To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 291
- compare with another revision
- download diff
- download tarball
- view history from revision 291
- Committer: Teddy Hogeborn
- Date: 2009-01-31 10:33:17 UTC
- mfrom: (24.1.129 mandos)
- Revision ID: teddy@fukt.bsnet.se-20090131103317-wzqvyr532sjcjt7u
Merge from Björn:
* mandos-ctl: New option "--remove-client". Only default to listing
clients if no clients were given on the command line.
* plugins.d/mandos-client.c: Lower kernel log level while bringing up
network interface. New option "--delay"
to control the maximum delay to wait for
running interface.
* plugins.d/mandos-client.xml (SYNOPSIS, OPTIONS): New option
"--delay".
* mandos-ctl: New option "--remove-client". Only default to listing
clients if no clients were given on the command line.
* plugins.d/mandos-client.c: Lower kernel log level while bringing up
network interface. New option "--delay"
to control the maximum delay to wait for
running interface.
* plugins.d/mandos-client.xml (SYNOPSIS, OPTIONS): New option
"--delay".
- files removed:
- DBUS-API
- debian/source
- network-hooks.d
- files modified:
- .bzrignore
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
import SocketServer as socketserver
36
import SocketServer
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
45
44
import gnutls.library.functions
46
45
import gnutls.library.constants
47
46
import gnutls.library.types
48
import ConfigParser as configparser
47
import ConfigParser
49
48
import sys
50
49
import re
51
50
import os
52
51
import signal
52
from sets import Set
53
53
import subprocess
54
54
import atexit
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
import contextlib
60
import struct
61
import fcntl
62
import functools
63
import cPickle as pickle
64
import multiprocessing
65
import types
66
import binascii
67
import tempfile
68
import itertools
59
from contextlib import closing
69
60
70
61
import dbus
71
62
import dbus.service
74
65
from dbus.mainloop.glib import DBusGMainLoop
75
66
import ctypes
76
67
import ctypes.util
77
import xml.dom.minidom
78
import inspect
79
import GnuPGInterface
80
81
try:
82
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
83
except AttributeError:
84
try:
85
from IN import SO_BINDTODEVICE
86
except ImportError:
87
SO_BINDTODEVICE = None
88
89
version = "1.5.3"
90
stored_state_file = "clients.pickle"
91
92
logger = logging.getLogger()
68
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
93
72
syslogger = (logging.handlers.SysLogHandler
94
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
address = str("/dev/log")))
96
97
try:
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
101
except (OSError, AttributeError):
102
def if_nametoindex(interface):
103
"Get an interface index the hard way, i.e. using fcntl()"
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
with contextlib.closing(socket.socket()) as s:
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
111
return interface_index
112
113
114
def initlogger(debug, level=logging.WARNING):
115
"""init logger and add loglevel"""
116
117
syslogger.setFormatter(logging.Formatter
118
('Mandos [%(process)d]: %(levelname)s:'
119
' %(message)s'))
120
logger.addHandler(syslogger)
121
122
if debug:
123
console = logging.StreamHandler()
124
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
125
' [%(process)d]:'
126
' %(levelname)s:'
127
' %(message)s'))
128
logger.addHandler(console)
129
logger.setLevel(level)
130
131
132
class PGPError(Exception):
133
"""Exception if encryption/decryption fails"""
134
pass
135
136
137
class PGPEngine(object):
138
"""A simple class for OpenPGP symmetric encryption & decryption"""
139
def __init__(self):
140
self.gnupg = GnuPGInterface.GnuPG()
141
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
142
self.gnupg = GnuPGInterface.GnuPG()
143
self.gnupg.options.meta_interactive = False
144
self.gnupg.options.homedir = self.tempdir
145
self.gnupg.options.extra_args.extend(['--force-mdc',
146
'--quiet',
147
'--no-use-agent'])
148
149
def __enter__(self):
150
return self
151
152
def __exit__ (self, exc_type, exc_value, traceback):
153
self._cleanup()
154
return False
155
156
def __del__(self):
157
self._cleanup()
158
159
def _cleanup(self):
160
if self.tempdir is not None:
161
# Delete contents of tempdir
162
for root, dirs, files in os.walk(self.tempdir,
163
topdown = False):
164
for filename in files:
165
os.remove(os.path.join(root, filename))
166
for dirname in dirs:
167
os.rmdir(os.path.join(root, dirname))
168
# Remove tempdir
169
os.rmdir(self.tempdir)
170
self.tempdir = None
171
172
def password_encode(self, password):
173
# Passphrase can not be empty and can not contain newlines or
174
# NUL bytes. So we prefix it and hex encode it.
175
return b"mandos" + binascii.hexlify(password)
176
177
def encrypt(self, data, password):
178
self.gnupg.passphrase = self.password_encode(password)
179
with open(os.devnull, "w") as devnull:
180
try:
181
proc = self.gnupg.run(['--symmetric'],
182
create_fhs=['stdin', 'stdout'],
183
attach_fhs={'stderr': devnull})
184
with contextlib.closing(proc.handles['stdin']) as f:
185
f.write(data)
186
with contextlib.closing(proc.handles['stdout']) as f:
187
ciphertext = f.read()
188
proc.wait()
189
except IOError as e:
190
raise PGPError(e)
191
self.gnupg.passphrase = None
192
return ciphertext
193
194
def decrypt(self, data, password):
195
self.gnupg.passphrase = self.password_encode(password)
196
with open(os.devnull, "w") as devnull:
197
try:
198
proc = self.gnupg.run(['--decrypt'],
199
create_fhs=['stdin', 'stdout'],
200
attach_fhs={'stderr': devnull})
201
with contextlib.closing(proc.handles['stdin']) as f:
202
f.write(data)
203
with contextlib.closing(proc.handles['stdout']) as f:
204
decrypted_plaintext = f.read()
205
proc.wait()
206
except IOError as e:
207
raise PGPError(e)
208
self.gnupg.passphrase = None
209
return decrypted_plaintext
210
211
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
77
logger.addHandler(syslogger)
78
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
212
83
213
84
class AvahiError(Exception):
214
85
def __init__(self, value, *args, **kwargs):
226
97
227
98
class AvahiService(object):
228
99
"""An Avahi (Zeroconf) service.
229
230
100
Attributes:
231
101
interface: integer; avahi.IF_UNSPEC or an interface index.
232
102
Used to optionally bind to the specified interface.
240
110
max_renames: integer; maximum number of renames
241
111
rename_count: integer; counter so we only rename after collisions
242
112
a sensible number of times
243
group: D-Bus Entry Group
244
server: D-Bus Server
245
bus: dbus.SystemBus()
246
113
"""
247
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
248
115
servicetype = None, port = None, TXT = None,
249
domain = "", host = "", max_renames = 32768,
250
protocol = avahi.PROTO_UNSPEC, bus = None):
116
domain = "", host = "", max_renames = 32768):
251
117
self.interface = interface
252
118
self.name = name
253
119
self.type = servicetype
257
123
self.host = host
258
124
self.rename_count = 0
259
125
self.max_renames = max_renames
260
self.protocol = protocol
261
self.group = None # our entry group
262
self.server = None
263
self.bus = bus
264
self.entry_group_state_changed_match = None
265
126
def rename(self):
266
127
"""Derived from the Avahi example code"""
267
128
if self.rename_count >= self.max_renames:
268
logger.critical("No suitable Zeroconf service name found"
269
" after %i retries, exiting.",
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
270
131
self.rename_count)
271
raise AvahiServiceError("Too many renames")
272
self.name = unicode(self.server
273
.GetAlternativeServiceName(self.name))
274
logger.info("Changing Zeroconf service name to %r ...",
275
self.name)
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
276
139
self.remove()
277
try:
278
self.add()
279
except dbus.exceptions.DBusException as error:
280
logger.critical("DBusException: %s", error)
281
self.cleanup()
282
os._exit(1)
140
self.add()
283
141
self.rename_count += 1
284
142
def remove(self):
285
143
"""Derived from the Avahi example code"""
286
if self.entry_group_state_changed_match is not None:
287
self.entry_group_state_changed_match.remove()
288
self.entry_group_state_changed_match = None
289
if self.group is not None:
290
self.group.Reset()
144
if group is not None:
145
group.Reset()
291
146
def add(self):
292
147
"""Derived from the Avahi example code"""
293
self.remove()
294
if self.group is None:
295
self.group = dbus.Interface(
296
self.bus.get_object(avahi.DBUS_NAME,
297
self.server.EntryGroupNew()),
298
avahi.DBUS_INTERFACE_ENTRY_GROUP)
299
self.entry_group_state_changed_match = (
300
self.group.connect_to_signal(
301
'StateChanged', self.entry_group_state_changed))
302
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
303
self.name, self.type)
304
self.group.AddService(
305
self.interface,
306
self.protocol,
307
dbus.UInt32(0), # flags
308
self.name, self.type,
309
self.domain, self.host,
310
dbus.UInt16(self.port),
311
avahi.string_array_to_txt_array(self.TXT))
312
self.group.Commit()
313
def entry_group_state_changed(self, state, error):
314
"""Derived from the Avahi example code"""
315
logger.debug("Avahi entry group state change: %i", state)
316
317
if state == avahi.ENTRY_GROUP_ESTABLISHED:
318
logger.debug("Zeroconf service established.")
319
elif state == avahi.ENTRY_GROUP_COLLISION:
320
logger.info("Zeroconf service name collision.")
321
self.rename()
322
elif state == avahi.ENTRY_GROUP_FAILURE:
323
logger.critical("Avahi: Error in group state changed %s",
324
unicode(error))
325
raise AvahiGroupError("State changed: %s"
326
% unicode(error))
327
def cleanup(self):
328
"""Derived from the Avahi example code"""
329
if self.group is not None:
330
try:
331
self.group.Free()
332
except (dbus.exceptions.UnknownMethodException,
333
dbus.exceptions.DBusException):
334
pass
335
self.group = None
336
self.remove()
337
def server_state_changed(self, state, error=None):
338
"""Derived from the Avahi example code"""
339
logger.debug("Avahi server state change: %i", state)
340
bad_states = { avahi.SERVER_INVALID:
341
"Zeroconf server invalid",
342
avahi.SERVER_REGISTERING: None,
343
avahi.SERVER_COLLISION:
344
"Zeroconf server name collision",
345
avahi.SERVER_FAILURE:
346
"Zeroconf server failure" }
347
if state in bad_states:
348
if bad_states[state] is not None:
349
if error is None:
350
logger.error(bad_states[state])
351
else:
352
logger.error(bad_states[state] + ": %r", error)
353
self.cleanup()
354
elif state == avahi.SERVER_RUNNING:
355
self.add()
356
else:
357
if error is None:
358
logger.debug("Unknown state: %r", state)
359
else:
360
logger.debug("Unknown state: %r: %r", state, error)
361
def activate(self):
362
"""Derived from the Avahi example code"""
363
if self.server is None:
364
self.server = dbus.Interface(
365
self.bus.get_object(avahi.DBUS_NAME,
366
avahi.DBUS_PATH_SERVER,
367
follow_name_owner_changes=True),
368
avahi.DBUS_INTERFACE_SERVER)
369
self.server.connect_to_signal("StateChanged",
370
self.server_state_changed)
371
self.server_state_changed(self.server.GetState())
372
373
class AvahiServiceToSyslog(AvahiService):
374
def rename(self):
375
"""Add the new name to the syslog messages"""
376
ret = AvahiService.rename(self)
377
syslogger.setFormatter(logging.Formatter
378
('Mandos (%s) [%%(process)d]:'
379
' %%(levelname)s: %%(message)s'
380
% self.name))
381
return ret
382
383
def timedelta_to_milliseconds(td):
384
"Convert a datetime.timedelta() to milliseconds"
385
return ((td.days * 24 * 60 * 60 * 1000)
386
+ (td.seconds * 1000)
387
+ (td.microseconds // 1000))
388
389
class Client(object):
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
390
179
"""A representation of a client host served by this server.
391
392
180
Attributes:
393
approved: bool(); 'None' if not yet approved/disapproved
394
approval_delay: datetime.timedelta(); Time to wait for approval
395
approval_duration: datetime.timedelta(); Duration of one approval
181
name: string; from the config file, used in log messages and
182
D-Bus identifiers
183
fingerprint: string (40 or 32 hexadecimal digits); used to
184
uniquely identify the client
185
secret: bytestring; sent verbatim (over TLS) to client
186
host: string; available for use by the checker command
187
created: datetime.datetime(); (UTC) object creation
188
last_enabled: datetime.datetime(); (UTC)
189
enabled: bool()
190
last_checked_ok: datetime.datetime(); (UTC) or None
191
timeout: datetime.timedelta(); How long from last_checked_ok
192
until this client is invalid
193
interval: datetime.timedelta(); How often to start a new checker
194
disable_hook: If set, called by disable() as disable_hook(self)
396
195
checker: subprocess.Popen(); a running checker process used
397
196
to see if the client lives.
398
197
'None' if no process is running.
399
checker_callback_tag: a gobject event source tag, or None
400
checker_command: string; External command which is run to check
401
if client lives. %() expansions are done at
198
checker_initiator_tag: a gobject event source tag, or None
199
disable_initiator_tag: - '' -
200
checker_callback_tag: - '' -
201
checker_command: string; External command which is run to check if
202
client lives. %() expansions are done at
402
203
runtime with vars(self) as dict, so that for
403
204
instance %(name)s can be used in the command.
404
checker_initiator_tag: a gobject event source tag, or None
405
created: datetime.datetime(); (UTC) object creation
406
client_structure: Object describing what attributes a client has
407
and is used for storing the client at exit
408
current_checker_command: string; current running checker_command
409
disable_initiator_tag: a gobject event source tag, or None
410
enabled: bool()
411
fingerprint: string (40 or 32 hexadecimal digits); used to
412
uniquely identify the client
413
host: string; available for use by the checker command
414
interval: datetime.timedelta(); How often to start a new checker
415
last_approval_request: datetime.datetime(); (UTC) or None
416
last_checked_ok: datetime.datetime(); (UTC) or None
417
last_checker_status: integer between 0 and 255 reflecting exit
418
status of last checker. -1 reflects crashed
419
checker, -2 means no checker completed yet.
420
last_enabled: datetime.datetime(); (UTC) or None
421
name: string; from the config file, used in log messages and
422
D-Bus identifiers
423
secret: bytestring; sent verbatim (over TLS) to client
424
timeout: datetime.timedelta(); How long from last_checked_ok
425
until this client is disabled
426
extended_timeout: extra long timeout when secret has been sent
427
runtime_expansions: Allowed attributes for runtime expansion.
428
expires: datetime.datetime(); time (UTC) when a client will be
429
disabled, or None
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
430
207
"""
431
432
runtime_expansions = ("approval_delay", "approval_duration",
433
"created", "enabled", "fingerprint",
434
"host", "interval", "last_checked_ok",
435
"last_enabled", "name", "timeout")
436
client_defaults = { "timeout": "5m",
437
"extended_timeout": "15m",
438
"interval": "2m",
439
"checker": "fping -q -- %%(host)s",
440
"host": "",
441
"approval_delay": "0s",
442
"approval_duration": "1s",
443
"approved_by_default": "True",
444
"enabled": "True",
445
}
446
447
208
def timeout_milliseconds(self):
448
209
"Return the 'timeout' attribute in milliseconds"
449
return timedelta_to_milliseconds(self.timeout)
450
451
def extended_timeout_milliseconds(self):
452
"Return the 'extended_timeout' attribute in milliseconds"
453
return timedelta_to_milliseconds(self.extended_timeout)
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
454
213
455
214
def interval_milliseconds(self):
456
215
"Return the 'interval' attribute in milliseconds"
457
return timedelta_to_milliseconds(self.interval)
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
458
219
459
def approval_delay_milliseconds(self):
460
return timedelta_to_milliseconds(self.approval_delay)
461
462
@staticmethod
463
def config_parser(config):
464
"""Construct a new dict of client settings of this form:
465
{ client_name: {setting_name: value, ...}, ...}
466
with exceptions for any special settings as defined above.
467
NOTE: Must be a pure function. Must return the same result
468
value given the same arguments.
469
"""
470
settings = {}
471
for client_name in config.sections():
472
section = dict(config.items(client_name))
473
client = settings[client_name] = {}
474
475
client["host"] = section["host"]
476
# Reformat values from string types to Python types
477
client["approved_by_default"] = config.getboolean(
478
client_name, "approved_by_default")
479
client["enabled"] = config.getboolean(client_name,
480
"enabled")
481
482
client["fingerprint"] = (section["fingerprint"].upper()
483
.replace(" ", ""))
484
if "secret" in section:
485
client["secret"] = section["secret"].decode("base64")
486
elif "secfile" in section:
487
with open(os.path.expanduser(os.path.expandvars
488
(section["secfile"])),
489
"rb") as secfile:
490
client["secret"] = secfile.read()
491
else:
492
raise TypeError("No secret or secfile for section %s"
493
% section)
494
client["timeout"] = string_to_delta(section["timeout"])
495
client["extended_timeout"] = string_to_delta(
496
section["extended_timeout"])
497
client["interval"] = string_to_delta(section["interval"])
498
client["approval_delay"] = string_to_delta(
499
section["approval_delay"])
500
client["approval_duration"] = string_to_delta(
501
section["approval_duration"])
502
client["checker_command"] = section["checker"]
503
client["last_approval_request"] = None
504
client["last_checked_ok"] = None
505
client["last_checker_status"] = -2
506
507
return settings
508
509
510
def __init__(self, settings, name = None):
220
def __init__(self, name = None, disable_hook=None, config=None,
221
use_dbus=True):
511
222
"""Note: the 'checker' key in 'config' sets the
512
223
'checker_command' attribute and *not* the 'checker'
513
224
attribute."""
514
225
self.name = name
515
# adding all client settings
516
for setting, value in settings.iteritems():
517
setattr(self, setting, value)
518
519
if self.enabled:
520
if not hasattr(self, "last_enabled"):
521
self.last_enabled = datetime.datetime.utcnow()
522
if not hasattr(self, "expires"):
523
self.expires = (datetime.datetime.utcnow()
524
+ self.timeout)
525
else:
526
self.last_enabled = None
527
self.expires = None
528
529
logger.debug("Creating client %r", self.name)
226
if config is None:
227
config = {}
228
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = False # During __init__
530
230
# Uppercase and remove spaces from fingerprint for later
531
231
# comparison purposes with return value from the fingerprint()
532
232
# function
533
logger.debug(" Fingerprint: %s", self.fingerprint)
534
self.created = settings.get("created",
535
datetime.datetime.utcnow())
536
537
# attributes specific for this server instance
233
self.fingerprint = (config["fingerprint"].upper()
234
.replace(u" ", u""))
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
239
with closing(open(os.path.expanduser
240
(os.path.expandvars
241
(config["secfile"])))) as secfile:
242
self.secret = secfile.read()
243
else:
244
raise TypeError(u"No secret or secfile for client %s"
245
% self.name)
246
self.host = config.get("host", "")
247
self.created = datetime.datetime.utcnow()
248
self.enabled = False
249
self.last_enabled = None
250
self.last_checked_ok = None
251
self.timeout = string_to_delta(config["timeout"])
252
self.interval = string_to_delta(config["interval"])
253
self.disable_hook = disable_hook
538
254
self.checker = None
539
255
self.checker_initiator_tag = None
540
256
self.disable_initiator_tag = None
541
257
self.checker_callback_tag = None
542
self.current_checker_command = None
543
self.approved = None
544
self.approvals_pending = 0
545
self.changedstate = (multiprocessing_manager
546
.Condition(multiprocessing_manager
547
.Lock()))
548
self.client_structure = [attr for attr in
549
self.__dict__.iterkeys()
550
if not attr.startswith("_")]
551
self.client_structure.append("client_structure")
552
553
for name, t in inspect.getmembers(type(self),
554
lambda obj:
555
isinstance(obj,
556
property)):
557
if not name.startswith("_"):
558
self.client_structure.append(name)
559
560
# Send notice to process children that client state has changed
561
def send_changedstate(self):
562
with self.changedstate:
563
self.changedstate.notify_all()
258
self.checker_command = config["checker"]
259
self.last_connect = None
260
# Only now, when this client is initialized, can it show up on
261
# the D-Bus
262
self.use_dbus = use_dbus
263
if self.use_dbus:
264
self.dbus_object_path = (dbus.ObjectPath
265
("/clients/"
266
+ self.name.replace(".", "_")))
267
dbus.service.Object.__init__(self, bus,
268
self.dbus_object_path)
564
269
565
270
def enable(self):
566
271
"""Start this client's checker and timeout hooks"""
567
if getattr(self, "enabled", False):
568
# Already enabled
569
return
570
self.send_changedstate()
571
self.expires = datetime.datetime.utcnow() + self.timeout
572
self.enabled = True
573
272
self.last_enabled = datetime.datetime.utcnow()
574
self.init_checker()
575
576
def disable(self, quiet=True):
577
"""Disable this client."""
578
if not getattr(self, "enabled", False):
579
return False
580
if not quiet:
581
self.send_changedstate()
582
if not quiet:
583
logger.info("Disabling client %s", self.name)
584
if getattr(self, "disable_initiator_tag", False):
585
gobject.source_remove(self.disable_initiator_tag)
586
self.disable_initiator_tag = None
587
self.expires = None
588
if getattr(self, "checker_initiator_tag", False):
589
gobject.source_remove(self.checker_initiator_tag)
590
self.checker_initiator_tag = None
591
self.stop_checker()
592
self.enabled = False
593
# Do not run this again if called by a gobject.timeout_add
594
return False
595
596
def __del__(self):
597
self.disable()
598
599
def init_checker(self):
600
273
# Schedule a new checker to be started an 'interval' from now,
601
274
# and every interval from then on.
602
275
self.checker_initiator_tag = (gobject.timeout_add
603
276
(self.interval_milliseconds(),
604
277
self.start_checker))
278
# Also start a new checker *right now*.
279
self.start_checker()
605
280
# Schedule a disable() when 'timeout' has passed
606
281
self.disable_initiator_tag = (gobject.timeout_add
607
282
(self.timeout_milliseconds(),
608
283
self.disable))
609
# Also start a new checker *right now*.
610
self.start_checker()
284
self.enabled = True
285
if self.use_dbus:
286
# Emit D-Bus signals
287
self.PropertyChanged(dbus.String(u"enabled"),
288
dbus.Boolean(True, variant_level=1))
289
self.PropertyChanged(dbus.String(u"last_enabled"),
290
(_datetime_to_dbus(self.last_enabled,
291
variant_level=1)))
292
293
def disable(self):
294
"""Disable this client."""
295
if not getattr(self, "enabled", False):
296
return False
297
logger.info(u"Disabling client %s", self.name)
298
if getattr(self, "disable_initiator_tag", False):
299
gobject.source_remove(self.disable_initiator_tag)
300
self.disable_initiator_tag = None
301
if getattr(self, "checker_initiator_tag", False):
302
gobject.source_remove(self.checker_initiator_tag)
303
self.checker_initiator_tag = None
304
self.stop_checker()
305
if self.disable_hook:
306
self.disable_hook(self)
307
self.enabled = False
308
if self.use_dbus:
309
# Emit D-Bus signal
310
self.PropertyChanged(dbus.String(u"enabled"),
311
dbus.Boolean(False, variant_level=1))
312
# Do not run this again if called by a gobject.timeout_add
313
return False
314
315
def __del__(self):
316
self.disable_hook = None
317
self.disable()
611
318
612
319
def checker_callback(self, pid, condition, command):
613
320
"""The checker has completed, so take appropriate actions."""
614
321
self.checker_callback_tag = None
615
322
self.checker = None
323
if self.use_dbus:
324
# Emit D-Bus signal
325
self.PropertyChanged(dbus.String(u"checker_running"),
326
dbus.Boolean(False, variant_level=1))
616
327
if os.WIFEXITED(condition):
617
self.last_checker_status = os.WEXITSTATUS(condition)
618
if self.last_checker_status == 0:
619
logger.info("Checker for %(name)s succeeded",
328
exitstatus = os.WEXITSTATUS(condition)
329
if exitstatus == 0:
330
logger.info(u"Checker for %(name)s succeeded",
620
331
vars(self))
621
332
self.checked_ok()
622
333
else:
623
logger.info("Checker for %(name)s failed",
334
logger.info(u"Checker for %(name)s failed",
624
335
vars(self))
336
if self.use_dbus:
337
# Emit D-Bus signal
338
self.CheckerCompleted(dbus.Int16(exitstatus),
339
dbus.Int64(condition),
340
dbus.String(command))
625
341
else:
626
self.last_checker_status = -1
627
logger.warning("Checker for %(name)s crashed?",
342
logger.warning(u"Checker for %(name)s crashed?",
628
343
vars(self))
344
if self.use_dbus:
345
# Emit D-Bus signal
346
self.CheckerCompleted(dbus.Int16(-1),
347
dbus.Int64(condition),
348
dbus.String(command))
629
349
630
350
def checked_ok(self):
631
"""Assert that the client has been seen, alive and well."""
351
"""Bump up the timeout for this client.
352
This should only be called when the client has been seen,
353
alive and well.
354
"""
632
355
self.last_checked_ok = datetime.datetime.utcnow()
633
self.last_checker_status = 0
634
self.bump_timeout()
635
636
def bump_timeout(self, timeout=None):
637
"""Bump up the timeout for this client."""
638
if timeout is None:
639
timeout = self.timeout
640
if self.disable_initiator_tag is not None:
641
gobject.source_remove(self.disable_initiator_tag)
642
if getattr(self, "enabled", False):
643
self.disable_initiator_tag = (gobject.timeout_add
644
(timedelta_to_milliseconds
645
(timeout), self.disable))
646
self.expires = datetime.datetime.utcnow() + timeout
647
648
def need_approval(self):
649
self.last_approval_request = datetime.datetime.utcnow()
356
gobject.source_remove(self.disable_initiator_tag)
357
self.disable_initiator_tag = (gobject.timeout_add
358
(self.timeout_milliseconds(),
359
self.disable))
360
if self.use_dbus:
361
# Emit D-Bus signal
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
365
variant_level=1)))
650
366
651
367
def start_checker(self):
652
368
"""Start a new checker subprocess if one is not running.
653
654
369
If a checker already exists, leave it running and do
655
370
nothing."""
656
371
# The reason for not killing a running checker is that if we
659
374
# client would inevitably timeout, since no checker would get
660
375
# a chance to run to completion. If we instead leave running
661
376
# checkers alone, the checker would have to take more time
662
# than 'timeout' for the client to be disabled, which is as it
663
# should be.
664
665
# If a checker exists, make sure it is not a zombie
666
try:
667
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
668
except (AttributeError, OSError) as error:
669
if (isinstance(error, OSError)
670
and error.errno != errno.ECHILD):
671
raise error
672
else:
673
if pid:
674
logger.warning("Checker was a zombie")
675
gobject.source_remove(self.checker_callback_tag)
676
self.checker_callback(pid, status,
677
self.current_checker_command)
678
# Start a new checker if needed
377
# than 'timeout' for the client to be declared invalid, which
378
# is as it should be.
679
379
if self.checker is None:
680
380
try:
681
381
# In case checker_command has exactly one % operator
682
382
command = self.checker_command % self.host
683
383
except TypeError:
684
384
# Escape attributes for the shell
685
escaped_attrs = dict(
686
(attr,
687
re.escape(unicode(str(getattr(self, attr, "")),
688
errors=
689
'replace')))
690
for attr in
691
self.runtime_expansions)
692
385
escaped_attrs = dict((key, re.escape(str(val)))
386
for key, val in
387
vars(self).iteritems())
693
388
try:
694
389
command = self.checker_command % escaped_attrs
695
except TypeError as error:
696
logger.error('Could not format string "%s":'
697
' %s', self.checker_command, error)
390
except TypeError, error:
391
logger.error(u'Could not format string "%s":'
392
u' %s', self.checker_command, error)
698
393
return True # Try again later
699
self.current_checker_command = command
700
394
try:
701
logger.info("Starting checker %r for %s",
395
logger.info(u"Starting checker %r for %s",
702
396
command, self.name)
703
397
# We don't need to redirect stdout and stderr, since
704
398
# in normal mode, that is already done by daemon(),
707
401
self.checker = subprocess.Popen(command,
708
402
close_fds=True,
709
403
shell=True, cwd="/")
404
if self.use_dbus:
405
# Emit D-Bus signal
406
self.CheckerStarted(command)
407
self.PropertyChanged(
408
dbus.String("checker_running"),
409
dbus.Boolean(True, variant_level=1))
710
410
self.checker_callback_tag = (gobject.child_watch_add
711
411
(self.checker.pid,
712
412
self.checker_callback,
713
413
data=command))
714
# The checker may have completed before the gobject
715
# watch was added. Check for this.
716
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
717
if pid:
718
gobject.source_remove(self.checker_callback_tag)
719
self.checker_callback(pid, status, command)
720
except OSError as error:
721
logger.error("Failed to start subprocess: %s",
414
except OSError, error:
415
logger.error(u"Failed to start subprocess: %s",
722
416
error)
723
417
# Re-run this periodically if run by gobject.timeout_add
724
418
return True
730
424
self.checker_callback_tag = None
731
425
if getattr(self, "checker", None) is None:
732
426
return
733
logger.debug("Stopping checker for %(name)s", vars(self))
427
logger.debug(u"Stopping checker for %(name)s", vars(self))
734
428
try:
735
429
os.kill(self.checker.pid, signal.SIGTERM)
736
#time.sleep(0.5)
430
#os.sleep(0.5)
737
431
#if self.checker.poll() is None:
738
432
# os.kill(self.checker.pid, signal.SIGKILL)
739
except OSError as error:
433
except OSError, error:
740
434
if error.errno != errno.ESRCH: # No such process
741
435
raise
742
436
self.checker = None
743
744
745
def dbus_service_property(dbus_interface, signature="v",
746
access="readwrite", byte_arrays=False):
747
"""Decorators for marking methods of a DBusObjectWithProperties to
748
become properties on the D-Bus.
749
750
The decorated method will be called with no arguments by "Get"
751
and with one argument by "Set".
752
753
The parameters, where they are supported, are the same as
754
dbus.service.method, except there is only "signature", since the
755
type from Get() and the type sent to Set() is the same.
756
"""
757
# Encoding deeply encoded byte arrays is not supported yet by the
758
# "Set" method, so we fail early here:
759
if byte_arrays and signature != "ay":
760
raise ValueError("Byte arrays not supported for non-'ay'"
761
" signature %r" % signature)
762
def decorator(func):
763
func._dbus_is_property = True
764
func._dbus_interface = dbus_interface
765
func._dbus_signature = signature
766
func._dbus_access = access
767
func._dbus_name = func.__name__
768
if func._dbus_name.endswith("_dbus_property"):
769
func._dbus_name = func._dbus_name[:-14]
770
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
771
return func
772
return decorator
773
774
775
def dbus_interface_annotations(dbus_interface):
776
"""Decorator for marking functions returning interface annotations.
777
778
Usage:
779
780
@dbus_interface_annotations("org.example.Interface")
781
def _foo(self): # Function name does not matter
782
return {"org.freedesktop.DBus.Deprecated": "true",
783
"org.freedesktop.DBus.Property.EmitsChangedSignal":
784
"false"}
785
"""
786
def decorator(func):
787
func._dbus_is_interface = True
788
func._dbus_interface = dbus_interface
789
func._dbus_name = dbus_interface
790
return func
791
return decorator
792
793
794
class DBusPropertyException(dbus.exceptions.DBusException):
795
"""A base class for D-Bus property-related exceptions
796
"""
797
def __unicode__(self):
798
return unicode(str(self))
799
800
801
class DBusPropertyAccessException(DBusPropertyException):
802
"""A property's access permissions disallows an operation.
803
"""
804
pass
805
806
807
class DBusPropertyNotFound(DBusPropertyException):
808
"""An attempt was made to access a non-existing property.
809
"""
810
pass
811
812
813
class DBusObjectWithProperties(dbus.service.Object):
814
"""A D-Bus object with properties.
815
816
Classes inheriting from this can use the dbus_service_property
817
decorator to expose methods as D-Bus properties. It exposes the
818
standard Get(), Set(), and GetAll() methods on the D-Bus.
819
"""
820
821
@staticmethod
822
def _is_dbus_thing(thing):
823
"""Returns a function testing if an attribute is a D-Bus thing
824
825
If called like _is_dbus_thing("method") it returns a function
826
suitable for use as predicate to inspect.getmembers().
827
"""
828
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
829
False)
830
831
def _get_all_dbus_things(self, thing):
832
"""Returns a generator of (name, attribute) pairs
833
"""
834
return ((athing.__get__(self)._dbus_name,
835
athing.__get__(self))
836
for cls in self.__class__.__mro__
837
for name, athing in
838
inspect.getmembers(cls,
839
self._is_dbus_thing(thing)))
840
841
def _get_dbus_property(self, interface_name, property_name):
842
"""Returns a bound method if one exists which is a D-Bus
843
property with the specified name and interface.
844
"""
845
for cls in self.__class__.__mro__:
846
for name, value in (inspect.getmembers
847
(cls,
848
self._is_dbus_thing("property"))):
849
if (value._dbus_name == property_name
850
and value._dbus_interface == interface_name):
851
return value.__get__(self)
852
853
# No such property
854
raise DBusPropertyNotFound(self.dbus_object_path + ":"
855
+ interface_name + "."
856
+ property_name)
857
858
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
859
out_signature="v")
860
def Get(self, interface_name, property_name):
861
"""Standard D-Bus property Get() method, see D-Bus standard.
862
"""
863
prop = self._get_dbus_property(interface_name, property_name)
864
if prop._dbus_access == "write":
865
raise DBusPropertyAccessException(property_name)
866
value = prop()
867
if not hasattr(value, "variant_level"):
868
return value
869
return type(value)(value, variant_level=value.variant_level+1)
870
871
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
872
def Set(self, interface_name, property_name, value):
873
"""Standard D-Bus property Set() method, see D-Bus standard.
874
"""
875
prop = self._get_dbus_property(interface_name, property_name)
876
if prop._dbus_access == "read":
877
raise DBusPropertyAccessException(property_name)
878
if prop._dbus_get_args_options["byte_arrays"]:
879
# The byte_arrays option is not supported yet on
880
# signatures other than "ay".
881
if prop._dbus_signature != "ay":
882
raise ValueError
883
value = dbus.ByteArray(b''.join(chr(byte)
884
for byte in value))
885
prop(value)
886
887
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
888
out_signature="a{sv}")
889
def GetAll(self, interface_name):
890
"""Standard D-Bus property GetAll() method, see D-Bus
891
standard.
892
893
Note: Will not include properties with access="write".
894
"""
895
properties = {}
896
for name, prop in self._get_all_dbus_things("property"):
897
if (interface_name
898
and interface_name != prop._dbus_interface):
899
# Interface non-empty but did not match
900
continue
901
# Ignore write-only properties
902
if prop._dbus_access == "write":
903
continue
904
value = prop()
905
if not hasattr(value, "variant_level"):
906
properties[name] = value
907
continue
908
properties[name] = type(value)(value, variant_level=
909
value.variant_level+1)
910
return dbus.Dictionary(properties, signature="sv")
911
912
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
913
out_signature="s",
914
path_keyword='object_path',
915
connection_keyword='connection')
916
def Introspect(self, object_path, connection):
917
"""Overloading of standard D-Bus method.
918
919
Inserts property tags and interface annotation tags.
920
"""
921
xmlstring = dbus.service.Object.Introspect(self, object_path,
922
connection)
923
try:
924
document = xml.dom.minidom.parseString(xmlstring)
925
def make_tag(document, name, prop):
926
e = document.createElement("property")
927
e.setAttribute("name", name)
928
e.setAttribute("type", prop._dbus_signature)
929
e.setAttribute("access", prop._dbus_access)
930
return e
931
for if_tag in document.getElementsByTagName("interface"):
932
# Add property tags
933
for tag in (make_tag(document, name, prop)
934
for name, prop
935
in self._get_all_dbus_things("property")
936
if prop._dbus_interface
937
== if_tag.getAttribute("name")):
938
if_tag.appendChild(tag)
939
# Add interface annotation tags
940
for annotation, value in dict(
941
itertools.chain(
942
*(annotations().iteritems()
943
for name, annotations in
944
self._get_all_dbus_things("interface")
945
if name == if_tag.getAttribute("name")
946
))).iteritems():
947
attr_tag = document.createElement("annotation")
948
attr_tag.setAttribute("name", annotation)
949
attr_tag.setAttribute("value", value)
950
if_tag.appendChild(attr_tag)
951
# Add the names to the return values for the
952
# "org.freedesktop.DBus.Properties" methods
953
if (if_tag.getAttribute("name")
954
== "org.freedesktop.DBus.Properties"):
955
for cn in if_tag.getElementsByTagName("method"):
956
if cn.getAttribute("name") == "Get":
957
for arg in cn.getElementsByTagName("arg"):
958
if (arg.getAttribute("direction")
959
== "out"):
960
arg.setAttribute("name", "value")
961
elif cn.getAttribute("name") == "GetAll":
962
for arg in cn.getElementsByTagName("arg"):
963
if (arg.getAttribute("direction")
964
== "out"):
965
arg.setAttribute("name", "props")
966
xmlstring = document.toxml("utf-8")
967
document.unlink()
968
except (AttributeError, xml.dom.DOMException,
969
xml.parsers.expat.ExpatError) as error:
970
logger.error("Failed to override Introspection method",
971
error)
972
return xmlstring
973
974
975
def datetime_to_dbus (dt, variant_level=0):
976
"""Convert a UTC datetime.datetime() to a D-Bus type."""
977
if dt is None:
978
return dbus.String("", variant_level = variant_level)
979
return dbus.String(dt.isoformat(),
980
variant_level=variant_level)
981
982
983
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
984
.__metaclass__):
985
"""Applied to an empty subclass of a D-Bus object, this metaclass
986
will add additional D-Bus attributes matching a certain pattern.
987
"""
988
def __new__(mcs, name, bases, attr):
989
# Go through all the base classes which could have D-Bus
990
# methods, signals, or properties in them
991
old_interface_names = []
992
for base in (b for b in bases
993
if issubclass(b, dbus.service.Object)):
994
# Go though all attributes of the base class
995
for attrname, attribute in inspect.getmembers(base):
996
# Ignore non-D-Bus attributes, and D-Bus attributes
997
# with the wrong interface name
998
if (not hasattr(attribute, "_dbus_interface")
999
or not attribute._dbus_interface
1000
.startswith("se.recompile.Mandos")):
1001
continue
1002
# Create an alternate D-Bus interface name based on
1003
# the current name
1004
alt_interface = (attribute._dbus_interface
1005
.replace("se.recompile.Mandos",
1006
"se.bsnet.fukt.Mandos"))
1007
if alt_interface != attribute._dbus_interface:
1008
old_interface_names.append(alt_interface)
1009
# Is this a D-Bus signal?
1010
if getattr(attribute, "_dbus_is_signal", False):
1011
# Extract the original non-method function by
1012
# black magic
1013
nonmethod_func = (dict(
1014
zip(attribute.func_code.co_freevars,
1015
attribute.__closure__))["func"]
1016
.cell_contents)
1017
# Create a new, but exactly alike, function
1018
# object, and decorate it to be a new D-Bus signal
1019
# with the alternate D-Bus interface name
1020
new_function = (dbus.service.signal
1021
(alt_interface,
1022
attribute._dbus_signature)
1023
(types.FunctionType(
1024
nonmethod_func.func_code,
1025
nonmethod_func.func_globals,
1026
nonmethod_func.func_name,
1027
nonmethod_func.func_defaults,
1028
nonmethod_func.func_closure)))
1029
# Define a creator of a function to call both the
1030
# old and new functions, so both the old and new
1031
# signals gets sent when the function is called
1032
def fixscope(func1, func2):
1033
"""This function is a scope container to pass
1034
func1 and func2 to the "call_both" function
1035
outside of its arguments"""
1036
def call_both(*args, **kwargs):
1037
"""This function will emit two D-Bus
1038
signals by calling func1 and func2"""
1039
func1(*args, **kwargs)
1040
func2(*args, **kwargs)
1041
return call_both
1042
# Create the "call_both" function and add it to
1043
# the class
1044
attr[attrname] = fixscope(attribute,
1045
new_function)
1046
# Is this a D-Bus method?
1047
elif getattr(attribute, "_dbus_is_method", False):
1048
# Create a new, but exactly alike, function
1049
# object. Decorate it to be a new D-Bus method
1050
# with the alternate D-Bus interface name. Add it
1051
# to the class.
1052
attr[attrname] = (dbus.service.method
1053
(alt_interface,
1054
attribute._dbus_in_signature,
1055
attribute._dbus_out_signature)
1056
(types.FunctionType
1057
(attribute.func_code,
1058
attribute.func_globals,
1059
attribute.func_name,
1060
attribute.func_defaults,
1061
attribute.func_closure)))
1062
# Is this a D-Bus property?
1063
elif getattr(attribute, "_dbus_is_property", False):
1064
# Create a new, but exactly alike, function
1065
# object, and decorate it to be a new D-Bus
1066
# property with the alternate D-Bus interface
1067
# name. Add it to the class.
1068
attr[attrname] = (dbus_service_property
1069
(alt_interface,
1070
attribute._dbus_signature,
1071
attribute._dbus_access,
1072
attribute
1073
._dbus_get_args_options
1074
["byte_arrays"])
1075
(types.FunctionType
1076
(attribute.func_code,
1077
attribute.func_globals,
1078
attribute.func_name,
1079
attribute.func_defaults,
1080
attribute.func_closure)))
1081
# Is this a D-Bus interface?
1082
elif getattr(attribute, "_dbus_is_interface", False):
1083
# Create a new, but exactly alike, function
1084
# object. Decorate it to be a new D-Bus interface
1085
# with the alternate D-Bus interface name. Add it
1086
# to the class.
1087
attr[attrname] = (dbus_interface_annotations
1088
(alt_interface)
1089
(types.FunctionType
1090
(attribute.func_code,
1091
attribute.func_globals,
1092
attribute.func_name,
1093
attribute.func_defaults,
1094
attribute.func_closure)))
1095
# Deprecate all old interfaces
1096
basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"
1097
for old_interface_name in old_interface_names:
1098
@dbus_interface_annotations(old_interface_name)
1099
def func(self):
1100
return { "org.freedesktop.DBus.Deprecated": "true" }
1101
# Find an unused name
1102
for aname in (basename.format(i) for i in
1103
itertools.count()):
1104
if aname not in attr:
1105
attr[aname] = func
1106
break
1107
return type.__new__(mcs, name, bases, attr)
1108
1109
1110
class ClientDBus(Client, DBusObjectWithProperties):
1111
"""A Client class using D-Bus
1112
1113
Attributes:
1114
dbus_object_path: dbus.ObjectPath
1115
bus: dbus.SystemBus()
1116
"""
1117
1118
runtime_expansions = (Client.runtime_expansions
1119
+ ("dbus_object_path",))
1120
1121
# dbus.service.Object doesn't use super(), so we can't either.
1122
1123
def __init__(self, bus = None, *args, **kwargs):
1124
self.bus = bus
1125
Client.__init__(self, *args, **kwargs)
1126
# Only now, when this client is initialized, can it show up on
1127
# the D-Bus
1128
client_object_name = unicode(self.name).translate(
1129
{ord("."): ord("_"),
1130
ord("-"): ord("_")})
1131
self.dbus_object_path = (dbus.ObjectPath
1132
("/clients/" + client_object_name))
1133
DBusObjectWithProperties.__init__(self, self.bus,
1134
self.dbus_object_path)
1135
1136
def notifychangeproperty(transform_func,
1137
dbus_name, type_func=lambda x: x,
1138
variant_level=1):
1139
""" Modify a variable so that it's a property which announces
1140
its changes to DBus.
1141
1142
transform_fun: Function that takes a value and a variant_level
1143
and transforms it to a D-Bus type.
1144
dbus_name: D-Bus name of the variable
1145
type_func: Function that transform the value before sending it
1146
to the D-Bus. Default: no transform
1147
variant_level: D-Bus variant level. Default: 1
1148
"""
1149
attrname = "_{0}".format(dbus_name)
1150
def setter(self, value):
1151
if hasattr(self, "dbus_object_path"):
1152
if (not hasattr(self, attrname) or
1153
type_func(getattr(self, attrname, None))
1154
!= type_func(value)):
1155
dbus_value = transform_func(type_func(value),
1156
variant_level
1157
=variant_level)
1158
self.PropertyChanged(dbus.String(dbus_name),
1159
dbus_value)
1160
setattr(self, attrname, value)
1161
1162
return property(lambda self: getattr(self, attrname), setter)
1163
1164
1165
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1166
approvals_pending = notifychangeproperty(dbus.Boolean,
1167
"ApprovalPending",
1168
type_func = bool)
1169
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1170
last_enabled = notifychangeproperty(datetime_to_dbus,
1171
"LastEnabled")
1172
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1173
type_func = lambda checker:
1174
checker is not None)
1175
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1176
"LastCheckedOK")
1177
last_checker_status = notifychangeproperty(dbus.Int16,
1178
"LastCheckerStatus")
1179
last_approval_request = notifychangeproperty(
1180
datetime_to_dbus, "LastApprovalRequest")
1181
approved_by_default = notifychangeproperty(dbus.Boolean,
1182
"ApprovedByDefault")
1183
approval_delay = notifychangeproperty(dbus.UInt64,
1184
"ApprovalDelay",
1185
type_func =
1186
timedelta_to_milliseconds)
1187
approval_duration = notifychangeproperty(
1188
dbus.UInt64, "ApprovalDuration",
1189
type_func = timedelta_to_milliseconds)
1190
host = notifychangeproperty(dbus.String, "Host")
1191
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1192
type_func =
1193
timedelta_to_milliseconds)
1194
extended_timeout = notifychangeproperty(
1195
dbus.UInt64, "ExtendedTimeout",
1196
type_func = timedelta_to_milliseconds)
1197
interval = notifychangeproperty(dbus.UInt64,
1198
"Interval",
1199
type_func =
1200
timedelta_to_milliseconds)
1201
checker_command = notifychangeproperty(dbus.String, "Checker")
1202
1203
del notifychangeproperty
1204
1205
def __del__(self, *args, **kwargs):
1206
try:
1207
self.remove_from_connection()
1208
except LookupError:
1209
pass
1210
if hasattr(DBusObjectWithProperties, "__del__"):
1211
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1212
Client.__del__(self, *args, **kwargs)
1213
1214
def checker_callback(self, pid, condition, command,
1215
*args, **kwargs):
1216
self.checker_callback_tag = None
1217
self.checker = None
1218
if os.WIFEXITED(condition):
1219
exitstatus = os.WEXITSTATUS(condition)
1220
# Emit D-Bus signal
1221
self.CheckerCompleted(dbus.Int16(exitstatus),
1222
dbus.Int64(condition),
1223
dbus.String(command))
1224
else:
1225
# Emit D-Bus signal
1226
self.CheckerCompleted(dbus.Int16(-1),
1227
dbus.Int64(condition),
1228
dbus.String(command))
1229
1230
return Client.checker_callback(self, pid, condition, command,
1231
*args, **kwargs)
1232
1233
def start_checker(self, *args, **kwargs):
1234
old_checker = self.checker
1235
if self.checker is not None:
1236
old_checker_pid = self.checker.pid
1237
else:
1238
old_checker_pid = None
1239
r = Client.start_checker(self, *args, **kwargs)
1240
# Only if new checker process was started
1241
if (self.checker is not None
1242
and old_checker_pid != self.checker.pid):
1243
# Emit D-Bus signal
1244
self.CheckerStarted(self.current_checker_command)
1245
return r
1246
1247
def _reset_approved(self):
1248
self.approved = None
1249
return False
1250
1251
def approve(self, value=True):
1252
self.send_changedstate()
1253
self.approved = value
1254
gobject.timeout_add(timedelta_to_milliseconds
1255
(self.approval_duration),
1256
self._reset_approved)
1257
1258
1259
## D-Bus methods, signals & properties
1260
_interface = "se.recompile.Mandos.Client"
1261
1262
## Interfaces
1263
1264
@dbus_interface_annotations(_interface)
1265
def _foo(self):
1266
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1267
"false"}
1268
1269
## Signals
437
if self.use_dbus:
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
440
441
def still_valid(self):
442
"""Has the timeout not yet passed for this client?"""
443
if not getattr(self, "enabled", False):
444
return False
445
now = datetime.datetime.utcnow()
446
if self.last_checked_ok is None:
447
return now < (self.created + self.timeout)
448
else:
449
return now < (self.last_checked_ok + self.timeout)
450
451
## D-Bus methods & signals
452
_interface = u"se.bsnet.fukt.Mandos.Client"
453
454
# CheckedOK - method
455
CheckedOK = dbus.service.method(_interface)(checked_ok)
456
CheckedOK.__name__ = "CheckedOK"
1270
457
1271
458
# CheckerCompleted - signal
1272
459
@dbus.service.signal(_interface, signature="nxs")
1280
467
"D-Bus signal"
1281
468
pass
1282
469
470
# GetAllProperties - method
471
@dbus.service.method(_interface, out_signature="a{sv}")
472
def GetAllProperties(self):
473
"D-Bus method"
474
return dbus.Dictionary({
475
dbus.String("name"):
476
dbus.String(self.name, variant_level=1),
477
dbus.String("fingerprint"):
478
dbus.String(self.fingerprint, variant_level=1),
479
dbus.String("host"):
480
dbus.String(self.host, variant_level=1),
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
485
variant_level=1)
486
if self.last_enabled is not None
487
else dbus.Boolean(False, variant_level=1)),
488
dbus.String("enabled"):
489
dbus.Boolean(self.enabled, variant_level=1),
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
492
variant_level=1)
493
if self.last_checked_ok is not None
494
else dbus.Boolean (False, variant_level=1)),
495
dbus.String("timeout"):
496
dbus.UInt64(self.timeout_milliseconds(),
497
variant_level=1),
498
dbus.String("interval"):
499
dbus.UInt64(self.interval_milliseconds(),
500
variant_level=1),
501
dbus.String("checker"):
502
dbus.String(self.checker_command,
503
variant_level=1),
504
dbus.String("checker_running"):
505
dbus.Boolean(self.checker is not None,
506
variant_level=1),
507
dbus.String("object_path"):
508
dbus.ObjectPath(self.dbus_object_path,
509
variant_level=1)
510
}, signature="sv")
511
512
# IsStillValid - method
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
514
(still_valid))
515
IsStillValid.__name__ = "IsStillValid"
516
1283
517
# PropertyChanged - signal
1284
518
@dbus.service.signal(_interface, signature="sv")
1285
519
def PropertyChanged(self, property, value):
1286
520
"D-Bus signal"
1287
521
pass
1288
522
1289
# GotSecret - signal
1290
@dbus.service.signal(_interface)
1291
def GotSecret(self):
1292
"""D-Bus signal
1293
Is sent after a successful transfer of secret from the Mandos
1294
server to mandos-client
1295
"""
1296
pass
1297
1298
# Rejected - signal
1299
@dbus.service.signal(_interface, signature="s")
1300
def Rejected(self, reason):
1301
"D-Bus signal"
1302
pass
1303
1304
# NeedApproval - signal
1305
@dbus.service.signal(_interface, signature="tb")
1306
def NeedApproval(self, timeout, default):
1307
"D-Bus signal"
1308
return self.need_approval()
1309
1310
## Methods
1311
1312
# Approve - method
1313
@dbus.service.method(_interface, in_signature="b")
1314
def Approve(self, value):
1315
self.approve(value)
1316
1317
# CheckedOK - method
1318
@dbus.service.method(_interface)
1319
def CheckedOK(self):
1320
self.checked_ok()
523
# SetChecker - method
524
@dbus.service.method(_interface, in_signature="s")
525
def SetChecker(self, checker):
526
"D-Bus setter method"
527
self.checker_command = checker
528
# Emit D-Bus signal
529
self.PropertyChanged(dbus.String(u"checker"),
530
dbus.String(self.checker_command,
531
variant_level=1))
532
533
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
537
self.host = host
538
# Emit D-Bus signal
539
self.PropertyChanged(dbus.String(u"host"),
540
dbus.String(self.host, variant_level=1))
541
542
# SetInterval - method
543
@dbus.service.method(_interface, in_signature="t")
544
def SetInterval(self, milliseconds):
545
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
546
# Emit D-Bus signal
547
self.PropertyChanged(dbus.String(u"interval"),
548
(dbus.UInt64(self.interval_milliseconds(),
549
variant_level=1)))
550
551
# SetSecret - method
552
@dbus.service.method(_interface, in_signature="ay",
553
byte_arrays=True)
554
def SetSecret(self, secret):
555
"D-Bus setter method"
556
self.secret = str(secret)
557
558
# SetTimeout - method
559
@dbus.service.method(_interface, in_signature="t")
560
def SetTimeout(self, milliseconds):
561
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
562
# Emit D-Bus signal
563
self.PropertyChanged(dbus.String(u"timeout"),
564
(dbus.UInt64(self.timeout_milliseconds(),
565
variant_level=1)))
1321
566
1322
567
# Enable - method
1323
@dbus.service.method(_interface)
1324
def Enable(self):
1325
"D-Bus method"
1326
self.enable()
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
1327
570
1328
571
# StartChecker - method
1329
572
@dbus.service.method(_interface)
1338
581
self.disable()
1339
582
1340
583
# StopChecker - method
1341
@dbus.service.method(_interface)
1342
def StopChecker(self):
1343
self.stop_checker()
1344
1345
## Properties
1346
1347
# ApprovalPending - property
1348
@dbus_service_property(_interface, signature="b", access="read")
1349
def ApprovalPending_dbus_property(self):
1350
return dbus.Boolean(bool(self.approvals_pending))
1351
1352
# ApprovedByDefault - property
1353
@dbus_service_property(_interface, signature="b",
1354
access="readwrite")
1355
def ApprovedByDefault_dbus_property(self, value=None):
1356
if value is None: # get
1357
return dbus.Boolean(self.approved_by_default)
1358
self.approved_by_default = bool(value)
1359
1360
# ApprovalDelay - property
1361
@dbus_service_property(_interface, signature="t",
1362
access="readwrite")
1363
def ApprovalDelay_dbus_property(self, value=None):
1364
if value is None: # get
1365
return dbus.UInt64(self.approval_delay_milliseconds())
1366
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1367
1368
# ApprovalDuration - property
1369
@dbus_service_property(_interface, signature="t",
1370
access="readwrite")
1371
def ApprovalDuration_dbus_property(self, value=None):
1372
if value is None: # get
1373
return dbus.UInt64(timedelta_to_milliseconds(
1374
self.approval_duration))
1375
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1376
1377
# Name - property
1378
@dbus_service_property(_interface, signature="s", access="read")
1379
def Name_dbus_property(self):
1380
return dbus.String(self.name)
1381
1382
# Fingerprint - property
1383
@dbus_service_property(_interface, signature="s", access="read")
1384
def Fingerprint_dbus_property(self):
1385
return dbus.String(self.fingerprint)
1386
1387
# Host - property
1388
@dbus_service_property(_interface, signature="s",
1389
access="readwrite")
1390
def Host_dbus_property(self, value=None):
1391
if value is None: # get
1392
return dbus.String(self.host)
1393
self.host = unicode(value)
1394
1395
# Created - property
1396
@dbus_service_property(_interface, signature="s", access="read")
1397
def Created_dbus_property(self):
1398
return datetime_to_dbus(self.created)
1399
1400
# LastEnabled - property
1401
@dbus_service_property(_interface, signature="s", access="read")
1402
def LastEnabled_dbus_property(self):
1403
return datetime_to_dbus(self.last_enabled)
1404
1405
# Enabled - property
1406
@dbus_service_property(_interface, signature="b",
1407
access="readwrite")
1408
def Enabled_dbus_property(self, value=None):
1409
if value is None: # get
1410
return dbus.Boolean(self.enabled)
1411
if value:
1412
self.enable()
1413
else:
1414
self.disable()
1415
1416
# LastCheckedOK - property
1417
@dbus_service_property(_interface, signature="s",
1418
access="readwrite")
1419
def LastCheckedOK_dbus_property(self, value=None):
1420
if value is not None:
1421
self.checked_ok()
1422
return
1423
return datetime_to_dbus(self.last_checked_ok)
1424
1425
# LastCheckerStatus - property
1426
@dbus_service_property(_interface, signature="n",
1427
access="read")
1428
def LastCheckerStatus_dbus_property(self):
1429
return dbus.Int16(self.last_checker_status)
1430
1431
# Expires - property
1432
@dbus_service_property(_interface, signature="s", access="read")
1433
def Expires_dbus_property(self):
1434
return datetime_to_dbus(self.expires)
1435
1436
# LastApprovalRequest - property
1437
@dbus_service_property(_interface, signature="s", access="read")
1438
def LastApprovalRequest_dbus_property(self):
1439
return datetime_to_dbus(self.last_approval_request)
1440
1441
# Timeout - property
1442
@dbus_service_property(_interface, signature="t",
1443
access="readwrite")
1444
def Timeout_dbus_property(self, value=None):
1445
if value is None: # get
1446
return dbus.UInt64(self.timeout_milliseconds())
1447
self.timeout = datetime.timedelta(0, 0, 0, value)
1448
# Reschedule timeout
1449
if self.enabled:
1450
now = datetime.datetime.utcnow()
1451
time_to_die = timedelta_to_milliseconds(
1452
(self.last_checked_ok + self.timeout) - now)
1453
if time_to_die <= 0:
1454
# The timeout has passed
1455
self.disable()
1456
else:
1457
self.expires = (now +
1458
datetime.timedelta(milliseconds =
1459
time_to_die))
1460
if (getattr(self, "disable_initiator_tag", None)
1461
is None):
1462
return
1463
gobject.source_remove(self.disable_initiator_tag)
1464
self.disable_initiator_tag = (gobject.timeout_add
1465
(time_to_die,
1466
self.disable))
1467
1468
# ExtendedTimeout - property
1469
@dbus_service_property(_interface, signature="t",
1470
access="readwrite")
1471
def ExtendedTimeout_dbus_property(self, value=None):
1472
if value is None: # get
1473
return dbus.UInt64(self.extended_timeout_milliseconds())
1474
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1475
1476
# Interval - property
1477
@dbus_service_property(_interface, signature="t",
1478
access="readwrite")
1479
def Interval_dbus_property(self, value=None):
1480
if value is None: # get
1481
return dbus.UInt64(self.interval_milliseconds())
1482
self.interval = datetime.timedelta(0, 0, 0, value)
1483
if getattr(self, "checker_initiator_tag", None) is None:
1484
return
1485
if self.enabled:
1486
# Reschedule checker run
1487
gobject.source_remove(self.checker_initiator_tag)
1488
self.checker_initiator_tag = (gobject.timeout_add
1489
(value, self.start_checker))
1490
self.start_checker() # Start one now, too
1491
1492
# Checker - property
1493
@dbus_service_property(_interface, signature="s",
1494
access="readwrite")
1495
def Checker_dbus_property(self, value=None):
1496
if value is None: # get
1497
return dbus.String(self.checker_command)
1498
self.checker_command = unicode(value)
1499
1500
# CheckerRunning - property
1501
@dbus_service_property(_interface, signature="b",
1502
access="readwrite")
1503
def CheckerRunning_dbus_property(self, value=None):
1504
if value is None: # get
1505
return dbus.Boolean(self.checker is not None)
1506
if value:
1507
self.start_checker()
1508
else:
1509
self.stop_checker()
1510
1511
# ObjectPath - property
1512
@dbus_service_property(_interface, signature="o", access="read")
1513
def ObjectPath_dbus_property(self):
1514
return self.dbus_object_path # is already a dbus.ObjectPath
1515
1516
# Secret = property
1517
@dbus_service_property(_interface, signature="ay",
1518
access="write", byte_arrays=True)
1519
def Secret_dbus_property(self, value):
1520
self.secret = str(value)
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
1521
586
1522
587
del _interface
1523
588
1524
589
1525
class ProxyClient(object):
1526
def __init__(self, child_pipe, fpr, address):
1527
self._pipe = child_pipe
1528
self._pipe.send(('init', fpr, address))
1529
if not self._pipe.recv():
1530
raise KeyError()
1531
1532
def __getattribute__(self, name):
1533
if name == '_pipe':
1534
return super(ProxyClient, self).__getattribute__(name)
1535
self._pipe.send(('getattr', name))
1536
data = self._pipe.recv()
1537
if data[0] == 'data':
1538
return data[1]
1539
if data[0] == 'function':
1540
def func(*args, **kwargs):
1541
self._pipe.send(('funcall', name, args, kwargs))
1542
return self._pipe.recv()[1]
1543
return func
1544
1545
def __setattr__(self, name, value):
1546
if name == '_pipe':
1547
return super(ProxyClient, self).__setattr__(name, value)
1548
self._pipe.send(('setattr', name, value))
1549
1550
1551
class ClientDBusTransitional(ClientDBus):
1552
__metaclass__ = AlternateDBusNamesMetaclass
1553
1554
1555
class ClientHandler(socketserver.BaseRequestHandler, object):
1556
"""A class to handle client connections.
1557
1558
Instantiated once for each connection to handle it.
590
def peer_certificate(session):
591
"Return the peer's OpenPGP certificate as a bytestring"
592
# If not an OpenPGP certificate...
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
596
# ...do the normal thing
597
return session.peer_certificate
598
list_size = ctypes.c_uint(1)
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
602
if not bool(cert_list) and list_size.value != 0:
603
raise gnutls.errors.GNUTLSError("error getting peer"
604
" certificate")
605
if list_size.value == 0:
606
return None
607
cert = cert_list[0]
608
return ctypes.string_at(cert.data, cert.size)
609
610
611
def fingerprint(openpgp):
612
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
613
# New GnuTLS "datum" with the OpenPGP public key
614
datum = (gnutls.library.types
615
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
616
ctypes.POINTER
617
(ctypes.c_ubyte)),
618
ctypes.c_uint(len(openpgp))))
619
# New empty GnuTLS certificate
620
crt = gnutls.library.types.gnutls_openpgp_crt_t()
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
623
# Import the OpenPGP public key into the certificate
624
(gnutls.library.functions
625
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
626
gnutls.library.constants
627
.GNUTLS_OPENPGP_FMT_RAW))
628
# Verify the self signature in the key
629
crtverify = ctypes.c_uint()
630
(gnutls.library.functions
631
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
632
if crtverify.value != 0:
633
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
634
raise gnutls.errors.CertificateSecurityError("Verify failed")
635
# New buffer for the fingerprint
636
buf = ctypes.create_string_buffer(20)
637
buf_len = ctypes.c_size_t()
638
# Get the fingerprint from the certificate into the buffer
639
(gnutls.library.functions
640
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
641
ctypes.byref(buf_len)))
642
# Deinit the certificate
643
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
644
# Convert the buffer to a Python bytestring
645
fpr = ctypes.string_at(buf, buf_len.value)
646
# Convert the bytestring to hexadecimal notation
647
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
648
return hex_fpr
649
650
651
class TCP_handler(SocketServer.BaseRequestHandler, object):
652
"""A TCP request handler class.
653
Instantiated by IPv6_TCPServer for each request to handle it.
1559
654
Note: This will run in its own forked process."""
1560
655
1561
656
def handle(self):
1562
with contextlib.closing(self.server.child_pipe) as child_pipe:
1563
logger.info("TCP connection from: %s",
1564
unicode(self.client_address))
1565
logger.debug("Pipe FD: %d",
1566
self.server.child_pipe.fileno())
1567
1568
session = (gnutls.connection
1569
.ClientSession(self.request,
1570
gnutls.connection
1571
.X509Credentials()))
1572
1573
# Note: gnutls.connection.X509Credentials is really a
1574
# generic GnuTLS certificate credentials object so long as
1575
# no X.509 keys are added to it. Therefore, we can use it
1576
# here despite using OpenPGP certificates.
1577
1578
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1579
# "+AES-256-CBC", "+SHA1",
1580
# "+COMP-NULL", "+CTYPE-OPENPGP",
1581
# "+DHE-DSS"))
1582
# Use a fallback default, since this MUST be set.
1583
priority = self.server.gnutls_priority
1584
if priority is None:
1585
priority = "NORMAL"
1586
(gnutls.library.functions
1587
.gnutls_priority_set_direct(session._c_object,
1588
priority, None))
1589
1590
# Start communication using the Mandos protocol
1591
# Get protocol number
1592
line = self.request.makefile().readline()
1593
logger.debug("Protocol version: %r", line)
1594
try:
1595
if int(line.strip().split()[0]) > 1:
1596
raise RuntimeError
1597
except (ValueError, IndexError, RuntimeError) as error:
1598
logger.error("Unknown protocol version: %s", error)
1599
return
1600
1601
# Start GnuTLS connection
1602
try:
1603
session.handshake()
1604
except gnutls.errors.GNUTLSError as error:
1605
logger.warning("Handshake failed: %s", error)
1606
# Do not run session.bye() here: the session is not
1607
# established. Just abandon the request.
1608
return
1609
logger.debug("Handshake succeeded")
1610
1611
approval_required = False
1612
try:
1613
try:
1614
fpr = self.fingerprint(self.peer_certificate
1615
(session))
1616
except (TypeError,
1617
gnutls.errors.GNUTLSError) as error:
1618
logger.warning("Bad certificate: %s", error)
1619
return
1620
logger.debug("Fingerprint: %s", fpr)
1621
1622
try:
1623
client = ProxyClient(child_pipe, fpr,
1624
self.client_address)
1625
except KeyError:
1626
return
1627
1628
if client.approval_delay:
1629
delay = client.approval_delay
1630
client.approvals_pending += 1
1631
approval_required = True
1632
1633
while True:
1634
if not client.enabled:
1635
logger.info("Client %s is disabled",
1636
client.name)
1637
if self.server.use_dbus:
1638
# Emit D-Bus signal
1639
client.Rejected("Disabled")
1640
return
1641
1642
if client.approved or not client.approval_delay:
1643
#We are approved or approval is disabled
1644
break
1645
elif client.approved is None:
1646
logger.info("Client %s needs approval",
1647
client.name)
1648
if self.server.use_dbus:
1649
# Emit D-Bus signal
1650
client.NeedApproval(
1651
client.approval_delay_milliseconds(),
1652
client.approved_by_default)
1653
else:
1654
logger.warning("Client %s was not approved",
1655
client.name)
1656
if self.server.use_dbus:
1657
# Emit D-Bus signal
1658
client.Rejected("Denied")
1659
return
1660
1661
#wait until timeout or approved
1662
time = datetime.datetime.now()
1663
client.changedstate.acquire()
1664
(client.changedstate.wait
1665
(float(client.timedelta_to_milliseconds(delay)
1666
/ 1000)))
1667
client.changedstate.release()
1668
time2 = datetime.datetime.now()
1669
if (time2 - time) >= delay:
1670
if not client.approved_by_default:
1671
logger.warning("Client %s timed out while"
1672
" waiting for approval",
1673
client.name)
1674
if self.server.use_dbus:
1675
# Emit D-Bus signal
1676
client.Rejected("Approval timed out")
1677
return
1678
else:
1679
break
1680
else:
1681
delay -= time2 - time
1682
1683
sent_size = 0
1684
while sent_size < len(client.secret):
1685
try:
1686
sent = session.send(client.secret[sent_size:])
1687
except gnutls.errors.GNUTLSError as error:
1688
logger.warning("gnutls send failed")
1689
return
1690
logger.debug("Sent: %d, remaining: %d",
1691
sent, len(client.secret)
1692
- (sent_size + sent))
1693
sent_size += sent
1694
1695
logger.info("Sending secret to %s", client.name)
1696
# bump the timeout using extended_timeout
1697
client.bump_timeout(client.extended_timeout)
1698
if self.server.use_dbus:
1699
# Emit D-Bus signal
1700
client.GotSecret()
1701
1702
finally:
1703
if approval_required:
1704
client.approvals_pending -= 1
1705
try:
1706
session.bye()
1707
except gnutls.errors.GNUTLSError as error:
1708
logger.warning("GnuTLS bye failed")
1709
1710
@staticmethod
1711
def peer_certificate(session):
1712
"Return the peer's OpenPGP certificate as a bytestring"
1713
# If not an OpenPGP certificate...
1714
if (gnutls.library.functions
1715
.gnutls_certificate_type_get(session._c_object)
1716
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1717
# ...do the normal thing
1718
return session.peer_certificate
1719
list_size = ctypes.c_uint(1)
1720
cert_list = (gnutls.library.functions
1721
.gnutls_certificate_get_peers
1722
(session._c_object, ctypes.byref(list_size)))
1723
if not bool(cert_list) and list_size.value != 0:
1724
raise gnutls.errors.GNUTLSError("error getting peer"
1725
" certificate")
1726
if list_size.value == 0:
1727
return None
1728
cert = cert_list[0]
1729
return ctypes.string_at(cert.data, cert.size)
1730
1731
@staticmethod
1732
def fingerprint(openpgp):
1733
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1734
# New GnuTLS "datum" with the OpenPGP public key
1735
datum = (gnutls.library.types
1736
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1737
ctypes.POINTER
1738
(ctypes.c_ubyte)),
1739
ctypes.c_uint(len(openpgp))))
1740
# New empty GnuTLS certificate
1741
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1742
(gnutls.library.functions
1743
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1744
# Import the OpenPGP public key into the certificate
1745
(gnutls.library.functions
1746
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1747
gnutls.library.constants
1748
.GNUTLS_OPENPGP_FMT_RAW))
1749
# Verify the self signature in the key
1750
crtverify = ctypes.c_uint()
1751
(gnutls.library.functions
1752
.gnutls_openpgp_crt_verify_self(crt, 0,
1753
ctypes.byref(crtverify)))
1754
if crtverify.value != 0:
1755
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1756
raise (gnutls.errors.CertificateSecurityError
1757
("Verify failed"))
1758
# New buffer for the fingerprint
1759
buf = ctypes.create_string_buffer(20)
1760
buf_len = ctypes.c_size_t()
1761
# Get the fingerprint from the certificate into the buffer
1762
(gnutls.library.functions
1763
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1764
ctypes.byref(buf_len)))
1765
# Deinit the certificate
1766
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1767
# Convert the buffer to a Python bytestring
1768
fpr = ctypes.string_at(buf, buf_len.value)
1769
# Convert the bytestring to hexadecimal notation
1770
hex_fpr = binascii.hexlify(fpr).upper()
1771
return hex_fpr
1772
1773
1774
class MultiprocessingMixIn(object):
1775
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1776
def sub_process_main(self, request, address):
1777
try:
1778
self.finish_request(request, address)
1779
except Exception:
1780
self.handle_error(request, address)
1781
self.close_request(request)
1782
1783
def process_request(self, request, address):
1784
"""Start a new process to process the request."""
1785
proc = multiprocessing.Process(target = self.sub_process_main,
1786
args = (request,
1787
address))
1788
proc.start()
1789
return proc
1790
1791
1792
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1793
""" adds a pipe to the MixIn """
1794
def process_request(self, request, client_address):
1795
"""Overrides and wraps the original process_request().
1796
1797
This function creates a new pipe in self.pipe
1798
"""
1799
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1800
1801
proc = MultiprocessingMixIn.process_request(self, request,
1802
client_address)
1803
self.child_pipe.close()
1804
self.add_pipe(parent_pipe, proc)
1805
1806
def add_pipe(self, parent_pipe, proc):
1807
"""Dummy function; override as necessary"""
1808
raise NotImplementedError
1809
1810
1811
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1812
socketserver.TCPServer, object):
1813
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1814
657
logger.info(u"TCP connection from: %s",
658
unicode(self.client_address))
659
session = (gnutls.connection
660
.ClientSession(self.request,
661
gnutls.connection
662
.X509Credentials()))
663
664
line = self.request.makefile().readline()
665
logger.debug(u"Protocol version: %r", line)
666
try:
667
if int(line.strip().split()[0]) > 1:
668
raise RuntimeError
669
except (ValueError, IndexError, RuntimeError), error:
670
logger.error(u"Unknown protocol version: %s", error)
671
return
672
673
# Note: gnutls.connection.X509Credentials is really a generic
674
# GnuTLS certificate credentials object so long as no X.509
675
# keys are added to it. Therefore, we can use it here despite
676
# using OpenPGP certificates.
677
678
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
679
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
680
# "+DHE-DSS"))
681
# Use a fallback default, since this MUST be set.
682
priority = self.server.settings.get("priority", "NORMAL")
683
(gnutls.library.functions
684
.gnutls_priority_set_direct(session._c_object,
685
priority, None))
686
687
try:
688
session.handshake()
689
except gnutls.errors.GNUTLSError, error:
690
logger.warning(u"Handshake failed: %s", error)
691
# Do not run session.bye() here: the session is not
692
# established. Just abandon the request.
693
return
694
logger.debug(u"Handshake succeeded")
695
try:
696
fpr = fingerprint(peer_certificate(session))
697
except (TypeError, gnutls.errors.GNUTLSError), error:
698
logger.warning(u"Bad certificate: %s", error)
699
session.bye()
700
return
701
logger.debug(u"Fingerprint: %s", fpr)
702
703
for c in self.server.clients:
704
if c.fingerprint == fpr:
705
client = c
706
break
707
else:
708
logger.warning(u"Client not found for fingerprint: %s",
709
fpr)
710
session.bye()
711
return
712
# Have to check if client.still_valid(), since it is possible
713
# that the client timed out while establishing the GnuTLS
714
# session.
715
if not client.still_valid():
716
logger.warning(u"Client %(name)s is invalid",
717
vars(client))
718
session.bye()
719
return
720
## This won't work here, since we're in a fork.
721
# client.checked_ok()
722
sent_size = 0
723
while sent_size < len(client.secret):
724
sent = session.send(client.secret[sent_size:])
725
logger.debug(u"Sent: %d, remaining: %d",
726
sent, len(client.secret)
727
- (sent_size + sent))
728
sent_size += sent
729
session.bye()
730
731
732
class IPv6_TCPServer(SocketServer.ForkingMixIn,
733
SocketServer.TCPServer, object):
734
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1815
735
Attributes:
736
settings: Server settings
737
clients: Set() of Client objects
1816
738
enabled: Boolean; whether this server is activated yet
1817
interface: None or a network interface name (string)
1818
use_ipv6: Boolean; to use IPv6 or not
1819
739
"""
1820
def __init__(self, server_address, RequestHandlerClass,
1821
interface=None, use_ipv6=True):
1822
self.interface = interface
1823
if use_ipv6:
1824
self.address_family = socket.AF_INET6
1825
socketserver.TCPServer.__init__(self, server_address,
1826
RequestHandlerClass)
740
address_family = socket.AF_INET6
741
def __init__(self, *args, **kwargs):
742
if "settings" in kwargs:
743
self.settings = kwargs["settings"]
744
del kwargs["settings"]
745
if "clients" in kwargs:
746
self.clients = kwargs["clients"]
747
del kwargs["clients"]
748
self.enabled = False
749
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1827
750
def server_bind(self):
1828
751
"""This overrides the normal server_bind() function
1829
752
to bind to an interface if one was specified, and also NOT to
1830
753
bind to an address or port if they were not specified."""
1831
if self.interface is not None:
1832
if SO_BINDTODEVICE is None:
1833
logger.error("SO_BINDTODEVICE does not exist;"
1834
" cannot bind to interface %s",
1835
self.interface)
1836
else:
1837
try:
1838
self.socket.setsockopt(socket.SOL_SOCKET,
1839
SO_BINDTODEVICE,
1840
str(self.interface
1841
+ '\0'))
1842
except socket.error as error:
1843
if error[0] == errno.EPERM:
1844
logger.error("No permission to"
1845
" bind to interface %s",
1846
self.interface)
1847
elif error[0] == errno.ENOPROTOOPT:
1848
logger.error("SO_BINDTODEVICE not available;"
1849
" cannot bind to interface %s",
1850
self.interface)
1851
else:
1852
raise
754
if self.settings["interface"]:
755
# 25 is from /usr/include/asm-i486/socket.h
756
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
757
try:
758
self.socket.setsockopt(socket.SOL_SOCKET,
759
SO_BINDTODEVICE,
760
self.settings["interface"])
761
except socket.error, error:
762
if error[0] == errno.EPERM:
763
logger.error(u"No permission to"
764
u" bind to interface %s",
765
self.settings["interface"])
766
else:
767
raise error
1853
768
# Only bind(2) the socket if we really need to.
1854
769
if self.server_address[0] or self.server_address[1]:
1855
770
if not self.server_address[0]:
1856
if self.address_family == socket.AF_INET6:
1857
any_address = "::" # in6addr_any
1858
else:
1859
any_address = socket.INADDR_ANY
1860
self.server_address = (any_address,
771
in6addr_any = "::"
772
self.server_address = (in6addr_any,
1861
773
self.server_address[1])
1862
774
elif not self.server_address[1]:
1863
775
self.server_address = (self.server_address[0],
1864
776
0)
1865
# if self.interface:
777
# if self.settings["interface"]:
1866
778
# self.server_address = (self.server_address[0],
1867
779
# 0, # port
1868
780
# 0, # flowinfo
1869
781
# if_nametoindex
1870
# (self.interface))
1871
return socketserver.TCPServer.server_bind(self)
1872
1873
1874
class MandosServer(IPv6_TCPServer):
1875
"""Mandos server.
1876
1877
Attributes:
1878
clients: set of Client objects
1879
gnutls_priority GnuTLS priority string
1880
use_dbus: Boolean; to emit D-Bus signals or not
1881
1882
Assumes a gobject.MainLoop event loop.
1883
"""
1884
def __init__(self, server_address, RequestHandlerClass,
1885
interface=None, use_ipv6=True, clients=None,
1886
gnutls_priority=None, use_dbus=True):
1887
self.enabled = False
1888
self.clients = clients
1889
if self.clients is None:
1890
self.clients = {}
1891
self.use_dbus = use_dbus
1892
self.gnutls_priority = gnutls_priority
1893
IPv6_TCPServer.__init__(self, server_address,
1894
RequestHandlerClass,
1895
interface = interface,
1896
use_ipv6 = use_ipv6)
782
# (self.settings
783
# ["interface"]))
784
return super(IPv6_TCPServer, self).server_bind()
1897
785
def server_activate(self):
1898
786
if self.enabled:
1899
return socketserver.TCPServer.server_activate(self)
1900
787
return super(IPv6_TCPServer, self).server_activate()
1901
788
def enable(self):
1902
789
self.enabled = True
1903
1904
def add_pipe(self, parent_pipe, proc):
1905
# Call "handle_ipc" for both data and EOF events
1906
gobject.io_add_watch(parent_pipe.fileno(),
1907
gobject.IO_IN | gobject.IO_HUP,
1908
functools.partial(self.handle_ipc,
1909
parent_pipe =
1910
parent_pipe,
1911
proc = proc))
1912
1913
def handle_ipc(self, source, condition, parent_pipe=None,
1914
proc = None, client_object=None):
1915
condition_names = {
1916
gobject.IO_IN: "IN", # There is data to read.
1917
gobject.IO_OUT: "OUT", # Data can be written (without
1918
# blocking).
1919
gobject.IO_PRI: "PRI", # There is urgent data to read.
1920
gobject.IO_ERR: "ERR", # Error condition.
1921
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1922
# broken, usually for pipes and
1923
# sockets).
1924
}
1925
conditions_string = ' | '.join(name
1926
for cond, name in
1927
condition_names.iteritems()
1928
if cond & condition)
1929
# error, or the other end of multiprocessing.Pipe has closed
1930
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1931
# Wait for other process to exit
1932
proc.join()
1933
return False
1934
1935
# Read a request from the child
1936
request = parent_pipe.recv()
1937
command = request[0]
1938
1939
if command == 'init':
1940
fpr = request[1]
1941
address = request[2]
1942
1943
for c in self.clients.itervalues():
1944
if c.fingerprint == fpr:
1945
client = c
1946
break
1947
else:
1948
logger.info("Client not found for fingerprint: %s, ad"
1949
"dress: %s", fpr, address)
1950
if self.use_dbus:
1951
# Emit D-Bus signal
1952
mandos_dbus_service.ClientNotFound(fpr,
1953
address[0])
1954
parent_pipe.send(False)
1955
return False
1956
1957
gobject.io_add_watch(parent_pipe.fileno(),
1958
gobject.IO_IN | gobject.IO_HUP,
1959
functools.partial(self.handle_ipc,
1960
parent_pipe =
1961
parent_pipe,
1962
proc = proc,
1963
client_object =
1964
client))
1965
parent_pipe.send(True)
1966
# remove the old hook in favor of the new above hook on
1967
# same fileno
1968
return False
1969
if command == 'funcall':
1970
funcname = request[1]
1971
args = request[2]
1972
kwargs = request[3]
1973
1974
parent_pipe.send(('data', getattr(client_object,
1975
funcname)(*args,
1976
**kwargs)))
1977
1978
if command == 'getattr':
1979
attrname = request[1]
1980
if callable(client_object.__getattribute__(attrname)):
1981
parent_pipe.send(('function',))
1982
else:
1983
parent_pipe.send(('data', client_object
1984
.__getattribute__(attrname)))
1985
1986
if command == 'setattr':
1987
attrname = request[1]
1988
value = request[2]
1989
setattr(client_object, attrname, value)
1990
1991
return True
1992
790
1993
791
1994
792
def string_to_delta(interval):
2002
800
datetime.timedelta(0, 3600)
2003
801
>>> string_to_delta('24h')
2004
802
datetime.timedelta(1)
2005
>>> string_to_delta('1w')
803
>>> string_to_delta(u'1w')
2006
804
datetime.timedelta(7)
2007
805
>>> string_to_delta('5m 30s')
2008
806
datetime.timedelta(0, 330)
2012
810
try:
2013
811
suffix = unicode(s[-1])
2014
812
value = int(s[:-1])
2015
if suffix == "d":
813
if suffix == u"d":
2016
814
delta = datetime.timedelta(value)
2017
elif suffix == "s":
815
elif suffix == u"s":
2018
816
delta = datetime.timedelta(0, value)
2019
elif suffix == "m":
817
elif suffix == u"m":
2020
818
delta = datetime.timedelta(0, 0, 0, 0, value)
2021
elif suffix == "h":
819
elif suffix == u"h":
2022
820
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
2023
elif suffix == "w":
821
elif suffix == u"w":
2024
822
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2025
823
else:
2026
raise ValueError("Unknown suffix %r" % suffix)
2027
except (ValueError, IndexError) as e:
2028
raise ValueError(*(e.args))
824
raise ValueError
825
except (ValueError, IndexError):
826
raise ValueError
2029
827
timevalue += delta
2030
828
return timevalue
2031
829
2032
830
831
def server_state_changed(state):
832
"""Derived from the Avahi example code"""
833
if state == avahi.SERVER_COLLISION:
834
logger.error(u"Zeroconf server name collision")
835
service.remove()
836
elif state == avahi.SERVER_RUNNING:
837
service.add()
838
839
840
def entry_group_state_changed(state, error):
841
"""Derived from the Avahi example code"""
842
logger.debug(u"Avahi state change: %i", state)
843
844
if state == avahi.ENTRY_GROUP_ESTABLISHED:
845
logger.debug(u"Zeroconf service established.")
846
elif state == avahi.ENTRY_GROUP_COLLISION:
847
logger.warning(u"Zeroconf service name collision.")
848
service.rename()
849
elif state == avahi.ENTRY_GROUP_FAILURE:
850
logger.critical(u"Avahi: Error in group state changed %s",
851
unicode(error))
852
raise AvahiGroupError(u"State changed: %s" % unicode(error))
853
854
def if_nametoindex(interface):
855
"""Call the C function if_nametoindex(), or equivalent"""
856
global if_nametoindex
857
try:
858
if_nametoindex = (ctypes.cdll.LoadLibrary
859
(ctypes.util.find_library("c"))
860
.if_nametoindex)
861
except (OSError, AttributeError):
862
if "struct" not in sys.modules:
863
import struct
864
if "fcntl" not in sys.modules:
865
import fcntl
866
def if_nametoindex(interface):
867
"Get an interface index the hard way, i.e. using fcntl()"
868
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
869
with closing(socket.socket()) as s:
870
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
871
struct.pack("16s16x", interface))
872
interface_index = struct.unpack("I", ifreq[16:20])[0]
873
return interface_index
874
return if_nametoindex(interface)
875
876
2033
877
def daemon(nochdir = False, noclose = False):
2034
878
"""See daemon(3). Standard BSD Unix function.
2035
2036
879
This should really exist as os.daemon, but it doesn't (yet)."""
2037
880
if os.fork():
2038
881
sys.exit()
2043
886
sys.exit()
2044
887
if not noclose:
2045
888
# Close all standard open file descriptors
2046
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
889
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2047
890
if not stat.S_ISCHR(os.fstat(null).st_mode):
2048
891
raise OSError(errno.ENODEV,
2049
"%s not a character device"
2050
% os.devnull)
892
"/dev/null not a character device")
2051
893
os.dup2(null, sys.stdin.fileno())
2052
894
os.dup2(null, sys.stdout.fileno())
2053
895
os.dup2(null, sys.stderr.fileno())
2056
898
2057
899
2058
900
def main():
2059
2060
##################################################################
2061
# Parsing of options, both command line and config file
2062
2063
parser = argparse.ArgumentParser()
2064
parser.add_argument("-v", "--version", action="version",
2065
version = "%%(prog)s %s" % version,
2066
help="show version number and exit")
2067
parser.add_argument("-i", "--interface", metavar="IF",
2068
help="Bind to interface IF")
2069
parser.add_argument("-a", "--address",
2070
help="Address to listen for requests on")
2071
parser.add_argument("-p", "--port", type=int,
2072
help="Port number to receive requests on")
2073
parser.add_argument("--check", action="store_true",
2074
help="Run self-test")
2075
parser.add_argument("--debug", action="store_true",
2076
help="Debug mode; run in foreground and log"
2077
" to terminal")
2078
parser.add_argument("--debuglevel", metavar="LEVEL",
2079
help="Debug level for stdout output")
2080
parser.add_argument("--priority", help="GnuTLS"
2081
" priority string (see GnuTLS documentation)")
2082
parser.add_argument("--servicename",
2083
metavar="NAME", help="Zeroconf service name")
2084
parser.add_argument("--configdir",
2085
default="/etc/mandos", metavar="DIR",
2086
help="Directory to search for configuration"
2087
" files")
2088
parser.add_argument("--no-dbus", action="store_false",
2089
dest="use_dbus", help="Do not provide D-Bus"
2090
" system bus interface")
2091
parser.add_argument("--no-ipv6", action="store_false",
2092
dest="use_ipv6", help="Do not use IPv6")
2093
parser.add_argument("--no-restore", action="store_false",
2094
dest="restore", help="Do not restore stored"
2095
" state")
2096
parser.add_argument("--statedir", metavar="DIR",
2097
help="Directory to save/restore state in")
2098
2099
options = parser.parse_args()
901
parser = optparse.OptionParser(version = "%%prog %s" % version)
902
parser.add_option("-i", "--interface", type="string",
903
metavar="IF", help="Bind to interface IF")
904
parser.add_option("-a", "--address", type="string",
905
help="Address to listen for requests on")
906
parser.add_option("-p", "--port", type="int",
907
help="Port number to receive requests on")
908
parser.add_option("--check", action="store_true",
909
help="Run self-test")
910
parser.add_option("--debug", action="store_true",
911
help="Debug mode; run in foreground and log to"
912
" terminal")
913
parser.add_option("--priority", type="string", help="GnuTLS"
914
" priority string (see GnuTLS documentation)")
915
parser.add_option("--servicename", type="string", metavar="NAME",
916
help="Zeroconf service name")
917
parser.add_option("--configdir", type="string",
918
default="/etc/mandos", metavar="DIR",
919
help="Directory to search for configuration"
920
" files")
921
parser.add_option("--no-dbus", action="store_false",
922
dest="use_dbus",
923
help="Do not provide D-Bus system bus"
924
" interface")
925
options = parser.parse_args()[0]
2100
926
2101
927
if options.check:
2102
928
import doctest
2112
938
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2113
939
"servicename": "Mandos",
2114
940
"use_dbus": "True",
2115
"use_ipv6": "True",
2116
"debuglevel": "",
2117
"restore": "True",
2118
"statedir": "/var/lib/mandos"
2119
941
}
2120
942
2121
943
# Parse config file for server-global settings
2122
server_config = configparser.SafeConfigParser(server_defaults)
944
server_config = ConfigParser.SafeConfigParser(server_defaults)
2123
945
del server_defaults
2124
server_config.read(os.path.join(options.configdir,
2125
"mandos.conf"))
946
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2126
947
# Convert the SafeConfigParser object to a dict
2127
948
server_settings = server_config.defaults()
2128
949
# Use the appropriate methods on the non-string config options
2129
for option in ("debug", "use_dbus", "use_ipv6"):
2130
server_settings[option] = server_config.getboolean("DEFAULT",
2131
option)
950
server_settings["debug"] = server_config.getboolean("DEFAULT",
951
"debug")
952
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
953
"use_dbus")
2132
954
if server_settings["port"]:
2133
955
server_settings["port"] = server_config.getint("DEFAULT",
2134
956
"port")
2138
960
# options, if set.
2139
961
for option in ("interface", "address", "port", "debug",
2140
962
"priority", "servicename", "configdir",
2141
"use_dbus", "use_ipv6", "debuglevel", "restore",
2142
"statedir"):
963
"use_dbus"):
2143
964
value = getattr(options, option)
2144
965
if value is not None:
2145
966
server_settings[option] = value
2146
967
del options
2147
# Force all strings to be unicode
2148
for option in server_settings.keys():
2149
if type(server_settings[option]) is str:
2150
server_settings[option] = unicode(server_settings[option])
2151
968
# Now we have our good server settings in "server_settings"
2152
969
2153
##################################################################
2154
2155
970
# For convenience
2156
971
debug = server_settings["debug"]
2157
debuglevel = server_settings["debuglevel"]
2158
972
use_dbus = server_settings["use_dbus"]
2159
use_ipv6 = server_settings["use_ipv6"]
2160
stored_state_path = os.path.join(server_settings["statedir"],
2161
stored_state_file)
973
974
def sigsegvhandler(signum, frame):
975
raise RuntimeError('Segmentation fault')
2162
976
2163
if debug:
2164
initlogger(debug, logging.DEBUG)
977
if not debug:
978
syslogger.setLevel(logging.WARNING)
979
console.setLevel(logging.WARNING)
2165
980
else:
2166
if not debuglevel:
2167
initlogger(debug)
2168
else:
2169
level = getattr(logging, debuglevel.upper())
2170
initlogger(debug, level)
981
signal.signal(signal.SIGSEGV, sigsegvhandler)
2171
982
2172
983
if server_settings["servicename"] != "Mandos":
2173
984
syslogger.setFormatter(logging.Formatter
2174
('Mandos (%s) [%%(process)d]:'
2175
' %%(levelname)s: %%(message)s'
985
('Mandos (%s): %%(levelname)s:'
986
' %%(message)s'
2176
987
% server_settings["servicename"]))
2177
988
2178
989
# Parse config file with clients
2179
client_config = configparser.SafeConfigParser(Client
2180
.client_defaults)
990
client_defaults = { "timeout": "1h",
991
"interval": "5m",
992
"checker": "fping -q -- %%(host)s",
993
"host": "",
994
}
995
client_config = ConfigParser.SafeConfigParser(client_defaults)
2181
996
client_config.read(os.path.join(server_settings["configdir"],
2182
997
"clients.conf"))
2183
998
2184
global mandos_dbus_service
2185
mandos_dbus_service = None
2186
2187
tcp_server = MandosServer((server_settings["address"],
2188
server_settings["port"]),
2189
ClientHandler,
2190
interface=(server_settings["interface"]
2191
or None),
2192
use_ipv6=use_ipv6,
2193
gnutls_priority=
2194
server_settings["priority"],
2195
use_dbus=use_dbus)
2196
if not debug:
2197
pidfilename = "/var/run/mandos.pid"
2198
try:
2199
pidfile = open(pidfilename, "w")
2200
except IOError:
2201
logger.error("Could not open file %r", pidfilename)
999
clients = Set()
1000
tcp_server = IPv6_TCPServer((server_settings["address"],
1001
server_settings["port"]),
1002
TCP_handler,
1003
settings=server_settings,
1004
clients=clients)
1005
pidfilename = "/var/run/mandos.pid"
1006
try:
1007
pidfile = open(pidfilename, "w")
1008
except IOError, error:
1009
logger.error("Could not open file %r", pidfilename)
2202
1010
2203
1011
try:
2204
1012
uid = pwd.getpwnam("_mandos").pw_uid
2210
1018
except KeyError:
2211
1019
try:
2212
1020
uid = pwd.getpwnam("nobody").pw_uid
2213
gid = pwd.getpwnam("nobody").pw_gid
1021
gid = pwd.getpwnam("nogroup").pw_gid
2214
1022
except KeyError:
2215
1023
uid = 65534
2216
1024
gid = 65534
2217
1025
try:
2218
1026
os.setgid(gid)
2219
1027
os.setuid(uid)
2220
except OSError as error:
1028
except OSError, error:
2221
1029
if error[0] != errno.EPERM:
2222
1030
raise error
2223
1031
1032
# Enable all possible GnuTLS debugging
2224
1033
if debug:
2225
# Enable all possible GnuTLS debugging
2226
2227
1034
# "Use a log level over 10 to enable all debugging options."
2228
1035
# - GnuTLS manual
2229
1036
gnutls.library.functions.gnutls_global_set_log_level(11)
2234
1041
2235
1042
(gnutls.library.functions
2236
1043
.gnutls_global_set_log_function(debug_gnutls))
2237
2238
# Redirect stdin so all checkers get /dev/null
2239
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2240
os.dup2(null, sys.stdin.fileno())
2241
if null > 2:
2242
os.close(null)
2243
2244
# Need to fork before connecting to D-Bus
2245
if not debug:
2246
# Close all input and output, do double fork, etc.
2247
daemon()
2248
2249
gobject.threads_init()
1044
1045
global service
1046
service = AvahiService(name = server_settings["servicename"],
1047
servicetype = "_mandos._tcp", )
1048
if server_settings["interface"]:
1049
service.interface = (if_nametoindex
1050
(server_settings["interface"]))
2250
1051
2251
1052
global main_loop
1053
global bus
1054
global server
2252
1055
# From the Avahi example code
2253
DBusGMainLoop(set_as_default=True)
1056
DBusGMainLoop(set_as_default=True )
2254
1057
main_loop = gobject.MainLoop()
2255
1058
bus = dbus.SystemBus()
1059
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1060
avahi.DBUS_PATH_SERVER),
1061
avahi.DBUS_INTERFACE_SERVER)
2256
1062
# End of Avahi example code
2257
1063
if use_dbus:
2258
try:
2259
bus_name = dbus.service.BusName("se.recompile.Mandos",
2260
bus, do_not_queue=True)
2261
old_bus_name = (dbus.service.BusName
2262
("se.bsnet.fukt.Mandos", bus,
2263
do_not_queue=True))
2264
except dbus.exceptions.NameExistsException as e:
2265
logger.error(unicode(e) + ", disabling D-Bus")
2266
use_dbus = False
2267
server_settings["use_dbus"] = False
2268
tcp_server.use_dbus = False
2269
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2270
service = AvahiServiceToSyslog(name =
2271
server_settings["servicename"],
2272
servicetype = "_mandos._tcp",
2273
protocol = protocol, bus = bus)
2274
if server_settings["interface"]:
2275
service.interface = (if_nametoindex
2276
(str(server_settings["interface"])))
2277
2278
global multiprocessing_manager
2279
multiprocessing_manager = multiprocessing.Manager()
2280
2281
client_class = Client
2282
if use_dbus:
2283
client_class = functools.partial(ClientDBusTransitional,
2284
bus = bus)
2285
2286
client_settings = Client.config_parser(client_config)
2287
old_client_settings = {}
2288
clients_data = {}
2289
2290
# Get client data and settings from last running state.
2291
if server_settings["restore"]:
2292
try:
2293
with open(stored_state_path, "rb") as stored_state:
2294
clients_data, old_client_settings = (pickle.load
2295
(stored_state))
2296
os.remove(stored_state_path)
2297
except IOError as e:
2298
logger.warning("Could not load persistent state: {0}"
2299
.format(e))
2300
if e.errno != errno.ENOENT:
2301
raise
2302
except EOFError as e:
2303
logger.warning("Could not load persistent state: "
2304
"EOFError: {0}".format(e))
2305
2306
with PGPEngine() as pgp:
2307
for client_name, client in clients_data.iteritems():
2308
# Decide which value to use after restoring saved state.
2309
# We have three different values: Old config file,
2310
# new config file, and saved state.
2311
# New config value takes precedence if it differs from old
2312
# config value, otherwise use saved state.
2313
for name, value in client_settings[client_name].items():
2314
try:
2315
# For each value in new config, check if it
2316
# differs from the old config value (Except for
2317
# the "secret" attribute)
2318
if (name != "secret" and
2319
value != old_client_settings[client_name]
2320
[name]):
2321
client[name] = value
2322
except KeyError:
2323
pass
2324
2325
# Clients who has passed its expire date can still be
2326
# enabled if its last checker was successful. Clients
2327
# whose checker succeeded before we stored its state is
2328
# assumed to have successfully run all checkers during
2329
# downtime.
2330
if client["enabled"]:
2331
if datetime.datetime.utcnow() >= client["expires"]:
2332
if not client["last_checked_ok"]:
2333
logger.warning(
2334
"disabling client {0} - Client never "
2335
"performed a successful checker"
2336
.format(client_name))
2337
client["enabled"] = False
2338
elif client["last_checker_status"] != 0:
2339
logger.warning(
2340
"disabling client {0} - Client "
2341
"last checker failed with error code {1}"
2342
.format(client_name,
2343
client["last_checker_status"]))
2344
client["enabled"] = False
2345
else:
2346
client["expires"] = (datetime.datetime
2347
.utcnow()
2348
+ client["timeout"])
2349
logger.debug("Last checker succeeded,"
2350
" keeping {0} enabled"
2351
.format(client_name))
2352
try:
2353
client["secret"] = (
2354
pgp.decrypt(client["encrypted_secret"],
2355
client_settings[client_name]
2356
["secret"]))
2357
except PGPError:
2358
# If decryption fails, we use secret from new settings
2359
logger.debug("Failed to decrypt {0} old secret"
2360
.format(client_name))
2361
client["secret"] = (
2362
client_settings[client_name]["secret"])
2363
2364
2365
# Add/remove clients based on new changes made to config
2366
for client_name in (set(old_client_settings)
2367
- set(client_settings)):
2368
del clients_data[client_name]
2369
for client_name in (set(client_settings)
2370
- set(old_client_settings)):
2371
clients_data[client_name] = client_settings[client_name]
2372
2373
# Create all client objects
2374
for client_name, client in clients_data.iteritems():
2375
tcp_server.clients[client_name] = client_class(
2376
name = client_name, settings = client)
2377
2378
if not tcp_server.clients:
2379
logger.warning("No clients defined")
1064
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1065
1066
clients.update(Set(Client(name = section,
1067
config
1068
= dict(client_config.items(section)),
1069
use_dbus = use_dbus)
1070
for section in client_config.sections()))
1071
if not clients:
1072
logger.warning(u"No clients defined")
1073
1074
if debug:
1075
# Redirect stdin so all checkers get /dev/null
1076
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1077
os.dup2(null, sys.stdin.fileno())
1078
if null > 2:
1079
os.close(null)
1080
else:
1081
# No console logging
1082
logger.removeHandler(console)
1083
# Close all input and output, do double fork, etc.
1084
daemon()
1085
1086
try:
1087
pid = os.getpid()
1088
pidfile.write(str(pid) + "\n")
1089
pidfile.close()
1090
del pidfile
1091
except IOError:
1092
logger.error(u"Could not write to file %r with PID %d",
1093
pidfilename, pid)
1094
except NameError:
1095
# "pidfile" was never created
1096
pass
1097
del pidfilename
1098
1099
def cleanup():
1100
"Cleanup function; run on exit"
1101
global group
1102
# From the Avahi example code
1103
if not group is None:
1104
group.Free()
1105
group = None
1106
# End of Avahi example code
2380
1107
1108
while clients:
1109
client = clients.pop()
1110
client.disable_hook = None
1111
client.disable()
1112
1113
atexit.register(cleanup)
1114
2381
1115
if not debug:
2382
try:
2383
with pidfile:
2384
pid = os.getpid()
2385
pidfile.write(str(pid) + "\n".encode("utf-8"))
2386
del pidfile
2387
except IOError:
2388
logger.error("Could not write to file %r with PID %d",
2389
pidfilename, pid)
2390
except NameError:
2391
# "pidfile" was never created
2392
pass
2393
del pidfilename
2394
1116
signal.signal(signal.SIGINT, signal.SIG_IGN)
2395
2396
1117
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2397
1118
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2398
1119
2399
1120
if use_dbus:
2400
class MandosDBusService(DBusObjectWithProperties):
1121
class MandosServer(dbus.service.Object):
2401
1122
"""A D-Bus proxy object"""
2402
1123
def __init__(self):
2403
1124
dbus.service.Object.__init__(self, bus, "/")
2404
_interface = "se.recompile.Mandos"
2405
2406
@dbus_interface_annotations(_interface)
2407
def _foo(self):
2408
return { "org.freedesktop.DBus.Property"
2409
".EmitsChangedSignal":
2410
"false"}
2411
2412
@dbus.service.signal(_interface, signature="o")
2413
def ClientAdded(self, objpath):
2414
"D-Bus signal"
2415
pass
2416
2417
@dbus.service.signal(_interface, signature="ss")
2418
def ClientNotFound(self, fingerprint, address):
1125
_interface = u"se.bsnet.fukt.Mandos"
1126
1127
@dbus.service.signal(_interface, signature="oa{sv}")
1128
def ClientAdded(self, objpath, properties):
2419
1129
"D-Bus signal"
2420
1130
pass
2421
1131
2427
1137
@dbus.service.method(_interface, out_signature="ao")
2428
1138
def GetAllClients(self):
2429
1139
"D-Bus method"
2430
return dbus.Array(c.dbus_object_path
2431
for c in
2432
tcp_server.clients.itervalues())
1140
return dbus.Array(c.dbus_object_path for c in clients)
2433
1141
2434
@dbus.service.method(_interface,
2435
out_signature="a{oa{sv}}")
1142
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
2436
1143
def GetAllClientsWithProperties(self):
2437
1144
"D-Bus method"
2438
1145
return dbus.Dictionary(
2439
((c.dbus_object_path, c.GetAll(""))
2440
for c in tcp_server.clients.itervalues()),
1146
((c.dbus_object_path, c.GetAllProperties())
1147
for c in clients),
2441
1148
signature="oa{sv}")
2442
1149
2443
1150
@dbus.service.method(_interface, in_signature="o")
2444
1151
def RemoveClient(self, object_path):
2445
1152
"D-Bus method"
2446
for c in tcp_server.clients.itervalues():
1153
for c in clients:
2447
1154
if c.dbus_object_path == object_path:
2448
del tcp_server.clients[c.name]
2449
c.remove_from_connection()
1155
clients.remove(c)
2450
1156
# Don't signal anything except ClientRemoved
2451
c.disable(quiet=True)
1157
c.use_dbus = False
1158
c.disable()
2452
1159
# Emit D-Bus signal
2453
1160
self.ClientRemoved(object_path, c.name)
2454
1161
return
2455
raise KeyError(object_path)
1162
raise KeyError
2456
1163
2457
1164
del _interface
2458
1165
2459
class MandosDBusServiceTransitional(MandosDBusService):
2460
__metaclass__ = AlternateDBusNamesMetaclass
2461
mandos_dbus_service = MandosDBusServiceTransitional()
2462
2463
def cleanup():
2464
"Cleanup function; run on exit"
2465
service.cleanup()
2466
2467
multiprocessing.active_children()
2468
if not (tcp_server.clients or client_settings):
2469
return
2470
2471
# Store client before exiting. Secrets are encrypted with key
2472
# based on what config file has. If config file is
2473
# removed/edited, old secret will thus be unrecovable.
2474
clients = {}
2475
with PGPEngine() as pgp:
2476
for client in tcp_server.clients.itervalues():
2477
key = client_settings[client.name]["secret"]
2478
client.encrypted_secret = pgp.encrypt(client.secret,
2479
key)
2480
client_dict = {}
2481
2482
# A list of attributes that can not be pickled
2483
# + secret.
2484
exclude = set(("bus", "changedstate", "secret",
2485
"checker"))
2486
for name, typ in (inspect.getmembers
2487
(dbus.service.Object)):
2488
exclude.add(name)
2489
2490
client_dict["encrypted_secret"] = (client
2491
.encrypted_secret)
2492
for attr in client.client_structure:
2493
if attr not in exclude:
2494
client_dict[attr] = getattr(client, attr)
2495
2496
clients[client.name] = client_dict
2497
del client_settings[client.name]["secret"]
2498
2499
try:
2500
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2501
prefix="clients-",
2502
dir=os.path.dirname
2503
(stored_state_path))
2504
with os.fdopen(tempfd, "wb") as stored_state:
2505
pickle.dump((clients, client_settings), stored_state)
2506
os.rename(tempname, stored_state_path)
2507
except (IOError, OSError) as e:
2508
logger.warning("Could not save persistent state: {0}"
2509
.format(e))
2510
if not debug:
2511
try:
2512
os.remove(tempname)
2513
except NameError:
2514
pass
2515
if e.errno not in set((errno.ENOENT, errno.EACCES,
2516
errno.EEXIST)):
2517
raise e
2518
2519
# Delete all clients, and settings from config
2520
while tcp_server.clients:
2521
name, client = tcp_server.clients.popitem()
2522
if use_dbus:
2523
client.remove_from_connection()
2524
# Don't signal anything except ClientRemoved
2525
client.disable(quiet=True)
2526
if use_dbus:
2527
# Emit D-Bus signal
2528
mandos_dbus_service.ClientRemoved(client
2529
.dbus_object_path,
2530
client.name)
2531
client_settings.clear()
2532
2533
atexit.register(cleanup)
2534
2535
for client in tcp_server.clients.itervalues():
1166
mandos_server = MandosServer()
1167
1168
for client in clients:
2536
1169
if use_dbus:
2537
1170
# Emit D-Bus signal
2538
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2539
# Need to initiate checking of clients
2540
if client.enabled:
2541
client.init_checker()
1171
mandos_server.ClientAdded(client.dbus_object_path,
1172
client.GetAllProperties())
1173
client.enable()
2542
1174
2543
1175
tcp_server.enable()
2544
1176
tcp_server.server_activate()
2545
1177
2546
1178
# Find out what port we got
2547
1179
service.port = tcp_server.socket.getsockname()[1]
2548
if use_ipv6:
2549
logger.info("Now listening on address %r, port %d,"
2550
" flowinfo %d, scope_id %d"
2551
% tcp_server.socket.getsockname())
2552
else: # IPv4
2553
logger.info("Now listening on address %r, port %d"
2554
% tcp_server.socket.getsockname())
1180
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1181
u" scope_id %d" % tcp_server.socket.getsockname())
2555
1182
2556
1183
#service.interface = tcp_server.socket.getsockname()[3]
2557
1184
2558
1185
try:
2559
1186
# From the Avahi example code
1187
server.connect_to_signal("StateChanged", server_state_changed)
2560
1188
try:
2561
service.activate()
2562
except dbus.exceptions.DBusException as error:
2563
logger.critical("DBusException: %s", error)
2564
cleanup()
1189
server_state_changed(server.GetState())
1190
except dbus.exceptions.DBusException, error:
1191
logger.critical(u"DBusException: %s", error)
2565
1192
sys.exit(1)
2566
1193
# End of Avahi example code
2567
1194
2570
1197
(tcp_server.handle_request
2571
1198
(*args[2:], **kwargs) or True))
2572
1199
2573
logger.debug("Starting main loop")
1200
logger.debug(u"Starting main loop")
2574
1201
main_loop.run()
2575
except AvahiError as error:
2576
logger.critical("AvahiError: %s", error)
2577
cleanup()
1202
except AvahiError, error:
1203
logger.critical(u"AvahiError: %s", error)
2578
1204
sys.exit(1)
2579
1205
except KeyboardInterrupt:
2580
1206
if debug:
2581
print("", file=sys.stderr)
2582
logger.debug("Server received KeyboardInterrupt")
2583
logger.debug("Server exiting")
2584
# Must run before the D-Bus bus name gets deregistered
2585
cleanup()
1207
print
2586
1208
2587
1209
if __name__ == '__main__':
2588
1210
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0