100
88
except ImportError:
101
89
SO_BINDTODEVICE = None
103
if sys.version_info.major == 2:
107
92
stored_state_file = "clients.pickle"
109
94
logger = logging.getLogger()
113
if_nametoindex = ctypes.cdll.LoadLibrary(
114
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
115
101
except (OSError, AttributeError):
117
102
def if_nametoindex(interface):
118
103
"Get an interface index the hard way, i.e. using fcntl()"
119
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
120
105
with contextlib.closing(socket.socket()) as s:
121
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
122
struct.pack(b"16s16x", interface))
123
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
109
interface_index = struct.unpack(str("I"),
124
111
return interface_index
296
276
self.entry_group_state_changed_match = None
298
def rename(self, remove=True):
299
279
"""Derived from the Avahi example code"""
300
280
if self.rename_count >= self.max_renames:
301
281
logger.critical("No suitable Zeroconf service name found"
302
282
" after %i retries, exiting.",
303
283
self.rename_count)
304
284
raise AvahiServiceError("Too many renames")
306
self.server.GetAlternativeServiceName(self.name))
307
self.rename_count += 1
285
self.name = unicode(self.server
286
.GetAlternativeServiceName(self.name))
308
287
logger.info("Changing Zeroconf service name to %r ...",
314
292
except dbus.exceptions.DBusException as error:
315
if (error.get_dbus_name()
316
== "org.freedesktop.Avahi.CollisionError"):
317
logger.info("Local Zeroconf service name collision.")
318
return self.rename(remove=False)
320
logger.critical("D-Bus Exception", exc_info=error)
293
logger.critical("D-Bus Exception", exc_info=error)
296
self.rename_count += 1
324
298
def remove(self):
325
299
"""Derived from the Avahi example code"""
380
355
def server_state_changed(self, state, error=None):
381
356
"""Derived from the Avahi example code"""
382
357
logger.debug("Avahi server state change: %i", state)
384
avahi.SERVER_INVALID: "Zeroconf server invalid",
385
avahi.SERVER_REGISTERING: None,
386
avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
avahi.SERVER_FAILURE: "Zeroconf server failure",
358
bad_states = { avahi.SERVER_INVALID:
359
"Zeroconf server invalid",
360
avahi.SERVER_REGISTERING: None,
361
avahi.SERVER_COLLISION:
362
"Zeroconf server name collision",
363
avahi.SERVER_FAILURE:
364
"Zeroconf server failure" }
389
365
if state in bad_states:
390
366
if bad_states[state] is not None:
391
367
if error is None:
410
386
follow_name_owner_changes=True),
411
387
avahi.DBUS_INTERFACE_SERVER)
412
388
self.server.connect_to_signal("StateChanged",
413
self.server_state_changed)
389
self.server_state_changed)
414
390
self.server_state_changed(self.server.GetState())
417
393
class AvahiServiceToSyslog(AvahiService):
418
def rename(self, *args, **kwargs):
419
395
"""Add the new name to the syslog messages"""
420
ret = AvahiService.rename(self, *args, **kwargs)
421
syslogger.setFormatter(logging.Formatter(
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({0}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
426
def subprocess_call_pipe(connection, # : multiprocessing.Connection
428
"""This function is meant to be called by multiprocessing.Process
430
This function runs a synchronous subprocess.call(), and writes the
431
resulting return code on the provided multiprocessing.Connection.
433
connection.send(subprocess.call(*args, **kwargs))
404
def timedelta_to_milliseconds(td):
405
"Convert a datetime.timedelta() to milliseconds"
406
return ((td.days * 24 * 60 * 60 * 1000)
407
+ (td.seconds * 1000)
408
+ (td.microseconds // 1000))
436
411
class Client(object):
437
412
"""A representation of a client host served by this server.
484
457
"fingerprint", "host", "interval",
485
458
"last_approval_request", "last_checked_ok",
486
459
"last_enabled", "name", "timeout")
489
"extended_timeout": "PT15M",
491
"checker": "fping -q -- %%(host)s",
493
"approval_delay": "PT0S",
494
"approval_duration": "PT1S",
495
"approved_by_default": "True",
460
client_defaults = { "timeout": "PT5M",
461
"extended_timeout": "PT15M",
463
"checker": "fping -q -- %%(host)s",
465
"approval_delay": "PT0S",
466
"approval_duration": "PT1S",
467
"approved_by_default": "True",
471
def timeout_milliseconds(self):
472
"Return the 'timeout' attribute in milliseconds"
473
return timedelta_to_milliseconds(self.timeout)
475
def extended_timeout_milliseconds(self):
476
"Return the 'extended_timeout' attribute in milliseconds"
477
return timedelta_to_milliseconds(self.extended_timeout)
479
def interval_milliseconds(self):
480
"Return the 'interval' attribute in milliseconds"
481
return timedelta_to_milliseconds(self.interval)
483
def approval_delay_milliseconds(self):
484
return timedelta_to_milliseconds(self.approval_delay)
500
487
def config_parser(config):
578
565
self.current_checker_command = None
579
566
self.approved = None
580
567
self.approvals_pending = 0
581
self.changedstate = multiprocessing_manager.Condition(
582
multiprocessing_manager.Lock())
583
self.client_structure = [attr
584
for attr in self.__dict__.iterkeys()
568
self.changedstate = (multiprocessing_manager
569
.Condition(multiprocessing_manager
571
self.client_structure = [attr for attr in
572
self.__dict__.iterkeys()
585
573
if not attr.startswith("_")]
586
574
self.client_structure.append("client_structure")
588
for name, t in inspect.getmembers(
589
type(self), lambda obj: isinstance(obj, property)):
576
for name, t in inspect.getmembers(type(self),
590
580
if not name.startswith("_"):
591
581
self.client_structure.append(name)
