/mandos/trunk : revision 829

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

38

41

39

import SocketServer as socketserver

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

40

46

import socket

41

47

import argparse

42

48

import datetime

43

49

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

51

54

import sys

52

55

import re

53

56

import os

62

65

import struct

63

66

import fcntl

64

67

import functools

65

import cPickle as pickle

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

66

72

import multiprocessing

67

73

import types

68

74

import binascii

69

75

import tempfile

70

76

import itertools

71

77

import collections

78

import codecs

72

79

73

80

import dbus

74

81

import dbus.service

75

import gobject

76

import avahi

82

try:

83

from gi.repository import GObject

84

except ImportError:

85

import gobject as GObject

77

86

from dbus.mainloop.glib import DBusGMainLoop

78

87

import ctypes

79

88

import ctypes.util

88

97

except ImportError:

89

98

SO_BINDTODEVICE = None

90

99

91

version = "1.6.0"

100

if sys.version_info.major == 2:

101

str = unicode

102

103

version = "1.7.5"

92

104

stored_state_file = "clients.pickle"

93

105

94

106

logger = logging.getLogger()

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

107

syslogger = None

98

108

99

109

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

110

if_nametoindex = ctypes.cdll.LoadLibrary(

111

ctypes.util.find_library("c")).if_nametoindex

103

112

except (OSError, AttributeError):

113

104

114

def if_nametoindex(interface):

105

115

"Get an interface index the hard way, i.e. using fcntl()"

106

116

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

117

with contextlib.closing(socket.socket()) as s:

108

118

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

119

struct.pack(b"16s16x", interface))

120

interface_index = struct.unpack("I", ifreq[16:20])[0]

113

121

return interface_index

114

122

115

123

124

def copy_function(func):

125

"""Make a copy of a function"""

126

if sys.version_info.major == 2:

127

return types.FunctionType(func.func_code,

128

func.func_globals,

129

func.func_name,

130

func.func_defaults,

131

func.func_closure)

132

else:

133

return types.FunctionType(func.__code__,

134

func.__globals__,

135

func.__name__,

136

func.__defaults__,

137

func.__closure__)

138

139

116

140

def initlogger(debug, level=logging.WARNING):

117

141

"""init logger and add loglevel"""

118

142

143

global syslogger

144

syslogger = (logging.handlers.SysLogHandler(

145

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

146

address = "/dev/log"))

119

147

syslogger.setFormatter(logging.Formatter

120

148

('Mandos [%(process)d]: %(levelname)s:'

121

149

' %(message)s'))

138

166

139

167

class PGPEngine(object):

140

168

"""A simple class for OpenPGP symmetric encryption & decryption"""

169

141

170

def __init__(self):

142

171

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

172

self.gpg = "gpg"

173

try:

174

output = subprocess.check_output(["gpgconf"])

175

for line in output.splitlines():

176

name, text, path = line.split(b":")

177

if name == "gpg":

178

self.gpg = path

179

break

180

except OSError as e:

181

if e.errno != errno.ENOENT:

182

raise

143

183

self.gnupgargs = ['--batch',

144

'--home', self.tempdir,

184

'--homedir', self.tempdir,

145

185

'--force-mdc',

146

186

'--quiet',

147

187

'--no-use-agent']

172

212

def password_encode(self, password):

173

213

# Passphrase can not be empty and can not contain newlines or

174

214

# NUL bytes. So we prefix it and hex encode it.

175

return b"mandos" + binascii.hexlify(password)

215

encoded = b"mandos" + binascii.hexlify(password)

216

if len(encoded) > 2048:

217

# GnuPG can't handle long passwords, so encode differently

218

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

219

.replace(b"\n", b"\\n")

220

.replace(b"\0", b"\\x00"))

221

return encoded

176

222

177

223

def encrypt(self, data, password):

178

224

passphrase = self.password_encode(password)

179

with tempfile.NamedTemporaryFile(dir=self.tempdir

180

) as passfile:

225

with tempfile.NamedTemporaryFile(

226

dir=self.tempdir) as passfile:

181

227

passfile.write(passphrase)

182

228

passfile.flush()

183

proc = subprocess.Popen(['gpg', '--symmetric',

229

proc = subprocess.Popen([self.gpg, '--symmetric',

184

230

'--passphrase-file',

185

231

passfile.name]

186

232

+ self.gnupgargs,

194

240

195

241

def decrypt(self, data, password):

196

242

passphrase = self.password_encode(password)

197

with tempfile.NamedTemporaryFile(dir = self.tempdir

198

) as passfile:

243

with tempfile.NamedTemporaryFile(

244

dir = self.tempdir) as passfile:

199

245

passfile.write(passphrase)

200

246

passfile.flush()

201

proc = subprocess.Popen(['gpg', '--decrypt',

247

proc = subprocess.Popen([self.gpg, '--decrypt',

202

248

'--passphrase-file',

203

249

passfile.name]

204

250

+ self.gnupgargs,

205

251

stdin = subprocess.PIPE,

206

252

stdout = subprocess.PIPE,

207

253

stderr = subprocess.PIPE)

208

decrypted_plaintext, err = proc.communicate(input

209

= data)

254

decrypted_plaintext, err = proc.communicate(input = data)

210

255

if proc.returncode != 0:

211

256

raise PGPError(err)

212

257

return decrypted_plaintext

213

258

259

# Pretend that we have an Avahi module

260

class Avahi(object):

261

"""This isn't so much a class as it is a module-like namespace.

262

It is instantiated once, and simulates having an Avahi module."""

263

IF_UNSPEC = -1 # avahi-common/address.h

264

PROTO_UNSPEC = -1 # avahi-common/address.h

265

PROTO_INET = 0 # avahi-common/address.h

266

PROTO_INET6 = 1 # avahi-common/address.h

267

DBUS_NAME = "org.freedesktop.Avahi"

268

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

269

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

270

DBUS_PATH_SERVER = "/"

271

def string_array_to_txt_array(self, t):

272

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

273

for s in t), signature="ay")

274

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

275

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

276

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

277

SERVER_INVALID = 0 # avahi-common/defs.h

278

SERVER_REGISTERING = 1 # avahi-common/defs.h

279

SERVER_RUNNING = 2 # avahi-common/defs.h

280

SERVER_COLLISION = 3 # avahi-common/defs.h

281

SERVER_FAILURE = 4 # avahi-common/defs.h

282

avahi = Avahi()

214

283

215

284

class AvahiError(Exception):

216

285

def __init__(self, value, *args, **kwargs):

217

286

self.value = value

218

super(AvahiError, self).__init__(value, *args, **kwargs)

219

def __unicode__(self):

220

return unicode(repr(self.value))

287

return super(AvahiError, self).__init__(value, *args,

288

**kwargs)

289

221

290

222

291

class AvahiServiceError(AvahiError):

223

292

pass

224

293

294

225

295

class AvahiGroupError(AvahiError):

226

296

pass

227

297

247

317

bus: dbus.SystemBus()

248

318

"""

249

319

250

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

251

servicetype = None, port = None, TXT = None,

252

domain = "", host = "", max_renames = 32768,

253

protocol = avahi.PROTO_UNSPEC, bus = None):

320

def __init__(self,

321

interface = avahi.IF_UNSPEC,

322

name = None,

323

servicetype = None,

324

port = None,

325

TXT = None,

326

domain = "",

327

host = "",

328

max_renames = 32768,

329

protocol = avahi.PROTO_UNSPEC,

330

bus = None):

254

331

self.interface = interface

255

332

self.name = name

256

333

self.type = servicetype

266

343

self.bus = bus

267

344

self.entry_group_state_changed_match = None

268

345

269

def rename(self):

346

def rename(self, remove=True):

270

347

"""Derived from the Avahi example code"""

271

348

if self.rename_count >= self.max_renames:

272

349

logger.critical("No suitable Zeroconf service name found"

273

350

" after %i retries, exiting.",

274

351

self.rename_count)

275

352

raise AvahiServiceError("Too many renames")

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

353

self.name = str(

354

self.server.GetAlternativeServiceName(self.name))

355

self.rename_count += 1

278

356

logger.info("Changing Zeroconf service name to %r ...",

279

357

self.name)

280

self.remove()

358

if remove:

359

self.remove()

281

360

try:

282

361

self.add()

283

362

except dbus.exceptions.DBusException as error:

284

logger.critical("D-Bus Exception", exc_info=error)

285

self.cleanup()

286

os._exit(1)

287

self.rename_count += 1

363

if (error.get_dbus_name()

364

== "org.freedesktop.Avahi.CollisionError"):

365

logger.info("Local Zeroconf service name collision.")

366

return self.rename(remove=False)

367

else:

368

logger.critical("D-Bus Exception", exc_info=error)

369

self.cleanup()

370

os._exit(1)

288

371

289

372

def remove(self):

290

373

"""Derived from the Avahi example code"""

328

411

self.rename()

329

412

elif state == avahi.ENTRY_GROUP_FAILURE:

330

413

logger.critical("Avahi: Error in group state changed %s",

331

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

333

.format(error))

414

str(error))

415

raise AvahiGroupError("State changed: {!s}".format(error))

334

416

335

417

def cleanup(self):

336

418

"""Derived from the Avahi example code"""

346

428

def server_state_changed(self, state, error=None):

347

429

"""Derived from the Avahi example code"""

348

430

logger.debug("Avahi server state change: %i", state)

349

bad_states = { avahi.SERVER_INVALID:

350

"Zeroconf server invalid",

351

avahi.SERVER_REGISTERING: None,

352

avahi.SERVER_COLLISION:

353

"Zeroconf server name collision",

354

avahi.SERVER_FAILURE:

355

"Zeroconf server failure" }

431

bad_states = {

432

avahi.SERVER_INVALID: "Zeroconf server invalid",

433

avahi.SERVER_REGISTERING: None,

434

avahi.SERVER_COLLISION: "Zeroconf server name collision",

435

avahi.SERVER_FAILURE: "Zeroconf server failure",

436

}

356

437

if state in bad_states:

357

438

if bad_states[state] is not None:

358

439

if error is None:

361

442

logger.error(bad_states[state] + ": %r", error)

362

443

self.cleanup()

363

444

elif state == avahi.SERVER_RUNNING:

364

self.add()

445

try:

446

self.add()

447

except dbus.exceptions.DBusException as error:

448

if (error.get_dbus_name()

449

== "org.freedesktop.Avahi.CollisionError"):

450

logger.info("Local Zeroconf service name"

451

" collision.")

452

return self.rename(remove=False)

453

else:

454

logger.critical("D-Bus Exception", exc_info=error)

455

self.cleanup()

456

os._exit(1)

365

457

else:

366

458

if error is None:

367

459

logger.debug("Unknown state: %r", state)

377

469

follow_name_owner_changes=True),

378

470

avahi.DBUS_INTERFACE_SERVER)

379

471

self.server.connect_to_signal("StateChanged",

380

self.server_state_changed)

472

self.server_state_changed)

381

473

self.server_state_changed(self.server.GetState())

382

474

383

475

384

476

class AvahiServiceToSyslog(AvahiService):

385

def rename(self):

477

def rename(self, *args, **kwargs):

386

478

"""Add the new name to the syslog messages"""

387

ret = AvahiService.rename(self)

388

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

390

' %(levelname)s: %(message)s'

391

.format(self.name)))

479

ret = AvahiService.rename(self, *args, **kwargs)

480

syslogger.setFormatter(logging.Formatter(

481

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

482

.format(self.name)))

392

483

return ret

393

484

394

395

def timedelta_to_milliseconds(td):

396

"Convert a datetime.timedelta() to milliseconds"

397

return ((td.days * 24 * 60 * 60 * 1000)

398

+ (td.seconds * 1000)

399

+ (td.microseconds // 1000))

400

485

# Pretend that we have a GnuTLS module

486

class GnuTLS(object):

487

"""This isn't so much a class as it is a module-like namespace.

488

It is instantiated once, and simulates having a GnuTLS module."""

489

490

_library = ctypes.cdll.LoadLibrary(

491

ctypes.util.find_library("gnutls"))

492

_need_version = b"3.3.0"

493

def __init__(self):

494

# Need to use class name "GnuTLS" here, since this method is

495

# called before the assignment to the "gnutls" global variable

496

# happens.

497

if GnuTLS.check_version(self._need_version) is None:

498

raise GnuTLS.Error("Needs GnuTLS {} or later"

499

.format(self._need_version))

500

501

# Unless otherwise indicated, the constants and types below are

502

# all from the gnutls/gnutls.h C header file.

503

504

# Constants

505

E_SUCCESS = 0

506

E_INTERRUPTED = -52

507

E_AGAIN = -28

508

CRT_OPENPGP = 2

509

CLIENT = 2

510

SHUT_RDWR = 0

511

CRD_CERTIFICATE = 1

512

E_NO_CERTIFICATE_FOUND = -49

513

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

514

515

# Types

516

class session_int(ctypes.Structure):

517

_fields_ = []

518

session_t = ctypes.POINTER(session_int)

519

class certificate_credentials_st(ctypes.Structure):

520

_fields_ = []

521

certificate_credentials_t = ctypes.POINTER(

522

certificate_credentials_st)

523

certificate_type_t = ctypes.c_int

524

class datum_t(ctypes.Structure):

525

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

526

('size', ctypes.c_uint)]

527

class openpgp_crt_int(ctypes.Structure):

528

_fields_ = []

529

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

530

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

531

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

532

credentials_type_t = ctypes.c_int

533

transport_ptr_t = ctypes.c_void_p

534

close_request_t = ctypes.c_int

535

536

# Exceptions

537

class Error(Exception):

538

# We need to use the class name "GnuTLS" here, since this

539

# exception might be raised from within GnuTLS.__init__,

540

# which is called before the assignment to the "gnutls"

541

# global variable has happened.

542

def __init__(self, message = None, code = None, args=()):

543

# Default usage is by a message string, but if a return

544

# code is passed, convert it to a string with

545

# gnutls.strerror()

546

self.code = code

547

if message is None and code is not None:

548

message = GnuTLS.strerror(code)

549

return super(GnuTLS.Error, self).__init__(

550

message, *args)

551

552

class CertificateSecurityError(Error):

553

pass

554

555

# Classes

556

class Credentials(object):

557

def __init__(self):

558

self._c_object = gnutls.certificate_credentials_t()

559

gnutls.certificate_allocate_credentials(

560

ctypes.byref(self._c_object))

561

self.type = gnutls.CRD_CERTIFICATE

562

563

def __del__(self):

564

gnutls.certificate_free_credentials(self._c_object)

565

566

class ClientSession(object):

567

def __init__(self, socket, credentials = None):

568

self._c_object = gnutls.session_t()

569

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

570

gnutls.set_default_priority(self._c_object)

571

gnutls.transport_set_ptr(self._c_object, socket.fileno())

572

gnutls.handshake_set_private_extensions(self._c_object,

573

True)

574

self.socket = socket

575

if credentials is None:

576

credentials = gnutls.Credentials()

577

gnutls.credentials_set(self._c_object, credentials.type,

578

ctypes.cast(credentials._c_object,

579

ctypes.c_void_p))

580

self.credentials = credentials

581

582

def __del__(self):

583

gnutls.deinit(self._c_object)

584

585

def handshake(self):

586

return gnutls.handshake(self._c_object)

587

588

def send(self, data):

589

data = bytes(data)

590

data_len = len(data)

591

while data_len > 0:

592

data_len -= gnutls.record_send(self._c_object,

593

data[-data_len:],

594

data_len)

595

596

def bye(self):

597

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

598

599

# Error handling functions

600

def _error_code(result):

601

"""A function to raise exceptions on errors, suitable

602

for the 'restype' attribute on ctypes functions"""

603

if result >= 0:

604

return result

605

if result == gnutls.E_NO_CERTIFICATE_FOUND:

606

raise gnutls.CertificateSecurityError(code = result)

607

raise gnutls.Error(code = result)

608

609

def _retry_on_error(result, func, arguments):

610

"""A function to retry on some errors, suitable

611

for the 'errcheck' attribute on ctypes functions"""

612

while result < 0:

613

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

614

return _error_code(result)

615

result = func(*arguments)

616

return result

617

618

# Unless otherwise indicated, the function declarations below are

619

# all from the gnutls/gnutls.h C header file.

620

621

# Functions

622

priority_set_direct = _library.gnutls_priority_set_direct

623

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

624

ctypes.POINTER(ctypes.c_char_p)]

625

priority_set_direct.restype = _error_code

626

627

init = _library.gnutls_init

628

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

629

init.restype = _error_code

630

631

set_default_priority = _library.gnutls_set_default_priority

632

set_default_priority.argtypes = [session_t]

633

set_default_priority.restype = _error_code

634

635

record_send = _library.gnutls_record_send

636

record_send.argtypes = [session_t, ctypes.c_void_p,

637

ctypes.c_size_t]

638

record_send.restype = ctypes.c_ssize_t

639

record_send.errcheck = _retry_on_error

640

641

certificate_allocate_credentials = (

642

_library.gnutls_certificate_allocate_credentials)

643

certificate_allocate_credentials.argtypes = [

644

ctypes.POINTER(certificate_credentials_t)]

645

certificate_allocate_credentials.restype = _error_code

646

647

certificate_free_credentials = (

648

_library.gnutls_certificate_free_credentials)

649

certificate_free_credentials.argtypes = [certificate_credentials_t]

650

certificate_free_credentials.restype = None

651

652

handshake_set_private_extensions = (

653

_library.gnutls_handshake_set_private_extensions)

654

handshake_set_private_extensions.argtypes = [session_t,

655

ctypes.c_int]

656

handshake_set_private_extensions.restype = None

657

658

credentials_set = _library.gnutls_credentials_set

659

credentials_set.argtypes = [session_t, credentials_type_t,

660

ctypes.c_void_p]

661

credentials_set.restype = _error_code

662

663

strerror = _library.gnutls_strerror

664

strerror.argtypes = [ctypes.c_int]

665

strerror.restype = ctypes.c_char_p

666

667

certificate_type_get = _library.gnutls_certificate_type_get

668

certificate_type_get.argtypes = [session_t]

669

certificate_type_get.restype = _error_code

670

671

certificate_get_peers = _library.gnutls_certificate_get_peers

672

certificate_get_peers.argtypes = [session_t,

673

ctypes.POINTER(ctypes.c_uint)]

674

certificate_get_peers.restype = ctypes.POINTER(datum_t)

675

676

global_set_log_level = _library.gnutls_global_set_log_level

677

global_set_log_level.argtypes = [ctypes.c_int]

678

global_set_log_level.restype = None

679

680

global_set_log_function = _library.gnutls_global_set_log_function

681

global_set_log_function.argtypes = [log_func]

682

global_set_log_function.restype = None

683

684

deinit = _library.gnutls_deinit

685

deinit.argtypes = [session_t]

686

deinit.restype = None

687

688

handshake = _library.gnutls_handshake

689

handshake.argtypes = [session_t]

690

handshake.restype = _error_code

691

handshake.errcheck = _retry_on_error

692

693

transport_set_ptr = _library.gnutls_transport_set_ptr

694

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

695

transport_set_ptr.restype = None

696

697

bye = _library.gnutls_bye

698

bye.argtypes = [session_t, close_request_t]

699

bye.restype = _error_code

700

bye.errcheck = _retry_on_error

701

702

check_version = _library.gnutls_check_version

703

check_version.argtypes = [ctypes.c_char_p]

704

check_version.restype = ctypes.c_char_p

705

706

# All the function declarations below are from gnutls/openpgp.h

707

708

openpgp_crt_init = _library.gnutls_openpgp_crt_init

709

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

710

openpgp_crt_init.restype = _error_code

711

712

openpgp_crt_import = _library.gnutls_openpgp_crt_import

713

openpgp_crt_import.argtypes = [openpgp_crt_t,

714

ctypes.POINTER(datum_t),

715

openpgp_crt_fmt_t]

716

openpgp_crt_import.restype = _error_code

717

718

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

719

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

720

ctypes.POINTER(ctypes.c_uint)]

721

openpgp_crt_verify_self.restype = _error_code

722

723

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

724

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

725

openpgp_crt_deinit.restype = None

726

727

openpgp_crt_get_fingerprint = (

728

_library.gnutls_openpgp_crt_get_fingerprint)

729

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

730

ctypes.c_void_p,

731

ctypes.POINTER(

732

ctypes.c_size_t)]

733

openpgp_crt_get_fingerprint.restype = _error_code

734

735

# Remove non-public functions

736

del _error_code, _retry_on_error

737

# Create the global "gnutls" object, simulating a module

738

gnutls = GnuTLS()

739

740

def call_pipe(connection, # : multiprocessing.Connection

741

func, *args, **kwargs):

742

"""This function is meant to be called by multiprocessing.Process

743

744

This function runs func(*args, **kwargs), and writes the resulting

745

return value on the provided multiprocessing.Connection.

746

"""

747

connection.send(func(*args, **kwargs))

748

connection.close()

401

749

402

750

class Client(object):

403

751

"""A representation of a client host served by this server.

409

757

checker: subprocess.Popen(); a running checker process used

410

758

to see if the client lives.

411

759

'None' if no process is running.

412

checker_callback_tag: a gobject event source tag, or None

760

checker_callback_tag: a GObject event source tag, or None

413

761

checker_command: string; External command which is run to check

414

762

if client lives. %() expansions are done at

415

763

runtime with vars(self) as dict, so that for

416

764

instance %(name)s can be used in the command.

417

checker_initiator_tag: a gobject event source tag, or None

765

checker_initiator_tag: a GObject event source tag, or None

418

766

created: datetime.datetime(); (UTC) object creation

419

767

client_structure: Object describing what attributes a client has

420

768

and is used for storing the client at exit

421

769

current_checker_command: string; current running checker_command

422

disable_initiator_tag: a gobject event source tag, or None

770

disable_initiator_tag: a GObject event source tag, or None

423

771

enabled: bool()

424

772

fingerprint: string (40 or 32 hexadecimal digits); used to

425

773

uniquely identify the client

430

778

last_checker_status: integer between 0 and 255 reflecting exit

431

779

status of last checker. -1 reflects crashed

432

780

checker, -2 means no checker completed yet.

781

last_checker_signal: The signal which killed the last checker, if

782

last_checker_status is -1

433

783

last_enabled: datetime.datetime(); (UTC) or None

434

784

name: string; from the config file, used in log messages and

435

785

D-Bus identifiers

440

790

runtime_expansions: Allowed attributes for runtime expansion.

441

791

expires: datetime.datetime(); time (UTC) when a client will be

442

792

disabled, or None

793

server_settings: The server_settings dict from main()

443

794

"""

444

795

445

796

runtime_expansions = ("approval_delay", "approval_duration",

447

798

"fingerprint", "host", "interval",

448

799

"last_approval_request", "last_checked_ok",

449

800

"last_enabled", "name", "timeout")

450

client_defaults = { "timeout": "PT5M",

451

"extended_timeout": "PT15M",

452

"interval": "PT2M",

453

"checker": "fping -q -- %%(host)s",

454

"host": "",

455

"approval_delay": "PT0S",

456

"approval_duration": "PT1S",

457

"approved_by_default": "True",

458

"enabled": "True",

459

}

460

461

def timeout_milliseconds(self):

462

"Return the 'timeout' attribute in milliseconds"

463

return timedelta_to_milliseconds(self.timeout)

464

465

def extended_timeout_milliseconds(self):

466

"Return the 'extended_timeout' attribute in milliseconds"

467

return timedelta_to_milliseconds(self.extended_timeout)

468

469

def interval_milliseconds(self):

470

"Return the 'interval' attribute in milliseconds"

471

return timedelta_to_milliseconds(self.interval)

472

473

def approval_delay_milliseconds(self):

474

return timedelta_to_milliseconds(self.approval_delay)

801

client_defaults = {

802

"timeout": "PT5M",

803

"extended_timeout": "PT15M",

804

"interval": "PT2M",

805

"checker": "fping -q -- %%(host)s",

806

"host": "",

807

"approval_delay": "PT0S",

808

"approval_duration": "PT1S",

809

"approved_by_default": "True",

810

"enabled": "True",

811

}

475

812

476

813

@staticmethod

477

814

def config_parser(config):

493

830

client["enabled"] = config.getboolean(client_name,

494

831

"enabled")

495

832

833

# Uppercase and remove spaces from fingerprint for later

834

# comparison purposes with return value from the

835

# fingerprint() function

496

836

client["fingerprint"] = (section["fingerprint"].upper()

497

837

.replace(" ", ""))

498

838

if "secret" in section:

499

client["secret"] = section["secret"].decode("base64")

839

client["secret"] = codecs.decode(section["secret"]

840

.encode("utf-8"),

841

"base64")

500

842

elif "secfile" in section:

501

843

with open(os.path.expanduser(os.path.expandvars

502

844

(section["secfile"])),

503

845

"rb") as secfile:

504

846

client["secret"] = secfile.read()

505

847

else:

506

raise TypeError("No secret or secfile for section {0}"

848

raise TypeError("No secret or secfile for section {}"

507

849

.format(section))

508

850

client["timeout"] = string_to_delta(section["timeout"])

509

851

client["extended_timeout"] = string_to_delta(

520

862

521

863

return settings

522

864

523

def __init__(self, settings, name = None):

865

def __init__(self, settings, name = None, server_settings=None):

524

866

self.name = name

867

if server_settings is None:

868

server_settings = {}

869

self.server_settings = server_settings

525

870

# adding all client settings

526

for setting, value in settings.iteritems():

871

for setting, value in settings.items():

527

872

setattr(self, setting, value)

528

873

529

874

if self.enabled:

537

882

self.expires = None

538

883

539

884

logger.debug("Creating client %r", self.name)

540

# Uppercase and remove spaces from fingerprint for later

541

# comparison purposes with return value from the fingerprint()

542

# function

543

885

logger.debug(" Fingerprint: %s", self.fingerprint)

544

886

self.created = settings.get("created",

545

887

datetime.datetime.utcnow())

552

894

self.current_checker_command = None

553

895

self.approved = None

554

896

self.approvals_pending = 0

555

self.changedstate = (multiprocessing_manager

556

.Condition(multiprocessing_manager

557

.Lock()))

558

self.client_structure = [attr for attr in

559

self.__dict__.iterkeys()

897

self.changedstate = multiprocessing_manager.Condition(

898

multiprocessing_manager.Lock())

899

self.client_structure = [attr

900

for attr in self.__dict__.keys()

560

901

if not attr.startswith("_")]

561

902

self.client_structure.append("client_structure")

562

903

563

for name, t in inspect.getmembers(type(self),

564

lambda obj:

565

isinstance(obj,

566

property)):

904

for name, t in inspect.getmembers(

905

type(self), lambda obj: isinstance(obj, property)):

567

906

if not name.startswith("_"):

568

907

self.client_structure.append(name)

569

908

590

929

if not quiet:

591

930

logger.info("Disabling client %s", self.name)

592

931

if getattr(self, "disable_initiator_tag", None) is not None:

593

gobject.source_remove(self.disable_initiator_tag)

932

GObject.source_remove(self.disable_initiator_tag)

594

933

self.disable_initiator_tag = None

595

934

self.expires = None

596

935

if getattr(self, "checker_initiator_tag", None) is not None:

597

gobject.source_remove(self.checker_initiator_tag)

936

GObject.source_remove(self.checker_initiator_tag)

598

937

self.checker_initiator_tag = None

599

938

self.stop_checker()

600

939

self.enabled = False

601

940

if not quiet:

602

941

self.send_changedstate()

603

# Do not run this again if called by a gobject.timeout_add

942

# Do not run this again if called by a GObject.timeout_add

604

943

return False

605

944

606

945

def __del__(self):

610

949

# Schedule a new checker to be started an 'interval' from now,

611

950

# and every interval from then on.

612

951

if self.checker_initiator_tag is not None:

613

gobject.source_remove(self.checker_initiator_tag)

614

self.checker_initiator_tag = (gobject.timeout_add

615

(self.interval_milliseconds(),

616

self.start_checker))

952

GObject.source_remove(self.checker_initiator_tag)

953

self.checker_initiator_tag = GObject.timeout_add(

954

int(self.interval.total_seconds() * 1000),

955

self.start_checker)

617

956

# Schedule a disable() when 'timeout' has passed

618

957

if self.disable_initiator_tag is not None:

619

gobject.source_remove(self.disable_initiator_tag)

620

self.disable_initiator_tag = (gobject.timeout_add

621

(self.timeout_milliseconds(),

622

self.disable))

958

GObject.source_remove(self.disable_initiator_tag)

959

self.disable_initiator_tag = GObject.timeout_add(

960

int(self.timeout.total_seconds() * 1000), self.disable)

623

961

# Also start a new checker *right now*.

624

962

self.start_checker()

625

963

626

def checker_callback(self, pid, condition, command):

964

def checker_callback(self, source, condition, connection,

965

command):

627

966

"""The checker has completed, so take appropriate actions."""

628

967

self.checker_callback_tag = None

629

968

self.checker = None

630

if os.WIFEXITED(condition):

631

self.last_checker_status = os.WEXITSTATUS(condition)

969

# Read return code from connection (see call_pipe)

970

returncode = connection.recv()

971

connection.close()

972

973

if returncode >= 0:

974

self.last_checker_status = returncode

975

self.last_checker_signal = None

632

976

if self.last_checker_status == 0:

633

977

logger.info("Checker for %(name)s succeeded",

634

978

vars(self))

635

979

self.checked_ok()

636

980

else:

637

logger.info("Checker for %(name)s failed",

638

vars(self))

981

logger.info("Checker for %(name)s failed", vars(self))

639

982

else:

640

983

self.last_checker_status = -1

984

self.last_checker_signal = -returncode

641

985

logger.warning("Checker for %(name)s crashed?",

642

986

vars(self))

987

return False

643

988

644

989

def checked_ok(self):

645

990

"""Assert that the client has been seen, alive and well."""

646

991

self.last_checked_ok = datetime.datetime.utcnow()

647

992

self.last_checker_status = 0

993

self.last_checker_signal = None

648

994

self.bump_timeout()

649

995

650

996

def bump_timeout(self, timeout=None):

652

998

if timeout is None:

653

999

timeout = self.timeout

654

1000

if self.disable_initiator_tag is not None:

655

gobject.source_remove(self.disable_initiator_tag)

1001

GObject.source_remove(self.disable_initiator_tag)

656

1002

self.disable_initiator_tag = None

657

1003

if getattr(self, "enabled", False):

658

self.disable_initiator_tag = (gobject.timeout_add

659

(timedelta_to_milliseconds

660

(timeout), self.disable))

1004

self.disable_initiator_tag = GObject.timeout_add(

1005

int(timeout.total_seconds() * 1000), self.disable)

661

1006

self.expires = datetime.datetime.utcnow() + timeout

662

1007

663

1008

def need_approval(self):

677

1022

# than 'timeout' for the client to be disabled, which is as it

678

1023

# should be.

679

1024

680

# If a checker exists, make sure it is not a zombie

681

try:

682

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

683

except (AttributeError, OSError) as error:

684

if (isinstance(error, OSError)

685

and error.errno != errno.ECHILD):

686

raise error

687

else:

688

if pid:

689

logger.warning("Checker was a zombie")

690

gobject.source_remove(self.checker_callback_tag)

691

self.checker_callback(pid, status,

692

self.current_checker_command)

1025

if self.checker is not None and not self.checker.is_alive():

1026

logger.warning("Checker was not alive; joining")

1027

self.checker.join()

1028

self.checker = None

693

1029

# Start a new checker if needed

694

1030

if self.checker is None:

695

1031

# Escape attributes for the shell

696

escaped_attrs = dict(

697

(attr, re.escape(unicode(getattr(self, attr))))

698

for attr in

699

self.runtime_expansions)

1032

escaped_attrs = {

1033

attr: re.escape(str(getattr(self, attr)))

1034

for attr in self.runtime_expansions }

700

1035

try:

701

1036

command = self.checker_command % escaped_attrs

702

1037

except TypeError as error:

703

1038

logger.error('Could not format string "%s"',

704

self.checker_command, exc_info=error)

705

return True # Try again later

1039

self.checker_command,

1040

exc_info=error)

1041

return True # Try again later

706

1042

self.current_checker_command = command

707

try:

708

logger.info("Starting checker %r for %s",

709

command, self.name)

710

# We don't need to redirect stdout and stderr, since

711

# in normal mode, that is already done by daemon(),

712

# and in debug mode we don't want to. (Stdin is

713

# always replaced by /dev/null.)

714

self.checker = subprocess.Popen(command,

715

close_fds=True,

716

shell=True, cwd="/")

717

except OSError as error:

718

logger.error("Failed to start subprocess",

719

exc_info=error)

720

return True

721

self.checker_callback_tag = (gobject.child_watch_add

722

(self.checker.pid,

723

self.checker_callback,

724

data=command))

725

# The checker may have completed before the gobject

726

# watch was added. Check for this.

727

try:

728

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

729

except OSError as error:

730

if error.errno == errno.ECHILD:

731

# This should never happen

732

logger.error("Child process vanished",

733

exc_info=error)

734

return True

735

raise

736

if pid:

737

gobject.source_remove(self.checker_callback_tag)

738

self.checker_callback(pid, status, command)

739

# Re-run this periodically if run by gobject.timeout_add

1043

logger.info("Starting checker %r for %s", command,

1044

self.name)

1045

# We don't need to redirect stdout and stderr, since

1046

# in normal mode, that is already done by daemon(),

1047

# and in debug mode we don't want to. (Stdin is

1048

# always replaced by /dev/null.)

1049

# The exception is when not debugging but nevertheless

1050

# running in the foreground; use the previously

1051

# created wnull.

1052

popen_args = { "close_fds": True,

1053

"shell": True,

1054

"cwd": "/" }

1055

if (not self.server_settings["debug"]

1056

and self.server_settings["foreground"]):

1057

popen_args.update({"stdout": wnull,

1058

"stderr": wnull })

1059

pipe = multiprocessing.Pipe(duplex = False)

1060

self.checker = multiprocessing.Process(

1061

target = call_pipe,

1062

args = (pipe[1], subprocess.call, command),

1063

kwargs = popen_args)

1064

self.checker.start()

1065

self.checker_callback_tag = GObject.io_add_watch(

1066

pipe[0].fileno(), GObject.IO_IN,

1067

self.checker_callback, pipe[0], command)

1068

# Re-run this periodically if run by GObject.timeout_add

740

1069

return True

741

1070

742

1071

def stop_checker(self):

743

1072

"""Force the checker process, if any, to stop."""

744

1073

if self.checker_callback_tag:

745

gobject.source_remove(self.checker_callback_tag)

1074

GObject.source_remove(self.checker_callback_tag)

746

1075

self.checker_callback_tag = None

747

1076

if getattr(self, "checker", None) is None:

748

1077

return

749

1078

logger.debug("Stopping checker for %(name)s", vars(self))

750

try:

751

self.checker.terminate()

752

#time.sleep(0.5)

753

#if self.checker.poll() is None:

754

# self.checker.kill()

755

except OSError as error:

756

if error.errno != errno.ESRCH: # No such process

757

raise

1079

self.checker.terminate()

758

1080

self.checker = None

759

1081

760

1082

761

def dbus_service_property(dbus_interface, signature="v",

762

access="readwrite", byte_arrays=False):

1083

def dbus_service_property(dbus_interface,

1084

signature="v",

1085

access="readwrite",

1086

byte_arrays=False):

763

1087

"""Decorators for marking methods of a DBusObjectWithProperties to

764

1088

become properties on the D-Bus.

765

1089

774

1098

# "Set" method, so we fail early here:

775

1099

if byte_arrays and signature != "ay":

776

1100

raise ValueError("Byte arrays not supported for non-'ay'"

777

" signature {0!r}".format(signature))

1101

" signature {!r}".format(signature))

1102

778

1103

def decorator(func):

779

1104

func._dbus_is_property = True

780

1105

func._dbus_interface = dbus_interface

785

1110

func._dbus_name = func._dbus_name[:-14]

786

1111

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

787

1112

return func

1113

788

1114

return decorator

789

1115

790

1116

799

1125

"org.freedesktop.DBus.Property.EmitsChangedSignal":

800

1126

"false"}

801

1127

"""

1128

802

1129

def decorator(func):

803

1130

func._dbus_is_interface = True

804

1131

func._dbus_interface = dbus_interface

805

1132

func._dbus_name = dbus_interface

806

1133

return func

1134

807

1135

return decorator

808

1136

809

1137

811

1139

"""Decorator to annotate D-Bus methods, signals or properties

812

1140

Usage:

813

1141

1142

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1143

"org.freedesktop.DBus.Property."

1144

"EmitsChangedSignal": "false"})

814

1145

@dbus_service_property("org.example.Interface", signature="b",

815

1146

access="r")

816

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

817

"org.freedesktop.DBus.Property."

818

"EmitsChangedSignal": "false"})

819

1147

def Property_dbus_property(self):

820

1148

return dbus.Boolean(False)

1149

1150

See also the DBusObjectWithAnnotations class.

821

1151

"""

1152

822

1153

def decorator(func):

823

1154

func._dbus_annotations = annotations

824

1155

return func

1156

825

1157

return decorator

826

1158

827

1159

828

1160

class DBusPropertyException(dbus.exceptions.DBusException):

829

1161

"""A base class for D-Bus property-related exceptions

830

1162

"""

831

def __unicode__(self):

832

return unicode(str(self))

1163

pass

833

1164

834

1165

835

1166

class DBusPropertyAccessException(DBusPropertyException):

844

1175

pass

845

1176

846

1177

847

class DBusObjectWithProperties(dbus.service.Object):

848

"""A D-Bus object with properties.

1178

class DBusObjectWithAnnotations(dbus.service.Object):

1179

"""A D-Bus object with annotations.

849

1180

850

Classes inheriting from this can use the dbus_service_property

851

decorator to expose methods as D-Bus properties. It exposes the

852

standard Get(), Set(), and GetAll() methods on the D-Bus.

1181

Classes inheriting from this can use the dbus_annotations

1182

decorator to add annotations to methods or signals.

853

1183

"""

854

1184

855

1185

@staticmethod

859

1189

If called like _is_dbus_thing("method") it returns a function

860

1190

suitable for use as predicate to inspect.getmembers().

861

1191

"""

862

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1192

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

863

1193

False)

864

1194

865

1195

def _get_all_dbus_things(self, thing):

866

1196

"""Returns a generator of (name, attribute) pairs

867

1197

"""

868

return ((getattr(athing.__get__(self), "_dbus_name",

869

name),

1198

return ((getattr(athing.__get__(self), "_dbus_name", name),

870

1199

athing.__get__(self))

871

1200

for cls in self.__class__.__mro__

872

1201

for name, athing in

873

inspect.getmembers(cls,

874

self._is_dbus_thing(thing)))

1202

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1203

1204

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1205

out_signature = "s",

1206

path_keyword = 'object_path',

1207

connection_keyword = 'connection')

1208

def Introspect(self, object_path, connection):

1209

"""Overloading of standard D-Bus method.

1210

1211

Inserts annotation tags on methods and signals.

1212

"""

1213

xmlstring = dbus.service.Object.Introspect(self, object_path,

1214

connection)

1215

try:

1216

document = xml.dom.minidom.parseString(xmlstring)

1217

1218

for if_tag in document.getElementsByTagName("interface"):

1219

# Add annotation tags

1220

for typ in ("method", "signal"):

1221

for tag in if_tag.getElementsByTagName(typ):

1222

annots = dict()

1223

for name, prop in (self.

1224

_get_all_dbus_things(typ)):

1225

if (name == tag.getAttribute("name")

1226

and prop._dbus_interface

1227

== if_tag.getAttribute("name")):

1228

annots.update(getattr(

1229

prop, "_dbus_annotations", {}))

1230

for name, value in annots.items():

1231

ann_tag = document.createElement(

1232

"annotation")

1233

ann_tag.setAttribute("name", name)

1234

ann_tag.setAttribute("value", value)

1235

tag.appendChild(ann_tag)

1236

# Add interface annotation tags

1237

for annotation, value in dict(

1238

itertools.chain.from_iterable(

1239

annotations().items()

1240

for name, annotations

1241

in self._get_all_dbus_things("interface")

1242

if name == if_tag.getAttribute("name")

1243

)).items():

1244

ann_tag = document.createElement("annotation")

1245

ann_tag.setAttribute("name", annotation)

1246

ann_tag.setAttribute("value", value)

1247

if_tag.appendChild(ann_tag)

1248

# Fix argument name for the Introspect method itself

1249

if (if_tag.getAttribute("name")

1250

== dbus.INTROSPECTABLE_IFACE):

1251

for cn in if_tag.getElementsByTagName("method"):

1252

if cn.getAttribute("name") == "Introspect":

1253

for arg in cn.getElementsByTagName("arg"):

1254

if (arg.getAttribute("direction")

1255

== "out"):

1256

arg.setAttribute("name",

1257

"xml_data")

1258

xmlstring = document.toxml("utf-8")

1259

document.unlink()

1260

except (AttributeError, xml.dom.DOMException,

1261

xml.parsers.expat.ExpatError) as error:

1262

logger.error("Failed to override Introspection method",

1263

exc_info=error)

1264

return xmlstring

1265

1266

1267

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1268

"""A D-Bus object with properties.

1269

1270

Classes inheriting from this can use the dbus_service_property

1271

decorator to expose methods as D-Bus properties. It exposes the

1272

standard Get(), Set(), and GetAll() methods on the D-Bus.

1273

"""

875

1274

876

1275

def _get_dbus_property(self, interface_name, property_name):

877

1276

"""Returns a bound method if one exists which is a D-Bus

878

1277

property with the specified name and interface.

879

1278

"""

880

for cls in self.__class__.__mro__:

881

for name, value in (inspect.getmembers

882

(cls,

883

self._is_dbus_thing("property"))):

1279

for cls in self.__class__.__mro__:

1280

for name, value in inspect.getmembers(

1281

cls, self._is_dbus_thing("property")):

884

1282

if (value._dbus_name == property_name

885

1283

and value._dbus_interface == interface_name):

886

1284

return value.__get__(self)

887

1285

888

1286

# No such property

889

raise DBusPropertyNotFound(self.dbus_object_path + ":"

890

+ interface_name + "."

891

+ property_name)

892

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1287

raise DBusPropertyNotFound("{}:{}.{}".format(

1288

self.dbus_object_path, interface_name, property_name))

1289

1290

@classmethod

1291

def _get_all_interface_names(cls):

1292

"""Get a sequence of all interfaces supported by an object"""

1293

return (name for name in set(getattr(getattr(x, attr),

1294

"_dbus_interface", None)

1295

for x in (inspect.getmro(cls))

1296

for attr in dir(x))

1297

if name is not None)

1298

1299

@dbus.service.method(dbus.PROPERTIES_IFACE,

1300

in_signature="ss",

894

1301

out_signature="v")

895

1302

def Get(self, interface_name, property_name):

896

1303

"""Standard D-Bus property Get() method, see D-Bus standard.

914

1321

# The byte_arrays option is not supported yet on

915

1322

# signatures other than "ay".

916

1323

if prop._dbus_signature != "ay":

917

raise ValueError

1324

raise ValueError("Byte arrays not supported for non-"

1325

"'ay' signature {!r}"

1326

.format(prop._dbus_signature))

918

1327

value = dbus.ByteArray(b''.join(chr(byte)

919

1328

for byte in value))

920

1329

prop(value)

921

1330

922

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1331

@dbus.service.method(dbus.PROPERTIES_IFACE,

1332

in_signature="s",

923

1333

out_signature="a{sv}")

924

1334

def GetAll(self, interface_name):

925

1335

"""Standard D-Bus property GetAll() method, see D-Bus

940

1350

if not hasattr(value, "variant_level"):

941

1351

properties[name] = value

942

1352

continue

943

properties[name] = type(value)(value, variant_level=

944

value.variant_level+1)

1353

properties[name] = type(value)(

1354

value, variant_level = value.variant_level + 1)

945

1355

return dbus.Dictionary(properties, signature="sv")

946

1356

1357

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1358

def PropertiesChanged(self, interface_name, changed_properties,

1359

invalidated_properties):

1360

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1361

standard.

1362

"""

1363

pass

1364

947

1365

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

948

1366

out_signature="s",

949

1367

path_keyword='object_path',

953

1371

954

1372

Inserts property tags and interface annotation tags.

955

1373

"""

956

xmlstring = dbus.service.Object.Introspect(self, object_path,

957

connection)

1374

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1375

object_path,

1376

connection)

958

1377

try:

959

1378

document = xml.dom.minidom.parseString(xmlstring)

1379

960

1380

def make_tag(document, name, prop):

961

1381

e = document.createElement("property")

962

1382

e.setAttribute("name", name)

963

1383

e.setAttribute("type", prop._dbus_signature)

964

1384

e.setAttribute("access", prop._dbus_access)

965

1385

return e

1386

966

1387

for if_tag in document.getElementsByTagName("interface"):

967

1388

# Add property tags

968

1389

for tag in (make_tag(document, name, prop)

971

1392

if prop._dbus_interface

972

1393

== if_tag.getAttribute("name")):

973

1394

if_tag.appendChild(tag)

974

# Add annotation tags

975

for typ in ("method", "signal", "property"):

976

for tag in if_tag.getElementsByTagName(typ):

977

annots = dict()

978

for name, prop in (self.

979

_get_all_dbus_things(typ)):

980

if (name == tag.getAttribute("name")

981

and prop._dbus_interface

982

== if_tag.getAttribute("name")):

983

annots.update(getattr

984

(prop,

985

"_dbus_annotations",

986

{}))

987

for name, value in annots.iteritems():

988

ann_tag = document.createElement(

989

"annotation")

990

ann_tag.setAttribute("name", name)

991

ann_tag.setAttribute("value", value)

992

tag.appendChild(ann_tag)

993

# Add interface annotation tags

994

for annotation, value in dict(

995

itertools.chain.from_iterable(

996

annotations().iteritems()

997

for name, annotations in

998

self._get_all_dbus_things("interface")

999

if name == if_tag.getAttribute("name")

1000

)).iteritems():

1001

ann_tag = document.createElement("annotation")

1002

ann_tag.setAttribute("name", annotation)

1003

ann_tag.setAttribute("value", value)

1004

if_tag.appendChild(ann_tag)

1395

# Add annotation tags for properties

1396

for tag in if_tag.getElementsByTagName("property"):

1397

annots = dict()

1398

for name, prop in self._get_all_dbus_things(

1399

"property"):

1400

if (name == tag.getAttribute("name")

1401

and prop._dbus_interface

1402

== if_tag.getAttribute("name")):

1403

annots.update(getattr(

1404

prop, "_dbus_annotations", {}))

1405

for name, value in annots.items():

1406

ann_tag = document.createElement(

1407

"annotation")

1408

ann_tag.setAttribute("name", name)

1409

ann_tag.setAttribute("value", value)

1410

tag.appendChild(ann_tag)

1005

1411

# Add the names to the return values for the

1006

1412

# "org.freedesktop.DBus.Properties" methods

1007

1413

if (if_tag.getAttribute("name")

1025

1431

exc_info=error)

1026

1432

return xmlstring

1027

1433

1434

try:

1435

dbus.OBJECT_MANAGER_IFACE

1436

except AttributeError:

1437

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1438

1439

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1440

"""A D-Bus object with an ObjectManager.

1441

1442

Classes inheriting from this exposes the standard

1443

GetManagedObjects call and the InterfacesAdded and

1444

InterfacesRemoved signals on the standard

1445

"org.freedesktop.DBus.ObjectManager" interface.

1446

1447

Note: No signals are sent automatically; they must be sent

1448

manually.

1449

"""

1450

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1451

out_signature = "a{oa{sa{sv}}}")

1452

def GetManagedObjects(self):

1453

"""This function must be overridden"""

1454

raise NotImplementedError()

1455

1456

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1457

signature = "oa{sa{sv}}")

1458

def InterfacesAdded(self, object_path, interfaces_and_properties):

1459

pass

1460

1461

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1462

def InterfacesRemoved(self, object_path, interfaces):

1463

pass

1464

1465

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1466

out_signature = "s",

1467

path_keyword = 'object_path',

1468

connection_keyword = 'connection')

1469

def Introspect(self, object_path, connection):

1470

"""Overloading of standard D-Bus method.

1471

1472

Override return argument name of GetManagedObjects to be

1473

"objpath_interfaces_and_properties"

1474

"""

1475

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1476

object_path,

1477

connection)

1478

try:

1479

document = xml.dom.minidom.parseString(xmlstring)

1480

1481

for if_tag in document.getElementsByTagName("interface"):

1482

# Fix argument name for the GetManagedObjects method

1483

if (if_tag.getAttribute("name")

1484

== dbus.OBJECT_MANAGER_IFACE):

1485

for cn in if_tag.getElementsByTagName("method"):

1486

if (cn.getAttribute("name")

1487

== "GetManagedObjects"):

1488

for arg in cn.getElementsByTagName("arg"):

1489

if (arg.getAttribute("direction")

1490

== "out"):

1491

arg.setAttribute(

1492

"name",

1493

"objpath_interfaces"

1494

"_and_properties")

1495

xmlstring = document.toxml("utf-8")

1496

document.unlink()

1497

except (AttributeError, xml.dom.DOMException,

1498

xml.parsers.expat.ExpatError) as error:

1499

logger.error("Failed to override Introspection method",

1500

exc_info = error)

1501

return xmlstring

1028

1502

1029

1503

def datetime_to_dbus(dt, variant_level=0):

1030

1504

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1031

1505

if dt is None:

1032

1506

return dbus.String("", variant_level = variant_level)

1033

return dbus.String(dt.isoformat(),

1034

variant_level=variant_level)

1507

return dbus.String(dt.isoformat(), variant_level=variant_level)

1035

1508

1036

1509

1037

1510

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1057

1530

(from DBusObjectWithProperties) and interfaces (from the

1058

1531

dbus_interface_annotations decorator).

1059

1532

"""

1533

1060

1534

def wrapper(cls):

1061

1535

for orig_interface_name, alt_interface_name in (

1062

alt_interface_names.iteritems()):

1536

alt_interface_names.items()):

1063

1537

attr = {}

1064

1538

interface_names = set()

1065

1539

# Go though all attributes of the class

1067

1541

# Ignore non-D-Bus attributes, and D-Bus attributes

1068

1542

# with the wrong interface name

1069

1543

if (not hasattr(attribute, "_dbus_interface")

1070

or not attribute._dbus_interface

1071

.startswith(orig_interface_name)):

1544

or not attribute._dbus_interface.startswith(

1545

orig_interface_name)):

1072

1546

continue

1073

1547

# Create an alternate D-Bus interface name based on

1074

1548

# the current name

1075

alt_interface = (attribute._dbus_interface

1076

.replace(orig_interface_name,

1077

alt_interface_name))

1549

alt_interface = attribute._dbus_interface.replace(

1550

orig_interface_name, alt_interface_name)

1078

1551

interface_names.add(alt_interface)

1079

1552

# Is this a D-Bus signal?

1080

1553

if getattr(attribute, "_dbus_is_signal", False):

1081

1554

# Extract the original non-method undecorated

1082

1555

# function by black magic

1083

nonmethod_func = (dict(

1556

if sys.version_info.major == 2:

1557

nonmethod_func = (dict(

1084

1558

zip(attribute.func_code.co_freevars,

1085

attribute.__closure__))["func"]

1086

.cell_contents)

1559

attribute.__closure__))

1560

["func"].cell_contents)

1561

else:

1562

nonmethod_func = (dict(

1563

zip(attribute.__code__.co_freevars,

1564

attribute.__closure__))

1565

["func"].cell_contents)

1087

1566

# Create a new, but exactly alike, function

1088

1567

# object, and decorate it to be a new D-Bus signal

1089

1568

# with the alternate D-Bus interface name

1090

new_function = (dbus.service.signal

1091

(alt_interface,

1092

attribute._dbus_signature)

1093

(types.FunctionType(

1094

nonmethod_func.func_code,

1095

nonmethod_func.func_globals,

1096

nonmethod_func.func_name,

1097

nonmethod_func.func_defaults,

1098

nonmethod_func.func_closure)))

1569

new_function = copy_function(nonmethod_func)

1570

new_function = (dbus.service.signal(

1571

alt_interface,

1572

attribute._dbus_signature)(new_function))

1099

1573

# Copy annotations, if any

1100

1574

try:

1101

new_function._dbus_annotations = (

1102

dict(attribute._dbus_annotations))

1575

new_function._dbus_annotations = dict(

1576

attribute._dbus_annotations)

1103

1577

except AttributeError:

1104

1578

pass

1105

1579

# Define a creator of a function to call both the

1110

1584

"""This function is a scope container to pass

1111

1585

func1 and func2 to the "call_both" function

1112

1586

outside of its arguments"""

1587

1588

@functools.wraps(func2)

1113

1589

def call_both(*args, **kwargs):

1114

1590

"""This function will emit two D-Bus

1115

1591

signals by calling func1 and func2"""

1116

1592

func1(*args, **kwargs)

1117

1593

func2(*args, **kwargs)

1594

# Make wrapper function look like a D-Bus signal

1595

for name, attr in inspect.getmembers(func2):

1596

if name.startswith("_dbus_"):

1597

setattr(call_both, name, attr)

1598

1118

1599

return call_both

1119

1600

# Create the "call_both" function and add it to

1120

1601

# the class

1125

1606

# object. Decorate it to be a new D-Bus method

1126

1607

# with the alternate D-Bus interface name. Add it

1127

1608

# to the class.

1128

attr[attrname] = (dbus.service.method

1129

(alt_interface,

1130

attribute._dbus_in_signature,

1131

attribute._dbus_out_signature)

1132

(types.FunctionType

1133

(attribute.func_code,

1134

attribute.func_globals,

1135

attribute.func_name,

1136

attribute.func_defaults,

1137

attribute.func_closure)))

1609

attr[attrname] = (

1610

dbus.service.method(

1611

alt_interface,

1612

attribute._dbus_in_signature,

1613

attribute._dbus_out_signature)

1614

(copy_function(attribute)))

1138

1615

# Copy annotations, if any

1139

1616

try:

1140

attr[attrname]._dbus_annotations = (

1141

dict(attribute._dbus_annotations))

1617

attr[attrname]._dbus_annotations = dict(

1618

attribute._dbus_annotations)

1142

1619

except AttributeError:

1143

1620

pass

1144

1621

# Is this a D-Bus property?

1147

1624

# object, and decorate it to be a new D-Bus

1148

1625

# property with the alternate D-Bus interface

1149

1626

# name. Add it to the class.

1150

attr[attrname] = (dbus_service_property

1151

(alt_interface,

1152

attribute._dbus_signature,

1153

attribute._dbus_access,

1154

attribute

1155

._dbus_get_args_options

1156

["byte_arrays"])

1157

(types.FunctionType

1158

(attribute.func_code,

1159

attribute.func_globals,

1160

attribute.func_name,

1161

attribute.func_defaults,

1162

attribute.func_closure)))

1627

attr[attrname] = (dbus_service_property(

1628

alt_interface, attribute._dbus_signature,

1629

attribute._dbus_access,

1630

attribute._dbus_get_args_options

1631

["byte_arrays"])

1632

(copy_function(attribute)))

1163

1633

# Copy annotations, if any

1164

1634

try:

1165

attr[attrname]._dbus_annotations = (

1166

dict(attribute._dbus_annotations))

1635

attr[attrname]._dbus_annotations = dict(

1636

attribute._dbus_annotations)

1167

1637

except AttributeError:

1168

1638

pass

1169

1639

# Is this a D-Bus interface?

1172

1642

# object. Decorate it to be a new D-Bus interface

1173

1643

# with the alternate D-Bus interface name. Add it

1174

1644

# to the class.

1175

attr[attrname] = (dbus_interface_annotations

1176

(alt_interface)

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1645

attr[attrname] = (

1646

dbus_interface_annotations(alt_interface)

1647

(copy_function(attribute)))

1183

1648

if deprecate:

1184

1649

# Deprecate all alternate interfaces

1185

iname="_AlternateDBusNames_interface_annotation{0}"

1650

iname="_AlternateDBusNames_interface_annotation{}"

1186

1651

for interface_name in interface_names:

1652

1187

1653

@dbus_interface_annotations(interface_name)

1188

1654

def func(self):

1189

1655

return { "org.freedesktop.DBus.Deprecated":

1190

"true" }

1656

"true" }

1191

1657

# Find an unused name

1192

1658

for aname in (iname.format(i)

1193

1659

for i in itertools.count()):

1197

1663

if interface_names:

1198

1664

# Replace the class with a new subclass of it with

1199

1665

# methods, signals, etc. as created above.

1200

cls = type(b"{0}Alternate".format(cls.__name__),

1201

(cls,), attr)

1666

if sys.version_info.major == 2:

1667

cls = type(b"{}Alternate".format(cls.__name__),

1668

(cls, ), attr)

1669

else:

1670

cls = type("{}Alternate".format(cls.__name__),

1671

(cls, ), attr)

1202

1672

return cls

1673

1203

1674

return wrapper

1204

1675

1205

1676

1206

1677

@alternate_dbus_interfaces({"se.recompile.Mandos":

1207

"se.bsnet.fukt.Mandos"})

1678

"se.bsnet.fukt.Mandos"})

1208

1679

class ClientDBus(Client, DBusObjectWithProperties):

1209

1680

"""A Client class using D-Bus

1210

1681

1214

1685

"""

1215

1686

1216

1687

runtime_expansions = (Client.runtime_expansions

1217

+ ("dbus_object_path",))

1688

+ ("dbus_object_path", ))

1689

1690

_interface = "se.recompile.Mandos.Client"

1218

1691

1219

1692

# dbus.service.Object doesn't use super(), so we can't either.

1220

1693

1223

1696

Client.__init__(self, *args, **kwargs)

1224

1697

# Only now, when this client is initialized, can it show up on

1225

1698

# the D-Bus

1226

client_object_name = unicode(self.name).translate(

1699

client_object_name = str(self.name).translate(

1227

1700

{ord("."): ord("_"),

1228

1701

ord("-"): ord("_")})

1229

self.dbus_object_path = (dbus.ObjectPath

1230

("/clients/" + client_object_name))

1702

self.dbus_object_path = dbus.ObjectPath(

1703

"/clients/" + client_object_name)

1231

1704

DBusObjectWithProperties.__init__(self, self.bus,

1232

1705

self.dbus_object_path)

1233

1706

1234

def notifychangeproperty(transform_func,

1235

dbus_name, type_func=lambda x: x,

1236

variant_level=1):

1707

def notifychangeproperty(transform_func, dbus_name,

1708

type_func=lambda x: x,

1709

variant_level=1,

1710

invalidate_only=False,

1711

_interface=_interface):

1237

1712

""" Modify a variable so that it's a property which announces

1238

1713

its changes to DBus.

1239

1714

1244

1719

to the D-Bus. Default: no transform

1245

1720

variant_level: D-Bus variant level. Default: 1

1246

1721

"""

1247

attrname = "_{0}".format(dbus_name)

1722

attrname = "_{}".format(dbus_name)

1723

1248

1724

def setter(self, value):

1249

1725

if hasattr(self, "dbus_object_path"):

1250

1726

if (not hasattr(self, attrname) or

1251

1727

type_func(getattr(self, attrname, None))

1252

1728

!= type_func(value)):

1253

dbus_value = transform_func(type_func(value),

1254

variant_level

1255

=variant_level)

1256

self.PropertyChanged(dbus.String(dbus_name),

1257

dbus_value)

1729

if invalidate_only:

1730

self.PropertiesChanged(

1731

_interface, dbus.Dictionary(),

1732

dbus.Array((dbus_name, )))

1733

else:

1734

dbus_value = transform_func(

1735

type_func(value),

1736

variant_level = variant_level)

1737

self.PropertyChanged(dbus.String(dbus_name),

1738

dbus_value)

1739

self.PropertiesChanged(

1740

_interface,

1741

dbus.Dictionary({ dbus.String(dbus_name):

1742

dbus_value }),

1743

dbus.Array())

1258

1744

setattr(self, attrname, value)

1259

1745

1260

1746

return property(lambda self: getattr(self, attrname), setter)

1266

1752

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1267

1753

last_enabled = notifychangeproperty(datetime_to_dbus,

1268

1754

"LastEnabled")

1269

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1270

type_func = lambda checker:

1271

checker is not None)

1755

checker = notifychangeproperty(

1756

dbus.Boolean, "CheckerRunning",

1757

type_func = lambda checker: checker is not None)

1272

1758

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1273

1759

"LastCheckedOK")

1274

1760

last_checker_status = notifychangeproperty(dbus.Int16,

1277

1763

datetime_to_dbus, "LastApprovalRequest")

1278

1764

approved_by_default = notifychangeproperty(dbus.Boolean,

1279

1765

"ApprovedByDefault")

1280

approval_delay = notifychangeproperty(dbus.UInt64,

1281

"ApprovalDelay",

1282

type_func =

1283

timedelta_to_milliseconds)

1766

approval_delay = notifychangeproperty(

1767

dbus.UInt64, "ApprovalDelay",

1768

type_func = lambda td: td.total_seconds() * 1000)

1284

1769

approval_duration = notifychangeproperty(

1285

1770

dbus.UInt64, "ApprovalDuration",

1286

type_func = timedelta_to_milliseconds)

1771

type_func = lambda td: td.total_seconds() * 1000)

1287

1772

host = notifychangeproperty(dbus.String, "Host")

1288

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1289

type_func =

1290

timedelta_to_milliseconds)

1773

timeout = notifychangeproperty(

1774

dbus.UInt64, "Timeout",

1775

type_func = lambda td: td.total_seconds() * 1000)

1291

1776

extended_timeout = notifychangeproperty(

1292

1777

dbus.UInt64, "ExtendedTimeout",

1293

type_func = timedelta_to_milliseconds)

1294

interval = notifychangeproperty(dbus.UInt64,

1295

"Interval",

1296

type_func =

1297

timedelta_to_milliseconds)

1778

type_func = lambda td: td.total_seconds() * 1000)

1779

interval = notifychangeproperty(

1780

dbus.UInt64, "Interval",

1781

type_func = lambda td: td.total_seconds() * 1000)

1298

1782

checker_command = notifychangeproperty(dbus.String, "Checker")

1783

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1784

invalidate_only=True)

1299

1785

1300

1786

del notifychangeproperty

1301

1787

1308

1794

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1309

1795

Client.__del__(self, *args, **kwargs)

1310

1796

1311

def checker_callback(self, pid, condition, command,

1312

*args, **kwargs):

1313

self.checker_callback_tag = None

1314

self.checker = None

1315

if os.WIFEXITED(condition):

1316

exitstatus = os.WEXITSTATUS(condition)

1797

def checker_callback(self, source, condition,

1798

connection, command, *args, **kwargs):

1799

ret = Client.checker_callback(self, source, condition,

1800

connection, command, *args,

1801

**kwargs)

1802

exitstatus = self.last_checker_status

1803

if exitstatus >= 0:

1317

1804

# Emit D-Bus signal

1318

1805

self.CheckerCompleted(dbus.Int16(exitstatus),

1319

dbus.Int64(condition),

1806

# This is specific to GNU libC

1807

dbus.Int64(exitstatus << 8),

1320

1808

dbus.String(command))

1321

1809

else:

1322

1810

# Emit D-Bus signal

1323

1811

self.CheckerCompleted(dbus.Int16(-1),

1324

dbus.Int64(condition),

1812

dbus.Int64(

1813

# This is specific to GNU libC

1814

(exitstatus << 8)

1815

| self.last_checker_signal),

1325

1816

dbus.String(command))

1326

1327

return Client.checker_callback(self, pid, condition, command,

1328

*args, **kwargs)

1817

return ret

1329

1818

1330

1819

def start_checker(self, *args, **kwargs):

1331

old_checker = self.checker

1332

if self.checker is not None:

1333

old_checker_pid = self.checker.pid

1334

else:

1335

old_checker_pid = None

1820

old_checker_pid = getattr(self.checker, "pid", None)

1336

1821

r = Client.start_checker(self, *args, **kwargs)

1337

1822

# Only if new checker process was started

1338

1823

if (self.checker is not None

1347

1832

1348

1833

def approve(self, value=True):

1349

1834

self.approved = value

1350

gobject.timeout_add(timedelta_to_milliseconds

1351

(self.approval_duration),

1352

self._reset_approved)

1835

GObject.timeout_add(int(self.approval_duration.total_seconds()

1836

* 1000), self._reset_approved)

1353

1837

self.send_changedstate()

1354

1838

1355

1839

## D-Bus methods, signals & properties

1356

_interface = "se.recompile.Mandos.Client"

1357

1840

1358

1841

## Interfaces

1359

1842

1360

@dbus_interface_annotations(_interface)

1361

def _foo(self):

1362

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1363

"false"}

1364

1365

1843

## Signals

1366

1844

1367

1845

# CheckerCompleted - signal

1377

1855

pass

1378

1856

1379

1857

# PropertyChanged - signal

1858

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1380

1859

@dbus.service.signal(_interface, signature="sv")

1381

1860

def PropertyChanged(self, property, value):

1382

1861

"D-Bus signal"

1416

1895

self.checked_ok()

1417

1896

1418

1897

# Enable - method

1898

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1419

1899

@dbus.service.method(_interface)

1420

1900

def Enable(self):

1421

1901

"D-Bus method"

1422

1902

self.enable()

1423

1903

1424

1904

# StartChecker - method

1905

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1425

1906

@dbus.service.method(_interface)

1426

1907

def StartChecker(self):

1427

1908

"D-Bus method"

1428

1909

self.start_checker()

1429

1910

1430

1911

# Disable - method

1912

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1431

1913

@dbus.service.method(_interface)

1432

1914

def Disable(self):

1433

1915

"D-Bus method"

1434

1916

self.disable()

1435

1917

1436

1918

# StopChecker - method

1919

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1437

1920

@dbus.service.method(_interface)

1438

1921

def StopChecker(self):

1439

1922

self.stop_checker()

1446

1929

return dbus.Boolean(bool(self.approvals_pending))

1447

1930

1448

1931

# ApprovedByDefault - property

1449

@dbus_service_property(_interface, signature="b",

1932

@dbus_service_property(_interface,

1933

signature="b",

1450

1934

access="readwrite")

1451

1935

def ApprovedByDefault_dbus_property(self, value=None):

1452

1936

if value is None: # get

1454

1938

self.approved_by_default = bool(value)

1455

1939

1456

1940

# ApprovalDelay - property

1457

@dbus_service_property(_interface, signature="t",

1941

@dbus_service_property(_interface,

1942

signature="t",

1458

1943

access="readwrite")

1459

1944

def ApprovalDelay_dbus_property(self, value=None):

1460

1945

if value is None: # get

1461

return dbus.UInt64(self.approval_delay_milliseconds())

1946

return dbus.UInt64(self.approval_delay.total_seconds()

1947

* 1000)

1462

1948

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1463

1949

1464

1950

# ApprovalDuration - property

1465

@dbus_service_property(_interface, signature="t",

1951

@dbus_service_property(_interface,

1952

signature="t",

1466

1953

access="readwrite")

1467

1954

def ApprovalDuration_dbus_property(self, value=None):

1468

1955

if value is None: # get

1469

return dbus.UInt64(timedelta_to_milliseconds(

1470

self.approval_duration))

1956

return dbus.UInt64(self.approval_duration.total_seconds()

1957

* 1000)

1471

1958

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1472

1959

1473

1960

# Name - property

1961

@dbus_annotations(

1962

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1474

1963

@dbus_service_property(_interface, signature="s", access="read")

1475

1964

def Name_dbus_property(self):

1476

1965

return dbus.String(self.name)

1477

1966

1478

1967

# Fingerprint - property

1968

@dbus_annotations(

1969

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1479

1970

@dbus_service_property(_interface, signature="s", access="read")

1480

1971

def Fingerprint_dbus_property(self):

1481

1972

return dbus.String(self.fingerprint)

1482

1973

1483

1974

# Host - property

1484

@dbus_service_property(_interface, signature="s",

1975

@dbus_service_property(_interface,

1976

signature="s",

1485

1977

access="readwrite")

1486

1978

def Host_dbus_property(self, value=None):

1487

1979

if value is None: # get

1488

1980

return dbus.String(self.host)

1489

self.host = unicode(value)

1981

self.host = str(value)

1490

1982

1491

1983

# Created - property

1984

@dbus_annotations(

1985

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1492

1986

@dbus_service_property(_interface, signature="s", access="read")

1493

1987

def Created_dbus_property(self):

1494

1988

return datetime_to_dbus(self.created)

1499

1993

return datetime_to_dbus(self.last_enabled)

1500

1994

1501

1995

# Enabled - property

1502

@dbus_service_property(_interface, signature="b",

1996

@dbus_service_property(_interface,

1997

signature="b",

1503

1998

access="readwrite")

1504

1999

def Enabled_dbus_property(self, value=None):

1505

2000

if value is None: # get

1510

2005

self.disable()

1511

2006

1512

2007

# LastCheckedOK - property

1513

@dbus_service_property(_interface, signature="s",

2008

@dbus_service_property(_interface,

2009

signature="s",

1514

2010

access="readwrite")

1515

2011

def LastCheckedOK_dbus_property(self, value=None):

1516

2012

if value is not None:

1519

2015

return datetime_to_dbus(self.last_checked_ok)

1520

2016

1521

2017

# LastCheckerStatus - property

1522

@dbus_service_property(_interface, signature="n",

1523

access="read")

2018

@dbus_service_property(_interface, signature="n", access="read")

1524

2019

def LastCheckerStatus_dbus_property(self):

1525

2020

return dbus.Int16(self.last_checker_status)

1526

2021

1535

2030

return datetime_to_dbus(self.last_approval_request)

1536

2031

1537

2032

# Timeout - property

1538

@dbus_service_property(_interface, signature="t",

2033

@dbus_service_property(_interface,

2034

signature="t",

1539

2035

access="readwrite")

1540

2036

def Timeout_dbus_property(self, value=None):

1541

2037

if value is None: # get

1542

return dbus.UInt64(self.timeout_milliseconds())

2038

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1543

2039

old_timeout = self.timeout

1544

2040

self.timeout = datetime.timedelta(0, 0, 0, value)

1545

2041

# Reschedule disabling

1553

2049

if (getattr(self, "disable_initiator_tag", None)

1554

2050

is None):

1555

2051

return

1556

gobject.source_remove(self.disable_initiator_tag)

1557

self.disable_initiator_tag = (

1558

gobject.timeout_add(

1559

timedelta_to_milliseconds(self.expires - now),

1560

self.disable))

2052

GObject.source_remove(self.disable_initiator_tag)

2053

self.disable_initiator_tag = GObject.timeout_add(

2054

int((self.expires - now).total_seconds() * 1000),

2055

self.disable)

1561

2056

1562

2057

# ExtendedTimeout - property

1563

@dbus_service_property(_interface, signature="t",

2058

@dbus_service_property(_interface,

2059

signature="t",

1564

2060

access="readwrite")

1565

2061

def ExtendedTimeout_dbus_property(self, value=None):

1566

2062

if value is None: # get

1567

return dbus.UInt64(self.extended_timeout_milliseconds())

2063

return dbus.UInt64(self.extended_timeout.total_seconds()

2064

* 1000)

1568

2065

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1569

2066

1570

2067

# Interval - property

1571

@dbus_service_property(_interface, signature="t",

2068

@dbus_service_property(_interface,

2069

signature="t",

1572

2070

access="readwrite")

1573

2071

def Interval_dbus_property(self, value=None):

1574

2072

if value is None: # get

1575

return dbus.UInt64(self.interval_milliseconds())

2073

return dbus.UInt64(self.interval.total_seconds() * 1000)

1576

2074

self.interval = datetime.timedelta(0, 0, 0, value)

1577

2075

if getattr(self, "checker_initiator_tag", None) is None:

1578

2076

return

1579

2077

if self.enabled:

1580

2078

# Reschedule checker run

1581

gobject.source_remove(self.checker_initiator_tag)

1582

self.checker_initiator_tag = (gobject.timeout_add

1583

(value, self.start_checker))

1584

self.start_checker() # Start one now, too

2079

GObject.source_remove(self.checker_initiator_tag)

2080

self.checker_initiator_tag = GObject.timeout_add(

2081

value, self.start_checker)

2082

self.start_checker() # Start one now, too

1585

2083

1586

2084

# Checker - property

1587

@dbus_service_property(_interface, signature="s",

2085

@dbus_service_property(_interface,

2086

signature="s",

1588

2087

access="readwrite")

1589

2088

def Checker_dbus_property(self, value=None):

1590

2089

if value is None: # get

1591

2090

return dbus.String(self.checker_command)

1592

self.checker_command = unicode(value)

2091

self.checker_command = str(value)

1593

2092

1594

2093

# CheckerRunning - property

1595

@dbus_service_property(_interface, signature="b",

2094

@dbus_service_property(_interface,

2095

signature="b",

1596

2096

access="readwrite")

1597

2097

def CheckerRunning_dbus_property(self, value=None):

1598

2098

if value is None: # get

1603

2103

self.stop_checker()

1604

2104

1605

2105

# ObjectPath - property

2106

@dbus_annotations(

2107

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2108

"org.freedesktop.DBus.Deprecated": "true"})

1606

2109

@dbus_service_property(_interface, signature="o", access="read")

1607

2110

def ObjectPath_dbus_property(self):

1608

2111

return self.dbus_object_path # is already a dbus.ObjectPath

1609

2112

1610

2113

# Secret = property

1611

@dbus_service_property(_interface, signature="ay",

1612

access="write", byte_arrays=True)

2114

@dbus_annotations(

2115

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2116

"invalidates"})

2117

@dbus_service_property(_interface,

2118

signature="ay",

2119

access="write",

2120

byte_arrays=True)

1613

2121

def Secret_dbus_property(self, value):

1614

self.secret = str(value)

2122

self.secret = bytes(value)

1615

2123

1616

2124

del _interface

1617

2125

1621

2129

self._pipe = child_pipe

1622

2130

self._pipe.send(('init', fpr, address))

1623

2131

if not self._pipe.recv():

1624

raise KeyError()

2132

raise KeyError(fpr)

1625

2133

1626

2134

def __getattribute__(self, name):

1627

2135

if name == '_pipe':

1631

2139

if data[0] == 'data':

1632

2140

return data[1]

1633

2141

if data[0] == 'function':

2142

1634

2143

def func(*args, **kwargs):

1635

2144

self._pipe.send(('funcall', name, args, kwargs))

1636

2145

return self._pipe.recv()[1]

2146

1637

2147

return func

1638

2148

1639

2149

def __setattr__(self, name, value):

1651

2161

def handle(self):

1652

2162

with contextlib.closing(self.server.child_pipe) as child_pipe:

1653

2163

logger.info("TCP connection from: %s",

1654

unicode(self.client_address))

2164

str(self.client_address))

1655

2165

logger.debug("Pipe FD: %d",

1656

2166

self.server.child_pipe.fileno())

1657

2167

1658

session = (gnutls.connection

1659

.ClientSession(self.request,

1660

gnutls.connection

1661

.X509Credentials()))

1662

1663

# Note: gnutls.connection.X509Credentials is really a

1664

# generic GnuTLS certificate credentials object so long as

1665

# no X.509 keys are added to it. Therefore, we can use it

1666

# here despite using OpenPGP certificates.

2168

session = gnutls.ClientSession(self.request)

1667

2169

1668

2170

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1669

2171

# "+AES-256-CBC", "+SHA1",

1673

2175

priority = self.server.gnutls_priority

1674

2176

if priority is None:

1675

2177

priority = "NORMAL"

1676

(gnutls.library.functions

1677

.gnutls_priority_set_direct(session._c_object,

1678

priority, None))

2178

gnutls.priority_set_direct(session._c_object, priority,

2179

None)

1679

2180

1680

2181

# Start communication using the Mandos protocol

1681

2182

# Get protocol number

1683

2184

logger.debug("Protocol version: %r", line)

1684

2185

try:

1685

2186

if int(line.strip().split()[0]) > 1:

1686

raise RuntimeError

2187

raise RuntimeError(line)

1687

2188

except (ValueError, IndexError, RuntimeError) as error:

1688

2189

logger.error("Unknown protocol version: %s", error)

1689

2190

return

1691

2192

# Start GnuTLS connection

1692

2193

try:

1693

2194

session.handshake()

1694

except gnutls.errors.GNUTLSError as error:

2195

except gnutls.Error as error:

1695

2196

logger.warning("Handshake failed: %s", error)

1696

2197

# Do not run session.bye() here: the session is not

1697

2198

# established. Just abandon the request.

1701

2202

approval_required = False

1702

2203

try:

1703

2204

try:

1704

fpr = self.fingerprint(self.peer_certificate

1705

(session))

1706

except (TypeError,

1707

gnutls.errors.GNUTLSError) as error:

2205

fpr = self.fingerprint(

2206

self.peer_certificate(session))

2207

except (TypeError, gnutls.Error) as error:

1708

2208

logger.warning("Bad certificate: %s", error)

1709

2209

return

1710

2210

logger.debug("Fingerprint: %s", fpr)

1723

2223

while True:

1724

2224

if not client.enabled:

1725

2225

logger.info("Client %s is disabled",

1726

client.name)

2226

client.name)

1727

2227

if self.server.use_dbus:

1728

2228

# Emit D-Bus signal

1729

2229

client.Rejected("Disabled")

1738

2238

if self.server.use_dbus:

1739

2239

# Emit D-Bus signal

1740

2240

client.NeedApproval(

1741

client.approval_delay_milliseconds(),

1742

client.approved_by_default)

2241

client.approval_delay.total_seconds()

2242

* 1000, client.approved_by_default)

1743

2243

else:

1744

2244

logger.warning("Client %s was not approved",

1745

2245

client.name)

1751

2251

#wait until timeout or approved

1752

2252

time = datetime.datetime.now()

1753

2253

client.changedstate.acquire()

1754

client.changedstate.wait(

1755

float(timedelta_to_milliseconds(delay)

1756

/ 1000))

2254

client.changedstate.wait(delay.total_seconds())

1757

2255

client.changedstate.release()

1758

2256

time2 = datetime.datetime.now()

1759

2257

if (time2 - time) >= delay:

1770

2268

else:

1771

2269

delay -= time2 - time

1772

2270

1773

sent_size = 0

1774

while sent_size < len(client.secret):

1775

try:

1776

sent = session.send(client.secret[sent_size:])

1777

except gnutls.errors.GNUTLSError as error:

1778

logger.warning("gnutls send failed",

1779

exc_info=error)

1780

return

1781

logger.debug("Sent: %d, remaining: %d",

1782

sent, len(client.secret)

1783

- (sent_size + sent))

1784

sent_size += sent

2271

try:

2272

session.send(client.secret)

2273

except gnutls.Error as error:

2274

logger.warning("gnutls send failed",

2275

exc_info = error)

2276

return

1785

2277

1786

2278

logger.info("Sending secret to %s", client.name)

1787

2279

# bump the timeout using extended_timeout

1795

2287

client.approvals_pending -= 1

1796

2288

try:

1797

2289

session.bye()

1798

except gnutls.errors.GNUTLSError as error:

2290

except gnutls.Error as error:

1799

2291

logger.warning("GnuTLS bye failed",

1800

2292

exc_info=error)

1801

2293

1803

2295

def peer_certificate(session):

1804

2296

"Return the peer's OpenPGP certificate as a bytestring"

1805

2297

# If not an OpenPGP certificate...

1806

if (gnutls.library.functions

1807

.gnutls_certificate_type_get(session._c_object)

1808

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1809

# ...do the normal thing

1810

return session.peer_certificate

2298

if (gnutls.certificate_type_get(session._c_object)

2299

!= gnutls.CRT_OPENPGP):

2300

# ...return invalid data

2301

return b""

1811

2302

list_size = ctypes.c_uint(1)

1812

cert_list = (gnutls.library.functions

1813

.gnutls_certificate_get_peers

2303

cert_list = (gnutls.certificate_get_peers

1814

2304

(session._c_object, ctypes.byref(list_size)))

1815

2305

if not bool(cert_list) and list_size.value != 0:

1816

raise gnutls.errors.GNUTLSError("error getting peer"

1817

" certificate")

2306

raise gnutls.Error("error getting peer certificate")

1818

2307

if list_size.value == 0:

1819

2308

return None

1820

2309

cert = cert_list[0]

1824

2313

def fingerprint(openpgp):

1825

2314

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1826

2315

# New GnuTLS "datum" with the OpenPGP public key

1827

datum = (gnutls.library.types

1828

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1829

ctypes.POINTER

1830

(ctypes.c_ubyte)),

1831

ctypes.c_uint(len(openpgp))))

2316

datum = gnutls.datum_t(

2317

ctypes.cast(ctypes.c_char_p(openpgp),

2318

ctypes.POINTER(ctypes.c_ubyte)),

2319

ctypes.c_uint(len(openpgp)))

1832

2320

# New empty GnuTLS certificate

1833

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1834

(gnutls.library.functions

1835

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2321

crt = gnutls.openpgp_crt_t()

2322

gnutls.openpgp_crt_init(ctypes.byref(crt))

1836

2323

# Import the OpenPGP public key into the certificate

1837

(gnutls.library.functions

1838

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1839

gnutls.library.constants

1840

.GNUTLS_OPENPGP_FMT_RAW))

2324

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2325

gnutls.OPENPGP_FMT_RAW)

1841

2326

# Verify the self signature in the key

1842

2327

crtverify = ctypes.c_uint()

1843

(gnutls.library.functions

1844

.gnutls_openpgp_crt_verify_self(crt, 0,

1845

ctypes.byref(crtverify)))

2328

gnutls.openpgp_crt_verify_self(crt, 0,

2329

ctypes.byref(crtverify))

1846

2330

if crtverify.value != 0:

1847

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1848

raise (gnutls.errors.CertificateSecurityError

1849

("Verify failed"))

2331

gnutls.openpgp_crt_deinit(crt)

2332

raise gnutls.CertificateSecurityError("Verify failed")

1850

2333

# New buffer for the fingerprint

1851

2334

buf = ctypes.create_string_buffer(20)

1852

2335

buf_len = ctypes.c_size_t()

1853

2336

# Get the fingerprint from the certificate into the buffer

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1856

ctypes.byref(buf_len)))

2337

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2338

ctypes.byref(buf_len))

1857

2339

# Deinit the certificate

1858

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2340

gnutls.openpgp_crt_deinit(crt)

1859

2341

# Convert the buffer to a Python bytestring

1860

2342

fpr = ctypes.string_at(buf, buf_len.value)

1861

2343

# Convert the bytestring to hexadecimal notation

1865

2347

1866

2348

class MultiprocessingMixIn(object):

1867

2349

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2350

1868

2351

def sub_process_main(self, request, address):

1869

2352

try:

1870

2353

self.finish_request(request, address)

1882

2365

1883

2366

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1884

2367

""" adds a pipe to the MixIn """

2368

1885

2369

def process_request(self, request, client_address):

1886

2370

"""Overrides and wraps the original process_request().

1887

2371

1896

2380

1897

2381

def add_pipe(self, parent_pipe, proc):

1898

2382

"""Dummy function; override as necessary"""

1899

raise NotImplementedError

2383

raise NotImplementedError()

1900

2384

1901

2385

1902

2386

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1908

2392

interface: None or a network interface name (string)

1909

2393

use_ipv6: Boolean; to use IPv6 or not

1910

2394

"""

2395

1911

2396

def __init__(self, server_address, RequestHandlerClass,

1912

interface=None, use_ipv6=True, socketfd=None):

2397

interface=None,

2398

use_ipv6=True,

2399

socketfd=None):

1913

2400

"""If socketfd is set, use that file descriptor instead of

1914

2401

creating a new one with socket.socket().

1915

2402

"""

1956

2443

self.interface)

1957

2444

else:

1958

2445

try:

1959

self.socket.setsockopt(socket.SOL_SOCKET,

1960

SO_BINDTODEVICE,

1961

str(self.interface + '\0'))

2446

self.socket.setsockopt(

2447

socket.SOL_SOCKET, SO_BINDTODEVICE,

2448

(self.interface + "\0").encode("utf-8"))

1962

2449

except socket.error as error:

1963

2450

if error.errno == errno.EPERM:

1964

2451

logger.error("No permission to bind to"

1978

2465

if self.address_family == socket.AF_INET6:

1979

2466

any_address = "::" # in6addr_any

1980

2467

else:

1981

any_address = socket.INADDR_ANY

2468

any_address = "0.0.0.0" # INADDR_ANY

1982

2469

self.server_address = (any_address,

1983

2470

self.server_address[1])

1984

2471

elif not self.server_address[1]:

1985

self.server_address = (self.server_address[0],

1986

0)

2472

self.server_address = (self.server_address[0], 0)

1987

2473

# if self.interface:

1988

2474

# self.server_address = (self.server_address[0],

1989

2475

# 0, # port

2001

2487

gnutls_priority GnuTLS priority string

2002

2488

use_dbus: Boolean; to emit D-Bus signals or not

2003

2489

2004

Assumes a gobject.MainLoop event loop.

2490

Assumes a GObject.MainLoop event loop.

2005

2491

"""

2492

2006

2493

def __init__(self, server_address, RequestHandlerClass,

2007

interface=None, use_ipv6=True, clients=None,

2008

gnutls_priority=None, use_dbus=True, socketfd=None):

2494

interface=None,

2495

use_ipv6=True,

2496

clients=None,

2497

gnutls_priority=None,

2498

use_dbus=True,

2499

socketfd=None):

2009

2500

self.enabled = False

2010

2501

self.clients = clients

2011

2502

if self.clients is None:

2017

2508

interface = interface,

2018

2509

use_ipv6 = use_ipv6,

2019

2510

socketfd = socketfd)

2511

2020

2512

def server_activate(self):

2021

2513

if self.enabled:

2022

2514

return socketserver.TCPServer.server_activate(self)

2026

2518

2027

2519

def add_pipe(self, parent_pipe, proc):

2028

2520

# Call "handle_ipc" for both data and EOF events

2029

gobject.io_add_watch(parent_pipe.fileno(),

2030

gobject.IO_IN | gobject.IO_HUP,

2031

functools.partial(self.handle_ipc,

2032

parent_pipe =

2033

parent_pipe,

2034

proc = proc))

2521

GObject.io_add_watch(

2522

parent_pipe.fileno(),

2523

GObject.IO_IN | GObject.IO_HUP,

2524

functools.partial(self.handle_ipc,

2525

parent_pipe = parent_pipe,

2526

proc = proc))

2035

2527

2036

def handle_ipc(self, source, condition, parent_pipe=None,

2037

proc = None, client_object=None):

2528

def handle_ipc(self, source, condition,

2529

parent_pipe=None,

2530

proc = None,

2531

client_object=None):

2038

2532

# error, or the other end of multiprocessing.Pipe has closed

2039

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2533

if condition & (GObject.IO_ERR | GObject.IO_HUP):

2040

2534

# Wait for other process to exit

2041

2535

proc.join()

2042

2536

return False

2049

2543

fpr = request[1]

2050

2544

address = request[2]

2051

2545

2052

for c in self.clients.itervalues():

2546

for c in self.clients.values():

2053

2547

if c.fingerprint == fpr:

2054

2548

client = c

2055

2549

break

2063

2557

parent_pipe.send(False)

2064

2558

return False

2065

2559

2066

gobject.io_add_watch(parent_pipe.fileno(),

2067

gobject.IO_IN | gobject.IO_HUP,

2068

functools.partial(self.handle_ipc,

2069

parent_pipe =

2070

parent_pipe,

2071

proc = proc,

2072

client_object =

2073

client))

2560

GObject.io_add_watch(

2561

parent_pipe.fileno(),

2562

GObject.IO_IN | GObject.IO_HUP,

2563

functools.partial(self.handle_ipc,

2564

parent_pipe = parent_pipe,

2565

proc = proc,

2566

client_object = client))

2074

2567

parent_pipe.send(True)

2075

2568

# remove the old hook in favor of the new above hook on

2076

2569

# same fileno

2082

2575

2083

2576

parent_pipe.send(('data', getattr(client_object,

2084

2577

funcname)(*args,

2085

**kwargs)))

2578

**kwargs)))

2086

2579

2087

2580

if command == 'getattr':

2088

2581

attrname = request[1]

2089

if callable(client_object.__getattribute__(attrname)):

2090

parent_pipe.send(('function',))

2582

if isinstance(client_object.__getattribute__(attrname),

2583

collections.Callable):

2584

parent_pipe.send(('function', ))

2091

2585

else:

2092

parent_pipe.send(('data', client_object

2093

.__getattribute__(attrname)))

2586

parent_pipe.send((

2587

'data', client_object.__getattribute__(attrname)))

2094

2588

2095

2589

if command == 'setattr':

2096

2590

attrname = request[1]

2127

2621

# avoid excessive use of external libraries.

2128

2622

2129

2623

# New type for defining tokens, syntax, and semantics all-in-one

2130

Token = collections.namedtuple("Token",

2131

("regexp", # To match token; if

2132

# "value" is not None,

2133

# must have a "group"

2134

# containing digits

2135

"value", # datetime.timedelta or

2136

# None

2137

"followers")) # Tokens valid after

2138

# this token

2624

Token = collections.namedtuple("Token", (

2625

"regexp", # To match token; if "value" is not None, must have

2626

# a "group" containing digits

2627

"value", # datetime.timedelta or None

2628

"followers")) # Tokens valid after this token

2139

2629

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2140

2630

# the "duration" ABNF definition in RFC 3339, Appendix A.

2141

2631

token_end = Token(re.compile(r"$"), None, frozenset())

2142

2632

token_second = Token(re.compile(r"(\d+)S"),

2143

2633

datetime.timedelta(seconds=1),

2144

frozenset((token_end,)))

2634

frozenset((token_end, )))

2145

2635

token_minute = Token(re.compile(r"(\d+)M"),

2146

2636

datetime.timedelta(minutes=1),

2147

2637

frozenset((token_second, token_end)))

2163

2653

frozenset((token_month, token_end)))

2164

2654

token_week = Token(re.compile(r"(\d+)W"),

2165

2655

datetime.timedelta(weeks=1),

2166

frozenset((token_end,)))

2656

frozenset((token_end, )))

2167

2657

token_duration = Token(re.compile(r"P"), None,

2168

2658

frozenset((token_year, token_month,

2169

2659

token_day, token_time,

2170

token_week))),

2660

token_week)))

2171

2661

# Define starting values

2172

2662

value = datetime.timedelta() # Value so far

2173

2663

found_token = None

2174

followers = frozenset(token_duration,) # Following valid tokens

2664

followers = frozenset((token_duration, )) # Following valid tokens

2175

2665

s = duration # String left to parse

2176

2666

# Loop until end token is found

2177

2667

while found_token is not token_end:

2194

2684

break

2195

2685

else:

2196

2686

# No currently valid tokens were found

2197

raise ValueError("Invalid RFC 3339 duration")

2687

raise ValueError("Invalid RFC 3339 duration: {!r}"

2688

.format(duration))

2198

2689

# End token found

2199

2690

return value

2200

2691

2224

2715

timevalue = datetime.timedelta(0)

2225

2716

for s in interval.split():

2226

2717

try:

2227

suffix = unicode(s[-1])

2718

suffix = s[-1]

2228

2719

value = int(s[:-1])

2229

2720

if suffix == "d":

2230

2721

delta = datetime.timedelta(value)

2237

2728

elif suffix == "w":

2238

2729

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2239

2730

else:

2240

raise ValueError("Unknown suffix {0!r}"

2241

.format(suffix))

2242

except (ValueError, IndexError) as e:

2731

raise ValueError("Unknown suffix {!r}".format(suffix))

2732

except IndexError as e:

2243

2733

raise ValueError(*(e.args))

2244

2734

timevalue += delta

2245

2735

return timevalue

2261

2751

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2262

2752

if not stat.S_ISCHR(os.fstat(null).st_mode):

2263

2753

raise OSError(errno.ENODEV,

2264

"{0} not a character device"

2754

"{} not a character device"

2265

2755

.format(os.devnull))

2266

2756

os.dup2(null, sys.stdin.fileno())

2267

2757

os.dup2(null, sys.stdout.fileno())

2277

2767

2278

2768

parser = argparse.ArgumentParser()

2279

2769

parser.add_argument("-v", "--version", action="version",

2280

version = "%(prog)s {0}".format(version),

2770

version = "%(prog)s {}".format(version),

2281

2771

help="show version number and exit")

2282

2772

parser.add_argument("-i", "--interface", metavar="IF",

2283

2773

help="Bind to interface IF")

2289

2779

help="Run self-test")

2290

2780

parser.add_argument("--debug", action="store_true",

2291

2781

help="Debug mode; run in foreground and log"

2292

" to terminal")

2782

" to terminal", default=None)

2293

2783

parser.add_argument("--debuglevel", metavar="LEVEL",

2294

2784

help="Debug level for stdout output")

2295

2785

parser.add_argument("--priority", help="GnuTLS"

2302

2792

" files")

2303

2793

parser.add_argument("--no-dbus", action="store_false",

2304

2794

dest="use_dbus", help="Do not provide D-Bus"

2305

" system bus interface")

2795

" system bus interface", default=None)

2306

2796

parser.add_argument("--no-ipv6", action="store_false",

2307

dest="use_ipv6", help="Do not use IPv6")

2797

dest="use_ipv6", help="Do not use IPv6",

2798

default=None)

2308

2799

parser.add_argument("--no-restore", action="store_false",

2309

2800

dest="restore", help="Do not restore stored"

2310

" state")

2801

" state", default=None)

2311

2802

parser.add_argument("--socket", type=int,

2312

2803

help="Specify a file descriptor to a network"

2313

2804

" socket to use instead of creating one")

2314

2805

parser.add_argument("--statedir", metavar="DIR",

2315

2806

help="Directory to save/restore state in")

2316

2807

parser.add_argument("--foreground", action="store_true",

2317

help="Run in foreground")

2808

help="Run in foreground", default=None)

2809

parser.add_argument("--no-zeroconf", action="store_false",

2810

dest="zeroconf", help="Do not use Zeroconf",

2811

default=None)

2318

2812

2319

2813

options = parser.parse_args()

2320

2814

2321

2815

if options.check:

2322

2816

import doctest

2323

doctest.testmod()

2324

sys.exit()

2817

fail_count, test_count = doctest.testmod()

2818

sys.exit(os.EX_OK if fail_count == 0 else 1)

2325

2819

2326

2820

# Default values for config file for server-global settings

2327

2821

server_defaults = { "interface": "",

2329

2823

"port": "",

2330

2824

"debug": "False",

2331

2825

"priority":

2332

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2826

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2827

":+SIGN-DSA-SHA256",

2333

2828

"servicename": "Mandos",

2334

2829

"use_dbus": "True",

2335

2830

"use_ipv6": "True",

2338

2833

"socket": "",

2339

2834

"statedir": "/var/lib/mandos",

2340

2835

"foreground": "False",

2341

}

2836

"zeroconf": "True",

2837

}

2342

2838

2343

2839

# Parse config file for server-global settings

2344

2840

server_config = configparser.SafeConfigParser(server_defaults)

2345

2841

del server_defaults

2346

server_config.read(os.path.join(options.configdir,

2347

"mandos.conf"))

2842

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2348

2843

# Convert the SafeConfigParser object to a dict

2349

2844

server_settings = server_config.defaults()

2350

2845

# Use the appropriate methods on the non-string config options

2368

2863

# Override the settings from the config file with command line

2369

2864

# options, if set.

2370

2865

for option in ("interface", "address", "port", "debug",

2371

"priority", "servicename", "configdir",

2372

"use_dbus", "use_ipv6", "debuglevel", "restore",

2373

"statedir", "socket", "foreground"):

2866

"priority", "servicename", "configdir", "use_dbus",

2867

"use_ipv6", "debuglevel", "restore", "statedir",

2868

"socket", "foreground", "zeroconf"):

2374

2869

value = getattr(options, option)

2375

2870

if value is not None:

2376

2871

server_settings[option] = value

2377

2872

del options

2378

2873

# Force all strings to be unicode

2379

2874

for option in server_settings.keys():

2380

if type(server_settings[option]) is str:

2381

server_settings[option] = unicode(server_settings[option])

2875

if isinstance(server_settings[option], bytes):

2876

server_settings[option] = (server_settings[option]

2877

.decode("utf-8"))

2878

# Force all boolean options to be boolean

2879

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2880

"foreground", "zeroconf"):

2881

server_settings[option] = bool(server_settings[option])

2382

2882

# Debug implies foreground

2383

2883

if server_settings["debug"]:

2384

2884

server_settings["foreground"] = True

2386

2886

2387

2887

##################################################################

2388

2888

2889

if (not server_settings["zeroconf"]

2890

and not (server_settings["port"]

2891

or server_settings["socket"] != "")):

2892

parser.error("Needs port or socket to work without Zeroconf")

2893

2389

2894

# For convenience

2390

2895

debug = server_settings["debug"]

2391

2896

debuglevel = server_settings["debuglevel"]

2394

2899

stored_state_path = os.path.join(server_settings["statedir"],

2395

2900

stored_state_file)

2396

2901

foreground = server_settings["foreground"]

2902

zeroconf = server_settings["zeroconf"]

2397

2903

2398

2904

if debug:

2399

2905

initlogger(debug, logging.DEBUG)

2405

2911

initlogger(debug, level)

2406

2912

2407

2913

if server_settings["servicename"] != "Mandos":

2408

syslogger.setFormatter(logging.Formatter

2409

('Mandos ({0}) [%(process)d]:'

2410

' %(levelname)s: %(message)s'

2411

.format(server_settings

2412

["servicename"])))

2914

syslogger.setFormatter(

2915

logging.Formatter('Mandos ({}) [%(process)d]:'

2916

' %(levelname)s: %(message)s'.format(

2917

server_settings["servicename"])))

2413

2918

2414

2919

# Parse config file with clients

2415

2920

client_config = configparser.SafeConfigParser(Client

2420

2925

global mandos_dbus_service

2421

2926

mandos_dbus_service = None

2422

2927

2423

tcp_server = MandosServer((server_settings["address"],

2424

server_settings["port"]),

2425

ClientHandler,

2426

interface=(server_settings["interface"]

2427

or None),

2428

use_ipv6=use_ipv6,

2429

gnutls_priority=

2430

server_settings["priority"],

2431

use_dbus=use_dbus,

2432

socketfd=(server_settings["socket"]

2433

or None))

2928

socketfd = None

2929

if server_settings["socket"] != "":

2930

socketfd = server_settings["socket"]

2931

tcp_server = MandosServer(

2932

(server_settings["address"], server_settings["port"]),

2933

ClientHandler,

2934

interface=(server_settings["interface"] or None),

2935

use_ipv6=use_ipv6,

2936

gnutls_priority=server_settings["priority"],

2937

use_dbus=use_dbus,

2938

socketfd=socketfd)

2434

2939

if not foreground:

2435

pidfilename = "/var/run/mandos.pid"

2940

pidfilename = "/run/mandos.pid"

2941

if not os.path.isdir("/run/."):

2942

pidfilename = "/var/run/mandos.pid"

2436

2943

pidfile = None

2437

2944

try:

2438

pidfile = open(pidfilename, "w")

2945

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2439

2946

except IOError as e:

2440

2947

logger.error("Could not open file %r", pidfilename,

2441

2948

exc_info=e)

2442

2949

2443

for name in ("_mandos", "mandos", "nobody"):

2950

for name, group in (("_mandos", "_mandos"),

2951

("mandos", "mandos"),

2952

("nobody", "nogroup")):

2444

2953

try:

2445

2954

uid = pwd.getpwnam(name).pw_uid

2446

gid = pwd.getpwnam(name).pw_gid

2955

gid = pwd.getpwnam(group).pw_gid

2447

2956

break

2448

2957

except KeyError:

2449

2958

continue

2453

2962

try:

2454

2963

os.setgid(gid)

2455

2964

os.setuid(uid)

2965

if debug:

2966

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2967

gid))

2456

2968

except OSError as error:

2969

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2970

.format(uid, gid, os.strerror(error.errno)))

2457

2971

if error.errno != errno.EPERM:

2458

raise error

2972

raise

2459

2973

2460

2974

if debug:

2461

2975

# Enable all possible GnuTLS debugging

2462

2976

2463

2977

# "Use a log level over 10 to enable all debugging options."

2464

2978

# - GnuTLS manual

2465

gnutls.library.functions.gnutls_global_set_log_level(11)

2979

gnutls.global_set_log_level(11)

2466

2980

2467

@gnutls.library.types.gnutls_log_func

2981

@gnutls.log_func

2468

2982

def debug_gnutls(level, string):

2469

2983

logger.debug("GnuTLS: %s", string[:-1])

2470

2984

2471

(gnutls.library.functions

2472

.gnutls_global_set_log_function(debug_gnutls))

2985

gnutls.global_set_log_function(debug_gnutls)

2473

2986

2474

2987

# Redirect stdin so all checkers get /dev/null

2475

2988

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2482

2995

# Close all input and output, do double fork, etc.

2483

2996

daemon()

2484

2997

2485

# multiprocessing will use threads, so before we use gobject we

2486

# need to inform gobject that threads will be used.

2487

gobject.threads_init()

2998

# multiprocessing will use threads, so before we use GObject we

2999

# need to inform GObject that threads will be used.

3000

GObject.threads_init()

2488

3001

2489

3002

global main_loop

2490

3003

# From the Avahi example code

2491

3004

DBusGMainLoop(set_as_default=True)

2492

main_loop = gobject.MainLoop()

3005

main_loop = GObject.MainLoop()

2493

3006

bus = dbus.SystemBus()

2494

3007

# End of Avahi example code

2495

3008

if use_dbus:

2496

3009

try:

2497

3010

bus_name = dbus.service.BusName("se.recompile.Mandos",

2498

bus, do_not_queue=True)

2499

old_bus_name = (dbus.service.BusName

2500

("se.bsnet.fukt.Mandos", bus,

2501

do_not_queue=True))

2502

except dbus.exceptions.NameExistsException as e:

3011

bus,

3012

do_not_queue=True)

3013

old_bus_name = dbus.service.BusName(

3014

"se.bsnet.fukt.Mandos", bus,

3015

do_not_queue=True)

3016

except dbus.exceptions.DBusException as e:

2503

3017

logger.error("Disabling D-Bus:", exc_info=e)

2504

3018

use_dbus = False

2505

3019

server_settings["use_dbus"] = False

2506

3020

tcp_server.use_dbus = False

2507

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2508

service = AvahiServiceToSyslog(name =

2509

server_settings["servicename"],

2510

servicetype = "_mandos._tcp",

2511

protocol = protocol, bus = bus)

2512

if server_settings["interface"]:

2513

service.interface = (if_nametoindex

2514

(str(server_settings["interface"])))

3021

if zeroconf:

3022

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3023

service = AvahiServiceToSyslog(

3024

name = server_settings["servicename"],

3025

servicetype = "_mandos._tcp",

3026

protocol = protocol,

3027

bus = bus)

3028

if server_settings["interface"]:

3029

service.interface = if_nametoindex(

3030

server_settings["interface"].encode("utf-8"))

2515

3031

2516

3032

global multiprocessing_manager

2517

3033

multiprocessing_manager = multiprocessing.Manager()

2524

3040

old_client_settings = {}

2525

3041

clients_data = {}

2526

3042

3043

# This is used to redirect stdout and stderr for checker processes

3044

global wnull

3045

wnull = open(os.devnull, "w") # A writable /dev/null

3046

# Only used if server is running in foreground but not in debug

3047

# mode

3048

if debug or not foreground:

3049

wnull.close()

3050

2527

3051

# Get client data and settings from last running state.

2528

3052

if server_settings["restore"]:

2529

3053

try:

2530

3054

with open(stored_state_path, "rb") as stored_state:

2531

clients_data, old_client_settings = (pickle.load

2532

(stored_state))

3055

if sys.version_info.major == 2:

3056

clients_data, old_client_settings = pickle.load(

3057

stored_state)

3058

else:

3059

bytes_clients_data, bytes_old_client_settings = (

3060

pickle.load(stored_state, encoding = "bytes"))

3061

### Fix bytes to strings

3062

## clients_data

3063

# .keys()

3064

clients_data = { (key.decode("utf-8")

3065

if isinstance(key, bytes)

3066

else key): value

3067

for key, value in

3068

bytes_clients_data.items() }

3069

del bytes_clients_data

3070

for key in clients_data:

3071

value = { (k.decode("utf-8")

3072

if isinstance(k, bytes) else k): v

3073

for k, v in

3074

clients_data[key].items() }

3075

clients_data[key] = value

3076

# .client_structure

3077

value["client_structure"] = [

3078

(s.decode("utf-8")

3079

if isinstance(s, bytes)

3080

else s) for s in

3081

value["client_structure"] ]

3082

# .name & .host

3083

for k in ("name", "host"):

3084

if isinstance(value[k], bytes):

3085

value[k] = value[k].decode("utf-8")

3086

## old_client_settings

3087

# .keys()

3088

old_client_settings = {

3089

(key.decode("utf-8")

3090

if isinstance(key, bytes)

3091

else key): value

3092

for key, value in

3093

bytes_old_client_settings.items() }

3094

del bytes_old_client_settings

3095

# .host

3096

for value in old_client_settings.values():

3097

if isinstance(value["host"], bytes):

3098

value["host"] = (value["host"]

3099

.decode("utf-8"))

2533

3100

os.remove(stored_state_path)

2534

3101

except IOError as e:

2535

3102

if e.errno == errno.ENOENT:

2536

logger.warning("Could not load persistent state: {0}"

2537

.format(os.strerror(e.errno)))

3103

logger.warning("Could not load persistent state:"

3104

" {}".format(os.strerror(e.errno)))

2538

3105

else:

2539

3106

logger.critical("Could not load persistent state:",

2540

3107

exc_info=e)

2541

3108

raise

2542

3109

except EOFError as e:

2543

3110

logger.warning("Could not load persistent state: "

2544

"EOFError:", exc_info=e)

3111

"EOFError:",

3112

exc_info=e)

2545

3113

2546

3114

with PGPEngine() as pgp:

2547

for client_name, client in clients_data.iteritems():

3115

for client_name, client in clients_data.items():

3116

# Skip removed clients

3117

if client_name not in client_settings:

3118

continue

3119

2548

3120

# Decide which value to use after restoring saved state.

2549

3121

# We have three different values: Old config file,

2550

3122

# new config file, and saved state.

2555

3127

# For each value in new config, check if it

2556

3128

# differs from the old config value (Except for

2557

3129

# the "secret" attribute)

2558

if (name != "secret" and

2559

value != old_client_settings[client_name]

2560

[name]):

3130

if (name != "secret"

3131

and (value !=

3132

old_client_settings[client_name][name])):

2561

3133

client[name] = value

2562

3134

except KeyError:

2563

3135

pass

2564

3136

2565

3137

# Clients who has passed its expire date can still be

2566

# enabled if its last checker was successful. Clients

3138

# enabled if its last checker was successful. A Client

2567

3139

# whose checker succeeded before we stored its state is

2568

3140

# assumed to have successfully run all checkers during

2569

3141

# downtime.

2571

3143

if datetime.datetime.utcnow() >= client["expires"]:

2572

3144

if not client["last_checked_ok"]:

2573

3145

logger.warning(

2574

"disabling client {0} - Client never "

2575

"performed a successful checker"

2576

.format(client_name))

3146

"disabling client {} - Client never "

3147

"performed a successful checker".format(

3148

client_name))

2577

3149

client["enabled"] = False

2578

3150

elif client["last_checker_status"] != 0:

2579

3151

logger.warning(

2580

"disabling client {0} - Client "

2581

"last checker failed with error code {1}"

2582

.format(client_name,

2583

client["last_checker_status"]))

3152

"disabling client {} - Client last"

3153

" checker failed with error code"

3154

" {}".format(

3155

client_name,

3156

client["last_checker_status"]))

2584

3157

client["enabled"] = False

2585

3158

else:

2586

client["expires"] = (datetime.datetime

2587

.utcnow()

2588

+ client["timeout"])

3159

client["expires"] = (

3160

datetime.datetime.utcnow()

3161

+ client["timeout"])

2589

3162

logger.debug("Last checker succeeded,"

2590

" keeping {0} enabled"

2591

.format(client_name))

3163

" keeping {} enabled".format(

3164

client_name))

2592

3165

try:

2593

client["secret"] = (

2594

pgp.decrypt(client["encrypted_secret"],

2595

client_settings[client_name]

2596

["secret"]))

3166

client["secret"] = pgp.decrypt(

3167

client["encrypted_secret"],

3168

client_settings[client_name]["secret"])

2597

3169

except PGPError:

2598

3170

# If decryption fails, we use secret from new settings

2599

logger.debug("Failed to decrypt {0} old secret"

2600

.format(client_name))

2601

client["secret"] = (

2602

client_settings[client_name]["secret"])

3171

logger.debug("Failed to decrypt {} old secret".format(

3172

client_name))

3173

client["secret"] = (client_settings[client_name]

3174

["secret"])

2603

3175

2604

3176

# Add/remove clients based on new changes made to config

2605

3177

for client_name in (set(old_client_settings)

2610

3182

clients_data[client_name] = client_settings[client_name]

2611

3183

2612

3184

# Create all client objects

2613

for client_name, client in clients_data.iteritems():

3185

for client_name, client in clients_data.items():

2614

3186

tcp_server.clients[client_name] = client_class(

2615

name = client_name, settings = client)

3187

name = client_name,

3188

settings = client,

3189

server_settings = server_settings)

2616

3190

2617

3191

if not tcp_server.clients:

2618

3192

logger.warning("No clients defined")

2619

3193

2620

3194

if not foreground:

2621

3195

if pidfile is not None:

3196

pid = os.getpid()

2622

3197

try:

2623

3198

with pidfile:

2624

pid = os.getpid()

2625

pidfile.write(str(pid) + "\n".encode("utf-8"))

3199

print(pid, file=pidfile)

2626

3200

except IOError:

2627

3201

logger.error("Could not write to file %r with PID %d",

2628

3202

pidfilename, pid)

2633

3207

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2634

3208

2635

3209

if use_dbus:

2636

@alternate_dbus_interfaces({"se.recompile.Mandos":

2637

"se.bsnet.fukt.Mandos"})

2638

class MandosDBusService(DBusObjectWithProperties):

3210

3211

@alternate_dbus_interfaces(

3212

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3213

class MandosDBusService(DBusObjectWithObjectManager):

2639

3214

"""A D-Bus proxy object"""

3215

2640

3216

def __init__(self):

2641

3217

dbus.service.Object.__init__(self, bus, "/")

3218

2642

3219

_interface = "se.recompile.Mandos"

2643

3220

2644

@dbus_interface_annotations(_interface)

2645

def _foo(self):

2646

return { "org.freedesktop.DBus.Property"

2647

".EmitsChangedSignal":

2648

"false"}

2649

2650

3221

@dbus.service.signal(_interface, signature="o")

2651

3222

def ClientAdded(self, objpath):

2652

3223

"D-Bus signal"

2657

3228

"D-Bus signal"

2658

3229

pass

2659

3230

3231

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3232

"true"})

2660

3233

@dbus.service.signal(_interface, signature="os")

2661

3234

def ClientRemoved(self, objpath, name):

2662

3235

"D-Bus signal"

2663

3236

pass

2664

3237

3238

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3239

"true"})

2665

3240

@dbus.service.method(_interface, out_signature="ao")

2666

3241

def GetAllClients(self):

2667

3242

"D-Bus method"

2668

return dbus.Array(c.dbus_object_path

2669

for c in

2670

tcp_server.clients.itervalues())

3243

return dbus.Array(c.dbus_object_path for c in

3244

tcp_server.clients.values())

2671

3245

3246

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3247

"true"})

2672

3248

@dbus.service.method(_interface,

2673

3249

out_signature="a{oa{sv}}")

2674

3250

def GetAllClientsWithProperties(self):

2675

3251

"D-Bus method"

2676

3252

return dbus.Dictionary(

2677

((c.dbus_object_path, c.GetAll(""))

2678

for c in tcp_server.clients.itervalues()),

3253

{ c.dbus_object_path: c.GetAll(

3254

"se.recompile.Mandos.Client")

3255

for c in tcp_server.clients.values() },

2679

3256

signature="oa{sv}")

2680

3257

2681

3258

@dbus.service.method(_interface, in_signature="o")

2682

3259

def RemoveClient(self, object_path):

2683

3260

"D-Bus method"

2684

for c in tcp_server.clients.itervalues():

3261

for c in tcp_server.clients.values():

2685

3262

if c.dbus_object_path == object_path:

2686

3263

del tcp_server.clients[c.name]

2687

3264

c.remove_from_connection()

2688

# Don't signal anything except ClientRemoved

3265

# Don't signal the disabling

2689

3266

c.disable(quiet=True)

2690

# Emit D-Bus signal

2691

self.ClientRemoved(object_path, c.name)

3267

# Emit D-Bus signal for removal

3268

self.client_removed_signal(c)

2692

3269

return

2693

3270

raise KeyError(object_path)

2694

3271

2695

3272

del _interface

3273

3274

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3275

out_signature = "a{oa{sa{sv}}}")

3276

def GetManagedObjects(self):

3277

"""D-Bus method"""

3278

return dbus.Dictionary(

3279

{ client.dbus_object_path:

3280

dbus.Dictionary(

3281

{ interface: client.GetAll(interface)

3282

for interface in

3283

client._get_all_interface_names()})

3284

for client in tcp_server.clients.values()})

3285

3286

def client_added_signal(self, client):

3287

"""Send the new standard signal and the old signal"""

3288

if use_dbus:

3289

# New standard signal

3290

self.InterfacesAdded(

3291

client.dbus_object_path,

3292

dbus.Dictionary(

3293

{ interface: client.GetAll(interface)

3294

for interface in

3295

client._get_all_interface_names()}))

3296

# Old signal

3297

self.ClientAdded(client.dbus_object_path)

3298

3299

def client_removed_signal(self, client):

3300

"""Send the new standard signal and the old signal"""

3301

if use_dbus:

3302

# New standard signal

3303

self.InterfacesRemoved(

3304

client.dbus_object_path,

3305

client._get_all_interface_names())

3306

# Old signal

3307

self.ClientRemoved(client.dbus_object_path,

3308

client.name)

2696

3309

2697

3310

mandos_dbus_service = MandosDBusService()

2698

3311

2699

3312

def cleanup():

2700

3313

"Cleanup function; run on exit"

2701

service.cleanup()

3314

if zeroconf:

3315

service.cleanup()

2702

3316

2703

3317

multiprocessing.active_children()

3318

wnull.close()

2704

3319

if not (tcp_server.clients or client_settings):

2705

3320

return

2706

3321

2709

3324

# removed/edited, old secret will thus be unrecovable.

2710

3325

clients = {}

2711

3326

with PGPEngine() as pgp:

2712

for client in tcp_server.clients.itervalues():

3327

for client in tcp_server.clients.values():

2713

3328

key = client_settings[client.name]["secret"]

2714

3329

client.encrypted_secret = pgp.encrypt(client.secret,

2715

3330

key)

2717

3332

2718

3333

# A list of attributes that can not be pickled

2719

3334

# + secret.

2720

exclude = set(("bus", "changedstate", "secret",

2721

"checker"))

2722

for name, typ in (inspect.getmembers

2723

(dbus.service.Object)):

3335

exclude = { "bus", "changedstate", "secret",

3336

"checker", "server_settings" }

3337

for name, typ in inspect.getmembers(dbus.service

3338

.Object):

2724

3339

exclude.add(name)

2725

3340

2726

3341

client_dict["encrypted_secret"] = (client

2733

3348

del client_settings[client.name]["secret"]

2734

3349

2735

3350

try:

2736

with (tempfile.NamedTemporaryFile

2737

(mode='wb', suffix=".pickle", prefix='clients-',

2738

dir=os.path.dirname(stored_state_path),

2739

delete=False)) as stored_state:

2740

pickle.dump((clients, client_settings), stored_state)

2741

tempname=stored_state.name

3351

with tempfile.NamedTemporaryFile(

3352

mode='wb',

3353

suffix=".pickle",

3354

prefix='clients-',

3355

dir=os.path.dirname(stored_state_path),

3356

delete=False) as stored_state:

3357

pickle.dump((clients, client_settings), stored_state,

3358

protocol = 2)

3359

tempname = stored_state.name

2742

3360

os.rename(tempname, stored_state_path)

2743

3361

except (IOError, OSError) as e:

2744

3362

if not debug:

2747

3365

except NameError:

2748

3366

pass

2749

3367

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2750

logger.warning("Could not save persistent state: {0}"

3368

logger.warning("Could not save persistent state: {}"

2751

3369

.format(os.strerror(e.errno)))

2752

3370

else:

2753

3371

logger.warning("Could not save persistent state:",

2754

3372

exc_info=e)

2755

raise e

3373

raise

2756

3374

2757

3375

# Delete all clients, and settings from config

2758

3376

while tcp_server.clients:

2759

3377

name, client = tcp_server.clients.popitem()

2760

3378

if use_dbus:

2761

3379

client.remove_from_connection()

2762

# Don't signal anything except ClientRemoved

3380

# Don't signal the disabling

2763

3381

client.disable(quiet=True)

3382

# Emit D-Bus signal for removal

2764

3383

if use_dbus:

2765

# Emit D-Bus signal

2766

mandos_dbus_service.ClientRemoved(client

2767

.dbus_object_path,

2768

client.name)

3384

mandos_dbus_service.client_removed_signal(client)

2769

3385

client_settings.clear()

2770

3386

2771

3387

atexit.register(cleanup)

2772

3388

2773

for client in tcp_server.clients.itervalues():

3389

for client in tcp_server.clients.values():

2774

3390

if use_dbus:

2775

# Emit D-Bus signal

2776

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3391

# Emit D-Bus signal for adding

3392

mandos_dbus_service.client_added_signal(client)

2777

3393

# Need to initiate checking of clients

2778

3394

if client.enabled:

2779

3395

client.init_checker()

2782

3398

tcp_server.server_activate()

2783

3399

2784

3400

# Find out what port we got

2785

service.port = tcp_server.socket.getsockname()[1]

3401

if zeroconf:

3402

service.port = tcp_server.socket.getsockname()[1]

2786

3403

if use_ipv6:

2787

3404

logger.info("Now listening on address %r, port %d,"

2788

3405

" flowinfo %d, scope_id %d",

2794

3411

#service.interface = tcp_server.socket.getsockname()[3]

2795

3412

2796

3413

try:

2797

# From the Avahi example code

2798

try:

2799

service.activate()

2800

except dbus.exceptions.DBusException as error:

2801

logger.critical("D-Bus Exception", exc_info=error)

2802

cleanup()

2803

sys.exit(1)

2804

# End of Avahi example code

3414

if zeroconf:

3415

# From the Avahi example code

3416

try:

3417

service.activate()

3418

except dbus.exceptions.DBusException as error:

3419

logger.critical("D-Bus Exception", exc_info=error)

3420

cleanup()

3421

sys.exit(1)

3422

# End of Avahi example code

2805

3423

2806

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3424

GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,

2807

3425

lambda *args, **kwargs:

2808

3426

(tcp_server.handle_request

2809

3427

(*args[2:], **kwargs) or True))

2822

3440

# Must run before the D-Bus bus name gets deregistered

2823

3441

cleanup()

2824

3442

3443

2825

3444

if __name__ == '__main__':

2826

3445

main()