78
89
except ImportError:
79
90
SO_BINDTODEVICE = None
84
logger = logging.Logger(u'mandos')
93
stored_state_file = "clients.pickle"
95
logger = logging.getLogger()
85
96
syslogger = (logging.handlers.SysLogHandler
86
97
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
87
address = "/dev/log"))
88
syslogger.setFormatter(logging.Formatter
89
(u'Mandos [%(process)d]: %(levelname)s:'
91
logger.addHandler(syslogger)
93
console = logging.StreamHandler()
94
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
logger.addHandler(console)
98
address = str("/dev/log")))
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
104
except (OSError, AttributeError):
105
def if_nametoindex(interface):
106
"Get an interface index the hard way, i.e. using fcntl()"
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
108
with contextlib.closing(socket.socket()) as s:
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
110
struct.pack(str("16s16x"),
112
interface_index = struct.unpack(str("I"),
114
return interface_index
117
def initlogger(debug, level=logging.WARNING):
118
"""init logger and add loglevel"""
120
syslogger.setFormatter(logging.Formatter
121
('Mandos [%(process)d]: %(levelname)s:'
123
logger.addHandler(syslogger)
126
console = logging.StreamHandler()
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
131
logger.addHandler(console)
132
logger.setLevel(level)
135
class PGPError(Exception):
136
"""Exception if encryption/decryption fails"""
140
class PGPEngine(object):
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
143
self.gnupg = GnuPGInterface.GnuPG()
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
self.gnupg = GnuPGInterface.GnuPG()
146
self.gnupg.options.meta_interactive = False
147
self.gnupg.options.homedir = self.tempdir
148
self.gnupg.options.extra_args.extend(['--force-mdc',
155
def __exit__(self, exc_type, exc_value, traceback):
163
if self.tempdir is not None:
164
# Delete contents of tempdir
165
for root, dirs, files in os.walk(self.tempdir,
167
for filename in files:
168
os.remove(os.path.join(root, filename))
170
os.rmdir(os.path.join(root, dirname))
172
os.rmdir(self.tempdir)
175
def password_encode(self, password):
176
# Passphrase can not be empty and can not contain newlines or
177
# NUL bytes. So we prefix it and hex encode it.
178
return b"mandos" + binascii.hexlify(password)
180
def encrypt(self, data, password):
181
self.gnupg.passphrase = self.password_encode(password)
182
with open(os.devnull, "w") as devnull:
184
proc = self.gnupg.run(['--symmetric'],
185
create_fhs=['stdin', 'stdout'],
186
attach_fhs={'stderr': devnull})
187
with contextlib.closing(proc.handles['stdin']) as f:
189
with contextlib.closing(proc.handles['stdout']) as f:
190
ciphertext = f.read()
194
self.gnupg.passphrase = None
197
def decrypt(self, data, password):
198
self.gnupg.passphrase = self.password_encode(password)
199
with open(os.devnull, "w") as devnull:
201
proc = self.gnupg.run(['--decrypt'],
202
create_fhs=['stdin', 'stdout'],
203
attach_fhs={'stderr': devnull})
204
with contextlib.closing(proc.handles['stdin']) as f:
206
with contextlib.closing(proc.handles['stdout']) as f:
207
decrypted_plaintext = f.read()
211
self.gnupg.passphrase = None
212
return decrypted_plaintext
99
215
class AvahiError(Exception):
100
216
def __init__(self, value, *args, **kwargs):
189
316
dbus.UInt16(self.port),
190
317
avahi.string_array_to_txt_array(self.TXT))
191
318
self.group.Commit()
192
320
def entry_group_state_changed(self, state, error):
193
321
"""Derived from the Avahi example code"""
194
logger.debug(u"Avahi state change: %i", state)
322
logger.debug("Avahi entry group state change: %i", state)
196
324
if state == avahi.ENTRY_GROUP_ESTABLISHED:
197
logger.debug(u"Zeroconf service established.")
325
logger.debug("Zeroconf service established.")
198
326
elif state == avahi.ENTRY_GROUP_COLLISION:
199
logger.warning(u"Zeroconf service name collision.")
327
logger.info("Zeroconf service name collision.")
201
329
elif state == avahi.ENTRY_GROUP_FAILURE:
202
logger.critical(u"Avahi: Error in group state changed %s",
330
logger.critical("Avahi: Error in group state changed %s",
204
raise AvahiGroupError(u"State changed: %s"
332
raise AvahiGroupError("State changed: {0!s}"
206
335
def cleanup(self):
207
336
"""Derived from the Avahi example code"""
208
337
if self.group is not None:
340
except (dbus.exceptions.UnknownMethodException,
341
dbus.exceptions.DBusException):
210
343
self.group = None
211
def server_state_changed(self, state):
346
def server_state_changed(self, state, error=None):
212
347
"""Derived from the Avahi example code"""
213
if state == avahi.SERVER_COLLISION:
214
logger.error(u"Zeroconf server name collision")
348
logger.debug("Avahi server state change: %i", state)
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
356
if state in bad_states:
357
if bad_states[state] is not None:
359
logger.error(bad_states[state])
361
logger.error(bad_states[state] + ": %r", error)
216
363
elif state == avahi.SERVER_RUNNING:
367
logger.debug("Unknown state: %r", state)
369
logger.debug("Unknown state: %r: %r", state, error)
218
371
def activate(self):
219
372
"""Derived from the Avahi example code"""
220
373
if self.server is None:
221
374
self.server = dbus.Interface(
222
375
self.bus.get_object(avahi.DBUS_NAME,
223
avahi.DBUS_PATH_SERVER),
376
avahi.DBUS_PATH_SERVER,
377
follow_name_owner_changes=True),
224
378
avahi.DBUS_INTERFACE_SERVER)
225
self.server.connect_to_signal(u"StateChanged",
379
self.server.connect_to_signal("StateChanged",
226
380
self.server_state_changed)
227
381
self.server_state_changed(self.server.GetState())
384
class AvahiServiceToSyslog(AvahiService):
386
"""Add the new name to the syslog messages"""
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
230
402
class Client(object):
231
403
"""A representation of a client host served by this server.
234
name: string; from the config file, used in log messages and
236
fingerprint: string (40 or 32 hexadecimal digits); used to
237
uniquely identify the client
238
secret: bytestring; sent verbatim (over TLS) to client
239
host: string; available for use by the checker command
240
created: datetime.datetime(); (UTC) object creation
241
last_enabled: datetime.datetime(); (UTC)
243
last_checked_ok: datetime.datetime(); (UTC) or None
244
timeout: datetime.timedelta(); How long from last_checked_ok
245
until this client is invalid
246
interval: datetime.timedelta(); How often to start a new checker
247
disable_hook: If set, called by disable() as disable_hook(self)
406
approved: bool(); 'None' if not yet approved/disapproved
407
approval_delay: datetime.timedelta(); Time to wait for approval
408
approval_duration: datetime.timedelta(); Duration of one approval
248
409
checker: subprocess.Popen(); a running checker process used
249
410
to see if the client lives.
250
411
'None' if no process is running.
251
checker_initiator_tag: a gobject event source tag, or None
252
disable_initiator_tag: - '' -
253
checker_callback_tag: - '' -
254
checker_command: string; External command which is run to check if
255
client lives. %() expansions are done at
412
checker_callback_tag: a gobject event source tag, or None
413
checker_command: string; External command which is run to check
414
if client lives. %() expansions are done at
256
415
runtime with vars(self) as dict, so that for
257
416
instance %(name)s can be used in the command.
417
checker_initiator_tag: a gobject event source tag, or None
418
created: datetime.datetime(); (UTC) object creation
419
client_structure: Object describing what attributes a client has
420
and is used for storing the client at exit
258
421
current_checker_command: string; current running checker_command
422
disable_initiator_tag: a gobject event source tag, or None
424
fingerprint: string (40 or 32 hexadecimal digits); used to
425
uniquely identify the client
426
host: string; available for use by the checker command
427
interval: datetime.timedelta(); How often to start a new checker
428
last_approval_request: datetime.datetime(); (UTC) or None
429
last_checked_ok: datetime.datetime(); (UTC) or None
430
last_checker_status: integer between 0 and 255 reflecting exit
431
status of last checker. -1 reflects crashed
432
checker, -2 means no checker completed yet.
433
last_enabled: datetime.datetime(); (UTC) or None
434
name: string; from the config file, used in log messages and
436
secret: bytestring; sent verbatim (over TLS) to client
437
timeout: datetime.timedelta(); How long from last_checked_ok
438
until this client is disabled
439
extended_timeout: extra long timeout when secret has been sent
440
runtime_expansions: Allowed attributes for runtime expansion.
441
expires: datetime.datetime(); time (UTC) when a client will be
262
def _timedelta_to_milliseconds(td):
263
"Convert a datetime.timedelta() to milliseconds"
264
return ((td.days * 24 * 60 * 60 * 1000)
265
+ (td.seconds * 1000)
266
+ (td.microseconds // 1000))
445
runtime_expansions = ("approval_delay", "approval_duration",
446
"created", "enabled", "expires",
447
"fingerprint", "host", "interval",
448
"last_approval_request", "last_checked_ok",
449
"last_enabled", "name", "timeout")
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
453
"checker": "fping -q -- %%(host)s",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
268
461
def timeout_milliseconds(self):
269
462
"Return the 'timeout' attribute in milliseconds"
270
return self._timedelta_to_milliseconds(self.timeout)
463
return timedelta_to_milliseconds(self.timeout)
465
def extended_timeout_milliseconds(self):
466
"Return the 'extended_timeout' attribute in milliseconds"
467
return timedelta_to_milliseconds(self.extended_timeout)
272
469
def interval_milliseconds(self):
273
470
"Return the 'interval' attribute in milliseconds"
274
return self._timedelta_to_milliseconds(self.interval)
276
def __init__(self, name = None, disable_hook=None, config=None):
277
"""Note: the 'checker' key in 'config' sets the
278
'checker_command' attribute and *not* the 'checker'
471
return timedelta_to_milliseconds(self.interval)
473
def approval_delay_milliseconds(self):
474
return timedelta_to_milliseconds(self.approval_delay)
477
def config_parser(config):
478
"""Construct a new dict of client settings of this form:
479
{ client_name: {setting_name: value, ...}, ...}
480
with exceptions for any special settings as defined above.
481
NOTE: Must be a pure function. Must return the same result
482
value given the same arguments.
485
for client_name in config.sections():
486
section = dict(config.items(client_name))
487
client = settings[client_name] = {}
489
client["host"] = section["host"]
490
# Reformat values from string types to Python types
491
client["approved_by_default"] = config.getboolean(
492
client_name, "approved_by_default")
493
client["enabled"] = config.getboolean(client_name,
496
client["fingerprint"] = (section["fingerprint"].upper()
498
if "secret" in section:
499
client["secret"] = section["secret"].decode("base64")
500
elif "secfile" in section:
501
with open(os.path.expanduser(os.path.expandvars
502
(section["secfile"])),
504
client["secret"] = secfile.read()
506
raise TypeError("No secret or secfile for section {0}"
508
client["timeout"] = string_to_delta(section["timeout"])
509
client["extended_timeout"] = string_to_delta(
510
section["extended_timeout"])
511
client["interval"] = string_to_delta(section["interval"])
512
client["approval_delay"] = string_to_delta(
513
section["approval_delay"])
514
client["approval_duration"] = string_to_delta(
515
section["approval_duration"])
516
client["checker_command"] = section["checker"]
517
client["last_approval_request"] = None
518
client["last_checked_ok"] = None
519
client["last_checker_status"] = -2
523
def __init__(self, settings, name = None):
283
logger.debug(u"Creating client %r", self.name)
525
# adding all client settings
526
for setting, value in settings.iteritems():
527
setattr(self, setting, value)
530
if not hasattr(self, "last_enabled"):
531
self.last_enabled = datetime.datetime.utcnow()
532
if not hasattr(self, "expires"):
533
self.expires = (datetime.datetime.utcnow()
536
self.last_enabled = None
539
logger.debug("Creating client %r", self.name)
284
540
# Uppercase and remove spaces from fingerprint for later
285
541
# comparison purposes with return value from the fingerprint()
287
self.fingerprint = (config[u"fingerprint"].upper()
289
logger.debug(u" Fingerprint: %s", self.fingerprint)
290
if u"secret" in config:
291
self.secret = config[u"secret"].decode(u"base64")
292
elif u"secfile" in config:
293
with closing(open(os.path.expanduser
295
(config[u"secfile"])),
297
self.secret = secfile.read()
299
raise TypeError(u"No secret or secfile for client %s"
301
self.host = config.get(u"host", u"")
302
self.created = datetime.datetime.utcnow()
304
self.last_enabled = None
305
self.last_checked_ok = None
306
self.timeout = string_to_delta(config[u"timeout"])
307
self.interval = string_to_delta(config[u"interval"])
308
self.disable_hook = disable_hook
543
logger.debug(" Fingerprint: %s", self.fingerprint)
544
self.created = settings.get("created",
545
datetime.datetime.utcnow())
547
# attributes specific for this server instance
309
548
self.checker = None
310
549
self.checker_initiator_tag = None
311
550
self.disable_initiator_tag = None
312
551
self.checker_callback_tag = None
313
self.checker_command = config[u"checker"]
314
552
self.current_checker_command = None
315
self.last_connect = None
554
self.approvals_pending = 0
555
self.changedstate = (multiprocessing_manager
556
.Condition(multiprocessing_manager
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
560
if not attr.startswith("_")]
561
self.client_structure.append("client_structure")
563
for name, t in inspect.getmembers(type(self),
567
if not name.startswith("_"):
568
self.client_structure.append(name)
570
# Send notice to process children that client state has changed
571
def send_changedstate(self):
572
with self.changedstate:
573
self.changedstate.notify_all()
317
575
def enable(self):
318
576
"""Start this client's checker and timeout hooks"""
319
if getattr(self, u"enabled", False):
577
if getattr(self, "enabled", False):
320
578
# Already enabled
580
self.expires = datetime.datetime.utcnow() + self.timeout
322
582
self.last_enabled = datetime.datetime.utcnow()
584
self.send_changedstate()
586
def disable(self, quiet=True):
587
"""Disable this client."""
588
if not getattr(self, "enabled", False):
591
logger.info("Disabling client %s", self.name)
592
if getattr(self, "disable_initiator_tag", None) is not None:
593
gobject.source_remove(self.disable_initiator_tag)
594
self.disable_initiator_tag = None
596
if getattr(self, "checker_initiator_tag", None) is not None:
597
gobject.source_remove(self.checker_initiator_tag)
598
self.checker_initiator_tag = None
602
self.send_changedstate()
603
# Do not run this again if called by a gobject.timeout_add
609
def init_checker(self):
323
610
# Schedule a new checker to be started an 'interval' from now,
324
611
# and every interval from then on.
612
if self.checker_initiator_tag is not None:
613
gobject.source_remove(self.checker_initiator_tag)
325
614
self.checker_initiator_tag = (gobject.timeout_add
326
615
(self.interval_milliseconds(),
327
616
self.start_checker))
328
617
# Schedule a disable() when 'timeout' has passed
618
if self.disable_initiator_tag is not None:
619
gobject.source_remove(self.disable_initiator_tag)
329
620
self.disable_initiator_tag = (gobject.timeout_add
330
621
(self.timeout_milliseconds(),
333
623
# Also start a new checker *right now*.
334
624
self.start_checker()
336
def disable(self, log=True):
337
"""Disable this client."""
338
if not getattr(self, "enabled", False):
341
logger.info(u"Disabling client %s", self.name)
342
if getattr(self, u"disable_initiator_tag", False):
343
gobject.source_remove(self.disable_initiator_tag)
344
self.disable_initiator_tag = None
345
if getattr(self, u"checker_initiator_tag", False):
346
gobject.source_remove(self.checker_initiator_tag)
347
self.checker_initiator_tag = None
349
if self.disable_hook:
350
self.disable_hook(self)
352
# Do not run this again if called by a gobject.timeout_add
356
self.disable_hook = None
359
626
def checker_callback(self, pid, condition, command):
360
627
"""The checker has completed, so take appropriate actions."""
361
628
self.checker_callback_tag = None
362
629
self.checker = None
363
630
if os.WIFEXITED(condition):
364
exitstatus = os.WEXITSTATUS(condition)
366
logger.info(u"Checker for %(name)s succeeded",
631
self.last_checker_status = os.WEXITSTATUS(condition)
632
if self.last_checker_status == 0:
633
logger.info("Checker for %(name)s succeeded",
368
635
self.checked_ok()
370
logger.info(u"Checker for %(name)s failed",
637
logger.info("Checker for %(name)s failed",
373
logger.warning(u"Checker for %(name)s crashed?",
640
self.last_checker_status = -1
641
logger.warning("Checker for %(name)s crashed?",
376
644
def checked_ok(self):
377
"""Bump up the timeout for this client.
379
This should only be called when the client has been seen,
645
"""Assert that the client has been seen, alive and well."""
382
646
self.last_checked_ok = datetime.datetime.utcnow()
383
gobject.source_remove(self.disable_initiator_tag)
384
self.disable_initiator_tag = (gobject.timeout_add
385
(self.timeout_milliseconds(),
647
self.last_checker_status = 0
650
def bump_timeout(self, timeout=None):
651
"""Bump up the timeout for this client."""
653
timeout = self.timeout
654
if self.disable_initiator_tag is not None:
655
gobject.source_remove(self.disable_initiator_tag)
656
self.disable_initiator_tag = None
657
if getattr(self, "enabled", False):
658
self.disable_initiator_tag = (gobject.timeout_add
659
(timedelta_to_milliseconds
660
(timeout), self.disable))
661
self.expires = datetime.datetime.utcnow() + timeout
663
def need_approval(self):
664
self.last_approval_request = datetime.datetime.utcnow()
388
666
def start_checker(self):
389
667
"""Start a new checker subprocess if one is not running.
534
847
class DBusObjectWithProperties(dbus.service.Object):
535
848
"""A D-Bus object with properties.
537
850
Classes inheriting from this can use the dbus_service_property
538
851
decorator to expose methods as D-Bus properties. It exposes the
539
852
standard Get(), Set(), and GetAll() methods on the D-Bus.
543
def _is_dbus_property(obj):
544
return getattr(obj, u"_dbus_is_property", False)
856
def _is_dbus_thing(thing):
857
"""Returns a function testing if an attribute is a D-Bus thing
859
If called like _is_dbus_thing("method") it returns a function
860
suitable for use as predicate to inspect.getmembers().
862
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
546
def _get_all_dbus_properties(self):
865
def _get_all_dbus_things(self, thing):
547
866
"""Returns a generator of (name, attribute) pairs
549
return ((prop._dbus_name, prop)
551
inspect.getmembers(self, self._is_dbus_property))
868
return ((getattr(athing.__get__(self), "_dbus_name",
870
athing.__get__(self))
871
for cls in self.__class__.__mro__
873
inspect.getmembers(cls,
874
self._is_dbus_thing(thing)))
553
876
def _get_dbus_property(self, interface_name, property_name):
554
877
"""Returns a bound method if one exists which is a D-Bus
555
878
property with the specified name and interface.
557
for name in (property_name,
558
property_name + u"_dbus_property"):
559
prop = getattr(self, name, None)
561
or not self._is_dbus_property(prop)
562
or prop._dbus_name != property_name
563
or (interface_name and prop._dbus_interface
564
and interface_name != prop._dbus_interface)):
880
for cls in self.__class__.__mro__:
881
for name, value in (inspect.getmembers
883
self._is_dbus_thing("property"))):
884
if (value._dbus_name == property_name
885
and value._dbus_interface == interface_name):
886
return value.__get__(self)
567
888
# No such property
568
raise DBusPropertyNotFound(self.dbus_object_path + u":"
569
+ interface_name + u"."
889
raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
+ interface_name + "."
