101
88
except ImportError:
102
89
SO_BINDTODEVICE = None
104
if sys.version_info.major == 2:
108
92
stored_state_file = "clients.pickle"
110
94
logger = logging.getLogger()
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
116
101
except (OSError, AttributeError):
118
102
def if_nametoindex(interface):
119
103
"Get an interface index the hard way, i.e. using fcntl()"
120
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
105
with contextlib.closing(socket.socket()) as s:
122
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
109
interface_index = struct.unpack(str("I"),
125
111
return interface_index
129
115
"""init logger and add loglevel"""
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
118
syslogger = (logging.handlers.SysLogHandler
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
135
122
syslogger.setFormatter(logging.Formatter
136
123
('Mandos [%(process)d]: %(levelname)s:'
200
186
def encrypt(self, data, password):
201
187
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
204
190
passfile.write(passphrase)
206
192
proc = subprocess.Popen(['gpg', '--symmetric',
218
204
def decrypt(self, data, password):
219
205
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
222
208
passfile.write(passphrase)
224
210
proc = subprocess.Popen(['gpg', '--decrypt',
237
224
class AvahiError(Exception):
238
225
def __init__(self, value, *args, **kwargs):
239
226
self.value = value
240
return super(AvahiError, self).__init__(value, *args,
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
244
231
class AvahiServiceError(AvahiError):
248
234
class AvahiGroupError(AvahiError):
270
256
bus: dbus.SystemBus()
274
interface = avahi.IF_UNSPEC,
282
protocol = avahi.PROTO_UNSPEC,
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
284
263
self.interface = interface
286
265
self.type = servicetype
297
276
self.entry_group_state_changed_match = None
299
def rename(self, remove=True):
300
279
"""Derived from the Avahi example code"""
301
280
if self.rename_count >= self.max_renames:
302
281
logger.critical("No suitable Zeroconf service name found"
303
282
" after %i retries, exiting.",
304
283
self.rename_count)
305
284
raise AvahiServiceError("Too many renames")
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
285
self.name = unicode(self.server
286
.GetAlternativeServiceName(self.name))
309
287
logger.info("Changing Zeroconf service name to %r ...",
315
292
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
321
logger.critical("D-Bus Exception", exc_info=error)
293
logger.critical("D-Bus Exception", exc_info=error)
296
self.rename_count += 1
325
298
def remove(self):
326
299
"""Derived from the Avahi example code"""
381
355
def server_state_changed(self, state, error=None):
382
356
"""Derived from the Avahi example code"""
383
357
logger.debug("Avahi server state change: %i", state)
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
358
bad_states = { avahi.SERVER_INVALID:
359
"Zeroconf server invalid",
360
avahi.SERVER_REGISTERING: None,
361
avahi.SERVER_COLLISION:
362
"Zeroconf server name collision",
363
avahi.SERVER_FAILURE:
364
"Zeroconf server failure" }
390
365
if state in bad_states:
391
366
if bad_states[state] is not None:
392
367
if error is None:
411
386
follow_name_owner_changes=True),
412
387
avahi.DBUS_INTERFACE_SERVER)
413
388
self.server.connect_to_signal("StateChanged",
414
self.server_state_changed)
389
self.server_state_changed)
415
390
self.server_state_changed(self.server.GetState())
418
393
class AvahiServiceToSyslog(AvahiService):
419
def rename(self, *args, **kwargs):
420
395
"""Add the new name to the syslog messages"""
421
ret = AvahiService.rename(self, *args, **kwargs)
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({0}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
404
def timedelta_to_milliseconds(td):
405
"Convert a datetime.timedelta() to milliseconds"
406
return ((td.days * 24 * 60 * 60 * 1000)
407
+ (td.seconds * 1000)
408
+ (td.microseconds // 1000))
428
411
class Client(object):
429
412
"""A representation of a client host served by this server.
474
457
"fingerprint", "host", "interval",
475
458
"last_approval_request", "last_checked_ok",
476
459
"last_enabled", "name", "timeout")
479
"extended_timeout": "PT15M",
481
"checker": "fping -q -- %%(host)s",
483
"approval_delay": "PT0S",
484
"approval_duration": "PT1S",
485
"approved_by_default": "True",
460
client_defaults = { "timeout": "PT5M",
461
"extended_timeout": "PT15M",
463
"checker": "fping -q -- %%(host)s",
465
"approval_delay": "PT0S",
466
"approval_duration": "PT1S",
467
"approved_by_default": "True",
471
def timeout_milliseconds(self):
472
"Return the 'timeout' attribute in milliseconds"
473
return timedelta_to_milliseconds(self.timeout)
475
def extended_timeout_milliseconds(self):
476
"Return the 'extended_timeout' attribute in milliseconds"
477
return timedelta_to_milliseconds(self.extended_timeout)
479
def interval_milliseconds(self):
480
"Return the 'interval' attribute in milliseconds"
481
return timedelta_to_milliseconds(self.interval)
483
def approval_delay_milliseconds(self):
484
return timedelta_to_milliseconds(self.approval_delay)
490
487
def config_parser(config):
568
565
self.current_checker_command = None
569
566
self.approved = None
570
567
self.approvals_pending = 0
571
self.changedstate = multiprocessing_manager.Condition(
572
multiprocessing_manager.Lock())
573
self.client_structure = [attr
574
for attr in self.__dict__.iterkeys()
568
self.changedstate = (multiprocessing_manager
569
.Condition(multiprocessing_manager
571
self.client_structure = [attr for attr in
572
self.__dict__.iterkeys()
575
573
if not attr.startswith("_")]
576
574
self.client_structure.append("client_structure")
578
for name, t in inspect.getmembers(
579
type(self), lambda obj: isinstance(obj, property)):
576
for name, t in inspect.getmembers(type(self),
580
580
if not name.startswith("_"):
581
581
self.client_structure.append(name)
