To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 502
- compare with another revision
- download diff
- download tarball
- view history from revision 502
- Committer: Teddy Hogeborn
- Date: 2011-09-26 19:36:18 UTC
- mfrom: (24.1.184 mandos)
- Revision ID: teddy@fukt.bsnet.se-20110926193618-vtj5c9hena1maixx
Merge from Björn
- files removed:
- debian/mandos-client.examples
- debian/upstream
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
37
import SocketServer as socketserver
43
38
import socket
44
39
import argparse
45
40
import datetime
46
41
import errno
47
try:
48
import ConfigParser as configparser
49
except ImportError:
50
import configparser
42
import gnutls.crypto
43
import gnutls.connection
44
import gnutls.errors
45
import gnutls.library.functions
46
import gnutls.library.constants
47
import gnutls.library.types
48
import ConfigParser as configparser
51
49
import sys
52
50
import re
53
51
import os
62
60
import struct
63
61
import fcntl
64
62
import functools
65
try:
66
import cPickle as pickle
67
except ImportError:
68
import pickle
63
import cPickle as pickle
69
64
import multiprocessing
70
import types
71
import binascii
72
import tempfile
73
import itertools
74
import collections
75
import codecs
76
65
77
66
import dbus
78
67
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
68
import gobject
83
69
import avahi
84
70
from dbus.mainloop.glib import DBusGMainLoop
85
71
import ctypes
95
81
except ImportError:
96
82
SO_BINDTODEVICE = None
97
83
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.1"
102
stored_state_file = "clients.pickle"
103
104
logger = logging.getLogger()
105
syslogger = None
106
107
try:
108
if_nametoindex = ctypes.cdll.LoadLibrary(
109
ctypes.util.find_library("c")).if_nametoindex
110
except (OSError, AttributeError):
111
112
def if_nametoindex(interface):
113
"Get an interface index the hard way, i.e. using fcntl()"
114
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
115
with contextlib.closing(socket.socket()) as s:
116
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
117
struct.pack(b"16s16x", interface))
118
interface_index = struct.unpack("I", ifreq[16:20])[0]
119
return interface_index
120
121
122
def initlogger(debug, level=logging.WARNING):
123
"""init logger and add loglevel"""
124
125
global syslogger
126
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
129
syslogger.setFormatter(logging.Formatter
130
('Mandos [%(process)d]: %(levelname)s:'
131
' %(message)s'))
132
logger.addHandler(syslogger)
133
134
if debug:
135
console = logging.StreamHandler()
136
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
137
' [%(process)d]:'
138
' %(levelname)s:'
139
' %(message)s'))
140
logger.addHandler(console)
141
logger.setLevel(level)
142
143
144
class PGPError(Exception):
145
"""Exception if encryption/decryption fails"""
146
pass
147
148
149
class PGPEngine(object):
150
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
152
def __init__(self):
153
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
self.gnupgargs = ['--batch',
155
'--home', self.tempdir,
156
'--force-mdc',
157
'--quiet',
158
'--no-use-agent']
159
160
def __enter__(self):
161
return self
162
163
def __exit__(self, exc_type, exc_value, traceback):
164
self._cleanup()
165
return False
166
167
def __del__(self):
168
self._cleanup()
169
170
def _cleanup(self):
171
if self.tempdir is not None:
172
# Delete contents of tempdir
173
for root, dirs, files in os.walk(self.tempdir,
174
topdown = False):
175
for filename in files:
176
os.remove(os.path.join(root, filename))
177
for dirname in dirs:
178
os.rmdir(os.path.join(root, dirname))
179
# Remove tempdir
180
os.rmdir(self.tempdir)
181
self.tempdir = None
182
183
def password_encode(self, password):
184
# Passphrase can not be empty and can not contain newlines or
185
# NUL bytes. So we prefix it and hex encode it.
186
encoded = b"mandos" + binascii.hexlify(password)
187
if len(encoded) > 2048:
188
# GnuPG can't handle long passwords, so encode differently
189
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
190
.replace(b"\n", b"\\n")
191
.replace(b"\0", b"\\x00"))
192
return encoded
193
194
def encrypt(self, data, password):
195
passphrase = self.password_encode(password)
196
with tempfile.NamedTemporaryFile(
197
dir=self.tempdir) as passfile:
198
passfile.write(passphrase)
199
passfile.flush()
200
proc = subprocess.Popen(['gpg', '--symmetric',
201
'--passphrase-file',
202
passfile.name]
203
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
208
if proc.returncode != 0:
209
raise PGPError(err)
210
return ciphertext
211
212
def decrypt(self, data, password):
213
passphrase = self.password_encode(password)
214
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
216
passfile.write(passphrase)
217
passfile.flush()
218
proc = subprocess.Popen(['gpg', '--decrypt',
219
'--passphrase-file',
220
passfile.name]
221
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
226
if proc.returncode != 0:
227
raise PGPError(err)
228
return decrypted_plaintext
229
84
85
version = "1.3.1"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
89
syslogger = (logging.handlers.SysLogHandler
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
95
logger.addHandler(syslogger)
96
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
101
logger.addHandler(console)
230
102
231
103
class AvahiError(Exception):
232
104
def __init__(self, value, *args, **kwargs):
233
105
self.value = value
234
return super(AvahiError, self).__init__(value, *args,
235
**kwargs)
236
106
super(AvahiError, self).__init__(value, *args, **kwargs)
107
def __unicode__(self):
108
return unicode(repr(self.value))
237
109
238
110
class AvahiServiceError(AvahiError):
239
111
pass
240
112
241
242
113
class AvahiGroupError(AvahiError):
243
114
pass
244
115
251
122
Used to optionally bind to the specified interface.
252
123
name: string; Example: 'Mandos'
253
124
type: string; Example: '_mandos._tcp'.
254
See <https://www.iana.org/assignments/service-names-port-numbers>
125
See <http://www.dns-sd.org/ServiceTypes.html>
255
126
port: integer; what port to announce
256
127
TXT: list of strings; TXT record for the service
257
128
domain: string; Domain to publish on, default to .local if empty.
263
134
server: D-Bus Server
264
135
bus: dbus.SystemBus()
265
136
"""
266
267
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
137
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
140
protocol = avahi.PROTO_UNSPEC, bus = None):
278
141
self.interface = interface
279
142
self.name = name
280
143
self.type = servicetype
289
152
self.server = None
290
153
self.bus = bus
291
154
self.entry_group_state_changed_match = None
292
293
def rename(self, remove=True):
155
def rename(self):
294
156
"""Derived from the Avahi example code"""
295
157
if self.rename_count >= self.max_renames:
296
158
logger.critical("No suitable Zeroconf service name found"
297
159
" after %i retries, exiting.",
298
160
self.rename_count)
299
161
raise AvahiServiceError("Too many renames")
300
self.name = str(
301
self.server.GetAlternativeServiceName(self.name))
302
self.rename_count += 1
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
303
163
logger.info("Changing Zeroconf service name to %r ...",
304
164
self.name)
305
if remove:
306
self.remove()
165
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
168
% self.name))
169
self.remove()
307
170
try:
308
171
self.add()
309
172
except dbus.exceptions.DBusException as error:
310
if (error.get_dbus_name()
311
== "org.freedesktop.Avahi.CollisionError"):
312
logger.info("Local Zeroconf service name collision.")
313
return self.rename(remove=False)
314
else:
315
logger.critical("D-Bus Exception", exc_info=error)
316
self.cleanup()
317
os._exit(1)
318
173
logger.critical("DBusException: %s", error)
174
self.cleanup()
175
os._exit(1)
176
self.rename_count += 1
319
177
def remove(self):
320
178
"""Derived from the Avahi example code"""
321
179
if self.entry_group_state_changed_match is not None:
323
181
self.entry_group_state_changed_match = None
324
182
if self.group is not None:
325
183
self.group.Reset()
326
327
184
def add(self):
328
185
"""Derived from the Avahi example code"""
329
186
self.remove()
334
191
avahi.DBUS_INTERFACE_ENTRY_GROUP)
335
192
self.entry_group_state_changed_match = (
336
193
self.group.connect_to_signal(
337
'StateChanged', self.entry_group_state_changed))
194
'StateChanged', self .entry_group_state_changed))
338
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
339
196
self.name, self.type)
340
197
self.group.AddService(
346
203
dbus.UInt16(self.port),
347
204
avahi.string_array_to_txt_array(self.TXT))
348
205
self.group.Commit()
349
350
206
def entry_group_state_changed(self, state, error):
351
207
"""Derived from the Avahi example code"""
352
208
logger.debug("Avahi entry group state change: %i", state)
358
214
self.rename()
359
215
elif state == avahi.ENTRY_GROUP_FAILURE:
360
216
logger.critical("Avahi: Error in group state changed %s",
361
str(error))
362
raise AvahiGroupError("State changed: {!s}".format(error))
363
217
unicode(error))
218
raise AvahiGroupError("State changed: %s"
219
% unicode(error))
364
220
def cleanup(self):
365
221
"""Derived from the Avahi example code"""
366
222
if self.group is not None:
367
223
try:
368
224
self.group.Free()
369
225
except (dbus.exceptions.UnknownMethodException,
370
dbus.exceptions.DBusException):
226
dbus.exceptions.DBusException) as e:
371
227
pass
372
228
self.group = None
373
229
self.remove()
374
375
230
def server_state_changed(self, state, error=None):
376
231
"""Derived from the Avahi example code"""
377
232
logger.debug("Avahi server state change: %i", state)
378
bad_states = {
379
avahi.SERVER_INVALID: "Zeroconf server invalid",
380
avahi.SERVER_REGISTERING: None,
381
avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
avahi.SERVER_FAILURE: "Zeroconf server failure",
383
}
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
384
240
if state in bad_states:
385
241
if bad_states[state] is not None:
386
242
if error is None:
389
245
logger.error(bad_states[state] + ": %r", error)
390
246
self.cleanup()
391
247
elif state == avahi.SERVER_RUNNING:
392
try:
393
self.add()
394
except dbus.exceptions.DBusException as error:
395
if (error.get_dbus_name()
396
== "org.freedesktop.Avahi.CollisionError"):
397
logger.info("Local Zeroconf service name"
398
" collision.")
399
return self.rename(remove=False)
400
else:
401
logger.critical("D-Bus Exception", exc_info=error)
402
self.cleanup()
403
os._exit(1)
248
self.add()
404
249
else:
405
250
if error is None:
406
251
logger.debug("Unknown state: %r", state)
407
252
else:
408
253
logger.debug("Unknown state: %r: %r", state, error)
409
410
254
def activate(self):
411
255
"""Derived from the Avahi example code"""
412
256
if self.server is None:
416
260
follow_name_owner_changes=True),
417
261
avahi.DBUS_INTERFACE_SERVER)
418
262
self.server.connect_to_signal("StateChanged",
419
self.server_state_changed)
263
self.server_state_changed)
420
264
self.server_state_changed(self.server.GetState())
421
265
422
266
423
class AvahiServiceToSyslog(AvahiService):
424
def rename(self, *args, **kwargs):
425
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
427
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
.format(self.name)))
430
return ret
431
432
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
448
# Unless otherwise indicated, the constants and types below are
449
# all from the gnutls/gnutls.h C header file.
450
451
# Constants
452
E_SUCCESS = 0
453
CRT_OPENPGP = 2
454
CLIENT = 2
455
SHUT_RDWR = 0
456
CRD_CERTIFICATE = 1
457
E_NO_CERTIFICATE_FOUND = -49
458
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
459
460
# Types
461
class session_int(ctypes.Structure):
462
_fields_ = []
463
session_t = ctypes.POINTER(session_int)
464
class certificate_credentials_st(ctypes.Structure):
465
_fields_ = []
466
certificate_credentials_t = ctypes.POINTER(
467
certificate_credentials_st)
468
certificate_type_t = ctypes.c_int
469
class datum_t(ctypes.Structure):
470
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
471
('size', ctypes.c_uint)]
472
class openpgp_crt_int(ctypes.Structure):
473
_fields_ = []
474
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
475
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
476
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
477
credentials_type_t = ctypes.c_int #
478
transport_ptr_t = ctypes.c_void_p
479
close_request_t = ctypes.c_int
480
481
# Exceptions
482
class Error(Exception):
483
# We need to use the class name "GnuTLS" here, since this
484
# exception might be raised from within GnuTLS.__init__,
485
# which is called before the assignment to the "gnutls"
486
# global variable happens.
487
def __init__(self, message = None, code = None, args=()):
488
# Default usage is by a message string, but if a return
489
# code is passed, convert it to a string with
490
# gnutls.strerror()
491
if message is None and code is not None:
492
message = GnuTLS.strerror(code)
493
return super(GnuTLS.Error, self).__init__(
494
message, *args)
495
496
class CertificateSecurityError(Error):
497
pass
498
499
# Classes
500
class Credentials(object):
501
def __init__(self):
502
self._c_object = gnutls.certificate_credentials_t()
503
gnutls.certificate_allocate_credentials(
504
ctypes.byref(self._c_object))
505
self.type = gnutls.CRD_CERTIFICATE
506
507
def __del__(self):
508
gnutls.certificate_free_credentials(self._c_object)
509
510
class ClientSession(object):
511
def __init__(self, socket, credentials = None):
512
self._c_object = gnutls.session_t()
513
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
514
gnutls.set_default_priority(self._c_object)
515
gnutls.transport_set_ptr(self._c_object, socket.fileno())
516
gnutls.handshake_set_private_extensions(self._c_object,
517
True)
518
self.socket = socket
519
if credentials is None:
520
credentials = gnutls.Credentials()
521
gnutls.credentials_set(self._c_object, credentials.type,
522
ctypes.cast(credentials._c_object,
523
ctypes.c_void_p))
524
self.credentials = credentials
525
526
def __del__(self):
527
gnutls.deinit(self._c_object)
528
529
def handshake(self):
530
return gnutls.handshake(self._c_object)
531
532
def send(self, data):
533
data = bytes(data)
534
if not data:
535
return 0
536
return gnutls.record_send(self._c_object, data, len(data))
537
538
def bye(self):
539
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
540
541
# Error handling function
542
def _error_code(result):
543
"""A function to raise exceptions on errors, suitable
544
for the 'restype' attribute on ctypes functions"""
545
if result >= 0:
546
return result
547
if result == gnutls.E_NO_CERTIFICATE_FOUND:
548
raise gnutls.CertificateSecurityError(code = result)
549
raise gnutls.Error(code = result)
550
551
# Unless otherwise indicated, the function declarations below are
552
# all from the gnutls/gnutls.h C header file.
553
554
# Functions
555
priority_set_direct = _library.gnutls_priority_set_direct
556
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
557
ctypes.POINTER(ctypes.c_char_p)]
558
priority_set_direct.restype = _error_code
559
560
init = _library.gnutls_init
561
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
562
init.restype = _error_code
563
564
set_default_priority = _library.gnutls_set_default_priority
565
set_default_priority.argtypes = [session_t]
566
set_default_priority.restype = _error_code
567
568
record_send = _library.gnutls_record_send
569
record_send.argtypes = [session_t, ctypes.c_void_p,
570
ctypes.c_size_t]
571
record_send.restype = ctypes.c_ssize_t
572
573
certificate_allocate_credentials = (
574
_library.gnutls_certificate_allocate_credentials)
575
certificate_allocate_credentials.argtypes = [
576
ctypes.POINTER(certificate_credentials_t)]
577
certificate_allocate_credentials.restype = _error_code
578
579
certificate_free_credentials = (
580
_library.gnutls_certificate_free_credentials)
581
certificate_free_credentials.argtypes = [certificate_credentials_t]
582
certificate_free_credentials.restype = None
583
584
handshake_set_private_extensions = (
585
_library.gnutls_handshake_set_private_extensions)
586
handshake_set_private_extensions.argtypes = [session_t,
587
ctypes.c_int]
588
handshake_set_private_extensions.restype = None
589
590
credentials_set = _library.gnutls_credentials_set
591
credentials_set.argtypes = [session_t, credentials_type_t,
592
ctypes.c_void_p]
593
credentials_set.restype = _error_code
594
595
strerror = _library.gnutls_strerror
596
strerror.argtypes = [ctypes.c_int]
597
strerror.restype = ctypes.c_char_p
598
599
certificate_type_get = _library.gnutls_certificate_type_get
600
certificate_type_get.argtypes = [session_t]
601
certificate_type_get.restype = _error_code
602
603
certificate_get_peers = _library.gnutls_certificate_get_peers
604
certificate_get_peers.argtypes = [session_t,
605
ctypes.POINTER(ctypes.c_uint)]
606
certificate_get_peers.restype = ctypes.POINTER(datum_t)
607
608
global_set_log_level = _library.gnutls_global_set_log_level
609
global_set_log_level.argtypes = [ctypes.c_int]
610
global_set_log_level.restype = None
611
612
global_set_log_function = _library.gnutls_global_set_log_function
613
global_set_log_function.argtypes = [log_func]
614
global_set_log_function.restype = None
615
616
deinit = _library.gnutls_deinit
617
deinit.argtypes = [session_t]
618
deinit.restype = None
619
620
handshake = _library.gnutls_handshake
621
handshake.argtypes = [session_t]
622
handshake.restype = _error_code
623
624
transport_set_ptr = _library.gnutls_transport_set_ptr
625
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
626
transport_set_ptr.restype = None
627
628
bye = _library.gnutls_bye
629
bye.argtypes = [session_t, close_request_t]
630
bye.restype = _error_code
631
632
check_version = _library.gnutls_check_version
633
check_version.argtypes = [ctypes.c_char_p]
634
check_version.restype = ctypes.c_char_p
635
636
# All the function declarations below are from gnutls/openpgp.h
637
638
openpgp_crt_init = _library.gnutls_openpgp_crt_init
639
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
640
openpgp_crt_init.restype = _error_code
641
642
openpgp_crt_import = _library.gnutls_openpgp_crt_import
643
openpgp_crt_import.argtypes = [openpgp_crt_t,
644
ctypes.POINTER(datum_t),
645
openpgp_crt_fmt_t]
646
openpgp_crt_import.restype = _error_code
647
648
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
649
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
650
ctypes.POINTER(ctypes.c_uint)]
651
openpgp_crt_verify_self.restype = _error_code
652
653
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
654
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
655
openpgp_crt_deinit.restype = None
656
657
openpgp_crt_get_fingerprint = (
658
_library.gnutls_openpgp_crt_get_fingerprint)
659
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
660
ctypes.c_void_p,
661
ctypes.POINTER(
662
ctypes.c_size_t)]
663
openpgp_crt_get_fingerprint.restype = _error_code
664
665
# Remove non-public function
666
del _error_code
667
# Create the global "gnutls" object, simulating a module
668
gnutls = GnuTLS()
669
670
def call_pipe(connection, # : multiprocessing.Connection
671
func, *args, **kwargs):
672
"""This function is meant to be called by multiprocessing.Process
673
674
This function runs func(*args, **kwargs), and writes the resulting
675
return value on the provided multiprocessing.Connection.
676
"""
677
connection.send(func(*args, **kwargs))
678
connection.close()
679
267
def _timedelta_to_milliseconds(td):
268
"Convert a datetime.timedelta() to milliseconds"
269
return ((td.days * 24 * 60 * 60 * 1000)
270
+ (td.seconds * 1000)
271
+ (td.microseconds // 1000))
272
680
273
class Client(object):
681
274
"""A representation of a client host served by this server.
682
275
683
276
Attributes:
684
approved: bool(); 'None' if not yet approved/disapproved
277
_approved: bool(); 'None' if not yet approved/disapproved
685
278
approval_delay: datetime.timedelta(); Time to wait for approval
686
279
approval_duration: datetime.timedelta(); Duration of one approval
687
280
checker: subprocess.Popen(); a running checker process used
694
287
instance %(name)s can be used in the command.
695
288
checker_initiator_tag: a gobject event source tag, or None
696
289
created: datetime.datetime(); (UTC) object creation
697
client_structure: Object describing what attributes a client has
698
and is used for storing the client at exit
699
290
current_checker_command: string; current running checker_command
291
disable_hook: If set, called by disable() as disable_hook(self)
700
292
disable_initiator_tag: a gobject event source tag, or None
701
293
enabled: bool()
702
294
fingerprint: string (40 or 32 hexadecimal digits); used to
705
297
interval: datetime.timedelta(); How often to start a new checker
706
298
last_approval_request: datetime.datetime(); (UTC) or None
707
299
last_checked_ok: datetime.datetime(); (UTC) or None
708
last_checker_status: integer between 0 and 255 reflecting exit
709
status of last checker. -1 reflects crashed
710
checker, -2 means no checker completed yet.
711
last_checker_signal: The signal which killed the last checker, if
712
last_checker_status is -1
713
last_enabled: datetime.datetime(); (UTC) or None
300
last_enabled: datetime.datetime(); (UTC)
714
301
name: string; from the config file, used in log messages and
715
302
D-Bus identifiers
716
303
secret: bytestring; sent verbatim (over TLS) to client
717
304
timeout: datetime.timedelta(); How long from last_checked_ok
718
305
until this client is disabled
719
extended_timeout: extra long timeout when secret has been sent
306
extended_timeout: extra long timeout when password has been sent
720
307
runtime_expansions: Allowed attributes for runtime expansion.
721
308
expires: datetime.datetime(); time (UTC) when a client will be
722
309
disabled, or None
723
server_settings: The server_settings dict from main()
724
310
"""
725
311
726
312
runtime_expansions = ("approval_delay", "approval_duration",
727
"created", "enabled", "expires",
728
"fingerprint", "host", "interval",
729
"last_approval_request", "last_checked_ok",
313
"created", "enabled", "fingerprint",
314
"host", "interval", "last_checked_ok",
730
315
"last_enabled", "name", "timeout")
731
client_defaults = {
732
"timeout": "PT5M",
733
"extended_timeout": "PT15M",
734
"interval": "PT2M",
735
"checker": "fping -q -- %%(host)s",
736
"host": "",
737
"approval_delay": "PT0S",
738
"approval_duration": "PT1S",
739
"approved_by_default": "True",
740
"enabled": "True",
741
}
742
743
@staticmethod
744
def config_parser(config):
745
"""Construct a new dict of client settings of this form:
746
{ client_name: {setting_name: value, ...}, ...}
747
with exceptions for any special settings as defined above.
748
NOTE: Must be a pure function. Must return the same result
749
value given the same arguments.
750
"""
751
settings = {}
752
for client_name in config.sections():
753
section = dict(config.items(client_name))
754
client = settings[client_name] = {}
755
756
client["host"] = section["host"]
757
# Reformat values from string types to Python types
758
client["approved_by_default"] = config.getboolean(
759
client_name, "approved_by_default")
760
client["enabled"] = config.getboolean(client_name,
761
"enabled")
762
763
# Uppercase and remove spaces from fingerprint for later
764
# comparison purposes with return value from the
765
# fingerprint() function
766
client["fingerprint"] = (section["fingerprint"].upper()
767
.replace(" ", ""))
768
if "secret" in section:
769
client["secret"] = section["secret"].decode("base64")
770
elif "secfile" in section:
771
with open(os.path.expanduser(os.path.expandvars
772
(section["secfile"])),
773
"rb") as secfile:
774
client["secret"] = secfile.read()
775
else:
776
raise TypeError("No secret or secfile for section {}"
777
.format(section))
778
client["timeout"] = string_to_delta(section["timeout"])
779
client["extended_timeout"] = string_to_delta(
780
section["extended_timeout"])
781
client["interval"] = string_to_delta(section["interval"])
782
client["approval_delay"] = string_to_delta(
783
section["approval_delay"])
784
client["approval_duration"] = string_to_delta(
785
section["approval_duration"])
786
client["checker_command"] = section["checker"]
787
client["last_approval_request"] = None
788
client["last_checked_ok"] = None
789
client["last_checker_status"] = -2
790
316
791
return settings
792
793
def __init__(self, settings, name = None, server_settings=None):
317
def timeout_milliseconds(self):
318
"Return the 'timeout' attribute in milliseconds"
319
return _timedelta_to_milliseconds(self.timeout)
320
321
def extended_timeout_milliseconds(self):
322
"Return the 'extended_timeout' attribute in milliseconds"
323
return _timedelta_to_milliseconds(self.extended_timeout)
324
325
def interval_milliseconds(self):
326
"Return the 'interval' attribute in milliseconds"
327
return _timedelta_to_milliseconds(self.interval)
328
329
def approval_delay_milliseconds(self):
330
return _timedelta_to_milliseconds(self.approval_delay)
331
332
def __init__(self, name = None, disable_hook=None, config=None):
333
"""Note: the 'checker' key in 'config' sets the
334
'checker_command' attribute and *not* the 'checker'
335
attribute."""
794
336
self.name = name
795
if server_settings is None:
796
server_settings = {}
797
self.server_settings = server_settings
798
# adding all client settings
799
for setting, value in settings.items():
800
setattr(self, setting, value)
801
802
if self.enabled:
803
if not hasattr(self, "last_enabled"):
804
self.last_enabled = datetime.datetime.utcnow()
805
if not hasattr(self, "expires"):
806
self.expires = (datetime.datetime.utcnow()
807
+ self.timeout)
808
else:
809
self.last_enabled = None
810
self.expires = None
811
337
if config is None:
338
config = {}
812
339
logger.debug("Creating client %r", self.name)
340
# Uppercase and remove spaces from fingerprint for later
341
# comparison purposes with return value from the fingerprint()
342
# function
343
self.fingerprint = (config["fingerprint"].upper()
344
.replace(" ", ""))
813
345
logger.debug(" Fingerprint: %s", self.fingerprint)
814
self.created = settings.get("created",
815
datetime.datetime.utcnow())
816
817
# attributes specific for this server instance
346
if "secret" in config:
347
self.secret = config["secret"].decode("base64")
348
elif "secfile" in config:
349
with open(os.path.expanduser(os.path.expandvars
350
(config["secfile"])),
351
"rb") as secfile:
352
self.secret = secfile.read()
353
else:
354
raise TypeError("No secret or secfile for client %s"
355
% self.name)
356
self.host = config.get("host", "")
357
self.created = datetime.datetime.utcnow()
358
self.enabled = False
359
self.last_approval_request = None
360
self.last_enabled = None
361
self.last_checked_ok = None
362
self.timeout = string_to_delta(config["timeout"])
363
self.extended_timeout = string_to_delta(config["extended_timeout"])
364
self.interval = string_to_delta(config["interval"])
365
self.disable_hook = disable_hook
818
366
self.checker = None
819
367
self.checker_initiator_tag = None
820
368
self.disable_initiator_tag = None
369
self.expires = None
821
370
self.checker_callback_tag = None
371
self.checker_command = config["checker"]
822
372
self.current_checker_command = None
823
self.approved = None
373
self.last_connect = None
374
self._approved = None
375
self.approved_by_default = config.get("approved_by_default",
376
True)
824
377
self.approvals_pending = 0
825
self.changedstate = multiprocessing_manager.Condition(
826
multiprocessing_manager.Lock())
827
self.client_structure = [attr
828
for attr in self.__dict__.iterkeys()
829
if not attr.startswith("_")]
830
self.client_structure.append("client_structure")
831
832
for name, t in inspect.getmembers(
833
type(self), lambda obj: isinstance(obj, property)):
834
if not name.startswith("_"):
835
self.client_structure.append(name)
378
self.approval_delay = string_to_delta(
379
config["approval_delay"])
380
self.approval_duration = string_to_delta(
381
config["approval_duration"])
382
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
836
383
837
# Send notice to process children that client state has changed
838
384
def send_changedstate(self):
839
with self.changedstate:
840
self.changedstate.notify_all()
841
385
self.changedstate.acquire()
386
self.changedstate.notify_all()
387
self.changedstate.release()
388
842
389
def enable(self):
843
390
"""Start this client's checker and timeout hooks"""
844
391
if getattr(self, "enabled", False):
845
392
# Already enabled
846
393
return
394
self.send_changedstate()
395
# Schedule a new checker to be started an 'interval' from now,
396
# and every interval from then on.
397
self.checker_initiator_tag = (gobject.timeout_add
398
(self.interval_milliseconds(),
399
self.start_checker))
400
# Schedule a disable() when 'timeout' has passed
847
401
self.expires = datetime.datetime.utcnow() + self.timeout
402
self.disable_initiator_tag = (gobject.timeout_add
403
(self.timeout_milliseconds(),
404
self.disable))
848
405
self.enabled = True
849
406
self.last_enabled = datetime.datetime.utcnow()
850
self.init_checker()
851
self.send_changedstate()
407
# Also start a new checker *right now*.
408
self.start_checker()
852
409
853
410
def disable(self, quiet=True):
854
411
"""Disable this client."""
855
412
if not getattr(self, "enabled", False):
856
413
return False
857
414
if not quiet:
415
self.send_changedstate()
416
if not quiet:
858
417
logger.info("Disabling client %s", self.name)
859
if getattr(self, "disable_initiator_tag", None) is not None:
418
if getattr(self, "disable_initiator_tag", False):
860
419
gobject.source_remove(self.disable_initiator_tag)
861
420
self.disable_initiator_tag = None
862
421
self.expires = None
863
if getattr(self, "checker_initiator_tag", None) is not None:
422
if getattr(self, "checker_initiator_tag", False):
864
423
gobject.source_remove(self.checker_initiator_tag)
865
424
self.checker_initiator_tag = None
866
425
self.stop_checker()
426
if self.disable_hook:
427
self.disable_hook(self)
867
428
self.enabled = False
868
if not quiet:
869
self.send_changedstate()
870
429
# Do not run this again if called by a gobject.timeout_add
871
430
return False
872
431
873
432
def __del__(self):
433
self.disable_hook = None
874
434
self.disable()
875
435
876
def init_checker(self):
877
# Schedule a new checker to be started an 'interval' from now,
878
# and every interval from then on.
879
if self.checker_initiator_tag is not None:
880
gobject.source_remove(self.checker_initiator_tag)
881
self.checker_initiator_tag = gobject.timeout_add(
882
int(self.interval.total_seconds() * 1000),
883
self.start_checker)
884
# Schedule a disable() when 'timeout' has passed
885
if self.disable_initiator_tag is not None:
886
gobject.source_remove(self.disable_initiator_tag)
887
self.disable_initiator_tag = gobject.timeout_add(
888
int(self.timeout.total_seconds() * 1000), self.disable)
889
# Also start a new checker *right now*.
890
self.start_checker()
891
892
def checker_callback(self, source, condition, connection,
893
command):
436
def checker_callback(self, pid, condition, command):
894
437
"""The checker has completed, so take appropriate actions."""
895
438
self.checker_callback_tag = None
896
439
self.checker = None
897
# Read return code from connection (see call_pipe)
898
returncode = connection.recv()
899
connection.close()
900
901
if returncode >= 0:
902
self.last_checker_status = returncode
903
self.last_checker_signal = None
904
if self.last_checker_status == 0:
440
if os.WIFEXITED(condition):
441
exitstatus = os.WEXITSTATUS(condition)
442
if exitstatus == 0:
905
443
logger.info("Checker for %(name)s succeeded",
906
444
vars(self))
907
445
self.checked_ok()
908
446
else:
909
logger.info("Checker for %(name)s failed", vars(self))
447
logger.info("Checker for %(name)s failed",
448
vars(self))
910
449
else:
911
self.last_checker_status = -1
912
self.last_checker_signal = -returncode
913
450
logger.warning("Checker for %(name)s crashed?",
914
451
vars(self))
915
return False
916
917
def checked_ok(self):
918
"""Assert that the client has been seen, alive and well."""
919
self.last_checked_ok = datetime.datetime.utcnow()
920
self.last_checker_status = 0
921
self.last_checker_signal = None
922
self.bump_timeout()
923
924
def bump_timeout(self, timeout=None):
925
"""Bump up the timeout for this client."""
452
453
def checked_ok(self, timeout=None):
454
"""Bump up the timeout for this client.
455
456
This should only be called when the client has been seen,
457
alive and well.
458
"""
926
459
if timeout is None:
927
460
timeout = self.timeout
928
if self.disable_initiator_tag is not None:
929
gobject.source_remove(self.disable_initiator_tag)
930
self.disable_initiator_tag = None
931
if getattr(self, "enabled", False):
932
self.disable_initiator_tag = gobject.timeout_add(
933
int(timeout.total_seconds() * 1000), self.disable)
934
self.expires = datetime.datetime.utcnow() + timeout
461
self.last_checked_ok = datetime.datetime.utcnow()
462
gobject.source_remove(self.disable_initiator_tag)
463
self.expires = datetime.datetime.utcnow() + timeout
464
self.disable_initiator_tag = (gobject.timeout_add
465
(_timedelta_to_milliseconds(timeout),
466
self.disable))
935
467
936
468
def need_approval(self):
937
469
self.last_approval_request = datetime.datetime.utcnow()
942
474
If a checker already exists, leave it running and do
943
475
nothing."""
944
476
# The reason for not killing a running checker is that if we
945
# did that, and if a checker (for some reason) started running
946
# slowly and taking more than 'interval' time, then the client
947
# would inevitably timeout, since no checker would get a
948
# chance to run to completion. If we instead leave running
477
# did that, then if a checker (for some reason) started
478
# running slowly and taking more than 'interval' time, the
479
# client would inevitably timeout, since no checker would get
480
# a chance to run to completion. If we instead leave running
949
481
# checkers alone, the checker would have to take more time
950
482
# than 'timeout' for the client to be disabled, which is as it
951
483
# should be.
952
484
953
if self.checker is not None and not self.checker.is_alive():
954
logger.warning("Checker was not alive; joining")
955
self.checker.join()
956
self.checker = None
485
# If a checker exists, make sure it is not a zombie
486
try:
487
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
488
except (AttributeError, OSError) as error:
489
if (isinstance(error, OSError)
490
and error.errno != errno.ECHILD):
491
raise error
492
else:
493
if pid:
494
logger.warning("Checker was a zombie")
495
gobject.source_remove(self.checker_callback_tag)
496
self.checker_callback(pid, status,
497
self.current_checker_command)
957
498
# Start a new checker if needed
958
499
if self.checker is None:
959
# Escape attributes for the shell
960
escaped_attrs = {
961
attr: re.escape(str(getattr(self, attr)))
962
for attr in self.runtime_expansions }
963
500
try:
964
command = self.checker_command % escaped_attrs
965
except TypeError as error:
966
logger.error('Could not format string "%s"',
967
self.checker_command,
968
exc_info=error)
969
return True # Try again later
501
# In case checker_command has exactly one % operator
502
command = self.checker_command % self.host
503
except TypeError:
504
# Escape attributes for the shell
505
escaped_attrs = dict(
506
(attr,
507
re.escape(unicode(str(getattr(self, attr, "")),
508
errors=
509
'replace')))
510
for attr in
511
self.runtime_expansions)
512
513
try:
514
command = self.checker_command % escaped_attrs
515
except TypeError as error:
516
logger.error('Could not format string "%s":'
517
' %s', self.checker_command, error)
518
return True # Try again later
970
519
self.current_checker_command = command
971
logger.info("Starting checker %r for %s", command,
972
self.name)
973
# We don't need to redirect stdout and stderr, since
974
# in normal mode, that is already done by daemon(),
975
# and in debug mode we don't want to. (Stdin is
976
# always replaced by /dev/null.)
977
# The exception is when not debugging but nevertheless
978
# running in the foreground; use the previously
979
# created wnull.
980
popen_args = { "close_fds": True,
981
"shell": True,
982
"cwd": "/" }
983
if (not self.server_settings["debug"]
984
and self.server_settings["foreground"]):
985
popen_args.update({"stdout": wnull,
986
"stderr": wnull })
987
pipe = multiprocessing.Pipe(duplex = False)
988
self.checker = multiprocessing.Process(
989
target = call_pipe,
990
args = (pipe[1], subprocess.call, command),
991
kwargs = popen_args)
992
self.checker.start()
993
self.checker_callback_tag = gobject.io_add_watch(
994
pipe[0].fileno(), gobject.IO_IN,
995
self.checker_callback, pipe[0], command)
520
try:
521
logger.info("Starting checker %r for %s",
522
command, self.name)
523
# We don't need to redirect stdout and stderr, since
524
# in normal mode, that is already done by daemon(),
525
# and in debug mode we don't want to. (Stdin is
526
# always replaced by /dev/null.)
527
self.checker = subprocess.Popen(command,
528
close_fds=True,
529
shell=True, cwd="/")
530
self.checker_callback_tag = (gobject.child_watch_add
531
(self.checker.pid,
532
self.checker_callback,
533
data=command))
534
# The checker may have completed before the gobject
535
# watch was added. Check for this.
536
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
537
if pid:
538
gobject.source_remove(self.checker_callback_tag)
539
self.checker_callback(pid, status, command)
540
except OSError as error:
541
logger.error("Failed to start subprocess: %s",
542
error)
996
543
# Re-run this periodically if run by gobject.timeout_add
997
544
return True
998
545
1004
551
if getattr(self, "checker", None) is None:
1005
552
return
1006
553
logger.debug("Stopping checker for %(name)s", vars(self))
1007
self.checker.terminate()
554
try:
555
os.kill(self.checker.pid, signal.SIGTERM)
556
#time.sleep(0.5)
557
#if self.checker.poll() is None:
558
# os.kill(self.checker.pid, signal.SIGKILL)
559
except OSError as error:
560
if error.errno != errno.ESRCH: # No such process
561
raise
1008
562
self.checker = None
1009
563
1010
1011
def dbus_service_property(dbus_interface,
1012
signature="v",
1013
access="readwrite",
1014
byte_arrays=False):
564
def dbus_service_property(dbus_interface, signature="v",
565
access="readwrite", byte_arrays=False):
1015
566
"""Decorators for marking methods of a DBusObjectWithProperties to
1016
567
become properties on the D-Bus.
1017
568
1026
577
# "Set" method, so we fail early here:
1027
578
if byte_arrays and signature != "ay":
1028
579
raise ValueError("Byte arrays not supported for non-'ay'"
1029
" signature {!r}".format(signature))
1030
580
" signature %r" % signature)
1031
581
def decorator(func):
1032
582
func._dbus_is_property = True
1033
583
func._dbus_interface = dbus_interface
1038
588
func._dbus_name = func._dbus_name[:-14]
1039
589
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1040
590
return func
1041
1042
return decorator
1043
1044
1045
def dbus_interface_annotations(dbus_interface):
1046
"""Decorator for marking functions returning interface annotations
1047
1048
Usage:
1049
1050
@dbus_interface_annotations("org.example.Interface")
1051
def _foo(self): # Function name does not matter
1052
return {"org.freedesktop.DBus.Deprecated": "true",
1053
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1054
"false"}
1055
"""
1056
1057
def decorator(func):
1058
func._dbus_is_interface = True
1059
func._dbus_interface = dbus_interface
1060
func._dbus_name = dbus_interface
1061
return func
1062
1063
return decorator
1064
1065
1066
def dbus_annotations(annotations):
1067
"""Decorator to annotate D-Bus methods, signals or properties
1068
Usage:
1069
1070
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1071
"org.freedesktop.DBus.Property."
1072
"EmitsChangedSignal": "false"})
1073
@dbus_service_property("org.example.Interface", signature="b",
1074
access="r")
1075
def Property_dbus_property(self):
1076
return dbus.Boolean(False)
1077
1078
See also the DBusObjectWithAnnotations class.
1079
"""
1080
1081
def decorator(func):
1082
func._dbus_annotations = annotations
1083
return func
1084
1085
591
return decorator
1086
592
1087
593
1088
594
class DBusPropertyException(dbus.exceptions.DBusException):
1089
595
"""A base class for D-Bus property-related exceptions
1090
596
"""
1091
pass
597
def __unicode__(self):
598
return unicode(str(self))
1092
599
1093
600
1094
601
class DBusPropertyAccessException(DBusPropertyException):
1103
610
pass
1104
611
1105
612
1106
class DBusObjectWithAnnotations(dbus.service.Object):
1107
"""A D-Bus object with annotations.
1108
1109
Classes inheriting from this can use the dbus_annotations
1110
decorator to add annotations to methods or signals.
1111
"""
1112
1113
@staticmethod
1114
def _is_dbus_thing(thing):
1115
"""Returns a function testing if an attribute is a D-Bus thing
1116
1117
If called like _is_dbus_thing("method") it returns a function
1118
suitable for use as predicate to inspect.getmembers().
1119
"""
1120
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1121
False)
1122
1123
def _get_all_dbus_things(self, thing):
1124
"""Returns a generator of (name, attribute) pairs
1125
"""
1126
return ((getattr(athing.__get__(self), "_dbus_name", name),
1127
athing.__get__(self))
1128
for cls in self.__class__.__mro__
1129
for name, athing in
1130
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1131
1132
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1133
out_signature = "s",
1134
path_keyword = 'object_path',
1135
connection_keyword = 'connection')
1136
def Introspect(self, object_path, connection):
1137
"""Overloading of standard D-Bus method.
1138
1139
Inserts annotation tags on methods and signals.
1140
"""
1141
xmlstring = dbus.service.Object.Introspect(self, object_path,
1142
connection)
1143
try:
1144
document = xml.dom.minidom.parseString(xmlstring)
1145
1146
for if_tag in document.getElementsByTagName("interface"):
1147
# Add annotation tags
1148
for typ in ("method", "signal"):
1149
for tag in if_tag.getElementsByTagName(typ):
1150
annots = dict()
1151
for name, prop in (self.
1152
_get_all_dbus_things(typ)):
1153
if (name == tag.getAttribute("name")
1154
and prop._dbus_interface
1155
== if_tag.getAttribute("name")):
1156
annots.update(getattr(
1157
prop, "_dbus_annotations", {}))
1158
for name, value in annots.items():
1159
ann_tag = document.createElement(
1160
"annotation")
1161
ann_tag.setAttribute("name", name)
1162
ann_tag.setAttribute("value", value)
1163
tag.appendChild(ann_tag)
1164
# Add interface annotation tags
1165
for annotation, value in dict(
1166
itertools.chain.from_iterable(
1167
annotations().items()
1168
for name, annotations
1169
in self._get_all_dbus_things("interface")
1170
if name == if_tag.getAttribute("name")
1171
)).items():
1172
ann_tag = document.createElement("annotation")
1173
ann_tag.setAttribute("name", annotation)
1174
ann_tag.setAttribute("value", value)
1175
if_tag.appendChild(ann_tag)
1176
# Fix argument name for the Introspect method itself
1177
if (if_tag.getAttribute("name")
1178
== dbus.INTROSPECTABLE_IFACE):
1179
for cn in if_tag.getElementsByTagName("method"):
1180
if cn.getAttribute("name") == "Introspect":
1181
for arg in cn.getElementsByTagName("arg"):
1182
if (arg.getAttribute("direction")
1183
== "out"):
1184
arg.setAttribute("name",
1185
"xml_data")
1186
xmlstring = document.toxml("utf-8")
1187
document.unlink()
1188
except (AttributeError, xml.dom.DOMException,
1189
xml.parsers.expat.ExpatError) as error:
1190
logger.error("Failed to override Introspection method",
1191
exc_info=error)
1192
return xmlstring
1193
1194
1195
class DBusObjectWithProperties(DBusObjectWithAnnotations):
613
class DBusObjectWithProperties(dbus.service.Object):
1196
614
"""A D-Bus object with properties.
1197
615
1198
616
Classes inheriting from this can use the dbus_service_property
1199
617
decorator to expose methods as D-Bus properties. It exposes the
1200
618
standard Get(), Set(), and GetAll() methods on the D-Bus.
1201
619
"""
1202
620
621
@staticmethod
622
def _is_dbus_property(obj):
623
return getattr(obj, "_dbus_is_property", False)
624
625
def _get_all_dbus_properties(self):
626
"""Returns a generator of (name, attribute) pairs
627
"""
628
return ((prop._dbus_name, prop)
629
for name, prop in
630
inspect.getmembers(self, self._is_dbus_property))
631
1203
632
def _get_dbus_property(self, interface_name, property_name):
1204
633
"""Returns a bound method if one exists which is a D-Bus
1205
634
property with the specified name and interface.
1206
635
"""
1207
for cls in self.__class__.__mro__:
1208
for name, value in inspect.getmembers(
1209
cls, self._is_dbus_thing("property")):
1210
if (value._dbus_name == property_name
1211
and value._dbus_interface == interface_name):
1212
return value.__get__(self)
1213
636
for name in (property_name,
637
property_name + "_dbus_property"):
638
prop = getattr(self, name, None)
639
if (prop is None
640
or not self._is_dbus_property(prop)
641
or prop._dbus_name != property_name
642
or (interface_name and prop._dbus_interface
643
and interface_name != prop._dbus_interface)):
644
continue
645
return prop
1214
646
# No such property
1215
raise DBusPropertyNotFound("{}:{}.{}".format(
1216
self.dbus_object_path, interface_name, property_name))
1217
1218
@classmethod
1219
def _get_all_interface_names(cls):
1220
"""Get a sequence of all interfaces supported by an object"""
1221
return (name for name in set(getattr(getattr(x, attr),
1222
"_dbus_interface", None)
1223
for x in (inspect.getmro(cls))
1224
for attr in dir(x))
1225
if name is not None)
1226
1227
@dbus.service.method(dbus.PROPERTIES_IFACE,
1228
in_signature="ss",
647
raise DBusPropertyNotFound(self.dbus_object_path + ":"
648
+ interface_name + "."
649
+ property_name)
650
651
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1229
652
out_signature="v")
1230
653
def Get(self, interface_name, property_name):
1231
654
"""Standard D-Bus property Get() method, see D-Bus standard.
1249
672
# The byte_arrays option is not supported yet on
1250
673
# signatures other than "ay".
1251
674
if prop._dbus_signature != "ay":
1252
raise ValueError("Byte arrays not supported for non-"
1253
"'ay' signature {!r}"
1254
.format(prop._dbus_signature))
1255
value = dbus.ByteArray(b''.join(chr(byte)
1256
for byte in value))
675
raise ValueError
676
value = dbus.ByteArray(''.join(unichr(byte)
677
for byte in value))
1257
678
prop(value)
1258
679
1259
@dbus.service.method(dbus.PROPERTIES_IFACE,
1260
in_signature="s",
680
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1261
681
out_signature="a{sv}")
1262
682
def GetAll(self, interface_name):
1263
683
"""Standard D-Bus property GetAll() method, see D-Bus
1264
684
standard.
1265
685
1266
686
Note: Will not include properties with access="write".
1267
687
"""
1268
properties = {}
1269
for name, prop in self._get_all_dbus_things("property"):
688
all = {}
689
for name, prop in self._get_all_dbus_properties():
1270
690
if (interface_name
1271
691
and interface_name != prop._dbus_interface):
1272
692
# Interface non-empty but did not match
1276
696
continue
1277
697
value = prop()
1278
698
if not hasattr(value, "variant_level"):
1279
properties[name] = value
699
all[name] = value
1280
700
continue
1281
properties[name] = type(value)(
1282
value, variant_level = value.variant_level + 1)
1283
return dbus.Dictionary(properties, signature="sv")
1284
1285
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1286
def PropertiesChanged(self, interface_name, changed_properties,
1287
invalidated_properties):
1288
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1289
standard.
1290
"""
1291
pass
701
all[name] = type(value)(value, variant_level=
702
value.variant_level+1)
703
return dbus.Dictionary(all, signature="sv")
1292
704
1293
705
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1294
706
out_signature="s",
1295
707
path_keyword='object_path',
1296
708
connection_keyword='connection')
1297
709
def Introspect(self, object_path, connection):
1298
"""Overloading of standard D-Bus method.
1299
1300
Inserts property tags and interface annotation tags.
710
"""Standard D-Bus method, overloaded to insert property tags.
1301
711
"""
1302
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1303
object_path,
1304
connection)
712
xmlstring = dbus.service.Object.Introspect(self, object_path,
713
connection)
1305
714
try:
1306
715
document = xml.dom.minidom.parseString(xmlstring)
1307
1308
716
def make_tag(document, name, prop):
1309
717
e = document.createElement("property")
1310
718
e.setAttribute("name", name)
1311
719
e.setAttribute("type", prop._dbus_signature)
1312
720
e.setAttribute("access", prop._dbus_access)
1313
721
return e
1314
1315
722
for if_tag in document.getElementsByTagName("interface"):
1316
# Add property tags
1317
723
for tag in (make_tag(document, name, prop)
1318
724
for name, prop
1319
in self._get_all_dbus_things("property")
725
in self._get_all_dbus_properties()
1320
726
if prop._dbus_interface
1321
727
== if_tag.getAttribute("name")):
1322
728
if_tag.appendChild(tag)
1323
# Add annotation tags for properties
1324
for tag in if_tag.getElementsByTagName("property"):
1325
annots = dict()
1326
for name, prop in self._get_all_dbus_things(
1327
"property"):
1328
if (name == tag.getAttribute("name")
1329
and prop._dbus_interface
1330
== if_tag.getAttribute("name")):
1331
annots.update(getattr(
1332
prop, "_dbus_annotations", {}))
1333
for name, value in annots.items():
1334
ann_tag = document.createElement(
1335
"annotation")
1336
ann_tag.setAttribute("name", name)
1337
ann_tag.setAttribute("value", value)
1338
tag.appendChild(ann_tag)
1339
729
# Add the names to the return values for the
1340
730
# "org.freedesktop.DBus.Properties" methods
1341
731
if (if_tag.getAttribute("name")
1356
746
except (AttributeError, xml.dom.DOMException,
1357
747
xml.parsers.expat.ExpatError) as error:
1358
748
logger.error("Failed to override Introspection method",
1359
exc_info=error)
1360
return xmlstring
1361
1362
try:
1363
dbus.OBJECT_MANAGER_IFACE
1364
except AttributeError:
1365
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1366
1367
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1368
"""A D-Bus object with an ObjectManager.
1369
1370
Classes inheriting from this exposes the standard
1371
GetManagedObjects call and the InterfacesAdded and
1372
InterfacesRemoved signals on the standard
1373
"org.freedesktop.DBus.ObjectManager" interface.
1374
1375
Note: No signals are sent automatically; they must be sent
1376
manually.
1377
"""
1378
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1379
out_signature = "a{oa{sa{sv}}}")
1380
def GetManagedObjects(self):
1381
"""This function must be overridden"""
1382
raise NotImplementedError()
1383
1384
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1385
signature = "oa{sa{sv}}")
1386
def InterfacesAdded(self, object_path, interfaces_and_properties):
1387
pass
1388
1389
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1390
def InterfacesRemoved(self, object_path, interfaces):
1391
pass
1392
1393
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1394
out_signature = "s",
1395
path_keyword = 'object_path',
1396
connection_keyword = 'connection')
1397
def Introspect(self, object_path, connection):
1398
"""Overloading of standard D-Bus method.
1399
1400
Override return argument name of GetManagedObjects to be
1401
"objpath_interfaces_and_properties"
1402
"""
1403
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1404
object_path,
1405
connection)
1406
try:
1407
document = xml.dom.minidom.parseString(xmlstring)
1408
1409
for if_tag in document.getElementsByTagName("interface"):
1410
# Fix argument name for the GetManagedObjects method
1411
if (if_tag.getAttribute("name")
1412
== dbus.OBJECT_MANAGER_IFACE):
1413
for cn in if_tag.getElementsByTagName("method"):
1414
if (cn.getAttribute("name")
1415
== "GetManagedObjects"):
1416
for arg in cn.getElementsByTagName("arg"):
1417
if (arg.getAttribute("direction")
1418
== "out"):
1419
arg.setAttribute(
1420
"name",
1421
"objpath_interfaces"
1422
"_and_properties")
1423
xmlstring = document.toxml("utf-8")
1424
document.unlink()
1425
except (AttributeError, xml.dom.DOMException,
1426
xml.parsers.expat.ExpatError) as error:
1427
logger.error("Failed to override Introspection method",
1428
exc_info = error)
1429
return xmlstring
1430
1431
def datetime_to_dbus(dt, variant_level=0):
749
error)
750
return xmlstring
751
752
753
def datetime_to_dbus (dt, variant_level=0):
1432
754
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1433
755
if dt is None:
1434
756
return dbus.String("", variant_level = variant_level)
1435
return dbus.String(dt.isoformat(), variant_level=variant_level)
1436
1437
1438
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1439
"""A class decorator; applied to a subclass of
1440
dbus.service.Object, it will add alternate D-Bus attributes with
1441
interface names according to the "alt_interface_names" mapping.
1442
Usage:
1443
1444
@alternate_dbus_interfaces({"org.example.Interface":
1445
"net.example.AlternateInterface"})
1446
class SampleDBusObject(dbus.service.Object):
1447
@dbus.service.method("org.example.Interface")
1448
def SampleDBusMethod():
1449
pass
1450
1451
The above "SampleDBusMethod" on "SampleDBusObject" will be
1452
reachable via two interfaces: "org.example.Interface" and
1453
"net.example.AlternateInterface", the latter of which will have
1454
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1455
"true", unless "deprecate" is passed with a False value.
1456
1457
This works for methods and signals, and also for D-Bus properties
1458
(from DBusObjectWithProperties) and interfaces (from the
1459
dbus_interface_annotations decorator).
1460
"""
1461
1462
def wrapper(cls):
1463
for orig_interface_name, alt_interface_name in (
1464
alt_interface_names.items()):
1465
attr = {}
1466
interface_names = set()
1467
# Go though all attributes of the class
1468
for attrname, attribute in inspect.getmembers(cls):
1469
# Ignore non-D-Bus attributes, and D-Bus attributes
1470
# with the wrong interface name
1471
if (not hasattr(attribute, "_dbus_interface")
1472
or not attribute._dbus_interface.startswith(
1473
orig_interface_name)):
1474
continue
1475
# Create an alternate D-Bus interface name based on
1476
# the current name
1477
alt_interface = attribute._dbus_interface.replace(
1478
orig_interface_name, alt_interface_name)
1479
interface_names.add(alt_interface)
1480
# Is this a D-Bus signal?
1481
if getattr(attribute, "_dbus_is_signal", False):
1482
if sys.version_info.major == 2:
1483
# Extract the original non-method undecorated
1484
# function by black magic
1485
nonmethod_func = (dict(
1486
zip(attribute.func_code.co_freevars,
1487
attribute.__closure__))
1488
["func"].cell_contents)
1489
else:
1490
nonmethod_func = attribute
1491
# Create a new, but exactly alike, function
1492
# object, and decorate it to be a new D-Bus signal
1493
# with the alternate D-Bus interface name
1494
if sys.version_info.major == 2:
1495
new_function = types.FunctionType(
1496
nonmethod_func.func_code,
1497
nonmethod_func.func_globals,
1498
nonmethod_func.func_name,
1499
nonmethod_func.func_defaults,
1500
nonmethod_func.func_closure)
1501
else:
1502
new_function = types.FunctionType(
1503
nonmethod_func.__code__,
1504
nonmethod_func.__globals__,
1505
nonmethod_func.__name__,
1506
nonmethod_func.__defaults__,
1507
nonmethod_func.__closure__)
1508
new_function = (dbus.service.signal(
1509
alt_interface,
1510
attribute._dbus_signature)(new_function))
1511
# Copy annotations, if any
1512
try:
1513
new_function._dbus_annotations = dict(
1514
attribute._dbus_annotations)
1515
except AttributeError:
1516
pass
1517
# Define a creator of a function to call both the
1518
# original and alternate functions, so both the
1519
# original and alternate signals gets sent when
1520
# the function is called
1521
def fixscope(func1, func2):
1522
"""This function is a scope container to pass
1523
func1 and func2 to the "call_both" function
1524
outside of its arguments"""
1525
1526
@functools.wraps(func2)
1527
def call_both(*args, **kwargs):
1528
"""This function will emit two D-Bus
1529
signals by calling func1 and func2"""
1530
func1(*args, **kwargs)
1531
func2(*args, **kwargs)
1532
# Make wrapper function look like a D-Bus signal
1533
for name, attr in inspect.getmembers(func2):
1534
if name.startswith("_dbus_"):
1535
setattr(call_both, name, attr)
1536
1537
return call_both
1538
# Create the "call_both" function and add it to
1539
# the class
1540
attr[attrname] = fixscope(attribute, new_function)
1541
# Is this a D-Bus method?
1542
elif getattr(attribute, "_dbus_is_method", False):
1543
# Create a new, but exactly alike, function
1544
# object. Decorate it to be a new D-Bus method
1545
# with the alternate D-Bus interface name. Add it
1546
# to the class.
1547
attr[attrname] = (
1548
dbus.service.method(
1549
alt_interface,
1550
attribute._dbus_in_signature,
1551
attribute._dbus_out_signature)
1552
(types.FunctionType(attribute.func_code,
1553
attribute.func_globals,
1554
attribute.func_name,
1555
attribute.func_defaults,
1556
attribute.func_closure)))
1557
# Copy annotations, if any
1558
try:
1559
attr[attrname]._dbus_annotations = dict(
1560
attribute._dbus_annotations)
1561
except AttributeError:
1562
pass
1563
# Is this a D-Bus property?
1564
elif getattr(attribute, "_dbus_is_property", False):
1565
# Create a new, but exactly alike, function
1566
# object, and decorate it to be a new D-Bus
1567
# property with the alternate D-Bus interface
1568
# name. Add it to the class.
1569
attr[attrname] = (dbus_service_property(
1570
alt_interface, attribute._dbus_signature,
1571
attribute._dbus_access,
1572
attribute._dbus_get_args_options
1573
["byte_arrays"])
1574
(types.FunctionType(
1575
attribute.func_code,
1576
attribute.func_globals,
1577
attribute.func_name,
1578
attribute.func_defaults,
1579
attribute.func_closure)))
1580
# Copy annotations, if any
1581
try:
1582
attr[attrname]._dbus_annotations = dict(
1583
attribute._dbus_annotations)
1584
except AttributeError:
1585
pass
1586
# Is this a D-Bus interface?
1587
elif getattr(attribute, "_dbus_is_interface", False):
1588
# Create a new, but exactly alike, function
1589
# object. Decorate it to be a new D-Bus interface
1590
# with the alternate D-Bus interface name. Add it
1591
# to the class.
1592
attr[attrname] = (
1593
dbus_interface_annotations(alt_interface)
1594
(types.FunctionType(attribute.func_code,
1595
attribute.func_globals,
1596
attribute.func_name,
1597
attribute.func_defaults,
1598
attribute.func_closure)))
1599
if deprecate:
1600
# Deprecate all alternate interfaces
1601
iname="_AlternateDBusNames_interface_annotation{}"
1602
for interface_name in interface_names:
1603
1604
@dbus_interface_annotations(interface_name)
1605
def func(self):
1606
return { "org.freedesktop.DBus.Deprecated":
1607
"true" }
1608
# Find an unused name
1609
for aname in (iname.format(i)
1610
for i in itertools.count()):
1611
if aname not in attr:
1612
attr[aname] = func
1613
break
1614
if interface_names:
1615
# Replace the class with a new subclass of it with
1616
# methods, signals, etc. as created above.
1617
cls = type(b"{}Alternate".format(cls.__name__),
1618
(cls, ), attr)
1619
return cls
1620
1621
return wrapper
1622
1623
1624
@alternate_dbus_interfaces({"se.recompile.Mandos":
1625
"se.bsnet.fukt.Mandos"})
757
return dbus.String(dt.isoformat(),
758
variant_level=variant_level)
759
1626
760
class ClientDBus(Client, DBusObjectWithProperties):
1627
761
"""A Client class using D-Bus
1628
762
1632
766
"""
1633
767
1634
768
runtime_expansions = (Client.runtime_expansions
1635
+ ("dbus_object_path", ))
1636
1637
_interface = "se.recompile.Mandos.Client"
769
+ ("dbus_object_path",))
1638
770
1639
771
# dbus.service.Object doesn't use super(), so we can't either.
1640
772
1641
773
def __init__(self, bus = None, *args, **kwargs):
774
self._approvals_pending = 0
1642
775
self.bus = bus
1643
776
Client.__init__(self, *args, **kwargs)
1644
777
# Only now, when this client is initialized, can it show up on
1645
778
# the D-Bus
1646
client_object_name = str(self.name).translate(
779
client_object_name = unicode(self.name).translate(
1647
780
{ord("."): ord("_"),
1648
781
ord("-"): ord("_")})
1649
self.dbus_object_path = dbus.ObjectPath(
1650
"/clients/" + client_object_name)
782
self.dbus_object_path = (dbus.ObjectPath
783
("/clients/" + client_object_name))
1651
784
DBusObjectWithProperties.__init__(self, self.bus,
1652
785
self.dbus_object_path)
1653
1654
def notifychangeproperty(transform_func, dbus_name,
1655
type_func=lambda x: x,
1656
variant_level=1,
1657
invalidate_only=False,
1658
_interface=_interface):
1659
""" Modify a variable so that it's a property which announces
1660
its changes to DBus.
1661
786
1662
transform_fun: Function that takes a value and a variant_level
1663
and transforms it to a D-Bus type.
1664
dbus_name: D-Bus name of the variable
787
def notifychangeproperty(transform_func,
788
dbus_name, type_func=lambda x: x,
789
variant_level=1):
790
""" Modify a variable so that its a property that announce its
791
changes to DBus.
792
transform_fun: Function that takes a value and transform it to
793
DBus type.
794
dbus_name: DBus name of the variable
1665
795
type_func: Function that transform the value before sending it
1666
to the D-Bus. Default: no transform
1667
variant_level: D-Bus variant level. Default: 1
796
to DBus
797
variant_level: DBus variant level. default: 1
1668
798
"""
1669
attrname = "_{}".format(dbus_name)
1670
799
real_value = [None,]
1671
800
def setter(self, value):
801
old_value = real_value[0]
802
real_value[0] = value
1672
803
if hasattr(self, "dbus_object_path"):
1673
if (not hasattr(self, attrname) or
1674
type_func(getattr(self, attrname, None))
1675
!= type_func(value)):
1676
if invalidate_only:
1677
self.PropertiesChanged(
1678
_interface, dbus.Dictionary(),
1679
dbus.Array((dbus_name, )))
1680
else:
1681
dbus_value = transform_func(
1682
type_func(value),
1683
variant_level = variant_level)
1684
self.PropertyChanged(dbus.String(dbus_name),
1685
dbus_value)
1686
self.PropertiesChanged(
1687
_interface,
1688
dbus.Dictionary({ dbus.String(dbus_name):
1689
dbus_value }),
1690
dbus.Array())
1691
setattr(self, attrname, value)
1692
1693
return property(lambda self: getattr(self, attrname), setter)
1694
804
if type_func(old_value) != type_func(real_value[0]):
805
dbus_value = transform_func(type_func(real_value[0]),
806
variant_level)
807
self.PropertyChanged(dbus.String(dbus_name),
808
dbus_value)
809
810
return property(lambda self: real_value[0], setter)
811
812
1695
813
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1696
814
approvals_pending = notifychangeproperty(dbus.Boolean,
1697
815
"ApprovalPending",
1699
817
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1700
818
last_enabled = notifychangeproperty(datetime_to_dbus,
1701
819
"LastEnabled")
1702
checker = notifychangeproperty(
1703
dbus.Boolean, "CheckerRunning",
1704
type_func = lambda checker: checker is not None)
820
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
821
type_func = lambda checker: checker is not None)
1705
822
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1706
823
"LastCheckedOK")
1707
last_checker_status = notifychangeproperty(dbus.Int16,
1708
"LastCheckerStatus")
1709
last_approval_request = notifychangeproperty(
1710
datetime_to_dbus, "LastApprovalRequest")
824
last_approval_request = notifychangeproperty(datetime_to_dbus,
825
"LastApprovalRequest")
1711
826
approved_by_default = notifychangeproperty(dbus.Boolean,
1712
827
"ApprovedByDefault")
1713
approval_delay = notifychangeproperty(
1714
dbus.UInt64, "ApprovalDelay",
1715
type_func = lambda td: td.total_seconds() * 1000)
1716
approval_duration = notifychangeproperty(
1717
dbus.UInt64, "ApprovalDuration",
1718
type_func = lambda td: td.total_seconds() * 1000)
828
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
829
type_func = _timedelta_to_milliseconds)
830
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
831
type_func = _timedelta_to_milliseconds)
1719
832
host = notifychangeproperty(dbus.String, "Host")
1720
timeout = notifychangeproperty(
1721
dbus.UInt64, "Timeout",
1722
type_func = lambda td: td.total_seconds() * 1000)
1723
extended_timeout = notifychangeproperty(
1724
dbus.UInt64, "ExtendedTimeout",
1725
type_func = lambda td: td.total_seconds() * 1000)
1726
interval = notifychangeproperty(
1727
dbus.UInt64, "Interval",
1728
type_func = lambda td: td.total_seconds() * 1000)
833
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
834
type_func = _timedelta_to_milliseconds)
835
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
836
type_func = _timedelta_to_milliseconds)
837
interval = notifychangeproperty(dbus.UInt16, "Interval",
838
type_func = _timedelta_to_milliseconds)
1729
839
checker_command = notifychangeproperty(dbus.String, "Checker")
1730
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1731
invalidate_only=True)
1732
840
1733
841
del notifychangeproperty
1734
842
1741
849
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1742
850
Client.__del__(self, *args, **kwargs)
1743
851
1744
def checker_callback(self, source, condition,
1745
connection, command, *args, **kwargs):
1746
ret = Client.checker_callback(self, source, condition,
1747
connection, command, *args,
1748
**kwargs)
1749
exitstatus = self.last_checker_status
1750
if exitstatus >= 0:
852
def checker_callback(self, pid, condition, command,
853
*args, **kwargs):
854
self.checker_callback_tag = None
855
self.checker = None
856
if os.WIFEXITED(condition):
857
exitstatus = os.WEXITSTATUS(condition)
1751
858
# Emit D-Bus signal
1752
859
self.CheckerCompleted(dbus.Int16(exitstatus),
1753
# This is specific to GNU libC
1754
dbus.Int64(exitstatus << 8),
860
dbus.Int64(condition),
1755
861
dbus.String(command))
1756
862
else:
1757
863
# Emit D-Bus signal
1758
864
self.CheckerCompleted(dbus.Int16(-1),
1759
dbus.Int64(
1760
# This is specific to GNU libC
1761
(exitstatus << 8)
1762
| self.last_checker_signal),
865
dbus.Int64(condition),
1763
866
dbus.String(command))
1764
return ret
1765
867
868
return Client.checker_callback(self, pid, condition, command,
869
*args, **kwargs)
870
1766
871
def start_checker(self, *args, **kwargs):
1767
old_checker_pid = getattr(self.checker, "pid", None)
872
old_checker = self.checker
873
if self.checker is not None:
874
old_checker_pid = self.checker.pid
875
else:
876
old_checker_pid = None
1768
877
r = Client.start_checker(self, *args, **kwargs)
1769
878
# Only if new checker process was started
1770
879
if (self.checker is not None
1774
883
return r
1775
884
1776
885
def _reset_approved(self):
1777
self.approved = None
886
self._approved = None
1778
887
return False
1779
888
1780
889
def approve(self, value=True):
1781
self.approved = value
1782
gobject.timeout_add(int(self.approval_duration.total_seconds()
1783
* 1000), self._reset_approved)
1784
890
self.send_changedstate()
891
self._approved = value
892
gobject.timeout_add(_timedelta_to_milliseconds
893
(self.approval_duration),
894
self._reset_approved)
895
1785
896
1786
897
## D-Bus methods, signals & properties
1787
1788
## Interfaces
898
_interface = "se.bsnet.fukt.Mandos.Client"
1789
899
1790
900
## Signals
1791
901
1802
912
pass
1803
913
1804
914
# PropertyChanged - signal
1805
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1806
915
@dbus.service.signal(_interface, signature="sv")
1807
916
def PropertyChanged(self, property, value):
1808
917
"D-Bus signal"
1842
951
self.checked_ok()
1843
952
1844
953
# Enable - method
1845
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1846
954
@dbus.service.method(_interface)
1847
955
def Enable(self):
1848
956
"D-Bus method"
1849
957
self.enable()
1850
958
1851
959
# StartChecker - method
1852
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1853
960
@dbus.service.method(_interface)
1854
961
def StartChecker(self):
1855
962
"D-Bus method"
1856
963
self.start_checker()
1857
964
1858
965
# Disable - method
1859
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1860
966
@dbus.service.method(_interface)
1861
967
def Disable(self):
1862
968
"D-Bus method"
1863
969
self.disable()
1864
970
1865
971
# StopChecker - method
1866
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1867
972
@dbus.service.method(_interface)
1868
973
def StopChecker(self):
1869
974
self.stop_checker()
1876
981
return dbus.Boolean(bool(self.approvals_pending))
1877
982
1878
983
# ApprovedByDefault - property
1879
@dbus_service_property(_interface,
1880
signature="b",
984
@dbus_service_property(_interface, signature="b",
1881
985
access="readwrite")
1882
986
def ApprovedByDefault_dbus_property(self, value=None):
1883
987
if value is None: # get
1885
989
self.approved_by_default = bool(value)
1886
990
1887
991
# ApprovalDelay - property
1888
@dbus_service_property(_interface,
1889
signature="t",
992
@dbus_service_property(_interface, signature="t",
1890
993
access="readwrite")
1891
994
def ApprovalDelay_dbus_property(self, value=None):
1892
995
if value is None: # get
1893
return dbus.UInt64(self.approval_delay.total_seconds()
1894
* 1000)
996
return dbus.UInt64(self.approval_delay_milliseconds())
1895
997
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1896
998
1897
999
# ApprovalDuration - property
1898
@dbus_service_property(_interface,
1899
signature="t",
1000
@dbus_service_property(_interface, signature="t",
1900
1001
access="readwrite")
1901
1002
def ApprovalDuration_dbus_property(self, value=None):
1902
1003
if value is None: # get
1903
return dbus.UInt64(self.approval_duration.total_seconds()
1904
* 1000)
1004
return dbus.UInt64(_timedelta_to_milliseconds(
1005
self.approval_duration))
1905
1006
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1906
1007
1907
1008
# Name - property
1908
@dbus_annotations(
1909
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1910
1009
@dbus_service_property(_interface, signature="s", access="read")
1911
1010
def Name_dbus_property(self):
1912
1011
return dbus.String(self.name)
1913
1012
1914
1013
# Fingerprint - property
1915
@dbus_annotations(
1916
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1917
1014
@dbus_service_property(_interface, signature="s", access="read")
1918
1015
def Fingerprint_dbus_property(self):
1919
1016
return dbus.String(self.fingerprint)
1920
1017
1921
1018
# Host - property
1922
@dbus_service_property(_interface,
1923
signature="s",
1019
@dbus_service_property(_interface, signature="s",
1924
1020
access="readwrite")
1925
1021
def Host_dbus_property(self, value=None):
1926
1022
if value is None: # get
1927
1023
return dbus.String(self.host)
1928
self.host = str(value)
1024
self.host = value
1929
1025
1930
1026
# Created - property
1931
@dbus_annotations(
1932
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1933
1027
@dbus_service_property(_interface, signature="s", access="read")
1934
1028
def Created_dbus_property(self):
1935
return datetime_to_dbus(self.created)
1029
return dbus.String(datetime_to_dbus(self.created))
1936
1030
1937
1031
# LastEnabled - property
1938
1032
@dbus_service_property(_interface, signature="s", access="read")
1940
1034
return datetime_to_dbus(self.last_enabled)
1941
1035
1942
1036
# Enabled - property
1943
@dbus_service_property(_interface,
1944
signature="b",
1037
@dbus_service_property(_interface, signature="b",
1945
1038
access="readwrite")
1946
1039
def Enabled_dbus_property(self, value=None):
1947
1040
if value is None: # get
1952
1045
self.disable()
1953
1046
1954
1047
# LastCheckedOK - property
1955
@dbus_service_property(_interface,
1956
signature="s",
1048
@dbus_service_property(_interface, signature="s",
1957
1049
access="readwrite")
1958
1050
def LastCheckedOK_dbus_property(self, value=None):
1959
1051
if value is not None:
1961
1053
return
1962
1054
return datetime_to_dbus(self.last_checked_ok)
1963
1055
1964
# LastCheckerStatus - property
1965
@dbus_service_property(_interface, signature="n", access="read")
1966
def LastCheckerStatus_dbus_property(self):
1967
return dbus.Int16(self.last_checker_status)
1968
1969
1056
# Expires - property
1970
1057
@dbus_service_property(_interface, signature="s", access="read")
1971
1058
def Expires_dbus_property(self):
1977
1064
return datetime_to_dbus(self.last_approval_request)
1978
1065
1979
1066
# Timeout - property
1980
@dbus_service_property(_interface,
1981
signature="t",
1067
@dbus_service_property(_interface, signature="t",
1982
1068
access="readwrite")
1983
1069
def Timeout_dbus_property(self, value=None):
1984
1070
if value is None: # get
1985
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1986
old_timeout = self.timeout
1071
return dbus.UInt64(self.timeout_milliseconds())
1987
1072
self.timeout = datetime.timedelta(0, 0, 0, value)
1988
# Reschedule disabling
1989
if self.enabled:
1990
now = datetime.datetime.utcnow()
1991
self.expires += self.timeout - old_timeout
1992
if self.expires <= now:
1993
# The timeout has passed
1994
self.disable()
1995
else:
1996
if (getattr(self, "disable_initiator_tag", None)
1997
is None):
1998
return
1999
gobject.source_remove(self.disable_initiator_tag)
2000
self.disable_initiator_tag = gobject.timeout_add(
2001
int((self.expires - now).total_seconds() * 1000),
2002
self.disable)
2003
1073
if getattr(self, "disable_initiator_tag", None) is None:
1074
return
1075
# Reschedule timeout
1076
gobject.source_remove(self.disable_initiator_tag)
1077
self.disable_initiator_tag = None
1078
self.expires = None
1079
time_to_die = (self.
1080
_timedelta_to_milliseconds((self
1081
.last_checked_ok
1082
+ self.timeout)
1083
- datetime.datetime
1084
.utcnow()))
1085
if time_to_die <= 0:
1086
# The timeout has passed
1087
self.disable()
1088
else:
1089
self.expires = (datetime.datetime.utcnow()
1090
+ datetime.timedelta(milliseconds = time_to_die))
1091
self.disable_initiator_tag = (gobject.timeout_add
1092
(time_to_die, self.disable))
1093
2004
1094
# ExtendedTimeout - property
2005
@dbus_service_property(_interface,
2006
signature="t",
1095
@dbus_service_property(_interface, signature="t",
2007
1096
access="readwrite")
2008
1097
def ExtendedTimeout_dbus_property(self, value=None):
2009
1098
if value is None: # get
2010
return dbus.UInt64(self.extended_timeout.total_seconds()
2011
* 1000)
1099
return dbus.UInt64(self.extended_timeout_milliseconds())
2012
1100
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2013
1101
2014
1102
# Interval - property
2015
@dbus_service_property(_interface,
2016
signature="t",
1103
@dbus_service_property(_interface, signature="t",
2017
1104
access="readwrite")
2018
1105
def Interval_dbus_property(self, value=None):
2019
1106
if value is None: # get
2020
return dbus.UInt64(self.interval.total_seconds() * 1000)
1107
return dbus.UInt64(self.interval_milliseconds())
2021
1108
self.interval = datetime.timedelta(0, 0, 0, value)
2022
1109
if getattr(self, "checker_initiator_tag", None) is None:
2023
1110
return
2024
if self.enabled:
2025
# Reschedule checker run
2026
gobject.source_remove(self.checker_initiator_tag)
2027
self.checker_initiator_tag = gobject.timeout_add(
2028
value, self.start_checker)
2029
self.start_checker() # Start one now, too
2030
1111
# Reschedule checker run
1112
gobject.source_remove(self.checker_initiator_tag)
1113
self.checker_initiator_tag = (gobject.timeout_add
1114
(value, self.start_checker))
1115
self.start_checker() # Start one now, too
1116
2031
1117
# Checker - property
2032
@dbus_service_property(_interface,
2033
signature="s",
1118
@dbus_service_property(_interface, signature="s",
2034
1119
access="readwrite")
2035
1120
def Checker_dbus_property(self, value=None):
2036
1121
if value is None: # get
2037
1122
return dbus.String(self.checker_command)
2038
self.checker_command = str(value)
1123
self.checker_command = value
2039
1124
2040
1125
# CheckerRunning - property
2041
@dbus_service_property(_interface,
2042
signature="b",
1126
@dbus_service_property(_interface, signature="b",
2043
1127
access="readwrite")
2044
1128
def CheckerRunning_dbus_property(self, value=None):
2045
1129
if value is None: # get
2050
1134
self.stop_checker()
2051
1135
2052
1136
# ObjectPath - property
2053
@dbus_annotations(
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2055
"org.freedesktop.DBus.Deprecated": "true"})
2056
1137
@dbus_service_property(_interface, signature="o", access="read")
2057
1138
def ObjectPath_dbus_property(self):
2058
1139
return self.dbus_object_path # is already a dbus.ObjectPath
2059
1140
2060
1141
# Secret = property
2061
@dbus_annotations(
2062
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2063
"invalidates"})
2064
@dbus_service_property(_interface,
2065
signature="ay",
2066
access="write",
2067
byte_arrays=True)
1142
@dbus_service_property(_interface, signature="ay",
1143
access="write", byte_arrays=True)
2068
1144
def Secret_dbus_property(self, value):
2069
self.secret = bytes(value)
1145
self.secret = str(value)
2070
1146
2071
1147
del _interface
2072
1148
2076
1152
self._pipe = child_pipe
2077
1153
self._pipe.send(('init', fpr, address))
2078
1154
if not self._pipe.recv():
2079
raise KeyError(fpr)
2080
1155
raise KeyError()
1156
2081
1157
def __getattribute__(self, name):
2082
if name == '_pipe':
1158
if(name == '_pipe'):
2083
1159
return super(ProxyClient, self).__getattribute__(name)
2084
1160
self._pipe.send(('getattr', name))
2085
1161
data = self._pipe.recv()
2086
1162
if data[0] == 'data':
2087
1163
return data[1]
2088
1164
if data[0] == 'function':
2089
2090
1165
def func(*args, **kwargs):
2091
1166
self._pipe.send(('funcall', name, args, kwargs))
2092
1167
return self._pipe.recv()[1]
2093
2094
1168
return func
2095
1169
2096
1170
def __setattr__(self, name, value):
2097
if name == '_pipe':
1171
if(name == '_pipe'):
2098
1172
return super(ProxyClient, self).__setattr__(name, value)
2099
1173
self._pipe.send(('setattr', name, value))
2100
1174
2108
1182
def handle(self):
2109
1183
with contextlib.closing(self.server.child_pipe) as child_pipe:
2110
1184
logger.info("TCP connection from: %s",
2111
str(self.client_address))
1185
unicode(self.client_address))
2112
1186
logger.debug("Pipe FD: %d",
2113
1187
self.server.child_pipe.fileno())
2114
2115
session = gnutls.ClientSession(self.request)
2116
1188
1189
session = (gnutls.connection
1190
.ClientSession(self.request,
1191
gnutls.connection
1192
.X509Credentials()))
1193
1194
# Note: gnutls.connection.X509Credentials is really a
1195
# generic GnuTLS certificate credentials object so long as
1196
# no X.509 keys are added to it. Therefore, we can use it
1197
# here despite using OpenPGP certificates.
1198
2117
1199
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2118
1200
# "+AES-256-CBC", "+SHA1",
2119
1201
# "+COMP-NULL", "+CTYPE-OPENPGP",
2122
1204
priority = self.server.gnutls_priority
2123
1205
if priority is None:
2124
1206
priority = "NORMAL"
2125
gnutls.priority_set_direct(session._c_object, priority,
2126
None)
2127
1207
(gnutls.library.functions
1208
.gnutls_priority_set_direct(session._c_object,
1209
priority, None))
1210
2128
1211
# Start communication using the Mandos protocol
2129
1212
# Get protocol number
2130
1213
line = self.request.makefile().readline()
2131
1214
logger.debug("Protocol version: %r", line)
2132
1215
try:
2133
1216
if int(line.strip().split()[0]) > 1:
2134
raise RuntimeError(line)
1217
raise RuntimeError
2135
1218
except (ValueError, IndexError, RuntimeError) as error:
2136
1219
logger.error("Unknown protocol version: %s", error)
2137
1220
return
2138
1221
2139
1222
# Start GnuTLS connection
2140
1223
try:
2141
1224
session.handshake()
2142
except gnutls.Error as error:
1225
except gnutls.errors.GNUTLSError as error:
2143
1226
logger.warning("Handshake failed: %s", error)
2144
1227
# Do not run session.bye() here: the session is not
2145
1228
# established. Just abandon the request.
2146
1229
return
2147
1230
logger.debug("Handshake succeeded")
2148
1231
2149
1232
approval_required = False
2150
1233
try:
2151
1234
try:
2152
fpr = self.fingerprint(
2153
self.peer_certificate(session))
2154
except (TypeError, gnutls.Error) as error:
1235
fpr = self.fingerprint(self.peer_certificate
1236
(session))
1237
except (TypeError,
1238
gnutls.errors.GNUTLSError) as error:
2155
1239
logger.warning("Bad certificate: %s", error)
2156
1240
return
2157
1241
logger.debug("Fingerprint: %s", fpr)
2158
1242
2159
1243
try:
2160
1244
client = ProxyClient(child_pipe, fpr,
2161
1245
self.client_address)
2170
1254
while True:
2171
1255
if not client.enabled:
2172
1256
logger.info("Client %s is disabled",
2173
client.name)
1257
client.name)
2174
1258
if self.server.use_dbus:
2175
1259
# Emit D-Bus signal
2176
client.Rejected("Disabled")
1260
client.Rejected("Disabled")
2177
1261
return
2178
1262
2179
if client.approved or not client.approval_delay:
1263
if client._approved or not client.approval_delay:
2180
1264
#We are approved or approval is disabled
2181
1265
break
2182
elif client.approved is None:
1266
elif client._approved is None:
2183
1267
logger.info("Client %s needs approval",
2184
1268
client.name)
2185
1269
if self.server.use_dbus:
2186
1270
# Emit D-Bus signal
2187
1271
client.NeedApproval(
2188
client.approval_delay.total_seconds()
2189
* 1000, client.approved_by_default)
1272
client.approval_delay_milliseconds(),
1273
client.approved_by_default)
2190
1274
else:
2191
1275
logger.warning("Client %s was not approved",
2192
1276
client.name)
2196
1280
return
2197
1281
2198
1282
#wait until timeout or approved
1283
#x = float(client._timedelta_to_milliseconds(delay))
2199
1284
time = datetime.datetime.now()
2200
1285
client.changedstate.acquire()
2201
client.changedstate.wait(delay.total_seconds())
1286
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
2202
1287
client.changedstate.release()
2203
1288
time2 = datetime.datetime.now()
2204
1289
if (time2 - time) >= delay:
2219
1304
while sent_size < len(client.secret):
2220
1305
try:
2221
1306
sent = session.send(client.secret[sent_size:])
2222
except gnutls.Error as error:
2223
logger.warning("gnutls send failed",
2224
exc_info=error)
1307
except gnutls.errors.GNUTLSError as error:
1308
logger.warning("gnutls send failed")
2225
1309
return
2226
logger.debug("Sent: %d, remaining: %d", sent,
2227
len(client.secret) - (sent_size
2228
+ sent))
1310
logger.debug("Sent: %d, remaining: %d",
1311
sent, len(client.secret)
1312
- (sent_size + sent))
2229
1313
sent_size += sent
2230
1314
2231
1315
logger.info("Sending secret to %s", client.name)
2232
# bump the timeout using extended_timeout
2233
client.bump_timeout(client.extended_timeout)
1316
# bump the timeout as if seen
1317
client.checked_ok(client.extended_timeout)
2234
1318
if self.server.use_dbus:
2235
1319
# Emit D-Bus signal
2236
1320
client.GotSecret()
2240
1324
client.approvals_pending -= 1
2241
1325
try:
2242
1326
session.bye()
2243
except gnutls.Error as error:
2244
logger.warning("GnuTLS bye failed",
2245
exc_info=error)
1327
except gnutls.errors.GNUTLSError as error:
1328
logger.warning("GnuTLS bye failed")
2246
1329
2247
1330
@staticmethod
2248
1331
def peer_certificate(session):
2249
1332
"Return the peer's OpenPGP certificate as a bytestring"
2250
1333
# If not an OpenPGP certificate...
2251
if (gnutls.certificate_type_get(session._c_object)
2252
!= gnutls.CRT_OPENPGP):
2253
# ...return invalid data
2254
return b""
1334
if (gnutls.library.functions
1335
.gnutls_certificate_type_get(session._c_object)
1336
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1337
# ...do the normal thing
1338
return session.peer_certificate
2255
1339
list_size = ctypes.c_uint(1)
2256
cert_list = (gnutls.certificate_get_peers
1340
cert_list = (gnutls.library.functions
1341
.gnutls_certificate_get_peers
2257
1342
(session._c_object, ctypes.byref(list_size)))
2258
1343
if not bool(cert_list) and list_size.value != 0:
2259
raise gnutls.Error("error getting peer certificate")
1344
raise gnutls.errors.GNUTLSError("error getting peer"
1345
" certificate")
2260
1346
if list_size.value == 0:
2261
1347
return None
2262
1348
cert = cert_list[0]
2266
1352
def fingerprint(openpgp):
2267
1353
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2268
1354
# New GnuTLS "datum" with the OpenPGP public key
2269
datum = gnutls.datum_t(
2270
ctypes.cast(ctypes.c_char_p(openpgp),
2271
ctypes.POINTER(ctypes.c_ubyte)),
2272
ctypes.c_uint(len(openpgp)))
1355
datum = (gnutls.library.types
1356
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1357
ctypes.POINTER
1358
(ctypes.c_ubyte)),
1359
ctypes.c_uint(len(openpgp))))
2273
1360
# New empty GnuTLS certificate
2274
crt = gnutls.openpgp_crt_t()
2275
gnutls.openpgp_crt_init(ctypes.byref(crt))
1361
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1362
(gnutls.library.functions
1363
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2276
1364
# Import the OpenPGP public key into the certificate
2277
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2278
gnutls.OPENPGP_FMT_RAW)
1365
(gnutls.library.functions
1366
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1367
gnutls.library.constants
1368
.GNUTLS_OPENPGP_FMT_RAW))
2279
1369
# Verify the self signature in the key
2280
1370
crtverify = ctypes.c_uint()
2281
gnutls.openpgp_crt_verify_self(crt, 0,
2282
ctypes.byref(crtverify))
1371
(gnutls.library.functions
1372
.gnutls_openpgp_crt_verify_self(crt, 0,
1373
ctypes.byref(crtverify)))
2283
1374
if crtverify.value != 0:
2284
gnutls.openpgp_crt_deinit(crt)
2285
raise gnutls.CertificateSecurityError("Verify failed")
1375
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1376
raise (gnutls.errors.CertificateSecurityError
1377
("Verify failed"))
2286
1378
# New buffer for the fingerprint
2287
1379
buf = ctypes.create_string_buffer(20)
2288
1380
buf_len = ctypes.c_size_t()
2289
1381
# Get the fingerprint from the certificate into the buffer
2290
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2291
ctypes.byref(buf_len))
1382
(gnutls.library.functions
1383
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1384
ctypes.byref(buf_len)))
2292
1385
# Deinit the certificate
2293
gnutls.openpgp_crt_deinit(crt)
1386
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2294
1387
# Convert the buffer to a Python bytestring
2295
1388
fpr = ctypes.string_at(buf, buf_len.value)
2296
1389
# Convert the bytestring to hexadecimal notation
2297
hex_fpr = binascii.hexlify(fpr).upper()
1390
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
2298
1391
return hex_fpr
2299
1392
2300
1393
2301
1394
class MultiprocessingMixIn(object):
2302
1395
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2303
2304
1396
def sub_process_main(self, request, address):
2305
1397
try:
2306
1398
self.finish_request(request, address)
2307
except Exception:
1399
except:
2308
1400
self.handle_error(request, address)
2309
1401
self.close_request(request)
2310
1402
2311
1403
def process_request(self, request, address):
2312
1404
"""Start a new process to process the request."""
2313
proc = multiprocessing.Process(target = self.sub_process_main,
2314
args = (request, address))
2315
proc.start()
2316
return proc
2317
1405
multiprocessing.Process(target = self.sub_process_main,
1406
args = (request, address)).start()
2318
1407
2319
1408
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2320
1409
""" adds a pipe to the MixIn """
2321
2322
1410
def process_request(self, request, client_address):
2323
1411
"""Overrides and wraps the original process_request().
2324
1412
2325
1413
This function creates a new pipe in self.pipe
2326
1414
"""
2327
1415
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2328
2329
proc = MultiprocessingMixIn.process_request(self, request,
2330
client_address)
1416
1417
super(MultiprocessingMixInWithPipe,
1418
self).process_request(request, client_address)
2331
1419
self.child_pipe.close()
2332
self.add_pipe(parent_pipe, proc)
2333
2334
def add_pipe(self, parent_pipe, proc):
1420
self.add_pipe(parent_pipe)
1421
1422
def add_pipe(self, parent_pipe):
2335
1423
"""Dummy function; override as necessary"""
2336
raise NotImplementedError()
2337
1424
raise NotImplementedError
2338
1425
2339
1426
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2340
1427
socketserver.TCPServer, object):
2345
1432
interface: None or a network interface name (string)
2346
1433
use_ipv6: Boolean; to use IPv6 or not
2347
1434
"""
2348
2349
1435
def __init__(self, server_address, RequestHandlerClass,
2350
interface=None,
2351
use_ipv6=True,
2352
socketfd=None):
2353
"""If socketfd is set, use that file descriptor instead of
2354
creating a new one with socket.socket().
2355
"""
1436
interface=None, use_ipv6=True):
2356
1437
self.interface = interface
2357
1438
if use_ipv6:
2358
1439
self.address_family = socket.AF_INET6
2359
if socketfd is not None:
2360
# Save the file descriptor
2361
self.socketfd = socketfd
2362
# Save the original socket.socket() function
2363
self.socket_socket = socket.socket
2364
# To implement --socket, we monkey patch socket.socket.
2365
#
2366
# (When socketserver.TCPServer is a new-style class, we
2367
# could make self.socket into a property instead of monkey
2368
# patching socket.socket.)
2369
#
2370
# Create a one-time-only replacement for socket.socket()
2371
@functools.wraps(socket.socket)
2372
def socket_wrapper(*args, **kwargs):
2373
# Restore original function so subsequent calls are
2374
# not affected.
2375
socket.socket = self.socket_socket
2376
del self.socket_socket
2377
# This time only, return a new socket object from the
2378
# saved file descriptor.
2379
return socket.fromfd(self.socketfd, *args, **kwargs)
2380
# Replace socket.socket() function with wrapper
2381
socket.socket = socket_wrapper
2382
# The socketserver.TCPServer.__init__ will call
2383
# socket.socket(), which might be our replacement,
2384
# socket_wrapper(), if socketfd was set.
2385
1440
socketserver.TCPServer.__init__(self, server_address,
2386
1441
RequestHandlerClass)
2387
2388
1442
def server_bind(self):
2389
1443
"""This overrides the normal server_bind() function
2390
1444
to bind to an interface if one was specified, and also NOT to
2396
1450
self.interface)
2397
1451
else:
2398
1452
try:
2399
self.socket.setsockopt(
2400
socket.SOL_SOCKET, SO_BINDTODEVICE,
2401
(self.interface + "\0").encode("utf-8"))
1453
self.socket.setsockopt(socket.SOL_SOCKET,
1454
SO_BINDTODEVICE,
1455
str(self.interface
1456
+ '\0'))
2402
1457
except socket.error as error:
2403
if error.errno == errno.EPERM:
2404
logger.error("No permission to bind to"
2405
" interface %s", self.interface)
2406
elif error.errno == errno.ENOPROTOOPT:
1458
if error[0] == errno.EPERM:
1459
logger.error("No permission to"
1460
" bind to interface %s",
1461
self.interface)
1462
elif error[0] == errno.ENOPROTOOPT:
2407
1463
logger.error("SO_BINDTODEVICE not available;"
2408
1464
" cannot bind to interface %s",
2409
1465
self.interface)
2410
elif error.errno == errno.ENODEV:
2411
logger.error("Interface %s does not exist,"
2412
" cannot bind", self.interface)
2413
1466
else:
2414
1467
raise
2415
1468
# Only bind(2) the socket if we really need to.
2418
1471
if self.address_family == socket.AF_INET6:
2419
1472
any_address = "::" # in6addr_any
2420
1473
else:
2421
any_address = "0.0.0.0" # INADDR_ANY
1474
any_address = socket.INADDR_ANY
2422
1475
self.server_address = (any_address,
2423
1476
self.server_address[1])
2424
1477
elif not self.server_address[1]:
2425
self.server_address = (self.server_address[0], 0)
1478
self.server_address = (self.server_address[0],
1479
0)
2426
1480
# if self.interface:
2427
1481
# self.server_address = (self.server_address[0],
2428
1482
# 0, # port
2442
1496
2443
1497
Assumes a gobject.MainLoop event loop.
2444
1498
"""
2445
2446
1499
def __init__(self, server_address, RequestHandlerClass,
2447
interface=None,
2448
use_ipv6=True,
2449
clients=None,
2450
gnutls_priority=None,
2451
use_dbus=True,
2452
socketfd=None):
1500
interface=None, use_ipv6=True, clients=None,
1501
gnutls_priority=None, use_dbus=True):
2453
1502
self.enabled = False
2454
1503
self.clients = clients
2455
1504
if self.clients is None:
2456
self.clients = {}
1505
self.clients = set()
2457
1506
self.use_dbus = use_dbus
2458
1507
self.gnutls_priority = gnutls_priority
2459
1508
IPv6_TCPServer.__init__(self, server_address,
2460
1509
RequestHandlerClass,
2461
1510
interface = interface,
2462
use_ipv6 = use_ipv6,
2463
socketfd = socketfd)
2464
1511
use_ipv6 = use_ipv6)
2465
1512
def server_activate(self):
2466
1513
if self.enabled:
2467
1514
return socketserver.TCPServer.server_activate(self)
2468
2469
1515
def enable(self):
2470
1516
self.enabled = True
2471
2472
def add_pipe(self, parent_pipe, proc):
1517
def add_pipe(self, parent_pipe):
2473
1518
# Call "handle_ipc" for both data and EOF events
2474
gobject.io_add_watch(
2475
parent_pipe.fileno(),
2476
gobject.IO_IN | gobject.IO_HUP,
2477
functools.partial(self.handle_ipc,
2478
parent_pipe = parent_pipe,
2479
proc = proc))
2480
2481
def handle_ipc(self, source, condition,
2482
parent_pipe=None,
2483
proc = None,
1519
gobject.io_add_watch(parent_pipe.fileno(),
1520
gobject.IO_IN | gobject.IO_HUP,
1521
functools.partial(self.handle_ipc,
1522
parent_pipe = parent_pipe))
1523
1524
def handle_ipc(self, source, condition, parent_pipe=None,
2484
1525
client_object=None):
2485
# error, or the other end of multiprocessing.Pipe has closed
2486
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2487
# Wait for other process to exit
2488
proc.join()
1526
condition_names = {
1527
gobject.IO_IN: "IN", # There is data to read.
1528
gobject.IO_OUT: "OUT", # Data can be written (without
1529
# blocking).
1530
gobject.IO_PRI: "PRI", # There is urgent data to read.
1531
gobject.IO_ERR: "ERR", # Error condition.
1532
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1533
# broken, usually for pipes and
1534
# sockets).
1535
}
1536
conditions_string = ' | '.join(name
1537
for cond, name in
1538
condition_names.iteritems()
1539
if cond & condition)
1540
# error or the other end of multiprocessing.Pipe has closed
1541
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2489
1542
return False
2490
1543
2491
1544
# Read a request from the child
2496
1549
fpr = request[1]
2497
1550
address = request[2]
2498
1551
2499
for c in self.clients.itervalues():
1552
for c in self.clients:
2500
1553
if c.fingerprint == fpr:
2501
1554
client = c
2502
1555
break
2505
1558
"dress: %s", fpr, address)
2506
1559
if self.use_dbus:
2507
1560
# Emit D-Bus signal
2508
mandos_dbus_service.ClientNotFound(fpr,
2509
address[0])
1561
mandos_dbus_service.ClientNotFound(fpr, address[0])
2510
1562
parent_pipe.send(False)
2511
1563
return False
2512
1564
2513
gobject.io_add_watch(
2514
parent_pipe.fileno(),
2515
gobject.IO_IN | gobject.IO_HUP,
2516
functools.partial(self.handle_ipc,
2517
parent_pipe = parent_pipe,
2518
proc = proc,
2519
client_object = client))
1565
gobject.io_add_watch(parent_pipe.fileno(),
1566
gobject.IO_IN | gobject.IO_HUP,
1567
functools.partial(self.handle_ipc,
1568
parent_pipe = parent_pipe,
1569
client_object = client))
2520
1570
parent_pipe.send(True)
2521
# remove the old hook in favor of the new above hook on
2522
# same fileno
1571
# remove the old hook in favor of the new above hook on same fileno
2523
1572
return False
2524
1573
if command == 'funcall':
2525
1574
funcname = request[1]
2526
1575
args = request[2]
2527
1576
kwargs = request[3]
2528
1577
2529
parent_pipe.send(('data', getattr(client_object,
2530
funcname)(*args,
2531
**kwargs)))
2532
1578
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1579
2533
1580
if command == 'getattr':
2534
1581
attrname = request[1]
2535
if isinstance(client_object.__getattribute__(attrname),
2536
collections.Callable):
2537
parent_pipe.send(('function', ))
1582
if callable(client_object.__getattribute__(attrname)):
1583
parent_pipe.send(('function',))
2538
1584
else:
2539
parent_pipe.send((
2540
'data', client_object.__getattribute__(attrname)))
1585
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2541
1586
2542
1587
if command == 'setattr':
2543
1588
attrname = request[1]
2544
1589
value = request[2]
2545
1590
setattr(client_object, attrname, value)
2546
1591
2547
1592
return True
2548
1593
2549
1594
2550
def rfc3339_duration_to_delta(duration):
2551
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2552
2553
>>> rfc3339_duration_to_delta("P7D")
2554
datetime.timedelta(7)
2555
>>> rfc3339_duration_to_delta("PT60S")
2556
datetime.timedelta(0, 60)
2557
>>> rfc3339_duration_to_delta("PT60M")
2558
datetime.timedelta(0, 3600)
2559
>>> rfc3339_duration_to_delta("PT24H")
2560
datetime.timedelta(1)
2561
>>> rfc3339_duration_to_delta("P1W")
2562
datetime.timedelta(7)
2563
>>> rfc3339_duration_to_delta("PT5M30S")
2564
datetime.timedelta(0, 330)
2565
>>> rfc3339_duration_to_delta("P1DT3M20S")
2566
datetime.timedelta(1, 200)
2567
"""
2568
2569
# Parsing an RFC 3339 duration with regular expressions is not
2570
# possible - there would have to be multiple places for the same
2571
# values, like seconds. The current code, while more esoteric, is
2572
# cleaner without depending on a parsing library. If Python had a
2573
# built-in library for parsing we would use it, but we'd like to
2574
# avoid excessive use of external libraries.
2575
2576
# New type for defining tokens, syntax, and semantics all-in-one
2577
Token = collections.namedtuple("Token", (
2578
"regexp", # To match token; if "value" is not None, must have
2579
# a "group" containing digits
2580
"value", # datetime.timedelta or None
2581
"followers")) # Tokens valid after this token
2582
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2583
# the "duration" ABNF definition in RFC 3339, Appendix A.
2584
token_end = Token(re.compile(r"$"), None, frozenset())
2585
token_second = Token(re.compile(r"(\d+)S"),
2586
datetime.timedelta(seconds=1),
2587
frozenset((token_end, )))
2588
token_minute = Token(re.compile(r"(\d+)M"),
2589
datetime.timedelta(minutes=1),
2590
frozenset((token_second, token_end)))
2591
token_hour = Token(re.compile(r"(\d+)H"),
2592
datetime.timedelta(hours=1),
2593
frozenset((token_minute, token_end)))
2594
token_time = Token(re.compile(r"T"),
2595
None,
2596
frozenset((token_hour, token_minute,
2597
token_second)))
2598
token_day = Token(re.compile(r"(\d+)D"),
2599
datetime.timedelta(days=1),
2600
frozenset((token_time, token_end)))
2601
token_month = Token(re.compile(r"(\d+)M"),
2602
datetime.timedelta(weeks=4),
2603
frozenset((token_day, token_end)))
2604
token_year = Token(re.compile(r"(\d+)Y"),
2605
datetime.timedelta(weeks=52),
2606
frozenset((token_month, token_end)))
2607
token_week = Token(re.compile(r"(\d+)W"),
2608
datetime.timedelta(weeks=1),
2609
frozenset((token_end, )))
2610
token_duration = Token(re.compile(r"P"), None,
2611
frozenset((token_year, token_month,
2612
token_day, token_time,
2613
token_week)))
2614
# Define starting values
2615
value = datetime.timedelta() # Value so far
2616
found_token = None
2617
followers = frozenset((token_duration, )) # Following valid tokens
2618
s = duration # String left to parse
2619
# Loop until end token is found
2620
while found_token is not token_end:
2621
# Search for any currently valid tokens
2622
for token in followers:
2623
match = token.regexp.match(s)
2624
if match is not None:
2625
# Token found
2626
if token.value is not None:
2627
# Value found, parse digits
2628
factor = int(match.group(1), 10)
2629
# Add to value so far
2630
value += factor * token.value
2631
# Strip token from string
2632
s = token.regexp.sub("", s, 1)
2633
# Go to found token
2634
found_token = token
2635
# Set valid next tokens
2636
followers = found_token.followers
2637
break
2638
else:
2639
# No currently valid tokens were found
2640
raise ValueError("Invalid RFC 3339 duration: {!r}"
2641
.format(duration))
2642
# End token found
2643
return value
2644
2645
2646
1595
def string_to_delta(interval):
2647
1596
"""Parse a string and return a datetime.timedelta
2648
1597
2659
1608
>>> string_to_delta('5m 30s')
2660
1609
datetime.timedelta(0, 330)
2661
1610
"""
2662
2663
try:
2664
return rfc3339_duration_to_delta(interval)
2665
except ValueError:
2666
pass
2667
2668
1611
timevalue = datetime.timedelta(0)
2669
1612
for s in interval.split():
2670
1613
try:
2671
suffix = s[-1]
1614
suffix = unicode(s[-1])
2672
1615
value = int(s[:-1])
2673
1616
if suffix == "d":
2674
1617
delta = datetime.timedelta(value)
2681
1624
elif suffix == "w":
2682
1625
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2683
1626
else:
2684
raise ValueError("Unknown suffix {!r}".format(suffix))
2685
except IndexError as e:
1627
raise ValueError("Unknown suffix %r" % suffix)
1628
except (ValueError, IndexError) as e:
2686
1629
raise ValueError(*(e.args))
2687
1630
timevalue += delta
2688
1631
return timevalue
2689
1632
2690
1633
1634
def if_nametoindex(interface):
1635
"""Call the C function if_nametoindex(), or equivalent
1636
1637
Note: This function cannot accept a unicode string."""
1638
global if_nametoindex
1639
try:
1640
if_nametoindex = (ctypes.cdll.LoadLibrary
1641
(ctypes.util.find_library("c"))
1642
.if_nametoindex)
1643
except (OSError, AttributeError):
1644
logger.warning("Doing if_nametoindex the hard way")
1645
def if_nametoindex(interface):
1646
"Get an interface index the hard way, i.e. using fcntl()"
1647
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1648
with contextlib.closing(socket.socket()) as s:
1649
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1650
struct.pack(str("16s16x"),
1651
interface))
1652
interface_index = struct.unpack(str("I"),
1653
ifreq[16:20])[0]
1654
return interface_index
1655
return if_nametoindex(interface)
1656
1657
2691
1658
def daemon(nochdir = False, noclose = False):
2692
1659
"""See daemon(3). Standard BSD Unix function.
2693
1660
2701
1668
sys.exit()
2702
1669
if not noclose:
2703
1670
# Close all standard open file descriptors
2704
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1671
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2705
1672
if not stat.S_ISCHR(os.fstat(null).st_mode):
2706
1673
raise OSError(errno.ENODEV,
2707
"{} not a character device"
2708
.format(os.devnull))
1674
"%s not a character device"
1675
% os.path.devnull)
2709
1676
os.dup2(null, sys.stdin.fileno())
2710
1677
os.dup2(null, sys.stdout.fileno())
2711
1678
os.dup2(null, sys.stderr.fileno())
2720
1687
2721
1688
parser = argparse.ArgumentParser()
2722
1689
parser.add_argument("-v", "--version", action="version",
2723
version = "%(prog)s {}".format(version),
1690
version = "%%(prog)s %s" % version,
2724
1691
help="show version number and exit")
2725
1692
parser.add_argument("-i", "--interface", metavar="IF",
2726
1693
help="Bind to interface IF")
2732
1699
help="Run self-test")
2733
1700
parser.add_argument("--debug", action="store_true",
2734
1701
help="Debug mode; run in foreground and log"
2735
" to terminal", default=None)
1702
" to terminal")
2736
1703
parser.add_argument("--debuglevel", metavar="LEVEL",
2737
1704
help="Debug level for stdout output")
2738
1705
parser.add_argument("--priority", help="GnuTLS"
2745
1712
" files")
2746
1713
parser.add_argument("--no-dbus", action="store_false",
2747
1714
dest="use_dbus", help="Do not provide D-Bus"
2748
" system bus interface", default=None)
1715
" system bus interface")
2749
1716
parser.add_argument("--no-ipv6", action="store_false",
2750
dest="use_ipv6", help="Do not use IPv6",
2751
default=None)
2752
parser.add_argument("--no-restore", action="store_false",
2753
dest="restore", help="Do not restore stored"
2754
" state", default=None)
2755
parser.add_argument("--socket", type=int,
2756
help="Specify a file descriptor to a network"
2757
" socket to use instead of creating one")
2758
parser.add_argument("--statedir", metavar="DIR",
2759
help="Directory to save/restore state in")
2760
parser.add_argument("--foreground", action="store_true",
2761
help="Run in foreground", default=None)
2762
parser.add_argument("--no-zeroconf", action="store_false",
2763
dest="zeroconf", help="Do not use Zeroconf",
2764
default=None)
2765
1717
dest="use_ipv6", help="Do not use IPv6")
2766
1718
options = parser.parse_args()
2767
1719
2768
1720
if options.check:
2769
1721
import doctest
2770
fail_count, test_count = doctest.testmod()
2771
sys.exit(os.EX_OK if fail_count == 0 else 1)
1722
doctest.testmod()
1723
sys.exit()
2772
1724
2773
1725
# Default values for config file for server-global settings
2774
1726
server_defaults = { "interface": "",
2776
1728
"port": "",
2777
1729
"debug": "False",
2778
1730
"priority":
2779
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2780
":+SIGN-DSA-SHA256",
1731
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2781
1732
"servicename": "Mandos",
2782
1733
"use_dbus": "True",
2783
1734
"use_ipv6": "True",
2784
1735
"debuglevel": "",
2785
"restore": "True",
2786
"socket": "",
2787
"statedir": "/var/lib/mandos",
2788
"foreground": "False",
2789
"zeroconf": "True",
2790
}
1736
}
2791
1737
2792
1738
# Parse config file for server-global settings
2793
1739
server_config = configparser.SafeConfigParser(server_defaults)
2794
1740
del server_defaults
2795
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1741
server_config.read(os.path.join(options.configdir,
1742
"mandos.conf"))
2796
1743
# Convert the SafeConfigParser object to a dict
2797
1744
server_settings = server_config.defaults()
2798
1745
# Use the appropriate methods on the non-string config options
2799
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1746
for option in ("debug", "use_dbus", "use_ipv6"):
2800
1747
server_settings[option] = server_config.getboolean("DEFAULT",
2801
1748
option)
2802
1749
if server_settings["port"]:
2803
1750
server_settings["port"] = server_config.getint("DEFAULT",
2804
1751
"port")
2805
if server_settings["socket"]:
2806
server_settings["socket"] = server_config.getint("DEFAULT",
2807
"socket")
2808
# Later, stdin will, and stdout and stderr might, be dup'ed
2809
# over with an opened os.devnull. But we don't want this to
2810
# happen with a supplied network socket.
2811
if 0 <= server_settings["socket"] <= 2:
2812
server_settings["socket"] = os.dup(server_settings
2813
["socket"])
2814
1752
del server_config
2815
1753
2816
1754
# Override the settings from the config file with command line
2817
1755
# options, if set.
2818
1756
for option in ("interface", "address", "port", "debug",
2819
"priority", "servicename", "configdir", "use_dbus",
2820
"use_ipv6", "debuglevel", "restore", "statedir",
2821
"socket", "foreground", "zeroconf"):
1757
"priority", "servicename", "configdir",
1758
"use_dbus", "use_ipv6", "debuglevel"):
2822
1759
value = getattr(options, option)
2823
1760
if value is not None:
2824
1761
server_settings[option] = value
2825
1762
del options
2826
1763
# Force all strings to be unicode
2827
1764
for option in server_settings.keys():
2828
if isinstance(server_settings[option], bytes):
2829
server_settings[option] = (server_settings[option]
2830
.decode("utf-8"))
2831
# Force all boolean options to be boolean
2832
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2833
"foreground", "zeroconf"):
2834
server_settings[option] = bool(server_settings[option])
2835
# Debug implies foreground
2836
if server_settings["debug"]:
2837
server_settings["foreground"] = True
1765
if type(server_settings[option]) is str:
1766
server_settings[option] = unicode(server_settings[option])
2838
1767
# Now we have our good server settings in "server_settings"
2839
1768
2840
1769
##################################################################
2841
1770
2842
if (not server_settings["zeroconf"]
2843
and not (server_settings["port"]
2844
or server_settings["socket"] != "")):
2845
parser.error("Needs port or socket to work without Zeroconf")
2846
2847
1771
# For convenience
2848
1772
debug = server_settings["debug"]
2849
1773
debuglevel = server_settings["debuglevel"]
2850
1774
use_dbus = server_settings["use_dbus"]
2851
1775
use_ipv6 = server_settings["use_ipv6"]
2852
stored_state_path = os.path.join(server_settings["statedir"],
2853
stored_state_file)
2854
foreground = server_settings["foreground"]
2855
zeroconf = server_settings["zeroconf"]
2856
2857
if debug:
2858
initlogger(debug, logging.DEBUG)
2859
else:
2860
if not debuglevel:
2861
initlogger(debug)
2862
else:
2863
level = getattr(logging, debuglevel.upper())
2864
initlogger(debug, level)
2865
1776
2866
1777
if server_settings["servicename"] != "Mandos":
2867
syslogger.setFormatter(
2868
logging.Formatter('Mandos ({}) [%(process)d]:'
2869
' %(levelname)s: %(message)s'.format(
2870
server_settings["servicename"])))
1778
syslogger.setFormatter(logging.Formatter
1779
('Mandos (%s) [%%(process)d]:'
1780
' %%(levelname)s: %%(message)s'
1781
% server_settings["servicename"]))
2871
1782
2872
1783
# Parse config file with clients
2873
client_config = configparser.SafeConfigParser(Client
2874
.client_defaults)
1784
client_defaults = { "timeout": "5m",
1785
"extended_timeout": "15m",
1786
"interval": "2m",
1787
"checker": "fping -q -- %%(host)s",
1788
"host": "",
1789
"approval_delay": "0s",
1790
"approval_duration": "1s",
1791
}
1792
client_config = configparser.SafeConfigParser(client_defaults)
2875
1793
client_config.read(os.path.join(server_settings["configdir"],
2876
1794
"clients.conf"))
2877
1795
2878
1796
global mandos_dbus_service
2879
1797
mandos_dbus_service = None
2880
1798
2881
socketfd = None
2882
if server_settings["socket"] != "":
2883
socketfd = server_settings["socket"]
2884
tcp_server = MandosServer(
2885
(server_settings["address"], server_settings["port"]),
2886
ClientHandler,
2887
interface=(server_settings["interface"] or None),
2888
use_ipv6=use_ipv6,
2889
gnutls_priority=server_settings["priority"],
2890
use_dbus=use_dbus,
2891
socketfd=socketfd)
2892
if not foreground:
2893
pidfilename = "/run/mandos.pid"
2894
if not os.path.isdir("/run/."):
2895
pidfilename = "/var/run/mandos.pid"
2896
pidfile = None
1799
tcp_server = MandosServer((server_settings["address"],
1800
server_settings["port"]),
1801
ClientHandler,
1802
interface=(server_settings["interface"]
1803
or None),
1804
use_ipv6=use_ipv6,
1805
gnutls_priority=
1806
server_settings["priority"],
1807
use_dbus=use_dbus)
1808
if not debug:
1809
pidfilename = "/var/run/mandos.pid"
2897
1810
try:
2898
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2899
except IOError as e:
2900
logger.error("Could not open file %r", pidfilename,
2901
exc_info=e)
1811
pidfile = open(pidfilename, "w")
1812
except IOError:
1813
logger.error("Could not open file %r", pidfilename)
2902
1814
2903
for name in ("_mandos", "mandos", "nobody"):
1815
try:
1816
uid = pwd.getpwnam("_mandos").pw_uid
1817
gid = pwd.getpwnam("_mandos").pw_gid
1818
except KeyError:
2904
1819
try:
2905
uid = pwd.getpwnam(name).pw_uid
2906
gid = pwd.getpwnam(name).pw_gid
2907
break
1820
uid = pwd.getpwnam("mandos").pw_uid
1821
gid = pwd.getpwnam("mandos").pw_gid
2908
1822
except KeyError:
2909
continue
2910
else:
2911
uid = 65534
2912
gid = 65534
1823
try:
1824
uid = pwd.getpwnam("nobody").pw_uid
1825
gid = pwd.getpwnam("nobody").pw_gid
1826
except KeyError:
1827
uid = 65534
1828
gid = 65534
2913
1829
try:
2914
1830
os.setgid(gid)
2915
1831
os.setuid(uid)
2916
1832
except OSError as error:
2917
if error.errno != errno.EPERM:
2918
raise
1833
if error[0] != errno.EPERM:
1834
raise error
2919
1835
1836
if not debug and not debuglevel:
1837
syslogger.setLevel(logging.WARNING)
1838
console.setLevel(logging.WARNING)
1839
if debuglevel:
1840
level = getattr(logging, debuglevel.upper())
1841
syslogger.setLevel(level)
1842
console.setLevel(level)
1843
2920
1844
if debug:
2921
1845
# Enable all possible GnuTLS debugging
2922
1846
2923
1847
# "Use a log level over 10 to enable all debugging options."
2924
1848
# - GnuTLS manual
2925
gnutls.global_set_log_level(11)
1849
gnutls.library.functions.gnutls_global_set_log_level(11)
2926
1850
2927
@gnutls.log_func
1851
@gnutls.library.types.gnutls_log_func
2928
1852
def debug_gnutls(level, string):
2929
1853
logger.debug("GnuTLS: %s", string[:-1])
2930
1854
2931
gnutls.global_set_log_function(debug_gnutls)
1855
(gnutls.library.functions
1856
.gnutls_global_set_log_function(debug_gnutls))
2932
1857
2933
1858
# Redirect stdin so all checkers get /dev/null
2934
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1859
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2935
1860
os.dup2(null, sys.stdin.fileno())
2936
1861
if null > 2:
2937
1862
os.close(null)
1863
else:
1864
# No console logging
1865
logger.removeHandler(console)
2938
1866
2939
1867
# Need to fork before connecting to D-Bus
2940
if not foreground:
1868
if not debug:
2941
1869
# Close all input and output, do double fork, etc.
2942
1870
daemon()
2943
1871
2944
# multiprocessing will use threads, so before we use gobject we
2945
# need to inform gobject that threads will be used.
2946
gobject.threads_init()
2947
2948
1872
global main_loop
2949
1873
# From the Avahi example code
2950
DBusGMainLoop(set_as_default=True)
1874
DBusGMainLoop(set_as_default=True )
2951
1875
main_loop = gobject.MainLoop()
2952
1876
bus = dbus.SystemBus()
2953
1877
# End of Avahi example code
2954
1878
if use_dbus:
2955
1879
try:
2956
bus_name = dbus.service.BusName("se.recompile.Mandos",
2957
bus,
2958
do_not_queue=True)
2959
old_bus_name = dbus.service.BusName(
2960
"se.bsnet.fukt.Mandos", bus,
2961
do_not_queue=True)
2962
except dbus.exceptions.DBusException as e:
2963
logger.error("Disabling D-Bus:", exc_info=e)
1880
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1881
bus, do_not_queue=True)
1882
except dbus.exceptions.NameExistsException as e:
1883
logger.error(unicode(e) + ", disabling D-Bus")
2964
1884
use_dbus = False
2965
1885
server_settings["use_dbus"] = False
2966
1886
tcp_server.use_dbus = False
2967
if zeroconf:
2968
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2969
service = AvahiServiceToSyslog(
2970
name = server_settings["servicename"],
2971
servicetype = "_mandos._tcp",
2972
protocol = protocol,
2973
bus = bus)
2974
if server_settings["interface"]:
2975
service.interface = if_nametoindex(
2976
server_settings["interface"].encode("utf-8"))
1887
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1888
service = AvahiService(name = server_settings["servicename"],
1889
servicetype = "_mandos._tcp",
1890
protocol = protocol, bus = bus)
1891
if server_settings["interface"]:
1892
service.interface = (if_nametoindex
1893
(str(server_settings["interface"])))
2977
1894
2978
1895
global multiprocessing_manager
2979
1896
multiprocessing_manager = multiprocessing.Manager()
2981
1898
client_class = Client
2982
1899
if use_dbus:
2983
1900
client_class = functools.partial(ClientDBus, bus = bus)
2984
2985
client_settings = Client.config_parser(client_config)
2986
old_client_settings = {}
2987
clients_data = {}
2988
2989
# This is used to redirect stdout and stderr for checker processes
2990
global wnull
2991
wnull = open(os.devnull, "w") # A writable /dev/null
2992
# Only used if server is running in foreground but not in debug
2993
# mode
2994
if debug or not foreground:
2995
wnull.close()
2996
2997
# Get client data and settings from last running state.
2998
if server_settings["restore"]:
2999
try:
3000
with open(stored_state_path, "rb") as stored_state:
3001
clients_data, old_client_settings = pickle.load(
3002
stored_state)
3003
os.remove(stored_state_path)
3004
except IOError as e:
3005
if e.errno == errno.ENOENT:
3006
logger.warning("Could not load persistent state:"
3007
" {}".format(os.strerror(e.errno)))
3008
else:
3009
logger.critical("Could not load persistent state:",
3010
exc_info=e)
3011
raise
3012
except EOFError as e:
3013
logger.warning("Could not load persistent state: "
3014
"EOFError:",
3015
exc_info=e)
3016
3017
with PGPEngine() as pgp:
3018
for client_name, client in clients_data.items():
3019
# Skip removed clients
3020
if client_name not in client_settings:
3021
continue
3022
3023
# Decide which value to use after restoring saved state.
3024
# We have three different values: Old config file,
3025
# new config file, and saved state.
3026
# New config value takes precedence if it differs from old
3027
# config value, otherwise use saved state.
3028
for name, value in client_settings[client_name].items():
3029
try:
3030
# For each value in new config, check if it
3031
# differs from the old config value (Except for
3032
# the "secret" attribute)
3033
if (name != "secret"
3034
and (value !=
3035
old_client_settings[client_name][name])):
3036
client[name] = value
3037
except KeyError:
3038
pass
3039
3040
# Clients who has passed its expire date can still be
3041
# enabled if its last checker was successful. A Client
3042
# whose checker succeeded before we stored its state is
3043
# assumed to have successfully run all checkers during
3044
# downtime.
3045
if client["enabled"]:
3046
if datetime.datetime.utcnow() >= client["expires"]:
3047
if not client["last_checked_ok"]:
3048
logger.warning(
3049
"disabling client {} - Client never "
3050
"performed a successful checker".format(
3051
client_name))
3052
client["enabled"] = False
3053
elif client["last_checker_status"] != 0:
3054
logger.warning(
3055
"disabling client {} - Client last"
3056
" checker failed with error code"
3057
" {}".format(
3058
client_name,
3059
client["last_checker_status"]))
3060
client["enabled"] = False
3061
else:
3062
client["expires"] = (
3063
datetime.datetime.utcnow()
3064
+ client["timeout"])
3065
logger.debug("Last checker succeeded,"
3066
" keeping {} enabled".format(
3067
client_name))
1901
def client_config_items(config, section):
1902
special_settings = {
1903
"approved_by_default":
1904
lambda: config.getboolean(section,
1905
"approved_by_default"),
1906
}
1907
for name, value in config.items(section):
3068
1908
try:
3069
client["secret"] = pgp.decrypt(
3070
client["encrypted_secret"],
3071
client_settings[client_name]["secret"])
3072
except PGPError:
3073
# If decryption fails, we use secret from new settings
3074
logger.debug("Failed to decrypt {} old secret".format(
3075
client_name))
3076
client["secret"] = (client_settings[client_name]
3077
["secret"])
3078
3079
# Add/remove clients based on new changes made to config
3080
for client_name in (set(old_client_settings)
3081
- set(client_settings)):
3082
del clients_data[client_name]
3083
for client_name in (set(client_settings)
3084
- set(old_client_settings)):
3085
clients_data[client_name] = client_settings[client_name]
3086
3087
# Create all client objects
3088
for client_name, client in clients_data.items():
3089
tcp_server.clients[client_name] = client_class(
3090
name = client_name,
3091
settings = client,
3092
server_settings = server_settings)
3093
1909
yield (name, special_settings[name]())
1910
except KeyError:
1911
yield (name, value)
1912
1913
tcp_server.clients.update(set(
1914
client_class(name = section,
1915
config= dict(client_config_items(
1916
client_config, section)))
1917
for section in client_config.sections()))
3094
1918
if not tcp_server.clients:
3095
1919
logger.warning("No clients defined")
3096
3097
if not foreground:
3098
if pidfile is not None:
3099
pid = os.getpid()
3100
try:
3101
with pidfile:
3102
print(pid, file=pidfile)
3103
except IOError:
3104
logger.error("Could not write to file %r with PID %d",
3105
pidfilename, pid)
3106
del pidfile
1920
1921
if not debug:
1922
try:
1923
with pidfile:
1924
pid = os.getpid()
1925
pidfile.write(str(pid) + "\n".encode("utf-8"))
1926
del pidfile
1927
except IOError:
1928
logger.error("Could not write to file %r with PID %d",
1929
pidfilename, pid)
1930
except NameError:
1931
# "pidfile" was never created
1932
pass
3107
1933
del pidfilename
3108
1934
1935
signal.signal(signal.SIGINT, signal.SIG_IGN)
1936
3109
1937
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3110
1938
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3111
1939
3112
1940
if use_dbus:
3113
3114
@alternate_dbus_interfaces(
3115
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3116
class MandosDBusService(DBusObjectWithObjectManager):
1941
class MandosDBusService(dbus.service.Object):
3117
1942
"""A D-Bus proxy object"""
3118
3119
1943
def __init__(self):
3120
1944
dbus.service.Object.__init__(self, bus, "/")
3121
3122
_interface = "se.recompile.Mandos"
1945
_interface = "se.bsnet.fukt.Mandos"
3123
1946
3124
1947
@dbus.service.signal(_interface, signature="o")
3125
1948
def ClientAdded(self, objpath):
3131
1954
"D-Bus signal"
3132
1955
pass
3133
1956
3134
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3135
"true"})
3136
1957
@dbus.service.signal(_interface, signature="os")
3137
1958
def ClientRemoved(self, objpath, name):
3138
1959
"D-Bus signal"
3139
1960
pass
3140
1961
3141
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3142
"true"})
3143
1962
@dbus.service.method(_interface, out_signature="ao")
3144
1963
def GetAllClients(self):
3145
1964
"D-Bus method"
3146
return dbus.Array(c.dbus_object_path for c in
3147
tcp_server.clients.itervalues())
1965
return dbus.Array(c.dbus_object_path
1966
for c in tcp_server.clients)
3148
1967
3149
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3150
"true"})
3151
1968
@dbus.service.method(_interface,
3152
1969
out_signature="a{oa{sv}}")
3153
1970
def GetAllClientsWithProperties(self):
3154
1971
"D-Bus method"
3155
1972
return dbus.Dictionary(
3156
{ c.dbus_object_path: c.GetAll(
3157
"se.recompile.Mandos.Client")
3158
for c in tcp_server.clients.itervalues() },
1973
((c.dbus_object_path, c.GetAll(""))
1974
for c in tcp_server.clients),
3159
1975
signature="oa{sv}")
3160
1976
3161
1977
@dbus.service.method(_interface, in_signature="o")
3162
1978
def RemoveClient(self, object_path):
3163
1979
"D-Bus method"
3164
for c in tcp_server.clients.itervalues():
1980
for c in tcp_server.clients:
3165
1981
if c.dbus_object_path == object_path:
3166
del tcp_server.clients[c.name]
1982
tcp_server.clients.remove(c)
3167
1983
c.remove_from_connection()
3168
# Don't signal the disabling
1984
# Don't signal anything except ClientRemoved
3169
1985
c.disable(quiet=True)
3170
# Emit D-Bus signal for removal
3171
self.client_removed_signal(c)
1986
# Emit D-Bus signal
1987
self.ClientRemoved(object_path, c.name)
3172
1988
return
3173
1989
raise KeyError(object_path)
3174
1990
3175
1991
del _interface
3176
3177
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3178
out_signature = "a{oa{sa{sv}}}")
3179
def GetManagedObjects(self):
3180
"""D-Bus method"""
3181
return dbus.Dictionary(
3182
{ client.dbus_object_path:
3183
dbus.Dictionary(
3184
{ interface: client.GetAll(interface)
3185
for interface in
3186
client._get_all_interface_names()})
3187
for client in tcp_server.clients.values()})
3188
3189
def client_added_signal(self, client):
3190
"""Send the new standard signal and the old signal"""
3191
if use_dbus:
3192
# New standard signal
3193
self.InterfacesAdded(
3194
client.dbus_object_path,
3195
dbus.Dictionary(
3196
{ interface: client.GetAll(interface)
3197
for interface in
3198
client._get_all_interface_names()}))
3199
# Old signal
3200
self.ClientAdded(client.dbus_object_path)
3201
3202
def client_removed_signal(self, client):
3203
"""Send the new standard signal and the old signal"""
3204
if use_dbus:
3205
# New standard signal
3206
self.InterfacesRemoved(
3207
client.dbus_object_path,
3208
client._get_all_interface_names())
3209
# Old signal
3210
self.ClientRemoved(client.dbus_object_path,
3211
client.name)
3212
1992
3213
1993
mandos_dbus_service = MandosDBusService()
3214
1994
3215
1995
def cleanup():
3216
1996
"Cleanup function; run on exit"
3217
if zeroconf:
3218
service.cleanup()
3219
3220
multiprocessing.active_children()
3221
wnull.close()
3222
if not (tcp_server.clients or client_settings):
3223
return
3224
3225
# Store client before exiting. Secrets are encrypted with key
3226
# based on what config file has. If config file is
3227
# removed/edited, old secret will thus be unrecovable.
3228
clients = {}
3229
with PGPEngine() as pgp:
3230
for client in tcp_server.clients.itervalues():
3231
key = client_settings[client.name]["secret"]
3232
client.encrypted_secret = pgp.encrypt(client.secret,
3233
key)
3234
client_dict = {}
3235
3236
# A list of attributes that can not be pickled
3237
# + secret.
3238
exclude = { "bus", "changedstate", "secret",
3239
"checker", "server_settings" }
3240
for name, typ in inspect.getmembers(dbus.service
3241
.Object):
3242
exclude.add(name)
3243
3244
client_dict["encrypted_secret"] = (client
3245
.encrypted_secret)
3246
for attr in client.client_structure:
3247
if attr not in exclude:
3248
client_dict[attr] = getattr(client, attr)
3249
3250
clients[client.name] = client_dict
3251
del client_settings[client.name]["secret"]
3252
3253
try:
3254
with tempfile.NamedTemporaryFile(
3255
mode='wb',
3256
suffix=".pickle",
3257
prefix='clients-',
3258
dir=os.path.dirname(stored_state_path),
3259
delete=False) as stored_state:
3260
pickle.dump((clients, client_settings), stored_state)
3261
tempname = stored_state.name
3262
os.rename(tempname, stored_state_path)
3263
except (IOError, OSError) as e:
3264
if not debug:
3265
try:
3266
os.remove(tempname)
3267
except NameError:
3268
pass
3269
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3270
logger.warning("Could not save persistent state: {}"
3271
.format(os.strerror(e.errno)))
3272
else:
3273
logger.warning("Could not save persistent state:",
3274
exc_info=e)
3275
raise
3276
3277
# Delete all clients, and settings from config
1997
service.cleanup()
1998
3278
1999
while tcp_server.clients:
3279
name, client = tcp_server.clients.popitem()
2000
client = tcp_server.clients.pop()
3280
2001
if use_dbus:
3281
2002
client.remove_from_connection()
3282
# Don't signal the disabling
2003
client.disable_hook = None
2004
# Don't signal anything except ClientRemoved
3283
2005
client.disable(quiet=True)
3284
# Emit D-Bus signal for removal
3285
2006
if use_dbus:
3286
mandos_dbus_service.client_removed_signal(client)
3287
client_settings.clear()
2007
# Emit D-Bus signal
2008
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2009
client.name)
3288
2010
3289
2011
atexit.register(cleanup)
3290
2012
3291
for client in tcp_server.clients.itervalues():
2013
for client in tcp_server.clients:
3292
2014
if use_dbus:
3293
# Emit D-Bus signal for adding
3294
mandos_dbus_service.client_added_signal(client)
3295
# Need to initiate checking of clients
3296
if client.enabled:
3297
client.init_checker()
2015
# Emit D-Bus signal
2016
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2017
client.enable()
3298
2018
3299
2019
tcp_server.enable()
3300
2020
tcp_server.server_activate()
3301
2021
3302
2022
# Find out what port we got
3303
if zeroconf:
3304
service.port = tcp_server.socket.getsockname()[1]
2023
service.port = tcp_server.socket.getsockname()[1]
3305
2024
if use_ipv6:
3306
2025
logger.info("Now listening on address %r, port %d,"
3307
" flowinfo %d, scope_id %d",
3308
*tcp_server.socket.getsockname())
2026
" flowinfo %d, scope_id %d"
2027
% tcp_server.socket.getsockname())
3309
2028
else: # IPv4
3310
logger.info("Now listening on address %r, port %d",
3311
*tcp_server.socket.getsockname())
2029
logger.info("Now listening on address %r, port %d"
2030
% tcp_server.socket.getsockname())
3312
2031
3313
2032
#service.interface = tcp_server.socket.getsockname()[3]
3314
2033
3315
2034
try:
3316
if zeroconf:
3317
# From the Avahi example code
3318
try:
3319
service.activate()
3320
except dbus.exceptions.DBusException as error:
3321
logger.critical("D-Bus Exception", exc_info=error)
3322
cleanup()
3323
sys.exit(1)
3324
# End of Avahi example code
2035
# From the Avahi example code
2036
try:
2037
service.activate()
2038
except dbus.exceptions.DBusException as error:
2039
logger.critical("DBusException: %s", error)
2040
cleanup()
2041
sys.exit(1)
2042
# End of Avahi example code
3325
2043
3326
2044
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3327
2045
lambda *args, **kwargs:
3331
2049
logger.debug("Starting main loop")
3332
2050
main_loop.run()
3333
2051
except AvahiError as error:
3334
logger.critical("Avahi Error", exc_info=error)
2052
logger.critical("AvahiError: %s", error)
3335
2053
cleanup()
3336
2054
sys.exit(1)
3337
2055
except KeyboardInterrupt:
3342
2060
# Must run before the D-Bus bus name gets deregistered
3343
2061
cleanup()
3344
2062
3345
3346
2063
if __name__ == '__main__':
3347
2064
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0