124
261
self.rename_count = 0
125
262
self.max_renames = max_renames
263
self.protocol = protocol
264
self.group = None # our entry group
267
self.entry_group_state_changed_match = None
126
269
def rename(self):
127
270
"""Derived from the Avahi example code"""
128
271
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
272
logger.critical("No suitable Zeroconf service name found"
273
" after %i retries, exiting.",
131
274
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
275
raise AvahiServiceError("Too many renames")
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
278
logger.info("Changing Zeroconf service name to %r ...",
283
except dbus.exceptions.DBusException as error:
284
logger.critical("D-Bus Exception", exc_info=error)
141
287
self.rename_count += 1
142
289
def remove(self):
143
290
"""Derived from the Avahi example code"""
144
if group is not None:
291
if self.entry_group_state_changed_match is not None:
292
self.entry_group_state_changed_match.remove()
293
self.entry_group_state_changed_match = None
294
if self.group is not None:
147
298
"""Derived from the Avahi example code"""
150
group = dbus.Interface(bus.get_object
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
service.name, service.type)
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
178
class Client(dbus.service.Object):
300
if self.group is None:
301
self.group = dbus.Interface(
302
self.bus.get_object(avahi.DBUS_NAME,
303
self.server.EntryGroupNew()),
304
avahi.DBUS_INTERFACE_ENTRY_GROUP)
305
self.entry_group_state_changed_match = (
306
self.group.connect_to_signal(
307
'StateChanged', self.entry_group_state_changed))
308
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
309
self.name, self.type)
310
self.group.AddService(
313
dbus.UInt32(0), # flags
314
self.name, self.type,
315
self.domain, self.host,
316
dbus.UInt16(self.port),
317
avahi.string_array_to_txt_array(self.TXT))
320
def entry_group_state_changed(self, state, error):
321
"""Derived from the Avahi example code"""
322
logger.debug("Avahi entry group state change: %i", state)
324
if state == avahi.ENTRY_GROUP_ESTABLISHED:
325
logger.debug("Zeroconf service established.")
326
elif state == avahi.ENTRY_GROUP_COLLISION:
327
logger.info("Zeroconf service name collision.")
329
elif state == avahi.ENTRY_GROUP_FAILURE:
330
logger.critical("Avahi: Error in group state changed %s",
332
raise AvahiGroupError("State changed: {0!s}"
336
"""Derived from the Avahi example code"""
337
if self.group is not None:
340
except (dbus.exceptions.UnknownMethodException,
341
dbus.exceptions.DBusException):
346
def server_state_changed(self, state, error=None):
347
"""Derived from the Avahi example code"""
348
logger.debug("Avahi server state change: %i", state)
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
356
if state in bad_states:
357
if bad_states[state] is not None:
359
logger.error(bad_states[state])
361
logger.error(bad_states[state] + ": %r", error)
363
elif state == avahi.SERVER_RUNNING:
367
logger.debug("Unknown state: %r", state)
369
logger.debug("Unknown state: %r: %r", state, error)
372
"""Derived from the Avahi example code"""
373
if self.server is None:
374
self.server = dbus.Interface(
375
self.bus.get_object(avahi.DBUS_NAME,
376
avahi.DBUS_PATH_SERVER,
377
follow_name_owner_changes=True),
378
avahi.DBUS_INTERFACE_SERVER)
379
self.server.connect_to_signal("StateChanged",
380
self.server_state_changed)
381
self.server_state_changed(self.server.GetState())
384
class AvahiServiceToSyslog(AvahiService):
386
"""Add the new name to the syslog messages"""
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
402
class Client(object):
179
403
"""A representation of a client host served by this server.
181
name: string; from the config file, used in log messages
406
approved: bool(); 'None' if not yet approved/disapproved
407
approval_delay: datetime.timedelta(); Time to wait for approval
408
approval_duration: datetime.timedelta(); Duration of one approval
409
checker: subprocess.Popen(); a running checker process used
410
to see if the client lives.
411
'None' if no process is running.
412
checker_callback_tag: a gobject event source tag, or None
413
checker_command: string; External command which is run to check
414
if client lives. %() expansions are done at
415
runtime with vars(self) as dict, so that for
416
instance %(name)s can be used in the command.
417
checker_initiator_tag: a gobject event source tag, or None
418
created: datetime.datetime(); (UTC) object creation
419
client_structure: Object describing what attributes a client has
420
and is used for storing the client at exit
421
current_checker_command: string; current running checker_command
422
disable_initiator_tag: a gobject event source tag, or None
182
424
fingerprint: string (40 or 32 hexadecimal digits); used to
183
425
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
426
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
427
interval: datetime.timedelta(); How often to start a new checker
428
last_approval_request: datetime.datetime(); (UTC) or None
189
429
last_checked_ok: datetime.datetime(); (UTC) or None
430
last_checker_status: integer between 0 and 255 reflecting exit
431
status of last checker. -1 reflects crashed
432
checker, -2 means no checker completed yet.
433
last_enabled: datetime.datetime(); (UTC) or None
434
name: string; from the config file, used in log messages and
436
secret: bytestring; sent verbatim (over TLS) to client
190
437
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
197
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
199
checker_callback_tag: - '' -
200
checker_command: string; External command which is run to check if
201
client lives. %() expansions are done at
202
runtime with vars(self) as dict, so that for
203
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
438
until this client is disabled
439
extended_timeout: extra long timeout when secret has been sent
440
runtime_expansions: Allowed attributes for runtime expansion.
441
expires: datetime.datetime(); time (UTC) when a client will be
445
runtime_expansions = ("approval_delay", "approval_duration",
446
"created", "enabled", "expires",
447
"fingerprint", "host", "interval",
448
"last_approval_request", "last_checked_ok",
449
"last_enabled", "name", "timeout")
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
453
"checker": "fping -q -- %%(host)s",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
207
461
def timeout_milliseconds(self):
208
462
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
463
return timedelta_to_milliseconds(self.timeout)
465
def extended_timeout_milliseconds(self):
466
"Return the 'extended_timeout' attribute in milliseconds"
467
return timedelta_to_milliseconds(self.extended_timeout)
213
469
def interval_milliseconds(self):
214
470
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
219
def __init__(self, name = None, disable_hook=None, config=None,
221
"""Note: the 'checker' key in 'config' sets the
222
'checker_command' attribute and *not* the 'checker'
471
return timedelta_to_milliseconds(self.interval)
473
def approval_delay_milliseconds(self):
474
return timedelta_to_milliseconds(self.approval_delay)
477
def config_parser(config):
478
"""Construct a new dict of client settings of this form:
479
{ client_name: {setting_name: value, ...}, ...}
480
with exceptions for any special settings as defined above.
481
NOTE: Must be a pure function. Must return the same result
482
value given the same arguments.
485
for client_name in config.sections():
486
section = dict(config.items(client_name))
487
client = settings[client_name] = {}
489
client["host"] = section["host"]
490
# Reformat values from string types to Python types
491
client["approved_by_default"] = config.getboolean(
492
client_name, "approved_by_default")
493
client["enabled"] = config.getboolean(client_name,
496
client["fingerprint"] = (section["fingerprint"].upper()
498
if "secret" in section:
499
client["secret"] = section["secret"].decode("base64")
500
elif "secfile" in section:
501
with open(os.path.expanduser(os.path.expandvars
502
(section["secfile"])),
504
client["secret"] = secfile.read()
506
raise TypeError("No secret or secfile for section {0}"
508
client["timeout"] = string_to_delta(section["timeout"])
509
client["extended_timeout"] = string_to_delta(
510
section["extended_timeout"])
511
client["interval"] = string_to_delta(section["interval"])
512
client["approval_delay"] = string_to_delta(
513
section["approval_delay"])
514
client["approval_duration"] = string_to_delta(
515
section["approval_duration"])
516
client["checker_command"] = section["checker"]
517
client["last_approval_request"] = None
518
client["last_checked_ok"] = None
519
client["last_checker_status"] = -2
523
def __init__(self, settings, name = None):
227
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
230
self.dbus_object_path = (dbus.ObjectPath
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
525
# adding all client settings
526
for setting, value in settings.iteritems():
527
setattr(self, setting, value)
530
if not hasattr(self, "last_enabled"):
531
self.last_enabled = datetime.datetime.utcnow()
532
if not hasattr(self, "expires"):
533
self.expires = (datetime.datetime.utcnow()
536
self.last_enabled = None
539
logger.debug("Creating client %r", self.name)
235
540
# Uppercase and remove spaces from fingerprint for later
236
541
# comparison purposes with return value from the fingerprint()
238
self.fingerprint = (config["fingerprint"].upper()
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
if "secret" in config:
242
self.secret = config["secret"].decode(u"base64")
243
elif "secfile" in config:
244
with closing(open(os.path.expanduser
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
249
raise TypeError(u"No secret or secfile for client %s"
251
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
254
self.last_enabled = None
255
self.last_checked_ok = None
256
self.timeout = string_to_delta(config["timeout"])
257
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
543
logger.debug(" Fingerprint: %s", self.fingerprint)
544
self.created = settings.get("created",
545
datetime.datetime.utcnow())
547
# attributes specific for this server instance
259
548
self.checker = None
260
549
self.checker_initiator_tag = None
261
550
self.disable_initiator_tag = None
262
551
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
552
self.current_checker_command = None
554
self.approvals_pending = 0
555
self.changedstate = (multiprocessing_manager
556
.Condition(multiprocessing_manager
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
560
if not attr.startswith("_")]
561
self.client_structure.append("client_structure")
563
for name, t in inspect.getmembers(type(self),
567
if not name.startswith("_"):
568
self.client_structure.append(name)
570
# Send notice to process children that client state has changed
571
def send_changedstate(self):
572
with self.changedstate:
573
self.changedstate.notify_all()
265
575
def enable(self):
266
576
"""Start this client's checker and timeout hooks"""
577
if getattr(self, "enabled", False):
580
self.expires = datetime.datetime.utcnow() + self.timeout
267
582
self.last_enabled = datetime.datetime.utcnow()
584
self.send_changedstate()
586
def disable(self, quiet=True):
587
"""Disable this client."""
