290
229
if config is None:
292
231
logger.debug(u"Creating client %r", self.name)
232
self.use_dbus = False # During __init__
293
233
# Uppercase and remove spaces from fingerprint for later
294
234
# comparison purposes with return value from the fingerprint()
296
self.fingerprint = (config[u"fingerprint"].upper()
236
self.fingerprint = (config["fingerprint"].upper()
297
237
.replace(u" ", u""))
298
238
logger.debug(u" Fingerprint: %s", self.fingerprint)
299
if u"secret" in config:
300
self.secret = config[u"secret"].decode(u"base64")
301
elif u"secfile" in config:
302
with open(os.path.expanduser(os.path.expandvars
303
(config[u"secfile"])),
239
if "secret" in config:
240
self.secret = config["secret"].decode(u"base64")
241
elif "secfile" in config:
242
with closing(open(os.path.expanduser
244
(config["secfile"])))) as secfile:
305
245
self.secret = secfile.read()
307
#XXX Need to allow secret on demand!
308
247
raise TypeError(u"No secret or secfile for client %s"
310
self.host = config.get(u"host", u"")
249
self.host = config.get("host", "")
311
250
self.created = datetime.datetime.utcnow()
312
251
self.enabled = False
313
252
self.last_enabled = None
314
253
self.last_checked_ok = None
315
self.timeout = string_to_delta(config[u"timeout"])
316
self.interval = string_to_delta(config[u"interval"])
254
self.timeout = string_to_delta(config["timeout"])
255
self.interval = string_to_delta(config["interval"])
317
256
self.disable_hook = disable_hook
318
257
self.checker = None
319
258
self.checker_initiator_tag = None
320
259
self.disable_initiator_tag = None
321
260
self.checker_callback_tag = None
322
self.checker_command = config[u"checker"]
323
self.current_checker_command = None
261
self.checker_command = config["checker"]
324
262
self.last_connect = None
325
self._approved = None
326
self.approved_by_default = config.get(u"approved_by_default",
328
self.approvals_pending = 0
329
self.approved_delay = string_to_delta(
330
config[u"approved_delay"])
331
self.approved_duration = string_to_delta(
332
config[u"approved_duration"])
333
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
263
# Only now, when this client is initialized, can it show up on
265
self.use_dbus = use_dbus
267
self.dbus_object_path = (dbus.ObjectPath
269
+ self.name.replace(".", "_")))
270
dbus.service.Object.__init__(self, bus,
271
self.dbus_object_path)
335
def send_changedstate(self):
336
self.changedstate.acquire()
337
self.changedstate.notify_all()
338
self.changedstate.release()
340
273
def enable(self):
341
274
"""Start this client's checker and timeout hooks"""
342
if getattr(self, u"enabled", False):
345
self.send_changedstate()
346
275
self.last_enabled = datetime.datetime.utcnow()
347
276
# Schedule a new checker to be started an 'interval' from now,
348
277
# and every interval from then on.
349
278
self.checker_initiator_tag = (gobject.timeout_add
350
279
(self.interval_milliseconds(),
351
280
self.start_checker))
281
# Also start a new checker *right now*.
352
283
# Schedule a disable() when 'timeout' has passed
353
284
self.disable_initiator_tag = (gobject.timeout_add
354
285
(self.timeout_milliseconds(),
356
287
self.enabled = True
357
# Also start a new checker *right now*.
290
self.PropertyChanged(dbus.String(u"enabled"),
291
dbus.Boolean(True, variant_level=1))
292
self.PropertyChanged(dbus.String(u"last_enabled"),
293
(_datetime_to_dbus(self.last_enabled,
360
def disable(self, quiet=True):
361
297
"""Disable this client."""
362
298
if not getattr(self, "enabled", False):
365
self.send_changedstate()
367
logger.info(u"Disabling client %s", self.name)
368
if getattr(self, u"disable_initiator_tag", False):
300
logger.info(u"Disabling client %s", self.name)
301
if getattr(self, "disable_initiator_tag", False):
369
302
gobject.source_remove(self.disable_initiator_tag)
370
303
self.disable_initiator_tag = None
371
if getattr(self, u"checker_initiator_tag", False):
304
if getattr(self, "checker_initiator_tag", False):
372
305
gobject.source_remove(self.checker_initiator_tag)
373
306
self.checker_initiator_tag = None
374
307
self.stop_checker()
375
308
if self.disable_hook:
376
309
self.disable_hook(self)
377
310
self.enabled = False
313
self.PropertyChanged(dbus.String(u"enabled"),
314
dbus.Boolean(False, variant_level=1))
378
315
# Do not run this again if called by a gobject.timeout_add
489
431
if self.checker_callback_tag:
490
432
gobject.source_remove(self.checker_callback_tag)
491
433
self.checker_callback_tag = None
492
if getattr(self, u"checker", None) is None:
434
if getattr(self, "checker", None) is None:
494
436
logger.debug(u"Stopping checker for %(name)s", vars(self))
496
438
os.kill(self.checker.pid, signal.SIGTERM)
498
440
#if self.checker.poll() is None:
499
441
# os.kill(self.checker.pid, signal.SIGKILL)
500
442
except OSError, error:
501
443
if error.errno != errno.ESRCH: # No such process
503
445
self.checker = None
505
def dbus_service_property(dbus_interface, signature=u"v",
506
access=u"readwrite", byte_arrays=False):
507
"""Decorators for marking methods of a DBusObjectWithProperties to
508
become properties on the D-Bus.
510
The decorated method will be called with no arguments by "Get"
511
and with one argument by "Set".
513
The parameters, where they are supported, are the same as
514
dbus.service.method, except there is only "signature", since the
515
type from Get() and the type sent to Set() is the same.
517
# Encoding deeply encoded byte arrays is not supported yet by the
518
# "Set" method, so we fail early here:
519
if byte_arrays and signature != u"ay":
520
raise ValueError(u"Byte arrays not supported for non-'ay'"
521
u" signature %r" % signature)
523
func._dbus_is_property = True
524
func._dbus_interface = dbus_interface
525
func._dbus_signature = signature
526
func._dbus_access = access
527
func._dbus_name = func.__name__
528
if func._dbus_name.endswith(u"_dbus_property"):
529
func._dbus_name = func._dbus_name[:-14]
530
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
535
class DBusPropertyException(dbus.exceptions.DBusException):
536
"""A base class for D-Bus property-related exceptions
538
def __unicode__(self):
539
return unicode(str(self))
542
class DBusPropertyAccessException(DBusPropertyException):
543
"""A property's access permissions disallows an operation.
548
class DBusPropertyNotFound(DBusPropertyException):
549
"""An attempt was made to access a non-existing property.
554
class DBusObjectWithProperties(dbus.service.Object):
555
"""A D-Bus object with properties.
557
Classes inheriting from this can use the dbus_service_property
558
decorator to expose methods as D-Bus properties. It exposes the
559
standard Get(), Set(), and GetAll() methods on the D-Bus.
563
def _is_dbus_property(obj):
564
return getattr(obj, u"_dbus_is_property", False)
566
def _get_all_dbus_properties(self):
567
"""Returns a generator of (name, attribute) pairs
569
return ((prop._dbus_name, prop)
571
inspect.getmembers(self, self._is_dbus_property))
573
def _get_dbus_property(self, interface_name, property_name):
574
"""Returns a bound method if one exists which is a D-Bus
575
property with the specified name and interface.
577
for name in (property_name,
578
property_name + u"_dbus_property"):
579
prop = getattr(self, name, None)
581
or not self._is_dbus_property(prop)
582
or prop._dbus_name != property_name
583
or (interface_name and prop._dbus_interface
584
and interface_name != prop._dbus_interface)):
588
raise DBusPropertyNotFound(self.dbus_object_path + u":"
589
+ interface_name + u"."
592
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
594
def Get(self, interface_name, property_name):
595
"""Standard D-Bus property Get() method, see D-Bus standard.
597
prop = self._get_dbus_property(interface_name, property_name)
598
if prop._dbus_access == u"write":
599
raise DBusPropertyAccessException(property_name)
601
if not hasattr(value, u"variant_level"):
603
return type(value)(value, variant_level=value.variant_level+1)
605
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
606
def Set(self, interface_name, property_name, value):
607
"""Standard D-Bus property Set() method, see D-Bus standard.
609
prop = self._get_dbus_property(interface_name, property_name)
610
if prop._dbus_access == u"read":
611
raise DBusPropertyAccessException(property_name)
612
if prop._dbus_get_args_options[u"byte_arrays"]:
613
# The byte_arrays option is not supported yet on
614
# signatures other than "ay".
615
if prop._dbus_signature != u"ay":
617
value = dbus.ByteArray(''.join(unichr(byte)
621
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
622
out_signature=u"a{sv}")
623
def GetAll(self, interface_name):
624
"""Standard D-Bus property GetAll() method, see D-Bus
627
Note: Will not include properties with access="write".
630
for name, prop in self._get_all_dbus_properties():
632
and interface_name != prop._dbus_interface):
633
# Interface non-empty but did not match
635
# Ignore write-only properties
636
if prop._dbus_access == u"write":
639
if not hasattr(value, u"variant_level"):
642
all[name] = type(value)(value, variant_level=
643
value.variant_level+1)
644
return dbus.Dictionary(all, signature=u"sv")
646
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
648
path_keyword='object_path',
649
connection_keyword='connection')
650
def Introspect(self, object_path, connection):
651
"""Standard D-Bus method, overloaded to insert property tags.
653
xmlstring = dbus.service.Object.Introspect(self, object_path,
656
document = xml.dom.minidom.parseString(xmlstring)
657
def make_tag(document, name, prop):
658
e = document.createElement(u"property")
659
e.setAttribute(u"name", name)
660
e.setAttribute(u"type", prop._dbus_signature)
661
e.setAttribute(u"access", prop._dbus_access)
663
for if_tag in document.getElementsByTagName(u"interface"):
664
for tag in (make_tag(document, name, prop)
666
in self._get_all_dbus_properties()
667
if prop._dbus_interface
668
== if_tag.getAttribute(u"name")):
669
if_tag.appendChild(tag)
670
# Add the names to the return values for the
671
# "org.freedesktop.DBus.Properties" methods
672
if (if_tag.getAttribute(u"name")
673
== u"org.freedesktop.DBus.Properties"):
674
for cn in if_tag.getElementsByTagName(u"method"):
675
if cn.getAttribute(u"name") == u"Get":
676
for arg in cn.getElementsByTagName(u"arg"):
677
if (arg.getAttribute(u"direction")
679
arg.setAttribute(u"name", u"value")
680
elif cn.getAttribute(u"name") == u"GetAll":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
684
arg.setAttribute(u"name", u"props")
685
xmlstring = document.toxml(u"utf-8")
687
except (AttributeError, xml.dom.DOMException,
688
xml.parsers.expat.ExpatError), error:
689
logger.error(u"Failed to override Introspection method",
694
class ClientDBus(Client, DBusObjectWithProperties):
695
"""A Client class using D-Bus
698
dbus_object_path: dbus.ObjectPath
699
bus: dbus.SystemBus()
701
# dbus.service.Object doesn't use super(), so we can't either.
703
def __init__(self, bus = None, *args, **kwargs):
704
self._approvals_pending = 0
706
Client.__init__(self, *args, **kwargs)
707
# Only now, when this client is initialized, can it show up on
709
self.dbus_object_path = (dbus.ObjectPath
711
+ self.name.replace(u".", u"_")))
712
DBusObjectWithProperties.__init__(self, self.bus,
713
self.dbus_object_path)
715
#Could possible return a bool(self._approvals_pending),
716
#but this could mess up approvals_pending += 1 XXX
717
def _get_approvals_pending(self):
718
return self._approvals_pending
719
def _set_approvals_pending(self, value):
720
old_value = self._approvals_pending
721
self._approvals_pending = value
723
if (hasattr(self, "dbus_object_path")
724
and bval is not bool(old_value)):
725
dbus_bool = dbus.Boolean(bval, variant_level=1)
726
self.PropertyChanged(dbus.String(u"approved_pending"),
729
approvals_pending = property(_get_approvals_pending,
730
_set_approvals_pending)
731
del _get_approvals_pending, _set_approvals_pending
734
def _datetime_to_dbus(dt, variant_level=0):
735
"""Convert a UTC datetime.datetime() to a D-Bus type."""
736
return dbus.String(dt.isoformat(),
737
variant_level=variant_level)
740
oldstate = getattr(self, u"enabled", False)
741
r = Client.enable(self)
742
if oldstate != self.enabled:
744
self.PropertyChanged(dbus.String(u"enabled"),
745
dbus.Boolean(True, variant_level=1))
746
self.PropertyChanged(
747
dbus.String(u"last_enabled"),
748
self._datetime_to_dbus(self.last_enabled,
752
def disable(self, quiet = False):
753
oldstate = getattr(self, u"enabled", False)
754
r = Client.disable(self, quiet=quiet)
755
if not quiet and oldstate != self.enabled:
757
self.PropertyChanged(dbus.String(u"enabled"),
758
dbus.Boolean(False, variant_level=1))
761
def __del__(self, *args, **kwargs):
763
self.remove_from_connection()
766
if hasattr(DBusObjectWithProperties, u"__del__"):
767
DBusObjectWithProperties.__del__(self, *args, **kwargs)
768
Client.__del__(self, *args, **kwargs)
770
def checker_callback(self, pid, condition, command,
772
self.checker_callback_tag = None
775
self.PropertyChanged(dbus.String(u"checker_running"),
776
dbus.Boolean(False, variant_level=1))
777
if os.WIFEXITED(condition):
778
exitstatus = os.WEXITSTATUS(condition)
780
self.CheckerCompleted(dbus.Int16(exitstatus),
781
dbus.Int64(condition),
782
dbus.String(command))
785
self.CheckerCompleted(dbus.Int16(-1),
786
dbus.Int64(condition),
787
dbus.String(command))
789
return Client.checker_callback(self, pid, condition, command,
792
def checked_ok(self, *args, **kwargs):
793
r = Client.checked_ok(self, *args, **kwargs)
795
self.PropertyChanged(
796
dbus.String(u"last_checked_ok"),
797
(self._datetime_to_dbus(self.last_checked_ok,
801
def start_checker(self, *args, **kwargs):
802
old_checker = self.checker
803
if self.checker is not None:
804
old_checker_pid = self.checker.pid
806
old_checker_pid = None
807
r = Client.start_checker(self, *args, **kwargs)
808
# Only if new checker process was started
809
if (self.checker is not None
810
and old_checker_pid != self.checker.pid):
812
self.CheckerStarted(self.current_checker_command)
813
self.PropertyChanged(
814
dbus.String(u"checker_running"),
815
dbus.Boolean(True, variant_level=1))
818
def stop_checker(self, *args, **kwargs):
819
old_checker = getattr(self, u"checker", None)
820
r = Client.stop_checker(self, *args, **kwargs)
821
if (old_checker is not None
822
and getattr(self, u"checker", None) is None):
823
447
self.PropertyChanged(dbus.String(u"checker_running"),
824
448
dbus.Boolean(False, variant_level=1))
827
def _reset_approved(self):
828
self._approved = None
831
def approve(self, value=True):
832
self.send_changedstate()
833
self._approved = value
834
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
835
self._reset_approved)
838
## D-Bus methods, signals & properties
450
def still_valid(self):
451
"""Has the timeout not yet passed for this client?"""
452
if not getattr(self, "enabled", False):
454
now = datetime.datetime.utcnow()
455
if self.last_checked_ok is None:
456
return now < (self.created + self.timeout)
458
return now < (self.last_checked_ok + self.timeout)
460
## D-Bus methods & signals
839
461
_interface = u"se.bsnet.fukt.Mandos.Client"
464
CheckedOK = dbus.service.method(_interface)(checked_ok)
465
CheckedOK.__name__ = "CheckedOK"
843
467
# CheckerCompleted - signal
844
@dbus.service.signal(_interface, signature=u"nxs")
468
@dbus.service.signal(_interface, signature="nxs")
845
469
def CheckerCompleted(self, exitcode, waitstatus, command):
849
473
# CheckerStarted - signal
850
@dbus.service.signal(_interface, signature=u"s")
474
@dbus.service.signal(_interface, signature="s")
851
475
def CheckerStarted(self, command):
479
# GetAllProperties - method
480
@dbus.service.method(_interface, out_signature="a{sv}")
481
def GetAllProperties(self):
483
return dbus.Dictionary({
485
dbus.String(self.name, variant_level=1),
486
dbus.String("fingerprint"):
487
dbus.String(self.fingerprint, variant_level=1),
489
dbus.String(self.host, variant_level=1),
490
dbus.String("created"):
491
_datetime_to_dbus(self.created, variant_level=1),
492
dbus.String("last_enabled"):
493
(_datetime_to_dbus(self.last_enabled,
495
if self.last_enabled is not None
496
else dbus.Boolean(False, variant_level=1)),
497
dbus.String("enabled"):
498
dbus.Boolean(self.enabled, variant_level=1),
499
dbus.String("last_checked_ok"):
500
(_datetime_to_dbus(self.last_checked_ok,
502
if self.last_checked_ok is not None
503
else dbus.Boolean (False, variant_level=1)),
504
dbus.String("timeout"):
505
dbus.UInt64(self.timeout_milliseconds(),
507
dbus.String("interval"):
508
dbus.UInt64(self.interval_milliseconds(),
510
dbus.String("checker"):
511
dbus.String(self.checker_command,
513
dbus.String("checker_running"):
514
dbus.Boolean(self.checker is not None,
516
dbus.String("object_path"):
517
dbus.ObjectPath(self.dbus_object_path,
521
# IsStillValid - method
522
IsStillValid = (dbus.service.method(_interface, out_signature="b")
524
IsStillValid.__name__ = "IsStillValid"
855
526
# PropertyChanged - signal
856
@dbus.service.signal(_interface, signature=u"sv")
527
@dbus.service.signal(_interface, signature="sv")
857
528
def PropertyChanged(self, property, value):
862
# XXXTEDDY Is sent after succesfull transfer of secret from mandos-server to mandos-client
863
@dbus.service.signal(_interface)
869
@dbus.service.signal(_interface, signature=u"s")
870
def Rejected(self, reason):
874
# NeedApproval - signal
875
@dbus.service.signal(_interface, signature=u"db")
876
def NeedApproval(self, timeout, default):
883
@dbus.service.method(_interface, in_signature=u"b")
884
def Approve(self, value):
888
@dbus.service.method(_interface)
890
return self.checked_ok()
532
# SetChecker - method
533
@dbus.service.method(_interface, in_signature="s")
534
def SetChecker(self, checker):
535
"D-Bus setter method"
536
self.checker_command = checker
538
self.PropertyChanged(dbus.String(u"checker"),
539
dbus.String(self.checker_command,
543
@dbus.service.method(_interface, in_signature="s")
544
def SetHost(self, host):
545
"D-Bus setter method"
548
self.PropertyChanged(dbus.String(u"host"),
549
dbus.String(self.host, variant_level=1))
551
# SetInterval - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetInterval(self, milliseconds):
554
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
556
self.PropertyChanged(dbus.String(u"interval"),
557
(dbus.UInt64(self.interval_milliseconds(),
561
@dbus.service.method(_interface, in_signature="ay",
563
def SetSecret(self, secret):
564
"D-Bus setter method"
565
self.secret = str(secret)
567
# SetTimeout - method
568
@dbus.service.method(_interface, in_signature="t")
569
def SetTimeout(self, milliseconds):
570
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
572
self.PropertyChanged(dbus.String(u"timeout"),
573
(dbus.UInt64(self.timeout_milliseconds(),
892
576
# Enable - method
893
@dbus.service.method(_interface)
577
Enable = dbus.service.method(_interface)(enable)
578
Enable.__name__ = "Enable"
898
580
# StartChecker - method
899
581
@dbus.service.method(_interface)
910
592
# StopChecker - method
911
@dbus.service.method(_interface)
912
def StopChecker(self):
917
# approved_pending - property
918
@dbus_service_property(_interface, signature=u"b", access=u"read")
919
def approved_pending_dbus_property(self):
920
return dbus.Boolean(bool(self.approvals_pending))
922
# approved_by_default - property
923
@dbus_service_property(_interface, signature=u"b",
925
def approved_by_default_dbus_property(self):
926
return dbus.Boolean(self.approved_by_default)
928
# approved_delay - property
929
@dbus_service_property(_interface, signature=u"t",
931
def approved_delay_dbus_property(self):
932
return dbus.UInt64(self.approved_delay_milliseconds())
934
# approved_duration - property
935
@dbus_service_property(_interface, signature=u"t",
937
def approved_duration_dbus_property(self):
938
return dbus.UInt64(self._timedelta_to_milliseconds(
939
self.approved_duration))
942
@dbus_service_property(_interface, signature=u"s", access=u"read")
943
def name_dbus_property(self):
944
return dbus.String(self.name)
946
# fingerprint - property
947
@dbus_service_property(_interface, signature=u"s", access=u"read")
948
def fingerprint_dbus_property(self):
949
return dbus.String(self.fingerprint)
952
@dbus_service_property(_interface, signature=u"s",
954
def host_dbus_property(self, value=None):
955
if value is None: # get
956
return dbus.String(self.host)
959
self.PropertyChanged(dbus.String(u"host"),
960
dbus.String(value, variant_level=1))
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
964
def created_dbus_property(self):
965
return dbus.String(self._datetime_to_dbus(self.created))
967
# last_enabled - property
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
969
def last_enabled_dbus_property(self):
970
if self.last_enabled is None:
971
return dbus.String(u"")
972
return dbus.String(self._datetime_to_dbus(self.last_enabled))
975
@dbus_service_property(_interface, signature=u"b",
977
def enabled_dbus_property(self, value=None):
978
if value is None: # get
979
return dbus.Boolean(self.enabled)
985
# last_checked_ok - property
986
@dbus_service_property(_interface, signature=u"s",
988
def last_checked_ok_dbus_property(self, value=None):
989
if value is not None:
992
if self.last_checked_ok is None:
993
return dbus.String(u"")
994
return dbus.String(self._datetime_to_dbus(self
998
@dbus_service_property(_interface, signature=u"t",
1000
def timeout_dbus_property(self, value=None):
1001
if value is None: # get
1002
return dbus.UInt64(self.timeout_milliseconds())
1003
self.timeout = datetime.timedelta(0, 0, 0, value)
1005
self.PropertyChanged(dbus.String(u"timeout"),
1006
dbus.UInt64(value, variant_level=1))
1007
if getattr(self, u"disable_initiator_tag", None) is None:
1009
# Reschedule timeout
1010
gobject.source_remove(self.disable_initiator_tag)
1011
self.disable_initiator_tag = None
1012
time_to_die = (self.
1013
_timedelta_to_milliseconds((self
1018
if time_to_die <= 0:
1019
# The timeout has passed
1022
self.disable_initiator_tag = (gobject.timeout_add
1023
(time_to_die, self.disable))
1025
# interval - property
1026
@dbus_service_property(_interface, signature=u"t",
1027
access=u"readwrite")
1028
def interval_dbus_property(self, value=None):
1029
if value is None: # get
1030
return dbus.UInt64(self.interval_milliseconds())
1031
self.interval = datetime.timedelta(0, 0, 0, value)
1033
self.PropertyChanged(dbus.String(u"interval"),
1034
dbus.UInt64(value, variant_level=1))
1035
if getattr(self, u"checker_initiator_tag", None) is None:
1037
# Reschedule checker run
1038
gobject.source_remove(self.checker_initiator_tag)
1039
self.checker_initiator_tag = (gobject.timeout_add
1040
(value, self.start_checker))
1041
self.start_checker() # Start one now, too
1043
# checker - property
1044
@dbus_service_property(_interface, signature=u"s",
1045
access=u"readwrite")
1046
def checker_dbus_property(self, value=None):
1047
if value is None: # get
1048
return dbus.String(self.checker_command)
1049
self.checker_command = value
1051
self.PropertyChanged(dbus.String(u"checker"),
1052
dbus.String(self.checker_command,
1055
# checker_running - property
1056
@dbus_service_property(_interface, signature=u"b",
1057
access=u"readwrite")
1058
def checker_running_dbus_property(self, value=None):
1059
if value is None: # get
1060
return dbus.Boolean(self.checker is not None)
1062
self.start_checker()
1066
# object_path - property
1067
@dbus_service_property(_interface, signature=u"o", access=u"read")
1068
def object_path_dbus_property(self):
1069
return self.dbus_object_path # is already a dbus.ObjectPath
1072
@dbus_service_property(_interface, signature=u"ay",
1073
access=u"write", byte_arrays=True)
1074
def secret_dbus_property(self, value):
1075
self.secret = str(value)
593
StopChecker = dbus.service.method(_interface)(stop_checker)
594
StopChecker.__name__ = "StopChecker"
1080
class ProxyClient(object):
1081
def __init__(self, child_pipe, fpr, address):
1082
self._pipe = child_pipe
1083
self._pipe.send(('init', fpr, address))
1084
if not self._pipe.recv():
1087
def __getattribute__(self, name):
1088
if(name == '_pipe'):
1089
return super(ProxyClient, self).__getattribute__(name)
1090
self._pipe.send(('getattr', name))
1091
data = self._pipe.recv()
1092
if data[0] == 'data':
1094
if data[0] == 'function':
1095
def func(*args, **kwargs):
1096
self._pipe.send(('funcall', name, args, kwargs))
1097
return self._pipe.recv()[1]
1100
def __setattr__(self, name, value):
1101
if(name == '_pipe'):
1102
return super(ProxyClient, self).__setattr__(name, value)
1103
self._pipe.send(('setattr', name, value))
1106
class ClientHandler(socketserver.BaseRequestHandler, object):
1107
"""A class to handle client connections.
1109
Instantiated once for each connection to handle it.
599
def peer_certificate(session):
600
"Return the peer's OpenPGP certificate as a bytestring"
601
# If not an OpenPGP certificate...
602
if (gnutls.library.functions
603
.gnutls_certificate_type_get(session._c_object)
604
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
605
# ...do the normal thing
606
return session.peer_certificate
607
list_size = ctypes.c_uint(1)
608
cert_list = (gnutls.library.functions
609
.gnutls_certificate_get_peers
610
(session._c_object, ctypes.byref(list_size)))
611
if not bool(cert_list) and list_size.value != 0:
612
raise gnutls.errors.GNUTLSError("error getting peer"
614
if list_size.value == 0:
617
return ctypes.string_at(cert.data, cert.size)
620
def fingerprint(openpgp):
621
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
622
# New GnuTLS "datum" with the OpenPGP public key
623
datum = (gnutls.library.types
624
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
627
ctypes.c_uint(len(openpgp))))
628
# New empty GnuTLS certificate
629
crt = gnutls.library.types.gnutls_openpgp_crt_t()
630
(gnutls.library.functions
631
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
632
# Import the OpenPGP public key into the certificate
633
(gnutls.library.functions
634
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
635
gnutls.library.constants
636
.GNUTLS_OPENPGP_FMT_RAW))
637
# Verify the self signature in the key
638
crtverify = ctypes.c_uint()
639
(gnutls.library.functions
640
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
641
if crtverify.value != 0:
642
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
643
raise gnutls.errors.CertificateSecurityError("Verify failed")
644
# New buffer for the fingerprint
645
buf = ctypes.create_string_buffer(20)
646
buf_len = ctypes.c_size_t()
647
# Get the fingerprint from the certificate into the buffer
648
(gnutls.library.functions
649
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
650
ctypes.byref(buf_len)))
651
# Deinit the certificate
652
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
653
# Convert the buffer to a Python bytestring
654
fpr = ctypes.string_at(buf, buf_len.value)
655
# Convert the bytestring to hexadecimal notation
656
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
660
class TCP_handler(SocketServer.BaseRequestHandler, object):
661
"""A TCP request handler class.
662
Instantiated by IPv6_TCPServer for each request to handle it.
1110
663
Note: This will run in its own forked process."""
1112
665
def handle(self):
1113
with contextlib.closing(self.server.child_pipe) as child_pipe:
1114
logger.info(u"TCP connection from: %s",
1115
unicode(self.client_address))
1116
logger.debug(u"Pipe FD: %d",
1117
self.server.child_pipe.fileno())
1119
session = (gnutls.connection
1120
.ClientSession(self.request,
1122
.X509Credentials()))
1124
# Note: gnutls.connection.X509Credentials is really a
1125
# generic GnuTLS certificate credentials object so long as
1126
# no X.509 keys are added to it. Therefore, we can use it
1127
# here despite using OpenPGP certificates.
1129
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1130
# u"+AES-256-CBC", u"+SHA1",
1131
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1133
# Use a fallback default, since this MUST be set.
1134
priority = self.server.gnutls_priority
1135
if priority is None:
1136
priority = u"NORMAL"
1137
(gnutls.library.functions
1138
.gnutls_priority_set_direct(session._c_object,
1141
# Start communication using the Mandos protocol
1142
# Get protocol number
1143
line = self.request.makefile().readline()
1144
logger.debug(u"Protocol version: %r", line)
1146
if int(line.strip().split()[0]) > 1:
1148
except (ValueError, IndexError, RuntimeError), error:
1149
logger.error(u"Unknown protocol version: %s", error)
1152
# Start GnuTLS connection
1155
except gnutls.errors.GNUTLSError, error:
1156
logger.warning(u"Handshake failed: %s", error)
1157
# Do not run session.bye() here: the session is not
1158
# established. Just abandon the request.
1160
logger.debug(u"Handshake succeeded")
1162
approval_required = False
1165
fpr = self.fingerprint(self.peer_certificate
1167
except (TypeError, gnutls.errors.GNUTLSError), error:
1168
logger.warning(u"Bad certificate: %s", error)
1170
logger.debug(u"Fingerprint: %s", fpr)
1173
client = ProxyClient(child_pipe, fpr,
1174
self.client_address)
1178
if client.approved_delay:
1179
delay = client.approved_delay
1180
client.approvals_pending += 1
1181
approval_required = True
1184
if not client.enabled:
1185
logger.warning(u"Client %s is disabled",
1187
if self.server.use_dbus:
1189
client.Rejected("Disabled")
1192
if client._approved or not client.approved_delay:
1193
#We are approved or approval is disabled
1195
elif client._approved is None:
1196
logger.info(u"Client %s need approval",
1198
if self.server.use_dbus:
1200
client.NeedApproval(
1201
client.approved_delay_milliseconds(),
1202
client.approved_by_default)
1204
logger.warning(u"Client %s was not approved",
1206
if self.server.use_dbus:
1208
client.Rejected("Disapproved")
1211
#wait until timeout or approved
1212
#x = float(client._timedelta_to_milliseconds(delay))
1213
time = datetime.datetime.now()
1214
client.changedstate.acquire()
1215
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1216
client.changedstate.release()
1217
time2 = datetime.datetime.now()
1218
if (time2 - time) >= delay:
1219
if not client.approved_by_default:
1220
logger.warning("Client %s timed out while"
1221
" waiting for approval",
1223
if self.server.use_dbus:
1225
client.Rejected("Time out")
1230
delay -= time2 - time
1233
while sent_size < len(client.secret):
1234
# XXX handle session exception
1235
sent = session.send(client.secret[sent_size:])
1236
logger.debug(u"Sent: %d, remaining: %d",
1237
sent, len(client.secret)
1238
- (sent_size + sent))
1241
logger.info(u"Sending secret to %s", client.name)
1242
# bump the timeout as if seen
1244
if self.server.use_dbus:
1249
if approval_required:
1250
client.approvals_pending -= 1
1254
def peer_certificate(session):
1255
"Return the peer's OpenPGP certificate as a bytestring"
1256
# If not an OpenPGP certificate...
1257
if (gnutls.library.functions
1258
.gnutls_certificate_type_get(session._c_object)
1259
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1260
# ...do the normal thing
1261
return session.peer_certificate
1262
list_size = ctypes.c_uint(1)
1263
cert_list = (gnutls.library.functions
1264
.gnutls_certificate_get_peers
1265
(session._c_object, ctypes.byref(list_size)))
1266
if not bool(cert_list) and list_size.value != 0:
1267
raise gnutls.errors.GNUTLSError(u"error getting peer"
1269
if list_size.value == 0:
1272
return ctypes.string_at(cert.data, cert.size)
1275
def fingerprint(openpgp):
1276
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1277
# New GnuTLS "datum" with the OpenPGP public key
1278
datum = (gnutls.library.types
1279
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1282
ctypes.c_uint(len(openpgp))))
1283
# New empty GnuTLS certificate
1284
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1285
(gnutls.library.functions
1286
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1287
# Import the OpenPGP public key into the certificate
1288
(gnutls.library.functions
1289
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1290
gnutls.library.constants
1291
.GNUTLS_OPENPGP_FMT_RAW))
1292
# Verify the self signature in the key
1293
crtverify = ctypes.c_uint()
1294
(gnutls.library.functions
1295
.gnutls_openpgp_crt_verify_self(crt, 0,
1296
ctypes.byref(crtverify)))
1297
if crtverify.value != 0:
1298
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1299
raise (gnutls.errors.CertificateSecurityError
1301
# New buffer for the fingerprint
1302
buf = ctypes.create_string_buffer(20)
1303
buf_len = ctypes.c_size_t()
1304
# Get the fingerprint from the certificate into the buffer
1305
(gnutls.library.functions
1306
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1307
ctypes.byref(buf_len)))
1308
# Deinit the certificate
1309
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1310
# Convert the buffer to a Python bytestring
1311
fpr = ctypes.string_at(buf, buf_len.value)
1312
# Convert the bytestring to hexadecimal notation
1313
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1317
class MultiprocessingMixIn(object):
1318
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1319
def sub_process_main(self, request, address):
1321
self.finish_request(request, address)
1323
self.handle_error(request, address)
1324
self.close_request(request)
1326
def process_request(self, request, address):
1327
"""Start a new process to process the request."""
1328
multiprocessing.Process(target = self.sub_process_main,
1329
args = (request, address)).start()
1331
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1332
""" adds a pipe to the MixIn """
1333
def process_request(self, request, client_address):
1334
"""Overrides and wraps the original process_request().
1336
This function creates a new pipe in self.pipe
1338
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1340
super(MultiprocessingMixInWithPipe,
1341
self).process_request(request, client_address)
1342
self.child_pipe.close()
1343
self.add_pipe(parent_pipe)
1345
def add_pipe(self, parent_pipe):
1346
"""Dummy function; override as necessary"""
1349
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1350
socketserver.TCPServer, object):
1351
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
666
logger.info(u"TCP connection from: %s",
667
unicode(self.client_address))
668
session = (gnutls.connection
669
.ClientSession(self.request,
673
line = self.request.makefile().readline()
674
logger.debug(u"Protocol version: %r", line)
676
if int(line.strip().split()[0]) > 1:
678
except (ValueError, IndexError, RuntimeError), error:
679
logger.error(u"Unknown protocol version: %s", error)
682
# Note: gnutls.connection.X509Credentials is really a generic
683
# GnuTLS certificate credentials object so long as no X.509
684
# keys are added to it. Therefore, we can use it here despite
685
# using OpenPGP certificates.
687
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
688
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
690
# Use a fallback default, since this MUST be set.
691
priority = self.server.settings.get("priority", "NORMAL")
692
(gnutls.library.functions
693
.gnutls_priority_set_direct(session._c_object,
698
except gnutls.errors.GNUTLSError, error:
699
logger.warning(u"Handshake failed: %s", error)
700
# Do not run session.bye() here: the session is not
701
# established. Just abandon the request.
703
logger.debug(u"Handshake succeeded")
705
fpr = fingerprint(peer_certificate(session))
706
except (TypeError, gnutls.errors.GNUTLSError), error:
707
logger.warning(u"Bad certificate: %s", error)
710
logger.debug(u"Fingerprint: %s", fpr)
712
for c in self.server.clients:
713
if c.fingerprint == fpr:
717
logger.warning(u"Client not found for fingerprint: %s",
721
# Have to check if client.still_valid(), since it is possible
722
# that the client timed out while establishing the GnuTLS
724
if not client.still_valid():
725
logger.warning(u"Client %(name)s is invalid",
729
## This won't work here, since we're in a fork.
730
# client.checked_ok()
732
while sent_size < len(client.secret):
733
sent = session.send(client.secret[sent_size:])
734
logger.debug(u"Sent: %d, remaining: %d",
735
sent, len(client.secret)
736
- (sent_size + sent))
741
class IPv6_TCPServer(SocketServer.ForkingMixIn,
742
SocketServer.TCPServer, object):
743
"""IPv6-capable TCP server. Accepts 'None' as address and/or port.
745
settings: Server settings
746
clients: Set() of Client objects
1354
747
enabled: Boolean; whether this server is activated yet
1355
interface: None or a network interface name (string)
1356
use_ipv6: Boolean; to use IPv6 or not
1358
def __init__(self, server_address, RequestHandlerClass,
1359
interface=None, use_ipv6=True):
1360
self.interface = interface
1362
self.address_family = socket.AF_INET6
1363
socketserver.TCPServer.__init__(self, server_address,
1364
RequestHandlerClass)
749
address_family = socket.AF_INET6
750
def __init__(self, *args, **kwargs):
751
if "settings" in kwargs:
752
self.settings = kwargs["settings"]
753
del kwargs["settings"]
754
if "clients" in kwargs:
755
self.clients = kwargs["clients"]
756
del kwargs["clients"]
757
if "use_ipv6" in kwargs:
758
if not kwargs["use_ipv6"]:
759
self.address_family = socket.AF_INET
760
del kwargs["use_ipv6"]
762
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1365
763
def server_bind(self):
1366
764
"""This overrides the normal server_bind() function
1367
765
to bind to an interface if one was specified, and also NOT to
1368
766
bind to an address or port if they were not specified."""
1369
if self.interface is not None:
1370
if SO_BINDTODEVICE is None:
1371
logger.error(u"SO_BINDTODEVICE does not exist;"
1372
u" cannot bind to interface %s",
1376
self.socket.setsockopt(socket.SOL_SOCKET,
1380
except socket.error, error:
1381
if error[0] == errno.EPERM:
1382
logger.error(u"No permission to"
1383
u" bind to interface %s",
1385
elif error[0] == errno.ENOPROTOOPT:
1386
logger.error(u"SO_BINDTODEVICE not available;"
1387
u" cannot bind to interface %s",
767
if self.settings["interface"]:
768
# 25 is from /usr/include/asm-i486/socket.h
769
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
771
self.socket.setsockopt(socket.SOL_SOCKET,
773
self.settings["interface"])
774
except socket.error, error:
775
if error[0] == errno.EPERM:
776
logger.error(u"No permission to"
777
u" bind to interface %s",
778
self.settings["interface"])
1391
781
# Only bind(2) the socket if we really need to.
1392
782
if self.server_address[0] or self.server_address[1]:
1393
783
if not self.server_address[0]:
1394
784
if self.address_family == socket.AF_INET6:
1395
any_address = u"::" # in6addr_any
785
any_address = "::" # in6addr_any
1397
787
any_address = socket.INADDR_ANY
1398
788
self.server_address = (any_address,
1647
950
# Default values for config file for server-global settings
1648
server_defaults = { u"interface": u"",
1653
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1654
u"servicename": u"Mandos",
1655
u"use_dbus": u"True",
1656
u"use_ipv6": u"True",
951
server_defaults = { "interface": "",
956
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
957
"servicename": "Mandos",
1659
962
# Parse config file for server-global settings
1660
server_config = configparser.SafeConfigParser(server_defaults)
963
server_config = ConfigParser.SafeConfigParser(server_defaults)
1661
964
del server_defaults
1662
server_config.read(os.path.join(options.configdir,
965
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1664
966
# Convert the SafeConfigParser object to a dict
1665
967
server_settings = server_config.defaults()
1666
968
# Use the appropriate methods on the non-string config options
1667
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1668
server_settings[option] = server_config.getboolean(u"DEFAULT",
969
server_settings["debug"] = server_config.getboolean("DEFAULT",
971
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
973
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1670
975
if server_settings["port"]:
1671
server_settings["port"] = server_config.getint(u"DEFAULT",
976
server_settings["port"] = server_config.getint("DEFAULT",
1673
978
del server_config
1675
980
# Override the settings from the config file with command line
1676
981
# options, if set.
1677
for option in (u"interface", u"address", u"port", u"debug",
1678
u"priority", u"servicename", u"configdir",
1679
u"use_dbus", u"use_ipv6"):
982
for option in ("interface", "address", "port", "debug",
983
"priority", "servicename", "configdir",
984
"use_dbus", "use_ipv6"):
1680
985
value = getattr(options, option)
1681
986
if value is not None:
1682
987
server_settings[option] = value
1684
# Force all strings to be unicode
1685
for option in server_settings.keys():
1686
if type(server_settings[option]) is str:
1687
server_settings[option] = unicode(server_settings[option])
1688
989
# Now we have our good server settings in "server_settings"
1690
##################################################################
1692
991
# For convenience
1693
debug = server_settings[u"debug"]
1694
use_dbus = server_settings[u"use_dbus"]
1695
use_ipv6 = server_settings[u"use_ipv6"]
992
debug = server_settings["debug"]
993
use_dbus = server_settings["use_dbus"]
994
use_ipv6 = server_settings["use_ipv6"]
1698
997
syslogger.setLevel(logging.WARNING)
1699
998
console.setLevel(logging.WARNING)
1701
if server_settings[u"servicename"] != u"Mandos":
1000
if server_settings["servicename"] != "Mandos":
1702
1001
syslogger.setFormatter(logging.Formatter
1703
(u'Mandos (%s) [%%(process)d]:'
1704
u' %%(levelname)s: %%(message)s'
1705
% server_settings[u"servicename"]))
1002
('Mandos (%s): %%(levelname)s:'
1004
% server_settings["servicename"]))
1707
1006
# Parse config file with clients
1708
client_defaults = { u"timeout": u"1h",
1710
u"checker": u"fping -q -- %%(host)s",
1712
u"approved_delay": u"0s",
1713
u"approved_duration": u"1s",
1007
client_defaults = { "timeout": "1h",
1009
"checker": "fping -q -- %%(host)s",
1715
client_config = configparser.SafeConfigParser(client_defaults)
1716
client_config.read(os.path.join(server_settings[u"configdir"],
1719
global mandos_dbus_service
1720
mandos_dbus_service = None
1722
tcp_server = MandosServer((server_settings[u"address"],
1723
server_settings[u"port"]),
1725
interface=server_settings[u"interface"],
1728
server_settings[u"priority"],
1730
pidfilename = u"/var/run/mandos.pid"
1012
client_config = ConfigParser.SafeConfigParser(client_defaults)
1013
client_config.read(os.path.join(server_settings["configdir"],
1017
tcp_server = IPv6_TCPServer((server_settings["address"],
1018
server_settings["port"]),
1020
settings=server_settings,
1021
clients=clients, use_ipv6=use_ipv6)
1022
pidfilename = "/var/run/mandos.pid"
1732
pidfile = open(pidfilename, u"w")
1024
pidfile = open(pidfilename, "w")
1733
1025
except IOError:
1734
logger.error(u"Could not open file %r", pidfilename)
1026
logger.error("Could not open file %r", pidfilename)
1737
uid = pwd.getpwnam(u"_mandos").pw_uid
1738
gid = pwd.getpwnam(u"_mandos").pw_gid
1029
uid = pwd.getpwnam("_mandos").pw_uid
1030
gid = pwd.getpwnam("_mandos").pw_gid
1739
1031
except KeyError:
1741
uid = pwd.getpwnam(u"mandos").pw_uid
1742
gid = pwd.getpwnam(u"mandos").pw_gid
1033
uid = pwd.getpwnam("mandos").pw_uid
1034
gid = pwd.getpwnam("mandos").pw_gid
1743
1035
except KeyError:
1745
uid = pwd.getpwnam(u"nobody").pw_uid
1746
gid = pwd.getpwnam(u"nobody").pw_gid
1037
uid = pwd.getpwnam("nobody").pw_uid
1038
gid = pwd.getpwnam("nogroup").pw_gid
1747
1039
except KeyError: