To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 485
- compare with another revision
- download diff
- download tarball
- view history from revision 485
- Committer: Teddy Hogeborn
- Date: 2011-07-13 02:24:39 UTC
- mfrom: (24.1.174 mandos)
- Revision ID: teddy@fukt.bsnet.se-20110713022439-wbv6kghshdsc2x24
Merge from Björn.
- files removed:
- debian/source/local-options
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
62
62
import functools
63
63
import cPickle as pickle
64
64
import multiprocessing
65
import types
66
import binascii
67
import tempfile
68
65
69
66
import dbus
70
67
import dbus.service
75
72
import ctypes.util
76
73
import xml.dom.minidom
77
74
import inspect
78
import GnuPGInterface
79
75
80
76
try:
81
77
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
81
except ImportError:
86
82
SO_BINDTODEVICE = None
87
83
88
version = "1.5.1"
89
stored_state_file = "clients.pickle"
90
91
logger = logging.getLogger()
84
85
version = "1.3.0"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
92
89
syslogger = (logging.handlers.SysLogHandler
93
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
91
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
147
148
def __enter__(self):
149
return self
150
151
def __exit__ (self, exc_type, exc_value, traceback):
152
self._cleanup()
153
return False
154
155
def __del__(self):
156
self._cleanup()
157
158
def _cleanup(self):
159
if self.tempdir is not None:
160
# Delete contents of tempdir
161
for root, dirs, files in os.walk(self.tempdir,
162
topdown = False):
163
for filename in files:
164
os.remove(os.path.join(root, filename))
165
for dirname in dirs:
166
os.rmdir(os.path.join(root, dirname))
167
# Remove tempdir
168
os.rmdir(self.tempdir)
169
self.tempdir = None
170
171
def password_encode(self, password):
172
# Passphrase can not be empty and can not contain newlines or
173
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
175
176
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
191
return ciphertext
192
193
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
208
return decrypted_plaintext
209
210
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
95
logger.addHandler(syslogger)
96
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
101
logger.addHandler(console)
211
102
212
103
class AvahiError(Exception):
213
104
def __init__(self, value, *args, **kwargs):
268
159
" after %i retries, exiting.",
269
160
self.rename_count)
270
161
raise AvahiServiceError("Too many renames")
271
self.name = unicode(self.server
272
.GetAlternativeServiceName(self.name))
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
273
163
logger.info("Changing Zeroconf service name to %r ...",
274
164
self.name)
165
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
168
% self.name))
275
169
self.remove()
276
170
try:
277
171
self.add()
297
191
avahi.DBUS_INTERFACE_ENTRY_GROUP)
298
192
self.entry_group_state_changed_match = (
299
193
self.group.connect_to_signal(
300
'StateChanged', self.entry_group_state_changed))
194
'StateChanged', self .entry_group_state_changed))
301
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
302
196
self.name, self.type)
303
197
self.group.AddService(
329
223
try:
330
224
self.group.Free()
331
225
except (dbus.exceptions.UnknownMethodException,
332
dbus.exceptions.DBusException):
226
dbus.exceptions.DBusException) as e:
333
227
pass
334
228
self.group = None
335
229
self.remove()
369
263
self.server_state_changed)
370
264
self.server_state_changed(self.server.GetState())
371
265
372
class AvahiServiceToSyslog(AvahiService):
373
def rename(self):
374
"""Add the new name to the syslog messages"""
375
ret = AvahiService.rename(self)
376
syslogger.setFormatter(logging.Formatter
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
380
return ret
381
266
382
def timedelta_to_milliseconds(td):
383
"Convert a datetime.timedelta() to milliseconds"
384
return ((td.days * 24 * 60 * 60 * 1000)
385
+ (td.seconds * 1000)
386
+ (td.microseconds // 1000))
387
388
267
class Client(object):
389
268
"""A representation of a client host served by this server.
390
269
391
270
Attributes:
392
approved: bool(); 'None' if not yet approved/disapproved
271
_approved: bool(); 'None' if not yet approved/disapproved
393
272
approval_delay: datetime.timedelta(); Time to wait for approval
394
273
approval_duration: datetime.timedelta(); Duration of one approval
395
274
checker: subprocess.Popen(); a running checker process used
402
281
instance %(name)s can be used in the command.
403
282
checker_initiator_tag: a gobject event source tag, or None
404
283
created: datetime.datetime(); (UTC) object creation
405
client_structure: Object describing what attributes a client has
406
and is used for storing the client at exit
407
284
current_checker_command: string; current running checker_command
285
disable_hook: If set, called by disable() as disable_hook(self)
408
286
disable_initiator_tag: a gobject event source tag, or None
409
287
enabled: bool()
410
288
fingerprint: string (40 or 32 hexadecimal digits); used to
413
291
interval: datetime.timedelta(); How often to start a new checker
414
292
last_approval_request: datetime.datetime(); (UTC) or None
415
293
last_checked_ok: datetime.datetime(); (UTC) or None
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
294
last_enabled: datetime.datetime(); (UTC)
420
295
name: string; from the config file, used in log messages and
421
296
D-Bus identifiers
422
297
secret: bytestring; sent verbatim (over TLS) to client
423
298
timeout: datetime.timedelta(); How long from last_checked_ok
424
299
until this client is disabled
425
extended_timeout: extra long timeout when secret has been sent
426
300
runtime_expansions: Allowed attributes for runtime expansion.
427
expires: datetime.datetime(); time (UTC) when a client will be
428
disabled, or None
429
301
"""
430
302
431
303
runtime_expansions = ("approval_delay", "approval_duration",
432
304
"created", "enabled", "fingerprint",
433
305
"host", "interval", "last_checked_ok",
434
306
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
307
308
@staticmethod
309
def _timedelta_to_milliseconds(td):
310
"Convert a datetime.timedelta() to milliseconds"
311
return ((td.days * 24 * 60 * 60 * 1000)
312
+ (td.seconds * 1000)
313
+ (td.microseconds // 1000))
445
314
446
315
def timeout_milliseconds(self):
447
316
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
449
450
def extended_timeout_milliseconds(self):
451
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
317
return self._timedelta_to_milliseconds(self.timeout)
453
318
454
319
def interval_milliseconds(self):
455
320
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
457
321
return self._timedelta_to_milliseconds(self.interval)
322
458
323
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
461
@staticmethod
462
def config_parser(config):
463
"""Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above.
466
NOTE: Must be a pure function. Must return the same result
467
value given the same arguments.
468
"""
469
settings = {}
470
for client_name in config.sections():
471
section = dict(config.items(client_name))
472
client = settings[client_name] = {}
473
474
client["host"] = section["host"]
475
# Reformat values from string types to Python types
476
client["approved_by_default"] = config.getboolean(
477
client_name, "approved_by_default")
478
client["enabled"] = config.getboolean(client_name,
479
"enabled")
480
481
client["fingerprint"] = (section["fingerprint"].upper()
482
.replace(" ", ""))
483
if "secret" in section:
484
client["secret"] = section["secret"].decode("base64")
485
elif "secfile" in section:
486
with open(os.path.expanduser(os.path.expandvars
487
(section["secfile"])),
488
"rb") as secfile:
489
client["secret"] = secfile.read()
490
else:
491
raise TypeError("No secret or secfile for section %s"
492
% section)
493
client["timeout"] = string_to_delta(section["timeout"])
494
client["extended_timeout"] = string_to_delta(
495
section["extended_timeout"])
496
client["interval"] = string_to_delta(section["interval"])
497
client["approval_delay"] = string_to_delta(
498
section["approval_delay"])
499
client["approval_duration"] = string_to_delta(
500
section["approval_duration"])
501
client["checker_command"] = section["checker"]
502
client["last_approval_request"] = None
503
client["last_checked_ok"] = None
504
client["last_checker_status"] = None
505
506
return settings
507
508
509
def __init__(self, settings, name = None):
324
return self._timedelta_to_milliseconds(self.approval_delay)
325
326
def __init__(self, name = None, disable_hook=None, config=None):
510
327
"""Note: the 'checker' key in 'config' sets the
511
328
'checker_command' attribute and *not* the 'checker'
512
329
attribute."""
513
330
self.name = name
514
# adding all client settings
515
for setting, value in settings.iteritems():
516
setattr(self, setting, value)
517
518
if self.enabled:
519
if not hasattr(self, "last_enabled"):
520
self.last_enabled = datetime.datetime.utcnow()
521
if not hasattr(self, "expires"):
522
self.expires = (datetime.datetime.utcnow()
523
+ self.timeout)
524
else:
525
self.last_enabled = None
526
self.expires = None
527
331
if config is None:
332
config = {}
528
333
logger.debug("Creating client %r", self.name)
529
334
# Uppercase and remove spaces from fingerprint for later
530
335
# comparison purposes with return value from the fingerprint()
531
336
# function
337
self.fingerprint = (config["fingerprint"].upper()
338
.replace(" ", ""))
532
339
logger.debug(" Fingerprint: %s", self.fingerprint)
533
self.created = settings.get("created",
534
datetime.datetime.utcnow())
535
536
# attributes specific for this server instance
340
if "secret" in config:
341
self.secret = config["secret"].decode("base64")
342
elif "secfile" in config:
343
with open(os.path.expanduser(os.path.expandvars
344
(config["secfile"])),
345
"rb") as secfile:
346
self.secret = secfile.read()
347
else:
348
raise TypeError("No secret or secfile for client %s"
349
% self.name)
350
self.host = config.get("host", "")
351
self.created = datetime.datetime.utcnow()
352
self.enabled = False
353
self.last_approval_request = None
354
self.last_enabled = None
355
self.last_checked_ok = None
356
self.timeout = string_to_delta(config["timeout"])
357
self.interval = string_to_delta(config["interval"])
358
self.disable_hook = disable_hook
537
359
self.checker = None
538
360
self.checker_initiator_tag = None
539
361
self.disable_initiator_tag = None
540
362
self.checker_callback_tag = None
363
self.checker_command = config["checker"]
541
364
self.current_checker_command = None
542
self.approved = None
365
self.last_connect = None
366
self._approved = None
367
self.approved_by_default = config.get("approved_by_default",
368
True)
543
369
self.approvals_pending = 0
544
self.changedstate = (multiprocessing_manager
545
.Condition(multiprocessing_manager
546
.Lock()))
547
self.client_structure = [attr for attr in
548
self.__dict__.iterkeys()
549
if not attr.startswith("_")]
550
self.client_structure.append("client_structure")
551
552
for name, t in inspect.getmembers(type(self),
553
lambda obj:
554
isinstance(obj,
555
property)):
556
if not name.startswith("_"):
557
self.client_structure.append(name)
370
self.approval_delay = string_to_delta(
371
config["approval_delay"])
372
self.approval_duration = string_to_delta(
373
config["approval_duration"])
374
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
558
375
559
# Send notice to process children that client state has changed
560
376
def send_changedstate(self):
561
with self.changedstate:
562
self.changedstate.notify_all()
563
377
self.changedstate.acquire()
378
self.changedstate.notify_all()
379
self.changedstate.release()
380
564
381
def enable(self):
565
382
"""Start this client's checker and timeout hooks"""
566
383
if getattr(self, "enabled", False):
567
384
# Already enabled
568
385
return
569
386
self.send_changedstate()
570
self.expires = datetime.datetime.utcnow() + self.timeout
571
self.enabled = True
572
387
self.last_enabled = datetime.datetime.utcnow()
573
self.init_checker()
388
# Schedule a new checker to be started an 'interval' from now,
389
# and every interval from then on.
390
self.checker_initiator_tag = (gobject.timeout_add
391
(self.interval_milliseconds(),
392
self.start_checker))
393
# Schedule a disable() when 'timeout' has passed
394
self.disable_initiator_tag = (gobject.timeout_add
395
(self.timeout_milliseconds(),
396
self.disable))
397
self.enabled = True
398
# Also start a new checker *right now*.
399
self.start_checker()
574
400
575
401
def disable(self, quiet=True):
576
402
"""Disable this client."""
583
409
if getattr(self, "disable_initiator_tag", False):
584
410
gobject.source_remove(self.disable_initiator_tag)
585
411
self.disable_initiator_tag = None
586
self.expires = None
587
412
if getattr(self, "checker_initiator_tag", False):
588
413
gobject.source_remove(self.checker_initiator_tag)
589
414
self.checker_initiator_tag = None
590
415
self.stop_checker()
416
if self.disable_hook:
417
self.disable_hook(self)
591
418
self.enabled = False
592
419
# Do not run this again if called by a gobject.timeout_add
593
420
return False
594
421
595
422
def __del__(self):
423
self.disable_hook = None
596
424
self.disable()
597
425
598
def init_checker(self):
599
# Schedule a new checker to be started an 'interval' from now,
600
# and every interval from then on.
601
self.checker_initiator_tag = (gobject.timeout_add
602
(self.interval_milliseconds(),
603
self.start_checker))
604
# Schedule a disable() when 'timeout' has passed
605
self.disable_initiator_tag = (gobject.timeout_add
606
(self.timeout_milliseconds(),
607
self.disable))
608
# Also start a new checker *right now*.
609
self.start_checker()
610
611
426
def checker_callback(self, pid, condition, command):
612
427
"""The checker has completed, so take appropriate actions."""
613
428
self.checker_callback_tag = None
614
429
self.checker = None
615
430
if os.WIFEXITED(condition):
616
self.last_checker_status = os.WEXITSTATUS(condition)
617
if self.last_checker_status == 0:
431
exitstatus = os.WEXITSTATUS(condition)
432
if exitstatus == 0:
618
433
logger.info("Checker for %(name)s succeeded",
619
434
vars(self))
620
435
self.checked_ok()
622
437
logger.info("Checker for %(name)s failed",
623
438
vars(self))
624
439
else:
625
self.last_checker_status = -1
626
440
logger.warning("Checker for %(name)s crashed?",
627
441
vars(self))
628
442
629
def checked_ok(self, timeout=None):
443
def checked_ok(self):
630
444
"""Bump up the timeout for this client.
631
445
632
446
This should only be called when the client has been seen,
633
447
alive and well.
634
448
"""
635
if timeout is None:
636
timeout = self.timeout
637
449
self.last_checked_ok = datetime.datetime.utcnow()
638
if self.disable_initiator_tag is not None:
639
gobject.source_remove(self.disable_initiator_tag)
640
if getattr(self, "enabled", False):
641
self.disable_initiator_tag = (gobject.timeout_add
642
(timedelta_to_milliseconds
643
(timeout), self.disable))
644
self.expires = datetime.datetime.utcnow() + timeout
450
gobject.source_remove(self.disable_initiator_tag)
451
self.disable_initiator_tag = (gobject.timeout_add
452
(self.timeout_milliseconds(),
453
self.disable))
645
454
646
455
def need_approval(self):
647
456
self.last_approval_request = datetime.datetime.utcnow()
687
496
'replace')))
688
497
for attr in
689
498
self.runtime_expansions)
690
499
691
500
try:
692
501
command = self.checker_command % escaped_attrs
693
502
except TypeError as error:
739
548
raise
740
549
self.checker = None
741
550
742
743
551
def dbus_service_property(dbus_interface, signature="v",
744
552
access="readwrite", byte_arrays=False):
745
553
"""Decorators for marking methods of a DBusObjectWithProperties to
791
599
792
600
class DBusObjectWithProperties(dbus.service.Object):
793
601
"""A D-Bus object with properties.
794
602
795
603
Classes inheriting from this can use the dbus_service_property
796
604
decorator to expose methods as D-Bus properties. It exposes the
797
605
standard Get(), Set(), and GetAll() methods on the D-Bus.
804
612
def _get_all_dbus_properties(self):
805
613
"""Returns a generator of (name, attribute) pairs
806
614
"""
807
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
808
for cls in self.__class__.__mro__
615
return ((prop._dbus_name, prop)
809
616
for name, prop in
810
inspect.getmembers(cls, self._is_dbus_property))
617
inspect.getmembers(self, self._is_dbus_property))
811
618
812
619
def _get_dbus_property(self, interface_name, property_name):
813
620
"""Returns a bound method if one exists which is a D-Bus
814
621
property with the specified name and interface.
815
622
"""
816
for cls in self.__class__.__mro__:
817
for name, value in (inspect.getmembers
818
(cls, self._is_dbus_property)):
819
if (value._dbus_name == property_name
820
and value._dbus_interface == interface_name):
821
return value.__get__(self)
822
623
for name in (property_name,
624
property_name + "_dbus_property"):
625
prop = getattr(self, name, None)
626
if (prop is None
627
or not self._is_dbus_property(prop)
628
or prop._dbus_name != property_name
629
or (interface_name and prop._dbus_interface
630
and interface_name != prop._dbus_interface)):
631
continue
632
return prop
823
633
# No such property
824
634
raise DBusPropertyNotFound(self.dbus_object_path + ":"
825
635
+ interface_name + "."
850
660
# signatures other than "ay".
851
661
if prop._dbus_signature != "ay":
852
662
raise ValueError
853
value = dbus.ByteArray(b''.join(chr(byte)
854
for byte in value))
663
value = dbus.ByteArray(''.join(unichr(byte)
664
for byte in value))
855
665
prop(value)
856
666
857
667
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
859
669
def GetAll(self, interface_name):
860
670
"""Standard D-Bus property GetAll() method, see D-Bus
861
671
standard.
862
672
863
673
Note: Will not include properties with access="write".
864
674
"""
865
properties = {}
675
all = {}
866
676
for name, prop in self._get_all_dbus_properties():
867
677
if (interface_name
868
678
and interface_name != prop._dbus_interface):
873
683
continue
874
684
value = prop()
875
685
if not hasattr(value, "variant_level"):
876
properties[name] = value
686
all[name] = value
877
687
continue
878
properties[name] = type(value)(value, variant_level=
879
value.variant_level+1)
880
return dbus.Dictionary(properties, signature="sv")
688
all[name] = type(value)(value, variant_level=
689
value.variant_level+1)
690
return dbus.Dictionary(all, signature="sv")
881
691
882
692
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
883
693
out_signature="s",
927
737
return xmlstring
928
738
929
739
930
def datetime_to_dbus (dt, variant_level=0):
931
"""Convert a UTC datetime.datetime() to a D-Bus type."""
932
if dt is None:
933
return dbus.String("", variant_level = variant_level)
934
return dbus.String(dt.isoformat(),
935
variant_level=variant_level)
936
937
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
939
.__metaclass__):
940
"""Applied to an empty subclass of a D-Bus object, this metaclass
941
will add additional D-Bus attributes matching a certain pattern.
942
"""
943
def __new__(mcs, name, bases, attr):
944
# Go through all the base classes which could have D-Bus
945
# methods, signals, or properties in them
946
for base in (b for b in bases
947
if issubclass(b, dbus.service.Object)):
948
# Go though all attributes of the base class
949
for attrname, attribute in inspect.getmembers(base):
950
# Ignore non-D-Bus attributes, and D-Bus attributes
951
# with the wrong interface name
952
if (not hasattr(attribute, "_dbus_interface")
953
or not attribute._dbus_interface
954
.startswith("se.recompile.Mandos")):
955
continue
956
# Create an alternate D-Bus interface name based on
957
# the current name
958
alt_interface = (attribute._dbus_interface
959
.replace("se.recompile.Mandos",
960
"se.bsnet.fukt.Mandos"))
961
# Is this a D-Bus signal?
962
if getattr(attribute, "_dbus_is_signal", False):
963
# Extract the original non-method function by
964
# black magic
965
nonmethod_func = (dict(
966
zip(attribute.func_code.co_freevars,
967
attribute.__closure__))["func"]
968
.cell_contents)
969
# Create a new, but exactly alike, function
970
# object, and decorate it to be a new D-Bus signal
971
# with the alternate D-Bus interface name
972
new_function = (dbus.service.signal
973
(alt_interface,
974
attribute._dbus_signature)
975
(types.FunctionType(
976
nonmethod_func.func_code,
977
nonmethod_func.func_globals,
978
nonmethod_func.func_name,
979
nonmethod_func.func_defaults,
980
nonmethod_func.func_closure)))
981
# Define a creator of a function to call both the
982
# old and new functions, so both the old and new
983
# signals gets sent when the function is called
984
def fixscope(func1, func2):
985
"""This function is a scope container to pass
986
func1 and func2 to the "call_both" function
987
outside of its arguments"""
988
def call_both(*args, **kwargs):
989
"""This function will emit two D-Bus
990
signals by calling func1 and func2"""
991
func1(*args, **kwargs)
992
func2(*args, **kwargs)
993
return call_both
994
# Create the "call_both" function and add it to
995
# the class
996
attr[attrname] = fixscope(attribute,
997
new_function)
998
# Is this a D-Bus method?
999
elif getattr(attribute, "_dbus_is_method", False):
1000
# Create a new, but exactly alike, function
1001
# object. Decorate it to be a new D-Bus method
1002
# with the alternate D-Bus interface name. Add it
1003
# to the class.
1004
attr[attrname] = (dbus.service.method
1005
(alt_interface,
1006
attribute._dbus_in_signature,
1007
attribute._dbus_out_signature)
1008
(types.FunctionType
1009
(attribute.func_code,
1010
attribute.func_globals,
1011
attribute.func_name,
1012
attribute.func_defaults,
1013
attribute.func_closure)))
1014
# Is this a D-Bus property?
1015
elif getattr(attribute, "_dbus_is_property", False):
1016
# Create a new, but exactly alike, function
1017
# object, and decorate it to be a new D-Bus
1018
# property with the alternate D-Bus interface
1019
# name. Add it to the class.
1020
attr[attrname] = (dbus_service_property
1021
(alt_interface,
1022
attribute._dbus_signature,
1023
attribute._dbus_access,
1024
attribute
1025
._dbus_get_args_options
1026
["byte_arrays"])
1027
(types.FunctionType
1028
(attribute.func_code,
1029
attribute.func_globals,
1030
attribute.func_name,
1031
attribute.func_defaults,
1032
attribute.func_closure)))
1033
return type.__new__(mcs, name, bases, attr)
1034
1035
1036
740
class ClientDBus(Client, DBusObjectWithProperties):
1037
741
"""A Client class using D-Bus
1038
742
1047
751
# dbus.service.Object doesn't use super(), so we can't either.
1048
752
1049
753
def __init__(self, bus = None, *args, **kwargs):
754
self._approvals_pending = 0
1050
755
self.bus = bus
1051
756
Client.__init__(self, *args, **kwargs)
1052
757
# Only now, when this client is initialized, can it show up on
1059
764
DBusObjectWithProperties.__init__(self, self.bus,
1060
765
self.dbus_object_path)
1061
766
1062
def notifychangeproperty(transform_func,
1063
dbus_name, type_func=lambda x: x,
1064
variant_level=1):
1065
""" Modify a variable so that it's a property which announces
1066
its changes to DBus.
1067
1068
transform_fun: Function that takes a value and a variant_level
1069
and transforms it to a D-Bus type.
1070
dbus_name: D-Bus name of the variable
1071
type_func: Function that transform the value before sending it
1072
to the D-Bus. Default: no transform
1073
variant_level: D-Bus variant level. Default: 1
1074
"""
1075
attrname = "_{0}".format(dbus_name)
1076
def setter(self, value):
1077
if hasattr(self, "dbus_object_path"):
1078
if (not hasattr(self, attrname) or
1079
type_func(getattr(self, attrname, None))
1080
!= type_func(value)):
1081
dbus_value = transform_func(type_func(value),
1082
variant_level
1083
=variant_level)
1084
self.PropertyChanged(dbus.String(dbus_name),
1085
dbus_value)
1086
setattr(self, attrname, value)
1087
1088
return property(lambda self: getattr(self, attrname), setter)
1089
1090
1091
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1092
approvals_pending = notifychangeproperty(dbus.Boolean,
1093
"ApprovalPending",
1094
type_func = bool)
1095
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1096
last_enabled = notifychangeproperty(datetime_to_dbus,
1097
"LastEnabled")
1098
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1099
type_func = lambda checker:
1100
checker is not None)
1101
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1102
"LastCheckedOK")
1103
last_approval_request = notifychangeproperty(
1104
datetime_to_dbus, "LastApprovalRequest")
1105
approved_by_default = notifychangeproperty(dbus.Boolean,
1106
"ApprovedByDefault")
1107
approval_delay = notifychangeproperty(dbus.UInt64,
1108
"ApprovalDelay",
1109
type_func =
1110
timedelta_to_milliseconds)
1111
approval_duration = notifychangeproperty(
1112
dbus.UInt64, "ApprovalDuration",
1113
type_func = timedelta_to_milliseconds)
1114
host = notifychangeproperty(dbus.String, "Host")
1115
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1116
type_func =
1117
timedelta_to_milliseconds)
1118
extended_timeout = notifychangeproperty(
1119
dbus.UInt64, "ExtendedTimeout",
1120
type_func = timedelta_to_milliseconds)
1121
interval = notifychangeproperty(dbus.UInt64,
1122
"Interval",
1123
type_func =
1124
timedelta_to_milliseconds)
1125
checker_command = notifychangeproperty(dbus.String, "Checker")
1126
1127
del notifychangeproperty
767
def _get_approvals_pending(self):
768
return self._approvals_pending
769
def _set_approvals_pending(self, value):
770
old_value = self._approvals_pending
771
self._approvals_pending = value
772
bval = bool(value)
773
if (hasattr(self, "dbus_object_path")
774
and bval is not bool(old_value)):
775
dbus_bool = dbus.Boolean(bval, variant_level=1)
776
self.PropertyChanged(dbus.String("ApprovalPending"),
777
dbus_bool)
778
779
approvals_pending = property(_get_approvals_pending,
780
_set_approvals_pending)
781
del _get_approvals_pending, _set_approvals_pending
782
783
@staticmethod
784
def _datetime_to_dbus(dt, variant_level=0):
785
"""Convert a UTC datetime.datetime() to a D-Bus type."""
786
return dbus.String(dt.isoformat(),
787
variant_level=variant_level)
788
789
def enable(self):
790
oldstate = getattr(self, "enabled", False)
791
r = Client.enable(self)
792
if oldstate != self.enabled:
793
# Emit D-Bus signals
794
self.PropertyChanged(dbus.String("Enabled"),
795
dbus.Boolean(True, variant_level=1))
796
self.PropertyChanged(
797
dbus.String("LastEnabled"),
798
self._datetime_to_dbus(self.last_enabled,
799
variant_level=1))
800
return r
801
802
def disable(self, quiet = False):
803
oldstate = getattr(self, "enabled", False)
804
r = Client.disable(self, quiet=quiet)
805
if not quiet and oldstate != self.enabled:
806
# Emit D-Bus signal
807
self.PropertyChanged(dbus.String("Enabled"),
808
dbus.Boolean(False, variant_level=1))
809
return r
1128
810
1129
811
def __del__(self, *args, **kwargs):
1130
812
try:
1139
821
*args, **kwargs):
1140
822
self.checker_callback_tag = None
1141
823
self.checker = None
824
# Emit D-Bus signal
825
self.PropertyChanged(dbus.String("CheckerRunning"),
826
dbus.Boolean(False, variant_level=1))
1142
827
if os.WIFEXITED(condition):
1143
828
exitstatus = os.WEXITSTATUS(condition)
1144
829
# Emit D-Bus signal
1154
839
return Client.checker_callback(self, pid, condition, command,
1155
840
*args, **kwargs)
1156
841
842
def checked_ok(self, *args, **kwargs):
843
Client.checked_ok(self, *args, **kwargs)
844
# Emit D-Bus signal
845
self.PropertyChanged(
846
dbus.String("LastCheckedOK"),
847
(self._datetime_to_dbus(self.last_checked_ok,
848
variant_level=1)))
849
850
def need_approval(self, *args, **kwargs):
851
r = Client.need_approval(self, *args, **kwargs)
852
# Emit D-Bus signal
853
self.PropertyChanged(
854
dbus.String("LastApprovalRequest"),
855
(self._datetime_to_dbus(self.last_approval_request,
856
variant_level=1)))
857
return r
858
1157
859
def start_checker(self, *args, **kwargs):
1158
860
old_checker = self.checker
1159
861
if self.checker is not None:
1166
868
and old_checker_pid != self.checker.pid):
1167
869
# Emit D-Bus signal
1168
870
self.CheckerStarted(self.current_checker_command)
871
self.PropertyChanged(
872
dbus.String("CheckerRunning"),
873
dbus.Boolean(True, variant_level=1))
1169
874
return r
1170
875
876
def stop_checker(self, *args, **kwargs):
877
old_checker = getattr(self, "checker", None)
878
r = Client.stop_checker(self, *args, **kwargs)
879
if (old_checker is not None
880
and getattr(self, "checker", None) is None):
881
self.PropertyChanged(dbus.String("CheckerRunning"),
882
dbus.Boolean(False, variant_level=1))
883
return r
884
1171
885
def _reset_approved(self):
1172
self.approved = None
886
self._approved = None
1173
887
return False
1174
888
1175
889
def approve(self, value=True):
1176
890
self.send_changedstate()
1177
self.approved = value
1178
gobject.timeout_add(timedelta_to_milliseconds
891
self._approved = value
892
gobject.timeout_add(self._timedelta_to_milliseconds
1179
893
(self.approval_duration),
1180
894
self._reset_approved)
1181
895
1182
896
1183
897
## D-Bus methods, signals & properties
1184
_interface = "se.recompile.Mandos.Client"
898
_interface = "se.bsnet.fukt.Mandos.Client"
1185
899
1186
900
## Signals
1187
901
1273
987
if value is None: # get
1274
988
return dbus.Boolean(self.approved_by_default)
1275
989
self.approved_by_default = bool(value)
990
# Emit D-Bus signal
991
self.PropertyChanged(dbus.String("ApprovedByDefault"),
992
dbus.Boolean(value, variant_level=1))
1276
993
1277
994
# ApprovalDelay - property
1278
995
@dbus_service_property(_interface, signature="t",
1281
998
if value is None: # get
1282
999
return dbus.UInt64(self.approval_delay_milliseconds())
1283
1000
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1001
# Emit D-Bus signal
1002
self.PropertyChanged(dbus.String("ApprovalDelay"),
1003
dbus.UInt64(value, variant_level=1))
1284
1004
1285
1005
# ApprovalDuration - property
1286
1006
@dbus_service_property(_interface, signature="t",
1287
1007
access="readwrite")
1288
1008
def ApprovalDuration_dbus_property(self, value=None):
1289
1009
if value is None: # get
1290
return dbus.UInt64(timedelta_to_milliseconds(
1010
return dbus.UInt64(self._timedelta_to_milliseconds(
1291
1011
self.approval_duration))
1292
1012
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1013
# Emit D-Bus signal
1014
self.PropertyChanged(dbus.String("ApprovalDuration"),
1015
dbus.UInt64(value, variant_level=1))
1293
1016
1294
1017
# Name - property
1295
1018
@dbus_service_property(_interface, signature="s", access="read")
1307
1030
def Host_dbus_property(self, value=None):
1308
1031
if value is None: # get
1309
1032
return dbus.String(self.host)
1310
self.host = unicode(value)
1033
self.host = value
1034
# Emit D-Bus signal
1035
self.PropertyChanged(dbus.String("Host"),
1036
dbus.String(value, variant_level=1))
1311
1037
1312
1038
# Created - property
1313
1039
@dbus_service_property(_interface, signature="s", access="read")
1314
1040
def Created_dbus_property(self):
1315
return datetime_to_dbus(self.created)
1041
return dbus.String(self._datetime_to_dbus(self.created))
1316
1042
1317
1043
# LastEnabled - property
1318
1044
@dbus_service_property(_interface, signature="s", access="read")
1319
1045
def LastEnabled_dbus_property(self):
1320
return datetime_to_dbus(self.last_enabled)
1046
if self.last_enabled is None:
1047
return dbus.String("")
1048
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1321
1049
1322
1050
# Enabled - property
1323
1051
@dbus_service_property(_interface, signature="b",
1337
1065
if value is not None:
1338
1066
self.checked_ok()
1339
1067
return
1340
return datetime_to_dbus(self.last_checked_ok)
1341
1342
# Expires - property
1343
@dbus_service_property(_interface, signature="s", access="read")
1344
def Expires_dbus_property(self):
1345
return datetime_to_dbus(self.expires)
1068
if self.last_checked_ok is None:
1069
return dbus.String("")
1070
return dbus.String(self._datetime_to_dbus(self
1071
.last_checked_ok))
1346
1072
1347
1073
# LastApprovalRequest - property
1348
1074
@dbus_service_property(_interface, signature="s", access="read")
1349
1075
def LastApprovalRequest_dbus_property(self):
1350
return datetime_to_dbus(self.last_approval_request)
1076
if self.last_approval_request is None:
1077
return dbus.String("")
1078
return dbus.String(self.
1079
_datetime_to_dbus(self
1080
.last_approval_request))
1351
1081
1352
1082
# Timeout - property
1353
1083
@dbus_service_property(_interface, signature="t",
1356
1086
if value is None: # get
1357
1087
return dbus.UInt64(self.timeout_milliseconds())
1358
1088
self.timeout = datetime.timedelta(0, 0, 0, value)
1089
# Emit D-Bus signal
1090
self.PropertyChanged(dbus.String("Timeout"),
1091
dbus.UInt64(value, variant_level=1))
1092
if getattr(self, "disable_initiator_tag", None) is None:
1093
return
1359
1094
# Reschedule timeout
1360
if self.enabled:
1361
now = datetime.datetime.utcnow()
1362
time_to_die = timedelta_to_milliseconds(
1363
(self.last_checked_ok + self.timeout) - now)
1364
if time_to_die <= 0:
1365
# The timeout has passed
1366
self.disable()
1367
else:
1368
self.expires = (now +
1369
datetime.timedelta(milliseconds =
1370
time_to_die))
1371
if (getattr(self, "disable_initiator_tag", None)
1372
is None):
1373
return
1374
gobject.source_remove(self.disable_initiator_tag)
1375
self.disable_initiator_tag = (gobject.timeout_add
1376
(time_to_die,
1377
self.disable))
1378
1379
# ExtendedTimeout - property
1380
@dbus_service_property(_interface, signature="t",
1381
access="readwrite")
1382
def ExtendedTimeout_dbus_property(self, value=None):
1383
if value is None: # get
1384
return dbus.UInt64(self.extended_timeout_milliseconds())
1385
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1095
gobject.source_remove(self.disable_initiator_tag)
1096
self.disable_initiator_tag = None
1097
time_to_die = (self.
1098
_timedelta_to_milliseconds((self
1099
.last_checked_ok
1100
+ self.timeout)
1101
- datetime.datetime
1102
.utcnow()))
1103
if time_to_die <= 0:
1104
# The timeout has passed
1105
self.disable()
1106
else:
1107
self.disable_initiator_tag = (gobject.timeout_add
1108
(time_to_die, self.disable))
1386
1109
1387
1110
# Interval - property
1388
1111
@dbus_service_property(_interface, signature="t",
1391
1114
if value is None: # get
1392
1115
return dbus.UInt64(self.interval_milliseconds())
1393
1116
self.interval = datetime.timedelta(0, 0, 0, value)
1117
# Emit D-Bus signal
1118
self.PropertyChanged(dbus.String("Interval"),
1119
dbus.UInt64(value, variant_level=1))
1394
1120
if getattr(self, "checker_initiator_tag", None) is None:
1395
1121
return
1396
if self.enabled:
1397
# Reschedule checker run
1398
gobject.source_remove(self.checker_initiator_tag)
1399
self.checker_initiator_tag = (gobject.timeout_add
1400
(value, self.start_checker))
1401
self.start_checker() # Start one now, too
1402
1122
# Reschedule checker run
1123
gobject.source_remove(self.checker_initiator_tag)
1124
self.checker_initiator_tag = (gobject.timeout_add
1125
(value, self.start_checker))
1126
self.start_checker() # Start one now, too
1127
1403
1128
# Checker - property
1404
1129
@dbus_service_property(_interface, signature="s",
1405
1130
access="readwrite")
1406
1131
def Checker_dbus_property(self, value=None):
1407
1132
if value is None: # get
1408
1133
return dbus.String(self.checker_command)
1409
self.checker_command = unicode(value)
1134
self.checker_command = value
1135
# Emit D-Bus signal
1136
self.PropertyChanged(dbus.String("Checker"),
1137
dbus.String(self.checker_command,
1138
variant_level=1))
1410
1139
1411
1140
# CheckerRunning - property
1412
1141
@dbus_service_property(_interface, signature="b",
1439
1168
self._pipe.send(('init', fpr, address))
1440
1169
if not self._pipe.recv():
1441
1170
raise KeyError()
1442
1171
1443
1172
def __getattribute__(self, name):
1444
if name == '_pipe':
1173
if(name == '_pipe'):
1445
1174
return super(ProxyClient, self).__getattribute__(name)
1446
1175
self._pipe.send(('getattr', name))
1447
1176
data = self._pipe.recv()
1452
1181
self._pipe.send(('funcall', name, args, kwargs))
1453
1182
return self._pipe.recv()[1]
1454
1183
return func
1455
1184
1456
1185
def __setattr__(self, name, value):
1457
if name == '_pipe':
1186
if(name == '_pipe'):
1458
1187
return super(ProxyClient, self).__setattr__(name, value)
1459
1188
self._pipe.send(('setattr', name, value))
1460
1189
1461
1190
1462
class ClientDBusTransitional(ClientDBus):
1463
__metaclass__ = AlternateDBusNamesMetaclass
1464
1465
1466
1191
class ClientHandler(socketserver.BaseRequestHandler, object):
1467
1192
"""A class to handle client connections.
1468
1193
1475
1200
unicode(self.client_address))
1476
1201
logger.debug("Pipe FD: %d",
1477
1202
self.server.child_pipe.fileno())
1478
1203
1479
1204
session = (gnutls.connection
1480
1205
.ClientSession(self.request,
1481
1206
gnutls.connection
1482
1207
.X509Credentials()))
1483
1208
1484
1209
# Note: gnutls.connection.X509Credentials is really a
1485
1210
# generic GnuTLS certificate credentials object so long as
1486
1211
# no X.509 keys are added to it. Therefore, we can use it
1487
1212
# here despite using OpenPGP certificates.
1488
1213
1489
1214
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1490
1215
# "+AES-256-CBC", "+SHA1",
1491
1216
# "+COMP-NULL", "+CTYPE-OPENPGP",
1497
1222
(gnutls.library.functions
1498
1223
.gnutls_priority_set_direct(session._c_object,
1499
1224
priority, None))
1500
1225
1501
1226
# Start communication using the Mandos protocol
1502
1227
# Get protocol number
1503
1228
line = self.request.makefile().readline()
1508
1233
except (ValueError, IndexError, RuntimeError) as error:
1509
1234
logger.error("Unknown protocol version: %s", error)
1510
1235
return
1511
1236
1512
1237
# Start GnuTLS connection
1513
1238
try:
1514
1239
session.handshake()
1518
1243
# established. Just abandon the request.
1519
1244
return
1520
1245
logger.debug("Handshake succeeded")
1521
1246
1522
1247
approval_required = False
1523
1248
try:
1524
1249
try:
1529
1254
logger.warning("Bad certificate: %s", error)
1530
1255
return
1531
1256
logger.debug("Fingerprint: %s", fpr)
1532
1257
1533
1258
try:
1534
1259
client = ProxyClient(child_pipe, fpr,
1535
1260
self.client_address)
1547
1272
client.name)
1548
1273
if self.server.use_dbus:
1549
1274
# Emit D-Bus signal
1550
client.Rejected("Disabled")
1275
client.Rejected("Disabled")
1551
1276
return
1552
1277
1553
if client.approved or not client.approval_delay:
1278
if client._approved or not client.approval_delay:
1554
1279
#We are approved or approval is disabled
1555
1280
break
1556
elif client.approved is None:
1281
elif client._approved is None:
1557
1282
logger.info("Client %s needs approval",
1558
1283
client.name)
1559
1284
if self.server.use_dbus:
1570
1295
return
1571
1296
1572
1297
#wait until timeout or approved
1298
#x = float(client._timedelta_to_milliseconds(delay))
1573
1299
time = datetime.datetime.now()
1574
1300
client.changedstate.acquire()
1575
(client.changedstate.wait
1576
(float(client.timedelta_to_milliseconds(delay)
1577
/ 1000)))
1301
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1578
1302
client.changedstate.release()
1579
1303
time2 = datetime.datetime.now()
1580
1304
if (time2 - time) >= delay:
1602
1326
sent, len(client.secret)
1603
1327
- (sent_size + sent))
1604
1328
sent_size += sent
1605
1329
1606
1330
logger.info("Sending secret to %s", client.name)
1607
# bump the timeout using extended_timeout
1608
client.checked_ok(client.extended_timeout)
1331
# bump the timeout as if seen
1332
client.checked_ok()
1609
1333
if self.server.use_dbus:
1610
1334
# Emit D-Bus signal
1611
1335
client.GotSecret()
1678
1402
# Convert the buffer to a Python bytestring
1679
1403
fpr = ctypes.string_at(buf, buf_len.value)
1680
1404
# Convert the bytestring to hexadecimal notation
1681
hex_fpr = binascii.hexlify(fpr).upper()
1405
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1682
1406
return hex_fpr
1683
1407
1684
1408
1687
1411
def sub_process_main(self, request, address):
1688
1412
try:
1689
1413
self.finish_request(request, address)
1690
except Exception:
1414
except:
1691
1415
self.handle_error(request, address)
1692
1416
self.close_request(request)
1693
1417
1694
1418
def process_request(self, request, address):
1695
1419
"""Start a new process to process the request."""
1696
proc = multiprocessing.Process(target = self.sub_process_main,
1697
args = (request,
1698
address))
1699
proc.start()
1700
return proc
1701
1420
multiprocessing.Process(target = self.sub_process_main,
1421
args = (request, address)).start()
1702
1422
1703
1423
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1704
1424
""" adds a pipe to the MixIn """
1708
1428
This function creates a new pipe in self.pipe
1709
1429
"""
1710
1430
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1711
1712
proc = MultiprocessingMixIn.process_request(self, request,
1713
client_address)
1431
1432
super(MultiprocessingMixInWithPipe,
1433
self).process_request(request, client_address)
1714
1434
self.child_pipe.close()
1715
self.add_pipe(parent_pipe, proc)
1716
1717
def add_pipe(self, parent_pipe, proc):
1435
self.add_pipe(parent_pipe)
1436
1437
def add_pipe(self, parent_pipe):
1718
1438
"""Dummy function; override as necessary"""
1719
1439
raise NotImplementedError
1720
1440
1721
1722
1441
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1723
1442
socketserver.TCPServer, object):
1724
1443
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1798
1517
self.enabled = False
1799
1518
self.clients = clients
1800
1519
if self.clients is None:
1801
self.clients = {}
1520
self.clients = set()
1802
1521
self.use_dbus = use_dbus
1803
1522
self.gnutls_priority = gnutls_priority
1804
1523
IPv6_TCPServer.__init__(self, server_address,
1808
1527
def server_activate(self):
1809
1528
if self.enabled:
1810
1529
return socketserver.TCPServer.server_activate(self)
1811
1812
1530
def enable(self):
1813
1531
self.enabled = True
1814
1815
def add_pipe(self, parent_pipe, proc):
1532
def add_pipe(self, parent_pipe):
1816
1533
# Call "handle_ipc" for both data and EOF events
1817
1534
gobject.io_add_watch(parent_pipe.fileno(),
1818
1535
gobject.IO_IN | gobject.IO_HUP,
1819
1536
functools.partial(self.handle_ipc,
1820
parent_pipe =
1821
parent_pipe,
1822
proc = proc))
1823
1537
parent_pipe = parent_pipe))
1538
1824
1539
def handle_ipc(self, source, condition, parent_pipe=None,
1825
proc = None, client_object=None):
1540
client_object=None):
1826
1541
condition_names = {
1827
1542
gobject.IO_IN: "IN", # There is data to read.
1828
1543
gobject.IO_OUT: "OUT", # Data can be written (without
1837
1552
for cond, name in
1838
1553
condition_names.iteritems()
1839
1554
if cond & condition)
1840
# error, or the other end of multiprocessing.Pipe has closed
1555
# error or the other end of multiprocessing.Pipe has closed
1841
1556
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1842
# Wait for other process to exit
1843
proc.join()
1844
1557
return False
1845
1558
1846
1559
# Read a request from the child
1851
1564
fpr = request[1]
1852
1565
address = request[2]
1853
1566
1854
for c in self.clients.itervalues():
1567
for c in self.clients:
1855
1568
if c.fingerprint == fpr:
1856
1569
client = c
1857
1570
break
1860
1573
"dress: %s", fpr, address)
1861
1574
if self.use_dbus:
1862
1575
# Emit D-Bus signal
1863
mandos_dbus_service.ClientNotFound(fpr,
1864
address[0])
1576
mandos_dbus_service.ClientNotFound(fpr, address[0])
1865
1577
parent_pipe.send(False)
1866
1578
return False
1867
1579
1868
1580
gobject.io_add_watch(parent_pipe.fileno(),
1869
1581
gobject.IO_IN | gobject.IO_HUP,
1870
1582
functools.partial(self.handle_ipc,
1871
parent_pipe =
1872
parent_pipe,
1873
proc = proc,
1874
client_object =
1875
client))
1583
parent_pipe = parent_pipe,
1584
client_object = client))
1876
1585
parent_pipe.send(True)
1877
# remove the old hook in favor of the new above hook on
1878
# same fileno
1586
# remove the old hook in favor of the new above hook on same fileno
1879
1587
return False
1880
1588
if command == 'funcall':
1881
1589
funcname = request[1]
1882
1590
args = request[2]
1883
1591
kwargs = request[3]
1884
1592
1885
parent_pipe.send(('data', getattr(client_object,
1886
funcname)(*args,
1887
**kwargs)))
1888
1593
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1594
1889
1595
if command == 'getattr':
1890
1596
attrname = request[1]
1891
1597
if callable(client_object.__getattribute__(attrname)):
1892
1598
parent_pipe.send(('function',))
1893
1599
else:
1894
parent_pipe.send(('data', client_object
1895
.__getattribute__(attrname)))
1600
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1896
1601
1897
1602
if command == 'setattr':
1898
1603
attrname = request[1]
1899
1604
value = request[2]
1900
1605
setattr(client_object, attrname, value)
1901
1606
1902
1607
return True
1903
1608
1904
1609
1941
1646
return timevalue
1942
1647
1943
1648
1649
def if_nametoindex(interface):
1650
"""Call the C function if_nametoindex(), or equivalent
1651
1652
Note: This function cannot accept a unicode string."""
1653
global if_nametoindex
1654
try:
1655
if_nametoindex = (ctypes.cdll.LoadLibrary
1656
(ctypes.util.find_library("c"))
1657
.if_nametoindex)
1658
except (OSError, AttributeError):
1659
logger.warning("Doing if_nametoindex the hard way")
1660
def if_nametoindex(interface):
1661
"Get an interface index the hard way, i.e. using fcntl()"
1662
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1663
with contextlib.closing(socket.socket()) as s:
1664
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1665
struct.pack(str("16s16x"),
1666
interface))
1667
interface_index = struct.unpack(str("I"),
1668
ifreq[16:20])[0]
1669
return interface_index
1670
return if_nametoindex(interface)
1671
1672
1944
1673
def daemon(nochdir = False, noclose = False):
1945
1674
"""See daemon(3). Standard BSD Unix function.
1946
1675
2001
1730
" system bus interface")
2002
1731
parser.add_argument("--no-ipv6", action="store_false",
2003
1732
dest="use_ipv6", help="Do not use IPv6")
2004
parser.add_argument("--no-restore", action="store_false",
2005
dest="restore", help="Do not restore stored"
2006
" state")
2007
parser.add_argument("--statedir", metavar="DIR",
2008
help="Directory to save/restore state in")
2009
2010
1733
options = parser.parse_args()
2011
1734
2012
1735
if options.check:
2025
1748
"use_dbus": "True",
2026
1749
"use_ipv6": "True",
2027
1750
"debuglevel": "",
2028
"restore": "True",
2029
"statedir": "/var/lib/mandos"
2030
1751
}
2031
1752
2032
1753
# Parse config file for server-global settings
2049
1770
# options, if set.
2050
1771
for option in ("interface", "address", "port", "debug",
2051
1772
"priority", "servicename", "configdir",
2052
"use_dbus", "use_ipv6", "debuglevel", "restore",
2053
"statedir"):
1773
"use_dbus", "use_ipv6", "debuglevel"):
2054
1774
value = getattr(options, option)
2055
1775
if value is not None:
2056
1776
server_settings[option] = value
2068
1788
debuglevel = server_settings["debuglevel"]
2069
1789
use_dbus = server_settings["use_dbus"]
2070
1790
use_ipv6 = server_settings["use_ipv6"]
2071
stored_state_path = os.path.join(server_settings["statedir"],
2072
stored_state_file)
2073
2074
if debug:
2075
initlogger(debug, logging.DEBUG)
2076
else:
2077
if not debuglevel:
2078
initlogger(debug)
2079
else:
2080
level = getattr(logging, debuglevel.upper())
2081
initlogger(debug, level)
2082
1791
2083
1792
if server_settings["servicename"] != "Mandos":
2084
1793
syslogger.setFormatter(logging.Formatter
2085
1794
('Mandos (%s) [%%(process)d]:'
2087
1796
% server_settings["servicename"]))
2088
1797
2089
1798
# Parse config file with clients
2090
client_config = configparser.SafeConfigParser(Client
2091
.client_defaults)
1799
client_defaults = { "timeout": "1h",
1800
"interval": "5m",
1801
"checker": "fping -q -- %%(host)s",
1802
"host": "",
1803
"approval_delay": "0s",
1804
"approval_duration": "1s",
1805
}
1806
client_config = configparser.SafeConfigParser(client_defaults)
2092
1807
client_config.read(os.path.join(server_settings["configdir"],
2093
1808
"clients.conf"))
2094
1809
2132
1847
if error[0] != errno.EPERM:
2133
1848
raise error
2134
1849
1850
if not debug and not debuglevel:
1851
syslogger.setLevel(logging.WARNING)
1852
console.setLevel(logging.WARNING)
1853
if debuglevel:
1854
level = getattr(logging, debuglevel.upper())
1855
syslogger.setLevel(level)
1856
console.setLevel(level)
1857
2135
1858
if debug:
2136
1859
# Enable all possible GnuTLS debugging
2137
1860
2151
1874
os.dup2(null, sys.stdin.fileno())
2152
1875
if null > 2:
2153
1876
os.close(null)
1877
else:
1878
# No console logging
1879
logger.removeHandler(console)
2154
1880
2155
1881
# Need to fork before connecting to D-Bus
2156
1882
if not debug:
2157
1883
# Close all input and output, do double fork, etc.
2158
1884
daemon()
2159
1885
2160
gobject.threads_init()
2161
2162
1886
global main_loop
2163
1887
# From the Avahi example code
2164
1888
DBusGMainLoop(set_as_default=True )
2167
1891
# End of Avahi example code
2168
1892
if use_dbus:
2169
1893
try:
2170
bus_name = dbus.service.BusName("se.recompile.Mandos",
1894
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2171
1895
bus, do_not_queue=True)
2172
old_bus_name = (dbus.service.BusName
2173
("se.bsnet.fukt.Mandos", bus,
2174
do_not_queue=True))
2175
1896
except dbus.exceptions.NameExistsException as e:
2176
1897
logger.error(unicode(e) + ", disabling D-Bus")
2177
1898
use_dbus = False
2178
1899
server_settings["use_dbus"] = False
2179
1900
tcp_server.use_dbus = False
2180
1901
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2181
service = AvahiServiceToSyslog(name =
2182
server_settings["servicename"],
2183
servicetype = "_mandos._tcp",
2184
protocol = protocol, bus = bus)
1902
service = AvahiService(name = server_settings["servicename"],
1903
servicetype = "_mandos._tcp",
1904
protocol = protocol, bus = bus)
2185
1905
if server_settings["interface"]:
2186
1906
service.interface = (if_nametoindex
2187
1907
(str(server_settings["interface"])))
2191
1911
2192
1912
client_class = Client
2193
1913
if use_dbus:
2194
client_class = functools.partial(ClientDBusTransitional,
2195
bus = bus)
2196
2197
client_settings = Client.config_parser(client_config)
2198
old_client_settings = {}
2199
clients_data = {}
2200
2201
# Get client data and settings from last running state.
2202
if server_settings["restore"]:
2203
try:
2204
with open(stored_state_path, "rb") as stored_state:
2205
clients_data, old_client_settings = (pickle.load
2206
(stored_state))
2207
os.remove(stored_state_path)
2208
except IOError as e:
2209
logger.warning("Could not load persistent state: {0}"
2210
.format(e))
2211
if e.errno != errno.ENOENT:
2212
raise
2213
except EOFError as e:
2214
logger.warning("Could not load persistent state: "
2215
"EOFError: {0}".format(e))
2216
2217
with PGPEngine() as pgp:
2218
for client_name, client in clients_data.iteritems():
2219
# Decide which value to use after restoring saved state.
2220
# We have three different values: Old config file,
2221
# new config file, and saved state.
2222
# New config value takes precedence if it differs from old
2223
# config value, otherwise use saved state.
2224
for name, value in client_settings[client_name].items():
2225
try:
2226
# For each value in new config, check if it
2227
# differs from the old config value (Except for
2228
# the "secret" attribute)
2229
if (name != "secret" and
2230
value != old_client_settings[client_name]
2231
[name]):
2232
client[name] = value
2233
except KeyError:
2234
pass
2235
2236
# Clients who has passed its expire date can still be
2237
# enabled if its last checker was successful. Clients
2238
# whose checker succeeded before we stored its state is
2239
# assumed to have successfully run all checkers during
2240
# downtime.
2241
if client["enabled"]:
2242
if datetime.datetime.utcnow() >= client["expires"]:
2243
if not client["last_checked_ok"]:
2244
logger.warning(
2245
"disabling client {0} - Client never "
2246
"performed a successful checker"
2247
.format(client_name))
2248
client["enabled"] = False
2249
elif client["last_checker_status"] != 0:
2250
logger.warning(
2251
"disabling client {0} - Client "
2252
"last checker failed with error code {1}"
2253
.format(client_name,
2254
client["last_checker_status"]))
2255
client["enabled"] = False
2256
else:
2257
client["expires"] = (datetime.datetime
2258
.utcnow()
2259
+ client["timeout"])
2260
logger.debug("Last checker succeeded,"
2261
" keeping {0} enabled"
2262
.format(client_name))
1914
client_class = functools.partial(ClientDBus, bus = bus)
1915
def client_config_items(config, section):
1916
special_settings = {
1917
"approved_by_default":
1918
lambda: config.getboolean(section,
1919
"approved_by_default"),
1920
}
1921
for name, value in config.items(section):
2263
1922
try:
2264
client["secret"] = (
2265
pgp.decrypt(client["encrypted_secret"],
2266
client_settings[client_name]
2267
["secret"]))
2268
except PGPError:
2269
# If decryption fails, we use secret from new settings
2270
logger.debug("Failed to decrypt {0} old secret"
2271
.format(client_name))
2272
client["secret"] = (
2273
client_settings[client_name]["secret"])
2274
2275
2276
# Add/remove clients based on new changes made to config
2277
for client_name in (set(old_client_settings)
2278
- set(client_settings)):
2279
del clients_data[client_name]
2280
for client_name in (set(client_settings)
2281
- set(old_client_settings)):
2282
clients_data[client_name] = client_settings[client_name]
2283
2284
# Create all client objects
2285
for client_name, client in clients_data.iteritems():
2286
tcp_server.clients[client_name] = client_class(
2287
name = client_name, settings = client)
2288
1923
yield (name, special_settings[name]())
1924
except KeyError:
1925
yield (name, value)
1926
1927
tcp_server.clients.update(set(
1928
client_class(name = section,
1929
config= dict(client_config_items(
1930
client_config, section)))
1931
for section in client_config.sections()))
2289
1932
if not tcp_server.clients:
2290
1933
logger.warning("No clients defined")
2291
1934
2302
1945
# "pidfile" was never created
2303
1946
pass
2304
1947
del pidfilename
1948
2305
1949
signal.signal(signal.SIGINT, signal.SIG_IGN)
2306
1950
2307
1951
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2308
1952
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2309
1953
2312
1956
"""A D-Bus proxy object"""
2313
1957
def __init__(self):
2314
1958
dbus.service.Object.__init__(self, bus, "/")
2315
_interface = "se.recompile.Mandos"
1959
_interface = "se.bsnet.fukt.Mandos"
2316
1960
2317
1961
@dbus.service.signal(_interface, signature="o")
2318
1962
def ClientAdded(self, objpath):
2333
1977
def GetAllClients(self):
2334
1978
"D-Bus method"
2335
1979
return dbus.Array(c.dbus_object_path
2336
for c in
2337
tcp_server.clients.itervalues())
1980
for c in tcp_server.clients)
2338
1981
2339
1982
@dbus.service.method(_interface,
2340
1983
out_signature="a{oa{sv}}")
2342
1985
"D-Bus method"
2343
1986
return dbus.Dictionary(
2344
1987
((c.dbus_object_path, c.GetAll(""))
2345
for c in tcp_server.clients.itervalues()),
1988
for c in tcp_server.clients),
2346
1989
signature="oa{sv}")
2347
1990
2348
1991
@dbus.service.method(_interface, in_signature="o")
2349
1992
def RemoveClient(self, object_path):
2350
1993
"D-Bus method"
2351
for c in tcp_server.clients.itervalues():
1994
for c in tcp_server.clients:
2352
1995
if c.dbus_object_path == object_path:
2353
del tcp_server.clients[c.name]
1996
tcp_server.clients.remove(c)
2354
1997
c.remove_from_connection()
2355
1998
# Don't signal anything except ClientRemoved
2356
1999
c.disable(quiet=True)
2361
2004
2362
2005
del _interface
2363
2006
2364
class MandosDBusServiceTransitional(MandosDBusService):
2365
__metaclass__ = AlternateDBusNamesMetaclass
2366
mandos_dbus_service = MandosDBusServiceTransitional()
2007
mandos_dbus_service = MandosDBusService()
2367
2008
2368
2009
def cleanup():
2369
2010
"Cleanup function; run on exit"
2370
2011
service.cleanup()
2371
2012
2372
multiprocessing.active_children()
2373
if not (tcp_server.clients or client_settings):
2374
return
2375
2376
# Store client before exiting. Secrets are encrypted with key
2377
# based on what config file has. If config file is
2378
# removed/edited, old secret will thus be unrecovable.
2379
clients = {}
2380
with PGPEngine() as pgp:
2381
for client in tcp_server.clients.itervalues():
2382
key = client_settings[client.name]["secret"]
2383
client.encrypted_secret = pgp.encrypt(client.secret,
2384
key)
2385
client_dict = {}
2386
2387
# A list of attributes that can not be pickled
2388
# + secret.
2389
exclude = set(("bus", "changedstate", "secret",
2390
"checker"))
2391
for name, typ in (inspect.getmembers
2392
(dbus.service.Object)):
2393
exclude.add(name)
2394
2395
client_dict["encrypted_secret"] = (client
2396
.encrypted_secret)
2397
for attr in client.client_structure:
2398
if attr not in exclude:
2399
client_dict[attr] = getattr(client, attr)
2400
2401
clients[client.name] = client_dict
2402
del client_settings[client.name]["secret"]
2403
2404
try:
2405
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2406
prefix="clients-",
2407
dir=os.path.dirname
2408
(stored_state_path))
2409
with os.fdopen(tempfd, "wb") as stored_state:
2410
pickle.dump((clients, client_settings), stored_state)
2411
os.rename(tempname, stored_state_path)
2412
except (IOError, OSError) as e:
2413
logger.warning("Could not save persistent state: {0}"
2414
.format(e))
2415
if not debug:
2416
try:
2417
os.remove(tempname)
2418
except NameError:
2419
pass
2420
if e.errno not in set((errno.ENOENT, errno.EACCES,
2421
errno.EEXIST)):
2422
raise e
2423
2424
# Delete all clients, and settings from config
2425
2013
while tcp_server.clients:
2426
name, client = tcp_server.clients.popitem()
2014
client = tcp_server.clients.pop()
2427
2015
if use_dbus:
2428
2016
client.remove_from_connection()
2017
client.disable_hook = None
2429
2018
# Don't signal anything except ClientRemoved
2430
2019
client.disable(quiet=True)
2431
2020
if use_dbus:
2432
2021
# Emit D-Bus signal
2433
mandos_dbus_service.ClientRemoved(client
2434
.dbus_object_path,
2022
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2435
2023
client.name)
2436
client_settings.clear()
2437
2024
2438
2025
atexit.register(cleanup)
2439
2026
2440
for client in tcp_server.clients.itervalues():
2027
for client in tcp_server.clients:
2441
2028
if use_dbus:
2442
2029
# Emit D-Bus signal
2443
2030
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2444
# Need to initiate checking of clients
2445
if client.enabled:
2446
client.init_checker()
2031
client.enable()
2447
2032
2448
2033
tcp_server.enable()
2449
2034
tcp_server.server_activate()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0