365
495
follow_name_owner_changes=True),
366
496
avahi.DBUS_INTERFACE_SERVER)
367
497
self.server.connect_to_signal("StateChanged",
368
self.server_state_changed)
498
self.server_state_changed)
369
499
self.server_state_changed(self.server.GetState())
371
502
class AvahiServiceToSyslog(AvahiService):
503
def rename(self, *args, **kwargs):
373
504
"""Add the new name to the syslog messages"""
374
ret = AvahiService.rename(self)
375
syslogger.setFormatter(logging.Formatter
376
('Mandos (%s) [%%(process)d]:'
377
' %%(levelname)s: %%(message)s'
505
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
506
syslogger.setFormatter(logging.Formatter(
507
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
381
def timedelta_to_milliseconds(td):
382
"Convert a datetime.timedelta() to milliseconds"
383
return ((td.days * 24 * 60 * 60 * 1000)
384
+ (td.seconds * 1000)
385
+ (td.microseconds // 1000))
387
class Client(object):
512
# Pretend that we have a GnuTLS module
514
"""This isn't so much a class as it is a module-like namespace."""
516
library = ctypes.util.find_library("gnutls")
518
library = ctypes.util.find_library("gnutls-deb0")
519
_library = ctypes.cdll.LoadLibrary(library)
522
# Unless otherwise indicated, the constants and types below are
523
# all from the gnutls/gnutls.h C header file.
534
E_NO_CERTIFICATE_FOUND = -49
539
KEYID_USE_SHA256 = 1 # gnutls/x509.h
540
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
543
class session_int(ctypes.Structure):
545
session_t = ctypes.POINTER(session_int)
547
class certificate_credentials_st(ctypes.Structure):
549
certificate_credentials_t = ctypes.POINTER(
550
certificate_credentials_st)
551
certificate_type_t = ctypes.c_int
553
class datum_t(ctypes.Structure):
554
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
555
('size', ctypes.c_uint)]
557
class openpgp_crt_int(ctypes.Structure):
559
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
560
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
561
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
562
credentials_type_t = ctypes.c_int
563
transport_ptr_t = ctypes.c_void_p
564
close_request_t = ctypes.c_int
567
class Error(Exception):
568
def __init__(self, message=None, code=None, args=()):
569
# Default usage is by a message string, but if a return
570
# code is passed, convert it to a string with
573
if message is None and code is not None:
574
message = gnutls.strerror(code)
575
return super(gnutls.Error, self).__init__(
578
class CertificateSecurityError(Error):
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
587
self.type = gnutls.CRD_CERTIFICATE
590
gnutls.certificate_free_credentials(self._c_object)
593
def __init__(self, socket, credentials=None):
594
self._c_object = gnutls.session_t()
595
gnutls_flags = gnutls.CLIENT
596
if gnutls.check_version(b"3.5.6"):
597
gnutls_flags |= gnutls.NO_TICKETS
599
gnutls_flags |= gnutls.ENABLE_RAWPK
600
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
602
gnutls.set_default_priority(self._c_object)
603
gnutls.transport_set_ptr(self._c_object, socket.fileno())
604
gnutls.handshake_set_private_extensions(self._c_object,
607
if credentials is None:
608
credentials = gnutls.Credentials()
609
gnutls.credentials_set(self._c_object, credentials.type,
610
ctypes.cast(credentials._c_object,
612
self.credentials = credentials
615
gnutls.deinit(self._c_object)
618
return gnutls.handshake(self._c_object)
620
def send(self, data):
624
data_len -= gnutls.record_send(self._c_object,
629
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
631
# Error handling functions
632
def _error_code(result):
633
"""A function to raise exceptions on errors, suitable
634
for the 'restype' attribute on ctypes functions"""
637
if result == gnutls.E_NO_CERTIFICATE_FOUND:
638
raise gnutls.CertificateSecurityError(code=result)
639
raise gnutls.Error(code=result)
641
def _retry_on_error(result, func, arguments):
642
"""A function to retry on some errors, suitable
643
for the 'errcheck' attribute on ctypes functions"""
645
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
646
return _error_code(result)
647
result = func(*arguments)
650
# Unless otherwise indicated, the function declarations below are
651
# all from the gnutls/gnutls.h C header file.
654
priority_set_direct = _library.gnutls_priority_set_direct
655
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
656
ctypes.POINTER(ctypes.c_char_p)]
657
priority_set_direct.restype = _error_code
659
init = _library.gnutls_init
660
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
661
init.restype = _error_code
663
set_default_priority = _library.gnutls_set_default_priority
664
set_default_priority.argtypes = [session_t]
665
set_default_priority.restype = _error_code
667
record_send = _library.gnutls_record_send
668
record_send.argtypes = [session_t, ctypes.c_void_p,
670
record_send.restype = ctypes.c_ssize_t
671
record_send.errcheck = _retry_on_error
673
certificate_allocate_credentials = (
674
_library.gnutls_certificate_allocate_credentials)
675
certificate_allocate_credentials.argtypes = [
676
ctypes.POINTER(certificate_credentials_t)]
677
certificate_allocate_credentials.restype = _error_code
679
certificate_free_credentials = (
680
_library.gnutls_certificate_free_credentials)
681
certificate_free_credentials.argtypes = [
682
certificate_credentials_t]
683
certificate_free_credentials.restype = None
685
handshake_set_private_extensions = (
686
_library.gnutls_handshake_set_private_extensions)
687
handshake_set_private_extensions.argtypes = [session_t,
689
handshake_set_private_extensions.restype = None
691
credentials_set = _library.gnutls_credentials_set
692
credentials_set.argtypes = [session_t, credentials_type_t,
694
credentials_set.restype = _error_code
696
strerror = _library.gnutls_strerror
697
strerror.argtypes = [ctypes.c_int]
698
strerror.restype = ctypes.c_char_p
700
certificate_type_get = _library.gnutls_certificate_type_get
701
certificate_type_get.argtypes = [session_t]
702
certificate_type_get.restype = _error_code
704
certificate_get_peers = _library.gnutls_certificate_get_peers
705
certificate_get_peers.argtypes = [session_t,
706
ctypes.POINTER(ctypes.c_uint)]
707
certificate_get_peers.restype = ctypes.POINTER(datum_t)
709
global_set_log_level = _library.gnutls_global_set_log_level
710
global_set_log_level.argtypes = [ctypes.c_int]
711
global_set_log_level.restype = None
713
global_set_log_function = _library.gnutls_global_set_log_function
714
global_set_log_function.argtypes = [log_func]
715
global_set_log_function.restype = None
717
deinit = _library.gnutls_deinit
718
deinit.argtypes = [session_t]
719
deinit.restype = None
721
handshake = _library.gnutls_handshake
722
handshake.argtypes = [session_t]
723
handshake.restype = _error_code
724
handshake.errcheck = _retry_on_error
726
transport_set_ptr = _library.gnutls_transport_set_ptr
727
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
728
transport_set_ptr.restype = None
730
bye = _library.gnutls_bye
731
bye.argtypes = [session_t, close_request_t]
732
bye.restype = _error_code
733
bye.errcheck = _retry_on_error
735
check_version = _library.gnutls_check_version
736
check_version.argtypes = [ctypes.c_char_p]
737
check_version.restype = ctypes.c_char_p
739
_need_version = b"3.3.0"
740
if check_version(_need_version) is None:
741
raise self.Error("Needs GnuTLS {} or later"
742
.format(_need_version))
744
_tls_rawpk_version = b"3.6.6"
745
has_rawpk = bool(check_version(_tls_rawpk_version))
749
class pubkey_st(ctypes.Structure):
751
pubkey_t = ctypes.POINTER(pubkey_st)
753
x509_crt_fmt_t = ctypes.c_int
755
# All the function declarations below are from gnutls/abstract.h
756
pubkey_init = _library.gnutls_pubkey_init
757
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
758
pubkey_init.restype = _error_code
760
pubkey_import = _library.gnutls_pubkey_import
761
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
763
pubkey_import.restype = _error_code
765
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
766
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
767
ctypes.POINTER(ctypes.c_ubyte),
768
ctypes.POINTER(ctypes.c_size_t)]
769
pubkey_get_key_id.restype = _error_code
771
pubkey_deinit = _library.gnutls_pubkey_deinit
772
pubkey_deinit.argtypes = [pubkey_t]
773
pubkey_deinit.restype = None
775
# All the function declarations below are from gnutls/openpgp.h
777
openpgp_crt_init = _library.gnutls_openpgp_crt_init
778
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
779
openpgp_crt_init.restype = _error_code
781
openpgp_crt_import = _library.gnutls_openpgp_crt_import
782
openpgp_crt_import.argtypes = [openpgp_crt_t,
783
ctypes.POINTER(datum_t),
785
openpgp_crt_import.restype = _error_code
787
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
788
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
789
ctypes.POINTER(ctypes.c_uint)]
790
openpgp_crt_verify_self.restype = _error_code
792
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
793
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
794
openpgp_crt_deinit.restype = None
796
openpgp_crt_get_fingerprint = (
797
_library.gnutls_openpgp_crt_get_fingerprint)
798
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
802
openpgp_crt_get_fingerprint.restype = _error_code
804
if check_version(b"3.6.4"):
805
certificate_type_get2 = _library.gnutls_certificate_type_get2
806
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
807
certificate_type_get2.restype = _error_code
809
# Remove non-public functions
810
del _error_code, _retry_on_error
813
def call_pipe(connection, # : multiprocessing.Connection
814
func, *args, **kwargs):
815
"""This function is meant to be called by multiprocessing.Process
817
This function runs func(*args, **kwargs), and writes the resulting
818
return value on the provided multiprocessing.Connection.
820
connection.send(func(*args, **kwargs))
388
825
"""A representation of a client host served by this server.
391
828
approved: bool(); 'None' if not yet approved/disapproved
392
829
approval_delay: datetime.timedelta(); Time to wait for approval
393
830
approval_duration: datetime.timedelta(); Duration of one approval
394
checker: subprocess.Popen(); a running checker process used
395
to see if the client lives.
396
'None' if no process is running.
397
checker_callback_tag: a gobject event source tag, or None
831
checker: multiprocessing.Process(); a running checker process used
832
to see if the client lives. 'None' if no process is
834
checker_callback_tag: a GLib event source tag, or None
398
835
checker_command: string; External command which is run to check
399
836
if client lives. %() expansions are done at
400
837
runtime with vars(self) as dict, so that for
401
838
instance %(name)s can be used in the command.
402
checker_initiator_tag: a gobject event source tag, or None
839
checker_initiator_tag: a GLib event source tag, or None
403
840
created: datetime.datetime(); (UTC) object creation
404
841
client_structure: Object describing what attributes a client has
405
842
and is used for storing the client at exit
406
843
current_checker_command: string; current running checker_command
407
disable_initiator_tag: a gobject event source tag, or None
844
disable_initiator_tag: a GLib event source tag, or None
409
846
fingerprint: string (40 or 32 hexadecimal digits); used to
410
uniquely identify the client
847
uniquely identify an OpenPGP client
848
key_id: string (64 hexadecimal digits); used to uniquely identify
849
a client using raw public keys
411
850
host: string; available for use by the checker command
412
851
interval: datetime.timedelta(); How often to start a new checker
413
852
last_approval_request: datetime.datetime(); (UTC) or None
414
853
last_checked_ok: datetime.datetime(); (UTC) or None
416
854
last_checker_status: integer between 0 and 255 reflecting exit
417
855
status of last checker. -1 reflects crashed
856
checker, -2 means no checker completed yet.
857
last_checker_signal: The signal which killed the last checker, if
858
last_checker_status is -1
419
859
last_enabled: datetime.datetime(); (UTC) or None
420
860
name: string; from the config file, used in log messages and
421
861
D-Bus identifiers
422
862
secret: bytestring; sent verbatim (over TLS) to client
423
863
timeout: datetime.timedelta(); How long from last_checked_ok
424
864
until this client is disabled
425
extended_timeout: extra long timeout when password has been sent
865
extended_timeout: extra long timeout when secret has been sent
426
866
runtime_expansions: Allowed attributes for runtime expansion.
427
867
expires: datetime.datetime(); time (UTC) when a client will be
428
868
disabled, or None
869
server_settings: The server_settings dict from main()
431
872
runtime_expansions = ("approval_delay", "approval_duration",
432
"created", "enabled", "fingerprint",
433
"host", "interval", "last_checked_ok",
873
"created", "enabled", "expires", "key_id",
874
"fingerprint", "host", "interval",
875
"last_approval_request", "last_checked_ok",
434
876
"last_enabled", "name", "timeout")
436
def timeout_milliseconds(self):
437
"Return the 'timeout' attribute in milliseconds"
438
return timedelta_to_milliseconds(self.timeout)
440
def extended_timeout_milliseconds(self):
441
"Return the 'extended_timeout' attribute in milliseconds"
442
return timedelta_to_milliseconds(self.extended_timeout)
444
def interval_milliseconds(self):
445
"Return the 'interval' attribute in milliseconds"
446
return timedelta_to_milliseconds(self.interval)
448
def approval_delay_milliseconds(self):
449
return timedelta_to_milliseconds(self.approval_delay)
451
def __init__(self, name = None, config=None):
452
"""Note: the 'checker' key in 'config' sets the
453
'checker_command' attribute and *not* the 'checker'
879
"extended_timeout": "PT15M",
881
"checker": "fping -q -- %%(host)s",
883
"approval_delay": "PT0S",
884
"approval_duration": "PT1S",
885
"approved_by_default": "True",
890
def config_parser(config):
891
"""Construct a new dict of client settings of this form:
892
{ client_name: {setting_name: value, ...}, ...}
893
with exceptions for any special settings as defined above.
894
NOTE: Must be a pure function. Must return the same result
895
value given the same arguments.
898
for client_name in config.sections():
899
section = dict(config.items(client_name))
900
client = settings[client_name] = {}
902
client["host"] = section["host"]
903
# Reformat values from string types to Python types
904
client["approved_by_default"] = config.getboolean(
905
client_name, "approved_by_default")
906
client["enabled"] = config.getboolean(client_name,
909
# Uppercase and remove spaces from key_id and fingerprint
910
# for later comparison purposes with return value from the
911
# key_id() and fingerprint() functions
912
client["key_id"] = (section.get("key_id", "").upper()
914
client["fingerprint"] = (section["fingerprint"].upper()
916
if "secret" in section:
917
client["secret"] = codecs.decode(section["secret"]
920
elif "secfile" in section:
921
with open(os.path.expanduser(os.path.expandvars
922
(section["secfile"])),
924
client["secret"] = secfile.read()
926
raise TypeError("No secret or secfile for section {}"
928
client["timeout"] = string_to_delta(section["timeout"])
929
client["extended_timeout"] = string_to_delta(
930
section["extended_timeout"])
931
client["interval"] = string_to_delta(section["interval"])
932
client["approval_delay"] = string_to_delta(
933
section["approval_delay"])
934
client["approval_duration"] = string_to_delta(
935
section["approval_duration"])
936
client["checker_command"] = section["checker"]
937
client["last_approval_request"] = None
938
client["last_checked_ok"] = None
939
client["last_checker_status"] = -2
943
def __init__(self, settings, name=None, server_settings=None):
945
if server_settings is None:
947
self.server_settings = server_settings
948
# adding all client settings
949
for setting, value in settings.items():
950
setattr(self, setting, value)
953
if not hasattr(self, "last_enabled"):
954
self.last_enabled = datetime.datetime.utcnow()
955
if not hasattr(self, "expires"):
956
self.expires = (datetime.datetime.utcnow()
959
self.last_enabled = None
458
962
logger.debug("Creating client %r", self.name)
459
# Uppercase and remove spaces from fingerprint for later
460
# comparison purposes with return value from the fingerprint()
462
self.fingerprint = (config["fingerprint"].upper()
963
logger.debug(" Key ID: %s", self.key_id)
464
964
logger.debug(" Fingerprint: %s", self.fingerprint)
465
if "secret" in config:
466
self.secret = config["secret"].decode("base64")
467
elif "secfile" in config:
468
with open(os.path.expanduser(os.path.expandvars
469
(config["secfile"])),
471
self.secret = secfile.read()
473
raise TypeError("No secret or secfile for client %s"
475
self.host = config.get("host", "")
476
self.created = datetime.datetime.utcnow()
477
self.enabled = config.get("enabled", True)
478
self.last_approval_request = None
480
self.last_enabled = datetime.datetime.utcnow()
482
self.last_enabled = None
483
self.last_checked_ok = None
484
self.last_checker_status = None
485
self.timeout = string_to_delta(config["timeout"])
486
self.extended_timeout = string_to_delta(config
487
["extended_timeout"])
488
self.interval = string_to_delta(config["interval"])
965
self.created = settings.get("created",
966
datetime.datetime.utcnow())
968
# attributes specific for this server instance
489
969
self.checker = None
490
970
self.checker_initiator_tag = None
491
971
self.disable_initiator_tag = None
493
self.expires = datetime.datetime.utcnow() + self.timeout
496
972
self.checker_callback_tag = None
497
self.checker_command = config["checker"]
498
973
self.current_checker_command = None
499
974
self.approved = None
500
self.approved_by_default = config.get("approved_by_default",
502
975
self.approvals_pending = 0
503
self.approval_delay = string_to_delta(
504
config["approval_delay"])
505
self.approval_duration = string_to_delta(
506
config["approval_duration"])
507
self.changedstate = (multiprocessing_manager
508
.Condition(multiprocessing_manager
510
self.client_structure = [attr for attr in
511
self.__dict__.iterkeys()
976
self.changedstate = multiprocessing_manager.Condition(
977
multiprocessing_manager.Lock())
978
self.client_structure = [attr
979
for attr in self.__dict__.keys()
512
980
if not attr.startswith("_")]
513
981
self.client_structure.append("client_structure")
515
for name, t in inspect.getmembers(type(self),
983
for name, t in inspect.getmembers(
984
type(self), lambda obj: isinstance(obj, property)):
519
985
if not name.startswith("_"):
520
986
self.client_structure.append(name)
522
988
# Send notice to process children that client state has changed
523
989
def send_changedstate(self):
524
990
with self.changedstate:
525
991
self.changedstate.notify_all()
527
993
def enable(self):
528
994
"""Start this client's checker and timeout hooks"""
529
995
if getattr(self, "enabled", False):
530
996
# Already enabled
532
self.send_changedstate()
533
998
self.expires = datetime.datetime.utcnow() + self.timeout
534
999
self.enabled = True
535
1000
self.last_enabled = datetime.datetime.utcnow()
536
1001
self.init_checker()
1002
self.send_changedstate()
538
1004
def disable(self, quiet=True):
539
1005
"""Disable this client."""
540
1006
if not getattr(self, "enabled", False):
543
self.send_changedstate()
545
1009
logger.info("Disabling client %s", self.name)
546
if getattr(self, "disable_initiator_tag", False):
547
gobject.source_remove(self.disable_initiator_tag)
1010
if getattr(self, "disable_initiator_tag", None) is not None:
1011
GLib.source_remove(self.disable_initiator_tag)
548
1012
self.disable_initiator_tag = None
549
1013
self.expires = None
550
if getattr(self, "checker_initiator_tag", False):
551
gobject.source_remove(self.checker_initiator_tag)
1014
if getattr(self, "checker_initiator_tag", None) is not None:
1015
GLib.source_remove(self.checker_initiator_tag)
552
1016
self.checker_initiator_tag = None
553
1017
self.stop_checker()
554
1018
self.enabled = False
555
# Do not run this again if called by a gobject.timeout_add
1020
self.send_changedstate()
1021
# Do not run this again if called by a GLib.timeout_add
558
1024
def __del__(self):
561
1027
def init_checker(self):
562
1028
# Schedule a new checker to be started an 'interval' from now,
563
1029
# and every interval from then on.
564
self.checker_initiator_tag = (gobject.timeout_add
565
(self.interval_milliseconds(),
1030
if self.checker_initiator_tag is not None:
1031
GLib.source_remove(self.checker_initiator_tag)
1032
self.checker_initiator_tag = GLib.timeout_add(
1033
int(self.interval.total_seconds() * 1000),
567
1035
# Schedule a disable() when 'timeout' has passed
568
self.disable_initiator_tag = (gobject.timeout_add
569
(self.timeout_milliseconds(),
1036
if self.disable_initiator_tag is not None:
1037
GLib.source_remove(self.disable_initiator_tag)
1038
self.disable_initiator_tag = GLib.timeout_add(
1039
int(self.timeout.total_seconds() * 1000), self.disable)
571
1040
# Also start a new checker *right now*.
572
1041
self.start_checker()
574
def checker_callback(self, pid, condition, command):
1043
def checker_callback(self, source, condition, connection,
575
1045
"""The checker has completed, so take appropriate actions."""
1046
# Read return code from connection (see call_pipe)
1047
returncode = connection.recv()
576
1050
self.checker_callback_tag = None
577
1051
self.checker = None
578
if os.WIFEXITED(condition):
579
self.last_checker_status = os.WEXITSTATUS(condition)
1054
self.last_checker_status = returncode
1055
self.last_checker_signal = None
580
1056
if self.last_checker_status == 0:
581
1057
logger.info("Checker for %(name)s succeeded",
583
1059
self.checked_ok()
585
logger.info("Checker for %(name)s failed",
1061
logger.info("Checker for %(name)s failed", vars(self))
588
1063
self.last_checker_status = -1
1064
self.last_checker_signal = -returncode
589
1065
logger.warning("Checker for %(name)s crashed?",
592
def checked_ok(self, timeout=None):
593
"""Bump up the timeout for this client.
595
This should only be called when the client has been seen,
1069
def checked_ok(self):
1070
"""Assert that the client has been seen, alive and well."""
1071
self.last_checked_ok = datetime.datetime.utcnow()
1072
self.last_checker_status = 0
1073
self.last_checker_signal = None
1076
def bump_timeout(self, timeout=None):
1077
"""Bump up the timeout for this client."""
598
1078
if timeout is None:
599
1079
timeout = self.timeout
600
self.last_checked_ok = datetime.datetime.utcnow()
601
1080
if self.disable_initiator_tag is not None:
602
gobject.source_remove(self.disable_initiator_tag)
1081
GLib.source_remove(self.disable_initiator_tag)
1082
self.disable_initiator_tag = None
603
1083
if getattr(self, "enabled", False):
604
self.disable_initiator_tag = (gobject.timeout_add
605
(timedelta_to_milliseconds
606
(timeout), self.disable))
1084
self.disable_initiator_tag = GLib.timeout_add(
1085
int(timeout.total_seconds() * 1000), self.disable)
607
1086
self.expires = datetime.datetime.utcnow() + timeout
609
1088
def need_approval(self):
610
1089
self.last_approval_request = datetime.datetime.utcnow()
612
1091
def start_checker(self):
613
1092
"""Start a new checker subprocess if one is not running.
615
1094
If a checker already exists, leave it running and do
617
1096
# The reason for not killing a running checker is that if we
618
# did that, then if a checker (for some reason) started
619
# running slowly and taking more than 'interval' time, the
620
# client would inevitably timeout, since no checker would get
621
# a chance to run to completion. If we instead leave running
1097
# did that, and if a checker (for some reason) started running
1098
# slowly and taking more than 'interval' time, then the client
1099
# would inevitably timeout, since no checker would get a
1100
# chance to run to completion. If we instead leave running
622
1101
# checkers alone, the checker would have to take more time
623
1102
# than 'timeout' for the client to be disabled, which is as it
626
# If a checker exists, make sure it is not a zombie
628
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
629
except (AttributeError, OSError) as error:
630
if (isinstance(error, OSError)
631
and error.errno != errno.ECHILD):
635
logger.warning("Checker was a zombie")
636
gobject.source_remove(self.checker_callback_tag)
637
self.checker_callback(pid, status,
638
self.current_checker_command)
1105
if self.checker is not None and not self.checker.is_alive():
1106
logger.warning("Checker was not alive; joining")
639
1109
# Start a new checker if needed
640
1110
if self.checker is None:
1111
# Escape attributes for the shell
1113
attr: re.escape(str(getattr(self, attr)))
1114
for attr in self.runtime_expansions}
642
# In case checker_command has exactly one % operator
643
command = self.checker_command % self.host
645
# Escape attributes for the shell
646
escaped_attrs = dict(
648
re.escape(unicode(str(getattr(self, attr, "")),
652
self.runtime_expansions)
655
command = self.checker_command % escaped_attrs
656
except TypeError as error:
657
logger.error('Could not format string "%s":'
658
' %s', self.checker_command, error)
659
return True # Try again later
1116
command = self.checker_command % escaped_attrs
1117
except TypeError as error:
1118
logger.error('Could not format string "%s"',
1119
self.checker_command,
1121
return True # Try again later
660
1122
self.current_checker_command = command
662
logger.info("Starting checker %r for %s",
664
# We don't need to redirect stdout and stderr, since
665
# in normal mode, that is already done by daemon(),
666
# and in debug mode we don't want to. (Stdin is
667
# always replaced by /dev/null.)
668
self.checker = subprocess.Popen(command,
671
self.checker_callback_tag = (gobject.child_watch_add
673
self.checker_callback,
675
# The checker may have completed before the gobject
676
# watch was added. Check for this.
677
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
679
gobject.source_remove(self.checker_callback_tag)
680
self.checker_callback(pid, status, command)
681
except OSError as error:
682
logger.error("Failed to start subprocess: %s",
684
# Re-run this periodically if run by gobject.timeout_add
1123
logger.info("Starting checker %r for %s", command,
1125
# We don't need to redirect stdout and stderr, since
1126
# in normal mode, that is already done by daemon(),
1127
# and in debug mode we don't want to. (Stdin is
1128
# always replaced by /dev/null.)
1129
# The exception is when not debugging but nevertheless
1130
# running in the foreground; use the previously
1132
popen_args = {"close_fds": True,
1135
if (not self.server_settings["debug"]
1136
and self.server_settings["foreground"]):
1137
popen_args.update({"stdout": wnull,
1139
pipe = multiprocessing.Pipe(duplex=False)
1140
self.checker = multiprocessing.Process(
1142
args=(pipe[1], subprocess.call, command),
1144
self.checker.start()
1145
self.checker_callback_tag = GLib.io_add_watch(
1146
pipe[0].fileno(), GLib.IO_IN,
1147
self.checker_callback, pipe[0], command)
1148
# Re-run this periodically if run by GLib.timeout_add
687
1151
def stop_checker(self):
688
1152
"""Force the checker process, if any, to stop."""
689
1153
if self.checker_callback_tag:
690
gobject.source_remove(self.checker_callback_tag)
1154
GLib.source_remove(self.checker_callback_tag)
691
1155
self.checker_callback_tag = None
692
1156
if getattr(self, "checker", None) is None:
694
1158
logger.debug("Stopping checker for %(name)s", vars(self))
696
os.kill(self.checker.pid, signal.SIGTERM)
698
#if self.checker.poll() is None:
699
# os.kill(self.checker.pid, signal.SIGKILL)
700
except OSError as error:
701
if error.errno != errno.ESRCH: # No such process
1159
self.checker.terminate()
703
1160
self.checker = None
706
def dbus_service_property(dbus_interface, signature="v",
707
access="readwrite", byte_arrays=False):
1163
def dbus_service_property(dbus_interface,
708
1167
"""Decorators for marking methods of a DBusObjectWithProperties to
709
1168
become properties on the D-Bus.
711
1170
The decorated method will be called with no arguments by "Get"
712
1171
and with one argument by "Set".
714
1173
The parameters, where they are supported, are the same as
715
1174
dbus.service.method, except there is only "signature", since the
716
1175
type from Get() and the type sent to Set() is the same.
886
1508
except (AttributeError, xml.dom.DOMException,
887
1509
xml.parsers.expat.ExpatError) as error:
888
1510
logger.error("Failed to override Introspection method",
893
def datetime_to_dbus (dt, variant_level=0):
1516
dbus.OBJECT_MANAGER_IFACE
1517
except AttributeError:
1518
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1521
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1522
"""A D-Bus object with an ObjectManager.
1524
Classes inheriting from this exposes the standard
1525
GetManagedObjects call and the InterfacesAdded and
1526
InterfacesRemoved signals on the standard
1527
"org.freedesktop.DBus.ObjectManager" interface.
1529
Note: No signals are sent automatically; they must be sent
1532
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1533
out_signature="a{oa{sa{sv}}}")
1534
def GetManagedObjects(self):
1535
"""This function must be overridden"""
1536
raise NotImplementedError()
1538
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1539
signature="oa{sa{sv}}")
1540
def InterfacesAdded(self, object_path, interfaces_and_properties):
1543
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1544
def InterfacesRemoved(self, object_path, interfaces):
1547
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1549
path_keyword='object_path',
1550
connection_keyword='connection')
1551
def Introspect(self, object_path, connection):
1552
"""Overloading of standard D-Bus method.
1554
Override return argument name of GetManagedObjects to be
1555
"objpath_interfaces_and_properties"
1557
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1561
document = xml.dom.minidom.parseString(xmlstring)
1563
for if_tag in document.getElementsByTagName("interface"):
1564
# Fix argument name for the GetManagedObjects method
1565
if (if_tag.getAttribute("name")
1566
== dbus.OBJECT_MANAGER_IFACE):
1567
for cn in if_tag.getElementsByTagName("method"):
1568
if (cn.getAttribute("name")
1569
== "GetManagedObjects"):
1570
for arg in cn.getElementsByTagName("arg"):
1571
if (arg.getAttribute("direction")
1575
"objpath_interfaces"
1577
xmlstring = document.toxml("utf-8")
1579
except (AttributeError, xml.dom.DOMException,
1580
xml.parsers.expat.ExpatError) as error:
1581
logger.error("Failed to override Introspection method",
1586
def datetime_to_dbus(dt, variant_level=0):
894
1587
"""Convert a UTC datetime.datetime() to a D-Bus type."""
896
return dbus.String("", variant_level = variant_level)
897
return dbus.String(dt.isoformat(),
898
variant_level=variant_level)
901
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
903
"""Applied to an empty subclass of a D-Bus object, this metaclass
904
will add additional D-Bus attributes matching a certain pattern.
1589
return dbus.String("", variant_level=variant_level)
1590
return dbus.String(dt.isoformat(), variant_level=variant_level)
1593
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1594
"""A class decorator; applied to a subclass of
1595
dbus.service.Object, it will add alternate D-Bus attributes with
1596
interface names according to the "alt_interface_names" mapping.
1599
@alternate_dbus_interfaces({"org.example.Interface":
1600
"net.example.AlternateInterface"})
1601
class SampleDBusObject(dbus.service.Object):
1602
@dbus.service.method("org.example.Interface")
1603
def SampleDBusMethod():
1606
The above "SampleDBusMethod" on "SampleDBusObject" will be
1607
reachable via two interfaces: "org.example.Interface" and
1608
"net.example.AlternateInterface", the latter of which will have
1609
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1610
"true", unless "deprecate" is passed with a False value.
1612
This works for methods and signals, and also for D-Bus properties
1613
(from DBusObjectWithProperties) and interfaces (from the
1614
dbus_interface_annotations decorator).
906
def __new__(mcs, name, bases, attr):
907
# Go through all the base classes which could have D-Bus
908
# methods, signals, or properties in them
909
for base in (b for b in bases
910
if issubclass(b, dbus.service.Object)):
911
# Go though all attributes of the base class
912
for attrname, attribute in inspect.getmembers(base):
1618
for orig_interface_name, alt_interface_name in (
1619
alt_interface_names.items()):
1621
interface_names = set()
1622
# Go though all attributes of the class
1623
for attrname, attribute in inspect.getmembers(cls):
913
1624
# Ignore non-D-Bus attributes, and D-Bus attributes
914
1625
# with the wrong interface name
915
1626
if (not hasattr(attribute, "_dbus_interface")
916
or not attribute._dbus_interface
917
.startswith("se.recompile.Mandos")):
1627
or not attribute._dbus_interface.startswith(
1628
orig_interface_name)):
919
1630
# Create an alternate D-Bus interface name based on
920
1631
# the current name
921
alt_interface = (attribute._dbus_interface
922
.replace("se.recompile.Mandos",
923
"se.bsnet.fukt.Mandos"))
1632
alt_interface = attribute._dbus_interface.replace(
1633
orig_interface_name, alt_interface_name)
1634
interface_names.add(alt_interface)
924
1635
# Is this a D-Bus signal?
925
1636
if getattr(attribute, "_dbus_is_signal", False):
926
# Extract the original non-method function by
928
nonmethod_func = (dict(
1637
# Extract the original non-method undecorated
1638
# function by black magic
1639
if sys.version_info.major == 2:
1640
nonmethod_func = (dict(
929
1641
zip(attribute.func_code.co_freevars,
930
attribute.__closure__))["func"]
1642
attribute.__closure__))
1643
["func"].cell_contents)
1645
nonmethod_func = (dict(
1646
zip(attribute.__code__.co_freevars,
1647
attribute.__closure__))
1648
["func"].cell_contents)
932
1649
# Create a new, but exactly alike, function
933
1650
# object, and decorate it to be a new D-Bus signal
934
1651
# with the alternate D-Bus interface name
935
new_function = (dbus.service.signal
937
attribute._dbus_signature)
939
nonmethod_func.func_code,
940
nonmethod_func.func_globals,
941
nonmethod_func.func_name,
942
nonmethod_func.func_defaults,
943
nonmethod_func.func_closure)))
1652
new_function = copy_function(nonmethod_func)
1653
new_function = (dbus.service.signal(
1655
attribute._dbus_signature)(new_function))
1656
# Copy annotations, if any
1658
new_function._dbus_annotations = dict(
1659
attribute._dbus_annotations)
1660
except AttributeError:
944
1663
# Define a creator of a function to call both the
945
# old and new functions, so both the old and new
946
# signals gets sent when the function is called
1664
# original and alternate functions, so both the
1665
# original and alternate signals gets sent when
1666
# the function is called
947
1667
def fixscope(func1, func2):
948
1668
"""This function is a scope container to pass
949
1669
func1 and func2 to the "call_both" function
950
1670
outside of its arguments"""
1672
@functools.wraps(func2)
951
1673
def call_both(*args, **kwargs):
952
1674
"""This function will emit two D-Bus
953
1675
signals by calling func1 and func2"""
954
1676
func1(*args, **kwargs)
955
1677
func2(*args, **kwargs)
1678
# Make wrapper function look like a D-Bus
1680
for name, attr in inspect.getmembers(func2):
1681
if name.startswith("_dbus_"):
1682
setattr(call_both, name, attr)
956
1684
return call_both
957
1685
# Create the "call_both" function and add it to
959
attr[attrname] = fixscope(attribute,
1687
attr[attrname] = fixscope(attribute, new_function)
961
1688
# Is this a D-Bus method?
962
1689
elif getattr(attribute, "_dbus_is_method", False):
963
1690
# Create a new, but exactly alike, function
964
1691
# object. Decorate it to be a new D-Bus method
965
1692
# with the alternate D-Bus interface name. Add it
967
attr[attrname] = (dbus.service.method
969
attribute._dbus_in_signature,
970
attribute._dbus_out_signature)
972
(attribute.func_code,
973
attribute.func_globals,
975
attribute.func_defaults,
976
attribute.func_closure)))
1695
dbus.service.method(
1697
attribute._dbus_in_signature,
1698
attribute._dbus_out_signature)
1699
(copy_function(attribute)))
1700
# Copy annotations, if any
1702
attr[attrname]._dbus_annotations = dict(
1703
attribute._dbus_annotations)
1704
except AttributeError:
977
1706
# Is this a D-Bus property?
978
1707
elif getattr(attribute, "_dbus_is_property", False):
979
1708
# Create a new, but exactly alike, function
980
1709
# object, and decorate it to be a new D-Bus
981
1710
# property with the alternate D-Bus interface
982
1711
# name. Add it to the class.
983
attr[attrname] = (dbus_service_property
985
attribute._dbus_signature,
986
attribute._dbus_access,
988
._dbus_get_args_options
991
(attribute.func_code,
992
attribute.func_globals,
994
attribute.func_defaults,
995
attribute.func_closure)))
996
return type.__new__(mcs, name, bases, attr)
1712
attr[attrname] = (dbus_service_property(
1713
alt_interface, attribute._dbus_signature,
1714
attribute._dbus_access,
1715
attribute._dbus_get_args_options
1717
(copy_function(attribute)))
1718
# Copy annotations, if any
1720
attr[attrname]._dbus_annotations = dict(
1721
attribute._dbus_annotations)
1722
except AttributeError:
1724
# Is this a D-Bus interface?
1725
elif getattr(attribute, "_dbus_is_interface", False):
1726
# Create a new, but exactly alike, function
1727
# object. Decorate it to be a new D-Bus interface
1728
# with the alternate D-Bus interface name. Add it
1731
dbus_interface_annotations(alt_interface)
1732
(copy_function(attribute)))
1734
# Deprecate all alternate interfaces
1735
iname = "_AlternateDBusNames_interface_annotation{}"
1736
for interface_name in interface_names:
1738
@dbus_interface_annotations(interface_name)
1740
return {"org.freedesktop.DBus.Deprecated":
1742
# Find an unused name
1743
for aname in (iname.format(i)
1744
for i in itertools.count()):
1745
if aname not in attr:
1749
# Replace the class with a new subclass of it with
1750
# methods, signals, etc. as created above.
1751
if sys.version_info.major == 2:
1752
cls = type(b"{}Alternate".format(cls.__name__),
1755
cls = type("{}Alternate".format(cls.__name__),
1762
@alternate_dbus_interfaces({"se.recompile.Mandos":
1763
"se.bsnet.fukt.Mandos"})
999
1764
class ClientDBus(Client, DBusObjectWithProperties):
1000
1765
"""A Client class using D-Bus
1003
1768
dbus_object_path: dbus.ObjectPath
1004
1769
bus: dbus.SystemBus()
1007
1772
runtime_expansions = (Client.runtime_expansions
1008
+ ("dbus_object_path",))
1773
+ ("dbus_object_path", ))
1775
_interface = "se.recompile.Mandos.Client"
1010
1777
# dbus.service.Object doesn't use super(), so we can't either.
1012
def __init__(self, bus = None, *args, **kwargs):
1779
def __init__(self, bus=None, *args, **kwargs):
1014
1781
Client.__init__(self, *args, **kwargs)
1016
self._approvals_pending = 0
1017
1782
# Only now, when this client is initialized, can it show up on
1019
client_object_name = unicode(self.name).translate(
1784
client_object_name = str(self.name).translate(
1020
1785
{ord("."): ord("_"),
1021
1786
ord("-"): ord("_")})
1022
self.dbus_object_path = (dbus.ObjectPath
1023
("/clients/" + client_object_name))
1787
self.dbus_object_path = dbus.ObjectPath(
1788
"/clients/" + client_object_name)
1024
1789
DBusObjectWithProperties.__init__(self, self.bus,
1025
1790
self.dbus_object_path)
1027
def notifychangeproperty(transform_func,
1028
dbus_name, type_func=lambda x: x,
1792
def notifychangeproperty(transform_func, dbus_name,
1793
type_func=lambda x: x,
1795
invalidate_only=False,
1796
_interface=_interface):
1030
1797
""" Modify a variable so that it's a property which announces
1031
1798
its changes to DBus.
1033
1800
transform_fun: Function that takes a value and a variant_level
1034
1801
and transforms it to a D-Bus type.
1035
1802
dbus_name: D-Bus name of the variable
2048
3067
use_ipv6 = server_settings["use_ipv6"]
2049
3068
stored_state_path = os.path.join(server_settings["statedir"],
2050
3069
stored_state_file)
3070
foreground = server_settings["foreground"]
3071
zeroconf = server_settings["zeroconf"]
2053
initlogger(logging.DEBUG)
3074
initlogger(debug, logging.DEBUG)
2055
3076
if not debuglevel:
2058
3079
level = getattr(logging, debuglevel.upper())
3080
initlogger(debug, level)
2061
3082
if server_settings["servicename"] != "Mandos":
2062
syslogger.setFormatter(logging.Formatter
2063
('Mandos (%s) [%%(process)d]:'
2064
' %%(levelname)s: %%(message)s'
2065
% server_settings["servicename"]))
3083
syslogger.setFormatter(
3084
logging.Formatter('Mandos ({}) [%(process)d]:'
3085
' %(levelname)s: %(message)s'.format(
3086
server_settings["servicename"])))
2067
3088
# Parse config file with clients
2068
client_defaults = { "timeout": "5m",
2069
"extended_timeout": "15m",
2071
"checker": "fping -q -- %%(host)s",
2073
"approval_delay": "0s",
2074
"approval_duration": "1s",
2076
client_config = configparser.SafeConfigParser(client_defaults)
3089
client_config = configparser.ConfigParser(Client.client_defaults)
2077
3090
client_config.read(os.path.join(server_settings["configdir"],
2078
3091
"clients.conf"))
2080
3093
global mandos_dbus_service
2081
3094
mandos_dbus_service = None
2083
tcp_server = MandosServer((server_settings["address"],
2084
server_settings["port"]),
2086
interface=(server_settings["interface"]
2090
server_settings["priority"],
2093
pidfilename = "/var/run/mandos.pid"
2095
pidfile = open(pidfilename, "w")
2097
logger.error("Could not open file %r", pidfilename)
2100
uid = pwd.getpwnam("_mandos").pw_uid
2101
gid = pwd.getpwnam("_mandos").pw_gid
2104
uid = pwd.getpwnam("mandos").pw_uid
2105
gid = pwd.getpwnam("mandos").pw_gid
3097
if server_settings["socket"] != "":
3098
socketfd = server_settings["socket"]
3099
tcp_server = MandosServer(
3100
(server_settings["address"], server_settings["port"]),
3102
interface=(server_settings["interface"] or None),
3104
gnutls_priority=server_settings["priority"],
3108
pidfilename = "/run/mandos.pid"
3109
if not os.path.isdir("/run/."):
3110
pidfilename = "/var/run/mandos.pid"
3113
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3114
except IOError as e:
3115
logger.error("Could not open file %r", pidfilename,
3118
for name, group in (("_mandos", "_mandos"),
3119
("mandos", "mandos"),
3120
("nobody", "nogroup")):
3122
uid = pwd.getpwnam(name).pw_uid
3123
gid = pwd.getpwnam(group).pw_gid
2106
3125
except KeyError:
2108
uid = pwd.getpwnam("nobody").pw_uid
2109
gid = pwd.getpwnam("nobody").pw_gid
3134
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2116
3136
except OSError as error:
2117
if error[0] != errno.EPERM:
3137
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3138
.format(uid, gid, os.strerror(error.errno)))
3139
if error.errno != errno.EPERM:
2121
3143
# Enable all possible GnuTLS debugging
2123
3145
# "Use a log level over 10 to enable all debugging options."
2124
3146
# - GnuTLS manual
2125
gnutls.library.functions.gnutls_global_set_log_level(11)
2127
@gnutls.library.types.gnutls_log_func
3147
gnutls.global_set_log_level(11)
2128
3150
def debug_gnutls(level, string):
2129
3151
logger.debug("GnuTLS: %s", string[:-1])
2131
(gnutls.library.functions
2132
.gnutls_global_set_log_function(debug_gnutls))
3153
gnutls.global_set_log_function(debug_gnutls)
2134
3155
# Redirect stdin so all checkers get /dev/null
2135
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
3156
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2136
3157
os.dup2(null, sys.stdin.fileno())
2140
# No console logging
2141
logger.removeHandler(console)
2143
3161
# Need to fork before connecting to D-Bus
2145
3163
# Close all input and output, do double fork, etc.
3166
if gi.version_info < (3, 10, 2):
3167
# multiprocessing will use threads, so before we use GLib we
3168
# need to inform GLib that threads will be used.
2148
3171
global main_loop
2149
3172
# From the Avahi example code
2150
DBusGMainLoop(set_as_default=True )
2151
main_loop = gobject.MainLoop()
3173
DBusGMainLoop(set_as_default=True)
3174
main_loop = GLib.MainLoop()
2152
3175
bus = dbus.SystemBus()
2153
3176
# End of Avahi example code
2156
3179
bus_name = dbus.service.BusName("se.recompile.Mandos",
2157
bus, do_not_queue=True)
2158
old_bus_name = (dbus.service.BusName
2159
("se.bsnet.fukt.Mandos", bus,
2161
except dbus.exceptions.NameExistsException as e:
2162
logger.error(unicode(e) + ", disabling D-Bus")
3182
old_bus_name = dbus.service.BusName(
3183
"se.bsnet.fukt.Mandos", bus,
3185
except dbus.exceptions.DBusException as e:
3186
logger.error("Disabling D-Bus:", exc_info=e)
2163
3187
use_dbus = False
2164
3188
server_settings["use_dbus"] = False
2165
3189
tcp_server.use_dbus = False
2166
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2167
service = AvahiServiceToSyslog(name =
2168
server_settings["servicename"],
2169
servicetype = "_mandos._tcp",
2170
protocol = protocol, bus = bus)
2171
if server_settings["interface"]:
2172
service.interface = (if_nametoindex
2173
(str(server_settings["interface"])))
3191
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3192
service = AvahiServiceToSyslog(
3193
name=server_settings["servicename"],
3194
servicetype="_mandos._tcp",
3197
if server_settings["interface"]:
3198
service.interface = if_nametoindex(
3199
server_settings["interface"].encode("utf-8"))
2175
3201
global multiprocessing_manager
2176
3202
multiprocessing_manager = multiprocessing.Manager()
2178
3204
client_class = Client
2180
client_class = functools.partial(ClientDBusTransitional,
2183
special_settings = {
2184
# Some settings need to be accessd by special methods;
2185
# booleans need .getboolean(), etc. Here is a list of them:
2186
"approved_by_default":
2188
client_config.getboolean(section, "approved_by_default"),
2191
client_config.getboolean(section, "enabled"),
2193
# Construct a new dict of client settings of this form:
2194
# { client_name: {setting_name: value, ...}, ...}
2195
# with exceptions for any special settings as defined above
2196
client_settings = dict((clientname,
2199
if setting not in special_settings
2200
else special_settings[setting]
2202
for setting, value in
2203
client_config.items(clientname)))
2204
for clientname in client_config.sections())
3206
client_class = functools.partial(ClientDBus, bus=bus)
3208
client_settings = Client.config_parser(client_config)
2206
3209
old_client_settings = {}
3212
# This is used to redirect stdout and stderr for checker processes
3214
wnull = open(os.devnull, "w") # A writable /dev/null
3215
# Only used if server is running in foreground but not in debug
3217
if debug or not foreground:
2209
3220
# Get client data and settings from last running state.
2210
3221
if server_settings["restore"]:
2212
3223
with open(stored_state_path, "rb") as stored_state:
2213
clients_data, old_client_settings = (pickle.load
3224
if sys.version_info.major == 2:
3225
clients_data, old_client_settings = pickle.load(
3228
bytes_clients_data, bytes_old_client_settings = (
3229
pickle.load(stored_state, encoding="bytes"))
3230
# Fix bytes to strings
3233
clients_data = {(key.decode("utf-8")
3234
if isinstance(key, bytes)
3237
bytes_clients_data.items()}
3238
del bytes_clients_data
3239
for key in clients_data:
3240
value = {(k.decode("utf-8")
3241
if isinstance(k, bytes) else k): v
3243
clients_data[key].items()}
3244
clients_data[key] = value
3246
value["client_structure"] = [
3248
if isinstance(s, bytes)
3250
value["client_structure"]]
3252
for k in ("name", "host"):
3253
if isinstance(value[k], bytes):
3254
value[k] = value[k].decode("utf-8")
3255
if "key_id" not in value:
3256
value["key_id"] = ""
3257
elif "fingerprint" not in value:
3258
value["fingerprint"] = ""
3259
# old_client_settings
3261
old_client_settings = {
3262
(key.decode("utf-8")
3263
if isinstance(key, bytes)
3266
bytes_old_client_settings.items()}
3267
del bytes_old_client_settings
3269
for value in old_client_settings.values():
3270
if isinstance(value["host"], bytes):
3271
value["host"] = (value["host"]
2215
3273
os.remove(stored_state_path)
2216
3274
except IOError as e:
2217
logger.warning("Could not load persistent state: {0}"
2219
if e.errno != errno.ENOENT:
3275
if e.errno == errno.ENOENT:
3276
logger.warning("Could not load persistent state:"
3277
" {}".format(os.strerror(e.errno)))
3279
logger.critical("Could not load persistent state:",
3282
except EOFError as e:
3283
logger.warning("Could not load persistent state: "
2222
3287
with PGPEngine() as pgp:
2223
for client in clients_data:
2224
client_name = client["name"]
3288
for client_name, client in clients_data.items():
3289
# Skip removed clients
3290
if client_name not in client_settings:
2226
3293
# Decide which value to use after restoring saved state.
2227
3294
# We have three different values: Old config file,
2228
3295
# new config file, and saved state.
2233
3300
# For each value in new config, check if it
2234
3301
# differs from the old config value (Except for
2235
3302
# the "secret" attribute)
2236
if (name != "secret" and
2237
value != old_client_settings[client_name]
3303
if (name != "secret"
3305
old_client_settings[client_name][name])):
2239
3306
client[name] = value
2240
3307
except KeyError:
2243
3310
# Clients who has passed its expire date can still be
2244
# enabled if its last checker was sucessful. Clients
2245
# whose checker failed before we stored its state is
2246
# assumed to have failed all checkers during downtime.
3311
# enabled if its last checker was successful. A Client
3312
# whose checker succeeded before we stored its state is
3313
# assumed to have successfully run all checkers during
2247
3315
if client["enabled"]:
2248
if client["expires"] <= (datetime.datetime
2250
# Client has expired
2251
if client["last_checker_status"] != 0:
3316
if datetime.datetime.utcnow() >= client["expires"]:
3317
if not client["last_checked_ok"]:
3319
"disabling client {} - Client never "
3320
"performed a successful checker".format(
3322
client["enabled"] = False
3323
elif client["last_checker_status"] != 0:
3325
"disabling client {} - Client last"
3326
" checker failed with error code"
3329
client["last_checker_status"]))
2252
3330
client["enabled"] = False
2254
client["expires"] = (datetime.datetime
2256
+ client["timeout"])
2258
client["changedstate"] = (multiprocessing_manager
2260
(multiprocessing_manager
2263
new_client = (ClientDBusTransitional.__new__
2264
(ClientDBusTransitional))
2265
tcp_server.clients[client_name] = new_client
2266
new_client.bus = bus
2267
for name, value in client.iteritems():
2268
setattr(new_client, name, value)
2269
client_object_name = unicode(client_name).translate(
2270
{ord("."): ord("_"),
2271
ord("-"): ord("_")})
2272
new_client.dbus_object_path = (dbus.ObjectPath
2274
+ client_object_name))
2275
DBusObjectWithProperties.__init__(new_client,
2280
tcp_server.clients[client_name] = (Client.__new__
2282
for name, value in client.iteritems():
2283
setattr(tcp_server.clients[client_name],
3332
client["expires"] = (
3333
datetime.datetime.utcnow()
3334
+ client["timeout"])
3335
logger.debug("Last checker succeeded,"
3336
" keeping {} enabled".format(
2287
tcp_server.clients[client_name].secret = (
2288
pgp.decrypt(tcp_server.clients[client_name]
2290
client_settings[client_name]
3339
client["secret"] = pgp.decrypt(
3340
client["encrypted_secret"],
3341
client_settings[client_name]["secret"])
2292
3342
except PGPError:
2293
3343
# If decryption fails, we use secret from new settings
2294
logger.debug("Failed to decrypt {0} old secret"
2295
.format(client_name))
2296
tcp_server.clients[client_name].secret = (
2297
client_settings[client_name]["secret"])
2299
# Create/remove clients based on new changes made to config
2300
for clientname in set(old_client_settings) - set(client_settings):
2301
del tcp_server.clients[clientname]
2302
for clientname in set(client_settings) - set(old_client_settings):
2303
tcp_server.clients[clientname] = (client_class(name
3344
logger.debug("Failed to decrypt {} old secret".format(
3346
client["secret"] = (client_settings[client_name]
3349
# Add/remove clients based on new changes made to config
3350
for client_name in (set(old_client_settings)
3351
- set(client_settings)):
3352
del clients_data[client_name]
3353
for client_name in (set(client_settings)
3354
- set(old_client_settings)):
3355
clients_data[client_name] = client_settings[client_name]
3357
# Create all client objects
3358
for client_name, client in clients_data.items():
3359
tcp_server.clients[client_name] = client_class(
3362
server_settings=server_settings)
2309
3364
if not tcp_server.clients:
2310
3365
logger.warning("No clients defined")
2316
pidfile.write(str(pid) + "\n".encode("utf-8"))
2319
logger.error("Could not write to file %r with PID %d",
2322
# "pidfile" was never created
3368
if pidfile is not None:
3372
print(pid, file=pidfile)
3374
logger.error("Could not write to file %r with PID %d",
2324
3377
del pidfilename
2326
signal.signal(signal.SIGINT, signal.SIG_IGN)
2328
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2329
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3379
for termsig in (signal.SIGHUP, signal.SIGTERM):
3380
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3381
lambda: main_loop.quit() and False)
2332
class MandosDBusService(dbus.service.Object):
3385
@alternate_dbus_interfaces(
3386
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3387
class MandosDBusService(DBusObjectWithObjectManager):
2333
3388
"""A D-Bus proxy object"""
2334
3390
def __init__(self):
2335
3391
dbus.service.Object.__init__(self, bus, "/")
2336
3393
_interface = "se.recompile.Mandos"
2338
3395
@dbus.service.signal(_interface, signature="o")
2339
3396
def ClientAdded(self, objpath):
2343
3400
@dbus.service.signal(_interface, signature="ss")
2344
def ClientNotFound(self, fingerprint, address):
3401
def ClientNotFound(self, key_id, address):
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2348
3407
@dbus.service.signal(_interface, signature="os")
2349
3408
def ClientRemoved(self, objpath, name):
3412
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2353
3414
@dbus.service.method(_interface, out_signature="ao")
2354
3415
def GetAllClients(self):
2356
return dbus.Array(c.dbus_object_path
2358
tcp_server.clients.itervalues())
3417
return dbus.Array(c.dbus_object_path for c in
3418
tcp_server.clients.values())
3420
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2360
3422
@dbus.service.method(_interface,
2361
3423
out_signature="a{oa{sv}}")
2362
3424
def GetAllClientsWithProperties(self):
2364
3426
return dbus.Dictionary(
2365
((c.dbus_object_path, c.GetAll(""))
2366
for c in tcp_server.clients.itervalues()),
3427
{c.dbus_object_path: c.GetAll(
3428
"se.recompile.Mandos.Client")
3429
for c in tcp_server.clients.values()},
2367
3430
signature="oa{sv}")
2369
3432
@dbus.service.method(_interface, in_signature="o")
2370
3433
def RemoveClient(self, object_path):
2372
for c in tcp_server.clients.itervalues():
3435
for c in tcp_server.clients.values():
2373
3436
if c.dbus_object_path == object_path:
2374
3437
del tcp_server.clients[c.name]
2375
3438
c.remove_from_connection()
2376
# Don't signal anything except ClientRemoved
3439
# Don't signal the disabling
2377
3440
c.disable(quiet=True)
2379
self.ClientRemoved(object_path, c.name)
3441
# Emit D-Bus signal for removal
3442
self.client_removed_signal(c)
2381
3444
raise KeyError(object_path)
2385
class MandosDBusServiceTransitional(MandosDBusService):
2386
__metaclass__ = AlternateDBusNamesMetaclass
2387
mandos_dbus_service = MandosDBusServiceTransitional()
3448
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3449
out_signature="a{oa{sa{sv}}}")
3450
def GetManagedObjects(self):
3452
return dbus.Dictionary(
3453
{client.dbus_object_path:
3455
{interface: client.GetAll(interface)
3457
client._get_all_interface_names()})
3458
for client in tcp_server.clients.values()})
3460
def client_added_signal(self, client):
3461
"""Send the new standard signal and the old signal"""
3463
# New standard signal
3464
self.InterfacesAdded(
3465
client.dbus_object_path,
3467
{interface: client.GetAll(interface)
3469
client._get_all_interface_names()}))
3471
self.ClientAdded(client.dbus_object_path)
3473
def client_removed_signal(self, client):
3474
"""Send the new standard signal and the old signal"""
3476
# New standard signal
3477
self.InterfacesRemoved(
3478
client.dbus_object_path,
3479
client._get_all_interface_names())
3481
self.ClientRemoved(client.dbus_object_path,
3484
mandos_dbus_service = MandosDBusService()
3486
# Save modules to variables to exempt the modules from being
3487
# unloaded before the function registered with atexit() is run.
3488
mp = multiprocessing
2390
3492
"Cleanup function; run on exit"
2393
multiprocessing.active_children()
3496
mp.active_children()
2394
3498
if not (tcp_server.clients or client_settings):
2397
3501
# Store client before exiting. Secrets are encrypted with key
2398
3502
# based on what config file has. If config file is
2399
3503
# removed/edited, old secret will thus be unrecovable.
2401
3505
with PGPEngine() as pgp:
2402
for client in tcp_server.clients.itervalues():
3506
for client in tcp_server.clients.values():
2403
3507
key = client_settings[client.name]["secret"]
2404
3508
client.encrypted_secret = pgp.encrypt(client.secret,
2406
3510
client_dict = {}
2408
# A list of attributes that will not be stored when
2410
exclude = set(("bus", "changedstate", "secret"))
2411
for name, typ in (inspect.getmembers
2412
(dbus.service.Object)):
3512
# A list of attributes that can not be pickled
3514
exclude = {"bus", "changedstate", "secret",
3515
"checker", "server_settings"}
3516
for name, typ in inspect.getmembers(dbus.service
2413
3518
exclude.add(name)
2415
3520
client_dict["encrypted_secret"] = (client
2416
3521
.encrypted_secret)
2417
3522
for attr in client.client_structure:
2418
3523
if attr not in exclude:
2419
3524
client_dict[attr] = getattr(client, attr)
2421
clients.append(client_dict)
3526
clients[client.name] = client_dict
2422
3527
del client_settings[client.name]["secret"]
2425
with os.fdopen(os.open(stored_state_path,
2426
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2427
0600), "wb") as stored_state:
2428
pickle.dump((clients, client_settings), stored_state)
3530
with tempfile.NamedTemporaryFile(
3534
dir=os.path.dirname(stored_state_path),
3535
delete=False) as stored_state:
3536
pickle.dump((clients, client_settings), stored_state,
3538
tempname = stored_state.name
3539
os.rename(tempname, stored_state_path)
2429
3540
except (IOError, OSError) as e:
2430
logger.warning("Could not save persistent state: {0}"
2432
if e.errno not in (errno.ENOENT, errno.EACCES):
3546
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3547
logger.warning("Could not save persistent state: {}"
3548
.format(os.strerror(e.errno)))
3550
logger.warning("Could not save persistent state:",
2435
3554
# Delete all clients, and settings from config
2436
3555
while tcp_server.clients:
2437
3556
name, client = tcp_server.clients.popitem()
2439
3558
client.remove_from_connection()
2440
# Don't signal anything except ClientRemoved
3559
# Don't signal the disabling
2441
3560
client.disable(quiet=True)
3561
# Emit D-Bus signal for removal
2444
mandos_dbus_service.ClientRemoved(client
3563
mandos_dbus_service.client_removed_signal(client)
2447
3564
client_settings.clear()
2449
3566
atexit.register(cleanup)
2451
for client in tcp_server.clients.itervalues():
3568
for client in tcp_server.clients.values():
2454
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3570
# Emit D-Bus signal for adding
3571
mandos_dbus_service.client_added_signal(client)
2455
3572
# Need to initiate checking of clients
2456
3573
if client.enabled:
2457
3574
client.init_checker()
2459
3576
tcp_server.enable()
2460
3577
tcp_server.server_activate()
2462
3579
# Find out what port we got
2463
service.port = tcp_server.socket.getsockname()[1]
3581
service.port = tcp_server.socket.getsockname()[1]
2465
3583
logger.info("Now listening on address %r, port %d,"
2466
" flowinfo %d, scope_id %d"
2467
% tcp_server.socket.getsockname())
3584
" flowinfo %d, scope_id %d",
3585
*tcp_server.socket.getsockname())
2469
logger.info("Now listening on address %r, port %d"
2470
% tcp_server.socket.getsockname())
2472
#service.interface = tcp_server.socket.getsockname()[3]
3587
logger.info("Now listening on address %r, port %d",
3588
*tcp_server.socket.getsockname())
3590
# service.interface = tcp_server.socket.getsockname()[3]
2475
# From the Avahi example code
2478
except dbus.exceptions.DBusException as error:
2479
logger.critical("DBusException: %s", error)
2482
# End of Avahi example code
2484
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2485
lambda *args, **kwargs:
2486
(tcp_server.handle_request
2487
(*args[2:], **kwargs) or True))
3594
# From the Avahi example code
3597
except dbus.exceptions.DBusException as error:
3598
logger.critical("D-Bus Exception", exc_info=error)
3601
# End of Avahi example code
3603
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3604
lambda *args, **kwargs:
3605
(tcp_server.handle_request
3606
(*args[2:], **kwargs) or True))
2489
3608
logger.debug("Starting main loop")
2490
3609
main_loop.run()
2491
3610
except AvahiError as error:
2492
logger.critical("AvahiError: %s", error)
3611
logger.critical("Avahi Error", exc_info=error)
2495
3614
except KeyboardInterrupt: