To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 470
- compare with another revision
- download diff
- download tarball
- view history from revision 470
- Committer: Teddy Hogeborn
- Date: 2011-03-01 20:35:04 UTC
- mfrom: (469.1.1 mandos-local)
- Revision ID: teddy@fukt.bsnet.se-20110301203504-2sp5wiq74jz1rl80
* plugins.d/password-prompt.c: Some white space fixes. Break some
long lines. Add more debug output.
long lines. Add more debug output.
- files removed:
- debian/source/local-options
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
37
import SocketServer as socketserver
40
38
import socket
41
import argparse
39
import optparse
42
40
import datetime
43
41
import errno
44
42
import gnutls.crypto
64
62
import functools
65
63
import cPickle as pickle
66
64
import multiprocessing
67
import types
68
import binascii
69
import tempfile
70
import itertools
71
65
72
66
import dbus
73
67
import dbus.service
78
72
import ctypes.util
79
73
import xml.dom.minidom
80
74
import inspect
81
import GnuPGInterface
82
75
83
76
try:
84
77
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
81
except ImportError:
89
82
SO_BINDTODEVICE = None
90
83
91
version = "1.5.3"
92
stored_state_file = "clients.pickle"
93
94
logger = logging.getLogger()
84
85
version = "1.2.3"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
95
89
syslogger = (logging.handlers.SysLogHandler
96
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
91
address = str("/dev/log")))
98
99
try:
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
103
except (OSError, AttributeError):
104
def if_nametoindex(interface):
105
"Get an interface index the hard way, i.e. using fcntl()"
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
with contextlib.closing(socket.socket()) as s:
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
113
return interface_index
114
115
116
def initlogger(debug, level=logging.WARNING):
117
"""init logger and add loglevel"""
118
119
syslogger.setFormatter(logging.Formatter
120
('Mandos [%(process)d]: %(levelname)s:'
121
' %(message)s'))
122
logger.addHandler(syslogger)
123
124
if debug:
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
' [%(process)d]:'
128
' %(levelname)s:'
129
' %(message)s'))
130
logger.addHandler(console)
131
logger.setLevel(level)
132
133
134
class PGPError(Exception):
135
"""Exception if encryption/decryption fails"""
136
pass
137
138
139
class PGPEngine(object):
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
141
def __init__(self):
142
self.gnupg = GnuPGInterface.GnuPG()
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
148
'--quiet',
149
'--no-use-agent'])
150
151
def __enter__(self):
152
return self
153
154
def __exit__ (self, exc_type, exc_value, traceback):
155
self._cleanup()
156
return False
157
158
def __del__(self):
159
self._cleanup()
160
161
def _cleanup(self):
162
if self.tempdir is not None:
163
# Delete contents of tempdir
164
for root, dirs, files in os.walk(self.tempdir,
165
topdown = False):
166
for filename in files:
167
os.remove(os.path.join(root, filename))
168
for dirname in dirs:
169
os.rmdir(os.path.join(root, dirname))
170
# Remove tempdir
171
os.rmdir(self.tempdir)
172
self.tempdir = None
173
174
def password_encode(self, password):
175
# Passphrase can not be empty and can not contain newlines or
176
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
178
179
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
182
try:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
187
f.write(data)
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
190
proc.wait()
191
except IOError as e:
192
raise PGPError(e)
193
self.gnupg.passphrase = None
194
return ciphertext
195
196
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
199
try:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
204
f.write(data)
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
207
proc.wait()
208
except IOError as e:
209
raise PGPError(e)
210
self.gnupg.passphrase = None
211
return decrypted_plaintext
212
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
95
logger.addHandler(syslogger)
96
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
101
logger.addHandler(console)
213
102
214
103
class AvahiError(Exception):
215
104
def __init__(self, value, *args, **kwargs):
245
134
server: D-Bus Server
246
135
bus: dbus.SystemBus()
247
136
"""
248
249
137
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
138
servicetype = None, port = None, TXT = None,
251
139
domain = "", host = "", max_renames = 32768,
263
151
self.group = None # our entry group
264
152
self.server = None
265
153
self.bus = bus
266
self.entry_group_state_changed_match = None
267
268
154
def rename(self):
269
155
"""Derived from the Avahi example code"""
270
156
if self.rename_count >= self.max_renames:
272
158
" after %i retries, exiting.",
273
159
self.rename_count)
274
160
raise AvahiServiceError("Too many renames")
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
161
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
277
162
logger.info("Changing Zeroconf service name to %r ...",
278
163
self.name)
164
syslogger.setFormatter(logging.Formatter
165
('Mandos (%s) [%%(process)d]:'
166
' %%(levelname)s: %%(message)s'
167
% self.name))
279
168
self.remove()
280
169
try:
281
170
self.add()
282
except dbus.exceptions.DBusException as error:
283
logger.critical("D-Bus Exception", exc_info=error)
171
except dbus.exceptions.DBusException, error:
172
logger.critical("DBusException: %s", error)
284
173
self.cleanup()
285
174
os._exit(1)
286
175
self.rename_count += 1
287
288
176
def remove(self):
289
177
"""Derived from the Avahi example code"""
290
if self.entry_group_state_changed_match is not None:
291
self.entry_group_state_changed_match.remove()
292
self.entry_group_state_changed_match = None
293
178
if self.group is not None:
294
179
self.group.Reset()
295
296
180
def add(self):
297
181
"""Derived from the Avahi example code"""
298
self.remove()
299
182
if self.group is None:
300
183
self.group = dbus.Interface(
301
184
self.bus.get_object(avahi.DBUS_NAME,
302
185
self.server.EntryGroupNew()),
303
186
avahi.DBUS_INTERFACE_ENTRY_GROUP)
304
self.entry_group_state_changed_match = (
305
self.group.connect_to_signal(
306
'StateChanged', self.entry_group_state_changed))
187
self.group.connect_to_signal('StateChanged',
188
self
189
.entry_group_state_changed)
307
190
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
308
191
self.name, self.type)
309
192
self.group.AddService(
315
198
dbus.UInt16(self.port),
316
199
avahi.string_array_to_txt_array(self.TXT))
317
200
self.group.Commit()
318
319
201
def entry_group_state_changed(self, state, error):
320
202
"""Derived from the Avahi example code"""
321
203
logger.debug("Avahi entry group state change: %i", state)
328
210
elif state == avahi.ENTRY_GROUP_FAILURE:
329
211
logger.critical("Avahi: Error in group state changed %s",
330
212
unicode(error))
331
raise AvahiGroupError("State changed: {0!s}"
332
.format(error))
333
213
raise AvahiGroupError("State changed: %s"
214
% unicode(error))
334
215
def cleanup(self):
335
216
"""Derived from the Avahi example code"""
336
217
if self.group is not None:
337
try:
338
self.group.Free()
339
except (dbus.exceptions.UnknownMethodException,
340
dbus.exceptions.DBusException):
341
pass
218
self.group.Free()
342
219
self.group = None
343
self.remove()
344
345
def server_state_changed(self, state, error=None):
220
def server_state_changed(self, state):
346
221
"""Derived from the Avahi example code"""
347
222
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
355
if state in bad_states:
356
if bad_states[state] is not None:
357
if error is None:
358
logger.error(bad_states[state])
359
else:
360
logger.error(bad_states[state] + ": %r", error)
361
self.cleanup()
223
if state == avahi.SERVER_COLLISION:
224
logger.error("Zeroconf server name collision")
225
self.remove()
362
226
elif state == avahi.SERVER_RUNNING:
363
227
self.add()
364
else:
365
if error is None:
366
logger.debug("Unknown state: %r", state)
367
else:
368
logger.debug("Unknown state: %r: %r", state, error)
369
370
228
def activate(self):
371
229
"""Derived from the Avahi example code"""
372
230
if self.server is None:
373
231
self.server = dbus.Interface(
374
232
self.bus.get_object(avahi.DBUS_NAME,
375
avahi.DBUS_PATH_SERVER,
376
follow_name_owner_changes=True),
233
avahi.DBUS_PATH_SERVER),
377
234
avahi.DBUS_INTERFACE_SERVER)
378
235
self.server.connect_to_signal("StateChanged",
379
236
self.server_state_changed)
380
237
self.server_state_changed(self.server.GetState())
381
238
382
239
383
class AvahiServiceToSyslog(AvahiService):
384
def rename(self):
385
"""Add the new name to the syslog messages"""
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
390
.format(self.name)))
391
return ret
392
393
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
399
400
401
240
class Client(object):
402
241
"""A representation of a client host served by this server.
403
242
404
243
Attributes:
405
approved: bool(); 'None' if not yet approved/disapproved
244
_approved: bool(); 'None' if not yet approved/disapproved
406
245
approval_delay: datetime.timedelta(); Time to wait for approval
407
246
approval_duration: datetime.timedelta(); Duration of one approval
408
247
checker: subprocess.Popen(); a running checker process used
415
254
instance %(name)s can be used in the command.
416
255
checker_initiator_tag: a gobject event source tag, or None
417
256
created: datetime.datetime(); (UTC) object creation
418
client_structure: Object describing what attributes a client has
419
and is used for storing the client at exit
420
257
current_checker_command: string; current running checker_command
258
disable_hook: If set, called by disable() as disable_hook(self)
421
259
disable_initiator_tag: a gobject event source tag, or None
422
260
enabled: bool()
423
261
fingerprint: string (40 or 32 hexadecimal digits); used to
426
264
interval: datetime.timedelta(); How often to start a new checker
427
265
last_approval_request: datetime.datetime(); (UTC) or None
428
266
last_checked_ok: datetime.datetime(); (UTC) or None
429
last_checker_status: integer between 0 and 255 reflecting exit
430
status of last checker. -1 reflects crashed
431
checker, -2 means no checker completed yet.
432
last_enabled: datetime.datetime(); (UTC) or None
267
last_enabled: datetime.datetime(); (UTC)
433
268
name: string; from the config file, used in log messages and
434
269
D-Bus identifiers
435
270
secret: bytestring; sent verbatim (over TLS) to client
436
271
timeout: datetime.timedelta(); How long from last_checked_ok
437
272
until this client is disabled
438
extended_timeout: extra long timeout when secret has been sent
439
273
runtime_expansions: Allowed attributes for runtime expansion.
440
expires: datetime.datetime(); time (UTC) when a client will be
441
disabled, or None
442
274
"""
443
275
444
276
runtime_expansions = ("approval_delay", "approval_duration",
445
277
"created", "enabled", "fingerprint",
446
278
"host", "interval", "last_checked_ok",
447
279
"last_enabled", "name", "timeout")
448
client_defaults = { "timeout": "5m",
449
"extended_timeout": "15m",
450
"interval": "2m",
451
"checker": "fping -q -- %%(host)s",
452
"host": "",
453
"approval_delay": "0s",
454
"approval_duration": "1s",
455
"approved_by_default": "True",
456
"enabled": "True",
457
}
280
281
@staticmethod
282
def _timedelta_to_milliseconds(td):
283
"Convert a datetime.timedelta() to milliseconds"
284
return ((td.days * 24 * 60 * 60 * 1000)
285
+ (td.seconds * 1000)
286
+ (td.microseconds // 1000))
458
287
459
288
def timeout_milliseconds(self):
460
289
"Return the 'timeout' attribute in milliseconds"
461
return timedelta_to_milliseconds(self.timeout)
462
463
def extended_timeout_milliseconds(self):
464
"Return the 'extended_timeout' attribute in milliseconds"
465
return timedelta_to_milliseconds(self.extended_timeout)
290
return self._timedelta_to_milliseconds(self.timeout)
466
291
467
292
def interval_milliseconds(self):
468
293
"Return the 'interval' attribute in milliseconds"
469
return timedelta_to_milliseconds(self.interval)
470
294
return self._timedelta_to_milliseconds(self.interval)
295
471
296
def approval_delay_milliseconds(self):
472
return timedelta_to_milliseconds(self.approval_delay)
473
474
@staticmethod
475
def config_parser(config):
476
"""Construct a new dict of client settings of this form:
477
{ client_name: {setting_name: value, ...}, ...}
478
with exceptions for any special settings as defined above.
479
NOTE: Must be a pure function. Must return the same result
480
value given the same arguments.
481
"""
482
settings = {}
483
for client_name in config.sections():
484
section = dict(config.items(client_name))
485
client = settings[client_name] = {}
486
487
client["host"] = section["host"]
488
# Reformat values from string types to Python types
489
client["approved_by_default"] = config.getboolean(
490
client_name, "approved_by_default")
491
client["enabled"] = config.getboolean(client_name,
492
"enabled")
493
494
client["fingerprint"] = (section["fingerprint"].upper()
495
.replace(" ", ""))
496
if "secret" in section:
497
client["secret"] = section["secret"].decode("base64")
498
elif "secfile" in section:
499
with open(os.path.expanduser(os.path.expandvars
500
(section["secfile"])),
501
"rb") as secfile:
502
client["secret"] = secfile.read()
503
else:
504
raise TypeError("No secret or secfile for section {0}"
505
.format(section))
506
client["timeout"] = string_to_delta(section["timeout"])
507
client["extended_timeout"] = string_to_delta(
508
section["extended_timeout"])
509
client["interval"] = string_to_delta(section["interval"])
510
client["approval_delay"] = string_to_delta(
511
section["approval_delay"])
512
client["approval_duration"] = string_to_delta(
513
section["approval_duration"])
514
client["checker_command"] = section["checker"]
515
client["last_approval_request"] = None
516
client["last_checked_ok"] = None
517
client["last_checker_status"] = -2
518
519
return settings
520
521
def __init__(self, settings, name = None):
297
return self._timedelta_to_milliseconds(self.approval_delay)
298
299
def __init__(self, name = None, disable_hook=None, config=None):
300
"""Note: the 'checker' key in 'config' sets the
301
'checker_command' attribute and *not* the 'checker'
302
attribute."""
522
303
self.name = name
523
# adding all client settings
524
for setting, value in settings.iteritems():
525
setattr(self, setting, value)
526
527
if self.enabled:
528
if not hasattr(self, "last_enabled"):
529
self.last_enabled = datetime.datetime.utcnow()
530
if not hasattr(self, "expires"):
531
self.expires = (datetime.datetime.utcnow()
532
+ self.timeout)
533
else:
534
self.last_enabled = None
535
self.expires = None
536
304
if config is None:
305
config = {}
537
306
logger.debug("Creating client %r", self.name)
538
307
# Uppercase and remove spaces from fingerprint for later
539
308
# comparison purposes with return value from the fingerprint()
540
309
# function
310
self.fingerprint = (config["fingerprint"].upper()
311
.replace(" ", ""))
541
312
logger.debug(" Fingerprint: %s", self.fingerprint)
542
self.created = settings.get("created",
543
datetime.datetime.utcnow())
544
545
# attributes specific for this server instance
313
if "secret" in config:
314
self.secret = config["secret"].decode("base64")
315
elif "secfile" in config:
316
with open(os.path.expanduser(os.path.expandvars
317
(config["secfile"])),
318
"rb") as secfile:
319
self.secret = secfile.read()
320
else:
321
raise TypeError("No secret or secfile for client %s"
322
% self.name)
323
self.host = config.get("host", "")
324
self.created = datetime.datetime.utcnow()
325
self.enabled = False
326
self.last_approval_request = None
327
self.last_enabled = None
328
self.last_checked_ok = None
329
self.timeout = string_to_delta(config["timeout"])
330
self.interval = string_to_delta(config["interval"])
331
self.disable_hook = disable_hook
546
332
self.checker = None
547
333
self.checker_initiator_tag = None
548
334
self.disable_initiator_tag = None
549
335
self.checker_callback_tag = None
336
self.checker_command = config["checker"]
550
337
self.current_checker_command = None
551
self.approved = None
338
self.last_connect = None
339
self._approved = None
340
self.approved_by_default = config.get("approved_by_default",
341
True)
552
342
self.approvals_pending = 0
553
self.changedstate = (multiprocessing_manager
554
.Condition(multiprocessing_manager
555
.Lock()))
556
self.client_structure = [attr for attr in
557
self.__dict__.iterkeys()
558
if not attr.startswith("_")]
559
self.client_structure.append("client_structure")
560
561
for name, t in inspect.getmembers(type(self),
562
lambda obj:
563
isinstance(obj,
564
property)):
565
if not name.startswith("_"):
566
self.client_structure.append(name)
343
self.approval_delay = string_to_delta(
344
config["approval_delay"])
345
self.approval_duration = string_to_delta(
346
config["approval_duration"])
347
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
567
348
568
# Send notice to process children that client state has changed
569
349
def send_changedstate(self):
570
with self.changedstate:
571
self.changedstate.notify_all()
572
350
self.changedstate.acquire()
351
self.changedstate.notify_all()
352
self.changedstate.release()
353
573
354
def enable(self):
574
355
"""Start this client's checker and timeout hooks"""
575
356
if getattr(self, "enabled", False):
576
357
# Already enabled
577
358
return
578
self.expires = datetime.datetime.utcnow() + self.timeout
579
self.enabled = True
359
self.send_changedstate()
580
360
self.last_enabled = datetime.datetime.utcnow()
581
self.init_checker()
582
self.send_changedstate()
583
584
def disable(self, quiet=True):
585
"""Disable this client."""
586
if not getattr(self, "enabled", False):
587
return False
588
if not quiet:
589
logger.info("Disabling client %s", self.name)
590
if getattr(self, "disable_initiator_tag", None) is not None:
591
gobject.source_remove(self.disable_initiator_tag)
592
self.disable_initiator_tag = None
593
self.expires = None
594
if getattr(self, "checker_initiator_tag", None) is not None:
595
gobject.source_remove(self.checker_initiator_tag)
596
self.checker_initiator_tag = None
597
self.stop_checker()
598
self.enabled = False
599
if not quiet:
600
self.send_changedstate()
601
# Do not run this again if called by a gobject.timeout_add
602
return False
603
604
def __del__(self):
605
self.disable()
606
607
def init_checker(self):
608
361
# Schedule a new checker to be started an 'interval' from now,
609
362
# and every interval from then on.
610
if self.checker_initiator_tag is not None:
611
gobject.source_remove(self.checker_initiator_tag)
612
363
self.checker_initiator_tag = (gobject.timeout_add
613
364
(self.interval_milliseconds(),
614
365
self.start_checker))
615
366
# Schedule a disable() when 'timeout' has passed
616
if self.disable_initiator_tag is not None:
617
gobject.source_remove(self.disable_initiator_tag)
618
367
self.disable_initiator_tag = (gobject.timeout_add
619
368
(self.timeout_milliseconds(),
620
369
self.disable))
370
self.enabled = True
621
371
# Also start a new checker *right now*.
622
372
self.start_checker()
623
373
374
def disable(self, quiet=True):
375
"""Disable this client."""
376
if not getattr(self, "enabled", False):
377
return False
378
if not quiet:
379
self.send_changedstate()
380
if not quiet:
381
logger.info("Disabling client %s", self.name)
382
if getattr(self, "disable_initiator_tag", False):
383
gobject.source_remove(self.disable_initiator_tag)
384
self.disable_initiator_tag = None
385
if getattr(self, "checker_initiator_tag", False):
386
gobject.source_remove(self.checker_initiator_tag)
387
self.checker_initiator_tag = None
388
self.stop_checker()
389
if self.disable_hook:
390
self.disable_hook(self)
391
self.enabled = False
392
# Do not run this again if called by a gobject.timeout_add
393
return False
394
395
def __del__(self):
396
self.disable_hook = None
397
self.disable()
398
624
399
def checker_callback(self, pid, condition, command):
625
400
"""The checker has completed, so take appropriate actions."""
626
401
self.checker_callback_tag = None
627
402
self.checker = None
628
403
if os.WIFEXITED(condition):
629
self.last_checker_status = os.WEXITSTATUS(condition)
630
if self.last_checker_status == 0:
404
exitstatus = os.WEXITSTATUS(condition)
405
if exitstatus == 0:
631
406
logger.info("Checker for %(name)s succeeded",
632
407
vars(self))
633
408
self.checked_ok()
635
410
logger.info("Checker for %(name)s failed",
636
411
vars(self))
637
412
else:
638
self.last_checker_status = -1
639
413
logger.warning("Checker for %(name)s crashed?",
640
414
vars(self))
641
415
642
416
def checked_ok(self):
643
"""Assert that the client has been seen, alive and well."""
417
"""Bump up the timeout for this client.
418
419
This should only be called when the client has been seen,
420
alive and well.
421
"""
644
422
self.last_checked_ok = datetime.datetime.utcnow()
645
self.last_checker_status = 0
646
self.bump_timeout()
647
648
def bump_timeout(self, timeout=None):
649
"""Bump up the timeout for this client."""
650
if timeout is None:
651
timeout = self.timeout
652
if self.disable_initiator_tag is not None:
653
gobject.source_remove(self.disable_initiator_tag)
654
self.disable_initiator_tag = None
655
if getattr(self, "enabled", False):
656
self.disable_initiator_tag = (gobject.timeout_add
657
(timedelta_to_milliseconds
658
(timeout), self.disable))
659
self.expires = datetime.datetime.utcnow() + timeout
423
gobject.source_remove(self.disable_initiator_tag)
424
self.disable_initiator_tag = (gobject.timeout_add
425
(self.timeout_milliseconds(),
426
self.disable))
660
427
661
428
def need_approval(self):
662
429
self.last_approval_request = datetime.datetime.utcnow()
667
434
If a checker already exists, leave it running and do
668
435
nothing."""
669
436
# The reason for not killing a running checker is that if we
670
# did that, and if a checker (for some reason) started running
671
# slowly and taking more than 'interval' time, then the client
672
# would inevitably timeout, since no checker would get a
673
# chance to run to completion. If we instead leave running
437
# did that, then if a checker (for some reason) started
438
# running slowly and taking more than 'interval' time, the
439
# client would inevitably timeout, since no checker would get
440
# a chance to run to completion. If we instead leave running
674
441
# checkers alone, the checker would have to take more time
675
442
# than 'timeout' for the client to be disabled, which is as it
676
443
# should be.
678
445
# If a checker exists, make sure it is not a zombie
679
446
try:
680
447
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
681
except (AttributeError, OSError) as error:
448
except (AttributeError, OSError), error:
682
449
if (isinstance(error, OSError)
683
450
and error.errno != errno.ECHILD):
684
451
raise error
702
469
'replace')))
703
470
for attr in
704
471
self.runtime_expansions)
705
472
706
473
try:
707
474
command = self.checker_command % escaped_attrs
708
except TypeError as error:
709
logger.error('Could not format string "%s"',
710
self.checker_command, exc_info=error)
475
except TypeError, error:
476
logger.error('Could not format string "%s":'
477
' %s', self.checker_command, error)
711
478
return True # Try again later
712
479
self.current_checker_command = command
713
480
try:
730
497
if pid:
731
498
gobject.source_remove(self.checker_callback_tag)
732
499
self.checker_callback(pid, status, command)
733
except OSError as error:
734
logger.error("Failed to start subprocess",
735
exc_info=error)
500
except OSError, error:
501
logger.error("Failed to start subprocess: %s",
502
error)
736
503
# Re-run this periodically if run by gobject.timeout_add
737
504
return True
738
505
745
512
return
746
513
logger.debug("Stopping checker for %(name)s", vars(self))
747
514
try:
748
self.checker.terminate()
515
os.kill(self.checker.pid, signal.SIGTERM)
749
516
#time.sleep(0.5)
750
517
#if self.checker.poll() is None:
751
# self.checker.kill()
752
except OSError as error:
518
# os.kill(self.checker.pid, signal.SIGKILL)
519
except OSError, error:
753
520
if error.errno != errno.ESRCH: # No such process
754
521
raise
755
522
self.checker = None
756
523
757
758
524
def dbus_service_property(dbus_interface, signature="v",
759
525
access="readwrite", byte_arrays=False):
760
526
"""Decorators for marking methods of a DBusObjectWithProperties to
771
537
# "Set" method, so we fail early here:
772
538
if byte_arrays and signature != "ay":
773
539
raise ValueError("Byte arrays not supported for non-'ay'"
774
" signature {0!r}".format(signature))
540
" signature %r" % signature)
775
541
def decorator(func):
776
542
func._dbus_is_property = True
777
543
func._dbus_interface = dbus_interface
785
551
return decorator
786
552
787
553
788
def dbus_interface_annotations(dbus_interface):
789
"""Decorator for marking functions returning interface annotations
790
791
Usage:
792
793
@dbus_interface_annotations("org.example.Interface")
794
def _foo(self): # Function name does not matter
795
return {"org.freedesktop.DBus.Deprecated": "true",
796
"org.freedesktop.DBus.Property.EmitsChangedSignal":
797
"false"}
798
"""
799
def decorator(func):
800
func._dbus_is_interface = True
801
func._dbus_interface = dbus_interface
802
func._dbus_name = dbus_interface
803
return func
804
return decorator
805
806
807
def dbus_annotations(annotations):
808
"""Decorator to annotate D-Bus methods, signals or properties
809
Usage:
810
811
@dbus_service_property("org.example.Interface", signature="b",
812
access="r")
813
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
814
"org.freedesktop.DBus.Property."
815
"EmitsChangedSignal": "false"})
816
def Property_dbus_property(self):
817
return dbus.Boolean(False)
818
"""
819
def decorator(func):
820
func._dbus_annotations = annotations
821
return func
822
return decorator
823
824
825
554
class DBusPropertyException(dbus.exceptions.DBusException):
826
555
"""A base class for D-Bus property-related exceptions
827
556
"""
843
572
844
573
class DBusObjectWithProperties(dbus.service.Object):
845
574
"""A D-Bus object with properties.
846
575
847
576
Classes inheriting from this can use the dbus_service_property
848
577
decorator to expose methods as D-Bus properties. It exposes the
849
578
standard Get(), Set(), and GetAll() methods on the D-Bus.
850
579
"""
851
580
852
581
@staticmethod
853
def _is_dbus_thing(thing):
854
"""Returns a function testing if an attribute is a D-Bus thing
855
856
If called like _is_dbus_thing("method") it returns a function
857
suitable for use as predicate to inspect.getmembers().
858
"""
859
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
860
False)
582
def _is_dbus_property(obj):
583
return getattr(obj, "_dbus_is_property", False)
861
584
862
def _get_all_dbus_things(self, thing):
585
def _get_all_dbus_properties(self):
863
586
"""Returns a generator of (name, attribute) pairs
864
587
"""
865
return ((getattr(athing.__get__(self), "_dbus_name",
866
name),
867
athing.__get__(self))
868
for cls in self.__class__.__mro__
869
for name, athing in
870
inspect.getmembers(cls,
871
self._is_dbus_thing(thing)))
588
return ((prop._dbus_name, prop)
589
for name, prop in
590
inspect.getmembers(self, self._is_dbus_property))
872
591
873
592
def _get_dbus_property(self, interface_name, property_name):
874
593
"""Returns a bound method if one exists which is a D-Bus
875
594
property with the specified name and interface.
876
595
"""
877
for cls in self.__class__.__mro__:
878
for name, value in (inspect.getmembers
879
(cls,
880
self._is_dbus_thing("property"))):
881
if (value._dbus_name == property_name
882
and value._dbus_interface == interface_name):
883
return value.__get__(self)
884
596
for name in (property_name,
597
property_name + "_dbus_property"):
598
prop = getattr(self, name, None)
599
if (prop is None
600
or not self._is_dbus_property(prop)
601
or prop._dbus_name != property_name
602
or (interface_name and prop._dbus_interface
603
and interface_name != prop._dbus_interface)):
604
continue
605
return prop
885
606
# No such property
886
607
raise DBusPropertyNotFound(self.dbus_object_path + ":"
887
608
+ interface_name + "."
912
633
# signatures other than "ay".
913
634
if prop._dbus_signature != "ay":
914
635
raise ValueError
915
value = dbus.ByteArray(b''.join(chr(byte)
916
for byte in value))
636
value = dbus.ByteArray(''.join(unichr(byte)
637
for byte in value))
917
638
prop(value)
918
639
919
640
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
921
642
def GetAll(self, interface_name):
922
643
"""Standard D-Bus property GetAll() method, see D-Bus
923
644
standard.
924
645
925
646
Note: Will not include properties with access="write".
926
647
"""
927
properties = {}
928
for name, prop in self._get_all_dbus_things("property"):
648
all = {}
649
for name, prop in self._get_all_dbus_properties():
929
650
if (interface_name
930
651
and interface_name != prop._dbus_interface):
931
652
# Interface non-empty but did not match
935
656
continue
936
657
value = prop()
937
658
if not hasattr(value, "variant_level"):
938
properties[name] = value
659
all[name] = value
939
660
continue
940
properties[name] = type(value)(value, variant_level=
941
value.variant_level+1)
942
return dbus.Dictionary(properties, signature="sv")
661
all[name] = type(value)(value, variant_level=
662
value.variant_level+1)
663
return dbus.Dictionary(all, signature="sv")
943
664
944
665
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
945
666
out_signature="s",
946
667
path_keyword='object_path',
947
668
connection_keyword='connection')
948
669
def Introspect(self, object_path, connection):
949
"""Overloading of standard D-Bus method.
950
951
Inserts property tags and interface annotation tags.
670
"""Standard D-Bus method, overloaded to insert property tags.
952
671
"""
953
672
xmlstring = dbus.service.Object.Introspect(self, object_path,
954
673
connection)
961
680
e.setAttribute("access", prop._dbus_access)
962
681
return e
963
682
for if_tag in document.getElementsByTagName("interface"):
964
# Add property tags
965
683
for tag in (make_tag(document, name, prop)
966
684
for name, prop
967
in self._get_all_dbus_things("property")
685
in self._get_all_dbus_properties()
968
686
if prop._dbus_interface
969
687
== if_tag.getAttribute("name")):
970
688
if_tag.appendChild(tag)
971
# Add annotation tags
972
for typ in ("method", "signal", "property"):
973
for tag in if_tag.getElementsByTagName(typ):
974
annots = dict()
975
for name, prop in (self.
976
_get_all_dbus_things(typ)):
977
if (name == tag.getAttribute("name")
978
and prop._dbus_interface
979
== if_tag.getAttribute("name")):
980
annots.update(getattr
981
(prop,
982
"_dbus_annotations",
983
{}))
984
for name, value in annots.iteritems():
985
ann_tag = document.createElement(
986
"annotation")
987
ann_tag.setAttribute("name", name)
988
ann_tag.setAttribute("value", value)
989
tag.appendChild(ann_tag)
990
# Add interface annotation tags
991
for annotation, value in dict(
992
itertools.chain.from_iterable(
993
annotations().iteritems()
994
for name, annotations in
995
self._get_all_dbus_things("interface")
996
if name == if_tag.getAttribute("name")
997
)).iteritems():
998
ann_tag = document.createElement("annotation")
999
ann_tag.setAttribute("name", annotation)
1000
ann_tag.setAttribute("value", value)
1001
if_tag.appendChild(ann_tag)
1002
689
# Add the names to the return values for the
1003
690
# "org.freedesktop.DBus.Properties" methods
1004
691
if (if_tag.getAttribute("name")
1017
704
xmlstring = document.toxml("utf-8")
1018
705
document.unlink()
1019
706
except (AttributeError, xml.dom.DOMException,
1020
xml.parsers.expat.ExpatError) as error:
707
xml.parsers.expat.ExpatError), error:
1021
708
logger.error("Failed to override Introspection method",
1022
exc_info=error)
709
error)
1023
710
return xmlstring
1024
711
1025
712
1026
def datetime_to_dbus (dt, variant_level=0):
1027
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1028
if dt is None:
1029
return dbus.String("", variant_level = variant_level)
1030
return dbus.String(dt.isoformat(),
1031
variant_level=variant_level)
1032
1033
1034
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1035
"""A class decorator; applied to a subclass of
1036
dbus.service.Object, it will add alternate D-Bus attributes with
1037
interface names according to the "alt_interface_names" mapping.
1038
Usage:
1039
1040
@alternate_dbus_names({"org.example.Interface":
1041
"net.example.AlternateInterface"})
1042
class SampleDBusObject(dbus.service.Object):
1043
@dbus.service.method("org.example.Interface")
1044
def SampleDBusMethod():
1045
pass
1046
1047
The above "SampleDBusMethod" on "SampleDBusObject" will be
1048
reachable via two interfaces: "org.example.Interface" and
1049
"net.example.AlternateInterface", the latter of which will have
1050
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1051
"true", unless "deprecate" is passed with a False value.
1052
1053
This works for methods and signals, and also for D-Bus properties
1054
(from DBusObjectWithProperties) and interfaces (from the
1055
dbus_interface_annotations decorator).
1056
"""
1057
def wrapper(cls):
1058
for orig_interface_name, alt_interface_name in (
1059
alt_interface_names.iteritems()):
1060
attr = {}
1061
interface_names = set()
1062
# Go though all attributes of the class
1063
for attrname, attribute in inspect.getmembers(cls):
1064
# Ignore non-D-Bus attributes, and D-Bus attributes
1065
# with the wrong interface name
1066
if (not hasattr(attribute, "_dbus_interface")
1067
or not attribute._dbus_interface
1068
.startswith(orig_interface_name)):
1069
continue
1070
# Create an alternate D-Bus interface name based on
1071
# the current name
1072
alt_interface = (attribute._dbus_interface
1073
.replace(orig_interface_name,
1074
alt_interface_name))
1075
interface_names.add(alt_interface)
1076
# Is this a D-Bus signal?
1077
if getattr(attribute, "_dbus_is_signal", False):
1078
# Extract the original non-method function by
1079
# black magic
1080
nonmethod_func = (dict(
1081
zip(attribute.func_code.co_freevars,
1082
attribute.__closure__))["func"]
1083
.cell_contents)
1084
# Create a new, but exactly alike, function
1085
# object, and decorate it to be a new D-Bus signal
1086
# with the alternate D-Bus interface name
1087
new_function = (dbus.service.signal
1088
(alt_interface,
1089
attribute._dbus_signature)
1090
(types.FunctionType(
1091
nonmethod_func.func_code,
1092
nonmethod_func.func_globals,
1093
nonmethod_func.func_name,
1094
nonmethod_func.func_defaults,
1095
nonmethod_func.func_closure)))
1096
# Copy annotations, if any
1097
try:
1098
new_function._dbus_annotations = (
1099
dict(attribute._dbus_annotations))
1100
except AttributeError:
1101
pass
1102
# Define a creator of a function to call both the
1103
# original and alternate functions, so both the
1104
# original and alternate signals gets sent when
1105
# the function is called
1106
def fixscope(func1, func2):
1107
"""This function is a scope container to pass
1108
func1 and func2 to the "call_both" function
1109
outside of its arguments"""
1110
def call_both(*args, **kwargs):
1111
"""This function will emit two D-Bus
1112
signals by calling func1 and func2"""
1113
func1(*args, **kwargs)
1114
func2(*args, **kwargs)
1115
return call_both
1116
# Create the "call_both" function and add it to
1117
# the class
1118
attr[attrname] = fixscope(attribute, new_function)
1119
# Is this a D-Bus method?
1120
elif getattr(attribute, "_dbus_is_method", False):
1121
# Create a new, but exactly alike, function
1122
# object. Decorate it to be a new D-Bus method
1123
# with the alternate D-Bus interface name. Add it
1124
# to the class.
1125
attr[attrname] = (dbus.service.method
1126
(alt_interface,
1127
attribute._dbus_in_signature,
1128
attribute._dbus_out_signature)
1129
(types.FunctionType
1130
(attribute.func_code,
1131
attribute.func_globals,
1132
attribute.func_name,
1133
attribute.func_defaults,
1134
attribute.func_closure)))
1135
# Copy annotations, if any
1136
try:
1137
attr[attrname]._dbus_annotations = (
1138
dict(attribute._dbus_annotations))
1139
except AttributeError:
1140
pass
1141
# Is this a D-Bus property?
1142
elif getattr(attribute, "_dbus_is_property", False):
1143
# Create a new, but exactly alike, function
1144
# object, and decorate it to be a new D-Bus
1145
# property with the alternate D-Bus interface
1146
# name. Add it to the class.
1147
attr[attrname] = (dbus_service_property
1148
(alt_interface,
1149
attribute._dbus_signature,
1150
attribute._dbus_access,
1151
attribute
1152
._dbus_get_args_options
1153
["byte_arrays"])
1154
(types.FunctionType
1155
(attribute.func_code,
1156
attribute.func_globals,
1157
attribute.func_name,
1158
attribute.func_defaults,
1159
attribute.func_closure)))
1160
# Copy annotations, if any
1161
try:
1162
attr[attrname]._dbus_annotations = (
1163
dict(attribute._dbus_annotations))
1164
except AttributeError:
1165
pass
1166
# Is this a D-Bus interface?
1167
elif getattr(attribute, "_dbus_is_interface", False):
1168
# Create a new, but exactly alike, function
1169
# object. Decorate it to be a new D-Bus interface
1170
# with the alternate D-Bus interface name. Add it
1171
# to the class.
1172
attr[attrname] = (dbus_interface_annotations
1173
(alt_interface)
1174
(types.FunctionType
1175
(attribute.func_code,
1176
attribute.func_globals,
1177
attribute.func_name,
1178
attribute.func_defaults,
1179
attribute.func_closure)))
1180
if deprecate:
1181
# Deprecate all alternate interfaces
1182
iname="_AlternateDBusNames_interface_annotation{0}"
1183
for interface_name in interface_names:
1184
@dbus_interface_annotations(interface_name)
1185
def func(self):
1186
return { "org.freedesktop.DBus.Deprecated":
1187
"true" }
1188
# Find an unused name
1189
for aname in (iname.format(i)
1190
for i in itertools.count()):
1191
if aname not in attr:
1192
attr[aname] = func
1193
break
1194
if interface_names:
1195
# Replace the class with a new subclass of it with
1196
# methods, signals, etc. as created above.
1197
cls = type(b"{0}Alternate".format(cls.__name__),
1198
(cls,), attr)
1199
return cls
1200
return wrapper
1201
1202
1203
@alternate_dbus_interfaces({"se.recompile.Mandos":
1204
"se.bsnet.fukt.Mandos"})
1205
713
class ClientDBus(Client, DBusObjectWithProperties):
1206
714
"""A Client class using D-Bus
1207
715
1216
724
# dbus.service.Object doesn't use super(), so we can't either.
1217
725
1218
726
def __init__(self, bus = None, *args, **kwargs):
727
self._approvals_pending = 0
1219
728
self.bus = bus
1220
729
Client.__init__(self, *args, **kwargs)
1221
730
# Only now, when this client is initialized, can it show up on
1227
736
("/clients/" + client_object_name))
1228
737
DBusObjectWithProperties.__init__(self, self.bus,
1229
738
self.dbus_object_path)
1230
1231
def notifychangeproperty(transform_func,
1232
dbus_name, type_func=lambda x: x,
1233
variant_level=1):
1234
""" Modify a variable so that it's a property which announces
1235
its changes to DBus.
1236
1237
transform_fun: Function that takes a value and a variant_level
1238
and transforms it to a D-Bus type.
1239
dbus_name: D-Bus name of the variable
1240
type_func: Function that transform the value before sending it
1241
to the D-Bus. Default: no transform
1242
variant_level: D-Bus variant level. Default: 1
1243
"""
1244
attrname = "_{0}".format(dbus_name)
1245
def setter(self, value):
1246
if hasattr(self, "dbus_object_path"):
1247
if (not hasattr(self, attrname) or
1248
type_func(getattr(self, attrname, None))
1249
!= type_func(value)):
1250
dbus_value = transform_func(type_func(value),
1251
variant_level
1252
=variant_level)
1253
self.PropertyChanged(dbus.String(dbus_name),
1254
dbus_value)
1255
setattr(self, attrname, value)
1256
1257
return property(lambda self: getattr(self, attrname), setter)
1258
1259
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1260
approvals_pending = notifychangeproperty(dbus.Boolean,
1261
"ApprovalPending",
1262
type_func = bool)
1263
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1264
last_enabled = notifychangeproperty(datetime_to_dbus,
1265
"LastEnabled")
1266
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1267
type_func = lambda checker:
1268
checker is not None)
1269
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1270
"LastCheckedOK")
1271
last_checker_status = notifychangeproperty(dbus.Int16,
1272
"LastCheckerStatus")
1273
last_approval_request = notifychangeproperty(
1274
datetime_to_dbus, "LastApprovalRequest")
1275
approved_by_default = notifychangeproperty(dbus.Boolean,
1276
"ApprovedByDefault")
1277
approval_delay = notifychangeproperty(dbus.UInt64,
1278
"ApprovalDelay",
1279
type_func =
1280
timedelta_to_milliseconds)
1281
approval_duration = notifychangeproperty(
1282
dbus.UInt64, "ApprovalDuration",
1283
type_func = timedelta_to_milliseconds)
1284
host = notifychangeproperty(dbus.String, "Host")
1285
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1286
type_func =
1287
timedelta_to_milliseconds)
1288
extended_timeout = notifychangeproperty(
1289
dbus.UInt64, "ExtendedTimeout",
1290
type_func = timedelta_to_milliseconds)
1291
interval = notifychangeproperty(dbus.UInt64,
1292
"Interval",
1293
type_func =
1294
timedelta_to_milliseconds)
1295
checker_command = notifychangeproperty(dbus.String, "Checker")
1296
1297
del notifychangeproperty
739
740
def _get_approvals_pending(self):
741
return self._approvals_pending
742
def _set_approvals_pending(self, value):
743
old_value = self._approvals_pending
744
self._approvals_pending = value
745
bval = bool(value)
746
if (hasattr(self, "dbus_object_path")
747
and bval is not bool(old_value)):
748
dbus_bool = dbus.Boolean(bval, variant_level=1)
749
self.PropertyChanged(dbus.String("ApprovalPending"),
750
dbus_bool)
751
752
approvals_pending = property(_get_approvals_pending,
753
_set_approvals_pending)
754
del _get_approvals_pending, _set_approvals_pending
755
756
@staticmethod
757
def _datetime_to_dbus(dt, variant_level=0):
758
"""Convert a UTC datetime.datetime() to a D-Bus type."""
759
return dbus.String(dt.isoformat(),
760
variant_level=variant_level)
761
762
def enable(self):
763
oldstate = getattr(self, "enabled", False)
764
r = Client.enable(self)
765
if oldstate != self.enabled:
766
# Emit D-Bus signals
767
self.PropertyChanged(dbus.String("Enabled"),
768
dbus.Boolean(True, variant_level=1))
769
self.PropertyChanged(
770
dbus.String("LastEnabled"),
771
self._datetime_to_dbus(self.last_enabled,
772
variant_level=1))
773
return r
774
775
def disable(self, quiet = False):
776
oldstate = getattr(self, "enabled", False)
777
r = Client.disable(self, quiet=quiet)
778
if not quiet and oldstate != self.enabled:
779
# Emit D-Bus signal
780
self.PropertyChanged(dbus.String("Enabled"),
781
dbus.Boolean(False, variant_level=1))
782
return r
1298
783
1299
784
def __del__(self, *args, **kwargs):
1300
785
try:
1309
794
*args, **kwargs):
1310
795
self.checker_callback_tag = None
1311
796
self.checker = None
797
# Emit D-Bus signal
798
self.PropertyChanged(dbus.String("CheckerRunning"),
799
dbus.Boolean(False, variant_level=1))
1312
800
if os.WIFEXITED(condition):
1313
801
exitstatus = os.WEXITSTATUS(condition)
1314
802
# Emit D-Bus signal
1324
812
return Client.checker_callback(self, pid, condition, command,
1325
813
*args, **kwargs)
1326
814
815
def checked_ok(self, *args, **kwargs):
816
r = Client.checked_ok(self, *args, **kwargs)
817
# Emit D-Bus signal
818
self.PropertyChanged(
819
dbus.String("LastCheckedOK"),
820
(self._datetime_to_dbus(self.last_checked_ok,
821
variant_level=1)))
822
return r
823
824
def need_approval(self, *args, **kwargs):
825
r = Client.need_approval(self, *args, **kwargs)
826
# Emit D-Bus signal
827
self.PropertyChanged(
828
dbus.String("LastApprovalRequest"),
829
(self._datetime_to_dbus(self.last_approval_request,
830
variant_level=1)))
831
return r
832
1327
833
def start_checker(self, *args, **kwargs):
1328
834
old_checker = self.checker
1329
835
if self.checker is not None:
1336
842
and old_checker_pid != self.checker.pid):
1337
843
# Emit D-Bus signal
1338
844
self.CheckerStarted(self.current_checker_command)
845
self.PropertyChanged(
846
dbus.String("CheckerRunning"),
847
dbus.Boolean(True, variant_level=1))
1339
848
return r
1340
849
850
def stop_checker(self, *args, **kwargs):
851
old_checker = getattr(self, "checker", None)
852
r = Client.stop_checker(self, *args, **kwargs)
853
if (old_checker is not None
854
and getattr(self, "checker", None) is None):
855
self.PropertyChanged(dbus.String("CheckerRunning"),
856
dbus.Boolean(False, variant_level=1))
857
return r
858
1341
859
def _reset_approved(self):
1342
self.approved = None
860
self._approved = None
1343
861
return False
1344
862
1345
863
def approve(self, value=True):
1346
self.approved = value
1347
gobject.timeout_add(timedelta_to_milliseconds
864
self.send_changedstate()
865
self._approved = value
866
gobject.timeout_add(self._timedelta_to_milliseconds
1348
867
(self.approval_duration),
1349
868
self._reset_approved)
1350
self.send_changedstate()
869
1351
870
1352
871
## D-Bus methods, signals & properties
1353
_interface = "se.recompile.Mandos.Client"
1354
1355
## Interfaces
1356
1357
@dbus_interface_annotations(_interface)
1358
def _foo(self):
1359
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1360
"false"}
872
_interface = "se.bsnet.fukt.Mandos.Client"
1361
873
1362
874
## Signals
1363
875
1410
922
# CheckedOK - method
1411
923
@dbus.service.method(_interface)
1412
924
def CheckedOK(self):
1413
self.checked_ok()
925
return self.checked_ok()
1414
926
1415
927
# Enable - method
1416
928
@dbus.service.method(_interface)
1449
961
if value is None: # get
1450
962
return dbus.Boolean(self.approved_by_default)
1451
963
self.approved_by_default = bool(value)
964
# Emit D-Bus signal
965
self.PropertyChanged(dbus.String("ApprovedByDefault"),
966
dbus.Boolean(value, variant_level=1))
1452
967
1453
968
# ApprovalDelay - property
1454
969
@dbus_service_property(_interface, signature="t",
1457
972
if value is None: # get
1458
973
return dbus.UInt64(self.approval_delay_milliseconds())
1459
974
self.approval_delay = datetime.timedelta(0, 0, 0, value)
975
# Emit D-Bus signal
976
self.PropertyChanged(dbus.String("ApprovalDelay"),
977
dbus.UInt64(value, variant_level=1))
1460
978
1461
979
# ApprovalDuration - property
1462
980
@dbus_service_property(_interface, signature="t",
1463
981
access="readwrite")
1464
982
def ApprovalDuration_dbus_property(self, value=None):
1465
983
if value is None: # get
1466
return dbus.UInt64(timedelta_to_milliseconds(
984
return dbus.UInt64(self._timedelta_to_milliseconds(
1467
985
self.approval_duration))
1468
986
self.approval_duration = datetime.timedelta(0, 0, 0, value)
987
# Emit D-Bus signal
988
self.PropertyChanged(dbus.String("ApprovalDuration"),
989
dbus.UInt64(value, variant_level=1))
1469
990
1470
991
# Name - property
1471
992
@dbus_service_property(_interface, signature="s", access="read")
1483
1004
def Host_dbus_property(self, value=None):
1484
1005
if value is None: # get
1485
1006
return dbus.String(self.host)
1486
self.host = unicode(value)
1007
self.host = value
1008
# Emit D-Bus signal
1009
self.PropertyChanged(dbus.String("Host"),
1010
dbus.String(value, variant_level=1))
1487
1011
1488
1012
# Created - property
1489
1013
@dbus_service_property(_interface, signature="s", access="read")
1490
1014
def Created_dbus_property(self):
1491
return datetime_to_dbus(self.created)
1015
return dbus.String(self._datetime_to_dbus(self.created))
1492
1016
1493
1017
# LastEnabled - property
1494
1018
@dbus_service_property(_interface, signature="s", access="read")
1495
1019
def LastEnabled_dbus_property(self):
1496
return datetime_to_dbus(self.last_enabled)
1020
if self.last_enabled is None:
1021
return dbus.String("")
1022
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1497
1023
1498
1024
# Enabled - property
1499
1025
@dbus_service_property(_interface, signature="b",
1513
1039
if value is not None:
1514
1040
self.checked_ok()
1515
1041
return
1516
return datetime_to_dbus(self.last_checked_ok)
1517
1518
# LastCheckerStatus - property
1519
@dbus_service_property(_interface, signature="n",
1520
access="read")
1521
def LastCheckerStatus_dbus_property(self):
1522
return dbus.Int16(self.last_checker_status)
1523
1524
# Expires - property
1525
@dbus_service_property(_interface, signature="s", access="read")
1526
def Expires_dbus_property(self):
1527
return datetime_to_dbus(self.expires)
1042
if self.last_checked_ok is None:
1043
return dbus.String("")
1044
return dbus.String(self._datetime_to_dbus(self
1045
.last_checked_ok))
1528
1046
1529
1047
# LastApprovalRequest - property
1530
1048
@dbus_service_property(_interface, signature="s", access="read")
1531
1049
def LastApprovalRequest_dbus_property(self):
1532
return datetime_to_dbus(self.last_approval_request)
1050
if self.last_approval_request is None:
1051
return dbus.String("")
1052
return dbus.String(self.
1053
_datetime_to_dbus(self
1054
.last_approval_request))
1533
1055
1534
1056
# Timeout - property
1535
1057
@dbus_service_property(_interface, signature="t",
1537
1059
def Timeout_dbus_property(self, value=None):
1538
1060
if value is None: # get
1539
1061
return dbus.UInt64(self.timeout_milliseconds())
1540
old_timeout = self.timeout
1541
1062
self.timeout = datetime.timedelta(0, 0, 0, value)
1542
# Reschedule disabling
1543
if self.enabled:
1544
now = datetime.datetime.utcnow()
1545
self.expires += self.timeout - old_timeout
1546
if self.expires <= now:
1547
# The timeout has passed
1548
self.disable()
1549
else:
1550
if (getattr(self, "disable_initiator_tag", None)
1551
is None):
1552
return
1553
gobject.source_remove(self.disable_initiator_tag)
1554
self.disable_initiator_tag = (
1555
gobject.timeout_add(
1556
timedelta_to_milliseconds(self.expires - now),
1557
self.disable))
1558
1559
# ExtendedTimeout - property
1560
@dbus_service_property(_interface, signature="t",
1561
access="readwrite")
1562
def ExtendedTimeout_dbus_property(self, value=None):
1563
if value is None: # get
1564
return dbus.UInt64(self.extended_timeout_milliseconds())
1565
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1063
# Emit D-Bus signal
1064
self.PropertyChanged(dbus.String("Timeout"),
1065
dbus.UInt64(value, variant_level=1))
1066
if getattr(self, "disable_initiator_tag", None) is None:
1067
return
1068
# Reschedule timeout
1069
gobject.source_remove(self.disable_initiator_tag)
1070
self.disable_initiator_tag = None
1071
time_to_die = (self.
1072
_timedelta_to_milliseconds((self
1073
.last_checked_ok
1074
+ self.timeout)
1075
- datetime.datetime
1076
.utcnow()))
1077
if time_to_die <= 0:
1078
# The timeout has passed
1079
self.disable()
1080
else:
1081
self.disable_initiator_tag = (gobject.timeout_add
1082
(time_to_die, self.disable))
1566
1083
1567
1084
# Interval - property
1568
1085
@dbus_service_property(_interface, signature="t",
1571
1088
if value is None: # get
1572
1089
return dbus.UInt64(self.interval_milliseconds())
1573
1090
self.interval = datetime.timedelta(0, 0, 0, value)
1091
# Emit D-Bus signal
1092
self.PropertyChanged(dbus.String("Interval"),
1093
dbus.UInt64(value, variant_level=1))
1574
1094
if getattr(self, "checker_initiator_tag", None) is None:
1575
1095
return
1576
if self.enabled:
1577
# Reschedule checker run
1578
gobject.source_remove(self.checker_initiator_tag)
1579
self.checker_initiator_tag = (gobject.timeout_add
1580
(value, self.start_checker))
1581
self.start_checker() # Start one now, too
1582
1096
# Reschedule checker run
1097
gobject.source_remove(self.checker_initiator_tag)
1098
self.checker_initiator_tag = (gobject.timeout_add
1099
(value, self.start_checker))
1100
self.start_checker() # Start one now, too
1101
1583
1102
# Checker - property
1584
1103
@dbus_service_property(_interface, signature="s",
1585
1104
access="readwrite")
1586
1105
def Checker_dbus_property(self, value=None):
1587
1106
if value is None: # get
1588
1107
return dbus.String(self.checker_command)
1589
self.checker_command = unicode(value)
1108
self.checker_command = value
1109
# Emit D-Bus signal
1110
self.PropertyChanged(dbus.String("Checker"),
1111
dbus.String(self.checker_command,
1112
variant_level=1))
1590
1113
1591
1114
# CheckerRunning - property
1592
1115
@dbus_service_property(_interface, signature="b",
1619
1142
self._pipe.send(('init', fpr, address))
1620
1143
if not self._pipe.recv():
1621
1144
raise KeyError()
1622
1145
1623
1146
def __getattribute__(self, name):
1624
if name == '_pipe':
1147
if(name == '_pipe'):
1625
1148
return super(ProxyClient, self).__getattribute__(name)
1626
1149
self._pipe.send(('getattr', name))
1627
1150
data = self._pipe.recv()
1632
1155
self._pipe.send(('funcall', name, args, kwargs))
1633
1156
return self._pipe.recv()[1]
1634
1157
return func
1635
1158
1636
1159
def __setattr__(self, name, value):
1637
if name == '_pipe':
1160
if(name == '_pipe'):
1638
1161
return super(ProxyClient, self).__setattr__(name, value)
1639
1162
self._pipe.send(('setattr', name, value))
1640
1163
1651
1174
unicode(self.client_address))
1652
1175
logger.debug("Pipe FD: %d",
1653
1176
self.server.child_pipe.fileno())
1654
1177
1655
1178
session = (gnutls.connection
1656
1179
.ClientSession(self.request,
1657
1180
gnutls.connection
1658
1181
.X509Credentials()))
1659
1182
1660
1183
# Note: gnutls.connection.X509Credentials is really a
1661
1184
# generic GnuTLS certificate credentials object so long as
1662
1185
# no X.509 keys are added to it. Therefore, we can use it
1663
1186
# here despite using OpenPGP certificates.
1664
1187
1665
1188
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1666
1189
# "+AES-256-CBC", "+SHA1",
1667
1190
# "+COMP-NULL", "+CTYPE-OPENPGP",
1673
1196
(gnutls.library.functions
1674
1197
.gnutls_priority_set_direct(session._c_object,
1675
1198
priority, None))
1676
1199
1677
1200
# Start communication using the Mandos protocol
1678
1201
# Get protocol number
1679
1202
line = self.request.makefile().readline()
1681
1204
try:
1682
1205
if int(line.strip().split()[0]) > 1:
1683
1206
raise RuntimeError
1684
except (ValueError, IndexError, RuntimeError) as error:
1207
except (ValueError, IndexError, RuntimeError), error:
1685
1208
logger.error("Unknown protocol version: %s", error)
1686
1209
return
1687
1210
1688
1211
# Start GnuTLS connection
1689
1212
try:
1690
1213
session.handshake()
1691
except gnutls.errors.GNUTLSError as error:
1214
except gnutls.errors.GNUTLSError, error:
1692
1215
logger.warning("Handshake failed: %s", error)
1693
1216
# Do not run session.bye() here: the session is not
1694
1217
# established. Just abandon the request.
1695
1218
return
1696
1219
logger.debug("Handshake succeeded")
1697
1220
1698
1221
approval_required = False
1699
1222
try:
1700
1223
try:
1701
1224
fpr = self.fingerprint(self.peer_certificate
1702
1225
(session))
1703
except (TypeError,
1704
gnutls.errors.GNUTLSError) as error:
1226
except (TypeError, gnutls.errors.GNUTLSError), error:
1705
1227
logger.warning("Bad certificate: %s", error)
1706
1228
return
1707
1229
logger.debug("Fingerprint: %s", fpr)
1708
1230
1709
1231
try:
1710
1232
client = ProxyClient(child_pipe, fpr,
1711
1233
self.client_address)
1719
1241
1720
1242
while True:
1721
1243
if not client.enabled:
1722
logger.info("Client %s is disabled",
1244
logger.warning("Client %s is disabled",
1723
1245
client.name)
1724
1246
if self.server.use_dbus:
1725
1247
# Emit D-Bus signal
1726
client.Rejected("Disabled")
1248
client.Rejected("Disabled")
1727
1249
return
1728
1250
1729
if client.approved or not client.approval_delay:
1251
if client._approved or not client.approval_delay:
1730
1252
#We are approved or approval is disabled
1731
1253
break
1732
elif client.approved is None:
1254
elif client._approved is None:
1733
1255
logger.info("Client %s needs approval",
1734
1256
client.name)
1735
1257
if self.server.use_dbus:
1746
1268
return
1747
1269
1748
1270
#wait until timeout or approved
1271
#x = float(client._timedelta_to_milliseconds(delay))
1749
1272
time = datetime.datetime.now()
1750
1273
client.changedstate.acquire()
1751
client.changedstate.wait(
1752
float(timedelta_to_milliseconds(delay)
1753
/ 1000))
1274
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1754
1275
client.changedstate.release()
1755
1276
time2 = datetime.datetime.now()
1756
1277
if (time2 - time) >= delay:
1771
1292
while sent_size < len(client.secret):
1772
1293
try:
1773
1294
sent = session.send(client.secret[sent_size:])
1774
except gnutls.errors.GNUTLSError as error:
1775
logger.warning("gnutls send failed",
1776
exc_info=error)
1295
except (gnutls.errors.GNUTLSError), error:
1296
logger.warning("gnutls send failed")
1777
1297
return
1778
1298
logger.debug("Sent: %d, remaining: %d",
1779
1299
sent, len(client.secret)
1780
1300
- (sent_size + sent))
1781
1301
sent_size += sent
1782
1302
1783
1303
logger.info("Sending secret to %s", client.name)
1784
# bump the timeout using extended_timeout
1785
client.bump_timeout(client.extended_timeout)
1304
# bump the timeout as if seen
1305
client.checked_ok()
1786
1306
if self.server.use_dbus:
1787
1307
# Emit D-Bus signal
1788
1308
client.GotSecret()
1792
1312
client.approvals_pending -= 1
1793
1313
try:
1794
1314
session.bye()
1795
except gnutls.errors.GNUTLSError as error:
1796
logger.warning("GnuTLS bye failed",
1797
exc_info=error)
1315
except (gnutls.errors.GNUTLSError), error:
1316
logger.warning("GnuTLS bye failed")
1798
1317
1799
1318
@staticmethod
1800
1319
def peer_certificate(session):
1856
1375
# Convert the buffer to a Python bytestring
1857
1376
fpr = ctypes.string_at(buf, buf_len.value)
1858
1377
# Convert the bytestring to hexadecimal notation
1859
hex_fpr = binascii.hexlify(fpr).upper()
1378
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1860
1379
return hex_fpr
1861
1380
1862
1381
1865
1384
def sub_process_main(self, request, address):
1866
1385
try:
1867
1386
self.finish_request(request, address)
1868
except Exception:
1387
except:
1869
1388
self.handle_error(request, address)
1870
1389
self.close_request(request)
1871
1390
1872
1391
def process_request(self, request, address):
1873
1392
"""Start a new process to process the request."""
1874
proc = multiprocessing.Process(target = self.sub_process_main,
1875
args = (request, address))
1876
proc.start()
1877
return proc
1878
1393
multiprocessing.Process(target = self.sub_process_main,
1394
args = (request, address)).start()
1879
1395
1880
1396
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1881
1397
""" adds a pipe to the MixIn """
1885
1401
This function creates a new pipe in self.pipe
1886
1402
"""
1887
1403
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1888
1889
proc = MultiprocessingMixIn.process_request(self, request,
1890
client_address)
1404
1405
super(MultiprocessingMixInWithPipe,
1406
self).process_request(request, client_address)
1891
1407
self.child_pipe.close()
1892
self.add_pipe(parent_pipe, proc)
1893
1894
def add_pipe(self, parent_pipe, proc):
1408
self.add_pipe(parent_pipe)
1409
1410
def add_pipe(self, parent_pipe):
1895
1411
"""Dummy function; override as necessary"""
1896
1412
raise NotImplementedError
1897
1413
1898
1899
1414
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1900
1415
socketserver.TCPServer, object):
1901
1416
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1927
1442
SO_BINDTODEVICE,
1928
1443
str(self.interface
1929
1444
+ '\0'))
1930
except socket.error as error:
1931
if error.errno == errno.EPERM:
1445
except socket.error, error:
1446
if error[0] == errno.EPERM:
1932
1447
logger.error("No permission to"
1933
1448
" bind to interface %s",
1934
1449
self.interface)
1935
elif error.errno == errno.ENOPROTOOPT:
1450
elif error[0] == errno.ENOPROTOOPT:
1936
1451
logger.error("SO_BINDTODEVICE not available;"
1937
1452
" cannot bind to interface %s",
1938
1453
self.interface)
1939
elif error.errno == errno.ENODEV:
1940
logger.error("Interface %s does not"
1941
" exist, cannot bind",
1942
self.interface)
1943
1454
else:
1944
1455
raise
1945
1456
# Only bind(2) the socket if we really need to.
1979
1490
self.enabled = False
1980
1491
self.clients = clients
1981
1492
if self.clients is None:
1982
self.clients = {}
1493
self.clients = set()
1983
1494
self.use_dbus = use_dbus
1984
1495
self.gnutls_priority = gnutls_priority
1985
1496
IPv6_TCPServer.__init__(self, server_address,
1989
1500
def server_activate(self):
1990
1501
if self.enabled:
1991
1502
return socketserver.TCPServer.server_activate(self)
1992
1993
1503
def enable(self):
1994
1504
self.enabled = True
1995
1996
def add_pipe(self, parent_pipe, proc):
1505
def add_pipe(self, parent_pipe):
1997
1506
# Call "handle_ipc" for both data and EOF events
1998
1507
gobject.io_add_watch(parent_pipe.fileno(),
1999
1508
gobject.IO_IN | gobject.IO_HUP,
2000
1509
functools.partial(self.handle_ipc,
2001
parent_pipe =
2002
parent_pipe,
2003
proc = proc))
2004
1510
parent_pipe = parent_pipe))
1511
2005
1512
def handle_ipc(self, source, condition, parent_pipe=None,
2006
proc = None, client_object=None):
2007
# error, or the other end of multiprocessing.Pipe has closed
2008
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2009
# Wait for other process to exit
2010
proc.join()
1513
client_object=None):
1514
condition_names = {
1515
gobject.IO_IN: "IN", # There is data to read.
1516
gobject.IO_OUT: "OUT", # Data can be written (without
1517
# blocking).
1518
gobject.IO_PRI: "PRI", # There is urgent data to read.
1519
gobject.IO_ERR: "ERR", # Error condition.
1520
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1521
# broken, usually for pipes and
1522
# sockets).
1523
}
1524
conditions_string = ' | '.join(name
1525
for cond, name in
1526
condition_names.iteritems()
1527
if cond & condition)
1528
# error or the other end of multiprocessing.Pipe has closed
1529
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2011
1530
return False
2012
1531
2013
1532
# Read a request from the child
2018
1537
fpr = request[1]
2019
1538
address = request[2]
2020
1539
2021
for c in self.clients.itervalues():
1540
for c in self.clients:
2022
1541
if c.fingerprint == fpr:
2023
1542
client = c
2024
1543
break
2025
1544
else:
2026
logger.info("Client not found for fingerprint: %s, ad"
2027
"dress: %s", fpr, address)
1545
logger.warning("Client not found for fingerprint: %s, ad"
1546
"dress: %s", fpr, address)
2028
1547
if self.use_dbus:
2029
1548
# Emit D-Bus signal
2030
mandos_dbus_service.ClientNotFound(fpr,
2031
address[0])
1549
mandos_dbus_service.ClientNotFound(fpr, address[0])
2032
1550
parent_pipe.send(False)
2033
1551
return False
2034
1552
2035
1553
gobject.io_add_watch(parent_pipe.fileno(),
2036
1554
gobject.IO_IN | gobject.IO_HUP,
2037
1555
functools.partial(self.handle_ipc,
2038
parent_pipe =
2039
parent_pipe,
2040
proc = proc,
2041
client_object =
2042
client))
1556
parent_pipe = parent_pipe,
1557
client_object = client))
2043
1558
parent_pipe.send(True)
2044
# remove the old hook in favor of the new above hook on
2045
# same fileno
1559
# remove the old hook in favor of the new above hook on same fileno
2046
1560
return False
2047
1561
if command == 'funcall':
2048
1562
funcname = request[1]
2049
1563
args = request[2]
2050
1564
kwargs = request[3]
2051
1565
2052
parent_pipe.send(('data', getattr(client_object,
2053
funcname)(*args,
2054
**kwargs)))
2055
1566
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1567
2056
1568
if command == 'getattr':
2057
1569
attrname = request[1]
2058
1570
if callable(client_object.__getattribute__(attrname)):
2059
1571
parent_pipe.send(('function',))
2060
1572
else:
2061
parent_pipe.send(('data', client_object
2062
.__getattribute__(attrname)))
1573
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2063
1574
2064
1575
if command == 'setattr':
2065
1576
attrname = request[1]
2066
1577
value = request[2]
2067
1578
setattr(client_object, attrname, value)
2068
1579
2069
1580
return True
2070
1581
2071
1582
2101
1612
elif suffix == "w":
2102
1613
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2103
1614
else:
2104
raise ValueError("Unknown suffix {0!r}"
2105
.format(suffix))
2106
except (ValueError, IndexError) as e:
1615
raise ValueError("Unknown suffix %r" % suffix)
1616
except (ValueError, IndexError), e:
2107
1617
raise ValueError(*(e.args))
2108
1618
timevalue += delta
2109
1619
return timevalue
2110
1620
2111
1621
1622
def if_nametoindex(interface):
1623
"""Call the C function if_nametoindex(), or equivalent
1624
1625
Note: This function cannot accept a unicode string."""
1626
global if_nametoindex
1627
try:
1628
if_nametoindex = (ctypes.cdll.LoadLibrary
1629
(ctypes.util.find_library("c"))
1630
.if_nametoindex)
1631
except (OSError, AttributeError):
1632
logger.warning("Doing if_nametoindex the hard way")
1633
def if_nametoindex(interface):
1634
"Get an interface index the hard way, i.e. using fcntl()"
1635
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1636
with contextlib.closing(socket.socket()) as s:
1637
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1638
struct.pack(str("16s16x"),
1639
interface))
1640
interface_index = struct.unpack(str("I"),
1641
ifreq[16:20])[0]
1642
return interface_index
1643
return if_nametoindex(interface)
1644
1645
2112
1646
def daemon(nochdir = False, noclose = False):
2113
1647
"""See daemon(3). Standard BSD Unix function.
2114
1648
2122
1656
sys.exit()
2123
1657
if not noclose:
2124
1658
# Close all standard open file descriptors
2125
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1659
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2126
1660
if not stat.S_ISCHR(os.fstat(null).st_mode):
2127
1661
raise OSError(errno.ENODEV,
2128
"{0} not a character device"
2129
.format(os.devnull))
1662
"%s not a character device"
1663
% os.path.devnull)
2130
1664
os.dup2(null, sys.stdin.fileno())
2131
1665
os.dup2(null, sys.stdout.fileno())
2132
1666
os.dup2(null, sys.stderr.fileno())
2139
1673
##################################################################
2140
1674
# Parsing of options, both command line and config file
2141
1675
2142
parser = argparse.ArgumentParser()
2143
parser.add_argument("-v", "--version", action="version",
2144
version = "%(prog)s {0}".format(version),
2145
help="show version number and exit")
2146
parser.add_argument("-i", "--interface", metavar="IF",
2147
help="Bind to interface IF")
2148
parser.add_argument("-a", "--address",
2149
help="Address to listen for requests on")
2150
parser.add_argument("-p", "--port", type=int,
2151
help="Port number to receive requests on")
2152
parser.add_argument("--check", action="store_true",
2153
help="Run self-test")
2154
parser.add_argument("--debug", action="store_true",
2155
help="Debug mode; run in foreground and log"
2156
" to terminal")
2157
parser.add_argument("--debuglevel", metavar="LEVEL",
2158
help="Debug level for stdout output")
2159
parser.add_argument("--priority", help="GnuTLS"
2160
" priority string (see GnuTLS documentation)")
2161
parser.add_argument("--servicename",
2162
metavar="NAME", help="Zeroconf service name")
2163
parser.add_argument("--configdir",
2164
default="/etc/mandos", metavar="DIR",
2165
help="Directory to search for configuration"
2166
" files")
2167
parser.add_argument("--no-dbus", action="store_false",
2168
dest="use_dbus", help="Do not provide D-Bus"
2169
" system bus interface")
2170
parser.add_argument("--no-ipv6", action="store_false",
2171
dest="use_ipv6", help="Do not use IPv6")
2172
parser.add_argument("--no-restore", action="store_false",
2173
dest="restore", help="Do not restore stored"
2174
" state")
2175
parser.add_argument("--statedir", metavar="DIR",
2176
help="Directory to save/restore state in")
2177
2178
options = parser.parse_args()
1676
parser = optparse.OptionParser(version = "%%prog %s" % version)
1677
parser.add_option("-i", "--interface", type="string",
1678
metavar="IF", help="Bind to interface IF")
1679
parser.add_option("-a", "--address", type="string",
1680
help="Address to listen for requests on")
1681
parser.add_option("-p", "--port", type="int",
1682
help="Port number to receive requests on")
1683
parser.add_option("--check", action="store_true",
1684
help="Run self-test")
1685
parser.add_option("--debug", action="store_true",
1686
help="Debug mode; run in foreground and log to"
1687
" terminal")
1688
parser.add_option("--debuglevel", type="string", metavar="LEVEL",
1689
help="Debug level for stdout output")
1690
parser.add_option("--priority", type="string", help="GnuTLS"
1691
" priority string (see GnuTLS documentation)")
1692
parser.add_option("--servicename", type="string",
1693
metavar="NAME", help="Zeroconf service name")
1694
parser.add_option("--configdir", type="string",
1695
default="/etc/mandos", metavar="DIR",
1696
help="Directory to search for configuration"
1697
" files")
1698
parser.add_option("--no-dbus", action="store_false",
1699
dest="use_dbus", help="Do not provide D-Bus"
1700
" system bus interface")
1701
parser.add_option("--no-ipv6", action="store_false",
1702
dest="use_ipv6", help="Do not use IPv6")
1703
options = parser.parse_args()[0]
2179
1704
2180
1705
if options.check:
2181
1706
import doctest
2193
1718
"use_dbus": "True",
2194
1719
"use_ipv6": "True",
2195
1720
"debuglevel": "",
2196
"restore": "True",
2197
"statedir": "/var/lib/mandos"
2198
1721
}
2199
1722
2200
1723
# Parse config file for server-global settings
2217
1740
# options, if set.
2218
1741
for option in ("interface", "address", "port", "debug",
2219
1742
"priority", "servicename", "configdir",
2220
"use_dbus", "use_ipv6", "debuglevel", "restore",
2221
"statedir"):
1743
"use_dbus", "use_ipv6", "debuglevel"):
2222
1744
value = getattr(options, option)
2223
1745
if value is not None:
2224
1746
server_settings[option] = value
2236
1758
debuglevel = server_settings["debuglevel"]
2237
1759
use_dbus = server_settings["use_dbus"]
2238
1760
use_ipv6 = server_settings["use_ipv6"]
2239
stored_state_path = os.path.join(server_settings["statedir"],
2240
stored_state_file)
2241
2242
if debug:
2243
initlogger(debug, logging.DEBUG)
2244
else:
2245
if not debuglevel:
2246
initlogger(debug)
2247
else:
2248
level = getattr(logging, debuglevel.upper())
2249
initlogger(debug, level)
2250
1761
2251
1762
if server_settings["servicename"] != "Mandos":
2252
1763
syslogger.setFormatter(logging.Formatter
2253
('Mandos ({0}) [%(process)d]:'
2254
' %(levelname)s: %(message)s'
2255
.format(server_settings
2256
["servicename"])))
1764
('Mandos (%s) [%%(process)d]:'
1765
' %%(levelname)s: %%(message)s'
1766
% server_settings["servicename"]))
2257
1767
2258
1768
# Parse config file with clients
2259
client_config = configparser.SafeConfigParser(Client
2260
.client_defaults)
1769
client_defaults = { "timeout": "1h",
1770
"interval": "5m",
1771
"checker": "fping -q -- %%(host)s",
1772
"host": "",
1773
"approval_delay": "0s",
1774
"approval_duration": "1s",
1775
}
1776
client_config = configparser.SafeConfigParser(client_defaults)
2261
1777
client_config.read(os.path.join(server_settings["configdir"],
2262
1778
"clients.conf"))
2263
1779
2277
1793
pidfilename = "/var/run/mandos.pid"
2278
1794
try:
2279
1795
pidfile = open(pidfilename, "w")
2280
except IOError as e:
2281
logger.error("Could not open file %r", pidfilename,
2282
exc_info=e)
1796
except IOError:
1797
logger.error("Could not open file %r", pidfilename)
2283
1798
2284
for name in ("_mandos", "mandos", "nobody"):
1799
try:
1800
uid = pwd.getpwnam("_mandos").pw_uid
1801
gid = pwd.getpwnam("_mandos").pw_gid
1802
except KeyError:
2285
1803
try:
2286
uid = pwd.getpwnam(name).pw_uid
2287
gid = pwd.getpwnam(name).pw_gid
2288
break
1804
uid = pwd.getpwnam("mandos").pw_uid
1805
gid = pwd.getpwnam("mandos").pw_gid
2289
1806
except KeyError:
2290
continue
2291
else:
2292
uid = 65534
2293
gid = 65534
1807
try:
1808
uid = pwd.getpwnam("nobody").pw_uid
1809
gid = pwd.getpwnam("nobody").pw_gid
1810
except KeyError:
1811
uid = 65534
1812
gid = 65534
2294
1813
try:
2295
1814
os.setgid(gid)
2296
1815
os.setuid(uid)
2297
except OSError as error:
1816
except OSError, error:
2298
1817
if error[0] != errno.EPERM:
2299
1818
raise error
2300
1819
1820
if not debug and not debuglevel:
1821
syslogger.setLevel(logging.WARNING)
1822
console.setLevel(logging.WARNING)
1823
if debuglevel:
1824
level = getattr(logging, debuglevel.upper())
1825
syslogger.setLevel(level)
1826
console.setLevel(level)
1827
2301
1828
if debug:
2302
1829
# Enable all possible GnuTLS debugging
2303
1830
2313
1840
.gnutls_global_set_log_function(debug_gnutls))
2314
1841
2315
1842
# Redirect stdin so all checkers get /dev/null
2316
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1843
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2317
1844
os.dup2(null, sys.stdin.fileno())
2318
1845
if null > 2:
2319
1846
os.close(null)
1847
else:
1848
# No console logging
1849
logger.removeHandler(console)
2320
1850
2321
1851
# Need to fork before connecting to D-Bus
2322
1852
if not debug:
2323
1853
# Close all input and output, do double fork, etc.
2324
1854
daemon()
2325
1855
2326
gobject.threads_init()
2327
2328
1856
global main_loop
2329
1857
# From the Avahi example code
2330
DBusGMainLoop(set_as_default=True)
1858
DBusGMainLoop(set_as_default=True )
2331
1859
main_loop = gobject.MainLoop()
2332
1860
bus = dbus.SystemBus()
2333
1861
# End of Avahi example code
2334
1862
if use_dbus:
2335
1863
try:
2336
bus_name = dbus.service.BusName("se.recompile.Mandos",
1864
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2337
1865
bus, do_not_queue=True)
2338
old_bus_name = (dbus.service.BusName
2339
("se.bsnet.fukt.Mandos", bus,
2340
do_not_queue=True))
2341
except dbus.exceptions.NameExistsException as e:
2342
logger.error("Disabling D-Bus:", exc_info=e)
1866
except dbus.exceptions.NameExistsException, e:
1867
logger.error(unicode(e) + ", disabling D-Bus")
2343
1868
use_dbus = False
2344
1869
server_settings["use_dbus"] = False
2345
1870
tcp_server.use_dbus = False
2346
1871
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2347
service = AvahiServiceToSyslog(name =
2348
server_settings["servicename"],
2349
servicetype = "_mandos._tcp",
2350
protocol = protocol, bus = bus)
1872
service = AvahiService(name = server_settings["servicename"],
1873
servicetype = "_mandos._tcp",
1874
protocol = protocol, bus = bus)
2351
1875
if server_settings["interface"]:
2352
1876
service.interface = (if_nametoindex
2353
1877
(str(server_settings["interface"])))
2358
1882
client_class = Client
2359
1883
if use_dbus:
2360
1884
client_class = functools.partial(ClientDBus, bus = bus)
2361
2362
client_settings = Client.config_parser(client_config)
2363
old_client_settings = {}
2364
clients_data = {}
2365
2366
# Get client data and settings from last running state.
2367
if server_settings["restore"]:
2368
try:
2369
with open(stored_state_path, "rb") as stored_state:
2370
clients_data, old_client_settings = (pickle.load
2371
(stored_state))
2372
os.remove(stored_state_path)
2373
except IOError as e:
2374
if e.errno == errno.ENOENT:
2375
logger.warning("Could not load persistent state: {0}"
2376
.format(os.strerror(e.errno)))
2377
else:
2378
logger.critical("Could not load persistent state:",
2379
exc_info=e)
2380
raise
2381
except EOFError as e:
2382
logger.warning("Could not load persistent state: "
2383
"EOFError:", exc_info=e)
2384
2385
with PGPEngine() as pgp:
2386
for client_name, client in clients_data.iteritems():
2387
# Decide which value to use after restoring saved state.
2388
# We have three different values: Old config file,
2389
# new config file, and saved state.
2390
# New config value takes precedence if it differs from old
2391
# config value, otherwise use saved state.
2392
for name, value in client_settings[client_name].items():
2393
try:
2394
# For each value in new config, check if it
2395
# differs from the old config value (Except for
2396
# the "secret" attribute)
2397
if (name != "secret" and
2398
value != old_client_settings[client_name]
2399
[name]):
2400
client[name] = value
2401
except KeyError:
2402
pass
2403
2404
# Clients who has passed its expire date can still be
2405
# enabled if its last checker was successful. Clients
2406
# whose checker succeeded before we stored its state is
2407
# assumed to have successfully run all checkers during
2408
# downtime.
2409
if client["enabled"]:
2410
if datetime.datetime.utcnow() >= client["expires"]:
2411
if not client["last_checked_ok"]:
2412
logger.warning(
2413
"disabling client {0} - Client never "
2414
"performed a successful checker"
2415
.format(client_name))
2416
client["enabled"] = False
2417
elif client["last_checker_status"] != 0:
2418
logger.warning(
2419
"disabling client {0} - Client "
2420
"last checker failed with error code {1}"
2421
.format(client_name,
2422
client["last_checker_status"]))
2423
client["enabled"] = False
2424
else:
2425
client["expires"] = (datetime.datetime
2426
.utcnow()
2427
+ client["timeout"])
2428
logger.debug("Last checker succeeded,"
2429
" keeping {0} enabled"
2430
.format(client_name))
1885
def client_config_items(config, section):
1886
special_settings = {
1887
"approved_by_default":
1888
lambda: config.getboolean(section,
1889
"approved_by_default"),
1890
}
1891
for name, value in config.items(section):
2431
1892
try:
2432
client["secret"] = (
2433
pgp.decrypt(client["encrypted_secret"],
2434
client_settings[client_name]
2435
["secret"]))
2436
except PGPError:
2437
# If decryption fails, we use secret from new settings
2438
logger.debug("Failed to decrypt {0} old secret"
2439
.format(client_name))
2440
client["secret"] = (
2441
client_settings[client_name]["secret"])
2442
2443
# Add/remove clients based on new changes made to config
2444
for client_name in (set(old_client_settings)
2445
- set(client_settings)):
2446
del clients_data[client_name]
2447
for client_name in (set(client_settings)
2448
- set(old_client_settings)):
2449
clients_data[client_name] = client_settings[client_name]
2450
2451
# Create all client objects
2452
for client_name, client in clients_data.iteritems():
2453
tcp_server.clients[client_name] = client_class(
2454
name = client_name, settings = client)
2455
1893
yield (name, special_settings[name]())
1894
except KeyError:
1895
yield (name, value)
1896
1897
tcp_server.clients.update(set(
1898
client_class(name = section,
1899
config= dict(client_config_items(
1900
client_config, section)))
1901
for section in client_config.sections()))
2456
1902
if not tcp_server.clients:
2457
1903
logger.warning("No clients defined")
2458
1904
2459
1905
if not debug:
2460
1906
try:
2461
1907
with pidfile:
2469
1915
# "pidfile" was never created
2470
1916
pass
2471
1917
del pidfilename
1918
2472
1919
signal.signal(signal.SIGINT, signal.SIG_IGN)
2473
1920
2474
1921
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2475
1922
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2476
1923
2477
1924
if use_dbus:
2478
@alternate_dbus_interfaces({"se.recompile.Mandos":
2479
"se.bsnet.fukt.Mandos"})
2480
class MandosDBusService(DBusObjectWithProperties):
1925
class MandosDBusService(dbus.service.Object):
2481
1926
"""A D-Bus proxy object"""
2482
1927
def __init__(self):
2483
1928
dbus.service.Object.__init__(self, bus, "/")
2484
_interface = "se.recompile.Mandos"
2485
2486
@dbus_interface_annotations(_interface)
2487
def _foo(self):
2488
return { "org.freedesktop.DBus.Property"
2489
".EmitsChangedSignal":
2490
"false"}
1929
_interface = "se.bsnet.fukt.Mandos"
2491
1930
2492
1931
@dbus.service.signal(_interface, signature="o")
2493
1932
def ClientAdded(self, objpath):
2508
1947
def GetAllClients(self):
2509
1948
"D-Bus method"
2510
1949
return dbus.Array(c.dbus_object_path
2511
for c in
2512
tcp_server.clients.itervalues())
1950
for c in tcp_server.clients)
2513
1951
2514
1952
@dbus.service.method(_interface,
2515
1953
out_signature="a{oa{sv}}")
2517
1955
"D-Bus method"
2518
1956
return dbus.Dictionary(
2519
1957
((c.dbus_object_path, c.GetAll(""))
2520
for c in tcp_server.clients.itervalues()),
1958
for c in tcp_server.clients),
2521
1959
signature="oa{sv}")
2522
1960
2523
1961
@dbus.service.method(_interface, in_signature="o")
2524
1962
def RemoveClient(self, object_path):
2525
1963
"D-Bus method"
2526
for c in tcp_server.clients.itervalues():
1964
for c in tcp_server.clients:
2527
1965
if c.dbus_object_path == object_path:
2528
del tcp_server.clients[c.name]
1966
tcp_server.clients.remove(c)
2529
1967
c.remove_from_connection()
2530
1968
# Don't signal anything except ClientRemoved
2531
1969
c.disable(quiet=True)
2542
1980
"Cleanup function; run on exit"
2543
1981
service.cleanup()
2544
1982
2545
multiprocessing.active_children()
2546
if not (tcp_server.clients or client_settings):
2547
return
2548
2549
# Store client before exiting. Secrets are encrypted with key
2550
# based on what config file has. If config file is
2551
# removed/edited, old secret will thus be unrecovable.
2552
clients = {}
2553
with PGPEngine() as pgp:
2554
for client in tcp_server.clients.itervalues():
2555
key = client_settings[client.name]["secret"]
2556
client.encrypted_secret = pgp.encrypt(client.secret,
2557
key)
2558
client_dict = {}
2559
2560
# A list of attributes that can not be pickled
2561
# + secret.
2562
exclude = set(("bus", "changedstate", "secret",
2563
"checker"))
2564
for name, typ in (inspect.getmembers
2565
(dbus.service.Object)):
2566
exclude.add(name)
2567
2568
client_dict["encrypted_secret"] = (client
2569
.encrypted_secret)
2570
for attr in client.client_structure:
2571
if attr not in exclude:
2572
client_dict[attr] = getattr(client, attr)
2573
2574
clients[client.name] = client_dict
2575
del client_settings[client.name]["secret"]
2576
2577
try:
2578
with (tempfile.NamedTemporaryFile
2579
(mode='wb', suffix=".pickle", prefix='clients-',
2580
dir=os.path.dirname(stored_state_path),
2581
delete=False)) as stored_state:
2582
pickle.dump((clients, client_settings), stored_state)
2583
tempname=stored_state.name
2584
os.rename(tempname, stored_state_path)
2585
except (IOError, OSError) as e:
2586
if not debug:
2587
try:
2588
os.remove(tempname)
2589
except NameError:
2590
pass
2591
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2592
logger.warning("Could not save persistent state: {0}"
2593
.format(os.strerror(e.errno)))
2594
else:
2595
logger.warning("Could not save persistent state:",
2596
exc_info=e)
2597
raise e
2598
2599
# Delete all clients, and settings from config
2600
1983
while tcp_server.clients:
2601
name, client = tcp_server.clients.popitem()
1984
client = tcp_server.clients.pop()
2602
1985
if use_dbus:
2603
1986
client.remove_from_connection()
1987
client.disable_hook = None
2604
1988
# Don't signal anything except ClientRemoved
2605
1989
client.disable(quiet=True)
2606
1990
if use_dbus:
2607
1991
# Emit D-Bus signal
2608
mandos_dbus_service.ClientRemoved(client
2609
.dbus_object_path,
1992
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2610
1993
client.name)
2611
client_settings.clear()
2612
1994
2613
1995
atexit.register(cleanup)
2614
1996
2615
for client in tcp_server.clients.itervalues():
1997
for client in tcp_server.clients:
2616
1998
if use_dbus:
2617
1999
# Emit D-Bus signal
2618
2000
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2619
# Need to initiate checking of clients
2620
if client.enabled:
2621
client.init_checker()
2001
client.enable()
2622
2002
2623
2003
tcp_server.enable()
2624
2004
tcp_server.server_activate()
2627
2007
service.port = tcp_server.socket.getsockname()[1]
2628
2008
if use_ipv6:
2629
2009
logger.info("Now listening on address %r, port %d,"
2630
" flowinfo %d, scope_id %d",
2631
*tcp_server.socket.getsockname())
2010
" flowinfo %d, scope_id %d"
2011
% tcp_server.socket.getsockname())
2632
2012
else: # IPv4
2633
logger.info("Now listening on address %r, port %d",
2634
*tcp_server.socket.getsockname())
2013
logger.info("Now listening on address %r, port %d"
2014
% tcp_server.socket.getsockname())
2635
2015
2636
2016
#service.interface = tcp_server.socket.getsockname()[3]
2637
2017
2639
2019
# From the Avahi example code
2640
2020
try:
2641
2021
service.activate()
2642
except dbus.exceptions.DBusException as error:
2643
logger.critical("D-Bus Exception", exc_info=error)
2022
except dbus.exceptions.DBusException, error:
2023
logger.critical("DBusException: %s", error)
2644
2024
cleanup()
2645
2025
sys.exit(1)
2646
2026
# End of Avahi example code
2652
2032
2653
2033
logger.debug("Starting main loop")
2654
2034
main_loop.run()
2655
except AvahiError as error:
2656
logger.critical("Avahi Error", exc_info=error)
2035
except AvahiError, error:
2036
logger.critical("AvahiError: %s", error)
2657
2037
cleanup()
2658
2038
sys.exit(1)
2659
2039
except KeyboardInterrupt:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0