To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 525
- compare with another revision
- download diff
- download tarball
- view history from revision 525
- Committer: Björn Påhlsson
- Date: 2011-12-21 00:33:12 UTC
- mfrom: (505.2.13 mandos-client-network-hooks)
- Revision ID: belorn@recompile.se-20111221003312-jwn6d76u2c2lejoz
working new feature: network-hooks - Enables user-scripts to take up
interfaces during bootup
interfaces during bootup
- files removed:
- debian/mandos-client.examples
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
37
import SocketServer as socketserver
40
38
import socket
41
39
import argparse
67
65
import types
68
66
import binascii
69
67
import tempfile
70
import itertools
71
import collections
72
68
73
69
import dbus
74
70
import dbus.service
79
75
import ctypes.util
80
76
import xml.dom.minidom
81
77
import inspect
78
import GnuPGInterface
82
79
83
80
try:
84
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
85
except ImportError:
89
86
SO_BINDTODEVICE = None
90
87
91
version = "1.6.0"
88
version = "1.4.1"
92
89
stored_state_file = "clients.pickle"
93
90
94
91
logger = logging.getLogger()
113
110
return interface_index
114
111
115
112
116
def initlogger(debug, level=logging.WARNING):
113
def initlogger(level=logging.WARNING):
117
114
"""init logger and add loglevel"""
118
115
119
116
syslogger.setFormatter(logging.Formatter
121
118
' %(message)s'))
122
119
logger.addHandler(syslogger)
123
120
124
if debug:
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
' [%(process)d]:'
128
' %(levelname)s:'
129
' %(message)s'))
130
logger.addHandler(console)
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
123
' [%(process)d]:'
124
' %(levelname)s:'
125
' %(message)s'))
126
logger.addHandler(console)
131
127
logger.setLevel(level)
132
128
133
129
139
135
class PGPEngine(object):
140
136
"""A simple class for OpenPGP symmetric encryption & decryption"""
141
137
def __init__(self):
138
self.gnupg = GnuPGInterface.GnuPG()
142
139
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
self.gnupgargs = ['--batch',
144
'--home', self.tempdir,
145
'--force-mdc',
146
'--quiet',
147
'--no-use-agent']
140
self.gnupg = GnuPGInterface.GnuPG()
141
self.gnupg.options.meta_interactive = False
142
self.gnupg.options.homedir = self.tempdir
143
self.gnupg.options.extra_args.extend(['--force-mdc',
144
'--quiet'])
148
145
149
146
def __enter__(self):
150
147
return self
151
148
152
def __exit__(self, exc_type, exc_value, traceback):
149
def __exit__ (self, exc_type, exc_value, traceback):
153
150
self._cleanup()
154
151
return False
155
152
175
172
return b"mandos" + binascii.hexlify(password)
176
173
177
174
def encrypt(self, data, password):
178
passphrase = self.password_encode(password)
179
with tempfile.NamedTemporaryFile(dir=self.tempdir
180
) as passfile:
181
passfile.write(passphrase)
182
passfile.flush()
183
proc = subprocess.Popen(['gpg', '--symmetric',
184
'--passphrase-file',
185
passfile.name]
186
+ self.gnupgargs,
187
stdin = subprocess.PIPE,
188
stdout = subprocess.PIPE,
189
stderr = subprocess.PIPE)
190
ciphertext, err = proc.communicate(input = data)
191
if proc.returncode != 0:
192
raise PGPError(err)
175
self.gnupg.passphrase = self.password_encode(password)
176
with open(os.devnull) as devnull:
177
try:
178
proc = self.gnupg.run(['--symmetric'],
179
create_fhs=['stdin', 'stdout'],
180
attach_fhs={'stderr': devnull})
181
with contextlib.closing(proc.handles['stdin']) as f:
182
f.write(data)
183
with contextlib.closing(proc.handles['stdout']) as f:
184
ciphertext = f.read()
185
proc.wait()
186
except IOError as e:
187
raise PGPError(e)
188
self.gnupg.passphrase = None
193
189
return ciphertext
194
190
195
191
def decrypt(self, data, password):
196
passphrase = self.password_encode(password)
197
with tempfile.NamedTemporaryFile(dir = self.tempdir
198
) as passfile:
199
passfile.write(passphrase)
200
passfile.flush()
201
proc = subprocess.Popen(['gpg', '--decrypt',
202
'--passphrase-file',
203
passfile.name]
204
+ self.gnupgargs,
205
stdin = subprocess.PIPE,
206
stdout = subprocess.PIPE,
207
stderr = subprocess.PIPE)
208
decrypted_plaintext, err = proc.communicate(input
209
= data)
210
if proc.returncode != 0:
211
raise PGPError(err)
192
self.gnupg.passphrase = self.password_encode(password)
193
with open(os.devnull) as devnull:
194
try:
195
proc = self.gnupg.run(['--decrypt'],
196
create_fhs=['stdin', 'stdout'],
197
attach_fhs={'stderr': devnull})
198
with contextlib.closing(proc.handles['stdin'] ) as f:
199
f.write(data)
200
with contextlib.closing(proc.handles['stdout']) as f:
201
decrypted_plaintext = f.read()
202
proc.wait()
203
except IOError as e:
204
raise PGPError(e)
205
self.gnupg.passphrase = None
212
206
return decrypted_plaintext
213
207
214
208
209
215
210
class AvahiError(Exception):
216
211
def __init__(self, value, *args, **kwargs):
217
212
self.value = value
234
229
Used to optionally bind to the specified interface.
235
230
name: string; Example: 'Mandos'
236
231
type: string; Example: '_mandos._tcp'.
237
See <https://www.iana.org/assignments/service-names-port-numbers>
232
See <http://www.dns-sd.org/ServiceTypes.html>
238
233
port: integer; what port to announce
239
234
TXT: list of strings; TXT record for the service
240
235
domain: string; Domain to publish on, default to .local if empty.
246
241
server: D-Bus Server
247
242
bus: dbus.SystemBus()
248
243
"""
249
250
244
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
245
servicetype = None, port = None, TXT = None,
252
246
domain = "", host = "", max_renames = 32768,
265
259
self.server = None
266
260
self.bus = bus
267
261
self.entry_group_state_changed_match = None
268
269
262
def rename(self):
270
263
"""Derived from the Avahi example code"""
271
264
if self.rename_count >= self.max_renames:
281
274
try:
282
275
self.add()
283
276
except dbus.exceptions.DBusException as error:
284
logger.critical("D-Bus Exception", exc_info=error)
277
logger.critical("DBusException: %s", error)
285
278
self.cleanup()
286
279
os._exit(1)
287
280
self.rename_count += 1
288
289
281
def remove(self):
290
282
"""Derived from the Avahi example code"""
291
283
if self.entry_group_state_changed_match is not None:
293
285
self.entry_group_state_changed_match = None
294
286
if self.group is not None:
295
287
self.group.Reset()
296
297
288
def add(self):
298
289
"""Derived from the Avahi example code"""
299
290
self.remove()
316
307
dbus.UInt16(self.port),
317
308
avahi.string_array_to_txt_array(self.TXT))
318
309
self.group.Commit()
319
320
310
def entry_group_state_changed(self, state, error):
321
311
"""Derived from the Avahi example code"""
322
312
logger.debug("Avahi entry group state change: %i", state)
329
319
elif state == avahi.ENTRY_GROUP_FAILURE:
330
320
logger.critical("Avahi: Error in group state changed %s",
331
321
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
334
322
raise AvahiGroupError("State changed: %s"
323
% unicode(error))
335
324
def cleanup(self):
336
325
"""Derived from the Avahi example code"""
337
326
if self.group is not None:
342
331
pass
343
332
self.group = None
344
333
self.remove()
345
346
334
def server_state_changed(self, state, error=None):
347
335
"""Derived from the Avahi example code"""
348
336
logger.debug("Avahi server state change: %i", state)
367
355
logger.debug("Unknown state: %r", state)
368
356
else:
369
357
logger.debug("Unknown state: %r: %r", state, error)
370
371
358
def activate(self):
372
359
"""Derived from the Avahi example code"""
373
360
if self.server is None:
380
367
self.server_state_changed)
381
368
self.server_state_changed(self.server.GetState())
382
369
383
384
370
class AvahiServiceToSyslog(AvahiService):
385
371
def rename(self):
386
372
"""Add the new name to the syslog messages"""
387
373
ret = AvahiService.rename(self)
388
374
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
377
% self.name))
392
378
return ret
393
379
394
395
380
def timedelta_to_milliseconds(td):
396
381
"Convert a datetime.timedelta() to milliseconds"
397
382
return ((td.days * 24 * 60 * 60 * 1000)
398
383
+ (td.seconds * 1000)
399
384
+ (td.microseconds // 1000))
400
401
385
402
386
class Client(object):
403
387
"""A representation of a client host served by this server.
404
388
429
413
last_checked_ok: datetime.datetime(); (UTC) or None
430
414
last_checker_status: integer between 0 and 255 reflecting exit
431
415
status of last checker. -1 reflects crashed
432
checker, -2 means no checker completed yet.
416
checker, or None.
433
417
last_enabled: datetime.datetime(); (UTC) or None
434
418
name: string; from the config file, used in log messages and
435
419
D-Bus identifiers
436
420
secret: bytestring; sent verbatim (over TLS) to client
437
421
timeout: datetime.timedelta(); How long from last_checked_ok
438
422
until this client is disabled
439
extended_timeout: extra long timeout when secret has been sent
423
extended_timeout: extra long timeout when password has been sent
440
424
runtime_expansions: Allowed attributes for runtime expansion.
441
425
expires: datetime.datetime(); time (UTC) when a client will be
442
426
disabled, or None
443
server_settings: The server_settings dict from main()
444
427
"""
445
428
446
429
runtime_expansions = ("approval_delay", "approval_duration",
447
"created", "enabled", "expires",
448
"fingerprint", "host", "interval",
449
"last_approval_request", "last_checked_ok",
430
"created", "enabled", "fingerprint",
431
"host", "interval", "last_checked_ok",
450
432
"last_enabled", "name", "timeout")
451
client_defaults = { "timeout": "PT5M",
452
"extended_timeout": "PT15M",
453
"interval": "PT2M",
433
client_defaults = { "timeout": "5m",
434
"extended_timeout": "15m",
435
"interval": "2m",
454
436
"checker": "fping -q -- %%(host)s",
455
437
"host": "",
456
"approval_delay": "PT0S",
457
"approval_duration": "PT1S",
438
"approval_delay": "0s",
439
"approval_duration": "1s",
458
440
"approved_by_default": "True",
459
441
"enabled": "True",
460
442
}
473
455
474
456
def approval_delay_milliseconds(self):
475
457
return timedelta_to_milliseconds(self.approval_delay)
476
458
477
459
@staticmethod
478
460
def config_parser(config):
479
"""Construct a new dict of client settings of this form:
461
""" Construct a new dict of client settings of this form:
480
462
{ client_name: {setting_name: value, ...}, ...}
481
with exceptions for any special settings as defined above.
482
NOTE: Must be a pure function. Must return the same result
483
value given the same arguments.
484
"""
463
with exceptions for any special settings as defined above"""
485
464
settings = {}
486
465
for client_name in config.sections():
487
466
section = dict(config.items(client_name))
491
470
# Reformat values from string types to Python types
492
471
client["approved_by_default"] = config.getboolean(
493
472
client_name, "approved_by_default")
494
client["enabled"] = config.getboolean(client_name,
495
"enabled")
473
client["enabled"] = config.getboolean(client_name, "enabled")
496
474
497
475
client["fingerprint"] = (section["fingerprint"].upper()
498
476
.replace(" ", ""))
504
482
"rb") as secfile:
505
483
client["secret"] = secfile.read()
506
484
else:
507
raise TypeError("No secret or secfile for section {0}"
508
.format(section))
485
raise TypeError("No secret or secfile for section %s"
486
% section)
509
487
client["timeout"] = string_to_delta(section["timeout"])
510
488
client["extended_timeout"] = string_to_delta(
511
489
section["extended_timeout"])
517
495
client["checker_command"] = section["checker"]
518
496
client["last_approval_request"] = None
519
497
client["last_checked_ok"] = None
520
client["last_checker_status"] = -2
521
498
client["last_checker_status"] = None
499
if client["enabled"]:
500
client["last_enabled"] = datetime.datetime.utcnow()
501
client["expires"] = (datetime.datetime.utcnow()
502
+ client["timeout"])
503
else:
504
client["last_enabled"] = None
505
client["expires"] = None
506
522
507
return settings
523
524
def __init__(self, settings, name = None, server_settings=None):
508
509
510
def __init__(self, settings, name = None):
511
"""Note: the 'checker' key in 'config' sets the
512
'checker_command' attribute and *not* the 'checker'
513
attribute."""
525
514
self.name = name
526
if server_settings is None:
527
server_settings = {}
528
self.server_settings = server_settings
529
515
# adding all client settings
530
516
for setting, value in settings.iteritems():
531
517
setattr(self, setting, value)
532
518
533
if self.enabled:
534
if not hasattr(self, "last_enabled"):
535
self.last_enabled = datetime.datetime.utcnow()
536
if not hasattr(self, "expires"):
537
self.expires = (datetime.datetime.utcnow()
538
+ self.timeout)
539
else:
540
self.last_enabled = None
541
self.expires = None
542
543
519
logger.debug("Creating client %r", self.name)
544
520
# Uppercase and remove spaces from fingerprint for later
545
521
# comparison purposes with return value from the fingerprint()
546
522
# function
547
523
logger.debug(" Fingerprint: %s", self.fingerprint)
548
self.created = settings.get("created",
549
datetime.datetime.utcnow())
550
524
self.created = settings.get("created", datetime.datetime.utcnow())
525
551
526
# attributes specific for this server instance
552
527
self.checker = None
553
528
self.checker_initiator_tag = None
581
556
if getattr(self, "enabled", False):
582
557
# Already enabled
583
558
return
559
self.send_changedstate()
584
560
self.expires = datetime.datetime.utcnow() + self.timeout
585
561
self.enabled = True
586
562
self.last_enabled = datetime.datetime.utcnow()
587
563
self.init_checker()
588
self.send_changedstate()
589
564
590
565
def disable(self, quiet=True):
591
566
"""Disable this client."""
592
567
if not getattr(self, "enabled", False):
593
568
return False
594
569
if not quiet:
570
self.send_changedstate()
571
if not quiet:
595
572
logger.info("Disabling client %s", self.name)
596
if getattr(self, "disable_initiator_tag", None) is not None:
573
if getattr(self, "disable_initiator_tag", False):
597
574
gobject.source_remove(self.disable_initiator_tag)
598
575
self.disable_initiator_tag = None
599
576
self.expires = None
600
if getattr(self, "checker_initiator_tag", None) is not None:
577
if getattr(self, "checker_initiator_tag", False):
601
578
gobject.source_remove(self.checker_initiator_tag)
602
579
self.checker_initiator_tag = None
603
580
self.stop_checker()
604
581
self.enabled = False
605
if not quiet:
606
self.send_changedstate()
607
582
# Do not run this again if called by a gobject.timeout_add
608
583
return False
609
584
613
588
def init_checker(self):
614
589
# Schedule a new checker to be started an 'interval' from now,
615
590
# and every interval from then on.
616
if self.checker_initiator_tag is not None:
617
gobject.source_remove(self.checker_initiator_tag)
618
591
self.checker_initiator_tag = (gobject.timeout_add
619
592
(self.interval_milliseconds(),
620
593
self.start_checker))
621
594
# Schedule a disable() when 'timeout' has passed
622
if self.disable_initiator_tag is not None:
623
gobject.source_remove(self.disable_initiator_tag)
624
595
self.disable_initiator_tag = (gobject.timeout_add
625
596
(self.timeout_milliseconds(),
626
597
self.disable))
645
616
logger.warning("Checker for %(name)s crashed?",
646
617
vars(self))
647
618
648
def checked_ok(self):
649
"""Assert that the client has been seen, alive and well."""
650
self.last_checked_ok = datetime.datetime.utcnow()
651
self.last_checker_status = 0
652
self.bump_timeout()
653
654
def bump_timeout(self, timeout=None):
655
"""Bump up the timeout for this client."""
619
def checked_ok(self, timeout=None):
620
"""Bump up the timeout for this client.
621
622
This should only be called when the client has been seen,
623
alive and well.
624
"""
656
625
if timeout is None:
657
626
timeout = self.timeout
627
self.last_checked_ok = datetime.datetime.utcnow()
658
628
if self.disable_initiator_tag is not None:
659
629
gobject.source_remove(self.disable_initiator_tag)
660
self.disable_initiator_tag = None
661
630
if getattr(self, "enabled", False):
662
631
self.disable_initiator_tag = (gobject.timeout_add
663
632
(timedelta_to_milliseconds
673
642
If a checker already exists, leave it running and do
674
643
nothing."""
675
644
# The reason for not killing a running checker is that if we
676
# did that, and if a checker (for some reason) started running
677
# slowly and taking more than 'interval' time, then the client
678
# would inevitably timeout, since no checker would get a
679
# chance to run to completion. If we instead leave running
645
# did that, then if a checker (for some reason) started
646
# running slowly and taking more than 'interval' time, the
647
# client would inevitably timeout, since no checker would get
648
# a chance to run to completion. If we instead leave running
680
649
# checkers alone, the checker would have to take more time
681
650
# than 'timeout' for the client to be disabled, which is as it
682
651
# should be.
696
665
self.current_checker_command)
697
666
# Start a new checker if needed
698
667
if self.checker is None:
699
# Escape attributes for the shell
700
escaped_attrs = dict(
701
(attr, re.escape(unicode(getattr(self, attr))))
702
for attr in
703
self.runtime_expansions)
704
668
try:
705
command = self.checker_command % escaped_attrs
706
except TypeError as error:
707
logger.error('Could not format string "%s"',
708
self.checker_command, exc_info=error)
709
return True # Try again later
669
# In case checker_command has exactly one % operator
670
command = self.checker_command % self.host
671
except TypeError:
672
# Escape attributes for the shell
673
escaped_attrs = dict(
674
(attr,
675
re.escape(unicode(str(getattr(self, attr, "")),
676
errors=
677
'replace')))
678
for attr in
679
self.runtime_expansions)
680
681
try:
682
command = self.checker_command % escaped_attrs
683
except TypeError as error:
684
logger.error('Could not format string "%s":'
685
' %s', self.checker_command, error)
686
return True # Try again later
710
687
self.current_checker_command = command
711
688
try:
712
689
logger.info("Starting checker %r for %s",
715
692
# in normal mode, that is already done by daemon(),
716
693
# and in debug mode we don't want to. (Stdin is
717
694
# always replaced by /dev/null.)
718
# The exception is when not debugging but nevertheless
719
# running in the foreground; use the previously
720
# created wnull.
721
popen_args = {}
722
if (not self.server_settings["debug"]
723
and self.server_settings["foreground"]):
724
popen_args.update({"stdout": wnull,
725
"stderr": wnull })
726
695
self.checker = subprocess.Popen(command,
727
696
close_fds=True,
728
shell=True, cwd="/",
729
**popen_args)
730
except OSError as error:
731
logger.error("Failed to start subprocess",
732
exc_info=error)
733
return True
734
self.checker_callback_tag = (gobject.child_watch_add
735
(self.checker.pid,
736
self.checker_callback,
737
data=command))
738
# The checker may have completed before the gobject
739
# watch was added. Check for this.
740
try:
697
shell=True, cwd="/")
698
self.checker_callback_tag = (gobject.child_watch_add
699
(self.checker.pid,
700
self.checker_callback,
701
data=command))
702
# The checker may have completed before the gobject
703
# watch was added. Check for this.
741
704
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
705
if pid:
706
gobject.source_remove(self.checker_callback_tag)
707
self.checker_callback(pid, status, command)
742
708
except OSError as error:
743
if error.errno == errno.ECHILD:
744
# This should never happen
745
logger.error("Child process vanished",
746
exc_info=error)
747
return True
748
raise
749
if pid:
750
gobject.source_remove(self.checker_callback_tag)
751
self.checker_callback(pid, status, command)
709
logger.error("Failed to start subprocess: %s",
710
error)
752
711
# Re-run this periodically if run by gobject.timeout_add
753
712
return True
754
713
761
720
return
762
721
logger.debug("Stopping checker for %(name)s", vars(self))
763
722
try:
764
self.checker.terminate()
723
os.kill(self.checker.pid, signal.SIGTERM)
765
724
#time.sleep(0.5)
766
725
#if self.checker.poll() is None:
767
# self.checker.kill()
726
# os.kill(self.checker.pid, signal.SIGKILL)
768
727
except OSError as error:
769
728
if error.errno != errno.ESRCH: # No such process
770
729
raise
787
746
# "Set" method, so we fail early here:
788
747
if byte_arrays and signature != "ay":
789
748
raise ValueError("Byte arrays not supported for non-'ay'"
790
" signature {0!r}".format(signature))
749
" signature %r" % signature)
791
750
def decorator(func):
792
751
func._dbus_is_property = True
793
752
func._dbus_interface = dbus_interface
801
760
return decorator
802
761
803
762
804
def dbus_interface_annotations(dbus_interface):
805
"""Decorator for marking functions returning interface annotations
806
807
Usage:
808
809
@dbus_interface_annotations("org.example.Interface")
810
def _foo(self): # Function name does not matter
811
return {"org.freedesktop.DBus.Deprecated": "true",
812
"org.freedesktop.DBus.Property.EmitsChangedSignal":
813
"false"}
814
"""
815
def decorator(func):
816
func._dbus_is_interface = True
817
func._dbus_interface = dbus_interface
818
func._dbus_name = dbus_interface
819
return func
820
return decorator
821
822
823
def dbus_annotations(annotations):
824
"""Decorator to annotate D-Bus methods, signals or properties
825
Usage:
826
827
@dbus_service_property("org.example.Interface", signature="b",
828
access="r")
829
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
830
"org.freedesktop.DBus.Property."
831
"EmitsChangedSignal": "false"})
832
def Property_dbus_property(self):
833
return dbus.Boolean(False)
834
"""
835
def decorator(func):
836
func._dbus_annotations = annotations
837
return func
838
return decorator
839
840
841
763
class DBusPropertyException(dbus.exceptions.DBusException):
842
764
"""A base class for D-Bus property-related exceptions
843
765
"""
866
788
"""
867
789
868
790
@staticmethod
869
def _is_dbus_thing(thing):
870
"""Returns a function testing if an attribute is a D-Bus thing
871
872
If called like _is_dbus_thing("method") it returns a function
873
suitable for use as predicate to inspect.getmembers().
874
"""
875
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
876
False)
791
def _is_dbus_property(obj):
792
return getattr(obj, "_dbus_is_property", False)
877
793
878
def _get_all_dbus_things(self, thing):
794
def _get_all_dbus_properties(self):
879
795
"""Returns a generator of (name, attribute) pairs
880
796
"""
881
return ((getattr(athing.__get__(self), "_dbus_name",
882
name),
883
athing.__get__(self))
797
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
884
798
for cls in self.__class__.__mro__
885
for name, athing in
886
inspect.getmembers(cls,
887
self._is_dbus_thing(thing)))
799
for name, prop in
800
inspect.getmembers(cls, self._is_dbus_property))
888
801
889
802
def _get_dbus_property(self, interface_name, property_name):
890
803
"""Returns a bound method if one exists which is a D-Bus
892
805
"""
893
806
for cls in self.__class__.__mro__:
894
807
for name, value in (inspect.getmembers
895
(cls,
896
self._is_dbus_thing("property"))):
808
(cls, self._is_dbus_property)):
897
809
if (value._dbus_name == property_name
898
810
and value._dbus_interface == interface_name):
899
811
return value.__get__(self)
928
840
# signatures other than "ay".
929
841
if prop._dbus_signature != "ay":
930
842
raise ValueError
931
value = dbus.ByteArray(b''.join(chr(byte)
932
for byte in value))
843
value = dbus.ByteArray(''.join(unichr(byte)
844
for byte in value))
933
845
prop(value)
934
846
935
847
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
941
853
Note: Will not include properties with access="write".
942
854
"""
943
855
properties = {}
944
for name, prop in self._get_all_dbus_things("property"):
856
for name, prop in self._get_all_dbus_properties():
945
857
if (interface_name
946
858
and interface_name != prop._dbus_interface):
947
859
# Interface non-empty but did not match
962
874
path_keyword='object_path',
963
875
connection_keyword='connection')
964
876
def Introspect(self, object_path, connection):
965
"""Overloading of standard D-Bus method.
966
967
Inserts property tags and interface annotation tags.
877
"""Standard D-Bus method, overloaded to insert property tags.
968
878
"""
969
879
xmlstring = dbus.service.Object.Introspect(self, object_path,
970
880
connection)
977
887
e.setAttribute("access", prop._dbus_access)
978
888
return e
979
889
for if_tag in document.getElementsByTagName("interface"):
980
# Add property tags
981
890
for tag in (make_tag(document, name, prop)
982
891
for name, prop
983
in self._get_all_dbus_things("property")
892
in self._get_all_dbus_properties()
984
893
if prop._dbus_interface
985
894
== if_tag.getAttribute("name")):
986
895
if_tag.appendChild(tag)
987
# Add annotation tags
988
for typ in ("method", "signal", "property"):
989
for tag in if_tag.getElementsByTagName(typ):
990
annots = dict()
991
for name, prop in (self.
992
_get_all_dbus_things(typ)):
993
if (name == tag.getAttribute("name")
994
and prop._dbus_interface
995
== if_tag.getAttribute("name")):
996
annots.update(getattr
997
(prop,
998
"_dbus_annotations",
999
{}))
1000
for name, value in annots.iteritems():
1001
ann_tag = document.createElement(
1002
"annotation")
1003
ann_tag.setAttribute("name", name)
1004
ann_tag.setAttribute("value", value)
1005
tag.appendChild(ann_tag)
1006
# Add interface annotation tags
1007
for annotation, value in dict(
1008
itertools.chain.from_iterable(
1009
annotations().iteritems()
1010
for name, annotations in
1011
self._get_all_dbus_things("interface")
1012
if name == if_tag.getAttribute("name")
1013
)).iteritems():
1014
ann_tag = document.createElement("annotation")
1015
ann_tag.setAttribute("name", annotation)
1016
ann_tag.setAttribute("value", value)
1017
if_tag.appendChild(ann_tag)
1018
896
# Add the names to the return values for the
1019
897
# "org.freedesktop.DBus.Properties" methods
1020
898
if (if_tag.getAttribute("name")
1035
913
except (AttributeError, xml.dom.DOMException,
1036
914
xml.parsers.expat.ExpatError) as error:
1037
915
logger.error("Failed to override Introspection method",
1038
exc_info=error)
916
error)
1039
917
return xmlstring
1040
918
1041
919
1042
def datetime_to_dbus(dt, variant_level=0):
920
def datetime_to_dbus (dt, variant_level=0):
1043
921
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1044
922
if dt is None:
1045
923
return dbus.String("", variant_level = variant_level)
1047
925
variant_level=variant_level)
1048
926
1049
927
1050
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1051
"""A class decorator; applied to a subclass of
1052
dbus.service.Object, it will add alternate D-Bus attributes with
1053
interface names according to the "alt_interface_names" mapping.
1054
Usage:
1055
1056
@alternate_dbus_interfaces({"org.example.Interface":
1057
"net.example.AlternateInterface"})
1058
class SampleDBusObject(dbus.service.Object):
1059
@dbus.service.method("org.example.Interface")
1060
def SampleDBusMethod():
1061
pass
1062
1063
The above "SampleDBusMethod" on "SampleDBusObject" will be
1064
reachable via two interfaces: "org.example.Interface" and
1065
"net.example.AlternateInterface", the latter of which will have
1066
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1067
"true", unless "deprecate" is passed with a False value.
1068
1069
This works for methods and signals, and also for D-Bus properties
1070
(from DBusObjectWithProperties) and interfaces (from the
1071
dbus_interface_annotations decorator).
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
929
.__metaclass__):
930
"""Applied to an empty subclass of a D-Bus object, this metaclass
931
will add additional D-Bus attributes matching a certain pattern.
1072
932
"""
1073
def wrapper(cls):
1074
for orig_interface_name, alt_interface_name in (
1075
alt_interface_names.iteritems()):
1076
attr = {}
1077
interface_names = set()
1078
# Go though all attributes of the class
1079
for attrname, attribute in inspect.getmembers(cls):
933
def __new__(mcs, name, bases, attr):
934
# Go through all the base classes which could have D-Bus
935
# methods, signals, or properties in them
936
for base in (b for b in bases
937
if issubclass(b, dbus.service.Object)):
938
# Go though all attributes of the base class
939
for attrname, attribute in inspect.getmembers(base):
1080
940
# Ignore non-D-Bus attributes, and D-Bus attributes
1081
941
# with the wrong interface name
1082
942
if (not hasattr(attribute, "_dbus_interface")
1083
943
or not attribute._dbus_interface
1084
.startswith(orig_interface_name)):
944
.startswith("se.recompile.Mandos")):
1085
945
continue
1086
946
# Create an alternate D-Bus interface name based on
1087
947
# the current name
1088
948
alt_interface = (attribute._dbus_interface
1089
.replace(orig_interface_name,
1090
alt_interface_name))
1091
interface_names.add(alt_interface)
949
.replace("se.recompile.Mandos",
950
"se.bsnet.fukt.Mandos"))
1092
951
# Is this a D-Bus signal?
1093
952
if getattr(attribute, "_dbus_is_signal", False):
1094
# Extract the original non-method undecorated
1095
# function by black magic
953
# Extract the original non-method function by
954
# black magic
1096
955
nonmethod_func = (dict(
1097
956
zip(attribute.func_code.co_freevars,
1098
957
attribute.__closure__))["func"]
1109
968
nonmethod_func.func_name,
1110
969
nonmethod_func.func_defaults,
1111
970
nonmethod_func.func_closure)))
1112
# Copy annotations, if any
1113
try:
1114
new_function._dbus_annotations = (
1115
dict(attribute._dbus_annotations))
1116
except AttributeError:
1117
pass
1118
971
# Define a creator of a function to call both the
1119
# original and alternate functions, so both the
1120
# original and alternate signals gets sent when
1121
# the function is called
972
# old and new functions, so both the old and new
973
# signals gets sent when the function is called
1122
974
def fixscope(func1, func2):
1123
975
"""This function is a scope container to pass
1124
976
func1 and func2 to the "call_both" function
1131
983
return call_both
1132
984
# Create the "call_both" function and add it to
1133
985
# the class
1134
attr[attrname] = fixscope(attribute, new_function)
986
attr[attrname] = fixscope(attribute,
987
new_function)
1135
988
# Is this a D-Bus method?
1136
989
elif getattr(attribute, "_dbus_is_method", False):
1137
990
# Create a new, but exactly alike, function
1148
1001
attribute.func_name,
1149
1002
attribute.func_defaults,
1150
1003
attribute.func_closure)))
1151
# Copy annotations, if any
1152
try:
1153
attr[attrname]._dbus_annotations = (
1154
dict(attribute._dbus_annotations))
1155
except AttributeError:
1156
pass
1157
1004
# Is this a D-Bus property?
1158
1005
elif getattr(attribute, "_dbus_is_property", False):
1159
1006
# Create a new, but exactly alike, function
1173
1020
attribute.func_name,
1174
1021
attribute.func_defaults,
1175
1022
attribute.func_closure)))
1176
# Copy annotations, if any
1177
try:
1178
attr[attrname]._dbus_annotations = (
1179
dict(attribute._dbus_annotations))
1180
except AttributeError:
1181
pass
1182
# Is this a D-Bus interface?
1183
elif getattr(attribute, "_dbus_is_interface", False):
1184
# Create a new, but exactly alike, function
1185
# object. Decorate it to be a new D-Bus interface
1186
# with the alternate D-Bus interface name. Add it
1187
# to the class.
1188
attr[attrname] = (dbus_interface_annotations
1189
(alt_interface)
1190
(types.FunctionType
1191
(attribute.func_code,
1192
attribute.func_globals,
1193
attribute.func_name,
1194
attribute.func_defaults,
1195
attribute.func_closure)))
1196
if deprecate:
1197
# Deprecate all alternate interfaces
1198
iname="_AlternateDBusNames_interface_annotation{0}"
1199
for interface_name in interface_names:
1200
@dbus_interface_annotations(interface_name)
1201
def func(self):
1202
return { "org.freedesktop.DBus.Deprecated":
1203
"true" }
1204
# Find an unused name
1205
for aname in (iname.format(i)
1206
for i in itertools.count()):
1207
if aname not in attr:
1208
attr[aname] = func
1209
break
1210
if interface_names:
1211
# Replace the class with a new subclass of it with
1212
# methods, signals, etc. as created above.
1213
cls = type(b"{0}Alternate".format(cls.__name__),
1214
(cls,), attr)
1215
return cls
1216
return wrapper
1217
1218
1219
@alternate_dbus_interfaces({"se.recompile.Mandos":
1220
"se.bsnet.fukt.Mandos"})
1023
return type.__new__(mcs, name, bases, attr)
1024
1025
1221
1026
class ClientDBus(Client, DBusObjectWithProperties):
1222
1027
"""A Client class using D-Bus
1223
1028
1234
1039
def __init__(self, bus = None, *args, **kwargs):
1235
1040
self.bus = bus
1236
1041
Client.__init__(self, *args, **kwargs)
1042
self._approvals_pending = 0
1043
1044
self._approvals_pending = 0
1237
1045
# Only now, when this client is initialized, can it show up on
1238
1046
# the D-Bus
1239
1047
client_object_name = unicode(self.name).translate(
1243
1051
("/clients/" + client_object_name))
1244
1052
DBusObjectWithProperties.__init__(self, self.bus,
1245
1053
self.dbus_object_path)
1246
1054
1247
1055
def notifychangeproperty(transform_func,
1248
1056
dbus_name, type_func=lambda x: x,
1249
1057
variant_level=1):
1272
1080
1273
1081
return property(lambda self: getattr(self, attrname), setter)
1274
1082
1083
1275
1084
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1276
1085
approvals_pending = notifychangeproperty(dbus.Boolean,
1277
1086
"ApprovalPending",
1284
1093
checker is not None)
1285
1094
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1286
1095
"LastCheckedOK")
1287
last_checker_status = notifychangeproperty(dbus.Int16,
1288
"LastCheckerStatus")
1289
1096
last_approval_request = notifychangeproperty(
1290
1097
datetime_to_dbus, "LastApprovalRequest")
1291
1098
approved_by_default = notifychangeproperty(dbus.Boolean,
1359
1166
return False
1360
1167
1361
1168
def approve(self, value=True):
1169
self.send_changedstate()
1362
1170
self.approved = value
1363
1171
gobject.timeout_add(timedelta_to_milliseconds
1364
1172
(self.approval_duration),
1365
1173
self._reset_approved)
1366
self.send_changedstate()
1174
1367
1175
1368
1176
## D-Bus methods, signals & properties
1369
1177
_interface = "se.recompile.Mandos.Client"
1370
1178
1371
## Interfaces
1372
1373
@dbus_interface_annotations(_interface)
1374
def _foo(self):
1375
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1376
"false"}
1377
1378
1179
## Signals
1379
1180
1380
1181
# CheckerCompleted - signal
1416
1217
"D-Bus signal"
1417
1218
return self.need_approval()
1418
1219
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1223
"""D-Bus signal
1224
Is sent after a client request a password.
1225
"""
1226
pass
1227
1419
1228
## Methods
1420
1229
1421
1230
# Approve - method
1531
1340
return
1532
1341
return datetime_to_dbus(self.last_checked_ok)
1533
1342
1534
# LastCheckerStatus - property
1535
@dbus_service_property(_interface, signature="n",
1536
access="read")
1537
def LastCheckerStatus_dbus_property(self):
1538
return dbus.Int16(self.last_checker_status)
1539
1540
1343
# Expires - property
1541
1344
@dbus_service_property(_interface, signature="s", access="read")
1542
1345
def Expires_dbus_property(self):
1553
1356
def Timeout_dbus_property(self, value=None):
1554
1357
if value is None: # get
1555
1358
return dbus.UInt64(self.timeout_milliseconds())
1556
old_timeout = self.timeout
1557
1359
self.timeout = datetime.timedelta(0, 0, 0, value)
1558
# Reschedule disabling
1559
if self.enabled:
1560
now = datetime.datetime.utcnow()
1561
self.expires += self.timeout - old_timeout
1562
if self.expires <= now:
1563
# The timeout has passed
1564
self.disable()
1565
else:
1566
if (getattr(self, "disable_initiator_tag", None)
1567
is None):
1568
return
1569
gobject.source_remove(self.disable_initiator_tag)
1570
self.disable_initiator_tag = (
1571
gobject.timeout_add(
1572
timedelta_to_milliseconds(self.expires - now),
1573
self.disable))
1360
if getattr(self, "disable_initiator_tag", None) is None:
1361
return
1362
# Reschedule timeout
1363
gobject.source_remove(self.disable_initiator_tag)
1364
self.disable_initiator_tag = None
1365
self.expires = None
1366
time_to_die = timedelta_to_milliseconds((self
1367
.last_checked_ok
1368
+ self.timeout)
1369
- datetime.datetime
1370
.utcnow())
1371
if time_to_die <= 0:
1372
# The timeout has passed
1373
self.disable()
1374
else:
1375
self.expires = (datetime.datetime.utcnow()
1376
+ datetime.timedelta(milliseconds =
1377
time_to_die))
1378
self.disable_initiator_tag = (gobject.timeout_add
1379
(time_to_die, self.disable))
1574
1380
1575
1381
# ExtendedTimeout - property
1576
1382
@dbus_service_property(_interface, signature="t",
1655
1461
self._pipe.send(('setattr', name, value))
1656
1462
1657
1463
1464
class ClientDBusTransitional(ClientDBus):
1465
__metaclass__ = AlternateDBusNamesMetaclass
1466
1467
1658
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1659
1469
"""A class to handle client connections.
1660
1470
1728
1538
except KeyError:
1729
1539
return
1730
1540
1541
if self.server.use_dbus:
1542
# Emit D-Bus signal
1543
client.NewRequest(str(self.client_address))
1544
1731
1545
if client.approval_delay:
1732
1546
delay = client.approval_delay
1733
1547
client.approvals_pending += 1
1764
1578
#wait until timeout or approved
1765
1579
time = datetime.datetime.now()
1766
1580
client.changedstate.acquire()
1767
client.changedstate.wait(
1768
float(timedelta_to_milliseconds(delay)
1769
/ 1000))
1581
(client.changedstate.wait
1582
(float(client.timedelta_to_milliseconds(delay)
1583
/ 1000)))
1770
1584
client.changedstate.release()
1771
1585
time2 = datetime.datetime.now()
1772
1586
if (time2 - time) >= delay:
1788
1602
try:
1789
1603
sent = session.send(client.secret[sent_size:])
1790
1604
except gnutls.errors.GNUTLSError as error:
1791
logger.warning("gnutls send failed",
1792
exc_info=error)
1605
logger.warning("gnutls send failed")
1793
1606
return
1794
1607
logger.debug("Sent: %d, remaining: %d",
1795
1608
sent, len(client.secret)
1798
1611
1799
1612
logger.info("Sending secret to %s", client.name)
1800
1613
# bump the timeout using extended_timeout
1801
client.bump_timeout(client.extended_timeout)
1614
client.checked_ok(client.extended_timeout)
1802
1615
if self.server.use_dbus:
1803
1616
# Emit D-Bus signal
1804
1617
client.GotSecret()
1809
1622
try:
1810
1623
session.bye()
1811
1624
except gnutls.errors.GNUTLSError as error:
1812
logger.warning("GnuTLS bye failed",
1813
exc_info=error)
1625
logger.warning("GnuTLS bye failed")
1814
1626
1815
1627
@staticmethod
1816
1628
def peer_certificate(session):
1888
1700
def process_request(self, request, address):
1889
1701
"""Start a new process to process the request."""
1890
1702
proc = multiprocessing.Process(target = self.sub_process_main,
1891
args = (request, address))
1703
args = (request,
1704
address))
1892
1705
proc.start()
1893
1706
return proc
1894
1707
1922
1735
use_ipv6: Boolean; to use IPv6 or not
1923
1736
"""
1924
1737
def __init__(self, server_address, RequestHandlerClass,
1925
interface=None, use_ipv6=True, socketfd=None):
1926
"""If socketfd is set, use that file descriptor instead of
1927
creating a new one with socket.socket().
1928
"""
1738
interface=None, use_ipv6=True):
1929
1739
self.interface = interface
1930
1740
if use_ipv6:
1931
1741
self.address_family = socket.AF_INET6
1932
if socketfd is not None:
1933
# Save the file descriptor
1934
self.socketfd = socketfd
1935
# Save the original socket.socket() function
1936
self.socket_socket = socket.socket
1937
# To implement --socket, we monkey patch socket.socket.
1938
#
1939
# (When socketserver.TCPServer is a new-style class, we
1940
# could make self.socket into a property instead of monkey
1941
# patching socket.socket.)
1942
#
1943
# Create a one-time-only replacement for socket.socket()
1944
@functools.wraps(socket.socket)
1945
def socket_wrapper(*args, **kwargs):
1946
# Restore original function so subsequent calls are
1947
# not affected.
1948
socket.socket = self.socket_socket
1949
del self.socket_socket
1950
# This time only, return a new socket object from the
1951
# saved file descriptor.
1952
return socket.fromfd(self.socketfd, *args, **kwargs)
1953
# Replace socket.socket() function with wrapper
1954
socket.socket = socket_wrapper
1955
# The socketserver.TCPServer.__init__ will call
1956
# socket.socket(), which might be our replacement,
1957
# socket_wrapper(), if socketfd was set.
1958
1742
socketserver.TCPServer.__init__(self, server_address,
1959
1743
RequestHandlerClass)
1960
1961
1744
def server_bind(self):
1962
1745
"""This overrides the normal server_bind() function
1963
1746
to bind to an interface if one was specified, and also NOT to
1971
1754
try:
1972
1755
self.socket.setsockopt(socket.SOL_SOCKET,
1973
1756
SO_BINDTODEVICE,
1974
str(self.interface + '\0'))
1757
str(self.interface
1758
+ '\0'))
1975
1759
except socket.error as error:
1976
if error.errno == errno.EPERM:
1977
logger.error("No permission to bind to"
1978
" interface %s", self.interface)
1979
elif error.errno == errno.ENOPROTOOPT:
1760
if error[0] == errno.EPERM:
1761
logger.error("No permission to"
1762
" bind to interface %s",
1763
self.interface)
1764
elif error[0] == errno.ENOPROTOOPT:
1980
1765
logger.error("SO_BINDTODEVICE not available;"
1981
1766
" cannot bind to interface %s",
1982
1767
self.interface)
1983
elif error.errno == errno.ENODEV:
1984
logger.error("Interface %s does not exist,"
1985
" cannot bind", self.interface)
1986
1768
else:
1987
1769
raise
1988
1770
# Only bind(2) the socket if we really need to.
1991
1773
if self.address_family == socket.AF_INET6:
1992
1774
any_address = "::" # in6addr_any
1993
1775
else:
1994
any_address = "0.0.0.0" # INADDR_ANY
1776
any_address = socket.INADDR_ANY
1995
1777
self.server_address = (any_address,
1996
1778
self.server_address[1])
1997
1779
elif not self.server_address[1]:
2018
1800
"""
2019
1801
def __init__(self, server_address, RequestHandlerClass,
2020
1802
interface=None, use_ipv6=True, clients=None,
2021
gnutls_priority=None, use_dbus=True, socketfd=None):
1803
gnutls_priority=None, use_dbus=True):
2022
1804
self.enabled = False
2023
1805
self.clients = clients
2024
1806
if self.clients is None:
2028
1810
IPv6_TCPServer.__init__(self, server_address,
2029
1811
RequestHandlerClass,
2030
1812
interface = interface,
2031
use_ipv6 = use_ipv6,
2032
socketfd = socketfd)
1813
use_ipv6 = use_ipv6)
2033
1814
def server_activate(self):
2034
1815
if self.enabled:
2035
1816
return socketserver.TCPServer.server_activate(self)
2048
1829
2049
1830
def handle_ipc(self, source, condition, parent_pipe=None,
2050
1831
proc = None, client_object=None):
1832
condition_names = {
1833
gobject.IO_IN: "IN", # There is data to read.
1834
gobject.IO_OUT: "OUT", # Data can be written (without
1835
# blocking).
1836
gobject.IO_PRI: "PRI", # There is urgent data to read.
1837
gobject.IO_ERR: "ERR", # Error condition.
1838
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1839
# broken, usually for pipes and
1840
# sockets).
1841
}
1842
conditions_string = ' | '.join(name
1843
for cond, name in
1844
condition_names.iteritems()
1845
if cond & condition)
2051
1846
# error, or the other end of multiprocessing.Pipe has closed
2052
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1847
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2053
1848
# Wait for other process to exit
2054
1849
proc.join()
2055
1850
return False
2113
1908
return True
2114
1909
2115
1910
2116
def rfc3339_duration_to_delta(duration):
2117
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2118
2119
>>> rfc3339_duration_to_delta("P7D")
2120
datetime.timedelta(7)
2121
>>> rfc3339_duration_to_delta("PT60S")
2122
datetime.timedelta(0, 60)
2123
>>> rfc3339_duration_to_delta("PT60M")
2124
datetime.timedelta(0, 3600)
2125
>>> rfc3339_duration_to_delta("PT24H")
2126
datetime.timedelta(1)
2127
>>> rfc3339_duration_to_delta("P1W")
2128
datetime.timedelta(7)
2129
>>> rfc3339_duration_to_delta("PT5M30S")
2130
datetime.timedelta(0, 330)
2131
>>> rfc3339_duration_to_delta("P1DT3M20S")
2132
datetime.timedelta(1, 200)
2133
"""
2134
2135
# Parsing an RFC 3339 duration with regular expressions is not
2136
# possible - there would have to be multiple places for the same
2137
# values, like seconds. The current code, while more esoteric, is
2138
# cleaner without depending on a parsing library. If Python had a
2139
# built-in library for parsing we would use it, but we'd like to
2140
# avoid excessive use of external libraries.
2141
2142
# New type for defining tokens, syntax, and semantics all-in-one
2143
Token = collections.namedtuple("Token",
2144
("regexp", # To match token; if
2145
# "value" is not None,
2146
# must have a "group"
2147
# containing digits
2148
"value", # datetime.timedelta or
2149
# None
2150
"followers")) # Tokens valid after
2151
# this token
2152
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2153
# the "duration" ABNF definition in RFC 3339, Appendix A.
2154
token_end = Token(re.compile(r"$"), None, frozenset())
2155
token_second = Token(re.compile(r"(\d+)S"),
2156
datetime.timedelta(seconds=1),
2157
frozenset((token_end,)))
2158
token_minute = Token(re.compile(r"(\d+)M"),
2159
datetime.timedelta(minutes=1),
2160
frozenset((token_second, token_end)))
2161
token_hour = Token(re.compile(r"(\d+)H"),
2162
datetime.timedelta(hours=1),
2163
frozenset((token_minute, token_end)))
2164
token_time = Token(re.compile(r"T"),
2165
None,
2166
frozenset((token_hour, token_minute,
2167
token_second)))
2168
token_day = Token(re.compile(r"(\d+)D"),
2169
datetime.timedelta(days=1),
2170
frozenset((token_time, token_end)))
2171
token_month = Token(re.compile(r"(\d+)M"),
2172
datetime.timedelta(weeks=4),
2173
frozenset((token_day, token_end)))
2174
token_year = Token(re.compile(r"(\d+)Y"),
2175
datetime.timedelta(weeks=52),
2176
frozenset((token_month, token_end)))
2177
token_week = Token(re.compile(r"(\d+)W"),
2178
datetime.timedelta(weeks=1),
2179
frozenset((token_end,)))
2180
token_duration = Token(re.compile(r"P"), None,
2181
frozenset((token_year, token_month,
2182
token_day, token_time,
2183
token_week))),
2184
# Define starting values
2185
value = datetime.timedelta() # Value so far
2186
found_token = None
2187
followers = frozenset(token_duration,) # Following valid tokens
2188
s = duration # String left to parse
2189
# Loop until end token is found
2190
while found_token is not token_end:
2191
# Search for any currently valid tokens
2192
for token in followers:
2193
match = token.regexp.match(s)
2194
if match is not None:
2195
# Token found
2196
if token.value is not None:
2197
# Value found, parse digits
2198
factor = int(match.group(1), 10)
2199
# Add to value so far
2200
value += factor * token.value
2201
# Strip token from string
2202
s = token.regexp.sub("", s, 1)
2203
# Go to found token
2204
found_token = token
2205
# Set valid next tokens
2206
followers = found_token.followers
2207
break
2208
else:
2209
# No currently valid tokens were found
2210
raise ValueError("Invalid RFC 3339 duration")
2211
# End token found
2212
return value
2213
2214
2215
1911
def string_to_delta(interval):
2216
1912
"""Parse a string and return a datetime.timedelta
2217
1913
2228
1924
>>> string_to_delta('5m 30s')
2229
1925
datetime.timedelta(0, 330)
2230
1926
"""
2231
2232
try:
2233
return rfc3339_duration_to_delta(interval)
2234
except ValueError:
2235
pass
2236
2237
1927
timevalue = datetime.timedelta(0)
2238
1928
for s in interval.split():
2239
1929
try:
2250
1940
elif suffix == "w":
2251
1941
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2252
1942
else:
2253
raise ValueError("Unknown suffix {0!r}"
2254
.format(suffix))
1943
raise ValueError("Unknown suffix %r" % suffix)
2255
1944
except (ValueError, IndexError) as e:
2256
1945
raise ValueError(*(e.args))
2257
1946
timevalue += delta
2271
1960
sys.exit()
2272
1961
if not noclose:
2273
1962
# Close all standard open file descriptors
2274
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1963
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2275
1964
if not stat.S_ISCHR(os.fstat(null).st_mode):
2276
1965
raise OSError(errno.ENODEV,
2277
"{0} not a character device"
2278
.format(os.devnull))
1966
"%s not a character device"
1967
% os.path.devnull)
2279
1968
os.dup2(null, sys.stdin.fileno())
2280
1969
os.dup2(null, sys.stdout.fileno())
2281
1970
os.dup2(null, sys.stderr.fileno())
2290
1979
2291
1980
parser = argparse.ArgumentParser()
2292
1981
parser.add_argument("-v", "--version", action="version",
2293
version = "%(prog)s {0}".format(version),
1982
version = "%%(prog)s %s" % version,
2294
1983
help="show version number and exit")
2295
1984
parser.add_argument("-i", "--interface", metavar="IF",
2296
1985
help="Bind to interface IF")
2302
1991
help="Run self-test")
2303
1992
parser.add_argument("--debug", action="store_true",
2304
1993
help="Debug mode; run in foreground and log"
2305
" to terminal", default=None)
1994
" to terminal")
2306
1995
parser.add_argument("--debuglevel", metavar="LEVEL",
2307
1996
help="Debug level for stdout output")
2308
1997
parser.add_argument("--priority", help="GnuTLS"
2315
2004
" files")
2316
2005
parser.add_argument("--no-dbus", action="store_false",
2317
2006
dest="use_dbus", help="Do not provide D-Bus"
2318
" system bus interface", default=None)
2007
" system bus interface")
2319
2008
parser.add_argument("--no-ipv6", action="store_false",
2320
dest="use_ipv6", help="Do not use IPv6",
2321
default=None)
2009
dest="use_ipv6", help="Do not use IPv6")
2322
2010
parser.add_argument("--no-restore", action="store_false",
2323
2011
dest="restore", help="Do not restore stored"
2324
" state", default=None)
2325
parser.add_argument("--socket", type=int,
2326
help="Specify a file descriptor to a network"
2327
" socket to use instead of creating one")
2012
" state")
2328
2013
parser.add_argument("--statedir", metavar="DIR",
2329
2014
help="Directory to save/restore state in")
2330
parser.add_argument("--foreground", action="store_true",
2331
help="Run in foreground", default=None)
2332
2015
2333
2016
options = parser.parse_args()
2334
2017
2343
2026
"port": "",
2344
2027
"debug": "False",
2345
2028
"priority":
2346
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",
2029
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2347
2030
"servicename": "Mandos",
2348
2031
"use_dbus": "True",
2349
2032
"use_ipv6": "True",
2350
2033
"debuglevel": "",
2351
2034
"restore": "True",
2352
"socket": "",
2353
"statedir": "/var/lib/mandos",
2354
"foreground": "False",
2035
"statedir": "/var/lib/mandos"
2355
2036
}
2356
2037
2357
2038
# Parse config file for server-global settings
2362
2043
# Convert the SafeConfigParser object to a dict
2363
2044
server_settings = server_config.defaults()
2364
2045
# Use the appropriate methods on the non-string config options
2365
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2046
for option in ("debug", "use_dbus", "use_ipv6"):
2366
2047
server_settings[option] = server_config.getboolean("DEFAULT",
2367
2048
option)
2368
2049
if server_settings["port"]:
2369
2050
server_settings["port"] = server_config.getint("DEFAULT",
2370
2051
"port")
2371
if server_settings["socket"]:
2372
server_settings["socket"] = server_config.getint("DEFAULT",
2373
"socket")
2374
# Later, stdin will, and stdout and stderr might, be dup'ed
2375
# over with an opened os.devnull. But we don't want this to
2376
# happen with a supplied network socket.
2377
if 0 <= server_settings["socket"] <= 2:
2378
server_settings["socket"] = os.dup(server_settings
2379
["socket"])
2380
2052
del server_config
2381
2053
2382
2054
# Override the settings from the config file with command line
2384
2056
for option in ("interface", "address", "port", "debug",
2385
2057
"priority", "servicename", "configdir",
2386
2058
"use_dbus", "use_ipv6", "debuglevel", "restore",
2387
"statedir", "socket", "foreground"):
2059
"statedir"):
2388
2060
value = getattr(options, option)
2389
2061
if value is not None:
2390
2062
server_settings[option] = value
2393
2065
for option in server_settings.keys():
2394
2066
if type(server_settings[option]) is str:
2395
2067
server_settings[option] = unicode(server_settings[option])
2396
# Force all boolean options to be boolean
2397
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2398
"foreground"):
2399
server_settings[option] = bool(server_settings[option])
2400
# Debug implies foreground
2401
if server_settings["debug"]:
2402
server_settings["foreground"] = True
2403
2068
# Now we have our good server settings in "server_settings"
2404
2069
2405
2070
##################################################################
2411
2076
use_ipv6 = server_settings["use_ipv6"]
2412
2077
stored_state_path = os.path.join(server_settings["statedir"],
2413
2078
stored_state_file)
2414
foreground = server_settings["foreground"]
2415
2079
2416
2080
if debug:
2417
initlogger(debug, logging.DEBUG)
2081
initlogger(logging.DEBUG)
2418
2082
else:
2419
2083
if not debuglevel:
2420
initlogger(debug)
2084
initlogger()
2421
2085
else:
2422
2086
level = getattr(logging, debuglevel.upper())
2423
initlogger(debug, level)
2087
initlogger(level)
2424
2088
2425
2089
if server_settings["servicename"] != "Mandos":
2426
2090
syslogger.setFormatter(logging.Formatter
2427
('Mandos ({0}) [%(process)d]:'
2428
' %(levelname)s: %(message)s'
2429
.format(server_settings
2430
["servicename"])))
2091
('Mandos (%s) [%%(process)d]:'
2092
' %%(levelname)s: %%(message)s'
2093
% server_settings["servicename"]))
2431
2094
2432
2095
# Parse config file with clients
2433
client_config = configparser.SafeConfigParser(Client
2434
.client_defaults)
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
2435
2097
client_config.read(os.path.join(server_settings["configdir"],
2436
2098
"clients.conf"))
2437
2099
2446
2108
use_ipv6=use_ipv6,
2447
2109
gnutls_priority=
2448
2110
server_settings["priority"],
2449
use_dbus=use_dbus,
2450
socketfd=(server_settings["socket"]
2451
or None))
2452
if not foreground:
2111
use_dbus=use_dbus)
2112
if not debug:
2453
2113
pidfilename = "/var/run/mandos.pid"
2454
pidfile = None
2455
2114
try:
2456
2115
pidfile = open(pidfilename, "w")
2457
except IOError as e:
2458
logger.error("Could not open file %r", pidfilename,
2459
exc_info=e)
2116
except IOError:
2117
logger.error("Could not open file %r", pidfilename)
2460
2118
2461
for name in ("_mandos", "mandos", "nobody"):
2119
try:
2120
uid = pwd.getpwnam("_mandos").pw_uid
2121
gid = pwd.getpwnam("_mandos").pw_gid
2122
except KeyError:
2462
2123
try:
2463
uid = pwd.getpwnam(name).pw_uid
2464
gid = pwd.getpwnam(name).pw_gid
2465
break
2124
uid = pwd.getpwnam("mandos").pw_uid
2125
gid = pwd.getpwnam("mandos").pw_gid
2466
2126
except KeyError:
2467
continue
2468
else:
2469
uid = 65534
2470
gid = 65534
2127
try:
2128
uid = pwd.getpwnam("nobody").pw_uid
2129
gid = pwd.getpwnam("nobody").pw_gid
2130
except KeyError:
2131
uid = 65534
2132
gid = 65534
2471
2133
try:
2472
2134
os.setgid(gid)
2473
2135
os.setuid(uid)
2474
2136
except OSError as error:
2475
if error.errno != errno.EPERM:
2137
if error[0] != errno.EPERM:
2476
2138
raise error
2477
2139
2478
2140
if debug:
2490
2152
.gnutls_global_set_log_function(debug_gnutls))
2491
2153
2492
2154
# Redirect stdin so all checkers get /dev/null
2493
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2155
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2494
2156
os.dup2(null, sys.stdin.fileno())
2495
2157
if null > 2:
2496
2158
os.close(null)
2159
else:
2160
# No console logging
2161
logger.removeHandler(console)
2497
2162
2498
2163
# Need to fork before connecting to D-Bus
2499
if not foreground:
2164
if not debug:
2500
2165
# Close all input and output, do double fork, etc.
2501
2166
daemon()
2502
2167
2503
# multiprocessing will use threads, so before we use gobject we
2504
# need to inform gobject that threads will be used.
2505
gobject.threads_init()
2506
2507
2168
global main_loop
2508
2169
# From the Avahi example code
2509
DBusGMainLoop(set_as_default=True)
2170
DBusGMainLoop(set_as_default=True )
2510
2171
main_loop = gobject.MainLoop()
2511
2172
bus = dbus.SystemBus()
2512
2173
# End of Avahi example code
2518
2179
("se.bsnet.fukt.Mandos", bus,
2519
2180
do_not_queue=True))
2520
2181
except dbus.exceptions.NameExistsException as e:
2521
logger.error("Disabling D-Bus:", exc_info=e)
2182
logger.error(unicode(e) + ", disabling D-Bus")
2522
2183
use_dbus = False
2523
2184
server_settings["use_dbus"] = False
2524
2185
tcp_server.use_dbus = False
2536
2197
2537
2198
client_class = Client
2538
2199
if use_dbus:
2539
client_class = functools.partial(ClientDBus, bus = bus)
2200
client_class = functools.partial(ClientDBusTransitional,
2201
bus = bus)
2540
2202
2541
2203
client_settings = Client.config_parser(client_config)
2542
2204
old_client_settings = {}
2543
2205
clients_data = {}
2544
2206
2545
# This is used to redirect stdout and stderr for checker processes
2546
global wnull
2547
wnull = open(os.devnull, "w") # A writable /dev/null
2548
# Only used if server is running in foreground but not in debug
2549
# mode
2550
if debug or not foreground:
2551
wnull.close()
2552
2553
2207
# Get client data and settings from last running state.
2554
2208
if server_settings["restore"]:
2555
2209
try:
2558
2212
(stored_state))
2559
2213
os.remove(stored_state_path)
2560
2214
except IOError as e:
2561
if e.errno == errno.ENOENT:
2562
logger.warning("Could not load persistent state: {0}"
2563
.format(os.strerror(e.errno)))
2564
else:
2565
logger.critical("Could not load persistent state:",
2566
exc_info=e)
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2217
if e.errno != errno.ENOENT:
2567
2218
raise
2568
except EOFError as e:
2569
logger.warning("Could not load persistent state: "
2570
"EOFError:", exc_info=e)
2571
2219
2572
2220
with PGPEngine() as pgp:
2573
2221
for client_name, client in clients_data.iteritems():
2574
# Skip removed clients
2575
if client_name not in client_settings:
2576
continue
2577
2578
2222
# Decide which value to use after restoring saved state.
2579
2223
# We have three different values: Old config file,
2580
2224
# new config file, and saved state.
2594
2238
2595
2239
# Clients who has passed its expire date can still be
2596
2240
# enabled if its last checker was successful. Clients
2597
# whose checker succeeded before we stored its state is
2598
# assumed to have successfully run all checkers during
2599
# downtime.
2241
# whose checker failed before we stored its state is
2242
# assumed to have failed all checkers during downtime.
2600
2243
if client["enabled"]:
2601
2244
if datetime.datetime.utcnow() >= client["expires"]:
2602
2245
if not client["last_checked_ok"]:
2603
2246
logger.warning(
2604
2247
"disabling client {0} - Client never "
2605
"performed a successful checker"
2606
.format(client_name))
2248
"performed a successfull checker"
2249
.format(client["name"]))
2607
2250
client["enabled"] = False
2608
2251
elif client["last_checker_status"] != 0:
2609
2252
logger.warning(
2610
2253
"disabling client {0} - Client "
2611
2254
"last checker failed with error code {1}"
2612
.format(client_name,
2255
.format(client["name"],
2613
2256
client["last_checker_status"]))
2614
2257
client["enabled"] = False
2615
2258
else:
2616
2259
client["expires"] = (datetime.datetime
2617
2260
.utcnow()
2618
2261
+ client["timeout"])
2619
logger.debug("Last checker succeeded,"
2620
" keeping {0} enabled"
2621
.format(client_name))
2262
2622
2263
try:
2623
2264
client["secret"] = (
2624
2265
pgp.decrypt(client["encrypted_secret"],
2630
2271
.format(client_name))
2631
2272
client["secret"] = (
2632
2273
client_settings[client_name]["secret"])
2274
2633
2275
2634
2276
# Add/remove clients based on new changes made to config
2635
for client_name in (set(old_client_settings)
2636
- set(client_settings)):
2277
for client_name in set(old_client_settings) - set(client_settings):
2637
2278
del clients_data[client_name]
2638
for client_name in (set(client_settings)
2639
- set(old_client_settings)):
2279
for client_name in set(client_settings) - set(old_client_settings):
2640
2280
clients_data[client_name] = client_settings[client_name]
2641
2642
# Create all client objects
2281
2282
# Create clients all clients
2643
2283
for client_name, client in clients_data.iteritems():
2644
2284
tcp_server.clients[client_name] = client_class(
2645
name = client_name, settings = client,
2646
server_settings = server_settings)
2285
name = client_name, settings = client)
2647
2286
2648
2287
if not tcp_server.clients:
2649
2288
logger.warning("No clients defined")
2650
2651
if not foreground:
2652
if pidfile is not None:
2653
try:
2654
with pidfile:
2655
pid = os.getpid()
2656
pidfile.write(str(pid) + "\n".encode("utf-8"))
2657
except IOError:
2658
logger.error("Could not write to file %r with PID %d",
2659
pidfilename, pid)
2660
del pidfile
2289
2290
if not debug:
2291
try:
2292
with pidfile:
2293
pid = os.getpid()
2294
pidfile.write(str(pid) + "\n".encode("utf-8"))
2295
del pidfile
2296
except IOError:
2297
logger.error("Could not write to file %r with PID %d",
2298
pidfilename, pid)
2299
except NameError:
2300
# "pidfile" was never created
2301
pass
2661
2302
del pidfilename
2303
signal.signal(signal.SIGINT, signal.SIG_IGN)
2662
2304
2663
2305
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2664
2306
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2665
2307
2666
2308
if use_dbus:
2667
@alternate_dbus_interfaces({"se.recompile.Mandos":
2668
"se.bsnet.fukt.Mandos"})
2669
class MandosDBusService(DBusObjectWithProperties):
2309
class MandosDBusService(dbus.service.Object):
2670
2310
"""A D-Bus proxy object"""
2671
2311
def __init__(self):
2672
2312
dbus.service.Object.__init__(self, bus, "/")
2673
2313
_interface = "se.recompile.Mandos"
2674
2314
2675
@dbus_interface_annotations(_interface)
2676
def _foo(self):
2677
return { "org.freedesktop.DBus.Property"
2678
".EmitsChangedSignal":
2679
"false"}
2680
2681
2315
@dbus.service.signal(_interface, signature="o")
2682
2316
def ClientAdded(self, objpath):
2683
2317
"D-Bus signal"
2725
2359
2726
2360
del _interface
2727
2361
2728
mandos_dbus_service = MandosDBusService()
2362
class MandosDBusServiceTransitional(MandosDBusService):
2363
__metaclass__ = AlternateDBusNamesMetaclass
2364
mandos_dbus_service = MandosDBusServiceTransitional()
2729
2365
2730
2366
def cleanup():
2731
2367
"Cleanup function; run on exit"
2732
2368
service.cleanup()
2733
2369
2734
2370
multiprocessing.active_children()
2735
wnull.close()
2736
2371
if not (tcp_server.clients or client_settings):
2737
2372
return
2738
2373
2750
2385
# A list of attributes that can not be pickled
2751
2386
# + secret.
2752
2387
exclude = set(("bus", "changedstate", "secret",
2753
"checker", "server_settings"))
2388
"checker"))
2754
2389
for name, typ in (inspect.getmembers
2755
2390
(dbus.service.Object)):
2756
2391
exclude.add(name)
2765
2400
del client_settings[client.name]["secret"]
2766
2401
2767
2402
try:
2768
with (tempfile.NamedTemporaryFile
2769
(mode='wb', suffix=".pickle", prefix='clients-',
2770
dir=os.path.dirname(stored_state_path),
2771
delete=False)) as stored_state:
2403
with os.fdopen(os.open(stored_state_path,
2404
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2405
0600), "wb") as stored_state:
2772
2406
pickle.dump((clients, client_settings), stored_state)
2773
tempname=stored_state.name
2774
os.rename(tempname, stored_state_path)
2775
2407
except (IOError, OSError) as e:
2776
if not debug:
2777
try:
2778
os.remove(tempname)
2779
except NameError:
2780
pass
2781
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2782
logger.warning("Could not save persistent state: {0}"
2783
.format(os.strerror(e.errno)))
2784
else:
2785
logger.warning("Could not save persistent state:",
2786
exc_info=e)
2787
raise e
2408
logger.warning("Could not save persistent state: {0}"
2409
.format(e))
2410
if e.errno not in (errno.ENOENT, errno.EACCES):
2411
raise
2788
2412
2789
2413
# Delete all clients, and settings from config
2790
2414
while tcp_server.clients:
2817
2441
service.port = tcp_server.socket.getsockname()[1]
2818
2442
if use_ipv6:
2819
2443
logger.info("Now listening on address %r, port %d,"
2820
" flowinfo %d, scope_id %d",
2821
*tcp_server.socket.getsockname())
2444
" flowinfo %d, scope_id %d"
2445
% tcp_server.socket.getsockname())
2822
2446
else: # IPv4
2823
logger.info("Now listening on address %r, port %d",
2824
*tcp_server.socket.getsockname())
2447
logger.info("Now listening on address %r, port %d"
2448
% tcp_server.socket.getsockname())
2825
2449
2826
2450
#service.interface = tcp_server.socket.getsockname()[3]
2827
2451
2830
2454
try:
2831
2455
service.activate()
2832
2456
except dbus.exceptions.DBusException as error:
2833
logger.critical("D-Bus Exception", exc_info=error)
2457
logger.critical("DBusException: %s", error)
2834
2458
cleanup()
2835
2459
sys.exit(1)
2836
2460
# End of Avahi example code
2843
2467
logger.debug("Starting main loop")
2844
2468
main_loop.run()
2845
2469
except AvahiError as error:
2846
logger.critical("Avahi Error", exc_info=error)
2470
logger.critical("AvahiError: %s", error)
2847
2471
cleanup()
2848
2472
sys.exit(1)
2849
2473
except KeyboardInterrupt:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0