To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 549
- compare with another revision
- download diff
- download tarball
- view history from revision 549
- Committer: teddy at recompile
- Date: 2012-01-01 17:38:33 UTC
- Revision ID: teddy@recompile.se-20120101173833-ai39bif1w0ftuyyh
* Makefile (install-server): Add intro(8mandos) man page.
* network-hooks.d/bridge: Add copyright info and year.
* network-hooks.d/openvpn: - '' -
* network-hooks.d/wireless: - '' -
* network-hooks.d/bridge: Add copyright info and year.
* network-hooks.d/openvpn: - '' -
* network-hooks.d/wireless: - '' -
added
removed
mandos
65
65
import types
66
66
import binascii
67
67
import tempfile
68
import itertools
69
68
70
69
import dbus
71
70
import dbus.service
86
85
except ImportError:
87
86
SO_BINDTODEVICE = None
88
87
89
version = "1.5.3"
88
version = "1.5.0"
90
89
stored_state_file = "clients.pickle"
91
90
92
91
logger = logging.getLogger()
176
175
177
176
def encrypt(self, data, password):
178
177
self.gnupg.passphrase = self.password_encode(password)
179
with open(os.devnull, "w") as devnull:
178
with open(os.devnull) as devnull:
180
179
try:
181
180
proc = self.gnupg.run(['--symmetric'],
182
181
create_fhs=['stdin', 'stdout'],
193
192
194
193
def decrypt(self, data, password):
195
194
self.gnupg.passphrase = self.password_encode(password)
196
with open(os.devnull, "w") as devnull:
195
with open(os.devnull) as devnull:
197
196
try:
198
197
proc = self.gnupg.run(['--decrypt'],
199
198
create_fhs=['stdin', 'stdout'],
200
199
attach_fhs={'stderr': devnull})
201
with contextlib.closing(proc.handles['stdin']) as f:
200
with contextlib.closing(proc.handles['stdin'] ) as f:
202
201
f.write(data)
203
202
with contextlib.closing(proc.handles['stdout']) as f:
204
203
decrypted_plaintext = f.read()
209
208
return decrypted_plaintext
210
209
211
210
211
212
212
class AvahiError(Exception):
213
213
def __init__(self, value, *args, **kwargs):
214
214
self.value = value
243
243
server: D-Bus Server
244
244
bus: dbus.SystemBus()
245
245
"""
246
247
246
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
248
247
servicetype = None, port = None, TXT = None,
249
248
domain = "", host = "", max_renames = 32768,
262
261
self.server = None
263
262
self.bus = bus
264
263
self.entry_group_state_changed_match = None
265
266
264
def rename(self):
267
265
"""Derived from the Avahi example code"""
268
266
if self.rename_count >= self.max_renames:
278
276
try:
279
277
self.add()
280
278
except dbus.exceptions.DBusException as error:
281
logger.critical("D-Bus Exception", exc_info=error)
279
logger.critical("DBusException: %s", error)
282
280
self.cleanup()
283
281
os._exit(1)
284
282
self.rename_count += 1
285
286
283
def remove(self):
287
284
"""Derived from the Avahi example code"""
288
285
if self.entry_group_state_changed_match is not None:
290
287
self.entry_group_state_changed_match = None
291
288
if self.group is not None:
292
289
self.group.Reset()
293
294
290
def add(self):
295
291
"""Derived from the Avahi example code"""
296
292
self.remove()
313
309
dbus.UInt16(self.port),
314
310
avahi.string_array_to_txt_array(self.TXT))
315
311
self.group.Commit()
316
317
312
def entry_group_state_changed(self, state, error):
318
313
"""Derived from the Avahi example code"""
319
314
logger.debug("Avahi entry group state change: %i", state)
326
321
elif state == avahi.ENTRY_GROUP_FAILURE:
327
322
logger.critical("Avahi: Error in group state changed %s",
328
323
unicode(error))
329
raise AvahiGroupError("State changed: {0!s}"
330
.format(error))
331
324
raise AvahiGroupError("State changed: %s"
325
% unicode(error))
332
326
def cleanup(self):
333
327
"""Derived from the Avahi example code"""
334
328
if self.group is not None:
339
333
pass
340
334
self.group = None
341
335
self.remove()
342
343
336
def server_state_changed(self, state, error=None):
344
337
"""Derived from the Avahi example code"""
345
338
logger.debug("Avahi server state change: %i", state)
364
357
logger.debug("Unknown state: %r", state)
365
358
else:
366
359
logger.debug("Unknown state: %r: %r", state, error)
367
368
360
def activate(self):
369
361
"""Derived from the Avahi example code"""
370
362
if self.server is None:
382
374
"""Add the new name to the syslog messages"""
383
375
ret = AvahiService.rename(self)
384
376
syslogger.setFormatter(logging.Formatter
385
('Mandos ({0}) [%(process)d]:'
386
' %(levelname)s: %(message)s'
387
.format(self.name)))
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
388
380
return ret
389
381
390
382
def timedelta_to_milliseconds(td):
392
384
return ((td.days * 24 * 60 * 60 * 1000)
393
385
+ (td.seconds * 1000)
394
386
+ (td.microseconds // 1000))
395
387
396
388
class Client(object):
397
389
"""A representation of a client host served by this server.
398
390
423
415
last_checked_ok: datetime.datetime(); (UTC) or None
424
416
last_checker_status: integer between 0 and 255 reflecting exit
425
417
status of last checker. -1 reflects crashed
426
checker, -2 means no checker completed yet.
418
checker, or None.
427
419
last_enabled: datetime.datetime(); (UTC) or None
428
420
name: string; from the config file, used in log messages and
429
421
D-Bus identifiers
430
422
secret: bytestring; sent verbatim (over TLS) to client
431
423
timeout: datetime.timedelta(); How long from last_checked_ok
432
424
until this client is disabled
433
extended_timeout: extra long timeout when secret has been sent
425
extended_timeout: extra long timeout when password has been sent
434
426
runtime_expansions: Allowed attributes for runtime expansion.
435
427
expires: datetime.datetime(); time (UTC) when a client will be
436
428
disabled, or None
465
457
466
458
def approval_delay_milliseconds(self):
467
459
return timedelta_to_milliseconds(self.approval_delay)
468
460
469
461
@staticmethod
470
462
def config_parser(config):
471
463
"""Construct a new dict of client settings of this form:
496
488
"rb") as secfile:
497
489
client["secret"] = secfile.read()
498
490
else:
499
raise TypeError("No secret or secfile for section {0}"
500
.format(section))
491
raise TypeError("No secret or secfile for section %s"
492
% section)
501
493
client["timeout"] = string_to_delta(section["timeout"])
502
494
client["extended_timeout"] = string_to_delta(
503
495
section["extended_timeout"])
509
501
client["checker_command"] = section["checker"]
510
502
client["last_approval_request"] = None
511
503
client["last_checked_ok"] = None
512
client["last_checker_status"] = -2
504
client["last_checker_status"] = None
513
505
514
506
return settings
515
507
508
516
509
def __init__(self, settings, name = None):
510
"""Note: the 'checker' key in 'config' sets the
511
'checker_command' attribute and *not* the 'checker'
512
attribute."""
517
513
self.name = name
518
514
# adding all client settings
519
515
for setting, value in settings.iteritems():
528
524
else:
529
525
self.last_enabled = None
530
526
self.expires = None
531
527
532
528
logger.debug("Creating client %r", self.name)
533
529
# Uppercase and remove spaces from fingerprint for later
534
530
# comparison purposes with return value from the fingerprint()
536
532
logger.debug(" Fingerprint: %s", self.fingerprint)
537
533
self.created = settings.get("created",
538
534
datetime.datetime.utcnow())
539
535
540
536
# attributes specific for this server instance
541
537
self.checker = None
542
538
self.checker_initiator_tag = None
630
626
logger.warning("Checker for %(name)s crashed?",
631
627
vars(self))
632
628
633
def checked_ok(self):
634
"""Assert that the client has been seen, alive and well."""
635
self.last_checked_ok = datetime.datetime.utcnow()
636
self.last_checker_status = 0
637
self.bump_timeout()
638
639
def bump_timeout(self, timeout=None):
640
"""Bump up the timeout for this client."""
629
def checked_ok(self, timeout=None):
630
"""Bump up the timeout for this client.
631
632
This should only be called when the client has been seen,
633
alive and well.
634
"""
641
635
if timeout is None:
642
636
timeout = self.timeout
637
self.last_checked_ok = datetime.datetime.utcnow()
643
638
if self.disable_initiator_tag is not None:
644
639
gobject.source_remove(self.disable_initiator_tag)
645
640
if getattr(self, "enabled", False):
657
652
If a checker already exists, leave it running and do
658
653
nothing."""
659
654
# The reason for not killing a running checker is that if we
660
# did that, and if a checker (for some reason) started running
661
# slowly and taking more than 'interval' time, then the client
662
# would inevitably timeout, since no checker would get a
663
# chance to run to completion. If we instead leave running
655
# did that, then if a checker (for some reason) started
656
# running slowly and taking more than 'interval' time, the
657
# client would inevitably timeout, since no checker would get
658
# a chance to run to completion. If we instead leave running
664
659
# checkers alone, the checker would have to take more time
665
660
# than 'timeout' for the client to be disabled, which is as it
666
661
# should be.
696
691
try:
697
692
command = self.checker_command % escaped_attrs
698
693
except TypeError as error:
699
logger.error('Could not format string "%s"',
700
self.checker_command, exc_info=error)
694
logger.error('Could not format string "%s":'
695
' %s', self.checker_command, error)
701
696
return True # Try again later
702
697
self.current_checker_command = command
703
698
try:
721
716
gobject.source_remove(self.checker_callback_tag)
722
717
self.checker_callback(pid, status, command)
723
718
except OSError as error:
724
logger.error("Failed to start subprocess",
725
exc_info=error)
719
logger.error("Failed to start subprocess: %s",
720
error)
726
721
# Re-run this periodically if run by gobject.timeout_add
727
722
return True
728
723
735
730
return
736
731
logger.debug("Stopping checker for %(name)s", vars(self))
737
732
try:
738
self.checker.terminate()
733
os.kill(self.checker.pid, signal.SIGTERM)
739
734
#time.sleep(0.5)
740
735
#if self.checker.poll() is None:
741
# self.checker.kill()
736
# os.kill(self.checker.pid, signal.SIGKILL)
742
737
except OSError as error:
743
738
if error.errno != errno.ESRCH: # No such process
744
739
raise
761
756
# "Set" method, so we fail early here:
762
757
if byte_arrays and signature != "ay":
763
758
raise ValueError("Byte arrays not supported for non-'ay'"
764
" signature {0!r}".format(signature))
759
" signature %r" % signature)
765
760
def decorator(func):
766
761
func._dbus_is_property = True
767
762
func._dbus_interface = dbus_interface
775
770
return decorator
776
771
777
772
778
def dbus_interface_annotations(dbus_interface):
779
"""Decorator for marking functions returning interface annotations
780
781
Usage:
782
783
@dbus_interface_annotations("org.example.Interface")
784
def _foo(self): # Function name does not matter
785
return {"org.freedesktop.DBus.Deprecated": "true",
786
"org.freedesktop.DBus.Property.EmitsChangedSignal":
787
"false"}
788
"""
789
def decorator(func):
790
func._dbus_is_interface = True
791
func._dbus_interface = dbus_interface
792
func._dbus_name = dbus_interface
793
return func
794
return decorator
795
796
797
def dbus_annotations(annotations):
798
"""Decorator to annotate D-Bus methods, signals or properties
799
Usage:
800
801
@dbus_service_property("org.example.Interface", signature="b",
802
access="r")
803
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
804
"org.freedesktop.DBus.Property."
805
"EmitsChangedSignal": "false"})
806
def Property_dbus_property(self):
807
return dbus.Boolean(False)
808
"""
809
def decorator(func):
810
func._dbus_annotations = annotations
811
return func
812
return decorator
813
814
815
773
class DBusPropertyException(dbus.exceptions.DBusException):
816
774
"""A base class for D-Bus property-related exceptions
817
775
"""
840
798
"""
841
799
842
800
@staticmethod
843
def _is_dbus_thing(thing):
844
"""Returns a function testing if an attribute is a D-Bus thing
845
846
If called like _is_dbus_thing("method") it returns a function
847
suitable for use as predicate to inspect.getmembers().
848
"""
849
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
850
False)
801
def _is_dbus_property(obj):
802
return getattr(obj, "_dbus_is_property", False)
851
803
852
def _get_all_dbus_things(self, thing):
804
def _get_all_dbus_properties(self):
853
805
"""Returns a generator of (name, attribute) pairs
854
806
"""
855
return ((getattr(athing.__get__(self), "_dbus_name",
856
name),
857
athing.__get__(self))
807
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
858
808
for cls in self.__class__.__mro__
859
for name, athing in
860
inspect.getmembers(cls,
861
self._is_dbus_thing(thing)))
809
for name, prop in
810
inspect.getmembers(cls, self._is_dbus_property))
862
811
863
812
def _get_dbus_property(self, interface_name, property_name):
864
813
"""Returns a bound method if one exists which is a D-Bus
866
815
"""
867
816
for cls in self.__class__.__mro__:
868
817
for name, value in (inspect.getmembers
869
(cls,
870
self._is_dbus_thing("property"))):
818
(cls, self._is_dbus_property)):
871
819
if (value._dbus_name == property_name
872
820
and value._dbus_interface == interface_name):
873
821
return value.__get__(self)
915
863
Note: Will not include properties with access="write".
916
864
"""
917
865
properties = {}
918
for name, prop in self._get_all_dbus_things("property"):
866
for name, prop in self._get_all_dbus_properties():
919
867
if (interface_name
920
868
and interface_name != prop._dbus_interface):
921
869
# Interface non-empty but did not match
936
884
path_keyword='object_path',
937
885
connection_keyword='connection')
938
886
def Introspect(self, object_path, connection):
939
"""Overloading of standard D-Bus method.
940
941
Inserts property tags and interface annotation tags.
887
"""Standard D-Bus method, overloaded to insert property tags.
942
888
"""
943
889
xmlstring = dbus.service.Object.Introspect(self, object_path,
944
890
connection)
951
897
e.setAttribute("access", prop._dbus_access)
952
898
return e
953
899
for if_tag in document.getElementsByTagName("interface"):
954
# Add property tags
955
900
for tag in (make_tag(document, name, prop)
956
901
for name, prop
957
in self._get_all_dbus_things("property")
902
in self._get_all_dbus_properties()
958
903
if prop._dbus_interface
959
904
== if_tag.getAttribute("name")):
960
905
if_tag.appendChild(tag)
961
# Add annotation tags
962
for typ in ("method", "signal", "property"):
963
for tag in if_tag.getElementsByTagName(typ):
964
annots = dict()
965
for name, prop in (self.
966
_get_all_dbus_things(typ)):
967
if (name == tag.getAttribute("name")
968
and prop._dbus_interface
969
== if_tag.getAttribute("name")):
970
annots.update(getattr
971
(prop,
972
"_dbus_annotations",
973
{}))
974
for name, value in annots.iteritems():
975
ann_tag = document.createElement(
976
"annotation")
977
ann_tag.setAttribute("name", name)
978
ann_tag.setAttribute("value", value)
979
tag.appendChild(ann_tag)
980
# Add interface annotation tags
981
for annotation, value in dict(
982
itertools.chain.from_iterable(
983
annotations().iteritems()
984
for name, annotations in
985
self._get_all_dbus_things("interface")
986
if name == if_tag.getAttribute("name")
987
)).iteritems():
988
ann_tag = document.createElement("annotation")
989
ann_tag.setAttribute("name", annotation)
990
ann_tag.setAttribute("value", value)
991
if_tag.appendChild(ann_tag)
992
906
# Add the names to the return values for the
993
907
# "org.freedesktop.DBus.Properties" methods
994
908
if (if_tag.getAttribute("name")
1009
923
except (AttributeError, xml.dom.DOMException,
1010
924
xml.parsers.expat.ExpatError) as error:
1011
925
logger.error("Failed to override Introspection method",
1012
exc_info=error)
926
error)
1013
927
return xmlstring
1014
928
1015
929
1021
935
variant_level=variant_level)
1022
936
1023
937
1024
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1025
"""A class decorator; applied to a subclass of
1026
dbus.service.Object, it will add alternate D-Bus attributes with
1027
interface names according to the "alt_interface_names" mapping.
1028
Usage:
1029
1030
@alternate_dbus_names({"org.example.Interface":
1031
"net.example.AlternateInterface"})
1032
class SampleDBusObject(dbus.service.Object):
1033
@dbus.service.method("org.example.Interface")
1034
def SampleDBusMethod():
1035
pass
1036
1037
The above "SampleDBusMethod" on "SampleDBusObject" will be
1038
reachable via two interfaces: "org.example.Interface" and
1039
"net.example.AlternateInterface", the latter of which will have
1040
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1041
"true", unless "deprecate" is passed with a False value.
1042
1043
This works for methods and signals, and also for D-Bus properties
1044
(from DBusObjectWithProperties) and interfaces (from the
1045
dbus_interface_annotations decorator).
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
939
.__metaclass__):
940
"""Applied to an empty subclass of a D-Bus object, this metaclass
941
will add additional D-Bus attributes matching a certain pattern.
1046
942
"""
1047
def wrapper(cls):
1048
for orig_interface_name, alt_interface_name in (
1049
alt_interface_names.iteritems()):
1050
attr = {}
1051
interface_names = set()
1052
# Go though all attributes of the class
1053
for attrname, attribute in inspect.getmembers(cls):
943
def __new__(mcs, name, bases, attr):
944
# Go through all the base classes which could have D-Bus
945
# methods, signals, or properties in them
946
for base in (b for b in bases
947
if issubclass(b, dbus.service.Object)):
948
# Go though all attributes of the base class
949
for attrname, attribute in inspect.getmembers(base):
1054
950
# Ignore non-D-Bus attributes, and D-Bus attributes
1055
951
# with the wrong interface name
1056
952
if (not hasattr(attribute, "_dbus_interface")
1057
953
or not attribute._dbus_interface
1058
.startswith(orig_interface_name)):
954
.startswith("se.recompile.Mandos")):
1059
955
continue
1060
956
# Create an alternate D-Bus interface name based on
1061
957
# the current name
1062
958
alt_interface = (attribute._dbus_interface
1063
.replace(orig_interface_name,
1064
alt_interface_name))
1065
interface_names.add(alt_interface)
959
.replace("se.recompile.Mandos",
960
"se.bsnet.fukt.Mandos"))
1066
961
# Is this a D-Bus signal?
1067
962
if getattr(attribute, "_dbus_is_signal", False):
1068
963
# Extract the original non-method function by
1083
978
nonmethod_func.func_name,
1084
979
nonmethod_func.func_defaults,
1085
980
nonmethod_func.func_closure)))
1086
# Copy annotations, if any
1087
try:
1088
new_function._dbus_annotations = (
1089
dict(attribute._dbus_annotations))
1090
except AttributeError:
1091
pass
1092
981
# Define a creator of a function to call both the
1093
# original and alternate functions, so both the
1094
# original and alternate signals gets sent when
1095
# the function is called
982
# old and new functions, so both the old and new
983
# signals gets sent when the function is called
1096
984
def fixscope(func1, func2):
1097
985
"""This function is a scope container to pass
1098
986
func1 and func2 to the "call_both" function
1105
993
return call_both
1106
994
# Create the "call_both" function and add it to
1107
995
# the class
1108
attr[attrname] = fixscope(attribute, new_function)
996
attr[attrname] = fixscope(attribute,
997
new_function)
1109
998
# Is this a D-Bus method?
1110
999
elif getattr(attribute, "_dbus_is_method", False):
1111
1000
# Create a new, but exactly alike, function
1122
1011
attribute.func_name,
1123
1012
attribute.func_defaults,
1124
1013
attribute.func_closure)))
1125
# Copy annotations, if any
1126
try:
1127
attr[attrname]._dbus_annotations = (
1128
dict(attribute._dbus_annotations))
1129
except AttributeError:
1130
pass
1131
1014
# Is this a D-Bus property?
1132
1015
elif getattr(attribute, "_dbus_is_property", False):
1133
1016
# Create a new, but exactly alike, function
1147
1030
attribute.func_name,
1148
1031
attribute.func_defaults,
1149
1032
attribute.func_closure)))
1150
# Copy annotations, if any
1151
try:
1152
attr[attrname]._dbus_annotations = (
1153
dict(attribute._dbus_annotations))
1154
except AttributeError:
1155
pass
1156
# Is this a D-Bus interface?
1157
elif getattr(attribute, "_dbus_is_interface", False):
1158
# Create a new, but exactly alike, function
1159
# object. Decorate it to be a new D-Bus interface
1160
# with the alternate D-Bus interface name. Add it
1161
# to the class.
1162
attr[attrname] = (dbus_interface_annotations
1163
(alt_interface)
1164
(types.FunctionType
1165
(attribute.func_code,
1166
attribute.func_globals,
1167
attribute.func_name,
1168
attribute.func_defaults,
1169
attribute.func_closure)))
1170
if deprecate:
1171
# Deprecate all alternate interfaces
1172
iname="_AlternateDBusNames_interface_annotation{0}"
1173
for interface_name in interface_names:
1174
@dbus_interface_annotations(interface_name)
1175
def func(self):
1176
return { "org.freedesktop.DBus.Deprecated":
1177
"true" }
1178
# Find an unused name
1179
for aname in (iname.format(i)
1180
for i in itertools.count()):
1181
if aname not in attr:
1182
attr[aname] = func
1183
break
1184
if interface_names:
1185
# Replace the class with a new subclass of it with
1186
# methods, signals, etc. as created above.
1187
cls = type(b"{0}Alternate".format(cls.__name__),
1188
(cls,), attr)
1189
return cls
1190
return wrapper
1191
1192
1193
@alternate_dbus_interfaces({"se.recompile.Mandos":
1194
"se.bsnet.fukt.Mandos"})
1033
return type.__new__(mcs, name, bases, attr)
1034
1035
1195
1036
class ClientDBus(Client, DBusObjectWithProperties):
1196
1037
"""A Client class using D-Bus
1197
1038
1208
1049
def __init__(self, bus = None, *args, **kwargs):
1209
1050
self.bus = bus
1210
1051
Client.__init__(self, *args, **kwargs)
1052
self._approvals_pending = 0
1053
1054
self._approvals_pending = 0
1211
1055
# Only now, when this client is initialized, can it show up on
1212
1056
# the D-Bus
1213
1057
client_object_name = unicode(self.name).translate(
1217
1061
("/clients/" + client_object_name))
1218
1062
DBusObjectWithProperties.__init__(self, self.bus,
1219
1063
self.dbus_object_path)
1220
1064
1221
1065
def notifychangeproperty(transform_func,
1222
1066
dbus_name, type_func=lambda x: x,
1223
1067
variant_level=1):
1246
1090
1247
1091
return property(lambda self: getattr(self, attrname), setter)
1248
1092
1093
1249
1094
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1250
1095
approvals_pending = notifychangeproperty(dbus.Boolean,
1251
1096
"ApprovalPending",
1258
1103
checker is not None)
1259
1104
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1260
1105
"LastCheckedOK")
1261
last_checker_status = notifychangeproperty(dbus.Int16,
1262
"LastCheckerStatus")
1263
1106
last_approval_request = notifychangeproperty(
1264
1107
datetime_to_dbus, "LastApprovalRequest")
1265
1108
approved_by_default = notifychangeproperty(dbus.Boolean,
1339
1182
(self.approval_duration),
1340
1183
self._reset_approved)
1341
1184
1185
1342
1186
## D-Bus methods, signals & properties
1343
1187
_interface = "se.recompile.Mandos.Client"
1344
1188
1345
## Interfaces
1346
1347
@dbus_interface_annotations(_interface)
1348
def _foo(self):
1349
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1350
"false"}
1351
1352
1189
## Signals
1353
1190
1354
1191
# CheckerCompleted - signal
1390
1227
"D-Bus signal"
1391
1228
return self.need_approval()
1392
1229
1230
# NeRwequest - signal
1231
@dbus.service.signal(_interface, signature="s")
1232
def NewRequest(self, ip):
1233
"""D-Bus signal
1234
Is sent after a client request a password.
1235
"""
1236
pass
1237
1393
1238
## Methods
1394
1239
1395
1240
# Approve - method
1505
1350
return
1506
1351
return datetime_to_dbus(self.last_checked_ok)
1507
1352
1508
# LastCheckerStatus - property
1509
@dbus_service_property(_interface, signature="n",
1510
access="read")
1511
def LastCheckerStatus_dbus_property(self):
1512
return dbus.Int16(self.last_checker_status)
1513
1514
1353
# Expires - property
1515
1354
@dbus_service_property(_interface, signature="s", access="read")
1516
1355
def Expires_dbus_property(self):
1631
1470
self._pipe.send(('setattr', name, value))
1632
1471
1633
1472
1473
class ClientDBusTransitional(ClientDBus):
1474
__metaclass__ = AlternateDBusNamesMetaclass
1475
1476
1634
1477
class ClientHandler(socketserver.BaseRequestHandler, object):
1635
1478
"""A class to handle client connections.
1636
1479
1704
1547
except KeyError:
1705
1548
return
1706
1549
1550
if self.server.use_dbus:
1551
# Emit D-Bus signal
1552
client.NewRequest(str(self.client_address))
1553
1707
1554
if client.approval_delay:
1708
1555
delay = client.approval_delay
1709
1556
client.approvals_pending += 1
1764
1611
try:
1765
1612
sent = session.send(client.secret[sent_size:])
1766
1613
except gnutls.errors.GNUTLSError as error:
1767
logger.warning("gnutls send failed",
1768
exc_info=error)
1614
logger.warning("gnutls send failed")
1769
1615
return
1770
1616
logger.debug("Sent: %d, remaining: %d",
1771
1617
sent, len(client.secret)
1774
1620
1775
1621
logger.info("Sending secret to %s", client.name)
1776
1622
# bump the timeout using extended_timeout
1777
client.bump_timeout(client.extended_timeout)
1623
client.checked_ok(client.extended_timeout)
1778
1624
if self.server.use_dbus:
1779
1625
# Emit D-Bus signal
1780
1626
client.GotSecret()
1785
1631
try:
1786
1632
session.bye()
1787
1633
except gnutls.errors.GNUTLSError as error:
1788
logger.warning("GnuTLS bye failed",
1789
exc_info=error)
1634
logger.warning("GnuTLS bye failed")
1790
1635
1791
1636
@staticmethod
1792
1637
def peer_certificate(session):
1993
1838
1994
1839
def handle_ipc(self, source, condition, parent_pipe=None,
1995
1840
proc = None, client_object=None):
1841
condition_names = {
1842
gobject.IO_IN: "IN", # There is data to read.
1843
gobject.IO_OUT: "OUT", # Data can be written (without
1844
# blocking).
1845
gobject.IO_PRI: "PRI", # There is urgent data to read.
1846
gobject.IO_ERR: "ERR", # Error condition.
1847
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1848
# broken, usually for pipes and
1849
# sockets).
1850
}
1851
conditions_string = ' | '.join(name
1852
for cond, name in
1853
condition_names.iteritems()
1854
if cond & condition)
1996
1855
# error, or the other end of multiprocessing.Pipe has closed
1997
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1856
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1998
1857
# Wait for other process to exit
1999
1858
proc.join()
2000
1859
return False
2090
1949
elif suffix == "w":
2091
1950
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2092
1951
else:
2093
raise ValueError("Unknown suffix {0!r}"
2094
.format(suffix))
1952
raise ValueError("Unknown suffix %r" % suffix)
2095
1953
except (ValueError, IndexError) as e:
2096
1954
raise ValueError(*(e.args))
2097
1955
timevalue += delta
2111
1969
sys.exit()
2112
1970
if not noclose:
2113
1971
# Close all standard open file descriptors
2114
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1972
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2115
1973
if not stat.S_ISCHR(os.fstat(null).st_mode):
2116
1974
raise OSError(errno.ENODEV,
2117
"{0} not a character device"
2118
.format(os.devnull))
1975
"%s not a character device"
1976
% os.path.devnull)
2119
1977
os.dup2(null, sys.stdin.fileno())
2120
1978
os.dup2(null, sys.stdout.fileno())
2121
1979
os.dup2(null, sys.stderr.fileno())
2130
1988
2131
1989
parser = argparse.ArgumentParser()
2132
1990
parser.add_argument("-v", "--version", action="version",
2133
version = "%(prog)s {0}".format(version),
1991
version = "%%(prog)s %s" % version,
2134
1992
help="show version number and exit")
2135
1993
parser.add_argument("-i", "--interface", metavar="IF",
2136
1994
help="Bind to interface IF")
2239
2097
2240
2098
if server_settings["servicename"] != "Mandos":
2241
2099
syslogger.setFormatter(logging.Formatter
2242
('Mandos ({0}) [%(process)d]:'
2243
' %(levelname)s: %(message)s'
2244
.format(server_settings
2245
["servicename"])))
2100
('Mandos (%s) [%%(process)d]:'
2101
' %%(levelname)s: %%(message)s'
2102
% server_settings["servicename"]))
2246
2103
2247
2104
# Parse config file with clients
2248
2105
client_config = configparser.SafeConfigParser(Client
2266
2123
pidfilename = "/var/run/mandos.pid"
2267
2124
try:
2268
2125
pidfile = open(pidfilename, "w")
2269
except IOError as e:
2270
logger.error("Could not open file %r", pidfilename,
2271
exc_info=e)
2126
except IOError:
2127
logger.error("Could not open file %r", pidfilename)
2272
2128
2273
for name in ("_mandos", "mandos", "nobody"):
2129
try:
2130
uid = pwd.getpwnam("_mandos").pw_uid
2131
gid = pwd.getpwnam("_mandos").pw_gid
2132
except KeyError:
2274
2133
try:
2275
uid = pwd.getpwnam(name).pw_uid
2276
gid = pwd.getpwnam(name).pw_gid
2277
break
2134
uid = pwd.getpwnam("mandos").pw_uid
2135
gid = pwd.getpwnam("mandos").pw_gid
2278
2136
except KeyError:
2279
continue
2280
else:
2281
uid = 65534
2282
gid = 65534
2137
try:
2138
uid = pwd.getpwnam("nobody").pw_uid
2139
gid = pwd.getpwnam("nobody").pw_gid
2140
except KeyError:
2141
uid = 65534
2142
gid = 65534
2283
2143
try:
2284
2144
os.setgid(gid)
2285
2145
os.setuid(uid)
2302
2162
.gnutls_global_set_log_function(debug_gnutls))
2303
2163
2304
2164
# Redirect stdin so all checkers get /dev/null
2305
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2165
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2306
2166
os.dup2(null, sys.stdin.fileno())
2307
2167
if null > 2:
2308
2168
os.close(null)
2316
2176
2317
2177
global main_loop
2318
2178
# From the Avahi example code
2319
DBusGMainLoop(set_as_default=True)
2179
DBusGMainLoop(set_as_default=True )
2320
2180
main_loop = gobject.MainLoop()
2321
2181
bus = dbus.SystemBus()
2322
2182
# End of Avahi example code
2328
2188
("se.bsnet.fukt.Mandos", bus,
2329
2189
do_not_queue=True))
2330
2190
except dbus.exceptions.NameExistsException as e:
2331
logger.error("Disabling D-Bus:", exc_info=e)
2191
logger.error(unicode(e) + ", disabling D-Bus")
2332
2192
use_dbus = False
2333
2193
server_settings["use_dbus"] = False
2334
2194
tcp_server.use_dbus = False
2346
2206
2347
2207
client_class = Client
2348
2208
if use_dbus:
2349
client_class = functools.partial(ClientDBus, bus = bus)
2209
client_class = functools.partial(ClientDBusTransitional,
2210
bus = bus)
2350
2211
2351
2212
client_settings = Client.config_parser(client_config)
2352
2213
old_client_settings = {}
2360
2221
(stored_state))
2361
2222
os.remove(stored_state_path)
2362
2223
except IOError as e:
2363
if e.errno == errno.ENOENT:
2364
logger.warning("Could not load persistent state: {0}"
2365
.format(os.strerror(e.errno)))
2366
else:
2367
logger.critical("Could not load persistent state:",
2368
exc_info=e)
2224
logger.warning("Could not load persistent state: {0}"
2225
.format(e))
2226
if e.errno != errno.ENOENT:
2369
2227
raise
2370
2228
except EOFError as e:
2371
2229
logger.warning("Could not load persistent state: "
2372
"EOFError:", exc_info=e)
2230
"EOFError: {0}".format(e))
2373
2231
2374
2232
with PGPEngine() as pgp:
2375
2233
for client_name, client in clients_data.iteritems():
2392
2250
2393
2251
# Clients who has passed its expire date can still be
2394
2252
# enabled if its last checker was successful. Clients
2395
# whose checker succeeded before we stored its state is
2396
# assumed to have successfully run all checkers during
2397
# downtime.
2253
# whose checker failed before we stored its state is
2254
# assumed to have failed all checkers during downtime.
2398
2255
if client["enabled"]:
2399
2256
if datetime.datetime.utcnow() >= client["expires"]:
2400
2257
if not client["last_checked_ok"]:
2401
2258
logger.warning(
2402
2259
"disabling client {0} - Client never "
2403
"performed a successful checker"
2404
.format(client_name))
2260
"performed a successfull checker"
2261
.format(client["name"]))
2405
2262
client["enabled"] = False
2406
2263
elif client["last_checker_status"] != 0:
2407
2264
logger.warning(
2408
2265
"disabling client {0} - Client "
2409
2266
"last checker failed with error code {1}"
2410
.format(client_name,
2267
.format(client["name"],
2411
2268
client["last_checker_status"]))
2412
2269
client["enabled"] = False
2413
2270
else:
2416
2273
+ client["timeout"])
2417
2274
logger.debug("Last checker succeeded,"
2418
2275
" keeping {0} enabled"
2419
.format(client_name))
2276
.format(client["name"]))
2420
2277
try:
2421
2278
client["secret"] = (
2422
2279
pgp.decrypt(client["encrypted_secret"],
2428
2285
.format(client_name))
2429
2286
client["secret"] = (
2430
2287
client_settings[client_name]["secret"])
2288
2431
2289
2432
2290
# Add/remove clients based on new changes made to config
2433
2291
for client_name in (set(old_client_settings)
2436
2294
for client_name in (set(client_settings)
2437
2295
- set(old_client_settings)):
2438
2296
clients_data[client_name] = client_settings[client_name]
2439
2440
# Create all client objects
2297
2298
# Create clients all clients
2441
2299
for client_name, client in clients_data.iteritems():
2442
2300
tcp_server.clients[client_name] = client_class(
2443
2301
name = client_name, settings = client)
2444
2302
2445
2303
if not tcp_server.clients:
2446
2304
logger.warning("No clients defined")
2447
2305
2448
2306
if not debug:
2449
2307
try:
2450
2308
with pidfile:
2464
2322
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2465
2323
2466
2324
if use_dbus:
2467
@alternate_dbus_interfaces({"se.recompile.Mandos":
2468
"se.bsnet.fukt.Mandos"})
2469
class MandosDBusService(DBusObjectWithProperties):
2325
class MandosDBusService(dbus.service.Object):
2470
2326
"""A D-Bus proxy object"""
2471
2327
def __init__(self):
2472
2328
dbus.service.Object.__init__(self, bus, "/")
2473
2329
_interface = "se.recompile.Mandos"
2474
2330
2475
@dbus_interface_annotations(_interface)
2476
def _foo(self):
2477
return { "org.freedesktop.DBus.Property"
2478
".EmitsChangedSignal":
2479
"false"}
2480
2481
2331
@dbus.service.signal(_interface, signature="o")
2482
2332
def ClientAdded(self, objpath):
2483
2333
"D-Bus signal"
2525
2375
2526
2376
del _interface
2527
2377
2528
mandos_dbus_service = MandosDBusService()
2378
class MandosDBusServiceTransitional(MandosDBusService):
2379
__metaclass__ = AlternateDBusNamesMetaclass
2380
mandos_dbus_service = MandosDBusServiceTransitional()
2529
2381
2530
2382
def cleanup():
2531
2383
"Cleanup function; run on exit"
2564
2416
del client_settings[client.name]["secret"]
2565
2417
2566
2418
try:
2567
with (tempfile.NamedTemporaryFile
2568
(mode='wb', suffix=".pickle", prefix='clients-',
2569
dir=os.path.dirname(stored_state_path),
2570
delete=False)) as stored_state:
2419
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2420
prefix="clients-",
2421
dir=os.path.dirname
2422
(stored_state_path))
2423
with os.fdopen(tempfd, "wb") as stored_state:
2571
2424
pickle.dump((clients, client_settings), stored_state)
2572
tempname=stored_state.name
2573
2425
os.rename(tempname, stored_state_path)
2574
2426
except (IOError, OSError) as e:
2427
logger.warning("Could not save persistent state: {0}"
2428
.format(e))
2575
2429
if not debug:
2576
2430
try:
2577
2431
os.remove(tempname)
2578
2432
except NameError:
2579
2433
pass
2580
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2581
logger.warning("Could not save persistent state: {0}"
2582
.format(os.strerror(e.errno)))
2583
else:
2584
logger.warning("Could not save persistent state:",
2585
exc_info=e)
2434
if e.errno not in set((errno.ENOENT, errno.EACCES,
2435
errno.EEXIST)):
2586
2436
raise e
2587
2437
2588
2438
# Delete all clients, and settings from config
2616
2466
service.port = tcp_server.socket.getsockname()[1]
2617
2467
if use_ipv6:
2618
2468
logger.info("Now listening on address %r, port %d,"
2619
" flowinfo %d, scope_id %d",
2620
*tcp_server.socket.getsockname())
2469
" flowinfo %d, scope_id %d"
2470
% tcp_server.socket.getsockname())
2621
2471
else: # IPv4
2622
logger.info("Now listening on address %r, port %d",
2623
*tcp_server.socket.getsockname())
2472
logger.info("Now listening on address %r, port %d"
2473
% tcp_server.socket.getsockname())
2624
2474
2625
2475
#service.interface = tcp_server.socket.getsockname()[3]
2626
2476
2629
2479
try:
2630
2480
service.activate()
2631
2481
except dbus.exceptions.DBusException as error:
2632
logger.critical("D-Bus Exception", exc_info=error)
2482
logger.critical("DBusException: %s", error)
2633
2483
cleanup()
2634
2484
sys.exit(1)
2635
2485
# End of Avahi example code
2642
2492
logger.debug("Starting main loop")
2643
2493
main_loop.run()
2644
2494
except AvahiError as error:
2645
logger.critical("Avahi Error", exc_info=error)
2495
logger.critical("AvahiError: %s", error)
2646
2496
cleanup()
2647
2497
sys.exit(1)
2648
2498
except KeyboardInterrupt:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0