572
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
893
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
574
895
def Get(self, interface_name, property_name):
575
896
"""Standard D-Bus property Get() method, see D-Bus standard.
577
898
prop = self._get_dbus_property(interface_name, property_name)
578
if prop._dbus_access == u"write":
899
if prop._dbus_access == "write":
579
900
raise DBusPropertyAccessException(property_name)
581
if not hasattr(value, u"variant_level"):
902
if not hasattr(value, "variant_level"):
583
904
return type(value)(value, variant_level=value.variant_level+1)
585
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
906
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
586
907
def Set(self, interface_name, property_name, value):
587
908
"""Standard D-Bus property Set() method, see D-Bus standard.
589
910
prop = self._get_dbus_property(interface_name, property_name)
590
if prop._dbus_access == u"read":
911
if prop._dbus_access == "read":
591
912
raise DBusPropertyAccessException(property_name)
592
if prop._dbus_get_args_options[u"byte_arrays"]:
593
value = dbus.ByteArray(''.join(unichr(byte)
913
if prop._dbus_get_args_options["byte_arrays"]:
914
# The byte_arrays option is not supported yet on
915
# signatures other than "ay".
916
if prop._dbus_signature != "ay":
918
value = dbus.ByteArray(b''.join(chr(byte)
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
598
out_signature=u"a{sv}")
922
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
923
out_signature="a{sv}")
599
924
def GetAll(self, interface_name):
600
925
"""Standard D-Bus property GetAll() method, see D-Bus
603
928
Note: Will not include properties with access="write".
606
for name, prop in self._get_all_dbus_properties():
931
for name, prop in self._get_all_dbus_things("property"):
607
932
if (interface_name
608
933
and interface_name != prop._dbus_interface):
609
934
# Interface non-empty but did not match
611
936
# Ignore write-only properties
612
if prop._dbus_access == u"write":
937
if prop._dbus_access == "write":
615
if not hasattr(value, u"variant_level"):
940
if not hasattr(value, "variant_level"):
941
properties[name] = value
618
all[name] = type(value)(value, variant_level=
619
value.variant_level+1)
620
return dbus.Dictionary(all, signature=u"sv")
943
properties[name] = type(value)(value, variant_level=
944
value.variant_level+1)
945
return dbus.Dictionary(properties, signature="sv")
622
947
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
624
949
path_keyword='object_path',
625
950
connection_keyword='connection')
626
951
def Introspect(self, object_path, connection):
627
"""Standard D-Bus method, overloaded to insert property tags.
952
"""Overloading of standard D-Bus method.
954
Inserts property tags and interface annotation tags.
629
956
xmlstring = dbus.service.Object.Introspect(self, object_path,
632
959
document = xml.dom.minidom.parseString(xmlstring)
633
960
def make_tag(document, name, prop):
634
e = document.createElement(u"property")
635
e.setAttribute(u"name", name)
636
e.setAttribute(u"type", prop._dbus_signature)
637
e.setAttribute(u"access", prop._dbus_access)
961
e = document.createElement("property")
962
e.setAttribute("name", name)
963
e.setAttribute("type", prop._dbus_signature)
964
e.setAttribute("access", prop._dbus_access)
639
for if_tag in document.getElementsByTagName(u"interface"):
966
for if_tag in document.getElementsByTagName("interface"):
640
968
for tag in (make_tag(document, name, prop)
642
in self._get_all_dbus_properties()
970
in self._get_all_dbus_things("property")
643
971
if prop._dbus_interface
644
== if_tag.getAttribute(u"name")):
972
== if_tag.getAttribute("name")):
645
973
if_tag.appendChild(tag)
974
# Add annotation tags
975
for typ in ("method", "signal", "property"):
976
for tag in if_tag.getElementsByTagName(typ):
978
for name, prop in (self.
979
_get_all_dbus_things(typ)):
980
if (name == tag.getAttribute("name")
981
and prop._dbus_interface
982
== if_tag.getAttribute("name")):
983
annots.update(getattr
987
for name, value in annots.iteritems():
988
ann_tag = document.createElement(
990
ann_tag.setAttribute("name", name)
991
ann_tag.setAttribute("value", value)
992
tag.appendChild(ann_tag)
993
# Add interface annotation tags
994
for annotation, value in dict(
995
itertools.chain.from_iterable(
996
annotations().iteritems()
997
for name, annotations in
998
self._get_all_dbus_things("interface")
999
if name == if_tag.getAttribute("name")
1001
ann_tag = document.createElement("annotation")
1002
ann_tag.setAttribute("name", annotation)
1003
ann_tag.setAttribute("value", value)
1004
if_tag.appendChild(ann_tag)
646
1005
# Add the names to the return values for the
647
1006
# "org.freedesktop.DBus.Properties" methods
648
if (if_tag.getAttribute(u"name")
649
== u"org.freedesktop.DBus.Properties"):
650
for cn in if_tag.getElementsByTagName(u"method"):
651
if cn.getAttribute(u"name") == u"Get":
652
for arg in cn.getElementsByTagName(u"arg"):
653
if (arg.getAttribute(u"direction")
655
arg.setAttribute(u"name", u"value")
656
elif cn.getAttribute(u"name") == u"GetAll":
657
for arg in cn.getElementsByTagName(u"arg"):
658
if (arg.getAttribute(u"direction")
660
arg.setAttribute(u"name", u"props")
661
xmlstring = document.toxml(u"utf-8")
1007
if (if_tag.getAttribute("name")
1008
== "org.freedesktop.DBus.Properties"):
1009
for cn in if_tag.getElementsByTagName("method"):
1010
if cn.getAttribute("name") == "Get":
1011
for arg in cn.getElementsByTagName("arg"):
1012
if (arg.getAttribute("direction")
1014
arg.setAttribute("name", "value")
1015
elif cn.getAttribute("name") == "GetAll":
1016
for arg in cn.getElementsByTagName("arg"):
1017
if (arg.getAttribute("direction")
1019
arg.setAttribute("name", "props")
1020
xmlstring = document.toxml("utf-8")
662
1021
document.unlink()
663
1022
except (AttributeError, xml.dom.DOMException,
664
xml.parsers.expat.ExpatError), error:
665
logger.error(u"Failed to override Introspection method",
1023
xml.parsers.expat.ExpatError) as error:
1024
logger.error("Failed to override Introspection method",
667
1026
return xmlstring
1029
def datetime_to_dbus(dt, variant_level=0):
1030
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1032
return dbus.String("", variant_level = variant_level)
1033
return dbus.String(dt.isoformat(),
1034
variant_level=variant_level)
1037
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1038
"""A class decorator; applied to a subclass of
1039
dbus.service.Object, it will add alternate D-Bus attributes with
1040
interface names according to the "alt_interface_names" mapping.
1043
@alternate_dbus_interfaces({"org.example.Interface":
1044
"net.example.AlternateInterface"})
1045
class SampleDBusObject(dbus.service.Object):
1046
@dbus.service.method("org.example.Interface")
1047
def SampleDBusMethod():
1050
The above "SampleDBusMethod" on "SampleDBusObject" will be
1051
reachable via two interfaces: "org.example.Interface" and
1052
"net.example.AlternateInterface", the latter of which will have
1053
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1054
"true", unless "deprecate" is passed with a False value.
1056
This works for methods and signals, and also for D-Bus properties
1057
(from DBusObjectWithProperties) and interfaces (from the
1058
dbus_interface_annotations decorator).
1061
for orig_interface_name, alt_interface_name in (
1062
alt_interface_names.iteritems()):
1064
interface_names = set()
1065
# Go though all attributes of the class
1066
for attrname, attribute in inspect.getmembers(cls):
1067
# Ignore non-D-Bus attributes, and D-Bus attributes
1068
# with the wrong interface name
1069
if (not hasattr(attribute, "_dbus_interface")
1070
or not attribute._dbus_interface
1071
.startswith(orig_interface_name)):
1073
# Create an alternate D-Bus interface name based on
1075
alt_interface = (attribute._dbus_interface
1076
.replace(orig_interface_name,
1077
alt_interface_name))
1078
interface_names.add(alt_interface)
1079
# Is this a D-Bus signal?
1080
if getattr(attribute, "_dbus_is_signal", False):
1081
# Extract the original non-method function by
1083
nonmethod_func = (dict(
1084
zip(attribute.func_code.co_freevars,
1085
attribute.__closure__))["func"]
1087
# Create a new, but exactly alike, function
1088
# object, and decorate it to be a new D-Bus signal
1089
# with the alternate D-Bus interface name
1090
new_function = (dbus.service.signal
1092
attribute._dbus_signature)
1093
(types.FunctionType(
1094
nonmethod_func.func_code,
1095
nonmethod_func.func_globals,
1096
nonmethod_func.func_name,
1097
nonmethod_func.func_defaults,
1098
nonmethod_func.func_closure)))
1099
# Copy annotations, if any
1101
new_function._dbus_annotations = (
1102
dict(attribute._dbus_annotations))
1103
except AttributeError:
1105
# Define a creator of a function to call both the
1106
# original and alternate functions, so both the
1107
# original and alternate signals gets sent when
1108
# the function is called
1109
def fixscope(func1, func2):
1110
"""This function is a scope container to pass
1111
func1 and func2 to the "call_both" function
1112
outside of its arguments"""
1113
def call_both(*args, **kwargs):
1114
"""This function will emit two D-Bus
1115
signals by calling func1 and func2"""
1116
func1(*args, **kwargs)
1117
func2(*args, **kwargs)
1119
# Create the "call_both" function and add it to
1121
attr[attrname] = fixscope(attribute, new_function)
1122
# Is this a D-Bus method?
1123
elif getattr(attribute, "_dbus_is_method", False):
1124
# Create a new, but exactly alike, function
1125
# object. Decorate it to be a new D-Bus method
1126
# with the alternate D-Bus interface name. Add it
1128
attr[attrname] = (dbus.service.method
1130
attribute._dbus_in_signature,
1131
attribute._dbus_out_signature)
1133
(attribute.func_code,
1134
attribute.func_globals,
1135
attribute.func_name,
1136
attribute.func_defaults,
1137
attribute.func_closure)))
1138
# Copy annotations, if any
1140
attr[attrname]._dbus_annotations = (
1141
dict(attribute._dbus_annotations))
1142
except AttributeError:
1144
# Is this a D-Bus property?
1145
elif getattr(attribute, "_dbus_is_property", False):
1146
# Create a new, but exactly alike, function
1147
# object, and decorate it to be a new D-Bus
1148
# property with the alternate D-Bus interface
1149
# name. Add it to the class.
1150
attr[attrname] = (dbus_service_property
1152
attribute._dbus_signature,
1153
attribute._dbus_access,
1155
._dbus_get_args_options
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1163
# Copy annotations, if any
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1167
except AttributeError:
1169
# Is this a D-Bus interface?
1170
elif getattr(attribute, "_dbus_is_interface", False):
1171
# Create a new, but exactly alike, function
1172
# object. Decorate it to be a new D-Bus interface
1173
# with the alternate D-Bus interface name. Add it
1175
attr[attrname] = (dbus_interface_annotations
1178
(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1184
# Deprecate all alternate interfaces
1185
iname="_AlternateDBusNames_interface_annotation{0}"
1186
for interface_name in interface_names:
1187
@dbus_interface_annotations(interface_name)
1189
return { "org.freedesktop.DBus.Deprecated":
1191
# Find an unused name
1192
for aname in (iname.format(i)
1193
for i in itertools.count()):
1194
if aname not in attr:
1198
# Replace the class with a new subclass of it with
1199
# methods, signals, etc. as created above.
1200
cls = type(b"{0}Alternate".format(cls.__name__),
1206
@alternate_dbus_interfaces({"se.recompile.Mandos":
1207
"se.bsnet.fukt.Mandos"})
670
1208
class ClientDBus(Client, DBusObjectWithProperties):
671
1209
"""A Client class using D-Bus
681
1223
Client.__init__(self, *args, **kwargs)
682
1224
# Only now, when this client is initialized, can it show up on
1226
client_object_name = unicode(self.name).translate(
1227
{ord("."): ord("_"),
1228
ord("-"): ord("_")})
684
1229
self.dbus_object_path = (dbus.ObjectPath
686
+ self.name.replace(u".", u"_")))
1230
("/clients/" + client_object_name))
687
1231
DBusObjectWithProperties.__init__(self, self.bus,
688
1232
self.dbus_object_path)
691
def _datetime_to_dbus(dt, variant_level=0):
692
"""Convert a UTC datetime.datetime() to a D-Bus type."""
693
return dbus.String(dt.isoformat(),
694
variant_level=variant_level)
697
oldstate = getattr(self, u"enabled", False)
698
r = Client.enable(self)
699
if oldstate != self.enabled:
701
self.PropertyChanged(dbus.String(u"enabled"),
702
dbus.Boolean(True, variant_level=1))
703
self.PropertyChanged(
704
dbus.String(u"last_enabled"),
705
self._datetime_to_dbus(self.last_enabled,
709
def disable(self, signal = True):
710
oldstate = getattr(self, u"enabled", False)
711
r = Client.disable(self, log=signal)
712
if signal and oldstate != self.enabled:
714
self.PropertyChanged(dbus.String(u"enabled"),
715
dbus.Boolean(False, variant_level=1))
1234
def notifychangeproperty(transform_func,
1235
dbus_name, type_func=lambda x: x,
1237
""" Modify a variable so that it's a property which announces
1238
its changes to DBus.
1240
transform_fun: Function that takes a value and a variant_level
1241
and transforms it to a D-Bus type.
1242
dbus_name: D-Bus name of the variable
1243
type_func: Function that transform the value before sending it
1244
to the D-Bus. Default: no transform
1245
variant_level: D-Bus variant level. Default: 1
1247
attrname = "_{0}".format(dbus_name)
1248
def setter(self, value):
1249
if hasattr(self, "dbus_object_path"):
1250
if (not hasattr(self, attrname) or
1251
type_func(getattr(self, attrname, None))
1252
!= type_func(value)):
1253
dbus_value = transform_func(type_func(value),
1256
self.PropertyChanged(dbus.String(dbus_name),
1258
setattr(self, attrname, value)
1260
return property(lambda self: getattr(self, attrname), setter)
1262
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1263
approvals_pending = notifychangeproperty(dbus.Boolean,
1266
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1267
last_enabled = notifychangeproperty(datetime_to_dbus,
1269
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1270
type_func = lambda checker:
1271
checker is not None)
1272
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1274
last_checker_status = notifychangeproperty(dbus.Int16,
1275
"LastCheckerStatus")
1276
last_approval_request = notifychangeproperty(
1277
datetime_to_dbus, "LastApprovalRequest")
1278
approved_by_default = notifychangeproperty(dbus.Boolean,
1279
"ApprovedByDefault")
1280
approval_delay = notifychangeproperty(dbus.UInt64,
1283
timedelta_to_milliseconds)
1284
approval_duration = notifychangeproperty(
1285
dbus.UInt64, "ApprovalDuration",
1286
type_func = timedelta_to_milliseconds)
1287
host = notifychangeproperty(dbus.String, "Host")
1288
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1290
timedelta_to_milliseconds)
1291
extended_timeout = notifychangeproperty(
1292
dbus.UInt64, "ExtendedTimeout",
1293
type_func = timedelta_to_milliseconds)
1294
interval = notifychangeproperty(dbus.UInt64,
1297
timedelta_to_milliseconds)
1298
checker_command = notifychangeproperty(dbus.String, "Checker")
1300
del notifychangeproperty
718
1302
def __del__(self, *args, **kwargs):
720
1304
self.remove_from_connection()
721
1305
except LookupError:
723
if hasattr(DBusObjectWithProperties, u"__del__"):
1307
if hasattr(DBusObjectWithProperties, "__del__"):
724
1308
DBusObjectWithProperties.__del__(self, *args, **kwargs)
725
1309
Client.__del__(self, *args, **kwargs)
842
1438
def StopChecker(self):
843
1439
self.stop_checker()
846
@dbus_service_property(_interface, signature=u"s", access=u"read")
847
def name_dbus_property(self):
1443
# ApprovalPending - property
1444
@dbus_service_property(_interface, signature="b", access="read")
1445
def ApprovalPending_dbus_property(self):
1446
return dbus.Boolean(bool(self.approvals_pending))
1448
# ApprovedByDefault - property
1449
@dbus_service_property(_interface, signature="b",
1451
def ApprovedByDefault_dbus_property(self, value=None):
1452
if value is None: # get
1453
return dbus.Boolean(self.approved_by_default)
1454
self.approved_by_default = bool(value)
1456
# ApprovalDelay - property
1457
@dbus_service_property(_interface, signature="t",
1459
def ApprovalDelay_dbus_property(self, value=None):
1460
if value is None: # get
1461
return dbus.UInt64(self.approval_delay_milliseconds())
1462
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1464
# ApprovalDuration - property
1465
@dbus_service_property(_interface, signature="t",
1467
def ApprovalDuration_dbus_property(self, value=None):
1468
if value is None: # get
1469
return dbus.UInt64(timedelta_to_milliseconds(
1470
self.approval_duration))
1471
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1474
@dbus_service_property(_interface, signature="s", access="read")
1475
def Name_dbus_property(self):
848
1476
return dbus.String(self.name)
850
# fingerprint - property
851
@dbus_service_property(_interface, signature=u"s", access=u"read")
852
def fingerprint_dbus_property(self):
1478
# Fingerprint - property
1479
@dbus_service_property(_interface, signature="s", access="read")
1480
def Fingerprint_dbus_property(self):
853
1481
return dbus.String(self.fingerprint)
856
@dbus_service_property(_interface, signature=u"s",
858
def host_dbus_property(self, value=None):
1484
@dbus_service_property(_interface, signature="s",
1486
def Host_dbus_property(self, value=None):
859
1487
if value is None: # get
860
1488
return dbus.String(self.host)
863
self.PropertyChanged(dbus.String(u"host"),
864
dbus.String(value, variant_level=1))
867
@dbus_service_property(_interface, signature=u"s", access=u"read")
868
def created_dbus_property(self):
869
return dbus.String(self._datetime_to_dbus(self.created))
871
# last_enabled - property
872
@dbus_service_property(_interface, signature=u"s", access=u"read")
873
def last_enabled_dbus_property(self):
874
if self.last_enabled is None:
875
return dbus.String(u"")
876
return dbus.String(self._datetime_to_dbus(self.last_enabled))
879
@dbus_service_property(_interface, signature=u"b",
881
def enabled_dbus_property(self, value=None):
1489
self.host = unicode(value)
1491
# Created - property
1492
@dbus_service_property(_interface, signature="s", access="read")
1493
def Created_dbus_property(self):
1494
return datetime_to_dbus(self.created)
1496
# LastEnabled - property
1497
@dbus_service_property(_interface, signature="s", access="read")
1498
def LastEnabled_dbus_property(self):
1499
return datetime_to_dbus(self.last_enabled)
1501
# Enabled - property
1502
@dbus_service_property(_interface, signature="b",
1504
def Enabled_dbus_property(self, value=None):
882
1505
if value is None: # get
883
1506
return dbus.Boolean(self.enabled)
889
# last_checked_ok - property
890
@dbus_service_property(_interface, signature=u"s",
892
def last_checked_ok_dbus_property(self, value=None):
1512
# LastCheckedOK - property
1513
@dbus_service_property(_interface, signature="s",
1515
def LastCheckedOK_dbus_property(self, value=None):
893
1516
if value is not None:
894
1517
self.checked_ok()
896
if self.last_checked_ok is None:
897
return dbus.String(u"")
898
return dbus.String(self._datetime_to_dbus(self
902
@dbus_service_property(_interface, signature=u"t",
904
def timeout_dbus_property(self, value=None):
1519
return datetime_to_dbus(self.last_checked_ok)
1521
# LastCheckerStatus - property
1522
@dbus_service_property(_interface, signature="n",
1524
def LastCheckerStatus_dbus_property(self):
1525
return dbus.Int16(self.last_checker_status)
1527
# Expires - property
1528
@dbus_service_property(_interface, signature="s", access="read")
1529
def Expires_dbus_property(self):
1530
return datetime_to_dbus(self.expires)
1532
# LastApprovalRequest - property
1533
@dbus_service_property(_interface, signature="s", access="read")
1534
def LastApprovalRequest_dbus_property(self):
1535
return datetime_to_dbus(self.last_approval_request)
1537
# Timeout - property
1538
@dbus_service_property(_interface, signature="t",
1540
def Timeout_dbus_property(self, value=None):
905
1541
if value is None: # get
906
1542
return dbus.UInt64(self.timeout_milliseconds())
1543
old_timeout = self.timeout
907
1544
self.timeout = datetime.timedelta(0, 0, 0, value)
909
self.PropertyChanged(dbus.String(u"timeout"),
910
dbus.UInt64(value, variant_level=1))
911
if getattr(self, u"disable_initiator_tag", None) is None:
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = None
917
_timedelta_to_milliseconds((self
923
# The timeout has passed
926
self.disable_initiator_tag = (gobject.timeout_add
927
(time_to_die, self.disable))
929
# interval - property
930
@dbus_service_property(_interface, signature=u"t",
932
def interval_dbus_property(self, value=None):
1545
# Reschedule disabling
1547
now = datetime.datetime.utcnow()
1548
self.expires += self.timeout - old_timeout
1549
if self.expires <= now:
1550
# The timeout has passed
1553
if (getattr(self, "disable_initiator_tag", None)
1556
gobject.source_remove(self.disable_initiator_tag)
1557
self.disable_initiator_tag = (
1558
gobject.timeout_add(
1559
timedelta_to_milliseconds(self.expires - now),
1562
# ExtendedTimeout - property
1563
@dbus_service_property(_interface, signature="t",
1565
def ExtendedTimeout_dbus_property(self, value=None):
1566
if value is None: # get
1567
return dbus.UInt64(self.extended_timeout_milliseconds())
1568
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1570
# Interval - property
1571
@dbus_service_property(_interface, signature="t",
1573
def Interval_dbus_property(self, value=None):
933
1574
if value is None: # get
934
1575
return dbus.UInt64(self.interval_milliseconds())
935
1576
self.interval = datetime.timedelta(0, 0, 0, value)
937
self.PropertyChanged(dbus.String(u"interval"),
938
dbus.UInt64(value, variant_level=1))
939
if getattr(self, u"checker_initiator_tag", None) is None:
1577
if getattr(self, "checker_initiator_tag", None) is None:
941
# Reschedule checker run
942
gobject.source_remove(self.checker_initiator_tag)
943
self.checker_initiator_tag = (gobject.timeout_add
944
(value, self.start_checker))
945
self.start_checker() # Start one now, too
948
@dbus_service_property(_interface, signature=u"s",
950
def checker_dbus_property(self, value=None):
1580
# Reschedule checker run
1581
gobject.source_remove(self.checker_initiator_tag)
1582
self.checker_initiator_tag = (gobject.timeout_add
1583
(value, self.start_checker))
1584
self.start_checker() # Start one now, too
1586
# Checker - property
1587
@dbus_service_property(_interface, signature="s",
1589
def Checker_dbus_property(self, value=None):
951
1590
if value is None: # get
952
1591
return dbus.String(self.checker_command)
953
self.checker_command = value
955
self.PropertyChanged(dbus.String(u"checker"),
956
dbus.String(self.checker_command,
1592
self.checker_command = unicode(value)
959
# checker_running - property
960
@dbus_service_property(_interface, signature=u"b",
962
def checker_running_dbus_property(self, value=None):
1594
# CheckerRunning - property
1595
@dbus_service_property(_interface, signature="b",
1597
def CheckerRunning_dbus_property(self, value=None):
963
1598
if value is None: # get
964
1599
return dbus.Boolean(self.checker is not None)
988
1649
Note: This will run in its own forked process."""
990
1651
def handle(self):
991
logger.info(u"TCP connection from: %s",
992
unicode(self.client_address))
993
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
994
# Open IPC pipe to parent process
995
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1652
with contextlib.closing(self.server.child_pipe) as child_pipe:
1653
logger.info("TCP connection from: %s",
1654
unicode(self.client_address))
1655
logger.debug("Pipe FD: %d",
1656
self.server.child_pipe.fileno())
996
1658
session = (gnutls.connection
997
1659
.ClientSession(self.request,
998
1660
gnutls.connection
999
1661
.X509Credentials()))
1001
line = self.request.makefile().readline()
1002
logger.debug(u"Protocol version: %r", line)
1004
if int(line.strip().split()[0]) > 1:
1006
except (ValueError, IndexError, RuntimeError), error:
1007
logger.error(u"Unknown protocol version: %s", error)
1010
1663
# Note: gnutls.connection.X509Credentials is really a
1011
1664
# generic GnuTLS certificate credentials object so long as
1012
1665
# no X.509 keys are added to it. Therefore, we can use it
1013
1666
# here despite using OpenPGP certificates.
1015
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1016
# u"+AES-256-CBC", u"+SHA1",
1017
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1668
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1669
# "+AES-256-CBC", "+SHA1",
1670
# "+COMP-NULL", "+CTYPE-OPENPGP",
1019
1672
# Use a fallback default, since this MUST be set.
1020
1673
priority = self.server.gnutls_priority
1021
1674
if priority is None:
1022
priority = u"NORMAL"
1023
1676
(gnutls.library.functions
1024
1677
.gnutls_priority_set_direct(session._c_object,
1025
1678
priority, None))
1680
# Start communication using the Mandos protocol
1681
# Get protocol number
1682
line = self.request.makefile().readline()
1683
logger.debug("Protocol version: %r", line)
1685
if int(line.strip().split()[0]) > 1:
1687
except (ValueError, IndexError, RuntimeError) as error:
1688
logger.error("Unknown protocol version: %s", error)
1691
# Start GnuTLS connection
1028
1693
session.handshake()
1029
except gnutls.errors.GNUTLSError, error:
1030
logger.warning(u"Handshake failed: %s", error)
1694
except gnutls.errors.GNUTLSError as error:
1695
logger.warning("Handshake failed: %s", error)
1031
1696
# Do not run session.bye() here: the session is not
1032
1697
# established. Just abandon the request.
1034
logger.debug(u"Handshake succeeded")
1699
logger.debug("Handshake succeeded")
1701
approval_required = False
1036
fpr = self.fingerprint(self.peer_certificate(session))
1037
except (TypeError, gnutls.errors.GNUTLSError), error:
1038
logger.warning(u"Bad certificate: %s", error)
1041
logger.debug(u"Fingerprint: %s", fpr)
1704
fpr = self.fingerprint(self.peer_certificate
1707
gnutls.errors.GNUTLSError) as error:
1708
logger.warning("Bad certificate: %s", error)
1710
logger.debug("Fingerprint: %s", fpr)
1713
client = ProxyClient(child_pipe, fpr,
1714
self.client_address)
1718
if client.approval_delay:
1719
delay = client.approval_delay
1720
client.approvals_pending += 1
1721
approval_required = True
1724
if not client.enabled:
1725
logger.info("Client %s is disabled",
1727
if self.server.use_dbus:
1729
client.Rejected("Disabled")
1732
if client.approved or not client.approval_delay:
1733
#We are approved or approval is disabled
1735
elif client.approved is None:
1736
logger.info("Client %s needs approval",
1738
if self.server.use_dbus:
1740
client.NeedApproval(
1741
client.approval_delay_milliseconds(),
1742
client.approved_by_default)
1744
logger.warning("Client %s was not approved",
1746
if self.server.use_dbus:
1748
client.Rejected("Denied")
1751
#wait until timeout or approved
1752
time = datetime.datetime.now()
1753
client.changedstate.acquire()
1754
client.changedstate.wait(
1755
float(timedelta_to_milliseconds(delay)
1757
client.changedstate.release()
1758
time2 = datetime.datetime.now()
1759
if (time2 - time) >= delay:
1760
if not client.approved_by_default:
1761
logger.warning("Client %s timed out while"
1762
" waiting for approval",
1764
if self.server.use_dbus:
1766
client.Rejected("Approval timed out")
1771
delay -= time2 - time
1774
while sent_size < len(client.secret):
1776
sent = session.send(client.secret[sent_size:])
1777
except gnutls.errors.GNUTLSError as error:
1778
logger.warning("gnutls send failed",
1781
logger.debug("Sent: %d, remaining: %d",
1782
sent, len(client.secret)
1783
- (sent_size + sent))
1786
logger.info("Sending secret to %s", client.name)
1787
# bump the timeout using extended_timeout
1788
client.bump_timeout(client.extended_timeout)
1789
if self.server.use_dbus:
1043
for c in self.server.clients:
1044
if c.fingerprint == fpr:
1048
ipc.write(u"NOTFOUND %s %s\n"
1049
% (fpr, unicode(self.client_address)))
1052
# Have to check if client.still_valid(), since it is
1053
# possible that the client timed out while establishing
1054
# the GnuTLS session.
1055
if not client.still_valid():
1056
ipc.write(u"INVALID %s\n" % client.name)
1059
ipc.write(u"SENDING %s\n" % client.name)
1061
while sent_size < len(client.secret):
1062
sent = session.send(client.secret[sent_size:])
1063
logger.debug(u"Sent: %d, remaining: %d",
1064
sent, len(client.secret)
1065
- (sent_size + sent))
1794
if approval_required:
1795
client.approvals_pending -= 1
1798
except gnutls.errors.GNUTLSError as error:
1799
logger.warning("GnuTLS bye failed",
1070
1803
def peer_certificate(session):
1157
1909
use_ipv6: Boolean; to use IPv6 or not
1159
1911
def __init__(self, server_address, RequestHandlerClass,
1160
interface=None, use_ipv6=True):
1912
interface=None, use_ipv6=True, socketfd=None):
1913
"""If socketfd is set, use that file descriptor instead of
1914
creating a new one with socket.socket().
1161
1916
self.interface = interface
1163
1918
self.address_family = socket.AF_INET6
1919
if socketfd is not None:
1920
# Save the file descriptor
1921
self.socketfd = socketfd
1922
# Save the original socket.socket() function
1923
self.socket_socket = socket.socket
1924
# To implement --socket, we monkey patch socket.socket.
1926
# (When socketserver.TCPServer is a new-style class, we
1927
# could make self.socket into a property instead of monkey
1928
# patching socket.socket.)
1930
# Create a one-time-only replacement for socket.socket()
1931
@functools.wraps(socket.socket)
1932
def socket_wrapper(*args, **kwargs):
1933
# Restore original function so subsequent calls are
1935
socket.socket = self.socket_socket
1936
del self.socket_socket
1937
# This time only, return a new socket object from the
1938
# saved file descriptor.
1939
return socket.fromfd(self.socketfd, *args, **kwargs)
1940
# Replace socket.socket() function with wrapper
1941
socket.socket = socket_wrapper
1942
# The socketserver.TCPServer.__init__ will call
1943
# socket.socket(), which might be our replacement,
1944
# socket_wrapper(), if socketfd was set.
1164
1945
socketserver.TCPServer.__init__(self, server_address,
1165
1946
RequestHandlerClass)
1166
1948
def server_bind(self):
1167
1949
"""This overrides the normal server_bind() function
1168
1950
to bind to an interface if one was specified, and also NOT to
1169
1951
bind to an address or port if they were not specified."""
1170
1952
if self.interface is not None:
1171
1953
if SO_BINDTODEVICE is None:
1172
logger.error(u"SO_BINDTODEVICE does not exist;"
1173
u" cannot bind to interface %s",
1954
logger.error("SO_BINDTODEVICE does not exist;"
1955
" cannot bind to interface %s",
1174
1956
self.interface)
1177
1959
self.socket.setsockopt(socket.SOL_SOCKET,
1178
1960
SO_BINDTODEVICE,
1181
except socket.error, error:
1182
if error[0] == errno.EPERM:
1183
logger.error(u"No permission to"
1184
u" bind to interface %s",
1186
elif error[0] == errno.ENOPROTOOPT:
1187
logger.error(u"SO_BINDTODEVICE not available;"
1188
u" cannot bind to interface %s",
1961
str(self.interface + '\0'))
1962
except socket.error as error:
1963
if error.errno == errno.EPERM:
1964
logger.error("No permission to bind to"
1965
" interface %s", self.interface)
1966
elif error.errno == errno.ENOPROTOOPT:
1967
logger.error("SO_BINDTODEVICE not available;"
1968
" cannot bind to interface %s",
1970
elif error.errno == errno.ENODEV:
1971
logger.error("Interface %s does not exist,"
1972
" cannot bind", self.interface)
1192
1975
# Only bind(2) the socket if we really need to.
1193
1976
if self.server_address[0] or self.server_address[1]:
1194
1977
if not self.server_address[0]:
1195
1978
if self.address_family == socket.AF_INET6:
1196
any_address = u"::" # in6addr_any
1979
any_address = "::" # in6addr_any
1198
1981
any_address = socket.INADDR_ANY
1199
1982
self.server_address = (any_address,
1223
2006
def __init__(self, server_address, RequestHandlerClass,
1224
2007
interface=None, use_ipv6=True, clients=None,
1225
gnutls_priority=None, use_dbus=True):
2008
gnutls_priority=None, use_dbus=True, socketfd=None):
1226
2009
self.enabled = False
1227
2010
self.clients = clients
1228
2011
if self.clients is None:
1229
self.clients = set()
1230
2013
self.use_dbus = use_dbus
1231
2014
self.gnutls_priority = gnutls_priority
1232
2015
IPv6_TCPServer.__init__(self, server_address,
1233
2016
RequestHandlerClass,
1234
2017
interface = interface,
1235
use_ipv6 = use_ipv6)
2018
use_ipv6 = use_ipv6,
2019
socketfd = socketfd)
1236
2020
def server_activate(self):
1237
2021
if self.enabled:
1238
2022
return socketserver.TCPServer.server_activate(self)
1239
2024
def enable(self):
1240
2025
self.enabled = True
1241
def add_pipe(self, pipe):
2027
def add_pipe(self, parent_pipe, proc):
1242
2028
# Call "handle_ipc" for both data and EOF events
1243
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1245
def handle_ipc(self, source, condition, file_objects={}):
1247
gobject.IO_IN: u"IN", # There is data to read.
1248
gobject.IO_OUT: u"OUT", # Data can be written (without
1250
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1251
gobject.IO_ERR: u"ERR", # Error condition.
1252
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1253
# broken, usually for pipes and
1256
conditions_string = ' | '.join(name
1258
condition_names.iteritems()
1259
if cond & condition)
1260
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1263
# Turn the pipe file descriptor into a Python file object
1264
if source not in file_objects:
1265
file_objects[source] = os.fdopen(source, u"r", 1)
1267
# Read a line from the file object
1268
cmdline = file_objects[source].readline()
1269
if not cmdline: # Empty line means end of file
1270
# close the IPC pipe
1271
file_objects[source].close()
1272
del file_objects[source]
1274
# Stop calling this function
1277
logger.debug(u"IPC command: %r", cmdline)
1279
# Parse and act on command
1280
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1282
if cmd == u"NOTFOUND":
1283
logger.warning(u"Client not found for fingerprint: %s",
1287
mandos_dbus_service.ClientNotFound(args)
1288
elif cmd == u"INVALID":
1289
for client in self.clients:
1290
if client.name == args:
1291
logger.warning(u"Client %s is invalid", args)
1297
logger.error(u"Unknown client %s is invalid", args)
1298
elif cmd == u"SENDING":
1299
for client in self.clients:
1300
if client.name == args:
1301
logger.info(u"Sending secret to %s", client.name)
1308
logger.error(u"Sending secret to unknown client %s",
2029
gobject.io_add_watch(parent_pipe.fileno(),
2030
gobject.IO_IN | gobject.IO_HUP,
2031
functools.partial(self.handle_ipc,
2036
def handle_ipc(self, source, condition, parent_pipe=None,
2037
proc = None, client_object=None):
2038
# error, or the other end of multiprocessing.Pipe has closed
2039
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2040
# Wait for other process to exit
2044
# Read a request from the child
2045
request = parent_pipe.recv()
2046
command = request[0]
2048
if command == 'init':
2050
address = request[2]
2052
for c in self.clients.itervalues():
2053
if c.fingerprint == fpr:
2057
logger.info("Client not found for fingerprint: %s, ad"
2058
"dress: %s", fpr, address)
2061
mandos_dbus_service.ClientNotFound(fpr,
2063
parent_pipe.send(False)
2066
gobject.io_add_watch(parent_pipe.fileno(),
2067
gobject.IO_IN | gobject.IO_HUP,
2068
functools.partial(self.handle_ipc,
2074
parent_pipe.send(True)
2075
# remove the old hook in favor of the new above hook on
2078
if command == 'funcall':
2079
funcname = request[1]
2083
parent_pipe.send(('data', getattr(client_object,
2087
if command == 'getattr':
2088
attrname = request[1]
2089
if callable(client_object.__getattribute__(attrname)):
2090
parent_pipe.send(('function',))
2092
parent_pipe.send(('data', client_object
2093
.__getattribute__(attrname)))
2095
if command == 'setattr':
2096
attrname = request[1]
2098
setattr(client_object, attrname, value)
2103
def rfc3339_duration_to_delta(duration):
2104
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2106
>>> rfc3339_duration_to_delta("P7D")
2107
datetime.timedelta(7)
2108
>>> rfc3339_duration_to_delta("PT60S")
2109
datetime.timedelta(0, 60)
2110
>>> rfc3339_duration_to_delta("PT60M")
2111
datetime.timedelta(0, 3600)
2112
>>> rfc3339_duration_to_delta("PT24H")
2113
datetime.timedelta(1)
2114
>>> rfc3339_duration_to_delta("P1W")
2115
datetime.timedelta(7)
2116
>>> rfc3339_duration_to_delta("PT5M30S")
2117
datetime.timedelta(0, 330)
2118
>>> rfc3339_duration_to_delta("P1DT3M20S")
2119
datetime.timedelta(1, 200)
2122
# Parsing an RFC 3339 duration with regular expressions is not
2123
# possible - there would have to be multiple places for the same
2124
# values, like seconds. The current code, while more esoteric, is
2125
# cleaner without depending on a parsing library. If Python had a
2126
# built-in library for parsing we would use it, but we'd like to
2127
# avoid excessive use of external libraries.
2129
# New type for defining tokens, syntax, and semantics all-in-one
2130
Token = collections.namedtuple("Token",
2131
("regexp", # To match token; if
2132
# "value" is not None,
2133
# must have a "group"
2135
"value", # datetime.timedelta or
2137
"followers")) # Tokens valid after
2139
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2140
# the "duration" ABNF definition in RFC 3339, Appendix A.
2141
token_end = Token(re.compile(r"$"), None, frozenset())
2142
token_second = Token(re.compile(r"(\d+)S"),
2143
datetime.timedelta(seconds=1),
2144
frozenset((token_end,)))
2145
token_minute = Token(re.compile(r"(\d+)M"),
2146
datetime.timedelta(minutes=1),
2147
frozenset((token_second, token_end)))
2148
token_hour = Token(re.compile(r"(\d+)H"),
2149
datetime.timedelta(hours=1),
2150
frozenset((token_minute, token_end)))
2151
token_time = Token(re.compile(r"T"),
2153
frozenset((token_hour, token_minute,
2155
token_day = Token(re.compile(r"(\d+)D"),
2156
datetime.timedelta(days=1),
2157
frozenset((token_time, token_end)))
2158
token_month = Token(re.compile(r"(\d+)M"),
2159
datetime.timedelta(weeks=4),
2160
frozenset((token_day, token_end)))
2161
token_year = Token(re.compile(r"(\d+)Y"),
2162
datetime.timedelta(weeks=52),
2163
frozenset((token_month, token_end)))
2164
token_week = Token(re.compile(r"(\d+)W"),
2165
datetime.timedelta(weeks=1),
2166
frozenset((token_end,)))
2167
token_duration = Token(re.compile(r"P"), None,
2168
frozenset((token_year, token_month,
2169
token_day, token_time,
2171
# Define starting values
2172
value = datetime.timedelta() # Value so far
2174
followers = frozenset(token_duration,) # Following valid tokens
2175
s = duration # String left to parse
2176
# Loop until end token is found
2177
while found_token is not token_end:
2178
# Search for any currently valid tokens
2179
for token in followers:
2180
match = token.regexp.match(s)
2181
if match is not None:
2183
if token.value is not None:
2184
# Value found, parse digits
2185
factor = int(match.group(1), 10)
2186
# Add to value so far
2187
value += factor * token.value
2188
# Strip token from string
2189
s = token.regexp.sub("", s, 1)
2192
# Set valid next tokens
2193
followers = found_token.followers
1311
logger.error(u"Unknown IPC command: %r", cmdline)
1313
# Keep calling this function
2196
# No currently valid tokens were found
2197
raise ValueError("Invalid RFC 3339 duration")
1317
2202
def string_to_delta(interval):
1318
2203
"""Parse a string and return a datetime.timedelta
1320
>>> string_to_delta(u'7d')
2205
>>> string_to_delta('7d')
1321
2206
datetime.timedelta(7)
1322
>>> string_to_delta(u'60s')
2207
>>> string_to_delta('60s')
1323
2208
datetime.timedelta(0, 60)
1324
>>> string_to_delta(u'60m')
2209
>>> string_to_delta('60m')
1325
2210
datetime.timedelta(0, 3600)
1326
>>> string_to_delta(u'24h')
2211
>>> string_to_delta('24h')
1327
2212
datetime.timedelta(1)
1328
>>> string_to_delta(u'1w')
2213
>>> string_to_delta('1w')
1329
2214
datetime.timedelta(7)
1330
>>> string_to_delta(u'5m 30s')
2215
>>> string_to_delta('5m 30s')
1331
2216
datetime.timedelta(0, 330)
2220
return rfc3339_duration_to_delta(interval)
1333
2224
timevalue = datetime.timedelta(0)
1334
2225
for s in interval.split():
1336
2227
suffix = unicode(s[-1])
1337
2228
value = int(s[:-1])
1339
2230
delta = datetime.timedelta(value)
1340
elif suffix == u"s":
1341
2232
delta = datetime.timedelta(0, value)
1342
elif suffix == u"m":
1343
2234
delta = datetime.timedelta(0, 0, 0, 0, value)
1344
elif suffix == u"h":
1345
2236
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1346
elif suffix == u"w":
1347
2238
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1349
raise ValueError(u"Unknown suffix %r" % suffix)
1350
except (ValueError, IndexError), e:
1351
raise ValueError(e.message)
2240
raise ValueError("Unknown suffix {0!r}"
2242
except (ValueError, IndexError) as e:
2243
raise ValueError(*(e.args))
1352
2244
timevalue += delta
1353
2245
return timevalue
1356
def if_nametoindex(interface):
1357
"""Call the C function if_nametoindex(), or equivalent
1359
Note: This function cannot accept a unicode string."""
1360
global if_nametoindex
1362
if_nametoindex = (ctypes.cdll.LoadLibrary
1363
(ctypes.util.find_library(u"c"))
1365
except (OSError, AttributeError):
1366
logger.warning(u"Doing if_nametoindex the hard way")
1367
def if_nametoindex(interface):
1368
"Get an interface index the hard way, i.e. using fcntl()"
1369
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1370
with closing(socket.socket()) as s:
1371
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1372
struct.pack(str(u"16s16x"),
1374
interface_index = struct.unpack(str(u"I"),
1376
return interface_index
1377
return if_nametoindex(interface)
1380
2248
def daemon(nochdir = False, noclose = False):
1381
2249
"""See daemon(3). Standard BSD Unix function.
1407
2275
##################################################################
1408
2276
# Parsing of options, both command line and config file
1410
parser = optparse.OptionParser(version = "%%prog %s" % version)
1411
parser.add_option("-i", u"--interface", type=u"string",
1412
metavar="IF", help=u"Bind to interface IF")
1413
parser.add_option("-a", u"--address", type=u"string",
1414
help=u"Address to listen for requests on")
1415
parser.add_option("-p", u"--port", type=u"int",
1416
help=u"Port number to receive requests on")
1417
parser.add_option("--check", action=u"store_true",
1418
help=u"Run self-test")
1419
parser.add_option("--debug", action=u"store_true",
1420
help=u"Debug mode; run in foreground and log to"
1422
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1423
u" priority string (see GnuTLS documentation)")
1424
parser.add_option("--servicename", type=u"string",
1425
metavar=u"NAME", help=u"Zeroconf service name")
1426
parser.add_option("--configdir", type=u"string",
1427
default=u"/etc/mandos", metavar=u"DIR",
1428
help=u"Directory to search for configuration"
1430
parser.add_option("--no-dbus", action=u"store_false",
1431
dest=u"use_dbus", help=u"Do not provide D-Bus"
1432
u" system bus interface")
1433
parser.add_option("--no-ipv6", action=u"store_false",
1434
dest=u"use_ipv6", help=u"Do not use IPv6")
1435
options = parser.parse_args()[0]
2278
parser = argparse.ArgumentParser()
2279
parser.add_argument("-v", "--version", action="version",
2280
version = "%(prog)s {0}".format(version),
2281
help="show version number and exit")
2282
parser.add_argument("-i", "--interface", metavar="IF",
2283
help="Bind to interface IF")
2284
parser.add_argument("-a", "--address",
2285
help="Address to listen for requests on")
2286
parser.add_argument("-p", "--port", type=int,
2287
help="Port number to receive requests on")
2288
parser.add_argument("--check", action="store_true",
2289
help="Run self-test")
2290
parser.add_argument("--debug", action="store_true",
2291
help="Debug mode; run in foreground and log"
2293
parser.add_argument("--debuglevel", metavar="LEVEL",
2294
help="Debug level for stdout output")
2295
parser.add_argument("--priority", help="GnuTLS"
2296
" priority string (see GnuTLS documentation)")
2297
parser.add_argument("--servicename",
2298
metavar="NAME", help="Zeroconf service name")
2299
parser.add_argument("--configdir",
2300
default="/etc/mandos", metavar="DIR",
2301
help="Directory to search for configuration"
2303
parser.add_argument("--no-dbus", action="store_false",
2304
dest="use_dbus", help="Do not provide D-Bus"
2305
" system bus interface")
2306
parser.add_argument("--no-ipv6", action="store_false",
2307
dest="use_ipv6", help="Do not use IPv6")
2308
parser.add_argument("--no-restore", action="store_false",
2309
dest="restore", help="Do not restore stored"
2311
parser.add_argument("--socket", type=int,
2312
help="Specify a file descriptor to a network"
2313
" socket to use instead of creating one")
2314
parser.add_argument("--statedir", metavar="DIR",
2315
help="Directory to save/restore state in")
2316
parser.add_argument("--foreground", action="store_true",
2317
help="Run in foreground")
2319
options = parser.parse_args()
1437
2321
if options.check:
1480
2379
for option in server_settings.keys():
1481
2380
if type(server_settings[option]) is str:
1482
2381
server_settings[option] = unicode(server_settings[option])
2382
# Debug implies foreground
2383
if server_settings["debug"]:
2384
server_settings["foreground"] = True
1483
2385
# Now we have our good server settings in "server_settings"
1485
2387
##################################################################
1487
2389
# For convenience
1488
debug = server_settings[u"debug"]
1489
use_dbus = server_settings[u"use_dbus"]
1490
use_ipv6 = server_settings[u"use_ipv6"]
1493
syslogger.setLevel(logging.WARNING)
1494
console.setLevel(logging.WARNING)
1496
if server_settings[u"servicename"] != u"Mandos":
2390
debug = server_settings["debug"]
2391
debuglevel = server_settings["debuglevel"]
2392
use_dbus = server_settings["use_dbus"]
2393
use_ipv6 = server_settings["use_ipv6"]
2394
stored_state_path = os.path.join(server_settings["statedir"],
2396
foreground = server_settings["foreground"]
2399
initlogger(debug, logging.DEBUG)
2404
level = getattr(logging, debuglevel.upper())
2405
initlogger(debug, level)
2407
if server_settings["servicename"] != "Mandos":
1497
2408
syslogger.setFormatter(logging.Formatter
1498
(u'Mandos (%s) [%%(process)d]:'
1499
u' %%(levelname)s: %%(message)s'
1500
% server_settings[u"servicename"]))
2409
('Mandos ({0}) [%(process)d]:'
2410
' %(levelname)s: %(message)s'
2411
.format(server_settings
1502
2414
# Parse config file with clients
1503
client_defaults = { u"timeout": u"1h",
1505
u"checker": u"fping -q -- %%(host)s",
1508
client_config = configparser.SafeConfigParser(client_defaults)
1509
client_config.read(os.path.join(server_settings[u"configdir"],
2415
client_config = configparser.SafeConfigParser(Client
2417
client_config.read(os.path.join(server_settings["configdir"],
1512
2420
global mandos_dbus_service
1513
2421
mandos_dbus_service = None
1515
tcp_server = MandosServer((server_settings[u"address"],
1516
server_settings[u"port"]),
2423
tcp_server = MandosServer((server_settings["address"],
2424
server_settings["port"]),
1518
interface=server_settings[u"interface"],
2426
interface=(server_settings["interface"]
1519
2428
use_ipv6=use_ipv6,
1520
2429
gnutls_priority=
1521
server_settings[u"priority"],
1523
pidfilename = u"/var/run/mandos.pid"
1525
pidfile = open(pidfilename, u"w")
1527
logger.error(u"Could not open file %r", pidfilename)
2430
server_settings["priority"],
2432
socketfd=(server_settings["socket"]
2435
pidfilename = "/var/run/mandos.pid"
2438
pidfile = open(pidfilename, "w")
2439
except IOError as e:
2440
logger.error("Could not open file %r", pidfilename,
1530
uid = pwd.getpwnam(u"_mandos").pw_uid
1531
gid = pwd.getpwnam(u"_mandos").pw_gid
2443
for name in ("_mandos", "mandos", "nobody"):
1534
uid = pwd.getpwnam(u"mandos").pw_uid
1535
gid = pwd.getpwnam(u"mandos").pw_gid
2445
uid = pwd.getpwnam(name).pw_uid
2446
gid = pwd.getpwnam(name).pw_gid
1536
2448
except KeyError:
1538
uid = pwd.getpwnam(u"nobody").pw_uid
1539
gid = pwd.getpwnam(u"nobody").pw_gid
1546
except OSError, error:
1547
if error[0] != errno.EPERM:
2456
except OSError as error:
2457
if error.errno != errno.EPERM:
1550
# Enable all possible GnuTLS debugging
2461
# Enable all possible GnuTLS debugging
1552
2463
# "Use a log level over 10 to enable all debugging options."
1553
2464
# - GnuTLS manual
1554
2465
gnutls.library.functions.gnutls_global_set_log_level(11)
1556
2467
@gnutls.library.types.gnutls_log_func
1557
2468
def debug_gnutls(level, string):
1558
logger.debug(u"GnuTLS: %s", string[:-1])
2469
logger.debug("GnuTLS: %s", string[:-1])
1560
2471
(gnutls.library.functions
1561
2472
.gnutls_global_set_log_function(debug_gnutls))
2474
# Redirect stdin so all checkers get /dev/null
2475
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2476
os.dup2(null, sys.stdin.fileno())
2480
# Need to fork before connecting to D-Bus
2482
# Close all input and output, do double fork, etc.
2485
# multiprocessing will use threads, so before we use gobject we
2486
# need to inform gobject that threads will be used.
2487
gobject.threads_init()
1563
2489
global main_loop
1564
2490
# From the Avahi example code
1565
DBusGMainLoop(set_as_default=True )
2491
DBusGMainLoop(set_as_default=True)
1566
2492
main_loop = gobject.MainLoop()
1567
2493
bus = dbus.SystemBus()
1568
2494
# End of Avahi example code
1570
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
2497
bus_name = dbus.service.BusName("se.recompile.Mandos",
2498
bus, do_not_queue=True)
2499
old_bus_name = (dbus.service.BusName
2500
("se.bsnet.fukt.Mandos", bus,
2502
except dbus.exceptions.NameExistsException as e:
2503
logger.error("Disabling D-Bus:", exc_info=e)
2505
server_settings["use_dbus"] = False
2506
tcp_server.use_dbus = False
1571
2507
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1572
service = AvahiService(name = server_settings[u"servicename"],
1573
servicetype = u"_mandos._tcp",
1574
protocol = protocol, bus = bus)
2508
service = AvahiServiceToSyslog(name =
2509
server_settings["servicename"],
2510
servicetype = "_mandos._tcp",
2511
protocol = protocol, bus = bus)
1575
2512
if server_settings["interface"]:
1576
2513
service.interface = (if_nametoindex
1577
(str(server_settings[u"interface"])))
2514
(str(server_settings["interface"])))
2516
global multiprocessing_manager
2517
multiprocessing_manager = multiprocessing.Manager()
1579
2519
client_class = Client
1581
2521
client_class = functools.partial(ClientDBus, bus = bus)
1582
tcp_server.clients.update(set(
1583
client_class(name = section,
1584
config= dict(client_config.items(section)))
1585
for section in client_config.sections()))
2523
client_settings = Client.config_parser(client_config)
2524
old_client_settings = {}
2527
# Get client data and settings from last running state.
2528
if server_settings["restore"]:
2530
with open(stored_state_path, "rb") as stored_state:
2531
clients_data, old_client_settings = (pickle.load
2533
os.remove(stored_state_path)
2534
except IOError as e:
2535
if e.errno == errno.ENOENT:
2536
logger.warning("Could not load persistent state: {0}"
2537
.format(os.strerror(e.errno)))
2539
logger.critical("Could not load persistent state:",
2542
except EOFError as e:
2543
logger.warning("Could not load persistent state: "
2544
"EOFError:", exc_info=e)
2546
with PGPEngine() as pgp:
2547
for client_name, client in clients_data.iteritems():
2548
# Decide which value to use after restoring saved state.
2549
# We have three different values: Old config file,
2550
# new config file, and saved state.
2551
# New config value takes precedence if it differs from old
2552
# config value, otherwise use saved state.
2553
for name, value in client_settings[client_name].items():
2555
# For each value in new config, check if it
2556
# differs from the old config value (Except for
2557
# the "secret" attribute)
2558
if (name != "secret" and
2559
value != old_client_settings[client_name]
2561
client[name] = value
2565
# Clients who has passed its expire date can still be
2566
# enabled if its last checker was successful. Clients
2567
# whose checker succeeded before we stored its state is
2568
# assumed to have successfully run all checkers during
2570
if client["enabled"]:
2571
if datetime.datetime.utcnow() >= client["expires"]:
2572
if not client["last_checked_ok"]:
2574
"disabling client {0} - Client never "
2575
"performed a successful checker"
2576
.format(client_name))
2577
client["enabled"] = False
2578
elif client["last_checker_status"] != 0:
2580
"disabling client {0} - Client "
2581
"last checker failed with error code {1}"
2582
.format(client_name,
2583
client["last_checker_status"]))
2584
client["enabled"] = False
2586
client["expires"] = (datetime.datetime
2588
+ client["timeout"])
2589
logger.debug("Last checker succeeded,"
2590
" keeping {0} enabled"
2591
.format(client_name))
2593
client["secret"] = (
2594
pgp.decrypt(client["encrypted_secret"],
2595
client_settings[client_name]
2598
# If decryption fails, we use secret from new settings
2599
logger.debug("Failed to decrypt {0} old secret"
2600
.format(client_name))
2601
client["secret"] = (
2602
client_settings[client_name]["secret"])
2604
# Add/remove clients based on new changes made to config
2605
for client_name in (set(old_client_settings)
2606
- set(client_settings)):
2607
del clients_data[client_name]
2608
for client_name in (set(client_settings)
2609
- set(old_client_settings)):
2610
clients_data[client_name] = client_settings[client_name]
2612
# Create all client objects
2613
for client_name, client in clients_data.iteritems():
2614
tcp_server.clients[client_name] = client_class(
2615
name = client_name, settings = client)
1586
2617
if not tcp_server.clients:
1587
logger.warning(u"No clients defined")
1590
# Redirect stdin so all checkers get /dev/null
1591
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1592
os.dup2(null, sys.stdin.fileno())
1596
# No console logging
1597
logger.removeHandler(console)
1598
# Close all input and output, do double fork, etc.
1602
with closing(pidfile):
1604
pidfile.write(str(pid) + "\n")
2618
logger.warning("No clients defined")
2621
if pidfile is not None:
2625
pidfile.write(str(pid) + "\n".encode("utf-8"))
2627
logger.error("Could not write to file %r with PID %d",
1607
logger.error(u"Could not write to file %r with PID %d",
1610
# "pidfile" was never created
1615
signal.signal(signal.SIGINT, signal.SIG_IGN)
1616
2632
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1617
2633
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1620
class MandosDBusService(dbus.service.Object):
2636
@alternate_dbus_interfaces({"se.recompile.Mandos":
2637
"se.bsnet.fukt.Mandos"})
2638
class MandosDBusService(DBusObjectWithProperties):
1621
2639
"""A D-Bus proxy object"""
1622
2640
def __init__(self):
1623
dbus.service.Object.__init__(self, bus, u"/")
1624
_interface = u"se.bsnet.fukt.Mandos"
1626
@dbus.service.signal(_interface, signature=u"oa{sv}")
1627
def ClientAdded(self, objpath, properties):
1631
@dbus.service.signal(_interface, signature=u"s")
1632
def ClientNotFound(self, fingerprint):
1636
@dbus.service.signal(_interface, signature=u"os")
2641
dbus.service.Object.__init__(self, bus, "/")
2642
_interface = "se.recompile.Mandos"
2644
@dbus_interface_annotations(_interface)
2646
return { "org.freedesktop.DBus.Property"
2647
".EmitsChangedSignal":
2650
@dbus.service.signal(_interface, signature="o")
2651
def ClientAdded(self, objpath):
2655
@dbus.service.signal(_interface, signature="ss")
2656
def ClientNotFound(self, fingerprint, address):
2660
@dbus.service.signal(_interface, signature="os")
1637
2661
def ClientRemoved(self, objpath, name):
1641
@dbus.service.method(_interface, out_signature=u"ao")
2665
@dbus.service.method(_interface, out_signature="ao")
1642
2666
def GetAllClients(self):
1644
2668
return dbus.Array(c.dbus_object_path
1645
for c in tcp_server.clients)
2670
tcp_server.clients.itervalues())
1647
2672
@dbus.service.method(_interface,
1648
out_signature=u"a{oa{sv}}")
2673
out_signature="a{oa{sv}}")
1649
2674
def GetAllClientsWithProperties(self):
1651
2676
return dbus.Dictionary(
1652
((c.dbus_object_path, c.GetAll(u""))
1653
for c in tcp_server.clients),
1654
signature=u"oa{sv}")
2677
((c.dbus_object_path, c.GetAll(""))
2678
for c in tcp_server.clients.itervalues()),
1656
@dbus.service.method(_interface, in_signature=u"o")
2681
@dbus.service.method(_interface, in_signature="o")
1657
2682
def RemoveClient(self, object_path):
1659
for c in tcp_server.clients:
2684
for c in tcp_server.clients.itervalues():
1660
2685
if c.dbus_object_path == object_path:
1661
tcp_server.clients.remove(c)
2686
del tcp_server.clients[c.name]
1662
2687
c.remove_from_connection()
1663
2688
# Don't signal anything except ClientRemoved
1664
c.disable(signal=False)
2689
c.disable(quiet=True)
1665
2690
# Emit D-Bus signal
1666
2691
self.ClientRemoved(object_path, c.name)