To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 549
- compare with another revision
- download diff
- download tarball
- view history from revision 549
- Committer: teddy at recompile
- Date: 2012-01-01 17:38:33 UTC
- Revision ID: teddy@recompile.se-20120101173833-ai39bif1w0ftuyyh
* Makefile (install-server): Add intro(8mandos) man page.
* network-hooks.d/bridge: Add copyright info and year.
* network-hooks.d/openvpn: - '' -
* network-hooks.d/wireless: - '' -
* network-hooks.d/bridge: Add copyright info and year.
* network-hooks.d/openvpn: - '' -
* network-hooks.d/wireless: - '' -
- files removed:
- debian/mandos-client.examples
- debian/upstream
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
37
import SocketServer as socketserver
40
38
import socket
41
39
import argparse
67
65
import types
68
66
import binascii
69
67
import tempfile
70
import itertools
71
import collections
72
68
73
69
import dbus
74
70
import dbus.service
79
75
import ctypes.util
80
76
import xml.dom.minidom
81
77
import inspect
78
import GnuPGInterface
82
79
83
80
try:
84
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
85
except ImportError:
89
86
SO_BINDTODEVICE = None
90
87
91
if sys.version_info.major == 2:
92
str = unicode
93
94
version = "1.6.8"
88
version = "1.5.0"
95
89
stored_state_file = "clients.pickle"
96
90
97
91
logger = logging.getLogger()
98
syslogger = None
92
syslogger = (logging.handlers.SysLogHandler
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
address = str("/dev/log")))
99
95
100
96
try:
101
97
if_nametoindex = (ctypes.cdll.LoadLibrary
107
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
108
104
with contextlib.closing(socket.socket()) as s:
109
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
110
struct.pack(b"16s16x", interface))
111
interface_index = struct.unpack("I", ifreq[16:20])[0]
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
112
110
return interface_index
113
111
114
112
115
113
def initlogger(debug, level=logging.WARNING):
116
114
"""init logger and add loglevel"""
117
115
118
global syslogger
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
123
116
syslogger.setFormatter(logging.Formatter
124
117
('Mandos [%(process)d]: %(levelname)s:'
125
118
' %(message)s'))
143
136
class PGPEngine(object):
144
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
145
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
146
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
147
self.gnupgargs = ['--batch',
148
'--home', self.tempdir,
149
'--force-mdc',
150
'--quiet',
151
'--no-use-agent']
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
152
147
153
148
def __enter__(self):
154
149
return self
155
150
156
def __exit__(self, exc_type, exc_value, traceback):
151
def __exit__ (self, exc_type, exc_value, traceback):
157
152
self._cleanup()
158
153
return False
159
154
176
171
def password_encode(self, password):
177
172
# Passphrase can not be empty and can not contain newlines or
178
173
# NUL bytes. So we prefix it and hex encode it.
179
encoded = b"mandos" + binascii.hexlify(password)
180
if len(encoded) > 2048:
181
# GnuPG can't handle long passwords, so encode differently
182
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
183
.replace(b"\n", b"\\n")
184
.replace(b"\0", b"\\x00"))
185
return encoded
174
return b"mandos" + binascii.hexlify(password)
186
175
187
176
def encrypt(self, data, password):
188
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
191
passfile.write(passphrase)
192
passfile.flush()
193
proc = subprocess.Popen(['gpg', '--symmetric',
194
'--passphrase-file',
195
passfile.name]
196
+ self.gnupgargs,
197
stdin = subprocess.PIPE,
198
stdout = subprocess.PIPE,
199
stderr = subprocess.PIPE)
200
ciphertext, err = proc.communicate(input = data)
201
if proc.returncode != 0:
202
raise PGPError(err)
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
203
191
return ciphertext
204
192
205
193
def decrypt(self, data, password):
206
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
209
passfile.write(passphrase)
210
passfile.flush()
211
proc = subprocess.Popen(['gpg', '--decrypt',
212
'--passphrase-file',
213
passfile.name]
214
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
220
if proc.returncode != 0:
221
raise PGPError(err)
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
222
208
return decrypted_plaintext
223
209
224
210
211
225
212
class AvahiError(Exception):
226
213
def __init__(self, value, *args, **kwargs):
227
214
self.value = value
228
return super(AvahiError, self).__init__(value, *args,
229
**kwargs)
215
super(AvahiError, self).__init__(value, *args, **kwargs)
216
def __unicode__(self):
217
return unicode(repr(self.value))
230
218
231
219
class AvahiServiceError(AvahiError):
232
220
pass
243
231
Used to optionally bind to the specified interface.
244
232
name: string; Example: 'Mandos'
245
233
type: string; Example: '_mandos._tcp'.
246
See <https://www.iana.org/assignments/service-names-port-numbers>
234
See <http://www.dns-sd.org/ServiceTypes.html>
247
235
port: integer; what port to announce
248
236
TXT: list of strings; TXT record for the service
249
237
domain: string; Domain to publish on, default to .local if empty.
255
243
server: D-Bus Server
256
244
bus: dbus.SystemBus()
257
245
"""
258
259
246
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
247
servicetype = None, port = None, TXT = None,
261
248
domain = "", host = "", max_renames = 32768,
274
261
self.server = None
275
262
self.bus = bus
276
263
self.entry_group_state_changed_match = None
277
278
264
def rename(self):
279
265
"""Derived from the Avahi example code"""
280
266
if self.rename_count >= self.max_renames:
282
268
" after %i retries, exiting.",
283
269
self.rename_count)
284
270
raise AvahiServiceError("Too many renames")
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
271
self.name = unicode(self.server
272
.GetAlternativeServiceName(self.name))
287
273
logger.info("Changing Zeroconf service name to %r ...",
288
274
self.name)
289
275
self.remove()
290
276
try:
291
277
self.add()
292
278
except dbus.exceptions.DBusException as error:
293
logger.critical("D-Bus Exception", exc_info=error)
279
logger.critical("DBusException: %s", error)
294
280
self.cleanup()
295
281
os._exit(1)
296
282
self.rename_count += 1
297
298
283
def remove(self):
299
284
"""Derived from the Avahi example code"""
300
285
if self.entry_group_state_changed_match is not None:
302
287
self.entry_group_state_changed_match = None
303
288
if self.group is not None:
304
289
self.group.Reset()
305
306
290
def add(self):
307
291
"""Derived from the Avahi example code"""
308
292
self.remove()
325
309
dbus.UInt16(self.port),
326
310
avahi.string_array_to_txt_array(self.TXT))
327
311
self.group.Commit()
328
329
312
def entry_group_state_changed(self, state, error):
330
313
"""Derived from the Avahi example code"""
331
314
logger.debug("Avahi entry group state change: %i", state)
337
320
self.rename()
338
321
elif state == avahi.ENTRY_GROUP_FAILURE:
339
322
logger.critical("Avahi: Error in group state changed %s",
340
str(error))
341
raise AvahiGroupError("State changed: {!s}"
342
.format(error))
343
323
unicode(error))
324
raise AvahiGroupError("State changed: %s"
325
% unicode(error))
344
326
def cleanup(self):
345
327
"""Derived from the Avahi example code"""
346
328
if self.group is not None:
351
333
pass
352
334
self.group = None
353
335
self.remove()
354
355
336
def server_state_changed(self, state, error=None):
356
337
"""Derived from the Avahi example code"""
357
338
logger.debug("Avahi server state change: %i", state)
376
357
logger.debug("Unknown state: %r", state)
377
358
else:
378
359
logger.debug("Unknown state: %r: %r", state, error)
379
380
360
def activate(self):
381
361
"""Derived from the Avahi example code"""
382
362
if self.server is None:
389
369
self.server_state_changed)
390
370
self.server_state_changed(self.server.GetState())
391
371
392
393
372
class AvahiServiceToSyslog(AvahiService):
394
373
def rename(self):
395
374
"""Add the new name to the syslog messages"""
396
375
ret = AvahiService.rename(self)
397
376
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
400
.format(self.name)))
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
401
380
return ret
402
381
403
382
def timedelta_to_milliseconds(td):
383
"Convert a datetime.timedelta() to milliseconds"
384
return ((td.days * 24 * 60 * 60 * 1000)
385
+ (td.seconds * 1000)
386
+ (td.microseconds // 1000))
387
404
388
class Client(object):
405
389
"""A representation of a client host served by this server.
406
390
431
415
last_checked_ok: datetime.datetime(); (UTC) or None
432
416
last_checker_status: integer between 0 and 255 reflecting exit
433
417
status of last checker. -1 reflects crashed
434
checker, -2 means no checker completed yet.
418
checker, or None.
435
419
last_enabled: datetime.datetime(); (UTC) or None
436
420
name: string; from the config file, used in log messages and
437
421
D-Bus identifiers
438
422
secret: bytestring; sent verbatim (over TLS) to client
439
423
timeout: datetime.timedelta(); How long from last_checked_ok
440
424
until this client is disabled
441
extended_timeout: extra long timeout when secret has been sent
425
extended_timeout: extra long timeout when password has been sent
442
426
runtime_expansions: Allowed attributes for runtime expansion.
443
427
expires: datetime.datetime(); time (UTC) when a client will be
444
428
disabled, or None
445
server_settings: The server_settings dict from main()
446
429
"""
447
430
448
431
runtime_expansions = ("approval_delay", "approval_duration",
449
"created", "enabled", "expires",
450
"fingerprint", "host", "interval",
451
"last_approval_request", "last_checked_ok",
432
"created", "enabled", "fingerprint",
433
"host", "interval", "last_checked_ok",
452
434
"last_enabled", "name", "timeout")
453
client_defaults = { "timeout": "PT5M",
454
"extended_timeout": "PT15M",
455
"interval": "PT2M",
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
456
438
"checker": "fping -q -- %%(host)s",
457
439
"host": "",
458
"approval_delay": "PT0S",
459
"approval_duration": "PT1S",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
460
442
"approved_by_default": "True",
461
443
"enabled": "True",
462
444
}
463
445
446
def timeout_milliseconds(self):
447
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
449
450
def extended_timeout_milliseconds(self):
451
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
453
454
def interval_milliseconds(self):
455
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
457
458
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
464
461
@staticmethod
465
462
def config_parser(config):
466
463
"""Construct a new dict of client settings of this form:
491
488
"rb") as secfile:
492
489
client["secret"] = secfile.read()
493
490
else:
494
raise TypeError("No secret or secfile for section {}"
495
.format(section))
491
raise TypeError("No secret or secfile for section %s"
492
% section)
496
493
client["timeout"] = string_to_delta(section["timeout"])
497
494
client["extended_timeout"] = string_to_delta(
498
495
section["extended_timeout"])
504
501
client["checker_command"] = section["checker"]
505
502
client["last_approval_request"] = None
506
503
client["last_checked_ok"] = None
507
client["last_checker_status"] = -2
504
client["last_checker_status"] = None
508
505
509
506
return settings
510
511
def __init__(self, settings, name = None, server_settings=None):
507
508
509
def __init__(self, settings, name = None):
510
"""Note: the 'checker' key in 'config' sets the
511
'checker_command' attribute and *not* the 'checker'
512
attribute."""
512
513
self.name = name
513
if server_settings is None:
514
server_settings = {}
515
self.server_settings = server_settings
516
514
# adding all client settings
517
for setting, value in settings.items():
515
for setting, value in settings.iteritems():
518
516
setattr(self, setting, value)
519
517
520
518
if self.enabled:
526
524
else:
527
525
self.last_enabled = None
528
526
self.expires = None
529
527
530
528
logger.debug("Creating client %r", self.name)
531
529
# Uppercase and remove spaces from fingerprint for later
532
530
# comparison purposes with return value from the fingerprint()
534
532
logger.debug(" Fingerprint: %s", self.fingerprint)
535
533
self.created = settings.get("created",
536
534
datetime.datetime.utcnow())
537
535
538
536
# attributes specific for this server instance
539
537
self.checker = None
540
538
self.checker_initiator_tag = None
568
566
if getattr(self, "enabled", False):
569
567
# Already enabled
570
568
return
569
self.send_changedstate()
571
570
self.expires = datetime.datetime.utcnow() + self.timeout
572
571
self.enabled = True
573
572
self.last_enabled = datetime.datetime.utcnow()
574
573
self.init_checker()
575
self.send_changedstate()
576
574
577
575
def disable(self, quiet=True):
578
576
"""Disable this client."""
579
577
if not getattr(self, "enabled", False):
580
578
return False
581
579
if not quiet:
580
self.send_changedstate()
581
if not quiet:
582
582
logger.info("Disabling client %s", self.name)
583
if getattr(self, "disable_initiator_tag", None) is not None:
583
if getattr(self, "disable_initiator_tag", False):
584
584
gobject.source_remove(self.disable_initiator_tag)
585
585
self.disable_initiator_tag = None
586
586
self.expires = None
587
if getattr(self, "checker_initiator_tag", None) is not None:
587
if getattr(self, "checker_initiator_tag", False):
588
588
gobject.source_remove(self.checker_initiator_tag)
589
589
self.checker_initiator_tag = None
590
590
self.stop_checker()
591
591
self.enabled = False
592
if not quiet:
593
self.send_changedstate()
594
592
# Do not run this again if called by a gobject.timeout_add
595
593
return False
596
594
600
598
def init_checker(self):
601
599
# Schedule a new checker to be started an 'interval' from now,
602
600
# and every interval from then on.
603
if self.checker_initiator_tag is not None:
604
gobject.source_remove(self.checker_initiator_tag)
605
601
self.checker_initiator_tag = (gobject.timeout_add
606
(int(self.interval
607
.total_seconds() * 1000),
602
(self.interval_milliseconds(),
608
603
self.start_checker))
609
604
# Schedule a disable() when 'timeout' has passed
610
if self.disable_initiator_tag is not None:
611
gobject.source_remove(self.disable_initiator_tag)
612
605
self.disable_initiator_tag = (gobject.timeout_add
613
(int(self.timeout
614
.total_seconds() * 1000),
615
self.disable))
606
(self.timeout_milliseconds(),
607
self.disable))
616
608
# Also start a new checker *right now*.
617
609
self.start_checker()
618
610
634
626
logger.warning("Checker for %(name)s crashed?",
635
627
vars(self))
636
628
637
def checked_ok(self):
638
"""Assert that the client has been seen, alive and well."""
639
self.last_checked_ok = datetime.datetime.utcnow()
640
self.last_checker_status = 0
641
self.bump_timeout()
642
643
def bump_timeout(self, timeout=None):
644
"""Bump up the timeout for this client."""
629
def checked_ok(self, timeout=None):
630
"""Bump up the timeout for this client.
631
632
This should only be called when the client has been seen,
633
alive and well.
634
"""
645
635
if timeout is None:
646
636
timeout = self.timeout
637
self.last_checked_ok = datetime.datetime.utcnow()
647
638
if self.disable_initiator_tag is not None:
648
639
gobject.source_remove(self.disable_initiator_tag)
649
self.disable_initiator_tag = None
650
640
if getattr(self, "enabled", False):
651
641
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
642
(timedelta_to_milliseconds
643
(timeout), self.disable))
654
644
self.expires = datetime.datetime.utcnow() + timeout
655
645
656
646
def need_approval(self):
662
652
If a checker already exists, leave it running and do
663
653
nothing."""
664
654
# The reason for not killing a running checker is that if we
665
# did that, and if a checker (for some reason) started running
666
# slowly and taking more than 'interval' time, then the client
667
# would inevitably timeout, since no checker would get a
668
# chance to run to completion. If we instead leave running
655
# did that, then if a checker (for some reason) started
656
# running slowly and taking more than 'interval' time, the
657
# client would inevitably timeout, since no checker would get
658
# a chance to run to completion. If we instead leave running
669
659
# checkers alone, the checker would have to take more time
670
660
# than 'timeout' for the client to be disabled, which is as it
671
661
# should be.
673
663
# If a checker exists, make sure it is not a zombie
674
664
try:
675
665
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
677
pass
678
except OSError as error:
679
if error.errno != errno.ECHILD:
680
raise
666
except (AttributeError, OSError) as error:
667
if (isinstance(error, OSError)
668
and error.errno != errno.ECHILD):
669
raise error
681
670
else:
682
671
if pid:
683
672
logger.warning("Checker was a zombie")
686
675
self.current_checker_command)
687
676
# Start a new checker if needed
688
677
if self.checker is None:
689
# Escape attributes for the shell
690
escaped_attrs = { attr:
691
re.escape(str(getattr(self, attr)))
692
for attr in self.runtime_expansions }
693
678
try:
694
command = self.checker_command % escaped_attrs
695
except TypeError as error:
696
logger.error('Could not format string "%s"',
697
self.checker_command, exc_info=error)
698
return True # Try again later
679
# In case checker_command has exactly one % operator
680
command = self.checker_command % self.host
681
except TypeError:
682
# Escape attributes for the shell
683
escaped_attrs = dict(
684
(attr,
685
re.escape(unicode(str(getattr(self, attr, "")),
686
errors=
687
'replace')))
688
for attr in
689
self.runtime_expansions)
690
691
try:
692
command = self.checker_command % escaped_attrs
693
except TypeError as error:
694
logger.error('Could not format string "%s":'
695
' %s', self.checker_command, error)
696
return True # Try again later
699
697
self.current_checker_command = command
700
698
try:
701
699
logger.info("Starting checker %r for %s",
704
702
# in normal mode, that is already done by daemon(),
705
703
# and in debug mode we don't want to. (Stdin is
706
704
# always replaced by /dev/null.)
707
# The exception is when not debugging but nevertheless
708
# running in the foreground; use the previously
709
# created wnull.
710
popen_args = {}
711
if (not self.server_settings["debug"]
712
and self.server_settings["foreground"]):
713
popen_args.update({"stdout": wnull,
714
"stderr": wnull })
715
705
self.checker = subprocess.Popen(command,
716
706
close_fds=True,
717
shell=True, cwd="/",
718
**popen_args)
719
except OSError as error:
720
logger.error("Failed to start subprocess",
721
exc_info=error)
722
return True
723
self.checker_callback_tag = (gobject.child_watch_add
724
(self.checker.pid,
725
self.checker_callback,
726
data=command))
727
# The checker may have completed before the gobject
728
# watch was added. Check for this.
729
try:
707
shell=True, cwd="/")
708
self.checker_callback_tag = (gobject.child_watch_add
709
(self.checker.pid,
710
self.checker_callback,
711
data=command))
712
# The checker may have completed before the gobject
713
# watch was added. Check for this.
730
714
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
715
if pid:
716
gobject.source_remove(self.checker_callback_tag)
717
self.checker_callback(pid, status, command)
731
718
except OSError as error:
732
if error.errno == errno.ECHILD:
733
# This should never happen
734
logger.error("Child process vanished",
735
exc_info=error)
736
return True
737
raise
738
if pid:
739
gobject.source_remove(self.checker_callback_tag)
740
self.checker_callback(pid, status, command)
719
logger.error("Failed to start subprocess: %s",
720
error)
741
721
# Re-run this periodically if run by gobject.timeout_add
742
722
return True
743
723
750
730
return
751
731
logger.debug("Stopping checker for %(name)s", vars(self))
752
732
try:
753
self.checker.terminate()
733
os.kill(self.checker.pid, signal.SIGTERM)
754
734
#time.sleep(0.5)
755
735
#if self.checker.poll() is None:
756
# self.checker.kill()
736
# os.kill(self.checker.pid, signal.SIGKILL)
757
737
except OSError as error:
758
738
if error.errno != errno.ESRCH: # No such process
759
739
raise
776
756
# "Set" method, so we fail early here:
777
757
if byte_arrays and signature != "ay":
778
758
raise ValueError("Byte arrays not supported for non-'ay'"
779
" signature {!r}".format(signature))
759
" signature %r" % signature)
780
760
def decorator(func):
781
761
func._dbus_is_property = True
782
762
func._dbus_interface = dbus_interface
790
770
return decorator
791
771
792
772
793
def dbus_interface_annotations(dbus_interface):
794
"""Decorator for marking functions returning interface annotations
795
796
Usage:
797
798
@dbus_interface_annotations("org.example.Interface")
799
def _foo(self): # Function name does not matter
800
return {"org.freedesktop.DBus.Deprecated": "true",
801
"org.freedesktop.DBus.Property.EmitsChangedSignal":
802
"false"}
803
"""
804
def decorator(func):
805
func._dbus_is_interface = True
806
func._dbus_interface = dbus_interface
807
func._dbus_name = dbus_interface
808
return func
809
return decorator
810
811
812
def dbus_annotations(annotations):
813
"""Decorator to annotate D-Bus methods, signals or properties
814
Usage:
815
816
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
817
"org.freedesktop.DBus.Property."
818
"EmitsChangedSignal": "false"})
819
@dbus_service_property("org.example.Interface", signature="b",
820
access="r")
821
def Property_dbus_property(self):
822
return dbus.Boolean(False)
823
"""
824
def decorator(func):
825
func._dbus_annotations = annotations
826
return func
827
return decorator
828
829
830
773
class DBusPropertyException(dbus.exceptions.DBusException):
831
774
"""A base class for D-Bus property-related exceptions
832
775
"""
833
pass
776
def __unicode__(self):
777
return unicode(str(self))
778
834
779
835
780
class DBusPropertyAccessException(DBusPropertyException):
836
781
"""A property's access permissions disallows an operation.
853
798
"""
854
799
855
800
@staticmethod
856
def _is_dbus_thing(thing):
857
"""Returns a function testing if an attribute is a D-Bus thing
858
859
If called like _is_dbus_thing("method") it returns a function
860
suitable for use as predicate to inspect.getmembers().
861
"""
862
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
863
False)
801
def _is_dbus_property(obj):
802
return getattr(obj, "_dbus_is_property", False)
864
803
865
def _get_all_dbus_things(self, thing):
804
def _get_all_dbus_properties(self):
866
805
"""Returns a generator of (name, attribute) pairs
867
806
"""
868
return ((getattr(athing.__get__(self), "_dbus_name",
869
name),
870
athing.__get__(self))
807
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
871
808
for cls in self.__class__.__mro__
872
for name, athing in
873
inspect.getmembers(cls,
874
self._is_dbus_thing(thing)))
809
for name, prop in
810
inspect.getmembers(cls, self._is_dbus_property))
875
811
876
812
def _get_dbus_property(self, interface_name, property_name):
877
813
"""Returns a bound method if one exists which is a D-Bus
879
815
"""
880
816
for cls in self.__class__.__mro__:
881
817
for name, value in (inspect.getmembers
882
(cls,
883
self._is_dbus_thing("property"))):
818
(cls, self._is_dbus_property)):
884
819
if (value._dbus_name == property_name
885
820
and value._dbus_interface == interface_name):
886
821
return value.__get__(self)
914
849
# The byte_arrays option is not supported yet on
915
850
# signatures other than "ay".
916
851
if prop._dbus_signature != "ay":
917
raise ValueError("Byte arrays not supported for non-"
918
"'ay' signature {!r}"
919
.format(prop._dbus_signature))
852
raise ValueError
920
853
value = dbus.ByteArray(b''.join(chr(byte)
921
854
for byte in value))
922
855
prop(value)
930
863
Note: Will not include properties with access="write".
931
864
"""
932
865
properties = {}
933
for name, prop in self._get_all_dbus_things("property"):
866
for name, prop in self._get_all_dbus_properties():
934
867
if (interface_name
935
868
and interface_name != prop._dbus_interface):
936
869
# Interface non-empty but did not match
946
879
value.variant_level+1)
947
880
return dbus.Dictionary(properties, signature="sv")
948
881
949
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
950
def PropertiesChanged(self, interface_name, changed_properties,
951
invalidated_properties):
952
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
953
standard.
954
"""
955
pass
956
957
882
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
958
883
out_signature="s",
959
884
path_keyword='object_path',
960
885
connection_keyword='connection')
961
886
def Introspect(self, object_path, connection):
962
"""Overloading of standard D-Bus method.
963
964
Inserts property tags and interface annotation tags.
887
"""Standard D-Bus method, overloaded to insert property tags.
965
888
"""
966
889
xmlstring = dbus.service.Object.Introspect(self, object_path,
967
890
connection)
974
897
e.setAttribute("access", prop._dbus_access)
975
898
return e
976
899
for if_tag in document.getElementsByTagName("interface"):
977
# Add property tags
978
900
for tag in (make_tag(document, name, prop)
979
901
for name, prop
980
in self._get_all_dbus_things("property")
902
in self._get_all_dbus_properties()
981
903
if prop._dbus_interface
982
904
== if_tag.getAttribute("name")):
983
905
if_tag.appendChild(tag)
984
# Add annotation tags
985
for typ in ("method", "signal", "property"):
986
for tag in if_tag.getElementsByTagName(typ):
987
annots = dict()
988
for name, prop in (self.
989
_get_all_dbus_things(typ)):
990
if (name == tag.getAttribute("name")
991
and prop._dbus_interface
992
== if_tag.getAttribute("name")):
993
annots.update(getattr
994
(prop,
995
"_dbus_annotations",
996
{}))
997
for name, value in annots.items():
998
ann_tag = document.createElement(
999
"annotation")
1000
ann_tag.setAttribute("name", name)
1001
ann_tag.setAttribute("value", value)
1002
tag.appendChild(ann_tag)
1003
# Add interface annotation tags
1004
for annotation, value in dict(
1005
itertools.chain.from_iterable(
1006
annotations().items()
1007
for name, annotations in
1008
self._get_all_dbus_things("interface")
1009
if name == if_tag.getAttribute("name")
1010
)).items():
1011
ann_tag = document.createElement("annotation")
1012
ann_tag.setAttribute("name", annotation)
1013
ann_tag.setAttribute("value", value)
1014
if_tag.appendChild(ann_tag)
1015
906
# Add the names to the return values for the
1016
907
# "org.freedesktop.DBus.Properties" methods
1017
908
if (if_tag.getAttribute("name")
1032
923
except (AttributeError, xml.dom.DOMException,
1033
924
xml.parsers.expat.ExpatError) as error:
1034
925
logger.error("Failed to override Introspection method",
1035
exc_info=error)
926
error)
1036
927
return xmlstring
1037
928
1038
929
1039
def datetime_to_dbus(dt, variant_level=0):
930
def datetime_to_dbus (dt, variant_level=0):
1040
931
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1041
932
if dt is None:
1042
933
return dbus.String("", variant_level = variant_level)
1044
935
variant_level=variant_level)
1045
936
1046
937
1047
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1048
"""A class decorator; applied to a subclass of
1049
dbus.service.Object, it will add alternate D-Bus attributes with
1050
interface names according to the "alt_interface_names" mapping.
1051
Usage:
1052
1053
@alternate_dbus_interfaces({"org.example.Interface":
1054
"net.example.AlternateInterface"})
1055
class SampleDBusObject(dbus.service.Object):
1056
@dbus.service.method("org.example.Interface")
1057
def SampleDBusMethod():
1058
pass
1059
1060
The above "SampleDBusMethod" on "SampleDBusObject" will be
1061
reachable via two interfaces: "org.example.Interface" and
1062
"net.example.AlternateInterface", the latter of which will have
1063
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1064
"true", unless "deprecate" is passed with a False value.
1065
1066
This works for methods and signals, and also for D-Bus properties
1067
(from DBusObjectWithProperties) and interfaces (from the
1068
dbus_interface_annotations decorator).
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
939
.__metaclass__):
940
"""Applied to an empty subclass of a D-Bus object, this metaclass
941
will add additional D-Bus attributes matching a certain pattern.
1069
942
"""
1070
def wrapper(cls):
1071
for orig_interface_name, alt_interface_name in (
1072
alt_interface_names.items()):
1073
attr = {}
1074
interface_names = set()
1075
# Go though all attributes of the class
1076
for attrname, attribute in inspect.getmembers(cls):
943
def __new__(mcs, name, bases, attr):
944
# Go through all the base classes which could have D-Bus
945
# methods, signals, or properties in them
946
for base in (b for b in bases
947
if issubclass(b, dbus.service.Object)):
948
# Go though all attributes of the base class
949
for attrname, attribute in inspect.getmembers(base):
1077
950
# Ignore non-D-Bus attributes, and D-Bus attributes
1078
951
# with the wrong interface name
1079
952
if (not hasattr(attribute, "_dbus_interface")
1080
953
or not attribute._dbus_interface
1081
.startswith(orig_interface_name)):
954
.startswith("se.recompile.Mandos")):
1082
955
continue
1083
956
# Create an alternate D-Bus interface name based on
1084
957
# the current name
1085
958
alt_interface = (attribute._dbus_interface
1086
.replace(orig_interface_name,
1087
alt_interface_name))
1088
interface_names.add(alt_interface)
959
.replace("se.recompile.Mandos",
960
"se.bsnet.fukt.Mandos"))
1089
961
# Is this a D-Bus signal?
1090
962
if getattr(attribute, "_dbus_is_signal", False):
1091
# Extract the original non-method undecorated
1092
# function by black magic
963
# Extract the original non-method function by
964
# black magic
1093
965
nonmethod_func = (dict(
1094
966
zip(attribute.func_code.co_freevars,
1095
967
attribute.__closure__))["func"]
1106
978
nonmethod_func.func_name,
1107
979
nonmethod_func.func_defaults,
1108
980
nonmethod_func.func_closure)))
1109
# Copy annotations, if any
1110
try:
1111
new_function._dbus_annotations = (
1112
dict(attribute._dbus_annotations))
1113
except AttributeError:
1114
pass
1115
981
# Define a creator of a function to call both the
1116
# original and alternate functions, so both the
1117
# original and alternate signals gets sent when
1118
# the function is called
982
# old and new functions, so both the old and new
983
# signals gets sent when the function is called
1119
984
def fixscope(func1, func2):
1120
985
"""This function is a scope container to pass
1121
986
func1 and func2 to the "call_both" function
1128
993
return call_both
1129
994
# Create the "call_both" function and add it to
1130
995
# the class
1131
attr[attrname] = fixscope(attribute, new_function)
996
attr[attrname] = fixscope(attribute,
997
new_function)
1132
998
# Is this a D-Bus method?
1133
999
elif getattr(attribute, "_dbus_is_method", False):
1134
1000
# Create a new, but exactly alike, function
1145
1011
attribute.func_name,
1146
1012
attribute.func_defaults,
1147
1013
attribute.func_closure)))
1148
# Copy annotations, if any
1149
try:
1150
attr[attrname]._dbus_annotations = (
1151
dict(attribute._dbus_annotations))
1152
except AttributeError:
1153
pass
1154
1014
# Is this a D-Bus property?
1155
1015
elif getattr(attribute, "_dbus_is_property", False):
1156
1016
# Create a new, but exactly alike, function
1170
1030
attribute.func_name,
1171
1031
attribute.func_defaults,
1172
1032
attribute.func_closure)))
1173
# Copy annotations, if any
1174
try:
1175
attr[attrname]._dbus_annotations = (
1176
dict(attribute._dbus_annotations))
1177
except AttributeError:
1178
pass
1179
# Is this a D-Bus interface?
1180
elif getattr(attribute, "_dbus_is_interface", False):
1181
# Create a new, but exactly alike, function
1182
# object. Decorate it to be a new D-Bus interface
1183
# with the alternate D-Bus interface name. Add it
1184
# to the class.
1185
attr[attrname] = (dbus_interface_annotations
1186
(alt_interface)
1187
(types.FunctionType
1188
(attribute.func_code,
1189
attribute.func_globals,
1190
attribute.func_name,
1191
attribute.func_defaults,
1192
attribute.func_closure)))
1193
if deprecate:
1194
# Deprecate all alternate interfaces
1195
iname="_AlternateDBusNames_interface_annotation{}"
1196
for interface_name in interface_names:
1197
@dbus_interface_annotations(interface_name)
1198
def func(self):
1199
return { "org.freedesktop.DBus.Deprecated":
1200
"true" }
1201
# Find an unused name
1202
for aname in (iname.format(i)
1203
for i in itertools.count()):
1204
if aname not in attr:
1205
attr[aname] = func
1206
break
1207
if interface_names:
1208
# Replace the class with a new subclass of it with
1209
# methods, signals, etc. as created above.
1210
cls = type(b"{}Alternate".format(cls.__name__),
1211
(cls,), attr)
1212
return cls
1213
return wrapper
1214
1215
1216
@alternate_dbus_interfaces({"se.recompile.Mandos":
1217
"se.bsnet.fukt.Mandos"})
1033
return type.__new__(mcs, name, bases, attr)
1034
1035
1218
1036
class ClientDBus(Client, DBusObjectWithProperties):
1219
1037
"""A Client class using D-Bus
1220
1038
1226
1044
runtime_expansions = (Client.runtime_expansions
1227
1045
+ ("dbus_object_path",))
1228
1046
1229
_interface = "se.recompile.Mandos.Client"
1230
1231
1047
# dbus.service.Object doesn't use super(), so we can't either.
1232
1048
1233
1049
def __init__(self, bus = None, *args, **kwargs):
1234
1050
self.bus = bus
1235
1051
Client.__init__(self, *args, **kwargs)
1052
self._approvals_pending = 0
1053
1054
self._approvals_pending = 0
1236
1055
# Only now, when this client is initialized, can it show up on
1237
1056
# the D-Bus
1238
client_object_name = str(self.name).translate(
1057
client_object_name = unicode(self.name).translate(
1239
1058
{ord("."): ord("_"),
1240
1059
ord("-"): ord("_")})
1241
1060
self.dbus_object_path = (dbus.ObjectPath
1242
1061
("/clients/" + client_object_name))
1243
1062
DBusObjectWithProperties.__init__(self, self.bus,
1244
1063
self.dbus_object_path)
1245
1064
1246
1065
def notifychangeproperty(transform_func,
1247
1066
dbus_name, type_func=lambda x: x,
1248
variant_level=1, invalidate_only=False,
1249
_interface=_interface):
1067
variant_level=1):
1250
1068
""" Modify a variable so that it's a property which announces
1251
1069
its changes to DBus.
1252
1070
1257
1075
to the D-Bus. Default: no transform
1258
1076
variant_level: D-Bus variant level. Default: 1
1259
1077
"""
1260
attrname = "_{}".format(dbus_name)
1078
attrname = "_{0}".format(dbus_name)
1261
1079
def setter(self, value):
1262
1080
if hasattr(self, "dbus_object_path"):
1263
1081
if (not hasattr(self, attrname) or
1264
1082
type_func(getattr(self, attrname, None))
1265
1083
!= type_func(value)):
1266
if invalidate_only:
1267
self.PropertiesChanged(_interface,
1268
dbus.Dictionary(),
1269
dbus.Array
1270
((dbus_name,)))
1271
else:
1272
dbus_value = transform_func(type_func(value),
1273
variant_level
1274
=variant_level)
1275
self.PropertyChanged(dbus.String(dbus_name),
1276
dbus_value)
1277
self.PropertiesChanged(_interface,
1278
dbus.Dictionary({
1279
dbus.String(dbus_name):
1280
dbus_value }), dbus.Array())
1084
dbus_value = transform_func(type_func(value),
1085
variant_level
1086
=variant_level)
1087
self.PropertyChanged(dbus.String(dbus_name),
1088
dbus_value)
1281
1089
setattr(self, attrname, value)
1282
1090
1283
1091
return property(lambda self: getattr(self, attrname), setter)
1284
1092
1093
1285
1094
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1286
1095
approvals_pending = notifychangeproperty(dbus.Boolean,
1287
1096
"ApprovalPending",
1294
1103
checker is not None)
1295
1104
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1296
1105
"LastCheckedOK")
1297
last_checker_status = notifychangeproperty(dbus.Int16,
1298
"LastCheckerStatus")
1299
1106
last_approval_request = notifychangeproperty(
1300
1107
datetime_to_dbus, "LastApprovalRequest")
1301
1108
approved_by_default = notifychangeproperty(dbus.Boolean,
1303
1110
approval_delay = notifychangeproperty(dbus.UInt64,
1304
1111
"ApprovalDelay",
1305
1112
type_func =
1306
lambda td: td.total_seconds()
1307
* 1000)
1113
timedelta_to_milliseconds)
1308
1114
approval_duration = notifychangeproperty(
1309
1115
dbus.UInt64, "ApprovalDuration",
1310
type_func = lambda td: td.total_seconds() * 1000)
1116
type_func = timedelta_to_milliseconds)
1311
1117
host = notifychangeproperty(dbus.String, "Host")
1312
1118
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1313
type_func = lambda td:
1314
td.total_seconds() * 1000)
1119
type_func =
1120
timedelta_to_milliseconds)
1315
1121
extended_timeout = notifychangeproperty(
1316
1122
dbus.UInt64, "ExtendedTimeout",
1317
type_func = lambda td: td.total_seconds() * 1000)
1123
type_func = timedelta_to_milliseconds)
1318
1124
interval = notifychangeproperty(dbus.UInt64,
1319
1125
"Interval",
1320
1126
type_func =
1321
lambda td: td.total_seconds()
1322
* 1000)
1127
timedelta_to_milliseconds)
1323
1128
checker_command = notifychangeproperty(dbus.String, "Checker")
1324
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1325
invalidate_only=True)
1326
1129
1327
1130
del notifychangeproperty
1328
1131
1355
1158
*args, **kwargs)
1356
1159
1357
1160
def start_checker(self, *args, **kwargs):
1358
old_checker_pid = getattr(self.checker, "pid", None)
1161
old_checker = self.checker
1162
if self.checker is not None:
1163
old_checker_pid = self.checker.pid
1164
else:
1165
old_checker_pid = None
1359
1166
r = Client.start_checker(self, *args, **kwargs)
1360
1167
# Only if new checker process was started
1361
1168
if (self.checker is not None
1369
1176
return False
1370
1177
1371
1178
def approve(self, value=True):
1179
self.send_changedstate()
1372
1180
self.approved = value
1373
gobject.timeout_add(int(self.approval_duration.total_seconds()
1374
* 1000), self._reset_approved)
1375
self.send_changedstate()
1181
gobject.timeout_add(timedelta_to_milliseconds
1182
(self.approval_duration),
1183
self._reset_approved)
1184
1376
1185
1377
1186
## D-Bus methods, signals & properties
1378
1379
## Interfaces
1187
_interface = "se.recompile.Mandos.Client"
1380
1188
1381
1189
## Signals
1382
1190
1393
1201
pass
1394
1202
1395
1203
# PropertyChanged - signal
1396
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1397
1204
@dbus.service.signal(_interface, signature="sv")
1398
1205
def PropertyChanged(self, property, value):
1399
1206
"D-Bus signal"
1420
1227
"D-Bus signal"
1421
1228
return self.need_approval()
1422
1229
1230
# NeRwequest - signal
1231
@dbus.service.signal(_interface, signature="s")
1232
def NewRequest(self, ip):
1233
"""D-Bus signal
1234
Is sent after a client request a password.
1235
"""
1236
pass
1237
1423
1238
## Methods
1424
1239
1425
1240
# Approve - method
1475
1290
access="readwrite")
1476
1291
def ApprovalDelay_dbus_property(self, value=None):
1477
1292
if value is None: # get
1478
return dbus.UInt64(self.approval_delay.total_seconds()
1479
* 1000)
1293
return dbus.UInt64(self.approval_delay_milliseconds())
1480
1294
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1481
1295
1482
1296
# ApprovalDuration - property
1484
1298
access="readwrite")
1485
1299
def ApprovalDuration_dbus_property(self, value=None):
1486
1300
if value is None: # get
1487
return dbus.UInt64(self.approval_duration.total_seconds()
1488
* 1000)
1301
return dbus.UInt64(timedelta_to_milliseconds(
1302
self.approval_duration))
1489
1303
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1490
1304
1491
1305
# Name - property
1504
1318
def Host_dbus_property(self, value=None):
1505
1319
if value is None: # get
1506
1320
return dbus.String(self.host)
1507
self.host = str(value)
1321
self.host = unicode(value)
1508
1322
1509
1323
# Created - property
1510
1324
@dbus_service_property(_interface, signature="s", access="read")
1536
1350
return
1537
1351
return datetime_to_dbus(self.last_checked_ok)
1538
1352
1539
# LastCheckerStatus - property
1540
@dbus_service_property(_interface, signature="n",
1541
access="read")
1542
def LastCheckerStatus_dbus_property(self):
1543
return dbus.Int16(self.last_checker_status)
1544
1545
1353
# Expires - property
1546
1354
@dbus_service_property(_interface, signature="s", access="read")
1547
1355
def Expires_dbus_property(self):
1557
1365
access="readwrite")
1558
1366
def Timeout_dbus_property(self, value=None):
1559
1367
if value is None: # get
1560
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1561
old_timeout = self.timeout
1368
return dbus.UInt64(self.timeout_milliseconds())
1562
1369
self.timeout = datetime.timedelta(0, 0, 0, value)
1563
# Reschedule disabling
1370
# Reschedule timeout
1564
1371
if self.enabled:
1565
1372
now = datetime.datetime.utcnow()
1566
self.expires += self.timeout - old_timeout
1567
if self.expires <= now:
1373
time_to_die = timedelta_to_milliseconds(
1374
(self.last_checked_ok + self.timeout) - now)
1375
if time_to_die <= 0:
1568
1376
# The timeout has passed
1569
1377
self.disable()
1570
1378
else:
1379
self.expires = (now +
1380
datetime.timedelta(milliseconds =
1381
time_to_die))
1571
1382
if (getattr(self, "disable_initiator_tag", None)
1572
1383
is None):
1573
1384
return
1574
1385
gobject.source_remove(self.disable_initiator_tag)
1575
self.disable_initiator_tag = (
1576
gobject.timeout_add(
1577
int((self.expires - now).total_seconds()
1578
* 1000), self.disable))
1386
self.disable_initiator_tag = (gobject.timeout_add
1387
(time_to_die,
1388
self.disable))
1579
1389
1580
1390
# ExtendedTimeout - property
1581
1391
@dbus_service_property(_interface, signature="t",
1582
1392
access="readwrite")
1583
1393
def ExtendedTimeout_dbus_property(self, value=None):
1584
1394
if value is None: # get
1585
return dbus.UInt64(self.extended_timeout.total_seconds()
1586
* 1000)
1395
return dbus.UInt64(self.extended_timeout_milliseconds())
1587
1396
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1588
1397
1589
1398
# Interval - property
1591
1400
access="readwrite")
1592
1401
def Interval_dbus_property(self, value=None):
1593
1402
if value is None: # get
1594
return dbus.UInt64(self.interval.total_seconds() * 1000)
1403
return dbus.UInt64(self.interval_milliseconds())
1595
1404
self.interval = datetime.timedelta(0, 0, 0, value)
1596
1405
if getattr(self, "checker_initiator_tag", None) is None:
1597
1406
return
1608
1417
def Checker_dbus_property(self, value=None):
1609
1418
if value is None: # get
1610
1419
return dbus.String(self.checker_command)
1611
self.checker_command = str(value)
1420
self.checker_command = unicode(value)
1612
1421
1613
1422
# CheckerRunning - property
1614
1423
@dbus_service_property(_interface, signature="b",
1630
1439
@dbus_service_property(_interface, signature="ay",
1631
1440
access="write", byte_arrays=True)
1632
1441
def Secret_dbus_property(self, value):
1633
self.secret = bytes(value)
1442
self.secret = str(value)
1634
1443
1635
1444
del _interface
1636
1445
1661
1470
self._pipe.send(('setattr', name, value))
1662
1471
1663
1472
1473
class ClientDBusTransitional(ClientDBus):
1474
__metaclass__ = AlternateDBusNamesMetaclass
1475
1476
1664
1477
class ClientHandler(socketserver.BaseRequestHandler, object):
1665
1478
"""A class to handle client connections.
1666
1479
1670
1483
def handle(self):
1671
1484
with contextlib.closing(self.server.child_pipe) as child_pipe:
1672
1485
logger.info("TCP connection from: %s",
1673
str(self.client_address))
1486
unicode(self.client_address))
1674
1487
logger.debug("Pipe FD: %d",
1675
1488
self.server.child_pipe.fileno())
1676
1489
1702
1515
logger.debug("Protocol version: %r", line)
1703
1516
try:
1704
1517
if int(line.strip().split()[0]) > 1:
1705
raise RuntimeError(line)
1518
raise RuntimeError
1706
1519
except (ValueError, IndexError, RuntimeError) as error:
1707
1520
logger.error("Unknown protocol version: %s", error)
1708
1521
return
1734
1547
except KeyError:
1735
1548
return
1736
1549
1550
if self.server.use_dbus:
1551
# Emit D-Bus signal
1552
client.NewRequest(str(self.client_address))
1553
1737
1554
if client.approval_delay:
1738
1555
delay = client.approval_delay
1739
1556
client.approvals_pending += 1
1757
1574
if self.server.use_dbus:
1758
1575
# Emit D-Bus signal
1759
1576
client.NeedApproval(
1760
client.approval_delay.total_seconds()
1761
* 1000, client.approved_by_default)
1577
client.approval_delay_milliseconds(),
1578
client.approved_by_default)
1762
1579
else:
1763
1580
logger.warning("Client %s was not approved",
1764
1581
client.name)
1770
1587
#wait until timeout or approved
1771
1588
time = datetime.datetime.now()
1772
1589
client.changedstate.acquire()
1773
client.changedstate.wait(delay.total_seconds())
1590
(client.changedstate.wait
1591
(float(client.timedelta_to_milliseconds(delay)
1592
/ 1000)))
1774
1593
client.changedstate.release()
1775
1594
time2 = datetime.datetime.now()
1776
1595
if (time2 - time) >= delay:
1792
1611
try:
1793
1612
sent = session.send(client.secret[sent_size:])
1794
1613
except gnutls.errors.GNUTLSError as error:
1795
logger.warning("gnutls send failed",
1796
exc_info=error)
1614
logger.warning("gnutls send failed")
1797
1615
return
1798
1616
logger.debug("Sent: %d, remaining: %d",
1799
1617
sent, len(client.secret)
1802
1620
1803
1621
logger.info("Sending secret to %s", client.name)
1804
1622
# bump the timeout using extended_timeout
1805
client.bump_timeout(client.extended_timeout)
1623
client.checked_ok(client.extended_timeout)
1806
1624
if self.server.use_dbus:
1807
1625
# Emit D-Bus signal
1808
1626
client.GotSecret()
1813
1631
try:
1814
1632
session.bye()
1815
1633
except gnutls.errors.GNUTLSError as error:
1816
logger.warning("GnuTLS bye failed",
1817
exc_info=error)
1634
logger.warning("GnuTLS bye failed")
1818
1635
1819
1636
@staticmethod
1820
1637
def peer_certificate(session):
1892
1709
def process_request(self, request, address):
1893
1710
"""Start a new process to process the request."""
1894
1711
proc = multiprocessing.Process(target = self.sub_process_main,
1895
args = (request, address))
1712
args = (request,
1713
address))
1896
1714
proc.start()
1897
1715
return proc
1898
1716
1913
1731
1914
1732
def add_pipe(self, parent_pipe, proc):
1915
1733
"""Dummy function; override as necessary"""
1916
raise NotImplementedError()
1734
raise NotImplementedError
1917
1735
1918
1736
1919
1737
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1926
1744
use_ipv6: Boolean; to use IPv6 or not
1927
1745
"""
1928
1746
def __init__(self, server_address, RequestHandlerClass,
1929
interface=None, use_ipv6=True, socketfd=None):
1930
"""If socketfd is set, use that file descriptor instead of
1931
creating a new one with socket.socket().
1932
"""
1747
interface=None, use_ipv6=True):
1933
1748
self.interface = interface
1934
1749
if use_ipv6:
1935
1750
self.address_family = socket.AF_INET6
1936
if socketfd is not None:
1937
# Save the file descriptor
1938
self.socketfd = socketfd
1939
# Save the original socket.socket() function
1940
self.socket_socket = socket.socket
1941
# To implement --socket, we monkey patch socket.socket.
1942
#
1943
# (When socketserver.TCPServer is a new-style class, we
1944
# could make self.socket into a property instead of monkey
1945
# patching socket.socket.)
1946
#
1947
# Create a one-time-only replacement for socket.socket()
1948
@functools.wraps(socket.socket)
1949
def socket_wrapper(*args, **kwargs):
1950
# Restore original function so subsequent calls are
1951
# not affected.
1952
socket.socket = self.socket_socket
1953
del self.socket_socket
1954
# This time only, return a new socket object from the
1955
# saved file descriptor.
1956
return socket.fromfd(self.socketfd, *args, **kwargs)
1957
# Replace socket.socket() function with wrapper
1958
socket.socket = socket_wrapper
1959
# The socketserver.TCPServer.__init__ will call
1960
# socket.socket(), which might be our replacement,
1961
# socket_wrapper(), if socketfd was set.
1962
1751
socketserver.TCPServer.__init__(self, server_address,
1963
1752
RequestHandlerClass)
1964
1965
1753
def server_bind(self):
1966
1754
"""This overrides the normal server_bind() function
1967
1755
to bind to an interface if one was specified, and also NOT to
1975
1763
try:
1976
1764
self.socket.setsockopt(socket.SOL_SOCKET,
1977
1765
SO_BINDTODEVICE,
1978
(self.interface + "\0")
1979
.encode("utf-8"))
1766
str(self.interface
1767
+ '\0'))
1980
1768
except socket.error as error:
1981
if error.errno == errno.EPERM:
1982
logger.error("No permission to bind to"
1983
" interface %s", self.interface)
1984
elif error.errno == errno.ENOPROTOOPT:
1769
if error[0] == errno.EPERM:
1770
logger.error("No permission to"
1771
" bind to interface %s",
1772
self.interface)
1773
elif error[0] == errno.ENOPROTOOPT:
1985
1774
logger.error("SO_BINDTODEVICE not available;"
1986
1775
" cannot bind to interface %s",
1987
1776
self.interface)
1988
elif error.errno == errno.ENODEV:
1989
logger.error("Interface %s does not exist,"
1990
" cannot bind", self.interface)
1991
1777
else:
1992
1778
raise
1993
1779
# Only bind(2) the socket if we really need to.
1996
1782
if self.address_family == socket.AF_INET6:
1997
1783
any_address = "::" # in6addr_any
1998
1784
else:
1999
any_address = "0.0.0.0" # INADDR_ANY
1785
any_address = socket.INADDR_ANY
2000
1786
self.server_address = (any_address,
2001
1787
self.server_address[1])
2002
1788
elif not self.server_address[1]:
2023
1809
"""
2024
1810
def __init__(self, server_address, RequestHandlerClass,
2025
1811
interface=None, use_ipv6=True, clients=None,
2026
gnutls_priority=None, use_dbus=True, socketfd=None):
1812
gnutls_priority=None, use_dbus=True):
2027
1813
self.enabled = False
2028
1814
self.clients = clients
2029
1815
if self.clients is None:
2033
1819
IPv6_TCPServer.__init__(self, server_address,
2034
1820
RequestHandlerClass,
2035
1821
interface = interface,
2036
use_ipv6 = use_ipv6,
2037
socketfd = socketfd)
1822
use_ipv6 = use_ipv6)
2038
1823
def server_activate(self):
2039
1824
if self.enabled:
2040
1825
return socketserver.TCPServer.server_activate(self)
2053
1838
2054
1839
def handle_ipc(self, source, condition, parent_pipe=None,
2055
1840
proc = None, client_object=None):
1841
condition_names = {
1842
gobject.IO_IN: "IN", # There is data to read.
1843
gobject.IO_OUT: "OUT", # Data can be written (without
1844
# blocking).
1845
gobject.IO_PRI: "PRI", # There is urgent data to read.
1846
gobject.IO_ERR: "ERR", # Error condition.
1847
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1848
# broken, usually for pipes and
1849
# sockets).
1850
}
1851
conditions_string = ' | '.join(name
1852
for cond, name in
1853
condition_names.iteritems()
1854
if cond & condition)
2056
1855
# error, or the other end of multiprocessing.Pipe has closed
2057
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1856
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2058
1857
# Wait for other process to exit
2059
1858
proc.join()
2060
1859
return False
2118
1917
return True
2119
1918
2120
1919
2121
def rfc3339_duration_to_delta(duration):
2122
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2123
2124
>>> rfc3339_duration_to_delta("P7D")
2125
datetime.timedelta(7)
2126
>>> rfc3339_duration_to_delta("PT60S")
2127
datetime.timedelta(0, 60)
2128
>>> rfc3339_duration_to_delta("PT60M")
2129
datetime.timedelta(0, 3600)
2130
>>> rfc3339_duration_to_delta("PT24H")
2131
datetime.timedelta(1)
2132
>>> rfc3339_duration_to_delta("P1W")
2133
datetime.timedelta(7)
2134
>>> rfc3339_duration_to_delta("PT5M30S")
2135
datetime.timedelta(0, 330)
2136
>>> rfc3339_duration_to_delta("P1DT3M20S")
2137
datetime.timedelta(1, 200)
2138
"""
2139
2140
# Parsing an RFC 3339 duration with regular expressions is not
2141
# possible - there would have to be multiple places for the same
2142
# values, like seconds. The current code, while more esoteric, is
2143
# cleaner without depending on a parsing library. If Python had a
2144
# built-in library for parsing we would use it, but we'd like to
2145
# avoid excessive use of external libraries.
2146
2147
# New type for defining tokens, syntax, and semantics all-in-one
2148
Token = collections.namedtuple("Token",
2149
("regexp", # To match token; if
2150
# "value" is not None,
2151
# must have a "group"
2152
# containing digits
2153
"value", # datetime.timedelta or
2154
# None
2155
"followers")) # Tokens valid after
2156
# this token
2157
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2158
# the "duration" ABNF definition in RFC 3339, Appendix A.
2159
token_end = Token(re.compile(r"$"), None, frozenset())
2160
token_second = Token(re.compile(r"(\d+)S"),
2161
datetime.timedelta(seconds=1),
2162
frozenset((token_end,)))
2163
token_minute = Token(re.compile(r"(\d+)M"),
2164
datetime.timedelta(minutes=1),
2165
frozenset((token_second, token_end)))
2166
token_hour = Token(re.compile(r"(\d+)H"),
2167
datetime.timedelta(hours=1),
2168
frozenset((token_minute, token_end)))
2169
token_time = Token(re.compile(r"T"),
2170
None,
2171
frozenset((token_hour, token_minute,
2172
token_second)))
2173
token_day = Token(re.compile(r"(\d+)D"),
2174
datetime.timedelta(days=1),
2175
frozenset((token_time, token_end)))
2176
token_month = Token(re.compile(r"(\d+)M"),
2177
datetime.timedelta(weeks=4),
2178
frozenset((token_day, token_end)))
2179
token_year = Token(re.compile(r"(\d+)Y"),
2180
datetime.timedelta(weeks=52),
2181
frozenset((token_month, token_end)))
2182
token_week = Token(re.compile(r"(\d+)W"),
2183
datetime.timedelta(weeks=1),
2184
frozenset((token_end,)))
2185
token_duration = Token(re.compile(r"P"), None,
2186
frozenset((token_year, token_month,
2187
token_day, token_time,
2188
token_week)))
2189
# Define starting values
2190
value = datetime.timedelta() # Value so far
2191
found_token = None
2192
followers = frozenset((token_duration,)) # Following valid tokens
2193
s = duration # String left to parse
2194
# Loop until end token is found
2195
while found_token is not token_end:
2196
# Search for any currently valid tokens
2197
for token in followers:
2198
match = token.regexp.match(s)
2199
if match is not None:
2200
# Token found
2201
if token.value is not None:
2202
# Value found, parse digits
2203
factor = int(match.group(1), 10)
2204
# Add to value so far
2205
value += factor * token.value
2206
# Strip token from string
2207
s = token.regexp.sub("", s, 1)
2208
# Go to found token
2209
found_token = token
2210
# Set valid next tokens
2211
followers = found_token.followers
2212
break
2213
else:
2214
# No currently valid tokens were found
2215
raise ValueError("Invalid RFC 3339 duration")
2216
# End token found
2217
return value
2218
2219
2220
1920
def string_to_delta(interval):
2221
1921
"""Parse a string and return a datetime.timedelta
2222
1922
2233
1933
>>> string_to_delta('5m 30s')
2234
1934
datetime.timedelta(0, 330)
2235
1935
"""
2236
2237
try:
2238
return rfc3339_duration_to_delta(interval)
2239
except ValueError:
2240
pass
2241
2242
1936
timevalue = datetime.timedelta(0)
2243
1937
for s in interval.split():
2244
1938
try:
2245
suffix = s[-1]
1939
suffix = unicode(s[-1])
2246
1940
value = int(s[:-1])
2247
1941
if suffix == "d":
2248
1942
delta = datetime.timedelta(value)
2255
1949
elif suffix == "w":
2256
1950
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2257
1951
else:
2258
raise ValueError("Unknown suffix {!r}"
2259
.format(suffix))
2260
except IndexError as e:
1952
raise ValueError("Unknown suffix %r" % suffix)
1953
except (ValueError, IndexError) as e:
2261
1954
raise ValueError(*(e.args))
2262
1955
timevalue += delta
2263
1956
return timevalue
2276
1969
sys.exit()
2277
1970
if not noclose:
2278
1971
# Close all standard open file descriptors
2279
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1972
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2280
1973
if not stat.S_ISCHR(os.fstat(null).st_mode):
2281
raise OSError(errno.ENODEV, "{} not a character device"
2282
.format(os.devnull))
1974
raise OSError(errno.ENODEV,
1975
"%s not a character device"
1976
% os.path.devnull)
2283
1977
os.dup2(null, sys.stdin.fileno())
2284
1978
os.dup2(null, sys.stdout.fileno())
2285
1979
os.dup2(null, sys.stderr.fileno())
2294
1988
2295
1989
parser = argparse.ArgumentParser()
2296
1990
parser.add_argument("-v", "--version", action="version",
2297
version = "%(prog)s {}".format(version),
1991
version = "%%(prog)s %s" % version,
2298
1992
help="show version number and exit")
2299
1993
parser.add_argument("-i", "--interface", metavar="IF",
2300
1994
help="Bind to interface IF")
2306
2000
help="Run self-test")
2307
2001
parser.add_argument("--debug", action="store_true",
2308
2002
help="Debug mode; run in foreground and log"
2309
" to terminal", default=None)
2003
" to terminal")
2310
2004
parser.add_argument("--debuglevel", metavar="LEVEL",
2311
2005
help="Debug level for stdout output")
2312
2006
parser.add_argument("--priority", help="GnuTLS"
2319
2013
" files")
2320
2014
parser.add_argument("--no-dbus", action="store_false",
2321
2015
dest="use_dbus", help="Do not provide D-Bus"
2322
" system bus interface", default=None)
2016
" system bus interface")
2323
2017
parser.add_argument("--no-ipv6", action="store_false",
2324
dest="use_ipv6", help="Do not use IPv6",
2325
default=None)
2018
dest="use_ipv6", help="Do not use IPv6")
2326
2019
parser.add_argument("--no-restore", action="store_false",
2327
2020
dest="restore", help="Do not restore stored"
2328
" state", default=None)
2329
parser.add_argument("--socket", type=int,
2330
help="Specify a file descriptor to a network"
2331
" socket to use instead of creating one")
2021
" state")
2332
2022
parser.add_argument("--statedir", metavar="DIR",
2333
2023
help="Directory to save/restore state in")
2334
parser.add_argument("--foreground", action="store_true",
2335
help="Run in foreground", default=None)
2336
parser.add_argument("--no-zeroconf", action="store_false",
2337
dest="zeroconf", help="Do not use Zeroconf",
2338
default=None)
2339
2024
2340
2025
options = parser.parse_args()
2341
2026
2342
2027
if options.check:
2343
2028
import doctest
2344
fail_count, test_count = doctest.testmod()
2345
sys.exit(os.EX_OK if fail_count == 0 else 1)
2029
doctest.testmod()
2030
sys.exit()
2346
2031
2347
2032
# Default values for config file for server-global settings
2348
2033
server_defaults = { "interface": "",
2350
2035
"port": "",
2351
2036
"debug": "False",
2352
2037
"priority":
2353
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2038
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2354
2039
"servicename": "Mandos",
2355
2040
"use_dbus": "True",
2356
2041
"use_ipv6": "True",
2357
2042
"debuglevel": "",
2358
2043
"restore": "True",
2359
"socket": "",
2360
"statedir": "/var/lib/mandos",
2361
"foreground": "False",
2362
"zeroconf": "True",
2044
"statedir": "/var/lib/mandos"
2363
2045
}
2364
2046
2365
2047
# Parse config file for server-global settings
2370
2052
# Convert the SafeConfigParser object to a dict
2371
2053
server_settings = server_config.defaults()
2372
2054
# Use the appropriate methods on the non-string config options
2373
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2055
for option in ("debug", "use_dbus", "use_ipv6"):
2374
2056
server_settings[option] = server_config.getboolean("DEFAULT",
2375
2057
option)
2376
2058
if server_settings["port"]:
2377
2059
server_settings["port"] = server_config.getint("DEFAULT",
2378
2060
"port")
2379
if server_settings["socket"]:
2380
server_settings["socket"] = server_config.getint("DEFAULT",
2381
"socket")
2382
# Later, stdin will, and stdout and stderr might, be dup'ed
2383
# over with an opened os.devnull. But we don't want this to
2384
# happen with a supplied network socket.
2385
if 0 <= server_settings["socket"] <= 2:
2386
server_settings["socket"] = os.dup(server_settings
2387
["socket"])
2388
2061
del server_config
2389
2062
2390
2063
# Override the settings from the config file with command line
2392
2065
for option in ("interface", "address", "port", "debug",
2393
2066
"priority", "servicename", "configdir",
2394
2067
"use_dbus", "use_ipv6", "debuglevel", "restore",
2395
"statedir", "socket", "foreground", "zeroconf"):
2068
"statedir"):
2396
2069
value = getattr(options, option)
2397
2070
if value is not None:
2398
2071
server_settings[option] = value
2399
2072
del options
2400
2073
# Force all strings to be unicode
2401
2074
for option in server_settings.keys():
2402
if isinstance(server_settings[option], bytes):
2403
server_settings[option] = (server_settings[option]
2404
.decode("utf-8"))
2405
# Force all boolean options to be boolean
2406
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2407
"foreground", "zeroconf"):
2408
server_settings[option] = bool(server_settings[option])
2409
# Debug implies foreground
2410
if server_settings["debug"]:
2411
server_settings["foreground"] = True
2075
if type(server_settings[option]) is str:
2076
server_settings[option] = unicode(server_settings[option])
2412
2077
# Now we have our good server settings in "server_settings"
2413
2078
2414
2079
##################################################################
2415
2080
2416
if (not server_settings["zeroconf"] and
2417
not (server_settings["port"]
2418
or server_settings["socket"] != "")):
2419
parser.error("Needs port or socket to work without"
2420
" Zeroconf")
2421
2422
2081
# For convenience
2423
2082
debug = server_settings["debug"]
2424
2083
debuglevel = server_settings["debuglevel"]
2426
2085
use_ipv6 = server_settings["use_ipv6"]
2427
2086
stored_state_path = os.path.join(server_settings["statedir"],
2428
2087
stored_state_file)
2429
foreground = server_settings["foreground"]
2430
zeroconf = server_settings["zeroconf"]
2431
2088
2432
2089
if debug:
2433
2090
initlogger(debug, logging.DEBUG)
2440
2097
2441
2098
if server_settings["servicename"] != "Mandos":
2442
2099
syslogger.setFormatter(logging.Formatter
2443
('Mandos ({}) [%(process)d]:'
2444
' %(levelname)s: %(message)s'
2445
.format(server_settings
2446
["servicename"])))
2100
('Mandos (%s) [%%(process)d]:'
2101
' %%(levelname)s: %%(message)s'
2102
% server_settings["servicename"]))
2447
2103
2448
2104
# Parse config file with clients
2449
2105
client_config = configparser.SafeConfigParser(Client
2454
2110
global mandos_dbus_service
2455
2111
mandos_dbus_service = None
2456
2112
2457
socketfd = None
2458
if server_settings["socket"] != "":
2459
socketfd = server_settings["socket"]
2460
2113
tcp_server = MandosServer((server_settings["address"],
2461
2114
server_settings["port"]),
2462
2115
ClientHandler,
2465
2118
use_ipv6=use_ipv6,
2466
2119
gnutls_priority=
2467
2120
server_settings["priority"],
2468
use_dbus=use_dbus,
2469
socketfd=socketfd)
2470
if not foreground:
2471
pidfilename = "/run/mandos.pid"
2472
if not os.path.isdir("/run/."):
2473
pidfilename = "/var/run/mandos.pid"
2474
pidfile = None
2121
use_dbus=use_dbus)
2122
if not debug:
2123
pidfilename = "/var/run/mandos.pid"
2475
2124
try:
2476
2125
pidfile = open(pidfilename, "w")
2477
except IOError as e:
2478
logger.error("Could not open file %r", pidfilename,
2479
exc_info=e)
2126
except IOError:
2127
logger.error("Could not open file %r", pidfilename)
2480
2128
2481
for name in ("_mandos", "mandos", "nobody"):
2129
try:
2130
uid = pwd.getpwnam("_mandos").pw_uid
2131
gid = pwd.getpwnam("_mandos").pw_gid
2132
except KeyError:
2482
2133
try:
2483
uid = pwd.getpwnam(name).pw_uid
2484
gid = pwd.getpwnam(name).pw_gid
2485
break
2134
uid = pwd.getpwnam("mandos").pw_uid
2135
gid = pwd.getpwnam("mandos").pw_gid
2486
2136
except KeyError:
2487
continue
2488
else:
2489
uid = 65534
2490
gid = 65534
2137
try:
2138
uid = pwd.getpwnam("nobody").pw_uid
2139
gid = pwd.getpwnam("nobody").pw_gid
2140
except KeyError:
2141
uid = 65534
2142
gid = 65534
2491
2143
try:
2492
2144
os.setgid(gid)
2493
2145
os.setuid(uid)
2494
2146
except OSError as error:
2495
if error.errno != errno.EPERM:
2496
raise
2147
if error[0] != errno.EPERM:
2148
raise error
2497
2149
2498
2150
if debug:
2499
2151
# Enable all possible GnuTLS debugging
2510
2162
.gnutls_global_set_log_function(debug_gnutls))
2511
2163
2512
2164
# Redirect stdin so all checkers get /dev/null
2513
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2165
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2514
2166
os.dup2(null, sys.stdin.fileno())
2515
2167
if null > 2:
2516
2168
os.close(null)
2517
2169
2518
2170
# Need to fork before connecting to D-Bus
2519
if not foreground:
2171
if not debug:
2520
2172
# Close all input and output, do double fork, etc.
2521
2173
daemon()
2522
2174
2523
# multiprocessing will use threads, so before we use gobject we
2524
# need to inform gobject that threads will be used.
2525
2175
gobject.threads_init()
2526
2176
2527
2177
global main_loop
2528
2178
# From the Avahi example code
2529
DBusGMainLoop(set_as_default=True)
2179
DBusGMainLoop(set_as_default=True )
2530
2180
main_loop = gobject.MainLoop()
2531
2181
bus = dbus.SystemBus()
2532
2182
# End of Avahi example code
2538
2188
("se.bsnet.fukt.Mandos", bus,
2539
2189
do_not_queue=True))
2540
2190
except dbus.exceptions.NameExistsException as e:
2541
logger.error("Disabling D-Bus:", exc_info=e)
2191
logger.error(unicode(e) + ", disabling D-Bus")
2542
2192
use_dbus = False
2543
2193
server_settings["use_dbus"] = False
2544
2194
tcp_server.use_dbus = False
2545
if zeroconf:
2546
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2547
service = AvahiServiceToSyslog(name =
2548
server_settings["servicename"],
2549
servicetype = "_mandos._tcp",
2550
protocol = protocol, bus = bus)
2551
if server_settings["interface"]:
2552
service.interface = (if_nametoindex
2553
(server_settings["interface"]
2554
.encode("utf-8")))
2195
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2196
service = AvahiServiceToSyslog(name =
2197
server_settings["servicename"],
2198
servicetype = "_mandos._tcp",
2199
protocol = protocol, bus = bus)
2200
if server_settings["interface"]:
2201
service.interface = (if_nametoindex
2202
(str(server_settings["interface"])))
2555
2203
2556
2204
global multiprocessing_manager
2557
2205
multiprocessing_manager = multiprocessing.Manager()
2558
2206
2559
2207
client_class = Client
2560
2208
if use_dbus:
2561
client_class = functools.partial(ClientDBus, bus = bus)
2209
client_class = functools.partial(ClientDBusTransitional,
2210
bus = bus)
2562
2211
2563
2212
client_settings = Client.config_parser(client_config)
2564
2213
old_client_settings = {}
2565
2214
clients_data = {}
2566
2215
2567
# This is used to redirect stdout and stderr for checker processes
2568
global wnull
2569
wnull = open(os.devnull, "w") # A writable /dev/null
2570
# Only used if server is running in foreground but not in debug
2571
# mode
2572
if debug or not foreground:
2573
wnull.close()
2574
2575
2216
# Get client data and settings from last running state.
2576
2217
if server_settings["restore"]:
2577
2218
try:
2580
2221
(stored_state))
2581
2222
os.remove(stored_state_path)
2582
2223
except IOError as e:
2583
if e.errno == errno.ENOENT:
2584
logger.warning("Could not load persistent state: {}"
2585
.format(os.strerror(e.errno)))
2586
else:
2587
logger.critical("Could not load persistent state:",
2588
exc_info=e)
2224
logger.warning("Could not load persistent state: {0}"
2225
.format(e))
2226
if e.errno != errno.ENOENT:
2589
2227
raise
2590
2228
except EOFError as e:
2591
2229
logger.warning("Could not load persistent state: "
2592
"EOFError:", exc_info=e)
2230
"EOFError: {0}".format(e))
2593
2231
2594
2232
with PGPEngine() as pgp:
2595
for client_name, client in clients_data.items():
2596
# Skip removed clients
2597
if client_name not in client_settings:
2598
continue
2599
2233
for client_name, client in clients_data.iteritems():
2600
2234
# Decide which value to use after restoring saved state.
2601
2235
# We have three different values: Old config file,
2602
2236
# new config file, and saved state.
2616
2250
2617
2251
# Clients who has passed its expire date can still be
2618
2252
# enabled if its last checker was successful. Clients
2619
# whose checker succeeded before we stored its state is
2620
# assumed to have successfully run all checkers during
2621
# downtime.
2253
# whose checker failed before we stored its state is
2254
# assumed to have failed all checkers during downtime.
2622
2255
if client["enabled"]:
2623
2256
if datetime.datetime.utcnow() >= client["expires"]:
2624
2257
if not client["last_checked_ok"]:
2625
2258
logger.warning(
2626
"disabling client {} - Client never "
2627
"performed a successful checker"
2628
.format(client_name))
2259
"disabling client {0} - Client never "
2260
"performed a successfull checker"
2261
.format(client["name"]))
2629
2262
client["enabled"] = False
2630
2263
elif client["last_checker_status"] != 0:
2631
2264
logger.warning(
2632
"disabling client {} - Client last"
2633
" checker failed with error code {}"
2634
.format(client_name,
2265
"disabling client {0} - Client "
2266
"last checker failed with error code {1}"
2267
.format(client["name"],
2635
2268
client["last_checker_status"]))
2636
2269
client["enabled"] = False
2637
2270
else:
2639
2272
.utcnow()
2640
2273
+ client["timeout"])
2641
2274
logger.debug("Last checker succeeded,"
2642
" keeping {} enabled"
2643
.format(client_name))
2275
" keeping {0} enabled"
2276
.format(client["name"]))
2644
2277
try:
2645
2278
client["secret"] = (
2646
2279
pgp.decrypt(client["encrypted_secret"],
2648
2281
["secret"]))
2649
2282
except PGPError:
2650
2283
# If decryption fails, we use secret from new settings
2651
logger.debug("Failed to decrypt {} old secret"
2284
logger.debug("Failed to decrypt {0} old secret"
2652
2285
.format(client_name))
2653
2286
client["secret"] = (
2654
2287
client_settings[client_name]["secret"])
2288
2655
2289
2656
2290
# Add/remove clients based on new changes made to config
2657
2291
for client_name in (set(old_client_settings)
2660
2294
for client_name in (set(client_settings)
2661
2295
- set(old_client_settings)):
2662
2296
clients_data[client_name] = client_settings[client_name]
2663
2664
# Create all client objects
2665
for client_name, client in clients_data.items():
2297
2298
# Create clients all clients
2299
for client_name, client in clients_data.iteritems():
2666
2300
tcp_server.clients[client_name] = client_class(
2667
name = client_name, settings = client,
2668
server_settings = server_settings)
2301
name = client_name, settings = client)
2669
2302
2670
2303
if not tcp_server.clients:
2671
2304
logger.warning("No clients defined")
2672
2673
if not foreground:
2674
if pidfile is not None:
2675
try:
2676
with pidfile:
2677
pid = os.getpid()
2678
pidfile.write("{}\n".format(pid).encode("utf-8"))
2679
except IOError:
2680
logger.error("Could not write to file %r with PID %d",
2681
pidfilename, pid)
2682
del pidfile
2305
2306
if not debug:
2307
try:
2308
with pidfile:
2309
pid = os.getpid()
2310
pidfile.write(str(pid) + "\n".encode("utf-8"))
2311
del pidfile
2312
except IOError:
2313
logger.error("Could not write to file %r with PID %d",
2314
pidfilename, pid)
2315
except NameError:
2316
# "pidfile" was never created
2317
pass
2683
2318
del pidfilename
2319
signal.signal(signal.SIGINT, signal.SIG_IGN)
2684
2320
2685
2321
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2686
2322
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2687
2323
2688
2324
if use_dbus:
2689
@alternate_dbus_interfaces({"se.recompile.Mandos":
2690
"se.bsnet.fukt.Mandos"})
2691
class MandosDBusService(DBusObjectWithProperties):
2325
class MandosDBusService(dbus.service.Object):
2692
2326
"""A D-Bus proxy object"""
2693
2327
def __init__(self):
2694
2328
dbus.service.Object.__init__(self, bus, "/")
2695
2329
_interface = "se.recompile.Mandos"
2696
2330
2697
@dbus_interface_annotations(_interface)
2698
def _foo(self):
2699
return { "org.freedesktop.DBus.Property"
2700
".EmitsChangedSignal":
2701
"false"}
2702
2703
2331
@dbus.service.signal(_interface, signature="o")
2704
2332
def ClientAdded(self, objpath):
2705
2333
"D-Bus signal"
2727
2355
def GetAllClientsWithProperties(self):
2728
2356
"D-Bus method"
2729
2357
return dbus.Dictionary(
2730
{ c.dbus_object_path: c.GetAll("")
2731
for c in tcp_server.clients.itervalues() },
2358
((c.dbus_object_path, c.GetAll(""))
2359
for c in tcp_server.clients.itervalues()),
2732
2360
signature="oa{sv}")
2733
2361
2734
2362
@dbus.service.method(_interface, in_signature="o")
2747
2375
2748
2376
del _interface
2749
2377
2750
mandos_dbus_service = MandosDBusService()
2378
class MandosDBusServiceTransitional(MandosDBusService):
2379
__metaclass__ = AlternateDBusNamesMetaclass
2380
mandos_dbus_service = MandosDBusServiceTransitional()
2751
2381
2752
2382
def cleanup():
2753
2383
"Cleanup function; run on exit"
2754
if zeroconf:
2755
service.cleanup()
2384
service.cleanup()
2756
2385
2757
2386
multiprocessing.active_children()
2758
wnull.close()
2759
2387
if not (tcp_server.clients or client_settings):
2760
2388
return
2761
2389
2772
2400
2773
2401
# A list of attributes that can not be pickled
2774
2402
# + secret.
2775
exclude = { "bus", "changedstate", "secret",
2776
"checker", "server_settings" }
2403
exclude = set(("bus", "changedstate", "secret",
2404
"checker"))
2777
2405
for name, typ in (inspect.getmembers
2778
2406
(dbus.service.Object)):
2779
2407
exclude.add(name)
2788
2416
del client_settings[client.name]["secret"]
2789
2417
2790
2418
try:
2791
with (tempfile.NamedTemporaryFile
2792
(mode='wb', suffix=".pickle", prefix='clients-',
2793
dir=os.path.dirname(stored_state_path),
2794
delete=False)) as stored_state:
2419
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2420
prefix="clients-",
2421
dir=os.path.dirname
2422
(stored_state_path))
2423
with os.fdopen(tempfd, "wb") as stored_state:
2795
2424
pickle.dump((clients, client_settings), stored_state)
2796
tempname=stored_state.name
2797
2425
os.rename(tempname, stored_state_path)
2798
2426
except (IOError, OSError) as e:
2427
logger.warning("Could not save persistent state: {0}"
2428
.format(e))
2799
2429
if not debug:
2800
2430
try:
2801
2431
os.remove(tempname)
2802
2432
except NameError:
2803
2433
pass
2804
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2805
logger.warning("Could not save persistent state: {}"
2806
.format(os.strerror(e.errno)))
2807
else:
2808
logger.warning("Could not save persistent state:",
2809
exc_info=e)
2810
raise
2434
if e.errno not in set((errno.ENOENT, errno.EACCES,
2435
errno.EEXIST)):
2436
raise e
2811
2437
2812
2438
# Delete all clients, and settings from config
2813
2439
while tcp_server.clients:
2837
2463
tcp_server.server_activate()
2838
2464
2839
2465
# Find out what port we got
2840
if zeroconf:
2841
service.port = tcp_server.socket.getsockname()[1]
2466
service.port = tcp_server.socket.getsockname()[1]
2842
2467
if use_ipv6:
2843
2468
logger.info("Now listening on address %r, port %d,"
2844
" flowinfo %d, scope_id %d",
2845
*tcp_server.socket.getsockname())
2469
" flowinfo %d, scope_id %d"
2470
% tcp_server.socket.getsockname())
2846
2471
else: # IPv4
2847
logger.info("Now listening on address %r, port %d",
2848
*tcp_server.socket.getsockname())
2472
logger.info("Now listening on address %r, port %d"
2473
% tcp_server.socket.getsockname())
2849
2474
2850
2475
#service.interface = tcp_server.socket.getsockname()[3]
2851
2476
2852
2477
try:
2853
if zeroconf:
2854
# From the Avahi example code
2855
try:
2856
service.activate()
2857
except dbus.exceptions.DBusException as error:
2858
logger.critical("D-Bus Exception", exc_info=error)
2859
cleanup()
2860
sys.exit(1)
2861
# End of Avahi example code
2478
# From the Avahi example code
2479
try:
2480
service.activate()
2481
except dbus.exceptions.DBusException as error:
2482
logger.critical("DBusException: %s", error)
2483
cleanup()
2484
sys.exit(1)
2485
# End of Avahi example code
2862
2486
2863
2487
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2864
2488
lambda *args, **kwargs:
2868
2492
logger.debug("Starting main loop")
2869
2493
main_loop.run()
2870
2494
except AvahiError as error:
2871
logger.critical("Avahi Error", exc_info=error)
2495
logger.critical("AvahiError: %s", error)
2872
2496
cleanup()
2873
2497
sys.exit(1)
2874
2498
except KeyboardInterrupt:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0