To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 879
- compare with another revision
- download diff
- download tarball
- view history from revision 879
- Committer: Teddy Hogeborn
- Date: 2016-10-08 04:11:22 UTC
- Revision ID: teddy@recompile.se-20161008041122-xdqj4sw9h9i461fu
Fix bug when generating keys in a chroot environment.
* mandos-keygen (keygen): Use "%no-protection" statement in GnuPG
batch parameter file to make GnuPG 2.1 not
try to ask for a passphrase interactively.
* mandos-keygen (keygen): Use "%no-protection" statement in GnuPG
batch parameter file to make GnuPG 2.1 not
try to ask for a passphrase interactively.
- files added:
- bugs.xml
- debian/upstream
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
#
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
23
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
25
# GNU General Public License for more details.
26
#
26
#
27
27
# You should have received a copy of the GNU General Public License
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
#
30
#
31
31
# Contact the authors at <mandos@recompile.se>.
32
#
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
38
41
39
import SocketServer as socketserver
42
try:
43
import SocketServer as socketserver
44
except ImportError:
45
import socketserver
40
46
import socket
41
47
import argparse
42
48
import datetime
43
49
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
50
try:
51
import ConfigParser as configparser
52
except ImportError:
53
import configparser
51
54
import sys
52
55
import re
53
56
import os
62
65
import struct
63
66
import fcntl
64
67
import functools
65
import cPickle as pickle
68
try:
69
import cPickle as pickle
70
except ImportError:
71
import pickle
66
72
import multiprocessing
67
73
import types
68
74
import binascii
69
75
import tempfile
70
76
import itertools
77
import collections
78
import codecs
71
79
72
80
import dbus
73
81
import dbus.service
74
import gobject
75
import avahi
82
from gi.repository import GLib
76
83
from dbus.mainloop.glib import DBusGMainLoop
77
84
import ctypes
78
85
import ctypes.util
79
86
import xml.dom.minidom
80
87
import inspect
81
import GnuPGInterface
82
88
89
# Try to find the value of SO_BINDTODEVICE:
83
90
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
84
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
94
except AttributeError:
86
95
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
87
98
from IN import SO_BINDTODEVICE
88
99
except ImportError:
89
SO_BINDTODEVICE = None
90
91
version = "1.5.3"
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
113
114
if sys.version_info.major == 2:
115
str = unicode
116
117
version = "1.7.12"
92
118
stored_state_file = "clients.pickle"
93
119
94
120
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
121
syslogger = None
98
122
99
123
try:
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
124
if_nametoindex = ctypes.cdll.LoadLibrary(
125
ctypes.util.find_library("c")).if_nametoindex
103
126
except (OSError, AttributeError):
127
104
128
def if_nametoindex(interface):
105
129
"Get an interface index the hard way, i.e. using fcntl()"
106
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
131
with contextlib.closing(socket.socket()) as s:
108
132
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
133
struct.pack(b"16s16x", interface))
134
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
135
return interface_index
114
136
115
137
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
142
func.func_globals,
143
func.func_name,
144
func.func_defaults,
145
func.func_closure)
146
else:
147
return types.FunctionType(func.__code__,
148
func.__globals__,
149
func.__name__,
150
func.__defaults__,
151
func.__closure__)
152
153
116
154
def initlogger(debug, level=logging.WARNING):
117
155
"""init logger and add loglevel"""
118
156
157
global syslogger
158
syslogger = (logging.handlers.SysLogHandler(
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
160
address="/dev/log"))
119
161
syslogger.setFormatter(logging.Formatter
120
162
('Mandos [%(process)d]: %(levelname)s:'
121
163
' %(message)s'))
122
164
logger.addHandler(syslogger)
123
165
124
166
if debug:
125
167
console = logging.StreamHandler()
126
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
138
180
139
181
class PGPEngine(object):
140
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
183
141
184
def __init__(self):
142
self.gnupg = GnuPGInterface.GnuPG()
143
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
148
'--quiet',
149
'--no-use-agent'])
150
186
self.gpg = "gpg"
187
try:
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
191
if name == "gpg":
192
self.gpg = path
193
break
194
except OSError as e:
195
if e.errno != errno.ENOENT:
196
raise
197
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
199
'--force-mdc',
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
204
151
205
def __enter__(self):
152
206
return self
153
154
def __exit__ (self, exc_type, exc_value, traceback):
207
208
def __exit__(self, exc_type, exc_value, traceback):
155
209
self._cleanup()
156
210
return False
157
211
158
212
def __del__(self):
159
213
self._cleanup()
160
214
161
215
def _cleanup(self):
162
216
if self.tempdir is not None:
163
217
# Delete contents of tempdir
164
218
for root, dirs, files in os.walk(self.tempdir,
165
topdown = False):
219
topdown=False):
166
220
for filename in files:
167
221
os.remove(os.path.join(root, filename))
168
222
for dirname in dirs:
170
224
# Remove tempdir
171
225
os.rmdir(self.tempdir)
172
226
self.tempdir = None
173
227
174
228
def password_encode(self, password):
175
229
# Passphrase can not be empty and can not contain newlines or
176
230
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
178
231
encoded = b"mandos" + binascii.hexlify(password)
232
if len(encoded) > 2048:
233
# GnuPG can't handle long passwords, so encode differently
234
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
235
.replace(b"\n", b"\\n")
236
.replace(b"\0", b"\\x00"))
237
return encoded
238
179
239
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
182
try:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
187
f.write(data)
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
190
proc.wait()
191
except IOError as e:
192
raise PGPError(e)
193
self.gnupg.passphrase = None
240
passphrase = self.password_encode(password)
241
with tempfile.NamedTemporaryFile(
242
dir=self.tempdir) as passfile:
243
passfile.write(passphrase)
244
passfile.flush()
245
proc = subprocess.Popen([self.gpg, '--symmetric',
246
'--passphrase-file',
247
passfile.name]
248
+ self.gnupgargs,
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
253
if proc.returncode != 0:
254
raise PGPError(err)
194
255
return ciphertext
195
256
196
257
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
199
try:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
204
f.write(data)
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
207
proc.wait()
208
except IOError as e:
209
raise PGPError(e)
210
self.gnupg.passphrase = None
258
passphrase = self.password_encode(password)
259
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
261
passfile.write(passphrase)
262
passfile.flush()
263
proc = subprocess.Popen([self.gpg, '--decrypt',
264
'--passphrase-file',
265
passfile.name]
266
+ self.gnupgargs,
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
271
if proc.returncode != 0:
272
raise PGPError(err)
211
273
return decrypted_plaintext
212
274
213
275
276
# Pretend that we have an Avahi module
277
class Avahi(object):
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
288
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
300
avahi = Avahi()
301
302
214
303
class AvahiError(Exception):
215
304
def __init__(self, value, *args, **kwargs):
216
305
self.value = value
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
306
return super(AvahiError, self).__init__(value, *args,
307
**kwargs)
308
220
309
221
310
class AvahiServiceError(AvahiError):
222
311
pass
223
312
313
224
314
class AvahiGroupError(AvahiError):
225
315
pass
226
316
227
317
228
318
class AvahiService(object):
229
319
"""An Avahi (Zeroconf) service.
230
320
231
321
Attributes:
232
322
interface: integer; avahi.IF_UNSPEC or an interface index.
233
323
Used to optionally bind to the specified interface.
234
324
name: string; Example: 'Mandos'
235
325
type: string; Example: '_mandos._tcp'.
236
See <http://www.dns-sd.org/ServiceTypes.html>
326
See <https://www.iana.org/assignments/service-names-port-numbers>
237
327
port: integer; what port to announce
238
328
TXT: list of strings; TXT record for the service
239
329
domain: string; Domain to publish on, default to .local if empty.
245
335
server: D-Bus Server
246
336
bus: dbus.SystemBus()
247
337
"""
248
249
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
servicetype = None, port = None, TXT = None,
251
domain = "", host = "", max_renames = 32768,
252
protocol = avahi.PROTO_UNSPEC, bus = None):
338
339
def __init__(self,
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
253
350
self.interface = interface
254
351
self.name = name
255
352
self.type = servicetype
264
361
self.server = None
265
362
self.bus = bus
266
363
self.entry_group_state_changed_match = None
267
268
def rename(self):
364
365
def rename(self, remove=True):
269
366
"""Derived from the Avahi example code"""
270
367
if self.rename_count >= self.max_renames:
271
368
logger.critical("No suitable Zeroconf service name found"
272
369
" after %i retries, exiting.",
273
370
self.rename_count)
274
371
raise AvahiServiceError("Too many renames")
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
372
self.name = str(
373
self.server.GetAlternativeServiceName(self.name))
374
self.rename_count += 1
277
375
logger.info("Changing Zeroconf service name to %r ...",
278
376
self.name)
279
self.remove()
377
if remove:
378
self.remove()
280
379
try:
281
380
self.add()
282
381
except dbus.exceptions.DBusException as error:
283
logger.critical("D-Bus Exception", exc_info=error)
284
self.cleanup()
285
os._exit(1)
286
self.rename_count += 1
287
382
if (error.get_dbus_name()
383
== "org.freedesktop.Avahi.CollisionError"):
384
logger.info("Local Zeroconf service name collision.")
385
return self.rename(remove=False)
386
else:
387
logger.critical("D-Bus Exception", exc_info=error)
388
self.cleanup()
389
os._exit(1)
390
288
391
def remove(self):
289
392
"""Derived from the Avahi example code"""
290
393
if self.entry_group_state_changed_match is not None:
292
395
self.entry_group_state_changed_match = None
293
396
if self.group is not None:
294
397
self.group.Reset()
295
398
296
399
def add(self):
297
400
"""Derived from the Avahi example code"""
298
401
self.remove()
315
418
dbus.UInt16(self.port),
316
419
avahi.string_array_to_txt_array(self.TXT))
317
420
self.group.Commit()
318
421
319
422
def entry_group_state_changed(self, state, error):
320
423
"""Derived from the Avahi example code"""
321
424
logger.debug("Avahi entry group state change: %i", state)
322
425
323
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
324
427
logger.debug("Zeroconf service established.")
325
428
elif state == avahi.ENTRY_GROUP_COLLISION:
327
430
self.rename()
328
431
elif state == avahi.ENTRY_GROUP_FAILURE:
329
432
logger.critical("Avahi: Error in group state changed %s",
330
unicode(error))
331
raise AvahiGroupError("State changed: {0!s}"
332
.format(error))
333
433
str(error))
434
raise AvahiGroupError("State changed: {!s}".format(error))
435
334
436
def cleanup(self):
335
437
"""Derived from the Avahi example code"""
336
438
if self.group is not None:
341
443
pass
342
444
self.group = None
343
445
self.remove()
344
446
345
447
def server_state_changed(self, state, error=None):
346
448
"""Derived from the Avahi example code"""
347
449
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
450
bad_states = {
451
avahi.SERVER_INVALID: "Zeroconf server invalid",
452
avahi.SERVER_REGISTERING: None,
453
avahi.SERVER_COLLISION: "Zeroconf server name collision",
454
avahi.SERVER_FAILURE: "Zeroconf server failure",
455
}
355
456
if state in bad_states:
356
457
if bad_states[state] is not None:
357
458
if error is None:
360
461
logger.error(bad_states[state] + ": %r", error)
361
462
self.cleanup()
362
463
elif state == avahi.SERVER_RUNNING:
363
self.add()
464
try:
465
self.add()
466
except dbus.exceptions.DBusException as error:
467
if (error.get_dbus_name()
468
== "org.freedesktop.Avahi.CollisionError"):
469
logger.info("Local Zeroconf service name"
470
" collision.")
471
return self.rename(remove=False)
472
else:
473
logger.critical("D-Bus Exception", exc_info=error)
474
self.cleanup()
475
os._exit(1)
364
476
else:
365
477
if error is None:
366
478
logger.debug("Unknown state: %r", state)
367
479
else:
368
480
logger.debug("Unknown state: %r: %r", state, error)
369
481
370
482
def activate(self):
371
483
"""Derived from the Avahi example code"""
372
484
if self.server is None:
376
488
follow_name_owner_changes=True),
377
489
avahi.DBUS_INTERFACE_SERVER)
378
490
self.server.connect_to_signal("StateChanged",
379
self.server_state_changed)
491
self.server_state_changed)
380
492
self.server_state_changed(self.server.GetState())
381
493
382
494
383
495
class AvahiServiceToSyslog(AvahiService):
384
def rename(self):
496
def rename(self, *args, **kwargs):
385
497
"""Add the new name to the syslog messages"""
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
390
.format(self.name)))
498
ret = AvahiService.rename(self, *args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
501
.format(self.name)))
391
502
return ret
392
503
393
504
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
505
# Pretend that we have a GnuTLS module
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
509
510
library = ctypes.util.find_library("gnutls")
511
if library is None:
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
514
del library
515
_need_version = b"3.3.0"
516
517
def __init__(self):
518
# Need to use class name "GnuTLS" here, since this method is
519
# called before the assignment to the "gnutls" global variable
520
# happens.
521
if GnuTLS.check_version(self._need_version) is None:
522
raise GnuTLS.Error("Needs GnuTLS {} or later"
523
.format(self._need_version))
524
525
# Unless otherwise indicated, the constants and types below are
526
# all from the gnutls/gnutls.h C header file.
527
528
# Constants
529
E_SUCCESS = 0
530
E_INTERRUPTED = -52
531
E_AGAIN = -28
532
CRT_OPENPGP = 2
533
CLIENT = 2
534
SHUT_RDWR = 0
535
CRD_CERTIFICATE = 1
536
E_NO_CERTIFICATE_FOUND = -49
537
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
538
539
# Types
540
class session_int(ctypes.Structure):
541
_fields_ = []
542
session_t = ctypes.POINTER(session_int)
543
544
class certificate_credentials_st(ctypes.Structure):
545
_fields_ = []
546
certificate_credentials_t = ctypes.POINTER(
547
certificate_credentials_st)
548
certificate_type_t = ctypes.c_int
549
550
class datum_t(ctypes.Structure):
551
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
('size', ctypes.c_uint)]
553
554
class openpgp_crt_int(ctypes.Structure):
555
_fields_ = []
556
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
558
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
559
credentials_type_t = ctypes.c_int
560
transport_ptr_t = ctypes.c_void_p
561
close_request_t = ctypes.c_int
562
563
# Exceptions
564
class Error(Exception):
565
# We need to use the class name "GnuTLS" here, since this
566
# exception might be raised from within GnuTLS.__init__,
567
# which is called before the assignment to the "gnutls"
568
# global variable has happened.
569
def __init__(self, message=None, code=None, args=()):
570
# Default usage is by a message string, but if a return
571
# code is passed, convert it to a string with
572
# gnutls.strerror()
573
self.code = code
574
if message is None and code is not None:
575
message = GnuTLS.strerror(code)
576
return super(GnuTLS.Error, self).__init__(
577
message, *args)
578
579
class CertificateSecurityError(Error):
580
pass
581
582
# Classes
583
class Credentials(object):
584
def __init__(self):
585
self._c_object = gnutls.certificate_credentials_t()
586
gnutls.certificate_allocate_credentials(
587
ctypes.byref(self._c_object))
588
self.type = gnutls.CRD_CERTIFICATE
589
590
def __del__(self):
591
gnutls.certificate_free_credentials(self._c_object)
592
593
class ClientSession(object):
594
def __init__(self, socket, credentials=None):
595
self._c_object = gnutls.session_t()
596
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
597
gnutls.set_default_priority(self._c_object)
598
gnutls.transport_set_ptr(self._c_object, socket.fileno())
599
gnutls.handshake_set_private_extensions(self._c_object,
600
True)
601
self.socket = socket
602
if credentials is None:
603
credentials = gnutls.Credentials()
604
gnutls.credentials_set(self._c_object, credentials.type,
605
ctypes.cast(credentials._c_object,
606
ctypes.c_void_p))
607
self.credentials = credentials
608
609
def __del__(self):
610
gnutls.deinit(self._c_object)
611
612
def handshake(self):
613
return gnutls.handshake(self._c_object)
614
615
def send(self, data):
616
data = bytes(data)
617
data_len = len(data)
618
while data_len > 0:
619
data_len -= gnutls.record_send(self._c_object,
620
data[-data_len:],
621
data_len)
622
623
def bye(self):
624
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
625
626
# Error handling functions
627
def _error_code(result):
628
"""A function to raise exceptions on errors, suitable
629
for the 'restype' attribute on ctypes functions"""
630
if result >= 0:
631
return result
632
if result == gnutls.E_NO_CERTIFICATE_FOUND:
633
raise gnutls.CertificateSecurityError(code=result)
634
raise gnutls.Error(code=result)
635
636
def _retry_on_error(result, func, arguments):
637
"""A function to retry on some errors, suitable
638
for the 'errcheck' attribute on ctypes functions"""
639
while result < 0:
640
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
641
return _error_code(result)
642
result = func(*arguments)
643
return result
644
645
# Unless otherwise indicated, the function declarations below are
646
# all from the gnutls/gnutls.h C header file.
647
648
# Functions
649
priority_set_direct = _library.gnutls_priority_set_direct
650
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
651
ctypes.POINTER(ctypes.c_char_p)]
652
priority_set_direct.restype = _error_code
653
654
init = _library.gnutls_init
655
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
656
init.restype = _error_code
657
658
set_default_priority = _library.gnutls_set_default_priority
659
set_default_priority.argtypes = [session_t]
660
set_default_priority.restype = _error_code
661
662
record_send = _library.gnutls_record_send
663
record_send.argtypes = [session_t, ctypes.c_void_p,
664
ctypes.c_size_t]
665
record_send.restype = ctypes.c_ssize_t
666
record_send.errcheck = _retry_on_error
667
668
certificate_allocate_credentials = (
669
_library.gnutls_certificate_allocate_credentials)
670
certificate_allocate_credentials.argtypes = [
671
ctypes.POINTER(certificate_credentials_t)]
672
certificate_allocate_credentials.restype = _error_code
673
674
certificate_free_credentials = (
675
_library.gnutls_certificate_free_credentials)
676
certificate_free_credentials.argtypes = [
677
certificate_credentials_t]
678
certificate_free_credentials.restype = None
679
680
handshake_set_private_extensions = (
681
_library.gnutls_handshake_set_private_extensions)
682
handshake_set_private_extensions.argtypes = [session_t,
683
ctypes.c_int]
684
handshake_set_private_extensions.restype = None
685
686
credentials_set = _library.gnutls_credentials_set
687
credentials_set.argtypes = [session_t, credentials_type_t,
688
ctypes.c_void_p]
689
credentials_set.restype = _error_code
690
691
strerror = _library.gnutls_strerror
692
strerror.argtypes = [ctypes.c_int]
693
strerror.restype = ctypes.c_char_p
694
695
certificate_type_get = _library.gnutls_certificate_type_get
696
certificate_type_get.argtypes = [session_t]
697
certificate_type_get.restype = _error_code
698
699
certificate_get_peers = _library.gnutls_certificate_get_peers
700
certificate_get_peers.argtypes = [session_t,
701
ctypes.POINTER(ctypes.c_uint)]
702
certificate_get_peers.restype = ctypes.POINTER(datum_t)
703
704
global_set_log_level = _library.gnutls_global_set_log_level
705
global_set_log_level.argtypes = [ctypes.c_int]
706
global_set_log_level.restype = None
707
708
global_set_log_function = _library.gnutls_global_set_log_function
709
global_set_log_function.argtypes = [log_func]
710
global_set_log_function.restype = None
711
712
deinit = _library.gnutls_deinit
713
deinit.argtypes = [session_t]
714
deinit.restype = None
715
716
handshake = _library.gnutls_handshake
717
handshake.argtypes = [session_t]
718
handshake.restype = _error_code
719
handshake.errcheck = _retry_on_error
720
721
transport_set_ptr = _library.gnutls_transport_set_ptr
722
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
723
transport_set_ptr.restype = None
724
725
bye = _library.gnutls_bye
726
bye.argtypes = [session_t, close_request_t]
727
bye.restype = _error_code
728
bye.errcheck = _retry_on_error
729
730
check_version = _library.gnutls_check_version
731
check_version.argtypes = [ctypes.c_char_p]
732
check_version.restype = ctypes.c_char_p
733
734
# All the function declarations below are from gnutls/openpgp.h
735
736
openpgp_crt_init = _library.gnutls_openpgp_crt_init
737
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
738
openpgp_crt_init.restype = _error_code
739
740
openpgp_crt_import = _library.gnutls_openpgp_crt_import
741
openpgp_crt_import.argtypes = [openpgp_crt_t,
742
ctypes.POINTER(datum_t),
743
openpgp_crt_fmt_t]
744
openpgp_crt_import.restype = _error_code
745
746
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
747
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
748
ctypes.POINTER(ctypes.c_uint)]
749
openpgp_crt_verify_self.restype = _error_code
750
751
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
752
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
753
openpgp_crt_deinit.restype = None
754
755
openpgp_crt_get_fingerprint = (
756
_library.gnutls_openpgp_crt_get_fingerprint)
757
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
758
ctypes.c_void_p,
759
ctypes.POINTER(
760
ctypes.c_size_t)]
761
openpgp_crt_get_fingerprint.restype = _error_code
762
763
# Remove non-public functions
764
del _error_code, _retry_on_error
765
# Create the global "gnutls" object, simulating a module
766
gnutls = GnuTLS()
767
768
769
def call_pipe(connection, # : multiprocessing.Connection
770
func, *args, **kwargs):
771
"""This function is meant to be called by multiprocessing.Process
772
773
This function runs func(*args, **kwargs), and writes the resulting
774
return value on the provided multiprocessing.Connection.
775
"""
776
connection.send(func(*args, **kwargs))
777
connection.close()
399
778
400
779
401
780
class Client(object):
402
781
"""A representation of a client host served by this server.
403
782
404
783
Attributes:
405
784
approved: bool(); 'None' if not yet approved/disapproved
406
785
approval_delay: datetime.timedelta(); Time to wait for approval
408
787
checker: subprocess.Popen(); a running checker process used
409
788
to see if the client lives.
410
789
'None' if no process is running.
411
checker_callback_tag: a gobject event source tag, or None
790
checker_callback_tag: a GLib event source tag, or None
412
791
checker_command: string; External command which is run to check
413
792
if client lives. %() expansions are done at
414
793
runtime with vars(self) as dict, so that for
415
794
instance %(name)s can be used in the command.
416
checker_initiator_tag: a gobject event source tag, or None
795
checker_initiator_tag: a GLib event source tag, or None
417
796
created: datetime.datetime(); (UTC) object creation
418
797
client_structure: Object describing what attributes a client has
419
798
and is used for storing the client at exit
420
799
current_checker_command: string; current running checker_command
421
disable_initiator_tag: a gobject event source tag, or None
800
disable_initiator_tag: a GLib event source tag, or None
422
801
enabled: bool()
423
802
fingerprint: string (40 or 32 hexadecimal digits); used to
424
803
uniquely identify the client
429
808
last_checker_status: integer between 0 and 255 reflecting exit
430
809
status of last checker. -1 reflects crashed
431
810
checker, -2 means no checker completed yet.
811
last_checker_signal: The signal which killed the last checker, if
812
last_checker_status is -1
432
813
last_enabled: datetime.datetime(); (UTC) or None
433
814
name: string; from the config file, used in log messages and
434
815
D-Bus identifiers
439
820
runtime_expansions: Allowed attributes for runtime expansion.
440
821
expires: datetime.datetime(); time (UTC) when a client will be
441
822
disabled, or None
823
server_settings: The server_settings dict from main()
442
824
"""
443
825
444
826
runtime_expansions = ("approval_delay", "approval_duration",
445
"created", "enabled", "fingerprint",
446
"host", "interval", "last_checked_ok",
827
"created", "enabled", "expires",
828
"fingerprint", "host", "interval",
829
"last_approval_request", "last_checked_ok",
447
830
"last_enabled", "name", "timeout")
448
client_defaults = { "timeout": "5m",
449
"extended_timeout": "15m",
450
"interval": "2m",
451
"checker": "fping -q -- %%(host)s",
452
"host": "",
453
"approval_delay": "0s",
454
"approval_duration": "1s",
455
"approved_by_default": "True",
456
"enabled": "True",
457
}
458
459
def timeout_milliseconds(self):
460
"Return the 'timeout' attribute in milliseconds"
461
return timedelta_to_milliseconds(self.timeout)
462
463
def extended_timeout_milliseconds(self):
464
"Return the 'extended_timeout' attribute in milliseconds"
465
return timedelta_to_milliseconds(self.extended_timeout)
466
467
def interval_milliseconds(self):
468
"Return the 'interval' attribute in milliseconds"
469
return timedelta_to_milliseconds(self.interval)
470
471
def approval_delay_milliseconds(self):
472
return timedelta_to_milliseconds(self.approval_delay)
473
831
client_defaults = {
832
"timeout": "PT5M",
833
"extended_timeout": "PT15M",
834
"interval": "PT2M",
835
"checker": "fping -q -- %%(host)s",
836
"host": "",
837
"approval_delay": "PT0S",
838
"approval_duration": "PT1S",
839
"approved_by_default": "True",
840
"enabled": "True",
841
}
842
474
843
@staticmethod
475
844
def config_parser(config):
476
845
"""Construct a new dict of client settings of this form:
483
852
for client_name in config.sections():
484
853
section = dict(config.items(client_name))
485
854
client = settings[client_name] = {}
486
855
487
856
client["host"] = section["host"]
488
857
# Reformat values from string types to Python types
489
858
client["approved_by_default"] = config.getboolean(
490
859
client_name, "approved_by_default")
491
860
client["enabled"] = config.getboolean(client_name,
492
861
"enabled")
493
862
863
# Uppercase and remove spaces from fingerprint for later
864
# comparison purposes with return value from the
865
# fingerprint() function
494
866
client["fingerprint"] = (section["fingerprint"].upper()
495
867
.replace(" ", ""))
496
868
if "secret" in section:
497
client["secret"] = section["secret"].decode("base64")
869
client["secret"] = codecs.decode(section["secret"]
870
.encode("utf-8"),
871
"base64")
498
872
elif "secfile" in section:
499
873
with open(os.path.expanduser(os.path.expandvars
500
874
(section["secfile"])),
501
875
"rb") as secfile:
502
876
client["secret"] = secfile.read()
503
877
else:
504
raise TypeError("No secret or secfile for section {0}"
878
raise TypeError("No secret or secfile for section {}"
505
879
.format(section))
506
880
client["timeout"] = string_to_delta(section["timeout"])
507
881
client["extended_timeout"] = string_to_delta(
515
889
client["last_approval_request"] = None
516
890
client["last_checked_ok"] = None
517
891
client["last_checker_status"] = -2
518
892
519
893
return settings
520
521
def __init__(self, settings, name = None):
894
895
def __init__(self, settings, name=None, server_settings=None):
522
896
self.name = name
897
if server_settings is None:
898
server_settings = {}
899
self.server_settings = server_settings
523
900
# adding all client settings
524
for setting, value in settings.iteritems():
901
for setting, value in settings.items():
525
902
setattr(self, setting, value)
526
903
527
904
if self.enabled:
528
905
if not hasattr(self, "last_enabled"):
529
906
self.last_enabled = datetime.datetime.utcnow()
533
910
else:
534
911
self.last_enabled = None
535
912
self.expires = None
536
913
537
914
logger.debug("Creating client %r", self.name)
538
# Uppercase and remove spaces from fingerprint for later
539
# comparison purposes with return value from the fingerprint()
540
# function
541
915
logger.debug(" Fingerprint: %s", self.fingerprint)
542
916
self.created = settings.get("created",
543
917
datetime.datetime.utcnow())
544
918
545
919
# attributes specific for this server instance
546
920
self.checker = None
547
921
self.checker_initiator_tag = None
550
924
self.current_checker_command = None
551
925
self.approved = None
552
926
self.approvals_pending = 0
553
self.changedstate = (multiprocessing_manager
554
.Condition(multiprocessing_manager
555
.Lock()))
556
self.client_structure = [attr for attr in
557
self.__dict__.iterkeys()
927
self.changedstate = multiprocessing_manager.Condition(
928
multiprocessing_manager.Lock())
929
self.client_structure = [attr
930
for attr in self.__dict__.keys()
558
931
if not attr.startswith("_")]
559
932
self.client_structure.append("client_structure")
560
561
for name, t in inspect.getmembers(type(self),
562
lambda obj:
563
isinstance(obj,
564
property)):
933
934
for name, t in inspect.getmembers(
935
type(self), lambda obj: isinstance(obj, property)):
565
936
if not name.startswith("_"):
566
937
self.client_structure.append(name)
567
938
568
939
# Send notice to process children that client state has changed
569
940
def send_changedstate(self):
570
941
with self.changedstate:
571
942
self.changedstate.notify_all()
572
943
573
944
def enable(self):
574
945
"""Start this client's checker and timeout hooks"""
575
946
if getattr(self, "enabled", False):
580
951
self.last_enabled = datetime.datetime.utcnow()
581
952
self.init_checker()
582
953
self.send_changedstate()
583
954
584
955
def disable(self, quiet=True):
585
956
"""Disable this client."""
586
957
if not getattr(self, "enabled", False):
588
959
if not quiet:
589
960
logger.info("Disabling client %s", self.name)
590
961
if getattr(self, "disable_initiator_tag", None) is not None:
591
gobject.source_remove(self.disable_initiator_tag)
962
GLib.source_remove(self.disable_initiator_tag)
592
963
self.disable_initiator_tag = None
593
964
self.expires = None
594
965
if getattr(self, "checker_initiator_tag", None) is not None:
595
gobject.source_remove(self.checker_initiator_tag)
966
GLib.source_remove(self.checker_initiator_tag)
596
967
self.checker_initiator_tag = None
597
968
self.stop_checker()
598
969
self.enabled = False
599
970
if not quiet:
600
971
self.send_changedstate()
601
# Do not run this again if called by a gobject.timeout_add
972
# Do not run this again if called by a GLib.timeout_add
602
973
return False
603
974
604
975
def __del__(self):
605
976
self.disable()
606
977
607
978
def init_checker(self):
608
979
# Schedule a new checker to be started an 'interval' from now,
609
980
# and every interval from then on.
610
981
if self.checker_initiator_tag is not None:
611
gobject.source_remove(self.checker_initiator_tag)
612
self.checker_initiator_tag = (gobject.timeout_add
613
(self.interval_milliseconds(),
614
self.start_checker))
982
GLib.source_remove(self.checker_initiator_tag)
983
self.checker_initiator_tag = GLib.timeout_add(
984
int(self.interval.total_seconds() * 1000),
985
self.start_checker)
615
986
# Schedule a disable() when 'timeout' has passed
616
987
if self.disable_initiator_tag is not None:
617
gobject.source_remove(self.disable_initiator_tag)
618
self.disable_initiator_tag = (gobject.timeout_add
619
(self.timeout_milliseconds(),
620
self.disable))
988
GLib.source_remove(self.disable_initiator_tag)
989
self.disable_initiator_tag = GLib.timeout_add(
990
int(self.timeout.total_seconds() * 1000), self.disable)
621
991
# Also start a new checker *right now*.
622
992
self.start_checker()
623
624
def checker_callback(self, pid, condition, command):
993
994
def checker_callback(self, source, condition, connection,
995
command):
625
996
"""The checker has completed, so take appropriate actions."""
626
997
self.checker_callback_tag = None
627
998
self.checker = None
628
if os.WIFEXITED(condition):
629
self.last_checker_status = os.WEXITSTATUS(condition)
999
# Read return code from connection (see call_pipe)
1000
returncode = connection.recv()
1001
connection.close()
1002
1003
if returncode >= 0:
1004
self.last_checker_status = returncode
1005
self.last_checker_signal = None
630
1006
if self.last_checker_status == 0:
631
1007
logger.info("Checker for %(name)s succeeded",
632
1008
vars(self))
633
1009
self.checked_ok()
634
1010
else:
635
logger.info("Checker for %(name)s failed",
636
vars(self))
1011
logger.info("Checker for %(name)s failed", vars(self))
637
1012
else:
638
1013
self.last_checker_status = -1
1014
self.last_checker_signal = -returncode
639
1015
logger.warning("Checker for %(name)s crashed?",
640
1016
vars(self))
641
1017
return False
1018
642
1019
def checked_ok(self):
643
1020
"""Assert that the client has been seen, alive and well."""
644
1021
self.last_checked_ok = datetime.datetime.utcnow()
645
1022
self.last_checker_status = 0
1023
self.last_checker_signal = None
646
1024
self.bump_timeout()
647
1025
648
1026
def bump_timeout(self, timeout=None):
649
1027
"""Bump up the timeout for this client."""
650
1028
if timeout is None:
651
1029
timeout = self.timeout
652
1030
if self.disable_initiator_tag is not None:
653
gobject.source_remove(self.disable_initiator_tag)
1031
GLib.source_remove(self.disable_initiator_tag)
654
1032
self.disable_initiator_tag = None
655
1033
if getattr(self, "enabled", False):
656
self.disable_initiator_tag = (gobject.timeout_add
657
(timedelta_to_milliseconds
658
(timeout), self.disable))
1034
self.disable_initiator_tag = GLib.timeout_add(
1035
int(timeout.total_seconds() * 1000), self.disable)
659
1036
self.expires = datetime.datetime.utcnow() + timeout
660
1037
661
1038
def need_approval(self):
662
1039
self.last_approval_request = datetime.datetime.utcnow()
663
1040
664
1041
def start_checker(self):
665
1042
"""Start a new checker subprocess if one is not running.
666
1043
667
1044
If a checker already exists, leave it running and do
668
1045
nothing."""
669
1046
# The reason for not killing a running checker is that if we
674
1051
# checkers alone, the checker would have to take more time
675
1052
# than 'timeout' for the client to be disabled, which is as it
676
1053
# should be.
677
678
# If a checker exists, make sure it is not a zombie
679
try:
680
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
681
except (AttributeError, OSError) as error:
682
if (isinstance(error, OSError)
683
and error.errno != errno.ECHILD):
684
raise error
685
else:
686
if pid:
687
logger.warning("Checker was a zombie")
688
gobject.source_remove(self.checker_callback_tag)
689
self.checker_callback(pid, status,
690
self.current_checker_command)
1054
1055
if self.checker is not None and not self.checker.is_alive():
1056
logger.warning("Checker was not alive; joining")
1057
self.checker.join()
1058
self.checker = None
691
1059
# Start a new checker if needed
692
1060
if self.checker is None:
1061
# Escape attributes for the shell
1062
escaped_attrs = {
1063
attr: re.escape(str(getattr(self, attr)))
1064
for attr in self.runtime_expansions}
693
1065
try:
694
# In case checker_command has exactly one % operator
695
command = self.checker_command % self.host
696
except TypeError:
697
# Escape attributes for the shell
698
escaped_attrs = dict(
699
(attr,
700
re.escape(unicode(str(getattr(self, attr, "")),
701
errors=
702
'replace')))
703
for attr in
704
self.runtime_expansions)
705
706
try:
707
command = self.checker_command % escaped_attrs
708
except TypeError as error:
709
logger.error('Could not format string "%s"',
710
self.checker_command, exc_info=error)
711
return True # Try again later
1066
command = self.checker_command % escaped_attrs
1067
except TypeError as error:
1068
logger.error('Could not format string "%s"',
1069
self.checker_command,
1070
exc_info=error)
1071
return True # Try again later
712
1072
self.current_checker_command = command
713
try:
714
logger.info("Starting checker %r for %s",
715
command, self.name)
716
# We don't need to redirect stdout and stderr, since
717
# in normal mode, that is already done by daemon(),
718
# and in debug mode we don't want to. (Stdin is
719
# always replaced by /dev/null.)
720
self.checker = subprocess.Popen(command,
721
close_fds=True,
722
shell=True, cwd="/")
723
self.checker_callback_tag = (gobject.child_watch_add
724
(self.checker.pid,
725
self.checker_callback,
726
data=command))
727
# The checker may have completed before the gobject
728
# watch was added. Check for this.
729
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
730
if pid:
731
gobject.source_remove(self.checker_callback_tag)
732
self.checker_callback(pid, status, command)
733
except OSError as error:
734
logger.error("Failed to start subprocess",
735
exc_info=error)
736
# Re-run this periodically if run by gobject.timeout_add
1073
logger.info("Starting checker %r for %s", command,
1074
self.name)
1075
# We don't need to redirect stdout and stderr, since
1076
# in normal mode, that is already done by daemon(),
1077
# and in debug mode we don't want to. (Stdin is
1078
# always replaced by /dev/null.)
1079
# The exception is when not debugging but nevertheless
1080
# running in the foreground; use the previously
1081
# created wnull.
1082
popen_args = {"close_fds": True,
1083
"shell": True,
1084
"cwd": "/"}
1085
if (not self.server_settings["debug"]
1086
and self.server_settings["foreground"]):
1087
popen_args.update({"stdout": wnull,
1088
"stderr": wnull})
1089
pipe = multiprocessing.Pipe(duplex=False)
1090
self.checker = multiprocessing.Process(
1091
target=call_pipe,
1092
args=(pipe[1], subprocess.call, command),
1093
kwargs=popen_args)
1094
self.checker.start()
1095
self.checker_callback_tag = GLib.io_add_watch(
1096
pipe[0].fileno(), GLib.IO_IN,
1097
self.checker_callback, pipe[0], command)
1098
# Re-run this periodically if run by GLib.timeout_add
737
1099
return True
738
1100
739
1101
def stop_checker(self):
740
1102
"""Force the checker process, if any, to stop."""
741
1103
if self.checker_callback_tag:
742
gobject.source_remove(self.checker_callback_tag)
1104
GLib.source_remove(self.checker_callback_tag)
743
1105
self.checker_callback_tag = None
744
1106
if getattr(self, "checker", None) is None:
745
1107
return
746
1108
logger.debug("Stopping checker for %(name)s", vars(self))
747
try:
748
self.checker.terminate()
749
#time.sleep(0.5)
750
#if self.checker.poll() is None:
751
# self.checker.kill()
752
except OSError as error:
753
if error.errno != errno.ESRCH: # No such process
754
raise
1109
self.checker.terminate()
755
1110
self.checker = None
756
1111
757
1112
758
def dbus_service_property(dbus_interface, signature="v",
759
access="readwrite", byte_arrays=False):
1113
def dbus_service_property(dbus_interface,
1114
signature="v",
1115
access="readwrite",
1116
byte_arrays=False):
760
1117
"""Decorators for marking methods of a DBusObjectWithProperties to
761
1118
become properties on the D-Bus.
762
1119
763
1120
The decorated method will be called with no arguments by "Get"
764
1121
and with one argument by "Set".
765
1122
766
1123
The parameters, where they are supported, are the same as
767
1124
dbus.service.method, except there is only "signature", since the
768
1125
type from Get() and the type sent to Set() is the same.
771
1128
# "Set" method, so we fail early here:
772
1129
if byte_arrays and signature != "ay":
773
1130
raise ValueError("Byte arrays not supported for non-'ay'"
774
" signature {0!r}".format(signature))
1131
" signature {!r}".format(signature))
1132
775
1133
def decorator(func):
776
1134
func._dbus_is_property = True
777
1135
func._dbus_interface = dbus_interface
780
1138
func._dbus_name = func.__name__
781
1139
if func._dbus_name.endswith("_dbus_property"):
782
1140
func._dbus_name = func._dbus_name[:-14]
783
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1141
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
784
1142
return func
1143
785
1144
return decorator
786
1145
787
1146
788
1147
def dbus_interface_annotations(dbus_interface):
789
1148
"""Decorator for marking functions returning interface annotations
790
1149
791
1150
Usage:
792
1151
793
1152
@dbus_interface_annotations("org.example.Interface")
794
1153
def _foo(self): # Function name does not matter
795
1154
return {"org.freedesktop.DBus.Deprecated": "true",
796
1155
"org.freedesktop.DBus.Property.EmitsChangedSignal":
797
1156
"false"}
798
1157
"""
1158
799
1159
def decorator(func):
800
1160
func._dbus_is_interface = True
801
1161
func._dbus_interface = dbus_interface
802
1162
func._dbus_name = dbus_interface
803
1163
return func
1164
804
1165
return decorator
805
1166
806
1167
807
1168
def dbus_annotations(annotations):
808
1169
"""Decorator to annotate D-Bus methods, signals or properties
809
1170
Usage:
810
1171
1172
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1173
"org.freedesktop.DBus.Property."
1174
"EmitsChangedSignal": "false"})
811
1175
@dbus_service_property("org.example.Interface", signature="b",
812
1176
access="r")
813
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
814
"org.freedesktop.DBus.Property."
815
"EmitsChangedSignal": "false"})
816
1177
def Property_dbus_property(self):
817
1178
return dbus.Boolean(False)
1179
1180
See also the DBusObjectWithAnnotations class.
818
1181
"""
1182
819
1183
def decorator(func):
820
1184
func._dbus_annotations = annotations
821
1185
return func
1186
822
1187
return decorator
823
1188
824
1189
825
1190
class DBusPropertyException(dbus.exceptions.DBusException):
826
1191
"""A base class for D-Bus property-related exceptions
827
1192
"""
828
def __unicode__(self):
829
return unicode(str(self))
1193
pass
830
1194
831
1195
832
1196
class DBusPropertyAccessException(DBusPropertyException):
841
1205
pass
842
1206
843
1207
844
class DBusObjectWithProperties(dbus.service.Object):
845
"""A D-Bus object with properties.
846
847
Classes inheriting from this can use the dbus_service_property
848
decorator to expose methods as D-Bus properties. It exposes the
849
standard Get(), Set(), and GetAll() methods on the D-Bus.
1208
class DBusObjectWithAnnotations(dbus.service.Object):
1209
"""A D-Bus object with annotations.
1210
1211
Classes inheriting from this can use the dbus_annotations
1212
decorator to add annotations to methods or signals.
850
1213
"""
851
1214
852
1215
@staticmethod
853
1216
def _is_dbus_thing(thing):
854
1217
"""Returns a function testing if an attribute is a D-Bus thing
855
1218
856
1219
If called like _is_dbus_thing("method") it returns a function
857
1220
suitable for use as predicate to inspect.getmembers().
858
1221
"""
859
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1222
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
860
1223
False)
861
1224
862
1225
def _get_all_dbus_things(self, thing):
863
1226
"""Returns a generator of (name, attribute) pairs
864
1227
"""
865
return ((getattr(athing.__get__(self), "_dbus_name",
866
name),
1228
return ((getattr(athing.__get__(self), "_dbus_name", name),
867
1229
athing.__get__(self))
868
1230
for cls in self.__class__.__mro__
869
1231
for name, athing in
870
inspect.getmembers(cls,
871
self._is_dbus_thing(thing)))
872
1232
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1233
1234
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1235
out_signature="s",
1236
path_keyword='object_path',
1237
connection_keyword='connection')
1238
def Introspect(self, object_path, connection):
1239
"""Overloading of standard D-Bus method.
1240
1241
Inserts annotation tags on methods and signals.
1242
"""
1243
xmlstring = dbus.service.Object.Introspect(self, object_path,
1244
connection)
1245
try:
1246
document = xml.dom.minidom.parseString(xmlstring)
1247
1248
for if_tag in document.getElementsByTagName("interface"):
1249
# Add annotation tags
1250
for typ in ("method", "signal"):
1251
for tag in if_tag.getElementsByTagName(typ):
1252
annots = dict()
1253
for name, prop in (self.
1254
_get_all_dbus_things(typ)):
1255
if (name == tag.getAttribute("name")
1256
and prop._dbus_interface
1257
== if_tag.getAttribute("name")):
1258
annots.update(getattr(
1259
prop, "_dbus_annotations", {}))
1260
for name, value in annots.items():
1261
ann_tag = document.createElement(
1262
"annotation")
1263
ann_tag.setAttribute("name", name)
1264
ann_tag.setAttribute("value", value)
1265
tag.appendChild(ann_tag)
1266
# Add interface annotation tags
1267
for annotation, value in dict(
1268
itertools.chain.from_iterable(
1269
annotations().items()
1270
for name, annotations
1271
in self._get_all_dbus_things("interface")
1272
if name == if_tag.getAttribute("name")
1273
)).items():
1274
ann_tag = document.createElement("annotation")
1275
ann_tag.setAttribute("name", annotation)
1276
ann_tag.setAttribute("value", value)
1277
if_tag.appendChild(ann_tag)
1278
# Fix argument name for the Introspect method itself
1279
if (if_tag.getAttribute("name")
1280
== dbus.INTROSPECTABLE_IFACE):
1281
for cn in if_tag.getElementsByTagName("method"):
1282
if cn.getAttribute("name") == "Introspect":
1283
for arg in cn.getElementsByTagName("arg"):
1284
if (arg.getAttribute("direction")
1285
== "out"):
1286
arg.setAttribute("name",
1287
"xml_data")
1288
xmlstring = document.toxml("utf-8")
1289
document.unlink()
1290
except (AttributeError, xml.dom.DOMException,
1291
xml.parsers.expat.ExpatError) as error:
1292
logger.error("Failed to override Introspection method",
1293
exc_info=error)
1294
return xmlstring
1295
1296
1297
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1298
"""A D-Bus object with properties.
1299
1300
Classes inheriting from this can use the dbus_service_property
1301
decorator to expose methods as D-Bus properties. It exposes the
1302
standard Get(), Set(), and GetAll() methods on the D-Bus.
1303
"""
1304
873
1305
def _get_dbus_property(self, interface_name, property_name):
874
1306
"""Returns a bound method if one exists which is a D-Bus
875
1307
property with the specified name and interface.
876
1308
"""
877
for cls in self.__class__.__mro__:
878
for name, value in (inspect.getmembers
879
(cls,
880
self._is_dbus_thing("property"))):
1309
for cls in self.__class__.__mro__:
1310
for name, value in inspect.getmembers(
1311
cls, self._is_dbus_thing("property")):
881
1312
if (value._dbus_name == property_name
882
1313
and value._dbus_interface == interface_name):
883
1314
return value.__get__(self)
884
1315
885
1316
# No such property
886
raise DBusPropertyNotFound(self.dbus_object_path + ":"
887
+ interface_name + "."
888
+ property_name)
889
890
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1317
raise DBusPropertyNotFound("{}:{}.{}".format(
1318
self.dbus_object_path, interface_name, property_name))
1319
1320
@classmethod
1321
def _get_all_interface_names(cls):
1322
"""Get a sequence of all interfaces supported by an object"""
1323
return (name for name in set(getattr(getattr(x, attr),
1324
"_dbus_interface", None)
1325
for x in (inspect.getmro(cls))
1326
for attr in dir(x))
1327
if name is not None)
1328
1329
@dbus.service.method(dbus.PROPERTIES_IFACE,
1330
in_signature="ss",
891
1331
out_signature="v")
892
1332
def Get(self, interface_name, property_name):
893
1333
"""Standard D-Bus property Get() method, see D-Bus standard.
899
1339
if not hasattr(value, "variant_level"):
900
1340
return value
901
1341
return type(value)(value, variant_level=value.variant_level+1)
902
1342
903
1343
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
904
1344
def Set(self, interface_name, property_name, value):
905
1345
"""Standard D-Bus property Set() method, see D-Bus standard.
911
1351
# The byte_arrays option is not supported yet on
912
1352
# signatures other than "ay".
913
1353
if prop._dbus_signature != "ay":
914
raise ValueError
1354
raise ValueError("Byte arrays not supported for non-"
1355
"'ay' signature {!r}"
1356
.format(prop._dbus_signature))
915
1357
value = dbus.ByteArray(b''.join(chr(byte)
916
1358
for byte in value))
917
1359
prop(value)
918
919
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1360
1361
@dbus.service.method(dbus.PROPERTIES_IFACE,
1362
in_signature="s",
920
1363
out_signature="a{sv}")
921
1364
def GetAll(self, interface_name):
922
1365
"""Standard D-Bus property GetAll() method, see D-Bus
923
1366
standard.
924
1367
925
1368
Note: Will not include properties with access="write".
926
1369
"""
927
1370
properties = {}
937
1380
if not hasattr(value, "variant_level"):
938
1381
properties[name] = value
939
1382
continue
940
properties[name] = type(value)(value, variant_level=
941
value.variant_level+1)
1383
properties[name] = type(value)(
1384
value, variant_level=value.variant_level + 1)
942
1385
return dbus.Dictionary(properties, signature="sv")
943
1386
1387
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1388
def PropertiesChanged(self, interface_name, changed_properties,
1389
invalidated_properties):
1390
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1391
standard.
1392
"""
1393
pass
1394
944
1395
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
945
1396
out_signature="s",
946
1397
path_keyword='object_path',
947
1398
connection_keyword='connection')
948
1399
def Introspect(self, object_path, connection):
949
1400
"""Overloading of standard D-Bus method.
950
1401
951
1402
Inserts property tags and interface annotation tags.
952
1403
"""
953
xmlstring = dbus.service.Object.Introspect(self, object_path,
954
connection)
1404
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1405
object_path,
1406
connection)
955
1407
try:
956
1408
document = xml.dom.minidom.parseString(xmlstring)
1409
957
1410
def make_tag(document, name, prop):
958
1411
e = document.createElement("property")
959
1412
e.setAttribute("name", name)
960
1413
e.setAttribute("type", prop._dbus_signature)
961
1414
e.setAttribute("access", prop._dbus_access)
962
1415
return e
1416
963
1417
for if_tag in document.getElementsByTagName("interface"):
964
1418
# Add property tags
965
1419
for tag in (make_tag(document, name, prop)
968
1422
if prop._dbus_interface
969
1423
== if_tag.getAttribute("name")):
970
1424
if_tag.appendChild(tag)
971
# Add annotation tags
972
for typ in ("method", "signal", "property"):
973
for tag in if_tag.getElementsByTagName(typ):
974
annots = dict()
975
for name, prop in (self.
976
_get_all_dbus_things(typ)):
977
if (name == tag.getAttribute("name")
978
and prop._dbus_interface
979
== if_tag.getAttribute("name")):
980
annots.update(getattr
981
(prop,
982
"_dbus_annotations",
983
{}))
984
for name, value in annots.iteritems():
985
ann_tag = document.createElement(
986
"annotation")
987
ann_tag.setAttribute("name", name)
988
ann_tag.setAttribute("value", value)
989
tag.appendChild(ann_tag)
990
# Add interface annotation tags
991
for annotation, value in dict(
992
itertools.chain.from_iterable(
993
annotations().iteritems()
994
for name, annotations in
995
self._get_all_dbus_things("interface")
996
if name == if_tag.getAttribute("name")
997
)).iteritems():
998
ann_tag = document.createElement("annotation")
999
ann_tag.setAttribute("name", annotation)
1000
ann_tag.setAttribute("value", value)
1001
if_tag.appendChild(ann_tag)
1425
# Add annotation tags for properties
1426
for tag in if_tag.getElementsByTagName("property"):
1427
annots = dict()
1428
for name, prop in self._get_all_dbus_things(
1429
"property"):
1430
if (name == tag.getAttribute("name")
1431
and prop._dbus_interface
1432
== if_tag.getAttribute("name")):
1433
annots.update(getattr(
1434
prop, "_dbus_annotations", {}))
1435
for name, value in annots.items():
1436
ann_tag = document.createElement(
1437
"annotation")
1438
ann_tag.setAttribute("name", name)
1439
ann_tag.setAttribute("value", value)
1440
tag.appendChild(ann_tag)
1002
1441
# Add the names to the return values for the
1003
1442
# "org.freedesktop.DBus.Properties" methods
1004
1443
if (if_tag.getAttribute("name")
1022
1461
exc_info=error)
1023
1462
return xmlstring
1024
1463
1025
1026
def datetime_to_dbus (dt, variant_level=0):
1464
try:
1465
dbus.OBJECT_MANAGER_IFACE
1466
except AttributeError:
1467
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1468
1469
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1471
"""A D-Bus object with an ObjectManager.
1472
1473
Classes inheriting from this exposes the standard
1474
GetManagedObjects call and the InterfacesAdded and
1475
InterfacesRemoved signals on the standard
1476
"org.freedesktop.DBus.ObjectManager" interface.
1477
1478
Note: No signals are sent automatically; they must be sent
1479
manually.
1480
"""
1481
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1482
out_signature="a{oa{sa{sv}}}")
1483
def GetManagedObjects(self):
1484
"""This function must be overridden"""
1485
raise NotImplementedError()
1486
1487
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1488
signature="oa{sa{sv}}")
1489
def InterfacesAdded(self, object_path, interfaces_and_properties):
1490
pass
1491
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1493
def InterfacesRemoved(self, object_path, interfaces):
1494
pass
1495
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1497
out_signature="s",
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1500
def Introspect(self, object_path, connection):
1501
"""Overloading of standard D-Bus method.
1502
1503
Override return argument name of GetManagedObjects to be
1504
"objpath_interfaces_and_properties"
1505
"""
1506
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1507
object_path,
1508
connection)
1509
try:
1510
document = xml.dom.minidom.parseString(xmlstring)
1511
1512
for if_tag in document.getElementsByTagName("interface"):
1513
# Fix argument name for the GetManagedObjects method
1514
if (if_tag.getAttribute("name")
1515
== dbus.OBJECT_MANAGER_IFACE):
1516
for cn in if_tag.getElementsByTagName("method"):
1517
if (cn.getAttribute("name")
1518
== "GetManagedObjects"):
1519
for arg in cn.getElementsByTagName("arg"):
1520
if (arg.getAttribute("direction")
1521
== "out"):
1522
arg.setAttribute(
1523
"name",
1524
"objpath_interfaces"
1525
"_and_properties")
1526
xmlstring = document.toxml("utf-8")
1527
document.unlink()
1528
except (AttributeError, xml.dom.DOMException,
1529
xml.parsers.expat.ExpatError) as error:
1530
logger.error("Failed to override Introspection method",
1531
exc_info=error)
1532
return xmlstring
1533
1534
1535
def datetime_to_dbus(dt, variant_level=0):
1027
1536
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1028
1537
if dt is None:
1029
return dbus.String("", variant_level = variant_level)
1030
return dbus.String(dt.isoformat(),
1031
variant_level=variant_level)
1538
return dbus.String("", variant_level=variant_level)
1539
return dbus.String(dt.isoformat(), variant_level=variant_level)
1032
1540
1033
1541
1034
1542
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1036
1544
dbus.service.Object, it will add alternate D-Bus attributes with
1037
1545
interface names according to the "alt_interface_names" mapping.
1038
1546
Usage:
1039
1040
@alternate_dbus_names({"org.example.Interface":
1041
"net.example.AlternateInterface"})
1547
1548
@alternate_dbus_interfaces({"org.example.Interface":
1549
"net.example.AlternateInterface"})
1042
1550
class SampleDBusObject(dbus.service.Object):
1043
1551
@dbus.service.method("org.example.Interface")
1044
1552
def SampleDBusMethod():
1045
1553
pass
1046
1554
1047
1555
The above "SampleDBusMethod" on "SampleDBusObject" will be
1048
1556
reachable via two interfaces: "org.example.Interface" and
1049
1557
"net.example.AlternateInterface", the latter of which will have
1050
1558
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1051
1559
"true", unless "deprecate" is passed with a False value.
1052
1560
1053
1561
This works for methods and signals, and also for D-Bus properties
1054
1562
(from DBusObjectWithProperties) and interfaces (from the
1055
1563
dbus_interface_annotations decorator).
1056
1564
"""
1565
1057
1566
def wrapper(cls):
1058
1567
for orig_interface_name, alt_interface_name in (
1059
alt_interface_names.iteritems()):
1568
alt_interface_names.items()):
1060
1569
attr = {}
1061
1570
interface_names = set()
1062
1571
# Go though all attributes of the class
1064
1573
# Ignore non-D-Bus attributes, and D-Bus attributes
1065
1574
# with the wrong interface name
1066
1575
if (not hasattr(attribute, "_dbus_interface")
1067
or not attribute._dbus_interface
1068
.startswith(orig_interface_name)):
1576
or not attribute._dbus_interface.startswith(
1577
orig_interface_name)):
1069
1578
continue
1070
1579
# Create an alternate D-Bus interface name based on
1071
1580
# the current name
1072
alt_interface = (attribute._dbus_interface
1073
.replace(orig_interface_name,
1074
alt_interface_name))
1581
alt_interface = attribute._dbus_interface.replace(
1582
orig_interface_name, alt_interface_name)
1075
1583
interface_names.add(alt_interface)
1076
1584
# Is this a D-Bus signal?
1077
1585
if getattr(attribute, "_dbus_is_signal", False):
1078
# Extract the original non-method function by
1079
# black magic
1080
nonmethod_func = (dict(
1586
# Extract the original non-method undecorated
1587
# function by black magic
1588
if sys.version_info.major == 2:
1589
nonmethod_func = (dict(
1081
1590
zip(attribute.func_code.co_freevars,
1082
attribute.__closure__))["func"]
1083
.cell_contents)
1591
attribute.__closure__))
1592
["func"].cell_contents)
1593
else:
1594
nonmethod_func = (dict(
1595
zip(attribute.__code__.co_freevars,
1596
attribute.__closure__))
1597
["func"].cell_contents)
1084
1598
# Create a new, but exactly alike, function
1085
1599
# object, and decorate it to be a new D-Bus signal
1086
1600
# with the alternate D-Bus interface name
1087
new_function = (dbus.service.signal
1088
(alt_interface,
1089
attribute._dbus_signature)
1090
(types.FunctionType(
1091
nonmethod_func.func_code,
1092
nonmethod_func.func_globals,
1093
nonmethod_func.func_name,
1094
nonmethod_func.func_defaults,
1095
nonmethod_func.func_closure)))
1601
new_function = copy_function(nonmethod_func)
1602
new_function = (dbus.service.signal(
1603
alt_interface,
1604
attribute._dbus_signature)(new_function))
1096
1605
# Copy annotations, if any
1097
1606
try:
1098
new_function._dbus_annotations = (
1099
dict(attribute._dbus_annotations))
1607
new_function._dbus_annotations = dict(
1608
attribute._dbus_annotations)
1100
1609
except AttributeError:
1101
1610
pass
1611
1102
1612
# Define a creator of a function to call both the
1103
1613
# original and alternate functions, so both the
1104
1614
# original and alternate signals gets sent when
1107
1617
"""This function is a scope container to pass
1108
1618
func1 and func2 to the "call_both" function
1109
1619
outside of its arguments"""
1620
1621
@functools.wraps(func2)
1110
1622
def call_both(*args, **kwargs):
1111
1623
"""This function will emit two D-Bus
1112
1624
signals by calling func1 and func2"""
1113
1625
func1(*args, **kwargs)
1114
1626
func2(*args, **kwargs)
1627
# Make wrapper function look like a D-Bus
1628
# signal
1629
for name, attr in inspect.getmembers(func2):
1630
if name.startswith("_dbus_"):
1631
setattr(call_both, name, attr)
1632
1115
1633
return call_both
1116
1634
# Create the "call_both" function and add it to
1117
1635
# the class
1122
1640
# object. Decorate it to be a new D-Bus method
1123
1641
# with the alternate D-Bus interface name. Add it
1124
1642
# to the class.
1125
attr[attrname] = (dbus.service.method
1126
(alt_interface,
1127
attribute._dbus_in_signature,
1128
attribute._dbus_out_signature)
1129
(types.FunctionType
1130
(attribute.func_code,
1131
attribute.func_globals,
1132
attribute.func_name,
1133
attribute.func_defaults,
1134
attribute.func_closure)))
1643
attr[attrname] = (
1644
dbus.service.method(
1645
alt_interface,
1646
attribute._dbus_in_signature,
1647
attribute._dbus_out_signature)
1648
(copy_function(attribute)))
1135
1649
# Copy annotations, if any
1136
1650
try:
1137
attr[attrname]._dbus_annotations = (
1138
dict(attribute._dbus_annotations))
1651
attr[attrname]._dbus_annotations = dict(
1652
attribute._dbus_annotations)
1139
1653
except AttributeError:
1140
1654
pass
1141
1655
# Is this a D-Bus property?
1144
1658
# object, and decorate it to be a new D-Bus
1145
1659
# property with the alternate D-Bus interface
1146
1660
# name. Add it to the class.
1147
attr[attrname] = (dbus_service_property
1148
(alt_interface,
1149
attribute._dbus_signature,
1150
attribute._dbus_access,
1151
attribute
1152
._dbus_get_args_options
1153
["byte_arrays"])
1154
(types.FunctionType
1155
(attribute.func_code,
1156
attribute.func_globals,
1157
attribute.func_name,
1158
attribute.func_defaults,
1159
attribute.func_closure)))
1661
attr[attrname] = (dbus_service_property(
1662
alt_interface, attribute._dbus_signature,
1663
attribute._dbus_access,
1664
attribute._dbus_get_args_options
1665
["byte_arrays"])
1666
(copy_function(attribute)))
1160
1667
# Copy annotations, if any
1161
1668
try:
1162
attr[attrname]._dbus_annotations = (
1163
dict(attribute._dbus_annotations))
1669
attr[attrname]._dbus_annotations = dict(
1670
attribute._dbus_annotations)
1164
1671
except AttributeError:
1165
1672
pass
1166
1673
# Is this a D-Bus interface?
1169
1676
# object. Decorate it to be a new D-Bus interface
1170
1677
# with the alternate D-Bus interface name. Add it
1171
1678
# to the class.
1172
attr[attrname] = (dbus_interface_annotations
1173
(alt_interface)
1174
(types.FunctionType
1175
(attribute.func_code,
1176
attribute.func_globals,
1177
attribute.func_name,
1178
attribute.func_defaults,
1179
attribute.func_closure)))
1679
attr[attrname] = (
1680
dbus_interface_annotations(alt_interface)
1681
(copy_function(attribute)))
1180
1682
if deprecate:
1181
1683
# Deprecate all alternate interfaces
1182
iname="_AlternateDBusNames_interface_annotation{0}"
1684
iname = "_AlternateDBusNames_interface_annotation{}"
1183
1685
for interface_name in interface_names:
1686
1184
1687
@dbus_interface_annotations(interface_name)
1185
1688
def func(self):
1186
return { "org.freedesktop.DBus.Deprecated":
1187
"true" }
1689
return {"org.freedesktop.DBus.Deprecated":
1690
"true"}
1188
1691
# Find an unused name
1189
1692
for aname in (iname.format(i)
1190
1693
for i in itertools.count()):
1194
1697
if interface_names:
1195
1698
# Replace the class with a new subclass of it with
1196
1699
# methods, signals, etc. as created above.
1197
cls = type(b"{0}Alternate".format(cls.__name__),
1198
(cls,), attr)
1700
if sys.version_info.major == 2:
1701
cls = type(b"{}Alternate".format(cls.__name__),
1702
(cls, ), attr)
1703
else:
1704
cls = type("{}Alternate".format(cls.__name__),
1705
(cls, ), attr)
1199
1706
return cls
1707
1200
1708
return wrapper
1201
1709
1202
1710
1203
1711
@alternate_dbus_interfaces({"se.recompile.Mandos":
1204
"se.bsnet.fukt.Mandos"})
1712
"se.bsnet.fukt.Mandos"})
1205
1713
class ClientDBus(Client, DBusObjectWithProperties):
1206
1714
"""A Client class using D-Bus
1207
1715
1208
1716
Attributes:
1209
1717
dbus_object_path: dbus.ObjectPath
1210
1718
bus: dbus.SystemBus()
1211
1719
"""
1212
1720
1213
1721
runtime_expansions = (Client.runtime_expansions
1214
+ ("dbus_object_path",))
1215
1722
+ ("dbus_object_path", ))
1723
1724
_interface = "se.recompile.Mandos.Client"
1725
1216
1726
# dbus.service.Object doesn't use super(), so we can't either.
1217
1218
def __init__(self, bus = None, *args, **kwargs):
1727
1728
def __init__(self, bus=None, *args, **kwargs):
1219
1729
self.bus = bus
1220
1730
Client.__init__(self, *args, **kwargs)
1221
1731
# Only now, when this client is initialized, can it show up on
1222
1732
# the D-Bus
1223
client_object_name = unicode(self.name).translate(
1733
client_object_name = str(self.name).translate(
1224
1734
{ord("."): ord("_"),
1225
1735
ord("-"): ord("_")})
1226
self.dbus_object_path = (dbus.ObjectPath
1227
("/clients/" + client_object_name))
1736
self.dbus_object_path = dbus.ObjectPath(
1737
"/clients/" + client_object_name)
1228
1738
DBusObjectWithProperties.__init__(self, self.bus,
1229
1739
self.dbus_object_path)
1230
1231
def notifychangeproperty(transform_func,
1232
dbus_name, type_func=lambda x: x,
1233
variant_level=1):
1740
1741
def notifychangeproperty(transform_func, dbus_name,
1742
type_func=lambda x: x,
1743
variant_level=1,
1744
invalidate_only=False,
1745
_interface=_interface):
1234
1746
""" Modify a variable so that it's a property which announces
1235
1747
its changes to DBus.
1236
1748
1237
1749
transform_fun: Function that takes a value and a variant_level
1238
1750
and transforms it to a D-Bus type.
1239
1751
dbus_name: D-Bus name of the variable
1241
1753
to the D-Bus. Default: no transform
1242
1754
variant_level: D-Bus variant level. Default: 1
1243
1755
"""
1244
attrname = "_{0}".format(dbus_name)
1756
attrname = "_{}".format(dbus_name)
1757
1245
1758
def setter(self, value):
1246
1759
if hasattr(self, "dbus_object_path"):
1247
1760
if (not hasattr(self, attrname) or
1248
1761
type_func(getattr(self, attrname, None))
1249
1762
!= type_func(value)):
1250
dbus_value = transform_func(type_func(value),
1251
variant_level
1252
=variant_level)
1253
self.PropertyChanged(dbus.String(dbus_name),
1254
dbus_value)
1763
if invalidate_only:
1764
self.PropertiesChanged(
1765
_interface, dbus.Dictionary(),
1766
dbus.Array((dbus_name, )))
1767
else:
1768
dbus_value = transform_func(
1769
type_func(value),
1770
variant_level=variant_level)
1771
self.PropertyChanged(dbus.String(dbus_name),
1772
dbus_value)
1773
self.PropertiesChanged(
1774
_interface,
1775
dbus.Dictionary({dbus.String(dbus_name):
1776
dbus_value}),
1777
dbus.Array())
1255
1778
setattr(self, attrname, value)
1256
1779
1257
1780
return property(lambda self: getattr(self, attrname), setter)
1258
1781
1259
1782
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1260
1783
approvals_pending = notifychangeproperty(dbus.Boolean,
1261
1784
"ApprovalPending",
1262
type_func = bool)
1785
type_func=bool)
1263
1786
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1264
1787
last_enabled = notifychangeproperty(datetime_to_dbus,
1265
1788
"LastEnabled")
1266
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1267
type_func = lambda checker:
1268
checker is not None)
1789
checker = notifychangeproperty(
1790
dbus.Boolean, "CheckerRunning",
1791
type_func=lambda checker: checker is not None)
1269
1792
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1270
1793
"LastCheckedOK")
1271
1794
last_checker_status = notifychangeproperty(dbus.Int16,
1274
1797
datetime_to_dbus, "LastApprovalRequest")
1275
1798
approved_by_default = notifychangeproperty(dbus.Boolean,
1276
1799
"ApprovedByDefault")
1277
approval_delay = notifychangeproperty(dbus.UInt64,
1278
"ApprovalDelay",
1279
type_func =
1280
timedelta_to_milliseconds)
1800
approval_delay = notifychangeproperty(
1801
dbus.UInt64, "ApprovalDelay",
1802
type_func=lambda td: td.total_seconds() * 1000)
1281
1803
approval_duration = notifychangeproperty(
1282
1804
dbus.UInt64, "ApprovalDuration",
1283
type_func = timedelta_to_milliseconds)
1805
type_func=lambda td: td.total_seconds() * 1000)
1284
1806
host = notifychangeproperty(dbus.String, "Host")
1285
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1286
type_func =
1287
timedelta_to_milliseconds)
1807
timeout = notifychangeproperty(
1808
dbus.UInt64, "Timeout",
1809
type_func=lambda td: td.total_seconds() * 1000)
1288
1810
extended_timeout = notifychangeproperty(
1289
1811
dbus.UInt64, "ExtendedTimeout",
1290
type_func = timedelta_to_milliseconds)
1291
interval = notifychangeproperty(dbus.UInt64,
1292
"Interval",
1293
type_func =
1294
timedelta_to_milliseconds)
1812
type_func=lambda td: td.total_seconds() * 1000)
1813
interval = notifychangeproperty(
1814
dbus.UInt64, "Interval",
1815
type_func=lambda td: td.total_seconds() * 1000)
1295
1816
checker_command = notifychangeproperty(dbus.String, "Checker")
1296
1817
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1818
invalidate_only=True)
1819
1297
1820
del notifychangeproperty
1298
1821
1299
1822
def __del__(self, *args, **kwargs):
1300
1823
try:
1301
1824
self.remove_from_connection()
1304
1827
if hasattr(DBusObjectWithProperties, "__del__"):
1305
1828
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1306
1829
Client.__del__(self, *args, **kwargs)
1307
1308
def checker_callback(self, pid, condition, command,
1309
*args, **kwargs):
1310
self.checker_callback_tag = None
1311
self.checker = None
1312
if os.WIFEXITED(condition):
1313
exitstatus = os.WEXITSTATUS(condition)
1830
1831
def checker_callback(self, source, condition,
1832
connection, command, *args, **kwargs):
1833
ret = Client.checker_callback(self, source, condition,
1834
connection, command, *args,
1835
**kwargs)
1836
exitstatus = self.last_checker_status
1837
if exitstatus >= 0:
1314
1838
# Emit D-Bus signal
1315
1839
self.CheckerCompleted(dbus.Int16(exitstatus),
1316
dbus.Int64(condition),
1840
# This is specific to GNU libC
1841
dbus.Int64(exitstatus << 8),
1317
1842
dbus.String(command))
1318
1843
else:
1319
1844
# Emit D-Bus signal
1320
1845
self.CheckerCompleted(dbus.Int16(-1),
1321
dbus.Int64(condition),
1846
dbus.Int64(
1847
# This is specific to GNU libC
1848
(exitstatus << 8)
1849
| self.last_checker_signal),
1322
1850
dbus.String(command))
1323
1324
return Client.checker_callback(self, pid, condition, command,
1325
*args, **kwargs)
1326
1851
return ret
1852
1327
1853
def start_checker(self, *args, **kwargs):
1328
old_checker = self.checker
1329
if self.checker is not None:
1330
old_checker_pid = self.checker.pid
1331
else:
1332
old_checker_pid = None
1854
old_checker_pid = getattr(self.checker, "pid", None)
1333
1855
r = Client.start_checker(self, *args, **kwargs)
1334
1856
# Only if new checker process was started
1335
1857
if (self.checker is not None
1337
1859
# Emit D-Bus signal
1338
1860
self.CheckerStarted(self.current_checker_command)
1339
1861
return r
1340
1862
1341
1863
def _reset_approved(self):
1342
1864
self.approved = None
1343
1865
return False
1344
1866
1345
1867
def approve(self, value=True):
1346
1868
self.approved = value
1347
gobject.timeout_add(timedelta_to_milliseconds
1348
(self.approval_duration),
1349
self._reset_approved)
1869
GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
* 1000), self._reset_approved)
1350
1871
self.send_changedstate()
1351
1352
## D-Bus methods, signals & properties
1353
_interface = "se.recompile.Mandos.Client"
1354
1355
## Interfaces
1356
1357
@dbus_interface_annotations(_interface)
1358
def _foo(self):
1359
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1360
"false"}
1361
1362
## Signals
1363
1872
1873
# D-Bus methods, signals & properties
1874
1875
# Interfaces
1876
1877
# Signals
1878
1364
1879
# CheckerCompleted - signal
1365
1880
@dbus.service.signal(_interface, signature="nxs")
1366
1881
def CheckerCompleted(self, exitcode, waitstatus, command):
1367
1882
"D-Bus signal"
1368
1883
pass
1369
1884
1370
1885
# CheckerStarted - signal
1371
1886
@dbus.service.signal(_interface, signature="s")
1372
1887
def CheckerStarted(self, command):
1373
1888
"D-Bus signal"
1374
1889
pass
1375
1890
1376
1891
# PropertyChanged - signal
1892
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1377
1893
@dbus.service.signal(_interface, signature="sv")
1378
1894
def PropertyChanged(self, property, value):
1379
1895
"D-Bus signal"
1380
1896
pass
1381
1897
1382
1898
# GotSecret - signal
1383
1899
@dbus.service.signal(_interface)
1384
1900
def GotSecret(self):
1387
1903
server to mandos-client
1388
1904
"""
1389
1905
pass
1390
1906
1391
1907
# Rejected - signal
1392
1908
@dbus.service.signal(_interface, signature="s")
1393
1909
def Rejected(self, reason):
1394
1910
"D-Bus signal"
1395
1911
pass
1396
1912
1397
1913
# NeedApproval - signal
1398
1914
@dbus.service.signal(_interface, signature="tb")
1399
1915
def NeedApproval(self, timeout, default):
1400
1916
"D-Bus signal"
1401
1917
return self.need_approval()
1402
1403
## Methods
1404
1918
1919
# Methods
1920
1405
1921
# Approve - method
1406
1922
@dbus.service.method(_interface, in_signature="b")
1407
1923
def Approve(self, value):
1408
1924
self.approve(value)
1409
1925
1410
1926
# CheckedOK - method
1411
1927
@dbus.service.method(_interface)
1412
1928
def CheckedOK(self):
1413
1929
self.checked_ok()
1414
1930
1415
1931
# Enable - method
1932
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1416
1933
@dbus.service.method(_interface)
1417
1934
def Enable(self):
1418
1935
"D-Bus method"
1419
1936
self.enable()
1420
1937
1421
1938
# StartChecker - method
1939
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1422
1940
@dbus.service.method(_interface)
1423
1941
def StartChecker(self):
1424
1942
"D-Bus method"
1425
1943
self.start_checker()
1426
1944
1427
1945
# Disable - method
1946
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1428
1947
@dbus.service.method(_interface)
1429
1948
def Disable(self):
1430
1949
"D-Bus method"
1431
1950
self.disable()
1432
1951
1433
1952
# StopChecker - method
1953
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1434
1954
@dbus.service.method(_interface)
1435
1955
def StopChecker(self):
1436
1956
self.stop_checker()
1437
1438
## Properties
1439
1957
1958
# Properties
1959
1440
1960
# ApprovalPending - property
1441
1961
@dbus_service_property(_interface, signature="b", access="read")
1442
1962
def ApprovalPending_dbus_property(self):
1443
1963
return dbus.Boolean(bool(self.approvals_pending))
1444
1964
1445
1965
# ApprovedByDefault - property
1446
@dbus_service_property(_interface, signature="b",
1966
@dbus_service_property(_interface,
1967
signature="b",
1447
1968
access="readwrite")
1448
1969
def ApprovedByDefault_dbus_property(self, value=None):
1449
1970
if value is None: # get
1450
1971
return dbus.Boolean(self.approved_by_default)
1451
1972
self.approved_by_default = bool(value)
1452
1973
1453
1974
# ApprovalDelay - property
1454
@dbus_service_property(_interface, signature="t",
1975
@dbus_service_property(_interface,
1976
signature="t",
1455
1977
access="readwrite")
1456
1978
def ApprovalDelay_dbus_property(self, value=None):
1457
1979
if value is None: # get
1458
return dbus.UInt64(self.approval_delay_milliseconds())
1980
return dbus.UInt64(self.approval_delay.total_seconds()
1981
* 1000)
1459
1982
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1460
1983
1461
1984
# ApprovalDuration - property
1462
@dbus_service_property(_interface, signature="t",
1985
@dbus_service_property(_interface,
1986
signature="t",
1463
1987
access="readwrite")
1464
1988
def ApprovalDuration_dbus_property(self, value=None):
1465
1989
if value is None: # get
1466
return dbus.UInt64(timedelta_to_milliseconds(
1467
self.approval_duration))
1990
return dbus.UInt64(self.approval_duration.total_seconds()
1991
* 1000)
1468
1992
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1469
1993
1470
1994
# Name - property
1995
@dbus_annotations(
1996
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1471
1997
@dbus_service_property(_interface, signature="s", access="read")
1472
1998
def Name_dbus_property(self):
1473
1999
return dbus.String(self.name)
1474
2000
1475
2001
# Fingerprint - property
2002
@dbus_annotations(
2003
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1476
2004
@dbus_service_property(_interface, signature="s", access="read")
1477
2005
def Fingerprint_dbus_property(self):
1478
2006
return dbus.String(self.fingerprint)
1479
2007
1480
2008
# Host - property
1481
@dbus_service_property(_interface, signature="s",
2009
@dbus_service_property(_interface,
2010
signature="s",
1482
2011
access="readwrite")
1483
2012
def Host_dbus_property(self, value=None):
1484
2013
if value is None: # get
1485
2014
return dbus.String(self.host)
1486
self.host = unicode(value)
1487
2015
self.host = str(value)
2016
1488
2017
# Created - property
2018
@dbus_annotations(
2019
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1489
2020
@dbus_service_property(_interface, signature="s", access="read")
1490
2021
def Created_dbus_property(self):
1491
2022
return datetime_to_dbus(self.created)
1492
2023
1493
2024
# LastEnabled - property
1494
2025
@dbus_service_property(_interface, signature="s", access="read")
1495
2026
def LastEnabled_dbus_property(self):
1496
2027
return datetime_to_dbus(self.last_enabled)
1497
2028
1498
2029
# Enabled - property
1499
@dbus_service_property(_interface, signature="b",
2030
@dbus_service_property(_interface,
2031
signature="b",
1500
2032
access="readwrite")
1501
2033
def Enabled_dbus_property(self, value=None):
1502
2034
if value is None: # get
1505
2037
self.enable()
1506
2038
else:
1507
2039
self.disable()
1508
2040
1509
2041
# LastCheckedOK - property
1510
@dbus_service_property(_interface, signature="s",
2042
@dbus_service_property(_interface,
2043
signature="s",
1511
2044
access="readwrite")
1512
2045
def LastCheckedOK_dbus_property(self, value=None):
1513
2046
if value is not None:
1514
2047
self.checked_ok()
1515
2048
return
1516
2049
return datetime_to_dbus(self.last_checked_ok)
1517
2050
1518
2051
# LastCheckerStatus - property
1519
@dbus_service_property(_interface, signature="n",
1520
access="read")
2052
@dbus_service_property(_interface, signature="n", access="read")
1521
2053
def LastCheckerStatus_dbus_property(self):
1522
2054
return dbus.Int16(self.last_checker_status)
1523
2055
1524
2056
# Expires - property
1525
2057
@dbus_service_property(_interface, signature="s", access="read")
1526
2058
def Expires_dbus_property(self):
1527
2059
return datetime_to_dbus(self.expires)
1528
2060
1529
2061
# LastApprovalRequest - property
1530
2062
@dbus_service_property(_interface, signature="s", access="read")
1531
2063
def LastApprovalRequest_dbus_property(self):
1532
2064
return datetime_to_dbus(self.last_approval_request)
1533
2065
1534
2066
# Timeout - property
1535
@dbus_service_property(_interface, signature="t",
2067
@dbus_service_property(_interface,
2068
signature="t",
1536
2069
access="readwrite")
1537
2070
def Timeout_dbus_property(self, value=None):
1538
2071
if value is None: # get
1539
return dbus.UInt64(self.timeout_milliseconds())
2072
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1540
2073
old_timeout = self.timeout
1541
2074
self.timeout = datetime.timedelta(0, 0, 0, value)
1542
2075
# Reschedule disabling
1550
2083
if (getattr(self, "disable_initiator_tag", None)
1551
2084
is None):
1552
2085
return
1553
gobject.source_remove(self.disable_initiator_tag)
1554
self.disable_initiator_tag = (
1555
gobject.timeout_add(
1556
timedelta_to_milliseconds(self.expires - now),
1557
self.disable))
1558
2086
GLib.source_remove(self.disable_initiator_tag)
2087
self.disable_initiator_tag = GLib.timeout_add(
2088
int((self.expires - now).total_seconds() * 1000),
2089
self.disable)
2090
1559
2091
# ExtendedTimeout - property
1560
@dbus_service_property(_interface, signature="t",
2092
@dbus_service_property(_interface,
2093
signature="t",
1561
2094
access="readwrite")
1562
2095
def ExtendedTimeout_dbus_property(self, value=None):
1563
2096
if value is None: # get
1564
return dbus.UInt64(self.extended_timeout_milliseconds())
2097
return dbus.UInt64(self.extended_timeout.total_seconds()
2098
* 1000)
1565
2099
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1566
2100
1567
2101
# Interval - property
1568
@dbus_service_property(_interface, signature="t",
2102
@dbus_service_property(_interface,
2103
signature="t",
1569
2104
access="readwrite")
1570
2105
def Interval_dbus_property(self, value=None):
1571
2106
if value is None: # get
1572
return dbus.UInt64(self.interval_milliseconds())
2107
return dbus.UInt64(self.interval.total_seconds() * 1000)
1573
2108
self.interval = datetime.timedelta(0, 0, 0, value)
1574
2109
if getattr(self, "checker_initiator_tag", None) is None:
1575
2110
return
1576
2111
if self.enabled:
1577
2112
# Reschedule checker run
1578
gobject.source_remove(self.checker_initiator_tag)
1579
self.checker_initiator_tag = (gobject.timeout_add
1580
(value, self.start_checker))
1581
self.start_checker() # Start one now, too
1582
2113
GLib.source_remove(self.checker_initiator_tag)
2114
self.checker_initiator_tag = GLib.timeout_add(
2115
value, self.start_checker)
2116
self.start_checker() # Start one now, too
2117
1583
2118
# Checker - property
1584
@dbus_service_property(_interface, signature="s",
2119
@dbus_service_property(_interface,
2120
signature="s",
1585
2121
access="readwrite")
1586
2122
def Checker_dbus_property(self, value=None):
1587
2123
if value is None: # get
1588
2124
return dbus.String(self.checker_command)
1589
self.checker_command = unicode(value)
1590
2125
self.checker_command = str(value)
2126
1591
2127
# CheckerRunning - property
1592
@dbus_service_property(_interface, signature="b",
2128
@dbus_service_property(_interface,
2129
signature="b",
1593
2130
access="readwrite")
1594
2131
def CheckerRunning_dbus_property(self, value=None):
1595
2132
if value is None: # get
1598
2135
self.start_checker()
1599
2136
else:
1600
2137
self.stop_checker()
1601
2138
1602
2139
# ObjectPath - property
2140
@dbus_annotations(
2141
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2142
"org.freedesktop.DBus.Deprecated": "true"})
1603
2143
@dbus_service_property(_interface, signature="o", access="read")
1604
2144
def ObjectPath_dbus_property(self):
1605
return self.dbus_object_path # is already a dbus.ObjectPath
1606
2145
return self.dbus_object_path # is already a dbus.ObjectPath
2146
1607
2147
# Secret = property
1608
@dbus_service_property(_interface, signature="ay",
1609
access="write", byte_arrays=True)
2148
@dbus_annotations(
2149
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2150
"invalidates"})
2151
@dbus_service_property(_interface,
2152
signature="ay",
2153
access="write",
2154
byte_arrays=True)
1610
2155
def Secret_dbus_property(self, value):
1611
self.secret = str(value)
1612
2156
self.secret = bytes(value)
2157
1613
2158
del _interface
1614
2159
1615
2160
1618
2163
self._pipe = child_pipe
1619
2164
self._pipe.send(('init', fpr, address))
1620
2165
if not self._pipe.recv():
1621
raise KeyError()
1622
2166
raise KeyError(fpr)
2167
1623
2168
def __getattribute__(self, name):
1624
2169
if name == '_pipe':
1625
2170
return super(ProxyClient, self).__getattribute__(name)
1628
2173
if data[0] == 'data':
1629
2174
return data[1]
1630
2175
if data[0] == 'function':
2176
1631
2177
def func(*args, **kwargs):
1632
2178
self._pipe.send(('funcall', name, args, kwargs))
1633
2179
return self._pipe.recv()[1]
2180
1634
2181
return func
1635
2182
1636
2183
def __setattr__(self, name, value):
1637
2184
if name == '_pipe':
1638
2185
return super(ProxyClient, self).__setattr__(name, value)
1641
2188
1642
2189
class ClientHandler(socketserver.BaseRequestHandler, object):
1643
2190
"""A class to handle client connections.
1644
2191
1645
2192
Instantiated once for each connection to handle it.
1646
2193
Note: This will run in its own forked process."""
1647
2194
1648
2195
def handle(self):
1649
2196
with contextlib.closing(self.server.child_pipe) as child_pipe:
1650
2197
logger.info("TCP connection from: %s",
1651
unicode(self.client_address))
2198
str(self.client_address))
1652
2199
logger.debug("Pipe FD: %d",
1653
2200
self.server.child_pipe.fileno())
1654
1655
session = (gnutls.connection
1656
.ClientSession(self.request,
1657
gnutls.connection
1658
.X509Credentials()))
1659
1660
# Note: gnutls.connection.X509Credentials is really a
1661
# generic GnuTLS certificate credentials object so long as
1662
# no X.509 keys are added to it. Therefore, we can use it
1663
# here despite using OpenPGP certificates.
1664
1665
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1666
# "+AES-256-CBC", "+SHA1",
1667
# "+COMP-NULL", "+CTYPE-OPENPGP",
1668
# "+DHE-DSS"))
2201
2202
session = gnutls.ClientSession(self.request)
2203
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
2207
# "+DHE-DSS"))
1669
2208
# Use a fallback default, since this MUST be set.
1670
2209
priority = self.server.gnutls_priority
1671
2210
if priority is None:
1672
2211
priority = "NORMAL"
1673
(gnutls.library.functions
1674
.gnutls_priority_set_direct(session._c_object,
1675
priority, None))
1676
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
2214
None)
2215
1677
2216
# Start communication using the Mandos protocol
1678
2217
# Get protocol number
1679
2218
line = self.request.makefile().readline()
1680
2219
logger.debug("Protocol version: %r", line)
1681
2220
try:
1682
2221
if int(line.strip().split()[0]) > 1:
1683
raise RuntimeError
2222
raise RuntimeError(line)
1684
2223
except (ValueError, IndexError, RuntimeError) as error:
1685
2224
logger.error("Unknown protocol version: %s", error)
1686
2225
return
1687
2226
1688
2227
# Start GnuTLS connection
1689
2228
try:
1690
2229
session.handshake()
1691
except gnutls.errors.GNUTLSError as error:
2230
except gnutls.Error as error:
1692
2231
logger.warning("Handshake failed: %s", error)
1693
2232
# Do not run session.bye() here: the session is not
1694
2233
# established. Just abandon the request.
1695
2234
return
1696
2235
logger.debug("Handshake succeeded")
1697
2236
1698
2237
approval_required = False
1699
2238
try:
1700
2239
try:
1701
fpr = self.fingerprint(self.peer_certificate
1702
(session))
1703
except (TypeError,
1704
gnutls.errors.GNUTLSError) as error:
2240
fpr = self.fingerprint(
2241
self.peer_certificate(session))
2242
except (TypeError, gnutls.Error) as error:
1705
2243
logger.warning("Bad certificate: %s", error)
1706
2244
return
1707
2245
logger.debug("Fingerprint: %s", fpr)
1708
2246
1709
2247
try:
1710
2248
client = ProxyClient(child_pipe, fpr,
1711
2249
self.client_address)
1712
2250
except KeyError:
1713
2251
return
1714
2252
1715
2253
if client.approval_delay:
1716
2254
delay = client.approval_delay
1717
2255
client.approvals_pending += 1
1718
2256
approval_required = True
1719
2257
1720
2258
while True:
1721
2259
if not client.enabled:
1722
2260
logger.info("Client %s is disabled",
1723
client.name)
2261
client.name)
1724
2262
if self.server.use_dbus:
1725
2263
# Emit D-Bus signal
1726
2264
client.Rejected("Disabled")
1727
2265
return
1728
2266
1729
2267
if client.approved or not client.approval_delay:
1730
#We are approved or approval is disabled
2268
# We are approved or approval is disabled
1731
2269
break
1732
2270
elif client.approved is None:
1733
2271
logger.info("Client %s needs approval",
1735
2273
if self.server.use_dbus:
1736
2274
# Emit D-Bus signal
1737
2275
client.NeedApproval(
1738
client.approval_delay_milliseconds(),
1739
client.approved_by_default)
2276
client.approval_delay.total_seconds()
2277
* 1000, client.approved_by_default)
1740
2278
else:
1741
2279
logger.warning("Client %s was not approved",
1742
2280
client.name)
1744
2282
# Emit D-Bus signal
1745
2283
client.Rejected("Denied")
1746
2284
return
1747
1748
#wait until timeout or approved
2285
2286
# wait until timeout or approved
1749
2287
time = datetime.datetime.now()
1750
2288
client.changedstate.acquire()
1751
client.changedstate.wait(
1752
float(timedelta_to_milliseconds(delay)
1753
/ 1000))
2289
client.changedstate.wait(delay.total_seconds())
1754
2290
client.changedstate.release()
1755
2291
time2 = datetime.datetime.now()
1756
2292
if (time2 - time) >= delay:
1766
2302
break
1767
2303
else:
1768
2304
delay -= time2 - time
1769
1770
sent_size = 0
1771
while sent_size < len(client.secret):
1772
try:
1773
sent = session.send(client.secret[sent_size:])
1774
except gnutls.errors.GNUTLSError as error:
1775
logger.warning("gnutls send failed",
1776
exc_info=error)
1777
return
1778
logger.debug("Sent: %d, remaining: %d",
1779
sent, len(client.secret)
1780
- (sent_size + sent))
1781
sent_size += sent
1782
2305
2306
try:
2307
session.send(client.secret)
2308
except gnutls.Error as error:
2309
logger.warning("gnutls send failed",
2310
exc_info=error)
2311
return
2312
1783
2313
logger.info("Sending secret to %s", client.name)
1784
2314
# bump the timeout using extended_timeout
1785
2315
client.bump_timeout(client.extended_timeout)
1786
2316
if self.server.use_dbus:
1787
2317
# Emit D-Bus signal
1788
2318
client.GotSecret()
1789
2319
1790
2320
finally:
1791
2321
if approval_required:
1792
2322
client.approvals_pending -= 1
1793
2323
try:
1794
2324
session.bye()
1795
except gnutls.errors.GNUTLSError as error:
2325
except gnutls.Error as error:
1796
2326
logger.warning("GnuTLS bye failed",
1797
2327
exc_info=error)
1798
2328
1799
2329
@staticmethod
1800
2330
def peer_certificate(session):
1801
2331
"Return the peer's OpenPGP certificate as a bytestring"
1802
2332
# If not an OpenPGP certificate...
1803
if (gnutls.library.functions
1804
.gnutls_certificate_type_get(session._c_object)
1805
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1806
# ...do the normal thing
1807
return session.peer_certificate
2333
if (gnutls.certificate_type_get(session._c_object)
2334
!= gnutls.CRT_OPENPGP):
2335
# ...return invalid data
2336
return b""
1808
2337
list_size = ctypes.c_uint(1)
1809
cert_list = (gnutls.library.functions
1810
.gnutls_certificate_get_peers
2338
cert_list = (gnutls.certificate_get_peers
1811
2339
(session._c_object, ctypes.byref(list_size)))
1812
2340
if not bool(cert_list) and list_size.value != 0:
1813
raise gnutls.errors.GNUTLSError("error getting peer"
1814
" certificate")
2341
raise gnutls.Error("error getting peer certificate")
1815
2342
if list_size.value == 0:
1816
2343
return None
1817
2344
cert = cert_list[0]
1818
2345
return ctypes.string_at(cert.data, cert.size)
1819
2346
1820
2347
@staticmethod
1821
2348
def fingerprint(openpgp):
1822
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1823
2350
# New GnuTLS "datum" with the OpenPGP public key
1824
datum = (gnutls.library.types
1825
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1826
ctypes.POINTER
1827
(ctypes.c_ubyte)),
1828
ctypes.c_uint(len(openpgp))))
2351
datum = gnutls.datum_t(
2352
ctypes.cast(ctypes.c_char_p(openpgp),
2353
ctypes.POINTER(ctypes.c_ubyte)),
2354
ctypes.c_uint(len(openpgp)))
1829
2355
# New empty GnuTLS certificate
1830
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1831
(gnutls.library.functions
1832
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2356
crt = gnutls.openpgp_crt_t()
2357
gnutls.openpgp_crt_init(ctypes.byref(crt))
1833
2358
# Import the OpenPGP public key into the certificate
1834
(gnutls.library.functions
1835
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1836
gnutls.library.constants
1837
.GNUTLS_OPENPGP_FMT_RAW))
2359
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2360
gnutls.OPENPGP_FMT_RAW)
1838
2361
# Verify the self signature in the key
1839
2362
crtverify = ctypes.c_uint()
1840
(gnutls.library.functions
1841
.gnutls_openpgp_crt_verify_self(crt, 0,
1842
ctypes.byref(crtverify)))
2363
gnutls.openpgp_crt_verify_self(crt, 0,
2364
ctypes.byref(crtverify))
1843
2365
if crtverify.value != 0:
1844
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1845
raise (gnutls.errors.CertificateSecurityError
1846
("Verify failed"))
2366
gnutls.openpgp_crt_deinit(crt)
2367
raise gnutls.CertificateSecurityError("Verify failed")
1847
2368
# New buffer for the fingerprint
1848
2369
buf = ctypes.create_string_buffer(20)
1849
2370
buf_len = ctypes.c_size_t()
1850
2371
# Get the fingerprint from the certificate into the buffer
1851
(gnutls.library.functions
1852
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1853
ctypes.byref(buf_len)))
2372
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2373
ctypes.byref(buf_len))
1854
2374
# Deinit the certificate
1855
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2375
gnutls.openpgp_crt_deinit(crt)
1856
2376
# Convert the buffer to a Python bytestring
1857
2377
fpr = ctypes.string_at(buf, buf_len.value)
1858
2378
# Convert the bytestring to hexadecimal notation
1862
2382
1863
2383
class MultiprocessingMixIn(object):
1864
2384
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2385
1865
2386
def sub_process_main(self, request, address):
1866
2387
try:
1867
2388
self.finish_request(request, address)
1868
2389
except Exception:
1869
2390
self.handle_error(request, address)
1870
2391
self.close_request(request)
1871
2392
1872
2393
def process_request(self, request, address):
1873
2394
"""Start a new process to process the request."""
1874
proc = multiprocessing.Process(target = self.sub_process_main,
1875
args = (request, address))
2395
proc = multiprocessing.Process(target=self.sub_process_main,
2396
args=(request, address))
1876
2397
proc.start()
1877
2398
return proc
1878
2399
1879
2400
1880
2401
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1881
2402
""" adds a pipe to the MixIn """
2403
1882
2404
def process_request(self, request, client_address):
1883
2405
"""Overrides and wraps the original process_request().
1884
2406
1885
2407
This function creates a new pipe in self.pipe
1886
2408
"""
1887
2409
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1888
2410
1889
2411
proc = MultiprocessingMixIn.process_request(self, request,
1890
2412
client_address)
1891
2413
self.child_pipe.close()
1892
2414
self.add_pipe(parent_pipe, proc)
1893
2415
1894
2416
def add_pipe(self, parent_pipe, proc):
1895
2417
"""Dummy function; override as necessary"""
1896
raise NotImplementedError
2418
raise NotImplementedError()
1897
2419
1898
2420
1899
2421
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1900
2422
socketserver.TCPServer, object):
1901
2423
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1902
2424
1903
2425
Attributes:
1904
2426
enabled: Boolean; whether this server is activated yet
1905
2427
interface: None or a network interface name (string)
1906
2428
use_ipv6: Boolean; to use IPv6 or not
1907
2429
"""
2430
1908
2431
def __init__(self, server_address, RequestHandlerClass,
1909
interface=None, use_ipv6=True):
2432
interface=None,
2433
use_ipv6=True,
2434
socketfd=None):
2435
"""If socketfd is set, use that file descriptor instead of
2436
creating a new one with socket.socket().
2437
"""
1910
2438
self.interface = interface
1911
2439
if use_ipv6:
1912
2440
self.address_family = socket.AF_INET6
2441
if socketfd is not None:
2442
# Save the file descriptor
2443
self.socketfd = socketfd
2444
# Save the original socket.socket() function
2445
self.socket_socket = socket.socket
2446
2447
# To implement --socket, we monkey patch socket.socket.
2448
#
2449
# (When socketserver.TCPServer is a new-style class, we
2450
# could make self.socket into a property instead of monkey
2451
# patching socket.socket.)
2452
#
2453
# Create a one-time-only replacement for socket.socket()
2454
@functools.wraps(socket.socket)
2455
def socket_wrapper(*args, **kwargs):
2456
# Restore original function so subsequent calls are
2457
# not affected.
2458
socket.socket = self.socket_socket
2459
del self.socket_socket
2460
# This time only, return a new socket object from the
2461
# saved file descriptor.
2462
return socket.fromfd(self.socketfd, *args, **kwargs)
2463
# Replace socket.socket() function with wrapper
2464
socket.socket = socket_wrapper
2465
# The socketserver.TCPServer.__init__ will call
2466
# socket.socket(), which might be our replacement,
2467
# socket_wrapper(), if socketfd was set.
1913
2468
socketserver.TCPServer.__init__(self, server_address,
1914
2469
RequestHandlerClass)
2470
1915
2471
def server_bind(self):
1916
2472
"""This overrides the normal server_bind() function
1917
2473
to bind to an interface if one was specified, and also NOT to
1918
2474
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
1919
2476
if self.interface is not None:
1920
2477
if SO_BINDTODEVICE is None:
1921
logger.error("SO_BINDTODEVICE does not exist;"
1922
" cannot bind to interface %s",
1923
self.interface)
1924
else:
1925
try:
1926
self.socket.setsockopt(socket.SOL_SOCKET,
1927
SO_BINDTODEVICE,
1928
str(self.interface
1929
+ '\0'))
1930
except socket.error as error:
1931
if error.errno == errno.EPERM:
1932
logger.error("No permission to"
1933
" bind to interface %s",
1934
self.interface)
1935
elif error.errno == errno.ENOPROTOOPT:
1936
logger.error("SO_BINDTODEVICE not available;"
1937
" cannot bind to interface %s",
1938
self.interface)
1939
elif error.errno == errno.ENODEV:
1940
logger.error("Interface %s does not"
1941
" exist, cannot bind",
1942
self.interface)
1943
else:
1944
raise
2478
# Fall back to a hard-coded value which seems to be
2479
# common enough.
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2482
try:
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2493
self.interface)
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
2497
else:
2498
raise
1945
2499
# Only bind(2) the socket if we really need to.
1946
2500
if self.server_address[0] or self.server_address[1]:
1947
2501
if not self.server_address[0]:
1948
2502
if self.address_family == socket.AF_INET6:
1949
any_address = "::" # in6addr_any
2503
any_address = "::" # in6addr_any
1950
2504
else:
1951
any_address = socket.INADDR_ANY
2505
any_address = "0.0.0.0" # INADDR_ANY
1952
2506
self.server_address = (any_address,
1953
2507
self.server_address[1])
1954
2508
elif not self.server_address[1]:
1955
self.server_address = (self.server_address[0],
1956
0)
2509
self.server_address = (self.server_address[0], 0)
1957
2510
# if self.interface:
1958
2511
# self.server_address = (self.server_address[0],
1959
2512
# 0, # port
1965
2518
1966
2519
class MandosServer(IPv6_TCPServer):
1967
2520
"""Mandos server.
1968
2521
1969
2522
Attributes:
1970
2523
clients: set of Client objects
1971
2524
gnutls_priority GnuTLS priority string
1972
2525
use_dbus: Boolean; to emit D-Bus signals or not
1973
1974
Assumes a gobject.MainLoop event loop.
2526
2527
Assumes a GLib.MainLoop event loop.
1975
2528
"""
2529
1976
2530
def __init__(self, server_address, RequestHandlerClass,
1977
interface=None, use_ipv6=True, clients=None,
1978
gnutls_priority=None, use_dbus=True):
2531
interface=None,
2532
use_ipv6=True,
2533
clients=None,
2534
gnutls_priority=None,
2535
use_dbus=True,
2536
socketfd=None):
1979
2537
self.enabled = False
1980
2538
self.clients = clients
1981
2539
if self.clients is None:
1984
2542
self.gnutls_priority = gnutls_priority
1985
2543
IPv6_TCPServer.__init__(self, server_address,
1986
2544
RequestHandlerClass,
1987
interface = interface,
1988
use_ipv6 = use_ipv6)
2545
interface=interface,
2546
use_ipv6=use_ipv6,
2547
socketfd=socketfd)
2548
1989
2549
def server_activate(self):
1990
2550
if self.enabled:
1991
2551
return socketserver.TCPServer.server_activate(self)
1992
2552
1993
2553
def enable(self):
1994
2554
self.enabled = True
1995
2555
1996
2556
def add_pipe(self, parent_pipe, proc):
1997
2557
# Call "handle_ipc" for both data and EOF events
1998
gobject.io_add_watch(parent_pipe.fileno(),
1999
gobject.IO_IN | gobject.IO_HUP,
2000
functools.partial(self.handle_ipc,
2001
parent_pipe =
2002
parent_pipe,
2003
proc = proc))
2004
2005
def handle_ipc(self, source, condition, parent_pipe=None,
2006
proc = None, client_object=None):
2558
GLib.io_add_watch(
2559
parent_pipe.fileno(),
2560
GLib.IO_IN | GLib.IO_HUP,
2561
functools.partial(self.handle_ipc,
2562
parent_pipe=parent_pipe,
2563
proc=proc))
2564
2565
def handle_ipc(self, source, condition,
2566
parent_pipe=None,
2567
proc=None,
2568
client_object=None):
2007
2569
# error, or the other end of multiprocessing.Pipe has closed
2008
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2570
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2009
2571
# Wait for other process to exit
2010
2572
proc.join()
2011
2573
return False
2012
2574
2013
2575
# Read a request from the child
2014
2576
request = parent_pipe.recv()
2015
2577
command = request[0]
2016
2578
2017
2579
if command == 'init':
2018
2580
fpr = request[1]
2019
2581
address = request[2]
2020
2021
for c in self.clients.itervalues():
2582
2583
for c in self.clients.values():
2022
2584
if c.fingerprint == fpr:
2023
2585
client = c
2024
2586
break
2031
2593
address[0])
2032
2594
parent_pipe.send(False)
2033
2595
return False
2034
2035
gobject.io_add_watch(parent_pipe.fileno(),
2036
gobject.IO_IN | gobject.IO_HUP,
2037
functools.partial(self.handle_ipc,
2038
parent_pipe =
2039
parent_pipe,
2040
proc = proc,
2041
client_object =
2042
client))
2596
2597
GLib.io_add_watch(
2598
parent_pipe.fileno(),
2599
GLib.IO_IN | GLib.IO_HUP,
2600
functools.partial(self.handle_ipc,
2601
parent_pipe=parent_pipe,
2602
proc=proc,
2603
client_object=client))
2043
2604
parent_pipe.send(True)
2044
2605
# remove the old hook in favor of the new above hook on
2045
2606
# same fileno
2048
2609
funcname = request[1]
2049
2610
args = request[2]
2050
2611
kwargs = request[3]
2051
2612
2052
2613
parent_pipe.send(('data', getattr(client_object,
2053
2614
funcname)(*args,
2054
**kwargs)))
2055
2615
**kwargs)))
2616
2056
2617
if command == 'getattr':
2057
2618
attrname = request[1]
2058
if callable(client_object.__getattribute__(attrname)):
2059
parent_pipe.send(('function',))
2619
if isinstance(client_object.__getattribute__(attrname),
2620
collections.Callable):
2621
parent_pipe.send(('function', ))
2060
2622
else:
2061
parent_pipe.send(('data', client_object
2062
.__getattribute__(attrname)))
2063
2623
parent_pipe.send((
2624
'data', client_object.__getattribute__(attrname)))
2625
2064
2626
if command == 'setattr':
2065
2627
attrname = request[1]
2066
2628
value = request[2]
2067
2629
setattr(client_object, attrname, value)
2068
2630
2069
2631
return True
2070
2632
2071
2633
2634
def rfc3339_duration_to_delta(duration):
2635
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2636
2637
>>> rfc3339_duration_to_delta("P7D")
2638
datetime.timedelta(7)
2639
>>> rfc3339_duration_to_delta("PT60S")
2640
datetime.timedelta(0, 60)
2641
>>> rfc3339_duration_to_delta("PT60M")
2642
datetime.timedelta(0, 3600)
2643
>>> rfc3339_duration_to_delta("PT24H")
2644
datetime.timedelta(1)
2645
>>> rfc3339_duration_to_delta("P1W")
2646
datetime.timedelta(7)
2647
>>> rfc3339_duration_to_delta("PT5M30S")
2648
datetime.timedelta(0, 330)
2649
>>> rfc3339_duration_to_delta("P1DT3M20S")
2650
datetime.timedelta(1, 200)
2651
"""
2652
2653
# Parsing an RFC 3339 duration with regular expressions is not
2654
# possible - there would have to be multiple places for the same
2655
# values, like seconds. The current code, while more esoteric, is
2656
# cleaner without depending on a parsing library. If Python had a
2657
# built-in library for parsing we would use it, but we'd like to
2658
# avoid excessive use of external libraries.
2659
2660
# New type for defining tokens, syntax, and semantics all-in-one
2661
Token = collections.namedtuple("Token", (
2662
"regexp", # To match token; if "value" is not None, must have
2663
# a "group" containing digits
2664
"value", # datetime.timedelta or None
2665
"followers")) # Tokens valid after this token
2666
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2667
# the "duration" ABNF definition in RFC 3339, Appendix A.
2668
token_end = Token(re.compile(r"$"), None, frozenset())
2669
token_second = Token(re.compile(r"(\d+)S"),
2670
datetime.timedelta(seconds=1),
2671
frozenset((token_end, )))
2672
token_minute = Token(re.compile(r"(\d+)M"),
2673
datetime.timedelta(minutes=1),
2674
frozenset((token_second, token_end)))
2675
token_hour = Token(re.compile(r"(\d+)H"),
2676
datetime.timedelta(hours=1),
2677
frozenset((token_minute, token_end)))
2678
token_time = Token(re.compile(r"T"),
2679
None,
2680
frozenset((token_hour, token_minute,
2681
token_second)))
2682
token_day = Token(re.compile(r"(\d+)D"),
2683
datetime.timedelta(days=1),
2684
frozenset((token_time, token_end)))
2685
token_month = Token(re.compile(r"(\d+)M"),
2686
datetime.timedelta(weeks=4),
2687
frozenset((token_day, token_end)))
2688
token_year = Token(re.compile(r"(\d+)Y"),
2689
datetime.timedelta(weeks=52),
2690
frozenset((token_month, token_end)))
2691
token_week = Token(re.compile(r"(\d+)W"),
2692
datetime.timedelta(weeks=1),
2693
frozenset((token_end, )))
2694
token_duration = Token(re.compile(r"P"), None,
2695
frozenset((token_year, token_month,
2696
token_day, token_time,
2697
token_week)))
2698
# Define starting values:
2699
# Value so far
2700
value = datetime.timedelta()
2701
found_token = None
2702
# Following valid tokens
2703
followers = frozenset((token_duration, ))
2704
# String left to parse
2705
s = duration
2706
# Loop until end token is found
2707
while found_token is not token_end:
2708
# Search for any currently valid tokens
2709
for token in followers:
2710
match = token.regexp.match(s)
2711
if match is not None:
2712
# Token found
2713
if token.value is not None:
2714
# Value found, parse digits
2715
factor = int(match.group(1), 10)
2716
# Add to value so far
2717
value += factor * token.value
2718
# Strip token from string
2719
s = token.regexp.sub("", s, 1)
2720
# Go to found token
2721
found_token = token
2722
# Set valid next tokens
2723
followers = found_token.followers
2724
break
2725
else:
2726
# No currently valid tokens were found
2727
raise ValueError("Invalid RFC 3339 duration: {!r}"
2728
.format(duration))
2729
# End token found
2730
return value
2731
2732
2072
2733
def string_to_delta(interval):
2073
2734
"""Parse a string and return a datetime.timedelta
2074
2735
2075
2736
>>> string_to_delta('7d')
2076
2737
datetime.timedelta(7)
2077
2738
>>> string_to_delta('60s')
2085
2746
>>> string_to_delta('5m 30s')
2086
2747
datetime.timedelta(0, 330)
2087
2748
"""
2749
2750
try:
2751
return rfc3339_duration_to_delta(interval)
2752
except ValueError:
2753
pass
2754
2088
2755
timevalue = datetime.timedelta(0)
2089
2756
for s in interval.split():
2090
2757
try:
2091
suffix = unicode(s[-1])
2758
suffix = s[-1]
2092
2759
value = int(s[:-1])
2093
2760
if suffix == "d":
2094
2761
delta = datetime.timedelta(value)
2101
2768
elif suffix == "w":
2102
2769
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2103
2770
else:
2104
raise ValueError("Unknown suffix {0!r}"
2105
.format(suffix))
2106
except (ValueError, IndexError) as e:
2771
raise ValueError("Unknown suffix {!r}".format(suffix))
2772
except IndexError as e:
2107
2773
raise ValueError(*(e.args))
2108
2774
timevalue += delta
2109
2775
return timevalue
2110
2776
2111
2777
2112
def daemon(nochdir = False, noclose = False):
2778
def daemon(nochdir=False, noclose=False):
2113
2779
"""See daemon(3). Standard BSD Unix function.
2114
2780
2115
2781
This should really exist as os.daemon, but it doesn't (yet)."""
2116
2782
if os.fork():
2117
2783
sys.exit()
2125
2791
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2126
2792
if not stat.S_ISCHR(os.fstat(null).st_mode):
2127
2793
raise OSError(errno.ENODEV,
2128
"{0} not a character device"
2794
"{} not a character device"
2129
2795
.format(os.devnull))
2130
2796
os.dup2(null, sys.stdin.fileno())
2131
2797
os.dup2(null, sys.stdout.fileno())
2135
2801
2136
2802
2137
2803
def main():
2138
2804
2139
2805
##################################################################
2140
2806
# Parsing of options, both command line and config file
2141
2807
2142
2808
parser = argparse.ArgumentParser()
2143
2809
parser.add_argument("-v", "--version", action="version",
2144
version = "%(prog)s {0}".format(version),
2810
version="%(prog)s {}".format(version),
2145
2811
help="show version number and exit")
2146
2812
parser.add_argument("-i", "--interface", metavar="IF",
2147
2813
help="Bind to interface IF")
2153
2819
help="Run self-test")
2154
2820
parser.add_argument("--debug", action="store_true",
2155
2821
help="Debug mode; run in foreground and log"
2156
" to terminal")
2822
" to terminal", default=None)
2157
2823
parser.add_argument("--debuglevel", metavar="LEVEL",
2158
2824
help="Debug level for stdout output")
2159
2825
parser.add_argument("--priority", help="GnuTLS"
2166
2832
" files")
2167
2833
parser.add_argument("--no-dbus", action="store_false",
2168
2834
dest="use_dbus", help="Do not provide D-Bus"
2169
" system bus interface")
2835
" system bus interface", default=None)
2170
2836
parser.add_argument("--no-ipv6", action="store_false",
2171
dest="use_ipv6", help="Do not use IPv6")
2837
dest="use_ipv6", help="Do not use IPv6",
2838
default=None)
2172
2839
parser.add_argument("--no-restore", action="store_false",
2173
2840
dest="restore", help="Do not restore stored"
2174
" state")
2841
" state", default=None)
2842
parser.add_argument("--socket", type=int,
2843
help="Specify a file descriptor to a network"
2844
" socket to use instead of creating one")
2175
2845
parser.add_argument("--statedir", metavar="DIR",
2176
2846
help="Directory to save/restore state in")
2177
2847
parser.add_argument("--foreground", action="store_true",
2848
help="Run in foreground", default=None)
2849
parser.add_argument("--no-zeroconf", action="store_false",
2850
dest="zeroconf", help="Do not use Zeroconf",
2851
default=None)
2852
2178
2853
options = parser.parse_args()
2179
2854
2180
2855
if options.check:
2181
2856
import doctest
2182
doctest.testmod()
2183
sys.exit()
2184
2857
fail_count, test_count = doctest.testmod()
2858
sys.exit(os.EX_OK if fail_count == 0 else 1)
2859
2185
2860
# Default values for config file for server-global settings
2186
server_defaults = { "interface": "",
2187
"address": "",
2188
"port": "",
2189
"debug": "False",
2190
"priority":
2191
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2192
"servicename": "Mandos",
2193
"use_dbus": "True",
2194
"use_ipv6": "True",
2195
"debuglevel": "",
2196
"restore": "True",
2197
"statedir": "/var/lib/mandos"
2198
}
2199
2861
server_defaults = {"interface": "",
2862
"address": "",
2863
"port": "",
2864
"debug": "False",
2865
"priority":
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2868
"servicename": "Mandos",
2869
"use_dbus": "True",
2870
"use_ipv6": "True",
2871
"debuglevel": "",
2872
"restore": "True",
2873
"socket": "",
2874
"statedir": "/var/lib/mandos",
2875
"foreground": "False",
2876
"zeroconf": "True",
2877
}
2878
2200
2879
# Parse config file for server-global settings
2201
2880
server_config = configparser.SafeConfigParser(server_defaults)
2202
2881
del server_defaults
2203
server_config.read(os.path.join(options.configdir,
2204
"mandos.conf"))
2882
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2205
2883
# Convert the SafeConfigParser object to a dict
2206
2884
server_settings = server_config.defaults()
2207
2885
# Use the appropriate methods on the non-string config options
2208
for option in ("debug", "use_dbus", "use_ipv6"):
2886
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2209
2887
server_settings[option] = server_config.getboolean("DEFAULT",
2210
2888
option)
2211
2889
if server_settings["port"]:
2212
2890
server_settings["port"] = server_config.getint("DEFAULT",
2213
2891
"port")
2892
if server_settings["socket"]:
2893
server_settings["socket"] = server_config.getint("DEFAULT",
2894
"socket")
2895
# Later, stdin will, and stdout and stderr might, be dup'ed
2896
# over with an opened os.devnull. But we don't want this to
2897
# happen with a supplied network socket.
2898
if 0 <= server_settings["socket"] <= 2:
2899
server_settings["socket"] = os.dup(server_settings
2900
["socket"])
2214
2901
del server_config
2215
2902
2216
2903
# Override the settings from the config file with command line
2217
2904
# options, if set.
2218
2905
for option in ("interface", "address", "port", "debug",
2219
"priority", "servicename", "configdir",
2220
"use_dbus", "use_ipv6", "debuglevel", "restore",
2221
"statedir"):
2906
"priority", "servicename", "configdir", "use_dbus",
2907
"use_ipv6", "debuglevel", "restore", "statedir",
2908
"socket", "foreground", "zeroconf"):
2222
2909
value = getattr(options, option)
2223
2910
if value is not None:
2224
2911
server_settings[option] = value
2225
2912
del options
2226
2913
# Force all strings to be unicode
2227
2914
for option in server_settings.keys():
2228
if type(server_settings[option]) is str:
2229
server_settings[option] = unicode(server_settings[option])
2915
if isinstance(server_settings[option], bytes):
2916
server_settings[option] = (server_settings[option]
2917
.decode("utf-8"))
2918
# Force all boolean options to be boolean
2919
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2920
"foreground", "zeroconf"):
2921
server_settings[option] = bool(server_settings[option])
2922
# Debug implies foreground
2923
if server_settings["debug"]:
2924
server_settings["foreground"] = True
2230
2925
# Now we have our good server settings in "server_settings"
2231
2926
2232
2927
##################################################################
2233
2928
2929
if (not server_settings["zeroconf"]
2930
and not (server_settings["port"]
2931
or server_settings["socket"] != "")):
2932
parser.error("Needs port or socket to work without Zeroconf")
2933
2234
2934
# For convenience
2235
2935
debug = server_settings["debug"]
2236
2936
debuglevel = server_settings["debuglevel"]
2238
2938
use_ipv6 = server_settings["use_ipv6"]
2239
2939
stored_state_path = os.path.join(server_settings["statedir"],
2240
2940
stored_state_file)
2241
2941
foreground = server_settings["foreground"]
2942
zeroconf = server_settings["zeroconf"]
2943
2242
2944
if debug:
2243
2945
initlogger(debug, logging.DEBUG)
2244
2946
else:
2247
2949
else:
2248
2950
level = getattr(logging, debuglevel.upper())
2249
2951
initlogger(debug, level)
2250
2952
2251
2953
if server_settings["servicename"] != "Mandos":
2252
syslogger.setFormatter(logging.Formatter
2253
('Mandos ({0}) [%(process)d]:'
2254
' %(levelname)s: %(message)s'
2255
.format(server_settings
2256
["servicename"])))
2257
2954
syslogger.setFormatter(
2955
logging.Formatter('Mandos ({}) [%(process)d]:'
2956
' %(levelname)s: %(message)s'.format(
2957
server_settings["servicename"])))
2958
2258
2959
# Parse config file with clients
2259
2960
client_config = configparser.SafeConfigParser(Client
2260
2961
.client_defaults)
2261
2962
client_config.read(os.path.join(server_settings["configdir"],
2262
2963
"clients.conf"))
2263
2964
2264
2965
global mandos_dbus_service
2265
2966
mandos_dbus_service = None
2266
2267
tcp_server = MandosServer((server_settings["address"],
2268
server_settings["port"]),
2269
ClientHandler,
2270
interface=(server_settings["interface"]
2271
or None),
2272
use_ipv6=use_ipv6,
2273
gnutls_priority=
2274
server_settings["priority"],
2275
use_dbus=use_dbus)
2276
if not debug:
2277
pidfilename = "/var/run/mandos.pid"
2967
2968
socketfd = None
2969
if server_settings["socket"] != "":
2970
socketfd = server_settings["socket"]
2971
tcp_server = MandosServer(
2972
(server_settings["address"], server_settings["port"]),
2973
ClientHandler,
2974
interface=(server_settings["interface"] or None),
2975
use_ipv6=use_ipv6,
2976
gnutls_priority=server_settings["priority"],
2977
use_dbus=use_dbus,
2978
socketfd=socketfd)
2979
if not foreground:
2980
pidfilename = "/run/mandos.pid"
2981
if not os.path.isdir("/run/."):
2982
pidfilename = "/var/run/mandos.pid"
2983
pidfile = None
2278
2984
try:
2279
pidfile = open(pidfilename, "w")
2985
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2280
2986
except IOError as e:
2281
2987
logger.error("Could not open file %r", pidfilename,
2282
2988
exc_info=e)
2283
2284
for name in ("_mandos", "mandos", "nobody"):
2989
2990
for name, group in (("_mandos", "_mandos"),
2991
("mandos", "mandos"),
2992
("nobody", "nogroup")):
2285
2993
try:
2286
2994
uid = pwd.getpwnam(name).pw_uid
2287
gid = pwd.getpwnam(name).pw_gid
2995
gid = pwd.getpwnam(group).pw_gid
2288
2996
break
2289
2997
except KeyError:
2290
2998
continue
2294
3002
try:
2295
3003
os.setgid(gid)
2296
3004
os.setuid(uid)
3005
if debug:
3006
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3007
gid))
2297
3008
except OSError as error:
2298
if error[0] != errno.EPERM:
2299
raise error
2300
3009
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3010
.format(uid, gid, os.strerror(error.errno)))
3011
if error.errno != errno.EPERM:
3012
raise
3013
2301
3014
if debug:
2302
3015
# Enable all possible GnuTLS debugging
2303
3016
2304
3017
# "Use a log level over 10 to enable all debugging options."
2305
3018
# - GnuTLS manual
2306
gnutls.library.functions.gnutls_global_set_log_level(11)
2307
2308
@gnutls.library.types.gnutls_log_func
3019
gnutls.global_set_log_level(11)
3020
3021
@gnutls.log_func
2309
3022
def debug_gnutls(level, string):
2310
3023
logger.debug("GnuTLS: %s", string[:-1])
2311
2312
(gnutls.library.functions
2313
.gnutls_global_set_log_function(debug_gnutls))
2314
3024
3025
gnutls.global_set_log_function(debug_gnutls)
3026
2315
3027
# Redirect stdin so all checkers get /dev/null
2316
3028
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2317
3029
os.dup2(null, sys.stdin.fileno())
2318
3030
if null > 2:
2319
3031
os.close(null)
2320
3032
2321
3033
# Need to fork before connecting to D-Bus
2322
if not debug:
3034
if not foreground:
2323
3035
# Close all input and output, do double fork, etc.
2324
3036
daemon()
2325
2326
gobject.threads_init()
2327
3037
3038
# multiprocessing will use threads, so before we use GLib we need
3039
# to inform GLib that threads will be used.
3040
GLib.threads_init()
3041
2328
3042
global main_loop
2329
3043
# From the Avahi example code
2330
3044
DBusGMainLoop(set_as_default=True)
2331
main_loop = gobject.MainLoop()
3045
main_loop = GLib.MainLoop()
2332
3046
bus = dbus.SystemBus()
2333
3047
# End of Avahi example code
2334
3048
if use_dbus:
2335
3049
try:
2336
3050
bus_name = dbus.service.BusName("se.recompile.Mandos",
2337
bus, do_not_queue=True)
2338
old_bus_name = (dbus.service.BusName
2339
("se.bsnet.fukt.Mandos", bus,
2340
do_not_queue=True))
2341
except dbus.exceptions.NameExistsException as e:
3051
bus,
3052
do_not_queue=True)
3053
old_bus_name = dbus.service.BusName(
3054
"se.bsnet.fukt.Mandos", bus,
3055
do_not_queue=True)
3056
except dbus.exceptions.DBusException as e:
2342
3057
logger.error("Disabling D-Bus:", exc_info=e)
2343
3058
use_dbus = False
2344
3059
server_settings["use_dbus"] = False
2345
3060
tcp_server.use_dbus = False
2346
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2347
service = AvahiServiceToSyslog(name =
2348
server_settings["servicename"],
2349
servicetype = "_mandos._tcp",
2350
protocol = protocol, bus = bus)
2351
if server_settings["interface"]:
2352
service.interface = (if_nametoindex
2353
(str(server_settings["interface"])))
2354
3061
if zeroconf:
3062
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3063
service = AvahiServiceToSyslog(
3064
name=server_settings["servicename"],
3065
servicetype="_mandos._tcp",
3066
protocol=protocol,
3067
bus=bus)
3068
if server_settings["interface"]:
3069
service.interface = if_nametoindex(
3070
server_settings["interface"].encode("utf-8"))
3071
2355
3072
global multiprocessing_manager
2356
3073
multiprocessing_manager = multiprocessing.Manager()
2357
3074
2358
3075
client_class = Client
2359
3076
if use_dbus:
2360
client_class = functools.partial(ClientDBus, bus = bus)
2361
3077
client_class = functools.partial(ClientDBus, bus=bus)
3078
2362
3079
client_settings = Client.config_parser(client_config)
2363
3080
old_client_settings = {}
2364
3081
clients_data = {}
2365
3082
3083
# This is used to redirect stdout and stderr for checker processes
3084
global wnull
3085
wnull = open(os.devnull, "w") # A writable /dev/null
3086
# Only used if server is running in foreground but not in debug
3087
# mode
3088
if debug or not foreground:
3089
wnull.close()
3090
2366
3091
# Get client data and settings from last running state.
2367
3092
if server_settings["restore"]:
2368
3093
try:
2369
3094
with open(stored_state_path, "rb") as stored_state:
2370
clients_data, old_client_settings = (pickle.load
2371
(stored_state))
3095
if sys.version_info.major == 2:
3096
clients_data, old_client_settings = pickle.load(
3097
stored_state)
3098
else:
3099
bytes_clients_data, bytes_old_client_settings = (
3100
pickle.load(stored_state, encoding="bytes"))
3101
# Fix bytes to strings
3102
# clients_data
3103
# .keys()
3104
clients_data = {(key.decode("utf-8")
3105
if isinstance(key, bytes)
3106
else key): value
3107
for key, value in
3108
bytes_clients_data.items()}
3109
del bytes_clients_data
3110
for key in clients_data:
3111
value = {(k.decode("utf-8")
3112
if isinstance(k, bytes) else k): v
3113
for k, v in
3114
clients_data[key].items()}
3115
clients_data[key] = value
3116
# .client_structure
3117
value["client_structure"] = [
3118
(s.decode("utf-8")
3119
if isinstance(s, bytes)
3120
else s) for s in
3121
value["client_structure"]]
3122
# .name & .host
3123
for k in ("name", "host"):
3124
if isinstance(value[k], bytes):
3125
value[k] = value[k].decode("utf-8")
3126
# old_client_settings
3127
# .keys()
3128
old_client_settings = {
3129
(key.decode("utf-8")
3130
if isinstance(key, bytes)
3131
else key): value
3132
for key, value in
3133
bytes_old_client_settings.items()}
3134
del bytes_old_client_settings
3135
# .host
3136
for value in old_client_settings.values():
3137
if isinstance(value["host"], bytes):
3138
value["host"] = (value["host"]
3139
.decode("utf-8"))
2372
3140
os.remove(stored_state_path)
2373
3141
except IOError as e:
2374
3142
if e.errno == errno.ENOENT:
2375
logger.warning("Could not load persistent state: {0}"
2376
.format(os.strerror(e.errno)))
3143
logger.warning("Could not load persistent state:"
3144
" {}".format(os.strerror(e.errno)))
2377
3145
else:
2378
3146
logger.critical("Could not load persistent state:",
2379
3147
exc_info=e)
2380
3148
raise
2381
3149
except EOFError as e:
2382
3150
logger.warning("Could not load persistent state: "
2383
"EOFError:", exc_info=e)
2384
3151
"EOFError:",
3152
exc_info=e)
3153
2385
3154
with PGPEngine() as pgp:
2386
for client_name, client in clients_data.iteritems():
3155
for client_name, client in clients_data.items():
3156
# Skip removed clients
3157
if client_name not in client_settings:
3158
continue
3159
2387
3160
# Decide which value to use after restoring saved state.
2388
3161
# We have three different values: Old config file,
2389
3162
# new config file, and saved state.
2394
3167
# For each value in new config, check if it
2395
3168
# differs from the old config value (Except for
2396
3169
# the "secret" attribute)
2397
if (name != "secret" and
2398
value != old_client_settings[client_name]
2399
[name]):
3170
if (name != "secret"
3171
and (value !=
3172
old_client_settings[client_name][name])):
2400
3173
client[name] = value
2401
3174
except KeyError:
2402
3175
pass
2403
3176
2404
3177
# Clients who has passed its expire date can still be
2405
# enabled if its last checker was successful. Clients
3178
# enabled if its last checker was successful. A Client
2406
3179
# whose checker succeeded before we stored its state is
2407
3180
# assumed to have successfully run all checkers during
2408
3181
# downtime.
2410
3183
if datetime.datetime.utcnow() >= client["expires"]:
2411
3184
if not client["last_checked_ok"]:
2412
3185
logger.warning(
2413
"disabling client {0} - Client never "
2414
"performed a successful checker"
2415
.format(client_name))
3186
"disabling client {} - Client never "
3187
"performed a successful checker".format(
3188
client_name))
2416
3189
client["enabled"] = False
2417
3190
elif client["last_checker_status"] != 0:
2418
3191
logger.warning(
2419
"disabling client {0} - Client "
2420
"last checker failed with error code {1}"
2421
.format(client_name,
2422
client["last_checker_status"]))
3192
"disabling client {} - Client last"
3193
" checker failed with error code"
3194
" {}".format(
3195
client_name,
3196
client["last_checker_status"]))
2423
3197
client["enabled"] = False
2424
3198
else:
2425
client["expires"] = (datetime.datetime
2426
.utcnow()
2427
+ client["timeout"])
3199
client["expires"] = (
3200
datetime.datetime.utcnow()
3201
+ client["timeout"])
2428
3202
logger.debug("Last checker succeeded,"
2429
" keeping {0} enabled"
2430
.format(client_name))
3203
" keeping {} enabled".format(
3204
client_name))
2431
3205
try:
2432
client["secret"] = (
2433
pgp.decrypt(client["encrypted_secret"],
2434
client_settings[client_name]
2435
["secret"]))
3206
client["secret"] = pgp.decrypt(
3207
client["encrypted_secret"],
3208
client_settings[client_name]["secret"])
2436
3209
except PGPError:
2437
3210
# If decryption fails, we use secret from new settings
2438
logger.debug("Failed to decrypt {0} old secret"
2439
.format(client_name))
2440
client["secret"] = (
2441
client_settings[client_name]["secret"])
2442
3211
logger.debug("Failed to decrypt {} old secret".format(
3212
client_name))
3213
client["secret"] = (client_settings[client_name]
3214
["secret"])
3215
2443
3216
# Add/remove clients based on new changes made to config
2444
3217
for client_name in (set(old_client_settings)
2445
3218
- set(client_settings)):
2447
3220
for client_name in (set(client_settings)
2448
3221
- set(old_client_settings)):
2449
3222
clients_data[client_name] = client_settings[client_name]
2450
3223
2451
3224
# Create all client objects
2452
for client_name, client in clients_data.iteritems():
3225
for client_name, client in clients_data.items():
2453
3226
tcp_server.clients[client_name] = client_class(
2454
name = client_name, settings = client)
2455
3227
name=client_name,
3228
settings=client,
3229
server_settings=server_settings)
3230
2456
3231
if not tcp_server.clients:
2457
3232
logger.warning("No clients defined")
2458
2459
if not debug:
2460
try:
2461
with pidfile:
2462
pid = os.getpid()
2463
pidfile.write(str(pid) + "\n".encode("utf-8"))
2464
del pidfile
2465
except IOError:
2466
logger.error("Could not write to file %r with PID %d",
2467
pidfilename, pid)
2468
except NameError:
2469
# "pidfile" was never created
2470
pass
3233
3234
if not foreground:
3235
if pidfile is not None:
3236
pid = os.getpid()
3237
try:
3238
with pidfile:
3239
print(pid, file=pidfile)
3240
except IOError:
3241
logger.error("Could not write to file %r with PID %d",
3242
pidfilename, pid)
3243
del pidfile
2471
3244
del pidfilename
2472
signal.signal(signal.SIGINT, signal.SIG_IGN)
2473
2474
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2475
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2476
3245
3246
for termsig in (signal.SIGHUP, signal.SIGTERM):
3247
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3248
lambda: main_loop.quit() and False)
3249
2477
3250
if use_dbus:
2478
@alternate_dbus_interfaces({"se.recompile.Mandos":
2479
"se.bsnet.fukt.Mandos"})
2480
class MandosDBusService(DBusObjectWithProperties):
3251
3252
@alternate_dbus_interfaces(
3253
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3254
class MandosDBusService(DBusObjectWithObjectManager):
2481
3255
"""A D-Bus proxy object"""
3256
2482
3257
def __init__(self):
2483
3258
dbus.service.Object.__init__(self, bus, "/")
3259
2484
3260
_interface = "se.recompile.Mandos"
2485
2486
@dbus_interface_annotations(_interface)
2487
def _foo(self):
2488
return { "org.freedesktop.DBus.Property"
2489
".EmitsChangedSignal":
2490
"false"}
2491
3261
2492
3262
@dbus.service.signal(_interface, signature="o")
2493
3263
def ClientAdded(self, objpath):
2494
3264
"D-Bus signal"
2495
3265
pass
2496
3266
2497
3267
@dbus.service.signal(_interface, signature="ss")
2498
3268
def ClientNotFound(self, fingerprint, address):
2499
3269
"D-Bus signal"
2500
3270
pass
2501
3271
3272
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3273
"true"})
2502
3274
@dbus.service.signal(_interface, signature="os")
2503
3275
def ClientRemoved(self, objpath, name):
2504
3276
"D-Bus signal"
2505
3277
pass
2506
3278
3279
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3280
"true"})
2507
3281
@dbus.service.method(_interface, out_signature="ao")
2508
3282
def GetAllClients(self):
2509
3283
"D-Bus method"
2510
return dbus.Array(c.dbus_object_path
2511
for c in
2512
tcp_server.clients.itervalues())
2513
3284
return dbus.Array(c.dbus_object_path for c in
3285
tcp_server.clients.values())
3286
3287
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3288
"true"})
2514
3289
@dbus.service.method(_interface,
2515
3290
out_signature="a{oa{sv}}")
2516
3291
def GetAllClientsWithProperties(self):
2517
3292
"D-Bus method"
2518
3293
return dbus.Dictionary(
2519
((c.dbus_object_path, c.GetAll(""))
2520
for c in tcp_server.clients.itervalues()),
3294
{c.dbus_object_path: c.GetAll(
3295
"se.recompile.Mandos.Client")
3296
for c in tcp_server.clients.values()},
2521
3297
signature="oa{sv}")
2522
3298
2523
3299
@dbus.service.method(_interface, in_signature="o")
2524
3300
def RemoveClient(self, object_path):
2525
3301
"D-Bus method"
2526
for c in tcp_server.clients.itervalues():
3302
for c in tcp_server.clients.values():
2527
3303
if c.dbus_object_path == object_path:
2528
3304
del tcp_server.clients[c.name]
2529
3305
c.remove_from_connection()
2530
# Don't signal anything except ClientRemoved
3306
# Don't signal the disabling
2531
3307
c.disable(quiet=True)
2532
# Emit D-Bus signal
2533
self.ClientRemoved(object_path, c.name)
3308
# Emit D-Bus signal for removal
3309
self.client_removed_signal(c)
2534
3310
return
2535
3311
raise KeyError(object_path)
2536
3312
2537
3313
del _interface
2538
3314
3315
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3316
out_signature="a{oa{sa{sv}}}")
3317
def GetManagedObjects(self):
3318
"""D-Bus method"""
3319
return dbus.Dictionary(
3320
{client.dbus_object_path:
3321
dbus.Dictionary(
3322
{interface: client.GetAll(interface)
3323
for interface in
3324
client._get_all_interface_names()})
3325
for client in tcp_server.clients.values()})
3326
3327
def client_added_signal(self, client):
3328
"""Send the new standard signal and the old signal"""
3329
if use_dbus:
3330
# New standard signal
3331
self.InterfacesAdded(
3332
client.dbus_object_path,
3333
dbus.Dictionary(
3334
{interface: client.GetAll(interface)
3335
for interface in
3336
client._get_all_interface_names()}))
3337
# Old signal
3338
self.ClientAdded(client.dbus_object_path)
3339
3340
def client_removed_signal(self, client):
3341
"""Send the new standard signal and the old signal"""
3342
if use_dbus:
3343
# New standard signal
3344
self.InterfacesRemoved(
3345
client.dbus_object_path,
3346
client._get_all_interface_names())
3347
# Old signal
3348
self.ClientRemoved(client.dbus_object_path,
3349
client.name)
3350
2539
3351
mandos_dbus_service = MandosDBusService()
2540
3352
3353
# Save modules to variables to exempt the modules from being
3354
# unloaded before the function registered with atexit() is run.
3355
mp = multiprocessing
3356
wn = wnull
3357
2541
3358
def cleanup():
2542
3359
"Cleanup function; run on exit"
2543
service.cleanup()
2544
2545
multiprocessing.active_children()
3360
if zeroconf:
3361
service.cleanup()
3362
3363
mp.active_children()
3364
wn.close()
2546
3365
if not (tcp_server.clients or client_settings):
2547
3366
return
2548
3367
2549
3368
# Store client before exiting. Secrets are encrypted with key
2550
3369
# based on what config file has. If config file is
2551
3370
# removed/edited, old secret will thus be unrecovable.
2552
3371
clients = {}
2553
3372
with PGPEngine() as pgp:
2554
for client in tcp_server.clients.itervalues():
3373
for client in tcp_server.clients.values():
2555
3374
key = client_settings[client.name]["secret"]
2556
3375
client.encrypted_secret = pgp.encrypt(client.secret,
2557
3376
key)
2558
3377
client_dict = {}
2559
3378
2560
3379
# A list of attributes that can not be pickled
2561
3380
# + secret.
2562
exclude = set(("bus", "changedstate", "secret",
2563
"checker"))
2564
for name, typ in (inspect.getmembers
2565
(dbus.service.Object)):
3381
exclude = {"bus", "changedstate", "secret",
3382
"checker", "server_settings"}
3383
for name, typ in inspect.getmembers(dbus.service
3384
.Object):
2566
3385
exclude.add(name)
2567
3386
2568
3387
client_dict["encrypted_secret"] = (client
2569
3388
.encrypted_secret)
2570
3389
for attr in client.client_structure:
2571
3390
if attr not in exclude:
2572
3391
client_dict[attr] = getattr(client, attr)
2573
3392
2574
3393
clients[client.name] = client_dict
2575
3394
del client_settings[client.name]["secret"]
2576
3395
2577
3396
try:
2578
with (tempfile.NamedTemporaryFile
2579
(mode='wb', suffix=".pickle", prefix='clients-',
2580
dir=os.path.dirname(stored_state_path),
2581
delete=False)) as stored_state:
2582
pickle.dump((clients, client_settings), stored_state)
2583
tempname=stored_state.name
3397
with tempfile.NamedTemporaryFile(
3398
mode='wb',
3399
suffix=".pickle",
3400
prefix='clients-',
3401
dir=os.path.dirname(stored_state_path),
3402
delete=False) as stored_state:
3403
pickle.dump((clients, client_settings), stored_state,
3404
protocol=2)
3405
tempname = stored_state.name
2584
3406
os.rename(tempname, stored_state_path)
2585
3407
except (IOError, OSError) as e:
2586
3408
if not debug:
2589
3411
except NameError:
2590
3412
pass
2591
3413
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2592
logger.warning("Could not save persistent state: {0}"
3414
logger.warning("Could not save persistent state: {}"
2593
3415
.format(os.strerror(e.errno)))
2594
3416
else:
2595
3417
logger.warning("Could not save persistent state:",
2596
3418
exc_info=e)
2597
raise e
2598
3419
raise
3420
2599
3421
# Delete all clients, and settings from config
2600
3422
while tcp_server.clients:
2601
3423
name, client = tcp_server.clients.popitem()
2602
3424
if use_dbus:
2603
3425
client.remove_from_connection()
2604
# Don't signal anything except ClientRemoved
3426
# Don't signal the disabling
2605
3427
client.disable(quiet=True)
3428
# Emit D-Bus signal for removal
2606
3429
if use_dbus:
2607
# Emit D-Bus signal
2608
mandos_dbus_service.ClientRemoved(client
2609
.dbus_object_path,
2610
client.name)
3430
mandos_dbus_service.client_removed_signal(client)
2611
3431
client_settings.clear()
2612
3432
2613
3433
atexit.register(cleanup)
2614
2615
for client in tcp_server.clients.itervalues():
3434
3435
for client in tcp_server.clients.values():
2616
3436
if use_dbus:
2617
# Emit D-Bus signal
2618
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3437
# Emit D-Bus signal for adding
3438
mandos_dbus_service.client_added_signal(client)
2619
3439
# Need to initiate checking of clients
2620
3440
if client.enabled:
2621
3441
client.init_checker()
2622
3442
2623
3443
tcp_server.enable()
2624
3444
tcp_server.server_activate()
2625
3445
2626
3446
# Find out what port we got
2627
service.port = tcp_server.socket.getsockname()[1]
3447
if zeroconf:
3448
service.port = tcp_server.socket.getsockname()[1]
2628
3449
if use_ipv6:
2629
3450
logger.info("Now listening on address %r, port %d,"
2630
3451
" flowinfo %d, scope_id %d",
2632
3453
else: # IPv4
2633
3454
logger.info("Now listening on address %r, port %d",
2634
3455
*tcp_server.socket.getsockname())
2635
2636
#service.interface = tcp_server.socket.getsockname()[3]
2637
3456
3457
# service.interface = tcp_server.socket.getsockname()[3]
3458
2638
3459
try:
2639
# From the Avahi example code
2640
try:
2641
service.activate()
2642
except dbus.exceptions.DBusException as error:
2643
logger.critical("D-Bus Exception", exc_info=error)
2644
cleanup()
2645
sys.exit(1)
2646
# End of Avahi example code
2647
2648
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2649
lambda *args, **kwargs:
2650
(tcp_server.handle_request
2651
(*args[2:], **kwargs) or True))
2652
3460
if zeroconf:
3461
# From the Avahi example code
3462
try:
3463
service.activate()
3464
except dbus.exceptions.DBusException as error:
3465
logger.critical("D-Bus Exception", exc_info=error)
3466
cleanup()
3467
sys.exit(1)
3468
# End of Avahi example code
3469
3470
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3471
lambda *args, **kwargs:
3472
(tcp_server.handle_request
3473
(*args[2:], **kwargs) or True))
3474
2653
3475
logger.debug("Starting main loop")
2654
3476
main_loop.run()
2655
3477
except AvahiError as error:
2664
3486
# Must run before the D-Bus bus name gets deregistered
2665
3487
cleanup()
2666
3488
3489
2667
3490
if __name__ == '__main__':
2668
3491
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0