/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-01-15 20:27:28 UTC
  • Revision ID: teddy@recompile.se-20120115202728-185929ww2r84s8xg
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
                                                           property.
* mandos (Client.last_checker_status): Use -2 instead of None to match
                                       D-Bus property.  All users
                                       changed.
  (Client.checked_ok): Remove "timeout" argument and call
                       "self.bump_timeout()" instead.
  (Client.bump_timeout): New; separated out from "checked_ok".
  (ClientDBus.last_checker_status): Hook to a D-Bus property.
  (ClientDBus.LastCheckerStatus_dbus_property): New D-Bus property.
  (ClientHandler.handle): Call client.bump_timeout() instead of
                          client.checked_ok().

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
65
65
import types
66
66
import binascii
67
67
import tempfile
68
 
import itertools
69
68
 
70
69
import dbus
71
70
import dbus.service
86
85
    except ImportError:
87
86
        SO_BINDTODEVICE = None
88
87
 
89
 
version = "1.5.3"
 
88
version = "1.5.2"
90
89
stored_state_file = "clients.pickle"
91
90
 
92
91
logger = logging.getLogger()
176
175
    
177
176
    def encrypt(self, data, password):
178
177
        self.gnupg.passphrase = self.password_encode(password)
179
 
        with open(os.devnull, "w") as devnull:
 
178
        with open(os.devnull) as devnull:
180
179
            try:
181
180
                proc = self.gnupg.run(['--symmetric'],
182
181
                                      create_fhs=['stdin', 'stdout'],
193
192
    
194
193
    def decrypt(self, data, password):
195
194
        self.gnupg.passphrase = self.password_encode(password)
196
 
        with open(os.devnull, "w") as devnull:
 
195
        with open(os.devnull) as devnull:
197
196
            try:
198
197
                proc = self.gnupg.run(['--decrypt'],
199
198
                                      create_fhs=['stdin', 'stdout'],
200
199
                                      attach_fhs={'stderr': devnull})
201
 
                with contextlib.closing(proc.handles['stdin']) as f:
 
200
                with contextlib.closing(proc.handles['stdin'] ) as f:
202
201
                    f.write(data)
203
202
                with contextlib.closing(proc.handles['stdout']) as f:
204
203
                    decrypted_plaintext = f.read()
277
276
        try:
278
277
            self.add()
279
278
        except dbus.exceptions.DBusException as error:
280
 
            logger.critical("D-Bus Exception", exc_info=error)
 
279
            logger.critical("DBusException: %s", error)
281
280
            self.cleanup()
282
281
            os._exit(1)
283
282
        self.rename_count += 1
322
321
        elif state == avahi.ENTRY_GROUP_FAILURE:
323
322
            logger.critical("Avahi: Error in group state changed %s",
324
323
                            unicode(error))
325
 
            raise AvahiGroupError("State changed: {0!s}"
326
 
                                  .format(error))
 
324
            raise AvahiGroupError("State changed: %s"
 
325
                                  % unicode(error))
327
326
    def cleanup(self):
328
327
        """Derived from the Avahi example code"""
329
328
        if self.group is not None:
375
374
        """Add the new name to the syslog messages"""
376
375
        ret = AvahiService.rename(self)
377
376
        syslogger.setFormatter(logging.Formatter
378
 
                               ('Mandos ({0}) [%(process)d]:'
379
 
                                ' %(levelname)s: %(message)s'
380
 
                                .format(self.name)))
 
377
                               ('Mandos (%s) [%%(process)d]:'
 
378
                                ' %%(levelname)s: %%(message)s'
 
379
                                % self.name))
381
380
        return ret
382
381
 
383
382
def timedelta_to_milliseconds(td):
489
488
                          "rb") as secfile:
490
489
                    client["secret"] = secfile.read()
491
490
            else:
492
 
                raise TypeError("No secret or secfile for section {0}"
493
 
                                .format(section))
 
491
                raise TypeError("No secret or secfile for section %s"
 
492
                                % section)
494
493
            client["timeout"] = string_to_delta(section["timeout"])
495
494
            client["extended_timeout"] = string_to_delta(
496
495
                section["extended_timeout"])
693
692
                try:
694
693
                    command = self.checker_command % escaped_attrs
695
694
                except TypeError as error:
696
 
                    logger.error('Could not format string "%s"',
697
 
                                 self.checker_command, exc_info=error)
 
695
                    logger.error('Could not format string "%s":'
 
696
                                 ' %s', self.checker_command, error)
698
697
                    return True # Try again later
699
698
            self.current_checker_command = command
700
699
            try:
718
717
                    gobject.source_remove(self.checker_callback_tag)
719
718
                    self.checker_callback(pid, status, command)
720
719
            except OSError as error:
721
 
                logger.error("Failed to start subprocess",
722
 
                             exc_info=error)
 
720
                logger.error("Failed to start subprocess: %s",
 
721
                             error)
723
722
        # Re-run this periodically if run by gobject.timeout_add
724
723
        return True
725
724
    
732
731
            return
733
732
        logger.debug("Stopping checker for %(name)s", vars(self))
734
733
        try:
735
 
            self.checker.terminate()
 
734
            os.kill(self.checker.pid, signal.SIGTERM)
736
735
            #time.sleep(0.5)
737
736
            #if self.checker.poll() is None:
738
 
            #    self.checker.kill()
 
737
            #    os.kill(self.checker.pid, signal.SIGKILL)
739
738
        except OSError as error:
740
739
            if error.errno != errno.ESRCH: # No such process
741
740
                raise
758
757
    # "Set" method, so we fail early here:
759
758
    if byte_arrays and signature != "ay":
760
759
        raise ValueError("Byte arrays not supported for non-'ay'"
761
 
                         " signature {0!r}".format(signature))
 
760
                         " signature %r" % signature)
762
761
    def decorator(func):
763
762
        func._dbus_is_property = True
764
763
        func._dbus_interface = dbus_interface
772
771
    return decorator
773
772
 
774
773
 
775
 
def dbus_interface_annotations(dbus_interface):
776
 
    """Decorator for marking functions returning interface annotations.
777
 
    
778
 
    Usage:
779
 
    
780
 
    @dbus_interface_annotations("org.example.Interface")
781
 
    def _foo(self):  # Function name does not matter
782
 
        return {"org.freedesktop.DBus.Deprecated": "true",
783
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
784
 
                    "false"}
785
 
    """
786
 
    def decorator(func):
787
 
        func._dbus_is_interface = True
788
 
        func._dbus_interface = dbus_interface
789
 
        func._dbus_name = dbus_interface
790
 
        return func
791
 
    return decorator
792
 
 
793
 
 
794
 
def dbus_annotations(annotations):
795
 
    """Decorator to annotate D-Bus methods, signals or properties
796
 
    Usage:
797
 
    
798
 
    @dbus_service_property("org.example.Interface", signature="b",
799
 
                           access="r")
800
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
801
 
                        "org.freedesktop.DBus.Property."
802
 
                        "EmitsChangedSignal": "false"})
803
 
    def Property_dbus_property(self):
804
 
        return dbus.Boolean(False)
805
 
    """
806
 
    def decorator(func):
807
 
        func._dbus_annotations = annotations
808
 
        return func
809
 
    return decorator
810
 
 
811
 
 
812
774
class DBusPropertyException(dbus.exceptions.DBusException):
813
775
    """A base class for D-Bus property-related exceptions
814
776
    """
837
799
    """
838
800
    
839
801
    @staticmethod
840
 
    def _is_dbus_thing(thing):
841
 
        """Returns a function testing if an attribute is a D-Bus thing
842
 
        
843
 
        If called like _is_dbus_thing("method") it returns a function
844
 
        suitable for use as predicate to inspect.getmembers().
845
 
        """
846
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
847
 
                                   False)
 
802
    def _is_dbus_property(obj):
 
803
        return getattr(obj, "_dbus_is_property", False)
848
804
    
849
 
    def _get_all_dbus_things(self, thing):
 
805
    def _get_all_dbus_properties(self):
850
806
        """Returns a generator of (name, attribute) pairs
851
807
        """
852
 
        return ((getattr(athing.__get__(self), "_dbus_name",
853
 
                         name),
854
 
                 athing.__get__(self))
 
808
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
855
809
                for cls in self.__class__.__mro__
856
 
                for name, athing in
857
 
                inspect.getmembers(cls,
858
 
                                   self._is_dbus_thing(thing)))
 
810
                for name, prop in
 
811
                inspect.getmembers(cls, self._is_dbus_property))
859
812
    
860
813
    def _get_dbus_property(self, interface_name, property_name):
861
814
        """Returns a bound method if one exists which is a D-Bus
863
816
        """
864
817
        for cls in  self.__class__.__mro__:
865
818
            for name, value in (inspect.getmembers
866
 
                                (cls,
867
 
                                 self._is_dbus_thing("property"))):
 
819
                                (cls, self._is_dbus_property)):
868
820
                if (value._dbus_name == property_name
869
821
                    and value._dbus_interface == interface_name):
870
822
                    return value.__get__(self)
912
864
        Note: Will not include properties with access="write".
913
865
        """
914
866
        properties = {}
915
 
        for name, prop in self._get_all_dbus_things("property"):
 
867
        for name, prop in self._get_all_dbus_properties():
916
868
            if (interface_name
917
869
                and interface_name != prop._dbus_interface):
918
870
                # Interface non-empty but did not match
933
885
                         path_keyword='object_path',
934
886
                         connection_keyword='connection')
935
887
    def Introspect(self, object_path, connection):
936
 
        """Overloading of standard D-Bus method.
937
 
        
938
 
        Inserts property tags and interface annotation tags.
 
888
        """Standard D-Bus method, overloaded to insert property tags.
939
889
        """
940
890
        xmlstring = dbus.service.Object.Introspect(self, object_path,
941
891
                                                   connection)
948
898
                e.setAttribute("access", prop._dbus_access)
949
899
                return e
950
900
            for if_tag in document.getElementsByTagName("interface"):
951
 
                # Add property tags
952
901
                for tag in (make_tag(document, name, prop)
953
902
                            for name, prop
954
 
                            in self._get_all_dbus_things("property")
 
903
                            in self._get_all_dbus_properties()
955
904
                            if prop._dbus_interface
956
905
                            == if_tag.getAttribute("name")):
957
906
                    if_tag.appendChild(tag)
958
 
                # Add annotation tags
959
 
                for typ in ("method", "signal", "property"):
960
 
                    for tag in if_tag.getElementsByTagName(typ):
961
 
                        annots = dict()
962
 
                        for name, prop in (self.
963
 
                                           _get_all_dbus_things(typ)):
964
 
                            if (name == tag.getAttribute("name")
965
 
                                and prop._dbus_interface
966
 
                                == if_tag.getAttribute("name")):
967
 
                                annots.update(getattr
968
 
                                              (prop,
969
 
                                               "_dbus_annotations",
970
 
                                               {}))
971
 
                        for name, value in annots.iteritems():
972
 
                            ann_tag = document.createElement(
973
 
                                "annotation")
974
 
                            ann_tag.setAttribute("name", name)
975
 
                            ann_tag.setAttribute("value", value)
976
 
                            tag.appendChild(ann_tag)
977
 
                # Add interface annotation tags
978
 
                for annotation, value in dict(
979
 
                    itertools.chain(
980
 
                        *(annotations().iteritems()
981
 
                          for name, annotations in
982
 
                          self._get_all_dbus_things("interface")
983
 
                          if name == if_tag.getAttribute("name")
984
 
                          ))).iteritems():
985
 
                    ann_tag = document.createElement("annotation")
986
 
                    ann_tag.setAttribute("name", annotation)
987
 
                    ann_tag.setAttribute("value", value)
988
 
                    if_tag.appendChild(ann_tag)
989
907
                # Add the names to the return values for the
990
908
                # "org.freedesktop.DBus.Properties" methods
991
909
                if (if_tag.getAttribute("name")
1006
924
        except (AttributeError, xml.dom.DOMException,
1007
925
                xml.parsers.expat.ExpatError) as error:
1008
926
            logger.error("Failed to override Introspection method",
1009
 
                         exc_info=error)
 
927
                         error)
1010
928
        return xmlstring
1011
929
 
1012
930
 
1026
944
    def __new__(mcs, name, bases, attr):
1027
945
        # Go through all the base classes which could have D-Bus
1028
946
        # methods, signals, or properties in them
1029
 
        old_interface_names = []
1030
947
        for base in (b for b in bases
1031
948
                     if issubclass(b, dbus.service.Object)):
1032
949
            # Go though all attributes of the base class
1042
959
                alt_interface = (attribute._dbus_interface
1043
960
                                 .replace("se.recompile.Mandos",
1044
961
                                          "se.bsnet.fukt.Mandos"))
1045
 
                if alt_interface != attribute._dbus_interface:
1046
 
                    old_interface_names.append(alt_interface)
1047
962
                # Is this a D-Bus signal?
1048
963
                if getattr(attribute, "_dbus_is_signal", False):
1049
964
                    # Extract the original non-method function by
1064
979
                                nonmethod_func.func_name,
1065
980
                                nonmethod_func.func_defaults,
1066
981
                                nonmethod_func.func_closure)))
1067
 
                    # Copy annotations, if any
1068
 
                    try:
1069
 
                        new_function._dbus_annotations = (
1070
 
                            dict(attribute._dbus_annotations))
1071
 
                    except AttributeError:
1072
 
                        pass
1073
982
                    # Define a creator of a function to call both the
1074
983
                    # old and new functions, so both the old and new
1075
984
                    # signals gets sent when the function is called
1103
1012
                                        attribute.func_name,
1104
1013
                                        attribute.func_defaults,
1105
1014
                                        attribute.func_closure)))
1106
 
                    # Copy annotations, if any
1107
 
                    try:
1108
 
                        attr[attrname]._dbus_annotations = (
1109
 
                            dict(attribute._dbus_annotations))
1110
 
                    except AttributeError:
1111
 
                        pass
1112
1015
                # Is this a D-Bus property?
1113
1016
                elif getattr(attribute, "_dbus_is_property", False):
1114
1017
                    # Create a new, but exactly alike, function
1128
1031
                                        attribute.func_name,
1129
1032
                                        attribute.func_defaults,
1130
1033
                                        attribute.func_closure)))
1131
 
                    # Copy annotations, if any
1132
 
                    try:
1133
 
                        attr[attrname]._dbus_annotations = (
1134
 
                            dict(attribute._dbus_annotations))
1135
 
                    except AttributeError:
1136
 
                        pass
1137
 
                # Is this a D-Bus interface?
1138
 
                elif getattr(attribute, "_dbus_is_interface", False):
1139
 
                    # Create a new, but exactly alike, function
1140
 
                    # object.  Decorate it to be a new D-Bus interface
1141
 
                    # with the alternate D-Bus interface name.  Add it
1142
 
                    # to the class.
1143
 
                    attr[attrname] = (dbus_interface_annotations
1144
 
                                      (alt_interface)
1145
 
                                      (types.FunctionType
1146
 
                                       (attribute.func_code,
1147
 
                                        attribute.func_globals,
1148
 
                                        attribute.func_name,
1149
 
                                        attribute.func_defaults,
1150
 
                                        attribute.func_closure)))
1151
 
        # Deprecate all old interfaces
1152
 
        basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"
1153
 
        for old_interface_name in old_interface_names:
1154
 
            @dbus_interface_annotations(old_interface_name)
1155
 
            def func(self):
1156
 
                return { "org.freedesktop.DBus.Deprecated": "true" }
1157
 
            # Find an unused name
1158
 
            for aname in (basename.format(i) for i in
1159
 
                          itertools.count()):
1160
 
                if aname not in attr:
1161
 
                    attr[aname] = func
1162
 
                    break
1163
1034
        return type.__new__(mcs, name, bases, attr)
1164
1035
 
1165
1036
 
1315
1186
    ## D-Bus methods, signals & properties
1316
1187
    _interface = "se.recompile.Mandos.Client"
1317
1188
    
1318
 
    ## Interfaces
1319
 
    
1320
 
    @dbus_interface_annotations(_interface)
1321
 
    def _foo(self):
1322
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1323
 
                     "false"}
1324
 
    
1325
1189
    ## Signals
1326
1190
    
1327
1191
    # CheckerCompleted - signal
2079
1943
            elif suffix == "w":
2080
1944
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2081
1945
            else:
2082
 
                raise ValueError("Unknown suffix {0!r}"
2083
 
                                 .format(suffix))
 
1946
                raise ValueError("Unknown suffix %r" % suffix)
2084
1947
        except (ValueError, IndexError) as e:
2085
1948
            raise ValueError(*(e.args))
2086
1949
        timevalue += delta
2100
1963
        sys.exit()
2101
1964
    if not noclose:
2102
1965
        # Close all standard open file descriptors
2103
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1966
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2104
1967
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2105
1968
            raise OSError(errno.ENODEV,
2106
 
                          "{0} not a character device"
2107
 
                          .format(os.devnull))
 
1969
                          "%s not a character device"
 
1970
                          % os.path.devnull)
2108
1971
        os.dup2(null, sys.stdin.fileno())
2109
1972
        os.dup2(null, sys.stdout.fileno())
2110
1973
        os.dup2(null, sys.stderr.fileno())
2119
1982
    
2120
1983
    parser = argparse.ArgumentParser()
2121
1984
    parser.add_argument("-v", "--version", action="version",
2122
 
                        version = "%(prog)s {0}".format(version),
 
1985
                        version = "%%(prog)s %s" % version,
2123
1986
                        help="show version number and exit")
2124
1987
    parser.add_argument("-i", "--interface", metavar="IF",
2125
1988
                        help="Bind to interface IF")
2228
2091
    
2229
2092
    if server_settings["servicename"] != "Mandos":
2230
2093
        syslogger.setFormatter(logging.Formatter
2231
 
                               ('Mandos ({0}) [%(process)d]:'
2232
 
                                ' %(levelname)s: %(message)s'
2233
 
                                .format(server_settings
2234
 
                                        ["servicename"])))
 
2094
                               ('Mandos (%s) [%%(process)d]:'
 
2095
                                ' %%(levelname)s: %%(message)s'
 
2096
                                % server_settings["servicename"]))
2235
2097
    
2236
2098
    # Parse config file with clients
2237
2099
    client_config = configparser.SafeConfigParser(Client
2258
2120
        except IOError:
2259
2121
            logger.error("Could not open file %r", pidfilename)
2260
2122
    
2261
 
    for name in ("_mandos", "mandos", "nobody"):
 
2123
    try:
 
2124
        uid = pwd.getpwnam("_mandos").pw_uid
 
2125
        gid = pwd.getpwnam("_mandos").pw_gid
 
2126
    except KeyError:
2262
2127
        try:
2263
 
            uid = pwd.getpwnam(name).pw_uid
2264
 
            gid = pwd.getpwnam(name).pw_gid
2265
 
            break
 
2128
            uid = pwd.getpwnam("mandos").pw_uid
 
2129
            gid = pwd.getpwnam("mandos").pw_gid
2266
2130
        except KeyError:
2267
 
            continue
2268
 
    else:
2269
 
        uid = 65534
2270
 
        gid = 65534
 
2131
            try:
 
2132
                uid = pwd.getpwnam("nobody").pw_uid
 
2133
                gid = pwd.getpwnam("nobody").pw_gid
 
2134
            except KeyError:
 
2135
                uid = 65534
 
2136
                gid = 65534
2271
2137
    try:
2272
2138
        os.setgid(gid)
2273
2139
        os.setuid(uid)
2290
2156
         .gnutls_global_set_log_function(debug_gnutls))
2291
2157
        
2292
2158
        # Redirect stdin so all checkers get /dev/null
2293
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2159
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2294
2160
        os.dup2(null, sys.stdin.fileno())
2295
2161
        if null > 2:
2296
2162
            os.close(null)
2304
2170
    
2305
2171
    global main_loop
2306
2172
    # From the Avahi example code
2307
 
    DBusGMainLoop(set_as_default=True)
 
2173
    DBusGMainLoop(set_as_default=True )
2308
2174
    main_loop = gobject.MainLoop()
2309
2175
    bus = dbus.SystemBus()
2310
2176
    # End of Avahi example code
2451
2317
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2452
2318
    
2453
2319
    if use_dbus:
2454
 
        class MandosDBusService(DBusObjectWithProperties):
 
2320
        class MandosDBusService(dbus.service.Object):
2455
2321
            """A D-Bus proxy object"""
2456
2322
            def __init__(self):
2457
2323
                dbus.service.Object.__init__(self, bus, "/")
2458
2324
            _interface = "se.recompile.Mandos"
2459
2325
            
2460
 
            @dbus_interface_annotations(_interface)
2461
 
            def _foo(self):
2462
 
                return { "org.freedesktop.DBus.Property"
2463
 
                         ".EmitsChangedSignal":
2464
 
                             "false"}
2465
 
            
2466
2326
            @dbus.service.signal(_interface, signature="o")
2467
2327
            def ClientAdded(self, objpath):
2468
2328
                "D-Bus signal"
2601
2461
    service.port = tcp_server.socket.getsockname()[1]
2602
2462
    if use_ipv6:
2603
2463
        logger.info("Now listening on address %r, port %d,"
2604
 
                    " flowinfo %d, scope_id %d",
2605
 
                    *tcp_server.socket.getsockname())
 
2464
                    " flowinfo %d, scope_id %d"
 
2465
                    % tcp_server.socket.getsockname())
2606
2466
    else:                       # IPv4
2607
 
        logger.info("Now listening on address %r, port %d",
2608
 
                    *tcp_server.socket.getsockname())
 
2467
        logger.info("Now listening on address %r, port %d"
 
2468
                    % tcp_server.socket.getsockname())
2609
2469
    
2610
2470
    #service.interface = tcp_server.socket.getsockname()[3]
2611
2471
    
2614
2474
        try:
2615
2475
            service.activate()
2616
2476
        except dbus.exceptions.DBusException as error:
2617
 
            logger.critical("D-Bus Exception", exc_info=error)
 
2477
            logger.critical("DBusException: %s", error)
2618
2478
            cleanup()
2619
2479
            sys.exit(1)
2620
2480
        # End of Avahi example code
2627
2487
        logger.debug("Starting main loop")
2628
2488
        main_loop.run()
2629
2489
    except AvahiError as error:
2630
 
        logger.critical("Avahi Error", exc_info=error)
 
2490
        logger.critical("AvahiError: %s", error)
2631
2491
        cleanup()
2632
2492
        sys.exit(1)
2633
2493
    except KeyboardInterrupt: