To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 784
- compare with another revision
- download diff
- download tarball
- view history from revision 784
- Committer: Teddy Hogeborn
- Date: 2015-08-10 08:25:01 UTC
- Revision ID: teddy@recompile.se-20150810082501-rb7w2dre1flqiqe2
Refactor D-Bus annotation class out from D-Bus properties class.
* mandos (DBusObjectWithAnnotations): New; factored out D-Bus
annotations code from
DBusObjectWithProperties class.
(DBusObjectWithProperties): Inherit from DBusObjectWithAnnotations.
(main/MandosDBusService): - '' -
(main/MandosDBusService._foo): Removed interface annotation for
"o.f.D.Property.EmitsChangedSignal";
this object has no properties.
* mandos (DBusObjectWithAnnotations): New; factored out D-Bus
annotations code from
DBusObjectWithProperties class.
(DBusObjectWithProperties): Inherit from DBusObjectWithAnnotations.
(main/MandosDBusService): - '' -
(main/MandosDBusService._foo): Removed interface annotation for
"o.f.D.Property.EmitsChangedSignal";
this object has no properties.
- files added:
- debian/mandos-client.examples
- debian/upstream
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
69
78
import tempfile
70
79
import itertools
80
import collections
81
import codecs
71
82
72
83
import dbus
73
84
import dbus.service
74
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
75
89
import avahi
76
90
from dbus.mainloop.glib import DBusGMainLoop
77
91
import ctypes
78
92
import ctypes.util
79
93
import xml.dom.minidom
80
94
import inspect
81
import GnuPGInterface
82
95
83
96
try:
84
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
101
except ImportError:
89
102
SO_BINDTODEVICE = None
90
103
91
version = "1.5.3"
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
92
108
stored_state_file = "clients.pickle"
93
109
94
110
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
111
syslogger = None
98
112
99
113
try:
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
103
116
except (OSError, AttributeError):
117
104
118
def if_nametoindex(interface):
105
119
"Get an interface index the hard way, i.e. using fcntl()"
106
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
121
with contextlib.closing(socket.socket()) as s:
108
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
125
return interface_index
114
126
115
127
116
128
def initlogger(debug, level=logging.WARNING):
117
129
"""init logger and add loglevel"""
118
130
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
119
135
syslogger.setFormatter(logging.Formatter
120
136
('Mandos [%(process)d]: %(levelname)s:'
121
137
' %(message)s'))
138
154
139
155
class PGPEngine(object):
140
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
141
158
def __init__(self):
142
self.gnupg = GnuPGInterface.GnuPG()
143
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
148
'--quiet',
149
'--no-use-agent'])
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
162
'--force-mdc',
163
'--quiet',
164
'--no-use-agent']
150
165
151
166
def __enter__(self):
152
167
return self
153
168
154
def __exit__ (self, exc_type, exc_value, traceback):
169
def __exit__(self, exc_type, exc_value, traceback):
155
170
self._cleanup()
156
171
return False
157
172
174
189
def password_encode(self, password):
175
190
# Passphrase can not be empty and can not contain newlines or
176
191
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
198
return encoded
178
199
179
200
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
182
try:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
187
f.write(data)
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
190
proc.wait()
191
except IOError as e:
192
raise PGPError(e)
193
self.gnupg.passphrase = None
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
205
passfile.flush()
206
proc = subprocess.Popen(['gpg', '--symmetric',
207
'--passphrase-file',
208
passfile.name]
209
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
215
raise PGPError(err)
194
216
return ciphertext
195
217
196
218
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
199
try:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
204
f.write(data)
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
207
proc.wait()
208
except IOError as e:
209
raise PGPError(e)
210
self.gnupg.passphrase = None
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
223
passfile.flush()
224
proc = subprocess.Popen(['gpg', '--decrypt',
225
'--passphrase-file',
226
passfile.name]
227
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
233
raise PGPError(err)
211
234
return decrypted_plaintext
212
235
213
236
214
237
class AvahiError(Exception):
215
238
def __init__(self, value, *args, **kwargs):
216
239
self.value = value
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
220
243
221
244
class AvahiServiceError(AvahiError):
222
245
pass
223
246
247
224
248
class AvahiGroupError(AvahiError):
225
249
pass
226
250
233
257
Used to optionally bind to the specified interface.
234
258
name: string; Example: 'Mandos'
235
259
type: string; Example: '_mandos._tcp'.
236
See <http://www.dns-sd.org/ServiceTypes.html>
260
See <https://www.iana.org/assignments/service-names-port-numbers>
237
261
port: integer; what port to announce
238
262
TXT: list of strings; TXT record for the service
239
263
domain: string; Domain to publish on, default to .local if empty.
246
270
bus: dbus.SystemBus()
247
271
"""
248
272
249
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
servicetype = None, port = None, TXT = None,
251
domain = "", host = "", max_renames = 32768,
252
protocol = avahi.PROTO_UNSPEC, bus = None):
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
253
284
self.interface = interface
254
285
self.name = name
255
286
self.type = servicetype
265
296
self.bus = bus
266
297
self.entry_group_state_changed_match = None
267
298
268
def rename(self):
299
def rename(self, remove=True):
269
300
"""Derived from the Avahi example code"""
270
301
if self.rename_count >= self.max_renames:
271
302
logger.critical("No suitable Zeroconf service name found"
272
303
" after %i retries, exiting.",
273
304
self.rename_count)
274
305
raise AvahiServiceError("Too many renames")
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
277
309
logger.info("Changing Zeroconf service name to %r ...",
278
310
self.name)
279
self.remove()
311
if remove:
312
self.remove()
280
313
try:
281
314
self.add()
282
315
except dbus.exceptions.DBusException as error:
283
logger.critical("D-Bus Exception", exc_info=error)
284
self.cleanup()
285
os._exit(1)
286
self.rename_count += 1
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
287
324
288
325
def remove(self):
289
326
"""Derived from the Avahi example code"""
327
364
self.rename()
328
365
elif state == avahi.ENTRY_GROUP_FAILURE:
329
366
logger.critical("Avahi: Error in group state changed %s",
330
unicode(error))
331
raise AvahiGroupError("State changed: {0!s}"
332
.format(error))
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
333
369
334
370
def cleanup(self):
335
371
"""Derived from the Avahi example code"""
345
381
def server_state_changed(self, state, error=None):
346
382
"""Derived from the Avahi example code"""
347
383
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
355
390
if state in bad_states:
356
391
if bad_states[state] is not None:
357
392
if error is None:
360
395
logger.error(bad_states[state] + ": %r", error)
361
396
self.cleanup()
362
397
elif state == avahi.SERVER_RUNNING:
363
self.add()
398
try:
399
self.add()
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
404
" collision.")
405
return self.rename(remove=False)
406
else:
407
logger.critical("D-Bus Exception", exc_info=error)
408
self.cleanup()
409
os._exit(1)
364
410
else:
365
411
if error is None:
366
412
logger.debug("Unknown state: %r", state)
376
422
follow_name_owner_changes=True),
377
423
avahi.DBUS_INTERFACE_SERVER)
378
424
self.server.connect_to_signal("StateChanged",
379
self.server_state_changed)
425
self.server_state_changed)
380
426
self.server_state_changed(self.server.GetState())
381
427
428
382
429
class AvahiServiceToSyslog(AvahiService):
383
def rename(self):
430
def rename(self, *args, **kwargs):
384
431
"""Add the new name to the syslog messages"""
385
ret = AvahiService.rename(self)
386
syslogger.setFormatter(logging.Formatter
387
('Mandos ({0}) [%(process)d]:'
388
' %(levelname)s: %(message)s'
389
.format(self.name)))
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
.format(self.name)))
390
436
return ret
391
437
392
def timedelta_to_milliseconds(td):
393
"Convert a datetime.timedelta() to milliseconds"
394
return ((td.days * 24 * 60 * 60 * 1000)
395
+ (td.seconds * 1000)
396
+ (td.microseconds // 1000))
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
441
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
444
"""
445
connection.send(func(*args, **kwargs))
446
connection.close()
397
447
398
448
class Client(object):
399
449
"""A representation of a client host served by this server.
426
476
last_checker_status: integer between 0 and 255 reflecting exit
427
477
status of last checker. -1 reflects crashed
428
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
429
481
last_enabled: datetime.datetime(); (UTC) or None
430
482
name: string; from the config file, used in log messages and
431
483
D-Bus identifiers
436
488
runtime_expansions: Allowed attributes for runtime expansion.
437
489
expires: datetime.datetime(); time (UTC) when a client will be
438
490
disabled, or None
491
server_settings: The server_settings dict from main()
439
492
"""
440
493
441
494
runtime_expansions = ("approval_delay", "approval_duration",
442
"created", "enabled", "fingerprint",
443
"host", "interval", "last_checked_ok",
495
"created", "enabled", "expires",
496
"fingerprint", "host", "interval",
497
"last_approval_request", "last_checked_ok",
444
498
"last_enabled", "name", "timeout")
445
client_defaults = { "timeout": "5m",
446
"extended_timeout": "15m",
447
"interval": "2m",
448
"checker": "fping -q -- %%(host)s",
449
"host": "",
450
"approval_delay": "0s",
451
"approval_duration": "1s",
452
"approved_by_default": "True",
453
"enabled": "True",
454
}
455
456
def timeout_milliseconds(self):
457
"Return the 'timeout' attribute in milliseconds"
458
return timedelta_to_milliseconds(self.timeout)
459
460
def extended_timeout_milliseconds(self):
461
"Return the 'extended_timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.extended_timeout)
463
464
def interval_milliseconds(self):
465
"Return the 'interval' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.interval)
467
468
def approval_delay_milliseconds(self):
469
return timedelta_to_milliseconds(self.approval_delay)
499
client_defaults = {
500
"timeout": "PT5M",
501
"extended_timeout": "PT15M",
502
"interval": "PT2M",
503
"checker": "fping -q -- %%(host)s",
504
"host": "",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
508
"enabled": "True",
509
}
470
510
471
511
@staticmethod
472
512
def config_parser(config):
488
528
client["enabled"] = config.getboolean(client_name,
489
529
"enabled")
490
530
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
491
534
client["fingerprint"] = (section["fingerprint"].upper()
492
535
.replace(" ", ""))
493
536
if "secret" in section:
498
541
"rb") as secfile:
499
542
client["secret"] = secfile.read()
500
543
else:
501
raise TypeError("No secret or secfile for section {0}"
544
raise TypeError("No secret or secfile for section {}"
502
545
.format(section))
503
546
client["timeout"] = string_to_delta(section["timeout"])
504
547
client["extended_timeout"] = string_to_delta(
515
558
516
559
return settings
517
560
518
def __init__(self, settings, name = None):
561
def __init__(self, settings, name = None, server_settings=None):
519
562
self.name = name
563
if server_settings is None:
564
server_settings = {}
565
self.server_settings = server_settings
520
566
# adding all client settings
521
for setting, value in settings.iteritems():
567
for setting, value in settings.items():
522
568
setattr(self, setting, value)
523
569
524
570
if self.enabled:
532
578
self.expires = None
533
579
534
580
logger.debug("Creating client %r", self.name)
535
# Uppercase and remove spaces from fingerprint for later
536
# comparison purposes with return value from the fingerprint()
537
# function
538
581
logger.debug(" Fingerprint: %s", self.fingerprint)
539
582
self.created = settings.get("created",
540
583
datetime.datetime.utcnow())
547
590
self.current_checker_command = None
548
591
self.approved = None
549
592
self.approvals_pending = 0
550
self.changedstate = (multiprocessing_manager
551
.Condition(multiprocessing_manager
552
.Lock()))
553
self.client_structure = [attr for attr in
554
self.__dict__.iterkeys()
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
555
597
if not attr.startswith("_")]
556
598
self.client_structure.append("client_structure")
557
599
558
for name, t in inspect.getmembers(type(self),
559
lambda obj:
560
isinstance(obj,
561
property)):
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
562
602
if not name.startswith("_"):
563
603
self.client_structure.append(name)
564
604
572
612
if getattr(self, "enabled", False):
573
613
# Already enabled
574
614
return
575
self.send_changedstate()
576
615
self.expires = datetime.datetime.utcnow() + self.timeout
577
616
self.enabled = True
578
617
self.last_enabled = datetime.datetime.utcnow()
579
618
self.init_checker()
619
self.send_changedstate()
580
620
581
621
def disable(self, quiet=True):
582
622
"""Disable this client."""
583
623
if not getattr(self, "enabled", False):
584
624
return False
585
625
if not quiet:
586
self.send_changedstate()
587
if not quiet:
588
626
logger.info("Disabling client %s", self.name)
589
if getattr(self, "disable_initiator_tag", False):
627
if getattr(self, "disable_initiator_tag", None) is not None:
590
628
gobject.source_remove(self.disable_initiator_tag)
591
629
self.disable_initiator_tag = None
592
630
self.expires = None
593
if getattr(self, "checker_initiator_tag", False):
631
if getattr(self, "checker_initiator_tag", None) is not None:
594
632
gobject.source_remove(self.checker_initiator_tag)
595
633
self.checker_initiator_tag = None
596
634
self.stop_checker()
597
635
self.enabled = False
636
if not quiet:
637
self.send_changedstate()
598
638
# Do not run this again if called by a gobject.timeout_add
599
639
return False
600
640
604
644
def init_checker(self):
605
645
# Schedule a new checker to be started an 'interval' from now,
606
646
# and every interval from then on.
607
self.checker_initiator_tag = (gobject.timeout_add
608
(self.interval_milliseconds(),
609
self.start_checker))
647
if self.checker_initiator_tag is not None:
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
651
self.start_checker)
610
652
# Schedule a disable() when 'timeout' has passed
611
self.disable_initiator_tag = (gobject.timeout_add
612
(self.timeout_milliseconds(),
613
self.disable))
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
614
657
# Also start a new checker *right now*.
615
658
self.start_checker()
616
659
617
def checker_callback(self, pid, condition, command):
660
def checker_callback(self, source, condition, connection,
661
command):
618
662
"""The checker has completed, so take appropriate actions."""
619
663
self.checker_callback_tag = None
620
664
self.checker = None
621
if os.WIFEXITED(condition):
622
self.last_checker_status = os.WEXITSTATUS(condition)
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
667
connection.close()
668
669
if returncode >= 0:
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
623
672
if self.last_checker_status == 0:
624
673
logger.info("Checker for %(name)s succeeded",
625
674
vars(self))
626
675
self.checked_ok()
627
676
else:
628
logger.info("Checker for %(name)s failed",
629
vars(self))
677
logger.info("Checker for %(name)s failed", vars(self))
630
678
else:
631
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
632
681
logger.warning("Checker for %(name)s crashed?",
633
682
vars(self))
683
return False
634
684
635
685
def checked_ok(self):
636
686
"""Assert that the client has been seen, alive and well."""
637
687
self.last_checked_ok = datetime.datetime.utcnow()
638
688
self.last_checker_status = 0
689
self.last_checker_signal = None
639
690
self.bump_timeout()
640
691
641
692
def bump_timeout(self, timeout=None):
644
695
timeout = self.timeout
645
696
if self.disable_initiator_tag is not None:
646
697
gobject.source_remove(self.disable_initiator_tag)
698
self.disable_initiator_tag = None
647
699
if getattr(self, "enabled", False):
648
self.disable_initiator_tag = (gobject.timeout_add
649
(timedelta_to_milliseconds
650
(timeout), self.disable))
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
651
702
self.expires = datetime.datetime.utcnow() + timeout
652
703
653
704
def need_approval(self):
667
718
# than 'timeout' for the client to be disabled, which is as it
668
719
# should be.
669
720
670
# If a checker exists, make sure it is not a zombie
671
try:
672
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
673
except (AttributeError, OSError) as error:
674
if (isinstance(error, OSError)
675
and error.errno != errno.ECHILD):
676
raise error
677
else:
678
if pid:
679
logger.warning("Checker was a zombie")
680
gobject.source_remove(self.checker_callback_tag)
681
self.checker_callback(pid, status,
682
self.current_checker_command)
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
723
self.checker.join()
724
self.checker = None
683
725
# Start a new checker if needed
684
726
if self.checker is None:
727
# Escape attributes for the shell
728
escaped_attrs = {
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
685
731
try:
686
# In case checker_command has exactly one % operator
687
command = self.checker_command % self.host
688
except TypeError:
689
# Escape attributes for the shell
690
escaped_attrs = dict(
691
(attr,
692
re.escape(unicode(str(getattr(self, attr, "")),
693
errors=
694
'replace')))
695
for attr in
696
self.runtime_expansions)
697
698
try:
699
command = self.checker_command % escaped_attrs
700
except TypeError as error:
701
logger.error('Could not format string "%s"',
702
self.checker_command, exc_info=error)
703
return True # Try again later
732
command = self.checker_command % escaped_attrs
733
except TypeError as error:
734
logger.error('Could not format string "%s"',
735
self.checker_command,
736
exc_info=error)
737
return True # Try again later
704
738
self.current_checker_command = command
705
try:
706
logger.info("Starting checker %r for %s",
707
command, self.name)
708
# We don't need to redirect stdout and stderr, since
709
# in normal mode, that is already done by daemon(),
710
# and in debug mode we don't want to. (Stdin is
711
# always replaced by /dev/null.)
712
self.checker = subprocess.Popen(command,
713
close_fds=True,
714
shell=True, cwd="/")
715
self.checker_callback_tag = (gobject.child_watch_add
716
(self.checker.pid,
717
self.checker_callback,
718
data=command))
719
# The checker may have completed before the gobject
720
# watch was added. Check for this.
721
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
722
if pid:
723
gobject.source_remove(self.checker_callback_tag)
724
self.checker_callback(pid, status, command)
725
except OSError as error:
726
logger.error("Failed to start subprocess",
727
exc_info=error)
739
logger.info("Starting checker %r for %s", command,
740
self.name)
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
747
# created wnull.
748
popen_args = { "close_fds": True,
749
"shell": True,
750
"cwd": "/" }
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
754
"stderr": wnull })
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
757
target = call_pipe,
758
args = (pipe[1], subprocess.call, command),
759
kwargs = popen_args)
760
self.checker.start()
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
728
764
# Re-run this periodically if run by gobject.timeout_add
729
765
return True
730
766
736
772
if getattr(self, "checker", None) is None:
737
773
return
738
774
logger.debug("Stopping checker for %(name)s", vars(self))
739
try:
740
self.checker.terminate()
741
#time.sleep(0.5)
742
#if self.checker.poll() is None:
743
# self.checker.kill()
744
except OSError as error:
745
if error.errno != errno.ESRCH: # No such process
746
raise
775
self.checker.terminate()
747
776
self.checker = None
748
777
749
778
750
def dbus_service_property(dbus_interface, signature="v",
751
access="readwrite", byte_arrays=False):
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
752
783
"""Decorators for marking methods of a DBusObjectWithProperties to
753
784
become properties on the D-Bus.
754
785
763
794
# "Set" method, so we fail early here:
764
795
if byte_arrays and signature != "ay":
765
796
raise ValueError("Byte arrays not supported for non-'ay'"
766
" signature {0!r}".format(signature))
797
" signature {!r}".format(signature))
798
767
799
def decorator(func):
768
800
func._dbus_is_property = True
769
801
func._dbus_interface = dbus_interface
774
806
func._dbus_name = func._dbus_name[:-14]
775
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
776
808
return func
809
777
810
return decorator
778
811
779
812
788
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
789
822
"false"}
790
823
"""
824
791
825
def decorator(func):
792
826
func._dbus_is_interface = True
793
827
func._dbus_interface = dbus_interface
794
828
func._dbus_name = dbus_interface
795
829
return func
830
796
831
return decorator
797
832
798
833
800
835
"""Decorator to annotate D-Bus methods, signals or properties
801
836
Usage:
802
837
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
803
841
@dbus_service_property("org.example.Interface", signature="b",
804
842
access="r")
805
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
806
"org.freedesktop.DBus.Property."
807
"EmitsChangedSignal": "false"})
808
843
def Property_dbus_property(self):
809
844
return dbus.Boolean(False)
845
846
See also the DBusObjectWithAnnotations class.
810
847
"""
848
811
849
def decorator(func):
812
850
func._dbus_annotations = annotations
813
851
return func
852
814
853
return decorator
815
854
816
855
817
856
class DBusPropertyException(dbus.exceptions.DBusException):
818
857
"""A base class for D-Bus property-related exceptions
819
858
"""
820
def __unicode__(self):
821
return unicode(str(self))
859
pass
822
860
823
861
824
862
class DBusPropertyAccessException(DBusPropertyException):
833
871
pass
834
872
835
873
836
class DBusObjectWithProperties(dbus.service.Object):
837
"""A D-Bus object with properties.
874
class DBusObjectWithAnnotations(dbus.service.Object):
875
"""A D-Bus object with annotations.
838
876
839
Classes inheriting from this can use the dbus_service_property
840
decorator to expose methods as D-Bus properties. It exposes the
841
standard Get(), Set(), and GetAll() methods on the D-Bus.
877
Classes inheriting from this can use the dbus_annotations
878
decorator to add annotations to methods or signals.
842
879
"""
843
880
844
881
@staticmethod
848
885
If called like _is_dbus_thing("method") it returns a function
849
886
suitable for use as predicate to inspect.getmembers().
850
887
"""
851
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
852
889
False)
853
890
854
891
def _get_all_dbus_things(self, thing):
855
892
"""Returns a generator of (name, attribute) pairs
856
893
"""
857
return ((getattr(athing.__get__(self), "_dbus_name",
858
name),
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
859
895
athing.__get__(self))
860
896
for cls in self.__class__.__mro__
861
897
for name, athing in
862
inspect.getmembers(cls,
863
self._is_dbus_thing(thing)))
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
899
900
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
901
out_signature = "s",
902
path_keyword = 'object_path',
903
connection_keyword = 'connection')
904
def Introspect(self, object_path, connection):
905
"""Overloading of standard D-Bus method.
906
907
Inserts annotation tags on methods and signals.
908
"""
909
xmlstring = dbus.service.Object.Introspect(self, object_path,
910
connection)
911
try:
912
document = xml.dom.minidom.parseString(xmlstring)
913
914
for if_tag in document.getElementsByTagName("interface"):
915
# Add annotation tags
916
for typ in ("method", "signal"):
917
for tag in if_tag.getElementsByTagName(typ):
918
annots = dict()
919
for name, prop in (self.
920
_get_all_dbus_things(typ)):
921
if (name == tag.getAttribute("name")
922
and prop._dbus_interface
923
== if_tag.getAttribute("name")):
924
annots.update(getattr(
925
prop, "_dbus_annotations", {}))
926
for name, value in annots.items():
927
ann_tag = document.createElement(
928
"annotation")
929
ann_tag.setAttribute("name", name)
930
ann_tag.setAttribute("value", value)
931
tag.appendChild(ann_tag)
932
# Add interface annotation tags
933
for annotation, value in dict(
934
itertools.chain.from_iterable(
935
annotations().items()
936
for name, annotations
937
in self._get_all_dbus_things("interface")
938
if name == if_tag.getAttribute("name")
939
)).items():
940
ann_tag = document.createElement("annotation")
941
ann_tag.setAttribute("name", annotation)
942
ann_tag.setAttribute("value", value)
943
if_tag.appendChild(ann_tag)
944
# Fix argument name for the Introspect method itself
945
if (if_tag.getAttribute("name")
946
== dbus.INTROSPECTABLE_IFACE):
947
for cn in if_tag.getElementsByTagName("method"):
948
if cn.getAttribute("name") == "Introspect":
949
for arg in cn.getElementsByTagName("arg"):
950
if (arg.getAttribute("direction")
951
== "out"):
952
arg.setAttribute("name",
953
"xml_data")
954
xmlstring = document.toxml("utf-8")
955
document.unlink()
956
except (AttributeError, xml.dom.DOMException,
957
xml.parsers.expat.ExpatError) as error:
958
logger.error("Failed to override Introspection method",
959
exc_info=error)
960
return xmlstring
961
962
963
class DBusObjectWithProperties(DBusObjectWithAnnotations):
964
"""A D-Bus object with properties.
965
966
Classes inheriting from this can use the dbus_service_property
967
decorator to expose methods as D-Bus properties. It exposes the
968
standard Get(), Set(), and GetAll() methods on the D-Bus.
969
"""
864
970
865
971
def _get_dbus_property(self, interface_name, property_name):
866
972
"""Returns a bound method if one exists which is a D-Bus
867
973
property with the specified name and interface.
868
974
"""
869
for cls in self.__class__.__mro__:
870
for name, value in (inspect.getmembers
871
(cls,
872
self._is_dbus_thing("property"))):
975
for cls in self.__class__.__mro__:
976
for name, value in inspect.getmembers(
977
cls, self._is_dbus_thing("property")):
873
978
if (value._dbus_name == property_name
874
979
and value._dbus_interface == interface_name):
875
980
return value.__get__(self)
876
981
877
982
# No such property
878
raise DBusPropertyNotFound(self.dbus_object_path + ":"
879
+ interface_name + "."
880
+ property_name)
983
raise DBusPropertyNotFound("{}:{}.{}".format(
984
self.dbus_object_path, interface_name, property_name))
881
985
882
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
986
@dbus.service.method(dbus.PROPERTIES_IFACE,
987
in_signature="ss",
883
988
out_signature="v")
884
989
def Get(self, interface_name, property_name):
885
990
"""Standard D-Bus property Get() method, see D-Bus standard.
903
1008
# The byte_arrays option is not supported yet on
904
1009
# signatures other than "ay".
905
1010
if prop._dbus_signature != "ay":
906
raise ValueError
1011
raise ValueError("Byte arrays not supported for non-"
1012
"'ay' signature {!r}"
1013
.format(prop._dbus_signature))
907
1014
value = dbus.ByteArray(b''.join(chr(byte)
908
1015
for byte in value))
909
1016
prop(value)
910
1017
911
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1018
@dbus.service.method(dbus.PROPERTIES_IFACE,
1019
in_signature="s",
912
1020
out_signature="a{sv}")
913
1021
def GetAll(self, interface_name):
914
1022
"""Standard D-Bus property GetAll() method, see D-Bus
929
1037
if not hasattr(value, "variant_level"):
930
1038
properties[name] = value
931
1039
continue
932
properties[name] = type(value)(value, variant_level=
933
value.variant_level+1)
1040
properties[name] = type(value)(
1041
value, variant_level = value.variant_level + 1)
934
1042
return dbus.Dictionary(properties, signature="sv")
935
1043
1044
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1045
def PropertiesChanged(self, interface_name, changed_properties,
1046
invalidated_properties):
1047
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1048
standard.
1049
"""
1050
pass
1051
936
1052
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
937
1053
out_signature="s",
938
1054
path_keyword='object_path',
942
1058
943
1059
Inserts property tags and interface annotation tags.
944
1060
"""
945
xmlstring = dbus.service.Object.Introspect(self, object_path,
946
connection)
1061
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1062
object_path,
1063
connection)
947
1064
try:
948
1065
document = xml.dom.minidom.parseString(xmlstring)
1066
949
1067
def make_tag(document, name, prop):
950
1068
e = document.createElement("property")
951
1069
e.setAttribute("name", name)
952
1070
e.setAttribute("type", prop._dbus_signature)
953
1071
e.setAttribute("access", prop._dbus_access)
954
1072
return e
1073
955
1074
for if_tag in document.getElementsByTagName("interface"):
956
1075
# Add property tags
957
1076
for tag in (make_tag(document, name, prop)
960
1079
if prop._dbus_interface
961
1080
== if_tag.getAttribute("name")):
962
1081
if_tag.appendChild(tag)
963
# Add annotation tags
964
for typ in ("method", "signal", "property"):
965
for tag in if_tag.getElementsByTagName(typ):
966
annots = dict()
967
for name, prop in (self.
968
_get_all_dbus_things(typ)):
969
if (name == tag.getAttribute("name")
970
and prop._dbus_interface
971
== if_tag.getAttribute("name")):
972
annots.update(getattr
973
(prop,
974
"_dbus_annotations",
975
{}))
976
for name, value in annots.iteritems():
977
ann_tag = document.createElement(
978
"annotation")
979
ann_tag.setAttribute("name", name)
980
ann_tag.setAttribute("value", value)
981
tag.appendChild(ann_tag)
982
# Add interface annotation tags
983
for annotation, value in dict(
984
itertools.chain.from_iterable(
985
annotations().iteritems()
986
for name, annotations in
987
self._get_all_dbus_things("interface")
988
if name == if_tag.getAttribute("name")
989
)).iteritems():
990
ann_tag = document.createElement("annotation")
991
ann_tag.setAttribute("name", annotation)
992
ann_tag.setAttribute("value", value)
993
if_tag.appendChild(ann_tag)
1082
# Add annotation tags for properties
1083
for tag in if_tag.getElementsByTagName("property"):
1084
annots = dict()
1085
for name, prop in self._get_all_dbus_things(
1086
"property"):
1087
if (name == tag.getAttribute("name")
1088
and prop._dbus_interface
1089
== if_tag.getAttribute("name")):
1090
annots.update(getattr(
1091
prop, "_dbus_annotations", {}))
1092
for name, value in annots.items():
1093
ann_tag = document.createElement(
1094
"annotation")
1095
ann_tag.setAttribute("name", name)
1096
ann_tag.setAttribute("value", value)
1097
tag.appendChild(ann_tag)
994
1098
# Add the names to the return values for the
995
1099
# "org.freedesktop.DBus.Properties" methods
996
1100
if (if_tag.getAttribute("name")
1015
1119
return xmlstring
1016
1120
1017
1121
1018
def datetime_to_dbus (dt, variant_level=0):
1122
def datetime_to_dbus(dt, variant_level=0):
1019
1123
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1020
1124
if dt is None:
1021
1125
return dbus.String("", variant_level = variant_level)
1022
return dbus.String(dt.isoformat(),
1023
variant_level=variant_level)
1126
return dbus.String(dt.isoformat(), variant_level=variant_level)
1024
1127
1025
1128
1026
1129
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1029
1132
interface names according to the "alt_interface_names" mapping.
1030
1133
Usage:
1031
1134
1032
@alternate_dbus_names({"org.example.Interface":
1033
"net.example.AlternateInterface"})
1135
@alternate_dbus_interfaces({"org.example.Interface":
1136
"net.example.AlternateInterface"})
1034
1137
class SampleDBusObject(dbus.service.Object):
1035
1138
@dbus.service.method("org.example.Interface")
1036
1139
def SampleDBusMethod():
1046
1149
(from DBusObjectWithProperties) and interfaces (from the
1047
1150
dbus_interface_annotations decorator).
1048
1151
"""
1152
1049
1153
def wrapper(cls):
1050
1154
for orig_interface_name, alt_interface_name in (
1051
alt_interface_names.iteritems()):
1155
alt_interface_names.items()):
1052
1156
attr = {}
1053
1157
interface_names = set()
1054
1158
# Go though all attributes of the class
1056
1160
# Ignore non-D-Bus attributes, and D-Bus attributes
1057
1161
# with the wrong interface name
1058
1162
if (not hasattr(attribute, "_dbus_interface")
1059
or not attribute._dbus_interface
1060
.startswith(orig_interface_name)):
1163
or not attribute._dbus_interface.startswith(
1164
orig_interface_name)):
1061
1165
continue
1062
1166
# Create an alternate D-Bus interface name based on
1063
1167
# the current name
1064
alt_interface = (attribute._dbus_interface
1065
.replace(orig_interface_name,
1066
alt_interface_name))
1168
alt_interface = attribute._dbus_interface.replace(
1169
orig_interface_name, alt_interface_name)
1067
1170
interface_names.add(alt_interface)
1068
1171
# Is this a D-Bus signal?
1069
1172
if getattr(attribute, "_dbus_is_signal", False):
1070
# Extract the original non-method function by
1071
# black magic
1072
nonmethod_func = (dict(
1173
if sys.version_info.major == 2:
1174
# Extract the original non-method undecorated
1175
# function by black magic
1176
nonmethod_func = (dict(
1073
1177
zip(attribute.func_code.co_freevars,
1074
attribute.__closure__))["func"]
1075
.cell_contents)
1178
attribute.__closure__))
1179
["func"].cell_contents)
1180
else:
1181
nonmethod_func = attribute
1076
1182
# Create a new, but exactly alike, function
1077
1183
# object, and decorate it to be a new D-Bus signal
1078
1184
# with the alternate D-Bus interface name
1079
new_function = (dbus.service.signal
1080
(alt_interface,
1081
attribute._dbus_signature)
1082
(types.FunctionType(
1083
nonmethod_func.func_code,
1084
nonmethod_func.func_globals,
1085
nonmethod_func.func_name,
1086
nonmethod_func.func_defaults,
1087
nonmethod_func.func_closure)))
1185
if sys.version_info.major == 2:
1186
new_function = types.FunctionType(
1187
nonmethod_func.func_code,
1188
nonmethod_func.func_globals,
1189
nonmethod_func.func_name,
1190
nonmethod_func.func_defaults,
1191
nonmethod_func.func_closure)
1192
else:
1193
new_function = types.FunctionType(
1194
nonmethod_func.__code__,
1195
nonmethod_func.__globals__,
1196
nonmethod_func.__name__,
1197
nonmethod_func.__defaults__,
1198
nonmethod_func.__closure__)
1199
new_function = (dbus.service.signal(
1200
alt_interface,
1201
attribute._dbus_signature)(new_function))
1088
1202
# Copy annotations, if any
1089
1203
try:
1090
new_function._dbus_annotations = (
1091
dict(attribute._dbus_annotations))
1204
new_function._dbus_annotations = dict(
1205
attribute._dbus_annotations)
1092
1206
except AttributeError:
1093
1207
pass
1094
1208
# Define a creator of a function to call both the
1099
1213
"""This function is a scope container to pass
1100
1214
func1 and func2 to the "call_both" function
1101
1215
outside of its arguments"""
1216
1102
1217
def call_both(*args, **kwargs):
1103
1218
"""This function will emit two D-Bus
1104
1219
signals by calling func1 and func2"""
1105
1220
func1(*args, **kwargs)
1106
1221
func2(*args, **kwargs)
1222
1107
1223
return call_both
1108
1224
# Create the "call_both" function and add it to
1109
1225
# the class
1114
1230
# object. Decorate it to be a new D-Bus method
1115
1231
# with the alternate D-Bus interface name. Add it
1116
1232
# to the class.
1117
attr[attrname] = (dbus.service.method
1118
(alt_interface,
1119
attribute._dbus_in_signature,
1120
attribute._dbus_out_signature)
1121
(types.FunctionType
1122
(attribute.func_code,
1123
attribute.func_globals,
1124
attribute.func_name,
1125
attribute.func_defaults,
1126
attribute.func_closure)))
1233
attr[attrname] = (
1234
dbus.service.method(
1235
alt_interface,
1236
attribute._dbus_in_signature,
1237
attribute._dbus_out_signature)
1238
(types.FunctionType(attribute.func_code,
1239
attribute.func_globals,
1240
attribute.func_name,
1241
attribute.func_defaults,
1242
attribute.func_closure)))
1127
1243
# Copy annotations, if any
1128
1244
try:
1129
attr[attrname]._dbus_annotations = (
1130
dict(attribute._dbus_annotations))
1245
attr[attrname]._dbus_annotations = dict(
1246
attribute._dbus_annotations)
1131
1247
except AttributeError:
1132
1248
pass
1133
1249
# Is this a D-Bus property?
1136
1252
# object, and decorate it to be a new D-Bus
1137
1253
# property with the alternate D-Bus interface
1138
1254
# name. Add it to the class.
1139
attr[attrname] = (dbus_service_property
1140
(alt_interface,
1141
attribute._dbus_signature,
1142
attribute._dbus_access,
1143
attribute
1144
._dbus_get_args_options
1145
["byte_arrays"])
1146
(types.FunctionType
1147
(attribute.func_code,
1148
attribute.func_globals,
1149
attribute.func_name,
1150
attribute.func_defaults,
1151
attribute.func_closure)))
1255
attr[attrname] = (dbus_service_property(
1256
alt_interface, attribute._dbus_signature,
1257
attribute._dbus_access,
1258
attribute._dbus_get_args_options
1259
["byte_arrays"])
1260
(types.FunctionType(
1261
attribute.func_code,
1262
attribute.func_globals,
1263
attribute.func_name,
1264
attribute.func_defaults,
1265
attribute.func_closure)))
1152
1266
# Copy annotations, if any
1153
1267
try:
1154
attr[attrname]._dbus_annotations = (
1155
dict(attribute._dbus_annotations))
1268
attr[attrname]._dbus_annotations = dict(
1269
attribute._dbus_annotations)
1156
1270
except AttributeError:
1157
1271
pass
1158
1272
# Is this a D-Bus interface?
1161
1275
# object. Decorate it to be a new D-Bus interface
1162
1276
# with the alternate D-Bus interface name. Add it
1163
1277
# to the class.
1164
attr[attrname] = (dbus_interface_annotations
1165
(alt_interface)
1166
(types.FunctionType
1167
(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1278
attr[attrname] = (
1279
dbus_interface_annotations(alt_interface)
1280
(types.FunctionType(attribute.func_code,
1281
attribute.func_globals,
1282
attribute.func_name,
1283
attribute.func_defaults,
1284
attribute.func_closure)))
1172
1285
if deprecate:
1173
1286
# Deprecate all alternate interfaces
1174
iname="_AlternateDBusNames_interface_annotation{0}"
1287
iname="_AlternateDBusNames_interface_annotation{}"
1175
1288
for interface_name in interface_names:
1289
1176
1290
@dbus_interface_annotations(interface_name)
1177
1291
def func(self):
1178
1292
return { "org.freedesktop.DBus.Deprecated":
1179
"true" }
1293
"true" }
1180
1294
# Find an unused name
1181
1295
for aname in (iname.format(i)
1182
1296
for i in itertools.count()):
1186
1300
if interface_names:
1187
1301
# Replace the class with a new subclass of it with
1188
1302
# methods, signals, etc. as created above.
1189
cls = type(b"{0}Alternate".format(cls.__name__),
1190
(cls,), attr)
1303
cls = type(b"{}Alternate".format(cls.__name__),
1304
(cls, ), attr)
1191
1305
return cls
1306
1192
1307
return wrapper
1193
1308
1194
1309
1195
1310
@alternate_dbus_interfaces({"se.recompile.Mandos":
1196
"se.bsnet.fukt.Mandos"})
1311
"se.bsnet.fukt.Mandos"})
1197
1312
class ClientDBus(Client, DBusObjectWithProperties):
1198
1313
"""A Client class using D-Bus
1199
1314
1203
1318
"""
1204
1319
1205
1320
runtime_expansions = (Client.runtime_expansions
1206
+ ("dbus_object_path",))
1321
+ ("dbus_object_path", ))
1322
1323
_interface = "se.recompile.Mandos.Client"
1207
1324
1208
1325
# dbus.service.Object doesn't use super(), so we can't either.
1209
1326
1212
1329
Client.__init__(self, *args, **kwargs)
1213
1330
# Only now, when this client is initialized, can it show up on
1214
1331
# the D-Bus
1215
client_object_name = unicode(self.name).translate(
1332
client_object_name = str(self.name).translate(
1216
1333
{ord("."): ord("_"),
1217
1334
ord("-"): ord("_")})
1218
self.dbus_object_path = (dbus.ObjectPath
1219
("/clients/" + client_object_name))
1335
self.dbus_object_path = dbus.ObjectPath(
1336
"/clients/" + client_object_name)
1220
1337
DBusObjectWithProperties.__init__(self, self.bus,
1221
1338
self.dbus_object_path)
1222
1339
1223
def notifychangeproperty(transform_func,
1224
dbus_name, type_func=lambda x: x,
1225
variant_level=1):
1340
def notifychangeproperty(transform_func, dbus_name,
1341
type_func=lambda x: x,
1342
variant_level=1,
1343
invalidate_only=False,
1344
_interface=_interface):
1226
1345
""" Modify a variable so that it's a property which announces
1227
1346
its changes to DBus.
1228
1347
1233
1352
to the D-Bus. Default: no transform
1234
1353
variant_level: D-Bus variant level. Default: 1
1235
1354
"""
1236
attrname = "_{0}".format(dbus_name)
1355
attrname = "_{}".format(dbus_name)
1356
1237
1357
def setter(self, value):
1238
1358
if hasattr(self, "dbus_object_path"):
1239
1359
if (not hasattr(self, attrname) or
1240
1360
type_func(getattr(self, attrname, None))
1241
1361
!= type_func(value)):
1242
dbus_value = transform_func(type_func(value),
1243
variant_level
1244
=variant_level)
1245
self.PropertyChanged(dbus.String(dbus_name),
1246
dbus_value)
1362
if invalidate_only:
1363
self.PropertiesChanged(
1364
_interface, dbus.Dictionary(),
1365
dbus.Array((dbus_name, )))
1366
else:
1367
dbus_value = transform_func(
1368
type_func(value),
1369
variant_level = variant_level)
1370
self.PropertyChanged(dbus.String(dbus_name),
1371
dbus_value)
1372
self.PropertiesChanged(
1373
_interface,
1374
dbus.Dictionary({ dbus.String(dbus_name):
1375
dbus_value }),
1376
dbus.Array())
1247
1377
setattr(self, attrname, value)
1248
1378
1249
1379
return property(lambda self: getattr(self, attrname), setter)
1255
1385
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1256
1386
last_enabled = notifychangeproperty(datetime_to_dbus,
1257
1387
"LastEnabled")
1258
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1259
type_func = lambda checker:
1260
checker is not None)
1388
checker = notifychangeproperty(
1389
dbus.Boolean, "CheckerRunning",
1390
type_func = lambda checker: checker is not None)
1261
1391
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1262
1392
"LastCheckedOK")
1263
1393
last_checker_status = notifychangeproperty(dbus.Int16,
1266
1396
datetime_to_dbus, "LastApprovalRequest")
1267
1397
approved_by_default = notifychangeproperty(dbus.Boolean,
1268
1398
"ApprovedByDefault")
1269
approval_delay = notifychangeproperty(dbus.UInt64,
1270
"ApprovalDelay",
1271
type_func =
1272
timedelta_to_milliseconds)
1399
approval_delay = notifychangeproperty(
1400
dbus.UInt64, "ApprovalDelay",
1401
type_func = lambda td: td.total_seconds() * 1000)
1273
1402
approval_duration = notifychangeproperty(
1274
1403
dbus.UInt64, "ApprovalDuration",
1275
type_func = timedelta_to_milliseconds)
1404
type_func = lambda td: td.total_seconds() * 1000)
1276
1405
host = notifychangeproperty(dbus.String, "Host")
1277
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1278
type_func =
1279
timedelta_to_milliseconds)
1406
timeout = notifychangeproperty(
1407
dbus.UInt64, "Timeout",
1408
type_func = lambda td: td.total_seconds() * 1000)
1280
1409
extended_timeout = notifychangeproperty(
1281
1410
dbus.UInt64, "ExtendedTimeout",
1282
type_func = timedelta_to_milliseconds)
1283
interval = notifychangeproperty(dbus.UInt64,
1284
"Interval",
1285
type_func =
1286
timedelta_to_milliseconds)
1411
type_func = lambda td: td.total_seconds() * 1000)
1412
interval = notifychangeproperty(
1413
dbus.UInt64, "Interval",
1414
type_func = lambda td: td.total_seconds() * 1000)
1287
1415
checker_command = notifychangeproperty(dbus.String, "Checker")
1416
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1417
invalidate_only=True)
1288
1418
1289
1419
del notifychangeproperty
1290
1420
1297
1427
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1298
1428
Client.__del__(self, *args, **kwargs)
1299
1429
1300
def checker_callback(self, pid, condition, command,
1301
*args, **kwargs):
1302
self.checker_callback_tag = None
1303
self.checker = None
1304
if os.WIFEXITED(condition):
1305
exitstatus = os.WEXITSTATUS(condition)
1430
def checker_callback(self, source, condition,
1431
connection, command, *args, **kwargs):
1432
ret = Client.checker_callback(self, source, condition,
1433
connection, command, *args,
1434
**kwargs)
1435
exitstatus = self.last_checker_status
1436
if exitstatus >= 0:
1306
1437
# Emit D-Bus signal
1307
1438
self.CheckerCompleted(dbus.Int16(exitstatus),
1308
dbus.Int64(condition),
1439
# This is specific to GNU libC
1440
dbus.Int64(exitstatus << 8),
1309
1441
dbus.String(command))
1310
1442
else:
1311
1443
# Emit D-Bus signal
1312
1444
self.CheckerCompleted(dbus.Int16(-1),
1313
dbus.Int64(condition),
1445
dbus.Int64(
1446
# This is specific to GNU libC
1447
(exitstatus << 8)
1448
| self.last_checker_signal),
1314
1449
dbus.String(command))
1315
1316
return Client.checker_callback(self, pid, condition, command,
1317
*args, **kwargs)
1450
return ret
1318
1451
1319
1452
def start_checker(self, *args, **kwargs):
1320
old_checker = self.checker
1321
if self.checker is not None:
1322
old_checker_pid = self.checker.pid
1323
else:
1324
old_checker_pid = None
1453
old_checker_pid = getattr(self.checker, "pid", None)
1325
1454
r = Client.start_checker(self, *args, **kwargs)
1326
1455
# Only if new checker process was started
1327
1456
if (self.checker is not None
1335
1464
return False
1336
1465
1337
1466
def approve(self, value=True):
1338
self.send_changedstate()
1339
1467
self.approved = value
1340
gobject.timeout_add(timedelta_to_milliseconds
1341
(self.approval_duration),
1342
self._reset_approved)
1468
gobject.timeout_add(int(self.approval_duration.total_seconds()
1469
* 1000), self._reset_approved)
1470
self.send_changedstate()
1343
1471
1344
1472
## D-Bus methods, signals & properties
1345
_interface = "se.recompile.Mandos.Client"
1346
1473
1347
1474
## Interfaces
1348
1475
1349
@dbus_interface_annotations(_interface)
1350
def _foo(self):
1351
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1352
"false"}
1353
1354
1476
## Signals
1355
1477
1356
1478
# CheckerCompleted - signal
1366
1488
pass
1367
1489
1368
1490
# PropertyChanged - signal
1491
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1369
1492
@dbus.service.signal(_interface, signature="sv")
1370
1493
def PropertyChanged(self, property, value):
1371
1494
"D-Bus signal"
1405
1528
self.checked_ok()
1406
1529
1407
1530
# Enable - method
1531
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1408
1532
@dbus.service.method(_interface)
1409
1533
def Enable(self):
1410
1534
"D-Bus method"
1411
1535
self.enable()
1412
1536
1413
1537
# StartChecker - method
1538
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1414
1539
@dbus.service.method(_interface)
1415
1540
def StartChecker(self):
1416
1541
"D-Bus method"
1417
1542
self.start_checker()
1418
1543
1419
1544
# Disable - method
1545
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1420
1546
@dbus.service.method(_interface)
1421
1547
def Disable(self):
1422
1548
"D-Bus method"
1423
1549
self.disable()
1424
1550
1425
1551
# StopChecker - method
1552
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1426
1553
@dbus.service.method(_interface)
1427
1554
def StopChecker(self):
1428
1555
self.stop_checker()
1435
1562
return dbus.Boolean(bool(self.approvals_pending))
1436
1563
1437
1564
# ApprovedByDefault - property
1438
@dbus_service_property(_interface, signature="b",
1565
@dbus_service_property(_interface,
1566
signature="b",
1439
1567
access="readwrite")
1440
1568
def ApprovedByDefault_dbus_property(self, value=None):
1441
1569
if value is None: # get
1443
1571
self.approved_by_default = bool(value)
1444
1572
1445
1573
# ApprovalDelay - property
1446
@dbus_service_property(_interface, signature="t",
1574
@dbus_service_property(_interface,
1575
signature="t",
1447
1576
access="readwrite")
1448
1577
def ApprovalDelay_dbus_property(self, value=None):
1449
1578
if value is None: # get
1450
return dbus.UInt64(self.approval_delay_milliseconds())
1579
return dbus.UInt64(self.approval_delay.total_seconds()
1580
* 1000)
1451
1581
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1452
1582
1453
1583
# ApprovalDuration - property
1454
@dbus_service_property(_interface, signature="t",
1584
@dbus_service_property(_interface,
1585
signature="t",
1455
1586
access="readwrite")
1456
1587
def ApprovalDuration_dbus_property(self, value=None):
1457
1588
if value is None: # get
1458
return dbus.UInt64(timedelta_to_milliseconds(
1459
self.approval_duration))
1589
return dbus.UInt64(self.approval_duration.total_seconds()
1590
* 1000)
1460
1591
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1461
1592
1462
1593
# Name - property
1594
@dbus_annotations(
1595
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1463
1596
@dbus_service_property(_interface, signature="s", access="read")
1464
1597
def Name_dbus_property(self):
1465
1598
return dbus.String(self.name)
1466
1599
1467
1600
# Fingerprint - property
1601
@dbus_annotations(
1602
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1468
1603
@dbus_service_property(_interface, signature="s", access="read")
1469
1604
def Fingerprint_dbus_property(self):
1470
1605
return dbus.String(self.fingerprint)
1471
1606
1472
1607
# Host - property
1473
@dbus_service_property(_interface, signature="s",
1608
@dbus_service_property(_interface,
1609
signature="s",
1474
1610
access="readwrite")
1475
1611
def Host_dbus_property(self, value=None):
1476
1612
if value is None: # get
1477
1613
return dbus.String(self.host)
1478
self.host = unicode(value)
1614
self.host = str(value)
1479
1615
1480
1616
# Created - property
1617
@dbus_annotations(
1618
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1481
1619
@dbus_service_property(_interface, signature="s", access="read")
1482
1620
def Created_dbus_property(self):
1483
1621
return datetime_to_dbus(self.created)
1488
1626
return datetime_to_dbus(self.last_enabled)
1489
1627
1490
1628
# Enabled - property
1491
@dbus_service_property(_interface, signature="b",
1629
@dbus_service_property(_interface,
1630
signature="b",
1492
1631
access="readwrite")
1493
1632
def Enabled_dbus_property(self, value=None):
1494
1633
if value is None: # get
1499
1638
self.disable()
1500
1639
1501
1640
# LastCheckedOK - property
1502
@dbus_service_property(_interface, signature="s",
1641
@dbus_service_property(_interface,
1642
signature="s",
1503
1643
access="readwrite")
1504
1644
def LastCheckedOK_dbus_property(self, value=None):
1505
1645
if value is not None:
1508
1648
return datetime_to_dbus(self.last_checked_ok)
1509
1649
1510
1650
# LastCheckerStatus - property
1511
@dbus_service_property(_interface, signature="n",
1512
access="read")
1651
@dbus_service_property(_interface, signature="n", access="read")
1513
1652
def LastCheckerStatus_dbus_property(self):
1514
1653
return dbus.Int16(self.last_checker_status)
1515
1654
1524
1663
return datetime_to_dbus(self.last_approval_request)
1525
1664
1526
1665
# Timeout - property
1527
@dbus_service_property(_interface, signature="t",
1666
@dbus_service_property(_interface,
1667
signature="t",
1528
1668
access="readwrite")
1529
1669
def Timeout_dbus_property(self, value=None):
1530
1670
if value is None: # get
1531
return dbus.UInt64(self.timeout_milliseconds())
1671
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1672
old_timeout = self.timeout
1532
1673
self.timeout = datetime.timedelta(0, 0, 0, value)
1533
# Reschedule timeout
1674
# Reschedule disabling
1534
1675
if self.enabled:
1535
1676
now = datetime.datetime.utcnow()
1536
time_to_die = timedelta_to_milliseconds(
1537
(self.last_checked_ok + self.timeout) - now)
1538
if time_to_die <= 0:
1677
self.expires += self.timeout - old_timeout
1678
if self.expires <= now:
1539
1679
# The timeout has passed
1540
1680
self.disable()
1541
1681
else:
1542
self.expires = (now +
1543
datetime.timedelta(milliseconds =
1544
time_to_die))
1545
1682
if (getattr(self, "disable_initiator_tag", None)
1546
1683
is None):
1547
1684
return
1548
1685
gobject.source_remove(self.disable_initiator_tag)
1549
self.disable_initiator_tag = (gobject.timeout_add
1550
(time_to_die,
1551
self.disable))
1686
self.disable_initiator_tag = gobject.timeout_add(
1687
int((self.expires - now).total_seconds() * 1000),
1688
self.disable)
1552
1689
1553
1690
# ExtendedTimeout - property
1554
@dbus_service_property(_interface, signature="t",
1691
@dbus_service_property(_interface,
1692
signature="t",
1555
1693
access="readwrite")
1556
1694
def ExtendedTimeout_dbus_property(self, value=None):
1557
1695
if value is None: # get
1558
return dbus.UInt64(self.extended_timeout_milliseconds())
1696
return dbus.UInt64(self.extended_timeout.total_seconds()
1697
* 1000)
1559
1698
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1560
1699
1561
1700
# Interval - property
1562
@dbus_service_property(_interface, signature="t",
1701
@dbus_service_property(_interface,
1702
signature="t",
1563
1703
access="readwrite")
1564
1704
def Interval_dbus_property(self, value=None):
1565
1705
if value is None: # get
1566
return dbus.UInt64(self.interval_milliseconds())
1706
return dbus.UInt64(self.interval.total_seconds() * 1000)
1567
1707
self.interval = datetime.timedelta(0, 0, 0, value)
1568
1708
if getattr(self, "checker_initiator_tag", None) is None:
1569
1709
return
1570
1710
if self.enabled:
1571
1711
# Reschedule checker run
1572
1712
gobject.source_remove(self.checker_initiator_tag)
1573
self.checker_initiator_tag = (gobject.timeout_add
1574
(value, self.start_checker))
1575
self.start_checker() # Start one now, too
1713
self.checker_initiator_tag = gobject.timeout_add(
1714
value, self.start_checker)
1715
self.start_checker() # Start one now, too
1576
1716
1577
1717
# Checker - property
1578
@dbus_service_property(_interface, signature="s",
1718
@dbus_service_property(_interface,
1719
signature="s",
1579
1720
access="readwrite")
1580
1721
def Checker_dbus_property(self, value=None):
1581
1722
if value is None: # get
1582
1723
return dbus.String(self.checker_command)
1583
self.checker_command = unicode(value)
1724
self.checker_command = str(value)
1584
1725
1585
1726
# CheckerRunning - property
1586
@dbus_service_property(_interface, signature="b",
1727
@dbus_service_property(_interface,
1728
signature="b",
1587
1729
access="readwrite")
1588
1730
def CheckerRunning_dbus_property(self, value=None):
1589
1731
if value is None: # get
1594
1736
self.stop_checker()
1595
1737
1596
1738
# ObjectPath - property
1739
@dbus_annotations(
1740
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
1741
"org.freedesktop.DBus.Deprecated": "true"})
1597
1742
@dbus_service_property(_interface, signature="o", access="read")
1598
1743
def ObjectPath_dbus_property(self):
1599
1744
return self.dbus_object_path # is already a dbus.ObjectPath
1600
1745
1601
1746
# Secret = property
1602
@dbus_service_property(_interface, signature="ay",
1603
access="write", byte_arrays=True)
1747
@dbus_annotations(
1748
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
1749
"invalidates"})
1750
@dbus_service_property(_interface,
1751
signature="ay",
1752
access="write",
1753
byte_arrays=True)
1604
1754
def Secret_dbus_property(self, value):
1605
self.secret = str(value)
1755
self.secret = bytes(value)
1606
1756
1607
1757
del _interface
1608
1758
1612
1762
self._pipe = child_pipe
1613
1763
self._pipe.send(('init', fpr, address))
1614
1764
if not self._pipe.recv():
1615
raise KeyError()
1765
raise KeyError(fpr)
1616
1766
1617
1767
def __getattribute__(self, name):
1618
1768
if name == '_pipe':
1622
1772
if data[0] == 'data':
1623
1773
return data[1]
1624
1774
if data[0] == 'function':
1775
1625
1776
def func(*args, **kwargs):
1626
1777
self._pipe.send(('funcall', name, args, kwargs))
1627
1778
return self._pipe.recv()[1]
1779
1628
1780
return func
1629
1781
1630
1782
def __setattr__(self, name, value):
1642
1794
def handle(self):
1643
1795
with contextlib.closing(self.server.child_pipe) as child_pipe:
1644
1796
logger.info("TCP connection from: %s",
1645
unicode(self.client_address))
1797
str(self.client_address))
1646
1798
logger.debug("Pipe FD: %d",
1647
1799
self.server.child_pipe.fileno())
1648
1800
1649
session = (gnutls.connection
1650
.ClientSession(self.request,
1651
gnutls.connection
1652
.X509Credentials()))
1801
session = gnutls.connection.ClientSession(
1802
self.request, gnutls.connection .X509Credentials())
1653
1803
1654
1804
# Note: gnutls.connection.X509Credentials is really a
1655
1805
# generic GnuTLS certificate credentials object so long as
1664
1814
priority = self.server.gnutls_priority
1665
1815
if priority is None:
1666
1816
priority = "NORMAL"
1667
(gnutls.library.functions
1668
.gnutls_priority_set_direct(session._c_object,
1669
priority, None))
1817
gnutls.library.functions.gnutls_priority_set_direct(
1818
session._c_object, priority, None)
1670
1819
1671
1820
# Start communication using the Mandos protocol
1672
1821
# Get protocol number
1674
1823
logger.debug("Protocol version: %r", line)
1675
1824
try:
1676
1825
if int(line.strip().split()[0]) > 1:
1677
raise RuntimeError
1826
raise RuntimeError(line)
1678
1827
except (ValueError, IndexError, RuntimeError) as error:
1679
1828
logger.error("Unknown protocol version: %s", error)
1680
1829
return
1692
1841
approval_required = False
1693
1842
try:
1694
1843
try:
1695
fpr = self.fingerprint(self.peer_certificate
1696
(session))
1844
fpr = self.fingerprint(
1845
self.peer_certificate(session))
1697
1846
except (TypeError,
1698
1847
gnutls.errors.GNUTLSError) as error:
1699
1848
logger.warning("Bad certificate: %s", error)
1714
1863
while True:
1715
1864
if not client.enabled:
1716
1865
logger.info("Client %s is disabled",
1717
client.name)
1866
client.name)
1718
1867
if self.server.use_dbus:
1719
1868
# Emit D-Bus signal
1720
1869
client.Rejected("Disabled")
1729
1878
if self.server.use_dbus:
1730
1879
# Emit D-Bus signal
1731
1880
client.NeedApproval(
1732
client.approval_delay_milliseconds(),
1733
client.approved_by_default)
1881
client.approval_delay.total_seconds()
1882
* 1000, client.approved_by_default)
1734
1883
else:
1735
1884
logger.warning("Client %s was not approved",
1736
1885
client.name)
1742
1891
#wait until timeout or approved
1743
1892
time = datetime.datetime.now()
1744
1893
client.changedstate.acquire()
1745
(client.changedstate.wait
1746
(float(client.timedelta_to_milliseconds(delay)
1747
/ 1000)))
1894
client.changedstate.wait(delay.total_seconds())
1748
1895
client.changedstate.release()
1749
1896
time2 = datetime.datetime.now()
1750
1897
if (time2 - time) >= delay:
1769
1916
logger.warning("gnutls send failed",
1770
1917
exc_info=error)
1771
1918
return
1772
logger.debug("Sent: %d, remaining: %d",
1773
sent, len(client.secret)
1774
- (sent_size + sent))
1919
logger.debug("Sent: %d, remaining: %d", sent,
1920
len(client.secret) - (sent_size
1921
+ sent))
1775
1922
sent_size += sent
1776
1923
1777
1924
logger.info("Sending secret to %s", client.name)
1794
1941
def peer_certificate(session):
1795
1942
"Return the peer's OpenPGP certificate as a bytestring"
1796
1943
# If not an OpenPGP certificate...
1797
if (gnutls.library.functions
1798
.gnutls_certificate_type_get(session._c_object)
1944
if (gnutls.library.functions.gnutls_certificate_type_get(
1945
session._c_object)
1799
1946
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1800
1947
# ...do the normal thing
1801
1948
return session.peer_certificate
1815
1962
def fingerprint(openpgp):
1816
1963
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1817
1964
# New GnuTLS "datum" with the OpenPGP public key
1818
datum = (gnutls.library.types
1819
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1820
ctypes.POINTER
1821
(ctypes.c_ubyte)),
1822
ctypes.c_uint(len(openpgp))))
1965
datum = gnutls.library.types.gnutls_datum_t(
1966
ctypes.cast(ctypes.c_char_p(openpgp),
1967
ctypes.POINTER(ctypes.c_ubyte)),
1968
ctypes.c_uint(len(openpgp)))
1823
1969
# New empty GnuTLS certificate
1824
1970
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1825
(gnutls.library.functions
1826
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1971
gnutls.library.functions.gnutls_openpgp_crt_init(
1972
ctypes.byref(crt))
1827
1973
# Import the OpenPGP public key into the certificate
1828
(gnutls.library.functions
1829
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1830
gnutls.library.constants
1831
.GNUTLS_OPENPGP_FMT_RAW))
1974
gnutls.library.functions.gnutls_openpgp_crt_import(
1975
crt, ctypes.byref(datum),
1976
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1832
1977
# Verify the self signature in the key
1833
1978
crtverify = ctypes.c_uint()
1834
(gnutls.library.functions
1835
.gnutls_openpgp_crt_verify_self(crt, 0,
1836
ctypes.byref(crtverify)))
1979
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1980
crt, 0, ctypes.byref(crtverify))
1837
1981
if crtverify.value != 0:
1838
1982
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1839
raise (gnutls.errors.CertificateSecurityError
1840
("Verify failed"))
1983
raise gnutls.errors.CertificateSecurityError(
1984
"Verify failed")
1841
1985
# New buffer for the fingerprint
1842
1986
buf = ctypes.create_string_buffer(20)
1843
1987
buf_len = ctypes.c_size_t()
1844
1988
# Get the fingerprint from the certificate into the buffer
1845
(gnutls.library.functions
1846
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1847
ctypes.byref(buf_len)))
1989
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1990
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1848
1991
# Deinit the certificate
1849
1992
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1850
1993
# Convert the buffer to a Python bytestring
1856
1999
1857
2000
class MultiprocessingMixIn(object):
1858
2001
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2002
1859
2003
def sub_process_main(self, request, address):
1860
2004
try:
1861
2005
self.finish_request(request, address)
1873
2017
1874
2018
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1875
2019
""" adds a pipe to the MixIn """
2020
1876
2021
def process_request(self, request, client_address):
1877
2022
"""Overrides and wraps the original process_request().
1878
2023
1887
2032
1888
2033
def add_pipe(self, parent_pipe, proc):
1889
2034
"""Dummy function; override as necessary"""
1890
raise NotImplementedError
2035
raise NotImplementedError()
1891
2036
1892
2037
1893
2038
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1899
2044
interface: None or a network interface name (string)
1900
2045
use_ipv6: Boolean; to use IPv6 or not
1901
2046
"""
2047
1902
2048
def __init__(self, server_address, RequestHandlerClass,
1903
interface=None, use_ipv6=True):
2049
interface=None,
2050
use_ipv6=True,
2051
socketfd=None):
2052
"""If socketfd is set, use that file descriptor instead of
2053
creating a new one with socket.socket().
2054
"""
1904
2055
self.interface = interface
1905
2056
if use_ipv6:
1906
2057
self.address_family = socket.AF_INET6
2058
if socketfd is not None:
2059
# Save the file descriptor
2060
self.socketfd = socketfd
2061
# Save the original socket.socket() function
2062
self.socket_socket = socket.socket
2063
# To implement --socket, we monkey patch socket.socket.
2064
#
2065
# (When socketserver.TCPServer is a new-style class, we
2066
# could make self.socket into a property instead of monkey
2067
# patching socket.socket.)
2068
#
2069
# Create a one-time-only replacement for socket.socket()
2070
@functools.wraps(socket.socket)
2071
def socket_wrapper(*args, **kwargs):
2072
# Restore original function so subsequent calls are
2073
# not affected.
2074
socket.socket = self.socket_socket
2075
del self.socket_socket
2076
# This time only, return a new socket object from the
2077
# saved file descriptor.
2078
return socket.fromfd(self.socketfd, *args, **kwargs)
2079
# Replace socket.socket() function with wrapper
2080
socket.socket = socket_wrapper
2081
# The socketserver.TCPServer.__init__ will call
2082
# socket.socket(), which might be our replacement,
2083
# socket_wrapper(), if socketfd was set.
1907
2084
socketserver.TCPServer.__init__(self, server_address,
1908
2085
RequestHandlerClass)
2086
1909
2087
def server_bind(self):
1910
2088
"""This overrides the normal server_bind() function
1911
2089
to bind to an interface if one was specified, and also NOT to
1917
2095
self.interface)
1918
2096
else:
1919
2097
try:
1920
self.socket.setsockopt(socket.SOL_SOCKET,
1921
SO_BINDTODEVICE,
1922
str(self.interface
1923
+ '\0'))
2098
self.socket.setsockopt(
2099
socket.SOL_SOCKET, SO_BINDTODEVICE,
2100
(self.interface + "\0").encode("utf-8"))
1924
2101
except socket.error as error:
1925
if error[0] == errno.EPERM:
1926
logger.error("No permission to"
1927
" bind to interface %s",
1928
self.interface)
1929
elif error[0] == errno.ENOPROTOOPT:
2102
if error.errno == errno.EPERM:
2103
logger.error("No permission to bind to"
2104
" interface %s", self.interface)
2105
elif error.errno == errno.ENOPROTOOPT:
1930
2106
logger.error("SO_BINDTODEVICE not available;"
1931
2107
" cannot bind to interface %s",
1932
2108
self.interface)
2109
elif error.errno == errno.ENODEV:
2110
logger.error("Interface %s does not exist,"
2111
" cannot bind", self.interface)
1933
2112
else:
1934
2113
raise
1935
2114
# Only bind(2) the socket if we really need to.
1938
2117
if self.address_family == socket.AF_INET6:
1939
2118
any_address = "::" # in6addr_any
1940
2119
else:
1941
any_address = socket.INADDR_ANY
2120
any_address = "0.0.0.0" # INADDR_ANY
1942
2121
self.server_address = (any_address,
1943
2122
self.server_address[1])
1944
2123
elif not self.server_address[1]:
1945
self.server_address = (self.server_address[0],
1946
0)
2124
self.server_address = (self.server_address[0], 0)
1947
2125
# if self.interface:
1948
2126
# self.server_address = (self.server_address[0],
1949
2127
# 0, # port
1963
2141
1964
2142
Assumes a gobject.MainLoop event loop.
1965
2143
"""
2144
1966
2145
def __init__(self, server_address, RequestHandlerClass,
1967
interface=None, use_ipv6=True, clients=None,
1968
gnutls_priority=None, use_dbus=True):
2146
interface=None,
2147
use_ipv6=True,
2148
clients=None,
2149
gnutls_priority=None,
2150
use_dbus=True,
2151
socketfd=None):
1969
2152
self.enabled = False
1970
2153
self.clients = clients
1971
2154
if self.clients is None:
1975
2158
IPv6_TCPServer.__init__(self, server_address,
1976
2159
RequestHandlerClass,
1977
2160
interface = interface,
1978
use_ipv6 = use_ipv6)
2161
use_ipv6 = use_ipv6,
2162
socketfd = socketfd)
2163
1979
2164
def server_activate(self):
1980
2165
if self.enabled:
1981
2166
return socketserver.TCPServer.server_activate(self)
1985
2170
1986
2171
def add_pipe(self, parent_pipe, proc):
1987
2172
# Call "handle_ipc" for both data and EOF events
1988
gobject.io_add_watch(parent_pipe.fileno(),
1989
gobject.IO_IN | gobject.IO_HUP,
1990
functools.partial(self.handle_ipc,
1991
parent_pipe =
1992
parent_pipe,
1993
proc = proc))
2173
gobject.io_add_watch(
2174
parent_pipe.fileno(),
2175
gobject.IO_IN | gobject.IO_HUP,
2176
functools.partial(self.handle_ipc,
2177
parent_pipe = parent_pipe,
2178
proc = proc))
1994
2179
1995
def handle_ipc(self, source, condition, parent_pipe=None,
1996
proc = None, client_object=None):
2180
def handle_ipc(self, source, condition,
2181
parent_pipe=None,
2182
proc = None,
2183
client_object=None):
1997
2184
# error, or the other end of multiprocessing.Pipe has closed
1998
2185
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1999
2186
# Wait for other process to exit
2022
2209
parent_pipe.send(False)
2023
2210
return False
2024
2211
2025
gobject.io_add_watch(parent_pipe.fileno(),
2026
gobject.IO_IN | gobject.IO_HUP,
2027
functools.partial(self.handle_ipc,
2028
parent_pipe =
2029
parent_pipe,
2030
proc = proc,
2031
client_object =
2032
client))
2212
gobject.io_add_watch(
2213
parent_pipe.fileno(),
2214
gobject.IO_IN | gobject.IO_HUP,
2215
functools.partial(self.handle_ipc,
2216
parent_pipe = parent_pipe,
2217
proc = proc,
2218
client_object = client))
2033
2219
parent_pipe.send(True)
2034
2220
# remove the old hook in favor of the new above hook on
2035
2221
# same fileno
2041
2227
2042
2228
parent_pipe.send(('data', getattr(client_object,
2043
2229
funcname)(*args,
2044
**kwargs)))
2230
**kwargs)))
2045
2231
2046
2232
if command == 'getattr':
2047
2233
attrname = request[1]
2048
if callable(client_object.__getattribute__(attrname)):
2049
parent_pipe.send(('function',))
2234
if isinstance(client_object.__getattribute__(attrname),
2235
collections.Callable):
2236
parent_pipe.send(('function', ))
2050
2237
else:
2051
parent_pipe.send(('data', client_object
2052
.__getattribute__(attrname)))
2238
parent_pipe.send((
2239
'data', client_object.__getattribute__(attrname)))
2053
2240
2054
2241
if command == 'setattr':
2055
2242
attrname = request[1]
2059
2246
return True
2060
2247
2061
2248
2249
def rfc3339_duration_to_delta(duration):
2250
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2251
2252
>>> rfc3339_duration_to_delta("P7D")
2253
datetime.timedelta(7)
2254
>>> rfc3339_duration_to_delta("PT60S")
2255
datetime.timedelta(0, 60)
2256
>>> rfc3339_duration_to_delta("PT60M")
2257
datetime.timedelta(0, 3600)
2258
>>> rfc3339_duration_to_delta("PT24H")
2259
datetime.timedelta(1)
2260
>>> rfc3339_duration_to_delta("P1W")
2261
datetime.timedelta(7)
2262
>>> rfc3339_duration_to_delta("PT5M30S")
2263
datetime.timedelta(0, 330)
2264
>>> rfc3339_duration_to_delta("P1DT3M20S")
2265
datetime.timedelta(1, 200)
2266
"""
2267
2268
# Parsing an RFC 3339 duration with regular expressions is not
2269
# possible - there would have to be multiple places for the same
2270
# values, like seconds. The current code, while more esoteric, is
2271
# cleaner without depending on a parsing library. If Python had a
2272
# built-in library for parsing we would use it, but we'd like to
2273
# avoid excessive use of external libraries.
2274
2275
# New type for defining tokens, syntax, and semantics all-in-one
2276
Token = collections.namedtuple("Token", (
2277
"regexp", # To match token; if "value" is not None, must have
2278
# a "group" containing digits
2279
"value", # datetime.timedelta or None
2280
"followers")) # Tokens valid after this token
2281
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2282
# the "duration" ABNF definition in RFC 3339, Appendix A.
2283
token_end = Token(re.compile(r"$"), None, frozenset())
2284
token_second = Token(re.compile(r"(\d+)S"),
2285
datetime.timedelta(seconds=1),
2286
frozenset((token_end, )))
2287
token_minute = Token(re.compile(r"(\d+)M"),
2288
datetime.timedelta(minutes=1),
2289
frozenset((token_second, token_end)))
2290
token_hour = Token(re.compile(r"(\d+)H"),
2291
datetime.timedelta(hours=1),
2292
frozenset((token_minute, token_end)))
2293
token_time = Token(re.compile(r"T"),
2294
None,
2295
frozenset((token_hour, token_minute,
2296
token_second)))
2297
token_day = Token(re.compile(r"(\d+)D"),
2298
datetime.timedelta(days=1),
2299
frozenset((token_time, token_end)))
2300
token_month = Token(re.compile(r"(\d+)M"),
2301
datetime.timedelta(weeks=4),
2302
frozenset((token_day, token_end)))
2303
token_year = Token(re.compile(r"(\d+)Y"),
2304
datetime.timedelta(weeks=52),
2305
frozenset((token_month, token_end)))
2306
token_week = Token(re.compile(r"(\d+)W"),
2307
datetime.timedelta(weeks=1),
2308
frozenset((token_end, )))
2309
token_duration = Token(re.compile(r"P"), None,
2310
frozenset((token_year, token_month,
2311
token_day, token_time,
2312
token_week)))
2313
# Define starting values
2314
value = datetime.timedelta() # Value so far
2315
found_token = None
2316
followers = frozenset((token_duration, )) # Following valid tokens
2317
s = duration # String left to parse
2318
# Loop until end token is found
2319
while found_token is not token_end:
2320
# Search for any currently valid tokens
2321
for token in followers:
2322
match = token.regexp.match(s)
2323
if match is not None:
2324
# Token found
2325
if token.value is not None:
2326
# Value found, parse digits
2327
factor = int(match.group(1), 10)
2328
# Add to value so far
2329
value += factor * token.value
2330
# Strip token from string
2331
s = token.regexp.sub("", s, 1)
2332
# Go to found token
2333
found_token = token
2334
# Set valid next tokens
2335
followers = found_token.followers
2336
break
2337
else:
2338
# No currently valid tokens were found
2339
raise ValueError("Invalid RFC 3339 duration: {!r}"
2340
.format(duration))
2341
# End token found
2342
return value
2343
2344
2062
2345
def string_to_delta(interval):
2063
2346
"""Parse a string and return a datetime.timedelta
2064
2347
2075
2358
>>> string_to_delta('5m 30s')
2076
2359
datetime.timedelta(0, 330)
2077
2360
"""
2361
2362
try:
2363
return rfc3339_duration_to_delta(interval)
2364
except ValueError:
2365
pass
2366
2078
2367
timevalue = datetime.timedelta(0)
2079
2368
for s in interval.split():
2080
2369
try:
2081
suffix = unicode(s[-1])
2370
suffix = s[-1]
2082
2371
value = int(s[:-1])
2083
2372
if suffix == "d":
2084
2373
delta = datetime.timedelta(value)
2091
2380
elif suffix == "w":
2092
2381
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2093
2382
else:
2094
raise ValueError("Unknown suffix {0!r}"
2095
.format(suffix))
2096
except (ValueError, IndexError) as e:
2383
raise ValueError("Unknown suffix {!r}".format(suffix))
2384
except IndexError as e:
2097
2385
raise ValueError(*(e.args))
2098
2386
timevalue += delta
2099
2387
return timevalue
2115
2403
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2116
2404
if not stat.S_ISCHR(os.fstat(null).st_mode):
2117
2405
raise OSError(errno.ENODEV,
2118
"{0} not a character device"
2406
"{} not a character device"
2119
2407
.format(os.devnull))
2120
2408
os.dup2(null, sys.stdin.fileno())
2121
2409
os.dup2(null, sys.stdout.fileno())
2131
2419
2132
2420
parser = argparse.ArgumentParser()
2133
2421
parser.add_argument("-v", "--version", action="version",
2134
version = "%(prog)s {0}".format(version),
2422
version = "%(prog)s {}".format(version),
2135
2423
help="show version number and exit")
2136
2424
parser.add_argument("-i", "--interface", metavar="IF",
2137
2425
help="Bind to interface IF")
2143
2431
help="Run self-test")
2144
2432
parser.add_argument("--debug", action="store_true",
2145
2433
help="Debug mode; run in foreground and log"
2146
" to terminal")
2434
" to terminal", default=None)
2147
2435
parser.add_argument("--debuglevel", metavar="LEVEL",
2148
2436
help="Debug level for stdout output")
2149
2437
parser.add_argument("--priority", help="GnuTLS"
2156
2444
" files")
2157
2445
parser.add_argument("--no-dbus", action="store_false",
2158
2446
dest="use_dbus", help="Do not provide D-Bus"
2159
" system bus interface")
2447
" system bus interface", default=None)
2160
2448
parser.add_argument("--no-ipv6", action="store_false",
2161
dest="use_ipv6", help="Do not use IPv6")
2449
dest="use_ipv6", help="Do not use IPv6",
2450
default=None)
2162
2451
parser.add_argument("--no-restore", action="store_false",
2163
2452
dest="restore", help="Do not restore stored"
2164
" state")
2453
" state", default=None)
2454
parser.add_argument("--socket", type=int,
2455
help="Specify a file descriptor to a network"
2456
" socket to use instead of creating one")
2165
2457
parser.add_argument("--statedir", metavar="DIR",
2166
2458
help="Directory to save/restore state in")
2459
parser.add_argument("--foreground", action="store_true",
2460
help="Run in foreground", default=None)
2461
parser.add_argument("--no-zeroconf", action="store_false",
2462
dest="zeroconf", help="Do not use Zeroconf",
2463
default=None)
2167
2464
2168
2465
options = parser.parse_args()
2169
2466
2170
2467
if options.check:
2171
2468
import doctest
2172
doctest.testmod()
2173
sys.exit()
2469
fail_count, test_count = doctest.testmod()
2470
sys.exit(os.EX_OK if fail_count == 0 else 1)
2174
2471
2175
2472
# Default values for config file for server-global settings
2176
2473
server_defaults = { "interface": "",
2178
2475
"port": "",
2179
2476
"debug": "False",
2180
2477
"priority":
2181
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2478
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2479
":+SIGN-DSA-SHA256",
2182
2480
"servicename": "Mandos",
2183
2481
"use_dbus": "True",
2184
2482
"use_ipv6": "True",
2185
2483
"debuglevel": "",
2186
2484
"restore": "True",
2187
"statedir": "/var/lib/mandos"
2188
}
2485
"socket": "",
2486
"statedir": "/var/lib/mandos",
2487
"foreground": "False",
2488
"zeroconf": "True",
2489
}
2189
2490
2190
2491
# Parse config file for server-global settings
2191
2492
server_config = configparser.SafeConfigParser(server_defaults)
2192
2493
del server_defaults
2193
server_config.read(os.path.join(options.configdir,
2194
"mandos.conf"))
2494
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2195
2495
# Convert the SafeConfigParser object to a dict
2196
2496
server_settings = server_config.defaults()
2197
2497
# Use the appropriate methods on the non-string config options
2198
for option in ("debug", "use_dbus", "use_ipv6"):
2498
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2199
2499
server_settings[option] = server_config.getboolean("DEFAULT",
2200
2500
option)
2201
2501
if server_settings["port"]:
2202
2502
server_settings["port"] = server_config.getint("DEFAULT",
2203
2503
"port")
2504
if server_settings["socket"]:
2505
server_settings["socket"] = server_config.getint("DEFAULT",
2506
"socket")
2507
# Later, stdin will, and stdout and stderr might, be dup'ed
2508
# over with an opened os.devnull. But we don't want this to
2509
# happen with a supplied network socket.
2510
if 0 <= server_settings["socket"] <= 2:
2511
server_settings["socket"] = os.dup(server_settings
2512
["socket"])
2204
2513
del server_config
2205
2514
2206
2515
# Override the settings from the config file with command line
2207
2516
# options, if set.
2208
2517
for option in ("interface", "address", "port", "debug",
2209
"priority", "servicename", "configdir",
2210
"use_dbus", "use_ipv6", "debuglevel", "restore",
2211
"statedir"):
2518
"priority", "servicename", "configdir", "use_dbus",
2519
"use_ipv6", "debuglevel", "restore", "statedir",
2520
"socket", "foreground", "zeroconf"):
2212
2521
value = getattr(options, option)
2213
2522
if value is not None:
2214
2523
server_settings[option] = value
2215
2524
del options
2216
2525
# Force all strings to be unicode
2217
2526
for option in server_settings.keys():
2218
if type(server_settings[option]) is str:
2219
server_settings[option] = unicode(server_settings[option])
2527
if isinstance(server_settings[option], bytes):
2528
server_settings[option] = (server_settings[option]
2529
.decode("utf-8"))
2530
# Force all boolean options to be boolean
2531
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2532
"foreground", "zeroconf"):
2533
server_settings[option] = bool(server_settings[option])
2534
# Debug implies foreground
2535
if server_settings["debug"]:
2536
server_settings["foreground"] = True
2220
2537
# Now we have our good server settings in "server_settings"
2221
2538
2222
2539
##################################################################
2223
2540
2541
if (not server_settings["zeroconf"]
2542
and not (server_settings["port"]
2543
or server_settings["socket"] != "")):
2544
parser.error("Needs port or socket to work without Zeroconf")
2545
2224
2546
# For convenience
2225
2547
debug = server_settings["debug"]
2226
2548
debuglevel = server_settings["debuglevel"]
2228
2550
use_ipv6 = server_settings["use_ipv6"]
2229
2551
stored_state_path = os.path.join(server_settings["statedir"],
2230
2552
stored_state_file)
2553
foreground = server_settings["foreground"]
2554
zeroconf = server_settings["zeroconf"]
2231
2555
2232
2556
if debug:
2233
2557
initlogger(debug, logging.DEBUG)
2239
2563
initlogger(debug, level)
2240
2564
2241
2565
if server_settings["servicename"] != "Mandos":
2242
syslogger.setFormatter(logging.Formatter
2243
('Mandos ({0}) [%(process)d]:'
2244
' %(levelname)s: %(message)s'
2245
.format(server_settings
2246
["servicename"])))
2566
syslogger.setFormatter(
2567
logging.Formatter('Mandos ({}) [%(process)d]:'
2568
' %(levelname)s: %(message)s'.format(
2569
server_settings["servicename"])))
2247
2570
2248
2571
# Parse config file with clients
2249
2572
client_config = configparser.SafeConfigParser(Client
2254
2577
global mandos_dbus_service
2255
2578
mandos_dbus_service = None
2256
2579
2257
tcp_server = MandosServer((server_settings["address"],
2258
server_settings["port"]),
2259
ClientHandler,
2260
interface=(server_settings["interface"]
2261
or None),
2262
use_ipv6=use_ipv6,
2263
gnutls_priority=
2264
server_settings["priority"],
2265
use_dbus=use_dbus)
2266
if not debug:
2267
pidfilename = "/var/run/mandos.pid"
2580
socketfd = None
2581
if server_settings["socket"] != "":
2582
socketfd = server_settings["socket"]
2583
tcp_server = MandosServer(
2584
(server_settings["address"], server_settings["port"]),
2585
ClientHandler,
2586
interface=(server_settings["interface"] or None),
2587
use_ipv6=use_ipv6,
2588
gnutls_priority=server_settings["priority"],
2589
use_dbus=use_dbus,
2590
socketfd=socketfd)
2591
if not foreground:
2592
pidfilename = "/run/mandos.pid"
2593
if not os.path.isdir("/run/."):
2594
pidfilename = "/var/run/mandos.pid"
2595
pidfile = None
2268
2596
try:
2269
pidfile = open(pidfilename, "w")
2597
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2270
2598
except IOError as e:
2271
2599
logger.error("Could not open file %r", pidfilename,
2272
2600
exc_info=e)
2285
2613
os.setgid(gid)
2286
2614
os.setuid(uid)
2287
2615
except OSError as error:
2288
if error[0] != errno.EPERM:
2289
raise error
2616
if error.errno != errno.EPERM:
2617
raise
2290
2618
2291
2619
if debug:
2292
2620
# Enable all possible GnuTLS debugging
2299
2627
def debug_gnutls(level, string):
2300
2628
logger.debug("GnuTLS: %s", string[:-1])
2301
2629
2302
(gnutls.library.functions
2303
.gnutls_global_set_log_function(debug_gnutls))
2630
gnutls.library.functions.gnutls_global_set_log_function(
2631
debug_gnutls)
2304
2632
2305
2633
# Redirect stdin so all checkers get /dev/null
2306
2634
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2309
2637
os.close(null)
2310
2638
2311
2639
# Need to fork before connecting to D-Bus
2312
if not debug:
2640
if not foreground:
2313
2641
# Close all input and output, do double fork, etc.
2314
2642
daemon()
2315
2643
2644
# multiprocessing will use threads, so before we use gobject we
2645
# need to inform gobject that threads will be used.
2316
2646
gobject.threads_init()
2317
2647
2318
2648
global main_loop
2324
2654
if use_dbus:
2325
2655
try:
2326
2656
bus_name = dbus.service.BusName("se.recompile.Mandos",
2327
bus, do_not_queue=True)
2328
old_bus_name = (dbus.service.BusName
2329
("se.bsnet.fukt.Mandos", bus,
2330
do_not_queue=True))
2331
except dbus.exceptions.NameExistsException as e:
2657
bus,
2658
do_not_queue=True)
2659
old_bus_name = dbus.service.BusName(
2660
"se.bsnet.fukt.Mandos", bus,
2661
do_not_queue=True)
2662
except dbus.exceptions.DBusException as e:
2332
2663
logger.error("Disabling D-Bus:", exc_info=e)
2333
2664
use_dbus = False
2334
2665
server_settings["use_dbus"] = False
2335
2666
tcp_server.use_dbus = False
2336
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2337
service = AvahiServiceToSyslog(name =
2338
server_settings["servicename"],
2339
servicetype = "_mandos._tcp",
2340
protocol = protocol, bus = bus)
2341
if server_settings["interface"]:
2342
service.interface = (if_nametoindex
2343
(str(server_settings["interface"])))
2667
if zeroconf:
2668
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2669
service = AvahiServiceToSyslog(
2670
name = server_settings["servicename"],
2671
servicetype = "_mandos._tcp",
2672
protocol = protocol,
2673
bus = bus)
2674
if server_settings["interface"]:
2675
service.interface = if_nametoindex(
2676
server_settings["interface"].encode("utf-8"))
2344
2677
2345
2678
global multiprocessing_manager
2346
2679
multiprocessing_manager = multiprocessing.Manager()
2353
2686
old_client_settings = {}
2354
2687
clients_data = {}
2355
2688
2689
# This is used to redirect stdout and stderr for checker processes
2690
global wnull
2691
wnull = open(os.devnull, "w") # A writable /dev/null
2692
# Only used if server is running in foreground but not in debug
2693
# mode
2694
if debug or not foreground:
2695
wnull.close()
2696
2356
2697
# Get client data and settings from last running state.
2357
2698
if server_settings["restore"]:
2358
2699
try:
2359
2700
with open(stored_state_path, "rb") as stored_state:
2360
clients_data, old_client_settings = (pickle.load
2361
(stored_state))
2701
clients_data, old_client_settings = pickle.load(
2702
stored_state)
2362
2703
os.remove(stored_state_path)
2363
2704
except IOError as e:
2364
2705
if e.errno == errno.ENOENT:
2365
logger.warning("Could not load persistent state: {0}"
2366
.format(os.strerror(e.errno)))
2706
logger.warning("Could not load persistent state:"
2707
" {}".format(os.strerror(e.errno)))
2367
2708
else:
2368
2709
logger.critical("Could not load persistent state:",
2369
2710
exc_info=e)
2370
2711
raise
2371
2712
except EOFError as e:
2372
2713
logger.warning("Could not load persistent state: "
2373
"EOFError:", exc_info=e)
2714
"EOFError:",
2715
exc_info=e)
2374
2716
2375
2717
with PGPEngine() as pgp:
2376
for client_name, client in clients_data.iteritems():
2718
for client_name, client in clients_data.items():
2719
# Skip removed clients
2720
if client_name not in client_settings:
2721
continue
2722
2377
2723
# Decide which value to use after restoring saved state.
2378
2724
# We have three different values: Old config file,
2379
2725
# new config file, and saved state.
2384
2730
# For each value in new config, check if it
2385
2731
# differs from the old config value (Except for
2386
2732
# the "secret" attribute)
2387
if (name != "secret" and
2388
value != old_client_settings[client_name]
2389
[name]):
2733
if (name != "secret"
2734
and (value !=
2735
old_client_settings[client_name][name])):
2390
2736
client[name] = value
2391
2737
except KeyError:
2392
2738
pass
2393
2739
2394
2740
# Clients who has passed its expire date can still be
2395
# enabled if its last checker was successful. Clients
2741
# enabled if its last checker was successful. A Client
2396
2742
# whose checker succeeded before we stored its state is
2397
2743
# assumed to have successfully run all checkers during
2398
2744
# downtime.
2400
2746
if datetime.datetime.utcnow() >= client["expires"]:
2401
2747
if not client["last_checked_ok"]:
2402
2748
logger.warning(
2403
"disabling client {0} - Client never "
2404
"performed a successful checker"
2405
.format(client_name))
2749
"disabling client {} - Client never "
2750
"performed a successful checker".format(
2751
client_name))
2406
2752
client["enabled"] = False
2407
2753
elif client["last_checker_status"] != 0:
2408
2754
logger.warning(
2409
"disabling client {0} - Client "
2410
"last checker failed with error code {1}"
2411
.format(client_name,
2412
client["last_checker_status"]))
2755
"disabling client {} - Client last"
2756
" checker failed with error code"
2757
" {}".format(
2758
client_name,
2759
client["last_checker_status"]))
2413
2760
client["enabled"] = False
2414
2761
else:
2415
client["expires"] = (datetime.datetime
2416
.utcnow()
2417
+ client["timeout"])
2762
client["expires"] = (
2763
datetime.datetime.utcnow()
2764
+ client["timeout"])
2418
2765
logger.debug("Last checker succeeded,"
2419
" keeping {0} enabled"
2420
.format(client_name))
2766
" keeping {} enabled".format(
2767
client_name))
2421
2768
try:
2422
client["secret"] = (
2423
pgp.decrypt(client["encrypted_secret"],
2424
client_settings[client_name]
2425
["secret"]))
2769
client["secret"] = pgp.decrypt(
2770
client["encrypted_secret"],
2771
client_settings[client_name]["secret"])
2426
2772
except PGPError:
2427
2773
# If decryption fails, we use secret from new settings
2428
logger.debug("Failed to decrypt {0} old secret"
2429
.format(client_name))
2430
client["secret"] = (
2431
client_settings[client_name]["secret"])
2774
logger.debug("Failed to decrypt {} old secret".format(
2775
client_name))
2776
client["secret"] = (client_settings[client_name]
2777
["secret"])
2432
2778
2433
2779
# Add/remove clients based on new changes made to config
2434
2780
for client_name in (set(old_client_settings)
2439
2785
clients_data[client_name] = client_settings[client_name]
2440
2786
2441
2787
# Create all client objects
2442
for client_name, client in clients_data.iteritems():
2788
for client_name, client in clients_data.items():
2443
2789
tcp_server.clients[client_name] = client_class(
2444
name = client_name, settings = client)
2790
name = client_name,
2791
settings = client,
2792
server_settings = server_settings)
2445
2793
2446
2794
if not tcp_server.clients:
2447
2795
logger.warning("No clients defined")
2448
2796
2449
if not debug:
2450
try:
2451
with pidfile:
2452
pid = os.getpid()
2453
pidfile.write(str(pid) + "\n".encode("utf-8"))
2454
del pidfile
2455
except IOError:
2456
logger.error("Could not write to file %r with PID %d",
2457
pidfilename, pid)
2458
except NameError:
2459
# "pidfile" was never created
2460
pass
2797
if not foreground:
2798
if pidfile is not None:
2799
pid = os.getpid()
2800
try:
2801
with pidfile:
2802
print(pid, file=pidfile)
2803
except IOError:
2804
logger.error("Could not write to file %r with PID %d",
2805
pidfilename, pid)
2806
del pidfile
2461
2807
del pidfilename
2462
signal.signal(signal.SIGINT, signal.SIG_IGN)
2463
2808
2464
2809
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2465
2810
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2466
2811
2467
2812
if use_dbus:
2468
@alternate_dbus_interfaces({"se.recompile.Mandos":
2469
"se.bsnet.fukt.Mandos"})
2470
class MandosDBusService(DBusObjectWithProperties):
2813
2814
@alternate_dbus_interfaces(
2815
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2816
class MandosDBusService(DBusObjectWithAnnotations):
2471
2817
"""A D-Bus proxy object"""
2818
2472
2819
def __init__(self):
2473
2820
dbus.service.Object.__init__(self, bus, "/")
2821
2474
2822
_interface = "se.recompile.Mandos"
2475
2823
2476
@dbus_interface_annotations(_interface)
2477
def _foo(self):
2478
return { "org.freedesktop.DBus.Property"
2479
".EmitsChangedSignal":
2480
"false"}
2481
2482
2824
@dbus.service.signal(_interface, signature="o")
2483
2825
def ClientAdded(self, objpath):
2484
2826
"D-Bus signal"
2497
2839
@dbus.service.method(_interface, out_signature="ao")
2498
2840
def GetAllClients(self):
2499
2841
"D-Bus method"
2500
return dbus.Array(c.dbus_object_path
2501
for c in
2842
return dbus.Array(c.dbus_object_path for c in
2502
2843
tcp_server.clients.itervalues())
2503
2844
2504
2845
@dbus.service.method(_interface,
2506
2847
def GetAllClientsWithProperties(self):
2507
2848
"D-Bus method"
2508
2849
return dbus.Dictionary(
2509
((c.dbus_object_path, c.GetAll(""))
2510
for c in tcp_server.clients.itervalues()),
2850
{ c.dbus_object_path: c.GetAll("")
2851
for c in tcp_server.clients.itervalues() },
2511
2852
signature="oa{sv}")
2512
2853
2513
2854
@dbus.service.method(_interface, in_signature="o")
2530
2871
2531
2872
def cleanup():
2532
2873
"Cleanup function; run on exit"
2533
service.cleanup()
2874
if zeroconf:
2875
service.cleanup()
2534
2876
2535
2877
multiprocessing.active_children()
2878
wnull.close()
2536
2879
if not (tcp_server.clients or client_settings):
2537
2880
return
2538
2881
2549
2892
2550
2893
# A list of attributes that can not be pickled
2551
2894
# + secret.
2552
exclude = set(("bus", "changedstate", "secret",
2553
"checker"))
2554
for name, typ in (inspect.getmembers
2555
(dbus.service.Object)):
2895
exclude = { "bus", "changedstate", "secret",
2896
"checker", "server_settings" }
2897
for name, typ in inspect.getmembers(dbus.service
2898
.Object):
2556
2899
exclude.add(name)
2557
2900
2558
2901
client_dict["encrypted_secret"] = (client
2565
2908
del client_settings[client.name]["secret"]
2566
2909
2567
2910
try:
2568
with (tempfile.NamedTemporaryFile
2569
(mode='wb', suffix=".pickle", prefix='clients-',
2570
dir=os.path.dirname(stored_state_path),
2571
delete=False)) as stored_state:
2911
with tempfile.NamedTemporaryFile(
2912
mode='wb',
2913
suffix=".pickle",
2914
prefix='clients-',
2915
dir=os.path.dirname(stored_state_path),
2916
delete=False) as stored_state:
2572
2917
pickle.dump((clients, client_settings), stored_state)
2573
tempname=stored_state.name
2918
tempname = stored_state.name
2574
2919
os.rename(tempname, stored_state_path)
2575
2920
except (IOError, OSError) as e:
2576
2921
if not debug:
2579
2924
except NameError:
2580
2925
pass
2581
2926
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2582
logger.warning("Could not save persistent state: {0}"
2927
logger.warning("Could not save persistent state: {}"
2583
2928
.format(os.strerror(e.errno)))
2584
2929
else:
2585
2930
logger.warning("Could not save persistent state:",
2586
2931
exc_info=e)
2587
raise e
2932
raise
2588
2933
2589
2934
# Delete all clients, and settings from config
2590
2935
while tcp_server.clients:
2595
2940
client.disable(quiet=True)
2596
2941
if use_dbus:
2597
2942
# Emit D-Bus signal
2598
mandos_dbus_service.ClientRemoved(client
2599
.dbus_object_path,
2600
client.name)
2943
mandos_dbus_service.ClientRemoved(
2944
client.dbus_object_path, client.name)
2601
2945
client_settings.clear()
2602
2946
2603
2947
atexit.register(cleanup)
2614
2958
tcp_server.server_activate()
2615
2959
2616
2960
# Find out what port we got
2617
service.port = tcp_server.socket.getsockname()[1]
2961
if zeroconf:
2962
service.port = tcp_server.socket.getsockname()[1]
2618
2963
if use_ipv6:
2619
2964
logger.info("Now listening on address %r, port %d,"
2620
2965
" flowinfo %d, scope_id %d",
2626
2971
#service.interface = tcp_server.socket.getsockname()[3]
2627
2972
2628
2973
try:
2629
# From the Avahi example code
2630
try:
2631
service.activate()
2632
except dbus.exceptions.DBusException as error:
2633
logger.critical("D-Bus Exception", exc_info=error)
2634
cleanup()
2635
sys.exit(1)
2636
# End of Avahi example code
2974
if zeroconf:
2975
# From the Avahi example code
2976
try:
2977
service.activate()
2978
except dbus.exceptions.DBusException as error:
2979
logger.critical("D-Bus Exception", exc_info=error)
2980
cleanup()
2981
sys.exit(1)
2982
# End of Avahi example code
2637
2983
2638
2984
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2639
2985
lambda *args, **kwargs:
2654
3000
# Must run before the D-Bus bus name gets deregistered
2655
3001
cleanup()
2656
3002
3003
2657
3004
if __name__ == '__main__':
2658
3005
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0