/mandos/trunk : revision 807

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

43

46

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

51

import sys

52

import re

53

import os

62

import struct

63

import fcntl

64

import functools

65

import cPickle as pickle

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

66

69

import multiprocessing

67

70

import types

68

71

import binascii

69

72

import tempfile

70

73

import itertools

71

74

import collections

75

import codecs

72

76

73

77

import dbus

74

78

import dbus.service

75

import gobject

79

try:

80

import gobject

81

except ImportError:

82

from gi.repository import GObject as gobject

76

83

import avahi

77

84

from dbus.mainloop.glib import DBusGMainLoop

78

85

import ctypes

88

95

except ImportError:

89

96

SO_BINDTODEVICE = None

90

97

91

version = "1.6.2"

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.1"

92

102

stored_state_file = "clients.pickle"

93

103

94

104

logger = logging.getLogger()

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

105

syslogger = None

98

106

99

107

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

103

110

except (OSError, AttributeError):

111

104

112

def if_nametoindex(interface):

105

113

"Get an interface index the hard way, i.e. using fcntl()"

106

114

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

115

with contextlib.closing(socket.socket()) as s:

108

116

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

117

struct.pack(b"16s16x", interface))

118

interface_index = struct.unpack("I", ifreq[16:20])[0]

113

119

return interface_index

114

120

115

121

116

122

def initlogger(debug, level=logging.WARNING):

117

123

"""init logger and add loglevel"""

118

124

125

global syslogger

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

119

129

syslogger.setFormatter(logging.Formatter

120

130

('Mandos [%(process)d]: %(levelname)s:'

121

131

' %(message)s'))

138

148

139

149

class PGPEngine(object):

140

150

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

141

152

def __init__(self):

142

153

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

self.gpg = "gpg"

155

try:

156

output = subprocess.check_output(["gpgconf"])

157

for line in output.splitlines():

158

name, text, path = line.split(":")

159

if name == "gpg":

160

self.gpg = path

161

break

162

except OSError as e:

163

if e.errno != errno.ENOENT:

164

raise

143

165

self.gnupgargs = ['--batch',

144

'--home', self.tempdir,

166

'--homedir', self.tempdir,

145

167

'--force-mdc',

146

168

'--quiet',

147

169

'--no-use-agent']

182

204

183

205

def encrypt(self, data, password):

184

206

passphrase = self.password_encode(password)

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

207

with tempfile.NamedTemporaryFile(

208

dir=self.tempdir) as passfile:

187

209

passfile.write(passphrase)

188

210

passfile.flush()

189

proc = subprocess.Popen(['gpg', '--symmetric',

211

proc = subprocess.Popen([self.gpg, '--symmetric',

190

212

'--passphrase-file',

191

213

passfile.name]

192

214

+ self.gnupgargs,

200

222

201

223

def decrypt(self, data, password):

202

224

passphrase = self.password_encode(password)

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

225

with tempfile.NamedTemporaryFile(

226

dir = self.tempdir) as passfile:

205

227

passfile.write(passphrase)

206

228

passfile.flush()

207

proc = subprocess.Popen(['gpg', '--decrypt',

229

proc = subprocess.Popen([self.gpg, '--decrypt',

208

230

'--passphrase-file',

209

231

passfile.name]

210

232

+ self.gnupgargs,

211

233

stdin = subprocess.PIPE,

212

234

stdout = subprocess.PIPE,

213

235

stderr = subprocess.PIPE)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

236

decrypted_plaintext, err = proc.communicate(input = data)

216

237

if proc.returncode != 0:

217

238

raise PGPError(err)

218

239

return decrypted_plaintext

221

242

class AvahiError(Exception):

222

243

def __init__(self, value, *args, **kwargs):

223

244

self.value = value

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

245

return super(AvahiError, self).__init__(value, *args,

246

**kwargs)

247

227

248

228

249

class AvahiServiceError(AvahiError):

229

250

pass

230

251

252

231

253

class AvahiGroupError(AvahiError):

232

254

pass

233

255

253

275

bus: dbus.SystemBus()

254

276

"""

255

277

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

278

def __init__(self,

279

interface = avahi.IF_UNSPEC,

280

name = None,

281

servicetype = None,

282

port = None,

283

TXT = None,

284

domain = "",

285

host = "",

286

max_renames = 32768,

287

protocol = avahi.PROTO_UNSPEC,

288

bus = None):

260

289

self.interface = interface

261

290

self.name = name

262

291

self.type = servicetype

272

301

self.bus = bus

273

302

self.entry_group_state_changed_match = None

274

303

275

def rename(self):

304

def rename(self, remove=True):

276

305

"""Derived from the Avahi example code"""

277

306

if self.rename_count >= self.max_renames:

278

307

logger.critical("No suitable Zeroconf service name found"

279

308

" after %i retries, exiting.",

280

309

self.rename_count)

281

310

raise AvahiServiceError("Too many renames")

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

311

self.name = str(

312

self.server.GetAlternativeServiceName(self.name))

313

self.rename_count += 1

284

314

logger.info("Changing Zeroconf service name to %r ...",

285

315

self.name)

286

self.remove()

316

if remove:

317

self.remove()

287

318

try:

288

319

self.add()

289

320

except dbus.exceptions.DBusException as error:

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

321

if (error.get_dbus_name()

322

== "org.freedesktop.Avahi.CollisionError"):

323

logger.info("Local Zeroconf service name collision.")

324

return self.rename(remove=False)

325

else:

326

logger.critical("D-Bus Exception", exc_info=error)

327

self.cleanup()

328

os._exit(1)

294

329

295

330

def remove(self):

296

331

"""Derived from the Avahi example code"""

334

369

self.rename()

335

370

elif state == avahi.ENTRY_GROUP_FAILURE:

336

371

logger.critical("Avahi: Error in group state changed %s",

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

372

str(error))

373

raise AvahiGroupError("State changed: {!s}".format(error))

340

374

341

375

def cleanup(self):

342

376

"""Derived from the Avahi example code"""

352

386

def server_state_changed(self, state, error=None):

353

387

"""Derived from the Avahi example code"""

354

388

logger.debug("Avahi server state change: %i", state)

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

389

bad_states = {

390

avahi.SERVER_INVALID: "Zeroconf server invalid",

391

avahi.SERVER_REGISTERING: None,

392

avahi.SERVER_COLLISION: "Zeroconf server name collision",

393

avahi.SERVER_FAILURE: "Zeroconf server failure",

394

}

362

395

if state in bad_states:

363

396

if bad_states[state] is not None:

364

397

if error is None:

367

400

logger.error(bad_states[state] + ": %r", error)

368

401

self.cleanup()

369

402

elif state == avahi.SERVER_RUNNING:

370

self.add()

403

try:

404

self.add()

405

except dbus.exceptions.DBusException as error:

406

if (error.get_dbus_name()

407

== "org.freedesktop.Avahi.CollisionError"):

408

logger.info("Local Zeroconf service name"

409

" collision.")

410

return self.rename(remove=False)

411

else:

412

logger.critical("D-Bus Exception", exc_info=error)

413

self.cleanup()

414

os._exit(1)

371

415

else:

372

416

if error is None:

373

417

logger.debug("Unknown state: %r", state)

383

427

follow_name_owner_changes=True),

384

428

avahi.DBUS_INTERFACE_SERVER)

385

429

self.server.connect_to_signal("StateChanged",

386

self.server_state_changed)

430

self.server_state_changed)

387

431

self.server_state_changed(self.server.GetState())

388

432

389

433

390

434

class AvahiServiceToSyslog(AvahiService):

391

def rename(self):

435

def rename(self, *args, **kwargs):

392

436

"""Add the new name to the syslog messages"""

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

437

ret = AvahiService.rename(self, *args, **kwargs)

438

syslogger.setFormatter(logging.Formatter(

439

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

440

.format(self.name)))

398

441

return ret

399

442

400

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

443

# Pretend that we have a GnuTLS module

444

class GnuTLS(object):

445

"""This isn't so much a class as it is a module-like namespace.

446

It is instantiated once, and simulates having a GnuTLS module."""

447

448

_library = ctypes.cdll.LoadLibrary(

449

ctypes.util.find_library("gnutls"))

450

_need_version = "3.3.0"

451

def __init__(self):

452

# Need to use class name "GnuTLS" here, since this method is

453

# called before the assignment to the "gnutls" global variable

454

# happens.

455

if GnuTLS.check_version(self._need_version) is None:

456

raise GnuTLS.Error("Needs GnuTLS {} or later"

457

.format(self._need_version))

458

459

# Unless otherwise indicated, the constants and types below are

460

# all from the gnutls/gnutls.h C header file.

461

462

# Constants

463

E_SUCCESS = 0

464

E_INTERRUPTED = -52

465

E_AGAIN = -28

466

CRT_OPENPGP = 2

467

CLIENT = 2

468

SHUT_RDWR = 0

469

CRD_CERTIFICATE = 1

470

E_NO_CERTIFICATE_FOUND = -49

471

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

472

473

# Types

474

class session_int(ctypes.Structure):

475

_fields_ = []

476

session_t = ctypes.POINTER(session_int)

477

class certificate_credentials_st(ctypes.Structure):

478

_fields_ = []

479

certificate_credentials_t = ctypes.POINTER(

480

certificate_credentials_st)

481

certificate_type_t = ctypes.c_int

482

class datum_t(ctypes.Structure):

483

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

484

('size', ctypes.c_uint)]

485

class openpgp_crt_int(ctypes.Structure):

486

_fields_ = []

487

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

488

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

489

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

490

credentials_type_t = ctypes.c_int #

491

transport_ptr_t = ctypes.c_void_p

492

close_request_t = ctypes.c_int

493

494

# Exceptions

495

class Error(Exception):

496

# We need to use the class name "GnuTLS" here, since this

497

# exception might be raised from within GnuTLS.__init__,

498

# which is called before the assignment to the "gnutls"

499

# global variable has happened.

500

def __init__(self, message = None, code = None, args=()):

501

# Default usage is by a message string, but if a return

502

# code is passed, convert it to a string with

503

# gnutls.strerror()

504

self.code = code

505

if message is None and code is not None:

506

message = GnuTLS.strerror(code)

507

return super(GnuTLS.Error, self).__init__(

508

message, *args)

509

510

class CertificateSecurityError(Error):

511

pass

512

513

# Classes

514

class Credentials(object):

515

def __init__(self):

516

self._c_object = gnutls.certificate_credentials_t()

517

gnutls.certificate_allocate_credentials(

518

ctypes.byref(self._c_object))

519

self.type = gnutls.CRD_CERTIFICATE

520

521

def __del__(self):

522

gnutls.certificate_free_credentials(self._c_object)

523

524

class ClientSession(object):

525

def __init__(self, socket, credentials = None):

526

self._c_object = gnutls.session_t()

527

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

528

gnutls.set_default_priority(self._c_object)

529

gnutls.transport_set_ptr(self._c_object, socket.fileno())

530

gnutls.handshake_set_private_extensions(self._c_object,

531

True)

532

self.socket = socket

533

if credentials is None:

534

credentials = gnutls.Credentials()

535

gnutls.credentials_set(self._c_object, credentials.type,

536

ctypes.cast(credentials._c_object,

537

ctypes.c_void_p))

538

self.credentials = credentials

539

540

def __del__(self):

541

gnutls.deinit(self._c_object)

542

543

def handshake(self):

544

return gnutls.handshake(self._c_object)

545

546

def send(self, data):

547

data = bytes(data)

548

data_len = len(data)

549

while data_len > 0:

550

data_len -= gnutls.record_send(self._c_object,

551

data[-data_len:],

552

data_len)

553

554

def bye(self):

555

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

556

557

# Error handling functions

558

def _error_code(result):

559

"""A function to raise exceptions on errors, suitable

560

for the 'restype' attribute on ctypes functions"""

561

if result >= 0:

562

return result

563

if result == gnutls.E_NO_CERTIFICATE_FOUND:

564

raise gnutls.CertificateSecurityError(code = result)

565

raise gnutls.Error(code = result)

566

567

def _retry_on_error(result, func, arguments):

568

"""A function to retry on some errors, suitable

569

for the 'errcheck' attribute on ctypes functions"""

570

while result < 0:

571

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

572

return _error_code(result)

573

result = func(*arguments)

574

return result

575

576

# Unless otherwise indicated, the function declarations below are

577

# all from the gnutls/gnutls.h C header file.

578

579

# Functions

580

priority_set_direct = _library.gnutls_priority_set_direct

581

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

582

ctypes.POINTER(ctypes.c_char_p)]

583

priority_set_direct.restype = _error_code

584

585

init = _library.gnutls_init

586

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

587

init.restype = _error_code

588

589

set_default_priority = _library.gnutls_set_default_priority

590

set_default_priority.argtypes = [session_t]

591

set_default_priority.restype = _error_code

592

593

record_send = _library.gnutls_record_send

594

record_send.argtypes = [session_t, ctypes.c_void_p,

595

ctypes.c_size_t]

596

record_send.restype = ctypes.c_ssize_t

597

record_send.errcheck = _retry_on_error

598

599

certificate_allocate_credentials = (

600

_library.gnutls_certificate_allocate_credentials)

601

certificate_allocate_credentials.argtypes = [

602

ctypes.POINTER(certificate_credentials_t)]

603

certificate_allocate_credentials.restype = _error_code

604

605

certificate_free_credentials = (

606

_library.gnutls_certificate_free_credentials)

607

certificate_free_credentials.argtypes = [certificate_credentials_t]

608

certificate_free_credentials.restype = None

609

610

handshake_set_private_extensions = (

611

_library.gnutls_handshake_set_private_extensions)

612

handshake_set_private_extensions.argtypes = [session_t,

613

ctypes.c_int]

614

handshake_set_private_extensions.restype = None

615

616

credentials_set = _library.gnutls_credentials_set

617

credentials_set.argtypes = [session_t, credentials_type_t,

618

ctypes.c_void_p]

619

credentials_set.restype = _error_code

620

621

strerror = _library.gnutls_strerror

622

strerror.argtypes = [ctypes.c_int]

623

strerror.restype = ctypes.c_char_p

624

625

certificate_type_get = _library.gnutls_certificate_type_get

626

certificate_type_get.argtypes = [session_t]

627

certificate_type_get.restype = _error_code

628

629

certificate_get_peers = _library.gnutls_certificate_get_peers

630

certificate_get_peers.argtypes = [session_t,

631

ctypes.POINTER(ctypes.c_uint)]

632

certificate_get_peers.restype = ctypes.POINTER(datum_t)

633

634

global_set_log_level = _library.gnutls_global_set_log_level

635

global_set_log_level.argtypes = [ctypes.c_int]

636

global_set_log_level.restype = None

637

638

global_set_log_function = _library.gnutls_global_set_log_function

639

global_set_log_function.argtypes = [log_func]

640

global_set_log_function.restype = None

641

642

deinit = _library.gnutls_deinit

643

deinit.argtypes = [session_t]

644

deinit.restype = None

645

646

handshake = _library.gnutls_handshake

647

handshake.argtypes = [session_t]

648

handshake.restype = _error_code

649

handshake.errcheck = _retry_on_error

650

651

transport_set_ptr = _library.gnutls_transport_set_ptr

652

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

653

transport_set_ptr.restype = None

654

655

bye = _library.gnutls_bye

656

bye.argtypes = [session_t, close_request_t]

657

bye.restype = _error_code

658

bye.errcheck = _retry_on_error

659

660

check_version = _library.gnutls_check_version

661

check_version.argtypes = [ctypes.c_char_p]

662

check_version.restype = ctypes.c_char_p

663

664

# All the function declarations below are from gnutls/openpgp.h

665

666

openpgp_crt_init = _library.gnutls_openpgp_crt_init

667

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

668

openpgp_crt_init.restype = _error_code

669

670

openpgp_crt_import = _library.gnutls_openpgp_crt_import

671

openpgp_crt_import.argtypes = [openpgp_crt_t,

672

ctypes.POINTER(datum_t),

673

openpgp_crt_fmt_t]

674

openpgp_crt_import.restype = _error_code

675

676

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

677

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

678

ctypes.POINTER(ctypes.c_uint)]

679

openpgp_crt_verify_self.restype = _error_code

680

681

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

682

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

683

openpgp_crt_deinit.restype = None

684

685

openpgp_crt_get_fingerprint = (

686

_library.gnutls_openpgp_crt_get_fingerprint)

687

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

688

ctypes.c_void_p,

689

ctypes.POINTER(

690

ctypes.c_size_t)]

691

openpgp_crt_get_fingerprint.restype = _error_code

692

693

# Remove non-public functions

694

del _error_code, _retry_on_error

695

# Create the global "gnutls" object, simulating a module

696

gnutls = GnuTLS()

697

698

def call_pipe(connection, # : multiprocessing.Connection

699

func, *args, **kwargs):

700

"""This function is meant to be called by multiprocessing.Process

701

702

This function runs func(*args, **kwargs), and writes the resulting

703

return value on the provided multiprocessing.Connection.

704

"""

705

connection.send(func(*args, **kwargs))

706

connection.close()

407

707

408

708

class Client(object):

409

709

"""A representation of a client host served by this server.

436

736

last_checker_status: integer between 0 and 255 reflecting exit

437

737

status of last checker. -1 reflects crashed

438

738

checker, -2 means no checker completed yet.

739

last_checker_signal: The signal which killed the last checker, if

740

last_checker_status is -1

439

741

last_enabled: datetime.datetime(); (UTC) or None

440

742

name: string; from the config file, used in log messages and

441

743

D-Bus identifiers

454

756

"fingerprint", "host", "interval",

455

757

"last_approval_request", "last_checked_ok",

456

758

"last_enabled", "name", "timeout")

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

759

client_defaults = {

760

"timeout": "PT5M",

761

"extended_timeout": "PT15M",

762

"interval": "PT2M",

763

"checker": "fping -q -- %%(host)s",

764

"host": "",

765

"approval_delay": "PT0S",

766

"approval_duration": "PT1S",

767

"approved_by_default": "True",

768

"enabled": "True",

769

}

482

770

483

771

@staticmethod

484

772

def config_parser(config):

500

788

client["enabled"] = config.getboolean(client_name,

501

789

"enabled")

502

790

791

# Uppercase and remove spaces from fingerprint for later

792

# comparison purposes with return value from the

793

# fingerprint() function

503

794

client["fingerprint"] = (section["fingerprint"].upper()

504

795

.replace(" ", ""))

505

796

if "secret" in section:

510

801

"rb") as secfile:

511

802

client["secret"] = secfile.read()

512

803

else:

513

raise TypeError("No secret or secfile for section {0}"

804

raise TypeError("No secret or secfile for section {}"

514

805

.format(section))

515

806

client["timeout"] = string_to_delta(section["timeout"])

516

807

client["extended_timeout"] = string_to_delta(

533

824

server_settings = {}

534

825

self.server_settings = server_settings

535

826

# adding all client settings

536

for setting, value in settings.iteritems():

827

for setting, value in settings.items():

537

828

setattr(self, setting, value)

538

829

539

830

if self.enabled:

547

838

self.expires = None

548

839

549

840

logger.debug("Creating client %r", self.name)

550

# Uppercase and remove spaces from fingerprint for later

551

# comparison purposes with return value from the fingerprint()

552

# function

553

841

logger.debug(" Fingerprint: %s", self.fingerprint)

554

842

self.created = settings.get("created",

555

843

datetime.datetime.utcnow())

562

850

self.current_checker_command = None

563

851

self.approved = None

564

852

self.approvals_pending = 0

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

853

self.changedstate = multiprocessing_manager.Condition(

854

multiprocessing_manager.Lock())

855

self.client_structure = [attr

856

for attr in self.__dict__.iterkeys()

570

857

if not attr.startswith("_")]

571

858

self.client_structure.append("client_structure")

572

859

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

860

for name, t in inspect.getmembers(

861

type(self), lambda obj: isinstance(obj, property)):

577

862

if not name.startswith("_"):

578

863

self.client_structure.append(name)

579

864

621

906

# and every interval from then on.

622

907

if self.checker_initiator_tag is not None:

623

908

gobject.source_remove(self.checker_initiator_tag)

624

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

626

self.start_checker))

909

self.checker_initiator_tag = gobject.timeout_add(

910

int(self.interval.total_seconds() * 1000),

911

self.start_checker)

627

912

# Schedule a disable() when 'timeout' has passed

628

913

if self.disable_initiator_tag is not None:

629

914

gobject.source_remove(self.disable_initiator_tag)

630

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

915

self.disable_initiator_tag = gobject.timeout_add(

916

int(self.timeout.total_seconds() * 1000), self.disable)

633

917

# Also start a new checker *right now*.

634

918

self.start_checker()

635

919

636

def checker_callback(self, pid, condition, command):

920

def checker_callback(self, source, condition, connection,

921

command):

637

922

"""The checker has completed, so take appropriate actions."""

638

923

self.checker_callback_tag = None

639

924

self.checker = None

640

if os.WIFEXITED(condition):

641

self.last_checker_status = os.WEXITSTATUS(condition)

925

# Read return code from connection (see call_pipe)

926

returncode = connection.recv()

927

connection.close()

928

929

if returncode >= 0:

930

self.last_checker_status = returncode

931

self.last_checker_signal = None

642

932

if self.last_checker_status == 0:

643

933

logger.info("Checker for %(name)s succeeded",

644

934

vars(self))

645

935

self.checked_ok()

646

936

else:

647

logger.info("Checker for %(name)s failed",

648

vars(self))

937

logger.info("Checker for %(name)s failed", vars(self))

649

938

else:

650

939

self.last_checker_status = -1

940

self.last_checker_signal = -returncode

651

941

logger.warning("Checker for %(name)s crashed?",

652

942

vars(self))

943

return False

653

944

654

945

def checked_ok(self):

655

946

"""Assert that the client has been seen, alive and well."""

656

947

self.last_checked_ok = datetime.datetime.utcnow()

657

948

self.last_checker_status = 0

949

self.last_checker_signal = None

658

950

self.bump_timeout()

659

951

660

952

def bump_timeout(self, timeout=None):

665

957

gobject.source_remove(self.disable_initiator_tag)

666

958

self.disable_initiator_tag = None

667

959

if getattr(self, "enabled", False):

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

960

self.disable_initiator_tag = gobject.timeout_add(

961

int(timeout.total_seconds() * 1000), self.disable)

671

962

self.expires = datetime.datetime.utcnow() + timeout

672

963

673

964

def need_approval(self):

687

978

# than 'timeout' for the client to be disabled, which is as it

688

979

# should be.

689

980

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

698

else:

699

if pid:

700

logger.warning("Checker was a zombie")

701

gobject.source_remove(self.checker_callback_tag)

702

self.checker_callback(pid, status,

703

self.current_checker_command)

981

if self.checker is not None and not self.checker.is_alive():

982

logger.warning("Checker was not alive; joining")

983

self.checker.join()

984

self.checker = None

704

985

# Start a new checker if needed

705

986

if self.checker is None:

706

987

# Escape attributes for the shell

707

escaped_attrs = dict(

708

(attr, re.escape(unicode(getattr(self, attr))))

709

for attr in

710

self.runtime_expansions)

988

escaped_attrs = {

989

attr: re.escape(str(getattr(self, attr)))

990

for attr in self.runtime_expansions }

711

991

try:

712

992

command = self.checker_command % escaped_attrs

713

993

except TypeError as error:

714

994

logger.error('Could not format string "%s"',

715

self.checker_command, exc_info=error)

716

return True # Try again later

995

self.checker_command,

996

exc_info=error)

997

return True # Try again later

717

998

self.current_checker_command = command

718

try:

719

logger.info("Starting checker %r for %s",

720

command, self.name)

721

# We don't need to redirect stdout and stderr, since

722

# in normal mode, that is already done by daemon(),

723

# and in debug mode we don't want to. (Stdin is

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

self.checker = subprocess.Popen(command,

734

close_fds=True,

735

shell=True, cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

739

exc_info=error)

740

return True

741

self.checker_callback_tag = (gobject.child_watch_add

742

(self.checker.pid,

743

self.checker_callback,

744

data=command))

745

# The checker may have completed before the gobject

746

# watch was added. Check for this.

747

try:

748

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

749

except OSError as error:

750

if error.errno == errno.ECHILD:

751

# This should never happen

752

logger.error("Child process vanished",

753

exc_info=error)

754

return True

755

raise

756

if pid:

757

gobject.source_remove(self.checker_callback_tag)

758

self.checker_callback(pid, status, command)

999

logger.info("Starting checker %r for %s", command,

1000

self.name)

1001

# We don't need to redirect stdout and stderr, since

1002

# in normal mode, that is already done by daemon(),

1003

# and in debug mode we don't want to. (Stdin is

1004

# always replaced by /dev/null.)

1005

# The exception is when not debugging but nevertheless

1006

# running in the foreground; use the previously

1007

# created wnull.

1008

popen_args = { "close_fds": True,

1009

"shell": True,

1010

"cwd": "/" }

1011

if (not self.server_settings["debug"]

1012

and self.server_settings["foreground"]):

1013

popen_args.update({"stdout": wnull,

1014

"stderr": wnull })

1015

pipe = multiprocessing.Pipe(duplex = False)

1016

self.checker = multiprocessing.Process(

1017

target = call_pipe,

1018

args = (pipe[1], subprocess.call, command),

1019

kwargs = popen_args)

1020

self.checker.start()

1021

self.checker_callback_tag = gobject.io_add_watch(

1022

pipe[0].fileno(), gobject.IO_IN,

1023

self.checker_callback, pipe[0], command)

759

1024

# Re-run this periodically if run by gobject.timeout_add

760

1025

return True

761

1026

767

1032

if getattr(self, "checker", None) is None:

768

1033

return

769

1034

logger.debug("Stopping checker for %(name)s", vars(self))

770

try:

771

self.checker.terminate()

772

#time.sleep(0.5)

773

#if self.checker.poll() is None:

774

# self.checker.kill()

775

except OSError as error:

776

if error.errno != errno.ESRCH: # No such process

777

raise

1035

self.checker.terminate()

778

1036

self.checker = None

779

1037

780

1038

781

def dbus_service_property(dbus_interface, signature="v",

782

access="readwrite", byte_arrays=False):

1039

def dbus_service_property(dbus_interface,

1040

signature="v",

1041

access="readwrite",

1042

byte_arrays=False):

783

1043

"""Decorators for marking methods of a DBusObjectWithProperties to

784

1044

become properties on the D-Bus.

785

1045

794

1054

# "Set" method, so we fail early here:

795

1055

if byte_arrays and signature != "ay":

796

1056

raise ValueError("Byte arrays not supported for non-'ay'"

797

" signature {0!r}".format(signature))

1057

" signature {!r}".format(signature))

1058

798

1059

def decorator(func):

799

1060

func._dbus_is_property = True

800

1061

func._dbus_interface = dbus_interface

805

1066

func._dbus_name = func._dbus_name[:-14]

806

1067

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

807

1068

return func

1069

808

1070

return decorator

809

1071

810

1072

819

1081

"org.freedesktop.DBus.Property.EmitsChangedSignal":

820

1082

"false"}

821

1083

"""

1084

822

1085

def decorator(func):

823

1086

func._dbus_is_interface = True

824

1087

func._dbus_interface = dbus_interface

825

1088

func._dbus_name = dbus_interface

826

1089

return func

1090

827

1091

return decorator

828

1092

829

1093

831

1095

"""Decorator to annotate D-Bus methods, signals or properties

832

1096

Usage:

833

1097

1098

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1099

"org.freedesktop.DBus.Property."

1100

"EmitsChangedSignal": "false"})

834

1101

@dbus_service_property("org.example.Interface", signature="b",

835

1102

access="r")

836

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

837

"org.freedesktop.DBus.Property."

838

"EmitsChangedSignal": "false"})

839

1103

def Property_dbus_property(self):

840

1104

return dbus.Boolean(False)

1105

1106

See also the DBusObjectWithAnnotations class.

841

1107

"""

1108

842

1109

def decorator(func):

843

1110

func._dbus_annotations = annotations

844

1111

return func

1112

845

1113

return decorator

846

1114

847

1115

848

1116

class DBusPropertyException(dbus.exceptions.DBusException):

849

1117

"""A base class for D-Bus property-related exceptions

850

1118

"""

851

def __unicode__(self):

852

return unicode(str(self))

1119

pass

853

1120

854

1121

855

1122

class DBusPropertyAccessException(DBusPropertyException):

864

1131

pass

865

1132

866

1133

867

class DBusObjectWithProperties(dbus.service.Object):

868

"""A D-Bus object with properties.

1134

class DBusObjectWithAnnotations(dbus.service.Object):

1135

"""A D-Bus object with annotations.

869

1136

870

Classes inheriting from this can use the dbus_service_property

871

decorator to expose methods as D-Bus properties. It exposes the

872

standard Get(), Set(), and GetAll() methods on the D-Bus.

1137

Classes inheriting from this can use the dbus_annotations

1138

decorator to add annotations to methods or signals.

873

1139

"""

874

1140

875

1141

@staticmethod

879

1145

If called like _is_dbus_thing("method") it returns a function

880

1146

suitable for use as predicate to inspect.getmembers().

881

1147

"""

882

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1148

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

883

1149

False)

884

1150

885

1151

def _get_all_dbus_things(self, thing):

886

1152

"""Returns a generator of (name, attribute) pairs

887

1153

"""

888

return ((getattr(athing.__get__(self), "_dbus_name",

889

name),

1154

return ((getattr(athing.__get__(self), "_dbus_name", name),

890

1155

athing.__get__(self))

891

1156

for cls in self.__class__.__mro__

892

1157

for name, athing in

893

inspect.getmembers(cls,

894

self._is_dbus_thing(thing)))

1158

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1159

1160

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1161

out_signature = "s",

1162

path_keyword = 'object_path',

1163

connection_keyword = 'connection')

1164

def Introspect(self, object_path, connection):

1165

"""Overloading of standard D-Bus method.

1166

1167

Inserts annotation tags on methods and signals.

1168

"""

1169

xmlstring = dbus.service.Object.Introspect(self, object_path,

1170

connection)

1171

try:

1172

document = xml.dom.minidom.parseString(xmlstring)

1173

1174

for if_tag in document.getElementsByTagName("interface"):

1175

# Add annotation tags

1176

for typ in ("method", "signal"):

1177

for tag in if_tag.getElementsByTagName(typ):

1178

annots = dict()

1179

for name, prop in (self.

1180

_get_all_dbus_things(typ)):

1181

if (name == tag.getAttribute("name")

1182

and prop._dbus_interface

1183

== if_tag.getAttribute("name")):

1184

annots.update(getattr(

1185

prop, "_dbus_annotations", {}))

1186

for name, value in annots.items():

1187

ann_tag = document.createElement(

1188

"annotation")

1189

ann_tag.setAttribute("name", name)

1190

ann_tag.setAttribute("value", value)

1191

tag.appendChild(ann_tag)

1192

# Add interface annotation tags

1193

for annotation, value in dict(

1194

itertools.chain.from_iterable(

1195

annotations().items()

1196

for name, annotations

1197

in self._get_all_dbus_things("interface")

1198

if name == if_tag.getAttribute("name")

1199

)).items():

1200

ann_tag = document.createElement("annotation")

1201

ann_tag.setAttribute("name", annotation)

1202

ann_tag.setAttribute("value", value)

1203

if_tag.appendChild(ann_tag)

1204

# Fix argument name for the Introspect method itself

1205

if (if_tag.getAttribute("name")

1206

== dbus.INTROSPECTABLE_IFACE):

1207

for cn in if_tag.getElementsByTagName("method"):

1208

if cn.getAttribute("name") == "Introspect":

1209

for arg in cn.getElementsByTagName("arg"):

1210

if (arg.getAttribute("direction")

1211

== "out"):

1212

arg.setAttribute("name",

1213

"xml_data")

1214

xmlstring = document.toxml("utf-8")

1215

document.unlink()

1216

except (AttributeError, xml.dom.DOMException,

1217

xml.parsers.expat.ExpatError) as error:

1218

logger.error("Failed to override Introspection method",

1219

exc_info=error)

1220

return xmlstring

1221

1222

1223

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1224

"""A D-Bus object with properties.

1225

1226

Classes inheriting from this can use the dbus_service_property

1227

decorator to expose methods as D-Bus properties. It exposes the

1228

standard Get(), Set(), and GetAll() methods on the D-Bus.

1229

"""

895

1230

896

1231

def _get_dbus_property(self, interface_name, property_name):

897

1232

"""Returns a bound method if one exists which is a D-Bus

898

1233

property with the specified name and interface.

899

1234

"""

900

for cls in self.__class__.__mro__:

901

for name, value in (inspect.getmembers

902

(cls,

903

self._is_dbus_thing("property"))):

1235

for cls in self.__class__.__mro__:

1236

for name, value in inspect.getmembers(

1237

cls, self._is_dbus_thing("property")):

904

1238

if (value._dbus_name == property_name

905

1239

and value._dbus_interface == interface_name):

906

1240

return value.__get__(self)

907

1241

908

1242

# No such property

909

raise DBusPropertyNotFound(self.dbus_object_path + ":"

910

+ interface_name + "."

911

+ property_name)

912

913

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1243

raise DBusPropertyNotFound("{}:{}.{}".format(

1244

self.dbus_object_path, interface_name, property_name))

1245

1246

@classmethod

1247

def _get_all_interface_names(cls):

1248

"""Get a sequence of all interfaces supported by an object"""

1249

return (name for name in set(getattr(getattr(x, attr),

1250

"_dbus_interface", None)

1251

for x in (inspect.getmro(cls))

1252

for attr in dir(x))

1253

if name is not None)

1254

1255

@dbus.service.method(dbus.PROPERTIES_IFACE,

1256

in_signature="ss",

914

1257

out_signature="v")

915

1258

def Get(self, interface_name, property_name):

916

1259

"""Standard D-Bus property Get() method, see D-Bus standard.

934

1277

# The byte_arrays option is not supported yet on

935

1278

# signatures other than "ay".

936

1279

if prop._dbus_signature != "ay":

937

raise ValueError

1280

raise ValueError("Byte arrays not supported for non-"

1281

"'ay' signature {!r}"

1282

.format(prop._dbus_signature))

938

1283

value = dbus.ByteArray(b''.join(chr(byte)

939

1284

for byte in value))

940

1285

prop(value)

941

1286

942

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1287

@dbus.service.method(dbus.PROPERTIES_IFACE,

1288

in_signature="s",

943

1289

out_signature="a{sv}")

944

1290

def GetAll(self, interface_name):

945

1291

"""Standard D-Bus property GetAll() method, see D-Bus

960

1306

if not hasattr(value, "variant_level"):

961

1307

properties[name] = value

962

1308

continue

963

properties[name] = type(value)(value, variant_level=

964

value.variant_level+1)

1309

properties[name] = type(value)(

1310

value, variant_level = value.variant_level + 1)

965

1311

return dbus.Dictionary(properties, signature="sv")

966

1312

1313

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1314

def PropertiesChanged(self, interface_name, changed_properties,

1315

invalidated_properties):

1316

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1317

standard.

1318

"""

1319

pass

1320

967

1321

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

968

1322

out_signature="s",

969

1323

path_keyword='object_path',

973

1327

974

1328

Inserts property tags and interface annotation tags.

975

1329

"""

976

xmlstring = dbus.service.Object.Introspect(self, object_path,

977

connection)

1330

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1331

object_path,

1332

connection)

978

1333

try:

979

1334

document = xml.dom.minidom.parseString(xmlstring)

1335

980

1336

def make_tag(document, name, prop):

981

1337

e = document.createElement("property")

982

1338

e.setAttribute("name", name)

983

1339

e.setAttribute("type", prop._dbus_signature)

984

1340

e.setAttribute("access", prop._dbus_access)

985

1341

return e

1342

986

1343

for if_tag in document.getElementsByTagName("interface"):

987

1344

# Add property tags

988

1345

for tag in (make_tag(document, name, prop)

991

1348

if prop._dbus_interface

992

1349

== if_tag.getAttribute("name")):

993

1350

if_tag.appendChild(tag)

994

# Add annotation tags

995

for typ in ("method", "signal", "property"):

996

for tag in if_tag.getElementsByTagName(typ):

997

annots = dict()

998

for name, prop in (self.

999

_get_all_dbus_things(typ)):

1000

if (name == tag.getAttribute("name")

1001

and prop._dbus_interface

1002

== if_tag.getAttribute("name")):

1003

annots.update(getattr

1004

(prop,

1005

"_dbus_annotations",

1006

{}))

1007

for name, value in annots.iteritems():

1008

ann_tag = document.createElement(

1009

"annotation")

1010

ann_tag.setAttribute("name", name)

1011

ann_tag.setAttribute("value", value)

1012

tag.appendChild(ann_tag)

1013

# Add interface annotation tags

1014

for annotation, value in dict(

1015

itertools.chain.from_iterable(

1016

annotations().iteritems()

1017

for name, annotations in

1018

self._get_all_dbus_things("interface")

1019

if name == if_tag.getAttribute("name")

1020

)).iteritems():

1021

ann_tag = document.createElement("annotation")

1022

ann_tag.setAttribute("name", annotation)

1023

ann_tag.setAttribute("value", value)

1024

if_tag.appendChild(ann_tag)

1351

# Add annotation tags for properties

1352

for tag in if_tag.getElementsByTagName("property"):

1353

annots = dict()

1354

for name, prop in self._get_all_dbus_things(

1355

"property"):

1356

if (name == tag.getAttribute("name")

1357

and prop._dbus_interface

1358

== if_tag.getAttribute("name")):

1359

annots.update(getattr(

1360

prop, "_dbus_annotations", {}))

1361

for name, value in annots.items():

1362

ann_tag = document.createElement(

1363

"annotation")

1364

ann_tag.setAttribute("name", name)

1365

ann_tag.setAttribute("value", value)

1366

tag.appendChild(ann_tag)

1025

1367

# Add the names to the return values for the

1026

1368

# "org.freedesktop.DBus.Properties" methods

1027

1369

if (if_tag.getAttribute("name")

1045

1387

exc_info=error)

1046

1388

return xmlstring

1047

1389

1390

try:

1391

dbus.OBJECT_MANAGER_IFACE

1392

except AttributeError:

1393

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1394

1395

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1396

"""A D-Bus object with an ObjectManager.

1397

1398

Classes inheriting from this exposes the standard

1399

GetManagedObjects call and the InterfacesAdded and

1400

InterfacesRemoved signals on the standard

1401

"org.freedesktop.DBus.ObjectManager" interface.

1402

1403

Note: No signals are sent automatically; they must be sent

1404

manually.

1405

"""

1406

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1407

out_signature = "a{oa{sa{sv}}}")

1408

def GetManagedObjects(self):

1409

"""This function must be overridden"""

1410

raise NotImplementedError()

1411

1412

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1413

signature = "oa{sa{sv}}")

1414

def InterfacesAdded(self, object_path, interfaces_and_properties):

1415

pass

1416

1417

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1418

def InterfacesRemoved(self, object_path, interfaces):

1419

pass

1420

1421

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1422

out_signature = "s",

1423

path_keyword = 'object_path',

1424

connection_keyword = 'connection')

1425

def Introspect(self, object_path, connection):

1426

"""Overloading of standard D-Bus method.

1427

1428

Override return argument name of GetManagedObjects to be

1429

"objpath_interfaces_and_properties"

1430

"""

1431

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1432

object_path,

1433

connection)

1434

try:

1435

document = xml.dom.minidom.parseString(xmlstring)

1436

1437

for if_tag in document.getElementsByTagName("interface"):

1438

# Fix argument name for the GetManagedObjects method

1439

if (if_tag.getAttribute("name")

1440

== dbus.OBJECT_MANAGER_IFACE):

1441

for cn in if_tag.getElementsByTagName("method"):

1442

if (cn.getAttribute("name")

1443

== "GetManagedObjects"):

1444

for arg in cn.getElementsByTagName("arg"):

1445

if (arg.getAttribute("direction")

1446

== "out"):

1447

arg.setAttribute(

1448

"name",

1449

"objpath_interfaces"

1450

"_and_properties")

1451

xmlstring = document.toxml("utf-8")

1452

document.unlink()

1453

except (AttributeError, xml.dom.DOMException,

1454

xml.parsers.expat.ExpatError) as error:

1455

logger.error("Failed to override Introspection method",

1456

exc_info = error)

1457

return xmlstring

1048

1458

1049

1459

def datetime_to_dbus(dt, variant_level=0):

1050

1460

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1051

1461

if dt is None:

1052

1462

return dbus.String("", variant_level = variant_level)

1053

return dbus.String(dt.isoformat(),

1054

variant_level=variant_level)

1463

return dbus.String(dt.isoformat(), variant_level=variant_level)

1055

1464

1056

1465

1057

1466

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1077

1486

(from DBusObjectWithProperties) and interfaces (from the

1078

1487

dbus_interface_annotations decorator).

1079

1488

"""

1489

1080

1490

def wrapper(cls):

1081

1491

for orig_interface_name, alt_interface_name in (

1082

alt_interface_names.iteritems()):

1492

alt_interface_names.items()):

1083

1493

attr = {}

1084

1494

interface_names = set()

1085

1495

# Go though all attributes of the class

1087

1497

# Ignore non-D-Bus attributes, and D-Bus attributes

1088

1498

# with the wrong interface name

1089

1499

if (not hasattr(attribute, "_dbus_interface")

1090

or not attribute._dbus_interface

1091

.startswith(orig_interface_name)):

1500

or not attribute._dbus_interface.startswith(

1501

orig_interface_name)):

1092

1502

continue

1093

1503

# Create an alternate D-Bus interface name based on

1094

1504

# the current name

1095

alt_interface = (attribute._dbus_interface

1096

.replace(orig_interface_name,

1097

alt_interface_name))

1505

alt_interface = attribute._dbus_interface.replace(

1506

orig_interface_name, alt_interface_name)

1098

1507

interface_names.add(alt_interface)

1099

1508

# Is this a D-Bus signal?

1100

1509

if getattr(attribute, "_dbus_is_signal", False):

1101

# Extract the original non-method undecorated

1102

# function by black magic

1103

nonmethod_func = (dict(

1510

if sys.version_info.major == 2:

1511

# Extract the original non-method undecorated

1512

# function by black magic

1513

nonmethod_func = (dict(

1104

1514

zip(attribute.func_code.co_freevars,

1105

attribute.__closure__))["func"]

1106

.cell_contents)

1515

attribute.__closure__))

1516

["func"].cell_contents)

1517

else:

1518

nonmethod_func = attribute

1107

1519

# Create a new, but exactly alike, function

1108

1520

# object, and decorate it to be a new D-Bus signal

1109

1521

# with the alternate D-Bus interface name

1110

new_function = (dbus.service.signal

1111

(alt_interface,

1112

attribute._dbus_signature)

1113

(types.FunctionType(

1114

nonmethod_func.func_code,

1115

nonmethod_func.func_globals,

1116

nonmethod_func.func_name,

1117

nonmethod_func.func_defaults,

1118

nonmethod_func.func_closure)))

1522

if sys.version_info.major == 2:

1523

new_function = types.FunctionType(

1524

nonmethod_func.func_code,

1525

nonmethod_func.func_globals,

1526

nonmethod_func.func_name,

1527

nonmethod_func.func_defaults,

1528

nonmethod_func.func_closure)

1529

else:

1530

new_function = types.FunctionType(

1531

nonmethod_func.__code__,

1532

nonmethod_func.__globals__,

1533

nonmethod_func.__name__,

1534

nonmethod_func.__defaults__,

1535

nonmethod_func.__closure__)

1536

new_function = (dbus.service.signal(

1537

alt_interface,

1538

attribute._dbus_signature)(new_function))

1119

1539

# Copy annotations, if any

1120

1540

try:

1121

new_function._dbus_annotations = (

1122

dict(attribute._dbus_annotations))

1541

new_function._dbus_annotations = dict(

1542

attribute._dbus_annotations)

1123

1543

except AttributeError:

1124

1544

pass

1125

1545

# Define a creator of a function to call both the

1130

1550

"""This function is a scope container to pass

1131

1551

func1 and func2 to the "call_both" function

1132

1552

outside of its arguments"""

1553

1554

@functools.wraps(func2)

1133

1555

def call_both(*args, **kwargs):

1134

1556

"""This function will emit two D-Bus

1135

1557

signals by calling func1 and func2"""

1136

1558

func1(*args, **kwargs)

1137

1559

func2(*args, **kwargs)

1560

# Make wrapper function look like a D-Bus signal

1561

for name, attr in inspect.getmembers(func2):

1562

if name.startswith("_dbus_"):

1563

setattr(call_both, name, attr)

1564

1138

1565

return call_both

1139

1566

# Create the "call_both" function and add it to

1140

1567

# the class

1145

1572

# object. Decorate it to be a new D-Bus method

1146

1573

# with the alternate D-Bus interface name. Add it

1147

1574

# to the class.

1148

attr[attrname] = (dbus.service.method

1149

(alt_interface,

1150

attribute._dbus_in_signature,

1151

attribute._dbus_out_signature)

1152

(types.FunctionType

1153

(attribute.func_code,

1154

attribute.func_globals,

1155

attribute.func_name,

1156

attribute.func_defaults,

1157

attribute.func_closure)))

1575

attr[attrname] = (

1576

dbus.service.method(

1577

alt_interface,

1578

attribute._dbus_in_signature,

1579

attribute._dbus_out_signature)

1580

(types.FunctionType(attribute.func_code,

1581

attribute.func_globals,

1582

attribute.func_name,

1583

attribute.func_defaults,

1584

attribute.func_closure)))

1158

1585

# Copy annotations, if any

1159

1586

try:

1160

attr[attrname]._dbus_annotations = (

1161

dict(attribute._dbus_annotations))

1587

attr[attrname]._dbus_annotations = dict(

1588

attribute._dbus_annotations)

1162

1589

except AttributeError:

1163

1590

pass

1164

1591

# Is this a D-Bus property?

1167

1594

# object, and decorate it to be a new D-Bus

1168

1595

# property with the alternate D-Bus interface

1169

1596

# name. Add it to the class.

1170

attr[attrname] = (dbus_service_property

1171

(alt_interface,

1172

attribute._dbus_signature,

1173

attribute._dbus_access,

1174

attribute

1175

._dbus_get_args_options

1176

["byte_arrays"])

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1597

attr[attrname] = (dbus_service_property(

1598

alt_interface, attribute._dbus_signature,

1599

attribute._dbus_access,

1600

attribute._dbus_get_args_options

1601

["byte_arrays"])

1602

(types.FunctionType(

1603

attribute.func_code,

1604

attribute.func_globals,

1605

attribute.func_name,

1606

attribute.func_defaults,

1607

attribute.func_closure)))

1183

1608

# Copy annotations, if any

1184

1609

try:

1185

attr[attrname]._dbus_annotations = (

1186

dict(attribute._dbus_annotations))

1610

attr[attrname]._dbus_annotations = dict(

1611

attribute._dbus_annotations)

1187

1612

except AttributeError:

1188

1613

pass

1189

1614

# Is this a D-Bus interface?

1192

1617

# object. Decorate it to be a new D-Bus interface

1193

1618

# with the alternate D-Bus interface name. Add it

1194

1619

# to the class.

1195

attr[attrname] = (dbus_interface_annotations

1196

(alt_interface)

1197

(types.FunctionType

1198

(attribute.func_code,

1199

attribute.func_globals,

1200

attribute.func_name,

1201

attribute.func_defaults,

1202

attribute.func_closure)))

1620

attr[attrname] = (

1621

dbus_interface_annotations(alt_interface)

1622

(types.FunctionType(attribute.func_code,

1623

attribute.func_globals,

1624

attribute.func_name,

1625

attribute.func_defaults,

1626

attribute.func_closure)))

1203

1627

if deprecate:

1204

1628

# Deprecate all alternate interfaces

1205

iname="_AlternateDBusNames_interface_annotation{0}"

1629

iname="_AlternateDBusNames_interface_annotation{}"

1206

1630

for interface_name in interface_names:

1631

1207

1632

@dbus_interface_annotations(interface_name)

1208

1633

def func(self):

1209

1634

return { "org.freedesktop.DBus.Deprecated":

1210

"true" }

1635

"true" }

1211

1636

# Find an unused name

1212

1637

for aname in (iname.format(i)

1213

1638

for i in itertools.count()):

1217

1642

if interface_names:

1218

1643

# Replace the class with a new subclass of it with

1219

1644

# methods, signals, etc. as created above.

1220

cls = type(b"{0}Alternate".format(cls.__name__),

1221

(cls,), attr)

1645

cls = type(b"{}Alternate".format(cls.__name__),

1646

(cls, ), attr)

1222

1647

return cls

1648

1223

1649

return wrapper

1224

1650

1225

1651

1226

1652

@alternate_dbus_interfaces({"se.recompile.Mandos":

1227

"se.bsnet.fukt.Mandos"})

1653

"se.bsnet.fukt.Mandos"})

1228

1654

class ClientDBus(Client, DBusObjectWithProperties):

1229

1655

"""A Client class using D-Bus

1230

1656

1234

1660

"""

1235

1661

1236

1662

runtime_expansions = (Client.runtime_expansions

1237

+ ("dbus_object_path",))

1663

+ ("dbus_object_path", ))

1664

1665

_interface = "se.recompile.Mandos.Client"

1238

1666

1239

1667

# dbus.service.Object doesn't use super(), so we can't either.

1240

1668

1243

1671

Client.__init__(self, *args, **kwargs)

1244

1672

# Only now, when this client is initialized, can it show up on

1245

1673

# the D-Bus

1246

client_object_name = unicode(self.name).translate(

1674

client_object_name = str(self.name).translate(

1247

1675

{ord("."): ord("_"),

1248

1676

ord("-"): ord("_")})

1249

self.dbus_object_path = (dbus.ObjectPath

1250

("/clients/" + client_object_name))

1677

self.dbus_object_path = dbus.ObjectPath(

1678

"/clients/" + client_object_name)

1251

1679

DBusObjectWithProperties.__init__(self, self.bus,

1252

1680

self.dbus_object_path)

1253

1681

1254

def notifychangeproperty(transform_func,

1255

dbus_name, type_func=lambda x: x,

1256

variant_level=1):

1682

def notifychangeproperty(transform_func, dbus_name,

1683

type_func=lambda x: x,

1684

variant_level=1,

1685

invalidate_only=False,

1686

_interface=_interface):

1257

1687

""" Modify a variable so that it's a property which announces

1258

1688

its changes to DBus.

1259

1689

1264

1694

to the D-Bus. Default: no transform

1265

1695

variant_level: D-Bus variant level. Default: 1

1266

1696

"""

1267

attrname = "_{0}".format(dbus_name)

1697

attrname = "_{}".format(dbus_name)

1698

1268

1699

def setter(self, value):

1269

1700

if hasattr(self, "dbus_object_path"):

1270

1701

if (not hasattr(self, attrname) or

1271

1702

type_func(getattr(self, attrname, None))

1272

1703

!= type_func(value)):

1273

dbus_value = transform_func(type_func(value),

1274

variant_level

1275

=variant_level)

1276

self.PropertyChanged(dbus.String(dbus_name),

1277

dbus_value)

1704

if invalidate_only:

1705

self.PropertiesChanged(

1706

_interface, dbus.Dictionary(),

1707

dbus.Array((dbus_name, )))

1708

else:

1709

dbus_value = transform_func(

1710

type_func(value),

1711

variant_level = variant_level)

1712

self.PropertyChanged(dbus.String(dbus_name),

1713

dbus_value)

1714

self.PropertiesChanged(

1715

_interface,

1716

dbus.Dictionary({ dbus.String(dbus_name):

1717

dbus_value }),

1718

dbus.Array())

1278

1719

setattr(self, attrname, value)

1279

1720

1280

1721

return property(lambda self: getattr(self, attrname), setter)

1286

1727

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1287

1728

last_enabled = notifychangeproperty(datetime_to_dbus,

1288

1729

"LastEnabled")

1289

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1290

type_func = lambda checker:

1291

checker is not None)

1730

checker = notifychangeproperty(

1731

dbus.Boolean, "CheckerRunning",

1732

type_func = lambda checker: checker is not None)

1292

1733

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1293

1734

"LastCheckedOK")

1294

1735

last_checker_status = notifychangeproperty(dbus.Int16,

1297

1738

datetime_to_dbus, "LastApprovalRequest")

1298

1739

approved_by_default = notifychangeproperty(dbus.Boolean,

1299

1740

"ApprovedByDefault")

1300

approval_delay = notifychangeproperty(dbus.UInt64,

1301

"ApprovalDelay",

1302

type_func =

1303

timedelta_to_milliseconds)

1741

approval_delay = notifychangeproperty(

1742

dbus.UInt64, "ApprovalDelay",

1743

type_func = lambda td: td.total_seconds() * 1000)

1304

1744

approval_duration = notifychangeproperty(

1305

1745

dbus.UInt64, "ApprovalDuration",

1306

type_func = timedelta_to_milliseconds)

1746

type_func = lambda td: td.total_seconds() * 1000)

1307

1747

host = notifychangeproperty(dbus.String, "Host")

1308

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1309

type_func =

1310

timedelta_to_milliseconds)

1748

timeout = notifychangeproperty(

1749

dbus.UInt64, "Timeout",

1750

type_func = lambda td: td.total_seconds() * 1000)

1311

1751

extended_timeout = notifychangeproperty(

1312

1752

dbus.UInt64, "ExtendedTimeout",

1313

type_func = timedelta_to_milliseconds)

1314

interval = notifychangeproperty(dbus.UInt64,

1315

"Interval",

1316

type_func =

1317

timedelta_to_milliseconds)

1753

type_func = lambda td: td.total_seconds() * 1000)

1754

interval = notifychangeproperty(

1755

dbus.UInt64, "Interval",

1756

type_func = lambda td: td.total_seconds() * 1000)

1318

1757

checker_command = notifychangeproperty(dbus.String, "Checker")

1758

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1759

invalidate_only=True)

1319

1760

1320

1761

del notifychangeproperty

1321

1762

1328

1769

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1329

1770

Client.__del__(self, *args, **kwargs)

1330

1771

1331

def checker_callback(self, pid, condition, command,

1332

*args, **kwargs):

1333

self.checker_callback_tag = None

1334

self.checker = None

1335

if os.WIFEXITED(condition):

1336

exitstatus = os.WEXITSTATUS(condition)

1772

def checker_callback(self, source, condition,

1773

connection, command, *args, **kwargs):

1774

ret = Client.checker_callback(self, source, condition,

1775

connection, command, *args,

1776

**kwargs)

1777

exitstatus = self.last_checker_status

1778

if exitstatus >= 0:

1337

1779

# Emit D-Bus signal

1338

1780

self.CheckerCompleted(dbus.Int16(exitstatus),

1339

dbus.Int64(condition),

1781

# This is specific to GNU libC

1782

dbus.Int64(exitstatus << 8),

1340

1783

dbus.String(command))

1341

1784

else:

1342

1785

# Emit D-Bus signal

1343

1786

self.CheckerCompleted(dbus.Int16(-1),

1344

dbus.Int64(condition),

1787

dbus.Int64(

1788

# This is specific to GNU libC

1789

(exitstatus << 8)

1790

| self.last_checker_signal),

1345

1791

dbus.String(command))

1346

1347

return Client.checker_callback(self, pid, condition, command,

1348

*args, **kwargs)

1792

return ret

1349

1793

1350

1794

def start_checker(self, *args, **kwargs):

1351

old_checker = self.checker

1352

if self.checker is not None:

1353

old_checker_pid = self.checker.pid

1354

else:

1355

old_checker_pid = None

1795

old_checker_pid = getattr(self.checker, "pid", None)

1356

1796

r = Client.start_checker(self, *args, **kwargs)

1357

1797

# Only if new checker process was started

1358

1798

if (self.checker is not None

1367

1807

1368

1808

def approve(self, value=True):

1369

1809

self.approved = value

1370

gobject.timeout_add(timedelta_to_milliseconds

1371

(self.approval_duration),

1372

self._reset_approved)

1810

gobject.timeout_add(int(self.approval_duration.total_seconds()

1811

* 1000), self._reset_approved)

1373

1812

self.send_changedstate()

1374

1813

1375

1814

## D-Bus methods, signals & properties

1376

_interface = "se.recompile.Mandos.Client"

1377

1815

1378

1816

## Interfaces

1379

1817

1380

@dbus_interface_annotations(_interface)

1381

def _foo(self):

1382

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1383

"false"}

1384

1385

1818

## Signals

1386

1819

1387

1820

# CheckerCompleted - signal

1397

1830

pass

1398

1831

1399

1832

# PropertyChanged - signal

1833

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1400

1834

@dbus.service.signal(_interface, signature="sv")

1401

1835

def PropertyChanged(self, property, value):

1402

1836

"D-Bus signal"

1436

1870

self.checked_ok()

1437

1871

1438

1872

# Enable - method

1873

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1439

1874

@dbus.service.method(_interface)

1440

1875

def Enable(self):

1441

1876

"D-Bus method"

1442

1877

self.enable()

1443

1878

1444

1879

# StartChecker - method

1880

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1445

1881

@dbus.service.method(_interface)

1446

1882

def StartChecker(self):

1447

1883

"D-Bus method"

1448

1884

self.start_checker()

1449

1885

1450

1886

# Disable - method

1887

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1451

1888

@dbus.service.method(_interface)

1452

1889

def Disable(self):

1453

1890

"D-Bus method"

1454

1891

self.disable()

1455

1892

1456

1893

# StopChecker - method

1894

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1457

1895

@dbus.service.method(_interface)

1458

1896

def StopChecker(self):

1459

1897

self.stop_checker()

1466

1904

return dbus.Boolean(bool(self.approvals_pending))

1467

1905

1468

1906

# ApprovedByDefault - property

1469

@dbus_service_property(_interface, signature="b",

1907

@dbus_service_property(_interface,

1908

signature="b",

1470

1909

access="readwrite")

1471

1910

def ApprovedByDefault_dbus_property(self, value=None):

1472

1911

if value is None: # get

1474

1913

self.approved_by_default = bool(value)

1475

1914

1476

1915

# ApprovalDelay - property

1477

@dbus_service_property(_interface, signature="t",

1916

@dbus_service_property(_interface,

1917

signature="t",

1478

1918

access="readwrite")

1479

1919

def ApprovalDelay_dbus_property(self, value=None):

1480

1920

if value is None: # get

1481

return dbus.UInt64(self.approval_delay_milliseconds())

1921

return dbus.UInt64(self.approval_delay.total_seconds()

1922

* 1000)

1482

1923

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1483

1924

1484

1925

# ApprovalDuration - property

1485

@dbus_service_property(_interface, signature="t",

1926

@dbus_service_property(_interface,

1927

signature="t",

1486

1928

access="readwrite")

1487

1929

def ApprovalDuration_dbus_property(self, value=None):

1488

1930

if value is None: # get

1489

return dbus.UInt64(timedelta_to_milliseconds(

1490

self.approval_duration))

1931

return dbus.UInt64(self.approval_duration.total_seconds()

1932

* 1000)

1491

1933

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1492

1934

1493

1935

# Name - property

1936

@dbus_annotations(

1937

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1494

1938

@dbus_service_property(_interface, signature="s", access="read")

1495

1939

def Name_dbus_property(self):

1496

1940

return dbus.String(self.name)

1497

1941

1498

1942

# Fingerprint - property

1943

@dbus_annotations(

1944

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1499

1945

@dbus_service_property(_interface, signature="s", access="read")

1500

1946

def Fingerprint_dbus_property(self):

1501

1947

return dbus.String(self.fingerprint)

1502

1948

1503

1949

# Host - property

1504

@dbus_service_property(_interface, signature="s",

1950

@dbus_service_property(_interface,

1951

signature="s",

1505

1952

access="readwrite")

1506

1953

def Host_dbus_property(self, value=None):

1507

1954

if value is None: # get

1508

1955

return dbus.String(self.host)

1509

self.host = unicode(value)

1956

self.host = str(value)

1510

1957

1511

1958

# Created - property

1959

@dbus_annotations(

1960

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1512

1961

@dbus_service_property(_interface, signature="s", access="read")

1513

1962

def Created_dbus_property(self):

1514

1963

return datetime_to_dbus(self.created)

1519

1968

return datetime_to_dbus(self.last_enabled)

1520

1969

1521

1970

# Enabled - property

1522

@dbus_service_property(_interface, signature="b",

1971

@dbus_service_property(_interface,

1972

signature="b",

1523

1973

access="readwrite")

1524

1974

def Enabled_dbus_property(self, value=None):

1525

1975

if value is None: # get

1530

1980

self.disable()

1531

1981

1532

1982

# LastCheckedOK - property

1533

@dbus_service_property(_interface, signature="s",

1983

@dbus_service_property(_interface,

1984

signature="s",

1534

1985

access="readwrite")

1535

1986

def LastCheckedOK_dbus_property(self, value=None):

1536

1987

if value is not None:

1539

1990

return datetime_to_dbus(self.last_checked_ok)

1540

1991

1541

1992

# LastCheckerStatus - property

1542

@dbus_service_property(_interface, signature="n",

1543

access="read")

1993

@dbus_service_property(_interface, signature="n", access="read")

1544

1994

def LastCheckerStatus_dbus_property(self):

1545

1995

return dbus.Int16(self.last_checker_status)

1546

1996

1555

2005

return datetime_to_dbus(self.last_approval_request)

1556

2006

1557

2007

# Timeout - property

1558

@dbus_service_property(_interface, signature="t",

2008

@dbus_service_property(_interface,

2009

signature="t",

1559

2010

access="readwrite")

1560

2011

def Timeout_dbus_property(self, value=None):

1561

2012

if value is None: # get

1562

return dbus.UInt64(self.timeout_milliseconds())

2013

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1563

2014

old_timeout = self.timeout

1564

2015

self.timeout = datetime.timedelta(0, 0, 0, value)

1565

2016

# Reschedule disabling

1574

2025

is None):

1575

2026

return

1576

2027

gobject.source_remove(self.disable_initiator_tag)

1577

self.disable_initiator_tag = (

1578

gobject.timeout_add(

1579

timedelta_to_milliseconds(self.expires - now),

1580

self.disable))

2028

self.disable_initiator_tag = gobject.timeout_add(

2029

int((self.expires - now).total_seconds() * 1000),

2030

self.disable)

1581

2031

1582

2032

# ExtendedTimeout - property

1583

@dbus_service_property(_interface, signature="t",

2033

@dbus_service_property(_interface,

2034

signature="t",

1584

2035

access="readwrite")

1585

2036

def ExtendedTimeout_dbus_property(self, value=None):

1586

2037

if value is None: # get

1587

return dbus.UInt64(self.extended_timeout_milliseconds())

2038

return dbus.UInt64(self.extended_timeout.total_seconds()

2039

* 1000)

1588

2040

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1589

2041

1590

2042

# Interval - property

1591

@dbus_service_property(_interface, signature="t",

2043

@dbus_service_property(_interface,

2044

signature="t",

1592

2045

access="readwrite")

1593

2046

def Interval_dbus_property(self, value=None):

1594

2047

if value is None: # get

1595

return dbus.UInt64(self.interval_milliseconds())

2048

return dbus.UInt64(self.interval.total_seconds() * 1000)

1596

2049

self.interval = datetime.timedelta(0, 0, 0, value)

1597

2050

if getattr(self, "checker_initiator_tag", None) is None:

1598

2051

return

1599

2052

if self.enabled:

1600

2053

# Reschedule checker run

1601

2054

gobject.source_remove(self.checker_initiator_tag)

1602

self.checker_initiator_tag = (gobject.timeout_add

1603

(value, self.start_checker))

1604

self.start_checker() # Start one now, too

2055

self.checker_initiator_tag = gobject.timeout_add(

2056

value, self.start_checker)

2057

self.start_checker() # Start one now, too

1605

2058

1606

2059

# Checker - property

1607

@dbus_service_property(_interface, signature="s",

2060

@dbus_service_property(_interface,

2061

signature="s",

1608

2062

access="readwrite")

1609

2063

def Checker_dbus_property(self, value=None):

1610

2064

if value is None: # get

1611

2065

return dbus.String(self.checker_command)

1612

self.checker_command = unicode(value)

2066

self.checker_command = str(value)

1613

2067

1614

2068

# CheckerRunning - property

1615

@dbus_service_property(_interface, signature="b",

2069

@dbus_service_property(_interface,

2070

signature="b",

1616

2071

access="readwrite")

1617

2072

def CheckerRunning_dbus_property(self, value=None):

1618

2073

if value is None: # get

1623

2078

self.stop_checker()

1624

2079

1625

2080

# ObjectPath - property

2081

@dbus_annotations(

2082

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2083

"org.freedesktop.DBus.Deprecated": "true"})

1626

2084

@dbus_service_property(_interface, signature="o", access="read")

1627

2085

def ObjectPath_dbus_property(self):

1628

2086

return self.dbus_object_path # is already a dbus.ObjectPath

1629

2087

1630

2088

# Secret = property

1631

@dbus_service_property(_interface, signature="ay",

1632

access="write", byte_arrays=True)

2089

@dbus_annotations(

2090

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2091

"invalidates"})

2092

@dbus_service_property(_interface,

2093

signature="ay",

2094

access="write",

2095

byte_arrays=True)

1633

2096

def Secret_dbus_property(self, value):

1634

self.secret = str(value)

2097

self.secret = bytes(value)

1635

2098

1636

2099

del _interface

1637

2100

1641

2104

self._pipe = child_pipe

1642

2105

self._pipe.send(('init', fpr, address))

1643

2106

if not self._pipe.recv():

1644

raise KeyError()

2107

raise KeyError(fpr)

1645

2108

1646

2109

def __getattribute__(self, name):

1647

2110

if name == '_pipe':

1651

2114

if data[0] == 'data':

1652

2115

return data[1]

1653

2116

if data[0] == 'function':

2117

1654

2118

def func(*args, **kwargs):

1655

2119

self._pipe.send(('funcall', name, args, kwargs))

1656

2120

return self._pipe.recv()[1]

2121

1657

2122

return func

1658

2123

1659

2124

def __setattr__(self, name, value):

1671

2136

def handle(self):

1672

2137

with contextlib.closing(self.server.child_pipe) as child_pipe:

1673

2138

logger.info("TCP connection from: %s",

1674

unicode(self.client_address))

2139

str(self.client_address))

1675

2140

logger.debug("Pipe FD: %d",

1676

2141

self.server.child_pipe.fileno())

1677

2142

1678

session = (gnutls.connection

1679

.ClientSession(self.request,

1680

gnutls.connection

1681

.X509Credentials()))

1682

1683

# Note: gnutls.connection.X509Credentials is really a

1684

# generic GnuTLS certificate credentials object so long as

1685

# no X.509 keys are added to it. Therefore, we can use it

1686

# here despite using OpenPGP certificates.

2143

session = gnutls.ClientSession(self.request)

1687

2144

1688

2145

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1689

2146

# "+AES-256-CBC", "+SHA1",

1693

2150

priority = self.server.gnutls_priority

1694

2151

if priority is None:

1695

2152

priority = "NORMAL"

1696

(gnutls.library.functions

1697

.gnutls_priority_set_direct(session._c_object,

1698

priority, None))

2153

gnutls.priority_set_direct(session._c_object, priority,

2154

None)

1699

2155

1700

2156

# Start communication using the Mandos protocol

1701

2157

# Get protocol number

1711

2167

# Start GnuTLS connection

1712

2168

try:

1713

2169

session.handshake()

1714

except gnutls.errors.GNUTLSError as error:

2170

except gnutls.Error as error:

1715

2171

logger.warning("Handshake failed: %s", error)

1716

2172

# Do not run session.bye() here: the session is not

1717

2173

# established. Just abandon the request.

1721

2177

approval_required = False

1722

2178

try:

1723

2179

try:

1724

fpr = self.fingerprint(self.peer_certificate

1725

(session))

1726

except (TypeError,

1727

gnutls.errors.GNUTLSError) as error:

2180

fpr = self.fingerprint(

2181

self.peer_certificate(session))

2182

except (TypeError, gnutls.Error) as error:

1728

2183

logger.warning("Bad certificate: %s", error)

1729

2184

return

1730

2185

logger.debug("Fingerprint: %s", fpr)

1743

2198

while True:

1744

2199

if not client.enabled:

1745

2200

logger.info("Client %s is disabled",

1746

client.name)

2201

client.name)

1747

2202

if self.server.use_dbus:

1748

2203

# Emit D-Bus signal

1749

2204

client.Rejected("Disabled")

1758

2213

if self.server.use_dbus:

1759

2214

# Emit D-Bus signal

1760

2215

client.NeedApproval(

1761

client.approval_delay_milliseconds(),

1762

client.approved_by_default)

2216

client.approval_delay.total_seconds()

2217

* 1000, client.approved_by_default)

1763

2218

else:

1764

2219

logger.warning("Client %s was not approved",

1765

2220

client.name)

1771

2226

#wait until timeout or approved

1772

2227

time = datetime.datetime.now()

1773

2228

client.changedstate.acquire()

1774

client.changedstate.wait(

1775

float(timedelta_to_milliseconds(delay)

1776

/ 1000))

2229

client.changedstate.wait(delay.total_seconds())

1777

2230

client.changedstate.release()

1778

2231

time2 = datetime.datetime.now()

1779

2232

if (time2 - time) >= delay:

1790

2243

else:

1791

2244

delay -= time2 - time

1792

2245

1793

sent_size = 0

1794

while sent_size < len(client.secret):

1795

try:

1796

sent = session.send(client.secret[sent_size:])

1797

except gnutls.errors.GNUTLSError as error:

1798

logger.warning("gnutls send failed",

1799

exc_info=error)

1800

return

1801

logger.debug("Sent: %d, remaining: %d",

1802

sent, len(client.secret)

1803

- (sent_size + sent))

1804

sent_size += sent

2246

try:

2247

session.send(client.secret)

2248

except gnutls.Error as error:

2249

logger.warning("gnutls send failed",

2250

exc_info = error)

2251

return

1805

2252

1806

2253

logger.info("Sending secret to %s", client.name)

1807

2254

# bump the timeout using extended_timeout

1815

2262

client.approvals_pending -= 1

1816

2263

try:

1817

2264

session.bye()

1818

except gnutls.errors.GNUTLSError as error:

2265

except gnutls.Error as error:

1819

2266

logger.warning("GnuTLS bye failed",

1820

2267

exc_info=error)

1821

2268

1823

2270

def peer_certificate(session):

1824

2271

"Return the peer's OpenPGP certificate as a bytestring"

1825

2272

# If not an OpenPGP certificate...

1826

if (gnutls.library.functions

1827

.gnutls_certificate_type_get(session._c_object)

1828

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1829

# ...do the normal thing

1830

return session.peer_certificate

2273

if (gnutls.certificate_type_get(session._c_object)

2274

!= gnutls.CRT_OPENPGP):

2275

# ...return invalid data

2276

return b""

1831

2277

list_size = ctypes.c_uint(1)

1832

cert_list = (gnutls.library.functions

1833

.gnutls_certificate_get_peers

2278

cert_list = (gnutls.certificate_get_peers

1834

2279

(session._c_object, ctypes.byref(list_size)))

1835

2280

if not bool(cert_list) and list_size.value != 0:

1836

raise gnutls.errors.GNUTLSError("error getting peer"

1837

" certificate")

2281

raise gnutls.Error("error getting peer certificate")

1838

2282

if list_size.value == 0:

1839

2283

return None

1840

2284

cert = cert_list[0]

1844

2288

def fingerprint(openpgp):

1845

2289

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1846

2290

# New GnuTLS "datum" with the OpenPGP public key

1847

datum = (gnutls.library.types

1848

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1849

ctypes.POINTER

1850

(ctypes.c_ubyte)),

1851

ctypes.c_uint(len(openpgp))))

2291

datum = gnutls.datum_t(

2292

ctypes.cast(ctypes.c_char_p(openpgp),

2293

ctypes.POINTER(ctypes.c_ubyte)),

2294

ctypes.c_uint(len(openpgp)))

1852

2295

# New empty GnuTLS certificate

1853

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2296

crt = gnutls.openpgp_crt_t()

2297

gnutls.openpgp_crt_init(ctypes.byref(crt))

1856

2298

# Import the OpenPGP public key into the certificate

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1859

gnutls.library.constants

1860

.GNUTLS_OPENPGP_FMT_RAW))

2299

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2300

gnutls.OPENPGP_FMT_RAW)

1861

2301

# Verify the self signature in the key

1862

2302

crtverify = ctypes.c_uint()

1863

(gnutls.library.functions

1864

.gnutls_openpgp_crt_verify_self(crt, 0,

1865

ctypes.byref(crtverify)))

2303

gnutls.openpgp_crt_verify_self(crt, 0,

2304

ctypes.byref(crtverify))

1866

2305

if crtverify.value != 0:

1867

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1868

raise (gnutls.errors.CertificateSecurityError

1869

("Verify failed"))

2306

gnutls.openpgp_crt_deinit(crt)

2307

raise gnutls.CertificateSecurityError("Verify failed")

1870

2308

# New buffer for the fingerprint

1871

2309

buf = ctypes.create_string_buffer(20)

1872

2310

buf_len = ctypes.c_size_t()

1873

2311

# Get the fingerprint from the certificate into the buffer

1874

(gnutls.library.functions

1875

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1876

ctypes.byref(buf_len)))

2312

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2313

ctypes.byref(buf_len))

1877

2314

# Deinit the certificate

1878

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2315

gnutls.openpgp_crt_deinit(crt)

1879

2316

# Convert the buffer to a Python bytestring

1880

2317

fpr = ctypes.string_at(buf, buf_len.value)

1881

2318

# Convert the bytestring to hexadecimal notation

1885

2322

1886

2323

class MultiprocessingMixIn(object):

1887

2324

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2325

1888

2326

def sub_process_main(self, request, address):

1889

2327

try:

1890

2328

self.finish_request(request, address)

1902

2340

1903

2341

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1904

2342

""" adds a pipe to the MixIn """

2343

1905

2344

def process_request(self, request, client_address):

1906

2345

"""Overrides and wraps the original process_request().

1907

2346

1928

2367

interface: None or a network interface name (string)

1929

2368

use_ipv6: Boolean; to use IPv6 or not

1930

2369

"""

2370

1931

2371

def __init__(self, server_address, RequestHandlerClass,

1932

interface=None, use_ipv6=True, socketfd=None):

2372

interface=None,

2373

use_ipv6=True,

2374

socketfd=None):

1933

2375

"""If socketfd is set, use that file descriptor instead of

1934

2376

creating a new one with socket.socket().

1935

2377

"""

1976

2418

self.interface)

1977

2419

else:

1978

2420

try:

1979

self.socket.setsockopt(socket.SOL_SOCKET,

1980

SO_BINDTODEVICE,

1981

str(self.interface + '\0'))

2421

self.socket.setsockopt(

2422

socket.SOL_SOCKET, SO_BINDTODEVICE,

2423

(self.interface + "\0").encode("utf-8"))

1982

2424

except socket.error as error:

1983

2425

if error.errno == errno.EPERM:

1984

2426

logger.error("No permission to bind to"

2002

2444

self.server_address = (any_address,

2003

2445

self.server_address[1])

2004

2446

elif not self.server_address[1]:

2005

self.server_address = (self.server_address[0],

2006

0)

2447

self.server_address = (self.server_address[0], 0)

2007

2448

# if self.interface:

2008

2449

# self.server_address = (self.server_address[0],

2009

2450

# 0, # port

2023

2464

2024

2465

Assumes a gobject.MainLoop event loop.

2025

2466

"""

2467

2026

2468

def __init__(self, server_address, RequestHandlerClass,

2027

interface=None, use_ipv6=True, clients=None,

2028

gnutls_priority=None, use_dbus=True, socketfd=None):

2469

interface=None,

2470

use_ipv6=True,

2471

clients=None,

2472

gnutls_priority=None,

2473

use_dbus=True,

2474

socketfd=None):

2029

2475

self.enabled = False

2030

2476

self.clients = clients

2031

2477

if self.clients is None:

2037

2483

interface = interface,

2038

2484

use_ipv6 = use_ipv6,

2039

2485

socketfd = socketfd)

2486

2040

2487

def server_activate(self):

2041

2488

if self.enabled:

2042

2489

return socketserver.TCPServer.server_activate(self)

2046

2493

2047

2494

def add_pipe(self, parent_pipe, proc):

2048

2495

# Call "handle_ipc" for both data and EOF events

2049

gobject.io_add_watch(parent_pipe.fileno(),

2050

gobject.IO_IN | gobject.IO_HUP,

2051

functools.partial(self.handle_ipc,

2052

parent_pipe =

2053

parent_pipe,

2054

proc = proc))

2496

gobject.io_add_watch(

2497

parent_pipe.fileno(),

2498

gobject.IO_IN | gobject.IO_HUP,

2499

functools.partial(self.handle_ipc,

2500

parent_pipe = parent_pipe,

2501

proc = proc))

2055

2502

2056

def handle_ipc(self, source, condition, parent_pipe=None,

2057

proc = None, client_object=None):

2503

def handle_ipc(self, source, condition,

2504

parent_pipe=None,

2505

proc = None,

2506

client_object=None):

2058

2507

# error, or the other end of multiprocessing.Pipe has closed

2059

2508

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2060

2509

# Wait for other process to exit

2083

2532

parent_pipe.send(False)

2084

2533

return False

2085

2534

2086

gobject.io_add_watch(parent_pipe.fileno(),

2087

gobject.IO_IN | gobject.IO_HUP,

2088

functools.partial(self.handle_ipc,

2089

parent_pipe =

2090

parent_pipe,

2091

proc = proc,

2092

client_object =

2093

client))

