To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 556
- compare with another revision
- download diff
- download tarball
- view history from revision 556
- Committer: Teddy Hogeborn
- Date: 2012-01-15 20:27:28 UTC
- Revision ID: teddy@recompile.se-20120115202728-185929ww2r84s8xg
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
property.
* mandos (Client.last_checker_status): Use -2 instead of None to match
D-Bus property. All users
changed.
(Client.checked_ok): Remove "timeout" argument and call
"self.bump_timeout()" instead.
(Client.bump_timeout): New; separated out from "checked_ok".
(ClientDBus.last_checker_status): Hook to a D-Bus property.
(ClientDBus.LastCheckerStatus_dbus_property): New D-Bus property.
(ClientHandler.handle): Call client.bump_timeout() instead of
client.checked_ok().
property.
* mandos (Client.last_checker_status): Use -2 instead of None to match
D-Bus property. All users
changed.
(Client.checked_ok): Remove "timeout" argument and call
"self.bump_timeout()" instead.
(Client.bump_timeout): New; separated out from "checked_ok".
(ClientDBus.last_checker_status): Hook to a D-Bus property.
(ClientDBus.LastCheckerStatus_dbus_property): New D-Bus property.
(ClientHandler.handle): Call client.bump_timeout() instead of
client.checked_ok().
- files removed:
- debian/mandos-client.examples
- debian/upstream
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
37
import SocketServer as socketserver
43
38
import socket
44
39
import argparse
45
40
import datetime
50
45
import gnutls.library.functions
51
46
import gnutls.library.constants
52
47
import gnutls.library.types
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
48
import ConfigParser as configparser
57
49
import sys
58
50
import re
59
51
import os
68
60
import struct
69
61
import fcntl
70
62
import functools
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
63
import cPickle as pickle
75
64
import multiprocessing
76
65
import types
77
66
import binascii
78
67
import tempfile
79
import itertools
80
import collections
81
import codecs
82
68
83
69
import dbus
84
70
import dbus.service
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
71
import gobject
89
72
import avahi
90
73
from dbus.mainloop.glib import DBusGMainLoop
91
74
import ctypes
92
75
import ctypes.util
93
76
import xml.dom.minidom
94
77
import inspect
78
import GnuPGInterface
95
79
96
80
try:
97
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
101
85
except ImportError:
102
86
SO_BINDTODEVICE = None
103
87
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
88
version = "1.5.2"
108
89
stored_state_file = "clients.pickle"
109
90
110
91
logger = logging.getLogger()
111
syslogger = None
92
syslogger = (logging.handlers.SysLogHandler
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
address = str("/dev/log")))
112
95
113
96
try:
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
116
100
except (OSError, AttributeError):
117
118
101
def if_nametoindex(interface):
119
102
"Get an interface index the hard way, i.e. using fcntl()"
120
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
104
with contextlib.closing(socket.socket()) as s:
122
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
125
110
return interface_index
126
111
127
112
128
113
def initlogger(debug, level=logging.WARNING):
129
114
"""init logger and add loglevel"""
130
115
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
116
syslogger.setFormatter(logging.Formatter
136
117
('Mandos [%(process)d]: %(levelname)s:'
137
118
' %(message)s'))
154
135
155
136
class PGPEngine(object):
156
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
158
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
159
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
162
'--force-mdc',
163
'--quiet',
164
'--no-use-agent']
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
165
147
166
148
def __enter__(self):
167
149
return self
168
150
169
def __exit__(self, exc_type, exc_value, traceback):
151
def __exit__ (self, exc_type, exc_value, traceback):
170
152
self._cleanup()
171
153
return False
172
154
189
171
def password_encode(self, password):
190
172
# Passphrase can not be empty and can not contain newlines or
191
173
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
198
return encoded
174
return b"mandos" + binascii.hexlify(password)
199
175
200
176
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
205
passfile.flush()
206
proc = subprocess.Popen(['gpg', '--symmetric',
207
'--passphrase-file',
208
passfile.name]
209
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
215
raise PGPError(err)
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
216
191
return ciphertext
217
192
218
193
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
223
passfile.flush()
224
proc = subprocess.Popen(['gpg', '--decrypt',
225
'--passphrase-file',
226
passfile.name]
227
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
233
raise PGPError(err)
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
234
208
return decrypted_plaintext
235
209
236
210
211
237
212
class AvahiError(Exception):
238
213
def __init__(self, value, *args, **kwargs):
239
214
self.value = value
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
215
super(AvahiError, self).__init__(value, *args, **kwargs)
216
def __unicode__(self):
217
return unicode(repr(self.value))
243
218
244
219
class AvahiServiceError(AvahiError):
245
220
pass
246
221
247
248
222
class AvahiGroupError(AvahiError):
249
223
pass
250
224
257
231
Used to optionally bind to the specified interface.
258
232
name: string; Example: 'Mandos'
259
233
type: string; Example: '_mandos._tcp'.
260
See <https://www.iana.org/assignments/service-names-port-numbers>
234
See <http://www.dns-sd.org/ServiceTypes.html>
261
235
port: integer; what port to announce
262
236
TXT: list of strings; TXT record for the service
263
237
domain: string; Domain to publish on, default to .local if empty.
269
243
server: D-Bus Server
270
244
bus: dbus.SystemBus()
271
245
"""
272
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
246
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
247
servicetype = None, port = None, TXT = None,
248
domain = "", host = "", max_renames = 32768,
249
protocol = avahi.PROTO_UNSPEC, bus = None):
284
250
self.interface = interface
285
251
self.name = name
286
252
self.type = servicetype
295
261
self.server = None
296
262
self.bus = bus
297
263
self.entry_group_state_changed_match = None
298
299
def rename(self, remove=True):
264
def rename(self):
300
265
"""Derived from the Avahi example code"""
301
266
if self.rename_count >= self.max_renames:
302
267
logger.critical("No suitable Zeroconf service name found"
303
268
" after %i retries, exiting.",
304
269
self.rename_count)
305
270
raise AvahiServiceError("Too many renames")
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
271
self.name = unicode(self.server
272
.GetAlternativeServiceName(self.name))
309
273
logger.info("Changing Zeroconf service name to %r ...",
310
274
self.name)
311
if remove:
312
self.remove()
275
self.remove()
313
276
try:
314
277
self.add()
315
278
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
324
279
logger.critical("DBusException: %s", error)
280
self.cleanup()
281
os._exit(1)
282
self.rename_count += 1
325
283
def remove(self):
326
284
"""Derived from the Avahi example code"""
327
285
if self.entry_group_state_changed_match is not None:
329
287
self.entry_group_state_changed_match = None
330
288
if self.group is not None:
331
289
self.group.Reset()
332
333
290
def add(self):
334
291
"""Derived from the Avahi example code"""
335
292
self.remove()
352
309
dbus.UInt16(self.port),
353
310
avahi.string_array_to_txt_array(self.TXT))
354
311
self.group.Commit()
355
356
312
def entry_group_state_changed(self, state, error):
357
313
"""Derived from the Avahi example code"""
358
314
logger.debug("Avahi entry group state change: %i", state)
364
320
self.rename()
365
321
elif state == avahi.ENTRY_GROUP_FAILURE:
366
322
logger.critical("Avahi: Error in group state changed %s",
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
369
323
unicode(error))
324
raise AvahiGroupError("State changed: %s"
325
% unicode(error))
370
326
def cleanup(self):
371
327
"""Derived from the Avahi example code"""
372
328
if self.group is not None:
377
333
pass
378
334
self.group = None
379
335
self.remove()
380
381
336
def server_state_changed(self, state, error=None):
382
337
"""Derived from the Avahi example code"""
383
338
logger.debug("Avahi server state change: %i", state)
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
339
bad_states = { avahi.SERVER_INVALID:
340
"Zeroconf server invalid",
341
avahi.SERVER_REGISTERING: None,
342
avahi.SERVER_COLLISION:
343
"Zeroconf server name collision",
344
avahi.SERVER_FAILURE:
345
"Zeroconf server failure" }
390
346
if state in bad_states:
391
347
if bad_states[state] is not None:
392
348
if error is None:
401
357
logger.debug("Unknown state: %r", state)
402
358
else:
403
359
logger.debug("Unknown state: %r: %r", state, error)
404
405
360
def activate(self):
406
361
"""Derived from the Avahi example code"""
407
362
if self.server is None:
411
366
follow_name_owner_changes=True),
412
367
avahi.DBUS_INTERFACE_SERVER)
413
368
self.server.connect_to_signal("StateChanged",
414
self.server_state_changed)
369
self.server_state_changed)
415
370
self.server_state_changed(self.server.GetState())
416
371
417
418
372
class AvahiServiceToSyslog(AvahiService):
419
def rename(self, *args, **kwargs):
373
def rename(self):
420
374
"""Add the new name to the syslog messages"""
421
ret = AvahiService.rename(self, *args, **kwargs)
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
.format(self.name)))
375
ret = AvahiService.rename(self)
376
syslogger.setFormatter(logging.Formatter
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
425
380
return ret
426
381
427
382
def timedelta_to_milliseconds(td):
383
"Convert a datetime.timedelta() to milliseconds"
384
return ((td.days * 24 * 60 * 60 * 1000)
385
+ (td.seconds * 1000)
386
+ (td.microseconds // 1000))
387
428
388
class Client(object):
429
389
"""A representation of a client host served by this server.
430
390
466
426
runtime_expansions: Allowed attributes for runtime expansion.
467
427
expires: datetime.datetime(); time (UTC) when a client will be
468
428
disabled, or None
469
server_settings: The server_settings dict from main()
470
429
"""
471
430
472
431
runtime_expansions = ("approval_delay", "approval_duration",
473
"created", "enabled", "expires",
474
"fingerprint", "host", "interval",
475
"last_approval_request", "last_checked_ok",
432
"created", "enabled", "fingerprint",
433
"host", "interval", "last_checked_ok",
476
434
"last_enabled", "name", "timeout")
477
client_defaults = {
478
"timeout": "PT5M",
479
"extended_timeout": "PT15M",
480
"interval": "PT2M",
481
"checker": "fping -q -- %%(host)s",
482
"host": "",
483
"approval_delay": "PT0S",
484
"approval_duration": "PT1S",
485
"approved_by_default": "True",
486
"enabled": "True",
487
}
488
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
446
def timeout_milliseconds(self):
447
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
449
450
def extended_timeout_milliseconds(self):
451
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
453
454
def interval_milliseconds(self):
455
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
457
458
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
489
461
@staticmethod
490
462
def config_parser(config):
491
463
"""Construct a new dict of client settings of this form:
506
478
client["enabled"] = config.getboolean(client_name,
507
479
"enabled")
508
480
509
# Uppercase and remove spaces from fingerprint for later
510
# comparison purposes with return value from the
511
# fingerprint() function
512
481
client["fingerprint"] = (section["fingerprint"].upper()
513
482
.replace(" ", ""))
514
483
if "secret" in section:
519
488
"rb") as secfile:
520
489
client["secret"] = secfile.read()
521
490
else:
522
raise TypeError("No secret or secfile for section {}"
523
.format(section))
491
raise TypeError("No secret or secfile for section %s"
492
% section)
524
493
client["timeout"] = string_to_delta(section["timeout"])
525
494
client["extended_timeout"] = string_to_delta(
526
495
section["extended_timeout"])
535
504
client["last_checker_status"] = -2
536
505
537
506
return settings
538
539
def __init__(self, settings, name = None, server_settings=None):
507
508
509
def __init__(self, settings, name = None):
510
"""Note: the 'checker' key in 'config' sets the
511
'checker_command' attribute and *not* the 'checker'
512
attribute."""
540
513
self.name = name
541
if server_settings is None:
542
server_settings = {}
543
self.server_settings = server_settings
544
514
# adding all client settings
545
for setting, value in settings.items():
515
for setting, value in settings.iteritems():
546
516
setattr(self, setting, value)
547
517
548
518
if self.enabled:
554
524
else:
555
525
self.last_enabled = None
556
526
self.expires = None
557
527
558
528
logger.debug("Creating client %r", self.name)
529
# Uppercase and remove spaces from fingerprint for later
530
# comparison purposes with return value from the fingerprint()
531
# function
559
532
logger.debug(" Fingerprint: %s", self.fingerprint)
560
533
self.created = settings.get("created",
561
534
datetime.datetime.utcnow())
562
535
563
536
# attributes specific for this server instance
564
537
self.checker = None
565
538
self.checker_initiator_tag = None
568
541
self.current_checker_command = None
569
542
self.approved = None
570
543
self.approvals_pending = 0
571
self.changedstate = multiprocessing_manager.Condition(
572
multiprocessing_manager.Lock())
573
self.client_structure = [attr
574
for attr in self.__dict__.iterkeys()
544
self.changedstate = (multiprocessing_manager
545
.Condition(multiprocessing_manager
546
.Lock()))
547
self.client_structure = [attr for attr in
548
self.__dict__.iterkeys()
575
549
if not attr.startswith("_")]
576
550
self.client_structure.append("client_structure")
577
551
578
for name, t in inspect.getmembers(
579
type(self), lambda obj: isinstance(obj, property)):
552
for name, t in inspect.getmembers(type(self),
553
lambda obj:
554
isinstance(obj,
555
property)):
580
556
if not name.startswith("_"):
581
557
self.client_structure.append(name)
582
558
590
566
if getattr(self, "enabled", False):
591
567
# Already enabled
592
568
return
569
self.send_changedstate()
593
570
self.expires = datetime.datetime.utcnow() + self.timeout
594
571
self.enabled = True
595
572
self.last_enabled = datetime.datetime.utcnow()
596
573
self.init_checker()
597
self.send_changedstate()
598
574
599
575
def disable(self, quiet=True):
600
576
"""Disable this client."""
601
577
if not getattr(self, "enabled", False):
602
578
return False
603
579
if not quiet:
580
self.send_changedstate()
581
if not quiet:
604
582
logger.info("Disabling client %s", self.name)
605
if getattr(self, "disable_initiator_tag", None) is not None:
583
if getattr(self, "disable_initiator_tag", False):
606
584
gobject.source_remove(self.disable_initiator_tag)
607
585
self.disable_initiator_tag = None
608
586
self.expires = None
609
if getattr(self, "checker_initiator_tag", None) is not None:
587
if getattr(self, "checker_initiator_tag", False):
610
588
gobject.source_remove(self.checker_initiator_tag)
611
589
self.checker_initiator_tag = None
612
590
self.stop_checker()
613
591
self.enabled = False
614
if not quiet:
615
self.send_changedstate()
616
592
# Do not run this again if called by a gobject.timeout_add
617
593
return False
618
594
622
598
def init_checker(self):
623
599
# Schedule a new checker to be started an 'interval' from now,
624
600
# and every interval from then on.
625
if self.checker_initiator_tag is not None:
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
629
self.start_checker)
601
self.checker_initiator_tag = (gobject.timeout_add
602
(self.interval_milliseconds(),
603
self.start_checker))
630
604
# Schedule a disable() when 'timeout' has passed
631
if self.disable_initiator_tag is not None:
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
634
int(self.timeout.total_seconds() * 1000), self.disable)
605
self.disable_initiator_tag = (gobject.timeout_add
606
(self.timeout_milliseconds(),
607
self.disable))
635
608
# Also start a new checker *right now*.
636
609
self.start_checker()
637
610
646
619
vars(self))
647
620
self.checked_ok()
648
621
else:
649
logger.info("Checker for %(name)s failed", vars(self))
622
logger.info("Checker for %(name)s failed",
623
vars(self))
650
624
else:
651
625
self.last_checker_status = -1
652
626
logger.warning("Checker for %(name)s crashed?",
664
638
timeout = self.timeout
665
639
if self.disable_initiator_tag is not None:
666
640
gobject.source_remove(self.disable_initiator_tag)
667
self.disable_initiator_tag = None
668
641
if getattr(self, "enabled", False):
669
self.disable_initiator_tag = gobject.timeout_add(
670
int(timeout.total_seconds() * 1000), self.disable)
642
self.disable_initiator_tag = (gobject.timeout_add
643
(timedelta_to_milliseconds
644
(timeout), self.disable))
671
645
self.expires = datetime.datetime.utcnow() + timeout
672
646
673
647
def need_approval(self):
679
653
If a checker already exists, leave it running and do
680
654
nothing."""
681
655
# The reason for not killing a running checker is that if we
682
# did that, and if a checker (for some reason) started running
683
# slowly and taking more than 'interval' time, then the client
684
# would inevitably timeout, since no checker would get a
685
# chance to run to completion. If we instead leave running
656
# did that, then if a checker (for some reason) started
657
# running slowly and taking more than 'interval' time, the
658
# client would inevitably timeout, since no checker would get
659
# a chance to run to completion. If we instead leave running
686
660
# checkers alone, the checker would have to take more time
687
661
# than 'timeout' for the client to be disabled, which is as it
688
662
# should be.
690
664
# If a checker exists, make sure it is not a zombie
691
665
try:
692
666
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except AttributeError:
694
pass
695
except OSError as error:
696
if error.errno != errno.ECHILD:
697
raise
667
except (AttributeError, OSError) as error:
668
if (isinstance(error, OSError)
669
and error.errno != errno.ECHILD):
670
raise error
698
671
else:
699
672
if pid:
700
673
logger.warning("Checker was a zombie")
703
676
self.current_checker_command)
704
677
# Start a new checker if needed
705
678
if self.checker is None:
706
# Escape attributes for the shell
707
escaped_attrs = {
708
attr: re.escape(str(getattr(self, attr)))
709
for attr in self.runtime_expansions }
710
679
try:
711
command = self.checker_command % escaped_attrs
712
except TypeError as error:
713
logger.error('Could not format string "%s"',
714
self.checker_command,
715
exc_info=error)
716
return True # Try again later
680
# In case checker_command has exactly one % operator
681
command = self.checker_command % self.host
682
except TypeError:
683
# Escape attributes for the shell
684
escaped_attrs = dict(
685
(attr,
686
re.escape(unicode(str(getattr(self, attr, "")),
687
errors=
688
'replace')))
689
for attr in
690
self.runtime_expansions)
691
692
try:
693
command = self.checker_command % escaped_attrs
694
except TypeError as error:
695
logger.error('Could not format string "%s":'
696
' %s', self.checker_command, error)
697
return True # Try again later
717
698
self.current_checker_command = command
718
699
try:
719
logger.info("Starting checker %r for %s", command,
720
self.name)
700
logger.info("Starting checker %r for %s",
701
command, self.name)
721
702
# We don't need to redirect stdout and stderr, since
722
703
# in normal mode, that is already done by daemon(),
723
704
# and in debug mode we don't want to. (Stdin is
724
705
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
727
# created wnull.
728
popen_args = {}
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
732
"stderr": wnull })
733
706
self.checker = subprocess.Popen(command,
734
707
close_fds=True,
735
shell=True,
736
cwd="/",
737
**popen_args)
738
except OSError as error:
739
logger.error("Failed to start subprocess",
740
exc_info=error)
741
return True
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
746
try:
708
shell=True, cwd="/")
709
self.checker_callback_tag = (gobject.child_watch_add
710
(self.checker.pid,
711
self.checker_callback,
712
data=command))
713
# The checker may have completed before the gobject
714
# watch was added. Check for this.
747
715
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
716
if pid:
717
gobject.source_remove(self.checker_callback_tag)
718
self.checker_callback(pid, status, command)
748
719
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
752
exc_info=error)
753
return True
754
raise
755
if pid:
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
720
logger.error("Failed to start subprocess: %s",
721
error)
758
722
# Re-run this periodically if run by gobject.timeout_add
759
723
return True
760
724
767
731
return
768
732
logger.debug("Stopping checker for %(name)s", vars(self))
769
733
try:
770
self.checker.terminate()
734
os.kill(self.checker.pid, signal.SIGTERM)
771
735
#time.sleep(0.5)
772
736
#if self.checker.poll() is None:
773
# self.checker.kill()
737
# os.kill(self.checker.pid, signal.SIGKILL)
774
738
except OSError as error:
775
739
if error.errno != errno.ESRCH: # No such process
776
740
raise
777
741
self.checker = None
778
742
779
743
780
def dbus_service_property(dbus_interface,
781
signature="v",
782
access="readwrite",
783
byte_arrays=False):
744
def dbus_service_property(dbus_interface, signature="v",
745
access="readwrite", byte_arrays=False):
784
746
"""Decorators for marking methods of a DBusObjectWithProperties to
785
747
become properties on the D-Bus.
786
748
795
757
# "Set" method, so we fail early here:
796
758
if byte_arrays and signature != "ay":
797
759
raise ValueError("Byte arrays not supported for non-'ay'"
798
" signature {!r}".format(signature))
799
760
" signature %r" % signature)
800
761
def decorator(func):
801
762
func._dbus_is_property = True
802
763
func._dbus_interface = dbus_interface
807
768
func._dbus_name = func._dbus_name[:-14]
808
769
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
809
770
return func
810
811
return decorator
812
813
814
def dbus_interface_annotations(dbus_interface):
815
"""Decorator for marking functions returning interface annotations
816
817
Usage:
818
819
@dbus_interface_annotations("org.example.Interface")
820
def _foo(self): # Function name does not matter
821
return {"org.freedesktop.DBus.Deprecated": "true",
822
"org.freedesktop.DBus.Property.EmitsChangedSignal":
823
"false"}
824
"""
825
826
def decorator(func):
827
func._dbus_is_interface = True
828
func._dbus_interface = dbus_interface
829
func._dbus_name = dbus_interface
830
return func
831
832
return decorator
833
834
835
def dbus_annotations(annotations):
836
"""Decorator to annotate D-Bus methods, signals or properties
837
Usage:
838
839
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
842
@dbus_service_property("org.example.Interface", signature="b",
843
access="r")
844
def Property_dbus_property(self):
845
return dbus.Boolean(False)
846
"""
847
848
def decorator(func):
849
func._dbus_annotations = annotations
850
return func
851
852
771
return decorator
853
772
854
773
855
774
class DBusPropertyException(dbus.exceptions.DBusException):
856
775
"""A base class for D-Bus property-related exceptions
857
776
"""
858
pass
777
def __unicode__(self):
778
return unicode(str(self))
859
779
860
780
861
781
class DBusPropertyAccessException(DBusPropertyException):
879
799
"""
880
800
881
801
@staticmethod
882
def _is_dbus_thing(thing):
883
"""Returns a function testing if an attribute is a D-Bus thing
884
885
If called like _is_dbus_thing("method") it returns a function
886
suitable for use as predicate to inspect.getmembers().
887
"""
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
889
False)
802
def _is_dbus_property(obj):
803
return getattr(obj, "_dbus_is_property", False)
890
804
891
def _get_all_dbus_things(self, thing):
805
def _get_all_dbus_properties(self):
892
806
"""Returns a generator of (name, attribute) pairs
893
807
"""
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
895
athing.__get__(self))
808
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
896
809
for cls in self.__class__.__mro__
897
for name, athing in
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
810
for name, prop in
811
inspect.getmembers(cls, self._is_dbus_property))
899
812
900
813
def _get_dbus_property(self, interface_name, property_name):
901
814
"""Returns a bound method if one exists which is a D-Bus
902
815
property with the specified name and interface.
903
816
"""
904
for cls in self.__class__.__mro__:
905
for name, value in inspect.getmembers(
906
cls, self._is_dbus_thing("property")):
817
for cls in self.__class__.__mro__:
818
for name, value in (inspect.getmembers
819
(cls, self._is_dbus_property)):
907
820
if (value._dbus_name == property_name
908
821
and value._dbus_interface == interface_name):
909
822
return value.__get__(self)
910
823
911
824
# No such property
912
raise DBusPropertyNotFound("{}:{}.{}".format(
913
self.dbus_object_path, interface_name, property_name))
825
raise DBusPropertyNotFound(self.dbus_object_path + ":"
826
+ interface_name + "."
827
+ property_name)
914
828
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
916
in_signature="ss",
829
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
917
830
out_signature="v")
918
831
def Get(self, interface_name, property_name):
919
832
"""Standard D-Bus property Get() method, see D-Bus standard.
937
850
# The byte_arrays option is not supported yet on
938
851
# signatures other than "ay".
939
852
if prop._dbus_signature != "ay":
940
raise ValueError("Byte arrays not supported for non-"
941
"'ay' signature {!r}"
942
.format(prop._dbus_signature))
853
raise ValueError
943
854
value = dbus.ByteArray(b''.join(chr(byte)
944
855
for byte in value))
945
856
prop(value)
946
857
947
@dbus.service.method(dbus.PROPERTIES_IFACE,
948
in_signature="s",
858
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
949
859
out_signature="a{sv}")
950
860
def GetAll(self, interface_name):
951
861
"""Standard D-Bus property GetAll() method, see D-Bus
954
864
Note: Will not include properties with access="write".
955
865
"""
956
866
properties = {}
957
for name, prop in self._get_all_dbus_things("property"):
867
for name, prop in self._get_all_dbus_properties():
958
868
if (interface_name
959
869
and interface_name != prop._dbus_interface):
960
870
# Interface non-empty but did not match
966
876
if not hasattr(value, "variant_level"):
967
877
properties[name] = value
968
878
continue
969
properties[name] = type(value)(
970
value, variant_level = value.variant_level + 1)
879
properties[name] = type(value)(value, variant_level=
880
value.variant_level+1)
971
881
return dbus.Dictionary(properties, signature="sv")
972
882
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
974
def PropertiesChanged(self, interface_name, changed_properties,
975
invalidated_properties):
976
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
977
standard.
978
"""
979
pass
980
981
883
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
982
884
out_signature="s",
983
885
path_keyword='object_path',
984
886
connection_keyword='connection')
985
887
def Introspect(self, object_path, connection):
986
"""Overloading of standard D-Bus method.
987
988
Inserts property tags and interface annotation tags.
888
"""Standard D-Bus method, overloaded to insert property tags.
989
889
"""
990
890
xmlstring = dbus.service.Object.Introspect(self, object_path,
991
891
connection)
992
892
try:
993
893
document = xml.dom.minidom.parseString(xmlstring)
994
995
894
def make_tag(document, name, prop):
996
895
e = document.createElement("property")
997
896
e.setAttribute("name", name)
998
897
e.setAttribute("type", prop._dbus_signature)
999
898
e.setAttribute("access", prop._dbus_access)
1000
899
return e
1001
1002
900
for if_tag in document.getElementsByTagName("interface"):
1003
# Add property tags
1004
901
for tag in (make_tag(document, name, prop)
1005
902
for name, prop
1006
in self._get_all_dbus_things("property")
903
in self._get_all_dbus_properties()
1007
904
if prop._dbus_interface
1008
905
== if_tag.getAttribute("name")):
1009
906
if_tag.appendChild(tag)
1010
# Add annotation tags
1011
for typ in ("method", "signal", "property"):
1012
for tag in if_tag.getElementsByTagName(typ):
1013
annots = dict()
1014
for name, prop in (self.
1015
_get_all_dbus_things(typ)):
1016
if (name == tag.getAttribute("name")
1017
and prop._dbus_interface
1018
== if_tag.getAttribute("name")):
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
1022
ann_tag = document.createElement(
1023
"annotation")
1024
ann_tag.setAttribute("name", name)
1025
ann_tag.setAttribute("value", value)
1026
tag.appendChild(ann_tag)
1027
# Add interface annotation tags
1028
for annotation, value in dict(
1029
itertools.chain.from_iterable(
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1033
if name == if_tag.getAttribute("name")
1034
)).items():
1035
ann_tag = document.createElement("annotation")
1036
ann_tag.setAttribute("name", annotation)
1037
ann_tag.setAttribute("value", value)
1038
if_tag.appendChild(ann_tag)
1039
907
# Add the names to the return values for the
1040
908
# "org.freedesktop.DBus.Properties" methods
1041
909
if (if_tag.getAttribute("name")
1056
924
except (AttributeError, xml.dom.DOMException,
1057
925
xml.parsers.expat.ExpatError) as error:
1058
926
logger.error("Failed to override Introspection method",
1059
exc_info=error)
927
error)
1060
928
return xmlstring
1061
929
1062
930
1063
def datetime_to_dbus(dt, variant_level=0):
931
def datetime_to_dbus (dt, variant_level=0):
1064
932
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
933
if dt is None:
1066
934
return dbus.String("", variant_level = variant_level)
1067
return dbus.String(dt.isoformat(), variant_level=variant_level)
1068
1069
1070
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1071
"""A class decorator; applied to a subclass of
1072
dbus.service.Object, it will add alternate D-Bus attributes with
1073
interface names according to the "alt_interface_names" mapping.
1074
Usage:
1075
1076
@alternate_dbus_interfaces({"org.example.Interface":
1077
"net.example.AlternateInterface"})
1078
class SampleDBusObject(dbus.service.Object):
1079
@dbus.service.method("org.example.Interface")
1080
def SampleDBusMethod():
1081
pass
1082
1083
The above "SampleDBusMethod" on "SampleDBusObject" will be
1084
reachable via two interfaces: "org.example.Interface" and
1085
"net.example.AlternateInterface", the latter of which will have
1086
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1087
"true", unless "deprecate" is passed with a False value.
1088
1089
This works for methods and signals, and also for D-Bus properties
1090
(from DBusObjectWithProperties) and interfaces (from the
1091
dbus_interface_annotations decorator).
935
return dbus.String(dt.isoformat(),
936
variant_level=variant_level)
937
938
939
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
940
.__metaclass__):
941
"""Applied to an empty subclass of a D-Bus object, this metaclass
942
will add additional D-Bus attributes matching a certain pattern.
1092
943
"""
1093
1094
def wrapper(cls):
1095
for orig_interface_name, alt_interface_name in (
1096
alt_interface_names.items()):
1097
attr = {}
1098
interface_names = set()
1099
# Go though all attributes of the class
1100
for attrname, attribute in inspect.getmembers(cls):
944
def __new__(mcs, name, bases, attr):
945
# Go through all the base classes which could have D-Bus
946
# methods, signals, or properties in them
947
for base in (b for b in bases
948
if issubclass(b, dbus.service.Object)):
949
# Go though all attributes of the base class
950
for attrname, attribute in inspect.getmembers(base):
1101
951
# Ignore non-D-Bus attributes, and D-Bus attributes
1102
952
# with the wrong interface name
1103
953
if (not hasattr(attribute, "_dbus_interface")
1104
or not attribute._dbus_interface.startswith(
1105
orig_interface_name)):
954
or not attribute._dbus_interface
955
.startswith("se.recompile.Mandos")):
1106
956
continue
1107
957
# Create an alternate D-Bus interface name based on
1108
958
# the current name
1109
alt_interface = attribute._dbus_interface.replace(
1110
orig_interface_name, alt_interface_name)
1111
interface_names.add(alt_interface)
959
alt_interface = (attribute._dbus_interface
960
.replace("se.recompile.Mandos",
961
"se.bsnet.fukt.Mandos"))
1112
962
# Is this a D-Bus signal?
1113
963
if getattr(attribute, "_dbus_is_signal", False):
1114
if sys.version == 2:
1115
# Extract the original non-method undecorated
1116
# function by black magic
1117
nonmethod_func = (dict(
964
# Extract the original non-method function by
965
# black magic
966
nonmethod_func = (dict(
1118
967
zip(attribute.func_code.co_freevars,
1119
attribute.__closure__))
1120
["func"].cell_contents)
1121
else:
1122
nonmethod_func = attribute
968
attribute.__closure__))["func"]
969
.cell_contents)
1123
970
# Create a new, but exactly alike, function
1124
971
# object, and decorate it to be a new D-Bus signal
1125
972
# with the alternate D-Bus interface name
1126
if sys.version == 2:
1127
new_function = types.FunctionType(
1128
nonmethod_func.func_code,
1129
nonmethod_func.func_globals,
1130
nonmethod_func.func_name,
1131
nonmethod_func.func_defaults,
1132
nonmethod_func.func_closure)
1133
else:
1134
new_function = types.FunctionType(
1135
nonmethod_func.__code__,
1136
nonmethod_func.__globals__,
1137
nonmethod_func.__name__,
1138
nonmethod_func.__defaults__,
1139
nonmethod_func.__closure__)
1140
new_function = (dbus.service.signal(
1141
alt_interface,
1142
attribute._dbus_signature)(new_function))
1143
# Copy annotations, if any
1144
try:
1145
new_function._dbus_annotations = dict(
1146
attribute._dbus_annotations)
1147
except AttributeError:
1148
pass
973
new_function = (dbus.service.signal
974
(alt_interface,
975
attribute._dbus_signature)
976
(types.FunctionType(
977
nonmethod_func.func_code,
978
nonmethod_func.func_globals,
979
nonmethod_func.func_name,
980
nonmethod_func.func_defaults,
981
nonmethod_func.func_closure)))
1149
982
# Define a creator of a function to call both the
1150
# original and alternate functions, so both the
1151
# original and alternate signals gets sent when
1152
# the function is called
983
# old and new functions, so both the old and new
984
# signals gets sent when the function is called
1153
985
def fixscope(func1, func2):
1154
986
"""This function is a scope container to pass
1155
987
func1 and func2 to the "call_both" function
1156
988
outside of its arguments"""
1157
1158
989
def call_both(*args, **kwargs):
1159
990
"""This function will emit two D-Bus
1160
991
signals by calling func1 and func2"""
1161
992
func1(*args, **kwargs)
1162
993
func2(*args, **kwargs)
1163
1164
994
return call_both
1165
995
# Create the "call_both" function and add it to
1166
996
# the class
1167
attr[attrname] = fixscope(attribute, new_function)
997
attr[attrname] = fixscope(attribute,
998
new_function)
1168
999
# Is this a D-Bus method?
1169
1000
elif getattr(attribute, "_dbus_is_method", False):
1170
1001
# Create a new, but exactly alike, function
1171
1002
# object. Decorate it to be a new D-Bus method
1172
1003
# with the alternate D-Bus interface name. Add it
1173
1004
# to the class.
1174
attr[attrname] = (
1175
dbus.service.method(
1176
alt_interface,
1177
attribute._dbus_in_signature,
1178
attribute._dbus_out_signature)
1179
(types.FunctionType(attribute.func_code,
1180
attribute.func_globals,
1181
attribute.func_name,
1182
attribute.func_defaults,
1183
attribute.func_closure)))
1184
# Copy annotations, if any
1185
try:
1186
attr[attrname]._dbus_annotations = dict(
1187
attribute._dbus_annotations)
1188
except AttributeError:
1189
pass
1005
attr[attrname] = (dbus.service.method
1006
(alt_interface,
1007
attribute._dbus_in_signature,
1008
attribute._dbus_out_signature)
1009
(types.FunctionType
1010
(attribute.func_code,
1011
attribute.func_globals,
1012
attribute.func_name,
1013
attribute.func_defaults,
1014
attribute.func_closure)))
1190
1015
# Is this a D-Bus property?
1191
1016
elif getattr(attribute, "_dbus_is_property", False):
1192
1017
# Create a new, but exactly alike, function
1193
1018
# object, and decorate it to be a new D-Bus
1194
1019
# property with the alternate D-Bus interface
1195
1020
# name. Add it to the class.
1196
attr[attrname] = (dbus_service_property(
1197
alt_interface, attribute._dbus_signature,
1198
attribute._dbus_access,
1199
attribute._dbus_get_args_options
1200
["byte_arrays"])
1201
(types.FunctionType(
1202
attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1207
# Copy annotations, if any
1208
try:
1209
attr[attrname]._dbus_annotations = dict(
1210
attribute._dbus_annotations)
1211
except AttributeError:
1212
pass
1213
# Is this a D-Bus interface?
1214
elif getattr(attribute, "_dbus_is_interface", False):
1215
# Create a new, but exactly alike, function
1216
# object. Decorate it to be a new D-Bus interface
1217
# with the alternate D-Bus interface name. Add it
1218
# to the class.
1219
attr[attrname] = (
1220
dbus_interface_annotations(alt_interface)
1221
(types.FunctionType(attribute.func_code,
1222
attribute.func_globals,
1223
attribute.func_name,
1224
attribute.func_defaults,
1225
attribute.func_closure)))
1226
if deprecate:
1227
# Deprecate all alternate interfaces
1228
iname="_AlternateDBusNames_interface_annotation{}"
1229
for interface_name in interface_names:
1230
1231
@dbus_interface_annotations(interface_name)
1232
def func(self):
1233
return { "org.freedesktop.DBus.Deprecated":
1234
"true" }
1235
# Find an unused name
1236
for aname in (iname.format(i)
1237
for i in itertools.count()):
1238
if aname not in attr:
1239
attr[aname] = func
1240
break
1241
if interface_names:
1242
# Replace the class with a new subclass of it with
1243
# methods, signals, etc. as created above.
1244
cls = type(b"{}Alternate".format(cls.__name__),
1245
(cls, ), attr)
1246
return cls
1247
1248
return wrapper
1249
1250
1251
@alternate_dbus_interfaces({"se.recompile.Mandos":
1252
"se.bsnet.fukt.Mandos"})
1021
attr[attrname] = (dbus_service_property
1022
(alt_interface,
1023
attribute._dbus_signature,
1024
attribute._dbus_access,
1025
attribute
1026
._dbus_get_args_options
1027
["byte_arrays"])
1028
(types.FunctionType
1029
(attribute.func_code,
1030
attribute.func_globals,
1031
attribute.func_name,
1032
attribute.func_defaults,
1033
attribute.func_closure)))
1034
return type.__new__(mcs, name, bases, attr)
1035
1036
1253
1037
class ClientDBus(Client, DBusObjectWithProperties):
1254
1038
"""A Client class using D-Bus
1255
1039
1259
1043
"""
1260
1044
1261
1045
runtime_expansions = (Client.runtime_expansions
1262
+ ("dbus_object_path", ))
1263
1264
_interface = "se.recompile.Mandos.Client"
1046
+ ("dbus_object_path",))
1265
1047
1266
1048
# dbus.service.Object doesn't use super(), so we can't either.
1267
1049
1270
1052
Client.__init__(self, *args, **kwargs)
1271
1053
# Only now, when this client is initialized, can it show up on
1272
1054
# the D-Bus
1273
client_object_name = str(self.name).translate(
1055
client_object_name = unicode(self.name).translate(
1274
1056
{ord("."): ord("_"),
1275
1057
ord("-"): ord("_")})
1276
self.dbus_object_path = dbus.ObjectPath(
1277
"/clients/" + client_object_name)
1058
self.dbus_object_path = (dbus.ObjectPath
1059
("/clients/" + client_object_name))
1278
1060
DBusObjectWithProperties.__init__(self, self.bus,
1279
1061
self.dbus_object_path)
1280
1281
def notifychangeproperty(transform_func, dbus_name,
1282
type_func=lambda x: x,
1283
variant_level=1,
1284
invalidate_only=False,
1285
_interface=_interface):
1062
1063
def notifychangeproperty(transform_func,
1064
dbus_name, type_func=lambda x: x,
1065
variant_level=1):
1286
1066
""" Modify a variable so that it's a property which announces
1287
1067
its changes to DBus.
1288
1068
1293
1073
to the D-Bus. Default: no transform
1294
1074
variant_level: D-Bus variant level. Default: 1
1295
1075
"""
1296
attrname = "_{}".format(dbus_name)
1297
1076
attrname = "_{0}".format(dbus_name)
1298
1077
def setter(self, value):
1299
1078
if hasattr(self, "dbus_object_path"):
1300
1079
if (not hasattr(self, attrname) or
1301
1080
type_func(getattr(self, attrname, None))
1302
1081
!= type_func(value)):
1303
if invalidate_only:
1304
self.PropertiesChanged(
1305
_interface, dbus.Dictionary(),
1306
dbus.Array((dbus_name, )))
1307
else:
1308
dbus_value = transform_func(
1309
type_func(value),
1310
variant_level = variant_level)
1311
self.PropertyChanged(dbus.String(dbus_name),
1312
dbus_value)
1313
self.PropertiesChanged(
1314
_interface,
1315
dbus.Dictionary({ dbus.String(dbus_name):
1316
dbus_value }),
1317
dbus.Array())
1082
dbus_value = transform_func(type_func(value),
1083
variant_level
1084
=variant_level)
1085
self.PropertyChanged(dbus.String(dbus_name),
1086
dbus_value)
1318
1087
setattr(self, attrname, value)
1319
1088
1320
1089
return property(lambda self: getattr(self, attrname), setter)
1321
1090
1091
1322
1092
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1323
1093
approvals_pending = notifychangeproperty(dbus.Boolean,
1324
1094
"ApprovalPending",
1326
1096
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1327
1097
last_enabled = notifychangeproperty(datetime_to_dbus,
1328
1098
"LastEnabled")
1329
checker = notifychangeproperty(
1330
dbus.Boolean, "CheckerRunning",
1331
type_func = lambda checker: checker is not None)
1099
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1100
type_func = lambda checker:
1101
checker is not None)
1332
1102
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1333
1103
"LastCheckedOK")
1334
1104
last_checker_status = notifychangeproperty(dbus.Int16,
1337
1107
datetime_to_dbus, "LastApprovalRequest")
1338
1108
approved_by_default = notifychangeproperty(dbus.Boolean,
1339
1109
"ApprovedByDefault")
1340
approval_delay = notifychangeproperty(
1341
dbus.UInt64, "ApprovalDelay",
1342
type_func = lambda td: td.total_seconds() * 1000)
1110
approval_delay = notifychangeproperty(dbus.UInt64,
1111
"ApprovalDelay",
1112
type_func =
1113
timedelta_to_milliseconds)
1343
1114
approval_duration = notifychangeproperty(
1344
1115
dbus.UInt64, "ApprovalDuration",
1345
type_func = lambda td: td.total_seconds() * 1000)
1116
type_func = timedelta_to_milliseconds)
1346
1117
host = notifychangeproperty(dbus.String, "Host")
1347
timeout = notifychangeproperty(
1348
dbus.UInt64, "Timeout",
1349
type_func = lambda td: td.total_seconds() * 1000)
1118
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1119
type_func =
1120
timedelta_to_milliseconds)
1350
1121
extended_timeout = notifychangeproperty(
1351
1122
dbus.UInt64, "ExtendedTimeout",
1352
type_func = lambda td: td.total_seconds() * 1000)
1353
interval = notifychangeproperty(
1354
dbus.UInt64, "Interval",
1355
type_func = lambda td: td.total_seconds() * 1000)
1123
type_func = timedelta_to_milliseconds)
1124
interval = notifychangeproperty(dbus.UInt64,
1125
"Interval",
1126
type_func =
1127
timedelta_to_milliseconds)
1356
1128
checker_command = notifychangeproperty(dbus.String, "Checker")
1357
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1358
invalidate_only=True)
1359
1129
1360
1130
del notifychangeproperty
1361
1131
1388
1158
*args, **kwargs)
1389
1159
1390
1160
def start_checker(self, *args, **kwargs):
1391
old_checker_pid = getattr(self.checker, "pid", None)
1161
old_checker = self.checker
1162
if self.checker is not None:
1163
old_checker_pid = self.checker.pid
1164
else:
1165
old_checker_pid = None
1392
1166
r = Client.start_checker(self, *args, **kwargs)
1393
1167
# Only if new checker process was started
1394
1168
if (self.checker is not None
1402
1176
return False
1403
1177
1404
1178
def approve(self, value=True):
1179
self.send_changedstate()
1405
1180
self.approved = value
1406
gobject.timeout_add(int(self.approval_duration.total_seconds()
1407
* 1000), self._reset_approved)
1408
self.send_changedstate()
1181
gobject.timeout_add(timedelta_to_milliseconds
1182
(self.approval_duration),
1183
self._reset_approved)
1184
1409
1185
1410
1186
## D-Bus methods, signals & properties
1411
1412
## Interfaces
1187
_interface = "se.recompile.Mandos.Client"
1413
1188
1414
1189
## Signals
1415
1190
1426
1201
pass
1427
1202
1428
1203
# PropertyChanged - signal
1429
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1430
1204
@dbus.service.signal(_interface, signature="sv")
1431
1205
def PropertyChanged(self, property, value):
1432
1206
"D-Bus signal"
1496
1270
return dbus.Boolean(bool(self.approvals_pending))
1497
1271
1498
1272
# ApprovedByDefault - property
1499
@dbus_service_property(_interface,
1500
signature="b",
1273
@dbus_service_property(_interface, signature="b",
1501
1274
access="readwrite")
1502
1275
def ApprovedByDefault_dbus_property(self, value=None):
1503
1276
if value is None: # get
1505
1278
self.approved_by_default = bool(value)
1506
1279
1507
1280
# ApprovalDelay - property
1508
@dbus_service_property(_interface,
1509
signature="t",
1281
@dbus_service_property(_interface, signature="t",
1510
1282
access="readwrite")
1511
1283
def ApprovalDelay_dbus_property(self, value=None):
1512
1284
if value is None: # get
1513
return dbus.UInt64(self.approval_delay.total_seconds()
1514
* 1000)
1285
return dbus.UInt64(self.approval_delay_milliseconds())
1515
1286
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1516
1287
1517
1288
# ApprovalDuration - property
1518
@dbus_service_property(_interface,
1519
signature="t",
1289
@dbus_service_property(_interface, signature="t",
1520
1290
access="readwrite")
1521
1291
def ApprovalDuration_dbus_property(self, value=None):
1522
1292
if value is None: # get
1523
return dbus.UInt64(self.approval_duration.total_seconds()
1524
* 1000)
1293
return dbus.UInt64(timedelta_to_milliseconds(
1294
self.approval_duration))
1525
1295
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1526
1296
1527
1297
# Name - property
1535
1305
return dbus.String(self.fingerprint)
1536
1306
1537
1307
# Host - property
1538
@dbus_service_property(_interface,
1539
signature="s",
1308
@dbus_service_property(_interface, signature="s",
1540
1309
access="readwrite")
1541
1310
def Host_dbus_property(self, value=None):
1542
1311
if value is None: # get
1543
1312
return dbus.String(self.host)
1544
self.host = str(value)
1313
self.host = unicode(value)
1545
1314
1546
1315
# Created - property
1547
1316
@dbus_service_property(_interface, signature="s", access="read")
1554
1323
return datetime_to_dbus(self.last_enabled)
1555
1324
1556
1325
# Enabled - property
1557
@dbus_service_property(_interface,
1558
signature="b",
1326
@dbus_service_property(_interface, signature="b",
1559
1327
access="readwrite")
1560
1328
def Enabled_dbus_property(self, value=None):
1561
1329
if value is None: # get
1566
1334
self.disable()
1567
1335
1568
1336
# LastCheckedOK - property
1569
@dbus_service_property(_interface,
1570
signature="s",
1337
@dbus_service_property(_interface, signature="s",
1571
1338
access="readwrite")
1572
1339
def LastCheckedOK_dbus_property(self, value=None):
1573
1340
if value is not None:
1576
1343
return datetime_to_dbus(self.last_checked_ok)
1577
1344
1578
1345
# LastCheckerStatus - property
1579
@dbus_service_property(_interface, signature="n", access="read")
1346
@dbus_service_property(_interface, signature="n",
1347
access="read")
1580
1348
def LastCheckerStatus_dbus_property(self):
1581
1349
return dbus.Int16(self.last_checker_status)
1582
1350
1591
1359
return datetime_to_dbus(self.last_approval_request)
1592
1360
1593
1361
# Timeout - property
1594
@dbus_service_property(_interface,
1595
signature="t",
1362
@dbus_service_property(_interface, signature="t",
1596
1363
access="readwrite")
1597
1364
def Timeout_dbus_property(self, value=None):
1598
1365
if value is None: # get
1599
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1600
old_timeout = self.timeout
1366
return dbus.UInt64(self.timeout_milliseconds())
1601
1367
self.timeout = datetime.timedelta(0, 0, 0, value)
1602
# Reschedule disabling
1368
# Reschedule timeout
1603
1369
if self.enabled:
1604
1370
now = datetime.datetime.utcnow()
1605
self.expires += self.timeout - old_timeout
1606
if self.expires <= now:
1371
time_to_die = timedelta_to_milliseconds(
1372
(self.last_checked_ok + self.timeout) - now)
1373
if time_to_die <= 0:
1607
1374
# The timeout has passed
1608
1375
self.disable()
1609
1376
else:
1377
self.expires = (now +
1378
datetime.timedelta(milliseconds =
1379
time_to_die))
1610
1380
if (getattr(self, "disable_initiator_tag", None)
1611
1381
is None):
1612
1382
return
1613
1383
gobject.source_remove(self.disable_initiator_tag)
1614
self.disable_initiator_tag = gobject.timeout_add(
1615
int((self.expires - now).total_seconds() * 1000),
1616
self.disable)
1384
self.disable_initiator_tag = (gobject.timeout_add
1385
(time_to_die,
1386
self.disable))
1617
1387
1618
1388
# ExtendedTimeout - property
1619
@dbus_service_property(_interface,
1620
signature="t",
1389
@dbus_service_property(_interface, signature="t",
1621
1390
access="readwrite")
1622
1391
def ExtendedTimeout_dbus_property(self, value=None):
1623
1392
if value is None: # get
1624
return dbus.UInt64(self.extended_timeout.total_seconds()
1625
* 1000)
1393
return dbus.UInt64(self.extended_timeout_milliseconds())
1626
1394
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1627
1395
1628
1396
# Interval - property
1629
@dbus_service_property(_interface,
1630
signature="t",
1397
@dbus_service_property(_interface, signature="t",
1631
1398
access="readwrite")
1632
1399
def Interval_dbus_property(self, value=None):
1633
1400
if value is None: # get
1634
return dbus.UInt64(self.interval.total_seconds() * 1000)
1401
return dbus.UInt64(self.interval_milliseconds())
1635
1402
self.interval = datetime.timedelta(0, 0, 0, value)
1636
1403
if getattr(self, "checker_initiator_tag", None) is None:
1637
1404
return
1638
1405
if self.enabled:
1639
1406
# Reschedule checker run
1640
1407
gobject.source_remove(self.checker_initiator_tag)
1641
self.checker_initiator_tag = gobject.timeout_add(
1642
value, self.start_checker)
1643
self.start_checker() # Start one now, too
1408
self.checker_initiator_tag = (gobject.timeout_add
1409
(value, self.start_checker))
1410
self.start_checker() # Start one now, too
1644
1411
1645
1412
# Checker - property
1646
@dbus_service_property(_interface,
1647
signature="s",
1413
@dbus_service_property(_interface, signature="s",
1648
1414
access="readwrite")
1649
1415
def Checker_dbus_property(self, value=None):
1650
1416
if value is None: # get
1651
1417
return dbus.String(self.checker_command)
1652
self.checker_command = str(value)
1418
self.checker_command = unicode(value)
1653
1419
1654
1420
# CheckerRunning - property
1655
@dbus_service_property(_interface,
1656
signature="b",
1421
@dbus_service_property(_interface, signature="b",
1657
1422
access="readwrite")
1658
1423
def CheckerRunning_dbus_property(self, value=None):
1659
1424
if value is None: # get
1669
1434
return self.dbus_object_path # is already a dbus.ObjectPath
1670
1435
1671
1436
# Secret = property
1672
@dbus_service_property(_interface,
1673
signature="ay",
1674
access="write",
1675
byte_arrays=True)
1437
@dbus_service_property(_interface, signature="ay",
1438
access="write", byte_arrays=True)
1676
1439
def Secret_dbus_property(self, value):
1677
self.secret = bytes(value)
1440
self.secret = str(value)
1678
1441
1679
1442
del _interface
1680
1443
1684
1447
self._pipe = child_pipe
1685
1448
self._pipe.send(('init', fpr, address))
1686
1449
if not self._pipe.recv():
1687
raise KeyError(fpr)
1450
raise KeyError()
1688
1451
1689
1452
def __getattribute__(self, name):
1690
1453
if name == '_pipe':
1694
1457
if data[0] == 'data':
1695
1458
return data[1]
1696
1459
if data[0] == 'function':
1697
1698
1460
def func(*args, **kwargs):
1699
1461
self._pipe.send(('funcall', name, args, kwargs))
1700
1462
return self._pipe.recv()[1]
1701
1702
1463
return func
1703
1464
1704
1465
def __setattr__(self, name, value):
1707
1468
self._pipe.send(('setattr', name, value))
1708
1469
1709
1470
1471
class ClientDBusTransitional(ClientDBus):
1472
__metaclass__ = AlternateDBusNamesMetaclass
1473
1474
1710
1475
class ClientHandler(socketserver.BaseRequestHandler, object):
1711
1476
"""A class to handle client connections.
1712
1477
1716
1481
def handle(self):
1717
1482
with contextlib.closing(self.server.child_pipe) as child_pipe:
1718
1483
logger.info("TCP connection from: %s",
1719
str(self.client_address))
1484
unicode(self.client_address))
1720
1485
logger.debug("Pipe FD: %d",
1721
1486
self.server.child_pipe.fileno())
1722
1487
1723
session = gnutls.connection.ClientSession(
1724
self.request, gnutls.connection .X509Credentials())
1488
session = (gnutls.connection
1489
.ClientSession(self.request,
1490
gnutls.connection
1491
.X509Credentials()))
1725
1492
1726
1493
# Note: gnutls.connection.X509Credentials is really a
1727
1494
# generic GnuTLS certificate credentials object so long as
1736
1503
priority = self.server.gnutls_priority
1737
1504
if priority is None:
1738
1505
priority = "NORMAL"
1739
gnutls.library.functions.gnutls_priority_set_direct(
1740
session._c_object, priority, None)
1506
(gnutls.library.functions
1507
.gnutls_priority_set_direct(session._c_object,
1508
priority, None))
1741
1509
1742
1510
# Start communication using the Mandos protocol
1743
1511
# Get protocol number
1745
1513
logger.debug("Protocol version: %r", line)
1746
1514
try:
1747
1515
if int(line.strip().split()[0]) > 1:
1748
raise RuntimeError(line)
1516
raise RuntimeError
1749
1517
except (ValueError, IndexError, RuntimeError) as error:
1750
1518
logger.error("Unknown protocol version: %s", error)
1751
1519
return
1763
1531
approval_required = False
1764
1532
try:
1765
1533
try:
1766
fpr = self.fingerprint(
1767
self.peer_certificate(session))
1534
fpr = self.fingerprint(self.peer_certificate
1535
(session))
1768
1536
except (TypeError,
1769
1537
gnutls.errors.GNUTLSError) as error:
1770
1538
logger.warning("Bad certificate: %s", error)
1785
1553
while True:
1786
1554
if not client.enabled:
1787
1555
logger.info("Client %s is disabled",
1788
client.name)
1556
client.name)
1789
1557
if self.server.use_dbus:
1790
1558
# Emit D-Bus signal
1791
1559
client.Rejected("Disabled")
1800
1568
if self.server.use_dbus:
1801
1569
# Emit D-Bus signal
1802
1570
client.NeedApproval(
1803
client.approval_delay.total_seconds()
1804
* 1000, client.approved_by_default)
1571
client.approval_delay_milliseconds(),
1572
client.approved_by_default)
1805
1573
else:
1806
1574
logger.warning("Client %s was not approved",
1807
1575
client.name)
1813
1581
#wait until timeout or approved
1814
1582
time = datetime.datetime.now()
1815
1583
client.changedstate.acquire()
1816
client.changedstate.wait(delay.total_seconds())
1584
(client.changedstate.wait
1585
(float(client.timedelta_to_milliseconds(delay)
1586
/ 1000)))
1817
1587
client.changedstate.release()
1818
1588
time2 = datetime.datetime.now()
1819
1589
if (time2 - time) >= delay:
1835
1605
try:
1836
1606
sent = session.send(client.secret[sent_size:])
1837
1607
except gnutls.errors.GNUTLSError as error:
1838
logger.warning("gnutls send failed",
1839
exc_info=error)
1608
logger.warning("gnutls send failed")
1840
1609
return
1841
logger.debug("Sent: %d, remaining: %d", sent,
1842
len(client.secret) - (sent_size
1843
+ sent))
1610
logger.debug("Sent: %d, remaining: %d",
1611
sent, len(client.secret)
1612
- (sent_size + sent))
1844
1613
sent_size += sent
1845
1614
1846
1615
logger.info("Sending secret to %s", client.name)
1856
1625
try:
1857
1626
session.bye()
1858
1627
except gnutls.errors.GNUTLSError as error:
1859
logger.warning("GnuTLS bye failed",
1860
exc_info=error)
1628
logger.warning("GnuTLS bye failed")
1861
1629
1862
1630
@staticmethod
1863
1631
def peer_certificate(session):
1864
1632
"Return the peer's OpenPGP certificate as a bytestring"
1865
1633
# If not an OpenPGP certificate...
1866
if (gnutls.library.functions.gnutls_certificate_type_get(
1867
session._c_object)
1634
if (gnutls.library.functions
1635
.gnutls_certificate_type_get(session._c_object)
1868
1636
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1869
1637
# ...do the normal thing
1870
1638
return session.peer_certificate
1884
1652
def fingerprint(openpgp):
1885
1653
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1886
1654
# New GnuTLS "datum" with the OpenPGP public key
1887
datum = gnutls.library.types.gnutls_datum_t(
1888
ctypes.cast(ctypes.c_char_p(openpgp),
1889
ctypes.POINTER(ctypes.c_ubyte)),
1890
ctypes.c_uint(len(openpgp)))
1655
datum = (gnutls.library.types
1656
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1657
ctypes.POINTER
1658
(ctypes.c_ubyte)),
1659
ctypes.c_uint(len(openpgp))))
1891
1660
# New empty GnuTLS certificate
1892
1661
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1893
gnutls.library.functions.gnutls_openpgp_crt_init(
1894
ctypes.byref(crt))
1662
(gnutls.library.functions
1663
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1895
1664
# Import the OpenPGP public key into the certificate
1896
gnutls.library.functions.gnutls_openpgp_crt_import(
1897
crt, ctypes.byref(datum),
1898
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1665
(gnutls.library.functions
1666
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1667
gnutls.library.constants
1668
.GNUTLS_OPENPGP_FMT_RAW))
1899
1669
# Verify the self signature in the key
1900
1670
crtverify = ctypes.c_uint()
1901
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1902
crt, 0, ctypes.byref(crtverify))
1671
(gnutls.library.functions
1672
.gnutls_openpgp_crt_verify_self(crt, 0,
1673
ctypes.byref(crtverify)))
1903
1674
if crtverify.value != 0:
1904
1675
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1905
raise gnutls.errors.CertificateSecurityError(
1906
"Verify failed")
1676
raise (gnutls.errors.CertificateSecurityError
1677
("Verify failed"))
1907
1678
# New buffer for the fingerprint
1908
1679
buf = ctypes.create_string_buffer(20)
1909
1680
buf_len = ctypes.c_size_t()
1910
1681
# Get the fingerprint from the certificate into the buffer
1911
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1912
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1682
(gnutls.library.functions
1683
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1684
ctypes.byref(buf_len)))
1913
1685
# Deinit the certificate
1914
1686
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1915
1687
# Convert the buffer to a Python bytestring
1921
1693
1922
1694
class MultiprocessingMixIn(object):
1923
1695
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1924
1925
1696
def sub_process_main(self, request, address):
1926
1697
try:
1927
1698
self.finish_request(request, address)
1932
1703
def process_request(self, request, address):
1933
1704
"""Start a new process to process the request."""
1934
1705
proc = multiprocessing.Process(target = self.sub_process_main,
1935
args = (request, address))
1706
args = (request,
1707
address))
1936
1708
proc.start()
1937
1709
return proc
1938
1710
1939
1711
1940
1712
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1941
1713
""" adds a pipe to the MixIn """
1942
1943
1714
def process_request(self, request, client_address):
1944
1715
"""Overrides and wraps the original process_request().
1945
1716
1954
1725
1955
1726
def add_pipe(self, parent_pipe, proc):
1956
1727
"""Dummy function; override as necessary"""
1957
raise NotImplementedError()
1728
raise NotImplementedError
1958
1729
1959
1730
1960
1731
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1966
1737
interface: None or a network interface name (string)
1967
1738
use_ipv6: Boolean; to use IPv6 or not
1968
1739
"""
1969
1970
1740
def __init__(self, server_address, RequestHandlerClass,
1971
interface=None,
1972
use_ipv6=True,
1973
socketfd=None):
1974
"""If socketfd is set, use that file descriptor instead of
1975
creating a new one with socket.socket().
1976
"""
1741
interface=None, use_ipv6=True):
1977
1742
self.interface = interface
1978
1743
if use_ipv6:
1979
1744
self.address_family = socket.AF_INET6
1980
if socketfd is not None:
1981
# Save the file descriptor
1982
self.socketfd = socketfd
1983
# Save the original socket.socket() function
1984
self.socket_socket = socket.socket
1985
# To implement --socket, we monkey patch socket.socket.
1986
#
1987
# (When socketserver.TCPServer is a new-style class, we
1988
# could make self.socket into a property instead of monkey
1989
# patching socket.socket.)
1990
#
1991
# Create a one-time-only replacement for socket.socket()
1992
@functools.wraps(socket.socket)
1993
def socket_wrapper(*args, **kwargs):
1994
# Restore original function so subsequent calls are
1995
# not affected.
1996
socket.socket = self.socket_socket
1997
del self.socket_socket
1998
# This time only, return a new socket object from the
1999
# saved file descriptor.
2000
return socket.fromfd(self.socketfd, *args, **kwargs)
2001
# Replace socket.socket() function with wrapper
2002
socket.socket = socket_wrapper
2003
# The socketserver.TCPServer.__init__ will call
2004
# socket.socket(), which might be our replacement,
2005
# socket_wrapper(), if socketfd was set.
2006
1745
socketserver.TCPServer.__init__(self, server_address,
2007
1746
RequestHandlerClass)
2008
2009
1747
def server_bind(self):
2010
1748
"""This overrides the normal server_bind() function
2011
1749
to bind to an interface if one was specified, and also NOT to
2017
1755
self.interface)
2018
1756
else:
2019
1757
try:
2020
self.socket.setsockopt(
2021
socket.SOL_SOCKET, SO_BINDTODEVICE,
2022
(self.interface + "\0").encode("utf-8"))
1758
self.socket.setsockopt(socket.SOL_SOCKET,
1759
SO_BINDTODEVICE,
1760
str(self.interface
1761
+ '\0'))
2023
1762
except socket.error as error:
2024
if error.errno == errno.EPERM:
2025
logger.error("No permission to bind to"
2026
" interface %s", self.interface)
2027
elif error.errno == errno.ENOPROTOOPT:
1763
if error[0] == errno.EPERM:
1764
logger.error("No permission to"
1765
" bind to interface %s",
1766
self.interface)
1767
elif error[0] == errno.ENOPROTOOPT:
2028
1768
logger.error("SO_BINDTODEVICE not available;"
2029
1769
" cannot bind to interface %s",
2030
1770
self.interface)
2031
elif error.errno == errno.ENODEV:
2032
logger.error("Interface %s does not exist,"
2033
" cannot bind", self.interface)
2034
1771
else:
2035
1772
raise
2036
1773
# Only bind(2) the socket if we really need to.
2039
1776
if self.address_family == socket.AF_INET6:
2040
1777
any_address = "::" # in6addr_any
2041
1778
else:
2042
any_address = "0.0.0.0" # INADDR_ANY
1779
any_address = socket.INADDR_ANY
2043
1780
self.server_address = (any_address,
2044
1781
self.server_address[1])
2045
1782
elif not self.server_address[1]:
2046
self.server_address = (self.server_address[0], 0)
1783
self.server_address = (self.server_address[0],
1784
0)
2047
1785
# if self.interface:
2048
1786
# self.server_address = (self.server_address[0],
2049
1787
# 0, # port
2063
1801
2064
1802
Assumes a gobject.MainLoop event loop.
2065
1803
"""
2066
2067
1804
def __init__(self, server_address, RequestHandlerClass,
2068
interface=None,
2069
use_ipv6=True,
2070
clients=None,
2071
gnutls_priority=None,
2072
use_dbus=True,
2073
socketfd=None):
1805
interface=None, use_ipv6=True, clients=None,
1806
gnutls_priority=None, use_dbus=True):
2074
1807
self.enabled = False
2075
1808
self.clients = clients
2076
1809
if self.clients is None:
2080
1813
IPv6_TCPServer.__init__(self, server_address,
2081
1814
RequestHandlerClass,
2082
1815
interface = interface,
2083
use_ipv6 = use_ipv6,
2084
socketfd = socketfd)
2085
1816
use_ipv6 = use_ipv6)
2086
1817
def server_activate(self):
2087
1818
if self.enabled:
2088
1819
return socketserver.TCPServer.server_activate(self)
2092
1823
2093
1824
def add_pipe(self, parent_pipe, proc):
2094
1825
# Call "handle_ipc" for both data and EOF events
2095
gobject.io_add_watch(
2096
parent_pipe.fileno(),
2097
gobject.IO_IN | gobject.IO_HUP,
2098
functools.partial(self.handle_ipc,
2099
parent_pipe = parent_pipe,
2100
proc = proc))
1826
gobject.io_add_watch(parent_pipe.fileno(),
1827
gobject.IO_IN | gobject.IO_HUP,
1828
functools.partial(self.handle_ipc,
1829
parent_pipe =
1830
parent_pipe,
1831
proc = proc))
2101
1832
2102
def handle_ipc(self, source, condition,
2103
parent_pipe=None,
2104
proc = None,
2105
client_object=None):
1833
def handle_ipc(self, source, condition, parent_pipe=None,
1834
proc = None, client_object=None):
1835
condition_names = {
1836
gobject.IO_IN: "IN", # There is data to read.
1837
gobject.IO_OUT: "OUT", # Data can be written (without
1838
# blocking).
1839
gobject.IO_PRI: "PRI", # There is urgent data to read.
1840
gobject.IO_ERR: "ERR", # Error condition.
1841
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1842
# broken, usually for pipes and
1843
# sockets).
1844
}
1845
conditions_string = ' | '.join(name
1846
for cond, name in
1847
condition_names.iteritems()
1848
if cond & condition)
2106
1849
# error, or the other end of multiprocessing.Pipe has closed
2107
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1850
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2108
1851
# Wait for other process to exit
2109
1852
proc.join()
2110
1853
return False
2131
1874
parent_pipe.send(False)
2132
1875
return False
2133
1876
2134
gobject.io_add_watch(
2135
parent_pipe.fileno(),
2136
gobject.IO_IN | gobject.IO_HUP,
2137
functools.partial(self.handle_ipc,
2138
parent_pipe = parent_pipe,
2139
proc = proc,
2140
client_object = client))
1877
gobject.io_add_watch(parent_pipe.fileno(),
1878
gobject.IO_IN | gobject.IO_HUP,
1879
functools.partial(self.handle_ipc,
1880
parent_pipe =
1881
parent_pipe,
1882
proc = proc,
1883
client_object =
1884
client))
2141
1885
parent_pipe.send(True)
2142
1886
# remove the old hook in favor of the new above hook on
2143
1887
# same fileno
2149
1893
2150
1894
parent_pipe.send(('data', getattr(client_object,
2151
1895
funcname)(*args,
2152
**kwargs)))
1896
**kwargs)))
2153
1897
2154
1898
if command == 'getattr':
2155
1899
attrname = request[1]
2156
if isinstance(client_object.__getattribute__(attrname),
2157
collections.Callable):
2158
parent_pipe.send(('function', ))
1900
if callable(client_object.__getattribute__(attrname)):
1901
parent_pipe.send(('function',))
2159
1902
else:
2160
parent_pipe.send((
2161
'data', client_object.__getattribute__(attrname)))
1903
parent_pipe.send(('data', client_object
1904
.__getattribute__(attrname)))
2162
1905
2163
1906
if command == 'setattr':
2164
1907
attrname = request[1]
2168
1911
return True
2169
1912
2170
1913
2171
def rfc3339_duration_to_delta(duration):
2172
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2173
2174
>>> rfc3339_duration_to_delta("P7D")
2175
datetime.timedelta(7)
2176
>>> rfc3339_duration_to_delta("PT60S")
2177
datetime.timedelta(0, 60)
2178
>>> rfc3339_duration_to_delta("PT60M")
2179
datetime.timedelta(0, 3600)
2180
>>> rfc3339_duration_to_delta("PT24H")
2181
datetime.timedelta(1)
2182
>>> rfc3339_duration_to_delta("P1W")
2183
datetime.timedelta(7)
2184
>>> rfc3339_duration_to_delta("PT5M30S")
2185
datetime.timedelta(0, 330)
2186
>>> rfc3339_duration_to_delta("P1DT3M20S")
2187
datetime.timedelta(1, 200)
2188
"""
2189
2190
# Parsing an RFC 3339 duration with regular expressions is not
2191
# possible - there would have to be multiple places for the same
2192
# values, like seconds. The current code, while more esoteric, is
2193
# cleaner without depending on a parsing library. If Python had a
2194
# built-in library for parsing we would use it, but we'd like to
2195
# avoid excessive use of external libraries.
2196
2197
# New type for defining tokens, syntax, and semantics all-in-one
2198
Token = collections.namedtuple("Token", (
2199
"regexp", # To match token; if "value" is not None, must have
2200
# a "group" containing digits
2201
"value", # datetime.timedelta or None
2202
"followers")) # Tokens valid after this token
2203
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2204
# the "duration" ABNF definition in RFC 3339, Appendix A.
2205
token_end = Token(re.compile(r"$"), None, frozenset())
2206
token_second = Token(re.compile(r"(\d+)S"),
2207
datetime.timedelta(seconds=1),
2208
frozenset((token_end, )))
2209
token_minute = Token(re.compile(r"(\d+)M"),
2210
datetime.timedelta(minutes=1),
2211
frozenset((token_second, token_end)))
2212
token_hour = Token(re.compile(r"(\d+)H"),
2213
datetime.timedelta(hours=1),
2214
frozenset((token_minute, token_end)))
2215
token_time = Token(re.compile(r"T"),
2216
None,
2217
frozenset((token_hour, token_minute,
2218
token_second)))
2219
token_day = Token(re.compile(r"(\d+)D"),
2220
datetime.timedelta(days=1),
2221
frozenset((token_time, token_end)))
2222
token_month = Token(re.compile(r"(\d+)M"),
2223
datetime.timedelta(weeks=4),
2224
frozenset((token_day, token_end)))
2225
token_year = Token(re.compile(r"(\d+)Y"),
2226
datetime.timedelta(weeks=52),
2227
frozenset((token_month, token_end)))
2228
token_week = Token(re.compile(r"(\d+)W"),
2229
datetime.timedelta(weeks=1),
2230
frozenset((token_end, )))
2231
token_duration = Token(re.compile(r"P"), None,
2232
frozenset((token_year, token_month,
2233
token_day, token_time,
2234
token_week)))
2235
# Define starting values
2236
value = datetime.timedelta() # Value so far
2237
found_token = None
2238
followers = frozenset((token_duration, )) # Following valid tokens
2239
s = duration # String left to parse
2240
# Loop until end token is found
2241
while found_token is not token_end:
2242
# Search for any currently valid tokens
2243
for token in followers:
2244
match = token.regexp.match(s)
2245
if match is not None:
2246
# Token found
2247
if token.value is not None:
2248
# Value found, parse digits
2249
factor = int(match.group(1), 10)
2250
# Add to value so far
2251
value += factor * token.value
2252
# Strip token from string
2253
s = token.regexp.sub("", s, 1)
2254
# Go to found token
2255
found_token = token
2256
# Set valid next tokens
2257
followers = found_token.followers
2258
break
2259
else:
2260
# No currently valid tokens were found
2261
raise ValueError("Invalid RFC 3339 duration: {!r}"
2262
.format(duration))
2263
# End token found
2264
return value
2265
2266
2267
1914
def string_to_delta(interval):
2268
1915
"""Parse a string and return a datetime.timedelta
2269
1916
2280
1927
>>> string_to_delta('5m 30s')
2281
1928
datetime.timedelta(0, 330)
2282
1929
"""
2283
2284
try:
2285
return rfc3339_duration_to_delta(interval)
2286
except ValueError:
2287
pass
2288
2289
1930
timevalue = datetime.timedelta(0)
2290
1931
for s in interval.split():
2291
1932
try:
2292
suffix = s[-1]
1933
suffix = unicode(s[-1])
2293
1934
value = int(s[:-1])
2294
1935
if suffix == "d":
2295
1936
delta = datetime.timedelta(value)
2302
1943
elif suffix == "w":
2303
1944
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2304
1945
else:
2305
raise ValueError("Unknown suffix {!r}".format(suffix))
2306
except IndexError as e:
1946
raise ValueError("Unknown suffix %r" % suffix)
1947
except (ValueError, IndexError) as e:
2307
1948
raise ValueError(*(e.args))
2308
1949
timevalue += delta
2309
1950
return timevalue
2322
1963
sys.exit()
2323
1964
if not noclose:
2324
1965
# Close all standard open file descriptors
2325
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1966
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2326
1967
if not stat.S_ISCHR(os.fstat(null).st_mode):
2327
1968
raise OSError(errno.ENODEV,
2328
"{} not a character device"
2329
.format(os.devnull))
1969
"%s not a character device"
1970
% os.path.devnull)
2330
1971
os.dup2(null, sys.stdin.fileno())
2331
1972
os.dup2(null, sys.stdout.fileno())
2332
1973
os.dup2(null, sys.stderr.fileno())
2341
1982
2342
1983
parser = argparse.ArgumentParser()
2343
1984
parser.add_argument("-v", "--version", action="version",
2344
version = "%(prog)s {}".format(version),
1985
version = "%%(prog)s %s" % version,
2345
1986
help="show version number and exit")
2346
1987
parser.add_argument("-i", "--interface", metavar="IF",
2347
1988
help="Bind to interface IF")
2353
1994
help="Run self-test")
2354
1995
parser.add_argument("--debug", action="store_true",
2355
1996
help="Debug mode; run in foreground and log"
2356
" to terminal", default=None)
1997
" to terminal")
2357
1998
parser.add_argument("--debuglevel", metavar="LEVEL",
2358
1999
help="Debug level for stdout output")
2359
2000
parser.add_argument("--priority", help="GnuTLS"
2366
2007
" files")
2367
2008
parser.add_argument("--no-dbus", action="store_false",
2368
2009
dest="use_dbus", help="Do not provide D-Bus"
2369
" system bus interface", default=None)
2010
" system bus interface")
2370
2011
parser.add_argument("--no-ipv6", action="store_false",
2371
dest="use_ipv6", help="Do not use IPv6",
2372
default=None)
2012
dest="use_ipv6", help="Do not use IPv6")
2373
2013
parser.add_argument("--no-restore", action="store_false",
2374
2014
dest="restore", help="Do not restore stored"
2375
" state", default=None)
2376
parser.add_argument("--socket", type=int,
2377
help="Specify a file descriptor to a network"
2378
" socket to use instead of creating one")
2015
" state")
2379
2016
parser.add_argument("--statedir", metavar="DIR",
2380
2017
help="Directory to save/restore state in")
2381
parser.add_argument("--foreground", action="store_true",
2382
help="Run in foreground", default=None)
2383
parser.add_argument("--no-zeroconf", action="store_false",
2384
dest="zeroconf", help="Do not use Zeroconf",
2385
default=None)
2386
2018
2387
2019
options = parser.parse_args()
2388
2020
2389
2021
if options.check:
2390
2022
import doctest
2391
fail_count, test_count = doctest.testmod()
2392
sys.exit(os.EX_OK if fail_count == 0 else 1)
2023
doctest.testmod()
2024
sys.exit()
2393
2025
2394
2026
# Default values for config file for server-global settings
2395
2027
server_defaults = { "interface": "",
2397
2029
"port": "",
2398
2030
"debug": "False",
2399
2031
"priority":
2400
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2401
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2032
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2402
2033
"servicename": "Mandos",
2403
2034
"use_dbus": "True",
2404
2035
"use_ipv6": "True",
2405
2036
"debuglevel": "",
2406
2037
"restore": "True",
2407
"socket": "",
2408
"statedir": "/var/lib/mandos",
2409
"foreground": "False",
2410
"zeroconf": "True",
2411
}
2038
"statedir": "/var/lib/mandos"
2039
}
2412
2040
2413
2041
# Parse config file for server-global settings
2414
2042
server_config = configparser.SafeConfigParser(server_defaults)
2415
2043
del server_defaults
2416
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2044
server_config.read(os.path.join(options.configdir,
2045
"mandos.conf"))
2417
2046
# Convert the SafeConfigParser object to a dict
2418
2047
server_settings = server_config.defaults()
2419
2048
# Use the appropriate methods on the non-string config options
2420
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2049
for option in ("debug", "use_dbus", "use_ipv6"):
2421
2050
server_settings[option] = server_config.getboolean("DEFAULT",
2422
2051
option)
2423
2052
if server_settings["port"]:
2424
2053
server_settings["port"] = server_config.getint("DEFAULT",
2425
2054
"port")
2426
if server_settings["socket"]:
2427
server_settings["socket"] = server_config.getint("DEFAULT",
2428
"socket")
2429
# Later, stdin will, and stdout and stderr might, be dup'ed
2430
# over with an opened os.devnull. But we don't want this to
2431
# happen with a supplied network socket.
2432
if 0 <= server_settings["socket"] <= 2:
2433
server_settings["socket"] = os.dup(server_settings
2434
["socket"])
2435
2055
del server_config
2436
2056
2437
2057
# Override the settings from the config file with command line
2438
2058
# options, if set.
2439
2059
for option in ("interface", "address", "port", "debug",
2440
"priority", "servicename", "configdir", "use_dbus",
2441
"use_ipv6", "debuglevel", "restore", "statedir",
2442
"socket", "foreground", "zeroconf"):
2060
"priority", "servicename", "configdir",
2061
"use_dbus", "use_ipv6", "debuglevel", "restore",
2062
"statedir"):
2443
2063
value = getattr(options, option)
2444
2064
if value is not None:
2445
2065
server_settings[option] = value
2446
2066
del options
2447
2067
# Force all strings to be unicode
2448
2068
for option in server_settings.keys():
2449
if isinstance(server_settings[option], bytes):
2450
server_settings[option] = (server_settings[option]
2451
.decode("utf-8"))
2452
# Force all boolean options to be boolean
2453
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2454
"foreground", "zeroconf"):
2455
server_settings[option] = bool(server_settings[option])
2456
# Debug implies foreground
2457
if server_settings["debug"]:
2458
server_settings["foreground"] = True
2069
if type(server_settings[option]) is str:
2070
server_settings[option] = unicode(server_settings[option])
2459
2071
# Now we have our good server settings in "server_settings"
2460
2072
2461
2073
##################################################################
2462
2074
2463
if (not server_settings["zeroconf"]
2464
and not (server_settings["port"]
2465
or server_settings["socket"] != "")):
2466
parser.error("Needs port or socket to work without Zeroconf")
2467
2468
2075
# For convenience
2469
2076
debug = server_settings["debug"]
2470
2077
debuglevel = server_settings["debuglevel"]
2472
2079
use_ipv6 = server_settings["use_ipv6"]
2473
2080
stored_state_path = os.path.join(server_settings["statedir"],
2474
2081
stored_state_file)
2475
foreground = server_settings["foreground"]
2476
zeroconf = server_settings["zeroconf"]
2477
2082
2478
2083
if debug:
2479
2084
initlogger(debug, logging.DEBUG)
2485
2090
initlogger(debug, level)
2486
2091
2487
2092
if server_settings["servicename"] != "Mandos":
2488
syslogger.setFormatter(
2489
logging.Formatter('Mandos ({}) [%(process)d]:'
2490
' %(levelname)s: %(message)s'.format(
2491
server_settings["servicename"])))
2093
syslogger.setFormatter(logging.Formatter
2094
('Mandos (%s) [%%(process)d]:'
2095
' %%(levelname)s: %%(message)s'
2096
% server_settings["servicename"]))
2492
2097
2493
2098
# Parse config file with clients
2494
2099
client_config = configparser.SafeConfigParser(Client
2499
2104
global mandos_dbus_service
2500
2105
mandos_dbus_service = None
2501
2106
2502
socketfd = None
2503
if server_settings["socket"] != "":
2504
socketfd = server_settings["socket"]
2505
tcp_server = MandosServer(
2506
(server_settings["address"], server_settings["port"]),
2507
ClientHandler,
2508
interface=(server_settings["interface"] or None),
2509
use_ipv6=use_ipv6,
2510
gnutls_priority=server_settings["priority"],
2511
use_dbus=use_dbus,
2512
socketfd=socketfd)
2513
if not foreground:
2514
pidfilename = "/run/mandos.pid"
2515
if not os.path.isdir("/run/."):
2516
pidfilename = "/var/run/mandos.pid"
2517
pidfile = None
2107
tcp_server = MandosServer((server_settings["address"],
2108
server_settings["port"]),
2109
ClientHandler,
2110
interface=(server_settings["interface"]
2111
or None),
2112
use_ipv6=use_ipv6,
2113
gnutls_priority=
2114
server_settings["priority"],
2115
use_dbus=use_dbus)
2116
if not debug:
2117
pidfilename = "/var/run/mandos.pid"
2518
2118
try:
2519
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2520
except IOError as e:
2521
logger.error("Could not open file %r", pidfilename,
2522
exc_info=e)
2119
pidfile = open(pidfilename, "w")
2120
except IOError:
2121
logger.error("Could not open file %r", pidfilename)
2523
2122
2524
for name in ("_mandos", "mandos", "nobody"):
2123
try:
2124
uid = pwd.getpwnam("_mandos").pw_uid
2125
gid = pwd.getpwnam("_mandos").pw_gid
2126
except KeyError:
2525
2127
try:
2526
uid = pwd.getpwnam(name).pw_uid
2527
gid = pwd.getpwnam(name).pw_gid
2528
break
2128
uid = pwd.getpwnam("mandos").pw_uid
2129
gid = pwd.getpwnam("mandos").pw_gid
2529
2130
except KeyError:
2530
continue
2531
else:
2532
uid = 65534
2533
gid = 65534
2131
try:
2132
uid = pwd.getpwnam("nobody").pw_uid
2133
gid = pwd.getpwnam("nobody").pw_gid
2134
except KeyError:
2135
uid = 65534
2136
gid = 65534
2534
2137
try:
2535
2138
os.setgid(gid)
2536
2139
os.setuid(uid)
2537
2140
except OSError as error:
2538
if error.errno != errno.EPERM:
2539
raise
2141
if error[0] != errno.EPERM:
2142
raise error
2540
2143
2541
2144
if debug:
2542
2145
# Enable all possible GnuTLS debugging
2549
2152
def debug_gnutls(level, string):
2550
2153
logger.debug("GnuTLS: %s", string[:-1])
2551
2154
2552
gnutls.library.functions.gnutls_global_set_log_function(
2553
debug_gnutls)
2155
(gnutls.library.functions
2156
.gnutls_global_set_log_function(debug_gnutls))
2554
2157
2555
2158
# Redirect stdin so all checkers get /dev/null
2556
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2159
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2557
2160
os.dup2(null, sys.stdin.fileno())
2558
2161
if null > 2:
2559
2162
os.close(null)
2560
2163
2561
2164
# Need to fork before connecting to D-Bus
2562
if not foreground:
2165
if not debug:
2563
2166
# Close all input and output, do double fork, etc.
2564
2167
daemon()
2565
2168
2566
# multiprocessing will use threads, so before we use gobject we
2567
# need to inform gobject that threads will be used.
2568
2169
gobject.threads_init()
2569
2170
2570
2171
global main_loop
2571
2172
# From the Avahi example code
2572
DBusGMainLoop(set_as_default=True)
2173
DBusGMainLoop(set_as_default=True )
2573
2174
main_loop = gobject.MainLoop()
2574
2175
bus = dbus.SystemBus()
2575
2176
# End of Avahi example code
2576
2177
if use_dbus:
2577
2178
try:
2578
2179
bus_name = dbus.service.BusName("se.recompile.Mandos",
2579
bus,
2580
do_not_queue=True)
2581
old_bus_name = dbus.service.BusName(
2582
"se.bsnet.fukt.Mandos", bus,
2583
do_not_queue=True)
2584
except dbus.exceptions.DBusException as e:
2585
logger.error("Disabling D-Bus:", exc_info=e)
2180
bus, do_not_queue=True)
2181
old_bus_name = (dbus.service.BusName
2182
("se.bsnet.fukt.Mandos", bus,
2183
do_not_queue=True))
2184
except dbus.exceptions.NameExistsException as e:
2185
logger.error(unicode(e) + ", disabling D-Bus")
2586
2186
use_dbus = False
2587
2187
server_settings["use_dbus"] = False
2588
2188
tcp_server.use_dbus = False
2589
if zeroconf:
2590
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2591
service = AvahiServiceToSyslog(
2592
name = server_settings["servicename"],
2593
servicetype = "_mandos._tcp",
2594
protocol = protocol,
2595
bus = bus)
2596
if server_settings["interface"]:
2597
service.interface = if_nametoindex(
2598
server_settings["interface"].encode("utf-8"))
2189
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2190
service = AvahiServiceToSyslog(name =
2191
server_settings["servicename"],
2192
servicetype = "_mandos._tcp",
2193
protocol = protocol, bus = bus)
2194
if server_settings["interface"]:
2195
service.interface = (if_nametoindex
2196
(str(server_settings["interface"])))
2599
2197
2600
2198
global multiprocessing_manager
2601
2199
multiprocessing_manager = multiprocessing.Manager()
2602
2200
2603
2201
client_class = Client
2604
2202
if use_dbus:
2605
client_class = functools.partial(ClientDBus, bus = bus)
2203
client_class = functools.partial(ClientDBusTransitional,
2204
bus = bus)
2606
2205
2607
2206
client_settings = Client.config_parser(client_config)
2608
2207
old_client_settings = {}
2609
2208
clients_data = {}
2610
2209
2611
# This is used to redirect stdout and stderr for checker processes
2612
global wnull
2613
wnull = open(os.devnull, "w") # A writable /dev/null
2614
# Only used if server is running in foreground but not in debug
2615
# mode
2616
if debug or not foreground:
2617
wnull.close()
2618
2619
2210
# Get client data and settings from last running state.
2620
2211
if server_settings["restore"]:
2621
2212
try:
2622
2213
with open(stored_state_path, "rb") as stored_state:
2623
clients_data, old_client_settings = pickle.load(
2624
stored_state)
2214
clients_data, old_client_settings = (pickle.load
2215
(stored_state))
2625
2216
os.remove(stored_state_path)
2626
2217
except IOError as e:
2627
if e.errno == errno.ENOENT:
2628
logger.warning("Could not load persistent state:"
2629
" {}".format(os.strerror(e.errno)))
2630
else:
2631
logger.critical("Could not load persistent state:",
2632
exc_info=e)
2218
logger.warning("Could not load persistent state: {0}"
2219
.format(e))
2220
if e.errno != errno.ENOENT:
2633
2221
raise
2634
2222
except EOFError as e:
2635
2223
logger.warning("Could not load persistent state: "
2636
"EOFError:",
2637
exc_info=e)
2224
"EOFError: {0}".format(e))
2638
2225
2639
2226
with PGPEngine() as pgp:
2640
for client_name, client in clients_data.items():
2641
# Skip removed clients
2642
if client_name not in client_settings:
2643
continue
2644
2227
for client_name, client in clients_data.iteritems():
2645
2228
# Decide which value to use after restoring saved state.
2646
2229
# We have three different values: Old config file,
2647
2230
# new config file, and saved state.
2652
2235
# For each value in new config, check if it
2653
2236
# differs from the old config value (Except for
2654
2237
# the "secret" attribute)
2655
if (name != "secret"
2656
and (value !=
2657
old_client_settings[client_name][name])):
2238
if (name != "secret" and
2239
value != old_client_settings[client_name]
2240
[name]):
2658
2241
client[name] = value
2659
2242
except KeyError:
2660
2243
pass
2668
2251
if datetime.datetime.utcnow() >= client["expires"]:
2669
2252
if not client["last_checked_ok"]:
2670
2253
logger.warning(
2671
"disabling client {} - Client never "
2672
"performed a successful checker".format(
2673
client_name))
2254
"disabling client {0} - Client never "
2255
"performed a successful checker"
2256
.format(client_name))
2674
2257
client["enabled"] = False
2675
2258
elif client["last_checker_status"] != 0:
2676
2259
logger.warning(
2677
"disabling client {} - Client last"
2678
" checker failed with error code"
2679
" {}".format(
2680
client_name,
2681
client["last_checker_status"]))
2260
"disabling client {0} - Client "
2261
"last checker failed with error code {1}"
2262
.format(client_name,
2263
client["last_checker_status"]))
2682
2264
client["enabled"] = False
2683
2265
else:
2684
client["expires"] = (
2685
datetime.datetime.utcnow()
2686
+ client["timeout"])
2266
client["expires"] = (datetime.datetime
2267
.utcnow()
2268
+ client["timeout"])
2687
2269
logger.debug("Last checker succeeded,"
2688
" keeping {} enabled".format(
2689
client_name))
2270
" keeping {0} enabled"
2271
.format(client_name))
2690
2272
try:
2691
client["secret"] = pgp.decrypt(
2692
client["encrypted_secret"],
2693
client_settings[client_name]["secret"])
2273
client["secret"] = (
2274
pgp.decrypt(client["encrypted_secret"],
2275
client_settings[client_name]
2276
["secret"]))
2694
2277
except PGPError:
2695
2278
# If decryption fails, we use secret from new settings
2696
logger.debug("Failed to decrypt {} old secret".format(
2697
client_name))
2698
client["secret"] = (client_settings[client_name]
2699
["secret"])
2279
logger.debug("Failed to decrypt {0} old secret"
2280
.format(client_name))
2281
client["secret"] = (
2282
client_settings[client_name]["secret"])
2283
2700
2284
2701
2285
# Add/remove clients based on new changes made to config
2702
2286
for client_name in (set(old_client_settings)
2705
2289
for client_name in (set(client_settings)
2706
2290
- set(old_client_settings)):
2707
2291
clients_data[client_name] = client_settings[client_name]
2708
2292
2709
2293
# Create all client objects
2710
for client_name, client in clients_data.items():
2294
for client_name, client in clients_data.iteritems():
2711
2295
tcp_server.clients[client_name] = client_class(
2712
name = client_name,
2713
settings = client,
2714
server_settings = server_settings)
2296
name = client_name, settings = client)
2715
2297
2716
2298
if not tcp_server.clients:
2717
2299
logger.warning("No clients defined")
2718
2719
if not foreground:
2720
if pidfile is not None:
2721
pid = os.getpid()
2722
try:
2723
with pidfile:
2724
print(pid, file=pidfile)
2725
except IOError:
2726
logger.error("Could not write to file %r with PID %d",
2727
pidfilename, pid)
2728
del pidfile
2300
2301
if not debug:
2302
try:
2303
with pidfile:
2304
pid = os.getpid()
2305
pidfile.write(str(pid) + "\n".encode("utf-8"))
2306
del pidfile
2307
except IOError:
2308
logger.error("Could not write to file %r with PID %d",
2309
pidfilename, pid)
2310
except NameError:
2311
# "pidfile" was never created
2312
pass
2729
2313
del pidfilename
2314
signal.signal(signal.SIGINT, signal.SIG_IGN)
2730
2315
2731
2316
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2732
2317
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2733
2318
2734
2319
if use_dbus:
2735
2736
@alternate_dbus_interfaces(
2737
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2738
class MandosDBusService(DBusObjectWithProperties):
2320
class MandosDBusService(dbus.service.Object):
2739
2321
"""A D-Bus proxy object"""
2740
2741
2322
def __init__(self):
2742
2323
dbus.service.Object.__init__(self, bus, "/")
2743
2744
2324
_interface = "se.recompile.Mandos"
2745
2325
2746
@dbus_interface_annotations(_interface)
2747
def _foo(self):
2748
return {
2749
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2750
"false" }
2751
2752
2326
@dbus.service.signal(_interface, signature="o")
2753
2327
def ClientAdded(self, objpath):
2754
2328
"D-Bus signal"
2767
2341
@dbus.service.method(_interface, out_signature="ao")
2768
2342
def GetAllClients(self):
2769
2343
"D-Bus method"
2770
return dbus.Array(c.dbus_object_path for c in
2344
return dbus.Array(c.dbus_object_path
2345
for c in
2771
2346
tcp_server.clients.itervalues())
2772
2347
2773
2348
@dbus.service.method(_interface,
2775
2350
def GetAllClientsWithProperties(self):
2776
2351
"D-Bus method"
2777
2352
return dbus.Dictionary(
2778
{ c.dbus_object_path: c.GetAll("")
2779
for c in tcp_server.clients.itervalues() },
2353
((c.dbus_object_path, c.GetAll(""))
2354
for c in tcp_server.clients.itervalues()),
2780
2355
signature="oa{sv}")
2781
2356
2782
2357
@dbus.service.method(_interface, in_signature="o")
2795
2370
2796
2371
del _interface
2797
2372
2798
mandos_dbus_service = MandosDBusService()
2373
class MandosDBusServiceTransitional(MandosDBusService):
2374
__metaclass__ = AlternateDBusNamesMetaclass
2375
mandos_dbus_service = MandosDBusServiceTransitional()
2799
2376
2800
2377
def cleanup():
2801
2378
"Cleanup function; run on exit"
2802
if zeroconf:
2803
service.cleanup()
2379
service.cleanup()
2804
2380
2805
2381
multiprocessing.active_children()
2806
wnull.close()
2807
2382
if not (tcp_server.clients or client_settings):
2808
2383
return
2809
2384
2820
2395
2821
2396
# A list of attributes that can not be pickled
2822
2397
# + secret.
2823
exclude = { "bus", "changedstate", "secret",
2824
"checker", "server_settings" }
2825
for name, typ in inspect.getmembers(dbus.service
2826
.Object):
2398
exclude = set(("bus", "changedstate", "secret",
2399
"checker"))
2400
for name, typ in (inspect.getmembers
2401
(dbus.service.Object)):
2827
2402
exclude.add(name)
2828
2403
2829
2404
client_dict["encrypted_secret"] = (client
2836
2411
del client_settings[client.name]["secret"]
2837
2412
2838
2413
try:
2839
with tempfile.NamedTemporaryFile(
2840
mode='wb',
2841
suffix=".pickle",
2842
prefix='clients-',
2843
dir=os.path.dirname(stored_state_path),
2844
delete=False) as stored_state:
2414
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2415
prefix="clients-",
2416
dir=os.path.dirname
2417
(stored_state_path))
2418
with os.fdopen(tempfd, "wb") as stored_state:
2845
2419
pickle.dump((clients, client_settings), stored_state)
2846
tempname = stored_state.name
2847
2420
os.rename(tempname, stored_state_path)
2848
2421
except (IOError, OSError) as e:
2422
logger.warning("Could not save persistent state: {0}"
2423
.format(e))
2849
2424
if not debug:
2850
2425
try:
2851
2426
os.remove(tempname)
2852
2427
except NameError:
2853
2428
pass
2854
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2855
logger.warning("Could not save persistent state: {}"
2856
.format(os.strerror(e.errno)))
2857
else:
2858
logger.warning("Could not save persistent state:",
2859
exc_info=e)
2860
raise
2429
if e.errno not in set((errno.ENOENT, errno.EACCES,
2430
errno.EEXIST)):
2431
raise e
2861
2432
2862
2433
# Delete all clients, and settings from config
2863
2434
while tcp_server.clients:
2868
2439
client.disable(quiet=True)
2869
2440
if use_dbus:
2870
2441
# Emit D-Bus signal
2871
mandos_dbus_service.ClientRemoved(
2872
client.dbus_object_path, client.name)
2442
mandos_dbus_service.ClientRemoved(client
2443
.dbus_object_path,
2444
client.name)
2873
2445
client_settings.clear()
2874
2446
2875
2447
atexit.register(cleanup)
2886
2458
tcp_server.server_activate()
2887
2459
2888
2460
# Find out what port we got
2889
if zeroconf:
2890
service.port = tcp_server.socket.getsockname()[1]
2461
service.port = tcp_server.socket.getsockname()[1]
2891
2462
if use_ipv6:
2892
2463
logger.info("Now listening on address %r, port %d,"
2893
" flowinfo %d, scope_id %d",
2894
*tcp_server.socket.getsockname())
2464
" flowinfo %d, scope_id %d"
2465
% tcp_server.socket.getsockname())
2895
2466
else: # IPv4
2896
logger.info("Now listening on address %r, port %d",
2897
*tcp_server.socket.getsockname())
2467
logger.info("Now listening on address %r, port %d"
2468
% tcp_server.socket.getsockname())
2898
2469
2899
2470
#service.interface = tcp_server.socket.getsockname()[3]
2900
2471
2901
2472
try:
2902
if zeroconf:
2903
# From the Avahi example code
2904
try:
2905
service.activate()
2906
except dbus.exceptions.DBusException as error:
2907
logger.critical("D-Bus Exception", exc_info=error)
2908
cleanup()
2909
sys.exit(1)
2910
# End of Avahi example code
2473
# From the Avahi example code
2474
try:
2475
service.activate()
2476
except dbus.exceptions.DBusException as error:
2477
logger.critical("DBusException: %s", error)
2478
cleanup()
2479
sys.exit(1)
2480
# End of Avahi example code
2911
2481
2912
2482
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2913
2483
lambda *args, **kwargs:
2917
2487
logger.debug("Starting main loop")
2918
2488
main_loop.run()
2919
2489
except AvahiError as error:
2920
logger.critical("Avahi Error", exc_info=error)
2490
logger.critical("AvahiError: %s", error)
2921
2491
cleanup()
2922
2492
sys.exit(1)
2923
2493
except KeyboardInterrupt:
2928
2498
# Must run before the D-Bus bus name gets deregistered
2929
2499
cleanup()
2930
2500
2931
2932
2501
if __name__ == '__main__':
2933
2502
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0