80
88
except ImportError:
81
89
SO_BINDTODEVICE = None
86
logger = logging.Logger(u'mandos')
92
stored_state_file = "clients.pickle"
94
logger = logging.getLogger()
87
95
syslogger = (logging.handlers.SysLogHandler
88
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
89
address = "/dev/log"))
90
syslogger.setFormatter(logging.Formatter
91
(u'Mandos [%(process)d]: %(levelname)s:'
93
logger.addHandler(syslogger)
95
console = logging.StreamHandler()
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
99
logger.addHandler(console)
101
multiprocessing_manager = multiprocessing.Manager()
97
address = str("/dev/log")))
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
103
except (OSError, AttributeError):
104
def if_nametoindex(interface):
105
"Get an interface index the hard way, i.e. using fcntl()"
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
with contextlib.closing(socket.socket()) as s:
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
113
return interface_index
116
def initlogger(debug, level=logging.WARNING):
117
"""init logger and add loglevel"""
119
syslogger.setFormatter(logging.Formatter
120
('Mandos [%(process)d]: %(levelname)s:'
122
logger.addHandler(syslogger)
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
130
logger.addHandler(console)
131
logger.setLevel(level)
134
class PGPError(Exception):
135
"""Exception if encryption/decryption fails"""
139
class PGPEngine(object):
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
self.gnupg = GnuPGInterface.GnuPG()
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
154
def __exit__(self, exc_type, exc_value, traceback):
162
if self.tempdir is not None:
163
# Delete contents of tempdir
164
for root, dirs, files in os.walk(self.tempdir,
166
for filename in files:
167
os.remove(os.path.join(root, filename))
169
os.rmdir(os.path.join(root, dirname))
171
os.rmdir(self.tempdir)
174
def password_encode(self, password):
175
# Passphrase can not be empty and can not contain newlines or
176
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
179
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
196
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
211
return decrypted_plaintext
103
214
class AvahiError(Exception):
104
215
def __init__(self, value, *args, **kwargs):
193
315
dbus.UInt16(self.port),
194
316
avahi.string_array_to_txt_array(self.TXT))
195
317
self.group.Commit()
196
319
def entry_group_state_changed(self, state, error):
197
320
"""Derived from the Avahi example code"""
198
logger.debug(u"Avahi state change: %i", state)
321
logger.debug("Avahi entry group state change: %i", state)
200
323
if state == avahi.ENTRY_GROUP_ESTABLISHED:
201
logger.debug(u"Zeroconf service established.")
324
logger.debug("Zeroconf service established.")
202
325
elif state == avahi.ENTRY_GROUP_COLLISION:
203
logger.warning(u"Zeroconf service name collision.")
326
logger.info("Zeroconf service name collision.")
205
328
elif state == avahi.ENTRY_GROUP_FAILURE:
206
logger.critical(u"Avahi: Error in group state changed %s",
329
logger.critical("Avahi: Error in group state changed %s",
208
raise AvahiGroupError(u"State changed: %s"
331
raise AvahiGroupError("State changed: {0!s}"
210
334
def cleanup(self):
211
335
"""Derived from the Avahi example code"""
212
336
if self.group is not None:
339
except (dbus.exceptions.UnknownMethodException,
340
dbus.exceptions.DBusException):
214
342
self.group = None
215
def server_state_changed(self, state):
345
def server_state_changed(self, state, error=None):
216
346
"""Derived from the Avahi example code"""
217
if state == avahi.SERVER_COLLISION:
218
logger.error(u"Zeroconf server name collision")
347
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
355
if state in bad_states:
356
if bad_states[state] is not None:
358
logger.error(bad_states[state])
360
logger.error(bad_states[state] + ": %r", error)
220
362
elif state == avahi.SERVER_RUNNING:
366
logger.debug("Unknown state: %r", state)
368
logger.debug("Unknown state: %r: %r", state, error)
222
370
def activate(self):
223
371
"""Derived from the Avahi example code"""
224
372
if self.server is None:
225
373
self.server = dbus.Interface(
226
374
self.bus.get_object(avahi.DBUS_NAME,
227
avahi.DBUS_PATH_SERVER),
375
avahi.DBUS_PATH_SERVER,
376
follow_name_owner_changes=True),
228
377
avahi.DBUS_INTERFACE_SERVER)
229
self.server.connect_to_signal(u"StateChanged",
378
self.server.connect_to_signal("StateChanged",
230
379
self.server_state_changed)
231
380
self.server_state_changed(self.server.GetState())
383
class AvahiServiceToSyslog(AvahiService):
385
"""Add the new name to the syslog messages"""
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
234
401
class Client(object):
235
402
"""A representation of a client host served by this server.
238
name: string; from the config file, used in log messages and
405
approved: bool(); 'None' if not yet approved/disapproved
406
approval_delay: datetime.timedelta(); Time to wait for approval
407
approval_duration: datetime.timedelta(); Duration of one approval
408
checker: subprocess.Popen(); a running checker process used
409
to see if the client lives.
410
'None' if no process is running.
411
checker_callback_tag: a gobject event source tag, or None
412
checker_command: string; External command which is run to check
413
if client lives. %() expansions are done at
414
runtime with vars(self) as dict, so that for
415
instance %(name)s can be used in the command.
416
checker_initiator_tag: a gobject event source tag, or None
417
created: datetime.datetime(); (UTC) object creation
418
client_structure: Object describing what attributes a client has
419
and is used for storing the client at exit
420
current_checker_command: string; current running checker_command
421
disable_initiator_tag: a gobject event source tag, or None
240
423
fingerprint: string (40 or 32 hexadecimal digits); used to
241
424
uniquely identify the client
242
secret: bytestring; sent verbatim (over TLS) to client
243
425
host: string; available for use by the checker command
244
created: datetime.datetime(); (UTC) object creation
245
last_enabled: datetime.datetime(); (UTC)
426
interval: datetime.timedelta(); How often to start a new checker
427
last_approval_request: datetime.datetime(); (UTC) or None
247
428
last_checked_ok: datetime.datetime(); (UTC) or None
429
last_checker_status: integer between 0 and 255 reflecting exit
430
status of last checker. -1 reflects crashed
431
checker, -2 means no checker completed yet.
432
last_enabled: datetime.datetime(); (UTC) or None
433
name: string; from the config file, used in log messages and
435
secret: bytestring; sent verbatim (over TLS) to client
248
436
timeout: datetime.timedelta(); How long from last_checked_ok
249
437
until this client is disabled
250
interval: datetime.timedelta(); How often to start a new checker
251
disable_hook: If set, called by disable() as disable_hook(self)
252
checker: subprocess.Popen(); a running checker process used
253
to see if the client lives.
254
'None' if no process is running.
255
checker_initiator_tag: a gobject event source tag, or None
256
disable_initiator_tag: - '' -
257
checker_callback_tag: - '' -
258
checker_command: string; External command which is run to check if
259
client lives. %() expansions are done at
260
runtime with vars(self) as dict, so that for
261
instance %(name)s can be used in the command.
262
current_checker_command: string; current running checker_command
263
approved_delay: datetime.timedelta(); Time to wait for approval
264
_approved: bool(); 'None' if not yet approved/disapproved
265
approved_duration: datetime.timedelta(); Duration of one approval
438
extended_timeout: extra long timeout when secret has been sent
439
runtime_expansions: Allowed attributes for runtime expansion.
440
expires: datetime.datetime(); time (UTC) when a client will be
269
def _timedelta_to_milliseconds(td):
270
"Convert a datetime.timedelta() to milliseconds"
271
return ((td.days * 24 * 60 * 60 * 1000)
272
+ (td.seconds * 1000)
273
+ (td.microseconds // 1000))
444
runtime_expansions = ("approval_delay", "approval_duration",
445
"created", "enabled", "expires",
446
"fingerprint", "host", "interval",
447
"last_approval_request", "last_checked_ok",
448
"last_enabled", "name", "timeout")
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
452
"checker": "fping -q -- %%(host)s",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
275
460
def timeout_milliseconds(self):
276
461
"Return the 'timeout' attribute in milliseconds"
277
return self._timedelta_to_milliseconds(self.timeout)
462
return timedelta_to_milliseconds(self.timeout)
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
279
468
def interval_milliseconds(self):
280
469
"Return the 'interval' attribute in milliseconds"
281
return self._timedelta_to_milliseconds(self.interval)
283
def approved_delay_milliseconds(self):
284
return self._timedelta_to_milliseconds(self.approved_delay)
286
def __init__(self, name = None, disable_hook=None, config=None):
287
"""Note: the 'checker' key in 'config' sets the
288
'checker_command' attribute and *not* the 'checker'
470
return timedelta_to_milliseconds(self.interval)
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
476
def config_parser(config):
477
"""Construct a new dict of client settings of this form:
478
{ client_name: {setting_name: value, ...}, ...}
479
with exceptions for any special settings as defined above.
480
NOTE: Must be a pure function. Must return the same result
481
value given the same arguments.
484
for client_name in config.sections():
485
section = dict(config.items(client_name))
486
client = settings[client_name] = {}
488
client["host"] = section["host"]
489
# Reformat values from string types to Python types
490
client["approved_by_default"] = config.getboolean(
491
client_name, "approved_by_default")
492
client["enabled"] = config.getboolean(client_name,
495
client["fingerprint"] = (section["fingerprint"].upper()
497
if "secret" in section:
498
client["secret"] = section["secret"].decode("base64")
499
elif "secfile" in section:
500
with open(os.path.expanduser(os.path.expandvars
501
(section["secfile"])),
503
client["secret"] = secfile.read()
505
raise TypeError("No secret or secfile for section {0}"
507
client["timeout"] = string_to_delta(section["timeout"])
508
client["extended_timeout"] = string_to_delta(
509
section["extended_timeout"])
510
client["interval"] = string_to_delta(section["interval"])
511
client["approval_delay"] = string_to_delta(
512
section["approval_delay"])
513
client["approval_duration"] = string_to_delta(
514
section["approval_duration"])
515
client["checker_command"] = section["checker"]
516
client["last_approval_request"] = None
517
client["last_checked_ok"] = None
518
client["last_checker_status"] = -2
522
def __init__(self, settings, name = None):
293
logger.debug(u"Creating client %r", self.name)
524
# adding all client settings
525
for setting, value in settings.iteritems():
526
setattr(self, setting, value)
529
if not hasattr(self, "last_enabled"):
530
self.last_enabled = datetime.datetime.utcnow()
531
if not hasattr(self, "expires"):
532
self.expires = (datetime.datetime.utcnow()
535
self.last_enabled = None
538
logger.debug("Creating client %r", self.name)
294
539
# Uppercase and remove spaces from fingerprint for later
295
540
# comparison purposes with return value from the fingerprint()
297
self.fingerprint = (config[u"fingerprint"].upper()
299
logger.debug(u" Fingerprint: %s", self.fingerprint)
300
if u"secret" in config:
301
self.secret = config[u"secret"].decode(u"base64")
302
elif u"secfile" in config:
303
with open(os.path.expanduser(os.path.expandvars
304
(config[u"secfile"])),
306
self.secret = secfile.read()
308
#XXX Need to allow secret on demand!
309
raise TypeError(u"No secret or secfile for client %s"
311
self.host = config.get(u"host", u"")
312
self.created = datetime.datetime.utcnow()
314
self.last_enabled = None
315
self.last_checked_ok = None
316
self.timeout = string_to_delta(config[u"timeout"])
317
self.interval = string_to_delta(config[u"interval"])
318
self.disable_hook = disable_hook
542
logger.debug(" Fingerprint: %s", self.fingerprint)
543
self.created = settings.get("created",
544
datetime.datetime.utcnow())
546
# attributes specific for this server instance
319
547
self.checker = None
320
548
self.checker_initiator_tag = None
321
549
self.disable_initiator_tag = None
322
550
self.checker_callback_tag = None
323
self.checker_command = config[u"checker"]
324
551
self.current_checker_command = None
325
self.last_connect = None
326
553
self.approvals_pending = 0
327
self._approved = None
328
self.approved_by_default = config.get(u"approved_by_default",
330
self.approved_delay = string_to_delta(
331
config[u"approved_delay"])
332
self.approved_duration = string_to_delta(
333
config[u"approved_duration"])
334
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
554
self.changedstate = (multiprocessing_manager
555
.Condition(multiprocessing_manager
557
self.client_structure = [attr for attr in
558
self.__dict__.iterkeys()
559
if not attr.startswith("_")]
560
self.client_structure.append("client_structure")
562
for name, t in inspect.getmembers(type(self),
566
if not name.startswith("_"):
567
self.client_structure.append(name)
569
# Send notice to process children that client state has changed
336
570
def send_changedstate(self):
337
self.changedstate.acquire()
338
self.changedstate.notify_all()
339
self.changedstate.release()
571
with self.changedstate:
572
self.changedstate.notify_all()
341
574
def enable(self):
342
575
"""Start this client's checker and timeout hooks"""
343
if getattr(self, u"enabled", False):
576
if getattr(self, "enabled", False):
344
577
# Already enabled
346
self.send_changedstate()
579
self.expires = datetime.datetime.utcnow() + self.timeout
347
581
self.last_enabled = datetime.datetime.utcnow()
583
self.send_changedstate()
585
def disable(self, quiet=True):
586
"""Disable this client."""
587
if not getattr(self, "enabled", False):
590
logger.info("Disabling client %s", self.name)
591
if getattr(self, "disable_initiator_tag", None) is not None:
592
gobject.source_remove(self.disable_initiator_tag)
593
self.disable_initiator_tag = None
595
if getattr(self, "checker_initiator_tag", None) is not None:
596
gobject.source_remove(self.checker_initiator_tag)
597
self.checker_initiator_tag = None
601
self.send_changedstate()
602
# Do not run this again if called by a gobject.timeout_add
608
def init_checker(self):
348
609
# Schedule a new checker to be started an 'interval' from now,
349
610
# and every interval from then on.
611
if self.checker_initiator_tag is not None:
612
gobject.source_remove(self.checker_initiator_tag)
350
613
self.checker_initiator_tag = (gobject.timeout_add
351
614
(self.interval_milliseconds(),
352
615
self.start_checker))
353
616
# Schedule a disable() when 'timeout' has passed
617
if self.disable_initiator_tag is not None:
618
gobject.source_remove(self.disable_initiator_tag)
354
619
self.disable_initiator_tag = (gobject.timeout_add
355
620
(self.timeout_milliseconds(),
358
622
# Also start a new checker *right now*.
359
623
self.start_checker()
361
def disable(self, quiet=True):
362
"""Disable this client."""
363
if not getattr(self, "enabled", False):
366
self.send_changedstate()
368
logger.info(u"Disabling client %s", self.name)
369
if getattr(self, u"disable_initiator_tag", False):
370
gobject.source_remove(self.disable_initiator_tag)
371
self.disable_initiator_tag = None
372
if getattr(self, u"checker_initiator_tag", False):
373
gobject.source_remove(self.checker_initiator_tag)
374
self.checker_initiator_tag = None
376
if self.disable_hook:
377
self.disable_hook(self)
379
# Do not run this again if called by a gobject.timeout_add
383
self.disable_hook = None
386
625
def checker_callback(self, pid, condition, command):
387
626
"""The checker has completed, so take appropriate actions."""
388
627
self.checker_callback_tag = None
389
628
self.checker = None
390
629
if os.WIFEXITED(condition):
391
exitstatus = os.WEXITSTATUS(condition)
393
logger.info(u"Checker for %(name)s succeeded",
630
self.last_checker_status = os.WEXITSTATUS(condition)
631
if self.last_checker_status == 0:
632
logger.info("Checker for %(name)s succeeded",
395
634
self.checked_ok()
397
logger.info(u"Checker for %(name)s failed",
636
logger.info("Checker for %(name)s failed",
400
logger.warning(u"Checker for %(name)s crashed?",
639
self.last_checker_status = -1
640
logger.warning("Checker for %(name)s crashed?",
403
643
def checked_ok(self):
404
"""Bump up the timeout for this client.
406
This should only be called when the client has been seen,
644
"""Assert that the client has been seen, alive and well."""
409
645
self.last_checked_ok = datetime.datetime.utcnow()
410
gobject.source_remove(self.disable_initiator_tag)
411
self.disable_initiator_tag = (gobject.timeout_add
412
(self.timeout_milliseconds(),
646
self.last_checker_status = 0
649
def bump_timeout(self, timeout=None):
650
"""Bump up the timeout for this client."""
652
timeout = self.timeout
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = None
656
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(timedelta_to_milliseconds
659
(timeout), self.disable))
660
self.expires = datetime.datetime.utcnow() + timeout
662
def need_approval(self):
663
self.last_approval_request = datetime.datetime.utcnow()
415
665
def start_checker(self):
416
666
"""Start a new checker subprocess if one is not running.
555
837
class DBusObjectWithProperties(dbus.service.Object):
556
838
"""A D-Bus object with properties.
558
840
Classes inheriting from this can use the dbus_service_property
559
841
decorator to expose methods as D-Bus properties. It exposes the
560
842
standard Get(), Set(), and GetAll() methods on the D-Bus.
564
def _is_dbus_property(obj):
565
return getattr(obj, u"_dbus_is_property", False)
846
def _is_dbus_thing(thing):
847
"""Returns a function testing if an attribute is a D-Bus thing
849
If called like _is_dbus_thing("method") it returns a function
850
suitable for use as predicate to inspect.getmembers().
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
567
def _get_all_dbus_properties(self):
855
def _get_all_dbus_things(self, thing):
568
856
"""Returns a generator of (name, attribute) pairs
570
return ((prop._dbus_name, prop)
572
inspect.getmembers(self, self._is_dbus_property))
858
return ((getattr(athing.__get__(self), "_dbus_name",
860
athing.__get__(self))
861
for cls in self.__class__.__mro__
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
574
866
def _get_dbus_property(self, interface_name, property_name):
575
867
"""Returns a bound method if one exists which is a D-Bus
576
868
property with the specified name and interface.
578
for name in (property_name,
579
property_name + u"_dbus_property"):
580
prop = getattr(self, name, None)
582
or not self._is_dbus_property(prop)
583
or prop._dbus_name != property_name
584
or (interface_name and prop._dbus_interface
585
and interface_name != prop._dbus_interface)):
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
873
self._is_dbus_thing("property"))):
874
if (value._dbus_name == property_name
875
and value._dbus_interface == interface_name):
876
return value.__get__(self)
588
878
# No such property
589
raise DBusPropertyNotFound(self.dbus_object_path + u":"
590
+ interface_name + u"."
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
593
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
595
885
def Get(self, interface_name, property_name):
596
886
"""Standard D-Bus property Get() method, see D-Bus standard.
598
888
prop = self._get_dbus_property(interface_name, property_name)
599
if prop._dbus_access == u"write":
889
if prop._dbus_access == "write":
600
890
raise DBusPropertyAccessException(property_name)
602
if not hasattr(value, u"variant_level"):
892
if not hasattr(value, "variant_level"):
604
894
return type(value)(value, variant_level=value.variant_level+1)
606
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
896
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
607
897
def Set(self, interface_name, property_name, value):
608
898
"""Standard D-Bus property Set() method, see D-Bus standard.
610
900
prop = self._get_dbus_property(interface_name, property_name)
611
if prop._dbus_access == u"read":
901
if prop._dbus_access == "read":
612
902
raise DBusPropertyAccessException(property_name)
613
if prop._dbus_get_args_options[u"byte_arrays"]:
903
if prop._dbus_get_args_options["byte_arrays"]:
614
904
# The byte_arrays option is not supported yet on
615
905
# signatures other than "ay".
616
if prop._dbus_signature != u"ay":
906
if prop._dbus_signature != "ay":
618
value = dbus.ByteArray(''.join(unichr(byte)
908
value = dbus.ByteArray(b''.join(chr(byte)
622
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
623
out_signature=u"a{sv}")
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
913
out_signature="a{sv}")
624
914
def GetAll(self, interface_name):
625
915
"""Standard D-Bus property GetAll() method, see D-Bus
628
918
Note: Will not include properties with access="write".
631
for name, prop in self._get_all_dbus_properties():
921
for name, prop in self._get_all_dbus_things("property"):
632
922
if (interface_name
633
923
and interface_name != prop._dbus_interface):
634
924
# Interface non-empty but did not match
636
926
# Ignore write-only properties
637
if prop._dbus_access == u"write":
927
if prop._dbus_access == "write":
640
if not hasattr(value, u"variant_level"):
930
if not hasattr(value, "variant_level"):
931
properties[name] = value
643
all[name] = type(value)(value, variant_level=
644
value.variant_level+1)
645
return dbus.Dictionary(all, signature=u"sv")
933
properties[name] = type(value)(value, variant_level=
934
value.variant_level+1)
935
return dbus.Dictionary(properties, signature="sv")
647
937
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
649
939
path_keyword='object_path',
650
940
connection_keyword='connection')
651
941
def Introspect(self, object_path, connection):
652
"""Standard D-Bus method, overloaded to insert property tags.
942
"""Overloading of standard D-Bus method.
944
Inserts property tags and interface annotation tags.
654
946
xmlstring = dbus.service.Object.Introspect(self, object_path,
657
949
document = xml.dom.minidom.parseString(xmlstring)
658
950
def make_tag(document, name, prop):
659
e = document.createElement(u"property")
660
e.setAttribute(u"name", name)
661
e.setAttribute(u"type", prop._dbus_signature)
662
e.setAttribute(u"access", prop._dbus_access)
951
e = document.createElement("property")
952
e.setAttribute("name", name)
953
e.setAttribute("type", prop._dbus_signature)
954
e.setAttribute("access", prop._dbus_access)
664
for if_tag in document.getElementsByTagName(u"interface"):
956
for if_tag in document.getElementsByTagName("interface"):
665
958
for tag in (make_tag(document, name, prop)
667
in self._get_all_dbus_properties()
960
in self._get_all_dbus_things("property")
668
961
if prop._dbus_interface
669
== if_tag.getAttribute(u"name")):
962
== if_tag.getAttribute("name")):
670
963
if_tag.appendChild(tag)
964
# Add annotation tags
965
for typ in ("method", "signal", "property"):
966
for tag in if_tag.getElementsByTagName(typ):
968
for name, prop in (self.
969
_get_all_dbus_things(typ)):
970
if (name == tag.getAttribute("name")
971
and prop._dbus_interface
972
== if_tag.getAttribute("name")):
973
annots.update(getattr
977
for name, value in annots.iteritems():
978
ann_tag = document.createElement(
980
ann_tag.setAttribute("name", name)
981
ann_tag.setAttribute("value", value)
982
tag.appendChild(ann_tag)
983
# Add interface annotation tags
984
for annotation, value in dict(
985
itertools.chain.from_iterable(
986
annotations().iteritems()
987
for name, annotations in
988
self._get_all_dbus_things("interface")
989
if name == if_tag.getAttribute("name")
991
ann_tag = document.createElement("annotation")
992
ann_tag.setAttribute("name", annotation)
993
ann_tag.setAttribute("value", value)
994
if_tag.appendChild(ann_tag)
671
995
# Add the names to the return values for the
672
996
# "org.freedesktop.DBus.Properties" methods
673
if (if_tag.getAttribute(u"name")
674
== u"org.freedesktop.DBus.Properties"):
675
for cn in if_tag.getElementsByTagName(u"method"):
676
if cn.getAttribute(u"name") == u"Get":
677
for arg in cn.getElementsByTagName(u"arg"):
678
if (arg.getAttribute(u"direction")
680
arg.setAttribute(u"name", u"value")
681
elif cn.getAttribute(u"name") == u"GetAll":
682
for arg in cn.getElementsByTagName(u"arg"):
683
if (arg.getAttribute(u"direction")
685
arg.setAttribute(u"name", u"props")
686
xmlstring = document.toxml(u"utf-8")
997
if (if_tag.getAttribute("name")
998
== "org.freedesktop.DBus.Properties"):
999
for cn in if_tag.getElementsByTagName("method"):
1000
if cn.getAttribute("name") == "Get":
1001
for arg in cn.getElementsByTagName("arg"):
1002
if (arg.getAttribute("direction")
1004
arg.setAttribute("name", "value")
1005
elif cn.getAttribute("name") == "GetAll":
1006
for arg in cn.getElementsByTagName("arg"):
1007
if (arg.getAttribute("direction")
1009
arg.setAttribute("name", "props")
1010
xmlstring = document.toxml("utf-8")
687
1011
document.unlink()
688
1012
except (AttributeError, xml.dom.DOMException,
689
xml.parsers.expat.ExpatError), error:
690
logger.error(u"Failed to override Introspection method",
1013
xml.parsers.expat.ExpatError) as error:
1014
logger.error("Failed to override Introspection method",
692
1016
return xmlstring
1019
def datetime_to_dbus(dt, variant_level=0):
1020
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1022
return dbus.String("", variant_level = variant_level)
1023
return dbus.String(dt.isoformat(),
1024
variant_level=variant_level)
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1028
"""A class decorator; applied to a subclass of
1029
dbus.service.Object, it will add alternate D-Bus attributes with
1030
interface names according to the "alt_interface_names" mapping.
1033
@alternate_dbus_interfaces({"org.example.Interface":
1034
"net.example.AlternateInterface"})
1035
class SampleDBusObject(dbus.service.Object):
1036
@dbus.service.method("org.example.Interface")
1037
def SampleDBusMethod():
1040
The above "SampleDBusMethod" on "SampleDBusObject" will be
1041
reachable via two interfaces: "org.example.Interface" and
1042
"net.example.AlternateInterface", the latter of which will have
1043
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1044
"true", unless "deprecate" is passed with a False value.
1046
This works for methods and signals, and also for D-Bus properties
1047
(from DBusObjectWithProperties) and interfaces (from the
1048
dbus_interface_annotations decorator).
1051
for orig_interface_name, alt_interface_name in (
1052
alt_interface_names.iteritems()):
1054
interface_names = set()
1055
# Go though all attributes of the class
1056
for attrname, attribute in inspect.getmembers(cls):
1057
# Ignore non-D-Bus attributes, and D-Bus attributes
1058
# with the wrong interface name
1059
if (not hasattr(attribute, "_dbus_interface")
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1063
# Create an alternate D-Bus interface name based on
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1068
interface_names.add(alt_interface)
1069
# Is this a D-Bus signal?
1070
if getattr(attribute, "_dbus_is_signal", False):
1071
# Extract the original non-method function by
1073
nonmethod_func = (dict(
1074
zip(attribute.func_code.co_freevars,
1075
attribute.__closure__))["func"]
1077
# Create a new, but exactly alike, function
1078
# object, and decorate it to be a new D-Bus signal
1079
# with the alternate D-Bus interface name
1080
new_function = (dbus.service.signal
1082
attribute._dbus_signature)
1083
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1089
# Copy annotations, if any
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1093
except AttributeError:
1095
# Define a creator of a function to call both the
1096
# original and alternate functions, so both the
1097
# original and alternate signals gets sent when
1098
# the function is called
1099
def fixscope(func1, func2):
1100
"""This function is a scope container to pass
1101
func1 and func2 to the "call_both" function
1102
outside of its arguments"""
1103
def call_both(*args, **kwargs):
1104
"""This function will emit two D-Bus
1105
signals by calling func1 and func2"""
1106
func1(*args, **kwargs)
1107
func2(*args, **kwargs)
1109
# Create the "call_both" function and add it to
1111
attr[attrname] = fixscope(attribute, new_function)
1112
# Is this a D-Bus method?
1113
elif getattr(attribute, "_dbus_is_method", False):
1114
# Create a new, but exactly alike, function
1115
# object. Decorate it to be a new D-Bus method
1116
# with the alternate D-Bus interface name. Add it
1118
attr[attrname] = (dbus.service.method
1120
attribute._dbus_in_signature,
1121
attribute._dbus_out_signature)
1123
(attribute.func_code,
1124
attribute.func_globals,
1125
attribute.func_name,
1126
attribute.func_defaults,
1127
attribute.func_closure)))
1128
# Copy annotations, if any
1130
attr[attrname]._dbus_annotations = (
1131
dict(attribute._dbus_annotations))
1132
except AttributeError:
1134
# Is this a D-Bus property?
1135
elif getattr(attribute, "_dbus_is_property", False):
1136
# Create a new, but exactly alike, function
1137
# object, and decorate it to be a new D-Bus
1138
# property with the alternate D-Bus interface
1139
# name. Add it to the class.
1140
attr[attrname] = (dbus_service_property
1142
attribute._dbus_signature,
1143
attribute._dbus_access,
1145
._dbus_get_args_options
1148
(attribute.func_code,
1149
attribute.func_globals,
1150
attribute.func_name,
1151
attribute.func_defaults,
1152
attribute.func_closure)))
1153
# Copy annotations, if any
1155
attr[attrname]._dbus_annotations = (
1156
dict(attribute._dbus_annotations))
1157
except AttributeError:
1159
# Is this a D-Bus interface?
1160
elif getattr(attribute, "_dbus_is_interface", False):
1161
# Create a new, but exactly alike, function
1162
# object. Decorate it to be a new D-Bus interface
1163
# with the alternate D-Bus interface name. Add it
1165
attr[attrname] = (dbus_interface_annotations
1168
(attribute.func_code,
1169
attribute.func_globals,
1170
attribute.func_name,
1171
attribute.func_defaults,
1172
attribute.func_closure)))
1174
# Deprecate all alternate interfaces
1175
iname="_AlternateDBusNames_interface_annotation{0}"
1176
for interface_name in interface_names:
1177
@dbus_interface_annotations(interface_name)
1179
return { "org.freedesktop.DBus.Deprecated":
1181
# Find an unused name
1182
for aname in (iname.format(i)
1183
for i in itertools.count()):
1184
if aname not in attr:
1188
# Replace the class with a new subclass of it with
1189
# methods, signals, etc. as created above.
1190
cls = type(b"{0}Alternate".format(cls.__name__),
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
"se.bsnet.fukt.Mandos"})
695
1198
class ClientDBus(Client, DBusObjectWithProperties):
696
1199
"""A Client class using D-Bus
706
1213
Client.__init__(self, *args, **kwargs)
707
1214
# Only now, when this client is initialized, can it show up on
1216
client_object_name = unicode(self.name).translate(
1217
{ord("."): ord("_"),
1218
ord("-"): ord("_")})
709
1219
self.dbus_object_path = (dbus.ObjectPath
711
+ self.name.replace(u".", u"_")))
1220
("/clients/" + client_object_name))
712
1221
DBusObjectWithProperties.__init__(self, self.bus,
713
1222
self.dbus_object_path)
716
def _datetime_to_dbus(dt, variant_level=0):
717
"""Convert a UTC datetime.datetime() to a D-Bus type."""
718
return dbus.String(dt.isoformat(),
719
variant_level=variant_level)
722
oldstate = getattr(self, u"enabled", False)
723
r = Client.enable(self)
724
if oldstate != self.enabled:
726
self.PropertyChanged(dbus.String(u"enabled"),
727
dbus.Boolean(True, variant_level=1))
728
self.PropertyChanged(
729
dbus.String(u"last_enabled"),
730
self._datetime_to_dbus(self.last_enabled,
734
def disable(self, quiet = False):
735
oldstate = getattr(self, u"enabled", False)
736
r = Client.disable(self, quiet=quiet)
737
if not quiet and oldstate != self.enabled:
739
self.PropertyChanged(dbus.String(u"enabled"),
740
dbus.Boolean(False, variant_level=1))
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1227
""" Modify a variable so that it's a property which announces
1228
its changes to DBus.
1230
transform_fun: Function that takes a value and a variant_level
1231
and transforms it to a D-Bus type.
1232
dbus_name: D-Bus name of the variable
1233
type_func: Function that transform the value before sending it
1234
to the D-Bus. Default: no transform
1235
variant_level: D-Bus variant level. Default: 1
1237
attrname = "_{0}".format(dbus_name)
1238
def setter(self, value):
1239
if hasattr(self, "dbus_object_path"):
1240
if (not hasattr(self, attrname) or
1241
type_func(getattr(self, attrname, None))
1242
!= type_func(value)):
1243
dbus_value = transform_func(type_func(value),
1246
self.PropertyChanged(dbus.String(dbus_name),
1248
setattr(self, attrname, value)
1250
return property(lambda self: getattr(self, attrname), setter)
1252
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1253
approvals_pending = notifychangeproperty(dbus.Boolean,
1256
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1257
last_enabled = notifychangeproperty(datetime_to_dbus,
1259
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1260
type_func = lambda checker:
1261
checker is not None)
1262
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1264
last_checker_status = notifychangeproperty(dbus.Int16,
1265
"LastCheckerStatus")
1266
last_approval_request = notifychangeproperty(
1267
datetime_to_dbus, "LastApprovalRequest")
1268
approved_by_default = notifychangeproperty(dbus.Boolean,
1269
"ApprovedByDefault")
1270
approval_delay = notifychangeproperty(dbus.UInt64,
1273
timedelta_to_milliseconds)
1274
approval_duration = notifychangeproperty(
1275
dbus.UInt64, "ApprovalDuration",
1276
type_func = timedelta_to_milliseconds)
1277
host = notifychangeproperty(dbus.String, "Host")
1278
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
timedelta_to_milliseconds)
1281
extended_timeout = notifychangeproperty(
1282
dbus.UInt64, "ExtendedTimeout",
1283
type_func = timedelta_to_milliseconds)
1284
interval = notifychangeproperty(dbus.UInt64,
1287
timedelta_to_milliseconds)
1288
checker_command = notifychangeproperty(dbus.String, "Checker")
1290
del notifychangeproperty
743
1292
def __del__(self, *args, **kwargs):
745
1294
self.remove_from_connection()
746
1295
except LookupError:
748
if hasattr(DBusObjectWithProperties, u"__del__"):
1297
if hasattr(DBusObjectWithProperties, "__del__"):
749
1298
DBusObjectWithProperties.__del__(self, *args, **kwargs)
750
1299
Client.__del__(self, *args, **kwargs)
899
# approved_pending - property
900
@dbus_service_property(_interface, signature=u"b", access=u"read")
901
def approved_pending_dbus_property(self):
902
return dbus.Boolean(self.approved_pending())
904
# approved_by_default - property
905
@dbus_service_property(_interface, signature=u"b",
907
def approved_by_default_dbus_property(self):
908
return dbus.Boolean(self.approved_by_default)
910
# approved_delay - property
911
@dbus_service_property(_interface, signature=u"t",
913
def approved_delay_dbus_property(self):
914
return dbus.UInt64(self.approved_delay_milliseconds())
916
# approved_duration - property
917
@dbus_service_property(_interface, signature=u"t",
919
def approved_duration_dbus_property(self):
920
return dbus.UInt64(self._timedelta_to_milliseconds(
921
self.approved_duration))
924
@dbus_service_property(_interface, signature=u"s", access=u"read")
925
def name_dbus_property(self):
1433
# ApprovalPending - property
1434
@dbus_service_property(_interface, signature="b", access="read")
1435
def ApprovalPending_dbus_property(self):
1436
return dbus.Boolean(bool(self.approvals_pending))
1438
# ApprovedByDefault - property
1439
@dbus_service_property(_interface, signature="b",
1441
def ApprovedByDefault_dbus_property(self, value=None):
1442
if value is None: # get
1443
return dbus.Boolean(self.approved_by_default)
1444
self.approved_by_default = bool(value)
1446
# ApprovalDelay - property
1447
@dbus_service_property(_interface, signature="t",
1449
def ApprovalDelay_dbus_property(self, value=None):
1450
if value is None: # get
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1452
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1454
# ApprovalDuration - property
1455
@dbus_service_property(_interface, signature="t",
1457
def ApprovalDuration_dbus_property(self, value=None):
1458
if value is None: # get
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1461
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1464
@dbus_service_property(_interface, signature="s", access="read")
1465
def Name_dbus_property(self):
926
1466
return dbus.String(self.name)
928
# fingerprint - property
929
@dbus_service_property(_interface, signature=u"s", access=u"read")
930
def fingerprint_dbus_property(self):
1468
# Fingerprint - property
1469
@dbus_service_property(_interface, signature="s", access="read")
1470
def Fingerprint_dbus_property(self):
931
1471
return dbus.String(self.fingerprint)
934
@dbus_service_property(_interface, signature=u"s",
936
def host_dbus_property(self, value=None):
1474
@dbus_service_property(_interface, signature="s",
1476
def Host_dbus_property(self, value=None):
937
1477
if value is None: # get
938
1478
return dbus.String(self.host)
941
self.PropertyChanged(dbus.String(u"host"),
942
dbus.String(value, variant_level=1))
945
@dbus_service_property(_interface, signature=u"s", access=u"read")
946
def created_dbus_property(self):
947
return dbus.String(self._datetime_to_dbus(self.created))
949
# last_enabled - property
950
@dbus_service_property(_interface, signature=u"s", access=u"read")
951
def last_enabled_dbus_property(self):
952
if self.last_enabled is None:
953
return dbus.String(u"")
954
return dbus.String(self._datetime_to_dbus(self.last_enabled))
957
@dbus_service_property(_interface, signature=u"b",
959
def enabled_dbus_property(self, value=None):
1479
self.host = unicode(value)
1481
# Created - property
1482
@dbus_service_property(_interface, signature="s", access="read")
1483
def Created_dbus_property(self):
1484
return datetime_to_dbus(self.created)
1486
# LastEnabled - property
1487
@dbus_service_property(_interface, signature="s", access="read")
1488
def LastEnabled_dbus_property(self):
1489
return datetime_to_dbus(self.last_enabled)
1491
# Enabled - property
1492
@dbus_service_property(_interface, signature="b",
1494
def Enabled_dbus_property(self, value=None):
960
1495
if value is None: # get
961
1496
return dbus.Boolean(self.enabled)
967
# last_checked_ok - property
968
@dbus_service_property(_interface, signature=u"s",
970
def last_checked_ok_dbus_property(self, value=None):
1502
# LastCheckedOK - property
1503
@dbus_service_property(_interface, signature="s",
1505
def LastCheckedOK_dbus_property(self, value=None):
971
1506
if value is not None:
972
1507
self.checked_ok()
974
if self.last_checked_ok is None:
975
return dbus.String(u"")
976
return dbus.String(self._datetime_to_dbus(self
980
@dbus_service_property(_interface, signature=u"t",
982
def timeout_dbus_property(self, value=None):
1509
return datetime_to_dbus(self.last_checked_ok)
1511
# LastCheckerStatus - property
1512
@dbus_service_property(_interface, signature="n",
1514
def LastCheckerStatus_dbus_property(self):
1515
return dbus.Int16(self.last_checker_status)
1517
# Expires - property
1518
@dbus_service_property(_interface, signature="s", access="read")
1519
def Expires_dbus_property(self):
1520
return datetime_to_dbus(self.expires)
1522
# LastApprovalRequest - property
1523
@dbus_service_property(_interface, signature="s", access="read")
1524
def LastApprovalRequest_dbus_property(self):
1525
return datetime_to_dbus(self.last_approval_request)
1527
# Timeout - property
1528
@dbus_service_property(_interface, signature="t",
1530
def Timeout_dbus_property(self, value=None):
983
1531
if value is None: # get
984
1532
return dbus.UInt64(self.timeout_milliseconds())
1533
old_timeout = self.timeout
985
1534
self.timeout = datetime.timedelta(0, 0, 0, value)
987
self.PropertyChanged(dbus.String(u"timeout"),
988
dbus.UInt64(value, variant_level=1))
989
if getattr(self, u"disable_initiator_tag", None) is None:
992
gobject.source_remove(self.disable_initiator_tag)
993
self.disable_initiator_tag = None
995
_timedelta_to_milliseconds((self
1000
if time_to_die <= 0:
1001
# The timeout has passed
1004
self.disable_initiator_tag = (gobject.timeout_add
1005
(time_to_die, self.disable))
1007
# interval - property
1008
@dbus_service_property(_interface, signature=u"t",
1009
access=u"readwrite")
1010
def interval_dbus_property(self, value=None):
1535
# Reschedule disabling
1537
now = datetime.datetime.utcnow()
1538
self.expires += self.timeout - old_timeout
1539
if self.expires <= now:
1540
# The timeout has passed
1543
if (getattr(self, "disable_initiator_tag", None)
1546
gobject.source_remove(self.disable_initiator_tag)
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1552
# ExtendedTimeout - property
1553
@dbus_service_property(_interface, signature="t",
1555
def ExtendedTimeout_dbus_property(self, value=None):
1556
if value is None: # get
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
1558
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1560
# Interval - property
1561
@dbus_service_property(_interface, signature="t",
1563
def Interval_dbus_property(self, value=None):
1011
1564
if value is None: # get
1012
1565
return dbus.UInt64(self.interval_milliseconds())
1013
1566
self.interval = datetime.timedelta(0, 0, 0, value)
1015
self.PropertyChanged(dbus.String(u"interval"),
1016
dbus.UInt64(value, variant_level=1))
1017
if getattr(self, u"checker_initiator_tag", None) is None:
1567
if getattr(self, "checker_initiator_tag", None) is None:
1019
# Reschedule checker run
1020
gobject.source_remove(self.checker_initiator_tag)
1021
self.checker_initiator_tag = (gobject.timeout_add
1022
(value, self.start_checker))
1023
self.start_checker() # Start one now, too
1025
# checker - property
1026
@dbus_service_property(_interface, signature=u"s",
1027
access=u"readwrite")
1028
def checker_dbus_property(self, value=None):
1570
# Reschedule checker run
1571
gobject.source_remove(self.checker_initiator_tag)
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
1576
# Checker - property
1577
@dbus_service_property(_interface, signature="s",
1579
def Checker_dbus_property(self, value=None):
1029
1580
if value is None: # get
1030
1581
return dbus.String(self.checker_command)
1031
self.checker_command = value
1033
self.PropertyChanged(dbus.String(u"checker"),
1034
dbus.String(self.checker_command,
1582
self.checker_command = unicode(value)
1037
# checker_running - property
1038
@dbus_service_property(_interface, signature=u"b",
1039
access=u"readwrite")
1040
def checker_running_dbus_property(self, value=None):
1584
# CheckerRunning - property
1585
@dbus_service_property(_interface, signature="b",
1587
def CheckerRunning_dbus_property(self, value=None):
1041
1588
if value is None: # get
1042
1589
return dbus.Boolean(self.checker is not None)
1094
1641
def handle(self):
1095
1642
with contextlib.closing(self.server.child_pipe) as child_pipe:
1096
logger.info(u"TCP connection from: %s",
1643
logger.info("TCP connection from: %s",
1097
1644
unicode(self.client_address))
1098
logger.debug(u"Pipe FD: %d",
1645
logger.debug("Pipe FD: %d",
1099
1646
self.server.child_pipe.fileno())
1101
1648
session = (gnutls.connection
1102
1649
.ClientSession(self.request,
1103
1650
gnutls.connection
1104
1651
.X509Credentials()))
1106
1653
# Note: gnutls.connection.X509Credentials is really a
1107
1654
# generic GnuTLS certificate credentials object so long as
1108
1655
# no X.509 keys are added to it. Therefore, we can use it
1109
1656
# here despite using OpenPGP certificates.
1111
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1112
# u"+AES-256-CBC", u"+SHA1",
1113
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1658
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1659
# "+AES-256-CBC", "+SHA1",
1660
# "+COMP-NULL", "+CTYPE-OPENPGP",
1115
1662
# Use a fallback default, since this MUST be set.
1116
1663
priority = self.server.gnutls_priority
1117
1664
if priority is None:
1118
priority = u"NORMAL"
1119
1666
(gnutls.library.functions
1120
1667
.gnutls_priority_set_direct(session._c_object,
1121
1668
priority, None))
1123
1670
# Start communication using the Mandos protocol
1124
1671
# Get protocol number
1125
1672
line = self.request.makefile().readline()
1126
logger.debug(u"Protocol version: %r", line)
1673
logger.debug("Protocol version: %r", line)
1128
1675
if int(line.strip().split()[0]) > 1:
1129
1676
raise RuntimeError
1130
except (ValueError, IndexError, RuntimeError), error:
1131
logger.error(u"Unknown protocol version: %s", error)
1677
except (ValueError, IndexError, RuntimeError) as error:
1678
logger.error("Unknown protocol version: %s", error)
1134
1681
# Start GnuTLS connection
1136
1683
session.handshake()
1137
except gnutls.errors.GNUTLSError, error:
1138
logger.warning(u"Handshake failed: %s", error)
1684
except gnutls.errors.GNUTLSError as error:
1685
logger.warning("Handshake failed: %s", error)
1139
1686
# Do not run session.bye() here: the session is not
1140
1687
# established. Just abandon the request.
1142
logger.debug(u"Handshake succeeded")
1689
logger.debug("Handshake succeeded")
1144
1691
approval_required = False
1147
1694
fpr = self.fingerprint(self.peer_certificate
1149
except (TypeError, gnutls.errors.GNUTLSError), error:
1150
logger.warning(u"Bad certificate: %s", error)
1697
gnutls.errors.GNUTLSError) as error:
1698
logger.warning("Bad certificate: %s", error)
1152
logger.debug(u"Fingerprint: %s", fpr)
1700
logger.debug("Fingerprint: %s", fpr)
1155
1703
client = ProxyClient(child_pipe, fpr,
1156
1704
self.client_address)
1157
1705
except KeyError:
1160
if client.approved_delay:
1161
delay = client.approved_delay
1708
if client.approval_delay:
1709
delay = client.approval_delay
1162
1710
client.approvals_pending += 1
1163
1711
approval_required = True
1166
1714
if not client.enabled:
1167
logger.warning(u"Client %s is disabled",
1715
logger.info("Client %s is disabled",
1169
1717
if self.server.use_dbus:
1170
1718
# Emit D-Bus signal
1171
client.Rejected("Disabled")
1719
client.Rejected("Disabled")
1174
if client._approved or not client.approved_delay:
1722
if client.approved or not client.approval_delay:
1175
1723
#We are approved or approval is disabled
1177
elif client._approved is None:
1178
logger.info(u"Client %s need approval",
1725
elif client.approved is None:
1726
logger.info("Client %s needs approval",
1180
1728
if self.server.use_dbus:
1181
1729
# Emit D-Bus signal
1182
1730
client.NeedApproval(
1183
client.approved_delay_milliseconds(),
1731
client.approval_delay_milliseconds(),
1184
1732
client.approved_by_default)
1186
logger.warning(u"Client %s was not approved",
1734
logger.warning("Client %s was not approved",
1188
1736
if self.server.use_dbus:
1189
1737
# Emit D-Bus signal
1190
client.Rejected("Disapproved")
1738
client.Rejected("Denied")
1193
1741
#wait until timeout or approved
1194
#x = float(client._timedelta_to_milliseconds(delay))
1195
1742
time = datetime.datetime.now()
1196
1743
client.changedstate.acquire()
1197
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1744
client.changedstate.wait(
1745
float(timedelta_to_milliseconds(delay)
1198
1747
client.changedstate.release()
1199
1748
time2 = datetime.datetime.now()
1200
1749
if (time2 - time) >= delay:
1587
2163
##################################################################
1588
2164
# Parsing of options, both command line and config file
1590
parser = optparse.OptionParser(version = "%%prog %s" % version)
1591
parser.add_option("-i", u"--interface", type=u"string",
1592
metavar="IF", help=u"Bind to interface IF")
1593
parser.add_option("-a", u"--address", type=u"string",
1594
help=u"Address to listen for requests on")
1595
parser.add_option("-p", u"--port", type=u"int",
1596
help=u"Port number to receive requests on")
1597
parser.add_option("--check", action=u"store_true",
1598
help=u"Run self-test")
1599
parser.add_option("--debug", action=u"store_true",
1600
help=u"Debug mode; run in foreground and log to"
1602
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1603
u" priority string (see GnuTLS documentation)")
1604
parser.add_option("--servicename", type=u"string",
1605
metavar=u"NAME", help=u"Zeroconf service name")
1606
parser.add_option("--configdir", type=u"string",
1607
default=u"/etc/mandos", metavar=u"DIR",
1608
help=u"Directory to search for configuration"
1610
parser.add_option("--no-dbus", action=u"store_false",
1611
dest=u"use_dbus", help=u"Do not provide D-Bus"
1612
u" system bus interface")
1613
parser.add_option("--no-ipv6", action=u"store_false",
1614
dest=u"use_ipv6", help=u"Do not use IPv6")
1615
options = parser.parse_args()[0]
2166
parser = argparse.ArgumentParser()
2167
parser.add_argument("-v", "--version", action="version",
2168
version = "%(prog)s {0}".format(version),
2169
help="show version number and exit")
2170
parser.add_argument("-i", "--interface", metavar="IF",
2171
help="Bind to interface IF")
2172
parser.add_argument("-a", "--address",
2173
help="Address to listen for requests on")
2174
parser.add_argument("-p", "--port", type=int,
2175
help="Port number to receive requests on")
2176
parser.add_argument("--check", action="store_true",
2177
help="Run self-test")
2178
parser.add_argument("--debug", action="store_true",
2179
help="Debug mode; run in foreground and log"
2181
parser.add_argument("--debuglevel", metavar="LEVEL",
2182
help="Debug level for stdout output")
2183
parser.add_argument("--priority", help="GnuTLS"
2184
" priority string (see GnuTLS documentation)")
2185
parser.add_argument("--servicename",
2186
metavar="NAME", help="Zeroconf service name")
2187
parser.add_argument("--configdir",
2188
default="/etc/mandos", metavar="DIR",
2189
help="Directory to search for configuration"
2191
parser.add_argument("--no-dbus", action="store_false",
2192
dest="use_dbus", help="Do not provide D-Bus"
2193
" system bus interface")
2194
parser.add_argument("--no-ipv6", action="store_false",
2195
dest="use_ipv6", help="Do not use IPv6")
2196
parser.add_argument("--no-restore", action="store_false",
2197
dest="restore", help="Do not restore stored"
2199
parser.add_argument("--socket", type=int,
2200
help="Specify a file descriptor to a network"
2201
" socket to use instead of creating one")
2202
parser.add_argument("--statedir", metavar="DIR",
2203
help="Directory to save/restore state in")
2205
options = parser.parse_args()
1617
2207
if options.check:
1665
2269
##################################################################
1667
2271
# For convenience
1668
debug = server_settings[u"debug"]
1669
use_dbus = server_settings[u"use_dbus"]
1670
use_ipv6 = server_settings[u"use_ipv6"]
1673
syslogger.setLevel(logging.WARNING)
1674
console.setLevel(logging.WARNING)
1676
if server_settings[u"servicename"] != u"Mandos":
2272
debug = server_settings["debug"]
2273
debuglevel = server_settings["debuglevel"]
2274
use_dbus = server_settings["use_dbus"]
2275
use_ipv6 = server_settings["use_ipv6"]
2276
stored_state_path = os.path.join(server_settings["statedir"],
2280
initlogger(debug, logging.DEBUG)
2285
level = getattr(logging, debuglevel.upper())
2286
initlogger(debug, level)
2288
if server_settings["servicename"] != "Mandos":
1677
2289
syslogger.setFormatter(logging.Formatter
1678
(u'Mandos (%s) [%%(process)d]:'
1679
u' %%(levelname)s: %%(message)s'
1680
% server_settings[u"servicename"]))
2290
('Mandos ({0}) [%(process)d]:'
2291
' %(levelname)s: %(message)s'
2292
.format(server_settings
1682
2295
# Parse config file with clients
1683
client_defaults = { u"timeout": u"1h",
1685
u"checker": u"fping -q -- %%(host)s",
1687
u"approved_delay": u"5m",
1688
u"approved_duration": u"1s",
1690
client_config = configparser.SafeConfigParser(client_defaults)
1691
client_config.read(os.path.join(server_settings[u"configdir"],
2296
client_config = configparser.SafeConfigParser(Client
2298
client_config.read(os.path.join(server_settings["configdir"],
1694
2301
global mandos_dbus_service
1695
2302
mandos_dbus_service = None
1697
tcp_server = MandosServer((server_settings[u"address"],
1698
server_settings[u"port"]),
2304
tcp_server = MandosServer((server_settings["address"],
2305
server_settings["port"]),
1700
interface=server_settings[u"interface"],
2307
interface=(server_settings["interface"]
1701
2309
use_ipv6=use_ipv6,
1702
2310
gnutls_priority=
1703
server_settings[u"priority"],
1705
pidfilename = u"/var/run/mandos.pid"
1707
pidfile = open(pidfilename, u"w")
1709
logger.error(u"Could not open file %r", pidfilename)
2311
server_settings["priority"],
2313
socketfd=(server_settings["socket"]
2316
pidfilename = "/var/run/mandos.pid"
2318
pidfile = open(pidfilename, "w")
2319
except IOError as e:
2320
logger.error("Could not open file %r", pidfilename,
1712
uid = pwd.getpwnam(u"_mandos").pw_uid
1713
gid = pwd.getpwnam(u"_mandos").pw_gid
2323
for name in ("_mandos", "mandos", "nobody"):
1716
uid = pwd.getpwnam(u"mandos").pw_uid
1717
gid = pwd.getpwnam(u"mandos").pw_gid
2325
uid = pwd.getpwnam(name).pw_uid
2326
gid = pwd.getpwnam(name).pw_gid
1718
2328
except KeyError:
1720
uid = pwd.getpwnam(u"nobody").pw_uid
1721
gid = pwd.getpwnam(u"nobody").pw_gid
1728
except OSError, error:
1729
if error[0] != errno.EPERM:
2336
except OSError as error:
2337
if error.errno != errno.EPERM:
1732
# Enable all possible GnuTLS debugging
2341
# Enable all possible GnuTLS debugging
1734
2343
# "Use a log level over 10 to enable all debugging options."
1735
2344
# - GnuTLS manual
1736
2345
gnutls.library.functions.gnutls_global_set_log_level(11)
1738
2347
@gnutls.library.types.gnutls_log_func
1739
2348
def debug_gnutls(level, string):
1740
logger.debug(u"GnuTLS: %s", string[:-1])
2349
logger.debug("GnuTLS: %s", string[:-1])
1742
2351
(gnutls.library.functions
1743
2352
.gnutls_global_set_log_function(debug_gnutls))
2354
# Redirect stdin so all checkers get /dev/null
2355
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2356
os.dup2(null, sys.stdin.fileno())
2360
# Need to fork before connecting to D-Bus
2362
# Close all input and output, do double fork, etc.
2365
# multiprocessing will use threads, so before we use gobject we
2366
# need to inform gobject that threads will be used.
2367
gobject.threads_init()
1745
2369
global main_loop
1746
2370
# From the Avahi example code
1747
DBusGMainLoop(set_as_default=True )
2371
DBusGMainLoop(set_as_default=True)
1748
2372
main_loop = gobject.MainLoop()
1749
2373
bus = dbus.SystemBus()
1750
2374
# End of Avahi example code
1753
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2377
bus_name = dbus.service.BusName("se.recompile.Mandos",
1754
2378
bus, do_not_queue=True)
1755
except dbus.exceptions.NameExistsException, e:
1756
logger.error(unicode(e) + u", disabling D-Bus")
2379
old_bus_name = (dbus.service.BusName
2380
("se.bsnet.fukt.Mandos", bus,
2382
except dbus.exceptions.NameExistsException as e:
2383
logger.error("Disabling D-Bus:", exc_info=e)
1757
2384
use_dbus = False
1758
server_settings[u"use_dbus"] = False
2385
server_settings["use_dbus"] = False
1759
2386
tcp_server.use_dbus = False
1760
2387
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1761
service = AvahiService(name = server_settings[u"servicename"],
1762
servicetype = u"_mandos._tcp",
1763
protocol = protocol, bus = bus)
2388
service = AvahiServiceToSyslog(name =
2389
server_settings["servicename"],
2390
servicetype = "_mandos._tcp",
2391
protocol = protocol, bus = bus)
1764
2392
if server_settings["interface"]:
1765
2393
service.interface = (if_nametoindex
1766
(str(server_settings[u"interface"])))
2394
(str(server_settings["interface"])))
2396
global multiprocessing_manager
2397
multiprocessing_manager = multiprocessing.Manager()
1768
2399
client_class = Client
1770
2401
client_class = functools.partial(ClientDBus, bus = bus)
1771
def client_config_items(config, section):
1772
special_settings = {
1773
"approved_by_default":
1774
lambda: config.getboolean(section,
1775
"approved_by_default"),
1777
for name, value in config.items(section):
2403
client_settings = Client.config_parser(client_config)
2404
old_client_settings = {}
2407
# Get client data and settings from last running state.
2408
if server_settings["restore"]:
2410
with open(stored_state_path, "rb") as stored_state:
2411
clients_data, old_client_settings = (pickle.load
2413
os.remove(stored_state_path)
2414
except IOError as e:
2415
if e.errno == errno.ENOENT:
2416
logger.warning("Could not load persistent state: {0}"
2417
.format(os.strerror(e.errno)))
2419
logger.critical("Could not load persistent state:",
2422
except EOFError as e:
2423
logger.warning("Could not load persistent state: "
2424
"EOFError:", exc_info=e)
2426
with PGPEngine() as pgp:
2427
for client_name, client in clients_data.iteritems():
2428
# Decide which value to use after restoring saved state.
2429
# We have three different values: Old config file,
2430
# new config file, and saved state.
2431
# New config value takes precedence if it differs from old
2432
# config value, otherwise use saved state.
2433
for name, value in client_settings[client_name].items():
2435
# For each value in new config, check if it
2436
# differs from the old config value (Except for
2437
# the "secret" attribute)
2438
if (name != "secret" and
2439
value != old_client_settings[client_name]
2441
client[name] = value
2445
# Clients who has passed its expire date can still be
2446
# enabled if its last checker was successful. Clients
2447
# whose checker succeeded before we stored its state is
2448
# assumed to have successfully run all checkers during
2450
if client["enabled"]:
2451
if datetime.datetime.utcnow() >= client["expires"]:
2452
if not client["last_checked_ok"]:
2454
"disabling client {0} - Client never "
2455
"performed a successful checker"
2456
.format(client_name))
2457
client["enabled"] = False
2458
elif client["last_checker_status"] != 0:
2460
"disabling client {0} - Client "
2461
"last checker failed with error code {1}"
2462
.format(client_name,
2463
client["last_checker_status"]))
2464
client["enabled"] = False
2466
client["expires"] = (datetime.datetime
2468
+ client["timeout"])
2469
logger.debug("Last checker succeeded,"
2470
" keeping {0} enabled"
2471
.format(client_name))
1779
yield (name, special_settings[name]())
1783
tcp_server.clients.update(set(
1784
client_class(name = section,
1785
config= dict(client_config_items(
1786
client_config, section)))
1787
for section in client_config.sections()))
2473
client["secret"] = (
2474
pgp.decrypt(client["encrypted_secret"],
2475
client_settings[client_name]
2478
# If decryption fails, we use secret from new settings
2479
logger.debug("Failed to decrypt {0} old secret"
2480
.format(client_name))
2481
client["secret"] = (
2482
client_settings[client_name]["secret"])
2484
# Add/remove clients based on new changes made to config
2485
for client_name in (set(old_client_settings)
2486
- set(client_settings)):
2487
del clients_data[client_name]
2488
for client_name in (set(client_settings)
2489
- set(old_client_settings)):
2490
clients_data[client_name] = client_settings[client_name]
2492
# Create all client objects
2493
for client_name, client in clients_data.iteritems():
2494
tcp_server.clients[client_name] = client_class(
2495
name = client_name, settings = client)
1788
2497
if not tcp_server.clients:
1789
logger.warning(u"No clients defined")
1792
# Redirect stdin so all checkers get /dev/null
1793
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1794
os.dup2(null, sys.stdin.fileno())
1798
# No console logging
1799
logger.removeHandler(console)
1800
# Close all input and output, do double fork, etc.
1806
pidfile.write(str(pid) + "\n")
1809
logger.error(u"Could not write to file %r with PID %d",
1812
# "pidfile" was never created
2498
logger.warning("No clients defined")
1817
signal.signal(signal.SIGINT, signal.SIG_IGN)
2504
pidfile.write(str(pid) + "\n".encode("utf-8"))
2507
logger.error("Could not write to file %r with PID %d",
2510
# "pidfile" was never created
1818
2514
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1819
2515
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1822
class MandosDBusService(dbus.service.Object):
2518
@alternate_dbus_interfaces({"se.recompile.Mandos":
2519
"se.bsnet.fukt.Mandos"})
2520
class MandosDBusService(DBusObjectWithProperties):
1823
2521
"""A D-Bus proxy object"""
1824
2522
def __init__(self):
1825
dbus.service.Object.__init__(self, bus, u"/")
1826
_interface = u"se.bsnet.fukt.Mandos"
1828
@dbus.service.signal(_interface, signature=u"o")
2523
dbus.service.Object.__init__(self, bus, "/")
2524
_interface = "se.recompile.Mandos"
2526
@dbus_interface_annotations(_interface)
2528
return { "org.freedesktop.DBus.Property"
2529
".EmitsChangedSignal":
2532
@dbus.service.signal(_interface, signature="o")
1829
2533
def ClientAdded(self, objpath):
1833
@dbus.service.signal(_interface, signature=u"ss")
2537
@dbus.service.signal(_interface, signature="ss")
1834
2538
def ClientNotFound(self, fingerprint, address):
1838
@dbus.service.signal(_interface, signature=u"os")
2542
@dbus.service.signal(_interface, signature="os")
1839
2543
def ClientRemoved(self, objpath, name):
1843
@dbus.service.method(_interface, out_signature=u"ao")
2547
@dbus.service.method(_interface, out_signature="ao")
1844
2548
def GetAllClients(self):
1846
2550
return dbus.Array(c.dbus_object_path
1847
for c in tcp_server.clients)
2552
tcp_server.clients.itervalues())
1849
2554
@dbus.service.method(_interface,
1850
out_signature=u"a{oa{sv}}")
2555
out_signature="a{oa{sv}}")
1851
2556
def GetAllClientsWithProperties(self):
1853
2558
return dbus.Dictionary(
1854
((c.dbus_object_path, c.GetAll(u""))
1855
for c in tcp_server.clients),
1856
signature=u"oa{sv}")
2559
((c.dbus_object_path, c.GetAll(""))
2560
for c in tcp_server.clients.itervalues()),
1858
@dbus.service.method(_interface, in_signature=u"o")
2563
@dbus.service.method(_interface, in_signature="o")
1859
2564
def RemoveClient(self, object_path):
1861
for c in tcp_server.clients:
2566
for c in tcp_server.clients.itervalues():
1862
2567
if c.dbus_object_path == object_path:
1863
tcp_server.clients.remove(c)
2568
del tcp_server.clients[c.name]
1864
2569
c.remove_from_connection()
1865
2570
# Don't signal anything except ClientRemoved
1866
2571
c.disable(quiet=True)