To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.155
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.155
- Committer: Björn Påhlsson
- Date: 2010-09-07 16:48:58 UTC
- mto: (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 421.
- Revision ID: belorn@fukt.bsnet.se-20100907164858-tcg8hkxdj41zizac
mandos server: Added debuglevel that adjust at what level information
should be reported.
plugin-runner, askpass-fifo, password-prompt, splasy, usplash:
Using error instead of perror
should be reported.
plugin-runner, askpass-fifo, password-prompt, splasy, usplash:
Using error instead of perror
- files added:
- plugins.d/plymouth
- files removed:
- DBUS-API
- debian/source
- network-hooks.d
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
62
61
import functools
63
62
import cPickle as pickle
64
63
import multiprocessing
65
import types
66
import binascii
67
import tempfile
68
64
69
65
import dbus
70
66
import dbus.service
75
71
import ctypes.util
76
72
import xml.dom.minidom
77
73
import inspect
78
import GnuPGInterface
79
74
80
75
try:
81
76
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
80
except ImportError:
86
81
SO_BINDTODEVICE = None
87
82
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
91
logger = logging.getLogger()
83
84
version = "1.0.14"
85
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
92
88
syslogger = (logging.handlers.SysLogHandler
93
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
147
148
def __enter__(self):
149
return self
150
151
def __exit__ (self, exc_type, exc_value, traceback):
152
self._cleanup()
153
return False
154
155
def __del__(self):
156
self._cleanup()
157
158
def _cleanup(self):
159
if self.tempdir is not None:
160
# Delete contents of tempdir
161
for root, dirs, files in os.walk(self.tempdir,
162
topdown = False):
163
for filename in files:
164
os.remove(os.path.join(root, filename))
165
for dirname in dirs:
166
os.rmdir(os.path.join(root, dirname))
167
# Remove tempdir
168
os.rmdir(self.tempdir)
169
self.tempdir = None
170
171
def password_encode(self, password):
172
# Passphrase can not be empty and can not contain newlines or
173
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
175
176
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
191
return ciphertext
192
193
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
208
return decrypted_plaintext
209
210
90
address = "/dev/log"))
91
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
94
logger.addHandler(syslogger)
95
96
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
100
logger.addHandler(console)
211
101
212
102
class AvahiError(Exception):
213
103
def __init__(self, value, *args, **kwargs):
229
119
Attributes:
230
120
interface: integer; avahi.IF_UNSPEC or an interface index.
231
121
Used to optionally bind to the specified interface.
232
name: string; Example: 'Mandos'
233
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
234
124
See <http://www.dns-sd.org/ServiceTypes.html>
235
125
port: integer; what port to announce
236
126
TXT: list of strings; TXT record for the service
245
135
"""
246
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
247
137
servicetype = None, port = None, TXT = None,
248
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
249
139
protocol = avahi.PROTO_UNSPEC, bus = None):
250
140
self.interface = interface
251
141
self.name = name
260
150
self.group = None # our entry group
261
151
self.server = None
262
152
self.bus = bus
263
self.entry_group_state_changed_match = None
264
153
def rename(self):
265
154
"""Derived from the Avahi example code"""
266
155
if self.rename_count >= self.max_renames:
267
logger.critical("No suitable Zeroconf service name found"
268
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
269
158
self.rename_count)
270
raise AvahiServiceError("Too many renames")
271
self.name = unicode(self.server
272
.GetAlternativeServiceName(self.name))
273
logger.info("Changing Zeroconf service name to %r ...",
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
274
162
self.name)
163
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
166
% self.name))
275
167
self.remove()
276
try:
277
self.add()
278
except dbus.exceptions.DBusException as error:
279
logger.critical("DBusException: %s", error)
280
self.cleanup()
281
os._exit(1)
168
self.add()
282
169
self.rename_count += 1
283
170
def remove(self):
284
171
"""Derived from the Avahi example code"""
285
if self.entry_group_state_changed_match is not None:
286
self.entry_group_state_changed_match.remove()
287
self.entry_group_state_changed_match = None
288
172
if self.group is not None:
289
173
self.group.Reset()
290
174
def add(self):
291
175
"""Derived from the Avahi example code"""
292
self.remove()
293
176
if self.group is None:
294
177
self.group = dbus.Interface(
295
178
self.bus.get_object(avahi.DBUS_NAME,
296
179
self.server.EntryGroupNew()),
297
180
avahi.DBUS_INTERFACE_ENTRY_GROUP)
298
self.entry_group_state_changed_match = (
299
self.group.connect_to_signal(
300
'StateChanged', self.entry_group_state_changed))
301
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
181
self.group.connect_to_signal('StateChanged',
182
self
183
.entry_group_state_changed)
184
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
302
185
self.name, self.type)
303
186
self.group.AddService(
304
187
self.interface,
311
194
self.group.Commit()
312
195
def entry_group_state_changed(self, state, error):
313
196
"""Derived from the Avahi example code"""
314
logger.debug("Avahi entry group state change: %i", state)
197
logger.debug(u"Avahi state change: %i", state)
315
198
316
199
if state == avahi.ENTRY_GROUP_ESTABLISHED:
317
logger.debug("Zeroconf service established.")
200
logger.debug(u"Zeroconf service established.")
318
201
elif state == avahi.ENTRY_GROUP_COLLISION:
319
logger.info("Zeroconf service name collision.")
202
logger.warning(u"Zeroconf service name collision.")
320
203
self.rename()
321
204
elif state == avahi.ENTRY_GROUP_FAILURE:
322
logger.critical("Avahi: Error in group state changed %s",
205
logger.critical(u"Avahi: Error in group state changed %s",
323
206
unicode(error))
324
raise AvahiGroupError("State changed: %s"
207
raise AvahiGroupError(u"State changed: %s"
325
208
% unicode(error))
326
209
def cleanup(self):
327
210
"""Derived from the Avahi example code"""
328
211
if self.group is not None:
329
try:
330
self.group.Free()
331
except (dbus.exceptions.UnknownMethodException,
332
dbus.exceptions.DBusException):
333
pass
212
self.group.Free()
334
213
self.group = None
335
self.remove()
336
def server_state_changed(self, state, error=None):
214
def server_state_changed(self, state):
337
215
"""Derived from the Avahi example code"""
338
logger.debug("Avahi server state change: %i", state)
339
bad_states = { avahi.SERVER_INVALID:
340
"Zeroconf server invalid",
341
avahi.SERVER_REGISTERING: None,
342
avahi.SERVER_COLLISION:
343
"Zeroconf server name collision",
344
avahi.SERVER_FAILURE:
345
"Zeroconf server failure" }
346
if state in bad_states:
347
if bad_states[state] is not None:
348
if error is None:
349
logger.error(bad_states[state])
350
else:
351
logger.error(bad_states[state] + ": %r", error)
352
self.cleanup()
216
if state == avahi.SERVER_COLLISION:
217
logger.error(u"Zeroconf server name collision")
218
self.remove()
353
219
elif state == avahi.SERVER_RUNNING:
354
220
self.add()
355
else:
356
if error is None:
357
logger.debug("Unknown state: %r", state)
358
else:
359
logger.debug("Unknown state: %r: %r", state, error)
360
221
def activate(self):
361
222
"""Derived from the Avahi example code"""
362
223
if self.server is None:
363
224
self.server = dbus.Interface(
364
225
self.bus.get_object(avahi.DBUS_NAME,
365
avahi.DBUS_PATH_SERVER,
366
follow_name_owner_changes=True),
226
avahi.DBUS_PATH_SERVER),
367
227
avahi.DBUS_INTERFACE_SERVER)
368
self.server.connect_to_signal("StateChanged",
228
self.server.connect_to_signal(u"StateChanged",
369
229
self.server_state_changed)
370
230
self.server_state_changed(self.server.GetState())
371
231
372
class AvahiServiceToSyslog(AvahiService):
373
def rename(self):
374
"""Add the new name to the syslog messages"""
375
ret = AvahiService.rename(self)
376
syslogger.setFormatter(logging.Formatter
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
380
return ret
381
232
382
def timedelta_to_milliseconds(td):
383
"Convert a datetime.timedelta() to milliseconds"
384
return ((td.days * 24 * 60 * 60 * 1000)
385
+ (td.seconds * 1000)
386
+ (td.microseconds // 1000))
387
388
233
class Client(object):
389
234
"""A representation of a client host served by this server.
390
235
391
236
Attributes:
392
approved: bool(); 'None' if not yet approved/disapproved
393
approval_delay: datetime.timedelta(); Time to wait for approval
394
approval_duration: datetime.timedelta(); Duration of one approval
237
name: string; from the config file, used in log messages and
238
D-Bus identifiers
239
fingerprint: string (40 or 32 hexadecimal digits); used to
240
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
244
last_enabled: datetime.datetime(); (UTC)
245
enabled: bool()
246
last_checked_ok: datetime.datetime(); (UTC) or None
247
timeout: datetime.timedelta(); How long from last_checked_ok
248
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
395
251
checker: subprocess.Popen(); a running checker process used
396
252
to see if the client lives.
397
253
'None' if no process is running.
398
checker_callback_tag: a gobject event source tag, or None
399
checker_command: string; External command which is run to check
400
if client lives. %() expansions are done at
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
401
259
runtime with vars(self) as dict, so that for
402
260
instance %(name)s can be used in the command.
403
checker_initiator_tag: a gobject event source tag, or None
404
created: datetime.datetime(); (UTC) object creation
405
client_structure: Object describing what attributes a client has
406
and is used for storing the client at exit
407
261
current_checker_command: string; current running checker_command
408
disable_initiator_tag: a gobject event source tag, or None
409
enabled: bool()
410
fingerprint: string (40 or 32 hexadecimal digits); used to
411
uniquely identify the client
412
host: string; available for use by the checker command
413
interval: datetime.timedelta(); How often to start a new checker
414
last_approval_request: datetime.datetime(); (UTC) or None
415
last_checked_ok: datetime.datetime(); (UTC) or None
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
420
name: string; from the config file, used in log messages and
421
D-Bus identifiers
422
secret: bytestring; sent verbatim (over TLS) to client
423
timeout: datetime.timedelta(); How long from last_checked_ok
424
until this client is disabled
425
extended_timeout: extra long timeout when password has been sent
426
runtime_expansions: Allowed attributes for runtime expansion.
427
expires: datetime.datetime(); time (UTC) when a client will be
428
disabled, or None
262
approved_delay: datetime.timedelta(); Time to wait for approval
263
_approved: bool(); 'None' if not yet approved/disapproved
264
approved_duration: datetime.timedelta(); Duration of one approval
429
265
"""
430
266
431
runtime_expansions = ("approval_delay", "approval_duration",
432
"created", "enabled", "fingerprint",
433
"host", "interval", "last_checked_ok",
434
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
267
@staticmethod
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
445
273
446
274
def timeout_milliseconds(self):
447
275
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
449
450
def extended_timeout_milliseconds(self):
451
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
276
return self._timedelta_to_milliseconds(self.timeout)
453
277
454
278
def interval_milliseconds(self):
455
279
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
280
return self._timedelta_to_milliseconds(self.interval)
281
282
def approved_delay_milliseconds(self):
283
return self._timedelta_to_milliseconds(self.approved_delay)
457
284
458
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
461
@staticmethod
462
def config_parser(config):
463
""" Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above"""
466
settings = {}
467
for client_name in config.sections():
468
section = dict(config.items(client_name))
469
client = settings[client_name] = {}
470
471
client["host"] = section["host"]
472
# Reformat values from string types to Python types
473
client["approved_by_default"] = config.getboolean(
474
client_name, "approved_by_default")
475
client["enabled"] = config.getboolean(client_name, "enabled")
476
477
client["fingerprint"] = (section["fingerprint"].upper()
478
.replace(" ", ""))
479
if "secret" in section:
480
client["secret"] = section["secret"].decode("base64")
481
elif "secfile" in section:
482
with open(os.path.expanduser(os.path.expandvars
483
(section["secfile"])),
484
"rb") as secfile:
485
client["secret"] = secfile.read()
486
else:
487
raise TypeError("No secret or secfile for section %s"
488
% section)
489
client["timeout"] = string_to_delta(section["timeout"])
490
client["extended_timeout"] = string_to_delta(
491
section["extended_timeout"])
492
client["interval"] = string_to_delta(section["interval"])
493
client["approval_delay"] = string_to_delta(
494
section["approval_delay"])
495
client["approval_duration"] = string_to_delta(
496
section["approval_duration"])
497
client["checker_command"] = section["checker"]
498
client["last_approval_request"] = None
499
client["last_checked_ok"] = None
500
client["last_checker_status"] = None
501
if client["enabled"]:
502
client["last_enabled"] = datetime.datetime.utcnow()
503
client["expires"] = (datetime.datetime.utcnow()
504
+ client["timeout"])
505
else:
506
client["last_enabled"] = None
507
client["expires"] = None
508
509
return settings
510
511
512
def __init__(self, settings, name = None):
285
def __init__(self, name = None, disable_hook=None, config=None):
513
286
"""Note: the 'checker' key in 'config' sets the
514
287
'checker_command' attribute and *not* the 'checker'
515
288
attribute."""
516
289
self.name = name
517
# adding all client settings
518
for setting, value in settings.iteritems():
519
setattr(self, setting, value)
520
521
logger.debug("Creating client %r", self.name)
290
if config is None:
291
config = {}
292
logger.debug(u"Creating client %r", self.name)
522
293
# Uppercase and remove spaces from fingerprint for later
523
294
# comparison purposes with return value from the fingerprint()
524
295
# function
525
logger.debug(" Fingerprint: %s", self.fingerprint)
526
self.created = settings.get("created", datetime.datetime.utcnow())
527
528
# attributes specific for this server instance
296
self.fingerprint = (config[u"fingerprint"].upper()
297
.replace(u" ", u""))
298
logger.debug(u" Fingerprint: %s", self.fingerprint)
299
if u"secret" in config:
300
self.secret = config[u"secret"].decode(u"base64")
301
elif u"secfile" in config:
302
with open(os.path.expanduser(os.path.expandvars
303
(config[u"secfile"])),
304
"rb") as secfile:
305
self.secret = secfile.read()
306
else:
307
raise TypeError(u"No secret or secfile for client %s"
308
% self.name)
309
self.host = config.get(u"host", u"")
310
self.created = datetime.datetime.utcnow()
311
self.enabled = False
312
self.last_enabled = None
313
self.last_checked_ok = None
314
self.timeout = string_to_delta(config[u"timeout"])
315
self.interval = string_to_delta(config[u"interval"])
316
self.disable_hook = disable_hook
529
317
self.checker = None
530
318
self.checker_initiator_tag = None
531
319
self.disable_initiator_tag = None
532
320
self.checker_callback_tag = None
321
self.checker_command = config[u"checker"]
533
322
self.current_checker_command = None
534
self.approved = None
323
self.last_connect = None
324
self._approved = None
325
self.approved_by_default = config.get(u"approved_by_default",
326
True)
535
327
self.approvals_pending = 0
536
self.changedstate = (multiprocessing_manager
537
.Condition(multiprocessing_manager
538
.Lock()))
539
self.client_structure = [attr for attr in
540
self.__dict__.iterkeys()
541
if not attr.startswith("_")]
542
self.client_structure.append("client_structure")
543
544
for name, t in inspect.getmembers(type(self),
545
lambda obj:
546
isinstance(obj,
547
property)):
548
if not name.startswith("_"):
549
self.client_structure.append(name)
328
self.approved_delay = string_to_delta(
329
config[u"approved_delay"])
330
self.approved_duration = string_to_delta(
331
config[u"approved_duration"])
332
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
550
333
551
# Send notice to process children that client state has changed
552
334
def send_changedstate(self):
553
with self.changedstate:
554
self.changedstate.notify_all()
555
335
self.changedstate.acquire()
336
self.changedstate.notify_all()
337
self.changedstate.release()
338
556
339
def enable(self):
557
340
"""Start this client's checker and timeout hooks"""
558
if getattr(self, "enabled", False):
341
if getattr(self, u"enabled", False):
559
342
# Already enabled
560
343
return
561
344
self.send_changedstate()
562
self.expires = datetime.datetime.utcnow() + self.timeout
563
self.enabled = True
564
345
self.last_enabled = datetime.datetime.utcnow()
565
self.init_checker()
566
567
def disable(self, quiet=True):
568
"""Disable this client."""
569
if not getattr(self, "enabled", False):
570
return False
571
if not quiet:
572
self.send_changedstate()
573
if not quiet:
574
logger.info("Disabling client %s", self.name)
575
if getattr(self, "disable_initiator_tag", False):
576
gobject.source_remove(self.disable_initiator_tag)
577
self.disable_initiator_tag = None
578
self.expires = None
579
if getattr(self, "checker_initiator_tag", False):
580
gobject.source_remove(self.checker_initiator_tag)
581
self.checker_initiator_tag = None
582
self.stop_checker()
583
self.enabled = False
584
# Do not run this again if called by a gobject.timeout_add
585
return False
586
587
def __del__(self):
588
self.disable()
589
590
def init_checker(self):
591
346
# Schedule a new checker to be started an 'interval' from now,
592
347
# and every interval from then on.
593
348
self.checker_initiator_tag = (gobject.timeout_add
597
352
self.disable_initiator_tag = (gobject.timeout_add
598
353
(self.timeout_milliseconds(),
599
354
self.disable))
355
self.enabled = True
600
356
# Also start a new checker *right now*.
601
357
self.start_checker()
602
358
359
def disable(self, quiet=True):
360
"""Disable this client."""
361
if not getattr(self, "enabled", False):
362
return False
363
if not quiet:
364
self.send_changedstate()
365
if not quiet:
366
logger.info(u"Disabling client %s", self.name)
367
if getattr(self, u"disable_initiator_tag", False):
368
gobject.source_remove(self.disable_initiator_tag)
369
self.disable_initiator_tag = None
370
if getattr(self, u"checker_initiator_tag", False):
371
gobject.source_remove(self.checker_initiator_tag)
372
self.checker_initiator_tag = None
373
self.stop_checker()
374
if self.disable_hook:
375
self.disable_hook(self)
376
self.enabled = False
377
# Do not run this again if called by a gobject.timeout_add
378
return False
379
380
def __del__(self):
381
self.disable_hook = None
382
self.disable()
383
603
384
def checker_callback(self, pid, condition, command):
604
385
"""The checker has completed, so take appropriate actions."""
605
386
self.checker_callback_tag = None
606
387
self.checker = None
607
388
if os.WIFEXITED(condition):
608
self.last_checker_status = os.WEXITSTATUS(condition)
609
if self.last_checker_status == 0:
610
logger.info("Checker for %(name)s succeeded",
389
exitstatus = os.WEXITSTATUS(condition)
390
if exitstatus == 0:
391
logger.info(u"Checker for %(name)s succeeded",
611
392
vars(self))
612
393
self.checked_ok()
613
394
else:
614
logger.info("Checker for %(name)s failed",
395
logger.info(u"Checker for %(name)s failed",
615
396
vars(self))
616
397
else:
617
self.last_checker_status = -1
618
logger.warning("Checker for %(name)s crashed?",
398
logger.warning(u"Checker for %(name)s crashed?",
619
399
vars(self))
620
400
621
def checked_ok(self, timeout=None):
401
def checked_ok(self):
622
402
"""Bump up the timeout for this client.
623
403
624
404
This should only be called when the client has been seen,
625
405
alive and well.
626
406
"""
627
if timeout is None:
628
timeout = self.timeout
629
407
self.last_checked_ok = datetime.datetime.utcnow()
630
if self.disable_initiator_tag is not None:
631
gobject.source_remove(self.disable_initiator_tag)
632
if getattr(self, "enabled", False):
633
self.disable_initiator_tag = (gobject.timeout_add
634
(timedelta_to_milliseconds
635
(timeout), self.disable))
636
self.expires = datetime.datetime.utcnow() + timeout
637
638
def need_approval(self):
639
self.last_approval_request = datetime.datetime.utcnow()
408
gobject.source_remove(self.disable_initiator_tag)
409
self.disable_initiator_tag = (gobject.timeout_add
410
(self.timeout_milliseconds(),
411
self.disable))
640
412
641
413
def start_checker(self):
642
414
"""Start a new checker subprocess if one is not running.
655
427
# If a checker exists, make sure it is not a zombie
656
428
try:
657
429
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
658
except (AttributeError, OSError) as error:
430
except (AttributeError, OSError), error:
659
431
if (isinstance(error, OSError)
660
432
and error.errno != errno.ECHILD):
661
433
raise error
662
434
else:
663
435
if pid:
664
logger.warning("Checker was a zombie")
436
logger.warning(u"Checker was a zombie")
665
437
gobject.source_remove(self.checker_callback_tag)
666
438
self.checker_callback(pid, status,
667
439
self.current_checker_command)
672
444
command = self.checker_command % self.host
673
445
except TypeError:
674
446
# Escape attributes for the shell
675
escaped_attrs = dict(
676
(attr,
677
re.escape(unicode(str(getattr(self, attr, "")),
678
errors=
679
'replace')))
680
for attr in
681
self.runtime_expansions)
682
447
escaped_attrs = dict((key,
448
re.escape(unicode(str(val),
449
errors=
450
u'replace')))
451
for key, val in
452
vars(self).iteritems())
683
453
try:
684
454
command = self.checker_command % escaped_attrs
685
except TypeError as error:
686
logger.error('Could not format string "%s":'
687
' %s', self.checker_command, error)
455
except TypeError, error:
456
logger.error(u'Could not format string "%s":'
457
u' %s', self.checker_command, error)
688
458
return True # Try again later
689
459
self.current_checker_command = command
690
460
try:
691
logger.info("Starting checker %r for %s",
461
logger.info(u"Starting checker %r for %s",
692
462
command, self.name)
693
463
# We don't need to redirect stdout and stderr, since
694
464
# in normal mode, that is already done by daemon(),
696
466
# always replaced by /dev/null.)
697
467
self.checker = subprocess.Popen(command,
698
468
close_fds=True,
699
shell=True, cwd="/")
469
shell=True, cwd=u"/")
700
470
self.checker_callback_tag = (gobject.child_watch_add
701
471
(self.checker.pid,
702
472
self.checker_callback,
707
477
if pid:
708
478
gobject.source_remove(self.checker_callback_tag)
709
479
self.checker_callback(pid, status, command)
710
except OSError as error:
711
logger.error("Failed to start subprocess: %s",
480
except OSError, error:
481
logger.error(u"Failed to start subprocess: %s",
712
482
error)
713
483
# Re-run this periodically if run by gobject.timeout_add
714
484
return True
718
488
if self.checker_callback_tag:
719
489
gobject.source_remove(self.checker_callback_tag)
720
490
self.checker_callback_tag = None
721
if getattr(self, "checker", None) is None:
491
if getattr(self, u"checker", None) is None:
722
492
return
723
logger.debug("Stopping checker for %(name)s", vars(self))
493
logger.debug(u"Stopping checker for %(name)s", vars(self))
724
494
try:
725
495
os.kill(self.checker.pid, signal.SIGTERM)
726
496
#time.sleep(0.5)
727
497
#if self.checker.poll() is None:
728
498
# os.kill(self.checker.pid, signal.SIGKILL)
729
except OSError as error:
499
except OSError, error:
730
500
if error.errno != errno.ESRCH: # No such process
731
501
raise
732
502
self.checker = None
733
503
734
735
def dbus_service_property(dbus_interface, signature="v",
736
access="readwrite", byte_arrays=False):
504
def dbus_service_property(dbus_interface, signature=u"v",
505
access=u"readwrite", byte_arrays=False):
737
506
"""Decorators for marking methods of a DBusObjectWithProperties to
738
507
become properties on the D-Bus.
739
508
746
515
"""
747
516
# Encoding deeply encoded byte arrays is not supported yet by the
748
517
# "Set" method, so we fail early here:
749
if byte_arrays and signature != "ay":
750
raise ValueError("Byte arrays not supported for non-'ay'"
751
" signature %r" % signature)
518
if byte_arrays and signature != u"ay":
519
raise ValueError(u"Byte arrays not supported for non-'ay'"
520
u" signature %r" % signature)
752
521
def decorator(func):
753
522
func._dbus_is_property = True
754
523
func._dbus_interface = dbus_interface
755
524
func._dbus_signature = signature
756
525
func._dbus_access = access
757
526
func._dbus_name = func.__name__
758
if func._dbus_name.endswith("_dbus_property"):
527
if func._dbus_name.endswith(u"_dbus_property"):
759
528
func._dbus_name = func._dbus_name[:-14]
760
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
529
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
761
530
return func
762
531
return decorator
763
532
783
552
784
553
class DBusObjectWithProperties(dbus.service.Object):
785
554
"""A D-Bus object with properties.
786
555
787
556
Classes inheriting from this can use the dbus_service_property
788
557
decorator to expose methods as D-Bus properties. It exposes the
789
558
standard Get(), Set(), and GetAll() methods on the D-Bus.
791
560
792
561
@staticmethod
793
562
def _is_dbus_property(obj):
794
return getattr(obj, "_dbus_is_property", False)
563
return getattr(obj, u"_dbus_is_property", False)
795
564
796
565
def _get_all_dbus_properties(self):
797
566
"""Returns a generator of (name, attribute) pairs
798
567
"""
799
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
800
for cls in self.__class__.__mro__
568
return ((prop._dbus_name, prop)
801
569
for name, prop in
802
inspect.getmembers(cls, self._is_dbus_property))
570
inspect.getmembers(self, self._is_dbus_property))
803
571
804
572
def _get_dbus_property(self, interface_name, property_name):
805
573
"""Returns a bound method if one exists which is a D-Bus
806
574
property with the specified name and interface.
807
575
"""
808
for cls in self.__class__.__mro__:
809
for name, value in (inspect.getmembers
810
(cls, self._is_dbus_property)):
811
if (value._dbus_name == property_name
812
and value._dbus_interface == interface_name):
813
return value.__get__(self)
814
576
for name in (property_name,
577
property_name + u"_dbus_property"):
578
prop = getattr(self, name, None)
579
if (prop is None
580
or not self._is_dbus_property(prop)
581
or prop._dbus_name != property_name
582
or (interface_name and prop._dbus_interface
583
and interface_name != prop._dbus_interface)):
584
continue
585
return prop
815
586
# No such property
816
raise DBusPropertyNotFound(self.dbus_object_path + ":"
817
+ interface_name + "."
587
raise DBusPropertyNotFound(self.dbus_object_path + u":"
588
+ interface_name + u"."
818
589
+ property_name)
819
590
820
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
821
out_signature="v")
591
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
592
out_signature=u"v")
822
593
def Get(self, interface_name, property_name):
823
594
"""Standard D-Bus property Get() method, see D-Bus standard.
824
595
"""
825
596
prop = self._get_dbus_property(interface_name, property_name)
826
if prop._dbus_access == "write":
597
if prop._dbus_access == u"write":
827
598
raise DBusPropertyAccessException(property_name)
828
599
value = prop()
829
if not hasattr(value, "variant_level"):
600
if not hasattr(value, u"variant_level"):
830
601
return value
831
602
return type(value)(value, variant_level=value.variant_level+1)
832
603
833
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
604
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
834
605
def Set(self, interface_name, property_name, value):
835
606
"""Standard D-Bus property Set() method, see D-Bus standard.
836
607
"""
837
608
prop = self._get_dbus_property(interface_name, property_name)
838
if prop._dbus_access == "read":
609
if prop._dbus_access == u"read":
839
610
raise DBusPropertyAccessException(property_name)
840
if prop._dbus_get_args_options["byte_arrays"]:
611
if prop._dbus_get_args_options[u"byte_arrays"]:
841
612
# The byte_arrays option is not supported yet on
842
613
# signatures other than "ay".
843
if prop._dbus_signature != "ay":
614
if prop._dbus_signature != u"ay":
844
615
raise ValueError
845
616
value = dbus.ByteArray(''.join(unichr(byte)
846
617
for byte in value))
847
618
prop(value)
848
619
849
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
850
out_signature="a{sv}")
620
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
621
out_signature=u"a{sv}")
851
622
def GetAll(self, interface_name):
852
623
"""Standard D-Bus property GetAll() method, see D-Bus
853
624
standard.
854
625
855
626
Note: Will not include properties with access="write".
856
627
"""
857
properties = {}
628
all = {}
858
629
for name, prop in self._get_all_dbus_properties():
859
630
if (interface_name
860
631
and interface_name != prop._dbus_interface):
861
632
# Interface non-empty but did not match
862
633
continue
863
634
# Ignore write-only properties
864
if prop._dbus_access == "write":
635
if prop._dbus_access == u"write":
865
636
continue
866
637
value = prop()
867
if not hasattr(value, "variant_level"):
868
properties[name] = value
638
if not hasattr(value, u"variant_level"):
639
all[name] = value
869
640
continue
870
properties[name] = type(value)(value, variant_level=
871
value.variant_level+1)
872
return dbus.Dictionary(properties, signature="sv")
641
all[name] = type(value)(value, variant_level=
642
value.variant_level+1)
643
return dbus.Dictionary(all, signature=u"sv")
873
644
874
645
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
875
out_signature="s",
646
out_signature=u"s",
876
647
path_keyword='object_path',
877
648
connection_keyword='connection')
878
649
def Introspect(self, object_path, connection):
883
654
try:
884
655
document = xml.dom.minidom.parseString(xmlstring)
885
656
def make_tag(document, name, prop):
886
e = document.createElement("property")
887
e.setAttribute("name", name)
888
e.setAttribute("type", prop._dbus_signature)
889
e.setAttribute("access", prop._dbus_access)
657
e = document.createElement(u"property")
658
e.setAttribute(u"name", name)
659
e.setAttribute(u"type", prop._dbus_signature)
660
e.setAttribute(u"access", prop._dbus_access)
890
661
return e
891
for if_tag in document.getElementsByTagName("interface"):
662
for if_tag in document.getElementsByTagName(u"interface"):
892
663
for tag in (make_tag(document, name, prop)
893
664
for name, prop
894
665
in self._get_all_dbus_properties()
895
666
if prop._dbus_interface
896
== if_tag.getAttribute("name")):
667
== if_tag.getAttribute(u"name")):
897
668
if_tag.appendChild(tag)
898
669
# Add the names to the return values for the
899
670
# "org.freedesktop.DBus.Properties" methods
900
if (if_tag.getAttribute("name")
901
== "org.freedesktop.DBus.Properties"):
902
for cn in if_tag.getElementsByTagName("method"):
903
if cn.getAttribute("name") == "Get":
904
for arg in cn.getElementsByTagName("arg"):
905
if (arg.getAttribute("direction")
906
== "out"):
907
arg.setAttribute("name", "value")
908
elif cn.getAttribute("name") == "GetAll":
909
for arg in cn.getElementsByTagName("arg"):
910
if (arg.getAttribute("direction")
911
== "out"):
912
arg.setAttribute("name", "props")
913
xmlstring = document.toxml("utf-8")
671
if (if_tag.getAttribute(u"name")
672
== u"org.freedesktop.DBus.Properties"):
673
for cn in if_tag.getElementsByTagName(u"method"):
674
if cn.getAttribute(u"name") == u"Get":
675
for arg in cn.getElementsByTagName(u"arg"):
676
if (arg.getAttribute(u"direction")
677
== u"out"):
678
arg.setAttribute(u"name", u"value")
679
elif cn.getAttribute(u"name") == u"GetAll":
680
for arg in cn.getElementsByTagName(u"arg"):
681
if (arg.getAttribute(u"direction")
682
== u"out"):
683
arg.setAttribute(u"name", u"props")
684
xmlstring = document.toxml(u"utf-8")
914
685
document.unlink()
915
686
except (AttributeError, xml.dom.DOMException,
916
xml.parsers.expat.ExpatError) as error:
917
logger.error("Failed to override Introspection method",
687
xml.parsers.expat.ExpatError), error:
688
logger.error(u"Failed to override Introspection method",
918
689
error)
919
690
return xmlstring
920
691
921
692
922
def datetime_to_dbus (dt, variant_level=0):
923
"""Convert a UTC datetime.datetime() to a D-Bus type."""
924
if dt is None:
925
return dbus.String("", variant_level = variant_level)
926
return dbus.String(dt.isoformat(),
927
variant_level=variant_level)
928
929
930
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
931
.__metaclass__):
932
"""Applied to an empty subclass of a D-Bus object, this metaclass
933
will add additional D-Bus attributes matching a certain pattern.
934
"""
935
def __new__(mcs, name, bases, attr):
936
# Go through all the base classes which could have D-Bus
937
# methods, signals, or properties in them
938
for base in (b for b in bases
939
if issubclass(b, dbus.service.Object)):
940
# Go though all attributes of the base class
941
for attrname, attribute in inspect.getmembers(base):
942
# Ignore non-D-Bus attributes, and D-Bus attributes
943
# with the wrong interface name
944
if (not hasattr(attribute, "_dbus_interface")
945
or not attribute._dbus_interface
946
.startswith("se.recompile.Mandos")):
947
continue
948
# Create an alternate D-Bus interface name based on
949
# the current name
950
alt_interface = (attribute._dbus_interface
951
.replace("se.recompile.Mandos",
952
"se.bsnet.fukt.Mandos"))
953
# Is this a D-Bus signal?
954
if getattr(attribute, "_dbus_is_signal", False):
955
# Extract the original non-method function by
956
# black magic
957
nonmethod_func = (dict(
958
zip(attribute.func_code.co_freevars,
959
attribute.__closure__))["func"]
960
.cell_contents)
961
# Create a new, but exactly alike, function
962
# object, and decorate it to be a new D-Bus signal
963
# with the alternate D-Bus interface name
964
new_function = (dbus.service.signal
965
(alt_interface,
966
attribute._dbus_signature)
967
(types.FunctionType(
968
nonmethod_func.func_code,
969
nonmethod_func.func_globals,
970
nonmethod_func.func_name,
971
nonmethod_func.func_defaults,
972
nonmethod_func.func_closure)))
973
# Define a creator of a function to call both the
974
# old and new functions, so both the old and new
975
# signals gets sent when the function is called
976
def fixscope(func1, func2):
977
"""This function is a scope container to pass
978
func1 and func2 to the "call_both" function
979
outside of its arguments"""
980
def call_both(*args, **kwargs):
981
"""This function will emit two D-Bus
982
signals by calling func1 and func2"""
983
func1(*args, **kwargs)
984
func2(*args, **kwargs)
985
return call_both
986
# Create the "call_both" function and add it to
987
# the class
988
attr[attrname] = fixscope(attribute,
989
new_function)
990
# Is this a D-Bus method?
991
elif getattr(attribute, "_dbus_is_method", False):
992
# Create a new, but exactly alike, function
993
# object. Decorate it to be a new D-Bus method
994
# with the alternate D-Bus interface name. Add it
995
# to the class.
996
attr[attrname] = (dbus.service.method
997
(alt_interface,
998
attribute._dbus_in_signature,
999
attribute._dbus_out_signature)
1000
(types.FunctionType
1001
(attribute.func_code,
1002
attribute.func_globals,
1003
attribute.func_name,
1004
attribute.func_defaults,
1005
attribute.func_closure)))
1006
# Is this a D-Bus property?
1007
elif getattr(attribute, "_dbus_is_property", False):
1008
# Create a new, but exactly alike, function
1009
# object, and decorate it to be a new D-Bus
1010
# property with the alternate D-Bus interface
1011
# name. Add it to the class.
1012
attr[attrname] = (dbus_service_property
1013
(alt_interface,
1014
attribute._dbus_signature,
1015
attribute._dbus_access,
1016
attribute
1017
._dbus_get_args_options
1018
["byte_arrays"])
1019
(types.FunctionType
1020
(attribute.func_code,
1021
attribute.func_globals,
1022
attribute.func_name,
1023
attribute.func_defaults,
1024
attribute.func_closure)))
1025
return type.__new__(mcs, name, bases, attr)
1026
1027
1028
693
class ClientDBus(Client, DBusObjectWithProperties):
1029
694
"""A Client class using D-Bus
1030
695
1032
697
dbus_object_path: dbus.ObjectPath
1033
698
bus: dbus.SystemBus()
1034
699
"""
1035
1036
runtime_expansions = (Client.runtime_expansions
1037
+ ("dbus_object_path",))
1038
1039
700
# dbus.service.Object doesn't use super(), so we can't either.
1040
701
1041
702
def __init__(self, bus = None, *args, **kwargs):
703
self._approvals_pending = 0
1042
704
self.bus = bus
1043
705
Client.__init__(self, *args, **kwargs)
1044
self._approvals_pending = 0
1045
1046
self._approvals_pending = 0
1047
706
# Only now, when this client is initialized, can it show up on
1048
707
# the D-Bus
1049
client_object_name = unicode(self.name).translate(
1050
{ord("."): ord("_"),
1051
ord("-"): ord("_")})
1052
708
self.dbus_object_path = (dbus.ObjectPath
1053
("/clients/" + client_object_name))
709
(u"/clients/"
710
+ self.name.replace(u".", u"_")))
1054
711
DBusObjectWithProperties.__init__(self, self.bus,
1055
712
self.dbus_object_path)
1056
1057
def notifychangeproperty(transform_func,
1058
dbus_name, type_func=lambda x: x,
1059
variant_level=1):
1060
""" Modify a variable so that it's a property which announces
1061
its changes to DBus.
1062
1063
transform_fun: Function that takes a value and a variant_level
1064
and transforms it to a D-Bus type.
1065
dbus_name: D-Bus name of the variable
1066
type_func: Function that transform the value before sending it
1067
to the D-Bus. Default: no transform
1068
variant_level: D-Bus variant level. Default: 1
1069
"""
1070
attrname = "_{0}".format(dbus_name)
1071
def setter(self, value):
1072
if hasattr(self, "dbus_object_path"):
1073
if (not hasattr(self, attrname) or
1074
type_func(getattr(self, attrname, None))
1075
!= type_func(value)):
1076
dbus_value = transform_func(type_func(value),
1077
variant_level
1078
=variant_level)
1079
self.PropertyChanged(dbus.String(dbus_name),
1080
dbus_value)
1081
setattr(self, attrname, value)
1082
1083
return property(lambda self: getattr(self, attrname), setter)
1084
1085
1086
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1087
approvals_pending = notifychangeproperty(dbus.Boolean,
1088
"ApprovalPending",
1089
type_func = bool)
1090
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1091
last_enabled = notifychangeproperty(datetime_to_dbus,
1092
"LastEnabled")
1093
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1094
type_func = lambda checker:
1095
checker is not None)
1096
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1097
"LastCheckedOK")
1098
last_approval_request = notifychangeproperty(
1099
datetime_to_dbus, "LastApprovalRequest")
1100
approved_by_default = notifychangeproperty(dbus.Boolean,
1101
"ApprovedByDefault")
1102
approval_delay = notifychangeproperty(dbus.UInt64,
1103
"ApprovalDelay",
1104
type_func =
1105
timedelta_to_milliseconds)
1106
approval_duration = notifychangeproperty(
1107
dbus.UInt64, "ApprovalDuration",
1108
type_func = timedelta_to_milliseconds)
1109
host = notifychangeproperty(dbus.String, "Host")
1110
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1111
type_func =
1112
timedelta_to_milliseconds)
1113
extended_timeout = notifychangeproperty(
1114
dbus.UInt64, "ExtendedTimeout",
1115
type_func = timedelta_to_milliseconds)
1116
interval = notifychangeproperty(dbus.UInt64,
1117
"Interval",
1118
type_func =
1119
timedelta_to_milliseconds)
1120
checker_command = notifychangeproperty(dbus.String, "Checker")
1121
1122
del notifychangeproperty
713
714
def _get_approvals_pending(self):
715
return self._approvals_pending
716
def _set_approvals_pending(self, value):
717
old_value = self._approvals_pending
718
self._approvals_pending = value
719
bval = bool(value)
720
if (hasattr(self, "dbus_object_path")
721
and bval is not bool(old_value)):
722
dbus_bool = dbus.Boolean(bval, variant_level=1)
723
self.PropertyChanged(dbus.String(u"approved_pending"),
724
dbus_bool)
725
726
approvals_pending = property(_get_approvals_pending,
727
_set_approvals_pending)
728
del _get_approvals_pending, _set_approvals_pending
729
730
@staticmethod
731
def _datetime_to_dbus(dt, variant_level=0):
732
"""Convert a UTC datetime.datetime() to a D-Bus type."""
733
return dbus.String(dt.isoformat(),
734
variant_level=variant_level)
735
736
def enable(self):
737
oldstate = getattr(self, u"enabled", False)
738
r = Client.enable(self)
739
if oldstate != self.enabled:
740
# Emit D-Bus signals
741
self.PropertyChanged(dbus.String(u"enabled"),
742
dbus.Boolean(True, variant_level=1))
743
self.PropertyChanged(
744
dbus.String(u"last_enabled"),
745
self._datetime_to_dbus(self.last_enabled,
746
variant_level=1))
747
return r
748
749
def disable(self, quiet = False):
750
oldstate = getattr(self, u"enabled", False)
751
r = Client.disable(self, quiet=quiet)
752
if not quiet and oldstate != self.enabled:
753
# Emit D-Bus signal
754
self.PropertyChanged(dbus.String(u"enabled"),
755
dbus.Boolean(False, variant_level=1))
756
return r
1123
757
1124
758
def __del__(self, *args, **kwargs):
1125
759
try:
1126
760
self.remove_from_connection()
1127
761
except LookupError:
1128
762
pass
1129
if hasattr(DBusObjectWithProperties, "__del__"):
763
if hasattr(DBusObjectWithProperties, u"__del__"):
1130
764
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1131
765
Client.__del__(self, *args, **kwargs)
1132
766
1134
768
*args, **kwargs):
1135
769
self.checker_callback_tag = None
1136
770
self.checker = None
771
# Emit D-Bus signal
772
self.PropertyChanged(dbus.String(u"checker_running"),
773
dbus.Boolean(False, variant_level=1))
1137
774
if os.WIFEXITED(condition):
1138
775
exitstatus = os.WEXITSTATUS(condition)
1139
776
# Emit D-Bus signal
1149
786
return Client.checker_callback(self, pid, condition, command,
1150
787
*args, **kwargs)
1151
788
789
def checked_ok(self, *args, **kwargs):
790
r = Client.checked_ok(self, *args, **kwargs)
791
# Emit D-Bus signal
792
self.PropertyChanged(
793
dbus.String(u"last_checked_ok"),
794
(self._datetime_to_dbus(self.last_checked_ok,
795
variant_level=1)))
796
return r
797
1152
798
def start_checker(self, *args, **kwargs):
1153
799
old_checker = self.checker
1154
800
if self.checker is not None:
1161
807
and old_checker_pid != self.checker.pid):
1162
808
# Emit D-Bus signal
1163
809
self.CheckerStarted(self.current_checker_command)
810
self.PropertyChanged(
811
dbus.String(u"checker_running"),
812
dbus.Boolean(True, variant_level=1))
1164
813
return r
1165
814
815
def stop_checker(self, *args, **kwargs):
816
old_checker = getattr(self, u"checker", None)
817
r = Client.stop_checker(self, *args, **kwargs)
818
if (old_checker is not None
819
and getattr(self, u"checker", None) is None):
820
self.PropertyChanged(dbus.String(u"checker_running"),
821
dbus.Boolean(False, variant_level=1))
822
return r
823
1166
824
def _reset_approved(self):
1167
self.approved = None
825
self._approved = None
1168
826
return False
1169
827
1170
828
def approve(self, value=True):
1171
829
self.send_changedstate()
1172
self.approved = value
1173
gobject.timeout_add(timedelta_to_milliseconds
1174
(self.approval_duration),
830
self._approved = value
831
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
1175
832
self._reset_approved)
1176
833
1177
834
1178
835
## D-Bus methods, signals & properties
1179
_interface = "se.recompile.Mandos.Client"
836
_interface = u"se.bsnet.fukt.Mandos.Client"
1180
837
1181
838
## Signals
1182
839
1183
840
# CheckerCompleted - signal
1184
@dbus.service.signal(_interface, signature="nxs")
841
@dbus.service.signal(_interface, signature=u"nxs")
1185
842
def CheckerCompleted(self, exitcode, waitstatus, command):
1186
843
"D-Bus signal"
1187
844
pass
1188
845
1189
846
# CheckerStarted - signal
1190
@dbus.service.signal(_interface, signature="s")
847
@dbus.service.signal(_interface, signature=u"s")
1191
848
def CheckerStarted(self, command):
1192
849
"D-Bus signal"
1193
850
pass
1194
851
1195
852
# PropertyChanged - signal
1196
@dbus.service.signal(_interface, signature="sv")
853
@dbus.service.signal(_interface, signature=u"sv")
1197
854
def PropertyChanged(self, property, value):
1198
855
"D-Bus signal"
1199
856
pass
1208
865
pass
1209
866
1210
867
# Rejected - signal
1211
@dbus.service.signal(_interface, signature="s")
868
@dbus.service.signal(_interface, signature=u"s")
1212
869
def Rejected(self, reason):
1213
870
"D-Bus signal"
1214
871
pass
1215
872
1216
873
# NeedApproval - signal
1217
@dbus.service.signal(_interface, signature="tb")
874
@dbus.service.signal(_interface, signature=u"db")
1218
875
def NeedApproval(self, timeout, default):
1219
876
"D-Bus signal"
1220
return self.need_approval()
1221
1222
# NeRwequest - signal
1223
@dbus.service.signal(_interface, signature="s")
1224
def NewRequest(self, ip):
1225
"""D-Bus signal
1226
Is sent after a client request a password.
1227
"""
1228
877
pass
1229
878
1230
879
## Methods
1231
880
1232
881
# Approve - method
1233
@dbus.service.method(_interface, in_signature="b")
882
@dbus.service.method(_interface, in_signature=u"b")
1234
883
def Approve(self, value):
1235
884
self.approve(value)
1236
885
1237
886
# CheckedOK - method
1238
887
@dbus.service.method(_interface)
1239
888
def CheckedOK(self):
1240
self.checked_ok()
889
return self.checked_ok()
1241
890
1242
891
# Enable - method
1243
892
@dbus.service.method(_interface)
1264
913
1265
914
## Properties
1266
915
1267
# ApprovalPending - property
1268
@dbus_service_property(_interface, signature="b", access="read")
1269
def ApprovalPending_dbus_property(self):
916
# approved_pending - property
917
@dbus_service_property(_interface, signature=u"b", access=u"read")
918
def approved_pending_dbus_property(self):
1270
919
return dbus.Boolean(bool(self.approvals_pending))
1271
920
1272
# ApprovedByDefault - property
1273
@dbus_service_property(_interface, signature="b",
1274
access="readwrite")
1275
def ApprovedByDefault_dbus_property(self, value=None):
1276
if value is None: # get
1277
return dbus.Boolean(self.approved_by_default)
1278
self.approved_by_default = bool(value)
1279
1280
# ApprovalDelay - property
1281
@dbus_service_property(_interface, signature="t",
1282
access="readwrite")
1283
def ApprovalDelay_dbus_property(self, value=None):
1284
if value is None: # get
1285
return dbus.UInt64(self.approval_delay_milliseconds())
1286
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1287
1288
# ApprovalDuration - property
1289
@dbus_service_property(_interface, signature="t",
1290
access="readwrite")
1291
def ApprovalDuration_dbus_property(self, value=None):
1292
if value is None: # get
1293
return dbus.UInt64(timedelta_to_milliseconds(
1294
self.approval_duration))
1295
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1296
1297
# Name - property
1298
@dbus_service_property(_interface, signature="s", access="read")
1299
def Name_dbus_property(self):
921
# approved_by_default - property
922
@dbus_service_property(_interface, signature=u"b",
923
access=u"readwrite")
924
def approved_by_default_dbus_property(self):
925
return dbus.Boolean(self.approved_by_default)
926
927
# approved_delay - property
928
@dbus_service_property(_interface, signature=u"t",
929
access=u"readwrite")
930
def approved_delay_dbus_property(self):
931
return dbus.UInt64(self.approved_delay_milliseconds())
932
933
# approved_duration - property
934
@dbus_service_property(_interface, signature=u"t",
935
access=u"readwrite")
936
def approved_duration_dbus_property(self):
937
return dbus.UInt64(self._timedelta_to_milliseconds(
938
self.approved_duration))
939
940
# name - property
941
@dbus_service_property(_interface, signature=u"s", access=u"read")
942
def name_dbus_property(self):
1300
943
return dbus.String(self.name)
1301
944
1302
# Fingerprint - property
1303
@dbus_service_property(_interface, signature="s", access="read")
1304
def Fingerprint_dbus_property(self):
945
# fingerprint - property
946
@dbus_service_property(_interface, signature=u"s", access=u"read")
947
def fingerprint_dbus_property(self):
1305
948
return dbus.String(self.fingerprint)
1306
949
1307
# Host - property
1308
@dbus_service_property(_interface, signature="s",
1309
access="readwrite")
1310
def Host_dbus_property(self, value=None):
950
# host - property
951
@dbus_service_property(_interface, signature=u"s",
952
access=u"readwrite")
953
def host_dbus_property(self, value=None):
1311
954
if value is None: # get
1312
955
return dbus.String(self.host)
1313
self.host = unicode(value)
1314
1315
# Created - property
1316
@dbus_service_property(_interface, signature="s", access="read")
1317
def Created_dbus_property(self):
1318
return datetime_to_dbus(self.created)
1319
1320
# LastEnabled - property
1321
@dbus_service_property(_interface, signature="s", access="read")
1322
def LastEnabled_dbus_property(self):
1323
return datetime_to_dbus(self.last_enabled)
1324
1325
# Enabled - property
1326
@dbus_service_property(_interface, signature="b",
1327
access="readwrite")
1328
def Enabled_dbus_property(self, value=None):
956
self.host = value
957
# Emit D-Bus signal
958
self.PropertyChanged(dbus.String(u"host"),
959
dbus.String(value, variant_level=1))
960
961
# created - property
962
@dbus_service_property(_interface, signature=u"s", access=u"read")
963
def created_dbus_property(self):
964
return dbus.String(self._datetime_to_dbus(self.created))
965
966
# last_enabled - property
967
@dbus_service_property(_interface, signature=u"s", access=u"read")
968
def last_enabled_dbus_property(self):
969
if self.last_enabled is None:
970
return dbus.String(u"")
971
return dbus.String(self._datetime_to_dbus(self.last_enabled))
972
973
# enabled - property
974
@dbus_service_property(_interface, signature=u"b",
975
access=u"readwrite")
976
def enabled_dbus_property(self, value=None):
1329
977
if value is None: # get
1330
978
return dbus.Boolean(self.enabled)
1331
979
if value:
1333
981
else:
1334
982
self.disable()
1335
983
1336
# LastCheckedOK - property
1337
@dbus_service_property(_interface, signature="s",
1338
access="readwrite")
1339
def LastCheckedOK_dbus_property(self, value=None):
984
# last_checked_ok - property
985
@dbus_service_property(_interface, signature=u"s",
986
access=u"readwrite")
987
def last_checked_ok_dbus_property(self, value=None):
1340
988
if value is not None:
1341
989
self.checked_ok()
1342
990
return
1343
return datetime_to_dbus(self.last_checked_ok)
1344
1345
# Expires - property
1346
@dbus_service_property(_interface, signature="s", access="read")
1347
def Expires_dbus_property(self):
1348
return datetime_to_dbus(self.expires)
1349
1350
# LastApprovalRequest - property
1351
@dbus_service_property(_interface, signature="s", access="read")
1352
def LastApprovalRequest_dbus_property(self):
1353
return datetime_to_dbus(self.last_approval_request)
1354
1355
# Timeout - property
1356
@dbus_service_property(_interface, signature="t",
1357
access="readwrite")
1358
def Timeout_dbus_property(self, value=None):
991
if self.last_checked_ok is None:
992
return dbus.String(u"")
993
return dbus.String(self._datetime_to_dbus(self
994
.last_checked_ok))
995
996
# timeout - property
997
@dbus_service_property(_interface, signature=u"t",
998
access=u"readwrite")
999
def timeout_dbus_property(self, value=None):
1359
1000
if value is None: # get
1360
1001
return dbus.UInt64(self.timeout_milliseconds())
1361
1002
self.timeout = datetime.timedelta(0, 0, 0, value)
1362
if getattr(self, "disable_initiator_tag", None) is None:
1003
# Emit D-Bus signal
1004
self.PropertyChanged(dbus.String(u"timeout"),
1005
dbus.UInt64(value, variant_level=1))
1006
if getattr(self, u"disable_initiator_tag", None) is None:
1363
1007
return
1364
1008
# Reschedule timeout
1365
1009
gobject.source_remove(self.disable_initiator_tag)
1366
1010
self.disable_initiator_tag = None
1367
self.expires = None
1368
time_to_die = timedelta_to_milliseconds((self
1369
.last_checked_ok
1370
+ self.timeout)
1371
- datetime.datetime
1372
.utcnow())
1011
time_to_die = (self.
1012
_timedelta_to_milliseconds((self
1013
.last_checked_ok
1014
+ self.timeout)
1015
- datetime.datetime
1016
.utcnow()))
1373
1017
if time_to_die <= 0:
1374
1018
# The timeout has passed
1375
1019
self.disable()
1376
1020
else:
1377
self.expires = (datetime.datetime.utcnow()
1378
+ datetime.timedelta(milliseconds =
1379
time_to_die))
1380
1021
self.disable_initiator_tag = (gobject.timeout_add
1381
1022
(time_to_die, self.disable))
1382
1023
1383
# ExtendedTimeout - property
1384
@dbus_service_property(_interface, signature="t",
1385
access="readwrite")
1386
def ExtendedTimeout_dbus_property(self, value=None):
1387
if value is None: # get
1388
return dbus.UInt64(self.extended_timeout_milliseconds())
1389
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1390
1391
# Interval - property
1392
@dbus_service_property(_interface, signature="t",
1393
access="readwrite")
1394
def Interval_dbus_property(self, value=None):
1024
# interval - property
1025
@dbus_service_property(_interface, signature=u"t",
1026
access=u"readwrite")
1027
def interval_dbus_property(self, value=None):
1395
1028
if value is None: # get
1396
1029
return dbus.UInt64(self.interval_milliseconds())
1397
1030
self.interval = datetime.timedelta(0, 0, 0, value)
1398
if getattr(self, "checker_initiator_tag", None) is None:
1031
# Emit D-Bus signal
1032
self.PropertyChanged(dbus.String(u"interval"),
1033
dbus.UInt64(value, variant_level=1))
1034
if getattr(self, u"checker_initiator_tag", None) is None:
1399
1035
return
1400
if self.enabled:
1401
# Reschedule checker run
1402
gobject.source_remove(self.checker_initiator_tag)
1403
self.checker_initiator_tag = (gobject.timeout_add
1404
(value, self.start_checker))
1405
self.start_checker() # Start one now, too
1406
1407
# Checker - property
1408
@dbus_service_property(_interface, signature="s",
1409
access="readwrite")
1410
def Checker_dbus_property(self, value=None):
1036
# Reschedule checker run
1037
gobject.source_remove(self.checker_initiator_tag)
1038
self.checker_initiator_tag = (gobject.timeout_add
1039
(value, self.start_checker))
1040
self.start_checker() # Start one now, too
1041
1042
# checker - property
1043
@dbus_service_property(_interface, signature=u"s",
1044
access=u"readwrite")
1045
def checker_dbus_property(self, value=None):
1411
1046
if value is None: # get
1412
1047
return dbus.String(self.checker_command)
1413
self.checker_command = unicode(value)
1048
self.checker_command = value
1049
# Emit D-Bus signal
1050
self.PropertyChanged(dbus.String(u"checker"),
1051
dbus.String(self.checker_command,
1052
variant_level=1))
1414
1053
1415
# CheckerRunning - property
1416
@dbus_service_property(_interface, signature="b",
1417
access="readwrite")
1418
def CheckerRunning_dbus_property(self, value=None):
1054
# checker_running - property
1055
@dbus_service_property(_interface, signature=u"b",
1056
access=u"readwrite")
1057
def checker_running_dbus_property(self, value=None):
1419
1058
if value is None: # get
1420
1059
return dbus.Boolean(self.checker is not None)
1421
1060
if value:
1423
1062
else:
1424
1063
self.stop_checker()
1425
1064
1426
# ObjectPath - property
1427
@dbus_service_property(_interface, signature="o", access="read")
1428
def ObjectPath_dbus_property(self):
1065
# object_path - property
1066
@dbus_service_property(_interface, signature=u"o", access=u"read")
1067
def object_path_dbus_property(self):
1429
1068
return self.dbus_object_path # is already a dbus.ObjectPath
1430
1069
1431
# Secret = property
1432
@dbus_service_property(_interface, signature="ay",
1433
access="write", byte_arrays=True)
1434
def Secret_dbus_property(self, value):
1070
# secret = property
1071
@dbus_service_property(_interface, signature=u"ay",
1072
access=u"write", byte_arrays=True)
1073
def secret_dbus_property(self, value):
1435
1074
self.secret = str(value)
1436
1075
1437
1076
del _interface
1443
1082
self._pipe.send(('init', fpr, address))
1444
1083
if not self._pipe.recv():
1445
1084
raise KeyError()
1446
1085
1447
1086
def __getattribute__(self, name):
1448
if name == '_pipe':
1087
if(name == '_pipe'):
1449
1088
return super(ProxyClient, self).__getattribute__(name)
1450
1089
self._pipe.send(('getattr', name))
1451
1090
data = self._pipe.recv()
1456
1095
self._pipe.send(('funcall', name, args, kwargs))
1457
1096
return self._pipe.recv()[1]
1458
1097
return func
1459
1098
1460
1099
def __setattr__(self, name, value):
1461
if name == '_pipe':
1100
if(name == '_pipe'):
1462
1101
return super(ProxyClient, self).__setattr__(name, value)
1463
1102
self._pipe.send(('setattr', name, value))
1464
1103
1465
1104
1466
class ClientDBusTransitional(ClientDBus):
1467
__metaclass__ = AlternateDBusNamesMetaclass
1468
1469
1470
1105
class ClientHandler(socketserver.BaseRequestHandler, object):
1471
1106
"""A class to handle client connections.
1472
1107
1475
1110
1476
1111
def handle(self):
1477
1112
with contextlib.closing(self.server.child_pipe) as child_pipe:
1478
logger.info("TCP connection from: %s",
1113
logger.info(u"TCP connection from: %s",
1479
1114
unicode(self.client_address))
1480
logger.debug("Pipe FD: %d",
1115
logger.debug(u"Pipe FD: %d",
1481
1116
self.server.child_pipe.fileno())
1482
1117
1483
1118
session = (gnutls.connection
1484
1119
.ClientSession(self.request,
1485
1120
gnutls.connection
1486
1121
.X509Credentials()))
1487
1122
1488
1123
# Note: gnutls.connection.X509Credentials is really a
1489
1124
# generic GnuTLS certificate credentials object so long as
1490
1125
# no X.509 keys are added to it. Therefore, we can use it
1491
1126
# here despite using OpenPGP certificates.
1492
1493
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1494
# "+AES-256-CBC", "+SHA1",
1495
# "+COMP-NULL", "+CTYPE-OPENPGP",
1496
# "+DHE-DSS"))
1127
1128
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1129
# u"+AES-256-CBC", u"+SHA1",
1130
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1131
# u"+DHE-DSS"))
1497
1132
# Use a fallback default, since this MUST be set.
1498
1133
priority = self.server.gnutls_priority
1499
1134
if priority is None:
1500
priority = "NORMAL"
1135
priority = u"NORMAL"
1501
1136
(gnutls.library.functions
1502
1137
.gnutls_priority_set_direct(session._c_object,
1503
1138
priority, None))
1504
1139
1505
1140
# Start communication using the Mandos protocol
1506
1141
# Get protocol number
1507
1142
line = self.request.makefile().readline()
1508
logger.debug("Protocol version: %r", line)
1143
logger.debug(u"Protocol version: %r", line)
1509
1144
try:
1510
1145
if int(line.strip().split()[0]) > 1:
1511
1146
raise RuntimeError
1512
except (ValueError, IndexError, RuntimeError) as error:
1513
logger.error("Unknown protocol version: %s", error)
1147
except (ValueError, IndexError, RuntimeError), error:
1148
logger.error(u"Unknown protocol version: %s", error)
1514
1149
return
1515
1150
1516
1151
# Start GnuTLS connection
1517
1152
try:
1518
1153
session.handshake()
1519
except gnutls.errors.GNUTLSError as error:
1520
logger.warning("Handshake failed: %s", error)
1154
except gnutls.errors.GNUTLSError, error:
1155
logger.warning(u"Handshake failed: %s", error)
1521
1156
# Do not run session.bye() here: the session is not
1522
1157
# established. Just abandon the request.
1523
1158
return
1524
logger.debug("Handshake succeeded")
1525
1159
logger.debug(u"Handshake succeeded")
1160
1526
1161
approval_required = False
1527
1162
try:
1528
1163
try:
1529
1164
fpr = self.fingerprint(self.peer_certificate
1530
1165
(session))
1531
except (TypeError,
1532
gnutls.errors.GNUTLSError) as error:
1533
logger.warning("Bad certificate: %s", error)
1166
except (TypeError, gnutls.errors.GNUTLSError), error:
1167
logger.warning(u"Bad certificate: %s", error)
1534
1168
return
1535
logger.debug("Fingerprint: %s", fpr)
1536
1169
logger.debug(u"Fingerprint: %s", fpr)
1170
1537
1171
try:
1538
1172
client = ProxyClient(child_pipe, fpr,
1539
1173
self.client_address)
1540
1174
except KeyError:
1541
1175
return
1542
1176
1543
if self.server.use_dbus:
1544
# Emit D-Bus signal
1545
client.NewRequest(str(self.client_address))
1546
1547
if client.approval_delay:
1548
delay = client.approval_delay
1177
if client.approved_delay:
1178
delay = client.approved_delay
1549
1179
client.approvals_pending += 1
1550
1180
approval_required = True
1551
1181
1552
1182
while True:
1553
1183
if not client.enabled:
1554
logger.info("Client %s is disabled",
1184
logger.warning(u"Client %s is disabled",
1555
1185
client.name)
1556
1186
if self.server.use_dbus:
1557
1187
# Emit D-Bus signal
1558
client.Rejected("Disabled")
1188
client.Rejected("Disabled")
1559
1189
return
1560
1190
1561
if client.approved or not client.approval_delay:
1191
if client._approved or not client.approved_delay:
1562
1192
#We are approved or approval is disabled
1563
1193
break
1564
elif client.approved is None:
1565
logger.info("Client %s needs approval",
1194
elif client._approved is None:
1195
logger.info(u"Client %s need approval",
1566
1196
client.name)
1567
1197
if self.server.use_dbus:
1568
1198
# Emit D-Bus signal
1569
1199
client.NeedApproval(
1570
client.approval_delay_milliseconds(),
1200
client.approved_delay_milliseconds(),
1571
1201
client.approved_by_default)
1572
1202
else:
1573
logger.warning("Client %s was not approved",
1203
logger.warning(u"Client %s was not approved",
1574
1204
client.name)
1575
1205
if self.server.use_dbus:
1576
1206
# Emit D-Bus signal
1577
client.Rejected("Denied")
1207
client.Rejected("Disapproved")
1578
1208
return
1579
1209
1580
1210
#wait until timeout or approved
1211
#x = float(client._timedelta_to_milliseconds(delay))
1581
1212
time = datetime.datetime.now()
1582
1213
client.changedstate.acquire()
1583
(client.changedstate.wait
1584
(float(client.timedelta_to_milliseconds(delay)
1585
/ 1000)))
1214
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1586
1215
client.changedstate.release()
1587
1216
time2 = datetime.datetime.now()
1588
1217
if (time2 - time) >= delay:
1592
1221
client.name)
1593
1222
if self.server.use_dbus:
1594
1223
# Emit D-Bus signal
1595
client.Rejected("Approval timed out")
1224
client.Rejected("Time out")
1596
1225
return
1597
1226
else:
1598
1227
break
1603
1232
while sent_size < len(client.secret):
1604
1233
try:
1605
1234
sent = session.send(client.secret[sent_size:])
1606
except gnutls.errors.GNUTLSError as error:
1235
except (gnutls.errors.GNUTLSError), error:
1607
1236
logger.warning("gnutls send failed")
1608
1237
return
1609
logger.debug("Sent: %d, remaining: %d",
1238
logger.debug(u"Sent: %d, remaining: %d",
1610
1239
sent, len(client.secret)
1611
1240
- (sent_size + sent))
1612
1241
sent_size += sent
1613
1614
logger.info("Sending secret to %s", client.name)
1615
# bump the timeout using extended_timeout
1616
client.checked_ok(client.extended_timeout)
1242
1243
logger.info(u"Sending secret to %s", client.name)
1244
# bump the timeout as if seen
1245
client.checked_ok()
1617
1246
if self.server.use_dbus:
1618
1247
# Emit D-Bus signal
1619
1248
client.GotSecret()
1623
1252
client.approvals_pending -= 1
1624
1253
try:
1625
1254
session.bye()
1626
except gnutls.errors.GNUTLSError as error:
1627
logger.warning("GnuTLS bye failed")
1255
except (gnutls.errors.GNUTLSError), error:
1256
logger.warning("gnutls bye failed")
1628
1257
1629
1258
@staticmethod
1630
1259
def peer_certificate(session):
1640
1269
.gnutls_certificate_get_peers
1641
1270
(session._c_object, ctypes.byref(list_size)))
1642
1271
if not bool(cert_list) and list_size.value != 0:
1643
raise gnutls.errors.GNUTLSError("error getting peer"
1644
" certificate")
1272
raise gnutls.errors.GNUTLSError(u"error getting peer"
1273
u" certificate")
1645
1274
if list_size.value == 0:
1646
1275
return None
1647
1276
cert = cert_list[0]
1673
1302
if crtverify.value != 0:
1674
1303
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1675
1304
raise (gnutls.errors.CertificateSecurityError
1676
("Verify failed"))
1305
(u"Verify failed"))
1677
1306
# New buffer for the fingerprint
1678
1307
buf = ctypes.create_string_buffer(20)
1679
1308
buf_len = ctypes.c_size_t()
1686
1315
# Convert the buffer to a Python bytestring
1687
1316
fpr = ctypes.string_at(buf, buf_len.value)
1688
1317
# Convert the bytestring to hexadecimal notation
1689
hex_fpr = binascii.hexlify(fpr).upper()
1318
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1690
1319
return hex_fpr
1691
1320
1692
1321
1695
1324
def sub_process_main(self, request, address):
1696
1325
try:
1697
1326
self.finish_request(request, address)
1698
except Exception:
1327
except:
1699
1328
self.handle_error(request, address)
1700
1329
self.close_request(request)
1701
1330
1702
1331
def process_request(self, request, address):
1703
1332
"""Start a new process to process the request."""
1704
proc = multiprocessing.Process(target = self.sub_process_main,
1705
args = (request,
1706
address))
1707
proc.start()
1708
return proc
1709
1333
multiprocessing.Process(target = self.sub_process_main,
1334
args = (request, address)).start()
1710
1335
1711
1336
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1712
1337
""" adds a pipe to the MixIn """
1716
1341
This function creates a new pipe in self.pipe
1717
1342
"""
1718
1343
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1719
1720
proc = MultiprocessingMixIn.process_request(self, request,
1721
client_address)
1344
1345
super(MultiprocessingMixInWithPipe,
1346
self).process_request(request, client_address)
1722
1347
self.child_pipe.close()
1723
self.add_pipe(parent_pipe, proc)
1724
1725
def add_pipe(self, parent_pipe, proc):
1348
self.add_pipe(parent_pipe)
1349
1350
def add_pipe(self, parent_pipe):
1726
1351
"""Dummy function; override as necessary"""
1727
raise NotImplementedError
1728
1352
pass
1729
1353
1730
1354
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1731
1355
socketserver.TCPServer, object):
1749
1373
bind to an address or port if they were not specified."""
1750
1374
if self.interface is not None:
1751
1375
if SO_BINDTODEVICE is None:
1752
logger.error("SO_BINDTODEVICE does not exist;"
1753
" cannot bind to interface %s",
1376
logger.error(u"SO_BINDTODEVICE does not exist;"
1377
u" cannot bind to interface %s",
1754
1378
self.interface)
1755
1379
else:
1756
1380
try:
1757
1381
self.socket.setsockopt(socket.SOL_SOCKET,
1758
1382
SO_BINDTODEVICE,
1759
1383
str(self.interface
1760
+ '\0'))
1761
except socket.error as error:
1384
+ u'\0'))
1385
except socket.error, error:
1762
1386
if error[0] == errno.EPERM:
1763
logger.error("No permission to"
1764
" bind to interface %s",
1387
logger.error(u"No permission to"
1388
u" bind to interface %s",
1765
1389
self.interface)
1766
1390
elif error[0] == errno.ENOPROTOOPT:
1767
logger.error("SO_BINDTODEVICE not available;"
1768
" cannot bind to interface %s",
1391
logger.error(u"SO_BINDTODEVICE not available;"
1392
u" cannot bind to interface %s",
1769
1393
self.interface)
1770
1394
else:
1771
1395
raise
1773
1397
if self.server_address[0] or self.server_address[1]:
1774
1398
if not self.server_address[0]:
1775
1399
if self.address_family == socket.AF_INET6:
1776
any_address = "::" # in6addr_any
1400
any_address = u"::" # in6addr_any
1777
1401
else:
1778
1402
any_address = socket.INADDR_ANY
1779
1403
self.server_address = (any_address,
1806
1430
self.enabled = False
1807
1431
self.clients = clients
1808
1432
if self.clients is None:
1809
self.clients = {}
1433
self.clients = set()
1810
1434
self.use_dbus = use_dbus
1811
1435
self.gnutls_priority = gnutls_priority
1812
1436
IPv6_TCPServer.__init__(self, server_address,
1816
1440
def server_activate(self):
1817
1441
if self.enabled:
1818
1442
return socketserver.TCPServer.server_activate(self)
1819
1820
1443
def enable(self):
1821
1444
self.enabled = True
1822
1823
def add_pipe(self, parent_pipe, proc):
1445
def add_pipe(self, parent_pipe):
1824
1446
# Call "handle_ipc" for both data and EOF events
1825
1447
gobject.io_add_watch(parent_pipe.fileno(),
1826
1448
gobject.IO_IN | gobject.IO_HUP,
1827
1449
functools.partial(self.handle_ipc,
1828
parent_pipe =
1829
parent_pipe,
1830
proc = proc))
1831
1450
parent_pipe = parent_pipe))
1451
1832
1452
def handle_ipc(self, source, condition, parent_pipe=None,
1833
proc = None, client_object=None):
1453
client_object=None):
1834
1454
condition_names = {
1835
gobject.IO_IN: "IN", # There is data to read.
1836
gobject.IO_OUT: "OUT", # Data can be written (without
1455
gobject.IO_IN: u"IN", # There is data to read.
1456
gobject.IO_OUT: u"OUT", # Data can be written (without
1837
1457
# blocking).
1838
gobject.IO_PRI: "PRI", # There is urgent data to read.
1839
gobject.IO_ERR: "ERR", # Error condition.
1840
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1458
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1459
gobject.IO_ERR: u"ERR", # Error condition.
1460
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1841
1461
# broken, usually for pipes and
1842
1462
# sockets).
1843
1463
}
1845
1465
for cond, name in
1846
1466
condition_names.iteritems()
1847
1467
if cond & condition)
1848
# error, or the other end of multiprocessing.Pipe has closed
1468
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1469
conditions_string)
1470
1471
# error or the other end of multiprocessing.Pipe has closed
1849
1472
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1850
# Wait for other process to exit
1851
proc.join()
1852
1473
return False
1853
1474
1854
1475
# Read a request from the child
1855
1476
request = parent_pipe.recv()
1477
logger.debug(u"IPC request: %s", repr(request))
1856
1478
command = request[0]
1857
1479
1858
1480
if command == 'init':
1859
1481
fpr = request[1]
1860
1482
address = request[2]
1861
1483
1862
for c in self.clients.itervalues():
1484
for c in self.clients:
1863
1485
if c.fingerprint == fpr:
1864
1486
client = c
1865
1487
break
1866
1488
else:
1867
logger.info("Client not found for fingerprint: %s, ad"
1868
"dress: %s", fpr, address)
1489
logger.warning(u"Client not found for fingerprint: %s, ad"
1490
u"dress: %s", fpr, address)
1869
1491
if self.use_dbus:
1870
1492
# Emit D-Bus signal
1871
mandos_dbus_service.ClientNotFound(fpr,
1872
address[0])
1493
mandos_dbus_service.ClientNotFound(fpr, address)
1873
1494
parent_pipe.send(False)
1874
1495
return False
1875
1496
1876
1497
gobject.io_add_watch(parent_pipe.fileno(),
1877
1498
gobject.IO_IN | gobject.IO_HUP,
1878
1499
functools.partial(self.handle_ipc,
1879
parent_pipe =
1880
parent_pipe,
1881
proc = proc,
1882
client_object =
1883
client))
1500
parent_pipe = parent_pipe,
1501
client_object = client))
1884
1502
parent_pipe.send(True)
1885
# remove the old hook in favor of the new above hook on
1886
# same fileno
1503
# remove the old hook in favor of the new above hook on same fileno
1887
1504
return False
1888
1505
if command == 'funcall':
1889
1506
funcname = request[1]
1890
1507
args = request[2]
1891
1508
kwargs = request[3]
1892
1509
1893
parent_pipe.send(('data', getattr(client_object,
1894
funcname)(*args,
1895
**kwargs)))
1896
1510
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1511
1897
1512
if command == 'getattr':
1898
1513
attrname = request[1]
1899
1514
if callable(client_object.__getattribute__(attrname)):
1900
1515
parent_pipe.send(('function',))
1901
1516
else:
1902
parent_pipe.send(('data', client_object
1903
.__getattribute__(attrname)))
1517
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1904
1518
1905
1519
if command == 'setattr':
1906
1520
attrname = request[1]
1907
1521
value = request[2]
1908
1522
setattr(client_object, attrname, value)
1909
1523
1910
1524
return True
1911
1525
1912
1526
1913
1527
def string_to_delta(interval):
1914
1528
"""Parse a string and return a datetime.timedelta
1915
1529
1916
>>> string_to_delta('7d')
1530
>>> string_to_delta(u'7d')
1917
1531
datetime.timedelta(7)
1918
>>> string_to_delta('60s')
1532
>>> string_to_delta(u'60s')
1919
1533
datetime.timedelta(0, 60)
1920
>>> string_to_delta('60m')
1534
>>> string_to_delta(u'60m')
1921
1535
datetime.timedelta(0, 3600)
1922
>>> string_to_delta('24h')
1536
>>> string_to_delta(u'24h')
1923
1537
datetime.timedelta(1)
1924
>>> string_to_delta('1w')
1538
>>> string_to_delta(u'1w')
1925
1539
datetime.timedelta(7)
1926
>>> string_to_delta('5m 30s')
1540
>>> string_to_delta(u'5m 30s')
1927
1541
datetime.timedelta(0, 330)
1928
1542
"""
1929
1543
timevalue = datetime.timedelta(0)
1931
1545
try:
1932
1546
suffix = unicode(s[-1])
1933
1547
value = int(s[:-1])
1934
if suffix == "d":
1548
if suffix == u"d":
1935
1549
delta = datetime.timedelta(value)
1936
elif suffix == "s":
1550
elif suffix == u"s":
1937
1551
delta = datetime.timedelta(0, value)
1938
elif suffix == "m":
1552
elif suffix == u"m":
1939
1553
delta = datetime.timedelta(0, 0, 0, 0, value)
1940
elif suffix == "h":
1554
elif suffix == u"h":
1941
1555
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1942
elif suffix == "w":
1556
elif suffix == u"w":
1943
1557
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1944
1558
else:
1945
raise ValueError("Unknown suffix %r" % suffix)
1946
except (ValueError, IndexError) as e:
1947
raise ValueError(*(e.args))
1559
raise ValueError(u"Unknown suffix %r" % suffix)
1560
except (ValueError, IndexError), e:
1561
raise ValueError(e.message)
1948
1562
timevalue += delta
1949
1563
return timevalue
1950
1564
1951
1565
1566
def if_nametoindex(interface):
1567
"""Call the C function if_nametoindex(), or equivalent
1568
1569
Note: This function cannot accept a unicode string."""
1570
global if_nametoindex
1571
try:
1572
if_nametoindex = (ctypes.cdll.LoadLibrary
1573
(ctypes.util.find_library(u"c"))
1574
.if_nametoindex)
1575
except (OSError, AttributeError):
1576
logger.warning(u"Doing if_nametoindex the hard way")
1577
def if_nametoindex(interface):
1578
"Get an interface index the hard way, i.e. using fcntl()"
1579
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1580
with contextlib.closing(socket.socket()) as s:
1581
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1582
struct.pack(str(u"16s16x"),
1583
interface))
1584
interface_index = struct.unpack(str(u"I"),
1585
ifreq[16:20])[0]
1586
return interface_index
1587
return if_nametoindex(interface)
1588
1589
1952
1590
def daemon(nochdir = False, noclose = False):
1953
1591
"""See daemon(3). Standard BSD Unix function.
1954
1592
1957
1595
sys.exit()
1958
1596
os.setsid()
1959
1597
if not nochdir:
1960
os.chdir("/")
1598
os.chdir(u"/")
1961
1599
if os.fork():
1962
1600
sys.exit()
1963
1601
if not noclose:
1965
1603
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1966
1604
if not stat.S_ISCHR(os.fstat(null).st_mode):
1967
1605
raise OSError(errno.ENODEV,
1968
"%s not a character device"
1606
u"%s not a character device"
1969
1607
% os.path.devnull)
1970
1608
os.dup2(null, sys.stdin.fileno())
1971
1609
os.dup2(null, sys.stdout.fileno())
1979
1617
##################################################################
1980
1618
# Parsing of options, both command line and config file
1981
1619
1982
parser = argparse.ArgumentParser()
1983
parser.add_argument("-v", "--version", action="version",
1984
version = "%%(prog)s %s" % version,
1985
help="show version number and exit")
1986
parser.add_argument("-i", "--interface", metavar="IF",
1987
help="Bind to interface IF")
1988
parser.add_argument("-a", "--address",
1989
help="Address to listen for requests on")
1990
parser.add_argument("-p", "--port", type=int,
1991
help="Port number to receive requests on")
1992
parser.add_argument("--check", action="store_true",
1993
help="Run self-test")
1994
parser.add_argument("--debug", action="store_true",
1995
help="Debug mode; run in foreground and log"
1996
" to terminal")
1997
parser.add_argument("--debuglevel", metavar="LEVEL",
1998
help="Debug level for stdout output")
1999
parser.add_argument("--priority", help="GnuTLS"
2000
" priority string (see GnuTLS documentation)")
2001
parser.add_argument("--servicename",
2002
metavar="NAME", help="Zeroconf service name")
2003
parser.add_argument("--configdir",
2004
default="/etc/mandos", metavar="DIR",
2005
help="Directory to search for configuration"
2006
" files")
2007
parser.add_argument("--no-dbus", action="store_false",
2008
dest="use_dbus", help="Do not provide D-Bus"
2009
" system bus interface")
2010
parser.add_argument("--no-ipv6", action="store_false",
2011
dest="use_ipv6", help="Do not use IPv6")
2012
parser.add_argument("--no-restore", action="store_false",
2013
dest="restore", help="Do not restore stored"
2014
" state")
2015
parser.add_argument("--statedir", metavar="DIR",
2016
help="Directory to save/restore state in")
2017
2018
options = parser.parse_args()
1620
parser = optparse.OptionParser(version = "%%prog %s" % version)
1621
parser.add_option("-i", u"--interface", type=u"string",
1622
metavar="IF", help=u"Bind to interface IF")
1623
parser.add_option("-a", u"--address", type=u"string",
1624
help=u"Address to listen for requests on")
1625
parser.add_option("-p", u"--port", type=u"int",
1626
help=u"Port number to receive requests on")
1627
parser.add_option("--check", action=u"store_true",
1628
help=u"Run self-test")
1629
parser.add_option("--debug", action=u"store_true",
1630
help=u"Debug mode; run in foreground and log to"
1631
u" terminal")
1632
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1633
help=u"Debug level for stdout output")
1634
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1635
u" priority string (see GnuTLS documentation)")
1636
parser.add_option("--servicename", type=u"string",
1637
metavar=u"NAME", help=u"Zeroconf service name")
1638
parser.add_option("--configdir", type=u"string",
1639
default=u"/etc/mandos", metavar=u"DIR",
1640
help=u"Directory to search for configuration"
1641
u" files")
1642
parser.add_option("--no-dbus", action=u"store_false",
1643
dest=u"use_dbus", help=u"Do not provide D-Bus"
1644
u" system bus interface")
1645
parser.add_option("--no-ipv6", action=u"store_false",
1646
dest=u"use_ipv6", help=u"Do not use IPv6")
1647
options = parser.parse_args()[0]
2019
1648
2020
1649
if options.check:
2021
1650
import doctest
2023
1652
sys.exit()
2024
1653
2025
1654
# Default values for config file for server-global settings
2026
server_defaults = { "interface": "",
2027
"address": "",
2028
"port": "",
2029
"debug": "False",
2030
"priority":
2031
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2032
"servicename": "Mandos",
2033
"use_dbus": "True",
2034
"use_ipv6": "True",
2035
"debuglevel": "",
2036
"restore": "True",
2037
"statedir": "/var/lib/mandos"
1655
server_defaults = { u"interface": u"",
1656
u"address": u"",
1657
u"port": u"",
1658
u"debug": u"False",
1659
u"priority":
1660
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1661
u"servicename": u"Mandos",
1662
u"use_dbus": u"True",
1663
u"use_ipv6": u"True",
1664
u"debuglevel": u"",
2038
1665
}
2039
1666
2040
1667
# Parse config file for server-global settings
2041
1668
server_config = configparser.SafeConfigParser(server_defaults)
2042
1669
del server_defaults
2043
1670
server_config.read(os.path.join(options.configdir,
2044
"mandos.conf"))
1671
u"mandos.conf"))
2045
1672
# Convert the SafeConfigParser object to a dict
2046
1673
server_settings = server_config.defaults()
2047
1674
# Use the appropriate methods on the non-string config options
2048
for option in ("debug", "use_dbus", "use_ipv6"):
2049
server_settings[option] = server_config.getboolean("DEFAULT",
1675
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1676
server_settings[option] = server_config.getboolean(u"DEFAULT",
2050
1677
option)
2051
1678
if server_settings["port"]:
2052
server_settings["port"] = server_config.getint("DEFAULT",
2053
"port")
1679
server_settings["port"] = server_config.getint(u"DEFAULT",
1680
u"port")
2054
1681
del server_config
2055
1682
2056
1683
# Override the settings from the config file with command line
2057
1684
# options, if set.
2058
for option in ("interface", "address", "port", "debug",
2059
"priority", "servicename", "configdir",
2060
"use_dbus", "use_ipv6", "debuglevel", "restore",
2061
"statedir"):
1685
for option in (u"interface", u"address", u"port", u"debug",
1686
u"priority", u"servicename", u"configdir",
1687
u"use_dbus", u"use_ipv6", u"debuglevel"):
2062
1688
value = getattr(options, option)
2063
1689
if value is not None:
2064
1690
server_settings[option] = value
2072
1698
##################################################################
2073
1699
2074
1700
# For convenience
2075
debug = server_settings["debug"]
2076
debuglevel = server_settings["debuglevel"]
2077
use_dbus = server_settings["use_dbus"]
2078
use_ipv6 = server_settings["use_ipv6"]
2079
stored_state_path = os.path.join(server_settings["statedir"],
2080
stored_state_file)
2081
2082
if debug:
2083
initlogger(debug, logging.DEBUG)
2084
else:
2085
if not debuglevel:
2086
initlogger(debug)
2087
else:
2088
level = getattr(logging, debuglevel.upper())
2089
initlogger(debug, level)
2090
2091
if server_settings["servicename"] != "Mandos":
1701
debug = server_settings[u"debug"]
1702
debuglevel = server_settings[u"debuglevel"]
1703
use_dbus = server_settings[u"use_dbus"]
1704
use_ipv6 = server_settings[u"use_ipv6"]
1705
1706
if server_settings[u"servicename"] != u"Mandos":
2092
1707
syslogger.setFormatter(logging.Formatter
2093
('Mandos (%s) [%%(process)d]:'
2094
' %%(levelname)s: %%(message)s'
2095
% server_settings["servicename"]))
1708
(u'Mandos (%s) [%%(process)d]:'
1709
u' %%(levelname)s: %%(message)s'
1710
% server_settings[u"servicename"]))
2096
1711
2097
1712
# Parse config file with clients
2098
client_config = configparser.SafeConfigParser(Client.client_defaults)
2099
client_config.read(os.path.join(server_settings["configdir"],
2100
"clients.conf"))
1713
client_defaults = { u"timeout": u"1h",
1714
u"interval": u"5m",
1715
u"checker": u"fping -q -- %%(host)s",
1716
u"host": u"",
1717
u"approved_delay": u"0s",
1718
u"approved_duration": u"1s",
1719
}
1720
client_config = configparser.SafeConfigParser(client_defaults)
1721
client_config.read(os.path.join(server_settings[u"configdir"],
1722
u"clients.conf"))
2101
1723
2102
1724
global mandos_dbus_service
2103
1725
mandos_dbus_service = None
2104
1726
2105
tcp_server = MandosServer((server_settings["address"],
2106
server_settings["port"]),
1727
tcp_server = MandosServer((server_settings[u"address"],
1728
server_settings[u"port"]),
2107
1729
ClientHandler,
2108
interface=(server_settings["interface"]
2109
or None),
1730
interface=server_settings[u"interface"],
2110
1731
use_ipv6=use_ipv6,
2111
1732
gnutls_priority=
2112
server_settings["priority"],
1733
server_settings[u"priority"],
2113
1734
use_dbus=use_dbus)
2114
if not debug:
2115
pidfilename = "/var/run/mandos.pid"
2116
try:
2117
pidfile = open(pidfilename, "w")
2118
except IOError:
2119
logger.error("Could not open file %r", pidfilename)
1735
pidfilename = u"/var/run/mandos.pid"
1736
try:
1737
pidfile = open(pidfilename, u"w")
1738
except IOError:
1739
logger.error(u"Could not open file %r", pidfilename)
2120
1740
2121
1741
try:
2122
uid = pwd.getpwnam("_mandos").pw_uid
2123
gid = pwd.getpwnam("_mandos").pw_gid
1742
uid = pwd.getpwnam(u"_mandos").pw_uid
1743
gid = pwd.getpwnam(u"_mandos").pw_gid
2124
1744
except KeyError:
2125
1745
try:
2126
uid = pwd.getpwnam("mandos").pw_uid
2127
gid = pwd.getpwnam("mandos").pw_gid
1746
uid = pwd.getpwnam(u"mandos").pw_uid
1747
gid = pwd.getpwnam(u"mandos").pw_gid
2128
1748
except KeyError:
2129
1749
try:
2130
uid = pwd.getpwnam("nobody").pw_uid
2131
gid = pwd.getpwnam("nobody").pw_gid
1750
uid = pwd.getpwnam(u"nobody").pw_uid
1751
gid = pwd.getpwnam(u"nobody").pw_gid
2132
1752
except KeyError:
2133
1753
uid = 65534
2134
1754
gid = 65534
2135
1755
try:
2136
1756
os.setgid(gid)
2137
1757
os.setuid(uid)
2138
except OSError as error:
1758
except OSError, error:
2139
1759
if error[0] != errno.EPERM:
2140
1760
raise error
2141
1761
1762
# Enable all possible GnuTLS debugging
1763
1764
1765
if not debug and not debuglevel:
1766
syslogger.setLevel(logging.WARNING)
1767
console.setLevel(logging.WARNING)
1768
if debuglevel:
1769
level = getattr(logging, debuglevel.upper())
1770
syslogger.setLevel(level)
1771
console.setLevel(level)
1772
2142
1773
if debug:
2143
# Enable all possible GnuTLS debugging
2144
2145
1774
# "Use a log level over 10 to enable all debugging options."
2146
1775
# - GnuTLS manual
2147
1776
gnutls.library.functions.gnutls_global_set_log_level(11)
2148
1777
2149
1778
@gnutls.library.types.gnutls_log_func
2150
1779
def debug_gnutls(level, string):
2151
logger.debug("GnuTLS: %s", string[:-1])
1780
logger.debug(u"GnuTLS: %s", string[:-1])
2152
1781
2153
1782
(gnutls.library.functions
2154
1783
.gnutls_global_set_log_function(debug_gnutls))
2155
1784
2156
1785
# Redirect stdin so all checkers get /dev/null
2157
1786
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2158
1787
os.dup2(null, sys.stdin.fileno())
2159
1788
if null > 2:
2160
1789
os.close(null)
2161
2162
# Need to fork before connecting to D-Bus
2163
if not debug:
2164
# Close all input and output, do double fork, etc.
2165
daemon()
2166
2167
gobject.threads_init()
1790
else:
1791
# No console logging
1792
logger.removeHandler(console)
1793
2168
1794
2169
1795
global main_loop
2170
1796
# From the Avahi example code
2174
1800
# End of Avahi example code
2175
1801
if use_dbus:
2176
1802
try:
2177
bus_name = dbus.service.BusName("se.recompile.Mandos",
1803
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2178
1804
bus, do_not_queue=True)
2179
old_bus_name = (dbus.service.BusName
2180
("se.bsnet.fukt.Mandos", bus,
2181
do_not_queue=True))
2182
except dbus.exceptions.NameExistsException as e:
2183
logger.error(unicode(e) + ", disabling D-Bus")
1805
except dbus.exceptions.NameExistsException, e:
1806
logger.error(unicode(e) + u", disabling D-Bus")
2184
1807
use_dbus = False
2185
server_settings["use_dbus"] = False
1808
server_settings[u"use_dbus"] = False
2186
1809
tcp_server.use_dbus = False
2187
1810
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2188
service = AvahiServiceToSyslog(name =
2189
server_settings["servicename"],
2190
servicetype = "_mandos._tcp",
2191
protocol = protocol, bus = bus)
1811
service = AvahiService(name = server_settings[u"servicename"],
1812
servicetype = u"_mandos._tcp",
1813
protocol = protocol, bus = bus)
2192
1814
if server_settings["interface"]:
2193
1815
service.interface = (if_nametoindex
2194
(str(server_settings["interface"])))
2195
1816
(str(server_settings[u"interface"])))
1817
1818
if not debug:
1819
# Close all input and output, do double fork, etc.
1820
daemon()
1821
2196
1822
global multiprocessing_manager
2197
1823
multiprocessing_manager = multiprocessing.Manager()
2198
1824
2199
1825
client_class = Client
2200
1826
if use_dbus:
2201
client_class = functools.partial(ClientDBusTransitional,
2202
bus = bus)
2203
2204
client_settings = Client.config_parser(client_config)
2205
old_client_settings = {}
2206
clients_data = {}
2207
2208
# Get client data and settings from last running state.
2209
if server_settings["restore"]:
2210
try:
2211
with open(stored_state_path, "rb") as stored_state:
2212
clients_data, old_client_settings = (pickle.load
2213
(stored_state))
2214
os.remove(stored_state_path)
2215
except IOError as e:
2216
logger.warning("Could not load persistent state: {0}"
2217
.format(e))
2218
if e.errno != errno.ENOENT:
2219
raise
2220
except EOFError as e:
2221
logger.warning("Could not load persistent state: "
2222
"EOFError: {0}".format(e))
2223
2224
with PGPEngine() as pgp:
2225
for client_name, client in clients_data.iteritems():
2226
# Decide which value to use after restoring saved state.
2227
# We have three different values: Old config file,
2228
# new config file, and saved state.
2229
# New config value takes precedence if it differs from old
2230
# config value, otherwise use saved state.
2231
for name, value in client_settings[client_name].items():
2232
try:
2233
# For each value in new config, check if it
2234
# differs from the old config value (Except for
2235
# the "secret" attribute)
2236
if (name != "secret" and
2237
value != old_client_settings[client_name]
2238
[name]):
2239
client[name] = value
2240
except KeyError:
2241
pass
2242
2243
# Clients who has passed its expire date can still be
2244
# enabled if its last checker was successful. Clients
2245
# whose checker failed before we stored its state is
2246
# assumed to have failed all checkers during downtime.
2247
if client["enabled"]:
2248
if datetime.datetime.utcnow() >= client["expires"]:
2249
if not client["last_checked_ok"]:
2250
logger.warning(
2251
"disabling client {0} - Client never "
2252
"performed a successfull checker"
2253
.format(client["name"]))
2254
client["enabled"] = False
2255
elif client["last_checker_status"] != 0:
2256
logger.warning(
2257
"disabling client {0} - Client "
2258
"last checker failed with error code {1}"
2259
.format(client["name"],
2260
client["last_checker_status"]))
2261
client["enabled"] = False
2262
else:
2263
client["expires"] = (datetime.datetime
2264
.utcnow()
2265
+ client["timeout"])
2266
1827
client_class = functools.partial(ClientDBus, bus = bus)
1828
def client_config_items(config, section):
1829
special_settings = {
1830
"approved_by_default":
1831
lambda: config.getboolean(section,
1832
"approved_by_default"),
1833
}
1834
for name, value in config.items(section):
2267
1835
try:
2268
client["secret"] = (
2269
pgp.decrypt(client["encrypted_secret"],
2270
client_settings[client_name]
2271
["secret"]))
2272
except PGPError:
2273
# If decryption fails, we use secret from new settings
2274
logger.debug("Failed to decrypt {0} old secret"
2275
.format(client_name))
2276
client["secret"] = (
2277
client_settings[client_name]["secret"])
2278
2279
2280
# Add/remove clients based on new changes made to config
2281
for client_name in set(old_client_settings) - set(client_settings):
2282
del clients_data[client_name]
2283
for client_name in set(client_settings) - set(old_client_settings):
2284
clients_data[client_name] = client_settings[client_name]
2285
2286
# Create clients all clients
2287
for client_name, client in clients_data.iteritems():
2288
tcp_server.clients[client_name] = client_class(
2289
name = client_name, settings = client)
2290
1836
yield (name, special_settings[name]())
1837
except KeyError:
1838
yield (name, value)
1839
1840
tcp_server.clients.update(set(
1841
client_class(name = section,
1842
config= dict(client_config_items(
1843
client_config, section)))
1844
for section in client_config.sections()))
2291
1845
if not tcp_server.clients:
2292
logger.warning("No clients defined")
1846
logger.warning(u"No clients defined")
2293
1847
1848
try:
1849
with pidfile:
1850
pid = os.getpid()
1851
pidfile.write(str(pid) + "\n")
1852
del pidfile
1853
except IOError:
1854
logger.error(u"Could not write to file %r with PID %d",
1855
pidfilename, pid)
1856
except NameError:
1857
# "pidfile" was never created
1858
pass
1859
del pidfilename
1860
2294
1861
if not debug:
2295
try:
2296
with pidfile:
2297
pid = os.getpid()
2298
pidfile.write(str(pid) + "\n".encode("utf-8"))
2299
del pidfile
2300
except IOError:
2301
logger.error("Could not write to file %r with PID %d",
2302
pidfilename, pid)
2303
except NameError:
2304
# "pidfile" was never created
2305
pass
2306
del pidfilename
2307
1862
signal.signal(signal.SIGINT, signal.SIG_IGN)
2308
2309
1863
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2310
1864
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2311
1865
2313
1867
class MandosDBusService(dbus.service.Object):
2314
1868
"""A D-Bus proxy object"""
2315
1869
def __init__(self):
2316
dbus.service.Object.__init__(self, bus, "/")
2317
_interface = "se.recompile.Mandos"
1870
dbus.service.Object.__init__(self, bus, u"/")
1871
_interface = u"se.bsnet.fukt.Mandos"
2318
1872
2319
@dbus.service.signal(_interface, signature="o")
1873
@dbus.service.signal(_interface, signature=u"o")
2320
1874
def ClientAdded(self, objpath):
2321
1875
"D-Bus signal"
2322
1876
pass
2323
1877
2324
@dbus.service.signal(_interface, signature="ss")
1878
@dbus.service.signal(_interface, signature=u"ss")
2325
1879
def ClientNotFound(self, fingerprint, address):
2326
1880
"D-Bus signal"
2327
1881
pass
2328
1882
2329
@dbus.service.signal(_interface, signature="os")
1883
@dbus.service.signal(_interface, signature=u"os")
2330
1884
def ClientRemoved(self, objpath, name):
2331
1885
"D-Bus signal"
2332
1886
pass
2333
1887
2334
@dbus.service.method(_interface, out_signature="ao")
1888
@dbus.service.method(_interface, out_signature=u"ao")
2335
1889
def GetAllClients(self):
2336
1890
"D-Bus method"
2337
1891
return dbus.Array(c.dbus_object_path
2338
for c in
2339
tcp_server.clients.itervalues())
1892
for c in tcp_server.clients)
2340
1893
2341
1894
@dbus.service.method(_interface,
2342
out_signature="a{oa{sv}}")
1895
out_signature=u"a{oa{sv}}")
2343
1896
def GetAllClientsWithProperties(self):
2344
1897
"D-Bus method"
2345
1898
return dbus.Dictionary(
2346
((c.dbus_object_path, c.GetAll(""))
2347
for c in tcp_server.clients.itervalues()),
2348
signature="oa{sv}")
1899
((c.dbus_object_path, c.GetAll(u""))
1900
for c in tcp_server.clients),
1901
signature=u"oa{sv}")
2349
1902
2350
@dbus.service.method(_interface, in_signature="o")
1903
@dbus.service.method(_interface, in_signature=u"o")
2351
1904
def RemoveClient(self, object_path):
2352
1905
"D-Bus method"
2353
for c in tcp_server.clients.itervalues():
1906
for c in tcp_server.clients:
2354
1907
if c.dbus_object_path == object_path:
2355
del tcp_server.clients[c.name]
1908
tcp_server.clients.remove(c)
2356
1909
c.remove_from_connection()
2357
1910
# Don't signal anything except ClientRemoved
2358
1911
c.disable(quiet=True)
2363
1916
2364
1917
del _interface
2365
1918
2366
class MandosDBusServiceTransitional(MandosDBusService):
2367
__metaclass__ = AlternateDBusNamesMetaclass
2368
mandos_dbus_service = MandosDBusServiceTransitional()
1919
mandos_dbus_service = MandosDBusService()
2369
1920
2370
1921
def cleanup():
2371
1922
"Cleanup function; run on exit"
2372
1923
service.cleanup()
2373
1924
2374
multiprocessing.active_children()
2375
if not (tcp_server.clients or client_settings):
2376
return
2377
2378
# Store client before exiting. Secrets are encrypted with key
2379
# based on what config file has. If config file is
2380
# removed/edited, old secret will thus be unrecovable.
2381
clients = {}
2382
with PGPEngine() as pgp:
2383
for client in tcp_server.clients.itervalues():
2384
key = client_settings[client.name]["secret"]
2385
client.encrypted_secret = pgp.encrypt(client.secret,
2386
key)
2387
client_dict = {}
2388
2389
# A list of attributes that can not be pickled
2390
# + secret.
2391
exclude = set(("bus", "changedstate", "secret",
2392
"checker"))
2393
for name, typ in (inspect.getmembers
2394
(dbus.service.Object)):
2395
exclude.add(name)
2396
2397
client_dict["encrypted_secret"] = (client
2398
.encrypted_secret)
2399
for attr in client.client_structure:
2400
if attr not in exclude:
2401
client_dict[attr] = getattr(client, attr)
2402
2403
clients[client.name] = client_dict
2404
del client_settings[client.name]["secret"]
2405
2406
try:
2407
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2408
prefix="clients-",
2409
dir=os.path.dirname
2410
(stored_state_path))
2411
with os.fdopen(tempfd, "wb") as stored_state:
2412
pickle.dump((clients, client_settings), stored_state)
2413
os.rename(tempname, stored_state_path)
2414
except (IOError, OSError) as e:
2415
logger.warning("Could not save persistent state: {0}"
2416
.format(e))
2417
if not debug:
2418
try:
2419
os.remove(tempname)
2420
except NameError:
2421
pass
2422
if e.errno not in set((errno.ENOENT, errno.EACCES,
2423
errno.EEXIST)):
2424
raise e
2425
2426
# Delete all clients, and settings from config
2427
1925
while tcp_server.clients:
2428
name, client = tcp_server.clients.popitem()
1926
client = tcp_server.clients.pop()
2429
1927
if use_dbus:
2430
1928
client.remove_from_connection()
1929
client.disable_hook = None
2431
1930
# Don't signal anything except ClientRemoved
2432
1931
client.disable(quiet=True)
2433
1932
if use_dbus:
2434
1933
# Emit D-Bus signal
2435
mandos_dbus_service.ClientRemoved(client
2436
.dbus_object_path,
1934
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2437
1935
client.name)
2438
client_settings.clear()
2439
1936
2440
1937
atexit.register(cleanup)
2441
1938
2442
for client in tcp_server.clients.itervalues():
1939
for client in tcp_server.clients:
2443
1940
if use_dbus:
2444
1941
# Emit D-Bus signal
2445
1942
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2446
# Need to initiate checking of clients
2447
if client.enabled:
2448
client.init_checker()
1943
client.enable()
2449
1944
2450
1945
tcp_server.enable()
2451
1946
tcp_server.server_activate()
2453
1948
# Find out what port we got
2454
1949
service.port = tcp_server.socket.getsockname()[1]
2455
1950
if use_ipv6:
2456
logger.info("Now listening on address %r, port %d,"
1951
logger.info(u"Now listening on address %r, port %d,"
2457
1952
" flowinfo %d, scope_id %d"
2458
1953
% tcp_server.socket.getsockname())
2459
1954
else: # IPv4
2460
logger.info("Now listening on address %r, port %d"
1955
logger.info(u"Now listening on address %r, port %d"
2461
1956
% tcp_server.socket.getsockname())
2462
1957
2463
1958
#service.interface = tcp_server.socket.getsockname()[3]
2466
1961
# From the Avahi example code
2467
1962
try:
2468
1963
service.activate()
2469
except dbus.exceptions.DBusException as error:
2470
logger.critical("DBusException: %s", error)
1964
except dbus.exceptions.DBusException, error:
1965
logger.critical(u"DBusException: %s", error)
2471
1966
cleanup()
2472
1967
sys.exit(1)
2473
1968
# End of Avahi example code
2477
1972
(tcp_server.handle_request
2478
1973
(*args[2:], **kwargs) or True))
2479
1974
2480
logger.debug("Starting main loop")
1975
logger.debug(u"Starting main loop")
2481
1976
main_loop.run()
2482
except AvahiError as error:
2483
logger.critical("AvahiError: %s", error)
1977
except AvahiError, error:
1978
logger.critical(u"AvahiError: %s", error)
2484
1979
cleanup()
2485
1980
sys.exit(1)
2486
1981
except KeyboardInterrupt:
2487
1982
if debug:
2488
print("", file=sys.stderr)
2489
logger.debug("Server received KeyboardInterrupt")
2490
logger.debug("Server exiting")
1983
print >> sys.stderr
1984
logger.debug(u"Server received KeyboardInterrupt")
1985
logger.debug(u"Server exiting")
2491
1986
# Must run before the D-Bus bus name gets deregistered
2492
1987
cleanup()
2493
1988
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0