To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 803
- compare with another revision
- download diff
- download tarball
- view history from revision 803
- Committer: Teddy Hogeborn
- Date: 2016-02-28 12:29:12 UTC
- Revision ID: teddy@recompile.se-20160228122912-6yxw70vq8oze7ogc
Remove version specific packages from Debian dependencies.
* debian/control (Source: mandos/Build-Depends-Indep): Remove
"python2.7", "python2.7-dbus", "python2.7-avahi", and
"python2.7-gobject"; replace with "python (= 2.7)", "python-dbus",
"python-avahi", "python-gobject".
Thanks: Scott Kitterman <debian@kitterman.com>
Closes: #811159
* debian/control (Source: mandos/Build-Depends-Indep): Remove
"python2.7", "python2.7-dbus", "python2.7-avahi", and
"python2.7-gobject"; replace with "python (= 2.7)", "python-dbus",
"python-avahi", "python-gobject".
Thanks: Scott Kitterman <debian@kitterman.com>
Closes: #811159
- files added:
- debian/upstream
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
43
46
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
47
try:
48
import ConfigParser as configparser
49
except ImportError:
50
import configparser
51
51
import sys
52
52
import re
53
53
import os
62
62
import struct
63
63
import fcntl
64
64
import functools
65
import cPickle as pickle
65
try:
66
import cPickle as pickle
67
except ImportError:
68
import pickle
66
69
import multiprocessing
67
70
import types
68
71
import binascii
69
72
import tempfile
70
73
import itertools
71
74
import collections
75
import codecs
72
76
73
77
import dbus
74
78
import dbus.service
75
import gobject
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
76
83
import avahi
77
84
from dbus.mainloop.glib import DBusGMainLoop
78
85
import ctypes
88
95
except ImportError:
89
96
SO_BINDTODEVICE = None
90
97
91
version = "1.6.1"
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.1"
92
102
stored_state_file = "clients.pickle"
93
103
94
104
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
105
syslogger = None
98
106
99
107
try:
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
108
if_nametoindex = ctypes.cdll.LoadLibrary(
109
ctypes.util.find_library("c")).if_nametoindex
103
110
except (OSError, AttributeError):
111
104
112
def if_nametoindex(interface):
105
113
"Get an interface index the hard way, i.e. using fcntl()"
106
114
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
115
with contextlib.closing(socket.socket()) as s:
108
116
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
117
struct.pack(b"16s16x", interface))
118
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
119
return interface_index
114
120
115
121
116
122
def initlogger(debug, level=logging.WARNING):
117
123
"""init logger and add loglevel"""
118
124
125
global syslogger
126
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
119
129
syslogger.setFormatter(logging.Formatter
120
130
('Mandos [%(process)d]: %(levelname)s:'
121
131
' %(message)s'))
138
148
139
149
class PGPEngine(object):
140
150
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
141
152
def __init__(self):
142
153
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
154
self.gnupgargs = ['--batch',
172
183
def password_encode(self, password):
173
184
# Passphrase can not be empty and can not contain newlines or
174
185
# NUL bytes. So we prefix it and hex encode it.
175
return b"mandos" + binascii.hexlify(password)
186
encoded = b"mandos" + binascii.hexlify(password)
187
if len(encoded) > 2048:
188
# GnuPG can't handle long passwords, so encode differently
189
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
190
.replace(b"\n", b"\\n")
191
.replace(b"\0", b"\\x00"))
192
return encoded
176
193
177
194
def encrypt(self, data, password):
178
195
passphrase = self.password_encode(password)
179
with tempfile.NamedTemporaryFile(dir=self.tempdir
180
) as passfile:
196
with tempfile.NamedTemporaryFile(
197
dir=self.tempdir) as passfile:
181
198
passfile.write(passphrase)
182
199
passfile.flush()
183
200
proc = subprocess.Popen(['gpg', '--symmetric',
194
211
195
212
def decrypt(self, data, password):
196
213
passphrase = self.password_encode(password)
197
with tempfile.NamedTemporaryFile(dir = self.tempdir
198
) as passfile:
214
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
199
216
passfile.write(passphrase)
200
217
passfile.flush()
201
218
proc = subprocess.Popen(['gpg', '--decrypt',
205
222
stdin = subprocess.PIPE,
206
223
stdout = subprocess.PIPE,
207
224
stderr = subprocess.PIPE)
208
decrypted_plaintext, err = proc.communicate(input
209
= data)
225
decrypted_plaintext, err = proc.communicate(input = data)
210
226
if proc.returncode != 0:
211
227
raise PGPError(err)
212
228
return decrypted_plaintext
215
231
class AvahiError(Exception):
216
232
def __init__(self, value, *args, **kwargs):
217
233
self.value = value
218
super(AvahiError, self).__init__(value, *args, **kwargs)
219
def __unicode__(self):
220
return unicode(repr(self.value))
234
return super(AvahiError, self).__init__(value, *args,
235
**kwargs)
236
221
237
222
238
class AvahiServiceError(AvahiError):
223
239
pass
224
240
241
225
242
class AvahiGroupError(AvahiError):
226
243
pass
227
244
247
264
bus: dbus.SystemBus()
248
265
"""
249
266
250
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
servicetype = None, port = None, TXT = None,
252
domain = "", host = "", max_renames = 32768,
253
protocol = avahi.PROTO_UNSPEC, bus = None):
267
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
254
278
self.interface = interface
255
279
self.name = name
256
280
self.type = servicetype
266
290
self.bus = bus
267
291
self.entry_group_state_changed_match = None
268
292
269
def rename(self):
293
def rename(self, remove=True):
270
294
"""Derived from the Avahi example code"""
271
295
if self.rename_count >= self.max_renames:
272
296
logger.critical("No suitable Zeroconf service name found"
273
297
" after %i retries, exiting.",
274
298
self.rename_count)
275
299
raise AvahiServiceError("Too many renames")
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
300
self.name = str(
301
self.server.GetAlternativeServiceName(self.name))
302
self.rename_count += 1
278
303
logger.info("Changing Zeroconf service name to %r ...",
279
304
self.name)
280
self.remove()
305
if remove:
306
self.remove()
281
307
try:
282
308
self.add()
283
309
except dbus.exceptions.DBusException as error:
284
logger.critical("D-Bus Exception", exc_info=error)
285
self.cleanup()
286
os._exit(1)
287
self.rename_count += 1
310
if (error.get_dbus_name()
311
== "org.freedesktop.Avahi.CollisionError"):
312
logger.info("Local Zeroconf service name collision.")
313
return self.rename(remove=False)
314
else:
315
logger.critical("D-Bus Exception", exc_info=error)
316
self.cleanup()
317
os._exit(1)
288
318
289
319
def remove(self):
290
320
"""Derived from the Avahi example code"""
328
358
self.rename()
329
359
elif state == avahi.ENTRY_GROUP_FAILURE:
330
360
logger.critical("Avahi: Error in group state changed %s",
331
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
361
str(error))
362
raise AvahiGroupError("State changed: {!s}".format(error))
334
363
335
364
def cleanup(self):
336
365
"""Derived from the Avahi example code"""
346
375
def server_state_changed(self, state, error=None):
347
376
"""Derived from the Avahi example code"""
348
377
logger.debug("Avahi server state change: %i", state)
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
378
bad_states = {
379
avahi.SERVER_INVALID: "Zeroconf server invalid",
380
avahi.SERVER_REGISTERING: None,
381
avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
avahi.SERVER_FAILURE: "Zeroconf server failure",
383
}
356
384
if state in bad_states:
357
385
if bad_states[state] is not None:
358
386
if error is None:
361
389
logger.error(bad_states[state] + ": %r", error)
362
390
self.cleanup()
363
391
elif state == avahi.SERVER_RUNNING:
364
self.add()
392
try:
393
self.add()
394
except dbus.exceptions.DBusException as error:
395
if (error.get_dbus_name()
396
== "org.freedesktop.Avahi.CollisionError"):
397
logger.info("Local Zeroconf service name"
398
" collision.")
399
return self.rename(remove=False)
400
else:
401
logger.critical("D-Bus Exception", exc_info=error)
402
self.cleanup()
403
os._exit(1)
365
404
else:
366
405
if error is None:
367
406
logger.debug("Unknown state: %r", state)
377
416
follow_name_owner_changes=True),
378
417
avahi.DBUS_INTERFACE_SERVER)
379
418
self.server.connect_to_signal("StateChanged",
380
self.server_state_changed)
419
self.server_state_changed)
381
420
self.server_state_changed(self.server.GetState())
382
421
383
422
384
423
class AvahiServiceToSyslog(AvahiService):
385
def rename(self):
424
def rename(self, *args, **kwargs):
386
425
"""Add the new name to the syslog messages"""
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
426
ret = AvahiService.rename(self, *args, **kwargs)
427
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
.format(self.name)))
392
430
return ret
393
431
394
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
400
432
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
448
# Unless otherwise indicated, the constants and types below are
449
# all from the gnutls/gnutls.h C header file.
450
451
# Constants
452
E_SUCCESS = 0
453
E_INTERRUPTED = -52
454
E_AGAIN = -28
455
CRT_OPENPGP = 2
456
CLIENT = 2
457
SHUT_RDWR = 0
458
CRD_CERTIFICATE = 1
459
E_NO_CERTIFICATE_FOUND = -49
460
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
462
# Types
463
class session_int(ctypes.Structure):
464
_fields_ = []
465
session_t = ctypes.POINTER(session_int)
466
class certificate_credentials_st(ctypes.Structure):
467
_fields_ = []
468
certificate_credentials_t = ctypes.POINTER(
469
certificate_credentials_st)
470
certificate_type_t = ctypes.c_int
471
class datum_t(ctypes.Structure):
472
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
('size', ctypes.c_uint)]
474
class openpgp_crt_int(ctypes.Structure):
475
_fields_ = []
476
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
480
transport_ptr_t = ctypes.c_void_p
481
close_request_t = ctypes.c_int
482
483
# Exceptions
484
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
490
# Default usage is by a message string, but if a return
491
# code is passed, convert it to a string with
492
# gnutls.strerror()
493
self.code = code
494
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
497
message, *args)
498
499
class CertificateSecurityError(Error):
500
pass
501
502
# Classes
503
class Credentials(object):
504
def __init__(self):
505
self._c_object = gnutls.certificate_credentials_t()
506
gnutls.certificate_allocate_credentials(
507
ctypes.byref(self._c_object))
508
self.type = gnutls.CRD_CERTIFICATE
509
510
def __del__(self):
511
gnutls.certificate_free_credentials(self._c_object)
512
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
515
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
gnutls.set_default_priority(self._c_object)
518
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
gnutls.handshake_set_private_extensions(self._c_object,
520
True)
521
self.socket = socket
522
if credentials is None:
523
credentials = gnutls.Credentials()
524
gnutls.credentials_set(self._c_object, credentials.type,
525
ctypes.cast(credentials._c_object,
526
ctypes.c_void_p))
527
self.credentials = credentials
528
529
def __del__(self):
530
gnutls.deinit(self._c_object)
531
532
def handshake(self):
533
return gnutls.handshake(self._c_object)
534
535
def send(self, data):
536
data = bytes(data)
537
data_len = len(data)
538
while data_len > 0:
539
data_len -= gnutls.record_send(self._c_object,
540
data[-data_len:],
541
data_len)
542
543
def bye(self):
544
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
546
# Error handling functions
547
def _error_code(result):
548
"""A function to raise exceptions on errors, suitable
549
for the 'restype' attribute on ctypes functions"""
550
if result >= 0:
551
return result
552
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
556
def _retry_on_error(result, func, arguments):
557
"""A function to retry on some errors, suitable
558
for the 'errcheck' attribute on ctypes functions"""
559
while result < 0:
560
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
561
return _error_code(result)
562
result = func(*arguments)
563
return result
564
565
# Unless otherwise indicated, the function declarations below are
566
# all from the gnutls/gnutls.h C header file.
567
568
# Functions
569
priority_set_direct = _library.gnutls_priority_set_direct
570
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
ctypes.POINTER(ctypes.c_char_p)]
572
priority_set_direct.restype = _error_code
573
574
init = _library.gnutls_init
575
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
init.restype = _error_code
577
578
set_default_priority = _library.gnutls_set_default_priority
579
set_default_priority.argtypes = [session_t]
580
set_default_priority.restype = _error_code
581
582
record_send = _library.gnutls_record_send
583
record_send.argtypes = [session_t, ctypes.c_void_p,
584
ctypes.c_size_t]
585
record_send.restype = ctypes.c_ssize_t
586
record_send.errcheck = _retry_on_error
587
588
certificate_allocate_credentials = (
589
_library.gnutls_certificate_allocate_credentials)
590
certificate_allocate_credentials.argtypes = [
591
ctypes.POINTER(certificate_credentials_t)]
592
certificate_allocate_credentials.restype = _error_code
593
594
certificate_free_credentials = (
595
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
597
certificate_free_credentials.restype = None
598
599
handshake_set_private_extensions = (
600
_library.gnutls_handshake_set_private_extensions)
601
handshake_set_private_extensions.argtypes = [session_t,
602
ctypes.c_int]
603
handshake_set_private_extensions.restype = None
604
605
credentials_set = _library.gnutls_credentials_set
606
credentials_set.argtypes = [session_t, credentials_type_t,
607
ctypes.c_void_p]
608
credentials_set.restype = _error_code
609
610
strerror = _library.gnutls_strerror
611
strerror.argtypes = [ctypes.c_int]
612
strerror.restype = ctypes.c_char_p
613
614
certificate_type_get = _library.gnutls_certificate_type_get
615
certificate_type_get.argtypes = [session_t]
616
certificate_type_get.restype = _error_code
617
618
certificate_get_peers = _library.gnutls_certificate_get_peers
619
certificate_get_peers.argtypes = [session_t,
620
ctypes.POINTER(ctypes.c_uint)]
621
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
623
global_set_log_level = _library.gnutls_global_set_log_level
624
global_set_log_level.argtypes = [ctypes.c_int]
625
global_set_log_level.restype = None
626
627
global_set_log_function = _library.gnutls_global_set_log_function
628
global_set_log_function.argtypes = [log_func]
629
global_set_log_function.restype = None
630
631
deinit = _library.gnutls_deinit
632
deinit.argtypes = [session_t]
633
deinit.restype = None
634
635
handshake = _library.gnutls_handshake
636
handshake.argtypes = [session_t]
637
handshake.restype = _error_code
638
handshake.errcheck = _retry_on_error
639
640
transport_set_ptr = _library.gnutls_transport_set_ptr
641
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
transport_set_ptr.restype = None
643
644
bye = _library.gnutls_bye
645
bye.argtypes = [session_t, close_request_t]
646
bye.restype = _error_code
647
bye.errcheck = _retry_on_error
648
649
check_version = _library.gnutls_check_version
650
check_version.argtypes = [ctypes.c_char_p]
651
check_version.restype = ctypes.c_char_p
652
653
# All the function declarations below are from gnutls/openpgp.h
654
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
658
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
662
openpgp_crt_fmt_t]
663
openpgp_crt_import.restype = _error_code
664
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
669
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
673
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
677
ctypes.c_void_p,
678
ctypes.POINTER(
679
ctypes.c_size_t)]
680
openpgp_crt_get_fingerprint.restype = _error_code
681
682
# Remove non-public functions
683
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
685
gnutls = GnuTLS()
686
687
def call_pipe(connection, # : multiprocessing.Connection
688
func, *args, **kwargs):
689
"""This function is meant to be called by multiprocessing.Process
690
691
This function runs func(*args, **kwargs), and writes the resulting
692
return value on the provided multiprocessing.Connection.
693
"""
694
connection.send(func(*args, **kwargs))
695
connection.close()
401
696
402
697
class Client(object):
403
698
"""A representation of a client host served by this server.
430
725
last_checker_status: integer between 0 and 255 reflecting exit
431
726
status of last checker. -1 reflects crashed
432
727
checker, -2 means no checker completed yet.
728
last_checker_signal: The signal which killed the last checker, if
729
last_checker_status is -1
433
730
last_enabled: datetime.datetime(); (UTC) or None
434
731
name: string; from the config file, used in log messages and
435
732
D-Bus identifiers
448
745
"fingerprint", "host", "interval",
449
746
"last_approval_request", "last_checked_ok",
450
747
"last_enabled", "name", "timeout")
451
client_defaults = { "timeout": "PT5M",
452
"extended_timeout": "PT15M",
453
"interval": "PT2M",
454
"checker": "fping -q -- %%(host)s",
455
"host": "",
456
"approval_delay": "PT0S",
457
"approval_duration": "PT1S",
458
"approved_by_default": "True",
459
"enabled": "True",
460
}
461
462
def timeout_milliseconds(self):
463
"Return the 'timeout' attribute in milliseconds"
464
return timedelta_to_milliseconds(self.timeout)
465
466
def extended_timeout_milliseconds(self):
467
"Return the 'extended_timeout' attribute in milliseconds"
468
return timedelta_to_milliseconds(self.extended_timeout)
469
470
def interval_milliseconds(self):
471
"Return the 'interval' attribute in milliseconds"
472
return timedelta_to_milliseconds(self.interval)
473
474
def approval_delay_milliseconds(self):
475
return timedelta_to_milliseconds(self.approval_delay)
748
client_defaults = {
749
"timeout": "PT5M",
750
"extended_timeout": "PT15M",
751
"interval": "PT2M",
752
"checker": "fping -q -- %%(host)s",
753
"host": "",
754
"approval_delay": "PT0S",
755
"approval_duration": "PT1S",
756
"approved_by_default": "True",
757
"enabled": "True",
758
}
476
759
477
760
@staticmethod
478
761
def config_parser(config):
494
777
client["enabled"] = config.getboolean(client_name,
495
778
"enabled")
496
779
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
497
783
client["fingerprint"] = (section["fingerprint"].upper()
498
784
.replace(" ", ""))
499
785
if "secret" in section:
504
790
"rb") as secfile:
505
791
client["secret"] = secfile.read()
506
792
else:
507
raise TypeError("No secret or secfile for section {0}"
793
raise TypeError("No secret or secfile for section {}"
508
794
.format(section))
509
795
client["timeout"] = string_to_delta(section["timeout"])
510
796
client["extended_timeout"] = string_to_delta(
527
813
server_settings = {}
528
814
self.server_settings = server_settings
529
815
# adding all client settings
530
for setting, value in settings.iteritems():
816
for setting, value in settings.items():
531
817
setattr(self, setting, value)
532
818
533
819
if self.enabled:
541
827
self.expires = None
542
828
543
829
logger.debug("Creating client %r", self.name)
544
# Uppercase and remove spaces from fingerprint for later
545
# comparison purposes with return value from the fingerprint()
546
# function
547
830
logger.debug(" Fingerprint: %s", self.fingerprint)
548
831
self.created = settings.get("created",
549
832
datetime.datetime.utcnow())
556
839
self.current_checker_command = None
557
840
self.approved = None
558
841
self.approvals_pending = 0
559
self.changedstate = (multiprocessing_manager
560
.Condition(multiprocessing_manager
561
.Lock()))
562
self.client_structure = [attr for attr in
563
self.__dict__.iterkeys()
842
self.changedstate = multiprocessing_manager.Condition(
843
multiprocessing_manager.Lock())
844
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
564
846
if not attr.startswith("_")]
565
847
self.client_structure.append("client_structure")
566
848
567
for name, t in inspect.getmembers(type(self),
568
lambda obj:
569
isinstance(obj,
570
property)):
849
for name, t in inspect.getmembers(
850
type(self), lambda obj: isinstance(obj, property)):
571
851
if not name.startswith("_"):
572
852
self.client_structure.append(name)
573
853
615
895
# and every interval from then on.
616
896
if self.checker_initiator_tag is not None:
617
897
gobject.source_remove(self.checker_initiator_tag)
618
self.checker_initiator_tag = (gobject.timeout_add
619
(self.interval_milliseconds(),
620
self.start_checker))
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
900
self.start_checker)
621
901
# Schedule a disable() when 'timeout' has passed
622
902
if self.disable_initiator_tag is not None:
623
903
gobject.source_remove(self.disable_initiator_tag)
624
self.disable_initiator_tag = (gobject.timeout_add
625
(self.timeout_milliseconds(),
626
self.disable))
904
self.disable_initiator_tag = gobject.timeout_add(
905
int(self.timeout.total_seconds() * 1000), self.disable)
627
906
# Also start a new checker *right now*.
628
907
self.start_checker()
629
908
630
def checker_callback(self, pid, condition, command):
909
def checker_callback(self, source, condition, connection,
910
command):
631
911
"""The checker has completed, so take appropriate actions."""
632
912
self.checker_callback_tag = None
633
913
self.checker = None
634
if os.WIFEXITED(condition):
635
self.last_checker_status = os.WEXITSTATUS(condition)
914
# Read return code from connection (see call_pipe)
915
returncode = connection.recv()
916
connection.close()
917
918
if returncode >= 0:
919
self.last_checker_status = returncode
920
self.last_checker_signal = None
636
921
if self.last_checker_status == 0:
637
922
logger.info("Checker for %(name)s succeeded",
638
923
vars(self))
639
924
self.checked_ok()
640
925
else:
641
logger.info("Checker for %(name)s failed",
642
vars(self))
926
logger.info("Checker for %(name)s failed", vars(self))
643
927
else:
644
928
self.last_checker_status = -1
929
self.last_checker_signal = -returncode
645
930
logger.warning("Checker for %(name)s crashed?",
646
931
vars(self))
932
return False
647
933
648
934
def checked_ok(self):
649
935
"""Assert that the client has been seen, alive and well."""
650
936
self.last_checked_ok = datetime.datetime.utcnow()
651
937
self.last_checker_status = 0
938
self.last_checker_signal = None
652
939
self.bump_timeout()
653
940
654
941
def bump_timeout(self, timeout=None):
659
946
gobject.source_remove(self.disable_initiator_tag)
660
947
self.disable_initiator_tag = None
661
948
if getattr(self, "enabled", False):
662
self.disable_initiator_tag = (gobject.timeout_add
663
(timedelta_to_milliseconds
664
(timeout), self.disable))
949
self.disable_initiator_tag = gobject.timeout_add(
950
int(timeout.total_seconds() * 1000), self.disable)
665
951
self.expires = datetime.datetime.utcnow() + timeout
666
952
667
953
def need_approval(self):
681
967
# than 'timeout' for the client to be disabled, which is as it
682
968
# should be.
683
969
684
# If a checker exists, make sure it is not a zombie
685
try:
686
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
687
except (AttributeError, OSError) as error:
688
if (isinstance(error, OSError)
689
and error.errno != errno.ECHILD):
690
raise error
691
else:
692
if pid:
693
logger.warning("Checker was a zombie")
694
gobject.source_remove(self.checker_callback_tag)
695
self.checker_callback(pid, status,
696
self.current_checker_command)
970
if self.checker is not None and not self.checker.is_alive():
971
logger.warning("Checker was not alive; joining")
972
self.checker.join()
973
self.checker = None
697
974
# Start a new checker if needed
698
975
if self.checker is None:
699
976
# Escape attributes for the shell
700
escaped_attrs = dict(
701
(attr, re.escape(unicode(getattr(self, attr))))
702
for attr in
703
self.runtime_expansions)
977
escaped_attrs = {
978
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
704
980
try:
705
981
command = self.checker_command % escaped_attrs
706
982
except TypeError as error:
707
983
logger.error('Could not format string "%s"',
708
self.checker_command, exc_info=error)
709
return True # Try again later
984
self.checker_command,
985
exc_info=error)
986
return True # Try again later
710
987
self.current_checker_command = command
711
try:
712
logger.info("Starting checker %r for %s",
713
command, self.name)
714
# We don't need to redirect stdout and stderr, since
715
# in normal mode, that is already done by daemon(),
716
# and in debug mode we don't want to. (Stdin is
717
# always replaced by /dev/null.)
718
# The exception is when not debugging but nevertheless
719
# running in the foreground; use the previously
720
# created wnull.
721
popen_args = {}
722
if (not self.server_settings["debug"]
723
and self.server_settings["foreground"]):
724
popen_args.update({"stdout": wnull,
725
"stderr": wnull })
726
self.checker = subprocess.Popen(command,
727
close_fds=True,
728
shell=True, cwd="/",
729
**popen_args)
730
except OSError as error:
731
logger.error("Failed to start subprocess",
732
exc_info=error)
733
return True
734
self.checker_callback_tag = (gobject.child_watch_add
735
(self.checker.pid,
736
self.checker_callback,
737
data=command))
738
# The checker may have completed before the gobject
739
# watch was added. Check for this.
740
try:
741
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
742
except OSError as error:
743
if error.errno == errno.ECHILD:
744
# This should never happen
745
logger.error("Child process vanished",
746
exc_info=error)
747
return True
748
raise
749
if pid:
750
gobject.source_remove(self.checker_callback_tag)
751
self.checker_callback(pid, status, command)
988
logger.info("Starting checker %r for %s", command,
989
self.name)
990
# We don't need to redirect stdout and stderr, since
991
# in normal mode, that is already done by daemon(),
992
# and in debug mode we don't want to. (Stdin is
993
# always replaced by /dev/null.)
994
# The exception is when not debugging but nevertheless
995
# running in the foreground; use the previously
996
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1000
if (not self.server_settings["debug"]
1001
and self.server_settings["foreground"]):
1002
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1005
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1009
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1012
self.checker_callback, pipe[0], command)
752
1013
# Re-run this periodically if run by gobject.timeout_add
753
1014
return True
754
1015
760
1021
if getattr(self, "checker", None) is None:
761
1022
return
762
1023
logger.debug("Stopping checker for %(name)s", vars(self))
763
try:
764
self.checker.terminate()
765
#time.sleep(0.5)
766
#if self.checker.poll() is None:
767
# self.checker.kill()
768
except OSError as error:
769
if error.errno != errno.ESRCH: # No such process
770
raise
1024
self.checker.terminate()
771
1025
self.checker = None
772
1026
773
1027
774
def dbus_service_property(dbus_interface, signature="v",
775
access="readwrite", byte_arrays=False):
1028
def dbus_service_property(dbus_interface,
1029
signature="v",
1030
access="readwrite",
1031
byte_arrays=False):
776
1032
"""Decorators for marking methods of a DBusObjectWithProperties to
777
1033
become properties on the D-Bus.
778
1034
787
1043
# "Set" method, so we fail early here:
788
1044
if byte_arrays and signature != "ay":
789
1045
raise ValueError("Byte arrays not supported for non-'ay'"
790
" signature {0!r}".format(signature))
1046
" signature {!r}".format(signature))
1047
791
1048
def decorator(func):
792
1049
func._dbus_is_property = True
793
1050
func._dbus_interface = dbus_interface
798
1055
func._dbus_name = func._dbus_name[:-14]
799
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
800
1057
return func
1058
801
1059
return decorator
802
1060
803
1061
812
1070
"org.freedesktop.DBus.Property.EmitsChangedSignal":
813
1071
"false"}
814
1072
"""
1073
815
1074
def decorator(func):
816
1075
func._dbus_is_interface = True
817
1076
func._dbus_interface = dbus_interface
818
1077
func._dbus_name = dbus_interface
819
1078
return func
1079
820
1080
return decorator
821
1081
822
1082
824
1084
"""Decorator to annotate D-Bus methods, signals or properties
825
1085
Usage:
826
1086
1087
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
"org.freedesktop.DBus.Property."
1089
"EmitsChangedSignal": "false"})
827
1090
@dbus_service_property("org.example.Interface", signature="b",
828
1091
access="r")
829
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
830
"org.freedesktop.DBus.Property."
831
"EmitsChangedSignal": "false"})
832
1092
def Property_dbus_property(self):
833
1093
return dbus.Boolean(False)
1094
1095
See also the DBusObjectWithAnnotations class.
834
1096
"""
1097
835
1098
def decorator(func):
836
1099
func._dbus_annotations = annotations
837
1100
return func
1101
838
1102
return decorator
839
1103
840
1104
841
1105
class DBusPropertyException(dbus.exceptions.DBusException):
842
1106
"""A base class for D-Bus property-related exceptions
843
1107
"""
844
def __unicode__(self):
845
return unicode(str(self))
1108
pass
846
1109
847
1110
848
1111
class DBusPropertyAccessException(DBusPropertyException):
857
1120
pass
858
1121
859
1122
860
class DBusObjectWithProperties(dbus.service.Object):
861
"""A D-Bus object with properties.
1123
class DBusObjectWithAnnotations(dbus.service.Object):
1124
"""A D-Bus object with annotations.
862
1125
863
Classes inheriting from this can use the dbus_service_property
864
decorator to expose methods as D-Bus properties. It exposes the
865
standard Get(), Set(), and GetAll() methods on the D-Bus.
1126
Classes inheriting from this can use the dbus_annotations
1127
decorator to add annotations to methods or signals.
866
1128
"""
867
1129
868
1130
@staticmethod
872
1134
If called like _is_dbus_thing("method") it returns a function
873
1135
suitable for use as predicate to inspect.getmembers().
874
1136
"""
875
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1137
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
876
1138
False)
877
1139
878
1140
def _get_all_dbus_things(self, thing):
879
1141
"""Returns a generator of (name, attribute) pairs
880
1142
"""
881
return ((getattr(athing.__get__(self), "_dbus_name",
882
name),
1143
return ((getattr(athing.__get__(self), "_dbus_name", name),
883
1144
athing.__get__(self))
884
1145
for cls in self.__class__.__mro__
885
1146
for name, athing in
886
inspect.getmembers(cls,
887
self._is_dbus_thing(thing)))
1147
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1149
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1153
def Introspect(self, object_path, connection):
1154
"""Overloading of standard D-Bus method.
1155
1156
Inserts annotation tags on methods and signals.
1157
"""
1158
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
connection)
1160
try:
1161
document = xml.dom.minidom.parseString(xmlstring)
1162
1163
for if_tag in document.getElementsByTagName("interface"):
1164
# Add annotation tags
1165
for typ in ("method", "signal"):
1166
for tag in if_tag.getElementsByTagName(typ):
1167
annots = dict()
1168
for name, prop in (self.
1169
_get_all_dbus_things(typ)):
1170
if (name == tag.getAttribute("name")
1171
and prop._dbus_interface
1172
== if_tag.getAttribute("name")):
1173
annots.update(getattr(
1174
prop, "_dbus_annotations", {}))
1175
for name, value in annots.items():
1176
ann_tag = document.createElement(
1177
"annotation")
1178
ann_tag.setAttribute("name", name)
1179
ann_tag.setAttribute("value", value)
1180
tag.appendChild(ann_tag)
1181
# Add interface annotation tags
1182
for annotation, value in dict(
1183
itertools.chain.from_iterable(
1184
annotations().items()
1185
for name, annotations
1186
in self._get_all_dbus_things("interface")
1187
if name == if_tag.getAttribute("name")
1188
)).items():
1189
ann_tag = document.createElement("annotation")
1190
ann_tag.setAttribute("name", annotation)
1191
ann_tag.setAttribute("value", value)
1192
if_tag.appendChild(ann_tag)
1193
# Fix argument name for the Introspect method itself
1194
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1196
for cn in if_tag.getElementsByTagName("method"):
1197
if cn.getAttribute("name") == "Introspect":
1198
for arg in cn.getElementsByTagName("arg"):
1199
if (arg.getAttribute("direction")
1200
== "out"):
1201
arg.setAttribute("name",
1202
"xml_data")
1203
xmlstring = document.toxml("utf-8")
1204
document.unlink()
1205
except (AttributeError, xml.dom.DOMException,
1206
xml.parsers.expat.ExpatError) as error:
1207
logger.error("Failed to override Introspection method",
1208
exc_info=error)
1209
return xmlstring
1210
1211
1212
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
"""A D-Bus object with properties.
1214
1215
Classes inheriting from this can use the dbus_service_property
1216
decorator to expose methods as D-Bus properties. It exposes the
1217
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
"""
888
1219
889
1220
def _get_dbus_property(self, interface_name, property_name):
890
1221
"""Returns a bound method if one exists which is a D-Bus
891
1222
property with the specified name and interface.
892
1223
"""
893
for cls in self.__class__.__mro__:
894
for name, value in (inspect.getmembers
895
(cls,
896
self._is_dbus_thing("property"))):
1224
for cls in self.__class__.__mro__:
1225
for name, value in inspect.getmembers(
1226
cls, self._is_dbus_thing("property")):
897
1227
if (value._dbus_name == property_name
898
1228
and value._dbus_interface == interface_name):
899
1229
return value.__get__(self)
900
1230
901
1231
# No such property
902
raise DBusPropertyNotFound(self.dbus_object_path + ":"
903
+ interface_name + "."
904
+ property_name)
905
906
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1232
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
self.dbus_object_path, interface_name, property_name))
1234
1235
@classmethod
1236
def _get_all_interface_names(cls):
1237
"""Get a sequence of all interfaces supported by an object"""
1238
return (name for name in set(getattr(getattr(x, attr),
1239
"_dbus_interface", None)
1240
for x in (inspect.getmro(cls))
1241
for attr in dir(x))
1242
if name is not None)
1243
1244
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
in_signature="ss",
907
1246
out_signature="v")
908
1247
def Get(self, interface_name, property_name):
909
1248
"""Standard D-Bus property Get() method, see D-Bus standard.
927
1266
# The byte_arrays option is not supported yet on
928
1267
# signatures other than "ay".
929
1268
if prop._dbus_signature != "ay":
930
raise ValueError
1269
raise ValueError("Byte arrays not supported for non-"
1270
"'ay' signature {!r}"
1271
.format(prop._dbus_signature))
931
1272
value = dbus.ByteArray(b''.join(chr(byte)
932
1273
for byte in value))
933
1274
prop(value)
934
1275
935
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1276
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
in_signature="s",
936
1278
out_signature="a{sv}")
937
1279
def GetAll(self, interface_name):
938
1280
"""Standard D-Bus property GetAll() method, see D-Bus
953
1295
if not hasattr(value, "variant_level"):
954
1296
properties[name] = value
955
1297
continue
956
properties[name] = type(value)(value, variant_level=
957
value.variant_level+1)
1298
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
958
1300
return dbus.Dictionary(properties, signature="sv")
959
1301
1302
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
def PropertiesChanged(self, interface_name, changed_properties,
1304
invalidated_properties):
1305
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1306
standard.
1307
"""
1308
pass
1309
960
1310
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
961
1311
out_signature="s",
962
1312
path_keyword='object_path',
966
1316
967
1317
Inserts property tags and interface annotation tags.
968
1318
"""
969
xmlstring = dbus.service.Object.Introspect(self, object_path,
970
connection)
1319
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1320
object_path,
1321
connection)
971
1322
try:
972
1323
document = xml.dom.minidom.parseString(xmlstring)
1324
973
1325
def make_tag(document, name, prop):
974
1326
e = document.createElement("property")
975
1327
e.setAttribute("name", name)
976
1328
e.setAttribute("type", prop._dbus_signature)
977
1329
e.setAttribute("access", prop._dbus_access)
978
1330
return e
1331
979
1332
for if_tag in document.getElementsByTagName("interface"):
980
1333
# Add property tags
981
1334
for tag in (make_tag(document, name, prop)
984
1337
if prop._dbus_interface
985
1338
== if_tag.getAttribute("name")):
986
1339
if_tag.appendChild(tag)
987
# Add annotation tags
988
for typ in ("method", "signal", "property"):
989
for tag in if_tag.getElementsByTagName(typ):
990
annots = dict()
991
for name, prop in (self.
992
_get_all_dbus_things(typ)):
993
if (name == tag.getAttribute("name")
994
and prop._dbus_interface
995
== if_tag.getAttribute("name")):
996
annots.update(getattr
997
(prop,
998
"_dbus_annotations",
999
{}))
1000
for name, value in annots.iteritems():
1001
ann_tag = document.createElement(
1002
"annotation")
1003
ann_tag.setAttribute("name", name)
1004
ann_tag.setAttribute("value", value)
1005
tag.appendChild(ann_tag)
1006
# Add interface annotation tags
1007
for annotation, value in dict(
1008
itertools.chain.from_iterable(
1009
annotations().iteritems()
1010
for name, annotations in
1011
self._get_all_dbus_things("interface")
1012
if name == if_tag.getAttribute("name")
1013
)).iteritems():
1014
ann_tag = document.createElement("annotation")
1015
ann_tag.setAttribute("name", annotation)
1016
ann_tag.setAttribute("value", value)
1017
if_tag.appendChild(ann_tag)
1340
# Add annotation tags for properties
1341
for tag in if_tag.getElementsByTagName("property"):
1342
annots = dict()
1343
for name, prop in self._get_all_dbus_things(
1344
"property"):
1345
if (name == tag.getAttribute("name")
1346
and prop._dbus_interface
1347
== if_tag.getAttribute("name")):
1348
annots.update(getattr(
1349
prop, "_dbus_annotations", {}))
1350
for name, value in annots.items():
1351
ann_tag = document.createElement(
1352
"annotation")
1353
ann_tag.setAttribute("name", name)
1354
ann_tag.setAttribute("value", value)
1355
tag.appendChild(ann_tag)
1018
1356
# Add the names to the return values for the
1019
1357
# "org.freedesktop.DBus.Properties" methods
1020
1358
if (if_tag.getAttribute("name")
1038
1376
exc_info=error)
1039
1377
return xmlstring
1040
1378
1379
try:
1380
dbus.OBJECT_MANAGER_IFACE
1381
except AttributeError:
1382
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1384
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
"""A D-Bus object with an ObjectManager.
1386
1387
Classes inheriting from this exposes the standard
1388
GetManagedObjects call and the InterfacesAdded and
1389
InterfacesRemoved signals on the standard
1390
"org.freedesktop.DBus.ObjectManager" interface.
1391
1392
Note: No signals are sent automatically; they must be sent
1393
manually.
1394
"""
1395
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1397
def GetManagedObjects(self):
1398
"""This function must be overridden"""
1399
raise NotImplementedError()
1400
1401
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1403
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1407
def InterfacesRemoved(self, object_path, interfaces):
1408
pass
1409
1410
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1414
def Introspect(self, object_path, connection):
1415
"""Overloading of standard D-Bus method.
1416
1417
Override return argument name of GetManagedObjects to be
1418
"objpath_interfaces_and_properties"
1419
"""
1420
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1421
object_path,
1422
connection)
1423
try:
1424
document = xml.dom.minidom.parseString(xmlstring)
1425
1426
for if_tag in document.getElementsByTagName("interface"):
1427
# Fix argument name for the GetManagedObjects method
1428
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1430
for cn in if_tag.getElementsByTagName("method"):
1431
if (cn.getAttribute("name")
1432
== "GetManagedObjects"):
1433
for arg in cn.getElementsByTagName("arg"):
1434
if (arg.getAttribute("direction")
1435
== "out"):
1436
arg.setAttribute(
1437
"name",
1438
"objpath_interfaces"
1439
"_and_properties")
1440
xmlstring = document.toxml("utf-8")
1441
document.unlink()
1442
except (AttributeError, xml.dom.DOMException,
1443
xml.parsers.expat.ExpatError) as error:
1444
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1446
return xmlstring
1041
1447
1042
1448
def datetime_to_dbus(dt, variant_level=0):
1043
1449
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1044
1450
if dt is None:
1045
1451
return dbus.String("", variant_level = variant_level)
1046
return dbus.String(dt.isoformat(),
1047
variant_level=variant_level)
1452
return dbus.String(dt.isoformat(), variant_level=variant_level)
1048
1453
1049
1454
1050
1455
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
1475
(from DBusObjectWithProperties) and interfaces (from the
1071
1476
dbus_interface_annotations decorator).
1072
1477
"""
1478
1073
1479
def wrapper(cls):
1074
1480
for orig_interface_name, alt_interface_name in (
1075
alt_interface_names.iteritems()):
1481
alt_interface_names.items()):
1076
1482
attr = {}
1077
1483
interface_names = set()
1078
1484
# Go though all attributes of the class
1080
1486
# Ignore non-D-Bus attributes, and D-Bus attributes
1081
1487
# with the wrong interface name
1082
1488
if (not hasattr(attribute, "_dbus_interface")
1083
or not attribute._dbus_interface
1084
.startswith(orig_interface_name)):
1489
or not attribute._dbus_interface.startswith(
1490
orig_interface_name)):
1085
1491
continue
1086
1492
# Create an alternate D-Bus interface name based on
1087
1493
# the current name
1088
alt_interface = (attribute._dbus_interface
1089
.replace(orig_interface_name,
1090
alt_interface_name))
1494
alt_interface = attribute._dbus_interface.replace(
1495
orig_interface_name, alt_interface_name)
1091
1496
interface_names.add(alt_interface)
1092
1497
# Is this a D-Bus signal?
1093
1498
if getattr(attribute, "_dbus_is_signal", False):
1094
# Extract the original non-method undecorated
1095
# function by black magic
1096
nonmethod_func = (dict(
1499
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
nonmethod_func = (dict(
1097
1503
zip(attribute.func_code.co_freevars,
1098
attribute.__closure__))["func"]
1099
.cell_contents)
1504
attribute.__closure__))
1505
["func"].cell_contents)
1506
else:
1507
nonmethod_func = attribute
1100
1508
# Create a new, but exactly alike, function
1101
1509
# object, and decorate it to be a new D-Bus signal
1102
1510
# with the alternate D-Bus interface name
1103
new_function = (dbus.service.signal
1104
(alt_interface,
1105
attribute._dbus_signature)
1106
(types.FunctionType(
1107
nonmethod_func.func_code,
1108
nonmethod_func.func_globals,
1109
nonmethod_func.func_name,
1110
nonmethod_func.func_defaults,
1111
nonmethod_func.func_closure)))
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1525
new_function = (dbus.service.signal(
1526
alt_interface,
1527
attribute._dbus_signature)(new_function))
1112
1528
# Copy annotations, if any
1113
1529
try:
1114
new_function._dbus_annotations = (
1115
dict(attribute._dbus_annotations))
1530
new_function._dbus_annotations = dict(
1531
attribute._dbus_annotations)
1116
1532
except AttributeError:
1117
1533
pass
1118
1534
# Define a creator of a function to call both the
1123
1539
"""This function is a scope container to pass
1124
1540
func1 and func2 to the "call_both" function
1125
1541
outside of its arguments"""
1542
1543
@functools.wraps(func2)
1126
1544
def call_both(*args, **kwargs):
1127
1545
"""This function will emit two D-Bus
1128
1546
signals by calling func1 and func2"""
1129
1547
func1(*args, **kwargs)
1130
1548
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1550
for name, attr in inspect.getmembers(func2):
1551
if name.startswith("_dbus_"):
1552
setattr(call_both, name, attr)
1553
1131
1554
return call_both
1132
1555
# Create the "call_both" function and add it to
1133
1556
# the class
1138
1561
# object. Decorate it to be a new D-Bus method
1139
1562
# with the alternate D-Bus interface name. Add it
1140
1563
# to the class.
1141
attr[attrname] = (dbus.service.method
1142
(alt_interface,
1143
attribute._dbus_in_signature,
1144
attribute._dbus_out_signature)
1145
(types.FunctionType
1146
(attribute.func_code,
1147
attribute.func_globals,
1148
attribute.func_name,
1149
attribute.func_defaults,
1150
attribute.func_closure)))
1564
attr[attrname] = (
1565
dbus.service.method(
1566
alt_interface,
1567
attribute._dbus_in_signature,
1568
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1151
1574
# Copy annotations, if any
1152
1575
try:
1153
attr[attrname]._dbus_annotations = (
1154
dict(attribute._dbus_annotations))
1576
attr[attrname]._dbus_annotations = dict(
1577
attribute._dbus_annotations)
1155
1578
except AttributeError:
1156
1579
pass
1157
1580
# Is this a D-Bus property?
1160
1583
# object, and decorate it to be a new D-Bus
1161
1584
# property with the alternate D-Bus interface
1162
1585
# name. Add it to the class.
1163
attr[attrname] = (dbus_service_property
1164
(alt_interface,
1165
attribute._dbus_signature,
1166
attribute._dbus_access,
1167
attribute
1168
._dbus_get_args_options
1169
["byte_arrays"])
1170
(types.FunctionType
1171
(attribute.func_code,
1172
attribute.func_globals,
1173
attribute.func_name,
1174
attribute.func_defaults,
1175
attribute.func_closure)))
1586
attr[attrname] = (dbus_service_property(
1587
alt_interface, attribute._dbus_signature,
1588
attribute._dbus_access,
1589
attribute._dbus_get_args_options
1590
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1176
1597
# Copy annotations, if any
1177
1598
try:
1178
attr[attrname]._dbus_annotations = (
1179
dict(attribute._dbus_annotations))
1599
attr[attrname]._dbus_annotations = dict(
1600
attribute._dbus_annotations)
1180
1601
except AttributeError:
1181
1602
pass
1182
1603
# Is this a D-Bus interface?
1185
1606
# object. Decorate it to be a new D-Bus interface
1186
1607
# with the alternate D-Bus interface name. Add it
1187
1608
# to the class.
1188
attr[attrname] = (dbus_interface_annotations
1189
(alt_interface)
1190
(types.FunctionType
1191
(attribute.func_code,
1192
attribute.func_globals,
1193
attribute.func_name,
1194
attribute.func_defaults,
1195
attribute.func_closure)))
1609
attr[attrname] = (
1610
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1196
1616
if deprecate:
1197
1617
# Deprecate all alternate interfaces
1198
iname="_AlternateDBusNames_interface_annotation{0}"
1618
iname="_AlternateDBusNames_interface_annotation{}"
1199
1619
for interface_name in interface_names:
1620
1200
1621
@dbus_interface_annotations(interface_name)
1201
1622
def func(self):
1202
1623
return { "org.freedesktop.DBus.Deprecated":
1203
"true" }
1624
"true" }
1204
1625
# Find an unused name
1205
1626
for aname in (iname.format(i)
1206
1627
for i in itertools.count()):
1210
1631
if interface_names:
1211
1632
# Replace the class with a new subclass of it with
1212
1633
# methods, signals, etc. as created above.
1213
cls = type(b"{0}Alternate".format(cls.__name__),
1214
(cls,), attr)
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1215
1636
return cls
1637
1216
1638
return wrapper
1217
1639
1218
1640
1219
1641
@alternate_dbus_interfaces({"se.recompile.Mandos":
1220
"se.bsnet.fukt.Mandos"})
1642
"se.bsnet.fukt.Mandos"})
1221
1643
class ClientDBus(Client, DBusObjectWithProperties):
1222
1644
"""A Client class using D-Bus
1223
1645
1227
1649
"""
1228
1650
1229
1651
runtime_expansions = (Client.runtime_expansions
1230
+ ("dbus_object_path",))
1652
+ ("dbus_object_path", ))
1653
1654
_interface = "se.recompile.Mandos.Client"
1231
1655
1232
1656
# dbus.service.Object doesn't use super(), so we can't either.
1233
1657
1236
1660
Client.__init__(self, *args, **kwargs)
1237
1661
# Only now, when this client is initialized, can it show up on
1238
1662
# the D-Bus
1239
client_object_name = unicode(self.name).translate(
1663
client_object_name = str(self.name).translate(
1240
1664
{ord("."): ord("_"),
1241
1665
ord("-"): ord("_")})
1242
self.dbus_object_path = (dbus.ObjectPath
1243
("/clients/" + client_object_name))
1666
self.dbus_object_path = dbus.ObjectPath(
1667
"/clients/" + client_object_name)
1244
1668
DBusObjectWithProperties.__init__(self, self.bus,
1245
1669
self.dbus_object_path)
1246
1670
1247
def notifychangeproperty(transform_func,
1248
dbus_name, type_func=lambda x: x,
1249
variant_level=1):
1671
def notifychangeproperty(transform_func, dbus_name,
1672
type_func=lambda x: x,
1673
variant_level=1,
1674
invalidate_only=False,
1675
_interface=_interface):
1250
1676
""" Modify a variable so that it's a property which announces
1251
1677
its changes to DBus.
1252
1678
1257
1683
to the D-Bus. Default: no transform
1258
1684
variant_level: D-Bus variant level. Default: 1
1259
1685
"""
1260
attrname = "_{0}".format(dbus_name)
1686
attrname = "_{}".format(dbus_name)
1687
1261
1688
def setter(self, value):
1262
1689
if hasattr(self, "dbus_object_path"):
1263
1690
if (not hasattr(self, attrname) or
1264
1691
type_func(getattr(self, attrname, None))
1265
1692
!= type_func(value)):
1266
dbus_value = transform_func(type_func(value),
1267
variant_level
1268
=variant_level)
1269
self.PropertyChanged(dbus.String(dbus_name),
1270
dbus_value)
1693
if invalidate_only:
1694
self.PropertiesChanged(
1695
_interface, dbus.Dictionary(),
1696
dbus.Array((dbus_name, )))
1697
else:
1698
dbus_value = transform_func(
1699
type_func(value),
1700
variant_level = variant_level)
1701
self.PropertyChanged(dbus.String(dbus_name),
1702
dbus_value)
1703
self.PropertiesChanged(
1704
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1707
dbus.Array())
1271
1708
setattr(self, attrname, value)
1272
1709
1273
1710
return property(lambda self: getattr(self, attrname), setter)
1279
1716
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1280
1717
last_enabled = notifychangeproperty(datetime_to_dbus,
1281
1718
"LastEnabled")
1282
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1283
type_func = lambda checker:
1284
checker is not None)
1719
checker = notifychangeproperty(
1720
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1285
1722
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1286
1723
"LastCheckedOK")
1287
1724
last_checker_status = notifychangeproperty(dbus.Int16,
1290
1727
datetime_to_dbus, "LastApprovalRequest")
1291
1728
approved_by_default = notifychangeproperty(dbus.Boolean,
1292
1729
"ApprovedByDefault")
1293
approval_delay = notifychangeproperty(dbus.UInt64,
1294
"ApprovalDelay",
1295
type_func =
1296
timedelta_to_milliseconds)
1730
approval_delay = notifychangeproperty(
1731
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1297
1733
approval_duration = notifychangeproperty(
1298
1734
dbus.UInt64, "ApprovalDuration",
1299
type_func = timedelta_to_milliseconds)
1735
type_func = lambda td: td.total_seconds() * 1000)
1300
1736
host = notifychangeproperty(dbus.String, "Host")
1301
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1302
type_func =
1303
timedelta_to_milliseconds)
1737
timeout = notifychangeproperty(
1738
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1304
1740
extended_timeout = notifychangeproperty(
1305
1741
dbus.UInt64, "ExtendedTimeout",
1306
type_func = timedelta_to_milliseconds)
1307
interval = notifychangeproperty(dbus.UInt64,
1308
"Interval",
1309
type_func =
1310
timedelta_to_milliseconds)
1742
type_func = lambda td: td.total_seconds() * 1000)
1743
interval = notifychangeproperty(
1744
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1311
1746
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
invalidate_only=True)
1312
1749
1313
1750
del notifychangeproperty
1314
1751
1321
1758
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1322
1759
Client.__del__(self, *args, **kwargs)
1323
1760
1324
def checker_callback(self, pid, condition, command,
1325
*args, **kwargs):
1326
self.checker_callback_tag = None
1327
self.checker = None
1328
if os.WIFEXITED(condition):
1329
exitstatus = os.WEXITSTATUS(condition)
1761
def checker_callback(self, source, condition,
1762
connection, command, *args, **kwargs):
1763
ret = Client.checker_callback(self, source, condition,
1764
connection, command, *args,
1765
**kwargs)
1766
exitstatus = self.last_checker_status
1767
if exitstatus >= 0:
1330
1768
# Emit D-Bus signal
1331
1769
self.CheckerCompleted(dbus.Int16(exitstatus),
1332
dbus.Int64(condition),
1770
# This is specific to GNU libC
1771
dbus.Int64(exitstatus << 8),
1333
1772
dbus.String(command))
1334
1773
else:
1335
1774
# Emit D-Bus signal
1336
1775
self.CheckerCompleted(dbus.Int16(-1),
1337
dbus.Int64(condition),
1776
dbus.Int64(
1777
# This is specific to GNU libC
1778
(exitstatus << 8)
1779
| self.last_checker_signal),
1338
1780
dbus.String(command))
1339
1340
return Client.checker_callback(self, pid, condition, command,
1341
*args, **kwargs)
1781
return ret
1342
1782
1343
1783
def start_checker(self, *args, **kwargs):
1344
old_checker = self.checker
1345
if self.checker is not None:
1346
old_checker_pid = self.checker.pid
1347
else:
1348
old_checker_pid = None
1784
old_checker_pid = getattr(self.checker, "pid", None)
1349
1785
r = Client.start_checker(self, *args, **kwargs)
1350
1786
# Only if new checker process was started
1351
1787
if (self.checker is not None
1360
1796
1361
1797
def approve(self, value=True):
1362
1798
self.approved = value
1363
gobject.timeout_add(timedelta_to_milliseconds
1364
(self.approval_duration),
1365
self._reset_approved)
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1366
1801
self.send_changedstate()
1367
1802
1368
1803
## D-Bus methods, signals & properties
1369
_interface = "se.recompile.Mandos.Client"
1370
1804
1371
1805
## Interfaces
1372
1806
1373
@dbus_interface_annotations(_interface)
1374
def _foo(self):
1375
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1376
"false"}
1377
1378
1807
## Signals
1379
1808
1380
1809
# CheckerCompleted - signal
1390
1819
pass
1391
1820
1392
1821
# PropertyChanged - signal
1822
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1393
1823
@dbus.service.signal(_interface, signature="sv")
1394
1824
def PropertyChanged(self, property, value):
1395
1825
"D-Bus signal"
1429
1859
self.checked_ok()
1430
1860
1431
1861
# Enable - method
1862
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1432
1863
@dbus.service.method(_interface)
1433
1864
def Enable(self):
1434
1865
"D-Bus method"
1435
1866
self.enable()
1436
1867
1437
1868
# StartChecker - method
1869
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1438
1870
@dbus.service.method(_interface)
1439
1871
def StartChecker(self):
1440
1872
"D-Bus method"
1441
1873
self.start_checker()
1442
1874
1443
1875
# Disable - method
1876
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1444
1877
@dbus.service.method(_interface)
1445
1878
def Disable(self):
1446
1879
"D-Bus method"
1447
1880
self.disable()
1448
1881
1449
1882
# StopChecker - method
1883
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1450
1884
@dbus.service.method(_interface)
1451
1885
def StopChecker(self):
1452
1886
self.stop_checker()
1459
1893
return dbus.Boolean(bool(self.approvals_pending))
1460
1894
1461
1895
# ApprovedByDefault - property
1462
@dbus_service_property(_interface, signature="b",
1896
@dbus_service_property(_interface,
1897
signature="b",
1463
1898
access="readwrite")
1464
1899
def ApprovedByDefault_dbus_property(self, value=None):
1465
1900
if value is None: # get
1467
1902
self.approved_by_default = bool(value)
1468
1903
1469
1904
# ApprovalDelay - property
1470
@dbus_service_property(_interface, signature="t",
1905
@dbus_service_property(_interface,
1906
signature="t",
1471
1907
access="readwrite")
1472
1908
def ApprovalDelay_dbus_property(self, value=None):
1473
1909
if value is None: # get
1474
return dbus.UInt64(self.approval_delay_milliseconds())
1910
return dbus.UInt64(self.approval_delay.total_seconds()
1911
* 1000)
1475
1912
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1476
1913
1477
1914
# ApprovalDuration - property
1478
@dbus_service_property(_interface, signature="t",
1915
@dbus_service_property(_interface,
1916
signature="t",
1479
1917
access="readwrite")
1480
1918
def ApprovalDuration_dbus_property(self, value=None):
1481
1919
if value is None: # get
1482
return dbus.UInt64(timedelta_to_milliseconds(
1483
self.approval_duration))
1920
return dbus.UInt64(self.approval_duration.total_seconds()
1921
* 1000)
1484
1922
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1485
1923
1486
1924
# Name - property
1925
@dbus_annotations(
1926
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1487
1927
@dbus_service_property(_interface, signature="s", access="read")
1488
1928
def Name_dbus_property(self):
1489
1929
return dbus.String(self.name)
1490
1930
1491
1931
# Fingerprint - property
1932
@dbus_annotations(
1933
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1492
1934
@dbus_service_property(_interface, signature="s", access="read")
1493
1935
def Fingerprint_dbus_property(self):
1494
1936
return dbus.String(self.fingerprint)
1495
1937
1496
1938
# Host - property
1497
@dbus_service_property(_interface, signature="s",
1939
@dbus_service_property(_interface,
1940
signature="s",
1498
1941
access="readwrite")
1499
1942
def Host_dbus_property(self, value=None):
1500
1943
if value is None: # get
1501
1944
return dbus.String(self.host)
1502
self.host = unicode(value)
1945
self.host = str(value)
1503
1946
1504
1947
# Created - property
1948
@dbus_annotations(
1949
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1505
1950
@dbus_service_property(_interface, signature="s", access="read")
1506
1951
def Created_dbus_property(self):
1507
1952
return datetime_to_dbus(self.created)
1512
1957
return datetime_to_dbus(self.last_enabled)
1513
1958
1514
1959
# Enabled - property
1515
@dbus_service_property(_interface, signature="b",
1960
@dbus_service_property(_interface,
1961
signature="b",
1516
1962
access="readwrite")
1517
1963
def Enabled_dbus_property(self, value=None):
1518
1964
if value is None: # get
1523
1969
self.disable()
1524
1970
1525
1971
# LastCheckedOK - property
1526
@dbus_service_property(_interface, signature="s",
1972
@dbus_service_property(_interface,
1973
signature="s",
1527
1974
access="readwrite")
1528
1975
def LastCheckedOK_dbus_property(self, value=None):
1529
1976
if value is not None:
1532
1979
return datetime_to_dbus(self.last_checked_ok)
1533
1980
1534
1981
# LastCheckerStatus - property
1535
@dbus_service_property(_interface, signature="n",
1536
access="read")
1982
@dbus_service_property(_interface, signature="n", access="read")
1537
1983
def LastCheckerStatus_dbus_property(self):
1538
1984
return dbus.Int16(self.last_checker_status)
1539
1985
1548
1994
return datetime_to_dbus(self.last_approval_request)
1549
1995
1550
1996
# Timeout - property
1551
@dbus_service_property(_interface, signature="t",
1997
@dbus_service_property(_interface,
1998
signature="t",
1552
1999
access="readwrite")
1553
2000
def Timeout_dbus_property(self, value=None):
1554
2001
if value is None: # get
1555
return dbus.UInt64(self.timeout_milliseconds())
2002
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1556
2003
old_timeout = self.timeout
1557
2004
self.timeout = datetime.timedelta(0, 0, 0, value)
1558
2005
# Reschedule disabling
1567
2014
is None):
1568
2015
return
1569
2016
gobject.source_remove(self.disable_initiator_tag)
1570
self.disable_initiator_tag = (
1571
gobject.timeout_add(
1572
timedelta_to_milliseconds(self.expires - now),
1573
self.disable))
2017
self.disable_initiator_tag = gobject.timeout_add(
2018
int((self.expires - now).total_seconds() * 1000),
2019
self.disable)
1574
2020
1575
2021
# ExtendedTimeout - property
1576
@dbus_service_property(_interface, signature="t",
2022
@dbus_service_property(_interface,
2023
signature="t",
1577
2024
access="readwrite")
1578
2025
def ExtendedTimeout_dbus_property(self, value=None):
1579
2026
if value is None: # get
1580
return dbus.UInt64(self.extended_timeout_milliseconds())
2027
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
* 1000)
1581
2029
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1582
2030
1583
2031
# Interval - property
1584
@dbus_service_property(_interface, signature="t",
2032
@dbus_service_property(_interface,
2033
signature="t",
1585
2034
access="readwrite")
1586
2035
def Interval_dbus_property(self, value=None):
1587
2036
if value is None: # get
1588
return dbus.UInt64(self.interval_milliseconds())
2037
return dbus.UInt64(self.interval.total_seconds() * 1000)
1589
2038
self.interval = datetime.timedelta(0, 0, 0, value)
1590
2039
if getattr(self, "checker_initiator_tag", None) is None:
1591
2040
return
1592
2041
if self.enabled:
1593
2042
# Reschedule checker run
1594
2043
gobject.source_remove(self.checker_initiator_tag)
1595
self.checker_initiator_tag = (gobject.timeout_add
1596
(value, self.start_checker))
1597
self.start_checker() # Start one now, too
2044
self.checker_initiator_tag = gobject.timeout_add(
2045
value, self.start_checker)
2046
self.start_checker() # Start one now, too
1598
2047
1599
2048
# Checker - property
1600
@dbus_service_property(_interface, signature="s",
2049
@dbus_service_property(_interface,
2050
signature="s",
1601
2051
access="readwrite")
1602
2052
def Checker_dbus_property(self, value=None):
1603
2053
if value is None: # get
1604
2054
return dbus.String(self.checker_command)
1605
self.checker_command = unicode(value)
2055
self.checker_command = str(value)
1606
2056
1607
2057
# CheckerRunning - property
1608
@dbus_service_property(_interface, signature="b",
2058
@dbus_service_property(_interface,
2059
signature="b",
1609
2060
access="readwrite")
1610
2061
def CheckerRunning_dbus_property(self, value=None):
1611
2062
if value is None: # get
1616
2067
self.stop_checker()
1617
2068
1618
2069
# ObjectPath - property
2070
@dbus_annotations(
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
"org.freedesktop.DBus.Deprecated": "true"})
1619
2073
@dbus_service_property(_interface, signature="o", access="read")
1620
2074
def ObjectPath_dbus_property(self):
1621
2075
return self.dbus_object_path # is already a dbus.ObjectPath
1622
2076
1623
2077
# Secret = property
1624
@dbus_service_property(_interface, signature="ay",
1625
access="write", byte_arrays=True)
2078
@dbus_annotations(
2079
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2080
"invalidates"})
2081
@dbus_service_property(_interface,
2082
signature="ay",
2083
access="write",
2084
byte_arrays=True)
1626
2085
def Secret_dbus_property(self, value):
1627
self.secret = str(value)
2086
self.secret = bytes(value)
1628
2087
1629
2088
del _interface
1630
2089
1634
2093
self._pipe = child_pipe
1635
2094
self._pipe.send(('init', fpr, address))
1636
2095
if not self._pipe.recv():
1637
raise KeyError()
2096
raise KeyError(fpr)
1638
2097
1639
2098
def __getattribute__(self, name):
1640
2099
if name == '_pipe':
1644
2103
if data[0] == 'data':
1645
2104
return data[1]
1646
2105
if data[0] == 'function':
2106
1647
2107
def func(*args, **kwargs):
1648
2108
self._pipe.send(('funcall', name, args, kwargs))
1649
2109
return self._pipe.recv()[1]
2110
1650
2111
return func
1651
2112
1652
2113
def __setattr__(self, name, value):
1664
2125
def handle(self):
1665
2126
with contextlib.closing(self.server.child_pipe) as child_pipe:
1666
2127
logger.info("TCP connection from: %s",
1667
unicode(self.client_address))
2128
str(self.client_address))
1668
2129
logger.debug("Pipe FD: %d",
1669
2130
self.server.child_pipe.fileno())
1670
2131
1671
session = (gnutls.connection
1672
.ClientSession(self.request,
1673
gnutls.connection
1674
.X509Credentials()))
1675
1676
# Note: gnutls.connection.X509Credentials is really a
1677
# generic GnuTLS certificate credentials object so long as
1678
# no X.509 keys are added to it. Therefore, we can use it
1679
# here despite using OpenPGP certificates.
2132
session = gnutls.ClientSession(self.request)
1680
2133
1681
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1682
2135
# "+AES-256-CBC", "+SHA1",
1686
2139
priority = self.server.gnutls_priority
1687
2140
if priority is None:
1688
2141
priority = "NORMAL"
1689
(gnutls.library.functions
1690
.gnutls_priority_set_direct(session._c_object,
1691
priority, None))
2142
gnutls.priority_set_direct(session._c_object, priority,
2143
None)
1692
2144
1693
2145
# Start communication using the Mandos protocol
1694
2146
# Get protocol number
1696
2148
logger.debug("Protocol version: %r", line)
1697
2149
try:
1698
2150
if int(line.strip().split()[0]) > 1:
1699
raise RuntimeError
2151
raise RuntimeError(line)
1700
2152
except (ValueError, IndexError, RuntimeError) as error:
1701
2153
logger.error("Unknown protocol version: %s", error)
1702
2154
return
1704
2156
# Start GnuTLS connection
1705
2157
try:
1706
2158
session.handshake()
1707
except gnutls.errors.GNUTLSError as error:
2159
except gnutls.Error as error:
1708
2160
logger.warning("Handshake failed: %s", error)
1709
2161
# Do not run session.bye() here: the session is not
1710
2162
# established. Just abandon the request.
1714
2166
approval_required = False
1715
2167
try:
1716
2168
try:
1717
fpr = self.fingerprint(self.peer_certificate
1718
(session))
1719
except (TypeError,
1720
gnutls.errors.GNUTLSError) as error:
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
1721
2172
logger.warning("Bad certificate: %s", error)
1722
2173
return
1723
2174
logger.debug("Fingerprint: %s", fpr)
1736
2187
while True:
1737
2188
if not client.enabled:
1738
2189
logger.info("Client %s is disabled",
1739
client.name)
2190
client.name)
1740
2191
if self.server.use_dbus:
1741
2192
# Emit D-Bus signal
1742
2193
client.Rejected("Disabled")
1751
2202
if self.server.use_dbus:
1752
2203
# Emit D-Bus signal
1753
2204
client.NeedApproval(
1754
client.approval_delay_milliseconds(),
1755
client.approved_by_default)
2205
client.approval_delay.total_seconds()
2206
* 1000, client.approved_by_default)
1756
2207
else:
1757
2208
logger.warning("Client %s was not approved",
1758
2209
client.name)
1764
2215
#wait until timeout or approved
1765
2216
time = datetime.datetime.now()
1766
2217
client.changedstate.acquire()
1767
client.changedstate.wait(
1768
float(timedelta_to_milliseconds(delay)
1769
/ 1000))
2218
client.changedstate.wait(delay.total_seconds())
1770
2219
client.changedstate.release()
1771
2220
time2 = datetime.datetime.now()
1772
2221
if (time2 - time) >= delay:
1783
2232
else:
1784
2233
delay -= time2 - time
1785
2234
1786
sent_size = 0
1787
while sent_size < len(client.secret):
1788
try:
1789
sent = session.send(client.secret[sent_size:])
1790
except gnutls.errors.GNUTLSError as error:
1791
logger.warning("gnutls send failed",
1792
exc_info=error)
1793
return
1794
logger.debug("Sent: %d, remaining: %d",
1795
sent, len(client.secret)
1796
- (sent_size + sent))
1797
sent_size += sent
2235
try:
2236
session.send(client.secret)
2237
except gnutls.Error as error:
2238
logger.warning("gnutls send failed",
2239
exc_info = error)
2240
return
1798
2241
1799
2242
logger.info("Sending secret to %s", client.name)
1800
2243
# bump the timeout using extended_timeout
1808
2251
client.approvals_pending -= 1
1809
2252
try:
1810
2253
session.bye()
1811
except gnutls.errors.GNUTLSError as error:
2254
except gnutls.Error as error:
1812
2255
logger.warning("GnuTLS bye failed",
1813
2256
exc_info=error)
1814
2257
1816
2259
def peer_certificate(session):
1817
2260
"Return the peer's OpenPGP certificate as a bytestring"
1818
2261
# If not an OpenPGP certificate...
1819
if (gnutls.library.functions
1820
.gnutls_certificate_type_get(session._c_object)
1821
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1822
# ...do the normal thing
1823
return session.peer_certificate
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2264
# ...return invalid data
2265
return b""
1824
2266
list_size = ctypes.c_uint(1)
1825
cert_list = (gnutls.library.functions
1826
.gnutls_certificate_get_peers
2267
cert_list = (gnutls.certificate_get_peers
1827
2268
(session._c_object, ctypes.byref(list_size)))
1828
2269
if not bool(cert_list) and list_size.value != 0:
1829
raise gnutls.errors.GNUTLSError("error getting peer"
1830
" certificate")
2270
raise gnutls.Error("error getting peer certificate")
1831
2271
if list_size.value == 0:
1832
2272
return None
1833
2273
cert = cert_list[0]
1837
2277
def fingerprint(openpgp):
1838
2278
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1839
2279
# New GnuTLS "datum" with the OpenPGP public key
1840
datum = (gnutls.library.types
1841
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1842
ctypes.POINTER
1843
(ctypes.c_ubyte)),
1844
ctypes.c_uint(len(openpgp))))
2280
datum = gnutls.datum_t(
2281
ctypes.cast(ctypes.c_char_p(openpgp),
2282
ctypes.POINTER(ctypes.c_ubyte)),
2283
ctypes.c_uint(len(openpgp)))
1845
2284
# New empty GnuTLS certificate
1846
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1847
(gnutls.library.functions
1848
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2285
crt = gnutls.openpgp_crt_t()
2286
gnutls.openpgp_crt_init(ctypes.byref(crt))
1849
2287
# Import the OpenPGP public key into the certificate
1850
(gnutls.library.functions
1851
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1852
gnutls.library.constants
1853
.GNUTLS_OPENPGP_FMT_RAW))
2288
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2289
gnutls.OPENPGP_FMT_RAW)
1854
2290
# Verify the self signature in the key
1855
2291
crtverify = ctypes.c_uint()
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_verify_self(crt, 0,
1858
ctypes.byref(crtverify)))
2292
gnutls.openpgp_crt_verify_self(crt, 0,
2293
ctypes.byref(crtverify))
1859
2294
if crtverify.value != 0:
1860
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1861
raise (gnutls.errors.CertificateSecurityError
1862
("Verify failed"))
2295
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
1863
2297
# New buffer for the fingerprint
1864
2298
buf = ctypes.create_string_buffer(20)
1865
2299
buf_len = ctypes.c_size_t()
1866
2300
# Get the fingerprint from the certificate into the buffer
1867
(gnutls.library.functions
1868
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1869
ctypes.byref(buf_len)))
2301
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2302
ctypes.byref(buf_len))
1870
2303
# Deinit the certificate
1871
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2304
gnutls.openpgp_crt_deinit(crt)
1872
2305
# Convert the buffer to a Python bytestring
1873
2306
fpr = ctypes.string_at(buf, buf_len.value)
1874
2307
# Convert the bytestring to hexadecimal notation
1878
2311
1879
2312
class MultiprocessingMixIn(object):
1880
2313
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
1881
2315
def sub_process_main(self, request, address):
1882
2316
try:
1883
2317
self.finish_request(request, address)
1895
2329
1896
2330
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1897
2331
""" adds a pipe to the MixIn """
2332
1898
2333
def process_request(self, request, client_address):
1899
2334
"""Overrides and wraps the original process_request().
1900
2335
1909
2344
1910
2345
def add_pipe(self, parent_pipe, proc):
1911
2346
"""Dummy function; override as necessary"""
1912
raise NotImplementedError
2347
raise NotImplementedError()
1913
2348
1914
2349
1915
2350
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1921
2356
interface: None or a network interface name (string)
1922
2357
use_ipv6: Boolean; to use IPv6 or not
1923
2358
"""
2359
1924
2360
def __init__(self, server_address, RequestHandlerClass,
1925
interface=None, use_ipv6=True, socketfd=None):
2361
interface=None,
2362
use_ipv6=True,
2363
socketfd=None):
1926
2364
"""If socketfd is set, use that file descriptor instead of
1927
2365
creating a new one with socket.socket().
1928
2366
"""
1969
2407
self.interface)
1970
2408
else:
1971
2409
try:
1972
self.socket.setsockopt(socket.SOL_SOCKET,
1973
SO_BINDTODEVICE,
1974
str(self.interface + '\0'))
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
1975
2413
except socket.error as error:
1976
2414
if error.errno == errno.EPERM:
1977
2415
logger.error("No permission to bind to"
1995
2433
self.server_address = (any_address,
1996
2434
self.server_address[1])
1997
2435
elif not self.server_address[1]:
1998
self.server_address = (self.server_address[0],
1999
0)
2436
self.server_address = (self.server_address[0], 0)
2000
2437
# if self.interface:
2001
2438
# self.server_address = (self.server_address[0],
2002
2439
# 0, # port
2016
2453
2017
2454
Assumes a gobject.MainLoop event loop.
2018
2455
"""
2456
2019
2457
def __init__(self, server_address, RequestHandlerClass,
2020
interface=None, use_ipv6=True, clients=None,
2021
gnutls_priority=None, use_dbus=True, socketfd=None):
2458
interface=None,
2459
use_ipv6=True,
2460
clients=None,
2461
gnutls_priority=None,
2462
use_dbus=True,
2463
socketfd=None):
2022
2464
self.enabled = False
2023
2465
self.clients = clients
2024
2466
if self.clients is None:
2030
2472
interface = interface,
2031
2473
use_ipv6 = use_ipv6,
2032
2474
socketfd = socketfd)
2475
2033
2476
def server_activate(self):
2034
2477
if self.enabled:
2035
2478
return socketserver.TCPServer.server_activate(self)
2039
2482
2040
2483
def add_pipe(self, parent_pipe, proc):
2041
2484
# Call "handle_ipc" for both data and EOF events
2042
gobject.io_add_watch(parent_pipe.fileno(),
2043
gobject.IO_IN | gobject.IO_HUP,
2044
functools.partial(self.handle_ipc,
2045
parent_pipe =
2046
parent_pipe,
2047
proc = proc))
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2488
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2048
2491
2049
def handle_ipc(self, source, condition, parent_pipe=None,
2050
proc = None, client_object=None):
2492
def handle_ipc(self, source, condition,
2493
parent_pipe=None,
2494
proc = None,
2495
client_object=None):
2051
2496
# error, or the other end of multiprocessing.Pipe has closed
2052
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2053
2498
# Wait for other process to exit
2076
2521
parent_pipe.send(False)
2077
2522
return False
2078
2523
2079
gobject.io_add_watch(parent_pipe.fileno(),
2080
gobject.IO_IN | gobject.IO_HUP,
2081
functools.partial(self.handle_ipc,
2082
parent_pipe =
2083
parent_pipe,
2084
proc = proc,
2085
client_object =
2086
client))
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2527
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2087
2531
parent_pipe.send(True)
2088
2532
# remove the old hook in favor of the new above hook on
2089
2533
# same fileno
2095
2539
2096
2540
parent_pipe.send(('data', getattr(client_object,
2097
2541
funcname)(*args,
2098
**kwargs)))
2542
**kwargs)))
2099
2543
2100
2544
if command == 'getattr':
2101
2545
attrname = request[1]
2102
if callable(client_object.__getattribute__(attrname)):
2103
parent_pipe.send(('function',))
2546
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2548
parent_pipe.send(('function', ))
2104
2549
else:
2105
parent_pipe.send(('data', client_object
2106
.__getattribute__(attrname)))
2550
parent_pipe.send((
2551
'data', client_object.__getattribute__(attrname)))
2107
2552
2108
2553
if command == 'setattr':
2109
2554
attrname = request[1]
2140
2585
# avoid excessive use of external libraries.
2141
2586
2142
2587
# New type for defining tokens, syntax, and semantics all-in-one
2143
Token = collections.namedtuple("Token",
2144
("regexp", # To match token; if
2145
# "value" is not None,
2146
# must have a "group"
2147
# containing digits
2148
"value", # datetime.timedelta or
2149
# None
2150
"followers")) # Tokens valid after
2151
# this token
2588
Token = collections.namedtuple("Token", (
2589
"regexp", # To match token; if "value" is not None, must have
2590
# a "group" containing digits
2591
"value", # datetime.timedelta or None
2592
"followers")) # Tokens valid after this token
2152
2593
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2153
2594
# the "duration" ABNF definition in RFC 3339, Appendix A.
2154
2595
token_end = Token(re.compile(r"$"), None, frozenset())
2155
2596
token_second = Token(re.compile(r"(\d+)S"),
2156
2597
datetime.timedelta(seconds=1),
2157
frozenset((token_end,)))
2598
frozenset((token_end, )))
2158
2599
token_minute = Token(re.compile(r"(\d+)M"),
2159
2600
datetime.timedelta(minutes=1),
2160
2601
frozenset((token_second, token_end)))
2176
2617
frozenset((token_month, token_end)))
2177
2618
token_week = Token(re.compile(r"(\d+)W"),
2178
2619
datetime.timedelta(weeks=1),
2179
frozenset((token_end,)))
2620
frozenset((token_end, )))
2180
2621
token_duration = Token(re.compile(r"P"), None,
2181
2622
frozenset((token_year, token_month,
2182
2623
token_day, token_time,
2183
token_week))),
2624
token_week)))
2184
2625
# Define starting values
2185
2626
value = datetime.timedelta() # Value so far
2186
2627
found_token = None
2187
followers = frozenset(token_duration,) # Following valid tokens
2628
followers = frozenset((token_duration, )) # Following valid tokens
2188
2629
s = duration # String left to parse
2189
2630
# Loop until end token is found
2190
2631
while found_token is not token_end:
2207
2648
break
2208
2649
else:
2209
2650
# No currently valid tokens were found
2210
raise ValueError("Invalid RFC 3339 duration")
2651
raise ValueError("Invalid RFC 3339 duration: {!r}"
2652
.format(duration))
2211
2653
# End token found
2212
2654
return value
2213
2655
2237
2679
timevalue = datetime.timedelta(0)
2238
2680
for s in interval.split():
2239
2681
try:
2240
suffix = unicode(s[-1])
2682
suffix = s[-1]
2241
2683
value = int(s[:-1])
2242
2684
if suffix == "d":
2243
2685
delta = datetime.timedelta(value)
2250
2692
elif suffix == "w":
2251
2693
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2252
2694
else:
2253
raise ValueError("Unknown suffix {0!r}"
2254
.format(suffix))
2255
except (ValueError, IndexError) as e:
2695
raise ValueError("Unknown suffix {!r}".format(suffix))
2696
except IndexError as e:
2256
2697
raise ValueError(*(e.args))
2257
2698
timevalue += delta
2258
2699
return timevalue
2274
2715
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2275
2716
if not stat.S_ISCHR(os.fstat(null).st_mode):
2276
2717
raise OSError(errno.ENODEV,
2277
"{0} not a character device"
2718
"{} not a character device"
2278
2719
.format(os.devnull))
2279
2720
os.dup2(null, sys.stdin.fileno())
2280
2721
os.dup2(null, sys.stdout.fileno())
2290
2731
2291
2732
parser = argparse.ArgumentParser()
2292
2733
parser.add_argument("-v", "--version", action="version",
2293
version = "%(prog)s {0}".format(version),
2734
version = "%(prog)s {}".format(version),
2294
2735
help="show version number and exit")
2295
2736
parser.add_argument("-i", "--interface", metavar="IF",
2296
2737
help="Bind to interface IF")
2329
2770
help="Directory to save/restore state in")
2330
2771
parser.add_argument("--foreground", action="store_true",
2331
2772
help="Run in foreground", default=None)
2773
parser.add_argument("--no-zeroconf", action="store_false",
2774
dest="zeroconf", help="Do not use Zeroconf",
2775
default=None)
2332
2776
2333
2777
options = parser.parse_args()
2334
2778
2335
2779
if options.check:
2336
2780
import doctest
2337
doctest.testmod()
2338
sys.exit()
2781
fail_count, test_count = doctest.testmod()
2782
sys.exit(os.EX_OK if fail_count == 0 else 1)
2339
2783
2340
2784
# Default values for config file for server-global settings
2341
2785
server_defaults = { "interface": "",
2343
2787
"port": "",
2344
2788
"debug": "False",
2345
2789
"priority":
2346
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2347
2792
"servicename": "Mandos",
2348
2793
"use_dbus": "True",
2349
2794
"use_ipv6": "True",
2352
2797
"socket": "",
2353
2798
"statedir": "/var/lib/mandos",
2354
2799
"foreground": "False",
2355
}
2800
"zeroconf": "True",
2801
}
2356
2802
2357
2803
# Parse config file for server-global settings
2358
2804
server_config = configparser.SafeConfigParser(server_defaults)
2359
2805
del server_defaults
2360
server_config.read(os.path.join(options.configdir,
2361
"mandos.conf"))
2806
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2362
2807
# Convert the SafeConfigParser object to a dict
2363
2808
server_settings = server_config.defaults()
2364
2809
# Use the appropriate methods on the non-string config options
2382
2827
# Override the settings from the config file with command line
2383
2828
# options, if set.
2384
2829
for option in ("interface", "address", "port", "debug",
2385
"priority", "servicename", "configdir",
2386
"use_dbus", "use_ipv6", "debuglevel", "restore",
2387
"statedir", "socket", "foreground"):
2830
"priority", "servicename", "configdir", "use_dbus",
2831
"use_ipv6", "debuglevel", "restore", "statedir",
2832
"socket", "foreground", "zeroconf"):
2388
2833
value = getattr(options, option)
2389
2834
if value is not None:
2390
2835
server_settings[option] = value
2391
2836
del options
2392
2837
# Force all strings to be unicode
2393
2838
for option in server_settings.keys():
2394
if type(server_settings[option]) is str:
2395
server_settings[option] = unicode(server_settings[option])
2839
if isinstance(server_settings[option], bytes):
2840
server_settings[option] = (server_settings[option]
2841
.decode("utf-8"))
2396
2842
# Force all boolean options to be boolean
2397
2843
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2398
"foreground"):
2844
"foreground", "zeroconf"):
2399
2845
server_settings[option] = bool(server_settings[option])
2400
2846
# Debug implies foreground
2401
2847
if server_settings["debug"]:
2404
2850
2405
2851
##################################################################
2406
2852
2853
if (not server_settings["zeroconf"]
2854
and not (server_settings["port"]
2855
or server_settings["socket"] != "")):
2856
parser.error("Needs port or socket to work without Zeroconf")
2857
2407
2858
# For convenience
2408
2859
debug = server_settings["debug"]
2409
2860
debuglevel = server_settings["debuglevel"]
2412
2863
stored_state_path = os.path.join(server_settings["statedir"],
2413
2864
stored_state_file)
2414
2865
foreground = server_settings["foreground"]
2866
zeroconf = server_settings["zeroconf"]
2415
2867
2416
2868
if debug:
2417
2869
initlogger(debug, logging.DEBUG)
2423
2875
initlogger(debug, level)
2424
2876
2425
2877
if server_settings["servicename"] != "Mandos":
2426
syslogger.setFormatter(logging.Formatter
2427
('Mandos ({0}) [%(process)d]:'
2428
' %(levelname)s: %(message)s'
2429
.format(server_settings
2430
["servicename"])))
2878
syslogger.setFormatter(
2879
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
' %(levelname)s: %(message)s'.format(
2881
server_settings["servicename"])))
2431
2882
2432
2883
# Parse config file with clients
2433
2884
client_config = configparser.SafeConfigParser(Client
2438
2889
global mandos_dbus_service
2439
2890
mandos_dbus_service = None
2440
2891
2441
tcp_server = MandosServer((server_settings["address"],
2442
server_settings["port"]),
2443
ClientHandler,
2444
interface=(server_settings["interface"]
2445
or None),
2446
use_ipv6=use_ipv6,
2447
gnutls_priority=
2448
server_settings["priority"],
2449
use_dbus=use_dbus,
2450
socketfd=(server_settings["socket"]
2451
or None))
2892
socketfd = None
2893
if server_settings["socket"] != "":
2894
socketfd = server_settings["socket"]
2895
tcp_server = MandosServer(
2896
(server_settings["address"], server_settings["port"]),
2897
ClientHandler,
2898
interface=(server_settings["interface"] or None),
2899
use_ipv6=use_ipv6,
2900
gnutls_priority=server_settings["priority"],
2901
use_dbus=use_dbus,
2902
socketfd=socketfd)
2452
2903
if not foreground:
2453
pidfilename = "/var/run/mandos.pid"
2904
pidfilename = "/run/mandos.pid"
2905
if not os.path.isdir("/run/."):
2906
pidfilename = "/var/run/mandos.pid"
2454
2907
pidfile = None
2455
2908
try:
2456
pidfile = open(pidfilename, "w")
2909
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2457
2910
except IOError as e:
2458
2911
logger.error("Could not open file %r", pidfilename,
2459
2912
exc_info=e)
2473
2926
os.setuid(uid)
2474
2927
except OSError as error:
2475
2928
if error.errno != errno.EPERM:
2476
raise error
2929
raise
2477
2930
2478
2931
if debug:
2479
2932
# Enable all possible GnuTLS debugging
2480
2933
2481
2934
# "Use a log level over 10 to enable all debugging options."
2482
2935
# - GnuTLS manual
2483
gnutls.library.functions.gnutls_global_set_log_level(11)
2936
gnutls.global_set_log_level(11)
2484
2937
2485
@gnutls.library.types.gnutls_log_func
2938
@gnutls.log_func
2486
2939
def debug_gnutls(level, string):
2487
2940
logger.debug("GnuTLS: %s", string[:-1])
2488
2941
2489
(gnutls.library.functions
2490
.gnutls_global_set_log_function(debug_gnutls))
2942
gnutls.global_set_log_function(debug_gnutls)
2491
2943
2492
2944
# Redirect stdin so all checkers get /dev/null
2493
2945
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2513
2965
if use_dbus:
2514
2966
try:
2515
2967
bus_name = dbus.service.BusName("se.recompile.Mandos",
2516
bus, do_not_queue=True)
2517
old_bus_name = (dbus.service.BusName
2518
("se.bsnet.fukt.Mandos", bus,
2519
do_not_queue=True))
2520
except dbus.exceptions.NameExistsException as e:
2968
bus,
2969
do_not_queue=True)
2970
old_bus_name = dbus.service.BusName(
2971
"se.bsnet.fukt.Mandos", bus,
2972
do_not_queue=True)
2973
except dbus.exceptions.DBusException as e:
2521
2974
logger.error("Disabling D-Bus:", exc_info=e)
2522
2975
use_dbus = False
2523
2976
server_settings["use_dbus"] = False
2524
2977
tcp_server.use_dbus = False
2525
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2526
service = AvahiServiceToSyslog(name =
2527
server_settings["servicename"],
2528
servicetype = "_mandos._tcp",
2529
protocol = protocol, bus = bus)
2530
if server_settings["interface"]:
2531
service.interface = (if_nametoindex
2532
(str(server_settings["interface"])))
2978
if zeroconf:
2979
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
2985
if server_settings["interface"]:
2986
service.interface = if_nametoindex(
2987
server_settings["interface"].encode("utf-8"))
2533
2988
2534
2989
global multiprocessing_manager
2535
2990
multiprocessing_manager = multiprocessing.Manager()
2554
3009
if server_settings["restore"]:
2555
3010
try:
2556
3011
with open(stored_state_path, "rb") as stored_state:
2557
clients_data, old_client_settings = (pickle.load
2558
(stored_state))
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
2559
3014
os.remove(stored_state_path)
2560
3015
except IOError as e:
2561
3016
if e.errno == errno.ENOENT:
2562
logger.warning("Could not load persistent state: {0}"
2563
.format(os.strerror(e.errno)))
3017
logger.warning("Could not load persistent state:"
3018
" {}".format(os.strerror(e.errno)))
2564
3019
else:
2565
3020
logger.critical("Could not load persistent state:",
2566
3021
exc_info=e)
2567
3022
raise
2568
3023
except EOFError as e:
2569
3024
logger.warning("Could not load persistent state: "
2570
"EOFError:", exc_info=e)
3025
"EOFError:",
3026
exc_info=e)
2571
3027
2572
3028
with PGPEngine() as pgp:
2573
for client_name, client in clients_data.iteritems():
3029
for client_name, client in clients_data.items():
2574
3030
# Skip removed clients
2575
3031
if client_name not in client_settings:
2576
3032
continue
2585
3041
# For each value in new config, check if it
2586
3042
# differs from the old config value (Except for
2587
3043
# the "secret" attribute)
2588
if (name != "secret" and
2589
value != old_client_settings[client_name]
2590
[name]):
3044
if (name != "secret"
3045
and (value !=
3046
old_client_settings[client_name][name])):
2591
3047
client[name] = value
2592
3048
except KeyError:
2593
3049
pass
2594
3050
2595
3051
# Clients who has passed its expire date can still be
2596
# enabled if its last checker was successful. Clients
3052
# enabled if its last checker was successful. A Client
2597
3053
# whose checker succeeded before we stored its state is
2598
3054
# assumed to have successfully run all checkers during
2599
3055
# downtime.
2601
3057
if datetime.datetime.utcnow() >= client["expires"]:
2602
3058
if not client["last_checked_ok"]:
2603
3059
logger.warning(
2604
"disabling client {0} - Client never "
2605
"performed a successful checker"
2606
.format(client_name))
3060
"disabling client {} - Client never "
3061
"performed a successful checker".format(
3062
client_name))
2607
3063
client["enabled"] = False
2608
3064
elif client["last_checker_status"] != 0:
2609
3065
logger.warning(
2610
"disabling client {0} - Client "
2611
"last checker failed with error code {1}"
2612
.format(client_name,
2613
client["last_checker_status"]))
3066
"disabling client {} - Client last"
3067
" checker failed with error code"
3068
" {}".format(
3069
client_name,
3070
client["last_checker_status"]))
2614
3071
client["enabled"] = False
2615
3072
else:
2616
client["expires"] = (datetime.datetime
2617
.utcnow()
2618
+ client["timeout"])
3073
client["expires"] = (
3074
datetime.datetime.utcnow()
3075
+ client["timeout"])
2619
3076
logger.debug("Last checker succeeded,"
2620
" keeping {0} enabled"
2621
.format(client_name))
3077
" keeping {} enabled".format(
3078
client_name))
2622
3079
try:
2623
client["secret"] = (
2624
pgp.decrypt(client["encrypted_secret"],
2625
client_settings[client_name]
2626
["secret"]))
3080
client["secret"] = pgp.decrypt(
3081
client["encrypted_secret"],
3082
client_settings[client_name]["secret"])
2627
3083
except PGPError:
2628
3084
# If decryption fails, we use secret from new settings
2629
logger.debug("Failed to decrypt {0} old secret"
2630
.format(client_name))
2631
client["secret"] = (
2632
client_settings[client_name]["secret"])
3085
logger.debug("Failed to decrypt {} old secret".format(
3086
client_name))
3087
client["secret"] = (client_settings[client_name]
3088
["secret"])
2633
3089
2634
3090
# Add/remove clients based on new changes made to config
2635
3091
for client_name in (set(old_client_settings)
2640
3096
clients_data[client_name] = client_settings[client_name]
2641
3097
2642
3098
# Create all client objects
2643
for client_name, client in clients_data.iteritems():
3099
for client_name, client in clients_data.items():
2644
3100
tcp_server.clients[client_name] = client_class(
2645
name = client_name, settings = client,
3101
name = client_name,
3102
settings = client,
2646
3103
server_settings = server_settings)
2647
3104
2648
3105
if not tcp_server.clients:
2650
3107
2651
3108
if not foreground:
2652
3109
if pidfile is not None:
3110
pid = os.getpid()
2653
3111
try:
2654
3112
with pidfile:
2655
pid = os.getpid()
2656
pidfile.write(str(pid) + "\n".encode("utf-8"))
3113
print(pid, file=pidfile)
2657
3114
except IOError:
2658
3115
logger.error("Could not write to file %r with PID %d",
2659
3116
pidfilename, pid)
2664
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2665
3122
2666
3123
if use_dbus:
2667
@alternate_dbus_interfaces({"se.recompile.Mandos":
2668
"se.bsnet.fukt.Mandos"})
2669
class MandosDBusService(DBusObjectWithProperties):
3124
3125
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3127
class MandosDBusService(DBusObjectWithObjectManager):
2670
3128
"""A D-Bus proxy object"""
3129
2671
3130
def __init__(self):
2672
3131
dbus.service.Object.__init__(self, bus, "/")
3132
2673
3133
_interface = "se.recompile.Mandos"
2674
3134
2675
@dbus_interface_annotations(_interface)
2676
def _foo(self):
2677
return { "org.freedesktop.DBus.Property"
2678
".EmitsChangedSignal":
2679
"false"}
2680
2681
3135
@dbus.service.signal(_interface, signature="o")
2682
3136
def ClientAdded(self, objpath):
2683
3137
"D-Bus signal"
2688
3142
"D-Bus signal"
2689
3143
pass
2690
3144
3145
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
"true"})
2691
3147
@dbus.service.signal(_interface, signature="os")
2692
3148
def ClientRemoved(self, objpath, name):
2693
3149
"D-Bus signal"
2694
3150
pass
2695
3151
3152
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
"true"})
2696
3154
@dbus.service.method(_interface, out_signature="ao")
2697
3155
def GetAllClients(self):
2698
3156
"D-Bus method"
2699
return dbus.Array(c.dbus_object_path
2700
for c in
3157
return dbus.Array(c.dbus_object_path for c in
2701
3158
tcp_server.clients.itervalues())
2702
3159
3160
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
"true"})
2703
3162
@dbus.service.method(_interface,
2704
3163
out_signature="a{oa{sv}}")
2705
3164
def GetAllClientsWithProperties(self):
2706
3165
"D-Bus method"
2707
3166
return dbus.Dictionary(
2708
((c.dbus_object_path, c.GetAll(""))
2709
for c in tcp_server.clients.itervalues()),
3167
{ c.dbus_object_path: c.GetAll(
3168
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
2710
3170
signature="oa{sv}")
2711
3171
2712
3172
@dbus.service.method(_interface, in_signature="o")
2716
3176
if c.dbus_object_path == object_path:
2717
3177
del tcp_server.clients[c.name]
2718
3178
c.remove_from_connection()
2719
# Don't signal anything except ClientRemoved
3179
# Don't signal the disabling
2720
3180
c.disable(quiet=True)
2721
# Emit D-Bus signal
2722
self.ClientRemoved(object_path, c.name)
3181
# Emit D-Bus signal for removal
3182
self.client_removed_signal(c)
2723
3183
return
2724
3184
raise KeyError(object_path)
2725
3185
2726
3186
del _interface
3187
3188
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3190
def GetManagedObjects(self):
3191
"""D-Bus method"""
3192
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3200
def client_added_signal(self, client):
3201
"""Send the new standard signal and the old signal"""
3202
if use_dbus:
3203
# New standard signal
3204
self.InterfacesAdded(
3205
client.dbus_object_path,
3206
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3210
# Old signal
3211
self.ClientAdded(client.dbus_object_path)
3212
3213
def client_removed_signal(self, client):
3214
"""Send the new standard signal and the old signal"""
3215
if use_dbus:
3216
# New standard signal
3217
self.InterfacesRemoved(
3218
client.dbus_object_path,
3219
client._get_all_interface_names())
3220
# Old signal
3221
self.ClientRemoved(client.dbus_object_path,
3222
client.name)
2727
3223
2728
3224
mandos_dbus_service = MandosDBusService()
2729
3225
2730
3226
def cleanup():
2731
3227
"Cleanup function; run on exit"
2732
service.cleanup()
3228
if zeroconf:
3229
service.cleanup()
2733
3230
2734
3231
multiprocessing.active_children()
2735
3232
wnull.close()
2749
3246
2750
3247
# A list of attributes that can not be pickled
2751
3248
# + secret.
2752
exclude = set(("bus", "changedstate", "secret",
2753
"checker", "server_settings"))
2754
for name, typ in (inspect.getmembers
2755
(dbus.service.Object)):
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3251
for name, typ in inspect.getmembers(dbus.service
3252
.Object):
2756
3253
exclude.add(name)
2757
3254
2758
3255
client_dict["encrypted_secret"] = (client
2765
3262
del client_settings[client.name]["secret"]
2766
3263
2767
3264
try:
2768
with (tempfile.NamedTemporaryFile
2769
(mode='wb', suffix=".pickle", prefix='clients-',
2770
dir=os.path.dirname(stored_state_path),
2771
delete=False)) as stored_state:
3265
with tempfile.NamedTemporaryFile(
3266
mode='wb',
3267
suffix=".pickle",
3268
prefix='clients-',
3269
dir=os.path.dirname(stored_state_path),
3270
delete=False) as stored_state:
2772
3271
pickle.dump((clients, client_settings), stored_state)
2773
tempname=stored_state.name
3272
tempname = stored_state.name
2774
3273
os.rename(tempname, stored_state_path)
2775
3274
except (IOError, OSError) as e:
2776
3275
if not debug:
2779
3278
except NameError:
2780
3279
pass
2781
3280
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2782
logger.warning("Could not save persistent state: {0}"
3281
logger.warning("Could not save persistent state: {}"
2783
3282
.format(os.strerror(e.errno)))
2784
3283
else:
2785
3284
logger.warning("Could not save persistent state:",
2786
3285
exc_info=e)
2787
raise e
3286
raise
2788
3287
2789
3288
# Delete all clients, and settings from config
2790
3289
while tcp_server.clients:
2791
3290
name, client = tcp_server.clients.popitem()
2792
3291
if use_dbus:
2793
3292
client.remove_from_connection()
2794
# Don't signal anything except ClientRemoved
3293
# Don't signal the disabling
2795
3294
client.disable(quiet=True)
3295
# Emit D-Bus signal for removal
2796
3296
if use_dbus:
2797
# Emit D-Bus signal
2798
mandos_dbus_service.ClientRemoved(client
2799
.dbus_object_path,
2800
client.name)
3297
mandos_dbus_service.client_removed_signal(client)
2801
3298
client_settings.clear()
2802
3299
2803
3300
atexit.register(cleanup)
2804
3301
2805
3302
for client in tcp_server.clients.itervalues():
2806
3303
if use_dbus:
2807
# Emit D-Bus signal
2808
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3304
# Emit D-Bus signal for adding
3305
mandos_dbus_service.client_added_signal(client)
2809
3306
# Need to initiate checking of clients
2810
3307
if client.enabled:
2811
3308
client.init_checker()
2814
3311
tcp_server.server_activate()
2815
3312
2816
3313
# Find out what port we got
2817
service.port = tcp_server.socket.getsockname()[1]
3314
if zeroconf:
3315
service.port = tcp_server.socket.getsockname()[1]
2818
3316
if use_ipv6:
2819
3317
logger.info("Now listening on address %r, port %d,"
2820
3318
" flowinfo %d, scope_id %d",
2826
3324
#service.interface = tcp_server.socket.getsockname()[3]
2827
3325
2828
3326
try:
2829
# From the Avahi example code
2830
try:
2831
service.activate()
2832
except dbus.exceptions.DBusException as error:
2833
logger.critical("D-Bus Exception", exc_info=error)
2834
cleanup()
2835
sys.exit(1)
2836
# End of Avahi example code
3327
if zeroconf:
3328
# From the Avahi example code
3329
try:
3330
service.activate()
3331
except dbus.exceptions.DBusException as error:
3332
logger.critical("D-Bus Exception", exc_info=error)
3333
cleanup()
3334
sys.exit(1)
3335
# End of Avahi example code
2837
3336
2838
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2839
3338
lambda *args, **kwargs:
2854
3353
# Must run before the D-Bus bus name gets deregistered
2855
3354
cleanup()
2856
3355
3356
2857
3357
if __name__ == '__main__':
2858
3358
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0