To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 239
- compare with another revision
- download diff
- download tarball
- view history from revision 239
- Committer: Teddy Hogeborn
- Date: 2008-12-15 02:33:36 UTC
- Revision ID: teddy@fukt.bsnet.se-20081215023336-x319cdr0ycvrzp33
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
return a dbus.String containing
an ISO 8601 formatted date+time.
(Client.__init__): Renamed keyword argument "stop_hook" to
"disabled_hook". All callers changed.
(Client.started): Renamed to "enabled"; all users changed.
(Client.last_started): Renamed to "last_enabled"; all users changed.
(Client.stop_hook): Renamed to "disabled_hook"; all users changed.
(Client.stop_initiator_tag): Renamed to "disable_initiator_tag"; all
users changed.
(Client.start): Renamed to "enable". All callers changed.
(Client.stop): Renamed to "disable". All callers changed.
(Client.GetAllProperties): Property "last_started" renamed to
"last_enabled" and "started" renamed to
"enabled".
(Client.Start): Renamed to "Enable".
(Client.Stop): Renamed to "Disable".
return a dbus.String containing
an ISO 8601 formatted date+time.
(Client.__init__): Renamed keyword argument "stop_hook" to
"disabled_hook". All callers changed.
(Client.started): Renamed to "enabled"; all users changed.
(Client.last_started): Renamed to "last_enabled"; all users changed.
(Client.stop_hook): Renamed to "disabled_hook"; all users changed.
(Client.stop_initiator_tag): Renamed to "disable_initiator_tag"; all
users changed.
(Client.start): Renamed to "enable". All callers changed.
(Client.stop): Renamed to "disable". All callers changed.
(Client.GetAllProperties): Property "last_started" renamed to
"last_enabled" and "started" renamed to
"enabled".
(Client.Start): Renamed to "Enable".
(Client.Stop): Renamed to "Disable".
- files added:
- debian/mandos-client.config
- files removed:
- dbus-mandos.conf
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
import optparse
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
58
import contextlib
59
import struct
60
import fcntl
61
import functools
62
import cPickle as pickle
63
import multiprocessing
59
from contextlib import closing
64
60
65
61
import dbus
66
62
import dbus.service
69
65
from dbus.mainloop.glib import DBusGMainLoop
70
66
import ctypes
71
67
import ctypes.util
72
import xml.dom.minidom
73
import inspect
74
75
try:
76
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
77
except AttributeError:
78
try:
79
from IN import SO_BINDTODEVICE
80
except ImportError:
81
SO_BINDTODEVICE = None
82
83
84
version = "1.0.14"
85
86
logger = logging.getLogger(u'mandos')
68
69
version = "1.0.2"
70
71
logger = logging.Logger('mandos')
87
72
syslogger = (logging.handlers.SysLogHandler
88
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
89
74
address = "/dev/log"))
90
75
syslogger.setFormatter(logging.Formatter
91
(u'Mandos [%(process)d]: %(levelname)s:'
92
u' %(message)s'))
76
('Mandos: %(levelname)s: %(message)s'))
93
77
logger.addHandler(syslogger)
94
78
95
79
console = logging.StreamHandler()
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
u' %(levelname)s:'
98
u' %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
99
82
logger.addHandler(console)
100
83
101
multiprocessing_manager = multiprocessing.Manager()
102
103
84
class AvahiError(Exception):
104
def __init__(self, value, *args, **kwargs):
85
def __init__(self, value):
105
86
self.value = value
106
super(AvahiError, self).__init__(value, *args, **kwargs)
107
def __unicode__(self):
108
return unicode(repr(self.value))
87
super(AvahiError, self).__init__()
88
def __str__(self):
89
return repr(self.value)
109
90
110
91
class AvahiServiceError(AvahiError):
111
92
pass
116
97
117
98
class AvahiService(object):
118
99
"""An Avahi (Zeroconf) service.
119
120
100
Attributes:
121
101
interface: integer; avahi.IF_UNSPEC or an interface index.
122
102
Used to optionally bind to the specified interface.
123
name: string; Example: u'Mandos'
124
type: string; Example: u'_mandos._tcp'.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
125
105
See <http://www.dns-sd.org/ServiceTypes.html>
126
106
port: integer; what port to announce
127
107
TXT: list of strings; TXT record for the service
130
110
max_renames: integer; maximum number of renames
131
111
rename_count: integer; counter so we only rename after collisions
132
112
a sensible number of times
133
group: D-Bus Entry Group
134
server: D-Bus Server
135
bus: dbus.SystemBus()
136
113
"""
137
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
115
servicetype = None, port = None, TXT = None,
139
domain = u"", host = u"", max_renames = 32768,
140
protocol = avahi.PROTO_UNSPEC, bus = None):
116
domain = "", host = "", max_renames = 32768):
141
117
self.interface = interface
142
118
self.name = name
143
119
self.type = servicetype
147
123
self.host = host
148
124
self.rename_count = 0
149
125
self.max_renames = max_renames
150
self.protocol = protocol
151
self.group = None # our entry group
152
self.server = None
153
self.bus = bus
154
126
def rename(self):
155
127
"""Derived from the Avahi example code"""
156
128
if self.rename_count >= self.max_renames:
157
129
logger.critical(u"No suitable Zeroconf service name found"
158
130
u" after %i retries, exiting.",
159
131
self.rename_count)
160
raise AvahiServiceError(u"Too many renames")
161
self.name = self.server.GetAlternativeServiceName(self.name)
132
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
162
134
logger.info(u"Changing Zeroconf service name to %r ...",
163
unicode(self.name))
135
str(self.name))
164
136
syslogger.setFormatter(logging.Formatter
165
(u'Mandos (%s) [%%(process)d]:'
166
u' %%(levelname)s: %%(message)s'
167
% self.name))
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
168
139
self.remove()
169
140
self.add()
170
141
self.rename_count += 1
171
142
def remove(self):
172
143
"""Derived from the Avahi example code"""
173
if self.group is not None:
174
self.group.Reset()
144
if group is not None:
145
group.Reset()
175
146
def add(self):
176
147
"""Derived from the Avahi example code"""
177
if self.group is None:
178
self.group = dbus.Interface(
179
self.bus.get_object(avahi.DBUS_NAME,
180
self.server.EntryGroupNew()),
181
avahi.DBUS_INTERFACE_ENTRY_GROUP)
182
self.group.connect_to_signal('StateChanged',
183
self
184
.entry_group_state_changed)
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
185
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
186
self.name, self.type)
187
self.group.AddService(
188
self.interface,
189
self.protocol,
190
dbus.UInt32(0), # flags
191
self.name, self.type,
192
self.domain, self.host,
193
dbus.UInt16(self.port),
194
avahi.string_array_to_txt_array(self.TXT))
195
self.group.Commit()
196
def entry_group_state_changed(self, state, error):
197
"""Derived from the Avahi example code"""
198
logger.debug(u"Avahi state change: %i", state)
199
200
if state == avahi.ENTRY_GROUP_ESTABLISHED:
201
logger.debug(u"Zeroconf service established.")
202
elif state == avahi.ENTRY_GROUP_COLLISION:
203
logger.warning(u"Zeroconf service name collision.")
204
self.rename()
205
elif state == avahi.ENTRY_GROUP_FAILURE:
206
logger.critical(u"Avahi: Error in group state changed %s",
207
unicode(error))
208
raise AvahiGroupError(u"State changed: %s"
209
% unicode(error))
210
def cleanup(self):
211
"""Derived from the Avahi example code"""
212
if self.group is not None:
213
self.group.Free()
214
self.group = None
215
def server_state_changed(self, state):
216
"""Derived from the Avahi example code"""
217
if state == avahi.SERVER_COLLISION:
218
logger.error(u"Zeroconf server name collision")
219
self.remove()
220
elif state == avahi.SERVER_RUNNING:
221
self.add()
222
def activate(self):
223
"""Derived from the Avahi example code"""
224
if self.server is None:
225
self.server = dbus.Interface(
226
self.bus.get_object(avahi.DBUS_NAME,
227
avahi.DBUS_PATH_SERVER),
228
avahi.DBUS_INTERFACE_SERVER)
229
self.server.connect_to_signal(u"StateChanged",
230
self.server_state_changed)
231
self.server_state_changed(self.server.GetState())
232
233
234
class Client(object):
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
235
179
"""A representation of a client host served by this server.
236
237
180
Attributes:
238
name: string; from the config file, used in log messages and
239
D-Bus identifiers
181
name: string; from the config file, used in log messages
240
182
fingerprint: string (40 or 32 hexadecimal digits); used to
241
183
uniquely identify the client
242
184
secret: bytestring; sent verbatim (over TLS) to client
246
188
enabled: bool()
247
189
last_checked_ok: datetime.datetime(); (UTC) or None
248
190
timeout: datetime.timedelta(); How long from last_checked_ok
249
until this client is disabled
191
until this client is invalid
250
192
interval: datetime.timedelta(); How often to start a new checker
251
193
disable_hook: If set, called by disable() as disable_hook(self)
252
194
checker: subprocess.Popen(); a running checker process used
253
195
to see if the client lives.
254
196
'None' if no process is running.
255
197
checker_initiator_tag: a gobject event source tag, or None
256
disable_initiator_tag: - '' -
198
disable_initiator_tag: - '' -
257
199
checker_callback_tag: - '' -
258
200
checker_command: string; External command which is run to check if
259
201
client lives. %() expansions are done at
260
202
runtime with vars(self) as dict, so that for
261
203
instance %(name)s can be used in the command.
262
current_checker_command: string; current running checker_command
263
approved_delay: datetime.timedelta(); Time to wait for approval
264
_approved: bool(); 'None' if not yet approved/disapproved
265
approved_duration: datetime.timedelta(); Duration of one approval
204
dbus_object_path: dbus.ObjectPath
205
Private attibutes:
206
_timeout: Real variable for 'timeout'
207
_interval: Real variable for 'interval'
208
_timeout_milliseconds: Used when calling gobject.timeout_add()
209
_interval_milliseconds: - '' -
266
210
"""
267
268
@staticmethod
269
def _timedelta_to_milliseconds(td):
270
"Convert a datetime.timedelta() to milliseconds"
271
return ((td.days * 24 * 60 * 60 * 1000)
272
+ (td.seconds * 1000)
273
+ (td.microseconds // 1000))
274
275
def timeout_milliseconds(self):
276
"Return the 'timeout' attribute in milliseconds"
277
return self._timedelta_to_milliseconds(self.timeout)
278
279
def interval_milliseconds(self):
280
"Return the 'interval' attribute in milliseconds"
281
return self._timedelta_to_milliseconds(self.interval)
282
283
def approved_delay_milliseconds(self):
284
return self._timedelta_to_milliseconds(self.approved_delay)
211
def _set_timeout(self, timeout):
212
"Setter function for the 'timeout' attribute"
213
self._timeout = timeout
214
self._timeout_milliseconds = ((self.timeout.days
215
* 24 * 60 * 60 * 1000)
216
+ (self.timeout.seconds * 1000)
217
+ (self.timeout.microseconds
218
// 1000))
219
# Emit D-Bus signal
220
self.PropertyChanged(dbus.String(u"timeout"),
221
(dbus.UInt64(self._timeout_milliseconds,
222
variant_level=1)))
223
timeout = property(lambda self: self._timeout, _set_timeout)
224
del _set_timeout
225
226
def _set_interval(self, interval):
227
"Setter function for the 'interval' attribute"
228
self._interval = interval
229
self._interval_milliseconds = ((self.interval.days
230
* 24 * 60 * 60 * 1000)
231
+ (self.interval.seconds
232
* 1000)
233
+ (self.interval.microseconds
234
// 1000))
235
# Emit D-Bus signal
236
self.PropertyChanged(dbus.String(u"interval"),
237
(dbus.UInt64(self._interval_milliseconds,
238
variant_level=1)))
239
interval = property(lambda self: self._interval, _set_interval)
240
del _set_interval
285
241
286
242
def __init__(self, name = None, disable_hook=None, config=None):
287
243
"""Note: the 'checker' key in 'config' sets the
288
244
'checker_command' attribute and *not* the 'checker'
289
245
attribute."""
290
self.name = name
246
self.dbus_object_path = (dbus.ObjectPath
247
("/Mandos/clients/"
248
+ name.replace(".", "_")))
249
dbus.service.Object.__init__(self, bus,
250
self.dbus_object_path)
291
251
if config is None:
292
252
config = {}
253
self.name = name
293
254
logger.debug(u"Creating client %r", self.name)
294
255
# Uppercase and remove spaces from fingerprint for later
295
256
# comparison purposes with return value from the fingerprint()
296
257
# function
297
self.fingerprint = (config[u"fingerprint"].upper()
258
self.fingerprint = (config["fingerprint"].upper()
298
259
.replace(u" ", u""))
299
260
logger.debug(u" Fingerprint: %s", self.fingerprint)
300
if u"secret" in config:
301
self.secret = config[u"secret"].decode(u"base64")
302
elif u"secfile" in config:
303
with open(os.path.expanduser(os.path.expandvars
304
(config[u"secfile"])),
305
"rb") as secfile:
261
if "secret" in config:
262
self.secret = config["secret"].decode(u"base64")
263
elif "secfile" in config:
264
with closing(open(os.path.expanduser
265
(os.path.expandvars
266
(config["secfile"])))) as secfile:
306
267
self.secret = secfile.read()
307
268
else:
308
#XXX Need to allow secret on demand!
309
269
raise TypeError(u"No secret or secfile for client %s"
310
270
% self.name)
311
self.host = config.get(u"host", u"")
271
self.host = config.get("host", "")
312
272
self.created = datetime.datetime.utcnow()
313
273
self.enabled = False
314
274
self.last_enabled = None
315
275
self.last_checked_ok = None
316
self.timeout = string_to_delta(config[u"timeout"])
317
self.interval = string_to_delta(config[u"interval"])
276
self.timeout = string_to_delta(config["timeout"])
277
self.interval = string_to_delta(config["interval"])
318
278
self.disable_hook = disable_hook
319
279
self.checker = None
320
280
self.checker_initiator_tag = None
321
281
self.disable_initiator_tag = None
322
282
self.checker_callback_tag = None
323
self.checker_command = config[u"checker"]
324
self.current_checker_command = None
325
self.last_connect = None
326
self.approvals_pending = 0
327
self._approved = None
328
self.approved_by_default = config.get(u"approved_by_default",
329
True)
330
self.approved_delay = string_to_delta(
331
config[u"approved_delay"])
332
self.approved_duration = string_to_delta(
333
config[u"approved_duration"])
334
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
283
self.checker_command = config["checker"]
335
284
336
def send_changedstate(self):
337
self.changedstate.acquire()
338
self.changedstate.notify_all()
339
self.changedstate.release()
340
341
285
def enable(self):
342
286
"""Start this client's checker and timeout hooks"""
343
if getattr(self, u"enabled", False):
344
# Already enabled
345
return
346
self.send_changedstate()
347
287
self.last_enabled = datetime.datetime.utcnow()
348
288
# Schedule a new checker to be started an 'interval' from now,
349
289
# and every interval from then on.
350
290
self.checker_initiator_tag = (gobject.timeout_add
351
(self.interval_milliseconds(),
291
(self._interval_milliseconds,
352
292
self.start_checker))
293
# Also start a new checker *right now*.
294
self.start_checker()
353
295
# Schedule a disable() when 'timeout' has passed
354
296
self.disable_initiator_tag = (gobject.timeout_add
355
(self.timeout_milliseconds(),
297
(self._timeout_milliseconds,
356
298
self.disable))
357
299
self.enabled = True
358
# Also start a new checker *right now*.
359
self.start_checker()
300
# Emit D-Bus signal
301
self.PropertyChanged(dbus.String(u"enabled"),
302
dbus.Boolean(True, variant_level=1))
303
self.PropertyChanged(dbus.String(u"last_enabled"),
304
(_datetime_to_dbus(self.last_enabled,
305
variant_level=1)))
360
306
361
def disable(self, quiet=True):
307
def disable(self):
362
308
"""Disable this client."""
363
309
if not getattr(self, "enabled", False):
364
310
return False
365
if not quiet:
366
self.send_changedstate()
367
if not quiet:
368
logger.info(u"Disabling client %s", self.name)
369
if getattr(self, u"disable_initiator_tag", False):
311
logger.info(u"Disabling client %s", self.name)
312
if getattr(self, "disable_initiator_tag", False):
370
313
gobject.source_remove(self.disable_initiator_tag)
371
314
self.disable_initiator_tag = None
372
if getattr(self, u"checker_initiator_tag", False):
315
if getattr(self, "checker_initiator_tag", False):
373
316
gobject.source_remove(self.checker_initiator_tag)
374
317
self.checker_initiator_tag = None
375
318
self.stop_checker()
376
319
if self.disable_hook:
377
320
self.disable_hook(self)
378
321
self.enabled = False
322
# Emit D-Bus signal
323
self.PropertyChanged(dbus.String(u"enabled"),
324
dbus.Boolean(False, variant_level=1))
379
325
# Do not run this again if called by a gobject.timeout_add
380
326
return False
381
327
387
333
"""The checker has completed, so take appropriate actions."""
388
334
self.checker_callback_tag = None
389
335
self.checker = None
390
if os.WIFEXITED(condition):
391
exitstatus = os.WEXITSTATUS(condition)
392
if exitstatus == 0:
393
logger.info(u"Checker for %(name)s succeeded",
394
vars(self))
395
self.checked_ok()
396
else:
397
logger.info(u"Checker for %(name)s failed",
398
vars(self))
399
else:
336
# Emit D-Bus signal
337
self.PropertyChanged(dbus.String(u"checker_running"),
338
dbus.Boolean(False, variant_level=1))
339
if (os.WIFEXITED(condition)
340
and (os.WEXITSTATUS(condition) == 0)):
341
logger.info(u"Checker for %(name)s succeeded",
342
vars(self))
343
# Emit D-Bus signal
344
self.CheckerCompleted(dbus.Boolean(True),
345
dbus.UInt16(condition),
346
dbus.String(command))
347
self.bump_timeout()
348
elif not os.WIFEXITED(condition):
400
349
logger.warning(u"Checker for %(name)s crashed?",
401
350
vars(self))
351
# Emit D-Bus signal
352
self.CheckerCompleted(dbus.Boolean(False),
353
dbus.UInt16(condition),
354
dbus.String(command))
355
else:
356
logger.info(u"Checker for %(name)s failed",
357
vars(self))
358
# Emit D-Bus signal
359
self.CheckerCompleted(dbus.Boolean(False),
360
dbus.UInt16(condition),
361
dbus.String(command))
402
362
403
def checked_ok(self):
363
def bump_timeout(self):
404
364
"""Bump up the timeout for this client.
405
406
365
This should only be called when the client has been seen,
407
366
alive and well.
408
367
"""
409
368
self.last_checked_ok = datetime.datetime.utcnow()
410
369
gobject.source_remove(self.disable_initiator_tag)
411
370
self.disable_initiator_tag = (gobject.timeout_add
412
(self.timeout_milliseconds(),
371
(self._timeout_milliseconds,
413
372
self.disable))
373
self.PropertyChanged(dbus.String(u"last_checked_ok"),
374
(_datetime_to_dbus(self.last_checked_ok,
375
variant_level=1)))
414
376
415
377
def start_checker(self):
416
378
"""Start a new checker subprocess if one is not running.
417
418
379
If a checker already exists, leave it running and do
419
380
nothing."""
420
381
# The reason for not killing a running checker is that if we
423
384
# client would inevitably timeout, since no checker would get
424
385
# a chance to run to completion. If we instead leave running
425
386
# checkers alone, the checker would have to take more time
426
# than 'timeout' for the client to be disabled, which is as it
427
# should be.
428
429
# If a checker exists, make sure it is not a zombie
430
try:
431
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
432
except (AttributeError, OSError), error:
433
if (isinstance(error, OSError)
434
and error.errno != errno.ECHILD):
435
raise error
436
else:
437
if pid:
438
logger.warning(u"Checker was a zombie")
439
gobject.source_remove(self.checker_callback_tag)
440
self.checker_callback(pid, status,
441
self.current_checker_command)
442
# Start a new checker if needed
387
# than 'timeout' for the client to be declared invalid, which
388
# is as it should be.
443
389
if self.checker is None:
444
390
try:
445
391
# In case checker_command has exactly one % operator
446
392
command = self.checker_command % self.host
447
393
except TypeError:
448
394
# Escape attributes for the shell
449
escaped_attrs = dict((key,
450
re.escape(unicode(str(val),
451
errors=
452
u'replace')))
395
escaped_attrs = dict((key, re.escape(str(val)))
453
396
for key, val in
454
397
vars(self).iteritems())
455
398
try:
458
401
logger.error(u'Could not format string "%s":'
459
402
u' %s', self.checker_command, error)
460
403
return True # Try again later
461
self.current_checker_command = command
462
404
try:
463
405
logger.info(u"Starting checker %r for %s",
464
406
command, self.name)
468
410
# always replaced by /dev/null.)
469
411
self.checker = subprocess.Popen(command,
470
412
close_fds=True,
471
shell=True, cwd=u"/")
413
shell=True, cwd="/")
414
# Emit D-Bus signal
415
self.CheckerStarted(command)
416
self.PropertyChanged(dbus.String("checker_running"),
417
dbus.Boolean(True, variant_level=1))
472
418
self.checker_callback_tag = (gobject.child_watch_add
473
419
(self.checker.pid,
474
420
self.checker_callback,
475
421
data=command))
476
# The checker may have completed before the gobject
477
# watch was added. Check for this.
478
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
479
if pid:
480
gobject.source_remove(self.checker_callback_tag)
481
self.checker_callback(pid, status, command)
482
422
except OSError, error:
483
423
logger.error(u"Failed to start subprocess: %s",
484
424
error)
490
430
if self.checker_callback_tag:
491
431
gobject.source_remove(self.checker_callback_tag)
492
432
self.checker_callback_tag = None
493
if getattr(self, u"checker", None) is None:
433
if getattr(self, "checker", None) is None:
494
434
return
495
435
logger.debug(u"Stopping checker for %(name)s", vars(self))
496
436
try:
497
437
os.kill(self.checker.pid, signal.SIGTERM)
498
#time.sleep(0.5)
438
#os.sleep(0.5)
499
439
#if self.checker.poll() is None:
500
440
# os.kill(self.checker.pid, signal.SIGKILL)
501
441
except OSError, error:
502
442
if error.errno != errno.ESRCH: # No such process
503
443
raise
504
444
self.checker = None
505
506
def dbus_service_property(dbus_interface, signature=u"v",
507
access=u"readwrite", byte_arrays=False):
508
"""Decorators for marking methods of a DBusObjectWithProperties to
509
become properties on the D-Bus.
510
511
The decorated method will be called with no arguments by "Get"
512
and with one argument by "Set".
513
514
The parameters, where they are supported, are the same as
515
dbus.service.method, except there is only "signature", since the
516
type from Get() and the type sent to Set() is the same.
517
"""
518
# Encoding deeply encoded byte arrays is not supported yet by the
519
# "Set" method, so we fail early here:
520
if byte_arrays and signature != u"ay":
521
raise ValueError(u"Byte arrays not supported for non-'ay'"
522
u" signature %r" % signature)
523
def decorator(func):
524
func._dbus_is_property = True
525
func._dbus_interface = dbus_interface
526
func._dbus_signature = signature
527
func._dbus_access = access
528
func._dbus_name = func.__name__
529
if func._dbus_name.endswith(u"_dbus_property"):
530
func._dbus_name = func._dbus_name[:-14]
531
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
532
return func
533
return decorator
534
535
536
class DBusPropertyException(dbus.exceptions.DBusException):
537
"""A base class for D-Bus property-related exceptions
538
"""
539
def __unicode__(self):
540
return unicode(str(self))
541
542
543
class DBusPropertyAccessException(DBusPropertyException):
544
"""A property's access permissions disallows an operation.
545
"""
546
pass
547
548
549
class DBusPropertyNotFound(DBusPropertyException):
550
"""An attempt was made to access a non-existing property.
551
"""
552
pass
553
554
555
class DBusObjectWithProperties(dbus.service.Object):
556
"""A D-Bus object with properties.
557
558
Classes inheriting from this can use the dbus_service_property
559
decorator to expose methods as D-Bus properties. It exposes the
560
standard Get(), Set(), and GetAll() methods on the D-Bus.
561
"""
562
563
@staticmethod
564
def _is_dbus_property(obj):
565
return getattr(obj, u"_dbus_is_property", False)
566
567
def _get_all_dbus_properties(self):
568
"""Returns a generator of (name, attribute) pairs
569
"""
570
return ((prop._dbus_name, prop)
571
for name, prop in
572
inspect.getmembers(self, self._is_dbus_property))
573
574
def _get_dbus_property(self, interface_name, property_name):
575
"""Returns a bound method if one exists which is a D-Bus
576
property with the specified name and interface.
577
"""
578
for name in (property_name,
579
property_name + u"_dbus_property"):
580
prop = getattr(self, name, None)
581
if (prop is None
582
or not self._is_dbus_property(prop)
583
or prop._dbus_name != property_name
584
or (interface_name and prop._dbus_interface
585
and interface_name != prop._dbus_interface)):
586
continue
587
return prop
588
# No such property
589
raise DBusPropertyNotFound(self.dbus_object_path + u":"
590
+ interface_name + u"."
591
+ property_name)
592
593
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
594
out_signature=u"v")
595
def Get(self, interface_name, property_name):
596
"""Standard D-Bus property Get() method, see D-Bus standard.
597
"""
598
prop = self._get_dbus_property(interface_name, property_name)
599
if prop._dbus_access == u"write":
600
raise DBusPropertyAccessException(property_name)
601
value = prop()
602
if not hasattr(value, u"variant_level"):
603
return value
604
return type(value)(value, variant_level=value.variant_level+1)
605
606
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
607
def Set(self, interface_name, property_name, value):
608
"""Standard D-Bus property Set() method, see D-Bus standard.
609
"""
610
prop = self._get_dbus_property(interface_name, property_name)
611
if prop._dbus_access == u"read":
612
raise DBusPropertyAccessException(property_name)
613
if prop._dbus_get_args_options[u"byte_arrays"]:
614
# The byte_arrays option is not supported yet on
615
# signatures other than "ay".
616
if prop._dbus_signature != u"ay":
617
raise ValueError
618
value = dbus.ByteArray(''.join(unichr(byte)
619
for byte in value))
620
prop(value)
621
622
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
623
out_signature=u"a{sv}")
624
def GetAll(self, interface_name):
625
"""Standard D-Bus property GetAll() method, see D-Bus
626
standard.
627
628
Note: Will not include properties with access="write".
629
"""
630
all = {}
631
for name, prop in self._get_all_dbus_properties():
632
if (interface_name
633
and interface_name != prop._dbus_interface):
634
# Interface non-empty but did not match
635
continue
636
# Ignore write-only properties
637
if prop._dbus_access == u"write":
638
continue
639
value = prop()
640
if not hasattr(value, u"variant_level"):
641
all[name] = value
642
continue
643
all[name] = type(value)(value, variant_level=
644
value.variant_level+1)
645
return dbus.Dictionary(all, signature=u"sv")
646
647
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
648
out_signature=u"s",
649
path_keyword='object_path',
650
connection_keyword='connection')
651
def Introspect(self, object_path, connection):
652
"""Standard D-Bus method, overloaded to insert property tags.
653
"""
654
xmlstring = dbus.service.Object.Introspect(self, object_path,
655
connection)
656
try:
657
document = xml.dom.minidom.parseString(xmlstring)
658
def make_tag(document, name, prop):
659
e = document.createElement(u"property")
660
e.setAttribute(u"name", name)
661
e.setAttribute(u"type", prop._dbus_signature)
662
e.setAttribute(u"access", prop._dbus_access)
663
return e
664
for if_tag in document.getElementsByTagName(u"interface"):
665
for tag in (make_tag(document, name, prop)
666
for name, prop
667
in self._get_all_dbus_properties()
668
if prop._dbus_interface
669
== if_tag.getAttribute(u"name")):
670
if_tag.appendChild(tag)
671
# Add the names to the return values for the
672
# "org.freedesktop.DBus.Properties" methods
673
if (if_tag.getAttribute(u"name")
674
== u"org.freedesktop.DBus.Properties"):
675
for cn in if_tag.getElementsByTagName(u"method"):
676
if cn.getAttribute(u"name") == u"Get":
677
for arg in cn.getElementsByTagName(u"arg"):
678
if (arg.getAttribute(u"direction")
679
== u"out"):
680
arg.setAttribute(u"name", u"value")
681
elif cn.getAttribute(u"name") == u"GetAll":
682
for arg in cn.getElementsByTagName(u"arg"):
683
if (arg.getAttribute(u"direction")
684
== u"out"):
685
arg.setAttribute(u"name", u"props")
686
xmlstring = document.toxml(u"utf-8")
687
document.unlink()
688
except (AttributeError, xml.dom.DOMException,
689
xml.parsers.expat.ExpatError), error:
690
logger.error(u"Failed to override Introspection method",
691
error)
692
return xmlstring
693
694
695
class ClientDBus(Client, DBusObjectWithProperties):
696
"""A Client class using D-Bus
697
698
Attributes:
699
dbus_object_path: dbus.ObjectPath
700
bus: dbus.SystemBus()
701
"""
702
# dbus.service.Object doesn't use super(), so we can't either.
703
704
def __init__(self, bus = None, *args, **kwargs):
705
self._approvals_pending = 0
706
self.bus = bus
707
Client.__init__(self, *args, **kwargs)
708
# Only now, when this client is initialized, can it show up on
709
# the D-Bus
710
self.dbus_object_path = (dbus.ObjectPath
711
(u"/clients/"
712
+ self.name.replace(u".", u"_")))
713
DBusObjectWithProperties.__init__(self, self.bus,
714
self.dbus_object_path)
715
716
def _get_approvals_pending(value):
717
return self._approvals_pending
718
def _set_approvals_pending(value):
719
old_value = self._approvals_pending
720
self._approvals_pending = value
721
bval = bool(value)
722
if bval is bool(old_value):
723
dbus_bool = dbus.Boolean(bval, variant_level=1)
724
self.PropertyChanged(dbus.String(u"approved_pending"),
725
dbus_bool)
726
return value
727
approvals_pending = property(_get_approvals_pending,
728
_set_approvals_pending)
729
del _get_approvals_pending, _set_approvals_pending
730
731
@staticmethod
732
def _datetime_to_dbus(dt, variant_level=0):
733
"""Convert a UTC datetime.datetime() to a D-Bus type."""
734
return dbus.String(dt.isoformat(),
735
variant_level=variant_level)
736
737
def enable(self):
738
oldstate = getattr(self, u"enabled", False)
739
r = Client.enable(self)
740
if oldstate != self.enabled:
741
# Emit D-Bus signals
742
self.PropertyChanged(dbus.String(u"enabled"),
743
dbus.Boolean(True, variant_level=1))
744
self.PropertyChanged(
745
dbus.String(u"last_enabled"),
746
self._datetime_to_dbus(self.last_enabled,
747
variant_level=1))
748
return r
749
750
def disable(self, quiet = False):
751
oldstate = getattr(self, u"enabled", False)
752
r = Client.disable(self, quiet=quiet)
753
if not quiet and oldstate != self.enabled:
754
# Emit D-Bus signal
755
self.PropertyChanged(dbus.String(u"enabled"),
756
dbus.Boolean(False, variant_level=1))
757
return r
758
759
def __del__(self, *args, **kwargs):
760
try:
761
self.remove_from_connection()
762
except LookupError:
763
pass
764
if hasattr(DBusObjectWithProperties, u"__del__"):
765
DBusObjectWithProperties.__del__(self, *args, **kwargs)
766
Client.__del__(self, *args, **kwargs)
767
768
def checker_callback(self, pid, condition, command,
769
*args, **kwargs):
770
self.checker_callback_tag = None
771
self.checker = None
772
# Emit D-Bus signal
773
445
self.PropertyChanged(dbus.String(u"checker_running"),
774
446
dbus.Boolean(False, variant_level=1))
775
if os.WIFEXITED(condition):
776
exitstatus = os.WEXITSTATUS(condition)
777
# Emit D-Bus signal
778
self.CheckerCompleted(dbus.Int16(exitstatus),
779
dbus.Int64(condition),
780
dbus.String(command))
781
else:
782
# Emit D-Bus signal
783
self.CheckerCompleted(dbus.Int16(-1),
784
dbus.Int64(condition),
785
dbus.String(command))
786
787
return Client.checker_callback(self, pid, condition, command,
788
*args, **kwargs)
789
790
def checked_ok(self, *args, **kwargs):
791
r = Client.checked_ok(self, *args, **kwargs)
792
# Emit D-Bus signal
793
self.PropertyChanged(
794
dbus.String(u"last_checked_ok"),
795
(self._datetime_to_dbus(self.last_checked_ok,
796
variant_level=1)))
797
return r
798
799
def start_checker(self, *args, **kwargs):
800
old_checker = self.checker
801
if self.checker is not None:
802
old_checker_pid = self.checker.pid
803
else:
804
old_checker_pid = None
805
r = Client.start_checker(self, *args, **kwargs)
806
# Only if new checker process was started
807
if (self.checker is not None
808
and old_checker_pid != self.checker.pid):
809
# Emit D-Bus signal
810
self.CheckerStarted(self.current_checker_command)
811
self.PropertyChanged(
812
dbus.String(u"checker_running"),
813
dbus.Boolean(True, variant_level=1))
814
return r
815
816
def stop_checker(self, *args, **kwargs):
817
old_checker = getattr(self, u"checker", None)
818
r = Client.stop_checker(self, *args, **kwargs)
819
if (old_checker is not None
820
and getattr(self, u"checker", None) is None):
821
self.PropertyChanged(dbus.String(u"checker_running"),
822
dbus.Boolean(False, variant_level=1))
823
return r
824
825
def _reset_approved(self):
826
self._approved = None
827
return False
828
829
def approve(self, value=True):
830
self._approved = value
831
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))
832
833
834
## D-Bus methods, signals & properties
835
_interface = u"se.bsnet.fukt.Mandos.Client"
836
837
## Signals
447
448
def still_valid(self):
449
"""Has the timeout not yet passed for this client?"""
450
if not getattr(self, "enabled", False):
451
return False
452
now = datetime.datetime.utcnow()
453
if self.last_checked_ok is None:
454
return now < (self.created + self.timeout)
455
else:
456
return now < (self.last_checked_ok + self.timeout)
457
458
## D-Bus methods & signals
459
_interface = u"org.mandos_system.Mandos.Client"
460
461
# BumpTimeout - method
462
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
463
BumpTimeout.__name__ = "BumpTimeout"
838
464
839
465
# CheckerCompleted - signal
840
@dbus.service.signal(_interface, signature=u"nxs")
841
def CheckerCompleted(self, exitcode, waitstatus, command):
466
@dbus.service.signal(_interface, signature="bqs")
467
def CheckerCompleted(self, success, condition, command):
842
468
"D-Bus signal"
843
469
pass
844
470
845
471
# CheckerStarted - signal
846
@dbus.service.signal(_interface, signature=u"s")
472
@dbus.service.signal(_interface, signature="s")
847
473
def CheckerStarted(self, command):
848
474
"D-Bus signal"
849
475
pass
850
476
477
# GetAllProperties - method
478
@dbus.service.method(_interface, out_signature="a{sv}")
479
def GetAllProperties(self):
480
"D-Bus method"
481
return dbus.Dictionary({
482
dbus.String("name"):
483
dbus.String(self.name, variant_level=1),
484
dbus.String("fingerprint"):
485
dbus.String(self.fingerprint, variant_level=1),
486
dbus.String("host"):
487
dbus.String(self.host, variant_level=1),
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
492
variant_level=1)
493
if self.last_enabled is not None
494
else dbus.Boolean(False, variant_level=1)),
495
dbus.String("enabled"):
496
dbus.Boolean(self.enabled, variant_level=1),
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
499
variant_level=1)
500
if self.last_checked_ok is not None
501
else dbus.Boolean (False, variant_level=1)),
502
dbus.String("timeout"):
503
dbus.UInt64(self._timeout_milliseconds,
504
variant_level=1),
505
dbus.String("interval"):
506
dbus.UInt64(self._interval_milliseconds,
507
variant_level=1),
508
dbus.String("checker"):
509
dbus.String(self.checker_command,
510
variant_level=1),
511
dbus.String("checker_running"):
512
dbus.Boolean(self.checker is not None,
513
variant_level=1),
514
}, signature="sv")
515
516
# IsStillValid - method
517
IsStillValid = (dbus.service.method(_interface, out_signature="b")
518
(still_valid))
519
IsStillValid.__name__ = "IsStillValid"
520
851
521
# PropertyChanged - signal
852
@dbus.service.signal(_interface, signature=u"sv")
522
@dbus.service.signal(_interface, signature="sv")
853
523
def PropertyChanged(self, property, value):
854
524
"D-Bus signal"
855
525
pass
856
526
857
# GotSecret - signal
858
@dbus.service.signal(_interface)
859
def GotSecret(self):
860
"D-Bus signal"
861
pass
862
863
# Rejected - signal
864
@dbus.service.signal(_interface, signature=u"s")
865
def Rejected(self, reason):
866
"D-Bus signal"
867
pass
868
869
# NeedApproval - signal
870
@dbus.service.signal(_interface, signature=u"db")
871
def NeedApproval(self, timeout, default):
872
"D-Bus signal"
873
pass
874
875
## Methods
876
877
# Approve - method
878
@dbus.service.method(_interface, in_signature=u"b")
879
def Approve(self, value):
880
self.approve(value)
881
882
# CheckedOK - method
883
@dbus.service.method(_interface)
884
def CheckedOK(self):
885
return self.checked_ok()
527
# SetChecker - method
528
@dbus.service.method(_interface, in_signature="s")
529
def SetChecker(self, checker):
530
"D-Bus setter method"
531
self.checker_command = checker
532
533
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
537
self.host = host
538
539
# SetInterval - method
540
@dbus.service.method(_interface, in_signature="t")
541
def SetInterval(self, milliseconds):
542
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
543
544
# SetSecret - method
545
@dbus.service.method(_interface, in_signature="ay",
546
byte_arrays=True)
547
def SetSecret(self, secret):
548
"D-Bus setter method"
549
self.secret = str(secret)
550
551
# SetTimeout - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetTimeout(self, milliseconds):
554
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
886
555
887
556
# Enable - method
888
@dbus.service.method(_interface)
889
def Enable(self):
890
"D-Bus method"
891
self.enable()
557
Enable = dbus.service.method(_interface)(enable)
558
Enable.__name__ = "Enable"
892
559
893
560
# StartChecker - method
894
561
@dbus.service.method(_interface)
903
570
self.disable()
904
571
905
572
# StopChecker - method
906
@dbus.service.method(_interface)
907
def StopChecker(self):
908
self.stop_checker()
909
910
## Properties
911
912
# approved_pending - property
913
@dbus_service_property(_interface, signature=u"b", access=u"read")
914
def approved_pending_dbus_property(self):
915
return dbus.Boolean(bool(self.approvals_pending))
916
917
# approved_by_default - property
918
@dbus_service_property(_interface, signature=u"b",
919
access=u"readwrite")
920
def approved_by_default_dbus_property(self):
921
return dbus.Boolean(self.approved_by_default)
922
923
# approved_delay - property
924
@dbus_service_property(_interface, signature=u"t",
925
access=u"readwrite")
926
def approved_delay_dbus_property(self):
927
return dbus.UInt64(self.approved_delay_milliseconds())
928
929
# approved_duration - property
930
@dbus_service_property(_interface, signature=u"t",
931
access=u"readwrite")
932
def approved_duration_dbus_property(self):
933
return dbus.UInt64(self._timedelta_to_milliseconds(
934
self.approved_duration))
935
936
# name - property
937
@dbus_service_property(_interface, signature=u"s", access=u"read")
938
def name_dbus_property(self):
939
return dbus.String(self.name)
940
941
# fingerprint - property
942
@dbus_service_property(_interface, signature=u"s", access=u"read")
943
def fingerprint_dbus_property(self):
944
return dbus.String(self.fingerprint)
945
946
# host - property
947
@dbus_service_property(_interface, signature=u"s",
948
access=u"readwrite")
949
def host_dbus_property(self, value=None):
950
if value is None: # get
951
return dbus.String(self.host)
952
self.host = value
953
# Emit D-Bus signal
954
self.PropertyChanged(dbus.String(u"host"),
955
dbus.String(value, variant_level=1))
956
957
# created - property
958
@dbus_service_property(_interface, signature=u"s", access=u"read")
959
def created_dbus_property(self):
960
return dbus.String(self._datetime_to_dbus(self.created))
961
962
# last_enabled - property
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
964
def last_enabled_dbus_property(self):
965
if self.last_enabled is None:
966
return dbus.String(u"")
967
return dbus.String(self._datetime_to_dbus(self.last_enabled))
968
969
# enabled - property
970
@dbus_service_property(_interface, signature=u"b",
971
access=u"readwrite")
972
def enabled_dbus_property(self, value=None):
973
if value is None: # get
974
return dbus.Boolean(self.enabled)
975
if value:
976
self.enable()
977
else:
978
self.disable()
979
980
# last_checked_ok - property
981
@dbus_service_property(_interface, signature=u"s",
982
access=u"readwrite")
983
def last_checked_ok_dbus_property(self, value=None):
984
if value is not None:
985
self.checked_ok()
986
return
987
if self.last_checked_ok is None:
988
return dbus.String(u"")
989
return dbus.String(self._datetime_to_dbus(self
990
.last_checked_ok))
991
992
# timeout - property
993
@dbus_service_property(_interface, signature=u"t",
994
access=u"readwrite")
995
def timeout_dbus_property(self, value=None):
996
if value is None: # get
997
return dbus.UInt64(self.timeout_milliseconds())
998
self.timeout = datetime.timedelta(0, 0, 0, value)
999
# Emit D-Bus signal
1000
self.PropertyChanged(dbus.String(u"timeout"),
1001
dbus.UInt64(value, variant_level=1))
1002
if getattr(self, u"disable_initiator_tag", None) is None:
1003
return
1004
# Reschedule timeout
1005
gobject.source_remove(self.disable_initiator_tag)
1006
self.disable_initiator_tag = None
1007
time_to_die = (self.
1008
_timedelta_to_milliseconds((self
1009
.last_checked_ok
1010
+ self.timeout)
1011
- datetime.datetime
1012
.utcnow()))
1013
if time_to_die <= 0:
1014
# The timeout has passed
1015
self.disable()
1016
else:
1017
self.disable_initiator_tag = (gobject.timeout_add
1018
(time_to_die, self.disable))
1019
1020
# interval - property
1021
@dbus_service_property(_interface, signature=u"t",
1022
access=u"readwrite")
1023
def interval_dbus_property(self, value=None):
1024
if value is None: # get
1025
return dbus.UInt64(self.interval_milliseconds())
1026
self.interval = datetime.timedelta(0, 0, 0, value)
1027
# Emit D-Bus signal
1028
self.PropertyChanged(dbus.String(u"interval"),
1029
dbus.UInt64(value, variant_level=1))
1030
if getattr(self, u"checker_initiator_tag", None) is None:
1031
return
1032
# Reschedule checker run
1033
gobject.source_remove(self.checker_initiator_tag)
1034
self.checker_initiator_tag = (gobject.timeout_add
1035
(value, self.start_checker))
1036
self.start_checker() # Start one now, too
1037
1038
# checker - property
1039
@dbus_service_property(_interface, signature=u"s",
1040
access=u"readwrite")
1041
def checker_dbus_property(self, value=None):
1042
if value is None: # get
1043
return dbus.String(self.checker_command)
1044
self.checker_command = value
1045
# Emit D-Bus signal
1046
self.PropertyChanged(dbus.String(u"checker"),
1047
dbus.String(self.checker_command,
1048
variant_level=1))
1049
1050
# checker_running - property
1051
@dbus_service_property(_interface, signature=u"b",
1052
access=u"readwrite")
1053
def checker_running_dbus_property(self, value=None):
1054
if value is None: # get
1055
return dbus.Boolean(self.checker is not None)
1056
if value:
1057
self.start_checker()
1058
else:
1059
self.stop_checker()
1060
1061
# object_path - property
1062
@dbus_service_property(_interface, signature=u"o", access=u"read")
1063
def object_path_dbus_property(self):
1064
return self.dbus_object_path # is already a dbus.ObjectPath
1065
1066
# secret = property
1067
@dbus_service_property(_interface, signature=u"ay",
1068
access=u"write", byte_arrays=True)
1069
def secret_dbus_property(self, value):
1070
self.secret = str(value)
573
StopChecker = dbus.service.method(_interface)(stop_checker)
574
StopChecker.__name__ = "StopChecker"
1071
575
1072
576
del _interface
1073
577
1074
578
1075
class ProxyClient(object):
1076
def __init__(self, child_pipe, fpr, address):
1077
self._pipe = child_pipe
1078
self._pipe.send(('init', fpr, address))
1079
if not self._pipe.recv():
1080
raise KeyError()
1081
1082
def __getattribute__(self, name):
1083
if(name == '_pipe'):
1084
return super(ProxyClient, self).__getattribute__(name)
1085
self._pipe.send(('getattr', name))
1086
data = self._pipe.recv()
1087
if data[0] == 'data':
1088
return data[1]
1089
if data[0] == 'function':
1090
def func(*args, **kwargs):
1091
self._pipe.send(('funcall', name, args, kwargs))
1092
return self._pipe.recv()[1]
1093
return func
1094
1095
def __setattr__(self, name, value):
1096
if(name == '_pipe'):
1097
return super(ProxyClient, self).__setattr__(name, value)
1098
self._pipe.send(('setattr', name, value))
1099
1100
1101
class ClientHandler(socketserver.BaseRequestHandler, object):
1102
"""A class to handle client connections.
1103
1104
Instantiated once for each connection to handle it.
579
def peer_certificate(session):
580
"Return the peer's OpenPGP certificate as a bytestring"
581
# If not an OpenPGP certificate...
582
if (gnutls.library.functions
583
.gnutls_certificate_type_get(session._c_object)
584
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
585
# ...do the normal thing
586
return session.peer_certificate
587
list_size = ctypes.c_uint()
588
cert_list = (gnutls.library.functions
589
.gnutls_certificate_get_peers
590
(session._c_object, ctypes.byref(list_size)))
591
if list_size.value == 0:
592
return None
593
cert = cert_list[0]
594
return ctypes.string_at(cert.data, cert.size)
595
596
597
def fingerprint(openpgp):
598
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
599
# New GnuTLS "datum" with the OpenPGP public key
600
datum = (gnutls.library.types
601
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
602
ctypes.POINTER
603
(ctypes.c_ubyte)),
604
ctypes.c_uint(len(openpgp))))
605
# New empty GnuTLS certificate
606
crt = gnutls.library.types.gnutls_openpgp_crt_t()
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
609
# Import the OpenPGP public key into the certificate
610
(gnutls.library.functions
611
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
612
gnutls.library.constants
613
.GNUTLS_OPENPGP_FMT_RAW))
614
# Verify the self signature in the key
615
crtverify = ctypes.c_uint()
616
(gnutls.library.functions
617
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
618
if crtverify.value != 0:
619
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
620
raise gnutls.errors.CertificateSecurityError("Verify failed")
621
# New buffer for the fingerprint
622
buf = ctypes.create_string_buffer(20)
623
buf_len = ctypes.c_size_t()
624
# Get the fingerprint from the certificate into the buffer
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
627
ctypes.byref(buf_len)))
628
# Deinit the certificate
629
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
630
# Convert the buffer to a Python bytestring
631
fpr = ctypes.string_at(buf, buf_len.value)
632
# Convert the bytestring to hexadecimal notation
633
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
634
return hex_fpr
635
636
637
class TCP_handler(SocketServer.BaseRequestHandler, object):
638
"""A TCP request handler class.
639
Instantiated by IPv6_TCPServer for each request to handle it.
1105
640
Note: This will run in its own forked process."""
1106
641
1107
642
def handle(self):
1108
with contextlib.closing(self.server.child_pipe) as child_pipe:
1109
logger.info(u"TCP connection from: %s",
1110
unicode(self.client_address))
1111
logger.debug(u"Pipe FD: %d",
1112
self.server.child_pipe.fileno())
1113
1114
session = (gnutls.connection
1115
.ClientSession(self.request,
1116
gnutls.connection
1117
.X509Credentials()))
1118
1119
# Note: gnutls.connection.X509Credentials is really a
1120
# generic GnuTLS certificate credentials object so long as
1121
# no X.509 keys are added to it. Therefore, we can use it
1122
# here despite using OpenPGP certificates.
1123
1124
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1125
# u"+AES-256-CBC", u"+SHA1",
1126
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1127
# u"+DHE-DSS"))
1128
# Use a fallback default, since this MUST be set.
1129
priority = self.server.gnutls_priority
1130
if priority is None:
1131
priority = u"NORMAL"
1132
(gnutls.library.functions
1133
.gnutls_priority_set_direct(session._c_object,
1134
priority, None))
1135
1136
# Start communication using the Mandos protocol
1137
# Get protocol number
1138
line = self.request.makefile().readline()
1139
logger.debug(u"Protocol version: %r", line)
1140
try:
1141
if int(line.strip().split()[0]) > 1:
1142
raise RuntimeError
1143
except (ValueError, IndexError, RuntimeError), error:
1144
logger.error(u"Unknown protocol version: %s", error)
1145
return
1146
1147
# Start GnuTLS connection
1148
try:
1149
session.handshake()
1150
except gnutls.errors.GNUTLSError, error:
1151
logger.warning(u"Handshake failed: %s", error)
1152
# Do not run session.bye() here: the session is not
1153
# established. Just abandon the request.
1154
return
1155
logger.debug(u"Handshake succeeded")
1156
1157
approval_required = False
1158
try:
1159
try:
1160
fpr = self.fingerprint(self.peer_certificate
1161
(session))
1162
except (TypeError, gnutls.errors.GNUTLSError), error:
1163
logger.warning(u"Bad certificate: %s", error)
1164
return
1165
logger.debug(u"Fingerprint: %s", fpr)
1166
1167
try:
1168
client = ProxyClient(child_pipe, fpr,
1169
self.client_address)
1170
except KeyError:
1171
return
1172
1173
if client.approved_delay:
1174
delay = client.approved_delay
1175
client.approvals_pending += 1
1176
approval_required = True
1177
1178
while True:
1179
if not client.enabled:
1180
logger.warning(u"Client %s is disabled",
1181
client.name)
1182
if self.server.use_dbus:
1183
# Emit D-Bus signal
1184
client.Rejected("Disabled")
1185
return
1186
1187
if client._approved or not client.approved_delay:
1188
#We are approved or approval is disabled
1189
break
1190
elif client._approved is None:
1191
logger.info(u"Client %s need approval",
1192
client.name)
1193
if self.server.use_dbus:
1194
# Emit D-Bus signal
1195
client.NeedApproval(
1196
client.approved_delay_milliseconds(),
1197
client.approved_by_default)
1198
else:
1199
logger.warning(u"Client %s was not approved",
1200
client.name)
1201
if self.server.use_dbus:
1202
# Emit D-Bus signal
1203
client.Rejected("Disapproved")
1204
return
1205
1206
#wait until timeout or approved
1207
#x = float(client._timedelta_to_milliseconds(delay))
1208
time = datetime.datetime.now()
1209
client.changedstate.acquire()
1210
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1211
client.changedstate.release()
1212
time2 = datetime.datetime.now()
1213
if (time2 - time) >= delay:
1214
if not client.approved_by_default:
1215
logger.warning("Client %s timed out while"
1216
" waiting for approval",
1217
client.name)
1218
if self.server.use_dbus:
1219
# Emit D-Bus signal
1220
client.Rejected("Time out")
1221
return
1222
else:
1223
break
1224
else:
1225
delay -= time2 - time
1226
1227
sent_size = 0
1228
while sent_size < len(client.secret):
1229
# XXX handle session exception
1230
sent = session.send(client.secret[sent_size:])
1231
logger.debug(u"Sent: %d, remaining: %d",
1232
sent, len(client.secret)
1233
- (sent_size + sent))
1234
sent_size += sent
1235
1236
logger.info(u"Sending secret to %s", client.name)
1237
# bump the timeout as if seen
1238
client.checked_ok()
1239
if self.server.use_dbus:
1240
# Emit D-Bus signal
1241
client.GotSecret()
1242
1243
finally:
1244
if approval_required:
1245
client.approvals_pending -= 1
1246
session.bye()
1247
1248
@staticmethod
1249
def peer_certificate(session):
1250
"Return the peer's OpenPGP certificate as a bytestring"
1251
# If not an OpenPGP certificate...
1252
if (gnutls.library.functions
1253
.gnutls_certificate_type_get(session._c_object)
1254
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1255
# ...do the normal thing
1256
return session.peer_certificate
1257
list_size = ctypes.c_uint(1)
1258
cert_list = (gnutls.library.functions
1259
.gnutls_certificate_get_peers
1260
(session._c_object, ctypes.byref(list_size)))
1261
if not bool(cert_list) and list_size.value != 0:
1262
raise gnutls.errors.GNUTLSError(u"error getting peer"
1263
u" certificate")
1264
if list_size.value == 0:
1265
return None
1266
cert = cert_list[0]
1267
return ctypes.string_at(cert.data, cert.size)
1268
1269
@staticmethod
1270
def fingerprint(openpgp):
1271
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1272
# New GnuTLS "datum" with the OpenPGP public key
1273
datum = (gnutls.library.types
1274
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1275
ctypes.POINTER
1276
(ctypes.c_ubyte)),
1277
ctypes.c_uint(len(openpgp))))
1278
# New empty GnuTLS certificate
1279
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1280
(gnutls.library.functions
1281
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1282
# Import the OpenPGP public key into the certificate
1283
(gnutls.library.functions
1284
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1285
gnutls.library.constants
1286
.GNUTLS_OPENPGP_FMT_RAW))
1287
# Verify the self signature in the key
1288
crtverify = ctypes.c_uint()
1289
(gnutls.library.functions
1290
.gnutls_openpgp_crt_verify_self(crt, 0,
1291
ctypes.byref(crtverify)))
1292
if crtverify.value != 0:
1293
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1294
raise (gnutls.errors.CertificateSecurityError
1295
(u"Verify failed"))
1296
# New buffer for the fingerprint
1297
buf = ctypes.create_string_buffer(20)
1298
buf_len = ctypes.c_size_t()
1299
# Get the fingerprint from the certificate into the buffer
1300
(gnutls.library.functions
1301
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1302
ctypes.byref(buf_len)))
1303
# Deinit the certificate
1304
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1305
# Convert the buffer to a Python bytestring
1306
fpr = ctypes.string_at(buf, buf_len.value)
1307
# Convert the bytestring to hexadecimal notation
1308
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1309
return hex_fpr
1310
1311
1312
class MultiprocessingMixIn(object):
1313
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1314
def sub_process_main(self, request, address):
1315
try:
1316
self.finish_request(request, address)
1317
except:
1318
self.handle_error(request, address)
1319
self.close_request(request)
1320
1321
def process_request(self, request, address):
1322
"""Start a new process to process the request."""
1323
multiprocessing.Process(target = self.sub_process_main,
1324
args = (request, address)).start()
1325
1326
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1327
""" adds a pipe to the MixIn """
1328
def process_request(self, request, client_address):
1329
"""Overrides and wraps the original process_request().
1330
1331
This function creates a new pipe in self.pipe
1332
"""
1333
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1334
1335
super(MultiprocessingMixInWithPipe,
1336
self).process_request(request, client_address)
1337
self.add_pipe(parent_pipe)
1338
def add_pipe(self, parent_pipe):
1339
"""Dummy function; override as necessary"""
1340
pass
1341
1342
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1343
socketserver.TCPServer, object):
1344
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1345
643
logger.info(u"TCP connection from: %s",
644
unicode(self.client_address))
645
session = (gnutls.connection
646
.ClientSession(self.request,
647
gnutls.connection
648
.X509Credentials()))
649
650
line = self.request.makefile().readline()
651
logger.debug(u"Protocol version: %r", line)
652
try:
653
if int(line.strip().split()[0]) > 1:
654
raise RuntimeError
655
except (ValueError, IndexError, RuntimeError), error:
656
logger.error(u"Unknown protocol version: %s", error)
657
return
658
659
# Note: gnutls.connection.X509Credentials is really a generic
660
# GnuTLS certificate credentials object so long as no X.509
661
# keys are added to it. Therefore, we can use it here despite
662
# using OpenPGP certificates.
663
664
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
665
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
666
# "+DHE-DSS"))
667
# Use a fallback default, since this MUST be set.
668
priority = self.server.settings.get("priority", "NORMAL")
669
(gnutls.library.functions
670
.gnutls_priority_set_direct(session._c_object,
671
priority, None))
672
673
try:
674
session.handshake()
675
except gnutls.errors.GNUTLSError, error:
676
logger.warning(u"Handshake failed: %s", error)
677
# Do not run session.bye() here: the session is not
678
# established. Just abandon the request.
679
return
680
try:
681
fpr = fingerprint(peer_certificate(session))
682
except (TypeError, gnutls.errors.GNUTLSError), error:
683
logger.warning(u"Bad certificate: %s", error)
684
session.bye()
685
return
686
logger.debug(u"Fingerprint: %s", fpr)
687
for c in self.server.clients:
688
if c.fingerprint == fpr:
689
client = c
690
break
691
else:
692
logger.warning(u"Client not found for fingerprint: %s",
693
fpr)
694
session.bye()
695
return
696
# Have to check if client.still_valid(), since it is possible
697
# that the client timed out while establishing the GnuTLS
698
# session.
699
if not client.still_valid():
700
logger.warning(u"Client %(name)s is invalid",
701
vars(client))
702
session.bye()
703
return
704
## This won't work here, since we're in a fork.
705
# client.bump_timeout()
706
sent_size = 0
707
while sent_size < len(client.secret):
708
sent = session.send(client.secret[sent_size:])
709
logger.debug(u"Sent: %d, remaining: %d",
710
sent, len(client.secret)
711
- (sent_size + sent))
712
sent_size += sent
713
session.bye()
714
715
716
class IPv6_TCPServer(SocketServer.ForkingMixIn,
717
SocketServer.TCPServer, object):
718
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1346
719
Attributes:
720
settings: Server settings
721
clients: Set() of Client objects
1347
722
enabled: Boolean; whether this server is activated yet
1348
interface: None or a network interface name (string)
1349
use_ipv6: Boolean; to use IPv6 or not
1350
723
"""
1351
def __init__(self, server_address, RequestHandlerClass,
1352
interface=None, use_ipv6=True):
1353
self.interface = interface
1354
if use_ipv6:
1355
self.address_family = socket.AF_INET6
1356
socketserver.TCPServer.__init__(self, server_address,
1357
RequestHandlerClass)
724
address_family = socket.AF_INET6
725
def __init__(self, *args, **kwargs):
726
if "settings" in kwargs:
727
self.settings = kwargs["settings"]
728
del kwargs["settings"]
729
if "clients" in kwargs:
730
self.clients = kwargs["clients"]
731
del kwargs["clients"]
732
self.enabled = False
733
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1358
734
def server_bind(self):
1359
735
"""This overrides the normal server_bind() function
1360
736
to bind to an interface if one was specified, and also NOT to
1361
737
bind to an address or port if they were not specified."""
1362
if self.interface is not None:
1363
if SO_BINDTODEVICE is None:
1364
logger.error(u"SO_BINDTODEVICE does not exist;"
1365
u" cannot bind to interface %s",
1366
self.interface)
1367
else:
1368
try:
1369
self.socket.setsockopt(socket.SOL_SOCKET,
1370
SO_BINDTODEVICE,
1371
str(self.interface
1372
+ u'\0'))
1373
except socket.error, error:
1374
if error[0] == errno.EPERM:
1375
logger.error(u"No permission to"
1376
u" bind to interface %s",
1377
self.interface)
1378
elif error[0] == errno.ENOPROTOOPT:
1379
logger.error(u"SO_BINDTODEVICE not available;"
1380
u" cannot bind to interface %s",
1381
self.interface)
1382
else:
1383
raise
738
if self.settings["interface"]:
739
# 25 is from /usr/include/asm-i486/socket.h
740
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
741
try:
742
self.socket.setsockopt(socket.SOL_SOCKET,
743
SO_BINDTODEVICE,
744
self.settings["interface"])
745
except socket.error, error:
746
if error[0] == errno.EPERM:
747
logger.error(u"No permission to"
748
u" bind to interface %s",
749
self.settings["interface"])
750
else:
751
raise error
1384
752
# Only bind(2) the socket if we really need to.
1385
753
if self.server_address[0] or self.server_address[1]:
1386
754
if not self.server_address[0]:
1387
if self.address_family == socket.AF_INET6:
1388
any_address = u"::" # in6addr_any
1389
else:
1390
any_address = socket.INADDR_ANY
1391
self.server_address = (any_address,
755
in6addr_any = "::"
756
self.server_address = (in6addr_any,
1392
757
self.server_address[1])
1393
758
elif not self.server_address[1]:
1394
759
self.server_address = (self.server_address[0],
1395
760
0)
1396
# if self.interface:
761
# if self.settings["interface"]:
1397
762
# self.server_address = (self.server_address[0],
1398
763
# 0, # port
1399
764
# 0, # flowinfo
1400
765
# if_nametoindex
1401
# (self.interface))
1402
return socketserver.TCPServer.server_bind(self)
1403
1404
1405
class MandosServer(IPv6_TCPServer):
1406
"""Mandos server.
1407
1408
Attributes:
1409
clients: set of Client objects
1410
gnutls_priority GnuTLS priority string
1411
use_dbus: Boolean; to emit D-Bus signals or not
1412
1413
Assumes a gobject.MainLoop event loop.
1414
"""
1415
def __init__(self, server_address, RequestHandlerClass,
1416
interface=None, use_ipv6=True, clients=None,
1417
gnutls_priority=None, use_dbus=True):
1418
self.enabled = False
1419
self.clients = clients
1420
if self.clients is None:
1421
self.clients = set()
1422
self.use_dbus = use_dbus
1423
self.gnutls_priority = gnutls_priority
1424
IPv6_TCPServer.__init__(self, server_address,
1425
RequestHandlerClass,
1426
interface = interface,
1427
use_ipv6 = use_ipv6)
766
# (self.settings
767
# ["interface"]))
768
return super(IPv6_TCPServer, self).server_bind()
1428
769
def server_activate(self):
1429
770
if self.enabled:
1430
return socketserver.TCPServer.server_activate(self)
771
return super(IPv6_TCPServer, self).server_activate()
1431
772
def enable(self):
1432
773
self.enabled = True
1433
def add_pipe(self, parent_pipe):
1434
# Call "handle_ipc" for both data and EOF events
1435
gobject.io_add_watch(parent_pipe.fileno(),
1436
gobject.IO_IN | gobject.IO_HUP,
1437
functools.partial(self.handle_ipc,
1438
parent_pipe = parent_pipe))
1439
1440
def handle_ipc(self, source, condition, parent_pipe=None,
1441
client_object=None):
1442
condition_names = {
1443
gobject.IO_IN: u"IN", # There is data to read.
1444
gobject.IO_OUT: u"OUT", # Data can be written (without
1445
# blocking).
1446
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1447
gobject.IO_ERR: u"ERR", # Error condition.
1448
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1449
# broken, usually for pipes and
1450
# sockets).
1451
}
1452
conditions_string = ' | '.join(name
1453
for cond, name in
1454
condition_names.iteritems()
1455
if cond & condition)
1456
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1457
conditions_string)
1458
1459
# Read a request from the child
1460
request = parent_pipe.recv()
1461
command = request[0]
1462
1463
if command == 'init':
1464
fpr = request[1]
1465
address = request[2]
1466
1467
for c in self.clients:
1468
if c.fingerprint == fpr:
1469
client = c
1470
break
1471
else:
1472
logger.warning(u"Client not found for fingerprint: %s, ad"
1473
u"dress: %s", fpr, address)
1474
if self.use_dbus:
1475
# Emit D-Bus signal
1476
mandos_dbus_service.ClientNotFound(fpr, address)
1477
parent_pipe.send(False)
1478
return False
1479
1480
gobject.io_add_watch(parent_pipe.fileno(),
1481
gobject.IO_IN | gobject.IO_HUP,
1482
functools.partial(self.handle_ipc,
1483
parent_pipe = parent_pipe,
1484
client_object = client))
1485
parent_pipe.send(True)
1486
# remove the old hook in favor of the new above hook on same fileno
1487
return False
1488
if command == 'funcall':
1489
funcname = request[1]
1490
args = request[2]
1491
kwargs = request[3]
1492
1493
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1494
1495
if command == 'getattr':
1496
attrname = request[1]
1497
if callable(client_object.__getattribute__(attrname)):
1498
parent_pipe.send(('function',))
1499
else:
1500
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1501
1502
if command == 'setattr':
1503
attrname = request[1]
1504
value = request[2]
1505
setattr(client_object, attrname, value)
1506
1507
return True
1508
774
1509
775
1510
776
def string_to_delta(interval):
1511
777
"""Parse a string and return a datetime.timedelta
1512
1513
>>> string_to_delta(u'7d')
778
779
>>> string_to_delta('7d')
1514
780
datetime.timedelta(7)
1515
>>> string_to_delta(u'60s')
781
>>> string_to_delta('60s')
1516
782
datetime.timedelta(0, 60)
1517
>>> string_to_delta(u'60m')
783
>>> string_to_delta('60m')
1518
784
datetime.timedelta(0, 3600)
1519
>>> string_to_delta(u'24h')
785
>>> string_to_delta('24h')
1520
786
datetime.timedelta(1)
1521
787
>>> string_to_delta(u'1w')
1522
788
datetime.timedelta(7)
1523
>>> string_to_delta(u'5m 30s')
789
>>> string_to_delta('5m 30s')
1524
790
datetime.timedelta(0, 330)
1525
791
"""
1526
792
timevalue = datetime.timedelta(0)
1539
805
elif suffix == u"w":
1540
806
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1541
807
else:
1542
raise ValueError(u"Unknown suffix %r" % suffix)
1543
except (ValueError, IndexError), e:
1544
raise ValueError(e.message)
808
raise ValueError
809
except (ValueError, IndexError):
810
raise ValueError
1545
811
timevalue += delta
1546
812
return timevalue
1547
813
1548
814
815
def server_state_changed(state):
816
"""Derived from the Avahi example code"""
817
if state == avahi.SERVER_COLLISION:
818
logger.error(u"Zeroconf server name collision")
819
service.remove()
820
elif state == avahi.SERVER_RUNNING:
821
service.add()
822
823
824
def entry_group_state_changed(state, error):
825
"""Derived from the Avahi example code"""
826
logger.debug(u"Avahi state change: %i", state)
827
828
if state == avahi.ENTRY_GROUP_ESTABLISHED:
829
logger.debug(u"Zeroconf service established.")
830
elif state == avahi.ENTRY_GROUP_COLLISION:
831
logger.warning(u"Zeroconf service name collision.")
832
service.rename()
833
elif state == avahi.ENTRY_GROUP_FAILURE:
834
logger.critical(u"Avahi: Error in group state changed %s",
835
unicode(error))
836
raise AvahiGroupError("State changed: %s", str(error))
837
1549
838
def if_nametoindex(interface):
1550
"""Call the C function if_nametoindex(), or equivalent
1551
1552
Note: This function cannot accept a unicode string."""
839
"""Call the C function if_nametoindex(), or equivalent"""
1553
840
global if_nametoindex
1554
841
try:
1555
842
if_nametoindex = (ctypes.cdll.LoadLibrary
1556
(ctypes.util.find_library(u"c"))
843
(ctypes.util.find_library("c"))
1557
844
.if_nametoindex)
1558
845
except (OSError, AttributeError):
1559
logger.warning(u"Doing if_nametoindex the hard way")
846
if "struct" not in sys.modules:
847
import struct
848
if "fcntl" not in sys.modules:
849
import fcntl
1560
850
def if_nametoindex(interface):
1561
851
"Get an interface index the hard way, i.e. using fcntl()"
1562
852
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1563
with contextlib.closing(socket.socket()) as s:
853
with closing(socket.socket()) as s:
1564
854
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1565
struct.pack(str(u"16s16x"),
1566
interface))
1567
interface_index = struct.unpack(str(u"I"),
1568
ifreq[16:20])[0]
855
struct.pack("16s16x", interface))
856
interface_index = struct.unpack("I", ifreq[16:20])[0]
1569
857
return interface_index
1570
858
return if_nametoindex(interface)
1571
859
1572
860
1573
861
def daemon(nochdir = False, noclose = False):
1574
862
"""See daemon(3). Standard BSD Unix function.
1575
1576
863
This should really exist as os.daemon, but it doesn't (yet)."""
1577
864
if os.fork():
1578
865
sys.exit()
1579
866
os.setsid()
1580
867
if not nochdir:
1581
os.chdir(u"/")
868
os.chdir("/")
1582
869
if os.fork():
1583
870
sys.exit()
1584
871
if not noclose:
1586
873
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1587
874
if not stat.S_ISCHR(os.fstat(null).st_mode):
1588
875
raise OSError(errno.ENODEV,
1589
u"%s not a character device"
1590
% os.path.devnull)
876
"/dev/null not a character device")
1591
877
os.dup2(null, sys.stdin.fileno())
1592
878
os.dup2(null, sys.stdout.fileno())
1593
879
os.dup2(null, sys.stderr.fileno())
1596
882
1597
883
1598
884
def main():
1599
1600
##################################################################
1601
# Parsing of options, both command line and config file
1602
1603
parser = optparse.OptionParser(version = "%%prog %s" % version)
1604
parser.add_option("-i", u"--interface", type=u"string",
1605
metavar="IF", help=u"Bind to interface IF")
1606
parser.add_option("-a", u"--address", type=u"string",
1607
help=u"Address to listen for requests on")
1608
parser.add_option("-p", u"--port", type=u"int",
1609
help=u"Port number to receive requests on")
1610
parser.add_option("--check", action=u"store_true",
1611
help=u"Run self-test")
1612
parser.add_option("--debug", action=u"store_true",
1613
help=u"Debug mode; run in foreground and log to"
1614
u" terminal")
1615
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1616
u" priority string (see GnuTLS documentation)")
1617
parser.add_option("--servicename", type=u"string",
1618
metavar=u"NAME", help=u"Zeroconf service name")
1619
parser.add_option("--configdir", type=u"string",
1620
default=u"/etc/mandos", metavar=u"DIR",
1621
help=u"Directory to search for configuration"
1622
u" files")
1623
parser.add_option("--no-dbus", action=u"store_false",
1624
dest=u"use_dbus", help=u"Do not provide D-Bus"
1625
u" system bus interface")
1626
parser.add_option("--no-ipv6", action=u"store_false",
1627
dest=u"use_ipv6", help=u"Do not use IPv6")
885
parser = OptionParser(version = "%%prog %s" % version)
886
parser.add_option("-i", "--interface", type="string",
887
metavar="IF", help="Bind to interface IF")
888
parser.add_option("-a", "--address", type="string",
889
help="Address to listen for requests on")
890
parser.add_option("-p", "--port", type="int",
891
help="Port number to receive requests on")
892
parser.add_option("--check", action="store_true", default=False,
893
help="Run self-test")
894
parser.add_option("--debug", action="store_true",
895
help="Debug mode; run in foreground and log to"
896
" terminal")
897
parser.add_option("--priority", type="string", help="GnuTLS"
898
" priority string (see GnuTLS documentation)")
899
parser.add_option("--servicename", type="string", metavar="NAME",
900
help="Zeroconf service name")
901
parser.add_option("--configdir", type="string",
902
default="/etc/mandos", metavar="DIR",
903
help="Directory to search for configuration"
904
" files")
1628
905
options = parser.parse_args()[0]
1629
906
1630
907
if options.check:
1633
910
sys.exit()
1634
911
1635
912
# Default values for config file for server-global settings
1636
server_defaults = { u"interface": u"",
1637
u"address": u"",
1638
u"port": u"",
1639
u"debug": u"False",
1640
u"priority":
1641
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1642
u"servicename": u"Mandos",
1643
u"use_dbus": u"True",
1644
u"use_ipv6": u"True",
913
server_defaults = { "interface": "",
914
"address": "",
915
"port": "",
916
"debug": "False",
917
"priority":
918
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
919
"servicename": "Mandos",
1645
920
}
1646
921
1647
922
# Parse config file for server-global settings
1648
server_config = configparser.SafeConfigParser(server_defaults)
923
server_config = ConfigParser.SafeConfigParser(server_defaults)
1649
924
del server_defaults
1650
server_config.read(os.path.join(options.configdir,
1651
u"mandos.conf"))
925
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1652
926
# Convert the SafeConfigParser object to a dict
1653
927
server_settings = server_config.defaults()
1654
# Use the appropriate methods on the non-string config options
1655
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1656
server_settings[option] = server_config.getboolean(u"DEFAULT",
1657
option)
1658
if server_settings["port"]:
1659
server_settings["port"] = server_config.getint(u"DEFAULT",
1660
u"port")
928
# Use getboolean on the boolean config option
929
server_settings["debug"] = (server_config.getboolean
930
("DEFAULT", "debug"))
1661
931
del server_config
1662
932
1663
933
# Override the settings from the config file with command line
1664
934
# options, if set.
1665
for option in (u"interface", u"address", u"port", u"debug",
1666
u"priority", u"servicename", u"configdir",
1667
u"use_dbus", u"use_ipv6"):
935
for option in ("interface", "address", "port", "debug",
936
"priority", "servicename", "configdir"):
1668
937
value = getattr(options, option)
1669
938
if value is not None:
1670
939
server_settings[option] = value
1671
940
del options
1672
# Force all strings to be unicode
1673
for option in server_settings.keys():
1674
if type(server_settings[option]) is str:
1675
server_settings[option] = unicode(server_settings[option])
1676
941
# Now we have our good server settings in "server_settings"
1677
942
1678
##################################################################
1679
1680
# For convenience
1681
debug = server_settings[u"debug"]
1682
use_dbus = server_settings[u"use_dbus"]
1683
use_ipv6 = server_settings[u"use_ipv6"]
943
debug = server_settings["debug"]
1684
944
1685
945
if not debug:
1686
946
syslogger.setLevel(logging.WARNING)
1687
947
console.setLevel(logging.WARNING)
1688
948
1689
if server_settings[u"servicename"] != u"Mandos":
949
if server_settings["servicename"] != "Mandos":
1690
950
syslogger.setFormatter(logging.Formatter
1691
(u'Mandos (%s) [%%(process)d]:'
1692
u' %%(levelname)s: %%(message)s'
1693
% server_settings[u"servicename"]))
951
('Mandos (%s): %%(levelname)s:'
952
' %%(message)s'
953
% server_settings["servicename"]))
1694
954
1695
955
# Parse config file with clients
1696
client_defaults = { u"timeout": u"1h",
1697
u"interval": u"5m",
1698
u"checker": u"fping -q -- %%(host)s",
1699
u"host": u"",
1700
u"approved_delay": u"0s",
1701
u"approved_duration": u"1s",
956
client_defaults = { "timeout": "1h",
957
"interval": "5m",
958
"checker": "fping -q -- %(host)s",
959
"host": "",
1702
960
}
1703
client_config = configparser.SafeConfigParser(client_defaults)
1704
client_config.read(os.path.join(server_settings[u"configdir"],
1705
u"clients.conf"))
1706
1707
global mandos_dbus_service
1708
mandos_dbus_service = None
1709
1710
tcp_server = MandosServer((server_settings[u"address"],
1711
server_settings[u"port"]),
1712
ClientHandler,
1713
interface=server_settings[u"interface"],
1714
use_ipv6=use_ipv6,
1715
gnutls_priority=
1716
server_settings[u"priority"],
1717
use_dbus=use_dbus)
1718
pidfilename = u"/var/run/mandos.pid"
1719
try:
1720
pidfile = open(pidfilename, u"w")
1721
except IOError:
1722
logger.error(u"Could not open file %r", pidfilename)
1723
1724
try:
1725
uid = pwd.getpwnam(u"_mandos").pw_uid
1726
gid = pwd.getpwnam(u"_mandos").pw_gid
961
client_config = ConfigParser.SafeConfigParser(client_defaults)
962
client_config.read(os.path.join(server_settings["configdir"],
963
"clients.conf"))
964
965
clients = Set()
966
tcp_server = IPv6_TCPServer((server_settings["address"],
967
server_settings["port"]),
968
TCP_handler,
969
settings=server_settings,
970
clients=clients)
971
pidfilename = "/var/run/mandos.pid"
972
try:
973
pidfile = open(pidfilename, "w")
974
except IOError, error:
975
logger.error("Could not open file %r", pidfilename)
976
977
try:
978
uid = pwd.getpwnam("_mandos").pw_uid
1727
979
except KeyError:
1728
980
try:
1729
uid = pwd.getpwnam(u"mandos").pw_uid
1730
gid = pwd.getpwnam(u"mandos").pw_gid
981
uid = pwd.getpwnam("mandos").pw_uid
1731
982
except KeyError:
1732
983
try:
1733
uid = pwd.getpwnam(u"nobody").pw_uid
1734
gid = pwd.getpwnam(u"nobody").pw_gid
984
uid = pwd.getpwnam("nobody").pw_uid
1735
985
except KeyError:
1736
986
uid = 65534
987
try:
988
gid = pwd.getpwnam("_mandos").pw_gid
989
except KeyError:
990
try:
991
gid = pwd.getpwnam("mandos").pw_gid
992
except KeyError:
993
try:
994
gid = pwd.getpwnam("nogroup").pw_gid
995
except KeyError:
1737
996
gid = 65534
1738
997
try:
998
os.setuid(uid)
1739
999
os.setgid(gid)
1740
os.setuid(uid)
1741
1000
except OSError, error:
1742
1001
if error[0] != errno.EPERM:
1743
1002
raise error
1744
1003
1745
# Enable all possible GnuTLS debugging
1746
if debug:
1747
# "Use a log level over 10 to enable all debugging options."
1748
# - GnuTLS manual
1749
gnutls.library.functions.gnutls_global_set_log_level(11)
1750
1751
@gnutls.library.types.gnutls_log_func
1752
def debug_gnutls(level, string):
1753
logger.debug(u"GnuTLS: %s", string[:-1])
1754
1755
(gnutls.library.functions
1756
.gnutls_global_set_log_function(debug_gnutls))
1004
global service
1005
service = AvahiService(name = server_settings["servicename"],
1006
servicetype = "_mandos._tcp", )
1007
if server_settings["interface"]:
1008
service.interface = (if_nametoindex
1009
(server_settings["interface"]))
1757
1010
1758
1011
global main_loop
1012
global bus
1013
global server
1759
1014
# From the Avahi example code
1760
1015
DBusGMainLoop(set_as_default=True )
1761
1016
main_loop = gobject.MainLoop()
1762
1017
bus = dbus.SystemBus()
1018
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1019
avahi.DBUS_PATH_SERVER),
1020
avahi.DBUS_INTERFACE_SERVER)
1763
1021
# End of Avahi example code
1764
if use_dbus:
1765
try:
1766
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1767
bus, do_not_queue=True)
1768
except dbus.exceptions.NameExistsException, e:
1769
logger.error(unicode(e) + u", disabling D-Bus")
1770
use_dbus = False
1771
server_settings[u"use_dbus"] = False
1772
tcp_server.use_dbus = False
1773
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1774
service = AvahiService(name = server_settings[u"servicename"],
1775
servicetype = u"_mandos._tcp",
1776
protocol = protocol, bus = bus)
1777
if server_settings["interface"]:
1778
service.interface = (if_nametoindex
1779
(str(server_settings[u"interface"])))
1780
1781
client_class = Client
1782
if use_dbus:
1783
client_class = functools.partial(ClientDBus, bus = bus)
1784
def client_config_items(config, section):
1785
special_settings = {
1786
"approved_by_default":
1787
lambda: config.getboolean(section,
1788
"approved_by_default"),
1789
}
1790
for name, value in config.items(section):
1791
try:
1792
yield (name, special_settings[name]())
1793
except KeyError:
1794
yield (name, value)
1795
1796
tcp_server.clients.update(set(
1797
client_class(name = section,
1798
config= dict(client_config_items(
1799
client_config, section)))
1800
for section in client_config.sections()))
1801
if not tcp_server.clients:
1802
logger.warning(u"No clients defined")
1022
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1023
1024
clients.update(Set(Client(name = section,
1025
config
1026
= dict(client_config.items(section)))
1027
for section in client_config.sections()))
1028
if not clients:
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1803
1031
1804
1032
if debug:
1805
1033
# Redirect stdin so all checkers get /dev/null
1814
1042
daemon()
1815
1043
1816
1044
try:
1817
with pidfile:
1818
pid = os.getpid()
1819
pidfile.write(str(pid) + "\n")
1045
pid = os.getpid()
1046
pidfile.write(str(pid) + "\n")
1047
pidfile.close()
1820
1048
del pidfile
1821
1049
except IOError:
1822
1050
logger.error(u"Could not write to file %r with PID %d",
1826
1054
pass
1827
1055
del pidfilename
1828
1056
1829
if not debug:
1830
signal.signal(signal.SIGINT, signal.SIG_IGN)
1831
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1832
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1833
1834
if use_dbus:
1835
class MandosDBusService(dbus.service.Object):
1836
"""A D-Bus proxy object"""
1837
def __init__(self):
1838
dbus.service.Object.__init__(self, bus, u"/")
1839
_interface = u"se.bsnet.fukt.Mandos"
1840
1841
@dbus.service.signal(_interface, signature=u"o")
1842
def ClientAdded(self, objpath):
1843
"D-Bus signal"
1844
pass
1845
1846
@dbus.service.signal(_interface, signature=u"ss")
1847
def ClientNotFound(self, fingerprint, address):
1848
"D-Bus signal"
1849
pass
1850
1851
@dbus.service.signal(_interface, signature=u"os")
1852
def ClientRemoved(self, objpath, name):
1853
"D-Bus signal"
1854
pass
1855
1856
@dbus.service.method(_interface, out_signature=u"ao")
1857
def GetAllClients(self):
1858
"D-Bus method"
1859
return dbus.Array(c.dbus_object_path
1860
for c in tcp_server.clients)
1861
1862
@dbus.service.method(_interface,
1863
out_signature=u"a{oa{sv}}")
1864
def GetAllClientsWithProperties(self):
1865
"D-Bus method"
1866
return dbus.Dictionary(
1867
((c.dbus_object_path, c.GetAll(u""))
1868
for c in tcp_server.clients),
1869
signature=u"oa{sv}")
1870
1871
@dbus.service.method(_interface, in_signature=u"o")
1872
def RemoveClient(self, object_path):
1873
"D-Bus method"
1874
for c in tcp_server.clients:
1875
if c.dbus_object_path == object_path:
1876
tcp_server.clients.remove(c)
1877
c.remove_from_connection()
1878
# Don't signal anything except ClientRemoved
1879
c.disable(quiet=True)
1880
# Emit D-Bus signal
1881
self.ClientRemoved(object_path, c.name)
1882
return
1883
raise KeyError(object_path)
1884
1885
del _interface
1886
1887
mandos_dbus_service = MandosDBusService()
1888
1889
1057
def cleanup():
1890
1058
"Cleanup function; run on exit"
1891
service.cleanup()
1059
global group
1060
# From the Avahi example code
1061
if not group is None:
1062
group.Free()
1063
group = None
1064
# End of Avahi example code
1892
1065
1893
while tcp_server.clients:
1894
client = tcp_server.clients.pop()
1895
if use_dbus:
1896
client.remove_from_connection()
1066
while clients:
1067
client = clients.pop()
1897
1068
client.disable_hook = None
1898
# Don't signal anything except ClientRemoved
1899
client.disable(quiet=True)
1900
if use_dbus:
1901
# Emit D-Bus signal
1902
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1903
client.name)
1069
client.disable()
1904
1070
1905
1071
atexit.register(cleanup)
1906
1072
1907
for client in tcp_server.clients:
1908
if use_dbus:
1909
# Emit D-Bus signal
1910
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1073
if not debug:
1074
signal.signal(signal.SIGINT, signal.SIG_IGN)
1075
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1077
1078
class MandosServer(dbus.service.Object):
1079
"""A D-Bus proxy object"""
1080
def __init__(self):
1081
dbus.service.Object.__init__(self, bus,
1082
"/Mandos")
1083
_interface = u"org.mandos_system.Mandos"
1084
1085
@dbus.service.signal(_interface, signature="oa{sv}")
1086
def ClientAdded(self, objpath, properties):
1087
"D-Bus signal"
1088
pass
1089
1090
@dbus.service.signal(_interface, signature="o")
1091
def ClientRemoved(self, objpath):
1092
"D-Bus signal"
1093
pass
1094
1095
@dbus.service.method(_interface, out_signature="ao")
1096
def GetAllClients(self):
1097
return dbus.Array(c.dbus_object_path for c in clients)
1098
1099
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1100
def GetAllClientsWithProperties(self):
1101
return dbus.Dictionary(
1102
((c.dbus_object_path, c.GetAllProperties())
1103
for c in clients),
1104
signature="oa{sv}")
1105
1106
@dbus.service.method(_interface, in_signature="o")
1107
def RemoveClient(self, object_path):
1108
for c in clients:
1109
if c.dbus_object_path == object_path:
1110
c.disable()
1111
clients.remove(c)
1112
return
1113
raise KeyError
1114
1115
del _interface
1116
1117
mandos_server = MandosServer()
1118
1119
for client in clients:
1120
# Emit D-Bus signal
1121
mandos_server.ClientAdded(client.dbus_object_path,
1122
client.GetAllProperties())
1911
1123
client.enable()
1912
1124
1913
1125
tcp_server.enable()
1915
1127
1916
1128
# Find out what port we got
1917
1129
service.port = tcp_server.socket.getsockname()[1]
1918
if use_ipv6:
1919
logger.info(u"Now listening on address %r, port %d,"
1920
" flowinfo %d, scope_id %d"
1921
% tcp_server.socket.getsockname())
1922
else: # IPv4
1923
logger.info(u"Now listening on address %r, port %d"
1924
% tcp_server.socket.getsockname())
1130
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1131
u" scope_id %d" % tcp_server.socket.getsockname())
1925
1132
1926
1133
#service.interface = tcp_server.socket.getsockname()[3]
1927
1134
1928
1135
try:
1929
1136
# From the Avahi example code
1137
server.connect_to_signal("StateChanged", server_state_changed)
1930
1138
try:
1931
service.activate()
1139
server_state_changed(server.GetState())
1932
1140
except dbus.exceptions.DBusException, error:
1933
1141
logger.critical(u"DBusException: %s", error)
1934
cleanup()
1935
1142
sys.exit(1)
1936
1143
# End of Avahi example code
1937
1144
1943
1150
logger.debug(u"Starting main loop")
1944
1151
main_loop.run()
1945
1152
except AvahiError, error:
1946
logger.critical(u"AvahiError: %s", error)
1947
cleanup()
1153
logger.critical(u"AvahiError: %s" + unicode(error))
1948
1154
sys.exit(1)
1949
1155
except KeyboardInterrupt:
1950
1156
if debug:
1951
print >> sys.stderr
1952
logger.debug(u"Server received KeyboardInterrupt")
1953
logger.debug(u"Server exiting")
1954
# Must run before the D-Bus bus name gets deregistered
1955
cleanup()
1157
print
1956
1158
1957
1159
if __name__ == '__main__':
1958
1160
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0