634
624
# and every interval from then on.
635
625
if self.checker_initiator_tag is not None:
636
626
gobject.source_remove(self.checker_initiator_tag)
637
self.checker_initiator_tag = gobject.timeout_add(
638
int(self.interval.total_seconds() * 1000),
627
self.checker_initiator_tag = (gobject.timeout_add
628
(self.interval_milliseconds(),
640
630
# Schedule a disable() when 'timeout' has passed
641
631
if self.disable_initiator_tag is not None:
642
632
gobject.source_remove(self.disable_initiator_tag)
643
self.disable_initiator_tag = gobject.timeout_add(
644
int(self.timeout.total_seconds() * 1000), self.disable)
633
self.disable_initiator_tag = (gobject.timeout_add
634
(self.timeout_milliseconds(),
645
636
# Also start a new checker *right now*.
646
637
self.start_checker()
648
def checker_callback(self, source, condition,
649
(connection, command)):
639
def checker_callback(self, pid, condition, command):
650
640
"""The checker has completed, so take appropriate actions."""
651
641
self.checker_callback_tag = None
652
642
self.checker = None
653
# Read return code from connection (see subprocess_call_pipe)
654
returncode = connection.recv()
658
self.last_checker_status = returncode
659
self.last_checker_signal = None
643
if os.WIFEXITED(condition):
644
self.last_checker_status = os.WEXITSTATUS(condition)
660
645
if self.last_checker_status == 0:
661
646
logger.info("Checker for %(name)s succeeded",
663
648
self.checked_ok()
665
logger.info("Checker for %(name)s failed", vars(self))
650
logger.info("Checker for %(name)s failed",
667
653
self.last_checker_status = -1
668
self.last_checker_signal = -returncode
669
654
logger.warning("Checker for %(name)s crashed?",
673
657
def checked_ok(self):
674
658
"""Assert that the client has been seen, alive and well."""
675
659
self.last_checked_ok = datetime.datetime.utcnow()
676
660
self.last_checker_status = 0
677
self.last_checker_signal = None
678
661
self.bump_timeout()
680
663
def bump_timeout(self, timeout=None):
706
690
# than 'timeout' for the client to be disabled, which is as it
709
if self.checker is not None and not self.checker.is_alive():
710
logger.warning("Checker was not alive; joining")
693
# If a checker exists, make sure it is not a zombie
695
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
696
except AttributeError:
698
except OSError as error:
699
if error.errno != errno.ECHILD:
703
logger.warning("Checker was a zombie")
704
gobject.source_remove(self.checker_callback_tag)
705
self.checker_callback(pid, status,
706
self.current_checker_command)
713
707
# Start a new checker if needed
714
708
if self.checker is None:
715
709
# Escape attributes for the shell
717
attr: re.escape(str(getattr(self, attr)))
718
for attr in self.runtime_expansions }
710
escaped_attrs = dict(
711
(attr, re.escape(unicode(getattr(self, attr))))
713
self.runtime_expansions)
720
715
command = self.checker_command % escaped_attrs
721
716
except TypeError as error:
722
717
logger.error('Could not format string "%s"',
723
self.checker_command,
718
self.checker_command, exc_info=error)
719
return True # Try again later
720
self.current_checker_command = command
722
logger.info("Starting checker %r for %s",
724
# We don't need to redirect stdout and stderr, since
725
# in normal mode, that is already done by daemon(),
726
# and in debug mode we don't want to. (Stdin is
727
# always replaced by /dev/null.)
728
# The exception is when not debugging but nevertheless
729
# running in the foreground; use the previously
732
if (not self.server_settings["debug"]
733
and self.server_settings["foreground"]):
734
popen_args.update({"stdout": wnull,
736
self.checker = subprocess.Popen(command,
740
except OSError as error:
741
logger.error("Failed to start subprocess",
725
return True # Try again later
726
self.current_checker_command = command
727
logger.info("Starting checker %r for %s", command,
729
# We don't need to redirect stdout and stderr, since
730
# in normal mode, that is already done by daemon(),
731
# and in debug mode we don't want to. (Stdin is
732
# always replaced by /dev/null.)
733
# The exception is when not debugging but nevertheless
734
# running in the foreground; use the previously
736
popen_args = { "close_fds": True,
739
if (not self.server_settings["debug"]
740
and self.server_settings["foreground"]):
741
popen_args.update({"stdout": wnull,
743
pipe = multiprocessing.Pipe(duplex=False)
744
self.checker = multiprocessing.Process(
745
target=subprocess_call_pipe, args=(pipe[1], command),
748
self.checker_callback_tag = gobject.io_add_watch(
749
pipe[0].fileno(), gobject.IO_IN,
750
self.checker_callback, (pipe[0], command))
744
self.checker_callback_tag = (gobject.child_watch_add
746
self.checker_callback,
748
# The checker may have completed before the gobject
749
# watch was added. Check for this.
751
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
752
except OSError as error:
753
if error.errno == errno.ECHILD:
754
# This should never happen
755
logger.error("Child process vanished",
760
gobject.source_remove(self.checker_callback_tag)
761
self.checker_callback(pid, status, command)
751
762
# Re-run this periodically if run by gobject.timeout_add
822
834
"""Decorator to annotate D-Bus methods, signals or properties
825
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
826
"org.freedesktop.DBus.Property."
827
"EmitsChangedSignal": "false"})
828
837
@dbus_service_property("org.example.Interface", signature="b",
839
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
830
842
def Property_dbus_property(self):
831
843
return dbus.Boolean(False)
834
845
def decorator(func):
835
846
func._dbus_annotations = annotations
841
851
class DBusPropertyException(dbus.exceptions.DBusException):
842
852
"""A base class for D-Bus property-related exceptions
854
def __unicode__(self):
855
return unicode(str(self))
847
858
class DBusPropertyAccessException(DBusPropertyException):
871
882
If called like _is_dbus_thing("method") it returns a function
872
883
suitable for use as predicate to inspect.getmembers().
874
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
877
888
def _get_all_dbus_things(self, thing):
878
889
"""Returns a generator of (name, attribute) pairs
880
return ((getattr(athing.__get__(self), "_dbus_name", name),
891
return ((getattr(athing.__get__(self), "_dbus_name",
881
893
athing.__get__(self))
882
894
for cls in self.__class__.__mro__
883
895
for name, athing in
884
inspect.getmembers(cls, self._is_dbus_thing(thing)))
896
inspect.getmembers(cls,
897
self._is_dbus_thing(thing)))
886
899
def _get_dbus_property(self, interface_name, property_name):
887
900
"""Returns a bound method if one exists which is a D-Bus
888
901
property with the specified name and interface.
890
for cls in self.__class__.__mro__:
891
for name, value in inspect.getmembers(
892
cls, self._is_dbus_thing("property")):
903
for cls in self.__class__.__mro__:
904
for name, value in (inspect.getmembers
906
self._is_dbus_thing("property"))):
893
907
if (value._dbus_name == property_name
894
908
and value._dbus_interface == interface_name):
895
909
return value.__get__(self)
897
911
# No such property
898
raise DBusPropertyNotFound("{}:{}.{}".format(
899
self.dbus_object_path, interface_name, property_name))
912
raise DBusPropertyNotFound(self.dbus_object_path + ":"
913
+ interface_name + "."
901
@dbus.service.method(dbus.PROPERTIES_IFACE,
916
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
903
917
out_signature="v")
904
918
def Get(self, interface_name, property_name):
905
919
"""Standard D-Bus property Get() method, see D-Bus standard.
952
965
if not hasattr(value, "variant_level"):
953
966
properties[name] = value
955
properties[name] = type(value)(
956
value, variant_level = value.variant_level + 1)
968
properties[name] = type(value)(value, variant_level=
969
value.variant_level+1)
957
970
return dbus.Dictionary(properties, signature="sv")
959
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
960
def PropertiesChanged(self, interface_name, changed_properties,
961
invalidated_properties):
962
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
967
972
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
968
973
out_signature="s",
969
974
path_keyword='object_path',
1087
1092
# Ignore non-D-Bus attributes, and D-Bus attributes
1088
1093
# with the wrong interface name
1089
1094
if (not hasattr(attribute, "_dbus_interface")
1090
or not attribute._dbus_interface.startswith(
1091
orig_interface_name)):
1095
or not attribute._dbus_interface
1096
.startswith(orig_interface_name)):
1093
1098
# Create an alternate D-Bus interface name based on
1094
1099
# the current name
1095
alt_interface = attribute._dbus_interface.replace(
1096
orig_interface_name, alt_interface_name)
1100
alt_interface = (attribute._dbus_interface
1101
.replace(orig_interface_name,
1102
alt_interface_name))
1097
1103
interface_names.add(alt_interface)
1098
1104
# Is this a D-Bus signal?
1099
1105
if getattr(attribute, "_dbus_is_signal", False):
1100
1106
# Extract the original non-method undecorated
1101
1107
# function by black magic
1102
1108
nonmethod_func = (dict(
1103
zip(attribute.func_code.co_freevars,
1104
attribute.__closure__))
1105
["func"].cell_contents)
1109
zip(attribute.func_code.co_freevars,
1110
attribute.__closure__))["func"]
1106
1112
# Create a new, but exactly alike, function
1107
1113
# object, and decorate it to be a new D-Bus signal
1108
1114
# with the alternate D-Bus interface name
1109
new_function = (dbus.service.signal(
1110
alt_interface, attribute._dbus_signature)
1115
new_function = (dbus.service.signal
1117
attribute._dbus_signature)
1111
1118
(types.FunctionType(
1112
nonmethod_func.func_code,
1113
nonmethod_func.func_globals,
1114
nonmethod_func.func_name,
1115
nonmethod_func.func_defaults,
1116
nonmethod_func.func_closure)))
1119
nonmethod_func.func_code,
1120
nonmethod_func.func_globals,
1121
nonmethod_func.func_name,
1122
nonmethod_func.func_defaults,
1123
nonmethod_func.func_closure)))
1117
1124
# Copy annotations, if any
1119
new_function._dbus_annotations = dict(
1120
attribute._dbus_annotations)
1126
new_function._dbus_annotations = (
1127
dict(attribute._dbus_annotations))
1121
1128
except AttributeError:
1123
1130
# Define a creator of a function to call both the
1145
1150
# object. Decorate it to be a new D-Bus method
1146
1151
# with the alternate D-Bus interface name. Add it
1147
1152
# to the class.
1149
dbus.service.method(
1151
attribute._dbus_in_signature,
1152
attribute._dbus_out_signature)
1153
(types.FunctionType(attribute.func_code,
1154
attribute.func_globals,
1155
attribute.func_name,
1156
attribute.func_defaults,
1157
attribute.func_closure)))
1153
attr[attrname] = (dbus.service.method
1155
attribute._dbus_in_signature,
1156
attribute._dbus_out_signature)
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1158
1163
# Copy annotations, if any
1160
attr[attrname]._dbus_annotations = dict(
1161
attribute._dbus_annotations)
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1162
1167
except AttributeError:
1164
1169
# Is this a D-Bus property?
1167
1172
# object, and decorate it to be a new D-Bus
1168
1173
# property with the alternate D-Bus interface
1169
1174
# name. Add it to the class.
1170
attr[attrname] = (dbus_service_property(
1171
alt_interface, attribute._dbus_signature,
1172
attribute._dbus_access,
1173
attribute._dbus_get_args_options
1175
(types.FunctionType(
1176
attribute.func_code,
1177
attribute.func_globals,
1178
attribute.func_name,
1179
attribute.func_defaults,
1180
attribute.func_closure)))
1175
attr[attrname] = (dbus_service_property
1177
attribute._dbus_signature,
1178
attribute._dbus_access,
1180
._dbus_get_args_options
1183
(attribute.func_code,
1184
attribute.func_globals,
1185
attribute.func_name,
1186
attribute.func_defaults,
1187
attribute.func_closure)))
1181
1188
# Copy annotations, if any
1183
attr[attrname]._dbus_annotations = dict(
1184
attribute._dbus_annotations)
1190
attr[attrname]._dbus_annotations = (
1191
dict(attribute._dbus_annotations))
1185
1192
except AttributeError:
1187
1194
# Is this a D-Bus interface?
1190
1197
# object. Decorate it to be a new D-Bus interface
1191
1198
# with the alternate D-Bus interface name. Add it
1192
1199
# to the class.
1194
dbus_interface_annotations(alt_interface)
1195
(types.FunctionType(attribute.func_code,
1196
attribute.func_globals,
1197
attribute.func_name,
1198
attribute.func_defaults,
1199
attribute.func_closure)))
1200
attr[attrname] = (dbus_interface_annotations
1203
(attribute.func_code,
1204
attribute.func_globals,
1205
attribute.func_name,
1206
attribute.func_defaults,
1207
attribute.func_closure)))
1201
1209
# Deprecate all alternate interfaces
1202
iname="_AlternateDBusNames_interface_annotation{}"
1210
iname="_AlternateDBusNames_interface_annotation{0}"
1203
1211
for interface_name in interface_names:
1205
1212
@dbus_interface_annotations(interface_name)
1206
1213
def func(self):
1207
1214
return { "org.freedesktop.DBus.Deprecated":
1209
1216
# Find an unused name
1210
1217
for aname in (iname.format(i)
1211
1218
for i in itertools.count()):
1244
1248
Client.__init__(self, *args, **kwargs)
1245
1249
# Only now, when this client is initialized, can it show up on
1247
client_object_name = str(self.name).translate(
1251
client_object_name = unicode(self.name).translate(
1248
1252
{ord("."): ord("_"),
1249
1253
ord("-"): ord("_")})
1250
self.dbus_object_path = dbus.ObjectPath(
1251
"/clients/" + client_object_name)
1254
self.dbus_object_path = (dbus.ObjectPath
1255
("/clients/" + client_object_name))
1252
1256
DBusObjectWithProperties.__init__(self, self.bus,
1253
1257
self.dbus_object_path)
1255
def notifychangeproperty(transform_func, dbus_name,
1256
type_func=lambda x: x,
1258
invalidate_only=False,
1259
_interface=_interface):
1259
def notifychangeproperty(transform_func,
1260
dbus_name, type_func=lambda x: x,
1260
1262
""" Modify a variable so that it's a property which announces
1261
1263
its changes to DBus.
1267
1269
to the D-Bus. Default: no transform
1268
1270
variant_level: D-Bus variant level. Default: 1
1270
attrname = "_{}".format(dbus_name)
1272
attrname = "_{0}".format(dbus_name)
1272
1273
def setter(self, value):
1273
1274
if hasattr(self, "dbus_object_path"):
1274
1275
if (not hasattr(self, attrname) or
1275
1276
type_func(getattr(self, attrname, None))
1276
1277
!= type_func(value)):
1278
self.PropertiesChanged(
1279
_interface, dbus.Dictionary(),
1280
dbus.Array((dbus_name, )))
1282
dbus_value = transform_func(
1284
variant_level = variant_level)
1285
self.PropertyChanged(dbus.String(dbus_name),
1287
self.PropertiesChanged(
1289
dbus.Dictionary({ dbus.String(dbus_name):
1278
dbus_value = transform_func(type_func(value),
1281
self.PropertyChanged(dbus.String(dbus_name),
1292
1283
setattr(self, attrname, value)
1294
1285
return property(lambda self: getattr(self, attrname), setter)
1300
1291
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1301
1292
last_enabled = notifychangeproperty(datetime_to_dbus,
1303
checker = notifychangeproperty(
1304
dbus.Boolean, "CheckerRunning",
1305
type_func = lambda checker: checker is not None)
1294
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1295
type_func = lambda checker:
1296
checker is not None)
1306
1297
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1307
1298
"LastCheckedOK")
1308
1299
last_checker_status = notifychangeproperty(dbus.Int16,
1311
1302
datetime_to_dbus, "LastApprovalRequest")
1312
1303
approved_by_default = notifychangeproperty(dbus.Boolean,
1313
1304
"ApprovedByDefault")
1314
approval_delay = notifychangeproperty(
1315
dbus.UInt64, "ApprovalDelay",
1316
type_func = lambda td: td.total_seconds() * 1000)
1305
approval_delay = notifychangeproperty(dbus.UInt64,
1308
timedelta_to_milliseconds)
1317
1309
approval_duration = notifychangeproperty(
1318
1310
dbus.UInt64, "ApprovalDuration",
1319
type_func = lambda td: td.total_seconds() * 1000)
1311
type_func = timedelta_to_milliseconds)
1320
1312
host = notifychangeproperty(dbus.String, "Host")
1321
timeout = notifychangeproperty(
1322
dbus.UInt64, "Timeout",
1323
type_func = lambda td: td.total_seconds() * 1000)
1313
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1315
timedelta_to_milliseconds)
1324
1316
extended_timeout = notifychangeproperty(
1325
1317
dbus.UInt64, "ExtendedTimeout",
1326
type_func = lambda td: td.total_seconds() * 1000)
1327
interval = notifychangeproperty(
1328
dbus.UInt64, "Interval",
1329
type_func = lambda td: td.total_seconds() * 1000)
1318
type_func = timedelta_to_milliseconds)
1319
interval = notifychangeproperty(dbus.UInt64,
1322
timedelta_to_milliseconds)
1330
1323
checker_command = notifychangeproperty(dbus.String, "Checker")
1331
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1332
invalidate_only=True)
1334
1325
del notifychangeproperty
1342
1333
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1343
1334
Client.__del__(self, *args, **kwargs)
1345
def checker_callback(self, source, condition,
1346
(connection, command), *args, **kwargs):
1347
ret = Client.checker_callback(self, source, condition,
1348
(connection, command), *args,
1350
exitstatus = self.last_checker_status
1336
def checker_callback(self, pid, condition, command,
1338
self.checker_callback_tag = None
1340
if os.WIFEXITED(condition):
1341
exitstatus = os.WEXITSTATUS(condition)
1352
1342
# Emit D-Bus signal
1353
1343
self.CheckerCompleted(dbus.Int16(exitstatus),
1344
dbus.Int64(condition),
1355
1345
dbus.String(command))
1357
1347
# Emit D-Bus signal
1358
1348
self.CheckerCompleted(dbus.Int16(-1),
1360
self.last_checker_signal),
1349
dbus.Int64(condition),
1361
1350
dbus.String(command))
1352
return Client.checker_callback(self, pid, condition, command,
1364
1355
def start_checker(self, *args, **kwargs):
1365
1356
old_checker_pid = getattr(self.checker, "pid", None)
1479
1475
self.approved_by_default = bool(value)
1481
1477
# ApprovalDelay - property
1482
@dbus_service_property(_interface,
1478
@dbus_service_property(_interface, signature="t",
1484
1479
access="readwrite")
1485
1480
def ApprovalDelay_dbus_property(self, value=None):
1486
1481
if value is None: # get
1487
return dbus.UInt64(self.approval_delay.total_seconds()
1482
return dbus.UInt64(self.approval_delay_milliseconds())
1489
1483
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1491
1485
# ApprovalDuration - property
1492
@dbus_service_property(_interface,
1486
@dbus_service_property(_interface, signature="t",
1494
1487
access="readwrite")
1495
1488
def ApprovalDuration_dbus_property(self, value=None):
1496
1489
if value is None: # get
1497
return dbus.UInt64(self.approval_duration.total_seconds()
1490
return dbus.UInt64(timedelta_to_milliseconds(
1491
self.approval_duration))
1499
1492
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1501
1494
# Name - property
1587
1577
gobject.source_remove(self.disable_initiator_tag)
1588
self.disable_initiator_tag = gobject.timeout_add(
1589
int((self.expires - now).total_seconds() * 1000),
1578
self.disable_initiator_tag = (
1579
gobject.timeout_add(
1580
timedelta_to_milliseconds(self.expires - now),
1592
1583
# ExtendedTimeout - property
1593
@dbus_service_property(_interface,
1584
@dbus_service_property(_interface, signature="t",
1595
1585
access="readwrite")
1596
1586
def ExtendedTimeout_dbus_property(self, value=None):
1597
1587
if value is None: # get
1598
return dbus.UInt64(self.extended_timeout.total_seconds()
1588
return dbus.UInt64(self.extended_timeout_milliseconds())
1600
1589
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1602
1591
# Interval - property
1603
@dbus_service_property(_interface,
1592
@dbus_service_property(_interface, signature="t",
1605
1593
access="readwrite")
1606
1594
def Interval_dbus_property(self, value=None):
1607
1595
if value is None: # get
1608
return dbus.UInt64(self.interval.total_seconds() * 1000)
1596
return dbus.UInt64(self.interval_milliseconds())
1609
1597
self.interval = datetime.timedelta(0, 0, 0, value)
1610
1598
if getattr(self, "checker_initiator_tag", None) is None:
1612
1600
if self.enabled:
1613
1601
# Reschedule checker run
1614
1602
gobject.source_remove(self.checker_initiator_tag)
1615
self.checker_initiator_tag = gobject.timeout_add(
1616
value, self.start_checker)
1617
self.start_checker() # Start one now, too
1603
self.checker_initiator_tag = (gobject.timeout_add
1604
(value, self.start_checker))
1605
self.start_checker() # Start one now, too
1619
1607
# Checker - property
1620
@dbus_service_property(_interface,
1608
@dbus_service_property(_interface, signature="s",
1622
1609
access="readwrite")
1623
1610
def Checker_dbus_property(self, value=None):
1624
1611
if value is None: # get
1625
1612
return dbus.String(self.checker_command)
1626
self.checker_command = str(value)
1613
self.checker_command = unicode(value)
1628
1615
# CheckerRunning - property
1629
@dbus_service_property(_interface,
1616
@dbus_service_property(_interface, signature="b",
1631
1617
access="readwrite")
1632
1618
def CheckerRunning_dbus_property(self, value=None):
1633
1619
if value is None: # get
1690
1672
def handle(self):
1691
1673
with contextlib.closing(self.server.child_pipe) as child_pipe:
1692
1674
logger.info("TCP connection from: %s",
1693
str(self.client_address))
1675
unicode(self.client_address))
1694
1676
logger.debug("Pipe FD: %d",
1695
1677
self.server.child_pipe.fileno())
1697
session = gnutls.connection.ClientSession(
1698
self.request, gnutls.connection .X509Credentials())
1679
session = (gnutls.connection
1680
.ClientSession(self.request,
1682
.X509Credentials()))
1700
1684
# Note: gnutls.connection.X509Credentials is really a
1701
1685
# generic GnuTLS certificate credentials object so long as
1858
1845
def fingerprint(openpgp):
1859
1846
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1860
1847
# New GnuTLS "datum" with the OpenPGP public key
1861
datum = gnutls.library.types.gnutls_datum_t(
1862
ctypes.cast(ctypes.c_char_p(openpgp),
1863
ctypes.POINTER(ctypes.c_ubyte)),
1864
ctypes.c_uint(len(openpgp)))
1848
datum = (gnutls.library.types
1849
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
ctypes.c_uint(len(openpgp))))
1865
1853
# New empty GnuTLS certificate
1866
1854
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1867
gnutls.library.functions.gnutls_openpgp_crt_init(
1855
(gnutls.library.functions
1856
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1869
1857
# Import the OpenPGP public key into the certificate
1870
gnutls.library.functions.gnutls_openpgp_crt_import(
1871
crt, ctypes.byref(datum),
1872
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1858
(gnutls.library.functions
1859
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1860
gnutls.library.constants
1861
.GNUTLS_OPENPGP_FMT_RAW))
1873
1862
# Verify the self signature in the key
1874
1863
crtverify = ctypes.c_uint()
1875
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1876
crt, 0, ctypes.byref(crtverify))
1864
(gnutls.library.functions
1865
.gnutls_openpgp_crt_verify_self(crt, 0,
1866
ctypes.byref(crtverify)))
1877
1867
if crtverify.value != 0:
1878
1868
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1879
raise gnutls.errors.CertificateSecurityError(
1869
raise (gnutls.errors.CertificateSecurityError
1881
1871
# New buffer for the fingerprint
1882
1872
buf = ctypes.create_string_buffer(20)
1883
1873
buf_len = ctypes.c_size_t()
1884
1874
# Get the fingerprint from the certificate into the buffer
1885
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1886
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1875
(gnutls.library.functions
1876
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1877
ctypes.byref(buf_len)))
1887
1878
# Deinit the certificate
1888
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1889
1880
# Convert the buffer to a Python bytestring
2067
2048
def add_pipe(self, parent_pipe, proc):
2068
2049
# Call "handle_ipc" for both data and EOF events
2069
gobject.io_add_watch(
2070
parent_pipe.fileno(),
2071
gobject.IO_IN | gobject.IO_HUP,
2072
functools.partial(self.handle_ipc,
2073
parent_pipe = parent_pipe,
2050
gobject.io_add_watch(parent_pipe.fileno(),
2051
gobject.IO_IN | gobject.IO_HUP,
2052
functools.partial(self.handle_ipc,
2076
def handle_ipc(self, source, condition,
2079
client_object=None):
2057
def handle_ipc(self, source, condition, parent_pipe=None,
2058
proc = None, client_object=None):
2080
2059
# error, or the other end of multiprocessing.Pipe has closed
2081
2060
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2082
2061
# Wait for other process to exit
2178
2158
"followers")) # Tokens valid after
2180
Token = collections.namedtuple("Token", (
2181
"regexp", # To match token; if "value" is not None, must have
2182
# a "group" containing digits
2183
"value", # datetime.timedelta or None
2184
"followers")) # Tokens valid after this token
2185
2160
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2186
2161
# the "duration" ABNF definition in RFC 3339, Appendix A.
2187
2162
token_end = Token(re.compile(r"$"), None, frozenset())
2188
2163
token_second = Token(re.compile(r"(\d+)S"),
2189
2164
datetime.timedelta(seconds=1),
2190
frozenset((token_end, )))
2165
frozenset((token_end,)))
2191
2166
token_minute = Token(re.compile(r"(\d+)M"),
2192
2167
datetime.timedelta(minutes=1),
2193
2168
frozenset((token_second, token_end)))
2209
2184
frozenset((token_month, token_end)))
2210
2185
token_week = Token(re.compile(r"(\d+)W"),
2211
2186
datetime.timedelta(weeks=1),
2212
frozenset((token_end, )))
2187
frozenset((token_end,)))
2213
2188
token_duration = Token(re.compile(r"P"), None,
2214
2189
frozenset((token_year, token_month,
2215
2190
token_day, token_time,
2217
2192
# Define starting values
2218
2193
value = datetime.timedelta() # Value so far
2219
2194
found_token = None
2220
followers = frozenset((token_duration,)) # Following valid tokens
2195
followers = frozenset(token_duration,) # Following valid tokens
2221
2196
s = duration # String left to parse
2222
2197
# Loop until end token is found
2223
2198
while found_token is not token_end:
2418
2394
# Override the settings from the config file with command line
2419
2395
# options, if set.
2420
2396
for option in ("interface", "address", "port", "debug",
2421
"priority", "servicename", "configdir", "use_dbus",
2422
"use_ipv6", "debuglevel", "restore", "statedir",
2423
"socket", "foreground", "zeroconf"):
2397
"priority", "servicename", "configdir",
2398
"use_dbus", "use_ipv6", "debuglevel", "restore",
2399
"statedir", "socket", "foreground", "zeroconf"):
2424
2400
value = getattr(options, option)
2425
2401
if value is not None:
2426
2402
server_settings[option] = value
2428
2404
# Force all strings to be unicode
2429
2405
for option in server_settings.keys():
2430
if isinstance(server_settings[option], bytes):
2431
server_settings[option] = (server_settings[option]
2406
if type(server_settings[option]) is str:
2407
server_settings[option] = unicode(server_settings[option])
2433
2408
# Force all boolean options to be boolean
2434
2409
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2435
2410
"foreground", "zeroconf"):
2483
2460
socketfd = None
2484
2461
if server_settings["socket"] != "":
2485
2462
socketfd = server_settings["socket"]
2486
tcp_server = MandosServer(
2487
(server_settings["address"], server_settings["port"]),
2489
interface=(server_settings["interface"] or None),
2491
gnutls_priority=server_settings["priority"],
2463
tcp_server = MandosServer((server_settings["address"],
2464
server_settings["port"]),
2466
interface=(server_settings["interface"]
2470
server_settings["priority"],
2494
2473
if not foreground:
2495
2474
pidfilename = "/run/mandos.pid"
2496
2475
if not os.path.isdir("/run/."):
2569
2547
tcp_server.use_dbus = False
2571
2549
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2572
service = AvahiServiceToSyslog(
2573
name = server_settings["servicename"],
2574
servicetype = "_mandos._tcp",
2575
protocol = protocol,
2550
service = AvahiServiceToSyslog(name =
2551
server_settings["servicename"],
2552
servicetype = "_mandos._tcp",
2553
protocol = protocol, bus = bus)
2577
2554
if server_settings["interface"]:
2578
service.interface = if_nametoindex(
2579
server_settings["interface"].encode("utf-8"))
2555
service.interface = (if_nametoindex
2556
(str(server_settings["interface"])))
2581
2558
global multiprocessing_manager
2582
2559
multiprocessing_manager = multiprocessing.Manager()
2601
2578
if server_settings["restore"]:
2603
2580
with open(stored_state_path, "rb") as stored_state:
2604
clients_data, old_client_settings = pickle.load(
2581
clients_data, old_client_settings = (pickle.load
2606
2583
os.remove(stored_state_path)
2607
2584
except IOError as e:
2608
2585
if e.errno == errno.ENOENT:
2609
logger.warning("Could not load persistent state:"
2610
" {}".format(os.strerror(e.errno)))
2586
logger.warning("Could not load persistent state: {0}"
2587
.format(os.strerror(e.errno)))
2612
2589
logger.critical("Could not load persistent state:",
2615
2592
except EOFError as e:
2616
2593
logger.warning("Could not load persistent state: "
2594
"EOFError:", exc_info=e)
2620
2596
with PGPEngine() as pgp:
2621
for client_name, client in clients_data.items():
2597
for client_name, client in clients_data.iteritems():
2622
2598
# Skip removed clients
2623
2599
if client_name not in client_settings:
2649
2625
if datetime.datetime.utcnow() >= client["expires"]:
2650
2626
if not client["last_checked_ok"]:
2651
2627
logger.warning(
2652
"disabling client {} - Client never "
2653
"performed a successful checker".format(
2628
"disabling client {0} - Client never "
2629
"performed a successful checker"
2630
.format(client_name))
2655
2631
client["enabled"] = False
2656
2632
elif client["last_checker_status"] != 0:
2657
2633
logger.warning(
2658
"disabling client {} - Client last"
2659
" checker failed with error code"
2662
client["last_checker_status"]))
2634
"disabling client {0} - Client "
2635
"last checker failed with error code {1}"
2636
.format(client_name,
2637
client["last_checker_status"]))
2663
2638
client["enabled"] = False
2665
client["expires"] = (
2666
datetime.datetime.utcnow()
2667
+ client["timeout"])
2640
client["expires"] = (datetime.datetime
2642
+ client["timeout"])
2668
2643
logger.debug("Last checker succeeded,"
2669
" keeping {} enabled".format(
2644
" keeping {0} enabled"
2645
.format(client_name))
2672
client["secret"] = pgp.decrypt(
2673
client["encrypted_secret"],
2674
client_settings[client_name]["secret"])
2647
client["secret"] = (
2648
pgp.decrypt(client["encrypted_secret"],
2649
client_settings[client_name]
2675
2651
except PGPError:
2676
2652
# If decryption fails, we use secret from new settings
2677
logger.debug("Failed to decrypt {} old secret".format(
2679
client["secret"] = (client_settings[client_name]
2653
logger.debug("Failed to decrypt {0} old secret"
2654
.format(client_name))
2655
client["secret"] = (
2656
client_settings[client_name]["secret"])
2682
2658
# Add/remove clients based on new changes made to config
2683
2659
for client_name in (set(old_client_settings)
2713
2688
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2717
@alternate_dbus_interfaces(
2718
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2691
@alternate_dbus_interfaces({"se.recompile.Mandos":
2692
"se.bsnet.fukt.Mandos"})
2719
2693
class MandosDBusService(DBusObjectWithProperties):
2720
2694
"""A D-Bus proxy object"""
2722
2695
def __init__(self):
2723
2696
dbus.service.Object.__init__(self, bus, "/")
2725
2697
_interface = "se.recompile.Mandos"
2727
2699
@dbus_interface_annotations(_interface)
2728
2700
def _foo(self):
2730
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2701
return { "org.freedesktop.DBus.Property"
2702
".EmitsChangedSignal":
2733
2705
@dbus.service.signal(_interface, signature="o")
2734
2706
def ClientAdded(self, objpath):
2817
2790
del client_settings[client.name]["secret"]
2820
with tempfile.NamedTemporaryFile(
2824
dir=os.path.dirname(stored_state_path),
2825
delete=False) as stored_state:
2793
with (tempfile.NamedTemporaryFile
2794
(mode='wb', suffix=".pickle", prefix='clients-',
2795
dir=os.path.dirname(stored_state_path),
2796
delete=False)) as stored_state:
2826
2797
pickle.dump((clients, client_settings), stored_state)
2827
tempname = stored_state.name
2798
tempname=stored_state.name
2828
2799
os.rename(tempname, stored_state_path)
2829
2800
except (IOError, OSError) as e: