2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2017 Teddy Hogeborn
15
# Copyright © 2008-2017 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
39
from future_builtins import *
37
from future_builtins import *
44
import SocketServer as socketserver
39
import SocketServer as socketserver
52
import ConfigParser as configparser
45
import gnutls.connection
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
70
import cPickle as pickle
65
import cPickle as pickle
73
66
import multiprocessing
82
73
import dbus.service
83
from gi.repository import GLib
84
76
from dbus.mainloop.glib import DBusGMainLoop
87
79
import xml.dom.minidom
90
# Try to find the value of SO_BINDTODEVICE:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
94
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
85
except AttributeError:
97
# This is where SO_BINDTODEVICE was up to and including Python
99
87
from IN import SO_BINDTODEVICE
100
88
except ImportError:
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
113
SO_BINDTODEVICE = None
115
if sys.version_info.major == 2:
89
SO_BINDTODEVICE = None
119
92
stored_state_file = "clients.pickle"
121
94
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
125
if_nametoindex = ctypes.cdll.LoadLibrary(
126
ctypes.util.find_library("c")).if_nametoindex
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
127
103
except (OSError, AttributeError):
129
104
def if_nametoindex(interface):
130
105
"Get an interface index the hard way, i.e. using fcntl()"
131
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
132
107
with contextlib.closing(socket.socket()) as s:
133
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
134
struct.pack(b"16s16x", interface))
135
interface_index = struct.unpack("I", ifreq[16:20])[0]
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
136
113
return interface_index
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
148
return types.FunctionType(func.__code__,
155
116
def initlogger(debug, level=logging.WARNING):
156
117
"""init logger and add loglevel"""
159
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
162
119
syslogger.setFormatter(logging.Formatter
163
120
('Mandos [%(process)d]: %(levelname)s:'
165
122
logger.addHandler(syslogger)
168
125
console = logging.StreamHandler()
169
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
226
171
os.rmdir(self.tempdir)
227
172
self.tempdir = None
229
174
def password_encode(self, password):
230
175
# Passphrase can not be empty and can not contain newlines or
231
176
# NUL bytes. So we prefix it and hex encode it.
232
encoded = b"mandos" + binascii.hexlify(password)
233
if len(encoded) > 2048:
234
# GnuPG can't handle long passwords, so encode differently
235
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
236
.replace(b"\n", b"\\n")
237
.replace(b"\0", b"\\x00"))
177
return b"mandos" + binascii.hexlify(password)
240
179
def encrypt(self, data, password):
241
passphrase = self.password_encode(password)
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
244
passfile.write(passphrase)
246
proc = subprocess.Popen([self.gpg, '--symmetric',
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
254
if proc.returncode != 0:
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
256
194
return ciphertext
258
196
def decrypt(self, data, password):
259
passphrase = self.password_encode(password)
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
262
passfile.write(passphrase)
264
proc = subprocess.Popen([self.gpg, '--decrypt',
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
272
if proc.returncode != 0:
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
274
211
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
285
DBUS_NAME = "org.freedesktop.Avahi"
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(self, t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
304
214
class AvahiError(Exception):
305
215
def __init__(self, value, *args, **kwargs):
306
216
self.value = value
307
return super(AvahiError, self).__init__(value, *args,
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
311
221
class AvahiServiceError(AvahiError):
315
224
class AvahiGroupError(AvahiError):
319
228
class AvahiService(object):
320
229
"""An Avahi (Zeroconf) service.
323
232
interface: integer; avahi.IF_UNSPEC or an interface index.
324
233
Used to optionally bind to the specified interface.
325
234
name: string; Example: 'Mandos'
326
235
type: string; Example: '_mandos._tcp'.
327
See <https://www.iana.org/assignments/service-names-port-numbers>
236
See <http://www.dns-sd.org/ServiceTypes.html>
328
237
port: integer; what port to announce
329
238
TXT: list of strings; TXT record for the service
330
239
domain: string; Domain to publish on, default to .local if empty.
489
376
follow_name_owner_changes=True),
490
377
avahi.DBUS_INTERFACE_SERVER)
491
378
self.server.connect_to_signal("StateChanged",
492
self.server_state_changed)
379
self.server_state_changed)
493
380
self.server_state_changed(self.server.GetState())
496
383
class AvahiServiceToSyslog(AvahiService):
497
def rename(self, *args, **kwargs):
498
385
"""Add the new name to the syslog messages"""
499
ret = super(AvahiServiceToSyslog, self).rename(self, *args,
501
syslogger.setFormatter(logging.Formatter(
502
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
507
# Pretend that we have a GnuTLS module
508
class GnuTLS(object):
509
"""This isn't so much a class as it is a module-like namespace.
510
It is instantiated once, and simulates having a GnuTLS module."""
512
library = ctypes.util.find_library("gnutls")
514
library = ctypes.util.find_library("gnutls-deb0")
515
_library = ctypes.cdll.LoadLibrary(library)
517
_need_version = b"3.3.0"
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
526
# Unless otherwise indicated, the constants and types below are
527
# all from the gnutls/gnutls.h C header file.
537
E_NO_CERTIFICATE_FOUND = -49
538
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
541
class session_int(ctypes.Structure):
543
session_t = ctypes.POINTER(session_int)
545
class certificate_credentials_st(ctypes.Structure):
547
certificate_credentials_t = ctypes.POINTER(
548
certificate_credentials_st)
549
certificate_type_t = ctypes.c_int
551
class datum_t(ctypes.Structure):
552
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
553
('size', ctypes.c_uint)]
555
class openpgp_crt_int(ctypes.Structure):
557
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
558
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
559
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
560
credentials_type_t = ctypes.c_int
561
transport_ptr_t = ctypes.c_void_p
562
close_request_t = ctypes.c_int
565
class Error(Exception):
566
# We need to use the class name "GnuTLS" here, since this
567
# exception might be raised from within GnuTLS.__init__,
568
# which is called before the assignment to the "gnutls"
569
# global variable has happened.
570
def __init__(self, message=None, code=None, args=()):
571
# Default usage is by a message string, but if a return
572
# code is passed, convert it to a string with
575
if message is None and code is not None:
576
message = GnuTLS.strerror(code)
577
return super(GnuTLS.Error, self).__init__(
580
class CertificateSecurityError(Error):
584
class Credentials(object):
586
self._c_object = gnutls.certificate_credentials_t()
587
gnutls.certificate_allocate_credentials(
588
ctypes.byref(self._c_object))
589
self.type = gnutls.CRD_CERTIFICATE
592
gnutls.certificate_free_credentials(self._c_object)
594
class ClientSession(object):
595
def __init__(self, socket, credentials=None):
596
self._c_object = gnutls.session_t()
597
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
598
gnutls.set_default_priority(self._c_object)
599
gnutls.transport_set_ptr(self._c_object, socket.fileno())
600
gnutls.handshake_set_private_extensions(self._c_object,
603
if credentials is None:
604
credentials = gnutls.Credentials()
605
gnutls.credentials_set(self._c_object, credentials.type,
606
ctypes.cast(credentials._c_object,
608
self.credentials = credentials
611
gnutls.deinit(self._c_object)
614
return gnutls.handshake(self._c_object)
616
def send(self, data):
620
data_len -= gnutls.record_send(self._c_object,
625
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
627
# Error handling functions
628
def _error_code(result):
629
"""A function to raise exceptions on errors, suitable
630
for the 'restype' attribute on ctypes functions"""
633
if result == gnutls.E_NO_CERTIFICATE_FOUND:
634
raise gnutls.CertificateSecurityError(code=result)
635
raise gnutls.Error(code=result)
637
def _retry_on_error(result, func, arguments):
638
"""A function to retry on some errors, suitable
639
for the 'errcheck' attribute on ctypes functions"""
641
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
642
return _error_code(result)
643
result = func(*arguments)
646
# Unless otherwise indicated, the function declarations below are
647
# all from the gnutls/gnutls.h C header file.
650
priority_set_direct = _library.gnutls_priority_set_direct
651
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
652
ctypes.POINTER(ctypes.c_char_p)]
653
priority_set_direct.restype = _error_code
655
init = _library.gnutls_init
656
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
657
init.restype = _error_code
659
set_default_priority = _library.gnutls_set_default_priority
660
set_default_priority.argtypes = [session_t]
661
set_default_priority.restype = _error_code
663
record_send = _library.gnutls_record_send
664
record_send.argtypes = [session_t, ctypes.c_void_p,
666
record_send.restype = ctypes.c_ssize_t
667
record_send.errcheck = _retry_on_error
669
certificate_allocate_credentials = (
670
_library.gnutls_certificate_allocate_credentials)
671
certificate_allocate_credentials.argtypes = [
672
ctypes.POINTER(certificate_credentials_t)]
673
certificate_allocate_credentials.restype = _error_code
675
certificate_free_credentials = (
676
_library.gnutls_certificate_free_credentials)
677
certificate_free_credentials.argtypes = [
678
certificate_credentials_t]
679
certificate_free_credentials.restype = None
681
handshake_set_private_extensions = (
682
_library.gnutls_handshake_set_private_extensions)
683
handshake_set_private_extensions.argtypes = [session_t,
685
handshake_set_private_extensions.restype = None
687
credentials_set = _library.gnutls_credentials_set
688
credentials_set.argtypes = [session_t, credentials_type_t,
690
credentials_set.restype = _error_code
692
strerror = _library.gnutls_strerror
693
strerror.argtypes = [ctypes.c_int]
694
strerror.restype = ctypes.c_char_p
696
certificate_type_get = _library.gnutls_certificate_type_get
697
certificate_type_get.argtypes = [session_t]
698
certificate_type_get.restype = _error_code
700
certificate_get_peers = _library.gnutls_certificate_get_peers
701
certificate_get_peers.argtypes = [session_t,
702
ctypes.POINTER(ctypes.c_uint)]
703
certificate_get_peers.restype = ctypes.POINTER(datum_t)
705
global_set_log_level = _library.gnutls_global_set_log_level
706
global_set_log_level.argtypes = [ctypes.c_int]
707
global_set_log_level.restype = None
709
global_set_log_function = _library.gnutls_global_set_log_function
710
global_set_log_function.argtypes = [log_func]
711
global_set_log_function.restype = None
713
deinit = _library.gnutls_deinit
714
deinit.argtypes = [session_t]
715
deinit.restype = None
717
handshake = _library.gnutls_handshake
718
handshake.argtypes = [session_t]
719
handshake.restype = _error_code
720
handshake.errcheck = _retry_on_error
722
transport_set_ptr = _library.gnutls_transport_set_ptr
723
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
724
transport_set_ptr.restype = None
726
bye = _library.gnutls_bye
727
bye.argtypes = [session_t, close_request_t]
728
bye.restype = _error_code
729
bye.errcheck = _retry_on_error
731
check_version = _library.gnutls_check_version
732
check_version.argtypes = [ctypes.c_char_p]
733
check_version.restype = ctypes.c_char_p
735
# All the function declarations below are from gnutls/openpgp.h
737
openpgp_crt_init = _library.gnutls_openpgp_crt_init
738
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
739
openpgp_crt_init.restype = _error_code
741
openpgp_crt_import = _library.gnutls_openpgp_crt_import
742
openpgp_crt_import.argtypes = [openpgp_crt_t,
743
ctypes.POINTER(datum_t),
745
openpgp_crt_import.restype = _error_code
747
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
748
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
749
ctypes.POINTER(ctypes.c_uint)]
750
openpgp_crt_verify_self.restype = _error_code
752
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
753
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
754
openpgp_crt_deinit.restype = None
756
openpgp_crt_get_fingerprint = (
757
_library.gnutls_openpgp_crt_get_fingerprint)
758
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
762
openpgp_crt_get_fingerprint.restype = _error_code
764
# Remove non-public functions
765
del _error_code, _retry_on_error
766
# Create the global "gnutls" object, simulating a module
770
def call_pipe(connection, # : multiprocessing.Connection
771
func, *args, **kwargs):
772
"""This function is meant to be called by multiprocessing.Process
774
This function runs func(*args, **kwargs), and writes the resulting
775
return value on the provided multiprocessing.Connection.
777
connection.send(func(*args, **kwargs))
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
781
401
class Client(object):
782
402
"""A representation of a client host served by this server.
785
405
approved: bool(); 'None' if not yet approved/disapproved
786
406
approval_delay: datetime.timedelta(); Time to wait for approval
821
439
runtime_expansions: Allowed attributes for runtime expansion.
822
440
expires: datetime.datetime(); time (UTC) when a client will be
823
441
disabled, or None
824
server_settings: The server_settings dict from main()
827
444
runtime_expansions = ("approval_delay", "approval_duration",
828
445
"created", "enabled", "expires",
829
446
"fingerprint", "host", "interval",
830
447
"last_approval_request", "last_checked_ok",
831
448
"last_enabled", "name", "timeout")
834
"extended_timeout": "PT15M",
836
"checker": "fping -q -- %%(host)s",
838
"approval_delay": "PT0S",
839
"approval_duration": "PT1S",
840
"approved_by_default": "True",
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
452
"checker": "fping -q -- %%(host)s",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
460
def timeout_milliseconds(self):
461
"Return the 'timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.timeout)
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
468
def interval_milliseconds(self):
469
"Return the 'interval' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.interval)
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
845
476
def config_parser(config):
846
477
"""Construct a new dict of client settings of this form:
961
590
logger.info("Disabling client %s", self.name)
962
591
if getattr(self, "disable_initiator_tag", None) is not None:
963
GLib.source_remove(self.disable_initiator_tag)
592
gobject.source_remove(self.disable_initiator_tag)
964
593
self.disable_initiator_tag = None
965
594
self.expires = None
966
595
if getattr(self, "checker_initiator_tag", None) is not None:
967
GLib.source_remove(self.checker_initiator_tag)
596
gobject.source_remove(self.checker_initiator_tag)
968
597
self.checker_initiator_tag = None
969
598
self.stop_checker()
970
599
self.enabled = False
972
601
self.send_changedstate()
973
# Do not run this again if called by a GLib.timeout_add
602
# Do not run this again if called by a gobject.timeout_add
976
605
def __del__(self):
979
608
def init_checker(self):
980
609
# Schedule a new checker to be started an 'interval' from now,
981
610
# and every interval from then on.
982
611
if self.checker_initiator_tag is not None:
983
GLib.source_remove(self.checker_initiator_tag)
984
self.checker_initiator_tag = GLib.timeout_add(
985
int(self.interval.total_seconds() * 1000),
612
gobject.source_remove(self.checker_initiator_tag)
613
self.checker_initiator_tag = (gobject.timeout_add
614
(self.interval_milliseconds(),
987
616
# Schedule a disable() when 'timeout' has passed
988
617
if self.disable_initiator_tag is not None:
989
GLib.source_remove(self.disable_initiator_tag)
990
self.disable_initiator_tag = GLib.timeout_add(
991
int(self.timeout.total_seconds() * 1000), self.disable)
618
gobject.source_remove(self.disable_initiator_tag)
619
self.disable_initiator_tag = (gobject.timeout_add
620
(self.timeout_milliseconds(),
992
622
# Also start a new checker *right now*.
993
623
self.start_checker()
995
def checker_callback(self, source, condition, connection,
625
def checker_callback(self, pid, condition, command):
997
626
"""The checker has completed, so take appropriate actions."""
998
627
self.checker_callback_tag = None
999
628
self.checker = None
1000
# Read return code from connection (see call_pipe)
1001
returncode = connection.recv()
1005
self.last_checker_status = returncode
1006
self.last_checker_signal = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
1007
631
if self.last_checker_status == 0:
1008
632
logger.info("Checker for %(name)s succeeded",
1010
634
self.checked_ok()
1012
logger.info("Checker for %(name)s failed", vars(self))
636
logger.info("Checker for %(name)s failed",
1014
639
self.last_checker_status = -1
1015
self.last_checker_signal = -returncode
1016
640
logger.warning("Checker for %(name)s crashed?",
1020
643
def checked_ok(self):
1021
644
"""Assert that the client has been seen, alive and well."""
1022
645
self.last_checked_ok = datetime.datetime.utcnow()
1023
646
self.last_checker_status = 0
1024
self.last_checker_signal = None
1025
647
self.bump_timeout()
1027
649
def bump_timeout(self, timeout=None):
1028
650
"""Bump up the timeout for this client."""
1029
651
if timeout is None:
1030
652
timeout = self.timeout
1031
653
if self.disable_initiator_tag is not None:
1032
GLib.source_remove(self.disable_initiator_tag)
654
gobject.source_remove(self.disable_initiator_tag)
1033
655
self.disable_initiator_tag = None
1034
656
if getattr(self, "enabled", False):
1035
self.disable_initiator_tag = GLib.timeout_add(
1036
int(timeout.total_seconds() * 1000), self.disable)
657
self.disable_initiator_tag = (gobject.timeout_add
658
(timedelta_to_milliseconds
659
(timeout), self.disable))
1037
660
self.expires = datetime.datetime.utcnow() + timeout
1039
662
def need_approval(self):
1040
663
self.last_approval_request = datetime.datetime.utcnow()
1042
665
def start_checker(self):
1043
666
"""Start a new checker subprocess if one is not running.
1045
668
If a checker already exists, leave it running and do
1047
670
# The reason for not killing a running checker is that if we
1052
675
# checkers alone, the checker would have to take more time
1053
676
# than 'timeout' for the client to be disabled, which is as it
1056
if self.checker is not None and not self.checker.is_alive():
1057
logger.warning("Checker was not alive; joining")
679
# If a checker exists, make sure it is not a zombie
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except (AttributeError, OSError) as error:
683
if (isinstance(error, OSError)
684
and error.errno != errno.ECHILD):
688
logger.warning("Checker was a zombie")
689
gobject.source_remove(self.checker_callback_tag)
690
self.checker_callback(pid, status,
691
self.current_checker_command)
1060
692
# Start a new checker if needed
1061
693
if self.checker is None:
1062
694
# Escape attributes for the shell
1064
attr: re.escape(str(getattr(self, attr)))
1065
for attr in self.runtime_expansions}
695
escaped_attrs = dict(
696
(attr, re.escape(unicode(getattr(self, attr))))
698
self.runtime_expansions)
1067
700
command = self.checker_command % escaped_attrs
1068
701
except TypeError as error:
1069
702
logger.error('Could not format string "%s"',
1070
self.checker_command,
703
self.checker_command, exc_info=error)
704
return True # Try again later
705
self.current_checker_command = command
707
logger.info("Starting checker %r for %s",
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
self.checker = subprocess.Popen(command,
716
except OSError as error:
717
logger.error("Failed to start subprocess",
1072
return True # Try again later
1073
self.current_checker_command = command
1074
logger.info("Starting checker %r for %s", command,
1076
# We don't need to redirect stdout and stderr, since
1077
# in normal mode, that is already done by daemon(),
1078
# and in debug mode we don't want to. (Stdin is
1079
# always replaced by /dev/null.)
1080
# The exception is when not debugging but nevertheless
1081
# running in the foreground; use the previously
1083
popen_args = {"close_fds": True,
1086
if (not self.server_settings["debug"]
1087
and self.server_settings["foreground"]):
1088
popen_args.update({"stdout": wnull,
1090
pipe = multiprocessing.Pipe(duplex=False)
1091
self.checker = multiprocessing.Process(
1093
args=(pipe[1], subprocess.call, command),
1095
self.checker.start()
1096
self.checker_callback_tag = GLib.io_add_watch(
1097
pipe[0].fileno(), GLib.IO_IN,
1098
self.checker_callback, pipe[0], command)
1099
# Re-run this periodically if run by GLib.timeout_add
719
self.checker_callback_tag = (gobject.child_watch_add
721
self.checker_callback,
723
# The checker may have completed before the gobject
724
# watch was added. Check for this.
725
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
727
gobject.source_remove(self.checker_callback_tag)
728
self.checker_callback(pid, status, command)
729
# Re-run this periodically if run by gobject.timeout_add
1102
732
def stop_checker(self):
1103
733
"""Force the checker process, if any, to stop."""
1104
734
if self.checker_callback_tag:
1105
GLib.source_remove(self.checker_callback_tag)
735
gobject.source_remove(self.checker_callback_tag)
1106
736
self.checker_callback_tag = None
1107
737
if getattr(self, "checker", None) is None:
1109
739
logger.debug("Stopping checker for %(name)s", vars(self))
1110
self.checker.terminate()
741
self.checker.terminate()
743
#if self.checker.poll() is None:
744
# self.checker.kill()
745
except OSError as error:
746
if error.errno != errno.ESRCH: # No such process
1111
748
self.checker = None
1114
def dbus_service_property(dbus_interface,
751
def dbus_service_property(dbus_interface, signature="v",
752
access="readwrite", byte_arrays=False):
1118
753
"""Decorators for marking methods of a DBusObjectWithProperties to
1119
754
become properties on the D-Bus.
1121
756
The decorated method will be called with no arguments by "Get"
1122
757
and with one argument by "Set".
1124
759
The parameters, where they are supported, are the same as
1125
760
dbus.service.method, except there is only "signature", since the
1126
761
type from Get() and the type sent to Set() is the same.
1209
class DBusObjectWithAnnotations(dbus.service.Object):
1210
"""A D-Bus object with annotations.
1212
Classes inheriting from this can use the dbus_annotations
1213
decorator to add annotations to methods or signals.
837
class DBusObjectWithProperties(dbus.service.Object):
838
"""A D-Bus object with properties.
840
Classes inheriting from this can use the dbus_service_property
841
decorator to expose methods as D-Bus properties. It exposes the
842
standard Get(), Set(), and GetAll() methods on the D-Bus.
1217
846
def _is_dbus_thing(thing):
1218
847
"""Returns a function testing if an attribute is a D-Bus thing
1220
849
If called like _is_dbus_thing("method") it returns a function
1221
850
suitable for use as predicate to inspect.getmembers().
1223
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1226
855
def _get_all_dbus_things(self, thing):
1227
856
"""Returns a generator of (name, attribute) pairs
1229
return ((getattr(athing.__get__(self), "_dbus_name", name),
858
return ((getattr(athing.__get__(self), "_dbus_name",
1230
860
athing.__get__(self))
1231
861
for cls in self.__class__.__mro__
1232
862
for name, athing in
1233
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1235
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1237
path_keyword='object_path',
1238
connection_keyword='connection')
1239
def Introspect(self, object_path, connection):
1240
"""Overloading of standard D-Bus method.
1242
Inserts annotation tags on methods and signals.
1244
xmlstring = dbus.service.Object.Introspect(self, object_path,
1247
document = xml.dom.minidom.parseString(xmlstring)
1249
for if_tag in document.getElementsByTagName("interface"):
1250
# Add annotation tags
1251
for typ in ("method", "signal"):
1252
for tag in if_tag.getElementsByTagName(typ):
1254
for name, prop in (self.
1255
_get_all_dbus_things(typ)):
1256
if (name == tag.getAttribute("name")
1257
and prop._dbus_interface
1258
== if_tag.getAttribute("name")):
1259
annots.update(getattr(
1260
prop, "_dbus_annotations", {}))
1261
for name, value in annots.items():
1262
ann_tag = document.createElement(
1264
ann_tag.setAttribute("name", name)
1265
ann_tag.setAttribute("value", value)
1266
tag.appendChild(ann_tag)
1267
# Add interface annotation tags
1268
for annotation, value in dict(
1269
itertools.chain.from_iterable(
1270
annotations().items()
1271
for name, annotations
1272
in self._get_all_dbus_things("interface")
1273
if name == if_tag.getAttribute("name")
1275
ann_tag = document.createElement("annotation")
1276
ann_tag.setAttribute("name", annotation)
1277
ann_tag.setAttribute("value", value)
1278
if_tag.appendChild(ann_tag)
1279
# Fix argument name for the Introspect method itself
1280
if (if_tag.getAttribute("name")
1281
== dbus.INTROSPECTABLE_IFACE):
1282
for cn in if_tag.getElementsByTagName("method"):
1283
if cn.getAttribute("name") == "Introspect":
1284
for arg in cn.getElementsByTagName("arg"):
1285
if (arg.getAttribute("direction")
1287
arg.setAttribute("name",
1289
xmlstring = document.toxml("utf-8")
1291
except (AttributeError, xml.dom.DOMException,
1292
xml.parsers.expat.ExpatError) as error:
1293
logger.error("Failed to override Introspection method",
1298
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1299
"""A D-Bus object with properties.
1301
Classes inheriting from this can use the dbus_service_property
1302
decorator to expose methods as D-Bus properties. It exposes the
1303
standard Get(), Set(), and GetAll() methods on the D-Bus.
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
1306
866
def _get_dbus_property(self, interface_name, property_name):
1307
867
"""Returns a bound method if one exists which is a D-Bus
1308
868
property with the specified name and interface.
1310
for cls in self.__class__.__mro__:
1311
for name, value in inspect.getmembers(
1312
cls, self._is_dbus_thing("property")):
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
873
self._is_dbus_thing("property"))):
1313
874
if (value._dbus_name == property_name
1314
875
and value._dbus_interface == interface_name):
1315
876
return value.__get__(self)
1317
878
# No such property
1318
raise DBusPropertyNotFound("{}:{}.{}".format(
1319
self.dbus_object_path, interface_name, property_name))
1322
def _get_all_interface_names(cls):
1323
"""Get a sequence of all interfaces supported by an object"""
1324
return (name for name in set(getattr(getattr(x, attr),
1325
"_dbus_interface", None)
1326
for x in (inspect.getmro(cls))
1328
if name is not None)
1330
@dbus.service.method(dbus.PROPERTIES_IFACE,
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1332
884
out_signature="v")
1333
885
def Get(self, interface_name, property_name):
1334
886
"""Standard D-Bus property Get() method, see D-Bus standard.
1463
1016
return xmlstring
1467
dbus.OBJECT_MANAGER_IFACE
1468
except AttributeError:
1469
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1472
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1473
"""A D-Bus object with an ObjectManager.
1475
Classes inheriting from this exposes the standard
1476
GetManagedObjects call and the InterfacesAdded and
1477
InterfacesRemoved signals on the standard
1478
"org.freedesktop.DBus.ObjectManager" interface.
1480
Note: No signals are sent automatically; they must be sent
1483
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1484
out_signature="a{oa{sa{sv}}}")
1485
def GetManagedObjects(self):
1486
"""This function must be overridden"""
1487
raise NotImplementedError()
1489
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1490
signature="oa{sa{sv}}")
1491
def InterfacesAdded(self, object_path, interfaces_and_properties):
1494
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1495
def InterfacesRemoved(self, object_path, interfaces):
1498
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1500
path_keyword='object_path',
1501
connection_keyword='connection')
1502
def Introspect(self, object_path, connection):
1503
"""Overloading of standard D-Bus method.
1505
Override return argument name of GetManagedObjects to be
1506
"objpath_interfaces_and_properties"
1508
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1512
document = xml.dom.minidom.parseString(xmlstring)
1514
for if_tag in document.getElementsByTagName("interface"):
1515
# Fix argument name for the GetManagedObjects method
1516
if (if_tag.getAttribute("name")
1517
== dbus.OBJECT_MANAGER_IFACE):
1518
for cn in if_tag.getElementsByTagName("method"):
1519
if (cn.getAttribute("name")
1520
== "GetManagedObjects"):
1521
for arg in cn.getElementsByTagName("arg"):
1522
if (arg.getAttribute("direction")
1526
"objpath_interfaces"
1528
xmlstring = document.toxml("utf-8")
1530
except (AttributeError, xml.dom.DOMException,
1531
xml.parsers.expat.ExpatError) as error:
1532
logger.error("Failed to override Introspection method",
1537
1019
def datetime_to_dbus(dt, variant_level=0):
1538
1020
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1540
return dbus.String("", variant_level=variant_level)
1541
return dbus.String(dt.isoformat(), variant_level=variant_level)
1022
return dbus.String("", variant_level = variant_level)
1023
return dbus.String(dt.isoformat(),
1024
variant_level=variant_level)
1544
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1575
1057
# Ignore non-D-Bus attributes, and D-Bus attributes
1576
1058
# with the wrong interface name
1577
1059
if (not hasattr(attribute, "_dbus_interface")
1578
or not attribute._dbus_interface.startswith(
1579
orig_interface_name)):
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1581
1063
# Create an alternate D-Bus interface name based on
1582
1064
# the current name
1583
alt_interface = attribute._dbus_interface.replace(
1584
orig_interface_name, alt_interface_name)
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1585
1068
interface_names.add(alt_interface)
1586
1069
# Is this a D-Bus signal?
1587
1070
if getattr(attribute, "_dbus_is_signal", False):
1588
# Extract the original non-method undecorated
1589
# function by black magic
1590
if sys.version_info.major == 2:
1591
nonmethod_func = (dict(
1071
# Extract the original non-method function by
1073
nonmethod_func = (dict(
1592
1074
zip(attribute.func_code.co_freevars,
1593
attribute.__closure__))
1594
["func"].cell_contents)
1596
nonmethod_func = (dict(
1597
zip(attribute.__code__.co_freevars,
1598
attribute.__closure__))
1599
["func"].cell_contents)
1075
attribute.__closure__))["func"]
1600
1077
# Create a new, but exactly alike, function
1601
1078
# object, and decorate it to be a new D-Bus signal
1602
1079
# with the alternate D-Bus interface name
1603
new_function = copy_function(nonmethod_func)
1604
new_function = (dbus.service.signal(
1606
attribute._dbus_signature)(new_function))
1080
new_function = (dbus.service.signal
1082
attribute._dbus_signature)
1083
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1607
1089
# Copy annotations, if any
1609
new_function._dbus_annotations = dict(
1610
attribute._dbus_annotations)
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1611
1093
except AttributeError:
1614
1095
# Define a creator of a function to call both the
1615
1096
# original and alternate functions, so both the
1616
1097
# original and alternate signals gets sent when
1699
1187
if interface_names:
1700
1188
# Replace the class with a new subclass of it with
1701
1189
# methods, signals, etc. as created above.
1702
if sys.version_info.major == 2:
1703
cls = type(b"{}Alternate".format(cls.__name__),
1706
cls = type("{}Alternate".format(cls.__name__),
1190
cls = type(b"{0}Alternate".format(cls.__name__),
1713
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
1714
"se.bsnet.fukt.Mandos"})
1197
"se.bsnet.fukt.Mandos"})
1715
1198
class ClientDBus(Client, DBusObjectWithProperties):
1716
1199
"""A Client class using D-Bus
1719
1202
dbus_object_path: dbus.ObjectPath
1720
1203
bus: dbus.SystemBus()
1723
1206
runtime_expansions = (Client.runtime_expansions
1724
+ ("dbus_object_path", ))
1726
_interface = "se.recompile.Mandos.Client"
1207
+ ("dbus_object_path",))
1728
1209
# dbus.service.Object doesn't use super(), so we can't either.
1730
def __init__(self, bus=None, *args, **kwargs):
1211
def __init__(self, bus = None, *args, **kwargs):
1732
1213
Client.__init__(self, *args, **kwargs)
1733
1214
# Only now, when this client is initialized, can it show up on
1735
client_object_name = str(self.name).translate(
1216
client_object_name = unicode(self.name).translate(
1736
1217
{ord("."): ord("_"),
1737
1218
ord("-"): ord("_")})
1738
self.dbus_object_path = dbus.ObjectPath(
1739
"/clients/" + client_object_name)
1219
self.dbus_object_path = (dbus.ObjectPath
1220
("/clients/" + client_object_name))
1740
1221
DBusObjectWithProperties.__init__(self, self.bus,
1741
1222
self.dbus_object_path)
1743
def notifychangeproperty(transform_func, dbus_name,
1744
type_func=lambda x: x,
1746
invalidate_only=False,
1747
_interface=_interface):
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1748
1227
""" Modify a variable so that it's a property which announces
1749
1228
its changes to DBus.
1751
1230
transform_fun: Function that takes a value and a variant_level
1752
1231
and transforms it to a D-Bus type.
1753
1232
dbus_name: D-Bus name of the variable
1829
1297
if hasattr(DBusObjectWithProperties, "__del__"):
1830
1298
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1831
1299
Client.__del__(self, *args, **kwargs)
1833
def checker_callback(self, source, condition,
1834
connection, command, *args, **kwargs):
1835
ret = Client.checker_callback(self, source, condition,
1836
connection, command, *args,
1838
exitstatus = self.last_checker_status
1301
def checker_callback(self, pid, condition, command,
1303
self.checker_callback_tag = None
1305
if os.WIFEXITED(condition):
1306
exitstatus = os.WEXITSTATUS(condition)
1840
1307
# Emit D-Bus signal
1841
1308
self.CheckerCompleted(dbus.Int16(exitstatus),
1842
# This is specific to GNU libC
1843
dbus.Int64(exitstatus << 8),
1309
dbus.Int64(condition),
1844
1310
dbus.String(command))
1846
1312
# Emit D-Bus signal
1847
1313
self.CheckerCompleted(dbus.Int16(-1),
1849
# This is specific to GNU libC
1851
| self.last_checker_signal),
1314
dbus.Int64(condition),
1852
1315
dbus.String(command))
1317
return Client.checker_callback(self, pid, condition, command,
1855
1320
def start_checker(self, *args, **kwargs):
1856
old_checker_pid = getattr(self.checker, "pid", None)
1321
old_checker = self.checker
1322
if self.checker is not None:
1323
old_checker_pid = self.checker.pid
1325
old_checker_pid = None
1857
1326
r = Client.start_checker(self, *args, **kwargs)
1858
1327
# Only if new checker process was started
1859
1328
if (self.checker is not None
1905
1380
server to mandos-client
1909
1384
# Rejected - signal
1910
1385
@dbus.service.signal(_interface, signature="s")
1911
1386
def Rejected(self, reason):
1915
1390
# NeedApproval - signal
1916
1391
@dbus.service.signal(_interface, signature="tb")
1917
1392
def NeedApproval(self, timeout, default):
1919
1394
return self.need_approval()
1923
1398
# Approve - method
1924
1399
@dbus.service.method(_interface, in_signature="b")
1925
1400
def Approve(self, value):
1926
1401
self.approve(value)
1928
1403
# CheckedOK - method
1929
1404
@dbus.service.method(_interface)
1930
1405
def CheckedOK(self):
1931
1406
self.checked_ok()
1933
1408
# Enable - method
1934
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1935
1409
@dbus.service.method(_interface)
1936
1410
def Enable(self):
1940
1414
# StartChecker - method
1941
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1942
1415
@dbus.service.method(_interface)
1943
1416
def StartChecker(self):
1945
1418
self.start_checker()
1947
1420
# Disable - method
1948
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1949
1421
@dbus.service.method(_interface)
1950
1422
def Disable(self):
1954
1426
# StopChecker - method
1955
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1956
1427
@dbus.service.method(_interface)
1957
1428
def StopChecker(self):
1958
1429
self.stop_checker()
1962
1433
# ApprovalPending - property
1963
1434
@dbus_service_property(_interface, signature="b", access="read")
1964
1435
def ApprovalPending_dbus_property(self):
1965
1436
return dbus.Boolean(bool(self.approvals_pending))
1967
1438
# ApprovedByDefault - property
1968
@dbus_service_property(_interface,
1439
@dbus_service_property(_interface, signature="b",
1970
1440
access="readwrite")
1971
1441
def ApprovedByDefault_dbus_property(self, value=None):
1972
1442
if value is None: # get
1973
1443
return dbus.Boolean(self.approved_by_default)
1974
1444
self.approved_by_default = bool(value)
1976
1446
# ApprovalDelay - property
1977
@dbus_service_property(_interface,
1447
@dbus_service_property(_interface, signature="t",
1979
1448
access="readwrite")
1980
1449
def ApprovalDelay_dbus_property(self, value=None):
1981
1450
if value is None: # get
1982
return dbus.UInt64(self.approval_delay.total_seconds()
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1984
1452
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1986
1454
# ApprovalDuration - property
1987
@dbus_service_property(_interface,
1455
@dbus_service_property(_interface, signature="t",
1989
1456
access="readwrite")
1990
1457
def ApprovalDuration_dbus_property(self, value=None):
1991
1458
if value is None: # get
1992
return dbus.UInt64(self.approval_duration.total_seconds()
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1994
1461
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1996
1463
# Name - property
1998
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1999
1464
@dbus_service_property(_interface, signature="s", access="read")
2000
1465
def Name_dbus_property(self):
2001
1466
return dbus.String(self.name)
2003
1468
# Fingerprint - property
2005
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2006
1469
@dbus_service_property(_interface, signature="s", access="read")
2007
1470
def Fingerprint_dbus_property(self):
2008
1471
return dbus.String(self.fingerprint)
2010
1473
# Host - property
2011
@dbus_service_property(_interface,
1474
@dbus_service_property(_interface, signature="s",
2013
1475
access="readwrite")
2014
1476
def Host_dbus_property(self, value=None):
2015
1477
if value is None: # get
2016
1478
return dbus.String(self.host)
2017
self.host = str(value)
1479
self.host = unicode(value)
2019
1481
# Created - property
2021
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2022
1482
@dbus_service_property(_interface, signature="s", access="read")
2023
1483
def Created_dbus_property(self):
2024
1484
return datetime_to_dbus(self.created)
2026
1486
# LastEnabled - property
2027
1487
@dbus_service_property(_interface, signature="s", access="read")
2028
1488
def LastEnabled_dbus_property(self):
2029
1489
return datetime_to_dbus(self.last_enabled)
2031
1491
# Enabled - property
2032
@dbus_service_property(_interface,
1492
@dbus_service_property(_interface, signature="b",
2034
1493
access="readwrite")
2035
1494
def Enabled_dbus_property(self, value=None):
2036
1495
if value is None: # get
2085
1543
if (getattr(self, "disable_initiator_tag", None)
2088
GLib.source_remove(self.disable_initiator_tag)
2089
self.disable_initiator_tag = GLib.timeout_add(
2090
int((self.expires - now).total_seconds() * 1000),
1546
gobject.source_remove(self.disable_initiator_tag)
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
2093
1552
# ExtendedTimeout - property
2094
@dbus_service_property(_interface,
1553
@dbus_service_property(_interface, signature="t",
2096
1554
access="readwrite")
2097
1555
def ExtendedTimeout_dbus_property(self, value=None):
2098
1556
if value is None: # get
2099
return dbus.UInt64(self.extended_timeout.total_seconds()
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
2101
1558
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2103
1560
# Interval - property
2104
@dbus_service_property(_interface,
1561
@dbus_service_property(_interface, signature="t",
2106
1562
access="readwrite")
2107
1563
def Interval_dbus_property(self, value=None):
2108
1564
if value is None: # get
2109
return dbus.UInt64(self.interval.total_seconds() * 1000)
1565
return dbus.UInt64(self.interval_milliseconds())
2110
1566
self.interval = datetime.timedelta(0, 0, 0, value)
2111
1567
if getattr(self, "checker_initiator_tag", None) is None:
2113
1569
if self.enabled:
2114
1570
# Reschedule checker run
2115
GLib.source_remove(self.checker_initiator_tag)
2116
self.checker_initiator_tag = GLib.timeout_add(
2117
value, self.start_checker)
2118
self.start_checker() # Start one now, too
1571
gobject.source_remove(self.checker_initiator_tag)
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
2120
1576
# Checker - property
2121
@dbus_service_property(_interface,
1577
@dbus_service_property(_interface, signature="s",
2123
1578
access="readwrite")
2124
1579
def Checker_dbus_property(self, value=None):
2125
1580
if value is None: # get
2126
1581
return dbus.String(self.checker_command)
2127
self.checker_command = str(value)
1582
self.checker_command = unicode(value)
2129
1584
# CheckerRunning - property
2130
@dbus_service_property(_interface,
1585
@dbus_service_property(_interface, signature="b",
2132
1586
access="readwrite")
2133
1587
def CheckerRunning_dbus_property(self, value=None):
2134
1588
if value is None: # get
2191
1635
class ClientHandler(socketserver.BaseRequestHandler, object):
2192
1636
"""A class to handle client connections.
2194
1638
Instantiated once for each connection to handle it.
2195
1639
Note: This will run in its own forked process."""
2197
1641
def handle(self):
2198
1642
with contextlib.closing(self.server.child_pipe) as child_pipe:
2199
1643
logger.info("TCP connection from: %s",
2200
str(self.client_address))
1644
unicode(self.client_address))
2201
1645
logger.debug("Pipe FD: %d",
2202
1646
self.server.child_pipe.fileno())
2204
session = gnutls.ClientSession(self.request)
2206
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2207
# "+AES-256-CBC", "+SHA1",
2208
# "+COMP-NULL", "+CTYPE-OPENPGP",
1648
session = (gnutls.connection
1649
.ClientSession(self.request,
1651
.X509Credentials()))
1653
# Note: gnutls.connection.X509Credentials is really a
1654
# generic GnuTLS certificate credentials object so long as
1655
# no X.509 keys are added to it. Therefore, we can use it
1656
# here despite using OpenPGP certificates.
1658
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1659
# "+AES-256-CBC", "+SHA1",
1660
# "+COMP-NULL", "+CTYPE-OPENPGP",
2210
1662
# Use a fallback default, since this MUST be set.
2211
1663
priority = self.server.gnutls_priority
2212
1664
if priority is None:
2213
1665
priority = "NORMAL"
2214
gnutls.priority_set_direct(session._c_object,
2215
priority.encode("utf-8"),
1666
(gnutls.library.functions
1667
.gnutls_priority_set_direct(session._c_object,
2218
1670
# Start communication using the Mandos protocol
2219
1671
# Get protocol number
2220
1672
line = self.request.makefile().readline()
2221
1673
logger.debug("Protocol version: %r", line)
2223
1675
if int(line.strip().split()[0]) > 1:
2224
raise RuntimeError(line)
2225
1677
except (ValueError, IndexError, RuntimeError) as error:
2226
1678
logger.error("Unknown protocol version: %s", error)
2229
1681
# Start GnuTLS connection
2231
1683
session.handshake()
2232
except gnutls.Error as error:
1684
except gnutls.errors.GNUTLSError as error:
2233
1685
logger.warning("Handshake failed: %s", error)
2234
1686
# Do not run session.bye() here: the session is not
2235
1687
# established. Just abandon the request.
2237
1689
logger.debug("Handshake succeeded")
2239
1691
approval_required = False
2242
fpr = self.fingerprint(
2243
self.peer_certificate(session))
2244
except (TypeError, gnutls.Error) as error:
1694
fpr = self.fingerprint(self.peer_certificate
1697
gnutls.errors.GNUTLSError) as error:
2245
1698
logger.warning("Bad certificate: %s", error)
2247
1700
logger.debug("Fingerprint: %s", fpr)
2250
1703
client = ProxyClient(child_pipe, fpr,
2251
1704
self.client_address)
2252
1705
except KeyError:
2255
1708
if client.approval_delay:
2256
1709
delay = client.approval_delay
2257
1710
client.approvals_pending += 1
2258
1711
approval_required = True
2261
1714
if not client.enabled:
2262
1715
logger.info("Client %s is disabled",
2264
1717
if self.server.use_dbus:
2265
1718
# Emit D-Bus signal
2266
1719
client.Rejected("Disabled")
2269
1722
if client.approved or not client.approval_delay:
2270
# We are approved or approval is disabled
1723
#We are approved or approval is disabled
2272
1725
elif client.approved is None:
2273
1726
logger.info("Client %s needs approval",
2306
1761
delay -= time2 - time
2309
session.send(client.secret)
2310
except gnutls.Error as error:
2311
logger.warning("gnutls send failed",
1764
while sent_size < len(client.secret):
1766
sent = session.send(client.secret[sent_size:])
1767
except gnutls.errors.GNUTLSError as error:
1768
logger.warning("gnutls send failed",
1771
logger.debug("Sent: %d, remaining: %d",
1772
sent, len(client.secret)
1773
- (sent_size + sent))
2315
1776
logger.info("Sending secret to %s", client.name)
2316
1777
# bump the timeout using extended_timeout
2317
1778
client.bump_timeout(client.extended_timeout)
2318
1779
if self.server.use_dbus:
2319
1780
# Emit D-Bus signal
2320
1781
client.GotSecret()
2323
1784
if approval_required:
2324
1785
client.approvals_pending -= 1
2327
except gnutls.Error as error:
1788
except gnutls.errors.GNUTLSError as error:
2328
1789
logger.warning("GnuTLS bye failed",
2329
1790
exc_info=error)
2332
1793
def peer_certificate(session):
2333
1794
"Return the peer's OpenPGP certificate as a bytestring"
2334
1795
# If not an OpenPGP certificate...
2335
if (gnutls.certificate_type_get(session._c_object)
2336
!= gnutls.CRT_OPENPGP):
2337
# ...return invalid data
1796
if (gnutls.library.functions
1797
.gnutls_certificate_type_get(session._c_object)
1798
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1799
# ...do the normal thing
1800
return session.peer_certificate
2339
1801
list_size = ctypes.c_uint(1)
2340
cert_list = (gnutls.certificate_get_peers
1802
cert_list = (gnutls.library.functions
1803
.gnutls_certificate_get_peers
2341
1804
(session._c_object, ctypes.byref(list_size)))
2342
1805
if not bool(cert_list) and list_size.value != 0:
2343
raise gnutls.Error("error getting peer certificate")
1806
raise gnutls.errors.GNUTLSError("error getting peer"
2344
1808
if list_size.value == 0:
2346
1810
cert = cert_list[0]
2347
1811
return ctypes.string_at(cert.data, cert.size)
2350
1814
def fingerprint(openpgp):
2351
1815
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2352
1816
# New GnuTLS "datum" with the OpenPGP public key
2353
datum = gnutls.datum_t(
2354
ctypes.cast(ctypes.c_char_p(openpgp),
2355
ctypes.POINTER(ctypes.c_ubyte)),
2356
ctypes.c_uint(len(openpgp)))
1817
datum = (gnutls.library.types
1818
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1821
ctypes.c_uint(len(openpgp))))
2357
1822
# New empty GnuTLS certificate
2358
crt = gnutls.openpgp_crt_t()
2359
gnutls.openpgp_crt_init(ctypes.byref(crt))
1823
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1824
(gnutls.library.functions
1825
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2360
1826
# Import the OpenPGP public key into the certificate
2361
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2362
gnutls.OPENPGP_FMT_RAW)
1827
(gnutls.library.functions
1828
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1829
gnutls.library.constants
1830
.GNUTLS_OPENPGP_FMT_RAW))
2363
1831
# Verify the self signature in the key
2364
1832
crtverify = ctypes.c_uint()
2365
gnutls.openpgp_crt_verify_self(crt, 0,
2366
ctypes.byref(crtverify))
1833
(gnutls.library.functions
1834
.gnutls_openpgp_crt_verify_self(crt, 0,
1835
ctypes.byref(crtverify)))
2367
1836
if crtverify.value != 0:
2368
gnutls.openpgp_crt_deinit(crt)
2369
raise gnutls.CertificateSecurityError("Verify failed")
1837
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1838
raise (gnutls.errors.CertificateSecurityError
2370
1840
# New buffer for the fingerprint
2371
1841
buf = ctypes.create_string_buffer(20)
2372
1842
buf_len = ctypes.c_size_t()
2373
1843
# Get the fingerprint from the certificate into the buffer
2374
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2375
ctypes.byref(buf_len))
1844
(gnutls.library.functions
1845
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1846
ctypes.byref(buf_len)))
2376
1847
# Deinit the certificate
2377
gnutls.openpgp_crt_deinit(crt)
1848
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2378
1849
# Convert the buffer to a Python bytestring
2379
1850
fpr = ctypes.string_at(buf, buf_len.value)
2380
1851
# Convert the bytestring to hexadecimal notation
2385
1856
class MultiprocessingMixIn(object):
2386
1857
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2388
1858
def sub_process_main(self, request, address):
2390
1860
self.finish_request(request, address)
2391
1861
except Exception:
2392
1862
self.handle_error(request, address)
2393
1863
self.close_request(request)
2395
1865
def process_request(self, request, address):
2396
1866
"""Start a new process to process the request."""
2397
proc = multiprocessing.Process(target=self.sub_process_main,
2398
args=(request, address))
1867
proc = multiprocessing.Process(target = self.sub_process_main,
1868
args = (request, address))
2403
1873
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2404
1874
""" adds a pipe to the MixIn """
2406
1875
def process_request(self, request, client_address):
2407
1876
"""Overrides and wraps the original process_request().
2409
1878
This function creates a new pipe in self.pipe
2411
1880
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2413
1882
proc = MultiprocessingMixIn.process_request(self, request,
2414
1883
client_address)
2415
1884
self.child_pipe.close()
2416
1885
self.add_pipe(parent_pipe, proc)
2418
1887
def add_pipe(self, parent_pipe, proc):
2419
1888
"""Dummy function; override as necessary"""
2420
raise NotImplementedError()
1889
raise NotImplementedError
2423
1892
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2424
1893
socketserver.TCPServer, object):
2425
1894
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2428
1897
enabled: Boolean; whether this server is activated yet
2429
1898
interface: None or a network interface name (string)
2430
1899
use_ipv6: Boolean; to use IPv6 or not
2433
1901
def __init__(self, server_address, RequestHandlerClass,
1902
interface=None, use_ipv6=True, socketfd=None):
2437
1903
"""If socketfd is set, use that file descriptor instead of
2438
1904
creating a new one with socket.socket().
2469
1934
# socket_wrapper(), if socketfd was set.
2470
1935
socketserver.TCPServer.__init__(self, server_address,
2471
1936
RequestHandlerClass)
2473
1938
def server_bind(self):
2474
1939
"""This overrides the normal server_bind() function
2475
1940
to bind to an interface if one was specified, and also NOT to
2476
1941
bind to an address or port if they were not specified."""
2477
global SO_BINDTODEVICE
2478
1942
if self.interface is not None:
2479
1943
if SO_BINDTODEVICE is None:
2480
# Fall back to a hard-coded value which seems to be
2482
logger.warning("SO_BINDTODEVICE not found, trying 25")
2483
SO_BINDTODEVICE = 25
2485
self.socket.setsockopt(
2486
socket.SOL_SOCKET, SO_BINDTODEVICE,
2487
(self.interface + "\0").encode("utf-8"))
2488
except socket.error as error:
2489
if error.errno == errno.EPERM:
2490
logger.error("No permission to bind to"
2491
" interface %s", self.interface)
2492
elif error.errno == errno.ENOPROTOOPT:
2493
logger.error("SO_BINDTODEVICE not available;"
2494
" cannot bind to interface %s",
2496
elif error.errno == errno.ENODEV:
2497
logger.error("Interface %s does not exist,"
2498
" cannot bind", self.interface)
1944
logger.error("SO_BINDTODEVICE does not exist;"
1945
" cannot bind to interface %s",
1949
self.socket.setsockopt(socket.SOL_SOCKET,
1953
except socket.error as error:
1954
if error.errno == errno.EPERM:
1955
logger.error("No permission to"
1956
" bind to interface %s",
1958
elif error.errno == errno.ENOPROTOOPT:
1959
logger.error("SO_BINDTODEVICE not available;"
1960
" cannot bind to interface %s",
1962
elif error.errno == errno.ENODEV:
1963
logger.error("Interface %s does not"
1964
" exist, cannot bind",
2501
1968
# Only bind(2) the socket if we really need to.
2502
1969
if self.server_address[0] or self.server_address[1]:
2503
1970
if not self.server_address[0]:
2504
1971
if self.address_family == socket.AF_INET6:
2505
any_address = "::" # in6addr_any
1972
any_address = "::" # in6addr_any
2507
any_address = "0.0.0.0" # INADDR_ANY
1974
any_address = socket.INADDR_ANY
2508
1975
self.server_address = (any_address,
2509
1976
self.server_address[1])
2510
1977
elif not self.server_address[1]:
2511
self.server_address = (self.server_address[0], 0)
1978
self.server_address = (self.server_address[0],
2512
1980
# if self.interface:
2513
1981
# self.server_address = (self.server_address[0],
2611
2072
funcname = request[1]
2612
2073
args = request[2]
2613
2074
kwargs = request[3]
2615
2076
parent_pipe.send(('data', getattr(client_object,
2616
2077
funcname)(*args,
2619
2080
if command == 'getattr':
2620
2081
attrname = request[1]
2621
if isinstance(client_object.__getattribute__(attrname),
2622
collections.Callable):
2623
parent_pipe.send(('function', ))
2082
if callable(client_object.__getattribute__(attrname)):
2083
parent_pipe.send(('function',))
2626
'data', client_object.__getattribute__(attrname)))
2085
parent_pipe.send(('data', client_object
2086
.__getattribute__(attrname)))
2628
2088
if command == 'setattr':
2629
2089
attrname = request[1]
2630
2090
value = request[2]
2631
2091
setattr(client_object, attrname, value)
2636
def rfc3339_duration_to_delta(duration):
2637
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2639
>>> rfc3339_duration_to_delta("P7D")
2640
datetime.timedelta(7)
2641
>>> rfc3339_duration_to_delta("PT60S")
2642
datetime.timedelta(0, 60)
2643
>>> rfc3339_duration_to_delta("PT60M")
2644
datetime.timedelta(0, 3600)
2645
>>> rfc3339_duration_to_delta("PT24H")
2646
datetime.timedelta(1)
2647
>>> rfc3339_duration_to_delta("P1W")
2648
datetime.timedelta(7)
2649
>>> rfc3339_duration_to_delta("PT5M30S")
2650
datetime.timedelta(0, 330)
2651
>>> rfc3339_duration_to_delta("P1DT3M20S")
2652
datetime.timedelta(1, 200)
2655
# Parsing an RFC 3339 duration with regular expressions is not
2656
# possible - there would have to be multiple places for the same
2657
# values, like seconds. The current code, while more esoteric, is
2658
# cleaner without depending on a parsing library. If Python had a
2659
# built-in library for parsing we would use it, but we'd like to
2660
# avoid excessive use of external libraries.
2662
# New type for defining tokens, syntax, and semantics all-in-one
2663
Token = collections.namedtuple("Token", (
2664
"regexp", # To match token; if "value" is not None, must have
2665
# a "group" containing digits
2666
"value", # datetime.timedelta or None
2667
"followers")) # Tokens valid after this token
2668
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2669
# the "duration" ABNF definition in RFC 3339, Appendix A.
2670
token_end = Token(re.compile(r"$"), None, frozenset())
2671
token_second = Token(re.compile(r"(\d+)S"),
2672
datetime.timedelta(seconds=1),
2673
frozenset((token_end, )))
2674
token_minute = Token(re.compile(r"(\d+)M"),
2675
datetime.timedelta(minutes=1),
2676
frozenset((token_second, token_end)))
2677
token_hour = Token(re.compile(r"(\d+)H"),
2678
datetime.timedelta(hours=1),
2679
frozenset((token_minute, token_end)))
2680
token_time = Token(re.compile(r"T"),
2682
frozenset((token_hour, token_minute,
2684
token_day = Token(re.compile(r"(\d+)D"),
2685
datetime.timedelta(days=1),
2686
frozenset((token_time, token_end)))
2687
token_month = Token(re.compile(r"(\d+)M"),
2688
datetime.timedelta(weeks=4),
2689
frozenset((token_day, token_end)))
2690
token_year = Token(re.compile(r"(\d+)Y"),
2691
datetime.timedelta(weeks=52),
2692
frozenset((token_month, token_end)))
2693
token_week = Token(re.compile(r"(\d+)W"),
2694
datetime.timedelta(weeks=1),
2695
frozenset((token_end, )))
2696
token_duration = Token(re.compile(r"P"), None,
2697
frozenset((token_year, token_month,
2698
token_day, token_time,
2700
# Define starting values:
2702
value = datetime.timedelta()
2704
# Following valid tokens
2705
followers = frozenset((token_duration, ))
2706
# String left to parse
2708
# Loop until end token is found
2709
while found_token is not token_end:
2710
# Search for any currently valid tokens
2711
for token in followers:
2712
match = token.regexp.match(s)
2713
if match is not None:
2715
if token.value is not None:
2716
# Value found, parse digits
2717
factor = int(match.group(1), 10)
2718
# Add to value so far
2719
value += factor * token.value
2720
# Strip token from string
2721
s = token.regexp.sub("", s, 1)
2724
# Set valid next tokens
2725
followers = found_token.followers
2728
# No currently valid tokens were found
2729
raise ValueError("Invalid RFC 3339 duration: {!r}"
2735
2096
def string_to_delta(interval):
2736
2097
"""Parse a string and return a datetime.timedelta
2738
2099
>>> string_to_delta('7d')
2739
2100
datetime.timedelta(7)
2740
2101
>>> string_to_delta('60s')
2835
2191
parser.add_argument("--no-dbus", action="store_false",
2836
2192
dest="use_dbus", help="Do not provide D-Bus"
2837
" system bus interface", default=None)
2193
" system bus interface")
2838
2194
parser.add_argument("--no-ipv6", action="store_false",
2839
dest="use_ipv6", help="Do not use IPv6",
2195
dest="use_ipv6", help="Do not use IPv6")
2841
2196
parser.add_argument("--no-restore", action="store_false",
2842
2197
dest="restore", help="Do not restore stored"
2843
" state", default=None)
2844
2199
parser.add_argument("--socket", type=int,
2845
2200
help="Specify a file descriptor to a network"
2846
2201
" socket to use instead of creating one")
2847
2202
parser.add_argument("--statedir", metavar="DIR",
2848
2203
help="Directory to save/restore state in")
2849
parser.add_argument("--foreground", action="store_true",
2850
help="Run in foreground", default=None)
2851
parser.add_argument("--no-zeroconf", action="store_false",
2852
dest="zeroconf", help="Do not use Zeroconf",
2855
2205
options = parser.parse_args()
2857
2207
if options.check:
2859
fail_count, test_count = doctest.testmod()
2860
sys.exit(os.EX_OK if fail_count == 0 else 1)
2862
2212
# Default values for config file for server-global settings
2863
server_defaults = {"interface": "",
2868
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2869
":+SIGN-DSA-SHA256",
2870
"servicename": "Mandos",
2876
"statedir": "/var/lib/mandos",
2877
"foreground": "False",
2213
server_defaults = { "interface": "",
2218
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2219
"servicename": "Mandos",
2225
"statedir": "/var/lib/mandos"
2881
2228
# Parse config file for server-global settings
2882
2229
server_config = configparser.SafeConfigParser(server_defaults)
2883
2230
del server_defaults
2884
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2231
server_config.read(os.path.join(options.configdir,
2885
2233
# Convert the SafeConfigParser object to a dict
2886
2234
server_settings = server_config.defaults()
2887
2235
# Use the appropriate methods on the non-string config options
2888
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2889
"foreground", "zeroconf"):
2236
for option in ("debug", "use_dbus", "use_ipv6"):
2890
2237
server_settings[option] = server_config.getboolean("DEFAULT",
2892
2239
if server_settings["port"]:
2902
2249
server_settings["socket"] = os.dup(server_settings
2904
2251
del server_config
2906
2253
# Override the settings from the config file with command line
2907
2254
# options, if set.
2908
2255
for option in ("interface", "address", "port", "debug",
2909
"priority", "servicename", "configdir", "use_dbus",
2910
"use_ipv6", "debuglevel", "restore", "statedir",
2911
"socket", "foreground", "zeroconf"):
2256
"priority", "servicename", "configdir",
2257
"use_dbus", "use_ipv6", "debuglevel", "restore",
2258
"statedir", "socket"):
2912
2259
value = getattr(options, option)
2913
2260
if value is not None:
2914
2261
server_settings[option] = value
2916
2263
# Force all strings to be unicode
2917
2264
for option in server_settings.keys():
2918
if isinstance(server_settings[option], bytes):
2919
server_settings[option] = (server_settings[option]
2921
# Force all boolean options to be boolean
2922
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2923
"foreground", "zeroconf"):
2924
server_settings[option] = bool(server_settings[option])
2925
# Debug implies foreground
2926
if server_settings["debug"]:
2927
server_settings["foreground"] = True
2265
if type(server_settings[option]) is str:
2266
server_settings[option] = unicode(server_settings[option])
2928
2267
# Now we have our good server settings in "server_settings"
2930
2269
##################################################################
2932
if (not server_settings["zeroconf"]
2933
and not (server_settings["port"]
2934
or server_settings["socket"] != "")):
2935
parser.error("Needs port or socket to work without Zeroconf")
2937
2271
# For convenience
2938
2272
debug = server_settings["debug"]
2939
2273
debuglevel = server_settings["debuglevel"]
2953
2285
level = getattr(logging, debuglevel.upper())
2954
2286
initlogger(debug, level)
2956
2288
if server_settings["servicename"] != "Mandos":
2957
syslogger.setFormatter(
2958
logging.Formatter('Mandos ({}) [%(process)d]:'
2959
' %(levelname)s: %(message)s'.format(
2960
server_settings["servicename"])))
2289
syslogger.setFormatter(logging.Formatter
2290
('Mandos ({0}) [%(process)d]:'
2291
' %(levelname)s: %(message)s'
2292
.format(server_settings
2962
2295
# Parse config file with clients
2963
2296
client_config = configparser.SafeConfigParser(Client
2964
2297
.client_defaults)
2965
2298
client_config.read(os.path.join(server_settings["configdir"],
2966
2299
"clients.conf"))
2968
2301
global mandos_dbus_service
2969
2302
mandos_dbus_service = None
2972
if server_settings["socket"] != "":
2973
socketfd = server_settings["socket"]
2974
tcp_server = MandosServer(
2975
(server_settings["address"], server_settings["port"]),
2977
interface=(server_settings["interface"] or None),
2979
gnutls_priority=server_settings["priority"],
2983
pidfilename = "/run/mandos.pid"
2984
if not os.path.isdir("/run/."):
2985
pidfilename = "/var/run/mandos.pid"
2304
tcp_server = MandosServer((server_settings["address"],
2305
server_settings["port"]),
2307
interface=(server_settings["interface"]
2311
server_settings["priority"],
2313
socketfd=(server_settings["socket"]
2316
pidfilename = "/var/run/mandos.pid"
2988
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2318
pidfile = open(pidfilename, "w")
2989
2319
except IOError as e:
2990
2320
logger.error("Could not open file %r", pidfilename,
2993
for name, group in (("_mandos", "_mandos"),
2994
("mandos", "mandos"),
2995
("nobody", "nogroup")):
2323
for name in ("_mandos", "mandos", "nobody"):
2997
2325
uid = pwd.getpwnam(name).pw_uid
2998
gid = pwd.getpwnam(group).pw_gid
2326
gid = pwd.getpwnam(name).pw_gid
3000
2328
except KeyError:
3009
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3011
2336
except OSError as error:
3012
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3013
.format(uid, gid, os.strerror(error.errno)))
3014
2337
if error.errno != errno.EPERM:
3018
2341
# Enable all possible GnuTLS debugging
3020
2343
# "Use a log level over 10 to enable all debugging options."
3021
2344
# - GnuTLS manual
3022
gnutls.global_set_log_level(11)
2345
gnutls.library.functions.gnutls_global_set_log_level(11)
2347
@gnutls.library.types.gnutls_log_func
3025
2348
def debug_gnutls(level, string):
3026
2349
logger.debug("GnuTLS: %s", string[:-1])
3028
gnutls.global_set_log_function(debug_gnutls)
2351
(gnutls.library.functions
2352
.gnutls_global_set_log_function(debug_gnutls))
3030
2354
# Redirect stdin so all checkers get /dev/null
3031
2355
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3032
2356
os.dup2(null, sys.stdin.fileno())
3036
2360
# Need to fork before connecting to D-Bus
3038
2362
# Close all input and output, do double fork, etc.
3041
# multiprocessing will use threads, so before we use GLib we need
3042
# to inform GLib that threads will be used.
2365
# multiprocessing will use threads, so before we use gobject we
2366
# need to inform gobject that threads will be used.
2367
gobject.threads_init()
3045
2369
global main_loop
3046
2370
# From the Avahi example code
3047
2371
DBusGMainLoop(set_as_default=True)
3048
main_loop = GLib.MainLoop()
2372
main_loop = gobject.MainLoop()
3049
2373
bus = dbus.SystemBus()
3050
2374
# End of Avahi example code
3053
2377
bus_name = dbus.service.BusName("se.recompile.Mandos",
3056
old_bus_name = dbus.service.BusName(
3057
"se.bsnet.fukt.Mandos", bus,
3059
except dbus.exceptions.DBusException as e:
2378
bus, do_not_queue=True)
2379
old_bus_name = (dbus.service.BusName
2380
("se.bsnet.fukt.Mandos", bus,
2382
except dbus.exceptions.NameExistsException as e:
3060
2383
logger.error("Disabling D-Bus:", exc_info=e)
3061
2384
use_dbus = False
3062
2385
server_settings["use_dbus"] = False
3063
2386
tcp_server.use_dbus = False
3065
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3066
service = AvahiServiceToSyslog(
3067
name=server_settings["servicename"],
3068
servicetype="_mandos._tcp",
3071
if server_settings["interface"]:
3072
service.interface = if_nametoindex(
3073
server_settings["interface"].encode("utf-8"))
2387
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2388
service = AvahiServiceToSyslog(name =
2389
server_settings["servicename"],
2390
servicetype = "_mandos._tcp",
2391
protocol = protocol, bus = bus)
2392
if server_settings["interface"]:
2393
service.interface = (if_nametoindex
2394
(str(server_settings["interface"])))
3075
2396
global multiprocessing_manager
3076
2397
multiprocessing_manager = multiprocessing.Manager()
3078
2399
client_class = Client
3080
client_class = functools.partial(ClientDBus, bus=bus)
2401
client_class = functools.partial(ClientDBus, bus = bus)
3082
2403
client_settings = Client.config_parser(client_config)
3083
2404
old_client_settings = {}
3084
2405
clients_data = {}
3086
# This is used to redirect stdout and stderr for checker processes
3088
wnull = open(os.devnull, "w") # A writable /dev/null
3089
# Only used if server is running in foreground but not in debug
3091
if debug or not foreground:
3094
2407
# Get client data and settings from last running state.
3095
2408
if server_settings["restore"]:
3097
2410
with open(stored_state_path, "rb") as stored_state:
3098
if sys.version_info.major == 2:
3099
clients_data, old_client_settings = pickle.load(
3102
bytes_clients_data, bytes_old_client_settings = (
3103
pickle.load(stored_state, encoding="bytes"))
3104
# Fix bytes to strings
3107
clients_data = {(key.decode("utf-8")
3108
if isinstance(key, bytes)
3111
bytes_clients_data.items()}
3112
del bytes_clients_data
3113
for key in clients_data:
3114
value = {(k.decode("utf-8")
3115
if isinstance(k, bytes) else k): v
3117
clients_data[key].items()}
3118
clients_data[key] = value
3120
value["client_structure"] = [
3122
if isinstance(s, bytes)
3124
value["client_structure"]]
3126
for k in ("name", "host"):
3127
if isinstance(value[k], bytes):
3128
value[k] = value[k].decode("utf-8")
3129
# old_client_settings
3131
old_client_settings = {
3132
(key.decode("utf-8")
3133
if isinstance(key, bytes)
3136
bytes_old_client_settings.items()}
3137
del bytes_old_client_settings
3139
for value in old_client_settings.values():
3140
if isinstance(value["host"], bytes):
3141
value["host"] = (value["host"]
2411
clients_data, old_client_settings = (pickle.load
3143
2413
os.remove(stored_state_path)
3144
2414
except IOError as e:
3145
2415
if e.errno == errno.ENOENT:
3146
logger.warning("Could not load persistent state:"
3147
" {}".format(os.strerror(e.errno)))
2416
logger.warning("Could not load persistent state: {0}"
2417
.format(os.strerror(e.errno)))
3149
2419
logger.critical("Could not load persistent state:",
3152
2422
except EOFError as e:
3153
2423
logger.warning("Could not load persistent state: "
2424
"EOFError:", exc_info=e)
3157
2426
with PGPEngine() as pgp:
3158
for client_name, client in clients_data.items():
3159
# Skip removed clients
3160
if client_name not in client_settings:
2427
for client_name, client in clients_data.iteritems():
3163
2428
# Decide which value to use after restoring saved state.
3164
2429
# We have three different values: Old config file,
3165
2430
# new config file, and saved state.
3223
2488
for client_name in (set(client_settings)
3224
2489
- set(old_client_settings)):
3225
2490
clients_data[client_name] = client_settings[client_name]
3227
2492
# Create all client objects
3228
for client_name, client in clients_data.items():
2493
for client_name, client in clients_data.iteritems():
3229
2494
tcp_server.clients[client_name] = client_class(
3232
server_settings=server_settings)
2495
name = client_name, settings = client)
3234
2497
if not tcp_server.clients:
3235
2498
logger.warning("No clients defined")
3238
if pidfile is not None:
3242
print(pid, file=pidfile)
3244
logger.error("Could not write to file %r with PID %d",
2504
pidfile.write(str(pid) + "\n".encode("utf-8"))
2507
logger.error("Could not write to file %r with PID %d",
2510
# "pidfile" was never created
3247
2512
del pidfilename
3249
for termsig in (signal.SIGHUP, signal.SIGTERM):
3250
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3251
lambda: main_loop.quit() and False)
2514
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2515
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3255
@alternate_dbus_interfaces(
3256
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3257
class MandosDBusService(DBusObjectWithObjectManager):
2518
@alternate_dbus_interfaces({"se.recompile.Mandos":
2519
"se.bsnet.fukt.Mandos"})
2520
class MandosDBusService(DBusObjectWithProperties):
3258
2521
"""A D-Bus proxy object"""
3260
2522
def __init__(self):
3261
2523
dbus.service.Object.__init__(self, bus, "/")
3263
2524
_interface = "se.recompile.Mandos"
2526
@dbus_interface_annotations(_interface)
2528
return { "org.freedesktop.DBus.Property"
2529
".EmitsChangedSignal":
3265
2532
@dbus.service.signal(_interface, signature="o")
3266
2533
def ClientAdded(self, objpath):
3270
2537
@dbus.service.signal(_interface, signature="ss")
3271
2538
def ClientNotFound(self, fingerprint, address):
3275
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3277
2542
@dbus.service.signal(_interface, signature="os")
3278
2543
def ClientRemoved(self, objpath, name):
3282
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3284
2547
@dbus.service.method(_interface, out_signature="ao")
3285
2548
def GetAllClients(self):
3287
return dbus.Array(c.dbus_object_path for c in
3288
tcp_server.clients.values())
3290
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2550
return dbus.Array(c.dbus_object_path
2552
tcp_server.clients.itervalues())
3292
2554
@dbus.service.method(_interface,
3293
2555
out_signature="a{oa{sv}}")
3294
2556
def GetAllClientsWithProperties(self):
3296
2558
return dbus.Dictionary(
3297
{c.dbus_object_path: c.GetAll(
3298
"se.recompile.Mandos.Client")
3299
for c in tcp_server.clients.values()},
2559
((c.dbus_object_path, c.GetAll(""))
2560
for c in tcp_server.clients.itervalues()),
3300
2561
signature="oa{sv}")
3302
2563
@dbus.service.method(_interface, in_signature="o")
3303
2564
def RemoveClient(self, object_path):
3305
for c in tcp_server.clients.values():
2566
for c in tcp_server.clients.itervalues():
3306
2567
if c.dbus_object_path == object_path:
3307
2568
del tcp_server.clients[c.name]
3308
2569
c.remove_from_connection()
3309
# Don't signal the disabling
2570
# Don't signal anything except ClientRemoved
3310
2571
c.disable(quiet=True)
3311
# Emit D-Bus signal for removal
3312
self.client_removed_signal(c)
2573
self.ClientRemoved(object_path, c.name)
3314
2575
raise KeyError(object_path)
3318
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3319
out_signature="a{oa{sa{sv}}}")
3320
def GetManagedObjects(self):
3322
return dbus.Dictionary(
3323
{client.dbus_object_path:
3325
{interface: client.GetAll(interface)
3327
client._get_all_interface_names()})
3328
for client in tcp_server.clients.values()})
3330
def client_added_signal(self, client):
3331
"""Send the new standard signal and the old signal"""
3333
# New standard signal
3334
self.InterfacesAdded(
3335
client.dbus_object_path,
3337
{interface: client.GetAll(interface)
3339
client._get_all_interface_names()}))
3341
self.ClientAdded(client.dbus_object_path)
3343
def client_removed_signal(self, client):
3344
"""Send the new standard signal and the old signal"""
3346
# New standard signal
3347
self.InterfacesRemoved(
3348
client.dbus_object_path,
3349
client._get_all_interface_names())
3351
self.ClientRemoved(client.dbus_object_path,
3354
2579
mandos_dbus_service = MandosDBusService()
3356
# Save modules to variables to exempt the modules from being
3357
# unloaded before the function registered with atexit() is run.
3358
mp = multiprocessing
3362
2582
"Cleanup function; run on exit"
3366
mp.active_children()
2585
multiprocessing.active_children()
3368
2586
if not (tcp_server.clients or client_settings):
3371
2589
# Store client before exiting. Secrets are encrypted with key
3372
2590
# based on what config file has. If config file is
3373
2591
# removed/edited, old secret will thus be unrecovable.
3375
2593
with PGPEngine() as pgp:
3376
for client in tcp_server.clients.values():
2594
for client in tcp_server.clients.itervalues():
3377
2595
key = client_settings[client.name]["secret"]
3378
2596
client.encrypted_secret = pgp.encrypt(client.secret,
3380
2598
client_dict = {}
3382
2600
# A list of attributes that can not be pickled
3384
exclude = {"bus", "changedstate", "secret",
3385
"checker", "server_settings"}
3386
for name, typ in inspect.getmembers(dbus.service
2602
exclude = set(("bus", "changedstate", "secret",
2604
for name, typ in (inspect.getmembers
2605
(dbus.service.Object)):
3388
2606
exclude.add(name)
3390
2608
client_dict["encrypted_secret"] = (client
3391
2609
.encrypted_secret)
3392
2610
for attr in client.client_structure:
3393
2611
if attr not in exclude:
3394
2612
client_dict[attr] = getattr(client, attr)
3396
2614
clients[client.name] = client_dict
3397
2615
del client_settings[client.name]["secret"]
3400
with tempfile.NamedTemporaryFile(
3404
dir=os.path.dirname(stored_state_path),
3405
delete=False) as stored_state:
3406
pickle.dump((clients, client_settings), stored_state,
3408
tempname = stored_state.name
2618
with (tempfile.NamedTemporaryFile
2619
(mode='wb', suffix=".pickle", prefix='clients-',
2620
dir=os.path.dirname(stored_state_path),
2621
delete=False)) as stored_state:
2622
pickle.dump((clients, client_settings), stored_state)
2623
tempname=stored_state.name
3409
2624
os.rename(tempname, stored_state_path)
3410
2625
except (IOError, OSError) as e: