171
170
# End of Avahi example code
174
class Client(object):
173
def _datetime_to_dbus_struct(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus struct.
175
The format is special to this application, since we could not find
176
any other standard way."""
177
return dbus.Struct((dbus.Int16(dt.year),
181
dbus.Byte(dt.minute),
182
dbus.Byte(dt.second),
183
dbus.UInt32(dt.microsecond)),
185
variant_level=variant_level)
188
class Client(dbus.service.Object):
175
189
"""A representation of a client host served by this server.
177
name: string; from the config file, used in log messages
191
name: string; from the config file, used in log messages
178
192
fingerprint: string (40 or 32 hexadecimal digits); used to
179
193
uniquely identify the client
180
secret: bytestring; sent verbatim (over TLS) to client
181
host: string; available for use by the checker command
182
created: datetime.datetime(); object creation, not client host
183
last_checked_ok: datetime.datetime() or None if not yet checked OK
184
timeout: datetime.timedelta(); How long from last_checked_ok
185
until this client is invalid
186
interval: datetime.timedelta(); How often to start a new checker
187
stop_hook: If set, called by stop() as stop_hook(self)
188
checker: subprocess.Popen(); a running checker process used
189
to see if the client lives.
190
'None' if no process is running.
194
secret: bytestring; sent verbatim (over TLS) to client
195
host: string; available for use by the checker command
196
created: datetime.datetime(); (UTC) object creation
197
last_started: datetime.datetime(); (UTC)
199
last_checked_ok: datetime.datetime(); (UTC) or None
200
timeout: datetime.timedelta(); How long from last_checked_ok
201
until this client is invalid
202
interval: datetime.timedelta(); How often to start a new checker
203
stop_hook: If set, called by stop() as stop_hook(self)
204
checker: subprocess.Popen(); a running checker process used
205
to see if the client lives.
206
'None' if no process is running.
191
207
checker_initiator_tag: a gobject event source tag, or None
192
208
stop_initiator_tag: - '' -
193
209
checker_callback_tag: - '' -
202
219
_interval_milliseconds: - '' -
204
221
def _set_timeout(self, timeout):
205
"Setter function for 'timeout' attribute"
222
"Setter function for the 'timeout' attribute"
206
223
self._timeout = timeout
207
224
self._timeout_milliseconds = ((self.timeout.days
208
225
* 24 * 60 * 60 * 1000)
209
226
+ (self.timeout.seconds * 1000)
210
227
+ (self.timeout.microseconds
212
timeout = property(lambda self: self._timeout,
230
self.PropertyChanged(dbus.String(u"timeout"),
231
(dbus.UInt64(self._timeout_milliseconds,
233
timeout = property(lambda self: self._timeout, _set_timeout)
215
236
def _set_interval(self, interval):
216
"Setter function for 'interval' attribute"
237
"Setter function for the 'interval' attribute"
217
238
self._interval = interval
218
239
self._interval_milliseconds = ((self.interval.days
219
240
* 24 * 60 * 60 * 1000)
235
265
# Uppercase and remove spaces from fingerprint for later
236
266
# comparison purposes with return value from the fingerprint()
238
self.fingerprint = config["fingerprint"].upper()\
268
self.fingerprint = (config["fingerprint"].upper()
240
270
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
271
if "secret" in config:
242
272
self.secret = config["secret"].decode(u"base64")
243
273
elif "secfile" in config:
244
274
with closing(open(os.path.expanduser
245
275
(os.path.expandvars
246
(config["secfile"])))) \
276
(config["secfile"])))) as secfile:
248
277
self.secret = secfile.read()
250
279
raise TypeError(u"No secret or secfile for client %s"
252
281
self.host = config.get("host", "")
253
self.created = datetime.datetime.now()
282
self.created = datetime.datetime.utcnow()
284
self.last_started = None
254
285
self.last_checked_ok = None
255
286
self.timeout = string_to_delta(config["timeout"])
256
287
self.interval = string_to_delta(config["interval"])
259
290
self.checker_initiator_tag = None
260
291
self.stop_initiator_tag = None
261
292
self.checker_callback_tag = None
262
self.check_command = config["checker"]
293
self.checker_command = config["checker"]
264
296
"""Start this client's checker and timeout hooks"""
297
self.last_started = datetime.datetime.utcnow()
265
298
# Schedule a new checker to be started an 'interval' from now,
266
299
# and every interval from then on.
267
self.checker_initiator_tag = gobject.timeout_add\
268
(self._interval_milliseconds,
300
self.checker_initiator_tag = (gobject.timeout_add
301
(self._interval_milliseconds,
270
303
# Also start a new checker *right now*.
271
304
self.start_checker()
272
305
# Schedule a stop() when 'timeout' has passed
273
self.stop_initiator_tag = gobject.timeout_add\
274
(self._timeout_milliseconds,
306
self.stop_initiator_tag = (gobject.timeout_add
307
(self._timeout_milliseconds,
311
self.PropertyChanged(dbus.String(u"started"),
312
dbus.Boolean(True, variant_level=1))
313
self.PropertyChanged(dbus.String(u"last_started"),
314
(_datetime_to_dbus_struct
315
(self.last_started, variant_level=1)))
278
The possibility that a client might be restarted is left open,
279
but not currently used."""
280
# If this client doesn't have a secret, it is already stopped.
281
if hasattr(self, "secret") and self.secret:
282
logger.info(u"Stopping client %s", self.name)
318
"""Stop this client."""
319
if not getattr(self, "started", False):
321
logger.info(u"Stopping client %s", self.name)
286
322
if getattr(self, "stop_initiator_tag", False):
287
323
gobject.source_remove(self.stop_initiator_tag)
288
324
self.stop_initiator_tag = None
292
328
self.stop_checker()
293
329
if self.stop_hook:
294
330
self.stop_hook(self)
333
self.PropertyChanged(dbus.String(u"started"),
334
dbus.Boolean(False, variant_level=1))
295
335
# Do not run this again if called by a gobject.timeout_add
297
338
def __del__(self):
298
339
self.stop_hook = None
300
def checker_callback(self, pid, condition):
342
def checker_callback(self, pid, condition, command):
301
343
"""The checker has completed, so take appropriate actions."""
302
344
self.checker_callback_tag = None
303
345
self.checker = None
304
if os.WIFEXITED(condition) \
305
and (os.WEXITSTATUS(condition) == 0):
347
self.PropertyChanged(dbus.String(u"checker_running"),
348
dbus.Boolean(False, variant_level=1))
349
if (os.WIFEXITED(condition)
350
and (os.WEXITSTATUS(condition) == 0)):
306
351
logger.info(u"Checker for %(name)s succeeded",
354
self.CheckerCompleted(dbus.Boolean(True),
355
dbus.UInt16(condition),
356
dbus.String(command))
308
357
self.bump_timeout()
309
358
elif not os.WIFEXITED(condition):
310
359
logger.warning(u"Checker for %(name)s crashed?",
362
self.CheckerCompleted(dbus.Boolean(False),
363
dbus.UInt16(condition),
364
dbus.String(command))
313
366
logger.info(u"Checker for %(name)s failed",
369
self.CheckerCompleted(dbus.Boolean(False),
370
dbus.UInt16(condition),
371
dbus.String(command))
315
373
def bump_timeout(self):
316
374
"""Bump up the timeout for this client.
317
375
This should only be called when the client has been seen,
320
self.last_checked_ok = datetime.datetime.now()
378
self.last_checked_ok = datetime.datetime.utcnow()
321
379
gobject.source_remove(self.stop_initiator_tag)
322
self.stop_initiator_tag = gobject.timeout_add\
323
(self._timeout_milliseconds, self.stop)
380
self.stop_initiator_tag = (gobject.timeout_add
381
(self._timeout_milliseconds,
383
self.PropertyChanged(dbus.String(u"last_checked_ok"),
384
(_datetime_to_dbus_struct
385
(self.last_checked_ok,
324
388
def start_checker(self):
325
389
"""Start a new checker subprocess if one is not running.
326
390
If a checker already exists, leave it running and do
383
453
if error.errno != errno.ESRCH: # No such process
385
455
self.checker = None
456
self.PropertyChanged(dbus.String(u"checker_running"),
457
dbus.Boolean(False, variant_level=1))
386
459
def still_valid(self):
387
460
"""Has the timeout not yet passed for this client?"""
388
now = datetime.datetime.now()
461
if not getattr(self, "started", False):
463
now = datetime.datetime.utcnow()
389
464
if self.last_checked_ok is None:
390
465
return now < (self.created + self.timeout)
392
467
return now < (self.last_checked_ok + self.timeout)
469
## D-Bus methods & signals
470
_interface = u"org.mandos_system.Mandos.Client"
472
# BumpTimeout - method
473
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
474
BumpTimeout.__name__ = "BumpTimeout"
476
# CheckerCompleted - signal
477
@dbus.service.signal(_interface, signature="bqs")
478
def CheckerCompleted(self, success, condition, command):
482
# CheckerStarted - signal
483
@dbus.service.signal(_interface, signature="s")
484
def CheckerStarted(self, command):
488
# GetAllProperties - method
489
@dbus.service.method(_interface, out_signature="a{sv}")
490
def GetAllProperties(self):
492
return dbus.Dictionary({
494
dbus.String(self.name, variant_level=1),
495
dbus.String("fingerprint"):
496
dbus.String(self.fingerprint, variant_level=1),
498
dbus.String(self.host, variant_level=1),
499
dbus.String("created"):
500
_datetime_to_dbus_struct(self.created,
502
dbus.String("last_started"):
503
(_datetime_to_dbus_struct(self.last_started,
505
if self.last_started is not None
506
else dbus.Boolean(False, variant_level=1)),
507
dbus.String("started"):
508
dbus.Boolean(self.started, variant_level=1),
509
dbus.String("last_checked_ok"):
510
(_datetime_to_dbus_struct(self.last_checked_ok,
512
if self.last_checked_ok is not None
513
else dbus.Boolean (False, variant_level=1)),
514
dbus.String("timeout"):
515
dbus.UInt64(self._timeout_milliseconds,
517
dbus.String("interval"):
518
dbus.UInt64(self._interval_milliseconds,
520
dbus.String("checker"):
521
dbus.String(self.checker_command,
523
dbus.String("checker_running"):
524
dbus.Boolean(self.checker is not None,
528
# IsStillValid - method
529
IsStillValid = (dbus.service.method(_interface, out_signature="b")
531
IsStillValid.__name__ = "IsStillValid"
533
# PropertyChanged - signal
534
@dbus.service.signal(_interface, signature="sv")
535
def PropertyChanged(self, property, value):
539
# SetChecker - method
540
@dbus.service.method(_interface, in_signature="s")
541
def SetChecker(self, checker):
542
"D-Bus setter method"
543
self.checker_command = checker
546
@dbus.service.method(_interface, in_signature="s")
547
def SetHost(self, host):
548
"D-Bus setter method"
551
# SetInterval - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetInterval(self, milliseconds):
554
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
557
@dbus.service.method(_interface, in_signature="ay",
559
def SetSecret(self, secret):
560
"D-Bus setter method"
561
self.secret = str(secret)
563
# SetTimeout - method
564
@dbus.service.method(_interface, in_signature="t")
565
def SetTimeout(self, milliseconds):
566
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
569
Start = dbus.service.method(_interface)(start)
570
Start.__name__ = "Start"
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
579
@dbus.service.method(_interface)
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
395
591
def peer_certificate(session):
396
592
"Return the peer's OpenPGP certificate as a bytestring"
397
593
# If not an OpenPGP certificate...
398
if gnutls.library.functions.gnutls_certificate_type_get\
399
(session._c_object) \
400
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
401
597
# ...do the normal thing
402
598
return session.peer_certificate
403
599
list_size = ctypes.c_uint()
404
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
405
(session._c_object, ctypes.byref(list_size))
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
406
603
if list_size.value == 0:
408
605
cert = cert_list[0]
412
609
def fingerprint(openpgp):
413
610
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
414
611
# New GnuTLS "datum" with the OpenPGP public key
415
datum = gnutls.library.types.gnutls_datum_t\
416
(ctypes.cast(ctypes.c_char_p(openpgp),
417
ctypes.POINTER(ctypes.c_ubyte)),
418
ctypes.c_uint(len(openpgp)))
612
datum = (gnutls.library.types
613
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
616
ctypes.c_uint(len(openpgp))))
419
617
# New empty GnuTLS certificate
420
618
crt = gnutls.library.types.gnutls_openpgp_crt_t()
421
gnutls.library.functions.gnutls_openpgp_crt_init\
619
(gnutls.library.functions
620
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
423
621
# Import the OpenPGP public key into the certificate
424
gnutls.library.functions.gnutls_openpgp_crt_import\
425
(crt, ctypes.byref(datum),
426
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
624
gnutls.library.constants
625
.GNUTLS_OPENPGP_FMT_RAW))
427
626
# Verify the self signature in the key
428
627
crtverify = ctypes.c_uint()
429
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
430
(crt, 0, ctypes.byref(crtverify))
628
(gnutls.library.functions
629
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
431
630
if crtverify.value != 0:
432
631
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
433
632
raise gnutls.errors.CertificateSecurityError("Verify failed")
886
1087
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
887
1088
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1090
class MandosServer(dbus.service.Object):
1091
"""A D-Bus proxy object"""
1093
dbus.service.Object.__init__(self, bus,
1095
_interface = u"org.mandos_system.Mandos"
1097
@dbus.service.signal(_interface, signature="oa{sv}")
1098
def ClientAdded(self, objpath, properties):
1102
@dbus.service.signal(_interface, signature="o")
1103
def ClientRemoved(self, objpath):
1107
@dbus.service.method(_interface, out_signature="ao")
1108
def GetAllClients(self):
1109
return dbus.Array(c.dbus_object_path for c in clients)
1111
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1112
def GetAllClientsWithProperties(self):
1113
return dbus.Dictionary(
1114
((c.dbus_object_path, c.GetAllProperties())
1118
@dbus.service.method(_interface, in_signature="o")
1119
def RemoveClient(self, object_path):
1121
if c.dbus_object_path == object_path:
1129
mandos_server = MandosServer()
889
1131
for client in clients:
1133
mandos_server.ClientAdded(client.dbus_object_path,
1134
client.GetAllProperties())
892
1137
tcp_server.enable()