101
81
except ImportError:
102
82
SO_BINDTODEVICE = None
104
if sys.version_info.major == 2:
108
stored_state_file = "clients.pickle"
110
logger = logging.getLogger()
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
116
except (OSError, AttributeError):
118
def if_nametoindex(interface):
119
"Get an interface index the hard way, i.e. using fcntl()"
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
with contextlib.closing(socket.socket()) as s:
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
125
return interface_index
128
def initlogger(debug, level=logging.WARNING):
129
"""init logger and add loglevel"""
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
syslogger.setFormatter(logging.Formatter
136
('Mandos [%(process)d]: %(levelname)s:'
138
logger.addHandler(syslogger)
141
console = logging.StreamHandler()
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
146
logger.addHandler(console)
147
logger.setLevel(level)
150
class PGPError(Exception):
151
"""Exception if encryption/decryption fails"""
155
class PGPEngine(object):
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
169
def __exit__(self, exc_type, exc_value, traceback):
177
if self.tempdir is not None:
178
# Delete contents of tempdir
179
for root, dirs, files in os.walk(self.tempdir,
181
for filename in files:
182
os.remove(os.path.join(root, filename))
184
os.rmdir(os.path.join(root, dirname))
186
os.rmdir(self.tempdir)
189
def password_encode(self, password):
190
# Passphrase can not be empty and can not contain newlines or
191
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
200
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
218
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
234
return decrypted_plaintext
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
89
syslogger = (logging.handlers.SysLogHandler
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
95
logger.addHandler(syslogger)
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
101
logger.addHandler(console)
237
103
class AvahiError(Exception):
238
104
def __init__(self, value, *args, **kwargs):
239
105
self.value = value
240
return super(AvahiError, self).__init__(value, *args,
106
super(AvahiError, self).__init__(value, *args, **kwargs)
107
def __unicode__(self):
108
return unicode(repr(self.value))
244
110
class AvahiServiceError(AvahiError):
248
113
class AvahiGroupError(AvahiError):
365
210
elif state == avahi.ENTRY_GROUP_FAILURE:
366
211
logger.critical("Avahi: Error in group state changed %s",
368
raise AvahiGroupError("State changed: {!s}".format(error))
213
raise AvahiGroupError("State changed: %s"
370
215
def cleanup(self):
371
216
"""Derived from the Avahi example code"""
372
217
if self.group is not None:
375
except (dbus.exceptions.UnknownMethodException,
376
dbus.exceptions.DBusException):
378
219
self.group = None
381
def server_state_changed(self, state, error=None):
220
def server_state_changed(self, state):
382
221
"""Derived from the Avahi example code"""
383
222
logger.debug("Avahi server state change: %i", state)
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
390
if state in bad_states:
391
if bad_states[state] is not None:
393
logger.error(bad_states[state])
395
logger.error(bad_states[state] + ": %r", error)
223
if state == avahi.SERVER_COLLISION:
224
logger.error("Zeroconf server name collision")
397
226
elif state == avahi.SERVER_RUNNING:
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
405
return self.rename(remove=False)
407
logger.critical("D-Bus Exception", exc_info=error)
412
logger.debug("Unknown state: %r", state)
414
logger.debug("Unknown state: %r: %r", state, error)
416
228
def activate(self):
417
229
"""Derived from the Avahi example code"""
418
230
if self.server is None:
419
231
self.server = dbus.Interface(
420
232
self.bus.get_object(avahi.DBUS_NAME,
421
avahi.DBUS_PATH_SERVER,
422
follow_name_owner_changes=True),
233
avahi.DBUS_PATH_SERVER),
423
234
avahi.DBUS_INTERFACE_SERVER)
424
235
self.server.connect_to_signal("StateChanged",
425
self.server_state_changed)
236
self.server_state_changed)
426
237
self.server_state_changed(self.server.GetState())
429
class AvahiServiceToSyslog(AvahiService):
430
def rename(self, *args, **kwargs):
431
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
445
connection.send(func(*args, **kwargs))
448
240
class Client(object):
449
241
"""A representation of a client host served by this server.
452
approved: bool(); 'None' if not yet approved/disapproved
244
_approved: bool(); 'None' if not yet approved/disapproved
453
245
approval_delay: datetime.timedelta(); Time to wait for approval
454
246
approval_duration: datetime.timedelta(); Duration of one approval
455
247
checker: subprocess.Popen(); a running checker process used
473
264
interval: datetime.timedelta(); How often to start a new checker
474
265
last_approval_request: datetime.datetime(); (UTC) or None
475
266
last_checked_ok: datetime.datetime(); (UTC) or None
476
last_checker_status: integer between 0 and 255 reflecting exit
477
status of last checker. -1 reflects crashed
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
481
last_enabled: datetime.datetime(); (UTC) or None
267
last_enabled: datetime.datetime(); (UTC)
482
268
name: string; from the config file, used in log messages and
483
269
D-Bus identifiers
484
270
secret: bytestring; sent verbatim (over TLS) to client
485
271
timeout: datetime.timedelta(); How long from last_checked_ok
486
272
until this client is disabled
487
extended_timeout: extra long timeout when secret has been sent
488
273
runtime_expansions: Allowed attributes for runtime expansion.
489
expires: datetime.datetime(); time (UTC) when a client will be
491
server_settings: The server_settings dict from main()
494
276
runtime_expansions = ("approval_delay", "approval_duration",
495
"created", "enabled", "expires",
496
"fingerprint", "host", "interval",
497
"last_approval_request", "last_checked_ok",
277
"created", "enabled", "fingerprint",
278
"host", "interval", "last_checked_ok",
498
279
"last_enabled", "name", "timeout")
501
"extended_timeout": "PT15M",
503
"checker": "fping -q -- %%(host)s",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
512
def config_parser(config):
513
"""Construct a new dict of client settings of this form:
514
{ client_name: {setting_name: value, ...}, ...}
515
with exceptions for any special settings as defined above.
516
NOTE: Must be a pure function. Must return the same result
517
value given the same arguments.
520
for client_name in config.sections():
521
section = dict(config.items(client_name))
522
client = settings[client_name] = {}
524
client["host"] = section["host"]
525
# Reformat values from string types to Python types
526
client["approved_by_default"] = config.getboolean(
527
client_name, "approved_by_default")
528
client["enabled"] = config.getboolean(client_name,
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
534
client["fingerprint"] = (section["fingerprint"].upper()
536
if "secret" in section:
537
client["secret"] = section["secret"].decode("base64")
538
elif "secfile" in section:
539
with open(os.path.expanduser(os.path.expandvars
540
(section["secfile"])),
542
client["secret"] = secfile.read()
544
raise TypeError("No secret or secfile for section {}"
546
client["timeout"] = string_to_delta(section["timeout"])
547
client["extended_timeout"] = string_to_delta(
548
section["extended_timeout"])
549
client["interval"] = string_to_delta(section["interval"])
550
client["approval_delay"] = string_to_delta(
551
section["approval_delay"])
552
client["approval_duration"] = string_to_delta(
553
section["approval_duration"])
554
client["checker_command"] = section["checker"]
555
client["last_approval_request"] = None
556
client["last_checked_ok"] = None
557
client["last_checker_status"] = -2
561
def __init__(self, settings, name = None, server_settings=None):
282
def _timedelta_to_milliseconds(td):
283
"Convert a datetime.timedelta() to milliseconds"
284
return ((td.days * 24 * 60 * 60 * 1000)
285
+ (td.seconds * 1000)
286
+ (td.microseconds // 1000))
288
def timeout_milliseconds(self):
289
"Return the 'timeout' attribute in milliseconds"
290
return self._timedelta_to_milliseconds(self.timeout)
292
def interval_milliseconds(self):
293
"Return the 'interval' attribute in milliseconds"
294
return self._timedelta_to_milliseconds(self.interval)
296
def approval_delay_milliseconds(self):
297
return self._timedelta_to_milliseconds(self.approval_delay)
299
def __init__(self, name = None, disable_hook=None, config=None):
300
"""Note: the 'checker' key in 'config' sets the
301
'checker_command' attribute and *not* the 'checker'
563
if server_settings is None:
565
self.server_settings = server_settings
566
# adding all client settings
567
for setting, value in settings.items():
568
setattr(self, setting, value)
571
if not hasattr(self, "last_enabled"):
572
self.last_enabled = datetime.datetime.utcnow()
573
if not hasattr(self, "expires"):
574
self.expires = (datetime.datetime.utcnow()
577
self.last_enabled = None
580
306
logger.debug("Creating client %r", self.name)
307
# Uppercase and remove spaces from fingerprint for later
308
# comparison purposes with return value from the fingerprint()
310
self.fingerprint = (config["fingerprint"].upper()
581
312
logger.debug(" Fingerprint: %s", self.fingerprint)
582
self.created = settings.get("created",
583
datetime.datetime.utcnow())
585
# attributes specific for this server instance
313
if "secret" in config:
314
self.secret = config["secret"].decode("base64")
315
elif "secfile" in config:
316
with open(os.path.expanduser(os.path.expandvars
317
(config["secfile"])),
319
self.secret = secfile.read()
321
raise TypeError("No secret or secfile for client %s"
323
self.host = config.get("host", "")
324
self.created = datetime.datetime.utcnow()
326
self.last_approval_request = None
327
self.last_enabled = None
328
self.last_checked_ok = None
329
self.timeout = string_to_delta(config["timeout"])
330
self.interval = string_to_delta(config["interval"])
331
self.disable_hook = disable_hook
586
332
self.checker = None
587
333
self.checker_initiator_tag = None
588
334
self.disable_initiator_tag = None
589
335
self.checker_callback_tag = None
336
self.checker_command = config["checker"]
590
337
self.current_checker_command = None
338
self.last_connect = None
339
self._approved = None
340
self.approved_by_default = config.get("approved_by_default",
592
342
self.approvals_pending = 0
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
597
if not attr.startswith("_")]
598
self.client_structure.append("client_structure")
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
602
if not name.startswith("_"):
603
self.client_structure.append(name)
343
self.approval_delay = string_to_delta(
344
config["approval_delay"])
345
self.approval_duration = string_to_delta(
346
config["approval_duration"])
347
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
605
# Send notice to process children that client state has changed
606
349
def send_changedstate(self):
607
with self.changedstate:
608
self.changedstate.notify_all()
350
self.changedstate.acquire()
351
self.changedstate.notify_all()
352
self.changedstate.release()
610
354
def enable(self):
611
355
"""Start this client's checker and timeout hooks"""
612
356
if getattr(self, "enabled", False):
613
357
# Already enabled
615
self.expires = datetime.datetime.utcnow() + self.timeout
359
self.send_changedstate()
617
360
self.last_enabled = datetime.datetime.utcnow()
619
self.send_changedstate()
361
# Schedule a new checker to be started an 'interval' from now,
362
# and every interval from then on.
363
self.checker_initiator_tag = (gobject.timeout_add
364
(self.interval_milliseconds(),
366
# Schedule a disable() when 'timeout' has passed
367
self.disable_initiator_tag = (gobject.timeout_add
368
(self.timeout_milliseconds(),
371
# Also start a new checker *right now*.
621
374
def disable(self, quiet=True):
622
375
"""Disable this client."""
623
376
if not getattr(self, "enabled", False):
379
self.send_changedstate()
626
381
logger.info("Disabling client %s", self.name)
627
if getattr(self, "disable_initiator_tag", None) is not None:
382
if getattr(self, "disable_initiator_tag", False):
628
383
gobject.source_remove(self.disable_initiator_tag)
629
384
self.disable_initiator_tag = None
631
if getattr(self, "checker_initiator_tag", None) is not None:
385
if getattr(self, "checker_initiator_tag", False):
632
386
gobject.source_remove(self.checker_initiator_tag)
633
387
self.checker_initiator_tag = None
634
388
self.stop_checker()
389
if self.disable_hook:
390
self.disable_hook(self)
635
391
self.enabled = False
637
self.send_changedstate()
638
392
# Do not run this again if called by a gobject.timeout_add
641
395
def __del__(self):
396
self.disable_hook = None
644
def init_checker(self):
645
# Schedule a new checker to be started an 'interval' from now,
646
# and every interval from then on.
647
if self.checker_initiator_tag is not None:
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
652
# Schedule a disable() when 'timeout' has passed
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
657
# Also start a new checker *right now*.
660
def checker_callback(self, source, condition, connection,
399
def checker_callback(self, pid, condition, command):
662
400
"""The checker has completed, so take appropriate actions."""
663
401
self.checker_callback_tag = None
664
402
self.checker = None
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
672
if self.last_checker_status == 0:
403
if os.WIFEXITED(condition):
404
exitstatus = os.WEXITSTATUS(condition)
673
406
logger.info("Checker for %(name)s succeeded",
675
408
self.checked_ok()
677
logger.info("Checker for %(name)s failed", vars(self))
410
logger.info("Checker for %(name)s failed",
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
681
413
logger.warning("Checker for %(name)s crashed?",
685
416
def checked_ok(self):
686
"""Assert that the client has been seen, alive and well."""
417
"""Bump up the timeout for this client.
419
This should only be called when the client has been seen,
687
422
self.last_checked_ok = datetime.datetime.utcnow()
688
self.last_checker_status = 0
689
self.last_checker_signal = None
692
def bump_timeout(self, timeout=None):
693
"""Bump up the timeout for this client."""
695
timeout = self.timeout
696
if self.disable_initiator_tag is not None:
697
gobject.source_remove(self.disable_initiator_tag)
698
self.disable_initiator_tag = None
699
if getattr(self, "enabled", False):
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
702
self.expires = datetime.datetime.utcnow() + timeout
423
gobject.source_remove(self.disable_initiator_tag)
424
self.disable_initiator_tag = (gobject.timeout_add
425
(self.timeout_milliseconds(),
704
428
def need_approval(self):
705
429
self.last_approval_request = datetime.datetime.utcnow()
710
434
If a checker already exists, leave it running and do
712
436
# The reason for not killing a running checker is that if we
713
# did that, and if a checker (for some reason) started running
714
# slowly and taking more than 'interval' time, then the client
715
# would inevitably timeout, since no checker would get a
716
# chance to run to completion. If we instead leave running
437
# did that, then if a checker (for some reason) started
438
# running slowly and taking more than 'interval' time, the
439
# client would inevitably timeout, since no checker would get
440
# a chance to run to completion. If we instead leave running
717
441
# checkers alone, the checker would have to take more time
718
442
# than 'timeout' for the client to be disabled, which is as it
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
445
# If a checker exists, make sure it is not a zombie
447
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
448
except (AttributeError, OSError), error:
449
if (isinstance(error, OSError)
450
and error.errno != errno.ECHILD):
454
logger.warning("Checker was a zombie")
455
gobject.source_remove(self.checker_callback_tag)
456
self.checker_callback(pid, status,
457
self.current_checker_command)
725
458
# Start a new checker if needed
726
459
if self.checker is None:
727
# Escape attributes for the shell
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
732
command = self.checker_command % escaped_attrs
733
except TypeError as error:
734
logger.error('Could not format string "%s"',
735
self.checker_command,
737
return True # Try again later
461
# In case checker_command has exactly one % operator
462
command = self.checker_command % self.host
464
# Escape attributes for the shell
465
escaped_attrs = dict(
467
re.escape(unicode(str(getattr(self, attr, "")),
471
self.runtime_expansions)
474
command = self.checker_command % escaped_attrs
475
except TypeError, error:
476
logger.error('Could not format string "%s":'
477
' %s', self.checker_command, error)
478
return True # Try again later
738
479
self.current_checker_command = command
739
logger.info("Starting checker %r for %s", command,
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
748
popen_args = { "close_fds": True,
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
758
args = (pipe[1], subprocess.call, command),
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
481
logger.info("Starting checker %r for %s",
483
# We don't need to redirect stdout and stderr, since
484
# in normal mode, that is already done by daemon(),
485
# and in debug mode we don't want to. (Stdin is
486
# always replaced by /dev/null.)
487
self.checker = subprocess.Popen(command,
490
self.checker_callback_tag = (gobject.child_watch_add
492
self.checker_callback,
494
# The checker may have completed before the gobject
495
# watch was added. Check for this.
496
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
498
gobject.source_remove(self.checker_callback_tag)
499
self.checker_callback(pid, status, command)
500
except OSError, error:
501
logger.error("Failed to start subprocess: %s",
764
503
# Re-run this periodically if run by gobject.timeout_add
872
573
class DBusObjectWithProperties(dbus.service.Object):
873
574
"""A D-Bus object with properties.
875
576
Classes inheriting from this can use the dbus_service_property
876
577
decorator to expose methods as D-Bus properties. It exposes the
877
578
standard Get(), Set(), and GetAll() methods on the D-Bus.
881
def _is_dbus_thing(thing):
882
"""Returns a function testing if an attribute is a D-Bus thing
884
If called like _is_dbus_thing("method") it returns a function
885
suitable for use as predicate to inspect.getmembers().
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
582
def _is_dbus_property(obj):
583
return getattr(obj, "_dbus_is_property", False)
890
def _get_all_dbus_things(self, thing):
585
def _get_all_dbus_properties(self):
891
586
"""Returns a generator of (name, attribute) pairs
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
894
athing.__get__(self))
895
for cls in self.__class__.__mro__
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
588
return ((prop._dbus_name, prop)
590
inspect.getmembers(self, self._is_dbus_property))
899
592
def _get_dbus_property(self, interface_name, property_name):
900
593
"""Returns a bound method if one exists which is a D-Bus
901
594
property with the specified name and interface.
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
906
if (value._dbus_name == property_name
907
and value._dbus_interface == interface_name):
908
return value.__get__(self)
596
for name in (property_name,
597
property_name + "_dbus_property"):
598
prop = getattr(self, name, None)
600
or not self._is_dbus_property(prop)
601
or prop._dbus_name != property_name
602
or (interface_name and prop._dbus_interface
603
and interface_name != prop._dbus_interface)):
910
606
# No such property
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
607
raise DBusPropertyNotFound(self.dbus_object_path + ":"
608
+ interface_name + "."
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
611
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
916
612
out_signature="v")
917
613
def Get(self, interface_name, property_name):
918
614
"""Standard D-Bus property Get() method, see D-Bus standard.
965
658
if not hasattr(value, "variant_level"):
966
properties[name] = value
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
970
return dbus.Dictionary(properties, signature="sv")
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
def PropertiesChanged(self, interface_name, changed_properties,
974
invalidated_properties):
975
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
661
all[name] = type(value)(value, variant_level=
662
value.variant_level+1)
663
return dbus.Dictionary(all, signature="sv")
980
665
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
981
666
out_signature="s",
982
667
path_keyword='object_path',
983
668
connection_keyword='connection')
984
669
def Introspect(self, object_path, connection):
985
"""Overloading of standard D-Bus method.
987
Inserts property tags and interface annotation tags.
670
"""Standard D-Bus method, overloaded to insert property tags.
989
672
xmlstring = dbus.service.Object.Introspect(self, object_path,
992
675
document = xml.dom.minidom.parseString(xmlstring)
994
676
def make_tag(document, name, prop):
995
677
e = document.createElement("property")
996
678
e.setAttribute("name", name)
997
679
e.setAttribute("type", prop._dbus_signature)
998
680
e.setAttribute("access", prop._dbus_access)
1001
682
for if_tag in document.getElementsByTagName("interface"):
1003
683
for tag in (make_tag(document, name, prop)
1005
in self._get_all_dbus_things("property")
685
in self._get_all_dbus_properties()
1006
686
if prop._dbus_interface
1007
687
== if_tag.getAttribute("name")):
1008
688
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1038
689
# Add the names to the return values for the
1039
690
# "org.freedesktop.DBus.Properties" methods
1040
691
if (if_tag.getAttribute("name")
1053
704
xmlstring = document.toxml("utf-8")
1054
705
document.unlink()
1055
706
except (AttributeError, xml.dom.DOMException,
1056
xml.parsers.expat.ExpatError) as error:
707
xml.parsers.expat.ExpatError), error:
1057
708
logger.error("Failed to override Introspection method",
1059
710
return xmlstring
1062
def datetime_to_dbus(dt, variant_level=0):
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
return dbus.String("", variant_level = variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
"""A class decorator; applied to a subclass of
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1072
interface names according to the "alt_interface_names" mapping.
1075
@alternate_dbus_interfaces({"org.example.Interface":
1076
"net.example.AlternateInterface"})
1077
class SampleDBusObject(dbus.service.Object):
1078
@dbus.service.method("org.example.Interface")
1079
def SampleDBusMethod():
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
reachable via two interfaces: "org.example.Interface" and
1084
"net.example.AlternateInterface", the latter of which will have
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
"true", unless "deprecate" is passed with a False value.
1088
This works for methods and signals, and also for D-Bus properties
1089
(from DBusObjectWithProperties) and interfaces (from the
1090
dbus_interface_annotations decorator).
1094
for orig_interface_name, alt_interface_name in (
1095
alt_interface_names.items()):
1097
interface_names = set()
1098
# Go though all attributes of the class
1099
for attrname, attribute in inspect.getmembers(cls):
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
1101
# with the wrong interface name
1102
if (not hasattr(attribute, "_dbus_interface")
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
1106
# Create an alternate D-Bus interface name based on
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1110
interface_names.add(alt_interface)
1111
# Is this a D-Bus signal?
1112
if getattr(attribute, "_dbus_is_signal", False):
1113
if sys.version_info.major == 2:
1114
# Extract the original non-method undecorated
1115
# function by black magic
1116
nonmethod_func = (dict(
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1121
nonmethod_func = attribute
1122
# Create a new, but exactly alike, function
1123
# object, and decorate it to be a new D-Bus signal
1124
# with the alternate D-Bus interface name
1125
if sys.version_info.major == 2:
1126
new_function = types.FunctionType(
1127
nonmethod_func.func_code,
1128
nonmethod_func.func_globals,
1129
nonmethod_func.func_name,
1130
nonmethod_func.func_defaults,
1131
nonmethod_func.func_closure)
1133
new_function = types.FunctionType(
1134
nonmethod_func.__code__,
1135
nonmethod_func.__globals__,
1136
nonmethod_func.__name__,
1137
nonmethod_func.__defaults__,
1138
nonmethod_func.__closure__)
1139
new_function = (dbus.service.signal(
1141
attribute._dbus_signature)(new_function))
1142
# Copy annotations, if any
1144
new_function._dbus_annotations = dict(
1145
attribute._dbus_annotations)
1146
except AttributeError:
1148
# Define a creator of a function to call both the
1149
# original and alternate functions, so both the
1150
# original and alternate signals gets sent when
1151
# the function is called
1152
def fixscope(func1, func2):
1153
"""This function is a scope container to pass
1154
func1 and func2 to the "call_both" function
1155
outside of its arguments"""
1157
def call_both(*args, **kwargs):
1158
"""This function will emit two D-Bus
1159
signals by calling func1 and func2"""
1160
func1(*args, **kwargs)
1161
func2(*args, **kwargs)
1164
# Create the "call_both" function and add it to
1166
attr[attrname] = fixscope(attribute, new_function)
1167
# Is this a D-Bus method?
1168
elif getattr(attribute, "_dbus_is_method", False):
1169
# Create a new, but exactly alike, function
1170
# object. Decorate it to be a new D-Bus method
1171
# with the alternate D-Bus interface name. Add it
1174
dbus.service.method(
1176
attribute._dbus_in_signature,
1177
attribute._dbus_out_signature)
1178
(types.FunctionType(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1183
# Copy annotations, if any
1185
attr[attrname]._dbus_annotations = dict(
1186
attribute._dbus_annotations)
1187
except AttributeError:
1189
# Is this a D-Bus property?
1190
elif getattr(attribute, "_dbus_is_property", False):
1191
# Create a new, but exactly alike, function
1192
# object, and decorate it to be a new D-Bus
1193
# property with the alternate D-Bus interface
1194
# name. Add it to the class.
1195
attr[attrname] = (dbus_service_property(
1196
alt_interface, attribute._dbus_signature,
1197
attribute._dbus_access,
1198
attribute._dbus_get_args_options
1200
(types.FunctionType(
1201
attribute.func_code,
1202
attribute.func_globals,
1203
attribute.func_name,
1204
attribute.func_defaults,
1205
attribute.func_closure)))
1206
# Copy annotations, if any
1208
attr[attrname]._dbus_annotations = dict(
1209
attribute._dbus_annotations)
1210
except AttributeError:
1212
# Is this a D-Bus interface?
1213
elif getattr(attribute, "_dbus_is_interface", False):
1214
# Create a new, but exactly alike, function
1215
# object. Decorate it to be a new D-Bus interface
1216
# with the alternate D-Bus interface name. Add it
1219
dbus_interface_annotations(alt_interface)
1220
(types.FunctionType(attribute.func_code,
1221
attribute.func_globals,
1222
attribute.func_name,
1223
attribute.func_defaults,
1224
attribute.func_closure)))
1226
# Deprecate all alternate interfaces
1227
iname="_AlternateDBusNames_interface_annotation{}"
1228
for interface_name in interface_names:
1230
@dbus_interface_annotations(interface_name)
1232
return { "org.freedesktop.DBus.Deprecated":
1234
# Find an unused name
1235
for aname in (iname.format(i)
1236
for i in itertools.count()):
1237
if aname not in attr:
1241
# Replace the class with a new subclass of it with
1242
# methods, signals, etc. as created above.
1243
cls = type(b"{}Alternate".format(cls.__name__),
1250
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
"se.bsnet.fukt.Mandos"})
1252
713
class ClientDBus(Client, DBusObjectWithProperties):
1253
714
"""A Client class using D-Bus
1260
721
runtime_expansions = (Client.runtime_expansions
1261
+ ("dbus_object_path", ))
1263
_interface = "se.recompile.Mandos.Client"
722
+ ("dbus_object_path",))
1265
724
# dbus.service.Object doesn't use super(), so we can't either.
1267
726
def __init__(self, bus = None, *args, **kwargs):
727
self._approvals_pending = 0
1269
729
Client.__init__(self, *args, **kwargs)
1270
730
# Only now, when this client is initialized, can it show up on
1272
client_object_name = str(self.name).translate(
732
client_object_name = unicode(self.name).translate(
1273
733
{ord("."): ord("_"),
1274
734
ord("-"): ord("_")})
1275
self.dbus_object_path = dbus.ObjectPath(
1276
"/clients/" + client_object_name)
735
self.dbus_object_path = (dbus.ObjectPath
736
("/clients/" + client_object_name))
1277
737
DBusObjectWithProperties.__init__(self, self.bus,
1278
738
self.dbus_object_path)
1280
def notifychangeproperty(transform_func, dbus_name,
1281
type_func=lambda x: x,
1283
invalidate_only=False,
1284
_interface=_interface):
1285
""" Modify a variable so that it's a property which announces
1286
its changes to DBus.
1288
transform_fun: Function that takes a value and a variant_level
1289
and transforms it to a D-Bus type.
1290
dbus_name: D-Bus name of the variable
1291
type_func: Function that transform the value before sending it
1292
to the D-Bus. Default: no transform
1293
variant_level: D-Bus variant level. Default: 1
1295
attrname = "_{}".format(dbus_name)
1297
def setter(self, value):
1298
if hasattr(self, "dbus_object_path"):
1299
if (not hasattr(self, attrname) or
1300
type_func(getattr(self, attrname, None))
1301
!= type_func(value)):
1303
self.PropertiesChanged(
1304
_interface, dbus.Dictionary(),
1305
dbus.Array((dbus_name, )))
1307
dbus_value = transform_func(
1309
variant_level = variant_level)
1310
self.PropertyChanged(dbus.String(dbus_name),
1312
self.PropertiesChanged(
1314
dbus.Dictionary({ dbus.String(dbus_name):
1317
setattr(self, attrname, value)
1319
return property(lambda self: getattr(self, attrname), setter)
1321
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1322
approvals_pending = notifychangeproperty(dbus.Boolean,
1325
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
last_enabled = notifychangeproperty(datetime_to_dbus,
1328
checker = notifychangeproperty(
1329
dbus.Boolean, "CheckerRunning",
1330
type_func = lambda checker: checker is not None)
1331
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1333
last_checker_status = notifychangeproperty(dbus.Int16,
1334
"LastCheckerStatus")
1335
last_approval_request = notifychangeproperty(
1336
datetime_to_dbus, "LastApprovalRequest")
1337
approved_by_default = notifychangeproperty(dbus.Boolean,
1338
"ApprovedByDefault")
1339
approval_delay = notifychangeproperty(
1340
dbus.UInt64, "ApprovalDelay",
1341
type_func = lambda td: td.total_seconds() * 1000)
1342
approval_duration = notifychangeproperty(
1343
dbus.UInt64, "ApprovalDuration",
1344
type_func = lambda td: td.total_seconds() * 1000)
1345
host = notifychangeproperty(dbus.String, "Host")
1346
timeout = notifychangeproperty(
1347
dbus.UInt64, "Timeout",
1348
type_func = lambda td: td.total_seconds() * 1000)
1349
extended_timeout = notifychangeproperty(
1350
dbus.UInt64, "ExtendedTimeout",
1351
type_func = lambda td: td.total_seconds() * 1000)
1352
interval = notifychangeproperty(
1353
dbus.UInt64, "Interval",
1354
type_func = lambda td: td.total_seconds() * 1000)
1355
checker_command = notifychangeproperty(dbus.String, "Checker")
1356
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
invalidate_only=True)
1359
del notifychangeproperty
740
def _get_approvals_pending(self):
741
return self._approvals_pending
742
def _set_approvals_pending(self, value):
743
old_value = self._approvals_pending
744
self._approvals_pending = value
746
if (hasattr(self, "dbus_object_path")
747
and bval is not bool(old_value)):
748
dbus_bool = dbus.Boolean(bval, variant_level=1)
749
self.PropertyChanged(dbus.String("ApprovalPending"),
752
approvals_pending = property(_get_approvals_pending,
753
_set_approvals_pending)
754
del _get_approvals_pending, _set_approvals_pending
757
def _datetime_to_dbus(dt, variant_level=0):
758
"""Convert a UTC datetime.datetime() to a D-Bus type."""
759
return dbus.String(dt.isoformat(),
760
variant_level=variant_level)
763
oldstate = getattr(self, "enabled", False)
764
r = Client.enable(self)
765
if oldstate != self.enabled:
767
self.PropertyChanged(dbus.String("Enabled"),
768
dbus.Boolean(True, variant_level=1))
769
self.PropertyChanged(
770
dbus.String("LastEnabled"),
771
self._datetime_to_dbus(self.last_enabled,
775
def disable(self, quiet = False):
776
oldstate = getattr(self, "enabled", False)
777
r = Client.disable(self, quiet=quiet)
778
if not quiet and oldstate != self.enabled:
780
self.PropertyChanged(dbus.String("Enabled"),
781
dbus.Boolean(False, variant_level=1))
1361
784
def __del__(self, *args, **kwargs):
1367
790
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1368
791
Client.__del__(self, *args, **kwargs)
1370
def checker_callback(self, source, condition,
1371
connection, command, *args, **kwargs):
1372
ret = Client.checker_callback(self, source, condition,
1373
connection, command, *args,
1375
exitstatus = self.last_checker_status
793
def checker_callback(self, pid, condition, command,
795
self.checker_callback_tag = None
798
self.PropertyChanged(dbus.String("CheckerRunning"),
799
dbus.Boolean(False, variant_level=1))
800
if os.WIFEXITED(condition):
801
exitstatus = os.WEXITSTATUS(condition)
1377
802
# Emit D-Bus signal
1378
803
self.CheckerCompleted(dbus.Int16(exitstatus),
804
dbus.Int64(condition),
1380
805
dbus.String(command))
1382
807
# Emit D-Bus signal
1383
808
self.CheckerCompleted(dbus.Int16(-1),
1385
self.last_checker_signal),
809
dbus.Int64(condition),
1386
810
dbus.String(command))
812
return Client.checker_callback(self, pid, condition, command,
815
def checked_ok(self, *args, **kwargs):
816
r = Client.checked_ok(self, *args, **kwargs)
818
self.PropertyChanged(
819
dbus.String("LastCheckedOK"),
820
(self._datetime_to_dbus(self.last_checked_ok,
824
def need_approval(self, *args, **kwargs):
825
r = Client.need_approval(self, *args, **kwargs)
827
self.PropertyChanged(
828
dbus.String("LastApprovalRequest"),
829
(self._datetime_to_dbus(self.last_approval_request,
1389
833
def start_checker(self, *args, **kwargs):
1390
old_checker_pid = getattr(self.checker, "pid", None)
834
old_checker = self.checker
835
if self.checker is not None:
836
old_checker_pid = self.checker.pid
838
old_checker_pid = None
1391
839
r = Client.start_checker(self, *args, **kwargs)
1392
840
# Only if new checker process was started
1393
841
if (self.checker is not None
1394
842
and old_checker_pid != self.checker.pid):
1395
843
# Emit D-Bus signal
1396
844
self.CheckerStarted(self.current_checker_command)
845
self.PropertyChanged(
846
dbus.String("CheckerRunning"),
847
dbus.Boolean(True, variant_level=1))
850
def stop_checker(self, *args, **kwargs):
851
old_checker = getattr(self, "checker", None)
852
r = Client.stop_checker(self, *args, **kwargs)
853
if (old_checker is not None
854
and getattr(self, "checker", None) is None):
855
self.PropertyChanged(dbus.String("CheckerRunning"),
856
dbus.Boolean(False, variant_level=1))
1399
859
def _reset_approved(self):
1400
self.approved = None
860
self._approved = None
1403
863
def approve(self, value=True):
1404
self.approved = value
1405
gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
* 1000), self._reset_approved)
1407
864
self.send_changedstate()
865
self._approved = value
866
gobject.timeout_add(self._timedelta_to_milliseconds
867
(self.approval_duration),
868
self._reset_approved)
1409
871
## D-Bus methods, signals & properties
872
_interface = "se.bsnet.fukt.Mandos.Client"
1499
955
return dbus.Boolean(bool(self.approvals_pending))
1501
957
# ApprovedByDefault - property
1502
@dbus_service_property(_interface,
958
@dbus_service_property(_interface, signature="b",
1504
959
access="readwrite")
1505
960
def ApprovedByDefault_dbus_property(self, value=None):
1506
961
if value is None: # get
1507
962
return dbus.Boolean(self.approved_by_default)
1508
963
self.approved_by_default = bool(value)
965
self.PropertyChanged(dbus.String("ApprovedByDefault"),
966
dbus.Boolean(value, variant_level=1))
1510
968
# ApprovalDelay - property
1511
@dbus_service_property(_interface,
969
@dbus_service_property(_interface, signature="t",
1513
970
access="readwrite")
1514
971
def ApprovalDelay_dbus_property(self, value=None):
1515
972
if value is None: # get
1516
return dbus.UInt64(self.approval_delay.total_seconds()
973
return dbus.UInt64(self.approval_delay_milliseconds())
1518
974
self.approval_delay = datetime.timedelta(0, 0, 0, value)
976
self.PropertyChanged(dbus.String("ApprovalDelay"),
977
dbus.UInt64(value, variant_level=1))
1520
979
# ApprovalDuration - property
1521
@dbus_service_property(_interface,
980
@dbus_service_property(_interface, signature="t",
1523
981
access="readwrite")
1524
982
def ApprovalDuration_dbus_property(self, value=None):
1525
983
if value is None: # get
1526
return dbus.UInt64(self.approval_duration.total_seconds()
984
return dbus.UInt64(self._timedelta_to_milliseconds(
985
self.approval_duration))
1528
986
self.approval_duration = datetime.timedelta(0, 0, 0, value)
988
self.PropertyChanged(dbus.String("ApprovalDuration"),
989
dbus.UInt64(value, variant_level=1))
1530
991
# Name - property
1532
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1533
992
@dbus_service_property(_interface, signature="s", access="read")
1534
993
def Name_dbus_property(self):
1535
994
return dbus.String(self.name)
1537
996
# Fingerprint - property
1539
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1540
997
@dbus_service_property(_interface, signature="s", access="read")
1541
998
def Fingerprint_dbus_property(self):
1542
999
return dbus.String(self.fingerprint)
1544
1001
# Host - property
1545
@dbus_service_property(_interface,
1002
@dbus_service_property(_interface, signature="s",
1547
1003
access="readwrite")
1548
1004
def Host_dbus_property(self, value=None):
1549
1005
if value is None: # get
1550
1006
return dbus.String(self.host)
1551
self.host = str(value)
1009
self.PropertyChanged(dbus.String("Host"),
1010
dbus.String(value, variant_level=1))
1553
1012
# Created - property
1555
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1556
1013
@dbus_service_property(_interface, signature="s", access="read")
1557
1014
def Created_dbus_property(self):
1558
return datetime_to_dbus(self.created)
1015
return dbus.String(self._datetime_to_dbus(self.created))
1560
1017
# LastEnabled - property
1561
1018
@dbus_service_property(_interface, signature="s", access="read")
1562
1019
def LastEnabled_dbus_property(self):
1563
return datetime_to_dbus(self.last_enabled)
1020
if self.last_enabled is None:
1021
return dbus.String("")
1022
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1565
1024
# Enabled - property
1566
@dbus_service_property(_interface,
1025
@dbus_service_property(_interface, signature="b",
1568
1026
access="readwrite")
1569
1027
def Enabled_dbus_property(self, value=None):
1570
1028
if value is None: # get
1577
1035
# LastCheckedOK - property
1578
@dbus_service_property(_interface,
1036
@dbus_service_property(_interface, signature="s",
1580
1037
access="readwrite")
1581
1038
def LastCheckedOK_dbus_property(self, value=None):
1582
1039
if value is not None:
1583
1040
self.checked_ok()
1585
return datetime_to_dbus(self.last_checked_ok)
1587
# LastCheckerStatus - property
1588
@dbus_service_property(_interface, signature="n", access="read")
1589
def LastCheckerStatus_dbus_property(self):
1590
return dbus.Int16(self.last_checker_status)
1592
# Expires - property
1593
@dbus_service_property(_interface, signature="s", access="read")
1594
def Expires_dbus_property(self):
1595
return datetime_to_dbus(self.expires)
1042
if self.last_checked_ok is None:
1043
return dbus.String("")
1044
return dbus.String(self._datetime_to_dbus(self
1597
1047
# LastApprovalRequest - property
1598
1048
@dbus_service_property(_interface, signature="s", access="read")
1599
1049
def LastApprovalRequest_dbus_property(self):
1600
return datetime_to_dbus(self.last_approval_request)
1050
if self.last_approval_request is None:
1051
return dbus.String("")
1052
return dbus.String(self.
1053
_datetime_to_dbus(self
1054
.last_approval_request))
1602
1056
# Timeout - property
1603
@dbus_service_property(_interface,
1057
@dbus_service_property(_interface, signature="t",
1605
1058
access="readwrite")
1606
1059
def Timeout_dbus_property(self, value=None):
1607
1060
if value is None: # get
1608
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1609
old_timeout = self.timeout
1061
return dbus.UInt64(self.timeout_milliseconds())
1610
1062
self.timeout = datetime.timedelta(0, 0, 0, value)
1611
# Reschedule disabling
1613
now = datetime.datetime.utcnow()
1614
self.expires += self.timeout - old_timeout
1615
if self.expires <= now:
1616
# The timeout has passed
1619
if (getattr(self, "disable_initiator_tag", None)
1622
gobject.source_remove(self.disable_initiator_tag)
1623
self.disable_initiator_tag = gobject.timeout_add(
1624
int((self.expires - now).total_seconds() * 1000),
1627
# ExtendedTimeout - property
1628
@dbus_service_property(_interface,
1631
def ExtendedTimeout_dbus_property(self, value=None):
1632
if value is None: # get
1633
return dbus.UInt64(self.extended_timeout.total_seconds()
1635
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1064
self.PropertyChanged(dbus.String("Timeout"),
1065
dbus.UInt64(value, variant_level=1))
1066
if getattr(self, "disable_initiator_tag", None) is None:
1068
# Reschedule timeout
1069
gobject.source_remove(self.disable_initiator_tag)
1070
self.disable_initiator_tag = None
1071
time_to_die = (self.
1072
_timedelta_to_milliseconds((self
1077
if time_to_die <= 0:
1078
# The timeout has passed
1081
self.disable_initiator_tag = (gobject.timeout_add
1082
(time_to_die, self.disable))
1637
1084
# Interval - property
1638
@dbus_service_property(_interface,
1085
@dbus_service_property(_interface, signature="t",
1640
1086
access="readwrite")
1641
1087
def Interval_dbus_property(self, value=None):
1642
1088
if value is None: # get
1643
return dbus.UInt64(self.interval.total_seconds() * 1000)
1089
return dbus.UInt64(self.interval_milliseconds())
1644
1090
self.interval = datetime.timedelta(0, 0, 0, value)
1092
self.PropertyChanged(dbus.String("Interval"),
1093
dbus.UInt64(value, variant_level=1))
1645
1094
if getattr(self, "checker_initiator_tag", None) is None:
1648
# Reschedule checker run
1649
gobject.source_remove(self.checker_initiator_tag)
1650
self.checker_initiator_tag = gobject.timeout_add(
1651
value, self.start_checker)
1652
self.start_checker() # Start one now, too
1096
# Reschedule checker run
1097
gobject.source_remove(self.checker_initiator_tag)
1098
self.checker_initiator_tag = (gobject.timeout_add
1099
(value, self.start_checker))
1100
self.start_checker() # Start one now, too
1654
1102
# Checker - property
1655
@dbus_service_property(_interface,
1103
@dbus_service_property(_interface, signature="s",
1657
1104
access="readwrite")
1658
1105
def Checker_dbus_property(self, value=None):
1659
1106
if value is None: # get
1660
1107
return dbus.String(self.checker_command)
1661
self.checker_command = str(value)
1108
self.checker_command = value
1110
self.PropertyChanged(dbus.String("Checker"),
1111
dbus.String(self.checker_command,
1663
1114
# CheckerRunning - property
1664
@dbus_service_property(_interface,
1115
@dbus_service_property(_interface, signature="b",
1666
1116
access="readwrite")
1667
1117
def CheckerRunning_dbus_property(self, value=None):
1668
1118
if value is None: # get
1899
1340
def fingerprint(openpgp):
1900
1341
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1901
1342
# New GnuTLS "datum" with the OpenPGP public key
1902
datum = gnutls.library.types.gnutls_datum_t(
1903
ctypes.cast(ctypes.c_char_p(openpgp),
1904
ctypes.POINTER(ctypes.c_ubyte)),
1905
ctypes.c_uint(len(openpgp)))
1343
datum = (gnutls.library.types
1344
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1347
ctypes.c_uint(len(openpgp))))
1906
1348
# New empty GnuTLS certificate
1907
1349
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1908
gnutls.library.functions.gnutls_openpgp_crt_init(
1350
(gnutls.library.functions
1351
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1910
1352
# Import the OpenPGP public key into the certificate
1911
gnutls.library.functions.gnutls_openpgp_crt_import(
1912
crt, ctypes.byref(datum),
1913
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1353
(gnutls.library.functions
1354
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1355
gnutls.library.constants
1356
.GNUTLS_OPENPGP_FMT_RAW))
1914
1357
# Verify the self signature in the key
1915
1358
crtverify = ctypes.c_uint()
1916
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1917
crt, 0, ctypes.byref(crtverify))
1359
(gnutls.library.functions
1360
.gnutls_openpgp_crt_verify_self(crt, 0,
1361
ctypes.byref(crtverify)))
1918
1362
if crtverify.value != 0:
1919
1363
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1920
raise gnutls.errors.CertificateSecurityError(
1364
raise (gnutls.errors.CertificateSecurityError
1922
1366
# New buffer for the fingerprint
1923
1367
buf = ctypes.create_string_buffer(20)
1924
1368
buf_len = ctypes.c_size_t()
1925
1369
# Get the fingerprint from the certificate into the buffer
1926
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1927
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1370
(gnutls.library.functions
1371
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1372
ctypes.byref(buf_len)))
1928
1373
# Deinit the certificate
1929
1374
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1930
1375
# Convert the buffer to a Python bytestring
1931
1376
fpr = ctypes.string_at(buf, buf_len.value)
1932
1377
# Convert the bytestring to hexadecimal notation
1933
hex_fpr = binascii.hexlify(fpr).upper()
1378
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1937
1382
class MultiprocessingMixIn(object):
1938
1383
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1940
1384
def sub_process_main(self, request, address):
1942
1386
self.finish_request(request, address)
1944
1388
self.handle_error(request, address)
1945
1389
self.close_request(request)
1947
1391
def process_request(self, request, address):
1948
1392
"""Start a new process to process the request."""
1949
proc = multiprocessing.Process(target = self.sub_process_main,
1950
args = (request, address))
1393
multiprocessing.Process(target = self.sub_process_main,
1394
args = (request, address)).start()
1955
1396
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1956
1397
""" adds a pipe to the MixIn """
1958
1398
def process_request(self, request, client_address):
1959
1399
"""Overrides and wraps the original process_request().
1961
1401
This function creates a new pipe in self.pipe
1963
1403
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1965
proc = MultiprocessingMixIn.process_request(self, request,
1405
super(MultiprocessingMixInWithPipe,
1406
self).process_request(request, client_address)
1967
1407
self.child_pipe.close()
1968
self.add_pipe(parent_pipe, proc)
1970
def add_pipe(self, parent_pipe, proc):
1408
self.add_pipe(parent_pipe)
1410
def add_pipe(self, parent_pipe):
1971
1411
"""Dummy function; override as necessary"""
1972
raise NotImplementedError()
1412
raise NotImplementedError
1975
1414
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1976
1415
socketserver.TCPServer, object):
2079
1485
Assumes a gobject.MainLoop event loop.
2082
1487
def __init__(self, server_address, RequestHandlerClass,
2086
gnutls_priority=None,
1488
interface=None, use_ipv6=True, clients=None,
1489
gnutls_priority=None, use_dbus=True):
2089
1490
self.enabled = False
2090
1491
self.clients = clients
2091
1492
if self.clients is None:
1493
self.clients = set()
2093
1494
self.use_dbus = use_dbus
2094
1495
self.gnutls_priority = gnutls_priority
2095
1496
IPv6_TCPServer.__init__(self, server_address,
2096
1497
RequestHandlerClass,
2097
1498
interface = interface,
2098
use_ipv6 = use_ipv6,
2099
socketfd = socketfd)
1499
use_ipv6 = use_ipv6)
2101
1500
def server_activate(self):
2102
1501
if self.enabled:
2103
1502
return socketserver.TCPServer.server_activate(self)
2105
1503
def enable(self):
2106
1504
self.enabled = True
2108
def add_pipe(self, parent_pipe, proc):
1505
def add_pipe(self, parent_pipe):
2109
1506
# Call "handle_ipc" for both data and EOF events
2110
gobject.io_add_watch(
2111
parent_pipe.fileno(),
2112
gobject.IO_IN | gobject.IO_HUP,
2113
functools.partial(self.handle_ipc,
2114
parent_pipe = parent_pipe,
2117
def handle_ipc(self, source, condition,
1507
gobject.io_add_watch(parent_pipe.fileno(),
1508
gobject.IO_IN | gobject.IO_HUP,
1509
functools.partial(self.handle_ipc,
1510
parent_pipe = parent_pipe))
1512
def handle_ipc(self, source, condition, parent_pipe=None,
2120
1513
client_object=None):
2121
# error, or the other end of multiprocessing.Pipe has closed
2122
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2123
# Wait for other process to exit
1515
gobject.IO_IN: "IN", # There is data to read.
1516
gobject.IO_OUT: "OUT", # Data can be written (without
1518
gobject.IO_PRI: "PRI", # There is urgent data to read.
1519
gobject.IO_ERR: "ERR", # Error condition.
1520
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1521
# broken, usually for pipes and
1524
conditions_string = ' | '.join(name
1526
condition_names.iteritems()
1527
if cond & condition)
1528
# error or the other end of multiprocessing.Pipe has closed
1529
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2127
1532
# Read a request from the child
2132
1537
fpr = request[1]
2133
1538
address = request[2]
2135
for c in self.clients.itervalues():
1540
for c in self.clients:
2136
1541
if c.fingerprint == fpr:
2140
logger.info("Client not found for fingerprint: %s, ad"
2141
"dress: %s", fpr, address)
1545
logger.warning("Client not found for fingerprint: %s, ad"
1546
"dress: %s", fpr, address)
2142
1547
if self.use_dbus:
2143
1548
# Emit D-Bus signal
2144
mandos_dbus_service.ClientNotFound(fpr,
1549
mandos_dbus_service.ClientNotFound(fpr, address[0])
2146
1550
parent_pipe.send(False)
2149
gobject.io_add_watch(
2150
parent_pipe.fileno(),
2151
gobject.IO_IN | gobject.IO_HUP,
2152
functools.partial(self.handle_ipc,
2153
parent_pipe = parent_pipe,
2155
client_object = client))
1553
gobject.io_add_watch(parent_pipe.fileno(),
1554
gobject.IO_IN | gobject.IO_HUP,
1555
functools.partial(self.handle_ipc,
1556
parent_pipe = parent_pipe,
1557
client_object = client))
2156
1558
parent_pipe.send(True)
2157
# remove the old hook in favor of the new above hook on
1559
# remove the old hook in favor of the new above hook on same fileno
2160
1561
if command == 'funcall':
2161
1562
funcname = request[1]
2162
1563
args = request[2]
2163
1564
kwargs = request[3]
2165
parent_pipe.send(('data', getattr(client_object,
1566
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
2169
1568
if command == 'getattr':
2170
1569
attrname = request[1]
2171
if isinstance(client_object.__getattribute__(attrname),
2172
collections.Callable):
2173
parent_pipe.send(('function', ))
1570
if callable(client_object.__getattribute__(attrname)):
1571
parent_pipe.send(('function',))
2176
'data', client_object.__getattribute__(attrname)))
1573
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2178
1575
if command == 'setattr':
2179
1576
attrname = request[1]
2180
1577
value = request[2]
2181
1578
setattr(client_object, attrname, value)
2186
def rfc3339_duration_to_delta(duration):
2187
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2189
>>> rfc3339_duration_to_delta("P7D")
2190
datetime.timedelta(7)
2191
>>> rfc3339_duration_to_delta("PT60S")
2192
datetime.timedelta(0, 60)
2193
>>> rfc3339_duration_to_delta("PT60M")
2194
datetime.timedelta(0, 3600)
2195
>>> rfc3339_duration_to_delta("PT24H")
2196
datetime.timedelta(1)
2197
>>> rfc3339_duration_to_delta("P1W")
2198
datetime.timedelta(7)
2199
>>> rfc3339_duration_to_delta("PT5M30S")
2200
datetime.timedelta(0, 330)
2201
>>> rfc3339_duration_to_delta("P1DT3M20S")
2202
datetime.timedelta(1, 200)
2205
# Parsing an RFC 3339 duration with regular expressions is not
2206
# possible - there would have to be multiple places for the same
2207
# values, like seconds. The current code, while more esoteric, is
2208
# cleaner without depending on a parsing library. If Python had a
2209
# built-in library for parsing we would use it, but we'd like to
2210
# avoid excessive use of external libraries.
2212
# New type for defining tokens, syntax, and semantics all-in-one
2213
Token = collections.namedtuple("Token", (
2214
"regexp", # To match token; if "value" is not None, must have
2215
# a "group" containing digits
2216
"value", # datetime.timedelta or None
2217
"followers")) # Tokens valid after this token
2218
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2219
# the "duration" ABNF definition in RFC 3339, Appendix A.
2220
token_end = Token(re.compile(r"$"), None, frozenset())
2221
token_second = Token(re.compile(r"(\d+)S"),
2222
datetime.timedelta(seconds=1),
2223
frozenset((token_end, )))
2224
token_minute = Token(re.compile(r"(\d+)M"),
2225
datetime.timedelta(minutes=1),
2226
frozenset((token_second, token_end)))
2227
token_hour = Token(re.compile(r"(\d+)H"),
2228
datetime.timedelta(hours=1),
2229
frozenset((token_minute, token_end)))
2230
token_time = Token(re.compile(r"T"),
2232
frozenset((token_hour, token_minute,
2234
token_day = Token(re.compile(r"(\d+)D"),
2235
datetime.timedelta(days=1),
2236
frozenset((token_time, token_end)))
2237
token_month = Token(re.compile(r"(\d+)M"),
2238
datetime.timedelta(weeks=4),
2239
frozenset((token_day, token_end)))
2240
token_year = Token(re.compile(r"(\d+)Y"),
2241
datetime.timedelta(weeks=52),
2242
frozenset((token_month, token_end)))
2243
token_week = Token(re.compile(r"(\d+)W"),
2244
datetime.timedelta(weeks=1),
2245
frozenset((token_end, )))
2246
token_duration = Token(re.compile(r"P"), None,
2247
frozenset((token_year, token_month,
2248
token_day, token_time,
2250
# Define starting values
2251
value = datetime.timedelta() # Value so far
2253
followers = frozenset((token_duration, )) # Following valid tokens
2254
s = duration # String left to parse
2255
# Loop until end token is found
2256
while found_token is not token_end:
2257
# Search for any currently valid tokens
2258
for token in followers:
2259
match = token.regexp.match(s)
2260
if match is not None:
2262
if token.value is not None:
2263
# Value found, parse digits
2264
factor = int(match.group(1), 10)
2265
# Add to value so far
2266
value += factor * token.value
2267
# Strip token from string
2268
s = token.regexp.sub("", s, 1)
2271
# Set valid next tokens
2272
followers = found_token.followers
2275
# No currently valid tokens were found
2276
raise ValueError("Invalid RFC 3339 duration: {!r}"
2282
1583
def string_to_delta(interval):
2283
1584
"""Parse a string and return a datetime.timedelta
2354
1673
##################################################################
2355
1674
# Parsing of options, both command line and config file
2357
parser = argparse.ArgumentParser()
2358
parser.add_argument("-v", "--version", action="version",
2359
version = "%(prog)s {}".format(version),
2360
help="show version number and exit")
2361
parser.add_argument("-i", "--interface", metavar="IF",
2362
help="Bind to interface IF")
2363
parser.add_argument("-a", "--address",
2364
help="Address to listen for requests on")
2365
parser.add_argument("-p", "--port", type=int,
2366
help="Port number to receive requests on")
2367
parser.add_argument("--check", action="store_true",
2368
help="Run self-test")
2369
parser.add_argument("--debug", action="store_true",
2370
help="Debug mode; run in foreground and log"
2371
" to terminal", default=None)
2372
parser.add_argument("--debuglevel", metavar="LEVEL",
2373
help="Debug level for stdout output")
2374
parser.add_argument("--priority", help="GnuTLS"
2375
" priority string (see GnuTLS documentation)")
2376
parser.add_argument("--servicename",
2377
metavar="NAME", help="Zeroconf service name")
2378
parser.add_argument("--configdir",
2379
default="/etc/mandos", metavar="DIR",
2380
help="Directory to search for configuration"
2382
parser.add_argument("--no-dbus", action="store_false",
2383
dest="use_dbus", help="Do not provide D-Bus"
2384
" system bus interface", default=None)
2385
parser.add_argument("--no-ipv6", action="store_false",
2386
dest="use_ipv6", help="Do not use IPv6",
2388
parser.add_argument("--no-restore", action="store_false",
2389
dest="restore", help="Do not restore stored"
2390
" state", default=None)
2391
parser.add_argument("--socket", type=int,
2392
help="Specify a file descriptor to a network"
2393
" socket to use instead of creating one")
2394
parser.add_argument("--statedir", metavar="DIR",
2395
help="Directory to save/restore state in")
2396
parser.add_argument("--foreground", action="store_true",
2397
help="Run in foreground", default=None)
2398
parser.add_argument("--no-zeroconf", action="store_false",
2399
dest="zeroconf", help="Do not use Zeroconf",
2402
options = parser.parse_args()
1676
parser = optparse.OptionParser(version = "%%prog %s" % version)
1677
parser.add_option("-i", "--interface", type="string",
1678
metavar="IF", help="Bind to interface IF")
1679
parser.add_option("-a", "--address", type="string",
1680
help="Address to listen for requests on")
1681
parser.add_option("-p", "--port", type="int",
1682
help="Port number to receive requests on")
1683
parser.add_option("--check", action="store_true",
1684
help="Run self-test")
1685
parser.add_option("--debug", action="store_true",
1686
help="Debug mode; run in foreground and log to"
1688
parser.add_option("--debuglevel", type="string", metavar="LEVEL",
1689
help="Debug level for stdout output")
1690
parser.add_option("--priority", type="string", help="GnuTLS"
1691
" priority string (see GnuTLS documentation)")
1692
parser.add_option("--servicename", type="string",
1693
metavar="NAME", help="Zeroconf service name")
1694
parser.add_option("--configdir", type="string",
1695
default="/etc/mandos", metavar="DIR",
1696
help="Directory to search for configuration"
1698
parser.add_option("--no-dbus", action="store_false",
1699
dest="use_dbus", help="Do not provide D-Bus"
1700
" system bus interface")
1701
parser.add_option("--no-ipv6", action="store_false",
1702
dest="use_ipv6", help="Do not use IPv6")
1703
options = parser.parse_args()[0]
2404
1705
if options.check:
2406
fail_count, test_count = doctest.testmod()
2407
sys.exit(os.EX_OK if fail_count == 0 else 1)
2409
1710
# Default values for config file for server-global settings
2410
1711
server_defaults = { "interface": "",
2413
1714
"debug": "False",
2415
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2416
":+SIGN-DSA-SHA256",
1716
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2417
1717
"servicename": "Mandos",
2418
1718
"use_dbus": "True",
2419
1719
"use_ipv6": "True",
2420
1720
"debuglevel": "",
2423
"statedir": "/var/lib/mandos",
2424
"foreground": "False",
2428
1723
# Parse config file for server-global settings
2429
1724
server_config = configparser.SafeConfigParser(server_defaults)
2430
1725
del server_defaults
2431
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1726
server_config.read(os.path.join(options.configdir,
2432
1728
# Convert the SafeConfigParser object to a dict
2433
1729
server_settings = server_config.defaults()
2434
1730
# Use the appropriate methods on the non-string config options
2435
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1731
for option in ("debug", "use_dbus", "use_ipv6"):
2436
1732
server_settings[option] = server_config.getboolean("DEFAULT",
2438
1734
if server_settings["port"]:
2439
1735
server_settings["port"] = server_config.getint("DEFAULT",
2441
if server_settings["socket"]:
2442
server_settings["socket"] = server_config.getint("DEFAULT",
2444
# Later, stdin will, and stdout and stderr might, be dup'ed
2445
# over with an opened os.devnull. But we don't want this to
2446
# happen with a supplied network socket.
2447
if 0 <= server_settings["socket"] <= 2:
2448
server_settings["socket"] = os.dup(server_settings
2450
1737
del server_config
2452
1739
# Override the settings from the config file with command line
2453
1740
# options, if set.
2454
1741
for option in ("interface", "address", "port", "debug",
2455
"priority", "servicename", "configdir", "use_dbus",
2456
"use_ipv6", "debuglevel", "restore", "statedir",
2457
"socket", "foreground", "zeroconf"):
1742
"priority", "servicename", "configdir",
1743
"use_dbus", "use_ipv6", "debuglevel"):
2458
1744
value = getattr(options, option)
2459
1745
if value is not None:
2460
1746
server_settings[option] = value
2462
1748
# Force all strings to be unicode
2463
1749
for option in server_settings.keys():
2464
if isinstance(server_settings[option], bytes):
2465
server_settings[option] = (server_settings[option]
2467
# Force all boolean options to be boolean
2468
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2469
"foreground", "zeroconf"):
2470
server_settings[option] = bool(server_settings[option])
2471
# Debug implies foreground
2472
if server_settings["debug"]:
2473
server_settings["foreground"] = True
1750
if type(server_settings[option]) is str:
1751
server_settings[option] = unicode(server_settings[option])
2474
1752
# Now we have our good server settings in "server_settings"
2476
1754
##################################################################
2478
if (not server_settings["zeroconf"]
2479
and not (server_settings["port"]
2480
or server_settings["socket"] != "")):
2481
parser.error("Needs port or socket to work without Zeroconf")
2483
1756
# For convenience
2484
1757
debug = server_settings["debug"]
2485
1758
debuglevel = server_settings["debuglevel"]
2486
1759
use_dbus = server_settings["use_dbus"]
2487
1760
use_ipv6 = server_settings["use_ipv6"]
2488
stored_state_path = os.path.join(server_settings["statedir"],
2490
foreground = server_settings["foreground"]
2491
zeroconf = server_settings["zeroconf"]
2494
initlogger(debug, logging.DEBUG)
2499
level = getattr(logging, debuglevel.upper())
2500
initlogger(debug, level)
2502
1762
if server_settings["servicename"] != "Mandos":
2503
syslogger.setFormatter(
2504
logging.Formatter('Mandos ({}) [%(process)d]:'
2505
' %(levelname)s: %(message)s'.format(
2506
server_settings["servicename"])))
1763
syslogger.setFormatter(logging.Formatter
1764
('Mandos (%s) [%%(process)d]:'
1765
' %%(levelname)s: %%(message)s'
1766
% server_settings["servicename"]))
2508
1768
# Parse config file with clients
2509
client_config = configparser.SafeConfigParser(Client
1769
client_defaults = { "timeout": "1h",
1771
"checker": "fping -q -- %%(host)s",
1773
"approval_delay": "0s",
1774
"approval_duration": "1s",
1776
client_config = configparser.SafeConfigParser(client_defaults)
2511
1777
client_config.read(os.path.join(server_settings["configdir"],
2512
1778
"clients.conf"))
2514
1780
global mandos_dbus_service
2515
1781
mandos_dbus_service = None
2518
if server_settings["socket"] != "":
2519
socketfd = server_settings["socket"]
2520
tcp_server = MandosServer(
2521
(server_settings["address"], server_settings["port"]),
2523
interface=(server_settings["interface"] or None),
2525
gnutls_priority=server_settings["priority"],
2529
pidfilename = "/run/mandos.pid"
2530
if not os.path.isdir("/run/."):
2531
pidfilename = "/var/run/mandos.pid"
1783
tcp_server = MandosServer((server_settings["address"],
1784
server_settings["port"]),
1786
interface=(server_settings["interface"]
1790
server_settings["priority"],
1793
pidfilename = "/var/run/mandos.pid"
2534
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2535
except IOError as e:
2536
logger.error("Could not open file %r", pidfilename,
1795
pidfile = open(pidfilename, "w")
1797
logger.error("Could not open file %r", pidfilename)
2539
for name in ("_mandos", "mandos", "nobody"):
1800
uid = pwd.getpwnam("_mandos").pw_uid
1801
gid = pwd.getpwnam("_mandos").pw_gid
2541
uid = pwd.getpwnam(name).pw_uid
2542
gid = pwd.getpwnam(name).pw_gid
1804
uid = pwd.getpwnam("mandos").pw_uid
1805
gid = pwd.getpwnam("mandos").pw_gid
2544
1806
except KeyError:
1808
uid = pwd.getpwnam("nobody").pw_uid
1809
gid = pwd.getpwnam("nobody").pw_gid
2552
except OSError as error:
2553
if error.errno != errno.EPERM:
1816
except OSError, error:
1817
if error[0] != errno.EPERM:
1820
if not debug and not debuglevel:
1821
syslogger.setLevel(logging.WARNING)
1822
console.setLevel(logging.WARNING)
1824
level = getattr(logging, debuglevel.upper())
1825
syslogger.setLevel(level)
1826
console.setLevel(level)
2557
1829
# Enable all possible GnuTLS debugging
2564
1836
def debug_gnutls(level, string):
2565
1837
logger.debug("GnuTLS: %s", string[:-1])
2567
gnutls.library.functions.gnutls_global_set_log_function(
1839
(gnutls.library.functions
1840
.gnutls_global_set_log_function(debug_gnutls))
2570
1842
# Redirect stdin so all checkers get /dev/null
2571
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1843
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2572
1844
os.dup2(null, sys.stdin.fileno())
1848
# No console logging
1849
logger.removeHandler(console)
2576
1851
# Need to fork before connecting to D-Bus
2578
1853
# Close all input and output, do double fork, etc.
2581
# multiprocessing will use threads, so before we use gobject we
2582
# need to inform gobject that threads will be used.
2583
gobject.threads_init()
2585
1856
global main_loop
2586
1857
# From the Avahi example code
2587
DBusGMainLoop(set_as_default=True)
1858
DBusGMainLoop(set_as_default=True )
2588
1859
main_loop = gobject.MainLoop()
2589
1860
bus = dbus.SystemBus()
2590
1861
# End of Avahi example code
2593
bus_name = dbus.service.BusName("se.recompile.Mandos",
2596
old_bus_name = dbus.service.BusName(
2597
"se.bsnet.fukt.Mandos", bus,
2599
except dbus.exceptions.DBusException as e:
2600
logger.error("Disabling D-Bus:", exc_info=e)
1864
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1865
bus, do_not_queue=True)
1866
except dbus.exceptions.NameExistsException, e:
1867
logger.error(unicode(e) + ", disabling D-Bus")
2601
1868
use_dbus = False
2602
1869
server_settings["use_dbus"] = False
2603
1870
tcp_server.use_dbus = False
2605
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2606
service = AvahiServiceToSyslog(
2607
name = server_settings["servicename"],
2608
servicetype = "_mandos._tcp",
2609
protocol = protocol,
2611
if server_settings["interface"]:
2612
service.interface = if_nametoindex(
2613
server_settings["interface"].encode("utf-8"))
1871
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1872
service = AvahiService(name = server_settings["servicename"],
1873
servicetype = "_mandos._tcp",
1874
protocol = protocol, bus = bus)
1875
if server_settings["interface"]:
1876
service.interface = (if_nametoindex
1877
(str(server_settings["interface"])))
2615
1879
global multiprocessing_manager
2616
1880
multiprocessing_manager = multiprocessing.Manager()
2618
1882
client_class = Client
2620
1884
client_class = functools.partial(ClientDBus, bus = bus)
2622
client_settings = Client.config_parser(client_config)
2623
old_client_settings = {}
2626
# This is used to redirect stdout and stderr for checker processes
2628
wnull = open(os.devnull, "w") # A writable /dev/null
2629
# Only used if server is running in foreground but not in debug
2631
if debug or not foreground:
2634
# Get client data and settings from last running state.
2635
if server_settings["restore"]:
2637
with open(stored_state_path, "rb") as stored_state:
2638
clients_data, old_client_settings = pickle.load(
2640
os.remove(stored_state_path)
2641
except IOError as e:
2642
if e.errno == errno.ENOENT:
2643
logger.warning("Could not load persistent state:"
2644
" {}".format(os.strerror(e.errno)))
2646
logger.critical("Could not load persistent state:",
2649
except EOFError as e:
2650
logger.warning("Could not load persistent state: "
2654
with PGPEngine() as pgp:
2655
for client_name, client in clients_data.items():
2656
# Skip removed clients
2657
if client_name not in client_settings:
2660
# Decide which value to use after restoring saved state.
2661
# We have three different values: Old config file,
2662
# new config file, and saved state.
2663
# New config value takes precedence if it differs from old
2664
# config value, otherwise use saved state.
2665
for name, value in client_settings[client_name].items():
2667
# For each value in new config, check if it
2668
# differs from the old config value (Except for
2669
# the "secret" attribute)
2670
if (name != "secret"
2672
old_client_settings[client_name][name])):
2673
client[name] = value
2677
# Clients who has passed its expire date can still be
2678
# enabled if its last checker was successful. A Client
2679
# whose checker succeeded before we stored its state is
2680
# assumed to have successfully run all checkers during
2682
if client["enabled"]:
2683
if datetime.datetime.utcnow() >= client["expires"]:
2684
if not client["last_checked_ok"]:
2686
"disabling client {} - Client never "
2687
"performed a successful checker".format(
2689
client["enabled"] = False
2690
elif client["last_checker_status"] != 0:
2692
"disabling client {} - Client last"
2693
" checker failed with error code"
2696
client["last_checker_status"]))
2697
client["enabled"] = False
2699
client["expires"] = (
2700
datetime.datetime.utcnow()
2701
+ client["timeout"])
2702
logger.debug("Last checker succeeded,"
2703
" keeping {} enabled".format(
1885
def client_config_items(config, section):
1886
special_settings = {
1887
"approved_by_default":
1888
lambda: config.getboolean(section,
1889
"approved_by_default"),
1891
for name, value in config.items(section):
2706
client["secret"] = pgp.decrypt(
2707
client["encrypted_secret"],
2708
client_settings[client_name]["secret"])
2710
# If decryption fails, we use secret from new settings
2711
logger.debug("Failed to decrypt {} old secret".format(
2713
client["secret"] = (client_settings[client_name]
2716
# Add/remove clients based on new changes made to config
2717
for client_name in (set(old_client_settings)
2718
- set(client_settings)):
2719
del clients_data[client_name]
2720
for client_name in (set(client_settings)
2721
- set(old_client_settings)):
2722
clients_data[client_name] = client_settings[client_name]
2724
# Create all client objects
2725
for client_name, client in clients_data.items():
2726
tcp_server.clients[client_name] = client_class(
2729
server_settings = server_settings)
1893
yield (name, special_settings[name]())
1897
tcp_server.clients.update(set(
1898
client_class(name = section,
1899
config= dict(client_config_items(
1900
client_config, section)))
1901
for section in client_config.sections()))
2731
1902
if not tcp_server.clients:
2732
1903
logger.warning("No clients defined")
2735
if pidfile is not None:
2739
print(pid, file=pidfile)
2741
logger.error("Could not write to file %r with PID %d",
1909
pidfile.write(str(pid) + "\n".encode("utf-8"))
1912
logger.error("Could not write to file %r with PID %d",
1915
# "pidfile" was never created
2744
1917
del pidfilename
1919
signal.signal(signal.SIGINT, signal.SIG_IGN)
2746
1921
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2747
1922
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2751
@alternate_dbus_interfaces(
2752
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2753
class MandosDBusService(DBusObjectWithProperties):
1925
class MandosDBusService(dbus.service.Object):
2754
1926
"""A D-Bus proxy object"""
2756
1927
def __init__(self):
2757
1928
dbus.service.Object.__init__(self, bus, "/")
2759
_interface = "se.recompile.Mandos"
2761
@dbus_interface_annotations(_interface)
2764
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1929
_interface = "se.bsnet.fukt.Mandos"
2767
1931
@dbus.service.signal(_interface, signature="o")
2768
1932
def ClientAdded(self, objpath):
2816
1980
"Cleanup function; run on exit"
2820
multiprocessing.active_children()
2822
if not (tcp_server.clients or client_settings):
2825
# Store client before exiting. Secrets are encrypted with key
2826
# based on what config file has. If config file is
2827
# removed/edited, old secret will thus be unrecovable.
2829
with PGPEngine() as pgp:
2830
for client in tcp_server.clients.itervalues():
2831
key = client_settings[client.name]["secret"]
2832
client.encrypted_secret = pgp.encrypt(client.secret,
2836
# A list of attributes that can not be pickled
2838
exclude = { "bus", "changedstate", "secret",
2839
"checker", "server_settings" }
2840
for name, typ in inspect.getmembers(dbus.service
2844
client_dict["encrypted_secret"] = (client
2846
for attr in client.client_structure:
2847
if attr not in exclude:
2848
client_dict[attr] = getattr(client, attr)
2850
clients[client.name] = client_dict
2851
del client_settings[client.name]["secret"]
2854
with tempfile.NamedTemporaryFile(
2858
dir=os.path.dirname(stored_state_path),
2859
delete=False) as stored_state:
2860
pickle.dump((clients, client_settings), stored_state)
2861
tempname = stored_state.name
2862
os.rename(tempname, stored_state_path)
2863
except (IOError, OSError) as e:
2869
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2870
logger.warning("Could not save persistent state: {}"
2871
.format(os.strerror(e.errno)))
2873
logger.warning("Could not save persistent state:",
2877
# Delete all clients, and settings from config
2878
1983
while tcp_server.clients:
2879
name, client = tcp_server.clients.popitem()
1984
client = tcp_server.clients.pop()
2881
1986
client.remove_from_connection()
1987
client.disable_hook = None
2882
1988
# Don't signal anything except ClientRemoved
2883
1989
client.disable(quiet=True)
2885
1991
# Emit D-Bus signal
2886
mandos_dbus_service.ClientRemoved(
2887
client.dbus_object_path, client.name)
2888
client_settings.clear()
1992
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2890
1995
atexit.register(cleanup)
2892
for client in tcp_server.clients.itervalues():
1997
for client in tcp_server.clients:
2894
1999
# Emit D-Bus signal
2895
2000
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2896
# Need to initiate checking of clients
2898
client.init_checker()
2900
2003
tcp_server.enable()
2901
2004
tcp_server.server_activate()
2903
2006
# Find out what port we got
2905
service.port = tcp_server.socket.getsockname()[1]
2007
service.port = tcp_server.socket.getsockname()[1]
2907
2009
logger.info("Now listening on address %r, port %d,"
2908
" flowinfo %d, scope_id %d",
2909
*tcp_server.socket.getsockname())
2010
" flowinfo %d, scope_id %d"
2011
% tcp_server.socket.getsockname())
2911
logger.info("Now listening on address %r, port %d",
2912
*tcp_server.socket.getsockname())
2013
logger.info("Now listening on address %r, port %d"
2014
% tcp_server.socket.getsockname())
2914
2016
#service.interface = tcp_server.socket.getsockname()[3]
2918
# From the Avahi example code
2921
except dbus.exceptions.DBusException as error:
2922
logger.critical("D-Bus Exception", exc_info=error)
2925
# End of Avahi example code
2019
# From the Avahi example code
2022
except dbus.exceptions.DBusException, error:
2023
logger.critical("DBusException: %s", error)
2026
# End of Avahi example code
2927
2028
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2928
2029
lambda *args, **kwargs: