88
80
except ImportError:
89
81
SO_BINDTODEVICE = None
92
stored_state_file = "clients.pickle"
94
logger = logging.getLogger()
86
logger = logging.Logger(u'mandos')
95
87
syslogger = (logging.handlers.SysLogHandler
96
88
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
103
except (OSError, AttributeError):
104
def if_nametoindex(interface):
105
"Get an interface index the hard way, i.e. using fcntl()"
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
with contextlib.closing(socket.socket()) as s:
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
113
return interface_index
116
def initlogger(debug, level=logging.WARNING):
117
"""init logger and add loglevel"""
119
syslogger.setFormatter(logging.Formatter
120
('Mandos [%(process)d]: %(levelname)s:'
122
logger.addHandler(syslogger)
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
130
logger.addHandler(console)
131
logger.setLevel(level)
134
class PGPError(Exception):
135
"""Exception if encryption/decryption fails"""
139
class PGPEngine(object):
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
self.gnupg = GnuPGInterface.GnuPG()
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
154
def __exit__ (self, exc_type, exc_value, traceback):
162
if self.tempdir is not None:
163
# Delete contents of tempdir
164
for root, dirs, files in os.walk(self.tempdir,
166
for filename in files:
167
os.remove(os.path.join(root, filename))
169
os.rmdir(os.path.join(root, dirname))
171
os.rmdir(self.tempdir)
174
def password_encode(self, password):
175
# Passphrase can not be empty and can not contain newlines or
176
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
179
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
196
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
211
return decrypted_plaintext
89
address = "/dev/log"))
90
syslogger.setFormatter(logging.Formatter
91
(u'Mandos [%(process)d]: %(levelname)s:'
93
logger.addHandler(syslogger)
95
console = logging.StreamHandler()
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
99
logger.addHandler(console)
214
101
class AvahiError(Exception):
215
102
def __init__(self, value, *args, **kwargs):
315
191
dbus.UInt16(self.port),
316
192
avahi.string_array_to_txt_array(self.TXT))
317
193
self.group.Commit()
319
194
def entry_group_state_changed(self, state, error):
320
195
"""Derived from the Avahi example code"""
321
logger.debug("Avahi entry group state change: %i", state)
196
logger.debug(u"Avahi entry group state change: %i", state)
323
198
if state == avahi.ENTRY_GROUP_ESTABLISHED:
324
logger.debug("Zeroconf service established.")
199
logger.debug(u"Zeroconf service established.")
325
200
elif state == avahi.ENTRY_GROUP_COLLISION:
326
logger.info("Zeroconf service name collision.")
201
logger.warning(u"Zeroconf service name collision.")
328
203
elif state == avahi.ENTRY_GROUP_FAILURE:
329
logger.critical("Avahi: Error in group state changed %s",
204
logger.critical(u"Avahi: Error in group state changed %s",
331
raise AvahiGroupError("State changed: {0!s}"
206
raise AvahiGroupError(u"State changed: %s"
334
208
def cleanup(self):
335
209
"""Derived from the Avahi example code"""
336
210
if self.group is not None:
339
except (dbus.exceptions.UnknownMethodException,
340
dbus.exceptions.DBusException):
342
212
self.group = None
345
def server_state_changed(self, state, error=None):
213
def server_state_changed(self, state):
346
214
"""Derived from the Avahi example code"""
347
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
355
if state in bad_states:
356
if bad_states[state] is not None:
358
logger.error(bad_states[state])
360
logger.error(bad_states[state] + ": %r", error)
215
logger.debug(u"Avahi server state change: %i", state)
216
if state == avahi.SERVER_COLLISION:
217
logger.error(u"Zeroconf server name collision")
362
219
elif state == avahi.SERVER_RUNNING:
366
logger.debug("Unknown state: %r", state)
368
logger.debug("Unknown state: %r: %r", state, error)
370
221
def activate(self):
371
222
"""Derived from the Avahi example code"""
372
223
if self.server is None:
373
224
self.server = dbus.Interface(
374
225
self.bus.get_object(avahi.DBUS_NAME,
375
avahi.DBUS_PATH_SERVER,
376
follow_name_owner_changes=True),
226
avahi.DBUS_PATH_SERVER),
377
227
avahi.DBUS_INTERFACE_SERVER)
378
self.server.connect_to_signal("StateChanged",
228
self.server.connect_to_signal(u"StateChanged",
379
229
self.server_state_changed)
380
230
self.server_state_changed(self.server.GetState())
383
class AvahiServiceToSyslog(AvahiService):
385
"""Add the new name to the syslog messages"""
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
401
233
class Client(object):
402
234
"""A representation of a client host served by this server.
405
approved: bool(); 'None' if not yet approved/disapproved
406
approval_delay: datetime.timedelta(); Time to wait for approval
407
approval_duration: datetime.timedelta(); Duration of one approval
237
name: string; from the config file, used in log messages and
239
fingerprint: string (40 or 32 hexadecimal digits); used to
240
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
244
last_enabled: datetime.datetime(); (UTC)
246
last_checked_ok: datetime.datetime(); (UTC) or None
247
timeout: datetime.timedelta(); How long from last_checked_ok
248
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
408
251
checker: subprocess.Popen(); a running checker process used
409
252
to see if the client lives.
410
253
'None' if no process is running.
411
checker_callback_tag: a gobject event source tag, or None
412
checker_command: string; External command which is run to check
413
if client lives. %() expansions are done at
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
414
259
runtime with vars(self) as dict, so that for
415
260
instance %(name)s can be used in the command.
416
checker_initiator_tag: a gobject event source tag, or None
417
created: datetime.datetime(); (UTC) object creation
418
client_structure: Object describing what attributes a client has
419
and is used for storing the client at exit
420
261
current_checker_command: string; current running checker_command
421
disable_initiator_tag: a gobject event source tag, or None
423
fingerprint: string (40 or 32 hexadecimal digits); used to
424
uniquely identify the client
425
host: string; available for use by the checker command
426
interval: datetime.timedelta(); How often to start a new checker
427
last_approval_request: datetime.datetime(); (UTC) or None
428
last_checked_ok: datetime.datetime(); (UTC) or None
429
last_checker_status: integer between 0 and 255 reflecting exit
430
status of last checker. -1 reflects crashed
431
checker, -2 means no checker completed yet.
432
last_enabled: datetime.datetime(); (UTC) or None
433
name: string; from the config file, used in log messages and
435
secret: bytestring; sent verbatim (over TLS) to client
436
timeout: datetime.timedelta(); How long from last_checked_ok
437
until this client is disabled
438
extended_timeout: extra long timeout when secret has been sent
439
runtime_expansions: Allowed attributes for runtime expansion.
440
expires: datetime.datetime(); time (UTC) when a client will be
444
runtime_expansions = ("approval_delay", "approval_duration",
445
"created", "enabled", "expires",
446
"fingerprint", "host", "interval",
447
"last_approval_request", "last_checked_ok",
448
"last_enabled", "name", "timeout")
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
452
"checker": "fping -q -- %%(host)s",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
265
def _timedelta_to_milliseconds(td):
266
"Convert a datetime.timedelta() to milliseconds"
267
return ((td.days * 24 * 60 * 60 * 1000)
268
+ (td.seconds * 1000)
269
+ (td.microseconds // 1000))
460
271
def timeout_milliseconds(self):
461
272
"Return the 'timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.timeout)
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
273
return self._timedelta_to_milliseconds(self.timeout)
468
275
def interval_milliseconds(self):
469
276
"Return the 'interval' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.interval)
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
476
def config_parser(config):
477
"""Construct a new dict of client settings of this form:
478
{ client_name: {setting_name: value, ...}, ...}
479
with exceptions for any special settings as defined above.
480
NOTE: Must be a pure function. Must return the same result
481
value given the same arguments.
484
for client_name in config.sections():
485
section = dict(config.items(client_name))
486
client = settings[client_name] = {}
488
client["host"] = section["host"]
489
# Reformat values from string types to Python types
490
client["approved_by_default"] = config.getboolean(
491
client_name, "approved_by_default")
492
client["enabled"] = config.getboolean(client_name,
495
client["fingerprint"] = (section["fingerprint"].upper()
497
if "secret" in section:
498
client["secret"] = section["secret"].decode("base64")
499
elif "secfile" in section:
500
with open(os.path.expanduser(os.path.expandvars
501
(section["secfile"])),
503
client["secret"] = secfile.read()
505
raise TypeError("No secret or secfile for section {0}"
507
client["timeout"] = string_to_delta(section["timeout"])
508
client["extended_timeout"] = string_to_delta(
509
section["extended_timeout"])
510
client["interval"] = string_to_delta(section["interval"])
511
client["approval_delay"] = string_to_delta(
512
section["approval_delay"])
513
client["approval_duration"] = string_to_delta(
514
section["approval_duration"])
515
client["checker_command"] = section["checker"]
516
client["last_approval_request"] = None
517
client["last_checked_ok"] = None
518
client["last_checker_status"] = -2
522
def __init__(self, settings, name = None):
277
return self._timedelta_to_milliseconds(self.interval)
279
def __init__(self, name = None, disable_hook=None, config=None):
280
"""Note: the 'checker' key in 'config' sets the
281
'checker_command' attribute and *not* the 'checker'
524
# adding all client settings
525
for setting, value in settings.iteritems():
526
setattr(self, setting, value)
529
if not hasattr(self, "last_enabled"):
530
self.last_enabled = datetime.datetime.utcnow()
531
if not hasattr(self, "expires"):
532
self.expires = (datetime.datetime.utcnow()
535
self.last_enabled = None
538
logger.debug("Creating client %r", self.name)
286
logger.debug(u"Creating client %r", self.name)
539
287
# Uppercase and remove spaces from fingerprint for later
540
288
# comparison purposes with return value from the fingerprint()
542
logger.debug(" Fingerprint: %s", self.fingerprint)
543
self.created = settings.get("created",
544
datetime.datetime.utcnow())
546
# attributes specific for this server instance
290
self.fingerprint = (config[u"fingerprint"].upper()
292
logger.debug(u" Fingerprint: %s", self.fingerprint)
293
if u"secret" in config:
294
self.secret = config[u"secret"].decode(u"base64")
295
elif u"secfile" in config:
296
with open(os.path.expanduser(os.path.expandvars
297
(config[u"secfile"])),
299
self.secret = secfile.read()
301
raise TypeError(u"No secret or secfile for client %s"
303
self.host = config.get(u"host", u"")
304
self.created = datetime.datetime.utcnow()
306
self.last_enabled = None
307
self.last_checked_ok = None
308
self.timeout = string_to_delta(config[u"timeout"])
309
self.interval = string_to_delta(config[u"interval"])
310
self.disable_hook = disable_hook
547
311
self.checker = None
548
312
self.checker_initiator_tag = None
549
313
self.disable_initiator_tag = None
550
314
self.checker_callback_tag = None
315
self.checker_command = config[u"checker"]
551
316
self.current_checker_command = None
553
self.approvals_pending = 0
554
self.changedstate = (multiprocessing_manager
555
.Condition(multiprocessing_manager
557
self.client_structure = [attr for attr in
558
self.__dict__.iterkeys()
559
if not attr.startswith("_")]
560
self.client_structure.append("client_structure")
562
for name, t in inspect.getmembers(type(self),
566
if not name.startswith("_"):
567
self.client_structure.append(name)
569
# Send notice to process children that client state has changed
570
def send_changedstate(self):
571
with self.changedstate:
572
self.changedstate.notify_all()
317
self.last_connect = None
574
319
def enable(self):
575
320
"""Start this client's checker and timeout hooks"""
576
if getattr(self, "enabled", False):
321
if getattr(self, u"enabled", False):
577
322
# Already enabled
579
self.expires = datetime.datetime.utcnow() + self.timeout
581
324
self.last_enabled = datetime.datetime.utcnow()
583
self.send_changedstate()
585
def disable(self, quiet=True):
586
"""Disable this client."""
587
if not getattr(self, "enabled", False):
590
logger.info("Disabling client %s", self.name)
591
if getattr(self, "disable_initiator_tag", None) is not None:
592
gobject.source_remove(self.disable_initiator_tag)
593
self.disable_initiator_tag = None
595
if getattr(self, "checker_initiator_tag", None) is not None:
596
gobject.source_remove(self.checker_initiator_tag)
597
self.checker_initiator_tag = None
601
self.send_changedstate()
602
# Do not run this again if called by a gobject.timeout_add
608
def init_checker(self):
609
325
# Schedule a new checker to be started an 'interval' from now,
610
326
# and every interval from then on.
611
if self.checker_initiator_tag is not None:
612
gobject.source_remove(self.checker_initiator_tag)
613
327
self.checker_initiator_tag = (gobject.timeout_add
614
328
(self.interval_milliseconds(),
615
329
self.start_checker))
616
330
# Schedule a disable() when 'timeout' has passed
617
if self.disable_initiator_tag is not None:
618
gobject.source_remove(self.disable_initiator_tag)
619
331
self.disable_initiator_tag = (gobject.timeout_add
620
332
(self.timeout_milliseconds(),
622
335
# Also start a new checker *right now*.
623
336
self.start_checker()
338
def disable(self, quiet=True):
339
"""Disable this client."""
340
if not getattr(self, "enabled", False):
343
logger.info(u"Disabling client %s", self.name)
344
if getattr(self, u"disable_initiator_tag", False):
345
gobject.source_remove(self.disable_initiator_tag)
346
self.disable_initiator_tag = None
347
if getattr(self, u"checker_initiator_tag", False):
348
gobject.source_remove(self.checker_initiator_tag)
349
self.checker_initiator_tag = None
351
if self.disable_hook:
352
self.disable_hook(self)
354
# Do not run this again if called by a gobject.timeout_add
358
self.disable_hook = None
625
361
def checker_callback(self, pid, condition, command):
626
362
"""The checker has completed, so take appropriate actions."""
627
363
self.checker_callback_tag = None
628
364
self.checker = None
629
365
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
631
if self.last_checker_status == 0:
632
logger.info("Checker for %(name)s succeeded",
366
exitstatus = os.WEXITSTATUS(condition)
368
logger.info(u"Checker for %(name)s succeeded",
634
370
self.checked_ok()
636
logger.info("Checker for %(name)s failed",
372
logger.info(u"Checker for %(name)s failed",
639
self.last_checker_status = -1
640
logger.warning("Checker for %(name)s crashed?",
375
logger.warning(u"Checker for %(name)s crashed?",
643
378
def checked_ok(self):
644
"""Assert that the client has been seen, alive and well."""
379
"""Bump up the timeout for this client.
381
This should only be called when the client has been seen,
645
384
self.last_checked_ok = datetime.datetime.utcnow()
646
self.last_checker_status = 0
649
def bump_timeout(self, timeout=None):
650
"""Bump up the timeout for this client."""
652
timeout = self.timeout
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = None
656
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(timedelta_to_milliseconds
659
(timeout), self.disable))
660
self.expires = datetime.datetime.utcnow() + timeout
662
def need_approval(self):
663
self.last_approval_request = datetime.datetime.utcnow()
385
gobject.source_remove(self.disable_initiator_tag)
386
self.disable_initiator_tag = (gobject.timeout_add
387
(self.timeout_milliseconds(),
665
390
def start_checker(self):
666
391
"""Start a new checker subprocess if one is not running.
837
531
class DBusObjectWithProperties(dbus.service.Object):
838
532
"""A D-Bus object with properties.
840
534
Classes inheriting from this can use the dbus_service_property
841
535
decorator to expose methods as D-Bus properties. It exposes the
842
536
standard Get(), Set(), and GetAll() methods on the D-Bus.
846
def _is_dbus_thing(thing):
847
"""Returns a function testing if an attribute is a D-Bus thing
849
If called like _is_dbus_thing("method") it returns a function
850
suitable for use as predicate to inspect.getmembers().
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
540
def _is_dbus_property(obj):
541
return getattr(obj, u"_dbus_is_property", False)
855
def _get_all_dbus_things(self, thing):
543
def _get_all_dbus_properties(self):
856
544
"""Returns a generator of (name, attribute) pairs
858
return ((getattr(athing.__get__(self), "_dbus_name",
860
athing.__get__(self))
861
for cls in self.__class__.__mro__
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
546
return ((prop._dbus_name, prop)
548
inspect.getmembers(self, self._is_dbus_property))
866
550
def _get_dbus_property(self, interface_name, property_name):
867
551
"""Returns a bound method if one exists which is a D-Bus
868
552
property with the specified name and interface.
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
873
self._is_dbus_thing("property"))):
874
if (value._dbus_name == property_name
875
and value._dbus_interface == interface_name):
876
return value.__get__(self)
554
for name in (property_name,
555
property_name + u"_dbus_property"):
556
prop = getattr(self, name, None)
558
or not self._is_dbus_property(prop)
559
or prop._dbus_name != property_name
560
or (interface_name and prop._dbus_interface
561
and interface_name != prop._dbus_interface)):
878
564
# No such property
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
565
raise DBusPropertyNotFound(self.dbus_object_path + u":"
566
+ interface_name + u"."
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
569
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
885
571
def Get(self, interface_name, property_name):
886
572
"""Standard D-Bus property Get() method, see D-Bus standard.
888
574
prop = self._get_dbus_property(interface_name, property_name)
889
if prop._dbus_access == "write":
575
if prop._dbus_access == u"write":
890
576
raise DBusPropertyAccessException(property_name)
892
if not hasattr(value, "variant_level"):
578
if not hasattr(value, u"variant_level"):
894
580
return type(value)(value, variant_level=value.variant_level+1)
896
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
582
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
897
583
def Set(self, interface_name, property_name, value):
898
584
"""Standard D-Bus property Set() method, see D-Bus standard.
900
586
prop = self._get_dbus_property(interface_name, property_name)
901
if prop._dbus_access == "read":
587
if prop._dbus_access == u"read":
902
588
raise DBusPropertyAccessException(property_name)
903
if prop._dbus_get_args_options["byte_arrays"]:
589
if prop._dbus_get_args_options[u"byte_arrays"]:
904
590
# The byte_arrays option is not supported yet on
905
591
# signatures other than "ay".
906
if prop._dbus_signature != "ay":
592
if prop._dbus_signature != u"ay":
908
value = dbus.ByteArray(b''.join(chr(byte)
594
value = dbus.ByteArray(''.join(unichr(byte)
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
913
out_signature="a{sv}")
598
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
599
out_signature=u"a{sv}")
914
600
def GetAll(self, interface_name):
915
601
"""Standard D-Bus property GetAll() method, see D-Bus
918
604
Note: Will not include properties with access="write".
921
for name, prop in self._get_all_dbus_things("property"):
607
for name, prop in self._get_all_dbus_properties():
922
608
if (interface_name
923
609
and interface_name != prop._dbus_interface):
924
610
# Interface non-empty but did not match
926
612
# Ignore write-only properties
927
if prop._dbus_access == "write":
613
if prop._dbus_access == u"write":
930
if not hasattr(value, "variant_level"):
931
properties[name] = value
616
if not hasattr(value, u"variant_level"):
933
properties[name] = type(value)(value, variant_level=
934
value.variant_level+1)
935
return dbus.Dictionary(properties, signature="sv")
619
all[name] = type(value)(value, variant_level=
620
value.variant_level+1)
621
return dbus.Dictionary(all, signature=u"sv")
937
623
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
939
625
path_keyword='object_path',
940
626
connection_keyword='connection')
941
627
def Introspect(self, object_path, connection):
942
"""Overloading of standard D-Bus method.
944
Inserts property tags and interface annotation tags.
628
"""Standard D-Bus method, overloaded to insert property tags.
946
630
xmlstring = dbus.service.Object.Introspect(self, object_path,
949
633
document = xml.dom.minidom.parseString(xmlstring)
950
634
def make_tag(document, name, prop):
951
e = document.createElement("property")
952
e.setAttribute("name", name)
953
e.setAttribute("type", prop._dbus_signature)
954
e.setAttribute("access", prop._dbus_access)
635
e = document.createElement(u"property")
636
e.setAttribute(u"name", name)
637
e.setAttribute(u"type", prop._dbus_signature)
638
e.setAttribute(u"access", prop._dbus_access)
956
for if_tag in document.getElementsByTagName("interface"):
640
for if_tag in document.getElementsByTagName(u"interface"):
958
641
for tag in (make_tag(document, name, prop)
960
in self._get_all_dbus_things("property")
643
in self._get_all_dbus_properties()
961
644
if prop._dbus_interface
962
== if_tag.getAttribute("name")):
645
== if_tag.getAttribute(u"name")):
963
646
if_tag.appendChild(tag)
964
# Add annotation tags
965
for typ in ("method", "signal", "property"):
966
for tag in if_tag.getElementsByTagName(typ):
968
for name, prop in (self.
969
_get_all_dbus_things(typ)):
970
if (name == tag.getAttribute("name")
971
and prop._dbus_interface
972
== if_tag.getAttribute("name")):
973
annots.update(getattr
977
for name, value in annots.iteritems():
978
ann_tag = document.createElement(
980
ann_tag.setAttribute("name", name)
981
ann_tag.setAttribute("value", value)
982
tag.appendChild(ann_tag)
983
# Add interface annotation tags
984
for annotation, value in dict(
985
itertools.chain.from_iterable(
986
annotations().iteritems()
987
for name, annotations in
988
self._get_all_dbus_things("interface")
989
if name == if_tag.getAttribute("name")
991
ann_tag = document.createElement("annotation")
992
ann_tag.setAttribute("name", annotation)
993
ann_tag.setAttribute("value", value)
994
if_tag.appendChild(ann_tag)
995
647
# Add the names to the return values for the
996
648
# "org.freedesktop.DBus.Properties" methods
997
if (if_tag.getAttribute("name")
998
== "org.freedesktop.DBus.Properties"):
999
for cn in if_tag.getElementsByTagName("method"):
1000
if cn.getAttribute("name") == "Get":
1001
for arg in cn.getElementsByTagName("arg"):
1002
if (arg.getAttribute("direction")
1004
arg.setAttribute("name", "value")
1005
elif cn.getAttribute("name") == "GetAll":
1006
for arg in cn.getElementsByTagName("arg"):
1007
if (arg.getAttribute("direction")
1009
arg.setAttribute("name", "props")
1010
xmlstring = document.toxml("utf-8")
649
if (if_tag.getAttribute(u"name")
650
== u"org.freedesktop.DBus.Properties"):
651
for cn in if_tag.getElementsByTagName(u"method"):
652
if cn.getAttribute(u"name") == u"Get":
653
for arg in cn.getElementsByTagName(u"arg"):
654
if (arg.getAttribute(u"direction")
656
arg.setAttribute(u"name", u"value")
657
elif cn.getAttribute(u"name") == u"GetAll":
658
for arg in cn.getElementsByTagName(u"arg"):
659
if (arg.getAttribute(u"direction")
661
arg.setAttribute(u"name", u"props")
662
xmlstring = document.toxml(u"utf-8")
1011
663
document.unlink()
1012
664
except (AttributeError, xml.dom.DOMException,
1013
xml.parsers.expat.ExpatError) as error:
1014
logger.error("Failed to override Introspection method",
665
xml.parsers.expat.ExpatError), error:
666
logger.error(u"Failed to override Introspection method",
1016
668
return xmlstring
1019
def datetime_to_dbus (dt, variant_level=0):
1020
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1022
return dbus.String("", variant_level = variant_level)
1023
return dbus.String(dt.isoformat(),
1024
variant_level=variant_level)
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1028
"""A class decorator; applied to a subclass of
1029
dbus.service.Object, it will add alternate D-Bus attributes with
1030
interface names according to the "alt_interface_names" mapping.
1033
@alternate_dbus_names({"org.example.Interface":
1034
"net.example.AlternateInterface"})
1035
class SampleDBusObject(dbus.service.Object):
1036
@dbus.service.method("org.example.Interface")
1037
def SampleDBusMethod():
1040
The above "SampleDBusMethod" on "SampleDBusObject" will be
1041
reachable via two interfaces: "org.example.Interface" and
1042
"net.example.AlternateInterface", the latter of which will have
1043
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1044
"true", unless "deprecate" is passed with a False value.
1046
This works for methods and signals, and also for D-Bus properties
1047
(from DBusObjectWithProperties) and interfaces (from the
1048
dbus_interface_annotations decorator).
1051
for orig_interface_name, alt_interface_name in (
1052
alt_interface_names.iteritems()):
1054
interface_names = set()
1055
# Go though all attributes of the class
1056
for attrname, attribute in inspect.getmembers(cls):
1057
# Ignore non-D-Bus attributes, and D-Bus attributes
1058
# with the wrong interface name
1059
if (not hasattr(attribute, "_dbus_interface")
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1063
# Create an alternate D-Bus interface name based on
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1068
interface_names.add(alt_interface)
1069
# Is this a D-Bus signal?
1070
if getattr(attribute, "_dbus_is_signal", False):
1071
# Extract the original non-method function by
1073
nonmethod_func = (dict(
1074
zip(attribute.func_code.co_freevars,
1075
attribute.__closure__))["func"]
1077
# Create a new, but exactly alike, function
1078
# object, and decorate it to be a new D-Bus signal
1079
# with the alternate D-Bus interface name
1080
new_function = (dbus.service.signal
1082
attribute._dbus_signature)
1083
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1089
# Copy annotations, if any
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1093
except AttributeError:
1095
# Define a creator of a function to call both the
1096
# original and alternate functions, so both the
1097
# original and alternate signals gets sent when
1098
# the function is called
1099
def fixscope(func1, func2):
1100
"""This function is a scope container to pass
1101
func1 and func2 to the "call_both" function
1102
outside of its arguments"""
1103
def call_both(*args, **kwargs):
1104
"""This function will emit two D-Bus
1105
signals by calling func1 and func2"""
1106
func1(*args, **kwargs)
1107
func2(*args, **kwargs)
1109
# Create the "call_both" function and add it to
1111
attr[attrname] = fixscope(attribute, new_function)
1112
# Is this a D-Bus method?
1113
elif getattr(attribute, "_dbus_is_method", False):
1114
# Create a new, but exactly alike, function
1115
# object. Decorate it to be a new D-Bus method
1116
# with the alternate D-Bus interface name. Add it
1118
attr[attrname] = (dbus.service.method
1120
attribute._dbus_in_signature,
1121
attribute._dbus_out_signature)
1123
(attribute.func_code,
1124
attribute.func_globals,
1125
attribute.func_name,
1126
attribute.func_defaults,
1127
attribute.func_closure)))
1128
# Copy annotations, if any
1130
attr[attrname]._dbus_annotations = (
1131
dict(attribute._dbus_annotations))
1132
except AttributeError:
1134
# Is this a D-Bus property?
1135
elif getattr(attribute, "_dbus_is_property", False):
1136
# Create a new, but exactly alike, function
1137
# object, and decorate it to be a new D-Bus
1138
# property with the alternate D-Bus interface
1139
# name. Add it to the class.
1140
attr[attrname] = (dbus_service_property
1142
attribute._dbus_signature,
1143
attribute._dbus_access,
1145
._dbus_get_args_options
1148
(attribute.func_code,
1149
attribute.func_globals,
1150
attribute.func_name,
1151
attribute.func_defaults,
1152
attribute.func_closure)))
1153
# Copy annotations, if any
1155
attr[attrname]._dbus_annotations = (
1156
dict(attribute._dbus_annotations))
1157
except AttributeError:
1159
# Is this a D-Bus interface?
1160
elif getattr(attribute, "_dbus_is_interface", False):
1161
# Create a new, but exactly alike, function
1162
# object. Decorate it to be a new D-Bus interface
1163
# with the alternate D-Bus interface name. Add it
1165
attr[attrname] = (dbus_interface_annotations
1168
(attribute.func_code,
1169
attribute.func_globals,
1170
attribute.func_name,
1171
attribute.func_defaults,
1172
attribute.func_closure)))
1174
# Deprecate all alternate interfaces
1175
iname="_AlternateDBusNames_interface_annotation{0}"
1176
for interface_name in interface_names:
1177
@dbus_interface_annotations(interface_name)
1179
return { "org.freedesktop.DBus.Deprecated":
1181
# Find an unused name
1182
for aname in (iname.format(i)
1183
for i in itertools.count()):
1184
if aname not in attr:
1188
# Replace the class with a new subclass of it with
1189
# methods, signals, etc. as created above.
1190
cls = type(b"{0}Alternate".format(cls.__name__),
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
"se.bsnet.fukt.Mandos"})
1198
671
class ClientDBus(Client, DBusObjectWithProperties):
1199
672
"""A Client class using D-Bus
1213
682
Client.__init__(self, *args, **kwargs)
1214
683
# Only now, when this client is initialized, can it show up on
1216
client_object_name = unicode(self.name).translate(
1217
{ord("."): ord("_"),
1218
ord("-"): ord("_")})
1219
685
self.dbus_object_path = (dbus.ObjectPath
1220
("/clients/" + client_object_name))
687
+ self.name.replace(u".", u"_")))
1221
688
DBusObjectWithProperties.__init__(self, self.bus,
1222
689
self.dbus_object_path)
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1227
""" Modify a variable so that it's a property which announces
1228
its changes to DBus.
1230
transform_fun: Function that takes a value and a variant_level
1231
and transforms it to a D-Bus type.
1232
dbus_name: D-Bus name of the variable
1233
type_func: Function that transform the value before sending it
1234
to the D-Bus. Default: no transform
1235
variant_level: D-Bus variant level. Default: 1
1237
attrname = "_{0}".format(dbus_name)
1238
def setter(self, value):
1239
if hasattr(self, "dbus_object_path"):
1240
if (not hasattr(self, attrname) or
1241
type_func(getattr(self, attrname, None))
1242
!= type_func(value)):
1243
dbus_value = transform_func(type_func(value),
1246
self.PropertyChanged(dbus.String(dbus_name),
1248
setattr(self, attrname, value)
1250
return property(lambda self: getattr(self, attrname), setter)
1252
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1253
approvals_pending = notifychangeproperty(dbus.Boolean,
1256
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1257
last_enabled = notifychangeproperty(datetime_to_dbus,
1259
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1260
type_func = lambda checker:
1261
checker is not None)
1262
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1264
last_checker_status = notifychangeproperty(dbus.Int16,
1265
"LastCheckerStatus")
1266
last_approval_request = notifychangeproperty(
1267
datetime_to_dbus, "LastApprovalRequest")
1268
approved_by_default = notifychangeproperty(dbus.Boolean,
1269
"ApprovedByDefault")
1270
approval_delay = notifychangeproperty(dbus.UInt64,
1273
timedelta_to_milliseconds)
1274
approval_duration = notifychangeproperty(
1275
dbus.UInt64, "ApprovalDuration",
1276
type_func = timedelta_to_milliseconds)
1277
host = notifychangeproperty(dbus.String, "Host")
1278
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
timedelta_to_milliseconds)
1281
extended_timeout = notifychangeproperty(
1282
dbus.UInt64, "ExtendedTimeout",
1283
type_func = timedelta_to_milliseconds)
1284
interval = notifychangeproperty(dbus.UInt64,
1287
timedelta_to_milliseconds)
1288
checker_command = notifychangeproperty(dbus.String, "Checker")
1290
del notifychangeproperty
692
def _datetime_to_dbus(dt, variant_level=0):
693
"""Convert a UTC datetime.datetime() to a D-Bus type."""
694
return dbus.String(dt.isoformat(),
695
variant_level=variant_level)
698
oldstate = getattr(self, u"enabled", False)
699
r = Client.enable(self)
700
if oldstate != self.enabled:
702
self.PropertyChanged(dbus.String(u"enabled"),
703
dbus.Boolean(True, variant_level=1))
704
self.PropertyChanged(
705
dbus.String(u"last_enabled"),
706
self._datetime_to_dbus(self.last_enabled,
710
def disable(self, quiet = False):
711
oldstate = getattr(self, u"enabled", False)
712
r = Client.disable(self, quiet=quiet)
713
if not quiet and oldstate != self.enabled:
715
self.PropertyChanged(dbus.String(u"enabled"),
716
dbus.Boolean(False, variant_level=1))
1292
719
def __del__(self, *args, **kwargs):
1294
721
self.remove_from_connection()
1295
722
except LookupError:
1297
if hasattr(DBusObjectWithProperties, "__del__"):
724
if hasattr(DBusObjectWithProperties, u"__del__"):
1298
725
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1299
726
Client.__del__(self, *args, **kwargs)
1433
# ApprovalPending - property
1434
@dbus_service_property(_interface, signature="b", access="read")
1435
def ApprovalPending_dbus_property(self):
1436
return dbus.Boolean(bool(self.approvals_pending))
1438
# ApprovedByDefault - property
1439
@dbus_service_property(_interface, signature="b",
1441
def ApprovedByDefault_dbus_property(self, value=None):
1442
if value is None: # get
1443
return dbus.Boolean(self.approved_by_default)
1444
self.approved_by_default = bool(value)
1446
# ApprovalDelay - property
1447
@dbus_service_property(_interface, signature="t",
1449
def ApprovalDelay_dbus_property(self, value=None):
1450
if value is None: # get
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1452
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1454
# ApprovalDuration - property
1455
@dbus_service_property(_interface, signature="t",
1457
def ApprovalDuration_dbus_property(self, value=None):
1458
if value is None: # get
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1461
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1464
@dbus_service_property(_interface, signature="s", access="read")
1465
def Name_dbus_property(self):
853
@dbus_service_property(_interface, signature=u"s", access=u"read")
854
def name_dbus_property(self):
1466
855
return dbus.String(self.name)
1468
# Fingerprint - property
1469
@dbus_service_property(_interface, signature="s", access="read")
1470
def Fingerprint_dbus_property(self):
857
# fingerprint - property
858
@dbus_service_property(_interface, signature=u"s", access=u"read")
859
def fingerprint_dbus_property(self):
1471
860
return dbus.String(self.fingerprint)
1474
@dbus_service_property(_interface, signature="s",
1476
def Host_dbus_property(self, value=None):
863
@dbus_service_property(_interface, signature=u"s",
865
def host_dbus_property(self, value=None):
1477
866
if value is None: # get
1478
867
return dbus.String(self.host)
1479
self.host = unicode(value)
1481
# Created - property
1482
@dbus_service_property(_interface, signature="s", access="read")
1483
def Created_dbus_property(self):
1484
return datetime_to_dbus(self.created)
1486
# LastEnabled - property
1487
@dbus_service_property(_interface, signature="s", access="read")
1488
def LastEnabled_dbus_property(self):
1489
return datetime_to_dbus(self.last_enabled)
1491
# Enabled - property
1492
@dbus_service_property(_interface, signature="b",
1494
def Enabled_dbus_property(self, value=None):
870
self.PropertyChanged(dbus.String(u"host"),
871
dbus.String(value, variant_level=1))
874
@dbus_service_property(_interface, signature=u"s", access=u"read")
875
def created_dbus_property(self):
876
return dbus.String(self._datetime_to_dbus(self.created))
878
# last_enabled - property
879
@dbus_service_property(_interface, signature=u"s", access=u"read")
880
def last_enabled_dbus_property(self):
881
if self.last_enabled is None:
882
return dbus.String(u"")
883
return dbus.String(self._datetime_to_dbus(self.last_enabled))
886
@dbus_service_property(_interface, signature=u"b",
888
def enabled_dbus_property(self, value=None):
1495
889
if value is None: # get
1496
890
return dbus.Boolean(self.enabled)
1502
# LastCheckedOK - property
1503
@dbus_service_property(_interface, signature="s",
1505
def LastCheckedOK_dbus_property(self, value=None):
896
# last_checked_ok - property
897
@dbus_service_property(_interface, signature=u"s",
899
def last_checked_ok_dbus_property(self, value=None):
1506
900
if value is not None:
1507
901
self.checked_ok()
1509
return datetime_to_dbus(self.last_checked_ok)
1511
# LastCheckerStatus - property
1512
@dbus_service_property(_interface, signature="n",
1514
def LastCheckerStatus_dbus_property(self):
1515
return dbus.Int16(self.last_checker_status)
1517
# Expires - property
1518
@dbus_service_property(_interface, signature="s", access="read")
1519
def Expires_dbus_property(self):
1520
return datetime_to_dbus(self.expires)
1522
# LastApprovalRequest - property
1523
@dbus_service_property(_interface, signature="s", access="read")
1524
def LastApprovalRequest_dbus_property(self):
1525
return datetime_to_dbus(self.last_approval_request)
1527
# Timeout - property
1528
@dbus_service_property(_interface, signature="t",
1530
def Timeout_dbus_property(self, value=None):
903
if self.last_checked_ok is None:
904
return dbus.String(u"")
905
return dbus.String(self._datetime_to_dbus(self
909
@dbus_service_property(_interface, signature=u"t",
911
def timeout_dbus_property(self, value=None):
1531
912
if value is None: # get
1532
913
return dbus.UInt64(self.timeout_milliseconds())
1533
old_timeout = self.timeout
1534
914
self.timeout = datetime.timedelta(0, 0, 0, value)
1535
# Reschedule disabling
1537
now = datetime.datetime.utcnow()
1538
self.expires += self.timeout - old_timeout
1539
if self.expires <= now:
1540
# The timeout has passed
1543
if (getattr(self, "disable_initiator_tag", None)
1546
gobject.source_remove(self.disable_initiator_tag)
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1552
# ExtendedTimeout - property
1553
@dbus_service_property(_interface, signature="t",
1555
def ExtendedTimeout_dbus_property(self, value=None):
1556
if value is None: # get
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
1558
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1560
# Interval - property
1561
@dbus_service_property(_interface, signature="t",
1563
def Interval_dbus_property(self, value=None):
916
self.PropertyChanged(dbus.String(u"timeout"),
917
dbus.UInt64(value, variant_level=1))
918
if getattr(self, u"disable_initiator_tag", None) is None:
921
gobject.source_remove(self.disable_initiator_tag)
922
self.disable_initiator_tag = None
924
_timedelta_to_milliseconds((self
930
# The timeout has passed
933
self.disable_initiator_tag = (gobject.timeout_add
934
(time_to_die, self.disable))
936
# interval - property
937
@dbus_service_property(_interface, signature=u"t",
939
def interval_dbus_property(self, value=None):
1564
940
if value is None: # get
1565
941
return dbus.UInt64(self.interval_milliseconds())
1566
942
self.interval = datetime.timedelta(0, 0, 0, value)
1567
if getattr(self, "checker_initiator_tag", None) is None:
944
self.PropertyChanged(dbus.String(u"interval"),
945
dbus.UInt64(value, variant_level=1))
946
if getattr(self, u"checker_initiator_tag", None) is None:
1570
# Reschedule checker run
1571
gobject.source_remove(self.checker_initiator_tag)
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
1576
# Checker - property
1577
@dbus_service_property(_interface, signature="s",
1579
def Checker_dbus_property(self, value=None):
948
# Reschedule checker run
949
gobject.source_remove(self.checker_initiator_tag)
950
self.checker_initiator_tag = (gobject.timeout_add
951
(value, self.start_checker))
952
self.start_checker() # Start one now, too
955
@dbus_service_property(_interface, signature=u"s",
957
def checker_dbus_property(self, value=None):
1580
958
if value is None: # get
1581
959
return dbus.String(self.checker_command)
1582
self.checker_command = unicode(value)
960
self.checker_command = value
962
self.PropertyChanged(dbus.String(u"checker"),
963
dbus.String(self.checker_command,
1584
# CheckerRunning - property
1585
@dbus_service_property(_interface, signature="b",
1587
def CheckerRunning_dbus_property(self, value=None):
966
# checker_running - property
967
@dbus_service_property(_interface, signature=u"b",
969
def checker_running_dbus_property(self, value=None):
1588
970
if value is None: # get
1589
971
return dbus.Boolean(self.checker is not None)
1670
1028
# Start communication using the Mandos protocol
1671
1029
# Get protocol number
1672
1030
line = self.request.makefile().readline()
1673
logger.debug("Protocol version: %r", line)
1031
logger.debug(u"Protocol version: %r", line)
1675
1033
if int(line.strip().split()[0]) > 1:
1676
1034
raise RuntimeError
1677
except (ValueError, IndexError, RuntimeError) as error:
1678
logger.error("Unknown protocol version: %s", error)
1035
except (ValueError, IndexError, RuntimeError), error:
1036
logger.error(u"Unknown protocol version: %s", error)
1681
1039
# Start GnuTLS connection
1683
1041
session.handshake()
1684
except gnutls.errors.GNUTLSError as error:
1685
logger.warning("Handshake failed: %s", error)
1042
except gnutls.errors.GNUTLSError, error:
1043
logger.warning(u"Handshake failed: %s", error)
1686
1044
# Do not run session.bye() here: the session is not
1687
1045
# established. Just abandon the request.
1689
logger.debug("Handshake succeeded")
1691
approval_required = False
1047
logger.debug(u"Handshake succeeded")
1694
1050
fpr = self.fingerprint(self.peer_certificate
1697
gnutls.errors.GNUTLSError) as error:
1698
logger.warning("Bad certificate: %s", error)
1700
logger.debug("Fingerprint: %s", fpr)
1703
client = ProxyClient(child_pipe, fpr,
1704
self.client_address)
1708
if client.approval_delay:
1709
delay = client.approval_delay
1710
client.approvals_pending += 1
1711
approval_required = True
1714
if not client.enabled:
1715
logger.info("Client %s is disabled",
1717
if self.server.use_dbus:
1719
client.Rejected("Disabled")
1722
if client.approved or not client.approval_delay:
1723
#We are approved or approval is disabled
1052
except (TypeError, gnutls.errors.GNUTLSError), error:
1053
logger.warning(u"Bad certificate: %s", error)
1055
logger.debug(u"Fingerprint: %s", fpr)
1057
for c in self.server.clients:
1058
if c.fingerprint == fpr:
1725
elif client.approved is None:
1726
logger.info("Client %s needs approval",
1728
if self.server.use_dbus:
1730
client.NeedApproval(
1731
client.approval_delay_milliseconds(),
1732
client.approved_by_default)
1734
logger.warning("Client %s was not approved",
1736
if self.server.use_dbus:
1738
client.Rejected("Denied")
1741
#wait until timeout or approved
1742
time = datetime.datetime.now()
1743
client.changedstate.acquire()
1744
client.changedstate.wait(
1745
float(timedelta_to_milliseconds(delay)
1747
client.changedstate.release()
1748
time2 = datetime.datetime.now()
1749
if (time2 - time) >= delay:
1750
if not client.approved_by_default:
1751
logger.warning("Client %s timed out while"
1752
" waiting for approval",
1754
if self.server.use_dbus:
1756
client.Rejected("Approval timed out")
1761
delay -= time2 - time
1062
ipc.write(u"NOTFOUND %s %s\n"
1063
% (fpr, unicode(self.client_address)))
1066
class ClientProxy(object):
1067
"""Client proxy object. Not for calling methods."""
1068
def __init__(self, client):
1069
self.client = client
1070
def __getattr__(self, name):
1071
if name.startswith("ipc_"):
1073
ipc.write("%s %s\n" % (name[4:].upper(),
1076
if not hasattr(self.client, name):
1077
raise AttributeError
1078
ipc.write(u"GETATTR %s %s\n"
1079
% (name, self.client.fingerprint))
1080
return pickle.load(ipc_return)
1081
clientproxy = ClientProxy(client)
1082
# Have to check if client.enabled, since it is
1083
# possible that the client was disabled since the
1084
# GnuTLS session was established.
1085
if not clientproxy.enabled:
1086
clientproxy.ipc_disabled()
1089
clientproxy.ipc_sending()
1764
1091
while sent_size < len(client.secret):
1766
sent = session.send(client.secret[sent_size:])
1767
except gnutls.errors.GNUTLSError as error:
1768
logger.warning("gnutls send failed",
1771
logger.debug("Sent: %d, remaining: %d",
1092
sent = session.send(client.secret[sent_size:])
1093
logger.debug(u"Sent: %d, remaining: %d",
1772
1094
sent, len(client.secret)
1773
1095
- (sent_size + sent))
1774
1096
sent_size += sent
1776
logger.info("Sending secret to %s", client.name)
1777
# bump the timeout using extended_timeout
1778
client.bump_timeout(client.extended_timeout)
1779
if self.server.use_dbus:
1784
if approval_required:
1785
client.approvals_pending -= 1
1788
except gnutls.errors.GNUTLSError as error:
1789
logger.warning("GnuTLS bye failed",
1793
1101
def peer_certificate(session):
1982
1273
def server_activate(self):
1983
1274
if self.enabled:
1984
1275
return socketserver.TCPServer.server_activate(self)
1986
1276
def enable(self):
1987
1277
self.enabled = True
1989
def add_pipe(self, parent_pipe, proc):
1278
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1990
1279
# Call "handle_ipc" for both data and EOF events
1991
gobject.io_add_watch(parent_pipe.fileno(),
1280
gobject.io_add_watch(child_pipe_fd.fileno(),
1992
1281
gobject.IO_IN | gobject.IO_HUP,
1993
1282
functools.partial(self.handle_ipc,
1998
def handle_ipc(self, source, condition, parent_pipe=None,
1999
proc = None, client_object=None):
2000
# error, or the other end of multiprocessing.Pipe has closed
2001
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2002
# Wait for other process to exit
2006
# Read a request from the child
2007
request = parent_pipe.recv()
2008
command = request[0]
2010
if command == 'init':
2012
address = request[2]
2014
for c in self.clients.itervalues():
2015
if c.fingerprint == fpr:
2019
logger.info("Client not found for fingerprint: %s, ad"
2020
"dress: %s", fpr, address)
2023
mandos_dbus_service.ClientNotFound(fpr,
2025
parent_pipe.send(False)
2028
gobject.io_add_watch(parent_pipe.fileno(),
2029
gobject.IO_IN | gobject.IO_HUP,
2030
functools.partial(self.handle_ipc,
2036
parent_pipe.send(True)
2037
# remove the old hook in favor of the new above hook on
2040
if command == 'funcall':
2041
funcname = request[1]
2045
parent_pipe.send(('data', getattr(client_object,
2049
if command == 'getattr':
2050
attrname = request[1]
2051
if callable(client_object.__getattribute__(attrname)):
2052
parent_pipe.send(('function',))
2054
parent_pipe.send(('data', client_object
2055
.__getattribute__(attrname)))
2057
if command == 'setattr':
2058
attrname = request[1]
2060
setattr(client_object, attrname, value)
1283
reply = parent_pipe_fd,
1284
sender= child_pipe_fd))
1285
def handle_ipc(self, source, condition, reply=None, sender=None):
1287
gobject.IO_IN: u"IN", # There is data to read.
1288
gobject.IO_OUT: u"OUT", # Data can be written (without
1290
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1291
gobject.IO_ERR: u"ERR", # Error condition.
1292
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1293
# broken, usually for pipes and
1296
conditions_string = ' | '.join(name
1298
condition_names.iteritems()
1299
if cond & condition)
1300
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1303
# Read a line from the file object
1304
cmdline = sender.readline()
1305
if not cmdline: # Empty line means end of file
1306
# close the IPC pipes
1310
# Stop calling this function
1313
logger.debug(u"IPC command: %r", cmdline)
1315
# Parse and act on command
1316
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1318
if cmd == u"NOTFOUND":
1319
fpr, address = args.split(None, 1)
1320
logger.warning(u"Client not found for fingerprint: %s, ad"
1321
u"dress: %s", fpr, address)
1324
mandos_dbus_service.ClientNotFound(fpr, address)
1325
elif cmd == u"DISABLED":
1326
for client in self.clients:
1327
if client.name == args:
1328
logger.warning(u"Client %s is disabled", args)
1334
logger.error(u"Unknown client %s is disabled", args)
1335
elif cmd == u"SENDING":
1336
for client in self.clients:
1337
if client.name == args:
1338
logger.info(u"Sending secret to %s", client.name)
1345
logger.error(u"Sending secret to unknown client %s",
1347
elif cmd == u"GETATTR":
1348
attr_name, fpr = args.split(None, 1)
1349
for client in self.clients:
1350
if client.fingerprint == fpr:
1351
attr_value = getattr(client, attr_name, None)
1352
logger.debug("IPC reply: %r", attr_value)
1353
pickle.dump(attr_value, reply)
1356
logger.error(u"Client %s on address %s requesting "
1357
u"attribute %s not found", fpr, address,
1359
pickle.dump(None, reply)
1361
logger.error(u"Unknown IPC command: %r", cmdline)
1363
# Keep calling this function
2065
1367
def string_to_delta(interval):
2066
1368
"""Parse a string and return a datetime.timedelta
2068
>>> string_to_delta('7d')
1370
>>> string_to_delta(u'7d')
2069
1371
datetime.timedelta(7)
2070
>>> string_to_delta('60s')
1372
>>> string_to_delta(u'60s')
2071
1373
datetime.timedelta(0, 60)
2072
>>> string_to_delta('60m')
1374
>>> string_to_delta(u'60m')
2073
1375
datetime.timedelta(0, 3600)
2074
>>> string_to_delta('24h')
1376
>>> string_to_delta(u'24h')
2075
1377
datetime.timedelta(1)
2076
>>> string_to_delta('1w')
1378
>>> string_to_delta(u'1w')
2077
1379
datetime.timedelta(7)
2078
>>> string_to_delta('5m 30s')
1380
>>> string_to_delta(u'5m 30s')
2079
1381
datetime.timedelta(0, 330)
2081
1383
timevalue = datetime.timedelta(0)
2132
1457
##################################################################
2133
1458
# Parsing of options, both command line and config file
2135
parser = argparse.ArgumentParser()
2136
parser.add_argument("-v", "--version", action="version",
2137
version = "%(prog)s {0}".format(version),
2138
help="show version number and exit")
2139
parser.add_argument("-i", "--interface", metavar="IF",
2140
help="Bind to interface IF")
2141
parser.add_argument("-a", "--address",
2142
help="Address to listen for requests on")
2143
parser.add_argument("-p", "--port", type=int,
2144
help="Port number to receive requests on")
2145
parser.add_argument("--check", action="store_true",
2146
help="Run self-test")
2147
parser.add_argument("--debug", action="store_true",
2148
help="Debug mode; run in foreground and log"
2150
parser.add_argument("--debuglevel", metavar="LEVEL",
2151
help="Debug level for stdout output")
2152
parser.add_argument("--priority", help="GnuTLS"
2153
" priority string (see GnuTLS documentation)")
2154
parser.add_argument("--servicename",
2155
metavar="NAME", help="Zeroconf service name")
2156
parser.add_argument("--configdir",
2157
default="/etc/mandos", metavar="DIR",
2158
help="Directory to search for configuration"
2160
parser.add_argument("--no-dbus", action="store_false",
2161
dest="use_dbus", help="Do not provide D-Bus"
2162
" system bus interface")
2163
parser.add_argument("--no-ipv6", action="store_false",
2164
dest="use_ipv6", help="Do not use IPv6")
2165
parser.add_argument("--no-restore", action="store_false",
2166
dest="restore", help="Do not restore stored"
2168
parser.add_argument("--statedir", metavar="DIR",
2169
help="Directory to save/restore state in")
2171
options = parser.parse_args()
1460
parser = optparse.OptionParser(version = "%%prog %s" % version)
1461
parser.add_option("-i", u"--interface", type=u"string",
1462
metavar="IF", help=u"Bind to interface IF")
1463
parser.add_option("-a", u"--address", type=u"string",
1464
help=u"Address to listen for requests on")
1465
parser.add_option("-p", u"--port", type=u"int",
1466
help=u"Port number to receive requests on")
1467
parser.add_option("--check", action=u"store_true",
1468
help=u"Run self-test")
1469
parser.add_option("--debug", action=u"store_true",
1470
help=u"Debug mode; run in foreground and log to"
1472
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1473
u" priority string (see GnuTLS documentation)")
1474
parser.add_option("--servicename", type=u"string",
1475
metavar=u"NAME", help=u"Zeroconf service name")
1476
parser.add_option("--configdir", type=u"string",
1477
default=u"/etc/mandos", metavar=u"DIR",
1478
help=u"Directory to search for configuration"
1480
parser.add_option("--no-dbus", action=u"store_false",
1481
dest=u"use_dbus", help=u"Do not provide D-Bus"
1482
u" system bus interface")
1483
parser.add_option("--no-ipv6", action=u"store_false",
1484
dest=u"use_ipv6", help=u"Do not use IPv6")
1485
options = parser.parse_args()[0]
2173
1487
if options.check:
2225
1535
##################################################################
2227
1537
# For convenience
2228
debug = server_settings["debug"]
2229
debuglevel = server_settings["debuglevel"]
2230
use_dbus = server_settings["use_dbus"]
2231
use_ipv6 = server_settings["use_ipv6"]
2232
stored_state_path = os.path.join(server_settings["statedir"],
2236
initlogger(debug, logging.DEBUG)
2241
level = getattr(logging, debuglevel.upper())
2242
initlogger(debug, level)
2244
if server_settings["servicename"] != "Mandos":
1538
debug = server_settings[u"debug"]
1539
use_dbus = server_settings[u"use_dbus"]
1540
use_ipv6 = server_settings[u"use_ipv6"]
1543
syslogger.setLevel(logging.WARNING)
1544
console.setLevel(logging.WARNING)
1546
if server_settings[u"servicename"] != u"Mandos":
2245
1547
syslogger.setFormatter(logging.Formatter
2246
('Mandos ({0}) [%(process)d]:'
2247
' %(levelname)s: %(message)s'
2248
.format(server_settings
1548
(u'Mandos (%s) [%%(process)d]:'
1549
u' %%(levelname)s: %%(message)s'
1550
% server_settings[u"servicename"]))
2251
1552
# Parse config file with clients
2252
client_config = configparser.SafeConfigParser(Client
2254
client_config.read(os.path.join(server_settings["configdir"],
1553
client_defaults = { u"timeout": u"1h",
1555
u"checker": u"fping -q -- %%(host)s",
1558
client_config = configparser.SafeConfigParser(client_defaults)
1559
client_config.read(os.path.join(server_settings[u"configdir"],
2257
1562
global mandos_dbus_service
2258
1563
mandos_dbus_service = None
2260
tcp_server = MandosServer((server_settings["address"],
2261
server_settings["port"]),
1565
tcp_server = MandosServer((server_settings[u"address"],
1566
server_settings[u"port"]),
2263
interface=(server_settings["interface"]
1568
interface=(server_settings[u"interface"]
2265
1570
use_ipv6=use_ipv6,
2266
1571
gnutls_priority=
2267
server_settings["priority"],
1572
server_settings[u"priority"],
2268
1573
use_dbus=use_dbus)
2270
pidfilename = "/var/run/mandos.pid"
2272
pidfile = open(pidfilename, "w")
2273
except IOError as e:
2274
logger.error("Could not open file %r", pidfilename,
1574
pidfilename = u"/var/run/mandos.pid"
1576
pidfile = open(pidfilename, u"w")
1578
logger.error(u"Could not open file %r", pidfilename)
2277
for name in ("_mandos", "mandos", "nobody"):
1581
uid = pwd.getpwnam(u"_mandos").pw_uid
1582
gid = pwd.getpwnam(u"_mandos").pw_gid
2279
uid = pwd.getpwnam(name).pw_uid
2280
gid = pwd.getpwnam(name).pw_gid
1585
uid = pwd.getpwnam(u"mandos").pw_uid
1586
gid = pwd.getpwnam(u"mandos").pw_gid
2282
1587
except KeyError:
1589
uid = pwd.getpwnam(u"nobody").pw_uid
1590
gid = pwd.getpwnam(u"nobody").pw_gid
2290
except OSError as error:
2291
if error.errno != errno.EPERM:
1597
except OSError, error:
1598
if error[0] != errno.EPERM:
1601
# Enable all possible GnuTLS debugging
2295
# Enable all possible GnuTLS debugging
2297
1603
# "Use a log level over 10 to enable all debugging options."
2298
1604
# - GnuTLS manual
2299
1605
gnutls.library.functions.gnutls_global_set_log_level(11)
2301
1607
@gnutls.library.types.gnutls_log_func
2302
1608
def debug_gnutls(level, string):
2303
logger.debug("GnuTLS: %s", string[:-1])
1609
logger.debug(u"GnuTLS: %s", string[:-1])
2305
1611
(gnutls.library.functions
2306
1612
.gnutls_global_set_log_function(debug_gnutls))
2308
# Redirect stdin so all checkers get /dev/null
2309
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2310
os.dup2(null, sys.stdin.fileno())
2314
# Need to fork before connecting to D-Bus
2316
# Close all input and output, do double fork, etc.
2319
gobject.threads_init()
2321
1614
global main_loop
2322
1615
# From the Avahi example code
2323
DBusGMainLoop(set_as_default=True)
1616
DBusGMainLoop(set_as_default=True )
2324
1617
main_loop = gobject.MainLoop()
2325
1618
bus = dbus.SystemBus()
2326
1619
# End of Avahi example code
2329
bus_name = dbus.service.BusName("se.recompile.Mandos",
1622
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2330
1623
bus, do_not_queue=True)
2331
old_bus_name = (dbus.service.BusName
2332
("se.bsnet.fukt.Mandos", bus,
2334
except dbus.exceptions.NameExistsException as e:
2335
logger.error("Disabling D-Bus:", exc_info=e)
1624
except dbus.exceptions.NameExistsException, e:
1625
logger.error(unicode(e) + u", disabling D-Bus")
2336
1626
use_dbus = False
2337
server_settings["use_dbus"] = False
1627
server_settings[u"use_dbus"] = False
2338
1628
tcp_server.use_dbus = False
2339
1629
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2340
service = AvahiServiceToSyslog(name =
2341
server_settings["servicename"],
2342
servicetype = "_mandos._tcp",
2343
protocol = protocol, bus = bus)
1630
service = AvahiService(name = server_settings[u"servicename"],
1631
servicetype = u"_mandos._tcp",
1632
protocol = protocol, bus = bus)
2344
1633
if server_settings["interface"]:
2345
1634
service.interface = (if_nametoindex
2346
(str(server_settings["interface"])))
2348
global multiprocessing_manager
2349
multiprocessing_manager = multiprocessing.Manager()
1635
(str(server_settings[u"interface"])))
2351
1637
client_class = Client
2353
1639
client_class = functools.partial(ClientDBus, bus = bus)
2355
client_settings = Client.config_parser(client_config)
2356
old_client_settings = {}
2359
# Get client data and settings from last running state.
2360
if server_settings["restore"]:
2362
with open(stored_state_path, "rb") as stored_state:
2363
clients_data, old_client_settings = (pickle.load
2365
os.remove(stored_state_path)
2366
except IOError as e:
2367
if e.errno == errno.ENOENT:
2368
logger.warning("Could not load persistent state: {0}"
2369
.format(os.strerror(e.errno)))
2371
logger.critical("Could not load persistent state:",
2374
except EOFError as e:
2375
logger.warning("Could not load persistent state: "
2376
"EOFError:", exc_info=e)
2378
with PGPEngine() as pgp:
2379
for client_name, client in clients_data.iteritems():
2380
# Decide which value to use after restoring saved state.
2381
# We have three different values: Old config file,
2382
# new config file, and saved state.
2383
# New config value takes precedence if it differs from old
2384
# config value, otherwise use saved state.
2385
for name, value in client_settings[client_name].items():
2387
# For each value in new config, check if it
2388
# differs from the old config value (Except for
2389
# the "secret" attribute)
2390
if (name != "secret" and
2391
value != old_client_settings[client_name]
2393
client[name] = value
2397
# Clients who has passed its expire date can still be
2398
# enabled if its last checker was successful. Clients
2399
# whose checker succeeded before we stored its state is
2400
# assumed to have successfully run all checkers during
2402
if client["enabled"]:
2403
if datetime.datetime.utcnow() >= client["expires"]:
2404
if not client["last_checked_ok"]:
2406
"disabling client {0} - Client never "
2407
"performed a successful checker"
2408
.format(client_name))
2409
client["enabled"] = False
2410
elif client["last_checker_status"] != 0:
2412
"disabling client {0} - Client "
2413
"last checker failed with error code {1}"
2414
.format(client_name,
2415
client["last_checker_status"]))
2416
client["enabled"] = False
2418
client["expires"] = (datetime.datetime
2420
+ client["timeout"])
2421
logger.debug("Last checker succeeded,"
2422
" keeping {0} enabled"
2423
.format(client_name))
2425
client["secret"] = (
2426
pgp.decrypt(client["encrypted_secret"],
2427
client_settings[client_name]
2430
# If decryption fails, we use secret from new settings
2431
logger.debug("Failed to decrypt {0} old secret"
2432
.format(client_name))
2433
client["secret"] = (
2434
client_settings[client_name]["secret"])
2436
# Add/remove clients based on new changes made to config
2437
for client_name in (set(old_client_settings)
2438
- set(client_settings)):
2439
del clients_data[client_name]
2440
for client_name in (set(client_settings)
2441
- set(old_client_settings)):
2442
clients_data[client_name] = client_settings[client_name]
2444
# Create all client objects
2445
for client_name, client in clients_data.iteritems():
2446
tcp_server.clients[client_name] = client_class(
2447
name = client_name, settings = client)
1640
tcp_server.clients.update(set(
1641
client_class(name = section,
1642
config= dict(client_config.items(section)))
1643
for section in client_config.sections()))
2449
1644
if not tcp_server.clients:
2450
logger.warning("No clients defined")
1645
logger.warning(u"No clients defined")
1648
# Redirect stdin so all checkers get /dev/null
1649
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1650
os.dup2(null, sys.stdin.fileno())
1654
# No console logging
1655
logger.removeHandler(console)
1656
# Close all input and output, do double fork, etc.
1662
pidfile.write(str(pid) + "\n")
1665
logger.error(u"Could not write to file %r with PID %d",
1668
# "pidfile" was never created
2456
pidfile.write(str(pid) + "\n".encode("utf-8"))
2459
logger.error("Could not write to file %r with PID %d",
2462
# "pidfile" was never created
1673
signal.signal(signal.SIGINT, signal.SIG_IGN)
2466
1674
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2467
1675
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2470
@alternate_dbus_interfaces({"se.recompile.Mandos":
2471
"se.bsnet.fukt.Mandos"})
2472
class MandosDBusService(DBusObjectWithProperties):
1678
class MandosDBusService(dbus.service.Object):
2473
1679
"""A D-Bus proxy object"""
2474
1680
def __init__(self):
2475
dbus.service.Object.__init__(self, bus, "/")
2476
_interface = "se.recompile.Mandos"
2478
@dbus_interface_annotations(_interface)
2480
return { "org.freedesktop.DBus.Property"
2481
".EmitsChangedSignal":
2484
@dbus.service.signal(_interface, signature="o")
1681
dbus.service.Object.__init__(self, bus, u"/")
1682
_interface = u"se.bsnet.fukt.Mandos"
1684
@dbus.service.signal(_interface, signature=u"o")
2485
1685
def ClientAdded(self, objpath):
2489
@dbus.service.signal(_interface, signature="ss")
1689
@dbus.service.signal(_interface, signature=u"ss")
2490
1690
def ClientNotFound(self, fingerprint, address):
2494
@dbus.service.signal(_interface, signature="os")
1694
@dbus.service.signal(_interface, signature=u"os")
2495
1695
def ClientRemoved(self, objpath, name):
2499
@dbus.service.method(_interface, out_signature="ao")
1699
@dbus.service.method(_interface, out_signature=u"ao")
2500
1700
def GetAllClients(self):
2502
1702
return dbus.Array(c.dbus_object_path
2504
tcp_server.clients.itervalues())
1703
for c in tcp_server.clients)
2506
1705
@dbus.service.method(_interface,
2507
out_signature="a{oa{sv}}")
1706
out_signature=u"a{oa{sv}}")
2508
1707
def GetAllClientsWithProperties(self):
2510
1709
return dbus.Dictionary(
2511
((c.dbus_object_path, c.GetAll(""))
2512
for c in tcp_server.clients.itervalues()),
1710
((c.dbus_object_path, c.GetAll(u""))
1711
for c in tcp_server.clients),
1712
signature=u"oa{sv}")
2515
@dbus.service.method(_interface, in_signature="o")
1714
@dbus.service.method(_interface, in_signature=u"o")
2516
1715
def RemoveClient(self, object_path):
2518
for c in tcp_server.clients.itervalues():
1717
for c in tcp_server.clients:
2519
1718
if c.dbus_object_path == object_path:
2520
del tcp_server.clients[c.name]
1719
tcp_server.clients.remove(c)
2521
1720
c.remove_from_connection()
2522
1721
# Don't signal anything except ClientRemoved
2523
1722
c.disable(quiet=True)