/mandos/trunk : revision 821

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

43

46

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

51

import sys

52

import re

53

import os

62

import struct

63

import fcntl

64

import functools

65

import cPickle as pickle

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

66

69

import multiprocessing

67

70

import types

68

71

import binascii

69

72

import tempfile

70

73

import itertools

71

74

import collections

75

import codecs

72

76

73

77

import dbus

74

78

import dbus.service

75

import gobject

79

try:

80

from gi.repository import GObject

81

except ImportError:

82

import gobject as GObject

76

83

import avahi

77

84

from dbus.mainloop.glib import DBusGMainLoop

78

85

import ctypes

79

86

import ctypes.util

80

87

import xml.dom.minidom

81

88

import inspect

82

import GnuPGInterface

83

89

84

90

try:

85

91

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

89

95

except ImportError:

90

96

SO_BINDTODEVICE = None

91

97

92

version = "1.6.0"

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.3"

93

102

stored_state_file = "clients.pickle"

94

103

95

104

logger = logging.getLogger()

96

syslogger = (logging.handlers.SysLogHandler

97

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

98

address = str("/dev/log")))

105

syslogger = None

99

106

100

107

try:

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

104

110

except (OSError, AttributeError):

111

105

112

def if_nametoindex(interface):

106

113

"Get an interface index the hard way, i.e. using fcntl()"

107

114

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

108

115

with contextlib.closing(socket.socket()) as s:

109

116

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

110

struct.pack(str("16s16x"),

111

interface))

112

interface_index = struct.unpack(str("I"),

113

ifreq[16:20])[0]

117

struct.pack(b"16s16x", interface))

118

interface_index = struct.unpack("I", ifreq[16:20])[0]

114

119

return interface_index

115

120

116

121

117

122

def initlogger(debug, level=logging.WARNING):

118

123

"""init logger and add loglevel"""

119

124

125

global syslogger

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

120

129

syslogger.setFormatter(logging.Formatter

121

130

('Mandos [%(process)d]: %(levelname)s:'

122

131

' %(message)s'))

139

148

140

149

class PGPEngine(object):

141

150

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

142

152

def __init__(self):

143

self.gnupg = GnuPGInterface.GnuPG()

144

153

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

145

self.gnupg = GnuPGInterface.GnuPG()

146

self.gnupg.options.meta_interactive = False

147

self.gnupg.options.homedir = self.tempdir

148

self.gnupg.options.extra_args.extend(['--force-mdc',

149

'--quiet',

150

'--no-use-agent'])

154

self.gpg = "gpg"

155

try:

156

output = subprocess.check_output(["gpgconf"])

157

for line in output.splitlines():

158

name, text, path = line.split(":")

159

if name == "gpg":

160

self.gpg = path

161

break

162

except OSError as e:

163

if e.errno != errno.ENOENT:

164

raise

165

self.gnupgargs = ['--batch',

166

'--homedir', self.tempdir,

167

'--force-mdc',

168

'--quiet',

169

'--no-use-agent']

151

170

152

171

def __enter__(self):

153

172

return self

175

194

def password_encode(self, password):

176

195

# Passphrase can not be empty and can not contain newlines or

177

196

# NUL bytes. So we prefix it and hex encode it.

178

return b"mandos" + binascii.hexlify(password)

197

encoded = b"mandos" + binascii.hexlify(password)

198

if len(encoded) > 2048:

199

# GnuPG can't handle long passwords, so encode differently

200

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

201

.replace(b"\n", b"\\n")

202

.replace(b"\0", b"\\x00"))

203

return encoded

179

204

180

205

def encrypt(self, data, password):

181

self.gnupg.passphrase = self.password_encode(password)

182

with open(os.devnull, "w") as devnull:

183

try:

184

proc = self.gnupg.run(['--symmetric'],

185

create_fhs=['stdin', 'stdout'],

186

attach_fhs={'stderr': devnull})

187

with contextlib.closing(proc.handles['stdin']) as f:

188

f.write(data)

189

with contextlib.closing(proc.handles['stdout']) as f:

190

ciphertext = f.read()

191

proc.wait()

192

except IOError as e:

193

raise PGPError(e)

194

self.gnupg.passphrase = None

206

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(

208

dir=self.tempdir) as passfile:

209

passfile.write(passphrase)

210

passfile.flush()

211

proc = subprocess.Popen([self.gpg, '--symmetric',

212

'--passphrase-file',

213

passfile.name]

214

+ self.gnupgargs,

215

stdin = subprocess.PIPE,

216

stdout = subprocess.PIPE,

217

stderr = subprocess.PIPE)

218

ciphertext, err = proc.communicate(input = data)

219

if proc.returncode != 0:

220

raise PGPError(err)

195

221

return ciphertext

196

222

197

223

def decrypt(self, data, password):

198

self.gnupg.passphrase = self.password_encode(password)

199

with open(os.devnull, "w") as devnull:

200

try:

201

proc = self.gnupg.run(['--decrypt'],

202

create_fhs=['stdin', 'stdout'],

203

attach_fhs={'stderr': devnull})

204

with contextlib.closing(proc.handles['stdin']) as f:

205

f.write(data)

206

with contextlib.closing(proc.handles['stdout']) as f:

207

decrypted_plaintext = f.read()

208

proc.wait()

209

except IOError as e:

210

raise PGPError(e)

211

self.gnupg.passphrase = None

224

passphrase = self.password_encode(password)

225

with tempfile.NamedTemporaryFile(

226

dir = self.tempdir) as passfile:

227

passfile.write(passphrase)

228

passfile.flush()

229

proc = subprocess.Popen([self.gpg, '--decrypt',

230

'--passphrase-file',

231

passfile.name]

232

+ self.gnupgargs,

233

stdin = subprocess.PIPE,

234

stdout = subprocess.PIPE,

235

stderr = subprocess.PIPE)

236

decrypted_plaintext, err = proc.communicate(input = data)

237

if proc.returncode != 0:

238

raise PGPError(err)

212

239

return decrypted_plaintext

213

240

214

241

215

242

class AvahiError(Exception):

216

243

def __init__(self, value, *args, **kwargs):

217

244

self.value = value

218

super(AvahiError, self).__init__(value, *args, **kwargs)

219

def __unicode__(self):

220

return unicode(repr(self.value))

245

return super(AvahiError, self).__init__(value, *args,

246

**kwargs)

247

221

248

222

249

class AvahiServiceError(AvahiError):

223

250

pass

224

251

252

225

253

class AvahiGroupError(AvahiError):

226

254

pass

227

255

234

262

Used to optionally bind to the specified interface.

235

263

name: string; Example: 'Mandos'

236

264

type: string; Example: '_mandos._tcp'.

237

See <http://www.dns-sd.org/ServiceTypes.html>

265

See <https://www.iana.org/assignments/service-names-port-numbers>

238

266

port: integer; what port to announce

239

267

TXT: list of strings; TXT record for the service

240

268

domain: string; Domain to publish on, default to .local if empty.

247

275

bus: dbus.SystemBus()

248

276

"""

249

277

250

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

251

servicetype = None, port = None, TXT = None,

252

domain = "", host = "", max_renames = 32768,

253

protocol = avahi.PROTO_UNSPEC, bus = None):

278

def __init__(self,

279

interface = avahi.IF_UNSPEC,

280

name = None,

281

servicetype = None,

282

port = None,

283

TXT = None,

284

domain = "",

285

host = "",

286

max_renames = 32768,

287

protocol = avahi.PROTO_UNSPEC,

288

bus = None):

254

289

self.interface = interface

255

290

self.name = name

256

291

self.type = servicetype

266

301

self.bus = bus

267

302

self.entry_group_state_changed_match = None

268

303

269

def rename(self):

304

def rename(self, remove=True):

270

305

"""Derived from the Avahi example code"""

271

306

if self.rename_count >= self.max_renames:

272

307

logger.critical("No suitable Zeroconf service name found"

273

308

" after %i retries, exiting.",

274

309

self.rename_count)

275

310

raise AvahiServiceError("Too many renames")

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

311

self.name = str(

312

self.server.GetAlternativeServiceName(self.name))

313

self.rename_count += 1

278

314

logger.info("Changing Zeroconf service name to %r ...",

279

315

self.name)

280

self.remove()

316

if remove:

317

self.remove()

281

318

try:

282

319

self.add()

283

320

except dbus.exceptions.DBusException as error:

284

logger.critical("D-Bus Exception", exc_info=error)

285

self.cleanup()

286

os._exit(1)

287

self.rename_count += 1

321

if (error.get_dbus_name()

322

== "org.freedesktop.Avahi.CollisionError"):

323

logger.info("Local Zeroconf service name collision.")

324

return self.rename(remove=False)

325

else:

326

logger.critical("D-Bus Exception", exc_info=error)

327

self.cleanup()

328

os._exit(1)

288

329

289

330

def remove(self):

290

331

"""Derived from the Avahi example code"""

328

369

self.rename()

329

370

elif state == avahi.ENTRY_GROUP_FAILURE:

330

371

logger.critical("Avahi: Error in group state changed %s",

331

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

333

.format(error))

372

str(error))

373

raise AvahiGroupError("State changed: {!s}".format(error))

334

374

335

375

def cleanup(self):

336

376

"""Derived from the Avahi example code"""

346

386

def server_state_changed(self, state, error=None):

347

387

"""Derived from the Avahi example code"""

348

388

logger.debug("Avahi server state change: %i", state)

349

bad_states = { avahi.SERVER_INVALID:

350

"Zeroconf server invalid",

351

avahi.SERVER_REGISTERING: None,

352

avahi.SERVER_COLLISION:

353

"Zeroconf server name collision",

354

avahi.SERVER_FAILURE:

355

"Zeroconf server failure" }

389

bad_states = {

390

avahi.SERVER_INVALID: "Zeroconf server invalid",

391

avahi.SERVER_REGISTERING: None,

392

avahi.SERVER_COLLISION: "Zeroconf server name collision",

393

avahi.SERVER_FAILURE: "Zeroconf server failure",

394

}

356

395

if state in bad_states:

357

396

if bad_states[state] is not None:

358

397

if error is None:

361

400

logger.error(bad_states[state] + ": %r", error)

362

401

self.cleanup()

363

402

elif state == avahi.SERVER_RUNNING:

364

self.add()

403

try:

404

self.add()

405

except dbus.exceptions.DBusException as error:

406

if (error.get_dbus_name()

407

== "org.freedesktop.Avahi.CollisionError"):

408

logger.info("Local Zeroconf service name"

409

" collision.")

410

return self.rename(remove=False)

411

else:

412

logger.critical("D-Bus Exception", exc_info=error)

413

self.cleanup()

414

os._exit(1)

365

415

else:

366

416

if error is None:

367

417

logger.debug("Unknown state: %r", state)

377

427

follow_name_owner_changes=True),

378

428

avahi.DBUS_INTERFACE_SERVER)

379

429

self.server.connect_to_signal("StateChanged",

380

self.server_state_changed)

430

self.server_state_changed)

381

431

self.server_state_changed(self.server.GetState())

382

432

383

433

384

434

class AvahiServiceToSyslog(AvahiService):

385

def rename(self):

435

def rename(self, *args, **kwargs):

386

436

"""Add the new name to the syslog messages"""

387

ret = AvahiService.rename(self)

388

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

390

' %(levelname)s: %(message)s'

391

.format(self.name)))

437

ret = AvahiService.rename(self, *args, **kwargs)

438

syslogger.setFormatter(logging.Formatter(

439

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

440

.format(self.name)))

392

441

return ret

393

442

394

395

def timedelta_to_milliseconds(td):

396

"Convert a datetime.timedelta() to milliseconds"

397

return ((td.days * 24 * 60 * 60 * 1000)

398

+ (td.seconds * 1000)

399

+ (td.microseconds // 1000))

400

443

# Pretend that we have a GnuTLS module

444

class GnuTLS(object):

445

"""This isn't so much a class as it is a module-like namespace.

446

It is instantiated once, and simulates having a GnuTLS module."""

447

448

_library = ctypes.cdll.LoadLibrary(

449

ctypes.util.find_library("gnutls"))

450

_need_version = "3.3.0"

451

def __init__(self):

452

# Need to use class name "GnuTLS" here, since this method is

453

# called before the assignment to the "gnutls" global variable

454

# happens.

455

if GnuTLS.check_version(self._need_version) is None:

456

raise GnuTLS.Error("Needs GnuTLS {} or later"

457

.format(self._need_version))

458

459

# Unless otherwise indicated, the constants and types below are

460

# all from the gnutls/gnutls.h C header file.

461

462

# Constants

463

E_SUCCESS = 0

464

E_INTERRUPTED = -52

465

E_AGAIN = -28

466

CRT_OPENPGP = 2

467

CLIENT = 2

468

SHUT_RDWR = 0

469

CRD_CERTIFICATE = 1

470

E_NO_CERTIFICATE_FOUND = -49

471

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

472

473

# Types

474

class session_int(ctypes.Structure):

475

_fields_ = []

476

session_t = ctypes.POINTER(session_int)

477

class certificate_credentials_st(ctypes.Structure):

478

_fields_ = []

479

certificate_credentials_t = ctypes.POINTER(

480

certificate_credentials_st)

481

certificate_type_t = ctypes.c_int

482

class datum_t(ctypes.Structure):

483

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

484

('size', ctypes.c_uint)]

485

class openpgp_crt_int(ctypes.Structure):

486

_fields_ = []

487

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

488

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

489

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

490

credentials_type_t = ctypes.c_int #

491

transport_ptr_t = ctypes.c_void_p

492

close_request_t = ctypes.c_int

493

494

# Exceptions

495

class Error(Exception):

496

# We need to use the class name "GnuTLS" here, since this

497

# exception might be raised from within GnuTLS.__init__,

498

# which is called before the assignment to the "gnutls"

499

# global variable has happened.

500

def __init__(self, message = None, code = None, args=()):

501

# Default usage is by a message string, but if a return

502

# code is passed, convert it to a string with

503

# gnutls.strerror()

504

self.code = code

505

if message is None and code is not None:

506

message = GnuTLS.strerror(code)

507

return super(GnuTLS.Error, self).__init__(

508

message, *args)

509

510

class CertificateSecurityError(Error):

511

pass

512

513

# Classes

514

class Credentials(object):

515

def __init__(self):

516

self._c_object = gnutls.certificate_credentials_t()

517

gnutls.certificate_allocate_credentials(

518

ctypes.byref(self._c_object))

519

self.type = gnutls.CRD_CERTIFICATE

520

521

def __del__(self):

522

gnutls.certificate_free_credentials(self._c_object)

523

524

class ClientSession(object):

525

def __init__(self, socket, credentials = None):

526

self._c_object = gnutls.session_t()

527

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

528

gnutls.set_default_priority(self._c_object)

529

gnutls.transport_set_ptr(self._c_object, socket.fileno())

530

gnutls.handshake_set_private_extensions(self._c_object,

531

True)

532

self.socket = socket

533

if credentials is None:

534

credentials = gnutls.Credentials()

535

gnutls.credentials_set(self._c_object, credentials.type,

536

ctypes.cast(credentials._c_object,

537

ctypes.c_void_p))

538

self.credentials = credentials

539

540

def __del__(self):

541

gnutls.deinit(self._c_object)

542

543

def handshake(self):

544

return gnutls.handshake(self._c_object)

545

546

def send(self, data):

547

data = bytes(data)

548

data_len = len(data)

549

while data_len > 0:

550

data_len -= gnutls.record_send(self._c_object,

551

data[-data_len:],

552

data_len)

553

554

def bye(self):

555

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

556

557

# Error handling functions

558

def _error_code(result):

559

"""A function to raise exceptions on errors, suitable

560

for the 'restype' attribute on ctypes functions"""

561

if result >= 0:

562

return result

563

if result == gnutls.E_NO_CERTIFICATE_FOUND:

564

raise gnutls.CertificateSecurityError(code = result)

565

raise gnutls.Error(code = result)

566

567

def _retry_on_error(result, func, arguments):

568

"""A function to retry on some errors, suitable

569

for the 'errcheck' attribute on ctypes functions"""

570

while result < 0:

571

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

572

return _error_code(result)

573

result = func(*arguments)

574

return result

575

576

# Unless otherwise indicated, the function declarations below are

577

# all from the gnutls/gnutls.h C header file.

578

579

# Functions

580

priority_set_direct = _library.gnutls_priority_set_direct

581

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

582

ctypes.POINTER(ctypes.c_char_p)]

583

priority_set_direct.restype = _error_code

584

585

init = _library.gnutls_init

586

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

587

init.restype = _error_code

588

589

set_default_priority = _library.gnutls_set_default_priority

590

set_default_priority.argtypes = [session_t]

591

set_default_priority.restype = _error_code

592

593

record_send = _library.gnutls_record_send

594

record_send.argtypes = [session_t, ctypes.c_void_p,

595

ctypes.c_size_t]

596

record_send.restype = ctypes.c_ssize_t

597

record_send.errcheck = _retry_on_error

598

599

certificate_allocate_credentials = (

600

_library.gnutls_certificate_allocate_credentials)

601

certificate_allocate_credentials.argtypes = [

602

ctypes.POINTER(certificate_credentials_t)]

603

certificate_allocate_credentials.restype = _error_code

604

605

certificate_free_credentials = (

606

_library.gnutls_certificate_free_credentials)

607

certificate_free_credentials.argtypes = [certificate_credentials_t]

608

certificate_free_credentials.restype = None

609

610

handshake_set_private_extensions = (

611

_library.gnutls_handshake_set_private_extensions)

612

handshake_set_private_extensions.argtypes = [session_t,

613

ctypes.c_int]

614

handshake_set_private_extensions.restype = None

615

616

credentials_set = _library.gnutls_credentials_set

617

credentials_set.argtypes = [session_t, credentials_type_t,

618

ctypes.c_void_p]

619

credentials_set.restype = _error_code

620

621

strerror = _library.gnutls_strerror

622

strerror.argtypes = [ctypes.c_int]

623

strerror.restype = ctypes.c_char_p

624

625

certificate_type_get = _library.gnutls_certificate_type_get

626

certificate_type_get.argtypes = [session_t]

627

certificate_type_get.restype = _error_code

628

629

certificate_get_peers = _library.gnutls_certificate_get_peers

630

certificate_get_peers.argtypes = [session_t,

631

ctypes.POINTER(ctypes.c_uint)]

632

certificate_get_peers.restype = ctypes.POINTER(datum_t)

633

634

global_set_log_level = _library.gnutls_global_set_log_level

635

global_set_log_level.argtypes = [ctypes.c_int]

636

global_set_log_level.restype = None

637

638

global_set_log_function = _library.gnutls_global_set_log_function

639

global_set_log_function.argtypes = [log_func]

640

global_set_log_function.restype = None

641

642

deinit = _library.gnutls_deinit

643

deinit.argtypes = [session_t]

644

deinit.restype = None

645

646

handshake = _library.gnutls_handshake

647

handshake.argtypes = [session_t]

648

handshake.restype = _error_code

649

handshake.errcheck = _retry_on_error

650

651

transport_set_ptr = _library.gnutls_transport_set_ptr

652

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

653

transport_set_ptr.restype = None

654

655

bye = _library.gnutls_bye

656

bye.argtypes = [session_t, close_request_t]

657

bye.restype = _error_code

658

bye.errcheck = _retry_on_error

659

660

check_version = _library.gnutls_check_version

661

check_version.argtypes = [ctypes.c_char_p]

662

check_version.restype = ctypes.c_char_p

663

664

# All the function declarations below are from gnutls/openpgp.h

665

666

openpgp_crt_init = _library.gnutls_openpgp_crt_init

667

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

668

openpgp_crt_init.restype = _error_code

669

670

openpgp_crt_import = _library.gnutls_openpgp_crt_import

671

openpgp_crt_import.argtypes = [openpgp_crt_t,

672

ctypes.POINTER(datum_t),

673

openpgp_crt_fmt_t]

674

openpgp_crt_import.restype = _error_code

675

676

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

677

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

678

ctypes.POINTER(ctypes.c_uint)]

679

openpgp_crt_verify_self.restype = _error_code

680

681

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

682

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

683

openpgp_crt_deinit.restype = None

684

685

openpgp_crt_get_fingerprint = (

686

_library.gnutls_openpgp_crt_get_fingerprint)

687

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

688

ctypes.c_void_p,

689

ctypes.POINTER(

690

ctypes.c_size_t)]

691

openpgp_crt_get_fingerprint.restype = _error_code

692

693

# Remove non-public functions

694

del _error_code, _retry_on_error

695

# Create the global "gnutls" object, simulating a module

696

gnutls = GnuTLS()

697

698

def call_pipe(connection, # : multiprocessing.Connection

699

func, *args, **kwargs):

700

"""This function is meant to be called by multiprocessing.Process

701

702

This function runs func(*args, **kwargs), and writes the resulting

703

return value on the provided multiprocessing.Connection.

704

"""

705

connection.send(func(*args, **kwargs))

706

connection.close()

401

707

402

708

class Client(object):

403

709

"""A representation of a client host served by this server.

409

715

checker: subprocess.Popen(); a running checker process used

410

716

to see if the client lives.

411

717

'None' if no process is running.

412

checker_callback_tag: a gobject event source tag, or None

718

checker_callback_tag: a GObject event source tag, or None

413

719

checker_command: string; External command which is run to check

414

720

if client lives. %() expansions are done at

415

721

runtime with vars(self) as dict, so that for

416

722

instance %(name)s can be used in the command.

417

checker_initiator_tag: a gobject event source tag, or None

723

checker_initiator_tag: a GObject event source tag, or None

418

724

created: datetime.datetime(); (UTC) object creation

419

725

client_structure: Object describing what attributes a client has

420

726

and is used for storing the client at exit

421

727

current_checker_command: string; current running checker_command

422

disable_initiator_tag: a gobject event source tag, or None

728

disable_initiator_tag: a GObject event source tag, or None

423

729

enabled: bool()

424

730

fingerprint: string (40 or 32 hexadecimal digits); used to

425

731

uniquely identify the client

430

736

last_checker_status: integer between 0 and 255 reflecting exit

431

737

status of last checker. -1 reflects crashed

432

738

checker, -2 means no checker completed yet.

739

last_checker_signal: The signal which killed the last checker, if

740

last_checker_status is -1

433

741

last_enabled: datetime.datetime(); (UTC) or None

434

742

name: string; from the config file, used in log messages and

435

743

D-Bus identifiers

440

748

runtime_expansions: Allowed attributes for runtime expansion.

441

749

expires: datetime.datetime(); time (UTC) when a client will be

442

750

disabled, or None

751

server_settings: The server_settings dict from main()

443

752

"""

444

753

445

754

runtime_expansions = ("approval_delay", "approval_duration",

447

756

"fingerprint", "host", "interval",

448

757

"last_approval_request", "last_checked_ok",

449

758

"last_enabled", "name", "timeout")

450

client_defaults = { "timeout": "PT5M",

451

"extended_timeout": "PT15M",

452

"interval": "PT2M",

453

"checker": "fping -q -- %%(host)s",

454

"host": "",

455

"approval_delay": "PT0S",

456

"approval_duration": "PT1S",

457

"approved_by_default": "True",

458

"enabled": "True",

459

}

460

461

def timeout_milliseconds(self):

462

"Return the 'timeout' attribute in milliseconds"

463

return timedelta_to_milliseconds(self.timeout)

464

465

def extended_timeout_milliseconds(self):

466

"Return the 'extended_timeout' attribute in milliseconds"

467

return timedelta_to_milliseconds(self.extended_timeout)

468

469

def interval_milliseconds(self):

470

"Return the 'interval' attribute in milliseconds"

471

return timedelta_to_milliseconds(self.interval)

472

473

def approval_delay_milliseconds(self):

474

return timedelta_to_milliseconds(self.approval_delay)

759

client_defaults = {

760

"timeout": "PT5M",

761

"extended_timeout": "PT15M",

762

"interval": "PT2M",

763

"checker": "fping -q -- %%(host)s",

764

"host": "",

765

"approval_delay": "PT0S",

766

"approval_duration": "PT1S",

767

"approved_by_default": "True",

768

"enabled": "True",

769

}

475

770

476

771

@staticmethod

477

772

def config_parser(config):

493

788

client["enabled"] = config.getboolean(client_name,

494

789

"enabled")

495

790

791

# Uppercase and remove spaces from fingerprint for later

792

# comparison purposes with return value from the

793

# fingerprint() function

496

794

client["fingerprint"] = (section["fingerprint"].upper()

497

795

.replace(" ", ""))

498

796

if "secret" in section:

503

801

"rb") as secfile:

504

802

client["secret"] = secfile.read()

505

803

else:

506

raise TypeError("No secret or secfile for section {0}"

804

raise TypeError("No secret or secfile for section {}"

507

805

.format(section))

508

806

client["timeout"] = string_to_delta(section["timeout"])

509

807

client["extended_timeout"] = string_to_delta(

520

818

521

819

return settings

522

820

523

def __init__(self, settings, name = None):

821

def __init__(self, settings, name = None, server_settings=None):

524

822

self.name = name

823

if server_settings is None:

824

server_settings = {}

825

self.server_settings = server_settings

525

826

# adding all client settings

526

for setting, value in settings.iteritems():

827

for setting, value in settings.items():

527

828

setattr(self, setting, value)

528

829

529

830

if self.enabled:

537

838

self.expires = None

538

839

539

840

logger.debug("Creating client %r", self.name)

540

# Uppercase and remove spaces from fingerprint for later

541

# comparison purposes with return value from the fingerprint()

542

# function

543

841

logger.debug(" Fingerprint: %s", self.fingerprint)

544

842

self.created = settings.get("created",

545

843

datetime.datetime.utcnow())

552

850

self.current_checker_command = None

553

851

self.approved = None

554

852

self.approvals_pending = 0

555

self.changedstate = (multiprocessing_manager

556

.Condition(multiprocessing_manager

557

.Lock()))

558

self.client_structure = [attr for attr in

559

self.__dict__.iterkeys()

853

self.changedstate = multiprocessing_manager.Condition(

854

multiprocessing_manager.Lock())

855

self.client_structure = [attr

856

for attr in self.__dict__.iterkeys()

560

857

if not attr.startswith("_")]

561

858

self.client_structure.append("client_structure")

562

859

563

for name, t in inspect.getmembers(type(self),

564

lambda obj:

565

isinstance(obj,

566

property)):

860

for name, t in inspect.getmembers(

861

type(self), lambda obj: isinstance(obj, property)):

567

862

if not name.startswith("_"):

568

863

self.client_structure.append(name)

569

864

590

885

if not quiet:

591

886

logger.info("Disabling client %s", self.name)

592

887

if getattr(self, "disable_initiator_tag", None) is not None:

593

gobject.source_remove(self.disable_initiator_tag)

888

GObject.source_remove(self.disable_initiator_tag)

594

889

self.disable_initiator_tag = None

595

890

self.expires = None

596

891

if getattr(self, "checker_initiator_tag", None) is not None:

597

gobject.source_remove(self.checker_initiator_tag)

892

GObject.source_remove(self.checker_initiator_tag)

598

893

self.checker_initiator_tag = None

599

894

self.stop_checker()

600

895

self.enabled = False

601

896

if not quiet:

602

897

self.send_changedstate()

603

# Do not run this again if called by a gobject.timeout_add

898

# Do not run this again if called by a GObject.timeout_add

604

899

return False

605

900

606

901

def __del__(self):

610

905

# Schedule a new checker to be started an 'interval' from now,

611

906

# and every interval from then on.

612

907

if self.checker_initiator_tag is not None:

613

gobject.source_remove(self.checker_initiator_tag)

614

self.checker_initiator_tag = (gobject.timeout_add

615

(self.interval_milliseconds(),

616

self.start_checker))

908

GObject.source_remove(self.checker_initiator_tag)

909

self.checker_initiator_tag = GObject.timeout_add(

910

int(self.interval.total_seconds() * 1000),

911

self.start_checker)

617

912

# Schedule a disable() when 'timeout' has passed

618

913

if self.disable_initiator_tag is not None:

619

gobject.source_remove(self.disable_initiator_tag)

620

self.disable_initiator_tag = (gobject.timeout_add

621

(self.timeout_milliseconds(),

622

self.disable))

914

GObject.source_remove(self.disable_initiator_tag)

915

self.disable_initiator_tag = GObject.timeout_add(

916

int(self.timeout.total_seconds() * 1000), self.disable)

623

917

# Also start a new checker *right now*.

624

918

self.start_checker()

625

919

626

def checker_callback(self, pid, condition, command):

920

def checker_callback(self, source, condition, connection,

921

command):

627

922

"""The checker has completed, so take appropriate actions."""

628

923

self.checker_callback_tag = None

629

924

self.checker = None

630

if os.WIFEXITED(condition):

631

self.last_checker_status = os.WEXITSTATUS(condition)

925

# Read return code from connection (see call_pipe)

926

returncode = connection.recv()

927

connection.close()

928

929

if returncode >= 0:

930

self.last_checker_status = returncode

931

self.last_checker_signal = None

632

932

if self.last_checker_status == 0:

633

933

logger.info("Checker for %(name)s succeeded",

634

934

vars(self))

635

935

self.checked_ok()

636

936

else:

637

logger.info("Checker for %(name)s failed",

638

vars(self))

937

logger.info("Checker for %(name)s failed", vars(self))

639

938

else:

640

939

self.last_checker_status = -1

940

self.last_checker_signal = -returncode

641

941

logger.warning("Checker for %(name)s crashed?",

642

942

vars(self))

943

return False

643

944

644

945

def checked_ok(self):

645

946

"""Assert that the client has been seen, alive and well."""

646

947

self.last_checked_ok = datetime.datetime.utcnow()

647

948

self.last_checker_status = 0

949

self.last_checker_signal = None

648

950

self.bump_timeout()

649

951

650

952

def bump_timeout(self, timeout=None):

652

954

if timeout is None:

653

955

timeout = self.timeout

654

956

if self.disable_initiator_tag is not None:

655

gobject.source_remove(self.disable_initiator_tag)

957

GObject.source_remove(self.disable_initiator_tag)

656

958

self.disable_initiator_tag = None

657

959

if getattr(self, "enabled", False):

658

self.disable_initiator_tag = (gobject.timeout_add

659

(timedelta_to_milliseconds

660

(timeout), self.disable))

960

self.disable_initiator_tag = GObject.timeout_add(

961

int(timeout.total_seconds() * 1000), self.disable)

661

962

self.expires = datetime.datetime.utcnow() + timeout

662

963

663

964

def need_approval(self):

677

978

# than 'timeout' for the client to be disabled, which is as it

678

979

# should be.

679

980

680

# If a checker exists, make sure it is not a zombie

681

try:

682

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

683

except (AttributeError, OSError) as error:

684

if (isinstance(error, OSError)

685

and error.errno != errno.ECHILD):

686

raise error

687

else:

688

if pid:

689

logger.warning("Checker was a zombie")

690

gobject.source_remove(self.checker_callback_tag)

691

self.checker_callback(pid, status,

692

self.current_checker_command)

981

if self.checker is not None and not self.checker.is_alive():

982

logger.warning("Checker was not alive; joining")

983

self.checker.join()

984

self.checker = None

693

985

# Start a new checker if needed

694

986

if self.checker is None:

695

987

# Escape attributes for the shell

696

escaped_attrs = dict(

697

(attr, re.escape(unicode(getattr(self, attr))))

698

for attr in

699

self.runtime_expansions)

988

escaped_attrs = {

989

attr: re.escape(str(getattr(self, attr)))

990

for attr in self.runtime_expansions }

700

991

try:

701

992

command = self.checker_command % escaped_attrs

702

993

except TypeError as error:

703

994

logger.error('Could not format string "%s"',

704

self.checker_command, exc_info=error)

705

return True # Try again later

995

self.checker_command,

996

exc_info=error)

997

return True # Try again later

706

998

self.current_checker_command = command

707

try:

708

logger.info("Starting checker %r for %s",

709

command, self.name)

710

# We don't need to redirect stdout and stderr, since

711

# in normal mode, that is already done by daemon(),

712

# and in debug mode we don't want to. (Stdin is

713

# always replaced by /dev/null.)

714

self.checker = subprocess.Popen(command,

715

close_fds=True,

716

shell=True, cwd="/")

717

except OSError as error:

718

logger.error("Failed to start subprocess",

719

exc_info=error)

720

self.checker_callback_tag = (gobject.child_watch_add

721

(self.checker.pid,

722

self.checker_callback,

723

data=command))

724

# The checker may have completed before the gobject

725

# watch was added. Check for this.

726

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

727

if pid:

728

gobject.source_remove(self.checker_callback_tag)

729

self.checker_callback(pid, status, command)

730

# Re-run this periodically if run by gobject.timeout_add

999

logger.info("Starting checker %r for %s", command,

1000

self.name)

1001

# We don't need to redirect stdout and stderr, since

1002

# in normal mode, that is already done by daemon(),

1003

# and in debug mode we don't want to. (Stdin is

1004

# always replaced by /dev/null.)

1005

# The exception is when not debugging but nevertheless

1006

# running in the foreground; use the previously

1007

# created wnull.

1008

popen_args = { "close_fds": True,

1009

"shell": True,

1010

"cwd": "/" }

1011

if (not self.server_settings["debug"]

1012

and self.server_settings["foreground"]):

1013

popen_args.update({"stdout": wnull,

1014

"stderr": wnull })

1015

pipe = multiprocessing.Pipe(duplex = False)

1016

self.checker = multiprocessing.Process(

1017

target = call_pipe,

1018

args = (pipe[1], subprocess.call, command),

1019

kwargs = popen_args)

1020

self.checker.start()

1021

self.checker_callback_tag = GObject.io_add_watch(

1022

pipe[0].fileno(), GObject.IO_IN,

1023

self.checker_callback, pipe[0], command)

1024

# Re-run this periodically if run by GObject.timeout_add

731

1025

return True

732

1026

733

1027

def stop_checker(self):

734

1028

"""Force the checker process, if any, to stop."""

735

1029

if self.checker_callback_tag:

736

gobject.source_remove(self.checker_callback_tag)

1030

GObject.source_remove(self.checker_callback_tag)

737

1031

self.checker_callback_tag = None

738

1032

if getattr(self, "checker", None) is None:

739

1033

return

740

1034

logger.debug("Stopping checker for %(name)s", vars(self))

741

try:

742

self.checker.terminate()

743

#time.sleep(0.5)

744

#if self.checker.poll() is None:

745

# self.checker.kill()

746

except OSError as error:

747

if error.errno != errno.ESRCH: # No such process

748

raise

1035

self.checker.terminate()

749

1036

self.checker = None

750

1037

751

1038

752

def dbus_service_property(dbus_interface, signature="v",

753

access="readwrite", byte_arrays=False):

1039

def dbus_service_property(dbus_interface,

1040

signature="v",

1041

access="readwrite",

1042

byte_arrays=False):

754

1043

"""Decorators for marking methods of a DBusObjectWithProperties to

755

1044

become properties on the D-Bus.

756

1045

765

1054

# "Set" method, so we fail early here:

766

1055

if byte_arrays and signature != "ay":

767

1056

raise ValueError("Byte arrays not supported for non-'ay'"

768

" signature {0!r}".format(signature))

1057

" signature {!r}".format(signature))

1058

769

1059

def decorator(func):

770

1060

func._dbus_is_property = True

771

1061

func._dbus_interface = dbus_interface

776

1066

func._dbus_name = func._dbus_name[:-14]

777

1067

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

778

1068

return func

1069

779

1070

return decorator

780

1071

781

1072

790

1081

"org.freedesktop.DBus.Property.EmitsChangedSignal":

791

1082

"false"}

792

1083

"""

1084

793

1085

def decorator(func):

794

1086

func._dbus_is_interface = True

795

1087

func._dbus_interface = dbus_interface

796

1088

func._dbus_name = dbus_interface

797

1089

return func

1090

798

1091

return decorator

799

1092

800

1093

802

1095

"""Decorator to annotate D-Bus methods, signals or properties

803

1096

Usage:

804

1097

1098

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1099

"org.freedesktop.DBus.Property."

1100

"EmitsChangedSignal": "false"})

805

1101

@dbus_service_property("org.example.Interface", signature="b",

806

1102

access="r")

807

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

808

"org.freedesktop.DBus.Property."

809

"EmitsChangedSignal": "false"})

810

1103

def Property_dbus_property(self):

811

1104

return dbus.Boolean(False)

1105

1106

See also the DBusObjectWithAnnotations class.

812

1107

"""

1108

813

1109

def decorator(func):

814

1110

func._dbus_annotations = annotations

815

1111

return func

1112

816

1113

return decorator

817

1114

818

1115

819

1116

class DBusPropertyException(dbus.exceptions.DBusException):

820

1117

"""A base class for D-Bus property-related exceptions

821

1118

"""

822

def __unicode__(self):

823

return unicode(str(self))

1119

pass

824

1120

825

1121

826

1122

class DBusPropertyAccessException(DBusPropertyException):

835

1131

pass

836

1132

837

1133

838

class DBusObjectWithProperties(dbus.service.Object):

839

"""A D-Bus object with properties.

1134

class DBusObjectWithAnnotations(dbus.service.Object):

1135

"""A D-Bus object with annotations.

840

1136

841

Classes inheriting from this can use the dbus_service_property

842

decorator to expose methods as D-Bus properties. It exposes the

843

standard Get(), Set(), and GetAll() methods on the D-Bus.

1137

Classes inheriting from this can use the dbus_annotations

1138

decorator to add annotations to methods or signals.

844

1139

"""

845

1140

846

1141

@staticmethod

850

1145

If called like _is_dbus_thing("method") it returns a function

851

1146

suitable for use as predicate to inspect.getmembers().

852

1147

"""

853

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1148

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

854

1149

False)

855

1150

856

1151

def _get_all_dbus_things(self, thing):

857

1152

"""Returns a generator of (name, attribute) pairs

858

1153

"""

859

return ((getattr(athing.__get__(self), "_dbus_name",

860

name),

1154

return ((getattr(athing.__get__(self), "_dbus_name", name),

861

1155

athing.__get__(self))

862

1156

for cls in self.__class__.__mro__

863

1157

for name, athing in

864

inspect.getmembers(cls,

865

self._is_dbus_thing(thing)))

1158

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1159

1160

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1161

out_signature = "s",

1162

path_keyword = 'object_path',

1163

connection_keyword = 'connection')

1164

def Introspect(self, object_path, connection):

1165

"""Overloading of standard D-Bus method.

1166

1167

Inserts annotation tags on methods and signals.

1168

"""

1169

xmlstring = dbus.service.Object.Introspect(self, object_path,

1170

connection)

1171

try:

1172

document = xml.dom.minidom.parseString(xmlstring)

1173

1174

for if_tag in document.getElementsByTagName("interface"):

1175

# Add annotation tags

1176

for typ in ("method", "signal"):

1177

for tag in if_tag.getElementsByTagName(typ):

1178

annots = dict()

1179

for name, prop in (self.

1180

_get_all_dbus_things(typ)):

1181

if (name == tag.getAttribute("name")

1182

and prop._dbus_interface

1183

== if_tag.getAttribute("name")):

1184

annots.update(getattr(

1185

prop, "_dbus_annotations", {}))

1186

for name, value in annots.items():

1187

ann_tag = document.createElement(

1188

"annotation")

1189

ann_tag.setAttribute("name", name)

1190

ann_tag.setAttribute("value", value)

1191

tag.appendChild(ann_tag)

1192

# Add interface annotation tags

1193

for annotation, value in dict(

1194

itertools.chain.from_iterable(

1195

annotations().items()

1196

for name, annotations

1197

in self._get_all_dbus_things("interface")

1198

if name == if_tag.getAttribute("name")

1199

)).items():

1200

ann_tag = document.createElement("annotation")

1201

ann_tag.setAttribute("name", annotation)

1202

ann_tag.setAttribute("value", value)

1203

if_tag.appendChild(ann_tag)

1204

# Fix argument name for the Introspect method itself

1205

if (if_tag.getAttribute("name")

1206

== dbus.INTROSPECTABLE_IFACE):

1207

for cn in if_tag.getElementsByTagName("method"):

1208

if cn.getAttribute("name") == "Introspect":

1209

for arg in cn.getElementsByTagName("arg"):

1210

if (arg.getAttribute("direction")

1211

== "out"):

1212

arg.setAttribute("name",

1213

"xml_data")

1214

xmlstring = document.toxml("utf-8")

1215

document.unlink()

1216

except (AttributeError, xml.dom.DOMException,

1217

xml.parsers.expat.ExpatError) as error:

1218

logger.error("Failed to override Introspection method",

1219

exc_info=error)

1220

return xmlstring

1221

1222

1223

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1224

"""A D-Bus object with properties.

1225

1226

Classes inheriting from this can use the dbus_service_property

1227

decorator to expose methods as D-Bus properties. It exposes the

1228

standard Get(), Set(), and GetAll() methods on the D-Bus.

1229

"""

866

1230

867

1231

def _get_dbus_property(self, interface_name, property_name):

868

1232

"""Returns a bound method if one exists which is a D-Bus

869

1233

property with the specified name and interface.

870

1234

"""

871

for cls in self.__class__.__mro__:

872

for name, value in (inspect.getmembers

873

(cls,

874

self._is_dbus_thing("property"))):

1235

for cls in self.__class__.__mro__:

1236

for name, value in inspect.getmembers(

1237

cls, self._is_dbus_thing("property")):

875

1238

if (value._dbus_name == property_name

876

1239

and value._dbus_interface == interface_name):

877

1240

return value.__get__(self)

878

1241

879

1242

# No such property

880

raise DBusPropertyNotFound(self.dbus_object_path + ":"

881

+ interface_name + "."

882

+ property_name)

883

884

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1243

raise DBusPropertyNotFound("{}:{}.{}".format(

1244

self.dbus_object_path, interface_name, property_name))

1245

1246

@classmethod

1247

def _get_all_interface_names(cls):

1248

"""Get a sequence of all interfaces supported by an object"""

1249

return (name for name in set(getattr(getattr(x, attr),

1250

"_dbus_interface", None)

1251

for x in (inspect.getmro(cls))

1252

for attr in dir(x))

1253

if name is not None)

1254

1255

@dbus.service.method(dbus.PROPERTIES_IFACE,

1256

in_signature="ss",

885

1257

out_signature="v")

886

1258

def Get(self, interface_name, property_name):

887

1259

"""Standard D-Bus property Get() method, see D-Bus standard.

905

1277

# The byte_arrays option is not supported yet on

906

1278

# signatures other than "ay".

907

1279

if prop._dbus_signature != "ay":

908

raise ValueError

1280

raise ValueError("Byte arrays not supported for non-"

1281

"'ay' signature {!r}"

1282

.format(prop._dbus_signature))

909

1283

value = dbus.ByteArray(b''.join(chr(byte)

910

1284

for byte in value))

911

1285

prop(value)

912

1286

913

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1287

@dbus.service.method(dbus.PROPERTIES_IFACE,

1288

in_signature="s",

914

1289

out_signature="a{sv}")

915

1290

def GetAll(self, interface_name):

916

1291

"""Standard D-Bus property GetAll() method, see D-Bus

931

1306

if not hasattr(value, "variant_level"):

932

1307

properties[name] = value

933

1308

continue

934

properties[name] = type(value)(value, variant_level=

935

value.variant_level+1)

1309

properties[name] = type(value)(

1310

value, variant_level = value.variant_level + 1)

936

1311

return dbus.Dictionary(properties, signature="sv")

937

1312

1313

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1314

def PropertiesChanged(self, interface_name, changed_properties,

1315

invalidated_properties):

1316

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1317

standard.

1318

"""

1319

pass

1320

938

1321

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

939

1322

out_signature="s",

940

1323

path_keyword='object_path',

944

1327

945

1328

Inserts property tags and interface annotation tags.

946

1329

"""

947

xmlstring = dbus.service.Object.Introspect(self, object_path,

948

connection)

1330

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1331

object_path,

1332

connection)

949

1333

try:

950

1334

document = xml.dom.minidom.parseString(xmlstring)

1335

951

1336

def make_tag(document, name, prop):

952

1337

e = document.createElement("property")

953

1338

e.setAttribute("name", name)

954

1339

e.setAttribute("type", prop._dbus_signature)

955

1340

e.setAttribute("access", prop._dbus_access)

956

1341

return e

1342

957

1343

for if_tag in document.getElementsByTagName("interface"):

958

1344

# Add property tags

959

1345

for tag in (make_tag(document, name, prop)

962

1348

if prop._dbus_interface

963

1349

== if_tag.getAttribute("name")):

964

1350

if_tag.appendChild(tag)

965

# Add annotation tags

966

for typ in ("method", "signal", "property"):

967

for tag in if_tag.getElementsByTagName(typ):

968

annots = dict()

969

for name, prop in (self.

970

_get_all_dbus_things(typ)):

971

if (name == tag.getAttribute("name")

972

and prop._dbus_interface

973

== if_tag.getAttribute("name")):

974

annots.update(getattr

975

(prop,

976

"_dbus_annotations",

977

{}))

978

for name, value in annots.iteritems():

979

ann_tag = document.createElement(

980

"annotation")

981

ann_tag.setAttribute("name", name)

982

ann_tag.setAttribute("value", value)

983

tag.appendChild(ann_tag)

984

# Add interface annotation tags

985

for annotation, value in dict(

986

itertools.chain.from_iterable(

987

annotations().iteritems()

988

for name, annotations in

989

self._get_all_dbus_things("interface")

990

if name == if_tag.getAttribute("name")

991

)).iteritems():

992

ann_tag = document.createElement("annotation")

993

ann_tag.setAttribute("name", annotation)

994

ann_tag.setAttribute("value", value)

995

if_tag.appendChild(ann_tag)

1351

# Add annotation tags for properties

1352

for tag in if_tag.getElementsByTagName("property"):

1353

annots = dict()

1354

for name, prop in self._get_all_dbus_things(

1355

"property"):

1356

if (name == tag.getAttribute("name")

1357

and prop._dbus_interface

1358

== if_tag.getAttribute("name")):

1359

annots.update(getattr(

1360

prop, "_dbus_annotations", {}))

1361

for name, value in annots.items():

1362

ann_tag = document.createElement(

1363

"annotation")

1364

ann_tag.setAttribute("name", name)

1365

ann_tag.setAttribute("value", value)

1366

tag.appendChild(ann_tag)

996

1367

# Add the names to the return values for the

997

1368

# "org.freedesktop.DBus.Properties" methods

998

1369

if (if_tag.getAttribute("name")

1016

1387

exc_info=error)

1017

1388

return xmlstring

1018

1389

1390

try:

1391

dbus.OBJECT_MANAGER_IFACE

1392

except AttributeError:

1393

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1394

1395

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1396

"""A D-Bus object with an ObjectManager.

1397

1398

Classes inheriting from this exposes the standard

1399

GetManagedObjects call and the InterfacesAdded and

1400

InterfacesRemoved signals on the standard

1401

"org.freedesktop.DBus.ObjectManager" interface.

1402

1403

Note: No signals are sent automatically; they must be sent

1404

manually.

1405

"""

1406

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1407

out_signature = "a{oa{sa{sv}}}")

1408

def GetManagedObjects(self):

1409

"""This function must be overridden"""

1410

raise NotImplementedError()

1411

1412

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1413

signature = "oa{sa{sv}}")

1414

def InterfacesAdded(self, object_path, interfaces_and_properties):

1415

pass

1416

1417

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1418

def InterfacesRemoved(self, object_path, interfaces):

1419

pass

1420

1421

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1422

out_signature = "s",

1423

path_keyword = 'object_path',

1424

connection_keyword = 'connection')

1425

def Introspect(self, object_path, connection):

1426

"""Overloading of standard D-Bus method.

1427

1428

Override return argument name of GetManagedObjects to be

1429

"objpath_interfaces_and_properties"

1430

"""

1431

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1432

object_path,

1433

connection)

1434

try:

1435

document = xml.dom.minidom.parseString(xmlstring)

1436

1437

for if_tag in document.getElementsByTagName("interface"):

1438

# Fix argument name for the GetManagedObjects method

1439

if (if_tag.getAttribute("name")

1440

== dbus.OBJECT_MANAGER_IFACE):

1441

for cn in if_tag.getElementsByTagName("method"):

1442

if (cn.getAttribute("name")

1443

== "GetManagedObjects"):

1444

for arg in cn.getElementsByTagName("arg"):

1445

if (arg.getAttribute("direction")

1446

== "out"):

1447

arg.setAttribute(

1448

"name",

1449

"objpath_interfaces"

1450

"_and_properties")

1451

xmlstring = document.toxml("utf-8")

1452

document.unlink()

1453

except (AttributeError, xml.dom.DOMException,

1454

xml.parsers.expat.ExpatError) as error:

1455

logger.error("Failed to override Introspection method",

1456

exc_info = error)

1457

return xmlstring

1019

1458

1020

1459

def datetime_to_dbus(dt, variant_level=0):

1021

1460

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1022

1461

if dt is None:

1023

1462

return dbus.String("", variant_level = variant_level)

1024

return dbus.String(dt.isoformat(),

1025

variant_level=variant_level)

1463

return dbus.String(dt.isoformat(), variant_level=variant_level)

1026

1464

1027

1465

1028

1466

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1048

1486

(from DBusObjectWithProperties) and interfaces (from the

1049

1487

dbus_interface_annotations decorator).

1050

1488

"""

1489

1051

1490

def wrapper(cls):

1052

1491

for orig_interface_name, alt_interface_name in (

1053

alt_interface_names.iteritems()):

1492

alt_interface_names.items()):

1054

1493

attr = {}

1055

1494

interface_names = set()

1056

1495

# Go though all attributes of the class

1058

1497

# Ignore non-D-Bus attributes, and D-Bus attributes

1059

1498

# with the wrong interface name

1060

1499

if (not hasattr(attribute, "_dbus_interface")

1061

or not attribute._dbus_interface

1062

.startswith(orig_interface_name)):

1500

or not attribute._dbus_interface.startswith(

1501

orig_interface_name)):

1063

1502

continue

1064

1503

# Create an alternate D-Bus interface name based on

1065

1504

# the current name

1066

alt_interface = (attribute._dbus_interface

1067

.replace(orig_interface_name,

1068

alt_interface_name))

1505

alt_interface = attribute._dbus_interface.replace(

1506

orig_interface_name, alt_interface_name)

1069

1507

interface_names.add(alt_interface)

1070

1508

# Is this a D-Bus signal?

1071

1509

if getattr(attribute, "_dbus_is_signal", False):

1072

# Extract the original non-method function by

1073

# black magic

1074

nonmethod_func = (dict(

1510

if sys.version_info.major == 2:

1511

# Extract the original non-method undecorated

1512

# function by black magic

1513

nonmethod_func = (dict(

1075

1514

zip(attribute.func_code.co_freevars,

1076

attribute.__closure__))["func"]

1077

.cell_contents)

1515

attribute.__closure__))

1516

["func"].cell_contents)

1517

else:

1518

nonmethod_func = attribute

1078

1519

# Create a new, but exactly alike, function

1079

1520

# object, and decorate it to be a new D-Bus signal

1080

1521

# with the alternate D-Bus interface name

1081

new_function = (dbus.service.signal

1082

(alt_interface,

1083

attribute._dbus_signature)

1084

(types.FunctionType(

1085

nonmethod_func.func_code,

1086

nonmethod_func.func_globals,

1087

nonmethod_func.func_name,

1088

nonmethod_func.func_defaults,

1089

nonmethod_func.func_closure)))

1522

if sys.version_info.major == 2:

1523

new_function = types.FunctionType(

1524

nonmethod_func.func_code,

1525

nonmethod_func.func_globals,

1526

nonmethod_func.func_name,

1527

nonmethod_func.func_defaults,

1528

nonmethod_func.func_closure)

1529

else:

1530

new_function = types.FunctionType(

1531

nonmethod_func.__code__,

1532

nonmethod_func.__globals__,

1533

nonmethod_func.__name__,

1534

nonmethod_func.__defaults__,

1535

nonmethod_func.__closure__)

1536

new_function = (dbus.service.signal(

1537

alt_interface,

1538

attribute._dbus_signature)(new_function))

1090

1539

# Copy annotations, if any

1091

1540

try:

1092

new_function._dbus_annotations = (

1093

dict(attribute._dbus_annotations))

1541

new_function._dbus_annotations = dict(

1542

attribute._dbus_annotations)

1094

1543

except AttributeError:

1095

1544

pass

1096

1545

# Define a creator of a function to call both the

1101

1550

"""This function is a scope container to pass

1102

1551

func1 and func2 to the "call_both" function

1103

1552

outside of its arguments"""

1553

1554

@functools.wraps(func2)

1104

1555

def call_both(*args, **kwargs):

1105

1556

"""This function will emit two D-Bus

1106

1557

signals by calling func1 and func2"""

1107

1558

func1(*args, **kwargs)

1108

1559

func2(*args, **kwargs)

1560

# Make wrapper function look like a D-Bus signal

1561

for name, attr in inspect.getmembers(func2):

1562

if name.startswith("_dbus_"):

1563

setattr(call_both, name, attr)

1564

1109

1565

return call_both

1110

1566

# Create the "call_both" function and add it to

1111

1567

# the class

1116

1572

# object. Decorate it to be a new D-Bus method

1117

1573

# with the alternate D-Bus interface name. Add it

1118

1574

# to the class.

1119

attr[attrname] = (dbus.service.method

1120

(alt_interface,

1121

attribute._dbus_in_signature,

1122

attribute._dbus_out_signature)

1123

(types.FunctionType

1124

(attribute.func_code,

1125

attribute.func_globals,

1126

attribute.func_name,

1127

attribute.func_defaults,

1128

attribute.func_closure)))

1575

attr[attrname] = (

1576

dbus.service.method(

1577

alt_interface,

1578

attribute._dbus_in_signature,

1579

attribute._dbus_out_signature)

1580

(types.FunctionType(attribute.func_code,

1581

attribute.func_globals,

1582

attribute.func_name,

1583

attribute.func_defaults,

1584

attribute.func_closure)))

1129

1585

# Copy annotations, if any

1130

1586

try:

1131

attr[attrname]._dbus_annotations = (

1132

dict(attribute._dbus_annotations))

1587

attr[attrname]._dbus_annotations = dict(

1588

attribute._dbus_annotations)

1133

1589

except AttributeError:

1134

1590

pass

1135

1591

# Is this a D-Bus property?

1138

1594

# object, and decorate it to be a new D-Bus

1139

1595

# property with the alternate D-Bus interface

1140

1596

# name. Add it to the class.

1141

attr[attrname] = (dbus_service_property

1142

(alt_interface,

1143

attribute._dbus_signature,

1144

attribute._dbus_access,

1145

attribute

1146

._dbus_get_args_options

1147

["byte_arrays"])

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1597

attr[attrname] = (dbus_service_property(

1598

alt_interface, attribute._dbus_signature,

1599

attribute._dbus_access,

1600

attribute._dbus_get_args_options

1601

["byte_arrays"])

1602

(types.FunctionType(

1603

attribute.func_code,

1604

attribute.func_globals,

1605

attribute.func_name,

1606

attribute.func_defaults,

1607

attribute.func_closure)))

1154

1608

# Copy annotations, if any

1155

1609

try:

1156

attr[attrname]._dbus_annotations = (

1157

dict(attribute._dbus_annotations))

1610

attr[attrname]._dbus_annotations = dict(

1611

attribute._dbus_annotations)

1158

1612

except AttributeError:

1159

1613

pass

1160

1614

# Is this a D-Bus interface?

1163

1617

# object. Decorate it to be a new D-Bus interface

1164

1618

# with the alternate D-Bus interface name. Add it

1165

1619

# to the class.

1166

attr[attrname] = (dbus_interface_annotations

1167

(alt_interface)

1168

(types.FunctionType

1169

(attribute.func_code,

1170

attribute.func_globals,

1171

attribute.func_name,

1172

attribute.func_defaults,

1173

attribute.func_closure)))

1620

attr[attrname] = (

1621

dbus_interface_annotations(alt_interface)

1622

(types.FunctionType(attribute.func_code,

1623

attribute.func_globals,

1624

attribute.func_name,

1625

attribute.func_defaults,

1626

attribute.func_closure)))

1174

1627

if deprecate:

1175

1628

# Deprecate all alternate interfaces

1176

iname="_AlternateDBusNames_interface_annotation{0}"

1629

iname="_AlternateDBusNames_interface_annotation{}"

1177

1630

for interface_name in interface_names:

1631

1178

1632

@dbus_interface_annotations(interface_name)

1179

1633

def func(self):

1180

1634

return { "org.freedesktop.DBus.Deprecated":

1181

"true" }

1635

"true" }

1182

1636

# Find an unused name

1183

1637

for aname in (iname.format(i)

1184

1638

for i in itertools.count()):

1188

1642

if interface_names:

1189

1643

# Replace the class with a new subclass of it with

1190

1644

# methods, signals, etc. as created above.

1191

cls = type(b"{0}Alternate".format(cls.__name__),

1192

(cls,), attr)

1645

cls = type(b"{}Alternate".format(cls.__name__),

1646

(cls, ), attr)

1193

1647

return cls

1648

1194

1649

return wrapper

1195

1650

1196

1651

1197

1652

@alternate_dbus_interfaces({"se.recompile.Mandos":

1198

"se.bsnet.fukt.Mandos"})

1653

"se.bsnet.fukt.Mandos"})

1199

1654

class ClientDBus(Client, DBusObjectWithProperties):

1200

1655

"""A Client class using D-Bus

1201

1656

1205

1660

"""

1206

1661

1207

1662

runtime_expansions = (Client.runtime_expansions

1208

+ ("dbus_object_path",))

1663

+ ("dbus_object_path", ))

1664

1665

_interface = "se.recompile.Mandos.Client"

1209

1666

1210

1667

# dbus.service.Object doesn't use super(), so we can't either.

1211

1668

1214

1671

Client.__init__(self, *args, **kwargs)

1215

1672

# Only now, when this client is initialized, can it show up on

1216

1673

# the D-Bus

1217

client_object_name = unicode(self.name).translate(

1674

client_object_name = str(self.name).translate(

1218

1675

{ord("."): ord("_"),

1219

1676

ord("-"): ord("_")})

1220

self.dbus_object_path = (dbus.ObjectPath

1221

("/clients/" + client_object_name))

1677

self.dbus_object_path = dbus.ObjectPath(

1678

"/clients/" + client_object_name)

1222

1679

DBusObjectWithProperties.__init__(self, self.bus,

1223

1680

self.dbus_object_path)

1224

1681

1225

def notifychangeproperty(transform_func,

1226

dbus_name, type_func=lambda x: x,

1227

variant_level=1):

1682

def notifychangeproperty(transform_func, dbus_name,

1683

type_func=lambda x: x,

1684

variant_level=1,

1685

invalidate_only=False,

1686

_interface=_interface):

1228

1687

""" Modify a variable so that it's a property which announces

1229

1688

its changes to DBus.

1230

1689

1235

1694

to the D-Bus. Default: no transform

1236

1695

variant_level: D-Bus variant level. Default: 1

1237

1696

"""

1238

attrname = "_{0}".format(dbus_name)

1697

attrname = "_{}".format(dbus_name)

1698

1239

1699

def setter(self, value):

1240

1700

if hasattr(self, "dbus_object_path"):

1241

1701

if (not hasattr(self, attrname) or

1242

1702

type_func(getattr(self, attrname, None))

1243

1703

!= type_func(value)):

1244

dbus_value = transform_func(type_func(value),

1245

variant_level

1246

=variant_level)

1247

self.PropertyChanged(dbus.String(dbus_name),

1248

dbus_value)

1704

if invalidate_only:

1705

self.PropertiesChanged(

1706

_interface, dbus.Dictionary(),

1707

dbus.Array((dbus_name, )))

1708

else:

1709

dbus_value = transform_func(

1710

type_func(value),

1711

variant_level = variant_level)

1712

self.PropertyChanged(dbus.String(dbus_name),

1713

dbus_value)

1714

self.PropertiesChanged(

1715

_interface,

1716

dbus.Dictionary({ dbus.String(dbus_name):

1717

dbus_value }),

1718

dbus.Array())

1249

1719

setattr(self, attrname, value)

1250

1720

1251

1721

return property(lambda self: getattr(self, attrname), setter)

1257

1727

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1258

1728

last_enabled = notifychangeproperty(datetime_to_dbus,

1259

1729

"LastEnabled")

1260

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1261

type_func = lambda checker:

1262

checker is not None)

1730

checker = notifychangeproperty(

1731

dbus.Boolean, "CheckerRunning",

1732

type_func = lambda checker: checker is not None)

1263

1733

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1264

1734

"LastCheckedOK")

1265

1735

last_checker_status = notifychangeproperty(dbus.Int16,

1268

1738

datetime_to_dbus, "LastApprovalRequest")

1269

1739

approved_by_default = notifychangeproperty(dbus.Boolean,

1270

1740

"ApprovedByDefault")

1271

approval_delay = notifychangeproperty(dbus.UInt64,

1272

"ApprovalDelay",

1273

type_func =

1274

timedelta_to_milliseconds)

1741

approval_delay = notifychangeproperty(

1742

dbus.UInt64, "ApprovalDelay",

1743

type_func = lambda td: td.total_seconds() * 1000)

1275

1744

approval_duration = notifychangeproperty(

1276

1745

dbus.UInt64, "ApprovalDuration",

1277

type_func = timedelta_to_milliseconds)

1746

type_func = lambda td: td.total_seconds() * 1000)

1278

1747

host = notifychangeproperty(dbus.String, "Host")

1279

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1280

type_func =

1281

timedelta_to_milliseconds)

1748

timeout = notifychangeproperty(

1749

dbus.UInt64, "Timeout",

1750

type_func = lambda td: td.total_seconds() * 1000)

1282

1751

extended_timeout = notifychangeproperty(

1283

1752

dbus.UInt64, "ExtendedTimeout",

1284

type_func = timedelta_to_milliseconds)

1285

interval = notifychangeproperty(dbus.UInt64,

1286

"Interval",

1287

type_func =

1288

timedelta_to_milliseconds)

1753

type_func = lambda td: td.total_seconds() * 1000)

1754

interval = notifychangeproperty(

1755

dbus.UInt64, "Interval",

1756

type_func = lambda td: td.total_seconds() * 1000)

1289

1757

checker_command = notifychangeproperty(dbus.String, "Checker")

1758

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1759

invalidate_only=True)

1290

1760

1291

1761

del notifychangeproperty

1292

1762

1299

1769

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1300

1770

Client.__del__(self, *args, **kwargs)

1301

1771

1302

def checker_callback(self, pid, condition, command,

1303

*args, **kwargs):

1304

self.checker_callback_tag = None

1305

self.checker = None

1306

if os.WIFEXITED(condition):

1307

exitstatus = os.WEXITSTATUS(condition)

1772

def checker_callback(self, source, condition,

1773

connection, command, *args, **kwargs):

1774

ret = Client.checker_callback(self, source, condition,

1775

connection, command, *args,

1776

**kwargs)

1777

exitstatus = self.last_checker_status

1778

if exitstatus >= 0:

1308

1779

# Emit D-Bus signal

1309

1780

self.CheckerCompleted(dbus.Int16(exitstatus),

1310

dbus.Int64(condition),

1781

# This is specific to GNU libC

1782

dbus.Int64(exitstatus << 8),

1311

1783

dbus.String(command))

1312

1784

else:

1313

1785

# Emit D-Bus signal

1314

1786

self.CheckerCompleted(dbus.Int16(-1),

1315

dbus.Int64(condition),

1787

dbus.Int64(

1788

# This is specific to GNU libC

1789

(exitstatus << 8)

1790

| self.last_checker_signal),

1316

1791

dbus.String(command))

1317

1318

return Client.checker_callback(self, pid, condition, command,

1319

*args, **kwargs)

1792

return ret

1320

1793

1321

1794

def start_checker(self, *args, **kwargs):

1322

old_checker = self.checker

1323

if self.checker is not None:

1324

old_checker_pid = self.checker.pid

1325

else:

1326

old_checker_pid = None

1795

old_checker_pid = getattr(self.checker, "pid", None)

1327

1796

r = Client.start_checker(self, *args, **kwargs)

1328

1797

# Only if new checker process was started

1329

1798

if (self.checker is not None

1338

1807

1339

1808

def approve(self, value=True):

1340

1809

self.approved = value

1341

gobject.timeout_add(timedelta_to_milliseconds

1342

(self.approval_duration),

1343

self._reset_approved)

1810

GObject.timeout_add(int(self.approval_duration.total_seconds()

1811

* 1000), self._reset_approved)

1344

1812

self.send_changedstate()

1345

1813

1346

1814

## D-Bus methods, signals & properties

1347

_interface = "se.recompile.Mandos.Client"

1348

1815

1349

1816

## Interfaces

1350

1817

1351

@dbus_interface_annotations(_interface)

1352

def _foo(self):

1353

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1354

"false"}

1355

1356

1818

## Signals

1357

1819

1358

1820

# CheckerCompleted - signal

1368

1830

pass

1369

1831

1370

1832

# PropertyChanged - signal

1833

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1371

1834

@dbus.service.signal(_interface, signature="sv")

1372

1835

def PropertyChanged(self, property, value):

1373

1836

"D-Bus signal"

1407

1870

self.checked_ok()

1408

1871

1409

1872

# Enable - method

1873

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1410

1874

@dbus.service.method(_interface)

1411

1875

def Enable(self):

1412

1876

"D-Bus method"

1413

1877

self.enable()

1414

1878

1415

1879

# StartChecker - method

1880

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1416

1881

@dbus.service.method(_interface)

1417

1882

def StartChecker(self):

1418

1883

"D-Bus method"

1419

1884

self.start_checker()

1420

1885

1421

1886

# Disable - method

1887

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1422

1888

@dbus.service.method(_interface)

1423

1889

def Disable(self):

1424

1890

"D-Bus method"

1425

1891

self.disable()

1426

1892

1427

1893

# StopChecker - method

1894

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1428

1895

@dbus.service.method(_interface)

1429

1896

def StopChecker(self):

1430

1897

self.stop_checker()

1437

1904

return dbus.Boolean(bool(self.approvals_pending))

1438

1905

1439

1906

# ApprovedByDefault - property

1440

@dbus_service_property(_interface, signature="b",

1907

@dbus_service_property(_interface,

1908

signature="b",

1441

1909

access="readwrite")

1442

1910

def ApprovedByDefault_dbus_property(self, value=None):

1443

1911

if value is None: # get

1445

1913

self.approved_by_default = bool(value)

1446

1914

1447

1915

# ApprovalDelay - property

1448

@dbus_service_property(_interface, signature="t",

1916

@dbus_service_property(_interface,

1917

signature="t",

1449

1918

access="readwrite")

1450

1919

def ApprovalDelay_dbus_property(self, value=None):

1451

1920

if value is None: # get

1452

return dbus.UInt64(self.approval_delay_milliseconds())

1921

return dbus.UInt64(self.approval_delay.total_seconds()

1922

* 1000)

1453

1923

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1454

1924

1455

1925

# ApprovalDuration - property

1456

@dbus_service_property(_interface, signature="t",

1926

@dbus_service_property(_interface,

1927

signature="t",

1457

1928

access="readwrite")

1458

1929

def ApprovalDuration_dbus_property(self, value=None):

1459

1930

if value is None: # get

1460

return dbus.UInt64(timedelta_to_milliseconds(

1461

self.approval_duration))

1931

return dbus.UInt64(self.approval_duration.total_seconds()

1932

* 1000)

1462

1933

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1463

1934

1464

1935

# Name - property

1936

@dbus_annotations(

1937

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1465

1938

@dbus_service_property(_interface, signature="s", access="read")

1466

1939

def Name_dbus_property(self):

1467

1940

return dbus.String(self.name)

1468

1941

1469

1942

# Fingerprint - property

1943

@dbus_annotations(

1944

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1470

1945

@dbus_service_property(_interface, signature="s", access="read")

1471

1946

def Fingerprint_dbus_property(self):

1472

1947

return dbus.String(self.fingerprint)

1473

1948

1474

1949

# Host - property

1475

@dbus_service_property(_interface, signature="s",

1950

@dbus_service_property(_interface,

1951

signature="s",

1476

1952

access="readwrite")

1477

1953

def Host_dbus_property(self, value=None):

1478

1954

if value is None: # get

1479

1955

return dbus.String(self.host)

1480

self.host = unicode(value)

1956

self.host = str(value)

1481

1957

1482

1958

# Created - property

1959

@dbus_annotations(

1960

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1483

1961

@dbus_service_property(_interface, signature="s", access="read")

1484

1962

def Created_dbus_property(self):

1485

1963

return datetime_to_dbus(self.created)

1490

1968

return datetime_to_dbus(self.last_enabled)

1491

1969

1492

1970

# Enabled - property

1493

@dbus_service_property(_interface, signature="b",

1971

@dbus_service_property(_interface,

1972

signature="b",

1494

1973

access="readwrite")

1495

1974

def Enabled_dbus_property(self, value=None):

1496

1975

if value is None: # get

1501

1980

self.disable()

1502

1981

1503

1982

# LastCheckedOK - property

1504

@dbus_service_property(_interface, signature="s",

1983

@dbus_service_property(_interface,

1984

signature="s",

1505

1985

access="readwrite")

1506

1986

def LastCheckedOK_dbus_property(self, value=None):

1507

1987

if value is not None:

1510

1990

return datetime_to_dbus(self.last_checked_ok)

1511

1991

1512

1992

# LastCheckerStatus - property

1513

@dbus_service_property(_interface, signature="n",

1514

access="read")

1993

@dbus_service_property(_interface, signature="n", access="read")

1515

1994

def LastCheckerStatus_dbus_property(self):

1516

1995

return dbus.Int16(self.last_checker_status)

1517

1996

1526

2005

return datetime_to_dbus(self.last_approval_request)

1527

2006

1528

2007

# Timeout - property

1529

@dbus_service_property(_interface, signature="t",

2008

@dbus_service_property(_interface,

2009

signature="t",

1530

2010

access="readwrite")

1531

2011

def Timeout_dbus_property(self, value=None):

1532

2012

if value is None: # get

1533

return dbus.UInt64(self.timeout_milliseconds())

2013

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1534

2014

old_timeout = self.timeout

1535

2015

self.timeout = datetime.timedelta(0, 0, 0, value)

1536

2016

# Reschedule disabling

1544

2024

if (getattr(self, "disable_initiator_tag", None)

1545

2025

is None):

1546

2026

return

1547

gobject.source_remove(self.disable_initiator_tag)

1548

self.disable_initiator_tag = (

1549

gobject.timeout_add(

1550

timedelta_to_milliseconds(self.expires - now),

1551

self.disable))

2027

GObject.source_remove(self.disable_initiator_tag)

2028

self.disable_initiator_tag = GObject.timeout_add(

2029

int((self.expires - now).total_seconds() * 1000),

2030

self.disable)

1552

2031

1553

2032

# ExtendedTimeout - property

1554

@dbus_service_property(_interface, signature="t",

2033

@dbus_service_property(_interface,

2034

signature="t",

1555

2035

access="readwrite")

1556

2036

def ExtendedTimeout_dbus_property(self, value=None):

1557

2037

if value is None: # get

1558

return dbus.UInt64(self.extended_timeout_milliseconds())

2038

return dbus.UInt64(self.extended_timeout.total_seconds()

2039

* 1000)

1559

2040

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1560

2041

1561

2042

# Interval - property

1562

@dbus_service_property(_interface, signature="t",

2043

@dbus_service_property(_interface,

2044

signature="t",

1563

2045

access="readwrite")

1564

2046

def Interval_dbus_property(self, value=None):

1565

2047

if value is None: # get

1566

return dbus.UInt64(self.interval_milliseconds())

2048

return dbus.UInt64(self.interval.total_seconds() * 1000)

1567

2049

self.interval = datetime.timedelta(0, 0, 0, value)

1568

2050

if getattr(self, "checker_initiator_tag", None) is None:

1569

2051

return

1570

2052

if self.enabled:

1571

2053

# Reschedule checker run

1572

gobject.source_remove(self.checker_initiator_tag)

1573

self.checker_initiator_tag = (gobject.timeout_add

1574

(value, self.start_checker))

1575

self.start_checker() # Start one now, too

2054

GObject.source_remove(self.checker_initiator_tag)

2055

self.checker_initiator_tag = GObject.timeout_add(

2056

value, self.start_checker)

2057

self.start_checker() # Start one now, too

1576

2058

1577

2059

# Checker - property

1578

@dbus_service_property(_interface, signature="s",

2060

@dbus_service_property(_interface,

2061

signature="s",

1579

2062

access="readwrite")

1580

2063

def Checker_dbus_property(self, value=None):

1581

2064

if value is None: # get

1582

2065

return dbus.String(self.checker_command)

1583

self.checker_command = unicode(value)

2066

self.checker_command = str(value)

1584

2067

1585

2068

# CheckerRunning - property

1586

@dbus_service_property(_interface, signature="b",

2069

@dbus_service_property(_interface,

2070

signature="b",

1587

2071

access="readwrite")

1588

2072

def CheckerRunning_dbus_property(self, value=None):

1589

2073

if value is None: # get

1594

2078

self.stop_checker()

1595

2079

1596

2080

# ObjectPath - property

2081

@dbus_annotations(

2082

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2083

"org.freedesktop.DBus.Deprecated": "true"})

1597

2084

@dbus_service_property(_interface, signature="o", access="read")

1598

2085

def ObjectPath_dbus_property(self):

1599

2086

return self.dbus_object_path # is already a dbus.ObjectPath

1600

2087

1601

2088

# Secret = property

1602

@dbus_service_property(_interface, signature="ay",

1603

access="write", byte_arrays=True)

2089

@dbus_annotations(

2090

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2091

"invalidates"})

2092

@dbus_service_property(_interface,

2093

signature="ay",

2094

access="write",

2095

byte_arrays=True)

1604

2096

def Secret_dbus_property(self, value):

1605

self.secret = str(value)

2097

self.secret = bytes(value)

1606

2098

1607

2099

del _interface

1608

2100

1612

2104

self._pipe = child_pipe

1613

2105

self._pipe.send(('init', fpr, address))

1614

2106

if not self._pipe.recv():

1615

raise KeyError()

2107

raise KeyError(fpr)

1616

2108

1617

2109

def __getattribute__(self, name):

1618

2110

if name == '_pipe':

1622

2114

if data[0] == 'data':

1623

2115

return data[1]

1624

2116

if data[0] == 'function':

2117

1625

2118

def func(*args, **kwargs):

1626

2119

self._pipe.send(('funcall', name, args, kwargs))

1627

2120

return self._pipe.recv()[1]

2121

1628

2122

return func

1629

2123

1630

2124

def __setattr__(self, name, value):

1642

2136

def handle(self):

1643

2137

with contextlib.closing(self.server.child_pipe) as child_pipe:

1644

2138

logger.info("TCP connection from: %s",

1645

unicode(self.client_address))

2139

str(self.client_address))

1646

2140

logger.debug("Pipe FD: %d",

1647

2141

self.server.child_pipe.fileno())

1648

2142

1649

session = (gnutls.connection

1650

.ClientSession(self.request,

1651

gnutls.connection

1652

.X509Credentials()))

1653

1654

# Note: gnutls.connection.X509Credentials is really a

1655

# generic GnuTLS certificate credentials object so long as

1656

# no X.509 keys are added to it. Therefore, we can use it

1657

# here despite using OpenPGP certificates.

2143

session = gnutls.ClientSession(self.request)

1658

2144

1659

2145

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1660

2146

# "+AES-256-CBC", "+SHA1",

1664

2150

priority = self.server.gnutls_priority

1665

2151

if priority is None:

1666

2152

priority = "NORMAL"

1667

(gnutls.library.functions

1668

.gnutls_priority_set_direct(session._c_object,

1669

priority, None))

2153

gnutls.priority_set_direct(session._c_object, priority,

2154

None)

1670

2155

1671

2156

# Start communication using the Mandos protocol

1672

2157

# Get protocol number

1674

2159

logger.debug("Protocol version: %r", line)

1675

2160

try:

1676

2161

if int(line.strip().split()[0]) > 1:

1677

raise RuntimeError

2162

raise RuntimeError(line)

1678

2163

except (ValueError, IndexError, RuntimeError) as error:

1679

2164

logger.error("Unknown protocol version: %s", error)

1680

2165

return

1682

2167

# Start GnuTLS connection

1683

2168

try:

1684

2169

session.handshake()

1685

except gnutls.errors.GNUTLSError as error:

2170

except gnutls.Error as error:

1686

2171

logger.warning("Handshake failed: %s", error)

1687

2172

# Do not run session.bye() here: the session is not

1688

2173

# established. Just abandon the request.

1692

2177

approval_required = False

1693

2178

try:

1694

2179

try:

1695

fpr = self.fingerprint(self.peer_certificate

1696

(session))

1697

except (TypeError,

1698

gnutls.errors.GNUTLSError) as error:

2180

fpr = self.fingerprint(

2181

self.peer_certificate(session))

2182

except (TypeError, gnutls.Error) as error:

1699

2183

logger.warning("Bad certificate: %s", error)

1700

2184

return

1701

2185

logger.debug("Fingerprint: %s", fpr)

1714

2198

while True:

1715

2199

if not client.enabled:

1716

2200

logger.info("Client %s is disabled",

1717

client.name)

2201

client.name)

1718

2202

if self.server.use_dbus:

1719

2203

# Emit D-Bus signal

1720

2204

client.Rejected("Disabled")

1729

2213

if self.server.use_dbus:

1730

2214

# Emit D-Bus signal

1731

2215

client.NeedApproval(

1732

client.approval_delay_milliseconds(),

1733

client.approved_by_default)

2216

client.approval_delay.total_seconds()

2217

* 1000, client.approved_by_default)

1734

2218

else:

1735

2219

logger.warning("Client %s was not approved",

1736

2220

client.name)

1742

2226

#wait until timeout or approved

1743

2227

time = datetime.datetime.now()

1744

2228

client.changedstate.acquire()

1745

client.changedstate.wait(

1746

float(timedelta_to_milliseconds(delay)

1747

/ 1000))

2229

client.changedstate.wait(delay.total_seconds())

1748

2230

client.changedstate.release()

1749

2231

time2 = datetime.datetime.now()

1750

2232

if (time2 - time) >= delay:

1761

2243

else:

1762

2244

delay -= time2 - time

1763

2245

1764

sent_size = 0

1765

while sent_size < len(client.secret):

1766

try:

1767

sent = session.send(client.secret[sent_size:])

1768

except gnutls.errors.GNUTLSError as error:

1769

logger.warning("gnutls send failed",

1770

exc_info=error)

1771

return

1772

logger.debug("Sent: %d, remaining: %d",

1773

sent, len(client.secret)

1774

- (sent_size + sent))

1775

sent_size += sent

2246

try:

2247

session.send(client.secret)

2248

except gnutls.Error as error:

2249

logger.warning("gnutls send failed",

2250

exc_info = error)

2251

return

1776

2252

1777

2253

logger.info("Sending secret to %s", client.name)

1778

2254

# bump the timeout using extended_timeout

1786

2262

client.approvals_pending -= 1

1787

2263

try:

1788

2264

session.bye()

1789

except gnutls.errors.GNUTLSError as error:

2265

except gnutls.Error as error:

1790

2266

logger.warning("GnuTLS bye failed",

1791

2267

exc_info=error)

1792

2268

1794

2270

def peer_certificate(session):

1795

2271

"Return the peer's OpenPGP certificate as a bytestring"

1796

2272

# If not an OpenPGP certificate...

1797

if (gnutls.library.functions

1798

.gnutls_certificate_type_get(session._c_object)

1799

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1800

# ...do the normal thing

1801

return session.peer_certificate

2273

if (gnutls.certificate_type_get(session._c_object)

2274

!= gnutls.CRT_OPENPGP):

2275

# ...return invalid data

2276

return b""

1802

2277

list_size = ctypes.c_uint(1)

1803

cert_list = (gnutls.library.functions

1804

.gnutls_certificate_get_peers

2278

cert_list = (gnutls.certificate_get_peers

1805

2279

(session._c_object, ctypes.byref(list_size)))

1806

2280

if not bool(cert_list) and list_size.value != 0:

1807

raise gnutls.errors.GNUTLSError("error getting peer"

1808

" certificate")

2281

raise gnutls.Error("error getting peer certificate")

1809

2282

if list_size.value == 0:

1810

2283

return None

1811

2284

cert = cert_list[0]

1815

2288

def fingerprint(openpgp):

1816

2289

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1817

2290

# New GnuTLS "datum" with the OpenPGP public key

1818

datum = (gnutls.library.types

1819

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1820

ctypes.POINTER

1821

(ctypes.c_ubyte)),

1822

ctypes.c_uint(len(openpgp))))

2291

datum = gnutls.datum_t(

2292

ctypes.cast(ctypes.c_char_p(openpgp),

2293

ctypes.POINTER(ctypes.c_ubyte)),

2294

ctypes.c_uint(len(openpgp)))

1823

2295

# New empty GnuTLS certificate

1824

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1825

(gnutls.library.functions

1826

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2296

crt = gnutls.openpgp_crt_t()

2297

gnutls.openpgp_crt_init(ctypes.byref(crt))

1827

2298

# Import the OpenPGP public key into the certificate

1828

(gnutls.library.functions

1829

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1830

gnutls.library.constants

1831

.GNUTLS_OPENPGP_FMT_RAW))

2299

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2300

gnutls.OPENPGP_FMT_RAW)

1832

2301

# Verify the self signature in the key

1833

2302

crtverify = ctypes.c_uint()

1834

(gnutls.library.functions

1835

.gnutls_openpgp_crt_verify_self(crt, 0,

1836

ctypes.byref(crtverify)))

2303

gnutls.openpgp_crt_verify_self(crt, 0,

2304

ctypes.byref(crtverify))

1837

2305

if crtverify.value != 0:

1838

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1839

raise (gnutls.errors.CertificateSecurityError

1840

("Verify failed"))

2306

gnutls.openpgp_crt_deinit(crt)

2307

raise gnutls.CertificateSecurityError("Verify failed")

1841

2308

# New buffer for the fingerprint

1842

2309

buf = ctypes.create_string_buffer(20)

1843

2310

buf_len = ctypes.c_size_t()

1844

2311

# Get the fingerprint from the certificate into the buffer

1845

(gnutls.library.functions

1846

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1847

ctypes.byref(buf_len)))

2312

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2313

ctypes.byref(buf_len))

1848

2314

# Deinit the certificate

1849

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2315

gnutls.openpgp_crt_deinit(crt)

1850

2316

# Convert the buffer to a Python bytestring

1851

2317

fpr = ctypes.string_at(buf, buf_len.value)

1852

2318

# Convert the bytestring to hexadecimal notation

1856

2322

1857

2323

class MultiprocessingMixIn(object):

1858

2324

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2325

1859

2326

def sub_process_main(self, request, address):

1860

2327

try:

1861

2328

self.finish_request(request, address)

1873

2340

1874

2341

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1875

2342

""" adds a pipe to the MixIn """

2343

1876

2344

def process_request(self, request, client_address):

1877

2345

"""Overrides and wraps the original process_request().

1878

2346

1887

2355

1888

2356

def add_pipe(self, parent_pipe, proc):

1889

2357

"""Dummy function; override as necessary"""

1890

raise NotImplementedError

2358

raise NotImplementedError()

1891

2359

1892

2360

1893

2361

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1899

2367

interface: None or a network interface name (string)

1900

2368

use_ipv6: Boolean; to use IPv6 or not

1901

2369

"""

2370

1902

2371

def __init__(self, server_address, RequestHandlerClass,

1903

interface=None, use_ipv6=True, socketfd=None):

2372

interface=None,

2373

use_ipv6=True,

2374

socketfd=None):

1904

2375

"""If socketfd is set, use that file descriptor instead of

1905

2376

creating a new one with socket.socket().

1906

2377

"""

1947

2418

self.interface)

1948

2419

else:

1949

2420

try:

1950

self.socket.setsockopt(socket.SOL_SOCKET,

1951

SO_BINDTODEVICE,

1952

str(self.interface + '\0'))

2421

self.socket.setsockopt(

2422

socket.SOL_SOCKET, SO_BINDTODEVICE,

2423

(self.interface + "\0").encode("utf-8"))

1953

2424

except socket.error as error:

1954

2425

if error.errno == errno.EPERM:

1955

2426

logger.error("No permission to bind to"

1969

2440

if self.address_family == socket.AF_INET6:

1970

2441

any_address = "::" # in6addr_any

1971

2442

else:

1972

any_address = socket.INADDR_ANY

2443

any_address = "0.0.0.0" # INADDR_ANY

1973

2444

self.server_address = (any_address,

1974

2445

self.server_address[1])

1975

2446

elif not self.server_address[1]:

1976

self.server_address = (self.server_address[0],

1977

0)

2447

self.server_address = (self.server_address[0], 0)

1978

2448

# if self.interface:

1979

2449

# self.server_address = (self.server_address[0],

1980

2450

# 0, # port

1992

2462

gnutls_priority GnuTLS priority string

1993

2463

use_dbus: Boolean; to emit D-Bus signals or not

1994

2464

1995

Assumes a gobject.MainLoop event loop.

2465

Assumes a GObject.MainLoop event loop.

1996

2466

"""

2467

1997

2468

def __init__(self, server_address, RequestHandlerClass,

1998

interface=None, use_ipv6=True, clients=None,

1999

gnutls_priority=None, use_dbus=True, socketfd=None):

2469

interface=None,

2470

use_ipv6=True,

2471

clients=None,

2472

gnutls_priority=None,

2473

use_dbus=True,

2474

socketfd=None):

2000

2475

self.enabled = False

2001

2476

self.clients = clients

2002

2477

if self.clients is None:

2008

2483

interface = interface,

2009

2484

use_ipv6 = use_ipv6,

2010

2485

socketfd = socketfd)

2486

2011

2487

def server_activate(self):

2012

2488

if self.enabled:

2013

2489

return socketserver.TCPServer.server_activate(self)

2017

2493

2018

2494

def add_pipe(self, parent_pipe, proc):

2019

2495

# Call "handle_ipc" for both data and EOF events

2020

gobject.io_add_watch(parent_pipe.fileno(),

2021

gobject.IO_IN | gobject.IO_HUP,

2022

functools.partial(self.handle_ipc,

2023

parent_pipe =

2024

parent_pipe,

2025

proc = proc))

2496

GObject.io_add_watch(

2497

parent_pipe.fileno(),

2498

GObject.IO_IN | GObject.IO_HUP,

2499

functools.partial(self.handle_ipc,

2500

parent_pipe = parent_pipe,

2501

proc = proc))

2026

2502

2027

def handle_ipc(self, source, condition, parent_pipe=None,

2028

proc = None, client_object=None):

2503

def handle_ipc(self, source, condition,

2504

parent_pipe=None,

2505

proc = None,

2506

client_object=None):

2029

2507

# error, or the other end of multiprocessing.Pipe has closed

2030

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2508

if condition & (GObject.IO_ERR | GObject.IO_HUP):

2031

2509

# Wait for other process to exit

2032

2510

proc.join()

2033

2511

return False

2054

2532

parent_pipe.send(False)

2055

2533

return False

2056

2534

2057

gobject.io_add_watch(parent_pipe.fileno(),

2058

gobject.IO_IN | gobject.IO_HUP,

2059

functools.partial(self.handle_ipc,

2060

parent_pipe =

2061

parent_pipe,

2062

proc = proc,

2063

client_object =

2064

client))

2535

GObject.io_add_watch(

2536

parent_pipe.fileno(),

2537

GObject.IO_IN | GObject.IO_HUP,

2538

functools.partial(self.handle_ipc,

2539

parent_pipe = parent_pipe,

2540

proc = proc,

2541

client_object = client))

2065

2542

parent_pipe.send(True)

2066

2543

# remove the old hook in favor of the new above hook on

2067

2544

# same fileno

2073

2550

2074

2551

parent_pipe.send(('data', getattr(client_object,

2075

2552

funcname)(*args,

2076

**kwargs)))

2553

**kwargs)))

2077

2554

2078

2555

if command == 'getattr':

2079

2556

attrname = request[1]

2080

if callable(client_object.__getattribute__(attrname)):

2081

parent_pipe.send(('function',))

2557

if isinstance(client_object.__getattribute__(attrname),

2558

collections.Callable):

2559

parent_pipe.send(('function', ))

2082

2560

else:

2083

parent_pipe.send(('data', client_object

2084

.__getattribute__(attrname)))

2561

parent_pipe.send((

2562

'data', client_object.__getattribute__(attrname)))

2085

2563

2086

2564

if command == 'setattr':

2087

2565

attrname = request[1]

2118

2596

# avoid excessive use of external libraries.

2119

2597

2120

2598

# New type for defining tokens, syntax, and semantics all-in-one

2121

Token = collections.namedtuple("Token",

2122

("regexp", # To match token; if

2123

# "value" is not None,

2124

# must have a "group"

2125

# containing digits

2126

"value", # datetime.timedelta or

2127

# None

2128

"followers")) # Tokens valid after

2129

# this token

2599

Token = collections.namedtuple("Token", (

2600

"regexp", # To match token; if "value" is not None, must have

2601

# a "group" containing digits

2602

"value", # datetime.timedelta or None

2603

"followers")) # Tokens valid after this token

2130

2604

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2131

2605

# the "duration" ABNF definition in RFC 3339, Appendix A.

2132

2606

token_end = Token(re.compile(r"$"), None, frozenset())

2133

2607

token_second = Token(re.compile(r"(\d+)S"),

2134

2608

datetime.timedelta(seconds=1),

2135

frozenset((token_end,)))

2609

frozenset((token_end, )))

2136

2610

token_minute = Token(re.compile(r"(\d+)M"),

2137

2611

datetime.timedelta(minutes=1),

2138

2612

frozenset((token_second, token_end)))

2154

2628

frozenset((token_month, token_end)))

2155

2629

token_week = Token(re.compile(r"(\d+)W"),

2156

2630

datetime.timedelta(weeks=1),

2157

frozenset((token_end,)))

2631

frozenset((token_end, )))

2158

2632

token_duration = Token(re.compile(r"P"), None,

2159

2633

frozenset((token_year, token_month,

2160

2634

token_day, token_time,

2161

token_week))),

2635

token_week)))

2162

2636

# Define starting values

2163

2637

value = datetime.timedelta() # Value so far

2164

2638

found_token = None

2165

followers = frozenset(token_duration,) # Following valid tokens

2639

followers = frozenset((token_duration, )) # Following valid tokens

2166

2640

s = duration # String left to parse

2167

2641

# Loop until end token is found

2168

2642

while found_token is not token_end:

2185

2659

break

2186

2660

else:

2187

2661

# No currently valid tokens were found

2188

raise ValueError("Invalid RFC 3339 duration")

2662

raise ValueError("Invalid RFC 3339 duration: {!r}"

2663

.format(duration))

2189

2664

# End token found

2190

2665

return value

2191

2666

2215

2690

timevalue = datetime.timedelta(0)

2216

2691

for s in interval.split():

2217

2692

try:

2218

suffix = unicode(s[-1])

2693

suffix = s[-1]

2219

2694

value = int(s[:-1])

2220

2695

if suffix == "d":

2221

2696

delta = datetime.timedelta(value)

2228

2703

elif suffix == "w":

2229

2704

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2230

2705

else:

2231

raise ValueError("Unknown suffix {0!r}"

2232

.format(suffix))

2233

except (ValueError, IndexError) as e:

2706

raise ValueError("Unknown suffix {!r}".format(suffix))

2707

except IndexError as e:

2234

2708

raise ValueError(*(e.args))

2235

2709

timevalue += delta

2236

2710

return timevalue

2252

2726

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2253

2727

if not stat.S_ISCHR(os.fstat(null).st_mode):

2254

2728

raise OSError(errno.ENODEV,

2255

"{0} not a character device"

2729

"{} not a character device"

2256

2730

.format(os.devnull))

2257

2731

os.dup2(null, sys.stdin.fileno())

2258

2732

os.dup2(null, sys.stdout.fileno())

2268

2742

2269

2743

parser = argparse.ArgumentParser()

2270

2744

parser.add_argument("-v", "--version", action="version",

2271

version = "%(prog)s {0}".format(version),

2745

version = "%(prog)s {}".format(version),

2272

2746

help="show version number and exit")

2273

2747

parser.add_argument("-i", "--interface", metavar="IF",

2274

2748

help="Bind to interface IF")

2280

2754

help="Run self-test")

2281

2755

parser.add_argument("--debug", action="store_true",

2282

2756

help="Debug mode; run in foreground and log"

2283

" to terminal")

2757

" to terminal", default=None)

2284

2758

parser.add_argument("--debuglevel", metavar="LEVEL",

2285

2759

help="Debug level for stdout output")

2286

2760

parser.add_argument("--priority", help="GnuTLS"

2293

2767

" files")

2294

2768

parser.add_argument("--no-dbus", action="store_false",

2295

2769

dest="use_dbus", help="Do not provide D-Bus"

2296

" system bus interface")

2770

" system bus interface", default=None)

2297

2771

parser.add_argument("--no-ipv6", action="store_false",

2298

dest="use_ipv6", help="Do not use IPv6")

2772

dest="use_ipv6", help="Do not use IPv6",

2773

default=None)

2299

2774

parser.add_argument("--no-restore", action="store_false",

2300

2775

dest="restore", help="Do not restore stored"

2301

" state")

2776

" state", default=None)

2302

2777

parser.add_argument("--socket", type=int,

2303

2778

help="Specify a file descriptor to a network"

2304

2779

" socket to use instead of creating one")

2305

2780

parser.add_argument("--statedir", metavar="DIR",

2306

2781

help="Directory to save/restore state in")

2307

2782

parser.add_argument("--foreground", action="store_true",

2308

help="Run in foreground")

2783

help="Run in foreground", default=None)

2784

parser.add_argument("--no-zeroconf", action="store_false",

2785

dest="zeroconf", help="Do not use Zeroconf",

2786

default=None)

2309

2787

2310

2788

options = parser.parse_args()

2311

2789

2312

2790

if options.check:

2313

2791

import doctest

2314

doctest.testmod()

2315

sys.exit()

2792

fail_count, test_count = doctest.testmod()

2793

sys.exit(os.EX_OK if fail_count == 0 else 1)

2316

2794

2317

2795

# Default values for config file for server-global settings

2318

2796

server_defaults = { "interface": "",

2320

2798

"port": "",

2321

2799

"debug": "False",

2322

2800

"priority":

2323

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2801

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2802

":+SIGN-DSA-SHA256",

2324

2803

"servicename": "Mandos",

2325

2804

"use_dbus": "True",

2326

2805

"use_ipv6": "True",

2329

2808

"socket": "",

2330

2809

"statedir": "/var/lib/mandos",

2331

2810

"foreground": "False",

2332

}

2811

"zeroconf": "True",

2812

}

2333

2813

2334

2814

# Parse config file for server-global settings

2335

2815

server_config = configparser.SafeConfigParser(server_defaults)

2336

2816

del server_defaults

2337

server_config.read(os.path.join(options.configdir,

2338

"mandos.conf"))

2817

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2339

2818

# Convert the SafeConfigParser object to a dict

2340

2819

server_settings = server_config.defaults()

2341

2820

# Use the appropriate methods on the non-string config options

2359

2838

# Override the settings from the config file with command line

2360

2839

# options, if set.

2361

2840

for option in ("interface", "address", "port", "debug",

2362

"priority", "servicename", "configdir",

2363

"use_dbus", "use_ipv6", "debuglevel", "restore",

2364

"statedir", "socket", "foreground"):

2841

"priority", "servicename", "configdir", "use_dbus",

2842

"use_ipv6", "debuglevel", "restore", "statedir",

2843

"socket", "foreground", "zeroconf"):

2365

2844

value = getattr(options, option)

2366

2845

if value is not None:

2367

2846

server_settings[option] = value

2368

2847

del options

2369

2848

# Force all strings to be unicode

2370

2849

for option in server_settings.keys():

2371

if type(server_settings[option]) is str:

2372

server_settings[option] = unicode(server_settings[option])

2850

if isinstance(server_settings[option], bytes):

2851

server_settings[option] = (server_settings[option]

2852

.decode("utf-8"))

2853

# Force all boolean options to be boolean

2854

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2855

"foreground", "zeroconf"):

2856

server_settings[option] = bool(server_settings[option])

2373

2857

# Debug implies foreground

2374

2858

if server_settings["debug"]:

2375

2859

server_settings["foreground"] = True

2377

2861

2378

2862

##################################################################

2379

2863

2864

if (not server_settings["zeroconf"]

2865

and not (server_settings["port"]

2866

or server_settings["socket"] != "")):

2867

parser.error("Needs port or socket to work without Zeroconf")

2868

2380

2869

# For convenience

2381

2870

debug = server_settings["debug"]

2382

2871

debuglevel = server_settings["debuglevel"]

2385

2874

stored_state_path = os.path.join(server_settings["statedir"],

2386

2875

stored_state_file)

2387

2876

foreground = server_settings["foreground"]

2877

zeroconf = server_settings["zeroconf"]

2388

2878

2389

2879

if debug:

2390

2880

initlogger(debug, logging.DEBUG)

2396

2886

initlogger(debug, level)

2397

2887

2398

2888

if server_settings["servicename"] != "Mandos":

2399

syslogger.setFormatter(logging.Formatter

2400

('Mandos ({0}) [%(process)d]:'

2401

' %(levelname)s: %(message)s'

2402

.format(server_settings

2403

["servicename"])))

2889

syslogger.setFormatter(

2890

logging.Formatter('Mandos ({}) [%(process)d]:'

2891

' %(levelname)s: %(message)s'.format(

2892

server_settings["servicename"])))

2404

2893

2405

2894

# Parse config file with clients

2406

2895

client_config = configparser.SafeConfigParser(Client

2411

2900

global mandos_dbus_service

2412

2901

mandos_dbus_service = None

2413

2902

2414

tcp_server = MandosServer((server_settings["address"],

2415

server_settings["port"]),

2416

ClientHandler,

2417

interface=(server_settings["interface"]

2418

or None),

2419

use_ipv6=use_ipv6,

2420

gnutls_priority=

2421

server_settings["priority"],

2422

use_dbus=use_dbus,

2423

socketfd=(server_settings["socket"]

2424

or None))

2903

socketfd = None

2904

if server_settings["socket"] != "":

2905

socketfd = server_settings["socket"]

2906

tcp_server = MandosServer(

2907

(server_settings["address"], server_settings["port"]),

2908

ClientHandler,

2909

interface=(server_settings["interface"] or None),

2910

use_ipv6=use_ipv6,

2911

gnutls_priority=server_settings["priority"],

2912

use_dbus=use_dbus,

2913

socketfd=socketfd)

2425

2914

if not foreground:

2426

pidfilename = "/var/run/mandos.pid"

2915

pidfilename = "/run/mandos.pid"

2916

if not os.path.isdir("/run/."):

2917

pidfilename = "/var/run/mandos.pid"

2427

2918

pidfile = None

2428

2919

try:

2429

pidfile = open(pidfilename, "w")

2920

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2430

2921

except IOError as e:

2431

2922

logger.error("Could not open file %r", pidfilename,

2432

2923

exc_info=e)

2433

2924

2434

for name in ("_mandos", "mandos", "nobody"):

2925

for name, group in (("_mandos", "_mandos"),

2926

("mandos", "mandos"),

2927

("nobody", "nogroup")):

2435

2928

try:

2436

2929

uid = pwd.getpwnam(name).pw_uid

2437

gid = pwd.getpwnam(name).pw_gid

2930

gid = pwd.getpwnam(group).pw_gid

2438

2931

break

2439

2932

except KeyError:

2440

2933

continue

2446

2939

os.setuid(uid)

2447

2940

except OSError as error:

2448

2941

if error.errno != errno.EPERM:

2449

raise error

2942

raise

2450

2943

2451

2944

if debug:

2452

2945

# Enable all possible GnuTLS debugging

2453

2946

2454

2947

# "Use a log level over 10 to enable all debugging options."

2455

2948

# - GnuTLS manual

2456

gnutls.library.functions.gnutls_global_set_log_level(11)

2949

gnutls.global_set_log_level(11)

2457

2950

2458

@gnutls.library.types.gnutls_log_func

2951

@gnutls.log_func

2459

2952

def debug_gnutls(level, string):

2460

2953

logger.debug("GnuTLS: %s", string[:-1])

2461

2954

2462

(gnutls.library.functions

2463

.gnutls_global_set_log_function(debug_gnutls))

2955

gnutls.global_set_log_function(debug_gnutls)

2464

2956

2465

2957

# Redirect stdin so all checkers get /dev/null

2466

2958

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2473

2965

# Close all input and output, do double fork, etc.

2474

2966

daemon()

2475

2967

2476

# multiprocessing will use threads, so before we use gobject we

2477

# need to inform gobject that threads will be used.

2478

gobject.threads_init()

2968

# multiprocessing will use threads, so before we use GObject we

2969

# need to inform GObject that threads will be used.

2970

GObject.threads_init()

2479

2971

2480

2972

global main_loop

2481

2973

# From the Avahi example code

2482

2974

DBusGMainLoop(set_as_default=True)

2483

main_loop = gobject.MainLoop()

2975

main_loop = GObject.MainLoop()

2484

2976

bus = dbus.SystemBus()

2485

2977

# End of Avahi example code

2486

2978

if use_dbus:

2487

2979

try:

2488

2980

bus_name = dbus.service.BusName("se.recompile.Mandos",

2489

bus, do_not_queue=True)

2490

old_bus_name = (dbus.service.BusName

2491

("se.bsnet.fukt.Mandos", bus,

2492

do_not_queue=True))

2493

except dbus.exceptions.NameExistsException as e:

2981

bus,

2982

do_not_queue=True)

2983

old_bus_name = dbus.service.BusName(

2984

"se.bsnet.fukt.Mandos", bus,

2985

do_not_queue=True)

2986

except dbus.exceptions.DBusException as e:

2494

2987

logger.error("Disabling D-Bus:", exc_info=e)

2495

2988

use_dbus = False

2496

2989

server_settings["use_dbus"] = False

2497

2990

tcp_server.use_dbus = False

2498

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2499

service = AvahiServiceToSyslog(name =

2500

server_settings["servicename"],

2501

servicetype = "_mandos._tcp",

2502

protocol = protocol, bus = bus)

2503

if server_settings["interface"]:

2504

service.interface = (if_nametoindex

2505

(str(server_settings["interface"])))

2991

if zeroconf:

2992

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2993

service = AvahiServiceToSyslog(

2994

name = server_settings["servicename"],

2995

servicetype = "_mandos._tcp",

2996

protocol = protocol,

2997

bus = bus)

2998

if server_settings["interface"]:

2999

service.interface = if_nametoindex(

3000

server_settings["interface"].encode("utf-8"))

2506

3001

2507

3002

global multiprocessing_manager

2508

3003

multiprocessing_manager = multiprocessing.Manager()

2515

3010

old_client_settings = {}

2516

3011

clients_data = {}

2517

3012

3013

# This is used to redirect stdout and stderr for checker processes

3014

global wnull

3015

wnull = open(os.devnull, "w") # A writable /dev/null

3016

# Only used if server is running in foreground but not in debug

3017

# mode

3018

if debug or not foreground:

3019

wnull.close()

3020

2518

3021

# Get client data and settings from last running state.

2519

3022

if server_settings["restore"]:

2520

3023

try:

2521

3024

with open(stored_state_path, "rb") as stored_state:

2522

clients_data, old_client_settings = (pickle.load

2523

(stored_state))

3025

clients_data, old_client_settings = pickle.load(

3026

stored_state)

2524

3027

os.remove(stored_state_path)

2525

3028

except IOError as e:

2526

3029

if e.errno == errno.ENOENT:

2527

logger.warning("Could not load persistent state: {0}"

2528

.format(os.strerror(e.errno)))

3030

logger.warning("Could not load persistent state:"

3031

" {}".format(os.strerror(e.errno)))

2529

3032

else:

2530

3033

logger.critical("Could not load persistent state:",

2531

3034

exc_info=e)

2532

3035

raise

2533

3036

except EOFError as e:

2534

3037

logger.warning("Could not load persistent state: "

2535

"EOFError:", exc_info=e)

3038

"EOFError:",

3039

exc_info=e)

2536

3040

2537

3041

with PGPEngine() as pgp:

2538

for client_name, client in clients_data.iteritems():

3042

for client_name, client in clients_data.items():

3043

# Skip removed clients

3044

if client_name not in client_settings:

3045

continue

3046

2539

3047

# Decide which value to use after restoring saved state.

2540

3048

# We have three different values: Old config file,

2541

3049

# new config file, and saved state.

2546

3054

# For each value in new config, check if it

2547

3055

# differs from the old config value (Except for

2548

3056

# the "secret" attribute)

2549

if (name != "secret" and

2550

value != old_client_settings[client_name]

2551

[name]):

3057

if (name != "secret"

3058

and (value !=

3059

old_client_settings[client_name][name])):

2552

3060

client[name] = value

2553

3061

except KeyError:

2554

3062

pass

2555

3063

2556

3064

# Clients who has passed its expire date can still be

2557

# enabled if its last checker was successful. Clients

3065

# enabled if its last checker was successful. A Client

2558

3066

# whose checker succeeded before we stored its state is

2559

3067

# assumed to have successfully run all checkers during

2560

3068

# downtime.

2562

3070

if datetime.datetime.utcnow() >= client["expires"]:

2563

3071

if not client["last_checked_ok"]:

2564

3072

logger.warning(

2565

"disabling client {0} - Client never "

2566

"performed a successful checker"

2567

.format(client_name))

3073

"disabling client {} - Client never "

3074

"performed a successful checker".format(

3075

client_name))

2568

3076

client["enabled"] = False

2569

3077

elif client["last_checker_status"] != 0:

2570

3078

logger.warning(

2571

"disabling client {0} - Client "

2572

"last checker failed with error code {1}"

2573

.format(client_name,

2574

client["last_checker_status"]))

3079

"disabling client {} - Client last"

3080

" checker failed with error code"

3081

" {}".format(

3082

client_name,

3083

client["last_checker_status"]))

2575

3084

client["enabled"] = False

2576

3085

else:

2577

client["expires"] = (datetime.datetime

2578

.utcnow()

2579

+ client["timeout"])

3086

client["expires"] = (

3087

datetime.datetime.utcnow()

3088

+ client["timeout"])

2580

3089

logger.debug("Last checker succeeded,"

2581

" keeping {0} enabled"

2582

.format(client_name))

3090

" keeping {} enabled".format(

3091

client_name))

2583

3092

try:

2584

client["secret"] = (

2585

pgp.decrypt(client["encrypted_secret"],

2586

client_settings[client_name]

2587

["secret"]))

3093

client["secret"] = pgp.decrypt(

3094

client["encrypted_secret"],

3095

client_settings[client_name]["secret"])

2588

3096

except PGPError:

2589

3097

# If decryption fails, we use secret from new settings

2590

logger.debug("Failed to decrypt {0} old secret"

2591

.format(client_name))

2592

client["secret"] = (

2593

client_settings[client_name]["secret"])

3098

logger.debug("Failed to decrypt {} old secret".format(

3099

client_name))

3100

client["secret"] = (client_settings[client_name]

3101

["secret"])

2594

3102

2595

3103

# Add/remove clients based on new changes made to config

2596

3104

for client_name in (set(old_client_settings)

2601

3109

clients_data[client_name] = client_settings[client_name]

2602

3110

2603

3111

# Create all client objects

2604

for client_name, client in clients_data.iteritems():

3112

for client_name, client in clients_data.items():

2605

3113

tcp_server.clients[client_name] = client_class(

2606

name = client_name, settings = client)

3114

name = client_name,

3115

settings = client,

3116

server_settings = server_settings)

2607

3117

2608

3118

if not tcp_server.clients:

2609

3119

logger.warning("No clients defined")

2610

3120

2611

3121

if not foreground:

2612

3122

if pidfile is not None:

3123

pid = os.getpid()

2613

3124

try:

2614

3125

with pidfile:

2615

pid = os.getpid()

2616

pidfile.write(str(pid) + "\n".encode("utf-8"))

3126

print(pid, file=pidfile)

2617

3127

except IOError:

2618

3128

logger.error("Could not write to file %r with PID %d",

2619

3129

pidfilename, pid)

2624

3134

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2625

3135

2626

3136

if use_dbus:

2627

@alternate_dbus_interfaces({"se.recompile.Mandos":

2628

"se.bsnet.fukt.Mandos"})

2629

class MandosDBusService(DBusObjectWithProperties):

3137

3138

@alternate_dbus_interfaces(

3139

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3140

class MandosDBusService(DBusObjectWithObjectManager):

2630

3141

"""A D-Bus proxy object"""

3142

2631

3143

def __init__(self):

2632

3144

dbus.service.Object.__init__(self, bus, "/")

3145

2633

3146

_interface = "se.recompile.Mandos"

2634

3147

2635

@dbus_interface_annotations(_interface)

2636

def _foo(self):

2637

return { "org.freedesktop.DBus.Property"

2638

".EmitsChangedSignal":

2639

"false"}

2640

2641

3148

@dbus.service.signal(_interface, signature="o")

2642

3149

def ClientAdded(self, objpath):

2643

3150

"D-Bus signal"

2648

3155

"D-Bus signal"

2649

3156

pass

2650

3157

3158

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3159

"true"})

2651

3160

@dbus.service.signal(_interface, signature="os")

2652

3161

def ClientRemoved(self, objpath, name):

2653

3162

"D-Bus signal"

2654

3163

pass

2655

3164

3165

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3166

"true"})

2656

3167

@dbus.service.method(_interface, out_signature="ao")

2657

3168

def GetAllClients(self):

2658

3169

"D-Bus method"

2659

return dbus.Array(c.dbus_object_path

2660

for c in

3170

return dbus.Array(c.dbus_object_path for c in

2661

3171

tcp_server.clients.itervalues())

2662

3172

3173

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3174

"true"})

2663

3175

@dbus.service.method(_interface,

2664

3176

out_signature="a{oa{sv}}")

2665

3177

def GetAllClientsWithProperties(self):

2666

3178

"D-Bus method"

2667

3179

return dbus.Dictionary(

2668

((c.dbus_object_path, c.GetAll(""))

2669

for c in tcp_server.clients.itervalues()),

3180

{ c.dbus_object_path: c.GetAll(

3181

"se.recompile.Mandos.Client")

3182

for c in tcp_server.clients.itervalues() },

2670

3183

signature="oa{sv}")

2671

3184

2672

3185

@dbus.service.method(_interface, in_signature="o")

2676

3189

if c.dbus_object_path == object_path:

2677

3190

del tcp_server.clients[c.name]

2678

3191

c.remove_from_connection()

2679

# Don't signal anything except ClientRemoved

3192

# Don't signal the disabling

2680

3193

c.disable(quiet=True)

2681

# Emit D-Bus signal

2682

self.ClientRemoved(object_path, c.name)

3194

# Emit D-Bus signal for removal

3195

self.client_removed_signal(c)

2683

3196

return

2684

3197

raise KeyError(object_path)

2685

3198

2686

3199

del _interface

3200

3201

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3202

out_signature = "a{oa{sa{sv}}}")

3203

def GetManagedObjects(self):

3204

"""D-Bus method"""

3205

return dbus.Dictionary(

3206

{ client.dbus_object_path:

3207

dbus.Dictionary(

3208

{ interface: client.GetAll(interface)

3209

for interface in

3210

client._get_all_interface_names()})

3211

for client in tcp_server.clients.values()})

3212

3213

def client_added_signal(self, client):

3214

"""Send the new standard signal and the old signal"""

3215

if use_dbus:

3216

# New standard signal

3217

self.InterfacesAdded(

3218

client.dbus_object_path,

3219

dbus.Dictionary(

3220

{ interface: client.GetAll(interface)

3221

for interface in

3222

client._get_all_interface_names()}))

3223

# Old signal

3224

self.ClientAdded(client.dbus_object_path)

3225

3226

def client_removed_signal(self, client):

3227

"""Send the new standard signal and the old signal"""

3228

if use_dbus:

3229

# New standard signal

3230

self.InterfacesRemoved(

3231

client.dbus_object_path,

3232

client._get_all_interface_names())

3233

# Old signal

3234

self.ClientRemoved(client.dbus_object_path,

3235

client.name)

2687

3236

2688

3237

mandos_dbus_service = MandosDBusService()

2689

3238

2690

3239

def cleanup():

2691

3240

"Cleanup function; run on exit"

2692

service.cleanup()

3241

if zeroconf:

3242

service.cleanup()

2693

3243

2694

3244

multiprocessing.active_children()

3245

wnull.close()

2695

3246

if not (tcp_server.clients or client_settings):

2696

3247

return

2697

3248

2708

3259

2709

3260

# A list of attributes that can not be pickled

2710

3261

# + secret.

2711

exclude = set(("bus", "changedstate", "secret",

2712

"checker"))

2713

for name, typ in (inspect.getmembers

2714

(dbus.service.Object)):

3262

exclude = { "bus", "changedstate", "secret",

3263

"checker", "server_settings" }

3264

for name, typ in inspect.getmembers(dbus.service

3265

.Object):

2715

3266

exclude.add(name)

2716

3267

2717

3268

client_dict["encrypted_secret"] = (client

2724

3275

del client_settings[client.name]["secret"]

2725

3276

2726

3277

try:

2727

with (tempfile.NamedTemporaryFile

2728

(mode='wb', suffix=".pickle", prefix='clients-',

2729

dir=os.path.dirname(stored_state_path),

2730

delete=False)) as stored_state:

3278

with tempfile.NamedTemporaryFile(

3279

mode='wb',

3280

suffix=".pickle",

3281

prefix='clients-',

3282

dir=os.path.dirname(stored_state_path),

3283

delete=False) as stored_state:

2731

3284

pickle.dump((clients, client_settings), stored_state)

2732

tempname=stored_state.name

3285

tempname = stored_state.name

2733

3286

os.rename(tempname, stored_state_path)

2734

3287

except (IOError, OSError) as e:

2735

3288

if not debug:

2738

3291

except NameError:

2739

3292

pass

2740

3293

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2741

logger.warning("Could not save persistent state: {0}"

3294

logger.warning("Could not save persistent state: {}"

2742

3295

.format(os.strerror(e.errno)))

2743

3296

else:

2744

3297

logger.warning("Could not save persistent state:",

2745

3298

exc_info=e)

2746

raise e

3299

raise

2747

3300

2748

3301

# Delete all clients, and settings from config

2749

3302

while tcp_server.clients:

2750

3303

name, client = tcp_server.clients.popitem()

2751

3304

if use_dbus:

2752

3305

client.remove_from_connection()

2753

# Don't signal anything except ClientRemoved

3306

# Don't signal the disabling

2754

3307

client.disable(quiet=True)

3308

# Emit D-Bus signal for removal

2755

3309

if use_dbus:

2756

# Emit D-Bus signal

2757

mandos_dbus_service.ClientRemoved(client

2758

.dbus_object_path,

2759

client.name)

3310

mandos_dbus_service.client_removed_signal(client)

2760

3311

client_settings.clear()

2761

3312

2762

3313

atexit.register(cleanup)

2763

3314

2764

3315

for client in tcp_server.clients.itervalues():

2765

3316

if use_dbus:

2766

# Emit D-Bus signal

2767

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3317

# Emit D-Bus signal for adding

3318

mandos_dbus_service.client_added_signal(client)

2768

3319

# Need to initiate checking of clients

2769

3320

if client.enabled:

2770

3321

client.init_checker()

2773

3324

tcp_server.server_activate()

2774

3325

2775

3326

# Find out what port we got

2776

service.port = tcp_server.socket.getsockname()[1]

3327

if zeroconf:

3328

service.port = tcp_server.socket.getsockname()[1]

2777

3329

if use_ipv6:

2778

3330

logger.info("Now listening on address %r, port %d,"

2779

3331

" flowinfo %d, scope_id %d",

2785

3337

#service.interface = tcp_server.socket.getsockname()[3]

2786

3338

2787

3339

try:

2788

# From the Avahi example code

2789

try:

2790

service.activate()

2791

except dbus.exceptions.DBusException as error:

2792

logger.critical("D-Bus Exception", exc_info=error)

2793

cleanup()

2794

sys.exit(1)

2795

# End of Avahi example code

3340

if zeroconf:

3341

# From the Avahi example code

3342

try:

3343

service.activate()

3344

except dbus.exceptions.DBusException as error:

3345

logger.critical("D-Bus Exception", exc_info=error)

3346

cleanup()

3347

sys.exit(1)

3348

# End of Avahi example code

2796

3349

2797

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3350

GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,

2798

3351

lambda *args, **kwargs:

2799

3352

(tcp_server.handle_request

2800

3353

(*args[2:], **kwargs) or True))

2813

3366

# Must run before the D-Bus bus name gets deregistered

2814

3367

cleanup()

2815

3368

3369

2816

3370

if __name__ == '__main__':

2817

3371

main()