To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 518.1.3
- compare with another revision
- download diff
- download tarball
- view history from revision 518.1.3
- Committer: Björn Påhlsson
- Date: 2011-11-11 14:14:24 UTC
- mto: (518.2.5 persistent-state-gpgme)
- mto: This revision was merged to the branch mainline in revision 524.
- Revision ID: belorn@fukt.bsnet.se-20111111141424-405blpt3kwrla6lw
new signal: NewRequest(IP_address)
Sent when a client ask for its password
Sent when a client ask for its password
- files added:
- debian/source
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
35
36
36
37
import SocketServer as socketserver
37
38
import socket
38
import optparse
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
61
62
import functools
62
63
import cPickle as pickle
63
64
import multiprocessing
65
import types
66
import hashlib
64
67
65
68
import dbus
66
69
import dbus.service
71
74
import ctypes.util
72
75
import xml.dom.minidom
73
76
import inspect
77
import Crypto.Cipher.AES
74
78
75
79
try:
76
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
85
SO_BINDTODEVICE = None
82
86
83
87
84
version = "1.2"
85
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
88
version = "1.4.1"
89
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
88
93
syslogger = (logging.handlers.SysLogHandler
89
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
address = "/dev/log"))
95
address = str("/dev/log")))
91
96
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
94
99
logger.addHandler(syslogger)
95
100
96
101
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
100
106
logger.addHandler(console)
101
107
108
102
109
class AvahiError(Exception):
103
110
def __init__(self, value, *args, **kwargs):
104
111
self.value = value
119
126
Attributes:
120
127
interface: integer; avahi.IF_UNSPEC or an interface index.
121
128
Used to optionally bind to the specified interface.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
129
name: string; Example: 'Mandos'
130
type: string; Example: '_mandos._tcp'.
124
131
See <http://www.dns-sd.org/ServiceTypes.html>
125
132
port: integer; what port to announce
126
133
TXT: list of strings; TXT record for the service
135
142
"""
136
143
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
144
servicetype = None, port = None, TXT = None,
138
domain = u"", host = u"", max_renames = 32768,
145
domain = "", host = "", max_renames = 32768,
139
146
protocol = avahi.PROTO_UNSPEC, bus = None):
140
147
self.interface = interface
141
148
self.name = name
150
157
self.group = None # our entry group
151
158
self.server = None
152
159
self.bus = bus
160
self.entry_group_state_changed_match = None
153
161
def rename(self):
154
162
"""Derived from the Avahi example code"""
155
163
if self.rename_count >= self.max_renames:
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
164
logger.critical("No suitable Zeroconf service name found"
165
" after %i retries, exiting.",
158
166
self.rename_count)
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
167
raise AvahiServiceError("Too many renames")
168
self.name = unicode(self.server
169
.GetAlternativeServiceName(self.name))
170
logger.info("Changing Zeroconf service name to %r ...",
162
171
self.name)
163
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
166
% self.name))
167
172
self.remove()
168
173
try:
169
174
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
175
except dbus.exceptions.DBusException as error:
176
logger.critical("DBusException: %s", error)
172
177
self.cleanup()
173
178
os._exit(1)
174
179
self.rename_count += 1
175
180
def remove(self):
176
181
"""Derived from the Avahi example code"""
182
if self.entry_group_state_changed_match is not None:
183
self.entry_group_state_changed_match.remove()
184
self.entry_group_state_changed_match = None
177
185
if self.group is not None:
178
186
self.group.Reset()
179
187
def add(self):
180
188
"""Derived from the Avahi example code"""
189
self.remove()
181
190
if self.group is None:
182
191
self.group = dbus.Interface(
183
192
self.bus.get_object(avahi.DBUS_NAME,
184
193
self.server.EntryGroupNew()),
185
194
avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
195
self.entry_group_state_changed_match = (
196
self.group.connect_to_signal(
197
'StateChanged', self.entry_group_state_changed))
198
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
190
199
self.name, self.type)
191
200
self.group.AddService(
192
201
self.interface,
199
208
self.group.Commit()
200
209
def entry_group_state_changed(self, state, error):
201
210
"""Derived from the Avahi example code"""
202
logger.debug(u"Avahi entry group state change: %i", state)
211
logger.debug("Avahi entry group state change: %i", state)
203
212
204
213
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
logger.debug(u"Zeroconf service established.")
214
logger.debug("Zeroconf service established.")
206
215
elif state == avahi.ENTRY_GROUP_COLLISION:
207
logger.warning(u"Zeroconf service name collision.")
216
logger.info("Zeroconf service name collision.")
208
217
self.rename()
209
218
elif state == avahi.ENTRY_GROUP_FAILURE:
210
logger.critical(u"Avahi: Error in group state changed %s",
219
logger.critical("Avahi: Error in group state changed %s",
211
220
unicode(error))
212
raise AvahiGroupError(u"State changed: %s"
221
raise AvahiGroupError("State changed: %s"
213
222
% unicode(error))
214
223
def cleanup(self):
215
224
"""Derived from the Avahi example code"""
216
225
if self.group is not None:
217
self.group.Free()
226
try:
227
self.group.Free()
228
except (dbus.exceptions.UnknownMethodException,
229
dbus.exceptions.DBusException) as e:
230
pass
218
231
self.group = None
219
def server_state_changed(self, state):
232
self.remove()
233
def server_state_changed(self, state, error=None):
220
234
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
235
logger.debug("Avahi server state change: %i", state)
236
bad_states = { avahi.SERVER_INVALID:
237
"Zeroconf server invalid",
238
avahi.SERVER_REGISTERING: None,
239
avahi.SERVER_COLLISION:
240
"Zeroconf server name collision",
241
avahi.SERVER_FAILURE:
242
"Zeroconf server failure" }
243
if state in bad_states:
244
if bad_states[state] is not None:
245
if error is None:
246
logger.error(bad_states[state])
247
else:
248
logger.error(bad_states[state] + ": %r", error)
249
self.cleanup()
225
250
elif state == avahi.SERVER_RUNNING:
226
251
self.add()
252
else:
253
if error is None:
254
logger.debug("Unknown state: %r", state)
255
else:
256
logger.debug("Unknown state: %r: %r", state, error)
227
257
def activate(self):
228
258
"""Derived from the Avahi example code"""
229
259
if self.server is None:
230
260
self.server = dbus.Interface(
231
261
self.bus.get_object(avahi.DBUS_NAME,
232
avahi.DBUS_PATH_SERVER),
262
avahi.DBUS_PATH_SERVER,
263
follow_name_owner_changes=True),
233
264
avahi.DBUS_INTERFACE_SERVER)
234
self.server.connect_to_signal(u"StateChanged",
265
self.server.connect_to_signal("StateChanged",
235
266
self.server_state_changed)
236
267
self.server_state_changed(self.server.GetState())
237
268
269
class AvahiServiceToSyslog(AvahiService):
270
def rename(self):
271
"""Add the new name to the syslog messages"""
272
ret = AvahiService.rename(self)
273
syslogger.setFormatter(logging.Formatter
274
('Mandos (%s) [%%(process)d]:'
275
' %%(levelname)s: %%(message)s'
276
% self.name))
277
return ret
238
278
279
def _timedelta_to_milliseconds(td):
280
"Convert a datetime.timedelta() to milliseconds"
281
return ((td.days * 24 * 60 * 60 * 1000)
282
+ (td.seconds * 1000)
283
+ (td.microseconds // 1000))
284
239
285
class Client(object):
240
286
"""A representation of a client host served by this server.
241
287
253
299
instance %(name)s can be used in the command.
254
300
checker_initiator_tag: a gobject event source tag, or None
255
301
created: datetime.datetime(); (UTC) object creation
302
client_structure: Object describing what attributes a client has
303
and is used for storing the client at exit
256
304
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
305
disable_initiator_tag: a gobject event source tag, or None
259
306
enabled: bool()
260
307
fingerprint: string (40 or 32 hexadecimal digits); used to
263
310
interval: datetime.timedelta(); How often to start a new checker
264
311
last_approval_request: datetime.datetime(); (UTC) or None
265
312
last_checked_ok: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit status
314
of last checker. -1 reflect crashed checker,
315
or None.
266
316
last_enabled: datetime.datetime(); (UTC)
267
317
name: string; from the config file, used in log messages and
268
318
D-Bus identifiers
269
319
secret: bytestring; sent verbatim (over TLS) to client
270
320
timeout: datetime.timedelta(); How long from last_checked_ok
271
321
until this client is disabled
322
extended_timeout: extra long timeout when password has been sent
272
323
runtime_expansions: Allowed attributes for runtime expansion.
324
expires: datetime.datetime(); time (UTC) when a client will be
325
disabled, or None
273
326
"""
274
327
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
279
280
@staticmethod
281
def _timedelta_to_milliseconds(td):
282
"Convert a datetime.timedelta() to milliseconds"
283
return ((td.days * 24 * 60 * 60 * 1000)
284
+ (td.seconds * 1000)
285
+ (td.microseconds // 1000))
328
runtime_expansions = ("approval_delay", "approval_duration",
329
"created", "enabled", "fingerprint",
330
"host", "interval", "last_checked_ok",
331
"last_enabled", "name", "timeout")
286
332
287
333
def timeout_milliseconds(self):
288
334
"Return the 'timeout' attribute in milliseconds"
289
return self._timedelta_to_milliseconds(self.timeout)
335
return _timedelta_to_milliseconds(self.timeout)
336
337
def extended_timeout_milliseconds(self):
338
"Return the 'extended_timeout' attribute in milliseconds"
339
return _timedelta_to_milliseconds(self.extended_timeout)
290
340
291
341
def interval_milliseconds(self):
292
342
"Return the 'interval' attribute in milliseconds"
293
return self._timedelta_to_milliseconds(self.interval)
294
343
return _timedelta_to_milliseconds(self.interval)
344
295
345
def approval_delay_milliseconds(self):
296
return self._timedelta_to_milliseconds(self.approval_delay)
346
return _timedelta_to_milliseconds(self.approval_delay)
297
347
298
def __init__(self, name = None, disable_hook=None, config=None):
348
def __init__(self, name = None, config=None):
299
349
"""Note: the 'checker' key in 'config' sets the
300
350
'checker_command' attribute and *not* the 'checker'
301
351
attribute."""
302
352
self.name = name
303
353
if config is None:
304
354
config = {}
305
logger.debug(u"Creating client %r", self.name)
355
logger.debug("Creating client %r", self.name)
306
356
# Uppercase and remove spaces from fingerprint for later
307
357
# comparison purposes with return value from the fingerprint()
308
358
# function
309
self.fingerprint = (config[u"fingerprint"].upper()
310
.replace(u" ", u""))
311
logger.debug(u" Fingerprint: %s", self.fingerprint)
312
if u"secret" in config:
313
self.secret = config[u"secret"].decode(u"base64")
314
elif u"secfile" in config:
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
361
logger.debug(" Fingerprint: %s", self.fingerprint)
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
315
365
with open(os.path.expanduser(os.path.expandvars
316
(config[u"secfile"])),
366
(config["secfile"])),
317
367
"rb") as secfile:
318
368
self.secret = secfile.read()
319
369
else:
320
raise TypeError(u"No secret or secfile for client %s"
370
raise TypeError("No secret or secfile for client %s"
321
371
% self.name)
322
self.host = config.get(u"host", u"")
372
self.host = config.get("host", "")
323
373
self.created = datetime.datetime.utcnow()
324
self.enabled = False
374
self.enabled = True
325
375
self.last_approval_request = None
326
self.last_enabled = None
376
self.last_enabled = datetime.datetime.utcnow()
327
377
self.last_checked_ok = None
328
self.timeout = string_to_delta(config[u"timeout"])
329
self.interval = string_to_delta(config[u"interval"])
330
self.disable_hook = disable_hook
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
331
383
self.checker = None
332
384
self.checker_initiator_tag = None
333
385
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
334
387
self.checker_callback_tag = None
335
self.checker_command = config[u"checker"]
388
self.checker_command = config["checker"]
336
389
self.current_checker_command = None
337
self.last_connect = None
338
390
self._approved = None
339
self.approved_by_default = config.get(u"approved_by_default",
391
self.approved_by_default = config.get("approved_by_default",
340
392
True)
341
393
self.approvals_pending = 0
342
394
self.approval_delay = string_to_delta(
343
config[u"approval_delay"])
395
config["approval_delay"])
344
396
self.approval_duration = string_to_delta(
345
config[u"approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
397
config["approval_duration"])
398
self.changedstate = (multiprocessing_manager
399
.Condition(multiprocessing_manager
400
.Lock()))
401
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
402
self.client_structure.append("client_structure")
403
404
405
for name, t in inspect.getmembers(type(self),
406
lambda obj: isinstance(obj, property)):
407
if not name.startswith("_"):
408
self.client_structure.append(name)
347
409
410
# Send notice to process children that client state has changed
348
411
def send_changedstate(self):
349
self.changedstate.acquire()
350
self.changedstate.notify_all()
351
self.changedstate.release()
352
412
with self.changedstate:
413
self.changedstate.notify_all()
414
353
415
def enable(self):
354
416
"""Start this client's checker and timeout hooks"""
355
if getattr(self, u"enabled", False):
417
if getattr(self, "enabled", False):
356
418
# Already enabled
357
419
return
358
420
self.send_changedstate()
421
self.expires = datetime.datetime.utcnow() + self.timeout
422
self.enabled = True
359
423
self.last_enabled = datetime.datetime.utcnow()
360
# Schedule a new checker to be started an 'interval' from now,
361
# and every interval from then on.
362
self.checker_initiator_tag = (gobject.timeout_add
363
(self.interval_milliseconds(),
364
self.start_checker))
365
# Schedule a disable() when 'timeout' has passed
366
self.disable_initiator_tag = (gobject.timeout_add
367
(self.timeout_milliseconds(),
368
self.disable))
369
self.enabled = True
370
# Also start a new checker *right now*.
371
self.start_checker()
424
self.init_checker()
372
425
373
426
def disable(self, quiet=True):
374
427
"""Disable this client."""
377
430
if not quiet:
378
431
self.send_changedstate()
379
432
if not quiet:
380
logger.info(u"Disabling client %s", self.name)
381
if getattr(self, u"disable_initiator_tag", False):
433
logger.info("Disabling client %s", self.name)
434
if getattr(self, "disable_initiator_tag", False):
382
435
gobject.source_remove(self.disable_initiator_tag)
383
436
self.disable_initiator_tag = None
384
if getattr(self, u"checker_initiator_tag", False):
437
self.expires = None
438
if getattr(self, "checker_initiator_tag", False):
385
439
gobject.source_remove(self.checker_initiator_tag)
386
440
self.checker_initiator_tag = None
387
441
self.stop_checker()
388
if self.disable_hook:
389
self.disable_hook(self)
390
442
self.enabled = False
391
443
# Do not run this again if called by a gobject.timeout_add
392
444
return False
393
445
394
446
def __del__(self):
395
self.disable_hook = None
396
447
self.disable()
397
448
449
def init_checker(self):
450
# Schedule a new checker to be started an 'interval' from now,
451
# and every interval from then on.
452
self.checker_initiator_tag = (gobject.timeout_add
453
(self.interval_milliseconds(),
454
self.start_checker))
455
# Schedule a disable() when 'timeout' has passed
456
self.disable_initiator_tag = (gobject.timeout_add
457
(self.timeout_milliseconds(),
458
self.disable))
459
# Also start a new checker *right now*.
460
self.start_checker()
461
462
398
463
def checker_callback(self, pid, condition, command):
399
464
"""The checker has completed, so take appropriate actions."""
400
465
self.checker_callback_tag = None
401
466
self.checker = None
402
467
if os.WIFEXITED(condition):
403
exitstatus = os.WEXITSTATUS(condition)
404
if exitstatus == 0:
405
logger.info(u"Checker for %(name)s succeeded",
468
self.last_checker_status = os.WEXITSTATUS(condition)
469
if self.last_checker_status == 0:
470
logger.info("Checker for %(name)s succeeded",
406
471
vars(self))
407
472
self.checked_ok()
408
473
else:
409
logger.info(u"Checker for %(name)s failed",
474
logger.info("Checker for %(name)s failed",
410
475
vars(self))
411
476
else:
412
logger.warning(u"Checker for %(name)s crashed?",
477
self.last_checker_status = -1
478
logger.warning("Checker for %(name)s crashed?",
413
479
vars(self))
414
480
415
def checked_ok(self):
481
def checked_ok(self, timeout=None):
416
482
"""Bump up the timeout for this client.
417
483
418
484
This should only be called when the client has been seen,
419
485
alive and well.
420
486
"""
487
if timeout is None:
488
timeout = self.timeout
421
489
self.last_checked_ok = datetime.datetime.utcnow()
422
gobject.source_remove(self.disable_initiator_tag)
423
self.disable_initiator_tag = (gobject.timeout_add
424
(self.timeout_milliseconds(),
425
self.disable))
490
if self.disable_initiator_tag is not None:
491
gobject.source_remove(self.disable_initiator_tag)
492
if getattr(self, "enabled", False):
493
self.disable_initiator_tag = (gobject.timeout_add
494
(_timedelta_to_milliseconds
495
(timeout), self.disable))
496
self.expires = datetime.datetime.utcnow() + timeout
426
497
427
498
def need_approval(self):
428
499
self.last_approval_request = datetime.datetime.utcnow()
444
515
# If a checker exists, make sure it is not a zombie
445
516
try:
446
517
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
447
except (AttributeError, OSError), error:
518
except (AttributeError, OSError) as error:
448
519
if (isinstance(error, OSError)
449
520
and error.errno != errno.ECHILD):
450
521
raise error
451
522
else:
452
523
if pid:
453
logger.warning(u"Checker was a zombie")
524
logger.warning("Checker was a zombie")
454
525
gobject.source_remove(self.checker_callback_tag)
455
526
self.checker_callback(pid, status,
456
527
self.current_checker_command)
463
534
# Escape attributes for the shell
464
535
escaped_attrs = dict(
465
536
(attr,
466
re.escape(unicode(str(getattr(self, attr, u"")),
537
re.escape(unicode(str(getattr(self, attr, "")),
467
538
errors=
468
u'replace')))
539
'replace')))
469
540
for attr in
470
541
self.runtime_expansions)
471
542
472
543
try:
473
544
command = self.checker_command % escaped_attrs
474
except TypeError, error:
475
logger.error(u'Could not format string "%s":'
476
u' %s', self.checker_command, error)
545
except TypeError as error:
546
logger.error('Could not format string "%s":'
547
' %s', self.checker_command, error)
477
548
return True # Try again later
478
549
self.current_checker_command = command
479
550
try:
480
logger.info(u"Starting checker %r for %s",
551
logger.info("Starting checker %r for %s",
481
552
command, self.name)
482
553
# We don't need to redirect stdout and stderr, since
483
554
# in normal mode, that is already done by daemon(),
485
556
# always replaced by /dev/null.)
486
557
self.checker = subprocess.Popen(command,
487
558
close_fds=True,
488
shell=True, cwd=u"/")
559
shell=True, cwd="/")
489
560
self.checker_callback_tag = (gobject.child_watch_add
490
561
(self.checker.pid,
491
562
self.checker_callback,
496
567
if pid:
497
568
gobject.source_remove(self.checker_callback_tag)
498
569
self.checker_callback(pid, status, command)
499
except OSError, error:
500
logger.error(u"Failed to start subprocess: %s",
570
except OSError as error:
571
logger.error("Failed to start subprocess: %s",
501
572
error)
502
573
# Re-run this periodically if run by gobject.timeout_add
503
574
return True
507
578
if self.checker_callback_tag:
508
579
gobject.source_remove(self.checker_callback_tag)
509
580
self.checker_callback_tag = None
510
if getattr(self, u"checker", None) is None:
581
if getattr(self, "checker", None) is None:
511
582
return
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
583
logger.debug("Stopping checker for %(name)s", vars(self))
513
584
try:
514
585
os.kill(self.checker.pid, signal.SIGTERM)
515
586
#time.sleep(0.5)
516
587
#if self.checker.poll() is None:
517
588
# os.kill(self.checker.pid, signal.SIGKILL)
518
except OSError, error:
589
except OSError as error:
519
590
if error.errno != errno.ESRCH: # No such process
520
591
raise
521
592
self.checker = None
522
593
523
def dbus_service_property(dbus_interface, signature=u"v",
524
access=u"readwrite", byte_arrays=False):
594
# Encrypts a client secret and stores it in a varible encrypted_secret
595
def encrypt_secret(self, key):
596
# Encryption-key need to be of a specific size, so we hash inputed key
597
hasheng = hashlib.sha256()
598
hasheng.update(key)
599
encryptionkey = hasheng.digest()
600
601
# Create validation hash so we know at decryption if it was sucessful
602
hasheng = hashlib.sha256()
603
hasheng.update(self.secret)
604
validationhash = hasheng.digest()
605
606
# Encrypt secret
607
iv = os.urandom(Crypto.Cipher.AES.block_size)
608
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
Crypto.Cipher.AES.MODE_CFB, iv)
610
ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
self.encrypted_secret = (ciphertext, iv)
612
613
# Decrypt a encrypted client secret
614
def decrypt_secret(self, key):
615
# Decryption-key need to be of a specific size, so we hash inputed key
616
hasheng = hashlib.sha256()
617
hasheng.update(key)
618
encryptionkey = hasheng.digest()
619
620
# Decrypt encrypted secret
621
ciphertext, iv = self.encrypted_secret
622
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
Crypto.Cipher.AES.MODE_CFB, iv)
624
plain = ciphereng.decrypt(ciphertext)
625
626
# Validate decrypted secret to know if it was succesful
627
hasheng = hashlib.sha256()
628
validationhash = plain[:hasheng.digest_size]
629
secret = plain[hasheng.digest_size:]
630
hasheng.update(secret)
631
632
# if validation fails, we use key as new secret. Otherwhise, we use
633
# the decrypted secret
634
if hasheng.digest() == validationhash:
635
self.secret = secret
636
else:
637
self.secret = key
638
del self.encrypted_secret
639
640
641
def dbus_service_property(dbus_interface, signature="v",
642
access="readwrite", byte_arrays=False):
525
643
"""Decorators for marking methods of a DBusObjectWithProperties to
526
644
become properties on the D-Bus.
527
645
534
652
"""
535
653
# Encoding deeply encoded byte arrays is not supported yet by the
536
654
# "Set" method, so we fail early here:
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
655
if byte_arrays and signature != "ay":
656
raise ValueError("Byte arrays not supported for non-'ay'"
657
" signature %r" % signature)
540
658
def decorator(func):
541
659
func._dbus_is_property = True
542
660
func._dbus_interface = dbus_interface
543
661
func._dbus_signature = signature
544
662
func._dbus_access = access
545
663
func._dbus_name = func.__name__
546
if func._dbus_name.endswith(u"_dbus_property"):
664
if func._dbus_name.endswith("_dbus_property"):
547
665
func._dbus_name = func._dbus_name[:-14]
548
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
666
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
549
667
return func
550
668
return decorator
551
669
571
689
572
690
class DBusObjectWithProperties(dbus.service.Object):
573
691
"""A D-Bus object with properties.
574
692
575
693
Classes inheriting from this can use the dbus_service_property
576
694
decorator to expose methods as D-Bus properties. It exposes the
577
695
standard Get(), Set(), and GetAll() methods on the D-Bus.
579
697
580
698
@staticmethod
581
699
def _is_dbus_property(obj):
582
return getattr(obj, u"_dbus_is_property", False)
700
return getattr(obj, "_dbus_is_property", False)
583
701
584
702
def _get_all_dbus_properties(self):
585
703
"""Returns a generator of (name, attribute) pairs
586
704
"""
587
return ((prop._dbus_name, prop)
705
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
706
for cls in self.__class__.__mro__
588
707
for name, prop in
589
inspect.getmembers(self, self._is_dbus_property))
708
inspect.getmembers(cls, self._is_dbus_property))
590
709
591
710
def _get_dbus_property(self, interface_name, property_name):
592
711
"""Returns a bound method if one exists which is a D-Bus
593
712
property with the specified name and interface.
594
713
"""
595
for name in (property_name,
596
property_name + u"_dbus_property"):
597
prop = getattr(self, name, None)
598
if (prop is None
599
or not self._is_dbus_property(prop)
600
or prop._dbus_name != property_name
601
or (interface_name and prop._dbus_interface
602
and interface_name != prop._dbus_interface)):
603
continue
604
return prop
714
for cls in self.__class__.__mro__:
715
for name, value in (inspect.getmembers
716
(cls, self._is_dbus_property)):
717
if (value._dbus_name == property_name
718
and value._dbus_interface == interface_name):
719
return value.__get__(self)
720
605
721
# No such property
606
raise DBusPropertyNotFound(self.dbus_object_path + u":"
607
+ interface_name + u"."
722
raise DBusPropertyNotFound(self.dbus_object_path + ":"
723
+ interface_name + "."
608
724
+ property_name)
609
725
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
611
out_signature=u"v")
726
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
727
out_signature="v")
612
728
def Get(self, interface_name, property_name):
613
729
"""Standard D-Bus property Get() method, see D-Bus standard.
614
730
"""
615
731
prop = self._get_dbus_property(interface_name, property_name)
616
if prop._dbus_access == u"write":
732
if prop._dbus_access == "write":
617
733
raise DBusPropertyAccessException(property_name)
618
734
value = prop()
619
if not hasattr(value, u"variant_level"):
735
if not hasattr(value, "variant_level"):
620
736
return value
621
737
return type(value)(value, variant_level=value.variant_level+1)
622
738
623
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
739
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
624
740
def Set(self, interface_name, property_name, value):
625
741
"""Standard D-Bus property Set() method, see D-Bus standard.
626
742
"""
627
743
prop = self._get_dbus_property(interface_name, property_name)
628
if prop._dbus_access == u"read":
744
if prop._dbus_access == "read":
629
745
raise DBusPropertyAccessException(property_name)
630
if prop._dbus_get_args_options[u"byte_arrays"]:
746
if prop._dbus_get_args_options["byte_arrays"]:
631
747
# The byte_arrays option is not supported yet on
632
748
# signatures other than "ay".
633
if prop._dbus_signature != u"ay":
749
if prop._dbus_signature != "ay":
634
750
raise ValueError
635
751
value = dbus.ByteArray(''.join(unichr(byte)
636
752
for byte in value))
637
753
prop(value)
638
754
639
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
640
out_signature=u"a{sv}")
755
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
756
out_signature="a{sv}")
641
757
def GetAll(self, interface_name):
642
758
"""Standard D-Bus property GetAll() method, see D-Bus
643
759
standard.
644
760
645
761
Note: Will not include properties with access="write".
646
762
"""
647
763
all = {}
651
767
# Interface non-empty but did not match
652
768
continue
653
769
# Ignore write-only properties
654
if prop._dbus_access == u"write":
770
if prop._dbus_access == "write":
655
771
continue
656
772
value = prop()
657
if not hasattr(value, u"variant_level"):
773
if not hasattr(value, "variant_level"):
658
774
all[name] = value
659
775
continue
660
776
all[name] = type(value)(value, variant_level=
661
777
value.variant_level+1)
662
return dbus.Dictionary(all, signature=u"sv")
778
return dbus.Dictionary(all, signature="sv")
663
779
664
780
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
665
out_signature=u"s",
781
out_signature="s",
666
782
path_keyword='object_path',
667
783
connection_keyword='connection')
668
784
def Introspect(self, object_path, connection):
673
789
try:
674
790
document = xml.dom.minidom.parseString(xmlstring)
675
791
def make_tag(document, name, prop):
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
792
e = document.createElement("property")
793
e.setAttribute("name", name)
794
e.setAttribute("type", prop._dbus_signature)
795
e.setAttribute("access", prop._dbus_access)
680
796
return e
681
for if_tag in document.getElementsByTagName(u"interface"):
797
for if_tag in document.getElementsByTagName("interface"):
682
798
for tag in (make_tag(document, name, prop)
683
799
for name, prop
684
800
in self._get_all_dbus_properties()
685
801
if prop._dbus_interface
686
== if_tag.getAttribute(u"name")):
802
== if_tag.getAttribute("name")):
687
803
if_tag.appendChild(tag)
688
804
# Add the names to the return values for the
689
805
# "org.freedesktop.DBus.Properties" methods
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
701
== u"out"):
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
806
if (if_tag.getAttribute("name")
807
== "org.freedesktop.DBus.Properties"):
808
for cn in if_tag.getElementsByTagName("method"):
809
if cn.getAttribute("name") == "Get":
810
for arg in cn.getElementsByTagName("arg"):
811
if (arg.getAttribute("direction")
812
== "out"):
813
arg.setAttribute("name", "value")
814
elif cn.getAttribute("name") == "GetAll":
815
for arg in cn.getElementsByTagName("arg"):
816
if (arg.getAttribute("direction")
817
== "out"):
818
arg.setAttribute("name", "props")
819
xmlstring = document.toxml("utf-8")
704
820
document.unlink()
705
821
except (AttributeError, xml.dom.DOMException,
706
xml.parsers.expat.ExpatError), error:
707
logger.error(u"Failed to override Introspection method",
822
xml.parsers.expat.ExpatError) as error:
823
logger.error("Failed to override Introspection method",
708
824
error)
709
825
return xmlstring
710
826
711
827
828
def datetime_to_dbus (dt, variant_level=0):
829
"""Convert a UTC datetime.datetime() to a D-Bus type."""
830
if dt is None:
831
return dbus.String("", variant_level = variant_level)
832
return dbus.String(dt.isoformat(),
833
variant_level=variant_level)
834
835
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
836
.__metaclass__):
837
"""Applied to an empty subclass of a D-Bus object, this metaclass
838
will add additional D-Bus attributes matching a certain pattern.
839
"""
840
def __new__(mcs, name, bases, attr):
841
# Go through all the base classes which could have D-Bus
842
# methods, signals, or properties in them
843
for base in (b for b in bases
844
if issubclass(b, dbus.service.Object)):
845
# Go though all attributes of the base class
846
for attrname, attribute in inspect.getmembers(base):
847
# Ignore non-D-Bus attributes, and D-Bus attributes
848
# with the wrong interface name
849
if (not hasattr(attribute, "_dbus_interface")
850
or not attribute._dbus_interface
851
.startswith("se.recompile.Mandos")):
852
continue
853
# Create an alternate D-Bus interface name based on
854
# the current name
855
alt_interface = (attribute._dbus_interface
856
.replace("se.recompile.Mandos",
857
"se.bsnet.fukt.Mandos"))
858
# Is this a D-Bus signal?
859
if getattr(attribute, "_dbus_is_signal", False):
860
# Extract the original non-method function by
861
# black magic
862
nonmethod_func = (dict(
863
zip(attribute.func_code.co_freevars,
864
attribute.__closure__))["func"]
865
.cell_contents)
866
# Create a new, but exactly alike, function
867
# object, and decorate it to be a new D-Bus signal
868
# with the alternate D-Bus interface name
869
new_function = (dbus.service.signal
870
(alt_interface,
871
attribute._dbus_signature)
872
(types.FunctionType(
873
nonmethod_func.func_code,
874
nonmethod_func.func_globals,
875
nonmethod_func.func_name,
876
nonmethod_func.func_defaults,
877
nonmethod_func.func_closure)))
878
# Define a creator of a function to call both the
879
# old and new functions, so both the old and new
880
# signals gets sent when the function is called
881
def fixscope(func1, func2):
882
"""This function is a scope container to pass
883
func1 and func2 to the "call_both" function
884
outside of its arguments"""
885
def call_both(*args, **kwargs):
886
"""This function will emit two D-Bus
887
signals by calling func1 and func2"""
888
func1(*args, **kwargs)
889
func2(*args, **kwargs)
890
return call_both
891
# Create the "call_both" function and add it to
892
# the class
893
attr[attrname] = fixscope(attribute,
894
new_function)
895
# Is this a D-Bus method?
896
elif getattr(attribute, "_dbus_is_method", False):
897
# Create a new, but exactly alike, function
898
# object. Decorate it to be a new D-Bus method
899
# with the alternate D-Bus interface name. Add it
900
# to the class.
901
attr[attrname] = (dbus.service.method
902
(alt_interface,
903
attribute._dbus_in_signature,
904
attribute._dbus_out_signature)
905
(types.FunctionType
906
(attribute.func_code,
907
attribute.func_globals,
908
attribute.func_name,
909
attribute.func_defaults,
910
attribute.func_closure)))
911
# Is this a D-Bus property?
912
elif getattr(attribute, "_dbus_is_property", False):
913
# Create a new, but exactly alike, function
914
# object, and decorate it to be a new D-Bus
915
# property with the alternate D-Bus interface
916
# name. Add it to the class.
917
attr[attrname] = (dbus_service_property
918
(alt_interface,
919
attribute._dbus_signature,
920
attribute._dbus_access,
921
attribute
922
._dbus_get_args_options
923
["byte_arrays"])
924
(types.FunctionType
925
(attribute.func_code,
926
attribute.func_globals,
927
attribute.func_name,
928
attribute.func_defaults,
929
attribute.func_closure)))
930
return type.__new__(mcs, name, bases, attr)
931
712
932
class ClientDBus(Client, DBusObjectWithProperties):
713
933
"""A Client class using D-Bus
714
934
718
938
"""
719
939
720
940
runtime_expansions = (Client.runtime_expansions
721
+ (u"dbus_object_path",))
941
+ ("dbus_object_path",))
722
942
723
943
# dbus.service.Object doesn't use super(), so we can't either.
724
944
725
945
def __init__(self, bus = None, *args, **kwargs):
946
self.bus = bus
947
Client.__init__(self, *args, **kwargs)
948
726
949
self._approvals_pending = 0
727
self.bus = bus
728
Client.__init__(self, *args, **kwargs)
729
950
# Only now, when this client is initialized, can it show up on
730
951
# the D-Bus
731
952
client_object_name = unicode(self.name).translate(
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
953
{ord("."): ord("_"),
954
ord("-"): ord("_")})
734
955
self.dbus_object_path = (dbus.ObjectPath
735
(u"/clients/" + client_object_name))
956
("/clients/" + client_object_name))
736
957
DBusObjectWithProperties.__init__(self, self.bus,
737
958
self.dbus_object_path)
738
959
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
744
bval = bool(value)
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
dbus_bool)
960
def notifychangeproperty(transform_func,
961
dbus_name, type_func=lambda x: x,
962
variant_level=1):
963
""" Modify a variable so that it's a property which announces
964
its changes to DBus.
750
965
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
754
755
@staticmethod
756
def _datetime_to_dbus(dt, variant_level=0):
757
"""Convert a UTC datetime.datetime() to a D-Bus type."""
758
return dbus.String(dt.isoformat(),
759
variant_level=variant_level)
760
761
def enable(self):
762
oldstate = getattr(self, u"enabled", False)
763
r = Client.enable(self)
764
if oldstate != self.enabled:
765
# Emit D-Bus signals
766
self.PropertyChanged(dbus.String(u"Enabled"),
767
dbus.Boolean(True, variant_level=1))
768
self.PropertyChanged(
769
dbus.String(u"LastEnabled"),
770
self._datetime_to_dbus(self.last_enabled,
771
variant_level=1))
772
return r
773
774
def disable(self, quiet = False):
775
oldstate = getattr(self, u"enabled", False)
776
r = Client.disable(self, quiet=quiet)
777
if not quiet and oldstate != self.enabled:
778
# Emit D-Bus signal
779
self.PropertyChanged(dbus.String(u"Enabled"),
780
dbus.Boolean(False, variant_level=1))
781
return r
966
transform_fun: Function that takes a value and a variant_level
967
and transforms it to a D-Bus type.
968
dbus_name: D-Bus name of the variable
969
type_func: Function that transform the value before sending it
970
to the D-Bus. Default: no transform
971
variant_level: D-Bus variant level. Default: 1
972
"""
973
attrname = "_{0}".format(dbus_name)
974
def setter(self, value):
975
if hasattr(self, "dbus_object_path"):
976
if (not hasattr(self, attrname) or
977
type_func(getattr(self, attrname, None))
978
!= type_func(value)):
979
dbus_value = transform_func(type_func(value),
980
variant_level
981
=variant_level)
982
self.PropertyChanged(dbus.String(dbus_name),
983
dbus_value)
984
setattr(self, attrname, value)
985
986
return property(lambda self: getattr(self, attrname), setter)
987
988
989
expires = notifychangeproperty(datetime_to_dbus, "Expires")
990
approvals_pending = notifychangeproperty(dbus.Boolean,
991
"ApprovalPending",
992
type_func = bool)
993
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
994
last_enabled = notifychangeproperty(datetime_to_dbus,
995
"LastEnabled")
996
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
997
type_func = lambda checker:
998
checker is not None)
999
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1000
"LastCheckedOK")
1001
last_approval_request = notifychangeproperty(
1002
datetime_to_dbus, "LastApprovalRequest")
1003
approved_by_default = notifychangeproperty(dbus.Boolean,
1004
"ApprovedByDefault")
1005
approval_delay = notifychangeproperty(dbus.UInt16,
1006
"ApprovalDelay",
1007
type_func =
1008
_timedelta_to_milliseconds)
1009
approval_duration = notifychangeproperty(
1010
dbus.UInt16, "ApprovalDuration",
1011
type_func = _timedelta_to_milliseconds)
1012
host = notifychangeproperty(dbus.String, "Host")
1013
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1014
type_func =
1015
_timedelta_to_milliseconds)
1016
extended_timeout = notifychangeproperty(
1017
dbus.UInt16, "ExtendedTimeout",
1018
type_func = _timedelta_to_milliseconds)
1019
interval = notifychangeproperty(dbus.UInt16,
1020
"Interval",
1021
type_func =
1022
_timedelta_to_milliseconds)
1023
checker_command = notifychangeproperty(dbus.String, "Checker")
1024
1025
del notifychangeproperty
782
1026
783
1027
def __del__(self, *args, **kwargs):
784
1028
try:
785
1029
self.remove_from_connection()
786
1030
except LookupError:
787
1031
pass
788
if hasattr(DBusObjectWithProperties, u"__del__"):
1032
if hasattr(DBusObjectWithProperties, "__del__"):
789
1033
DBusObjectWithProperties.__del__(self, *args, **kwargs)
790
1034
Client.__del__(self, *args, **kwargs)
791
1035
793
1037
*args, **kwargs):
794
1038
self.checker_callback_tag = None
795
1039
self.checker = None
796
# Emit D-Bus signal
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
798
dbus.Boolean(False, variant_level=1))
799
1040
if os.WIFEXITED(condition):
800
1041
exitstatus = os.WEXITSTATUS(condition)
801
1042
# Emit D-Bus signal
811
1052
return Client.checker_callback(self, pid, condition, command,
812
1053
*args, **kwargs)
813
1054
814
def checked_ok(self, *args, **kwargs):
815
r = Client.checked_ok(self, *args, **kwargs)
816
# Emit D-Bus signal
817
self.PropertyChanged(
818
dbus.String(u"LastCheckedOK"),
819
(self._datetime_to_dbus(self.last_checked_ok,
820
variant_level=1)))
821
return r
822
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
825
# Emit D-Bus signal
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
829
variant_level=1)))
830
return r
831
832
1055
def start_checker(self, *args, **kwargs):
833
1056
old_checker = self.checker
834
1057
if self.checker is not None:
841
1064
and old_checker_pid != self.checker.pid):
842
1065
# Emit D-Bus signal
843
1066
self.CheckerStarted(self.current_checker_command)
844
self.PropertyChanged(
845
dbus.String(u"CheckerRunning"),
846
dbus.Boolean(True, variant_level=1))
847
1067
return r
848
1068
849
def stop_checker(self, *args, **kwargs):
850
old_checker = getattr(self, u"checker", None)
851
r = Client.stop_checker(self, *args, **kwargs)
852
if (old_checker is not None
853
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
855
dbus.Boolean(False, variant_level=1))
856
return r
857
858
1069
def _reset_approved(self):
859
1070
self._approved = None
860
1071
return False
862
1073
def approve(self, value=True):
863
1074
self.send_changedstate()
864
1075
self._approved = value
865
gobject.timeout_add(self._timedelta_to_milliseconds
1076
gobject.timeout_add(_timedelta_to_milliseconds
866
1077
(self.approval_duration),
867
1078
self._reset_approved)
868
1079
869
1080
870
1081
## D-Bus methods, signals & properties
871
_interface = u"se.bsnet.fukt.Mandos.Client"
1082
_interface = "se.recompile.Mandos.Client"
872
1083
873
1084
## Signals
874
1085
875
1086
# CheckerCompleted - signal
876
@dbus.service.signal(_interface, signature=u"nxs")
1087
@dbus.service.signal(_interface, signature="nxs")
877
1088
def CheckerCompleted(self, exitcode, waitstatus, command):
878
1089
"D-Bus signal"
879
1090
pass
880
1091
881
1092
# CheckerStarted - signal
882
@dbus.service.signal(_interface, signature=u"s")
1093
@dbus.service.signal(_interface, signature="s")
883
1094
def CheckerStarted(self, command):
884
1095
"D-Bus signal"
885
1096
pass
886
1097
887
1098
# PropertyChanged - signal
888
@dbus.service.signal(_interface, signature=u"sv")
1099
@dbus.service.signal(_interface, signature="sv")
889
1100
def PropertyChanged(self, property, value):
890
1101
"D-Bus signal"
891
1102
pass
900
1111
pass
901
1112
902
1113
# Rejected - signal
903
@dbus.service.signal(_interface, signature=u"s")
1114
@dbus.service.signal(_interface, signature="s")
904
1115
def Rejected(self, reason):
905
1116
"D-Bus signal"
906
1117
pass
907
1118
908
1119
# NeedApproval - signal
909
@dbus.service.signal(_interface, signature=u"tb")
1120
@dbus.service.signal(_interface, signature="tb")
910
1121
def NeedApproval(self, timeout, default):
911
1122
"D-Bus signal"
912
1123
return self.need_approval()
913
1124
1125
# NeRwequest - signal
1126
@dbus.service.signal(_interface, signature="s")
1127
def NewRequest(self, ip):
1128
"""D-Bus signal
1129
Is sent after a client request a password.
1130
"""
1131
pass
1132
914
1133
## Methods
915
1134
916
1135
# Approve - method
917
@dbus.service.method(_interface, in_signature=u"b")
1136
@dbus.service.method(_interface, in_signature="b")
918
1137
def Approve(self, value):
919
1138
self.approve(value)
920
1139
921
1140
# CheckedOK - method
922
1141
@dbus.service.method(_interface)
923
1142
def CheckedOK(self):
924
return self.checked_ok()
1143
self.checked_ok()
925
1144
926
1145
# Enable - method
927
1146
@dbus.service.method(_interface)
949
1168
## Properties
950
1169
951
1170
# ApprovalPending - property
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
1171
@dbus_service_property(_interface, signature="b", access="read")
953
1172
def ApprovalPending_dbus_property(self):
954
1173
return dbus.Boolean(bool(self.approvals_pending))
955
1174
956
1175
# ApprovedByDefault - property
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
1176
@dbus_service_property(_interface, signature="b",
1177
access="readwrite")
959
1178
def ApprovedByDefault_dbus_property(self, value=None):
960
1179
if value is None: # get
961
1180
return dbus.Boolean(self.approved_by_default)
962
1181
self.approved_by_default = bool(value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
966
1182
967
1183
# ApprovalDelay - property
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
1184
@dbus_service_property(_interface, signature="t",
1185
access="readwrite")
970
1186
def ApprovalDelay_dbus_property(self, value=None):
971
1187
if value is None: # get
972
1188
return dbus.UInt64(self.approval_delay_milliseconds())
973
1189
self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
# Emit D-Bus signal
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
977
1190
978
1191
# ApprovalDuration - property
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
1192
@dbus_service_property(_interface, signature="t",
1193
access="readwrite")
981
1194
def ApprovalDuration_dbus_property(self, value=None):
982
1195
if value is None: # get
983
return dbus.UInt64(self._timedelta_to_milliseconds(
1196
return dbus.UInt64(_timedelta_to_milliseconds(
984
1197
self.approval_duration))
985
1198
self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
# Emit D-Bus signal
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
989
1199
990
1200
# Name - property
991
@dbus_service_property(_interface, signature=u"s", access=u"read")
1201
@dbus_service_property(_interface, signature="s", access="read")
992
1202
def Name_dbus_property(self):
993
1203
return dbus.String(self.name)
994
1204
995
1205
# Fingerprint - property
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
1206
@dbus_service_property(_interface, signature="s", access="read")
997
1207
def Fingerprint_dbus_property(self):
998
1208
return dbus.String(self.fingerprint)
999
1209
1000
1210
# Host - property
1001
@dbus_service_property(_interface, signature=u"s",
1002
access=u"readwrite")
1211
@dbus_service_property(_interface, signature="s",
1212
access="readwrite")
1003
1213
def Host_dbus_property(self, value=None):
1004
1214
if value is None: # get
1005
1215
return dbus.String(self.host)
1006
1216
self.host = value
1007
# Emit D-Bus signal
1008
self.PropertyChanged(dbus.String(u"Host"),
1009
dbus.String(value, variant_level=1))
1010
1217
1011
1218
# Created - property
1012
@dbus_service_property(_interface, signature=u"s", access=u"read")
1219
@dbus_service_property(_interface, signature="s", access="read")
1013
1220
def Created_dbus_property(self):
1014
return dbus.String(self._datetime_to_dbus(self.created))
1221
return dbus.String(datetime_to_dbus(self.created))
1015
1222
1016
1223
# LastEnabled - property
1017
@dbus_service_property(_interface, signature=u"s", access=u"read")
1224
@dbus_service_property(_interface, signature="s", access="read")
1018
1225
def LastEnabled_dbus_property(self):
1019
if self.last_enabled is None:
1020
return dbus.String(u"")
1021
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1226
return datetime_to_dbus(self.last_enabled)
1022
1227
1023
1228
# Enabled - property
1024
@dbus_service_property(_interface, signature=u"b",
1025
access=u"readwrite")
1229
@dbus_service_property(_interface, signature="b",
1230
access="readwrite")
1026
1231
def Enabled_dbus_property(self, value=None):
1027
1232
if value is None: # get
1028
1233
return dbus.Boolean(self.enabled)
1032
1237
self.disable()
1033
1238
1034
1239
# LastCheckedOK - property
1035
@dbus_service_property(_interface, signature=u"s",
1036
access=u"readwrite")
1240
@dbus_service_property(_interface, signature="s",
1241
access="readwrite")
1037
1242
def LastCheckedOK_dbus_property(self, value=None):
1038
1243
if value is not None:
1039
1244
self.checked_ok()
1040
1245
return
1041
if self.last_checked_ok is None:
1042
return dbus.String(u"")
1043
return dbus.String(self._datetime_to_dbus(self
1044
.last_checked_ok))
1246
return datetime_to_dbus(self.last_checked_ok)
1247
1248
# Expires - property
1249
@dbus_service_property(_interface, signature="s", access="read")
1250
def Expires_dbus_property(self):
1251
return datetime_to_dbus(self.expires)
1045
1252
1046
1253
# LastApprovalRequest - property
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1254
@dbus_service_property(_interface, signature="s", access="read")
1048
1255
def LastApprovalRequest_dbus_property(self):
1049
if self.last_approval_request is None:
1050
return dbus.String(u"")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1256
return datetime_to_dbus(self.last_approval_request)
1054
1257
1055
1258
# Timeout - property
1056
@dbus_service_property(_interface, signature=u"t",
1057
access=u"readwrite")
1259
@dbus_service_property(_interface, signature="t",
1260
access="readwrite")
1058
1261
def Timeout_dbus_property(self, value=None):
1059
1262
if value is None: # get
1060
1263
return dbus.UInt64(self.timeout_milliseconds())
1061
1264
self.timeout = datetime.timedelta(0, 0, 0, value)
1062
# Emit D-Bus signal
1063
self.PropertyChanged(dbus.String(u"Timeout"),
1064
dbus.UInt64(value, variant_level=1))
1065
if getattr(self, u"disable_initiator_tag", None) is None:
1265
if getattr(self, "disable_initiator_tag", None) is None:
1066
1266
return
1067
1267
# Reschedule timeout
1068
1268
gobject.source_remove(self.disable_initiator_tag)
1069
1269
self.disable_initiator_tag = None
1070
time_to_die = (self.
1071
_timedelta_to_milliseconds((self
1072
.last_checked_ok
1073
+ self.timeout)
1074
- datetime.datetime
1075
.utcnow()))
1270
self.expires = None
1271
time_to_die = _timedelta_to_milliseconds((self
1272
.last_checked_ok
1273
+ self.timeout)
1274
- datetime.datetime
1275
.utcnow())
1076
1276
if time_to_die <= 0:
1077
1277
# The timeout has passed
1078
1278
self.disable()
1079
1279
else:
1280
self.expires = (datetime.datetime.utcnow()
1281
+ datetime.timedelta(milliseconds =
1282
time_to_die))
1080
1283
self.disable_initiator_tag = (gobject.timeout_add
1081
1284
(time_to_die, self.disable))
1082
1285
1286
# ExtendedTimeout - property
1287
@dbus_service_property(_interface, signature="t",
1288
access="readwrite")
1289
def ExtendedTimeout_dbus_property(self, value=None):
1290
if value is None: # get
1291
return dbus.UInt64(self.extended_timeout_milliseconds())
1292
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1293
1083
1294
# Interval - property
1084
@dbus_service_property(_interface, signature=u"t",
1085
access=u"readwrite")
1295
@dbus_service_property(_interface, signature="t",
1296
access="readwrite")
1086
1297
def Interval_dbus_property(self, value=None):
1087
1298
if value is None: # get
1088
1299
return dbus.UInt64(self.interval_milliseconds())
1089
1300
self.interval = datetime.timedelta(0, 0, 0, value)
1090
# Emit D-Bus signal
1091
self.PropertyChanged(dbus.String(u"Interval"),
1092
dbus.UInt64(value, variant_level=1))
1093
if getattr(self, u"checker_initiator_tag", None) is None:
1301
if getattr(self, "checker_initiator_tag", None) is None:
1094
1302
return
1095
1303
# Reschedule checker run
1096
1304
gobject.source_remove(self.checker_initiator_tag)
1097
1305
self.checker_initiator_tag = (gobject.timeout_add
1098
1306
(value, self.start_checker))
1099
1307
self.start_checker() # Start one now, too
1100
1308
1101
1309
# Checker - property
1102
@dbus_service_property(_interface, signature=u"s",
1103
access=u"readwrite")
1310
@dbus_service_property(_interface, signature="s",
1311
access="readwrite")
1104
1312
def Checker_dbus_property(self, value=None):
1105
1313
if value is None: # get
1106
1314
return dbus.String(self.checker_command)
1107
1315
self.checker_command = value
1108
# Emit D-Bus signal
1109
self.PropertyChanged(dbus.String(u"Checker"),
1110
dbus.String(self.checker_command,
1111
variant_level=1))
1112
1316
1113
1317
# CheckerRunning - property
1114
@dbus_service_property(_interface, signature=u"b",
1115
access=u"readwrite")
1318
@dbus_service_property(_interface, signature="b",
1319
access="readwrite")
1116
1320
def CheckerRunning_dbus_property(self, value=None):
1117
1321
if value is None: # get
1118
1322
return dbus.Boolean(self.checker is not None)
1122
1326
self.stop_checker()
1123
1327
1124
1328
# ObjectPath - property
1125
@dbus_service_property(_interface, signature=u"o", access=u"read")
1329
@dbus_service_property(_interface, signature="o", access="read")
1126
1330
def ObjectPath_dbus_property(self):
1127
1331
return self.dbus_object_path # is already a dbus.ObjectPath
1128
1332
1129
1333
# Secret = property
1130
@dbus_service_property(_interface, signature=u"ay",
1131
access=u"write", byte_arrays=True)
1334
@dbus_service_property(_interface, signature="ay",
1335
access="write", byte_arrays=True)
1132
1336
def Secret_dbus_property(self, value):
1133
1337
self.secret = str(value)
1134
1338
1141
1345
self._pipe.send(('init', fpr, address))
1142
1346
if not self._pipe.recv():
1143
1347
raise KeyError()
1144
1348
1145
1349
def __getattribute__(self, name):
1146
1350
if(name == '_pipe'):
1147
1351
return super(ProxyClient, self).__getattribute__(name)
1154
1358
self._pipe.send(('funcall', name, args, kwargs))
1155
1359
return self._pipe.recv()[1]
1156
1360
return func
1157
1361
1158
1362
def __setattr__(self, name, value):
1159
1363
if(name == '_pipe'):
1160
1364
return super(ProxyClient, self).__setattr__(name, value)
1161
1365
self._pipe.send(('setattr', name, value))
1162
1366
1367
class ClientDBusTransitional(ClientDBus):
1368
__metaclass__ = AlternateDBusNamesMetaclass
1163
1369
1164
1370
class ClientHandler(socketserver.BaseRequestHandler, object):
1165
1371
"""A class to handle client connections.
1169
1375
1170
1376
def handle(self):
1171
1377
with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
logger.info(u"TCP connection from: %s",
1378
logger.info("TCP connection from: %s",
1173
1379
unicode(self.client_address))
1174
logger.debug(u"Pipe FD: %d",
1380
logger.debug("Pipe FD: %d",
1175
1381
self.server.child_pipe.fileno())
1176
1382
1177
1383
session = (gnutls.connection
1178
1384
.ClientSession(self.request,
1179
1385
gnutls.connection
1180
1386
.X509Credentials()))
1181
1387
1182
1388
# Note: gnutls.connection.X509Credentials is really a
1183
1389
# generic GnuTLS certificate credentials object so long as
1184
1390
# no X.509 keys are added to it. Therefore, we can use it
1185
1391
# here despite using OpenPGP certificates.
1186
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
# u"+AES-256-CBC", u"+SHA1",
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1190
# u"+DHE-DSS"))
1392
1393
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1394
# "+AES-256-CBC", "+SHA1",
1395
# "+COMP-NULL", "+CTYPE-OPENPGP",
1396
# "+DHE-DSS"))
1191
1397
# Use a fallback default, since this MUST be set.
1192
1398
priority = self.server.gnutls_priority
1193
1399
if priority is None:
1194
priority = u"NORMAL"
1400
priority = "NORMAL"
1195
1401
(gnutls.library.functions
1196
1402
.gnutls_priority_set_direct(session._c_object,
1197
1403
priority, None))
1198
1404
1199
1405
# Start communication using the Mandos protocol
1200
1406
# Get protocol number
1201
1407
line = self.request.makefile().readline()
1202
logger.debug(u"Protocol version: %r", line)
1408
logger.debug("Protocol version: %r", line)
1203
1409
try:
1204
1410
if int(line.strip().split()[0]) > 1:
1205
1411
raise RuntimeError
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
1412
except (ValueError, IndexError, RuntimeError) as error:
1413
logger.error("Unknown protocol version: %s", error)
1208
1414
return
1209
1415
1210
1416
# Start GnuTLS connection
1211
1417
try:
1212
1418
session.handshake()
1213
except gnutls.errors.GNUTLSError, error:
1214
logger.warning(u"Handshake failed: %s", error)
1419
except gnutls.errors.GNUTLSError as error:
1420
logger.warning("Handshake failed: %s", error)
1215
1421
# Do not run session.bye() here: the session is not
1216
1422
# established. Just abandon the request.
1217
1423
return
1218
logger.debug(u"Handshake succeeded")
1219
1424
logger.debug("Handshake succeeded")
1425
1220
1426
approval_required = False
1221
1427
try:
1222
1428
try:
1223
1429
fpr = self.fingerprint(self.peer_certificate
1224
1430
(session))
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning(u"Bad certificate: %s", error)
1431
except (TypeError,
1432
gnutls.errors.GNUTLSError) as error:
1433
logger.warning("Bad certificate: %s", error)
1227
1434
return
1228
logger.debug(u"Fingerprint: %s", fpr)
1229
1435
logger.debug("Fingerprint: %s", fpr)
1436
if self.server.use_dbus:
1437
# Emit D-Bus signal
1438
client.NewRequest(str(self.client_address))
1439
1230
1440
try:
1231
1441
client = ProxyClient(child_pipe, fpr,
1232
1442
self.client_address)
1240
1450
1241
1451
while True:
1242
1452
if not client.enabled:
1243
logger.warning(u"Client %s is disabled",
1453
logger.info("Client %s is disabled",
1244
1454
client.name)
1245
1455
if self.server.use_dbus:
1246
1456
# Emit D-Bus signal
1247
client.Rejected("Disabled")
1457
client.Rejected("Disabled")
1248
1458
return
1249
1459
1250
1460
if client._approved or not client.approval_delay:
1251
1461
#We are approved or approval is disabled
1252
1462
break
1253
1463
elif client._approved is None:
1254
logger.info(u"Client %s needs approval",
1464
logger.info("Client %s needs approval",
1255
1465
client.name)
1256
1466
if self.server.use_dbus:
1257
1467
# Emit D-Bus signal
1259
1469
client.approval_delay_milliseconds(),
1260
1470
client.approved_by_default)
1261
1471
else:
1262
logger.warning(u"Client %s was not approved",
1472
logger.warning("Client %s was not approved",
1263
1473
client.name)
1264
1474
if self.server.use_dbus:
1265
1475
# Emit D-Bus signal
1267
1477
return
1268
1478
1269
1479
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
1271
1480
time = datetime.datetime.now()
1272
1481
client.changedstate.acquire()
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1482
(client.changedstate.wait
1483
(float(client._timedelta_to_milliseconds(delay)
1484
/ 1000)))
1274
1485
client.changedstate.release()
1275
1486
time2 = datetime.datetime.now()
1276
1487
if (time2 - time) >= delay:
1291
1502
while sent_size < len(client.secret):
1292
1503
try:
1293
1504
sent = session.send(client.secret[sent_size:])
1294
except (gnutls.errors.GNUTLSError), error:
1505
except gnutls.errors.GNUTLSError as error:
1295
1506
logger.warning("gnutls send failed")
1296
1507
return
1297
logger.debug(u"Sent: %d, remaining: %d",
1508
logger.debug("Sent: %d, remaining: %d",
1298
1509
sent, len(client.secret)
1299
1510
- (sent_size + sent))
1300
1511
sent_size += sent
1301
1302
logger.info(u"Sending secret to %s", client.name)
1303
# bump the timeout as if seen
1304
client.checked_ok()
1512
1513
logger.info("Sending secret to %s", client.name)
1514
# bump the timeout using extended_timeout
1515
client.checked_ok(client.extended_timeout)
1305
1516
if self.server.use_dbus:
1306
1517
# Emit D-Bus signal
1307
1518
client.GotSecret()
1311
1522
client.approvals_pending -= 1
1312
1523
try:
1313
1524
session.bye()
1314
except (gnutls.errors.GNUTLSError), error:
1525
except gnutls.errors.GNUTLSError as error:
1315
1526
logger.warning("GnuTLS bye failed")
1316
1527
1317
1528
@staticmethod
1328
1539
.gnutls_certificate_get_peers
1329
1540
(session._c_object, ctypes.byref(list_size)))
1330
1541
if not bool(cert_list) and list_size.value != 0:
1331
raise gnutls.errors.GNUTLSError(u"error getting peer"
1332
u" certificate")
1542
raise gnutls.errors.GNUTLSError("error getting peer"
1543
" certificate")
1333
1544
if list_size.value == 0:
1334
1545
return None
1335
1546
cert = cert_list[0]
1361
1572
if crtverify.value != 0:
1362
1573
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1363
1574
raise (gnutls.errors.CertificateSecurityError
1364
(u"Verify failed"))
1575
("Verify failed"))
1365
1576
# New buffer for the fingerprint
1366
1577
buf = ctypes.create_string_buffer(20)
1367
1578
buf_len = ctypes.c_size_t()
1374
1585
# Convert the buffer to a Python bytestring
1375
1586
fpr = ctypes.string_at(buf, buf_len.value)
1376
1587
# Convert the bytestring to hexadecimal notation
1377
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1588
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1378
1589
return hex_fpr
1379
1590
1380
1591
1386
1597
except:
1387
1598
self.handle_error(request, address)
1388
1599
self.close_request(request)
1389
1600
1390
1601
def process_request(self, request, address):
1391
1602
"""Start a new process to process the request."""
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
1603
proc = multiprocessing.Process(target = self.sub_process_main,
1604
args = (request,
1605
address))
1606
proc.start()
1607
return proc
1608
1394
1609
1395
1610
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
1611
""" adds a pipe to the MixIn """
1400
1615
This function creates a new pipe in self.pipe
1401
1616
"""
1402
1617
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
1404
super(MultiprocessingMixInWithPipe,
1405
self).process_request(request, client_address)
1618
1619
proc = MultiprocessingMixIn.process_request(self, request,
1620
client_address)
1406
1621
self.child_pipe.close()
1407
self.add_pipe(parent_pipe)
1408
1409
def add_pipe(self, parent_pipe):
1622
self.add_pipe(parent_pipe, proc)
1623
1624
def add_pipe(self, parent_pipe, proc):
1410
1625
"""Dummy function; override as necessary"""
1411
pass
1626
raise NotImplementedError
1627
1412
1628
1413
1629
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1414
1630
socketserver.TCPServer, object):
1432
1648
bind to an address or port if they were not specified."""
1433
1649
if self.interface is not None:
1434
1650
if SO_BINDTODEVICE is None:
1435
logger.error(u"SO_BINDTODEVICE does not exist;"
1436
u" cannot bind to interface %s",
1651
logger.error("SO_BINDTODEVICE does not exist;"
1652
" cannot bind to interface %s",
1437
1653
self.interface)
1438
1654
else:
1439
1655
try:
1440
1656
self.socket.setsockopt(socket.SOL_SOCKET,
1441
1657
SO_BINDTODEVICE,
1442
1658
str(self.interface
1443
+ u'\0'))
1444
except socket.error, error:
1659
+ '\0'))
1660
except socket.error as error:
1445
1661
if error[0] == errno.EPERM:
1446
logger.error(u"No permission to"
1447
u" bind to interface %s",
1662
logger.error("No permission to"
1663
" bind to interface %s",
1448
1664
self.interface)
1449
1665
elif error[0] == errno.ENOPROTOOPT:
1450
logger.error(u"SO_BINDTODEVICE not available;"
1451
u" cannot bind to interface %s",
1666
logger.error("SO_BINDTODEVICE not available;"
1667
" cannot bind to interface %s",
1452
1668
self.interface)
1453
1669
else:
1454
1670
raise
1456
1672
if self.server_address[0] or self.server_address[1]:
1457
1673
if not self.server_address[0]:
1458
1674
if self.address_family == socket.AF_INET6:
1459
any_address = u"::" # in6addr_any
1675
any_address = "::" # in6addr_any
1460
1676
else:
1461
1677
any_address = socket.INADDR_ANY
1462
1678
self.server_address = (any_address,
1489
1705
self.enabled = False
1490
1706
self.clients = clients
1491
1707
if self.clients is None:
1492
self.clients = set()
1708
self.clients = {}
1493
1709
self.use_dbus = use_dbus
1494
1710
self.gnutls_priority = gnutls_priority
1495
1711
IPv6_TCPServer.__init__(self, server_address,
1499
1715
def server_activate(self):
1500
1716
if self.enabled:
1501
1717
return socketserver.TCPServer.server_activate(self)
1718
1502
1719
def enable(self):
1503
1720
self.enabled = True
1504
def add_pipe(self, parent_pipe):
1721
1722
def add_pipe(self, parent_pipe, proc):
1505
1723
# Call "handle_ipc" for both data and EOF events
1506
1724
gobject.io_add_watch(parent_pipe.fileno(),
1507
1725
gobject.IO_IN | gobject.IO_HUP,
1508
1726
functools.partial(self.handle_ipc,
1509
parent_pipe = parent_pipe))
1510
1727
parent_pipe =
1728
parent_pipe,
1729
proc = proc))
1730
1511
1731
def handle_ipc(self, source, condition, parent_pipe=None,
1512
client_object=None):
1732
proc = None, client_object=None):
1513
1733
condition_names = {
1514
gobject.IO_IN: u"IN", # There is data to read.
1515
gobject.IO_OUT: u"OUT", # Data can be written (without
1734
gobject.IO_IN: "IN", # There is data to read.
1735
gobject.IO_OUT: "OUT", # Data can be written (without
1516
1736
# blocking).
1517
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1518
gobject.IO_ERR: u"ERR", # Error condition.
1519
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1737
gobject.IO_PRI: "PRI", # There is urgent data to read.
1738
gobject.IO_ERR: "ERR", # Error condition.
1739
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1520
1740
# broken, usually for pipes and
1521
1741
# sockets).
1522
1742
}
1524
1744
for cond, name in
1525
1745
condition_names.iteritems()
1526
1746
if cond & condition)
1527
# error or the other end of multiprocessing.Pipe has closed
1747
# error, or the other end of multiprocessing.Pipe has closed
1528
1748
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1749
# Wait for other process to exit
1750
proc.join()
1529
1751
return False
1530
1752
1531
1753
# Read a request from the child
1536
1758
fpr = request[1]
1537
1759
address = request[2]
1538
1760
1539
for c in self.clients:
1761
for c in self.clients.itervalues():
1540
1762
if c.fingerprint == fpr:
1541
1763
client = c
1542
1764
break
1543
1765
else:
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1766
logger.info("Client not found for fingerprint: %s, ad"
1767
"dress: %s", fpr, address)
1546
1768
if self.use_dbus:
1547
1769
# Emit D-Bus signal
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1770
mandos_dbus_service.ClientNotFound(fpr,
1771
address[0])
1549
1772
parent_pipe.send(False)
1550
1773
return False
1551
1774
1552
1775
gobject.io_add_watch(parent_pipe.fileno(),
1553
1776
gobject.IO_IN | gobject.IO_HUP,
1554
1777
functools.partial(self.handle_ipc,
1555
parent_pipe = parent_pipe,
1556
client_object = client))
1778
parent_pipe =
1779
parent_pipe,
1780
proc = proc,
1781
client_object =
1782
client))
1557
1783
parent_pipe.send(True)
1558
# remove the old hook in favor of the new above hook on same fileno
1784
# remove the old hook in favor of the new above hook on
1785
# same fileno
1559
1786
return False
1560
1787
if command == 'funcall':
1561
1788
funcname = request[1]
1562
1789
args = request[2]
1563
1790
kwargs = request[3]
1564
1791
1565
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
1792
parent_pipe.send(('data', getattr(client_object,
1793
funcname)(*args,
1794
**kwargs)))
1795
1567
1796
if command == 'getattr':
1568
1797
attrname = request[1]
1569
1798
if callable(client_object.__getattribute__(attrname)):
1570
1799
parent_pipe.send(('function',))
1571
1800
else:
1572
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1801
parent_pipe.send(('data', client_object
1802
.__getattribute__(attrname)))
1573
1803
1574
1804
if command == 'setattr':
1575
1805
attrname = request[1]
1576
1806
value = request[2]
1577
1807
setattr(client_object, attrname, value)
1578
1808
1579
1809
return True
1580
1810
1581
1811
1582
1812
def string_to_delta(interval):
1583
1813
"""Parse a string and return a datetime.timedelta
1584
1814
1585
>>> string_to_delta(u'7d')
1815
>>> string_to_delta('7d')
1586
1816
datetime.timedelta(7)
1587
>>> string_to_delta(u'60s')
1817
>>> string_to_delta('60s')
1588
1818
datetime.timedelta(0, 60)
1589
>>> string_to_delta(u'60m')
1819
>>> string_to_delta('60m')
1590
1820
datetime.timedelta(0, 3600)
1591
>>> string_to_delta(u'24h')
1821
>>> string_to_delta('24h')
1592
1822
datetime.timedelta(1)
1593
>>> string_to_delta(u'1w')
1823
>>> string_to_delta('1w')
1594
1824
datetime.timedelta(7)
1595
>>> string_to_delta(u'5m 30s')
1825
>>> string_to_delta('5m 30s')
1596
1826
datetime.timedelta(0, 330)
1597
1827
"""
1598
1828
timevalue = datetime.timedelta(0)
1600
1830
try:
1601
1831
suffix = unicode(s[-1])
1602
1832
value = int(s[:-1])
1603
if suffix == u"d":
1833
if suffix == "d":
1604
1834
delta = datetime.timedelta(value)
1605
elif suffix == u"s":
1835
elif suffix == "s":
1606
1836
delta = datetime.timedelta(0, value)
1607
elif suffix == u"m":
1837
elif suffix == "m":
1608
1838
delta = datetime.timedelta(0, 0, 0, 0, value)
1609
elif suffix == u"h":
1839
elif suffix == "h":
1610
1840
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1611
elif suffix == u"w":
1841
elif suffix == "w":
1612
1842
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1613
1843
else:
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1615
except (ValueError, IndexError), e:
1616
raise ValueError(e.message)
1844
raise ValueError("Unknown suffix %r" % suffix)
1845
except (ValueError, IndexError) as e:
1846
raise ValueError(*(e.args))
1617
1847
timevalue += delta
1618
1848
return timevalue
1619
1849
1625
1855
global if_nametoindex
1626
1856
try:
1627
1857
if_nametoindex = (ctypes.cdll.LoadLibrary
1628
(ctypes.util.find_library(u"c"))
1858
(ctypes.util.find_library("c"))
1629
1859
.if_nametoindex)
1630
1860
except (OSError, AttributeError):
1631
logger.warning(u"Doing if_nametoindex the hard way")
1861
logger.warning("Doing if_nametoindex the hard way")
1632
1862
def if_nametoindex(interface):
1633
1863
"Get an interface index the hard way, i.e. using fcntl()"
1634
1864
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1635
1865
with contextlib.closing(socket.socket()) as s:
1636
1866
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1637
struct.pack(str(u"16s16x"),
1867
struct.pack(str("16s16x"),
1638
1868
interface))
1639
interface_index = struct.unpack(str(u"I"),
1869
interface_index = struct.unpack(str("I"),
1640
1870
ifreq[16:20])[0]
1641
1871
return interface_index
1642
1872
return if_nametoindex(interface)
1650
1880
sys.exit()
1651
1881
os.setsid()
1652
1882
if not nochdir:
1653
os.chdir(u"/")
1883
os.chdir("/")
1654
1884
if os.fork():
1655
1885
sys.exit()
1656
1886
if not noclose:
1658
1888
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1659
1889
if not stat.S_ISCHR(os.fstat(null).st_mode):
1660
1890
raise OSError(errno.ENODEV,
1661
u"%s not a character device"
1891
"%s not a character device"
1662
1892
% os.path.devnull)
1663
1893
os.dup2(null, sys.stdin.fileno())
1664
1894
os.dup2(null, sys.stdout.fileno())
1672
1902
##################################################################
1673
1903
# Parsing of options, both command line and config file
1674
1904
1675
parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
parser.add_option("-i", u"--interface", type=u"string",
1677
metavar="IF", help=u"Bind to interface IF")
1678
parser.add_option("-a", u"--address", type=u"string",
1679
help=u"Address to listen for requests on")
1680
parser.add_option("-p", u"--port", type=u"int",
1681
help=u"Port number to receive requests on")
1682
parser.add_option("--check", action=u"store_true",
1683
help=u"Run self-test")
1684
parser.add_option("--debug", action=u"store_true",
1685
help=u"Debug mode; run in foreground and log to"
1686
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
help=u"Debug level for stdout output")
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
u" priority string (see GnuTLS documentation)")
1691
parser.add_option("--servicename", type=u"string",
1692
metavar=u"NAME", help=u"Zeroconf service name")
1693
parser.add_option("--configdir", type=u"string",
1694
default=u"/etc/mandos", metavar=u"DIR",
1695
help=u"Directory to search for configuration"
1696
u" files")
1697
parser.add_option("--no-dbus", action=u"store_false",
1698
dest=u"use_dbus", help=u"Do not provide D-Bus"
1699
u" system bus interface")
1700
parser.add_option("--no-ipv6", action=u"store_false",
1701
dest=u"use_ipv6", help=u"Do not use IPv6")
1702
options = parser.parse_args()[0]
1905
parser = argparse.ArgumentParser()
1906
parser.add_argument("-v", "--version", action="version",
1907
version = "%%(prog)s %s" % version,
1908
help="show version number and exit")
1909
parser.add_argument("-i", "--interface", metavar="IF",
1910
help="Bind to interface IF")
1911
parser.add_argument("-a", "--address",
1912
help="Address to listen for requests on")
1913
parser.add_argument("-p", "--port", type=int,
1914
help="Port number to receive requests on")
1915
parser.add_argument("--check", action="store_true",
1916
help="Run self-test")
1917
parser.add_argument("--debug", action="store_true",
1918
help="Debug mode; run in foreground and log"
1919
" to terminal")
1920
parser.add_argument("--debuglevel", metavar="LEVEL",
1921
help="Debug level for stdout output")
1922
parser.add_argument("--priority", help="GnuTLS"
1923
" priority string (see GnuTLS documentation)")
1924
parser.add_argument("--servicename",
1925
metavar="NAME", help="Zeroconf service name")
1926
parser.add_argument("--configdir",
1927
default="/etc/mandos", metavar="DIR",
1928
help="Directory to search for configuration"
1929
" files")
1930
parser.add_argument("--no-dbus", action="store_false",
1931
dest="use_dbus", help="Do not provide D-Bus"
1932
" system bus interface")
1933
parser.add_argument("--no-ipv6", action="store_false",
1934
dest="use_ipv6", help="Do not use IPv6")
1935
parser.add_argument("--no-restore", action="store_false",
1936
dest="restore", help="Do not restore stored state",
1937
default=True)
1938
1939
options = parser.parse_args()
1703
1940
1704
1941
if options.check:
1705
1942
import doctest
1707
1944
sys.exit()
1708
1945
1709
1946
# Default values for config file for server-global settings
1710
server_defaults = { u"interface": u"",
1711
u"address": u"",
1712
u"port": u"",
1713
u"debug": u"False",
1714
u"priority":
1715
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
u"servicename": u"Mandos",
1717
u"use_dbus": u"True",
1718
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1947
server_defaults = { "interface": "",
1948
"address": "",
1949
"port": "",
1950
"debug": "False",
1951
"priority":
1952
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1953
"servicename": "Mandos",
1954
"use_dbus": "True",
1955
"use_ipv6": "True",
1956
"debuglevel": "",
1720
1957
}
1721
1958
1722
1959
# Parse config file for server-global settings
1723
1960
server_config = configparser.SafeConfigParser(server_defaults)
1724
1961
del server_defaults
1725
1962
server_config.read(os.path.join(options.configdir,
1726
u"mandos.conf"))
1963
"mandos.conf"))
1727
1964
# Convert the SafeConfigParser object to a dict
1728
1965
server_settings = server_config.defaults()
1729
1966
# Use the appropriate methods on the non-string config options
1730
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1731
server_settings[option] = server_config.getboolean(u"DEFAULT",
1967
for option in ("debug", "use_dbus", "use_ipv6"):
1968
server_settings[option] = server_config.getboolean("DEFAULT",
1732
1969
option)
1733
1970
if server_settings["port"]:
1734
server_settings["port"] = server_config.getint(u"DEFAULT",
1735
u"port")
1971
server_settings["port"] = server_config.getint("DEFAULT",
1972
"port")
1736
1973
del server_config
1737
1974
1738
1975
# Override the settings from the config file with command line
1739
1976
# options, if set.
1740
for option in (u"interface", u"address", u"port", u"debug",
1741
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1977
for option in ("interface", "address", "port", "debug",
1978
"priority", "servicename", "configdir",
1979
"use_dbus", "use_ipv6", "debuglevel", "restore"):
1743
1980
value = getattr(options, option)
1744
1981
if value is not None:
1745
1982
server_settings[option] = value
1753
1990
##################################################################
1754
1991
1755
1992
# For convenience
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
use_dbus = server_settings[u"use_dbus"]
1759
use_ipv6 = server_settings[u"use_ipv6"]
1760
1761
if server_settings[u"servicename"] != u"Mandos":
1993
debug = server_settings["debug"]
1994
debuglevel = server_settings["debuglevel"]
1995
use_dbus = server_settings["use_dbus"]
1996
use_ipv6 = server_settings["use_ipv6"]
1997
1998
if server_settings["servicename"] != "Mandos":
1762
1999
syslogger.setFormatter(logging.Formatter
1763
(u'Mandos (%s) [%%(process)d]:'
1764
u' %%(levelname)s: %%(message)s'
1765
% server_settings[u"servicename"]))
2000
('Mandos (%s) [%%(process)d]:'
2001
' %%(levelname)s: %%(message)s'
2002
% server_settings["servicename"]))
1766
2003
1767
2004
# Parse config file with clients
1768
client_defaults = { u"timeout": u"1h",
1769
u"interval": u"5m",
1770
u"checker": u"fping -q -- %%(host)s",
1771
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
2005
client_defaults = { "timeout": "5m",
2006
"extended_timeout": "15m",
2007
"interval": "2m",
2008
"checker": "fping -q -- %%(host)s",
2009
"host": "",
2010
"approval_delay": "0s",
2011
"approval_duration": "1s",
1774
2012
}
1775
2013
client_config = configparser.SafeConfigParser(client_defaults)
1776
client_config.read(os.path.join(server_settings[u"configdir"],
1777
u"clients.conf"))
2014
client_config.read(os.path.join(server_settings["configdir"],
2015
"clients.conf"))
1778
2016
1779
2017
global mandos_dbus_service
1780
2018
mandos_dbus_service = None
1781
2019
1782
tcp_server = MandosServer((server_settings[u"address"],
1783
server_settings[u"port"]),
2020
tcp_server = MandosServer((server_settings["address"],
2021
server_settings["port"]),
1784
2022
ClientHandler,
1785
interface=(server_settings[u"interface"]
2023
interface=(server_settings["interface"]
1786
2024
or None),
1787
2025
use_ipv6=use_ipv6,
1788
2026
gnutls_priority=
1789
server_settings[u"priority"],
2027
server_settings["priority"],
1790
2028
use_dbus=use_dbus)
1791
2029
if not debug:
1792
pidfilename = u"/var/run/mandos.pid"
2030
pidfilename = "/var/run/mandos.pid"
1793
2031
try:
1794
pidfile = open(pidfilename, u"w")
2032
pidfile = open(pidfilename, "w")
1795
2033
except IOError:
1796
logger.error(u"Could not open file %r", pidfilename)
2034
logger.error("Could not open file %r", pidfilename)
1797
2035
1798
2036
try:
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1800
gid = pwd.getpwnam(u"_mandos").pw_gid
2037
uid = pwd.getpwnam("_mandos").pw_uid
2038
gid = pwd.getpwnam("_mandos").pw_gid
1801
2039
except KeyError:
1802
2040
try:
1803
uid = pwd.getpwnam(u"mandos").pw_uid
1804
gid = pwd.getpwnam(u"mandos").pw_gid
2041
uid = pwd.getpwnam("mandos").pw_uid
2042
gid = pwd.getpwnam("mandos").pw_gid
1805
2043
except KeyError:
1806
2044
try:
1807
uid = pwd.getpwnam(u"nobody").pw_uid
1808
gid = pwd.getpwnam(u"nobody").pw_gid
2045
uid = pwd.getpwnam("nobody").pw_uid
2046
gid = pwd.getpwnam("nobody").pw_gid
1809
2047
except KeyError:
1810
2048
uid = 65534
1811
2049
gid = 65534
1812
2050
try:
1813
2051
os.setgid(gid)
1814
2052
os.setuid(uid)
1815
except OSError, error:
2053
except OSError as error:
1816
2054
if error[0] != errno.EPERM:
1817
2055
raise error
1818
2056
1819
2057
if not debug and not debuglevel:
1820
syslogger.setLevel(logging.WARNING)
1821
console.setLevel(logging.WARNING)
2058
logger.setLevel(logging.WARNING)
1822
2059
if debuglevel:
1823
2060
level = getattr(logging, debuglevel.upper())
1824
syslogger.setLevel(level)
1825
console.setLevel(level)
1826
2061
logger.setLevel(level)
2062
1827
2063
if debug:
2064
logger.setLevel(logging.DEBUG)
1828
2065
# Enable all possible GnuTLS debugging
1829
2066
1830
2067
# "Use a log level over 10 to enable all debugging options."
1833
2070
1834
2071
@gnutls.library.types.gnutls_log_func
1835
2072
def debug_gnutls(level, string):
1836
logger.debug(u"GnuTLS: %s", string[:-1])
2073
logger.debug("GnuTLS: %s", string[:-1])
1837
2074
1838
2075
(gnutls.library.functions
1839
2076
.gnutls_global_set_log_function(debug_gnutls))
1847
2084
# No console logging
1848
2085
logger.removeHandler(console)
1849
2086
2087
# Need to fork before connecting to D-Bus
2088
if not debug:
2089
# Close all input and output, do double fork, etc.
2090
daemon()
1850
2091
1851
2092
global main_loop
1852
2093
# From the Avahi example code
1856
2097
# End of Avahi example code
1857
2098
if use_dbus:
1858
2099
try:
1859
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2100
bus_name = dbus.service.BusName("se.recompile.Mandos",
1860
2101
bus, do_not_queue=True)
1861
except dbus.exceptions.NameExistsException, e:
1862
logger.error(unicode(e) + u", disabling D-Bus")
2102
old_bus_name = (dbus.service.BusName
2103
("se.bsnet.fukt.Mandos", bus,
2104
do_not_queue=True))
2105
except dbus.exceptions.NameExistsException as e:
2106
logger.error(unicode(e) + ", disabling D-Bus")
1863
2107
use_dbus = False
1864
server_settings[u"use_dbus"] = False
2108
server_settings["use_dbus"] = False
1865
2109
tcp_server.use_dbus = False
1866
2110
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1867
service = AvahiService(name = server_settings[u"servicename"],
1868
servicetype = u"_mandos._tcp",
1869
protocol = protocol, bus = bus)
2111
service = AvahiServiceToSyslog(name =
2112
server_settings["servicename"],
2113
servicetype = "_mandos._tcp",
2114
protocol = protocol, bus = bus)
1870
2115
if server_settings["interface"]:
1871
2116
service.interface = (if_nametoindex
1872
(str(server_settings[u"interface"])))
1873
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1877
2117
(str(server_settings["interface"])))
2118
1878
2119
global multiprocessing_manager
1879
2120
multiprocessing_manager = multiprocessing.Manager()
1880
2121
1881
2122
client_class = Client
1882
2123
if use_dbus:
1883
client_class = functools.partial(ClientDBus, bus = bus)
1884
def client_config_items(config, section):
1885
special_settings = {
1886
"approved_by_default":
1887
lambda: config.getboolean(section,
1888
"approved_by_default"),
1889
}
1890
for name, value in config.items(section):
2124
client_class = functools.partial(ClientDBusTransitional,
2125
bus = bus)
2126
2127
special_settings = {
2128
# Some settings need to be accessd by special methods;
2129
# booleans need .getboolean(), etc. Here is a list of them:
2130
"approved_by_default":
2131
lambda section:
2132
client_config.getboolean(section, "approved_by_default"),
2133
}
2134
# Construct a new dict of client settings of this form:
2135
# { client_name: {setting_name: value, ...}, ...}
2136
# with exceptions for any special settings as defined above
2137
client_settings = dict((clientname,
2138
dict((setting,
2139
(value if setting not in special_settings
2140
else special_settings[setting](clientname)))
2141
for setting, value in client_config.items(clientname)))
2142
for clientname in client_config.sections())
2143
2144
old_client_settings = {}
2145
clients_data = []
2146
2147
# Get client data and settings from last running state.
2148
if server_settings["restore"]:
2149
try:
2150
with open(stored_state_path, "rb") as stored_state:
2151
clients_data, old_client_settings = pickle.load(stored_state)
2152
os.remove(stored_state_path)
2153
except IOError as e:
2154
logger.warning("Could not load persistant state: {0}".format(e))
2155
if e.errno != errno.ENOENT:
2156
raise
2157
2158
for client in clients_data:
2159
client_name = client["name"]
2160
2161
# Decide which value to use after restoring saved state.
2162
# We have three different values: Old config file,
2163
# new config file, and saved state.
2164
# New config value takes precedence if it differs from old
2165
# config value, otherwise use saved state.
2166
for name, value in client_settings[client_name].items():
1891
2167
try:
1892
yield (name, special_settings[name]())
2168
# For each value in new config, check if it differs
2169
# from the old config value (Except for the "secret"
2170
# attribute)
2171
if name != "secret" and value != old_client_settings[client_name][name]:
2172
setattr(client, name, value)
1893
2173
except KeyError:
1894
yield (name, value)
2174
pass
2175
2176
# Clients who has passed its expire date, can still be enabled if its
2177
# last checker was sucessful. Clients who checkers failed before we
2178
# stored it state is asumed to had failed checker during downtime.
2179
if client["enabled"] and client["last_checked_ok"]:
2180
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2181
> client["interval"]):
2182
if client["last_checker_status"] != 0:
2183
client["enabled"] = False
2184
else:
2185
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2186
2187
client["changedstate"] = (multiprocessing_manager
2188
.Condition(multiprocessing_manager
2189
.Lock()))
2190
if use_dbus:
2191
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2192
tcp_server.clients[client_name] = new_client
2193
new_client.bus = bus
2194
for name, value in client.iteritems():
2195
setattr(new_client, name, value)
2196
client_object_name = unicode(client_name).translate(
2197
{ord("."): ord("_"),
2198
ord("-"): ord("_")})
2199
new_client.dbus_object_path = (dbus.ObjectPath
2200
("/clients/" + client_object_name))
2201
DBusObjectWithProperties.__init__(new_client,
2202
new_client.bus,
2203
new_client.dbus_object_path)
2204
else:
2205
tcp_server.clients[client_name] = Client.__new__(Client)
2206
for name, value in client.iteritems():
2207
setattr(tcp_server.clients[client_name], name, value)
2208
2209
tcp_server.clients[client_name].decrypt_secret(
2210
client_settings[client_name]["secret"])
2211
2212
# Create/remove clients based on new changes made to config
2213
for clientname in set(old_client_settings) - set(client_settings):
2214
del tcp_server.clients[clientname]
2215
for clientname in set(client_settings) - set(old_client_settings):
2216
tcp_server.clients[clientname] = (client_class(name = clientname,
2217
config =
2218
client_settings
2219
[clientname]))
1895
2220
1896
tcp_server.clients.update(set(
1897
client_class(name = section,
1898
config= dict(client_config_items(
1899
client_config, section)))
1900
for section in client_config.sections()))
2221
1901
2222
if not tcp_server.clients:
1902
logger.warning(u"No clients defined")
2223
logger.warning("No clients defined")
1903
2224
1904
2225
if not debug:
1905
2226
try:
1906
2227
with pidfile:
1907
2228
pid = os.getpid()
1908
pidfile.write(str(pid) + "\n")
2229
pidfile.write(str(pid) + "\n".encode("utf-8"))
1909
2230
del pidfile
1910
2231
except IOError:
1911
logger.error(u"Could not write to file %r with PID %d",
2232
logger.error("Could not write to file %r with PID %d",
1912
2233
pidfilename, pid)
1913
2234
except NameError:
1914
2235
# "pidfile" was never created
1916
2237
del pidfilename
1917
2238
1918
2239
signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
2240
1920
2241
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
2242
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1922
2243
1924
2245
class MandosDBusService(dbus.service.Object):
1925
2246
"""A D-Bus proxy object"""
1926
2247
def __init__(self):
1927
dbus.service.Object.__init__(self, bus, u"/")
1928
_interface = u"se.bsnet.fukt.Mandos"
2248
dbus.service.Object.__init__(self, bus, "/")
2249
_interface = "se.recompile.Mandos"
1929
2250
1930
@dbus.service.signal(_interface, signature=u"o")
2251
@dbus.service.signal(_interface, signature="o")
1931
2252
def ClientAdded(self, objpath):
1932
2253
"D-Bus signal"
1933
2254
pass
1934
2255
1935
@dbus.service.signal(_interface, signature=u"ss")
2256
@dbus.service.signal(_interface, signature="ss")
1936
2257
def ClientNotFound(self, fingerprint, address):
1937
2258
"D-Bus signal"
1938
2259
pass
1939
2260
1940
@dbus.service.signal(_interface, signature=u"os")
2261
@dbus.service.signal(_interface, signature="os")
1941
2262
def ClientRemoved(self, objpath, name):
1942
2263
"D-Bus signal"
1943
2264
pass
1944
2265
1945
@dbus.service.method(_interface, out_signature=u"ao")
2266
@dbus.service.method(_interface, out_signature="ao")
1946
2267
def GetAllClients(self):
1947
2268
"D-Bus method"
1948
2269
return dbus.Array(c.dbus_object_path
1949
for c in tcp_server.clients)
2270
for c in
2271
tcp_server.clients.itervalues())
1950
2272
1951
2273
@dbus.service.method(_interface,
1952
out_signature=u"a{oa{sv}}")
2274
out_signature="a{oa{sv}}")
1953
2275
def GetAllClientsWithProperties(self):
1954
2276
"D-Bus method"
1955
2277
return dbus.Dictionary(
1956
((c.dbus_object_path, c.GetAll(u""))
1957
for c in tcp_server.clients),
1958
signature=u"oa{sv}")
2278
((c.dbus_object_path, c.GetAll(""))
2279
for c in tcp_server.clients.itervalues()),
2280
signature="oa{sv}")
1959
2281
1960
@dbus.service.method(_interface, in_signature=u"o")
2282
@dbus.service.method(_interface, in_signature="o")
1961
2283
def RemoveClient(self, object_path):
1962
2284
"D-Bus method"
1963
for c in tcp_server.clients:
2285
for c in tcp_server.clients.itervalues():
1964
2286
if c.dbus_object_path == object_path:
1965
tcp_server.clients.remove(c)
2287
del tcp_server.clients[c.name]
1966
2288
c.remove_from_connection()
1967
2289
# Don't signal anything except ClientRemoved
1968
2290
c.disable(quiet=True)
1973
2295
1974
2296
del _interface
1975
2297
1976
mandos_dbus_service = MandosDBusService()
2298
class MandosDBusServiceTransitional(MandosDBusService):
2299
__metaclass__ = AlternateDBusNamesMetaclass
2300
mandos_dbus_service = MandosDBusServiceTransitional()
1977
2301
1978
2302
def cleanup():
1979
2303
"Cleanup function; run on exit"
1980
2304
service.cleanup()
1981
2305
2306
multiprocessing.active_children()
2307
if not (tcp_server.clients or client_settings):
2308
return
2309
2310
# Store client before exiting. Secrets are encrypted with key based
2311
# on what config file has. If config file is removed/edited, old
2312
# secret will thus be unrecovable.
2313
clients = []
2314
for client in tcp_server.clients.itervalues():
2315
client.encrypt_secret(client_settings[client.name]["secret"])
2316
2317
client_dict = {}
2318
2319
# A list of attributes that will not be stored when shuting down.
2320
exclude = set(("bus", "changedstate", "secret"))
2321
for name, typ in inspect.getmembers(dbus.service.Object):
2322
exclude.add(name)
2323
2324
client_dict["encrypted_secret"] = client.encrypted_secret
2325
for attr in client.client_structure:
2326
if attr not in exclude:
2327
client_dict[attr] = getattr(client, attr)
2328
2329
clients.append(client_dict)
2330
del client_settings[client.name]["secret"]
2331
2332
try:
2333
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2334
pickle.dump((clients, client_settings), stored_state)
2335
except IOError as e:
2336
logger.warning("Could not save persistant state: {0}".format(e))
2337
if e.errno != errno.ENOENT:
2338
raise
2339
2340
# Delete all clients, and settings from config
1982
2341
while tcp_server.clients:
1983
client = tcp_server.clients.pop()
2342
name, client = tcp_server.clients.popitem()
1984
2343
if use_dbus:
1985
2344
client.remove_from_connection()
1986
client.disable_hook = None
1987
2345
# Don't signal anything except ClientRemoved
1988
2346
client.disable(quiet=True)
1989
2347
if use_dbus:
1990
2348
# Emit D-Bus signal
1991
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2349
mandos_dbus_service.ClientRemoved(client
2350
.dbus_object_path,
1992
2351
client.name)
2352
client_settings.clear()
1993
2353
1994
2354
atexit.register(cleanup)
1995
2355
1996
for client in tcp_server.clients:
2356
for client in tcp_server.clients.itervalues():
1997
2357
if use_dbus:
1998
2358
# Emit D-Bus signal
1999
2359
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2000
client.enable()
2360
# Need to initiate checking of clients
2361
if client.enabled:
2362
client.init_checker()
2363
2001
2364
2002
2365
tcp_server.enable()
2003
2366
tcp_server.server_activate()
2005
2368
# Find out what port we got
2006
2369
service.port = tcp_server.socket.getsockname()[1]
2007
2370
if use_ipv6:
2008
logger.info(u"Now listening on address %r, port %d,"
2371
logger.info("Now listening on address %r, port %d,"
2009
2372
" flowinfo %d, scope_id %d"
2010
2373
% tcp_server.socket.getsockname())
2011
2374
else: # IPv4
2012
logger.info(u"Now listening on address %r, port %d"
2375
logger.info("Now listening on address %r, port %d"
2013
2376
% tcp_server.socket.getsockname())
2014
2377
2015
2378
#service.interface = tcp_server.socket.getsockname()[3]
2018
2381
# From the Avahi example code
2019
2382
try:
2020
2383
service.activate()
2021
except dbus.exceptions.DBusException, error:
2022
logger.critical(u"DBusException: %s", error)
2384
except dbus.exceptions.DBusException as error:
2385
logger.critical("DBusException: %s", error)
2023
2386
cleanup()
2024
2387
sys.exit(1)
2025
2388
# End of Avahi example code
2029
2392
(tcp_server.handle_request
2030
2393
(*args[2:], **kwargs) or True))
2031
2394
2032
logger.debug(u"Starting main loop")
2395
logger.debug("Starting main loop")
2033
2396
main_loop.run()
2034
except AvahiError, error:
2035
logger.critical(u"AvahiError: %s", error)
2397
except AvahiError as error:
2398
logger.critical("AvahiError: %s", error)
2036
2399
cleanup()
2037
2400
sys.exit(1)
2038
2401
except KeyboardInterrupt:
2039
2402
if debug:
2040
print >> sys.stderr
2041
logger.debug(u"Server received KeyboardInterrupt")
2042
logger.debug(u"Server exiting")
2403
print("", file=sys.stderr)
2404
logger.debug("Server received KeyboardInterrupt")
2405
logger.debug("Server exiting")
2043
2406
# Must run before the D-Bus bus name gets deregistered
2044
2407
cleanup()
2045
2408
2409
2046
2410
if __name__ == '__main__':
2047
2411
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0