346
197
dbus.UInt16(self.port),
347
198
avahi.string_array_to_txt_array(self.TXT))
348
199
self.group.Commit()
350
200
def entry_group_state_changed(self, state, error):
351
201
"""Derived from the Avahi example code"""
352
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
354
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
355
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
356
206
elif state == avahi.ENTRY_GROUP_COLLISION:
357
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
359
209
elif state == avahi.ENTRY_GROUP_FAILURE:
360
logger.critical("Avahi: Error in group state changed %s",
362
raise AvahiGroupError("State changed: {!s}".format(error))
210
logger.critical(u"Avahi: Error in group state changed %s",
212
raise AvahiGroupError(u"State changed: %s"
364
214
def cleanup(self):
365
215
"""Derived from the Avahi example code"""
366
216
if self.group is not None:
369
except (dbus.exceptions.UnknownMethodException,
370
dbus.exceptions.DBusException):
372
218
self.group = None
375
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
376
220
"""Derived from the Avahi example code"""
377
logger.debug("Avahi server state change: %i", state)
379
avahi.SERVER_INVALID: "Zeroconf server invalid",
380
avahi.SERVER_REGISTERING: None,
381
avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
avahi.SERVER_FAILURE: "Zeroconf server failure",
384
if state in bad_states:
385
if bad_states[state] is not None:
387
logger.error(bad_states[state])
389
logger.error(bad_states[state] + ": %r", error)
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
391
225
elif state == avahi.SERVER_RUNNING:
394
except dbus.exceptions.DBusException as error:
395
if (error.get_dbus_name()
396
== "org.freedesktop.Avahi.CollisionError"):
397
logger.info("Local Zeroconf service name"
399
return self.rename(remove=False)
401
logger.critical("D-Bus Exception", exc_info=error)
406
logger.debug("Unknown state: %r", state)
408
logger.debug("Unknown state: %r: %r", state, error)
410
227
def activate(self):
411
228
"""Derived from the Avahi example code"""
412
229
if self.server is None:
413
230
self.server = dbus.Interface(
414
231
self.bus.get_object(avahi.DBUS_NAME,
415
avahi.DBUS_PATH_SERVER,
416
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
417
233
avahi.DBUS_INTERFACE_SERVER)
418
self.server.connect_to_signal("StateChanged",
419
self.server_state_changed)
234
self.server.connect_to_signal(u"StateChanged",
235
self.server_state_changed)
420
236
self.server_state_changed(self.server.GetState())
423
class AvahiServiceToSyslog(AvahiService):
424
def rename(self, *args, **kwargs):
425
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
427
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
432
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
448
# Unless otherwise indicated, the constants and types below are
449
# all from the gnutls/gnutls.h C header file.
459
E_NO_CERTIFICATE_FOUND = -49
460
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
463
class session_int(ctypes.Structure):
465
session_t = ctypes.POINTER(session_int)
466
class certificate_credentials_st(ctypes.Structure):
468
certificate_credentials_t = ctypes.POINTER(
469
certificate_credentials_st)
470
certificate_type_t = ctypes.c_int
471
class datum_t(ctypes.Structure):
472
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
('size', ctypes.c_uint)]
474
class openpgp_crt_int(ctypes.Structure):
476
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
480
transport_ptr_t = ctypes.c_void_p
481
close_request_t = ctypes.c_int
484
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
490
# Default usage is by a message string, but if a return
491
# code is passed, convert it to a string with
494
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
499
class CertificateSecurityError(Error):
503
class Credentials(object):
505
self._c_object = gnutls.certificate_credentials_t()
506
gnutls.certificate_allocate_credentials(
507
ctypes.byref(self._c_object))
508
self.type = gnutls.CRD_CERTIFICATE
511
gnutls.certificate_free_credentials(self._c_object)
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
515
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
gnutls.set_default_priority(self._c_object)
518
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
gnutls.handshake_set_private_extensions(self._c_object,
522
if credentials is None:
523
credentials = gnutls.Credentials()
524
gnutls.credentials_set(self._c_object, credentials.type,
525
ctypes.cast(credentials._c_object,
527
self.credentials = credentials
530
gnutls.deinit(self._c_object)
533
return gnutls.handshake(self._c_object)
535
def send(self, data):
539
data_len -= gnutls.record_send(self._c_object,
544
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
546
# Error handling functions
547
def _error_code(result):
548
"""A function to raise exceptions on errors, suitable
549
for the 'restype' attribute on ctypes functions"""
552
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
556
def _retry_on_error(result, func, arguments):
557
"""A function to retry on some errors, suitable
558
for the 'errcheck' attribute on ctypes functions"""
560
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
561
return _error_code(result)
562
result = func(*arguments)
565
# Unless otherwise indicated, the function declarations below are
566
# all from the gnutls/gnutls.h C header file.
569
priority_set_direct = _library.gnutls_priority_set_direct
570
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
ctypes.POINTER(ctypes.c_char_p)]
572
priority_set_direct.restype = _error_code
574
init = _library.gnutls_init
575
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
init.restype = _error_code
578
set_default_priority = _library.gnutls_set_default_priority
579
set_default_priority.argtypes = [session_t]
580
set_default_priority.restype = _error_code
582
record_send = _library.gnutls_record_send
583
record_send.argtypes = [session_t, ctypes.c_void_p,
585
record_send.restype = ctypes.c_ssize_t
586
record_send.errcheck = _retry_on_error
588
certificate_allocate_credentials = (
589
_library.gnutls_certificate_allocate_credentials)
590
certificate_allocate_credentials.argtypes = [
591
ctypes.POINTER(certificate_credentials_t)]
592
certificate_allocate_credentials.restype = _error_code
594
certificate_free_credentials = (
595
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
597
certificate_free_credentials.restype = None
599
handshake_set_private_extensions = (
600
_library.gnutls_handshake_set_private_extensions)
601
handshake_set_private_extensions.argtypes = [session_t,
603
handshake_set_private_extensions.restype = None
605
credentials_set = _library.gnutls_credentials_set
606
credentials_set.argtypes = [session_t, credentials_type_t,
608
credentials_set.restype = _error_code
610
strerror = _library.gnutls_strerror
611
strerror.argtypes = [ctypes.c_int]
612
strerror.restype = ctypes.c_char_p
614
certificate_type_get = _library.gnutls_certificate_type_get
615
certificate_type_get.argtypes = [session_t]
616
certificate_type_get.restype = _error_code
618
certificate_get_peers = _library.gnutls_certificate_get_peers
619
certificate_get_peers.argtypes = [session_t,
620
ctypes.POINTER(ctypes.c_uint)]
621
certificate_get_peers.restype = ctypes.POINTER(datum_t)
623
global_set_log_level = _library.gnutls_global_set_log_level
624
global_set_log_level.argtypes = [ctypes.c_int]
625
global_set_log_level.restype = None
627
global_set_log_function = _library.gnutls_global_set_log_function
628
global_set_log_function.argtypes = [log_func]
629
global_set_log_function.restype = None
631
deinit = _library.gnutls_deinit
632
deinit.argtypes = [session_t]
633
deinit.restype = None
635
handshake = _library.gnutls_handshake
636
handshake.argtypes = [session_t]
637
handshake.restype = _error_code
638
handshake.errcheck = _retry_on_error
640
transport_set_ptr = _library.gnutls_transport_set_ptr
641
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
transport_set_ptr.restype = None
644
bye = _library.gnutls_bye
645
bye.argtypes = [session_t, close_request_t]
646
bye.restype = _error_code
647
bye.errcheck = _retry_on_error
649
check_version = _library.gnutls_check_version
650
check_version.argtypes = [ctypes.c_char_p]
651
check_version.restype = ctypes.c_char_p
653
# All the function declarations below are from gnutls/openpgp.h
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
663
openpgp_crt_import.restype = _error_code
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
680
openpgp_crt_get_fingerprint.restype = _error_code
682
# Remove non-public functions
683
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
687
def call_pipe(connection, # : multiprocessing.Connection
688
func, *args, **kwargs):
689
"""This function is meant to be called by multiprocessing.Process
691
This function runs func(*args, **kwargs), and writes the resulting
692
return value on the provided multiprocessing.Connection.
694
connection.send(func(*args, **kwargs))
697
239
class Client(object):
698
240
"""A representation of a client host served by this server.
701
approved: bool(); 'None' if not yet approved/disapproved
243
_approved: bool(); 'None' if not yet approved/disapproved
702
244
approval_delay: datetime.timedelta(); Time to wait for approval
703
245
approval_duration: datetime.timedelta(); Duration of one approval
704
246
checker: subprocess.Popen(); a running checker process used
705
247
to see if the client lives.
706
248
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
249
checker_callback_tag: - '' -
708
250
checker_command: string; External command which is run to check
709
251
if client lives. %() expansions are done at
710
252
runtime with vars(self) as dict, so that for
711
253
instance %(name)s can be used in the command.
712
254
checker_initiator_tag: a gobject event source tag, or None
713
255
created: datetime.datetime(); (UTC) object creation
714
client_structure: Object describing what attributes a client has
715
and is used for storing the client at exit
716
256
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: - '' -
719
260
fingerprint: string (40 or 32 hexadecimal digits); used to
720
261
uniquely identify the client
721
262
host: string; available for use by the checker command
722
263
interval: datetime.timedelta(); How often to start a new checker
723
last_approval_request: datetime.datetime(); (UTC) or None
724
264
last_checked_ok: datetime.datetime(); (UTC) or None
725
last_checker_status: integer between 0 and 255 reflecting exit
726
status of last checker. -1 reflects crashed
727
checker, -2 means no checker completed yet.
728
last_checker_signal: The signal which killed the last checker, if
729
last_checker_status is -1
730
last_enabled: datetime.datetime(); (UTC) or None
265
last_enabled: datetime.datetime(); (UTC)
731
266
name: string; from the config file, used in log messages and
732
267
D-Bus identifiers
733
268
secret: bytestring; sent verbatim (over TLS) to client
734
269
timeout: datetime.timedelta(); How long from last_checked_ok
735
270
until this client is disabled
736
extended_timeout: extra long timeout when secret has been sent
737
271
runtime_expansions: Allowed attributes for runtime expansion.
738
expires: datetime.datetime(); time (UTC) when a client will be
740
server_settings: The server_settings dict from main()
743
runtime_expansions = ("approval_delay", "approval_duration",
744
"created", "enabled", "expires",
745
"fingerprint", "host", "interval",
746
"last_approval_request", "last_checked_ok",
747
"last_enabled", "name", "timeout")
750
"extended_timeout": "PT15M",
752
"checker": "fping -q -- %%(host)s",
754
"approval_delay": "PT0S",
755
"approval_duration": "PT1S",
756
"approved_by_default": "True",
274
runtime_expansions = (u"approval_delay", u"approval_duration",
275
u"created", u"enabled", u"fingerprint",
276
u"host", u"interval", u"last_checked_ok",
277
u"last_enabled", u"name", u"timeout")
761
def config_parser(config):
762
"""Construct a new dict of client settings of this form:
763
{ client_name: {setting_name: value, ...}, ...}
764
with exceptions for any special settings as defined above.
765
NOTE: Must be a pure function. Must return the same result
766
value given the same arguments.
769
for client_name in config.sections():
770
section = dict(config.items(client_name))
771
client = settings[client_name] = {}
773
client["host"] = section["host"]
774
# Reformat values from string types to Python types
775
client["approved_by_default"] = config.getboolean(
776
client_name, "approved_by_default")
777
client["enabled"] = config.getboolean(client_name,
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
783
client["fingerprint"] = (section["fingerprint"].upper()
785
if "secret" in section:
786
client["secret"] = section["secret"].decode("base64")
787
elif "secfile" in section:
788
with open(os.path.expanduser(os.path.expandvars
789
(section["secfile"])),
791
client["secret"] = secfile.read()
793
raise TypeError("No secret or secfile for section {}"
795
client["timeout"] = string_to_delta(section["timeout"])
796
client["extended_timeout"] = string_to_delta(
797
section["extended_timeout"])
798
client["interval"] = string_to_delta(section["interval"])
799
client["approval_delay"] = string_to_delta(
800
section["approval_delay"])
801
client["approval_duration"] = string_to_delta(
802
section["approval_duration"])
803
client["checker_command"] = section["checker"]
804
client["last_approval_request"] = None
805
client["last_checked_ok"] = None
806
client["last_checker_status"] = -2
810
def __init__(self, settings, name = None, server_settings=None):
280
def _timedelta_to_milliseconds(td):
281
"Convert a datetime.timedelta() to milliseconds"
282
return ((td.days * 24 * 60 * 60 * 1000)
283
+ (td.seconds * 1000)
284
+ (td.microseconds // 1000))
286
def timeout_milliseconds(self):
287
"Return the 'timeout' attribute in milliseconds"
288
return self._timedelta_to_milliseconds(self.timeout)
290
def interval_milliseconds(self):
291
"Return the 'interval' attribute in milliseconds"
292
return self._timedelta_to_milliseconds(self.interval)
294
def approval_delay_milliseconds(self):
295
return self._timedelta_to_milliseconds(self.approval_delay)
297
def __init__(self, name = None, disable_hook=None, config=None):
298
"""Note: the 'checker' key in 'config' sets the
299
'checker_command' attribute and *not* the 'checker'
812
if server_settings is None:
814
self.server_settings = server_settings
815
# adding all client settings
816
for setting, value in settings.items():
817
setattr(self, setting, value)
820
if not hasattr(self, "last_enabled"):
821
self.last_enabled = datetime.datetime.utcnow()
822
if not hasattr(self, "expires"):
823
self.expires = (datetime.datetime.utcnow()
304
logger.debug(u"Creating client %r", self.name)
305
# Uppercase and remove spaces from fingerprint for later
306
# comparison purposes with return value from the fingerprint()
308
self.fingerprint = (config[u"fingerprint"].upper()
310
logger.debug(u" Fingerprint: %s", self.fingerprint)
311
if u"secret" in config:
312
self.secret = config[u"secret"].decode(u"base64")
313
elif u"secfile" in config:
314
with open(os.path.expanduser(os.path.expandvars
315
(config[u"secfile"])),
317
self.secret = secfile.read()
826
self.last_enabled = None
829
logger.debug("Creating client %r", self.name)
830
logger.debug(" Fingerprint: %s", self.fingerprint)
831
self.created = settings.get("created",
832
datetime.datetime.utcnow())
834
# attributes specific for this server instance
319
raise TypeError(u"No secret or secfile for client %s"
321
self.host = config.get(u"host", u"")
322
self.created = datetime.datetime.utcnow()
324
self.last_enabled = None
325
self.last_checked_ok = None
326
self.timeout = string_to_delta(config[u"timeout"])
327
self.interval = string_to_delta(config[u"interval"])
328
self.disable_hook = disable_hook
835
329
self.checker = None
836
330
self.checker_initiator_tag = None
837
331
self.disable_initiator_tag = None
838
332
self.checker_callback_tag = None
333
self.checker_command = config[u"checker"]
839
334
self.current_checker_command = None
335
self.last_connect = None
336
self._approved = None
337
self.approved_by_default = config.get(u"approved_by_default",
841
339
self.approvals_pending = 0
842
self.changedstate = multiprocessing_manager.Condition(
843
multiprocessing_manager.Lock())
844
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
846
if not attr.startswith("_")]
847
self.client_structure.append("client_structure")
849
for name, t in inspect.getmembers(
850
type(self), lambda obj: isinstance(obj, property)):
851
if not name.startswith("_"):
852
self.client_structure.append(name)
340
self.approval_delay = string_to_delta(
341
config[u"approval_delay"])
342
self.approval_duration = string_to_delta(
343
config[u"approval_duration"])
344
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
854
# Send notice to process children that client state has changed
855
346
def send_changedstate(self):
856
with self.changedstate:
857
self.changedstate.notify_all()
347
self.changedstate.acquire()
348
self.changedstate.notify_all()
349
self.changedstate.release()
859
351
def enable(self):
860
352
"""Start this client's checker and timeout hooks"""
861
if getattr(self, "enabled", False):
353
if getattr(self, u"enabled", False):
862
354
# Already enabled
864
self.expires = datetime.datetime.utcnow() + self.timeout
356
self.send_changedstate()
866
357
self.last_enabled = datetime.datetime.utcnow()
868
self.send_changedstate()
358
# Schedule a new checker to be started an 'interval' from now,
359
# and every interval from then on.
360
self.checker_initiator_tag = (gobject.timeout_add
361
(self.interval_milliseconds(),
363
# Schedule a disable() when 'timeout' has passed
364
self.disable_initiator_tag = (gobject.timeout_add
365
(self.timeout_milliseconds(),
368
# Also start a new checker *right now*.
870
371
def disable(self, quiet=True):
871
372
"""Disable this client."""
872
373
if not getattr(self, "enabled", False):
875
logger.info("Disabling client %s", self.name)
876
if getattr(self, "disable_initiator_tag", None) is not None:
376
self.send_changedstate()
378
logger.info(u"Disabling client %s", self.name)
379
if getattr(self, u"disable_initiator_tag", False):
877
380
gobject.source_remove(self.disable_initiator_tag)
878
381
self.disable_initiator_tag = None
880
if getattr(self, "checker_initiator_tag", None) is not None:
382
if getattr(self, u"checker_initiator_tag", False):
881
383
gobject.source_remove(self.checker_initiator_tag)
882
384
self.checker_initiator_tag = None
883
385
self.stop_checker()
386
if self.disable_hook:
387
self.disable_hook(self)
884
388
self.enabled = False
886
self.send_changedstate()
887
389
# Do not run this again if called by a gobject.timeout_add
890
392
def __del__(self):
393
self.disable_hook = None
893
def init_checker(self):
894
# Schedule a new checker to be started an 'interval' from now,
895
# and every interval from then on.
896
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
901
# Schedule a disable() when 'timeout' has passed
902
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
905
int(self.timeout.total_seconds() * 1000), self.disable)
906
# Also start a new checker *right now*.
909
def checker_callback(self, source, condition, connection,
396
def checker_callback(self, pid, condition, command):
911
397
"""The checker has completed, so take appropriate actions."""
912
398
self.checker_callback_tag = None
913
399
self.checker = None
914
# Read return code from connection (see call_pipe)
915
returncode = connection.recv()
919
self.last_checker_status = returncode
920
self.last_checker_signal = None
921
if self.last_checker_status == 0:
922
logger.info("Checker for %(name)s succeeded",
400
if os.WIFEXITED(condition):
401
exitstatus = os.WEXITSTATUS(condition)
403
logger.info(u"Checker for %(name)s succeeded",
924
405
self.checked_ok()
926
logger.info("Checker for %(name)s failed", vars(self))
407
logger.info(u"Checker for %(name)s failed",
928
self.last_checker_status = -1
929
self.last_checker_signal = -returncode
930
logger.warning("Checker for %(name)s crashed?",
410
logger.warning(u"Checker for %(name)s crashed?",
934
413
def checked_ok(self):
935
"""Assert that the client has been seen, alive and well."""
414
"""Bump up the timeout for this client.
416
This should only be called when the client has been seen,
936
419
self.last_checked_ok = datetime.datetime.utcnow()
937
self.last_checker_status = 0
938
self.last_checker_signal = None
941
def bump_timeout(self, timeout=None):
942
"""Bump up the timeout for this client."""
944
timeout = self.timeout
945
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
947
self.disable_initiator_tag = None
948
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
950
int(timeout.total_seconds() * 1000), self.disable)
951
self.expires = datetime.datetime.utcnow() + timeout
953
def need_approval(self):
954
self.last_approval_request = datetime.datetime.utcnow()
420
gobject.source_remove(self.disable_initiator_tag)
421
self.disable_initiator_tag = (gobject.timeout_add
422
(self.timeout_milliseconds(),
956
425
def start_checker(self):
957
426
"""Start a new checker subprocess if one is not running.
1123
class DBusObjectWithAnnotations(dbus.service.Object):
1124
"""A D-Bus object with annotations.
1126
Classes inheriting from this can use the dbus_annotations
1127
decorator to add annotations to methods or signals.
1131
def _is_dbus_thing(thing):
1132
"""Returns a function testing if an attribute is a D-Bus thing
1134
If called like _is_dbus_thing("method") it returns a function
1135
suitable for use as predicate to inspect.getmembers().
1137
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1140
def _get_all_dbus_things(self, thing):
1141
"""Returns a generator of (name, attribute) pairs
1143
return ((getattr(athing.__get__(self), "_dbus_name", name),
1144
athing.__get__(self))
1145
for cls in self.__class__.__mro__
1147
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1149
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1153
def Introspect(self, object_path, connection):
1154
"""Overloading of standard D-Bus method.
1156
Inserts annotation tags on methods and signals.
1158
xmlstring = dbus.service.Object.Introspect(self, object_path,
1161
document = xml.dom.minidom.parseString(xmlstring)
1163
for if_tag in document.getElementsByTagName("interface"):
1164
# Add annotation tags
1165
for typ in ("method", "signal"):
1166
for tag in if_tag.getElementsByTagName(typ):
1168
for name, prop in (self.
1169
_get_all_dbus_things(typ)):
1170
if (name == tag.getAttribute("name")
1171
and prop._dbus_interface
1172
== if_tag.getAttribute("name")):
1173
annots.update(getattr(
1174
prop, "_dbus_annotations", {}))
1175
for name, value in annots.items():
1176
ann_tag = document.createElement(
1178
ann_tag.setAttribute("name", name)
1179
ann_tag.setAttribute("value", value)
1180
tag.appendChild(ann_tag)
1181
# Add interface annotation tags
1182
for annotation, value in dict(
1183
itertools.chain.from_iterable(
1184
annotations().items()
1185
for name, annotations
1186
in self._get_all_dbus_things("interface")
1187
if name == if_tag.getAttribute("name")
1189
ann_tag = document.createElement("annotation")
1190
ann_tag.setAttribute("name", annotation)
1191
ann_tag.setAttribute("value", value)
1192
if_tag.appendChild(ann_tag)
1193
# Fix argument name for the Introspect method itself
1194
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1196
for cn in if_tag.getElementsByTagName("method"):
1197
if cn.getAttribute("name") == "Introspect":
1198
for arg in cn.getElementsByTagName("arg"):
1199
if (arg.getAttribute("direction")
1201
arg.setAttribute("name",
1203
xmlstring = document.toxml("utf-8")
1205
except (AttributeError, xml.dom.DOMException,
1206
xml.parsers.expat.ExpatError) as error:
1207
logger.error("Failed to override Introspection method",
1212
class DBusObjectWithProperties(DBusObjectWithAnnotations):
567
class DBusObjectWithProperties(dbus.service.Object):
1213
568
"""A D-Bus object with properties.
1215
570
Classes inheriting from this can use the dbus_service_property
1216
571
decorator to expose methods as D-Bus properties. It exposes the
1217
572
standard Get(), Set(), and GetAll() methods on the D-Bus.
576
def _is_dbus_property(obj):
577
return getattr(obj, u"_dbus_is_property", False)
579
def _get_all_dbus_properties(self):
580
"""Returns a generator of (name, attribute) pairs
582
return ((prop._dbus_name, prop)
584
inspect.getmembers(self, self._is_dbus_property))
1220
586
def _get_dbus_property(self, interface_name, property_name):
1221
587
"""Returns a bound method if one exists which is a D-Bus
1222
588
property with the specified name and interface.
1224
for cls in self.__class__.__mro__:
1225
for name, value in inspect.getmembers(
1226
cls, self._is_dbus_thing("property")):
1227
if (value._dbus_name == property_name
1228
and value._dbus_interface == interface_name):
1229
return value.__get__(self)
590
for name in (property_name,
591
property_name + u"_dbus_property"):
592
prop = getattr(self, name, None)
594
or not self._is_dbus_property(prop)
595
or prop._dbus_name != property_name
596
or (interface_name and prop._dbus_interface
597
and interface_name != prop._dbus_interface)):
1231
600
# No such property
1232
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
self.dbus_object_path, interface_name, property_name))
1236
def _get_all_interface_names(cls):
1237
"""Get a sequence of all interfaces supported by an object"""
1238
return (name for name in set(getattr(getattr(x, attr),
1239
"_dbus_interface", None)
1240
for x in (inspect.getmro(cls))
1242
if name is not None)
1244
@dbus.service.method(dbus.PROPERTIES_IFACE,
601
raise DBusPropertyNotFound(self.dbus_object_path + u":"
602
+ interface_name + u"."
605
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
1247
607
def Get(self, interface_name, property_name):
1248
608
"""Standard D-Bus property Get() method, see D-Bus standard.
1250
610
prop = self._get_dbus_property(interface_name, property_name)
1251
if prop._dbus_access == "write":
611
if prop._dbus_access == u"write":
1252
612
raise DBusPropertyAccessException(property_name)
1254
if not hasattr(value, "variant_level"):
614
if not hasattr(value, u"variant_level"):
1256
616
return type(value)(value, variant_level=value.variant_level+1)
1258
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
618
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
1259
619
def Set(self, interface_name, property_name, value):
1260
620
"""Standard D-Bus property Set() method, see D-Bus standard.
1262
622
prop = self._get_dbus_property(interface_name, property_name)
1263
if prop._dbus_access == "read":
623
if prop._dbus_access == u"read":
1264
624
raise DBusPropertyAccessException(property_name)
1265
if prop._dbus_get_args_options["byte_arrays"]:
625
if prop._dbus_get_args_options[u"byte_arrays"]:
1266
626
# The byte_arrays option is not supported yet on
1267
627
# signatures other than "ay".
1268
if prop._dbus_signature != "ay":
1269
raise ValueError("Byte arrays not supported for non-"
1270
"'ay' signature {!r}"
1271
.format(prop._dbus_signature))
1272
value = dbus.ByteArray(b''.join(chr(byte)
628
if prop._dbus_signature != u"ay":
630
value = dbus.ByteArray(''.join(unichr(byte)
1276
@dbus.service.method(dbus.PROPERTIES_IFACE,
1278
out_signature="a{sv}")
634
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
635
out_signature=u"a{sv}")
1279
636
def GetAll(self, interface_name):
1280
637
"""Standard D-Bus property GetAll() method, see D-Bus
1283
640
Note: Will not include properties with access="write".
1286
for name, prop in self._get_all_dbus_things("property"):
643
for name, prop in self._get_all_dbus_properties():
1287
644
if (interface_name
1288
645
and interface_name != prop._dbus_interface):
1289
646
# Interface non-empty but did not match
1291
648
# Ignore write-only properties
1292
if prop._dbus_access == "write":
649
if prop._dbus_access == u"write":
1295
if not hasattr(value, "variant_level"):
1296
properties[name] = value
652
if not hasattr(value, u"variant_level"):
1298
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
1300
return dbus.Dictionary(properties, signature="sv")
1302
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
def PropertiesChanged(self, interface_name, changed_properties,
1304
invalidated_properties):
1305
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
655
all[name] = type(value)(value, variant_level=
656
value.variant_level+1)
657
return dbus.Dictionary(all, signature=u"sv")
1310
659
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1312
661
path_keyword='object_path',
1313
662
connection_keyword='connection')
1314
663
def Introspect(self, object_path, connection):
1315
"""Overloading of standard D-Bus method.
1317
Inserts property tags and interface annotation tags.
664
"""Standard D-Bus method, overloaded to insert property tags.
1319
xmlstring = DBusObjectWithAnnotations.Introspect(self,
666
xmlstring = dbus.service.Object.Introspect(self, object_path,
1323
669
document = xml.dom.minidom.parseString(xmlstring)
1325
670
def make_tag(document, name, prop):
1326
e = document.createElement("property")
1327
e.setAttribute("name", name)
1328
e.setAttribute("type", prop._dbus_signature)
1329
e.setAttribute("access", prop._dbus_access)
671
e = document.createElement(u"property")
672
e.setAttribute(u"name", name)
673
e.setAttribute(u"type", prop._dbus_signature)
674
e.setAttribute(u"access", prop._dbus_access)
1332
for if_tag in document.getElementsByTagName("interface"):
676
for if_tag in document.getElementsByTagName(u"interface"):
1334
677
for tag in (make_tag(document, name, prop)
1336
in self._get_all_dbus_things("property")
679
in self._get_all_dbus_properties()
1337
680
if prop._dbus_interface
1338
== if_tag.getAttribute("name")):
681
== if_tag.getAttribute(u"name")):
1339
682
if_tag.appendChild(tag)
1340
# Add annotation tags for properties
1341
for tag in if_tag.getElementsByTagName("property"):
1343
for name, prop in self._get_all_dbus_things(
1345
if (name == tag.getAttribute("name")
1346
and prop._dbus_interface
1347
== if_tag.getAttribute("name")):
1348
annots.update(getattr(
1349
prop, "_dbus_annotations", {}))
1350
for name, value in annots.items():
1351
ann_tag = document.createElement(
1353
ann_tag.setAttribute("name", name)
1354
ann_tag.setAttribute("value", value)
1355
tag.appendChild(ann_tag)
1356
683
# Add the names to the return values for the
1357
684
# "org.freedesktop.DBus.Properties" methods
1358
if (if_tag.getAttribute("name")
1359
== "org.freedesktop.DBus.Properties"):
1360
for cn in if_tag.getElementsByTagName("method"):
1361
if cn.getAttribute("name") == "Get":
1362
for arg in cn.getElementsByTagName("arg"):
1363
if (arg.getAttribute("direction")
1365
arg.setAttribute("name", "value")
1366
elif cn.getAttribute("name") == "GetAll":
1367
for arg in cn.getElementsByTagName("arg"):
1368
if (arg.getAttribute("direction")
1370
arg.setAttribute("name", "props")
1371
xmlstring = document.toxml("utf-8")
1373
except (AttributeError, xml.dom.DOMException,
1374
xml.parsers.expat.ExpatError) as error:
1375
logger.error("Failed to override Introspection method",
1380
dbus.OBJECT_MANAGER_IFACE
1381
except AttributeError:
1382
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1384
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
"""A D-Bus object with an ObjectManager.
1387
Classes inheriting from this exposes the standard
1388
GetManagedObjects call and the InterfacesAdded and
1389
InterfacesRemoved signals on the standard
1390
"org.freedesktop.DBus.ObjectManager" interface.
1392
Note: No signals are sent automatically; they must be sent
1395
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1397
def GetManagedObjects(self):
1398
"""This function must be overridden"""
1399
raise NotImplementedError()
1401
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1403
def InterfacesAdded(self, object_path, interfaces_and_properties):
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1407
def InterfacesRemoved(self, object_path, interfaces):
1410
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1414
def Introspect(self, object_path, connection):
1415
"""Overloading of standard D-Bus method.
1417
Override return argument name of GetManagedObjects to be
1418
"objpath_interfaces_and_properties"
1420
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1424
document = xml.dom.minidom.parseString(xmlstring)
1426
for if_tag in document.getElementsByTagName("interface"):
1427
# Fix argument name for the GetManagedObjects method
1428
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1430
for cn in if_tag.getElementsByTagName("method"):
1431
if (cn.getAttribute("name")
1432
== "GetManagedObjects"):
1433
for arg in cn.getElementsByTagName("arg"):
1434
if (arg.getAttribute("direction")
1438
"objpath_interfaces"
1440
xmlstring = document.toxml("utf-8")
1442
except (AttributeError, xml.dom.DOMException,
1443
xml.parsers.expat.ExpatError) as error:
1444
logger.error("Failed to override Introspection method",
1448
def datetime_to_dbus(dt, variant_level=0):
1449
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1451
return dbus.String("", variant_level = variant_level)
1452
return dbus.String(dt.isoformat(), variant_level=variant_level)
1455
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1456
"""A class decorator; applied to a subclass of
1457
dbus.service.Object, it will add alternate D-Bus attributes with
1458
interface names according to the "alt_interface_names" mapping.
1461
@alternate_dbus_interfaces({"org.example.Interface":
1462
"net.example.AlternateInterface"})
1463
class SampleDBusObject(dbus.service.Object):
1464
@dbus.service.method("org.example.Interface")
1465
def SampleDBusMethod():
1468
The above "SampleDBusMethod" on "SampleDBusObject" will be
1469
reachable via two interfaces: "org.example.Interface" and
1470
"net.example.AlternateInterface", the latter of which will have
1471
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1472
"true", unless "deprecate" is passed with a False value.
1474
This works for methods and signals, and also for D-Bus properties
1475
(from DBusObjectWithProperties) and interfaces (from the
1476
dbus_interface_annotations decorator).
1480
for orig_interface_name, alt_interface_name in (
1481
alt_interface_names.items()):
1483
interface_names = set()
1484
# Go though all attributes of the class
1485
for attrname, attribute in inspect.getmembers(cls):
1486
# Ignore non-D-Bus attributes, and D-Bus attributes
1487
# with the wrong interface name
1488
if (not hasattr(attribute, "_dbus_interface")
1489
or not attribute._dbus_interface.startswith(
1490
orig_interface_name)):
1492
# Create an alternate D-Bus interface name based on
1494
alt_interface = attribute._dbus_interface.replace(
1495
orig_interface_name, alt_interface_name)
1496
interface_names.add(alt_interface)
1497
# Is this a D-Bus signal?
1498
if getattr(attribute, "_dbus_is_signal", False):
1499
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
nonmethod_func = (dict(
1503
zip(attribute.func_code.co_freevars,
1504
attribute.__closure__))
1505
["func"].cell_contents)
1507
nonmethod_func = attribute
1508
# Create a new, but exactly alike, function
1509
# object, and decorate it to be a new D-Bus signal
1510
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1525
new_function = (dbus.service.signal(
1527
attribute._dbus_signature)(new_function))
1528
# Copy annotations, if any
1530
new_function._dbus_annotations = dict(
1531
attribute._dbus_annotations)
1532
except AttributeError:
1534
# Define a creator of a function to call both the
1535
# original and alternate functions, so both the
1536
# original and alternate signals gets sent when
1537
# the function is called
1538
def fixscope(func1, func2):
1539
"""This function is a scope container to pass
1540
func1 and func2 to the "call_both" function
1541
outside of its arguments"""
1543
@functools.wraps(func2)
1544
def call_both(*args, **kwargs):
1545
"""This function will emit two D-Bus
1546
signals by calling func1 and func2"""
1547
func1(*args, **kwargs)
1548
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1550
for name, attr in inspect.getmembers(func2):
1551
if name.startswith("_dbus_"):
1552
setattr(call_both, name, attr)
1555
# Create the "call_both" function and add it to
1557
attr[attrname] = fixscope(attribute, new_function)
1558
# Is this a D-Bus method?
1559
elif getattr(attribute, "_dbus_is_method", False):
1560
# Create a new, but exactly alike, function
1561
# object. Decorate it to be a new D-Bus method
1562
# with the alternate D-Bus interface name. Add it
1565
dbus.service.method(
1567
attribute._dbus_in_signature,
1568
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1574
# Copy annotations, if any
1576
attr[attrname]._dbus_annotations = dict(
1577
attribute._dbus_annotations)
1578
except AttributeError:
1580
# Is this a D-Bus property?
1581
elif getattr(attribute, "_dbus_is_property", False):
1582
# Create a new, but exactly alike, function
1583
# object, and decorate it to be a new D-Bus
1584
# property with the alternate D-Bus interface
1585
# name. Add it to the class.
1586
attr[attrname] = (dbus_service_property(
1587
alt_interface, attribute._dbus_signature,
1588
attribute._dbus_access,
1589
attribute._dbus_get_args_options
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1597
# Copy annotations, if any
1599
attr[attrname]._dbus_annotations = dict(
1600
attribute._dbus_annotations)
1601
except AttributeError:
1603
# Is this a D-Bus interface?
1604
elif getattr(attribute, "_dbus_is_interface", False):
1605
# Create a new, but exactly alike, function
1606
# object. Decorate it to be a new D-Bus interface
1607
# with the alternate D-Bus interface name. Add it
1610
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1617
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1619
for interface_name in interface_names:
1621
@dbus_interface_annotations(interface_name)
1623
return { "org.freedesktop.DBus.Deprecated":
1625
# Find an unused name
1626
for aname in (iname.format(i)
1627
for i in itertools.count()):
1628
if aname not in attr:
1632
# Replace the class with a new subclass of it with
1633
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1641
@alternate_dbus_interfaces({"se.recompile.Mandos":
1642
"se.bsnet.fukt.Mandos"})
685
if (if_tag.getAttribute(u"name")
686
== u"org.freedesktop.DBus.Properties"):
687
for cn in if_tag.getElementsByTagName(u"method"):
688
if cn.getAttribute(u"name") == u"Get":
689
for arg in cn.getElementsByTagName(u"arg"):
690
if (arg.getAttribute(u"direction")
692
arg.setAttribute(u"name", u"value")
693
elif cn.getAttribute(u"name") == u"GetAll":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
697
arg.setAttribute(u"name", u"props")
698
xmlstring = document.toxml(u"utf-8")
700
except (AttributeError, xml.dom.DOMException,
701
xml.parsers.expat.ExpatError), error:
702
logger.error(u"Failed to override Introspection method",
1643
707
class ClientDBus(Client, DBusObjectWithProperties):
1644
708
"""A Client class using D-Bus
1651
715
runtime_expansions = (Client.runtime_expansions
1652
+ ("dbus_object_path", ))
1654
_interface = "se.recompile.Mandos.Client"
716
+ (u"dbus_object_path",))
1656
718
# dbus.service.Object doesn't use super(), so we can't either.
1658
720
def __init__(self, bus = None, *args, **kwargs):
721
self._approvals_pending = 0
1660
723
Client.__init__(self, *args, **kwargs)
1661
724
# Only now, when this client is initialized, can it show up on
1663
client_object_name = str(self.name).translate(
1664
{ord("."): ord("_"),
1665
ord("-"): ord("_")})
1666
self.dbus_object_path = dbus.ObjectPath(
1667
"/clients/" + client_object_name)
726
client_object_name = unicode(self.name).translate(
727
{ord(u"."): ord(u"_"),
728
ord(u"-"): ord(u"_")})
729
self.dbus_object_path = (dbus.ObjectPath
730
(u"/clients/" + client_object_name))
1668
731
DBusObjectWithProperties.__init__(self, self.bus,
1669
732
self.dbus_object_path)
1671
def notifychangeproperty(transform_func, dbus_name,
1672
type_func=lambda x: x,
1674
invalidate_only=False,
1675
_interface=_interface):
1676
""" Modify a variable so that it's a property which announces
1677
its changes to DBus.
1679
transform_fun: Function that takes a value and a variant_level
1680
and transforms it to a D-Bus type.
1681
dbus_name: D-Bus name of the variable
1682
type_func: Function that transform the value before sending it
1683
to the D-Bus. Default: no transform
1684
variant_level: D-Bus variant level. Default: 1
1686
attrname = "_{}".format(dbus_name)
1688
def setter(self, value):
1689
if hasattr(self, "dbus_object_path"):
1690
if (not hasattr(self, attrname) or
1691
type_func(getattr(self, attrname, None))
1692
!= type_func(value)):
1694
self.PropertiesChanged(
1695
_interface, dbus.Dictionary(),
1696
dbus.Array((dbus_name, )))
1698
dbus_value = transform_func(
1700
variant_level = variant_level)
1701
self.PropertyChanged(dbus.String(dbus_name),
1703
self.PropertiesChanged(
1705
dbus.Dictionary({ dbus.String(dbus_name):
1708
setattr(self, attrname, value)
1710
return property(lambda self: getattr(self, attrname), setter)
1712
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1713
approvals_pending = notifychangeproperty(dbus.Boolean,
1716
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
last_enabled = notifychangeproperty(datetime_to_dbus,
1719
checker = notifychangeproperty(
1720
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1722
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1724
last_checker_status = notifychangeproperty(dbus.Int16,
1725
"LastCheckerStatus")
1726
last_approval_request = notifychangeproperty(
1727
datetime_to_dbus, "LastApprovalRequest")
1728
approved_by_default = notifychangeproperty(dbus.Boolean,
1729
"ApprovedByDefault")
1730
approval_delay = notifychangeproperty(
1731
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1733
approval_duration = notifychangeproperty(
1734
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1736
host = notifychangeproperty(dbus.String, "Host")
1737
timeout = notifychangeproperty(
1738
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1740
extended_timeout = notifychangeproperty(
1741
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1743
interval = notifychangeproperty(
1744
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1746
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
invalidate_only=True)
1750
del notifychangeproperty
734
def _get_approvals_pending(self):
735
return self._approvals_pending
736
def _set_approvals_pending(self, value):
737
old_value = self._approvals_pending
738
self._approvals_pending = value
740
if (hasattr(self, "dbus_object_path")
741
and bval is not bool(old_value)):
742
dbus_bool = dbus.Boolean(bval, variant_level=1)
743
self.PropertyChanged(dbus.String(u"ApprovalPending"),
746
approvals_pending = property(_get_approvals_pending,
747
_set_approvals_pending)
748
del _get_approvals_pending, _set_approvals_pending
751
def _datetime_to_dbus(dt, variant_level=0):
752
"""Convert a UTC datetime.datetime() to a D-Bus type."""
753
return dbus.String(dt.isoformat(),
754
variant_level=variant_level)
757
oldstate = getattr(self, u"enabled", False)
758
r = Client.enable(self)
759
if oldstate != self.enabled:
761
self.PropertyChanged(dbus.String(u"Enabled"),
762
dbus.Boolean(True, variant_level=1))
763
self.PropertyChanged(
764
dbus.String(u"LastEnabled"),
765
self._datetime_to_dbus(self.last_enabled,
769
def disable(self, quiet = False):
770
oldstate = getattr(self, u"enabled", False)
771
r = Client.disable(self, quiet=quiet)
772
if not quiet and oldstate != self.enabled:
774
self.PropertyChanged(dbus.String(u"Enabled"),
775
dbus.Boolean(False, variant_level=1))
1752
778
def __del__(self, *args, **kwargs):
1754
780
self.remove_from_connection()
1755
781
except LookupError:
1757
if hasattr(DBusObjectWithProperties, "__del__"):
783
if hasattr(DBusObjectWithProperties, u"__del__"):
1758
784
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
785
Client.__del__(self, *args, **kwargs)
1761
def checker_callback(self, source, condition,
1762
connection, command, *args, **kwargs):
1763
ret = Client.checker_callback(self, source, condition,
1764
connection, command, *args,
1766
exitstatus = self.last_checker_status
787
def checker_callback(self, pid, condition, command,
789
self.checker_callback_tag = None
792
self.PropertyChanged(dbus.String(u"CheckerRunning"),
793
dbus.Boolean(False, variant_level=1))
794
if os.WIFEXITED(condition):
795
exitstatus = os.WEXITSTATUS(condition)
1768
796
# Emit D-Bus signal
1769
797
self.CheckerCompleted(dbus.Int16(exitstatus),
1770
# This is specific to GNU libC
1771
dbus.Int64(exitstatus << 8),
798
dbus.Int64(condition),
1772
799
dbus.String(command))
1774
801
# Emit D-Bus signal
1775
802
self.CheckerCompleted(dbus.Int16(-1),
1777
# This is specific to GNU libC
1779
| self.last_checker_signal),
803
dbus.Int64(condition),
1780
804
dbus.String(command))
806
return Client.checker_callback(self, pid, condition, command,
809
def checked_ok(self, *args, **kwargs):
810
r = Client.checked_ok(self, *args, **kwargs)
812
self.PropertyChanged(
813
dbus.String(u"LastCheckedOK"),
814
(self._datetime_to_dbus(self.last_checked_ok,
1783
818
def start_checker(self, *args, **kwargs):
1784
old_checker_pid = getattr(self.checker, "pid", None)
819
old_checker = self.checker
820
if self.checker is not None:
821
old_checker_pid = self.checker.pid
823
old_checker_pid = None
1785
824
r = Client.start_checker(self, *args, **kwargs)
1786
825
# Only if new checker process was started
1787
826
if (self.checker is not None
1788
827
and old_checker_pid != self.checker.pid):
1789
828
# Emit D-Bus signal
1790
829
self.CheckerStarted(self.current_checker_command)
830
self.PropertyChanged(
831
dbus.String(u"CheckerRunning"),
832
dbus.Boolean(True, variant_level=1))
835
def stop_checker(self, *args, **kwargs):
836
old_checker = getattr(self, u"checker", None)
837
r = Client.stop_checker(self, *args, **kwargs)
838
if (old_checker is not None
839
and getattr(self, u"checker", None) is None):
840
self.PropertyChanged(dbus.String(u"CheckerRunning"),
841
dbus.Boolean(False, variant_level=1))
1793
844
def _reset_approved(self):
1794
self.approved = None
845
self._approved = None
1797
848
def approve(self, value=True):
1798
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1801
849
self.send_changedstate()
850
self._approved = value
851
gobject.timeout_add(self._timedelta_to_milliseconds
852
(self.approval_duration),
853
self._reset_approved)
1803
856
## D-Bus methods, signals & properties
857
_interface = u"se.bsnet.fukt.Mandos.Client"
1809
861
# CheckerCompleted - signal
1810
@dbus.service.signal(_interface, signature="nxs")
862
@dbus.service.signal(_interface, signature=u"nxs")
1811
863
def CheckerCompleted(self, exitcode, waitstatus, command):
1815
867
# CheckerStarted - signal
1816
@dbus.service.signal(_interface, signature="s")
868
@dbus.service.signal(_interface, signature=u"s")
1817
869
def CheckerStarted(self, command):
1821
873
# PropertyChanged - signal
1822
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
@dbus.service.signal(_interface, signature="sv")
874
@dbus.service.signal(_interface, signature=u"sv")
1824
875
def PropertyChanged(self, property, value):
2507
1513
fpr = request[1]
2508
1514
address = request[2]
2510
for c in self.clients.itervalues():
1516
for c in self.clients:
2511
1517
if c.fingerprint == fpr:
2515
logger.info("Client not found for fingerprint: %s, ad"
2516
"dress: %s", fpr, address)
1521
logger.warning(u"Client not found for fingerprint: %s, ad"
1522
u"dress: %s", fpr, address)
2517
1523
if self.use_dbus:
2518
1524
# Emit D-Bus signal
2519
mandos_dbus_service.ClientNotFound(fpr,
1525
mandos_dbus_service.ClientNotFound(fpr, address[0])
2521
1526
parent_pipe.send(False)
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2527
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2530
client_object = client))
1529
gobject.io_add_watch(parent_pipe.fileno(),
1530
gobject.IO_IN | gobject.IO_HUP,
1531
functools.partial(self.handle_ipc,
1532
parent_pipe = parent_pipe,
1533
client_object = client))
2531
1534
parent_pipe.send(True)
2532
# remove the old hook in favor of the new above hook on
1535
# remove the old hook in favor of the new above hook on same fileno
2535
1537
if command == 'funcall':
2536
1538
funcname = request[1]
2537
1539
args = request[2]
2538
1540
kwargs = request[3]
2540
parent_pipe.send(('data', getattr(client_object,
1542
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
2544
1544
if command == 'getattr':
2545
1545
attrname = request[1]
2546
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2548
parent_pipe.send(('function', ))
1546
if callable(client_object.__getattribute__(attrname)):
1547
parent_pipe.send(('function',))
2551
'data', client_object.__getattribute__(attrname)))
1549
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2553
1551
if command == 'setattr':
2554
1552
attrname = request[1]
2555
1553
value = request[2]
2556
1554
setattr(client_object, attrname, value)
2561
def rfc3339_duration_to_delta(duration):
2562
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2564
>>> rfc3339_duration_to_delta("P7D")
2565
datetime.timedelta(7)
2566
>>> rfc3339_duration_to_delta("PT60S")
2567
datetime.timedelta(0, 60)
2568
>>> rfc3339_duration_to_delta("PT60M")
2569
datetime.timedelta(0, 3600)
2570
>>> rfc3339_duration_to_delta("PT24H")
2571
datetime.timedelta(1)
2572
>>> rfc3339_duration_to_delta("P1W")
2573
datetime.timedelta(7)
2574
>>> rfc3339_duration_to_delta("PT5M30S")
2575
datetime.timedelta(0, 330)
2576
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
datetime.timedelta(1, 200)
2580
# Parsing an RFC 3339 duration with regular expressions is not
2581
# possible - there would have to be multiple places for the same
2582
# values, like seconds. The current code, while more esoteric, is
2583
# cleaner without depending on a parsing library. If Python had a
2584
# built-in library for parsing we would use it, but we'd like to
2585
# avoid excessive use of external libraries.
2587
# New type for defining tokens, syntax, and semantics all-in-one
2588
Token = collections.namedtuple("Token", (
2589
"regexp", # To match token; if "value" is not None, must have
2590
# a "group" containing digits
2591
"value", # datetime.timedelta or None
2592
"followers")) # Tokens valid after this token
2593
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2594
# the "duration" ABNF definition in RFC 3339, Appendix A.
2595
token_end = Token(re.compile(r"$"), None, frozenset())
2596
token_second = Token(re.compile(r"(\d+)S"),
2597
datetime.timedelta(seconds=1),
2598
frozenset((token_end, )))
2599
token_minute = Token(re.compile(r"(\d+)M"),
2600
datetime.timedelta(minutes=1),
2601
frozenset((token_second, token_end)))
2602
token_hour = Token(re.compile(r"(\d+)H"),
2603
datetime.timedelta(hours=1),
2604
frozenset((token_minute, token_end)))
2605
token_time = Token(re.compile(r"T"),
2607
frozenset((token_hour, token_minute,
2609
token_day = Token(re.compile(r"(\d+)D"),
2610
datetime.timedelta(days=1),
2611
frozenset((token_time, token_end)))
2612
token_month = Token(re.compile(r"(\d+)M"),
2613
datetime.timedelta(weeks=4),
2614
frozenset((token_day, token_end)))
2615
token_year = Token(re.compile(r"(\d+)Y"),
2616
datetime.timedelta(weeks=52),
2617
frozenset((token_month, token_end)))
2618
token_week = Token(re.compile(r"(\d+)W"),
2619
datetime.timedelta(weeks=1),
2620
frozenset((token_end, )))
2621
token_duration = Token(re.compile(r"P"), None,
2622
frozenset((token_year, token_month,
2623
token_day, token_time,
2625
# Define starting values
2626
value = datetime.timedelta() # Value so far
2628
followers = frozenset((token_duration, )) # Following valid tokens
2629
s = duration # String left to parse
2630
# Loop until end token is found
2631
while found_token is not token_end:
2632
# Search for any currently valid tokens
2633
for token in followers:
2634
match = token.regexp.match(s)
2635
if match is not None:
2637
if token.value is not None:
2638
# Value found, parse digits
2639
factor = int(match.group(1), 10)
2640
# Add to value so far
2641
value += factor * token.value
2642
# Strip token from string
2643
s = token.regexp.sub("", s, 1)
2646
# Set valid next tokens
2647
followers = found_token.followers
2650
# No currently valid tokens were found
2651
raise ValueError("Invalid RFC 3339 duration: {!r}"
2657
1559
def string_to_delta(interval):
2658
1560
"""Parse a string and return a datetime.timedelta
2660
>>> string_to_delta('7d')
1562
>>> string_to_delta(u'7d')
2661
1563
datetime.timedelta(7)
2662
>>> string_to_delta('60s')
1564
>>> string_to_delta(u'60s')
2663
1565
datetime.timedelta(0, 60)
2664
>>> string_to_delta('60m')
1566
>>> string_to_delta(u'60m')
2665
1567
datetime.timedelta(0, 3600)
2666
>>> string_to_delta('24h')
1568
>>> string_to_delta(u'24h')
2667
1569
datetime.timedelta(1)
2668
>>> string_to_delta('1w')
1570
>>> string_to_delta(u'1w')
2669
1571
datetime.timedelta(7)
2670
>>> string_to_delta('5m 30s')
1572
>>> string_to_delta(u'5m 30s')
2671
1573
datetime.timedelta(0, 330)
2675
return rfc3339_duration_to_delta(interval)
2679
1575
timevalue = datetime.timedelta(0)
2680
1576
for s in interval.split():
1578
suffix = unicode(s[-1])
2683
1579
value = int(s[:-1])
2685
1581
delta = datetime.timedelta(value)
1582
elif suffix == u"s":
2687
1583
delta = datetime.timedelta(0, value)
1584
elif suffix == u"m":
2689
1585
delta = datetime.timedelta(0, 0, 0, 0, value)
1586
elif suffix == u"h":
2691
1587
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1588
elif suffix == u"w":
2693
1589
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2695
raise ValueError("Unknown suffix {!r}".format(suffix))
2696
except IndexError as e:
2697
raise ValueError(*(e.args))
1591
raise ValueError(u"Unknown suffix %r" % suffix)
1592
except (ValueError, IndexError), e:
1593
raise ValueError(e.message)
2698
1594
timevalue += delta
2699
1595
return timevalue
1598
def if_nametoindex(interface):
1599
"""Call the C function if_nametoindex(), or equivalent
1601
Note: This function cannot accept a unicode string."""
1602
global if_nametoindex
1604
if_nametoindex = (ctypes.cdll.LoadLibrary
1605
(ctypes.util.find_library(u"c"))
1607
except (OSError, AttributeError):
1608
logger.warning(u"Doing if_nametoindex the hard way")
1609
def if_nametoindex(interface):
1610
"Get an interface index the hard way, i.e. using fcntl()"
1611
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1612
with contextlib.closing(socket.socket()) as s:
1613
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1614
struct.pack(str(u"16s16x"),
1616
interface_index = struct.unpack(str(u"I"),
1618
return interface_index
1619
return if_nametoindex(interface)
2702
1622
def daemon(nochdir = False, noclose = False):
2703
1623
"""See daemon(3). Standard BSD Unix function.
2729
1649
##################################################################
2730
1650
# Parsing of options, both command line and config file
2732
parser = argparse.ArgumentParser()
2733
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
2735
help="show version number and exit")
2736
parser.add_argument("-i", "--interface", metavar="IF",
2737
help="Bind to interface IF")
2738
parser.add_argument("-a", "--address",
2739
help="Address to listen for requests on")
2740
parser.add_argument("-p", "--port", type=int,
2741
help="Port number to receive requests on")
2742
parser.add_argument("--check", action="store_true",
2743
help="Run self-test")
2744
parser.add_argument("--debug", action="store_true",
2745
help="Debug mode; run in foreground and log"
2746
" to terminal", default=None)
2747
parser.add_argument("--debuglevel", metavar="LEVEL",
2748
help="Debug level for stdout output")
2749
parser.add_argument("--priority", help="GnuTLS"
2750
" priority string (see GnuTLS documentation)")
2751
parser.add_argument("--servicename",
2752
metavar="NAME", help="Zeroconf service name")
2753
parser.add_argument("--configdir",
2754
default="/etc/mandos", metavar="DIR",
2755
help="Directory to search for configuration"
2757
parser.add_argument("--no-dbus", action="store_false",
2758
dest="use_dbus", help="Do not provide D-Bus"
2759
" system bus interface", default=None)
2760
parser.add_argument("--no-ipv6", action="store_false",
2761
dest="use_ipv6", help="Do not use IPv6",
2763
parser.add_argument("--no-restore", action="store_false",
2764
dest="restore", help="Do not restore stored"
2765
" state", default=None)
2766
parser.add_argument("--socket", type=int,
2767
help="Specify a file descriptor to a network"
2768
" socket to use instead of creating one")
2769
parser.add_argument("--statedir", metavar="DIR",
2770
help="Directory to save/restore state in")
2771
parser.add_argument("--foreground", action="store_true",
2772
help="Run in foreground", default=None)
2773
parser.add_argument("--no-zeroconf", action="store_false",
2774
dest="zeroconf", help="Do not use Zeroconf",
2777
options = parser.parse_args()
1652
parser = optparse.OptionParser(version = "%%prog %s" % version)
1653
parser.add_option("-i", u"--interface", type=u"string",
1654
metavar="IF", help=u"Bind to interface IF")
1655
parser.add_option("-a", u"--address", type=u"string",
1656
help=u"Address to listen for requests on")
1657
parser.add_option("-p", u"--port", type=u"int",
1658
help=u"Port number to receive requests on")
1659
parser.add_option("--check", action=u"store_true",
1660
help=u"Run self-test")
1661
parser.add_option("--debug", action=u"store_true",
1662
help=u"Debug mode; run in foreground and log to"
1664
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1665
help=u"Debug level for stdout output")
1666
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1667
u" priority string (see GnuTLS documentation)")
1668
parser.add_option("--servicename", type=u"string",
1669
metavar=u"NAME", help=u"Zeroconf service name")
1670
parser.add_option("--configdir", type=u"string",
1671
default=u"/etc/mandos", metavar=u"DIR",
1672
help=u"Directory to search for configuration"
1674
parser.add_option("--no-dbus", action=u"store_false",
1675
dest=u"use_dbus", help=u"Do not provide D-Bus"
1676
u" system bus interface")
1677
parser.add_option("--no-ipv6", action=u"store_false",
1678
dest=u"use_ipv6", help=u"Do not use IPv6")
1679
options = parser.parse_args()[0]
2779
1681
if options.check:
2781
fail_count, test_count = doctest.testmod()
2782
sys.exit(os.EX_OK if fail_count == 0 else 1)
2784
1686
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
1687
server_defaults = { u"interface": u"",
1692
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1693
u"servicename": u"Mandos",
1694
u"use_dbus": u"True",
1695
u"use_ipv6": u"True",
2803
1699
# Parse config file for server-global settings
2804
1700
server_config = configparser.SafeConfigParser(server_defaults)
2805
1701
del server_defaults
2806
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1702
server_config.read(os.path.join(options.configdir,
2807
1704
# Convert the SafeConfigParser object to a dict
2808
1705
server_settings = server_config.defaults()
2809
1706
# Use the appropriate methods on the non-string config options
2810
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2811
server_settings[option] = server_config.getboolean("DEFAULT",
1707
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1708
server_settings[option] = server_config.getboolean(u"DEFAULT",
2813
1710
if server_settings["port"]:
2814
server_settings["port"] = server_config.getint("DEFAULT",
2816
if server_settings["socket"]:
2817
server_settings["socket"] = server_config.getint("DEFAULT",
2819
# Later, stdin will, and stdout and stderr might, be dup'ed
2820
# over with an opened os.devnull. But we don't want this to
2821
# happen with a supplied network socket.
2822
if 0 <= server_settings["socket"] <= 2:
2823
server_settings["socket"] = os.dup(server_settings
1711
server_settings["port"] = server_config.getint(u"DEFAULT",
2825
1713
del server_config
2827
1715
# Override the settings from the config file with command line
2828
1716
# options, if set.
2829
for option in ("interface", "address", "port", "debug",
2830
"priority", "servicename", "configdir", "use_dbus",
2831
"use_ipv6", "debuglevel", "restore", "statedir",
2832
"socket", "foreground", "zeroconf"):
1717
for option in (u"interface", u"address", u"port", u"debug",
1718
u"priority", u"servicename", u"configdir",
1719
u"use_dbus", u"use_ipv6", u"debuglevel"):
2833
1720
value = getattr(options, option)
2834
1721
if value is not None:
2835
1722
server_settings[option] = value
2837
1724
# Force all strings to be unicode
2838
1725
for option in server_settings.keys():
2839
if isinstance(server_settings[option], bytes):
2840
server_settings[option] = (server_settings[option]
2842
# Force all boolean options to be boolean
2843
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2844
"foreground", "zeroconf"):
2845
server_settings[option] = bool(server_settings[option])
2846
# Debug implies foreground
2847
if server_settings["debug"]:
2848
server_settings["foreground"] = True
1726
if type(server_settings[option]) is str:
1727
server_settings[option] = unicode(server_settings[option])
2849
1728
# Now we have our good server settings in "server_settings"
2851
1730
##################################################################
2853
if (not server_settings["zeroconf"]
2854
and not (server_settings["port"]
2855
or server_settings["socket"] != "")):
2856
parser.error("Needs port or socket to work without Zeroconf")
2858
1732
# For convenience
2859
debug = server_settings["debug"]
2860
debuglevel = server_settings["debuglevel"]
2861
use_dbus = server_settings["use_dbus"]
2862
use_ipv6 = server_settings["use_ipv6"]
2863
stored_state_path = os.path.join(server_settings["statedir"],
2865
foreground = server_settings["foreground"]
2866
zeroconf = server_settings["zeroconf"]
2869
initlogger(debug, logging.DEBUG)
2874
level = getattr(logging, debuglevel.upper())
2875
initlogger(debug, level)
2877
if server_settings["servicename"] != "Mandos":
2878
syslogger.setFormatter(
2879
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
' %(levelname)s: %(message)s'.format(
2881
server_settings["servicename"])))
1733
debug = server_settings[u"debug"]
1734
debuglevel = server_settings[u"debuglevel"]
1735
use_dbus = server_settings[u"use_dbus"]
1736
use_ipv6 = server_settings[u"use_ipv6"]
1738
if server_settings[u"servicename"] != u"Mandos":
1739
syslogger.setFormatter(logging.Formatter
1740
(u'Mandos (%s) [%%(process)d]:'
1741
u' %%(levelname)s: %%(message)s'
1742
% server_settings[u"servicename"]))
2883
1744
# Parse config file with clients
2884
client_config = configparser.SafeConfigParser(Client
2886
client_config.read(os.path.join(server_settings["configdir"],
1745
client_defaults = { u"timeout": u"1h",
1747
u"checker": u"fping -q -- %%(host)s",
1749
u"approval_delay": u"0s",
1750
u"approval_duration": u"1s",
1752
client_config = configparser.SafeConfigParser(client_defaults)
1753
client_config.read(os.path.join(server_settings[u"configdir"],
2889
1756
global mandos_dbus_service
2890
1757
mandos_dbus_service = None
2893
if server_settings["socket"] != "":
2894
socketfd = server_settings["socket"]
2895
tcp_server = MandosServer(
2896
(server_settings["address"], server_settings["port"]),
2898
interface=(server_settings["interface"] or None),
2900
gnutls_priority=server_settings["priority"],
2904
pidfilename = "/run/mandos.pid"
2905
if not os.path.isdir("/run/."):
2906
pidfilename = "/var/run/mandos.pid"
1759
tcp_server = MandosServer((server_settings[u"address"],
1760
server_settings[u"port"]),
1762
interface=(server_settings[u"interface"]
1766
server_settings[u"priority"],
1769
pidfilename = u"/var/run/mandos.pid"
2909
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2910
except IOError as e:
2911
logger.error("Could not open file %r", pidfilename,
1771
pidfile = open(pidfilename, u"w")
1773
logger.error(u"Could not open file %r", pidfilename)
2914
for name in ("_mandos", "mandos", "nobody"):
1776
uid = pwd.getpwnam(u"_mandos").pw_uid
1777
gid = pwd.getpwnam(u"_mandos").pw_gid
2916
uid = pwd.getpwnam(name).pw_uid
2917
gid = pwd.getpwnam(name).pw_gid
1780
uid = pwd.getpwnam(u"mandos").pw_uid
1781
gid = pwd.getpwnam(u"mandos").pw_gid
2919
1782
except KeyError:
1784
uid = pwd.getpwnam(u"nobody").pw_uid
1785
gid = pwd.getpwnam(u"nobody").pw_gid
2927
except OSError as error:
2928
if error.errno != errno.EPERM:
1792
except OSError, error:
1793
if error[0] != errno.EPERM:
1796
if not debug and not debuglevel:
1797
syslogger.setLevel(logging.WARNING)
1798
console.setLevel(logging.WARNING)
1800
level = getattr(logging, debuglevel.upper())
1801
syslogger.setLevel(level)
1802
console.setLevel(level)
2932
1805
# Enable all possible GnuTLS debugging
2934
1807
# "Use a log level over 10 to enable all debugging options."
2935
1808
# - GnuTLS manual
2936
gnutls.global_set_log_level(11)
1809
gnutls.library.functions.gnutls_global_set_log_level(11)
1811
@gnutls.library.types.gnutls_log_func
2939
1812
def debug_gnutls(level, string):
2940
logger.debug("GnuTLS: %s", string[:-1])
1813
logger.debug(u"GnuTLS: %s", string[:-1])
2942
gnutls.global_set_log_function(debug_gnutls)
1815
(gnutls.library.functions
1816
.gnutls_global_set_log_function(debug_gnutls))
2944
1818
# Redirect stdin so all checkers get /dev/null
2945
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1819
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2946
1820
os.dup2(null, sys.stdin.fileno())
2950
# Need to fork before connecting to D-Bus
2952
# Close all input and output, do double fork, etc.
2955
# multiprocessing will use threads, so before we use gobject we
2956
# need to inform gobject that threads will be used.
2957
gobject.threads_init()
1824
# No console logging
1825
logger.removeHandler(console)
2959
1828
global main_loop
2960
1829
# From the Avahi example code
2961
DBusGMainLoop(set_as_default=True)
1830
DBusGMainLoop(set_as_default=True )
2962
1831
main_loop = gobject.MainLoop()
2963
1832
bus = dbus.SystemBus()
2964
1833
# End of Avahi example code
2967
bus_name = dbus.service.BusName("se.recompile.Mandos",
2970
old_bus_name = dbus.service.BusName(
2971
"se.bsnet.fukt.Mandos", bus,
2973
except dbus.exceptions.DBusException as e:
2974
logger.error("Disabling D-Bus:", exc_info=e)
1836
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1837
bus, do_not_queue=True)
1838
except dbus.exceptions.NameExistsException, e:
1839
logger.error(unicode(e) + u", disabling D-Bus")
2975
1840
use_dbus = False
2976
server_settings["use_dbus"] = False
1841
server_settings[u"use_dbus"] = False
2977
1842
tcp_server.use_dbus = False
2979
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2985
if server_settings["interface"]:
2986
service.interface = if_nametoindex(
2987
server_settings["interface"].encode("utf-8"))
1843
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1844
service = AvahiService(name = server_settings[u"servicename"],
1845
servicetype = u"_mandos._tcp",
1846
protocol = protocol, bus = bus)
1847
if server_settings["interface"]:
1848
service.interface = (if_nametoindex
1849
(str(server_settings[u"interface"])))
1852
# Close all input and output, do double fork, etc.
2989
1855
global multiprocessing_manager
2990
1856
multiprocessing_manager = multiprocessing.Manager()
2992
1858
client_class = Client
2994
1860
client_class = functools.partial(ClientDBus, bus = bus)
2996
client_settings = Client.config_parser(client_config)
2997
old_client_settings = {}
3000
# This is used to redirect stdout and stderr for checker processes
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3003
# Only used if server is running in foreground but not in debug
3005
if debug or not foreground:
3008
# Get client data and settings from last running state.
3009
if server_settings["restore"]:
3011
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3014
os.remove(stored_state_path)
3015
except IOError as e:
3016
if e.errno == errno.ENOENT:
3017
logger.warning("Could not load persistent state:"
3018
" {}".format(os.strerror(e.errno)))
3020
logger.critical("Could not load persistent state:",
3023
except EOFError as e:
3024
logger.warning("Could not load persistent state: "
3028
with PGPEngine() as pgp:
3029
for client_name, client in clients_data.items():
3030
# Skip removed clients
3031
if client_name not in client_settings:
3034
# Decide which value to use after restoring saved state.
3035
# We have three different values: Old config file,
3036
# new config file, and saved state.
3037
# New config value takes precedence if it differs from old
3038
# config value, otherwise use saved state.
3039
for name, value in client_settings[client_name].items():
3041
# For each value in new config, check if it
3042
# differs from the old config value (Except for
3043
# the "secret" attribute)
3044
if (name != "secret"
3046
old_client_settings[client_name][name])):
3047
client[name] = value
3051
# Clients who has passed its expire date can still be
3052
# enabled if its last checker was successful. A Client
3053
# whose checker succeeded before we stored its state is
3054
# assumed to have successfully run all checkers during
3056
if client["enabled"]:
3057
if datetime.datetime.utcnow() >= client["expires"]:
3058
if not client["last_checked_ok"]:
3060
"disabling client {} - Client never "
3061
"performed a successful checker".format(
3063
client["enabled"] = False
3064
elif client["last_checker_status"] != 0:
3066
"disabling client {} - Client last"
3067
" checker failed with error code"
3070
client["last_checker_status"]))
3071
client["enabled"] = False
3073
client["expires"] = (
3074
datetime.datetime.utcnow()
3075
+ client["timeout"])
3076
logger.debug("Last checker succeeded,"
3077
" keeping {} enabled".format(
1861
def client_config_items(config, section):
1862
special_settings = {
1863
"approved_by_default":
1864
lambda: config.getboolean(section,
1865
"approved_by_default"),
1867
for name, value in config.items(section):
3080
client["secret"] = pgp.decrypt(
3081
client["encrypted_secret"],
3082
client_settings[client_name]["secret"])
3084
# If decryption fails, we use secret from new settings
3085
logger.debug("Failed to decrypt {} old secret".format(
3087
client["secret"] = (client_settings[client_name]
3090
# Add/remove clients based on new changes made to config
3091
for client_name in (set(old_client_settings)
3092
- set(client_settings)):
3093
del clients_data[client_name]
3094
for client_name in (set(client_settings)
3095
- set(old_client_settings)):
3096
clients_data[client_name] = client_settings[client_name]
3098
# Create all client objects
3099
for client_name, client in clients_data.items():
3100
tcp_server.clients[client_name] = client_class(
3103
server_settings = server_settings)
1869
yield (name, special_settings[name]())
1873
tcp_server.clients.update(set(
1874
client_class(name = section,
1875
config= dict(client_config_items(
1876
client_config, section)))
1877
for section in client_config.sections()))
3105
1878
if not tcp_server.clients:
3106
logger.warning("No clients defined")
3109
if pidfile is not None:
3113
print(pid, file=pidfile)
3115
logger.error("Could not write to file %r with PID %d",
1879
logger.warning(u"No clients defined")
1885
pidfile.write(str(pid) + "\n")
1888
logger.error(u"Could not write to file %r with PID %d",
1891
# "pidfile" was never created
3118
1893
del pidfilename
1895
signal.signal(signal.SIGINT, signal.SIG_IGN)
3120
1897
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
1898
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3125
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3127
class MandosDBusService(DBusObjectWithObjectManager):
1901
class MandosDBusService(dbus.service.Object):
3128
1902
"""A D-Bus proxy object"""
3130
1903
def __init__(self):
3131
dbus.service.Object.__init__(self, bus, "/")
3133
_interface = "se.recompile.Mandos"
3135
@dbus.service.signal(_interface, signature="o")
1904
dbus.service.Object.__init__(self, bus, u"/")
1905
_interface = u"se.bsnet.fukt.Mandos"
1907
@dbus.service.signal(_interface, signature=u"o")
3136
1908
def ClientAdded(self, objpath):
3140
@dbus.service.signal(_interface, signature="ss")
1912
@dbus.service.signal(_interface, signature=u"ss")
3141
1913
def ClientNotFound(self, fingerprint, address):
3145
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3147
@dbus.service.signal(_interface, signature="os")
1917
@dbus.service.signal(_interface, signature=u"os")
3148
1918
def ClientRemoved(self, objpath, name):
3152
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3154
@dbus.service.method(_interface, out_signature="ao")
1922
@dbus.service.method(_interface, out_signature=u"ao")
3155
1923
def GetAllClients(self):
3157
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
1925
return dbus.Array(c.dbus_object_path
1926
for c in tcp_server.clients)
3160
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3162
1928
@dbus.service.method(_interface,
3163
out_signature="a{oa{sv}}")
1929
out_signature=u"a{oa{sv}}")
3164
1930
def GetAllClientsWithProperties(self):
3166
1932
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3168
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
1933
((c.dbus_object_path, c.GetAll(u""))
1934
for c in tcp_server.clients),
1935
signature=u"oa{sv}")
3172
@dbus.service.method(_interface, in_signature="o")
1937
@dbus.service.method(_interface, in_signature=u"o")
3173
1938
def RemoveClient(self, object_path):
3175
for c in tcp_server.clients.itervalues():
1940
for c in tcp_server.clients:
3176
1941
if c.dbus_object_path == object_path:
3177
del tcp_server.clients[c.name]
1942
tcp_server.clients.remove(c)
3178
1943
c.remove_from_connection()
3179
# Don't signal the disabling
1944
# Don't signal anything except ClientRemoved
3180
1945
c.disable(quiet=True)
3181
# Emit D-Bus signal for removal
3182
self.client_removed_signal(c)
1947
self.ClientRemoved(object_path, c.name)
3184
1949
raise KeyError(object_path)
3188
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3190
def GetManagedObjects(self):
3192
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3195
{ interface: client.GetAll(interface)
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3200
def client_added_signal(self, client):
3201
"""Send the new standard signal and the old signal"""
3203
# New standard signal
3204
self.InterfacesAdded(
3205
client.dbus_object_path,
3207
{ interface: client.GetAll(interface)
3209
client._get_all_interface_names()}))
3211
self.ClientAdded(client.dbus_object_path)
3213
def client_removed_signal(self, client):
3214
"""Send the new standard signal and the old signal"""
3216
# New standard signal
3217
self.InterfacesRemoved(
3218
client.dbus_object_path,
3219
client._get_all_interface_names())
3221
self.ClientRemoved(client.dbus_object_path,
3224
1953
mandos_dbus_service = MandosDBusService()
3227
1956
"Cleanup function; run on exit"
3231
multiprocessing.active_children()
3233
if not (tcp_server.clients or client_settings):
3236
# Store client before exiting. Secrets are encrypted with key
3237
# based on what config file has. If config file is
3238
# removed/edited, old secret will thus be unrecovable.
3240
with PGPEngine() as pgp:
3241
for client in tcp_server.clients.itervalues():
3242
key = client_settings[client.name]["secret"]
3243
client.encrypted_secret = pgp.encrypt(client.secret,
3247
# A list of attributes that can not be pickled
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3251
for name, typ in inspect.getmembers(dbus.service
3255
client_dict["encrypted_secret"] = (client
3257
for attr in client.client_structure:
3258
if attr not in exclude:
3259
client_dict[attr] = getattr(client, attr)
3261
clients[client.name] = client_dict
3262
del client_settings[client.name]["secret"]
3265
with tempfile.NamedTemporaryFile(
3269
dir=os.path.dirname(stored_state_path),
3270
delete=False) as stored_state:
3271
pickle.dump((clients, client_settings), stored_state)
3272
tempname = stored_state.name
3273
os.rename(tempname, stored_state_path)
3274
except (IOError, OSError) as e:
3280
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3281
logger.warning("Could not save persistent state: {}"
3282
.format(os.strerror(e.errno)))
3284
logger.warning("Could not save persistent state:",
3288
# Delete all clients, and settings from config
3289
1959
while tcp_server.clients:
3290
name, client = tcp_server.clients.popitem()
1960
client = tcp_server.clients.pop()
3292
1962
client.remove_from_connection()
3293
# Don't signal the disabling
1963
client.disable_hook = None
1964
# Don't signal anything except ClientRemoved
3294
1965
client.disable(quiet=True)
3295
# Emit D-Bus signal for removal
3297
mandos_dbus_service.client_removed_signal(client)
3298
client_settings.clear()
1968
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
3300
1971
atexit.register(cleanup)
3302
for client in tcp_server.clients.itervalues():
1973
for client in tcp_server.clients:
3304
# Emit D-Bus signal for adding
3305
mandos_dbus_service.client_added_signal(client)
3306
# Need to initiate checking of clients
3308
client.init_checker()
1976
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3310
1979
tcp_server.enable()
3311
1980
tcp_server.server_activate()
3313
1982
# Find out what port we got
3315
service.port = tcp_server.socket.getsockname()[1]
1983
service.port = tcp_server.socket.getsockname()[1]
3317
logger.info("Now listening on address %r, port %d,"
3318
" flowinfo %d, scope_id %d",
3319
*tcp_server.socket.getsockname())
1985
logger.info(u"Now listening on address %r, port %d,"
1986
" flowinfo %d, scope_id %d"
1987
% tcp_server.socket.getsockname())
3321
logger.info("Now listening on address %r, port %d",
3322
*tcp_server.socket.getsockname())
1989
logger.info(u"Now listening on address %r, port %d"
1990
% tcp_server.socket.getsockname())
3324
1992
#service.interface = tcp_server.socket.getsockname()[3]
3328
# From the Avahi example code
3331
except dbus.exceptions.DBusException as error:
3332
logger.critical("D-Bus Exception", exc_info=error)
3335
# End of Avahi example code
1995
# From the Avahi example code
1998
except dbus.exceptions.DBusException, error:
1999
logger.critical(u"DBusException: %s", error)
2002
# End of Avahi example code
3337
2004
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
2005
lambda *args, **kwargs:
3339
2006
(tcp_server.handle_request
3340
2007
(*args[2:], **kwargs) or True))
3342
logger.debug("Starting main loop")
2009
logger.debug(u"Starting main loop")
3343
2010
main_loop.run()
3344
except AvahiError as error:
3345
logger.critical("Avahi Error", exc_info=error)
2011
except AvahiError, error:
2012
logger.critical(u"AvahiError: %s", error)
3348
2015
except KeyboardInterrupt:
3350
print("", file=sys.stderr)
3351
logger.debug("Server received KeyboardInterrupt")
3352
logger.debug("Server exiting")
2018
logger.debug(u"Server received KeyboardInterrupt")
2019
logger.debug(u"Server exiting")
3353
2020
# Must run before the D-Bus bus name gets deregistered
3357
2023
if __name__ == '__main__':