To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.2.146
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.146
- Committer: Teddy Hogeborn
- Date: 2009-09-22 20:18:43 UTC
- mto: (24.1.146 mandos) (237.12.2 mandos-persistent) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 270.
- Revision ID: teddy@fukt.bsnet.se-20090922201843-cd5uqnthf3eegg4l
* mandos (Client.start_checker): Bug fix: Fix race condition with
short intervals.
short intervals.
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
import contextlib
58
from contextlib import closing
60
59
import struct
61
60
import fcntl
62
61
import functools
63
import cPickle as pickle
64
import multiprocessing
65
import types
66
import binascii
67
import tempfile
68
62
69
63
import dbus
70
64
import dbus.service
75
69
import ctypes.util
76
70
import xml.dom.minidom
77
71
import inspect
78
import GnuPGInterface
79
72
80
73
try:
81
74
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
86
79
SO_BINDTODEVICE = None
87
80
88
81
89
version = "1.4.1"
90
stored_state_file = "clients.pickle"
82
version = "1.0.12"
91
83
92
logger = logging.getLogger()
84
logger = logging.Logger(u'mandos')
93
85
syslogger = (logging.handlers.SysLogHandler
94
86
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
address = str("/dev/log")))
96
97
try:
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
101
except (OSError, AttributeError):
102
def if_nametoindex(interface):
103
"Get an interface index the hard way, i.e. using fcntl()"
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
with contextlib.closing(socket.socket()) as s:
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
111
return interface_index
112
113
114
def initlogger(level=logging.WARNING):
115
"""init logger and add loglevel"""
116
117
syslogger.setFormatter(logging.Formatter
118
('Mandos [%(process)d]: %(levelname)s:'
119
' %(message)s'))
120
logger.addHandler(syslogger)
121
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
147
def __enter__(self):
148
return self
149
150
def __exit__ (self, exc_type, exc_value, traceback):
151
self._cleanup()
152
return False
153
154
def __del__(self):
155
self._cleanup()
156
157
def _cleanup(self):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
161
topdown = False):
162
for filename in files:
163
os.remove(os.path.join(root, filename))
164
for dirname in dirs:
165
os.rmdir(os.path.join(root, dirname))
166
# Remove tempdir
167
os.rmdir(self.tempdir)
168
self.tempdir = None
169
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
174
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
190
return ciphertext
191
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
208
209
87
address = "/dev/log"))
88
syslogger.setFormatter(logging.Formatter
89
(u'Mandos [%(process)d]: %(levelname)s:'
90
u' %(message)s'))
91
logger.addHandler(syslogger)
92
93
console = logging.StreamHandler()
94
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
95
u' %(levelname)s:'
96
u' %(message)s'))
97
logger.addHandler(console)
210
98
211
99
class AvahiError(Exception):
212
100
def __init__(self, value, *args, **kwargs):
228
116
Attributes:
229
117
interface: integer; avahi.IF_UNSPEC or an interface index.
230
118
Used to optionally bind to the specified interface.
231
name: string; Example: 'Mandos'
232
type: string; Example: '_mandos._tcp'.
119
name: string; Example: u'Mandos'
120
type: string; Example: u'_mandos._tcp'.
233
121
See <http://www.dns-sd.org/ServiceTypes.html>
234
122
port: integer; what port to announce
235
123
TXT: list of strings; TXT record for the service
244
132
"""
245
133
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
246
134
servicetype = None, port = None, TXT = None,
247
domain = "", host = "", max_renames = 32768,
135
domain = u"", host = u"", max_renames = 32768,
248
136
protocol = avahi.PROTO_UNSPEC, bus = None):
249
137
self.interface = interface
250
138
self.name = name
259
147
self.group = None # our entry group
260
148
self.server = None
261
149
self.bus = bus
262
self.entry_group_state_changed_match = None
263
150
def rename(self):
264
151
"""Derived from the Avahi example code"""
265
152
if self.rename_count >= self.max_renames:
266
logger.critical("No suitable Zeroconf service name found"
267
" after %i retries, exiting.",
153
logger.critical(u"No suitable Zeroconf service name found"
154
u" after %i retries, exiting.",
268
155
self.rename_count)
269
raise AvahiServiceError("Too many renames")
270
self.name = unicode(self.server
271
.GetAlternativeServiceName(self.name))
272
logger.info("Changing Zeroconf service name to %r ...",
273
self.name)
156
raise AvahiServiceError(u"Too many renames")
157
self.name = self.server.GetAlternativeServiceName(self.name)
158
logger.info(u"Changing Zeroconf service name to %r ...",
159
unicode(self.name))
160
syslogger.setFormatter(logging.Formatter
161
(u'Mandos (%s) [%%(process)d]:'
162
u' %%(levelname)s: %%(message)s'
163
% self.name))
274
164
self.remove()
275
try:
276
self.add()
277
except dbus.exceptions.DBusException as error:
278
logger.critical("DBusException: %s", error)
279
self.cleanup()
280
os._exit(1)
165
self.add()
281
166
self.rename_count += 1
282
167
def remove(self):
283
168
"""Derived from the Avahi example code"""
284
if self.entry_group_state_changed_match is not None:
285
self.entry_group_state_changed_match.remove()
286
self.entry_group_state_changed_match = None
287
169
if self.group is not None:
288
170
self.group.Reset()
289
171
def add(self):
290
172
"""Derived from the Avahi example code"""
291
self.remove()
292
173
if self.group is None:
293
174
self.group = dbus.Interface(
294
175
self.bus.get_object(avahi.DBUS_NAME,
295
176
self.server.EntryGroupNew()),
296
177
avahi.DBUS_INTERFACE_ENTRY_GROUP)
297
self.entry_group_state_changed_match = (
298
self.group.connect_to_signal(
299
'StateChanged', self.entry_group_state_changed))
300
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
178
self.group.connect_to_signal('StateChanged',
179
self
180
.entry_group_state_changed)
181
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
301
182
self.name, self.type)
302
183
self.group.AddService(
303
184
self.interface,
310
191
self.group.Commit()
311
192
def entry_group_state_changed(self, state, error):
312
193
"""Derived from the Avahi example code"""
313
logger.debug("Avahi entry group state change: %i", state)
194
logger.debug(u"Avahi state change: %i", state)
314
195
315
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
316
logger.debug("Zeroconf service established.")
197
logger.debug(u"Zeroconf service established.")
317
198
elif state == avahi.ENTRY_GROUP_COLLISION:
318
logger.info("Zeroconf service name collision.")
199
logger.warning(u"Zeroconf service name collision.")
319
200
self.rename()
320
201
elif state == avahi.ENTRY_GROUP_FAILURE:
321
logger.critical("Avahi: Error in group state changed %s",
202
logger.critical(u"Avahi: Error in group state changed %s",
322
203
unicode(error))
323
raise AvahiGroupError("State changed: %s"
204
raise AvahiGroupError(u"State changed: %s"
324
205
% unicode(error))
325
206
def cleanup(self):
326
207
"""Derived from the Avahi example code"""
327
208
if self.group is not None:
328
try:
329
self.group.Free()
330
except (dbus.exceptions.UnknownMethodException,
331
dbus.exceptions.DBusException):
332
pass
209
self.group.Free()
333
210
self.group = None
334
self.remove()
335
def server_state_changed(self, state, error=None):
211
def server_state_changed(self, state):
336
212
"""Derived from the Avahi example code"""
337
logger.debug("Avahi server state change: %i", state)
338
bad_states = { avahi.SERVER_INVALID:
339
"Zeroconf server invalid",
340
avahi.SERVER_REGISTERING: None,
341
avahi.SERVER_COLLISION:
342
"Zeroconf server name collision",
343
avahi.SERVER_FAILURE:
344
"Zeroconf server failure" }
345
if state in bad_states:
346
if bad_states[state] is not None:
347
if error is None:
348
logger.error(bad_states[state])
349
else:
350
logger.error(bad_states[state] + ": %r", error)
351
self.cleanup()
213
if state == avahi.SERVER_COLLISION:
214
logger.error(u"Zeroconf server name collision")
215
self.remove()
352
216
elif state == avahi.SERVER_RUNNING:
353
217
self.add()
354
else:
355
if error is None:
356
logger.debug("Unknown state: %r", state)
357
else:
358
logger.debug("Unknown state: %r: %r", state, error)
359
218
def activate(self):
360
219
"""Derived from the Avahi example code"""
361
220
if self.server is None:
362
221
self.server = dbus.Interface(
363
222
self.bus.get_object(avahi.DBUS_NAME,
364
avahi.DBUS_PATH_SERVER,
365
follow_name_owner_changes=True),
223
avahi.DBUS_PATH_SERVER),
366
224
avahi.DBUS_INTERFACE_SERVER)
367
self.server.connect_to_signal("StateChanged",
225
self.server.connect_to_signal(u"StateChanged",
368
226
self.server_state_changed)
369
227
self.server_state_changed(self.server.GetState())
370
228
371
class AvahiServiceToSyslog(AvahiService):
372
def rename(self):
373
"""Add the new name to the syslog messages"""
374
ret = AvahiService.rename(self)
375
syslogger.setFormatter(logging.Formatter
376
('Mandos (%s) [%%(process)d]:'
377
' %%(levelname)s: %%(message)s'
378
% self.name))
379
return ret
380
229
381
def timedelta_to_milliseconds(td):
382
"Convert a datetime.timedelta() to milliseconds"
383
return ((td.days * 24 * 60 * 60 * 1000)
384
+ (td.seconds * 1000)
385
+ (td.microseconds // 1000))
386
387
230
class Client(object):
388
231
"""A representation of a client host served by this server.
389
232
390
233
Attributes:
391
approved: bool(); 'None' if not yet approved/disapproved
392
approval_delay: datetime.timedelta(); Time to wait for approval
393
approval_duration: datetime.timedelta(); Duration of one approval
234
name: string; from the config file, used in log messages and
235
D-Bus identifiers
236
fingerprint: string (40 or 32 hexadecimal digits); used to
237
uniquely identify the client
238
secret: bytestring; sent verbatim (over TLS) to client
239
host: string; available for use by the checker command
240
created: datetime.datetime(); (UTC) object creation
241
last_enabled: datetime.datetime(); (UTC)
242
enabled: bool()
243
last_checked_ok: datetime.datetime(); (UTC) or None
244
timeout: datetime.timedelta(); How long from last_checked_ok
245
until this client is invalid
246
interval: datetime.timedelta(); How often to start a new checker
247
disable_hook: If set, called by disable() as disable_hook(self)
394
248
checker: subprocess.Popen(); a running checker process used
395
249
to see if the client lives.
396
250
'None' if no process is running.
397
checker_callback_tag: a gobject event source tag, or None
398
checker_command: string; External command which is run to check
399
if client lives. %() expansions are done at
251
checker_initiator_tag: a gobject event source tag, or None
252
disable_initiator_tag: - '' -
253
checker_callback_tag: - '' -
254
checker_command: string; External command which is run to check if
255
client lives. %() expansions are done at
400
256
runtime with vars(self) as dict, so that for
401
257
instance %(name)s can be used in the command.
402
checker_initiator_tag: a gobject event source tag, or None
403
created: datetime.datetime(); (UTC) object creation
404
client_structure: Object describing what attributes a client has
405
and is used for storing the client at exit
406
258
current_checker_command: string; current running checker_command
407
disable_initiator_tag: a gobject event source tag, or None
408
enabled: bool()
409
fingerprint: string (40 or 32 hexadecimal digits); used to
410
uniquely identify the client
411
host: string; available for use by the checker command
412
interval: datetime.timedelta(); How often to start a new checker
413
last_approval_request: datetime.datetime(); (UTC) or None
414
last_checked_ok: datetime.datetime(); (UTC) or None
415
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
420
name: string; from the config file, used in log messages and
421
D-Bus identifiers
422
secret: bytestring; sent verbatim (over TLS) to client
423
timeout: datetime.timedelta(); How long from last_checked_ok
424
until this client is disabled
425
extended_timeout: extra long timeout when password has been sent
426
runtime_expansions: Allowed attributes for runtime expansion.
427
expires: datetime.datetime(); time (UTC) when a client will be
428
disabled, or None
429
259
"""
430
260
431
runtime_expansions = ("approval_delay", "approval_duration",
432
"created", "enabled", "fingerprint",
433
"host", "interval", "last_checked_ok",
434
"last_enabled", "name", "timeout")
261
@staticmethod
262
def _timedelta_to_milliseconds(td):
263
"Convert a datetime.timedelta() to milliseconds"
264
return ((td.days * 24 * 60 * 60 * 1000)
265
+ (td.seconds * 1000)
266
+ (td.microseconds // 1000))
435
267
436
268
def timeout_milliseconds(self):
437
269
"Return the 'timeout' attribute in milliseconds"
438
return timedelta_to_milliseconds(self.timeout)
439
440
def extended_timeout_milliseconds(self):
441
"Return the 'extended_timeout' attribute in milliseconds"
442
return timedelta_to_milliseconds(self.extended_timeout)
270
return self._timedelta_to_milliseconds(self.timeout)
443
271
444
272
def interval_milliseconds(self):
445
273
"Return the 'interval' attribute in milliseconds"
446
return timedelta_to_milliseconds(self.interval)
447
448
def approval_delay_milliseconds(self):
449
return timedelta_to_milliseconds(self.approval_delay)
450
451
def __init__(self, name = None, config=None):
274
return self._timedelta_to_milliseconds(self.interval)
275
276
def __init__(self, name = None, disable_hook=None, config=None):
452
277
"""Note: the 'checker' key in 'config' sets the
453
278
'checker_command' attribute and *not* the 'checker'
454
279
attribute."""
455
280
self.name = name
456
281
if config is None:
457
282
config = {}
458
logger.debug("Creating client %r", self.name)
283
logger.debug(u"Creating client %r", self.name)
459
284
# Uppercase and remove spaces from fingerprint for later
460
285
# comparison purposes with return value from the fingerprint()
461
286
# function
462
self.fingerprint = (config["fingerprint"].upper()
463
.replace(" ", ""))
464
logger.debug(" Fingerprint: %s", self.fingerprint)
465
if "secret" in config:
466
self.secret = config["secret"].decode("base64")
467
elif "secfile" in config:
468
with open(os.path.expanduser(os.path.expandvars
469
(config["secfile"])),
470
"rb") as secfile:
287
self.fingerprint = (config[u"fingerprint"].upper()
288
.replace(u" ", u""))
289
logger.debug(u" Fingerprint: %s", self.fingerprint)
290
if u"secret" in config:
291
self.secret = config[u"secret"].decode(u"base64")
292
elif u"secfile" in config:
293
with closing(open(os.path.expanduser
294
(os.path.expandvars
295
(config[u"secfile"])))) as secfile:
471
296
self.secret = secfile.read()
472
297
else:
473
raise TypeError("No secret or secfile for client %s"
298
raise TypeError(u"No secret or secfile for client %s"
474
299
% self.name)
475
self.host = config.get("host", "")
300
self.host = config.get(u"host", u"")
476
301
self.created = datetime.datetime.utcnow()
477
self.enabled = config.get("enabled", True)
478
self.last_approval_request = None
479
if self.enabled:
480
self.last_enabled = datetime.datetime.utcnow()
481
else:
482
self.last_enabled = None
302
self.enabled = False
303
self.last_enabled = None
483
304
self.last_checked_ok = None
484
self.last_checker_status = None
485
self.timeout = string_to_delta(config["timeout"])
486
self.extended_timeout = string_to_delta(config
487
["extended_timeout"])
488
self.interval = string_to_delta(config["interval"])
305
self.timeout = string_to_delta(config[u"timeout"])
306
self.interval = string_to_delta(config[u"interval"])
307
self.disable_hook = disable_hook
489
308
self.checker = None
490
309
self.checker_initiator_tag = None
491
310
self.disable_initiator_tag = None
492
if self.enabled:
493
self.expires = datetime.datetime.utcnow() + self.timeout
494
else:
495
self.expires = None
496
311
self.checker_callback_tag = None
497
self.checker_command = config["checker"]
312
self.checker_command = config[u"checker"]
498
313
self.current_checker_command = None
499
self.approved = None
500
self.approved_by_default = config.get("approved_by_default",
501
True)
502
self.approvals_pending = 0
503
self.approval_delay = string_to_delta(
504
config["approval_delay"])
505
self.approval_duration = string_to_delta(
506
config["approval_duration"])
507
self.changedstate = (multiprocessing_manager
508
.Condition(multiprocessing_manager
509
.Lock()))
510
self.client_structure = [attr for attr in
511
self.__dict__.iterkeys()
512
if not attr.startswith("_")]
513
self.client_structure.append("client_structure")
514
515
for name, t in inspect.getmembers(type(self),
516
lambda obj:
517
isinstance(obj,
518
property)):
519
if not name.startswith("_"):
520
self.client_structure.append(name)
521
522
# Send notice to process children that client state has changed
523
def send_changedstate(self):
524
with self.changedstate:
525
self.changedstate.notify_all()
314
self.last_connect = None
526
315
527
316
def enable(self):
528
317
"""Start this client's checker and timeout hooks"""
529
if getattr(self, "enabled", False):
318
if getattr(self, u"enabled", False):
530
319
# Already enabled
531
320
return
532
self.send_changedstate()
533
self.expires = datetime.datetime.utcnow() + self.timeout
534
self.enabled = True
535
321
self.last_enabled = datetime.datetime.utcnow()
536
self.init_checker()
537
538
def disable(self, quiet=True):
539
"""Disable this client."""
540
if not getattr(self, "enabled", False):
541
return False
542
if not quiet:
543
self.send_changedstate()
544
if not quiet:
545
logger.info("Disabling client %s", self.name)
546
if getattr(self, "disable_initiator_tag", False):
547
gobject.source_remove(self.disable_initiator_tag)
548
self.disable_initiator_tag = None
549
self.expires = None
550
if getattr(self, "checker_initiator_tag", False):
551
gobject.source_remove(self.checker_initiator_tag)
552
self.checker_initiator_tag = None
553
self.stop_checker()
554
self.enabled = False
555
# Do not run this again if called by a gobject.timeout_add
556
return False
557
558
def __del__(self):
559
self.disable()
560
561
def init_checker(self):
562
322
# Schedule a new checker to be started an 'interval' from now,
563
323
# and every interval from then on.
564
324
self.checker_initiator_tag = (gobject.timeout_add
565
325
(self.interval_milliseconds(),
566
326
self.start_checker))
327
# Also start a new checker *right now*.
328
self.start_checker()
567
329
# Schedule a disable() when 'timeout' has passed
568
330
self.disable_initiator_tag = (gobject.timeout_add
569
331
(self.timeout_milliseconds(),
570
332
self.disable))
571
# Also start a new checker *right now*.
572
self.start_checker()
333
self.enabled = True
334
335
def disable(self):
336
"""Disable this client."""
337
if not getattr(self, "enabled", False):
338
return False
339
logger.info(u"Disabling client %s", self.name)
340
if getattr(self, u"disable_initiator_tag", False):
341
gobject.source_remove(self.disable_initiator_tag)
342
self.disable_initiator_tag = None
343
if getattr(self, u"checker_initiator_tag", False):
344
gobject.source_remove(self.checker_initiator_tag)
345
self.checker_initiator_tag = None
346
self.stop_checker()
347
if self.disable_hook:
348
self.disable_hook(self)
349
self.enabled = False
350
# Do not run this again if called by a gobject.timeout_add
351
return False
352
353
def __del__(self):
354
self.disable_hook = None
355
self.disable()
573
356
574
357
def checker_callback(self, pid, condition, command):
575
358
"""The checker has completed, so take appropriate actions."""
576
359
self.checker_callback_tag = None
577
360
self.checker = None
578
361
if os.WIFEXITED(condition):
579
self.last_checker_status = os.WEXITSTATUS(condition)
580
if self.last_checker_status == 0:
581
logger.info("Checker for %(name)s succeeded",
362
exitstatus = os.WEXITSTATUS(condition)
363
if exitstatus == 0:
364
logger.info(u"Checker for %(name)s succeeded",
582
365
vars(self))
583
366
self.checked_ok()
584
367
else:
585
logger.info("Checker for %(name)s failed",
368
logger.info(u"Checker for %(name)s failed",
586
369
vars(self))
587
370
else:
588
self.last_checker_status = -1
589
logger.warning("Checker for %(name)s crashed?",
371
logger.warning(u"Checker for %(name)s crashed?",
590
372
vars(self))
591
373
592
def checked_ok(self, timeout=None):
374
def checked_ok(self):
593
375
"""Bump up the timeout for this client.
594
376
595
377
This should only be called when the client has been seen,
596
378
alive and well.
597
379
"""
598
if timeout is None:
599
timeout = self.timeout
600
380
self.last_checked_ok = datetime.datetime.utcnow()
601
if self.disable_initiator_tag is not None:
602
gobject.source_remove(self.disable_initiator_tag)
603
if getattr(self, "enabled", False):
604
self.disable_initiator_tag = (gobject.timeout_add
605
(timedelta_to_milliseconds
606
(timeout), self.disable))
607
self.expires = datetime.datetime.utcnow() + timeout
608
609
def need_approval(self):
610
self.last_approval_request = datetime.datetime.utcnow()
381
gobject.source_remove(self.disable_initiator_tag)
382
self.disable_initiator_tag = (gobject.timeout_add
383
(self.timeout_milliseconds(),
384
self.disable))
611
385
612
386
def start_checker(self):
613
387
"""Start a new checker subprocess if one is not running.
620
394
# client would inevitably timeout, since no checker would get
621
395
# a chance to run to completion. If we instead leave running
622
396
# checkers alone, the checker would have to take more time
623
# than 'timeout' for the client to be disabled, which is as it
624
# should be.
397
# than 'timeout' for the client to be declared invalid, which
398
# is as it should be.
625
399
626
400
# If a checker exists, make sure it is not a zombie
627
401
try:
628
402
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
629
except (AttributeError, OSError) as error:
403
except (AttributeError, OSError), error:
630
404
if (isinstance(error, OSError)
631
405
and error.errno != errno.ECHILD):
632
406
raise error
633
407
else:
634
408
if pid:
635
logger.warning("Checker was a zombie")
409
logger.warning(u"Checker was a zombie")
636
410
gobject.source_remove(self.checker_callback_tag)
637
411
self.checker_callback(pid, status,
638
412
self.current_checker_command)
643
417
command = self.checker_command % self.host
644
418
except TypeError:
645
419
# Escape attributes for the shell
646
escaped_attrs = dict(
647
(attr,
648
re.escape(unicode(str(getattr(self, attr, "")),
649
errors=
650
'replace')))
651
for attr in
652
self.runtime_expansions)
653
420
escaped_attrs = dict((key,
421
re.escape(unicode(str(val),
422
errors=
423
u'replace')))
424
for key, val in
425
vars(self).iteritems())
654
426
try:
655
427
command = self.checker_command % escaped_attrs
656
except TypeError as error:
657
logger.error('Could not format string "%s":'
658
' %s', self.checker_command, error)
428
except TypeError, error:
429
logger.error(u'Could not format string "%s":'
430
u' %s', self.checker_command, error)
659
431
return True # Try again later
660
432
self.current_checker_command = command
661
433
try:
662
logger.info("Starting checker %r for %s",
434
logger.info(u"Starting checker %r for %s",
663
435
command, self.name)
664
436
# We don't need to redirect stdout and stderr, since
665
437
# in normal mode, that is already done by daemon(),
667
439
# always replaced by /dev/null.)
668
440
self.checker = subprocess.Popen(command,
669
441
close_fds=True,
670
shell=True, cwd="/")
442
shell=True, cwd=u"/")
671
443
self.checker_callback_tag = (gobject.child_watch_add
672
444
(self.checker.pid,
673
445
self.checker_callback,
678
450
if pid:
679
451
gobject.source_remove(self.checker_callback_tag)
680
452
self.checker_callback(pid, status, command)
681
except OSError as error:
682
logger.error("Failed to start subprocess: %s",
453
except OSError, error:
454
logger.error(u"Failed to start subprocess: %s",
683
455
error)
684
456
# Re-run this periodically if run by gobject.timeout_add
685
457
return True
689
461
if self.checker_callback_tag:
690
462
gobject.source_remove(self.checker_callback_tag)
691
463
self.checker_callback_tag = None
692
if getattr(self, "checker", None) is None:
464
if getattr(self, u"checker", None) is None:
693
465
return
694
logger.debug("Stopping checker for %(name)s", vars(self))
466
logger.debug(u"Stopping checker for %(name)s", vars(self))
695
467
try:
696
468
os.kill(self.checker.pid, signal.SIGTERM)
697
#time.sleep(0.5)
469
#os.sleep(0.5)
698
470
#if self.checker.poll() is None:
699
471
# os.kill(self.checker.pid, signal.SIGKILL)
700
except OSError as error:
472
except OSError, error:
701
473
if error.errno != errno.ESRCH: # No such process
702
474
raise
703
475
self.checker = None
704
705
706
def dbus_service_property(dbus_interface, signature="v",
707
access="readwrite", byte_arrays=False):
476
477
def still_valid(self):
478
"""Has the timeout not yet passed for this client?"""
479
if not getattr(self, u"enabled", False):
480
return False
481
now = datetime.datetime.utcnow()
482
if self.last_checked_ok is None:
483
return now < (self.created + self.timeout)
484
else:
485
return now < (self.last_checked_ok + self.timeout)
486
487
488
def dbus_service_property(dbus_interface, signature=u"v",
489
access=u"readwrite", byte_arrays=False):
708
490
"""Decorators for marking methods of a DBusObjectWithProperties to
709
491
become properties on the D-Bus.
710
492
715
497
dbus.service.method, except there is only "signature", since the
716
498
type from Get() and the type sent to Set() is the same.
717
499
"""
718
# Encoding deeply encoded byte arrays is not supported yet by the
719
# "Set" method, so we fail early here:
720
if byte_arrays and signature != "ay":
721
raise ValueError("Byte arrays not supported for non-'ay'"
722
" signature %r" % signature)
723
500
def decorator(func):
724
501
func._dbus_is_property = True
725
502
func._dbus_interface = dbus_interface
726
503
func._dbus_signature = signature
727
504
func._dbus_access = access
728
505
func._dbus_name = func.__name__
729
if func._dbus_name.endswith("_dbus_property"):
506
if func._dbus_name.endswith(u"_dbus_property"):
730
507
func._dbus_name = func._dbus_name[:-14]
731
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
508
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
732
509
return func
733
510
return decorator
734
511
754
531
755
532
class DBusObjectWithProperties(dbus.service.Object):
756
533
"""A D-Bus object with properties.
757
534
758
535
Classes inheriting from this can use the dbus_service_property
759
536
decorator to expose methods as D-Bus properties. It exposes the
760
537
standard Get(), Set(), and GetAll() methods on the D-Bus.
762
539
763
540
@staticmethod
764
541
def _is_dbus_property(obj):
765
return getattr(obj, "_dbus_is_property", False)
542
return getattr(obj, u"_dbus_is_property", False)
766
543
767
544
def _get_all_dbus_properties(self):
768
545
"""Returns a generator of (name, attribute) pairs
769
546
"""
770
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
771
for cls in self.__class__.__mro__
547
return ((prop._dbus_name, prop)
772
548
for name, prop in
773
inspect.getmembers(cls, self._is_dbus_property))
549
inspect.getmembers(self, self._is_dbus_property))
774
550
775
551
def _get_dbus_property(self, interface_name, property_name):
776
552
"""Returns a bound method if one exists which is a D-Bus
777
553
property with the specified name and interface.
778
554
"""
779
for cls in self.__class__.__mro__:
780
for name, value in (inspect.getmembers
781
(cls, self._is_dbus_property)):
782
if (value._dbus_name == property_name
783
and value._dbus_interface == interface_name):
784
return value.__get__(self)
785
555
for name in (property_name,
556
property_name + u"_dbus_property"):
557
prop = getattr(self, name, None)
558
if (prop is None
559
or not self._is_dbus_property(prop)
560
or prop._dbus_name != property_name
561
or (interface_name and prop._dbus_interface
562
and interface_name != prop._dbus_interface)):
563
continue
564
return prop
786
565
# No such property
787
raise DBusPropertyNotFound(self.dbus_object_path + ":"
788
+ interface_name + "."
566
raise DBusPropertyNotFound(self.dbus_object_path + u":"
567
+ interface_name + u"."
789
568
+ property_name)
790
569
791
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
792
out_signature="v")
570
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
571
out_signature=u"v")
793
572
def Get(self, interface_name, property_name):
794
573
"""Standard D-Bus property Get() method, see D-Bus standard.
795
574
"""
796
575
prop = self._get_dbus_property(interface_name, property_name)
797
if prop._dbus_access == "write":
576
if prop._dbus_access == u"write":
798
577
raise DBusPropertyAccessException(property_name)
799
578
value = prop()
800
if not hasattr(value, "variant_level"):
579
if not hasattr(value, u"variant_level"):
801
580
return value
802
581
return type(value)(value, variant_level=value.variant_level+1)
803
582
804
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
583
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
805
584
def Set(self, interface_name, property_name, value):
806
585
"""Standard D-Bus property Set() method, see D-Bus standard.
807
586
"""
808
587
prop = self._get_dbus_property(interface_name, property_name)
809
if prop._dbus_access == "read":
588
if prop._dbus_access == u"read":
810
589
raise DBusPropertyAccessException(property_name)
811
if prop._dbus_get_args_options["byte_arrays"]:
812
# The byte_arrays option is not supported yet on
813
# signatures other than "ay".
814
if prop._dbus_signature != "ay":
815
raise ValueError
590
if prop._dbus_get_args_options[u"byte_arrays"]:
816
591
value = dbus.ByteArray(''.join(unichr(byte)
817
592
for byte in value))
818
593
prop(value)
819
594
820
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
821
out_signature="a{sv}")
595
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
596
out_signature=u"a{sv}")
822
597
def GetAll(self, interface_name):
823
598
"""Standard D-Bus property GetAll() method, see D-Bus
824
599
standard.
825
600
826
601
Note: Will not include properties with access="write".
827
602
"""
828
properties = {}
603
all = {}
829
604
for name, prop in self._get_all_dbus_properties():
830
605
if (interface_name
831
606
and interface_name != prop._dbus_interface):
832
607
# Interface non-empty but did not match
833
608
continue
834
609
# Ignore write-only properties
835
if prop._dbus_access == "write":
610
if prop._dbus_access == u"write":
836
611
continue
837
612
value = prop()
838
if not hasattr(value, "variant_level"):
839
properties[name] = value
613
if not hasattr(value, u"variant_level"):
614
all[name] = value
840
615
continue
841
properties[name] = type(value)(value, variant_level=
842
value.variant_level+1)
843
return dbus.Dictionary(properties, signature="sv")
616
all[name] = type(value)(value, variant_level=
617
value.variant_level+1)
618
return dbus.Dictionary(all, signature=u"sv")
844
619
845
620
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
846
out_signature="s",
621
out_signature=u"s",
847
622
path_keyword='object_path',
848
623
connection_keyword='connection')
849
624
def Introspect(self, object_path, connection):
850
625
"""Standard D-Bus method, overloaded to insert property tags.
851
626
"""
852
627
xmlstring = dbus.service.Object.Introspect(self, object_path,
853
connection)
854
try:
855
document = xml.dom.minidom.parseString(xmlstring)
856
def make_tag(document, name, prop):
857
e = document.createElement("property")
858
e.setAttribute("name", name)
859
e.setAttribute("type", prop._dbus_signature)
860
e.setAttribute("access", prop._dbus_access)
861
return e
862
for if_tag in document.getElementsByTagName("interface"):
863
for tag in (make_tag(document, name, prop)
864
for name, prop
865
in self._get_all_dbus_properties()
866
if prop._dbus_interface
867
== if_tag.getAttribute("name")):
868
if_tag.appendChild(tag)
869
# Add the names to the return values for the
870
# "org.freedesktop.DBus.Properties" methods
871
if (if_tag.getAttribute("name")
872
== "org.freedesktop.DBus.Properties"):
873
for cn in if_tag.getElementsByTagName("method"):
874
if cn.getAttribute("name") == "Get":
875
for arg in cn.getElementsByTagName("arg"):
876
if (arg.getAttribute("direction")
877
== "out"):
878
arg.setAttribute("name", "value")
879
elif cn.getAttribute("name") == "GetAll":
880
for arg in cn.getElementsByTagName("arg"):
881
if (arg.getAttribute("direction")
882
== "out"):
883
arg.setAttribute("name", "props")
884
xmlstring = document.toxml("utf-8")
885
document.unlink()
886
except (AttributeError, xml.dom.DOMException,
887
xml.parsers.expat.ExpatError) as error:
888
logger.error("Failed to override Introspection method",
889
error)
628
connection)
629
document = xml.dom.minidom.parseString(xmlstring)
630
del xmlstring
631
def make_tag(document, name, prop):
632
e = document.createElement(u"property")
633
e.setAttribute(u"name", name)
634
e.setAttribute(u"type", prop._dbus_signature)
635
e.setAttribute(u"access", prop._dbus_access)
636
return e
637
for if_tag in document.getElementsByTagName(u"interface"):
638
for tag in (make_tag(document, name, prop)
639
for name, prop
640
in self._get_all_dbus_properties()
641
if prop._dbus_interface
642
== if_tag.getAttribute(u"name")):
643
if_tag.appendChild(tag)
644
xmlstring = document.toxml(u"utf-8")
645
document.unlink()
890
646
return xmlstring
891
647
892
648
893
def datetime_to_dbus (dt, variant_level=0):
894
"""Convert a UTC datetime.datetime() to a D-Bus type."""
895
if dt is None:
896
return dbus.String("", variant_level = variant_level)
897
return dbus.String(dt.isoformat(),
898
variant_level=variant_level)
899
900
901
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
902
.__metaclass__):
903
"""Applied to an empty subclass of a D-Bus object, this metaclass
904
will add additional D-Bus attributes matching a certain pattern.
905
"""
906
def __new__(mcs, name, bases, attr):
907
# Go through all the base classes which could have D-Bus
908
# methods, signals, or properties in them
909
for base in (b for b in bases
910
if issubclass(b, dbus.service.Object)):
911
# Go though all attributes of the base class
912
for attrname, attribute in inspect.getmembers(base):
913
# Ignore non-D-Bus attributes, and D-Bus attributes
914
# with the wrong interface name
915
if (not hasattr(attribute, "_dbus_interface")
916
or not attribute._dbus_interface
917
.startswith("se.recompile.Mandos")):
918
continue
919
# Create an alternate D-Bus interface name based on
920
# the current name
921
alt_interface = (attribute._dbus_interface
922
.replace("se.recompile.Mandos",
923
"se.bsnet.fukt.Mandos"))
924
# Is this a D-Bus signal?
925
if getattr(attribute, "_dbus_is_signal", False):
926
# Extract the original non-method function by
927
# black magic
928
nonmethod_func = (dict(
929
zip(attribute.func_code.co_freevars,
930
attribute.__closure__))["func"]
931
.cell_contents)
932
# Create a new, but exactly alike, function
933
# object, and decorate it to be a new D-Bus signal
934
# with the alternate D-Bus interface name
935
new_function = (dbus.service.signal
936
(alt_interface,
937
attribute._dbus_signature)
938
(types.FunctionType(
939
nonmethod_func.func_code,
940
nonmethod_func.func_globals,
941
nonmethod_func.func_name,
942
nonmethod_func.func_defaults,
943
nonmethod_func.func_closure)))
944
# Define a creator of a function to call both the
945
# old and new functions, so both the old and new
946
# signals gets sent when the function is called
947
def fixscope(func1, func2):
948
"""This function is a scope container to pass
949
func1 and func2 to the "call_both" function
950
outside of its arguments"""
951
def call_both(*args, **kwargs):
952
"""This function will emit two D-Bus
953
signals by calling func1 and func2"""
954
func1(*args, **kwargs)
955
func2(*args, **kwargs)
956
return call_both
957
# Create the "call_both" function and add it to
958
# the class
959
attr[attrname] = fixscope(attribute,
960
new_function)
961
# Is this a D-Bus method?
962
elif getattr(attribute, "_dbus_is_method", False):
963
# Create a new, but exactly alike, function
964
# object. Decorate it to be a new D-Bus method
965
# with the alternate D-Bus interface name. Add it
966
# to the class.
967
attr[attrname] = (dbus.service.method
968
(alt_interface,
969
attribute._dbus_in_signature,
970
attribute._dbus_out_signature)
971
(types.FunctionType
972
(attribute.func_code,
973
attribute.func_globals,
974
attribute.func_name,
975
attribute.func_defaults,
976
attribute.func_closure)))
977
# Is this a D-Bus property?
978
elif getattr(attribute, "_dbus_is_property", False):
979
# Create a new, but exactly alike, function
980
# object, and decorate it to be a new D-Bus
981
# property with the alternate D-Bus interface
982
# name. Add it to the class.
983
attr[attrname] = (dbus_service_property
984
(alt_interface,
985
attribute._dbus_signature,
986
attribute._dbus_access,
987
attribute
988
._dbus_get_args_options
989
["byte_arrays"])
990
(types.FunctionType
991
(attribute.func_code,
992
attribute.func_globals,
993
attribute.func_name,
994
attribute.func_defaults,
995
attribute.func_closure)))
996
return type.__new__(mcs, name, bases, attr)
997
998
999
649
class ClientDBus(Client, DBusObjectWithProperties):
1000
650
"""A Client class using D-Bus
1001
651
1003
653
dbus_object_path: dbus.ObjectPath
1004
654
bus: dbus.SystemBus()
1005
655
"""
1006
1007
runtime_expansions = (Client.runtime_expansions
1008
+ ("dbus_object_path",))
1009
1010
656
# dbus.service.Object doesn't use super(), so we can't either.
1011
657
1012
658
def __init__(self, bus = None, *args, **kwargs):
1013
659
self.bus = bus
1014
660
Client.__init__(self, *args, **kwargs)
1015
1016
self._approvals_pending = 0
1017
661
# Only now, when this client is initialized, can it show up on
1018
662
# the D-Bus
1019
client_object_name = unicode(self.name).translate(
1020
{ord("."): ord("_"),
1021
ord("-"): ord("_")})
1022
663
self.dbus_object_path = (dbus.ObjectPath
1023
("/clients/" + client_object_name))
664
(u"/clients/"
665
+ self.name.replace(u".", u"_")))
1024
666
DBusObjectWithProperties.__init__(self, self.bus,
1025
667
self.dbus_object_path)
1026
1027
def notifychangeproperty(transform_func,
1028
dbus_name, type_func=lambda x: x,
1029
variant_level=1):
1030
""" Modify a variable so that it's a property which announces
1031
its changes to DBus.
1032
1033
transform_fun: Function that takes a value and a variant_level
1034
and transforms it to a D-Bus type.
1035
dbus_name: D-Bus name of the variable
1036
type_func: Function that transform the value before sending it
1037
to the D-Bus. Default: no transform
1038
variant_level: D-Bus variant level. Default: 1
1039
"""
1040
attrname = "_{0}".format(dbus_name)
1041
def setter(self, value):
1042
if hasattr(self, "dbus_object_path"):
1043
if (not hasattr(self, attrname) or
1044
type_func(getattr(self, attrname, None))
1045
!= type_func(value)):
1046
dbus_value = transform_func(type_func(value),
1047
variant_level
1048
=variant_level)
1049
self.PropertyChanged(dbus.String(dbus_name),
1050
dbus_value)
1051
setattr(self, attrname, value)
1052
1053
return property(lambda self: getattr(self, attrname), setter)
1054
1055
1056
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1057
approvals_pending = notifychangeproperty(dbus.Boolean,
1058
"ApprovalPending",
1059
type_func = bool)
1060
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1061
last_enabled = notifychangeproperty(datetime_to_dbus,
1062
"LastEnabled")
1063
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1064
type_func = lambda checker:
1065
checker is not None)
1066
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1067
"LastCheckedOK")
1068
last_approval_request = notifychangeproperty(
1069
datetime_to_dbus, "LastApprovalRequest")
1070
approved_by_default = notifychangeproperty(dbus.Boolean,
1071
"ApprovedByDefault")
1072
approval_delay = notifychangeproperty(dbus.UInt16,
1073
"ApprovalDelay",
1074
type_func =
1075
timedelta_to_milliseconds)
1076
approval_duration = notifychangeproperty(
1077
dbus.UInt16, "ApprovalDuration",
1078
type_func = timedelta_to_milliseconds)
1079
host = notifychangeproperty(dbus.String, "Host")
1080
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1081
type_func =
1082
timedelta_to_milliseconds)
1083
extended_timeout = notifychangeproperty(
1084
dbus.UInt16, "ExtendedTimeout",
1085
type_func = timedelta_to_milliseconds)
1086
interval = notifychangeproperty(dbus.UInt16,
1087
"Interval",
1088
type_func =
1089
timedelta_to_milliseconds)
1090
checker_command = notifychangeproperty(dbus.String, "Checker")
1091
1092
del notifychangeproperty
668
669
@staticmethod
670
def _datetime_to_dbus(dt, variant_level=0):
671
"""Convert a UTC datetime.datetime() to a D-Bus type."""
672
return dbus.String(dt.isoformat(),
673
variant_level=variant_level)
674
675
def enable(self):
676
oldstate = getattr(self, u"enabled", False)
677
r = Client.enable(self)
678
if oldstate != self.enabled:
679
# Emit D-Bus signals
680
self.PropertyChanged(dbus.String(u"enabled"),
681
dbus.Boolean(True, variant_level=1))
682
self.PropertyChanged(
683
dbus.String(u"last_enabled"),
684
self._datetime_to_dbus(self.last_enabled,
685
variant_level=1))
686
return r
687
688
def disable(self, signal = True):
689
oldstate = getattr(self, u"enabled", False)
690
r = Client.disable(self)
691
if signal and oldstate != self.enabled:
692
# Emit D-Bus signal
693
self.PropertyChanged(dbus.String(u"enabled"),
694
dbus.Boolean(False, variant_level=1))
695
return r
1093
696
1094
697
def __del__(self, *args, **kwargs):
1095
698
try:
1096
699
self.remove_from_connection()
1097
700
except LookupError:
1098
701
pass
1099
if hasattr(DBusObjectWithProperties, "__del__"):
702
if hasattr(DBusObjectWithProperties, u"__del__"):
1100
703
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1101
704
Client.__del__(self, *args, **kwargs)
1102
705
1104
707
*args, **kwargs):
1105
708
self.checker_callback_tag = None
1106
709
self.checker = None
710
# Emit D-Bus signal
711
self.PropertyChanged(dbus.String(u"checker_running"),
712
dbus.Boolean(False, variant_level=1))
1107
713
if os.WIFEXITED(condition):
1108
714
exitstatus = os.WEXITSTATUS(condition)
1109
715
# Emit D-Bus signal
1119
725
return Client.checker_callback(self, pid, condition, command,
1120
726
*args, **kwargs)
1121
727
728
def checked_ok(self, *args, **kwargs):
729
r = Client.checked_ok(self, *args, **kwargs)
730
# Emit D-Bus signal
731
self.PropertyChanged(
732
dbus.String(u"last_checked_ok"),
733
(self._datetime_to_dbus(self.last_checked_ok,
734
variant_level=1)))
735
return r
736
1122
737
def start_checker(self, *args, **kwargs):
1123
738
old_checker = self.checker
1124
739
if self.checker is not None:
1131
746
and old_checker_pid != self.checker.pid):
1132
747
# Emit D-Bus signal
1133
748
self.CheckerStarted(self.current_checker_command)
1134
return r
1135
1136
def _reset_approved(self):
1137
self.approved = None
1138
return False
1139
1140
def approve(self, value=True):
1141
self.send_changedstate()
1142
self.approved = value
1143
gobject.timeout_add(timedelta_to_milliseconds
1144
(self.approval_duration),
1145
self._reset_approved)
1146
1147
1148
## D-Bus methods, signals & properties
1149
_interface = "se.recompile.Mandos.Client"
1150
1151
## Signals
749
self.PropertyChanged(
750
dbus.String(u"checker_running"),
751
dbus.Boolean(True, variant_level=1))
752
return r
753
754
def stop_checker(self, *args, **kwargs):
755
old_checker = getattr(self, u"checker", None)
756
r = Client.stop_checker(self, *args, **kwargs)
757
if (old_checker is not None
758
and getattr(self, u"checker", None) is None):
759
self.PropertyChanged(dbus.String(u"checker_running"),
760
dbus.Boolean(False, variant_level=1))
761
return r
762
763
## D-Bus methods & signals
764
_interface = u"se.bsnet.fukt.Mandos.Client"
765
766
# CheckedOK - method
767
@dbus.service.method(_interface)
768
def CheckedOK(self):
769
return self.checked_ok()
1152
770
1153
771
# CheckerCompleted - signal
1154
@dbus.service.signal(_interface, signature="nxs")
772
@dbus.service.signal(_interface, signature=u"nxs")
1155
773
def CheckerCompleted(self, exitcode, waitstatus, command):
1156
774
"D-Bus signal"
1157
775
pass
1158
776
1159
777
# CheckerStarted - signal
1160
@dbus.service.signal(_interface, signature="s")
778
@dbus.service.signal(_interface, signature=u"s")
1161
779
def CheckerStarted(self, command):
1162
780
"D-Bus signal"
1163
781
pass
1164
782
1165
783
# PropertyChanged - signal
1166
@dbus.service.signal(_interface, signature="sv")
784
@dbus.service.signal(_interface, signature=u"sv")
1167
785
def PropertyChanged(self, property, value):
1168
786
"D-Bus signal"
1169
787
pass
1170
788
1171
# GotSecret - signal
789
# ReceivedSecret - signal
1172
790
@dbus.service.signal(_interface)
1173
def GotSecret(self):
1174
"""D-Bus signal
1175
Is sent after a successful transfer of secret from the Mandos
1176
server to mandos-client
1177
"""
791
def ReceivedSecret(self):
792
"D-Bus signal"
1178
793
pass
1179
794
1180
795
# Rejected - signal
1181
@dbus.service.signal(_interface, signature="s")
1182
def Rejected(self, reason):
1183
"D-Bus signal"
1184
pass
1185
1186
# NeedApproval - signal
1187
@dbus.service.signal(_interface, signature="tb")
1188
def NeedApproval(self, timeout, default):
1189
"D-Bus signal"
1190
return self.need_approval()
1191
1192
# NeRwequest - signal
1193
@dbus.service.signal(_interface, signature="s")
1194
def NewRequest(self, ip):
1195
"""D-Bus signal
1196
Is sent after a client request a password.
1197
"""
1198
pass
1199
1200
## Methods
1201
1202
# Approve - method
1203
@dbus.service.method(_interface, in_signature="b")
1204
def Approve(self, value):
1205
self.approve(value)
1206
1207
# CheckedOK - method
1208
@dbus.service.method(_interface)
1209
def CheckedOK(self):
1210
self.checked_ok()
796
@dbus.service.signal(_interface)
797
def Rejected(self):
798
"D-Bus signal"
799
pass
1211
800
1212
801
# Enable - method
1213
802
@dbus.service.method(_interface)
1232
821
def StopChecker(self):
1233
822
self.stop_checker()
1234
823
1235
## Properties
1236
1237
# ApprovalPending - property
1238
@dbus_service_property(_interface, signature="b", access="read")
1239
def ApprovalPending_dbus_property(self):
1240
return dbus.Boolean(bool(self.approvals_pending))
1241
1242
# ApprovedByDefault - property
1243
@dbus_service_property(_interface, signature="b",
1244
access="readwrite")
1245
def ApprovedByDefault_dbus_property(self, value=None):
1246
if value is None: # get
1247
return dbus.Boolean(self.approved_by_default)
1248
self.approved_by_default = bool(value)
1249
1250
# ApprovalDelay - property
1251
@dbus_service_property(_interface, signature="t",
1252
access="readwrite")
1253
def ApprovalDelay_dbus_property(self, value=None):
1254
if value is None: # get
1255
return dbus.UInt64(self.approval_delay_milliseconds())
1256
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1257
1258
# ApprovalDuration - property
1259
@dbus_service_property(_interface, signature="t",
1260
access="readwrite")
1261
def ApprovalDuration_dbus_property(self, value=None):
1262
if value is None: # get
1263
return dbus.UInt64(timedelta_to_milliseconds(
1264
self.approval_duration))
1265
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1266
1267
# Name - property
1268
@dbus_service_property(_interface, signature="s", access="read")
1269
def Name_dbus_property(self):
824
# name - property
825
@dbus_service_property(_interface, signature=u"s", access=u"read")
826
def name_dbus_property(self):
1270
827
return dbus.String(self.name)
1271
828
1272
# Fingerprint - property
1273
@dbus_service_property(_interface, signature="s", access="read")
1274
def Fingerprint_dbus_property(self):
829
# fingerprint - property
830
@dbus_service_property(_interface, signature=u"s", access=u"read")
831
def fingerprint_dbus_property(self):
1275
832
return dbus.String(self.fingerprint)
1276
833
1277
# Host - property
1278
@dbus_service_property(_interface, signature="s",
1279
access="readwrite")
1280
def Host_dbus_property(self, value=None):
834
# host - property
835
@dbus_service_property(_interface, signature=u"s",
836
access=u"readwrite")
837
def host_dbus_property(self, value=None):
1281
838
if value is None: # get
1282
839
return dbus.String(self.host)
1283
840
self.host = value
1284
1285
# Created - property
1286
@dbus_service_property(_interface, signature="s", access="read")
1287
def Created_dbus_property(self):
1288
return datetime_to_dbus(self.created)
1289
1290
# LastEnabled - property
1291
@dbus_service_property(_interface, signature="s", access="read")
1292
def LastEnabled_dbus_property(self):
1293
return datetime_to_dbus(self.last_enabled)
1294
1295
# Enabled - property
1296
@dbus_service_property(_interface, signature="b",
1297
access="readwrite")
1298
def Enabled_dbus_property(self, value=None):
841
# Emit D-Bus signal
842
self.PropertyChanged(dbus.String(u"host"),
843
dbus.String(value, variant_level=1))
844
845
# created - property
846
@dbus_service_property(_interface, signature=u"s", access=u"read")
847
def created_dbus_property(self):
848
return dbus.String(self._datetime_to_dbus(self.created))
849
850
# last_enabled - property
851
@dbus_service_property(_interface, signature=u"s", access=u"read")
852
def last_enabled_dbus_property(self):
853
if self.last_enabled is None:
854
return dbus.String(u"")
855
return dbus.String(self._datetime_to_dbus(self.last_enabled))
856
857
# enabled - property
858
@dbus_service_property(_interface, signature=u"b",
859
access=u"readwrite")
860
def enabled_dbus_property(self, value=None):
1299
861
if value is None: # get
1300
862
return dbus.Boolean(self.enabled)
1301
863
if value:
1303
865
else:
1304
866
self.disable()
1305
867
1306
# LastCheckedOK - property
1307
@dbus_service_property(_interface, signature="s",
1308
access="readwrite")
1309
def LastCheckedOK_dbus_property(self, value=None):
868
# last_checked_ok - property
869
@dbus_service_property(_interface, signature=u"s",
870
access=u"readwrite")
871
def last_checked_ok_dbus_property(self, value=None):
1310
872
if value is not None:
1311
873
self.checked_ok()
1312
874
return
1313
return datetime_to_dbus(self.last_checked_ok)
1314
1315
# Expires - property
1316
@dbus_service_property(_interface, signature="s", access="read")
1317
def Expires_dbus_property(self):
1318
return datetime_to_dbus(self.expires)
1319
1320
# LastApprovalRequest - property
1321
@dbus_service_property(_interface, signature="s", access="read")
1322
def LastApprovalRequest_dbus_property(self):
1323
return datetime_to_dbus(self.last_approval_request)
1324
1325
# Timeout - property
1326
@dbus_service_property(_interface, signature="t",
1327
access="readwrite")
1328
def Timeout_dbus_property(self, value=None):
875
if self.last_checked_ok is None:
876
return dbus.String(u"")
877
return dbus.String(self._datetime_to_dbus(self
878
.last_checked_ok))
879
880
# timeout - property
881
@dbus_service_property(_interface, signature=u"t",
882
access=u"readwrite")
883
def timeout_dbus_property(self, value=None):
1329
884
if value is None: # get
1330
885
return dbus.UInt64(self.timeout_milliseconds())
1331
886
self.timeout = datetime.timedelta(0, 0, 0, value)
1332
if getattr(self, "disable_initiator_tag", None) is None:
887
# Emit D-Bus signal
888
self.PropertyChanged(dbus.String(u"timeout"),
889
dbus.UInt64(value, variant_level=1))
890
if getattr(self, u"disable_initiator_tag", None) is None:
1333
891
return
1334
892
# Reschedule timeout
1335
893
gobject.source_remove(self.disable_initiator_tag)
1336
894
self.disable_initiator_tag = None
1337
self.expires = None
1338
time_to_die = timedelta_to_milliseconds((self
1339
.last_checked_ok
1340
+ self.timeout)
1341
- datetime.datetime
1342
.utcnow())
895
time_to_die = (self.
896
_timedelta_to_milliseconds((self
897
.last_checked_ok
898
+ self.timeout)
899
- datetime.datetime
900
.utcnow()))
1343
901
if time_to_die <= 0:
1344
902
# The timeout has passed
1345
903
self.disable()
1346
904
else:
1347
self.expires = (datetime.datetime.utcnow()
1348
+ datetime.timedelta(milliseconds =
1349
time_to_die))
1350
905
self.disable_initiator_tag = (gobject.timeout_add
1351
906
(time_to_die, self.disable))
1352
907
1353
# ExtendedTimeout - property
1354
@dbus_service_property(_interface, signature="t",
1355
access="readwrite")
1356
def ExtendedTimeout_dbus_property(self, value=None):
1357
if value is None: # get
1358
return dbus.UInt64(self.extended_timeout_milliseconds())
1359
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1360
1361
# Interval - property
1362
@dbus_service_property(_interface, signature="t",
1363
access="readwrite")
1364
def Interval_dbus_property(self, value=None):
908
# interval - property
909
@dbus_service_property(_interface, signature=u"t",
910
access=u"readwrite")
911
def interval_dbus_property(self, value=None):
1365
912
if value is None: # get
1366
913
return dbus.UInt64(self.interval_milliseconds())
1367
914
self.interval = datetime.timedelta(0, 0, 0, value)
1368
if getattr(self, "checker_initiator_tag", None) is None:
915
# Emit D-Bus signal
916
self.PropertyChanged(dbus.String(u"interval"),
917
dbus.UInt64(value, variant_level=1))
918
if getattr(self, u"checker_initiator_tag", None) is None:
1369
919
return
1370
if self.enabled:
1371
# Reschedule checker run
1372
gobject.source_remove(self.checker_initiator_tag)
1373
self.checker_initiator_tag = (gobject.timeout_add
1374
(value, self.start_checker))
1375
self.start_checker() # Start one now, too
1376
1377
# Checker - property
1378
@dbus_service_property(_interface, signature="s",
1379
access="readwrite")
1380
def Checker_dbus_property(self, value=None):
920
# Reschedule checker run
921
gobject.source_remove(self.checker_initiator_tag)
922
self.checker_initiator_tag = (gobject.timeout_add
923
(value, self.start_checker))
924
self.start_checker() # Start one now, too
925
926
# checker - property
927
@dbus_service_property(_interface, signature=u"s",
928
access=u"readwrite")
929
def checker_dbus_property(self, value=None):
1381
930
if value is None: # get
1382
931
return dbus.String(self.checker_command)
1383
932
self.checker_command = value
933
# Emit D-Bus signal
934
self.PropertyChanged(dbus.String(u"checker"),
935
dbus.String(self.checker_command,
936
variant_level=1))
1384
937
1385
# CheckerRunning - property
1386
@dbus_service_property(_interface, signature="b",
1387
access="readwrite")
1388
def CheckerRunning_dbus_property(self, value=None):
938
# checker_running - property
939
@dbus_service_property(_interface, signature=u"b",
940
access=u"readwrite")
941
def checker_running_dbus_property(self, value=None):
1389
942
if value is None: # get
1390
943
return dbus.Boolean(self.checker is not None)
1391
944
if value:
1393
946
else:
1394
947
self.stop_checker()
1395
948
1396
# ObjectPath - property
1397
@dbus_service_property(_interface, signature="o", access="read")
1398
def ObjectPath_dbus_property(self):
949
# object_path - property
950
@dbus_service_property(_interface, signature=u"o", access=u"read")
951
def object_path_dbus_property(self):
1399
952
return self.dbus_object_path # is already a dbus.ObjectPath
1400
953
1401
# Secret = property
1402
@dbus_service_property(_interface, signature="ay",
1403
access="write", byte_arrays=True)
1404
def Secret_dbus_property(self, value):
954
# secret = property
955
@dbus_service_property(_interface, signature=u"ay",
956
access=u"write", byte_arrays=True)
957
def secret_dbus_property(self, value):
1405
958
self.secret = str(value)
1406
959
1407
960
del _interface
1408
961
1409
962
1410
class ProxyClient(object):
1411
def __init__(self, child_pipe, fpr, address):
1412
self._pipe = child_pipe
1413
self._pipe.send(('init', fpr, address))
1414
if not self._pipe.recv():
1415
raise KeyError()
1416
1417
def __getattribute__(self, name):
1418
if name == '_pipe':
1419
return super(ProxyClient, self).__getattribute__(name)
1420
self._pipe.send(('getattr', name))
1421
data = self._pipe.recv()
1422
if data[0] == 'data':
1423
return data[1]
1424
if data[0] == 'function':
1425
def func(*args, **kwargs):
1426
self._pipe.send(('funcall', name, args, kwargs))
1427
return self._pipe.recv()[1]
1428
return func
1429
1430
def __setattr__(self, name, value):
1431
if name == '_pipe':
1432
return super(ProxyClient, self).__setattr__(name, value)
1433
self._pipe.send(('setattr', name, value))
1434
1435
1436
class ClientDBusTransitional(ClientDBus):
1437
__metaclass__ = AlternateDBusNamesMetaclass
1438
1439
1440
963
class ClientHandler(socketserver.BaseRequestHandler, object):
1441
964
"""A class to handle client connections.
1442
965
1444
967
Note: This will run in its own forked process."""
1445
968
1446
969
def handle(self):
1447
with contextlib.closing(self.server.child_pipe) as child_pipe:
1448
logger.info("TCP connection from: %s",
1449
unicode(self.client_address))
1450
logger.debug("Pipe FD: %d",
1451
self.server.child_pipe.fileno())
1452
970
logger.info(u"TCP connection from: %s",
971
unicode(self.client_address))
972
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
973
# Open IPC pipe to parent process
974
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1453
975
session = (gnutls.connection
1454
976
.ClientSession(self.request,
1455
977
gnutls.connection
1456
978
.X509Credentials()))
1457
979
980
line = self.request.makefile().readline()
981
logger.debug(u"Protocol version: %r", line)
982
try:
983
if int(line.strip().split()[0]) > 1:
984
raise RuntimeError
985
except (ValueError, IndexError, RuntimeError), error:
986
logger.error(u"Unknown protocol version: %s", error)
987
return
988
1458
989
# Note: gnutls.connection.X509Credentials is really a
1459
990
# generic GnuTLS certificate credentials object so long as
1460
991
# no X.509 keys are added to it. Therefore, we can use it
1461
992
# here despite using OpenPGP certificates.
1462
993
1463
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1464
# "+AES-256-CBC", "+SHA1",
1465
# "+COMP-NULL", "+CTYPE-OPENPGP",
1466
# "+DHE-DSS"))
994
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
995
# u"+AES-256-CBC", u"+SHA1",
996
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
997
# u"+DHE-DSS"))
1467
998
# Use a fallback default, since this MUST be set.
1468
999
priority = self.server.gnutls_priority
1469
1000
if priority is None:
1470
priority = "NORMAL"
1001
priority = u"NORMAL"
1471
1002
(gnutls.library.functions
1472
1003
.gnutls_priority_set_direct(session._c_object,
1473
1004
priority, None))
1474
1005
1475
# Start communication using the Mandos protocol
1476
# Get protocol number
1477
line = self.request.makefile().readline()
1478
logger.debug("Protocol version: %r", line)
1479
try:
1480
if int(line.strip().split()[0]) > 1:
1481
raise RuntimeError
1482
except (ValueError, IndexError, RuntimeError) as error:
1483
logger.error("Unknown protocol version: %s", error)
1484
return
1485
1486
# Start GnuTLS connection
1487
1006
try:
1488
1007
session.handshake()
1489
except gnutls.errors.GNUTLSError as error:
1490
logger.warning("Handshake failed: %s", error)
1008
except gnutls.errors.GNUTLSError, error:
1009
logger.warning(u"Handshake failed: %s", error)
1491
1010
# Do not run session.bye() here: the session is not
1492
1011
# established. Just abandon the request.
1493
1012
return
1494
logger.debug("Handshake succeeded")
1495
1496
approval_required = False
1013
logger.debug(u"Handshake succeeded")
1497
1014
try:
1498
try:
1499
fpr = self.fingerprint(self.peer_certificate
1500
(session))
1501
except (TypeError,
1502
gnutls.errors.GNUTLSError) as error:
1503
logger.warning("Bad certificate: %s", error)
1504
return
1505
logger.debug("Fingerprint: %s", fpr)
1506
1507
try:
1508
client = ProxyClient(child_pipe, fpr,
1509
self.client_address)
1510
except KeyError:
1511
return
1512
1513
if self.server.use_dbus:
1514
# Emit D-Bus signal
1515
client.NewRequest(str(self.client_address))
1516
1517
if client.approval_delay:
1518
delay = client.approval_delay
1519
client.approvals_pending += 1
1520
approval_required = True
1521
1522
while True:
1523
if not client.enabled:
1524
logger.info("Client %s is disabled",
1525
client.name)
1526
if self.server.use_dbus:
1527
# Emit D-Bus signal
1528
client.Rejected("Disabled")
1529
return
1530
1531
if client.approved or not client.approval_delay:
1532
#We are approved or approval is disabled
1533
break
1534
elif client.approved is None:
1535
logger.info("Client %s needs approval",
1536
client.name)
1537
if self.server.use_dbus:
1538
# Emit D-Bus signal
1539
client.NeedApproval(
1540
client.approval_delay_milliseconds(),
1541
client.approved_by_default)
1542
else:
1543
logger.warning("Client %s was not approved",
1544
client.name)
1545
if self.server.use_dbus:
1546
# Emit D-Bus signal
1547
client.Rejected("Denied")
1548
return
1549
1550
#wait until timeout or approved
1551
time = datetime.datetime.now()
1552
client.changedstate.acquire()
1553
(client.changedstate.wait
1554
(float(client.timedelta_to_milliseconds(delay)
1555
/ 1000)))
1556
client.changedstate.release()
1557
time2 = datetime.datetime.now()
1558
if (time2 - time) >= delay:
1559
if not client.approved_by_default:
1560
logger.warning("Client %s timed out while"
1561
" waiting for approval",
1562
client.name)
1563
if self.server.use_dbus:
1564
# Emit D-Bus signal
1565
client.Rejected("Approval timed out")
1566
return
1567
else:
1568
break
1569
else:
1570
delay -= time2 - time
1571
1572
sent_size = 0
1573
while sent_size < len(client.secret):
1574
try:
1575
sent = session.send(client.secret[sent_size:])
1576
except gnutls.errors.GNUTLSError as error:
1577
logger.warning("gnutls send failed")
1578
return
1579
logger.debug("Sent: %d, remaining: %d",
1580
sent, len(client.secret)
1581
- (sent_size + sent))
1582
sent_size += sent
1583
1584
logger.info("Sending secret to %s", client.name)
1585
# bump the timeout using extended_timeout
1586
client.checked_ok(client.extended_timeout)
1587
if self.server.use_dbus:
1588
# Emit D-Bus signal
1589
client.GotSecret()
1015
fpr = self.fingerprint(self.peer_certificate(session))
1016
except (TypeError, gnutls.errors.GNUTLSError), error:
1017
logger.warning(u"Bad certificate: %s", error)
1018
session.bye()
1019
return
1020
logger.debug(u"Fingerprint: %s", fpr)
1590
1021
1591
finally:
1592
if approval_required:
1593
client.approvals_pending -= 1
1594
try:
1595
session.bye()
1596
except gnutls.errors.GNUTLSError as error:
1597
logger.warning("GnuTLS bye failed")
1022
for c in self.server.clients:
1023
if c.fingerprint == fpr:
1024
client = c
1025
break
1026
else:
1027
ipc.write(u"NOTFOUND %s %s\n"
1028
% (fpr, unicode(self.client_address)))
1029
session.bye()
1030
return
1031
# Have to check if client.still_valid(), since it is
1032
# possible that the client timed out while establishing
1033
# the GnuTLS session.
1034
if not client.still_valid():
1035
ipc.write(u"INVALID %s\n" % client.name)
1036
session.bye()
1037
return
1038
ipc.write(u"SENDING %s\n" % client.name)
1039
sent_size = 0
1040
while sent_size < len(client.secret):
1041
sent = session.send(client.secret[sent_size:])
1042
logger.debug(u"Sent: %d, remaining: %d",
1043
sent, len(client.secret)
1044
- (sent_size + sent))
1045
sent_size += sent
1046
session.bye()
1598
1047
1599
1048
@staticmethod
1600
1049
def peer_certificate(session):
1610
1059
.gnutls_certificate_get_peers
1611
1060
(session._c_object, ctypes.byref(list_size)))
1612
1061
if not bool(cert_list) and list_size.value != 0:
1613
raise gnutls.errors.GNUTLSError("error getting peer"
1614
" certificate")
1062
raise gnutls.errors.GNUTLSError(u"error getting peer"
1063
u" certificate")
1615
1064
if list_size.value == 0:
1616
1065
return None
1617
1066
cert = cert_list[0]
1643
1092
if crtverify.value != 0:
1644
1093
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1645
1094
raise (gnutls.errors.CertificateSecurityError
1646
("Verify failed"))
1095
(u"Verify failed"))
1647
1096
# New buffer for the fingerprint
1648
1097
buf = ctypes.create_string_buffer(20)
1649
1098
buf_len = ctypes.c_size_t()
1656
1105
# Convert the buffer to a Python bytestring
1657
1106
fpr = ctypes.string_at(buf, buf_len.value)
1658
1107
# Convert the bytestring to hexadecimal notation
1659
hex_fpr = binascii.hexlify(fpr).upper()
1108
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1660
1109
return hex_fpr
1661
1110
1662
1111
1663
class MultiprocessingMixIn(object):
1664
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1665
def sub_process_main(self, request, address):
1666
try:
1667
self.finish_request(request, address)
1668
except:
1669
self.handle_error(request, address)
1670
self.close_request(request)
1671
1672
def process_request(self, request, address):
1673
"""Start a new process to process the request."""
1674
proc = multiprocessing.Process(target = self.sub_process_main,
1675
args = (request,
1676
address))
1677
proc.start()
1678
return proc
1679
1680
1681
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1682
""" adds a pipe to the MixIn """
1112
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1113
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1683
1114
def process_request(self, request, client_address):
1684
1115
"""Overrides and wraps the original process_request().
1685
1116
1686
1117
This function creates a new pipe in self.pipe
1687
1118
"""
1688
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1689
1690
proc = MultiprocessingMixIn.process_request(self, request,
1691
client_address)
1692
self.child_pipe.close()
1693
self.add_pipe(parent_pipe, proc)
1694
1695
def add_pipe(self, parent_pipe, proc):
1119
self.pipe = os.pipe()
1120
super(ForkingMixInWithPipe,
1121
self).process_request(request, client_address)
1122
os.close(self.pipe[1]) # close write end
1123
self.add_pipe(self.pipe[0])
1124
def add_pipe(self, pipe):
1696
1125
"""Dummy function; override as necessary"""
1697
raise NotImplementedError
1698
1699
1700
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1126
os.close(pipe)
1127
1128
1129
class IPv6_TCPServer(ForkingMixInWithPipe,
1701
1130
socketserver.TCPServer, object):
1702
1131
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1703
1132
1719
1148
bind to an address or port if they were not specified."""
1720
1149
if self.interface is not None:
1721
1150
if SO_BINDTODEVICE is None:
1722
logger.error("SO_BINDTODEVICE does not exist;"
1723
" cannot bind to interface %s",
1151
logger.error(u"SO_BINDTODEVICE does not exist;"
1152
u" cannot bind to interface %s",
1724
1153
self.interface)
1725
1154
else:
1726
1155
try:
1727
1156
self.socket.setsockopt(socket.SOL_SOCKET,
1728
1157
SO_BINDTODEVICE,
1729
1158
str(self.interface
1730
+ '\0'))
1731
except socket.error as error:
1159
+ u'\0'))
1160
except socket.error, error:
1732
1161
if error[0] == errno.EPERM:
1733
logger.error("No permission to"
1734
" bind to interface %s",
1162
logger.error(u"No permission to"
1163
u" bind to interface %s",
1735
1164
self.interface)
1736
1165
elif error[0] == errno.ENOPROTOOPT:
1737
logger.error("SO_BINDTODEVICE not available;"
1738
" cannot bind to interface %s",
1166
logger.error(u"SO_BINDTODEVICE not available;"
1167
u" cannot bind to interface %s",
1739
1168
self.interface)
1740
1169
else:
1741
1170
raise
1743
1172
if self.server_address[0] or self.server_address[1]:
1744
1173
if not self.server_address[0]:
1745
1174
if self.address_family == socket.AF_INET6:
1746
any_address = "::" # in6addr_any
1175
any_address = u"::" # in6addr_any
1747
1176
else:
1748
1177
any_address = socket.INADDR_ANY
1749
1178
self.server_address = (any_address,
1776
1205
self.enabled = False
1777
1206
self.clients = clients
1778
1207
if self.clients is None:
1779
self.clients = {}
1208
self.clients = set()
1780
1209
self.use_dbus = use_dbus
1781
1210
self.gnutls_priority = gnutls_priority
1782
1211
IPv6_TCPServer.__init__(self, server_address,
1786
1215
def server_activate(self):
1787
1216
if self.enabled:
1788
1217
return socketserver.TCPServer.server_activate(self)
1789
1790
1218
def enable(self):
1791
1219
self.enabled = True
1792
1793
def add_pipe(self, parent_pipe, proc):
1220
def add_pipe(self, pipe):
1794
1221
# Call "handle_ipc" for both data and EOF events
1795
gobject.io_add_watch(parent_pipe.fileno(),
1796
gobject.IO_IN | gobject.IO_HUP,
1797
functools.partial(self.handle_ipc,
1798
parent_pipe =
1799
parent_pipe,
1800
proc = proc))
1801
1802
def handle_ipc(self, source, condition, parent_pipe=None,
1803
proc = None, client_object=None):
1222
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1223
self.handle_ipc)
1224
def handle_ipc(self, source, condition, file_objects={}):
1804
1225
condition_names = {
1805
gobject.IO_IN: "IN", # There is data to read.
1806
gobject.IO_OUT: "OUT", # Data can be written (without
1226
gobject.IO_IN: u"IN", # There is data to read.
1227
gobject.IO_OUT: u"OUT", # Data can be written (without
1807
1228
# blocking).
1808
gobject.IO_PRI: "PRI", # There is urgent data to read.
1809
gobject.IO_ERR: "ERR", # Error condition.
1810
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1229
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1230
gobject.IO_ERR: u"ERR", # Error condition.
1231
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1811
1232
# broken, usually for pipes and
1812
1233
# sockets).
1813
1234
}
1815
1236
for cond, name in
1816
1237
condition_names.iteritems()
1817
1238
if cond & condition)
1818
# error, or the other end of multiprocessing.Pipe has closed
1819
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1820
# Wait for other process to exit
1821
proc.join()
1822
return False
1823
1824
# Read a request from the child
1825
request = parent_pipe.recv()
1826
command = request[0]
1827
1828
if command == 'init':
1829
fpr = request[1]
1830
address = request[2]
1831
1832
for c in self.clients.itervalues():
1833
if c.fingerprint == fpr:
1834
client = c
1835
break
1836
else:
1837
logger.info("Client not found for fingerprint: %s, ad"
1838
"dress: %s", fpr, address)
1839
if self.use_dbus:
1840
# Emit D-Bus signal
1841
mandos_dbus_service.ClientNotFound(fpr,
1842
address[0])
1843
parent_pipe.send(False)
1844
return False
1845
1846
gobject.io_add_watch(parent_pipe.fileno(),
1847
gobject.IO_IN | gobject.IO_HUP,
1848
functools.partial(self.handle_ipc,
1849
parent_pipe =
1850
parent_pipe,
1851
proc = proc,
1852
client_object =
1853
client))
1854
parent_pipe.send(True)
1855
# remove the old hook in favor of the new above hook on
1856
# same fileno
1857
return False
1858
if command == 'funcall':
1859
funcname = request[1]
1860
args = request[2]
1861
kwargs = request[3]
1862
1863
parent_pipe.send(('data', getattr(client_object,
1864
funcname)(*args,
1865
**kwargs)))
1866
1867
if command == 'getattr':
1868
attrname = request[1]
1869
if callable(client_object.__getattribute__(attrname)):
1870
parent_pipe.send(('function',))
1871
else:
1872
parent_pipe.send(('data', client_object
1873
.__getattribute__(attrname)))
1874
1875
if command == 'setattr':
1876
attrname = request[1]
1877
value = request[2]
1878
setattr(client_object, attrname, value)
1879
1239
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1240
conditions_string)
1241
1242
# Turn the pipe file descriptor into a Python file object
1243
if source not in file_objects:
1244
file_objects[source] = os.fdopen(source, u"r", 1)
1245
1246
# Read a line from the file object
1247
cmdline = file_objects[source].readline()
1248
if not cmdline: # Empty line means end of file
1249
# close the IPC pipe
1250
file_objects[source].close()
1251
del file_objects[source]
1252
1253
# Stop calling this function
1254
return False
1255
1256
logger.debug(u"IPC command: %r", cmdline)
1257
1258
# Parse and act on command
1259
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1260
1261
if cmd == u"NOTFOUND":
1262
logger.warning(u"Client not found for fingerprint: %s",
1263
args)
1264
if self.use_dbus:
1265
# Emit D-Bus signal
1266
mandos_dbus_service.ClientNotFound(args)
1267
elif cmd == u"INVALID":
1268
for client in self.clients:
1269
if client.name == args:
1270
logger.warning(u"Client %s is invalid", args)
1271
if self.use_dbus:
1272
# Emit D-Bus signal
1273
client.Rejected()
1274
break
1275
else:
1276
logger.error(u"Unknown client %s is invalid", args)
1277
elif cmd == u"SENDING":
1278
for client in self.clients:
1279
if client.name == args:
1280
logger.info(u"Sending secret to %s", client.name)
1281
client.checked_ok()
1282
if self.use_dbus:
1283
# Emit D-Bus signal
1284
client.ReceivedSecret()
1285
break
1286
else:
1287
logger.error(u"Sending secret to unknown client %s",
1288
args)
1289
else:
1290
logger.error(u"Unknown IPC command: %r", cmdline)
1291
1292
# Keep calling this function
1880
1293
return True
1881
1294
1882
1295
1883
1296
def string_to_delta(interval):
1884
1297
"""Parse a string and return a datetime.timedelta
1885
1298
1886
>>> string_to_delta('7d')
1299
>>> string_to_delta(u'7d')
1887
1300
datetime.timedelta(7)
1888
>>> string_to_delta('60s')
1301
>>> string_to_delta(u'60s')
1889
1302
datetime.timedelta(0, 60)
1890
>>> string_to_delta('60m')
1303
>>> string_to_delta(u'60m')
1891
1304
datetime.timedelta(0, 3600)
1892
>>> string_to_delta('24h')
1305
>>> string_to_delta(u'24h')
1893
1306
datetime.timedelta(1)
1894
>>> string_to_delta('1w')
1307
>>> string_to_delta(u'1w')
1895
1308
datetime.timedelta(7)
1896
>>> string_to_delta('5m 30s')
1309
>>> string_to_delta(u'5m 30s')
1897
1310
datetime.timedelta(0, 330)
1898
1311
"""
1899
1312
timevalue = datetime.timedelta(0)
1901
1314
try:
1902
1315
suffix = unicode(s[-1])
1903
1316
value = int(s[:-1])
1904
if suffix == "d":
1317
if suffix == u"d":
1905
1318
delta = datetime.timedelta(value)
1906
elif suffix == "s":
1319
elif suffix == u"s":
1907
1320
delta = datetime.timedelta(0, value)
1908
elif suffix == "m":
1321
elif suffix == u"m":
1909
1322
delta = datetime.timedelta(0, 0, 0, 0, value)
1910
elif suffix == "h":
1323
elif suffix == u"h":
1911
1324
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1912
elif suffix == "w":
1325
elif suffix == u"w":
1913
1326
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1914
1327
else:
1915
raise ValueError("Unknown suffix %r" % suffix)
1916
except (ValueError, IndexError) as e:
1917
raise ValueError(*(e.args))
1328
raise ValueError
1329
except (ValueError, IndexError):
1330
raise ValueError
1918
1331
timevalue += delta
1919
1332
return timevalue
1920
1333
1921
1334
1335
def if_nametoindex(interface):
1336
"""Call the C function if_nametoindex(), or equivalent
1337
1338
Note: This function cannot accept a unicode string."""
1339
global if_nametoindex
1340
try:
1341
if_nametoindex = (ctypes.cdll.LoadLibrary
1342
(ctypes.util.find_library(u"c"))
1343
.if_nametoindex)
1344
except (OSError, AttributeError):
1345
logger.warning(u"Doing if_nametoindex the hard way")
1346
def if_nametoindex(interface):
1347
"Get an interface index the hard way, i.e. using fcntl()"
1348
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1349
with closing(socket.socket()) as s:
1350
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1351
struct.pack(str(u"16s16x"),
1352
interface))
1353
interface_index = struct.unpack(str(u"I"),
1354
ifreq[16:20])[0]
1355
return interface_index
1356
return if_nametoindex(interface)
1357
1358
1922
1359
def daemon(nochdir = False, noclose = False):
1923
1360
"""See daemon(3). Standard BSD Unix function.
1924
1361
1927
1364
sys.exit()
1928
1365
os.setsid()
1929
1366
if not nochdir:
1930
os.chdir("/")
1367
os.chdir(u"/")
1931
1368
if os.fork():
1932
1369
sys.exit()
1933
1370
if not noclose:
1935
1372
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1936
1373
if not stat.S_ISCHR(os.fstat(null).st_mode):
1937
1374
raise OSError(errno.ENODEV,
1938
"%s not a character device"
1939
% os.path.devnull)
1375
u"/dev/null not a character device")
1940
1376
os.dup2(null, sys.stdin.fileno())
1941
1377
os.dup2(null, sys.stdout.fileno())
1942
1378
os.dup2(null, sys.stderr.fileno())
1949
1385
##################################################################
1950
1386
# Parsing of options, both command line and config file
1951
1387
1952
parser = argparse.ArgumentParser()
1953
parser.add_argument("-v", "--version", action="version",
1954
version = "%%(prog)s %s" % version,
1955
help="show version number and exit")
1956
parser.add_argument("-i", "--interface", metavar="IF",
1957
help="Bind to interface IF")
1958
parser.add_argument("-a", "--address",
1959
help="Address to listen for requests on")
1960
parser.add_argument("-p", "--port", type=int,
1961
help="Port number to receive requests on")
1962
parser.add_argument("--check", action="store_true",
1963
help="Run self-test")
1964
parser.add_argument("--debug", action="store_true",
1965
help="Debug mode; run in foreground and log"
1966
" to terminal")
1967
parser.add_argument("--debuglevel", metavar="LEVEL",
1968
help="Debug level for stdout output")
1969
parser.add_argument("--priority", help="GnuTLS"
1970
" priority string (see GnuTLS documentation)")
1971
parser.add_argument("--servicename",
1972
metavar="NAME", help="Zeroconf service name")
1973
parser.add_argument("--configdir",
1974
default="/etc/mandos", metavar="DIR",
1975
help="Directory to search for configuration"
1976
" files")
1977
parser.add_argument("--no-dbus", action="store_false",
1978
dest="use_dbus", help="Do not provide D-Bus"
1979
" system bus interface")
1980
parser.add_argument("--no-ipv6", action="store_false",
1981
dest="use_ipv6", help="Do not use IPv6")
1982
parser.add_argument("--no-restore", action="store_false",
1983
dest="restore", help="Do not restore stored"
1984
" state")
1985
parser.add_argument("--statedir", metavar="DIR",
1986
help="Directory to save/restore state in")
1987
1988
options = parser.parse_args()
1388
parser = optparse.OptionParser(version = "%%prog %s" % version)
1389
parser.add_option("-i", u"--interface", type=u"string",
1390
metavar="IF", help=u"Bind to interface IF")
1391
parser.add_option("-a", u"--address", type=u"string",
1392
help=u"Address to listen for requests on")
1393
parser.add_option("-p", u"--port", type=u"int",
1394
help=u"Port number to receive requests on")
1395
parser.add_option("--check", action=u"store_true",
1396
help=u"Run self-test")
1397
parser.add_option("--debug", action=u"store_true",
1398
help=u"Debug mode; run in foreground and log to"
1399
u" terminal")
1400
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1401
u" priority string (see GnuTLS documentation)")
1402
parser.add_option("--servicename", type=u"string",
1403
metavar=u"NAME", help=u"Zeroconf service name")
1404
parser.add_option("--configdir", type=u"string",
1405
default=u"/etc/mandos", metavar=u"DIR",
1406
help=u"Directory to search for configuration"
1407
u" files")
1408
parser.add_option("--no-dbus", action=u"store_false",
1409
dest=u"use_dbus", help=u"Do not provide D-Bus"
1410
u" system bus interface")
1411
parser.add_option("--no-ipv6", action=u"store_false",
1412
dest=u"use_ipv6", help=u"Do not use IPv6")
1413
options = parser.parse_args()[0]
1989
1414
1990
1415
if options.check:
1991
1416
import doctest
1993
1418
sys.exit()
1994
1419
1995
1420
# Default values for config file for server-global settings
1996
server_defaults = { "interface": "",
1997
"address": "",
1998
"port": "",
1999
"debug": "False",
2000
"priority":
2001
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2002
"servicename": "Mandos",
2003
"use_dbus": "True",
2004
"use_ipv6": "True",
2005
"debuglevel": "",
2006
"restore": "True",
2007
"statedir": "/var/lib/mandos"
1421
server_defaults = { u"interface": u"",
1422
u"address": u"",
1423
u"port": u"",
1424
u"debug": u"False",
1425
u"priority":
1426
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1427
u"servicename": u"Mandos",
1428
u"use_dbus": u"True",
1429
u"use_ipv6": u"True",
2008
1430
}
2009
1431
2010
1432
# Parse config file for server-global settings
2011
1433
server_config = configparser.SafeConfigParser(server_defaults)
2012
1434
del server_defaults
2013
1435
server_config.read(os.path.join(options.configdir,
2014
"mandos.conf"))
1436
u"mandos.conf"))
2015
1437
# Convert the SafeConfigParser object to a dict
2016
1438
server_settings = server_config.defaults()
2017
1439
# Use the appropriate methods on the non-string config options
2018
for option in ("debug", "use_dbus", "use_ipv6"):
2019
server_settings[option] = server_config.getboolean("DEFAULT",
1440
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1441
server_settings[option] = server_config.getboolean(u"DEFAULT",
2020
1442
option)
2021
1443
if server_settings["port"]:
2022
server_settings["port"] = server_config.getint("DEFAULT",
2023
"port")
1444
server_settings["port"] = server_config.getint(u"DEFAULT",
1445
u"port")
2024
1446
del server_config
2025
1447
2026
1448
# Override the settings from the config file with command line
2027
1449
# options, if set.
2028
for option in ("interface", "address", "port", "debug",
2029
"priority", "servicename", "configdir",
2030
"use_dbus", "use_ipv6", "debuglevel", "restore",
2031
"statedir"):
1450
for option in (u"interface", u"address", u"port", u"debug",
1451
u"priority", u"servicename", u"configdir",
1452
u"use_dbus", u"use_ipv6"):
2032
1453
value = getattr(options, option)
2033
1454
if value is not None:
2034
1455
server_settings[option] = value
2042
1463
##################################################################
2043
1464
2044
1465
# For convenience
2045
debug = server_settings["debug"]
2046
debuglevel = server_settings["debuglevel"]
2047
use_dbus = server_settings["use_dbus"]
2048
use_ipv6 = server_settings["use_ipv6"]
2049
stored_state_path = os.path.join(server_settings["statedir"],
2050
stored_state_file)
2051
2052
if debug:
2053
initlogger(logging.DEBUG)
2054
else:
2055
if not debuglevel:
2056
initlogger()
2057
else:
2058
level = getattr(logging, debuglevel.upper())
2059
initlogger(level)
2060
2061
if server_settings["servicename"] != "Mandos":
1466
debug = server_settings[u"debug"]
1467
use_dbus = server_settings[u"use_dbus"]
1468
use_ipv6 = server_settings[u"use_ipv6"]
1469
1470
if not debug:
1471
syslogger.setLevel(logging.WARNING)
1472
console.setLevel(logging.WARNING)
1473
1474
if server_settings[u"servicename"] != u"Mandos":
2062
1475
syslogger.setFormatter(logging.Formatter
2063
('Mandos (%s) [%%(process)d]:'
2064
' %%(levelname)s: %%(message)s'
2065
% server_settings["servicename"]))
1476
(u'Mandos (%s) [%%(process)d]:'
1477
u' %%(levelname)s: %%(message)s'
1478
% server_settings[u"servicename"]))
2066
1479
2067
1480
# Parse config file with clients
2068
client_defaults = { "timeout": "5m",
2069
"extended_timeout": "15m",
2070
"interval": "2m",
2071
"checker": "fping -q -- %%(host)s",
2072
"host": "",
2073
"approval_delay": "0s",
2074
"approval_duration": "1s",
1481
client_defaults = { u"timeout": u"1h",
1482
u"interval": u"5m",
1483
u"checker": u"fping -q -- %%(host)s",
1484
u"host": u"",
2075
1485
}
2076
1486
client_config = configparser.SafeConfigParser(client_defaults)
2077
client_config.read(os.path.join(server_settings["configdir"],
2078
"clients.conf"))
1487
client_config.read(os.path.join(server_settings[u"configdir"],
1488
u"clients.conf"))
2079
1489
2080
1490
global mandos_dbus_service
2081
1491
mandos_dbus_service = None
2082
1492
2083
tcp_server = MandosServer((server_settings["address"],
2084
server_settings["port"]),
1493
tcp_server = MandosServer((server_settings[u"address"],
1494
server_settings[u"port"]),
2085
1495
ClientHandler,
2086
interface=(server_settings["interface"]
2087
or None),
1496
interface=server_settings[u"interface"],
2088
1497
use_ipv6=use_ipv6,
2089
1498
gnutls_priority=
2090
server_settings["priority"],
1499
server_settings[u"priority"],
2091
1500
use_dbus=use_dbus)
2092
if not debug:
2093
pidfilename = "/var/run/mandos.pid"
2094
try:
2095
pidfile = open(pidfilename, "w")
2096
except IOError:
2097
logger.error("Could not open file %r", pidfilename)
1501
pidfilename = u"/var/run/mandos.pid"
1502
try:
1503
pidfile = open(pidfilename, u"w")
1504
except IOError:
1505
logger.error(u"Could not open file %r", pidfilename)
2098
1506
2099
1507
try:
2100
uid = pwd.getpwnam("_mandos").pw_uid
2101
gid = pwd.getpwnam("_mandos").pw_gid
1508
uid = pwd.getpwnam(u"_mandos").pw_uid
1509
gid = pwd.getpwnam(u"_mandos").pw_gid
2102
1510
except KeyError:
2103
1511
try:
2104
uid = pwd.getpwnam("mandos").pw_uid
2105
gid = pwd.getpwnam("mandos").pw_gid
1512
uid = pwd.getpwnam(u"mandos").pw_uid
1513
gid = pwd.getpwnam(u"mandos").pw_gid
2106
1514
except KeyError:
2107
1515
try:
2108
uid = pwd.getpwnam("nobody").pw_uid
2109
gid = pwd.getpwnam("nobody").pw_gid
1516
uid = pwd.getpwnam(u"nobody").pw_uid
1517
gid = pwd.getpwnam(u"nobody").pw_gid
2110
1518
except KeyError:
2111
1519
uid = 65534
2112
1520
gid = 65534
2113
1521
try:
2114
1522
os.setgid(gid)
2115
1523
os.setuid(uid)
2116
except OSError as error:
1524
except OSError, error:
2117
1525
if error[0] != errno.EPERM:
2118
1526
raise error
2119
1527
1528
# Enable all possible GnuTLS debugging
2120
1529
if debug:
2121
# Enable all possible GnuTLS debugging
2122
2123
1530
# "Use a log level over 10 to enable all debugging options."
2124
1531
# - GnuTLS manual
2125
1532
gnutls.library.functions.gnutls_global_set_log_level(11)
2126
1533
2127
1534
@gnutls.library.types.gnutls_log_func
2128
1535
def debug_gnutls(level, string):
2129
logger.debug("GnuTLS: %s", string[:-1])
1536
logger.debug(u"GnuTLS: %s", string[:-1])
2130
1537
2131
1538
(gnutls.library.functions
2132
1539
.gnutls_global_set_log_function(debug_gnutls))
2133
2134
# Redirect stdin so all checkers get /dev/null
2135
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2136
os.dup2(null, sys.stdin.fileno())
2137
if null > 2:
2138
os.close(null)
2139
else:
2140
# No console logging
2141
logger.removeHandler(console)
2142
2143
# Need to fork before connecting to D-Bus
2144
if not debug:
2145
# Close all input and output, do double fork, etc.
2146
daemon()
2147
1540
2148
1541
global main_loop
2149
1542
# From the Avahi example code
2152
1545
bus = dbus.SystemBus()
2153
1546
# End of Avahi example code
2154
1547
if use_dbus:
2155
try:
2156
bus_name = dbus.service.BusName("se.recompile.Mandos",
2157
bus, do_not_queue=True)
2158
old_bus_name = (dbus.service.BusName
2159
("se.bsnet.fukt.Mandos", bus,
2160
do_not_queue=True))
2161
except dbus.exceptions.NameExistsException as e:
2162
logger.error(unicode(e) + ", disabling D-Bus")
2163
use_dbus = False
2164
server_settings["use_dbus"] = False
2165
tcp_server.use_dbus = False
1548
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
2166
1549
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2167
service = AvahiServiceToSyslog(name =
2168
server_settings["servicename"],
2169
servicetype = "_mandos._tcp",
2170
protocol = protocol, bus = bus)
1550
service = AvahiService(name = server_settings[u"servicename"],
1551
servicetype = u"_mandos._tcp",
1552
protocol = protocol, bus = bus)
2171
1553
if server_settings["interface"]:
2172
1554
service.interface = (if_nametoindex
2173
(str(server_settings["interface"])))
2174
2175
global multiprocessing_manager
2176
multiprocessing_manager = multiprocessing.Manager()
1555
(str(server_settings[u"interface"])))
2177
1556
2178
1557
client_class = Client
2179
1558
if use_dbus:
2180
client_class = functools.partial(ClientDBusTransitional,
2181
bus = bus)
2182
2183
special_settings = {
2184
# Some settings need to be accessd by special methods;
2185
# booleans need .getboolean(), etc. Here is a list of them:
2186
"approved_by_default":
2187
lambda section:
2188
client_config.getboolean(section, "approved_by_default"),
2189
"enabled":
2190
lambda section:
2191
client_config.getboolean(section, "enabled"),
2192
}
2193
# Construct a new dict of client settings of this form:
2194
# { client_name: {setting_name: value, ...}, ...}
2195
# with exceptions for any special settings as defined above
2196
client_settings = dict((clientname,
2197
dict((setting,
2198
(value
2199
if setting not in special_settings
2200
else special_settings[setting]
2201
(clientname)))
2202
for setting, value in
2203
client_config.items(clientname)))
2204
for clientname in client_config.sections())
2205
2206
old_client_settings = {}
2207
clients_data = []
2208
2209
# Get client data and settings from last running state.
2210
if server_settings["restore"]:
2211
try:
2212
with open(stored_state_path, "rb") as stored_state:
2213
clients_data, old_client_settings = (pickle.load
2214
(stored_state))
2215
os.remove(stored_state_path)
2216
except IOError as e:
2217
logger.warning("Could not load persistent state: {0}"
2218
.format(e))
2219
if e.errno != errno.ENOENT:
2220
raise
2221
2222
with PGPEngine() as pgp:
2223
for client in clients_data:
2224
client_name = client["name"]
2225
2226
# Decide which value to use after restoring saved state.
2227
# We have three different values: Old config file,
2228
# new config file, and saved state.
2229
# New config value takes precedence if it differs from old
2230
# config value, otherwise use saved state.
2231
for name, value in client_settings[client_name].items():
2232
try:
2233
# For each value in new config, check if it
2234
# differs from the old config value (Except for
2235
# the "secret" attribute)
2236
if (name != "secret" and
2237
value != old_client_settings[client_name]
2238
[name]):
2239
setattr(client, name, value)
2240
except KeyError:
2241
pass
2242
2243
# Clients who has passed its expire date can still be
2244
# enabled if its last checker was sucessful. Clients
2245
# whose checker failed before we stored its state is
2246
# assumed to have failed all checkers during downtime.
2247
if client["enabled"] and client["last_checked_ok"]:
2248
if ((datetime.datetime.utcnow()
2249
- client["last_checked_ok"])
2250
> client["interval"]):
2251
if client["last_checker_status"] != 0:
2252
client["enabled"] = False
2253
else:
2254
client["expires"] = (datetime.datetime
2255
.utcnow()
2256
+ client["timeout"])
2257
2258
client["changedstate"] = (multiprocessing_manager
2259
.Condition
2260
(multiprocessing_manager
2261
.Lock()))
2262
if use_dbus:
2263
new_client = (ClientDBusTransitional.__new__
2264
(ClientDBusTransitional))
2265
tcp_server.clients[client_name] = new_client
2266
new_client.bus = bus
2267
for name, value in client.iteritems():
2268
setattr(new_client, name, value)
2269
client_object_name = unicode(client_name).translate(
2270
{ord("."): ord("_"),
2271
ord("-"): ord("_")})
2272
new_client.dbus_object_path = (dbus.ObjectPath
2273
("/clients/"
2274
+ client_object_name))
2275
DBusObjectWithProperties.__init__(new_client,
2276
new_client.bus,
2277
new_client
2278
.dbus_object_path)
2279
else:
2280
tcp_server.clients[client_name] = (Client.__new__
2281
(Client))
2282
for name, value in client.iteritems():
2283
setattr(tcp_server.clients[client_name],
2284
name, value)
2285
2286
try:
2287
tcp_server.clients[client_name].secret = (
2288
pgp.decrypt(tcp_server.clients[client_name]
2289
.encrypted_secret,
2290
client_settings[client_name]
2291
["secret"]))
2292
except PGPError:
2293
# If decryption fails, we use secret from new settings
2294
logger.debug("Failed to decrypt {0} old secret"
2295
.format(client_name))
2296
tcp_server.clients[client_name].secret = (
2297
client_settings[client_name]["secret"])
2298
2299
# Create/remove clients based on new changes made to config
2300
for clientname in set(old_client_settings) - set(client_settings):
2301
del tcp_server.clients[clientname]
2302
for clientname in set(client_settings) - set(old_client_settings):
2303
tcp_server.clients[clientname] = (client_class(name
2304
= clientname,
2305
config =
2306
client_settings
2307
[clientname]))
2308
1559
client_class = functools.partial(ClientDBus, bus = bus)
1560
tcp_server.clients.update(set(
1561
client_class(name = section,
1562
config= dict(client_config.items(section)))
1563
for section in client_config.sections()))
2309
1564
if not tcp_server.clients:
2310
logger.warning("No clients defined")
1565
logger.warning(u"No clients defined")
1566
1567
if debug:
1568
# Redirect stdin so all checkers get /dev/null
1569
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1570
os.dup2(null, sys.stdin.fileno())
1571
if null > 2:
1572
os.close(null)
1573
else:
1574
# No console logging
1575
logger.removeHandler(console)
1576
# Close all input and output, do double fork, etc.
1577
daemon()
1578
1579
try:
1580
with closing(pidfile):
1581
pid = os.getpid()
1582
pidfile.write(str(pid) + "\n")
1583
del pidfile
1584
except IOError:
1585
logger.error(u"Could not write to file %r with PID %d",
1586
pidfilename, pid)
1587
except NameError:
1588
# "pidfile" was never created
1589
pass
1590
del pidfilename
1591
1592
def cleanup():
1593
"Cleanup function; run on exit"
1594
service.cleanup()
2311
1595
1596
while tcp_server.clients:
1597
client = tcp_server.clients.pop()
1598
client.disable_hook = None
1599
client.disable()
1600
1601
atexit.register(cleanup)
1602
2312
1603
if not debug:
2313
try:
2314
with pidfile:
2315
pid = os.getpid()
2316
pidfile.write(str(pid) + "\n".encode("utf-8"))
2317
del pidfile
2318
except IOError:
2319
logger.error("Could not write to file %r with PID %d",
2320
pidfilename, pid)
2321
except NameError:
2322
# "pidfile" was never created
2323
pass
2324
del pidfilename
2325
2326
1604
signal.signal(signal.SIGINT, signal.SIG_IGN)
2327
2328
1605
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2329
1606
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2330
1607
2332
1609
class MandosDBusService(dbus.service.Object):
2333
1610
"""A D-Bus proxy object"""
2334
1611
def __init__(self):
2335
dbus.service.Object.__init__(self, bus, "/")
2336
_interface = "se.recompile.Mandos"
2337
2338
@dbus.service.signal(_interface, signature="o")
2339
def ClientAdded(self, objpath):
2340
"D-Bus signal"
2341
pass
2342
2343
@dbus.service.signal(_interface, signature="ss")
2344
def ClientNotFound(self, fingerprint, address):
2345
"D-Bus signal"
2346
pass
2347
2348
@dbus.service.signal(_interface, signature="os")
1612
dbus.service.Object.__init__(self, bus, u"/")
1613
_interface = u"se.bsnet.fukt.Mandos"
1614
1615
@dbus.service.signal(_interface, signature=u"oa{sv}")
1616
def ClientAdded(self, objpath, properties):
1617
"D-Bus signal"
1618
pass
1619
1620
@dbus.service.signal(_interface, signature=u"s")
1621
def ClientNotFound(self, fingerprint):
1622
"D-Bus signal"
1623
pass
1624
1625
@dbus.service.signal(_interface, signature=u"os")
2349
1626
def ClientRemoved(self, objpath, name):
2350
1627
"D-Bus signal"
2351
1628
pass
2352
1629
2353
@dbus.service.method(_interface, out_signature="ao")
1630
@dbus.service.method(_interface, out_signature=u"ao")
2354
1631
def GetAllClients(self):
2355
1632
"D-Bus method"
2356
1633
return dbus.Array(c.dbus_object_path
2357
for c in
2358
tcp_server.clients.itervalues())
1634
for c in tcp_server.clients)
2359
1635
2360
1636
@dbus.service.method(_interface,
2361
out_signature="a{oa{sv}}")
1637
out_signature=u"a{oa{sv}}")
2362
1638
def GetAllClientsWithProperties(self):
2363
1639
"D-Bus method"
2364
1640
return dbus.Dictionary(
2365
((c.dbus_object_path, c.GetAll(""))
2366
for c in tcp_server.clients.itervalues()),
2367
signature="oa{sv}")
1641
((c.dbus_object_path, c.GetAll(u""))
1642
for c in tcp_server.clients),
1643
signature=u"oa{sv}")
2368
1644
2369
@dbus.service.method(_interface, in_signature="o")
1645
@dbus.service.method(_interface, in_signature=u"o")
2370
1646
def RemoveClient(self, object_path):
2371
1647
"D-Bus method"
2372
for c in tcp_server.clients.itervalues():
1648
for c in tcp_server.clients:
2373
1649
if c.dbus_object_path == object_path:
2374
del tcp_server.clients[c.name]
1650
tcp_server.clients.remove(c)
2375
1651
c.remove_from_connection()
2376
1652
# Don't signal anything except ClientRemoved
2377
c.disable(quiet=True)
1653
c.disable(signal=False)
2378
1654
# Emit D-Bus signal
2379
1655
self.ClientRemoved(object_path, c.name)
2380
1656
return
2381
raise KeyError(object_path)
1657
raise KeyError
2382
1658
2383
1659
del _interface
2384
1660
2385
class MandosDBusServiceTransitional(MandosDBusService):
2386
__metaclass__ = AlternateDBusNamesMetaclass
2387
mandos_dbus_service = MandosDBusServiceTransitional()
2388
2389
def cleanup():
2390
"Cleanup function; run on exit"
2391
service.cleanup()
2392
2393
multiprocessing.active_children()
2394
if not (tcp_server.clients or client_settings):
2395
return
2396
2397
# Store client before exiting. Secrets are encrypted with key
2398
# based on what config file has. If config file is
2399
# removed/edited, old secret will thus be unrecovable.
2400
clients = []
2401
with PGPEngine() as pgp:
2402
for client in tcp_server.clients.itervalues():
2403
key = client_settings[client.name]["secret"]
2404
client.encrypted_secret = pgp.encrypt(client.secret,
2405
key)
2406
client_dict = {}
2407
2408
# A list of attributes that will not be stored when
2409
# shutting down.
2410
exclude = set(("bus", "changedstate", "secret"))
2411
for name, typ in (inspect.getmembers
2412
(dbus.service.Object)):
2413
exclude.add(name)
2414
2415
client_dict["encrypted_secret"] = (client
2416
.encrypted_secret)
2417
for attr in client.client_structure:
2418
if attr not in exclude:
2419
client_dict[attr] = getattr(client, attr)
2420
2421
clients.append(client_dict)
2422
del client_settings[client.name]["secret"]
2423
2424
try:
2425
with os.fdopen(os.open(stored_state_path,
2426
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2427
0600), "wb") as stored_state:
2428
pickle.dump((clients, client_settings), stored_state)
2429
except (IOError, OSError) as e:
2430
logger.warning("Could not save persistent state: {0}"
2431
.format(e))
2432
if e.errno not in (errno.ENOENT, errno.EACCES):
2433
raise
2434
2435
# Delete all clients, and settings from config
2436
while tcp_server.clients:
2437
name, client = tcp_server.clients.popitem()
2438
if use_dbus:
2439
client.remove_from_connection()
2440
# Don't signal anything except ClientRemoved
2441
client.disable(quiet=True)
2442
if use_dbus:
2443
# Emit D-Bus signal
2444
mandos_dbus_service.ClientRemoved(client
2445
.dbus_object_path,
2446
client.name)
2447
client_settings.clear()
2448
2449
atexit.register(cleanup)
2450
2451
for client in tcp_server.clients.itervalues():
1661
mandos_dbus_service = MandosDBusService()
1662
1663
for client in tcp_server.clients:
2452
1664
if use_dbus:
2453
1665
# Emit D-Bus signal
2454
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2455
# Need to initiate checking of clients
2456
if client.enabled:
2457
client.init_checker()
1666
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1667
client.GetAll(u""))
1668
client.enable()
2458
1669
2459
1670
tcp_server.enable()
2460
1671
tcp_server.server_activate()
2462
1673
# Find out what port we got
2463
1674
service.port = tcp_server.socket.getsockname()[1]
2464
1675
if use_ipv6:
2465
logger.info("Now listening on address %r, port %d,"
1676
logger.info(u"Now listening on address %r, port %d,"
2466
1677
" flowinfo %d, scope_id %d"
2467
1678
% tcp_server.socket.getsockname())
2468
1679
else: # IPv4
2469
logger.info("Now listening on address %r, port %d"
1680
logger.info(u"Now listening on address %r, port %d"
2470
1681
% tcp_server.socket.getsockname())
2471
1682
2472
1683
#service.interface = tcp_server.socket.getsockname()[3]
2475
1686
# From the Avahi example code
2476
1687
try:
2477
1688
service.activate()
2478
except dbus.exceptions.DBusException as error:
2479
logger.critical("DBusException: %s", error)
2480
cleanup()
1689
except dbus.exceptions.DBusException, error:
1690
logger.critical(u"DBusException: %s", error)
2481
1691
sys.exit(1)
2482
1692
# End of Avahi example code
2483
1693
2486
1696
(tcp_server.handle_request
2487
1697
(*args[2:], **kwargs) or True))
2488
1698
2489
logger.debug("Starting main loop")
1699
logger.debug(u"Starting main loop")
2490
1700
main_loop.run()
2491
except AvahiError as error:
2492
logger.critical("AvahiError: %s", error)
2493
cleanup()
1701
except AvahiError, error:
1702
logger.critical(u"AvahiError: %s", error)
2494
1703
sys.exit(1)
2495
1704
except KeyboardInterrupt:
2496
1705
if debug:
2497
print("", file=sys.stderr)
2498
logger.debug("Server received KeyboardInterrupt")
2499
logger.debug("Server exiting")
2500
# Must run before the D-Bus bus name gets deregistered
2501
cleanup()
2502
1706
print >> sys.stderr
1707
logger.debug(u"Server received KeyboardInterrupt")
1708
logger.debug(u"Server exiting")
2503
1709
2504
1710
if __name__ == '__main__':
2505
1711
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0