2535

gobject.io_add_watch(

2536

parent_pipe.fileno(),

2537

gobject.IO_IN | gobject.IO_HUP,

2538

functools.partial(self.handle_ipc,

2539

parent_pipe = parent_pipe,

2540

proc = proc,

2541

client_object = client))

2094

2542

parent_pipe.send(True)

2095

2543

# remove the old hook in favor of the new above hook on

2096

2544

# same fileno

2102

2550

2103

2551

parent_pipe.send(('data', getattr(client_object,

2104

2552

funcname)(*args,

2105

**kwargs)))

2553

**kwargs)))

2106

2554

2107

2555

if command == 'getattr':

2108

2556

attrname = request[1]

2109

if callable(client_object.__getattribute__(attrname)):

2110

parent_pipe.send(('function',))

2557

if isinstance(client_object.__getattribute__(attrname),

2558

collections.Callable):

2559

parent_pipe.send(('function', ))

2111

2560

else:

2112

parent_pipe.send(('data', client_object

2113

.__getattribute__(attrname)))

2561

parent_pipe.send((

2562

'data', client_object.__getattribute__(attrname)))

2114

2563

2115

2564

if command == 'setattr':

2116

2565

attrname = request[1]

2147

2596

# avoid excessive use of external libraries.

2148

2597

2149

2598

# New type for defining tokens, syntax, and semantics all-in-one

2150

Token = collections.namedtuple("Token",

2151

("regexp", # To match token; if

2152

# "value" is not None,

2153

# must have a "group"

2154

# containing digits

2155

"value", # datetime.timedelta or

2156

# None

2157

"followers")) # Tokens valid after

2158

# this token

2599

Token = collections.namedtuple("Token", (

2600

"regexp", # To match token; if "value" is not None, must have

2601

# a "group" containing digits

2602

"value", # datetime.timedelta or None

2603

"followers")) # Tokens valid after this token

2159

2604

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2160

2605

# the "duration" ABNF definition in RFC 3339, Appendix A.

2161

2606

token_end = Token(re.compile(r"$"), None, frozenset())

2162

2607

token_second = Token(re.compile(r"(\d+)S"),

2163

2608

datetime.timedelta(seconds=1),

2164

frozenset((token_end,)))

2609

frozenset((token_end, )))

2165

2610

token_minute = Token(re.compile(r"(\d+)M"),

2166

2611

datetime.timedelta(minutes=1),

2167

2612

frozenset((token_second, token_end)))

2183

2628

frozenset((token_month, token_end)))

2184

2629

token_week = Token(re.compile(r"(\d+)W"),

2185

2630

datetime.timedelta(weeks=1),

2186

frozenset((token_end,)))

2631

frozenset((token_end, )))

2187

2632

token_duration = Token(re.compile(r"P"), None,

2188

2633

frozenset((token_year, token_month,

2189

2634

token_day, token_time,

2190

token_week))),

2635

token_week)))

2191

2636

# Define starting values

2192

2637

value = datetime.timedelta() # Value so far

2193

2638

found_token = None

2194

followers = frozenset(token_duration,) # Following valid tokens

2639

followers = frozenset((token_duration, )) # Following valid tokens

2195

2640

s = duration # String left to parse

2196

2641

# Loop until end token is found

2197

2642

while found_token is not token_end:

2214

2659

break

2215

2660

else:

2216

2661

# No currently valid tokens were found

2217

raise ValueError("Invalid RFC 3339 duration")

2662

raise ValueError("Invalid RFC 3339 duration: {!r}"

2663

.format(duration))

2218

2664

# End token found

2219

2665

return value

2220

2666

2244

2690

timevalue = datetime.timedelta(0)

2245

2691

for s in interval.split():

2246

2692

try:

2247

suffix = unicode(s[-1])

2693

suffix = s[-1]

2248

2694

value = int(s[:-1])

2249

2695

if suffix == "d":

2250

2696

delta = datetime.timedelta(value)

2257

2703

elif suffix == "w":

2258

2704

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2259

2705

else:

2260

raise ValueError("Unknown suffix {0!r}"

2261

.format(suffix))

2706

raise ValueError("Unknown suffix {!r}".format(suffix))

2262

2707

except IndexError as e:

2263

2708

raise ValueError(*(e.args))

2264

2709

timevalue += delta

2281

2726

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2282

2727

if not stat.S_ISCHR(os.fstat(null).st_mode):

2283

2728

raise OSError(errno.ENODEV,

2284

"{0} not a character device"

2729

"{} not a character device"

2285

2730

.format(os.devnull))

2286

2731

os.dup2(null, sys.stdin.fileno())

2287

2732

os.dup2(null, sys.stdout.fileno())

2297

2742

2298

2743

parser = argparse.ArgumentParser()

2299

2744

parser.add_argument("-v", "--version", action="version",

2300

version = "%(prog)s {0}".format(version),

2745

version = "%(prog)s {}".format(version),

2301

2746

help="show version number and exit")

2302

2747

parser.add_argument("-i", "--interface", metavar="IF",

2303

2748

help="Bind to interface IF")

2336

2781

help="Directory to save/restore state in")

2337

2782

parser.add_argument("--foreground", action="store_true",

2338

2783

help="Run in foreground", default=None)

2784

parser.add_argument("--no-zeroconf", action="store_false",

2785

dest="zeroconf", help="Do not use Zeroconf",

2786

default=None)

2339

2787

2340

2788

options = parser.parse_args()

2341

2789

2342

2790

if options.check:

2343

2791

import doctest

2344

doctest.testmod()

2345

sys.exit()

2792

fail_count, test_count = doctest.testmod()

2793

sys.exit(os.EX_OK if fail_count == 0 else 1)

2346

2794

2347

2795

# Default values for config file for server-global settings

2348

2796

server_defaults = { "interface": "",

2350

2798

"port": "",

2351

2799

"debug": "False",

2352

2800

"priority":

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2801

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2802

":+SIGN-DSA-SHA256",

2354

2803

"servicename": "Mandos",

2355

2804

"use_dbus": "True",

2356

2805

"use_ipv6": "True",

2359

2808

"socket": "",

2360

2809

"statedir": "/var/lib/mandos",

2361

2810

"foreground": "False",

2362

}

2811

"zeroconf": "True",

2812

}

2363

2813

2364

2814

# Parse config file for server-global settings

2365

2815

server_config = configparser.SafeConfigParser(server_defaults)

2366

2816

del server_defaults

2367

server_config.read(os.path.join(options.configdir,

2368

"mandos.conf"))

2817

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2369

2818

# Convert the SafeConfigParser object to a dict

2370

2819

server_settings = server_config.defaults()

2371

2820

# Use the appropriate methods on the non-string config options

2389

2838

# Override the settings from the config file with command line

2390

2839

# options, if set.

2391

2840

for option in ("interface", "address", "port", "debug",

2392

"priority", "servicename", "configdir",

2393

"use_dbus", "use_ipv6", "debuglevel", "restore",

2394

"statedir", "socket", "foreground"):

2841

"priority", "servicename", "configdir", "use_dbus",

2842

"use_ipv6", "debuglevel", "restore", "statedir",

2843

"socket", "foreground", "zeroconf"):

2395

2844

value = getattr(options, option)

2396

2845

if value is not None:

2397

2846

server_settings[option] = value

2398

2847

del options

2399

2848

# Force all strings to be unicode

2400

2849

for option in server_settings.keys():

2401

if type(server_settings[option]) is str:

2402

server_settings[option] = unicode(server_settings[option])

2850

if isinstance(server_settings[option], bytes):

2851

server_settings[option] = (server_settings[option]

2852

.decode("utf-8"))

2403

2853

# Force all boolean options to be boolean

2404

2854

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2405

"foreground"):

2855

"foreground", "zeroconf"):

2406

2856

server_settings[option] = bool(server_settings[option])

2407

2857

# Debug implies foreground

2408

2858

if server_settings["debug"]:

2411

2861

2412

2862

##################################################################

2413

2863

2864

if (not server_settings["zeroconf"]

2865

and not (server_settings["port"]

2866

or server_settings["socket"] != "")):

2867

parser.error("Needs port or socket to work without Zeroconf")

2868

2414

2869

# For convenience

2415

2870

debug = server_settings["debug"]

2416

2871

debuglevel = server_settings["debuglevel"]

2419

2874

stored_state_path = os.path.join(server_settings["statedir"],

2420

2875

stored_state_file)

2421

2876

foreground = server_settings["foreground"]

2877

zeroconf = server_settings["zeroconf"]

2422

2878

2423

2879

if debug:

2424

2880

initlogger(debug, logging.DEBUG)

2430

2886

initlogger(debug, level)

2431

2887

2432

2888

if server_settings["servicename"] != "Mandos":

2433

syslogger.setFormatter(logging.Formatter

2434

('Mandos ({0}) [%(process)d]:'

2435

' %(levelname)s: %(message)s'

2436

.format(server_settings

2437

["servicename"])))

2889

syslogger.setFormatter(

2890

logging.Formatter('Mandos ({}) [%(process)d]:'

2891

' %(levelname)s: %(message)s'.format(

2892

server_settings["servicename"])))

2438

2893

2439

2894

# Parse config file with clients

2440

2895

client_config = configparser.SafeConfigParser(Client

2445

2900

global mandos_dbus_service

2446

2901

mandos_dbus_service = None

2447

2902

2448

tcp_server = MandosServer((server_settings["address"],

2449

server_settings["port"]),

2450

ClientHandler,

2451

interface=(server_settings["interface"]

2452

or None),

2453

use_ipv6=use_ipv6,

2454

gnutls_priority=

2455

server_settings["priority"],

2456

use_dbus=use_dbus,

2457

socketfd=(server_settings["socket"]

2458

or None))

2903

socketfd = None

2904

if server_settings["socket"] != "":

2905

socketfd = server_settings["socket"]

2906

tcp_server = MandosServer(

2907

(server_settings["address"], server_settings["port"]),

2908

ClientHandler,

2909

interface=(server_settings["interface"] or None),

2910

use_ipv6=use_ipv6,

2911

gnutls_priority=server_settings["priority"],

2912

use_dbus=use_dbus,

2913

socketfd=socketfd)

2459

2914

if not foreground:

2460

2915

pidfilename = "/run/mandos.pid"

2461

2916

if not os.path.isdir("/run/."):

2462

2917

pidfilename = "/var/run/mandos.pid"

2463

2918

pidfile = None

2464

2919

try:

2465

pidfile = open(pidfilename, "w")

2920

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2466

2921

except IOError as e:

2467

2922

logger.error("Could not open file %r", pidfilename,

2468

2923

exc_info=e)

2489

2944

2490

2945

# "Use a log level over 10 to enable all debugging options."

2491

2946

# - GnuTLS manual

2492

gnutls.library.functions.gnutls_global_set_log_level(11)

2947

gnutls.global_set_log_level(11)

2493

2948

2494

@gnutls.library.types.gnutls_log_func

2949

@gnutls.log_func

2495

2950

def debug_gnutls(level, string):

2496

2951

logger.debug("GnuTLS: %s", string[:-1])

2497

2952

2498

(gnutls.library.functions

2499

.gnutls_global_set_log_function(debug_gnutls))

2953

gnutls.global_set_log_function(debug_gnutls)

2500

2954

2501

2955

# Redirect stdin so all checkers get /dev/null

2502

2956

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2522

2976

if use_dbus:

2523

2977

try:

2524

2978

bus_name = dbus.service.BusName("se.recompile.Mandos",

2525

bus, do_not_queue=True)

2526

old_bus_name = (dbus.service.BusName

2527

("se.bsnet.fukt.Mandos", bus,

2528

do_not_queue=True))

2529

except dbus.exceptions.NameExistsException as e:

2979

bus,

2980

do_not_queue=True)

2981

old_bus_name = dbus.service.BusName(

2982

"se.bsnet.fukt.Mandos", bus,

2983

do_not_queue=True)

2984

except dbus.exceptions.DBusException as e:

2530

2985

logger.error("Disabling D-Bus:", exc_info=e)

2531

2986

use_dbus = False

2532

2987

server_settings["use_dbus"] = False

2533

2988

tcp_server.use_dbus = False

2534

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2535

service = AvahiServiceToSyslog(name =

2536

server_settings["servicename"],

2537

servicetype = "_mandos._tcp",

2538

protocol = protocol, bus = bus)

2539

if server_settings["interface"]:

2540

service.interface = (if_nametoindex

2541

(str(server_settings["interface"])))

2989

if zeroconf:

2990

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2991

service = AvahiServiceToSyslog(

2992

name = server_settings["servicename"],

2993

servicetype = "_mandos._tcp",

2994

protocol = protocol,

2995

bus = bus)

2996

if server_settings["interface"]:

2997

service.interface = if_nametoindex(

2998

server_settings["interface"].encode("utf-8"))

2542

2999

2543

3000

global multiprocessing_manager

2544

3001

multiprocessing_manager = multiprocessing.Manager()

2563

3020

if server_settings["restore"]:

2564

3021

try:

2565

3022

with open(stored_state_path, "rb") as stored_state:

2566

clients_data, old_client_settings = (pickle.load

2567

(stored_state))

3023

clients_data, old_client_settings = pickle.load(

3024

stored_state)

2568

3025

os.remove(stored_state_path)

2569

3026

except IOError as e:

2570

3027

if e.errno == errno.ENOENT:

2571

logger.warning("Could not load persistent state: {0}"

2572

.format(os.strerror(e.errno)))

3028

logger.warning("Could not load persistent state:"

3029

" {}".format(os.strerror(e.errno)))

2573

3030

else:

2574

3031

logger.critical("Could not load persistent state:",

2575

3032

exc_info=e)

2576

3033

raise

2577

3034

except EOFError as e:

2578

3035

logger.warning("Could not load persistent state: "

2579

"EOFError:", exc_info=e)

3036

"EOFError:",

3037

exc_info=e)

2580

3038

2581

3039

with PGPEngine() as pgp:

2582

for client_name, client in clients_data.iteritems():

3040

for client_name, client in clients_data.items():

2583

3041

# Skip removed clients

2584

3042

if client_name not in client_settings:

2585

3043

continue

2594

3052

# For each value in new config, check if it

2595

3053

# differs from the old config value (Except for

2596

3054

# the "secret" attribute)

2597

if (name != "secret" and

2598

value != old_client_settings[client_name]

2599

[name]):

3055

if (name != "secret"

3056

and (value !=

3057

old_client_settings[client_name][name])):

2600

3058

client[name] = value

2601

3059

except KeyError:

2602

3060

pass

2603

3061

2604

3062

# Clients who has passed its expire date can still be

2605

# enabled if its last checker was successful. Clients

3063

# enabled if its last checker was successful. A Client

2606

3064

# whose checker succeeded before we stored its state is

2607

3065

# assumed to have successfully run all checkers during

2608

3066

# downtime.

2610

3068

if datetime.datetime.utcnow() >= client["expires"]:

2611

3069

if not client["last_checked_ok"]:

2612

3070

logger.warning(

2613

"disabling client {0} - Client never "

2614

"performed a successful checker"

2615

.format(client_name))

3071

"disabling client {} - Client never "

3072

"performed a successful checker".format(

3073

client_name))

2616

3074

client["enabled"] = False

2617

3075

elif client["last_checker_status"] != 0:

2618

3076

logger.warning(

2619

"disabling client {0} - Client "

2620

"last checker failed with error code {1}"

2621

.format(client_name,

2622

client["last_checker_status"]))

3077

"disabling client {} - Client last"

3078

" checker failed with error code"

3079

" {}".format(

3080

client_name,

3081

client["last_checker_status"]))

2623

3082

client["enabled"] = False

2624

3083

else:

2625

client["expires"] = (datetime.datetime

2626

.utcnow()

2627

+ client["timeout"])

3084

client["expires"] = (

3085

datetime.datetime.utcnow()

3086

+ client["timeout"])

2628

3087

logger.debug("Last checker succeeded,"

2629

" keeping {0} enabled"

2630

.format(client_name))

3088

" keeping {} enabled".format(

3089

client_name))

2631

3090

try:

2632

client["secret"] = (

2633

pgp.decrypt(client["encrypted_secret"],

2634

client_settings[client_name]

2635

["secret"]))

3091

client["secret"] = pgp.decrypt(

3092

client["encrypted_secret"],

3093

client_settings[client_name]["secret"])

2636

3094

except PGPError:

2637

3095

# If decryption fails, we use secret from new settings

2638

logger.debug("Failed to decrypt {0} old secret"

2639

.format(client_name))

2640

client["secret"] = (

2641

client_settings[client_name]["secret"])

3096

logger.debug("Failed to decrypt {} old secret".format(

3097

client_name))

3098

client["secret"] = (client_settings[client_name]

3099

["secret"])

2642

3100

2643

3101

# Add/remove clients based on new changes made to config

2644

3102

for client_name in (set(old_client_settings)

2649

3107

clients_data[client_name] = client_settings[client_name]

2650

3108

2651

3109

# Create all client objects

2652

for client_name, client in clients_data.iteritems():

3110

for client_name, client in clients_data.items():

2653

3111

tcp_server.clients[client_name] = client_class(

2654

name = client_name, settings = client,

3112

name = client_name,

3113

settings = client,

2655

3114

server_settings = server_settings)

2656

3115

2657

3116

if not tcp_server.clients:

2659

3118

2660

3119

if not foreground:

2661

3120

if pidfile is not None:

3121

pid = os.getpid()

2662

3122

try:

2663

3123

with pidfile:

2664

pid = os.getpid()

2665

pidfile.write(str(pid) + "\n".encode("utf-8"))

3124

print(pid, file=pidfile)

2666

3125

except IOError:

2667

3126

logger.error("Could not write to file %r with PID %d",

2668

3127

pidfilename, pid)

2673

3132

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2674

3133

2675

3134

if use_dbus:

2676

@alternate_dbus_interfaces({"se.recompile.Mandos":

2677

"se.bsnet.fukt.Mandos"})

2678

class MandosDBusService(DBusObjectWithProperties):

3135

3136

@alternate_dbus_interfaces(

3137

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3138

class MandosDBusService(DBusObjectWithObjectManager):

2679

3139

"""A D-Bus proxy object"""

3140

2680

3141

def __init__(self):

2681

3142

dbus.service.Object.__init__(self, bus, "/")

3143

2682

3144

_interface = "se.recompile.Mandos"

2683

3145

2684

@dbus_interface_annotations(_interface)

2685

def _foo(self):

2686

return { "org.freedesktop.DBus.Property"

2687

".EmitsChangedSignal":

2688

"false"}

2689

2690

3146

@dbus.service.signal(_interface, signature="o")

2691

3147

def ClientAdded(self, objpath):

2692

3148

"D-Bus signal"

2697

3153

"D-Bus signal"

2698

3154

pass

2699

3155

3156

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3157

"true"})

2700

3158

@dbus.service.signal(_interface, signature="os")

2701

3159

def ClientRemoved(self, objpath, name):

2702

3160

"D-Bus signal"

2703

3161

pass

2704

3162

3163

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3164

"true"})

2705

3165

@dbus.service.method(_interface, out_signature="ao")

2706

3166

def GetAllClients(self):

2707

3167

"D-Bus method"

2708

return dbus.Array(c.dbus_object_path

2709

for c in

3168

return dbus.Array(c.dbus_object_path for c in

2710

3169

tcp_server.clients.itervalues())

2711

3170

3171

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3172

"true"})

2712

3173

@dbus.service.method(_interface,

2713

3174

out_signature="a{oa{sv}}")

2714

3175

def GetAllClientsWithProperties(self):

2715

3176

"D-Bus method"

2716

3177

return dbus.Dictionary(

2717

((c.dbus_object_path, c.GetAll(""))

2718

for c in tcp_server.clients.itervalues()),

3178

{ c.dbus_object_path: c.GetAll(

3179

"se.recompile.Mandos.Client")

3180

for c in tcp_server.clients.itervalues() },

2719

3181

signature="oa{sv}")

2720

3182

2721

3183

@dbus.service.method(_interface, in_signature="o")

2725

3187

if c.dbus_object_path == object_path:

2726

3188

del tcp_server.clients[c.name]

2727

3189

c.remove_from_connection()

2728

# Don't signal anything except ClientRemoved

3190

# Don't signal the disabling

2729

3191

c.disable(quiet=True)

2730

# Emit D-Bus signal

2731

self.ClientRemoved(object_path, c.name)

3192

# Emit D-Bus signal for removal

3193

self.client_removed_signal(c)

2732

3194

return

2733

3195

raise KeyError(object_path)

2734

3196

2735

3197

del _interface

3198

3199

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3200

out_signature = "a{oa{sa{sv}}}")

3201

def GetManagedObjects(self):

3202

"""D-Bus method"""

3203

return dbus.Dictionary(

3204

{ client.dbus_object_path:

3205

dbus.Dictionary(

3206

{ interface: client.GetAll(interface)

3207

for interface in

3208

client._get_all_interface_names()})

3209

for client in tcp_server.clients.values()})

3210

3211

def client_added_signal(self, client):

3212

"""Send the new standard signal and the old signal"""

3213

if use_dbus:

3214

# New standard signal

3215

self.InterfacesAdded(

3216

client.dbus_object_path,

3217

dbus.Dictionary(

3218

{ interface: client.GetAll(interface)

3219

for interface in

3220

client._get_all_interface_names()}))

3221

# Old signal

3222

self.ClientAdded(client.dbus_object_path)

3223

3224

def client_removed_signal(self, client):

3225

"""Send the new standard signal and the old signal"""

3226

if use_dbus:

3227

# New standard signal

3228

self.InterfacesRemoved(

3229

client.dbus_object_path,

3230

client._get_all_interface_names())

3231

# Old signal

3232

self.ClientRemoved(client.dbus_object_path,

3233

client.name)

2736

3234

2737

3235

mandos_dbus_service = MandosDBusService()

2738

3236

2739

3237

def cleanup():

2740

3238

"Cleanup function; run on exit"

2741

service.cleanup()

3239

if zeroconf:

3240

service.cleanup()

2742

3241

2743

3242

multiprocessing.active_children()

2744

3243

wnull.close()

2758

3257

2759

3258

# A list of attributes that can not be pickled

2760

3259

# + secret.

2761

exclude = set(("bus", "changedstate", "secret",

2762

"checker", "server_settings"))

2763

for name, typ in (inspect.getmembers

2764

(dbus.service.Object)):

3260

exclude = { "bus", "changedstate", "secret",

3261

"checker", "server_settings" }

3262

for name, typ in inspect.getmembers(dbus.service

3263

.Object):

2765

3264

exclude.add(name)

2766

3265

2767

3266

client_dict["encrypted_secret"] = (client

2774

3273

del client_settings[client.name]["secret"]

2775

3274

2776

3275

try:

2777

with (tempfile.NamedTemporaryFile

2778

(mode='wb', suffix=".pickle", prefix='clients-',

2779

dir=os.path.dirname(stored_state_path),

2780

delete=False)) as stored_state:

3276

with tempfile.NamedTemporaryFile(

3277

mode='wb',

3278

suffix=".pickle",

3279

prefix='clients-',

3280

dir=os.path.dirname(stored_state_path),

3281

delete=False) as stored_state:

2781

3282

pickle.dump((clients, client_settings), stored_state)

2782

tempname=stored_state.name

3283

tempname = stored_state.name

2783

3284

os.rename(tempname, stored_state_path)

2784

3285

except (IOError, OSError) as e:

2785

3286

if not debug:

2788

3289

except NameError:

2789

3290

pass

2790

3291

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2791

logger.warning("Could not save persistent state: {0}"

3292

logger.warning("Could not save persistent state: {}"

2792

3293

.format(os.strerror(e.errno)))

2793

3294

else:

2794

3295

logger.warning("Could not save persistent state:",

2800

3301

name, client = tcp_server.clients.popitem()

2801

3302

if use_dbus:

2802

3303

client.remove_from_connection()

2803

# Don't signal anything except ClientRemoved

3304

# Don't signal the disabling

2804

3305

client.disable(quiet=True)

3306

# Emit D-Bus signal for removal

2805

3307

if use_dbus:

2806

# Emit D-Bus signal

2807

mandos_dbus_service.ClientRemoved(client

2808

.dbus_object_path,

2809

client.name)

3308

mandos_dbus_service.client_removed_signal(client)

2810

3309

client_settings.clear()

2811

3310

2812

3311

atexit.register(cleanup)

2813

3312

2814

3313

for client in tcp_server.clients.itervalues():

2815

3314

if use_dbus:

2816

# Emit D-Bus signal

2817

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3315

# Emit D-Bus signal for adding

3316

mandos_dbus_service.client_added_signal(client)

2818

3317

# Need to initiate checking of clients

2819

3318

if client.enabled:

2820

3319

client.init_checker()

2823

3322

tcp_server.server_activate()

2824

3323

2825

3324

# Find out what port we got

2826

service.port = tcp_server.socket.getsockname()[1]

3325

if zeroconf:

3326

service.port = tcp_server.socket.getsockname()[1]

2827

3327

if use_ipv6:

2828

3328

logger.info("Now listening on address %r, port %d,"

2829

3329

" flowinfo %d, scope_id %d",

2835

3335

#service.interface = tcp_server.socket.getsockname()[3]

2836

3336

2837

3337

try:

2838

# From the Avahi example code

2839

try:

2840

service.activate()

2841

except dbus.exceptions.DBusException as error:

2842

logger.critical("D-Bus Exception", exc_info=error)

2843

cleanup()

2844

sys.exit(1)

2845

# End of Avahi example code

3338

if zeroconf:

3339

# From the Avahi example code

3340

try:

3341

service.activate()

3342

except dbus.exceptions.DBusException as error:

3343

logger.critical("D-Bus Exception", exc_info=error)

3344

cleanup()

3345

sys.exit(1)

3346

# End of Avahi example code

2846

3347

2847

3348

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2848

3349

lambda *args, **kwargs:

2863

3364

# Must run before the D-Bus bus name gets deregistered

2864

3365

cleanup()

2865

3366

3367

2866

3368

if __name__ == '__main__':

2867

3369

main()