2
# -*- mode: python; coding: utf-8 -*-
4
# Mandos server - give out binary blobs to connecting clients.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
# GNU General Public License for more details.
27
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
31
# Contact the authors at <mandos@recompile.se>.
34
from __future__ import (division, absolute_import, print_function,
37
from future_builtins import *
40
import SocketServer as socketserver
6
from optparse import OptionParser
47
9
import gnutls.crypto
48
10
import gnutls.connection
49
11
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
54
import ConfigParser as configparser
65
import logging.handlers
72
import cPickle as pickle
75
import multiprocessing
88
from gi.repository import GObject as gobject
90
from dbus.mainloop.glib import DBusGMainLoop
93
import xml.dom.minidom
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
98
except AttributeError:
100
from IN import SO_BINDTODEVICE
102
SO_BINDTODEVICE = None
104
if sys.version_info.major == 2:
108
stored_state_file = "clients.pickle"
110
logger = logging.getLogger()
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
116
except (OSError, AttributeError):
118
def if_nametoindex(interface):
119
"Get an interface index the hard way, i.e. using fcntl()"
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
with contextlib.closing(socket.socket()) as s:
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
125
return interface_index
128
def initlogger(debug, level=logging.WARNING):
129
"""init logger and add loglevel"""
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
syslogger.setFormatter(logging.Formatter
136
('Mandos [%(process)d]: %(levelname)s:'
138
logger.addHandler(syslogger)
141
console = logging.StreamHandler()
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
146
logger.addHandler(console)
147
logger.setLevel(level)
150
class PGPError(Exception):
151
"""Exception if encryption/decryption fails"""
155
class PGPEngine(object):
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
169
def __exit__(self, exc_type, exc_value, traceback):
177
if self.tempdir is not None:
178
# Delete contents of tempdir
179
for root, dirs, files in os.walk(self.tempdir,
181
for filename in files:
182
os.remove(os.path.join(root, filename))
184
os.rmdir(os.path.join(root, dirname))
186
os.rmdir(self.tempdir)
189
def password_encode(self, password):
190
# Passphrase can not be empty and can not contain newlines or
191
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
200
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
218
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
234
return decrypted_plaintext
237
class AvahiError(Exception):
238
def __init__(self, value, *args, **kwargs):
240
return super(AvahiError, self).__init__(value, *args,
244
class AvahiServiceError(AvahiError):
248
class AvahiGroupError(AvahiError):
252
class AvahiService(object):
253
"""An Avahi (Zeroconf) service.
256
interface: integer; avahi.IF_UNSPEC or an interface index.
257
Used to optionally bind to the specified interface.
258
name: string; Example: 'Mandos'
259
type: string; Example: '_mandos._tcp'.
260
See <https://www.iana.org/assignments/service-names-port-numbers>
261
port: integer; what port to announce
262
TXT: list of strings; TXT record for the service
263
domain: string; Domain to publish on, default to .local if empty.
264
host: string; Host to publish records for, default is localhost
265
max_renames: integer; maximum number of renames
266
rename_count: integer; counter so we only rename after collisions
267
a sensible number of times
268
group: D-Bus Entry Group
270
bus: dbus.SystemBus()
274
interface = avahi.IF_UNSPEC,
282
protocol = avahi.PROTO_UNSPEC,
284
self.interface = interface
286
self.type = servicetype
288
self.TXT = TXT if TXT is not None else []
291
self.rename_count = 0
292
self.max_renames = max_renames
293
self.protocol = protocol
294
self.group = None # our entry group
297
self.entry_group_state_changed_match = None
299
def rename(self, remove=True):
300
"""Derived from the Avahi example code"""
301
if self.rename_count >= self.max_renames:
302
logger.critical("No suitable Zeroconf service name found"
303
" after %i retries, exiting.",
305
raise AvahiServiceError("Too many renames")
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
309
logger.info("Changing Zeroconf service name to %r ...",
315
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
321
logger.critical("D-Bus Exception", exc_info=error)
326
"""Derived from the Avahi example code"""
327
if self.entry_group_state_changed_match is not None:
328
self.entry_group_state_changed_match.remove()
329
self.entry_group_state_changed_match = None
330
if self.group is not None:
334
"""Derived from the Avahi example code"""
336
if self.group is None:
337
self.group = dbus.Interface(
338
self.bus.get_object(avahi.DBUS_NAME,
339
self.server.EntryGroupNew()),
340
avahi.DBUS_INTERFACE_ENTRY_GROUP)
341
self.entry_group_state_changed_match = (
342
self.group.connect_to_signal(
343
'StateChanged', self.entry_group_state_changed))
344
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
345
self.name, self.type)
346
self.group.AddService(
349
dbus.UInt32(0), # flags
350
self.name, self.type,
351
self.domain, self.host,
352
dbus.UInt16(self.port),
353
avahi.string_array_to_txt_array(self.TXT))
356
def entry_group_state_changed(self, state, error):
357
"""Derived from the Avahi example code"""
358
logger.debug("Avahi entry group state change: %i", state)
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
361
logger.debug("Zeroconf service established.")
362
elif state == avahi.ENTRY_GROUP_COLLISION:
363
logger.info("Zeroconf service name collision.")
365
elif state == avahi.ENTRY_GROUP_FAILURE:
366
logger.critical("Avahi: Error in group state changed %s",
368
raise AvahiGroupError("State changed: {!s}".format(error))
371
"""Derived from the Avahi example code"""
372
if self.group is not None:
375
except (dbus.exceptions.UnknownMethodException,
376
dbus.exceptions.DBusException):
381
def server_state_changed(self, state, error=None):
382
"""Derived from the Avahi example code"""
383
logger.debug("Avahi server state change: %i", state)
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
390
if state in bad_states:
391
if bad_states[state] is not None:
393
logger.error(bad_states[state])
395
logger.error(bad_states[state] + ": %r", error)
397
elif state == avahi.SERVER_RUNNING:
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
405
return self.rename(remove=False)
407
logger.critical("D-Bus Exception", exc_info=error)
412
logger.debug("Unknown state: %r", state)
414
logger.debug("Unknown state: %r: %r", state, error)
417
"""Derived from the Avahi example code"""
418
if self.server is None:
419
self.server = dbus.Interface(
420
self.bus.get_object(avahi.DBUS_NAME,
421
avahi.DBUS_PATH_SERVER,
422
follow_name_owner_changes=True),
423
avahi.DBUS_INTERFACE_SERVER)
424
self.server.connect_to_signal("StateChanged",
425
self.server_state_changed)
426
self.server_state_changed(self.server.GetState())
429
class AvahiServiceToSyslog(AvahiService):
430
def rename(self, *args, **kwargs):
431
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
445
connection.send(func(*args, **kwargs))
448
16
class Client(object):
449
"""A representation of a client host served by this server.
452
approved: bool(); 'None' if not yet approved/disapproved
453
approval_delay: datetime.timedelta(); Time to wait for approval
454
approval_duration: datetime.timedelta(); Duration of one approval
455
checker: subprocess.Popen(); a running checker process used
456
to see if the client lives.
457
'None' if no process is running.
458
checker_callback_tag: a gobject event source tag, or None
459
checker_command: string; External command which is run to check
460
if client lives. %() expansions are done at
461
runtime with vars(self) as dict, so that for
462
instance %(name)s can be used in the command.
463
checker_initiator_tag: a gobject event source tag, or None
464
created: datetime.datetime(); (UTC) object creation
465
client_structure: Object describing what attributes a client has
466
and is used for storing the client at exit
467
current_checker_command: string; current running checker_command
468
disable_initiator_tag: a gobject event source tag, or None
470
fingerprint: string (40 or 32 hexadecimal digits); used to
471
uniquely identify the client
472
host: string; available for use by the checker command
473
interval: datetime.timedelta(); How often to start a new checker
474
last_approval_request: datetime.datetime(); (UTC) or None
475
last_checked_ok: datetime.datetime(); (UTC) or None
476
last_checker_status: integer between 0 and 255 reflecting exit
477
status of last checker. -1 reflects crashed
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
481
last_enabled: datetime.datetime(); (UTC) or None
482
name: string; from the config file, used in log messages and
484
secret: bytestring; sent verbatim (over TLS) to client
485
timeout: datetime.timedelta(); How long from last_checked_ok
486
until this client is disabled
487
extended_timeout: extra long timeout when secret has been sent
488
runtime_expansions: Allowed attributes for runtime expansion.
489
expires: datetime.datetime(); time (UTC) when a client will be
491
server_settings: The server_settings dict from main()
494
runtime_expansions = ("approval_delay", "approval_duration",
495
"created", "enabled", "expires",
496
"fingerprint", "host", "interval",
497
"last_approval_request", "last_checked_ok",
498
"last_enabled", "name", "timeout")
501
"extended_timeout": "PT15M",
503
"checker": "fping -q -- %%(host)s",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
512
def config_parser(config):
513
"""Construct a new dict of client settings of this form:
514
{ client_name: {setting_name: value, ...}, ...}
515
with exceptions for any special settings as defined above.
516
NOTE: Must be a pure function. Must return the same result
517
value given the same arguments.
520
for client_name in config.sections():
521
section = dict(config.items(client_name))
522
client = settings[client_name] = {}
524
client["host"] = section["host"]
525
# Reformat values from string types to Python types
526
client["approved_by_default"] = config.getboolean(
527
client_name, "approved_by_default")
528
client["enabled"] = config.getboolean(client_name,
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
534
client["fingerprint"] = (section["fingerprint"].upper()
536
if "secret" in section:
537
client["secret"] = section["secret"].decode("base64")
538
elif "secfile" in section:
539
with open(os.path.expanduser(os.path.expandvars
540
(section["secfile"])),
542
client["secret"] = secfile.read()
544
raise TypeError("No secret or secfile for section {}"
546
client["timeout"] = string_to_delta(section["timeout"])
547
client["extended_timeout"] = string_to_delta(
548
section["extended_timeout"])
549
client["interval"] = string_to_delta(section["interval"])
550
client["approval_delay"] = string_to_delta(
551
section["approval_delay"])
552
client["approval_duration"] = string_to_delta(
553
section["approval_duration"])
554
client["checker_command"] = section["checker"]
555
client["last_approval_request"] = None
556
client["last_checked_ok"] = None
557
client["last_checker_status"] = -2
561
def __init__(self, settings, name = None, server_settings=None):
17
def __init__(self, name=None, options=None, dn=None,
18
password=None, passfile=None, fqdn=None,
19
timeout=None, interval=-1):
563
if server_settings is None:
565
self.server_settings = server_settings
566
# adding all client settings
567
for setting, value in settings.items():
568
setattr(self, setting, value)
571
if not hasattr(self, "last_enabled"):
572
self.last_enabled = datetime.datetime.utcnow()
573
if not hasattr(self, "expires"):
574
self.expires = (datetime.datetime.utcnow()
577
self.last_enabled = None
580
logger.debug("Creating client %r", self.name)
581
logger.debug(" Fingerprint: %s", self.fingerprint)
582
self.created = settings.get("created",
583
datetime.datetime.utcnow())
585
# attributes specific for this server instance
587
self.checker_initiator_tag = None
588
self.disable_initiator_tag = None
589
self.checker_callback_tag = None
590
self.current_checker_command = None
592
self.approvals_pending = 0
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
597
if not attr.startswith("_")]
598
self.client_structure.append("client_structure")
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
602
if not name.startswith("_"):
603
self.client_structure.append(name)
605
# Send notice to process children that client state has changed
606
def send_changedstate(self):
607
with self.changedstate:
608
self.changedstate.notify_all()
611
"""Start this client's checker and timeout hooks"""
612
if getattr(self, "enabled", False):
615
self.expires = datetime.datetime.utcnow() + self.timeout
617
self.last_enabled = datetime.datetime.utcnow()
619
self.send_changedstate()
621
def disable(self, quiet=True):
622
"""Disable this client."""
623
if not getattr(self, "enabled", False):
626
logger.info("Disabling client %s", self.name)
627
if getattr(self, "disable_initiator_tag", None) is not None:
628
gobject.source_remove(self.disable_initiator_tag)
629
self.disable_initiator_tag = None
631
if getattr(self, "checker_initiator_tag", None) is not None:
632
gobject.source_remove(self.checker_initiator_tag)
633
self.checker_initiator_tag = None
637
self.send_changedstate()
638
# Do not run this again if called by a gobject.timeout_add
644
def init_checker(self):
645
# Schedule a new checker to be started an 'interval' from now,
646
# and every interval from then on.
647
if self.checker_initiator_tag is not None:
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
652
# Schedule a disable() when 'timeout' has passed
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
657
# Also start a new checker *right now*.
660
def checker_callback(self, source, condition, connection,
662
"""The checker has completed, so take appropriate actions."""
663
self.checker_callback_tag = None
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
672
if self.last_checker_status == 0:
673
logger.info("Checker for %(name)s succeeded",
677
logger.info("Checker for %(name)s failed", vars(self))
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
681
logger.warning("Checker for %(name)s crashed?",
685
def checked_ok(self):
686
"""Assert that the client has been seen, alive and well."""
687
self.last_checked_ok = datetime.datetime.utcnow()
688
self.last_checker_status = 0
689
self.last_checker_signal = None
692
def bump_timeout(self, timeout=None):
693
"""Bump up the timeout for this client."""
23
self.password = password
25
self.password = open(passfile).readall()
27
print "No Password or Passfile in client config file"
28
# raise RuntimeError XXX
29
self.password = "gazonk"
31
self.created = datetime.datetime.now()
694
33
if timeout is None:
695
timeout = self.timeout
696
if self.disable_initiator_tag is not None:
697
gobject.source_remove(self.disable_initiator_tag)
698
self.disable_initiator_tag = None
699
if getattr(self, "enabled", False):
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
702
self.expires = datetime.datetime.utcnow() + timeout
704
def need_approval(self):
705
self.last_approval_request = datetime.datetime.utcnow()
707
def start_checker(self):
708
"""Start a new checker subprocess if one is not running.
710
If a checker already exists, leave it running and do
712
# The reason for not killing a running checker is that if we
713
# did that, and if a checker (for some reason) started running
714
# slowly and taking more than 'interval' time, then the client
715
# would inevitably timeout, since no checker would get a
716
# chance to run to completion. If we instead leave running
717
# checkers alone, the checker would have to take more time
718
# than 'timeout' for the client to be disabled, which is as it
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
725
# Start a new checker if needed
726
if self.checker is None:
727
# Escape attributes for the shell
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
732
command = self.checker_command % escaped_attrs
733
except TypeError as error:
734
logger.error('Could not format string "%s"',
735
self.checker_command,
737
return True # Try again later
738
self.current_checker_command = command
739
logger.info("Starting checker %r for %s", command,
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
748
popen_args = { "close_fds": True,
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
758
args = (pipe[1], subprocess.call, command),
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
764
# Re-run this periodically if run by gobject.timeout_add
767
def stop_checker(self):
768
"""Force the checker process, if any, to stop."""
769
if self.checker_callback_tag:
770
gobject.source_remove(self.checker_callback_tag)
771
self.checker_callback_tag = None
772
if getattr(self, "checker", None) is None:
774
logger.debug("Stopping checker for %(name)s", vars(self))
775
self.checker.terminate()
779
def dbus_service_property(dbus_interface,
783
"""Decorators for marking methods of a DBusObjectWithProperties to
784
become properties on the D-Bus.
786
The decorated method will be called with no arguments by "Get"
787
and with one argument by "Set".
789
The parameters, where they are supported, are the same as
790
dbus.service.method, except there is only "signature", since the
791
type from Get() and the type sent to Set() is the same.
793
# Encoding deeply encoded byte arrays is not supported yet by the
794
# "Set" method, so we fail early here:
795
if byte_arrays and signature != "ay":
796
raise ValueError("Byte arrays not supported for non-'ay'"
797
" signature {!r}".format(signature))
800
func._dbus_is_property = True
801
func._dbus_interface = dbus_interface
802
func._dbus_signature = signature
803
func._dbus_access = access
804
func._dbus_name = func.__name__
805
if func._dbus_name.endswith("_dbus_property"):
806
func._dbus_name = func._dbus_name[:-14]
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
813
def dbus_interface_annotations(dbus_interface):
814
"""Decorator for marking functions returning interface annotations
818
@dbus_interface_annotations("org.example.Interface")
819
def _foo(self): # Function name does not matter
820
return {"org.freedesktop.DBus.Deprecated": "true",
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
826
func._dbus_is_interface = True
827
func._dbus_interface = dbus_interface
828
func._dbus_name = dbus_interface
834
def dbus_annotations(annotations):
835
"""Decorator to annotate D-Bus methods, signals or properties
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
@dbus_service_property("org.example.Interface", signature="b",
843
def Property_dbus_property(self):
844
return dbus.Boolean(False)
848
func._dbus_annotations = annotations
854
class DBusPropertyException(dbus.exceptions.DBusException):
855
"""A base class for D-Bus property-related exceptions
860
class DBusPropertyAccessException(DBusPropertyException):
861
"""A property's access permissions disallows an operation.
866
class DBusPropertyNotFound(DBusPropertyException):
867
"""An attempt was made to access a non-existing property.
872
class DBusObjectWithProperties(dbus.service.Object):
873
"""A D-Bus object with properties.
875
Classes inheriting from this can use the dbus_service_property
876
decorator to expose methods as D-Bus properties. It exposes the
877
standard Get(), Set(), and GetAll() methods on the D-Bus.
881
def _is_dbus_thing(thing):
882
"""Returns a function testing if an attribute is a D-Bus thing
884
If called like _is_dbus_thing("method") it returns a function
885
suitable for use as predicate to inspect.getmembers().
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
890
def _get_all_dbus_things(self, thing):
891
"""Returns a generator of (name, attribute) pairs
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
894
athing.__get__(self))
895
for cls in self.__class__.__mro__
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
899
def _get_dbus_property(self, interface_name, property_name):
900
"""Returns a bound method if one exists which is a D-Bus
901
property with the specified name and interface.
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
906
if (value._dbus_name == property_name
907
and value._dbus_interface == interface_name):
908
return value.__get__(self)
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
917
def Get(self, interface_name, property_name):
918
"""Standard D-Bus property Get() method, see D-Bus standard.
920
prop = self._get_dbus_property(interface_name, property_name)
921
if prop._dbus_access == "write":
922
raise DBusPropertyAccessException(property_name)
924
if not hasattr(value, "variant_level"):
926
return type(value)(value, variant_level=value.variant_level+1)
928
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
929
def Set(self, interface_name, property_name, value):
930
"""Standard D-Bus property Set() method, see D-Bus standard.
932
prop = self._get_dbus_property(interface_name, property_name)
933
if prop._dbus_access == "read":
934
raise DBusPropertyAccessException(property_name)
935
if prop._dbus_get_args_options["byte_arrays"]:
936
# The byte_arrays option is not supported yet on
937
# signatures other than "ay".
938
if prop._dbus_signature != "ay":
939
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {!r}"
941
.format(prop._dbus_signature))
942
value = dbus.ByteArray(b''.join(chr(byte)
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
948
out_signature="a{sv}")
949
def GetAll(self, interface_name):
950
"""Standard D-Bus property GetAll() method, see D-Bus
953
Note: Will not include properties with access="write".
956
for name, prop in self._get_all_dbus_things("property"):
958
and interface_name != prop._dbus_interface):
959
# Interface non-empty but did not match
961
# Ignore write-only properties
962
if prop._dbus_access == "write":
965
if not hasattr(value, "variant_level"):
966
properties[name] = value
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
970
return dbus.Dictionary(properties, signature="sv")
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
def PropertiesChanged(self, interface_name, changed_properties,
974
invalidated_properties):
975
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
980
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
982
path_keyword='object_path',
983
connection_keyword='connection')
984
def Introspect(self, object_path, connection):
985
"""Overloading of standard D-Bus method.
987
Inserts property tags and interface annotation tags.
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
992
document = xml.dom.minidom.parseString(xmlstring)
994
def make_tag(document, name, prop):
995
e = document.createElement("property")
996
e.setAttribute("name", name)
997
e.setAttribute("type", prop._dbus_signature)
998
e.setAttribute("access", prop._dbus_access)
1001
for if_tag in document.getElementsByTagName("interface"):
1003
for tag in (make_tag(document, name, prop)
1005
in self._get_all_dbus_things("property")
1006
if prop._dbus_interface
1007
== if_tag.getAttribute("name")):
1008
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1038
# Add the names to the return values for the
1039
# "org.freedesktop.DBus.Properties" methods
1040
if (if_tag.getAttribute("name")
1041
== "org.freedesktop.DBus.Properties"):
1042
for cn in if_tag.getElementsByTagName("method"):
1043
if cn.getAttribute("name") == "Get":
1044
for arg in cn.getElementsByTagName("arg"):
1045
if (arg.getAttribute("direction")
1047
arg.setAttribute("name", "value")
1048
elif cn.getAttribute("name") == "GetAll":
1049
for arg in cn.getElementsByTagName("arg"):
1050
if (arg.getAttribute("direction")
1052
arg.setAttribute("name", "props")
1053
xmlstring = document.toxml("utf-8")
1055
except (AttributeError, xml.dom.DOMException,
1056
xml.parsers.expat.ExpatError) as error:
1057
logger.error("Failed to override Introspection method",
1062
def datetime_to_dbus(dt, variant_level=0):
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
return dbus.String("", variant_level = variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
"""A class decorator; applied to a subclass of
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1072
interface names according to the "alt_interface_names" mapping.
1075
@alternate_dbus_interfaces({"org.example.Interface":
1076
"net.example.AlternateInterface"})
1077
class SampleDBusObject(dbus.service.Object):
1078
@dbus.service.method("org.example.Interface")
1079
def SampleDBusMethod():
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
reachable via two interfaces: "org.example.Interface" and
1084
"net.example.AlternateInterface", the latter of which will have
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
"true", unless "deprecate" is passed with a False value.
1088
This works for methods and signals, and also for D-Bus properties
1089
(from DBusObjectWithProperties) and interfaces (from the
1090
dbus_interface_annotations decorator).
1094
for orig_interface_name, alt_interface_name in (
1095
alt_interface_names.items()):
1097
interface_names = set()
1098
# Go though all attributes of the class
1099
for attrname, attribute in inspect.getmembers(cls):
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
1101
# with the wrong interface name
1102
if (not hasattr(attribute, "_dbus_interface")
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
1106
# Create an alternate D-Bus interface name based on
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1110
interface_names.add(alt_interface)
1111
# Is this a D-Bus signal?
1112
if getattr(attribute, "_dbus_is_signal", False):
1113
if sys.version_info.major == 2:
1114
# Extract the original non-method undecorated
1115
# function by black magic
1116
nonmethod_func = (dict(
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1121
nonmethod_func = attribute
1122
# Create a new, but exactly alike, function
1123
# object, and decorate it to be a new D-Bus signal
1124
# with the alternate D-Bus interface name
1125
if sys.version_info.major == 2:
1126
new_function = types.FunctionType(
1127
nonmethod_func.func_code,
1128
nonmethod_func.func_globals,
1129
nonmethod_func.func_name,
1130
nonmethod_func.func_defaults,
1131
nonmethod_func.func_closure)
1133
new_function = types.FunctionType(
1134
nonmethod_func.__code__,
1135
nonmethod_func.__globals__,
1136
nonmethod_func.__name__,
1137
nonmethod_func.__defaults__,
1138
nonmethod_func.__closure__)
1139
new_function = (dbus.service.signal(
1141
attribute._dbus_signature)(new_function))
1142
# Copy annotations, if any
1144
new_function._dbus_annotations = dict(
1145
attribute._dbus_annotations)
1146
except AttributeError:
1148
# Define a creator of a function to call both the
1149
# original and alternate functions, so both the
1150
# original and alternate signals gets sent when
1151
# the function is called
1152
def fixscope(func1, func2):
1153
"""This function is a scope container to pass
1154
func1 and func2 to the "call_both" function
1155
outside of its arguments"""
1157
def call_both(*args, **kwargs):
1158
"""This function will emit two D-Bus
1159
signals by calling func1 and func2"""
1160
func1(*args, **kwargs)
1161
func2(*args, **kwargs)
1164
# Create the "call_both" function and add it to
1166
attr[attrname] = fixscope(attribute, new_function)
1167
# Is this a D-Bus method?
1168
elif getattr(attribute, "_dbus_is_method", False):
1169
# Create a new, but exactly alike, function
1170
# object. Decorate it to be a new D-Bus method
1171
# with the alternate D-Bus interface name. Add it
1174
dbus.service.method(
1176
attribute._dbus_in_signature,
1177
attribute._dbus_out_signature)
1178
(types.FunctionType(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1183
# Copy annotations, if any
1185
attr[attrname]._dbus_annotations = dict(
1186
attribute._dbus_annotations)
1187
except AttributeError:
1189
# Is this a D-Bus property?
1190
elif getattr(attribute, "_dbus_is_property", False):
1191
# Create a new, but exactly alike, function
1192
# object, and decorate it to be a new D-Bus
1193
# property with the alternate D-Bus interface
1194
# name. Add it to the class.
1195
attr[attrname] = (dbus_service_property(
1196
alt_interface, attribute._dbus_signature,
1197
attribute._dbus_access,
1198
attribute._dbus_get_args_options
1200
(types.FunctionType(
1201
attribute.func_code,
1202
attribute.func_globals,
1203
attribute.func_name,
1204
attribute.func_defaults,
1205
attribute.func_closure)))
1206
# Copy annotations, if any
1208
attr[attrname]._dbus_annotations = dict(
1209
attribute._dbus_annotations)
1210
except AttributeError:
1212
# Is this a D-Bus interface?
1213
elif getattr(attribute, "_dbus_is_interface", False):
1214
# Create a new, but exactly alike, function
1215
# object. Decorate it to be a new D-Bus interface
1216
# with the alternate D-Bus interface name. Add it
1219
dbus_interface_annotations(alt_interface)
1220
(types.FunctionType(attribute.func_code,
1221
attribute.func_globals,
1222
attribute.func_name,
1223
attribute.func_defaults,
1224
attribute.func_closure)))
1226
# Deprecate all alternate interfaces
1227
iname="_AlternateDBusNames_interface_annotation{}"
1228
for interface_name in interface_names:
1230
@dbus_interface_annotations(interface_name)
1232
return { "org.freedesktop.DBus.Deprecated":
1234
# Find an unused name
1235
for aname in (iname.format(i)
1236
for i in itertools.count()):
1237
if aname not in attr:
1241
# Replace the class with a new subclass of it with
1242
# methods, signals, etc. as created above.
1243
cls = type(b"{}Alternate".format(cls.__name__),
1250
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
"se.bsnet.fukt.Mandos"})
1252
class ClientDBus(Client, DBusObjectWithProperties):
1253
"""A Client class using D-Bus
1256
dbus_object_path: dbus.ObjectPath
1257
bus: dbus.SystemBus()
1260
runtime_expansions = (Client.runtime_expansions
1261
+ ("dbus_object_path", ))
1263
_interface = "se.recompile.Mandos.Client"
1265
# dbus.service.Object doesn't use super(), so we can't either.
1267
def __init__(self, bus = None, *args, **kwargs):
1269
Client.__init__(self, *args, **kwargs)
1270
# Only now, when this client is initialized, can it show up on
1272
client_object_name = str(self.name).translate(
1273
{ord("."): ord("_"),
1274
ord("-"): ord("_")})
1275
self.dbus_object_path = dbus.ObjectPath(
1276
"/clients/" + client_object_name)
1277
DBusObjectWithProperties.__init__(self, self.bus,
1278
self.dbus_object_path)
1280
def notifychangeproperty(transform_func, dbus_name,
1281
type_func=lambda x: x,
1283
invalidate_only=False,
1284
_interface=_interface):
1285
""" Modify a variable so that it's a property which announces
1286
its changes to DBus.
1288
transform_fun: Function that takes a value and a variant_level
1289
and transforms it to a D-Bus type.
1290
dbus_name: D-Bus name of the variable
1291
type_func: Function that transform the value before sending it
1292
to the D-Bus. Default: no transform
1293
variant_level: D-Bus variant level. Default: 1
1295
attrname = "_{}".format(dbus_name)
1297
def setter(self, value):
1298
if hasattr(self, "dbus_object_path"):
1299
if (not hasattr(self, attrname) or
1300
type_func(getattr(self, attrname, None))
1301
!= type_func(value)):
1303
self.PropertiesChanged(
1304
_interface, dbus.Dictionary(),
1305
dbus.Array((dbus_name, )))
1307
dbus_value = transform_func(
1309
variant_level = variant_level)
1310
self.PropertyChanged(dbus.String(dbus_name),
1312
self.PropertiesChanged(
1314
dbus.Dictionary({ dbus.String(dbus_name):
1317
setattr(self, attrname, value)
1319
return property(lambda self: getattr(self, attrname), setter)
1321
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1322
approvals_pending = notifychangeproperty(dbus.Boolean,
1325
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
last_enabled = notifychangeproperty(datetime_to_dbus,
1328
checker = notifychangeproperty(
1329
dbus.Boolean, "CheckerRunning",
1330
type_func = lambda checker: checker is not None)
1331
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1333
last_checker_status = notifychangeproperty(dbus.Int16,
1334
"LastCheckerStatus")
1335
last_approval_request = notifychangeproperty(
1336
datetime_to_dbus, "LastApprovalRequest")
1337
approved_by_default = notifychangeproperty(dbus.Boolean,
1338
"ApprovedByDefault")
1339
approval_delay = notifychangeproperty(
1340
dbus.UInt64, "ApprovalDelay",
1341
type_func = lambda td: td.total_seconds() * 1000)
1342
approval_duration = notifychangeproperty(
1343
dbus.UInt64, "ApprovalDuration",
1344
type_func = lambda td: td.total_seconds() * 1000)
1345
host = notifychangeproperty(dbus.String, "Host")
1346
timeout = notifychangeproperty(
1347
dbus.UInt64, "Timeout",
1348
type_func = lambda td: td.total_seconds() * 1000)
1349
extended_timeout = notifychangeproperty(
1350
dbus.UInt64, "ExtendedTimeout",
1351
type_func = lambda td: td.total_seconds() * 1000)
1352
interval = notifychangeproperty(
1353
dbus.UInt64, "Interval",
1354
type_func = lambda td: td.total_seconds() * 1000)
1355
checker_command = notifychangeproperty(dbus.String, "Checker")
1356
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
invalidate_only=True)
1359
del notifychangeproperty
1361
def __del__(self, *args, **kwargs):
1363
self.remove_from_connection()
1366
if hasattr(DBusObjectWithProperties, "__del__"):
1367
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1368
Client.__del__(self, *args, **kwargs)
1370
def checker_callback(self, source, condition,
1371
connection, command, *args, **kwargs):
1372
ret = Client.checker_callback(self, source, condition,
1373
connection, command, *args,
1375
exitstatus = self.last_checker_status
1378
self.CheckerCompleted(dbus.Int16(exitstatus),
1380
dbus.String(command))
1383
self.CheckerCompleted(dbus.Int16(-1),
1385
self.last_checker_signal),
1386
dbus.String(command))
1389
def start_checker(self, *args, **kwargs):
1390
old_checker_pid = getattr(self.checker, "pid", None)
1391
r = Client.start_checker(self, *args, **kwargs)
1392
# Only if new checker process was started
1393
if (self.checker is not None
1394
and old_checker_pid != self.checker.pid):
1396
self.CheckerStarted(self.current_checker_command)
1399
def _reset_approved(self):
1400
self.approved = None
1403
def approve(self, value=True):
1404
self.approved = value
1405
gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
* 1000), self._reset_approved)
1407
self.send_changedstate()
1409
## D-Bus methods, signals & properties
1415
# CheckerCompleted - signal
1416
@dbus.service.signal(_interface, signature="nxs")
1417
def CheckerCompleted(self, exitcode, waitstatus, command):
1421
# CheckerStarted - signal
1422
@dbus.service.signal(_interface, signature="s")
1423
def CheckerStarted(self, command):
1427
# PropertyChanged - signal
1428
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1429
@dbus.service.signal(_interface, signature="sv")
1430
def PropertyChanged(self, property, value):
1434
# GotSecret - signal
1435
@dbus.service.signal(_interface)
1436
def GotSecret(self):
1438
Is sent after a successful transfer of secret from the Mandos
1439
server to mandos-client
1444
@dbus.service.signal(_interface, signature="s")
1445
def Rejected(self, reason):
1449
# NeedApproval - signal
1450
@dbus.service.signal(_interface, signature="tb")
1451
def NeedApproval(self, timeout, default):
1453
return self.need_approval()
1458
@dbus.service.method(_interface, in_signature="b")
1459
def Approve(self, value):
1462
# CheckedOK - method
1463
@dbus.service.method(_interface)
1464
def CheckedOK(self):
1468
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1469
@dbus.service.method(_interface)
1474
# StartChecker - method
1475
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1476
@dbus.service.method(_interface)
1477
def StartChecker(self):
1479
self.start_checker()
1482
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1483
@dbus.service.method(_interface)
1488
# StopChecker - method
1489
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1490
@dbus.service.method(_interface)
1491
def StopChecker(self):
1496
# ApprovalPending - property
1497
@dbus_service_property(_interface, signature="b", access="read")
1498
def ApprovalPending_dbus_property(self):
1499
return dbus.Boolean(bool(self.approvals_pending))
1501
# ApprovedByDefault - property
1502
@dbus_service_property(_interface,
1505
def ApprovedByDefault_dbus_property(self, value=None):
1506
if value is None: # get
1507
return dbus.Boolean(self.approved_by_default)
1508
self.approved_by_default = bool(value)
1510
# ApprovalDelay - property
1511
@dbus_service_property(_interface,
1514
def ApprovalDelay_dbus_property(self, value=None):
1515
if value is None: # get
1516
return dbus.UInt64(self.approval_delay.total_seconds()
1518
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1520
# ApprovalDuration - property
1521
@dbus_service_property(_interface,
1524
def ApprovalDuration_dbus_property(self, value=None):
1525
if value is None: # get
1526
return dbus.UInt64(self.approval_duration.total_seconds()
1528
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1532
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1533
@dbus_service_property(_interface, signature="s", access="read")
1534
def Name_dbus_property(self):
1535
return dbus.String(self.name)
1537
# Fingerprint - property
1539
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1540
@dbus_service_property(_interface, signature="s", access="read")
1541
def Fingerprint_dbus_property(self):
1542
return dbus.String(self.fingerprint)
1545
@dbus_service_property(_interface,
1548
def Host_dbus_property(self, value=None):
1549
if value is None: # get
1550
return dbus.String(self.host)
1551
self.host = str(value)
1553
# Created - property
1555
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1556
@dbus_service_property(_interface, signature="s", access="read")
1557
def Created_dbus_property(self):
1558
return datetime_to_dbus(self.created)
1560
# LastEnabled - property
1561
@dbus_service_property(_interface, signature="s", access="read")
1562
def LastEnabled_dbus_property(self):
1563
return datetime_to_dbus(self.last_enabled)
1565
# Enabled - property
1566
@dbus_service_property(_interface,
1569
def Enabled_dbus_property(self, value=None):
1570
if value is None: # get
1571
return dbus.Boolean(self.enabled)
1577
# LastCheckedOK - property
1578
@dbus_service_property(_interface,
1581
def LastCheckedOK_dbus_property(self, value=None):
1582
if value is not None:
1585
return datetime_to_dbus(self.last_checked_ok)
1587
# LastCheckerStatus - property
1588
@dbus_service_property(_interface, signature="n", access="read")
1589
def LastCheckerStatus_dbus_property(self):
1590
return dbus.Int16(self.last_checker_status)
1592
# Expires - property
1593
@dbus_service_property(_interface, signature="s", access="read")
1594
def Expires_dbus_property(self):
1595
return datetime_to_dbus(self.expires)
1597
# LastApprovalRequest - property
1598
@dbus_service_property(_interface, signature="s", access="read")
1599
def LastApprovalRequest_dbus_property(self):
1600
return datetime_to_dbus(self.last_approval_request)
1602
# Timeout - property
1603
@dbus_service_property(_interface,
1606
def Timeout_dbus_property(self, value=None):
1607
if value is None: # get
1608
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1609
old_timeout = self.timeout
1610
self.timeout = datetime.timedelta(0, 0, 0, value)
1611
# Reschedule disabling
1613
now = datetime.datetime.utcnow()
1614
self.expires += self.timeout - old_timeout
1615
if self.expires <= now:
1616
# The timeout has passed
1619
if (getattr(self, "disable_initiator_tag", None)
1622
gobject.source_remove(self.disable_initiator_tag)
1623
self.disable_initiator_tag = gobject.timeout_add(
1624
int((self.expires - now).total_seconds() * 1000),
1627
# ExtendedTimeout - property
1628
@dbus_service_property(_interface,
1631
def ExtendedTimeout_dbus_property(self, value=None):
1632
if value is None: # get
1633
return dbus.UInt64(self.extended_timeout.total_seconds()
1635
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1637
# Interval - property
1638
@dbus_service_property(_interface,
1641
def Interval_dbus_property(self, value=None):
1642
if value is None: # get
1643
return dbus.UInt64(self.interval.total_seconds() * 1000)
1644
self.interval = datetime.timedelta(0, 0, 0, value)
1645
if getattr(self, "checker_initiator_tag", None) is None:
1648
# Reschedule checker run
1649
gobject.source_remove(self.checker_initiator_tag)
1650
self.checker_initiator_tag = gobject.timeout_add(
1651
value, self.start_checker)
1652
self.start_checker() # Start one now, too
1654
# Checker - property
1655
@dbus_service_property(_interface,
1658
def Checker_dbus_property(self, value=None):
1659
if value is None: # get
1660
return dbus.String(self.checker_command)
1661
self.checker_command = str(value)
1663
# CheckerRunning - property
1664
@dbus_service_property(_interface,
1667
def CheckerRunning_dbus_property(self, value=None):
1668
if value is None: # get
1669
return dbus.Boolean(self.checker is not None)
1671
self.start_checker()
1675
# ObjectPath - property
1677
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1678
@dbus_service_property(_interface, signature="o", access="read")
1679
def ObjectPath_dbus_property(self):
1680
return self.dbus_object_path # is already a dbus.ObjectPath
1684
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
1686
@dbus_service_property(_interface,
1690
def Secret_dbus_property(self, value):
1691
self.secret = bytes(value)
1696
class ProxyClient(object):
1697
def __init__(self, child_pipe, fpr, address):
1698
self._pipe = child_pipe
1699
self._pipe.send(('init', fpr, address))
1700
if not self._pipe.recv():
1703
def __getattribute__(self, name):
1705
return super(ProxyClient, self).__getattribute__(name)
1706
self._pipe.send(('getattr', name))
1707
data = self._pipe.recv()
1708
if data[0] == 'data':
1710
if data[0] == 'function':
1712
def func(*args, **kwargs):
1713
self._pipe.send(('funcall', name, args, kwargs))
1714
return self._pipe.recv()[1]
1718
def __setattr__(self, name, value):
1720
return super(ProxyClient, self).__setattr__(name, value)
1721
self._pipe.send(('setattr', name, value))
1724
class ClientHandler(socketserver.BaseRequestHandler, object):
1725
"""A class to handle client connections.
1727
Instantiated once for each connection to handle it.
1728
Note: This will run in its own forked process."""
1731
with contextlib.closing(self.server.child_pipe) as child_pipe:
1732
logger.info("TCP connection from: %s",
1733
str(self.client_address))
1734
logger.debug("Pipe FD: %d",
1735
self.server.child_pipe.fileno())
1737
session = gnutls.connection.ClientSession(
1738
self.request, gnutls.connection .X509Credentials())
1740
# Note: gnutls.connection.X509Credentials is really a
1741
# generic GnuTLS certificate credentials object so long as
1742
# no X.509 keys are added to it. Therefore, we can use it
1743
# here despite using OpenPGP certificates.
1745
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1746
# "+AES-256-CBC", "+SHA1",
1747
# "+COMP-NULL", "+CTYPE-OPENPGP",
1749
# Use a fallback default, since this MUST be set.
1750
priority = self.server.gnutls_priority
1751
if priority is None:
1753
gnutls.library.functions.gnutls_priority_set_direct(
1754
session._c_object, priority, None)
1756
# Start communication using the Mandos protocol
1757
# Get protocol number
1758
line = self.request.makefile().readline()
1759
logger.debug("Protocol version: %r", line)
1761
if int(line.strip().split()[0]) > 1:
1762
raise RuntimeError(line)
1763
except (ValueError, IndexError, RuntimeError) as error:
1764
logger.error("Unknown protocol version: %s", error)
1767
# Start GnuTLS connection
1770
except gnutls.errors.GNUTLSError as error:
1771
logger.warning("Handshake failed: %s", error)
1772
# Do not run session.bye() here: the session is not
1773
# established. Just abandon the request.
1775
logger.debug("Handshake succeeded")
1777
approval_required = False
1780
fpr = self.fingerprint(
1781
self.peer_certificate(session))
1783
gnutls.errors.GNUTLSError) as error:
1784
logger.warning("Bad certificate: %s", error)
1786
logger.debug("Fingerprint: %s", fpr)
1789
client = ProxyClient(child_pipe, fpr,
1790
self.client_address)
1794
if client.approval_delay:
1795
delay = client.approval_delay
1796
client.approvals_pending += 1
1797
approval_required = True
1800
if not client.enabled:
1801
logger.info("Client %s is disabled",
1803
if self.server.use_dbus:
1805
client.Rejected("Disabled")
1808
if client.approved or not client.approval_delay:
1809
#We are approved or approval is disabled
1811
elif client.approved is None:
1812
logger.info("Client %s needs approval",
1814
if self.server.use_dbus:
1816
client.NeedApproval(
1817
client.approval_delay.total_seconds()
1818
* 1000, client.approved_by_default)
1820
logger.warning("Client %s was not approved",
1822
if self.server.use_dbus:
1824
client.Rejected("Denied")
1827
#wait until timeout or approved
1828
time = datetime.datetime.now()
1829
client.changedstate.acquire()
1830
client.changedstate.wait(delay.total_seconds())
1831
client.changedstate.release()
1832
time2 = datetime.datetime.now()
1833
if (time2 - time) >= delay:
1834
if not client.approved_by_default:
1835
logger.warning("Client %s timed out while"
1836
" waiting for approval",
1838
if self.server.use_dbus:
1840
client.Rejected("Approval timed out")
1845
delay -= time2 - time
1848
while sent_size < len(client.secret):
1850
sent = session.send(client.secret[sent_size:])
1851
except gnutls.errors.GNUTLSError as error:
1852
logger.warning("gnutls send failed",
1855
logger.debug("Sent: %d, remaining: %d", sent,
1856
len(client.secret) - (sent_size
1860
logger.info("Sending secret to %s", client.name)
1861
# bump the timeout using extended_timeout
1862
client.bump_timeout(client.extended_timeout)
1863
if self.server.use_dbus:
1868
if approval_required:
1869
client.approvals_pending -= 1
1872
except gnutls.errors.GNUTLSError as error:
1873
logger.warning("GnuTLS bye failed",
1877
def peer_certificate(session):
1878
"Return the peer's OpenPGP certificate as a bytestring"
1879
# If not an OpenPGP certificate...
1880
if (gnutls.library.functions.gnutls_certificate_type_get(
1882
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1883
# ...do the normal thing
1884
return session.peer_certificate
1885
list_size = ctypes.c_uint(1)
1886
cert_list = (gnutls.library.functions
1887
.gnutls_certificate_get_peers
1888
(session._c_object, ctypes.byref(list_size)))
1889
if not bool(cert_list) and list_size.value != 0:
1890
raise gnutls.errors.GNUTLSError("error getting peer"
1892
if list_size.value == 0:
1895
return ctypes.string_at(cert.data, cert.size)
1898
def fingerprint(openpgp):
1899
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1900
# New GnuTLS "datum" with the OpenPGP public key
1901
datum = gnutls.library.types.gnutls_datum_t(
1902
ctypes.cast(ctypes.c_char_p(openpgp),
1903
ctypes.POINTER(ctypes.c_ubyte)),
1904
ctypes.c_uint(len(openpgp)))
1905
# New empty GnuTLS certificate
1906
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1907
gnutls.library.functions.gnutls_openpgp_crt_init(
1909
# Import the OpenPGP public key into the certificate
1910
gnutls.library.functions.gnutls_openpgp_crt_import(
1911
crt, ctypes.byref(datum),
1912
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1913
# Verify the self signature in the key
1914
crtverify = ctypes.c_uint()
1915
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1916
crt, 0, ctypes.byref(crtverify))
1917
if crtverify.value != 0:
1918
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1919
raise gnutls.errors.CertificateSecurityError(
1921
# New buffer for the fingerprint
1922
buf = ctypes.create_string_buffer(20)
1923
buf_len = ctypes.c_size_t()
1924
# Get the fingerprint from the certificate into the buffer
1925
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1926
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1927
# Deinit the certificate
1928
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1929
# Convert the buffer to a Python bytestring
1930
fpr = ctypes.string_at(buf, buf_len.value)
1931
# Convert the bytestring to hexadecimal notation
1932
hex_fpr = binascii.hexlify(fpr).upper()
1936
class MultiprocessingMixIn(object):
1937
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1939
def sub_process_main(self, request, address):
1941
self.finish_request(request, address)
1943
self.handle_error(request, address)
1944
self.close_request(request)
1946
def process_request(self, request, address):
1947
"""Start a new process to process the request."""
1948
proc = multiprocessing.Process(target = self.sub_process_main,
1949
args = (request, address))
1954
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1955
""" adds a pipe to the MixIn """
1957
def process_request(self, request, client_address):
1958
"""Overrides and wraps the original process_request().
1960
This function creates a new pipe in self.pipe
1962
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1964
proc = MultiprocessingMixIn.process_request(self, request,
1966
self.child_pipe.close()
1967
self.add_pipe(parent_pipe, proc)
1969
def add_pipe(self, parent_pipe, proc):
1970
"""Dummy function; override as necessary"""
1971
raise NotImplementedError()
1974
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1975
socketserver.TCPServer, object):
1976
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1979
enabled: Boolean; whether this server is activated yet
1980
interface: None or a network interface name (string)
1981
use_ipv6: Boolean; to use IPv6 or not
1984
def __init__(self, server_address, RequestHandlerClass,
1988
"""If socketfd is set, use that file descriptor instead of
1989
creating a new one with socket.socket().
1991
self.interface = interface
1993
self.address_family = socket.AF_INET6
1994
if socketfd is not None:
1995
# Save the file descriptor
1996
self.socketfd = socketfd
1997
# Save the original socket.socket() function
1998
self.socket_socket = socket.socket
1999
# To implement --socket, we monkey patch socket.socket.
2001
# (When socketserver.TCPServer is a new-style class, we
2002
# could make self.socket into a property instead of monkey
2003
# patching socket.socket.)
2005
# Create a one-time-only replacement for socket.socket()
2006
@functools.wraps(socket.socket)
2007
def socket_wrapper(*args, **kwargs):
2008
# Restore original function so subsequent calls are
2010
socket.socket = self.socket_socket
2011
del self.socket_socket
2012
# This time only, return a new socket object from the
2013
# saved file descriptor.
2014
return socket.fromfd(self.socketfd, *args, **kwargs)
2015
# Replace socket.socket() function with wrapper
2016
socket.socket = socket_wrapper
2017
# The socketserver.TCPServer.__init__ will call
2018
# socket.socket(), which might be our replacement,
2019
# socket_wrapper(), if socketfd was set.
2020
socketserver.TCPServer.__init__(self, server_address,
2021
RequestHandlerClass)
2023
def server_bind(self):
2024
"""This overrides the normal server_bind() function
2025
to bind to an interface if one was specified, and also NOT to
2026
bind to an address or port if they were not specified."""
2027
if self.interface is not None:
2028
if SO_BINDTODEVICE is None:
2029
logger.error("SO_BINDTODEVICE does not exist;"
2030
" cannot bind to interface %s",
2034
self.socket.setsockopt(
2035
socket.SOL_SOCKET, SO_BINDTODEVICE,
2036
(self.interface + "\0").encode("utf-8"))
2037
except socket.error as error:
2038
if error.errno == errno.EPERM:
2039
logger.error("No permission to bind to"
2040
" interface %s", self.interface)
2041
elif error.errno == errno.ENOPROTOOPT:
2042
logger.error("SO_BINDTODEVICE not available;"
2043
" cannot bind to interface %s",
2045
elif error.errno == errno.ENODEV:
2046
logger.error("Interface %s does not exist,"
2047
" cannot bind", self.interface)
2050
# Only bind(2) the socket if we really need to.
2051
if self.server_address[0] or self.server_address[1]:
2052
if not self.server_address[0]:
2053
if self.address_family == socket.AF_INET6:
2054
any_address = "::" # in6addr_any
2056
any_address = "0.0.0.0" # INADDR_ANY
2057
self.server_address = (any_address,
2058
self.server_address[1])
2059
elif not self.server_address[1]:
2060
self.server_address = (self.server_address[0], 0)
2061
# if self.interface:
2062
# self.server_address = (self.server_address[0],
2067
return socketserver.TCPServer.server_bind(self)
2070
class MandosServer(IPv6_TCPServer):
2074
clients: set of Client objects
2075
gnutls_priority GnuTLS priority string
2076
use_dbus: Boolean; to emit D-Bus signals or not
2078
Assumes a gobject.MainLoop event loop.
2081
def __init__(self, server_address, RequestHandlerClass,
2085
gnutls_priority=None,
2088
self.enabled = False
2089
self.clients = clients
2090
if self.clients is None:
2092
self.use_dbus = use_dbus
2093
self.gnutls_priority = gnutls_priority
2094
IPv6_TCPServer.__init__(self, server_address,
2095
RequestHandlerClass,
2096
interface = interface,
2097
use_ipv6 = use_ipv6,
2098
socketfd = socketfd)
2100
def server_activate(self):
2102
return socketserver.TCPServer.server_activate(self)
2107
def add_pipe(self, parent_pipe, proc):
2108
# Call "handle_ipc" for both data and EOF events
2109
gobject.io_add_watch(
2110
parent_pipe.fileno(),
2111
gobject.IO_IN | gobject.IO_HUP,
2112
functools.partial(self.handle_ipc,
2113
parent_pipe = parent_pipe,
2116
def handle_ipc(self, source, condition,
2119
client_object=None):
2120
# error, or the other end of multiprocessing.Pipe has closed
2121
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2122
# Wait for other process to exit
2126
# Read a request from the child
2127
request = parent_pipe.recv()
2128
command = request[0]
2130
if command == 'init':
2132
address = request[2]
2134
for c in self.clients.itervalues():
2135
if c.fingerprint == fpr:
2139
logger.info("Client not found for fingerprint: %s, ad"
2140
"dress: %s", fpr, address)
2143
mandos_dbus_service.ClientNotFound(fpr,
2145
parent_pipe.send(False)
2148
gobject.io_add_watch(
2149
parent_pipe.fileno(),
2150
gobject.IO_IN | gobject.IO_HUP,
2151
functools.partial(self.handle_ipc,
2152
parent_pipe = parent_pipe,
2154
client_object = client))
2155
parent_pipe.send(True)
2156
# remove the old hook in favor of the new above hook on
2159
if command == 'funcall':
2160
funcname = request[1]
2164
parent_pipe.send(('data', getattr(client_object,
2168
if command == 'getattr':
2169
attrname = request[1]
2170
if isinstance(client_object.__getattribute__(attrname),
2171
collections.Callable):
2172
parent_pipe.send(('function', ))
2175
'data', client_object.__getattribute__(attrname)))
2177
if command == 'setattr':
2178
attrname = request[1]
2180
setattr(client_object, attrname, value)
2185
def rfc3339_duration_to_delta(duration):
2186
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2188
>>> rfc3339_duration_to_delta("P7D")
2189
datetime.timedelta(7)
2190
>>> rfc3339_duration_to_delta("PT60S")
2191
datetime.timedelta(0, 60)
2192
>>> rfc3339_duration_to_delta("PT60M")
2193
datetime.timedelta(0, 3600)
2194
>>> rfc3339_duration_to_delta("PT24H")
2195
datetime.timedelta(1)
2196
>>> rfc3339_duration_to_delta("P1W")
2197
datetime.timedelta(7)
2198
>>> rfc3339_duration_to_delta("PT5M30S")
2199
datetime.timedelta(0, 330)
2200
>>> rfc3339_duration_to_delta("P1DT3M20S")
2201
datetime.timedelta(1, 200)
2204
# Parsing an RFC 3339 duration with regular expressions is not
2205
# possible - there would have to be multiple places for the same
2206
# values, like seconds. The current code, while more esoteric, is
2207
# cleaner without depending on a parsing library. If Python had a
2208
# built-in library for parsing we would use it, but we'd like to
2209
# avoid excessive use of external libraries.
2211
# New type for defining tokens, syntax, and semantics all-in-one
2212
Token = collections.namedtuple("Token", (
2213
"regexp", # To match token; if "value" is not None, must have
2214
# a "group" containing digits
2215
"value", # datetime.timedelta or None
2216
"followers")) # Tokens valid after this token
2217
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2218
# the "duration" ABNF definition in RFC 3339, Appendix A.
2219
token_end = Token(re.compile(r"$"), None, frozenset())
2220
token_second = Token(re.compile(r"(\d+)S"),
2221
datetime.timedelta(seconds=1),
2222
frozenset((token_end, )))
2223
token_minute = Token(re.compile(r"(\d+)M"),
2224
datetime.timedelta(minutes=1),
2225
frozenset((token_second, token_end)))
2226
token_hour = Token(re.compile(r"(\d+)H"),
2227
datetime.timedelta(hours=1),
2228
frozenset((token_minute, token_end)))
2229
token_time = Token(re.compile(r"T"),
2231
frozenset((token_hour, token_minute,
2233
token_day = Token(re.compile(r"(\d+)D"),
2234
datetime.timedelta(days=1),
2235
frozenset((token_time, token_end)))
2236
token_month = Token(re.compile(r"(\d+)M"),
2237
datetime.timedelta(weeks=4),
2238
frozenset((token_day, token_end)))
2239
token_year = Token(re.compile(r"(\d+)Y"),
2240
datetime.timedelta(weeks=52),
2241
frozenset((token_month, token_end)))
2242
token_week = Token(re.compile(r"(\d+)W"),
2243
datetime.timedelta(weeks=1),
2244
frozenset((token_end, )))
2245
token_duration = Token(re.compile(r"P"), None,
2246
frozenset((token_year, token_month,
2247
token_day, token_time,
2249
# Define starting values
2250
value = datetime.timedelta() # Value so far
2252
followers = frozenset((token_duration, )) # Following valid tokens
2253
s = duration # String left to parse
2254
# Loop until end token is found
2255
while found_token is not token_end:
2256
# Search for any currently valid tokens
2257
for token in followers:
2258
match = token.regexp.match(s)
2259
if match is not None:
2261
if token.value is not None:
2262
# Value found, parse digits
2263
factor = int(match.group(1), 10)
2264
# Add to value so far
2265
value += factor * token.value
2266
# Strip token from string
2267
s = token.regexp.sub("", s, 1)
2270
# Set valid next tokens
2271
followers = found_token.followers
2274
# No currently valid tokens were found
2275
raise ValueError("Invalid RFC 3339 duration: {!r}"
34
timeout = options.timeout
35
self.timeout = timeout
37
interval = options.interval
38
self.interval = interval
39
self.next_check = datetime.datetime.now()
42
class server_metaclass(type):
43
"Common behavior for the UDP and TCP server classes"
44
def __new__(cls, name, bases, attrs):
45
attrs["address_family"] = socket.AF_INET6
46
attrs["allow_reuse_address"] = True
47
def server_bind(self):
48
if self.options.interface:
49
if not hasattr(socket, "SO_BINDTODEVICE"):
50
# From /usr/include/asm-i486/socket.h
51
socket.SO_BINDTODEVICE = 25
53
self.socket.setsockopt(socket.SOL_SOCKET,
54
socket.SO_BINDTODEVICE,
55
self.options.interface)
56
except socket.error, error:
57
if error[0] == errno.EPERM:
58
print "Warning: No permission to bind to interface", \
59
self.options.interface
62
return super(type(self), self).server_bind()
63
attrs["server_bind"] = server_bind
64
def init(self, *args, **kwargs):
65
if "options" in kwargs:
66
self.options = kwargs["options"]
68
if "clients" in kwargs:
69
self.clients = kwargs["clients"]
71
if "credentials" in kwargs:
72
self.credentials = kwargs["credentials"]
73
del kwargs["credentials"]
74
return super(type(self), self).__init__(*args, **kwargs)
75
attrs["__init__"] = init
76
return type.__new__(cls, name, bases, attrs)
79
class udp_handler(SocketServer.DatagramRequestHandler, object):
81
self.wfile.write("Polo")
82
print "UDP request answered"
85
class IPv6_UDPServer(SocketServer.UDPServer, object):
86
__metaclass__ = server_metaclass
87
def verify_request(self, request, client_address):
88
print "UDP request came"
89
return request[0] == "Marco"
92
class tcp_handler(SocketServer.BaseRequestHandler, object):
94
print "TCP request came"
95
print "Request:", self.request
96
print "Client Address:", self.client_address
97
print "Server:", self.server
98
session = gnutls.connection.ServerSession(self.request,
99
self.server.credentials)
101
if session.peer_certificate:
102
print "DN:", session.peer_certificate.subject
104
session.verify_peer()
105
except gnutls.errors.CertificateError, error:
106
print "Verify failed", error
110
session.send(dict((client.dn, client.password)
111
for client in self.server.clients)
112
[session.peer_certificate.subject])
114
session.send("gazonk")
119
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
120
__metaclass__ = server_metaclass
121
request_queue_size = 1024
2281
128
def string_to_delta(interval):
2282
129
"""Parse a string and return a datetime.timedelta
2284
131
>>> string_to_delta('7d')
2285
132
datetime.timedelta(7)
2286
133
>>> string_to_delta('60s')
2289
136
datetime.timedelta(0, 3600)
2290
137
>>> string_to_delta('24h')
2291
138
datetime.timedelta(1)
2292
>>> string_to_delta('1w')
139
>>> string_to_delta(u'1w')
2293
140
datetime.timedelta(7)
2294
>>> string_to_delta('5m 30s')
2295
datetime.timedelta(0, 330)
2299
return rfc3339_duration_to_delta(interval)
2303
timevalue = datetime.timedelta(0)
2304
for s in interval.split():
2309
delta = datetime.timedelta(value)
2311
delta = datetime.timedelta(0, value)
2313
delta = datetime.timedelta(0, 0, 0, 0, value)
2315
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
2317
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2319
raise ValueError("Unknown suffix {!r}".format(suffix))
2320
except IndexError as e:
2321
raise ValueError(*(e.args))
2326
def daemon(nochdir = False, noclose = False):
2327
"""See daemon(3). Standard BSD Unix function.
2329
This should really exist as os.daemon, but it doesn't (yet)."""
2338
# Close all standard open file descriptors
2339
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2340
if not stat.S_ISCHR(os.fstat(null).st_mode):
2341
raise OSError(errno.ENODEV,
2342
"{} not a character device"
2343
.format(os.devnull))
2344
os.dup2(null, sys.stdin.fileno())
2345
os.dup2(null, sys.stdout.fileno())
2346
os.dup2(null, sys.stderr.fileno())
143
suffix=unicode(interval[-1])
144
value=int(interval[:-1])
146
delta = datetime.timedelta(value)
148
delta = datetime.timedelta(0, value)
150
delta = datetime.timedelta(0, 0, 0, 0, value)
152
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
154
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
157
except (ValueError, IndexError):
2353
##################################################################
2354
# Parsing of options, both command line and config file
2356
parser = argparse.ArgumentParser()
2357
parser.add_argument("-v", "--version", action="version",
2358
version = "%(prog)s {}".format(version),
2359
help="show version number and exit")
2360
parser.add_argument("-i", "--interface", metavar="IF",
2361
help="Bind to interface IF")
2362
parser.add_argument("-a", "--address",
2363
help="Address to listen for requests on")
2364
parser.add_argument("-p", "--port", type=int,
2365
help="Port number to receive requests on")
2366
parser.add_argument("--check", action="store_true",
2367
help="Run self-test")
2368
parser.add_argument("--debug", action="store_true",
2369
help="Debug mode; run in foreground and log"
2370
" to terminal", default=None)
2371
parser.add_argument("--debuglevel", metavar="LEVEL",
2372
help="Debug level for stdout output")
2373
parser.add_argument("--priority", help="GnuTLS"
2374
" priority string (see GnuTLS documentation)")
2375
parser.add_argument("--servicename",
2376
metavar="NAME", help="Zeroconf service name")
2377
parser.add_argument("--configdir",
2378
default="/etc/mandos", metavar="DIR",
2379
help="Directory to search for configuration"
2381
parser.add_argument("--no-dbus", action="store_false",
2382
dest="use_dbus", help="Do not provide D-Bus"
2383
" system bus interface", default=None)
2384
parser.add_argument("--no-ipv6", action="store_false",
2385
dest="use_ipv6", help="Do not use IPv6",
2387
parser.add_argument("--no-restore", action="store_false",
2388
dest="restore", help="Do not restore stored"
2389
" state", default=None)
2390
parser.add_argument("--socket", type=int,
2391
help="Specify a file descriptor to a network"
2392
" socket to use instead of creating one")
2393
parser.add_argument("--statedir", metavar="DIR",
2394
help="Directory to save/restore state in")
2395
parser.add_argument("--foreground", action="store_true",
2396
help="Run in foreground", default=None)
2397
parser.add_argument("--no-zeroconf", action="store_false",
2398
dest="zeroconf", help="Do not use Zeroconf",
2401
options = parser.parse_args()
162
parser = OptionParser()
163
parser.add_option("-i", "--interface", type="string",
164
default="eth0", metavar="IF",
165
help="Interface to bind to")
166
parser.add_option("--cert", type="string", default="cert.pem",
168
help="Public key certificate to use")
169
parser.add_option("--key", type="string", default="key.pem",
171
help="Private key to use")
172
parser.add_option("--ca", type="string", default="ca.pem",
174
help="Certificate Authority certificate to use")
175
parser.add_option("--crl", type="string", default="crl.pem",
177
help="Certificate Revokation List to use")
178
parser.add_option("-p", "--port", type="int", default=49001,
179
help="Port number to receive requests on")
180
parser.add_option("--dh", type="int", metavar="BITS",
181
help="DH group to use")
182
parser.add_option("-t", "--timeout", type="string", # Parsed later
184
help="Amount of downtime allowed for clients")
185
parser.add_option("--interval", type="string", # Parsed later
187
help="How often to check that a client is up")
188
parser.add_option("--check", action="store_true", default=False,
189
help="Run self-test")
190
(options, args) = parser.parse_args()
2403
192
if options.check:
2405
fail_count, test_count = doctest.testmod()
2406
sys.exit(os.EX_OK if fail_count == 0 else 1)
2408
# Default values for config file for server-global settings
2409
server_defaults = { "interface": "",
2414
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2415
":+SIGN-DSA-SHA256",
2416
"servicename": "Mandos",
2422
"statedir": "/var/lib/mandos",
2423
"foreground": "False",
2427
# Parse config file for server-global settings
2428
server_config = configparser.SafeConfigParser(server_defaults)
2430
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2431
# Convert the SafeConfigParser object to a dict
2432
server_settings = server_config.defaults()
2433
# Use the appropriate methods on the non-string config options
2434
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2435
server_settings[option] = server_config.getboolean("DEFAULT",
2437
if server_settings["port"]:
2438
server_settings["port"] = server_config.getint("DEFAULT",
2440
if server_settings["socket"]:
2441
server_settings["socket"] = server_config.getint("DEFAULT",
2443
# Later, stdin will, and stdout and stderr might, be dup'ed
2444
# over with an opened os.devnull. But we don't want this to
2445
# happen with a supplied network socket.
2446
if 0 <= server_settings["socket"] <= 2:
2447
server_settings["socket"] = os.dup(server_settings
2451
# Override the settings from the config file with command line
2453
for option in ("interface", "address", "port", "debug",
2454
"priority", "servicename", "configdir", "use_dbus",
2455
"use_ipv6", "debuglevel", "restore", "statedir",
2456
"socket", "foreground", "zeroconf"):
2457
value = getattr(options, option)
2458
if value is not None:
2459
server_settings[option] = value
2461
# Force all strings to be unicode
2462
for option in server_settings.keys():
2463
if isinstance(server_settings[option], bytes):
2464
server_settings[option] = (server_settings[option]
2466
# Force all boolean options to be boolean
2467
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2468
"foreground", "zeroconf"):
2469
server_settings[option] = bool(server_settings[option])
2470
# Debug implies foreground
2471
if server_settings["debug"]:
2472
server_settings["foreground"] = True
2473
# Now we have our good server settings in "server_settings"
2475
##################################################################
2477
if (not server_settings["zeroconf"]
2478
and not (server_settings["port"]
2479
or server_settings["socket"] != "")):
2480
parser.error("Needs port or socket to work without Zeroconf")
2483
debug = server_settings["debug"]
2484
debuglevel = server_settings["debuglevel"]
2485
use_dbus = server_settings["use_dbus"]
2486
use_ipv6 = server_settings["use_ipv6"]
2487
stored_state_path = os.path.join(server_settings["statedir"],
2489
foreground = server_settings["foreground"]
2490
zeroconf = server_settings["zeroconf"]
2493
initlogger(debug, logging.DEBUG)
2498
level = getattr(logging, debuglevel.upper())
2499
initlogger(debug, level)
2501
if server_settings["servicename"] != "Mandos":
2502
syslogger.setFormatter(
2503
logging.Formatter('Mandos ({}) [%(process)d]:'
2504
' %(levelname)s: %(message)s'.format(
2505
server_settings["servicename"])))
2507
# Parse config file with clients
2508
client_config = configparser.SafeConfigParser(Client
2510
client_config.read(os.path.join(server_settings["configdir"],
2513
global mandos_dbus_service
2514
mandos_dbus_service = None
2517
if server_settings["socket"] != "":
2518
socketfd = server_settings["socket"]
2519
tcp_server = MandosServer(
2520
(server_settings["address"], server_settings["port"]),
2522
interface=(server_settings["interface"] or None),
2524
gnutls_priority=server_settings["priority"],
2528
pidfilename = "/run/mandos.pid"
2529
if not os.path.isdir("/run/."):
2530
pidfilename = "/var/run/mandos.pid"
2533
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2534
except IOError as e:
2535
logger.error("Could not open file %r", pidfilename,
2538
for name in ("_mandos", "mandos", "nobody"):
2540
uid = pwd.getpwnam(name).pw_uid
2541
gid = pwd.getpwnam(name).pw_gid
2551
except OSError as error:
2552
if error.errno != errno.EPERM:
2556
# Enable all possible GnuTLS debugging
2558
# "Use a log level over 10 to enable all debugging options."
2560
gnutls.library.functions.gnutls_global_set_log_level(11)
2562
@gnutls.library.types.gnutls_log_func
2563
def debug_gnutls(level, string):
2564
logger.debug("GnuTLS: %s", string[:-1])
2566
gnutls.library.functions.gnutls_global_set_log_function(
2569
# Redirect stdin so all checkers get /dev/null
2570
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2571
os.dup2(null, sys.stdin.fileno())
2575
# Need to fork before connecting to D-Bus
2577
# Close all input and output, do double fork, etc.
2580
# multiprocessing will use threads, so before we use gobject we
2581
# need to inform gobject that threads will be used.
2582
gobject.threads_init()
2585
# From the Avahi example code
2586
DBusGMainLoop(set_as_default=True)
2587
main_loop = gobject.MainLoop()
2588
bus = dbus.SystemBus()
2589
# End of Avahi example code
2592
bus_name = dbus.service.BusName("se.recompile.Mandos",
2595
old_bus_name = dbus.service.BusName(
2596
"se.bsnet.fukt.Mandos", bus,
2598
except dbus.exceptions.DBusException as e:
2599
logger.error("Disabling D-Bus:", exc_info=e)
2601
server_settings["use_dbus"] = False
2602
tcp_server.use_dbus = False
2604
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2605
service = AvahiServiceToSyslog(
2606
name = server_settings["servicename"],
2607
servicetype = "_mandos._tcp",
2608
protocol = protocol,
2610
if server_settings["interface"]:
2611
service.interface = if_nametoindex(
2612
server_settings["interface"].encode("utf-8"))
2614
global multiprocessing_manager
2615
multiprocessing_manager = multiprocessing.Manager()
2617
client_class = Client
2619
client_class = functools.partial(ClientDBus, bus = bus)
2621
client_settings = Client.config_parser(client_config)
2622
old_client_settings = {}
2625
# This is used to redirect stdout and stderr for checker processes
2627
wnull = open(os.devnull, "w") # A writable /dev/null
2628
# Only used if server is running in foreground but not in debug
2630
if debug or not foreground:
2633
# Get client data and settings from last running state.
2634
if server_settings["restore"]:
2636
with open(stored_state_path, "rb") as stored_state:
2637
clients_data, old_client_settings = pickle.load(
2639
os.remove(stored_state_path)
2640
except IOError as e:
2641
if e.errno == errno.ENOENT:
2642
logger.warning("Could not load persistent state:"
2643
" {}".format(os.strerror(e.errno)))
2645
logger.critical("Could not load persistent state:",
2648
except EOFError as e:
2649
logger.warning("Could not load persistent state: "
2653
with PGPEngine() as pgp:
2654
for client_name, client in clients_data.items():
2655
# Skip removed clients
2656
if client_name not in client_settings:
2659
# Decide which value to use after restoring saved state.
2660
# We have three different values: Old config file,
2661
# new config file, and saved state.
2662
# New config value takes precedence if it differs from old
2663
# config value, otherwise use saved state.
2664
for name, value in client_settings[client_name].items():
2666
# For each value in new config, check if it
2667
# differs from the old config value (Except for
2668
# the "secret" attribute)
2669
if (name != "secret"
2671
old_client_settings[client_name][name])):
2672
client[name] = value
2676
# Clients who has passed its expire date can still be
2677
# enabled if its last checker was successful. A Client
2678
# whose checker succeeded before we stored its state is
2679
# assumed to have successfully run all checkers during
2681
if client["enabled"]:
2682
if datetime.datetime.utcnow() >= client["expires"]:
2683
if not client["last_checked_ok"]:
2685
"disabling client {} - Client never "
2686
"performed a successful checker".format(
2688
client["enabled"] = False
2689
elif client["last_checker_status"] != 0:
2691
"disabling client {} - Client last"
2692
" checker failed with error code"
2695
client["last_checker_status"]))
2696
client["enabled"] = False
2698
client["expires"] = (
2699
datetime.datetime.utcnow()
2700
+ client["timeout"])
2701
logger.debug("Last checker succeeded,"
2702
" keeping {} enabled".format(
2705
client["secret"] = pgp.decrypt(
2706
client["encrypted_secret"],
2707
client_settings[client_name]["secret"])
2709
# If decryption fails, we use secret from new settings
2710
logger.debug("Failed to decrypt {} old secret".format(
2712
client["secret"] = (client_settings[client_name]
2715
# Add/remove clients based on new changes made to config
2716
for client_name in (set(old_client_settings)
2717
- set(client_settings)):
2718
del clients_data[client_name]
2719
for client_name in (set(client_settings)
2720
- set(old_client_settings)):
2721
clients_data[client_name] = client_settings[client_name]
2723
# Create all client objects
2724
for client_name, client in clients_data.items():
2725
tcp_server.clients[client_name] = client_class(
2728
server_settings = server_settings)
2730
if not tcp_server.clients:
2731
logger.warning("No clients defined")
2734
if pidfile is not None:
2738
print(pid, file=pidfile)
2740
logger.error("Could not write to file %r with PID %d",
2745
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2746
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2750
@alternate_dbus_interfaces(
2751
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2752
class MandosDBusService(DBusObjectWithProperties):
2753
"""A D-Bus proxy object"""
2756
dbus.service.Object.__init__(self, bus, "/")
2758
_interface = "se.recompile.Mandos"
2760
@dbus_interface_annotations(_interface)
2763
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2766
@dbus.service.signal(_interface, signature="o")
2767
def ClientAdded(self, objpath):
2771
@dbus.service.signal(_interface, signature="ss")
2772
def ClientNotFound(self, fingerprint, address):
2776
@dbus.service.signal(_interface, signature="os")
2777
def ClientRemoved(self, objpath, name):
2781
@dbus.service.method(_interface, out_signature="ao")
2782
def GetAllClients(self):
2784
return dbus.Array(c.dbus_object_path for c in
2785
tcp_server.clients.itervalues())
2787
@dbus.service.method(_interface,
2788
out_signature="a{oa{sv}}")
2789
def GetAllClientsWithProperties(self):
2791
return dbus.Dictionary(
2792
{ c.dbus_object_path: c.GetAll("")
2793
for c in tcp_server.clients.itervalues() },
2796
@dbus.service.method(_interface, in_signature="o")
2797
def RemoveClient(self, object_path):
2799
for c in tcp_server.clients.itervalues():
2800
if c.dbus_object_path == object_path:
2801
del tcp_server.clients[c.name]
2802
c.remove_from_connection()
2803
# Don't signal anything except ClientRemoved
2804
c.disable(quiet=True)
2806
self.ClientRemoved(object_path, c.name)
2808
raise KeyError(object_path)
2812
mandos_dbus_service = MandosDBusService()
2815
"Cleanup function; run on exit"
2819
multiprocessing.active_children()
2821
if not (tcp_server.clients or client_settings):
2824
# Store client before exiting. Secrets are encrypted with key
2825
# based on what config file has. If config file is
2826
# removed/edited, old secret will thus be unrecovable.
2828
with PGPEngine() as pgp:
2829
for client in tcp_server.clients.itervalues():
2830
key = client_settings[client.name]["secret"]
2831
client.encrypted_secret = pgp.encrypt(client.secret,
2835
# A list of attributes that can not be pickled
2837
exclude = { "bus", "changedstate", "secret",
2838
"checker", "server_settings" }
2839
for name, typ in inspect.getmembers(dbus.service
2843
client_dict["encrypted_secret"] = (client
2845
for attr in client.client_structure:
2846
if attr not in exclude:
2847
client_dict[attr] = getattr(client, attr)
2849
clients[client.name] = client_dict
2850
del client_settings[client.name]["secret"]
2853
with tempfile.NamedTemporaryFile(
2857
dir=os.path.dirname(stored_state_path),
2858
delete=False) as stored_state:
2859
pickle.dump((clients, client_settings), stored_state)
2860
tempname = stored_state.name
2861
os.rename(tempname, stored_state_path)
2862
except (IOError, OSError) as e:
2868
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2869
logger.warning("Could not save persistent state: {}"
2870
.format(os.strerror(e.errno)))
2872
logger.warning("Could not save persistent state:",
2876
# Delete all clients, and settings from config
2877
while tcp_server.clients:
2878
name, client = tcp_server.clients.popitem()
2880
client.remove_from_connection()
2881
# Don't signal anything except ClientRemoved
2882
client.disable(quiet=True)
2885
mandos_dbus_service.ClientRemoved(
2886
client.dbus_object_path, client.name)
2887
client_settings.clear()
2889
atexit.register(cleanup)
2891
for client in tcp_server.clients.itervalues():
2894
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2895
# Need to initiate checking of clients
2897
client.init_checker()
2900
tcp_server.server_activate()
2902
# Find out what port we got
2904
service.port = tcp_server.socket.getsockname()[1]
2906
logger.info("Now listening on address %r, port %d,"
2907
" flowinfo %d, scope_id %d",
2908
*tcp_server.socket.getsockname())
2910
logger.info("Now listening on address %r, port %d",
2911
*tcp_server.socket.getsockname())
2913
#service.interface = tcp_server.socket.getsockname()[3]
2917
# From the Avahi example code
2920
except dbus.exceptions.DBusException as error:
2921
logger.critical("D-Bus Exception", exc_info=error)
2924
# End of Avahi example code
2926
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2927
lambda *args, **kwargs:
2928
(tcp_server.handle_request
2929
(*args[2:], **kwargs) or True))
2931
logger.debug("Starting main loop")
2933
except AvahiError as error:
2934
logger.critical("Avahi Error", exc_info=error)
2937
except KeyboardInterrupt:
2939
print("", file=sys.stderr)
2940
logger.debug("Server received KeyboardInterrupt")
2941
logger.debug("Server exiting")
2942
# Must run before the D-Bus bus name gets deregistered
2946
if __name__ == '__main__':
197
# Parse the time arguments
199
options.timeout = string_to_delta(options.timeout)
201
parser.error("option --timeout: Unparseable time")
204
options.interval = string_to_delta(options.interval)
206
parser.error("option --interval: Unparseable time")
208
cert = gnutls.crypto.X509Certificate(open(options.cert).read())
209
key = gnutls.crypto.X509PrivateKey(open(options.key).read())
210
ca = gnutls.crypto.X509Certificate(open(options.ca).read())
211
crl = gnutls.crypto.X509CRL(open(options.crl).read())
212
cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
216
client_config_object = ConfigParser.SafeConfigParser(defaults)
217
client_config_object.read("mandos-clients.conf")
218
clients = [Client(name=section, options=options,
219
**(dict(client_config_object.items(section))))
220
for section in client_config_object.sections()]
222
udp_server = IPv6_UDPServer((in6addr_any, options.port),
226
tcp_server = IPv6_TCPServer((in6addr_any, options.port),
233
in_, out, err = select.select((udp_server,
236
server.handle_request()
239
if __name__ == "__main__":