To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 612
- compare with another revision
- download diff
- download tarball
- view history from revision 612
- Committer: Björn Påhlsson
- Date: 2012-07-03 20:55:09 UTC
- Revision ID: belorn@recompile.se-20120703205509-fkeb6uqy4i6gt4b6
added note messages when mandos-monitor starts without running server,
or a server with no clients.
or a server with no clients.
- files added:
- debian/mandos-client.examples
- network-hooks.d
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
63
65
import cPickle as pickle
64
66
import multiprocessing
65
67
import types
68
import binascii
69
import tempfile
70
import itertools
71
import collections
66
72
67
73
import dbus
68
74
import dbus.service
73
79
import ctypes.util
74
80
import xml.dom.minidom
75
81
import inspect
82
import GnuPGInterface
76
83
77
84
try:
78
85
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
82
89
except ImportError:
83
90
SO_BINDTODEVICE = None
84
91
85
86
version = "1.4.1"
87
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
92
version = "1.6.0"
93
stored_state_file = "clients.pickle"
94
95
logger = logging.getLogger()
90
96
syslogger = (logging.handlers.SysLogHandler
91
97
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
98
address = str("/dev/log")))
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
99
100
try:
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
104
except (OSError, AttributeError):
105
def if_nametoindex(interface):
106
"Get an interface index the hard way, i.e. using fcntl()"
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
108
with contextlib.closing(socket.socket()) as s:
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
110
struct.pack(str("16s16x"),
111
interface))
112
interface_index = struct.unpack(str("I"),
113
ifreq[16:20])[0]
114
return interface_index
115
116
117
def initlogger(debug, level=logging.WARNING):
118
"""init logger and add loglevel"""
119
120
syslogger.setFormatter(logging.Formatter
121
('Mandos [%(process)d]: %(levelname)s:'
122
' %(message)s'))
123
logger.addHandler(syslogger)
124
125
if debug:
126
console = logging.StreamHandler()
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
128
' [%(process)d]:'
129
' %(levelname)s:'
130
' %(message)s'))
131
logger.addHandler(console)
132
logger.setLevel(level)
133
134
135
class PGPError(Exception):
136
"""Exception if encryption/decryption fails"""
137
pass
138
139
140
class PGPEngine(object):
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
def __init__(self):
143
self.gnupg = GnuPGInterface.GnuPG()
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
self.gnupg = GnuPGInterface.GnuPG()
146
self.gnupg.options.meta_interactive = False
147
self.gnupg.options.homedir = self.tempdir
148
self.gnupg.options.extra_args.extend(['--force-mdc',
149
'--quiet',
150
'--no-use-agent'])
151
152
def __enter__(self):
153
return self
154
155
def __exit__(self, exc_type, exc_value, traceback):
156
self._cleanup()
157
return False
158
159
def __del__(self):
160
self._cleanup()
161
162
def _cleanup(self):
163
if self.tempdir is not None:
164
# Delete contents of tempdir
165
for root, dirs, files in os.walk(self.tempdir,
166
topdown = False):
167
for filename in files:
168
os.remove(os.path.join(root, filename))
169
for dirname in dirs:
170
os.rmdir(os.path.join(root, dirname))
171
# Remove tempdir
172
os.rmdir(self.tempdir)
173
self.tempdir = None
174
175
def password_encode(self, password):
176
# Passphrase can not be empty and can not contain newlines or
177
# NUL bytes. So we prefix it and hex encode it.
178
return b"mandos" + binascii.hexlify(password)
179
180
def encrypt(self, data, password):
181
self.gnupg.passphrase = self.password_encode(password)
182
with open(os.devnull, "w") as devnull:
183
try:
184
proc = self.gnupg.run(['--symmetric'],
185
create_fhs=['stdin', 'stdout'],
186
attach_fhs={'stderr': devnull})
187
with contextlib.closing(proc.handles['stdin']) as f:
188
f.write(data)
189
with contextlib.closing(proc.handles['stdout']) as f:
190
ciphertext = f.read()
191
proc.wait()
192
except IOError as e:
193
raise PGPError(e)
194
self.gnupg.passphrase = None
195
return ciphertext
196
197
def decrypt(self, data, password):
198
self.gnupg.passphrase = self.password_encode(password)
199
with open(os.devnull, "w") as devnull:
200
try:
201
proc = self.gnupg.run(['--decrypt'],
202
create_fhs=['stdin', 'stdout'],
203
attach_fhs={'stderr': devnull})
204
with contextlib.closing(proc.handles['stdin']) as f:
205
f.write(data)
206
with contextlib.closing(proc.handles['stdout']) as f:
207
decrypted_plaintext = f.read()
208
proc.wait()
209
except IOError as e:
210
raise PGPError(e)
211
self.gnupg.passphrase = None
212
return decrypted_plaintext
213
103
214
104
215
class AvahiError(Exception):
105
216
def __init__(self, value, *args, **kwargs):
135
246
server: D-Bus Server
136
247
bus: dbus.SystemBus()
137
248
"""
249
138
250
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
251
servicetype = None, port = None, TXT = None,
140
252
domain = "", host = "", max_renames = 32768,
153
265
self.server = None
154
266
self.bus = bus
155
267
self.entry_group_state_changed_match = None
268
156
269
def rename(self):
157
270
"""Derived from the Avahi example code"""
158
271
if self.rename_count >= self.max_renames:
164
277
.GetAlternativeServiceName(self.name))
165
278
logger.info("Changing Zeroconf service name to %r ...",
166
279
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
171
280
self.remove()
172
281
try:
173
282
self.add()
174
283
except dbus.exceptions.DBusException as error:
175
logger.critical("DBusException: %s", error)
284
logger.critical("D-Bus Exception", exc_info=error)
176
285
self.cleanup()
177
286
os._exit(1)
178
287
self.rename_count += 1
288
179
289
def remove(self):
180
290
"""Derived from the Avahi example code"""
181
291
if self.entry_group_state_changed_match is not None:
183
293
self.entry_group_state_changed_match = None
184
294
if self.group is not None:
185
295
self.group.Reset()
296
186
297
def add(self):
187
298
"""Derived from the Avahi example code"""
188
299
self.remove()
193
304
avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
305
self.entry_group_state_changed_match = (
195
306
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
307
'StateChanged', self.entry_group_state_changed))
197
308
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
198
309
self.name, self.type)
199
310
self.group.AddService(
205
316
dbus.UInt16(self.port),
206
317
avahi.string_array_to_txt_array(self.TXT))
207
318
self.group.Commit()
319
208
320
def entry_group_state_changed(self, state, error):
209
321
"""Derived from the Avahi example code"""
210
322
logger.debug("Avahi entry group state change: %i", state)
217
329
elif state == avahi.ENTRY_GROUP_FAILURE:
218
330
logger.critical("Avahi: Error in group state changed %s",
219
331
unicode(error))
220
raise AvahiGroupError("State changed: %s"
221
% unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
334
222
335
def cleanup(self):
223
336
"""Derived from the Avahi example code"""
224
337
if self.group is not None:
225
338
try:
226
339
self.group.Free()
227
340
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
341
dbus.exceptions.DBusException):
229
342
pass
230
343
self.group = None
231
344
self.remove()
345
232
346
def server_state_changed(self, state, error=None):
233
347
"""Derived from the Avahi example code"""
234
348
logger.debug("Avahi server state change: %i", state)
253
367
logger.debug("Unknown state: %r", state)
254
368
else:
255
369
logger.debug("Unknown state: %r: %r", state, error)
370
256
371
def activate(self):
257
372
"""Derived from the Avahi example code"""
258
373
if self.server is None:
266
381
self.server_state_changed(self.server.GetState())
267
382
268
383
269
def _timedelta_to_milliseconds(td):
384
class AvahiServiceToSyslog(AvahiService):
385
def rename(self):
386
"""Add the new name to the syslog messages"""
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
392
return ret
393
394
395
def timedelta_to_milliseconds(td):
270
396
"Convert a datetime.timedelta() to milliseconds"
271
397
return ((td.days * 24 * 60 * 60 * 1000)
272
398
+ (td.seconds * 1000)
273
399
+ (td.microseconds // 1000))
274
400
401
275
402
class Client(object):
276
403
"""A representation of a client host served by this server.
277
404
278
405
Attributes:
279
_approved: bool(); 'None' if not yet approved/disapproved
406
approved: bool(); 'None' if not yet approved/disapproved
280
407
approval_delay: datetime.timedelta(); Time to wait for approval
281
408
approval_duration: datetime.timedelta(); Duration of one approval
282
409
checker: subprocess.Popen(); a running checker process used
289
416
instance %(name)s can be used in the command.
290
417
checker_initiator_tag: a gobject event source tag, or None
291
418
created: datetime.datetime(); (UTC) object creation
419
client_structure: Object describing what attributes a client has
420
and is used for storing the client at exit
292
421
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
294
422
disable_initiator_tag: a gobject event source tag, or None
295
423
enabled: bool()
296
424
fingerprint: string (40 or 32 hexadecimal digits); used to
299
427
interval: datetime.timedelta(); How often to start a new checker
300
428
last_approval_request: datetime.datetime(); (UTC) or None
301
429
last_checked_ok: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
430
last_checker_status: integer between 0 and 255 reflecting exit
431
status of last checker. -1 reflects crashed
432
checker, -2 means no checker completed yet.
433
last_enabled: datetime.datetime(); (UTC) or None
303
434
name: string; from the config file, used in log messages and
304
435
D-Bus identifiers
305
436
secret: bytestring; sent verbatim (over TLS) to client
306
437
timeout: datetime.timedelta(); How long from last_checked_ok
307
438
until this client is disabled
308
extended_timeout: extra long timeout when password has been sent
439
extended_timeout: extra long timeout when secret has been sent
309
440
runtime_expansions: Allowed attributes for runtime expansion.
310
441
expires: datetime.datetime(); time (UTC) when a client will be
311
442
disabled, or None
312
443
"""
313
444
314
445
runtime_expansions = ("approval_delay", "approval_duration",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
446
"created", "enabled", "expires",
447
"fingerprint", "host", "interval",
448
"last_approval_request", "last_checked_ok",
317
449
"last_enabled", "name", "timeout")
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
453
"checker": "fping -q -- %%(host)s",
454
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
458
"enabled": "True",
459
}
318
460
319
461
def timeout_milliseconds(self):
320
462
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
463
return timedelta_to_milliseconds(self.timeout)
322
464
323
465
def extended_timeout_milliseconds(self):
324
466
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
467
return timedelta_to_milliseconds(self.extended_timeout)
326
468
327
469
def interval_milliseconds(self):
328
470
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
471
return timedelta_to_milliseconds(self.interval)
330
472
331
473
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
335
"""Note: the 'checker' key in 'config' sets the
336
'checker_command' attribute and *not* the 'checker'
337
attribute."""
474
return timedelta_to_milliseconds(self.approval_delay)
475
476
@staticmethod
477
def config_parser(config):
478
"""Construct a new dict of client settings of this form:
479
{ client_name: {setting_name: value, ...}, ...}
480
with exceptions for any special settings as defined above.
481
NOTE: Must be a pure function. Must return the same result
482
value given the same arguments.
483
"""
484
settings = {}
485
for client_name in config.sections():
486
section = dict(config.items(client_name))
487
client = settings[client_name] = {}
488
489
client["host"] = section["host"]
490
# Reformat values from string types to Python types
491
client["approved_by_default"] = config.getboolean(
492
client_name, "approved_by_default")
493
client["enabled"] = config.getboolean(client_name,
494
"enabled")
495
496
client["fingerprint"] = (section["fingerprint"].upper()
497
.replace(" ", ""))
498
if "secret" in section:
499
client["secret"] = section["secret"].decode("base64")
500
elif "secfile" in section:
501
with open(os.path.expanduser(os.path.expandvars
502
(section["secfile"])),
503
"rb") as secfile:
504
client["secret"] = secfile.read()
505
else:
506
raise TypeError("No secret or secfile for section {0}"
507
.format(section))
508
client["timeout"] = string_to_delta(section["timeout"])
509
client["extended_timeout"] = string_to_delta(
510
section["extended_timeout"])
511
client["interval"] = string_to_delta(section["interval"])
512
client["approval_delay"] = string_to_delta(
513
section["approval_delay"])
514
client["approval_duration"] = string_to_delta(
515
section["approval_duration"])
516
client["checker_command"] = section["checker"]
517
client["last_approval_request"] = None
518
client["last_checked_ok"] = None
519
client["last_checker_status"] = -2
520
521
return settings
522
523
def __init__(self, settings, name = None):
338
524
self.name = name
339
if config is None:
340
config = {}
525
# adding all client settings
526
for setting, value in settings.iteritems():
527
setattr(self, setting, value)
528
529
if self.enabled:
530
if not hasattr(self, "last_enabled"):
531
self.last_enabled = datetime.datetime.utcnow()
532
if not hasattr(self, "expires"):
533
self.expires = (datetime.datetime.utcnow()
534
+ self.timeout)
535
else:
536
self.last_enabled = None
537
self.expires = None
538
341
539
logger.debug("Creating client %r", self.name)
342
540
# Uppercase and remove spaces from fingerprint for later
343
541
# comparison purposes with return value from the fingerprint()
344
542
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
543
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
544
self.created = settings.get("created",
545
datetime.datetime.utcnow())
546
547
# attributes specific for this server instance
369
548
self.checker = None
370
549
self.checker_initiator_tag = None
371
550
self.disable_initiator_tag = None
372
self.expires = None
373
551
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
375
552
self.current_checker_command = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
553
self.approved = None
380
554
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
555
self.changedstate = (multiprocessing_manager
386
556
.Condition(multiprocessing_manager
387
557
.Lock()))
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
560
if not attr.startswith("_")]
561
self.client_structure.append("client_structure")
562
563
for name, t in inspect.getmembers(type(self),
564
lambda obj:
565
isinstance(obj,
566
property)):
567
if not name.startswith("_"):
568
self.client_structure.append(name)
388
569
570
# Send notice to process children that client state has changed
389
571
def send_changedstate(self):
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
572
with self.changedstate:
573
self.changedstate.notify_all()
393
574
394
575
def enable(self):
395
576
"""Start this client's checker and timeout hooks"""
396
577
if getattr(self, "enabled", False):
397
578
# Already enabled
398
579
return
580
self.expires = datetime.datetime.utcnow() + self.timeout
581
self.enabled = True
582
self.last_enabled = datetime.datetime.utcnow()
583
self.init_checker()
399
584
self.send_changedstate()
585
586
def disable(self, quiet=True):
587
"""Disable this client."""
588
if not getattr(self, "enabled", False):
589
return False
590
if not quiet:
591
logger.info("Disabling client %s", self.name)
592
if getattr(self, "disable_initiator_tag", None) is not None:
593
gobject.source_remove(self.disable_initiator_tag)
594
self.disable_initiator_tag = None
595
self.expires = None
596
if getattr(self, "checker_initiator_tag", None) is not None:
597
gobject.source_remove(self.checker_initiator_tag)
598
self.checker_initiator_tag = None
599
self.stop_checker()
600
self.enabled = False
601
if not quiet:
602
self.send_changedstate()
603
# Do not run this again if called by a gobject.timeout_add
604
return False
605
606
def __del__(self):
607
self.disable()
608
609
def init_checker(self):
400
610
# Schedule a new checker to be started an 'interval' from now,
401
611
# and every interval from then on.
612
if self.checker_initiator_tag is not None:
613
gobject.source_remove(self.checker_initiator_tag)
402
614
self.checker_initiator_tag = (gobject.timeout_add
403
615
(self.interval_milliseconds(),
404
616
self.start_checker))
405
617
# Schedule a disable() when 'timeout' has passed
406
self.expires = datetime.datetime.utcnow() + self.timeout
618
if self.disable_initiator_tag is not None:
619
gobject.source_remove(self.disable_initiator_tag)
407
620
self.disable_initiator_tag = (gobject.timeout_add
408
621
(self.timeout_milliseconds(),
409
622
self.disable))
410
self.enabled = True
411
self.last_enabled = datetime.datetime.utcnow()
412
623
# Also start a new checker *right now*.
413
624
self.start_checker()
414
625
415
def disable(self, quiet=True):
416
"""Disable this client."""
417
if not getattr(self, "enabled", False):
418
return False
419
if not quiet:
420
self.send_changedstate()
421
if not quiet:
422
logger.info("Disabling client %s", self.name)
423
if getattr(self, "disable_initiator_tag", False):
424
gobject.source_remove(self.disable_initiator_tag)
425
self.disable_initiator_tag = None
426
self.expires = None
427
if getattr(self, "checker_initiator_tag", False):
428
gobject.source_remove(self.checker_initiator_tag)
429
self.checker_initiator_tag = None
430
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
433
self.enabled = False
434
# Do not run this again if called by a gobject.timeout_add
435
return False
436
437
def __del__(self):
438
self.disable_hook = None
439
self.disable()
440
441
626
def checker_callback(self, pid, condition, command):
442
627
"""The checker has completed, so take appropriate actions."""
443
628
self.checker_callback_tag = None
444
629
self.checker = None
445
630
if os.WIFEXITED(condition):
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
631
self.last_checker_status = os.WEXITSTATUS(condition)
632
if self.last_checker_status == 0:
448
633
logger.info("Checker for %(name)s succeeded",
449
634
vars(self))
450
635
self.checked_ok()
452
637
logger.info("Checker for %(name)s failed",
453
638
vars(self))
454
639
else:
640
self.last_checker_status = -1
455
641
logger.warning("Checker for %(name)s crashed?",
456
642
vars(self))
457
643
458
def checked_ok(self, timeout=None):
459
"""Bump up the timeout for this client.
460
461
This should only be called when the client has been seen,
462
alive and well.
463
"""
644
def checked_ok(self):
645
"""Assert that the client has been seen, alive and well."""
646
self.last_checked_ok = datetime.datetime.utcnow()
647
self.last_checker_status = 0
648
self.bump_timeout()
649
650
def bump_timeout(self, timeout=None):
651
"""Bump up the timeout for this client."""
464
652
if timeout is None:
465
653
timeout = self.timeout
466
self.last_checked_ok = datetime.datetime.utcnow()
467
654
if self.disable_initiator_tag is not None:
468
655
gobject.source_remove(self.disable_initiator_tag)
656
self.disable_initiator_tag = None
469
657
if getattr(self, "enabled", False):
470
658
self.disable_initiator_tag = (gobject.timeout_add
471
(_timedelta_to_milliseconds
659
(timedelta_to_milliseconds
472
660
(timeout), self.disable))
473
661
self.expires = datetime.datetime.utcnow() + timeout
474
662
481
669
If a checker already exists, leave it running and do
482
670
nothing."""
483
671
# The reason for not killing a running checker is that if we
484
# did that, then if a checker (for some reason) started
485
# running slowly and taking more than 'interval' time, the
486
# client would inevitably timeout, since no checker would get
487
# a chance to run to completion. If we instead leave running
672
# did that, and if a checker (for some reason) started running
673
# slowly and taking more than 'interval' time, then the client
674
# would inevitably timeout, since no checker would get a
675
# chance to run to completion. If we instead leave running
488
676
# checkers alone, the checker would have to take more time
489
677
# than 'timeout' for the client to be disabled, which is as it
490
678
# should be.
504
692
self.current_checker_command)
505
693
# Start a new checker if needed
506
694
if self.checker is None:
695
# Escape attributes for the shell
696
escaped_attrs = dict(
697
(attr, re.escape(unicode(getattr(self, attr))))
698
for attr in
699
self.runtime_expansions)
507
700
try:
508
# In case checker_command has exactly one % operator
509
command = self.checker_command % self.host
510
except TypeError:
511
# Escape attributes for the shell
512
escaped_attrs = dict(
513
(attr,
514
re.escape(unicode(str(getattr(self, attr, "")),
515
errors=
516
'replace')))
517
for attr in
518
self.runtime_expansions)
519
520
try:
521
command = self.checker_command % escaped_attrs
522
except TypeError as error:
523
logger.error('Could not format string "%s":'
524
' %s', self.checker_command, error)
525
return True # Try again later
701
command = self.checker_command % escaped_attrs
702
except TypeError as error:
703
logger.error('Could not format string "%s"',
704
self.checker_command, exc_info=error)
705
return True # Try again later
526
706
self.current_checker_command = command
527
707
try:
528
708
logger.info("Starting checker %r for %s",
534
714
self.checker = subprocess.Popen(command,
535
715
close_fds=True,
536
716
shell=True, cwd="/")
537
self.checker_callback_tag = (gobject.child_watch_add
538
(self.checker.pid,
539
self.checker_callback,
540
data=command))
541
# The checker may have completed before the gobject
542
# watch was added. Check for this.
717
except OSError as error:
718
logger.error("Failed to start subprocess",
719
exc_info=error)
720
return True
721
self.checker_callback_tag = (gobject.child_watch_add
722
(self.checker.pid,
723
self.checker_callback,
724
data=command))
725
# The checker may have completed before the gobject
726
# watch was added. Check for this.
727
try:
543
728
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
544
if pid:
545
gobject.source_remove(self.checker_callback_tag)
546
self.checker_callback(pid, status, command)
547
729
except OSError as error:
548
logger.error("Failed to start subprocess: %s",
549
error)
730
if error.errno == errno.ECHILD:
731
# This should never happen
732
logger.error("Child process vanished",
733
exc_info=error)
734
return True
735
raise
736
if pid:
737
gobject.source_remove(self.checker_callback_tag)
738
self.checker_callback(pid, status, command)
550
739
# Re-run this periodically if run by gobject.timeout_add
551
740
return True
552
741
559
748
return
560
749
logger.debug("Stopping checker for %(name)s", vars(self))
561
750
try:
562
os.kill(self.checker.pid, signal.SIGTERM)
751
self.checker.terminate()
563
752
#time.sleep(0.5)
564
753
#if self.checker.poll() is None:
565
# os.kill(self.checker.pid, signal.SIGKILL)
754
# self.checker.kill()
566
755
except OSError as error:
567
756
if error.errno != errno.ESRCH: # No such process
568
757
raise
585
774
# "Set" method, so we fail early here:
586
775
if byte_arrays and signature != "ay":
587
776
raise ValueError("Byte arrays not supported for non-'ay'"
588
" signature %r" % signature)
777
" signature {0!r}".format(signature))
589
778
def decorator(func):
590
779
func._dbus_is_property = True
591
780
func._dbus_interface = dbus_interface
599
788
return decorator
600
789
601
790
791
def dbus_interface_annotations(dbus_interface):
792
"""Decorator for marking functions returning interface annotations
793
794
Usage:
795
796
@dbus_interface_annotations("org.example.Interface")
797
def _foo(self): # Function name does not matter
798
return {"org.freedesktop.DBus.Deprecated": "true",
799
"org.freedesktop.DBus.Property.EmitsChangedSignal":
800
"false"}
801
"""
802
def decorator(func):
803
func._dbus_is_interface = True
804
func._dbus_interface = dbus_interface
805
func._dbus_name = dbus_interface
806
return func
807
return decorator
808
809
810
def dbus_annotations(annotations):
811
"""Decorator to annotate D-Bus methods, signals or properties
812
Usage:
813
814
@dbus_service_property("org.example.Interface", signature="b",
815
access="r")
816
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
817
"org.freedesktop.DBus.Property."
818
"EmitsChangedSignal": "false"})
819
def Property_dbus_property(self):
820
return dbus.Boolean(False)
821
"""
822
def decorator(func):
823
func._dbus_annotations = annotations
824
return func
825
return decorator
826
827
602
828
class DBusPropertyException(dbus.exceptions.DBusException):
603
829
"""A base class for D-Bus property-related exceptions
604
830
"""
627
853
"""
628
854
629
855
@staticmethod
630
def _is_dbus_property(obj):
631
return getattr(obj, "_dbus_is_property", False)
856
def _is_dbus_thing(thing):
857
"""Returns a function testing if an attribute is a D-Bus thing
858
859
If called like _is_dbus_thing("method") it returns a function
860
suitable for use as predicate to inspect.getmembers().
861
"""
862
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
863
False)
632
864
633
def _get_all_dbus_properties(self):
865
def _get_all_dbus_things(self, thing):
634
866
"""Returns a generator of (name, attribute) pairs
635
867
"""
636
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
868
return ((getattr(athing.__get__(self), "_dbus_name",
869
name),
870
athing.__get__(self))
637
871
for cls in self.__class__.__mro__
638
for name, prop in
639
inspect.getmembers(cls, self._is_dbus_property))
872
for name, athing in
873
inspect.getmembers(cls,
874
self._is_dbus_thing(thing)))
640
875
641
876
def _get_dbus_property(self, interface_name, property_name):
642
877
"""Returns a bound method if one exists which is a D-Bus
644
879
"""
645
880
for cls in self.__class__.__mro__:
646
881
for name, value in (inspect.getmembers
647
(cls, self._is_dbus_property)):
882
(cls,
883
self._is_dbus_thing("property"))):
648
884
if (value._dbus_name == property_name
649
885
and value._dbus_interface == interface_name):
650
886
return value.__get__(self)
679
915
# signatures other than "ay".
680
916
if prop._dbus_signature != "ay":
681
917
raise ValueError
682
value = dbus.ByteArray(''.join(unichr(byte)
683
for byte in value))
918
value = dbus.ByteArray(b''.join(chr(byte)
919
for byte in value))
684
920
prop(value)
685
921
686
922
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
691
927
692
928
Note: Will not include properties with access="write".
693
929
"""
694
all = {}
695
for name, prop in self._get_all_dbus_properties():
930
properties = {}
931
for name, prop in self._get_all_dbus_things("property"):
696
932
if (interface_name
697
933
and interface_name != prop._dbus_interface):
698
934
# Interface non-empty but did not match
702
938
continue
703
939
value = prop()
704
940
if not hasattr(value, "variant_level"):
705
all[name] = value
941
properties[name] = value
706
942
continue
707
all[name] = type(value)(value, variant_level=
708
value.variant_level+1)
709
return dbus.Dictionary(all, signature="sv")
943
properties[name] = type(value)(value, variant_level=
944
value.variant_level+1)
945
return dbus.Dictionary(properties, signature="sv")
710
946
711
947
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
712
948
out_signature="s",
713
949
path_keyword='object_path',
714
950
connection_keyword='connection')
715
951
def Introspect(self, object_path, connection):
716
"""Standard D-Bus method, overloaded to insert property tags.
952
"""Overloading of standard D-Bus method.
953
954
Inserts property tags and interface annotation tags.
717
955
"""
718
956
xmlstring = dbus.service.Object.Introspect(self, object_path,
719
957
connection)
726
964
e.setAttribute("access", prop._dbus_access)
727
965
return e
728
966
for if_tag in document.getElementsByTagName("interface"):
967
# Add property tags
729
968
for tag in (make_tag(document, name, prop)
730
969
for name, prop
731
in self._get_all_dbus_properties()
970
in self._get_all_dbus_things("property")
732
971
if prop._dbus_interface
733
972
== if_tag.getAttribute("name")):
734
973
if_tag.appendChild(tag)
974
# Add annotation tags
975
for typ in ("method", "signal", "property"):
976
for tag in if_tag.getElementsByTagName(typ):
977
annots = dict()
978
for name, prop in (self.
979
_get_all_dbus_things(typ)):
980
if (name == tag.getAttribute("name")
981
and prop._dbus_interface
982
== if_tag.getAttribute("name")):
983
annots.update(getattr
984
(prop,
985
"_dbus_annotations",
986
{}))
987
for name, value in annots.iteritems():
988
ann_tag = document.createElement(
989
"annotation")
990
ann_tag.setAttribute("name", name)
991
ann_tag.setAttribute("value", value)
992
tag.appendChild(ann_tag)
993
# Add interface annotation tags
994
for annotation, value in dict(
995
itertools.chain.from_iterable(
996
annotations().iteritems()
997
for name, annotations in
998
self._get_all_dbus_things("interface")
999
if name == if_tag.getAttribute("name")
1000
)).iteritems():
1001
ann_tag = document.createElement("annotation")
1002
ann_tag.setAttribute("name", annotation)
1003
ann_tag.setAttribute("value", value)
1004
if_tag.appendChild(ann_tag)
735
1005
# Add the names to the return values for the
736
1006
# "org.freedesktop.DBus.Properties" methods
737
1007
if (if_tag.getAttribute("name")
752
1022
except (AttributeError, xml.dom.DOMException,
753
1023
xml.parsers.expat.ExpatError) as error:
754
1024
logger.error("Failed to override Introspection method",
755
error)
1025
exc_info=error)
756
1026
return xmlstring
757
1027
758
1028
759
def datetime_to_dbus (dt, variant_level=0):
1029
def datetime_to_dbus(dt, variant_level=0):
760
1030
"""Convert a UTC datetime.datetime() to a D-Bus type."""
761
1031
if dt is None:
762
1032
return dbus.String("", variant_level = variant_level)
763
1033
return dbus.String(dt.isoformat(),
764
1034
variant_level=variant_level)
765
1035
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
767
.__metaclass__):
768
"""Applied to an empty subclass of a D-Bus object, this metaclass
769
will add additional D-Bus attributes matching a certain pattern.
1036
1037
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1038
"""A class decorator; applied to a subclass of
1039
dbus.service.Object, it will add alternate D-Bus attributes with
1040
interface names according to the "alt_interface_names" mapping.
1041
Usage:
1042
1043
@alternate_dbus_interfaces({"org.example.Interface":
1044
"net.example.AlternateInterface"})
1045
class SampleDBusObject(dbus.service.Object):
1046
@dbus.service.method("org.example.Interface")
1047
def SampleDBusMethod():
1048
pass
1049
1050
The above "SampleDBusMethod" on "SampleDBusObject" will be
1051
reachable via two interfaces: "org.example.Interface" and
1052
"net.example.AlternateInterface", the latter of which will have
1053
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1054
"true", unless "deprecate" is passed with a False value.
1055
1056
This works for methods and signals, and also for D-Bus properties
1057
(from DBusObjectWithProperties) and interfaces (from the
1058
dbus_interface_annotations decorator).
770
1059
"""
771
def __new__(mcs, name, bases, attr):
772
# Go through all the base classes which could have D-Bus
773
# methods, signals, or properties in them
774
for base in (b for b in bases
775
if issubclass(b, dbus.service.Object)):
776
# Go though all attributes of the base class
777
for attrname, attribute in inspect.getmembers(base):
1060
def wrapper(cls):
1061
for orig_interface_name, alt_interface_name in (
1062
alt_interface_names.iteritems()):
1063
attr = {}
1064
interface_names = set()
1065
# Go though all attributes of the class
1066
for attrname, attribute in inspect.getmembers(cls):
778
1067
# Ignore non-D-Bus attributes, and D-Bus attributes
779
1068
# with the wrong interface name
780
1069
if (not hasattr(attribute, "_dbus_interface")
781
1070
or not attribute._dbus_interface
782
.startswith("se.recompile.Mandos")):
1071
.startswith(orig_interface_name)):
783
1072
continue
784
1073
# Create an alternate D-Bus interface name based on
785
1074
# the current name
786
1075
alt_interface = (attribute._dbus_interface
787
.replace("se.recompile.Mandos",
788
"se.bsnet.fukt.Mandos"))
1076
.replace(orig_interface_name,
1077
alt_interface_name))
1078
interface_names.add(alt_interface)
789
1079
# Is this a D-Bus signal?
790
1080
if getattr(attribute, "_dbus_is_signal", False):
791
1081
# Extract the original non-method function by
806
1096
nonmethod_func.func_name,
807
1097
nonmethod_func.func_defaults,
808
1098
nonmethod_func.func_closure)))
1099
# Copy annotations, if any
1100
try:
1101
new_function._dbus_annotations = (
1102
dict(attribute._dbus_annotations))
1103
except AttributeError:
1104
pass
809
1105
# Define a creator of a function to call both the
810
# old and new functions, so both the old and new
811
# signals gets sent when the function is called
1106
# original and alternate functions, so both the
1107
# original and alternate signals gets sent when
1108
# the function is called
812
1109
def fixscope(func1, func2):
813
1110
"""This function is a scope container to pass
814
1111
func1 and func2 to the "call_both" function
821
1118
return call_both
822
1119
# Create the "call_both" function and add it to
823
1120
# the class
824
attr[attrname] = fixscope(attribute,
825
new_function)
1121
attr[attrname] = fixscope(attribute, new_function)
826
1122
# Is this a D-Bus method?
827
1123
elif getattr(attribute, "_dbus_is_method", False):
828
1124
# Create a new, but exactly alike, function
839
1135
attribute.func_name,
840
1136
attribute.func_defaults,
841
1137
attribute.func_closure)))
1138
# Copy annotations, if any
1139
try:
1140
attr[attrname]._dbus_annotations = (
1141
dict(attribute._dbus_annotations))
1142
except AttributeError:
1143
pass
842
1144
# Is this a D-Bus property?
843
1145
elif getattr(attribute, "_dbus_is_property", False):
844
1146
# Create a new, but exactly alike, function
858
1160
attribute.func_name,
859
1161
attribute.func_defaults,
860
1162
attribute.func_closure)))
861
return type.__new__(mcs, name, bases, attr)
862
1163
# Copy annotations, if any
1164
try:
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1167
except AttributeError:
1168
pass
1169
# Is this a D-Bus interface?
1170
elif getattr(attribute, "_dbus_is_interface", False):
1171
# Create a new, but exactly alike, function
1172
# object. Decorate it to be a new D-Bus interface
1173
# with the alternate D-Bus interface name. Add it
1174
# to the class.
1175
attr[attrname] = (dbus_interface_annotations
1176
(alt_interface)
1177
(types.FunctionType
1178
(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1183
if deprecate:
1184
# Deprecate all alternate interfaces
1185
iname="_AlternateDBusNames_interface_annotation{0}"
1186
for interface_name in interface_names:
1187
@dbus_interface_annotations(interface_name)
1188
def func(self):
1189
return { "org.freedesktop.DBus.Deprecated":
1190
"true" }
1191
# Find an unused name
1192
for aname in (iname.format(i)
1193
for i in itertools.count()):
1194
if aname not in attr:
1195
attr[aname] = func
1196
break
1197
if interface_names:
1198
# Replace the class with a new subclass of it with
1199
# methods, signals, etc. as created above.
1200
cls = type(b"{0}Alternate".format(cls.__name__),
1201
(cls,), attr)
1202
return cls
1203
return wrapper
1204
1205
1206
@alternate_dbus_interfaces({"se.recompile.Mandos":
1207
"se.bsnet.fukt.Mandos"})
863
1208
class ClientDBus(Client, DBusObjectWithProperties):
864
1209
"""A Client class using D-Bus
865
1210
874
1219
# dbus.service.Object doesn't use super(), so we can't either.
875
1220
876
1221
def __init__(self, bus = None, *args, **kwargs):
877
self._approvals_pending = 0
878
1222
self.bus = bus
879
1223
Client.__init__(self, *args, **kwargs)
880
1224
# Only now, when this client is initialized, can it show up on
886
1230
("/clients/" + client_object_name))
887
1231
DBusObjectWithProperties.__init__(self, self.bus,
888
1232
self.dbus_object_path)
889
1233
890
1234
def notifychangeproperty(transform_func,
891
1235
dbus_name, type_func=lambda x: x,
892
1236
variant_level=1):
893
1237
""" Modify a variable so that it's a property which announces
894
1238
its changes to DBus.
895
1239
896
1240
transform_fun: Function that takes a value and a variant_level
897
1241
and transforms it to a D-Bus type.
898
1242
dbus_name: D-Bus name of the variable
915
1259
916
1260
return property(lambda self: getattr(self, attrname), setter)
917
1261
918
919
1262
expires = notifychangeproperty(datetime_to_dbus, "Expires")
920
1263
approvals_pending = notifychangeproperty(dbus.Boolean,
921
1264
"ApprovalPending",
928
1271
checker is not None)
929
1272
last_checked_ok = notifychangeproperty(datetime_to_dbus,
930
1273
"LastCheckedOK")
1274
last_checker_status = notifychangeproperty(dbus.Int16,
1275
"LastCheckerStatus")
931
1276
last_approval_request = notifychangeproperty(
932
1277
datetime_to_dbus, "LastApprovalRequest")
933
1278
approved_by_default = notifychangeproperty(dbus.Boolean,
934
1279
"ApprovedByDefault")
935
approval_delay = notifychangeproperty(dbus.UInt16,
1280
approval_delay = notifychangeproperty(dbus.UInt64,
936
1281
"ApprovalDelay",
937
1282
type_func =
938
_timedelta_to_milliseconds)
1283
timedelta_to_milliseconds)
939
1284
approval_duration = notifychangeproperty(
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
1285
dbus.UInt64, "ApprovalDuration",
1286
type_func = timedelta_to_milliseconds)
942
1287
host = notifychangeproperty(dbus.String, "Host")
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1288
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
944
1289
type_func =
945
_timedelta_to_milliseconds)
1290
timedelta_to_milliseconds)
946
1291
extended_timeout = notifychangeproperty(
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
1292
dbus.UInt64, "ExtendedTimeout",
1293
type_func = timedelta_to_milliseconds)
1294
interval = notifychangeproperty(dbus.UInt64,
950
1295
"Interval",
951
1296
type_func =
952
_timedelta_to_milliseconds)
1297
timedelta_to_milliseconds)
953
1298
checker_command = notifychangeproperty(dbus.String, "Checker")
954
1299
955
1300
del notifychangeproperty
997
1342
return r
998
1343
999
1344
def _reset_approved(self):
1000
self._approved = None
1345
self.approved = None
1001
1346
return False
1002
1347
1003
1348
def approve(self, value=True):
1004
self.send_changedstate()
1005
self._approved = value
1006
gobject.timeout_add(_timedelta_to_milliseconds
1349
self.approved = value
1350
gobject.timeout_add(timedelta_to_milliseconds
1007
1351
(self.approval_duration),
1008
1352
self._reset_approved)
1009
1353
self.send_changedstate()
1010
1354
1011
1355
## D-Bus methods, signals & properties
1012
1356
_interface = "se.recompile.Mandos.Client"
1013
1357
1358
## Interfaces
1359
1360
@dbus_interface_annotations(_interface)
1361
def _foo(self):
1362
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1363
"false"}
1364
1014
1365
## Signals
1015
1366
1016
1367
# CheckerCompleted - signal
1115
1466
access="readwrite")
1116
1467
def ApprovalDuration_dbus_property(self, value=None):
1117
1468
if value is None: # get
1118
return dbus.UInt64(_timedelta_to_milliseconds(
1469
return dbus.UInt64(timedelta_to_milliseconds(
1119
1470
self.approval_duration))
1120
1471
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1121
1472
1135
1486
def Host_dbus_property(self, value=None):
1136
1487
if value is None: # get
1137
1488
return dbus.String(self.host)
1138
self.host = value
1489
self.host = unicode(value)
1139
1490
1140
1491
# Created - property
1141
1492
@dbus_service_property(_interface, signature="s", access="read")
1142
1493
def Created_dbus_property(self):
1143
return dbus.String(datetime_to_dbus(self.created))
1494
return datetime_to_dbus(self.created)
1144
1495
1145
1496
# LastEnabled - property
1146
1497
@dbus_service_property(_interface, signature="s", access="read")
1167
1518
return
1168
1519
return datetime_to_dbus(self.last_checked_ok)
1169
1520
1521
# LastCheckerStatus - property
1522
@dbus_service_property(_interface, signature="n",
1523
access="read")
1524
def LastCheckerStatus_dbus_property(self):
1525
return dbus.Int16(self.last_checker_status)
1526
1170
1527
# Expires - property
1171
1528
@dbus_service_property(_interface, signature="s", access="read")
1172
1529
def Expires_dbus_property(self):
1183
1540
def Timeout_dbus_property(self, value=None):
1184
1541
if value is None: # get
1185
1542
return dbus.UInt64(self.timeout_milliseconds())
1543
old_timeout = self.timeout
1186
1544
self.timeout = datetime.timedelta(0, 0, 0, value)
1187
if getattr(self, "disable_initiator_tag", None) is None:
1188
return
1189
# Reschedule timeout
1190
gobject.source_remove(self.disable_initiator_tag)
1191
self.disable_initiator_tag = None
1192
self.expires = None
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1198
if time_to_die <= 0:
1199
# The timeout has passed
1200
self.disable()
1201
else:
1202
self.expires = (datetime.datetime.utcnow()
1203
+ datetime.timedelta(milliseconds =
1204
time_to_die))
1205
self.disable_initiator_tag = (gobject.timeout_add
1206
(time_to_die, self.disable))
1545
# Reschedule disabling
1546
if self.enabled:
1547
now = datetime.datetime.utcnow()
1548
self.expires += self.timeout - old_timeout
1549
if self.expires <= now:
1550
# The timeout has passed
1551
self.disable()
1552
else:
1553
if (getattr(self, "disable_initiator_tag", None)
1554
is None):
1555
return
1556
gobject.source_remove(self.disable_initiator_tag)
1557
self.disable_initiator_tag = (
1558
gobject.timeout_add(
1559
timedelta_to_milliseconds(self.expires - now),
1560
self.disable))
1207
1561
1208
1562
# ExtendedTimeout - property
1209
1563
@dbus_service_property(_interface, signature="t",
1222
1576
self.interval = datetime.timedelta(0, 0, 0, value)
1223
1577
if getattr(self, "checker_initiator_tag", None) is None:
1224
1578
return
1225
# Reschedule checker run
1226
gobject.source_remove(self.checker_initiator_tag)
1227
self.checker_initiator_tag = (gobject.timeout_add
1228
(value, self.start_checker))
1229
self.start_checker() # Start one now, too
1579
if self.enabled:
1580
# Reschedule checker run
1581
gobject.source_remove(self.checker_initiator_tag)
1582
self.checker_initiator_tag = (gobject.timeout_add
1583
(value, self.start_checker))
1584
self.start_checker() # Start one now, too
1230
1585
1231
1586
# Checker - property
1232
1587
@dbus_service_property(_interface, signature="s",
1234
1589
def Checker_dbus_property(self, value=None):
1235
1590
if value is None: # get
1236
1591
return dbus.String(self.checker_command)
1237
self.checker_command = value
1592
self.checker_command = unicode(value)
1238
1593
1239
1594
# CheckerRunning - property
1240
1595
@dbus_service_property(_interface, signature="b",
1269
1624
raise KeyError()
1270
1625
1271
1626
def __getattribute__(self, name):
1272
if(name == '_pipe'):
1627
if name == '_pipe':
1273
1628
return super(ProxyClient, self).__getattribute__(name)
1274
1629
self._pipe.send(('getattr', name))
1275
1630
data = self._pipe.recv()
1282
1637
return func
1283
1638
1284
1639
def __setattr__(self, name, value):
1285
if(name == '_pipe'):
1640
if name == '_pipe':
1286
1641
return super(ProxyClient, self).__setattr__(name, value)
1287
1642
self._pipe.send(('setattr', name, value))
1288
1643
1289
class ClientDBusTransitional(ClientDBus):
1290
__metaclass__ = AlternateDBusNamesMetaclass
1291
1644
1292
1645
class ClientHandler(socketserver.BaseRequestHandler, object):
1293
1646
"""A class to handle client connections.
1376
1729
client.Rejected("Disabled")
1377
1730
return
1378
1731
1379
if client._approved or not client.approval_delay:
1732
if client.approved or not client.approval_delay:
1380
1733
#We are approved or approval is disabled
1381
1734
break
1382
elif client._approved is None:
1735
elif client.approved is None:
1383
1736
logger.info("Client %s needs approval",
1384
1737
client.name)
1385
1738
if self.server.use_dbus:
1398
1751
#wait until timeout or approved
1399
1752
time = datetime.datetime.now()
1400
1753
client.changedstate.acquire()
1401
(client.changedstate.wait
1402
(float(client._timedelta_to_milliseconds(delay)
1403
/ 1000)))
1754
client.changedstate.wait(
1755
float(timedelta_to_milliseconds(delay)
1756
/ 1000))
1404
1757
client.changedstate.release()
1405
1758
time2 = datetime.datetime.now()
1406
1759
if (time2 - time) >= delay:
1422
1775
try:
1423
1776
sent = session.send(client.secret[sent_size:])
1424
1777
except gnutls.errors.GNUTLSError as error:
1425
logger.warning("gnutls send failed")
1778
logger.warning("gnutls send failed",
1779
exc_info=error)
1426
1780
return
1427
1781
logger.debug("Sent: %d, remaining: %d",
1428
1782
sent, len(client.secret)
1431
1785
1432
1786
logger.info("Sending secret to %s", client.name)
1433
1787
# bump the timeout using extended_timeout
1434
client.checked_ok(client.extended_timeout)
1788
client.bump_timeout(client.extended_timeout)
1435
1789
if self.server.use_dbus:
1436
1790
# Emit D-Bus signal
1437
1791
client.GotSecret()
1442
1796
try:
1443
1797
session.bye()
1444
1798
except gnutls.errors.GNUTLSError as error:
1445
logger.warning("GnuTLS bye failed")
1799
logger.warning("GnuTLS bye failed",
1800
exc_info=error)
1446
1801
1447
1802
@staticmethod
1448
1803
def peer_certificate(session):
1504
1859
# Convert the buffer to a Python bytestring
1505
1860
fpr = ctypes.string_at(buf, buf_len.value)
1506
1861
# Convert the bytestring to hexadecimal notation
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1862
hex_fpr = binascii.hexlify(fpr).upper()
1508
1863
return hex_fpr
1509
1864
1510
1865
1513
1868
def sub_process_main(self, request, address):
1514
1869
try:
1515
1870
self.finish_request(request, address)
1516
except:
1871
except Exception:
1517
1872
self.handle_error(request, address)
1518
1873
self.close_request(request)
1519
1874
1520
1875
def process_request(self, request, address):
1521
1876
"""Start a new process to process the request."""
1522
1877
proc = multiprocessing.Process(target = self.sub_process_main,
1523
args = (request,
1524
address))
1878
args = (request, address))
1525
1879
proc.start()
1526
1880
return proc
1527
1881
1555
1909
use_ipv6: Boolean; to use IPv6 or not
1556
1910
"""
1557
1911
def __init__(self, server_address, RequestHandlerClass,
1558
interface=None, use_ipv6=True):
1912
interface=None, use_ipv6=True, socketfd=None):
1913
"""If socketfd is set, use that file descriptor instead of
1914
creating a new one with socket.socket().
1915
"""
1559
1916
self.interface = interface
1560
1917
if use_ipv6:
1561
1918
self.address_family = socket.AF_INET6
1919
if socketfd is not None:
1920
# Save the file descriptor
1921
self.socketfd = socketfd
1922
# Save the original socket.socket() function
1923
self.socket_socket = socket.socket
1924
# To implement --socket, we monkey patch socket.socket.
1925
#
1926
# (When socketserver.TCPServer is a new-style class, we
1927
# could make self.socket into a property instead of monkey
1928
# patching socket.socket.)
1929
#
1930
# Create a one-time-only replacement for socket.socket()
1931
@functools.wraps(socket.socket)
1932
def socket_wrapper(*args, **kwargs):
1933
# Restore original function so subsequent calls are
1934
# not affected.
1935
socket.socket = self.socket_socket
1936
del self.socket_socket
1937
# This time only, return a new socket object from the
1938
# saved file descriptor.
1939
return socket.fromfd(self.socketfd, *args, **kwargs)
1940
# Replace socket.socket() function with wrapper
1941
socket.socket = socket_wrapper
1942
# The socketserver.TCPServer.__init__ will call
1943
# socket.socket(), which might be our replacement,
1944
# socket_wrapper(), if socketfd was set.
1562
1945
socketserver.TCPServer.__init__(self, server_address,
1563
1946
RequestHandlerClass)
1947
1564
1948
def server_bind(self):
1565
1949
"""This overrides the normal server_bind() function
1566
1950
to bind to an interface if one was specified, and also NOT to
1574
1958
try:
1575
1959
self.socket.setsockopt(socket.SOL_SOCKET,
1576
1960
SO_BINDTODEVICE,
1577
str(self.interface
1578
+ '\0'))
1961
str(self.interface + '\0'))
1579
1962
except socket.error as error:
1580
if error[0] == errno.EPERM:
1581
logger.error("No permission to"
1582
" bind to interface %s",
1583
self.interface)
1584
elif error[0] == errno.ENOPROTOOPT:
1963
if error.errno == errno.EPERM:
1964
logger.error("No permission to bind to"
1965
" interface %s", self.interface)
1966
elif error.errno == errno.ENOPROTOOPT:
1585
1967
logger.error("SO_BINDTODEVICE not available;"
1586
1968
" cannot bind to interface %s",
1587
1969
self.interface)
1970
elif error.errno == errno.ENODEV:
1971
logger.error("Interface %s does not exist,"
1972
" cannot bind", self.interface)
1588
1973
else:
1589
1974
raise
1590
1975
# Only bind(2) the socket if we really need to.
1620
2005
"""
1621
2006
def __init__(self, server_address, RequestHandlerClass,
1622
2007
interface=None, use_ipv6=True, clients=None,
1623
gnutls_priority=None, use_dbus=True):
2008
gnutls_priority=None, use_dbus=True, socketfd=None):
1624
2009
self.enabled = False
1625
2010
self.clients = clients
1626
2011
if self.clients is None:
1627
self.clients = set()
2012
self.clients = {}
1628
2013
self.use_dbus = use_dbus
1629
2014
self.gnutls_priority = gnutls_priority
1630
2015
IPv6_TCPServer.__init__(self, server_address,
1631
2016
RequestHandlerClass,
1632
2017
interface = interface,
1633
use_ipv6 = use_ipv6)
2018
use_ipv6 = use_ipv6,
2019
socketfd = socketfd)
1634
2020
def server_activate(self):
1635
2021
if self.enabled:
1636
2022
return socketserver.TCPServer.server_activate(self)
1649
2035
1650
2036
def handle_ipc(self, source, condition, parent_pipe=None,
1651
2037
proc = None, client_object=None):
1652
condition_names = {
1653
gobject.IO_IN: "IN", # There is data to read.
1654
gobject.IO_OUT: "OUT", # Data can be written (without
1655
# blocking).
1656
gobject.IO_PRI: "PRI", # There is urgent data to read.
1657
gobject.IO_ERR: "ERR", # Error condition.
1658
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1659
# broken, usually for pipes and
1660
# sockets).
1661
}
1662
conditions_string = ' | '.join(name
1663
for cond, name in
1664
condition_names.iteritems()
1665
if cond & condition)
1666
2038
# error, or the other end of multiprocessing.Pipe has closed
1667
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2039
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1668
2040
# Wait for other process to exit
1669
2041
proc.join()
1670
2042
return False
1677
2049
fpr = request[1]
1678
2050
address = request[2]
1679
2051
1680
for c in self.clients:
2052
for c in self.clients.itervalues():
1681
2053
if c.fingerprint == fpr:
1682
2054
client = c
1683
2055
break
1728
2100
return True
1729
2101
1730
2102
2103
def rfc3339_duration_to_delta(duration):
2104
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2105
2106
>>> rfc3339_duration_to_delta("P7D")
2107
datetime.timedelta(7)
2108
>>> rfc3339_duration_to_delta("PT60S")
2109
datetime.timedelta(0, 60)
2110
>>> rfc3339_duration_to_delta("PT60M")
2111
datetime.timedelta(0, 3600)
2112
>>> rfc3339_duration_to_delta("PT24H")
2113
datetime.timedelta(1)
2114
>>> rfc3339_duration_to_delta("P1W")
2115
datetime.timedelta(7)
2116
>>> rfc3339_duration_to_delta("PT5M30S")
2117
datetime.timedelta(0, 330)
2118
>>> rfc3339_duration_to_delta("P1DT3M20S")
2119
datetime.timedelta(1, 200)
2120
"""
2121
2122
# Parsing an RFC 3339 duration with regular expressions is not
2123
# possible - there would have to be multiple places for the same
2124
# values, like seconds. The current code, while more esoteric, is
2125
# cleaner without depending on a parsing library. If Python had a
2126
# built-in library for parsing we would use it, but we'd like to
2127
# avoid excessive use of external libraries.
2128
2129
# New type for defining tokens, syntax, and semantics all-in-one
2130
Token = collections.namedtuple("Token",
2131
("regexp", # To match token; if
2132
# "value" is not None,
2133
# must have a "group"
2134
# containing digits
2135
"value", # datetime.timedelta or
2136
# None
2137
"followers")) # Tokens valid after
2138
# this token
2139
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2140
# the "duration" ABNF definition in RFC 3339, Appendix A.
2141
token_end = Token(re.compile(r"$"), None, frozenset())
2142
token_second = Token(re.compile(r"(\d+)S"),
2143
datetime.timedelta(seconds=1),
2144
frozenset((token_end,)))
2145
token_minute = Token(re.compile(r"(\d+)M"),
2146
datetime.timedelta(minutes=1),
2147
frozenset((token_second, token_end)))
2148
token_hour = Token(re.compile(r"(\d+)H"),
2149
datetime.timedelta(hours=1),
2150
frozenset((token_minute, token_end)))
2151
token_time = Token(re.compile(r"T"),
2152
None,
2153
frozenset((token_hour, token_minute,
2154
token_second)))
2155
token_day = Token(re.compile(r"(\d+)D"),
2156
datetime.timedelta(days=1),
2157
frozenset((token_time, token_end)))
2158
token_month = Token(re.compile(r"(\d+)M"),
2159
datetime.timedelta(weeks=4),
2160
frozenset((token_day, token_end)))
2161
token_year = Token(re.compile(r"(\d+)Y"),
2162
datetime.timedelta(weeks=52),
2163
frozenset((token_month, token_end)))
2164
token_week = Token(re.compile(r"(\d+)W"),
2165
datetime.timedelta(weeks=1),
2166
frozenset((token_end,)))
2167
token_duration = Token(re.compile(r"P"), None,
2168
frozenset((token_year, token_month,
2169
token_day, token_time,
2170
token_week))),
2171
# Define starting values
2172
value = datetime.timedelta() # Value so far
2173
found_token = None
2174
followers = frozenset(token_duration,) # Following valid tokens
2175
s = duration # String left to parse
2176
# Loop until end token is found
2177
while found_token is not token_end:
2178
# Search for any currently valid tokens
2179
for token in followers:
2180
match = token.regexp.match(s)
2181
if match is not None:
2182
# Token found
2183
if token.value is not None:
2184
# Value found, parse digits
2185
factor = int(match.group(1), 10)
2186
# Add to value so far
2187
value += factor * token.value
2188
# Strip token from string
2189
s = token.regexp.sub("", s, 1)
2190
# Go to found token
2191
found_token = token
2192
# Set valid next tokens
2193
followers = found_token.followers
2194
break
2195
else:
2196
# No currently valid tokens were found
2197
raise ValueError("Invalid RFC 3339 duration")
2198
# End token found
2199
return value
2200
2201
1731
2202
def string_to_delta(interval):
1732
2203
"""Parse a string and return a datetime.timedelta
1733
2204
1744
2215
>>> string_to_delta('5m 30s')
1745
2216
datetime.timedelta(0, 330)
1746
2217
"""
2218
2219
try:
2220
return rfc3339_duration_to_delta(interval)
2221
except ValueError:
2222
pass
2223
1747
2224
timevalue = datetime.timedelta(0)
1748
2225
for s in interval.split():
1749
2226
try:
1760
2237
elif suffix == "w":
1761
2238
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1762
2239
else:
1763
raise ValueError("Unknown suffix %r" % suffix)
2240
raise ValueError("Unknown suffix {0!r}"
2241
.format(suffix))
1764
2242
except (ValueError, IndexError) as e:
1765
2243
raise ValueError(*(e.args))
1766
2244
timevalue += delta
1767
2245
return timevalue
1768
2246
1769
2247
1770
def if_nametoindex(interface):
1771
"""Call the C function if_nametoindex(), or equivalent
1772
1773
Note: This function cannot accept a unicode string."""
1774
global if_nametoindex
1775
try:
1776
if_nametoindex = (ctypes.cdll.LoadLibrary
1777
(ctypes.util.find_library("c"))
1778
.if_nametoindex)
1779
except (OSError, AttributeError):
1780
logger.warning("Doing if_nametoindex the hard way")
1781
def if_nametoindex(interface):
1782
"Get an interface index the hard way, i.e. using fcntl()"
1783
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1784
with contextlib.closing(socket.socket()) as s:
1785
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
struct.pack(str("16s16x"),
1787
interface))
1788
interface_index = struct.unpack(str("I"),
1789
ifreq[16:20])[0]
1790
return interface_index
1791
return if_nametoindex(interface)
1792
1793
1794
2248
def daemon(nochdir = False, noclose = False):
1795
2249
"""See daemon(3). Standard BSD Unix function.
1796
2250
1804
2258
sys.exit()
1805
2259
if not noclose:
1806
2260
# Close all standard open file descriptors
1807
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2261
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1808
2262
if not stat.S_ISCHR(os.fstat(null).st_mode):
1809
2263
raise OSError(errno.ENODEV,
1810
"%s not a character device"
1811
% os.path.devnull)
2264
"{0} not a character device"
2265
.format(os.devnull))
1812
2266
os.dup2(null, sys.stdin.fileno())
1813
2267
os.dup2(null, sys.stdout.fileno())
1814
2268
os.dup2(null, sys.stderr.fileno())
1823
2277
1824
2278
parser = argparse.ArgumentParser()
1825
2279
parser.add_argument("-v", "--version", action="version",
1826
version = "%%(prog)s %s" % version,
2280
version = "%(prog)s {0}".format(version),
1827
2281
help="show version number and exit")
1828
2282
parser.add_argument("-i", "--interface", metavar="IF",
1829
2283
help="Bind to interface IF")
1851
2305
" system bus interface")
1852
2306
parser.add_argument("--no-ipv6", action="store_false",
1853
2307
dest="use_ipv6", help="Do not use IPv6")
2308
parser.add_argument("--no-restore", action="store_false",
2309
dest="restore", help="Do not restore stored"
2310
" state")
2311
parser.add_argument("--socket", type=int,
2312
help="Specify a file descriptor to a network"
2313
" socket to use instead of creating one")
2314
parser.add_argument("--statedir", metavar="DIR",
2315
help="Directory to save/restore state in")
2316
parser.add_argument("--foreground", action="store_true",
2317
help="Run in foreground")
2318
1854
2319
options = parser.parse_args()
1855
2320
1856
2321
if options.check:
1869
2334
"use_dbus": "True",
1870
2335
"use_ipv6": "True",
1871
2336
"debuglevel": "",
2337
"restore": "True",
2338
"socket": "",
2339
"statedir": "/var/lib/mandos",
2340
"foreground": "False",
1872
2341
}
1873
2342
1874
2343
# Parse config file for server-global settings
1879
2348
# Convert the SafeConfigParser object to a dict
1880
2349
server_settings = server_config.defaults()
1881
2350
# Use the appropriate methods on the non-string config options
1882
for option in ("debug", "use_dbus", "use_ipv6"):
2351
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1883
2352
server_settings[option] = server_config.getboolean("DEFAULT",
1884
2353
option)
1885
2354
if server_settings["port"]:
1886
2355
server_settings["port"] = server_config.getint("DEFAULT",
1887
2356
"port")
2357
if server_settings["socket"]:
2358
server_settings["socket"] = server_config.getint("DEFAULT",
2359
"socket")
2360
# Later, stdin will, and stdout and stderr might, be dup'ed
2361
# over with an opened os.devnull. But we don't want this to
2362
# happen with a supplied network socket.
2363
if 0 <= server_settings["socket"] <= 2:
2364
server_settings["socket"] = os.dup(server_settings
2365
["socket"])
1888
2366
del server_config
1889
2367
1890
2368
# Override the settings from the config file with command line
1891
2369
# options, if set.
1892
2370
for option in ("interface", "address", "port", "debug",
1893
2371
"priority", "servicename", "configdir",
1894
"use_dbus", "use_ipv6", "debuglevel"):
2372
"use_dbus", "use_ipv6", "debuglevel", "restore",
2373
"statedir", "socket", "foreground"):
1895
2374
value = getattr(options, option)
1896
2375
if value is not None:
1897
2376
server_settings[option] = value
1900
2379
for option in server_settings.keys():
1901
2380
if type(server_settings[option]) is str:
1902
2381
server_settings[option] = unicode(server_settings[option])
2382
# Debug implies foreground
2383
if server_settings["debug"]:
2384
server_settings["foreground"] = True
1903
2385
# Now we have our good server settings in "server_settings"
1904
2386
1905
2387
##################################################################
1909
2391
debuglevel = server_settings["debuglevel"]
1910
2392
use_dbus = server_settings["use_dbus"]
1911
2393
use_ipv6 = server_settings["use_ipv6"]
2394
stored_state_path = os.path.join(server_settings["statedir"],
2395
stored_state_file)
2396
foreground = server_settings["foreground"]
2397
2398
if debug:
2399
initlogger(debug, logging.DEBUG)
2400
else:
2401
if not debuglevel:
2402
initlogger(debug)
2403
else:
2404
level = getattr(logging, debuglevel.upper())
2405
initlogger(debug, level)
1912
2406
1913
2407
if server_settings["servicename"] != "Mandos":
1914
2408
syslogger.setFormatter(logging.Formatter
1915
('Mandos (%s) [%%(process)d]:'
1916
' %%(levelname)s: %%(message)s'
1917
% server_settings["servicename"]))
2409
('Mandos ({0}) [%(process)d]:'
2410
' %(levelname)s: %(message)s'
2411
.format(server_settings
2412
["servicename"])))
1918
2413
1919
2414
# Parse config file with clients
1920
client_defaults = { "timeout": "5m",
1921
"extended_timeout": "15m",
1922
"interval": "2m",
1923
"checker": "fping -q -- %%(host)s",
1924
"host": "",
1925
"approval_delay": "0s",
1926
"approval_duration": "1s",
1927
}
1928
client_config = configparser.SafeConfigParser(client_defaults)
2415
client_config = configparser.SafeConfigParser(Client
2416
.client_defaults)
1929
2417
client_config.read(os.path.join(server_settings["configdir"],
1930
2418
"clients.conf"))
1931
2419
1940
2428
use_ipv6=use_ipv6,
1941
2429
gnutls_priority=
1942
2430
server_settings["priority"],
1943
use_dbus=use_dbus)
1944
if not debug:
2431
use_dbus=use_dbus,
2432
socketfd=(server_settings["socket"]
2433
or None))
2434
if not foreground:
1945
2435
pidfilename = "/var/run/mandos.pid"
2436
pidfile = None
1946
2437
try:
1947
2438
pidfile = open(pidfilename, "w")
1948
except IOError:
1949
logger.error("Could not open file %r", pidfilename)
2439
except IOError as e:
2440
logger.error("Could not open file %r", pidfilename,
2441
exc_info=e)
1950
2442
1951
try:
1952
uid = pwd.getpwnam("_mandos").pw_uid
1953
gid = pwd.getpwnam("_mandos").pw_gid
1954
except KeyError:
2443
for name in ("_mandos", "mandos", "nobody"):
1955
2444
try:
1956
uid = pwd.getpwnam("mandos").pw_uid
1957
gid = pwd.getpwnam("mandos").pw_gid
2445
uid = pwd.getpwnam(name).pw_uid
2446
gid = pwd.getpwnam(name).pw_gid
2447
break
1958
2448
except KeyError:
1959
try:
1960
uid = pwd.getpwnam("nobody").pw_uid
1961
gid = pwd.getpwnam("nobody").pw_gid
1962
except KeyError:
1963
uid = 65534
1964
gid = 65534
2449
continue
2450
else:
2451
uid = 65534
2452
gid = 65534
1965
2453
try:
1966
2454
os.setgid(gid)
1967
2455
os.setuid(uid)
1968
2456
except OSError as error:
1969
if error[0] != errno.EPERM:
2457
if error.errno != errno.EPERM:
1970
2458
raise error
1971
2459
1972
if not debug and not debuglevel:
1973
syslogger.setLevel(logging.WARNING)
1974
console.setLevel(logging.WARNING)
1975
if debuglevel:
1976
level = getattr(logging, debuglevel.upper())
1977
syslogger.setLevel(level)
1978
console.setLevel(level)
1979
1980
2460
if debug:
1981
2461
# Enable all possible GnuTLS debugging
1982
2462
1992
2472
.gnutls_global_set_log_function(debug_gnutls))
1993
2473
1994
2474
# Redirect stdin so all checkers get /dev/null
1995
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2475
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1996
2476
os.dup2(null, sys.stdin.fileno())
1997
2477
if null > 2:
1998
2478
os.close(null)
1999
else:
2000
# No console logging
2001
logger.removeHandler(console)
2002
2479
2003
2480
# Need to fork before connecting to D-Bus
2004
if not debug:
2481
if not foreground:
2005
2482
# Close all input and output, do double fork, etc.
2006
2483
daemon()
2007
2484
2485
# multiprocessing will use threads, so before we use gobject we
2486
# need to inform gobject that threads will be used.
2487
gobject.threads_init()
2488
2008
2489
global main_loop
2009
2490
# From the Avahi example code
2010
DBusGMainLoop(set_as_default=True )
2491
DBusGMainLoop(set_as_default=True)
2011
2492
main_loop = gobject.MainLoop()
2012
2493
bus = dbus.SystemBus()
2013
2494
# End of Avahi example code
2019
2500
("se.bsnet.fukt.Mandos", bus,
2020
2501
do_not_queue=True))
2021
2502
except dbus.exceptions.NameExistsException as e:
2022
logger.error(unicode(e) + ", disabling D-Bus")
2503
logger.error("Disabling D-Bus:", exc_info=e)
2023
2504
use_dbus = False
2024
2505
server_settings["use_dbus"] = False
2025
2506
tcp_server.use_dbus = False
2026
2507
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
2029
protocol = protocol, bus = bus)
2508
service = AvahiServiceToSyslog(name =
2509
server_settings["servicename"],
2510
servicetype = "_mandos._tcp",
2511
protocol = protocol, bus = bus)
2030
2512
if server_settings["interface"]:
2031
2513
service.interface = (if_nametoindex
2032
2514
(str(server_settings["interface"])))
2036
2518
2037
2519
client_class = Client
2038
2520
if use_dbus:
2039
client_class = functools.partial(ClientDBusTransitional,
2040
bus = bus)
2041
def client_config_items(config, section):
2042
special_settings = {
2043
"approved_by_default":
2044
lambda: config.getboolean(section,
2045
"approved_by_default"),
2046
}
2047
for name, value in config.items(section):
2521
client_class = functools.partial(ClientDBus, bus = bus)
2522
2523
client_settings = Client.config_parser(client_config)
2524
old_client_settings = {}
2525
clients_data = {}
2526
2527
# Get client data and settings from last running state.
2528
if server_settings["restore"]:
2529
try:
2530
with open(stored_state_path, "rb") as stored_state:
2531
clients_data, old_client_settings = (pickle.load
2532
(stored_state))
2533
os.remove(stored_state_path)
2534
except IOError as e:
2535
if e.errno == errno.ENOENT:
2536
logger.warning("Could not load persistent state: {0}"
2537
.format(os.strerror(e.errno)))
2538
else:
2539
logger.critical("Could not load persistent state:",
2540
exc_info=e)
2541
raise
2542
except EOFError as e:
2543
logger.warning("Could not load persistent state: "
2544
"EOFError:", exc_info=e)
2545
2546
with PGPEngine() as pgp:
2547
for client_name, client in clients_data.iteritems():
2548
# Decide which value to use after restoring saved state.
2549
# We have three different values: Old config file,
2550
# new config file, and saved state.
2551
# New config value takes precedence if it differs from old
2552
# config value, otherwise use saved state.
2553
for name, value in client_settings[client_name].items():
2554
try:
2555
# For each value in new config, check if it
2556
# differs from the old config value (Except for
2557
# the "secret" attribute)
2558
if (name != "secret" and
2559
value != old_client_settings[client_name]
2560
[name]):
2561
client[name] = value
2562
except KeyError:
2563
pass
2564
2565
# Clients who has passed its expire date can still be
2566
# enabled if its last checker was successful. Clients
2567
# whose checker succeeded before we stored its state is
2568
# assumed to have successfully run all checkers during
2569
# downtime.
2570
if client["enabled"]:
2571
if datetime.datetime.utcnow() >= client["expires"]:
2572
if not client["last_checked_ok"]:
2573
logger.warning(
2574
"disabling client {0} - Client never "
2575
"performed a successful checker"
2576
.format(client_name))
2577
client["enabled"] = False
2578
elif client["last_checker_status"] != 0:
2579
logger.warning(
2580
"disabling client {0} - Client "
2581
"last checker failed with error code {1}"
2582
.format(client_name,
2583
client["last_checker_status"]))
2584
client["enabled"] = False
2585
else:
2586
client["expires"] = (datetime.datetime
2587
.utcnow()
2588
+ client["timeout"])
2589
logger.debug("Last checker succeeded,"
2590
" keeping {0} enabled"
2591
.format(client_name))
2048
2592
try:
2049
yield (name, special_settings[name]())
2050
except KeyError:
2051
yield (name, value)
2052
2053
tcp_server.clients.update(set(
2054
client_class(name = section,
2055
config= dict(client_config_items(
2056
client_config, section)))
2057
for section in client_config.sections()))
2593
client["secret"] = (
2594
pgp.decrypt(client["encrypted_secret"],
2595
client_settings[client_name]
2596
["secret"]))
2597
except PGPError:
2598
# If decryption fails, we use secret from new settings
2599
logger.debug("Failed to decrypt {0} old secret"
2600
.format(client_name))
2601
client["secret"] = (
2602
client_settings[client_name]["secret"])
2603
2604
# Add/remove clients based on new changes made to config
2605
for client_name in (set(old_client_settings)
2606
- set(client_settings)):
2607
del clients_data[client_name]
2608
for client_name in (set(client_settings)
2609
- set(old_client_settings)):
2610
clients_data[client_name] = client_settings[client_name]
2611
2612
# Create all client objects
2613
for client_name, client in clients_data.iteritems():
2614
tcp_server.clients[client_name] = client_class(
2615
name = client_name, settings = client)
2616
2058
2617
if not tcp_server.clients:
2059
2618
logger.warning("No clients defined")
2060
2061
if not debug:
2062
try:
2063
with pidfile:
2064
pid = os.getpid()
2065
pidfile.write(str(pid) + "\n".encode("utf-8"))
2066
del pidfile
2067
except IOError:
2068
logger.error("Could not write to file %r with PID %d",
2069
pidfilename, pid)
2070
except NameError:
2071
# "pidfile" was never created
2072
pass
2619
2620
if not foreground:
2621
if pidfile is not None:
2622
try:
2623
with pidfile:
2624
pid = os.getpid()
2625
pidfile.write(str(pid) + "\n".encode("utf-8"))
2626
except IOError:
2627
logger.error("Could not write to file %r with PID %d",
2628
pidfilename, pid)
2629
del pidfile
2073
2630
del pidfilename
2074
2075
signal.signal(signal.SIGINT, signal.SIG_IGN)
2076
2631
2077
2632
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2078
2633
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2079
2634
2080
2635
if use_dbus:
2081
class MandosDBusService(dbus.service.Object):
2636
@alternate_dbus_interfaces({"se.recompile.Mandos":
2637
"se.bsnet.fukt.Mandos"})
2638
class MandosDBusService(DBusObjectWithProperties):
2082
2639
"""A D-Bus proxy object"""
2083
2640
def __init__(self):
2084
2641
dbus.service.Object.__init__(self, bus, "/")
2085
2642
_interface = "se.recompile.Mandos"
2086
2643
2644
@dbus_interface_annotations(_interface)
2645
def _foo(self):
2646
return { "org.freedesktop.DBus.Property"
2647
".EmitsChangedSignal":
2648
"false"}
2649
2087
2650
@dbus.service.signal(_interface, signature="o")
2088
2651
def ClientAdded(self, objpath):
2089
2652
"D-Bus signal"
2103
2666
def GetAllClients(self):
2104
2667
"D-Bus method"
2105
2668
return dbus.Array(c.dbus_object_path
2106
for c in tcp_server.clients)
2669
for c in
2670
tcp_server.clients.itervalues())
2107
2671
2108
2672
@dbus.service.method(_interface,
2109
2673
out_signature="a{oa{sv}}")
2111
2675
"D-Bus method"
2112
2676
return dbus.Dictionary(
2113
2677
((c.dbus_object_path, c.GetAll(""))
2114
for c in tcp_server.clients),
2678
for c in tcp_server.clients.itervalues()),
2115
2679
signature="oa{sv}")
2116
2680
2117
2681
@dbus.service.method(_interface, in_signature="o")
2118
2682
def RemoveClient(self, object_path):
2119
2683
"D-Bus method"
2120
for c in tcp_server.clients:
2684
for c in tcp_server.clients.itervalues():
2121
2685
if c.dbus_object_path == object_path:
2122
tcp_server.clients.remove(c)
2686
del tcp_server.clients[c.name]
2123
2687
c.remove_from_connection()
2124
2688
# Don't signal anything except ClientRemoved
2125
2689
c.disable(quiet=True)
2130
2694
2131
2695
del _interface
2132
2696
2133
class MandosDBusServiceTransitional(MandosDBusService):
2134
__metaclass__ = AlternateDBusNamesMetaclass
2135
mandos_dbus_service = MandosDBusServiceTransitional()
2697
mandos_dbus_service = MandosDBusService()
2136
2698
2137
2699
def cleanup():
2138
2700
"Cleanup function; run on exit"
2139
2701
service.cleanup()
2140
2702
2141
2703
multiprocessing.active_children()
2704
if not (tcp_server.clients or client_settings):
2705
return
2706
2707
# Store client before exiting. Secrets are encrypted with key
2708
# based on what config file has. If config file is
2709
# removed/edited, old secret will thus be unrecovable.
2710
clients = {}
2711
with PGPEngine() as pgp:
2712
for client in tcp_server.clients.itervalues():
2713
key = client_settings[client.name]["secret"]
2714
client.encrypted_secret = pgp.encrypt(client.secret,
2715
key)
2716
client_dict = {}
2717
2718
# A list of attributes that can not be pickled
2719
# + secret.
2720
exclude = set(("bus", "changedstate", "secret",
2721
"checker"))
2722
for name, typ in (inspect.getmembers
2723
(dbus.service.Object)):
2724
exclude.add(name)
2725
2726
client_dict["encrypted_secret"] = (client
2727
.encrypted_secret)
2728
for attr in client.client_structure:
2729
if attr not in exclude:
2730
client_dict[attr] = getattr(client, attr)
2731
2732
clients[client.name] = client_dict
2733
del client_settings[client.name]["secret"]
2734
2735
try:
2736
with (tempfile.NamedTemporaryFile
2737
(mode='wb', suffix=".pickle", prefix='clients-',
2738
dir=os.path.dirname(stored_state_path),
2739
delete=False)) as stored_state:
2740
pickle.dump((clients, client_settings), stored_state)
2741
tempname=stored_state.name
2742
os.rename(tempname, stored_state_path)
2743
except (IOError, OSError) as e:
2744
if not debug:
2745
try:
2746
os.remove(tempname)
2747
except NameError:
2748
pass
2749
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2750
logger.warning("Could not save persistent state: {0}"
2751
.format(os.strerror(e.errno)))
2752
else:
2753
logger.warning("Could not save persistent state:",
2754
exc_info=e)
2755
raise e
2756
2757
# Delete all clients, and settings from config
2142
2758
while tcp_server.clients:
2143
client = tcp_server.clients.pop()
2759
name, client = tcp_server.clients.popitem()
2144
2760
if use_dbus:
2145
2761
client.remove_from_connection()
2146
client.disable_hook = None
2147
2762
# Don't signal anything except ClientRemoved
2148
2763
client.disable(quiet=True)
2149
2764
if use_dbus:
2151
2766
mandos_dbus_service.ClientRemoved(client
2152
2767
.dbus_object_path,
2153
2768
client.name)
2769
client_settings.clear()
2154
2770
2155
2771
atexit.register(cleanup)
2156
2772
2157
for client in tcp_server.clients:
2773
for client in tcp_server.clients.itervalues():
2158
2774
if use_dbus:
2159
2775
# Emit D-Bus signal
2160
2776
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2161
client.enable()
2777
# Need to initiate checking of clients
2778
if client.enabled:
2779
client.init_checker()
2162
2780
2163
2781
tcp_server.enable()
2164
2782
tcp_server.server_activate()
2167
2785
service.port = tcp_server.socket.getsockname()[1]
2168
2786
if use_ipv6:
2169
2787
logger.info("Now listening on address %r, port %d,"
2170
" flowinfo %d, scope_id %d"
2171
% tcp_server.socket.getsockname())
2788
" flowinfo %d, scope_id %d",
2789
*tcp_server.socket.getsockname())
2172
2790
else: # IPv4
2173
logger.info("Now listening on address %r, port %d"
2174
% tcp_server.socket.getsockname())
2791
logger.info("Now listening on address %r, port %d",
2792
*tcp_server.socket.getsockname())
2175
2793
2176
2794
#service.interface = tcp_server.socket.getsockname()[3]
2177
2795
2180
2798
try:
2181
2799
service.activate()
2182
2800
except dbus.exceptions.DBusException as error:
2183
logger.critical("DBusException: %s", error)
2801
logger.critical("D-Bus Exception", exc_info=error)
2184
2802
cleanup()
2185
2803
sys.exit(1)
2186
2804
# End of Avahi example code
2193
2811
logger.debug("Starting main loop")
2194
2812
main_loop.run()
2195
2813
except AvahiError as error:
2196
logger.critical("AvahiError: %s", error)
2814
logger.critical("Avahi Error", exc_info=error)
2197
2815
cleanup()
2198
2816
sys.exit(1)
2199
2817
except KeyboardInterrupt:
2204
2822
# Must run before the D-Bus bus name gets deregistered
2205
2823
cleanup()
2206
2824
2207
2208
2825
if __name__ == '__main__':
2209
2826
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0