To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 482
- compare with another revision
- download diff
- download tarball
- view history from revision 482
- Committer: Teddy Hogeborn
- Date: 2011-04-02 06:37:18 UTC
- Revision ID: teddy@fukt.bsnet.se-20110402063718-13ldrcuu0t33sdc4
* mandos: Tolerate restarting Avahi servers. Also Changed to new
"except x as y" exception syntax.
(AvahiService.entry_group_state_changed_match): New; contains the
SignalMatch object.
(AvahiService.remove): Really remove the group and the signal
connection, if any.
(AvahiService.add): Always create a new group and signal connection.
(AvahiService.cleanup): Changed to simply call remove().
(AvahiService.server_state_changed): Handle and log more bad states.
(AvahiService.activate): Set "follow_name_owner_changes=True" on the
Avahi Server proxy object.
(ClientDBus.checked_ok): Do not return anything.
(ClientDBus.CheckedOK): Do not return anything, as documented.
* mandos-monitor: Call D-Bus methods asynchronously.
"except x as y" exception syntax.
(AvahiService.entry_group_state_changed_match): New; contains the
SignalMatch object.
(AvahiService.remove): Really remove the group and the signal
connection, if any.
(AvahiService.add): Always create a new group and signal connection.
(AvahiService.cleanup): Changed to simply call remove().
(AvahiService.server_state_changed): Handle and log more bad states.
(AvahiService.activate): Set "follow_name_owner_changes=True" on the
Avahi Server proxy object.
(ClientDBus.checked_ok): Do not return anything.
(ClientDBus.CheckedOK): Do not return anything, as documented.
* mandos-monitor: Call D-Bus methods asynchronously.
- files removed:
- debian/mandos-client.examples
- debian/upstream
- network-hooks.d
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
37
import SocketServer as socketserver
40
38
import socket
41
39
import argparse
64
62
import functools
65
63
import cPickle as pickle
66
64
import multiprocessing
67
import types
68
import binascii
69
import tempfile
70
import itertools
71
import collections
72
65
73
66
import dbus
74
67
import dbus.service
88
81
except ImportError:
89
82
SO_BINDTODEVICE = None
90
83
91
version = "1.6.8"
92
stored_state_file = "clients.pickle"
93
94
logger = logging.getLogger()
95
syslogger = None
96
97
try:
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
101
except (OSError, AttributeError):
102
def if_nametoindex(interface):
103
"Get an interface index the hard way, i.e. using fcntl()"
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
with contextlib.closing(socket.socket()) as s:
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(b"16s16x", interface))
108
interface_index = struct.unpack("I", ifreq[16:20])[0]
109
return interface_index
110
111
112
def initlogger(debug, level=logging.WARNING):
113
"""init logger and add loglevel"""
114
115
global syslogger
116
syslogger = (logging.handlers.SysLogHandler
117
(facility =
118
logging.handlers.SysLogHandler.LOG_DAEMON,
119
address = "/dev/log"))
120
syslogger.setFormatter(logging.Formatter
121
('Mandos [%(process)d]: %(levelname)s:'
122
' %(message)s'))
123
logger.addHandler(syslogger)
124
125
if debug:
126
console = logging.StreamHandler()
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
128
' [%(process)d]:'
129
' %(levelname)s:'
130
' %(message)s'))
131
logger.addHandler(console)
132
logger.setLevel(level)
133
134
135
class PGPError(Exception):
136
"""Exception if encryption/decryption fails"""
137
pass
138
139
140
class PGPEngine(object):
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
def __init__(self):
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupgargs = ['--batch',
145
'--home', self.tempdir,
146
'--force-mdc',
147
'--quiet',
148
'--no-use-agent']
149
150
def __enter__(self):
151
return self
152
153
def __exit__(self, exc_type, exc_value, traceback):
154
self._cleanup()
155
return False
156
157
def __del__(self):
158
self._cleanup()
159
160
def _cleanup(self):
161
if self.tempdir is not None:
162
# Delete contents of tempdir
163
for root, dirs, files in os.walk(self.tempdir,
164
topdown = False):
165
for filename in files:
166
os.remove(os.path.join(root, filename))
167
for dirname in dirs:
168
os.rmdir(os.path.join(root, dirname))
169
# Remove tempdir
170
os.rmdir(self.tempdir)
171
self.tempdir = None
172
173
def password_encode(self, password):
174
# Passphrase can not be empty and can not contain newlines or
175
# NUL bytes. So we prefix it and hex encode it.
176
encoded = b"mandos" + binascii.hexlify(password)
177
if len(encoded) > 2048:
178
# GnuPG can't handle long passwords, so encode differently
179
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
180
.replace(b"\n", b"\\n")
181
.replace(b"\0", b"\\x00"))
182
return encoded
183
184
def encrypt(self, data, password):
185
passphrase = self.password_encode(password)
186
with tempfile.NamedTemporaryFile(dir=self.tempdir
187
) as passfile:
188
passfile.write(passphrase)
189
passfile.flush()
190
proc = subprocess.Popen(['gpg', '--symmetric',
191
'--passphrase-file',
192
passfile.name]
193
+ self.gnupgargs,
194
stdin = subprocess.PIPE,
195
stdout = subprocess.PIPE,
196
stderr = subprocess.PIPE)
197
ciphertext, err = proc.communicate(input = data)
198
if proc.returncode != 0:
199
raise PGPError(err)
200
return ciphertext
201
202
def decrypt(self, data, password):
203
passphrase = self.password_encode(password)
204
with tempfile.NamedTemporaryFile(dir = self.tempdir
205
) as passfile:
206
passfile.write(passphrase)
207
passfile.flush()
208
proc = subprocess.Popen(['gpg', '--decrypt',
209
'--passphrase-file',
210
passfile.name]
211
+ self.gnupgargs,
212
stdin = subprocess.PIPE,
213
stdout = subprocess.PIPE,
214
stderr = subprocess.PIPE)
215
decrypted_plaintext, err = proc.communicate(input
216
= data)
217
if proc.returncode != 0:
218
raise PGPError(err)
219
return decrypted_plaintext
220
84
85
version = "1.3.0"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
89
syslogger = (logging.handlers.SysLogHandler
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
95
logger.addHandler(syslogger)
96
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
101
logger.addHandler(console)
221
102
222
103
class AvahiError(Exception):
223
104
def __init__(self, value, *args, **kwargs):
224
105
self.value = value
225
return super(AvahiError, self).__init__(value, *args,
226
**kwargs)
106
super(AvahiError, self).__init__(value, *args, **kwargs)
107
def __unicode__(self):
108
return unicode(repr(self.value))
227
109
228
110
class AvahiServiceError(AvahiError):
229
111
pass
240
122
Used to optionally bind to the specified interface.
241
123
name: string; Example: 'Mandos'
242
124
type: string; Example: '_mandos._tcp'.
243
See <https://www.iana.org/assignments/service-names-port-numbers>
125
See <http://www.dns-sd.org/ServiceTypes.html>
244
126
port: integer; what port to announce
245
127
TXT: list of strings; TXT record for the service
246
128
domain: string; Domain to publish on, default to .local if empty.
252
134
server: D-Bus Server
253
135
bus: dbus.SystemBus()
254
136
"""
255
256
137
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
257
138
servicetype = None, port = None, TXT = None,
258
139
domain = "", host = "", max_renames = 32768,
271
152
self.server = None
272
153
self.bus = bus
273
154
self.entry_group_state_changed_match = None
274
275
155
def rename(self):
276
156
"""Derived from the Avahi example code"""
277
157
if self.rename_count >= self.max_renames:
279
159
" after %i retries, exiting.",
280
160
self.rename_count)
281
161
raise AvahiServiceError("Too many renames")
282
self.name = unicode(self.server
283
.GetAlternativeServiceName(self.name))
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
284
163
logger.info("Changing Zeroconf service name to %r ...",
285
164
self.name)
165
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
168
% self.name))
286
169
self.remove()
287
170
try:
288
171
self.add()
289
172
except dbus.exceptions.DBusException as error:
290
logger.critical("D-Bus Exception", exc_info=error)
173
logger.critical("DBusException: %s", error)
291
174
self.cleanup()
292
175
os._exit(1)
293
176
self.rename_count += 1
294
295
177
def remove(self):
296
178
"""Derived from the Avahi example code"""
179
if self.group is not None:
180
try:
181
self.group.Free()
182
except (dbus.exceptions.UnknownMethodException,
183
dbus.exceptions.DBusException) as e:
184
pass
185
self.group = None
297
186
if self.entry_group_state_changed_match is not None:
298
187
self.entry_group_state_changed_match.remove()
299
188
self.entry_group_state_changed_match = None
300
if self.group is not None:
301
self.group.Reset()
302
303
189
def add(self):
304
190
"""Derived from the Avahi example code"""
305
191
self.remove()
306
if self.group is None:
307
self.group = dbus.Interface(
308
self.bus.get_object(avahi.DBUS_NAME,
309
self.server.EntryGroupNew()),
310
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
self.group = dbus.Interface(
193
self.bus.get_object(avahi.DBUS_NAME,
194
self.server.EntryGroupNew(),
195
follow_name_owner_changes=True),
196
avahi.DBUS_INTERFACE_ENTRY_GROUP)
311
197
self.entry_group_state_changed_match = (
312
198
self.group.connect_to_signal(
313
'StateChanged', self.entry_group_state_changed))
199
'StateChanged', self .entry_group_state_changed))
314
200
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
315
201
self.name, self.type)
316
202
self.group.AddService(
322
208
dbus.UInt16(self.port),
323
209
avahi.string_array_to_txt_array(self.TXT))
324
210
self.group.Commit()
325
326
211
def entry_group_state_changed(self, state, error):
327
212
"""Derived from the Avahi example code"""
328
213
logger.debug("Avahi entry group state change: %i", state)
335
220
elif state == avahi.ENTRY_GROUP_FAILURE:
336
221
logger.critical("Avahi: Error in group state changed %s",
337
222
unicode(error))
338
raise AvahiGroupError("State changed: {!s}"
339
.format(error))
340
223
raise AvahiGroupError("State changed: %s"
224
% unicode(error))
341
225
def cleanup(self):
342
226
"""Derived from the Avahi example code"""
343
if self.group is not None:
344
try:
345
self.group.Free()
346
except (dbus.exceptions.UnknownMethodException,
347
dbus.exceptions.DBusException):
348
pass
349
self.group = None
350
227
self.remove()
351
352
228
def server_state_changed(self, state, error=None):
353
229
"""Derived from the Avahi example code"""
354
230
logger.debug("Avahi server state change: %i", state)
360
236
avahi.SERVER_FAILURE:
361
237
"Zeroconf server failure" }
362
238
if state in bad_states:
363
if bad_states[state] is not None:
364
if error is None:
365
logger.error(bad_states[state])
366
else:
367
logger.error(bad_states[state] + ": %r", error)
368
self.cleanup()
239
if bad_states[state]:
240
logger.error(bad_states[state])
241
self.remove()
369
242
elif state == avahi.SERVER_RUNNING:
370
243
self.add()
371
244
else:
372
if error is None:
373
logger.debug("Unknown state: %r", state)
374
else:
375
logger.debug("Unknown state: %r: %r", state, error)
376
245
logger.debug("Unknown state: %r", state)
377
246
def activate(self):
378
247
"""Derived from the Avahi example code"""
379
248
if self.server is None:
387
256
self.server_state_changed(self.server.GetState())
388
257
389
258
390
class AvahiServiceToSyslog(AvahiService):
391
def rename(self):
392
"""Add the new name to the syslog messages"""
393
ret = AvahiService.rename(self)
394
syslogger.setFormatter(logging.Formatter
395
('Mandos ({}) [%(process)d]:'
396
' %(levelname)s: %(message)s'
397
.format(self.name)))
398
return ret
399
400
401
259
class Client(object):
402
260
"""A representation of a client host served by this server.
403
261
404
262
Attributes:
405
approved: bool(); 'None' if not yet approved/disapproved
263
_approved: bool(); 'None' if not yet approved/disapproved
406
264
approval_delay: datetime.timedelta(); Time to wait for approval
407
265
approval_duration: datetime.timedelta(); Duration of one approval
408
266
checker: subprocess.Popen(); a running checker process used
415
273
instance %(name)s can be used in the command.
416
274
checker_initiator_tag: a gobject event source tag, or None
417
275
created: datetime.datetime(); (UTC) object creation
418
client_structure: Object describing what attributes a client has
419
and is used for storing the client at exit
420
276
current_checker_command: string; current running checker_command
277
disable_hook: If set, called by disable() as disable_hook(self)
421
278
disable_initiator_tag: a gobject event source tag, or None
422
279
enabled: bool()
423
280
fingerprint: string (40 or 32 hexadecimal digits); used to
426
283
interval: datetime.timedelta(); How often to start a new checker
427
284
last_approval_request: datetime.datetime(); (UTC) or None
428
285
last_checked_ok: datetime.datetime(); (UTC) or None
429
last_checker_status: integer between 0 and 255 reflecting exit
430
status of last checker. -1 reflects crashed
431
checker, -2 means no checker completed yet.
432
last_enabled: datetime.datetime(); (UTC) or None
286
last_enabled: datetime.datetime(); (UTC)
433
287
name: string; from the config file, used in log messages and
434
288
D-Bus identifiers
435
289
secret: bytestring; sent verbatim (over TLS) to client
436
290
timeout: datetime.timedelta(); How long from last_checked_ok
437
291
until this client is disabled
438
extended_timeout: extra long timeout when secret has been sent
439
292
runtime_expansions: Allowed attributes for runtime expansion.
440
expires: datetime.datetime(); time (UTC) when a client will be
441
disabled, or None
442
server_settings: The server_settings dict from main()
443
293
"""
444
294
445
295
runtime_expansions = ("approval_delay", "approval_duration",
446
"created", "enabled", "expires",
447
"fingerprint", "host", "interval",
448
"last_approval_request", "last_checked_ok",
296
"created", "enabled", "fingerprint",
297
"host", "interval", "last_checked_ok",
449
298
"last_enabled", "name", "timeout")
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
453
"checker": "fping -q -- %%(host)s",
454
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
458
"enabled": "True",
459
}
460
299
461
300
@staticmethod
462
def config_parser(config):
463
"""Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above.
466
NOTE: Must be a pure function. Must return the same result
467
value given the same arguments.
468
"""
469
settings = {}
470
for client_name in config.sections():
471
section = dict(config.items(client_name))
472
client = settings[client_name] = {}
473
474
client["host"] = section["host"]
475
# Reformat values from string types to Python types
476
client["approved_by_default"] = config.getboolean(
477
client_name, "approved_by_default")
478
client["enabled"] = config.getboolean(client_name,
479
"enabled")
480
481
client["fingerprint"] = (section["fingerprint"].upper()
482
.replace(" ", ""))
483
if "secret" in section:
484
client["secret"] = section["secret"].decode("base64")
485
elif "secfile" in section:
486
with open(os.path.expanduser(os.path.expandvars
487
(section["secfile"])),
488
"rb") as secfile:
489
client["secret"] = secfile.read()
490
else:
491
raise TypeError("No secret or secfile for section {}"
492
.format(section))
493
client["timeout"] = string_to_delta(section["timeout"])
494
client["extended_timeout"] = string_to_delta(
495
section["extended_timeout"])
496
client["interval"] = string_to_delta(section["interval"])
497
client["approval_delay"] = string_to_delta(
498
section["approval_delay"])
499
client["approval_duration"] = string_to_delta(
500
section["approval_duration"])
501
client["checker_command"] = section["checker"]
502
client["last_approval_request"] = None
503
client["last_checked_ok"] = None
504
client["last_checker_status"] = -2
505
506
return settings
507
508
def __init__(self, settings, name = None, server_settings=None):
301
def _timedelta_to_milliseconds(td):
302
"Convert a datetime.timedelta() to milliseconds"
303
return ((td.days * 24 * 60 * 60 * 1000)
304
+ (td.seconds * 1000)
305
+ (td.microseconds // 1000))
306
307
def timeout_milliseconds(self):
308
"Return the 'timeout' attribute in milliseconds"
309
return self._timedelta_to_milliseconds(self.timeout)
310
311
def interval_milliseconds(self):
312
"Return the 'interval' attribute in milliseconds"
313
return self._timedelta_to_milliseconds(self.interval)
314
315
def approval_delay_milliseconds(self):
316
return self._timedelta_to_milliseconds(self.approval_delay)
317
318
def __init__(self, name = None, disable_hook=None, config=None):
319
"""Note: the 'checker' key in 'config' sets the
320
'checker_command' attribute and *not* the 'checker'
321
attribute."""
509
322
self.name = name
510
if server_settings is None:
511
server_settings = {}
512
self.server_settings = server_settings
513
# adding all client settings
514
for setting, value in settings.items():
515
setattr(self, setting, value)
516
517
if self.enabled:
518
if not hasattr(self, "last_enabled"):
519
self.last_enabled = datetime.datetime.utcnow()
520
if not hasattr(self, "expires"):
521
self.expires = (datetime.datetime.utcnow()
522
+ self.timeout)
523
else:
524
self.last_enabled = None
525
self.expires = None
526
323
if config is None:
324
config = {}
527
325
logger.debug("Creating client %r", self.name)
528
326
# Uppercase and remove spaces from fingerprint for later
529
327
# comparison purposes with return value from the fingerprint()
530
328
# function
329
self.fingerprint = (config["fingerprint"].upper()
330
.replace(" ", ""))
531
331
logger.debug(" Fingerprint: %s", self.fingerprint)
532
self.created = settings.get("created",
533
datetime.datetime.utcnow())
534
535
# attributes specific for this server instance
332
if "secret" in config:
333
self.secret = config["secret"].decode("base64")
334
elif "secfile" in config:
335
with open(os.path.expanduser(os.path.expandvars
336
(config["secfile"])),
337
"rb") as secfile:
338
self.secret = secfile.read()
339
else:
340
raise TypeError("No secret or secfile for client %s"
341
% self.name)
342
self.host = config.get("host", "")
343
self.created = datetime.datetime.utcnow()
344
self.enabled = False
345
self.last_approval_request = None
346
self.last_enabled = None
347
self.last_checked_ok = None
348
self.timeout = string_to_delta(config["timeout"])
349
self.interval = string_to_delta(config["interval"])
350
self.disable_hook = disable_hook
536
351
self.checker = None
537
352
self.checker_initiator_tag = None
538
353
self.disable_initiator_tag = None
539
354
self.checker_callback_tag = None
355
self.checker_command = config["checker"]
540
356
self.current_checker_command = None
541
self.approved = None
357
self.last_connect = None
358
self._approved = None
359
self.approved_by_default = config.get("approved_by_default",
360
True)
542
361
self.approvals_pending = 0
543
self.changedstate = (multiprocessing_manager
544
.Condition(multiprocessing_manager
545
.Lock()))
546
self.client_structure = [attr for attr in
547
self.__dict__.iterkeys()
548
if not attr.startswith("_")]
549
self.client_structure.append("client_structure")
550
551
for name, t in inspect.getmembers(type(self),
552
lambda obj:
553
isinstance(obj,
554
property)):
555
if not name.startswith("_"):
556
self.client_structure.append(name)
362
self.approval_delay = string_to_delta(
363
config["approval_delay"])
364
self.approval_duration = string_to_delta(
365
config["approval_duration"])
366
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
557
367
558
# Send notice to process children that client state has changed
559
368
def send_changedstate(self):
560
with self.changedstate:
561
self.changedstate.notify_all()
562
369
self.changedstate.acquire()
370
self.changedstate.notify_all()
371
self.changedstate.release()
372
563
373
def enable(self):
564
374
"""Start this client's checker and timeout hooks"""
565
375
if getattr(self, "enabled", False):
566
376
# Already enabled
567
377
return
568
self.expires = datetime.datetime.utcnow() + self.timeout
569
self.enabled = True
378
self.send_changedstate()
570
379
self.last_enabled = datetime.datetime.utcnow()
571
self.init_checker()
572
self.send_changedstate()
380
# Schedule a new checker to be started an 'interval' from now,
381
# and every interval from then on.
382
self.checker_initiator_tag = (gobject.timeout_add
383
(self.interval_milliseconds(),
384
self.start_checker))
385
# Schedule a disable() when 'timeout' has passed
386
self.disable_initiator_tag = (gobject.timeout_add
387
(self.timeout_milliseconds(),
388
self.disable))
389
self.enabled = True
390
# Also start a new checker *right now*.
391
self.start_checker()
573
392
574
393
def disable(self, quiet=True):
575
394
"""Disable this client."""
576
395
if not getattr(self, "enabled", False):
577
396
return False
578
397
if not quiet:
398
self.send_changedstate()
399
if not quiet:
579
400
logger.info("Disabling client %s", self.name)
580
if getattr(self, "disable_initiator_tag", None) is not None:
401
if getattr(self, "disable_initiator_tag", False):
581
402
gobject.source_remove(self.disable_initiator_tag)
582
403
self.disable_initiator_tag = None
583
self.expires = None
584
if getattr(self, "checker_initiator_tag", None) is not None:
404
if getattr(self, "checker_initiator_tag", False):
585
405
gobject.source_remove(self.checker_initiator_tag)
586
406
self.checker_initiator_tag = None
587
407
self.stop_checker()
408
if self.disable_hook:
409
self.disable_hook(self)
588
410
self.enabled = False
589
if not quiet:
590
self.send_changedstate()
591
411
# Do not run this again if called by a gobject.timeout_add
592
412
return False
593
413
594
414
def __del__(self):
415
self.disable_hook = None
595
416
self.disable()
596
417
597
def init_checker(self):
598
# Schedule a new checker to be started an 'interval' from now,
599
# and every interval from then on.
600
if self.checker_initiator_tag is not None:
601
gobject.source_remove(self.checker_initiator_tag)
602
self.checker_initiator_tag = (gobject.timeout_add
603
(int(self.interval
604
.total_seconds() * 1000),
605
self.start_checker))
606
# Schedule a disable() when 'timeout' has passed
607
if self.disable_initiator_tag is not None:
608
gobject.source_remove(self.disable_initiator_tag)
609
self.disable_initiator_tag = (gobject.timeout_add
610
(int(self.timeout
611
.total_seconds() * 1000),
612
self.disable))
613
# Also start a new checker *right now*.
614
self.start_checker()
615
616
418
def checker_callback(self, pid, condition, command):
617
419
"""The checker has completed, so take appropriate actions."""
618
420
self.checker_callback_tag = None
619
421
self.checker = None
620
422
if os.WIFEXITED(condition):
621
self.last_checker_status = os.WEXITSTATUS(condition)
622
if self.last_checker_status == 0:
423
exitstatus = os.WEXITSTATUS(condition)
424
if exitstatus == 0:
623
425
logger.info("Checker for %(name)s succeeded",
624
426
vars(self))
625
427
self.checked_ok()
627
429
logger.info("Checker for %(name)s failed",
628
430
vars(self))
629
431
else:
630
self.last_checker_status = -1
631
432
logger.warning("Checker for %(name)s crashed?",
632
433
vars(self))
633
434
634
435
def checked_ok(self):
635
"""Assert that the client has been seen, alive and well."""
436
"""Bump up the timeout for this client.
437
438
This should only be called when the client has been seen,
439
alive and well.
440
"""
636
441
self.last_checked_ok = datetime.datetime.utcnow()
637
self.last_checker_status = 0
638
self.bump_timeout()
639
640
def bump_timeout(self, timeout=None):
641
"""Bump up the timeout for this client."""
642
if timeout is None:
643
timeout = self.timeout
644
if self.disable_initiator_tag is not None:
645
gobject.source_remove(self.disable_initiator_tag)
646
self.disable_initiator_tag = None
647
if getattr(self, "enabled", False):
648
self.disable_initiator_tag = (gobject.timeout_add
649
(int(timeout.total_seconds()
650
* 1000), self.disable))
651
self.expires = datetime.datetime.utcnow() + timeout
442
gobject.source_remove(self.disable_initiator_tag)
443
self.disable_initiator_tag = (gobject.timeout_add
444
(self.timeout_milliseconds(),
445
self.disable))
652
446
653
447
def need_approval(self):
654
448
self.last_approval_request = datetime.datetime.utcnow()
659
453
If a checker already exists, leave it running and do
660
454
nothing."""
661
455
# The reason for not killing a running checker is that if we
662
# did that, and if a checker (for some reason) started running
663
# slowly and taking more than 'interval' time, then the client
664
# would inevitably timeout, since no checker would get a
665
# chance to run to completion. If we instead leave running
456
# did that, then if a checker (for some reason) started
457
# running slowly and taking more than 'interval' time, the
458
# client would inevitably timeout, since no checker would get
459
# a chance to run to completion. If we instead leave running
666
460
# checkers alone, the checker would have to take more time
667
461
# than 'timeout' for the client to be disabled, which is as it
668
462
# should be.
670
464
# If a checker exists, make sure it is not a zombie
671
465
try:
672
466
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
673
except AttributeError:
674
pass
675
except OSError as error:
676
if error.errno != errno.ECHILD:
677
raise
467
except (AttributeError, OSError) as error:
468
if (isinstance(error, OSError)
469
and error.errno != errno.ECHILD):
470
raise error
678
471
else:
679
472
if pid:
680
473
logger.warning("Checker was a zombie")
683
476
self.current_checker_command)
684
477
# Start a new checker if needed
685
478
if self.checker is None:
686
# Escape attributes for the shell
687
escaped_attrs = { attr:
688
re.escape(unicode(getattr(self,
689
attr)))
690
for attr in self.runtime_expansions }
691
479
try:
692
command = self.checker_command % escaped_attrs
693
except TypeError as error:
694
logger.error('Could not format string "%s"',
695
self.checker_command, exc_info=error)
696
return True # Try again later
480
# In case checker_command has exactly one % operator
481
command = self.checker_command % self.host
482
except TypeError:
483
# Escape attributes for the shell
484
escaped_attrs = dict(
485
(attr,
486
re.escape(unicode(str(getattr(self, attr, "")),
487
errors=
488
'replace')))
489
for attr in
490
self.runtime_expansions)
491
492
try:
493
command = self.checker_command % escaped_attrs
494
except TypeError as error:
495
logger.error('Could not format string "%s":'
496
' %s', self.checker_command, error)
497
return True # Try again later
697
498
self.current_checker_command = command
698
499
try:
699
500
logger.info("Starting checker %r for %s",
702
503
# in normal mode, that is already done by daemon(),
703
504
# and in debug mode we don't want to. (Stdin is
704
505
# always replaced by /dev/null.)
705
# The exception is when not debugging but nevertheless
706
# running in the foreground; use the previously
707
# created wnull.
708
popen_args = {}
709
if (not self.server_settings["debug"]
710
and self.server_settings["foreground"]):
711
popen_args.update({"stdout": wnull,
712
"stderr": wnull })
713
506
self.checker = subprocess.Popen(command,
714
507
close_fds=True,
715
shell=True, cwd="/",
716
**popen_args)
717
except OSError as error:
718
logger.error("Failed to start subprocess",
719
exc_info=error)
720
return True
721
self.checker_callback_tag = (gobject.child_watch_add
722
(self.checker.pid,
723
self.checker_callback,
724
data=command))
725
# The checker may have completed before the gobject
726
# watch was added. Check for this.
727
try:
508
shell=True, cwd="/")
509
self.checker_callback_tag = (gobject.child_watch_add
510
(self.checker.pid,
511
self.checker_callback,
512
data=command))
513
# The checker may have completed before the gobject
514
# watch was added. Check for this.
728
515
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
516
if pid:
517
gobject.source_remove(self.checker_callback_tag)
518
self.checker_callback(pid, status, command)
729
519
except OSError as error:
730
if error.errno == errno.ECHILD:
731
# This should never happen
732
logger.error("Child process vanished",
733
exc_info=error)
734
return True
735
raise
736
if pid:
737
gobject.source_remove(self.checker_callback_tag)
738
self.checker_callback(pid, status, command)
520
logger.error("Failed to start subprocess: %s",
521
error)
739
522
# Re-run this periodically if run by gobject.timeout_add
740
523
return True
741
524
748
531
return
749
532
logger.debug("Stopping checker for %(name)s", vars(self))
750
533
try:
751
self.checker.terminate()
534
os.kill(self.checker.pid, signal.SIGTERM)
752
535
#time.sleep(0.5)
753
536
#if self.checker.poll() is None:
754
# self.checker.kill()
537
# os.kill(self.checker.pid, signal.SIGKILL)
755
538
except OSError as error:
756
539
if error.errno != errno.ESRCH: # No such process
757
540
raise
758
541
self.checker = None
759
542
760
761
543
def dbus_service_property(dbus_interface, signature="v",
762
544
access="readwrite", byte_arrays=False):
763
545
"""Decorators for marking methods of a DBusObjectWithProperties to
774
556
# "Set" method, so we fail early here:
775
557
if byte_arrays and signature != "ay":
776
558
raise ValueError("Byte arrays not supported for non-'ay'"
777
" signature {!r}".format(signature))
559
" signature %r" % signature)
778
560
def decorator(func):
779
561
func._dbus_is_property = True
780
562
func._dbus_interface = dbus_interface
788
570
return decorator
789
571
790
572
791
def dbus_interface_annotations(dbus_interface):
792
"""Decorator for marking functions returning interface annotations
793
794
Usage:
795
796
@dbus_interface_annotations("org.example.Interface")
797
def _foo(self): # Function name does not matter
798
return {"org.freedesktop.DBus.Deprecated": "true",
799
"org.freedesktop.DBus.Property.EmitsChangedSignal":
800
"false"}
801
"""
802
def decorator(func):
803
func._dbus_is_interface = True
804
func._dbus_interface = dbus_interface
805
func._dbus_name = dbus_interface
806
return func
807
return decorator
808
809
810
def dbus_annotations(annotations):
811
"""Decorator to annotate D-Bus methods, signals or properties
812
Usage:
813
814
@dbus_service_property("org.example.Interface", signature="b",
815
access="r")
816
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
817
"org.freedesktop.DBus.Property."
818
"EmitsChangedSignal": "false"})
819
def Property_dbus_property(self):
820
return dbus.Boolean(False)
821
"""
822
def decorator(func):
823
func._dbus_annotations = annotations
824
return func
825
return decorator
826
827
828
573
class DBusPropertyException(dbus.exceptions.DBusException):
829
574
"""A base class for D-Bus property-related exceptions
830
575
"""
831
pass
576
def __unicode__(self):
577
return unicode(str(self))
578
832
579
833
580
class DBusPropertyAccessException(DBusPropertyException):
834
581
"""A property's access permissions disallows an operation.
844
591
845
592
class DBusObjectWithProperties(dbus.service.Object):
846
593
"""A D-Bus object with properties.
847
594
848
595
Classes inheriting from this can use the dbus_service_property
849
596
decorator to expose methods as D-Bus properties. It exposes the
850
597
standard Get(), Set(), and GetAll() methods on the D-Bus.
851
598
"""
852
599
853
600
@staticmethod
854
def _is_dbus_thing(thing):
855
"""Returns a function testing if an attribute is a D-Bus thing
856
857
If called like _is_dbus_thing("method") it returns a function
858
suitable for use as predicate to inspect.getmembers().
859
"""
860
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
861
False)
601
def _is_dbus_property(obj):
602
return getattr(obj, "_dbus_is_property", False)
862
603
863
def _get_all_dbus_things(self, thing):
604
def _get_all_dbus_properties(self):
864
605
"""Returns a generator of (name, attribute) pairs
865
606
"""
866
return ((getattr(athing.__get__(self), "_dbus_name",
867
name),
868
athing.__get__(self))
869
for cls in self.__class__.__mro__
870
for name, athing in
871
inspect.getmembers(cls,
872
self._is_dbus_thing(thing)))
607
return ((prop._dbus_name, prop)
608
for name, prop in
609
inspect.getmembers(self, self._is_dbus_property))
873
610
874
611
def _get_dbus_property(self, interface_name, property_name):
875
612
"""Returns a bound method if one exists which is a D-Bus
876
613
property with the specified name and interface.
877
614
"""
878
for cls in self.__class__.__mro__:
879
for name, value in (inspect.getmembers
880
(cls,
881
self._is_dbus_thing("property"))):
882
if (value._dbus_name == property_name
883
and value._dbus_interface == interface_name):
884
return value.__get__(self)
885
615
for name in (property_name,
616
property_name + "_dbus_property"):
617
prop = getattr(self, name, None)
618
if (prop is None
619
or not self._is_dbus_property(prop)
620
or prop._dbus_name != property_name
621
or (interface_name and prop._dbus_interface
622
and interface_name != prop._dbus_interface)):
623
continue
624
return prop
886
625
# No such property
887
626
raise DBusPropertyNotFound(self.dbus_object_path + ":"
888
627
+ interface_name + "."
912
651
# The byte_arrays option is not supported yet on
913
652
# signatures other than "ay".
914
653
if prop._dbus_signature != "ay":
915
raise ValueError("Byte arrays not supported for non-"
916
"'ay' signature {!r}"
917
.format(prop._dbus_signature))
918
value = dbus.ByteArray(b''.join(chr(byte)
919
for byte in value))
654
raise ValueError
655
value = dbus.ByteArray(''.join(unichr(byte)
656
for byte in value))
920
657
prop(value)
921
658
922
659
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
924
661
def GetAll(self, interface_name):
925
662
"""Standard D-Bus property GetAll() method, see D-Bus
926
663
standard.
927
664
928
665
Note: Will not include properties with access="write".
929
666
"""
930
properties = {}
931
for name, prop in self._get_all_dbus_things("property"):
667
all = {}
668
for name, prop in self._get_all_dbus_properties():
932
669
if (interface_name
933
670
and interface_name != prop._dbus_interface):
934
671
# Interface non-empty but did not match
938
675
continue
939
676
value = prop()
940
677
if not hasattr(value, "variant_level"):
941
properties[name] = value
678
all[name] = value
942
679
continue
943
properties[name] = type(value)(value, variant_level=
944
value.variant_level+1)
945
return dbus.Dictionary(properties, signature="sv")
680
all[name] = type(value)(value, variant_level=
681
value.variant_level+1)
682
return dbus.Dictionary(all, signature="sv")
946
683
947
684
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
948
685
out_signature="s",
949
686
path_keyword='object_path',
950
687
connection_keyword='connection')
951
688
def Introspect(self, object_path, connection):
952
"""Overloading of standard D-Bus method.
953
954
Inserts property tags and interface annotation tags.
689
"""Standard D-Bus method, overloaded to insert property tags.
955
690
"""
956
691
xmlstring = dbus.service.Object.Introspect(self, object_path,
957
692
connection)
964
699
e.setAttribute("access", prop._dbus_access)
965
700
return e
966
701
for if_tag in document.getElementsByTagName("interface"):
967
# Add property tags
968
702
for tag in (make_tag(document, name, prop)
969
703
for name, prop
970
in self._get_all_dbus_things("property")
704
in self._get_all_dbus_properties()
971
705
if prop._dbus_interface
972
706
== if_tag.getAttribute("name")):
973
707
if_tag.appendChild(tag)
974
# Add annotation tags
975
for typ in ("method", "signal", "property"):
976
for tag in if_tag.getElementsByTagName(typ):
977
annots = dict()
978
for name, prop in (self.
979
_get_all_dbus_things(typ)):
980
if (name == tag.getAttribute("name")
981
and prop._dbus_interface
982
== if_tag.getAttribute("name")):
983
annots.update(getattr
984
(prop,
985
"_dbus_annotations",
986
{}))
987
for name, value in annots.items():
988
ann_tag = document.createElement(
989
"annotation")
990
ann_tag.setAttribute("name", name)
991
ann_tag.setAttribute("value", value)
992
tag.appendChild(ann_tag)
993
# Add interface annotation tags
994
for annotation, value in dict(
995
itertools.chain.from_iterable(
996
annotations().items()
997
for name, annotations in
998
self._get_all_dbus_things("interface")
999
if name == if_tag.getAttribute("name")
1000
)).items():
1001
ann_tag = document.createElement("annotation")
1002
ann_tag.setAttribute("name", annotation)
1003
ann_tag.setAttribute("value", value)
1004
if_tag.appendChild(ann_tag)
1005
708
# Add the names to the return values for the
1006
709
# "org.freedesktop.DBus.Properties" methods
1007
710
if (if_tag.getAttribute("name")
1022
725
except (AttributeError, xml.dom.DOMException,
1023
726
xml.parsers.expat.ExpatError) as error:
1024
727
logger.error("Failed to override Introspection method",
1025
exc_info=error)
728
error)
1026
729
return xmlstring
1027
730
1028
731
1029
def datetime_to_dbus(dt, variant_level=0):
1030
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1031
if dt is None:
1032
return dbus.String("", variant_level = variant_level)
1033
return dbus.String(dt.isoformat(),
1034
variant_level=variant_level)
1035
1036
1037
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1038
"""A class decorator; applied to a subclass of
1039
dbus.service.Object, it will add alternate D-Bus attributes with
1040
interface names according to the "alt_interface_names" mapping.
1041
Usage:
1042
1043
@alternate_dbus_interfaces({"org.example.Interface":
1044
"net.example.AlternateInterface"})
1045
class SampleDBusObject(dbus.service.Object):
1046
@dbus.service.method("org.example.Interface")
1047
def SampleDBusMethod():
1048
pass
1049
1050
The above "SampleDBusMethod" on "SampleDBusObject" will be
1051
reachable via two interfaces: "org.example.Interface" and
1052
"net.example.AlternateInterface", the latter of which will have
1053
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1054
"true", unless "deprecate" is passed with a False value.
1055
1056
This works for methods and signals, and also for D-Bus properties
1057
(from DBusObjectWithProperties) and interfaces (from the
1058
dbus_interface_annotations decorator).
1059
"""
1060
def wrapper(cls):
1061
for orig_interface_name, alt_interface_name in (
1062
alt_interface_names.items()):
1063
attr = {}
1064
interface_names = set()
1065
# Go though all attributes of the class
1066
for attrname, attribute in inspect.getmembers(cls):
1067
# Ignore non-D-Bus attributes, and D-Bus attributes
1068
# with the wrong interface name
1069
if (not hasattr(attribute, "_dbus_interface")
1070
or not attribute._dbus_interface
1071
.startswith(orig_interface_name)):
1072
continue
1073
# Create an alternate D-Bus interface name based on
1074
# the current name
1075
alt_interface = (attribute._dbus_interface
1076
.replace(orig_interface_name,
1077
alt_interface_name))
1078
interface_names.add(alt_interface)
1079
# Is this a D-Bus signal?
1080
if getattr(attribute, "_dbus_is_signal", False):
1081
# Extract the original non-method undecorated
1082
# function by black magic
1083
nonmethod_func = (dict(
1084
zip(attribute.func_code.co_freevars,
1085
attribute.__closure__))["func"]
1086
.cell_contents)
1087
# Create a new, but exactly alike, function
1088
# object, and decorate it to be a new D-Bus signal
1089
# with the alternate D-Bus interface name
1090
new_function = (dbus.service.signal
1091
(alt_interface,
1092
attribute._dbus_signature)
1093
(types.FunctionType(
1094
nonmethod_func.func_code,
1095
nonmethod_func.func_globals,
1096
nonmethod_func.func_name,
1097
nonmethod_func.func_defaults,
1098
nonmethod_func.func_closure)))
1099
# Copy annotations, if any
1100
try:
1101
new_function._dbus_annotations = (
1102
dict(attribute._dbus_annotations))
1103
except AttributeError:
1104
pass
1105
# Define a creator of a function to call both the
1106
# original and alternate functions, so both the
1107
# original and alternate signals gets sent when
1108
# the function is called
1109
def fixscope(func1, func2):
1110
"""This function is a scope container to pass
1111
func1 and func2 to the "call_both" function
1112
outside of its arguments"""
1113
def call_both(*args, **kwargs):
1114
"""This function will emit two D-Bus
1115
signals by calling func1 and func2"""
1116
func1(*args, **kwargs)
1117
func2(*args, **kwargs)
1118
return call_both
1119
# Create the "call_both" function and add it to
1120
# the class
1121
attr[attrname] = fixscope(attribute, new_function)
1122
# Is this a D-Bus method?
1123
elif getattr(attribute, "_dbus_is_method", False):
1124
# Create a new, but exactly alike, function
1125
# object. Decorate it to be a new D-Bus method
1126
# with the alternate D-Bus interface name. Add it
1127
# to the class.
1128
attr[attrname] = (dbus.service.method
1129
(alt_interface,
1130
attribute._dbus_in_signature,
1131
attribute._dbus_out_signature)
1132
(types.FunctionType
1133
(attribute.func_code,
1134
attribute.func_globals,
1135
attribute.func_name,
1136
attribute.func_defaults,
1137
attribute.func_closure)))
1138
# Copy annotations, if any
1139
try:
1140
attr[attrname]._dbus_annotations = (
1141
dict(attribute._dbus_annotations))
1142
except AttributeError:
1143
pass
1144
# Is this a D-Bus property?
1145
elif getattr(attribute, "_dbus_is_property", False):
1146
# Create a new, but exactly alike, function
1147
# object, and decorate it to be a new D-Bus
1148
# property with the alternate D-Bus interface
1149
# name. Add it to the class.
1150
attr[attrname] = (dbus_service_property
1151
(alt_interface,
1152
attribute._dbus_signature,
1153
attribute._dbus_access,
1154
attribute
1155
._dbus_get_args_options
1156
["byte_arrays"])
1157
(types.FunctionType
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1163
# Copy annotations, if any
1164
try:
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1167
except AttributeError:
1168
pass
1169
# Is this a D-Bus interface?
1170
elif getattr(attribute, "_dbus_is_interface", False):
1171
# Create a new, but exactly alike, function
1172
# object. Decorate it to be a new D-Bus interface
1173
# with the alternate D-Bus interface name. Add it
1174
# to the class.
1175
attr[attrname] = (dbus_interface_annotations
1176
(alt_interface)
1177
(types.FunctionType
1178
(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1183
if deprecate:
1184
# Deprecate all alternate interfaces
1185
iname="_AlternateDBusNames_interface_annotation{}"
1186
for interface_name in interface_names:
1187
@dbus_interface_annotations(interface_name)
1188
def func(self):
1189
return { "org.freedesktop.DBus.Deprecated":
1190
"true" }
1191
# Find an unused name
1192
for aname in (iname.format(i)
1193
for i in itertools.count()):
1194
if aname not in attr:
1195
attr[aname] = func
1196
break
1197
if interface_names:
1198
# Replace the class with a new subclass of it with
1199
# methods, signals, etc. as created above.
1200
cls = type(b"{}Alternate".format(cls.__name__),
1201
(cls,), attr)
1202
return cls
1203
return wrapper
1204
1205
1206
@alternate_dbus_interfaces({"se.recompile.Mandos":
1207
"se.bsnet.fukt.Mandos"})
1208
732
class ClientDBus(Client, DBusObjectWithProperties):
1209
733
"""A Client class using D-Bus
1210
734
1219
743
# dbus.service.Object doesn't use super(), so we can't either.
1220
744
1221
745
def __init__(self, bus = None, *args, **kwargs):
746
self._approvals_pending = 0
1222
747
self.bus = bus
1223
748
Client.__init__(self, *args, **kwargs)
1224
749
# Only now, when this client is initialized, can it show up on
1230
755
("/clients/" + client_object_name))
1231
756
DBusObjectWithProperties.__init__(self, self.bus,
1232
757
self.dbus_object_path)
1233
1234
def notifychangeproperty(transform_func,
1235
dbus_name, type_func=lambda x: x,
1236
variant_level=1):
1237
""" Modify a variable so that it's a property which announces
1238
its changes to DBus.
1239
1240
transform_fun: Function that takes a value and a variant_level
1241
and transforms it to a D-Bus type.
1242
dbus_name: D-Bus name of the variable
1243
type_func: Function that transform the value before sending it
1244
to the D-Bus. Default: no transform
1245
variant_level: D-Bus variant level. Default: 1
1246
"""
1247
attrname = "_{}".format(dbus_name)
1248
def setter(self, value):
1249
if hasattr(self, "dbus_object_path"):
1250
if (not hasattr(self, attrname) or
1251
type_func(getattr(self, attrname, None))
1252
!= type_func(value)):
1253
dbus_value = transform_func(type_func(value),
1254
variant_level
1255
=variant_level)
1256
self.PropertyChanged(dbus.String(dbus_name),
1257
dbus_value)
1258
setattr(self, attrname, value)
1259
1260
return property(lambda self: getattr(self, attrname), setter)
1261
1262
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1263
approvals_pending = notifychangeproperty(dbus.Boolean,
1264
"ApprovalPending",
1265
type_func = bool)
1266
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1267
last_enabled = notifychangeproperty(datetime_to_dbus,
1268
"LastEnabled")
1269
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1270
type_func = lambda checker:
1271
checker is not None)
1272
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1273
"LastCheckedOK")
1274
last_checker_status = notifychangeproperty(dbus.Int16,
1275
"LastCheckerStatus")
1276
last_approval_request = notifychangeproperty(
1277
datetime_to_dbus, "LastApprovalRequest")
1278
approved_by_default = notifychangeproperty(dbus.Boolean,
1279
"ApprovedByDefault")
1280
approval_delay = notifychangeproperty(dbus.UInt64,
1281
"ApprovalDelay",
1282
type_func =
1283
lambda td: td.total_seconds()
1284
* 1000)
1285
approval_duration = notifychangeproperty(
1286
dbus.UInt64, "ApprovalDuration",
1287
type_func = lambda td: td.total_seconds() * 1000)
1288
host = notifychangeproperty(dbus.String, "Host")
1289
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1290
type_func = lambda td:
1291
td.total_seconds() * 1000)
1292
extended_timeout = notifychangeproperty(
1293
dbus.UInt64, "ExtendedTimeout",
1294
type_func = lambda td: td.total_seconds() * 1000)
1295
interval = notifychangeproperty(dbus.UInt64,
1296
"Interval",
1297
type_func =
1298
lambda td: td.total_seconds()
1299
* 1000)
1300
checker_command = notifychangeproperty(dbus.String, "Checker")
1301
1302
del notifychangeproperty
758
759
def _get_approvals_pending(self):
760
return self._approvals_pending
761
def _set_approvals_pending(self, value):
762
old_value = self._approvals_pending
763
self._approvals_pending = value
764
bval = bool(value)
765
if (hasattr(self, "dbus_object_path")
766
and bval is not bool(old_value)):
767
dbus_bool = dbus.Boolean(bval, variant_level=1)
768
self.PropertyChanged(dbus.String("ApprovalPending"),
769
dbus_bool)
770
771
approvals_pending = property(_get_approvals_pending,
772
_set_approvals_pending)
773
del _get_approvals_pending, _set_approvals_pending
774
775
@staticmethod
776
def _datetime_to_dbus(dt, variant_level=0):
777
"""Convert a UTC datetime.datetime() to a D-Bus type."""
778
return dbus.String(dt.isoformat(),
779
variant_level=variant_level)
780
781
def enable(self):
782
oldstate = getattr(self, "enabled", False)
783
r = Client.enable(self)
784
if oldstate != self.enabled:
785
# Emit D-Bus signals
786
self.PropertyChanged(dbus.String("Enabled"),
787
dbus.Boolean(True, variant_level=1))
788
self.PropertyChanged(
789
dbus.String("LastEnabled"),
790
self._datetime_to_dbus(self.last_enabled,
791
variant_level=1))
792
return r
793
794
def disable(self, quiet = False):
795
oldstate = getattr(self, "enabled", False)
796
r = Client.disable(self, quiet=quiet)
797
if not quiet and oldstate != self.enabled:
798
# Emit D-Bus signal
799
self.PropertyChanged(dbus.String("Enabled"),
800
dbus.Boolean(False, variant_level=1))
801
return r
1303
802
1304
803
def __del__(self, *args, **kwargs):
1305
804
try:
1314
813
*args, **kwargs):
1315
814
self.checker_callback_tag = None
1316
815
self.checker = None
816
# Emit D-Bus signal
817
self.PropertyChanged(dbus.String("CheckerRunning"),
818
dbus.Boolean(False, variant_level=1))
1317
819
if os.WIFEXITED(condition):
1318
820
exitstatus = os.WEXITSTATUS(condition)
1319
821
# Emit D-Bus signal
1329
831
return Client.checker_callback(self, pid, condition, command,
1330
832
*args, **kwargs)
1331
833
834
def checked_ok(self, *args, **kwargs):
835
Client.checked_ok(self, *args, **kwargs)
836
# Emit D-Bus signal
837
self.PropertyChanged(
838
dbus.String("LastCheckedOK"),
839
(self._datetime_to_dbus(self.last_checked_ok,
840
variant_level=1)))
841
842
def need_approval(self, *args, **kwargs):
843
r = Client.need_approval(self, *args, **kwargs)
844
# Emit D-Bus signal
845
self.PropertyChanged(
846
dbus.String("LastApprovalRequest"),
847
(self._datetime_to_dbus(self.last_approval_request,
848
variant_level=1)))
849
return r
850
1332
851
def start_checker(self, *args, **kwargs):
1333
old_checker_pid = getattr(self.checker, "pid", None)
852
old_checker = self.checker
853
if self.checker is not None:
854
old_checker_pid = self.checker.pid
855
else:
856
old_checker_pid = None
1334
857
r = Client.start_checker(self, *args, **kwargs)
1335
858
# Only if new checker process was started
1336
859
if (self.checker is not None
1337
860
and old_checker_pid != self.checker.pid):
1338
861
# Emit D-Bus signal
1339
862
self.CheckerStarted(self.current_checker_command)
863
self.PropertyChanged(
864
dbus.String("CheckerRunning"),
865
dbus.Boolean(True, variant_level=1))
1340
866
return r
1341
867
868
def stop_checker(self, *args, **kwargs):
869
old_checker = getattr(self, "checker", None)
870
r = Client.stop_checker(self, *args, **kwargs)
871
if (old_checker is not None
872
and getattr(self, "checker", None) is None):
873
self.PropertyChanged(dbus.String("CheckerRunning"),
874
dbus.Boolean(False, variant_level=1))
875
return r
876
1342
877
def _reset_approved(self):
1343
self.approved = None
878
self._approved = None
1344
879
return False
1345
880
1346
881
def approve(self, value=True):
1347
self.approved = value
1348
gobject.timeout_add(int(self.approval_duration.total_seconds()
1349
* 1000), self._reset_approved)
1350
882
self.send_changedstate()
883
self._approved = value
884
gobject.timeout_add(self._timedelta_to_milliseconds
885
(self.approval_duration),
886
self._reset_approved)
887
1351
888
1352
889
## D-Bus methods, signals & properties
1353
_interface = "se.recompile.Mandos.Client"
1354
1355
## Interfaces
1356
1357
@dbus_interface_annotations(_interface)
1358
def _foo(self):
1359
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1360
"false"}
890
_interface = "se.bsnet.fukt.Mandos.Client"
1361
891
1362
892
## Signals
1363
893
1449
979
if value is None: # get
1450
980
return dbus.Boolean(self.approved_by_default)
1451
981
self.approved_by_default = bool(value)
982
# Emit D-Bus signal
983
self.PropertyChanged(dbus.String("ApprovedByDefault"),
984
dbus.Boolean(value, variant_level=1))
1452
985
1453
986
# ApprovalDelay - property
1454
987
@dbus_service_property(_interface, signature="t",
1455
988
access="readwrite")
1456
989
def ApprovalDelay_dbus_property(self, value=None):
1457
990
if value is None: # get
1458
return dbus.UInt64(self.approval_delay.total_seconds()
1459
* 1000)
991
return dbus.UInt64(self.approval_delay_milliseconds())
1460
992
self.approval_delay = datetime.timedelta(0, 0, 0, value)
993
# Emit D-Bus signal
994
self.PropertyChanged(dbus.String("ApprovalDelay"),
995
dbus.UInt64(value, variant_level=1))
1461
996
1462
997
# ApprovalDuration - property
1463
998
@dbus_service_property(_interface, signature="t",
1464
999
access="readwrite")
1465
1000
def ApprovalDuration_dbus_property(self, value=None):
1466
1001
if value is None: # get
1467
return dbus.UInt64(self.approval_duration.total_seconds()
1468
* 1000)
1002
return dbus.UInt64(self._timedelta_to_milliseconds(
1003
self.approval_duration))
1469
1004
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1005
# Emit D-Bus signal
1006
self.PropertyChanged(dbus.String("ApprovalDuration"),
1007
dbus.UInt64(value, variant_level=1))
1470
1008
1471
1009
# Name - property
1472
1010
@dbus_service_property(_interface, signature="s", access="read")
1484
1022
def Host_dbus_property(self, value=None):
1485
1023
if value is None: # get
1486
1024
return dbus.String(self.host)
1487
self.host = unicode(value)
1025
self.host = value
1026
# Emit D-Bus signal
1027
self.PropertyChanged(dbus.String("Host"),
1028
dbus.String(value, variant_level=1))
1488
1029
1489
1030
# Created - property
1490
1031
@dbus_service_property(_interface, signature="s", access="read")
1491
1032
def Created_dbus_property(self):
1492
return datetime_to_dbus(self.created)
1033
return dbus.String(self._datetime_to_dbus(self.created))
1493
1034
1494
1035
# LastEnabled - property
1495
1036
@dbus_service_property(_interface, signature="s", access="read")
1496
1037
def LastEnabled_dbus_property(self):
1497
return datetime_to_dbus(self.last_enabled)
1038
if self.last_enabled is None:
1039
return dbus.String("")
1040
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1498
1041
1499
1042
# Enabled - property
1500
1043
@dbus_service_property(_interface, signature="b",
1514
1057
if value is not None:
1515
1058
self.checked_ok()
1516
1059
return
1517
return datetime_to_dbus(self.last_checked_ok)
1518
1519
# LastCheckerStatus - property
1520
@dbus_service_property(_interface, signature="n",
1521
access="read")
1522
def LastCheckerStatus_dbus_property(self):
1523
return dbus.Int16(self.last_checker_status)
1524
1525
# Expires - property
1526
@dbus_service_property(_interface, signature="s", access="read")
1527
def Expires_dbus_property(self):
1528
return datetime_to_dbus(self.expires)
1060
if self.last_checked_ok is None:
1061
return dbus.String("")
1062
return dbus.String(self._datetime_to_dbus(self
1063
.last_checked_ok))
1529
1064
1530
1065
# LastApprovalRequest - property
1531
1066
@dbus_service_property(_interface, signature="s", access="read")
1532
1067
def LastApprovalRequest_dbus_property(self):
1533
return datetime_to_dbus(self.last_approval_request)
1068
if self.last_approval_request is None:
1069
return dbus.String("")
1070
return dbus.String(self.
1071
_datetime_to_dbus(self
1072
.last_approval_request))
1534
1073
1535
1074
# Timeout - property
1536
1075
@dbus_service_property(_interface, signature="t",
1537
1076
access="readwrite")
1538
1077
def Timeout_dbus_property(self, value=None):
1539
1078
if value is None: # get
1540
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1541
old_timeout = self.timeout
1079
return dbus.UInt64(self.timeout_milliseconds())
1542
1080
self.timeout = datetime.timedelta(0, 0, 0, value)
1543
# Reschedule disabling
1544
if self.enabled:
1545
now = datetime.datetime.utcnow()
1546
self.expires += self.timeout - old_timeout
1547
if self.expires <= now:
1548
# The timeout has passed
1549
self.disable()
1550
else:
1551
if (getattr(self, "disable_initiator_tag", None)
1552
is None):
1553
return
1554
gobject.source_remove(self.disable_initiator_tag)
1555
self.disable_initiator_tag = (
1556
gobject.timeout_add(
1557
int((self.expires - now).total_seconds()
1558
* 1000), self.disable))
1559
1560
# ExtendedTimeout - property
1561
@dbus_service_property(_interface, signature="t",
1562
access="readwrite")
1563
def ExtendedTimeout_dbus_property(self, value=None):
1564
if value is None: # get
1565
return dbus.UInt64(self.extended_timeout.total_seconds()
1566
* 1000)
1567
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1081
# Emit D-Bus signal
1082
self.PropertyChanged(dbus.String("Timeout"),
1083
dbus.UInt64(value, variant_level=1))
1084
if getattr(self, "disable_initiator_tag", None) is None:
1085
return
1086
# Reschedule timeout
1087
gobject.source_remove(self.disable_initiator_tag)
1088
self.disable_initiator_tag = None
1089
time_to_die = (self.
1090
_timedelta_to_milliseconds((self
1091
.last_checked_ok
1092
+ self.timeout)
1093
- datetime.datetime
1094
.utcnow()))
1095
if time_to_die <= 0:
1096
# The timeout has passed
1097
self.disable()
1098
else:
1099
self.disable_initiator_tag = (gobject.timeout_add
1100
(time_to_die, self.disable))
1568
1101
1569
1102
# Interval - property
1570
1103
@dbus_service_property(_interface, signature="t",
1571
1104
access="readwrite")
1572
1105
def Interval_dbus_property(self, value=None):
1573
1106
if value is None: # get
1574
return dbus.UInt64(self.interval.total_seconds() * 1000)
1107
return dbus.UInt64(self.interval_milliseconds())
1575
1108
self.interval = datetime.timedelta(0, 0, 0, value)
1109
# Emit D-Bus signal
1110
self.PropertyChanged(dbus.String("Interval"),
1111
dbus.UInt64(value, variant_level=1))
1576
1112
if getattr(self, "checker_initiator_tag", None) is None:
1577
1113
return
1578
if self.enabled:
1579
# Reschedule checker run
1580
gobject.source_remove(self.checker_initiator_tag)
1581
self.checker_initiator_tag = (gobject.timeout_add
1582
(value, self.start_checker))
1583
self.start_checker() # Start one now, too
1584
1114
# Reschedule checker run
1115
gobject.source_remove(self.checker_initiator_tag)
1116
self.checker_initiator_tag = (gobject.timeout_add
1117
(value, self.start_checker))
1118
self.start_checker() # Start one now, too
1119
1585
1120
# Checker - property
1586
1121
@dbus_service_property(_interface, signature="s",
1587
1122
access="readwrite")
1588
1123
def Checker_dbus_property(self, value=None):
1589
1124
if value is None: # get
1590
1125
return dbus.String(self.checker_command)
1591
self.checker_command = unicode(value)
1126
self.checker_command = value
1127
# Emit D-Bus signal
1128
self.PropertyChanged(dbus.String("Checker"),
1129
dbus.String(self.checker_command,
1130
variant_level=1))
1592
1131
1593
1132
# CheckerRunning - property
1594
1133
@dbus_service_property(_interface, signature="b",
1610
1149
@dbus_service_property(_interface, signature="ay",
1611
1150
access="write", byte_arrays=True)
1612
1151
def Secret_dbus_property(self, value):
1613
self.secret = bytes(value)
1152
self.secret = str(value)
1614
1153
1615
1154
del _interface
1616
1155
1621
1160
self._pipe.send(('init', fpr, address))
1622
1161
if not self._pipe.recv():
1623
1162
raise KeyError()
1624
1163
1625
1164
def __getattribute__(self, name):
1626
if name == '_pipe':
1165
if(name == '_pipe'):
1627
1166
return super(ProxyClient, self).__getattribute__(name)
1628
1167
self._pipe.send(('getattr', name))
1629
1168
data = self._pipe.recv()
1634
1173
self._pipe.send(('funcall', name, args, kwargs))
1635
1174
return self._pipe.recv()[1]
1636
1175
return func
1637
1176
1638
1177
def __setattr__(self, name, value):
1639
if name == '_pipe':
1178
if(name == '_pipe'):
1640
1179
return super(ProxyClient, self).__setattr__(name, value)
1641
1180
self._pipe.send(('setattr', name, value))
1642
1181
1653
1192
unicode(self.client_address))
1654
1193
logger.debug("Pipe FD: %d",
1655
1194
self.server.child_pipe.fileno())
1656
1195
1657
1196
session = (gnutls.connection
1658
1197
.ClientSession(self.request,
1659
1198
gnutls.connection
1660
1199
.X509Credentials()))
1661
1200
1662
1201
# Note: gnutls.connection.X509Credentials is really a
1663
1202
# generic GnuTLS certificate credentials object so long as
1664
1203
# no X.509 keys are added to it. Therefore, we can use it
1665
1204
# here despite using OpenPGP certificates.
1666
1205
1667
1206
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1668
1207
# "+AES-256-CBC", "+SHA1",
1669
1208
# "+COMP-NULL", "+CTYPE-OPENPGP",
1675
1214
(gnutls.library.functions
1676
1215
.gnutls_priority_set_direct(session._c_object,
1677
1216
priority, None))
1678
1217
1679
1218
# Start communication using the Mandos protocol
1680
1219
# Get protocol number
1681
1220
line = self.request.makefile().readline()
1682
1221
logger.debug("Protocol version: %r", line)
1683
1222
try:
1684
1223
if int(line.strip().split()[0]) > 1:
1685
raise RuntimeError(line)
1224
raise RuntimeError
1686
1225
except (ValueError, IndexError, RuntimeError) as error:
1687
1226
logger.error("Unknown protocol version: %s", error)
1688
1227
return
1689
1228
1690
1229
# Start GnuTLS connection
1691
1230
try:
1692
1231
session.handshake()
1696
1235
# established. Just abandon the request.
1697
1236
return
1698
1237
logger.debug("Handshake succeeded")
1699
1238
1700
1239
approval_required = False
1701
1240
try:
1702
1241
try:
1707
1246
logger.warning("Bad certificate: %s", error)
1708
1247
return
1709
1248
logger.debug("Fingerprint: %s", fpr)
1710
1249
1711
1250
try:
1712
1251
client = ProxyClient(child_pipe, fpr,
1713
1252
self.client_address)
1721
1260
1722
1261
while True:
1723
1262
if not client.enabled:
1724
logger.info("Client %s is disabled",
1263
logger.warning("Client %s is disabled",
1725
1264
client.name)
1726
1265
if self.server.use_dbus:
1727
1266
# Emit D-Bus signal
1728
client.Rejected("Disabled")
1267
client.Rejected("Disabled")
1729
1268
return
1730
1269
1731
if client.approved or not client.approval_delay:
1270
if client._approved or not client.approval_delay:
1732
1271
#We are approved or approval is disabled
1733
1272
break
1734
elif client.approved is None:
1273
elif client._approved is None:
1735
1274
logger.info("Client %s needs approval",
1736
1275
client.name)
1737
1276
if self.server.use_dbus:
1738
1277
# Emit D-Bus signal
1739
1278
client.NeedApproval(
1740
client.approval_delay.total_seconds()
1741
* 1000, client.approved_by_default)
1279
client.approval_delay_milliseconds(),
1280
client.approved_by_default)
1742
1281
else:
1743
1282
logger.warning("Client %s was not approved",
1744
1283
client.name)
1748
1287
return
1749
1288
1750
1289
#wait until timeout or approved
1290
#x = float(client._timedelta_to_milliseconds(delay))
1751
1291
time = datetime.datetime.now()
1752
1292
client.changedstate.acquire()
1753
client.changedstate.wait(delay.total_seconds())
1293
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1754
1294
client.changedstate.release()
1755
1295
time2 = datetime.datetime.now()
1756
1296
if (time2 - time) >= delay:
1772
1312
try:
1773
1313
sent = session.send(client.secret[sent_size:])
1774
1314
except gnutls.errors.GNUTLSError as error:
1775
logger.warning("gnutls send failed",
1776
exc_info=error)
1315
logger.warning("gnutls send failed")
1777
1316
return
1778
1317
logger.debug("Sent: %d, remaining: %d",
1779
1318
sent, len(client.secret)
1780
1319
- (sent_size + sent))
1781
1320
sent_size += sent
1782
1321
1783
1322
logger.info("Sending secret to %s", client.name)
1784
# bump the timeout using extended_timeout
1785
client.bump_timeout(client.extended_timeout)
1323
# bump the timeout as if seen
1324
client.checked_ok()
1786
1325
if self.server.use_dbus:
1787
1326
# Emit D-Bus signal
1788
1327
client.GotSecret()
1793
1332
try:
1794
1333
session.bye()
1795
1334
except gnutls.errors.GNUTLSError as error:
1796
logger.warning("GnuTLS bye failed",
1797
exc_info=error)
1335
logger.warning("GnuTLS bye failed")
1798
1336
1799
1337
@staticmethod
1800
1338
def peer_certificate(session):
1856
1394
# Convert the buffer to a Python bytestring
1857
1395
fpr = ctypes.string_at(buf, buf_len.value)
1858
1396
# Convert the bytestring to hexadecimal notation
1859
hex_fpr = binascii.hexlify(fpr).upper()
1397
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1860
1398
return hex_fpr
1861
1399
1862
1400
1865
1403
def sub_process_main(self, request, address):
1866
1404
try:
1867
1405
self.finish_request(request, address)
1868
except Exception:
1406
except:
1869
1407
self.handle_error(request, address)
1870
1408
self.close_request(request)
1871
1409
1872
1410
def process_request(self, request, address):
1873
1411
"""Start a new process to process the request."""
1874
proc = multiprocessing.Process(target = self.sub_process_main,
1875
args = (request, address))
1876
proc.start()
1877
return proc
1878
1412
multiprocessing.Process(target = self.sub_process_main,
1413
args = (request, address)).start()
1879
1414
1880
1415
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1881
1416
""" adds a pipe to the MixIn """
1885
1420
This function creates a new pipe in self.pipe
1886
1421
"""
1887
1422
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1888
1889
proc = MultiprocessingMixIn.process_request(self, request,
1890
client_address)
1423
1424
super(MultiprocessingMixInWithPipe,
1425
self).process_request(request, client_address)
1891
1426
self.child_pipe.close()
1892
self.add_pipe(parent_pipe, proc)
1893
1894
def add_pipe(self, parent_pipe, proc):
1427
self.add_pipe(parent_pipe)
1428
1429
def add_pipe(self, parent_pipe):
1895
1430
"""Dummy function; override as necessary"""
1896
raise NotImplementedError()
1897
1431
raise NotImplementedError
1898
1432
1899
1433
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1900
1434
socketserver.TCPServer, object):
1906
1440
use_ipv6: Boolean; to use IPv6 or not
1907
1441
"""
1908
1442
def __init__(self, server_address, RequestHandlerClass,
1909
interface=None, use_ipv6=True, socketfd=None):
1910
"""If socketfd is set, use that file descriptor instead of
1911
creating a new one with socket.socket().
1912
"""
1443
interface=None, use_ipv6=True):
1913
1444
self.interface = interface
1914
1445
if use_ipv6:
1915
1446
self.address_family = socket.AF_INET6
1916
if socketfd is not None:
1917
# Save the file descriptor
1918
self.socketfd = socketfd
1919
# Save the original socket.socket() function
1920
self.socket_socket = socket.socket
1921
# To implement --socket, we monkey patch socket.socket.
1922
#
1923
# (When socketserver.TCPServer is a new-style class, we
1924
# could make self.socket into a property instead of monkey
1925
# patching socket.socket.)
1926
#
1927
# Create a one-time-only replacement for socket.socket()
1928
@functools.wraps(socket.socket)
1929
def socket_wrapper(*args, **kwargs):
1930
# Restore original function so subsequent calls are
1931
# not affected.
1932
socket.socket = self.socket_socket
1933
del self.socket_socket
1934
# This time only, return a new socket object from the
1935
# saved file descriptor.
1936
return socket.fromfd(self.socketfd, *args, **kwargs)
1937
# Replace socket.socket() function with wrapper
1938
socket.socket = socket_wrapper
1939
# The socketserver.TCPServer.__init__ will call
1940
# socket.socket(), which might be our replacement,
1941
# socket_wrapper(), if socketfd was set.
1942
1447
socketserver.TCPServer.__init__(self, server_address,
1943
1448
RequestHandlerClass)
1944
1945
1449
def server_bind(self):
1946
1450
"""This overrides the normal server_bind() function
1947
1451
to bind to an interface if one was specified, and also NOT to
1955
1459
try:
1956
1460
self.socket.setsockopt(socket.SOL_SOCKET,
1957
1461
SO_BINDTODEVICE,
1958
(self.interface + "\0")
1959
.encode("utf-8"))
1462
str(self.interface
1463
+ '\0'))
1960
1464
except socket.error as error:
1961
if error.errno == errno.EPERM:
1962
logger.error("No permission to bind to"
1963
" interface %s", self.interface)
1964
elif error.errno == errno.ENOPROTOOPT:
1465
if error[0] == errno.EPERM:
1466
logger.error("No permission to"
1467
" bind to interface %s",
1468
self.interface)
1469
elif error[0] == errno.ENOPROTOOPT:
1965
1470
logger.error("SO_BINDTODEVICE not available;"
1966
1471
" cannot bind to interface %s",
1967
1472
self.interface)
1968
elif error.errno == errno.ENODEV:
1969
logger.error("Interface %s does not exist,"
1970
" cannot bind", self.interface)
1971
1473
else:
1972
1474
raise
1973
1475
# Only bind(2) the socket if we really need to.
1976
1478
if self.address_family == socket.AF_INET6:
1977
1479
any_address = "::" # in6addr_any
1978
1480
else:
1979
any_address = "0.0.0.0" # INADDR_ANY
1481
any_address = socket.INADDR_ANY
1980
1482
self.server_address = (any_address,
1981
1483
self.server_address[1])
1982
1484
elif not self.server_address[1]:
2003
1505
"""
2004
1506
def __init__(self, server_address, RequestHandlerClass,
2005
1507
interface=None, use_ipv6=True, clients=None,
2006
gnutls_priority=None, use_dbus=True, socketfd=None):
1508
gnutls_priority=None, use_dbus=True):
2007
1509
self.enabled = False
2008
1510
self.clients = clients
2009
1511
if self.clients is None:
2010
self.clients = {}
1512
self.clients = set()
2011
1513
self.use_dbus = use_dbus
2012
1514
self.gnutls_priority = gnutls_priority
2013
1515
IPv6_TCPServer.__init__(self, server_address,
2014
1516
RequestHandlerClass,
2015
1517
interface = interface,
2016
use_ipv6 = use_ipv6,
2017
socketfd = socketfd)
1518
use_ipv6 = use_ipv6)
2018
1519
def server_activate(self):
2019
1520
if self.enabled:
2020
1521
return socketserver.TCPServer.server_activate(self)
2021
2022
1522
def enable(self):
2023
1523
self.enabled = True
2024
2025
def add_pipe(self, parent_pipe, proc):
1524
def add_pipe(self, parent_pipe):
2026
1525
# Call "handle_ipc" for both data and EOF events
2027
1526
gobject.io_add_watch(parent_pipe.fileno(),
2028
1527
gobject.IO_IN | gobject.IO_HUP,
2029
1528
functools.partial(self.handle_ipc,
2030
parent_pipe =
2031
parent_pipe,
2032
proc = proc))
2033
1529
parent_pipe = parent_pipe))
1530
2034
1531
def handle_ipc(self, source, condition, parent_pipe=None,
2035
proc = None, client_object=None):
2036
# error, or the other end of multiprocessing.Pipe has closed
2037
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2038
# Wait for other process to exit
2039
proc.join()
1532
client_object=None):
1533
condition_names = {
1534
gobject.IO_IN: "IN", # There is data to read.
1535
gobject.IO_OUT: "OUT", # Data can be written (without
1536
# blocking).
1537
gobject.IO_PRI: "PRI", # There is urgent data to read.
1538
gobject.IO_ERR: "ERR", # Error condition.
1539
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1540
# broken, usually for pipes and
1541
# sockets).
1542
}
1543
conditions_string = ' | '.join(name
1544
for cond, name in
1545
condition_names.iteritems()
1546
if cond & condition)
1547
# error or the other end of multiprocessing.Pipe has closed
1548
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2040
1549
return False
2041
1550
2042
1551
# Read a request from the child
2047
1556
fpr = request[1]
2048
1557
address = request[2]
2049
1558
2050
for c in self.clients.itervalues():
1559
for c in self.clients:
2051
1560
if c.fingerprint == fpr:
2052
1561
client = c
2053
1562
break
2054
1563
else:
2055
logger.info("Client not found for fingerprint: %s, ad"
2056
"dress: %s", fpr, address)
1564
logger.warning("Client not found for fingerprint: %s, ad"
1565
"dress: %s", fpr, address)
2057
1566
if self.use_dbus:
2058
1567
# Emit D-Bus signal
2059
mandos_dbus_service.ClientNotFound(fpr,
2060
address[0])
1568
mandos_dbus_service.ClientNotFound(fpr, address[0])
2061
1569
parent_pipe.send(False)
2062
1570
return False
2063
1571
2064
1572
gobject.io_add_watch(parent_pipe.fileno(),
2065
1573
gobject.IO_IN | gobject.IO_HUP,
2066
1574
functools.partial(self.handle_ipc,
2067
parent_pipe =
2068
parent_pipe,
2069
proc = proc,
2070
client_object =
2071
client))
1575
parent_pipe = parent_pipe,
1576
client_object = client))
2072
1577
parent_pipe.send(True)
2073
# remove the old hook in favor of the new above hook on
2074
# same fileno
1578
# remove the old hook in favor of the new above hook on same fileno
2075
1579
return False
2076
1580
if command == 'funcall':
2077
1581
funcname = request[1]
2078
1582
args = request[2]
2079
1583
kwargs = request[3]
2080
1584
2081
parent_pipe.send(('data', getattr(client_object,
2082
funcname)(*args,
2083
**kwargs)))
2084
1585
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1586
2085
1587
if command == 'getattr':
2086
1588
attrname = request[1]
2087
1589
if callable(client_object.__getattribute__(attrname)):
2088
1590
parent_pipe.send(('function',))
2089
1591
else:
2090
parent_pipe.send(('data', client_object
2091
.__getattribute__(attrname)))
1592
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2092
1593
2093
1594
if command == 'setattr':
2094
1595
attrname = request[1]
2095
1596
value = request[2]
2096
1597
setattr(client_object, attrname, value)
2097
1598
2098
1599
return True
2099
1600
2100
1601
2101
def rfc3339_duration_to_delta(duration):
2102
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2103
2104
>>> rfc3339_duration_to_delta("P7D")
2105
datetime.timedelta(7)
2106
>>> rfc3339_duration_to_delta("PT60S")
2107
datetime.timedelta(0, 60)
2108
>>> rfc3339_duration_to_delta("PT60M")
2109
datetime.timedelta(0, 3600)
2110
>>> rfc3339_duration_to_delta("PT24H")
2111
datetime.timedelta(1)
2112
>>> rfc3339_duration_to_delta("P1W")
2113
datetime.timedelta(7)
2114
>>> rfc3339_duration_to_delta("PT5M30S")
2115
datetime.timedelta(0, 330)
2116
>>> rfc3339_duration_to_delta("P1DT3M20S")
2117
datetime.timedelta(1, 200)
2118
"""
2119
2120
# Parsing an RFC 3339 duration with regular expressions is not
2121
# possible - there would have to be multiple places for the same
2122
# values, like seconds. The current code, while more esoteric, is
2123
# cleaner without depending on a parsing library. If Python had a
2124
# built-in library for parsing we would use it, but we'd like to
2125
# avoid excessive use of external libraries.
2126
2127
# New type for defining tokens, syntax, and semantics all-in-one
2128
Token = collections.namedtuple("Token",
2129
("regexp", # To match token; if
2130
# "value" is not None,
2131
# must have a "group"
2132
# containing digits
2133
"value", # datetime.timedelta or
2134
# None
2135
"followers")) # Tokens valid after
2136
# this token
2137
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2138
# the "duration" ABNF definition in RFC 3339, Appendix A.
2139
token_end = Token(re.compile(r"$"), None, frozenset())
2140
token_second = Token(re.compile(r"(\d+)S"),
2141
datetime.timedelta(seconds=1),
2142
frozenset((token_end,)))
2143
token_minute = Token(re.compile(r"(\d+)M"),
2144
datetime.timedelta(minutes=1),
2145
frozenset((token_second, token_end)))
2146
token_hour = Token(re.compile(r"(\d+)H"),
2147
datetime.timedelta(hours=1),
2148
frozenset((token_minute, token_end)))
2149
token_time = Token(re.compile(r"T"),
2150
None,
2151
frozenset((token_hour, token_minute,
2152
token_second)))
2153
token_day = Token(re.compile(r"(\d+)D"),
2154
datetime.timedelta(days=1),
2155
frozenset((token_time, token_end)))
2156
token_month = Token(re.compile(r"(\d+)M"),
2157
datetime.timedelta(weeks=4),
2158
frozenset((token_day, token_end)))
2159
token_year = Token(re.compile(r"(\d+)Y"),
2160
datetime.timedelta(weeks=52),
2161
frozenset((token_month, token_end)))
2162
token_week = Token(re.compile(r"(\d+)W"),
2163
datetime.timedelta(weeks=1),
2164
frozenset((token_end,)))
2165
token_duration = Token(re.compile(r"P"), None,
2166
frozenset((token_year, token_month,
2167
token_day, token_time,
2168
token_week)))
2169
# Define starting values
2170
value = datetime.timedelta() # Value so far
2171
found_token = None
2172
followers = frozenset((token_duration,)) # Following valid tokens
2173
s = duration # String left to parse
2174
# Loop until end token is found
2175
while found_token is not token_end:
2176
# Search for any currently valid tokens
2177
for token in followers:
2178
match = token.regexp.match(s)
2179
if match is not None:
2180
# Token found
2181
if token.value is not None:
2182
# Value found, parse digits
2183
factor = int(match.group(1), 10)
2184
# Add to value so far
2185
value += factor * token.value
2186
# Strip token from string
2187
s = token.regexp.sub("", s, 1)
2188
# Go to found token
2189
found_token = token
2190
# Set valid next tokens
2191
followers = found_token.followers
2192
break
2193
else:
2194
# No currently valid tokens were found
2195
raise ValueError("Invalid RFC 3339 duration")
2196
# End token found
2197
return value
2198
2199
2200
1602
def string_to_delta(interval):
2201
1603
"""Parse a string and return a datetime.timedelta
2202
1604
2213
1615
>>> string_to_delta('5m 30s')
2214
1616
datetime.timedelta(0, 330)
2215
1617
"""
2216
2217
try:
2218
return rfc3339_duration_to_delta(interval)
2219
except ValueError:
2220
pass
2221
2222
1618
timevalue = datetime.timedelta(0)
2223
1619
for s in interval.split():
2224
1620
try:
2225
suffix = s[-1]
1621
suffix = unicode(s[-1])
2226
1622
value = int(s[:-1])
2227
1623
if suffix == "d":
2228
1624
delta = datetime.timedelta(value)
2235
1631
elif suffix == "w":
2236
1632
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2237
1633
else:
2238
raise ValueError("Unknown suffix {!r}"
2239
.format(suffix))
2240
except IndexError as e:
1634
raise ValueError("Unknown suffix %r" % suffix)
1635
except (ValueError, IndexError) as e:
2241
1636
raise ValueError(*(e.args))
2242
1637
timevalue += delta
2243
1638
return timevalue
2244
1639
2245
1640
1641
def if_nametoindex(interface):
1642
"""Call the C function if_nametoindex(), or equivalent
1643
1644
Note: This function cannot accept a unicode string."""
1645
global if_nametoindex
1646
try:
1647
if_nametoindex = (ctypes.cdll.LoadLibrary
1648
(ctypes.util.find_library("c"))
1649
.if_nametoindex)
1650
except (OSError, AttributeError):
1651
logger.warning("Doing if_nametoindex the hard way")
1652
def if_nametoindex(interface):
1653
"Get an interface index the hard way, i.e. using fcntl()"
1654
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1655
with contextlib.closing(socket.socket()) as s:
1656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1657
struct.pack(str("16s16x"),
1658
interface))
1659
interface_index = struct.unpack(str("I"),
1660
ifreq[16:20])[0]
1661
return interface_index
1662
return if_nametoindex(interface)
1663
1664
2246
1665
def daemon(nochdir = False, noclose = False):
2247
1666
"""See daemon(3). Standard BSD Unix function.
2248
1667
2256
1675
sys.exit()
2257
1676
if not noclose:
2258
1677
# Close all standard open file descriptors
2259
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1678
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2260
1679
if not stat.S_ISCHR(os.fstat(null).st_mode):
2261
raise OSError(errno.ENODEV, "{} not a character device"
2262
.format(os.devnull))
1680
raise OSError(errno.ENODEV,
1681
"%s not a character device"
1682
% os.path.devnull)
2263
1683
os.dup2(null, sys.stdin.fileno())
2264
1684
os.dup2(null, sys.stdout.fileno())
2265
1685
os.dup2(null, sys.stderr.fileno())
2274
1694
2275
1695
parser = argparse.ArgumentParser()
2276
1696
parser.add_argument("-v", "--version", action="version",
2277
version = "%(prog)s {}".format(version),
1697
version = "%%(prog)s %s" % version,
2278
1698
help="show version number and exit")
2279
1699
parser.add_argument("-i", "--interface", metavar="IF",
2280
1700
help="Bind to interface IF")
2286
1706
help="Run self-test")
2287
1707
parser.add_argument("--debug", action="store_true",
2288
1708
help="Debug mode; run in foreground and log"
2289
" to terminal", default=None)
1709
" to terminal")
2290
1710
parser.add_argument("--debuglevel", metavar="LEVEL",
2291
1711
help="Debug level for stdout output")
2292
1712
parser.add_argument("--priority", help="GnuTLS"
2299
1719
" files")
2300
1720
parser.add_argument("--no-dbus", action="store_false",
2301
1721
dest="use_dbus", help="Do not provide D-Bus"
2302
" system bus interface", default=None)
1722
" system bus interface")
2303
1723
parser.add_argument("--no-ipv6", action="store_false",
2304
dest="use_ipv6", help="Do not use IPv6",
2305
default=None)
2306
parser.add_argument("--no-restore", action="store_false",
2307
dest="restore", help="Do not restore stored"
2308
" state", default=None)
2309
parser.add_argument("--socket", type=int,
2310
help="Specify a file descriptor to a network"
2311
" socket to use instead of creating one")
2312
parser.add_argument("--statedir", metavar="DIR",
2313
help="Directory to save/restore state in")
2314
parser.add_argument("--foreground", action="store_true",
2315
help="Run in foreground", default=None)
2316
parser.add_argument("--no-zeroconf", action="store_false",
2317
dest="zeroconf", help="Do not use Zeroconf",
2318
default=None)
2319
1724
dest="use_ipv6", help="Do not use IPv6")
2320
1725
options = parser.parse_args()
2321
1726
2322
1727
if options.check:
2323
1728
import doctest
2324
fail_count, test_count = doctest.testmod()
2325
sys.exit(os.EX_OK if fail_count == 0 else 1)
1729
doctest.testmod()
1730
sys.exit()
2326
1731
2327
1732
# Default values for config file for server-global settings
2328
1733
server_defaults = { "interface": "",
2330
1735
"port": "",
2331
1736
"debug": "False",
2332
1737
"priority":
2333
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
1738
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2334
1739
"servicename": "Mandos",
2335
1740
"use_dbus": "True",
2336
1741
"use_ipv6": "True",
2337
1742
"debuglevel": "",
2338
"restore": "True",
2339
"socket": "",
2340
"statedir": "/var/lib/mandos",
2341
"foreground": "False",
2342
"zeroconf": "True",
2343
1743
}
2344
1744
2345
1745
# Parse config file for server-global settings
2350
1750
# Convert the SafeConfigParser object to a dict
2351
1751
server_settings = server_config.defaults()
2352
1752
# Use the appropriate methods on the non-string config options
2353
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1753
for option in ("debug", "use_dbus", "use_ipv6"):
2354
1754
server_settings[option] = server_config.getboolean("DEFAULT",
2355
1755
option)
2356
1756
if server_settings["port"]:
2357
1757
server_settings["port"] = server_config.getint("DEFAULT",
2358
1758
"port")
2359
if server_settings["socket"]:
2360
server_settings["socket"] = server_config.getint("DEFAULT",
2361
"socket")
2362
# Later, stdin will, and stdout and stderr might, be dup'ed
2363
# over with an opened os.devnull. But we don't want this to
2364
# happen with a supplied network socket.
2365
if 0 <= server_settings["socket"] <= 2:
2366
server_settings["socket"] = os.dup(server_settings
2367
["socket"])
2368
1759
del server_config
2369
1760
2370
1761
# Override the settings from the config file with command line
2371
1762
# options, if set.
2372
1763
for option in ("interface", "address", "port", "debug",
2373
1764
"priority", "servicename", "configdir",
2374
"use_dbus", "use_ipv6", "debuglevel", "restore",
2375
"statedir", "socket", "foreground", "zeroconf"):
1765
"use_dbus", "use_ipv6", "debuglevel"):
2376
1766
value = getattr(options, option)
2377
1767
if value is not None:
2378
1768
server_settings[option] = value
2379
1769
del options
2380
1770
# Force all strings to be unicode
2381
1771
for option in server_settings.keys():
2382
if isinstance(server_settings[option], bytes):
2383
server_settings[option] = (server_settings[option]
2384
.decode("utf-8"))
2385
# Force all boolean options to be boolean
2386
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2387
"foreground", "zeroconf"):
2388
server_settings[option] = bool(server_settings[option])
2389
# Debug implies foreground
2390
if server_settings["debug"]:
2391
server_settings["foreground"] = True
1772
if type(server_settings[option]) is str:
1773
server_settings[option] = unicode(server_settings[option])
2392
1774
# Now we have our good server settings in "server_settings"
2393
1775
2394
1776
##################################################################
2395
1777
2396
if (not server_settings["zeroconf"] and
2397
not (server_settings["port"]
2398
or server_settings["socket"] != "")):
2399
parser.error("Needs port or socket to work without"
2400
" Zeroconf")
2401
2402
1778
# For convenience
2403
1779
debug = server_settings["debug"]
2404
1780
debuglevel = server_settings["debuglevel"]
2405
1781
use_dbus = server_settings["use_dbus"]
2406
1782
use_ipv6 = server_settings["use_ipv6"]
2407
stored_state_path = os.path.join(server_settings["statedir"],
2408
stored_state_file)
2409
foreground = server_settings["foreground"]
2410
zeroconf = server_settings["zeroconf"]
2411
2412
if debug:
2413
initlogger(debug, logging.DEBUG)
2414
else:
2415
if not debuglevel:
2416
initlogger(debug)
2417
else:
2418
level = getattr(logging, debuglevel.upper())
2419
initlogger(debug, level)
2420
1783
2421
1784
if server_settings["servicename"] != "Mandos":
2422
1785
syslogger.setFormatter(logging.Formatter
2423
('Mandos ({}) [%(process)d]:'
2424
' %(levelname)s: %(message)s'
2425
.format(server_settings
2426
["servicename"])))
1786
('Mandos (%s) [%%(process)d]:'
1787
' %%(levelname)s: %%(message)s'
1788
% server_settings["servicename"]))
2427
1789
2428
1790
# Parse config file with clients
2429
client_config = configparser.SafeConfigParser(Client
2430
.client_defaults)
1791
client_defaults = { "timeout": "1h",
1792
"interval": "5m",
1793
"checker": "fping -q -- %%(host)s",
1794
"host": "",
1795
"approval_delay": "0s",
1796
"approval_duration": "1s",
1797
}
1798
client_config = configparser.SafeConfigParser(client_defaults)
2431
1799
client_config.read(os.path.join(server_settings["configdir"],
2432
1800
"clients.conf"))
2433
1801
2434
1802
global mandos_dbus_service
2435
1803
mandos_dbus_service = None
2436
1804
2437
socketfd = None
2438
if server_settings["socket"] != "":
2439
socketfd = server_settings["socket"]
2440
1805
tcp_server = MandosServer((server_settings["address"],
2441
1806
server_settings["port"]),
2442
1807
ClientHandler,
2445
1810
use_ipv6=use_ipv6,
2446
1811
gnutls_priority=
2447
1812
server_settings["priority"],
2448
use_dbus=use_dbus,
2449
socketfd=socketfd)
2450
if not foreground:
2451
pidfilename = "/run/mandos.pid"
2452
if not os.path.isdir("/run/."):
2453
pidfilename = "/var/run/mandos.pid"
2454
pidfile = None
1813
use_dbus=use_dbus)
1814
if not debug:
1815
pidfilename = "/var/run/mandos.pid"
2455
1816
try:
2456
1817
pidfile = open(pidfilename, "w")
2457
except IOError as e:
2458
logger.error("Could not open file %r", pidfilename,
2459
exc_info=e)
1818
except IOError:
1819
logger.error("Could not open file %r", pidfilename)
2460
1820
2461
for name in ("_mandos", "mandos", "nobody"):
1821
try:
1822
uid = pwd.getpwnam("_mandos").pw_uid
1823
gid = pwd.getpwnam("_mandos").pw_gid
1824
except KeyError:
2462
1825
try:
2463
uid = pwd.getpwnam(name).pw_uid
2464
gid = pwd.getpwnam(name).pw_gid
2465
break
1826
uid = pwd.getpwnam("mandos").pw_uid
1827
gid = pwd.getpwnam("mandos").pw_gid
2466
1828
except KeyError:
2467
continue
2468
else:
2469
uid = 65534
2470
gid = 65534
1829
try:
1830
uid = pwd.getpwnam("nobody").pw_uid
1831
gid = pwd.getpwnam("nobody").pw_gid
1832
except KeyError:
1833
uid = 65534
1834
gid = 65534
2471
1835
try:
2472
1836
os.setgid(gid)
2473
1837
os.setuid(uid)
2474
1838
except OSError as error:
2475
if error.errno != errno.EPERM:
2476
raise
1839
if error[0] != errno.EPERM:
1840
raise error
2477
1841
1842
if not debug and not debuglevel:
1843
syslogger.setLevel(logging.WARNING)
1844
console.setLevel(logging.WARNING)
1845
if debuglevel:
1846
level = getattr(logging, debuglevel.upper())
1847
syslogger.setLevel(level)
1848
console.setLevel(level)
1849
2478
1850
if debug:
2479
1851
# Enable all possible GnuTLS debugging
2480
1852
2490
1862
.gnutls_global_set_log_function(debug_gnutls))
2491
1863
2492
1864
# Redirect stdin so all checkers get /dev/null
2493
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1865
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2494
1866
os.dup2(null, sys.stdin.fileno())
2495
1867
if null > 2:
2496
1868
os.close(null)
1869
else:
1870
# No console logging
1871
logger.removeHandler(console)
2497
1872
2498
1873
# Need to fork before connecting to D-Bus
2499
if not foreground:
1874
if not debug:
2500
1875
# Close all input and output, do double fork, etc.
2501
1876
daemon()
2502
1877
2503
# multiprocessing will use threads, so before we use gobject we
2504
# need to inform gobject that threads will be used.
2505
gobject.threads_init()
2506
2507
1878
global main_loop
2508
1879
# From the Avahi example code
2509
DBusGMainLoop(set_as_default=True)
1880
DBusGMainLoop(set_as_default=True )
2510
1881
main_loop = gobject.MainLoop()
2511
1882
bus = dbus.SystemBus()
2512
1883
# End of Avahi example code
2513
1884
if use_dbus:
2514
1885
try:
2515
bus_name = dbus.service.BusName("se.recompile.Mandos",
1886
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2516
1887
bus, do_not_queue=True)
2517
old_bus_name = (dbus.service.BusName
2518
("se.bsnet.fukt.Mandos", bus,
2519
do_not_queue=True))
2520
1888
except dbus.exceptions.NameExistsException as e:
2521
logger.error("Disabling D-Bus:", exc_info=e)
1889
logger.error(unicode(e) + ", disabling D-Bus")
2522
1890
use_dbus = False
2523
1891
server_settings["use_dbus"] = False
2524
1892
tcp_server.use_dbus = False
2525
if zeroconf:
2526
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2527
service = AvahiServiceToSyslog(name =
2528
server_settings["servicename"],
2529
servicetype = "_mandos._tcp",
2530
protocol = protocol, bus = bus)
2531
if server_settings["interface"]:
2532
service.interface = (if_nametoindex
2533
(server_settings["interface"]
2534
.encode("utf-8")))
1893
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1894
service = AvahiService(name = server_settings["servicename"],
1895
servicetype = "_mandos._tcp",
1896
protocol = protocol, bus = bus)
1897
if server_settings["interface"]:
1898
service.interface = (if_nametoindex
1899
(str(server_settings["interface"])))
2535
1900
2536
1901
global multiprocessing_manager
2537
1902
multiprocessing_manager = multiprocessing.Manager()
2539
1904
client_class = Client
2540
1905
if use_dbus:
2541
1906
client_class = functools.partial(ClientDBus, bus = bus)
2542
2543
client_settings = Client.config_parser(client_config)
2544
old_client_settings = {}
2545
clients_data = {}
2546
2547
# This is used to redirect stdout and stderr for checker processes
2548
global wnull
2549
wnull = open(os.devnull, "w") # A writable /dev/null
2550
# Only used if server is running in foreground but not in debug
2551
# mode
2552
if debug or not foreground:
2553
wnull.close()
2554
2555
# Get client data and settings from last running state.
2556
if server_settings["restore"]:
2557
try:
2558
with open(stored_state_path, "rb") as stored_state:
2559
clients_data, old_client_settings = (pickle.load
2560
(stored_state))
2561
os.remove(stored_state_path)
2562
except IOError as e:
2563
if e.errno == errno.ENOENT:
2564
logger.warning("Could not load persistent state: {}"
2565
.format(os.strerror(e.errno)))
2566
else:
2567
logger.critical("Could not load persistent state:",
2568
exc_info=e)
2569
raise
2570
except EOFError as e:
2571
logger.warning("Could not load persistent state: "
2572
"EOFError:", exc_info=e)
2573
2574
with PGPEngine() as pgp:
2575
for client_name, client in clients_data.items():
2576
# Skip removed clients
2577
if client_name not in client_settings:
2578
continue
2579
2580
# Decide which value to use after restoring saved state.
2581
# We have three different values: Old config file,
2582
# new config file, and saved state.
2583
# New config value takes precedence if it differs from old
2584
# config value, otherwise use saved state.
2585
for name, value in client_settings[client_name].items():
2586
try:
2587
# For each value in new config, check if it
2588
# differs from the old config value (Except for
2589
# the "secret" attribute)
2590
if (name != "secret" and
2591
value != old_client_settings[client_name]
2592
[name]):
2593
client[name] = value
2594
except KeyError:
2595
pass
2596
2597
# Clients who has passed its expire date can still be
2598
# enabled if its last checker was successful. Clients
2599
# whose checker succeeded before we stored its state is
2600
# assumed to have successfully run all checkers during
2601
# downtime.
2602
if client["enabled"]:
2603
if datetime.datetime.utcnow() >= client["expires"]:
2604
if not client["last_checked_ok"]:
2605
logger.warning(
2606
"disabling client {} - Client never "
2607
"performed a successful checker"
2608
.format(client_name))
2609
client["enabled"] = False
2610
elif client["last_checker_status"] != 0:
2611
logger.warning(
2612
"disabling client {} - Client last"
2613
" checker failed with error code {}"
2614
.format(client_name,
2615
client["last_checker_status"]))
2616
client["enabled"] = False
2617
else:
2618
client["expires"] = (datetime.datetime
2619
.utcnow()
2620
+ client["timeout"])
2621
logger.debug("Last checker succeeded,"
2622
" keeping {} enabled"
2623
.format(client_name))
1907
def client_config_items(config, section):
1908
special_settings = {
1909
"approved_by_default":
1910
lambda: config.getboolean(section,
1911
"approved_by_default"),
1912
}
1913
for name, value in config.items(section):
2624
1914
try:
2625
client["secret"] = (
2626
pgp.decrypt(client["encrypted_secret"],
2627
client_settings[client_name]
2628
["secret"]))
2629
except PGPError:
2630
# If decryption fails, we use secret from new settings
2631
logger.debug("Failed to decrypt {} old secret"
2632
.format(client_name))
2633
client["secret"] = (
2634
client_settings[client_name]["secret"])
2635
2636
# Add/remove clients based on new changes made to config
2637
for client_name in (set(old_client_settings)
2638
- set(client_settings)):
2639
del clients_data[client_name]
2640
for client_name in (set(client_settings)
2641
- set(old_client_settings)):
2642
clients_data[client_name] = client_settings[client_name]
2643
2644
# Create all client objects
2645
for client_name, client in clients_data.items():
2646
tcp_server.clients[client_name] = client_class(
2647
name = client_name, settings = client,
2648
server_settings = server_settings)
2649
1915
yield (name, special_settings[name]())
1916
except KeyError:
1917
yield (name, value)
1918
1919
tcp_server.clients.update(set(
1920
client_class(name = section,
1921
config= dict(client_config_items(
1922
client_config, section)))
1923
for section in client_config.sections()))
2650
1924
if not tcp_server.clients:
2651
1925
logger.warning("No clients defined")
2652
2653
if not foreground:
2654
if pidfile is not None:
2655
try:
2656
with pidfile:
2657
pid = os.getpid()
2658
pidfile.write("{}\n".format(pid).encode("utf-8"))
2659
except IOError:
2660
logger.error("Could not write to file %r with PID %d",
2661
pidfilename, pid)
2662
del pidfile
1926
1927
if not debug:
1928
try:
1929
with pidfile:
1930
pid = os.getpid()
1931
pidfile.write(str(pid) + "\n".encode("utf-8"))
1932
del pidfile
1933
except IOError:
1934
logger.error("Could not write to file %r with PID %d",
1935
pidfilename, pid)
1936
except NameError:
1937
# "pidfile" was never created
1938
pass
2663
1939
del pidfilename
2664
1940
1941
signal.signal(signal.SIGINT, signal.SIG_IGN)
1942
2665
1943
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2666
1944
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2667
1945
2668
1946
if use_dbus:
2669
@alternate_dbus_interfaces({"se.recompile.Mandos":
2670
"se.bsnet.fukt.Mandos"})
2671
class MandosDBusService(DBusObjectWithProperties):
1947
class MandosDBusService(dbus.service.Object):
2672
1948
"""A D-Bus proxy object"""
2673
1949
def __init__(self):
2674
1950
dbus.service.Object.__init__(self, bus, "/")
2675
_interface = "se.recompile.Mandos"
2676
2677
@dbus_interface_annotations(_interface)
2678
def _foo(self):
2679
return { "org.freedesktop.DBus.Property"
2680
".EmitsChangedSignal":
2681
"false"}
1951
_interface = "se.bsnet.fukt.Mandos"
2682
1952
2683
1953
@dbus.service.signal(_interface, signature="o")
2684
1954
def ClientAdded(self, objpath):
2699
1969
def GetAllClients(self):
2700
1970
"D-Bus method"
2701
1971
return dbus.Array(c.dbus_object_path
2702
for c in
2703
tcp_server.clients.itervalues())
1972
for c in tcp_server.clients)
2704
1973
2705
1974
@dbus.service.method(_interface,
2706
1975
out_signature="a{oa{sv}}")
2708
1977
"D-Bus method"
2709
1978
return dbus.Dictionary(
2710
1979
((c.dbus_object_path, c.GetAll(""))
2711
for c in tcp_server.clients.itervalues()),
1980
for c in tcp_server.clients),
2712
1981
signature="oa{sv}")
2713
1982
2714
1983
@dbus.service.method(_interface, in_signature="o")
2715
1984
def RemoveClient(self, object_path):
2716
1985
"D-Bus method"
2717
for c in tcp_server.clients.itervalues():
1986
for c in tcp_server.clients:
2718
1987
if c.dbus_object_path == object_path:
2719
del tcp_server.clients[c.name]
1988
tcp_server.clients.remove(c)
2720
1989
c.remove_from_connection()
2721
1990
# Don't signal anything except ClientRemoved
2722
1991
c.disable(quiet=True)
2731
2000
2732
2001
def cleanup():
2733
2002
"Cleanup function; run on exit"
2734
if zeroconf:
2735
service.cleanup()
2736
2737
multiprocessing.active_children()
2738
wnull.close()
2739
if not (tcp_server.clients or client_settings):
2740
return
2741
2742
# Store client before exiting. Secrets are encrypted with key
2743
# based on what config file has. If config file is
2744
# removed/edited, old secret will thus be unrecovable.
2745
clients = {}
2746
with PGPEngine() as pgp:
2747
for client in tcp_server.clients.itervalues():
2748
key = client_settings[client.name]["secret"]
2749
client.encrypted_secret = pgp.encrypt(client.secret,
2750
key)
2751
client_dict = {}
2752
2753
# A list of attributes that can not be pickled
2754
# + secret.
2755
exclude = { "bus", "changedstate", "secret",
2756
"checker", "server_settings" }
2757
for name, typ in (inspect.getmembers
2758
(dbus.service.Object)):
2759
exclude.add(name)
2760
2761
client_dict["encrypted_secret"] = (client
2762
.encrypted_secret)
2763
for attr in client.client_structure:
2764
if attr not in exclude:
2765
client_dict[attr] = getattr(client, attr)
2766
2767
clients[client.name] = client_dict
2768
del client_settings[client.name]["secret"]
2769
2770
try:
2771
with (tempfile.NamedTemporaryFile
2772
(mode='wb', suffix=".pickle", prefix='clients-',
2773
dir=os.path.dirname(stored_state_path),
2774
delete=False)) as stored_state:
2775
pickle.dump((clients, client_settings), stored_state)
2776
tempname=stored_state.name
2777
os.rename(tempname, stored_state_path)
2778
except (IOError, OSError) as e:
2779
if not debug:
2780
try:
2781
os.remove(tempname)
2782
except NameError:
2783
pass
2784
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2785
logger.warning("Could not save persistent state: {}"
2786
.format(os.strerror(e.errno)))
2787
else:
2788
logger.warning("Could not save persistent state:",
2789
exc_info=e)
2790
raise
2791
2792
# Delete all clients, and settings from config
2003
service.cleanup()
2004
2793
2005
while tcp_server.clients:
2794
name, client = tcp_server.clients.popitem()
2006
client = tcp_server.clients.pop()
2795
2007
if use_dbus:
2796
2008
client.remove_from_connection()
2009
client.disable_hook = None
2797
2010
# Don't signal anything except ClientRemoved
2798
2011
client.disable(quiet=True)
2799
2012
if use_dbus:
2800
2013
# Emit D-Bus signal
2801
mandos_dbus_service.ClientRemoved(client
2802
.dbus_object_path,
2014
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2803
2015
client.name)
2804
client_settings.clear()
2805
2016
2806
2017
atexit.register(cleanup)
2807
2018
2808
for client in tcp_server.clients.itervalues():
2019
for client in tcp_server.clients:
2809
2020
if use_dbus:
2810
2021
# Emit D-Bus signal
2811
2022
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2812
# Need to initiate checking of clients
2813
if client.enabled:
2814
client.init_checker()
2023
client.enable()
2815
2024
2816
2025
tcp_server.enable()
2817
2026
tcp_server.server_activate()
2818
2027
2819
2028
# Find out what port we got
2820
if zeroconf:
2821
service.port = tcp_server.socket.getsockname()[1]
2029
service.port = tcp_server.socket.getsockname()[1]
2822
2030
if use_ipv6:
2823
2031
logger.info("Now listening on address %r, port %d,"
2824
" flowinfo %d, scope_id %d",
2825
*tcp_server.socket.getsockname())
2032
" flowinfo %d, scope_id %d"
2033
% tcp_server.socket.getsockname())
2826
2034
else: # IPv4
2827
logger.info("Now listening on address %r, port %d",
2828
*tcp_server.socket.getsockname())
2035
logger.info("Now listening on address %r, port %d"
2036
% tcp_server.socket.getsockname())
2829
2037
2830
2038
#service.interface = tcp_server.socket.getsockname()[3]
2831
2039
2832
2040
try:
2833
if zeroconf:
2834
# From the Avahi example code
2835
try:
2836
service.activate()
2837
except dbus.exceptions.DBusException as error:
2838
logger.critical("D-Bus Exception", exc_info=error)
2839
cleanup()
2840
sys.exit(1)
2841
# End of Avahi example code
2041
# From the Avahi example code
2042
try:
2043
service.activate()
2044
except dbus.exceptions.DBusException as error:
2045
logger.critical("DBusException: %s", error)
2046
cleanup()
2047
sys.exit(1)
2048
# End of Avahi example code
2842
2049
2843
2050
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2844
2051
lambda *args, **kwargs:
2848
2055
logger.debug("Starting main loop")
2849
2056
main_loop.run()
2850
2057
except AvahiError as error:
2851
logger.critical("Avahi Error", exc_info=error)
2058
logger.critical("AvahiError: %s", error)
2852
2059
cleanup()
2853
2060
sys.exit(1)
2854
2061
except KeyboardInterrupt:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0