351
186
dbus.UInt16(self.port),
352
187
avahi.string_array_to_txt_array(self.TXT))
353
188
self.group.Commit()
355
189
def entry_group_state_changed(self, state, error):
356
190
"""Derived from the Avahi example code"""
357
logger.debug("Avahi entry group state change: %i", state)
191
logger.debug(u"Avahi state change: %i", state)
359
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
360
logger.debug("Zeroconf service established.")
194
logger.debug(u"Zeroconf service established.")
361
195
elif state == avahi.ENTRY_GROUP_COLLISION:
362
logger.info("Zeroconf service name collision.")
196
logger.warning(u"Zeroconf service name collision.")
364
198
elif state == avahi.ENTRY_GROUP_FAILURE:
365
logger.critical("Avahi: Error in group state changed %s",
367
raise AvahiGroupError("State changed: {!s}".format(error))
199
logger.critical(u"Avahi: Error in group state changed %s",
201
raise AvahiGroupError(u"State changed: %s"
369
203
def cleanup(self):
370
204
"""Derived from the Avahi example code"""
371
205
if self.group is not None:
374
except (dbus.exceptions.UnknownMethodException,
375
dbus.exceptions.DBusException):
377
207
self.group = None
380
def server_state_changed(self, state, error=None):
208
def server_state_changed(self, state):
381
209
"""Derived from the Avahi example code"""
382
logger.debug("Avahi server state change: %i", state)
384
avahi.SERVER_INVALID: "Zeroconf server invalid",
385
avahi.SERVER_REGISTERING: None,
386
avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
if state in bad_states:
390
if bad_states[state] is not None:
392
logger.error(bad_states[state])
394
logger.error(bad_states[state] + ": %r", error)
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
396
213
elif state == avahi.SERVER_RUNNING:
400
logger.debug("Unknown state: %r", state)
402
logger.debug("Unknown state: %r: %r", state, error)
404
215
def activate(self):
405
216
"""Derived from the Avahi example code"""
406
217
if self.server is None:
407
218
self.server = dbus.Interface(
408
219
self.bus.get_object(avahi.DBUS_NAME,
409
avahi.DBUS_PATH_SERVER,
410
follow_name_owner_changes=True),
220
avahi.DBUS_PATH_SERVER),
411
221
avahi.DBUS_INTERFACE_SERVER)
412
self.server.connect_to_signal("StateChanged",
413
self.server_state_changed)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
414
224
self.server_state_changed(self.server.GetState())
417
class AvahiServiceToSyslog(AvahiService):
418
def rename(self, *args, **kwargs):
419
"""Add the new name to the syslog messages"""
420
ret = AvahiService.rename(self, *args, **kwargs)
421
syslogger.setFormatter(logging.Formatter(
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
427
227
class Client(object):
428
228
"""A representation of a client host served by this server.
431
approved: bool(); 'None' if not yet approved/disapproved
432
approval_delay: datetime.timedelta(); Time to wait for approval
433
approval_duration: datetime.timedelta(); Duration of one approval
231
name: string; from the config file, used in log messages and
233
fingerprint: string (40 or 32 hexadecimal digits); used to
234
uniquely identify the client
235
secret: bytestring; sent verbatim (over TLS) to client
236
host: string; available for use by the checker command
237
created: datetime.datetime(); (UTC) object creation
238
last_enabled: datetime.datetime(); (UTC)
240
last_checked_ok: datetime.datetime(); (UTC) or None
241
timeout: datetime.timedelta(); How long from last_checked_ok
242
until this client is invalid
243
interval: datetime.timedelta(); How often to start a new checker
244
disable_hook: If set, called by disable() as disable_hook(self)
434
245
checker: subprocess.Popen(); a running checker process used
435
246
to see if the client lives.
436
247
'None' if no process is running.
437
checker_callback_tag: a gobject event source tag, or None
438
checker_command: string; External command which is run to check
439
if client lives. %() expansions are done at
248
checker_initiator_tag: a gobject event source tag, or None
249
disable_initiator_tag: - '' -
250
checker_callback_tag: - '' -
251
checker_command: string; External command which is run to check if
252
client lives. %() expansions are done at
440
253
runtime with vars(self) as dict, so that for
441
254
instance %(name)s can be used in the command.
442
checker_initiator_tag: a gobject event source tag, or None
443
created: datetime.datetime(); (UTC) object creation
444
client_structure: Object describing what attributes a client has
445
and is used for storing the client at exit
446
255
current_checker_command: string; current running checker_command
447
disable_initiator_tag: a gobject event source tag, or None
449
fingerprint: string (40 or 32 hexadecimal digits); used to
450
uniquely identify the client
451
host: string; available for use by the checker command
452
interval: datetime.timedelta(); How often to start a new checker
453
last_approval_request: datetime.datetime(); (UTC) or None
454
last_checked_ok: datetime.datetime(); (UTC) or None
455
last_checker_status: integer between 0 and 255 reflecting exit
456
status of last checker. -1 reflects crashed
457
checker, -2 means no checker completed yet.
458
last_enabled: datetime.datetime(); (UTC) or None
459
name: string; from the config file, used in log messages and
461
secret: bytestring; sent verbatim (over TLS) to client
462
timeout: datetime.timedelta(); How long from last_checked_ok
463
until this client is disabled
464
extended_timeout: extra long timeout when secret has been sent
465
runtime_expansions: Allowed attributes for runtime expansion.
466
expires: datetime.datetime(); time (UTC) when a client will be
468
server_settings: The server_settings dict from main()
471
runtime_expansions = ("approval_delay", "approval_duration",
472
"created", "enabled", "expires",
473
"fingerprint", "host", "interval",
474
"last_approval_request", "last_checked_ok",
475
"last_enabled", "name", "timeout")
478
"extended_timeout": "PT15M",
480
"checker": "fping -q -- %%(host)s",
482
"approval_delay": "PT0S",
483
"approval_duration": "PT1S",
484
"approved_by_default": "True",
489
def config_parser(config):
490
"""Construct a new dict of client settings of this form:
491
{ client_name: {setting_name: value, ...}, ...}
492
with exceptions for any special settings as defined above.
493
NOTE: Must be a pure function. Must return the same result
494
value given the same arguments.
497
for client_name in config.sections():
498
section = dict(config.items(client_name))
499
client = settings[client_name] = {}
501
client["host"] = section["host"]
502
# Reformat values from string types to Python types
503
client["approved_by_default"] = config.getboolean(
504
client_name, "approved_by_default")
505
client["enabled"] = config.getboolean(client_name,
508
# Uppercase and remove spaces from fingerprint for later
509
# comparison purposes with return value from the
510
# fingerprint() function
511
client["fingerprint"] = (section["fingerprint"].upper()
513
if "secret" in section:
514
client["secret"] = section["secret"].decode("base64")
515
elif "secfile" in section:
516
with open(os.path.expanduser(os.path.expandvars
517
(section["secfile"])),
519
client["secret"] = secfile.read()
521
raise TypeError("No secret or secfile for section {}"
523
client["timeout"] = string_to_delta(section["timeout"])
524
client["extended_timeout"] = string_to_delta(
525
section["extended_timeout"])
526
client["interval"] = string_to_delta(section["interval"])
527
client["approval_delay"] = string_to_delta(
528
section["approval_delay"])
529
client["approval_duration"] = string_to_delta(
530
section["approval_duration"])
531
client["checker_command"] = section["checker"]
532
client["last_approval_request"] = None
533
client["last_checked_ok"] = None
534
client["last_checker_status"] = -2
538
def __init__(self, settings, name = None, server_settings=None):
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
265
def timeout_milliseconds(self):
266
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
269
def interval_milliseconds(self):
270
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
273
def __init__(self, name = None, disable_hook=None, config=None):
274
"""Note: the 'checker' key in 'config' sets the
275
'checker_command' attribute and *not* the 'checker'
540
if server_settings is None:
542
self.server_settings = server_settings
543
# adding all client settings
544
for setting, value in settings.items():
545
setattr(self, setting, value)
548
if not hasattr(self, "last_enabled"):
549
self.last_enabled = datetime.datetime.utcnow()
550
if not hasattr(self, "expires"):
551
self.expires = (datetime.datetime.utcnow()
280
logger.debug(u"Creating client %r", self.name)
281
# Uppercase and remove spaces from fingerprint for later
282
# comparison purposes with return value from the fingerprint()
284
self.fingerprint = (config[u"fingerprint"].upper()
286
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
290
with closing(open(os.path.expanduser
292
(config[u"secfile"])))) as secfile:
293
self.secret = secfile.read()
554
self.last_enabled = None
557
logger.debug("Creating client %r", self.name)
558
logger.debug(" Fingerprint: %s", self.fingerprint)
559
self.created = settings.get("created",
560
datetime.datetime.utcnow())
562
# attributes specific for this server instance
295
raise TypeError(u"No secret or secfile for client %s"
297
self.host = config.get(u"host", u"")
298
self.created = datetime.datetime.utcnow()
300
self.last_enabled = None
301
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
304
self.disable_hook = disable_hook
563
305
self.checker = None
564
306
self.checker_initiator_tag = None
565
307
self.disable_initiator_tag = None
566
308
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
567
310
self.current_checker_command = None
569
self.approvals_pending = 0
570
self.changedstate = multiprocessing_manager.Condition(
571
multiprocessing_manager.Lock())
572
self.client_structure = [attr
573
for attr in self.__dict__.iterkeys()
574
if not attr.startswith("_")]
575
self.client_structure.append("client_structure")
577
for name, t in inspect.getmembers(
578
type(self), lambda obj: isinstance(obj, property)):
579
if not name.startswith("_"):
580
self.client_structure.append(name)
582
# Send notice to process children that client state has changed
583
def send_changedstate(self):
584
with self.changedstate:
585
self.changedstate.notify_all()
311
self.last_connect = None
587
313
def enable(self):
588
314
"""Start this client's checker and timeout hooks"""
589
if getattr(self, "enabled", False):
315
if getattr(self, u"enabled", False):
590
316
# Already enabled
592
self.expires = datetime.datetime.utcnow() + self.timeout
594
318
self.last_enabled = datetime.datetime.utcnow()
596
self.send_changedstate()
319
# Schedule a new checker to be started an 'interval' from now,
320
# and every interval from then on.
321
self.checker_initiator_tag = (gobject.timeout_add
322
(self.interval_milliseconds(),
324
# Also start a new checker *right now*.
326
# Schedule a disable() when 'timeout' has passed
327
self.disable_initiator_tag = (gobject.timeout_add
328
(self.timeout_milliseconds(),
598
def disable(self, quiet=True):
599
333
"""Disable this client."""
600
334
if not getattr(self, "enabled", False):
603
logger.info("Disabling client %s", self.name)
604
if getattr(self, "disable_initiator_tag", None) is not None:
336
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
605
338
gobject.source_remove(self.disable_initiator_tag)
606
339
self.disable_initiator_tag = None
608
if getattr(self, "checker_initiator_tag", None) is not None:
340
if getattr(self, u"checker_initiator_tag", False):
609
341
gobject.source_remove(self.checker_initiator_tag)
610
342
self.checker_initiator_tag = None
611
343
self.stop_checker()
344
if self.disable_hook:
345
self.disable_hook(self)
612
346
self.enabled = False
614
self.send_changedstate()
615
347
# Do not run this again if called by a gobject.timeout_add
618
350
def __del__(self):
351
self.disable_hook = None
621
def init_checker(self):
622
# Schedule a new checker to be started an 'interval' from now,
623
# and every interval from then on.
624
if self.checker_initiator_tag is not None:
625
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = gobject.timeout_add(
627
int(self.interval.total_seconds() * 1000),
629
# Schedule a disable() when 'timeout' has passed
630
if self.disable_initiator_tag is not None:
631
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = gobject.timeout_add(
633
int(self.timeout.total_seconds() * 1000), self.disable)
634
# Also start a new checker *right now*.
637
354
def checker_callback(self, pid, condition, command):
638
355
"""The checker has completed, so take appropriate actions."""
639
356
self.checker_callback_tag = None
640
357
self.checker = None
641
358
if os.WIFEXITED(condition):
642
self.last_checker_status = os.WEXITSTATUS(condition)
643
if self.last_checker_status == 0:
644
logger.info("Checker for %(name)s succeeded",
359
exitstatus = os.WEXITSTATUS(condition)
361
logger.info(u"Checker for %(name)s succeeded",
646
363
self.checked_ok()
648
logger.info("Checker for %(name)s failed", vars(self))
365
logger.info(u"Checker for %(name)s failed",
650
self.last_checker_status = -1
651
logger.warning("Checker for %(name)s crashed?",
368
logger.warning(u"Checker for %(name)s crashed?",
654
371
def checked_ok(self):
655
"""Assert that the client has been seen, alive and well."""
372
"""Bump up the timeout for this client.
374
This should only be called when the client has been seen,
656
377
self.last_checked_ok = datetime.datetime.utcnow()
657
self.last_checker_status = 0
660
def bump_timeout(self, timeout=None):
661
"""Bump up the timeout for this client."""
663
timeout = self.timeout
664
if self.disable_initiator_tag is not None:
665
gobject.source_remove(self.disable_initiator_tag)
666
self.disable_initiator_tag = None
667
if getattr(self, "enabled", False):
668
self.disable_initiator_tag = gobject.timeout_add(
669
int(timeout.total_seconds() * 1000), self.disable)
670
self.expires = datetime.datetime.utcnow() + timeout
672
def need_approval(self):
673
self.last_approval_request = datetime.datetime.utcnow()
378
gobject.source_remove(self.disable_initiator_tag)
379
self.disable_initiator_tag = (gobject.timeout_add
380
(self.timeout_milliseconds(),
675
383
def start_checker(self):
676
384
"""Start a new checker subprocess if one is not running.
762
453
if self.checker_callback_tag:
763
454
gobject.source_remove(self.checker_callback_tag)
764
455
self.checker_callback_tag = None
765
if getattr(self, "checker", None) is None:
456
if getattr(self, u"checker", None) is None:
767
logger.debug("Stopping checker for %(name)s", vars(self))
458
logger.debug(u"Stopping checker for %(name)s", vars(self))
769
self.checker.terminate()
460
os.kill(self.checker.pid, signal.SIGTERM)
771
462
#if self.checker.poll() is None:
772
# self.checker.kill()
773
except OSError as error:
463
# os.kill(self.checker.pid, signal.SIGKILL)
464
except OSError, error:
774
465
if error.errno != errno.ESRCH: # No such process
776
467
self.checker = None
779
def dbus_service_property(dbus_interface,
783
"""Decorators for marking methods of a DBusObjectWithProperties to
784
become properties on the D-Bus.
786
The decorated method will be called with no arguments by "Get"
787
and with one argument by "Set".
789
The parameters, where they are supported, are the same as
790
dbus.service.method, except there is only "signature", since the
791
type from Get() and the type sent to Set() is the same.
793
# Encoding deeply encoded byte arrays is not supported yet by the
794
# "Set" method, so we fail early here:
795
if byte_arrays and signature != "ay":
796
raise ValueError("Byte arrays not supported for non-'ay'"
797
" signature {!r}".format(signature))
800
func._dbus_is_property = True
801
func._dbus_interface = dbus_interface
802
func._dbus_signature = signature
803
func._dbus_access = access
804
func._dbus_name = func.__name__
805
if func._dbus_name.endswith("_dbus_property"):
806
func._dbus_name = func._dbus_name[:-14]
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
813
def dbus_interface_annotations(dbus_interface):
814
"""Decorator for marking functions returning interface annotations
818
@dbus_interface_annotations("org.example.Interface")
819
def _foo(self): # Function name does not matter
820
return {"org.freedesktop.DBus.Deprecated": "true",
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
826
func._dbus_is_interface = True
827
func._dbus_interface = dbus_interface
828
func._dbus_name = dbus_interface
834
def dbus_annotations(annotations):
835
"""Decorator to annotate D-Bus methods, signals or properties
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
@dbus_service_property("org.example.Interface", signature="b",
843
def Property_dbus_property(self):
844
return dbus.Boolean(False)
848
func._dbus_annotations = annotations
854
class DBusPropertyException(dbus.exceptions.DBusException):
855
"""A base class for D-Bus property-related exceptions
860
class DBusPropertyAccessException(DBusPropertyException):
861
"""A property's access permissions disallows an operation.
866
class DBusPropertyNotFound(DBusPropertyException):
867
"""An attempt was made to access a non-existing property.
872
class DBusObjectWithProperties(dbus.service.Object):
873
"""A D-Bus object with properties.
875
Classes inheriting from this can use the dbus_service_property
876
decorator to expose methods as D-Bus properties. It exposes the
877
standard Get(), Set(), and GetAll() methods on the D-Bus.
881
def _is_dbus_thing(thing):
882
"""Returns a function testing if an attribute is a D-Bus thing
884
If called like _is_dbus_thing("method") it returns a function
885
suitable for use as predicate to inspect.getmembers().
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
890
def _get_all_dbus_things(self, thing):
891
"""Returns a generator of (name, attribute) pairs
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
894
athing.__get__(self))
895
for cls in self.__class__.__mro__
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
899
def _get_dbus_property(self, interface_name, property_name):
900
"""Returns a bound method if one exists which is a D-Bus
901
property with the specified name and interface.
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
906
if (value._dbus_name == property_name
907
and value._dbus_interface == interface_name):
908
return value.__get__(self)
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
917
def Get(self, interface_name, property_name):
918
"""Standard D-Bus property Get() method, see D-Bus standard.
920
prop = self._get_dbus_property(interface_name, property_name)
921
if prop._dbus_access == "write":
922
raise DBusPropertyAccessException(property_name)
924
if not hasattr(value, "variant_level"):
926
return type(value)(value, variant_level=value.variant_level+1)
928
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
929
def Set(self, interface_name, property_name, value):
930
"""Standard D-Bus property Set() method, see D-Bus standard.
932
prop = self._get_dbus_property(interface_name, property_name)
933
if prop._dbus_access == "read":
934
raise DBusPropertyAccessException(property_name)
935
if prop._dbus_get_args_options["byte_arrays"]:
936
# The byte_arrays option is not supported yet on
937
# signatures other than "ay".
938
if prop._dbus_signature != "ay":
939
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {!r}"
941
.format(prop._dbus_signature))
942
value = dbus.ByteArray(b''.join(chr(byte)
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
948
out_signature="a{sv}")
949
def GetAll(self, interface_name):
950
"""Standard D-Bus property GetAll() method, see D-Bus
953
Note: Will not include properties with access="write".
956
for name, prop in self._get_all_dbus_things("property"):
958
and interface_name != prop._dbus_interface):
959
# Interface non-empty but did not match
961
# Ignore write-only properties
962
if prop._dbus_access == "write":
965
if not hasattr(value, "variant_level"):
966
properties[name] = value
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
970
return dbus.Dictionary(properties, signature="sv")
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
def PropertiesChanged(self, interface_name, changed_properties,
974
invalidated_properties):
975
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
980
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
982
path_keyword='object_path',
983
connection_keyword='connection')
984
def Introspect(self, object_path, connection):
985
"""Overloading of standard D-Bus method.
987
Inserts property tags and interface annotation tags.
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
992
document = xml.dom.minidom.parseString(xmlstring)
994
def make_tag(document, name, prop):
995
e = document.createElement("property")
996
e.setAttribute("name", name)
997
e.setAttribute("type", prop._dbus_signature)
998
e.setAttribute("access", prop._dbus_access)
1001
for if_tag in document.getElementsByTagName("interface"):
1003
for tag in (make_tag(document, name, prop)
1005
in self._get_all_dbus_things("property")
1006
if prop._dbus_interface
1007
== if_tag.getAttribute("name")):
1008
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1038
# Add the names to the return values for the
1039
# "org.freedesktop.DBus.Properties" methods
1040
if (if_tag.getAttribute("name")
1041
== "org.freedesktop.DBus.Properties"):
1042
for cn in if_tag.getElementsByTagName("method"):
1043
if cn.getAttribute("name") == "Get":
1044
for arg in cn.getElementsByTagName("arg"):
1045
if (arg.getAttribute("direction")
1047
arg.setAttribute("name", "value")
1048
elif cn.getAttribute("name") == "GetAll":
1049
for arg in cn.getElementsByTagName("arg"):
1050
if (arg.getAttribute("direction")
1052
arg.setAttribute("name", "props")
1053
xmlstring = document.toxml("utf-8")
1055
except (AttributeError, xml.dom.DOMException,
1056
xml.parsers.expat.ExpatError) as error:
1057
logger.error("Failed to override Introspection method",
1062
def datetime_to_dbus(dt, variant_level=0):
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
return dbus.String("", variant_level = variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
"""A class decorator; applied to a subclass of
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1072
interface names according to the "alt_interface_names" mapping.
1075
@alternate_dbus_interfaces({"org.example.Interface":
1076
"net.example.AlternateInterface"})
1077
class SampleDBusObject(dbus.service.Object):
1078
@dbus.service.method("org.example.Interface")
1079
def SampleDBusMethod():
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
reachable via two interfaces: "org.example.Interface" and
1084
"net.example.AlternateInterface", the latter of which will have
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
"true", unless "deprecate" is passed with a False value.
1088
This works for methods and signals, and also for D-Bus properties
1089
(from DBusObjectWithProperties) and interfaces (from the
1090
dbus_interface_annotations decorator).
1094
for orig_interface_name, alt_interface_name in (
1095
alt_interface_names.items()):
1097
interface_names = set()
1098
# Go though all attributes of the class
1099
for attrname, attribute in inspect.getmembers(cls):
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
1101
# with the wrong interface name
1102
if (not hasattr(attribute, "_dbus_interface")
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
1106
# Create an alternate D-Bus interface name based on
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1110
interface_names.add(alt_interface)
1111
# Is this a D-Bus signal?
1112
if getattr(attribute, "_dbus_is_signal", False):
1113
# Extract the original non-method undecorated
1114
# function by black magic
1115
nonmethod_func = (dict(
1116
zip(attribute.func_code.co_freevars,
1117
attribute.__closure__))
1118
["func"].cell_contents)
1119
# Create a new, but exactly alike, function
1120
# object, and decorate it to be a new D-Bus signal
1121
# with the alternate D-Bus interface name
1122
new_function = (dbus.service.signal(
1123
alt_interface, attribute._dbus_signature)
1124
(types.FunctionType(
1125
nonmethod_func.func_code,
1126
nonmethod_func.func_globals,
1127
nonmethod_func.func_name,
1128
nonmethod_func.func_defaults,
1129
nonmethod_func.func_closure)))
1130
# Copy annotations, if any
1132
new_function._dbus_annotations = dict(
1133
attribute._dbus_annotations)
1134
except AttributeError:
1136
# Define a creator of a function to call both the
1137
# original and alternate functions, so both the
1138
# original and alternate signals gets sent when
1139
# the function is called
1140
def fixscope(func1, func2):
1141
"""This function is a scope container to pass
1142
func1 and func2 to the "call_both" function
1143
outside of its arguments"""
1145
def call_both(*args, **kwargs):
1146
"""This function will emit two D-Bus
1147
signals by calling func1 and func2"""
1148
func1(*args, **kwargs)
1149
func2(*args, **kwargs)
1152
# Create the "call_both" function and add it to
1154
attr[attrname] = fixscope(attribute, new_function)
1155
# Is this a D-Bus method?
1156
elif getattr(attribute, "_dbus_is_method", False):
1157
# Create a new, but exactly alike, function
1158
# object. Decorate it to be a new D-Bus method
1159
# with the alternate D-Bus interface name. Add it
1162
dbus.service.method(
1164
attribute._dbus_in_signature,
1165
attribute._dbus_out_signature)
1166
(types.FunctionType(attribute.func_code,
1167
attribute.func_globals,
1168
attribute.func_name,
1169
attribute.func_defaults,
1170
attribute.func_closure)))
1171
# Copy annotations, if any
1173
attr[attrname]._dbus_annotations = dict(
1174
attribute._dbus_annotations)
1175
except AttributeError:
1177
# Is this a D-Bus property?
1178
elif getattr(attribute, "_dbus_is_property", False):
1179
# Create a new, but exactly alike, function
1180
# object, and decorate it to be a new D-Bus
1181
# property with the alternate D-Bus interface
1182
# name. Add it to the class.
1183
attr[attrname] = (dbus_service_property(
1184
alt_interface, attribute._dbus_signature,
1185
attribute._dbus_access,
1186
attribute._dbus_get_args_options
1188
(types.FunctionType(
1189
attribute.func_code,
1190
attribute.func_globals,
1191
attribute.func_name,
1192
attribute.func_defaults,
1193
attribute.func_closure)))
1194
# Copy annotations, if any
1196
attr[attrname]._dbus_annotations = dict(
1197
attribute._dbus_annotations)
1198
except AttributeError:
1200
# Is this a D-Bus interface?
1201
elif getattr(attribute, "_dbus_is_interface", False):
1202
# Create a new, but exactly alike, function
1203
# object. Decorate it to be a new D-Bus interface
1204
# with the alternate D-Bus interface name. Add it
1207
dbus_interface_annotations(alt_interface)
1208
(types.FunctionType(attribute.func_code,
1209
attribute.func_globals,
1210
attribute.func_name,
1211
attribute.func_defaults,
1212
attribute.func_closure)))
1214
# Deprecate all alternate interfaces
1215
iname="_AlternateDBusNames_interface_annotation{}"
1216
for interface_name in interface_names:
1218
@dbus_interface_annotations(interface_name)
1220
return { "org.freedesktop.DBus.Deprecated":
1222
# Find an unused name
1223
for aname in (iname.format(i)
1224
for i in itertools.count()):
1225
if aname not in attr:
1229
# Replace the class with a new subclass of it with
1230
# methods, signals, etc. as created above.
1231
cls = type(b"{}Alternate".format(cls.__name__),
1238
@alternate_dbus_interfaces({"se.recompile.Mandos":
1239
"se.bsnet.fukt.Mandos"})
1240
class ClientDBus(Client, DBusObjectWithProperties):
469
def still_valid(self):
470
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
473
now = datetime.datetime.utcnow()
474
if self.last_checked_ok is None:
475
return now < (self.created + self.timeout)
477
return now < (self.last_checked_ok + self.timeout)
480
class ClientDBus(Client, dbus.service.Object):
1241
481
"""A Client class using D-Bus
1244
484
dbus_object_path: dbus.ObjectPath
1245
485
bus: dbus.SystemBus()
1248
runtime_expansions = (Client.runtime_expansions
1249
+ ("dbus_object_path", ))
1251
_interface = "se.recompile.Mandos.Client"
1253
487
# dbus.service.Object doesn't use super(), so we can't either.
1255
489
def __init__(self, bus = None, *args, **kwargs):
1257
491
Client.__init__(self, *args, **kwargs)
1258
492
# Only now, when this client is initialized, can it show up on
1260
client_object_name = str(self.name).translate(
1261
{ord("."): ord("_"),
1262
ord("-"): ord("_")})
1263
self.dbus_object_path = dbus.ObjectPath(
1264
"/clients/" + client_object_name)
1265
DBusObjectWithProperties.__init__(self, self.bus,
1266
self.dbus_object_path)
1268
def notifychangeproperty(transform_func, dbus_name,
1269
type_func=lambda x: x,
1271
invalidate_only=False,
1272
_interface=_interface):
1273
""" Modify a variable so that it's a property which announces
1274
its changes to DBus.
1276
transform_fun: Function that takes a value and a variant_level
1277
and transforms it to a D-Bus type.
1278
dbus_name: D-Bus name of the variable
1279
type_func: Function that transform the value before sending it
1280
to the D-Bus. Default: no transform
1281
variant_level: D-Bus variant level. Default: 1
1283
attrname = "_{}".format(dbus_name)
1285
def setter(self, value):
1286
if hasattr(self, "dbus_object_path"):
1287
if (not hasattr(self, attrname) or
1288
type_func(getattr(self, attrname, None))
1289
!= type_func(value)):
1291
self.PropertiesChanged(
1292
_interface, dbus.Dictionary(),
1293
dbus.Array((dbus_name, )))
1295
dbus_value = transform_func(
1297
variant_level = variant_level)
1298
self.PropertyChanged(dbus.String(dbus_name),
1300
self.PropertiesChanged(
1302
dbus.Dictionary({ dbus.String(dbus_name):
1305
setattr(self, attrname, value)
1307
return property(lambda self: getattr(self, attrname), setter)
1309
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1310
approvals_pending = notifychangeproperty(dbus.Boolean,
1313
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1314
last_enabled = notifychangeproperty(datetime_to_dbus,
1316
checker = notifychangeproperty(
1317
dbus.Boolean, "CheckerRunning",
1318
type_func = lambda checker: checker is not None)
1319
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1321
last_checker_status = notifychangeproperty(dbus.Int16,
1322
"LastCheckerStatus")
1323
last_approval_request = notifychangeproperty(
1324
datetime_to_dbus, "LastApprovalRequest")
1325
approved_by_default = notifychangeproperty(dbus.Boolean,
1326
"ApprovedByDefault")
1327
approval_delay = notifychangeproperty(
1328
dbus.UInt64, "ApprovalDelay",
1329
type_func = lambda td: td.total_seconds() * 1000)
1330
approval_duration = notifychangeproperty(
1331
dbus.UInt64, "ApprovalDuration",
1332
type_func = lambda td: td.total_seconds() * 1000)
1333
host = notifychangeproperty(dbus.String, "Host")
1334
timeout = notifychangeproperty(
1335
dbus.UInt64, "Timeout",
1336
type_func = lambda td: td.total_seconds() * 1000)
1337
extended_timeout = notifychangeproperty(
1338
dbus.UInt64, "ExtendedTimeout",
1339
type_func = lambda td: td.total_seconds() * 1000)
1340
interval = notifychangeproperty(
1341
dbus.UInt64, "Interval",
1342
type_func = lambda td: td.total_seconds() * 1000)
1343
checker_command = notifychangeproperty(dbus.String, "Checker")
1344
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1345
invalidate_only=True)
1347
del notifychangeproperty
494
self.dbus_object_path = (dbus.ObjectPath
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
1349
528
def __del__(self, *args, **kwargs):
1351
530
self.remove_from_connection()
1352
531
except LookupError:
1354
if hasattr(DBusObjectWithProperties, "__del__"):
1355
DBusObjectWithProperties.__del__(self, *args, **kwargs)
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
1356
535
Client.__del__(self, *args, **kwargs)
1358
537
def checker_callback(self, pid, condition, command,
1359
538
*args, **kwargs):
1360
539
self.checker_callback_tag = None
1361
540
self.checker = None
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
1362
544
if os.WIFEXITED(condition):
1363
545
exitstatus = os.WEXITSTATUS(condition)
1364
546
# Emit D-Bus signal
1374
556
return Client.checker_callback(self, pid, condition, command,
1375
557
*args, **kwargs)
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
1377
568
def start_checker(self, *args, **kwargs):
1378
old_checker_pid = getattr(self.checker, "pid", None)
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
573
old_checker_pid = None
1379
574
r = Client.start_checker(self, *args, **kwargs)
1380
575
# Only if new checker process was started
1381
576
if (self.checker is not None
1382
577
and old_checker_pid != self.checker.pid):
1383
578
# Emit D-Bus signal
1384
579
self.CheckerStarted(self.current_checker_command)
1387
def _reset_approved(self):
1388
self.approved = None
1391
def approve(self, value=True):
1392
self.approved = value
1393
gobject.timeout_add(int(self.approval_duration.total_seconds()
1394
* 1000), self._reset_approved)
1395
self.send_changedstate()
1397
## D-Bus methods, signals & properties
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
594
## D-Bus methods & signals
595
_interface = u"se.bsnet.fukt.Mandos.Client"
598
@dbus.service.method(_interface)
600
return self.checked_ok()
1403
602
# CheckerCompleted - signal
1404
@dbus.service.signal(_interface, signature="nxs")
603
@dbus.service.signal(_interface, signature=u"nxs")
1405
604
def CheckerCompleted(self, exitcode, waitstatus, command):
1409
608
# CheckerStarted - signal
1410
@dbus.service.signal(_interface, signature="s")
609
@dbus.service.signal(_interface, signature=u"s")
1411
610
def CheckerStarted(self, command):
614
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
616
def GetAllProperties(self):
618
return dbus.Dictionary({
619
dbus.String(u"name"):
620
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
622
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
624
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
631
if self.last_enabled is not None
632
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
634
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
638
if self.last_checked_ok is not None
639
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
641
dbus.UInt64(self.timeout_milliseconds(),
643
dbus.String(u"interval"):
644
dbus.UInt64(self.interval_milliseconds(),
646
dbus.String(u"checker"):
647
dbus.String(self.checker_command,
649
dbus.String(u"checker_running"):
650
dbus.Boolean(self.checker is not None,
652
dbus.String(u"object_path"):
653
dbus.ObjectPath(self.dbus_object_path,
657
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
1415
662
# PropertyChanged - signal
1416
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1417
@dbus.service.signal(_interface, signature="sv")
663
@dbus.service.signal(_interface, signature=u"sv")
1418
664
def PropertyChanged(self, property, value):
1422
# GotSecret - signal
668
# ReceivedSecret - signal
1423
669
@dbus.service.signal(_interface)
1424
def GotSecret(self):
1426
Is sent after a successful transfer of secret from the Mandos
1427
server to mandos-client
670
def ReceivedSecret(self):
1431
674
# Rejected - signal
1432
@dbus.service.signal(_interface, signature="s")
1433
def Rejected(self, reason):
675
@dbus.service.signal(_interface)
1437
# NeedApproval - signal
1438
@dbus.service.signal(_interface, signature="tb")
1439
def NeedApproval(self, timeout, default):
1441
return self.need_approval()
1446
@dbus.service.method(_interface, in_signature="b")
1447
def Approve(self, value):
1450
# CheckedOK - method
1451
@dbus.service.method(_interface)
1452
def CheckedOK(self):
680
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
682
def SetChecker(self, checker):
683
"D-Bus setter method"
684
self.checker_command = checker
686
self.PropertyChanged(dbus.String(u"checker"),
687
dbus.String(self.checker_command,
691
@dbus.service.method(_interface, in_signature=u"s")
692
def SetHost(self, host):
693
"D-Bus setter method"
696
self.PropertyChanged(dbus.String(u"host"),
697
dbus.String(self.host, variant_level=1))
699
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
701
def SetInterval(self, milliseconds):
702
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
704
self.PropertyChanged(dbus.String(u"interval"),
705
(dbus.UInt64(self.interval_milliseconds(),
709
@dbus.service.method(_interface, in_signature=u"ay",
711
def SetSecret(self, secret):
712
"D-Bus setter method"
713
self.secret = str(secret)
715
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
717
def SetTimeout(self, milliseconds):
718
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
720
self.PropertyChanged(dbus.String(u"timeout"),
721
(dbus.UInt64(self.timeout_milliseconds(),
1455
724
# Enable - method
1456
725
@dbus.service.method(_interface)
1475
744
def StopChecker(self):
1476
745
self.stop_checker()
1480
# ApprovalPending - property
1481
@dbus_service_property(_interface, signature="b", access="read")
1482
def ApprovalPending_dbus_property(self):
1483
return dbus.Boolean(bool(self.approvals_pending))
1485
# ApprovedByDefault - property
1486
@dbus_service_property(_interface,
1489
def ApprovedByDefault_dbus_property(self, value=None):
1490
if value is None: # get
1491
return dbus.Boolean(self.approved_by_default)
1492
self.approved_by_default = bool(value)
1494
# ApprovalDelay - property
1495
@dbus_service_property(_interface,
1498
def ApprovalDelay_dbus_property(self, value=None):
1499
if value is None: # get
1500
return dbus.UInt64(self.approval_delay.total_seconds()
1502
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1504
# ApprovalDuration - property
1505
@dbus_service_property(_interface,
1508
def ApprovalDuration_dbus_property(self, value=None):
1509
if value is None: # get
1510
return dbus.UInt64(self.approval_duration.total_seconds()
1512
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1515
@dbus_service_property(_interface, signature="s", access="read")
1516
def Name_dbus_property(self):
1517
return dbus.String(self.name)
1519
# Fingerprint - property
1520
@dbus_service_property(_interface, signature="s", access="read")
1521
def Fingerprint_dbus_property(self):
1522
return dbus.String(self.fingerprint)
1525
@dbus_service_property(_interface,
1528
def Host_dbus_property(self, value=None):
1529
if value is None: # get
1530
return dbus.String(self.host)
1531
self.host = str(value)
1533
# Created - property
1534
@dbus_service_property(_interface, signature="s", access="read")
1535
def Created_dbus_property(self):
1536
return datetime_to_dbus(self.created)
1538
# LastEnabled - property
1539
@dbus_service_property(_interface, signature="s", access="read")
1540
def LastEnabled_dbus_property(self):
1541
return datetime_to_dbus(self.last_enabled)
1543
# Enabled - property
1544
@dbus_service_property(_interface,
1547
def Enabled_dbus_property(self, value=None):
1548
if value is None: # get
1549
return dbus.Boolean(self.enabled)
1555
# LastCheckedOK - property
1556
@dbus_service_property(_interface,
1559
def LastCheckedOK_dbus_property(self, value=None):
1560
if value is not None:
1563
return datetime_to_dbus(self.last_checked_ok)
1565
# LastCheckerStatus - property
1566
@dbus_service_property(_interface, signature="n", access="read")
1567
def LastCheckerStatus_dbus_property(self):
1568
return dbus.Int16(self.last_checker_status)
1570
# Expires - property
1571
@dbus_service_property(_interface, signature="s", access="read")
1572
def Expires_dbus_property(self):
1573
return datetime_to_dbus(self.expires)
1575
# LastApprovalRequest - property
1576
@dbus_service_property(_interface, signature="s", access="read")
1577
def LastApprovalRequest_dbus_property(self):
1578
return datetime_to_dbus(self.last_approval_request)
1580
# Timeout - property
1581
@dbus_service_property(_interface,
1584
def Timeout_dbus_property(self, value=None):
1585
if value is None: # get
1586
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1587
old_timeout = self.timeout
1588
self.timeout = datetime.timedelta(0, 0, 0, value)
1589
# Reschedule disabling
1591
now = datetime.datetime.utcnow()
1592
self.expires += self.timeout - old_timeout
1593
if self.expires <= now:
1594
# The timeout has passed
1597
if (getattr(self, "disable_initiator_tag", None)
1600
gobject.source_remove(self.disable_initiator_tag)
1601
self.disable_initiator_tag = gobject.timeout_add(
1602
int((self.expires - now).total_seconds() * 1000),
1605
# ExtendedTimeout - property
1606
@dbus_service_property(_interface,
1609
def ExtendedTimeout_dbus_property(self, value=None):
1610
if value is None: # get
1611
return dbus.UInt64(self.extended_timeout.total_seconds()
1613
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1615
# Interval - property
1616
@dbus_service_property(_interface,
1619
def Interval_dbus_property(self, value=None):
1620
if value is None: # get
1621
return dbus.UInt64(self.interval.total_seconds() * 1000)
1622
self.interval = datetime.timedelta(0, 0, 0, value)
1623
if getattr(self, "checker_initiator_tag", None) is None:
1626
# Reschedule checker run
1627
gobject.source_remove(self.checker_initiator_tag)
1628
self.checker_initiator_tag = gobject.timeout_add(
1629
value, self.start_checker)
1630
self.start_checker() # Start one now, too
1632
# Checker - property
1633
@dbus_service_property(_interface,
1636
def Checker_dbus_property(self, value=None):
1637
if value is None: # get
1638
return dbus.String(self.checker_command)
1639
self.checker_command = str(value)
1641
# CheckerRunning - property
1642
@dbus_service_property(_interface,
1645
def CheckerRunning_dbus_property(self, value=None):
1646
if value is None: # get
1647
return dbus.Boolean(self.checker is not None)
1649
self.start_checker()
1653
# ObjectPath - property
1654
@dbus_service_property(_interface, signature="o", access="read")
1655
def ObjectPath_dbus_property(self):
1656
return self.dbus_object_path # is already a dbus.ObjectPath
1659
@dbus_service_property(_interface,
1663
def Secret_dbus_property(self, value):
1664
self.secret = bytes(value)
1669
class ProxyClient(object):
1670
def __init__(self, child_pipe, fpr, address):
1671
self._pipe = child_pipe
1672
self._pipe.send(('init', fpr, address))
1673
if not self._pipe.recv():
1676
def __getattribute__(self, name):
1678
return super(ProxyClient, self).__getattribute__(name)
1679
self._pipe.send(('getattr', name))
1680
data = self._pipe.recv()
1681
if data[0] == 'data':
1683
if data[0] == 'function':
1685
def func(*args, **kwargs):
1686
self._pipe.send(('funcall', name, args, kwargs))
1687
return self._pipe.recv()[1]
1691
def __setattr__(self, name, value):
1693
return super(ProxyClient, self).__setattr__(name, value)
1694
self._pipe.send(('setattr', name, value))
1697
750
class ClientHandler(socketserver.BaseRequestHandler, object):
1698
751
"""A class to handle client connections.
1701
754
Note: This will run in its own forked process."""
1703
756
def handle(self):
1704
with contextlib.closing(self.server.child_pipe) as child_pipe:
1705
logger.info("TCP connection from: %s",
1706
str(self.client_address))
1707
logger.debug("Pipe FD: %d",
1708
self.server.child_pipe.fileno())
757
logger.info(u"TCP connection from: %s",
758
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
1710
session = gnutls.connection.ClientSession(
1711
self.request, gnutls.connection .X509Credentials())
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
770
if int(line.strip().split()[0]) > 1:
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
1713
776
# Note: gnutls.connection.X509Credentials is really a
1714
777
# generic GnuTLS certificate credentials object so long as
1715
778
# no X.509 keys are added to it. Therefore, we can use it
1716
779
# here despite using OpenPGP certificates.
1718
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1719
# "+AES-256-CBC", "+SHA1",
1720
# "+COMP-NULL", "+CTYPE-OPENPGP",
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1722
785
# Use a fallback default, since this MUST be set.
1723
786
priority = self.server.gnutls_priority
1724
787
if priority is None:
1726
gnutls.library.functions.gnutls_priority_set_direct(
1727
session._c_object, priority, None)
1729
# Start communication using the Mandos protocol
1730
# Get protocol number
1731
line = self.request.makefile().readline()
1732
logger.debug("Protocol version: %r", line)
1734
if int(line.strip().split()[0]) > 1:
1735
raise RuntimeError(line)
1736
except (ValueError, IndexError, RuntimeError) as error:
1737
logger.error("Unknown protocol version: %s", error)
1740
# Start GnuTLS connection
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
1742
794
session.handshake()
1743
except gnutls.errors.GNUTLSError as error:
1744
logger.warning("Handshake failed: %s", error)
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
1745
797
# Do not run session.bye() here: the session is not
1746
798
# established. Just abandon the request.
1748
logger.debug("Handshake succeeded")
1750
approval_required = False
800
logger.debug(u"Handshake succeeded")
1753
fpr = self.fingerprint(
1754
self.peer_certificate(session))
1756
gnutls.errors.GNUTLSError) as error:
1757
logger.warning("Bad certificate: %s", error)
1759
logger.debug("Fingerprint: %s", fpr)
1762
client = ProxyClient(child_pipe, fpr,
1763
self.client_address)
1767
if client.approval_delay:
1768
delay = client.approval_delay
1769
client.approvals_pending += 1
1770
approval_required = True
1773
if not client.enabled:
1774
logger.info("Client %s is disabled",
1776
if self.server.use_dbus:
1778
client.Rejected("Disabled")
1781
if client.approved or not client.approval_delay:
1782
#We are approved or approval is disabled
1784
elif client.approved is None:
1785
logger.info("Client %s needs approval",
1787
if self.server.use_dbus:
1789
client.NeedApproval(
1790
client.approval_delay.total_seconds()
1791
* 1000, client.approved_by_default)
1793
logger.warning("Client %s was not approved",
1795
if self.server.use_dbus:
1797
client.Rejected("Denied")
1800
#wait until timeout or approved
1801
time = datetime.datetime.now()
1802
client.changedstate.acquire()
1803
client.changedstate.wait(delay.total_seconds())
1804
client.changedstate.release()
1805
time2 = datetime.datetime.now()
1806
if (time2 - time) >= delay:
1807
if not client.approved_by_default:
1808
logger.warning("Client %s timed out while"
1809
" waiting for approval",
1811
if self.server.use_dbus:
1813
client.Rejected("Approval timed out")
1818
delay -= time2 - time
1821
while sent_size < len(client.secret):
1823
sent = session.send(client.secret[sent_size:])
1824
except gnutls.errors.GNUTLSError as error:
1825
logger.warning("gnutls send failed",
1828
logger.debug("Sent: %d, remaining: %d", sent,
1829
len(client.secret) - (sent_size
1833
logger.info("Sending secret to %s", client.name)
1834
# bump the timeout using extended_timeout
1835
client.bump_timeout(client.extended_timeout)
1836
if self.server.use_dbus:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
807
logger.debug(u"Fingerprint: %s", fpr)
1841
if approval_required:
1842
client.approvals_pending -= 1
1845
except gnutls.errors.GNUTLSError as error:
1846
logger.warning("GnuTLS bye failed",
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
814
ipc.write(u"NOTFOUND %s\n" % fpr)
817
# Have to check if client.still_valid(), since it is
818
# possible that the client timed out while establishing
819
# the GnuTLS session.
820
if not client.still_valid():
821
ipc.write(u"INVALID %s\n" % client.name)
824
ipc.write(u"SENDING %s\n" % client.name)
826
while sent_size < len(client.secret):
827
sent = session.send(client.secret[sent_size:])
828
logger.debug(u"Sent: %d, remaining: %d",
829
sent, len(client.secret)
830
- (sent_size + sent))
1850
835
def peer_certificate(session):
1851
836
"Return the peer's OpenPGP certificate as a bytestring"
1852
837
# If not an OpenPGP certificate...
1853
if (gnutls.library.functions.gnutls_certificate_type_get(
838
if (gnutls.library.functions
839
.gnutls_certificate_type_get(session._c_object)
1855
840
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1856
841
# ...do the normal thing
1857
842
return session.peer_certificate
2047
982
clients: set of Client objects
2048
983
gnutls_priority GnuTLS priority string
2049
984
use_dbus: Boolean; to emit D-Bus signals or not
985
clients: set of Client objects
986
gnutls_priority GnuTLS priority string
987
use_dbus: Boolean; to emit D-Bus signals or not
2051
989
Assumes a gobject.MainLoop event loop.
2054
991
def __init__(self, server_address, RequestHandlerClass,
2058
gnutls_priority=None,
992
interface=None, use_ipv6=True, clients=None,
993
gnutls_priority=None, use_dbus=True):
2061
994
self.enabled = False
2062
995
self.clients = clients
2063
996
if self.clients is None:
2065
998
self.use_dbus = use_dbus
2066
999
self.gnutls_priority = gnutls_priority
2067
1000
IPv6_TCPServer.__init__(self, server_address,
2068
1001
RequestHandlerClass,
2069
1002
interface = interface,
2070
use_ipv6 = use_ipv6,
2071
socketfd = socketfd)
1003
use_ipv6 = use_ipv6)
2073
1004
def server_activate(self):
2074
1005
if self.enabled:
2075
1006
return socketserver.TCPServer.server_activate(self)
2077
1007
def enable(self):
2078
1008
self.enabled = True
2080
def add_pipe(self, parent_pipe, proc):
1009
def add_pipe(self, pipe):
2081
1010
# Call "handle_ipc" for both data and EOF events
2082
gobject.io_add_watch(
2083
parent_pipe.fileno(),
2084
gobject.IO_IN | gobject.IO_HUP,
2085
functools.partial(self.handle_ipc,
2086
parent_pipe = parent_pipe,
2089
def handle_ipc(self, source, condition,
2092
client_object=None):
2093
# error, or the other end of multiprocessing.Pipe has closed
2094
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2095
# Wait for other process to exit
2099
# Read a request from the child
2100
request = parent_pipe.recv()
2101
command = request[0]
2103
if command == 'init':
2105
address = request[2]
2107
for c in self.clients.itervalues():
2108
if c.fingerprint == fpr:
2112
logger.info("Client not found for fingerprint: %s, ad"
2113
"dress: %s", fpr, address)
2116
mandos_dbus_service.ClientNotFound(fpr,
2118
parent_pipe.send(False)
2121
gobject.io_add_watch(
2122
parent_pipe.fileno(),
2123
gobject.IO_IN | gobject.IO_HUP,
2124
functools.partial(self.handle_ipc,
2125
parent_pipe = parent_pipe,
2127
client_object = client))
2128
parent_pipe.send(True)
2129
# remove the old hook in favor of the new above hook on
2132
if command == 'funcall':
2133
funcname = request[1]
2137
parent_pipe.send(('data', getattr(client_object,
2141
if command == 'getattr':
2142
attrname = request[1]
2143
if callable(client_object.__getattribute__(attrname)):
2144
parent_pipe.send(('function', ))
2147
'data', client_object.__getattribute__(attrname)))
2149
if command == 'setattr':
2150
attrname = request[1]
2152
setattr(client_object, attrname, value)
1011
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1013
def handle_ipc(self, source, condition, file_objects={}):
1015
gobject.IO_IN: u"IN", # There is data to read.
1016
gobject.IO_OUT: u"OUT", # Data can be written (without
1018
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1019
gobject.IO_ERR: u"ERR", # Error condition.
1020
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1021
# broken, usually for pipes and
1024
conditions_string = ' | '.join(name
1026
condition_names.iteritems()
1027
if cond & condition)
1028
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1031
# Turn the pipe file descriptor into a Python file object
1032
if source not in file_objects:
1033
file_objects[source] = os.fdopen(source, u"r", 1)
1035
# Read a line from the file object
1036
cmdline = file_objects[source].readline()
1037
if not cmdline: # Empty line means end of file
1038
# close the IPC pipe
1039
file_objects[source].close()
1040
del file_objects[source]
1042
# Stop calling this function
1045
logger.debug(u"IPC command: %r", cmdline)
1047
# Parse and act on command
1048
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1050
if cmd == u"NOTFOUND":
1051
logger.warning(u"Client not found for fingerprint: %s",
1055
mandos_dbus_service.ClientNotFound(args)
1056
elif cmd == u"INVALID":
1057
for client in self.clients:
1058
if client.name == args:
1059
logger.warning(u"Client %s is invalid", args)
1065
logger.error(u"Unknown client %s is invalid", args)
1066
elif cmd == u"SENDING":
1067
for client in self.clients:
1068
if client.name == args:
1069
logger.info(u"Sending secret to %s", client.name)
1073
client.ReceivedSecret()
1076
logger.error(u"Sending secret to unknown client %s",
1079
logger.error(u"Unknown IPC command: %r", cmdline)
1081
# Keep calling this function
2157
def rfc3339_duration_to_delta(duration):
2158
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2160
>>> rfc3339_duration_to_delta("P7D")
2161
datetime.timedelta(7)
2162
>>> rfc3339_duration_to_delta("PT60S")
2163
datetime.timedelta(0, 60)
2164
>>> rfc3339_duration_to_delta("PT60M")
2165
datetime.timedelta(0, 3600)
2166
>>> rfc3339_duration_to_delta("PT24H")
2167
datetime.timedelta(1)
2168
>>> rfc3339_duration_to_delta("P1W")
2169
datetime.timedelta(7)
2170
>>> rfc3339_duration_to_delta("PT5M30S")
2171
datetime.timedelta(0, 330)
2172
>>> rfc3339_duration_to_delta("P1DT3M20S")
2173
datetime.timedelta(1, 200)
2176
# Parsing an RFC 3339 duration with regular expressions is not
2177
# possible - there would have to be multiple places for the same
2178
# values, like seconds. The current code, while more esoteric, is
2179
# cleaner without depending on a parsing library. If Python had a
2180
# built-in library for parsing we would use it, but we'd like to
2181
# avoid excessive use of external libraries.
2183
# New type for defining tokens, syntax, and semantics all-in-one
2184
Token = collections.namedtuple("Token",
2185
("regexp", # To match token; if
2186
# "value" is not None,
2187
# must have a "group"
2189
"value", # datetime.timedelta or
2191
"followers")) # Tokens valid after
2193
Token = collections.namedtuple("Token", (
2194
"regexp", # To match token; if "value" is not None, must have
2195
# a "group" containing digits
2196
"value", # datetime.timedelta or None
2197
"followers")) # Tokens valid after this token
2198
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2199
# the "duration" ABNF definition in RFC 3339, Appendix A.
2200
token_end = Token(re.compile(r"$"), None, frozenset())
2201
token_second = Token(re.compile(r"(\d+)S"),
2202
datetime.timedelta(seconds=1),
2203
frozenset((token_end, )))
2204
token_minute = Token(re.compile(r"(\d+)M"),
2205
datetime.timedelta(minutes=1),
2206
frozenset((token_second, token_end)))
2207
token_hour = Token(re.compile(r"(\d+)H"),
2208
datetime.timedelta(hours=1),
2209
frozenset((token_minute, token_end)))
2210
token_time = Token(re.compile(r"T"),
2212
frozenset((token_hour, token_minute,
2214
token_day = Token(re.compile(r"(\d+)D"),
2215
datetime.timedelta(days=1),
2216
frozenset((token_time, token_end)))
2217
token_month = Token(re.compile(r"(\d+)M"),
2218
datetime.timedelta(weeks=4),
2219
frozenset((token_day, token_end)))
2220
token_year = Token(re.compile(r"(\d+)Y"),
2221
datetime.timedelta(weeks=52),
2222
frozenset((token_month, token_end)))
2223
token_week = Token(re.compile(r"(\d+)W"),
2224
datetime.timedelta(weeks=1),
2225
frozenset((token_end, )))
2226
token_duration = Token(re.compile(r"P"), None,
2227
frozenset((token_year, token_month,
2228
token_day, token_time,
2230
# Define starting values
2231
value = datetime.timedelta() # Value so far
2233
followers = frozenset((token_duration,)) # Following valid tokens
2234
s = duration # String left to parse
2235
# Loop until end token is found
2236
while found_token is not token_end:
2237
# Search for any currently valid tokens
2238
for token in followers:
2239
match = token.regexp.match(s)
2240
if match is not None:
2242
if token.value is not None:
2243
# Value found, parse digits
2244
factor = int(match.group(1), 10)
2245
# Add to value so far
2246
value += factor * token.value
2247
# Strip token from string
2248
s = token.regexp.sub("", s, 1)
2251
# Set valid next tokens
2252
followers = found_token.followers
2255
# No currently valid tokens were found
2256
raise ValueError("Invalid RFC 3339 duration")
2261
1085
def string_to_delta(interval):
2262
1086
"""Parse a string and return a datetime.timedelta
2264
>>> string_to_delta('7d')
1088
>>> string_to_delta(u'7d')
2265
1089
datetime.timedelta(7)
2266
>>> string_to_delta('60s')
1090
>>> string_to_delta(u'60s')
2267
1091
datetime.timedelta(0, 60)
2268
>>> string_to_delta('60m')
1092
>>> string_to_delta(u'60m')
2269
1093
datetime.timedelta(0, 3600)
2270
>>> string_to_delta('24h')
1094
>>> string_to_delta(u'24h')
2271
1095
datetime.timedelta(1)
2272
>>> string_to_delta('1w')
1096
>>> string_to_delta(u'1w')
2273
1097
datetime.timedelta(7)
2274
>>> string_to_delta('5m 30s')
1098
>>> string_to_delta(u'5m 30s')
2275
1099
datetime.timedelta(0, 330)
2279
return rfc3339_duration_to_delta(interval)
2283
1101
timevalue = datetime.timedelta(0)
2284
1102
for s in interval.split():
1104
suffix = unicode(s[-1])
2287
1105
value = int(s[:-1])
2289
1107
delta = datetime.timedelta(value)
1108
elif suffix == u"s":
2291
1109
delta = datetime.timedelta(0, value)
1110
elif suffix == u"m":
2293
1111
delta = datetime.timedelta(0, 0, 0, 0, value)
1112
elif suffix == u"h":
2295
1113
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1114
elif suffix == u"w":
2297
1115
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2299
raise ValueError("Unknown suffix {!r}".format(suffix))
2300
except IndexError as e:
2301
raise ValueError(*(e.args))
1118
except (ValueError, IndexError):
2302
1120
timevalue += delta
2303
1121
return timevalue
1124
def if_nametoindex(interface):
1125
"""Call the C function if_nametoindex(), or equivalent
1127
Note: This function cannot accept a unicode string."""
1128
global if_nametoindex
1130
if_nametoindex = (ctypes.cdll.LoadLibrary
1131
(ctypes.util.find_library(u"c"))
1133
except (OSError, AttributeError):
1134
logger.warning(u"Doing if_nametoindex the hard way")
1135
def if_nametoindex(interface):
1136
"Get an interface index the hard way, i.e. using fcntl()"
1137
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1138
with closing(socket.socket()) as s:
1139
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1140
struct.pack(str(u"16s16x"),
1142
interface_index = struct.unpack(str(u"I"),
1144
return interface_index
1145
return if_nametoindex(interface)
2306
1148
def daemon(nochdir = False, noclose = False):
2307
1149
"""See daemon(3). Standard BSD Unix function.
2333
##################################################################
1174
######################################################################
2334
1175
# Parsing of options, both command line and config file
2336
parser = argparse.ArgumentParser()
2337
parser.add_argument("-v", "--version", action="version",
2338
version = "%(prog)s {}".format(version),
2339
help="show version number and exit")
2340
parser.add_argument("-i", "--interface", metavar="IF",
2341
help="Bind to interface IF")
2342
parser.add_argument("-a", "--address",
2343
help="Address to listen for requests on")
2344
parser.add_argument("-p", "--port", type=int,
2345
help="Port number to receive requests on")
2346
parser.add_argument("--check", action="store_true",
2347
help="Run self-test")
2348
parser.add_argument("--debug", action="store_true",
2349
help="Debug mode; run in foreground and log"
2350
" to terminal", default=None)
2351
parser.add_argument("--debuglevel", metavar="LEVEL",
2352
help="Debug level for stdout output")
2353
parser.add_argument("--priority", help="GnuTLS"
2354
" priority string (see GnuTLS documentation)")
2355
parser.add_argument("--servicename",
2356
metavar="NAME", help="Zeroconf service name")
2357
parser.add_argument("--configdir",
2358
default="/etc/mandos", metavar="DIR",
2359
help="Directory to search for configuration"
2361
parser.add_argument("--no-dbus", action="store_false",
2362
dest="use_dbus", help="Do not provide D-Bus"
2363
" system bus interface", default=None)
2364
parser.add_argument("--no-ipv6", action="store_false",
2365
dest="use_ipv6", help="Do not use IPv6",
2367
parser.add_argument("--no-restore", action="store_false",
2368
dest="restore", help="Do not restore stored"
2369
" state", default=None)
2370
parser.add_argument("--socket", type=int,
2371
help="Specify a file descriptor to a network"
2372
" socket to use instead of creating one")
2373
parser.add_argument("--statedir", metavar="DIR",
2374
help="Directory to save/restore state in")
2375
parser.add_argument("--foreground", action="store_true",
2376
help="Run in foreground", default=None)
2377
parser.add_argument("--no-zeroconf", action="store_false",
2378
dest="zeroconf", help="Do not use Zeroconf",
2381
options = parser.parse_args()
1177
parser = optparse.OptionParser(version = "%%prog %s" % version)
1178
parser.add_option("-i", u"--interface", type=u"string",
1179
metavar="IF", help=u"Bind to interface IF")
1180
parser.add_option("-a", u"--address", type=u"string",
1181
help=u"Address to listen for requests on")
1182
parser.add_option("-p", u"--port", type=u"int",
1183
help=u"Port number to receive requests on")
1184
parser.add_option("--check", action=u"store_true",
1185
help=u"Run self-test")
1186
parser.add_option("--debug", action=u"store_true",
1187
help=u"Debug mode; run in foreground and log to"
1189
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1190
u" priority string (see GnuTLS documentation)")
1191
parser.add_option("--servicename", type=u"string",
1192
metavar=u"NAME", help=u"Zeroconf service name")
1193
parser.add_option("--configdir", type=u"string",
1194
default=u"/etc/mandos", metavar=u"DIR",
1195
help=u"Directory to search for configuration"
1197
parser.add_option("--no-dbus", action=u"store_false",
1198
dest=u"use_dbus", help=u"Do not provide D-Bus"
1199
u" system bus interface")
1200
parser.add_option("--no-ipv6", action=u"store_false",
1201
dest=u"use_ipv6", help=u"Do not use IPv6")
1202
options = parser.parse_args()[0]
2383
1204
if options.check:
2385
fail_count, test_count = doctest.testmod()
2386
sys.exit(os.EX_OK if fail_count == 0 else 1)
2388
1209
# Default values for config file for server-global settings
2389
server_defaults = { "interface": "",
2394
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2395
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2396
"servicename": "Mandos",
2402
"statedir": "/var/lib/mandos",
2403
"foreground": "False",
1210
server_defaults = { u"interface": u"",
1215
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1216
u"servicename": u"Mandos",
1217
u"use_dbus": u"True",
1218
u"use_ipv6": u"True",
2407
1221
# Parse config file for server-global settings
2408
1222
server_config = configparser.SafeConfigParser(server_defaults)
2409
1223
del server_defaults
2410
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1224
server_config.read(os.path.join(options.configdir,
2411
1226
# Convert the SafeConfigParser object to a dict
2412
1227
server_settings = server_config.defaults()
2413
1228
# Use the appropriate methods on the non-string config options
2414
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2415
server_settings[option] = server_config.getboolean("DEFAULT",
1229
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1230
server_settings[option] = server_config.getboolean(u"DEFAULT",
2417
1232
if server_settings["port"]:
2418
server_settings["port"] = server_config.getint("DEFAULT",
2420
if server_settings["socket"]:
2421
server_settings["socket"] = server_config.getint("DEFAULT",
2423
# Later, stdin will, and stdout and stderr might, be dup'ed
2424
# over with an opened os.devnull. But we don't want this to
2425
# happen with a supplied network socket.
2426
if 0 <= server_settings["socket"] <= 2:
2427
server_settings["socket"] = os.dup(server_settings
1233
server_settings["port"] = server_config.getint(u"DEFAULT",
2429
1235
del server_config
2431
1237
# Override the settings from the config file with command line
2432
1238
# options, if set.
2433
for option in ("interface", "address", "port", "debug",
2434
"priority", "servicename", "configdir", "use_dbus",
2435
"use_ipv6", "debuglevel", "restore", "statedir",
2436
"socket", "foreground", "zeroconf"):
1239
for option in (u"interface", u"address", u"port", u"debug",
1240
u"priority", u"servicename", u"configdir",
1241
u"use_dbus", u"use_ipv6"):
2437
1242
value = getattr(options, option)
2438
1243
if value is not None:
2439
1244
server_settings[option] = value
2441
1246
# Force all strings to be unicode
2442
1247
for option in server_settings.keys():
2443
if isinstance(server_settings[option], bytes):
2444
server_settings[option] = (server_settings[option]
2446
# Force all boolean options to be boolean
2447
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2448
"foreground", "zeroconf"):
2449
server_settings[option] = bool(server_settings[option])
2450
# Debug implies foreground
2451
if server_settings["debug"]:
2452
server_settings["foreground"] = True
1248
if type(server_settings[option]) is str:
1249
server_settings[option] = unicode(server_settings[option])
2453
1250
# Now we have our good server settings in "server_settings"
2455
1252
##################################################################
2457
if (not server_settings["zeroconf"]
2458
and not (server_settings["port"]
2459
or server_settings["socket"] != "")):
2460
parser.error("Needs port or socket to work without Zeroconf")
2462
1254
# For convenience
2463
debug = server_settings["debug"]
2464
debuglevel = server_settings["debuglevel"]
2465
use_dbus = server_settings["use_dbus"]
2466
use_ipv6 = server_settings["use_ipv6"]
2467
stored_state_path = os.path.join(server_settings["statedir"],
2469
foreground = server_settings["foreground"]
2470
zeroconf = server_settings["zeroconf"]
2473
initlogger(debug, logging.DEBUG)
2478
level = getattr(logging, debuglevel.upper())
2479
initlogger(debug, level)
2481
if server_settings["servicename"] != "Mandos":
2482
syslogger.setFormatter(
2483
logging.Formatter('Mandos ({}) [%(process)d]:'
2484
' %(levelname)s: %(message)s'.format(
2485
server_settings["servicename"])))
1255
debug = server_settings[u"debug"]
1256
use_dbus = server_settings[u"use_dbus"]
1257
use_ipv6 = server_settings[u"use_ipv6"]
1260
syslogger.setLevel(logging.WARNING)
1261
console.setLevel(logging.WARNING)
1263
if server_settings[u"servicename"] != u"Mandos":
1264
syslogger.setFormatter(logging.Formatter
1265
(u'Mandos (%s) [%%(process)d]:'
1266
u' %%(levelname)s: %%(message)s'
1267
% server_settings[u"servicename"]))
2487
1269
# Parse config file with clients
2488
client_config = configparser.SafeConfigParser(Client
2490
client_config.read(os.path.join(server_settings["configdir"],
1270
client_defaults = { u"timeout": u"1h",
1272
u"checker": u"fping -q -- %%(host)s",
1275
client_config = configparser.SafeConfigParser(client_defaults)
1276
client_config.read(os.path.join(server_settings[u"configdir"],
2493
1279
global mandos_dbus_service
2494
1280
mandos_dbus_service = None
2497
if server_settings["socket"] != "":
2498
socketfd = server_settings["socket"]
2499
tcp_server = MandosServer(
2500
(server_settings["address"], server_settings["port"]),
2502
interface=(server_settings["interface"] or None),
2504
gnutls_priority=server_settings["priority"],
2508
pidfilename = "/run/mandos.pid"
2509
if not os.path.isdir("/run/."):
2510
pidfilename = "/var/run/mandos.pid"
2513
pidfile = open(pidfilename, "w")
2514
except IOError as e:
2515
logger.error("Could not open file %r", pidfilename,
1282
tcp_server = MandosServer((server_settings[u"address"],
1283
server_settings[u"port"]),
1285
interface=server_settings[u"interface"],
1288
server_settings[u"priority"],
1290
pidfilename = u"/var/run/mandos.pid"
1292
pidfile = open(pidfilename, u"w")
1294
logger.error(u"Could not open file %r", pidfilename)
2518
for name in ("_mandos", "mandos", "nobody"):
1297
uid = pwd.getpwnam(u"_mandos").pw_uid
1298
gid = pwd.getpwnam(u"_mandos").pw_gid
2520
uid = pwd.getpwnam(name).pw_uid
2521
gid = pwd.getpwnam(name).pw_gid
1301
uid = pwd.getpwnam(u"mandos").pw_uid
1302
gid = pwd.getpwnam(u"mandos").pw_gid
2523
1303
except KeyError:
1305
uid = pwd.getpwnam(u"nobody").pw_uid
1306
gid = pwd.getpwnam(u"nobody").pw_gid
2531
except OSError as error:
2532
if error.errno != errno.EPERM:
1313
except OSError, error:
1314
if error[0] != errno.EPERM:
1317
# Enable all possible GnuTLS debugging
2536
# Enable all possible GnuTLS debugging
2538
1319
# "Use a log level over 10 to enable all debugging options."
2539
1320
# - GnuTLS manual
2540
1321
gnutls.library.functions.gnutls_global_set_log_level(11)
2542
1323
@gnutls.library.types.gnutls_log_func
2543
1324
def debug_gnutls(level, string):
2544
logger.debug("GnuTLS: %s", string[:-1])
2546
gnutls.library.functions.gnutls_global_set_log_function(
2549
# Redirect stdin so all checkers get /dev/null
2550
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2551
os.dup2(null, sys.stdin.fileno())
2555
# Need to fork before connecting to D-Bus
2557
# Close all input and output, do double fork, etc.
2560
# multiprocessing will use threads, so before we use gobject we
2561
# need to inform gobject that threads will be used.
2562
gobject.threads_init()
1325
logger.debug(u"GnuTLS: %s", string[:-1])
1327
(gnutls.library.functions
1328
.gnutls_global_set_log_function(debug_gnutls))
2564
1330
global main_loop
2565
1331
# From the Avahi example code
2566
DBusGMainLoop(set_as_default=True)
1332
DBusGMainLoop(set_as_default=True )
2567
1333
main_loop = gobject.MainLoop()
2568
1334
bus = dbus.SystemBus()
2569
1335
# End of Avahi example code
2572
bus_name = dbus.service.BusName("se.recompile.Mandos",
2575
old_bus_name = dbus.service.BusName(
2576
"se.bsnet.fukt.Mandos", bus,
2578
except dbus.exceptions.NameExistsException as e:
2579
logger.error("Disabling D-Bus:", exc_info=e)
2581
server_settings["use_dbus"] = False
2582
tcp_server.use_dbus = False
2584
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2585
service = AvahiServiceToSyslog(
2586
name = server_settings["servicename"],
2587
servicetype = "_mandos._tcp",
2588
protocol = protocol,
2590
if server_settings["interface"]:
2591
service.interface = if_nametoindex(
2592
server_settings["interface"].encode("utf-8"))
2594
global multiprocessing_manager
2595
multiprocessing_manager = multiprocessing.Manager()
1337
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1338
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1339
service = AvahiService(name = server_settings[u"servicename"],
1340
servicetype = u"_mandos._tcp",
1341
protocol = protocol, bus = bus)
1342
if server_settings["interface"]:
1343
service.interface = (if_nametoindex
1344
(str(server_settings[u"interface"])))
2597
1346
client_class = Client
2599
1348
client_class = functools.partial(ClientDBus, bus = bus)
2601
client_settings = Client.config_parser(client_config)
2602
old_client_settings = {}
2605
# This is used to redirect stdout and stderr for checker processes
2607
wnull = open(os.devnull, "w") # A writable /dev/null
2608
# Only used if server is running in foreground but not in debug
2610
if debug or not foreground:
2613
# Get client data and settings from last running state.
2614
if server_settings["restore"]:
2616
with open(stored_state_path, "rb") as stored_state:
2617
clients_data, old_client_settings = pickle.load(
2619
os.remove(stored_state_path)
2620
except IOError as e:
2621
if e.errno == errno.ENOENT:
2622
logger.warning("Could not load persistent state:"
2623
" {}".format(os.strerror(e.errno)))
2625
logger.critical("Could not load persistent state:",
2628
except EOFError as e:
2629
logger.warning("Could not load persistent state: "
2633
with PGPEngine() as pgp:
2634
for client_name, client in clients_data.items():
2635
# Skip removed clients
2636
if client_name not in client_settings:
2639
# Decide which value to use after restoring saved state.
2640
# We have three different values: Old config file,
2641
# new config file, and saved state.
2642
# New config value takes precedence if it differs from old
2643
# config value, otherwise use saved state.
2644
for name, value in client_settings[client_name].items():
2646
# For each value in new config, check if it
2647
# differs from the old config value (Except for
2648
# the "secret" attribute)
2649
if (name != "secret"
2651
old_client_settings[client_name][name])):
2652
client[name] = value
2656
# Clients who has passed its expire date can still be
2657
# enabled if its last checker was successful. Clients
2658
# whose checker succeeded before we stored its state is
2659
# assumed to have successfully run all checkers during
2661
if client["enabled"]:
2662
if datetime.datetime.utcnow() >= client["expires"]:
2663
if not client["last_checked_ok"]:
2665
"disabling client {} - Client never "
2666
"performed a successful checker".format(
2668
client["enabled"] = False
2669
elif client["last_checker_status"] != 0:
2671
"disabling client {} - Client last"
2672
" checker failed with error code"
2675
client["last_checker_status"]))
2676
client["enabled"] = False
2678
client["expires"] = (
2679
datetime.datetime.utcnow()
2680
+ client["timeout"])
2681
logger.debug("Last checker succeeded,"
2682
" keeping {} enabled".format(
2685
client["secret"] = pgp.decrypt(
2686
client["encrypted_secret"],
2687
client_settings[client_name]["secret"])
2689
# If decryption fails, we use secret from new settings
2690
logger.debug("Failed to decrypt {} old secret".format(
2692
client["secret"] = (client_settings[client_name]
2695
# Add/remove clients based on new changes made to config
2696
for client_name in (set(old_client_settings)
2697
- set(client_settings)):
2698
del clients_data[client_name]
2699
for client_name in (set(client_settings)
2700
- set(old_client_settings)):
2701
clients_data[client_name] = client_settings[client_name]
2703
# Create all client objects
2704
for client_name, client in clients_data.items():
2705
tcp_server.clients[client_name] = client_class(
2708
server_settings = server_settings)
1349
tcp_server.clients.update(set(
1350
client_class(name = section,
1351
config= dict(client_config.items(section)))
1352
for section in client_config.sections()))
2710
1353
if not tcp_server.clients:
2711
logger.warning("No clients defined")
2714
if pidfile is not None:
2718
pidfile.write("{}\n".format(pid).encode("utf-8"))
2720
logger.error("Could not write to file %r with PID %d",
1354
logger.warning(u"No clients defined")
1357
# Redirect stdin so all checkers get /dev/null
1358
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1359
os.dup2(null, sys.stdin.fileno())
1363
# No console logging
1364
logger.removeHandler(console)
1365
# Close all input and output, do double fork, etc.
1369
with closing(pidfile):
1371
pidfile.write(str(pid) + "\n")
1374
logger.error(u"Could not write to file %r with PID %d",
1377
# "pidfile" was never created
1382
"Cleanup function; run on exit"
1385
while tcp_server.clients:
1386
client = tcp_server.clients.pop()
1387
client.disable_hook = None
1390
atexit.register(cleanup)
1393
signal.signal(signal.SIGINT, signal.SIG_IGN)
2725
1394
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2726
1395
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2730
@alternate_dbus_interfaces(
2731
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2732
class MandosDBusService(DBusObjectWithProperties):
1398
class MandosDBusService(dbus.service.Object):
2733
1399
"""A D-Bus proxy object"""
2735
1400
def __init__(self):
2736
dbus.service.Object.__init__(self, bus, "/")
2738
_interface = "se.recompile.Mandos"
2740
@dbus_interface_annotations(_interface)
2743
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2746
@dbus.service.signal(_interface, signature="o")
2747
def ClientAdded(self, objpath):
2751
@dbus.service.signal(_interface, signature="ss")
2752
def ClientNotFound(self, fingerprint, address):
2756
@dbus.service.signal(_interface, signature="os")
1401
dbus.service.Object.__init__(self, bus, u"/")
1402
_interface = u"se.bsnet.fukt.Mandos"
1404
@dbus.service.signal(_interface, signature=u"oa{sv}")
1405
def ClientAdded(self, objpath, properties):
1409
@dbus.service.signal(_interface, signature=u"s")
1410
def ClientNotFound(self, fingerprint):
1414
@dbus.service.signal(_interface, signature=u"os")
2757
1415
def ClientRemoved(self, objpath, name):
2761
@dbus.service.method(_interface, out_signature="ao")
1419
@dbus.service.method(_interface, out_signature=u"ao")
2762
1420
def GetAllClients(self):
2764
return dbus.Array(c.dbus_object_path for c in
2765
tcp_server.clients.itervalues())
1422
return dbus.Array(c.dbus_object_path
1423
for c in tcp_server.clients)
2767
1425
@dbus.service.method(_interface,
2768
out_signature="a{oa{sv}}")
1426
out_signature=u"a{oa{sv}}")
2769
1427
def GetAllClientsWithProperties(self):
2771
1429
return dbus.Dictionary(
2772
{ c.dbus_object_path: c.GetAll("")
2773
for c in tcp_server.clients.itervalues() },
1430
((c.dbus_object_path, c.GetAllProperties())
1431
for c in tcp_server.clients),
1432
signature=u"oa{sv}")
2776
@dbus.service.method(_interface, in_signature="o")
1434
@dbus.service.method(_interface, in_signature=u"o")
2777
1435
def RemoveClient(self, object_path):
2779
for c in tcp_server.clients.itervalues():
1437
for c in tcp_server.clients:
2780
1438
if c.dbus_object_path == object_path:
2781
del tcp_server.clients[c.name]
1439
tcp_server.clients.remove(c)
2782
1440
c.remove_from_connection()
2783
1441
# Don't signal anything except ClientRemoved
2784
c.disable(quiet=True)
1442
c.disable(signal=False)
2785
1443
# Emit D-Bus signal
2786
1444
self.ClientRemoved(object_path, c.name)
2788
raise KeyError(object_path)
2792
1450
mandos_dbus_service = MandosDBusService()
2795
"Cleanup function; run on exit"
2799
multiprocessing.active_children()
2801
if not (tcp_server.clients or client_settings):
2804
# Store client before exiting. Secrets are encrypted with key
2805
# based on what config file has. If config file is
2806
# removed/edited, old secret will thus be unrecovable.
2808
with PGPEngine() as pgp:
2809
for client in tcp_server.clients.itervalues():
2810
key = client_settings[client.name]["secret"]
2811
client.encrypted_secret = pgp.encrypt(client.secret,
2815
# A list of attributes that can not be pickled
2817
exclude = { "bus", "changedstate", "secret",
2818
"checker", "server_settings" }
2819
for name, typ in inspect.getmembers(dbus.service
2823
client_dict["encrypted_secret"] = (client
2825
for attr in client.client_structure:
2826
if attr not in exclude:
2827
client_dict[attr] = getattr(client, attr)
2829
clients[client.name] = client_dict
2830
del client_settings[client.name]["secret"]
2833
with tempfile.NamedTemporaryFile(
2837
dir=os.path.dirname(stored_state_path),
2838
delete=False) as stored_state:
2839
pickle.dump((clients, client_settings), stored_state)
2840
tempname = stored_state.name
2841
os.rename(tempname, stored_state_path)
2842
except (IOError, OSError) as e:
2848
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2849
logger.warning("Could not save persistent state: {}"
2850
.format(os.strerror(e.errno)))
2852
logger.warning("Could not save persistent state:",
2856
# Delete all clients, and settings from config
2857
while tcp_server.clients:
2858
name, client = tcp_server.clients.popitem()
2860
client.remove_from_connection()
2861
# Don't signal anything except ClientRemoved
2862
client.disable(quiet=True)
2865
mandos_dbus_service.ClientRemoved(
2866
client.dbus_object_path, client.name)
2867
client_settings.clear()
2869
atexit.register(cleanup)
2871
for client in tcp_server.clients.itervalues():
1452
for client in tcp_server.clients:
2873
1454
# Emit D-Bus signal
2874
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2875
# Need to initiate checking of clients
2877
client.init_checker()
1455
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1456
client.GetAllProperties())
2879
1459
tcp_server.enable()
2880
1460
tcp_server.server_activate()
2882
1462
# Find out what port we got
2884
service.port = tcp_server.socket.getsockname()[1]
1463
service.port = tcp_server.socket.getsockname()[1]
2886
logger.info("Now listening on address %r, port %d,"
2887
" flowinfo %d, scope_id %d",
2888
*tcp_server.socket.getsockname())
1465
logger.info(u"Now listening on address %r, port %d,"
1466
" flowinfo %d, scope_id %d"
1467
% tcp_server.socket.getsockname())
2890
logger.info("Now listening on address %r, port %d",
2891
*tcp_server.socket.getsockname())
1469
logger.info(u"Now listening on address %r, port %d"
1470
% tcp_server.socket.getsockname())
2893
1472
#service.interface = tcp_server.socket.getsockname()[3]
2897
# From the Avahi example code
2900
except dbus.exceptions.DBusException as error:
2901
logger.critical("D-Bus Exception", exc_info=error)
2904
# End of Avahi example code
1475
# From the Avahi example code
1478
except dbus.exceptions.DBusException, error:
1479
logger.critical(u"DBusException: %s", error)
1481
# End of Avahi example code
2906
1483
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2907
1484
lambda *args, **kwargs:
2908
1485
(tcp_server.handle_request
2909
1486
(*args[2:], **kwargs) or True))
2911
logger.debug("Starting main loop")
1488
logger.debug(u"Starting main loop")
2912
1489
main_loop.run()
2913
except AvahiError as error:
2914
logger.critical("Avahi Error", exc_info=error)
1490
except AvahiError, error:
1491
logger.critical(u"AvahiError: %s", error)
2917
1493
except KeyboardInterrupt:
2919
print("", file=sys.stderr)
2920
logger.debug("Server received KeyboardInterrupt")
2921
logger.debug("Server exiting")
2922
# Must run before the D-Bus bus name gets deregistered
1496
logger.debug(u"Server received KeyboardInterrupt")
1497
logger.debug(u"Server exiting")
2926
1499
if __name__ == '__main__':