77
65
from dbus.mainloop.glib import DBusGMainLoop
80
import xml.dom.minidom
85
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
86
except AttributeError:
88
from IN import SO_BINDTODEVICE
90
SO_BINDTODEVICE = None
93
stored_state_file = "clients.pickle"
95
logger = logging.getLogger()
71
logger = logging.Logger('mandos')
96
72
syslogger = (logging.handlers.SysLogHandler
97
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
98
address = str("/dev/log")))
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
104
except (OSError, AttributeError):
105
def if_nametoindex(interface):
106
"Get an interface index the hard way, i.e. using fcntl()"
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
108
with contextlib.closing(socket.socket()) as s:
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
110
struct.pack(str("16s16x"),
112
interface_index = struct.unpack(str("I"),
114
return interface_index
117
def initlogger(debug, level=logging.WARNING):
118
"""init logger and add loglevel"""
120
syslogger.setFormatter(logging.Formatter
121
('Mandos [%(process)d]: %(levelname)s:'
123
logger.addHandler(syslogger)
126
console = logging.StreamHandler()
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
131
logger.addHandler(console)
132
logger.setLevel(level)
135
class PGPError(Exception):
136
"""Exception if encryption/decryption fails"""
140
class PGPEngine(object):
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
143
self.gnupg = GnuPGInterface.GnuPG()
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
self.gnupg = GnuPGInterface.GnuPG()
146
self.gnupg.options.meta_interactive = False
147
self.gnupg.options.homedir = self.tempdir
148
self.gnupg.options.extra_args.extend(['--force-mdc',
155
def __exit__(self, exc_type, exc_value, traceback):
163
if self.tempdir is not None:
164
# Delete contents of tempdir
165
for root, dirs, files in os.walk(self.tempdir,
167
for filename in files:
168
os.remove(os.path.join(root, filename))
170
os.rmdir(os.path.join(root, dirname))
172
os.rmdir(self.tempdir)
175
def password_encode(self, password):
176
# Passphrase can not be empty and can not contain newlines or
177
# NUL bytes. So we prefix it and hex encode it.
178
return b"mandos" + binascii.hexlify(password)
180
def encrypt(self, data, password):
181
self.gnupg.passphrase = self.password_encode(password)
182
with open(os.devnull, "w") as devnull:
184
proc = self.gnupg.run(['--symmetric'],
185
create_fhs=['stdin', 'stdout'],
186
attach_fhs={'stderr': devnull})
187
with contextlib.closing(proc.handles['stdin']) as f:
189
with contextlib.closing(proc.handles['stdout']) as f:
190
ciphertext = f.read()
194
self.gnupg.passphrase = None
197
def decrypt(self, data, password):
198
self.gnupg.passphrase = self.password_encode(password)
199
with open(os.devnull, "w") as devnull:
201
proc = self.gnupg.run(['--decrypt'],
202
create_fhs=['stdin', 'stdout'],
203
attach_fhs={'stderr': devnull})
204
with contextlib.closing(proc.handles['stdin']) as f:
206
with contextlib.closing(proc.handles['stdout']) as f:
207
decrypted_plaintext = f.read()
211
self.gnupg.passphrase = None
212
return decrypted_plaintext
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
78
logger.addHandler(syslogger)
80
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
83
logger.addHandler(console)
215
85
class AvahiError(Exception):
216
86
def __init__(self, value, *args, **kwargs):
261
126
self.rename_count = 0
262
127
self.max_renames = max_renames
263
128
self.protocol = protocol
264
self.group = None # our entry group
267
self.entry_group_state_changed_match = None
269
129
def rename(self):
270
130
"""Derived from the Avahi example code"""
271
131
if self.rename_count >= self.max_renames:
272
logger.critical("No suitable Zeroconf service name found"
273
" after %i retries, exiting.",
132
logger.critical(u"No suitable Zeroconf service name found"
133
u" after %i retries, exiting.",
274
134
self.rename_count)
275
raise AvahiServiceError("Too many renames")
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
278
logger.info("Changing Zeroconf service name to %r ...",
135
raise AvahiServiceError(u"Too many renames")
136
self.name = server.GetAlternativeServiceName(self.name)
137
logger.info(u"Changing Zeroconf service name to %r ...",
139
syslogger.setFormatter(logging.Formatter
140
('Mandos (%s) [%%(process)d]:'
141
' %%(levelname)s: %%(message)s'
283
except dbus.exceptions.DBusException as error:
284
logger.critical("D-Bus Exception", exc_info=error)
287
145
self.rename_count += 1
289
146
def remove(self):
290
147
"""Derived from the Avahi example code"""
291
if self.entry_group_state_changed_match is not None:
292
self.entry_group_state_changed_match.remove()
293
self.entry_group_state_changed_match = None
294
if self.group is not None:
148
if group is not None:
298
151
"""Derived from the Avahi example code"""
300
if self.group is None:
301
self.group = dbus.Interface(
302
self.bus.get_object(avahi.DBUS_NAME,
303
self.server.EntryGroupNew()),
304
avahi.DBUS_INTERFACE_ENTRY_GROUP)
305
self.entry_group_state_changed_match = (
306
self.group.connect_to_signal(
307
'StateChanged', self.entry_group_state_changed))
308
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
309
self.name, self.type)
310
self.group.AddService(
313
dbus.UInt32(0), # flags
314
self.name, self.type,
315
self.domain, self.host,
316
dbus.UInt16(self.port),
317
avahi.string_array_to_txt_array(self.TXT))
320
def entry_group_state_changed(self, state, error):
321
"""Derived from the Avahi example code"""
322
logger.debug("Avahi entry group state change: %i", state)
324
if state == avahi.ENTRY_GROUP_ESTABLISHED:
325
logger.debug("Zeroconf service established.")
326
elif state == avahi.ENTRY_GROUP_COLLISION:
327
logger.info("Zeroconf service name collision.")
329
elif state == avahi.ENTRY_GROUP_FAILURE:
330
logger.critical("Avahi: Error in group state changed %s",
332
raise AvahiGroupError("State changed: {0!s}"
336
"""Derived from the Avahi example code"""
337
if self.group is not None:
340
except (dbus.exceptions.UnknownMethodException,
341
dbus.exceptions.DBusException):
346
def server_state_changed(self, state, error=None):
347
"""Derived from the Avahi example code"""
348
logger.debug("Avahi server state change: %i", state)
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
356
if state in bad_states:
357
if bad_states[state] is not None:
359
logger.error(bad_states[state])
361
logger.error(bad_states[state] + ": %r", error)
363
elif state == avahi.SERVER_RUNNING:
367
logger.debug("Unknown state: %r", state)
369
logger.debug("Unknown state: %r: %r", state, error)
372
"""Derived from the Avahi example code"""
373
if self.server is None:
374
self.server = dbus.Interface(
375
self.bus.get_object(avahi.DBUS_NAME,
376
avahi.DBUS_PATH_SERVER,
377
follow_name_owner_changes=True),
378
avahi.DBUS_INTERFACE_SERVER)
379
self.server.connect_to_signal("StateChanged",
380
self.server_state_changed)
381
self.server_state_changed(self.server.GetState())
384
class AvahiServiceToSyslog(AvahiService):
386
"""Add the new name to the syslog messages"""
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
154
group = dbus.Interface(bus.get_object
156
server.EntryGroupNew()),
157
avahi.DBUS_INTERFACE_ENTRY_GROUP)
158
group.connect_to_signal('StateChanged',
159
entry_group_state_changed)
160
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
161
service.name, service.type)
163
self.interface, # interface
164
self.protocol, # protocol
165
dbus.UInt32(0), # flags
166
self.name, self.type,
167
self.domain, self.host,
168
dbus.UInt16(self.port),
169
avahi.string_array_to_txt_array(self.TXT))
172
# From the Avahi example code:
173
group = None # our entry group
174
# End of Avahi example code
177
def _datetime_to_dbus(dt, variant_level=0):
178
"""Convert a UTC datetime.datetime() to a D-Bus type."""
179
return dbus.String(dt.isoformat(), variant_level=variant_level)
402
182
class Client(object):
403
183
"""A representation of a client host served by this server.
406
approved: bool(); 'None' if not yet approved/disapproved
407
approval_delay: datetime.timedelta(); Time to wait for approval
408
approval_duration: datetime.timedelta(); Duration of one approval
185
name: string; from the config file, used in log messages and
187
fingerprint: string (40 or 32 hexadecimal digits); used to
188
uniquely identify the client
189
secret: bytestring; sent verbatim (over TLS) to client
190
host: string; available for use by the checker command
191
created: datetime.datetime(); (UTC) object creation
192
last_enabled: datetime.datetime(); (UTC)
194
last_checked_ok: datetime.datetime(); (UTC) or None
195
timeout: datetime.timedelta(); How long from last_checked_ok
196
until this client is invalid
197
interval: datetime.timedelta(); How often to start a new checker
198
disable_hook: If set, called by disable() as disable_hook(self)
409
199
checker: subprocess.Popen(); a running checker process used
410
200
to see if the client lives.
411
201
'None' if no process is running.
412
checker_callback_tag: a gobject event source tag, or None
413
checker_command: string; External command which is run to check
414
if client lives. %() expansions are done at
202
checker_initiator_tag: a gobject event source tag, or None
203
disable_initiator_tag: - '' -
204
checker_callback_tag: - '' -
205
checker_command: string; External command which is run to check if
206
client lives. %() expansions are done at
415
207
runtime with vars(self) as dict, so that for
416
208
instance %(name)s can be used in the command.
417
checker_initiator_tag: a gobject event source tag, or None
418
created: datetime.datetime(); (UTC) object creation
419
client_structure: Object describing what attributes a client has
420
and is used for storing the client at exit
421
209
current_checker_command: string; current running checker_command
422
disable_initiator_tag: a gobject event source tag, or None
424
fingerprint: string (40 or 32 hexadecimal digits); used to
425
uniquely identify the client
426
host: string; available for use by the checker command
427
interval: datetime.timedelta(); How often to start a new checker
428
last_approval_request: datetime.datetime(); (UTC) or None
429
last_checked_ok: datetime.datetime(); (UTC) or None
430
last_checker_status: integer between 0 and 255 reflecting exit
431
status of last checker. -1 reflects crashed
432
checker, -2 means no checker completed yet.
433
last_enabled: datetime.datetime(); (UTC) or None
434
name: string; from the config file, used in log messages and
436
secret: bytestring; sent verbatim (over TLS) to client
437
timeout: datetime.timedelta(); How long from last_checked_ok
438
until this client is disabled
439
extended_timeout: extra long timeout when secret has been sent
440
runtime_expansions: Allowed attributes for runtime expansion.
441
expires: datetime.datetime(); time (UTC) when a client will be
445
runtime_expansions = ("approval_delay", "approval_duration",
446
"created", "enabled", "expires",
447
"fingerprint", "host", "interval",
448
"last_approval_request", "last_checked_ok",
449
"last_enabled", "name", "timeout")
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
453
"checker": "fping -q -- %%(host)s",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
461
211
def timeout_milliseconds(self):
462
212
"Return the 'timeout' attribute in milliseconds"
463
return timedelta_to_milliseconds(self.timeout)
465
def extended_timeout_milliseconds(self):
466
"Return the 'extended_timeout' attribute in milliseconds"
467
return timedelta_to_milliseconds(self.extended_timeout)
213
return ((self.timeout.days * 24 * 60 * 60 * 1000)
214
+ (self.timeout.seconds * 1000)
215
+ (self.timeout.microseconds // 1000))
469
217
def interval_milliseconds(self):
470
218
"Return the 'interval' attribute in milliseconds"
471
return timedelta_to_milliseconds(self.interval)
473
def approval_delay_milliseconds(self):
474
return timedelta_to_milliseconds(self.approval_delay)
477
def config_parser(config):
478
"""Construct a new dict of client settings of this form:
479
{ client_name: {setting_name: value, ...}, ...}
480
with exceptions for any special settings as defined above.
481
NOTE: Must be a pure function. Must return the same result
482
value given the same arguments.
485
for client_name in config.sections():
486
section = dict(config.items(client_name))
487
client = settings[client_name] = {}
489
client["host"] = section["host"]
490
# Reformat values from string types to Python types
491
client["approved_by_default"] = config.getboolean(
492
client_name, "approved_by_default")
493
client["enabled"] = config.getboolean(client_name,
496
client["fingerprint"] = (section["fingerprint"].upper()
498
if "secret" in section:
499
client["secret"] = section["secret"].decode("base64")
500
elif "secfile" in section:
501
with open(os.path.expanduser(os.path.expandvars
502
(section["secfile"])),
504
client["secret"] = secfile.read()
506
raise TypeError("No secret or secfile for section {0}"
508
client["timeout"] = string_to_delta(section["timeout"])
509
client["extended_timeout"] = string_to_delta(
510
section["extended_timeout"])
511
client["interval"] = string_to_delta(section["interval"])
512
client["approval_delay"] = string_to_delta(
513
section["approval_delay"])
514
client["approval_duration"] = string_to_delta(
515
section["approval_duration"])
516
client["checker_command"] = section["checker"]
517
client["last_approval_request"] = None
518
client["last_checked_ok"] = None
519
client["last_checker_status"] = -2
523
def __init__(self, settings, name = None):
219
return ((self.interval.days * 24 * 60 * 60 * 1000)
220
+ (self.interval.seconds * 1000)
221
+ (self.interval.microseconds // 1000))
223
def __init__(self, name = None, disable_hook=None, config=None):
224
"""Note: the 'checker' key in 'config' sets the
225
'checker_command' attribute and *not* the 'checker'
525
# adding all client settings
526
for setting, value in settings.iteritems():
527
setattr(self, setting, value)
530
if not hasattr(self, "last_enabled"):
531
self.last_enabled = datetime.datetime.utcnow()
532
if not hasattr(self, "expires"):
533
self.expires = (datetime.datetime.utcnow()
536
self.last_enabled = None
539
logger.debug("Creating client %r", self.name)
230
logger.debug(u"Creating client %r", self.name)
540
231
# Uppercase and remove spaces from fingerprint for later
541
232
# comparison purposes with return value from the fingerprint()
543
logger.debug(" Fingerprint: %s", self.fingerprint)
544
self.created = settings.get("created",
545
datetime.datetime.utcnow())
547
# attributes specific for this server instance
234
self.fingerprint = (config["fingerprint"].upper()
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
if "secret" in config:
238
self.secret = config["secret"].decode(u"base64")
239
elif "secfile" in config:
240
with closing(open(os.path.expanduser
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
245
raise TypeError(u"No secret or secfile for client %s"
247
self.host = config.get("host", "")
248
self.created = datetime.datetime.utcnow()
250
self.last_enabled = None
251
self.last_checked_ok = None
252
self.timeout = string_to_delta(config["timeout"])
253
self.interval = string_to_delta(config["interval"])
254
self.disable_hook = disable_hook
548
255
self.checker = None
549
256
self.checker_initiator_tag = None
550
257
self.disable_initiator_tag = None
551
258
self.checker_callback_tag = None
259
self.checker_command = config["checker"]
552
260
self.current_checker_command = None
554
self.approvals_pending = 0
555
self.changedstate = (multiprocessing_manager
556
.Condition(multiprocessing_manager
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
560
if not attr.startswith("_")]
561
self.client_structure.append("client_structure")
563
for name, t in inspect.getmembers(type(self),
567
if not name.startswith("_"):
568
self.client_structure.append(name)
570
# Send notice to process children that client state has changed
571
def send_changedstate(self):
572
with self.changedstate:
573
self.changedstate.notify_all()
261
self.last_connect = None
575
263
def enable(self):
576
264
"""Start this client's checker and timeout hooks"""
577
if getattr(self, "enabled", False):
580
self.expires = datetime.datetime.utcnow() + self.timeout
582
265
self.last_enabled = datetime.datetime.utcnow()
584
self.send_changedstate()
586
def disable(self, quiet=True):
587
"""Disable this client."""
588
if not getattr(self, "enabled", False):
591
logger.info("Disabling client %s", self.name)
592
if getattr(self, "disable_initiator_tag", None) is not None:
593
gobject.source_remove(self.disable_initiator_tag)
594
self.disable_initiator_tag = None
596
if getattr(self, "checker_initiator_tag", None) is not None:
597
gobject.source_remove(self.checker_initiator_tag)
598
self.checker_initiator_tag = None
602
self.send_changedstate()
603
# Do not run this again if called by a gobject.timeout_add
609
def init_checker(self):
610
266
# Schedule a new checker to be started an 'interval' from now,
611
267
# and every interval from then on.
612
if self.checker_initiator_tag is not None:
613
gobject.source_remove(self.checker_initiator_tag)
614
268
self.checker_initiator_tag = (gobject.timeout_add
615
269
(self.interval_milliseconds(),
616
270
self.start_checker))
271
# Also start a new checker *right now*.
617
273
# Schedule a disable() when 'timeout' has passed
618
if self.disable_initiator_tag is not None:
619
gobject.source_remove(self.disable_initiator_tag)
620
274
self.disable_initiator_tag = (gobject.timeout_add
621
275
(self.timeout_milliseconds(),
623
# Also start a new checker *right now*.
280
"""Disable this client."""
281
if not getattr(self, "enabled", False):
283
logger.info(u"Disabling client %s", self.name)
284
if getattr(self, "disable_initiator_tag", False):
285
gobject.source_remove(self.disable_initiator_tag)
286
self.disable_initiator_tag = None
287
if getattr(self, "checker_initiator_tag", False):
288
gobject.source_remove(self.checker_initiator_tag)
289
self.checker_initiator_tag = None
291
if self.disable_hook:
292
self.disable_hook(self)
294
# Do not run this again if called by a gobject.timeout_add
298
self.disable_hook = None
626
301
def checker_callback(self, pid, condition, command):
627
302
"""The checker has completed, so take appropriate actions."""
628
303
self.checker_callback_tag = None
629
304
self.checker = None
630
305
if os.WIFEXITED(condition):
631
self.last_checker_status = os.WEXITSTATUS(condition)
632
if self.last_checker_status == 0:
633
logger.info("Checker for %(name)s succeeded",
306
exitstatus = os.WEXITSTATUS(condition)
308
logger.info(u"Checker for %(name)s succeeded",
635
310
self.checked_ok()
637
logger.info("Checker for %(name)s failed",
312
logger.info(u"Checker for %(name)s failed",
640
self.last_checker_status = -1
641
logger.warning("Checker for %(name)s crashed?",
315
logger.warning(u"Checker for %(name)s crashed?",
644
318
def checked_ok(self):
645
"""Assert that the client has been seen, alive and well."""
319
"""Bump up the timeout for this client.
320
This should only be called when the client has been seen,
646
323
self.last_checked_ok = datetime.datetime.utcnow()
647
self.last_checker_status = 0
650
def bump_timeout(self, timeout=None):
651
"""Bump up the timeout for this client."""
653
timeout = self.timeout
654
if self.disable_initiator_tag is not None:
655
gobject.source_remove(self.disable_initiator_tag)
656
self.disable_initiator_tag = None
657
if getattr(self, "enabled", False):
658
self.disable_initiator_tag = (gobject.timeout_add
659
(timedelta_to_milliseconds
660
(timeout), self.disable))
661
self.expires = datetime.datetime.utcnow() + timeout
663
def need_approval(self):
664
self.last_approval_request = datetime.datetime.utcnow()
324
gobject.source_remove(self.disable_initiator_tag)
325
self.disable_initiator_tag = (gobject.timeout_add
326
(self.timeout_milliseconds(),
666
329
def start_checker(self):
667
330
"""Start a new checker subprocess if one is not running.
669
331
If a checker already exists, leave it running and do
671
333
# The reason for not killing a running checker is that if we
672
# did that, and if a checker (for some reason) started running
673
# slowly and taking more than 'interval' time, then the client
674
# would inevitably timeout, since no checker would get a
675
# chance to run to completion. If we instead leave running
334
# did that, then if a checker (for some reason) started
335
# running slowly and taking more than 'interval' time, the
336
# client would inevitably timeout, since no checker would get
337
# a chance to run to completion. If we instead leave running
676
338
# checkers alone, the checker would have to take more time
677
# than 'timeout' for the client to be disabled, which is as it
339
# than 'timeout' for the client to be declared invalid, which
340
# is as it should be.
680
342
# If a checker exists, make sure it is not a zombie
343
if self.checker is not None:
682
344
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
683
except (AttributeError, OSError) as error:
684
if (isinstance(error, OSError)
685
and error.errno != errno.ECHILD):
689
346
logger.warning("Checker was a zombie")
690
347
gobject.source_remove(self.checker_callback_tag)
746
397
self.checker_callback_tag = None
747
398
if getattr(self, "checker", None) is None:
749
logger.debug("Stopping checker for %(name)s", vars(self))
400
logger.debug(u"Stopping checker for %(name)s", vars(self))
751
self.checker.terminate()
402
os.kill(self.checker.pid, signal.SIGTERM)
753
404
#if self.checker.poll() is None:
754
# self.checker.kill()
755
except OSError as error:
405
# os.kill(self.checker.pid, signal.SIGKILL)
406
except OSError, error:
756
407
if error.errno != errno.ESRCH: # No such process
758
409
self.checker = None
761
def dbus_service_property(dbus_interface, signature="v",
762
access="readwrite", byte_arrays=False):
763
"""Decorators for marking methods of a DBusObjectWithProperties to
764
become properties on the D-Bus.
766
The decorated method will be called with no arguments by "Get"
767
and with one argument by "Set".
769
The parameters, where they are supported, are the same as
770
dbus.service.method, except there is only "signature", since the
771
type from Get() and the type sent to Set() is the same.
773
# Encoding deeply encoded byte arrays is not supported yet by the
774
# "Set" method, so we fail early here:
775
if byte_arrays and signature != "ay":
776
raise ValueError("Byte arrays not supported for non-'ay'"
777
" signature {0!r}".format(signature))
779
func._dbus_is_property = True
780
func._dbus_interface = dbus_interface
781
func._dbus_signature = signature
782
func._dbus_access = access
783
func._dbus_name = func.__name__
784
if func._dbus_name.endswith("_dbus_property"):
785
func._dbus_name = func._dbus_name[:-14]
786
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
791
def dbus_interface_annotations(dbus_interface):
792
"""Decorator for marking functions returning interface annotations
796
@dbus_interface_annotations("org.example.Interface")
797
def _foo(self): # Function name does not matter
798
return {"org.freedesktop.DBus.Deprecated": "true",
799
"org.freedesktop.DBus.Property.EmitsChangedSignal":
803
func._dbus_is_interface = True
804
func._dbus_interface = dbus_interface
805
func._dbus_name = dbus_interface
810
def dbus_annotations(annotations):
811
"""Decorator to annotate D-Bus methods, signals or properties
814
@dbus_service_property("org.example.Interface", signature="b",
816
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
817
"org.freedesktop.DBus.Property."
818
"EmitsChangedSignal": "false"})
819
def Property_dbus_property(self):
820
return dbus.Boolean(False)
823
func._dbus_annotations = annotations
828
class DBusPropertyException(dbus.exceptions.DBusException):
829
"""A base class for D-Bus property-related exceptions
831
def __unicode__(self):
832
return unicode(str(self))
835
class DBusPropertyAccessException(DBusPropertyException):
836
"""A property's access permissions disallows an operation.
841
class DBusPropertyNotFound(DBusPropertyException):
842
"""An attempt was made to access a non-existing property.
847
class DBusObjectWithProperties(dbus.service.Object):
848
"""A D-Bus object with properties.
850
Classes inheriting from this can use the dbus_service_property
851
decorator to expose methods as D-Bus properties. It exposes the
852
standard Get(), Set(), and GetAll() methods on the D-Bus.
856
def _is_dbus_thing(thing):
857
"""Returns a function testing if an attribute is a D-Bus thing
859
If called like _is_dbus_thing("method") it returns a function
860
suitable for use as predicate to inspect.getmembers().
862
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
865
def _get_all_dbus_things(self, thing):
866
"""Returns a generator of (name, attribute) pairs
868
return ((getattr(athing.__get__(self), "_dbus_name",
870
athing.__get__(self))
871
for cls in self.__class__.__mro__
873
inspect.getmembers(cls,
874
self._is_dbus_thing(thing)))
876
def _get_dbus_property(self, interface_name, property_name):
877
"""Returns a bound method if one exists which is a D-Bus
878
property with the specified name and interface.
880
for cls in self.__class__.__mro__:
881
for name, value in (inspect.getmembers
883
self._is_dbus_thing("property"))):
884
if (value._dbus_name == property_name
885
and value._dbus_interface == interface_name):
886
return value.__get__(self)
889
raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
+ interface_name + "."
893
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
895
def Get(self, interface_name, property_name):
896
"""Standard D-Bus property Get() method, see D-Bus standard.
898
prop = self._get_dbus_property(interface_name, property_name)
899
if prop._dbus_access == "write":
900
raise DBusPropertyAccessException(property_name)
902
if not hasattr(value, "variant_level"):
904
return type(value)(value, variant_level=value.variant_level+1)
906
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
907
def Set(self, interface_name, property_name, value):
908
"""Standard D-Bus property Set() method, see D-Bus standard.
910
prop = self._get_dbus_property(interface_name, property_name)
911
if prop._dbus_access == "read":
912
raise DBusPropertyAccessException(property_name)
913
if prop._dbus_get_args_options["byte_arrays"]:
914
# The byte_arrays option is not supported yet on
915
# signatures other than "ay".
916
if prop._dbus_signature != "ay":
918
value = dbus.ByteArray(b''.join(chr(byte)
922
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
923
out_signature="a{sv}")
924
def GetAll(self, interface_name):
925
"""Standard D-Bus property GetAll() method, see D-Bus
928
Note: Will not include properties with access="write".
931
for name, prop in self._get_all_dbus_things("property"):
933
and interface_name != prop._dbus_interface):
934
# Interface non-empty but did not match
936
# Ignore write-only properties
937
if prop._dbus_access == "write":
940
if not hasattr(value, "variant_level"):
941
properties[name] = value
943
properties[name] = type(value)(value, variant_level=
944
value.variant_level+1)
945
return dbus.Dictionary(properties, signature="sv")
947
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
949
path_keyword='object_path',
950
connection_keyword='connection')
951
def Introspect(self, object_path, connection):
952
"""Overloading of standard D-Bus method.
954
Inserts property tags and interface annotation tags.
956
xmlstring = dbus.service.Object.Introspect(self, object_path,
959
document = xml.dom.minidom.parseString(xmlstring)
960
def make_tag(document, name, prop):
961
e = document.createElement("property")
962
e.setAttribute("name", name)
963
e.setAttribute("type", prop._dbus_signature)
964
e.setAttribute("access", prop._dbus_access)
966
for if_tag in document.getElementsByTagName("interface"):
968
for tag in (make_tag(document, name, prop)
970
in self._get_all_dbus_things("property")
971
if prop._dbus_interface
972
== if_tag.getAttribute("name")):
973
if_tag.appendChild(tag)
974
# Add annotation tags
975
for typ in ("method", "signal", "property"):
976
for tag in if_tag.getElementsByTagName(typ):
978
for name, prop in (self.
979
_get_all_dbus_things(typ)):
980
if (name == tag.getAttribute("name")
981
and prop._dbus_interface
982
== if_tag.getAttribute("name")):
983
annots.update(getattr
987
for name, value in annots.iteritems():
988
ann_tag = document.createElement(
990
ann_tag.setAttribute("name", name)
991
ann_tag.setAttribute("value", value)
992
tag.appendChild(ann_tag)
993
# Add interface annotation tags
994
for annotation, value in dict(
995
itertools.chain.from_iterable(
996
annotations().iteritems()
997
for name, annotations in
998
self._get_all_dbus_things("interface")
999
if name == if_tag.getAttribute("name")
1001
ann_tag = document.createElement("annotation")
1002
ann_tag.setAttribute("name", annotation)
1003
ann_tag.setAttribute("value", value)
1004
if_tag.appendChild(ann_tag)
1005
# Add the names to the return values for the
1006
# "org.freedesktop.DBus.Properties" methods
1007
if (if_tag.getAttribute("name")
1008
== "org.freedesktop.DBus.Properties"):
1009
for cn in if_tag.getElementsByTagName("method"):
1010
if cn.getAttribute("name") == "Get":
1011
for arg in cn.getElementsByTagName("arg"):
1012
if (arg.getAttribute("direction")
1014
arg.setAttribute("name", "value")
1015
elif cn.getAttribute("name") == "GetAll":
1016
for arg in cn.getElementsByTagName("arg"):
1017
if (arg.getAttribute("direction")
1019
arg.setAttribute("name", "props")
1020
xmlstring = document.toxml("utf-8")
1022
except (AttributeError, xml.dom.DOMException,
1023
xml.parsers.expat.ExpatError) as error:
1024
logger.error("Failed to override Introspection method",
1029
def datetime_to_dbus(dt, variant_level=0):
1030
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1032
return dbus.String("", variant_level = variant_level)
1033
return dbus.String(dt.isoformat(),
1034
variant_level=variant_level)
1037
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1038
"""A class decorator; applied to a subclass of
1039
dbus.service.Object, it will add alternate D-Bus attributes with
1040
interface names according to the "alt_interface_names" mapping.
1043
@alternate_dbus_interfaces({"org.example.Interface":
1044
"net.example.AlternateInterface"})
1045
class SampleDBusObject(dbus.service.Object):
1046
@dbus.service.method("org.example.Interface")
1047
def SampleDBusMethod():
1050
The above "SampleDBusMethod" on "SampleDBusObject" will be
1051
reachable via two interfaces: "org.example.Interface" and
1052
"net.example.AlternateInterface", the latter of which will have
1053
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1054
"true", unless "deprecate" is passed with a False value.
1056
This works for methods and signals, and also for D-Bus properties
1057
(from DBusObjectWithProperties) and interfaces (from the
1058
dbus_interface_annotations decorator).
1061
for orig_interface_name, alt_interface_name in (
1062
alt_interface_names.iteritems()):
1064
interface_names = set()
1065
# Go though all attributes of the class
1066
for attrname, attribute in inspect.getmembers(cls):
1067
# Ignore non-D-Bus attributes, and D-Bus attributes
1068
# with the wrong interface name
1069
if (not hasattr(attribute, "_dbus_interface")
1070
or not attribute._dbus_interface
1071
.startswith(orig_interface_name)):
1073
# Create an alternate D-Bus interface name based on
1075
alt_interface = (attribute._dbus_interface
1076
.replace(orig_interface_name,
1077
alt_interface_name))
1078
interface_names.add(alt_interface)
1079
# Is this a D-Bus signal?
1080
if getattr(attribute, "_dbus_is_signal", False):
1081
# Extract the original non-method function by
1083
nonmethod_func = (dict(
1084
zip(attribute.func_code.co_freevars,
1085
attribute.__closure__))["func"]
1087
# Create a new, but exactly alike, function
1088
# object, and decorate it to be a new D-Bus signal
1089
# with the alternate D-Bus interface name
1090
new_function = (dbus.service.signal
1092
attribute._dbus_signature)
1093
(types.FunctionType(
1094
nonmethod_func.func_code,
1095
nonmethod_func.func_globals,
1096
nonmethod_func.func_name,
1097
nonmethod_func.func_defaults,
1098
nonmethod_func.func_closure)))
1099
# Copy annotations, if any
1101
new_function._dbus_annotations = (
1102
dict(attribute._dbus_annotations))
1103
except AttributeError:
1105
# Define a creator of a function to call both the
1106
# original and alternate functions, so both the
1107
# original and alternate signals gets sent when
1108
# the function is called
1109
def fixscope(func1, func2):
1110
"""This function is a scope container to pass
1111
func1 and func2 to the "call_both" function
1112
outside of its arguments"""
1113
def call_both(*args, **kwargs):
1114
"""This function will emit two D-Bus
1115
signals by calling func1 and func2"""
1116
func1(*args, **kwargs)
1117
func2(*args, **kwargs)
1119
# Create the "call_both" function and add it to
1121
attr[attrname] = fixscope(attribute, new_function)
1122
# Is this a D-Bus method?
1123
elif getattr(attribute, "_dbus_is_method", False):
1124
# Create a new, but exactly alike, function
1125
# object. Decorate it to be a new D-Bus method
1126
# with the alternate D-Bus interface name. Add it
1128
attr[attrname] = (dbus.service.method
1130
attribute._dbus_in_signature,
1131
attribute._dbus_out_signature)
1133
(attribute.func_code,
1134
attribute.func_globals,
1135
attribute.func_name,
1136
attribute.func_defaults,
1137
attribute.func_closure)))
1138
# Copy annotations, if any
1140
attr[attrname]._dbus_annotations = (
1141
dict(attribute._dbus_annotations))
1142
except AttributeError:
1144
# Is this a D-Bus property?
1145
elif getattr(attribute, "_dbus_is_property", False):
1146
# Create a new, but exactly alike, function
1147
# object, and decorate it to be a new D-Bus
1148
# property with the alternate D-Bus interface
1149
# name. Add it to the class.
1150
attr[attrname] = (dbus_service_property
1152
attribute._dbus_signature,
1153
attribute._dbus_access,
1155
._dbus_get_args_options
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1163
# Copy annotations, if any
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1167
except AttributeError:
1169
# Is this a D-Bus interface?
1170
elif getattr(attribute, "_dbus_is_interface", False):
1171
# Create a new, but exactly alike, function
1172
# object. Decorate it to be a new D-Bus interface
1173
# with the alternate D-Bus interface name. Add it
1175
attr[attrname] = (dbus_interface_annotations
1178
(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1184
# Deprecate all alternate interfaces
1185
iname="_AlternateDBusNames_interface_annotation{0}"
1186
for interface_name in interface_names:
1187
@dbus_interface_annotations(interface_name)
1189
return { "org.freedesktop.DBus.Deprecated":
1191
# Find an unused name
1192
for aname in (iname.format(i)
1193
for i in itertools.count()):
1194
if aname not in attr:
1198
# Replace the class with a new subclass of it with
1199
# methods, signals, etc. as created above.
1200
cls = type(b"{0}Alternate".format(cls.__name__),
1206
@alternate_dbus_interfaces({"se.recompile.Mandos":
1207
"se.bsnet.fukt.Mandos"})
1208
class ClientDBus(Client, DBusObjectWithProperties):
411
def still_valid(self):
412
"""Has the timeout not yet passed for this client?"""
413
if not getattr(self, "enabled", False):
415
now = datetime.datetime.utcnow()
416
if self.last_checked_ok is None:
417
return now < (self.created + self.timeout)
419
return now < (self.last_checked_ok + self.timeout)
422
class ClientDBus(Client, dbus.service.Object):
1209
423
"""A Client class using D-Bus
1212
dbus_object_path: dbus.ObjectPath
1213
bus: dbus.SystemBus()
425
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
1216
runtime_expansions = (Client.runtime_expansions
1217
+ ("dbus_object_path",))
1219
427
# dbus.service.Object doesn't use super(), so we can't either.
1221
def __init__(self, bus = None, *args, **kwargs):
429
def __init__(self, *args, **kwargs):
1223
430
Client.__init__(self, *args, **kwargs)
1224
431
# Only now, when this client is initialized, can it show up on
1226
client_object_name = unicode(self.name).translate(
1227
{ord("."): ord("_"),
1228
ord("-"): ord("_")})
1229
433
self.dbus_object_path = (dbus.ObjectPath
1230
("/clients/" + client_object_name))
1231
DBusObjectWithProperties.__init__(self, self.bus,
1232
self.dbus_object_path)
1234
def notifychangeproperty(transform_func,
1235
dbus_name, type_func=lambda x: x,
1237
""" Modify a variable so that it's a property which announces
1238
its changes to DBus.
1240
transform_fun: Function that takes a value and a variant_level
1241
and transforms it to a D-Bus type.
1242
dbus_name: D-Bus name of the variable
1243
type_func: Function that transform the value before sending it
1244
to the D-Bus. Default: no transform
1245
variant_level: D-Bus variant level. Default: 1
1247
attrname = "_{0}".format(dbus_name)
1248
def setter(self, value):
1249
if hasattr(self, "dbus_object_path"):
1250
if (not hasattr(self, attrname) or
1251
type_func(getattr(self, attrname, None))
1252
!= type_func(value)):
1253
dbus_value = transform_func(type_func(value),
1256
self.PropertyChanged(dbus.String(dbus_name),
1258
setattr(self, attrname, value)
1260
return property(lambda self: getattr(self, attrname), setter)
1262
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1263
approvals_pending = notifychangeproperty(dbus.Boolean,
1266
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1267
last_enabled = notifychangeproperty(datetime_to_dbus,
1269
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1270
type_func = lambda checker:
1271
checker is not None)
1272
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1274
last_checker_status = notifychangeproperty(dbus.Int16,
1275
"LastCheckerStatus")
1276
last_approval_request = notifychangeproperty(
1277
datetime_to_dbus, "LastApprovalRequest")
1278
approved_by_default = notifychangeproperty(dbus.Boolean,
1279
"ApprovedByDefault")
1280
approval_delay = notifychangeproperty(dbus.UInt64,
1283
timedelta_to_milliseconds)
1284
approval_duration = notifychangeproperty(
1285
dbus.UInt64, "ApprovalDuration",
1286
type_func = timedelta_to_milliseconds)
1287
host = notifychangeproperty(dbus.String, "Host")
1288
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1290
timedelta_to_milliseconds)
1291
extended_timeout = notifychangeproperty(
1292
dbus.UInt64, "ExtendedTimeout",
1293
type_func = timedelta_to_milliseconds)
1294
interval = notifychangeproperty(dbus.UInt64,
1297
timedelta_to_milliseconds)
1298
checker_command = notifychangeproperty(dbus.String, "Checker")
1300
del notifychangeproperty
435
+ self.name.replace(".", "_")))
436
dbus.service.Object.__init__(self, bus,
437
self.dbus_object_path)
439
oldstate = getattr(self, "enabled", False)
440
r = Client.enable(self)
441
if oldstate != self.enabled:
443
self.PropertyChanged(dbus.String(u"enabled"),
444
dbus.Boolean(True, variant_level=1))
445
self.PropertyChanged(dbus.String(u"last_enabled"),
446
(_datetime_to_dbus(self.last_enabled,
450
def disable(self, signal = True):
451
oldstate = getattr(self, "enabled", False)
452
r = Client.disable(self)
453
if signal and oldstate != self.enabled:
455
self.PropertyChanged(dbus.String(u"enabled"),
456
dbus.Boolean(False, variant_level=1))
1302
459
def __del__(self, *args, **kwargs):
1304
461
self.remove_from_connection()
1305
462
except LookupError:
1307
if hasattr(DBusObjectWithProperties, "__del__"):
1308
DBusObjectWithProperties.__del__(self, *args, **kwargs)
464
if hasattr(dbus.service.Object, "__del__"):
465
dbus.service.Object.__del__(self, *args, **kwargs)
1309
466
Client.__del__(self, *args, **kwargs)
1311
468
def checker_callback(self, pid, condition, command,
1312
469
*args, **kwargs):
1313
470
self.checker_callback_tag = None
1314
471
self.checker = None
473
self.PropertyChanged(dbus.String(u"checker_running"),
474
dbus.Boolean(False, variant_level=1))
1315
475
if os.WIFEXITED(condition):
1316
476
exitstatus = os.WEXITSTATUS(condition)
1317
477
# Emit D-Bus signal
544
# GetAllProperties - method
545
@dbus.service.method(_interface, out_signature="a{sv}")
546
def GetAllProperties(self):
548
return dbus.Dictionary({
550
dbus.String(self.name, variant_level=1),
551
dbus.String("fingerprint"):
552
dbus.String(self.fingerprint, variant_level=1),
554
dbus.String(self.host, variant_level=1),
555
dbus.String("created"):
556
_datetime_to_dbus(self.created, variant_level=1),
557
dbus.String("last_enabled"):
558
(_datetime_to_dbus(self.last_enabled,
560
if self.last_enabled is not None
561
else dbus.Boolean(False, variant_level=1)),
562
dbus.String("enabled"):
563
dbus.Boolean(self.enabled, variant_level=1),
564
dbus.String("last_checked_ok"):
565
(_datetime_to_dbus(self.last_checked_ok,
567
if self.last_checked_ok is not None
568
else dbus.Boolean (False, variant_level=1)),
569
dbus.String("timeout"):
570
dbus.UInt64(self.timeout_milliseconds(),
572
dbus.String("interval"):
573
dbus.UInt64(self.interval_milliseconds(),
575
dbus.String("checker"):
576
dbus.String(self.checker_command,
578
dbus.String("checker_running"):
579
dbus.Boolean(self.checker is not None,
581
dbus.String("object_path"):
582
dbus.ObjectPath(self.dbus_object_path,
586
# IsStillValid - method
587
@dbus.service.method(_interface, out_signature="b")
588
def IsStillValid(self):
589
return self.still_valid()
1379
591
# PropertyChanged - signal
1380
592
@dbus.service.signal(_interface, signature="sv")
1381
593
def PropertyChanged(self, property, value):
1385
# GotSecret - signal
597
# ReceivedSecret - signal
1386
598
@dbus.service.signal(_interface)
1387
def GotSecret(self):
1389
Is sent after a successful transfer of secret from the Mandos
1390
server to mandos-client
599
def ReceivedSecret(self):
1394
603
# Rejected - signal
1395
@dbus.service.signal(_interface, signature="s")
1396
def Rejected(self, reason):
604
@dbus.service.signal(_interface)
1400
# NeedApproval - signal
1401
@dbus.service.signal(_interface, signature="tb")
1402
def NeedApproval(self, timeout, default):
1404
return self.need_approval()
1409
@dbus.service.method(_interface, in_signature="b")
1410
def Approve(self, value):
1413
# CheckedOK - method
1414
@dbus.service.method(_interface)
1415
def CheckedOK(self):
609
# SetChecker - method
610
@dbus.service.method(_interface, in_signature="s")
611
def SetChecker(self, checker):
612
"D-Bus setter method"
613
self.checker_command = checker
615
self.PropertyChanged(dbus.String(u"checker"),
616
dbus.String(self.checker_command,
620
@dbus.service.method(_interface, in_signature="s")
621
def SetHost(self, host):
622
"D-Bus setter method"
625
self.PropertyChanged(dbus.String(u"host"),
626
dbus.String(self.host, variant_level=1))
628
# SetInterval - method
629
@dbus.service.method(_interface, in_signature="t")
630
def SetInterval(self, milliseconds):
631
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
633
self.PropertyChanged(dbus.String(u"interval"),
634
(dbus.UInt64(self.interval_milliseconds(),
638
@dbus.service.method(_interface, in_signature="ay",
640
def SetSecret(self, secret):
641
"D-Bus setter method"
642
self.secret = str(secret)
644
# SetTimeout - method
645
@dbus.service.method(_interface, in_signature="t")
646
def SetTimeout(self, milliseconds):
647
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
649
self.PropertyChanged(dbus.String(u"timeout"),
650
(dbus.UInt64(self.timeout_milliseconds(),
1418
653
# Enable - method
1419
@dbus.service.method(_interface)
654
Enable = dbus.service.method(_interface)(enable)
655
Enable.__name__ = "Enable"
1424
657
# StartChecker - method
1425
658
@dbus.service.method(_interface)
1436
669
# StopChecker - method
1437
@dbus.service.method(_interface)
1438
def StopChecker(self):
1443
# ApprovalPending - property
1444
@dbus_service_property(_interface, signature="b", access="read")
1445
def ApprovalPending_dbus_property(self):
1446
return dbus.Boolean(bool(self.approvals_pending))
1448
# ApprovedByDefault - property
1449
@dbus_service_property(_interface, signature="b",
1451
def ApprovedByDefault_dbus_property(self, value=None):
1452
if value is None: # get
1453
return dbus.Boolean(self.approved_by_default)
1454
self.approved_by_default = bool(value)
1456
# ApprovalDelay - property
1457
@dbus_service_property(_interface, signature="t",
1459
def ApprovalDelay_dbus_property(self, value=None):
1460
if value is None: # get
1461
return dbus.UInt64(self.approval_delay_milliseconds())
1462
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1464
# ApprovalDuration - property
1465
@dbus_service_property(_interface, signature="t",
1467
def ApprovalDuration_dbus_property(self, value=None):
1468
if value is None: # get
1469
return dbus.UInt64(timedelta_to_milliseconds(
1470
self.approval_duration))
1471
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1474
@dbus_service_property(_interface, signature="s", access="read")
1475
def Name_dbus_property(self):
1476
return dbus.String(self.name)
1478
# Fingerprint - property
1479
@dbus_service_property(_interface, signature="s", access="read")
1480
def Fingerprint_dbus_property(self):
1481
return dbus.String(self.fingerprint)
1484
@dbus_service_property(_interface, signature="s",
1486
def Host_dbus_property(self, value=None):
1487
if value is None: # get
1488
return dbus.String(self.host)
1489
self.host = unicode(value)
1491
# Created - property
1492
@dbus_service_property(_interface, signature="s", access="read")
1493
def Created_dbus_property(self):
1494
return datetime_to_dbus(self.created)
1496
# LastEnabled - property
1497
@dbus_service_property(_interface, signature="s", access="read")
1498
def LastEnabled_dbus_property(self):
1499
return datetime_to_dbus(self.last_enabled)
1501
# Enabled - property
1502
@dbus_service_property(_interface, signature="b",
1504
def Enabled_dbus_property(self, value=None):
1505
if value is None: # get
1506
return dbus.Boolean(self.enabled)
1512
# LastCheckedOK - property
1513
@dbus_service_property(_interface, signature="s",
1515
def LastCheckedOK_dbus_property(self, value=None):
1516
if value is not None:
1519
return datetime_to_dbus(self.last_checked_ok)
1521
# LastCheckerStatus - property
1522
@dbus_service_property(_interface, signature="n",
1524
def LastCheckerStatus_dbus_property(self):
1525
return dbus.Int16(self.last_checker_status)
1527
# Expires - property
1528
@dbus_service_property(_interface, signature="s", access="read")
1529
def Expires_dbus_property(self):
1530
return datetime_to_dbus(self.expires)
1532
# LastApprovalRequest - property
1533
@dbus_service_property(_interface, signature="s", access="read")
1534
def LastApprovalRequest_dbus_property(self):
1535
return datetime_to_dbus(self.last_approval_request)
1537
# Timeout - property
1538
@dbus_service_property(_interface, signature="t",
1540
def Timeout_dbus_property(self, value=None):
1541
if value is None: # get
1542
return dbus.UInt64(self.timeout_milliseconds())
1543
old_timeout = self.timeout
1544
self.timeout = datetime.timedelta(0, 0, 0, value)
1545
# Reschedule disabling
1547
now = datetime.datetime.utcnow()
1548
self.expires += self.timeout - old_timeout
1549
if self.expires <= now:
1550
# The timeout has passed
1553
if (getattr(self, "disable_initiator_tag", None)
1556
gobject.source_remove(self.disable_initiator_tag)
1557
self.disable_initiator_tag = (
1558
gobject.timeout_add(
1559
timedelta_to_milliseconds(self.expires - now),
1562
# ExtendedTimeout - property
1563
@dbus_service_property(_interface, signature="t",
1565
def ExtendedTimeout_dbus_property(self, value=None):
1566
if value is None: # get
1567
return dbus.UInt64(self.extended_timeout_milliseconds())
1568
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1570
# Interval - property
1571
@dbus_service_property(_interface, signature="t",
1573
def Interval_dbus_property(self, value=None):
1574
if value is None: # get
1575
return dbus.UInt64(self.interval_milliseconds())
1576
self.interval = datetime.timedelta(0, 0, 0, value)
1577
if getattr(self, "checker_initiator_tag", None) is None:
1580
# Reschedule checker run
1581
gobject.source_remove(self.checker_initiator_tag)
1582
self.checker_initiator_tag = (gobject.timeout_add
1583
(value, self.start_checker))
1584
self.start_checker() # Start one now, too
1586
# Checker - property
1587
@dbus_service_property(_interface, signature="s",
1589
def Checker_dbus_property(self, value=None):
1590
if value is None: # get
1591
return dbus.String(self.checker_command)
1592
self.checker_command = unicode(value)
1594
# CheckerRunning - property
1595
@dbus_service_property(_interface, signature="b",
1597
def CheckerRunning_dbus_property(self, value=None):
1598
if value is None: # get
1599
return dbus.Boolean(self.checker is not None)
1601
self.start_checker()
1605
# ObjectPath - property
1606
@dbus_service_property(_interface, signature="o", access="read")
1607
def ObjectPath_dbus_property(self):
1608
return self.dbus_object_path # is already a dbus.ObjectPath
1611
@dbus_service_property(_interface, signature="ay",
1612
access="write", byte_arrays=True)
1613
def Secret_dbus_property(self, value):
1614
self.secret = str(value)
670
StopChecker = dbus.service.method(_interface)(stop_checker)
671
StopChecker.__name__ = "StopChecker"
1619
class ProxyClient(object):
1620
def __init__(self, child_pipe, fpr, address):
1621
self._pipe = child_pipe
1622
self._pipe.send(('init', fpr, address))
1623
if not self._pipe.recv():
1626
def __getattribute__(self, name):
1628
return super(ProxyClient, self).__getattribute__(name)
1629
self._pipe.send(('getattr', name))
1630
data = self._pipe.recv()
1631
if data[0] == 'data':
1633
if data[0] == 'function':
1634
def func(*args, **kwargs):
1635
self._pipe.send(('funcall', name, args, kwargs))
1636
return self._pipe.recv()[1]
1639
def __setattr__(self, name, value):
1641
return super(ProxyClient, self).__setattr__(name, value)
1642
self._pipe.send(('setattr', name, value))
1645
class ClientHandler(socketserver.BaseRequestHandler, object):
1646
"""A class to handle client connections.
1648
Instantiated once for each connection to handle it.
676
class TCP_handler(SocketServer.BaseRequestHandler, object):
677
"""A TCP request handler class.
678
Instantiated by IPv6_TCPServer for each request to handle it.
1649
679
Note: This will run in its own forked process."""
1651
681
def handle(self):
1652
with contextlib.closing(self.server.child_pipe) as child_pipe:
1653
logger.info("TCP connection from: %s",
1654
unicode(self.client_address))
1655
logger.debug("Pipe FD: %d",
1656
self.server.child_pipe.fileno())
682
logger.info(u"TCP connection from: %s",
683
unicode(self.client_address))
684
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
685
# Open IPC pipe to parent process
686
with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
1658
687
session = (gnutls.connection
1659
688
.ClientSession(self.request,
1660
689
gnutls.connection
1661
690
.X509Credentials()))
692
line = self.request.makefile().readline()
693
logger.debug(u"Protocol version: %r", line)
695
if int(line.strip().split()[0]) > 1:
697
except (ValueError, IndexError, RuntimeError), error:
698
logger.error(u"Unknown protocol version: %s", error)
1663
701
# Note: gnutls.connection.X509Credentials is really a
1664
702
# generic GnuTLS certificate credentials object so long as
1665
703
# no X.509 keys are added to it. Therefore, we can use it
1666
704
# here despite using OpenPGP certificates.
1668
706
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1669
# "+AES-256-CBC", "+SHA1",
1670
# "+COMP-NULL", "+CTYPE-OPENPGP",
707
# "+AES-256-CBC", "+SHA1",
708
# "+COMP-NULL", "+CTYPE-OPENPGP",
1672
710
# Use a fallback default, since this MUST be set.
1673
priority = self.server.gnutls_priority
1674
if priority is None:
711
priority = self.server.settings.get("priority", "NORMAL")
1676
712
(gnutls.library.functions
1677
713
.gnutls_priority_set_direct(session._c_object,
1678
714
priority, None))
1680
# Start communication using the Mandos protocol
1681
# Get protocol number
1682
line = self.request.makefile().readline()
1683
logger.debug("Protocol version: %r", line)
1685
if int(line.strip().split()[0]) > 1:
1687
except (ValueError, IndexError, RuntimeError) as error:
1688
logger.error("Unknown protocol version: %s", error)
1691
# Start GnuTLS connection
1693
717
session.handshake()
1694
except gnutls.errors.GNUTLSError as error:
1695
logger.warning("Handshake failed: %s", error)
718
except gnutls.errors.GNUTLSError, error:
719
logger.warning(u"Handshake failed: %s", error)
1696
720
# Do not run session.bye() here: the session is not
1697
721
# established. Just abandon the request.
1699
logger.debug("Handshake succeeded")
1701
approval_required = False
723
logger.debug(u"Handshake succeeded")
1704
fpr = self.fingerprint(self.peer_certificate
1707
gnutls.errors.GNUTLSError) as error:
1708
logger.warning("Bad certificate: %s", error)
1710
logger.debug("Fingerprint: %s", fpr)
1713
client = ProxyClient(child_pipe, fpr,
1714
self.client_address)
1718
if client.approval_delay:
1719
delay = client.approval_delay
1720
client.approvals_pending += 1
1721
approval_required = True
1724
if not client.enabled:
1725
logger.info("Client %s is disabled",
1727
if self.server.use_dbus:
1729
client.Rejected("Disabled")
1732
if client.approved or not client.approval_delay:
1733
#We are approved or approval is disabled
1735
elif client.approved is None:
1736
logger.info("Client %s needs approval",
1738
if self.server.use_dbus:
1740
client.NeedApproval(
1741
client.approval_delay_milliseconds(),
1742
client.approved_by_default)
1744
logger.warning("Client %s was not approved",
1746
if self.server.use_dbus:
1748
client.Rejected("Denied")
1751
#wait until timeout or approved
1752
time = datetime.datetime.now()
1753
client.changedstate.acquire()
1754
client.changedstate.wait(
1755
float(timedelta_to_milliseconds(delay)
1757
client.changedstate.release()
1758
time2 = datetime.datetime.now()
1759
if (time2 - time) >= delay:
1760
if not client.approved_by_default:
1761
logger.warning("Client %s timed out while"
1762
" waiting for approval",
1764
if self.server.use_dbus:
1766
client.Rejected("Approval timed out")
1771
delay -= time2 - time
1774
while sent_size < len(client.secret):
1776
sent = session.send(client.secret[sent_size:])
1777
except gnutls.errors.GNUTLSError as error:
1778
logger.warning("gnutls send failed",
1781
logger.debug("Sent: %d, remaining: %d",
1782
sent, len(client.secret)
1783
- (sent_size + sent))
1786
logger.info("Sending secret to %s", client.name)
1787
# bump the timeout using extended_timeout
1788
client.bump_timeout(client.extended_timeout)
1789
if self.server.use_dbus:
725
fpr = self.fingerprint(self.peer_certificate(session))
726
except (TypeError, gnutls.errors.GNUTLSError), error:
727
logger.warning(u"Bad certificate: %s", error)
730
logger.debug(u"Fingerprint: %s", fpr)
1794
if approval_required:
1795
client.approvals_pending -= 1
1798
except gnutls.errors.GNUTLSError as error:
1799
logger.warning("GnuTLS bye failed",
732
for c in self.server.clients:
733
if c.fingerprint == fpr:
737
ipc.write("NOTFOUND %s\n" % fpr)
740
# Have to check if client.still_valid(), since it is
741
# possible that the client timed out while establishing
742
# the GnuTLS session.
743
if not client.still_valid():
744
ipc.write("INVALID %s\n" % client.name)
747
ipc.write("SENDING %s\n" % client.name)
749
while sent_size < len(client.secret):
750
sent = session.send(client.secret[sent_size:])
751
logger.debug(u"Sent: %d, remaining: %d",
752
sent, len(client.secret)
753
- (sent_size + sent))
1803
758
def peer_certificate(session):
1859
814
# Convert the buffer to a Python bytestring
1860
815
fpr = ctypes.string_at(buf, buf_len.value)
1861
816
# Convert the bytestring to hexadecimal notation
1862
hex_fpr = binascii.hexlify(fpr).upper()
817
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1866
class MultiprocessingMixIn(object):
1867
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1868
def sub_process_main(self, request, address):
1870
self.finish_request(request, address)
1872
self.handle_error(request, address)
1873
self.close_request(request)
1875
def process_request(self, request, address):
1876
"""Start a new process to process the request."""
1877
proc = multiprocessing.Process(target = self.sub_process_main,
1878
args = (request, address))
1883
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1884
""" adds a pipe to the MixIn """
821
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
822
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
823
Assumes a gobject.MainLoop event loop.
1885
825
def process_request(self, request, client_address):
1886
"""Overrides and wraps the original process_request().
1888
This function creates a new pipe in self.pipe
826
"""This overrides and wraps the original process_request().
827
This function creates a new pipe in self.pipe
1890
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1892
proc = MultiprocessingMixIn.process_request(self, request,
1894
self.child_pipe.close()
1895
self.add_pipe(parent_pipe, proc)
1897
def add_pipe(self, parent_pipe, proc):
829
self.pipe = os.pipe()
830
super(ForkingMixInWithPipe,
831
self).process_request(request, client_address)
832
os.close(self.pipe[1]) # close write end
833
# Call "handle_ipc" for both data and EOF events
834
gobject.io_add_watch(self.pipe[0],
835
gobject.IO_IN | gobject.IO_HUP,
837
def handle_ipc(source, condition):
1898
838
"""Dummy function; override as necessary"""
1899
raise NotImplementedError
1902
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1903
socketserver.TCPServer, object):
843
class IPv6_TCPServer(ForkingMixInWithPipe,
844
SocketServer.TCPServer, object):
1904
845
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
847
settings: Server settings
848
clients: Set() of Client objects
1907
849
enabled: Boolean; whether this server is activated yet
1908
interface: None or a network interface name (string)
1909
use_ipv6: Boolean; to use IPv6 or not
1911
def __init__(self, server_address, RequestHandlerClass,
1912
interface=None, use_ipv6=True, socketfd=None):
1913
"""If socketfd is set, use that file descriptor instead of
1914
creating a new one with socket.socket().
1916
self.interface = interface
1918
self.address_family = socket.AF_INET6
1919
if socketfd is not None:
1920
# Save the file descriptor
1921
self.socketfd = socketfd
1922
# Save the original socket.socket() function
1923
self.socket_socket = socket.socket
1924
# To implement --socket, we monkey patch socket.socket.
1926
# (When socketserver.TCPServer is a new-style class, we
1927
# could make self.socket into a property instead of monkey
1928
# patching socket.socket.)
1930
# Create a one-time-only replacement for socket.socket()
1931
@functools.wraps(socket.socket)
1932
def socket_wrapper(*args, **kwargs):
1933
# Restore original function so subsequent calls are
1935
socket.socket = self.socket_socket
1936
del self.socket_socket
1937
# This time only, return a new socket object from the
1938
# saved file descriptor.
1939
return socket.fromfd(self.socketfd, *args, **kwargs)
1940
# Replace socket.socket() function with wrapper
1941
socket.socket = socket_wrapper
1942
# The socketserver.TCPServer.__init__ will call
1943
# socket.socket(), which might be our replacement,
1944
# socket_wrapper(), if socketfd was set.
1945
socketserver.TCPServer.__init__(self, server_address,
1946
RequestHandlerClass)
851
address_family = socket.AF_INET6
852
def __init__(self, *args, **kwargs):
853
if "settings" in kwargs:
854
self.settings = kwargs["settings"]
855
del kwargs["settings"]
856
if "clients" in kwargs:
857
self.clients = kwargs["clients"]
858
del kwargs["clients"]
859
if "use_ipv6" in kwargs:
860
if not kwargs["use_ipv6"]:
861
self.address_family = socket.AF_INET
862
del kwargs["use_ipv6"]
864
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1948
865
def server_bind(self):
1949
866
"""This overrides the normal server_bind() function
1950
867
to bind to an interface if one was specified, and also NOT to
1951
868
bind to an address or port if they were not specified."""
1952
if self.interface is not None:
1953
if SO_BINDTODEVICE is None:
1954
logger.error("SO_BINDTODEVICE does not exist;"
1955
" cannot bind to interface %s",
1959
self.socket.setsockopt(socket.SOL_SOCKET,
1961
str(self.interface + '\0'))
1962
except socket.error as error:
1963
if error.errno == errno.EPERM:
1964
logger.error("No permission to bind to"
1965
" interface %s", self.interface)
1966
elif error.errno == errno.ENOPROTOOPT:
1967
logger.error("SO_BINDTODEVICE not available;"
1968
" cannot bind to interface %s",
1970
elif error.errno == errno.ENODEV:
1971
logger.error("Interface %s does not exist,"
1972
" cannot bind", self.interface)
869
if self.settings["interface"]:
870
# 25 is from /usr/include/asm-i486/socket.h
871
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
873
self.socket.setsockopt(socket.SOL_SOCKET,
875
self.settings["interface"])
876
except socket.error, error:
877
if error[0] == errno.EPERM:
878
logger.error(u"No permission to"
879
u" bind to interface %s",
880
self.settings["interface"])
1975
883
# Only bind(2) the socket if we really need to.
1976
884
if self.server_address[0] or self.server_address[1]:
1977
885
if not self.server_address[0]:
1984
892
elif not self.server_address[1]:
1985
893
self.server_address = (self.server_address[0],
1987
# if self.interface:
895
# if self.settings["interface"]:
1988
896
# self.server_address = (self.server_address[0],
1991
899
# if_nametoindex
1993
return socketserver.TCPServer.server_bind(self)
1996
class MandosServer(IPv6_TCPServer):
2000
clients: set of Client objects
2001
gnutls_priority GnuTLS priority string
2002
use_dbus: Boolean; to emit D-Bus signals or not
2004
Assumes a gobject.MainLoop event loop.
2006
def __init__(self, server_address, RequestHandlerClass,
2007
interface=None, use_ipv6=True, clients=None,
2008
gnutls_priority=None, use_dbus=True, socketfd=None):
2009
self.enabled = False
2010
self.clients = clients
2011
if self.clients is None:
2013
self.use_dbus = use_dbus
2014
self.gnutls_priority = gnutls_priority
2015
IPv6_TCPServer.__init__(self, server_address,
2016
RequestHandlerClass,
2017
interface = interface,
2018
use_ipv6 = use_ipv6,
2019
socketfd = socketfd)
902
return super(IPv6_TCPServer, self).server_bind()
2020
903
def server_activate(self):
2021
904
if self.enabled:
2022
return socketserver.TCPServer.server_activate(self)
905
return super(IPv6_TCPServer, self).server_activate()
2024
906
def enable(self):
2025
907
self.enabled = True
2027
def add_pipe(self, parent_pipe, proc):
2028
# Call "handle_ipc" for both data and EOF events
2029
gobject.io_add_watch(parent_pipe.fileno(),
2030
gobject.IO_IN | gobject.IO_HUP,
2031
functools.partial(self.handle_ipc,
2036
def handle_ipc(self, source, condition, parent_pipe=None,
2037
proc = None, client_object=None):
2038
# error, or the other end of multiprocessing.Pipe has closed
2039
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2040
# Wait for other process to exit
2044
# Read a request from the child
2045
request = parent_pipe.recv()
2046
command = request[0]
2048
if command == 'init':
2050
address = request[2]
2052
for c in self.clients.itervalues():
2053
if c.fingerprint == fpr:
2057
logger.info("Client not found for fingerprint: %s, ad"
2058
"dress: %s", fpr, address)
2061
mandos_dbus_service.ClientNotFound(fpr,
2063
parent_pipe.send(False)
2066
gobject.io_add_watch(parent_pipe.fileno(),
2067
gobject.IO_IN | gobject.IO_HUP,
2068
functools.partial(self.handle_ipc,
2074
parent_pipe.send(True)
2075
# remove the old hook in favor of the new above hook on
2078
if command == 'funcall':
2079
funcname = request[1]
2083
parent_pipe.send(('data', getattr(client_object,
2087
if command == 'getattr':
2088
attrname = request[1]
2089
if callable(client_object.__getattribute__(attrname)):
2090
parent_pipe.send(('function',))
2092
parent_pipe.send(('data', client_object
2093
.__getattribute__(attrname)))
2095
if command == 'setattr':
2096
attrname = request[1]
2098
setattr(client_object, attrname, value)
908
def handle_ipc(self, source, condition, file_objects={}):
910
gobject.IO_IN: "IN", # There is data to read.
911
gobject.IO_OUT: "OUT", # Data can be written (without
913
gobject.IO_PRI: "PRI", # There is urgent data to read.
914
gobject.IO_ERR: "ERR", # Error condition.
915
gobject.IO_HUP: "HUP" # Hung up (the connection has been
916
# broken, usually for pipes and
919
conditions_string = ' | '.join(name
921
condition_names.iteritems()
923
logger.debug("Handling IPC: FD = %d, condition = %s", source,
926
# Turn the pipe file descriptor into a Python file object
927
if source not in file_objects:
928
file_objects[source] = os.fdopen(source, "r", 1)
930
# Read a line from the file object
931
cmdline = file_objects[source].readline()
932
if not cmdline: # Empty line means end of file
934
file_objects[source].close()
935
del file_objects[source]
937
# Stop calling this function
940
logger.debug("IPC command: %r", cmdline)
942
# Parse and act on command
943
cmd, args = cmdline.rstrip("\r\n").split(None, 1)
945
if cmd == "NOTFOUND":
946
logger.warning(u"Client not found for fingerprint: %s",
948
if self.settings["use_dbus"]:
950
mandos_dbus_service.ClientNotFound(args)
951
elif cmd == "INVALID":
952
for client in self.clients:
953
if client.name == args:
954
logger.warning(u"Client %s is invalid", args)
955
if self.settings["use_dbus"]:
960
logger.error(u"Unknown client %s is invalid", args)
961
elif cmd == "SENDING":
962
for client in self.clients:
963
if client.name == args:
964
logger.info(u"Sending secret to %s", client.name)
966
if self.settings["use_dbus"]:
968
client.ReceivedSecret()
971
logger.error(u"Sending secret to unknown client %s",
974
logger.error("Unknown IPC command: %r", cmdline)
976
# Keep calling this function
2103
def rfc3339_duration_to_delta(duration):
2104
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2106
>>> rfc3339_duration_to_delta("P7D")
2107
datetime.timedelta(7)
2108
>>> rfc3339_duration_to_delta("PT60S")
2109
datetime.timedelta(0, 60)
2110
>>> rfc3339_duration_to_delta("PT60M")
2111
datetime.timedelta(0, 3600)
2112
>>> rfc3339_duration_to_delta("PT24H")
2113
datetime.timedelta(1)
2114
>>> rfc3339_duration_to_delta("P1W")
2115
datetime.timedelta(7)
2116
>>> rfc3339_duration_to_delta("PT5M30S")
2117
datetime.timedelta(0, 330)
2118
>>> rfc3339_duration_to_delta("P1DT3M20S")
2119
datetime.timedelta(1, 200)
2122
# Parsing an RFC 3339 duration with regular expressions is not
2123
# possible - there would have to be multiple places for the same
2124
# values, like seconds. The current code, while more esoteric, is
2125
# cleaner without depending on a parsing library. If Python had a
2126
# built-in library for parsing we would use it, but we'd like to
2127
# avoid excessive use of external libraries.
2129
# New type for defining tokens, syntax, and semantics all-in-one
2130
Token = collections.namedtuple("Token",
2131
("regexp", # To match token; if
2132
# "value" is not None,
2133
# must have a "group"
2135
"value", # datetime.timedelta or
2137
"followers")) # Tokens valid after
2139
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2140
# the "duration" ABNF definition in RFC 3339, Appendix A.
2141
token_end = Token(re.compile(r"$"), None, frozenset())
2142
token_second = Token(re.compile(r"(\d+)S"),
2143
datetime.timedelta(seconds=1),
2144
frozenset((token_end,)))
2145
token_minute = Token(re.compile(r"(\d+)M"),
2146
datetime.timedelta(minutes=1),
2147
frozenset((token_second, token_end)))
2148
token_hour = Token(re.compile(r"(\d+)H"),
2149
datetime.timedelta(hours=1),
2150
frozenset((token_minute, token_end)))
2151
token_time = Token(re.compile(r"T"),
2153
frozenset((token_hour, token_minute,
2155
token_day = Token(re.compile(r"(\d+)D"),
2156
datetime.timedelta(days=1),
2157
frozenset((token_time, token_end)))
2158
token_month = Token(re.compile(r"(\d+)M"),
2159
datetime.timedelta(weeks=4),
2160
frozenset((token_day, token_end)))
2161
token_year = Token(re.compile(r"(\d+)Y"),
2162
datetime.timedelta(weeks=52),
2163
frozenset((token_month, token_end)))
2164
token_week = Token(re.compile(r"(\d+)W"),
2165
datetime.timedelta(weeks=1),
2166
frozenset((token_end,)))
2167
token_duration = Token(re.compile(r"P"), None,
2168
frozenset((token_year, token_month,
2169
token_day, token_time,
2171
# Define starting values
2172
value = datetime.timedelta() # Value so far
2174
followers = frozenset(token_duration,) # Following valid tokens
2175
s = duration # String left to parse
2176
# Loop until end token is found
2177
while found_token is not token_end:
2178
# Search for any currently valid tokens
2179
for token in followers:
2180
match = token.regexp.match(s)
2181
if match is not None:
2183
if token.value is not None:
2184
# Value found, parse digits
2185
factor = int(match.group(1), 10)
2186
# Add to value so far
2187
value += factor * token.value
2188
# Strip token from string
2189
s = token.regexp.sub("", s, 1)
2192
# Set valid next tokens
2193
followers = found_token.followers
2196
# No currently valid tokens were found
2197
raise ValueError("Invalid RFC 3339 duration")
2202
980
def string_to_delta(interval):
2203
981
"""Parse a string and return a datetime.timedelta
2275
##################################################################
1090
######################################################################
2276
1091
# Parsing of options, both command line and config file
2278
parser = argparse.ArgumentParser()
2279
parser.add_argument("-v", "--version", action="version",
2280
version = "%(prog)s {0}".format(version),
2281
help="show version number and exit")
2282
parser.add_argument("-i", "--interface", metavar="IF",
2283
help="Bind to interface IF")
2284
parser.add_argument("-a", "--address",
2285
help="Address to listen for requests on")
2286
parser.add_argument("-p", "--port", type=int,
2287
help="Port number to receive requests on")
2288
parser.add_argument("--check", action="store_true",
2289
help="Run self-test")
2290
parser.add_argument("--debug", action="store_true",
2291
help="Debug mode; run in foreground and log"
2293
parser.add_argument("--debuglevel", metavar="LEVEL",
2294
help="Debug level for stdout output")
2295
parser.add_argument("--priority", help="GnuTLS"
2296
" priority string (see GnuTLS documentation)")
2297
parser.add_argument("--servicename",
2298
metavar="NAME", help="Zeroconf service name")
2299
parser.add_argument("--configdir",
2300
default="/etc/mandos", metavar="DIR",
2301
help="Directory to search for configuration"
2303
parser.add_argument("--no-dbus", action="store_false",
2304
dest="use_dbus", help="Do not provide D-Bus"
2305
" system bus interface")
2306
parser.add_argument("--no-ipv6", action="store_false",
2307
dest="use_ipv6", help="Do not use IPv6")
2308
parser.add_argument("--no-restore", action="store_false",
2309
dest="restore", help="Do not restore stored"
2311
parser.add_argument("--socket", type=int,
2312
help="Specify a file descriptor to a network"
2313
" socket to use instead of creating one")
2314
parser.add_argument("--statedir", metavar="DIR",
2315
help="Directory to save/restore state in")
2316
parser.add_argument("--foreground", action="store_true",
2317
help="Run in foreground")
2319
options = parser.parse_args()
1093
parser = optparse.OptionParser(version = "%%prog %s" % version)
1094
parser.add_option("-i", "--interface", type="string",
1095
metavar="IF", help="Bind to interface IF")
1096
parser.add_option("-a", "--address", type="string",
1097
help="Address to listen for requests on")
1098
parser.add_option("-p", "--port", type="int",
1099
help="Port number to receive requests on")
1100
parser.add_option("--check", action="store_true",
1101
help="Run self-test")
1102
parser.add_option("--debug", action="store_true",
1103
help="Debug mode; run in foreground and log to"
1105
parser.add_option("--priority", type="string", help="GnuTLS"
1106
" priority string (see GnuTLS documentation)")
1107
parser.add_option("--servicename", type="string", metavar="NAME",
1108
help="Zeroconf service name")
1109
parser.add_option("--configdir", type="string",
1110
default="/etc/mandos", metavar="DIR",
1111
help="Directory to search for configuration"
1113
parser.add_option("--no-dbus", action="store_false",
1115
help="Do not provide D-Bus system bus"
1117
parser.add_option("--no-ipv6", action="store_false",
1118
dest="use_ipv6", help="Do not use IPv6")
1119
options = parser.parse_args()[0]
2321
1121
if options.check:
2333
1133
"servicename": "Mandos",
2334
1134
"use_dbus": "True",
2335
1135
"use_ipv6": "True",
2339
"statedir": "/var/lib/mandos",
2340
"foreground": "False",
2343
1138
# Parse config file for server-global settings
2344
server_config = configparser.SafeConfigParser(server_defaults)
1139
server_config = ConfigParser.SafeConfigParser(server_defaults)
2345
1140
del server_defaults
2346
server_config.read(os.path.join(options.configdir,
1141
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2348
1142
# Convert the SafeConfigParser object to a dict
2349
1143
server_settings = server_config.defaults()
2350
1144
# Use the appropriate methods on the non-string config options
2351
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2352
server_settings[option] = server_config.getboolean("DEFAULT",
1145
server_settings["debug"] = server_config.getboolean("DEFAULT",
1147
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1149
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
2354
1151
if server_settings["port"]:
2355
1152
server_settings["port"] = server_config.getint("DEFAULT",
2357
if server_settings["socket"]:
2358
server_settings["socket"] = server_config.getint("DEFAULT",
2360
# Later, stdin will, and stdout and stderr might, be dup'ed
2361
# over with an opened os.devnull. But we don't want this to
2362
# happen with a supplied network socket.
2363
if 0 <= server_settings["socket"] <= 2:
2364
server_settings["socket"] = os.dup(server_settings
2366
1154
del server_config
2368
1156
# Override the settings from the config file with command line
2369
1157
# options, if set.
2370
1158
for option in ("interface", "address", "port", "debug",
2371
1159
"priority", "servicename", "configdir",
2372
"use_dbus", "use_ipv6", "debuglevel", "restore",
2373
"statedir", "socket", "foreground"):
1160
"use_dbus", "use_ipv6"):
2374
1161
value = getattr(options, option)
2375
1162
if value is not None:
2376
1163
server_settings[option] = value
2378
# Force all strings to be unicode
2379
for option in server_settings.keys():
2380
if type(server_settings[option]) is str:
2381
server_settings[option] = unicode(server_settings[option])
2382
# Debug implies foreground
2383
if server_settings["debug"]:
2384
server_settings["foreground"] = True
2385
1165
# Now we have our good server settings in "server_settings"
2387
1167
##################################################################
2389
1169
# For convenience
2390
1170
debug = server_settings["debug"]
2391
debuglevel = server_settings["debuglevel"]
2392
1171
use_dbus = server_settings["use_dbus"]
2393
1172
use_ipv6 = server_settings["use_ipv6"]
2394
stored_state_path = os.path.join(server_settings["statedir"],
2396
foreground = server_settings["foreground"]
2399
initlogger(debug, logging.DEBUG)
2404
level = getattr(logging, debuglevel.upper())
2405
initlogger(debug, level)
1175
syslogger.setLevel(logging.WARNING)
1176
console.setLevel(logging.WARNING)
2407
1178
if server_settings["servicename"] != "Mandos":
2408
1179
syslogger.setFormatter(logging.Formatter
2409
('Mandos ({0}) [%(process)d]:'
2410
' %(levelname)s: %(message)s'
2411
.format(server_settings
1180
('Mandos (%s) [%%(process)d]:'
1181
' %%(levelname)s: %%(message)s'
1182
% server_settings["servicename"]))
2414
1184
# Parse config file with clients
2415
client_config = configparser.SafeConfigParser(Client
1185
client_defaults = { "timeout": "1h",
1187
"checker": "fping -q -- %%(host)s",
1190
client_config = ConfigParser.SafeConfigParser(client_defaults)
2417
1191
client_config.read(os.path.join(server_settings["configdir"],
2418
1192
"clients.conf"))
2420
1194
global mandos_dbus_service
2421
1195
mandos_dbus_service = None
2423
tcp_server = MandosServer((server_settings["address"],
2424
server_settings["port"]),
2426
interface=(server_settings["interface"]
2430
server_settings["priority"],
2432
socketfd=(server_settings["socket"]
2435
pidfilename = "/var/run/mandos.pid"
2438
pidfile = open(pidfilename, "w")
2439
except IOError as e:
2440
logger.error("Could not open file %r", pidfilename,
1198
tcp_server = IPv6_TCPServer((server_settings["address"],
1199
server_settings["port"]),
1201
settings=server_settings,
1202
clients=clients, use_ipv6=use_ipv6)
1203
pidfilename = "/var/run/mandos.pid"
1205
pidfile = open(pidfilename, "w")
1207
logger.error("Could not open file %r", pidfilename)
2443
for name in ("_mandos", "mandos", "nobody"):
1210
uid = pwd.getpwnam("_mandos").pw_uid
1211
gid = pwd.getpwnam("_mandos").pw_gid
2445
uid = pwd.getpwnam(name).pw_uid
2446
gid = pwd.getpwnam(name).pw_gid
1214
uid = pwd.getpwnam("mandos").pw_uid
1215
gid = pwd.getpwnam("mandos").pw_gid
2448
1216
except KeyError:
1218
uid = pwd.getpwnam("nobody").pw_uid
1219
gid = pwd.getpwnam("nogroup").pw_gid
2456
except OSError as error:
2457
if error.errno != errno.EPERM:
1226
except OSError, error:
1227
if error[0] != errno.EPERM:
1230
# Enable all possible GnuTLS debugging
2461
# Enable all possible GnuTLS debugging
2463
1232
# "Use a log level over 10 to enable all debugging options."
2464
1233
# - GnuTLS manual
2465
1234
gnutls.library.functions.gnutls_global_set_log_level(11)
2471
1240
(gnutls.library.functions
2472
1241
.gnutls_global_set_log_function(debug_gnutls))
2474
# Redirect stdin so all checkers get /dev/null
2475
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2476
os.dup2(null, sys.stdin.fileno())
2480
# Need to fork before connecting to D-Bus
2482
# Close all input and output, do double fork, etc.
2485
# multiprocessing will use threads, so before we use gobject we
2486
# need to inform gobject that threads will be used.
2487
gobject.threads_init()
1244
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1245
service = AvahiService(name = server_settings["servicename"],
1246
servicetype = "_mandos._tcp",
1247
protocol = protocol)
1248
if server_settings["interface"]:
1249
service.interface = (if_nametoindex
1250
(server_settings["interface"]))
2489
1252
global main_loop
2490
1255
# From the Avahi example code
2491
DBusGMainLoop(set_as_default=True)
1256
DBusGMainLoop(set_as_default=True )
2492
1257
main_loop = gobject.MainLoop()
2493
1258
bus = dbus.SystemBus()
1259
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1260
avahi.DBUS_PATH_SERVER),
1261
avahi.DBUS_INTERFACE_SERVER)
2494
1262
# End of Avahi example code
2497
bus_name = dbus.service.BusName("se.recompile.Mandos",
2498
bus, do_not_queue=True)
2499
old_bus_name = (dbus.service.BusName
2500
("se.bsnet.fukt.Mandos", bus,
2502
except dbus.exceptions.NameExistsException as e:
2503
logger.error("Disabling D-Bus:", exc_info=e)
2505
server_settings["use_dbus"] = False
2506
tcp_server.use_dbus = False
2507
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2508
service = AvahiServiceToSyslog(name =
2509
server_settings["servicename"],
2510
servicetype = "_mandos._tcp",
2511
protocol = protocol, bus = bus)
2512
if server_settings["interface"]:
2513
service.interface = (if_nametoindex
2514
(str(server_settings["interface"])))
2516
global multiprocessing_manager
2517
multiprocessing_manager = multiprocessing.Manager()
1264
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
2519
1266
client_class = Client
2521
client_class = functools.partial(ClientDBus, bus = bus)
2523
client_settings = Client.config_parser(client_config)
2524
old_client_settings = {}
2527
# Get client data and settings from last running state.
2528
if server_settings["restore"]:
2530
with open(stored_state_path, "rb") as stored_state:
2531
clients_data, old_client_settings = (pickle.load
2533
os.remove(stored_state_path)
2534
except IOError as e:
2535
if e.errno == errno.ENOENT:
2536
logger.warning("Could not load persistent state: {0}"
2537
.format(os.strerror(e.errno)))
2539
logger.critical("Could not load persistent state:",
2542
except EOFError as e:
2543
logger.warning("Could not load persistent state: "
2544
"EOFError:", exc_info=e)
2546
with PGPEngine() as pgp:
2547
for client_name, client in clients_data.iteritems():
2548
# Decide which value to use after restoring saved state.
2549
# We have three different values: Old config file,
2550
# new config file, and saved state.
2551
# New config value takes precedence if it differs from old
2552
# config value, otherwise use saved state.
2553
for name, value in client_settings[client_name].items():
2555
# For each value in new config, check if it
2556
# differs from the old config value (Except for
2557
# the "secret" attribute)
2558
if (name != "secret" and
2559
value != old_client_settings[client_name]
2561
client[name] = value
2565
# Clients who has passed its expire date can still be
2566
# enabled if its last checker was successful. Clients
2567
# whose checker succeeded before we stored its state is
2568
# assumed to have successfully run all checkers during
2570
if client["enabled"]:
2571
if datetime.datetime.utcnow() >= client["expires"]:
2572
if not client["last_checked_ok"]:
2574
"disabling client {0} - Client never "
2575
"performed a successful checker"
2576
.format(client_name))
2577
client["enabled"] = False
2578
elif client["last_checker_status"] != 0:
2580
"disabling client {0} - Client "
2581
"last checker failed with error code {1}"
2582
.format(client_name,
2583
client["last_checker_status"]))
2584
client["enabled"] = False
2586
client["expires"] = (datetime.datetime
2588
+ client["timeout"])
2589
logger.debug("Last checker succeeded,"
2590
" keeping {0} enabled"
2591
.format(client_name))
2593
client["secret"] = (
2594
pgp.decrypt(client["encrypted_secret"],
2595
client_settings[client_name]
2598
# If decryption fails, we use secret from new settings
2599
logger.debug("Failed to decrypt {0} old secret"
2600
.format(client_name))
2601
client["secret"] = (
2602
client_settings[client_name]["secret"])
2604
# Add/remove clients based on new changes made to config
2605
for client_name in (set(old_client_settings)
2606
- set(client_settings)):
2607
del clients_data[client_name]
2608
for client_name in (set(client_settings)
2609
- set(old_client_settings)):
2610
clients_data[client_name] = client_settings[client_name]
2612
# Create all client objects
2613
for client_name, client in clients_data.iteritems():
2614
tcp_server.clients[client_name] = client_class(
2615
name = client_name, settings = client)
2617
if not tcp_server.clients:
2618
logger.warning("No clients defined")
2621
if pidfile is not None:
2625
pidfile.write(str(pid) + "\n".encode("utf-8"))
2627
logger.error("Could not write to file %r with PID %d",
1268
client_class = ClientDBus
1270
client_class(name = section,
1271
config= dict(client_config.items(section)))
1272
for section in client_config.sections()))
1274
logger.warning(u"No clients defined")
1277
# Redirect stdin so all checkers get /dev/null
1278
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1279
os.dup2(null, sys.stdin.fileno())
1283
# No console logging
1284
logger.removeHandler(console)
1285
# Close all input and output, do double fork, etc.
1289
with closing(pidfile):
1291
pidfile.write(str(pid) + "\n")
1294
logger.error(u"Could not write to file %r with PID %d",
1297
# "pidfile" was never created
1302
"Cleanup function; run on exit"
1304
# From the Avahi example code
1305
if not group is None:
1308
# End of Avahi example code
1311
client = clients.pop()
1312
client.disable_hook = None
1315
atexit.register(cleanup)
1318
signal.signal(signal.SIGINT, signal.SIG_IGN)
2632
1319
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2633
1320
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2636
@alternate_dbus_interfaces({"se.recompile.Mandos":
2637
"se.bsnet.fukt.Mandos"})
2638
class MandosDBusService(DBusObjectWithProperties):
1323
class MandosDBusService(dbus.service.Object):
2639
1324
"""A D-Bus proxy object"""
2640
1325
def __init__(self):
2641
1326
dbus.service.Object.__init__(self, bus, "/")
2642
_interface = "se.recompile.Mandos"
2644
@dbus_interface_annotations(_interface)
2646
return { "org.freedesktop.DBus.Property"
2647
".EmitsChangedSignal":
2650
@dbus.service.signal(_interface, signature="o")
2651
def ClientAdded(self, objpath):
1327
_interface = u"se.bsnet.fukt.Mandos"
1329
@dbus.service.signal(_interface, signature="oa{sv}")
1330
def ClientAdded(self, objpath, properties):
2655
@dbus.service.signal(_interface, signature="ss")
2656
def ClientNotFound(self, fingerprint, address):
1334
@dbus.service.signal(_interface, signature="s")
1335
def ClientNotFound(self, fingerprint):