80
88
except ImportError:
81
89
SO_BINDTODEVICE = None
86
logger = logging.Logger(u'mandos')
92
stored_state_file = "clients.pickle"
94
logger = logging.getLogger()
87
95
syslogger = (logging.handlers.SysLogHandler
88
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
89
address = "/dev/log"))
90
syslogger.setFormatter(logging.Formatter
91
(u'Mandos [%(process)d]: %(levelname)s:'
93
logger.addHandler(syslogger)
95
console = logging.StreamHandler()
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
99
logger.addHandler(console)
97
address = str("/dev/log")))
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
103
except (OSError, AttributeError):
104
def if_nametoindex(interface):
105
"Get an interface index the hard way, i.e. using fcntl()"
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
with contextlib.closing(socket.socket()) as s:
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
113
return interface_index
116
def initlogger(debug, level=logging.WARNING):
117
"""init logger and add loglevel"""
119
syslogger.setFormatter(logging.Formatter
120
('Mandos [%(process)d]: %(levelname)s:'
122
logger.addHandler(syslogger)
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
130
logger.addHandler(console)
131
logger.setLevel(level)
134
class PGPError(Exception):
135
"""Exception if encryption/decryption fails"""
139
class PGPEngine(object):
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
self.gnupg = GnuPGInterface.GnuPG()
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
154
def __exit__(self, exc_type, exc_value, traceback):
162
if self.tempdir is not None:
163
# Delete contents of tempdir
164
for root, dirs, files in os.walk(self.tempdir,
166
for filename in files:
167
os.remove(os.path.join(root, filename))
169
os.rmdir(os.path.join(root, dirname))
171
os.rmdir(self.tempdir)
174
def password_encode(self, password):
175
# Passphrase can not be empty and can not contain newlines or
176
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
179
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
196
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
211
return decrypted_plaintext
101
214
class AvahiError(Exception):
102
215
def __init__(self, value, *args, **kwargs):
191
315
dbus.UInt16(self.port),
192
316
avahi.string_array_to_txt_array(self.TXT))
193
317
self.group.Commit()
194
319
def entry_group_state_changed(self, state, error):
195
320
"""Derived from the Avahi example code"""
196
logger.debug(u"Avahi state change: %i", state)
321
logger.debug("Avahi entry group state change: %i", state)
198
323
if state == avahi.ENTRY_GROUP_ESTABLISHED:
199
logger.debug(u"Zeroconf service established.")
324
logger.debug("Zeroconf service established.")
200
325
elif state == avahi.ENTRY_GROUP_COLLISION:
201
logger.warning(u"Zeroconf service name collision.")
326
logger.info("Zeroconf service name collision.")
203
328
elif state == avahi.ENTRY_GROUP_FAILURE:
204
logger.critical(u"Avahi: Error in group state changed %s",
329
logger.critical("Avahi: Error in group state changed %s",
206
raise AvahiGroupError(u"State changed: %s"
331
raise AvahiGroupError("State changed: {0!s}"
208
334
def cleanup(self):
209
335
"""Derived from the Avahi example code"""
210
336
if self.group is not None:
339
except (dbus.exceptions.UnknownMethodException,
340
dbus.exceptions.DBusException):
212
342
self.group = None
213
def server_state_changed(self, state):
345
def server_state_changed(self, state, error=None):
214
346
"""Derived from the Avahi example code"""
215
if state == avahi.SERVER_COLLISION:
216
logger.error(u"Zeroconf server name collision")
347
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
355
if state in bad_states:
356
if bad_states[state] is not None:
358
logger.error(bad_states[state])
360
logger.error(bad_states[state] + ": %r", error)
218
362
elif state == avahi.SERVER_RUNNING:
366
logger.debug("Unknown state: %r", state)
368
logger.debug("Unknown state: %r: %r", state, error)
220
370
def activate(self):
221
371
"""Derived from the Avahi example code"""
222
372
if self.server is None:
223
373
self.server = dbus.Interface(
224
374
self.bus.get_object(avahi.DBUS_NAME,
225
avahi.DBUS_PATH_SERVER),
375
avahi.DBUS_PATH_SERVER,
376
follow_name_owner_changes=True),
226
377
avahi.DBUS_INTERFACE_SERVER)
227
self.server.connect_to_signal(u"StateChanged",
378
self.server.connect_to_signal("StateChanged",
228
379
self.server_state_changed)
229
380
self.server_state_changed(self.server.GetState())
383
class AvahiServiceToSyslog(AvahiService):
385
"""Add the new name to the syslog messages"""
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
232
401
class Client(object):
233
402
"""A representation of a client host served by this server.
236
name: string; from the config file, used in log messages and
405
approved: bool(); 'None' if not yet approved/disapproved
406
approval_delay: datetime.timedelta(); Time to wait for approval
407
approval_duration: datetime.timedelta(); Duration of one approval
408
checker: subprocess.Popen(); a running checker process used
409
to see if the client lives.
410
'None' if no process is running.
411
checker_callback_tag: a gobject event source tag, or None
412
checker_command: string; External command which is run to check
413
if client lives. %() expansions are done at
414
runtime with vars(self) as dict, so that for
415
instance %(name)s can be used in the command.
416
checker_initiator_tag: a gobject event source tag, or None
417
created: datetime.datetime(); (UTC) object creation
418
client_structure: Object describing what attributes a client has
419
and is used for storing the client at exit
420
current_checker_command: string; current running checker_command
421
disable_initiator_tag: a gobject event source tag, or None
238
423
fingerprint: string (40 or 32 hexadecimal digits); used to
239
424
uniquely identify the client
240
secret: bytestring; sent verbatim (over TLS) to client
241
425
host: string; available for use by the checker command
242
created: datetime.datetime(); (UTC) object creation
243
last_enabled: datetime.datetime(); (UTC)
426
interval: datetime.timedelta(); How often to start a new checker
427
last_approval_request: datetime.datetime(); (UTC) or None
245
428
last_checked_ok: datetime.datetime(); (UTC) or None
429
last_checker_status: integer between 0 and 255 reflecting exit
430
status of last checker. -1 reflects crashed
431
checker, -2 means no checker completed yet.
432
last_enabled: datetime.datetime(); (UTC) or None
433
name: string; from the config file, used in log messages and
435
secret: bytestring; sent verbatim (over TLS) to client
246
436
timeout: datetime.timedelta(); How long from last_checked_ok
247
437
until this client is disabled
248
interval: datetime.timedelta(); How often to start a new checker
249
disable_hook: If set, called by disable() as disable_hook(self)
250
checker: subprocess.Popen(); a running checker process used
251
to see if the client lives.
252
'None' if no process is running.
253
checker_initiator_tag: a gobject event source tag, or None
254
disable_initiator_tag: - '' -
255
checker_callback_tag: - '' -
256
checker_command: string; External command which is run to check if
257
client lives. %() expansions are done at
258
runtime with vars(self) as dict, so that for
259
instance %(name)s can be used in the command.
260
current_checker_command: string; current running checker_command
438
extended_timeout: extra long timeout when secret has been sent
439
runtime_expansions: Allowed attributes for runtime expansion.
440
expires: datetime.datetime(); time (UTC) when a client will be
264
def _timedelta_to_milliseconds(td):
265
"Convert a datetime.timedelta() to milliseconds"
266
return ((td.days * 24 * 60 * 60 * 1000)
267
+ (td.seconds * 1000)
268
+ (td.microseconds // 1000))
444
runtime_expansions = ("approval_delay", "approval_duration",
445
"created", "enabled", "expires",
446
"fingerprint", "host", "interval",
447
"last_approval_request", "last_checked_ok",
448
"last_enabled", "name", "timeout")
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
452
"checker": "fping -q -- %%(host)s",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
270
460
def timeout_milliseconds(self):
271
461
"Return the 'timeout' attribute in milliseconds"
272
return self._timedelta_to_milliseconds(self.timeout)
462
return timedelta_to_milliseconds(self.timeout)
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
274
468
def interval_milliseconds(self):
275
469
"Return the 'interval' attribute in milliseconds"
276
return self._timedelta_to_milliseconds(self.interval)
278
def __init__(self, name = None, disable_hook=None, config=None):
279
"""Note: the 'checker' key in 'config' sets the
280
'checker_command' attribute and *not* the 'checker'
470
return timedelta_to_milliseconds(self.interval)
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
476
def config_parser(config):
477
"""Construct a new dict of client settings of this form:
478
{ client_name: {setting_name: value, ...}, ...}
479
with exceptions for any special settings as defined above.
480
NOTE: Must be a pure function. Must return the same result
481
value given the same arguments.
484
for client_name in config.sections():
485
section = dict(config.items(client_name))
486
client = settings[client_name] = {}
488
client["host"] = section["host"]
489
# Reformat values from string types to Python types
490
client["approved_by_default"] = config.getboolean(
491
client_name, "approved_by_default")
492
client["enabled"] = config.getboolean(client_name,
495
client["fingerprint"] = (section["fingerprint"].upper()
497
if "secret" in section:
498
client["secret"] = section["secret"].decode("base64")
499
elif "secfile" in section:
500
with open(os.path.expanduser(os.path.expandvars
501
(section["secfile"])),
503
client["secret"] = secfile.read()
505
raise TypeError("No secret or secfile for section {0}"
507
client["timeout"] = string_to_delta(section["timeout"])
508
client["extended_timeout"] = string_to_delta(
509
section["extended_timeout"])
510
client["interval"] = string_to_delta(section["interval"])
511
client["approval_delay"] = string_to_delta(
512
section["approval_delay"])
513
client["approval_duration"] = string_to_delta(
514
section["approval_duration"])
515
client["checker_command"] = section["checker"]
516
client["last_approval_request"] = None
517
client["last_checked_ok"] = None
518
client["last_checker_status"] = -2
522
def __init__(self, settings, name = None):
285
logger.debug(u"Creating client %r", self.name)
524
# adding all client settings
525
for setting, value in settings.iteritems():
526
setattr(self, setting, value)
529
if not hasattr(self, "last_enabled"):
530
self.last_enabled = datetime.datetime.utcnow()
531
if not hasattr(self, "expires"):
532
self.expires = (datetime.datetime.utcnow()
535
self.last_enabled = None
538
logger.debug("Creating client %r", self.name)
286
539
# Uppercase and remove spaces from fingerprint for later
287
540
# comparison purposes with return value from the fingerprint()
289
self.fingerprint = (config[u"fingerprint"].upper()
291
logger.debug(u" Fingerprint: %s", self.fingerprint)
292
if u"secret" in config:
293
self.secret = config[u"secret"].decode(u"base64")
294
elif u"secfile" in config:
295
with open(os.path.expanduser(os.path.expandvars
296
(config[u"secfile"])),
298
self.secret = secfile.read()
300
raise TypeError(u"No secret or secfile for client %s"
302
self.host = config.get(u"host", u"")
303
self.created = datetime.datetime.utcnow()
305
self.last_enabled = None
306
self.last_checked_ok = None
307
self.timeout = string_to_delta(config[u"timeout"])
308
self.interval = string_to_delta(config[u"interval"])
309
self.disable_hook = disable_hook
542
logger.debug(" Fingerprint: %s", self.fingerprint)
543
self.created = settings.get("created",
544
datetime.datetime.utcnow())
546
# attributes specific for this server instance
310
547
self.checker = None
311
548
self.checker_initiator_tag = None
312
549
self.disable_initiator_tag = None
313
550
self.checker_callback_tag = None
314
self.checker_command = config[u"checker"]
315
551
self.current_checker_command = None
316
self.last_connect = None
553
self.approvals_pending = 0
554
self.changedstate = (multiprocessing_manager
555
.Condition(multiprocessing_manager
557
self.client_structure = [attr for attr in
558
self.__dict__.iterkeys()
559
if not attr.startswith("_")]
560
self.client_structure.append("client_structure")
562
for name, t in inspect.getmembers(type(self),
566
if not name.startswith("_"):
567
self.client_structure.append(name)
569
# Send notice to process children that client state has changed
570
def send_changedstate(self):
571
with self.changedstate:
572
self.changedstate.notify_all()
318
574
def enable(self):
319
575
"""Start this client's checker and timeout hooks"""
320
if getattr(self, u"enabled", False):
576
if getattr(self, "enabled", False):
321
577
# Already enabled
579
self.expires = datetime.datetime.utcnow() + self.timeout
323
581
self.last_enabled = datetime.datetime.utcnow()
583
self.send_changedstate()
585
def disable(self, quiet=True):
586
"""Disable this client."""
587
if not getattr(self, "enabled", False):
590
logger.info("Disabling client %s", self.name)
591
if getattr(self, "disable_initiator_tag", None) is not None:
592
gobject.source_remove(self.disable_initiator_tag)
593
self.disable_initiator_tag = None
595
if getattr(self, "checker_initiator_tag", None) is not None:
596
gobject.source_remove(self.checker_initiator_tag)
597
self.checker_initiator_tag = None
601
self.send_changedstate()
602
# Do not run this again if called by a gobject.timeout_add
608
def init_checker(self):
324
609
# Schedule a new checker to be started an 'interval' from now,
325
610
# and every interval from then on.
611
if self.checker_initiator_tag is not None:
612
gobject.source_remove(self.checker_initiator_tag)
326
613
self.checker_initiator_tag = (gobject.timeout_add
327
614
(self.interval_milliseconds(),
328
615
self.start_checker))
329
616
# Schedule a disable() when 'timeout' has passed
617
if self.disable_initiator_tag is not None:
618
gobject.source_remove(self.disable_initiator_tag)
330
619
self.disable_initiator_tag = (gobject.timeout_add
331
620
(self.timeout_milliseconds(),
334
622
# Also start a new checker *right now*.
335
623
self.start_checker()
337
def disable(self, quiet=True):
338
"""Disable this client."""
339
if not getattr(self, "enabled", False):
342
logger.info(u"Disabling client %s", self.name)
343
if getattr(self, u"disable_initiator_tag", False):
344
gobject.source_remove(self.disable_initiator_tag)
345
self.disable_initiator_tag = None
346
if getattr(self, u"checker_initiator_tag", False):
347
gobject.source_remove(self.checker_initiator_tag)
348
self.checker_initiator_tag = None
350
if self.disable_hook:
351
self.disable_hook(self)
353
# Do not run this again if called by a gobject.timeout_add
357
self.disable_hook = None
360
625
def checker_callback(self, pid, condition, command):
361
626
"""The checker has completed, so take appropriate actions."""
362
627
self.checker_callback_tag = None
363
628
self.checker = None
364
629
if os.WIFEXITED(condition):
365
exitstatus = os.WEXITSTATUS(condition)
367
logger.info(u"Checker for %(name)s succeeded",
630
self.last_checker_status = os.WEXITSTATUS(condition)
631
if self.last_checker_status == 0:
632
logger.info("Checker for %(name)s succeeded",
369
634
self.checked_ok()
371
logger.info(u"Checker for %(name)s failed",
636
logger.info("Checker for %(name)s failed",
374
logger.warning(u"Checker for %(name)s crashed?",
639
self.last_checker_status = -1
640
logger.warning("Checker for %(name)s crashed?",
377
643
def checked_ok(self):
378
"""Bump up the timeout for this client.
380
This should only be called when the client has been seen,
644
"""Assert that the client has been seen, alive and well."""
383
645
self.last_checked_ok = datetime.datetime.utcnow()
384
gobject.source_remove(self.disable_initiator_tag)
385
self.disable_initiator_tag = (gobject.timeout_add
386
(self.timeout_milliseconds(),
646
self.last_checker_status = 0
649
def bump_timeout(self, timeout=None):
650
"""Bump up the timeout for this client."""
652
timeout = self.timeout
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = None
656
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(timedelta_to_milliseconds
659
(timeout), self.disable))
660
self.expires = datetime.datetime.utcnow() + timeout
662
def need_approval(self):
663
self.last_approval_request = datetime.datetime.utcnow()
389
665
def start_checker(self):
390
666
"""Start a new checker subprocess if one is not running.
530
837
class DBusObjectWithProperties(dbus.service.Object):
531
838
"""A D-Bus object with properties.
533
840
Classes inheriting from this can use the dbus_service_property
534
841
decorator to expose methods as D-Bus properties. It exposes the
535
842
standard Get(), Set(), and GetAll() methods on the D-Bus.
539
def _is_dbus_property(obj):
540
return getattr(obj, u"_dbus_is_property", False)
846
def _is_dbus_thing(thing):
847
"""Returns a function testing if an attribute is a D-Bus thing
849
If called like _is_dbus_thing("method") it returns a function
850
suitable for use as predicate to inspect.getmembers().
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
542
def _get_all_dbus_properties(self):
855
def _get_all_dbus_things(self, thing):
543
856
"""Returns a generator of (name, attribute) pairs
545
return ((prop._dbus_name, prop)
547
inspect.getmembers(self, self._is_dbus_property))
858
return ((getattr(athing.__get__(self), "_dbus_name",
860
athing.__get__(self))
861
for cls in self.__class__.__mro__
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
549
866
def _get_dbus_property(self, interface_name, property_name):
550
867
"""Returns a bound method if one exists which is a D-Bus
551
868
property with the specified name and interface.
553
for name in (property_name,
554
property_name + u"_dbus_property"):
555
prop = getattr(self, name, None)
557
or not self._is_dbus_property(prop)
558
or prop._dbus_name != property_name
559
or (interface_name and prop._dbus_interface
560
and interface_name != prop._dbus_interface)):
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
873
self._is_dbus_thing("property"))):
874
if (value._dbus_name == property_name
875
and value._dbus_interface == interface_name):
876
return value.__get__(self)
563
878
# No such property
564
raise DBusPropertyNotFound(self.dbus_object_path + u":"
565
+ interface_name + u"."
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
568
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
570
885
def Get(self, interface_name, property_name):
571
886
"""Standard D-Bus property Get() method, see D-Bus standard.
573
888
prop = self._get_dbus_property(interface_name, property_name)
574
if prop._dbus_access == u"write":
889
if prop._dbus_access == "write":
575
890
raise DBusPropertyAccessException(property_name)
577
if not hasattr(value, u"variant_level"):
892
if not hasattr(value, "variant_level"):
579
894
return type(value)(value, variant_level=value.variant_level+1)
581
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
896
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
582
897
def Set(self, interface_name, property_name, value):
583
898
"""Standard D-Bus property Set() method, see D-Bus standard.
585
900
prop = self._get_dbus_property(interface_name, property_name)
586
if prop._dbus_access == u"read":
901
if prop._dbus_access == "read":
587
902
raise DBusPropertyAccessException(property_name)
588
if prop._dbus_get_args_options[u"byte_arrays"]:
903
if prop._dbus_get_args_options["byte_arrays"]:
589
904
# The byte_arrays option is not supported yet on
590
905
# signatures other than "ay".
591
if prop._dbus_signature != u"ay":
906
if prop._dbus_signature != "ay":
593
value = dbus.ByteArray(''.join(unichr(byte)
908
value = dbus.ByteArray(b''.join(chr(byte)
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
598
out_signature=u"a{sv}")
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
913
out_signature="a{sv}")
599
914
def GetAll(self, interface_name):
600
915
"""Standard D-Bus property GetAll() method, see D-Bus
603
918
Note: Will not include properties with access="write".
606
for name, prop in self._get_all_dbus_properties():
921
for name, prop in self._get_all_dbus_things("property"):
607
922
if (interface_name
608
923
and interface_name != prop._dbus_interface):
609
924
# Interface non-empty but did not match
611
926
# Ignore write-only properties
612
if prop._dbus_access == u"write":
927
if prop._dbus_access == "write":
615
if not hasattr(value, u"variant_level"):
930
if not hasattr(value, "variant_level"):
931
properties[name] = value
618
all[name] = type(value)(value, variant_level=
619
value.variant_level+1)
620
return dbus.Dictionary(all, signature=u"sv")
933
properties[name] = type(value)(value, variant_level=
934
value.variant_level+1)
935
return dbus.Dictionary(properties, signature="sv")
622
937
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
624
939
path_keyword='object_path',
625
940
connection_keyword='connection')
626
941
def Introspect(self, object_path, connection):
627
"""Standard D-Bus method, overloaded to insert property tags.
942
"""Overloading of standard D-Bus method.
944
Inserts property tags and interface annotation tags.
629
946
xmlstring = dbus.service.Object.Introspect(self, object_path,
632
949
document = xml.dom.minidom.parseString(xmlstring)
633
950
def make_tag(document, name, prop):
634
e = document.createElement(u"property")
635
e.setAttribute(u"name", name)
636
e.setAttribute(u"type", prop._dbus_signature)
637
e.setAttribute(u"access", prop._dbus_access)
951
e = document.createElement("property")
952
e.setAttribute("name", name)
953
e.setAttribute("type", prop._dbus_signature)
954
e.setAttribute("access", prop._dbus_access)
639
for if_tag in document.getElementsByTagName(u"interface"):
956
for if_tag in document.getElementsByTagName("interface"):
640
958
for tag in (make_tag(document, name, prop)
642
in self._get_all_dbus_properties()
960
in self._get_all_dbus_things("property")
643
961
if prop._dbus_interface
644
== if_tag.getAttribute(u"name")):
962
== if_tag.getAttribute("name")):
645
963
if_tag.appendChild(tag)
964
# Add annotation tags
965
for typ in ("method", "signal", "property"):
966
for tag in if_tag.getElementsByTagName(typ):
968
for name, prop in (self.
969
_get_all_dbus_things(typ)):
970
if (name == tag.getAttribute("name")
971
and prop._dbus_interface
972
== if_tag.getAttribute("name")):
973
annots.update(getattr
977
for name, value in annots.iteritems():
978
ann_tag = document.createElement(
980
ann_tag.setAttribute("name", name)
981
ann_tag.setAttribute("value", value)
982
tag.appendChild(ann_tag)
983
# Add interface annotation tags
984
for annotation, value in dict(
985
itertools.chain.from_iterable(
986
annotations().iteritems()
987
for name, annotations in
988
self._get_all_dbus_things("interface")
989
if name == if_tag.getAttribute("name")
991
ann_tag = document.createElement("annotation")
992
ann_tag.setAttribute("name", annotation)
993
ann_tag.setAttribute("value", value)
994
if_tag.appendChild(ann_tag)
646
995
# Add the names to the return values for the
647
996
# "org.freedesktop.DBus.Properties" methods
648
if (if_tag.getAttribute(u"name")
649
== u"org.freedesktop.DBus.Properties"):
650
for cn in if_tag.getElementsByTagName(u"method"):
651
if cn.getAttribute(u"name") == u"Get":
652
for arg in cn.getElementsByTagName(u"arg"):
653
if (arg.getAttribute(u"direction")
655
arg.setAttribute(u"name", u"value")
656
elif cn.getAttribute(u"name") == u"GetAll":
657
for arg in cn.getElementsByTagName(u"arg"):
658
if (arg.getAttribute(u"direction")
660
arg.setAttribute(u"name", u"props")
661
xmlstring = document.toxml(u"utf-8")
997
if (if_tag.getAttribute("name")
998
== "org.freedesktop.DBus.Properties"):
999
for cn in if_tag.getElementsByTagName("method"):
1000
if cn.getAttribute("name") == "Get":
1001
for arg in cn.getElementsByTagName("arg"):
1002
if (arg.getAttribute("direction")
1004
arg.setAttribute("name", "value")
1005
elif cn.getAttribute("name") == "GetAll":
1006
for arg in cn.getElementsByTagName("arg"):
1007
if (arg.getAttribute("direction")
1009
arg.setAttribute("name", "props")
1010
xmlstring = document.toxml("utf-8")
662
1011
document.unlink()
663
1012
except (AttributeError, xml.dom.DOMException,
664
xml.parsers.expat.ExpatError), error:
665
logger.error(u"Failed to override Introspection method",
1013
xml.parsers.expat.ExpatError) as error:
1014
logger.error("Failed to override Introspection method",
667
1016
return xmlstring
1019
def datetime_to_dbus(dt, variant_level=0):
1020
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1022
return dbus.String("", variant_level = variant_level)
1023
return dbus.String(dt.isoformat(),
1024
variant_level=variant_level)
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1028
"""A class decorator; applied to a subclass of
1029
dbus.service.Object, it will add alternate D-Bus attributes with
1030
interface names according to the "alt_interface_names" mapping.
1033
@alternate_dbus_interfaces({"org.example.Interface":
1034
"net.example.AlternateInterface"})
1035
class SampleDBusObject(dbus.service.Object):
1036
@dbus.service.method("org.example.Interface")
1037
def SampleDBusMethod():
1040
The above "SampleDBusMethod" on "SampleDBusObject" will be
1041
reachable via two interfaces: "org.example.Interface" and
1042
"net.example.AlternateInterface", the latter of which will have
1043
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1044
"true", unless "deprecate" is passed with a False value.
1046
This works for methods and signals, and also for D-Bus properties
1047
(from DBusObjectWithProperties) and interfaces (from the
1048
dbus_interface_annotations decorator).
1051
for orig_interface_name, alt_interface_name in (
1052
alt_interface_names.iteritems()):
1054
interface_names = set()
1055
# Go though all attributes of the class
1056
for attrname, attribute in inspect.getmembers(cls):
1057
# Ignore non-D-Bus attributes, and D-Bus attributes
1058
# with the wrong interface name
1059
if (not hasattr(attribute, "_dbus_interface")
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1063
# Create an alternate D-Bus interface name based on
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1068
interface_names.add(alt_interface)
1069
# Is this a D-Bus signal?
1070
if getattr(attribute, "_dbus_is_signal", False):
1071
# Extract the original non-method function by
1073
nonmethod_func = (dict(
1074
zip(attribute.func_code.co_freevars,
1075
attribute.__closure__))["func"]
1077
# Create a new, but exactly alike, function
1078
# object, and decorate it to be a new D-Bus signal
1079
# with the alternate D-Bus interface name
1080
new_function = (dbus.service.signal
1082
attribute._dbus_signature)
1083
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1089
# Copy annotations, if any
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1093
except AttributeError:
1095
# Define a creator of a function to call both the
1096
# original and alternate functions, so both the
1097
# original and alternate signals gets sent when
1098
# the function is called
1099
def fixscope(func1, func2):
1100
"""This function is a scope container to pass
1101
func1 and func2 to the "call_both" function
1102
outside of its arguments"""
1103
def call_both(*args, **kwargs):
1104
"""This function will emit two D-Bus
1105
signals by calling func1 and func2"""
1106
func1(*args, **kwargs)
1107
func2(*args, **kwargs)
1109
# Create the "call_both" function and add it to
1111
attr[attrname] = fixscope(attribute, new_function)
1112
# Is this a D-Bus method?
1113
elif getattr(attribute, "_dbus_is_method", False):
1114
# Create a new, but exactly alike, function
1115
# object. Decorate it to be a new D-Bus method
1116
# with the alternate D-Bus interface name. Add it
1118
attr[attrname] = (dbus.service.method
1120
attribute._dbus_in_signature,
1121
attribute._dbus_out_signature)
1123
(attribute.func_code,
1124
attribute.func_globals,
1125
attribute.func_name,
1126
attribute.func_defaults,
1127
attribute.func_closure)))
1128
# Copy annotations, if any
1130
attr[attrname]._dbus_annotations = (
1131
dict(attribute._dbus_annotations))
1132
except AttributeError:
1134
# Is this a D-Bus property?
1135
elif getattr(attribute, "_dbus_is_property", False):
1136
# Create a new, but exactly alike, function
1137
# object, and decorate it to be a new D-Bus
1138
# property with the alternate D-Bus interface
1139
# name. Add it to the class.
1140
attr[attrname] = (dbus_service_property
1142
attribute._dbus_signature,
1143
attribute._dbus_access,
1145
._dbus_get_args_options
1148
(attribute.func_code,
1149
attribute.func_globals,
1150
attribute.func_name,
1151
attribute.func_defaults,
1152
attribute.func_closure)))
1153
# Copy annotations, if any
1155
attr[attrname]._dbus_annotations = (
1156
dict(attribute._dbus_annotations))
1157
except AttributeError:
1159
# Is this a D-Bus interface?
1160
elif getattr(attribute, "_dbus_is_interface", False):
1161
# Create a new, but exactly alike, function
1162
# object. Decorate it to be a new D-Bus interface
1163
# with the alternate D-Bus interface name. Add it
1165
attr[attrname] = (dbus_interface_annotations
1168
(attribute.func_code,
1169
attribute.func_globals,
1170
attribute.func_name,
1171
attribute.func_defaults,
1172
attribute.func_closure)))
1174
# Deprecate all alternate interfaces
1175
iname="_AlternateDBusNames_interface_annotation{0}"
1176
for interface_name in interface_names:
1177
@dbus_interface_annotations(interface_name)
1179
return { "org.freedesktop.DBus.Deprecated":
1181
# Find an unused name
1182
for aname in (iname.format(i)
1183
for i in itertools.count()):
1184
if aname not in attr:
1188
# Replace the class with a new subclass of it with
1189
# methods, signals, etc. as created above.
1190
cls = type(b"{0}Alternate".format(cls.__name__),
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
"se.bsnet.fukt.Mandos"})
670
1198
class ClientDBus(Client, DBusObjectWithProperties):
671
1199
"""A Client class using D-Bus
681
1213
Client.__init__(self, *args, **kwargs)
682
1214
# Only now, when this client is initialized, can it show up on
1216
client_object_name = unicode(self.name).translate(
1217
{ord("."): ord("_"),
1218
ord("-"): ord("_")})
684
1219
self.dbus_object_path = (dbus.ObjectPath
686
+ self.name.replace(u".", u"_")))
1220
("/clients/" + client_object_name))
687
1221
DBusObjectWithProperties.__init__(self, self.bus,
688
1222
self.dbus_object_path)
691
def _datetime_to_dbus(dt, variant_level=0):
692
"""Convert a UTC datetime.datetime() to a D-Bus type."""
693
return dbus.String(dt.isoformat(),
694
variant_level=variant_level)
697
oldstate = getattr(self, u"enabled", False)
698
r = Client.enable(self)
699
if oldstate != self.enabled:
701
self.PropertyChanged(dbus.String(u"enabled"),
702
dbus.Boolean(True, variant_level=1))
703
self.PropertyChanged(
704
dbus.String(u"last_enabled"),
705
self._datetime_to_dbus(self.last_enabled,
709
def disable(self, quiet = False):
710
oldstate = getattr(self, u"enabled", False)
711
r = Client.disable(self, quiet=quiet)
712
if not quiet and oldstate != self.enabled:
714
self.PropertyChanged(dbus.String(u"enabled"),
715
dbus.Boolean(False, variant_level=1))
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1227
""" Modify a variable so that it's a property which announces
1228
its changes to DBus.
1230
transform_fun: Function that takes a value and a variant_level
1231
and transforms it to a D-Bus type.
1232
dbus_name: D-Bus name of the variable
1233
type_func: Function that transform the value before sending it
1234
to the D-Bus. Default: no transform
1235
variant_level: D-Bus variant level. Default: 1
1237
attrname = "_{0}".format(dbus_name)
1238
def setter(self, value):
1239
if hasattr(self, "dbus_object_path"):
1240
if (not hasattr(self, attrname) or
1241
type_func(getattr(self, attrname, None))
1242
!= type_func(value)):
1243
dbus_value = transform_func(type_func(value),
1246
self.PropertyChanged(dbus.String(dbus_name),
1248
setattr(self, attrname, value)
1250
return property(lambda self: getattr(self, attrname), setter)
1252
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1253
approvals_pending = notifychangeproperty(dbus.Boolean,
1256
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1257
last_enabled = notifychangeproperty(datetime_to_dbus,
1259
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1260
type_func = lambda checker:
1261
checker is not None)
1262
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1264
last_checker_status = notifychangeproperty(dbus.Int16,
1265
"LastCheckerStatus")
1266
last_approval_request = notifychangeproperty(
1267
datetime_to_dbus, "LastApprovalRequest")
1268
approved_by_default = notifychangeproperty(dbus.Boolean,
1269
"ApprovedByDefault")
1270
approval_delay = notifychangeproperty(dbus.UInt64,
1273
timedelta_to_milliseconds)
1274
approval_duration = notifychangeproperty(
1275
dbus.UInt64, "ApprovalDuration",
1276
type_func = timedelta_to_milliseconds)
1277
host = notifychangeproperty(dbus.String, "Host")
1278
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
timedelta_to_milliseconds)
1281
extended_timeout = notifychangeproperty(
1282
dbus.UInt64, "ExtendedTimeout",
1283
type_func = timedelta_to_milliseconds)
1284
interval = notifychangeproperty(dbus.UInt64,
1287
timedelta_to_milliseconds)
1288
checker_command = notifychangeproperty(dbus.String, "Checker")
1290
del notifychangeproperty
718
1292
def __del__(self, *args, **kwargs):
720
1294
self.remove_from_connection()
721
1295
except LookupError:
723
if hasattr(DBusObjectWithProperties, u"__del__"):
1297
if hasattr(DBusObjectWithProperties, "__del__"):
724
1298
DBusObjectWithProperties.__del__(self, *args, **kwargs)
725
1299
Client.__del__(self, *args, **kwargs)
852
@dbus_service_property(_interface, signature=u"s", access=u"read")
853
def name_dbus_property(self):
1433
# ApprovalPending - property
1434
@dbus_service_property(_interface, signature="b", access="read")
1435
def ApprovalPending_dbus_property(self):
1436
return dbus.Boolean(bool(self.approvals_pending))
1438
# ApprovedByDefault - property
1439
@dbus_service_property(_interface, signature="b",
1441
def ApprovedByDefault_dbus_property(self, value=None):
1442
if value is None: # get
1443
return dbus.Boolean(self.approved_by_default)
1444
self.approved_by_default = bool(value)
1446
# ApprovalDelay - property
1447
@dbus_service_property(_interface, signature="t",
1449
def ApprovalDelay_dbus_property(self, value=None):
1450
if value is None: # get
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1452
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1454
# ApprovalDuration - property
1455
@dbus_service_property(_interface, signature="t",
1457
def ApprovalDuration_dbus_property(self, value=None):
1458
if value is None: # get
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1461
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1464
@dbus_service_property(_interface, signature="s", access="read")
1465
def Name_dbus_property(self):
854
1466
return dbus.String(self.name)
856
# fingerprint - property
857
@dbus_service_property(_interface, signature=u"s", access=u"read")
858
def fingerprint_dbus_property(self):
1468
# Fingerprint - property
1469
@dbus_service_property(_interface, signature="s", access="read")
1470
def Fingerprint_dbus_property(self):
859
1471
return dbus.String(self.fingerprint)
862
@dbus_service_property(_interface, signature=u"s",
864
def host_dbus_property(self, value=None):
1474
@dbus_service_property(_interface, signature="s",
1476
def Host_dbus_property(self, value=None):
865
1477
if value is None: # get
866
1478
return dbus.String(self.host)
869
self.PropertyChanged(dbus.String(u"host"),
870
dbus.String(value, variant_level=1))
873
@dbus_service_property(_interface, signature=u"s", access=u"read")
874
def created_dbus_property(self):
875
return dbus.String(self._datetime_to_dbus(self.created))
877
# last_enabled - property
878
@dbus_service_property(_interface, signature=u"s", access=u"read")
879
def last_enabled_dbus_property(self):
880
if self.last_enabled is None:
881
return dbus.String(u"")
882
return dbus.String(self._datetime_to_dbus(self.last_enabled))
885
@dbus_service_property(_interface, signature=u"b",
887
def enabled_dbus_property(self, value=None):
1479
self.host = unicode(value)
1481
# Created - property
1482
@dbus_service_property(_interface, signature="s", access="read")
1483
def Created_dbus_property(self):
1484
return datetime_to_dbus(self.created)
1486
# LastEnabled - property
1487
@dbus_service_property(_interface, signature="s", access="read")
1488
def LastEnabled_dbus_property(self):
1489
return datetime_to_dbus(self.last_enabled)
1491
# Enabled - property
1492
@dbus_service_property(_interface, signature="b",
1494
def Enabled_dbus_property(self, value=None):
888
1495
if value is None: # get
889
1496
return dbus.Boolean(self.enabled)
895
# last_checked_ok - property
896
@dbus_service_property(_interface, signature=u"s",
898
def last_checked_ok_dbus_property(self, value=None):
1502
# LastCheckedOK - property
1503
@dbus_service_property(_interface, signature="s",
1505
def LastCheckedOK_dbus_property(self, value=None):
899
1506
if value is not None:
900
1507
self.checked_ok()
902
if self.last_checked_ok is None:
903
return dbus.String(u"")
904
return dbus.String(self._datetime_to_dbus(self
908
@dbus_service_property(_interface, signature=u"t",
910
def timeout_dbus_property(self, value=None):
1509
return datetime_to_dbus(self.last_checked_ok)
1511
# LastCheckerStatus - property
1512
@dbus_service_property(_interface, signature="n",
1514
def LastCheckerStatus_dbus_property(self):
1515
return dbus.Int16(self.last_checker_status)
1517
# Expires - property
1518
@dbus_service_property(_interface, signature="s", access="read")
1519
def Expires_dbus_property(self):
1520
return datetime_to_dbus(self.expires)
1522
# LastApprovalRequest - property
1523
@dbus_service_property(_interface, signature="s", access="read")
1524
def LastApprovalRequest_dbus_property(self):
1525
return datetime_to_dbus(self.last_approval_request)
1527
# Timeout - property
1528
@dbus_service_property(_interface, signature="t",
1530
def Timeout_dbus_property(self, value=None):
911
1531
if value is None: # get
912
1532
return dbus.UInt64(self.timeout_milliseconds())
1533
old_timeout = self.timeout
913
1534
self.timeout = datetime.timedelta(0, 0, 0, value)
915
self.PropertyChanged(dbus.String(u"timeout"),
916
dbus.UInt64(value, variant_level=1))
917
if getattr(self, u"disable_initiator_tag", None) is None:
920
gobject.source_remove(self.disable_initiator_tag)
921
self.disable_initiator_tag = None
923
_timedelta_to_milliseconds((self
929
# The timeout has passed
932
self.disable_initiator_tag = (gobject.timeout_add
933
(time_to_die, self.disable))
935
# interval - property
936
@dbus_service_property(_interface, signature=u"t",
938
def interval_dbus_property(self, value=None):
1535
# Reschedule disabling
1537
now = datetime.datetime.utcnow()
1538
self.expires += self.timeout - old_timeout
1539
if self.expires <= now:
1540
# The timeout has passed
1543
if (getattr(self, "disable_initiator_tag", None)
1546
gobject.source_remove(self.disable_initiator_tag)
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1552
# ExtendedTimeout - property
1553
@dbus_service_property(_interface, signature="t",
1555
def ExtendedTimeout_dbus_property(self, value=None):
1556
if value is None: # get
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
1558
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1560
# Interval - property
1561
@dbus_service_property(_interface, signature="t",
1563
def Interval_dbus_property(self, value=None):
939
1564
if value is None: # get
940
1565
return dbus.UInt64(self.interval_milliseconds())
941
1566
self.interval = datetime.timedelta(0, 0, 0, value)
943
self.PropertyChanged(dbus.String(u"interval"),
944
dbus.UInt64(value, variant_level=1))
945
if getattr(self, u"checker_initiator_tag", None) is None:
1567
if getattr(self, "checker_initiator_tag", None) is None:
947
# Reschedule checker run
948
gobject.source_remove(self.checker_initiator_tag)
949
self.checker_initiator_tag = (gobject.timeout_add
950
(value, self.start_checker))
951
self.start_checker() # Start one now, too
954
@dbus_service_property(_interface, signature=u"s",
956
def checker_dbus_property(self, value=None):
1570
# Reschedule checker run
1571
gobject.source_remove(self.checker_initiator_tag)
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
1576
# Checker - property
1577
@dbus_service_property(_interface, signature="s",
1579
def Checker_dbus_property(self, value=None):
957
1580
if value is None: # get
958
1581
return dbus.String(self.checker_command)
959
self.checker_command = value
961
self.PropertyChanged(dbus.String(u"checker"),
962
dbus.String(self.checker_command,
1582
self.checker_command = unicode(value)
965
# checker_running - property
966
@dbus_service_property(_interface, signature=u"b",
968
def checker_running_dbus_property(self, value=None):
1584
# CheckerRunning - property
1585
@dbus_service_property(_interface, signature="b",
1587
def CheckerRunning_dbus_property(self, value=None):
969
1588
if value is None: # get
970
1589
return dbus.Boolean(self.checker is not None)
1027
1670
# Start communication using the Mandos protocol
1028
1671
# Get protocol number
1029
1672
line = self.request.makefile().readline()
1030
logger.debug(u"Protocol version: %r", line)
1673
logger.debug("Protocol version: %r", line)
1032
1675
if int(line.strip().split()[0]) > 1:
1033
1676
raise RuntimeError
1034
except (ValueError, IndexError, RuntimeError), error:
1035
logger.error(u"Unknown protocol version: %s", error)
1677
except (ValueError, IndexError, RuntimeError) as error:
1678
logger.error("Unknown protocol version: %s", error)
1038
1681
# Start GnuTLS connection
1040
1683
session.handshake()
1041
except gnutls.errors.GNUTLSError, error:
1042
logger.warning(u"Handshake failed: %s", error)
1684
except gnutls.errors.GNUTLSError as error:
1685
logger.warning("Handshake failed: %s", error)
1043
1686
# Do not run session.bye() here: the session is not
1044
1687
# established. Just abandon the request.
1046
logger.debug(u"Handshake succeeded")
1689
logger.debug("Handshake succeeded")
1691
approval_required = False
1049
1694
fpr = self.fingerprint(self.peer_certificate
1051
except (TypeError, gnutls.errors.GNUTLSError), error:
1052
logger.warning(u"Bad certificate: %s", error)
1054
logger.debug(u"Fingerprint: %s", fpr)
1056
for c in self.server.clients:
1057
if c.fingerprint == fpr:
1697
gnutls.errors.GNUTLSError) as error:
1698
logger.warning("Bad certificate: %s", error)
1700
logger.debug("Fingerprint: %s", fpr)
1703
client = ProxyClient(child_pipe, fpr,
1704
self.client_address)
1708
if client.approval_delay:
1709
delay = client.approval_delay
1710
client.approvals_pending += 1
1711
approval_required = True
1714
if not client.enabled:
1715
logger.info("Client %s is disabled",
1717
if self.server.use_dbus:
1719
client.Rejected("Disabled")
1722
if client.approved or not client.approval_delay:
1723
#We are approved or approval is disabled
1061
ipc.write(u"NOTFOUND %s %s\n"
1062
% (fpr, unicode(self.client_address)))
1065
class ClientProxy(object):
1066
"""Client proxy object. Not for calling methods."""
1067
def __init__(self, client):
1068
self.client = client
1069
def __getattr__(self, name):
1070
if name.startswith("ipc_"):
1072
ipc.write("%s %s\n" % (name[4:].upper(),
1075
if not hasattr(self.client, name):
1076
raise AttributeError
1077
ipc.write(u"GETATTR %s %s\n"
1078
% (name, self.client.fingerprint))
1079
return pickle.load(ipc_return)
1080
clientproxy = ClientProxy(client)
1081
# Have to check if client.enabled, since it is
1082
# possible that the client was disabled since the
1083
# GnuTLS session was established.
1084
if not clientproxy.enabled:
1085
clientproxy.ipc_disabled()
1088
clientproxy.ipc_sending()
1725
elif client.approved is None:
1726
logger.info("Client %s needs approval",
1728
if self.server.use_dbus:
1730
client.NeedApproval(
1731
client.approval_delay_milliseconds(),
1732
client.approved_by_default)
1734
logger.warning("Client %s was not approved",
1736
if self.server.use_dbus:
1738
client.Rejected("Denied")
1741
#wait until timeout or approved
1742
time = datetime.datetime.now()
1743
client.changedstate.acquire()
1744
client.changedstate.wait(
1745
float(timedelta_to_milliseconds(delay)
1747
client.changedstate.release()
1748
time2 = datetime.datetime.now()
1749
if (time2 - time) >= delay:
1750
if not client.approved_by_default:
1751
logger.warning("Client %s timed out while"
1752
" waiting for approval",
1754
if self.server.use_dbus:
1756
client.Rejected("Approval timed out")
1761
delay -= time2 - time
1090
1764
while sent_size < len(client.secret):
1091
sent = session.send(client.secret[sent_size:])
1092
logger.debug(u"Sent: %d, remaining: %d",
1766
sent = session.send(client.secret[sent_size:])
1767
except gnutls.errors.GNUTLSError as error:
1768
logger.warning("gnutls send failed",
1771
logger.debug("Sent: %d, remaining: %d",
1093
1772
sent, len(client.secret)
1094
1773
- (sent_size + sent))
1095
1774
sent_size += sent
1776
logger.info("Sending secret to %s", client.name)
1777
# bump the timeout using extended_timeout
1778
client.bump_timeout(client.extended_timeout)
1779
if self.server.use_dbus:
1784
if approval_required:
1785
client.approvals_pending -= 1
1788
except gnutls.errors.GNUTLSError as error:
1789
logger.warning("GnuTLS bye failed",
1100
1793
def peer_certificate(session):
1259
1999
def __init__(self, server_address, RequestHandlerClass,
1260
2000
interface=None, use_ipv6=True, clients=None,
1261
gnutls_priority=None, use_dbus=True):
2001
gnutls_priority=None, use_dbus=True, socketfd=None):
1262
2002
self.enabled = False
1263
2003
self.clients = clients
1264
2004
if self.clients is None:
1265
self.clients = set()
1266
2006
self.use_dbus = use_dbus
1267
2007
self.gnutls_priority = gnutls_priority
1268
2008
IPv6_TCPServer.__init__(self, server_address,
1269
2009
RequestHandlerClass,
1270
2010
interface = interface,
1271
use_ipv6 = use_ipv6)
2011
use_ipv6 = use_ipv6,
2012
socketfd = socketfd)
1272
2013
def server_activate(self):
1273
2014
if self.enabled:
1274
2015
return socketserver.TCPServer.server_activate(self)
1275
2017
def enable(self):
1276
2018
self.enabled = True
1277
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
2020
def add_pipe(self, parent_pipe, proc):
1278
2021
# Call "handle_ipc" for both data and EOF events
1279
gobject.io_add_watch(child_pipe_fd.fileno(),
2022
gobject.io_add_watch(parent_pipe.fileno(),
1280
2023
gobject.IO_IN | gobject.IO_HUP,
1281
2024
functools.partial(self.handle_ipc,
1282
reply = parent_pipe_fd,
1283
sender= child_pipe_fd))
1284
def handle_ipc(self, source, condition, reply=None, sender=None):
1286
gobject.IO_IN: u"IN", # There is data to read.
1287
gobject.IO_OUT: u"OUT", # Data can be written (without
1289
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1290
gobject.IO_ERR: u"ERR", # Error condition.
1291
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1292
# broken, usually for pipes and
1295
conditions_string = ' | '.join(name
1297
condition_names.iteritems()
1298
if cond & condition)
1299
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1302
# Read a line from the file object
1303
cmdline = sender.readline()
1304
if not cmdline: # Empty line means end of file
1305
# close the IPC pipes
1309
# Stop calling this function
1312
logger.debug(u"IPC command: %r", cmdline)
1314
# Parse and act on command
1315
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1317
if cmd == u"NOTFOUND":
1318
fpr, address = args.split(None, 1)
1319
logger.warning(u"Client not found for fingerprint: %s, ad"
1320
u"dress: %s", fpr, address)
1323
mandos_dbus_service.ClientNotFound(fpr, address)
1324
elif cmd == u"DISABLED":
1325
for client in self.clients:
1326
if client.name == args:
1327
logger.warning(u"Client %s is disabled", args)
1333
logger.error(u"Unknown client %s is disabled", args)
1334
elif cmd == u"SENDING":
1335
for client in self.clients:
1336
if client.name == args:
1337
logger.info(u"Sending secret to %s", client.name)
1344
logger.error(u"Sending secret to unknown client %s",
1346
elif cmd == u"GETATTR":
1347
attr_name, fpr = args.split(None, 1)
1348
for client in self.clients:
1349
if client.fingerprint == fpr:
1350
attr_value = getattr(client, attr_name, None)
1351
logger.debug("IPC reply: %r", attr_value)
1352
pickle.dump(attr_value, reply)
1355
logger.error(u"Client %s on address %s requesting "
1356
u"attribute %s not found", fpr, address,
1358
pickle.dump(None, reply)
1360
logger.error(u"Unknown IPC command: %r", cmdline)
1362
# Keep calling this function
2029
def handle_ipc(self, source, condition, parent_pipe=None,
2030
proc = None, client_object=None):
2031
# error, or the other end of multiprocessing.Pipe has closed
2032
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2033
# Wait for other process to exit
2037
# Read a request from the child
2038
request = parent_pipe.recv()
2039
command = request[0]
2041
if command == 'init':
2043
address = request[2]
2045
for c in self.clients.itervalues():
2046
if c.fingerprint == fpr:
2050
logger.info("Client not found for fingerprint: %s, ad"
2051
"dress: %s", fpr, address)
2054
mandos_dbus_service.ClientNotFound(fpr,
2056
parent_pipe.send(False)
2059
gobject.io_add_watch(parent_pipe.fileno(),
2060
gobject.IO_IN | gobject.IO_HUP,
2061
functools.partial(self.handle_ipc,
2067
parent_pipe.send(True)
2068
# remove the old hook in favor of the new above hook on
2071
if command == 'funcall':
2072
funcname = request[1]
2076
parent_pipe.send(('data', getattr(client_object,
2080
if command == 'getattr':
2081
attrname = request[1]
2082
if callable(client_object.__getattribute__(attrname)):
2083
parent_pipe.send(('function',))
2085
parent_pipe.send(('data', client_object
2086
.__getattribute__(attrname)))
2088
if command == 'setattr':
2089
attrname = request[1]
2091
setattr(client_object, attrname, value)
1366
2096
def string_to_delta(interval):
1367
2097
"""Parse a string and return a datetime.timedelta
1369
>>> string_to_delta(u'7d')
2099
>>> string_to_delta('7d')
1370
2100
datetime.timedelta(7)
1371
>>> string_to_delta(u'60s')
2101
>>> string_to_delta('60s')
1372
2102
datetime.timedelta(0, 60)
1373
>>> string_to_delta(u'60m')
2103
>>> string_to_delta('60m')
1374
2104
datetime.timedelta(0, 3600)
1375
>>> string_to_delta(u'24h')
2105
>>> string_to_delta('24h')
1376
2106
datetime.timedelta(1)
1377
>>> string_to_delta(u'1w')
2107
>>> string_to_delta('1w')
1378
2108
datetime.timedelta(7)
1379
>>> string_to_delta(u'5m 30s')
2109
>>> string_to_delta('5m 30s')
1380
2110
datetime.timedelta(0, 330)
1382
2112
timevalue = datetime.timedelta(0)
1456
2163
##################################################################
1457
2164
# Parsing of options, both command line and config file
1459
parser = optparse.OptionParser(version = "%%prog %s" % version)
1460
parser.add_option("-i", u"--interface", type=u"string",
1461
metavar="IF", help=u"Bind to interface IF")
1462
parser.add_option("-a", u"--address", type=u"string",
1463
help=u"Address to listen for requests on")
1464
parser.add_option("-p", u"--port", type=u"int",
1465
help=u"Port number to receive requests on")
1466
parser.add_option("--check", action=u"store_true",
1467
help=u"Run self-test")
1468
parser.add_option("--debug", action=u"store_true",
1469
help=u"Debug mode; run in foreground and log to"
1471
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1472
u" priority string (see GnuTLS documentation)")
1473
parser.add_option("--servicename", type=u"string",
1474
metavar=u"NAME", help=u"Zeroconf service name")
1475
parser.add_option("--configdir", type=u"string",
1476
default=u"/etc/mandos", metavar=u"DIR",
1477
help=u"Directory to search for configuration"
1479
parser.add_option("--no-dbus", action=u"store_false",
1480
dest=u"use_dbus", help=u"Do not provide D-Bus"
1481
u" system bus interface")
1482
parser.add_option("--no-ipv6", action=u"store_false",
1483
dest=u"use_ipv6", help=u"Do not use IPv6")
1484
options = parser.parse_args()[0]
2166
parser = argparse.ArgumentParser()
2167
parser.add_argument("-v", "--version", action="version",
2168
version = "%(prog)s {0}".format(version),
2169
help="show version number and exit")
2170
parser.add_argument("-i", "--interface", metavar="IF",
2171
help="Bind to interface IF")
2172
parser.add_argument("-a", "--address",
2173
help="Address to listen for requests on")
2174
parser.add_argument("-p", "--port", type=int,
2175
help="Port number to receive requests on")
2176
parser.add_argument("--check", action="store_true",
2177
help="Run self-test")
2178
parser.add_argument("--debug", action="store_true",
2179
help="Debug mode; run in foreground and log"
2181
parser.add_argument("--debuglevel", metavar="LEVEL",
2182
help="Debug level for stdout output")
2183
parser.add_argument("--priority", help="GnuTLS"
2184
" priority string (see GnuTLS documentation)")
2185
parser.add_argument("--servicename",
2186
metavar="NAME", help="Zeroconf service name")
2187
parser.add_argument("--configdir",
2188
default="/etc/mandos", metavar="DIR",
2189
help="Directory to search for configuration"
2191
parser.add_argument("--no-dbus", action="store_false",
2192
dest="use_dbus", help="Do not provide D-Bus"
2193
" system bus interface")
2194
parser.add_argument("--no-ipv6", action="store_false",
2195
dest="use_ipv6", help="Do not use IPv6")
2196
parser.add_argument("--no-restore", action="store_false",
2197
dest="restore", help="Do not restore stored"
2199
parser.add_argument("--socket", type=int,
2200
help="Specify a file descriptor to a network"
2201
" socket to use instead of creating one")
2202
parser.add_argument("--statedir", metavar="DIR",
2203
help="Directory to save/restore state in")
2205
options = parser.parse_args()
1486
2207
if options.check:
1534
2269
##################################################################
1536
2271
# For convenience
1537
debug = server_settings[u"debug"]
1538
use_dbus = server_settings[u"use_dbus"]
1539
use_ipv6 = server_settings[u"use_ipv6"]
1542
syslogger.setLevel(logging.WARNING)
1543
console.setLevel(logging.WARNING)
1545
if server_settings[u"servicename"] != u"Mandos":
2272
debug = server_settings["debug"]
2273
debuglevel = server_settings["debuglevel"]
2274
use_dbus = server_settings["use_dbus"]
2275
use_ipv6 = server_settings["use_ipv6"]
2276
stored_state_path = os.path.join(server_settings["statedir"],
2280
initlogger(debug, logging.DEBUG)
2285
level = getattr(logging, debuglevel.upper())
2286
initlogger(debug, level)
2288
if server_settings["servicename"] != "Mandos":
1546
2289
syslogger.setFormatter(logging.Formatter
1547
(u'Mandos (%s) [%%(process)d]:'
1548
u' %%(levelname)s: %%(message)s'
1549
% server_settings[u"servicename"]))
2290
('Mandos ({0}) [%(process)d]:'
2291
' %(levelname)s: %(message)s'
2292
.format(server_settings
1551
2295
# Parse config file with clients
1552
client_defaults = { u"timeout": u"1h",
1554
u"checker": u"fping -q -- %%(host)s",
1557
client_config = configparser.SafeConfigParser(client_defaults)
1558
client_config.read(os.path.join(server_settings[u"configdir"],
2296
client_config = configparser.SafeConfigParser(Client
2298
client_config.read(os.path.join(server_settings["configdir"],
1561
2301
global mandos_dbus_service
1562
2302
mandos_dbus_service = None
1564
tcp_server = MandosServer((server_settings[u"address"],
1565
server_settings[u"port"]),
2304
tcp_server = MandosServer((server_settings["address"],
2305
server_settings["port"]),
1567
interface=server_settings[u"interface"],
2307
interface=(server_settings["interface"]
1568
2309
use_ipv6=use_ipv6,
1569
2310
gnutls_priority=
1570
server_settings[u"priority"],
1572
pidfilename = u"/var/run/mandos.pid"
1574
pidfile = open(pidfilename, u"w")
1576
logger.error(u"Could not open file %r", pidfilename)
2311
server_settings["priority"],
2313
socketfd=(server_settings["socket"]
2316
pidfilename = "/var/run/mandos.pid"
2318
pidfile = open(pidfilename, "w")
2319
except IOError as e:
2320
logger.error("Could not open file %r", pidfilename,
1579
uid = pwd.getpwnam(u"_mandos").pw_uid
1580
gid = pwd.getpwnam(u"_mandos").pw_gid
2323
for name in ("_mandos", "mandos", "nobody"):
1583
uid = pwd.getpwnam(u"mandos").pw_uid
1584
gid = pwd.getpwnam(u"mandos").pw_gid
2325
uid = pwd.getpwnam(name).pw_uid
2326
gid = pwd.getpwnam(name).pw_gid
1585
2328
except KeyError:
1587
uid = pwd.getpwnam(u"nobody").pw_uid
1588
gid = pwd.getpwnam(u"nobody").pw_gid
1595
except OSError, error:
1596
if error[0] != errno.EPERM:
2336
except OSError as error:
2337
if error.errno != errno.EPERM:
1599
# Enable all possible GnuTLS debugging
2341
# Enable all possible GnuTLS debugging
1601
2343
# "Use a log level over 10 to enable all debugging options."
1602
2344
# - GnuTLS manual
1603
2345
gnutls.library.functions.gnutls_global_set_log_level(11)
1605
2347
@gnutls.library.types.gnutls_log_func
1606
2348
def debug_gnutls(level, string):
1607
logger.debug(u"GnuTLS: %s", string[:-1])
2349
logger.debug("GnuTLS: %s", string[:-1])
1609
2351
(gnutls.library.functions
1610
2352
.gnutls_global_set_log_function(debug_gnutls))
2354
# Redirect stdin so all checkers get /dev/null
2355
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2356
os.dup2(null, sys.stdin.fileno())
2360
# Need to fork before connecting to D-Bus
2362
# Close all input and output, do double fork, etc.
2365
# multiprocessing will use threads, so before we use gobject we
2366
# need to inform gobject that threads will be used.
2367
gobject.threads_init()
1612
2369
global main_loop
1613
2370
# From the Avahi example code
1614
DBusGMainLoop(set_as_default=True )
2371
DBusGMainLoop(set_as_default=True)
1615
2372
main_loop = gobject.MainLoop()
1616
2373
bus = dbus.SystemBus()
1617
2374
# End of Avahi example code
1620
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2377
bus_name = dbus.service.BusName("se.recompile.Mandos",
1621
2378
bus, do_not_queue=True)
1622
except dbus.exceptions.NameExistsException, e:
1623
logger.error(unicode(e) + u", disabling D-Bus")
2379
old_bus_name = (dbus.service.BusName
2380
("se.bsnet.fukt.Mandos", bus,
2382
except dbus.exceptions.NameExistsException as e:
2383
logger.error("Disabling D-Bus:", exc_info=e)
1624
2384
use_dbus = False
1625
server_settings[u"use_dbus"] = False
2385
server_settings["use_dbus"] = False
1626
2386
tcp_server.use_dbus = False
1627
2387
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1628
service = AvahiService(name = server_settings[u"servicename"],
1629
servicetype = u"_mandos._tcp",
1630
protocol = protocol, bus = bus)
2388
service = AvahiServiceToSyslog(name =
2389
server_settings["servicename"],
2390
servicetype = "_mandos._tcp",
2391
protocol = protocol, bus = bus)
1631
2392
if server_settings["interface"]:
1632
2393
service.interface = (if_nametoindex
1633
(str(server_settings[u"interface"])))
2394
(str(server_settings["interface"])))
2396
global multiprocessing_manager
2397
multiprocessing_manager = multiprocessing.Manager()
1635
2399
client_class = Client
1637
2401
client_class = functools.partial(ClientDBus, bus = bus)
1638
tcp_server.clients.update(set(
1639
client_class(name = section,
1640
config= dict(client_config.items(section)))
1641
for section in client_config.sections()))
2403
client_settings = Client.config_parser(client_config)
2404
old_client_settings = {}
2407
# Get client data and settings from last running state.
2408
if server_settings["restore"]:
2410
with open(stored_state_path, "rb") as stored_state:
2411
clients_data, old_client_settings = (pickle.load
2413
os.remove(stored_state_path)
2414
except IOError as e:
2415
if e.errno == errno.ENOENT:
2416
logger.warning("Could not load persistent state: {0}"
2417
.format(os.strerror(e.errno)))
2419
logger.critical("Could not load persistent state:",
2422
except EOFError as e:
2423
logger.warning("Could not load persistent state: "
2424
"EOFError:", exc_info=e)
2426
with PGPEngine() as pgp:
2427
for client_name, client in clients_data.iteritems():
2428
# Decide which value to use after restoring saved state.
2429
# We have three different values: Old config file,
2430
# new config file, and saved state.
2431
# New config value takes precedence if it differs from old
2432
# config value, otherwise use saved state.
2433
for name, value in client_settings[client_name].items():
2435
# For each value in new config, check if it
2436
# differs from the old config value (Except for
2437
# the "secret" attribute)
2438
if (name != "secret" and
2439
value != old_client_settings[client_name]
2441
client[name] = value
2445
# Clients who has passed its expire date can still be
2446
# enabled if its last checker was successful. Clients
2447
# whose checker succeeded before we stored its state is
2448
# assumed to have successfully run all checkers during
2450
if client["enabled"]:
2451
if datetime.datetime.utcnow() >= client["expires"]:
2452
if not client["last_checked_ok"]:
2454
"disabling client {0} - Client never "
2455
"performed a successful checker"
2456
.format(client_name))
2457
client["enabled"] = False
2458
elif client["last_checker_status"] != 0:
2460
"disabling client {0} - Client "
2461
"last checker failed with error code {1}"
2462
.format(client_name,
2463
client["last_checker_status"]))
2464
client["enabled"] = False
2466
client["expires"] = (datetime.datetime
2468
+ client["timeout"])
2469
logger.debug("Last checker succeeded,"
2470
" keeping {0} enabled"
2471
.format(client_name))
2473
client["secret"] = (
2474
pgp.decrypt(client["encrypted_secret"],
2475
client_settings[client_name]
2478
# If decryption fails, we use secret from new settings
2479
logger.debug("Failed to decrypt {0} old secret"
2480
.format(client_name))
2481
client["secret"] = (
2482
client_settings[client_name]["secret"])
2484
# Add/remove clients based on new changes made to config
2485
for client_name in (set(old_client_settings)
2486
- set(client_settings)):
2487
del clients_data[client_name]
2488
for client_name in (set(client_settings)
2489
- set(old_client_settings)):
2490
clients_data[client_name] = client_settings[client_name]
2492
# Create all client objects
2493
for client_name, client in clients_data.iteritems():
2494
tcp_server.clients[client_name] = client_class(
2495
name = client_name, settings = client)
1642
2497
if not tcp_server.clients:
1643
logger.warning(u"No clients defined")
1646
# Redirect stdin so all checkers get /dev/null
1647
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1648
os.dup2(null, sys.stdin.fileno())
1652
# No console logging
1653
logger.removeHandler(console)
1654
# Close all input and output, do double fork, etc.
1660
pidfile.write(str(pid) + "\n")
1663
logger.error(u"Could not write to file %r with PID %d",
1666
# "pidfile" was never created
2498
logger.warning("No clients defined")
1671
signal.signal(signal.SIGINT, signal.SIG_IGN)
2504
pidfile.write(str(pid) + "\n".encode("utf-8"))
2507
logger.error("Could not write to file %r with PID %d",
2510
# "pidfile" was never created
1672
2514
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1673
2515
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1676
class MandosDBusService(dbus.service.Object):
2518
@alternate_dbus_interfaces({"se.recompile.Mandos":
2519
"se.bsnet.fukt.Mandos"})
2520
class MandosDBusService(DBusObjectWithProperties):
1677
2521
"""A D-Bus proxy object"""
1678
2522
def __init__(self):
1679
dbus.service.Object.__init__(self, bus, u"/")
1680
_interface = u"se.bsnet.fukt.Mandos"
1682
@dbus.service.signal(_interface, signature=u"o")
2523
dbus.service.Object.__init__(self, bus, "/")
2524
_interface = "se.recompile.Mandos"
2526
@dbus_interface_annotations(_interface)
2528
return { "org.freedesktop.DBus.Property"
2529
".EmitsChangedSignal":
2532
@dbus.service.signal(_interface, signature="o")
1683
2533
def ClientAdded(self, objpath):
1687
@dbus.service.signal(_interface, signature=u"ss")
2537
@dbus.service.signal(_interface, signature="ss")
1688
2538
def ClientNotFound(self, fingerprint, address):
1692
@dbus.service.signal(_interface, signature=u"os")
2542
@dbus.service.signal(_interface, signature="os")
1693
2543
def ClientRemoved(self, objpath, name):
1697
@dbus.service.method(_interface, out_signature=u"ao")
2547
@dbus.service.method(_interface, out_signature="ao")
1698
2548
def GetAllClients(self):
1700
2550
return dbus.Array(c.dbus_object_path
1701
for c in tcp_server.clients)
2552
tcp_server.clients.itervalues())
1703
2554
@dbus.service.method(_interface,
1704
out_signature=u"a{oa{sv}}")
2555
out_signature="a{oa{sv}}")
1705
2556
def GetAllClientsWithProperties(self):
1707
2558
return dbus.Dictionary(
1708
((c.dbus_object_path, c.GetAll(u""))
1709
for c in tcp_server.clients),
1710
signature=u"oa{sv}")
2559
((c.dbus_object_path, c.GetAll(""))
2560
for c in tcp_server.clients.itervalues()),
1712
@dbus.service.method(_interface, in_signature=u"o")
2563
@dbus.service.method(_interface, in_signature="o")
1713
2564
def RemoveClient(self, object_path):
1715
for c in tcp_server.clients:
2566
for c in tcp_server.clients.itervalues():
1716
2567
if c.dbus_object_path == object_path:
1717
tcp_server.clients.remove(c)
2568
del tcp_server.clients[c.name]
1718
2569
c.remove_from_connection()
1719
2570
# Don't signal anything except ClientRemoved
1720
2571
c.disable(quiet=True)