To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 520
- compare with another revision
- download diff
- download tarball
- view history from revision 520
- Committer: Björn Påhlsson
- Date: 2011-11-09 17:16:03 UTC
- mfrom: (518.1.1 mandos-persistent)
- Revision ID: belorn@fukt.bsnet.se-20111109171603-srz21uoclpldp5ve
merge persistent state
- files added:
- debian/source
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
35
36
36
37
import SocketServer as socketserver
37
38
import socket
38
import optparse
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
61
62
import functools
62
63
import cPickle as pickle
63
64
import multiprocessing
65
import types
66
import hashlib
64
67
65
68
import dbus
66
69
import dbus.service
71
74
import ctypes.util
72
75
import xml.dom.minidom
73
76
import inspect
77
import Crypto.Cipher.AES
74
78
75
79
try:
76
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
85
SO_BINDTODEVICE = None
82
86
83
87
84
version = "1.2"
85
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
88
version = "1.4.1"
89
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
88
93
syslogger = (logging.handlers.SysLogHandler
89
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
address = "/dev/log"))
95
address = str("/dev/log")))
91
96
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
94
99
logger.addHandler(syslogger)
95
100
96
101
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
100
106
logger.addHandler(console)
101
107
108
102
109
class AvahiError(Exception):
103
110
def __init__(self, value, *args, **kwargs):
104
111
self.value = value
119
126
Attributes:
120
127
interface: integer; avahi.IF_UNSPEC or an interface index.
121
128
Used to optionally bind to the specified interface.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
129
name: string; Example: 'Mandos'
130
type: string; Example: '_mandos._tcp'.
124
131
See <http://www.dns-sd.org/ServiceTypes.html>
125
132
port: integer; what port to announce
126
133
TXT: list of strings; TXT record for the service
135
142
"""
136
143
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
144
servicetype = None, port = None, TXT = None,
138
domain = u"", host = u"", max_renames = 32768,
145
domain = "", host = "", max_renames = 32768,
139
146
protocol = avahi.PROTO_UNSPEC, bus = None):
140
147
self.interface = interface
141
148
self.name = name
150
157
self.group = None # our entry group
151
158
self.server = None
152
159
self.bus = bus
160
self.entry_group_state_changed_match = None
153
161
def rename(self):
154
162
"""Derived from the Avahi example code"""
155
163
if self.rename_count >= self.max_renames:
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
164
logger.critical("No suitable Zeroconf service name found"
165
" after %i retries, exiting.",
158
166
self.rename_count)
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
167
raise AvahiServiceError("Too many renames")
168
self.name = unicode(self.server
169
.GetAlternativeServiceName(self.name))
170
logger.info("Changing Zeroconf service name to %r ...",
162
171
self.name)
163
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
166
% self.name))
167
172
self.remove()
168
173
try:
169
174
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
175
except dbus.exceptions.DBusException as error:
176
logger.critical("DBusException: %s", error)
172
177
self.cleanup()
173
178
os._exit(1)
174
179
self.rename_count += 1
175
180
def remove(self):
176
181
"""Derived from the Avahi example code"""
182
if self.entry_group_state_changed_match is not None:
183
self.entry_group_state_changed_match.remove()
184
self.entry_group_state_changed_match = None
177
185
if self.group is not None:
178
186
self.group.Reset()
179
187
def add(self):
180
188
"""Derived from the Avahi example code"""
189
self.remove()
181
190
if self.group is None:
182
191
self.group = dbus.Interface(
183
192
self.bus.get_object(avahi.DBUS_NAME,
184
193
self.server.EntryGroupNew()),
185
194
avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
195
self.entry_group_state_changed_match = (
196
self.group.connect_to_signal(
197
'StateChanged', self.entry_group_state_changed))
198
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
190
199
self.name, self.type)
191
200
self.group.AddService(
192
201
self.interface,
199
208
self.group.Commit()
200
209
def entry_group_state_changed(self, state, error):
201
210
"""Derived from the Avahi example code"""
202
logger.debug(u"Avahi entry group state change: %i", state)
211
logger.debug("Avahi entry group state change: %i", state)
203
212
204
213
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
logger.debug(u"Zeroconf service established.")
214
logger.debug("Zeroconf service established.")
206
215
elif state == avahi.ENTRY_GROUP_COLLISION:
207
logger.warning(u"Zeroconf service name collision.")
216
logger.info("Zeroconf service name collision.")
208
217
self.rename()
209
218
elif state == avahi.ENTRY_GROUP_FAILURE:
210
logger.critical(u"Avahi: Error in group state changed %s",
219
logger.critical("Avahi: Error in group state changed %s",
211
220
unicode(error))
212
raise AvahiGroupError(u"State changed: %s"
221
raise AvahiGroupError("State changed: %s"
213
222
% unicode(error))
214
223
def cleanup(self):
215
224
"""Derived from the Avahi example code"""
216
225
if self.group is not None:
217
self.group.Free()
226
try:
227
self.group.Free()
228
except (dbus.exceptions.UnknownMethodException,
229
dbus.exceptions.DBusException) as e:
230
pass
218
231
self.group = None
219
def server_state_changed(self, state):
232
self.remove()
233
def server_state_changed(self, state, error=None):
220
234
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
235
logger.debug("Avahi server state change: %i", state)
236
bad_states = { avahi.SERVER_INVALID:
237
"Zeroconf server invalid",
238
avahi.SERVER_REGISTERING: None,
239
avahi.SERVER_COLLISION:
240
"Zeroconf server name collision",
241
avahi.SERVER_FAILURE:
242
"Zeroconf server failure" }
243
if state in bad_states:
244
if bad_states[state] is not None:
245
if error is None:
246
logger.error(bad_states[state])
247
else:
248
logger.error(bad_states[state] + ": %r", error)
249
self.cleanup()
225
250
elif state == avahi.SERVER_RUNNING:
226
251
self.add()
252
else:
253
if error is None:
254
logger.debug("Unknown state: %r", state)
255
else:
256
logger.debug("Unknown state: %r: %r", state, error)
227
257
def activate(self):
228
258
"""Derived from the Avahi example code"""
229
259
if self.server is None:
230
260
self.server = dbus.Interface(
231
261
self.bus.get_object(avahi.DBUS_NAME,
232
avahi.DBUS_PATH_SERVER),
262
avahi.DBUS_PATH_SERVER,
263
follow_name_owner_changes=True),
233
264
avahi.DBUS_INTERFACE_SERVER)
234
self.server.connect_to_signal(u"StateChanged",
265
self.server.connect_to_signal("StateChanged",
235
266
self.server_state_changed)
236
267
self.server_state_changed(self.server.GetState())
237
268
269
class AvahiServiceToSyslog(AvahiService):
270
def rename(self):
271
"""Add the new name to the syslog messages"""
272
ret = AvahiService.rename(self)
273
syslogger.setFormatter(logging.Formatter
274
('Mandos (%s) [%%(process)d]:'
275
' %%(levelname)s: %%(message)s'
276
% self.name))
277
return ret
238
278
279
def _timedelta_to_milliseconds(td):
280
"Convert a datetime.timedelta() to milliseconds"
281
return ((td.days * 24 * 60 * 60 * 1000)
282
+ (td.seconds * 1000)
283
+ (td.microseconds // 1000))
284
239
285
class Client(object):
240
286
"""A representation of a client host served by this server.
241
287
253
299
instance %(name)s can be used in the command.
254
300
checker_initiator_tag: a gobject event source tag, or None
255
301
created: datetime.datetime(); (UTC) object creation
302
client_structure: Object describing what attributes a client has
303
and is used for storing the client at exit
256
304
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
305
disable_initiator_tag: a gobject event source tag, or None
259
306
enabled: bool()
260
307
fingerprint: string (40 or 32 hexadecimal digits); used to
263
310
interval: datetime.timedelta(); How often to start a new checker
264
311
last_approval_request: datetime.datetime(); (UTC) or None
265
312
last_checked_ok: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit status
314
of last checker. -1 reflect crashed checker,
315
or None.
266
316
last_enabled: datetime.datetime(); (UTC)
267
317
name: string; from the config file, used in log messages and
268
318
D-Bus identifiers
269
319
secret: bytestring; sent verbatim (over TLS) to client
270
320
timeout: datetime.timedelta(); How long from last_checked_ok
271
321
until this client is disabled
322
extended_timeout: extra long timeout when password has been sent
272
323
runtime_expansions: Allowed attributes for runtime expansion.
324
expires: datetime.datetime(); time (UTC) when a client will be
325
disabled, or None
273
326
"""
274
327
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
279
280
@staticmethod
281
def _timedelta_to_milliseconds(td):
282
"Convert a datetime.timedelta() to milliseconds"
283
return ((td.days * 24 * 60 * 60 * 1000)
284
+ (td.seconds * 1000)
285
+ (td.microseconds // 1000))
328
runtime_expansions = ("approval_delay", "approval_duration",
329
"created", "enabled", "fingerprint",
330
"host", "interval", "last_checked_ok",
331
"last_enabled", "name", "timeout")
286
332
287
333
def timeout_milliseconds(self):
288
334
"Return the 'timeout' attribute in milliseconds"
289
return self._timedelta_to_milliseconds(self.timeout)
335
return _timedelta_to_milliseconds(self.timeout)
336
337
def extended_timeout_milliseconds(self):
338
"Return the 'extended_timeout' attribute in milliseconds"
339
return _timedelta_to_milliseconds(self.extended_timeout)
290
340
291
341
def interval_milliseconds(self):
292
342
"Return the 'interval' attribute in milliseconds"
293
return self._timedelta_to_milliseconds(self.interval)
294
343
return _timedelta_to_milliseconds(self.interval)
344
295
345
def approval_delay_milliseconds(self):
296
return self._timedelta_to_milliseconds(self.approval_delay)
346
return _timedelta_to_milliseconds(self.approval_delay)
297
347
298
def __init__(self, name = None, disable_hook=None, config=None):
348
def __init__(self, name = None, config=None):
299
349
"""Note: the 'checker' key in 'config' sets the
300
350
'checker_command' attribute and *not* the 'checker'
301
351
attribute."""
302
352
self.name = name
303
353
if config is None:
304
354
config = {}
305
logger.debug(u"Creating client %r", self.name)
355
logger.debug("Creating client %r", self.name)
306
356
# Uppercase and remove spaces from fingerprint for later
307
357
# comparison purposes with return value from the fingerprint()
308
358
# function
309
self.fingerprint = (config[u"fingerprint"].upper()
310
.replace(u" ", u""))
311
logger.debug(u" Fingerprint: %s", self.fingerprint)
312
if u"secret" in config:
313
self.secret = config[u"secret"].decode(u"base64")
314
elif u"secfile" in config:
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
361
logger.debug(" Fingerprint: %s", self.fingerprint)
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
315
365
with open(os.path.expanduser(os.path.expandvars
316
(config[u"secfile"])),
366
(config["secfile"])),
317
367
"rb") as secfile:
318
368
self.secret = secfile.read()
319
369
else:
320
raise TypeError(u"No secret or secfile for client %s"
370
raise TypeError("No secret or secfile for client %s"
321
371
% self.name)
322
self.host = config.get(u"host", u"")
372
self.host = config.get("host", "")
323
373
self.created = datetime.datetime.utcnow()
324
self.enabled = False
374
self.enabled = True
325
375
self.last_approval_request = None
326
self.last_enabled = None
376
self.last_enabled = datetime.datetime.utcnow()
327
377
self.last_checked_ok = None
328
self.timeout = string_to_delta(config[u"timeout"])
329
self.interval = string_to_delta(config[u"interval"])
330
self.disable_hook = disable_hook
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
331
383
self.checker = None
332
384
self.checker_initiator_tag = None
333
385
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
334
387
self.checker_callback_tag = None
335
self.checker_command = config[u"checker"]
388
self.checker_command = config["checker"]
336
389
self.current_checker_command = None
337
self.last_connect = None
338
390
self._approved = None
339
self.approved_by_default = config.get(u"approved_by_default",
391
self.approved_by_default = config.get("approved_by_default",
340
392
True)
341
393
self.approvals_pending = 0
342
394
self.approval_delay = string_to_delta(
343
config[u"approval_delay"])
395
config["approval_delay"])
344
396
self.approval_duration = string_to_delta(
345
config[u"approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
397
config["approval_duration"])
398
self.changedstate = (multiprocessing_manager
399
.Condition(multiprocessing_manager
400
.Lock()))
401
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
402
self.client_structure.append("client_structure")
403
404
405
for name, t in inspect.getmembers(type(self),
406
lambda obj: isinstance(obj, property)):
407
if not name.startswith("_"):
408
self.client_structure.append(name)
347
409
410
# Send notice to process children that client state has changed
348
411
def send_changedstate(self):
349
self.changedstate.acquire()
350
self.changedstate.notify_all()
351
self.changedstate.release()
352
412
with self.changedstate:
413
self.changedstate.notify_all()
414
353
415
def enable(self):
354
416
"""Start this client's checker and timeout hooks"""
355
if getattr(self, u"enabled", False):
417
if getattr(self, "enabled", False):
356
418
# Already enabled
357
419
return
358
420
self.send_changedstate()
421
self.expires = datetime.datetime.utcnow() + self.timeout
422
self.enabled = True
359
423
self.last_enabled = datetime.datetime.utcnow()
360
# Schedule a new checker to be started an 'interval' from now,
361
# and every interval from then on.
362
self.checker_initiator_tag = (gobject.timeout_add
363
(self.interval_milliseconds(),
364
self.start_checker))
365
# Schedule a disable() when 'timeout' has passed
366
self.disable_initiator_tag = (gobject.timeout_add
367
(self.timeout_milliseconds(),
368
self.disable))
369
self.enabled = True
370
# Also start a new checker *right now*.
371
self.start_checker()
424
self.init_checker()
372
425
373
426
def disable(self, quiet=True):
374
427
"""Disable this client."""
377
430
if not quiet:
378
431
self.send_changedstate()
379
432
if not quiet:
380
logger.info(u"Disabling client %s", self.name)
381
if getattr(self, u"disable_initiator_tag", False):
433
logger.info("Disabling client %s", self.name)
434
if getattr(self, "disable_initiator_tag", False):
382
435
gobject.source_remove(self.disable_initiator_tag)
383
436
self.disable_initiator_tag = None
384
if getattr(self, u"checker_initiator_tag", False):
437
self.expires = None
438
if getattr(self, "checker_initiator_tag", False):
385
439
gobject.source_remove(self.checker_initiator_tag)
386
440
self.checker_initiator_tag = None
387
441
self.stop_checker()
388
if self.disable_hook:
389
self.disable_hook(self)
390
442
self.enabled = False
391
443
# Do not run this again if called by a gobject.timeout_add
392
444
return False
393
445
394
446
def __del__(self):
395
self.disable_hook = None
396
447
self.disable()
397
448
449
def init_checker(self):
450
# Schedule a new checker to be started an 'interval' from now,
451
# and every interval from then on.
452
self.checker_initiator_tag = (gobject.timeout_add
453
(self.interval_milliseconds(),
454
self.start_checker))
455
# Schedule a disable() when 'timeout' has passed
456
self.disable_initiator_tag = (gobject.timeout_add
457
(self.timeout_milliseconds(),
458
self.disable))
459
# Also start a new checker *right now*.
460
self.start_checker()
461
462
398
463
def checker_callback(self, pid, condition, command):
399
464
"""The checker has completed, so take appropriate actions."""
400
465
self.checker_callback_tag = None
401
466
self.checker = None
402
467
if os.WIFEXITED(condition):
403
exitstatus = os.WEXITSTATUS(condition)
404
if exitstatus == 0:
405
logger.info(u"Checker for %(name)s succeeded",
468
self.last_checker_status = os.WEXITSTATUS(condition)
469
if self.last_checker_status == 0:
470
logger.info("Checker for %(name)s succeeded",
406
471
vars(self))
407
472
self.checked_ok()
408
473
else:
409
logger.info(u"Checker for %(name)s failed",
474
logger.info("Checker for %(name)s failed",
410
475
vars(self))
411
476
else:
412
logger.warning(u"Checker for %(name)s crashed?",
477
self.last_checker_status = -1
478
logger.warning("Checker for %(name)s crashed?",
413
479
vars(self))
414
480
415
def checked_ok(self):
481
def checked_ok(self, timeout=None):
416
482
"""Bump up the timeout for this client.
417
483
418
484
This should only be called when the client has been seen,
419
485
alive and well.
420
486
"""
487
if timeout is None:
488
timeout = self.timeout
421
489
self.last_checked_ok = datetime.datetime.utcnow()
422
gobject.source_remove(self.disable_initiator_tag)
423
self.disable_initiator_tag = (gobject.timeout_add
424
(self.timeout_milliseconds(),
425
self.disable))
490
if self.disable_initiator_tag is not None:
491
gobject.source_remove(self.disable_initiator_tag)
492
if getattr(self, "enabled", False):
493
self.disable_initiator_tag = (gobject.timeout_add
494
(_timedelta_to_milliseconds
495
(timeout), self.disable))
496
self.expires = datetime.datetime.utcnow() + timeout
426
497
427
498
def need_approval(self):
428
499
self.last_approval_request = datetime.datetime.utcnow()
444
515
# If a checker exists, make sure it is not a zombie
445
516
try:
446
517
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
447
except (AttributeError, OSError), error:
518
except (AttributeError, OSError) as error:
448
519
if (isinstance(error, OSError)
449
520
and error.errno != errno.ECHILD):
450
521
raise error
451
522
else:
452
523
if pid:
453
logger.warning(u"Checker was a zombie")
524
logger.warning("Checker was a zombie")
454
525
gobject.source_remove(self.checker_callback_tag)
455
526
self.checker_callback(pid, status,
456
527
self.current_checker_command)
463
534
# Escape attributes for the shell
464
535
escaped_attrs = dict(
465
536
(attr,
466
re.escape(unicode(str(getattr(self, attr, u"")),
537
re.escape(unicode(str(getattr(self, attr, "")),
467
538
errors=
468
u'replace')))
539
'replace')))
469
540
for attr in
470
541
self.runtime_expansions)
471
542
472
543
try:
473
544
command = self.checker_command % escaped_attrs
474
except TypeError, error:
475
logger.error(u'Could not format string "%s":'
476
u' %s', self.checker_command, error)
545
except TypeError as error:
546
logger.error('Could not format string "%s":'
547
' %s', self.checker_command, error)
477
548
return True # Try again later
478
549
self.current_checker_command = command
479
550
try:
480
logger.info(u"Starting checker %r for %s",
551
logger.info("Starting checker %r for %s",
481
552
command, self.name)
482
553
# We don't need to redirect stdout and stderr, since
483
554
# in normal mode, that is already done by daemon(),
485
556
# always replaced by /dev/null.)
486
557
self.checker = subprocess.Popen(command,
487
558
close_fds=True,
488
shell=True, cwd=u"/")
559
shell=True, cwd="/")
489
560
self.checker_callback_tag = (gobject.child_watch_add
490
561
(self.checker.pid,
491
562
self.checker_callback,
496
567
if pid:
497
568
gobject.source_remove(self.checker_callback_tag)
498
569
self.checker_callback(pid, status, command)
499
except OSError, error:
500
logger.error(u"Failed to start subprocess: %s",
570
except OSError as error:
571
logger.error("Failed to start subprocess: %s",
501
572
error)
502
573
# Re-run this periodically if run by gobject.timeout_add
503
574
return True
507
578
if self.checker_callback_tag:
508
579
gobject.source_remove(self.checker_callback_tag)
509
580
self.checker_callback_tag = None
510
if getattr(self, u"checker", None) is None:
581
if getattr(self, "checker", None) is None:
511
582
return
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
583
logger.debug("Stopping checker for %(name)s", vars(self))
513
584
try:
514
585
os.kill(self.checker.pid, signal.SIGTERM)
515
586
#time.sleep(0.5)
516
587
#if self.checker.poll() is None:
517
588
# os.kill(self.checker.pid, signal.SIGKILL)
518
except OSError, error:
589
except OSError as error:
519
590
if error.errno != errno.ESRCH: # No such process
520
591
raise
521
592
self.checker = None
522
593
523
def dbus_service_property(dbus_interface, signature=u"v",
524
access=u"readwrite", byte_arrays=False):
594
# Encrypts a client secret and stores it in a varible encrypted_secret
595
def encrypt_secret(self, key):
596
# Encryption-key need to be of a specific size, so we hash inputed key
597
hasheng = hashlib.sha256()
598
hasheng.update(key)
599
encryptionkey = hasheng.digest()
600
601
# Create validation hash so we know at decryption if it was sucessful
602
hasheng = hashlib.sha256()
603
hasheng.update(self.secret)
604
validationhash = hasheng.digest()
605
606
# Encrypt secret
607
iv = os.urandom(Crypto.Cipher.AES.block_size)
608
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
Crypto.Cipher.AES.MODE_CFB, iv)
610
ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
self.encrypted_secret = (ciphertext, iv)
612
613
# Decrypt a encrypted client secret
614
def decrypt_secret(self, key):
615
# Decryption-key need to be of a specific size, so we hash inputed key
616
hasheng = hashlib.sha256()
617
hasheng.update(key)
618
encryptionkey = hasheng.digest()
619
620
# Decrypt encrypted secret
621
ciphertext, iv = self.encrypted_secret
622
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
Crypto.Cipher.AES.MODE_CFB, iv)
624
plain = ciphereng.decrypt(ciphertext)
625
626
# Validate decrypted secret to know if it was succesful
627
hasheng = hashlib.sha256()
628
validationhash = plain[:hasheng.digest_size]
629
secret = plain[hasheng.digest_size:]
630
hasheng.update(secret)
631
632
# if validation fails, we use key as new secret. Otherwhise, we use
633
# the decrypted secret
634
if hasheng.digest() == validationhash:
635
self.secret = secret
636
else:
637
self.secret = key
638
del self.encrypted_secret
639
640
641
def dbus_service_property(dbus_interface, signature="v",
642
access="readwrite", byte_arrays=False):
525
643
"""Decorators for marking methods of a DBusObjectWithProperties to
526
644
become properties on the D-Bus.
527
645
534
652
"""
535
653
# Encoding deeply encoded byte arrays is not supported yet by the
536
654
# "Set" method, so we fail early here:
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
655
if byte_arrays and signature != "ay":
656
raise ValueError("Byte arrays not supported for non-'ay'"
657
" signature %r" % signature)
540
658
def decorator(func):
541
659
func._dbus_is_property = True
542
660
func._dbus_interface = dbus_interface
543
661
func._dbus_signature = signature
544
662
func._dbus_access = access
545
663
func._dbus_name = func.__name__
546
if func._dbus_name.endswith(u"_dbus_property"):
664
if func._dbus_name.endswith("_dbus_property"):
547
665
func._dbus_name = func._dbus_name[:-14]
548
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
666
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
549
667
return func
550
668
return decorator
551
669
571
689
572
690
class DBusObjectWithProperties(dbus.service.Object):
573
691
"""A D-Bus object with properties.
574
692
575
693
Classes inheriting from this can use the dbus_service_property
576
694
decorator to expose methods as D-Bus properties. It exposes the
577
695
standard Get(), Set(), and GetAll() methods on the D-Bus.
579
697
580
698
@staticmethod
581
699
def _is_dbus_property(obj):
582
return getattr(obj, u"_dbus_is_property", False)
700
return getattr(obj, "_dbus_is_property", False)
583
701
584
702
def _get_all_dbus_properties(self):
585
703
"""Returns a generator of (name, attribute) pairs
586
704
"""
587
return ((prop._dbus_name, prop)
705
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
706
for cls in self.__class__.__mro__
588
707
for name, prop in
589
inspect.getmembers(self, self._is_dbus_property))
708
inspect.getmembers(cls, self._is_dbus_property))
590
709
591
710
def _get_dbus_property(self, interface_name, property_name):
592
711
"""Returns a bound method if one exists which is a D-Bus
593
712
property with the specified name and interface.
594
713
"""
595
for name in (property_name,
596
property_name + u"_dbus_property"):
597
prop = getattr(self, name, None)
598
if (prop is None
599
or not self._is_dbus_property(prop)
600
or prop._dbus_name != property_name
601
or (interface_name and prop._dbus_interface
602
and interface_name != prop._dbus_interface)):
603
continue
604
return prop
714
for cls in self.__class__.__mro__:
715
for name, value in (inspect.getmembers
716
(cls, self._is_dbus_property)):
717
if (value._dbus_name == property_name
718
and value._dbus_interface == interface_name):
719
return value.__get__(self)
720
605
721
# No such property
606
raise DBusPropertyNotFound(self.dbus_object_path + u":"
607
+ interface_name + u"."
722
raise DBusPropertyNotFound(self.dbus_object_path + ":"
723
+ interface_name + "."
608
724
+ property_name)
609
725
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
611
out_signature=u"v")
726
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
727
out_signature="v")
612
728
def Get(self, interface_name, property_name):
613
729
"""Standard D-Bus property Get() method, see D-Bus standard.
614
730
"""
615
731
prop = self._get_dbus_property(interface_name, property_name)
616
if prop._dbus_access == u"write":
732
if prop._dbus_access == "write":
617
733
raise DBusPropertyAccessException(property_name)
618
734
value = prop()
619
if not hasattr(value, u"variant_level"):
735
if not hasattr(value, "variant_level"):
620
736
return value
621
737
return type(value)(value, variant_level=value.variant_level+1)
622
738
623
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
739
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
624
740
def Set(self, interface_name, property_name, value):
625
741
"""Standard D-Bus property Set() method, see D-Bus standard.
626
742
"""
627
743
prop = self._get_dbus_property(interface_name, property_name)
628
if prop._dbus_access == u"read":
744
if prop._dbus_access == "read":
629
745
raise DBusPropertyAccessException(property_name)
630
if prop._dbus_get_args_options[u"byte_arrays"]:
746
if prop._dbus_get_args_options["byte_arrays"]:
631
747
# The byte_arrays option is not supported yet on
632
748
# signatures other than "ay".
633
if prop._dbus_signature != u"ay":
749
if prop._dbus_signature != "ay":
634
750
raise ValueError
635
751
value = dbus.ByteArray(''.join(unichr(byte)
636
752
for byte in value))
637
753
prop(value)
638
754
639
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
640
out_signature=u"a{sv}")
755
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
756
out_signature="a{sv}")
641
757
def GetAll(self, interface_name):
642
758
"""Standard D-Bus property GetAll() method, see D-Bus
643
759
standard.
644
760
645
761
Note: Will not include properties with access="write".
646
762
"""
647
763
all = {}
651
767
# Interface non-empty but did not match
652
768
continue
653
769
# Ignore write-only properties
654
if prop._dbus_access == u"write":
770
if prop._dbus_access == "write":
655
771
continue
656
772
value = prop()
657
if not hasattr(value, u"variant_level"):
773
if not hasattr(value, "variant_level"):
658
774
all[name] = value
659
775
continue
660
776
all[name] = type(value)(value, variant_level=
661
777
value.variant_level+1)
662
return dbus.Dictionary(all, signature=u"sv")
778
return dbus.Dictionary(all, signature="sv")
663
779
664
780
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
665
out_signature=u"s",
781
out_signature="s",
666
782
path_keyword='object_path',
667
783
connection_keyword='connection')
668
784
def Introspect(self, object_path, connection):
673
789
try:
674
790
document = xml.dom.minidom.parseString(xmlstring)
675
791
def make_tag(document, name, prop):
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
792
e = document.createElement("property")
793
e.setAttribute("name", name)
794
e.setAttribute("type", prop._dbus_signature)
795
e.setAttribute("access", prop._dbus_access)
680
796
return e
681
for if_tag in document.getElementsByTagName(u"interface"):
797
for if_tag in document.getElementsByTagName("interface"):
682
798
for tag in (make_tag(document, name, prop)
683
799
for name, prop
684
800
in self._get_all_dbus_properties()
685
801
if prop._dbus_interface
686
== if_tag.getAttribute(u"name")):
802
== if_tag.getAttribute("name")):
687
803
if_tag.appendChild(tag)
688
804
# Add the names to the return values for the
689
805
# "org.freedesktop.DBus.Properties" methods
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
701
== u"out"):
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
806
if (if_tag.getAttribute("name")
807
== "org.freedesktop.DBus.Properties"):
808
for cn in if_tag.getElementsByTagName("method"):
809
if cn.getAttribute("name") == "Get":
810
for arg in cn.getElementsByTagName("arg"):
811
if (arg.getAttribute("direction")
812
== "out"):
813
arg.setAttribute("name", "value")
814
elif cn.getAttribute("name") == "GetAll":
815
for arg in cn.getElementsByTagName("arg"):
816
if (arg.getAttribute("direction")
817
== "out"):
818
arg.setAttribute("name", "props")
819
xmlstring = document.toxml("utf-8")
704
820
document.unlink()
705
821
except (AttributeError, xml.dom.DOMException,
706
xml.parsers.expat.ExpatError), error:
707
logger.error(u"Failed to override Introspection method",
822
xml.parsers.expat.ExpatError) as error:
823
logger.error("Failed to override Introspection method",
708
824
error)
709
825
return xmlstring
710
826
711
827
828
def datetime_to_dbus (dt, variant_level=0):
829
"""Convert a UTC datetime.datetime() to a D-Bus type."""
830
if dt is None:
831
return dbus.String("", variant_level = variant_level)
832
return dbus.String(dt.isoformat(),
833
variant_level=variant_level)
834
835
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
836
.__metaclass__):
837
"""Applied to an empty subclass of a D-Bus object, this metaclass
838
will add additional D-Bus attributes matching a certain pattern.
839
"""
840
def __new__(mcs, name, bases, attr):
841
# Go through all the base classes which could have D-Bus
842
# methods, signals, or properties in them
843
for base in (b for b in bases
844
if issubclass(b, dbus.service.Object)):
845
# Go though all attributes of the base class
846
for attrname, attribute in inspect.getmembers(base):
847
# Ignore non-D-Bus attributes, and D-Bus attributes
848
# with the wrong interface name
849
if (not hasattr(attribute, "_dbus_interface")
850
or not attribute._dbus_interface
851
.startswith("se.recompile.Mandos")):
852
continue
853
# Create an alternate D-Bus interface name based on
854
# the current name
855
alt_interface = (attribute._dbus_interface
856
.replace("se.recompile.Mandos",
857
"se.bsnet.fukt.Mandos"))
858
# Is this a D-Bus signal?
859
if getattr(attribute, "_dbus_is_signal", False):
860
# Extract the original non-method function by
861
# black magic
862
nonmethod_func = (dict(
863
zip(attribute.func_code.co_freevars,
864
attribute.__closure__))["func"]
865
.cell_contents)
866
# Create a new, but exactly alike, function
867
# object, and decorate it to be a new D-Bus signal
868
# with the alternate D-Bus interface name
869
new_function = (dbus.service.signal
870
(alt_interface,
871
attribute._dbus_signature)
872
(types.FunctionType(
873
nonmethod_func.func_code,
874
nonmethod_func.func_globals,
875
nonmethod_func.func_name,
876
nonmethod_func.func_defaults,
877
nonmethod_func.func_closure)))
878
# Define a creator of a function to call both the
879
# old and new functions, so both the old and new
880
# signals gets sent when the function is called
881
def fixscope(func1, func2):
882
"""This function is a scope container to pass
883
func1 and func2 to the "call_both" function
884
outside of its arguments"""
885
def call_both(*args, **kwargs):
886
"""This function will emit two D-Bus
887
signals by calling func1 and func2"""
888
func1(*args, **kwargs)
889
func2(*args, **kwargs)
890
return call_both
891
# Create the "call_both" function and add it to
892
# the class
893
attr[attrname] = fixscope(attribute,
894
new_function)
895
# Is this a D-Bus method?
896
elif getattr(attribute, "_dbus_is_method", False):
897
# Create a new, but exactly alike, function
898
# object. Decorate it to be a new D-Bus method
899
# with the alternate D-Bus interface name. Add it
900
# to the class.
901
attr[attrname] = (dbus.service.method
902
(alt_interface,
903
attribute._dbus_in_signature,
904
attribute._dbus_out_signature)
905
(types.FunctionType
906
(attribute.func_code,
907
attribute.func_globals,
908
attribute.func_name,
909
attribute.func_defaults,
910
attribute.func_closure)))
911
# Is this a D-Bus property?
912
elif getattr(attribute, "_dbus_is_property", False):
913
# Create a new, but exactly alike, function
914
# object, and decorate it to be a new D-Bus
915
# property with the alternate D-Bus interface
916
# name. Add it to the class.
917
attr[attrname] = (dbus_service_property
918
(alt_interface,
919
attribute._dbus_signature,
920
attribute._dbus_access,
921
attribute
922
._dbus_get_args_options
923
["byte_arrays"])
924
(types.FunctionType
925
(attribute.func_code,
926
attribute.func_globals,
927
attribute.func_name,
928
attribute.func_defaults,
929
attribute.func_closure)))
930
return type.__new__(mcs, name, bases, attr)
931
712
932
class ClientDBus(Client, DBusObjectWithProperties):
713
933
"""A Client class using D-Bus
714
934
718
938
"""
719
939
720
940
runtime_expansions = (Client.runtime_expansions
721
+ (u"dbus_object_path",))
941
+ ("dbus_object_path",))
722
942
723
943
# dbus.service.Object doesn't use super(), so we can't either.
724
944
725
945
def __init__(self, bus = None, *args, **kwargs):
946
self.bus = bus
947
Client.__init__(self, *args, **kwargs)
948
726
949
self._approvals_pending = 0
727
self.bus = bus
728
Client.__init__(self, *args, **kwargs)
729
950
# Only now, when this client is initialized, can it show up on
730
951
# the D-Bus
731
952
client_object_name = unicode(self.name).translate(
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
953
{ord("."): ord("_"),
954
ord("-"): ord("_")})
734
955
self.dbus_object_path = (dbus.ObjectPath
735
(u"/clients/" + client_object_name))
956
("/clients/" + client_object_name))
736
957
DBusObjectWithProperties.__init__(self, self.bus,
737
958
self.dbus_object_path)
738
959
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
744
bval = bool(value)
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
dbus_bool)
960
def notifychangeproperty(transform_func,
961
dbus_name, type_func=lambda x: x,
962
variant_level=1):
963
""" Modify a variable so that it's a property which announces
964
its changes to DBus.
750
965
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
754
755
@staticmethod
756
def _datetime_to_dbus(dt, variant_level=0):
757
"""Convert a UTC datetime.datetime() to a D-Bus type."""
758
return dbus.String(dt.isoformat(),
759
variant_level=variant_level)
760
761
def enable(self):
762
oldstate = getattr(self, u"enabled", False)
763
r = Client.enable(self)
764
if oldstate != self.enabled:
765
# Emit D-Bus signals
766
self.PropertyChanged(dbus.String(u"Enabled"),
767
dbus.Boolean(True, variant_level=1))
768
self.PropertyChanged(
769
dbus.String(u"LastEnabled"),
770
self._datetime_to_dbus(self.last_enabled,
771
variant_level=1))
772
return r
773
774
def disable(self, quiet = False):
775
oldstate = getattr(self, u"enabled", False)
776
r = Client.disable(self, quiet=quiet)
777
if not quiet and oldstate != self.enabled:
778
# Emit D-Bus signal
779
self.PropertyChanged(dbus.String(u"Enabled"),
780
dbus.Boolean(False, variant_level=1))
781
return r
966
transform_fun: Function that takes a value and a variant_level
967
and transforms it to a D-Bus type.
968
dbus_name: D-Bus name of the variable
969
type_func: Function that transform the value before sending it
970
to the D-Bus. Default: no transform
971
variant_level: D-Bus variant level. Default: 1
972
"""
973
attrname = "_{0}".format(dbus_name)
974
def setter(self, value):
975
if hasattr(self, "dbus_object_path"):
976
if (not hasattr(self, attrname) or
977
type_func(getattr(self, attrname, None))
978
!= type_func(value)):
979
dbus_value = transform_func(type_func(value),
980
variant_level
981
=variant_level)
982
self.PropertyChanged(dbus.String(dbus_name),
983
dbus_value)
984
setattr(self, attrname, value)
985
986
return property(lambda self: getattr(self, attrname), setter)
987
988
989
expires = notifychangeproperty(datetime_to_dbus, "Expires")
990
approvals_pending = notifychangeproperty(dbus.Boolean,
991
"ApprovalPending",
992
type_func = bool)
993
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
994
last_enabled = notifychangeproperty(datetime_to_dbus,
995
"LastEnabled")
996
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
997
type_func = lambda checker:
998
checker is not None)
999
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1000
"LastCheckedOK")
1001
last_approval_request = notifychangeproperty(
1002
datetime_to_dbus, "LastApprovalRequest")
1003
approved_by_default = notifychangeproperty(dbus.Boolean,
1004
"ApprovedByDefault")
1005
approval_delay = notifychangeproperty(dbus.UInt16,
1006
"ApprovalDelay",
1007
type_func =
1008
_timedelta_to_milliseconds)
1009
approval_duration = notifychangeproperty(
1010
dbus.UInt16, "ApprovalDuration",
1011
type_func = _timedelta_to_milliseconds)
1012
host = notifychangeproperty(dbus.String, "Host")
1013
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1014
type_func =
1015
_timedelta_to_milliseconds)
1016
extended_timeout = notifychangeproperty(
1017
dbus.UInt16, "ExtendedTimeout",
1018
type_func = _timedelta_to_milliseconds)
1019
interval = notifychangeproperty(dbus.UInt16,
1020
"Interval",
1021
type_func =
1022
_timedelta_to_milliseconds)
1023
checker_command = notifychangeproperty(dbus.String, "Checker")
1024
1025
del notifychangeproperty
782
1026
783
1027
def __del__(self, *args, **kwargs):
784
1028
try:
785
1029
self.remove_from_connection()
786
1030
except LookupError:
787
1031
pass
788
if hasattr(DBusObjectWithProperties, u"__del__"):
1032
if hasattr(DBusObjectWithProperties, "__del__"):
789
1033
DBusObjectWithProperties.__del__(self, *args, **kwargs)
790
1034
Client.__del__(self, *args, **kwargs)
791
1035
793
1037
*args, **kwargs):
794
1038
self.checker_callback_tag = None
795
1039
self.checker = None
796
# Emit D-Bus signal
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
798
dbus.Boolean(False, variant_level=1))
799
1040
if os.WIFEXITED(condition):
800
1041
exitstatus = os.WEXITSTATUS(condition)
801
1042
# Emit D-Bus signal
811
1052
return Client.checker_callback(self, pid, condition, command,
812
1053
*args, **kwargs)
813
1054
814
def checked_ok(self, *args, **kwargs):
815
r = Client.checked_ok(self, *args, **kwargs)
816
# Emit D-Bus signal
817
self.PropertyChanged(
818
dbus.String(u"LastCheckedOK"),
819
(self._datetime_to_dbus(self.last_checked_ok,
820
variant_level=1)))
821
return r
822
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
825
# Emit D-Bus signal
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
829
variant_level=1)))
830
return r
831
832
1055
def start_checker(self, *args, **kwargs):
833
1056
old_checker = self.checker
834
1057
if self.checker is not None:
841
1064
and old_checker_pid != self.checker.pid):
842
1065
# Emit D-Bus signal
843
1066
self.CheckerStarted(self.current_checker_command)
844
self.PropertyChanged(
845
dbus.String(u"CheckerRunning"),
846
dbus.Boolean(True, variant_level=1))
847
1067
return r
848
1068
849
def stop_checker(self, *args, **kwargs):
850
old_checker = getattr(self, u"checker", None)
851
r = Client.stop_checker(self, *args, **kwargs)
852
if (old_checker is not None
853
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
855
dbus.Boolean(False, variant_level=1))
856
return r
857
858
1069
def _reset_approved(self):
859
1070
self._approved = None
860
1071
return False
862
1073
def approve(self, value=True):
863
1074
self.send_changedstate()
864
1075
self._approved = value
865
gobject.timeout_add(self._timedelta_to_milliseconds
1076
gobject.timeout_add(_timedelta_to_milliseconds
866
1077
(self.approval_duration),
867
1078
self._reset_approved)
868
1079
869
1080
870
1081
## D-Bus methods, signals & properties
871
_interface = u"se.bsnet.fukt.Mandos.Client"
1082
_interface = "se.recompile.Mandos.Client"
872
1083
873
1084
## Signals
874
1085
875
1086
# CheckerCompleted - signal
876
@dbus.service.signal(_interface, signature=u"nxs")
1087
@dbus.service.signal(_interface, signature="nxs")
877
1088
def CheckerCompleted(self, exitcode, waitstatus, command):
878
1089
"D-Bus signal"
879
1090
pass
880
1091
881
1092
# CheckerStarted - signal
882
@dbus.service.signal(_interface, signature=u"s")
1093
@dbus.service.signal(_interface, signature="s")
883
1094
def CheckerStarted(self, command):
884
1095
"D-Bus signal"
885
1096
pass
886
1097
887
1098
# PropertyChanged - signal
888
@dbus.service.signal(_interface, signature=u"sv")
1099
@dbus.service.signal(_interface, signature="sv")
889
1100
def PropertyChanged(self, property, value):
890
1101
"D-Bus signal"
891
1102
pass
900
1111
pass
901
1112
902
1113
# Rejected - signal
903
@dbus.service.signal(_interface, signature=u"s")
1114
@dbus.service.signal(_interface, signature="s")
904
1115
def Rejected(self, reason):
905
1116
"D-Bus signal"
906
1117
pass
907
1118
908
1119
# NeedApproval - signal
909
@dbus.service.signal(_interface, signature=u"tb")
1120
@dbus.service.signal(_interface, signature="tb")
910
1121
def NeedApproval(self, timeout, default):
911
1122
"D-Bus signal"
912
1123
return self.need_approval()
914
1125
## Methods
915
1126
916
1127
# Approve - method
917
@dbus.service.method(_interface, in_signature=u"b")
1128
@dbus.service.method(_interface, in_signature="b")
918
1129
def Approve(self, value):
919
1130
self.approve(value)
920
1131
921
1132
# CheckedOK - method
922
1133
@dbus.service.method(_interface)
923
1134
def CheckedOK(self):
924
return self.checked_ok()
1135
self.checked_ok()
925
1136
926
1137
# Enable - method
927
1138
@dbus.service.method(_interface)
949
1160
## Properties
950
1161
951
1162
# ApprovalPending - property
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
1163
@dbus_service_property(_interface, signature="b", access="read")
953
1164
def ApprovalPending_dbus_property(self):
954
1165
return dbus.Boolean(bool(self.approvals_pending))
955
1166
956
1167
# ApprovedByDefault - property
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
1168
@dbus_service_property(_interface, signature="b",
1169
access="readwrite")
959
1170
def ApprovedByDefault_dbus_property(self, value=None):
960
1171
if value is None: # get
961
1172
return dbus.Boolean(self.approved_by_default)
962
1173
self.approved_by_default = bool(value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
966
1174
967
1175
# ApprovalDelay - property
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
1176
@dbus_service_property(_interface, signature="t",
1177
access="readwrite")
970
1178
def ApprovalDelay_dbus_property(self, value=None):
971
1179
if value is None: # get
972
1180
return dbus.UInt64(self.approval_delay_milliseconds())
973
1181
self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
# Emit D-Bus signal
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
977
1182
978
1183
# ApprovalDuration - property
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
1184
@dbus_service_property(_interface, signature="t",
1185
access="readwrite")
981
1186
def ApprovalDuration_dbus_property(self, value=None):
982
1187
if value is None: # get
983
return dbus.UInt64(self._timedelta_to_milliseconds(
1188
return dbus.UInt64(_timedelta_to_milliseconds(
984
1189
self.approval_duration))
985
1190
self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
# Emit D-Bus signal
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
989
1191
990
1192
# Name - property
991
@dbus_service_property(_interface, signature=u"s", access=u"read")
1193
@dbus_service_property(_interface, signature="s", access="read")
992
1194
def Name_dbus_property(self):
993
1195
return dbus.String(self.name)
994
1196
995
1197
# Fingerprint - property
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
1198
@dbus_service_property(_interface, signature="s", access="read")
997
1199
def Fingerprint_dbus_property(self):
998
1200
return dbus.String(self.fingerprint)
999
1201
1000
1202
# Host - property
1001
@dbus_service_property(_interface, signature=u"s",
1002
access=u"readwrite")
1203
@dbus_service_property(_interface, signature="s",
1204
access="readwrite")
1003
1205
def Host_dbus_property(self, value=None):
1004
1206
if value is None: # get
1005
1207
return dbus.String(self.host)
1006
1208
self.host = value
1007
# Emit D-Bus signal
1008
self.PropertyChanged(dbus.String(u"Host"),
1009
dbus.String(value, variant_level=1))
1010
1209
1011
1210
# Created - property
1012
@dbus_service_property(_interface, signature=u"s", access=u"read")
1211
@dbus_service_property(_interface, signature="s", access="read")
1013
1212
def Created_dbus_property(self):
1014
return dbus.String(self._datetime_to_dbus(self.created))
1213
return dbus.String(datetime_to_dbus(self.created))
1015
1214
1016
1215
# LastEnabled - property
1017
@dbus_service_property(_interface, signature=u"s", access=u"read")
1216
@dbus_service_property(_interface, signature="s", access="read")
1018
1217
def LastEnabled_dbus_property(self):
1019
if self.last_enabled is None:
1020
return dbus.String(u"")
1021
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1218
return datetime_to_dbus(self.last_enabled)
1022
1219
1023
1220
# Enabled - property
1024
@dbus_service_property(_interface, signature=u"b",
1025
access=u"readwrite")
1221
@dbus_service_property(_interface, signature="b",
1222
access="readwrite")
1026
1223
def Enabled_dbus_property(self, value=None):
1027
1224
if value is None: # get
1028
1225
return dbus.Boolean(self.enabled)
1032
1229
self.disable()
1033
1230
1034
1231
# LastCheckedOK - property
1035
@dbus_service_property(_interface, signature=u"s",
1036
access=u"readwrite")
1232
@dbus_service_property(_interface, signature="s",
1233
access="readwrite")
1037
1234
def LastCheckedOK_dbus_property(self, value=None):
1038
1235
if value is not None:
1039
1236
self.checked_ok()
1040
1237
return
1041
if self.last_checked_ok is None:
1042
return dbus.String(u"")
1043
return dbus.String(self._datetime_to_dbus(self
1044
.last_checked_ok))
1238
return datetime_to_dbus(self.last_checked_ok)
1239
1240
# Expires - property
1241
@dbus_service_property(_interface, signature="s", access="read")
1242
def Expires_dbus_property(self):
1243
return datetime_to_dbus(self.expires)
1045
1244
1046
1245
# LastApprovalRequest - property
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1246
@dbus_service_property(_interface, signature="s", access="read")
1048
1247
def LastApprovalRequest_dbus_property(self):
1049
if self.last_approval_request is None:
1050
return dbus.String(u"")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1248
return datetime_to_dbus(self.last_approval_request)
1054
1249
1055
1250
# Timeout - property
1056
@dbus_service_property(_interface, signature=u"t",
1057
access=u"readwrite")
1251
@dbus_service_property(_interface, signature="t",
1252
access="readwrite")
1058
1253
def Timeout_dbus_property(self, value=None):
1059
1254
if value is None: # get
1060
1255
return dbus.UInt64(self.timeout_milliseconds())
1061
1256
self.timeout = datetime.timedelta(0, 0, 0, value)
1062
# Emit D-Bus signal
1063
self.PropertyChanged(dbus.String(u"Timeout"),
1064
dbus.UInt64(value, variant_level=1))
1065
if getattr(self, u"disable_initiator_tag", None) is None:
1257
if getattr(self, "disable_initiator_tag", None) is None:
1066
1258
return
1067
1259
# Reschedule timeout
1068
1260
gobject.source_remove(self.disable_initiator_tag)
1069
1261
self.disable_initiator_tag = None
1070
time_to_die = (self.
1071
_timedelta_to_milliseconds((self
1072
.last_checked_ok
1073
+ self.timeout)
1074
- datetime.datetime
1075
.utcnow()))
1262
self.expires = None
1263
time_to_die = _timedelta_to_milliseconds((self
1264
.last_checked_ok
1265
+ self.timeout)
1266
- datetime.datetime
1267
.utcnow())
1076
1268
if time_to_die <= 0:
1077
1269
# The timeout has passed
1078
1270
self.disable()
1079
1271
else:
1272
self.expires = (datetime.datetime.utcnow()
1273
+ datetime.timedelta(milliseconds =
1274
time_to_die))
1080
1275
self.disable_initiator_tag = (gobject.timeout_add
1081
1276
(time_to_die, self.disable))
1082
1277
1278
# ExtendedTimeout - property
1279
@dbus_service_property(_interface, signature="t",
1280
access="readwrite")
1281
def ExtendedTimeout_dbus_property(self, value=None):
1282
if value is None: # get
1283
return dbus.UInt64(self.extended_timeout_milliseconds())
1284
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1285
1083
1286
# Interval - property
1084
@dbus_service_property(_interface, signature=u"t",
1085
access=u"readwrite")
1287
@dbus_service_property(_interface, signature="t",
1288
access="readwrite")
1086
1289
def Interval_dbus_property(self, value=None):
1087
1290
if value is None: # get
1088
1291
return dbus.UInt64(self.interval_milliseconds())
1089
1292
self.interval = datetime.timedelta(0, 0, 0, value)
1090
# Emit D-Bus signal
1091
self.PropertyChanged(dbus.String(u"Interval"),
1092
dbus.UInt64(value, variant_level=1))
1093
if getattr(self, u"checker_initiator_tag", None) is None:
1293
if getattr(self, "checker_initiator_tag", None) is None:
1094
1294
return
1095
1295
# Reschedule checker run
1096
1296
gobject.source_remove(self.checker_initiator_tag)
1097
1297
self.checker_initiator_tag = (gobject.timeout_add
1098
1298
(value, self.start_checker))
1099
1299
self.start_checker() # Start one now, too
1100
1300
1101
1301
# Checker - property
1102
@dbus_service_property(_interface, signature=u"s",
1103
access=u"readwrite")
1302
@dbus_service_property(_interface, signature="s",
1303
access="readwrite")
1104
1304
def Checker_dbus_property(self, value=None):
1105
1305
if value is None: # get
1106
1306
return dbus.String(self.checker_command)
1107
1307
self.checker_command = value
1108
# Emit D-Bus signal
1109
self.PropertyChanged(dbus.String(u"Checker"),
1110
dbus.String(self.checker_command,
1111
variant_level=1))
1112
1308
1113
1309
# CheckerRunning - property
1114
@dbus_service_property(_interface, signature=u"b",
1115
access=u"readwrite")
1310
@dbus_service_property(_interface, signature="b",
1311
access="readwrite")
1116
1312
def CheckerRunning_dbus_property(self, value=None):
1117
1313
if value is None: # get
1118
1314
return dbus.Boolean(self.checker is not None)
1122
1318
self.stop_checker()
1123
1319
1124
1320
# ObjectPath - property
1125
@dbus_service_property(_interface, signature=u"o", access=u"read")
1321
@dbus_service_property(_interface, signature="o", access="read")
1126
1322
def ObjectPath_dbus_property(self):
1127
1323
return self.dbus_object_path # is already a dbus.ObjectPath
1128
1324
1129
1325
# Secret = property
1130
@dbus_service_property(_interface, signature=u"ay",
1131
access=u"write", byte_arrays=True)
1326
@dbus_service_property(_interface, signature="ay",
1327
access="write", byte_arrays=True)
1132
1328
def Secret_dbus_property(self, value):
1133
1329
self.secret = str(value)
1134
1330
1141
1337
self._pipe.send(('init', fpr, address))
1142
1338
if not self._pipe.recv():
1143
1339
raise KeyError()
1144
1340
1145
1341
def __getattribute__(self, name):
1146
1342
if(name == '_pipe'):
1147
1343
return super(ProxyClient, self).__getattribute__(name)
1154
1350
self._pipe.send(('funcall', name, args, kwargs))
1155
1351
return self._pipe.recv()[1]
1156
1352
return func
1157
1353
1158
1354
def __setattr__(self, name, value):
1159
1355
if(name == '_pipe'):
1160
1356
return super(ProxyClient, self).__setattr__(name, value)
1161
1357
self._pipe.send(('setattr', name, value))
1162
1358
1359
class ClientDBusTransitional(ClientDBus):
1360
__metaclass__ = AlternateDBusNamesMetaclass
1163
1361
1164
1362
class ClientHandler(socketserver.BaseRequestHandler, object):
1165
1363
"""A class to handle client connections.
1169
1367
1170
1368
def handle(self):
1171
1369
with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
logger.info(u"TCP connection from: %s",
1370
logger.info("TCP connection from: %s",
1173
1371
unicode(self.client_address))
1174
logger.debug(u"Pipe FD: %d",
1372
logger.debug("Pipe FD: %d",
1175
1373
self.server.child_pipe.fileno())
1176
1374
1177
1375
session = (gnutls.connection
1178
1376
.ClientSession(self.request,
1179
1377
gnutls.connection
1180
1378
.X509Credentials()))
1181
1379
1182
1380
# Note: gnutls.connection.X509Credentials is really a
1183
1381
# generic GnuTLS certificate credentials object so long as
1184
1382
# no X.509 keys are added to it. Therefore, we can use it
1185
1383
# here despite using OpenPGP certificates.
1186
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
# u"+AES-256-CBC", u"+SHA1",
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1190
# u"+DHE-DSS"))
1384
1385
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1386
# "+AES-256-CBC", "+SHA1",
1387
# "+COMP-NULL", "+CTYPE-OPENPGP",
1388
# "+DHE-DSS"))
1191
1389
# Use a fallback default, since this MUST be set.
1192
1390
priority = self.server.gnutls_priority
1193
1391
if priority is None:
1194
priority = u"NORMAL"
1392
priority = "NORMAL"
1195
1393
(gnutls.library.functions
1196
1394
.gnutls_priority_set_direct(session._c_object,
1197
1395
priority, None))
1198
1396
1199
1397
# Start communication using the Mandos protocol
1200
1398
# Get protocol number
1201
1399
line = self.request.makefile().readline()
1202
logger.debug(u"Protocol version: %r", line)
1400
logger.debug("Protocol version: %r", line)
1203
1401
try:
1204
1402
if int(line.strip().split()[0]) > 1:
1205
1403
raise RuntimeError
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
1404
except (ValueError, IndexError, RuntimeError) as error:
1405
logger.error("Unknown protocol version: %s", error)
1208
1406
return
1209
1407
1210
1408
# Start GnuTLS connection
1211
1409
try:
1212
1410
session.handshake()
1213
except gnutls.errors.GNUTLSError, error:
1214
logger.warning(u"Handshake failed: %s", error)
1411
except gnutls.errors.GNUTLSError as error:
1412
logger.warning("Handshake failed: %s", error)
1215
1413
# Do not run session.bye() here: the session is not
1216
1414
# established. Just abandon the request.
1217
1415
return
1218
logger.debug(u"Handshake succeeded")
1219
1416
logger.debug("Handshake succeeded")
1417
1220
1418
approval_required = False
1221
1419
try:
1222
1420
try:
1223
1421
fpr = self.fingerprint(self.peer_certificate
1224
1422
(session))
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning(u"Bad certificate: %s", error)
1423
except (TypeError,
1424
gnutls.errors.GNUTLSError) as error:
1425
logger.warning("Bad certificate: %s", error)
1227
1426
return
1228
logger.debug(u"Fingerprint: %s", fpr)
1229
1427
logger.debug("Fingerprint: %s", fpr)
1428
1230
1429
try:
1231
1430
client = ProxyClient(child_pipe, fpr,
1232
1431
self.client_address)
1240
1439
1241
1440
while True:
1242
1441
if not client.enabled:
1243
logger.warning(u"Client %s is disabled",
1442
logger.info("Client %s is disabled",
1244
1443
client.name)
1245
1444
if self.server.use_dbus:
1246
1445
# Emit D-Bus signal
1247
client.Rejected("Disabled")
1446
client.Rejected("Disabled")
1248
1447
return
1249
1448
1250
1449
if client._approved or not client.approval_delay:
1251
1450
#We are approved or approval is disabled
1252
1451
break
1253
1452
elif client._approved is None:
1254
logger.info(u"Client %s needs approval",
1453
logger.info("Client %s needs approval",
1255
1454
client.name)
1256
1455
if self.server.use_dbus:
1257
1456
# Emit D-Bus signal
1259
1458
client.approval_delay_milliseconds(),
1260
1459
client.approved_by_default)
1261
1460
else:
1262
logger.warning(u"Client %s was not approved",
1461
logger.warning("Client %s was not approved",
1263
1462
client.name)
1264
1463
if self.server.use_dbus:
1265
1464
# Emit D-Bus signal
1267
1466
return
1268
1467
1269
1468
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
1271
1469
time = datetime.datetime.now()
1272
1470
client.changedstate.acquire()
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1471
(client.changedstate.wait
1472
(float(client._timedelta_to_milliseconds(delay)
1473
/ 1000)))
1274
1474
client.changedstate.release()
1275
1475
time2 = datetime.datetime.now()
1276
1476
if (time2 - time) >= delay:
1291
1491
while sent_size < len(client.secret):
1292
1492
try:
1293
1493
sent = session.send(client.secret[sent_size:])
1294
except (gnutls.errors.GNUTLSError), error:
1494
except gnutls.errors.GNUTLSError as error:
1295
1495
logger.warning("gnutls send failed")
1296
1496
return
1297
logger.debug(u"Sent: %d, remaining: %d",
1497
logger.debug("Sent: %d, remaining: %d",
1298
1498
sent, len(client.secret)
1299
1499
- (sent_size + sent))
1300
1500
sent_size += sent
1301
1302
logger.info(u"Sending secret to %s", client.name)
1303
# bump the timeout as if seen
1304
client.checked_ok()
1501
1502
logger.info("Sending secret to %s", client.name)
1503
# bump the timeout using extended_timeout
1504
client.checked_ok(client.extended_timeout)
1305
1505
if self.server.use_dbus:
1306
1506
# Emit D-Bus signal
1307
1507
client.GotSecret()
1311
1511
client.approvals_pending -= 1
1312
1512
try:
1313
1513
session.bye()
1314
except (gnutls.errors.GNUTLSError), error:
1514
except gnutls.errors.GNUTLSError as error:
1315
1515
logger.warning("GnuTLS bye failed")
1316
1516
1317
1517
@staticmethod
1328
1528
.gnutls_certificate_get_peers
1329
1529
(session._c_object, ctypes.byref(list_size)))
1330
1530
if not bool(cert_list) and list_size.value != 0:
1331
raise gnutls.errors.GNUTLSError(u"error getting peer"
1332
u" certificate")
1531
raise gnutls.errors.GNUTLSError("error getting peer"
1532
" certificate")
1333
1533
if list_size.value == 0:
1334
1534
return None
1335
1535
cert = cert_list[0]
1361
1561
if crtverify.value != 0:
1362
1562
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1363
1563
raise (gnutls.errors.CertificateSecurityError
1364
(u"Verify failed"))
1564
("Verify failed"))
1365
1565
# New buffer for the fingerprint
1366
1566
buf = ctypes.create_string_buffer(20)
1367
1567
buf_len = ctypes.c_size_t()
1374
1574
# Convert the buffer to a Python bytestring
1375
1575
fpr = ctypes.string_at(buf, buf_len.value)
1376
1576
# Convert the bytestring to hexadecimal notation
1377
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1577
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1378
1578
return hex_fpr
1379
1579
1380
1580
1386
1586
except:
1387
1587
self.handle_error(request, address)
1388
1588
self.close_request(request)
1389
1589
1390
1590
def process_request(self, request, address):
1391
1591
"""Start a new process to process the request."""
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
1592
proc = multiprocessing.Process(target = self.sub_process_main,
1593
args = (request,
1594
address))
1595
proc.start()
1596
return proc
1597
1394
1598
1395
1599
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
1600
""" adds a pipe to the MixIn """
1400
1604
This function creates a new pipe in self.pipe
1401
1605
"""
1402
1606
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
1404
super(MultiprocessingMixInWithPipe,
1405
self).process_request(request, client_address)
1607
1608
proc = MultiprocessingMixIn.process_request(self, request,
1609
client_address)
1406
1610
self.child_pipe.close()
1407
self.add_pipe(parent_pipe)
1408
1409
def add_pipe(self, parent_pipe):
1611
self.add_pipe(parent_pipe, proc)
1612
1613
def add_pipe(self, parent_pipe, proc):
1410
1614
"""Dummy function; override as necessary"""
1411
pass
1615
raise NotImplementedError
1616
1412
1617
1413
1618
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1414
1619
socketserver.TCPServer, object):
1432
1637
bind to an address or port if they were not specified."""
1433
1638
if self.interface is not None:
1434
1639
if SO_BINDTODEVICE is None:
1435
logger.error(u"SO_BINDTODEVICE does not exist;"
1436
u" cannot bind to interface %s",
1640
logger.error("SO_BINDTODEVICE does not exist;"
1641
" cannot bind to interface %s",
1437
1642
self.interface)
1438
1643
else:
1439
1644
try:
1440
1645
self.socket.setsockopt(socket.SOL_SOCKET,
1441
1646
SO_BINDTODEVICE,
1442
1647
str(self.interface
1443
+ u'\0'))
1444
except socket.error, error:
1648
+ '\0'))
1649
except socket.error as error:
1445
1650
if error[0] == errno.EPERM:
1446
logger.error(u"No permission to"
1447
u" bind to interface %s",
1651
logger.error("No permission to"
1652
" bind to interface %s",
1448
1653
self.interface)
1449
1654
elif error[0] == errno.ENOPROTOOPT:
1450
logger.error(u"SO_BINDTODEVICE not available;"
1451
u" cannot bind to interface %s",
1655
logger.error("SO_BINDTODEVICE not available;"
1656
" cannot bind to interface %s",
1452
1657
self.interface)
1453
1658
else:
1454
1659
raise
1456
1661
if self.server_address[0] or self.server_address[1]:
1457
1662
if not self.server_address[0]:
1458
1663
if self.address_family == socket.AF_INET6:
1459
any_address = u"::" # in6addr_any
1664
any_address = "::" # in6addr_any
1460
1665
else:
1461
1666
any_address = socket.INADDR_ANY
1462
1667
self.server_address = (any_address,
1489
1694
self.enabled = False
1490
1695
self.clients = clients
1491
1696
if self.clients is None:
1492
self.clients = set()
1697
self.clients = {}
1493
1698
self.use_dbus = use_dbus
1494
1699
self.gnutls_priority = gnutls_priority
1495
1700
IPv6_TCPServer.__init__(self, server_address,
1499
1704
def server_activate(self):
1500
1705
if self.enabled:
1501
1706
return socketserver.TCPServer.server_activate(self)
1707
1502
1708
def enable(self):
1503
1709
self.enabled = True
1504
def add_pipe(self, parent_pipe):
1710
1711
def add_pipe(self, parent_pipe, proc):
1505
1712
# Call "handle_ipc" for both data and EOF events
1506
1713
gobject.io_add_watch(parent_pipe.fileno(),
1507
1714
gobject.IO_IN | gobject.IO_HUP,
1508
1715
functools.partial(self.handle_ipc,
1509
parent_pipe = parent_pipe))
1510
1716
parent_pipe =
1717
parent_pipe,
1718
proc = proc))
1719
1511
1720
def handle_ipc(self, source, condition, parent_pipe=None,
1512
client_object=None):
1721
proc = None, client_object=None):
1513
1722
condition_names = {
1514
gobject.IO_IN: u"IN", # There is data to read.
1515
gobject.IO_OUT: u"OUT", # Data can be written (without
1723
gobject.IO_IN: "IN", # There is data to read.
1724
gobject.IO_OUT: "OUT", # Data can be written (without
1516
1725
# blocking).
1517
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1518
gobject.IO_ERR: u"ERR", # Error condition.
1519
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1726
gobject.IO_PRI: "PRI", # There is urgent data to read.
1727
gobject.IO_ERR: "ERR", # Error condition.
1728
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1520
1729
# broken, usually for pipes and
1521
1730
# sockets).
1522
1731
}
1524
1733
for cond, name in
1525
1734
condition_names.iteritems()
1526
1735
if cond & condition)
1527
# error or the other end of multiprocessing.Pipe has closed
1736
# error, or the other end of multiprocessing.Pipe has closed
1528
1737
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1738
# Wait for other process to exit
1739
proc.join()
1529
1740
return False
1530
1741
1531
1742
# Read a request from the child
1536
1747
fpr = request[1]
1537
1748
address = request[2]
1538
1749
1539
for c in self.clients:
1750
for c in self.clients.itervalues():
1540
1751
if c.fingerprint == fpr:
1541
1752
client = c
1542
1753
break
1543
1754
else:
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1755
logger.info("Client not found for fingerprint: %s, ad"
1756
"dress: %s", fpr, address)
1546
1757
if self.use_dbus:
1547
1758
# Emit D-Bus signal
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1759
mandos_dbus_service.ClientNotFound(fpr,
1760
address[0])
1549
1761
parent_pipe.send(False)
1550
1762
return False
1551
1763
1552
1764
gobject.io_add_watch(parent_pipe.fileno(),
1553
1765
gobject.IO_IN | gobject.IO_HUP,
1554
1766
functools.partial(self.handle_ipc,
1555
parent_pipe = parent_pipe,
1556
client_object = client))
1767
parent_pipe =
1768
parent_pipe,
1769
proc = proc,
1770
client_object =
1771
client))
1557
1772
parent_pipe.send(True)
1558
# remove the old hook in favor of the new above hook on same fileno
1773
# remove the old hook in favor of the new above hook on
1774
# same fileno
1559
1775
return False
1560
1776
if command == 'funcall':
1561
1777
funcname = request[1]
1562
1778
args = request[2]
1563
1779
kwargs = request[3]
1564
1780
1565
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
1781
parent_pipe.send(('data', getattr(client_object,
1782
funcname)(*args,
1783
**kwargs)))
1784
1567
1785
if command == 'getattr':
1568
1786
attrname = request[1]
1569
1787
if callable(client_object.__getattribute__(attrname)):
1570
1788
parent_pipe.send(('function',))
1571
1789
else:
1572
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1790
parent_pipe.send(('data', client_object
1791
.__getattribute__(attrname)))
1573
1792
1574
1793
if command == 'setattr':
1575
1794
attrname = request[1]
1576
1795
value = request[2]
1577
1796
setattr(client_object, attrname, value)
1578
1797
1579
1798
return True
1580
1799
1581
1800
1582
1801
def string_to_delta(interval):
1583
1802
"""Parse a string and return a datetime.timedelta
1584
1803
1585
>>> string_to_delta(u'7d')
1804
>>> string_to_delta('7d')
1586
1805
datetime.timedelta(7)
1587
>>> string_to_delta(u'60s')
1806
>>> string_to_delta('60s')
1588
1807
datetime.timedelta(0, 60)
1589
>>> string_to_delta(u'60m')
1808
>>> string_to_delta('60m')
1590
1809
datetime.timedelta(0, 3600)
1591
>>> string_to_delta(u'24h')
1810
>>> string_to_delta('24h')
1592
1811
datetime.timedelta(1)
1593
>>> string_to_delta(u'1w')
1812
>>> string_to_delta('1w')
1594
1813
datetime.timedelta(7)
1595
>>> string_to_delta(u'5m 30s')
1814
>>> string_to_delta('5m 30s')
1596
1815
datetime.timedelta(0, 330)
1597
1816
"""
1598
1817
timevalue = datetime.timedelta(0)
1600
1819
try:
1601
1820
suffix = unicode(s[-1])
1602
1821
value = int(s[:-1])
1603
if suffix == u"d":
1822
if suffix == "d":
1604
1823
delta = datetime.timedelta(value)
1605
elif suffix == u"s":
1824
elif suffix == "s":
1606
1825
delta = datetime.timedelta(0, value)
1607
elif suffix == u"m":
1826
elif suffix == "m":
1608
1827
delta = datetime.timedelta(0, 0, 0, 0, value)
1609
elif suffix == u"h":
1828
elif suffix == "h":
1610
1829
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1611
elif suffix == u"w":
1830
elif suffix == "w":
1612
1831
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1613
1832
else:
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1615
except (ValueError, IndexError), e:
1616
raise ValueError(e.message)
1833
raise ValueError("Unknown suffix %r" % suffix)
1834
except (ValueError, IndexError) as e:
1835
raise ValueError(*(e.args))
1617
1836
timevalue += delta
1618
1837
return timevalue
1619
1838
1625
1844
global if_nametoindex
1626
1845
try:
1627
1846
if_nametoindex = (ctypes.cdll.LoadLibrary
1628
(ctypes.util.find_library(u"c"))
1847
(ctypes.util.find_library("c"))
1629
1848
.if_nametoindex)
1630
1849
except (OSError, AttributeError):
1631
logger.warning(u"Doing if_nametoindex the hard way")
1850
logger.warning("Doing if_nametoindex the hard way")
1632
1851
def if_nametoindex(interface):
1633
1852
"Get an interface index the hard way, i.e. using fcntl()"
1634
1853
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1635
1854
with contextlib.closing(socket.socket()) as s:
1636
1855
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1637
struct.pack(str(u"16s16x"),
1856
struct.pack(str("16s16x"),
1638
1857
interface))
1639
interface_index = struct.unpack(str(u"I"),
1858
interface_index = struct.unpack(str("I"),
1640
1859
ifreq[16:20])[0]
1641
1860
return interface_index
1642
1861
return if_nametoindex(interface)
1650
1869
sys.exit()
1651
1870
os.setsid()
1652
1871
if not nochdir:
1653
os.chdir(u"/")
1872
os.chdir("/")
1654
1873
if os.fork():
1655
1874
sys.exit()
1656
1875
if not noclose:
1658
1877
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1659
1878
if not stat.S_ISCHR(os.fstat(null).st_mode):
1660
1879
raise OSError(errno.ENODEV,
1661
u"%s not a character device"
1880
"%s not a character device"
1662
1881
% os.path.devnull)
1663
1882
os.dup2(null, sys.stdin.fileno())
1664
1883
os.dup2(null, sys.stdout.fileno())
1672
1891
##################################################################
1673
1892
# Parsing of options, both command line and config file
1674
1893
1675
parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
parser.add_option("-i", u"--interface", type=u"string",
1677
metavar="IF", help=u"Bind to interface IF")
1678
parser.add_option("-a", u"--address", type=u"string",
1679
help=u"Address to listen for requests on")
1680
parser.add_option("-p", u"--port", type=u"int",
1681
help=u"Port number to receive requests on")
1682
parser.add_option("--check", action=u"store_true",
1683
help=u"Run self-test")
1684
parser.add_option("--debug", action=u"store_true",
1685
help=u"Debug mode; run in foreground and log to"
1686
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
help=u"Debug level for stdout output")
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
u" priority string (see GnuTLS documentation)")
1691
parser.add_option("--servicename", type=u"string",
1692
metavar=u"NAME", help=u"Zeroconf service name")
1693
parser.add_option("--configdir", type=u"string",
1694
default=u"/etc/mandos", metavar=u"DIR",
1695
help=u"Directory to search for configuration"
1696
u" files")
1697
parser.add_option("--no-dbus", action=u"store_false",
1698
dest=u"use_dbus", help=u"Do not provide D-Bus"
1699
u" system bus interface")
1700
parser.add_option("--no-ipv6", action=u"store_false",
1701
dest=u"use_ipv6", help=u"Do not use IPv6")
1702
options = parser.parse_args()[0]
1894
parser = argparse.ArgumentParser()
1895
parser.add_argument("-v", "--version", action="version",
1896
version = "%%(prog)s %s" % version,
1897
help="show version number and exit")
1898
parser.add_argument("-i", "--interface", metavar="IF",
1899
help="Bind to interface IF")
1900
parser.add_argument("-a", "--address",
1901
help="Address to listen for requests on")
1902
parser.add_argument("-p", "--port", type=int,
1903
help="Port number to receive requests on")
1904
parser.add_argument("--check", action="store_true",
1905
help="Run self-test")
1906
parser.add_argument("--debug", action="store_true",
1907
help="Debug mode; run in foreground and log"
1908
" to terminal")
1909
parser.add_argument("--debuglevel", metavar="LEVEL",
1910
help="Debug level for stdout output")
1911
parser.add_argument("--priority", help="GnuTLS"
1912
" priority string (see GnuTLS documentation)")
1913
parser.add_argument("--servicename",
1914
metavar="NAME", help="Zeroconf service name")
1915
parser.add_argument("--configdir",
1916
default="/etc/mandos", metavar="DIR",
1917
help="Directory to search for configuration"
1918
" files")
1919
parser.add_argument("--no-dbus", action="store_false",
1920
dest="use_dbus", help="Do not provide D-Bus"
1921
" system bus interface")
1922
parser.add_argument("--no-ipv6", action="store_false",
1923
dest="use_ipv6", help="Do not use IPv6")
1924
parser.add_argument("--no-restore", action="store_false",
1925
dest="restore", help="Do not restore stored state",
1926
default=True)
1927
1928
options = parser.parse_args()
1703
1929
1704
1930
if options.check:
1705
1931
import doctest
1707
1933
sys.exit()
1708
1934
1709
1935
# Default values for config file for server-global settings
1710
server_defaults = { u"interface": u"",
1711
u"address": u"",
1712
u"port": u"",
1713
u"debug": u"False",
1714
u"priority":
1715
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
u"servicename": u"Mandos",
1717
u"use_dbus": u"True",
1718
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1936
server_defaults = { "interface": "",
1937
"address": "",
1938
"port": "",
1939
"debug": "False",
1940
"priority":
1941
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1942
"servicename": "Mandos",
1943
"use_dbus": "True",
1944
"use_ipv6": "True",
1945
"debuglevel": "",
1720
1946
}
1721
1947
1722
1948
# Parse config file for server-global settings
1723
1949
server_config = configparser.SafeConfigParser(server_defaults)
1724
1950
del server_defaults
1725
1951
server_config.read(os.path.join(options.configdir,
1726
u"mandos.conf"))
1952
"mandos.conf"))
1727
1953
# Convert the SafeConfigParser object to a dict
1728
1954
server_settings = server_config.defaults()
1729
1955
# Use the appropriate methods on the non-string config options
1730
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1731
server_settings[option] = server_config.getboolean(u"DEFAULT",
1956
for option in ("debug", "use_dbus", "use_ipv6"):
1957
server_settings[option] = server_config.getboolean("DEFAULT",
1732
1958
option)
1733
1959
if server_settings["port"]:
1734
server_settings["port"] = server_config.getint(u"DEFAULT",
1735
u"port")
1960
server_settings["port"] = server_config.getint("DEFAULT",
1961
"port")
1736
1962
del server_config
1737
1963
1738
1964
# Override the settings from the config file with command line
1739
1965
# options, if set.
1740
for option in (u"interface", u"address", u"port", u"debug",
1741
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1966
for option in ("interface", "address", "port", "debug",
1967
"priority", "servicename", "configdir",
1968
"use_dbus", "use_ipv6", "debuglevel", "restore"):
1743
1969
value = getattr(options, option)
1744
1970
if value is not None:
1745
1971
server_settings[option] = value
1753
1979
##################################################################
1754
1980
1755
1981
# For convenience
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
use_dbus = server_settings[u"use_dbus"]
1759
use_ipv6 = server_settings[u"use_ipv6"]
1760
1761
if server_settings[u"servicename"] != u"Mandos":
1982
debug = server_settings["debug"]
1983
debuglevel = server_settings["debuglevel"]
1984
use_dbus = server_settings["use_dbus"]
1985
use_ipv6 = server_settings["use_ipv6"]
1986
1987
if server_settings["servicename"] != "Mandos":
1762
1988
syslogger.setFormatter(logging.Formatter
1763
(u'Mandos (%s) [%%(process)d]:'
1764
u' %%(levelname)s: %%(message)s'
1765
% server_settings[u"servicename"]))
1989
('Mandos (%s) [%%(process)d]:'
1990
' %%(levelname)s: %%(message)s'
1991
% server_settings["servicename"]))
1766
1992
1767
1993
# Parse config file with clients
1768
client_defaults = { u"timeout": u"1h",
1769
u"interval": u"5m",
1770
u"checker": u"fping -q -- %%(host)s",
1771
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1994
client_defaults = { "timeout": "5m",
1995
"extended_timeout": "15m",
1996
"interval": "2m",
1997
"checker": "fping -q -- %%(host)s",
1998
"host": "",
1999
"approval_delay": "0s",
2000
"approval_duration": "1s",
1774
2001
}
1775
2002
client_config = configparser.SafeConfigParser(client_defaults)
1776
client_config.read(os.path.join(server_settings[u"configdir"],
1777
u"clients.conf"))
2003
client_config.read(os.path.join(server_settings["configdir"],
2004
"clients.conf"))
1778
2005
1779
2006
global mandos_dbus_service
1780
2007
mandos_dbus_service = None
1781
2008
1782
tcp_server = MandosServer((server_settings[u"address"],
1783
server_settings[u"port"]),
2009
tcp_server = MandosServer((server_settings["address"],
2010
server_settings["port"]),
1784
2011
ClientHandler,
1785
interface=(server_settings[u"interface"]
2012
interface=(server_settings["interface"]
1786
2013
or None),
1787
2014
use_ipv6=use_ipv6,
1788
2015
gnutls_priority=
1789
server_settings[u"priority"],
2016
server_settings["priority"],
1790
2017
use_dbus=use_dbus)
1791
2018
if not debug:
1792
pidfilename = u"/var/run/mandos.pid"
2019
pidfilename = "/var/run/mandos.pid"
1793
2020
try:
1794
pidfile = open(pidfilename, u"w")
2021
pidfile = open(pidfilename, "w")
1795
2022
except IOError:
1796
logger.error(u"Could not open file %r", pidfilename)
2023
logger.error("Could not open file %r", pidfilename)
1797
2024
1798
2025
try:
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1800
gid = pwd.getpwnam(u"_mandos").pw_gid
2026
uid = pwd.getpwnam("_mandos").pw_uid
2027
gid = pwd.getpwnam("_mandos").pw_gid
1801
2028
except KeyError:
1802
2029
try:
1803
uid = pwd.getpwnam(u"mandos").pw_uid
1804
gid = pwd.getpwnam(u"mandos").pw_gid
2030
uid = pwd.getpwnam("mandos").pw_uid
2031
gid = pwd.getpwnam("mandos").pw_gid
1805
2032
except KeyError:
1806
2033
try:
1807
uid = pwd.getpwnam(u"nobody").pw_uid
1808
gid = pwd.getpwnam(u"nobody").pw_gid
2034
uid = pwd.getpwnam("nobody").pw_uid
2035
gid = pwd.getpwnam("nobody").pw_gid
1809
2036
except KeyError:
1810
2037
uid = 65534
1811
2038
gid = 65534
1812
2039
try:
1813
2040
os.setgid(gid)
1814
2041
os.setuid(uid)
1815
except OSError, error:
2042
except OSError as error:
1816
2043
if error[0] != errno.EPERM:
1817
2044
raise error
1818
2045
1819
2046
if not debug and not debuglevel:
1820
syslogger.setLevel(logging.WARNING)
1821
console.setLevel(logging.WARNING)
2047
logger.setLevel(logging.WARNING)
1822
2048
if debuglevel:
1823
2049
level = getattr(logging, debuglevel.upper())
1824
syslogger.setLevel(level)
1825
console.setLevel(level)
1826
2050
logger.setLevel(level)
2051
1827
2052
if debug:
2053
logger.setLevel(logging.DEBUG)
1828
2054
# Enable all possible GnuTLS debugging
1829
2055
1830
2056
# "Use a log level over 10 to enable all debugging options."
1833
2059
1834
2060
@gnutls.library.types.gnutls_log_func
1835
2061
def debug_gnutls(level, string):
1836
logger.debug(u"GnuTLS: %s", string[:-1])
2062
logger.debug("GnuTLS: %s", string[:-1])
1837
2063
1838
2064
(gnutls.library.functions
1839
2065
.gnutls_global_set_log_function(debug_gnutls))
1847
2073
# No console logging
1848
2074
logger.removeHandler(console)
1849
2075
2076
# Need to fork before connecting to D-Bus
2077
if not debug:
2078
# Close all input and output, do double fork, etc.
2079
daemon()
1850
2080
1851
2081
global main_loop
1852
2082
# From the Avahi example code
1856
2086
# End of Avahi example code
1857
2087
if use_dbus:
1858
2088
try:
1859
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2089
bus_name = dbus.service.BusName("se.recompile.Mandos",
1860
2090
bus, do_not_queue=True)
1861
except dbus.exceptions.NameExistsException, e:
1862
logger.error(unicode(e) + u", disabling D-Bus")
2091
old_bus_name = (dbus.service.BusName
2092
("se.bsnet.fukt.Mandos", bus,
2093
do_not_queue=True))
2094
except dbus.exceptions.NameExistsException as e:
2095
logger.error(unicode(e) + ", disabling D-Bus")
1863
2096
use_dbus = False
1864
server_settings[u"use_dbus"] = False
2097
server_settings["use_dbus"] = False
1865
2098
tcp_server.use_dbus = False
1866
2099
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1867
service = AvahiService(name = server_settings[u"servicename"],
1868
servicetype = u"_mandos._tcp",
1869
protocol = protocol, bus = bus)
2100
service = AvahiServiceToSyslog(name =
2101
server_settings["servicename"],
2102
servicetype = "_mandos._tcp",
2103
protocol = protocol, bus = bus)
1870
2104
if server_settings["interface"]:
1871
2105
service.interface = (if_nametoindex
1872
(str(server_settings[u"interface"])))
1873
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1877
2106
(str(server_settings["interface"])))
2107
1878
2108
global multiprocessing_manager
1879
2109
multiprocessing_manager = multiprocessing.Manager()
1880
2110
1881
2111
client_class = Client
1882
2112
if use_dbus:
1883
client_class = functools.partial(ClientDBus, bus = bus)
1884
def client_config_items(config, section):
1885
special_settings = {
1886
"approved_by_default":
1887
lambda: config.getboolean(section,
1888
"approved_by_default"),
1889
}
1890
for name, value in config.items(section):
2113
client_class = functools.partial(ClientDBusTransitional,
2114
bus = bus)
2115
2116
special_settings = {
2117
# Some settings need to be accessd by special methods;
2118
# booleans need .getboolean(), etc. Here is a list of them:
2119
"approved_by_default":
2120
lambda section:
2121
client_config.getboolean(section, "approved_by_default"),
2122
}
2123
# Construct a new dict of client settings of this form:
2124
# { client_name: {setting_name: value, ...}, ...}
2125
# with exceptions for any special settings as defined above
2126
client_settings = dict((clientname,
2127
dict((setting,
2128
(value if setting not in special_settings
2129
else special_settings[setting](clientname)))
2130
for setting, value in client_config.items(clientname)))
2131
for clientname in client_config.sections())
2132
2133
old_client_settings = {}
2134
clients_data = []
2135
2136
# Get client data and settings from last running state.
2137
if server_settings["restore"]:
2138
try:
2139
with open(stored_state_path, "rb") as stored_state:
2140
clients_data, old_client_settings = pickle.load(stored_state)
2141
os.remove(stored_state_path)
2142
except IOError as e:
2143
logger.warning("Could not load persistant state: {0}".format(e))
2144
if e.errno != errno.ENOENT:
2145
raise
2146
2147
for client in clients_data:
2148
client_name = client["name"]
2149
2150
# Decide which value to use after restoring saved state.
2151
# We have three different values: Old config file,
2152
# new config file, and saved state.
2153
# New config value takes precedence if it differs from old
2154
# config value, otherwise use saved state.
2155
for name, value in client_settings[client_name].items():
1891
2156
try:
1892
yield (name, special_settings[name]())
2157
# For each value in new config, check if it differs
2158
# from the old config value (Except for the "secret"
2159
# attribute)
2160
if name != "secret" and value != old_client_settings[client_name][name]:
2161
setattr(client, name, value)
1893
2162
except KeyError:
1894
yield (name, value)
2163
pass
2164
2165
# Clients who has passed its expire date, can still be enabled if its
2166
# last checker was sucessful. Clients who checkers failed before we
2167
# stored it state is asumed to had failed checker during downtime.
2168
if client["enabled"] and client["last_checked_ok"]:
2169
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2170
> client["interval"]):
2171
if client["last_checker_status"] != 0:
2172
client["enabled"] = False
2173
else:
2174
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2175
2176
client["changedstate"] = (multiprocessing_manager
2177
.Condition(multiprocessing_manager
2178
.Lock()))
2179
if use_dbus:
2180
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2181
tcp_server.clients[client_name] = new_client
2182
new_client.bus = bus
2183
for name, value in client.iteritems():
2184
setattr(new_client, name, value)
2185
client_object_name = unicode(client_name).translate(
2186
{ord("."): ord("_"),
2187
ord("-"): ord("_")})
2188
new_client.dbus_object_path = (dbus.ObjectPath
2189
("/clients/" + client_object_name))
2190
DBusObjectWithProperties.__init__(new_client,
2191
new_client.bus,
2192
new_client.dbus_object_path)
2193
else:
2194
tcp_server.clients[client_name] = Client.__new__(Client)
2195
for name, value in client.iteritems():
2196
setattr(tcp_server.clients[client_name], name, value)
2197
2198
tcp_server.clients[client_name].decrypt_secret(
2199
client_settings[client_name]["secret"])
2200
2201
# Create/remove clients based on new changes made to config
2202
for clientname in set(old_client_settings) - set(client_settings):
2203
del tcp_server.clients[clientname]
2204
for clientname in set(client_settings) - set(old_client_settings):
2205
tcp_server.clients[clientname] = (client_class(name = clientname,
2206
config =
2207
client_settings
2208
[clientname]))
1895
2209
1896
tcp_server.clients.update(set(
1897
client_class(name = section,
1898
config= dict(client_config_items(
1899
client_config, section)))
1900
for section in client_config.sections()))
2210
1901
2211
if not tcp_server.clients:
1902
logger.warning(u"No clients defined")
2212
logger.warning("No clients defined")
1903
2213
1904
2214
if not debug:
1905
2215
try:
1906
2216
with pidfile:
1907
2217
pid = os.getpid()
1908
pidfile.write(str(pid) + "\n")
2218
pidfile.write(str(pid) + "\n".encode("utf-8"))
1909
2219
del pidfile
1910
2220
except IOError:
1911
logger.error(u"Could not write to file %r with PID %d",
2221
logger.error("Could not write to file %r with PID %d",
1912
2222
pidfilename, pid)
1913
2223
except NameError:
1914
2224
# "pidfile" was never created
1916
2226
del pidfilename
1917
2227
1918
2228
signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
2229
1920
2230
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
2231
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1922
2232
1924
2234
class MandosDBusService(dbus.service.Object):
1925
2235
"""A D-Bus proxy object"""
1926
2236
def __init__(self):
1927
dbus.service.Object.__init__(self, bus, u"/")
1928
_interface = u"se.bsnet.fukt.Mandos"
2237
dbus.service.Object.__init__(self, bus, "/")
2238
_interface = "se.recompile.Mandos"
1929
2239
1930
@dbus.service.signal(_interface, signature=u"o")
2240
@dbus.service.signal(_interface, signature="o")
1931
2241
def ClientAdded(self, objpath):
1932
2242
"D-Bus signal"
1933
2243
pass
1934
2244
1935
@dbus.service.signal(_interface, signature=u"ss")
2245
@dbus.service.signal(_interface, signature="ss")
1936
2246
def ClientNotFound(self, fingerprint, address):
1937
2247
"D-Bus signal"
1938
2248
pass
1939
2249
1940
@dbus.service.signal(_interface, signature=u"os")
2250
@dbus.service.signal(_interface, signature="os")
1941
2251
def ClientRemoved(self, objpath, name):
1942
2252
"D-Bus signal"
1943
2253
pass
1944
2254
1945
@dbus.service.method(_interface, out_signature=u"ao")
2255
@dbus.service.method(_interface, out_signature="ao")
1946
2256
def GetAllClients(self):
1947
2257
"D-Bus method"
1948
2258
return dbus.Array(c.dbus_object_path
1949
for c in tcp_server.clients)
2259
for c in
2260
tcp_server.clients.itervalues())
1950
2261
1951
2262
@dbus.service.method(_interface,
1952
out_signature=u"a{oa{sv}}")
2263
out_signature="a{oa{sv}}")
1953
2264
def GetAllClientsWithProperties(self):
1954
2265
"D-Bus method"
1955
2266
return dbus.Dictionary(
1956
((c.dbus_object_path, c.GetAll(u""))
1957
for c in tcp_server.clients),
1958
signature=u"oa{sv}")
2267
((c.dbus_object_path, c.GetAll(""))
2268
for c in tcp_server.clients.itervalues()),
2269
signature="oa{sv}")
1959
2270
1960
@dbus.service.method(_interface, in_signature=u"o")
2271
@dbus.service.method(_interface, in_signature="o")
1961
2272
def RemoveClient(self, object_path):
1962
2273
"D-Bus method"
1963
for c in tcp_server.clients:
2274
for c in tcp_server.clients.itervalues():
1964
2275
if c.dbus_object_path == object_path:
1965
tcp_server.clients.remove(c)
2276
del tcp_server.clients[c.name]
1966
2277
c.remove_from_connection()
1967
2278
# Don't signal anything except ClientRemoved
1968
2279
c.disable(quiet=True)
1973
2284
1974
2285
del _interface
1975
2286
1976
mandos_dbus_service = MandosDBusService()
2287
class MandosDBusServiceTransitional(MandosDBusService):
2288
__metaclass__ = AlternateDBusNamesMetaclass
2289
mandos_dbus_service = MandosDBusServiceTransitional()
1977
2290
1978
2291
def cleanup():
1979
2292
"Cleanup function; run on exit"
1980
2293
service.cleanup()
1981
2294
2295
multiprocessing.active_children()
2296
if not (tcp_server.clients or client_settings):
2297
return
2298
2299
# Store client before exiting. Secrets are encrypted with key based
2300
# on what config file has. If config file is removed/edited, old
2301
# secret will thus be unrecovable.
2302
clients = []
2303
for client in tcp_server.clients.itervalues():
2304
client.encrypt_secret(client_settings[client.name]["secret"])
2305
2306
client_dict = {}
2307
2308
# A list of attributes that will not be stored when shuting down.
2309
exclude = set(("bus", "changedstate", "secret"))
2310
for name, typ in inspect.getmembers(dbus.service.Object):
2311
exclude.add(name)
2312
2313
client_dict["encrypted_secret"] = client.encrypted_secret
2314
for attr in client.client_structure:
2315
if attr not in exclude:
2316
client_dict[attr] = getattr(client, attr)
2317
2318
clients.append(client_dict)
2319
del client_settings[client.name]["secret"]
2320
2321
try:
2322
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2323
pickle.dump((clients, client_settings), stored_state)
2324
except IOError as e:
2325
logger.warning("Could not save persistant state: {0}".format(e))
2326
if e.errno != errno.ENOENT:
2327
raise
2328
2329
# Delete all clients, and settings from config
1982
2330
while tcp_server.clients:
1983
client = tcp_server.clients.pop()
2331
name, client = tcp_server.clients.popitem()
1984
2332
if use_dbus:
1985
2333
client.remove_from_connection()
1986
client.disable_hook = None
1987
2334
# Don't signal anything except ClientRemoved
1988
2335
client.disable(quiet=True)
1989
2336
if use_dbus:
1990
2337
# Emit D-Bus signal
1991
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2338
mandos_dbus_service.ClientRemoved(client
2339
.dbus_object_path,
1992
2340
client.name)
2341
client_settings.clear()
1993
2342
1994
2343
atexit.register(cleanup)
1995
2344
1996
for client in tcp_server.clients:
2345
for client in tcp_server.clients.itervalues():
1997
2346
if use_dbus:
1998
2347
# Emit D-Bus signal
1999
2348
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2000
client.enable()
2349
# Need to initiate checking of clients
2350
if client.enabled:
2351
client.init_checker()
2352
2001
2353
2002
2354
tcp_server.enable()
2003
2355
tcp_server.server_activate()
2005
2357
# Find out what port we got
2006
2358
service.port = tcp_server.socket.getsockname()[1]
2007
2359
if use_ipv6:
2008
logger.info(u"Now listening on address %r, port %d,"
2360
logger.info("Now listening on address %r, port %d,"
2009
2361
" flowinfo %d, scope_id %d"
2010
2362
% tcp_server.socket.getsockname())
2011
2363
else: # IPv4
2012
logger.info(u"Now listening on address %r, port %d"
2364
logger.info("Now listening on address %r, port %d"
2013
2365
% tcp_server.socket.getsockname())
2014
2366
2015
2367
#service.interface = tcp_server.socket.getsockname()[3]
2018
2370
# From the Avahi example code
2019
2371
try:
2020
2372
service.activate()
2021
except dbus.exceptions.DBusException, error:
2022
logger.critical(u"DBusException: %s", error)
2373
except dbus.exceptions.DBusException as error:
2374
logger.critical("DBusException: %s", error)
2023
2375
cleanup()
2024
2376
sys.exit(1)
2025
2377
# End of Avahi example code
2029
2381
(tcp_server.handle_request
2030
2382
(*args[2:], **kwargs) or True))
2031
2383
2032
logger.debug(u"Starting main loop")
2384
logger.debug("Starting main loop")
2033
2385
main_loop.run()
2034
except AvahiError, error:
2035
logger.critical(u"AvahiError: %s", error)
2386
except AvahiError as error:
2387
logger.critical("AvahiError: %s", error)
2036
2388
cleanup()
2037
2389
sys.exit(1)
2038
2390
except KeyboardInterrupt:
2039
2391
if debug:
2040
print >> sys.stderr
2041
logger.debug(u"Server received KeyboardInterrupt")
2042
logger.debug(u"Server exiting")
2392
print("", file=sys.stderr)
2393
logger.debug("Server received KeyboardInterrupt")
2394
logger.debug("Server exiting")
2043
2395
# Must run before the D-Bus bus name gets deregistered
2044
2396
cleanup()
2045
2397
2398
2046
2399
if __name__ == '__main__':
2047
2400
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0