To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 466
- compare with another revision
- download diff
- download tarball
- view history from revision 466
- Committer: Teddy Hogeborn
- Date: 2011-02-27 17:26:35 UTC
- Revision ID: teddy@fukt.bsnet.se-20110227172635-hw1sire7k3vuo1co
Update copyright year to "2011" wherever appropriate.
- files removed:
- debian/source/local-options
- files modified:
- DBUS-API
added
removed
mandos
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
36
36
37
37
import SocketServer as socketserver
38
38
import socket
39
import argparse
39
import optparse
40
40
import datetime
41
41
import errno
42
42
import gnutls.crypto
62
62
import functools
63
63
import cPickle as pickle
64
64
import multiprocessing
65
import types
66
import hashlib
67
65
68
66
import dbus
69
67
import dbus.service
74
72
import ctypes.util
75
73
import xml.dom.minidom
76
74
import inspect
77
import Crypto.Cipher.AES
78
75
79
76
try:
80
77
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
82
SO_BINDTODEVICE = None
86
83
87
84
88
version = "1.4.1"
89
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
85
version = "1.2.3"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
93
89
syslogger = (logging.handlers.SysLogHandler
94
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
91
address = str("/dev/log")))
99
95
logger.addHandler(syslogger)
100
96
101
97
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
104
99
' %(levelname)s:'
105
100
' %(message)s'))
106
101
logger.addHandler(console)
107
102
108
109
103
class AvahiError(Exception):
110
104
def __init__(self, value, *args, **kwargs):
111
105
self.value = value
157
151
self.group = None # our entry group
158
152
self.server = None
159
153
self.bus = bus
160
self.entry_group_state_changed_match = None
161
154
def rename(self):
162
155
"""Derived from the Avahi example code"""
163
156
if self.rename_count >= self.max_renames:
165
158
" after %i retries, exiting.",
166
159
self.rename_count)
167
160
raise AvahiServiceError("Too many renames")
168
self.name = unicode(self.server
169
.GetAlternativeServiceName(self.name))
161
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
170
162
logger.info("Changing Zeroconf service name to %r ...",
171
163
self.name)
164
syslogger.setFormatter(logging.Formatter
165
('Mandos (%s) [%%(process)d]:'
166
' %%(levelname)s: %%(message)s'
167
% self.name))
172
168
self.remove()
173
169
try:
174
170
self.add()
175
except dbus.exceptions.DBusException as error:
171
except dbus.exceptions.DBusException, error:
176
172
logger.critical("DBusException: %s", error)
177
173
self.cleanup()
178
174
os._exit(1)
179
175
self.rename_count += 1
180
176
def remove(self):
181
177
"""Derived from the Avahi example code"""
182
if self.entry_group_state_changed_match is not None:
183
self.entry_group_state_changed_match.remove()
184
self.entry_group_state_changed_match = None
185
178
if self.group is not None:
186
179
self.group.Reset()
187
180
def add(self):
188
181
"""Derived from the Avahi example code"""
189
self.remove()
190
182
if self.group is None:
191
183
self.group = dbus.Interface(
192
184
self.bus.get_object(avahi.DBUS_NAME,
193
185
self.server.EntryGroupNew()),
194
186
avahi.DBUS_INTERFACE_ENTRY_GROUP)
195
self.entry_group_state_changed_match = (
196
self.group.connect_to_signal(
197
'StateChanged', self.entry_group_state_changed))
187
self.group.connect_to_signal('StateChanged',
188
self
189
.entry_group_state_changed)
198
190
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
199
191
self.name, self.type)
200
192
self.group.AddService(
223
215
def cleanup(self):
224
216
"""Derived from the Avahi example code"""
225
217
if self.group is not None:
226
try:
227
self.group.Free()
228
except (dbus.exceptions.UnknownMethodException,
229
dbus.exceptions.DBusException) as e:
230
pass
218
self.group.Free()
231
219
self.group = None
232
self.remove()
233
def server_state_changed(self, state, error=None):
220
def server_state_changed(self, state):
234
221
"""Derived from the Avahi example code"""
235
222
logger.debug("Avahi server state change: %i", state)
236
bad_states = { avahi.SERVER_INVALID:
237
"Zeroconf server invalid",
238
avahi.SERVER_REGISTERING: None,
239
avahi.SERVER_COLLISION:
240
"Zeroconf server name collision",
241
avahi.SERVER_FAILURE:
242
"Zeroconf server failure" }
243
if state in bad_states:
244
if bad_states[state] is not None:
245
if error is None:
246
logger.error(bad_states[state])
247
else:
248
logger.error(bad_states[state] + ": %r", error)
249
self.cleanup()
223
if state == avahi.SERVER_COLLISION:
224
logger.error("Zeroconf server name collision")
225
self.remove()
250
226
elif state == avahi.SERVER_RUNNING:
251
227
self.add()
252
else:
253
if error is None:
254
logger.debug("Unknown state: %r", state)
255
else:
256
logger.debug("Unknown state: %r: %r", state, error)
257
228
def activate(self):
258
229
"""Derived from the Avahi example code"""
259
230
if self.server is None:
260
231
self.server = dbus.Interface(
261
232
self.bus.get_object(avahi.DBUS_NAME,
262
avahi.DBUS_PATH_SERVER,
263
follow_name_owner_changes=True),
233
avahi.DBUS_PATH_SERVER),
264
234
avahi.DBUS_INTERFACE_SERVER)
265
235
self.server.connect_to_signal("StateChanged",
266
236
self.server_state_changed)
267
237
self.server_state_changed(self.server.GetState())
268
238
269
class AvahiServiceToSyslog(AvahiService):
270
def rename(self):
271
"""Add the new name to the syslog messages"""
272
ret = AvahiService.rename(self)
273
syslogger.setFormatter(logging.Formatter
274
('Mandos (%s) [%%(process)d]:'
275
' %%(levelname)s: %%(message)s'
276
% self.name))
277
return ret
278
239
279
def _timedelta_to_milliseconds(td):
280
"Convert a datetime.timedelta() to milliseconds"
281
return ((td.days * 24 * 60 * 60 * 1000)
282
+ (td.seconds * 1000)
283
+ (td.microseconds // 1000))
284
285
240
class Client(object):
286
241
"""A representation of a client host served by this server.
287
242
299
254
instance %(name)s can be used in the command.
300
255
checker_initiator_tag: a gobject event source tag, or None
301
256
created: datetime.datetime(); (UTC) object creation
302
client_structure: Object describing what attributes a client has
303
and is used for storing the client at exit
304
257
current_checker_command: string; current running checker_command
258
disable_hook: If set, called by disable() as disable_hook(self)
305
259
disable_initiator_tag: a gobject event source tag, or None
306
260
enabled: bool()
307
261
fingerprint: string (40 or 32 hexadecimal digits); used to
310
264
interval: datetime.timedelta(); How often to start a new checker
311
265
last_approval_request: datetime.datetime(); (UTC) or None
312
266
last_checked_ok: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit
314
status of last checker. -1 reflect crashed
315
checker, or None.
316
267
last_enabled: datetime.datetime(); (UTC)
317
268
name: string; from the config file, used in log messages and
318
269
D-Bus identifiers
319
270
secret: bytestring; sent verbatim (over TLS) to client
320
271
timeout: datetime.timedelta(); How long from last_checked_ok
321
272
until this client is disabled
322
extended_timeout: extra long timeout when password has been sent
323
273
runtime_expansions: Allowed attributes for runtime expansion.
324
expires: datetime.datetime(); time (UTC) when a client will be
325
disabled, or None
326
274
"""
327
275
328
276
runtime_expansions = ("approval_delay", "approval_duration",
330
278
"host", "interval", "last_checked_ok",
331
279
"last_enabled", "name", "timeout")
332
280
281
@staticmethod
282
def _timedelta_to_milliseconds(td):
283
"Convert a datetime.timedelta() to milliseconds"
284
return ((td.days * 24 * 60 * 60 * 1000)
285
+ (td.seconds * 1000)
286
+ (td.microseconds // 1000))
287
333
288
def timeout_milliseconds(self):
334
289
"Return the 'timeout' attribute in milliseconds"
335
return _timedelta_to_milliseconds(self.timeout)
336
337
def extended_timeout_milliseconds(self):
338
"Return the 'extended_timeout' attribute in milliseconds"
339
return _timedelta_to_milliseconds(self.extended_timeout)
290
return self._timedelta_to_milliseconds(self.timeout)
340
291
341
292
def interval_milliseconds(self):
342
293
"Return the 'interval' attribute in milliseconds"
343
return _timedelta_to_milliseconds(self.interval)
344
294
return self._timedelta_to_milliseconds(self.interval)
295
345
296
def approval_delay_milliseconds(self):
346
return _timedelta_to_milliseconds(self.approval_delay)
297
return self._timedelta_to_milliseconds(self.approval_delay)
347
298
348
def __init__(self, name = None, config=None):
299
def __init__(self, name = None, disable_hook=None, config=None):
349
300
"""Note: the 'checker' key in 'config' sets the
350
301
'checker_command' attribute and *not* the 'checker'
351
302
attribute."""
371
322
% self.name)
372
323
self.host = config.get("host", "")
373
324
self.created = datetime.datetime.utcnow()
374
self.enabled = True
325
self.enabled = False
375
326
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
327
self.last_enabled = None
377
328
self.last_checked_ok = None
378
self.last_checker_status = None
379
329
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
330
self.interval = string_to_delta(config["interval"])
331
self.disable_hook = disable_hook
383
332
self.checker = None
384
333
self.checker_initiator_tag = None
385
334
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
387
335
self.checker_callback_tag = None
388
336
self.checker_command = config["checker"]
389
337
self.current_checker_command = None
338
self.last_connect = None
390
339
self._approved = None
391
340
self.approved_by_default = config.get("approved_by_default",
392
341
True)
395
344
config["approval_delay"])
396
345
self.approval_duration = string_to_delta(
397
346
config["approval_duration"])
398
self.changedstate = (multiprocessing_manager
399
.Condition(multiprocessing_manager
400
.Lock()))
401
self.client_structure = [attr for attr
402
in self.__dict__.iterkeys()
403
if not attr.startswith("_")]
404
self.client_structure.append("client_structure")
405
406
407
for name, t in inspect.getmembers(type(self),
408
lambda obj:
409
isinstance(obj,
410
property)):
411
if not name.startswith("_"):
412
self.client_structure.append(name)
347
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
413
348
414
# Send notice to process children that client state has changed
415
349
def send_changedstate(self):
416
with self.changedstate:
417
self.changedstate.notify_all()
418
350
self.changedstate.acquire()
351
self.changedstate.notify_all()
352
self.changedstate.release()
353
419
354
def enable(self):
420
355
"""Start this client's checker and timeout hooks"""
421
356
if getattr(self, "enabled", False):
422
357
# Already enabled
423
358
return
424
359
self.send_changedstate()
425
self.expires = datetime.datetime.utcnow() + self.timeout
360
self.last_enabled = datetime.datetime.utcnow()
361
# Schedule a new checker to be started an 'interval' from now,
362
# and every interval from then on.
363
self.checker_initiator_tag = (gobject.timeout_add
364
(self.interval_milliseconds(),
365
self.start_checker))
366
# Schedule a disable() when 'timeout' has passed
367
self.disable_initiator_tag = (gobject.timeout_add
368
(self.timeout_milliseconds(),
369
self.disable))
426
370
self.enabled = True
427
self.last_enabled = datetime.datetime.utcnow()
428
self.init_checker()
371
# Also start a new checker *right now*.
372
self.start_checker()
429
373
430
374
def disable(self, quiet=True):
431
375
"""Disable this client."""
438
382
if getattr(self, "disable_initiator_tag", False):
439
383
gobject.source_remove(self.disable_initiator_tag)
440
384
self.disable_initiator_tag = None
441
self.expires = None
442
385
if getattr(self, "checker_initiator_tag", False):
443
386
gobject.source_remove(self.checker_initiator_tag)
444
387
self.checker_initiator_tag = None
445
388
self.stop_checker()
389
if self.disable_hook:
390
self.disable_hook(self)
446
391
self.enabled = False
447
392
# Do not run this again if called by a gobject.timeout_add
448
393
return False
449
394
450
395
def __del__(self):
396
self.disable_hook = None
451
397
self.disable()
452
453
def init_checker(self):
454
# Schedule a new checker to be started an 'interval' from now,
455
# and every interval from then on.
456
self.checker_initiator_tag = (gobject.timeout_add
457
(self.interval_milliseconds(),
458
self.start_checker))
459
# Schedule a disable() when 'timeout' has passed
460
self.disable_initiator_tag = (gobject.timeout_add
461
(self.timeout_milliseconds(),
462
self.disable))
463
# Also start a new checker *right now*.
464
self.start_checker()
465
466
398
467
399
def checker_callback(self, pid, condition, command):
468
400
"""The checker has completed, so take appropriate actions."""
469
401
self.checker_callback_tag = None
470
402
self.checker = None
471
403
if os.WIFEXITED(condition):
472
self.last_checker_status = os.WEXITSTATUS(condition)
473
if self.last_checker_status == 0:
404
exitstatus = os.WEXITSTATUS(condition)
405
if exitstatus == 0:
474
406
logger.info("Checker for %(name)s succeeded",
475
407
vars(self))
476
408
self.checked_ok()
478
410
logger.info("Checker for %(name)s failed",
479
411
vars(self))
480
412
else:
481
self.last_checker_status = -1
482
413
logger.warning("Checker for %(name)s crashed?",
483
414
vars(self))
484
415
485
def checked_ok(self, timeout=None):
416
def checked_ok(self):
486
417
"""Bump up the timeout for this client.
487
418
488
419
This should only be called when the client has been seen,
489
420
alive and well.
490
421
"""
491
if timeout is None:
492
timeout = self.timeout
493
422
self.last_checked_ok = datetime.datetime.utcnow()
494
if self.disable_initiator_tag is not None:
495
gobject.source_remove(self.disable_initiator_tag)
496
if getattr(self, "enabled", False):
497
self.disable_initiator_tag = (gobject.timeout_add
498
(_timedelta_to_milliseconds
499
(timeout), self.disable))
500
self.expires = datetime.datetime.utcnow() + timeout
423
gobject.source_remove(self.disable_initiator_tag)
424
self.disable_initiator_tag = (gobject.timeout_add
425
(self.timeout_milliseconds(),
426
self.disable))
501
427
502
428
def need_approval(self):
503
429
self.last_approval_request = datetime.datetime.utcnow()
519
445
# If a checker exists, make sure it is not a zombie
520
446
try:
521
447
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
522
except (AttributeError, OSError) as error:
448
except (AttributeError, OSError), error:
523
449
if (isinstance(error, OSError)
524
450
and error.errno != errno.ECHILD):
525
451
raise error
543
469
'replace')))
544
470
for attr in
545
471
self.runtime_expansions)
546
472
547
473
try:
548
474
command = self.checker_command % escaped_attrs
549
except TypeError as error:
475
except TypeError, error:
550
476
logger.error('Could not format string "%s":'
551
477
' %s', self.checker_command, error)
552
478
return True # Try again later
571
497
if pid:
572
498
gobject.source_remove(self.checker_callback_tag)
573
499
self.checker_callback(pid, status, command)
574
except OSError as error:
500
except OSError, error:
575
501
logger.error("Failed to start subprocess: %s",
576
502
error)
577
503
# Re-run this periodically if run by gobject.timeout_add
590
516
#time.sleep(0.5)
591
517
#if self.checker.poll() is None:
592
518
# os.kill(self.checker.pid, signal.SIGKILL)
593
except OSError as error:
519
except OSError, error:
594
520
if error.errno != errno.ESRCH: # No such process
595
521
raise
596
522
self.checker = None
597
523
598
# Encrypts a client secret and stores it in a varible
599
# encrypted_secret
600
def encrypt_secret(self, key):
601
# Encryption-key need to be of a specific size, so we hash
602
# supplied key
603
hasheng = hashlib.sha256()
604
hasheng.update(key)
605
encryptionkey = hasheng.digest()
606
607
# Create validation hash so we know at decryption if it was
608
# sucessful
609
hasheng = hashlib.sha256()
610
hasheng.update(self.secret)
611
validationhash = hasheng.digest()
612
613
# Encrypt secret
614
iv = os.urandom(Crypto.Cipher.AES.block_size)
615
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
616
Crypto.Cipher.AES.MODE_CFB, iv)
617
ciphertext = ciphereng.encrypt(validationhash+self.secret)
618
self.encrypted_secret = (ciphertext, iv)
619
620
# Decrypt a encrypted client secret
621
def decrypt_secret(self, key):
622
# Decryption-key need to be of a specific size, so we hash
623
# supplied key
624
hasheng = hashlib.sha256()
625
hasheng.update(key)
626
encryptionkey = hasheng.digest()
627
628
# Decrypt encrypted secret
629
ciphertext, iv = self.encrypted_secret
630
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
631
Crypto.Cipher.AES.MODE_CFB, iv)
632
plain = ciphereng.decrypt(ciphertext)
633
634
# Validate decrypted secret to know if it was succesful
635
hasheng = hashlib.sha256()
636
validationhash = plain[:hasheng.digest_size]
637
secret = plain[hasheng.digest_size:]
638
hasheng.update(secret)
639
640
# If validation fails, we use key as new secret. Otherwise, we
641
# use the decrypted secret
642
if hasheng.digest() == validationhash:
643
self.secret = secret
644
else:
645
self.secret = key
646
del self.encrypted_secret
647
648
649
524
def dbus_service_property(dbus_interface, signature="v",
650
525
access="readwrite", byte_arrays=False):
651
526
"""Decorators for marking methods of a DBusObjectWithProperties to
697
572
698
573
class DBusObjectWithProperties(dbus.service.Object):
699
574
"""A D-Bus object with properties.
700
575
701
576
Classes inheriting from this can use the dbus_service_property
702
577
decorator to expose methods as D-Bus properties. It exposes the
703
578
standard Get(), Set(), and GetAll() methods on the D-Bus.
710
585
def _get_all_dbus_properties(self):
711
586
"""Returns a generator of (name, attribute) pairs
712
587
"""
713
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
714
for cls in self.__class__.__mro__
588
return ((prop._dbus_name, prop)
715
589
for name, prop in
716
inspect.getmembers(cls, self._is_dbus_property))
590
inspect.getmembers(self, self._is_dbus_property))
717
591
718
592
def _get_dbus_property(self, interface_name, property_name):
719
593
"""Returns a bound method if one exists which is a D-Bus
720
594
property with the specified name and interface.
721
595
"""
722
for cls in self.__class__.__mro__:
723
for name, value in (inspect.getmembers
724
(cls, self._is_dbus_property)):
725
if (value._dbus_name == property_name
726
and value._dbus_interface == interface_name):
727
return value.__get__(self)
728
596
for name in (property_name,
597
property_name + "_dbus_property"):
598
prop = getattr(self, name, None)
599
if (prop is None
600
or not self._is_dbus_property(prop)
601
or prop._dbus_name != property_name
602
or (interface_name and prop._dbus_interface
603
and interface_name != prop._dbus_interface)):
604
continue
605
return prop
729
606
# No such property
730
607
raise DBusPropertyNotFound(self.dbus_object_path + ":"
731
608
+ interface_name + "."
765
642
def GetAll(self, interface_name):
766
643
"""Standard D-Bus property GetAll() method, see D-Bus
767
644
standard.
768
645
769
646
Note: Will not include properties with access="write".
770
647
"""
771
648
all = {}
827
704
xmlstring = document.toxml("utf-8")
828
705
document.unlink()
829
706
except (AttributeError, xml.dom.DOMException,
830
xml.parsers.expat.ExpatError) as error:
707
xml.parsers.expat.ExpatError), error:
831
708
logger.error("Failed to override Introspection method",
832
709
error)
833
710
return xmlstring
834
711
835
712
836
def datetime_to_dbus (dt, variant_level=0):
837
"""Convert a UTC datetime.datetime() to a D-Bus type."""
838
if dt is None:
839
return dbus.String("", variant_level = variant_level)
840
return dbus.String(dt.isoformat(),
841
variant_level=variant_level)
842
843
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
844
.__metaclass__):
845
"""Applied to an empty subclass of a D-Bus object, this metaclass
846
will add additional D-Bus attributes matching a certain pattern.
847
"""
848
def __new__(mcs, name, bases, attr):
849
# Go through all the base classes which could have D-Bus
850
# methods, signals, or properties in them
851
for base in (b for b in bases
852
if issubclass(b, dbus.service.Object)):
853
# Go though all attributes of the base class
854
for attrname, attribute in inspect.getmembers(base):
855
# Ignore non-D-Bus attributes, and D-Bus attributes
856
# with the wrong interface name
857
if (not hasattr(attribute, "_dbus_interface")
858
or not attribute._dbus_interface
859
.startswith("se.recompile.Mandos")):
860
continue
861
# Create an alternate D-Bus interface name based on
862
# the current name
863
alt_interface = (attribute._dbus_interface
864
.replace("se.recompile.Mandos",
865
"se.bsnet.fukt.Mandos"))
866
# Is this a D-Bus signal?
867
if getattr(attribute, "_dbus_is_signal", False):
868
# Extract the original non-method function by
869
# black magic
870
nonmethod_func = (dict(
871
zip(attribute.func_code.co_freevars,
872
attribute.__closure__))["func"]
873
.cell_contents)
874
# Create a new, but exactly alike, function
875
# object, and decorate it to be a new D-Bus signal
876
# with the alternate D-Bus interface name
877
new_function = (dbus.service.signal
878
(alt_interface,
879
attribute._dbus_signature)
880
(types.FunctionType(
881
nonmethod_func.func_code,
882
nonmethod_func.func_globals,
883
nonmethod_func.func_name,
884
nonmethod_func.func_defaults,
885
nonmethod_func.func_closure)))
886
# Define a creator of a function to call both the
887
# old and new functions, so both the old and new
888
# signals gets sent when the function is called
889
def fixscope(func1, func2):
890
"""This function is a scope container to pass
891
func1 and func2 to the "call_both" function
892
outside of its arguments"""
893
def call_both(*args, **kwargs):
894
"""This function will emit two D-Bus
895
signals by calling func1 and func2"""
896
func1(*args, **kwargs)
897
func2(*args, **kwargs)
898
return call_both
899
# Create the "call_both" function and add it to
900
# the class
901
attr[attrname] = fixscope(attribute,
902
new_function)
903
# Is this a D-Bus method?
904
elif getattr(attribute, "_dbus_is_method", False):
905
# Create a new, but exactly alike, function
906
# object. Decorate it to be a new D-Bus method
907
# with the alternate D-Bus interface name. Add it
908
# to the class.
909
attr[attrname] = (dbus.service.method
910
(alt_interface,
911
attribute._dbus_in_signature,
912
attribute._dbus_out_signature)
913
(types.FunctionType
914
(attribute.func_code,
915
attribute.func_globals,
916
attribute.func_name,
917
attribute.func_defaults,
918
attribute.func_closure)))
919
# Is this a D-Bus property?
920
elif getattr(attribute, "_dbus_is_property", False):
921
# Create a new, but exactly alike, function
922
# object, and decorate it to be a new D-Bus
923
# property with the alternate D-Bus interface
924
# name. Add it to the class.
925
attr[attrname] = (dbus_service_property
926
(alt_interface,
927
attribute._dbus_signature,
928
attribute._dbus_access,
929
attribute
930
._dbus_get_args_options
931
["byte_arrays"])
932
(types.FunctionType
933
(attribute.func_code,
934
attribute.func_globals,
935
attribute.func_name,
936
attribute.func_defaults,
937
attribute.func_closure)))
938
return type.__new__(mcs, name, bases, attr)
939
940
713
class ClientDBus(Client, DBusObjectWithProperties):
941
714
"""A Client class using D-Bus
942
715
951
724
# dbus.service.Object doesn't use super(), so we can't either.
952
725
953
726
def __init__(self, bus = None, *args, **kwargs):
954
self.bus = bus
955
727
self._approvals_pending = 0
728
self.bus = bus
956
729
Client.__init__(self, *args, **kwargs)
957
self.add_to_dbus()
958
959
def add_to_dbus(self):
960
730
# Only now, when this client is initialized, can it show up on
961
731
# the D-Bus
962
732
client_object_name = unicode(self.name).translate(
967
737
DBusObjectWithProperties.__init__(self, self.bus,
968
738
self.dbus_object_path)
969
739
970
def notifychangeproperty(transform_func,
971
dbus_name, type_func=lambda x: x,
972
variant_level=1):
973
""" Modify a variable so that it's a property which announces
974
its changes to DBus.
740
def _get_approvals_pending(self):
741
return self._approvals_pending
742
def _set_approvals_pending(self, value):
743
old_value = self._approvals_pending
744
self._approvals_pending = value
745
bval = bool(value)
746
if (hasattr(self, "dbus_object_path")
747
and bval is not bool(old_value)):
748
dbus_bool = dbus.Boolean(bval, variant_level=1)
749
self.PropertyChanged(dbus.String("ApprovalPending"),
750
dbus_bool)
975
751
976
transform_fun: Function that takes a value and a variant_level
977
and transforms it to a D-Bus type.
978
dbus_name: D-Bus name of the variable
979
type_func: Function that transform the value before sending it
980
to the D-Bus. Default: no transform
981
variant_level: D-Bus variant level. Default: 1
982
"""
983
attrname = "_{0}".format(dbus_name)
984
def setter(self, value):
985
if hasattr(self, "dbus_object_path"):
986
if (not hasattr(self, attrname) or
987
type_func(getattr(self, attrname, None))
988
!= type_func(value)):
989
dbus_value = transform_func(type_func(value),
990
variant_level
991
=variant_level)
992
self.PropertyChanged(dbus.String(dbus_name),
993
dbus_value)
994
setattr(self, attrname, value)
995
996
return property(lambda self: getattr(self, attrname), setter)
997
998
999
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1000
approvals_pending = notifychangeproperty(dbus.Boolean,
1001
"ApprovalPending",
1002
type_func = bool)
1003
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1004
last_enabled = notifychangeproperty(datetime_to_dbus,
1005
"LastEnabled")
1006
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1007
type_func = lambda checker:
1008
checker is not None)
1009
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1010
"LastCheckedOK")
1011
last_approval_request = notifychangeproperty(
1012
datetime_to_dbus, "LastApprovalRequest")
1013
approved_by_default = notifychangeproperty(dbus.Boolean,
1014
"ApprovedByDefault")
1015
approval_delay = notifychangeproperty(dbus.UInt64,
1016
"ApprovalDelay",
1017
type_func =
1018
_timedelta_to_milliseconds)
1019
approval_duration = notifychangeproperty(
1020
dbus.UInt64, "ApprovalDuration",
1021
type_func = _timedelta_to_milliseconds)
1022
host = notifychangeproperty(dbus.String, "Host")
1023
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1024
type_func =
1025
_timedelta_to_milliseconds)
1026
extended_timeout = notifychangeproperty(
1027
dbus.UInt64, "ExtendedTimeout",
1028
type_func = _timedelta_to_milliseconds)
1029
interval = notifychangeproperty(dbus.UInt64,
1030
"Interval",
1031
type_func =
1032
_timedelta_to_milliseconds)
1033
checker_command = notifychangeproperty(dbus.String, "Checker")
1034
1035
del notifychangeproperty
752
approvals_pending = property(_get_approvals_pending,
753
_set_approvals_pending)
754
del _get_approvals_pending, _set_approvals_pending
755
756
@staticmethod
757
def _datetime_to_dbus(dt, variant_level=0):
758
"""Convert a UTC datetime.datetime() to a D-Bus type."""
759
return dbus.String(dt.isoformat(),
760
variant_level=variant_level)
761
762
def enable(self):
763
oldstate = getattr(self, "enabled", False)
764
r = Client.enable(self)
765
if oldstate != self.enabled:
766
# Emit D-Bus signals
767
self.PropertyChanged(dbus.String("Enabled"),
768
dbus.Boolean(True, variant_level=1))
769
self.PropertyChanged(
770
dbus.String("LastEnabled"),
771
self._datetime_to_dbus(self.last_enabled,
772
variant_level=1))
773
return r
774
775
def disable(self, quiet = False):
776
oldstate = getattr(self, "enabled", False)
777
r = Client.disable(self, quiet=quiet)
778
if not quiet and oldstate != self.enabled:
779
# Emit D-Bus signal
780
self.PropertyChanged(dbus.String("Enabled"),
781
dbus.Boolean(False, variant_level=1))
782
return r
1036
783
1037
784
def __del__(self, *args, **kwargs):
1038
785
try:
1047
794
*args, **kwargs):
1048
795
self.checker_callback_tag = None
1049
796
self.checker = None
797
# Emit D-Bus signal
798
self.PropertyChanged(dbus.String("CheckerRunning"),
799
dbus.Boolean(False, variant_level=1))
1050
800
if os.WIFEXITED(condition):
1051
801
exitstatus = os.WEXITSTATUS(condition)
1052
802
# Emit D-Bus signal
1062
812
return Client.checker_callback(self, pid, condition, command,
1063
813
*args, **kwargs)
1064
814
815
def checked_ok(self, *args, **kwargs):
816
r = Client.checked_ok(self, *args, **kwargs)
817
# Emit D-Bus signal
818
self.PropertyChanged(
819
dbus.String("LastCheckedOK"),
820
(self._datetime_to_dbus(self.last_checked_ok,
821
variant_level=1)))
822
return r
823
824
def need_approval(self, *args, **kwargs):
825
r = Client.need_approval(self, *args, **kwargs)
826
# Emit D-Bus signal
827
self.PropertyChanged(
828
dbus.String("LastApprovalRequest"),
829
(self._datetime_to_dbus(self.last_approval_request,
830
variant_level=1)))
831
return r
832
1065
833
def start_checker(self, *args, **kwargs):
1066
834
old_checker = self.checker
1067
835
if self.checker is not None:
1074
842
and old_checker_pid != self.checker.pid):
1075
843
# Emit D-Bus signal
1076
844
self.CheckerStarted(self.current_checker_command)
845
self.PropertyChanged(
846
dbus.String("CheckerRunning"),
847
dbus.Boolean(True, variant_level=1))
1077
848
return r
1078
849
850
def stop_checker(self, *args, **kwargs):
851
old_checker = getattr(self, "checker", None)
852
r = Client.stop_checker(self, *args, **kwargs)
853
if (old_checker is not None
854
and getattr(self, "checker", None) is None):
855
self.PropertyChanged(dbus.String("CheckerRunning"),
856
dbus.Boolean(False, variant_level=1))
857
return r
858
1079
859
def _reset_approved(self):
1080
860
self._approved = None
1081
861
return False
1083
863
def approve(self, value=True):
1084
864
self.send_changedstate()
1085
865
self._approved = value
1086
gobject.timeout_add(_timedelta_to_milliseconds
866
gobject.timeout_add(self._timedelta_to_milliseconds
1087
867
(self.approval_duration),
1088
868
self._reset_approved)
1089
869
1090
870
1091
871
## D-Bus methods, signals & properties
1092
_interface = "se.recompile.Mandos.Client"
872
_interface = "se.bsnet.fukt.Mandos.Client"
1093
873
1094
874
## Signals
1095
875
1142
922
# CheckedOK - method
1143
923
@dbus.service.method(_interface)
1144
924
def CheckedOK(self):
1145
self.checked_ok()
925
return self.checked_ok()
1146
926
1147
927
# Enable - method
1148
928
@dbus.service.method(_interface)
1181
961
if value is None: # get
1182
962
return dbus.Boolean(self.approved_by_default)
1183
963
self.approved_by_default = bool(value)
964
# Emit D-Bus signal
965
self.PropertyChanged(dbus.String("ApprovedByDefault"),
966
dbus.Boolean(value, variant_level=1))
1184
967
1185
968
# ApprovalDelay - property
1186
969
@dbus_service_property(_interface, signature="t",
1189
972
if value is None: # get
1190
973
return dbus.UInt64(self.approval_delay_milliseconds())
1191
974
self.approval_delay = datetime.timedelta(0, 0, 0, value)
975
# Emit D-Bus signal
976
self.PropertyChanged(dbus.String("ApprovalDelay"),
977
dbus.UInt64(value, variant_level=1))
1192
978
1193
979
# ApprovalDuration - property
1194
980
@dbus_service_property(_interface, signature="t",
1195
981
access="readwrite")
1196
982
def ApprovalDuration_dbus_property(self, value=None):
1197
983
if value is None: # get
1198
return dbus.UInt64(_timedelta_to_milliseconds(
984
return dbus.UInt64(self._timedelta_to_milliseconds(
1199
985
self.approval_duration))
1200
986
self.approval_duration = datetime.timedelta(0, 0, 0, value)
987
# Emit D-Bus signal
988
self.PropertyChanged(dbus.String("ApprovalDuration"),
989
dbus.UInt64(value, variant_level=1))
1201
990
1202
991
# Name - property
1203
992
@dbus_service_property(_interface, signature="s", access="read")
1216
1005
if value is None: # get
1217
1006
return dbus.String(self.host)
1218
1007
self.host = value
1008
# Emit D-Bus signal
1009
self.PropertyChanged(dbus.String("Host"),
1010
dbus.String(value, variant_level=1))
1219
1011
1220
1012
# Created - property
1221
1013
@dbus_service_property(_interface, signature="s", access="read")
1222
1014
def Created_dbus_property(self):
1223
return dbus.String(datetime_to_dbus(self.created))
1015
return dbus.String(self._datetime_to_dbus(self.created))
1224
1016
1225
1017
# LastEnabled - property
1226
1018
@dbus_service_property(_interface, signature="s", access="read")
1227
1019
def LastEnabled_dbus_property(self):
1228
return datetime_to_dbus(self.last_enabled)
1020
if self.last_enabled is None:
1021
return dbus.String("")
1022
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1229
1023
1230
1024
# Enabled - property
1231
1025
@dbus_service_property(_interface, signature="b",
1245
1039
if value is not None:
1246
1040
self.checked_ok()
1247
1041
return
1248
return datetime_to_dbus(self.last_checked_ok)
1249
1250
# Expires - property
1251
@dbus_service_property(_interface, signature="s", access="read")
1252
def Expires_dbus_property(self):
1253
return datetime_to_dbus(self.expires)
1042
if self.last_checked_ok is None:
1043
return dbus.String("")
1044
return dbus.String(self._datetime_to_dbus(self
1045
.last_checked_ok))
1254
1046
1255
1047
# LastApprovalRequest - property
1256
1048
@dbus_service_property(_interface, signature="s", access="read")
1257
1049
def LastApprovalRequest_dbus_property(self):
1258
return datetime_to_dbus(self.last_approval_request)
1050
if self.last_approval_request is None:
1051
return dbus.String("")
1052
return dbus.String(self.
1053
_datetime_to_dbus(self
1054
.last_approval_request))
1259
1055
1260
1056
# Timeout - property
1261
1057
@dbus_service_property(_interface, signature="t",
1264
1060
if value is None: # get
1265
1061
return dbus.UInt64(self.timeout_milliseconds())
1266
1062
self.timeout = datetime.timedelta(0, 0, 0, value)
1063
# Emit D-Bus signal
1064
self.PropertyChanged(dbus.String("Timeout"),
1065
dbus.UInt64(value, variant_level=1))
1267
1066
if getattr(self, "disable_initiator_tag", None) is None:
1268
1067
return
1269
1068
# Reschedule timeout
1270
1069
gobject.source_remove(self.disable_initiator_tag)
1271
1070
self.disable_initiator_tag = None
1272
self.expires = None
1273
time_to_die = _timedelta_to_milliseconds((self
1274
.last_checked_ok
1275
+ self.timeout)
1276
- datetime.datetime
1277
.utcnow())
1071
time_to_die = (self.
1072
_timedelta_to_milliseconds((self
1073
.last_checked_ok
1074
+ self.timeout)
1075
- datetime.datetime
1076
.utcnow()))
1278
1077
if time_to_die <= 0:
1279
1078
# The timeout has passed
1280
1079
self.disable()
1281
1080
else:
1282
self.expires = (datetime.datetime.utcnow()
1283
+ datetime.timedelta(milliseconds =
1284
time_to_die))
1285
1081
self.disable_initiator_tag = (gobject.timeout_add
1286
1082
(time_to_die, self.disable))
1287
1083
1288
# ExtendedTimeout - property
1289
@dbus_service_property(_interface, signature="t",
1290
access="readwrite")
1291
def ExtendedTimeout_dbus_property(self, value=None):
1292
if value is None: # get
1293
return dbus.UInt64(self.extended_timeout_milliseconds())
1294
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1295
1296
1084
# Interval - property
1297
1085
@dbus_service_property(_interface, signature="t",
1298
1086
access="readwrite")
1300
1088
if value is None: # get
1301
1089
return dbus.UInt64(self.interval_milliseconds())
1302
1090
self.interval = datetime.timedelta(0, 0, 0, value)
1091
# Emit D-Bus signal
1092
self.PropertyChanged(dbus.String("Interval"),
1093
dbus.UInt64(value, variant_level=1))
1303
1094
if getattr(self, "checker_initiator_tag", None) is None:
1304
1095
return
1305
1096
# Reschedule checker run
1307
1098
self.checker_initiator_tag = (gobject.timeout_add
1308
1099
(value, self.start_checker))
1309
1100
self.start_checker() # Start one now, too
1310
1101
1311
1102
# Checker - property
1312
1103
@dbus_service_property(_interface, signature="s",
1313
1104
access="readwrite")
1315
1106
if value is None: # get
1316
1107
return dbus.String(self.checker_command)
1317
1108
self.checker_command = value
1109
# Emit D-Bus signal
1110
self.PropertyChanged(dbus.String("Checker"),
1111
dbus.String(self.checker_command,
1112
variant_level=1))
1318
1113
1319
1114
# CheckerRunning - property
1320
1115
@dbus_service_property(_interface, signature="b",
1347
1142
self._pipe.send(('init', fpr, address))
1348
1143
if not self._pipe.recv():
1349
1144
raise KeyError()
1350
1145
1351
1146
def __getattribute__(self, name):
1352
1147
if(name == '_pipe'):
1353
1148
return super(ProxyClient, self).__getattribute__(name)
1360
1155
self._pipe.send(('funcall', name, args, kwargs))
1361
1156
return self._pipe.recv()[1]
1362
1157
return func
1363
1158
1364
1159
def __setattr__(self, name, value):
1365
1160
if(name == '_pipe'):
1366
1161
return super(ProxyClient, self).__setattr__(name, value)
1367
1162
self._pipe.send(('setattr', name, value))
1368
1163
1369
class ClientDBusTransitional(ClientDBus):
1370
__metaclass__ = AlternateDBusNamesMetaclass
1371
1164
1372
1165
class ClientHandler(socketserver.BaseRequestHandler, object):
1373
1166
"""A class to handle client connections.
1381
1174
unicode(self.client_address))
1382
1175
logger.debug("Pipe FD: %d",
1383
1176
self.server.child_pipe.fileno())
1384
1177
1385
1178
session = (gnutls.connection
1386
1179
.ClientSession(self.request,
1387
1180
gnutls.connection
1388
1181
.X509Credentials()))
1389
1182
1390
1183
# Note: gnutls.connection.X509Credentials is really a
1391
1184
# generic GnuTLS certificate credentials object so long as
1392
1185
# no X.509 keys are added to it. Therefore, we can use it
1393
1186
# here despite using OpenPGP certificates.
1394
1187
1395
1188
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1396
1189
# "+AES-256-CBC", "+SHA1",
1397
1190
# "+COMP-NULL", "+CTYPE-OPENPGP",
1403
1196
(gnutls.library.functions
1404
1197
.gnutls_priority_set_direct(session._c_object,
1405
1198
priority, None))
1406
1199
1407
1200
# Start communication using the Mandos protocol
1408
1201
# Get protocol number
1409
1202
line = self.request.makefile().readline()
1411
1204
try:
1412
1205
if int(line.strip().split()[0]) > 1:
1413
1206
raise RuntimeError
1414
except (ValueError, IndexError, RuntimeError) as error:
1207
except (ValueError, IndexError, RuntimeError), error:
1415
1208
logger.error("Unknown protocol version: %s", error)
1416
1209
return
1417
1210
1418
1211
# Start GnuTLS connection
1419
1212
try:
1420
1213
session.handshake()
1421
except gnutls.errors.GNUTLSError as error:
1214
except gnutls.errors.GNUTLSError, error:
1422
1215
logger.warning("Handshake failed: %s", error)
1423
1216
# Do not run session.bye() here: the session is not
1424
1217
# established. Just abandon the request.
1425
1218
return
1426
1219
logger.debug("Handshake succeeded")
1427
1220
1428
1221
approval_required = False
1429
1222
try:
1430
1223
try:
1431
1224
fpr = self.fingerprint(self.peer_certificate
1432
1225
(session))
1433
except (TypeError,
1434
gnutls.errors.GNUTLSError) as error:
1226
except (TypeError, gnutls.errors.GNUTLSError), error:
1435
1227
logger.warning("Bad certificate: %s", error)
1436
1228
return
1437
1229
logger.debug("Fingerprint: %s", fpr)
1438
1230
1439
1231
try:
1440
1232
client = ProxyClient(child_pipe, fpr,
1441
1233
self.client_address)
1449
1241
1450
1242
while True:
1451
1243
if not client.enabled:
1452
logger.info("Client %s is disabled",
1244
logger.warning("Client %s is disabled",
1453
1245
client.name)
1454
1246
if self.server.use_dbus:
1455
1247
# Emit D-Bus signal
1456
client.Rejected("Disabled")
1248
client.Rejected("Disabled")
1457
1249
return
1458
1250
1459
1251
if client._approved or not client.approval_delay:
1476
1268
return
1477
1269
1478
1270
#wait until timeout or approved
1271
#x = float(client._timedelta_to_milliseconds(delay))
1479
1272
time = datetime.datetime.now()
1480
1273
client.changedstate.acquire()
1481
(client.changedstate.wait
1482
(float(client._timedelta_to_milliseconds(delay)
1483
/ 1000)))
1274
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1484
1275
client.changedstate.release()
1485
1276
time2 = datetime.datetime.now()
1486
1277
if (time2 - time) >= delay:
1501
1292
while sent_size < len(client.secret):
1502
1293
try:
1503
1294
sent = session.send(client.secret[sent_size:])
1504
except gnutls.errors.GNUTLSError as error:
1295
except (gnutls.errors.GNUTLSError), error:
1505
1296
logger.warning("gnutls send failed")
1506
1297
return
1507
1298
logger.debug("Sent: %d, remaining: %d",
1508
1299
sent, len(client.secret)
1509
1300
- (sent_size + sent))
1510
1301
sent_size += sent
1511
1302
1512
1303
logger.info("Sending secret to %s", client.name)
1513
# bump the timeout using extended_timeout
1514
client.checked_ok(client.extended_timeout)
1304
# bump the timeout as if seen
1305
client.checked_ok()
1515
1306
if self.server.use_dbus:
1516
1307
# Emit D-Bus signal
1517
1308
client.GotSecret()
1521
1312
client.approvals_pending -= 1
1522
1313
try:
1523
1314
session.bye()
1524
except gnutls.errors.GNUTLSError as error:
1315
except (gnutls.errors.GNUTLSError), error:
1525
1316
logger.warning("GnuTLS bye failed")
1526
1317
1527
1318
@staticmethod
1596
1387
except:
1597
1388
self.handle_error(request, address)
1598
1389
self.close_request(request)
1599
1390
1600
1391
def process_request(self, request, address):
1601
1392
"""Start a new process to process the request."""
1602
proc = multiprocessing.Process(target = self.sub_process_main,
1603
args = (request,
1604
address))
1605
proc.start()
1606
return proc
1607
1393
multiprocessing.Process(target = self.sub_process_main,
1394
args = (request, address)).start()
1608
1395
1609
1396
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1610
1397
""" adds a pipe to the MixIn """
1614
1401
This function creates a new pipe in self.pipe
1615
1402
"""
1616
1403
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1617
1618
proc = MultiprocessingMixIn.process_request(self, request,
1619
client_address)
1404
1405
super(MultiprocessingMixInWithPipe,
1406
self).process_request(request, client_address)
1620
1407
self.child_pipe.close()
1621
self.add_pipe(parent_pipe, proc)
1622
1623
def add_pipe(self, parent_pipe, proc):
1408
self.add_pipe(parent_pipe)
1409
1410
def add_pipe(self, parent_pipe):
1624
1411
"""Dummy function; override as necessary"""
1625
1412
raise NotImplementedError
1626
1413
1627
1628
1414
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1629
1415
socketserver.TCPServer, object):
1630
1416
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1656
1442
SO_BINDTODEVICE,
1657
1443
str(self.interface
1658
1444
+ '\0'))
1659
except socket.error as error:
1445
except socket.error, error:
1660
1446
if error[0] == errno.EPERM:
1661
1447
logger.error("No permission to"
1662
1448
" bind to interface %s",
1704
1490
self.enabled = False
1705
1491
self.clients = clients
1706
1492
if self.clients is None:
1707
self.clients = {}
1493
self.clients = set()
1708
1494
self.use_dbus = use_dbus
1709
1495
self.gnutls_priority = gnutls_priority
1710
1496
IPv6_TCPServer.__init__(self, server_address,
1714
1500
def server_activate(self):
1715
1501
if self.enabled:
1716
1502
return socketserver.TCPServer.server_activate(self)
1717
1718
1503
def enable(self):
1719
1504
self.enabled = True
1720
1721
def add_pipe(self, parent_pipe, proc):
1505
def add_pipe(self, parent_pipe):
1722
1506
# Call "handle_ipc" for both data and EOF events
1723
1507
gobject.io_add_watch(parent_pipe.fileno(),
1724
1508
gobject.IO_IN | gobject.IO_HUP,
1725
1509
functools.partial(self.handle_ipc,
1726
parent_pipe =
1727
parent_pipe,
1728
proc = proc))
1729
1510
parent_pipe = parent_pipe))
1511
1730
1512
def handle_ipc(self, source, condition, parent_pipe=None,
1731
proc = None, client_object=None):
1513
client_object=None):
1732
1514
condition_names = {
1733
1515
gobject.IO_IN: "IN", # There is data to read.
1734
1516
gobject.IO_OUT: "OUT", # Data can be written (without
1743
1525
for cond, name in
1744
1526
condition_names.iteritems()
1745
1527
if cond & condition)
1746
# error, or the other end of multiprocessing.Pipe has closed
1528
# error or the other end of multiprocessing.Pipe has closed
1747
1529
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1748
# Wait for other process to exit
1749
proc.join()
1750
1530
return False
1751
1531
1752
1532
# Read a request from the child
1757
1537
fpr = request[1]
1758
1538
address = request[2]
1759
1539
1760
for c in self.clients.itervalues():
1540
for c in self.clients:
1761
1541
if c.fingerprint == fpr:
1762
1542
client = c
1763
1543
break
1764
1544
else:
1765
logger.info("Client not found for fingerprint: %s, ad"
1766
"dress: %s", fpr, address)
1545
logger.warning("Client not found for fingerprint: %s, ad"
1546
"dress: %s", fpr, address)
1767
1547
if self.use_dbus:
1768
1548
# Emit D-Bus signal
1769
mandos_dbus_service.ClientNotFound(fpr,
1770
address[0])
1549
mandos_dbus_service.ClientNotFound(fpr, address[0])
1771
1550
parent_pipe.send(False)
1772
1551
return False
1773
1552
1774
1553
gobject.io_add_watch(parent_pipe.fileno(),
1775
1554
gobject.IO_IN | gobject.IO_HUP,
1776
1555
functools.partial(self.handle_ipc,
1777
parent_pipe =
1778
parent_pipe,
1779
proc = proc,
1780
client_object =
1781
client))
1556
parent_pipe = parent_pipe,
1557
client_object = client))
1782
1558
parent_pipe.send(True)
1783
# remove the old hook in favor of the new above hook on
1784
# same fileno
1559
# remove the old hook in favor of the new above hook on same fileno
1785
1560
return False
1786
1561
if command == 'funcall':
1787
1562
funcname = request[1]
1788
1563
args = request[2]
1789
1564
kwargs = request[3]
1790
1565
1791
parent_pipe.send(('data', getattr(client_object,
1792
funcname)(*args,
1793
**kwargs)))
1794
1566
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1567
1795
1568
if command == 'getattr':
1796
1569
attrname = request[1]
1797
1570
if callable(client_object.__getattribute__(attrname)):
1798
1571
parent_pipe.send(('function',))
1799
1572
else:
1800
parent_pipe.send(('data', client_object
1801
.__getattribute__(attrname)))
1573
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1802
1574
1803
1575
if command == 'setattr':
1804
1576
attrname = request[1]
1805
1577
value = request[2]
1806
1578
setattr(client_object, attrname, value)
1807
1579
1808
1580
return True
1809
1581
1810
1582
1841
1613
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1842
1614
else:
1843
1615
raise ValueError("Unknown suffix %r" % suffix)
1844
except (ValueError, IndexError) as e:
1616
except (ValueError, IndexError), e:
1845
1617
raise ValueError(*(e.args))
1846
1618
timevalue += delta
1847
1619
return timevalue
1901
1673
##################################################################
1902
1674
# Parsing of options, both command line and config file
1903
1675
1904
parser = argparse.ArgumentParser()
1905
parser.add_argument("-v", "--version", action="version",
1906
version = "%%(prog)s %s" % version,
1907
help="show version number and exit")
1908
parser.add_argument("-i", "--interface", metavar="IF",
1909
help="Bind to interface IF")
1910
parser.add_argument("-a", "--address",
1911
help="Address to listen for requests on")
1912
parser.add_argument("-p", "--port", type=int,
1913
help="Port number to receive requests on")
1914
parser.add_argument("--check", action="store_true",
1915
help="Run self-test")
1916
parser.add_argument("--debug", action="store_true",
1917
help="Debug mode; run in foreground and log"
1918
" to terminal")
1919
parser.add_argument("--debuglevel", metavar="LEVEL",
1920
help="Debug level for stdout output")
1921
parser.add_argument("--priority", help="GnuTLS"
1922
" priority string (see GnuTLS documentation)")
1923
parser.add_argument("--servicename",
1924
metavar="NAME", help="Zeroconf service name")
1925
parser.add_argument("--configdir",
1926
default="/etc/mandos", metavar="DIR",
1927
help="Directory to search for configuration"
1928
" files")
1929
parser.add_argument("--no-dbus", action="store_false",
1930
dest="use_dbus", help="Do not provide D-Bus"
1931
" system bus interface")
1932
parser.add_argument("--no-ipv6", action="store_false",
1933
dest="use_ipv6", help="Do not use IPv6")
1934
parser.add_argument("--no-restore", action="store_false",
1935
dest="restore",
1936
help="Do not restore stored state",
1937
default=True)
1938
1939
options = parser.parse_args()
1676
parser = optparse.OptionParser(version = "%%prog %s" % version)
1677
parser.add_option("-i", "--interface", type="string",
1678
metavar="IF", help="Bind to interface IF")
1679
parser.add_option("-a", "--address", type="string",
1680
help="Address to listen for requests on")
1681
parser.add_option("-p", "--port", type="int",
1682
help="Port number to receive requests on")
1683
parser.add_option("--check", action="store_true",
1684
help="Run self-test")
1685
parser.add_option("--debug", action="store_true",
1686
help="Debug mode; run in foreground and log to"
1687
" terminal")
1688
parser.add_option("--debuglevel", type="string", metavar="LEVEL",
1689
help="Debug level for stdout output")
1690
parser.add_option("--priority", type="string", help="GnuTLS"
1691
" priority string (see GnuTLS documentation)")
1692
parser.add_option("--servicename", type="string",
1693
metavar="NAME", help="Zeroconf service name")
1694
parser.add_option("--configdir", type="string",
1695
default="/etc/mandos", metavar="DIR",
1696
help="Directory to search for configuration"
1697
" files")
1698
parser.add_option("--no-dbus", action="store_false",
1699
dest="use_dbus", help="Do not provide D-Bus"
1700
" system bus interface")
1701
parser.add_option("--no-ipv6", action="store_false",
1702
dest="use_ipv6", help="Do not use IPv6")
1703
options = parser.parse_args()[0]
1940
1704
1941
1705
if options.check:
1942
1706
import doctest
1976
1740
# options, if set.
1977
1741
for option in ("interface", "address", "port", "debug",
1978
1742
"priority", "servicename", "configdir",
1979
"use_dbus", "use_ipv6", "debuglevel", "restore"):
1743
"use_dbus", "use_ipv6", "debuglevel"):
1980
1744
value = getattr(options, option)
1981
1745
if value is not None:
1982
1746
server_settings[option] = value
1994
1758
debuglevel = server_settings["debuglevel"]
1995
1759
use_dbus = server_settings["use_dbus"]
1996
1760
use_ipv6 = server_settings["use_ipv6"]
1997
1761
1998
1762
if server_settings["servicename"] != "Mandos":
1999
1763
syslogger.setFormatter(logging.Formatter
2000
1764
('Mandos (%s) [%%(process)d]:'
2002
1766
% server_settings["servicename"]))
2003
1767
2004
1768
# Parse config file with clients
2005
client_defaults = { "timeout": "5m",
2006
"extended_timeout": "15m",
2007
"interval": "2m",
1769
client_defaults = { "timeout": "1h",
1770
"interval": "5m",
2008
1771
"checker": "fping -q -- %%(host)s",
2009
1772
"host": "",
2010
1773
"approval_delay": "0s",
2050
1813
try:
2051
1814
os.setgid(gid)
2052
1815
os.setuid(uid)
2053
except OSError as error:
1816
except OSError, error:
2054
1817
if error[0] != errno.EPERM:
2055
1818
raise error
2056
1819
2057
1820
if not debug and not debuglevel:
2058
logger.setLevel(logging.WARNING)
1821
syslogger.setLevel(logging.WARNING)
1822
console.setLevel(logging.WARNING)
2059
1823
if debuglevel:
2060
1824
level = getattr(logging, debuglevel.upper())
2061
logger.setLevel(level)
2062
1825
syslogger.setLevel(level)
1826
console.setLevel(level)
1827
2063
1828
if debug:
2064
logger.setLevel(logging.DEBUG)
2065
1829
# Enable all possible GnuTLS debugging
2066
1830
2067
1831
# "Use a log level over 10 to enable all debugging options."
2097
1861
# End of Avahi example code
2098
1862
if use_dbus:
2099
1863
try:
2100
bus_name = dbus.service.BusName("se.recompile.Mandos",
1864
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2101
1865
bus, do_not_queue=True)
2102
old_bus_name = (dbus.service.BusName
2103
("se.bsnet.fukt.Mandos", bus,
2104
do_not_queue=True))
2105
except dbus.exceptions.NameExistsException as e:
1866
except dbus.exceptions.NameExistsException, e:
2106
1867
logger.error(unicode(e) + ", disabling D-Bus")
2107
1868
use_dbus = False
2108
1869
server_settings["use_dbus"] = False
2109
1870
tcp_server.use_dbus = False
2110
1871
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2111
service = AvahiServiceToSyslog(name =
2112
server_settings["servicename"],
2113
servicetype = "_mandos._tcp",
2114
protocol = protocol, bus = bus)
1872
service = AvahiService(name = server_settings["servicename"],
1873
servicetype = "_mandos._tcp",
1874
protocol = protocol, bus = bus)
2115
1875
if server_settings["interface"]:
2116
1876
service.interface = (if_nametoindex
2117
1877
(str(server_settings["interface"])))
2121
1881
2122
1882
client_class = Client
2123
1883
if use_dbus:
2124
client_class = functools.partial(ClientDBusTransitional,
2125
bus = bus)
2126
2127
special_settings = {
2128
# Some settings need to be accessd by special methods;
2129
# booleans need .getboolean(), etc. Here is a list of them:
2130
"approved_by_default":
2131
lambda section:
2132
client_config.getboolean(section, "approved_by_default"),
2133
}
2134
# Construct a new dict of client settings of this form:
2135
# { client_name: {setting_name: value, ...}, ...}
2136
# with exceptions for any special settings as defined above
2137
client_settings = dict((clientname,
2138
dict((setting,
2139
(value if
2140
setting not in special_settings
2141
else special_settings[setting]
2142
(clientname)))
2143
for setting, value
2144
in client_config.items(clientname)))
2145
for clientname in client_config.sections())
2146
2147
old_client_settings = {}
2148
clients_data = []
2149
2150
# Get client data and settings from last running state.
2151
if server_settings["restore"]:
2152
try:
2153
with open(stored_state_path, "rb") as stored_state:
2154
clients_data, old_client_settings = (
2155
pickle.load(stored_state))
2156
os.remove(stored_state_path)
2157
except IOError as e:
2158
logger.warning("Could not load persistant state: {0}"
2159
.format(e))
2160
if e.errno != errno.ENOENT:
2161
raise
2162
2163
for client in clients_data:
2164
client_name = client["name"]
2165
2166
# Decide which value to use after restoring saved state.
2167
# We have three different values: Old config file,
2168
# new config file, and saved state.
2169
# New config value takes precedence if it differs from old
2170
# config value, otherwise use saved state.
2171
for name, value in client_settings[client_name].items():
1884
client_class = functools.partial(ClientDBus, bus = bus)
1885
def client_config_items(config, section):
1886
special_settings = {
1887
"approved_by_default":
1888
lambda: config.getboolean(section,
1889
"approved_by_default"),
1890
}
1891
for name, value in config.items(section):
2172
1892
try:
2173
# For each value in new config, check if it differs
2174
# from the old config value (Except for the "secret"
2175
# attribute)
2176
if (name != "secret" and
2177
value != old_client_settings[client_name][name]):
2178
setattr(client, name, value)
1893
yield (name, special_settings[name]())
2179
1894
except KeyError:
2180
pass
2181
2182
# Clients who has passed its expire date, can still be enabled
2183
# if its last checker was sucessful. Clients who checkers
2184
# failed before we stored it state is asumed to had failed
2185
# checker during downtime.
2186
if client["enabled"] and client["last_checked_ok"]:
2187
if ((datetime.datetime.utcnow()
2188
- client["last_checked_ok"]) > client["interval"]):
2189
if client["last_checker_status"] != 0:
2190
client["enabled"] = False
2191
else:
2192
client["expires"] = (datetime.datetime.utcnow()
2193
+ client["timeout"])
2194
2195
client["changedstate"] = (multiprocessing_manager
2196
.Condition(multiprocessing_manager
2197
.Lock()))
2198
if use_dbus:
2199
new_client = ClientDBusTransitional.__new__(
2200
ClientDBusTransitional)
2201
tcp_server.clients[client_name] = new_client
2202
new_client.bus = bus
2203
for name, value in client.iteritems():
2204
setattr(new_client, name, value)
2205
new_client._approvals_pending = 0
2206
new_client.add_to_dbus()
2207
else:
2208
tcp_server.clients[client_name] = Client.__new__(Client)
2209
for name, value in client.iteritems():
2210
setattr(tcp_server.clients[client_name], name, value)
2211
2212
tcp_server.clients[client_name].decrypt_secret(
2213
client_settings[client_name]["secret"])
2214
2215
# Create/remove clients based on new changes made to config
2216
for clientname in set(old_client_settings) - set(client_settings):
2217
del tcp_server.clients[clientname]
2218
for clientname in set(client_settings) - set(old_client_settings):
2219
tcp_server.clients[clientname] = client_class(name
2220
= clientname,
2221
config =
2222
client_settings
2223
[clientname])
1895
yield (name, value)
2224
1896
1897
tcp_server.clients.update(set(
1898
client_class(name = section,
1899
config= dict(client_config_items(
1900
client_config, section)))
1901
for section in client_config.sections()))
2225
1902
if not tcp_server.clients:
2226
1903
logger.warning("No clients defined")
2227
1904
2240
1917
del pidfilename
2241
1918
2242
1919
signal.signal(signal.SIGINT, signal.SIG_IGN)
2243
1920
2244
1921
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2245
1922
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2246
1923
2249
1926
"""A D-Bus proxy object"""
2250
1927
def __init__(self):
2251
1928
dbus.service.Object.__init__(self, bus, "/")
2252
_interface = "se.recompile.Mandos"
1929
_interface = "se.bsnet.fukt.Mandos"
2253
1930
2254
1931
@dbus.service.signal(_interface, signature="o")
2255
1932
def ClientAdded(self, objpath):
2270
1947
def GetAllClients(self):
2271
1948
"D-Bus method"
2272
1949
return dbus.Array(c.dbus_object_path
2273
for c in
2274
tcp_server.clients.itervalues())
1950
for c in tcp_server.clients)
2275
1951
2276
1952
@dbus.service.method(_interface,
2277
1953
out_signature="a{oa{sv}}")
2279
1955
"D-Bus method"
2280
1956
return dbus.Dictionary(
2281
1957
((c.dbus_object_path, c.GetAll(""))
2282
for c in tcp_server.clients.itervalues()),
1958
for c in tcp_server.clients),
2283
1959
signature="oa{sv}")
2284
1960
2285
1961
@dbus.service.method(_interface, in_signature="o")
2286
1962
def RemoveClient(self, object_path):
2287
1963
"D-Bus method"
2288
for c in tcp_server.clients.itervalues():
1964
for c in tcp_server.clients:
2289
1965
if c.dbus_object_path == object_path:
2290
del tcp_server.clients[c.name]
1966
tcp_server.clients.remove(c)
2291
1967
c.remove_from_connection()
2292
1968
# Don't signal anything except ClientRemoved
2293
1969
c.disable(quiet=True)
2298
1974
2299
1975
del _interface
2300
1976
2301
class MandosDBusServiceTransitional(MandosDBusService):
2302
__metaclass__ = AlternateDBusNamesMetaclass
2303
mandos_dbus_service = MandosDBusServiceTransitional()
1977
mandos_dbus_service = MandosDBusService()
2304
1978
2305
1979
def cleanup():
2306
1980
"Cleanup function; run on exit"
2307
1981
service.cleanup()
2308
1982
2309
multiprocessing.active_children()
2310
if not (tcp_server.clients or client_settings):
2311
return
2312
2313
# Store client before exiting. Secrets are encrypted with key
2314
# based on what config file has. If config file is
2315
# removed/edited, old secret will thus be unrecovable.
2316
clients = []
2317
for client in tcp_server.clients.itervalues():
2318
client.encrypt_secret(
2319
client_settings[client.name]["secret"])
2320
2321
client_dict = {}
2322
2323
# A list of attributes that will not be stored when
2324
# shutting down.
2325
exclude = set(("bus", "changedstate", "secret"))
2326
for name, typ in inspect.getmembers(dbus.service.Object):
2327
exclude.add(name)
2328
2329
client_dict["encrypted_secret"] = client.encrypted_secret
2330
for attr in client.client_structure:
2331
if attr not in exclude:
2332
client_dict[attr] = getattr(client, attr)
2333
2334
clients.append(client_dict)
2335
del client_settings[client.name]["secret"]
2336
2337
try:
2338
with os.fdopen(os.open(stored_state_path,
2339
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2340
stat.S_IRUSR | stat.S_IWUSR),
2341
"wb") as stored_state:
2342
pickle.dump((clients, client_settings), stored_state)
2343
except IOError as e:
2344
logger.warning("Could not save persistant state: {0}"
2345
.format(e))
2346
if e.errno != errno.ENOENT:
2347
raise
2348
2349
# Delete all clients, and settings from config
2350
1983
while tcp_server.clients:
2351
name, client = tcp_server.clients.popitem()
1984
client = tcp_server.clients.pop()
2352
1985
if use_dbus:
2353
1986
client.remove_from_connection()
1987
client.disable_hook = None
2354
1988
# Don't signal anything except ClientRemoved
2355
1989
client.disable(quiet=True)
2356
1990
if use_dbus:
2357
1991
# Emit D-Bus signal
2358
mandos_dbus_service.ClientRemoved(client
2359
.dbus_object_path,
1992
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2360
1993
client.name)
2361
client_settings.clear()
2362
1994
2363
1995
atexit.register(cleanup)
2364
1996
2365
for client in tcp_server.clients.itervalues():
1997
for client in tcp_server.clients:
2366
1998
if use_dbus:
2367
1999
# Emit D-Bus signal
2368
2000
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2369
# Need to initiate checking of clients
2370
if client.enabled:
2371
client.init_checker()
2372
2001
client.enable()
2373
2002
2374
2003
tcp_server.enable()
2375
2004
tcp_server.server_activate()
2390
2019
# From the Avahi example code
2391
2020
try:
2392
2021
service.activate()
2393
except dbus.exceptions.DBusException as error:
2022
except dbus.exceptions.DBusException, error:
2394
2023
logger.critical("DBusException: %s", error)
2395
2024
cleanup()
2396
2025
sys.exit(1)
2403
2032
2404
2033
logger.debug("Starting main loop")
2405
2034
main_loop.run()
2406
except AvahiError as error:
2035
except AvahiError, error:
2407
2036
logger.critical("AvahiError: %s", error)
2408
2037
cleanup()
2409
2038
sys.exit(1)
2415
2044
# Must run before the D-Bus bus name gets deregistered
2416
2045
cleanup()
2417
2046
2418
2419
2047
if __name__ == '__main__':
2420
2048
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0