To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 493
- compare with another revision
- download diff
- download tarball
- view history from revision 493
- Committer: Teddy Hogeborn
- Date: 2011-08-08 21:12:37 UTC
- Revision ID: teddy@fukt.bsnet.se-20110808211237-jejsz5brjytrjot8
* Makefile (DOCS): Added "intro.8mandos".
(intro.8mandos, intro.8mandos.xhtml): New.
* README: Replaced text with link, reference and short summary.
* intro.xml: New.
* mandos-clients.conf.xml (SEE ALSO): Added "intro(8mandos)".
* mandos-ctl.xml (SEE ALSO): - '' -
* mandos-keygen.xml (SEE ALSO): - '' -
* mandos-monitor.xml (SEE ALSO): - '' -
* mandos.conf.xml (SEE ALSO): - '' -
* mandos.xml (SEE ALSO): - '' -
* plugin-runner.xml (SEE ALSO): - '' -
* plugins.d/askpass-fifo.xml (SEE ALSO): - '' -
* plugins.d/mandos-client.xml (SEE ALSO): - '' -
* plugins.d/password-prompt.xml (SEE ALSO): - '' -
* plugins.d/plymouth.xml (SEE ALSO): - '' -
* plugins.d/splashy.xml (SEE ALSO): - '' -
* plugins.d/usplash.xml (SEE ALSO): - '' -
(intro.8mandos, intro.8mandos.xhtml): New.
* README: Replaced text with link, reference and short summary.
* intro.xml: New.
* mandos-clients.conf.xml (SEE ALSO): Added "intro(8mandos)".
* mandos-ctl.xml (SEE ALSO): - '' -
* mandos-keygen.xml (SEE ALSO): - '' -
* mandos-monitor.xml (SEE ALSO): - '' -
* mandos.conf.xml (SEE ALSO): - '' -
* mandos.xml (SEE ALSO): - '' -
* plugin-runner.xml (SEE ALSO): - '' -
* plugins.d/askpass-fifo.xml (SEE ALSO): - '' -
* plugins.d/mandos-client.xml (SEE ALSO): - '' -
* plugins.d/password-prompt.xml (SEE ALSO): - '' -
* plugins.d/plymouth.xml (SEE ALSO): - '' -
* plugins.d/splashy.xml (SEE ALSO): - '' -
* plugins.d/usplash.xml (SEE ALSO): - '' -
- files removed:
- debian/source/local-options
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
37
import SocketServer as socketserver
40
38
import socket
41
39
import argparse
64
62
import functools
65
63
import cPickle as pickle
66
64
import multiprocessing
67
import types
68
import binascii
69
import tempfile
70
import itertools
71
65
72
66
import dbus
73
67
import dbus.service
78
72
import ctypes.util
79
73
import xml.dom.minidom
80
74
import inspect
81
import GnuPGInterface
82
75
83
76
try:
84
77
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
81
except ImportError:
89
82
SO_BINDTODEVICE = None
90
83
91
version = "1.5.3"
92
stored_state_file = "clients.pickle"
93
94
logger = logging.getLogger()
84
85
version = "1.3.1"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
95
89
syslogger = (logging.handlers.SysLogHandler
96
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
91
address = str("/dev/log")))
98
99
try:
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
103
except (OSError, AttributeError):
104
def if_nametoindex(interface):
105
"Get an interface index the hard way, i.e. using fcntl()"
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
with contextlib.closing(socket.socket()) as s:
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
113
return interface_index
114
115
116
def initlogger(debug, level=logging.WARNING):
117
"""init logger and add loglevel"""
118
119
syslogger.setFormatter(logging.Formatter
120
('Mandos [%(process)d]: %(levelname)s:'
121
' %(message)s'))
122
logger.addHandler(syslogger)
123
124
if debug:
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
' [%(process)d]:'
128
' %(levelname)s:'
129
' %(message)s'))
130
logger.addHandler(console)
131
logger.setLevel(level)
132
133
134
class PGPError(Exception):
135
"""Exception if encryption/decryption fails"""
136
pass
137
138
139
class PGPEngine(object):
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
141
def __init__(self):
142
self.gnupg = GnuPGInterface.GnuPG()
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
148
'--quiet',
149
'--no-use-agent'])
150
151
def __enter__(self):
152
return self
153
154
def __exit__ (self, exc_type, exc_value, traceback):
155
self._cleanup()
156
return False
157
158
def __del__(self):
159
self._cleanup()
160
161
def _cleanup(self):
162
if self.tempdir is not None:
163
# Delete contents of tempdir
164
for root, dirs, files in os.walk(self.tempdir,
165
topdown = False):
166
for filename in files:
167
os.remove(os.path.join(root, filename))
168
for dirname in dirs:
169
os.rmdir(os.path.join(root, dirname))
170
# Remove tempdir
171
os.rmdir(self.tempdir)
172
self.tempdir = None
173
174
def password_encode(self, password):
175
# Passphrase can not be empty and can not contain newlines or
176
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
178
179
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
182
try:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
187
f.write(data)
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
190
proc.wait()
191
except IOError as e:
192
raise PGPError(e)
193
self.gnupg.passphrase = None
194
return ciphertext
195
196
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
199
try:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
204
f.write(data)
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
207
proc.wait()
208
except IOError as e:
209
raise PGPError(e)
210
self.gnupg.passphrase = None
211
return decrypted_plaintext
212
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
95
logger.addHandler(syslogger)
96
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
101
logger.addHandler(console)
213
102
214
103
class AvahiError(Exception):
215
104
def __init__(self, value, *args, **kwargs):
245
134
server: D-Bus Server
246
135
bus: dbus.SystemBus()
247
136
"""
248
249
137
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
138
servicetype = None, port = None, TXT = None,
251
139
domain = "", host = "", max_renames = 32768,
264
152
self.server = None
265
153
self.bus = bus
266
154
self.entry_group_state_changed_match = None
267
268
155
def rename(self):
269
156
"""Derived from the Avahi example code"""
270
157
if self.rename_count >= self.max_renames:
272
159
" after %i retries, exiting.",
273
160
self.rename_count)
274
161
raise AvahiServiceError("Too many renames")
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
277
163
logger.info("Changing Zeroconf service name to %r ...",
278
164
self.name)
165
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
168
% self.name))
279
169
self.remove()
280
170
try:
281
171
self.add()
282
172
except dbus.exceptions.DBusException as error:
283
logger.critical("D-Bus Exception", exc_info=error)
173
logger.critical("DBusException: %s", error)
284
174
self.cleanup()
285
175
os._exit(1)
286
176
self.rename_count += 1
287
288
177
def remove(self):
289
178
"""Derived from the Avahi example code"""
290
179
if self.entry_group_state_changed_match is not None:
292
181
self.entry_group_state_changed_match = None
293
182
if self.group is not None:
294
183
self.group.Reset()
295
296
184
def add(self):
297
185
"""Derived from the Avahi example code"""
298
186
self.remove()
303
191
avahi.DBUS_INTERFACE_ENTRY_GROUP)
304
192
self.entry_group_state_changed_match = (
305
193
self.group.connect_to_signal(
306
'StateChanged', self.entry_group_state_changed))
194
'StateChanged', self .entry_group_state_changed))
307
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
308
196
self.name, self.type)
309
197
self.group.AddService(
315
203
dbus.UInt16(self.port),
316
204
avahi.string_array_to_txt_array(self.TXT))
317
205
self.group.Commit()
318
319
206
def entry_group_state_changed(self, state, error):
320
207
"""Derived from the Avahi example code"""
321
208
logger.debug("Avahi entry group state change: %i", state)
328
215
elif state == avahi.ENTRY_GROUP_FAILURE:
329
216
logger.critical("Avahi: Error in group state changed %s",
330
217
unicode(error))
331
raise AvahiGroupError("State changed: {0!s}"
332
.format(error))
333
218
raise AvahiGroupError("State changed: %s"
219
% unicode(error))
334
220
def cleanup(self):
335
221
"""Derived from the Avahi example code"""
336
222
if self.group is not None:
337
223
try:
338
224
self.group.Free()
339
225
except (dbus.exceptions.UnknownMethodException,
340
dbus.exceptions.DBusException):
226
dbus.exceptions.DBusException) as e:
341
227
pass
342
228
self.group = None
343
229
self.remove()
344
345
230
def server_state_changed(self, state, error=None):
346
231
"""Derived from the Avahi example code"""
347
232
logger.debug("Avahi server state change: %i", state)
366
251
logger.debug("Unknown state: %r", state)
367
252
else:
368
253
logger.debug("Unknown state: %r: %r", state, error)
369
370
254
def activate(self):
371
255
"""Derived from the Avahi example code"""
372
256
if self.server is None:
379
263
self.server_state_changed)
380
264
self.server_state_changed(self.server.GetState())
381
265
382
class AvahiServiceToSyslog(AvahiService):
383
def rename(self):
384
"""Add the new name to the syslog messages"""
385
ret = AvahiService.rename(self)
386
syslogger.setFormatter(logging.Formatter
387
('Mandos ({0}) [%(process)d]:'
388
' %(levelname)s: %(message)s'
389
.format(self.name)))
390
return ret
391
392
def timedelta_to_milliseconds(td):
393
"Convert a datetime.timedelta() to milliseconds"
394
return ((td.days * 24 * 60 * 60 * 1000)
395
+ (td.seconds * 1000)
396
+ (td.microseconds // 1000))
397
266
398
267
class Client(object):
399
268
"""A representation of a client host served by this server.
400
269
401
270
Attributes:
402
approved: bool(); 'None' if not yet approved/disapproved
271
_approved: bool(); 'None' if not yet approved/disapproved
403
272
approval_delay: datetime.timedelta(); Time to wait for approval
404
273
approval_duration: datetime.timedelta(); Duration of one approval
405
274
checker: subprocess.Popen(); a running checker process used
412
281
instance %(name)s can be used in the command.
413
282
checker_initiator_tag: a gobject event source tag, or None
414
283
created: datetime.datetime(); (UTC) object creation
415
client_structure: Object describing what attributes a client has
416
and is used for storing the client at exit
417
284
current_checker_command: string; current running checker_command
285
disable_hook: If set, called by disable() as disable_hook(self)
418
286
disable_initiator_tag: a gobject event source tag, or None
419
287
enabled: bool()
420
288
fingerprint: string (40 or 32 hexadecimal digits); used to
423
291
interval: datetime.timedelta(); How often to start a new checker
424
292
last_approval_request: datetime.datetime(); (UTC) or None
425
293
last_checked_ok: datetime.datetime(); (UTC) or None
426
last_checker_status: integer between 0 and 255 reflecting exit
427
status of last checker. -1 reflects crashed
428
checker, -2 means no checker completed yet.
429
last_enabled: datetime.datetime(); (UTC) or None
294
last_enabled: datetime.datetime(); (UTC)
430
295
name: string; from the config file, used in log messages and
431
296
D-Bus identifiers
432
297
secret: bytestring; sent verbatim (over TLS) to client
433
298
timeout: datetime.timedelta(); How long from last_checked_ok
434
299
until this client is disabled
435
extended_timeout: extra long timeout when secret has been sent
436
300
runtime_expansions: Allowed attributes for runtime expansion.
437
expires: datetime.datetime(); time (UTC) when a client will be
438
disabled, or None
439
301
"""
440
302
441
303
runtime_expansions = ("approval_delay", "approval_duration",
442
304
"created", "enabled", "fingerprint",
443
305
"host", "interval", "last_checked_ok",
444
306
"last_enabled", "name", "timeout")
445
client_defaults = { "timeout": "5m",
446
"extended_timeout": "15m",
447
"interval": "2m",
448
"checker": "fping -q -- %%(host)s",
449
"host": "",
450
"approval_delay": "0s",
451
"approval_duration": "1s",
452
"approved_by_default": "True",
453
"enabled": "True",
454
}
307
308
@staticmethod
309
def _timedelta_to_milliseconds(td):
310
"Convert a datetime.timedelta() to milliseconds"
311
return ((td.days * 24 * 60 * 60 * 1000)
312
+ (td.seconds * 1000)
313
+ (td.microseconds // 1000))
455
314
456
315
def timeout_milliseconds(self):
457
316
"Return the 'timeout' attribute in milliseconds"
458
return timedelta_to_milliseconds(self.timeout)
459
460
def extended_timeout_milliseconds(self):
461
"Return the 'extended_timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.extended_timeout)
317
return self._timedelta_to_milliseconds(self.timeout)
463
318
464
319
def interval_milliseconds(self):
465
320
"Return the 'interval' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.interval)
467
321
return self._timedelta_to_milliseconds(self.interval)
322
468
323
def approval_delay_milliseconds(self):
469
return timedelta_to_milliseconds(self.approval_delay)
470
471
@staticmethod
472
def config_parser(config):
473
"""Construct a new dict of client settings of this form:
474
{ client_name: {setting_name: value, ...}, ...}
475
with exceptions for any special settings as defined above.
476
NOTE: Must be a pure function. Must return the same result
477
value given the same arguments.
478
"""
479
settings = {}
480
for client_name in config.sections():
481
section = dict(config.items(client_name))
482
client = settings[client_name] = {}
483
484
client["host"] = section["host"]
485
# Reformat values from string types to Python types
486
client["approved_by_default"] = config.getboolean(
487
client_name, "approved_by_default")
488
client["enabled"] = config.getboolean(client_name,
489
"enabled")
490
491
client["fingerprint"] = (section["fingerprint"].upper()
492
.replace(" ", ""))
493
if "secret" in section:
494
client["secret"] = section["secret"].decode("base64")
495
elif "secfile" in section:
496
with open(os.path.expanduser(os.path.expandvars
497
(section["secfile"])),
498
"rb") as secfile:
499
client["secret"] = secfile.read()
500
else:
501
raise TypeError("No secret or secfile for section {0}"
502
.format(section))
503
client["timeout"] = string_to_delta(section["timeout"])
504
client["extended_timeout"] = string_to_delta(
505
section["extended_timeout"])
506
client["interval"] = string_to_delta(section["interval"])
507
client["approval_delay"] = string_to_delta(
508
section["approval_delay"])
509
client["approval_duration"] = string_to_delta(
510
section["approval_duration"])
511
client["checker_command"] = section["checker"]
512
client["last_approval_request"] = None
513
client["last_checked_ok"] = None
514
client["last_checker_status"] = -2
515
516
return settings
517
518
def __init__(self, settings, name = None):
324
return self._timedelta_to_milliseconds(self.approval_delay)
325
326
def __init__(self, name = None, disable_hook=None, config=None):
327
"""Note: the 'checker' key in 'config' sets the
328
'checker_command' attribute and *not* the 'checker'
329
attribute."""
519
330
self.name = name
520
# adding all client settings
521
for setting, value in settings.iteritems():
522
setattr(self, setting, value)
523
524
if self.enabled:
525
if not hasattr(self, "last_enabled"):
526
self.last_enabled = datetime.datetime.utcnow()
527
if not hasattr(self, "expires"):
528
self.expires = (datetime.datetime.utcnow()
529
+ self.timeout)
530
else:
531
self.last_enabled = None
532
self.expires = None
533
331
if config is None:
332
config = {}
534
333
logger.debug("Creating client %r", self.name)
535
334
# Uppercase and remove spaces from fingerprint for later
536
335
# comparison purposes with return value from the fingerprint()
537
336
# function
337
self.fingerprint = (config["fingerprint"].upper()
338
.replace(" ", ""))
538
339
logger.debug(" Fingerprint: %s", self.fingerprint)
539
self.created = settings.get("created",
540
datetime.datetime.utcnow())
541
542
# attributes specific for this server instance
340
if "secret" in config:
341
self.secret = config["secret"].decode("base64")
342
elif "secfile" in config:
343
with open(os.path.expanduser(os.path.expandvars
344
(config["secfile"])),
345
"rb") as secfile:
346
self.secret = secfile.read()
347
else:
348
raise TypeError("No secret or secfile for client %s"
349
% self.name)
350
self.host = config.get("host", "")
351
self.created = datetime.datetime.utcnow()
352
self.enabled = False
353
self.last_approval_request = None
354
self.last_enabled = None
355
self.last_checked_ok = None
356
self.timeout = string_to_delta(config["timeout"])
357
self.interval = string_to_delta(config["interval"])
358
self.disable_hook = disable_hook
543
359
self.checker = None
544
360
self.checker_initiator_tag = None
545
361
self.disable_initiator_tag = None
546
362
self.checker_callback_tag = None
363
self.checker_command = config["checker"]
547
364
self.current_checker_command = None
548
self.approved = None
365
self.last_connect = None
366
self._approved = None
367
self.approved_by_default = config.get("approved_by_default",
368
True)
549
369
self.approvals_pending = 0
550
self.changedstate = (multiprocessing_manager
551
.Condition(multiprocessing_manager
552
.Lock()))
553
self.client_structure = [attr for attr in
554
self.__dict__.iterkeys()
555
if not attr.startswith("_")]
556
self.client_structure.append("client_structure")
557
558
for name, t in inspect.getmembers(type(self),
559
lambda obj:
560
isinstance(obj,
561
property)):
562
if not name.startswith("_"):
563
self.client_structure.append(name)
370
self.approval_delay = string_to_delta(
371
config["approval_delay"])
372
self.approval_duration = string_to_delta(
373
config["approval_duration"])
374
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
564
375
565
# Send notice to process children that client state has changed
566
376
def send_changedstate(self):
567
with self.changedstate:
568
self.changedstate.notify_all()
569
377
self.changedstate.acquire()
378
self.changedstate.notify_all()
379
self.changedstate.release()
380
570
381
def enable(self):
571
382
"""Start this client's checker and timeout hooks"""
572
383
if getattr(self, "enabled", False):
573
384
# Already enabled
574
385
return
575
386
self.send_changedstate()
576
self.expires = datetime.datetime.utcnow() + self.timeout
577
self.enabled = True
578
387
self.last_enabled = datetime.datetime.utcnow()
579
self.init_checker()
388
# Schedule a new checker to be started an 'interval' from now,
389
# and every interval from then on.
390
self.checker_initiator_tag = (gobject.timeout_add
391
(self.interval_milliseconds(),
392
self.start_checker))
393
# Schedule a disable() when 'timeout' has passed
394
self.disable_initiator_tag = (gobject.timeout_add
395
(self.timeout_milliseconds(),
396
self.disable))
397
self.enabled = True
398
# Also start a new checker *right now*.
399
self.start_checker()
580
400
581
401
def disable(self, quiet=True):
582
402
"""Disable this client."""
589
409
if getattr(self, "disable_initiator_tag", False):
590
410
gobject.source_remove(self.disable_initiator_tag)
591
411
self.disable_initiator_tag = None
592
self.expires = None
593
412
if getattr(self, "checker_initiator_tag", False):
594
413
gobject.source_remove(self.checker_initiator_tag)
595
414
self.checker_initiator_tag = None
596
415
self.stop_checker()
416
if self.disable_hook:
417
self.disable_hook(self)
597
418
self.enabled = False
598
419
# Do not run this again if called by a gobject.timeout_add
599
420
return False
600
421
601
422
def __del__(self):
423
self.disable_hook = None
602
424
self.disable()
603
425
604
def init_checker(self):
605
# Schedule a new checker to be started an 'interval' from now,
606
# and every interval from then on.
607
self.checker_initiator_tag = (gobject.timeout_add
608
(self.interval_milliseconds(),
609
self.start_checker))
610
# Schedule a disable() when 'timeout' has passed
611
self.disable_initiator_tag = (gobject.timeout_add
612
(self.timeout_milliseconds(),
613
self.disable))
614
# Also start a new checker *right now*.
615
self.start_checker()
616
617
426
def checker_callback(self, pid, condition, command):
618
427
"""The checker has completed, so take appropriate actions."""
619
428
self.checker_callback_tag = None
620
429
self.checker = None
621
430
if os.WIFEXITED(condition):
622
self.last_checker_status = os.WEXITSTATUS(condition)
623
if self.last_checker_status == 0:
431
exitstatus = os.WEXITSTATUS(condition)
432
if exitstatus == 0:
624
433
logger.info("Checker for %(name)s succeeded",
625
434
vars(self))
626
435
self.checked_ok()
628
437
logger.info("Checker for %(name)s failed",
629
438
vars(self))
630
439
else:
631
self.last_checker_status = -1
632
440
logger.warning("Checker for %(name)s crashed?",
633
441
vars(self))
634
442
635
443
def checked_ok(self):
636
"""Assert that the client has been seen, alive and well."""
444
"""Bump up the timeout for this client.
445
446
This should only be called when the client has been seen,
447
alive and well.
448
"""
637
449
self.last_checked_ok = datetime.datetime.utcnow()
638
self.last_checker_status = 0
639
self.bump_timeout()
640
641
def bump_timeout(self, timeout=None):
642
"""Bump up the timeout for this client."""
643
if timeout is None:
644
timeout = self.timeout
645
if self.disable_initiator_tag is not None:
646
gobject.source_remove(self.disable_initiator_tag)
647
if getattr(self, "enabled", False):
648
self.disable_initiator_tag = (gobject.timeout_add
649
(timedelta_to_milliseconds
650
(timeout), self.disable))
651
self.expires = datetime.datetime.utcnow() + timeout
450
gobject.source_remove(self.disable_initiator_tag)
451
self.disable_initiator_tag = (gobject.timeout_add
452
(self.timeout_milliseconds(),
453
self.disable))
652
454
653
455
def need_approval(self):
654
456
self.last_approval_request = datetime.datetime.utcnow()
659
461
If a checker already exists, leave it running and do
660
462
nothing."""
661
463
# The reason for not killing a running checker is that if we
662
# did that, and if a checker (for some reason) started running
663
# slowly and taking more than 'interval' time, then the client
664
# would inevitably timeout, since no checker would get a
665
# chance to run to completion. If we instead leave running
464
# did that, then if a checker (for some reason) started
465
# running slowly and taking more than 'interval' time, the
466
# client would inevitably timeout, since no checker would get
467
# a chance to run to completion. If we instead leave running
666
468
# checkers alone, the checker would have to take more time
667
469
# than 'timeout' for the client to be disabled, which is as it
668
470
# should be.
694
496
'replace')))
695
497
for attr in
696
498
self.runtime_expansions)
697
499
698
500
try:
699
501
command = self.checker_command % escaped_attrs
700
502
except TypeError as error:
701
logger.error('Could not format string "%s"',
702
self.checker_command, exc_info=error)
503
logger.error('Could not format string "%s":'
504
' %s', self.checker_command, error)
703
505
return True # Try again later
704
506
self.current_checker_command = command
705
507
try:
723
525
gobject.source_remove(self.checker_callback_tag)
724
526
self.checker_callback(pid, status, command)
725
527
except OSError as error:
726
logger.error("Failed to start subprocess",
727
exc_info=error)
528
logger.error("Failed to start subprocess: %s",
529
error)
728
530
# Re-run this periodically if run by gobject.timeout_add
729
531
return True
730
532
737
539
return
738
540
logger.debug("Stopping checker for %(name)s", vars(self))
739
541
try:
740
self.checker.terminate()
542
os.kill(self.checker.pid, signal.SIGTERM)
741
543
#time.sleep(0.5)
742
544
#if self.checker.poll() is None:
743
# self.checker.kill()
545
# os.kill(self.checker.pid, signal.SIGKILL)
744
546
except OSError as error:
745
547
if error.errno != errno.ESRCH: # No such process
746
548
raise
747
549
self.checker = None
748
550
749
750
551
def dbus_service_property(dbus_interface, signature="v",
751
552
access="readwrite", byte_arrays=False):
752
553
"""Decorators for marking methods of a DBusObjectWithProperties to
763
564
# "Set" method, so we fail early here:
764
565
if byte_arrays and signature != "ay":
765
566
raise ValueError("Byte arrays not supported for non-'ay'"
766
" signature {0!r}".format(signature))
567
" signature %r" % signature)
767
568
def decorator(func):
768
569
func._dbus_is_property = True
769
570
func._dbus_interface = dbus_interface
777
578
return decorator
778
579
779
580
780
def dbus_interface_annotations(dbus_interface):
781
"""Decorator for marking functions returning interface annotations
782
783
Usage:
784
785
@dbus_interface_annotations("org.example.Interface")
786
def _foo(self): # Function name does not matter
787
return {"org.freedesktop.DBus.Deprecated": "true",
788
"org.freedesktop.DBus.Property.EmitsChangedSignal":
789
"false"}
790
"""
791
def decorator(func):
792
func._dbus_is_interface = True
793
func._dbus_interface = dbus_interface
794
func._dbus_name = dbus_interface
795
return func
796
return decorator
797
798
799
def dbus_annotations(annotations):
800
"""Decorator to annotate D-Bus methods, signals or properties
801
Usage:
802
803
@dbus_service_property("org.example.Interface", signature="b",
804
access="r")
805
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
806
"org.freedesktop.DBus.Property."
807
"EmitsChangedSignal": "false"})
808
def Property_dbus_property(self):
809
return dbus.Boolean(False)
810
"""
811
def decorator(func):
812
func._dbus_annotations = annotations
813
return func
814
return decorator
815
816
817
581
class DBusPropertyException(dbus.exceptions.DBusException):
818
582
"""A base class for D-Bus property-related exceptions
819
583
"""
835
599
836
600
class DBusObjectWithProperties(dbus.service.Object):
837
601
"""A D-Bus object with properties.
838
602
839
603
Classes inheriting from this can use the dbus_service_property
840
604
decorator to expose methods as D-Bus properties. It exposes the
841
605
standard Get(), Set(), and GetAll() methods on the D-Bus.
842
606
"""
843
607
844
608
@staticmethod
845
def _is_dbus_thing(thing):
846
"""Returns a function testing if an attribute is a D-Bus thing
847
848
If called like _is_dbus_thing("method") it returns a function
849
suitable for use as predicate to inspect.getmembers().
850
"""
851
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
852
False)
609
def _is_dbus_property(obj):
610
return getattr(obj, "_dbus_is_property", False)
853
611
854
def _get_all_dbus_things(self, thing):
612
def _get_all_dbus_properties(self):
855
613
"""Returns a generator of (name, attribute) pairs
856
614
"""
857
return ((getattr(athing.__get__(self), "_dbus_name",
858
name),
859
athing.__get__(self))
860
for cls in self.__class__.__mro__
861
for name, athing in
862
inspect.getmembers(cls,
863
self._is_dbus_thing(thing)))
615
return ((prop._dbus_name, prop)
616
for name, prop in
617
inspect.getmembers(self, self._is_dbus_property))
864
618
865
619
def _get_dbus_property(self, interface_name, property_name):
866
620
"""Returns a bound method if one exists which is a D-Bus
867
621
property with the specified name and interface.
868
622
"""
869
for cls in self.__class__.__mro__:
870
for name, value in (inspect.getmembers
871
(cls,
872
self._is_dbus_thing("property"))):
873
if (value._dbus_name == property_name
874
and value._dbus_interface == interface_name):
875
return value.__get__(self)
876
623
for name in (property_name,
624
property_name + "_dbus_property"):
625
prop = getattr(self, name, None)
626
if (prop is None
627
or not self._is_dbus_property(prop)
628
or prop._dbus_name != property_name
629
or (interface_name and prop._dbus_interface
630
and interface_name != prop._dbus_interface)):
631
continue
632
return prop
877
633
# No such property
878
634
raise DBusPropertyNotFound(self.dbus_object_path + ":"
879
635
+ interface_name + "."
904
660
# signatures other than "ay".
905
661
if prop._dbus_signature != "ay":
906
662
raise ValueError
907
value = dbus.ByteArray(b''.join(chr(byte)
908
for byte in value))
663
value = dbus.ByteArray(''.join(unichr(byte)
664
for byte in value))
909
665
prop(value)
910
666
911
667
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
913
669
def GetAll(self, interface_name):
914
670
"""Standard D-Bus property GetAll() method, see D-Bus
915
671
standard.
916
672
917
673
Note: Will not include properties with access="write".
918
674
"""
919
properties = {}
920
for name, prop in self._get_all_dbus_things("property"):
675
all = {}
676
for name, prop in self._get_all_dbus_properties():
921
677
if (interface_name
922
678
and interface_name != prop._dbus_interface):
923
679
# Interface non-empty but did not match
927
683
continue
928
684
value = prop()
929
685
if not hasattr(value, "variant_level"):
930
properties[name] = value
686
all[name] = value
931
687
continue
932
properties[name] = type(value)(value, variant_level=
933
value.variant_level+1)
934
return dbus.Dictionary(properties, signature="sv")
688
all[name] = type(value)(value, variant_level=
689
value.variant_level+1)
690
return dbus.Dictionary(all, signature="sv")
935
691
936
692
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
937
693
out_signature="s",
938
694
path_keyword='object_path',
939
695
connection_keyword='connection')
940
696
def Introspect(self, object_path, connection):
941
"""Overloading of standard D-Bus method.
942
943
Inserts property tags and interface annotation tags.
697
"""Standard D-Bus method, overloaded to insert property tags.
944
698
"""
945
699
xmlstring = dbus.service.Object.Introspect(self, object_path,
946
700
connection)
953
707
e.setAttribute("access", prop._dbus_access)
954
708
return e
955
709
for if_tag in document.getElementsByTagName("interface"):
956
# Add property tags
957
710
for tag in (make_tag(document, name, prop)
958
711
for name, prop
959
in self._get_all_dbus_things("property")
712
in self._get_all_dbus_properties()
960
713
if prop._dbus_interface
961
714
== if_tag.getAttribute("name")):
962
715
if_tag.appendChild(tag)
963
# Add annotation tags
964
for typ in ("method", "signal", "property"):
965
for tag in if_tag.getElementsByTagName(typ):
966
annots = dict()
967
for name, prop in (self.
968
_get_all_dbus_things(typ)):
969
if (name == tag.getAttribute("name")
970
and prop._dbus_interface
971
== if_tag.getAttribute("name")):
972
annots.update(getattr
973
(prop,
974
"_dbus_annotations",
975
{}))
976
for name, value in annots.iteritems():
977
ann_tag = document.createElement(
978
"annotation")
979
ann_tag.setAttribute("name", name)
980
ann_tag.setAttribute("value", value)
981
tag.appendChild(ann_tag)
982
# Add interface annotation tags
983
for annotation, value in dict(
984
itertools.chain.from_iterable(
985
annotations().iteritems()
986
for name, annotations in
987
self._get_all_dbus_things("interface")
988
if name == if_tag.getAttribute("name")
989
)).iteritems():
990
ann_tag = document.createElement("annotation")
991
ann_tag.setAttribute("name", annotation)
992
ann_tag.setAttribute("value", value)
993
if_tag.appendChild(ann_tag)
994
716
# Add the names to the return values for the
995
717
# "org.freedesktop.DBus.Properties" methods
996
718
if (if_tag.getAttribute("name")
1011
733
except (AttributeError, xml.dom.DOMException,
1012
734
xml.parsers.expat.ExpatError) as error:
1013
735
logger.error("Failed to override Introspection method",
1014
exc_info=error)
736
error)
1015
737
return xmlstring
1016
738
1017
739
1018
def datetime_to_dbus (dt, variant_level=0):
1019
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1020
if dt is None:
1021
return dbus.String("", variant_level = variant_level)
1022
return dbus.String(dt.isoformat(),
1023
variant_level=variant_level)
1024
1025
1026
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1027
"""A class decorator; applied to a subclass of
1028
dbus.service.Object, it will add alternate D-Bus attributes with
1029
interface names according to the "alt_interface_names" mapping.
1030
Usage:
1031
1032
@alternate_dbus_names({"org.example.Interface":
1033
"net.example.AlternateInterface"})
1034
class SampleDBusObject(dbus.service.Object):
1035
@dbus.service.method("org.example.Interface")
1036
def SampleDBusMethod():
1037
pass
1038
1039
The above "SampleDBusMethod" on "SampleDBusObject" will be
1040
reachable via two interfaces: "org.example.Interface" and
1041
"net.example.AlternateInterface", the latter of which will have
1042
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1043
"true", unless "deprecate" is passed with a False value.
1044
1045
This works for methods and signals, and also for D-Bus properties
1046
(from DBusObjectWithProperties) and interfaces (from the
1047
dbus_interface_annotations decorator).
1048
"""
1049
def wrapper(cls):
1050
for orig_interface_name, alt_interface_name in (
1051
alt_interface_names.iteritems()):
1052
attr = {}
1053
interface_names = set()
1054
# Go though all attributes of the class
1055
for attrname, attribute in inspect.getmembers(cls):
1056
# Ignore non-D-Bus attributes, and D-Bus attributes
1057
# with the wrong interface name
1058
if (not hasattr(attribute, "_dbus_interface")
1059
or not attribute._dbus_interface
1060
.startswith(orig_interface_name)):
1061
continue
1062
# Create an alternate D-Bus interface name based on
1063
# the current name
1064
alt_interface = (attribute._dbus_interface
1065
.replace(orig_interface_name,
1066
alt_interface_name))
1067
interface_names.add(alt_interface)
1068
# Is this a D-Bus signal?
1069
if getattr(attribute, "_dbus_is_signal", False):
1070
# Extract the original non-method function by
1071
# black magic
1072
nonmethod_func = (dict(
1073
zip(attribute.func_code.co_freevars,
1074
attribute.__closure__))["func"]
1075
.cell_contents)
1076
# Create a new, but exactly alike, function
1077
# object, and decorate it to be a new D-Bus signal
1078
# with the alternate D-Bus interface name
1079
new_function = (dbus.service.signal
1080
(alt_interface,
1081
attribute._dbus_signature)
1082
(types.FunctionType(
1083
nonmethod_func.func_code,
1084
nonmethod_func.func_globals,
1085
nonmethod_func.func_name,
1086
nonmethod_func.func_defaults,
1087
nonmethod_func.func_closure)))
1088
# Copy annotations, if any
1089
try:
1090
new_function._dbus_annotations = (
1091
dict(attribute._dbus_annotations))
1092
except AttributeError:
1093
pass
1094
# Define a creator of a function to call both the
1095
# original and alternate functions, so both the
1096
# original and alternate signals gets sent when
1097
# the function is called
1098
def fixscope(func1, func2):
1099
"""This function is a scope container to pass
1100
func1 and func2 to the "call_both" function
1101
outside of its arguments"""
1102
def call_both(*args, **kwargs):
1103
"""This function will emit two D-Bus
1104
signals by calling func1 and func2"""
1105
func1(*args, **kwargs)
1106
func2(*args, **kwargs)
1107
return call_both
1108
# Create the "call_both" function and add it to
1109
# the class
1110
attr[attrname] = fixscope(attribute, new_function)
1111
# Is this a D-Bus method?
1112
elif getattr(attribute, "_dbus_is_method", False):
1113
# Create a new, but exactly alike, function
1114
# object. Decorate it to be a new D-Bus method
1115
# with the alternate D-Bus interface name. Add it
1116
# to the class.
1117
attr[attrname] = (dbus.service.method
1118
(alt_interface,
1119
attribute._dbus_in_signature,
1120
attribute._dbus_out_signature)
1121
(types.FunctionType
1122
(attribute.func_code,
1123
attribute.func_globals,
1124
attribute.func_name,
1125
attribute.func_defaults,
1126
attribute.func_closure)))
1127
# Copy annotations, if any
1128
try:
1129
attr[attrname]._dbus_annotations = (
1130
dict(attribute._dbus_annotations))
1131
except AttributeError:
1132
pass
1133
# Is this a D-Bus property?
1134
elif getattr(attribute, "_dbus_is_property", False):
1135
# Create a new, but exactly alike, function
1136
# object, and decorate it to be a new D-Bus
1137
# property with the alternate D-Bus interface
1138
# name. Add it to the class.
1139
attr[attrname] = (dbus_service_property
1140
(alt_interface,
1141
attribute._dbus_signature,
1142
attribute._dbus_access,
1143
attribute
1144
._dbus_get_args_options
1145
["byte_arrays"])
1146
(types.FunctionType
1147
(attribute.func_code,
1148
attribute.func_globals,
1149
attribute.func_name,
1150
attribute.func_defaults,
1151
attribute.func_closure)))
1152
# Copy annotations, if any
1153
try:
1154
attr[attrname]._dbus_annotations = (
1155
dict(attribute._dbus_annotations))
1156
except AttributeError:
1157
pass
1158
# Is this a D-Bus interface?
1159
elif getattr(attribute, "_dbus_is_interface", False):
1160
# Create a new, but exactly alike, function
1161
# object. Decorate it to be a new D-Bus interface
1162
# with the alternate D-Bus interface name. Add it
1163
# to the class.
1164
attr[attrname] = (dbus_interface_annotations
1165
(alt_interface)
1166
(types.FunctionType
1167
(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1172
if deprecate:
1173
# Deprecate all alternate interfaces
1174
iname="_AlternateDBusNames_interface_annotation{0}"
1175
for interface_name in interface_names:
1176
@dbus_interface_annotations(interface_name)
1177
def func(self):
1178
return { "org.freedesktop.DBus.Deprecated":
1179
"true" }
1180
# Find an unused name
1181
for aname in (iname.format(i)
1182
for i in itertools.count()):
1183
if aname not in attr:
1184
attr[aname] = func
1185
break
1186
if interface_names:
1187
# Replace the class with a new subclass of it with
1188
# methods, signals, etc. as created above.
1189
cls = type(b"{0}Alternate".format(cls.__name__),
1190
(cls,), attr)
1191
return cls
1192
return wrapper
1193
1194
1195
@alternate_dbus_interfaces({"se.recompile.Mandos":
1196
"se.bsnet.fukt.Mandos"})
1197
740
class ClientDBus(Client, DBusObjectWithProperties):
1198
741
"""A Client class using D-Bus
1199
742
1208
751
# dbus.service.Object doesn't use super(), so we can't either.
1209
752
1210
753
def __init__(self, bus = None, *args, **kwargs):
754
self._approvals_pending = 0
1211
755
self.bus = bus
1212
756
Client.__init__(self, *args, **kwargs)
1213
757
# Only now, when this client is initialized, can it show up on
1219
763
("/clients/" + client_object_name))
1220
764
DBusObjectWithProperties.__init__(self, self.bus,
1221
765
self.dbus_object_path)
1222
1223
def notifychangeproperty(transform_func,
1224
dbus_name, type_func=lambda x: x,
1225
variant_level=1):
1226
""" Modify a variable so that it's a property which announces
1227
its changes to DBus.
1228
1229
transform_fun: Function that takes a value and a variant_level
1230
and transforms it to a D-Bus type.
1231
dbus_name: D-Bus name of the variable
1232
type_func: Function that transform the value before sending it
1233
to the D-Bus. Default: no transform
1234
variant_level: D-Bus variant level. Default: 1
1235
"""
1236
attrname = "_{0}".format(dbus_name)
1237
def setter(self, value):
1238
if hasattr(self, "dbus_object_path"):
1239
if (not hasattr(self, attrname) or
1240
type_func(getattr(self, attrname, None))
1241
!= type_func(value)):
1242
dbus_value = transform_func(type_func(value),
1243
variant_level
1244
=variant_level)
1245
self.PropertyChanged(dbus.String(dbus_name),
1246
dbus_value)
1247
setattr(self, attrname, value)
1248
1249
return property(lambda self: getattr(self, attrname), setter)
1250
1251
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1252
approvals_pending = notifychangeproperty(dbus.Boolean,
1253
"ApprovalPending",
1254
type_func = bool)
1255
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1256
last_enabled = notifychangeproperty(datetime_to_dbus,
1257
"LastEnabled")
1258
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1259
type_func = lambda checker:
1260
checker is not None)
1261
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1262
"LastCheckedOK")
1263
last_checker_status = notifychangeproperty(dbus.Int16,
1264
"LastCheckerStatus")
1265
last_approval_request = notifychangeproperty(
1266
datetime_to_dbus, "LastApprovalRequest")
1267
approved_by_default = notifychangeproperty(dbus.Boolean,
1268
"ApprovedByDefault")
1269
approval_delay = notifychangeproperty(dbus.UInt64,
1270
"ApprovalDelay",
1271
type_func =
1272
timedelta_to_milliseconds)
1273
approval_duration = notifychangeproperty(
1274
dbus.UInt64, "ApprovalDuration",
1275
type_func = timedelta_to_milliseconds)
1276
host = notifychangeproperty(dbus.String, "Host")
1277
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1278
type_func =
1279
timedelta_to_milliseconds)
1280
extended_timeout = notifychangeproperty(
1281
dbus.UInt64, "ExtendedTimeout",
1282
type_func = timedelta_to_milliseconds)
1283
interval = notifychangeproperty(dbus.UInt64,
1284
"Interval",
1285
type_func =
1286
timedelta_to_milliseconds)
1287
checker_command = notifychangeproperty(dbus.String, "Checker")
1288
1289
del notifychangeproperty
766
767
def _get_approvals_pending(self):
768
return self._approvals_pending
769
def _set_approvals_pending(self, value):
770
old_value = self._approvals_pending
771
self._approvals_pending = value
772
bval = bool(value)
773
if (hasattr(self, "dbus_object_path")
774
and bval is not bool(old_value)):
775
dbus_bool = dbus.Boolean(bval, variant_level=1)
776
self.PropertyChanged(dbus.String("ApprovalPending"),
777
dbus_bool)
778
779
approvals_pending = property(_get_approvals_pending,
780
_set_approvals_pending)
781
del _get_approvals_pending, _set_approvals_pending
782
783
@staticmethod
784
def _datetime_to_dbus(dt, variant_level=0):
785
"""Convert a UTC datetime.datetime() to a D-Bus type."""
786
return dbus.String(dt.isoformat(),
787
variant_level=variant_level)
788
789
def enable(self):
790
oldstate = getattr(self, "enabled", False)
791
r = Client.enable(self)
792
if oldstate != self.enabled:
793
# Emit D-Bus signals
794
self.PropertyChanged(dbus.String("Enabled"),
795
dbus.Boolean(True, variant_level=1))
796
self.PropertyChanged(
797
dbus.String("LastEnabled"),
798
self._datetime_to_dbus(self.last_enabled,
799
variant_level=1))
800
return r
801
802
def disable(self, quiet = False):
803
oldstate = getattr(self, "enabled", False)
804
r = Client.disable(self, quiet=quiet)
805
if not quiet and oldstate != self.enabled:
806
# Emit D-Bus signal
807
self.PropertyChanged(dbus.String("Enabled"),
808
dbus.Boolean(False, variant_level=1))
809
return r
1290
810
1291
811
def __del__(self, *args, **kwargs):
1292
812
try:
1301
821
*args, **kwargs):
1302
822
self.checker_callback_tag = None
1303
823
self.checker = None
824
# Emit D-Bus signal
825
self.PropertyChanged(dbus.String("CheckerRunning"),
826
dbus.Boolean(False, variant_level=1))
1304
827
if os.WIFEXITED(condition):
1305
828
exitstatus = os.WEXITSTATUS(condition)
1306
829
# Emit D-Bus signal
1316
839
return Client.checker_callback(self, pid, condition, command,
1317
840
*args, **kwargs)
1318
841
842
def checked_ok(self, *args, **kwargs):
843
Client.checked_ok(self, *args, **kwargs)
844
# Emit D-Bus signal
845
self.PropertyChanged(
846
dbus.String("LastCheckedOK"),
847
(self._datetime_to_dbus(self.last_checked_ok,
848
variant_level=1)))
849
850
def need_approval(self, *args, **kwargs):
851
r = Client.need_approval(self, *args, **kwargs)
852
# Emit D-Bus signal
853
self.PropertyChanged(
854
dbus.String("LastApprovalRequest"),
855
(self._datetime_to_dbus(self.last_approval_request,
856
variant_level=1)))
857
return r
858
1319
859
def start_checker(self, *args, **kwargs):
1320
860
old_checker = self.checker
1321
861
if self.checker is not None:
1328
868
and old_checker_pid != self.checker.pid):
1329
869
# Emit D-Bus signal
1330
870
self.CheckerStarted(self.current_checker_command)
871
self.PropertyChanged(
872
dbus.String("CheckerRunning"),
873
dbus.Boolean(True, variant_level=1))
1331
874
return r
1332
875
876
def stop_checker(self, *args, **kwargs):
877
old_checker = getattr(self, "checker", None)
878
r = Client.stop_checker(self, *args, **kwargs)
879
if (old_checker is not None
880
and getattr(self, "checker", None) is None):
881
self.PropertyChanged(dbus.String("CheckerRunning"),
882
dbus.Boolean(False, variant_level=1))
883
return r
884
1333
885
def _reset_approved(self):
1334
self.approved = None
886
self._approved = None
1335
887
return False
1336
888
1337
889
def approve(self, value=True):
1338
890
self.send_changedstate()
1339
self.approved = value
1340
gobject.timeout_add(timedelta_to_milliseconds
891
self._approved = value
892
gobject.timeout_add(self._timedelta_to_milliseconds
1341
893
(self.approval_duration),
1342
894
self._reset_approved)
1343
895
896
1344
897
## D-Bus methods, signals & properties
1345
_interface = "se.recompile.Mandos.Client"
1346
1347
## Interfaces
1348
1349
@dbus_interface_annotations(_interface)
1350
def _foo(self):
1351
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1352
"false"}
898
_interface = "se.bsnet.fukt.Mandos.Client"
1353
899
1354
900
## Signals
1355
901
1441
987
if value is None: # get
1442
988
return dbus.Boolean(self.approved_by_default)
1443
989
self.approved_by_default = bool(value)
990
# Emit D-Bus signal
991
self.PropertyChanged(dbus.String("ApprovedByDefault"),
992
dbus.Boolean(value, variant_level=1))
1444
993
1445
994
# ApprovalDelay - property
1446
995
@dbus_service_property(_interface, signature="t",
1449
998
if value is None: # get
1450
999
return dbus.UInt64(self.approval_delay_milliseconds())
1451
1000
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1001
# Emit D-Bus signal
1002
self.PropertyChanged(dbus.String("ApprovalDelay"),
1003
dbus.UInt64(value, variant_level=1))
1452
1004
1453
1005
# ApprovalDuration - property
1454
1006
@dbus_service_property(_interface, signature="t",
1455
1007
access="readwrite")
1456
1008
def ApprovalDuration_dbus_property(self, value=None):
1457
1009
if value is None: # get
1458
return dbus.UInt64(timedelta_to_milliseconds(
1010
return dbus.UInt64(self._timedelta_to_milliseconds(
1459
1011
self.approval_duration))
1460
1012
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1013
# Emit D-Bus signal
1014
self.PropertyChanged(dbus.String("ApprovalDuration"),
1015
dbus.UInt64(value, variant_level=1))
1461
1016
1462
1017
# Name - property
1463
1018
@dbus_service_property(_interface, signature="s", access="read")
1475
1030
def Host_dbus_property(self, value=None):
1476
1031
if value is None: # get
1477
1032
return dbus.String(self.host)
1478
self.host = unicode(value)
1033
self.host = value
1034
# Emit D-Bus signal
1035
self.PropertyChanged(dbus.String("Host"),
1036
dbus.String(value, variant_level=1))
1479
1037
1480
1038
# Created - property
1481
1039
@dbus_service_property(_interface, signature="s", access="read")
1482
1040
def Created_dbus_property(self):
1483
return datetime_to_dbus(self.created)
1041
return dbus.String(self._datetime_to_dbus(self.created))
1484
1042
1485
1043
# LastEnabled - property
1486
1044
@dbus_service_property(_interface, signature="s", access="read")
1487
1045
def LastEnabled_dbus_property(self):
1488
return datetime_to_dbus(self.last_enabled)
1046
if self.last_enabled is None:
1047
return dbus.String("")
1048
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1489
1049
1490
1050
# Enabled - property
1491
1051
@dbus_service_property(_interface, signature="b",
1505
1065
if value is not None:
1506
1066
self.checked_ok()
1507
1067
return
1508
return datetime_to_dbus(self.last_checked_ok)
1509
1510
# LastCheckerStatus - property
1511
@dbus_service_property(_interface, signature="n",
1512
access="read")
1513
def LastCheckerStatus_dbus_property(self):
1514
return dbus.Int16(self.last_checker_status)
1515
1516
# Expires - property
1517
@dbus_service_property(_interface, signature="s", access="read")
1518
def Expires_dbus_property(self):
1519
return datetime_to_dbus(self.expires)
1068
if self.last_checked_ok is None:
1069
return dbus.String("")
1070
return dbus.String(self._datetime_to_dbus(self
1071
.last_checked_ok))
1520
1072
1521
1073
# LastApprovalRequest - property
1522
1074
@dbus_service_property(_interface, signature="s", access="read")
1523
1075
def LastApprovalRequest_dbus_property(self):
1524
return datetime_to_dbus(self.last_approval_request)
1076
if self.last_approval_request is None:
1077
return dbus.String("")
1078
return dbus.String(self.
1079
_datetime_to_dbus(self
1080
.last_approval_request))
1525
1081
1526
1082
# Timeout - property
1527
1083
@dbus_service_property(_interface, signature="t",
1530
1086
if value is None: # get
1531
1087
return dbus.UInt64(self.timeout_milliseconds())
1532
1088
self.timeout = datetime.timedelta(0, 0, 0, value)
1089
# Emit D-Bus signal
1090
self.PropertyChanged(dbus.String("Timeout"),
1091
dbus.UInt64(value, variant_level=1))
1092
if getattr(self, "disable_initiator_tag", None) is None:
1093
return
1533
1094
# Reschedule timeout
1534
if self.enabled:
1535
now = datetime.datetime.utcnow()
1536
time_to_die = timedelta_to_milliseconds(
1537
(self.last_checked_ok + self.timeout) - now)
1538
if time_to_die <= 0:
1539
# The timeout has passed
1540
self.disable()
1541
else:
1542
self.expires = (now +
1543
datetime.timedelta(milliseconds =
1544
time_to_die))
1545
if (getattr(self, "disable_initiator_tag", None)
1546
is None):
1547
return
1548
gobject.source_remove(self.disable_initiator_tag)
1549
self.disable_initiator_tag = (gobject.timeout_add
1550
(time_to_die,
1551
self.disable))
1552
1553
# ExtendedTimeout - property
1554
@dbus_service_property(_interface, signature="t",
1555
access="readwrite")
1556
def ExtendedTimeout_dbus_property(self, value=None):
1557
if value is None: # get
1558
return dbus.UInt64(self.extended_timeout_milliseconds())
1559
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1095
gobject.source_remove(self.disable_initiator_tag)
1096
self.disable_initiator_tag = None
1097
time_to_die = (self.
1098
_timedelta_to_milliseconds((self
1099
.last_checked_ok
1100
+ self.timeout)
1101
- datetime.datetime
1102
.utcnow()))
1103
if time_to_die <= 0:
1104
# The timeout has passed
1105
self.disable()
1106
else:
1107
self.disable_initiator_tag = (gobject.timeout_add
1108
(time_to_die, self.disable))
1560
1109
1561
1110
# Interval - property
1562
1111
@dbus_service_property(_interface, signature="t",
1565
1114
if value is None: # get
1566
1115
return dbus.UInt64(self.interval_milliseconds())
1567
1116
self.interval = datetime.timedelta(0, 0, 0, value)
1117
# Emit D-Bus signal
1118
self.PropertyChanged(dbus.String("Interval"),
1119
dbus.UInt64(value, variant_level=1))
1568
1120
if getattr(self, "checker_initiator_tag", None) is None:
1569
1121
return
1570
if self.enabled:
1571
# Reschedule checker run
1572
gobject.source_remove(self.checker_initiator_tag)
1573
self.checker_initiator_tag = (gobject.timeout_add
1574
(value, self.start_checker))
1575
self.start_checker() # Start one now, too
1576
1122
# Reschedule checker run
1123
gobject.source_remove(self.checker_initiator_tag)
1124
self.checker_initiator_tag = (gobject.timeout_add
1125
(value, self.start_checker))
1126
self.start_checker() # Start one now, too
1127
1577
1128
# Checker - property
1578
1129
@dbus_service_property(_interface, signature="s",
1579
1130
access="readwrite")
1580
1131
def Checker_dbus_property(self, value=None):
1581
1132
if value is None: # get
1582
1133
return dbus.String(self.checker_command)
1583
self.checker_command = unicode(value)
1134
self.checker_command = value
1135
# Emit D-Bus signal
1136
self.PropertyChanged(dbus.String("Checker"),
1137
dbus.String(self.checker_command,
1138
variant_level=1))
1584
1139
1585
1140
# CheckerRunning - property
1586
1141
@dbus_service_property(_interface, signature="b",
1613
1168
self._pipe.send(('init', fpr, address))
1614
1169
if not self._pipe.recv():
1615
1170
raise KeyError()
1616
1171
1617
1172
def __getattribute__(self, name):
1618
if name == '_pipe':
1173
if(name == '_pipe'):
1619
1174
return super(ProxyClient, self).__getattribute__(name)
1620
1175
self._pipe.send(('getattr', name))
1621
1176
data = self._pipe.recv()
1626
1181
self._pipe.send(('funcall', name, args, kwargs))
1627
1182
return self._pipe.recv()[1]
1628
1183
return func
1629
1184
1630
1185
def __setattr__(self, name, value):
1631
if name == '_pipe':
1186
if(name == '_pipe'):
1632
1187
return super(ProxyClient, self).__setattr__(name, value)
1633
1188
self._pipe.send(('setattr', name, value))
1634
1189
1645
1200
unicode(self.client_address))
1646
1201
logger.debug("Pipe FD: %d",
1647
1202
self.server.child_pipe.fileno())
1648
1203
1649
1204
session = (gnutls.connection
1650
1205
.ClientSession(self.request,
1651
1206
gnutls.connection
1652
1207
.X509Credentials()))
1653
1208
1654
1209
# Note: gnutls.connection.X509Credentials is really a
1655
1210
# generic GnuTLS certificate credentials object so long as
1656
1211
# no X.509 keys are added to it. Therefore, we can use it
1657
1212
# here despite using OpenPGP certificates.
1658
1213
1659
1214
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1660
1215
# "+AES-256-CBC", "+SHA1",
1661
1216
# "+COMP-NULL", "+CTYPE-OPENPGP",
1667
1222
(gnutls.library.functions
1668
1223
.gnutls_priority_set_direct(session._c_object,
1669
1224
priority, None))
1670
1225
1671
1226
# Start communication using the Mandos protocol
1672
1227
# Get protocol number
1673
1228
line = self.request.makefile().readline()
1678
1233
except (ValueError, IndexError, RuntimeError) as error:
1679
1234
logger.error("Unknown protocol version: %s", error)
1680
1235
return
1681
1236
1682
1237
# Start GnuTLS connection
1683
1238
try:
1684
1239
session.handshake()
1688
1243
# established. Just abandon the request.
1689
1244
return
1690
1245
logger.debug("Handshake succeeded")
1691
1246
1692
1247
approval_required = False
1693
1248
try:
1694
1249
try:
1699
1254
logger.warning("Bad certificate: %s", error)
1700
1255
return
1701
1256
logger.debug("Fingerprint: %s", fpr)
1702
1257
1703
1258
try:
1704
1259
client = ProxyClient(child_pipe, fpr,
1705
1260
self.client_address)
1717
1272
client.name)
1718
1273
if self.server.use_dbus:
1719
1274
# Emit D-Bus signal
1720
client.Rejected("Disabled")
1275
client.Rejected("Disabled")
1721
1276
return
1722
1277
1723
if client.approved or not client.approval_delay:
1278
if client._approved or not client.approval_delay:
1724
1279
#We are approved or approval is disabled
1725
1280
break
1726
elif client.approved is None:
1281
elif client._approved is None:
1727
1282
logger.info("Client %s needs approval",
1728
1283
client.name)
1729
1284
if self.server.use_dbus:
1740
1295
return
1741
1296
1742
1297
#wait until timeout or approved
1298
#x = float(client._timedelta_to_milliseconds(delay))
1743
1299
time = datetime.datetime.now()
1744
1300
client.changedstate.acquire()
1745
(client.changedstate.wait
1746
(float(client.timedelta_to_milliseconds(delay)
1747
/ 1000)))
1301
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1748
1302
client.changedstate.release()
1749
1303
time2 = datetime.datetime.now()
1750
1304
if (time2 - time) >= delay:
1766
1320
try:
1767
1321
sent = session.send(client.secret[sent_size:])
1768
1322
except gnutls.errors.GNUTLSError as error:
1769
logger.warning("gnutls send failed",
1770
exc_info=error)
1323
logger.warning("gnutls send failed")
1771
1324
return
1772
1325
logger.debug("Sent: %d, remaining: %d",
1773
1326
sent, len(client.secret)
1774
1327
- (sent_size + sent))
1775
1328
sent_size += sent
1776
1329
1777
1330
logger.info("Sending secret to %s", client.name)
1778
# bump the timeout using extended_timeout
1779
client.bump_timeout(client.extended_timeout)
1331
# bump the timeout as if seen
1332
client.checked_ok()
1780
1333
if self.server.use_dbus:
1781
1334
# Emit D-Bus signal
1782
1335
client.GotSecret()
1787
1340
try:
1788
1341
session.bye()
1789
1342
except gnutls.errors.GNUTLSError as error:
1790
logger.warning("GnuTLS bye failed",
1791
exc_info=error)
1343
logger.warning("GnuTLS bye failed")
1792
1344
1793
1345
@staticmethod
1794
1346
def peer_certificate(session):
1850
1402
# Convert the buffer to a Python bytestring
1851
1403
fpr = ctypes.string_at(buf, buf_len.value)
1852
1404
# Convert the bytestring to hexadecimal notation
1853
hex_fpr = binascii.hexlify(fpr).upper()
1405
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1854
1406
return hex_fpr
1855
1407
1856
1408
1859
1411
def sub_process_main(self, request, address):
1860
1412
try:
1861
1413
self.finish_request(request, address)
1862
except Exception:
1414
except:
1863
1415
self.handle_error(request, address)
1864
1416
self.close_request(request)
1865
1417
1866
1418
def process_request(self, request, address):
1867
1419
"""Start a new process to process the request."""
1868
proc = multiprocessing.Process(target = self.sub_process_main,
1869
args = (request, address))
1870
proc.start()
1871
return proc
1872
1420
multiprocessing.Process(target = self.sub_process_main,
1421
args = (request, address)).start()
1873
1422
1874
1423
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1875
1424
""" adds a pipe to the MixIn """
1879
1428
This function creates a new pipe in self.pipe
1880
1429
"""
1881
1430
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1882
1883
proc = MultiprocessingMixIn.process_request(self, request,
1884
client_address)
1431
1432
super(MultiprocessingMixInWithPipe,
1433
self).process_request(request, client_address)
1885
1434
self.child_pipe.close()
1886
self.add_pipe(parent_pipe, proc)
1887
1888
def add_pipe(self, parent_pipe, proc):
1435
self.add_pipe(parent_pipe)
1436
1437
def add_pipe(self, parent_pipe):
1889
1438
"""Dummy function; override as necessary"""
1890
1439
raise NotImplementedError
1891
1440
1892
1893
1441
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1894
1442
socketserver.TCPServer, object):
1895
1443
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1969
1517
self.enabled = False
1970
1518
self.clients = clients
1971
1519
if self.clients is None:
1972
self.clients = {}
1520
self.clients = set()
1973
1521
self.use_dbus = use_dbus
1974
1522
self.gnutls_priority = gnutls_priority
1975
1523
IPv6_TCPServer.__init__(self, server_address,
1979
1527
def server_activate(self):
1980
1528
if self.enabled:
1981
1529
return socketserver.TCPServer.server_activate(self)
1982
1983
1530
def enable(self):
1984
1531
self.enabled = True
1985
1986
def add_pipe(self, parent_pipe, proc):
1532
def add_pipe(self, parent_pipe):
1987
1533
# Call "handle_ipc" for both data and EOF events
1988
1534
gobject.io_add_watch(parent_pipe.fileno(),
1989
1535
gobject.IO_IN | gobject.IO_HUP,
1990
1536
functools.partial(self.handle_ipc,
1991
parent_pipe =
1992
parent_pipe,
1993
proc = proc))
1994
1537
parent_pipe = parent_pipe))
1538
1995
1539
def handle_ipc(self, source, condition, parent_pipe=None,
1996
proc = None, client_object=None):
1997
# error, or the other end of multiprocessing.Pipe has closed
1998
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1999
# Wait for other process to exit
2000
proc.join()
1540
client_object=None):
1541
condition_names = {
1542
gobject.IO_IN: "IN", # There is data to read.
1543
gobject.IO_OUT: "OUT", # Data can be written (without
1544
# blocking).
1545
gobject.IO_PRI: "PRI", # There is urgent data to read.
1546
gobject.IO_ERR: "ERR", # Error condition.
1547
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1548
# broken, usually for pipes and
1549
# sockets).
1550
}
1551
conditions_string = ' | '.join(name
1552
for cond, name in
1553
condition_names.iteritems()
1554
if cond & condition)
1555
# error or the other end of multiprocessing.Pipe has closed
1556
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2001
1557
return False
2002
1558
2003
1559
# Read a request from the child
2008
1564
fpr = request[1]
2009
1565
address = request[2]
2010
1566
2011
for c in self.clients.itervalues():
1567
for c in self.clients:
2012
1568
if c.fingerprint == fpr:
2013
1569
client = c
2014
1570
break
2017
1573
"dress: %s", fpr, address)
2018
1574
if self.use_dbus:
2019
1575
# Emit D-Bus signal
2020
mandos_dbus_service.ClientNotFound(fpr,
2021
address[0])
1576
mandos_dbus_service.ClientNotFound(fpr, address[0])
2022
1577
parent_pipe.send(False)
2023
1578
return False
2024
1579
2025
1580
gobject.io_add_watch(parent_pipe.fileno(),
2026
1581
gobject.IO_IN | gobject.IO_HUP,
2027
1582
functools.partial(self.handle_ipc,
2028
parent_pipe =
2029
parent_pipe,
2030
proc = proc,
2031
client_object =
2032
client))
1583
parent_pipe = parent_pipe,
1584
client_object = client))
2033
1585
parent_pipe.send(True)
2034
# remove the old hook in favor of the new above hook on
2035
# same fileno
1586
# remove the old hook in favor of the new above hook on same fileno
2036
1587
return False
2037
1588
if command == 'funcall':
2038
1589
funcname = request[1]
2039
1590
args = request[2]
2040
1591
kwargs = request[3]
2041
1592
2042
parent_pipe.send(('data', getattr(client_object,
2043
funcname)(*args,
2044
**kwargs)))
2045
1593
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1594
2046
1595
if command == 'getattr':
2047
1596
attrname = request[1]
2048
1597
if callable(client_object.__getattribute__(attrname)):
2049
1598
parent_pipe.send(('function',))
2050
1599
else:
2051
parent_pipe.send(('data', client_object
2052
.__getattribute__(attrname)))
1600
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2053
1601
2054
1602
if command == 'setattr':
2055
1603
attrname = request[1]
2056
1604
value = request[2]
2057
1605
setattr(client_object, attrname, value)
2058
1606
2059
1607
return True
2060
1608
2061
1609
2091
1639
elif suffix == "w":
2092
1640
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2093
1641
else:
2094
raise ValueError("Unknown suffix {0!r}"
2095
.format(suffix))
1642
raise ValueError("Unknown suffix %r" % suffix)
2096
1643
except (ValueError, IndexError) as e:
2097
1644
raise ValueError(*(e.args))
2098
1645
timevalue += delta
2099
1646
return timevalue
2100
1647
2101
1648
1649
def if_nametoindex(interface):
1650
"""Call the C function if_nametoindex(), or equivalent
1651
1652
Note: This function cannot accept a unicode string."""
1653
global if_nametoindex
1654
try:
1655
if_nametoindex = (ctypes.cdll.LoadLibrary
1656
(ctypes.util.find_library("c"))
1657
.if_nametoindex)
1658
except (OSError, AttributeError):
1659
logger.warning("Doing if_nametoindex the hard way")
1660
def if_nametoindex(interface):
1661
"Get an interface index the hard way, i.e. using fcntl()"
1662
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1663
with contextlib.closing(socket.socket()) as s:
1664
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1665
struct.pack(str("16s16x"),
1666
interface))
1667
interface_index = struct.unpack(str("I"),
1668
ifreq[16:20])[0]
1669
return interface_index
1670
return if_nametoindex(interface)
1671
1672
2102
1673
def daemon(nochdir = False, noclose = False):
2103
1674
"""See daemon(3). Standard BSD Unix function.
2104
1675
2112
1683
sys.exit()
2113
1684
if not noclose:
2114
1685
# Close all standard open file descriptors
2115
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1686
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2116
1687
if not stat.S_ISCHR(os.fstat(null).st_mode):
2117
1688
raise OSError(errno.ENODEV,
2118
"{0} not a character device"
2119
.format(os.devnull))
1689
"%s not a character device"
1690
% os.path.devnull)
2120
1691
os.dup2(null, sys.stdin.fileno())
2121
1692
os.dup2(null, sys.stdout.fileno())
2122
1693
os.dup2(null, sys.stderr.fileno())
2131
1702
2132
1703
parser = argparse.ArgumentParser()
2133
1704
parser.add_argument("-v", "--version", action="version",
2134
version = "%(prog)s {0}".format(version),
1705
version = "%%(prog)s %s" % version,
2135
1706
help="show version number and exit")
2136
1707
parser.add_argument("-i", "--interface", metavar="IF",
2137
1708
help="Bind to interface IF")
2159
1730
" system bus interface")
2160
1731
parser.add_argument("--no-ipv6", action="store_false",
2161
1732
dest="use_ipv6", help="Do not use IPv6")
2162
parser.add_argument("--no-restore", action="store_false",
2163
dest="restore", help="Do not restore stored"
2164
" state")
2165
parser.add_argument("--statedir", metavar="DIR",
2166
help="Directory to save/restore state in")
2167
2168
1733
options = parser.parse_args()
2169
1734
2170
1735
if options.check:
2183
1748
"use_dbus": "True",
2184
1749
"use_ipv6": "True",
2185
1750
"debuglevel": "",
2186
"restore": "True",
2187
"statedir": "/var/lib/mandos"
2188
1751
}
2189
1752
2190
1753
# Parse config file for server-global settings
2207
1770
# options, if set.
2208
1771
for option in ("interface", "address", "port", "debug",
2209
1772
"priority", "servicename", "configdir",
2210
"use_dbus", "use_ipv6", "debuglevel", "restore",
2211
"statedir"):
1773
"use_dbus", "use_ipv6", "debuglevel"):
2212
1774
value = getattr(options, option)
2213
1775
if value is not None:
2214
1776
server_settings[option] = value
2226
1788
debuglevel = server_settings["debuglevel"]
2227
1789
use_dbus = server_settings["use_dbus"]
2228
1790
use_ipv6 = server_settings["use_ipv6"]
2229
stored_state_path = os.path.join(server_settings["statedir"],
2230
stored_state_file)
2231
2232
if debug:
2233
initlogger(debug, logging.DEBUG)
2234
else:
2235
if not debuglevel:
2236
initlogger(debug)
2237
else:
2238
level = getattr(logging, debuglevel.upper())
2239
initlogger(debug, level)
2240
1791
2241
1792
if server_settings["servicename"] != "Mandos":
2242
1793
syslogger.setFormatter(logging.Formatter
2243
('Mandos ({0}) [%(process)d]:'
2244
' %(levelname)s: %(message)s'
2245
.format(server_settings
2246
["servicename"])))
1794
('Mandos (%s) [%%(process)d]:'
1795
' %%(levelname)s: %%(message)s'
1796
% server_settings["servicename"]))
2247
1797
2248
1798
# Parse config file with clients
2249
client_config = configparser.SafeConfigParser(Client
2250
.client_defaults)
1799
client_defaults = { "timeout": "1h",
1800
"interval": "5m",
1801
"checker": "fping -q -- %%(host)s",
1802
"host": "",
1803
"approval_delay": "0s",
1804
"approval_duration": "1s",
1805
}
1806
client_config = configparser.SafeConfigParser(client_defaults)
2251
1807
client_config.read(os.path.join(server_settings["configdir"],
2252
1808
"clients.conf"))
2253
1809
2267
1823
pidfilename = "/var/run/mandos.pid"
2268
1824
try:
2269
1825
pidfile = open(pidfilename, "w")
2270
except IOError as e:
2271
logger.error("Could not open file %r", pidfilename,
2272
exc_info=e)
1826
except IOError:
1827
logger.error("Could not open file %r", pidfilename)
2273
1828
2274
for name in ("_mandos", "mandos", "nobody"):
1829
try:
1830
uid = pwd.getpwnam("_mandos").pw_uid
1831
gid = pwd.getpwnam("_mandos").pw_gid
1832
except KeyError:
2275
1833
try:
2276
uid = pwd.getpwnam(name).pw_uid
2277
gid = pwd.getpwnam(name).pw_gid
2278
break
1834
uid = pwd.getpwnam("mandos").pw_uid
1835
gid = pwd.getpwnam("mandos").pw_gid
2279
1836
except KeyError:
2280
continue
2281
else:
2282
uid = 65534
2283
gid = 65534
1837
try:
1838
uid = pwd.getpwnam("nobody").pw_uid
1839
gid = pwd.getpwnam("nobody").pw_gid
1840
except KeyError:
1841
uid = 65534
1842
gid = 65534
2284
1843
try:
2285
1844
os.setgid(gid)
2286
1845
os.setuid(uid)
2288
1847
if error[0] != errno.EPERM:
2289
1848
raise error
2290
1849
1850
if not debug and not debuglevel:
1851
syslogger.setLevel(logging.WARNING)
1852
console.setLevel(logging.WARNING)
1853
if debuglevel:
1854
level = getattr(logging, debuglevel.upper())
1855
syslogger.setLevel(level)
1856
console.setLevel(level)
1857
2291
1858
if debug:
2292
1859
# Enable all possible GnuTLS debugging
2293
1860
2303
1870
.gnutls_global_set_log_function(debug_gnutls))
2304
1871
2305
1872
# Redirect stdin so all checkers get /dev/null
2306
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1873
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2307
1874
os.dup2(null, sys.stdin.fileno())
2308
1875
if null > 2:
2309
1876
os.close(null)
1877
else:
1878
# No console logging
1879
logger.removeHandler(console)
2310
1880
2311
1881
# Need to fork before connecting to D-Bus
2312
1882
if not debug:
2313
1883
# Close all input and output, do double fork, etc.
2314
1884
daemon()
2315
1885
2316
gobject.threads_init()
2317
2318
1886
global main_loop
2319
1887
# From the Avahi example code
2320
DBusGMainLoop(set_as_default=True)
1888
DBusGMainLoop(set_as_default=True )
2321
1889
main_loop = gobject.MainLoop()
2322
1890
bus = dbus.SystemBus()
2323
1891
# End of Avahi example code
2324
1892
if use_dbus:
2325
1893
try:
2326
bus_name = dbus.service.BusName("se.recompile.Mandos",
1894
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2327
1895
bus, do_not_queue=True)
2328
old_bus_name = (dbus.service.BusName
2329
("se.bsnet.fukt.Mandos", bus,
2330
do_not_queue=True))
2331
1896
except dbus.exceptions.NameExistsException as e:
2332
logger.error("Disabling D-Bus:", exc_info=e)
1897
logger.error(unicode(e) + ", disabling D-Bus")
2333
1898
use_dbus = False
2334
1899
server_settings["use_dbus"] = False
2335
1900
tcp_server.use_dbus = False
2336
1901
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2337
service = AvahiServiceToSyslog(name =
2338
server_settings["servicename"],
2339
servicetype = "_mandos._tcp",
2340
protocol = protocol, bus = bus)
1902
service = AvahiService(name = server_settings["servicename"],
1903
servicetype = "_mandos._tcp",
1904
protocol = protocol, bus = bus)
2341
1905
if server_settings["interface"]:
2342
1906
service.interface = (if_nametoindex
2343
1907
(str(server_settings["interface"])))
2348
1912
client_class = Client
2349
1913
if use_dbus:
2350
1914
client_class = functools.partial(ClientDBus, bus = bus)
2351
2352
client_settings = Client.config_parser(client_config)
2353
old_client_settings = {}
2354
clients_data = {}
2355
2356
# Get client data and settings from last running state.
2357
if server_settings["restore"]:
2358
try:
2359
with open(stored_state_path, "rb") as stored_state:
2360
clients_data, old_client_settings = (pickle.load
2361
(stored_state))
2362
os.remove(stored_state_path)
2363
except IOError as e:
2364
if e.errno == errno.ENOENT:
2365
logger.warning("Could not load persistent state: {0}"
2366
.format(os.strerror(e.errno)))
2367
else:
2368
logger.critical("Could not load persistent state:",
2369
exc_info=e)
2370
raise
2371
except EOFError as e:
2372
logger.warning("Could not load persistent state: "
2373
"EOFError:", exc_info=e)
2374
2375
with PGPEngine() as pgp:
2376
for client_name, client in clients_data.iteritems():
2377
# Decide which value to use after restoring saved state.
2378
# We have three different values: Old config file,
2379
# new config file, and saved state.
2380
# New config value takes precedence if it differs from old
2381
# config value, otherwise use saved state.
2382
for name, value in client_settings[client_name].items():
2383
try:
2384
# For each value in new config, check if it
2385
# differs from the old config value (Except for
2386
# the "secret" attribute)
2387
if (name != "secret" and
2388
value != old_client_settings[client_name]
2389
[name]):
2390
client[name] = value
2391
except KeyError:
2392
pass
2393
2394
# Clients who has passed its expire date can still be
2395
# enabled if its last checker was successful. Clients
2396
# whose checker succeeded before we stored its state is
2397
# assumed to have successfully run all checkers during
2398
# downtime.
2399
if client["enabled"]:
2400
if datetime.datetime.utcnow() >= client["expires"]:
2401
if not client["last_checked_ok"]:
2402
logger.warning(
2403
"disabling client {0} - Client never "
2404
"performed a successful checker"
2405
.format(client_name))
2406
client["enabled"] = False
2407
elif client["last_checker_status"] != 0:
2408
logger.warning(
2409
"disabling client {0} - Client "
2410
"last checker failed with error code {1}"
2411
.format(client_name,
2412
client["last_checker_status"]))
2413
client["enabled"] = False
2414
else:
2415
client["expires"] = (datetime.datetime
2416
.utcnow()
2417
+ client["timeout"])
2418
logger.debug("Last checker succeeded,"
2419
" keeping {0} enabled"
2420
.format(client_name))
1915
def client_config_items(config, section):
1916
special_settings = {
1917
"approved_by_default":
1918
lambda: config.getboolean(section,
1919
"approved_by_default"),
1920
}
1921
for name, value in config.items(section):
2421
1922
try:
2422
client["secret"] = (
2423
pgp.decrypt(client["encrypted_secret"],
2424
client_settings[client_name]
2425
["secret"]))
2426
except PGPError:
2427
# If decryption fails, we use secret from new settings
2428
logger.debug("Failed to decrypt {0} old secret"
2429
.format(client_name))
2430
client["secret"] = (
2431
client_settings[client_name]["secret"])
2432
2433
# Add/remove clients based on new changes made to config
2434
for client_name in (set(old_client_settings)
2435
- set(client_settings)):
2436
del clients_data[client_name]
2437
for client_name in (set(client_settings)
2438
- set(old_client_settings)):
2439
clients_data[client_name] = client_settings[client_name]
2440
2441
# Create all client objects
2442
for client_name, client in clients_data.iteritems():
2443
tcp_server.clients[client_name] = client_class(
2444
name = client_name, settings = client)
2445
1923
yield (name, special_settings[name]())
1924
except KeyError:
1925
yield (name, value)
1926
1927
tcp_server.clients.update(set(
1928
client_class(name = section,
1929
config= dict(client_config_items(
1930
client_config, section)))
1931
for section in client_config.sections()))
2446
1932
if not tcp_server.clients:
2447
1933
logger.warning("No clients defined")
2448
1934
2449
1935
if not debug:
2450
1936
try:
2451
1937
with pidfile:
2459
1945
# "pidfile" was never created
2460
1946
pass
2461
1947
del pidfilename
1948
2462
1949
signal.signal(signal.SIGINT, signal.SIG_IGN)
2463
1950
2464
1951
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2465
1952
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2466
1953
2467
1954
if use_dbus:
2468
@alternate_dbus_interfaces({"se.recompile.Mandos":
2469
"se.bsnet.fukt.Mandos"})
2470
class MandosDBusService(DBusObjectWithProperties):
1955
class MandosDBusService(dbus.service.Object):
2471
1956
"""A D-Bus proxy object"""
2472
1957
def __init__(self):
2473
1958
dbus.service.Object.__init__(self, bus, "/")
2474
_interface = "se.recompile.Mandos"
2475
2476
@dbus_interface_annotations(_interface)
2477
def _foo(self):
2478
return { "org.freedesktop.DBus.Property"
2479
".EmitsChangedSignal":
2480
"false"}
1959
_interface = "se.bsnet.fukt.Mandos"
2481
1960
2482
1961
@dbus.service.signal(_interface, signature="o")
2483
1962
def ClientAdded(self, objpath):
2498
1977
def GetAllClients(self):
2499
1978
"D-Bus method"
2500
1979
return dbus.Array(c.dbus_object_path
2501
for c in
2502
tcp_server.clients.itervalues())
1980
for c in tcp_server.clients)
2503
1981
2504
1982
@dbus.service.method(_interface,
2505
1983
out_signature="a{oa{sv}}")
2507
1985
"D-Bus method"
2508
1986
return dbus.Dictionary(
2509
1987
((c.dbus_object_path, c.GetAll(""))
2510
for c in tcp_server.clients.itervalues()),
1988
for c in tcp_server.clients),
2511
1989
signature="oa{sv}")
2512
1990
2513
1991
@dbus.service.method(_interface, in_signature="o")
2514
1992
def RemoveClient(self, object_path):
2515
1993
"D-Bus method"
2516
for c in tcp_server.clients.itervalues():
1994
for c in tcp_server.clients:
2517
1995
if c.dbus_object_path == object_path:
2518
del tcp_server.clients[c.name]
1996
tcp_server.clients.remove(c)
2519
1997
c.remove_from_connection()
2520
1998
# Don't signal anything except ClientRemoved
2521
1999
c.disable(quiet=True)
2532
2010
"Cleanup function; run on exit"
2533
2011
service.cleanup()
2534
2012
2535
multiprocessing.active_children()
2536
if not (tcp_server.clients or client_settings):
2537
return
2538
2539
# Store client before exiting. Secrets are encrypted with key
2540
# based on what config file has. If config file is
2541
# removed/edited, old secret will thus be unrecovable.
2542
clients = {}
2543
with PGPEngine() as pgp:
2544
for client in tcp_server.clients.itervalues():
2545
key = client_settings[client.name]["secret"]
2546
client.encrypted_secret = pgp.encrypt(client.secret,
2547
key)
2548
client_dict = {}
2549
2550
# A list of attributes that can not be pickled
2551
# + secret.
2552
exclude = set(("bus", "changedstate", "secret",
2553
"checker"))
2554
for name, typ in (inspect.getmembers
2555
(dbus.service.Object)):
2556
exclude.add(name)
2557
2558
client_dict["encrypted_secret"] = (client
2559
.encrypted_secret)
2560
for attr in client.client_structure:
2561
if attr not in exclude:
2562
client_dict[attr] = getattr(client, attr)
2563
2564
clients[client.name] = client_dict
2565
del client_settings[client.name]["secret"]
2566
2567
try:
2568
with (tempfile.NamedTemporaryFile
2569
(mode='wb', suffix=".pickle", prefix='clients-',
2570
dir=os.path.dirname(stored_state_path),
2571
delete=False)) as stored_state:
2572
pickle.dump((clients, client_settings), stored_state)
2573
tempname=stored_state.name
2574
os.rename(tempname, stored_state_path)
2575
except (IOError, OSError) as e:
2576
if not debug:
2577
try:
2578
os.remove(tempname)
2579
except NameError:
2580
pass
2581
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2582
logger.warning("Could not save persistent state: {0}"
2583
.format(os.strerror(e.errno)))
2584
else:
2585
logger.warning("Could not save persistent state:",
2586
exc_info=e)
2587
raise e
2588
2589
# Delete all clients, and settings from config
2590
2013
while tcp_server.clients:
2591
name, client = tcp_server.clients.popitem()
2014
client = tcp_server.clients.pop()
2592
2015
if use_dbus:
2593
2016
client.remove_from_connection()
2017
client.disable_hook = None
2594
2018
# Don't signal anything except ClientRemoved
2595
2019
client.disable(quiet=True)
2596
2020
if use_dbus:
2597
2021
# Emit D-Bus signal
2598
mandos_dbus_service.ClientRemoved(client
2599
.dbus_object_path,
2022
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2600
2023
client.name)
2601
client_settings.clear()
2602
2024
2603
2025
atexit.register(cleanup)
2604
2026
2605
for client in tcp_server.clients.itervalues():
2027
for client in tcp_server.clients:
2606
2028
if use_dbus:
2607
2029
# Emit D-Bus signal
2608
2030
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2609
# Need to initiate checking of clients
2610
if client.enabled:
2611
client.init_checker()
2031
client.enable()
2612
2032
2613
2033
tcp_server.enable()
2614
2034
tcp_server.server_activate()
2617
2037
service.port = tcp_server.socket.getsockname()[1]
2618
2038
if use_ipv6:
2619
2039
logger.info("Now listening on address %r, port %d,"
2620
" flowinfo %d, scope_id %d",
2621
*tcp_server.socket.getsockname())
2040
" flowinfo %d, scope_id %d"
2041
% tcp_server.socket.getsockname())
2622
2042
else: # IPv4
2623
logger.info("Now listening on address %r, port %d",
2624
*tcp_server.socket.getsockname())
2043
logger.info("Now listening on address %r, port %d"
2044
% tcp_server.socket.getsockname())
2625
2045
2626
2046
#service.interface = tcp_server.socket.getsockname()[3]
2627
2047
2630
2050
try:
2631
2051
service.activate()
2632
2052
except dbus.exceptions.DBusException as error:
2633
logger.critical("D-Bus Exception", exc_info=error)
2053
logger.critical("DBusException: %s", error)
2634
2054
cleanup()
2635
2055
sys.exit(1)
2636
2056
# End of Avahi example code
2643
2063
logger.debug("Starting main loop")
2644
2064
main_loop.run()
2645
2065
except AvahiError as error:
2646
logger.critical("Avahi Error", exc_info=error)
2066
logger.critical("AvahiError: %s", error)
2647
2067
cleanup()
2648
2068
sys.exit(1)
2649
2069
except KeyboardInterrupt:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0