352
189
dbus.UInt16(self.port),
353
190
avahi.string_array_to_txt_array(self.TXT))
354
191
self.group.Commit()
356
192
def entry_group_state_changed(self, state, error):
357
193
"""Derived from the Avahi example code"""
358
logger.debug("Avahi entry group state change: %i", state)
194
logger.debug(u"Avahi state change: %i", state)
360
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
361
logger.debug("Zeroconf service established.")
197
logger.debug(u"Zeroconf service established.")
362
198
elif state == avahi.ENTRY_GROUP_COLLISION:
363
logger.info("Zeroconf service name collision.")
199
logger.warning(u"Zeroconf service name collision.")
365
201
elif state == avahi.ENTRY_GROUP_FAILURE:
366
logger.critical("Avahi: Error in group state changed %s",
368
raise AvahiGroupError("State changed: {!s}".format(error))
202
logger.critical(u"Avahi: Error in group state changed %s",
204
raise AvahiGroupError(u"State changed: %s"
370
206
def cleanup(self):
371
207
"""Derived from the Avahi example code"""
372
208
if self.group is not None:
375
except (dbus.exceptions.UnknownMethodException,
376
dbus.exceptions.DBusException):
378
210
self.group = None
381
def server_state_changed(self, state, error=None):
211
def server_state_changed(self, state):
382
212
"""Derived from the Avahi example code"""
383
logger.debug("Avahi server state change: %i", state)
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
390
if state in bad_states:
391
if bad_states[state] is not None:
393
logger.error(bad_states[state])
395
logger.error(bad_states[state] + ": %r", error)
213
if state == avahi.SERVER_COLLISION:
214
logger.error(u"Zeroconf server name collision")
397
216
elif state == avahi.SERVER_RUNNING:
401
logger.debug("Unknown state: %r", state)
403
logger.debug("Unknown state: %r: %r", state, error)
405
218
def activate(self):
406
219
"""Derived from the Avahi example code"""
407
220
if self.server is None:
408
221
self.server = dbus.Interface(
409
222
self.bus.get_object(avahi.DBUS_NAME,
410
avahi.DBUS_PATH_SERVER,
411
follow_name_owner_changes=True),
223
avahi.DBUS_PATH_SERVER),
412
224
avahi.DBUS_INTERFACE_SERVER)
413
self.server.connect_to_signal("StateChanged",
414
self.server_state_changed)
225
self.server.connect_to_signal(u"StateChanged",
226
self.server_state_changed)
415
227
self.server_state_changed(self.server.GetState())
418
class AvahiServiceToSyslog(AvahiService):
419
def rename(self, *args, **kwargs):
420
"""Add the new name to the syslog messages"""
421
ret = AvahiService.rename(self, *args, **kwargs)
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
428
230
class Client(object):
429
231
"""A representation of a client host served by this server.
432
approved: bool(); 'None' if not yet approved/disapproved
433
approval_delay: datetime.timedelta(); Time to wait for approval
434
approval_duration: datetime.timedelta(); Duration of one approval
234
name: string; from the config file, used in log messages and
236
fingerprint: string (40 or 32 hexadecimal digits); used to
237
uniquely identify the client
238
secret: bytestring; sent verbatim (over TLS) to client
239
host: string; available for use by the checker command
240
created: datetime.datetime(); (UTC) object creation
241
last_enabled: datetime.datetime(); (UTC)
243
last_checked_ok: datetime.datetime(); (UTC) or None
244
timeout: datetime.timedelta(); How long from last_checked_ok
245
until this client is invalid
246
interval: datetime.timedelta(); How often to start a new checker
247
disable_hook: If set, called by disable() as disable_hook(self)
435
248
checker: subprocess.Popen(); a running checker process used
436
249
to see if the client lives.
437
250
'None' if no process is running.
438
checker_callback_tag: a gobject event source tag, or None
439
checker_command: string; External command which is run to check
440
if client lives. %() expansions are done at
251
checker_initiator_tag: a gobject event source tag, or None
252
disable_initiator_tag: - '' -
253
checker_callback_tag: - '' -
254
checker_command: string; External command which is run to check if
255
client lives. %() expansions are done at
441
256
runtime with vars(self) as dict, so that for
442
257
instance %(name)s can be used in the command.
443
checker_initiator_tag: a gobject event source tag, or None
444
created: datetime.datetime(); (UTC) object creation
445
client_structure: Object describing what attributes a client has
446
and is used for storing the client at exit
447
258
current_checker_command: string; current running checker_command
448
disable_initiator_tag: a gobject event source tag, or None
450
fingerprint: string (40 or 32 hexadecimal digits); used to
451
uniquely identify the client
452
host: string; available for use by the checker command
453
interval: datetime.timedelta(); How often to start a new checker
454
last_approval_request: datetime.datetime(); (UTC) or None
455
last_checked_ok: datetime.datetime(); (UTC) or None
456
last_checker_status: integer between 0 and 255 reflecting exit
457
status of last checker. -1 reflects crashed
458
checker, -2 means no checker completed yet.
459
last_enabled: datetime.datetime(); (UTC) or None
460
name: string; from the config file, used in log messages and
462
secret: bytestring; sent verbatim (over TLS) to client
463
timeout: datetime.timedelta(); How long from last_checked_ok
464
until this client is disabled
465
extended_timeout: extra long timeout when secret has been sent
466
runtime_expansions: Allowed attributes for runtime expansion.
467
expires: datetime.datetime(); time (UTC) when a client will be
469
server_settings: The server_settings dict from main()
472
runtime_expansions = ("approval_delay", "approval_duration",
473
"created", "enabled", "expires",
474
"fingerprint", "host", "interval",
475
"last_approval_request", "last_checked_ok",
476
"last_enabled", "name", "timeout")
479
"extended_timeout": "PT15M",
481
"checker": "fping -q -- %%(host)s",
483
"approval_delay": "PT0S",
484
"approval_duration": "PT1S",
485
"approved_by_default": "True",
490
def config_parser(config):
491
"""Construct a new dict of client settings of this form:
492
{ client_name: {setting_name: value, ...}, ...}
493
with exceptions for any special settings as defined above.
494
NOTE: Must be a pure function. Must return the same result
495
value given the same arguments.
498
for client_name in config.sections():
499
section = dict(config.items(client_name))
500
client = settings[client_name] = {}
502
client["host"] = section["host"]
503
# Reformat values from string types to Python types
504
client["approved_by_default"] = config.getboolean(
505
client_name, "approved_by_default")
506
client["enabled"] = config.getboolean(client_name,
509
# Uppercase and remove spaces from fingerprint for later
510
# comparison purposes with return value from the
511
# fingerprint() function
512
client["fingerprint"] = (section["fingerprint"].upper()
514
if "secret" in section:
515
client["secret"] = section["secret"].decode("base64")
516
elif "secfile" in section:
517
with open(os.path.expanduser(os.path.expandvars
518
(section["secfile"])),
520
client["secret"] = secfile.read()
522
raise TypeError("No secret or secfile for section {}"
524
client["timeout"] = string_to_delta(section["timeout"])
525
client["extended_timeout"] = string_to_delta(
526
section["extended_timeout"])
527
client["interval"] = string_to_delta(section["interval"])
528
client["approval_delay"] = string_to_delta(
529
section["approval_delay"])
530
client["approval_duration"] = string_to_delta(
531
section["approval_duration"])
532
client["checker_command"] = section["checker"]
533
client["last_approval_request"] = None
534
client["last_checked_ok"] = None
535
client["last_checker_status"] = -2
539
def __init__(self, settings, name = None, server_settings=None):
262
def _timedelta_to_milliseconds(td):
263
"Convert a datetime.timedelta() to milliseconds"
264
return ((td.days * 24 * 60 * 60 * 1000)
265
+ (td.seconds * 1000)
266
+ (td.microseconds // 1000))
268
def timeout_milliseconds(self):
269
"Return the 'timeout' attribute in milliseconds"
270
return self._timedelta_to_milliseconds(self.timeout)
272
def interval_milliseconds(self):
273
"Return the 'interval' attribute in milliseconds"
274
return self._timedelta_to_milliseconds(self.interval)
276
def __init__(self, name = None, disable_hook=None, config=None):
277
"""Note: the 'checker' key in 'config' sets the
278
'checker_command' attribute and *not* the 'checker'
541
if server_settings is None:
543
self.server_settings = server_settings
544
# adding all client settings
545
for setting, value in settings.items():
546
setattr(self, setting, value)
549
if not hasattr(self, "last_enabled"):
550
self.last_enabled = datetime.datetime.utcnow()
551
if not hasattr(self, "expires"):
552
self.expires = (datetime.datetime.utcnow()
283
logger.debug(u"Creating client %r", self.name)
284
# Uppercase and remove spaces from fingerprint for later
285
# comparison purposes with return value from the fingerprint()
287
self.fingerprint = (config[u"fingerprint"].upper()
289
logger.debug(u" Fingerprint: %s", self.fingerprint)
290
if u"secret" in config:
291
self.secret = config[u"secret"].decode(u"base64")
292
elif u"secfile" in config:
293
with closing(open(os.path.expanduser
295
(config[u"secfile"])),
297
self.secret = secfile.read()
555
self.last_enabled = None
558
logger.debug("Creating client %r", self.name)
559
logger.debug(" Fingerprint: %s", self.fingerprint)
560
self.created = settings.get("created",
561
datetime.datetime.utcnow())
563
# attributes specific for this server instance
299
raise TypeError(u"No secret or secfile for client %s"
301
self.host = config.get(u"host", u"")
302
self.created = datetime.datetime.utcnow()
304
self.last_enabled = None
305
self.last_checked_ok = None
306
self.timeout = string_to_delta(config[u"timeout"])
307
self.interval = string_to_delta(config[u"interval"])
308
self.disable_hook = disable_hook
564
309
self.checker = None
565
310
self.checker_initiator_tag = None
566
311
self.disable_initiator_tag = None
567
312
self.checker_callback_tag = None
313
self.checker_command = config[u"checker"]
568
314
self.current_checker_command = None
570
self.approvals_pending = 0
571
self.changedstate = multiprocessing_manager.Condition(
572
multiprocessing_manager.Lock())
573
self.client_structure = [attr
574
for attr in self.__dict__.iterkeys()
575
if not attr.startswith("_")]
576
self.client_structure.append("client_structure")
578
for name, t in inspect.getmembers(
579
type(self), lambda obj: isinstance(obj, property)):
580
if not name.startswith("_"):
581
self.client_structure.append(name)
583
# Send notice to process children that client state has changed
584
def send_changedstate(self):
585
with self.changedstate:
586
self.changedstate.notify_all()
315
self.last_connect = None
588
317
def enable(self):
589
318
"""Start this client's checker and timeout hooks"""
590
if getattr(self, "enabled", False):
319
if getattr(self, u"enabled", False):
591
320
# Already enabled
593
self.expires = datetime.datetime.utcnow() + self.timeout
595
322
self.last_enabled = datetime.datetime.utcnow()
597
self.send_changedstate()
323
# Schedule a new checker to be started an 'interval' from now,
324
# and every interval from then on.
325
self.checker_initiator_tag = (gobject.timeout_add
326
(self.interval_milliseconds(),
328
# Also start a new checker *right now*.
330
# Schedule a disable() when 'timeout' has passed
331
self.disable_initiator_tag = (gobject.timeout_add
332
(self.timeout_milliseconds(),
599
def disable(self, quiet=True):
600
337
"""Disable this client."""
601
338
if not getattr(self, "enabled", False):
604
logger.info("Disabling client %s", self.name)
605
if getattr(self, "disable_initiator_tag", None) is not None:
340
logger.info(u"Disabling client %s", self.name)
341
if getattr(self, u"disable_initiator_tag", False):
606
342
gobject.source_remove(self.disable_initiator_tag)
607
343
self.disable_initiator_tag = None
609
if getattr(self, "checker_initiator_tag", None) is not None:
344
if getattr(self, u"checker_initiator_tag", False):
610
345
gobject.source_remove(self.checker_initiator_tag)
611
346
self.checker_initiator_tag = None
612
347
self.stop_checker()
348
if self.disable_hook:
349
self.disable_hook(self)
613
350
self.enabled = False
615
self.send_changedstate()
616
351
# Do not run this again if called by a gobject.timeout_add
619
354
def __del__(self):
355
self.disable_hook = None
622
def init_checker(self):
623
# Schedule a new checker to be started an 'interval' from now,
624
# and every interval from then on.
625
if self.checker_initiator_tag is not None:
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
630
# Schedule a disable() when 'timeout' has passed
631
if self.disable_initiator_tag is not None:
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
634
int(self.timeout.total_seconds() * 1000), self.disable)
635
# Also start a new checker *right now*.
638
358
def checker_callback(self, pid, condition, command):
639
359
"""The checker has completed, so take appropriate actions."""
640
360
self.checker_callback_tag = None
641
361
self.checker = None
642
362
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
644
if self.last_checker_status == 0:
645
logger.info("Checker for %(name)s succeeded",
363
exitstatus = os.WEXITSTATUS(condition)
365
logger.info(u"Checker for %(name)s succeeded",
647
367
self.checked_ok()
649
logger.info("Checker for %(name)s failed", vars(self))
369
logger.info(u"Checker for %(name)s failed",
651
self.last_checker_status = -1
652
logger.warning("Checker for %(name)s crashed?",
372
logger.warning(u"Checker for %(name)s crashed?",
655
375
def checked_ok(self):
656
"""Assert that the client has been seen, alive and well."""
376
"""Bump up the timeout for this client.
378
This should only be called when the client has been seen,
657
381
self.last_checked_ok = datetime.datetime.utcnow()
658
self.last_checker_status = 0
661
def bump_timeout(self, timeout=None):
662
"""Bump up the timeout for this client."""
664
timeout = self.timeout
665
if self.disable_initiator_tag is not None:
666
gobject.source_remove(self.disable_initiator_tag)
667
self.disable_initiator_tag = None
668
if getattr(self, "enabled", False):
669
self.disable_initiator_tag = gobject.timeout_add(
670
int(timeout.total_seconds() * 1000), self.disable)
671
self.expires = datetime.datetime.utcnow() + timeout
673
def need_approval(self):
674
self.last_approval_request = datetime.datetime.utcnow()
382
gobject.source_remove(self.disable_initiator_tag)
383
self.disable_initiator_tag = (gobject.timeout_add
384
(self.timeout_milliseconds(),
676
387
def start_checker(self):
677
388
"""Start a new checker subprocess if one is not running.
873
533
class DBusObjectWithProperties(dbus.service.Object):
874
534
"""A D-Bus object with properties.
876
536
Classes inheriting from this can use the dbus_service_property
877
537
decorator to expose methods as D-Bus properties. It exposes the
878
538
standard Get(), Set(), and GetAll() methods on the D-Bus.
882
def _is_dbus_thing(thing):
883
"""Returns a function testing if an attribute is a D-Bus thing
885
If called like _is_dbus_thing("method") it returns a function
886
suitable for use as predicate to inspect.getmembers().
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
542
def _is_dbus_property(obj):
543
return getattr(obj, u"_dbus_is_property", False)
891
def _get_all_dbus_things(self, thing):
545
def _get_all_dbus_properties(self):
892
546
"""Returns a generator of (name, attribute) pairs
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
895
athing.__get__(self))
896
for cls in self.__class__.__mro__
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
548
return ((prop._dbus_name, prop)
550
inspect.getmembers(self, self._is_dbus_property))
900
552
def _get_dbus_property(self, interface_name, property_name):
901
553
"""Returns a bound method if one exists which is a D-Bus
902
554
property with the specified name and interface.
904
for cls in self.__class__.__mro__:
905
for name, value in inspect.getmembers(
906
cls, self._is_dbus_thing("property")):
907
if (value._dbus_name == property_name
908
and value._dbus_interface == interface_name):
909
return value.__get__(self)
556
for name in (property_name,
557
property_name + u"_dbus_property"):
558
prop = getattr(self, name, None)
560
or not self._is_dbus_property(prop)
561
or prop._dbus_name != property_name
562
or (interface_name and prop._dbus_interface
563
and interface_name != prop._dbus_interface)):
911
566
# No such property
912
raise DBusPropertyNotFound("{}:{}.{}".format(
913
self.dbus_object_path, interface_name, property_name))
567
raise DBusPropertyNotFound(self.dbus_object_path + u":"
568
+ interface_name + u"."
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
571
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
918
573
def Get(self, interface_name, property_name):
919
574
"""Standard D-Bus property Get() method, see D-Bus standard.
921
576
prop = self._get_dbus_property(interface_name, property_name)
922
if prop._dbus_access == "write":
577
if prop._dbus_access == u"write":
923
578
raise DBusPropertyAccessException(property_name)
925
if not hasattr(value, "variant_level"):
580
if not hasattr(value, u"variant_level"):
927
582
return type(value)(value, variant_level=value.variant_level+1)
929
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
584
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
930
585
def Set(self, interface_name, property_name, value):
931
586
"""Standard D-Bus property Set() method, see D-Bus standard.
933
588
prop = self._get_dbus_property(interface_name, property_name)
934
if prop._dbus_access == "read":
589
if prop._dbus_access == u"read":
935
590
raise DBusPropertyAccessException(property_name)
936
if prop._dbus_get_args_options["byte_arrays"]:
937
# The byte_arrays option is not supported yet on
938
# signatures other than "ay".
939
if prop._dbus_signature != "ay":
940
raise ValueError("Byte arrays not supported for non-"
941
"'ay' signature {!r}"
942
.format(prop._dbus_signature))
943
value = dbus.ByteArray(b''.join(chr(byte)
591
if prop._dbus_get_args_options[u"byte_arrays"]:
592
value = dbus.ByteArray(''.join(unichr(byte)
947
@dbus.service.method(dbus.PROPERTIES_IFACE,
949
out_signature="a{sv}")
596
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
597
out_signature=u"a{sv}")
950
598
def GetAll(self, interface_name):
951
599
"""Standard D-Bus property GetAll() method, see D-Bus
954
602
Note: Will not include properties with access="write".
957
for name, prop in self._get_all_dbus_things("property"):
605
for name, prop in self._get_all_dbus_properties():
958
606
if (interface_name
959
607
and interface_name != prop._dbus_interface):
960
608
# Interface non-empty but did not match
962
610
# Ignore write-only properties
963
if prop._dbus_access == "write":
611
if prop._dbus_access == u"write":
966
if not hasattr(value, "variant_level"):
967
properties[name] = value
614
if not hasattr(value, u"variant_level"):
969
properties[name] = type(value)(
970
value, variant_level = value.variant_level + 1)
971
return dbus.Dictionary(properties, signature="sv")
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
974
def PropertiesChanged(self, interface_name, changed_properties,
975
invalidated_properties):
976
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
617
all[name] = type(value)(value, variant_level=
618
value.variant_level+1)
619
return dbus.Dictionary(all, signature=u"sv")
981
621
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
983
623
path_keyword='object_path',
984
624
connection_keyword='connection')
985
625
def Introspect(self, object_path, connection):
986
"""Overloading of standard D-Bus method.
988
Inserts property tags and interface annotation tags.
626
"""Standard D-Bus method, overloaded to insert property tags.
990
628
xmlstring = dbus.service.Object.Introspect(self, object_path,
993
631
document = xml.dom.minidom.parseString(xmlstring)
995
632
def make_tag(document, name, prop):
996
e = document.createElement("property")
997
e.setAttribute("name", name)
998
e.setAttribute("type", prop._dbus_signature)
999
e.setAttribute("access", prop._dbus_access)
633
e = document.createElement(u"property")
634
e.setAttribute(u"name", name)
635
e.setAttribute(u"type", prop._dbus_signature)
636
e.setAttribute(u"access", prop._dbus_access)
1002
for if_tag in document.getElementsByTagName("interface"):
638
for if_tag in document.getElementsByTagName(u"interface"):
1004
639
for tag in (make_tag(document, name, prop)
1006
in self._get_all_dbus_things("property")
641
in self._get_all_dbus_properties()
1007
642
if prop._dbus_interface
1008
== if_tag.getAttribute("name")):
643
== if_tag.getAttribute(u"name")):
1009
644
if_tag.appendChild(tag)
1010
# Add annotation tags
1011
for typ in ("method", "signal", "property"):
1012
for tag in if_tag.getElementsByTagName(typ):
1014
for name, prop in (self.
1015
_get_all_dbus_things(typ)):
1016
if (name == tag.getAttribute("name")
1017
and prop._dbus_interface
1018
== if_tag.getAttribute("name")):
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
1022
ann_tag = document.createElement(
1024
ann_tag.setAttribute("name", name)
1025
ann_tag.setAttribute("value", value)
1026
tag.appendChild(ann_tag)
1027
# Add interface annotation tags
1028
for annotation, value in dict(
1029
itertools.chain.from_iterable(
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1033
if name == if_tag.getAttribute("name")
1035
ann_tag = document.createElement("annotation")
1036
ann_tag.setAttribute("name", annotation)
1037
ann_tag.setAttribute("value", value)
1038
if_tag.appendChild(ann_tag)
1039
645
# Add the names to the return values for the
1040
646
# "org.freedesktop.DBus.Properties" methods
1041
if (if_tag.getAttribute("name")
1042
== "org.freedesktop.DBus.Properties"):
1043
for cn in if_tag.getElementsByTagName("method"):
1044
if cn.getAttribute("name") == "Get":
1045
for arg in cn.getElementsByTagName("arg"):
1046
if (arg.getAttribute("direction")
1048
arg.setAttribute("name", "value")
1049
elif cn.getAttribute("name") == "GetAll":
1050
for arg in cn.getElementsByTagName("arg"):
1051
if (arg.getAttribute("direction")
1053
arg.setAttribute("name", "props")
1054
xmlstring = document.toxml("utf-8")
647
if (if_tag.getAttribute(u"name")
648
== u"org.freedesktop.DBus.Properties"):
649
for cn in if_tag.getElementsByTagName(u"method"):
650
if cn.getAttribute(u"name") == u"Get":
651
for arg in cn.getElementsByTagName(u"arg"):
652
if (arg.getAttribute(u"direction")
654
arg.setAttribute(u"name", u"value")
655
elif cn.getAttribute(u"name") == u"GetAll":
656
for arg in cn.getElementsByTagName(u"arg"):
657
if (arg.getAttribute(u"direction")
659
arg.setAttribute(u"name", u"props")
660
xmlstring = document.toxml(u"utf-8")
1055
661
document.unlink()
1056
662
except (AttributeError, xml.dom.DOMException,
1057
xml.parsers.expat.ExpatError) as error:
1058
logger.error("Failed to override Introspection method",
663
xml.parsers.expat.ExpatError), error:
664
logger.error(u"Failed to override Introspection method",
1060
666
return xmlstring
1063
def datetime_to_dbus(dt, variant_level=0):
1064
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1066
return dbus.String("", variant_level = variant_level)
1067
return dbus.String(dt.isoformat(), variant_level=variant_level)
1070
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1071
"""A class decorator; applied to a subclass of
1072
dbus.service.Object, it will add alternate D-Bus attributes with
1073
interface names according to the "alt_interface_names" mapping.
1076
@alternate_dbus_interfaces({"org.example.Interface":
1077
"net.example.AlternateInterface"})
1078
class SampleDBusObject(dbus.service.Object):
1079
@dbus.service.method("org.example.Interface")
1080
def SampleDBusMethod():
1083
The above "SampleDBusMethod" on "SampleDBusObject" will be
1084
reachable via two interfaces: "org.example.Interface" and
1085
"net.example.AlternateInterface", the latter of which will have
1086
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1087
"true", unless "deprecate" is passed with a False value.
1089
This works for methods and signals, and also for D-Bus properties
1090
(from DBusObjectWithProperties) and interfaces (from the
1091
dbus_interface_annotations decorator).
1095
for orig_interface_name, alt_interface_name in (
1096
alt_interface_names.items()):
1098
interface_names = set()
1099
# Go though all attributes of the class
1100
for attrname, attribute in inspect.getmembers(cls):
1101
# Ignore non-D-Bus attributes, and D-Bus attributes
1102
# with the wrong interface name
1103
if (not hasattr(attribute, "_dbus_interface")
1104
or not attribute._dbus_interface.startswith(
1105
orig_interface_name)):
1107
# Create an alternate D-Bus interface name based on
1109
alt_interface = attribute._dbus_interface.replace(
1110
orig_interface_name, alt_interface_name)
1111
interface_names.add(alt_interface)
1112
# Is this a D-Bus signal?
1113
if getattr(attribute, "_dbus_is_signal", False):
1114
# Extract the original non-method undecorated
1115
# function by black magic
1116
nonmethod_func = (dict(
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1120
# Create a new, but exactly alike, function
1121
# object, and decorate it to be a new D-Bus signal
1122
# with the alternate D-Bus interface name
1123
new_function = (dbus.service.signal(
1124
alt_interface, attribute._dbus_signature)
1125
(types.FunctionType(
1126
nonmethod_func.func_code,
1127
nonmethod_func.func_globals,
1128
nonmethod_func.func_name,
1129
nonmethod_func.func_defaults,
1130
nonmethod_func.func_closure)))
1131
# Copy annotations, if any
1133
new_function._dbus_annotations = dict(
1134
attribute._dbus_annotations)
1135
except AttributeError:
1137
# Define a creator of a function to call both the
1138
# original and alternate functions, so both the
1139
# original and alternate signals gets sent when
1140
# the function is called
1141
def fixscope(func1, func2):
1142
"""This function is a scope container to pass
1143
func1 and func2 to the "call_both" function
1144
outside of its arguments"""
1146
def call_both(*args, **kwargs):
1147
"""This function will emit two D-Bus
1148
signals by calling func1 and func2"""
1149
func1(*args, **kwargs)
1150
func2(*args, **kwargs)
1153
# Create the "call_both" function and add it to
1155
attr[attrname] = fixscope(attribute, new_function)
1156
# Is this a D-Bus method?
1157
elif getattr(attribute, "_dbus_is_method", False):
1158
# Create a new, but exactly alike, function
1159
# object. Decorate it to be a new D-Bus method
1160
# with the alternate D-Bus interface name. Add it
1163
dbus.service.method(
1165
attribute._dbus_in_signature,
1166
attribute._dbus_out_signature)
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1172
# Copy annotations, if any
1174
attr[attrname]._dbus_annotations = dict(
1175
attribute._dbus_annotations)
1176
except AttributeError:
1178
# Is this a D-Bus property?
1179
elif getattr(attribute, "_dbus_is_property", False):
1180
# Create a new, but exactly alike, function
1181
# object, and decorate it to be a new D-Bus
1182
# property with the alternate D-Bus interface
1183
# name. Add it to the class.
1184
attr[attrname] = (dbus_service_property(
1185
alt_interface, attribute._dbus_signature,
1186
attribute._dbus_access,
1187
attribute._dbus_get_args_options
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1195
# Copy annotations, if any
1197
attr[attrname]._dbus_annotations = dict(
1198
attribute._dbus_annotations)
1199
except AttributeError:
1201
# Is this a D-Bus interface?
1202
elif getattr(attribute, "_dbus_is_interface", False):
1203
# Create a new, but exactly alike, function
1204
# object. Decorate it to be a new D-Bus interface
1205
# with the alternate D-Bus interface name. Add it
1208
dbus_interface_annotations(alt_interface)
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1215
# Deprecate all alternate interfaces
1216
iname="_AlternateDBusNames_interface_annotation{}"
1217
for interface_name in interface_names:
1219
@dbus_interface_annotations(interface_name)
1221
return { "org.freedesktop.DBus.Deprecated":
1223
# Find an unused name
1224
for aname in (iname.format(i)
1225
for i in itertools.count()):
1226
if aname not in attr:
1230
# Replace the class with a new subclass of it with
1231
# methods, signals, etc. as created above.
1232
cls = type(b"{}Alternate".format(cls.__name__),
1239
@alternate_dbus_interfaces({"se.recompile.Mandos":
1240
"se.bsnet.fukt.Mandos"})
1241
669
class ClientDBus(Client, DBusObjectWithProperties):
1242
670
"""A Client class using D-Bus
1702
987
Note: This will run in its own forked process."""
1704
989
def handle(self):
1705
with contextlib.closing(self.server.child_pipe) as child_pipe:
1706
logger.info("TCP connection from: %s",
1707
str(self.client_address))
1708
logger.debug("Pipe FD: %d",
1709
self.server.child_pipe.fileno())
990
logger.info(u"TCP connection from: %s",
991
unicode(self.client_address))
992
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
993
# Open IPC pipe to parent process
994
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
995
session = (gnutls.connection
996
.ClientSession(self.request,
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1000
line = self.request.makefile().readline()
1001
logger.debug(u"Protocol version: %r", line)
1003
if int(line.strip().split()[0]) > 1:
1005
except (ValueError, IndexError, RuntimeError), error:
1006
logger.error(u"Unknown protocol version: %s", error)
1714
1009
# Note: gnutls.connection.X509Credentials is really a
1715
1010
# generic GnuTLS certificate credentials object so long as
1716
1011
# no X.509 keys are added to it. Therefore, we can use it
1717
1012
# here despite using OpenPGP certificates.
1719
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1720
# "+AES-256-CBC", "+SHA1",
1721
# "+COMP-NULL", "+CTYPE-OPENPGP",
1014
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1015
# u"+AES-256-CBC", u"+SHA1",
1016
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1723
1018
# Use a fallback default, since this MUST be set.
1724
1019
priority = self.server.gnutls_priority
1725
1020
if priority is None:
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
1730
# Start communication using the Mandos protocol
1731
# Get protocol number
1732
line = self.request.makefile().readline()
1733
logger.debug("Protocol version: %r", line)
1735
if int(line.strip().split()[0]) > 1:
1736
raise RuntimeError(line)
1737
except (ValueError, IndexError, RuntimeError) as error:
1738
logger.error("Unknown protocol version: %s", error)
1741
# Start GnuTLS connection
1021
priority = u"NORMAL"
1022
(gnutls.library.functions
1023
.gnutls_priority_set_direct(session._c_object,
1743
1027
session.handshake()
1744
except gnutls.errors.GNUTLSError as error:
1745
logger.warning("Handshake failed: %s", error)
1028
except gnutls.errors.GNUTLSError, error:
1029
logger.warning(u"Handshake failed: %s", error)
1746
1030
# Do not run session.bye() here: the session is not
1747
1031
# established. Just abandon the request.
1749
logger.debug("Handshake succeeded")
1751
approval_required = False
1033
logger.debug(u"Handshake succeeded")
1754
fpr = self.fingerprint(
1755
self.peer_certificate(session))
1757
gnutls.errors.GNUTLSError) as error:
1758
logger.warning("Bad certificate: %s", error)
1760
logger.debug("Fingerprint: %s", fpr)
1763
client = ProxyClient(child_pipe, fpr,
1764
self.client_address)
1768
if client.approval_delay:
1769
delay = client.approval_delay
1770
client.approvals_pending += 1
1771
approval_required = True
1774
if not client.enabled:
1775
logger.info("Client %s is disabled",
1777
if self.server.use_dbus:
1779
client.Rejected("Disabled")
1782
if client.approved or not client.approval_delay:
1783
#We are approved or approval is disabled
1785
elif client.approved is None:
1786
logger.info("Client %s needs approval",
1788
if self.server.use_dbus:
1790
client.NeedApproval(
1791
client.approval_delay.total_seconds()
1792
* 1000, client.approved_by_default)
1794
logger.warning("Client %s was not approved",
1796
if self.server.use_dbus:
1798
client.Rejected("Denied")
1801
#wait until timeout or approved
1802
time = datetime.datetime.now()
1803
client.changedstate.acquire()
1804
client.changedstate.wait(delay.total_seconds())
1805
client.changedstate.release()
1806
time2 = datetime.datetime.now()
1807
if (time2 - time) >= delay:
1808
if not client.approved_by_default:
1809
logger.warning("Client %s timed out while"
1810
" waiting for approval",
1812
if self.server.use_dbus:
1814
client.Rejected("Approval timed out")
1819
delay -= time2 - time
1822
while sent_size < len(client.secret):
1824
sent = session.send(client.secret[sent_size:])
1825
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1834
logger.info("Sending secret to %s", client.name)
1835
# bump the timeout using extended_timeout
1836
client.bump_timeout(client.extended_timeout)
1837
if self.server.use_dbus:
1035
fpr = self.fingerprint(self.peer_certificate(session))
1036
except (TypeError, gnutls.errors.GNUTLSError), error:
1037
logger.warning(u"Bad certificate: %s", error)
1040
logger.debug(u"Fingerprint: %s", fpr)
1842
if approval_required:
1843
client.approvals_pending -= 1
1846
except gnutls.errors.GNUTLSError as error:
1847
logger.warning("GnuTLS bye failed",
1042
for c in self.server.clients:
1043
if c.fingerprint == fpr:
1047
ipc.write(u"NOTFOUND %s %s\n"
1048
% (fpr, unicode(self.client_address)))
1051
# Have to check if client.still_valid(), since it is
1052
# possible that the client timed out while establishing
1053
# the GnuTLS session.
1054
if not client.still_valid():
1055
ipc.write(u"INVALID %s\n" % client.name)
1058
ipc.write(u"SENDING %s\n" % client.name)
1060
while sent_size < len(client.secret):
1061
sent = session.send(client.secret[sent_size:])
1062
logger.debug(u"Sent: %d, remaining: %d",
1063
sent, len(client.secret)
1064
- (sent_size + sent))
1851
1069
def peer_certificate(session):
1852
1070
"Return the peer's OpenPGP certificate as a bytestring"
1853
1071
# If not an OpenPGP certificate...
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1072
if (gnutls.library.functions
1073
.gnutls_certificate_type_get(session._c_object)
1856
1074
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
1075
# ...do the normal thing
1858
1076
return session.peer_certificate
2052
1220
Assumes a gobject.MainLoop event loop.
2055
1222
def __init__(self, server_address, RequestHandlerClass,
2059
gnutls_priority=None,
1223
interface=None, use_ipv6=True, clients=None,
1224
gnutls_priority=None, use_dbus=True):
2062
1225
self.enabled = False
2063
1226
self.clients = clients
2064
1227
if self.clients is None:
1228
self.clients = set()
2066
1229
self.use_dbus = use_dbus
2067
1230
self.gnutls_priority = gnutls_priority
2068
1231
IPv6_TCPServer.__init__(self, server_address,
2069
1232
RequestHandlerClass,
2070
1233
interface = interface,
2071
use_ipv6 = use_ipv6,
2072
socketfd = socketfd)
1234
use_ipv6 = use_ipv6)
2074
1235
def server_activate(self):
2075
1236
if self.enabled:
2076
1237
return socketserver.TCPServer.server_activate(self)
2078
1238
def enable(self):
2079
1239
self.enabled = True
2081
def add_pipe(self, parent_pipe, proc):
1240
def add_pipe(self, pipe):
2082
1241
# Call "handle_ipc" for both data and EOF events
2083
gobject.io_add_watch(
2084
parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2086
functools.partial(self.handle_ipc,
2087
parent_pipe = parent_pipe,
2090
def handle_ipc(self, source, condition,
2093
client_object=None):
2094
# error, or the other end of multiprocessing.Pipe has closed
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2096
# Wait for other process to exit
2100
# Read a request from the child
2101
request = parent_pipe.recv()
2102
command = request[0]
2104
if command == 'init':
2106
address = request[2]
2108
for c in self.clients.itervalues():
2109
if c.fingerprint == fpr:
2113
logger.info("Client not found for fingerprint: %s, ad"
2114
"dress: %s", fpr, address)
2117
mandos_dbus_service.ClientNotFound(fpr,
2119
parent_pipe.send(False)
2122
gobject.io_add_watch(
2123
parent_pipe.fileno(),
2124
gobject.IO_IN | gobject.IO_HUP,
2125
functools.partial(self.handle_ipc,
2126
parent_pipe = parent_pipe,
2128
client_object = client))
2129
parent_pipe.send(True)
2130
# remove the old hook in favor of the new above hook on
2133
if command == 'funcall':
2134
funcname = request[1]
2138
parent_pipe.send(('data', getattr(client_object,
2142
if command == 'getattr':
2143
attrname = request[1]
2144
if callable(client_object.__getattribute__(attrname)):
2145
parent_pipe.send(('function', ))
2148
'data', client_object.__getattribute__(attrname)))
2150
if command == 'setattr':
2151
attrname = request[1]
2153
setattr(client_object, attrname, value)
1242
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1244
def handle_ipc(self, source, condition, file_objects={}):
1246
gobject.IO_IN: u"IN", # There is data to read.
1247
gobject.IO_OUT: u"OUT", # Data can be written (without
1249
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1250
gobject.IO_ERR: u"ERR", # Error condition.
1251
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1252
# broken, usually for pipes and
1255
conditions_string = ' | '.join(name
1257
condition_names.iteritems()
1258
if cond & condition)
1259
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1262
# Turn the pipe file descriptor into a Python file object
1263
if source not in file_objects:
1264
file_objects[source] = os.fdopen(source, u"r", 1)
1266
# Read a line from the file object
1267
cmdline = file_objects[source].readline()
1268
if not cmdline: # Empty line means end of file
1269
# close the IPC pipe
1270
file_objects[source].close()
1271
del file_objects[source]
1273
# Stop calling this function
1276
logger.debug(u"IPC command: %r", cmdline)
1278
# Parse and act on command
1279
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1281
if cmd == u"NOTFOUND":
1282
logger.warning(u"Client not found for fingerprint: %s",
1286
mandos_dbus_service.ClientNotFound(args)
1287
elif cmd == u"INVALID":
1288
for client in self.clients:
1289
if client.name == args:
1290
logger.warning(u"Client %s is invalid", args)
1296
logger.error(u"Unknown client %s is invalid", args)
1297
elif cmd == u"SENDING":
1298
for client in self.clients:
1299
if client.name == args:
1300
logger.info(u"Sending secret to %s", client.name)
1307
logger.error(u"Sending secret to unknown client %s",
1310
logger.error(u"Unknown IPC command: %r", cmdline)
1312
# Keep calling this function
2158
def rfc3339_duration_to_delta(duration):
2159
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2161
>>> rfc3339_duration_to_delta("P7D")
2162
datetime.timedelta(7)
2163
>>> rfc3339_duration_to_delta("PT60S")
2164
datetime.timedelta(0, 60)
2165
>>> rfc3339_duration_to_delta("PT60M")
2166
datetime.timedelta(0, 3600)
2167
>>> rfc3339_duration_to_delta("PT24H")
2168
datetime.timedelta(1)
2169
>>> rfc3339_duration_to_delta("P1W")
2170
datetime.timedelta(7)
2171
>>> rfc3339_duration_to_delta("PT5M30S")
2172
datetime.timedelta(0, 330)
2173
>>> rfc3339_duration_to_delta("P1DT3M20S")
2174
datetime.timedelta(1, 200)
2177
# Parsing an RFC 3339 duration with regular expressions is not
2178
# possible - there would have to be multiple places for the same
2179
# values, like seconds. The current code, while more esoteric, is
2180
# cleaner without depending on a parsing library. If Python had a
2181
# built-in library for parsing we would use it, but we'd like to
2182
# avoid excessive use of external libraries.
2184
# New type for defining tokens, syntax, and semantics all-in-one
2185
Token = collections.namedtuple("Token",
2186
("regexp", # To match token; if
2187
# "value" is not None,
2188
# must have a "group"
2190
"value", # datetime.timedelta or
2192
"followers")) # Tokens valid after
2194
Token = collections.namedtuple("Token", (
2195
"regexp", # To match token; if "value" is not None, must have
2196
# a "group" containing digits
2197
"value", # datetime.timedelta or None
2198
"followers")) # Tokens valid after this token
2199
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2200
# the "duration" ABNF definition in RFC 3339, Appendix A.
2201
token_end = Token(re.compile(r"$"), None, frozenset())
2202
token_second = Token(re.compile(r"(\d+)S"),
2203
datetime.timedelta(seconds=1),
2204
frozenset((token_end, )))
2205
token_minute = Token(re.compile(r"(\d+)M"),
2206
datetime.timedelta(minutes=1),
2207
frozenset((token_second, token_end)))
2208
token_hour = Token(re.compile(r"(\d+)H"),
2209
datetime.timedelta(hours=1),
2210
frozenset((token_minute, token_end)))
2211
token_time = Token(re.compile(r"T"),
2213
frozenset((token_hour, token_minute,
2215
token_day = Token(re.compile(r"(\d+)D"),
2216
datetime.timedelta(days=1),
2217
frozenset((token_time, token_end)))
2218
token_month = Token(re.compile(r"(\d+)M"),
2219
datetime.timedelta(weeks=4),
2220
frozenset((token_day, token_end)))
2221
token_year = Token(re.compile(r"(\d+)Y"),
2222
datetime.timedelta(weeks=52),
2223
frozenset((token_month, token_end)))
2224
token_week = Token(re.compile(r"(\d+)W"),
2225
datetime.timedelta(weeks=1),
2226
frozenset((token_end, )))
2227
token_duration = Token(re.compile(r"P"), None,
2228
frozenset((token_year, token_month,
2229
token_day, token_time,
2231
# Define starting values
2232
value = datetime.timedelta() # Value so far
2234
followers = frozenset((token_duration,)) # Following valid tokens
2235
s = duration # String left to parse
2236
# Loop until end token is found
2237
while found_token is not token_end:
2238
# Search for any currently valid tokens
2239
for token in followers:
2240
match = token.regexp.match(s)
2241
if match is not None:
2243
if token.value is not None:
2244
# Value found, parse digits
2245
factor = int(match.group(1), 10)
2246
# Add to value so far
2247
value += factor * token.value
2248
# Strip token from string
2249
s = token.regexp.sub("", s, 1)
2252
# Set valid next tokens
2253
followers = found_token.followers
2256
# No currently valid tokens were found
2257
raise ValueError("Invalid RFC 3339 duration: {!r}"
2263
1316
def string_to_delta(interval):
2264
1317
"""Parse a string and return a datetime.timedelta
2266
>>> string_to_delta('7d')
1319
>>> string_to_delta(u'7d')
2267
1320
datetime.timedelta(7)
2268
>>> string_to_delta('60s')
1321
>>> string_to_delta(u'60s')
2269
1322
datetime.timedelta(0, 60)
2270
>>> string_to_delta('60m')
1323
>>> string_to_delta(u'60m')
2271
1324
datetime.timedelta(0, 3600)
2272
>>> string_to_delta('24h')
1325
>>> string_to_delta(u'24h')
2273
1326
datetime.timedelta(1)
2274
>>> string_to_delta('1w')
1327
>>> string_to_delta(u'1w')
2275
1328
datetime.timedelta(7)
2276
>>> string_to_delta('5m 30s')
1329
>>> string_to_delta(u'5m 30s')
2277
1330
datetime.timedelta(0, 330)
2281
return rfc3339_duration_to_delta(interval)
2285
1332
timevalue = datetime.timedelta(0)
2286
1333
for s in interval.split():
1335
suffix = unicode(s[-1])
2289
1336
value = int(s[:-1])
2291
1338
delta = datetime.timedelta(value)
1339
elif suffix == u"s":
2293
1340
delta = datetime.timedelta(0, value)
1341
elif suffix == u"m":
2295
1342
delta = datetime.timedelta(0, 0, 0, 0, value)
1343
elif suffix == u"h":
2297
1344
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1345
elif suffix == u"w":
2299
1346
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2301
raise ValueError("Unknown suffix {!r}".format(suffix))
2302
except IndexError as e:
2303
raise ValueError(*(e.args))
1349
except (ValueError, IndexError):
2304
1351
timevalue += delta
2305
1352
return timevalue
1355
def if_nametoindex(interface):
1356
"""Call the C function if_nametoindex(), or equivalent
1358
Note: This function cannot accept a unicode string."""
1359
global if_nametoindex
1361
if_nametoindex = (ctypes.cdll.LoadLibrary
1362
(ctypes.util.find_library(u"c"))
1364
except (OSError, AttributeError):
1365
logger.warning(u"Doing if_nametoindex the hard way")
1366
def if_nametoindex(interface):
1367
"Get an interface index the hard way, i.e. using fcntl()"
1368
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1369
with closing(socket.socket()) as s:
1370
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1371
struct.pack(str(u"16s16x"),
1373
interface_index = struct.unpack(str(u"I"),
1375
return interface_index
1376
return if_nametoindex(interface)
2308
1379
def daemon(nochdir = False, noclose = False):
2309
1380
"""See daemon(3). Standard BSD Unix function.
2335
1406
##################################################################
2336
1407
# Parsing of options, both command line and config file
2338
parser = argparse.ArgumentParser()
2339
parser.add_argument("-v", "--version", action="version",
2340
version = "%(prog)s {}".format(version),
2341
help="show version number and exit")
2342
parser.add_argument("-i", "--interface", metavar="IF",
2343
help="Bind to interface IF")
2344
parser.add_argument("-a", "--address",
2345
help="Address to listen for requests on")
2346
parser.add_argument("-p", "--port", type=int,
2347
help="Port number to receive requests on")
2348
parser.add_argument("--check", action="store_true",
2349
help="Run self-test")
2350
parser.add_argument("--debug", action="store_true",
2351
help="Debug mode; run in foreground and log"
2352
" to terminal", default=None)
2353
parser.add_argument("--debuglevel", metavar="LEVEL",
2354
help="Debug level for stdout output")
2355
parser.add_argument("--priority", help="GnuTLS"
2356
" priority string (see GnuTLS documentation)")
2357
parser.add_argument("--servicename",
2358
metavar="NAME", help="Zeroconf service name")
2359
parser.add_argument("--configdir",
2360
default="/etc/mandos", metavar="DIR",
2361
help="Directory to search for configuration"
2363
parser.add_argument("--no-dbus", action="store_false",
2364
dest="use_dbus", help="Do not provide D-Bus"
2365
" system bus interface", default=None)
2366
parser.add_argument("--no-ipv6", action="store_false",
2367
dest="use_ipv6", help="Do not use IPv6",
2369
parser.add_argument("--no-restore", action="store_false",
2370
dest="restore", help="Do not restore stored"
2371
" state", default=None)
2372
parser.add_argument("--socket", type=int,
2373
help="Specify a file descriptor to a network"
2374
" socket to use instead of creating one")
2375
parser.add_argument("--statedir", metavar="DIR",
2376
help="Directory to save/restore state in")
2377
parser.add_argument("--foreground", action="store_true",
2378
help="Run in foreground", default=None)
2379
parser.add_argument("--no-zeroconf", action="store_false",
2380
dest="zeroconf", help="Do not use Zeroconf",
2383
options = parser.parse_args()
1409
parser = optparse.OptionParser(version = "%%prog %s" % version)
1410
parser.add_option("-i", u"--interface", type=u"string",
1411
metavar="IF", help=u"Bind to interface IF")
1412
parser.add_option("-a", u"--address", type=u"string",
1413
help=u"Address to listen for requests on")
1414
parser.add_option("-p", u"--port", type=u"int",
1415
help=u"Port number to receive requests on")
1416
parser.add_option("--check", action=u"store_true",
1417
help=u"Run self-test")
1418
parser.add_option("--debug", action=u"store_true",
1419
help=u"Debug mode; run in foreground and log to"
1421
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1422
u" priority string (see GnuTLS documentation)")
1423
parser.add_option("--servicename", type=u"string",
1424
metavar=u"NAME", help=u"Zeroconf service name")
1425
parser.add_option("--configdir", type=u"string",
1426
default=u"/etc/mandos", metavar=u"DIR",
1427
help=u"Directory to search for configuration"
1429
parser.add_option("--no-dbus", action=u"store_false",
1430
dest=u"use_dbus", help=u"Do not provide D-Bus"
1431
u" system bus interface")
1432
parser.add_option("--no-ipv6", action=u"store_false",
1433
dest=u"use_ipv6", help=u"Do not use IPv6")
1434
options = parser.parse_args()[0]
2385
1436
if options.check:
2387
fail_count, test_count = doctest.testmod()
2388
sys.exit(os.EX_OK if fail_count == 0 else 1)
2390
1441
# Default values for config file for server-global settings
2391
server_defaults = { "interface": "",
2396
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2397
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2398
"servicename": "Mandos",
2404
"statedir": "/var/lib/mandos",
2405
"foreground": "False",
1442
server_defaults = { u"interface": u"",
1447
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1448
u"servicename": u"Mandos",
1449
u"use_dbus": u"True",
1450
u"use_ipv6": u"True",
2409
1453
# Parse config file for server-global settings
2410
1454
server_config = configparser.SafeConfigParser(server_defaults)
2411
1455
del server_defaults
2412
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1456
server_config.read(os.path.join(options.configdir,
2413
1458
# Convert the SafeConfigParser object to a dict
2414
1459
server_settings = server_config.defaults()
2415
1460
# Use the appropriate methods on the non-string config options
2416
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2417
server_settings[option] = server_config.getboolean("DEFAULT",
1461
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1462
server_settings[option] = server_config.getboolean(u"DEFAULT",
2419
1464
if server_settings["port"]:
2420
server_settings["port"] = server_config.getint("DEFAULT",
2422
if server_settings["socket"]:
2423
server_settings["socket"] = server_config.getint("DEFAULT",
2425
# Later, stdin will, and stdout and stderr might, be dup'ed
2426
# over with an opened os.devnull. But we don't want this to
2427
# happen with a supplied network socket.
2428
if 0 <= server_settings["socket"] <= 2:
2429
server_settings["socket"] = os.dup(server_settings
1465
server_settings["port"] = server_config.getint(u"DEFAULT",
2431
1467
del server_config
2433
1469
# Override the settings from the config file with command line
2434
1470
# options, if set.
2435
for option in ("interface", "address", "port", "debug",
2436
"priority", "servicename", "configdir", "use_dbus",
2437
"use_ipv6", "debuglevel", "restore", "statedir",
2438
"socket", "foreground", "zeroconf"):
1471
for option in (u"interface", u"address", u"port", u"debug",
1472
u"priority", u"servicename", u"configdir",
1473
u"use_dbus", u"use_ipv6"):
2439
1474
value = getattr(options, option)
2440
1475
if value is not None:
2441
1476
server_settings[option] = value
2443
1478
# Force all strings to be unicode
2444
1479
for option in server_settings.keys():
2445
if isinstance(server_settings[option], bytes):
2446
server_settings[option] = (server_settings[option]
2448
# Force all boolean options to be boolean
2449
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2450
"foreground", "zeroconf"):
2451
server_settings[option] = bool(server_settings[option])
2452
# Debug implies foreground
2453
if server_settings["debug"]:
2454
server_settings["foreground"] = True
1480
if type(server_settings[option]) is str:
1481
server_settings[option] = unicode(server_settings[option])
2455
1482
# Now we have our good server settings in "server_settings"
2457
1484
##################################################################
2459
if (not server_settings["zeroconf"]
2460
and not (server_settings["port"]
2461
or server_settings["socket"] != "")):
2462
parser.error("Needs port or socket to work without Zeroconf")
2464
1486
# For convenience
2465
debug = server_settings["debug"]
2466
debuglevel = server_settings["debuglevel"]
2467
use_dbus = server_settings["use_dbus"]
2468
use_ipv6 = server_settings["use_ipv6"]
2469
stored_state_path = os.path.join(server_settings["statedir"],
2471
foreground = server_settings["foreground"]
2472
zeroconf = server_settings["zeroconf"]
2475
initlogger(debug, logging.DEBUG)
2480
level = getattr(logging, debuglevel.upper())
2481
initlogger(debug, level)
2483
if server_settings["servicename"] != "Mandos":
2484
syslogger.setFormatter(
2485
logging.Formatter('Mandos ({}) [%(process)d]:'
2486
' %(levelname)s: %(message)s'.format(
2487
server_settings["servicename"])))
1487
debug = server_settings[u"debug"]
1488
use_dbus = server_settings[u"use_dbus"]
1489
use_ipv6 = server_settings[u"use_ipv6"]
1492
syslogger.setLevel(logging.WARNING)
1493
console.setLevel(logging.WARNING)
1495
if server_settings[u"servicename"] != u"Mandos":
1496
syslogger.setFormatter(logging.Formatter
1497
(u'Mandos (%s) [%%(process)d]:'
1498
u' %%(levelname)s: %%(message)s'
1499
% server_settings[u"servicename"]))
2489
1501
# Parse config file with clients
2490
client_config = configparser.SafeConfigParser(Client
2492
client_config.read(os.path.join(server_settings["configdir"],
1502
client_defaults = { u"timeout": u"1h",
1504
u"checker": u"fping -q -- %%(host)s",
1507
client_config = configparser.SafeConfigParser(client_defaults)
1508
client_config.read(os.path.join(server_settings[u"configdir"],
2495
1511
global mandos_dbus_service
2496
1512
mandos_dbus_service = None
2499
if server_settings["socket"] != "":
2500
socketfd = server_settings["socket"]
2501
tcp_server = MandosServer(
2502
(server_settings["address"], server_settings["port"]),
2504
interface=(server_settings["interface"] or None),
2506
gnutls_priority=server_settings["priority"],
2510
pidfilename = "/run/mandos.pid"
2511
if not os.path.isdir("/run/."):
2512
pidfilename = "/var/run/mandos.pid"
2515
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2516
except IOError as e:
2517
logger.error("Could not open file %r", pidfilename,
1514
tcp_server = MandosServer((server_settings[u"address"],
1515
server_settings[u"port"]),
1517
interface=server_settings[u"interface"],
1520
server_settings[u"priority"],
1522
pidfilename = u"/var/run/mandos.pid"
1524
pidfile = open(pidfilename, u"w")
1526
logger.error(u"Could not open file %r", pidfilename)
2520
for name in ("_mandos", "mandos", "nobody"):
1529
uid = pwd.getpwnam(u"_mandos").pw_uid
1530
gid = pwd.getpwnam(u"_mandos").pw_gid
2522
uid = pwd.getpwnam(name).pw_uid
2523
gid = pwd.getpwnam(name).pw_gid
1533
uid = pwd.getpwnam(u"mandos").pw_uid
1534
gid = pwd.getpwnam(u"mandos").pw_gid
2525
1535
except KeyError:
1537
uid = pwd.getpwnam(u"nobody").pw_uid
1538
gid = pwd.getpwnam(u"nobody").pw_gid
2533
except OSError as error:
2534
if error.errno != errno.EPERM:
1545
except OSError, error:
1546
if error[0] != errno.EPERM:
1549
# Enable all possible GnuTLS debugging
2538
# Enable all possible GnuTLS debugging
2540
1551
# "Use a log level over 10 to enable all debugging options."
2541
1552
# - GnuTLS manual
2542
1553
gnutls.library.functions.gnutls_global_set_log_level(11)
2544
1555
@gnutls.library.types.gnutls_log_func
2545
1556
def debug_gnutls(level, string):
2546
logger.debug("GnuTLS: %s", string[:-1])
2548
gnutls.library.functions.gnutls_global_set_log_function(
2551
# Redirect stdin so all checkers get /dev/null
2552
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2553
os.dup2(null, sys.stdin.fileno())
2557
# Need to fork before connecting to D-Bus
2559
# Close all input and output, do double fork, etc.
2562
# multiprocessing will use threads, so before we use gobject we
2563
# need to inform gobject that threads will be used.
2564
gobject.threads_init()
1557
logger.debug(u"GnuTLS: %s", string[:-1])
1559
(gnutls.library.functions
1560
.gnutls_global_set_log_function(debug_gnutls))
2566
1562
global main_loop
2567
1563
# From the Avahi example code
2568
DBusGMainLoop(set_as_default=True)
1564
DBusGMainLoop(set_as_default=True )
2569
1565
main_loop = gobject.MainLoop()
2570
1566
bus = dbus.SystemBus()
2571
1567
# End of Avahi example code
2574
bus_name = dbus.service.BusName("se.recompile.Mandos",
2577
old_bus_name = dbus.service.BusName(
2578
"se.bsnet.fukt.Mandos", bus,
2580
except dbus.exceptions.DBusException as e:
2581
logger.error("Disabling D-Bus:", exc_info=e)
2583
server_settings["use_dbus"] = False
2584
tcp_server.use_dbus = False
2586
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2587
service = AvahiServiceToSyslog(
2588
name = server_settings["servicename"],
2589
servicetype = "_mandos._tcp",
2590
protocol = protocol,
2592
if server_settings["interface"]:
2593
service.interface = if_nametoindex(
2594
server_settings["interface"].encode("utf-8"))
2596
global multiprocessing_manager
2597
multiprocessing_manager = multiprocessing.Manager()
1569
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1570
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1571
service = AvahiService(name = server_settings[u"servicename"],
1572
servicetype = u"_mandos._tcp",
1573
protocol = protocol, bus = bus)
1574
if server_settings["interface"]:
1575
service.interface = (if_nametoindex
1576
(str(server_settings[u"interface"])))
2599
1578
client_class = Client
2601
1580
client_class = functools.partial(ClientDBus, bus = bus)
2603
client_settings = Client.config_parser(client_config)
2604
old_client_settings = {}
2607
# This is used to redirect stdout and stderr for checker processes
2609
wnull = open(os.devnull, "w") # A writable /dev/null
2610
# Only used if server is running in foreground but not in debug
2612
if debug or not foreground:
2615
# Get client data and settings from last running state.
2616
if server_settings["restore"]:
2618
with open(stored_state_path, "rb") as stored_state:
2619
clients_data, old_client_settings = pickle.load(
2621
os.remove(stored_state_path)
2622
except IOError as e:
2623
if e.errno == errno.ENOENT:
2624
logger.warning("Could not load persistent state:"
2625
" {}".format(os.strerror(e.errno)))
2627
logger.critical("Could not load persistent state:",
2630
except EOFError as e:
2631
logger.warning("Could not load persistent state: "
2635
with PGPEngine() as pgp:
2636
for client_name, client in clients_data.items():
2637
# Skip removed clients
2638
if client_name not in client_settings:
2641
# Decide which value to use after restoring saved state.
2642
# We have three different values: Old config file,
2643
# new config file, and saved state.
2644
# New config value takes precedence if it differs from old
2645
# config value, otherwise use saved state.
2646
for name, value in client_settings[client_name].items():
2648
# For each value in new config, check if it
2649
# differs from the old config value (Except for
2650
# the "secret" attribute)
2651
if (name != "secret"
2653
old_client_settings[client_name][name])):
2654
client[name] = value
2658
# Clients who has passed its expire date can still be
2659
# enabled if its last checker was successful. Clients
2660
# whose checker succeeded before we stored its state is
2661
# assumed to have successfully run all checkers during
2663
if client["enabled"]:
2664
if datetime.datetime.utcnow() >= client["expires"]:
2665
if not client["last_checked_ok"]:
2667
"disabling client {} - Client never "
2668
"performed a successful checker".format(
2670
client["enabled"] = False
2671
elif client["last_checker_status"] != 0:
2673
"disabling client {} - Client last"
2674
" checker failed with error code"
2677
client["last_checker_status"]))
2678
client["enabled"] = False
2680
client["expires"] = (
2681
datetime.datetime.utcnow()
2682
+ client["timeout"])
2683
logger.debug("Last checker succeeded,"
2684
" keeping {} enabled".format(
2687
client["secret"] = pgp.decrypt(
2688
client["encrypted_secret"],
2689
client_settings[client_name]["secret"])
2691
# If decryption fails, we use secret from new settings
2692
logger.debug("Failed to decrypt {} old secret".format(
2694
client["secret"] = (client_settings[client_name]
2697
# Add/remove clients based on new changes made to config
2698
for client_name in (set(old_client_settings)
2699
- set(client_settings)):
2700
del clients_data[client_name]
2701
for client_name in (set(client_settings)
2702
- set(old_client_settings)):
2703
clients_data[client_name] = client_settings[client_name]
2705
# Create all client objects
2706
for client_name, client in clients_data.items():
2707
tcp_server.clients[client_name] = client_class(
2710
server_settings = server_settings)
1581
tcp_server.clients.update(set(
1582
client_class(name = section,
1583
config= dict(client_config.items(section)))
1584
for section in client_config.sections()))
2712
1585
if not tcp_server.clients:
2713
logger.warning("No clients defined")
2716
if pidfile is not None:
1586
logger.warning(u"No clients defined")
1589
# Redirect stdin so all checkers get /dev/null
1590
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1591
os.dup2(null, sys.stdin.fileno())
1595
# No console logging
1596
logger.removeHandler(console)
1597
# Close all input and output, do double fork, etc.
1601
with closing(pidfile):
2717
1602
pid = os.getpid()
2720
print(pid, file=pidfile)
2722
logger.error("Could not write to file %r with PID %d",
1603
pidfile.write(str(pid) + "\n")
1606
logger.error(u"Could not write to file %r with PID %d",
1609
# "pidfile" was never created
1614
"Cleanup function; run on exit"
1617
while tcp_server.clients:
1618
client = tcp_server.clients.pop()
1619
client.disable_hook = None
1622
atexit.register(cleanup)
1625
signal.signal(signal.SIGINT, signal.SIG_IGN)
2727
1626
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2728
1627
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2732
@alternate_dbus_interfaces(
2733
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2734
class MandosDBusService(DBusObjectWithProperties):
1630
class MandosDBusService(dbus.service.Object):
2735
1631
"""A D-Bus proxy object"""
2737
1632
def __init__(self):
2738
dbus.service.Object.__init__(self, bus, "/")
2740
_interface = "se.recompile.Mandos"
2742
@dbus_interface_annotations(_interface)
2745
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2748
@dbus.service.signal(_interface, signature="o")
2749
def ClientAdded(self, objpath):
2753
@dbus.service.signal(_interface, signature="ss")
2754
def ClientNotFound(self, fingerprint, address):
2758
@dbus.service.signal(_interface, signature="os")
1633
dbus.service.Object.__init__(self, bus, u"/")
1634
_interface = u"se.bsnet.fukt.Mandos"
1636
@dbus.service.signal(_interface, signature=u"oa{sv}")
1637
def ClientAdded(self, objpath, properties):
1641
@dbus.service.signal(_interface, signature=u"s")
1642
def ClientNotFound(self, fingerprint):
1646
@dbus.service.signal(_interface, signature=u"os")
2759
1647
def ClientRemoved(self, objpath, name):
2763
@dbus.service.method(_interface, out_signature="ao")
1651
@dbus.service.method(_interface, out_signature=u"ao")
2764
1652
def GetAllClients(self):
2766
return dbus.Array(c.dbus_object_path for c in
2767
tcp_server.clients.itervalues())
1654
return dbus.Array(c.dbus_object_path
1655
for c in tcp_server.clients)
2769
1657
@dbus.service.method(_interface,
2770
out_signature="a{oa{sv}}")
1658
out_signature=u"a{oa{sv}}")
2771
1659
def GetAllClientsWithProperties(self):
2773
1661
return dbus.Dictionary(
2774
{ c.dbus_object_path: c.GetAll("")
2775
for c in tcp_server.clients.itervalues() },
1662
((c.dbus_object_path, c.GetAll(u""))
1663
for c in tcp_server.clients),
1664
signature=u"oa{sv}")
2778
@dbus.service.method(_interface, in_signature="o")
1666
@dbus.service.method(_interface, in_signature=u"o")
2779
1667
def RemoveClient(self, object_path):
2781
for c in tcp_server.clients.itervalues():
1669
for c in tcp_server.clients:
2782
1670
if c.dbus_object_path == object_path:
2783
del tcp_server.clients[c.name]
1671
tcp_server.clients.remove(c)
2784
1672
c.remove_from_connection()
2785
1673
# Don't signal anything except ClientRemoved
2786
c.disable(quiet=True)
1674
c.disable(signal=False)
2787
1675
# Emit D-Bus signal
2788
1676
self.ClientRemoved(object_path, c.name)
2790
raise KeyError(object_path)
2794
1682
mandos_dbus_service = MandosDBusService()
2797
"Cleanup function; run on exit"
2801
multiprocessing.active_children()
2803
if not (tcp_server.clients or client_settings):
2806
# Store client before exiting. Secrets are encrypted with key
2807
# based on what config file has. If config file is
2808
# removed/edited, old secret will thus be unrecovable.
2810
with PGPEngine() as pgp:
2811
for client in tcp_server.clients.itervalues():
2812
key = client_settings[client.name]["secret"]
2813
client.encrypted_secret = pgp.encrypt(client.secret,
2817
# A list of attributes that can not be pickled
2819
exclude = { "bus", "changedstate", "secret",
2820
"checker", "server_settings" }
2821
for name, typ in inspect.getmembers(dbus.service
2825
client_dict["encrypted_secret"] = (client
2827
for attr in client.client_structure:
2828
if attr not in exclude:
2829
client_dict[attr] = getattr(client, attr)
2831
clients[client.name] = client_dict
2832
del client_settings[client.name]["secret"]
2835
with tempfile.NamedTemporaryFile(
2839
dir=os.path.dirname(stored_state_path),
2840
delete=False) as stored_state:
2841
pickle.dump((clients, client_settings), stored_state)
2842
tempname = stored_state.name
2843
os.rename(tempname, stored_state_path)
2844
except (IOError, OSError) as e:
2850
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2851
logger.warning("Could not save persistent state: {}"
2852
.format(os.strerror(e.errno)))
2854
logger.warning("Could not save persistent state:",
2858
# Delete all clients, and settings from config
2859
while tcp_server.clients:
2860
name, client = tcp_server.clients.popitem()
2862
client.remove_from_connection()
2863
# Don't signal anything except ClientRemoved
2864
client.disable(quiet=True)
2867
mandos_dbus_service.ClientRemoved(
2868
client.dbus_object_path, client.name)
2869
client_settings.clear()
2871
atexit.register(cleanup)
2873
for client in tcp_server.clients.itervalues():
1684
for client in tcp_server.clients:
2875
1686
# Emit D-Bus signal
2876
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2877
# Need to initiate checking of clients
2879
client.init_checker()
1687
mandos_dbus_service.ClientAdded(client.dbus_object_path,
2881
1691
tcp_server.enable()
2882
1692
tcp_server.server_activate()
2884
1694
# Find out what port we got
2886
service.port = tcp_server.socket.getsockname()[1]
1695
service.port = tcp_server.socket.getsockname()[1]
2888
logger.info("Now listening on address %r, port %d,"
2889
" flowinfo %d, scope_id %d",
2890
*tcp_server.socket.getsockname())
1697
logger.info(u"Now listening on address %r, port %d,"
1698
" flowinfo %d, scope_id %d"
1699
% tcp_server.socket.getsockname())
2892
logger.info("Now listening on address %r, port %d",
2893
*tcp_server.socket.getsockname())
1701
logger.info(u"Now listening on address %r, port %d"
1702
% tcp_server.socket.getsockname())
2895
1704
#service.interface = tcp_server.socket.getsockname()[3]
2899
# From the Avahi example code
2902
except dbus.exceptions.DBusException as error:
2903
logger.critical("D-Bus Exception", exc_info=error)
2906
# End of Avahi example code
1707
# From the Avahi example code
1710
except dbus.exceptions.DBusException, error:
1711
logger.critical(u"DBusException: %s", error)
1713
# End of Avahi example code
2908
1715
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2909
1716
lambda *args, **kwargs:
2910
1717
(tcp_server.handle_request
2911
1718
(*args[2:], **kwargs) or True))
2913
logger.debug("Starting main loop")
1720
logger.debug(u"Starting main loop")
2914
1721
main_loop.run()
2915
except AvahiError as error:
2916
logger.critical("Avahi Error", exc_info=error)
1722
except AvahiError, error:
1723
logger.critical(u"AvahiError: %s", error)
2919
1725
except KeyboardInterrupt:
2921
print("", file=sys.stderr)
2922
logger.debug("Server received KeyboardInterrupt")
2923
logger.debug("Server exiting")
2924
# Must run before the D-Bus bus name gets deregistered
1728
logger.debug(u"Server received KeyboardInterrupt")
1729
logger.debug(u"Server exiting")
2928
1731
if __name__ == '__main__':