To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 609
- compare with another revision
- download diff
- download tarball
- view history from revision 609
- Committer: Teddy Hogeborn
- Date: 2012-06-23 00:58:49 UTC
- Revision ID: teddy@recompile.se-20120623005849-02wj82cng433rt2k
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
* mandos: All client options for time intervals now take an RFC 3339
duration.
(rfc3339_duration_to_delta): New function.
(string_to_delta): Try rfc3339_duration_to_delta first.
* mandos-clients.conf.xml (OPTIONS/timeout): Document new format.
(EXAMPLE): Update to new interval format.
(SEE ALSO): Reference RFC 3339.
* mandos: All client options for time intervals now take an RFC 3339
duration.
(rfc3339_duration_to_delta): New function.
(string_to_delta): Try rfc3339_duration_to_delta first.
* mandos-clients.conf.xml (OPTIONS/timeout): Document new format.
(EXAMPLE): Update to new interval format.
(SEE ALSO): Reference RFC 3339.
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
46
43
import errno
47
try:
48
import ConfigParser as configparser
49
except ImportError:
50
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
51
51
import sys
52
52
import re
53
53
import os
62
62
import struct
63
63
import fcntl
64
64
import functools
65
try:
66
import cPickle as pickle
67
except ImportError:
68
import pickle
65
import cPickle as pickle
69
66
import multiprocessing
70
67
import types
71
68
import binascii
72
69
import tempfile
73
70
import itertools
74
71
import collections
75
import codecs
76
72
77
73
import dbus
78
74
import dbus.service
79
try:
80
from gi.repository import GObject
81
except ImportError:
82
import gobject as GObject
75
import gobject
83
76
import avahi
84
77
from dbus.mainloop.glib import DBusGMainLoop
85
78
import ctypes
86
79
import ctypes.util
87
80
import xml.dom.minidom
88
81
import inspect
82
import GnuPGInterface
89
83
90
84
try:
91
85
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
89
except ImportError:
96
90
SO_BINDTODEVICE = None
97
91
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.3"
92
version = "1.6.0"
102
93
stored_state_file = "clients.pickle"
103
94
104
95
logger = logging.getLogger()
105
syslogger = None
96
syslogger = (logging.handlers.SysLogHandler
97
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
98
address = str("/dev/log")))
106
99
107
100
try:
108
if_nametoindex = ctypes.cdll.LoadLibrary(
109
ctypes.util.find_library("c")).if_nametoindex
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
110
104
except (OSError, AttributeError):
111
112
105
def if_nametoindex(interface):
113
106
"Get an interface index the hard way, i.e. using fcntl()"
114
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
115
108
with contextlib.closing(socket.socket()) as s:
116
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
117
struct.pack(b"16s16x", interface))
118
interface_index = struct.unpack("I", ifreq[16:20])[0]
110
struct.pack(str("16s16x"),
111
interface))
112
interface_index = struct.unpack(str("I"),
113
ifreq[16:20])[0]
119
114
return interface_index
120
115
121
116
122
117
def initlogger(debug, level=logging.WARNING):
123
118
"""init logger and add loglevel"""
124
119
125
global syslogger
126
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
129
120
syslogger.setFormatter(logging.Formatter
130
121
('Mandos [%(process)d]: %(levelname)s:'
131
122
' %(message)s'))
148
139
149
140
class PGPEngine(object):
150
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
152
142
def __init__(self):
143
self.gnupg = GnuPGInterface.GnuPG()
153
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
self.gpg = "gpg"
155
try:
156
output = subprocess.check_output(["gpgconf"])
157
for line in output.splitlines():
158
name, text, path = line.split(":")
159
if name == "gpg":
160
self.gpg = path
161
break
162
except OSError as e:
163
if e.errno != errno.ENOENT:
164
raise
165
self.gnupgargs = ['--batch',
166
'--homedir', self.tempdir,
167
'--force-mdc',
168
'--quiet',
169
'--no-use-agent']
145
self.gnupg = GnuPGInterface.GnuPG()
146
self.gnupg.options.meta_interactive = False
147
self.gnupg.options.homedir = self.tempdir
148
self.gnupg.options.extra_args.extend(['--force-mdc',
149
'--quiet',
150
'--no-use-agent'])
170
151
171
152
def __enter__(self):
172
153
return self
194
175
def password_encode(self, password):
195
176
# Passphrase can not be empty and can not contain newlines or
196
177
# NUL bytes. So we prefix it and hex encode it.
197
encoded = b"mandos" + binascii.hexlify(password)
198
if len(encoded) > 2048:
199
# GnuPG can't handle long passwords, so encode differently
200
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
201
.replace(b"\n", b"\\n")
202
.replace(b"\0", b"\\x00"))
203
return encoded
178
return b"mandos" + binascii.hexlify(password)
204
179
205
180
def encrypt(self, data, password):
206
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(
208
dir=self.tempdir) as passfile:
209
passfile.write(passphrase)
210
passfile.flush()
211
proc = subprocess.Popen([self.gpg, '--symmetric',
212
'--passphrase-file',
213
passfile.name]
214
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
219
if proc.returncode != 0:
220
raise PGPError(err)
181
self.gnupg.passphrase = self.password_encode(password)
182
with open(os.devnull, "w") as devnull:
183
try:
184
proc = self.gnupg.run(['--symmetric'],
185
create_fhs=['stdin', 'stdout'],
186
attach_fhs={'stderr': devnull})
187
with contextlib.closing(proc.handles['stdin']) as f:
188
f.write(data)
189
with contextlib.closing(proc.handles['stdout']) as f:
190
ciphertext = f.read()
191
proc.wait()
192
except IOError as e:
193
raise PGPError(e)
194
self.gnupg.passphrase = None
221
195
return ciphertext
222
196
223
197
def decrypt(self, data, password):
224
passphrase = self.password_encode(password)
225
with tempfile.NamedTemporaryFile(
226
dir = self.tempdir) as passfile:
227
passfile.write(passphrase)
228
passfile.flush()
229
proc = subprocess.Popen([self.gpg, '--decrypt',
230
'--passphrase-file',
231
passfile.name]
232
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
237
if proc.returncode != 0:
238
raise PGPError(err)
198
self.gnupg.passphrase = self.password_encode(password)
199
with open(os.devnull, "w") as devnull:
200
try:
201
proc = self.gnupg.run(['--decrypt'],
202
create_fhs=['stdin', 'stdout'],
203
attach_fhs={'stderr': devnull})
204
with contextlib.closing(proc.handles['stdin']) as f:
205
f.write(data)
206
with contextlib.closing(proc.handles['stdout']) as f:
207
decrypted_plaintext = f.read()
208
proc.wait()
209
except IOError as e:
210
raise PGPError(e)
211
self.gnupg.passphrase = None
239
212
return decrypted_plaintext
240
213
241
214
242
215
class AvahiError(Exception):
243
216
def __init__(self, value, *args, **kwargs):
244
217
self.value = value
245
return super(AvahiError, self).__init__(value, *args,
246
**kwargs)
247
218
super(AvahiError, self).__init__(value, *args, **kwargs)
219
def __unicode__(self):
220
return unicode(repr(self.value))
248
221
249
222
class AvahiServiceError(AvahiError):
250
223
pass
251
224
252
253
225
class AvahiGroupError(AvahiError):
254
226
pass
255
227
262
234
Used to optionally bind to the specified interface.
263
235
name: string; Example: 'Mandos'
264
236
type: string; Example: '_mandos._tcp'.
265
See <https://www.iana.org/assignments/service-names-port-numbers>
237
See <http://www.dns-sd.org/ServiceTypes.html>
266
238
port: integer; what port to announce
267
239
TXT: list of strings; TXT record for the service
268
240
domain: string; Domain to publish on, default to .local if empty.
275
247
bus: dbus.SystemBus()
276
248
"""
277
249
278
def __init__(self,
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
250
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
servicetype = None, port = None, TXT = None,
252
domain = "", host = "", max_renames = 32768,
253
protocol = avahi.PROTO_UNSPEC, bus = None):
289
254
self.interface = interface
290
255
self.name = name
291
256
self.type = servicetype
301
266
self.bus = bus
302
267
self.entry_group_state_changed_match = None
303
268
304
def rename(self, remove=True):
269
def rename(self):
305
270
"""Derived from the Avahi example code"""
306
271
if self.rename_count >= self.max_renames:
307
272
logger.critical("No suitable Zeroconf service name found"
308
273
" after %i retries, exiting.",
309
274
self.rename_count)
310
275
raise AvahiServiceError("Too many renames")
311
self.name = str(
312
self.server.GetAlternativeServiceName(self.name))
313
self.rename_count += 1
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
314
278
logger.info("Changing Zeroconf service name to %r ...",
315
279
self.name)
316
if remove:
317
self.remove()
280
self.remove()
318
281
try:
319
282
self.add()
320
283
except dbus.exceptions.DBusException as error:
321
if (error.get_dbus_name()
322
== "org.freedesktop.Avahi.CollisionError"):
323
logger.info("Local Zeroconf service name collision.")
324
return self.rename(remove=False)
325
else:
326
logger.critical("D-Bus Exception", exc_info=error)
327
self.cleanup()
328
os._exit(1)
284
logger.critical("D-Bus Exception", exc_info=error)
285
self.cleanup()
286
os._exit(1)
287
self.rename_count += 1
329
288
330
289
def remove(self):
331
290
"""Derived from the Avahi example code"""
369
328
self.rename()
370
329
elif state == avahi.ENTRY_GROUP_FAILURE:
371
330
logger.critical("Avahi: Error in group state changed %s",
372
str(error))
373
raise AvahiGroupError("State changed: {!s}".format(error))
331
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
374
334
375
335
def cleanup(self):
376
336
"""Derived from the Avahi example code"""
386
346
def server_state_changed(self, state, error=None):
387
347
"""Derived from the Avahi example code"""
388
348
logger.debug("Avahi server state change: %i", state)
389
bad_states = {
390
avahi.SERVER_INVALID: "Zeroconf server invalid",
391
avahi.SERVER_REGISTERING: None,
392
avahi.SERVER_COLLISION: "Zeroconf server name collision",
393
avahi.SERVER_FAILURE: "Zeroconf server failure",
394
}
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
395
356
if state in bad_states:
396
357
if bad_states[state] is not None:
397
358
if error is None:
400
361
logger.error(bad_states[state] + ": %r", error)
401
362
self.cleanup()
402
363
elif state == avahi.SERVER_RUNNING:
403
try:
404
self.add()
405
except dbus.exceptions.DBusException as error:
406
if (error.get_dbus_name()
407
== "org.freedesktop.Avahi.CollisionError"):
408
logger.info("Local Zeroconf service name"
409
" collision.")
410
return self.rename(remove=False)
411
else:
412
logger.critical("D-Bus Exception", exc_info=error)
413
self.cleanup()
414
os._exit(1)
364
self.add()
415
365
else:
416
366
if error is None:
417
367
logger.debug("Unknown state: %r", state)
427
377
follow_name_owner_changes=True),
428
378
avahi.DBUS_INTERFACE_SERVER)
429
379
self.server.connect_to_signal("StateChanged",
430
self.server_state_changed)
380
self.server_state_changed)
431
381
self.server_state_changed(self.server.GetState())
432
382
433
383
434
384
class AvahiServiceToSyslog(AvahiService):
435
def rename(self, *args, **kwargs):
385
def rename(self):
436
386
"""Add the new name to the syslog messages"""
437
ret = AvahiService.rename(self, *args, **kwargs)
438
syslogger.setFormatter(logging.Formatter(
439
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
440
.format(self.name)))
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
441
392
return ret
442
393
443
# Pretend that we have a GnuTLS module
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
459
# Unless otherwise indicated, the constants and types below are
460
# all from the gnutls/gnutls.h C header file.
461
462
# Constants
463
E_SUCCESS = 0
464
E_INTERRUPTED = -52
465
E_AGAIN = -28
466
CRT_OPENPGP = 2
467
CLIENT = 2
468
SHUT_RDWR = 0
469
CRD_CERTIFICATE = 1
470
E_NO_CERTIFICATE_FOUND = -49
471
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
472
473
# Types
474
class session_int(ctypes.Structure):
475
_fields_ = []
476
session_t = ctypes.POINTER(session_int)
477
class certificate_credentials_st(ctypes.Structure):
478
_fields_ = []
479
certificate_credentials_t = ctypes.POINTER(
480
certificate_credentials_st)
481
certificate_type_t = ctypes.c_int
482
class datum_t(ctypes.Structure):
483
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
('size', ctypes.c_uint)]
485
class openpgp_crt_int(ctypes.Structure):
486
_fields_ = []
487
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
489
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
490
credentials_type_t = ctypes.c_int #
491
transport_ptr_t = ctypes.c_void_p
492
close_request_t = ctypes.c_int
493
494
# Exceptions
495
class Error(Exception):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
501
# Default usage is by a message string, but if a return
502
# code is passed, convert it to a string with
503
# gnutls.strerror()
504
self.code = code
505
if message is None and code is not None:
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
508
message, *args)
509
510
class CertificateSecurityError(Error):
511
pass
512
513
# Classes
514
class Credentials(object):
515
def __init__(self):
516
self._c_object = gnutls.certificate_credentials_t()
517
gnutls.certificate_allocate_credentials(
518
ctypes.byref(self._c_object))
519
self.type = gnutls.CRD_CERTIFICATE
520
521
def __del__(self):
522
gnutls.certificate_free_credentials(self._c_object)
523
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
526
self._c_object = gnutls.session_t()
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
528
gnutls.set_default_priority(self._c_object)
529
gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
gnutls.handshake_set_private_extensions(self._c_object,
531
True)
532
self.socket = socket
533
if credentials is None:
534
credentials = gnutls.Credentials()
535
gnutls.credentials_set(self._c_object, credentials.type,
536
ctypes.cast(credentials._c_object,
537
ctypes.c_void_p))
538
self.credentials = credentials
539
540
def __del__(self):
541
gnutls.deinit(self._c_object)
542
543
def handshake(self):
544
return gnutls.handshake(self._c_object)
545
546
def send(self, data):
547
data = bytes(data)
548
data_len = len(data)
549
while data_len > 0:
550
data_len -= gnutls.record_send(self._c_object,
551
data[-data_len:],
552
data_len)
553
554
def bye(self):
555
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
557
# Error handling functions
558
def _error_code(result):
559
"""A function to raise exceptions on errors, suitable
560
for the 'restype' attribute on ctypes functions"""
561
if result >= 0:
562
return result
563
if result == gnutls.E_NO_CERTIFICATE_FOUND:
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
567
def _retry_on_error(result, func, arguments):
568
"""A function to retry on some errors, suitable
569
for the 'errcheck' attribute on ctypes functions"""
570
while result < 0:
571
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
572
return _error_code(result)
573
result = func(*arguments)
574
return result
575
576
# Unless otherwise indicated, the function declarations below are
577
# all from the gnutls/gnutls.h C header file.
578
579
# Functions
580
priority_set_direct = _library.gnutls_priority_set_direct
581
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
582
ctypes.POINTER(ctypes.c_char_p)]
583
priority_set_direct.restype = _error_code
584
585
init = _library.gnutls_init
586
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
587
init.restype = _error_code
588
589
set_default_priority = _library.gnutls_set_default_priority
590
set_default_priority.argtypes = [session_t]
591
set_default_priority.restype = _error_code
592
593
record_send = _library.gnutls_record_send
594
record_send.argtypes = [session_t, ctypes.c_void_p,
595
ctypes.c_size_t]
596
record_send.restype = ctypes.c_ssize_t
597
record_send.errcheck = _retry_on_error
598
599
certificate_allocate_credentials = (
600
_library.gnutls_certificate_allocate_credentials)
601
certificate_allocate_credentials.argtypes = [
602
ctypes.POINTER(certificate_credentials_t)]
603
certificate_allocate_credentials.restype = _error_code
604
605
certificate_free_credentials = (
606
_library.gnutls_certificate_free_credentials)
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
608
certificate_free_credentials.restype = None
609
610
handshake_set_private_extensions = (
611
_library.gnutls_handshake_set_private_extensions)
612
handshake_set_private_extensions.argtypes = [session_t,
613
ctypes.c_int]
614
handshake_set_private_extensions.restype = None
615
616
credentials_set = _library.gnutls_credentials_set
617
credentials_set.argtypes = [session_t, credentials_type_t,
618
ctypes.c_void_p]
619
credentials_set.restype = _error_code
620
621
strerror = _library.gnutls_strerror
622
strerror.argtypes = [ctypes.c_int]
623
strerror.restype = ctypes.c_char_p
624
625
certificate_type_get = _library.gnutls_certificate_type_get
626
certificate_type_get.argtypes = [session_t]
627
certificate_type_get.restype = _error_code
628
629
certificate_get_peers = _library.gnutls_certificate_get_peers
630
certificate_get_peers.argtypes = [session_t,
631
ctypes.POINTER(ctypes.c_uint)]
632
certificate_get_peers.restype = ctypes.POINTER(datum_t)
633
634
global_set_log_level = _library.gnutls_global_set_log_level
635
global_set_log_level.argtypes = [ctypes.c_int]
636
global_set_log_level.restype = None
637
638
global_set_log_function = _library.gnutls_global_set_log_function
639
global_set_log_function.argtypes = [log_func]
640
global_set_log_function.restype = None
641
642
deinit = _library.gnutls_deinit
643
deinit.argtypes = [session_t]
644
deinit.restype = None
645
646
handshake = _library.gnutls_handshake
647
handshake.argtypes = [session_t]
648
handshake.restype = _error_code
649
handshake.errcheck = _retry_on_error
650
651
transport_set_ptr = _library.gnutls_transport_set_ptr
652
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
653
transport_set_ptr.restype = None
654
655
bye = _library.gnutls_bye
656
bye.argtypes = [session_t, close_request_t]
657
bye.restype = _error_code
658
bye.errcheck = _retry_on_error
659
660
check_version = _library.gnutls_check_version
661
check_version.argtypes = [ctypes.c_char_p]
662
check_version.restype = ctypes.c_char_p
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
693
# Remove non-public functions
694
del _error_code, _retry_on_error
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
697
698
def call_pipe(connection, # : multiprocessing.Connection
699
func, *args, **kwargs):
700
"""This function is meant to be called by multiprocessing.Process
701
702
This function runs func(*args, **kwargs), and writes the resulting
703
return value on the provided multiprocessing.Connection.
704
"""
705
connection.send(func(*args, **kwargs))
706
connection.close()
394
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
400
707
401
708
402
class Client(object):
709
403
"""A representation of a client host served by this server.
715
409
checker: subprocess.Popen(); a running checker process used
716
410
to see if the client lives.
717
411
'None' if no process is running.
718
checker_callback_tag: a GObject event source tag, or None
412
checker_callback_tag: a gobject event source tag, or None
719
413
checker_command: string; External command which is run to check
720
414
if client lives. %() expansions are done at
721
415
runtime with vars(self) as dict, so that for
722
416
instance %(name)s can be used in the command.
723
checker_initiator_tag: a GObject event source tag, or None
417
checker_initiator_tag: a gobject event source tag, or None
724
418
created: datetime.datetime(); (UTC) object creation
725
419
client_structure: Object describing what attributes a client has
726
420
and is used for storing the client at exit
727
421
current_checker_command: string; current running checker_command
728
disable_initiator_tag: a GObject event source tag, or None
422
disable_initiator_tag: a gobject event source tag, or None
729
423
enabled: bool()
730
424
fingerprint: string (40 or 32 hexadecimal digits); used to
731
425
uniquely identify the client
736
430
last_checker_status: integer between 0 and 255 reflecting exit
737
431
status of last checker. -1 reflects crashed
738
432
checker, -2 means no checker completed yet.
739
last_checker_signal: The signal which killed the last checker, if
740
last_checker_status is -1
741
433
last_enabled: datetime.datetime(); (UTC) or None
742
434
name: string; from the config file, used in log messages and
743
435
D-Bus identifiers
748
440
runtime_expansions: Allowed attributes for runtime expansion.
749
441
expires: datetime.datetime(); time (UTC) when a client will be
750
442
disabled, or None
751
server_settings: The server_settings dict from main()
752
443
"""
753
444
754
445
runtime_expansions = ("approval_delay", "approval_duration",
756
447
"fingerprint", "host", "interval",
757
448
"last_approval_request", "last_checked_ok",
758
449
"last_enabled", "name", "timeout")
759
client_defaults = {
760
"timeout": "PT5M",
761
"extended_timeout": "PT15M",
762
"interval": "PT2M",
763
"checker": "fping -q -- %%(host)s",
764
"host": "",
765
"approval_delay": "PT0S",
766
"approval_duration": "PT1S",
767
"approved_by_default": "True",
768
"enabled": "True",
769
}
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
453
"checker": "fping -q -- %%(host)s",
454
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
458
"enabled": "True",
459
}
460
461
def timeout_milliseconds(self):
462
"Return the 'timeout' attribute in milliseconds"
463
return timedelta_to_milliseconds(self.timeout)
464
465
def extended_timeout_milliseconds(self):
466
"Return the 'extended_timeout' attribute in milliseconds"
467
return timedelta_to_milliseconds(self.extended_timeout)
468
469
def interval_milliseconds(self):
470
"Return the 'interval' attribute in milliseconds"
471
return timedelta_to_milliseconds(self.interval)
472
473
def approval_delay_milliseconds(self):
474
return timedelta_to_milliseconds(self.approval_delay)
770
475
771
476
@staticmethod
772
477
def config_parser(config):
788
493
client["enabled"] = config.getboolean(client_name,
789
494
"enabled")
790
495
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
794
496
client["fingerprint"] = (section["fingerprint"].upper()
795
497
.replace(" ", ""))
796
498
if "secret" in section:
801
503
"rb") as secfile:
802
504
client["secret"] = secfile.read()
803
505
else:
804
raise TypeError("No secret or secfile for section {}"
506
raise TypeError("No secret or secfile for section {0}"
805
507
.format(section))
806
508
client["timeout"] = string_to_delta(section["timeout"])
807
509
client["extended_timeout"] = string_to_delta(
818
520
819
521
return settings
820
522
821
def __init__(self, settings, name = None, server_settings=None):
523
def __init__(self, settings, name = None):
822
524
self.name = name
823
if server_settings is None:
824
server_settings = {}
825
self.server_settings = server_settings
826
525
# adding all client settings
827
for setting, value in settings.items():
526
for setting, value in settings.iteritems():
828
527
setattr(self, setting, value)
829
528
830
529
if self.enabled:
838
537
self.expires = None
839
538
840
539
logger.debug("Creating client %r", self.name)
540
# Uppercase and remove spaces from fingerprint for later
541
# comparison purposes with return value from the fingerprint()
542
# function
841
543
logger.debug(" Fingerprint: %s", self.fingerprint)
842
544
self.created = settings.get("created",
843
545
datetime.datetime.utcnow())
850
552
self.current_checker_command = None
851
553
self.approved = None
852
554
self.approvals_pending = 0
853
self.changedstate = multiprocessing_manager.Condition(
854
multiprocessing_manager.Lock())
855
self.client_structure = [attr
856
for attr in self.__dict__.iterkeys()
555
self.changedstate = (multiprocessing_manager
556
.Condition(multiprocessing_manager
557
.Lock()))
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
857
560
if not attr.startswith("_")]
858
561
self.client_structure.append("client_structure")
859
562
860
for name, t in inspect.getmembers(
861
type(self), lambda obj: isinstance(obj, property)):
563
for name, t in inspect.getmembers(type(self),
564
lambda obj:
565
isinstance(obj,
566
property)):
862
567
if not name.startswith("_"):
863
568
self.client_structure.append(name)
864
569
885
590
if not quiet:
886
591
logger.info("Disabling client %s", self.name)
887
592
if getattr(self, "disable_initiator_tag", None) is not None:
888
GObject.source_remove(self.disable_initiator_tag)
593
gobject.source_remove(self.disable_initiator_tag)
889
594
self.disable_initiator_tag = None
890
595
self.expires = None
891
596
if getattr(self, "checker_initiator_tag", None) is not None:
892
GObject.source_remove(self.checker_initiator_tag)
597
gobject.source_remove(self.checker_initiator_tag)
893
598
self.checker_initiator_tag = None
894
599
self.stop_checker()
895
600
self.enabled = False
896
601
if not quiet:
897
602
self.send_changedstate()
898
# Do not run this again if called by a GObject.timeout_add
603
# Do not run this again if called by a gobject.timeout_add
899
604
return False
900
605
901
606
def __del__(self):
905
610
# Schedule a new checker to be started an 'interval' from now,
906
611
# and every interval from then on.
907
612
if self.checker_initiator_tag is not None:
908
GObject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = GObject.timeout_add(
910
int(self.interval.total_seconds() * 1000),
911
self.start_checker)
613
gobject.source_remove(self.checker_initiator_tag)
614
self.checker_initiator_tag = (gobject.timeout_add
615
(self.interval_milliseconds(),
616
self.start_checker))
912
617
# Schedule a disable() when 'timeout' has passed
913
618
if self.disable_initiator_tag is not None:
914
GObject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = GObject.timeout_add(
916
int(self.timeout.total_seconds() * 1000), self.disable)
619
gobject.source_remove(self.disable_initiator_tag)
620
self.disable_initiator_tag = (gobject.timeout_add
621
(self.timeout_milliseconds(),
622
self.disable))
917
623
# Also start a new checker *right now*.
918
624
self.start_checker()
919
625
920
def checker_callback(self, source, condition, connection,
921
command):
626
def checker_callback(self, pid, condition, command):
922
627
"""The checker has completed, so take appropriate actions."""
923
628
self.checker_callback_tag = None
924
629
self.checker = None
925
# Read return code from connection (see call_pipe)
926
returncode = connection.recv()
927
connection.close()
928
929
if returncode >= 0:
930
self.last_checker_status = returncode
931
self.last_checker_signal = None
630
if os.WIFEXITED(condition):
631
self.last_checker_status = os.WEXITSTATUS(condition)
932
632
if self.last_checker_status == 0:
933
633
logger.info("Checker for %(name)s succeeded",
934
634
vars(self))
935
635
self.checked_ok()
936
636
else:
937
logger.info("Checker for %(name)s failed", vars(self))
637
logger.info("Checker for %(name)s failed",
638
vars(self))
938
639
else:
939
640
self.last_checker_status = -1
940
self.last_checker_signal = -returncode
941
641
logger.warning("Checker for %(name)s crashed?",
942
642
vars(self))
943
return False
944
643
945
644
def checked_ok(self):
946
645
"""Assert that the client has been seen, alive and well."""
947
646
self.last_checked_ok = datetime.datetime.utcnow()
948
647
self.last_checker_status = 0
949
self.last_checker_signal = None
950
648
self.bump_timeout()
951
649
952
650
def bump_timeout(self, timeout=None):
954
652
if timeout is None:
955
653
timeout = self.timeout
956
654
if self.disable_initiator_tag is not None:
957
GObject.source_remove(self.disable_initiator_tag)
655
gobject.source_remove(self.disable_initiator_tag)
958
656
self.disable_initiator_tag = None
959
657
if getattr(self, "enabled", False):
960
self.disable_initiator_tag = GObject.timeout_add(
961
int(timeout.total_seconds() * 1000), self.disable)
658
self.disable_initiator_tag = (gobject.timeout_add
659
(timedelta_to_milliseconds
660
(timeout), self.disable))
962
661
self.expires = datetime.datetime.utcnow() + timeout
963
662
964
663
def need_approval(self):
978
677
# than 'timeout' for the client to be disabled, which is as it
979
678
# should be.
980
679
981
if self.checker is not None and not self.checker.is_alive():
982
logger.warning("Checker was not alive; joining")
983
self.checker.join()
984
self.checker = None
680
# If a checker exists, make sure it is not a zombie
681
try:
682
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
683
except (AttributeError, OSError) as error:
684
if (isinstance(error, OSError)
685
and error.errno != errno.ECHILD):
686
raise error
687
else:
688
if pid:
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
985
693
# Start a new checker if needed
986
694
if self.checker is None:
987
695
# Escape attributes for the shell
988
escaped_attrs = {
989
attr: re.escape(str(getattr(self, attr)))
990
for attr in self.runtime_expansions }
696
escaped_attrs = dict(
697
(attr, re.escape(unicode(getattr(self, attr))))
698
for attr in
699
self.runtime_expansions)
991
700
try:
992
701
command = self.checker_command % escaped_attrs
993
702
except TypeError as error:
994
703
logger.error('Could not format string "%s"',
995
self.checker_command,
704
self.checker_command, exc_info=error)
705
return True # Try again later
706
self.current_checker_command = command
707
try:
708
logger.info("Starting checker %r for %s",
709
command, self.name)
710
# We don't need to redirect stdout and stderr, since
711
# in normal mode, that is already done by daemon(),
712
# and in debug mode we don't want to. (Stdin is
713
# always replaced by /dev/null.)
714
self.checker = subprocess.Popen(command,
715
close_fds=True,
716
shell=True, cwd="/")
717
except OSError as error:
718
logger.error("Failed to start subprocess",
996
719
exc_info=error)
997
return True # Try again later
998
self.current_checker_command = command
999
logger.info("Starting checker %r for %s", command,
1000
self.name)
1001
# We don't need to redirect stdout and stderr, since
1002
# in normal mode, that is already done by daemon(),
1003
# and in debug mode we don't want to. (Stdin is
1004
# always replaced by /dev/null.)
1005
# The exception is when not debugging but nevertheless
1006
# running in the foreground; use the previously
1007
# created wnull.
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1011
if (not self.server_settings["debug"]
1012
and self.server_settings["foreground"]):
1013
popen_args.update({"stdout": wnull,
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1016
self.checker = multiprocessing.Process(
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1020
self.checker.start()
1021
self.checker_callback_tag = GObject.io_add_watch(
1022
pipe[0].fileno(), GObject.IO_IN,
1023
self.checker_callback, pipe[0], command)
1024
# Re-run this periodically if run by GObject.timeout_add
720
self.checker_callback_tag = (gobject.child_watch_add
721
(self.checker.pid,
722
self.checker_callback,
723
data=command))
724
# The checker may have completed before the gobject
725
# watch was added. Check for this.
726
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
727
if pid:
728
gobject.source_remove(self.checker_callback_tag)
729
self.checker_callback(pid, status, command)
730
# Re-run this periodically if run by gobject.timeout_add
1025
731
return True
1026
732
1027
733
def stop_checker(self):
1028
734
"""Force the checker process, if any, to stop."""
1029
735
if self.checker_callback_tag:
1030
GObject.source_remove(self.checker_callback_tag)
736
gobject.source_remove(self.checker_callback_tag)
1031
737
self.checker_callback_tag = None
1032
738
if getattr(self, "checker", None) is None:
1033
739
return
1034
740
logger.debug("Stopping checker for %(name)s", vars(self))
1035
self.checker.terminate()
741
try:
742
self.checker.terminate()
743
#time.sleep(0.5)
744
#if self.checker.poll() is None:
745
# self.checker.kill()
746
except OSError as error:
747
if error.errno != errno.ESRCH: # No such process
748
raise
1036
749
self.checker = None
1037
750
1038
751
1039
def dbus_service_property(dbus_interface,
1040
signature="v",
1041
access="readwrite",
1042
byte_arrays=False):
752
def dbus_service_property(dbus_interface, signature="v",
753
access="readwrite", byte_arrays=False):
1043
754
"""Decorators for marking methods of a DBusObjectWithProperties to
1044
755
become properties on the D-Bus.
1045
756
1054
765
# "Set" method, so we fail early here:
1055
766
if byte_arrays and signature != "ay":
1056
767
raise ValueError("Byte arrays not supported for non-'ay'"
1057
" signature {!r}".format(signature))
1058
768
" signature {0!r}".format(signature))
1059
769
def decorator(func):
1060
770
func._dbus_is_property = True
1061
771
func._dbus_interface = dbus_interface
1066
776
func._dbus_name = func._dbus_name[:-14]
1067
777
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1068
778
return func
1069
1070
779
return decorator
1071
780
1072
781
1081
790
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1082
791
"false"}
1083
792
"""
1084
1085
793
def decorator(func):
1086
794
func._dbus_is_interface = True
1087
795
func._dbus_interface = dbus_interface
1088
796
func._dbus_name = dbus_interface
1089
797
return func
1090
1091
798
return decorator
1092
799
1093
800
1095
802
"""Decorator to annotate D-Bus methods, signals or properties
1096
803
Usage:
1097
804
1098
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1099
"org.freedesktop.DBus.Property."
1100
"EmitsChangedSignal": "false"})
1101
805
@dbus_service_property("org.example.Interface", signature="b",
1102
806
access="r")
807
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
808
"org.freedesktop.DBus.Property."
809
"EmitsChangedSignal": "false"})
1103
810
def Property_dbus_property(self):
1104
811
return dbus.Boolean(False)
1105
1106
See also the DBusObjectWithAnnotations class.
1107
812
"""
1108
1109
813
def decorator(func):
1110
814
func._dbus_annotations = annotations
1111
815
return func
1112
1113
816
return decorator
1114
817
1115
818
1116
819
class DBusPropertyException(dbus.exceptions.DBusException):
1117
820
"""A base class for D-Bus property-related exceptions
1118
821
"""
1119
pass
822
def __unicode__(self):
823
return unicode(str(self))
1120
824
1121
825
1122
826
class DBusPropertyAccessException(DBusPropertyException):
1131
835
pass
1132
836
1133
837
1134
class DBusObjectWithAnnotations(dbus.service.Object):
1135
"""A D-Bus object with annotations.
838
class DBusObjectWithProperties(dbus.service.Object):
839
"""A D-Bus object with properties.
1136
840
1137
Classes inheriting from this can use the dbus_annotations
1138
decorator to add annotations to methods or signals.
841
Classes inheriting from this can use the dbus_service_property
842
decorator to expose methods as D-Bus properties. It exposes the
843
standard Get(), Set(), and GetAll() methods on the D-Bus.
1139
844
"""
1140
845
1141
846
@staticmethod
1145
850
If called like _is_dbus_thing("method") it returns a function
1146
851
suitable for use as predicate to inspect.getmembers().
1147
852
"""
1148
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
853
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1149
854
False)
1150
855
1151
856
def _get_all_dbus_things(self, thing):
1152
857
"""Returns a generator of (name, attribute) pairs
1153
858
"""
1154
return ((getattr(athing.__get__(self), "_dbus_name", name),
859
return ((getattr(athing.__get__(self), "_dbus_name",
860
name),
1155
861
athing.__get__(self))
1156
862
for cls in self.__class__.__mro__
1157
863
for name, athing in
1158
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1159
1160
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1164
def Introspect(self, object_path, connection):
1165
"""Overloading of standard D-Bus method.
1166
1167
Inserts annotation tags on methods and signals.
1168
"""
1169
xmlstring = dbus.service.Object.Introspect(self, object_path,
1170
connection)
1171
try:
1172
document = xml.dom.minidom.parseString(xmlstring)
1173
1174
for if_tag in document.getElementsByTagName("interface"):
1175
# Add annotation tags
1176
for typ in ("method", "signal"):
1177
for tag in if_tag.getElementsByTagName(typ):
1178
annots = dict()
1179
for name, prop in (self.
1180
_get_all_dbus_things(typ)):
1181
if (name == tag.getAttribute("name")
1182
and prop._dbus_interface
1183
== if_tag.getAttribute("name")):
1184
annots.update(getattr(
1185
prop, "_dbus_annotations", {}))
1186
for name, value in annots.items():
1187
ann_tag = document.createElement(
1188
"annotation")
1189
ann_tag.setAttribute("name", name)
1190
ann_tag.setAttribute("value", value)
1191
tag.appendChild(ann_tag)
1192
# Add interface annotation tags
1193
for annotation, value in dict(
1194
itertools.chain.from_iterable(
1195
annotations().items()
1196
for name, annotations
1197
in self._get_all_dbus_things("interface")
1198
if name == if_tag.getAttribute("name")
1199
)).items():
1200
ann_tag = document.createElement("annotation")
1201
ann_tag.setAttribute("name", annotation)
1202
ann_tag.setAttribute("value", value)
1203
if_tag.appendChild(ann_tag)
1204
# Fix argument name for the Introspect method itself
1205
if (if_tag.getAttribute("name")
1206
== dbus.INTROSPECTABLE_IFACE):
1207
for cn in if_tag.getElementsByTagName("method"):
1208
if cn.getAttribute("name") == "Introspect":
1209
for arg in cn.getElementsByTagName("arg"):
1210
if (arg.getAttribute("direction")
1211
== "out"):
1212
arg.setAttribute("name",
1213
"xml_data")
1214
xmlstring = document.toxml("utf-8")
1215
document.unlink()
1216
except (AttributeError, xml.dom.DOMException,
1217
xml.parsers.expat.ExpatError) as error:
1218
logger.error("Failed to override Introspection method",
1219
exc_info=error)
1220
return xmlstring
1221
1222
1223
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1224
"""A D-Bus object with properties.
1225
1226
Classes inheriting from this can use the dbus_service_property
1227
decorator to expose methods as D-Bus properties. It exposes the
1228
standard Get(), Set(), and GetAll() methods on the D-Bus.
1229
"""
864
inspect.getmembers(cls,
865
self._is_dbus_thing(thing)))
1230
866
1231
867
def _get_dbus_property(self, interface_name, property_name):
1232
868
"""Returns a bound method if one exists which is a D-Bus
1233
869
property with the specified name and interface.
1234
870
"""
1235
for cls in self.__class__.__mro__:
1236
for name, value in inspect.getmembers(
1237
cls, self._is_dbus_thing("property")):
871
for cls in self.__class__.__mro__:
872
for name, value in (inspect.getmembers
873
(cls,
874
self._is_dbus_thing("property"))):
1238
875
if (value._dbus_name == property_name
1239
876
and value._dbus_interface == interface_name):
1240
877
return value.__get__(self)
1241
878
1242
879
# No such property
1243
raise DBusPropertyNotFound("{}:{}.{}".format(
1244
self.dbus_object_path, interface_name, property_name))
1245
1246
@classmethod
1247
def _get_all_interface_names(cls):
1248
"""Get a sequence of all interfaces supported by an object"""
1249
return (name for name in set(getattr(getattr(x, attr),
1250
"_dbus_interface", None)
1251
for x in (inspect.getmro(cls))
1252
for attr in dir(x))
1253
if name is not None)
1254
1255
@dbus.service.method(dbus.PROPERTIES_IFACE,
1256
in_signature="ss",
880
raise DBusPropertyNotFound(self.dbus_object_path + ":"
881
+ interface_name + "."
882
+ property_name)
883
884
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1257
885
out_signature="v")
1258
886
def Get(self, interface_name, property_name):
1259
887
"""Standard D-Bus property Get() method, see D-Bus standard.
1277
905
# The byte_arrays option is not supported yet on
1278
906
# signatures other than "ay".
1279
907
if prop._dbus_signature != "ay":
1280
raise ValueError("Byte arrays not supported for non-"
1281
"'ay' signature {!r}"
1282
.format(prop._dbus_signature))
908
raise ValueError
1283
909
value = dbus.ByteArray(b''.join(chr(byte)
1284
910
for byte in value))
1285
911
prop(value)
1286
912
1287
@dbus.service.method(dbus.PROPERTIES_IFACE,
1288
in_signature="s",
913
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1289
914
out_signature="a{sv}")
1290
915
def GetAll(self, interface_name):
1291
916
"""Standard D-Bus property GetAll() method, see D-Bus
1306
931
if not hasattr(value, "variant_level"):
1307
932
properties[name] = value
1308
933
continue
1309
properties[name] = type(value)(
1310
value, variant_level = value.variant_level + 1)
934
properties[name] = type(value)(value, variant_level=
935
value.variant_level+1)
1311
936
return dbus.Dictionary(properties, signature="sv")
1312
937
1313
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1314
def PropertiesChanged(self, interface_name, changed_properties,
1315
invalidated_properties):
1316
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1317
standard.
1318
"""
1319
pass
1320
1321
938
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1322
939
out_signature="s",
1323
940
path_keyword='object_path',
1327
944
1328
945
Inserts property tags and interface annotation tags.
1329
946
"""
1330
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1331
object_path,
1332
connection)
947
xmlstring = dbus.service.Object.Introspect(self, object_path,
948
connection)
1333
949
try:
1334
950
document = xml.dom.minidom.parseString(xmlstring)
1335
1336
951
def make_tag(document, name, prop):
1337
952
e = document.createElement("property")
1338
953
e.setAttribute("name", name)
1339
954
e.setAttribute("type", prop._dbus_signature)
1340
955
e.setAttribute("access", prop._dbus_access)
1341
956
return e
1342
1343
957
for if_tag in document.getElementsByTagName("interface"):
1344
958
# Add property tags
1345
959
for tag in (make_tag(document, name, prop)
1348
962
if prop._dbus_interface
1349
963
== if_tag.getAttribute("name")):
1350
964
if_tag.appendChild(tag)
1351
# Add annotation tags for properties
1352
for tag in if_tag.getElementsByTagName("property"):
1353
annots = dict()
1354
for name, prop in self._get_all_dbus_things(
1355
"property"):
1356
if (name == tag.getAttribute("name")
1357
and prop._dbus_interface
1358
== if_tag.getAttribute("name")):
1359
annots.update(getattr(
1360
prop, "_dbus_annotations", {}))
1361
for name, value in annots.items():
1362
ann_tag = document.createElement(
1363
"annotation")
1364
ann_tag.setAttribute("name", name)
1365
ann_tag.setAttribute("value", value)
1366
tag.appendChild(ann_tag)
965
# Add annotation tags
966
for typ in ("method", "signal", "property"):
967
for tag in if_tag.getElementsByTagName(typ):
968
annots = dict()
969
for name, prop in (self.
970
_get_all_dbus_things(typ)):
971
if (name == tag.getAttribute("name")
972
and prop._dbus_interface
973
== if_tag.getAttribute("name")):
974
annots.update(getattr
975
(prop,
976
"_dbus_annotations",
977
{}))
978
for name, value in annots.iteritems():
979
ann_tag = document.createElement(
980
"annotation")
981
ann_tag.setAttribute("name", name)
982
ann_tag.setAttribute("value", value)
983
tag.appendChild(ann_tag)
984
# Add interface annotation tags
985
for annotation, value in dict(
986
itertools.chain.from_iterable(
987
annotations().iteritems()
988
for name, annotations in
989
self._get_all_dbus_things("interface")
990
if name == if_tag.getAttribute("name")
991
)).iteritems():
992
ann_tag = document.createElement("annotation")
993
ann_tag.setAttribute("name", annotation)
994
ann_tag.setAttribute("value", value)
995
if_tag.appendChild(ann_tag)
1367
996
# Add the names to the return values for the
1368
997
# "org.freedesktop.DBus.Properties" methods
1369
998
if (if_tag.getAttribute("name")
1387
1016
exc_info=error)
1388
1017
return xmlstring
1389
1018
1390
try:
1391
dbus.OBJECT_MANAGER_IFACE
1392
except AttributeError:
1393
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1394
1395
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1396
"""A D-Bus object with an ObjectManager.
1397
1398
Classes inheriting from this exposes the standard
1399
GetManagedObjects call and the InterfacesAdded and
1400
InterfacesRemoved signals on the standard
1401
"org.freedesktop.DBus.ObjectManager" interface.
1402
1403
Note: No signals are sent automatically; they must be sent
1404
manually.
1405
"""
1406
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1407
out_signature = "a{oa{sa{sv}}}")
1408
def GetManagedObjects(self):
1409
"""This function must be overridden"""
1410
raise NotImplementedError()
1411
1412
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1413
signature = "oa{sa{sv}}")
1414
def InterfacesAdded(self, object_path, interfaces_and_properties):
1415
pass
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1418
def InterfacesRemoved(self, object_path, interfaces):
1419
pass
1420
1421
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1425
def Introspect(self, object_path, connection):
1426
"""Overloading of standard D-Bus method.
1427
1428
Override return argument name of GetManagedObjects to be
1429
"objpath_interfaces_and_properties"
1430
"""
1431
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1432
object_path,
1433
connection)
1434
try:
1435
document = xml.dom.minidom.parseString(xmlstring)
1436
1437
for if_tag in document.getElementsByTagName("interface"):
1438
# Fix argument name for the GetManagedObjects method
1439
if (if_tag.getAttribute("name")
1440
== dbus.OBJECT_MANAGER_IFACE):
1441
for cn in if_tag.getElementsByTagName("method"):
1442
if (cn.getAttribute("name")
1443
== "GetManagedObjects"):
1444
for arg in cn.getElementsByTagName("arg"):
1445
if (arg.getAttribute("direction")
1446
== "out"):
1447
arg.setAttribute(
1448
"name",
1449
"objpath_interfaces"
1450
"_and_properties")
1451
xmlstring = document.toxml("utf-8")
1452
document.unlink()
1453
except (AttributeError, xml.dom.DOMException,
1454
xml.parsers.expat.ExpatError) as error:
1455
logger.error("Failed to override Introspection method",
1456
exc_info = error)
1457
return xmlstring
1458
1019
1459
1020
def datetime_to_dbus(dt, variant_level=0):
1460
1021
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1461
1022
if dt is None:
1462
1023
return dbus.String("", variant_level = variant_level)
1463
return dbus.String(dt.isoformat(), variant_level=variant_level)
1024
return dbus.String(dt.isoformat(),
1025
variant_level=variant_level)
1464
1026
1465
1027
1466
1028
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1486
1048
(from DBusObjectWithProperties) and interfaces (from the
1487
1049
dbus_interface_annotations decorator).
1488
1050
"""
1489
1490
1051
def wrapper(cls):
1491
1052
for orig_interface_name, alt_interface_name in (
1492
alt_interface_names.items()):
1053
alt_interface_names.iteritems()):
1493
1054
attr = {}
1494
1055
interface_names = set()
1495
1056
# Go though all attributes of the class
1497
1058
# Ignore non-D-Bus attributes, and D-Bus attributes
1498
1059
# with the wrong interface name
1499
1060
if (not hasattr(attribute, "_dbus_interface")
1500
or not attribute._dbus_interface.startswith(
1501
orig_interface_name)):
1061
or not attribute._dbus_interface
1062
.startswith(orig_interface_name)):
1502
1063
continue
1503
1064
# Create an alternate D-Bus interface name based on
1504
1065
# the current name
1505
alt_interface = attribute._dbus_interface.replace(
1506
orig_interface_name, alt_interface_name)
1066
alt_interface = (attribute._dbus_interface
1067
.replace(orig_interface_name,
1068
alt_interface_name))
1507
1069
interface_names.add(alt_interface)
1508
1070
# Is this a D-Bus signal?
1509
1071
if getattr(attribute, "_dbus_is_signal", False):
1510
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1513
nonmethod_func = (dict(
1072
# Extract the original non-method function by
1073
# black magic
1074
nonmethod_func = (dict(
1514
1075
zip(attribute.func_code.co_freevars,
1515
attribute.__closure__))
1516
["func"].cell_contents)
1517
else:
1518
nonmethod_func = attribute
1076
attribute.__closure__))["func"]
1077
.cell_contents)
1519
1078
# Create a new, but exactly alike, function
1520
1079
# object, and decorate it to be a new D-Bus signal
1521
1080
# with the alternate D-Bus interface name
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1536
new_function = (dbus.service.signal(
1537
alt_interface,
1538
attribute._dbus_signature)(new_function))
1081
new_function = (dbus.service.signal
1082
(alt_interface,
1083
attribute._dbus_signature)
1084
(types.FunctionType(
1085
nonmethod_func.func_code,
1086
nonmethod_func.func_globals,
1087
nonmethod_func.func_name,
1088
nonmethod_func.func_defaults,
1089
nonmethod_func.func_closure)))
1539
1090
# Copy annotations, if any
1540
1091
try:
1541
new_function._dbus_annotations = dict(
1542
attribute._dbus_annotations)
1092
new_function._dbus_annotations = (
1093
dict(attribute._dbus_annotations))
1543
1094
except AttributeError:
1544
1095
pass
1545
1096
# Define a creator of a function to call both the
1550
1101
"""This function is a scope container to pass
1551
1102
func1 and func2 to the "call_both" function
1552
1103
outside of its arguments"""
1553
1554
@functools.wraps(func2)
1555
1104
def call_both(*args, **kwargs):
1556
1105
"""This function will emit two D-Bus
1557
1106
signals by calling func1 and func2"""
1558
1107
func1(*args, **kwargs)
1559
1108
func2(*args, **kwargs)
1560
# Make wrapper function look like a D-Bus signal
1561
for name, attr in inspect.getmembers(func2):
1562
if name.startswith("_dbus_"):
1563
setattr(call_both, name, attr)
1564
1565
1109
return call_both
1566
1110
# Create the "call_both" function and add it to
1567
1111
# the class
1572
1116
# object. Decorate it to be a new D-Bus method
1573
1117
# with the alternate D-Bus interface name. Add it
1574
1118
# to the class.
1575
attr[attrname] = (
1576
dbus.service.method(
1577
alt_interface,
1578
attribute._dbus_in_signature,
1579
attribute._dbus_out_signature)
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1119
attr[attrname] = (dbus.service.method
1120
(alt_interface,
1121
attribute._dbus_in_signature,
1122
attribute._dbus_out_signature)
1123
(types.FunctionType
1124
(attribute.func_code,
1125
attribute.func_globals,
1126
attribute.func_name,
1127
attribute.func_defaults,
1128
attribute.func_closure)))
1585
1129
# Copy annotations, if any
1586
1130
try:
1587
attr[attrname]._dbus_annotations = dict(
1588
attribute._dbus_annotations)
1131
attr[attrname]._dbus_annotations = (
1132
dict(attribute._dbus_annotations))
1589
1133
except AttributeError:
1590
1134
pass
1591
1135
# Is this a D-Bus property?
1594
1138
# object, and decorate it to be a new D-Bus
1595
1139
# property with the alternate D-Bus interface
1596
1140
# name. Add it to the class.
1597
attr[attrname] = (dbus_service_property(
1598
alt_interface, attribute._dbus_signature,
1599
attribute._dbus_access,
1600
attribute._dbus_get_args_options
1601
["byte_arrays"])
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1141
attr[attrname] = (dbus_service_property
1142
(alt_interface,
1143
attribute._dbus_signature,
1144
attribute._dbus_access,
1145
attribute
1146
._dbus_get_args_options
1147
["byte_arrays"])
1148
(types.FunctionType
1149
(attribute.func_code,
1150
attribute.func_globals,
1151
attribute.func_name,
1152
attribute.func_defaults,
1153
attribute.func_closure)))
1608
1154
# Copy annotations, if any
1609
1155
try:
1610
attr[attrname]._dbus_annotations = dict(
1611
attribute._dbus_annotations)
1156
attr[attrname]._dbus_annotations = (
1157
dict(attribute._dbus_annotations))
1612
1158
except AttributeError:
1613
1159
pass
1614
1160
# Is this a D-Bus interface?
1617
1163
# object. Decorate it to be a new D-Bus interface
1618
1164
# with the alternate D-Bus interface name. Add it
1619
1165
# to the class.
1620
attr[attrname] = (
1621
dbus_interface_annotations(alt_interface)
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1166
attr[attrname] = (dbus_interface_annotations
1167
(alt_interface)
1168
(types.FunctionType
1169
(attribute.func_code,
1170
attribute.func_globals,
1171
attribute.func_name,
1172
attribute.func_defaults,
1173
attribute.func_closure)))
1627
1174
if deprecate:
1628
1175
# Deprecate all alternate interfaces
1629
iname="_AlternateDBusNames_interface_annotation{}"
1176
iname="_AlternateDBusNames_interface_annotation{0}"
1630
1177
for interface_name in interface_names:
1631
1632
1178
@dbus_interface_annotations(interface_name)
1633
1179
def func(self):
1634
1180
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1181
"true" }
1636
1182
# Find an unused name
1637
1183
for aname in (iname.format(i)
1638
1184
for i in itertools.count()):
1642
1188
if interface_names:
1643
1189
# Replace the class with a new subclass of it with
1644
1190
# methods, signals, etc. as created above.
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1191
cls = type(b"{0}Alternate".format(cls.__name__),
1192
(cls,), attr)
1647
1193
return cls
1648
1649
1194
return wrapper
1650
1195
1651
1196
1652
1197
@alternate_dbus_interfaces({"se.recompile.Mandos":
1653
"se.bsnet.fukt.Mandos"})
1198
"se.bsnet.fukt.Mandos"})
1654
1199
class ClientDBus(Client, DBusObjectWithProperties):
1655
1200
"""A Client class using D-Bus
1656
1201
1660
1205
"""
1661
1206
1662
1207
runtime_expansions = (Client.runtime_expansions
1663
+ ("dbus_object_path", ))
1664
1665
_interface = "se.recompile.Mandos.Client"
1208
+ ("dbus_object_path",))
1666
1209
1667
1210
# dbus.service.Object doesn't use super(), so we can't either.
1668
1211
1671
1214
Client.__init__(self, *args, **kwargs)
1672
1215
# Only now, when this client is initialized, can it show up on
1673
1216
# the D-Bus
1674
client_object_name = str(self.name).translate(
1217
client_object_name = unicode(self.name).translate(
1675
1218
{ord("."): ord("_"),
1676
1219
ord("-"): ord("_")})
1677
self.dbus_object_path = dbus.ObjectPath(
1678
"/clients/" + client_object_name)
1220
self.dbus_object_path = (dbus.ObjectPath
1221
("/clients/" + client_object_name))
1679
1222
DBusObjectWithProperties.__init__(self, self.bus,
1680
1223
self.dbus_object_path)
1681
1224
1682
def notifychangeproperty(transform_func, dbus_name,
1683
type_func=lambda x: x,
1684
variant_level=1,
1685
invalidate_only=False,
1686
_interface=_interface):
1225
def notifychangeproperty(transform_func,
1226
dbus_name, type_func=lambda x: x,
1227
variant_level=1):
1687
1228
""" Modify a variable so that it's a property which announces
1688
1229
its changes to DBus.
1689
1230
1694
1235
to the D-Bus. Default: no transform
1695
1236
variant_level: D-Bus variant level. Default: 1
1696
1237
"""
1697
attrname = "_{}".format(dbus_name)
1698
1238
attrname = "_{0}".format(dbus_name)
1699
1239
def setter(self, value):
1700
1240
if hasattr(self, "dbus_object_path"):
1701
1241
if (not hasattr(self, attrname) or
1702
1242
type_func(getattr(self, attrname, None))
1703
1243
!= type_func(value)):
1704
if invalidate_only:
1705
self.PropertiesChanged(
1706
_interface, dbus.Dictionary(),
1707
dbus.Array((dbus_name, )))
1708
else:
1709
dbus_value = transform_func(
1710
type_func(value),
1711
variant_level = variant_level)
1712
self.PropertyChanged(dbus.String(dbus_name),
1713
dbus_value)
1714
self.PropertiesChanged(
1715
_interface,
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1718
dbus.Array())
1244
dbus_value = transform_func(type_func(value),
1245
variant_level
1246
=variant_level)
1247
self.PropertyChanged(dbus.String(dbus_name),
1248
dbus_value)
1719
1249
setattr(self, attrname, value)
1720
1250
1721
1251
return property(lambda self: getattr(self, attrname), setter)
1727
1257
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1728
1258
last_enabled = notifychangeproperty(datetime_to_dbus,
1729
1259
"LastEnabled")
1730
checker = notifychangeproperty(
1731
dbus.Boolean, "CheckerRunning",
1732
type_func = lambda checker: checker is not None)
1260
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1261
type_func = lambda checker:
1262
checker is not None)
1733
1263
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1734
1264
"LastCheckedOK")
1735
1265
last_checker_status = notifychangeproperty(dbus.Int16,
1738
1268
datetime_to_dbus, "LastApprovalRequest")
1739
1269
approved_by_default = notifychangeproperty(dbus.Boolean,
1740
1270
"ApprovedByDefault")
1741
approval_delay = notifychangeproperty(
1742
dbus.UInt64, "ApprovalDelay",
1743
type_func = lambda td: td.total_seconds() * 1000)
1271
approval_delay = notifychangeproperty(dbus.UInt64,
1272
"ApprovalDelay",
1273
type_func =
1274
timedelta_to_milliseconds)
1744
1275
approval_duration = notifychangeproperty(
1745
1276
dbus.UInt64, "ApprovalDuration",
1746
type_func = lambda td: td.total_seconds() * 1000)
1277
type_func = timedelta_to_milliseconds)
1747
1278
host = notifychangeproperty(dbus.String, "Host")
1748
timeout = notifychangeproperty(
1749
dbus.UInt64, "Timeout",
1750
type_func = lambda td: td.total_seconds() * 1000)
1279
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
type_func =
1281
timedelta_to_milliseconds)
1751
1282
extended_timeout = notifychangeproperty(
1752
1283
dbus.UInt64, "ExtendedTimeout",
1753
type_func = lambda td: td.total_seconds() * 1000)
1754
interval = notifychangeproperty(
1755
dbus.UInt64, "Interval",
1756
type_func = lambda td: td.total_seconds() * 1000)
1284
type_func = timedelta_to_milliseconds)
1285
interval = notifychangeproperty(dbus.UInt64,
1286
"Interval",
1287
type_func =
1288
timedelta_to_milliseconds)
1757
1289
checker_command = notifychangeproperty(dbus.String, "Checker")
1758
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1759
invalidate_only=True)
1760
1290
1761
1291
del notifychangeproperty
1762
1292
1769
1299
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1770
1300
Client.__del__(self, *args, **kwargs)
1771
1301
1772
def checker_callback(self, source, condition,
1773
connection, command, *args, **kwargs):
1774
ret = Client.checker_callback(self, source, condition,
1775
connection, command, *args,
1776
**kwargs)
1777
exitstatus = self.last_checker_status
1778
if exitstatus >= 0:
1302
def checker_callback(self, pid, condition, command,
1303
*args, **kwargs):
1304
self.checker_callback_tag = None
1305
self.checker = None
1306
if os.WIFEXITED(condition):
1307
exitstatus = os.WEXITSTATUS(condition)
1779
1308
# Emit D-Bus signal
1780
1309
self.CheckerCompleted(dbus.Int16(exitstatus),
1781
# This is specific to GNU libC
1782
dbus.Int64(exitstatus << 8),
1310
dbus.Int64(condition),
1783
1311
dbus.String(command))
1784
1312
else:
1785
1313
# Emit D-Bus signal
1786
1314
self.CheckerCompleted(dbus.Int16(-1),
1787
dbus.Int64(
1788
# This is specific to GNU libC
1789
(exitstatus << 8)
1790
| self.last_checker_signal),
1315
dbus.Int64(condition),
1791
1316
dbus.String(command))
1792
return ret
1317
1318
return Client.checker_callback(self, pid, condition, command,
1319
*args, **kwargs)
1793
1320
1794
1321
def start_checker(self, *args, **kwargs):
1795
old_checker_pid = getattr(self.checker, "pid", None)
1322
old_checker = self.checker
1323
if self.checker is not None:
1324
old_checker_pid = self.checker.pid
1325
else:
1326
old_checker_pid = None
1796
1327
r = Client.start_checker(self, *args, **kwargs)
1797
1328
# Only if new checker process was started
1798
1329
if (self.checker is not None
1807
1338
1808
1339
def approve(self, value=True):
1809
1340
self.approved = value
1810
GObject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1341
gobject.timeout_add(timedelta_to_milliseconds
1342
(self.approval_duration),
1343
self._reset_approved)
1812
1344
self.send_changedstate()
1813
1345
1814
1346
## D-Bus methods, signals & properties
1347
_interface = "se.recompile.Mandos.Client"
1815
1348
1816
1349
## Interfaces
1817
1350
1351
@dbus_interface_annotations(_interface)
1352
def _foo(self):
1353
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1354
"false"}
1355
1818
1356
## Signals
1819
1357
1820
1358
# CheckerCompleted - signal
1830
1368
pass
1831
1369
1832
1370
# PropertyChanged - signal
1833
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1834
1371
@dbus.service.signal(_interface, signature="sv")
1835
1372
def PropertyChanged(self, property, value):
1836
1373
"D-Bus signal"
1870
1407
self.checked_ok()
1871
1408
1872
1409
# Enable - method
1873
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1874
1410
@dbus.service.method(_interface)
1875
1411
def Enable(self):
1876
1412
"D-Bus method"
1877
1413
self.enable()
1878
1414
1879
1415
# StartChecker - method
1880
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1881
1416
@dbus.service.method(_interface)
1882
1417
def StartChecker(self):
1883
1418
"D-Bus method"
1884
1419
self.start_checker()
1885
1420
1886
1421
# Disable - method
1887
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1888
1422
@dbus.service.method(_interface)
1889
1423
def Disable(self):
1890
1424
"D-Bus method"
1891
1425
self.disable()
1892
1426
1893
1427
# StopChecker - method
1894
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1895
1428
@dbus.service.method(_interface)
1896
1429
def StopChecker(self):
1897
1430
self.stop_checker()
1904
1437
return dbus.Boolean(bool(self.approvals_pending))
1905
1438
1906
1439
# ApprovedByDefault - property
1907
@dbus_service_property(_interface,
1908
signature="b",
1440
@dbus_service_property(_interface, signature="b",
1909
1441
access="readwrite")
1910
1442
def ApprovedByDefault_dbus_property(self, value=None):
1911
1443
if value is None: # get
1913
1445
self.approved_by_default = bool(value)
1914
1446
1915
1447
# ApprovalDelay - property
1916
@dbus_service_property(_interface,
1917
signature="t",
1448
@dbus_service_property(_interface, signature="t",
1918
1449
access="readwrite")
1919
1450
def ApprovalDelay_dbus_property(self, value=None):
1920
1451
if value is None: # get
1921
return dbus.UInt64(self.approval_delay.total_seconds()
1922
* 1000)
1452
return dbus.UInt64(self.approval_delay_milliseconds())
1923
1453
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1924
1454
1925
1455
# ApprovalDuration - property
1926
@dbus_service_property(_interface,
1927
signature="t",
1456
@dbus_service_property(_interface, signature="t",
1928
1457
access="readwrite")
1929
1458
def ApprovalDuration_dbus_property(self, value=None):
1930
1459
if value is None: # get
1931
return dbus.UInt64(self.approval_duration.total_seconds()
1932
* 1000)
1460
return dbus.UInt64(timedelta_to_milliseconds(
1461
self.approval_duration))
1933
1462
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1934
1463
1935
1464
# Name - property
1936
@dbus_annotations(
1937
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1938
1465
@dbus_service_property(_interface, signature="s", access="read")
1939
1466
def Name_dbus_property(self):
1940
1467
return dbus.String(self.name)
1941
1468
1942
1469
# Fingerprint - property
1943
@dbus_annotations(
1944
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1945
1470
@dbus_service_property(_interface, signature="s", access="read")
1946
1471
def Fingerprint_dbus_property(self):
1947
1472
return dbus.String(self.fingerprint)
1948
1473
1949
1474
# Host - property
1950
@dbus_service_property(_interface,
1951
signature="s",
1475
@dbus_service_property(_interface, signature="s",
1952
1476
access="readwrite")
1953
1477
def Host_dbus_property(self, value=None):
1954
1478
if value is None: # get
1955
1479
return dbus.String(self.host)
1956
self.host = str(value)
1480
self.host = unicode(value)
1957
1481
1958
1482
# Created - property
1959
@dbus_annotations(
1960
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1961
1483
@dbus_service_property(_interface, signature="s", access="read")
1962
1484
def Created_dbus_property(self):
1963
1485
return datetime_to_dbus(self.created)
1968
1490
return datetime_to_dbus(self.last_enabled)
1969
1491
1970
1492
# Enabled - property
1971
@dbus_service_property(_interface,
1972
signature="b",
1493
@dbus_service_property(_interface, signature="b",
1973
1494
access="readwrite")
1974
1495
def Enabled_dbus_property(self, value=None):
1975
1496
if value is None: # get
1980
1501
self.disable()
1981
1502
1982
1503
# LastCheckedOK - property
1983
@dbus_service_property(_interface,
1984
signature="s",
1504
@dbus_service_property(_interface, signature="s",
1985
1505
access="readwrite")
1986
1506
def LastCheckedOK_dbus_property(self, value=None):
1987
1507
if value is not None:
1990
1510
return datetime_to_dbus(self.last_checked_ok)
1991
1511
1992
1512
# LastCheckerStatus - property
1993
@dbus_service_property(_interface, signature="n", access="read")
1513
@dbus_service_property(_interface, signature="n",
1514
access="read")
1994
1515
def LastCheckerStatus_dbus_property(self):
1995
1516
return dbus.Int16(self.last_checker_status)
1996
1517
2005
1526
return datetime_to_dbus(self.last_approval_request)
2006
1527
2007
1528
# Timeout - property
2008
@dbus_service_property(_interface,
2009
signature="t",
1529
@dbus_service_property(_interface, signature="t",
2010
1530
access="readwrite")
2011
1531
def Timeout_dbus_property(self, value=None):
2012
1532
if value is None: # get
2013
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1533
return dbus.UInt64(self.timeout_milliseconds())
2014
1534
old_timeout = self.timeout
2015
1535
self.timeout = datetime.timedelta(0, 0, 0, value)
2016
1536
# Reschedule disabling
2024
1544
if (getattr(self, "disable_initiator_tag", None)
2025
1545
is None):
2026
1546
return
2027
GObject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = GObject.timeout_add(
2029
int((self.expires - now).total_seconds() * 1000),
2030
self.disable)
1547
gobject.source_remove(self.disable_initiator_tag)
1548
self.disable_initiator_tag = (
1549
gobject.timeout_add(
1550
timedelta_to_milliseconds(self.expires - now),
1551
self.disable))
2031
1552
2032
1553
# ExtendedTimeout - property
2033
@dbus_service_property(_interface,
2034
signature="t",
1554
@dbus_service_property(_interface, signature="t",
2035
1555
access="readwrite")
2036
1556
def ExtendedTimeout_dbus_property(self, value=None):
2037
1557
if value is None: # get
2038
return dbus.UInt64(self.extended_timeout.total_seconds()
2039
* 1000)
1558
return dbus.UInt64(self.extended_timeout_milliseconds())
2040
1559
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2041
1560
2042
1561
# Interval - property
2043
@dbus_service_property(_interface,
2044
signature="t",
1562
@dbus_service_property(_interface, signature="t",
2045
1563
access="readwrite")
2046
1564
def Interval_dbus_property(self, value=None):
2047
1565
if value is None: # get
2048
return dbus.UInt64(self.interval.total_seconds() * 1000)
1566
return dbus.UInt64(self.interval_milliseconds())
2049
1567
self.interval = datetime.timedelta(0, 0, 0, value)
2050
1568
if getattr(self, "checker_initiator_tag", None) is None:
2051
1569
return
2052
1570
if self.enabled:
2053
1571
# Reschedule checker run
2054
GObject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = GObject.timeout_add(
2056
value, self.start_checker)
2057
self.start_checker() # Start one now, too
1572
gobject.source_remove(self.checker_initiator_tag)
1573
self.checker_initiator_tag = (gobject.timeout_add
1574
(value, self.start_checker))
1575
self.start_checker() # Start one now, too
2058
1576
2059
1577
# Checker - property
2060
@dbus_service_property(_interface,
2061
signature="s",
1578
@dbus_service_property(_interface, signature="s",
2062
1579
access="readwrite")
2063
1580
def Checker_dbus_property(self, value=None):
2064
1581
if value is None: # get
2065
1582
return dbus.String(self.checker_command)
2066
self.checker_command = str(value)
1583
self.checker_command = unicode(value)
2067
1584
2068
1585
# CheckerRunning - property
2069
@dbus_service_property(_interface,
2070
signature="b",
1586
@dbus_service_property(_interface, signature="b",
2071
1587
access="readwrite")
2072
1588
def CheckerRunning_dbus_property(self, value=None):
2073
1589
if value is None: # get
2078
1594
self.stop_checker()
2079
1595
2080
1596
# ObjectPath - property
2081
@dbus_annotations(
2082
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2083
"org.freedesktop.DBus.Deprecated": "true"})
2084
1597
@dbus_service_property(_interface, signature="o", access="read")
2085
1598
def ObjectPath_dbus_property(self):
2086
1599
return self.dbus_object_path # is already a dbus.ObjectPath
2087
1600
2088
1601
# Secret = property
2089
@dbus_annotations(
2090
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2091
"invalidates"})
2092
@dbus_service_property(_interface,
2093
signature="ay",
2094
access="write",
2095
byte_arrays=True)
1602
@dbus_service_property(_interface, signature="ay",
1603
access="write", byte_arrays=True)
2096
1604
def Secret_dbus_property(self, value):
2097
self.secret = bytes(value)
1605
self.secret = str(value)
2098
1606
2099
1607
del _interface
2100
1608
2104
1612
self._pipe = child_pipe
2105
1613
self._pipe.send(('init', fpr, address))
2106
1614
if not self._pipe.recv():
2107
raise KeyError(fpr)
1615
raise KeyError()
2108
1616
2109
1617
def __getattribute__(self, name):
2110
1618
if name == '_pipe':
2114
1622
if data[0] == 'data':
2115
1623
return data[1]
2116
1624
if data[0] == 'function':
2117
2118
1625
def func(*args, **kwargs):
2119
1626
self._pipe.send(('funcall', name, args, kwargs))
2120
1627
return self._pipe.recv()[1]
2121
2122
1628
return func
2123
1629
2124
1630
def __setattr__(self, name, value):
2136
1642
def handle(self):
2137
1643
with contextlib.closing(self.server.child_pipe) as child_pipe:
2138
1644
logger.info("TCP connection from: %s",
2139
str(self.client_address))
1645
unicode(self.client_address))
2140
1646
logger.debug("Pipe FD: %d",
2141
1647
self.server.child_pipe.fileno())
2142
1648
2143
session = gnutls.ClientSession(self.request)
1649
session = (gnutls.connection
1650
.ClientSession(self.request,
1651
gnutls.connection
1652
.X509Credentials()))
1653
1654
# Note: gnutls.connection.X509Credentials is really a
1655
# generic GnuTLS certificate credentials object so long as
1656
# no X.509 keys are added to it. Therefore, we can use it
1657
# here despite using OpenPGP certificates.
2144
1658
2145
1659
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
1660
# "+AES-256-CBC", "+SHA1",
2150
1664
priority = self.server.gnutls_priority
2151
1665
if priority is None:
2152
1666
priority = "NORMAL"
2153
gnutls.priority_set_direct(session._c_object, priority,
2154
None)
1667
(gnutls.library.functions
1668
.gnutls_priority_set_direct(session._c_object,
1669
priority, None))
2155
1670
2156
1671
# Start communication using the Mandos protocol
2157
1672
# Get protocol number
2159
1674
logger.debug("Protocol version: %r", line)
2160
1675
try:
2161
1676
if int(line.strip().split()[0]) > 1:
2162
raise RuntimeError(line)
1677
raise RuntimeError
2163
1678
except (ValueError, IndexError, RuntimeError) as error:
2164
1679
logger.error("Unknown protocol version: %s", error)
2165
1680
return
2167
1682
# Start GnuTLS connection
2168
1683
try:
2169
1684
session.handshake()
2170
except gnutls.Error as error:
1685
except gnutls.errors.GNUTLSError as error:
2171
1686
logger.warning("Handshake failed: %s", error)
2172
1687
# Do not run session.bye() here: the session is not
2173
1688
# established. Just abandon the request.
2177
1692
approval_required = False
2178
1693
try:
2179
1694
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
1695
fpr = self.fingerprint(self.peer_certificate
1696
(session))
1697
except (TypeError,
1698
gnutls.errors.GNUTLSError) as error:
2183
1699
logger.warning("Bad certificate: %s", error)
2184
1700
return
2185
1701
logger.debug("Fingerprint: %s", fpr)
2198
1714
while True:
2199
1715
if not client.enabled:
2200
1716
logger.info("Client %s is disabled",
2201
client.name)
1717
client.name)
2202
1718
if self.server.use_dbus:
2203
1719
# Emit D-Bus signal
2204
1720
client.Rejected("Disabled")
2213
1729
if self.server.use_dbus:
2214
1730
# Emit D-Bus signal
2215
1731
client.NeedApproval(
2216
client.approval_delay.total_seconds()
2217
* 1000, client.approved_by_default)
1732
client.approval_delay_milliseconds(),
1733
client.approved_by_default)
2218
1734
else:
2219
1735
logger.warning("Client %s was not approved",
2220
1736
client.name)
2226
1742
#wait until timeout or approved
2227
1743
time = datetime.datetime.now()
2228
1744
client.changedstate.acquire()
2229
client.changedstate.wait(delay.total_seconds())
1745
client.changedstate.wait(
1746
float(timedelta_to_milliseconds(delay)
1747
/ 1000))
2230
1748
client.changedstate.release()
2231
1749
time2 = datetime.datetime.now()
2232
1750
if (time2 - time) >= delay:
2243
1761
else:
2244
1762
delay -= time2 - time
2245
1763
2246
try:
2247
session.send(client.secret)
2248
except gnutls.Error as error:
2249
logger.warning("gnutls send failed",
2250
exc_info = error)
2251
return
1764
sent_size = 0
1765
while sent_size < len(client.secret):
1766
try:
1767
sent = session.send(client.secret[sent_size:])
1768
except gnutls.errors.GNUTLSError as error:
1769
logger.warning("gnutls send failed",
1770
exc_info=error)
1771
return
1772
logger.debug("Sent: %d, remaining: %d",
1773
sent, len(client.secret)
1774
- (sent_size + sent))
1775
sent_size += sent
2252
1776
2253
1777
logger.info("Sending secret to %s", client.name)
2254
1778
# bump the timeout using extended_timeout
2262
1786
client.approvals_pending -= 1
2263
1787
try:
2264
1788
session.bye()
2265
except gnutls.Error as error:
1789
except gnutls.errors.GNUTLSError as error:
2266
1790
logger.warning("GnuTLS bye failed",
2267
1791
exc_info=error)
2268
1792
2270
1794
def peer_certificate(session):
2271
1795
"Return the peer's OpenPGP certificate as a bytestring"
2272
1796
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2275
# ...return invalid data
2276
return b""
1797
if (gnutls.library.functions
1798
.gnutls_certificate_type_get(session._c_object)
1799
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1800
# ...do the normal thing
1801
return session.peer_certificate
2277
1802
list_size = ctypes.c_uint(1)
2278
cert_list = (gnutls.certificate_get_peers
1803
cert_list = (gnutls.library.functions
1804
.gnutls_certificate_get_peers
2279
1805
(session._c_object, ctypes.byref(list_size)))
2280
1806
if not bool(cert_list) and list_size.value != 0:
2281
raise gnutls.Error("error getting peer certificate")
1807
raise gnutls.errors.GNUTLSError("error getting peer"
1808
" certificate")
2282
1809
if list_size.value == 0:
2283
1810
return None
2284
1811
cert = cert_list[0]
2288
1815
def fingerprint(openpgp):
2289
1816
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2290
1817
# New GnuTLS "datum" with the OpenPGP public key
2291
datum = gnutls.datum_t(
2292
ctypes.cast(ctypes.c_char_p(openpgp),
2293
ctypes.POINTER(ctypes.c_ubyte)),
2294
ctypes.c_uint(len(openpgp)))
1818
datum = (gnutls.library.types
1819
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1820
ctypes.POINTER
1821
(ctypes.c_ubyte)),
1822
ctypes.c_uint(len(openpgp))))
2295
1823
# New empty GnuTLS certificate
2296
crt = gnutls.openpgp_crt_t()
2297
gnutls.openpgp_crt_init(ctypes.byref(crt))
1824
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1825
(gnutls.library.functions
1826
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2298
1827
# Import the OpenPGP public key into the certificate
2299
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2300
gnutls.OPENPGP_FMT_RAW)
1828
(gnutls.library.functions
1829
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1830
gnutls.library.constants
1831
.GNUTLS_OPENPGP_FMT_RAW))
2301
1832
# Verify the self signature in the key
2302
1833
crtverify = ctypes.c_uint()
2303
gnutls.openpgp_crt_verify_self(crt, 0,
2304
ctypes.byref(crtverify))
1834
(gnutls.library.functions
1835
.gnutls_openpgp_crt_verify_self(crt, 0,
1836
ctypes.byref(crtverify)))
2305
1837
if crtverify.value != 0:
2306
gnutls.openpgp_crt_deinit(crt)
2307
raise gnutls.CertificateSecurityError("Verify failed")
1838
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1839
raise (gnutls.errors.CertificateSecurityError
1840
("Verify failed"))
2308
1841
# New buffer for the fingerprint
2309
1842
buf = ctypes.create_string_buffer(20)
2310
1843
buf_len = ctypes.c_size_t()
2311
1844
# Get the fingerprint from the certificate into the buffer
2312
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2313
ctypes.byref(buf_len))
1845
(gnutls.library.functions
1846
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1847
ctypes.byref(buf_len)))
2314
1848
# Deinit the certificate
2315
gnutls.openpgp_crt_deinit(crt)
1849
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2316
1850
# Convert the buffer to a Python bytestring
2317
1851
fpr = ctypes.string_at(buf, buf_len.value)
2318
1852
# Convert the bytestring to hexadecimal notation
2322
1856
2323
1857
class MultiprocessingMixIn(object):
2324
1858
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2325
2326
1859
def sub_process_main(self, request, address):
2327
1860
try:
2328
1861
self.finish_request(request, address)
2340
1873
2341
1874
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2342
1875
""" adds a pipe to the MixIn """
2343
2344
1876
def process_request(self, request, client_address):
2345
1877
"""Overrides and wraps the original process_request().
2346
1878
2355
1887
2356
1888
def add_pipe(self, parent_pipe, proc):
2357
1889
"""Dummy function; override as necessary"""
2358
raise NotImplementedError()
1890
raise NotImplementedError
2359
1891
2360
1892
2361
1893
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2367
1899
interface: None or a network interface name (string)
2368
1900
use_ipv6: Boolean; to use IPv6 or not
2369
1901
"""
2370
2371
1902
def __init__(self, server_address, RequestHandlerClass,
2372
interface=None,
2373
use_ipv6=True,
2374
socketfd=None):
1903
interface=None, use_ipv6=True, socketfd=None):
2375
1904
"""If socketfd is set, use that file descriptor instead of
2376
1905
creating a new one with socket.socket().
2377
1906
"""
2418
1947
self.interface)
2419
1948
else:
2420
1949
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
1950
self.socket.setsockopt(socket.SOL_SOCKET,
1951
SO_BINDTODEVICE,
1952
str(self.interface + '\0'))
2424
1953
except socket.error as error:
2425
1954
if error.errno == errno.EPERM:
2426
1955
logger.error("No permission to bind to"
2440
1969
if self.address_family == socket.AF_INET6:
2441
1970
any_address = "::" # in6addr_any
2442
1971
else:
2443
any_address = "0.0.0.0" # INADDR_ANY
1972
any_address = socket.INADDR_ANY
2444
1973
self.server_address = (any_address,
2445
1974
self.server_address[1])
2446
1975
elif not self.server_address[1]:
2447
self.server_address = (self.server_address[0], 0)
1976
self.server_address = (self.server_address[0],
1977
0)
2448
1978
# if self.interface:
2449
1979
# self.server_address = (self.server_address[0],
2450
1980
# 0, # port
2462
1992
gnutls_priority GnuTLS priority string
2463
1993
use_dbus: Boolean; to emit D-Bus signals or not
2464
1994
2465
Assumes a GObject.MainLoop event loop.
1995
Assumes a gobject.MainLoop event loop.
2466
1996
"""
2467
2468
1997
def __init__(self, server_address, RequestHandlerClass,
2469
interface=None,
2470
use_ipv6=True,
2471
clients=None,
2472
gnutls_priority=None,
2473
use_dbus=True,
2474
socketfd=None):
1998
interface=None, use_ipv6=True, clients=None,
1999
gnutls_priority=None, use_dbus=True, socketfd=None):
2475
2000
self.enabled = False
2476
2001
self.clients = clients
2477
2002
if self.clients is None:
2483
2008
interface = interface,
2484
2009
use_ipv6 = use_ipv6,
2485
2010
socketfd = socketfd)
2486
2487
2011
def server_activate(self):
2488
2012
if self.enabled:
2489
2013
return socketserver.TCPServer.server_activate(self)
2493
2017
2494
2018
def add_pipe(self, parent_pipe, proc):
2495
2019
# Call "handle_ipc" for both data and EOF events
2496
GObject.io_add_watch(
2497
parent_pipe.fileno(),
2498
GObject.IO_IN | GObject.IO_HUP,
2499
functools.partial(self.handle_ipc,
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2020
gobject.io_add_watch(parent_pipe.fileno(),
2021
gobject.IO_IN | gobject.IO_HUP,
2022
functools.partial(self.handle_ipc,
2023
parent_pipe =
2024
parent_pipe,
2025
proc = proc))
2502
2026
2503
def handle_ipc(self, source, condition,
2504
parent_pipe=None,
2505
proc = None,
2506
client_object=None):
2027
def handle_ipc(self, source, condition, parent_pipe=None,
2028
proc = None, client_object=None):
2507
2029
# error, or the other end of multiprocessing.Pipe has closed
2508
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2030
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2509
2031
# Wait for other process to exit
2510
2032
proc.join()
2511
2033
return False
2532
2054
parent_pipe.send(False)
2533
2055
return False
2534
2056
2535
GObject.io_add_watch(
2536
parent_pipe.fileno(),
2537
GObject.IO_IN | GObject.IO_HUP,
2538
functools.partial(self.handle_ipc,
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2057
gobject.io_add_watch(parent_pipe.fileno(),
2058
gobject.IO_IN | gobject.IO_HUP,
2059
functools.partial(self.handle_ipc,
2060
parent_pipe =
2061
parent_pipe,
2062
proc = proc,
2063
client_object =
2064
client))
2542
2065
parent_pipe.send(True)
2543
2066
# remove the old hook in favor of the new above hook on
2544
2067
# same fileno
2550
2073
2551
2074
parent_pipe.send(('data', getattr(client_object,
2552
2075
funcname)(*args,
2553
**kwargs)))
2076
**kwargs)))
2554
2077
2555
2078
if command == 'getattr':
2556
2079
attrname = request[1]
2557
if isinstance(client_object.__getattribute__(attrname),
2558
collections.Callable):
2559
parent_pipe.send(('function', ))
2080
if callable(client_object.__getattribute__(attrname)):
2081
parent_pipe.send(('function',))
2560
2082
else:
2561
parent_pipe.send((
2562
'data', client_object.__getattribute__(attrname)))
2083
parent_pipe.send(('data', client_object
2084
.__getattribute__(attrname)))
2563
2085
2564
2086
if command == 'setattr':
2565
2087
attrname = request[1]
2596
2118
# avoid excessive use of external libraries.
2597
2119
2598
2120
# New type for defining tokens, syntax, and semantics all-in-one
2599
Token = collections.namedtuple("Token", (
2600
"regexp", # To match token; if "value" is not None, must have
2601
# a "group" containing digits
2602
"value", # datetime.timedelta or None
2603
"followers")) # Tokens valid after this token
2121
Token = collections.namedtuple("Token",
2122
("regexp", # To match token; if
2123
# "value" is not None,
2124
# must have a "group"
2125
# containing digits
2126
"value", # datetime.timedelta or
2127
# None
2128
"followers")) # Tokens valid after
2129
# this token
2604
2130
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2605
2131
# the "duration" ABNF definition in RFC 3339, Appendix A.
2606
2132
token_end = Token(re.compile(r"$"), None, frozenset())
2607
2133
token_second = Token(re.compile(r"(\d+)S"),
2608
2134
datetime.timedelta(seconds=1),
2609
frozenset((token_end, )))
2135
frozenset((token_end,)))
2610
2136
token_minute = Token(re.compile(r"(\d+)M"),
2611
2137
datetime.timedelta(minutes=1),
2612
2138
frozenset((token_second, token_end)))
2628
2154
frozenset((token_month, token_end)))
2629
2155
token_week = Token(re.compile(r"(\d+)W"),
2630
2156
datetime.timedelta(weeks=1),
2631
frozenset((token_end, )))
2157
frozenset((token_end,)))
2632
2158
token_duration = Token(re.compile(r"P"), None,
2633
2159
frozenset((token_year, token_month,
2634
2160
token_day, token_time,
2635
token_week)))
2161
token_week))),
2636
2162
# Define starting values
2637
2163
value = datetime.timedelta() # Value so far
2638
2164
found_token = None
2639
followers = frozenset((token_duration, )) # Following valid tokens
2165
followers = frozenset(token_duration,) # Following valid tokens
2640
2166
s = duration # String left to parse
2641
2167
# Loop until end token is found
2642
2168
while found_token is not token_end:
2659
2185
break
2660
2186
else:
2661
2187
# No currently valid tokens were found
2662
raise ValueError("Invalid RFC 3339 duration: {!r}"
2663
.format(duration))
2188
raise ValueError("Invalid RFC 3339 duration")
2664
2189
# End token found
2665
2190
return value
2666
2191
2690
2215
timevalue = datetime.timedelta(0)
2691
2216
for s in interval.split():
2692
2217
try:
2693
suffix = s[-1]
2218
suffix = unicode(s[-1])
2694
2219
value = int(s[:-1])
2695
2220
if suffix == "d":
2696
2221
delta = datetime.timedelta(value)
2703
2228
elif suffix == "w":
2704
2229
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2705
2230
else:
2706
raise ValueError("Unknown suffix {!r}".format(suffix))
2707
except IndexError as e:
2231
raise ValueError("Unknown suffix {0!r}"
2232
.format(suffix))
2233
except (ValueError, IndexError) as e:
2708
2234
raise ValueError(*(e.args))
2709
2235
timevalue += delta
2710
2236
return timevalue
2726
2252
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2727
2253
if not stat.S_ISCHR(os.fstat(null).st_mode):
2728
2254
raise OSError(errno.ENODEV,
2729
"{} not a character device"
2255
"{0} not a character device"
2730
2256
.format(os.devnull))
2731
2257
os.dup2(null, sys.stdin.fileno())
2732
2258
os.dup2(null, sys.stdout.fileno())
2742
2268
2743
2269
parser = argparse.ArgumentParser()
2744
2270
parser.add_argument("-v", "--version", action="version",
2745
version = "%(prog)s {}".format(version),
2271
version = "%(prog)s {0}".format(version),
2746
2272
help="show version number and exit")
2747
2273
parser.add_argument("-i", "--interface", metavar="IF",
2748
2274
help="Bind to interface IF")
2754
2280
help="Run self-test")
2755
2281
parser.add_argument("--debug", action="store_true",
2756
2282
help="Debug mode; run in foreground and log"
2757
" to terminal", default=None)
2283
" to terminal")
2758
2284
parser.add_argument("--debuglevel", metavar="LEVEL",
2759
2285
help="Debug level for stdout output")
2760
2286
parser.add_argument("--priority", help="GnuTLS"
2767
2293
" files")
2768
2294
parser.add_argument("--no-dbus", action="store_false",
2769
2295
dest="use_dbus", help="Do not provide D-Bus"
2770
" system bus interface", default=None)
2296
" system bus interface")
2771
2297
parser.add_argument("--no-ipv6", action="store_false",
2772
dest="use_ipv6", help="Do not use IPv6",
2773
default=None)
2298
dest="use_ipv6", help="Do not use IPv6")
2774
2299
parser.add_argument("--no-restore", action="store_false",
2775
2300
dest="restore", help="Do not restore stored"
2776
" state", default=None)
2301
" state")
2777
2302
parser.add_argument("--socket", type=int,
2778
2303
help="Specify a file descriptor to a network"
2779
2304
" socket to use instead of creating one")
2780
2305
parser.add_argument("--statedir", metavar="DIR",
2781
2306
help="Directory to save/restore state in")
2782
2307
parser.add_argument("--foreground", action="store_true",
2783
help="Run in foreground", default=None)
2784
parser.add_argument("--no-zeroconf", action="store_false",
2785
dest="zeroconf", help="Do not use Zeroconf",
2786
default=None)
2308
help="Run in foreground")
2787
2309
2788
2310
options = parser.parse_args()
2789
2311
2790
2312
if options.check:
2791
2313
import doctest
2792
fail_count, test_count = doctest.testmod()
2793
sys.exit(os.EX_OK if fail_count == 0 else 1)
2314
doctest.testmod()
2315
sys.exit()
2794
2316
2795
2317
# Default values for config file for server-global settings
2796
2318
server_defaults = { "interface": "",
2798
2320
"port": "",
2799
2321
"debug": "False",
2800
2322
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2323
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2803
2324
"servicename": "Mandos",
2804
2325
"use_dbus": "True",
2805
2326
"use_ipv6": "True",
2808
2329
"socket": "",
2809
2330
"statedir": "/var/lib/mandos",
2810
2331
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2332
}
2813
2333
2814
2334
# Parse config file for server-global settings
2815
2335
server_config = configparser.SafeConfigParser(server_defaults)
2816
2336
del server_defaults
2817
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2337
server_config.read(os.path.join(options.configdir,
2338
"mandos.conf"))
2818
2339
# Convert the SafeConfigParser object to a dict
2819
2340
server_settings = server_config.defaults()
2820
2341
# Use the appropriate methods on the non-string config options
2838
2359
# Override the settings from the config file with command line
2839
2360
# options, if set.
2840
2361
for option in ("interface", "address", "port", "debug",
2841
"priority", "servicename", "configdir", "use_dbus",
2842
"use_ipv6", "debuglevel", "restore", "statedir",
2843
"socket", "foreground", "zeroconf"):
2362
"priority", "servicename", "configdir",
2363
"use_dbus", "use_ipv6", "debuglevel", "restore",
2364
"statedir", "socket", "foreground"):
2844
2365
value = getattr(options, option)
2845
2366
if value is not None:
2846
2367
server_settings[option] = value
2847
2368
del options
2848
2369
# Force all strings to be unicode
2849
2370
for option in server_settings.keys():
2850
if isinstance(server_settings[option], bytes):
2851
server_settings[option] = (server_settings[option]
2852
.decode("utf-8"))
2853
# Force all boolean options to be boolean
2854
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2855
"foreground", "zeroconf"):
2856
server_settings[option] = bool(server_settings[option])
2371
if type(server_settings[option]) is str:
2372
server_settings[option] = unicode(server_settings[option])
2857
2373
# Debug implies foreground
2858
2374
if server_settings["debug"]:
2859
2375
server_settings["foreground"] = True
2861
2377
2862
2378
##################################################################
2863
2379
2864
if (not server_settings["zeroconf"]
2865
and not (server_settings["port"]
2866
or server_settings["socket"] != "")):
2867
parser.error("Needs port or socket to work without Zeroconf")
2868
2869
2380
# For convenience
2870
2381
debug = server_settings["debug"]
2871
2382
debuglevel = server_settings["debuglevel"]
2874
2385
stored_state_path = os.path.join(server_settings["statedir"],
2875
2386
stored_state_file)
2876
2387
foreground = server_settings["foreground"]
2877
zeroconf = server_settings["zeroconf"]
2878
2388
2879
2389
if debug:
2880
2390
initlogger(debug, logging.DEBUG)
2886
2396
initlogger(debug, level)
2887
2397
2888
2398
if server_settings["servicename"] != "Mandos":
2889
syslogger.setFormatter(
2890
logging.Formatter('Mandos ({}) [%(process)d]:'
2891
' %(levelname)s: %(message)s'.format(
2892
server_settings["servicename"])))
2399
syslogger.setFormatter(logging.Formatter
2400
('Mandos ({0}) [%(process)d]:'
2401
' %(levelname)s: %(message)s'
2402
.format(server_settings
2403
["servicename"])))
2893
2404
2894
2405
# Parse config file with clients
2895
2406
client_config = configparser.SafeConfigParser(Client
2900
2411
global mandos_dbus_service
2901
2412
mandos_dbus_service = None
2902
2413
2903
socketfd = None
2904
if server_settings["socket"] != "":
2905
socketfd = server_settings["socket"]
2906
tcp_server = MandosServer(
2907
(server_settings["address"], server_settings["port"]),
2908
ClientHandler,
2909
interface=(server_settings["interface"] or None),
2910
use_ipv6=use_ipv6,
2911
gnutls_priority=server_settings["priority"],
2912
use_dbus=use_dbus,
2913
socketfd=socketfd)
2414
tcp_server = MandosServer((server_settings["address"],
2415
server_settings["port"]),
2416
ClientHandler,
2417
interface=(server_settings["interface"]
2418
or None),
2419
use_ipv6=use_ipv6,
2420
gnutls_priority=
2421
server_settings["priority"],
2422
use_dbus=use_dbus,
2423
socketfd=(server_settings["socket"]
2424
or None))
2914
2425
if not foreground:
2915
pidfilename = "/run/mandos.pid"
2916
if not os.path.isdir("/run/."):
2917
pidfilename = "/var/run/mandos.pid"
2426
pidfilename = "/var/run/mandos.pid"
2918
2427
pidfile = None
2919
2428
try:
2920
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2429
pidfile = open(pidfilename, "w")
2921
2430
except IOError as e:
2922
2431
logger.error("Could not open file %r", pidfilename,
2923
2432
exc_info=e)
2924
2433
2925
for name, group in (("_mandos", "_mandos"),
2926
("mandos", "mandos"),
2927
("nobody", "nogroup")):
2434
for name in ("_mandos", "mandos", "nobody"):
2928
2435
try:
2929
2436
uid = pwd.getpwnam(name).pw_uid
2930
gid = pwd.getpwnam(group).pw_gid
2437
gid = pwd.getpwnam(name).pw_gid
2931
2438
break
2932
2439
except KeyError:
2933
2440
continue
2939
2446
os.setuid(uid)
2940
2447
except OSError as error:
2941
2448
if error.errno != errno.EPERM:
2942
raise
2449
raise error
2943
2450
2944
2451
if debug:
2945
2452
# Enable all possible GnuTLS debugging
2946
2453
2947
2454
# "Use a log level over 10 to enable all debugging options."
2948
2455
# - GnuTLS manual
2949
gnutls.global_set_log_level(11)
2456
gnutls.library.functions.gnutls_global_set_log_level(11)
2950
2457
2951
@gnutls.log_func
2458
@gnutls.library.types.gnutls_log_func
2952
2459
def debug_gnutls(level, string):
2953
2460
logger.debug("GnuTLS: %s", string[:-1])
2954
2461
2955
gnutls.global_set_log_function(debug_gnutls)
2462
(gnutls.library.functions
2463
.gnutls_global_set_log_function(debug_gnutls))
2956
2464
2957
2465
# Redirect stdin so all checkers get /dev/null
2958
2466
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2965
2473
# Close all input and output, do double fork, etc.
2966
2474
daemon()
2967
2475
2968
# multiprocessing will use threads, so before we use GObject we
2969
# need to inform GObject that threads will be used.
2970
GObject.threads_init()
2476
# multiprocessing will use threads, so before we use gobject we
2477
# need to inform gobject that threads will be used.
2478
gobject.threads_init()
2971
2479
2972
2480
global main_loop
2973
2481
# From the Avahi example code
2974
2482
DBusGMainLoop(set_as_default=True)
2975
main_loop = GObject.MainLoop()
2483
main_loop = gobject.MainLoop()
2976
2484
bus = dbus.SystemBus()
2977
2485
# End of Avahi example code
2978
2486
if use_dbus:
2979
2487
try:
2980
2488
bus_name = dbus.service.BusName("se.recompile.Mandos",
2981
bus,
2982
do_not_queue=True)
2983
old_bus_name = dbus.service.BusName(
2984
"se.bsnet.fukt.Mandos", bus,
2985
do_not_queue=True)
2986
except dbus.exceptions.DBusException as e:
2489
bus, do_not_queue=True)
2490
old_bus_name = (dbus.service.BusName
2491
("se.bsnet.fukt.Mandos", bus,
2492
do_not_queue=True))
2493
except dbus.exceptions.NameExistsException as e:
2987
2494
logger.error("Disabling D-Bus:", exc_info=e)
2988
2495
use_dbus = False
2989
2496
server_settings["use_dbus"] = False
2990
2497
tcp_server.use_dbus = False
2991
if zeroconf:
2992
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2993
service = AvahiServiceToSyslog(
2994
name = server_settings["servicename"],
2995
servicetype = "_mandos._tcp",
2996
protocol = protocol,
2997
bus = bus)
2998
if server_settings["interface"]:
2999
service.interface = if_nametoindex(
3000
server_settings["interface"].encode("utf-8"))
2498
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2499
service = AvahiServiceToSyslog(name =
2500
server_settings["servicename"],
2501
servicetype = "_mandos._tcp",
2502
protocol = protocol, bus = bus)
2503
if server_settings["interface"]:
2504
service.interface = (if_nametoindex
2505
(str(server_settings["interface"])))
3001
2506
3002
2507
global multiprocessing_manager
3003
2508
multiprocessing_manager = multiprocessing.Manager()
3010
2515
old_client_settings = {}
3011
2516
clients_data = {}
3012
2517
3013
# This is used to redirect stdout and stderr for checker processes
3014
global wnull
3015
wnull = open(os.devnull, "w") # A writable /dev/null
3016
# Only used if server is running in foreground but not in debug
3017
# mode
3018
if debug or not foreground:
3019
wnull.close()
3020
3021
2518
# Get client data and settings from last running state.
3022
2519
if server_settings["restore"]:
3023
2520
try:
3024
2521
with open(stored_state_path, "rb") as stored_state:
3025
clients_data, old_client_settings = pickle.load(
3026
stored_state)
2522
clients_data, old_client_settings = (pickle.load
2523
(stored_state))
3027
2524
os.remove(stored_state_path)
3028
2525
except IOError as e:
3029
2526
if e.errno == errno.ENOENT:
3030
logger.warning("Could not load persistent state:"
3031
" {}".format(os.strerror(e.errno)))
2527
logger.warning("Could not load persistent state: {0}"
2528
.format(os.strerror(e.errno)))
3032
2529
else:
3033
2530
logger.critical("Could not load persistent state:",
3034
2531
exc_info=e)
3035
2532
raise
3036
2533
except EOFError as e:
3037
2534
logger.warning("Could not load persistent state: "
3038
"EOFError:",
3039
exc_info=e)
2535
"EOFError:", exc_info=e)
3040
2536
3041
2537
with PGPEngine() as pgp:
3042
for client_name, client in clients_data.items():
3043
# Skip removed clients
3044
if client_name not in client_settings:
3045
continue
3046
2538
for client_name, client in clients_data.iteritems():
3047
2539
# Decide which value to use after restoring saved state.
3048
2540
# We have three different values: Old config file,
3049
2541
# new config file, and saved state.
3054
2546
# For each value in new config, check if it
3055
2547
# differs from the old config value (Except for
3056
2548
# the "secret" attribute)
3057
if (name != "secret"
3058
and (value !=
3059
old_client_settings[client_name][name])):
2549
if (name != "secret" and
2550
value != old_client_settings[client_name]
2551
[name]):
3060
2552
client[name] = value
3061
2553
except KeyError:
3062
2554
pass
3063
2555
3064
2556
# Clients who has passed its expire date can still be
3065
# enabled if its last checker was successful. A Client
2557
# enabled if its last checker was successful. Clients
3066
2558
# whose checker succeeded before we stored its state is
3067
2559
# assumed to have successfully run all checkers during
3068
2560
# downtime.
3070
2562
if datetime.datetime.utcnow() >= client["expires"]:
3071
2563
if not client["last_checked_ok"]:
3072
2564
logger.warning(
3073
"disabling client {} - Client never "
3074
"performed a successful checker".format(
3075
client_name))
2565
"disabling client {0} - Client never "
2566
"performed a successful checker"
2567
.format(client_name))
3076
2568
client["enabled"] = False
3077
2569
elif client["last_checker_status"] != 0:
3078
2570
logger.warning(
3079
"disabling client {} - Client last"
3080
" checker failed with error code"
3081
" {}".format(
3082
client_name,
3083
client["last_checker_status"]))
2571
"disabling client {0} - Client "
2572
"last checker failed with error code {1}"
2573
.format(client_name,
2574
client["last_checker_status"]))
3084
2575
client["enabled"] = False
3085
2576
else:
3086
client["expires"] = (
3087
datetime.datetime.utcnow()
3088
+ client["timeout"])
2577
client["expires"] = (datetime.datetime
2578
.utcnow()
2579
+ client["timeout"])
3089
2580
logger.debug("Last checker succeeded,"
3090
" keeping {} enabled".format(
3091
client_name))
2581
" keeping {0} enabled"
2582
.format(client_name))
3092
2583
try:
3093
client["secret"] = pgp.decrypt(
3094
client["encrypted_secret"],
3095
client_settings[client_name]["secret"])
2584
client["secret"] = (
2585
pgp.decrypt(client["encrypted_secret"],
2586
client_settings[client_name]
2587
["secret"]))
3096
2588
except PGPError:
3097
2589
# If decryption fails, we use secret from new settings
3098
logger.debug("Failed to decrypt {} old secret".format(
3099
client_name))
3100
client["secret"] = (client_settings[client_name]
3101
["secret"])
2590
logger.debug("Failed to decrypt {0} old secret"
2591
.format(client_name))
2592
client["secret"] = (
2593
client_settings[client_name]["secret"])
3102
2594
3103
2595
# Add/remove clients based on new changes made to config
3104
2596
for client_name in (set(old_client_settings)
3109
2601
clients_data[client_name] = client_settings[client_name]
3110
2602
3111
2603
# Create all client objects
3112
for client_name, client in clients_data.items():
2604
for client_name, client in clients_data.iteritems():
3113
2605
tcp_server.clients[client_name] = client_class(
3114
name = client_name,
3115
settings = client,
3116
server_settings = server_settings)
2606
name = client_name, settings = client)
3117
2607
3118
2608
if not tcp_server.clients:
3119
2609
logger.warning("No clients defined")
3120
2610
3121
2611
if not foreground:
3122
2612
if pidfile is not None:
3123
pid = os.getpid()
3124
2613
try:
3125
2614
with pidfile:
3126
print(pid, file=pidfile)
2615
pid = os.getpid()
2616
pidfile.write(str(pid) + "\n".encode("utf-8"))
3127
2617
except IOError:
3128
2618
logger.error("Could not write to file %r with PID %d",
3129
2619
pidfilename, pid)
3134
2624
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3135
2625
3136
2626
if use_dbus:
3137
3138
@alternate_dbus_interfaces(
3139
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3140
class MandosDBusService(DBusObjectWithObjectManager):
2627
@alternate_dbus_interfaces({"se.recompile.Mandos":
2628
"se.bsnet.fukt.Mandos"})
2629
class MandosDBusService(DBusObjectWithProperties):
3141
2630
"""A D-Bus proxy object"""
3142
3143
2631
def __init__(self):
3144
2632
dbus.service.Object.__init__(self, bus, "/")
3145
3146
2633
_interface = "se.recompile.Mandos"
3147
2634
2635
@dbus_interface_annotations(_interface)
2636
def _foo(self):
2637
return { "org.freedesktop.DBus.Property"
2638
".EmitsChangedSignal":
2639
"false"}
2640
3148
2641
@dbus.service.signal(_interface, signature="o")
3149
2642
def ClientAdded(self, objpath):
3150
2643
"D-Bus signal"
3155
2648
"D-Bus signal"
3156
2649
pass
3157
2650
3158
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3159
"true"})
3160
2651
@dbus.service.signal(_interface, signature="os")
3161
2652
def ClientRemoved(self, objpath, name):
3162
2653
"D-Bus signal"
3163
2654
pass
3164
2655
3165
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3166
"true"})
3167
2656
@dbus.service.method(_interface, out_signature="ao")
3168
2657
def GetAllClients(self):
3169
2658
"D-Bus method"
3170
return dbus.Array(c.dbus_object_path for c in
2659
return dbus.Array(c.dbus_object_path
2660
for c in
3171
2661
tcp_server.clients.itervalues())
3172
2662
3173
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3174
"true"})
3175
2663
@dbus.service.method(_interface,
3176
2664
out_signature="a{oa{sv}}")
3177
2665
def GetAllClientsWithProperties(self):
3178
2666
"D-Bus method"
3179
2667
return dbus.Dictionary(
3180
{ c.dbus_object_path: c.GetAll(
3181
"se.recompile.Mandos.Client")
3182
for c in tcp_server.clients.itervalues() },
2668
((c.dbus_object_path, c.GetAll(""))
2669
for c in tcp_server.clients.itervalues()),
3183
2670
signature="oa{sv}")
3184
2671
3185
2672
@dbus.service.method(_interface, in_signature="o")
3189
2676
if c.dbus_object_path == object_path:
3190
2677
del tcp_server.clients[c.name]
3191
2678
c.remove_from_connection()
3192
# Don't signal the disabling
2679
# Don't signal anything except ClientRemoved
3193
2680
c.disable(quiet=True)
3194
# Emit D-Bus signal for removal
3195
self.client_removed_signal(c)
2681
# Emit D-Bus signal
2682
self.ClientRemoved(object_path, c.name)
3196
2683
return
3197
2684
raise KeyError(object_path)
3198
2685
3199
2686
del _interface
3200
3201
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3202
out_signature = "a{oa{sa{sv}}}")
3203
def GetManagedObjects(self):
3204
"""D-Bus method"""
3205
return dbus.Dictionary(
3206
{ client.dbus_object_path:
3207
dbus.Dictionary(
3208
{ interface: client.GetAll(interface)
3209
for interface in
3210
client._get_all_interface_names()})
3211
for client in tcp_server.clients.values()})
3212
3213
def client_added_signal(self, client):
3214
"""Send the new standard signal and the old signal"""
3215
if use_dbus:
3216
# New standard signal
3217
self.InterfacesAdded(
3218
client.dbus_object_path,
3219
dbus.Dictionary(
3220
{ interface: client.GetAll(interface)
3221
for interface in
3222
client._get_all_interface_names()}))
3223
# Old signal
3224
self.ClientAdded(client.dbus_object_path)
3225
3226
def client_removed_signal(self, client):
3227
"""Send the new standard signal and the old signal"""
3228
if use_dbus:
3229
# New standard signal
3230
self.InterfacesRemoved(
3231
client.dbus_object_path,
3232
client._get_all_interface_names())
3233
# Old signal
3234
self.ClientRemoved(client.dbus_object_path,
3235
client.name)
3236
2687
3237
2688
mandos_dbus_service = MandosDBusService()
3238
2689
3239
2690
def cleanup():
3240
2691
"Cleanup function; run on exit"
3241
if zeroconf:
3242
service.cleanup()
2692
service.cleanup()
3243
2693
3244
2694
multiprocessing.active_children()
3245
wnull.close()
3246
2695
if not (tcp_server.clients or client_settings):
3247
2696
return
3248
2697
3259
2708
3260
2709
# A list of attributes that can not be pickled
3261
2710
# + secret.
3262
exclude = { "bus", "changedstate", "secret",
3263
"checker", "server_settings" }
3264
for name, typ in inspect.getmembers(dbus.service
3265
.Object):
2711
exclude = set(("bus", "changedstate", "secret",
2712
"checker"))
2713
for name, typ in (inspect.getmembers
2714
(dbus.service.Object)):
3266
2715
exclude.add(name)
3267
2716
3268
2717
client_dict["encrypted_secret"] = (client
3275
2724
del client_settings[client.name]["secret"]
3276
2725
3277
2726
try:
3278
with tempfile.NamedTemporaryFile(
3279
mode='wb',
3280
suffix=".pickle",
3281
prefix='clients-',
3282
dir=os.path.dirname(stored_state_path),
3283
delete=False) as stored_state:
2727
with (tempfile.NamedTemporaryFile
2728
(mode='wb', suffix=".pickle", prefix='clients-',
2729
dir=os.path.dirname(stored_state_path),
2730
delete=False)) as stored_state:
3284
2731
pickle.dump((clients, client_settings), stored_state)
3285
tempname = stored_state.name
2732
tempname=stored_state.name
3286
2733
os.rename(tempname, stored_state_path)
3287
2734
except (IOError, OSError) as e:
3288
2735
if not debug:
3291
2738
except NameError:
3292
2739
pass
3293
2740
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3294
logger.warning("Could not save persistent state: {}"
2741
logger.warning("Could not save persistent state: {0}"
3295
2742
.format(os.strerror(e.errno)))
3296
2743
else:
3297
2744
logger.warning("Could not save persistent state:",
3298
2745
exc_info=e)
3299
raise
2746
raise e
3300
2747
3301
2748
# Delete all clients, and settings from config
3302
2749
while tcp_server.clients:
3303
2750
name, client = tcp_server.clients.popitem()
3304
2751
if use_dbus:
3305
2752
client.remove_from_connection()
3306
# Don't signal the disabling
2753
# Don't signal anything except ClientRemoved
3307
2754
client.disable(quiet=True)
3308
# Emit D-Bus signal for removal
3309
2755
if use_dbus:
3310
mandos_dbus_service.client_removed_signal(client)
2756
# Emit D-Bus signal
2757
mandos_dbus_service.ClientRemoved(client
2758
.dbus_object_path,
2759
client.name)
3311
2760
client_settings.clear()
3312
2761
3313
2762
atexit.register(cleanup)
3314
2763
3315
2764
for client in tcp_server.clients.itervalues():
3316
2765
if use_dbus:
3317
# Emit D-Bus signal for adding
3318
mandos_dbus_service.client_added_signal(client)
2766
# Emit D-Bus signal
2767
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3319
2768
# Need to initiate checking of clients
3320
2769
if client.enabled:
3321
2770
client.init_checker()
3324
2773
tcp_server.server_activate()
3325
2774
3326
2775
# Find out what port we got
3327
if zeroconf:
3328
service.port = tcp_server.socket.getsockname()[1]
2776
service.port = tcp_server.socket.getsockname()[1]
3329
2777
if use_ipv6:
3330
2778
logger.info("Now listening on address %r, port %d,"
3331
2779
" flowinfo %d, scope_id %d",
3337
2785
#service.interface = tcp_server.socket.getsockname()[3]
3338
2786
3339
2787
try:
3340
if zeroconf:
3341
# From the Avahi example code
3342
try:
3343
service.activate()
3344
except dbus.exceptions.DBusException as error:
3345
logger.critical("D-Bus Exception", exc_info=error)
3346
cleanup()
3347
sys.exit(1)
3348
# End of Avahi example code
2788
# From the Avahi example code
2789
try:
2790
service.activate()
2791
except dbus.exceptions.DBusException as error:
2792
logger.critical("D-Bus Exception", exc_info=error)
2793
cleanup()
2794
sys.exit(1)
2795
# End of Avahi example code
3349
2796
3350
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
2797
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3351
2798
lambda *args, **kwargs:
3352
2799
(tcp_server.handle_request
3353
2800
(*args[2:], **kwargs) or True))
3366
2813
# Must run before the D-Bus bus name gets deregistered
3367
2814
cleanup()
3368
2815
3369
3370
2816
if __name__ == '__main__':
3371
2817
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0