624
624
# and every interval from then on.
625
625
if self.checker_initiator_tag is not None:
626
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
627
self.checker_initiator_tag = (gobject.timeout_add
628
(self.interval_milliseconds(),
630
630
# Schedule a disable() when 'timeout' has passed
631
631
if self.disable_initiator_tag is not None:
632
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
634
int(self.timeout.total_seconds() * 1000), self.disable)
633
self.disable_initiator_tag = (gobject.timeout_add
634
(self.timeout_milliseconds(),
635
636
# Also start a new checker *right now*.
636
637
self.start_checker()
666
668
gobject.source_remove(self.disable_initiator_tag)
667
669
self.disable_initiator_tag = None
668
670
if getattr(self, "enabled", False):
669
self.disable_initiator_tag = gobject.timeout_add(
670
int(timeout.total_seconds() * 1000), self.disable)
671
self.disable_initiator_tag = (gobject.timeout_add
672
(timedelta_to_milliseconds
673
(timeout), self.disable))
671
674
self.expires = datetime.datetime.utcnow() + timeout
673
676
def need_approval(self):
704
707
# Start a new checker if needed
705
708
if self.checker is None:
706
709
# Escape attributes for the shell
708
attr: re.escape(str(getattr(self, attr)))
709
for attr in self.runtime_expansions }
710
escaped_attrs = dict(
711
(attr, re.escape(unicode(getattr(self, attr))))
713
self.runtime_expansions)
711
715
command = self.checker_command % escaped_attrs
712
716
except TypeError as error:
713
717
logger.error('Could not format string "%s"',
714
self.checker_command,
716
return True # Try again later
718
self.checker_command, exc_info=error)
719
return True # Try again later
717
720
self.current_checker_command = command
719
logger.info("Starting checker %r for %s", command,
722
logger.info("Starting checker %r for %s",
721
724
# We don't need to redirect stdout and stderr, since
722
725
# in normal mode, that is already done by daemon(),
723
726
# and in debug mode we don't want to. (Stdin is
732
735
"stderr": wnull })
733
736
self.checker = subprocess.Popen(command,
738
740
except OSError as error:
739
741
logger.error("Failed to start subprocess",
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
self.checker_callback_tag = (gobject.child_watch_add
746
self.checker_callback,
744
748
# The checker may have completed before the gobject
745
749
# watch was added. Check for this.
836
834
"""Decorator to annotate D-Bus methods, signals or properties
839
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
842
837
@dbus_service_property("org.example.Interface", signature="b",
839
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
844
842
def Property_dbus_property(self):
845
843
return dbus.Boolean(False)
848
845
def decorator(func):
849
846
func._dbus_annotations = annotations
855
851
class DBusPropertyException(dbus.exceptions.DBusException):
856
852
"""A base class for D-Bus property-related exceptions
854
def __unicode__(self):
855
return unicode(str(self))
861
858
class DBusPropertyAccessException(DBusPropertyException):
885
882
If called like _is_dbus_thing("method") it returns a function
886
883
suitable for use as predicate to inspect.getmembers().
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
891
888
def _get_all_dbus_things(self, thing):
892
889
"""Returns a generator of (name, attribute) pairs
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
891
return ((getattr(athing.__get__(self), "_dbus_name",
895
893
athing.__get__(self))
896
894
for cls in self.__class__.__mro__
897
895
for name, athing in
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
896
inspect.getmembers(cls,
897
self._is_dbus_thing(thing)))
900
899
def _get_dbus_property(self, interface_name, property_name):
901
900
"""Returns a bound method if one exists which is a D-Bus
902
901
property with the specified name and interface.
904
for cls in self.__class__.__mro__:
905
for name, value in inspect.getmembers(
906
cls, self._is_dbus_thing("property")):
903
for cls in self.__class__.__mro__:
904
for name, value in (inspect.getmembers
906
self._is_dbus_thing("property"))):
907
907
if (value._dbus_name == property_name
908
908
and value._dbus_interface == interface_name):
909
909
return value.__get__(self)
911
911
# No such property
912
raise DBusPropertyNotFound("{}:{}.{}".format(
913
self.dbus_object_path, interface_name, property_name))
912
raise DBusPropertyNotFound(self.dbus_object_path + ":"
913
+ interface_name + "."
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
916
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
917
917
out_signature="v")
918
918
def Get(self, interface_name, property_name):
919
919
"""Standard D-Bus property Get() method, see D-Bus standard.
938
938
# signatures other than "ay".
939
939
if prop._dbus_signature != "ay":
940
940
raise ValueError("Byte arrays not supported for non-"
941
"'ay' signature {!r}"
941
"'ay' signature {0!r}"
942
942
.format(prop._dbus_signature))
943
943
value = dbus.ByteArray(b''.join(chr(byte)
944
944
for byte in value))
947
@dbus.service.method(dbus.PROPERTIES_IFACE,
947
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
949
948
out_signature="a{sv}")
950
949
def GetAll(self, interface_name):
951
950
"""Standard D-Bus property GetAll() method, see D-Bus
966
965
if not hasattr(value, "variant_level"):
967
966
properties[name] = value
969
properties[name] = type(value)(
970
value, variant_level = value.variant_level + 1)
968
properties[name] = type(value)(value, variant_level=
969
value.variant_level+1)
971
970
return dbus.Dictionary(properties, signature="sv")
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
974
def PropertiesChanged(self, interface_name, changed_properties,
975
invalidated_properties):
976
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
981
972
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
982
973
out_signature="s",
983
974
path_keyword='object_path',
993
984
document = xml.dom.minidom.parseString(xmlstring)
995
985
def make_tag(document, name, prop):
996
986
e = document.createElement("property")
997
987
e.setAttribute("name", name)
998
988
e.setAttribute("type", prop._dbus_signature)
999
989
e.setAttribute("access", prop._dbus_access)
1002
991
for if_tag in document.getElementsByTagName("interface"):
1003
992
# Add property tags
1004
993
for tag in (make_tag(document, name, prop)
1016
1005
if (name == tag.getAttribute("name")
1017
1006
and prop._dbus_interface
1018
1007
== if_tag.getAttribute("name")):
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
1008
annots.update(getattr
1010
"_dbus_annotations",
1012
for name, value in annots.iteritems():
1022
1013
ann_tag = document.createElement(
1024
1015
ann_tag.setAttribute("name", name)
1027
1018
# Add interface annotation tags
1028
1019
for annotation, value in dict(
1029
1020
itertools.chain.from_iterable(
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1021
annotations().iteritems()
1022
for name, annotations in
1023
self._get_all_dbus_things("interface")
1033
1024
if name == if_tag.getAttribute("name")
1035
1026
ann_tag = document.createElement("annotation")
1036
1027
ann_tag.setAttribute("name", annotation)
1037
1028
ann_tag.setAttribute("value", value)
1101
1092
# Ignore non-D-Bus attributes, and D-Bus attributes
1102
1093
# with the wrong interface name
1103
1094
if (not hasattr(attribute, "_dbus_interface")
1104
or not attribute._dbus_interface.startswith(
1105
orig_interface_name)):
1095
or not attribute._dbus_interface
1096
.startswith(orig_interface_name)):
1107
1098
# Create an alternate D-Bus interface name based on
1108
1099
# the current name
1109
alt_interface = attribute._dbus_interface.replace(
1110
orig_interface_name, alt_interface_name)
1100
alt_interface = (attribute._dbus_interface
1101
.replace(orig_interface_name,
1102
alt_interface_name))
1111
1103
interface_names.add(alt_interface)
