To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 784
- compare with another revision
- download diff
- download tarball
- view history from revision 784
- Committer: Teddy Hogeborn
- Date: 2015-08-10 08:25:01 UTC
- Revision ID: teddy@recompile.se-20150810082501-rb7w2dre1flqiqe2
Refactor D-Bus annotation class out from D-Bus properties class.
* mandos (DBusObjectWithAnnotations): New; factored out D-Bus
annotations code from
DBusObjectWithProperties class.
(DBusObjectWithProperties): Inherit from DBusObjectWithAnnotations.
(main/MandosDBusService): - '' -
(main/MandosDBusService._foo): Removed interface annotation for
"o.f.D.Property.EmitsChangedSignal";
this object has no properties.
* mandos (DBusObjectWithAnnotations): New; factored out D-Bus
annotations code from
DBusObjectWithProperties class.
(DBusObjectWithProperties): Inherit from DBusObjectWithAnnotations.
(main/MandosDBusService): - '' -
(main/MandosDBusService._foo): Removed interface annotation for
"o.f.D.Property.EmitsChangedSignal";
this object has no properties.
- files added:
- debian/upstream
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
69
78
import tempfile
70
79
import itertools
71
80
import collections
81
import codecs
72
82
73
83
import dbus
74
84
import dbus.service
75
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
76
89
import avahi
77
90
from dbus.mainloop.glib import DBusGMainLoop
78
91
import ctypes
88
101
except ImportError:
89
102
SO_BINDTODEVICE = None
90
103
91
version = "1.6.4"
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
92
108
stored_state_file = "clients.pickle"
93
109
94
110
logger = logging.getLogger()
95
111
syslogger = None
96
112
97
113
try:
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
101
116
except (OSError, AttributeError):
117
102
118
def if_nametoindex(interface):
103
119
"Get an interface index the hard way, i.e. using fcntl()"
104
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
121
with contextlib.closing(socket.socket()) as s:
106
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
111
125
return interface_index
112
126
113
127
114
128
def initlogger(debug, level=logging.WARNING):
115
129
"""init logger and add loglevel"""
116
130
117
syslogger = (logging.handlers.SysLogHandler
118
(facility =
119
logging.handlers.SysLogHandler.LOG_DAEMON,
120
address = str("/dev/log")))
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
121
135
syslogger.setFormatter(logging.Formatter
122
136
('Mandos [%(process)d]: %(levelname)s:'
123
137
' %(message)s'))
140
154
141
155
class PGPEngine(object):
142
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
143
158
def __init__(self):
144
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
160
self.gnupgargs = ['--batch',
184
199
185
200
def encrypt(self, data, password):
186
201
passphrase = self.password_encode(password)
187
with tempfile.NamedTemporaryFile(dir=self.tempdir
188
) as passfile:
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
189
204
passfile.write(passphrase)
190
205
passfile.flush()
191
206
proc = subprocess.Popen(['gpg', '--symmetric',
202
217
203
218
def decrypt(self, data, password):
204
219
passphrase = self.password_encode(password)
205
with tempfile.NamedTemporaryFile(dir = self.tempdir
206
) as passfile:
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
207
222
passfile.write(passphrase)
208
223
passfile.flush()
209
224
proc = subprocess.Popen(['gpg', '--decrypt',
213
228
stdin = subprocess.PIPE,
214
229
stdout = subprocess.PIPE,
215
230
stderr = subprocess.PIPE)
216
decrypted_plaintext, err = proc.communicate(input
217
= data)
231
decrypted_plaintext, err = proc.communicate(input = data)
218
232
if proc.returncode != 0:
219
233
raise PGPError(err)
220
234
return decrypted_plaintext
223
237
class AvahiError(Exception):
224
238
def __init__(self, value, *args, **kwargs):
225
239
self.value = value
226
super(AvahiError, self).__init__(value, *args, **kwargs)
227
def __unicode__(self):
228
return unicode(repr(self.value))
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
229
243
230
244
class AvahiServiceError(AvahiError):
231
245
pass
232
246
247
233
248
class AvahiGroupError(AvahiError):
234
249
pass
235
250
255
270
bus: dbus.SystemBus()
256
271
"""
257
272
258
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
259
servicetype = None, port = None, TXT = None,
260
domain = "", host = "", max_renames = 32768,
261
protocol = avahi.PROTO_UNSPEC, bus = None):
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
262
284
self.interface = interface
263
285
self.name = name
264
286
self.type = servicetype
274
296
self.bus = bus
275
297
self.entry_group_state_changed_match = None
276
298
277
def rename(self):
299
def rename(self, remove=True):
278
300
"""Derived from the Avahi example code"""
279
301
if self.rename_count >= self.max_renames:
280
302
logger.critical("No suitable Zeroconf service name found"
281
303
" after %i retries, exiting.",
282
304
self.rename_count)
283
305
raise AvahiServiceError("Too many renames")
284
self.name = unicode(self.server
285
.GetAlternativeServiceName(self.name))
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
286
309
logger.info("Changing Zeroconf service name to %r ...",
287
310
self.name)
288
self.remove()
311
if remove:
312
self.remove()
289
313
try:
290
314
self.add()
291
315
except dbus.exceptions.DBusException as error:
292
logger.critical("D-Bus Exception", exc_info=error)
293
self.cleanup()
294
os._exit(1)
295
self.rename_count += 1
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
296
324
297
325
def remove(self):
298
326
"""Derived from the Avahi example code"""
336
364
self.rename()
337
365
elif state == avahi.ENTRY_GROUP_FAILURE:
338
366
logger.critical("Avahi: Error in group state changed %s",
339
unicode(error))
340
raise AvahiGroupError("State changed: {0!s}"
341
.format(error))
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
342
369
343
370
def cleanup(self):
344
371
"""Derived from the Avahi example code"""
354
381
def server_state_changed(self, state, error=None):
355
382
"""Derived from the Avahi example code"""
356
383
logger.debug("Avahi server state change: %i", state)
357
bad_states = { avahi.SERVER_INVALID:
358
"Zeroconf server invalid",
359
avahi.SERVER_REGISTERING: None,
360
avahi.SERVER_COLLISION:
361
"Zeroconf server name collision",
362
avahi.SERVER_FAILURE:
363
"Zeroconf server failure" }
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
364
390
if state in bad_states:
365
391
if bad_states[state] is not None:
366
392
if error is None:
369
395
logger.error(bad_states[state] + ": %r", error)
370
396
self.cleanup()
371
397
elif state == avahi.SERVER_RUNNING:
372
self.add()
398
try:
399
self.add()
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
404
" collision.")
405
return self.rename(remove=False)
406
else:
407
logger.critical("D-Bus Exception", exc_info=error)
408
self.cleanup()
409
os._exit(1)
373
410
else:
374
411
if error is None:
375
412
logger.debug("Unknown state: %r", state)
385
422
follow_name_owner_changes=True),
386
423
avahi.DBUS_INTERFACE_SERVER)
387
424
self.server.connect_to_signal("StateChanged",
388
self.server_state_changed)
425
self.server_state_changed)
389
426
self.server_state_changed(self.server.GetState())
390
427
391
428
392
429
class AvahiServiceToSyslog(AvahiService):
393
def rename(self):
430
def rename(self, *args, **kwargs):
394
431
"""Add the new name to the syslog messages"""
395
ret = AvahiService.rename(self)
396
syslogger.setFormatter(logging.Formatter
397
('Mandos ({0}) [%(process)d]:'
398
' %(levelname)s: %(message)s'
399
.format(self.name)))
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
.format(self.name)))
400
436
return ret
401
437
402
403
def timedelta_to_milliseconds(td):
404
"Convert a datetime.timedelta() to milliseconds"
405
return ((td.days * 24 * 60 * 60 * 1000)
406
+ (td.seconds * 1000)
407
+ (td.microseconds // 1000))
408
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
441
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
444
"""
445
connection.send(func(*args, **kwargs))
446
connection.close()
409
447
410
448
class Client(object):
411
449
"""A representation of a client host served by this server.
438
476
last_checker_status: integer between 0 and 255 reflecting exit
439
477
status of last checker. -1 reflects crashed
440
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
441
481
last_enabled: datetime.datetime(); (UTC) or None
442
482
name: string; from the config file, used in log messages and
443
483
D-Bus identifiers
456
496
"fingerprint", "host", "interval",
457
497
"last_approval_request", "last_checked_ok",
458
498
"last_enabled", "name", "timeout")
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
469
470
def timeout_milliseconds(self):
471
"Return the 'timeout' attribute in milliseconds"
472
return timedelta_to_milliseconds(self.timeout)
473
474
def extended_timeout_milliseconds(self):
475
"Return the 'extended_timeout' attribute in milliseconds"
476
return timedelta_to_milliseconds(self.extended_timeout)
477
478
def interval_milliseconds(self):
479
"Return the 'interval' attribute in milliseconds"
480
return timedelta_to_milliseconds(self.interval)
481
482
def approval_delay_milliseconds(self):
483
return timedelta_to_milliseconds(self.approval_delay)
499
client_defaults = {
500
"timeout": "PT5M",
501
"extended_timeout": "PT15M",
502
"interval": "PT2M",
503
"checker": "fping -q -- %%(host)s",
504
"host": "",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
508
"enabled": "True",
509
}
484
510
485
511
@staticmethod
486
512
def config_parser(config):
502
528
client["enabled"] = config.getboolean(client_name,
503
529
"enabled")
504
530
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
505
534
client["fingerprint"] = (section["fingerprint"].upper()
506
535
.replace(" ", ""))
507
536
if "secret" in section:
512
541
"rb") as secfile:
513
542
client["secret"] = secfile.read()
514
543
else:
515
raise TypeError("No secret or secfile for section {0}"
544
raise TypeError("No secret or secfile for section {}"
516
545
.format(section))
517
546
client["timeout"] = string_to_delta(section["timeout"])
518
547
client["extended_timeout"] = string_to_delta(
535
564
server_settings = {}
536
565
self.server_settings = server_settings
537
566
# adding all client settings
538
for setting, value in settings.iteritems():
567
for setting, value in settings.items():
539
568
setattr(self, setting, value)
540
569
541
570
if self.enabled:
549
578
self.expires = None
550
579
551
580
logger.debug("Creating client %r", self.name)
552
# Uppercase and remove spaces from fingerprint for later
553
# comparison purposes with return value from the fingerprint()
554
# function
555
581
logger.debug(" Fingerprint: %s", self.fingerprint)
556
582
self.created = settings.get("created",
557
583
datetime.datetime.utcnow())
564
590
self.current_checker_command = None
565
591
self.approved = None
566
592
self.approvals_pending = 0
567
self.changedstate = (multiprocessing_manager
568
.Condition(multiprocessing_manager
569
.Lock()))
570
self.client_structure = [attr for attr in
571
self.__dict__.iterkeys()
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
572
597
if not attr.startswith("_")]
573
598
self.client_structure.append("client_structure")
574
599
575
for name, t in inspect.getmembers(type(self),
576
lambda obj:
577
isinstance(obj,
578
property)):
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
579
602
if not name.startswith("_"):
580
603
self.client_structure.append(name)
581
604
623
646
# and every interval from then on.
624
647
if self.checker_initiator_tag is not None:
625
648
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = (gobject.timeout_add
627
(self.interval_milliseconds(),
628
self.start_checker))
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
651
self.start_checker)
629
652
# Schedule a disable() when 'timeout' has passed
630
653
if self.disable_initiator_tag is not None:
631
654
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = (gobject.timeout_add
633
(self.timeout_milliseconds(),
634
self.disable))
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
635
657
# Also start a new checker *right now*.
636
658
self.start_checker()
637
659
638
def checker_callback(self, pid, condition, command):
660
def checker_callback(self, source, condition, connection,
661
command):
639
662
"""The checker has completed, so take appropriate actions."""
640
663
self.checker_callback_tag = None
641
664
self.checker = None
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
667
connection.close()
668
669
if returncode >= 0:
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
644
672
if self.last_checker_status == 0:
645
673
logger.info("Checker for %(name)s succeeded",
646
674
vars(self))
647
675
self.checked_ok()
648
676
else:
649
logger.info("Checker for %(name)s failed",
650
vars(self))
677
logger.info("Checker for %(name)s failed", vars(self))
651
678
else:
652
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
653
681
logger.warning("Checker for %(name)s crashed?",
654
682
vars(self))
683
return False
655
684
656
685
def checked_ok(self):
657
686
"""Assert that the client has been seen, alive and well."""
658
687
self.last_checked_ok = datetime.datetime.utcnow()
659
688
self.last_checker_status = 0
689
self.last_checker_signal = None
660
690
self.bump_timeout()
661
691
662
692
def bump_timeout(self, timeout=None):
667
697
gobject.source_remove(self.disable_initiator_tag)
668
698
self.disable_initiator_tag = None
669
699
if getattr(self, "enabled", False):
670
self.disable_initiator_tag = (gobject.timeout_add
671
(timedelta_to_milliseconds
672
(timeout), self.disable))
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
673
702
self.expires = datetime.datetime.utcnow() + timeout
674
703
675
704
def need_approval(self):
689
718
# than 'timeout' for the client to be disabled, which is as it
690
719
# should be.
691
720
692
# If a checker exists, make sure it is not a zombie
693
try:
694
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
695
except AttributeError:
696
pass
697
except OSError as error:
698
if error.errno != errno.ECHILD:
699
raise
700
else:
701
if pid:
702
logger.warning("Checker was a zombie")
703
gobject.source_remove(self.checker_callback_tag)
704
self.checker_callback(pid, status,
705
self.current_checker_command)
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
723
self.checker.join()
724
self.checker = None
706
725
# Start a new checker if needed
707
726
if self.checker is None:
708
727
# Escape attributes for the shell
709
escaped_attrs = dict(
710
(attr, re.escape(unicode(getattr(self, attr))))
711
for attr in
712
self.runtime_expansions)
728
escaped_attrs = {
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
713
731
try:
714
732
command = self.checker_command % escaped_attrs
715
733
except TypeError as error:
716
734
logger.error('Could not format string "%s"',
717
self.checker_command, exc_info=error)
718
return True # Try again later
735
self.checker_command,
736
exc_info=error)
737
return True # Try again later
719
738
self.current_checker_command = command
720
try:
721
logger.info("Starting checker %r for %s",
722
command, self.name)
723
# We don't need to redirect stdout and stderr, since
724
# in normal mode, that is already done by daemon(),
725
# and in debug mode we don't want to. (Stdin is
726
# always replaced by /dev/null.)
727
# The exception is when not debugging but nevertheless
728
# running in the foreground; use the previously
729
# created wnull.
730
popen_args = {}
731
if (not self.server_settings["debug"]
732
and self.server_settings["foreground"]):
733
popen_args.update({"stdout": wnull,
734
"stderr": wnull })
735
self.checker = subprocess.Popen(command,
736
close_fds=True,
737
shell=True, cwd="/",
738
**popen_args)
739
except OSError as error:
740
logger.error("Failed to start subprocess",
741
exc_info=error)
742
return True
743
self.checker_callback_tag = (gobject.child_watch_add
744
(self.checker.pid,
745
self.checker_callback,
746
data=command))
747
# The checker may have completed before the gobject
748
# watch was added. Check for this.
749
try:
750
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
751
except OSError as error:
752
if error.errno == errno.ECHILD:
753
# This should never happen
754
logger.error("Child process vanished",
755
exc_info=error)
756
return True
757
raise
758
if pid:
759
gobject.source_remove(self.checker_callback_tag)
760
self.checker_callback(pid, status, command)
739
logger.info("Starting checker %r for %s", command,
740
self.name)
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
747
# created wnull.
748
popen_args = { "close_fds": True,
749
"shell": True,
750
"cwd": "/" }
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
754
"stderr": wnull })
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
757
target = call_pipe,
758
args = (pipe[1], subprocess.call, command),
759
kwargs = popen_args)
760
self.checker.start()
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
761
764
# Re-run this periodically if run by gobject.timeout_add
762
765
return True
763
766
769
772
if getattr(self, "checker", None) is None:
770
773
return
771
774
logger.debug("Stopping checker for %(name)s", vars(self))
772
try:
773
self.checker.terminate()
774
#time.sleep(0.5)
775
#if self.checker.poll() is None:
776
# self.checker.kill()
777
except OSError as error:
778
if error.errno != errno.ESRCH: # No such process
779
raise
775
self.checker.terminate()
780
776
self.checker = None
781
777
782
778
783
def dbus_service_property(dbus_interface, signature="v",
784
access="readwrite", byte_arrays=False):
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
785
783
"""Decorators for marking methods of a DBusObjectWithProperties to
786
784
become properties on the D-Bus.
787
785
796
794
# "Set" method, so we fail early here:
797
795
if byte_arrays and signature != "ay":
798
796
raise ValueError("Byte arrays not supported for non-'ay'"
799
" signature {0!r}".format(signature))
797
" signature {!r}".format(signature))
798
800
799
def decorator(func):
801
800
func._dbus_is_property = True
802
801
func._dbus_interface = dbus_interface
807
806
func._dbus_name = func._dbus_name[:-14]
808
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
809
808
return func
809
810
810
return decorator
811
811
812
812
821
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
822
822
"false"}
823
823
"""
824
824
825
def decorator(func):
825
826
func._dbus_is_interface = True
826
827
func._dbus_interface = dbus_interface
827
828
func._dbus_name = dbus_interface
828
829
return func
830
829
831
return decorator
830
832
831
833
833
835
"""Decorator to annotate D-Bus methods, signals or properties
834
836
Usage:
835
837
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
836
841
@dbus_service_property("org.example.Interface", signature="b",
837
842
access="r")
838
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
843
def Property_dbus_property(self):
842
844
return dbus.Boolean(False)
845
846
See also the DBusObjectWithAnnotations class.
843
847
"""
848
844
849
def decorator(func):
845
850
func._dbus_annotations = annotations
846
851
return func
852
847
853
return decorator
848
854
849
855
850
856
class DBusPropertyException(dbus.exceptions.DBusException):
851
857
"""A base class for D-Bus property-related exceptions
852
858
"""
853
def __unicode__(self):
854
return unicode(str(self))
859
pass
855
860
856
861
857
862
class DBusPropertyAccessException(DBusPropertyException):
866
871
pass
867
872
868
873
869
class DBusObjectWithProperties(dbus.service.Object):
870
"""A D-Bus object with properties.
874
class DBusObjectWithAnnotations(dbus.service.Object):
875
"""A D-Bus object with annotations.
871
876
872
Classes inheriting from this can use the dbus_service_property
873
decorator to expose methods as D-Bus properties. It exposes the
874
standard Get(), Set(), and GetAll() methods on the D-Bus.
877
Classes inheriting from this can use the dbus_annotations
878
decorator to add annotations to methods or signals.
875
879
"""
876
880
877
881
@staticmethod
881
885
If called like _is_dbus_thing("method") it returns a function
882
886
suitable for use as predicate to inspect.getmembers().
883
887
"""
884
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
889
False)
886
890
887
891
def _get_all_dbus_things(self, thing):
888
892
"""Returns a generator of (name, attribute) pairs
889
893
"""
890
return ((getattr(athing.__get__(self), "_dbus_name",
891
name),
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
892
895
athing.__get__(self))
893
896
for cls in self.__class__.__mro__
894
897
for name, athing in
895
inspect.getmembers(cls,
896
self._is_dbus_thing(thing)))
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
899
900
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
901
out_signature = "s",
902
path_keyword = 'object_path',
903
connection_keyword = 'connection')
904
def Introspect(self, object_path, connection):
905
"""Overloading of standard D-Bus method.
906
907
Inserts annotation tags on methods and signals.
908
"""
909
xmlstring = dbus.service.Object.Introspect(self, object_path,
910
connection)
911
try:
912
document = xml.dom.minidom.parseString(xmlstring)
913
914
for if_tag in document.getElementsByTagName("interface"):
915
# Add annotation tags
916
for typ in ("method", "signal"):
917
for tag in if_tag.getElementsByTagName(typ):
918
annots = dict()
919
for name, prop in (self.
920
_get_all_dbus_things(typ)):
921
if (name == tag.getAttribute("name")
922
and prop._dbus_interface
923
== if_tag.getAttribute("name")):
924
annots.update(getattr(
925
prop, "_dbus_annotations", {}))
926
for name, value in annots.items():
927
ann_tag = document.createElement(
928
"annotation")
929
ann_tag.setAttribute("name", name)
930
ann_tag.setAttribute("value", value)
931
tag.appendChild(ann_tag)
932
# Add interface annotation tags
933
for annotation, value in dict(
934
itertools.chain.from_iterable(
935
annotations().items()
936
for name, annotations
937
in self._get_all_dbus_things("interface")
938
if name == if_tag.getAttribute("name")
939
)).items():
940
ann_tag = document.createElement("annotation")
941
ann_tag.setAttribute("name", annotation)
942
ann_tag.setAttribute("value", value)
943
if_tag.appendChild(ann_tag)
944
# Fix argument name for the Introspect method itself
945
if (if_tag.getAttribute("name")
946
== dbus.INTROSPECTABLE_IFACE):
947
for cn in if_tag.getElementsByTagName("method"):
948
if cn.getAttribute("name") == "Introspect":
949
for arg in cn.getElementsByTagName("arg"):
950
if (arg.getAttribute("direction")
951
== "out"):
952
arg.setAttribute("name",
953
"xml_data")
954
xmlstring = document.toxml("utf-8")
955
document.unlink()
956
except (AttributeError, xml.dom.DOMException,
957
xml.parsers.expat.ExpatError) as error:
958
logger.error("Failed to override Introspection method",
959
exc_info=error)
960
return xmlstring
961
962
963
class DBusObjectWithProperties(DBusObjectWithAnnotations):
964
"""A D-Bus object with properties.
965
966
Classes inheriting from this can use the dbus_service_property
967
decorator to expose methods as D-Bus properties. It exposes the
968
standard Get(), Set(), and GetAll() methods on the D-Bus.
969
"""
897
970
898
971
def _get_dbus_property(self, interface_name, property_name):
899
972
"""Returns a bound method if one exists which is a D-Bus
900
973
property with the specified name and interface.
901
974
"""
902
for cls in self.__class__.__mro__:
903
for name, value in (inspect.getmembers
904
(cls,
905
self._is_dbus_thing("property"))):
975
for cls in self.__class__.__mro__:
976
for name, value in inspect.getmembers(
977
cls, self._is_dbus_thing("property")):
906
978
if (value._dbus_name == property_name
907
979
and value._dbus_interface == interface_name):
908
980
return value.__get__(self)
909
981
910
982
# No such property
911
raise DBusPropertyNotFound(self.dbus_object_path + ":"
912
+ interface_name + "."
913
+ property_name)
983
raise DBusPropertyNotFound("{}:{}.{}".format(
984
self.dbus_object_path, interface_name, property_name))
914
985
915
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
986
@dbus.service.method(dbus.PROPERTIES_IFACE,
987
in_signature="ss",
916
988
out_signature="v")
917
989
def Get(self, interface_name, property_name):
918
990
"""Standard D-Bus property Get() method, see D-Bus standard.
937
1009
# signatures other than "ay".
938
1010
if prop._dbus_signature != "ay":
939
1011
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {0!r}"
1012
"'ay' signature {!r}"
941
1013
.format(prop._dbus_signature))
942
1014
value = dbus.ByteArray(b''.join(chr(byte)
943
1015
for byte in value))
944
1016
prop(value)
945
1017
946
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1018
@dbus.service.method(dbus.PROPERTIES_IFACE,
1019
in_signature="s",
947
1020
out_signature="a{sv}")
948
1021
def GetAll(self, interface_name):
949
1022
"""Standard D-Bus property GetAll() method, see D-Bus
964
1037
if not hasattr(value, "variant_level"):
965
1038
properties[name] = value
966
1039
continue
967
properties[name] = type(value)(value, variant_level=
968
value.variant_level+1)
1040
properties[name] = type(value)(
1041
value, variant_level = value.variant_level + 1)
969
1042
return dbus.Dictionary(properties, signature="sv")
970
1043
1044
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1045
def PropertiesChanged(self, interface_name, changed_properties,
1046
invalidated_properties):
1047
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1048
standard.
1049
"""
1050
pass
1051
971
1052
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
972
1053
out_signature="s",
973
1054
path_keyword='object_path',
977
1058
978
1059
Inserts property tags and interface annotation tags.
979
1060
"""
980
xmlstring = dbus.service.Object.Introspect(self, object_path,
981
connection)
1061
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1062
object_path,
1063
connection)
982
1064
try:
983
1065
document = xml.dom.minidom.parseString(xmlstring)
1066
984
1067
def make_tag(document, name, prop):
985
1068
e = document.createElement("property")
986
1069
e.setAttribute("name", name)
987
1070
e.setAttribute("type", prop._dbus_signature)
988
1071
e.setAttribute("access", prop._dbus_access)
989
1072
return e
1073
990
1074
for if_tag in document.getElementsByTagName("interface"):
991
1075
# Add property tags
992
1076
for tag in (make_tag(document, name, prop)
995
1079
if prop._dbus_interface
996
1080
== if_tag.getAttribute("name")):
997
1081
if_tag.appendChild(tag)
998
# Add annotation tags
999
for typ in ("method", "signal", "property"):
1000
for tag in if_tag.getElementsByTagName(typ):
1001
annots = dict()
1002
for name, prop in (self.
1003
_get_all_dbus_things(typ)):
1004
if (name == tag.getAttribute("name")
1005
and prop._dbus_interface
1006
== if_tag.getAttribute("name")):
1007
annots.update(getattr
1008
(prop,
1009
"_dbus_annotations",
1010
{}))
1011
for name, value in annots.iteritems():
1012
ann_tag = document.createElement(
1013
"annotation")
1014
ann_tag.setAttribute("name", name)
1015
ann_tag.setAttribute("value", value)
1016
tag.appendChild(ann_tag)
1017
# Add interface annotation tags
1018
for annotation, value in dict(
1019
itertools.chain.from_iterable(
1020
annotations().iteritems()
1021
for name, annotations in
1022
self._get_all_dbus_things("interface")
1023
if name == if_tag.getAttribute("name")
1024
)).iteritems():
1025
ann_tag = document.createElement("annotation")
1026
ann_tag.setAttribute("name", annotation)
1027
ann_tag.setAttribute("value", value)
1028
if_tag.appendChild(ann_tag)
1082
# Add annotation tags for properties
1083
for tag in if_tag.getElementsByTagName("property"):
1084
annots = dict()
1085
for name, prop in self._get_all_dbus_things(
1086
"property"):
1087
if (name == tag.getAttribute("name")
1088
and prop._dbus_interface
1089
== if_tag.getAttribute("name")):
1090
annots.update(getattr(
1091
prop, "_dbus_annotations", {}))
1092
for name, value in annots.items():
1093
ann_tag = document.createElement(
1094
"annotation")
1095
ann_tag.setAttribute("name", name)
1096
ann_tag.setAttribute("value", value)
1097
tag.appendChild(ann_tag)
1029
1098
# Add the names to the return values for the
1030
1099
# "org.freedesktop.DBus.Properties" methods
1031
1100
if (if_tag.getAttribute("name")
1054
1123
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1055
1124
if dt is None:
1056
1125
return dbus.String("", variant_level = variant_level)
1057
return dbus.String(dt.isoformat(),
1058
variant_level=variant_level)
1126
return dbus.String(dt.isoformat(), variant_level=variant_level)
1059
1127
1060
1128
1061
1129
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1081
1149
(from DBusObjectWithProperties) and interfaces (from the
1082
1150
dbus_interface_annotations decorator).
1083
1151
"""
1152
1084
1153
def wrapper(cls):
1085
1154
for orig_interface_name, alt_interface_name in (
1086
alt_interface_names.iteritems()):
1155
alt_interface_names.items()):
1087
1156
attr = {}
1088
1157
interface_names = set()
1089
1158
# Go though all attributes of the class
1091
1160
# Ignore non-D-Bus attributes, and D-Bus attributes
1092
1161
# with the wrong interface name
1093
1162
if (not hasattr(attribute, "_dbus_interface")
1094
or not attribute._dbus_interface
1095
.startswith(orig_interface_name)):
1163
or not attribute._dbus_interface.startswith(
1164
orig_interface_name)):
1096
1165
continue
1097
1166
# Create an alternate D-Bus interface name based on
1098
1167
# the current name
1099
alt_interface = (attribute._dbus_interface
1100
.replace(orig_interface_name,
1101
alt_interface_name))
1168
alt_interface = attribute._dbus_interface.replace(
1169
orig_interface_name, alt_interface_name)
1102
1170
interface_names.add(alt_interface)
1103
1171
# Is this a D-Bus signal?
1104
1172
if getattr(attribute, "_dbus_is_signal", False):
1105
# Extract the original non-method undecorated
1106
# function by black magic
1107
nonmethod_func = (dict(
1173
if sys.version_info.major == 2:
1174
# Extract the original non-method undecorated
1175
# function by black magic
1176
nonmethod_func = (dict(
1108
1177
zip(attribute.func_code.co_freevars,
1109
attribute.__closure__))["func"]
1110
.cell_contents)
1178
attribute.__closure__))
1179
["func"].cell_contents)
1180
else:
1181
nonmethod_func = attribute
1111
1182
# Create a new, but exactly alike, function
1112
1183
# object, and decorate it to be a new D-Bus signal
1113
1184
# with the alternate D-Bus interface name
1114
new_function = (dbus.service.signal
1115
(alt_interface,
1116
attribute._dbus_signature)
1117
(types.FunctionType(
1118
nonmethod_func.func_code,
1119
nonmethod_func.func_globals,
1120
nonmethod_func.func_name,
1121
nonmethod_func.func_defaults,
1122
nonmethod_func.func_closure)))
1185
if sys.version_info.major == 2:
1186
new_function = types.FunctionType(
1187
nonmethod_func.func_code,
1188
nonmethod_func.func_globals,
1189
nonmethod_func.func_name,
1190
nonmethod_func.func_defaults,
1191
nonmethod_func.func_closure)
1192
else:
1193
new_function = types.FunctionType(
1194
nonmethod_func.__code__,
1195
nonmethod_func.__globals__,
1196
nonmethod_func.__name__,
1197
nonmethod_func.__defaults__,
1198
nonmethod_func.__closure__)
1199
new_function = (dbus.service.signal(
1200
alt_interface,
1201
attribute._dbus_signature)(new_function))
1123
1202
# Copy annotations, if any
1124
1203
try:
1125
new_function._dbus_annotations = (
1126
dict(attribute._dbus_annotations))
1204
new_function._dbus_annotations = dict(
1205
attribute._dbus_annotations)
1127
1206
except AttributeError:
1128
1207
pass
1129
1208
# Define a creator of a function to call both the
1134
1213
"""This function is a scope container to pass
1135
1214
func1 and func2 to the "call_both" function
1136
1215
outside of its arguments"""
1216
1137
1217
def call_both(*args, **kwargs):
1138
1218
"""This function will emit two D-Bus
1139
1219
signals by calling func1 and func2"""
1140
1220
func1(*args, **kwargs)
1141
1221
func2(*args, **kwargs)
1222
1142
1223
return call_both
1143
1224
# Create the "call_both" function and add it to
1144
1225
# the class
1149
1230
# object. Decorate it to be a new D-Bus method
1150
1231
# with the alternate D-Bus interface name. Add it
1151
1232
# to the class.
1152
attr[attrname] = (dbus.service.method
1153
(alt_interface,
1154
attribute._dbus_in_signature,
1155
attribute._dbus_out_signature)
1156
(types.FunctionType
1157
(attribute.func_code,
1158
attribute.func_globals,
1159
attribute.func_name,
1160
attribute.func_defaults,
1161
attribute.func_closure)))
1233
attr[attrname] = (
1234
dbus.service.method(
1235
alt_interface,
1236
attribute._dbus_in_signature,
1237
attribute._dbus_out_signature)
1238
(types.FunctionType(attribute.func_code,
1239
attribute.func_globals,
1240
attribute.func_name,
1241
attribute.func_defaults,
1242
attribute.func_closure)))
1162
1243
# Copy annotations, if any
1163
1244
try:
1164
attr[attrname]._dbus_annotations = (
1165
dict(attribute._dbus_annotations))
1245
attr[attrname]._dbus_annotations = dict(
1246
attribute._dbus_annotations)
1166
1247
except AttributeError:
1167
1248
pass
1168
1249
# Is this a D-Bus property?
1171
1252
# object, and decorate it to be a new D-Bus
1172
1253
# property with the alternate D-Bus interface
1173
1254
# name. Add it to the class.
1174
attr[attrname] = (dbus_service_property
1175
(alt_interface,
1176
attribute._dbus_signature,
1177
attribute._dbus_access,
1178
attribute
1179
._dbus_get_args_options
1180
["byte_arrays"])
1181
(types.FunctionType
1182
(attribute.func_code,
1183
attribute.func_globals,
1184
attribute.func_name,
1185
attribute.func_defaults,
1186
attribute.func_closure)))
1255
attr[attrname] = (dbus_service_property(
1256
alt_interface, attribute._dbus_signature,
1257
attribute._dbus_access,
1258
attribute._dbus_get_args_options
1259
["byte_arrays"])
1260
(types.FunctionType(
1261
attribute.func_code,
1262
attribute.func_globals,
1263
attribute.func_name,
1264
attribute.func_defaults,
1265
attribute.func_closure)))
1187
1266
# Copy annotations, if any
1188
1267
try:
1189
attr[attrname]._dbus_annotations = (
1190
dict(attribute._dbus_annotations))
1268
attr[attrname]._dbus_annotations = dict(
1269
attribute._dbus_annotations)
1191
1270
except AttributeError:
1192
1271
pass
1193
1272
# Is this a D-Bus interface?
1196
1275
# object. Decorate it to be a new D-Bus interface
1197
1276
# with the alternate D-Bus interface name. Add it
1198
1277
# to the class.
1199
attr[attrname] = (dbus_interface_annotations
1200
(alt_interface)
1201
(types.FunctionType
1202
(attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1278
attr[attrname] = (
1279
dbus_interface_annotations(alt_interface)
1280
(types.FunctionType(attribute.func_code,
1281
attribute.func_globals,
1282
attribute.func_name,
1283
attribute.func_defaults,
1284
attribute.func_closure)))
1207
1285
if deprecate:
1208
1286
# Deprecate all alternate interfaces
1209
iname="_AlternateDBusNames_interface_annotation{0}"
1287
iname="_AlternateDBusNames_interface_annotation{}"
1210
1288
for interface_name in interface_names:
1289
1211
1290
@dbus_interface_annotations(interface_name)
1212
1291
def func(self):
1213
1292
return { "org.freedesktop.DBus.Deprecated":
1214
"true" }
1293
"true" }
1215
1294
# Find an unused name
1216
1295
for aname in (iname.format(i)
1217
1296
for i in itertools.count()):
1221
1300
if interface_names:
1222
1301
# Replace the class with a new subclass of it with
1223
1302
# methods, signals, etc. as created above.
1224
cls = type(b"{0}Alternate".format(cls.__name__),
1225
(cls,), attr)
1303
cls = type(b"{}Alternate".format(cls.__name__),
1304
(cls, ), attr)
1226
1305
return cls
1306
1227
1307
return wrapper
1228
1308
1229
1309
1230
1310
@alternate_dbus_interfaces({"se.recompile.Mandos":
1231
"se.bsnet.fukt.Mandos"})
1311
"se.bsnet.fukt.Mandos"})
1232
1312
class ClientDBus(Client, DBusObjectWithProperties):
1233
1313
"""A Client class using D-Bus
1234
1314
1238
1318
"""
1239
1319
1240
1320
runtime_expansions = (Client.runtime_expansions
1241
+ ("dbus_object_path",))
1321
+ ("dbus_object_path", ))
1322
1323
_interface = "se.recompile.Mandos.Client"
1242
1324
1243
1325
# dbus.service.Object doesn't use super(), so we can't either.
1244
1326
1247
1329
Client.__init__(self, *args, **kwargs)
1248
1330
# Only now, when this client is initialized, can it show up on
1249
1331
# the D-Bus
1250
client_object_name = unicode(self.name).translate(
1332
client_object_name = str(self.name).translate(
1251
1333
{ord("."): ord("_"),
1252
1334
ord("-"): ord("_")})
1253
self.dbus_object_path = (dbus.ObjectPath
1254
("/clients/" + client_object_name))
1335
self.dbus_object_path = dbus.ObjectPath(
1336
"/clients/" + client_object_name)
1255
1337
DBusObjectWithProperties.__init__(self, self.bus,
1256
1338
self.dbus_object_path)
1257
1339
1258
def notifychangeproperty(transform_func,
1259
dbus_name, type_func=lambda x: x,
1260
variant_level=1):
1340
def notifychangeproperty(transform_func, dbus_name,
1341
type_func=lambda x: x,
1342
variant_level=1,
1343
invalidate_only=False,
1344
_interface=_interface):
1261
1345
""" Modify a variable so that it's a property which announces
1262
1346
its changes to DBus.
1263
1347
1268
1352
to the D-Bus. Default: no transform
1269
1353
variant_level: D-Bus variant level. Default: 1
1270
1354
"""
1271
attrname = "_{0}".format(dbus_name)
1355
attrname = "_{}".format(dbus_name)
1356
1272
1357
def setter(self, value):
1273
1358
if hasattr(self, "dbus_object_path"):
1274
1359
if (not hasattr(self, attrname) or
1275
1360
type_func(getattr(self, attrname, None))
1276
1361
!= type_func(value)):
1277
dbus_value = transform_func(type_func(value),
1278
variant_level
1279
=variant_level)
1280
self.PropertyChanged(dbus.String(dbus_name),
1281
dbus_value)
1362
if invalidate_only:
1363
self.PropertiesChanged(
1364
_interface, dbus.Dictionary(),
1365
dbus.Array((dbus_name, )))
1366
else:
1367
dbus_value = transform_func(
1368
type_func(value),
1369
variant_level = variant_level)
1370
self.PropertyChanged(dbus.String(dbus_name),
1371
dbus_value)
1372
self.PropertiesChanged(
1373
_interface,
1374
dbus.Dictionary({ dbus.String(dbus_name):
1375
dbus_value }),
1376
dbus.Array())
1282
1377
setattr(self, attrname, value)
1283
1378
1284
1379
return property(lambda self: getattr(self, attrname), setter)
1290
1385
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1291
1386
last_enabled = notifychangeproperty(datetime_to_dbus,
1292
1387
"LastEnabled")
1293
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1294
type_func = lambda checker:
1295
checker is not None)
1388
checker = notifychangeproperty(
1389
dbus.Boolean, "CheckerRunning",
1390
type_func = lambda checker: checker is not None)
1296
1391
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1297
1392
"LastCheckedOK")
1298
1393
last_checker_status = notifychangeproperty(dbus.Int16,
1301
1396
datetime_to_dbus, "LastApprovalRequest")
1302
1397
approved_by_default = notifychangeproperty(dbus.Boolean,
1303
1398
"ApprovedByDefault")
1304
approval_delay = notifychangeproperty(dbus.UInt64,
1305
"ApprovalDelay",
1306
type_func =
1307
timedelta_to_milliseconds)
1399
approval_delay = notifychangeproperty(
1400
dbus.UInt64, "ApprovalDelay",
1401
type_func = lambda td: td.total_seconds() * 1000)
1308
1402
approval_duration = notifychangeproperty(
1309
1403
dbus.UInt64, "ApprovalDuration",
1310
type_func = timedelta_to_milliseconds)
1404
type_func = lambda td: td.total_seconds() * 1000)
1311
1405
host = notifychangeproperty(dbus.String, "Host")
1312
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1313
type_func =
1314
timedelta_to_milliseconds)
1406
timeout = notifychangeproperty(
1407
dbus.UInt64, "Timeout",
1408
type_func = lambda td: td.total_seconds() * 1000)
1315
1409
extended_timeout = notifychangeproperty(
1316
1410
dbus.UInt64, "ExtendedTimeout",
1317
type_func = timedelta_to_milliseconds)
1318
interval = notifychangeproperty(dbus.UInt64,
1319
"Interval",
1320
type_func =
1321
timedelta_to_milliseconds)
1411
type_func = lambda td: td.total_seconds() * 1000)
1412
interval = notifychangeproperty(
1413
dbus.UInt64, "Interval",
1414
type_func = lambda td: td.total_seconds() * 1000)
1322
1415
checker_command = notifychangeproperty(dbus.String, "Checker")
1416
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1417
invalidate_only=True)
1323
1418
1324
1419
del notifychangeproperty
1325
1420
1332
1427
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1333
1428
Client.__del__(self, *args, **kwargs)
1334
1429
1335
def checker_callback(self, pid, condition, command,
1336
*args, **kwargs):
1337
self.checker_callback_tag = None
1338
self.checker = None
1339
if os.WIFEXITED(condition):
1340
exitstatus = os.WEXITSTATUS(condition)
1430
def checker_callback(self, source, condition,
1431
connection, command, *args, **kwargs):
1432
ret = Client.checker_callback(self, source, condition,
1433
connection, command, *args,
1434
**kwargs)
1435
exitstatus = self.last_checker_status
1436
if exitstatus >= 0:
1341
1437
# Emit D-Bus signal
1342
1438
self.CheckerCompleted(dbus.Int16(exitstatus),
1343
dbus.Int64(condition),
1439
# This is specific to GNU libC
1440
dbus.Int64(exitstatus << 8),
1344
1441
dbus.String(command))
1345
1442
else:
1346
1443
# Emit D-Bus signal
1347
1444
self.CheckerCompleted(dbus.Int16(-1),
1348
dbus.Int64(condition),
1445
dbus.Int64(
1446
# This is specific to GNU libC
1447
(exitstatus << 8)
1448
| self.last_checker_signal),
1349
1449
dbus.String(command))
1350
1351
return Client.checker_callback(self, pid, condition, command,
1352
*args, **kwargs)
1450
return ret
1353
1451
1354
1452
def start_checker(self, *args, **kwargs):
1355
old_checker = self.checker
1356
if self.checker is not None:
1357
old_checker_pid = self.checker.pid
1358
else:
1359
old_checker_pid = None
1453
old_checker_pid = getattr(self.checker, "pid", None)
1360
1454
r = Client.start_checker(self, *args, **kwargs)
1361
1455
# Only if new checker process was started
1362
1456
if (self.checker is not None
1371
1465
1372
1466
def approve(self, value=True):
1373
1467
self.approved = value
1374
gobject.timeout_add(timedelta_to_milliseconds
1375
(self.approval_duration),
1376
self._reset_approved)
1468
gobject.timeout_add(int(self.approval_duration.total_seconds()
1469
* 1000), self._reset_approved)
1377
1470
self.send_changedstate()
1378
1471
1379
1472
## D-Bus methods, signals & properties
1380
_interface = "se.recompile.Mandos.Client"
1381
1473
1382
1474
## Interfaces
1383
1475
1384
@dbus_interface_annotations(_interface)
1385
def _foo(self):
1386
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1387
"false"}
1388
1389
1476
## Signals
1390
1477
1391
1478
# CheckerCompleted - signal
1401
1488
pass
1402
1489
1403
1490
# PropertyChanged - signal
1491
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1404
1492
@dbus.service.signal(_interface, signature="sv")
1405
1493
def PropertyChanged(self, property, value):
1406
1494
"D-Bus signal"
1440
1528
self.checked_ok()
1441
1529
1442
1530
# Enable - method
1531
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1443
1532
@dbus.service.method(_interface)
1444
1533
def Enable(self):
1445
1534
"D-Bus method"
1446
1535
self.enable()
1447
1536
1448
1537
# StartChecker - method
1538
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1449
1539
@dbus.service.method(_interface)
1450
1540
def StartChecker(self):
1451
1541
"D-Bus method"
1452
1542
self.start_checker()
1453
1543
1454
1544
# Disable - method
1545
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1455
1546
@dbus.service.method(_interface)
1456
1547
def Disable(self):
1457
1548
"D-Bus method"
1458
1549
self.disable()
1459
1550
1460
1551
# StopChecker - method
1552
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1461
1553
@dbus.service.method(_interface)
1462
1554
def StopChecker(self):
1463
1555
self.stop_checker()
1470
1562
return dbus.Boolean(bool(self.approvals_pending))
1471
1563
1472
1564
# ApprovedByDefault - property
1473
@dbus_service_property(_interface, signature="b",
1565
@dbus_service_property(_interface,
1566
signature="b",
1474
1567
access="readwrite")
1475
1568
def ApprovedByDefault_dbus_property(self, value=None):
1476
1569
if value is None: # get
1478
1571
self.approved_by_default = bool(value)
1479
1572
1480
1573
# ApprovalDelay - property
1481
@dbus_service_property(_interface, signature="t",
1574
@dbus_service_property(_interface,
1575
signature="t",
1482
1576
access="readwrite")
1483
1577
def ApprovalDelay_dbus_property(self, value=None):
1484
1578
if value is None: # get
1485
return dbus.UInt64(self.approval_delay_milliseconds())
1579
return dbus.UInt64(self.approval_delay.total_seconds()
1580
* 1000)
1486
1581
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1487
1582
1488
1583
# ApprovalDuration - property
1489
@dbus_service_property(_interface, signature="t",
1584
@dbus_service_property(_interface,
1585
signature="t",
1490
1586
access="readwrite")
1491
1587
def ApprovalDuration_dbus_property(self, value=None):
1492
1588
if value is None: # get
1493
return dbus.UInt64(timedelta_to_milliseconds(
1494
self.approval_duration))
1589
return dbus.UInt64(self.approval_duration.total_seconds()
1590
* 1000)
1495
1591
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1496
1592
1497
1593
# Name - property
1594
@dbus_annotations(
1595
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
1596
@dbus_service_property(_interface, signature="s", access="read")
1499
1597
def Name_dbus_property(self):
1500
1598
return dbus.String(self.name)
1501
1599
1502
1600
# Fingerprint - property
1601
@dbus_annotations(
1602
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1503
1603
@dbus_service_property(_interface, signature="s", access="read")
1504
1604
def Fingerprint_dbus_property(self):
1505
1605
return dbus.String(self.fingerprint)
1506
1606
1507
1607
# Host - property
1508
@dbus_service_property(_interface, signature="s",
1608
@dbus_service_property(_interface,
1609
signature="s",
1509
1610
access="readwrite")
1510
1611
def Host_dbus_property(self, value=None):
1511
1612
if value is None: # get
1512
1613
return dbus.String(self.host)
1513
self.host = unicode(value)
1614
self.host = str(value)
1514
1615
1515
1616
# Created - property
1617
@dbus_annotations(
1618
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1516
1619
@dbus_service_property(_interface, signature="s", access="read")
1517
1620
def Created_dbus_property(self):
1518
1621
return datetime_to_dbus(self.created)
1523
1626
return datetime_to_dbus(self.last_enabled)
1524
1627
1525
1628
# Enabled - property
1526
@dbus_service_property(_interface, signature="b",
1629
@dbus_service_property(_interface,
1630
signature="b",
1527
1631
access="readwrite")
1528
1632
def Enabled_dbus_property(self, value=None):
1529
1633
if value is None: # get
1534
1638
self.disable()
1535
1639
1536
1640
# LastCheckedOK - property
1537
@dbus_service_property(_interface, signature="s",
1641
@dbus_service_property(_interface,
1642
signature="s",
1538
1643
access="readwrite")
1539
1644
def LastCheckedOK_dbus_property(self, value=None):
1540
1645
if value is not None:
1543
1648
return datetime_to_dbus(self.last_checked_ok)
1544
1649
1545
1650
# LastCheckerStatus - property
1546
@dbus_service_property(_interface, signature="n",
1547
access="read")
1651
@dbus_service_property(_interface, signature="n", access="read")
1548
1652
def LastCheckerStatus_dbus_property(self):
1549
1653
return dbus.Int16(self.last_checker_status)
1550
1654
1559
1663
return datetime_to_dbus(self.last_approval_request)
1560
1664
1561
1665
# Timeout - property
1562
@dbus_service_property(_interface, signature="t",
1666
@dbus_service_property(_interface,
1667
signature="t",
1563
1668
access="readwrite")
1564
1669
def Timeout_dbus_property(self, value=None):
1565
1670
if value is None: # get
1566
return dbus.UInt64(self.timeout_milliseconds())
1671
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1567
1672
old_timeout = self.timeout
1568
1673
self.timeout = datetime.timedelta(0, 0, 0, value)
1569
1674
# Reschedule disabling
1578
1683
is None):
1579
1684
return
1580
1685
gobject.source_remove(self.disable_initiator_tag)
1581
self.disable_initiator_tag = (
1582
gobject.timeout_add(
1583
timedelta_to_milliseconds(self.expires - now),
1584
self.disable))
1686
self.disable_initiator_tag = gobject.timeout_add(
1687
int((self.expires - now).total_seconds() * 1000),
1688
self.disable)
1585
1689
1586
1690
# ExtendedTimeout - property
1587
@dbus_service_property(_interface, signature="t",
1691
@dbus_service_property(_interface,
1692
signature="t",
1588
1693
access="readwrite")
1589
1694
def ExtendedTimeout_dbus_property(self, value=None):
1590
1695
if value is None: # get
1591
return dbus.UInt64(self.extended_timeout_milliseconds())
1696
return dbus.UInt64(self.extended_timeout.total_seconds()
1697
* 1000)
1592
1698
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1593
1699
1594
1700
# Interval - property
1595
@dbus_service_property(_interface, signature="t",
1701
@dbus_service_property(_interface,
1702
signature="t",
1596
1703
access="readwrite")
1597
1704
def Interval_dbus_property(self, value=None):
1598
1705
if value is None: # get
1599
return dbus.UInt64(self.interval_milliseconds())
1706
return dbus.UInt64(self.interval.total_seconds() * 1000)
1600
1707
self.interval = datetime.timedelta(0, 0, 0, value)
1601
1708
if getattr(self, "checker_initiator_tag", None) is None:
1602
1709
return
1603
1710
if self.enabled:
1604
1711
# Reschedule checker run
1605
1712
gobject.source_remove(self.checker_initiator_tag)
1606
self.checker_initiator_tag = (gobject.timeout_add
1607
(value, self.start_checker))
1608
self.start_checker() # Start one now, too
1713
self.checker_initiator_tag = gobject.timeout_add(
1714
value, self.start_checker)
1715
self.start_checker() # Start one now, too
1609
1716
1610
1717
# Checker - property
1611
@dbus_service_property(_interface, signature="s",
1718
@dbus_service_property(_interface,
1719
signature="s",
1612
1720
access="readwrite")
1613
1721
def Checker_dbus_property(self, value=None):
1614
1722
if value is None: # get
1615
1723
return dbus.String(self.checker_command)
1616
self.checker_command = unicode(value)
1724
self.checker_command = str(value)
1617
1725
1618
1726
# CheckerRunning - property
1619
@dbus_service_property(_interface, signature="b",
1727
@dbus_service_property(_interface,
1728
signature="b",
1620
1729
access="readwrite")
1621
1730
def CheckerRunning_dbus_property(self, value=None):
1622
1731
if value is None: # get
1627
1736
self.stop_checker()
1628
1737
1629
1738
# ObjectPath - property
1739
@dbus_annotations(
1740
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
1741
"org.freedesktop.DBus.Deprecated": "true"})
1630
1742
@dbus_service_property(_interface, signature="o", access="read")
1631
1743
def ObjectPath_dbus_property(self):
1632
1744
return self.dbus_object_path # is already a dbus.ObjectPath
1633
1745
1634
1746
# Secret = property
1635
@dbus_service_property(_interface, signature="ay",
1636
access="write", byte_arrays=True)
1747
@dbus_annotations(
1748
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
1749
"invalidates"})
1750
@dbus_service_property(_interface,
1751
signature="ay",
1752
access="write",
1753
byte_arrays=True)
1637
1754
def Secret_dbus_property(self, value):
1638
self.secret = str(value)
1755
self.secret = bytes(value)
1639
1756
1640
1757
del _interface
1641
1758
1645
1762
self._pipe = child_pipe
1646
1763
self._pipe.send(('init', fpr, address))
1647
1764
if not self._pipe.recv():
1648
raise KeyError()
1765
raise KeyError(fpr)
1649
1766
1650
1767
def __getattribute__(self, name):
1651
1768
if name == '_pipe':
1655
1772
if data[0] == 'data':
1656
1773
return data[1]
1657
1774
if data[0] == 'function':
1775
1658
1776
def func(*args, **kwargs):
1659
1777
self._pipe.send(('funcall', name, args, kwargs))
1660
1778
return self._pipe.recv()[1]
1779
1661
1780
return func
1662
1781
1663
1782
def __setattr__(self, name, value):
1675
1794
def handle(self):
1676
1795
with contextlib.closing(self.server.child_pipe) as child_pipe:
1677
1796
logger.info("TCP connection from: %s",
1678
unicode(self.client_address))
1797
str(self.client_address))
1679
1798
logger.debug("Pipe FD: %d",
1680
1799
self.server.child_pipe.fileno())
1681
1800
1682
session = (gnutls.connection
1683
.ClientSession(self.request,
1684
gnutls.connection
1685
.X509Credentials()))
1801
session = gnutls.connection.ClientSession(
1802
self.request, gnutls.connection .X509Credentials())
1686
1803
1687
1804
# Note: gnutls.connection.X509Credentials is really a
1688
1805
# generic GnuTLS certificate credentials object so long as
1697
1814
priority = self.server.gnutls_priority
1698
1815
if priority is None:
1699
1816
priority = "NORMAL"
1700
(gnutls.library.functions
1701
.gnutls_priority_set_direct(session._c_object,
1702
priority, None))
1817
gnutls.library.functions.gnutls_priority_set_direct(
1818
session._c_object, priority, None)
1703
1819
1704
1820
# Start communication using the Mandos protocol
1705
1821
# Get protocol number
1725
1841
approval_required = False
1726
1842
try:
1727
1843
try:
1728
fpr = self.fingerprint(self.peer_certificate
1729
(session))
1844
fpr = self.fingerprint(
1845
self.peer_certificate(session))
1730
1846
except (TypeError,
1731
1847
gnutls.errors.GNUTLSError) as error:
1732
1848
logger.warning("Bad certificate: %s", error)
1747
1863
while True:
1748
1864
if not client.enabled:
1749
1865
logger.info("Client %s is disabled",
1750
client.name)
1866
client.name)
1751
1867
if self.server.use_dbus:
1752
1868
# Emit D-Bus signal
1753
1869
client.Rejected("Disabled")
1762
1878
if self.server.use_dbus:
1763
1879
# Emit D-Bus signal
1764
1880
client.NeedApproval(
1765
client.approval_delay_milliseconds(),
1766
client.approved_by_default)
1881
client.approval_delay.total_seconds()
1882
* 1000, client.approved_by_default)
1767
1883
else:
1768
1884
logger.warning("Client %s was not approved",
1769
1885
client.name)
1775
1891
#wait until timeout or approved
1776
1892
time = datetime.datetime.now()
1777
1893
client.changedstate.acquire()
1778
client.changedstate.wait(
1779
float(timedelta_to_milliseconds(delay)
1780
/ 1000))
1894
client.changedstate.wait(delay.total_seconds())
1781
1895
client.changedstate.release()
1782
1896
time2 = datetime.datetime.now()
1783
1897
if (time2 - time) >= delay:
1802
1916
logger.warning("gnutls send failed",
1803
1917
exc_info=error)
1804
1918
return
1805
logger.debug("Sent: %d, remaining: %d",
1806
sent, len(client.secret)
1807
- (sent_size + sent))
1919
logger.debug("Sent: %d, remaining: %d", sent,
1920
len(client.secret) - (sent_size
1921
+ sent))
1808
1922
sent_size += sent
1809
1923
1810
1924
logger.info("Sending secret to %s", client.name)
1827
1941
def peer_certificate(session):
1828
1942
"Return the peer's OpenPGP certificate as a bytestring"
1829
1943
# If not an OpenPGP certificate...
1830
if (gnutls.library.functions
1831
.gnutls_certificate_type_get(session._c_object)
1944
if (gnutls.library.functions.gnutls_certificate_type_get(
1945
session._c_object)
1832
1946
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1833
1947
# ...do the normal thing
1834
1948
return session.peer_certificate
1848
1962
def fingerprint(openpgp):
1849
1963
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1850
1964
# New GnuTLS "datum" with the OpenPGP public key
1851
datum = (gnutls.library.types
1852
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1853
ctypes.POINTER
1854
(ctypes.c_ubyte)),
1855
ctypes.c_uint(len(openpgp))))
1965
datum = gnutls.library.types.gnutls_datum_t(
1966
ctypes.cast(ctypes.c_char_p(openpgp),
1967
ctypes.POINTER(ctypes.c_ubyte)),
1968
ctypes.c_uint(len(openpgp)))
1856
1969
# New empty GnuTLS certificate
1857
1970
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1858
(gnutls.library.functions
1859
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1971
gnutls.library.functions.gnutls_openpgp_crt_init(
1972
ctypes.byref(crt))
1860
1973
# Import the OpenPGP public key into the certificate
1861
(gnutls.library.functions
1862
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1863
gnutls.library.constants
1864
.GNUTLS_OPENPGP_FMT_RAW))
1974
gnutls.library.functions.gnutls_openpgp_crt_import(
1975
crt, ctypes.byref(datum),
1976
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1865
1977
# Verify the self signature in the key
1866
1978
crtverify = ctypes.c_uint()
1867
(gnutls.library.functions
1868
.gnutls_openpgp_crt_verify_self(crt, 0,
1869
ctypes.byref(crtverify)))
1979
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1980
crt, 0, ctypes.byref(crtverify))
1870
1981
if crtverify.value != 0:
1871
1982
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1872
raise (gnutls.errors.CertificateSecurityError
1873
("Verify failed"))
1983
raise gnutls.errors.CertificateSecurityError(
1984
"Verify failed")
1874
1985
# New buffer for the fingerprint
1875
1986
buf = ctypes.create_string_buffer(20)
1876
1987
buf_len = ctypes.c_size_t()
1877
1988
# Get the fingerprint from the certificate into the buffer
1878
(gnutls.library.functions
1879
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1880
ctypes.byref(buf_len)))
1989
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1990
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1881
1991
# Deinit the certificate
1882
1992
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1883
1993
# Convert the buffer to a Python bytestring
1889
1999
1890
2000
class MultiprocessingMixIn(object):
1891
2001
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2002
1892
2003
def sub_process_main(self, request, address):
1893
2004
try:
1894
2005
self.finish_request(request, address)
1906
2017
1907
2018
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1908
2019
""" adds a pipe to the MixIn """
2020
1909
2021
def process_request(self, request, client_address):
1910
2022
"""Overrides and wraps the original process_request().
1911
2023
1932
2044
interface: None or a network interface name (string)
1933
2045
use_ipv6: Boolean; to use IPv6 or not
1934
2046
"""
2047
1935
2048
def __init__(self, server_address, RequestHandlerClass,
1936
interface=None, use_ipv6=True, socketfd=None):
2049
interface=None,
2050
use_ipv6=True,
2051
socketfd=None):
1937
2052
"""If socketfd is set, use that file descriptor instead of
1938
2053
creating a new one with socket.socket().
1939
2054
"""
1980
2095
self.interface)
1981
2096
else:
1982
2097
try:
1983
self.socket.setsockopt(socket.SOL_SOCKET,
1984
SO_BINDTODEVICE,
1985
str(self.interface + '\0'))
2098
self.socket.setsockopt(
2099
socket.SOL_SOCKET, SO_BINDTODEVICE,
2100
(self.interface + "\0").encode("utf-8"))
1986
2101
except socket.error as error:
1987
2102
if error.errno == errno.EPERM:
1988
2103
logger.error("No permission to bind to"
2006
2121
self.server_address = (any_address,
2007
2122
self.server_address[1])
2008
2123
elif not self.server_address[1]:
2009
self.server_address = (self.server_address[0],
2010
0)
2124
self.server_address = (self.server_address[0], 0)
2011
2125
# if self.interface:
2012
2126
# self.server_address = (self.server_address[0],
2013
2127
# 0, # port
2027
2141
2028
2142
Assumes a gobject.MainLoop event loop.
2029
2143
"""
2144
2030
2145
def __init__(self, server_address, RequestHandlerClass,
2031
interface=None, use_ipv6=True, clients=None,
2032
gnutls_priority=None, use_dbus=True, socketfd=None):
2146
interface=None,
2147
use_ipv6=True,
2148
clients=None,
2149
gnutls_priority=None,
2150
use_dbus=True,
2151
socketfd=None):
2033
2152
self.enabled = False
2034
2153
self.clients = clients
2035
2154
if self.clients is None:
2041
2160
interface = interface,
2042
2161
use_ipv6 = use_ipv6,
2043
2162
socketfd = socketfd)
2163
2044
2164
def server_activate(self):
2045
2165
if self.enabled:
2046
2166
return socketserver.TCPServer.server_activate(self)
2050
2170
2051
2171
def add_pipe(self, parent_pipe, proc):
2052
2172
# Call "handle_ipc" for both data and EOF events
2053
gobject.io_add_watch(parent_pipe.fileno(),
2054
gobject.IO_IN | gobject.IO_HUP,
2055
functools.partial(self.handle_ipc,
2056
parent_pipe =
2057
parent_pipe,
2058
proc = proc))
2173
gobject.io_add_watch(
2174
parent_pipe.fileno(),
2175
gobject.IO_IN | gobject.IO_HUP,
2176
functools.partial(self.handle_ipc,
2177
parent_pipe = parent_pipe,
2178
proc = proc))
2059
2179
2060
def handle_ipc(self, source, condition, parent_pipe=None,
2061
proc = None, client_object=None):
2180
def handle_ipc(self, source, condition,
2181
parent_pipe=None,
2182
proc = None,
2183
client_object=None):
2062
2184
# error, or the other end of multiprocessing.Pipe has closed
2063
2185
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2064
2186
# Wait for other process to exit
2087
2209
parent_pipe.send(False)
2088
2210
return False
2089
2211
2090
gobject.io_add_watch(parent_pipe.fileno(),
2091
gobject.IO_IN | gobject.IO_HUP,
2092
functools.partial(self.handle_ipc,
2093
parent_pipe =
2094
parent_pipe,
2095
proc = proc,
2096
client_object =
2097
client))
2212
gobject.io_add_watch(
2213
parent_pipe.fileno(),
2214
gobject.IO_IN | gobject.IO_HUP,
2215
functools.partial(self.handle_ipc,
2216
parent_pipe = parent_pipe,
2217
proc = proc,
2218
client_object = client))
2098
2219
parent_pipe.send(True)
2099
2220
# remove the old hook in favor of the new above hook on
2100
2221
# same fileno
2106
2227
2107
2228
parent_pipe.send(('data', getattr(client_object,
2108
2229
funcname)(*args,
2109
**kwargs)))
2230
**kwargs)))
2110
2231
2111
2232
if command == 'getattr':
2112
2233
attrname = request[1]
2113
if callable(client_object.__getattribute__(attrname)):
2114
parent_pipe.send(('function',))
2234
if isinstance(client_object.__getattribute__(attrname),
2235
collections.Callable):
2236
parent_pipe.send(('function', ))
2115
2237
else:
2116
parent_pipe.send(('data', client_object
2117
.__getattribute__(attrname)))
2238
parent_pipe.send((
2239
'data', client_object.__getattribute__(attrname)))
2118
2240
2119
2241
if command == 'setattr':
2120
2242
attrname = request[1]
2151
2273
# avoid excessive use of external libraries.
2152
2274
2153
2275
# New type for defining tokens, syntax, and semantics all-in-one
2154
Token = collections.namedtuple("Token",
2155
("regexp", # To match token; if
2156
# "value" is not None,
2157
# must have a "group"
2158
# containing digits
2159
"value", # datetime.timedelta or
2160
# None
2161
"followers")) # Tokens valid after
2162
# this token
2276
Token = collections.namedtuple("Token", (
2277
"regexp", # To match token; if "value" is not None, must have
2278
# a "group" containing digits
2279
"value", # datetime.timedelta or None
2280
"followers")) # Tokens valid after this token
2163
2281
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
2282
# the "duration" ABNF definition in RFC 3339, Appendix A.
2165
2283
token_end = Token(re.compile(r"$"), None, frozenset())
2166
2284
token_second = Token(re.compile(r"(\d+)S"),
2167
2285
datetime.timedelta(seconds=1),
2168
frozenset((token_end,)))
2286
frozenset((token_end, )))
2169
2287
token_minute = Token(re.compile(r"(\d+)M"),
2170
2288
datetime.timedelta(minutes=1),
2171
2289
frozenset((token_second, token_end)))
2187
2305
frozenset((token_month, token_end)))
2188
2306
token_week = Token(re.compile(r"(\d+)W"),
2189
2307
datetime.timedelta(weeks=1),
2190
frozenset((token_end,)))
2308
frozenset((token_end, )))
2191
2309
token_duration = Token(re.compile(r"P"), None,
2192
2310
frozenset((token_year, token_month,
2193
2311
token_day, token_time,
2194
token_week))),
2312
token_week)))
2195
2313
# Define starting values
2196
2314
value = datetime.timedelta() # Value so far
2197
2315
found_token = None
2198
followers = frozenset(token_duration,) # Following valid tokens
2316
followers = frozenset((token_duration, )) # Following valid tokens
2199
2317
s = duration # String left to parse
2200
2318
# Loop until end token is found
2201
2319
while found_token is not token_end:
2218
2336
break
2219
2337
else:
2220
2338
# No currently valid tokens were found
2221
raise ValueError("Invalid RFC 3339 duration")
2339
raise ValueError("Invalid RFC 3339 duration: {!r}"
2340
.format(duration))
2222
2341
# End token found
2223
2342
return value
2224
2343
2248
2367
timevalue = datetime.timedelta(0)
2249
2368
for s in interval.split():
2250
2369
try:
2251
suffix = unicode(s[-1])
2370
suffix = s[-1]
2252
2371
value = int(s[:-1])
2253
2372
if suffix == "d":
2254
2373
delta = datetime.timedelta(value)
2261
2380
elif suffix == "w":
2262
2381
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2263
2382
else:
2264
raise ValueError("Unknown suffix {0!r}"
2265
.format(suffix))
2383
raise ValueError("Unknown suffix {!r}".format(suffix))
2266
2384
except IndexError as e:
2267
2385
raise ValueError(*(e.args))
2268
2386
timevalue += delta
2285
2403
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2286
2404
if not stat.S_ISCHR(os.fstat(null).st_mode):
2287
2405
raise OSError(errno.ENODEV,
2288
"{0} not a character device"
2406
"{} not a character device"
2289
2407
.format(os.devnull))
2290
2408
os.dup2(null, sys.stdin.fileno())
2291
2409
os.dup2(null, sys.stdout.fileno())
2301
2419
2302
2420
parser = argparse.ArgumentParser()
2303
2421
parser.add_argument("-v", "--version", action="version",
2304
version = "%(prog)s {0}".format(version),
2422
version = "%(prog)s {}".format(version),
2305
2423
help="show version number and exit")
2306
2424
parser.add_argument("-i", "--interface", metavar="IF",
2307
2425
help="Bind to interface IF")
2340
2458
help="Directory to save/restore state in")
2341
2459
parser.add_argument("--foreground", action="store_true",
2342
2460
help="Run in foreground", default=None)
2461
parser.add_argument("--no-zeroconf", action="store_false",
2462
dest="zeroconf", help="Do not use Zeroconf",
2463
default=None)
2343
2464
2344
2465
options = parser.parse_args()
2345
2466
2354
2475
"port": "",
2355
2476
"debug": "False",
2356
2477
"priority":
2357
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2478
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2479
":+SIGN-DSA-SHA256",
2358
2480
"servicename": "Mandos",
2359
2481
"use_dbus": "True",
2360
2482
"use_ipv6": "True",
2363
2485
"socket": "",
2364
2486
"statedir": "/var/lib/mandos",
2365
2487
"foreground": "False",
2366
}
2488
"zeroconf": "True",
2489
}
2367
2490
2368
2491
# Parse config file for server-global settings
2369
2492
server_config = configparser.SafeConfigParser(server_defaults)
2370
2493
del server_defaults
2371
server_config.read(os.path.join(options.configdir,
2372
"mandos.conf"))
2494
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2373
2495
# Convert the SafeConfigParser object to a dict
2374
2496
server_settings = server_config.defaults()
2375
2497
# Use the appropriate methods on the non-string config options
2393
2515
# Override the settings from the config file with command line
2394
2516
# options, if set.
2395
2517
for option in ("interface", "address", "port", "debug",
2396
"priority", "servicename", "configdir",
2397
"use_dbus", "use_ipv6", "debuglevel", "restore",
2398
"statedir", "socket", "foreground"):
2518
"priority", "servicename", "configdir", "use_dbus",
2519
"use_ipv6", "debuglevel", "restore", "statedir",
2520
"socket", "foreground", "zeroconf"):
2399
2521
value = getattr(options, option)
2400
2522
if value is not None:
2401
2523
server_settings[option] = value
2402
2524
del options
2403
2525
# Force all strings to be unicode
2404
2526
for option in server_settings.keys():
2405
if type(server_settings[option]) is str:
2406
server_settings[option] = unicode(server_settings[option])
2527
if isinstance(server_settings[option], bytes):
2528
server_settings[option] = (server_settings[option]
2529
.decode("utf-8"))
2407
2530
# Force all boolean options to be boolean
2408
2531
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2409
"foreground"):
2532
"foreground", "zeroconf"):
2410
2533
server_settings[option] = bool(server_settings[option])
2411
2534
# Debug implies foreground
2412
2535
if server_settings["debug"]:
2415
2538
2416
2539
##################################################################
2417
2540
2541
if (not server_settings["zeroconf"]
2542
and not (server_settings["port"]
2543
or server_settings["socket"] != "")):
2544
parser.error("Needs port or socket to work without Zeroconf")
2545
2418
2546
# For convenience
2419
2547
debug = server_settings["debug"]
2420
2548
debuglevel = server_settings["debuglevel"]
2423
2551
stored_state_path = os.path.join(server_settings["statedir"],
2424
2552
stored_state_file)
2425
2553
foreground = server_settings["foreground"]
2554
zeroconf = server_settings["zeroconf"]
2426
2555
2427
2556
if debug:
2428
2557
initlogger(debug, logging.DEBUG)
2434
2563
initlogger(debug, level)
2435
2564
2436
2565
if server_settings["servicename"] != "Mandos":
2437
syslogger.setFormatter(logging.Formatter
2438
('Mandos ({0}) [%(process)d]:'
2439
' %(levelname)s: %(message)s'
2440
.format(server_settings
2441
["servicename"])))
2566
syslogger.setFormatter(
2567
logging.Formatter('Mandos ({}) [%(process)d]:'
2568
' %(levelname)s: %(message)s'.format(
2569
server_settings["servicename"])))
2442
2570
2443
2571
# Parse config file with clients
2444
2572
client_config = configparser.SafeConfigParser(Client
2449
2577
global mandos_dbus_service
2450
2578
mandos_dbus_service = None
2451
2579
2452
tcp_server = MandosServer((server_settings["address"],
2453
server_settings["port"]),
2454
ClientHandler,
2455
interface=(server_settings["interface"]
2456
or None),
2457
use_ipv6=use_ipv6,
2458
gnutls_priority=
2459
server_settings["priority"],
2460
use_dbus=use_dbus,
2461
socketfd=(server_settings["socket"]
2462
or None))
2580
socketfd = None
2581
if server_settings["socket"] != "":
2582
socketfd = server_settings["socket"]
2583
tcp_server = MandosServer(
2584
(server_settings["address"], server_settings["port"]),
2585
ClientHandler,
2586
interface=(server_settings["interface"] or None),
2587
use_ipv6=use_ipv6,
2588
gnutls_priority=server_settings["priority"],
2589
use_dbus=use_dbus,
2590
socketfd=socketfd)
2463
2591
if not foreground:
2464
2592
pidfilename = "/run/mandos.pid"
2465
2593
if not os.path.isdir("/run/."):
2466
2594
pidfilename = "/var/run/mandos.pid"
2467
2595
pidfile = None
2468
2596
try:
2469
pidfile = open(pidfilename, "w")
2597
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2470
2598
except IOError as e:
2471
2599
logger.error("Could not open file %r", pidfilename,
2472
2600
exc_info=e)
2499
2627
def debug_gnutls(level, string):
2500
2628
logger.debug("GnuTLS: %s", string[:-1])
2501
2629
2502
(gnutls.library.functions
2503
.gnutls_global_set_log_function(debug_gnutls))
2630
gnutls.library.functions.gnutls_global_set_log_function(
2631
debug_gnutls)
2504
2632
2505
2633
# Redirect stdin so all checkers get /dev/null
2506
2634
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2526
2654
if use_dbus:
2527
2655
try:
2528
2656
bus_name = dbus.service.BusName("se.recompile.Mandos",
2529
bus, do_not_queue=True)
2530
old_bus_name = (dbus.service.BusName
2531
("se.bsnet.fukt.Mandos", bus,
2532
do_not_queue=True))
2533
except dbus.exceptions.NameExistsException as e:
2657
bus,
2658
do_not_queue=True)
2659
old_bus_name = dbus.service.BusName(
2660
"se.bsnet.fukt.Mandos", bus,
2661
do_not_queue=True)
2662
except dbus.exceptions.DBusException as e:
2534
2663
logger.error("Disabling D-Bus:", exc_info=e)
2535
2664
use_dbus = False
2536
2665
server_settings["use_dbus"] = False
2537
2666
tcp_server.use_dbus = False
2538
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2539
service = AvahiServiceToSyslog(name =
2540
server_settings["servicename"],
2541
servicetype = "_mandos._tcp",
2542
protocol = protocol, bus = bus)
2543
if server_settings["interface"]:
2544
service.interface = (if_nametoindex
2545
(str(server_settings["interface"])))
2667
if zeroconf:
2668
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2669
service = AvahiServiceToSyslog(
2670
name = server_settings["servicename"],
2671
servicetype = "_mandos._tcp",
2672
protocol = protocol,
2673
bus = bus)
2674
if server_settings["interface"]:
2675
service.interface = if_nametoindex(
2676
server_settings["interface"].encode("utf-8"))
2546
2677
2547
2678
global multiprocessing_manager
2548
2679
multiprocessing_manager = multiprocessing.Manager()
2567
2698
if server_settings["restore"]:
2568
2699
try:
2569
2700
with open(stored_state_path, "rb") as stored_state:
2570
clients_data, old_client_settings = (pickle.load
2571
(stored_state))
2701
clients_data, old_client_settings = pickle.load(
2702
stored_state)
2572
2703
os.remove(stored_state_path)
2573
2704
except IOError as e:
2574
2705
if e.errno == errno.ENOENT:
2575
logger.warning("Could not load persistent state: {0}"
2576
.format(os.strerror(e.errno)))
2706
logger.warning("Could not load persistent state:"
2707
" {}".format(os.strerror(e.errno)))
2577
2708
else:
2578
2709
logger.critical("Could not load persistent state:",
2579
2710
exc_info=e)
2580
2711
raise
2581
2712
except EOFError as e:
2582
2713
logger.warning("Could not load persistent state: "
2583
"EOFError:", exc_info=e)
2714
"EOFError:",
2715
exc_info=e)
2584
2716
2585
2717
with PGPEngine() as pgp:
2586
for client_name, client in clients_data.iteritems():
2718
for client_name, client in clients_data.items():
2587
2719
# Skip removed clients
2588
2720
if client_name not in client_settings:
2589
2721
continue
2598
2730
# For each value in new config, check if it
2599
2731
# differs from the old config value (Except for
2600
2732
# the "secret" attribute)
2601
if (name != "secret" and
2602
value != old_client_settings[client_name]
2603
[name]):
2733
if (name != "secret"
2734
and (value !=
2735
old_client_settings[client_name][name])):
2604
2736
client[name] = value
2605
2737
except KeyError:
2606
2738
pass
2607
2739
2608
2740
# Clients who has passed its expire date can still be
2609
# enabled if its last checker was successful. Clients
2741
# enabled if its last checker was successful. A Client
2610
2742
# whose checker succeeded before we stored its state is
2611
2743
# assumed to have successfully run all checkers during
2612
2744
# downtime.
2614
2746
if datetime.datetime.utcnow() >= client["expires"]:
2615
2747
if not client["last_checked_ok"]:
2616
2748
logger.warning(
2617
"disabling client {0} - Client never "
2618
"performed a successful checker"
2619
.format(client_name))
2749
"disabling client {} - Client never "
2750
"performed a successful checker".format(
2751
client_name))
2620
2752
client["enabled"] = False
2621
2753
elif client["last_checker_status"] != 0:
2622
2754
logger.warning(
2623
"disabling client {0} - Client "
2624
"last checker failed with error code {1}"
2625
.format(client_name,
2626
client["last_checker_status"]))
2755
"disabling client {} - Client last"
2756
" checker failed with error code"
2757
" {}".format(
2758
client_name,
2759
client["last_checker_status"]))
2627
2760
client["enabled"] = False
2628
2761
else:
2629
client["expires"] = (datetime.datetime
2630
.utcnow()
2631
+ client["timeout"])
2762
client["expires"] = (
2763
datetime.datetime.utcnow()
2764
+ client["timeout"])
2632
2765
logger.debug("Last checker succeeded,"
2633
" keeping {0} enabled"
2634
.format(client_name))
2766
" keeping {} enabled".format(
2767
client_name))
2635
2768
try:
2636
client["secret"] = (
2637
pgp.decrypt(client["encrypted_secret"],
2638
client_settings[client_name]
2639
["secret"]))
2769
client["secret"] = pgp.decrypt(
2770
client["encrypted_secret"],
2771
client_settings[client_name]["secret"])
2640
2772
except PGPError:
2641
2773
# If decryption fails, we use secret from new settings
2642
logger.debug("Failed to decrypt {0} old secret"
2643
.format(client_name))
2644
client["secret"] = (
2645
client_settings[client_name]["secret"])
2774
logger.debug("Failed to decrypt {} old secret".format(
2775
client_name))
2776
client["secret"] = (client_settings[client_name]
2777
["secret"])
2646
2778
2647
2779
# Add/remove clients based on new changes made to config
2648
2780
for client_name in (set(old_client_settings)
2653
2785
clients_data[client_name] = client_settings[client_name]
2654
2786
2655
2787
# Create all client objects
2656
for client_name, client in clients_data.iteritems():
2788
for client_name, client in clients_data.items():
2657
2789
tcp_server.clients[client_name] = client_class(
2658
name = client_name, settings = client,
2790
name = client_name,
2791
settings = client,
2659
2792
server_settings = server_settings)
2660
2793
2661
2794
if not tcp_server.clients:
2663
2796
2664
2797
if not foreground:
2665
2798
if pidfile is not None:
2799
pid = os.getpid()
2666
2800
try:
2667
2801
with pidfile:
2668
pid = os.getpid()
2669
pidfile.write(str(pid) + "\n".encode("utf-8"))
2802
print(pid, file=pidfile)
2670
2803
except IOError:
2671
2804
logger.error("Could not write to file %r with PID %d",
2672
2805
pidfilename, pid)
2677
2810
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2678
2811
2679
2812
if use_dbus:
2680
@alternate_dbus_interfaces({"se.recompile.Mandos":
2681
"se.bsnet.fukt.Mandos"})
2682
class MandosDBusService(DBusObjectWithProperties):
2813
2814
@alternate_dbus_interfaces(
2815
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2816
class MandosDBusService(DBusObjectWithAnnotations):
2683
2817
"""A D-Bus proxy object"""
2818
2684
2819
def __init__(self):
2685
2820
dbus.service.Object.__init__(self, bus, "/")
2821
2686
2822
_interface = "se.recompile.Mandos"
2687
2823
2688
@dbus_interface_annotations(_interface)
2689
def _foo(self):
2690
return { "org.freedesktop.DBus.Property"
2691
".EmitsChangedSignal":
2692
"false"}
2693
2694
2824
@dbus.service.signal(_interface, signature="o")
2695
2825
def ClientAdded(self, objpath):
2696
2826
"D-Bus signal"
2709
2839
@dbus.service.method(_interface, out_signature="ao")
2710
2840
def GetAllClients(self):
2711
2841
"D-Bus method"
2712
return dbus.Array(c.dbus_object_path
2713
for c in
2842
return dbus.Array(c.dbus_object_path for c in
2714
2843
tcp_server.clients.itervalues())
2715
2844
2716
2845
@dbus.service.method(_interface,
2718
2847
def GetAllClientsWithProperties(self):
2719
2848
"D-Bus method"
2720
2849
return dbus.Dictionary(
2721
((c.dbus_object_path, c.GetAll(""))
2722
for c in tcp_server.clients.itervalues()),
2850
{ c.dbus_object_path: c.GetAll("")
2851
for c in tcp_server.clients.itervalues() },
2723
2852
signature="oa{sv}")
2724
2853
2725
2854
@dbus.service.method(_interface, in_signature="o")
2742
2871
2743
2872
def cleanup():
2744
2873
"Cleanup function; run on exit"
2745
service.cleanup()
2874
if zeroconf:
2875
service.cleanup()
2746
2876
2747
2877
multiprocessing.active_children()
2748
2878
wnull.close()
2762
2892
2763
2893
# A list of attributes that can not be pickled
2764
2894
# + secret.
2765
exclude = set(("bus", "changedstate", "secret",
2766
"checker", "server_settings"))
2767
for name, typ in (inspect.getmembers
2768
(dbus.service.Object)):
2895
exclude = { "bus", "changedstate", "secret",
2896
"checker", "server_settings" }
2897
for name, typ in inspect.getmembers(dbus.service
2898
.Object):
2769
2899
exclude.add(name)
2770
2900
2771
2901
client_dict["encrypted_secret"] = (client
2778
2908
del client_settings[client.name]["secret"]
2779
2909
2780
2910
try:
2781
with (tempfile.NamedTemporaryFile
2782
(mode='wb', suffix=".pickle", prefix='clients-',
2783
dir=os.path.dirname(stored_state_path),
2784
delete=False)) as stored_state:
2911
with tempfile.NamedTemporaryFile(
2912
mode='wb',
2913
suffix=".pickle",
2914
prefix='clients-',
2915
dir=os.path.dirname(stored_state_path),
2916
delete=False) as stored_state:
2785
2917
pickle.dump((clients, client_settings), stored_state)
2786
tempname=stored_state.name
2918
tempname = stored_state.name
2787
2919
os.rename(tempname, stored_state_path)
2788
2920
except (IOError, OSError) as e:
2789
2921
if not debug:
2792
2924
except NameError:
2793
2925
pass
2794
2926
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2795
logger.warning("Could not save persistent state: {0}"
2927
logger.warning("Could not save persistent state: {}"
2796
2928
.format(os.strerror(e.errno)))
2797
2929
else:
2798
2930
logger.warning("Could not save persistent state:",
2808
2940
client.disable(quiet=True)
2809
2941
if use_dbus:
2810
2942
# Emit D-Bus signal
2811
mandos_dbus_service.ClientRemoved(client
2812
.dbus_object_path,
2813
client.name)
2943
mandos_dbus_service.ClientRemoved(
2944
client.dbus_object_path, client.name)
2814
2945
client_settings.clear()
2815
2946
2816
2947
atexit.register(cleanup)
2827
2958
tcp_server.server_activate()
2828
2959
2829
2960
# Find out what port we got
2830
service.port = tcp_server.socket.getsockname()[1]
2961
if zeroconf:
2962
service.port = tcp_server.socket.getsockname()[1]
2831
2963
if use_ipv6:
2832
2964
logger.info("Now listening on address %r, port %d,"
2833
2965
" flowinfo %d, scope_id %d",
2839
2971
#service.interface = tcp_server.socket.getsockname()[3]
2840
2972
2841
2973
try:
2842
# From the Avahi example code
2843
try:
2844
service.activate()
2845
except dbus.exceptions.DBusException as error:
2846
logger.critical("D-Bus Exception", exc_info=error)
2847
cleanup()
2848
sys.exit(1)
2849
# End of Avahi example code
2974
if zeroconf:
2975
# From the Avahi example code
2976
try:
2977
service.activate()
2978
except dbus.exceptions.DBusException as error:
2979
logger.critical("D-Bus Exception", exc_info=error)
2980
cleanup()
2981
sys.exit(1)
2982
# End of Avahi example code
2850
2983
2851
2984
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2852
2985
lambda *args, **kwargs:
2867
3000
# Must run before the D-Bus bus name gets deregistered
2868
3001
cleanup()
2869
3002
3003
2870
3004
if __name__ == '__main__':
2871
3005
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0