588
if not getattr(self, "enabled", False):
591
logger.info("Disabling client %s", self.name)
592
if getattr(self, "disable_initiator_tag", None) is not None:
593
gobject.source_remove(self.disable_initiator_tag)
594
self.disable_initiator_tag = None
596
if getattr(self, "checker_initiator_tag", None) is not None:
597
gobject.source_remove(self.checker_initiator_tag)
598
self.checker_initiator_tag = None
602
self.send_changedstate()
603
# Do not run this again if called by a gobject.timeout_add
609
def init_checker(self):
268
610
# Schedule a new checker to be started an 'interval' from now,
269
611
# and every interval from then on.
612
if self.checker_initiator_tag is not None:
613
gobject.source_remove(self.checker_initiator_tag)
270
614
self.checker_initiator_tag = (gobject.timeout_add
271
615
(self.interval_milliseconds(),
272
616
self.start_checker))
273
# Also start a new checker *right now*.
275
617
# Schedule a disable() when 'timeout' has passed
618
if self.disable_initiator_tag is not None:
619
gobject.source_remove(self.disable_initiator_tag)
276
620
self.disable_initiator_tag = (gobject.timeout_add
277
621
(self.timeout_milliseconds(),
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
296
if getattr(self, "checker_initiator_tag", False):
297
gobject.source_remove(self.checker_initiator_tag)
298
self.checker_initiator_tag = None
300
if self.disable_hook:
301
self.disable_hook(self)
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
307
# Do not run this again if called by a gobject.timeout_add
311
self.disable_hook = None
623
# Also start a new checker *right now*.
314
626
def checker_callback(self, pid, condition, command):
315
627
"""The checker has completed, so take appropriate actions."""
316
628
self.checker_callback_tag = None
317
629
self.checker = None
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
324
logger.info(u"Checker for %(name)s succeeded",
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
332
elif not os.WIFEXITED(condition):
333
logger.warning(u"Checker for %(name)s crashed?",
630
if os.WIFEXITED(condition):
631
self.last_checker_status = os.WEXITSTATUS(condition)
632
if self.last_checker_status == 0:
633
logger.info("Checker for %(name)s succeeded",
637
logger.info("Checker for %(name)s failed",
640
self.last_checker_status = -1
641
logger.warning("Checker for %(name)s crashed?",
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
341
logger.info(u"Checker for %(name)s failed",
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
644
def checked_ok(self):
645
"""Assert that the client has been seen, alive and well."""
354
646
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
647
self.last_checker_status = 0
650
def bump_timeout(self, timeout=None):
651
"""Bump up the timeout for this client."""
653
timeout = self.timeout
654
if self.disable_initiator_tag is not None:
655
gobject.source_remove(self.disable_initiator_tag)
656
self.disable_initiator_tag = None
657
if getattr(self, "enabled", False):
658
self.disable_initiator_tag = (gobject.timeout_add
659
(timedelta_to_milliseconds
660
(timeout), self.disable))
661
self.expires = datetime.datetime.utcnow() + timeout
663
def need_approval(self):
664
self.last_approval_request = datetime.datetime.utcnow()
366
666
def start_checker(self):
367
667
"""Start a new checker subprocess if one is not running.
368
669
If a checker already exists, leave it running and do
370
671
# The reason for not killing a running checker is that if we
371
# did that, then if a checker (for some reason) started
372
# running slowly and taking more than 'interval' time, the
373
# client would inevitably timeout, since no checker would get
374
# a chance to run to completion. If we instead leave running
672
# did that, and if a checker (for some reason) started running
673
# slowly and taking more than 'interval' time, then the client
674
# would inevitably timeout, since no checker would get a
675
# chance to run to completion. If we instead leave running
375
676
# checkers alone, the checker would have to take more time
376
# than 'timeout' for the client to be declared invalid, which
377
# is as it should be.
677
# than 'timeout' for the client to be disabled, which is as it
680
# If a checker exists, make sure it is not a zombie
682
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
683
except (AttributeError, OSError) as error:
684
if (isinstance(error, OSError)
685
and error.errno != errno.ECHILD):
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
693
# Start a new checker if needed
378
694
if self.checker is None:
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
383
# Escape attributes for the shell
384
escaped_attrs = dict((key, re.escape(str(val)))
386
vars(self).iteritems())
388
command = self.checker_command % escaped_attrs
389
except TypeError, error:
390
logger.error(u'Could not format string "%s":'
391
u' %s', self.checker_command, error)
392
return True # Try again later
394
logger.info(u"Starting checker %r for %s",
695
# Escape attributes for the shell
696
escaped_attrs = dict(
697
(attr, re.escape(unicode(getattr(self, attr))))
699
self.runtime_expansions)
701
command = self.checker_command % escaped_attrs
702
except TypeError as error:
703
logger.error('Could not format string "%s"',
704
self.checker_command, exc_info=error)
705
return True # Try again later
706
self.current_checker_command = command
708
logger.info("Starting checker %r for %s",
395
709
command, self.name)
396
710
# We don't need to redirect stdout and stderr, since
397
711
# in normal mode, that is already done by daemon(),
423
744
self.checker_callback_tag = None
424
745
if getattr(self, "checker", None) is None:
426
logger.debug(u"Stopping checker for %(name)s", vars(self))
747
logger.debug("Stopping checker for %(name)s", vars(self))
428
os.kill(self.checker.pid, signal.SIGTERM)
749
self.checker.terminate()
430
751
#if self.checker.poll() is None:
431
# os.kill(self.checker.pid, signal.SIGKILL)
432
except OSError, error:
752
# self.checker.kill()
753
except OSError as error:
433
754
if error.errno != errno.ESRCH: # No such process
435
756
self.checker = None
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
440
def still_valid(self):
441
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
444
now = datetime.datetime.utcnow()
445
if self.last_checked_ok is None:
446
return now < (self.created + self.timeout)
448
return now < (self.last_checked_ok + self.timeout)
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
759
def dbus_service_property(dbus_interface, signature="v",
760
access="readwrite", byte_arrays=False):
761
"""Decorators for marking methods of a DBusObjectWithProperties to
762
become properties on the D-Bus.
764
The decorated method will be called with no arguments by "Get"
765
and with one argument by "Set".
767
The parameters, where they are supported, are the same as
768
dbus.service.method, except there is only "signature", since the
769
type from Get() and the type sent to Set() is the same.
771
# Encoding deeply encoded byte arrays is not supported yet by the
772
# "Set" method, so we fail early here:
773
if byte_arrays and signature != "ay":
774
raise ValueError("Byte arrays not supported for non-'ay'"
775
" signature {0!r}".format(signature))
777
func._dbus_is_property = True
778
func._dbus_interface = dbus_interface
779
func._dbus_signature = signature
780
func._dbus_access = access
781
func._dbus_name = func.__name__
782
if func._dbus_name.endswith("_dbus_property"):
783
func._dbus_name = func._dbus_name[:-14]
784
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
789
def dbus_interface_annotations(dbus_interface):
790
"""Decorator for marking functions returning interface annotations
794
@dbus_interface_annotations("org.example.Interface")
795
def _foo(self): # Function name does not matter
796
return {"org.freedesktop.DBus.Deprecated": "true",
797
"org.freedesktop.DBus.Property.EmitsChangedSignal":
801
func._dbus_is_interface = True
802
func._dbus_interface = dbus_interface
803
func._dbus_name = dbus_interface
808
def dbus_annotations(annotations):
809
"""Decorator to annotate D-Bus methods, signals or properties
812
@dbus_service_property("org.example.Interface", signature="b",
814
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
815
"org.freedesktop.DBus.Property."
816
"EmitsChangedSignal": "false"})
817
def Property_dbus_property(self):
818
return dbus.Boolean(False)
821
func._dbus_annotations = annotations
826
class DBusPropertyException(dbus.exceptions.DBusException):
827
"""A base class for D-Bus property-related exceptions
829
def __unicode__(self):
830
return unicode(str(self))
833
class DBusPropertyAccessException(DBusPropertyException):
834
"""A property's access permissions disallows an operation.
839
class DBusPropertyNotFound(DBusPropertyException):
840
"""An attempt was made to access a non-existing property.
845
class DBusObjectWithProperties(dbus.service.Object):
846
"""A D-Bus object with properties.
848
Classes inheriting from this can use the dbus_service_property
849
decorator to expose methods as D-Bus properties. It exposes the
850
standard Get(), Set(), and GetAll() methods on the D-Bus.
854
def _is_dbus_thing(thing):
855
"""Returns a function testing if an attribute is a D-Bus thing
857
If called like _is_dbus_thing("method") it returns a function
858
suitable for use as predicate to inspect.getmembers().
860
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
863
def _get_all_dbus_things(self, thing):
864
"""Returns a generator of (name, attribute) pairs
866
return ((getattr(athing.__get__(self), "_dbus_name",
868
athing.__get__(self))
869
for cls in self.__class__.__mro__
871
inspect.getmembers(cls,
872
self._is_dbus_thing(thing)))
874
def _get_dbus_property(self, interface_name, property_name):
875
"""Returns a bound method if one exists which is a D-Bus
876
property with the specified name and interface.
878
for cls in self.__class__.__mro__:
879
for name, value in (inspect.getmembers
881
self._is_dbus_thing("property"))):
882
if (value._dbus_name == property_name
883
and value._dbus_interface == interface_name):
884
return value.__get__(self)
887
raise DBusPropertyNotFound(self.dbus_object_path + ":"
888
+ interface_name + "."
891
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
893
def Get(self, interface_name, property_name):
894
"""Standard D-Bus property Get() method, see D-Bus standard.
896
prop = self._get_dbus_property(interface_name, property_name)
897
if prop._dbus_access == "write":
898
raise DBusPropertyAccessException(property_name)
900
if not hasattr(value, "variant_level"):
902
return type(value)(value, variant_level=value.variant_level+1)
904
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
905
def Set(self, interface_name, property_name, value):
906
"""Standard D-Bus property Set() method, see D-Bus standard.
908
prop = self._get_dbus_property(interface_name, property_name)
909
if prop._dbus_access == "read":
910
raise DBusPropertyAccessException(property_name)
911
if prop._dbus_get_args_options["byte_arrays"]:
912
# The byte_arrays option is not supported yet on
913
# signatures other than "ay".
914
if prop._dbus_signature != "ay":
916
value = dbus.ByteArray(b''.join(chr(byte)
920
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
921
out_signature="a{sv}")
922
def GetAll(self, interface_name):
923
"""Standard D-Bus property GetAll() method, see D-Bus
926
Note: Will not include properties with access="write".
929
for name, prop in self._get_all_dbus_things("property"):
931
and interface_name != prop._dbus_interface):
932
# Interface non-empty but did not match
934
# Ignore write-only properties
935
if prop._dbus_access == "write":
938
if not hasattr(value, "variant_level"):
939
properties[name] = value
941
properties[name] = type(value)(value, variant_level=
942
value.variant_level+1)
943
return dbus.Dictionary(properties, signature="sv")
945
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
947
path_keyword='object_path',
948
connection_keyword='connection')
949
def Introspect(self, object_path, connection):
950
"""Overloading of standard D-Bus method.
952
Inserts property tags and interface annotation tags.
954
xmlstring = dbus.service.Object.Introspect(self, object_path,
957
document = xml.dom.minidom.parseString(xmlstring)
958
def make_tag(document, name, prop):
959
e = document.createElement("property")
960
e.setAttribute("name", name)
961
e.setAttribute("type", prop._dbus_signature)
962
e.setAttribute("access", prop._dbus_access)
964
for if_tag in document.getElementsByTagName("interface"):
966
for tag in (make_tag(document, name, prop)
968
in self._get_all_dbus_things("property")
969
if prop._dbus_interface
970
== if_tag.getAttribute("name")):
971
if_tag.appendChild(tag)
972
# Add annotation tags
973
for typ in ("method", "signal", "property"):
974
for tag in if_tag.getElementsByTagName(typ):
976
for name, prop in (self.
977
_get_all_dbus_things(typ)):
978
if (name == tag.getAttribute("name")
979
and prop._dbus_interface
980
== if_tag.getAttribute("name")):
981
annots.update(getattr
985
for name, value in annots.iteritems():
986
ann_tag = document.createElement(
988
ann_tag.setAttribute("name", name)
989
ann_tag.setAttribute("value", value)
990
tag.appendChild(ann_tag)
991
# Add interface annotation tags
992
for annotation, value in dict(
993
itertools.chain.from_iterable(
994
annotations().iteritems()
995
for name, annotations in
996
self._get_all_dbus_things("interface")
997
if name == if_tag.getAttribute("name")
999
ann_tag = document.createElement("annotation")
1000
ann_tag.setAttribute("name", annotation)
1001
ann_tag.setAttribute("value", value)
1002
if_tag.appendChild(ann_tag)
1003
# Add the names to the return values for the
1004
# "org.freedesktop.DBus.Properties" methods
1005
if (if_tag.getAttribute("name")
1006
== "org.freedesktop.DBus.Properties"):
1007
for cn in if_tag.getElementsByTagName("method"):
1008
if cn.getAttribute("name") == "Get":
1009
for arg in cn.getElementsByTagName("arg"):
1010
if (arg.getAttribute("direction")
1012
arg.setAttribute("name", "value")
1013
elif cn.getAttribute("name") == "GetAll":
1014
for arg in cn.getElementsByTagName("arg"):
1015
if (arg.getAttribute("direction")
1017
arg.setAttribute("name", "props")
1018
xmlstring = document.toxml("utf-8")
1020
except (AttributeError, xml.dom.DOMException,
1021
xml.parsers.expat.ExpatError) as error:
1022
logger.error("Failed to override Introspection method",
1027
def datetime_to_dbus(dt, variant_level=0):
1028
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1030
return dbus.String("", variant_level = variant_level)
1031
return dbus.String(dt.isoformat(),
1032
variant_level=variant_level)
1035
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1036
"""A class decorator; applied to a subclass of
1037
dbus.service.Object, it will add alternate D-Bus attributes with
1038
interface names according to the "alt_interface_names" mapping.
1041
@alternate_dbus_interfaces({"org.example.Interface":
1042
"net.example.AlternateInterface"})
1043
class SampleDBusObject(dbus.service.Object):
1044
@dbus.service.method("org.example.Interface")
1045
def SampleDBusMethod():
1048
The above "SampleDBusMethod" on "SampleDBusObject" will be
1049
reachable via two interfaces: "org.example.Interface" and
1050
"net.example.AlternateInterface", the latter of which will have
1051
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1052
"true", unless "deprecate" is passed with a False value.
1054
This works for methods and signals, and also for D-Bus properties
1055
(from DBusObjectWithProperties) and interfaces (from the
1056
dbus_interface_annotations decorator).
1059
for orig_interface_name, alt_interface_name in (
1060
alt_interface_names.iteritems()):
1062
interface_names = set()
1063
# Go though all attributes of the class
1064
for attrname, attribute in inspect.getmembers(cls):
1065
# Ignore non-D-Bus attributes, and D-Bus attributes
1066
# with the wrong interface name
1067
if (not hasattr(attribute, "_dbus_interface")
1068
or not attribute._dbus_interface
1069
.startswith(orig_interface_name)):
1071
# Create an alternate D-Bus interface name based on
1073
alt_interface = (attribute._dbus_interface
1074
.replace(orig_interface_name,
1075
alt_interface_name))
1076
interface_names.add(alt_interface)
1077
# Is this a D-Bus signal?
1078
if getattr(attribute, "_dbus_is_signal", False):
1079
# Extract the original non-method function by
1081
nonmethod_func = (dict(
1082
zip(attribute.func_code.co_freevars,
1083
attribute.__closure__))["func"]
1085
# Create a new, but exactly alike, function
1086
# object, and decorate it to be a new D-Bus signal
1087
# with the alternate D-Bus interface name
1088
new_function = (dbus.service.signal
1090
attribute._dbus_signature)
1091
(types.FunctionType(
1092
nonmethod_func.func_code,
1093
nonmethod_func.func_globals,
1094
nonmethod_func.func_name,
1095
nonmethod_func.func_defaults,
1096
nonmethod_func.func_closure)))
1097
# Copy annotations, if any
1099
new_function._dbus_annotations = (
1100
dict(attribute._dbus_annotations))
1101
except AttributeError:
1103
# Define a creator of a function to call both the
1104
# original and alternate functions, so both the
1105
# original and alternate signals gets sent when
1106
# the function is called
1107
def fixscope(func1, func2):
1108
"""This function is a scope container to pass
1109
func1 and func2 to the "call_both" function
1110
outside of its arguments"""
1111
def call_both(*args, **kwargs):
1112
"""This function will emit two D-Bus
1113
signals by calling func1 and func2"""
1114
func1(*args, **kwargs)
1115
func2(*args, **kwargs)
1117
# Create the "call_both" function and add it to
1119
attr[attrname] = fixscope(attribute, new_function)
1120
# Is this a D-Bus method?
1121
elif getattr(attribute, "_dbus_is_method", False):
1122
# Create a new, but exactly alike, function
1123
# object. Decorate it to be a new D-Bus method
1124
# with the alternate D-Bus interface name. Add it
1126
attr[attrname] = (dbus.service.method
1128
attribute._dbus_in_signature,
1129
attribute._dbus_out_signature)
1131
(attribute.func_code,
1132
attribute.func_globals,
1133
attribute.func_name,
1134
attribute.func_defaults,
1135
attribute.func_closure)))
1136
# Copy annotations, if any
1138
attr[attrname]._dbus_annotations = (
1139
dict(attribute._dbus_annotations))
1140
except AttributeError:
1142
# Is this a D-Bus property?
1143
elif getattr(attribute, "_dbus_is_property", False):
1144
# Create a new, but exactly alike, function
1145
# object, and decorate it to be a new D-Bus
1146
# property with the alternate D-Bus interface
1147
# name. Add it to the class.
1148
attr[attrname] = (dbus_service_property
1150
attribute._dbus_signature,
1151
attribute._dbus_access,
1153
._dbus_get_args_options
1156
(attribute.func_code,
1157
attribute.func_globals,
1158
attribute.func_name,
1159
attribute.func_defaults,
1160
attribute.func_closure)))
1161
# Copy annotations, if any
1163
attr[attrname]._dbus_annotations = (
1164
dict(attribute._dbus_annotations))
1165
except AttributeError:
1167
# Is this a D-Bus interface?
1168
elif getattr(attribute, "_dbus_is_interface", False):
1169
# Create a new, but exactly alike, function
1170
# object. Decorate it to be a new D-Bus interface
1171
# with the alternate D-Bus interface name. Add it
1173
attr[attrname] = (dbus_interface_annotations
1176
(attribute.func_code,
1177
attribute.func_globals,
1178
attribute.func_name,
1179
attribute.func_defaults,
1180
attribute.func_closure)))
1182
# Deprecate all alternate interfaces
1183
iname="_AlternateDBusNames_interface_annotation{0}"
1184
for interface_name in interface_names:
1185
@dbus_interface_annotations(interface_name)
1187
return { "org.freedesktop.DBus.Deprecated":
1189
# Find an unused name
1190
for aname in (iname.format(i)
1191
for i in itertools.count()):
1192
if aname not in attr:
1196
# Replace the class with a new subclass of it with
1197
# methods, signals, etc. as created above.
1198
cls = type(b"{0}Alternate".format(cls.__name__),
1204
@alternate_dbus_interfaces({"se.recompile.Mandos":
1205
"se.bsnet.fukt.Mandos"})
1206
class ClientDBus(Client, DBusObjectWithProperties):
1207
"""A Client class using D-Bus
1210
dbus_object_path: dbus.ObjectPath
1211
bus: dbus.SystemBus()
1214
runtime_expansions = (Client.runtime_expansions
1215
+ ("dbus_object_path",))
1217
# dbus.service.Object doesn't use super(), so we can't either.
1219
def __init__(self, bus = None, *args, **kwargs):
1221
Client.__init__(self, *args, **kwargs)
1222
# Only now, when this client is initialized, can it show up on
1224
client_object_name = unicode(self.name).translate(
1225
{ord("."): ord("_"),
1226
ord("-"): ord("_")})
1227
self.dbus_object_path = (dbus.ObjectPath
1228
("/clients/" + client_object_name))
1229
DBusObjectWithProperties.__init__(self, self.bus,
1230
self.dbus_object_path)
1232
def notifychangeproperty(transform_func,
1233
dbus_name, type_func=lambda x: x,
1235
""" Modify a variable so that it's a property which announces
1236
its changes to DBus.
1238
transform_fun: Function that takes a value and a variant_level
1239
and transforms it to a D-Bus type.
1240
dbus_name: D-Bus name of the variable
1241
type_func: Function that transform the value before sending it
1242
to the D-Bus. Default: no transform
1243
variant_level: D-Bus variant level. Default: 1
1245
attrname = "_{0}".format(dbus_name)
1246
def setter(self, value):
1247
if hasattr(self, "dbus_object_path"):
1248
if (not hasattr(self, attrname) or
1249
type_func(getattr(self, attrname, None))
1250
!= type_func(value)):
1251
dbus_value = transform_func(type_func(value),
1254
self.PropertyChanged(dbus.String(dbus_name),
1256
setattr(self, attrname, value)
1258
return property(lambda self: getattr(self, attrname), setter)
1260
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1261
approvals_pending = notifychangeproperty(dbus.Boolean,
1264
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1265
last_enabled = notifychangeproperty(datetime_to_dbus,
1267
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1268
type_func = lambda checker:
1269
checker is not None)
1270
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1272
last_checker_status = notifychangeproperty(dbus.Int16,
1273
"LastCheckerStatus")
1274
last_approval_request = notifychangeproperty(
1275
datetime_to_dbus, "LastApprovalRequest")
1276
approved_by_default = notifychangeproperty(dbus.Boolean,
1277
"ApprovedByDefault")
1278
approval_delay = notifychangeproperty(dbus.UInt64,
1281
timedelta_to_milliseconds)
1282
approval_duration = notifychangeproperty(
1283
dbus.UInt64, "ApprovalDuration",
1284
type_func = timedelta_to_milliseconds)
1285
host = notifychangeproperty(dbus.String, "Host")
1286
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1288
timedelta_to_milliseconds)
1289
extended_timeout = notifychangeproperty(
1290
dbus.UInt64, "ExtendedTimeout",
1291
type_func = timedelta_to_milliseconds)
1292
interval = notifychangeproperty(dbus.UInt64,
1295
timedelta_to_milliseconds)
1296
checker_command = notifychangeproperty(dbus.String, "Checker")
1298
del notifychangeproperty
1300
def __del__(self, *args, **kwargs):
1302
self.remove_from_connection()
1305
if hasattr(DBusObjectWithProperties, "__del__"):
1306
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1307
Client.__del__(self, *args, **kwargs)
1309
def checker_callback(self, pid, condition, command,
1311
self.checker_callback_tag = None
1313
if os.WIFEXITED(condition):
1314
exitstatus = os.WEXITSTATUS(condition)
1316
self.CheckerCompleted(dbus.Int16(exitstatus),
1317
dbus.Int64(condition),
1318
dbus.String(command))
1321
self.CheckerCompleted(dbus.Int16(-1),
1322
dbus.Int64(condition),
1323
dbus.String(command))
1325
return Client.checker_callback(self, pid, condition, command,
1328
def start_checker(self, *args, **kwargs):
1329
old_checker = self.checker
1330
if self.checker is not None:
1331
old_checker_pid = self.checker.pid
1333
old_checker_pid = None
1334
r = Client.start_checker(self, *args, **kwargs)
1335
# Only if new checker process was started
1336
if (self.checker is not None
1337
and old_checker_pid != self.checker.pid):
1339
self.CheckerStarted(self.current_checker_command)
1342
def _reset_approved(self):
1343
self.approved = None
1346
def approve(self, value=True):
1347
self.approved = value
1348
gobject.timeout_add(timedelta_to_milliseconds
1349
(self.approval_duration),
1350
self._reset_approved)
1351
self.send_changedstate()
1353
## D-Bus methods, signals & properties
1354
_interface = "se.recompile.Mandos.Client"
1358
@dbus_interface_annotations(_interface)
1360
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
457
1365
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
1366
@dbus.service.signal(_interface, signature="nxs")
1367
def CheckerCompleted(self, exitcode, waitstatus, command):
579
1434
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
1435
@dbus.service.method(_interface)
1436
def StopChecker(self):
1441
# ApprovalPending - property
1442
@dbus_service_property(_interface, signature="b", access="read")
1443
def ApprovalPending_dbus_property(self):
1444
return dbus.Boolean(bool(self.approvals_pending))
1446
# ApprovedByDefault - property
1447
@dbus_service_property(_interface, signature="b",
1449
def ApprovedByDefault_dbus_property(self, value=None):
1450
if value is None: # get
1451
return dbus.Boolean(self.approved_by_default)
1452
self.approved_by_default = bool(value)
1454
# ApprovalDelay - property
1455
@dbus_service_property(_interface, signature="t",
1457
def ApprovalDelay_dbus_property(self, value=None):
1458
if value is None: # get
1459
return dbus.UInt64(self.approval_delay_milliseconds())
1460
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1462
# ApprovalDuration - property
1463
@dbus_service_property(_interface, signature="t",
1465
def ApprovalDuration_dbus_property(self, value=None):
1466
if value is None: # get
1467
return dbus.UInt64(timedelta_to_milliseconds(
1468
self.approval_duration))
1469
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1472
@dbus_service_property(_interface, signature="s", access="read")
1473
def Name_dbus_property(self):
1474
return dbus.String(self.name)
1476
# Fingerprint - property
1477
@dbus_service_property(_interface, signature="s", access="read")
1478
def Fingerprint_dbus_property(self):
1479
return dbus.String(self.fingerprint)
1482
@dbus_service_property(_interface, signature="s",
1484
def Host_dbus_property(self, value=None):
1485
if value is None: # get
1486
return dbus.String(self.host)
1487
self.host = unicode(value)
1489
# Created - property
1490
@dbus_service_property(_interface, signature="s", access="read")
1491
def Created_dbus_property(self):
1492
return datetime_to_dbus(self.created)
1494
# LastEnabled - property
1495
@dbus_service_property(_interface, signature="s", access="read")
1496
def LastEnabled_dbus_property(self):
1497
return datetime_to_dbus(self.last_enabled)
1499
# Enabled - property
1500
@dbus_service_property(_interface, signature="b",
1502
def Enabled_dbus_property(self, value=None):
1503
if value is None: # get
1504
return dbus.Boolean(self.enabled)
1510
# LastCheckedOK - property
1511
@dbus_service_property(_interface, signature="s",
1513
def LastCheckedOK_dbus_property(self, value=None):
1514
if value is not None:
1517
return datetime_to_dbus(self.last_checked_ok)
1519
# LastCheckerStatus - property
1520
@dbus_service_property(_interface, signature="n",
1522
def LastCheckerStatus_dbus_property(self):
1523
return dbus.Int16(self.last_checker_status)
1525
# Expires - property
1526
@dbus_service_property(_interface, signature="s", access="read")
1527
def Expires_dbus_property(self):
1528
return datetime_to_dbus(self.expires)
1530
# LastApprovalRequest - property
1531
@dbus_service_property(_interface, signature="s", access="read")
1532
def LastApprovalRequest_dbus_property(self):
1533
return datetime_to_dbus(self.last_approval_request)
1535
# Timeout - property
1536
@dbus_service_property(_interface, signature="t",
1538
def Timeout_dbus_property(self, value=None):
1539
if value is None: # get
1540
return dbus.UInt64(self.timeout_milliseconds())
1541
old_timeout = self.timeout
1542
self.timeout = datetime.timedelta(0, 0, 0, value)
1543
# Reschedule disabling
1545
now = datetime.datetime.utcnow()
1546
self.expires += self.timeout - old_timeout
1547
if self.expires <= now:
1548
# The timeout has passed
1551
if (getattr(self, "disable_initiator_tag", None)
1554
gobject.source_remove(self.disable_initiator_tag)
1555
self.disable_initiator_tag = (
1556
gobject.timeout_add(
1557
timedelta_to_milliseconds(self.expires - now),
1560
# ExtendedTimeout - property
1561
@dbus_service_property(_interface, signature="t",
1563
def ExtendedTimeout_dbus_property(self, value=None):
1564
if value is None: # get
1565
return dbus.UInt64(self.extended_timeout_milliseconds())
1566
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1568
# Interval - property
1569
@dbus_service_property(_interface, signature="t",
1571
def Interval_dbus_property(self, value=None):
1572
if value is None: # get
1573
return dbus.UInt64(self.interval_milliseconds())
1574
self.interval = datetime.timedelta(0, 0, 0, value)
1575
if getattr(self, "checker_initiator_tag", None) is None:
1578
# Reschedule checker run
1579
gobject.source_remove(self.checker_initiator_tag)
1580
self.checker_initiator_tag = (gobject.timeout_add
1581
(value, self.start_checker))
1582
self.start_checker() # Start one now, too
1584
# Checker - property
1585
@dbus_service_property(_interface, signature="s",
1587
def Checker_dbus_property(self, value=None):
1588
if value is None: # get
1589
return dbus.String(self.checker_command)
1590
self.checker_command = unicode(value)
1592
# CheckerRunning - property
1593
@dbus_service_property(_interface, signature="b",
1595
def CheckerRunning_dbus_property(self, value=None):
1596
if value is None: # get
1597
return dbus.Boolean(self.checker is not None)
1599
self.start_checker()
1603
# ObjectPath - property
1604
@dbus_service_property(_interface, signature="o", access="read")
1605
def ObjectPath_dbus_property(self):
1606
return self.dbus_object_path # is already a dbus.ObjectPath
1609
@dbus_service_property(_interface, signature="ay",
1610
access="write", byte_arrays=True)
1611
def Secret_dbus_property(self, value):
1612
self.secret = str(value)
586
def peer_certificate(session):
587
"Return the peer's OpenPGP certificate as a bytestring"
588
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
592
# ...do the normal thing
593
return session.peer_certificate
594
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
598
if list_size.value == 0:
601
return ctypes.string_at(cert.data, cert.size)
604
def fingerprint(openpgp):
605
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
611
ctypes.c_uint(len(openpgp))))
612
# New empty GnuTLS certificate
613
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
616
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
621
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
628
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
631
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
635
# Deinit the certificate
636
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
639
# Convert the bytestring to hexadecimal notation
640
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
645
"""A TCP request handler class.
646
Instantiated by IPv6_TCPServer for each request to handle it.
1617
class ProxyClient(object):
1618
def __init__(self, child_pipe, fpr, address):
1619
self._pipe = child_pipe
1620
self._pipe.send(('init', fpr, address))
1621
if not self._pipe.recv():
1624
def __getattribute__(self, name):
1626
return super(ProxyClient, self).__getattribute__(name)
1627
self._pipe.send(('getattr', name))
1628
data = self._pipe.recv()
1629
if data[0] == 'data':
1631
if data[0] == 'function':
1632
def func(*args, **kwargs):
1633
self._pipe.send(('funcall', name, args, kwargs))
1634
return self._pipe.recv()[1]
1637
def __setattr__(self, name, value):
1639
return super(ProxyClient, self).__setattr__(name, value)
1640
self._pipe.send(('setattr', name, value))
1643
class ClientHandler(socketserver.BaseRequestHandler, object):
1644
"""A class to handle client connections.
1646
Instantiated once for each connection to handle it.
647
1647
Note: This will run in its own forked process."""
649
1649
def handle(self):
650
logger.info(u"TCP connection from: %s",
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
657
line = self.request.makefile().readline()
658
logger.debug(u"Protocol version: %r", line)
660
if int(line.strip().split()[0]) > 1:
662
except (ValueError, IndexError, RuntimeError), error:
663
logger.error(u"Unknown protocol version: %s", error)
666
# Note: gnutls.connection.X509Credentials is really a generic
667
# GnuTLS certificate credentials object so long as no X.509
668
# keys are added to it. Therefore, we can use it here despite
669
# using OpenPGP certificates.
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
682
except gnutls.errors.GNUTLSError, error:
683
logger.warning(u"Handshake failed: %s", error)
684
# Do not run session.bye() here: the session is not
685
# established. Just abandon the request.
688
fpr = fingerprint(peer_certificate(session))
689
except (TypeError, gnutls.errors.GNUTLSError), error:
690
logger.warning(u"Bad certificate: %s", error)
693
logger.debug(u"Fingerprint: %s", fpr)
694
for c in self.server.clients:
695
if c.fingerprint == fpr:
699
logger.warning(u"Client not found for fingerprint: %s",
703
# Have to check if client.still_valid(), since it is possible
704
# that the client timed out while establishing the GnuTLS
706
if not client.still_valid():
707
logger.warning(u"Client %(name)s is invalid",
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
714
while sent_size < len(client.secret):
715
sent = session.send(client.secret[sent_size:])
716
logger.debug(u"Sent: %d, remaining: %d",
717
sent, len(client.secret)
718
- (sent_size + sent))
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1650
with contextlib.closing(self.server.child_pipe) as child_pipe:
1651
logger.info("TCP connection from: %s",
1652
unicode(self.client_address))
1653
logger.debug("Pipe FD: %d",
1654
self.server.child_pipe.fileno())
1656
session = (gnutls.connection
1657
.ClientSession(self.request,
1659
.X509Credentials()))
1661
# Note: gnutls.connection.X509Credentials is really a
1662
# generic GnuTLS certificate credentials object so long as
1663
# no X.509 keys are added to it. Therefore, we can use it
1664
# here despite using OpenPGP certificates.
1666
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1667
# "+AES-256-CBC", "+SHA1",
1668
# "+COMP-NULL", "+CTYPE-OPENPGP",
1670
# Use a fallback default, since this MUST be set.
1671
priority = self.server.gnutls_priority
1672
if priority is None:
1674
(gnutls.library.functions
1675
.gnutls_priority_set_direct(session._c_object,
1678
# Start communication using the Mandos protocol
1679
# Get protocol number
1680
line = self.request.makefile().readline()
1681
logger.debug("Protocol version: %r", line)
1683
if int(line.strip().split()[0]) > 1:
1685
except (ValueError, IndexError, RuntimeError) as error:
1686
logger.error("Unknown protocol version: %s", error)
1689
# Start GnuTLS connection
1692
except gnutls.errors.GNUTLSError as error:
1693
logger.warning("Handshake failed: %s", error)
1694
# Do not run session.bye() here: the session is not
1695
# established. Just abandon the request.
1697
logger.debug("Handshake succeeded")
1699
approval_required = False
1702
fpr = self.fingerprint(self.peer_certificate
1705
gnutls.errors.GNUTLSError) as error:
1706
logger.warning("Bad certificate: %s", error)
1708
logger.debug("Fingerprint: %s", fpr)
1711
client = ProxyClient(child_pipe, fpr,
1712
self.client_address)
1716
if client.approval_delay:
1717
delay = client.approval_delay
1718
client.approvals_pending += 1
1719
approval_required = True
1722
if not client.enabled:
1723
logger.info("Client %s is disabled",
1725
if self.server.use_dbus:
1727
client.Rejected("Disabled")
1730
if client.approved or not client.approval_delay:
1731
#We are approved or approval is disabled
1733
elif client.approved is None:
1734
logger.info("Client %s needs approval",
1736
if self.server.use_dbus:
1738
client.NeedApproval(
1739
client.approval_delay_milliseconds(),
1740
client.approved_by_default)
1742
logger.warning("Client %s was not approved",
1744
if self.server.use_dbus:
1746
client.Rejected("Denied")
1749
#wait until timeout or approved
1750
time = datetime.datetime.now()
1751
client.changedstate.acquire()
1752
client.changedstate.wait(
1753
float(timedelta_to_milliseconds(delay)
1755
client.changedstate.release()
1756
time2 = datetime.datetime.now()
1757
if (time2 - time) >= delay:
1758
if not client.approved_by_default:
1759
logger.warning("Client %s timed out while"
1760
" waiting for approval",
1762
if self.server.use_dbus:
1764
client.Rejected("Approval timed out")
1769
delay -= time2 - time
1772
while sent_size < len(client.secret):
1774
sent = session.send(client.secret[sent_size:])
1775
except gnutls.errors.GNUTLSError as error:
1776
logger.warning("gnutls send failed",
1779
logger.debug("Sent: %d, remaining: %d",
1780
sent, len(client.secret)
1781
- (sent_size + sent))
1784
logger.info("Sending secret to %s", client.name)
1785
# bump the timeout using extended_timeout
1786
client.bump_timeout(client.extended_timeout)
1787
if self.server.use_dbus:
1792
if approval_required:
1793
client.approvals_pending -= 1
1796
except gnutls.errors.GNUTLSError as error:
1797
logger.warning("GnuTLS bye failed",
1801
def peer_certificate(session):
1802
"Return the peer's OpenPGP certificate as a bytestring"
1803
# If not an OpenPGP certificate...
1804
if (gnutls.library.functions
1805
.gnutls_certificate_type_get(session._c_object)
1806
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1807
# ...do the normal thing
1808
return session.peer_certificate
1809
list_size = ctypes.c_uint(1)
1810
cert_list = (gnutls.library.functions
1811
.gnutls_certificate_get_peers
1812
(session._c_object, ctypes.byref(list_size)))
1813
if not bool(cert_list) and list_size.value != 0:
1814
raise gnutls.errors.GNUTLSError("error getting peer"
1816
if list_size.value == 0:
1819
return ctypes.string_at(cert.data, cert.size)
1822
def fingerprint(openpgp):
1823
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1824
# New GnuTLS "datum" with the OpenPGP public key
1825
datum = (gnutls.library.types
1826
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1829
ctypes.c_uint(len(openpgp))))
1830
# New empty GnuTLS certificate
1831
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1832
(gnutls.library.functions
1833
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1834
# Import the OpenPGP public key into the certificate
1835
(gnutls.library.functions
1836
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1837
gnutls.library.constants
1838
.GNUTLS_OPENPGP_FMT_RAW))
1839
# Verify the self signature in the key
1840
crtverify = ctypes.c_uint()
1841
(gnutls.library.functions
1842
.gnutls_openpgp_crt_verify_self(crt, 0,
1843
ctypes.byref(crtverify)))
1844
if crtverify.value != 0:
1845
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1846
raise (gnutls.errors.CertificateSecurityError
1848
# New buffer for the fingerprint
1849
buf = ctypes.create_string_buffer(20)
1850
buf_len = ctypes.c_size_t()
1851
# Get the fingerprint from the certificate into the buffer
1852
(gnutls.library.functions
1853
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1854
ctypes.byref(buf_len)))
1855
# Deinit the certificate
1856
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1857
# Convert the buffer to a Python bytestring
1858
fpr = ctypes.string_at(buf, buf_len.value)
1859
# Convert the bytestring to hexadecimal notation
1860
hex_fpr = binascii.hexlify(fpr).upper()
1864
class MultiprocessingMixIn(object):
1865
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1866
def sub_process_main(self, request, address):
1868
self.finish_request(request, address)
1870
self.handle_error(request, address)
1871
self.close_request(request)
1873
def process_request(self, request, address):
1874
"""Start a new process to process the request."""
1875
proc = multiprocessing.Process(target = self.sub_process_main,
1876
args = (request, address))
1881
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1882
""" adds a pipe to the MixIn """
1883
def process_request(self, request, client_address):
1884
"""Overrides and wraps the original process_request().
1886
This function creates a new pipe in self.pipe
1888
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1890
proc = MultiprocessingMixIn.process_request(self, request,
1892
self.child_pipe.close()
1893
self.add_pipe(parent_pipe, proc)
1895
def add_pipe(self, parent_pipe, proc):
1896
"""Dummy function; override as necessary"""
1897
raise NotImplementedError
1900
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1901
socketserver.TCPServer, object):
1902
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
727
settings: Server settings
728
clients: Set() of Client objects
729
1905
enabled: Boolean; whether this server is activated yet
1906
interface: None or a network interface name (string)
1907
use_ipv6: Boolean; to use IPv6 or not
731
address_family = socket.AF_INET6
732
def __init__(self, *args, **kwargs):
733
if "settings" in kwargs:
734
self.settings = kwargs["settings"]
735
del kwargs["settings"]
736
if "clients" in kwargs:
737
self.clients = kwargs["clients"]
738
del kwargs["clients"]
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1909
def __init__(self, server_address, RequestHandlerClass,
1910
interface=None, use_ipv6=True, socketfd=None):
1911
"""If socketfd is set, use that file descriptor instead of
1912
creating a new one with socket.socket().
1914
self.interface = interface
1916
self.address_family = socket.AF_INET6
1917
if socketfd is not None:
1918
# Save the file descriptor
1919
self.socketfd = socketfd
1920
# Save the original socket.socket() function
1921
self.socket_socket = socket.socket
1922
# To implement --socket, we monkey patch socket.socket.
1924
# (When socketserver.TCPServer is a new-style class, we
1925
# could make self.socket into a property instead of monkey
1926
# patching socket.socket.)
1928
# Create a one-time-only replacement for socket.socket()
1929
@functools.wraps(socket.socket)
1930
def socket_wrapper(*args, **kwargs):
1931
# Restore original function so subsequent calls are
1933
socket.socket = self.socket_socket
1934
del self.socket_socket
1935
# This time only, return a new socket object from the
1936
# saved file descriptor.
1937
return socket.fromfd(self.socketfd, *args, **kwargs)
1938
# Replace socket.socket() function with wrapper
1939
socket.socket = socket_wrapper
1940
# The socketserver.TCPServer.__init__ will call
1941
# socket.socket(), which might be our replacement,
1942
# socket_wrapper(), if socketfd was set.
1943
socketserver.TCPServer.__init__(self, server_address,
1944
RequestHandlerClass)
741
1946
def server_bind(self):
742
1947
"""This overrides the normal server_bind() function
743
1948
to bind to an interface if one was specified, and also NOT to
744
1949
bind to an address or port if they were not specified."""
745
if self.settings["interface"]:
746
# 25 is from /usr/include/asm-i486/socket.h
747
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
749
self.socket.setsockopt(socket.SOL_SOCKET,
751
self.settings["interface"])
752
except socket.error, error:
753
if error[0] == errno.EPERM:
754
logger.error(u"No permission to"
755
u" bind to interface %s",
756
self.settings["interface"])
1950
if self.interface is not None:
1951
if SO_BINDTODEVICE is None:
1952
logger.error("SO_BINDTODEVICE does not exist;"
1953
" cannot bind to interface %s",
1957
self.socket.setsockopt(socket.SOL_SOCKET,
1959
str(self.interface + '\0'))
1960
except socket.error as error:
1961
if error.errno == errno.EPERM:
1962
logger.error("No permission to bind to"
1963
" interface %s", self.interface)
1964
elif error.errno == errno.ENOPROTOOPT:
1965
logger.error("SO_BINDTODEVICE not available;"
1966
" cannot bind to interface %s",
1968
elif error.errno == errno.ENODEV:
1969
logger.error("Interface %s does not exist,"
1970
" cannot bind", self.interface)
759
1973
# Only bind(2) the socket if we really need to.
760
1974
if self.server_address[0] or self.server_address[1]:
761
1975
if not self.server_address[0]:
763
self.server_address = (in6addr_any,
1976
if self.address_family == socket.AF_INET6:
1977
any_address = "::" # in6addr_any
1979
any_address = socket.INADDR_ANY
1980
self.server_address = (any_address,
764
1981
self.server_address[1])
765
1982
elif not self.server_address[1]:
766
1983
self.server_address = (self.server_address[0],
768
# if self.settings["interface"]:
1985
# if self.interface:
769
1986
# self.server_address = (self.server_address[0],
772
1989
# if_nametoindex
775
return super(IPv6_TCPServer, self).server_bind()
1991
return socketserver.TCPServer.server_bind(self)
1994
class MandosServer(IPv6_TCPServer):
1998
clients: set of Client objects
1999
gnutls_priority GnuTLS priority string
2000
use_dbus: Boolean; to emit D-Bus signals or not
2002
Assumes a gobject.MainLoop event loop.
2004
def __init__(self, server_address, RequestHandlerClass,
2005
interface=None, use_ipv6=True, clients=None,
2006
gnutls_priority=None, use_dbus=True, socketfd=None):
2007
self.enabled = False
2008
self.clients = clients
2009
if self.clients is None:
2011
self.use_dbus = use_dbus
2012
self.gnutls_priority = gnutls_priority
2013
IPv6_TCPServer.__init__(self, server_address,
2014
RequestHandlerClass,
2015
interface = interface,
2016
use_ipv6 = use_ipv6,
2017
socketfd = socketfd)
776
2018
def server_activate(self):
777
2019
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
2020
return socketserver.TCPServer.server_activate(self)
779
2022
def enable(self):
780
2023
self.enabled = True
2025
def add_pipe(self, parent_pipe, proc):
2026
# Call "handle_ipc" for both data and EOF events
2027
gobject.io_add_watch(parent_pipe.fileno(),
2028
gobject.IO_IN | gobject.IO_HUP,
2029
functools.partial(self.handle_ipc,
2034
def handle_ipc(self, source, condition, parent_pipe=None,
2035
proc = None, client_object=None):
2036
# error, or the other end of multiprocessing.Pipe has closed
2037
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2038
# Wait for other process to exit
2042
# Read a request from the child
2043
request = parent_pipe.recv()
2044
command = request[0]
2046
if command == 'init':
2048
address = request[2]
2050
for c in self.clients.itervalues():
2051
if c.fingerprint == fpr:
2055
logger.info("Client not found for fingerprint: %s, ad"
2056
"dress: %s", fpr, address)
2059
mandos_dbus_service.ClientNotFound(fpr,
2061
parent_pipe.send(False)
2064
gobject.io_add_watch(parent_pipe.fileno(),
2065
gobject.IO_IN | gobject.IO_HUP,
2066
functools.partial(self.handle_ipc,
2072
parent_pipe.send(True)
2073
# remove the old hook in favor of the new above hook on
2076
if command == 'funcall':
2077
funcname = request[1]
2081
parent_pipe.send(('data', getattr(client_object,
2085
if command == 'getattr':
2086
attrname = request[1]
2087
if callable(client_object.__getattribute__(attrname)):
2088
parent_pipe.send(('function',))
2090
parent_pipe.send(('data', client_object
2091
.__getattribute__(attrname)))
2093
if command == 'setattr':
2094
attrname = request[1]
2096
setattr(client_object, attrname, value)
2101
def rfc3339_duration_to_delta(duration):
2102
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2104
>>> rfc3339_duration_to_delta("P7D")
2105
datetime.timedelta(7)
2106
>>> rfc3339_duration_to_delta("PT60S")
2107
datetime.timedelta(0, 60)
2108
>>> rfc3339_duration_to_delta("PT60M")
2109
datetime.timedelta(0, 3600)
2110
>>> rfc3339_duration_to_delta("PT24H")
2111
datetime.timedelta(1)
2112
>>> rfc3339_duration_to_delta("P1W")
2113
datetime.timedelta(7)
2114
>>> rfc3339_duration_to_delta("PT5M30S")
2115
datetime.timedelta(0, 330)
2116
>>> rfc3339_duration_to_delta("P1DT3M20S")
2117
datetime.timedelta(1, 200)
2120
# Parsing an RFC 3339 duration with regular expressions is not
2121
# possible - there would have to be multiple places for the same
2122
# values, like seconds. The current code, while more esoteric, is
2123
# cleaner without depending on a parsing library. If Python had a
2124
# built-in library for parsing we would use it, but we'd like to
2125
# avoid excessive use of external libraries.
2127
# New type for defining tokens, syntax, and semantics all-in-one
2128
Token = collections.namedtuple("Token",
2129
("regexp", # To match token; if
2130
# "value" is not None,
2131
# must have a "group"
2133
"value", # datetime.timedelta or
2135
"followers")) # Tokens valid after
2137
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2138
# the "duration" ABNF definition in RFC 3339, Appendix A.
2139
token_end = Token(re.compile(r"$"), None, frozenset())
2140
token_second = Token(re.compile(r"(\d+)S"),
2141
datetime.timedelta(seconds=1),
2142
frozenset((token_end,)))
2143
token_minute = Token(re.compile(r"(\d+)M"),
2144
datetime.timedelta(minutes=1),
2145
frozenset((token_second, token_end)))
2146
token_hour = Token(re.compile(r"(\d+)H"),
2147
datetime.timedelta(hours=1),
2148
frozenset((token_minute, token_end)))
2149
token_time = Token(re.compile(r"T"),
2151
frozenset((token_hour, token_minute,
2153
token_day = Token(re.compile(r"(\d+)D"),
2154
datetime.timedelta(days=1),
2155
frozenset((token_time, token_end)))
2156
token_month = Token(re.compile(r"(\d+)M"),
2157
datetime.timedelta(weeks=4),
2158
frozenset((token_day, token_end)))
2159
token_year = Token(re.compile(r"(\d+)Y"),
2160
datetime.timedelta(weeks=52),
2161
frozenset((token_month, token_end)))
2162
token_week = Token(re.compile(r"(\d+)W"),
2163
datetime.timedelta(weeks=1),
2164
frozenset((token_end,)))
2165
token_duration = Token(re.compile(r"P"), None,
2166
frozenset((token_year, token_month,
2167
token_day, token_time,
2169
# Define starting values
2170
value = datetime.timedelta() # Value so far
2172
followers = frozenset(token_duration,) # Following valid tokens
2173
s = duration # String left to parse
2174
# Loop until end token is found
2175
while found_token is not token_end:
2176
# Search for any currently valid tokens
2177
for token in followers:
2178
match = token.regexp.match(s)
2179
if match is not None:
2181
if token.value is not None:
2182
# Value found, parse digits
2183
factor = int(match.group(1), 10)
2184
# Add to value so far
2185
value += factor * token.value
2186
# Strip token from string
2187
s = token.regexp.sub("", s, 1)
2190
# Set valid next tokens
2191
followers = found_token.followers
2194
# No currently valid tokens were found
2195
raise ValueError("Invalid RFC 3339 duration")
783
2200
def string_to_delta(interval):
784
2201
"""Parse a string and return a datetime.timedelta
786
2203
>>> string_to_delta('7d')
787
2204
datetime.timedelta(7)
788
2205
>>> string_to_delta('60s')
929
2330
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
2331
"servicename": "Mandos",
931
2332
"use_dbus": "True",
2337
"statedir": "/var/lib/mandos",
2338
"foreground": "False",
934
2341
# Parse config file for server-global settings
935
server_config = ConfigParser.SafeConfigParser(server_defaults)
2342
server_config = configparser.SafeConfigParser(server_defaults)
936
2343
del server_defaults
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2344
server_config.read(os.path.join(options.configdir,
938
2346
# Convert the SafeConfigParser object to a dict
939
2347
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
2348
# Use the appropriate methods on the non-string config options
2349
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2350
server_settings[option] = server_config.getboolean("DEFAULT",
2352
if server_settings["port"]:
2353
server_settings["port"] = server_config.getint("DEFAULT",
2355
if server_settings["socket"]:
2356
server_settings["socket"] = server_config.getint("DEFAULT",
2358
# Later, stdin will, and stdout and stderr might, be dup'ed
2359
# over with an opened os.devnull. But we don't want this to
2360
# happen with a supplied network socket.
2361
if 0 <= server_settings["socket"] <= 2:
2362
server_settings["socket"] = os.dup(server_settings
945
2364
del server_config
947
2366
# Override the settings from the config file with command line
948
2367
# options, if set.
949
2368
for option in ("interface", "address", "port", "debug",
950
2369
"priority", "servicename", "configdir",
2370
"use_dbus", "use_ipv6", "debuglevel", "restore",
2371
"statedir", "socket", "foreground"):
952
2372
value = getattr(options, option)
953
2373
if value is not None:
954
2374
server_settings[option] = value
2376
# Force all strings to be unicode
2377
for option in server_settings.keys():
2378
if type(server_settings[option]) is str:
2379
server_settings[option] = unicode(server_settings[option])
2380
# Debug implies foreground
2381
if server_settings["debug"]:
2382
server_settings["foreground"] = True
956
2383
# Now we have our good server settings in "server_settings"
2385
##################################################################
958
2387
# For convenience
959
2388
debug = server_settings["debug"]
2389
debuglevel = server_settings["debuglevel"]
960
2390
use_dbus = server_settings["use_dbus"]
2391
use_ipv6 = server_settings["use_ipv6"]
2392
stored_state_path = os.path.join(server_settings["statedir"],
2394
foreground = server_settings["foreground"]
963
syslogger.setLevel(logging.WARNING)
964
console.setLevel(logging.WARNING)
2397
initlogger(debug, logging.DEBUG)
2402
level = getattr(logging, debuglevel.upper())
2403
initlogger(debug, level)
966
2405
if server_settings["servicename"] != "Mandos":
967
2406
syslogger.setFormatter(logging.Formatter
968
('Mandos (%s): %%(levelname)s:'
970
% server_settings["servicename"]))
2407
('Mandos ({0}) [%(process)d]:'
2408
' %(levelname)s: %(message)s'
2409
.format(server_settings
972
2412
# Parse config file with clients
973
client_defaults = { "timeout": "1h",
975
"checker": "fping -q -- %%(host)s",
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
2413
client_config = configparser.SafeConfigParser(Client
979
2415
client_config.read(os.path.join(server_settings["configdir"],
980
2416
"clients.conf"))
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
986
settings=server_settings,
988
pidfilename = "/var/run/mandos.pid"
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
2418
global mandos_dbus_service
2419
mandos_dbus_service = None
2421
tcp_server = MandosServer((server_settings["address"],
2422
server_settings["port"]),
2424
interface=(server_settings["interface"]
2428
server_settings["priority"],
2430
socketfd=(server_settings["socket"]
2433
pidfilename = "/var/run/mandos.pid"
2436
pidfile = open(pidfilename, "w")
2437
except IOError as e:
2438
logger.error("Could not open file %r", pidfilename,
2441
for name in ("_mandos", "mandos", "nobody"):
2443
uid = pwd.getpwnam(name).pw_uid
2444
gid = pwd.getpwnam(name).pw_gid
1001
2446
except KeyError:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1011
except OSError, error:
1012
if error[0] != errno.EPERM:
2454
except OSError as error:
2455
if error.errno != errno.EPERM:
1016
service = AvahiService(name = server_settings["servicename"],
1017
servicetype = "_mandos._tcp", )
1018
if server_settings["interface"]:
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
2459
# Enable all possible GnuTLS debugging
2461
# "Use a log level over 10 to enable all debugging options."
2463
gnutls.library.functions.gnutls_global_set_log_level(11)
2465
@gnutls.library.types.gnutls_log_func
2466
def debug_gnutls(level, string):
2467
logger.debug("GnuTLS: %s", string[:-1])
2469
(gnutls.library.functions
2470
.gnutls_global_set_log_function(debug_gnutls))
2472
# Redirect stdin so all checkers get /dev/null
2473
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2474
os.dup2(null, sys.stdin.fileno())
2478
# Need to fork before connecting to D-Bus
2480
# Close all input and output, do double fork, etc.
2483
# multiprocessing will use threads, so before we use gobject we
2484
# need to inform gobject that threads will be used.
2485
gobject.threads_init()
1022
2487
global main_loop
1025
2488
# From the Avahi example code
1026
DBusGMainLoop(set_as_default=True )
2489
DBusGMainLoop(set_as_default=True)
1027
2490
main_loop = gobject.MainLoop()
1028
2491
bus = dbus.SystemBus()
1029
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1030
avahi.DBUS_PATH_SERVER),
1031
avahi.DBUS_INTERFACE_SERVER)
1032
2492
# End of Avahi example code
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1037
clients.update(Set(Client(name = section,
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
1041
for section in client_config.sections()))
1043
logger.warning(u"No clients defined")
1046
# Redirect stdin so all checkers get /dev/null
1047
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1048
os.dup2(null, sys.stdin.fileno())
1052
# No console logging
1053
logger.removeHandler(console)
1054
# Close all input and output, do double fork, etc.
1059
pidfile.write(str(pid) + "\n")
2495
bus_name = dbus.service.BusName("se.recompile.Mandos",
2496
bus, do_not_queue=True)
2497
old_bus_name = (dbus.service.BusName
2498
("se.bsnet.fukt.Mandos", bus,
2500
except dbus.exceptions.NameExistsException as e:
2501
logger.error("Disabling D-Bus:", exc_info=e)
2503
server_settings["use_dbus"] = False
2504
tcp_server.use_dbus = False
2505
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2506
service = AvahiServiceToSyslog(name =
2507
server_settings["servicename"],
2508
servicetype = "_mandos._tcp",
2509
protocol = protocol, bus = bus)
2510
if server_settings["interface"]:
2511
service.interface = (if_nametoindex
2512
(str(server_settings["interface"])))
2514
global multiprocessing_manager
2515
multiprocessing_manager = multiprocessing.Manager()
2517
client_class = Client
2519
client_class = functools.partial(ClientDBus, bus = bus)
2521
client_settings = Client.config_parser(client_config)
2522
old_client_settings = {}
2525
# Get client data and settings from last running state.
2526
if server_settings["restore"]:
2528
with open(stored_state_path, "rb") as stored_state:
2529
clients_data, old_client_settings = (pickle.load
2531
os.remove(stored_state_path)
2532
except IOError as e:
2533
if e.errno == errno.ENOENT:
2534
logger.warning("Could not load persistent state: {0}"
2535
.format(os.strerror(e.errno)))
2537
logger.critical("Could not load persistent state:",
2540
except EOFError as e:
2541
logger.warning("Could not load persistent state: "
2542
"EOFError:", exc_info=e)
2544
with PGPEngine() as pgp:
2545
for client_name, client in clients_data.iteritems():
2546
# Decide which value to use after restoring saved state.
2547
# We have three different values: Old config file,
2548
# new config file, and saved state.
2549
# New config value takes precedence if it differs from old
2550
# config value, otherwise use saved state.
2551
for name, value in client_settings[client_name].items():
2553
# For each value in new config, check if it
2554
# differs from the old config value (Except for
2555
# the "secret" attribute)
2556
if (name != "secret" and
2557
value != old_client_settings[client_name]
2559
client[name] = value
2563
# Clients who has passed its expire date can still be
2564
# enabled if its last checker was successful. Clients
2565
# whose checker succeeded before we stored its state is
2566
# assumed to have successfully run all checkers during
2568
if client["enabled"]:
2569
if datetime.datetime.utcnow() >= client["expires"]:
2570
if not client["last_checked_ok"]:
2572
"disabling client {0} - Client never "
2573
"performed a successful checker"
2574
.format(client_name))
2575
client["enabled"] = False
2576
elif client["last_checker_status"] != 0:
2578
"disabling client {0} - Client "
2579
"last checker failed with error code {1}"
2580
.format(client_name,
2581
client["last_checker_status"]))
2582
client["enabled"] = False
2584
client["expires"] = (datetime.datetime
2586
+ client["timeout"])
2587
logger.debug("Last checker succeeded,"
2588
" keeping {0} enabled"
2589
.format(client_name))
2591
client["secret"] = (
2592
pgp.decrypt(client["encrypted_secret"],
2593
client_settings[client_name]
2596
# If decryption fails, we use secret from new settings
2597
logger.debug("Failed to decrypt {0} old secret"
2598
.format(client_name))
2599
client["secret"] = (
2600
client_settings[client_name]["secret"])
2602
# Add/remove clients based on new changes made to config
2603
for client_name in (set(old_client_settings)
2604
- set(client_settings)):
2605
del clients_data[client_name]
2606
for client_name in (set(client_settings)
2607
- set(old_client_settings)):
2608
clients_data[client_name] = client_settings[client_name]
2610
# Create all client objects
2611
for client_name, client in clients_data.iteritems():
2612
tcp_server.clients[client_name] = client_class(
2613
name = client_name, settings = client)
2615
if not tcp_server.clients:
2616
logger.warning("No clients defined")
2619
if pidfile is not None:
2623
pidfile.write(str(pid) + "\n".encode("utf-8"))
2625
logger.error("Could not write to file %r with PID %d",
1063
logger.error(u"Could not write to file %r with PID %d",
1066
# "pidfile" was never created
1071
"Cleanup function; run on exit"
1073
# From the Avahi example code
1074
if not group is None:
1077
# End of Avahi example code
1080
client = clients.pop()
1081
client.disable_hook = None
1084
atexit.register(cleanup)
1087
signal.signal(signal.SIGINT, signal.SIG_IGN)
1088
2630
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1089
2631
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1092
class MandosServer(dbus.service.Object):
2634
@alternate_dbus_interfaces({"se.recompile.Mandos":
2635
"se.bsnet.fukt.Mandos"})
2636
class MandosDBusService(DBusObjectWithProperties):
1093
2637
"""A D-Bus proxy object"""
1094
2638
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1097
_interface = u"org.mandos_system.Mandos"
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
2639
dbus.service.Object.__init__(self, bus, "/")
2640
_interface = "se.recompile.Mandos"
2642
@dbus_interface_annotations(_interface)
2644
return { "org.freedesktop.DBus.Property"
2645
".EmitsChangedSignal":
1104
2648
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
2649
def ClientAdded(self, objpath):
2653
@dbus.service.signal(_interface, signature="ss")
2654
def ClientNotFound(self, fingerprint, address):
2658
@dbus.service.signal(_interface, signature="os")
2659
def ClientRemoved(self, objpath, name):
1109
2663
@dbus.service.method(_interface, out_signature="ao")
1110
2664
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
2666
return dbus.Array(c.dbus_object_path
2668
tcp_server.clients.itervalues())
2670
@dbus.service.method(_interface,
2671
out_signature="a{oa{sv}}")
1114
2672
def GetAllClientsWithProperties(self):
1115
2674
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
2675
((c.dbus_object_path, c.GetAll(""))
2676
for c in tcp_server.clients.itervalues()),
1118
2677
signature="oa{sv}")
1120
2679
@dbus.service.method(_interface, in_signature="o")
1121
2680
def RemoveClient(self, object_path):
2682
for c in tcp_server.clients.itervalues():
1123
2683
if c.dbus_object_path == object_path:
2684
del tcp_server.clients[c.name]
2685
c.remove_from_connection()
1125
2686
# Don't signal anything except ClientRemoved
2687
c.disable(quiet=True)
1128
2688
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
2689
self.ClientRemoved(object_path, c.name)
1132
@dbus.service.method(_interface)
2691
raise KeyError(object_path)
1138
mandos_server = MandosServer()
1140
for client in clients:
2695
mandos_dbus_service = MandosDBusService()
2698
"Cleanup function; run on exit"
2701
multiprocessing.active_children()
2702
if not (tcp_server.clients or client_settings):
2705
# Store client before exiting. Secrets are encrypted with key
2706
# based on what config file has. If config file is
2707
# removed/edited, old secret will thus be unrecovable.
2709
with PGPEngine() as pgp:
2710
for client in tcp_server.clients.itervalues():
2711
key = client_settings[client.name]["secret"]
2712
client.encrypted_secret = pgp.encrypt(client.secret,
2716
# A list of attributes that can not be pickled
2718
exclude = set(("bus", "changedstate", "secret",
2720
for name, typ in (inspect.getmembers
2721
(dbus.service.Object)):
2724
client_dict["encrypted_secret"] = (client
2726
for attr in client.client_structure:
2727
if attr not in exclude:
2728
client_dict[attr] = getattr(client, attr)
2730
clients[client.name] = client_dict
2731
del client_settings[client.name]["secret"]
2734
with (tempfile.NamedTemporaryFile
2735
(mode='wb', suffix=".pickle", prefix='clients-',
2736
dir=os.path.dirname(stored_state_path),
2737
delete=False)) as stored_state:
2738
pickle.dump((clients, client_settings), stored_state)
2739
tempname=stored_state.name
2740
os.rename(tempname, stored_state_path)
2741
except (IOError, OSError) as e:
2747
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2748
logger.warning("Could not save persistent state: {0}"
2749
.format(os.strerror(e.errno)))
2751
logger.warning("Could not save persistent state:",
2755
# Delete all clients, and settings from config
2756
while tcp_server.clients:
2757
name, client = tcp_server.clients.popitem()
2759
client.remove_from_connection()
2760
# Don't signal anything except ClientRemoved
2761
client.disable(quiet=True)
2764
mandos_dbus_service.ClientRemoved(client
2767
client_settings.clear()
2769
atexit.register(cleanup)
2771
for client in tcp_server.clients.itervalues():
1142
2773
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
2774
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2775
# Need to initiate checking of clients
2777
client.init_checker()
1147
2779
tcp_server.enable()
1148
2780
tcp_server.server_activate()
1150
2782
# Find out what port we got
1151
2783
service.port = tcp_server.socket.getsockname()[1]
1152
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1153
u" scope_id %d" % tcp_server.socket.getsockname())
2785
logger.info("Now listening on address %r, port %d,"
2786
" flowinfo %d, scope_id %d",
2787
*tcp_server.socket.getsockname())
2789
logger.info("Now listening on address %r, port %d",
2790
*tcp_server.socket.getsockname())
1155
2792
#service.interface = tcp_server.socket.getsockname()[3]
1158
2795
# From the Avahi example code
1159
server.connect_to_signal("StateChanged", server_state_changed)
1161
server_state_changed(server.GetState())
1162
except dbus.exceptions.DBusException, error:
1163
logger.critical(u"DBusException: %s", error)
2798
except dbus.exceptions.DBusException as error:
2799
logger.critical("D-Bus Exception", exc_info=error)
1165
2802
# End of Avahi example code