1112
1104
# Is this a D-Bus signal?
1113
1105
if getattr(attribute, "_dbus_is_signal", False):
1114
if sys.version == 2:
1115
# Extract the original non-method undecorated
1116
# function by black magic
1117
nonmethod_func = (dict(
1106
# Extract the original non-method undecorated
1107
# function by black magic
1108
nonmethod_func = (dict(
1118
1109
zip(attribute.func_code.co_freevars,
1119
attribute.__closure__))
1120
["func"].cell_contents)
1122
nonmethod_func = attribute
1110
attribute.__closure__))["func"]
1123
1112
# Create a new, but exactly alike, function
1124
1113
# object, and decorate it to be a new D-Bus signal
1125
1114
# with the alternate D-Bus interface name
1126
if sys.version == 2:
1127
new_function = types.FunctionType(
1128
nonmethod_func.func_code,
1129
nonmethod_func.func_globals,
1130
nonmethod_func.func_name,
1131
nonmethod_func.func_defaults,
1132
nonmethod_func.func_closure)
1134
new_function = types.FunctionType(
1135
nonmethod_func.__code__,
1136
nonmethod_func.__globals__,
1137
nonmethod_func.__name__,
1138
nonmethod_func.__defaults__,
1139
nonmethod_func.__closure__)
1140
new_function = (dbus.service.signal(
1142
attribute._dbus_signature)(new_function))
1115
new_function = (dbus.service.signal
1117
attribute._dbus_signature)
1118
(types.FunctionType(
1119
nonmethod_func.func_code,
1120
nonmethod_func.func_globals,
1121
nonmethod_func.func_name,
1122
nonmethod_func.func_defaults,
1123
nonmethod_func.func_closure)))
1143
1124
# Copy annotations, if any
1145
new_function._dbus_annotations = dict(
1146
attribute._dbus_annotations)
1126
new_function._dbus_annotations = (
1127
dict(attribute._dbus_annotations))
1147
1128
except AttributeError:
1149
1130
# Define a creator of a function to call both the
1171
1150
# object. Decorate it to be a new D-Bus method
1172
1151
# with the alternate D-Bus interface name. Add it
1173
1152
# to the class.
1175
dbus.service.method(
1177
attribute._dbus_in_signature,
1178
attribute._dbus_out_signature)
1179
(types.FunctionType(attribute.func_code,
1180
attribute.func_globals,
1181
attribute.func_name,
1182
attribute.func_defaults,
1183
attribute.func_closure)))
1153
attr[attrname] = (dbus.service.method
1155
attribute._dbus_in_signature,
1156
attribute._dbus_out_signature)
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1184
1163
# Copy annotations, if any
1186
attr[attrname]._dbus_annotations = dict(
1187
attribute._dbus_annotations)
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1188
1167
except AttributeError:
1190
1169
# Is this a D-Bus property?
1193
1172
# object, and decorate it to be a new D-Bus
1194
1173
# property with the alternate D-Bus interface
1195
1174
# name. Add it to the class.
1196
attr[attrname] = (dbus_service_property(
1197
alt_interface, attribute._dbus_signature,
1198
attribute._dbus_access,
1199
attribute._dbus_get_args_options
1201
(types.FunctionType(
1202
attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1175
attr[attrname] = (dbus_service_property
1177
attribute._dbus_signature,
1178
attribute._dbus_access,
1180
._dbus_get_args_options
1183
(attribute.func_code,
1184
attribute.func_globals,
1185
attribute.func_name,
1186
attribute.func_defaults,
1187
attribute.func_closure)))
1207
1188
# Copy annotations, if any
1209
attr[attrname]._dbus_annotations = dict(
1210
attribute._dbus_annotations)
1190
attr[attrname]._dbus_annotations = (
1191
dict(attribute._dbus_annotations))
1211
1192
except AttributeError:
1213
1194
# Is this a D-Bus interface?
1216
1197
# object. Decorate it to be a new D-Bus interface
1217
1198
# with the alternate D-Bus interface name. Add it
1218
1199
# to the class.
1220
dbus_interface_annotations(alt_interface)
1221
(types.FunctionType(attribute.func_code,
1222
attribute.func_globals,
1223
attribute.func_name,
1224
attribute.func_defaults,
1225
attribute.func_closure)))
1200
attr[attrname] = (dbus_interface_annotations
1203
(attribute.func_code,
1204
attribute.func_globals,
1205
attribute.func_name,
1206
attribute.func_defaults,
1207
attribute.func_closure)))
1227
1209
# Deprecate all alternate interfaces
1228
iname="_AlternateDBusNames_interface_annotation{}"
1210
iname="_AlternateDBusNames_interface_annotation{0}"
1229
1211
for interface_name in interface_names:
1231
1212
@dbus_interface_annotations(interface_name)
1232
1213
def func(self):
1233
1214
return { "org.freedesktop.DBus.Deprecated":
1235
1216
# Find an unused name
1236
1217
for aname in (iname.format(i)
1237
1218
for i in itertools.count()):
1241
1222
if interface_names:
1242
1223
# Replace the class with a new subclass of it with
1243
1224
# methods, signals, etc. as created above.
1244
cls = type(b"{}Alternate".format(cls.__name__),
1225
cls = type(b"{0}Alternate".format(cls.__name__),
1251
1231
@alternate_dbus_interfaces({"se.recompile.Mandos":
1252
"se.bsnet.fukt.Mandos"})
1232
"se.bsnet.fukt.Mandos"})
1253
1233
class ClientDBus(Client, DBusObjectWithProperties):
1254
1234
"""A Client class using D-Bus
1270
1248
Client.__init__(self, *args, **kwargs)
1271
1249
# Only now, when this client is initialized, can it show up on
1273
client_object_name = str(self.name).translate(
1251
client_object_name = unicode(self.name).translate(
1274
1252
{ord("."): ord("_"),
1275
1253
ord("-"): ord("_")})
1276
self.dbus_object_path = dbus.ObjectPath(
1277
"/clients/" + client_object_name)
1254
self.dbus_object_path = (dbus.ObjectPath
1255
("/clients/" + client_object_name))
1278
1256
DBusObjectWithProperties.__init__(self, self.bus,
1279
1257
self.dbus_object_path)
1281
def notifychangeproperty(transform_func, dbus_name,
1282
type_func=lambda x: x,
1284
invalidate_only=False,
1285
_interface=_interface):
1259
def notifychangeproperty(transform_func,
1260
dbus_name, type_func=lambda x: x,
1286
1262
""" Modify a variable so that it's a property which announces
1287
1263
its changes to DBus.
1293
1269
to the D-Bus. Default: no transform
1294
1270
variant_level: D-Bus variant level. Default: 1
1296
attrname = "_{}".format(dbus_name)
1272
attrname = "_{0}".format(dbus_name)
1298
1273
def setter(self, value):
1299
1274
if hasattr(self, "dbus_object_path"):
1300
1275
if (not hasattr(self, attrname) or
1301
1276
type_func(getattr(self, attrname, None))
1302
1277
!= type_func(value)):
1304
self.PropertiesChanged(
1305
_interface, dbus.Dictionary(),
1306
dbus.Array((dbus_name, )))
1308
dbus_value = transform_func(
1310
variant_level = variant_level)
1311
self.PropertyChanged(dbus.String(dbus_name),
1313
self.PropertiesChanged(
1315
dbus.Dictionary({ dbus.String(dbus_name):
1278
dbus_value = transform_func(type_func(value),
1281
self.PropertyChanged(dbus.String(dbus_name),
1318
1283
setattr(self, attrname, value)
1320
1285
return property(lambda self: getattr(self, attrname), setter)
1326
1291
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1327
1292
last_enabled = notifychangeproperty(datetime_to_dbus,
1329
checker = notifychangeproperty(
1330
dbus.Boolean, "CheckerRunning",
1331
type_func = lambda checker: checker is not None)
1294
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1295
type_func = lambda checker:
1296
checker is not None)
1332
1297
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1333
1298
"LastCheckedOK")
1334
1299
last_checker_status = notifychangeproperty(dbus.Int16,
1337
1302
datetime_to_dbus, "LastApprovalRequest")
1338
1303
approved_by_default = notifychangeproperty(dbus.Boolean,
1339
1304
"ApprovedByDefault")
1340
approval_delay = notifychangeproperty(
1341
dbus.UInt64, "ApprovalDelay",
1342
type_func = lambda td: td.total_seconds() * 1000)
1305
approval_delay = notifychangeproperty(dbus.UInt64,
1308
timedelta_to_milliseconds)
1343
1309
approval_duration = notifychangeproperty(
1344
1310
dbus.UInt64, "ApprovalDuration",
1345
type_func = lambda td: td.total_seconds() * 1000)
1311
type_func = timedelta_to_milliseconds)
1346
1312
host = notifychangeproperty(dbus.String, "Host")
1347
timeout = notifychangeproperty(
1348
dbus.UInt64, "Timeout",
1349
type_func = lambda td: td.total_seconds() * 1000)
1313
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1315
timedelta_to_milliseconds)
1350
1316
extended_timeout = notifychangeproperty(
1351
1317
dbus.UInt64, "ExtendedTimeout",
1352
type_func = lambda td: td.total_seconds() * 1000)
1353
interval = notifychangeproperty(
1354
dbus.UInt64, "Interval",
1355
type_func = lambda td: td.total_seconds() * 1000)
1318
type_func = timedelta_to_milliseconds)
1319
interval = notifychangeproperty(dbus.UInt64,
1322
timedelta_to_milliseconds)
1356
1323
checker_command = notifychangeproperty(dbus.String, "Checker")
1357
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1358
invalidate_only=True)
1360
1325
del notifychangeproperty
1404
1369
def approve(self, value=True):
1405
1370
self.approved = value
1406
gobject.timeout_add(int(self.approval_duration.total_seconds()
1407
* 1000), self._reset_approved)
1371
gobject.timeout_add(timedelta_to_milliseconds
1372
(self.approval_duration),
1373
self._reset_approved)
1408
1374
self.send_changedstate()
1410
1376
## D-Bus methods, signals & properties
1377
_interface = "se.recompile.Mandos.Client"
1381
@dbus_interface_annotations(_interface)
1383
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1416
1388
# CheckerCompleted - signal
1505
1475
self.approved_by_default = bool(value)
1507
1477
# ApprovalDelay - property
1508
@dbus_service_property(_interface,
1478
@dbus_service_property(_interface, signature="t",
1510
1479
access="readwrite")
1511
1480
def ApprovalDelay_dbus_property(self, value=None):
1512
1481
if value is None: # get
1513
return dbus.UInt64(self.approval_delay.total_seconds()
1482
return dbus.UInt64(self.approval_delay_milliseconds())
1515
1483
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1517
1485
# ApprovalDuration - property
1518
@dbus_service_property(_interface,
1486
@dbus_service_property(_interface, signature="t",
1520
1487
access="readwrite")
1521
1488
def ApprovalDuration_dbus_property(self, value=None):
1522
1489
if value is None: # get
1523
return dbus.UInt64(self.approval_duration.total_seconds()
1490
return dbus.UInt64(timedelta_to_milliseconds(
1491
self.approval_duration))
1525
1492
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1527
1494
# Name - property
1535
1502
return dbus.String(self.fingerprint)
1537
1504
# Host - property
1538
@dbus_service_property(_interface,
1505
@dbus_service_property(_interface, signature="s",
1540
1506
access="readwrite")
1541
1507
def Host_dbus_property(self, value=None):
1542
1508
if value is None: # get
1543
1509
return dbus.String(self.host)
1544
self.host = str(value)
1510
self.host = unicode(value)
1546
1512
# Created - property
1547
1513
@dbus_service_property(_interface, signature="s", access="read")
1591
1556
return datetime_to_dbus(self.last_approval_request)
1593
1558
# Timeout - property
1594
@dbus_service_property(_interface,
1559
@dbus_service_property(_interface, signature="t",
1596
1560
access="readwrite")
1597
1561
def Timeout_dbus_property(self, value=None):
1598
1562
if value is None: # get
1599
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1563
return dbus.UInt64(self.timeout_milliseconds())
1600
1564
old_timeout = self.timeout
1601
1565
self.timeout = datetime.timedelta(0, 0, 0, value)
1602
1566
# Reschedule disabling
1613
1577
gobject.source_remove(self.disable_initiator_tag)
1614
self.disable_initiator_tag = gobject.timeout_add(
1615
int((self.expires - now).total_seconds() * 1000),
1578
self.disable_initiator_tag = (
1579
gobject.timeout_add(
1580
timedelta_to_milliseconds(self.expires - now),
1618
1583
# ExtendedTimeout - property
1619
@dbus_service_property(_interface,
1584
@dbus_service_property(_interface, signature="t",
1621
1585
access="readwrite")
1622
1586
def ExtendedTimeout_dbus_property(self, value=None):
1623
1587
if value is None: # get
1624
return dbus.UInt64(self.extended_timeout.total_seconds()
1588
return dbus.UInt64(self.extended_timeout_milliseconds())
1626
1589
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1628
1591
# Interval - property
1629
@dbus_service_property(_interface,
1592
@dbus_service_property(_interface, signature="t",
1631
1593
access="readwrite")
1632
1594
def Interval_dbus_property(self, value=None):
1633
1595
if value is None: # get
1634
return dbus.UInt64(self.interval.total_seconds() * 1000)
1596
return dbus.UInt64(self.interval_milliseconds())
1635
1597
self.interval = datetime.timedelta(0, 0, 0, value)
1636
1598
if getattr(self, "checker_initiator_tag", None) is None:
1638
1600
if self.enabled:
1639
1601
# Reschedule checker run
1640
1602
gobject.source_remove(self.checker_initiator_tag)
1641
self.checker_initiator_tag = gobject.timeout_add(
1642
value, self.start_checker)
1643
self.start_checker() # Start one now, too
1603
self.checker_initiator_tag = (gobject.timeout_add
1604
(value, self.start_checker))
1605
self.start_checker() # Start one now, too
1645
1607
# Checker - property
1646
@dbus_service_property(_interface,
1608
@dbus_service_property(_interface, signature="s",
1648
1609
access="readwrite")
1649
1610
def Checker_dbus_property(self, value=None):
1650
1611
if value is None: # get
1651
1612
return dbus.String(self.checker_command)
1652
self.checker_command = str(value)
1613
self.checker_command = unicode(value)
1654
1615
# CheckerRunning - property
1655
@dbus_service_property(_interface,
1616
@dbus_service_property(_interface, signature="b",
1657
1617
access="readwrite")
1658
1618
def CheckerRunning_dbus_property(self, value=None):
1659
1619
if value is None: # get
1669
1629
return self.dbus_object_path # is already a dbus.ObjectPath
1671
1631
# Secret = property
1672
@dbus_service_property(_interface,
1632
@dbus_service_property(_interface, signature="ay",
1633
access="write", byte_arrays=True)
1676
1634
def Secret_dbus_property(self, value):
1677
self.secret = bytes(value)
1635
self.secret = str(value)
1716
1672
def handle(self):
1717
1673
with contextlib.closing(self.server.child_pipe) as child_pipe:
1718
1674
logger.info("TCP connection from: %s",
1719
str(self.client_address))
1675
unicode(self.client_address))
1720
1676
logger.debug("Pipe FD: %d",
1721
1677
self.server.child_pipe.fileno())
1723
session = gnutls.connection.ClientSession(
1724
self.request, gnutls.connection .X509Credentials())
1679
session = (gnutls.connection
1680
.ClientSession(self.request,
1682
.X509Credentials()))
1726
1684
# Note: gnutls.connection.X509Credentials is really a
1727
1685
# generic GnuTLS certificate credentials object so long as
1813
1772
#wait until timeout or approved
1814
1773
time = datetime.datetime.now()
1815
1774
client.changedstate.acquire()
1816
client.changedstate.wait(delay.total_seconds())
1775
client.changedstate.wait(
1776
float(timedelta_to_milliseconds(delay)
1817
1778
client.changedstate.release()
1818
1779
time2 = datetime.datetime.now()
1819
1780
if (time2 - time) >= delay:
1863
1824
def peer_certificate(session):
1864
1825
"Return the peer's OpenPGP certificate as a bytestring"
1865
1826
# If not an OpenPGP certificate...
1866
if (gnutls.library.functions.gnutls_certificate_type_get(
1827
if (gnutls.library.functions
1828
.gnutls_certificate_type_get(session._c_object)
1868
1829
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1869
1830
# ...do the normal thing
1870
1831
return session.peer_certificate
1884
1845
def fingerprint(openpgp):
1885
1846
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1886
1847
# New GnuTLS "datum" with the OpenPGP public key
1887
datum = gnutls.library.types.gnutls_datum_t(
1888
ctypes.cast(ctypes.c_char_p(openpgp),
1889
ctypes.POINTER(ctypes.c_ubyte)),
1890
ctypes.c_uint(len(openpgp)))
1848
datum = (gnutls.library.types
1849
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
ctypes.c_uint(len(openpgp))))
1891
1853
# New empty GnuTLS certificate
1892
1854
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1893
gnutls.library.functions.gnutls_openpgp_crt_init(
1855
(gnutls.library.functions
1856
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1895
1857
# Import the OpenPGP public key into the certificate
1896
gnutls.library.functions.gnutls_openpgp_crt_import(
1897
crt, ctypes.byref(datum),
1898
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1858
(gnutls.library.functions
1859
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1860
gnutls.library.constants
1861
.GNUTLS_OPENPGP_FMT_RAW))
1899
1862
# Verify the self signature in the key
1900
1863
crtverify = ctypes.c_uint()
1901
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1902
crt, 0, ctypes.byref(crtverify))
1864
(gnutls.library.functions
1865
.gnutls_openpgp_crt_verify_self(crt, 0,
1866
ctypes.byref(crtverify)))
1903
1867
if crtverify.value != 0:
1904
1868
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1905
raise gnutls.errors.CertificateSecurityError(
1869
raise (gnutls.errors.CertificateSecurityError
1907
1871
# New buffer for the fingerprint
1908
1872
buf = ctypes.create_string_buffer(20)
1909
1873
buf_len = ctypes.c_size_t()
1910
1874
# Get the fingerprint from the certificate into the buffer
1911
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1912
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1875
(gnutls.library.functions
1876
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1877
ctypes.byref(buf_len)))
1913
1878
# Deinit the certificate
1914
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1915
1880
# Convert the buffer to a Python bytestring
1966
1929
interface: None or a network interface name (string)
1967
1930
use_ipv6: Boolean; to use IPv6 or not
1970
1932
def __init__(self, server_address, RequestHandlerClass,
1933
interface=None, use_ipv6=True, socketfd=None):
1974
1934
"""If socketfd is set, use that file descriptor instead of
1975
1935
creating a new one with socket.socket().
2017
1977
self.interface)
2020
self.socket.setsockopt(
2021
socket.SOL_SOCKET, SO_BINDTODEVICE,
2022
(self.interface + "\0").encode("utf-8"))
1980
self.socket.setsockopt(socket.SOL_SOCKET,
1982
str(self.interface + '\0'))
2023
1983
except socket.error as error:
2024
1984
if error.errno == errno.EPERM:
2025
1985
logger.error("No permission to bind to"
2093
2048
def add_pipe(self, parent_pipe, proc):
2094
2049
# Call "handle_ipc" for both data and EOF events
2095
gobject.io_add_watch(
2096
parent_pipe.fileno(),
2097
gobject.IO_IN | gobject.IO_HUP,
2098
functools.partial(self.handle_ipc,
2099
parent_pipe = parent_pipe,
2050
gobject.io_add_watch(parent_pipe.fileno(),
2051
gobject.IO_IN | gobject.IO_HUP,
2052
functools.partial(self.handle_ipc,
2102
def handle_ipc(self, source, condition,
2105
client_object=None):
2057
def handle_ipc(self, source, condition, parent_pipe=None,
2058
proc = None, client_object=None):
2106
2059
# error, or the other end of multiprocessing.Pipe has closed
2107
2060
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2108
2061
# Wait for other process to exit
2131
2084
parent_pipe.send(False)
2134
gobject.io_add_watch(
2135
parent_pipe.fileno(),
2136
gobject.IO_IN | gobject.IO_HUP,
2137
functools.partial(self.handle_ipc,
2138
parent_pipe = parent_pipe,
2140
client_object = client))
2087
gobject.io_add_watch(parent_pipe.fileno(),
2088
gobject.IO_IN | gobject.IO_HUP,
2089
functools.partial(self.handle_ipc,
2141
2095
parent_pipe.send(True)
2142
2096
# remove the old hook in favor of the new above hook on
2150
2104
parent_pipe.send(('data', getattr(client_object,
2151
2105
funcname)(*args,
2154
2108
if command == 'getattr':
2155
2109
attrname = request[1]
2156
if isinstance(client_object.__getattribute__(attrname),
2157
collections.Callable):
2158
parent_pipe.send(('function', ))
2110
if callable(client_object.__getattribute__(attrname)):
2111
parent_pipe.send(('function',))
2161
'data', client_object.__getattribute__(attrname)))
2113
parent_pipe.send(('data', client_object
2114
.__getattribute__(attrname)))
2163
2116
if command == 'setattr':
2164
2117
attrname = request[1]
2195
2148
# avoid excessive use of external libraries.
2197
2150
# New type for defining tokens, syntax, and semantics all-in-one
2198
Token = collections.namedtuple("Token", (
2199
"regexp", # To match token; if "value" is not None, must have
2200
# a "group" containing digits
2201
"value", # datetime.timedelta or None
2202
"followers")) # Tokens valid after this token
2151
Token = collections.namedtuple("Token",
2152
("regexp", # To match token; if
2153
# "value" is not None,
2154
# must have a "group"
2156
"value", # datetime.timedelta or
2158
"followers")) # Tokens valid after
2203
2160
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2204
2161
# the "duration" ABNF definition in RFC 3339, Appendix A.
2205
2162
token_end = Token(re.compile(r"$"), None, frozenset())
2206
2163
token_second = Token(re.compile(r"(\d+)S"),
2207
2164
datetime.timedelta(seconds=1),
2208
frozenset((token_end, )))
2165
frozenset((token_end,)))
2209
2166
token_minute = Token(re.compile(r"(\d+)M"),
2210
2167
datetime.timedelta(minutes=1),
2211
2168
frozenset((token_second, token_end)))
2227
2184
frozenset((token_month, token_end)))
2228
2185
token_week = Token(re.compile(r"(\d+)W"),
2229
2186
datetime.timedelta(weeks=1),
2230
frozenset((token_end, )))
2187
frozenset((token_end,)))
2231
2188
token_duration = Token(re.compile(r"P"), None,
2232
2189
frozenset((token_year, token_month,
2233
2190
token_day, token_time,
2235
2192
# Define starting values
2236
2193
value = datetime.timedelta() # Value so far
2237
2194
found_token = None
2238
followers = frozenset((token_duration, )) # Following valid tokens
2195
followers = frozenset(token_duration,) # Following valid tokens
2239
2196
s = duration # String left to parse
2240
2197
# Loop until end token is found
2241
2198
while found_token is not token_end:
2325
2282
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2326
2283
if not stat.S_ISCHR(os.fstat(null).st_mode):
2327
2284
raise OSError(errno.ENODEV,
2328
"{} not a character device"
2285
"{0} not a character device"
2329
2286
.format(os.devnull))
2330
2287
os.dup2(null, sys.stdin.fileno())
2331
2288
os.dup2(null, sys.stdout.fileno())
2342
2299
parser = argparse.ArgumentParser()
2343
2300
parser.add_argument("-v", "--version", action="version",
2344
version = "%(prog)s {}".format(version),
2301
version = "%(prog)s {0}".format(version),
2345
2302
help="show version number and exit")
2346
2303
parser.add_argument("-i", "--interface", metavar="IF",
2347
2304
help="Bind to interface IF")
2408
2364
"statedir": "/var/lib/mandos",
2409
2365
"foreground": "False",
2410
2366
"zeroconf": "True",
2413
2369
# Parse config file for server-global settings
2414
2370
server_config = configparser.SafeConfigParser(server_defaults)
2415
2371
del server_defaults
2416
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2372
server_config.read(os.path.join(options.configdir,
2417
2374
# Convert the SafeConfigParser object to a dict
2418
2375
server_settings = server_config.defaults()
2419
2376
# Use the appropriate methods on the non-string config options
2437
2394
# Override the settings from the config file with command line
2438
2395
# options, if set.
2439
2396
for option in ("interface", "address", "port", "debug",
2440
"priority", "servicename", "configdir", "use_dbus",
2441
"use_ipv6", "debuglevel", "restore", "statedir",
2442
"socket", "foreground", "zeroconf"):
2397
"priority", "servicename", "configdir",
2398
"use_dbus", "use_ipv6", "debuglevel", "restore",
2399
"statedir", "socket", "foreground", "zeroconf"):
2443
2400
value = getattr(options, option)
2444
2401
if value is not None:
2445
2402
server_settings[option] = value
2447
2404
# Force all strings to be unicode
2448
2405
for option in server_settings.keys():
2449
if isinstance(server_settings[option], bytes):
2450
server_settings[option] = (server_settings[option]
2406
if type(server_settings[option]) is str:
2407
server_settings[option] = unicode(server_settings[option])
2452
2408
# Force all boolean options to be boolean
2453
2409
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2454
2410
"foreground", "zeroconf"):
2461
2417
##################################################################
2463
if (not server_settings["zeroconf"]
2464
and not (server_settings["port"]
2465
or server_settings["socket"] != "")):
2466
parser.error("Needs port or socket to work without Zeroconf")
2419
if (not server_settings["zeroconf"] and
2420
not (server_settings["port"]
2421
or server_settings["socket"] != "")):
2422
parser.error("Needs port or socket to work without"
2468
2425
# For convenience
2469
2426
debug = server_settings["debug"]
2485
2442
initlogger(debug, level)
2487
2444
if server_settings["servicename"] != "Mandos":
2488
syslogger.setFormatter(
2489
logging.Formatter('Mandos ({}) [%(process)d]:'
2490
' %(levelname)s: %(message)s'.format(
2491
server_settings["servicename"])))
2445
syslogger.setFormatter(logging.Formatter
2446
('Mandos ({0}) [%(process)d]:'
2447
' %(levelname)s: %(message)s'
2448
.format(server_settings
2493
2451
# Parse config file with clients
2494
2452
client_config = configparser.SafeConfigParser(Client
2502
2460
socketfd = None
2503
2461
if server_settings["socket"] != "":
2504
2462
socketfd = server_settings["socket"]
2505
tcp_server = MandosServer(
2506
(server_settings["address"], server_settings["port"]),
2508
interface=(server_settings["interface"] or None),
2510
gnutls_priority=server_settings["priority"],
2463
tcp_server = MandosServer((server_settings["address"],
2464
server_settings["port"]),
2466
interface=(server_settings["interface"]
2470
server_settings["priority"],
2513
2473
if not foreground:
2514
2474
pidfilename = "/run/mandos.pid"
2515
2475
if not os.path.isdir("/run/."):
2516
2476
pidfilename = "/var/run/mandos.pid"
2519
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2479
pidfile = open(pidfilename, "w")
2520
2480
except IOError as e:
2521
2481
logger.error("Could not open file %r", pidfilename,
2549
2509
def debug_gnutls(level, string):
2550
2510
logger.debug("GnuTLS: %s", string[:-1])
2552
gnutls.library.functions.gnutls_global_set_log_function(
2512
(gnutls.library.functions
2513
.gnutls_global_set_log_function(debug_gnutls))
2555
2515
# Redirect stdin so all checkers get /dev/null
2556
2516
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2578
2538
bus_name = dbus.service.BusName("se.recompile.Mandos",
2581
old_bus_name = dbus.service.BusName(
2582
"se.bsnet.fukt.Mandos", bus,
2584
except dbus.exceptions.DBusException as e:
2539
bus, do_not_queue=True)
2540
old_bus_name = (dbus.service.BusName
2541
("se.bsnet.fukt.Mandos", bus,
2543
except dbus.exceptions.NameExistsException as e:
2585
2544
logger.error("Disabling D-Bus:", exc_info=e)
2586
2545
use_dbus = False
2587
2546
server_settings["use_dbus"] = False
2588
2547
tcp_server.use_dbus = False
2590
2549
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2591
service = AvahiServiceToSyslog(
2592
name = server_settings["servicename"],
2593
servicetype = "_mandos._tcp",
2594
protocol = protocol,
2550
service = AvahiServiceToSyslog(name =
2551
server_settings["servicename"],
2552
servicetype = "_mandos._tcp",
2553
protocol = protocol, bus = bus)
2596
2554
if server_settings["interface"]:
2597
service.interface = if_nametoindex(
2598
server_settings["interface"].encode("utf-8"))
2555
service.interface = (if_nametoindex
2556
(str(server_settings["interface"])))
2600
2558
global multiprocessing_manager
2601
2559
multiprocessing_manager = multiprocessing.Manager()
2620
2578
if server_settings["restore"]:
2622
2580
with open(stored_state_path, "rb") as stored_state:
2623
clients_data, old_client_settings = pickle.load(
2581
clients_data, old_client_settings = (pickle.load
2625
2583
os.remove(stored_state_path)
2626
2584
except IOError as e:
2627
2585
if e.errno == errno.ENOENT:
2628
logger.warning("Could not load persistent state:"
2629
" {}".format(os.strerror(e.errno)))
2586
logger.warning("Could not load persistent state: {0}"
2587
.format(os.strerror(e.errno)))
2631
2589
logger.critical("Could not load persistent state:",
2634
2592
except EOFError as e:
2635
2593
logger.warning("Could not load persistent state: "
2594
"EOFError:", exc_info=e)
2639
2596
with PGPEngine() as pgp:
2640
for client_name, client in clients_data.items():
2597
for client_name, client in clients_data.iteritems():
2641
2598
# Skip removed clients
2642
2599
if client_name not in client_settings:
2668
2625
if datetime.datetime.utcnow() >= client["expires"]:
2669
2626
if not client["last_checked_ok"]:
2670
2627
logger.warning(
2671
"disabling client {} - Client never "
2672
"performed a successful checker".format(
2628
"disabling client {0} - Client never "
2629
"performed a successful checker"
2630
.format(client_name))
2674
2631
client["enabled"] = False
2675
2632
elif client["last_checker_status"] != 0:
2676
2633
logger.warning(
2677
"disabling client {} - Client last"
2678
" checker failed with error code"
2681
client["last_checker_status"]))
2634
"disabling client {0} - Client "
2635
"last checker failed with error code {1}"
2636
.format(client_name,
2637
client["last_checker_status"]))
2682
2638
client["enabled"] = False
2684
client["expires"] = (
2685
datetime.datetime.utcnow()
2686
+ client["timeout"])
2640
client["expires"] = (datetime.datetime
2642
+ client["timeout"])
2687
2643
logger.debug("Last checker succeeded,"
2688
" keeping {} enabled".format(
2644
" keeping {0} enabled"
2645
.format(client_name))
2691
client["secret"] = pgp.decrypt(
2692
client["encrypted_secret"],
2693
client_settings[client_name]["secret"])
2647
client["secret"] = (
2648
pgp.decrypt(client["encrypted_secret"],
2649
client_settings[client_name]
2694
2651
except PGPError:
2695
2652
# If decryption fails, we use secret from new settings
2696
logger.debug("Failed to decrypt {} old secret".format(
2698
client["secret"] = (client_settings[client_name]
2653
logger.debug("Failed to decrypt {0} old secret"
2654
.format(client_name))
2655
client["secret"] = (
2656
client_settings[client_name]["secret"])
2701
2658
# Add/remove clients based on new changes made to config
2702
2659
for client_name in (set(old_client_settings)
2707
2664
clients_data[client_name] = client_settings[client_name]
2709
2666
# Create all client objects
2710
for client_name, client in clients_data.items():
2667
for client_name, client in clients_data.iteritems():
2711
2668
tcp_server.clients[client_name] = client_class(
2669
name = client_name, settings = client,
2714
2670
server_settings = server_settings)
2716
2672
if not tcp_server.clients:
2732
2688
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2736
@alternate_dbus_interfaces(
2737
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2691
@alternate_dbus_interfaces({"se.recompile.Mandos":
2692
"se.bsnet.fukt.Mandos"})
2738
2693
class MandosDBusService(DBusObjectWithProperties):
2739
2694
"""A D-Bus proxy object"""
2741
2695
def __init__(self):
2742
2696
dbus.service.Object.__init__(self, bus, "/")
2744
2697
_interface = "se.recompile.Mandos"
2746
2699
@dbus_interface_annotations(_interface)
2747
2700
def _foo(self):
2749
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2701
return { "org.freedesktop.DBus.Property"
2702
".EmitsChangedSignal":
2752
2705
@dbus.service.signal(_interface, signature="o")
2753
2706
def ClientAdded(self, objpath):
2821
2775
# A list of attributes that can not be pickled
2823
exclude = { "bus", "changedstate", "secret",
2824
"checker", "server_settings" }
2825
for name, typ in inspect.getmembers(dbus.service
2777
exclude = set(("bus", "changedstate", "secret",
2778
"checker", "server_settings"))
2779
for name, typ in (inspect.getmembers
2780
(dbus.service.Object)):
2827
2781
exclude.add(name)
2829
2783
client_dict["encrypted_secret"] = (client
2836
2790
del client_settings[client.name]["secret"]
2839
with tempfile.NamedTemporaryFile(
2843
dir=os.path.dirname(stored_state_path),
2844
delete=False) as stored_state:
2793
with (tempfile.NamedTemporaryFile
2794
(mode='wb', suffix=".pickle", prefix='clients-',
2795
dir=os.path.dirname(stored_state_path),
2796
delete=False)) as stored_state:
2845
2797
pickle.dump((clients, client_settings), stored_state)
2846
tempname = stored_state.name
2798
tempname=stored_state.name
2847
2799
os.rename(tempname, stored_state_path)
2848
2800
except (IOError, OSError) as e: