88
81
except ImportError:
89
82
SO_BINDTODEVICE = None
92
stored_state_file = "clients.pickle"
94
logger = logging.getLogger()
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
101
except (OSError, AttributeError):
102
def if_nametoindex(interface):
103
"Get an interface index the hard way, i.e. using fcntl()"
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
with contextlib.closing(socket.socket()) as s:
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
109
interface_index = struct.unpack(str("I"),
111
return interface_index
114
def initlogger(debug, level=logging.WARNING):
115
"""init logger and add loglevel"""
118
syslogger = (logging.handlers.SysLogHandler
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
122
syslogger.setFormatter(logging.Formatter
123
('Mandos [%(process)d]: %(levelname)s:'
125
logger.addHandler(syslogger)
128
console = logging.StreamHandler()
129
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
133
logger.addHandler(console)
134
logger.setLevel(level)
137
class PGPError(Exception):
138
"""Exception if encryption/decryption fails"""
142
class PGPEngine(object):
143
"""A simple class for OpenPGP symmetric encryption & decryption"""
145
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
146
self.gnupgargs = ['--batch',
147
'--home', self.tempdir,
155
def __exit__(self, exc_type, exc_value, traceback):
163
if self.tempdir is not None:
164
# Delete contents of tempdir
165
for root, dirs, files in os.walk(self.tempdir,
167
for filename in files:
168
os.remove(os.path.join(root, filename))
170
os.rmdir(os.path.join(root, dirname))
172
os.rmdir(self.tempdir)
175
def password_encode(self, password):
176
# Passphrase can not be empty and can not contain newlines or
177
# NUL bytes. So we prefix it and hex encode it.
178
encoded = b"mandos" + binascii.hexlify(password)
179
if len(encoded) > 2048:
180
# GnuPG can't handle long passwords, so encode differently
181
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
182
.replace(b"\n", b"\\n")
183
.replace(b"\0", b"\\x00"))
186
def encrypt(self, data, password):
187
passphrase = self.password_encode(password)
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
passfile.write(passphrase)
192
proc = subprocess.Popen(['gpg', '--symmetric',
196
stdin = subprocess.PIPE,
197
stdout = subprocess.PIPE,
198
stderr = subprocess.PIPE)
199
ciphertext, err = proc.communicate(input = data)
200
if proc.returncode != 0:
204
def decrypt(self, data, password):
205
passphrase = self.password_encode(password)
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
passfile.write(passphrase)
210
proc = subprocess.Popen(['gpg', '--decrypt',
214
stdin = subprocess.PIPE,
215
stdout = subprocess.PIPE,
216
stderr = subprocess.PIPE)
217
decrypted_plaintext, err = proc.communicate(input
219
if proc.returncode != 0:
221
return decrypted_plaintext
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
89
syslogger = (logging.handlers.SysLogHandler
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
95
logger.addHandler(syslogger)
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
101
logger.addHandler(console)
224
103
class AvahiError(Exception):
225
104
def __init__(self, value, *args, **kwargs):
436
291
interval: datetime.timedelta(); How often to start a new checker
437
292
last_approval_request: datetime.datetime(); (UTC) or None
438
293
last_checked_ok: datetime.datetime(); (UTC) or None
439
last_checker_status: integer between 0 and 255 reflecting exit
440
status of last checker. -1 reflects crashed
441
checker, -2 means no checker completed yet.
442
last_enabled: datetime.datetime(); (UTC) or None
294
last_enabled: datetime.datetime(); (UTC)
443
295
name: string; from the config file, used in log messages and
444
296
D-Bus identifiers
445
297
secret: bytestring; sent verbatim (over TLS) to client
446
298
timeout: datetime.timedelta(); How long from last_checked_ok
447
299
until this client is disabled
448
extended_timeout: extra long timeout when secret has been sent
300
extended_timeout: extra long timeout when password has been sent
449
301
runtime_expansions: Allowed attributes for runtime expansion.
450
302
expires: datetime.datetime(); time (UTC) when a client will be
451
303
disabled, or None
452
server_settings: The server_settings dict from main()
455
306
runtime_expansions = ("approval_delay", "approval_duration",
456
"created", "enabled", "expires",
457
"fingerprint", "host", "interval",
458
"last_approval_request", "last_checked_ok",
307
"created", "enabled", "fingerprint",
308
"host", "interval", "last_checked_ok",
459
309
"last_enabled", "name", "timeout")
460
client_defaults = { "timeout": "PT5M",
461
"extended_timeout": "PT15M",
463
"checker": "fping -q -- %%(host)s",
465
"approval_delay": "PT0S",
466
"approval_duration": "PT1S",
467
"approved_by_default": "True",
312
def _timedelta_to_milliseconds(td):
313
"Convert a datetime.timedelta() to milliseconds"
314
return ((td.days * 24 * 60 * 60 * 1000)
315
+ (td.seconds * 1000)
316
+ (td.microseconds // 1000))
471
318
def timeout_milliseconds(self):
472
319
"Return the 'timeout' attribute in milliseconds"
473
return timedelta_to_milliseconds(self.timeout)
320
return self._timedelta_to_milliseconds(self.timeout)
475
322
def extended_timeout_milliseconds(self):
476
323
"Return the 'extended_timeout' attribute in milliseconds"
477
return timedelta_to_milliseconds(self.extended_timeout)
324
return self._timedelta_to_milliseconds(self.extended_timeout)
479
326
def interval_milliseconds(self):
480
327
"Return the 'interval' attribute in milliseconds"
481
return timedelta_to_milliseconds(self.interval)
328
return self._timedelta_to_milliseconds(self.interval)
483
330
def approval_delay_milliseconds(self):
484
return timedelta_to_milliseconds(self.approval_delay)
487
def config_parser(config):
488
"""Construct a new dict of client settings of this form:
489
{ client_name: {setting_name: value, ...}, ...}
490
with exceptions for any special settings as defined above.
491
NOTE: Must be a pure function. Must return the same result
492
value given the same arguments.
495
for client_name in config.sections():
496
section = dict(config.items(client_name))
497
client = settings[client_name] = {}
499
client["host"] = section["host"]
500
# Reformat values from string types to Python types
501
client["approved_by_default"] = config.getboolean(
502
client_name, "approved_by_default")
503
client["enabled"] = config.getboolean(client_name,
506
client["fingerprint"] = (section["fingerprint"].upper()
508
if "secret" in section:
509
client["secret"] = section["secret"].decode("base64")
510
elif "secfile" in section:
511
with open(os.path.expanduser(os.path.expandvars
512
(section["secfile"])),
514
client["secret"] = secfile.read()
516
raise TypeError("No secret or secfile for section {0}"
518
client["timeout"] = string_to_delta(section["timeout"])
519
client["extended_timeout"] = string_to_delta(
520
section["extended_timeout"])
521
client["interval"] = string_to_delta(section["interval"])
522
client["approval_delay"] = string_to_delta(
523
section["approval_delay"])
524
client["approval_duration"] = string_to_delta(
525
section["approval_duration"])
526
client["checker_command"] = section["checker"]
527
client["last_approval_request"] = None
528
client["last_checked_ok"] = None
529
client["last_checker_status"] = -2
533
def __init__(self, settings, name = None, server_settings=None):
331
return self._timedelta_to_milliseconds(self.approval_delay)
333
def __init__(self, name = None, disable_hook=None, config=None):
334
"""Note: the 'checker' key in 'config' sets the
335
'checker_command' attribute and *not* the 'checker'
535
if server_settings is None:
537
self.server_settings = server_settings
538
# adding all client settings
539
for setting, value in settings.iteritems():
540
setattr(self, setting, value)
543
if not hasattr(self, "last_enabled"):
544
self.last_enabled = datetime.datetime.utcnow()
545
if not hasattr(self, "expires"):
546
self.expires = (datetime.datetime.utcnow()
549
self.last_enabled = None
552
340
logger.debug("Creating client %r", self.name)
553
341
# Uppercase and remove spaces from fingerprint for later
554
342
# comparison purposes with return value from the fingerprint()
344
self.fingerprint = (config["fingerprint"].upper()
556
346
logger.debug(" Fingerprint: %s", self.fingerprint)
557
self.created = settings.get("created",
558
datetime.datetime.utcnow())
560
# attributes specific for this server instance
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
350
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
353
self.secret = secfile.read()
355
raise TypeError("No secret or secfile for client %s"
357
self.host = config.get("host", "")
358
self.created = datetime.datetime.utcnow()
360
self.last_approval_request = None
361
self.last_enabled = None
362
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
366
self.disable_hook = disable_hook
561
367
self.checker = None
562
368
self.checker_initiator_tag = None
563
369
self.disable_initiator_tag = None
564
371
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
565
373
self.current_checker_command = None
374
self.last_connect = None
375
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
567
378
self.approvals_pending = 0
568
self.changedstate = (multiprocessing_manager
569
.Condition(multiprocessing_manager
571
self.client_structure = [attr for attr in
572
self.__dict__.iterkeys()
573
if not attr.startswith("_")]
574
self.client_structure.append("client_structure")
576
for name, t in inspect.getmembers(type(self),
580
if not name.startswith("_"):
581
self.client_structure.append(name)
379
self.approval_delay = string_to_delta(
380
config["approval_delay"])
381
self.approval_duration = string_to_delta(
382
config["approval_duration"])
383
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
583
# Send notice to process children that client state has changed
584
385
def send_changedstate(self):
585
with self.changedstate:
586
self.changedstate.notify_all()
386
self.changedstate.acquire()
387
self.changedstate.notify_all()
388
self.changedstate.release()
588
390
def enable(self):
589
391
"""Start this client's checker and timeout hooks"""
590
392
if getattr(self, "enabled", False):
591
393
# Already enabled
593
self.expires = datetime.datetime.utcnow() + self.timeout
395
self.send_changedstate()
595
396
self.last_enabled = datetime.datetime.utcnow()
597
self.send_changedstate()
599
def disable(self, quiet=True):
600
"""Disable this client."""
601
if not getattr(self, "enabled", False):
604
logger.info("Disabling client %s", self.name)
605
if getattr(self, "disable_initiator_tag", None) is not None:
606
gobject.source_remove(self.disable_initiator_tag)
607
self.disable_initiator_tag = None
609
if getattr(self, "checker_initiator_tag", None) is not None:
610
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = None
615
self.send_changedstate()
616
# Do not run this again if called by a gobject.timeout_add
622
def init_checker(self):
623
397
# Schedule a new checker to be started an 'interval' from now,
624
398
# and every interval from then on.
625
if self.checker_initiator_tag is not None:
626
gobject.source_remove(self.checker_initiator_tag)
627
399
self.checker_initiator_tag = (gobject.timeout_add
628
400
(self.interval_milliseconds(),
629
401
self.start_checker))
630
402
# Schedule a disable() when 'timeout' has passed
631
if self.disable_initiator_tag is not None:
632
gobject.source_remove(self.disable_initiator_tag)
403
self.expires = datetime.datetime.utcnow() + self.timeout
633
404
self.disable_initiator_tag = (gobject.timeout_add
634
405
(self.timeout_milliseconds(),
636
408
# Also start a new checker *right now*.
637
409
self.start_checker()
411
def disable(self, quiet=True):
412
"""Disable this client."""
413
if not getattr(self, "enabled", False):
416
self.send_changedstate()
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
420
gobject.source_remove(self.disable_initiator_tag)
421
self.disable_initiator_tag = None
423
if getattr(self, "checker_initiator_tag", False):
424
gobject.source_remove(self.checker_initiator_tag)
425
self.checker_initiator_tag = None
427
if self.disable_hook:
428
self.disable_hook(self)
430
# Do not run this again if called by a gobject.timeout_add
434
self.disable_hook = None
639
437
def checker_callback(self, pid, condition, command):
640
438
"""The checker has completed, so take appropriate actions."""
641
439
self.checker_callback_tag = None
642
440
self.checker = None
643
441
if os.WIFEXITED(condition):
644
self.last_checker_status = os.WEXITSTATUS(condition)
645
if self.last_checker_status == 0:
442
exitstatus = os.WEXITSTATUS(condition)
646
444
logger.info("Checker for %(name)s succeeded",
648
446
self.checked_ok()
870
614
class DBusObjectWithProperties(dbus.service.Object):
871
615
"""A D-Bus object with properties.
873
617
Classes inheriting from this can use the dbus_service_property
874
618
decorator to expose methods as D-Bus properties. It exposes the
875
619
standard Get(), Set(), and GetAll() methods on the D-Bus.
879
def _is_dbus_thing(thing):
880
"""Returns a function testing if an attribute is a D-Bus thing
882
If called like _is_dbus_thing("method") it returns a function
883
suitable for use as predicate to inspect.getmembers().
885
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
623
def _is_dbus_property(obj):
624
return getattr(obj, "_dbus_is_property", False)
888
def _get_all_dbus_things(self, thing):
626
def _get_all_dbus_properties(self):
889
627
"""Returns a generator of (name, attribute) pairs
891
return ((getattr(athing.__get__(self), "_dbus_name",
893
athing.__get__(self))
894
for cls in self.__class__.__mro__
896
inspect.getmembers(cls,
897
self._is_dbus_thing(thing)))
629
return ((prop._dbus_name, prop)
631
inspect.getmembers(self, self._is_dbus_property))
899
633
def _get_dbus_property(self, interface_name, property_name):
900
634
"""Returns a bound method if one exists which is a D-Bus
901
635
property with the specified name and interface.
903
for cls in self.__class__.__mro__:
904
for name, value in (inspect.getmembers
906
self._is_dbus_thing("property"))):
907
if (value._dbus_name == property_name
908
and value._dbus_interface == interface_name):
909
return value.__get__(self)
637
for name in (property_name,
638
property_name + "_dbus_property"):
639
prop = getattr(self, name, None)
641
or not self._is_dbus_property(prop)
642
or prop._dbus_name != property_name
643
or (interface_name and prop._dbus_interface
644
and interface_name != prop._dbus_interface)):
911
647
# No such property
912
648
raise DBusPropertyNotFound(self.dbus_object_path + ":"
913
649
+ interface_name + "."
1047
747
except (AttributeError, xml.dom.DOMException,
1048
748
xml.parsers.expat.ExpatError) as error:
1049
749
logger.error("Failed to override Introspection method",
1051
751
return xmlstring
1054
def datetime_to_dbus(dt, variant_level=0):
1055
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1057
return dbus.String("", variant_level = variant_level)
1058
return dbus.String(dt.isoformat(),
1059
variant_level=variant_level)
1062
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1063
"""A class decorator; applied to a subclass of
1064
dbus.service.Object, it will add alternate D-Bus attributes with
1065
interface names according to the "alt_interface_names" mapping.
1068
@alternate_dbus_interfaces({"org.example.Interface":
1069
"net.example.AlternateInterface"})
1070
class SampleDBusObject(dbus.service.Object):
1071
@dbus.service.method("org.example.Interface")
1072
def SampleDBusMethod():
1075
The above "SampleDBusMethod" on "SampleDBusObject" will be
1076
reachable via two interfaces: "org.example.Interface" and
1077
"net.example.AlternateInterface", the latter of which will have
1078
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1079
"true", unless "deprecate" is passed with a False value.
1081
This works for methods and signals, and also for D-Bus properties
1082
(from DBusObjectWithProperties) and interfaces (from the
1083
dbus_interface_annotations decorator).
1086
for orig_interface_name, alt_interface_name in (
1087
alt_interface_names.iteritems()):
1089
interface_names = set()
1090
# Go though all attributes of the class
1091
for attrname, attribute in inspect.getmembers(cls):
1092
# Ignore non-D-Bus attributes, and D-Bus attributes
1093
# with the wrong interface name
1094
if (not hasattr(attribute, "_dbus_interface")
1095
or not attribute._dbus_interface
1096
.startswith(orig_interface_name)):
1098
# Create an alternate D-Bus interface name based on
1100
alt_interface = (attribute._dbus_interface
1101
.replace(orig_interface_name,
1102
alt_interface_name))
1103
interface_names.add(alt_interface)
1104
# Is this a D-Bus signal?
1105
if getattr(attribute, "_dbus_is_signal", False):
1106
# Extract the original non-method undecorated
1107
# function by black magic
1108
nonmethod_func = (dict(
1109
zip(attribute.func_code.co_freevars,
1110
attribute.__closure__))["func"]
1112
# Create a new, but exactly alike, function
1113
# object, and decorate it to be a new D-Bus signal
1114
# with the alternate D-Bus interface name
1115
new_function = (dbus.service.signal
1117
attribute._dbus_signature)
1118
(types.FunctionType(
1119
nonmethod_func.func_code,
1120
nonmethod_func.func_globals,
1121
nonmethod_func.func_name,
1122
nonmethod_func.func_defaults,
1123
nonmethod_func.func_closure)))
1124
# Copy annotations, if any
1126
new_function._dbus_annotations = (
1127
dict(attribute._dbus_annotations))
1128
except AttributeError:
1130
# Define a creator of a function to call both the
1131
# original and alternate functions, so both the
1132
# original and alternate signals gets sent when
1133
# the function is called
1134
def fixscope(func1, func2):
1135
"""This function is a scope container to pass
1136
func1 and func2 to the "call_both" function
1137
outside of its arguments"""
1138
def call_both(*args, **kwargs):
1139
"""This function will emit two D-Bus
1140
signals by calling func1 and func2"""
1141
func1(*args, **kwargs)
1142
func2(*args, **kwargs)
1144
# Create the "call_both" function and add it to
1146
attr[attrname] = fixscope(attribute, new_function)
1147
# Is this a D-Bus method?
1148
elif getattr(attribute, "_dbus_is_method", False):
1149
# Create a new, but exactly alike, function
1150
# object. Decorate it to be a new D-Bus method
1151
# with the alternate D-Bus interface name. Add it
1153
attr[attrname] = (dbus.service.method
1155
attribute._dbus_in_signature,
1156
attribute._dbus_out_signature)
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1163
# Copy annotations, if any
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1167
except AttributeError:
1169
# Is this a D-Bus property?
1170
elif getattr(attribute, "_dbus_is_property", False):
1171
# Create a new, but exactly alike, function
1172
# object, and decorate it to be a new D-Bus
1173
# property with the alternate D-Bus interface
1174
# name. Add it to the class.
1175
attr[attrname] = (dbus_service_property
1177
attribute._dbus_signature,
1178
attribute._dbus_access,
1180
._dbus_get_args_options
1183
(attribute.func_code,
1184
attribute.func_globals,
1185
attribute.func_name,
1186
attribute.func_defaults,
1187
attribute.func_closure)))
1188
# Copy annotations, if any
1190
attr[attrname]._dbus_annotations = (
1191
dict(attribute._dbus_annotations))
1192
except AttributeError:
1194
# Is this a D-Bus interface?
1195
elif getattr(attribute, "_dbus_is_interface", False):
1196
# Create a new, but exactly alike, function
1197
# object. Decorate it to be a new D-Bus interface
1198
# with the alternate D-Bus interface name. Add it
1200
attr[attrname] = (dbus_interface_annotations
1203
(attribute.func_code,
1204
attribute.func_globals,
1205
attribute.func_name,
1206
attribute.func_defaults,
1207
attribute.func_closure)))
1209
# Deprecate all alternate interfaces
1210
iname="_AlternateDBusNames_interface_annotation{0}"
1211
for interface_name in interface_names:
1212
@dbus_interface_annotations(interface_name)
1214
return { "org.freedesktop.DBus.Deprecated":
1216
# Find an unused name
1217
for aname in (iname.format(i)
1218
for i in itertools.count()):
1219
if aname not in attr:
1223
# Replace the class with a new subclass of it with
1224
# methods, signals, etc. as created above.
1225
cls = type(b"{0}Alternate".format(cls.__name__),
1231
@alternate_dbus_interfaces({"se.recompile.Mandos":
1232
"se.bsnet.fukt.Mandos"})
1233
754
class ClientDBus(Client, DBusObjectWithProperties):
1234
755
"""A Client class using D-Bus
1255
777
("/clients/" + client_object_name))
1256
778
DBusObjectWithProperties.__init__(self, self.bus,
1257
779
self.dbus_object_path)
1259
def notifychangeproperty(transform_func,
1260
dbus_name, type_func=lambda x: x,
1262
""" Modify a variable so that it's a property which announces
1263
its changes to DBus.
1265
transform_fun: Function that takes a value and a variant_level
1266
and transforms it to a D-Bus type.
1267
dbus_name: D-Bus name of the variable
1268
type_func: Function that transform the value before sending it
1269
to the D-Bus. Default: no transform
1270
variant_level: D-Bus variant level. Default: 1
1272
attrname = "_{0}".format(dbus_name)
1273
def setter(self, value):
1274
if hasattr(self, "dbus_object_path"):
1275
if (not hasattr(self, attrname) or
1276
type_func(getattr(self, attrname, None))
1277
!= type_func(value)):
1278
dbus_value = transform_func(type_func(value),
1281
self.PropertyChanged(dbus.String(dbus_name),
1283
setattr(self, attrname, value)
1285
return property(lambda self: getattr(self, attrname), setter)
1287
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1288
approvals_pending = notifychangeproperty(dbus.Boolean,
1291
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1292
last_enabled = notifychangeproperty(datetime_to_dbus,
1294
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1295
type_func = lambda checker:
1296
checker is not None)
1297
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1299
last_checker_status = notifychangeproperty(dbus.Int16,
1300
"LastCheckerStatus")
1301
last_approval_request = notifychangeproperty(
1302
datetime_to_dbus, "LastApprovalRequest")
1303
approved_by_default = notifychangeproperty(dbus.Boolean,
1304
"ApprovedByDefault")
1305
approval_delay = notifychangeproperty(dbus.UInt64,
1308
timedelta_to_milliseconds)
1309
approval_duration = notifychangeproperty(
1310
dbus.UInt64, "ApprovalDuration",
1311
type_func = timedelta_to_milliseconds)
1312
host = notifychangeproperty(dbus.String, "Host")
1313
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1315
timedelta_to_milliseconds)
1316
extended_timeout = notifychangeproperty(
1317
dbus.UInt64, "ExtendedTimeout",
1318
type_func = timedelta_to_milliseconds)
1319
interval = notifychangeproperty(dbus.UInt64,
1322
timedelta_to_milliseconds)
1323
checker_command = notifychangeproperty(dbus.String, "Checker")
1325
del notifychangeproperty
780
def _set_expires(self, value):
781
old_value = getattr(self, "_expires", None)
782
self._expires = value
783
if hasattr(self, "dbus_object_path") and old_value != value:
784
dbus_time = (self._datetime_to_dbus(self._expires,
786
self.PropertyChanged(dbus.String("Expires"),
788
expires = property(lambda self: self._expires, _set_expires)
791
def _get_approvals_pending(self):
792
return self._approvals_pending
793
def _set_approvals_pending(self, value):
794
old_value = self._approvals_pending
795
self._approvals_pending = value
797
if (hasattr(self, "dbus_object_path")
798
and bval is not bool(old_value)):
799
dbus_bool = dbus.Boolean(bval, variant_level=1)
800
self.PropertyChanged(dbus.String("ApprovalPending"),
803
approvals_pending = property(_get_approvals_pending,
804
_set_approvals_pending)
805
del _get_approvals_pending, _set_approvals_pending
808
def _datetime_to_dbus(dt, variant_level=0):
809
"""Convert a UTC datetime.datetime() to a D-Bus type."""
811
return dbus.String("", variant_level = variant_level)
812
return dbus.String(dt.isoformat(),
813
variant_level=variant_level)
816
oldstate = getattr(self, "enabled", False)
817
r = Client.enable(self)
818
if oldstate != self.enabled:
820
self.PropertyChanged(dbus.String("Enabled"),
821
dbus.Boolean(True, variant_level=1))
822
self.PropertyChanged(
823
dbus.String("LastEnabled"),
824
self._datetime_to_dbus(self.last_enabled,
828
def disable(self, quiet = False):
829
oldstate = getattr(self, "enabled", False)
830
r = Client.disable(self, quiet=quiet)
831
if not quiet and oldstate != self.enabled:
833
self.PropertyChanged(dbus.String("Enabled"),
834
dbus.Boolean(False, variant_level=1))
1327
837
def __del__(self, *args, **kwargs):
1352
865
return Client.checker_callback(self, pid, condition, command,
1353
866
*args, **kwargs)
868
def checked_ok(self, *args, **kwargs):
869
Client.checked_ok(self, *args, **kwargs)
871
self.PropertyChanged(
872
dbus.String("LastCheckedOK"),
873
(self._datetime_to_dbus(self.last_checked_ok,
876
def need_approval(self, *args, **kwargs):
877
r = Client.need_approval(self, *args, **kwargs)
879
self.PropertyChanged(
880
dbus.String("LastApprovalRequest"),
881
(self._datetime_to_dbus(self.last_approval_request,
1355
885
def start_checker(self, *args, **kwargs):
1356
old_checker_pid = getattr(self.checker, "pid", None)
886
old_checker = self.checker
887
if self.checker is not None:
888
old_checker_pid = self.checker.pid
890
old_checker_pid = None
1357
891
r = Client.start_checker(self, *args, **kwargs)
1358
892
# Only if new checker process was started
1359
893
if (self.checker is not None
1360
894
and old_checker_pid != self.checker.pid):
1361
895
# Emit D-Bus signal
1362
896
self.CheckerStarted(self.current_checker_command)
897
self.PropertyChanged(
898
dbus.String("CheckerRunning"),
899
dbus.Boolean(True, variant_level=1))
902
def stop_checker(self, *args, **kwargs):
903
old_checker = getattr(self, "checker", None)
904
r = Client.stop_checker(self, *args, **kwargs)
905
if (old_checker is not None
906
and getattr(self, "checker", None) is None):
907
self.PropertyChanged(dbus.String("CheckerRunning"),
908
dbus.Boolean(False, variant_level=1))
1365
911
def _reset_approved(self):
1366
self.approved = None
912
self._approved = None
1369
915
def approve(self, value=True):
1370
self.approved = value
1371
gobject.timeout_add(timedelta_to_milliseconds
916
self.send_changedstate()
917
self._approved = value
918
gobject.timeout_add(self._timedelta_to_milliseconds
1372
919
(self.approval_duration),
1373
920
self._reset_approved)
1374
self.send_changedstate()
1376
923
## D-Bus methods, signals & properties
1377
_interface = "se.recompile.Mandos.Client"
1381
@dbus_interface_annotations(_interface)
1383
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
924
_interface = "se.bsnet.fukt.Mandos.Client"
1561
1115
def Timeout_dbus_property(self, value=None):
1562
1116
if value is None: # get
1563
1117
return dbus.UInt64(self.timeout_milliseconds())
1564
old_timeout = self.timeout
1118
old_value = self.timeout
1565
1119
self.timeout = datetime.timedelta(0, 0, 0, value)
1566
# Reschedule disabling
1568
now = datetime.datetime.utcnow()
1569
self.expires += self.timeout - old_timeout
1570
if self.expires <= now:
1571
# The timeout has passed
1574
if (getattr(self, "disable_initiator_tag", None)
1577
gobject.source_remove(self.disable_initiator_tag)
1578
self.disable_initiator_tag = (
1579
gobject.timeout_add(
1580
timedelta_to_milliseconds(self.expires - now),
1121
if old_value != self.timeout:
1122
self.PropertyChanged(dbus.String("Timeout"),
1123
dbus.UInt64(value, variant_level=1))
1124
if getattr(self, "disable_initiator_tag", None) is None:
1126
# Reschedule timeout
1127
gobject.source_remove(self.disable_initiator_tag)
1128
self.disable_initiator_tag = None
1130
time_to_die = (self.
1131
_timedelta_to_milliseconds((self
1136
if time_to_die <= 0:
1137
# The timeout has passed
1140
self.expires = (datetime.datetime.utcnow()
1141
+ datetime.timedelta(milliseconds = time_to_die))
1142
self.disable_initiator_tag = (gobject.timeout_add
1143
(time_to_die, self.disable))
1583
1145
# ExtendedTimeout - property
1584
1146
@dbus_service_property(_interface, signature="t",
1585
1147
access="readwrite")
1586
1148
def ExtendedTimeout_dbus_property(self, value=None):
1587
1149
if value is None: # get
1588
1150
return dbus.UInt64(self.extended_timeout_milliseconds())
1151
old_value = self.extended_timeout
1589
1152
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1154
if old_value != self.extended_timeout:
1155
self.PropertyChanged(dbus.String("ExtendedTimeout"),
1156
dbus.UInt64(value, variant_level=1))
1591
1158
# Interval - property
1592
1159
@dbus_service_property(_interface, signature="t",
1593
1160
access="readwrite")
1594
1161
def Interval_dbus_property(self, value=None):
1595
1162
if value is None: # get
1596
1163
return dbus.UInt64(self.interval_milliseconds())
1164
old_value = self.interval
1597
1165
self.interval = datetime.timedelta(0, 0, 0, value)
1167
if old_value != self.interval:
1168
self.PropertyChanged(dbus.String("Interval"),
1169
dbus.UInt64(value, variant_level=1))
1598
1170
if getattr(self, "checker_initiator_tag", None) is None:
1601
# Reschedule checker run
1602
gobject.source_remove(self.checker_initiator_tag)
1603
self.checker_initiator_tag = (gobject.timeout_add
1604
(value, self.start_checker))
1605
self.start_checker() # Start one now, too
1172
# Reschedule checker run
1173
gobject.source_remove(self.checker_initiator_tag)
1174
self.checker_initiator_tag = (gobject.timeout_add
1175
(value, self.start_checker))
1176
self.start_checker() # Start one now, too
1607
1178
# Checker - property
1608
1179
@dbus_service_property(_interface, signature="s",
1609
1180
access="readwrite")
1610
1181
def Checker_dbus_property(self, value=None):
1611
1182
if value is None: # get
1612
1183
return dbus.String(self.checker_command)
1613
self.checker_command = unicode(value)
1184
old_value = self.checker_command
1185
self.checker_command = value
1187
if old_value != self.checker_command:
1188
self.PropertyChanged(dbus.String("Checker"),
1189
dbus.String(self.checker_command,
1615
1192
# CheckerRunning - property
1616
1193
@dbus_service_property(_interface, signature="b",
2027
1566
def __init__(self, server_address, RequestHandlerClass,
2028
1567
interface=None, use_ipv6=True, clients=None,
2029
gnutls_priority=None, use_dbus=True, socketfd=None):
1568
gnutls_priority=None, use_dbus=True):
2030
1569
self.enabled = False
2031
1570
self.clients = clients
2032
1571
if self.clients is None:
1572
self.clients = set()
2034
1573
self.use_dbus = use_dbus
2035
1574
self.gnutls_priority = gnutls_priority
2036
1575
IPv6_TCPServer.__init__(self, server_address,
2037
1576
RequestHandlerClass,
2038
1577
interface = interface,
2039
use_ipv6 = use_ipv6,
2040
socketfd = socketfd)
1578
use_ipv6 = use_ipv6)
2041
1579
def server_activate(self):
2042
1580
if self.enabled:
2043
1581
return socketserver.TCPServer.server_activate(self)
2045
1582
def enable(self):
2046
1583
self.enabled = True
2048
def add_pipe(self, parent_pipe, proc):
1584
def add_pipe(self, parent_pipe):
2049
1585
# Call "handle_ipc" for both data and EOF events
2050
1586
gobject.io_add_watch(parent_pipe.fileno(),
2051
1587
gobject.IO_IN | gobject.IO_HUP,
2052
1588
functools.partial(self.handle_ipc,
1589
parent_pipe = parent_pipe))
2057
1591
def handle_ipc(self, source, condition, parent_pipe=None,
2058
proc = None, client_object=None):
2059
# error, or the other end of multiprocessing.Pipe has closed
2060
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2061
# Wait for other process to exit
1592
client_object=None):
1594
gobject.IO_IN: "IN", # There is data to read.
1595
gobject.IO_OUT: "OUT", # Data can be written (without
1597
gobject.IO_PRI: "PRI", # There is urgent data to read.
1598
gobject.IO_ERR: "ERR", # Error condition.
1599
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1600
# broken, usually for pipes and
1603
conditions_string = ' | '.join(name
1605
condition_names.iteritems()
1606
if cond & condition)
1607
# error or the other end of multiprocessing.Pipe has closed
1608
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2065
1611
# Read a request from the child
2079
1625
"dress: %s", fpr, address)
2080
1626
if self.use_dbus:
2081
1627
# Emit D-Bus signal
2082
mandos_dbus_service.ClientNotFound(fpr,
1628
mandos_dbus_service.ClientNotFound(fpr, address[0])
2084
1629
parent_pipe.send(False)
2087
1632
gobject.io_add_watch(parent_pipe.fileno(),
2088
1633
gobject.IO_IN | gobject.IO_HUP,
2089
1634
functools.partial(self.handle_ipc,
1635
parent_pipe = parent_pipe,
1636
client_object = client))
2095
1637
parent_pipe.send(True)
2096
# remove the old hook in favor of the new above hook on
1638
# remove the old hook in favor of the new above hook on same fileno
2099
1640
if command == 'funcall':
2100
1641
funcname = request[1]
2101
1642
args = request[2]
2102
1643
kwargs = request[3]
2104
parent_pipe.send(('data', getattr(client_object,
1645
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
2108
1647
if command == 'getattr':
2109
1648
attrname = request[1]
2110
1649
if callable(client_object.__getattribute__(attrname)):
2111
1650
parent_pipe.send(('function',))
2113
parent_pipe.send(('data', client_object
2114
.__getattribute__(attrname)))
1652
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2116
1654
if command == 'setattr':
2117
1655
attrname = request[1]
2118
1656
value = request[2]
2119
1657
setattr(client_object, attrname, value)
2124
def rfc3339_duration_to_delta(duration):
2125
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2127
>>> rfc3339_duration_to_delta("P7D")
2128
datetime.timedelta(7)
2129
>>> rfc3339_duration_to_delta("PT60S")
2130
datetime.timedelta(0, 60)
2131
>>> rfc3339_duration_to_delta("PT60M")
2132
datetime.timedelta(0, 3600)
2133
>>> rfc3339_duration_to_delta("PT24H")
2134
datetime.timedelta(1)
2135
>>> rfc3339_duration_to_delta("P1W")
2136
datetime.timedelta(7)
2137
>>> rfc3339_duration_to_delta("PT5M30S")
2138
datetime.timedelta(0, 330)
2139
>>> rfc3339_duration_to_delta("P1DT3M20S")
2140
datetime.timedelta(1, 200)
2143
# Parsing an RFC 3339 duration with regular expressions is not
2144
# possible - there would have to be multiple places for the same
2145
# values, like seconds. The current code, while more esoteric, is
2146
# cleaner without depending on a parsing library. If Python had a
2147
# built-in library for parsing we would use it, but we'd like to
2148
# avoid excessive use of external libraries.
2150
# New type for defining tokens, syntax, and semantics all-in-one
2151
Token = collections.namedtuple("Token",
2152
("regexp", # To match token; if
2153
# "value" is not None,
2154
# must have a "group"
2156
"value", # datetime.timedelta or
2158
"followers")) # Tokens valid after
2160
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2161
# the "duration" ABNF definition in RFC 3339, Appendix A.
2162
token_end = Token(re.compile(r"$"), None, frozenset())
2163
token_second = Token(re.compile(r"(\d+)S"),
2164
datetime.timedelta(seconds=1),
2165
frozenset((token_end,)))
2166
token_minute = Token(re.compile(r"(\d+)M"),
2167
datetime.timedelta(minutes=1),
2168
frozenset((token_second, token_end)))
2169
token_hour = Token(re.compile(r"(\d+)H"),
2170
datetime.timedelta(hours=1),
2171
frozenset((token_minute, token_end)))
2172
token_time = Token(re.compile(r"T"),
2174
frozenset((token_hour, token_minute,
2176
token_day = Token(re.compile(r"(\d+)D"),
2177
datetime.timedelta(days=1),
2178
frozenset((token_time, token_end)))
2179
token_month = Token(re.compile(r"(\d+)M"),
2180
datetime.timedelta(weeks=4),
2181
frozenset((token_day, token_end)))
2182
token_year = Token(re.compile(r"(\d+)Y"),
2183
datetime.timedelta(weeks=52),
2184
frozenset((token_month, token_end)))
2185
token_week = Token(re.compile(r"(\d+)W"),
2186
datetime.timedelta(weeks=1),
2187
frozenset((token_end,)))
2188
token_duration = Token(re.compile(r"P"), None,
2189
frozenset((token_year, token_month,
2190
token_day, token_time,
2192
# Define starting values
2193
value = datetime.timedelta() # Value so far
2195
followers = frozenset((token_duration,)) # Following valid tokens
2196
s = duration # String left to parse
2197
# Loop until end token is found
2198
while found_token is not token_end:
2199
# Search for any currently valid tokens
2200
for token in followers:
2201
match = token.regexp.match(s)
2202
if match is not None:
2204
if token.value is not None:
2205
# Value found, parse digits
2206
factor = int(match.group(1), 10)
2207
# Add to value so far
2208
value += factor * token.value
2209
# Strip token from string
2210
s = token.regexp.sub("", s, 1)
2213
# Set valid next tokens
2214
followers = found_token.followers
2217
# No currently valid tokens were found
2218
raise ValueError("Invalid RFC 3339 duration")
2223
1662
def string_to_delta(interval):
2224
1663
"""Parse a string and return a datetime.timedelta
2405
1831
for option in server_settings.keys():
2406
1832
if type(server_settings[option]) is str:
2407
1833
server_settings[option] = unicode(server_settings[option])
2408
# Force all boolean options to be boolean
2409
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2410
"foreground", "zeroconf"):
2411
server_settings[option] = bool(server_settings[option])
2412
# Debug implies foreground
2413
if server_settings["debug"]:
2414
server_settings["foreground"] = True
2415
1834
# Now we have our good server settings in "server_settings"
2417
1836
##################################################################
2419
if (not server_settings["zeroconf"] and
2420
not (server_settings["port"]
2421
or server_settings["socket"] != "")):
2422
parser.error("Needs port or socket to work without"
2425
1838
# For convenience
2426
1839
debug = server_settings["debug"]
2427
1840
debuglevel = server_settings["debuglevel"]
2428
1841
use_dbus = server_settings["use_dbus"]
2429
1842
use_ipv6 = server_settings["use_ipv6"]
2430
stored_state_path = os.path.join(server_settings["statedir"],
2432
foreground = server_settings["foreground"]
2433
zeroconf = server_settings["zeroconf"]
2436
initlogger(debug, logging.DEBUG)
2441
level = getattr(logging, debuglevel.upper())
2442
initlogger(debug, level)
2444
1844
if server_settings["servicename"] != "Mandos":
2445
1845
syslogger.setFormatter(logging.Formatter
2446
('Mandos ({0}) [%(process)d]:'
2447
' %(levelname)s: %(message)s'
2448
.format(server_settings
1846
('Mandos (%s) [%%(process)d]:'
1847
' %%(levelname)s: %%(message)s'
1848
% server_settings["servicename"]))
2451
1850
# Parse config file with clients
2452
client_config = configparser.SafeConfigParser(Client
1851
client_defaults = { "timeout": "5m",
1852
"extended_timeout": "15m",
1854
"checker": "fping -q -- %%(host)s",
1856
"approval_delay": "0s",
1857
"approval_duration": "1s",
1859
client_config = configparser.SafeConfigParser(client_defaults)
2454
1860
client_config.read(os.path.join(server_settings["configdir"],
2455
1861
"clients.conf"))
2457
1863
global mandos_dbus_service
2458
1864
mandos_dbus_service = None
2461
if server_settings["socket"] != "":
2462
socketfd = server_settings["socket"]
2463
1866
tcp_server = MandosServer((server_settings["address"],
2464
1867
server_settings["port"]),
2513
1923
.gnutls_global_set_log_function(debug_gnutls))
2515
1925
# Redirect stdin so all checkers get /dev/null
2516
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1926
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2517
1927
os.dup2(null, sys.stdin.fileno())
1931
# No console logging
1932
logger.removeHandler(console)
2521
1934
# Need to fork before connecting to D-Bus
2523
1936
# Close all input and output, do double fork, etc.
2526
# multiprocessing will use threads, so before we use gobject we
2527
# need to inform gobject that threads will be used.
2528
gobject.threads_init()
2530
1939
global main_loop
2531
1940
# From the Avahi example code
2532
DBusGMainLoop(set_as_default=True)
1941
DBusGMainLoop(set_as_default=True )
2533
1942
main_loop = gobject.MainLoop()
2534
1943
bus = dbus.SystemBus()
2535
1944
# End of Avahi example code
2538
bus_name = dbus.service.BusName("se.recompile.Mandos",
1947
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2539
1948
bus, do_not_queue=True)
2540
old_bus_name = (dbus.service.BusName
2541
("se.bsnet.fukt.Mandos", bus,
2543
1949
except dbus.exceptions.NameExistsException as e:
2544
logger.error("Disabling D-Bus:", exc_info=e)
1950
logger.error(unicode(e) + ", disabling D-Bus")
2545
1951
use_dbus = False
2546
1952
server_settings["use_dbus"] = False
2547
1953
tcp_server.use_dbus = False
2549
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2550
service = AvahiServiceToSyslog(name =
2551
server_settings["servicename"],
2552
servicetype = "_mandos._tcp",
2553
protocol = protocol, bus = bus)
2554
if server_settings["interface"]:
2555
service.interface = (if_nametoindex
2556
(str(server_settings["interface"])))
1954
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1955
service = AvahiService(name = server_settings["servicename"],
1956
servicetype = "_mandos._tcp",
1957
protocol = protocol, bus = bus)
1958
if server_settings["interface"]:
1959
service.interface = (if_nametoindex
1960
(str(server_settings["interface"])))
2558
1962
global multiprocessing_manager
2559
1963
multiprocessing_manager = multiprocessing.Manager()
2561
1965
client_class = Client
2563
1967
client_class = functools.partial(ClientDBus, bus = bus)
2565
client_settings = Client.config_parser(client_config)
2566
old_client_settings = {}
2569
# This is used to redirect stdout and stderr for checker processes
2571
wnull = open(os.devnull, "w") # A writable /dev/null
2572
# Only used if server is running in foreground but not in debug
2574
if debug or not foreground:
2577
# Get client data and settings from last running state.
2578
if server_settings["restore"]:
2580
with open(stored_state_path, "rb") as stored_state:
2581
clients_data, old_client_settings = (pickle.load
2583
os.remove(stored_state_path)
2584
except IOError as e:
2585
if e.errno == errno.ENOENT:
2586
logger.warning("Could not load persistent state: {0}"
2587
.format(os.strerror(e.errno)))
2589
logger.critical("Could not load persistent state:",
2592
except EOFError as e:
2593
logger.warning("Could not load persistent state: "
2594
"EOFError:", exc_info=e)
2596
with PGPEngine() as pgp:
2597
for client_name, client in clients_data.iteritems():
2598
# Skip removed clients
2599
if client_name not in client_settings:
2602
# Decide which value to use after restoring saved state.
2603
# We have three different values: Old config file,
2604
# new config file, and saved state.
2605
# New config value takes precedence if it differs from old
2606
# config value, otherwise use saved state.
2607
for name, value in client_settings[client_name].items():
2609
# For each value in new config, check if it
2610
# differs from the old config value (Except for
2611
# the "secret" attribute)
2612
if (name != "secret" and
2613
value != old_client_settings[client_name]
2615
client[name] = value
2619
# Clients who has passed its expire date can still be
2620
# enabled if its last checker was successful. Clients
2621
# whose checker succeeded before we stored its state is
2622
# assumed to have successfully run all checkers during
2624
if client["enabled"]:
2625
if datetime.datetime.utcnow() >= client["expires"]:
2626
if not client["last_checked_ok"]:
2628
"disabling client {0} - Client never "
2629
"performed a successful checker"
2630
.format(client_name))
2631
client["enabled"] = False
2632
elif client["last_checker_status"] != 0:
2634
"disabling client {0} - Client "
2635
"last checker failed with error code {1}"
2636
.format(client_name,
2637
client["last_checker_status"]))
2638
client["enabled"] = False
2640
client["expires"] = (datetime.datetime
2642
+ client["timeout"])
2643
logger.debug("Last checker succeeded,"
2644
" keeping {0} enabled"
2645
.format(client_name))
1968
def client_config_items(config, section):
1969
special_settings = {
1970
"approved_by_default":
1971
lambda: config.getboolean(section,
1972
"approved_by_default"),
1974
for name, value in config.items(section):
2647
client["secret"] = (
2648
pgp.decrypt(client["encrypted_secret"],
2649
client_settings[client_name]
2652
# If decryption fails, we use secret from new settings
2653
logger.debug("Failed to decrypt {0} old secret"
2654
.format(client_name))
2655
client["secret"] = (
2656
client_settings[client_name]["secret"])
2658
# Add/remove clients based on new changes made to config
2659
for client_name in (set(old_client_settings)
2660
- set(client_settings)):
2661
del clients_data[client_name]
2662
for client_name in (set(client_settings)
2663
- set(old_client_settings)):
2664
clients_data[client_name] = client_settings[client_name]
2666
# Create all client objects
2667
for client_name, client in clients_data.iteritems():
2668
tcp_server.clients[client_name] = client_class(
2669
name = client_name, settings = client,
2670
server_settings = server_settings)
1976
yield (name, special_settings[name]())
1980
tcp_server.clients.update(set(
1981
client_class(name = section,
1982
config= dict(client_config_items(
1983
client_config, section)))
1984
for section in client_config.sections()))
2672
1985
if not tcp_server.clients:
2673
1986
logger.warning("No clients defined")
2676
if pidfile is not None:
2680
pidfile.write(str(pid) + "\n".encode("utf-8"))
2682
logger.error("Could not write to file %r with PID %d",
1992
pidfile.write(str(pid) + "\n".encode("utf-8"))
1995
logger.error("Could not write to file %r with PID %d",
1998
# "pidfile" was never created
2685
2000
del pidfilename
2002
signal.signal(signal.SIGINT, signal.SIG_IGN)
2687
2004
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2688
2005
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2691
@alternate_dbus_interfaces({"se.recompile.Mandos":
2692
"se.bsnet.fukt.Mandos"})
2693
class MandosDBusService(DBusObjectWithProperties):
2008
class MandosDBusService(dbus.service.Object):
2694
2009
"""A D-Bus proxy object"""
2695
2010
def __init__(self):
2696
2011
dbus.service.Object.__init__(self, bus, "/")
2697
_interface = "se.recompile.Mandos"
2699
@dbus_interface_annotations(_interface)
2701
return { "org.freedesktop.DBus.Property"
2702
".EmitsChangedSignal":
2012
_interface = "se.bsnet.fukt.Mandos"
2705
2014
@dbus.service.signal(_interface, signature="o")
2706
2015
def ClientAdded(self, objpath):
2755
2063
"Cleanup function; run on exit"
2759
multiprocessing.active_children()
2761
if not (tcp_server.clients or client_settings):
2764
# Store client before exiting. Secrets are encrypted with key
2765
# based on what config file has. If config file is
2766
# removed/edited, old secret will thus be unrecovable.
2768
with PGPEngine() as pgp:
2769
for client in tcp_server.clients.itervalues():
2770
key = client_settings[client.name]["secret"]
2771
client.encrypted_secret = pgp.encrypt(client.secret,
2775
# A list of attributes that can not be pickled
2777
exclude = set(("bus", "changedstate", "secret",
2778
"checker", "server_settings"))
2779
for name, typ in (inspect.getmembers
2780
(dbus.service.Object)):
2783
client_dict["encrypted_secret"] = (client
2785
for attr in client.client_structure:
2786
if attr not in exclude:
2787
client_dict[attr] = getattr(client, attr)
2789
clients[client.name] = client_dict
2790
del client_settings[client.name]["secret"]
2793
with (tempfile.NamedTemporaryFile
2794
(mode='wb', suffix=".pickle", prefix='clients-',
2795
dir=os.path.dirname(stored_state_path),
2796
delete=False)) as stored_state:
2797
pickle.dump((clients, client_settings), stored_state)
2798
tempname=stored_state.name
2799
os.rename(tempname, stored_state_path)
2800
except (IOError, OSError) as e:
2806
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2807
logger.warning("Could not save persistent state: {0}"
2808
.format(os.strerror(e.errno)))
2810
logger.warning("Could not save persistent state:",
2814
# Delete all clients, and settings from config
2815
2066
while tcp_server.clients:
2816
name, client = tcp_server.clients.popitem()
2067
client = tcp_server.clients.pop()
2818
2069
client.remove_from_connection()
2070
client.disable_hook = None
2819
2071
# Don't signal anything except ClientRemoved
2820
2072
client.disable(quiet=True)
2822
2074
# Emit D-Bus signal
2823
mandos_dbus_service.ClientRemoved(client
2075
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2826
client_settings.clear()
2828
2078
atexit.register(cleanup)
2830
for client in tcp_server.clients.itervalues():
2080
for client in tcp_server.clients:
2832
2082
# Emit D-Bus signal
2833
2083
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2834
# Need to initiate checking of clients
2836
client.init_checker()
2838
2086
tcp_server.enable()
2839
2087
tcp_server.server_activate()
2841
2089
# Find out what port we got
2843
service.port = tcp_server.socket.getsockname()[1]
2090
service.port = tcp_server.socket.getsockname()[1]
2845
2092
logger.info("Now listening on address %r, port %d,"
2846
" flowinfo %d, scope_id %d",
2847
*tcp_server.socket.getsockname())
2093
" flowinfo %d, scope_id %d"
2094
% tcp_server.socket.getsockname())
2849
logger.info("Now listening on address %r, port %d",
2850
*tcp_server.socket.getsockname())
2096
logger.info("Now listening on address %r, port %d"
2097
% tcp_server.socket.getsockname())
2852
2099
#service.interface = tcp_server.socket.getsockname()[3]
2856
# From the Avahi example code
2859
except dbus.exceptions.DBusException as error:
2860
logger.critical("D-Bus Exception", exc_info=error)
2863
# End of Avahi example code
2102
# From the Avahi example code
2105
except dbus.exceptions.DBusException as error:
2106
logger.critical("DBusException: %s", error)
2109
# End of Avahi example code
2865
2111
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2866
2112
lambda *args, **kwargs: