To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 729
- compare with another revision
- download diff
- download tarball
- view history from revision 729
- Committer: Teddy Hogeborn
- Date: 2014-08-09 13:12:55 UTC
- Revision ID: teddy@recompile.se-20140809131255-lp31j98u2pl0xpe6
mandos: Stop using str() and remove unnecessary unicode() calls.
* mandos (if_nametoindex): Use "bytes" literal instead of str().
(initlogger): Use a unicode string for log device.
(AvahiError.__unicode__): Removed.
(DBusPropertyException.__unicode__): - '' -
(ClientDBus.Secret_dbus_property): Use bytes() instead of str().
(IPv6_TCPServer.server_bind): Use .encode() instead of str().
(string_to_delta): Removed unnecessary unicode() call.
(main): Use "isinstance(x, bytes)" instead of "type(x) is str", use
.decode() instead of unicode(), and use .encode() instead of
str().
* mandos (if_nametoindex): Use "bytes" literal instead of str().
(initlogger): Use a unicode string for log device.
(AvahiError.__unicode__): Removed.
(DBusPropertyException.__unicode__): - '' -
(ClientDBus.Secret_dbus_property): Use bytes() instead of str().
(IPv6_TCPServer.server_bind): Use .encode() instead of str().
(string_to_delta): Removed unnecessary unicode() call.
(main): Use "isinstance(x, bytes)" instead of "type(x) is str", use
.decode() instead of unicode(), and use .encode() instead of
str().
- files added:
- debian/mandos-client.examples
- debian/upstream
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
65
67
import types
66
68
import binascii
67
69
import tempfile
70
import itertools
71
import collections
68
72
69
73
import dbus
70
74
import dbus.service
75
79
import ctypes.util
76
80
import xml.dom.minidom
77
81
import inspect
78
import GnuPGInterface
79
82
80
83
try:
81
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
88
except ImportError:
86
89
SO_BINDTODEVICE = None
87
90
88
version = "1.4.1"
91
version = "1.6.8"
89
92
stored_state_file = "clients.pickle"
90
93
91
94
logger = logging.getLogger()
92
syslogger = (logging.handlers.SysLogHandler
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
address = str("/dev/log")))
95
syslogger = None
95
96
96
97
try:
97
98
if_nametoindex = (ctypes.cdll.LoadLibrary
103
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
105
with contextlib.closing(socket.socket()) as s:
105
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
107
struct.pack(b"16s16x", interface))
108
interface_index = struct.unpack("I", ifreq[16:20])[0]
110
109
return interface_index
111
110
112
111
113
def initlogger(level=logging.WARNING):
112
def initlogger(debug, level=logging.WARNING):
114
113
"""init logger and add loglevel"""
115
114
115
global syslogger
116
syslogger = (logging.handlers.SysLogHandler
117
(facility =
118
logging.handlers.SysLogHandler.LOG_DAEMON,
119
address = "/dev/log"))
116
120
syslogger.setFormatter(logging.Formatter
117
121
('Mandos [%(process)d]: %(levelname)s:'
118
122
' %(message)s'))
119
123
logger.addHandler(syslogger)
120
124
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
123
' [%(process)d]:'
124
' %(levelname)s:'
125
' %(message)s'))
126
logger.addHandler(console)
125
if debug:
126
console = logging.StreamHandler()
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
128
' [%(process)d]:'
129
' %(levelname)s:'
130
' %(message)s'))
131
logger.addHandler(console)
127
132
logger.setLevel(level)
128
133
129
134
135
140
class PGPEngine(object):
136
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
137
142
def __init__(self):
138
self.gnupg = GnuPGInterface.GnuPG()
139
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
140
self.gnupg = GnuPGInterface.GnuPG()
141
self.gnupg.options.meta_interactive = False
142
self.gnupg.options.homedir = self.tempdir
143
self.gnupg.options.extra_args.extend(['--force-mdc',
144
'--quiet'])
144
self.gnupgargs = ['--batch',
145
'--home', self.tempdir,
146
'--force-mdc',
147
'--quiet',
148
'--no-use-agent']
145
149
146
150
def __enter__(self):
147
151
return self
148
152
149
def __exit__ (self, exc_type, exc_value, traceback):
153
def __exit__(self, exc_type, exc_value, traceback):
150
154
self._cleanup()
151
155
return False
152
156
169
173
def password_encode(self, password):
170
174
# Passphrase can not be empty and can not contain newlines or
171
175
# NUL bytes. So we prefix it and hex encode it.
172
return b"mandos" + binascii.hexlify(password)
176
encoded = b"mandos" + binascii.hexlify(password)
177
if len(encoded) > 2048:
178
# GnuPG can't handle long passwords, so encode differently
179
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
180
.replace(b"\n", b"\\n")
181
.replace(b"\0", b"\\x00"))
182
return encoded
173
183
174
184
def encrypt(self, data, password):
175
self.gnupg.passphrase = self.password_encode(password)
176
with open(os.devnull) as devnull:
177
try:
178
proc = self.gnupg.run(['--symmetric'],
179
create_fhs=['stdin', 'stdout'],
180
attach_fhs={'stderr': devnull})
181
with contextlib.closing(proc.handles['stdin']) as f:
182
f.write(data)
183
with contextlib.closing(proc.handles['stdout']) as f:
184
ciphertext = f.read()
185
proc.wait()
186
except IOError as e:
187
raise PGPError(e)
188
self.gnupg.passphrase = None
185
passphrase = self.password_encode(password)
186
with tempfile.NamedTemporaryFile(dir=self.tempdir
187
) as passfile:
188
passfile.write(passphrase)
189
passfile.flush()
190
proc = subprocess.Popen(['gpg', '--symmetric',
191
'--passphrase-file',
192
passfile.name]
193
+ self.gnupgargs,
194
stdin = subprocess.PIPE,
195
stdout = subprocess.PIPE,
196
stderr = subprocess.PIPE)
197
ciphertext, err = proc.communicate(input = data)
198
if proc.returncode != 0:
199
raise PGPError(err)
189
200
return ciphertext
190
201
191
202
def decrypt(self, data, password):
192
self.gnupg.passphrase = self.password_encode(password)
193
with open(os.devnull) as devnull:
194
try:
195
proc = self.gnupg.run(['--decrypt'],
196
create_fhs=['stdin', 'stdout'],
197
attach_fhs={'stderr': devnull})
198
with contextlib.closing(proc.handles['stdin'] ) as f:
199
f.write(data)
200
with contextlib.closing(proc.handles['stdout']) as f:
201
decrypted_plaintext = f.read()
202
proc.wait()
203
except IOError as e:
204
raise PGPError(e)
205
self.gnupg.passphrase = None
203
passphrase = self.password_encode(password)
204
with tempfile.NamedTemporaryFile(dir = self.tempdir
205
) as passfile:
206
passfile.write(passphrase)
207
passfile.flush()
208
proc = subprocess.Popen(['gpg', '--decrypt',
209
'--passphrase-file',
210
passfile.name]
211
+ self.gnupgargs,
212
stdin = subprocess.PIPE,
213
stdout = subprocess.PIPE,
214
stderr = subprocess.PIPE)
215
decrypted_plaintext, err = proc.communicate(input
216
= data)
217
if proc.returncode != 0:
218
raise PGPError(err)
206
219
return decrypted_plaintext
207
220
208
221
209
210
222
class AvahiError(Exception):
211
223
def __init__(self, value, *args, **kwargs):
212
224
self.value = value
213
super(AvahiError, self).__init__(value, *args, **kwargs)
214
def __unicode__(self):
215
return unicode(repr(self.value))
225
return super(AvahiError, self).__init__(value, *args,
226
**kwargs)
216
227
217
228
class AvahiServiceError(AvahiError):
218
229
pass
229
240
Used to optionally bind to the specified interface.
230
241
name: string; Example: 'Mandos'
231
242
type: string; Example: '_mandos._tcp'.
232
See <http://www.dns-sd.org/ServiceTypes.html>
243
See <https://www.iana.org/assignments/service-names-port-numbers>
233
244
port: integer; what port to announce
234
245
TXT: list of strings; TXT record for the service
235
246
domain: string; Domain to publish on, default to .local if empty.
241
252
server: D-Bus Server
242
253
bus: dbus.SystemBus()
243
254
"""
255
244
256
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
245
257
servicetype = None, port = None, TXT = None,
246
258
domain = "", host = "", max_renames = 32768,
259
271
self.server = None
260
272
self.bus = bus
261
273
self.entry_group_state_changed_match = None
274
262
275
def rename(self):
263
276
"""Derived from the Avahi example code"""
264
277
if self.rename_count >= self.max_renames:
274
287
try:
275
288
self.add()
276
289
except dbus.exceptions.DBusException as error:
277
logger.critical("DBusException: %s", error)
290
logger.critical("D-Bus Exception", exc_info=error)
278
291
self.cleanup()
279
292
os._exit(1)
280
293
self.rename_count += 1
294
281
295
def remove(self):
282
296
"""Derived from the Avahi example code"""
283
297
if self.entry_group_state_changed_match is not None:
285
299
self.entry_group_state_changed_match = None
286
300
if self.group is not None:
287
301
self.group.Reset()
302
288
303
def add(self):
289
304
"""Derived from the Avahi example code"""
290
305
self.remove()
307
322
dbus.UInt16(self.port),
308
323
avahi.string_array_to_txt_array(self.TXT))
309
324
self.group.Commit()
325
310
326
def entry_group_state_changed(self, state, error):
311
327
"""Derived from the Avahi example code"""
312
328
logger.debug("Avahi entry group state change: %i", state)
319
335
elif state == avahi.ENTRY_GROUP_FAILURE:
320
336
logger.critical("Avahi: Error in group state changed %s",
321
337
unicode(error))
322
raise AvahiGroupError("State changed: %s"
323
% unicode(error))
338
raise AvahiGroupError("State changed: {!s}"
339
.format(error))
340
324
341
def cleanup(self):
325
342
"""Derived from the Avahi example code"""
326
343
if self.group is not None:
331
348
pass
332
349
self.group = None
333
350
self.remove()
351
334
352
def server_state_changed(self, state, error=None):
335
353
"""Derived from the Avahi example code"""
336
354
logger.debug("Avahi server state change: %i", state)
355
373
logger.debug("Unknown state: %r", state)
356
374
else:
357
375
logger.debug("Unknown state: %r: %r", state, error)
376
358
377
def activate(self):
359
378
"""Derived from the Avahi example code"""
360
379
if self.server is None:
367
386
self.server_state_changed)
368
387
self.server_state_changed(self.server.GetState())
369
388
389
370
390
class AvahiServiceToSyslog(AvahiService):
371
391
def rename(self):
372
392
"""Add the new name to the syslog messages"""
373
393
ret = AvahiService.rename(self)
374
394
syslogger.setFormatter(logging.Formatter
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
377
% self.name))
395
('Mandos ({}) [%(process)d]:'
396
' %(levelname)s: %(message)s'
397
.format(self.name)))
378
398
return ret
379
399
380
def timedelta_to_milliseconds(td):
381
"Convert a datetime.timedelta() to milliseconds"
382
return ((td.days * 24 * 60 * 60 * 1000)
383
+ (td.seconds * 1000)
384
+ (td.microseconds // 1000))
385
400
386
401
class Client(object):
387
402
"""A representation of a client host served by this server.
388
403
413
428
last_checked_ok: datetime.datetime(); (UTC) or None
414
429
last_checker_status: integer between 0 and 255 reflecting exit
415
430
status of last checker. -1 reflects crashed
416
checker, or None.
431
checker, -2 means no checker completed yet.
417
432
last_enabled: datetime.datetime(); (UTC) or None
418
433
name: string; from the config file, used in log messages and
419
434
D-Bus identifiers
420
435
secret: bytestring; sent verbatim (over TLS) to client
421
436
timeout: datetime.timedelta(); How long from last_checked_ok
422
437
until this client is disabled
423
extended_timeout: extra long timeout when password has been sent
438
extended_timeout: extra long timeout when secret has been sent
424
439
runtime_expansions: Allowed attributes for runtime expansion.
425
440
expires: datetime.datetime(); time (UTC) when a client will be
426
441
disabled, or None
442
server_settings: The server_settings dict from main()
427
443
"""
428
444
429
445
runtime_expansions = ("approval_delay", "approval_duration",
430
"created", "enabled", "fingerprint",
431
"host", "interval", "last_checked_ok",
446
"created", "enabled", "expires",
447
"fingerprint", "host", "interval",
448
"last_approval_request", "last_checked_ok",
432
449
"last_enabled", "name", "timeout")
433
client_defaults = { "timeout": "5m",
434
"extended_timeout": "15m",
435
"interval": "2m",
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
436
453
"checker": "fping -q -- %%(host)s",
437
454
"host": "",
438
"approval_delay": "0s",
439
"approval_duration": "1s",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
440
457
"approved_by_default": "True",
441
458
"enabled": "True",
442
459
}
443
460
444
def timeout_milliseconds(self):
445
"Return the 'timeout' attribute in milliseconds"
446
return timedelta_to_milliseconds(self.timeout)
447
448
def extended_timeout_milliseconds(self):
449
"Return the 'extended_timeout' attribute in milliseconds"
450
return timedelta_to_milliseconds(self.extended_timeout)
451
452
def interval_milliseconds(self):
453
"Return the 'interval' attribute in milliseconds"
454
return timedelta_to_milliseconds(self.interval)
455
456
def approval_delay_milliseconds(self):
457
return timedelta_to_milliseconds(self.approval_delay)
458
459
461
@staticmethod
460
462
def config_parser(config):
461
""" Construct a new dict of client settings of this form:
463
"""Construct a new dict of client settings of this form:
462
464
{ client_name: {setting_name: value, ...}, ...}
463
with exceptions for any special settings as defined above"""
465
with exceptions for any special settings as defined above.
466
NOTE: Must be a pure function. Must return the same result
467
value given the same arguments.
468
"""
464
469
settings = {}
465
470
for client_name in config.sections():
466
471
section = dict(config.items(client_name))
470
475
# Reformat values from string types to Python types
471
476
client["approved_by_default"] = config.getboolean(
472
477
client_name, "approved_by_default")
473
client["enabled"] = config.getboolean(client_name, "enabled")
478
client["enabled"] = config.getboolean(client_name,
479
"enabled")
474
480
475
481
client["fingerprint"] = (section["fingerprint"].upper()
476
482
.replace(" ", ""))
482
488
"rb") as secfile:
483
489
client["secret"] = secfile.read()
484
490
else:
485
raise TypeError("No secret or secfile for section %s"
486
% section)
491
raise TypeError("No secret or secfile for section {}"
492
.format(section))
487
493
client["timeout"] = string_to_delta(section["timeout"])
488
494
client["extended_timeout"] = string_to_delta(
489
495
section["extended_timeout"])
495
501
client["checker_command"] = section["checker"]
496
502
client["last_approval_request"] = None
497
503
client["last_checked_ok"] = None
498
client["last_checker_status"] = None
499
if client["enabled"]:
500
client["last_enabled"] = datetime.datetime.utcnow()
501
client["expires"] = (datetime.datetime.utcnow()
502
+ client["timeout"])
503
else:
504
client["last_enabled"] = None
505
client["expires"] = None
506
504
client["last_checker_status"] = -2
505
507
506
return settings
508
509
510
def __init__(self, settings, name = None):
511
"""Note: the 'checker' key in 'config' sets the
512
'checker_command' attribute and *not* the 'checker'
513
attribute."""
507
508
def __init__(self, settings, name = None, server_settings=None):
514
509
self.name = name
510
if server_settings is None:
511
server_settings = {}
512
self.server_settings = server_settings
515
513
# adding all client settings
516
for setting, value in settings.iteritems():
514
for setting, value in settings.items():
517
515
setattr(self, setting, value)
518
516
517
if self.enabled:
518
if not hasattr(self, "last_enabled"):
519
self.last_enabled = datetime.datetime.utcnow()
520
if not hasattr(self, "expires"):
521
self.expires = (datetime.datetime.utcnow()
522
+ self.timeout)
523
else:
524
self.last_enabled = None
525
self.expires = None
526
519
527
logger.debug("Creating client %r", self.name)
520
528
# Uppercase and remove spaces from fingerprint for later
521
529
# comparison purposes with return value from the fingerprint()
522
530
# function
523
531
logger.debug(" Fingerprint: %s", self.fingerprint)
524
self.created = settings.get("created", datetime.datetime.utcnow())
525
532
self.created = settings.get("created",
533
datetime.datetime.utcnow())
534
526
535
# attributes specific for this server instance
527
536
self.checker = None
528
537
self.checker_initiator_tag = None
556
565
if getattr(self, "enabled", False):
557
566
# Already enabled
558
567
return
559
self.send_changedstate()
560
568
self.expires = datetime.datetime.utcnow() + self.timeout
561
569
self.enabled = True
562
570
self.last_enabled = datetime.datetime.utcnow()
563
571
self.init_checker()
572
self.send_changedstate()
564
573
565
574
def disable(self, quiet=True):
566
575
"""Disable this client."""
567
576
if not getattr(self, "enabled", False):
568
577
return False
569
578
if not quiet:
570
self.send_changedstate()
571
if not quiet:
572
579
logger.info("Disabling client %s", self.name)
573
if getattr(self, "disable_initiator_tag", False):
580
if getattr(self, "disable_initiator_tag", None) is not None:
574
581
gobject.source_remove(self.disable_initiator_tag)
575
582
self.disable_initiator_tag = None
576
583
self.expires = None
577
if getattr(self, "checker_initiator_tag", False):
584
if getattr(self, "checker_initiator_tag", None) is not None:
578
585
gobject.source_remove(self.checker_initiator_tag)
579
586
self.checker_initiator_tag = None
580
587
self.stop_checker()
581
588
self.enabled = False
589
if not quiet:
590
self.send_changedstate()
582
591
# Do not run this again if called by a gobject.timeout_add
583
592
return False
584
593
588
597
def init_checker(self):
589
598
# Schedule a new checker to be started an 'interval' from now,
590
599
# and every interval from then on.
600
if self.checker_initiator_tag is not None:
601
gobject.source_remove(self.checker_initiator_tag)
591
602
self.checker_initiator_tag = (gobject.timeout_add
592
(self.interval_milliseconds(),
603
(int(self.interval
604
.total_seconds() * 1000),
593
605
self.start_checker))
594
606
# Schedule a disable() when 'timeout' has passed
607
if self.disable_initiator_tag is not None:
608
gobject.source_remove(self.disable_initiator_tag)
595
609
self.disable_initiator_tag = (gobject.timeout_add
596
(self.timeout_milliseconds(),
597
self.disable))
610
(int(self.timeout
611
.total_seconds() * 1000),
612
self.disable))
598
613
# Also start a new checker *right now*.
599
614
self.start_checker()
600
615
616
631
logger.warning("Checker for %(name)s crashed?",
617
632
vars(self))
618
633
619
def checked_ok(self, timeout=None):
620
"""Bump up the timeout for this client.
621
622
This should only be called when the client has been seen,
623
alive and well.
624
"""
634
def checked_ok(self):
635
"""Assert that the client has been seen, alive and well."""
636
self.last_checked_ok = datetime.datetime.utcnow()
637
self.last_checker_status = 0
638
self.bump_timeout()
639
640
def bump_timeout(self, timeout=None):
641
"""Bump up the timeout for this client."""
625
642
if timeout is None:
626
643
timeout = self.timeout
627
self.last_checked_ok = datetime.datetime.utcnow()
628
644
if self.disable_initiator_tag is not None:
629
645
gobject.source_remove(self.disable_initiator_tag)
646
self.disable_initiator_tag = None
630
647
if getattr(self, "enabled", False):
631
648
self.disable_initiator_tag = (gobject.timeout_add
632
(timedelta_to_milliseconds
633
(timeout), self.disable))
649
(int(timeout.total_seconds()
650
* 1000), self.disable))
634
651
self.expires = datetime.datetime.utcnow() + timeout
635
652
636
653
def need_approval(self):
642
659
If a checker already exists, leave it running and do
643
660
nothing."""
644
661
# The reason for not killing a running checker is that if we
645
# did that, then if a checker (for some reason) started
646
# running slowly and taking more than 'interval' time, the
647
# client would inevitably timeout, since no checker would get
648
# a chance to run to completion. If we instead leave running
662
# did that, and if a checker (for some reason) started running
663
# slowly and taking more than 'interval' time, then the client
664
# would inevitably timeout, since no checker would get a
665
# chance to run to completion. If we instead leave running
649
666
# checkers alone, the checker would have to take more time
650
667
# than 'timeout' for the client to be disabled, which is as it
651
668
# should be.
653
670
# If a checker exists, make sure it is not a zombie
654
671
try:
655
672
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
656
except (AttributeError, OSError) as error:
657
if (isinstance(error, OSError)
658
and error.errno != errno.ECHILD):
659
raise error
673
except AttributeError:
674
pass
675
except OSError as error:
676
if error.errno != errno.ECHILD:
677
raise
660
678
else:
661
679
if pid:
662
680
logger.warning("Checker was a zombie")
665
683
self.current_checker_command)
666
684
# Start a new checker if needed
667
685
if self.checker is None:
686
# Escape attributes for the shell
687
escaped_attrs = { attr:
688
re.escape(unicode(getattr(self,
689
attr)))
690
for attr in self.runtime_expansions }
668
691
try:
669
# In case checker_command has exactly one % operator
670
command = self.checker_command % self.host
671
except TypeError:
672
# Escape attributes for the shell
673
escaped_attrs = dict(
674
(attr,
675
re.escape(unicode(str(getattr(self, attr, "")),
676
errors=
677
'replace')))
678
for attr in
679
self.runtime_expansions)
680
681
try:
682
command = self.checker_command % escaped_attrs
683
except TypeError as error:
684
logger.error('Could not format string "%s":'
685
' %s', self.checker_command, error)
686
return True # Try again later
692
command = self.checker_command % escaped_attrs
693
except TypeError as error:
694
logger.error('Could not format string "%s"',
695
self.checker_command, exc_info=error)
696
return True # Try again later
687
697
self.current_checker_command = command
688
698
try:
689
699
logger.info("Starting checker %r for %s",
692
702
# in normal mode, that is already done by daemon(),
693
703
# and in debug mode we don't want to. (Stdin is
694
704
# always replaced by /dev/null.)
705
# The exception is when not debugging but nevertheless
706
# running in the foreground; use the previously
707
# created wnull.
708
popen_args = {}
709
if (not self.server_settings["debug"]
710
and self.server_settings["foreground"]):
711
popen_args.update({"stdout": wnull,
712
"stderr": wnull })
695
713
self.checker = subprocess.Popen(command,
696
714
close_fds=True,
697
shell=True, cwd="/")
698
self.checker_callback_tag = (gobject.child_watch_add
699
(self.checker.pid,
700
self.checker_callback,
701
data=command))
702
# The checker may have completed before the gobject
703
# watch was added. Check for this.
715
shell=True, cwd="/",
716
**popen_args)
717
except OSError as error:
718
logger.error("Failed to start subprocess",
719
exc_info=error)
720
return True
721
self.checker_callback_tag = (gobject.child_watch_add
722
(self.checker.pid,
723
self.checker_callback,
724
data=command))
725
# The checker may have completed before the gobject
726
# watch was added. Check for this.
727
try:
704
728
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
705
if pid:
706
gobject.source_remove(self.checker_callback_tag)
707
self.checker_callback(pid, status, command)
708
729
except OSError as error:
709
logger.error("Failed to start subprocess: %s",
710
error)
730
if error.errno == errno.ECHILD:
731
# This should never happen
732
logger.error("Child process vanished",
733
exc_info=error)
734
return True
735
raise
736
if pid:
737
gobject.source_remove(self.checker_callback_tag)
738
self.checker_callback(pid, status, command)
711
739
# Re-run this periodically if run by gobject.timeout_add
712
740
return True
713
741
720
748
return
721
749
logger.debug("Stopping checker for %(name)s", vars(self))
722
750
try:
723
os.kill(self.checker.pid, signal.SIGTERM)
751
self.checker.terminate()
724
752
#time.sleep(0.5)
725
753
#if self.checker.poll() is None:
726
# os.kill(self.checker.pid, signal.SIGKILL)
754
# self.checker.kill()
727
755
except OSError as error:
728
756
if error.errno != errno.ESRCH: # No such process
729
757
raise
746
774
# "Set" method, so we fail early here:
747
775
if byte_arrays and signature != "ay":
748
776
raise ValueError("Byte arrays not supported for non-'ay'"
749
" signature %r" % signature)
777
" signature {!r}".format(signature))
750
778
def decorator(func):
751
779
func._dbus_is_property = True
752
780
func._dbus_interface = dbus_interface
760
788
return decorator
761
789
762
790
791
def dbus_interface_annotations(dbus_interface):
792
"""Decorator for marking functions returning interface annotations
793
794
Usage:
795
796
@dbus_interface_annotations("org.example.Interface")
797
def _foo(self): # Function name does not matter
798
return {"org.freedesktop.DBus.Deprecated": "true",
799
"org.freedesktop.DBus.Property.EmitsChangedSignal":
800
"false"}
801
"""
802
def decorator(func):
803
func._dbus_is_interface = True
804
func._dbus_interface = dbus_interface
805
func._dbus_name = dbus_interface
806
return func
807
return decorator
808
809
810
def dbus_annotations(annotations):
811
"""Decorator to annotate D-Bus methods, signals or properties
812
Usage:
813
814
@dbus_service_property("org.example.Interface", signature="b",
815
access="r")
816
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
817
"org.freedesktop.DBus.Property."
818
"EmitsChangedSignal": "false"})
819
def Property_dbus_property(self):
820
return dbus.Boolean(False)
821
"""
822
def decorator(func):
823
func._dbus_annotations = annotations
824
return func
825
return decorator
826
827
763
828
class DBusPropertyException(dbus.exceptions.DBusException):
764
829
"""A base class for D-Bus property-related exceptions
765
830
"""
766
def __unicode__(self):
767
return unicode(str(self))
768
831
pass
769
832
770
833
class DBusPropertyAccessException(DBusPropertyException):
771
834
"""A property's access permissions disallows an operation.
788
851
"""
789
852
790
853
@staticmethod
791
def _is_dbus_property(obj):
792
return getattr(obj, "_dbus_is_property", False)
854
def _is_dbus_thing(thing):
855
"""Returns a function testing if an attribute is a D-Bus thing
856
857
If called like _is_dbus_thing("method") it returns a function
858
suitable for use as predicate to inspect.getmembers().
859
"""
860
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
861
False)
793
862
794
def _get_all_dbus_properties(self):
863
def _get_all_dbus_things(self, thing):
795
864
"""Returns a generator of (name, attribute) pairs
796
865
"""
797
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
866
return ((getattr(athing.__get__(self), "_dbus_name",
867
name),
868
athing.__get__(self))
798
869
for cls in self.__class__.__mro__
799
for name, prop in
800
inspect.getmembers(cls, self._is_dbus_property))
870
for name, athing in
871
inspect.getmembers(cls,
872
self._is_dbus_thing(thing)))
801
873
802
874
def _get_dbus_property(self, interface_name, property_name):
803
875
"""Returns a bound method if one exists which is a D-Bus
805
877
"""
806
878
for cls in self.__class__.__mro__:
807
879
for name, value in (inspect.getmembers
808
(cls, self._is_dbus_property)):
880
(cls,
881
self._is_dbus_thing("property"))):
809
882
if (value._dbus_name == property_name
810
883
and value._dbus_interface == interface_name):
811
884
return value.__get__(self)
839
912
# The byte_arrays option is not supported yet on
840
913
# signatures other than "ay".
841
914
if prop._dbus_signature != "ay":
842
raise ValueError
843
value = dbus.ByteArray(''.join(unichr(byte)
844
for byte in value))
915
raise ValueError("Byte arrays not supported for non-"
916
"'ay' signature {!r}"
917
.format(prop._dbus_signature))
918
value = dbus.ByteArray(b''.join(chr(byte)
919
for byte in value))
845
920
prop(value)
846
921
847
922
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
853
928
Note: Will not include properties with access="write".
854
929
"""
855
930
properties = {}
856
for name, prop in self._get_all_dbus_properties():
931
for name, prop in self._get_all_dbus_things("property"):
857
932
if (interface_name
858
933
and interface_name != prop._dbus_interface):
859
934
# Interface non-empty but did not match
874
949
path_keyword='object_path',
875
950
connection_keyword='connection')
876
951
def Introspect(self, object_path, connection):
877
"""Standard D-Bus method, overloaded to insert property tags.
952
"""Overloading of standard D-Bus method.
953
954
Inserts property tags and interface annotation tags.
878
955
"""
879
956
xmlstring = dbus.service.Object.Introspect(self, object_path,
880
957
connection)
887
964
e.setAttribute("access", prop._dbus_access)
888
965
return e
889
966
for if_tag in document.getElementsByTagName("interface"):
967
# Add property tags
890
968
for tag in (make_tag(document, name, prop)
891
969
for name, prop
892
in self._get_all_dbus_properties()
970
in self._get_all_dbus_things("property")
893
971
if prop._dbus_interface
894
972
== if_tag.getAttribute("name")):
895
973
if_tag.appendChild(tag)
974
# Add annotation tags
975
for typ in ("method", "signal", "property"):
976
for tag in if_tag.getElementsByTagName(typ):
977
annots = dict()
978
for name, prop in (self.
979
_get_all_dbus_things(typ)):
980
if (name == tag.getAttribute("name")
981
and prop._dbus_interface
982
== if_tag.getAttribute("name")):
983
annots.update(getattr
984
(prop,
985
"_dbus_annotations",
986
{}))
987
for name, value in annots.items():
988
ann_tag = document.createElement(
989
"annotation")
990
ann_tag.setAttribute("name", name)
991
ann_tag.setAttribute("value", value)
992
tag.appendChild(ann_tag)
993
# Add interface annotation tags
994
for annotation, value in dict(
995
itertools.chain.from_iterable(
996
annotations().items()
997
for name, annotations in
998
self._get_all_dbus_things("interface")
999
if name == if_tag.getAttribute("name")
1000
)).items():
1001
ann_tag = document.createElement("annotation")
1002
ann_tag.setAttribute("name", annotation)
1003
ann_tag.setAttribute("value", value)
1004
if_tag.appendChild(ann_tag)
896
1005
# Add the names to the return values for the
897
1006
# "org.freedesktop.DBus.Properties" methods
898
1007
if (if_tag.getAttribute("name")
913
1022
except (AttributeError, xml.dom.DOMException,
914
1023
xml.parsers.expat.ExpatError) as error:
915
1024
logger.error("Failed to override Introspection method",
916
error)
1025
exc_info=error)
917
1026
return xmlstring
918
1027
919
1028
920
def datetime_to_dbus (dt, variant_level=0):
1029
def datetime_to_dbus(dt, variant_level=0):
921
1030
"""Convert a UTC datetime.datetime() to a D-Bus type."""
922
1031
if dt is None:
923
1032
return dbus.String("", variant_level = variant_level)
925
1034
variant_level=variant_level)
926
1035
927
1036
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
929
.__metaclass__):
930
"""Applied to an empty subclass of a D-Bus object, this metaclass
931
will add additional D-Bus attributes matching a certain pattern.
1037
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1038
"""A class decorator; applied to a subclass of
1039
dbus.service.Object, it will add alternate D-Bus attributes with
1040
interface names according to the "alt_interface_names" mapping.
1041
Usage:
1042
1043
@alternate_dbus_interfaces({"org.example.Interface":
1044
"net.example.AlternateInterface"})
1045
class SampleDBusObject(dbus.service.Object):
1046
@dbus.service.method("org.example.Interface")
1047
def SampleDBusMethod():
1048
pass
1049
1050
The above "SampleDBusMethod" on "SampleDBusObject" will be
1051
reachable via two interfaces: "org.example.Interface" and
1052
"net.example.AlternateInterface", the latter of which will have
1053
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1054
"true", unless "deprecate" is passed with a False value.
1055
1056
This works for methods and signals, and also for D-Bus properties
1057
(from DBusObjectWithProperties) and interfaces (from the
1058
dbus_interface_annotations decorator).
932
1059
"""
933
def __new__(mcs, name, bases, attr):
934
# Go through all the base classes which could have D-Bus
935
# methods, signals, or properties in them
936
for base in (b for b in bases
937
if issubclass(b, dbus.service.Object)):
938
# Go though all attributes of the base class
939
for attrname, attribute in inspect.getmembers(base):
1060
def wrapper(cls):
1061
for orig_interface_name, alt_interface_name in (
1062
alt_interface_names.items()):
1063
attr = {}
1064
interface_names = set()
1065
# Go though all attributes of the class
1066
for attrname, attribute in inspect.getmembers(cls):
940
1067
# Ignore non-D-Bus attributes, and D-Bus attributes
941
1068
# with the wrong interface name
942
1069
if (not hasattr(attribute, "_dbus_interface")
943
1070
or not attribute._dbus_interface
944
.startswith("se.recompile.Mandos")):
1071
.startswith(orig_interface_name)):
945
1072
continue
946
1073
# Create an alternate D-Bus interface name based on
947
1074
# the current name
948
1075
alt_interface = (attribute._dbus_interface
949
.replace("se.recompile.Mandos",
950
"se.bsnet.fukt.Mandos"))
1076
.replace(orig_interface_name,
1077
alt_interface_name))
1078
interface_names.add(alt_interface)
951
1079
# Is this a D-Bus signal?
952
1080
if getattr(attribute, "_dbus_is_signal", False):
953
# Extract the original non-method function by
954
# black magic
1081
# Extract the original non-method undecorated
1082
# function by black magic
955
1083
nonmethod_func = (dict(
956
1084
zip(attribute.func_code.co_freevars,
957
1085
attribute.__closure__))["func"]
968
1096
nonmethod_func.func_name,
969
1097
nonmethod_func.func_defaults,
970
1098
nonmethod_func.func_closure)))
1099
# Copy annotations, if any
1100
try:
1101
new_function._dbus_annotations = (
1102
dict(attribute._dbus_annotations))
1103
except AttributeError:
1104
pass
971
1105
# Define a creator of a function to call both the
972
# old and new functions, so both the old and new
973
# signals gets sent when the function is called
1106
# original and alternate functions, so both the
1107
# original and alternate signals gets sent when
1108
# the function is called
974
1109
def fixscope(func1, func2):
975
1110
"""This function is a scope container to pass
976
1111
func1 and func2 to the "call_both" function
983
1118
return call_both
984
1119
# Create the "call_both" function and add it to
985
1120
# the class
986
attr[attrname] = fixscope(attribute,
987
new_function)
1121
attr[attrname] = fixscope(attribute, new_function)
988
1122
# Is this a D-Bus method?
989
1123
elif getattr(attribute, "_dbus_is_method", False):
990
1124
# Create a new, but exactly alike, function
1001
1135
attribute.func_name,
1002
1136
attribute.func_defaults,
1003
1137
attribute.func_closure)))
1138
# Copy annotations, if any
1139
try:
1140
attr[attrname]._dbus_annotations = (
1141
dict(attribute._dbus_annotations))
1142
except AttributeError:
1143
pass
1004
1144
# Is this a D-Bus property?
1005
1145
elif getattr(attribute, "_dbus_is_property", False):
1006
1146
# Create a new, but exactly alike, function
1020
1160
attribute.func_name,
1021
1161
attribute.func_defaults,
1022
1162
attribute.func_closure)))
1023
return type.__new__(mcs, name, bases, attr)
1024
1025
1163
# Copy annotations, if any
1164
try:
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1167
except AttributeError:
1168
pass
1169
# Is this a D-Bus interface?
1170
elif getattr(attribute, "_dbus_is_interface", False):
1171
# Create a new, but exactly alike, function
1172
# object. Decorate it to be a new D-Bus interface
1173
# with the alternate D-Bus interface name. Add it
1174
# to the class.
1175
attr[attrname] = (dbus_interface_annotations
1176
(alt_interface)
1177
(types.FunctionType
1178
(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1183
if deprecate:
1184
# Deprecate all alternate interfaces
1185
iname="_AlternateDBusNames_interface_annotation{}"
1186
for interface_name in interface_names:
1187
@dbus_interface_annotations(interface_name)
1188
def func(self):
1189
return { "org.freedesktop.DBus.Deprecated":
1190
"true" }
1191
# Find an unused name
1192
for aname in (iname.format(i)
1193
for i in itertools.count()):
1194
if aname not in attr:
1195
attr[aname] = func
1196
break
1197
if interface_names:
1198
# Replace the class with a new subclass of it with
1199
# methods, signals, etc. as created above.
1200
cls = type(b"{}Alternate".format(cls.__name__),
1201
(cls,), attr)
1202
return cls
1203
return wrapper
1204
1205
1206
@alternate_dbus_interfaces({"se.recompile.Mandos":
1207
"se.bsnet.fukt.Mandos"})
1026
1208
class ClientDBus(Client, DBusObjectWithProperties):
1027
1209
"""A Client class using D-Bus
1028
1210
1039
1221
def __init__(self, bus = None, *args, **kwargs):
1040
1222
self.bus = bus
1041
1223
Client.__init__(self, *args, **kwargs)
1042
self._approvals_pending = 0
1043
1044
self._approvals_pending = 0
1045
1224
# Only now, when this client is initialized, can it show up on
1046
1225
# the D-Bus
1047
1226
client_object_name = unicode(self.name).translate(
1051
1230
("/clients/" + client_object_name))
1052
1231
DBusObjectWithProperties.__init__(self, self.bus,
1053
1232
self.dbus_object_path)
1054
1233
1055
1234
def notifychangeproperty(transform_func,
1056
1235
dbus_name, type_func=lambda x: x,
1057
1236
variant_level=1):
1065
1244
to the D-Bus. Default: no transform
1066
1245
variant_level: D-Bus variant level. Default: 1
1067
1246
"""
1068
attrname = "_{0}".format(dbus_name)
1247
attrname = "_{}".format(dbus_name)
1069
1248
def setter(self, value):
1070
1249
if hasattr(self, "dbus_object_path"):
1071
1250
if (not hasattr(self, attrname) or
1080
1259
1081
1260
return property(lambda self: getattr(self, attrname), setter)
1082
1261
1083
1084
1262
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1085
1263
approvals_pending = notifychangeproperty(dbus.Boolean,
1086
1264
"ApprovalPending",
1093
1271
checker is not None)
1094
1272
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1095
1273
"LastCheckedOK")
1274
last_checker_status = notifychangeproperty(dbus.Int16,
1275
"LastCheckerStatus")
1096
1276
last_approval_request = notifychangeproperty(
1097
1277
datetime_to_dbus, "LastApprovalRequest")
1098
1278
approved_by_default = notifychangeproperty(dbus.Boolean,
1100
1280
approval_delay = notifychangeproperty(dbus.UInt64,
1101
1281
"ApprovalDelay",
1102
1282
type_func =
1103
timedelta_to_milliseconds)
1283
lambda td: td.total_seconds()
1284
* 1000)
1104
1285
approval_duration = notifychangeproperty(
1105
1286
dbus.UInt64, "ApprovalDuration",
1106
type_func = timedelta_to_milliseconds)
1287
type_func = lambda td: td.total_seconds() * 1000)
1107
1288
host = notifychangeproperty(dbus.String, "Host")
1108
1289
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1109
type_func =
1110
timedelta_to_milliseconds)
1290
type_func = lambda td:
1291
td.total_seconds() * 1000)
1111
1292
extended_timeout = notifychangeproperty(
1112
1293
dbus.UInt64, "ExtendedTimeout",
1113
type_func = timedelta_to_milliseconds)
1294
type_func = lambda td: td.total_seconds() * 1000)
1114
1295
interval = notifychangeproperty(dbus.UInt64,
1115
1296
"Interval",
1116
1297
type_func =
1117
timedelta_to_milliseconds)
1298
lambda td: td.total_seconds()
1299
* 1000)
1118
1300
checker_command = notifychangeproperty(dbus.String, "Checker")
1119
1301
1120
1302
del notifychangeproperty
1148
1330
*args, **kwargs)
1149
1331
1150
1332
def start_checker(self, *args, **kwargs):
1151
old_checker = self.checker
1152
if self.checker is not None:
1153
old_checker_pid = self.checker.pid
1154
else:
1155
old_checker_pid = None
1333
old_checker_pid = getattr(self.checker, "pid", None)
1156
1334
r = Client.start_checker(self, *args, **kwargs)
1157
1335
# Only if new checker process was started
1158
1336
if (self.checker is not None
1166
1344
return False
1167
1345
1168
1346
def approve(self, value=True):
1169
self.send_changedstate()
1170
1347
self.approved = value
1171
gobject.timeout_add(timedelta_to_milliseconds
1172
(self.approval_duration),
1173
self._reset_approved)
1174
1348
gobject.timeout_add(int(self.approval_duration.total_seconds()
1349
* 1000), self._reset_approved)
1350
self.send_changedstate()
1175
1351
1176
1352
## D-Bus methods, signals & properties
1177
1353
_interface = "se.recompile.Mandos.Client"
1178
1354
1355
## Interfaces
1356
1357
@dbus_interface_annotations(_interface)
1358
def _foo(self):
1359
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1360
"false"}
1361
1179
1362
## Signals
1180
1363
1181
1364
# CheckerCompleted - signal
1217
1400
"D-Bus signal"
1218
1401
return self.need_approval()
1219
1402
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1223
"""D-Bus signal
1224
Is sent after a client request a password.
1225
"""
1226
pass
1227
1228
1403
## Methods
1229
1404
1230
1405
# Approve - method
1280
1455
access="readwrite")
1281
1456
def ApprovalDelay_dbus_property(self, value=None):
1282
1457
if value is None: # get
1283
return dbus.UInt64(self.approval_delay_milliseconds())
1458
return dbus.UInt64(self.approval_delay.total_seconds()
1459
* 1000)
1284
1460
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1285
1461
1286
1462
# ApprovalDuration - property
1288
1464
access="readwrite")
1289
1465
def ApprovalDuration_dbus_property(self, value=None):
1290
1466
if value is None: # get
1291
return dbus.UInt64(timedelta_to_milliseconds(
1292
self.approval_duration))
1467
return dbus.UInt64(self.approval_duration.total_seconds()
1468
* 1000)
1293
1469
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1294
1470
1295
1471
# Name - property
1340
1516
return
1341
1517
return datetime_to_dbus(self.last_checked_ok)
1342
1518
1519
# LastCheckerStatus - property
1520
@dbus_service_property(_interface, signature="n",
1521
access="read")
1522
def LastCheckerStatus_dbus_property(self):
1523
return dbus.Int16(self.last_checker_status)
1524
1343
1525
# Expires - property
1344
1526
@dbus_service_property(_interface, signature="s", access="read")
1345
1527
def Expires_dbus_property(self):
1355
1537
access="readwrite")
1356
1538
def Timeout_dbus_property(self, value=None):
1357
1539
if value is None: # get
1358
return dbus.UInt64(self.timeout_milliseconds())
1540
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1541
old_timeout = self.timeout
1359
1542
self.timeout = datetime.timedelta(0, 0, 0, value)
1360
if getattr(self, "disable_initiator_tag", None) is None:
1361
return
1362
# Reschedule timeout
1363
gobject.source_remove(self.disable_initiator_tag)
1364
self.disable_initiator_tag = None
1365
self.expires = None
1366
time_to_die = timedelta_to_milliseconds((self
1367
.last_checked_ok
1368
+ self.timeout)
1369
- datetime.datetime
1370
.utcnow())
1371
if time_to_die <= 0:
1372
# The timeout has passed
1373
self.disable()
1374
else:
1375
self.expires = (datetime.datetime.utcnow()
1376
+ datetime.timedelta(milliseconds =
1377
time_to_die))
1378
self.disable_initiator_tag = (gobject.timeout_add
1379
(time_to_die, self.disable))
1543
# Reschedule disabling
1544
if self.enabled:
1545
now = datetime.datetime.utcnow()
1546
self.expires += self.timeout - old_timeout
1547
if self.expires <= now:
1548
# The timeout has passed
1549
self.disable()
1550
else:
1551
if (getattr(self, "disable_initiator_tag", None)
1552
is None):
1553
return
1554
gobject.source_remove(self.disable_initiator_tag)
1555
self.disable_initiator_tag = (
1556
gobject.timeout_add(
1557
int((self.expires - now).total_seconds()
1558
* 1000), self.disable))
1380
1559
1381
1560
# ExtendedTimeout - property
1382
1561
@dbus_service_property(_interface, signature="t",
1383
1562
access="readwrite")
1384
1563
def ExtendedTimeout_dbus_property(self, value=None):
1385
1564
if value is None: # get
1386
return dbus.UInt64(self.extended_timeout_milliseconds())
1565
return dbus.UInt64(self.extended_timeout.total_seconds()
1566
* 1000)
1387
1567
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1388
1568
1389
1569
# Interval - property
1391
1571
access="readwrite")
1392
1572
def Interval_dbus_property(self, value=None):
1393
1573
if value is None: # get
1394
return dbus.UInt64(self.interval_milliseconds())
1574
return dbus.UInt64(self.interval.total_seconds() * 1000)
1395
1575
self.interval = datetime.timedelta(0, 0, 0, value)
1396
1576
if getattr(self, "checker_initiator_tag", None) is None:
1397
1577
return
1430
1610
@dbus_service_property(_interface, signature="ay",
1431
1611
access="write", byte_arrays=True)
1432
1612
def Secret_dbus_property(self, value):
1433
self.secret = str(value)
1613
self.secret = bytes(value)
1434
1614
1435
1615
del _interface
1436
1616
1461
1641
self._pipe.send(('setattr', name, value))
1462
1642
1463
1643
1464
class ClientDBusTransitional(ClientDBus):
1465
__metaclass__ = AlternateDBusNamesMetaclass
1466
1467
1468
1644
class ClientHandler(socketserver.BaseRequestHandler, object):
1469
1645
"""A class to handle client connections.
1470
1646
1506
1682
logger.debug("Protocol version: %r", line)
1507
1683
try:
1508
1684
if int(line.strip().split()[0]) > 1:
1509
raise RuntimeError
1685
raise RuntimeError(line)
1510
1686
except (ValueError, IndexError, RuntimeError) as error:
1511
1687
logger.error("Unknown protocol version: %s", error)
1512
1688
return
1538
1714
except KeyError:
1539
1715
return
1540
1716
1541
if self.server.use_dbus:
1542
# Emit D-Bus signal
1543
client.NewRequest(str(self.client_address))
1544
1545
1717
if client.approval_delay:
1546
1718
delay = client.approval_delay
1547
1719
client.approvals_pending += 1
1565
1737
if self.server.use_dbus:
1566
1738
# Emit D-Bus signal
1567
1739
client.NeedApproval(
1568
client.approval_delay_milliseconds(),
1569
client.approved_by_default)
1740
client.approval_delay.total_seconds()
1741
* 1000, client.approved_by_default)
1570
1742
else:
1571
1743
logger.warning("Client %s was not approved",
1572
1744
client.name)
1578
1750
#wait until timeout or approved
1579
1751
time = datetime.datetime.now()
1580
1752
client.changedstate.acquire()
1581
(client.changedstate.wait
1582
(float(client.timedelta_to_milliseconds(delay)
1583
/ 1000)))
1753
client.changedstate.wait(delay.total_seconds())
1584
1754
client.changedstate.release()
1585
1755
time2 = datetime.datetime.now()
1586
1756
if (time2 - time) >= delay:
1602
1772
try:
1603
1773
sent = session.send(client.secret[sent_size:])
1604
1774
except gnutls.errors.GNUTLSError as error:
1605
logger.warning("gnutls send failed")
1775
logger.warning("gnutls send failed",
1776
exc_info=error)
1606
1777
return
1607
1778
logger.debug("Sent: %d, remaining: %d",
1608
1779
sent, len(client.secret)
1611
1782
1612
1783
logger.info("Sending secret to %s", client.name)
1613
1784
# bump the timeout using extended_timeout
1614
client.checked_ok(client.extended_timeout)
1785
client.bump_timeout(client.extended_timeout)
1615
1786
if self.server.use_dbus:
1616
1787
# Emit D-Bus signal
1617
1788
client.GotSecret()
1622
1793
try:
1623
1794
session.bye()
1624
1795
except gnutls.errors.GNUTLSError as error:
1625
logger.warning("GnuTLS bye failed")
1796
logger.warning("GnuTLS bye failed",
1797
exc_info=error)
1626
1798
1627
1799
@staticmethod
1628
1800
def peer_certificate(session):
1700
1872
def process_request(self, request, address):
1701
1873
"""Start a new process to process the request."""
1702
1874
proc = multiprocessing.Process(target = self.sub_process_main,
1703
args = (request,
1704
address))
1875
args = (request, address))
1705
1876
proc.start()
1706
1877
return proc
1707
1878
1722
1893
1723
1894
def add_pipe(self, parent_pipe, proc):
1724
1895
"""Dummy function; override as necessary"""
1725
raise NotImplementedError
1896
raise NotImplementedError()
1726
1897
1727
1898
1728
1899
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1735
1906
use_ipv6: Boolean; to use IPv6 or not
1736
1907
"""
1737
1908
def __init__(self, server_address, RequestHandlerClass,
1738
interface=None, use_ipv6=True):
1909
interface=None, use_ipv6=True, socketfd=None):
1910
"""If socketfd is set, use that file descriptor instead of
1911
creating a new one with socket.socket().
1912
"""
1739
1913
self.interface = interface
1740
1914
if use_ipv6:
1741
1915
self.address_family = socket.AF_INET6
1916
if socketfd is not None:
1917
# Save the file descriptor
1918
self.socketfd = socketfd
1919
# Save the original socket.socket() function
1920
self.socket_socket = socket.socket
1921
# To implement --socket, we monkey patch socket.socket.
1922
#
1923
# (When socketserver.TCPServer is a new-style class, we
1924
# could make self.socket into a property instead of monkey
1925
# patching socket.socket.)
1926
#
1927
# Create a one-time-only replacement for socket.socket()
1928
@functools.wraps(socket.socket)
1929
def socket_wrapper(*args, **kwargs):
1930
# Restore original function so subsequent calls are
1931
# not affected.
1932
socket.socket = self.socket_socket
1933
del self.socket_socket
1934
# This time only, return a new socket object from the
1935
# saved file descriptor.
1936
return socket.fromfd(self.socketfd, *args, **kwargs)
1937
# Replace socket.socket() function with wrapper
1938
socket.socket = socket_wrapper
1939
# The socketserver.TCPServer.__init__ will call
1940
# socket.socket(), which might be our replacement,
1941
# socket_wrapper(), if socketfd was set.
1742
1942
socketserver.TCPServer.__init__(self, server_address,
1743
1943
RequestHandlerClass)
1944
1744
1945
def server_bind(self):
1745
1946
"""This overrides the normal server_bind() function
1746
1947
to bind to an interface if one was specified, and also NOT to
1754
1955
try:
1755
1956
self.socket.setsockopt(socket.SOL_SOCKET,
1756
1957
SO_BINDTODEVICE,
1757
str(self.interface
1758
+ '\0'))
1958
(self.interface + "\0")
1959
.encode("utf-8"))
1759
1960
except socket.error as error:
1760
if error[0] == errno.EPERM:
1761
logger.error("No permission to"
1762
" bind to interface %s",
1763
self.interface)
1764
elif error[0] == errno.ENOPROTOOPT:
1961
if error.errno == errno.EPERM:
1962
logger.error("No permission to bind to"
1963
" interface %s", self.interface)
1964
elif error.errno == errno.ENOPROTOOPT:
1765
1965
logger.error("SO_BINDTODEVICE not available;"
1766
1966
" cannot bind to interface %s",
1767
1967
self.interface)
1968
elif error.errno == errno.ENODEV:
1969
logger.error("Interface %s does not exist,"
1970
" cannot bind", self.interface)
1768
1971
else:
1769
1972
raise
1770
1973
# Only bind(2) the socket if we really need to.
1773
1976
if self.address_family == socket.AF_INET6:
1774
1977
any_address = "::" # in6addr_any
1775
1978
else:
1776
any_address = socket.INADDR_ANY
1979
any_address = "0.0.0.0" # INADDR_ANY
1777
1980
self.server_address = (any_address,
1778
1981
self.server_address[1])
1779
1982
elif not self.server_address[1]:
1800
2003
"""
1801
2004
def __init__(self, server_address, RequestHandlerClass,
1802
2005
interface=None, use_ipv6=True, clients=None,
1803
gnutls_priority=None, use_dbus=True):
2006
gnutls_priority=None, use_dbus=True, socketfd=None):
1804
2007
self.enabled = False
1805
2008
self.clients = clients
1806
2009
if self.clients is None:
1810
2013
IPv6_TCPServer.__init__(self, server_address,
1811
2014
RequestHandlerClass,
1812
2015
interface = interface,
1813
use_ipv6 = use_ipv6)
2016
use_ipv6 = use_ipv6,
2017
socketfd = socketfd)
1814
2018
def server_activate(self):
1815
2019
if self.enabled:
1816
2020
return socketserver.TCPServer.server_activate(self)
1829
2033
1830
2034
def handle_ipc(self, source, condition, parent_pipe=None,
1831
2035
proc = None, client_object=None):
1832
condition_names = {
1833
gobject.IO_IN: "IN", # There is data to read.
1834
gobject.IO_OUT: "OUT", # Data can be written (without
1835
# blocking).
1836
gobject.IO_PRI: "PRI", # There is urgent data to read.
1837
gobject.IO_ERR: "ERR", # Error condition.
1838
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1839
# broken, usually for pipes and
1840
# sockets).
1841
}
1842
conditions_string = ' | '.join(name
1843
for cond, name in
1844
condition_names.iteritems()
1845
if cond & condition)
1846
2036
# error, or the other end of multiprocessing.Pipe has closed
1847
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2037
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1848
2038
# Wait for other process to exit
1849
2039
proc.join()
1850
2040
return False
1908
2098
return True
1909
2099
1910
2100
2101
def rfc3339_duration_to_delta(duration):
2102
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2103
2104
>>> rfc3339_duration_to_delta("P7D")
2105
datetime.timedelta(7)
2106
>>> rfc3339_duration_to_delta("PT60S")
2107
datetime.timedelta(0, 60)
2108
>>> rfc3339_duration_to_delta("PT60M")
2109
datetime.timedelta(0, 3600)
2110
>>> rfc3339_duration_to_delta("PT24H")
2111
datetime.timedelta(1)
2112
>>> rfc3339_duration_to_delta("P1W")
2113
datetime.timedelta(7)
2114
>>> rfc3339_duration_to_delta("PT5M30S")
2115
datetime.timedelta(0, 330)
2116
>>> rfc3339_duration_to_delta("P1DT3M20S")
2117
datetime.timedelta(1, 200)
2118
"""
2119
2120
# Parsing an RFC 3339 duration with regular expressions is not
2121
# possible - there would have to be multiple places for the same
2122
# values, like seconds. The current code, while more esoteric, is
2123
# cleaner without depending on a parsing library. If Python had a
2124
# built-in library for parsing we would use it, but we'd like to
2125
# avoid excessive use of external libraries.
2126
2127
# New type for defining tokens, syntax, and semantics all-in-one
2128
Token = collections.namedtuple("Token",
2129
("regexp", # To match token; if
2130
# "value" is not None,
2131
# must have a "group"
2132
# containing digits
2133
"value", # datetime.timedelta or
2134
# None
2135
"followers")) # Tokens valid after
2136
# this token
2137
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2138
# the "duration" ABNF definition in RFC 3339, Appendix A.
2139
token_end = Token(re.compile(r"$"), None, frozenset())
2140
token_second = Token(re.compile(r"(\d+)S"),
2141
datetime.timedelta(seconds=1),
2142
frozenset((token_end,)))
2143
token_minute = Token(re.compile(r"(\d+)M"),
2144
datetime.timedelta(minutes=1),
2145
frozenset((token_second, token_end)))
2146
token_hour = Token(re.compile(r"(\d+)H"),
2147
datetime.timedelta(hours=1),
2148
frozenset((token_minute, token_end)))
2149
token_time = Token(re.compile(r"T"),
2150
None,
2151
frozenset((token_hour, token_minute,
2152
token_second)))
2153
token_day = Token(re.compile(r"(\d+)D"),
2154
datetime.timedelta(days=1),
2155
frozenset((token_time, token_end)))
2156
token_month = Token(re.compile(r"(\d+)M"),
2157
datetime.timedelta(weeks=4),
2158
frozenset((token_day, token_end)))
2159
token_year = Token(re.compile(r"(\d+)Y"),
2160
datetime.timedelta(weeks=52),
2161
frozenset((token_month, token_end)))
2162
token_week = Token(re.compile(r"(\d+)W"),
2163
datetime.timedelta(weeks=1),
2164
frozenset((token_end,)))
2165
token_duration = Token(re.compile(r"P"), None,
2166
frozenset((token_year, token_month,
2167
token_day, token_time,
2168
token_week)))
2169
# Define starting values
2170
value = datetime.timedelta() # Value so far
2171
found_token = None
2172
followers = frozenset((token_duration,)) # Following valid tokens
2173
s = duration # String left to parse
2174
# Loop until end token is found
2175
while found_token is not token_end:
2176
# Search for any currently valid tokens
2177
for token in followers:
2178
match = token.regexp.match(s)
2179
if match is not None:
2180
# Token found
2181
if token.value is not None:
2182
# Value found, parse digits
2183
factor = int(match.group(1), 10)
2184
# Add to value so far
2185
value += factor * token.value
2186
# Strip token from string
2187
s = token.regexp.sub("", s, 1)
2188
# Go to found token
2189
found_token = token
2190
# Set valid next tokens
2191
followers = found_token.followers
2192
break
2193
else:
2194
# No currently valid tokens were found
2195
raise ValueError("Invalid RFC 3339 duration")
2196
# End token found
2197
return value
2198
2199
1911
2200
def string_to_delta(interval):
1912
2201
"""Parse a string and return a datetime.timedelta
1913
2202
1924
2213
>>> string_to_delta('5m 30s')
1925
2214
datetime.timedelta(0, 330)
1926
2215
"""
2216
2217
try:
2218
return rfc3339_duration_to_delta(interval)
2219
except ValueError:
2220
pass
2221
1927
2222
timevalue = datetime.timedelta(0)
1928
2223
for s in interval.split():
1929
2224
try:
1930
suffix = unicode(s[-1])
2225
suffix = s[-1]
1931
2226
value = int(s[:-1])
1932
2227
if suffix == "d":
1933
2228
delta = datetime.timedelta(value)
1940
2235
elif suffix == "w":
1941
2236
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1942
2237
else:
1943
raise ValueError("Unknown suffix %r" % suffix)
1944
except (ValueError, IndexError) as e:
2238
raise ValueError("Unknown suffix {!r}"
2239
.format(suffix))
2240
except IndexError as e:
1945
2241
raise ValueError(*(e.args))
1946
2242
timevalue += delta
1947
2243
return timevalue
1960
2256
sys.exit()
1961
2257
if not noclose:
1962
2258
# Close all standard open file descriptors
1963
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2259
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1964
2260
if not stat.S_ISCHR(os.fstat(null).st_mode):
1965
raise OSError(errno.ENODEV,
1966
"%s not a character device"
1967
% os.path.devnull)
2261
raise OSError(errno.ENODEV, "{} not a character device"
2262
.format(os.devnull))
1968
2263
os.dup2(null, sys.stdin.fileno())
1969
2264
os.dup2(null, sys.stdout.fileno())
1970
2265
os.dup2(null, sys.stderr.fileno())
1979
2274
1980
2275
parser = argparse.ArgumentParser()
1981
2276
parser.add_argument("-v", "--version", action="version",
1982
version = "%%(prog)s %s" % version,
2277
version = "%(prog)s {}".format(version),
1983
2278
help="show version number and exit")
1984
2279
parser.add_argument("-i", "--interface", metavar="IF",
1985
2280
help="Bind to interface IF")
1991
2286
help="Run self-test")
1992
2287
parser.add_argument("--debug", action="store_true",
1993
2288
help="Debug mode; run in foreground and log"
1994
" to terminal")
2289
" to terminal", default=None)
1995
2290
parser.add_argument("--debuglevel", metavar="LEVEL",
1996
2291
help="Debug level for stdout output")
1997
2292
parser.add_argument("--priority", help="GnuTLS"
2004
2299
" files")
2005
2300
parser.add_argument("--no-dbus", action="store_false",
2006
2301
dest="use_dbus", help="Do not provide D-Bus"
2007
" system bus interface")
2302
" system bus interface", default=None)
2008
2303
parser.add_argument("--no-ipv6", action="store_false",
2009
dest="use_ipv6", help="Do not use IPv6")
2304
dest="use_ipv6", help="Do not use IPv6",
2305
default=None)
2010
2306
parser.add_argument("--no-restore", action="store_false",
2011
2307
dest="restore", help="Do not restore stored"
2012
" state")
2308
" state", default=None)
2309
parser.add_argument("--socket", type=int,
2310
help="Specify a file descriptor to a network"
2311
" socket to use instead of creating one")
2013
2312
parser.add_argument("--statedir", metavar="DIR",
2014
2313
help="Directory to save/restore state in")
2314
parser.add_argument("--foreground", action="store_true",
2315
help="Run in foreground", default=None)
2316
parser.add_argument("--no-zeroconf", action="store_false",
2317
dest="zeroconf", help="Do not use Zeroconf",
2318
default=None)
2015
2319
2016
2320
options = parser.parse_args()
2017
2321
2018
2322
if options.check:
2019
2323
import doctest
2020
doctest.testmod()
2021
sys.exit()
2324
fail_count, test_count = doctest.testmod()
2325
sys.exit(os.EX_OK if fail_count == 0 else 1)
2022
2326
2023
2327
# Default values for config file for server-global settings
2024
2328
server_defaults = { "interface": "",
2026
2330
"port": "",
2027
2331
"debug": "False",
2028
2332
"priority":
2029
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2333
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2030
2334
"servicename": "Mandos",
2031
2335
"use_dbus": "True",
2032
2336
"use_ipv6": "True",
2033
2337
"debuglevel": "",
2034
2338
"restore": "True",
2035
"statedir": "/var/lib/mandos"
2339
"socket": "",
2340
"statedir": "/var/lib/mandos",
2341
"foreground": "False",
2342
"zeroconf": "True",
2036
2343
}
2037
2344
2038
2345
# Parse config file for server-global settings
2043
2350
# Convert the SafeConfigParser object to a dict
2044
2351
server_settings = server_config.defaults()
2045
2352
# Use the appropriate methods on the non-string config options
2046
for option in ("debug", "use_dbus", "use_ipv6"):
2353
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2047
2354
server_settings[option] = server_config.getboolean("DEFAULT",
2048
2355
option)
2049
2356
if server_settings["port"]:
2050
2357
server_settings["port"] = server_config.getint("DEFAULT",
2051
2358
"port")
2359
if server_settings["socket"]:
2360
server_settings["socket"] = server_config.getint("DEFAULT",
2361
"socket")
2362
# Later, stdin will, and stdout and stderr might, be dup'ed
2363
# over with an opened os.devnull. But we don't want this to
2364
# happen with a supplied network socket.
2365
if 0 <= server_settings["socket"] <= 2:
2366
server_settings["socket"] = os.dup(server_settings
2367
["socket"])
2052
2368
del server_config
2053
2369
2054
2370
# Override the settings from the config file with command line
2056
2372
for option in ("interface", "address", "port", "debug",
2057
2373
"priority", "servicename", "configdir",
2058
2374
"use_dbus", "use_ipv6", "debuglevel", "restore",
2059
"statedir"):
2375
"statedir", "socket", "foreground", "zeroconf"):
2060
2376
value = getattr(options, option)
2061
2377
if value is not None:
2062
2378
server_settings[option] = value
2063
2379
del options
2064
2380
# Force all strings to be unicode
2065
2381
for option in server_settings.keys():
2066
if type(server_settings[option]) is str:
2067
server_settings[option] = unicode(server_settings[option])
2382
if isinstance(server_settings[option], bytes):
2383
server_settings[option] = (server_settings[option]
2384
.decode("utf-8"))
2385
# Force all boolean options to be boolean
2386
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2387
"foreground", "zeroconf"):
2388
server_settings[option] = bool(server_settings[option])
2389
# Debug implies foreground
2390
if server_settings["debug"]:
2391
server_settings["foreground"] = True
2068
2392
# Now we have our good server settings in "server_settings"
2069
2393
2070
2394
##################################################################
2071
2395
2396
if (not server_settings["zeroconf"] and
2397
not (server_settings["port"]
2398
or server_settings["socket"] != "")):
2399
parser.error("Needs port or socket to work without"
2400
" Zeroconf")
2401
2072
2402
# For convenience
2073
2403
debug = server_settings["debug"]
2074
2404
debuglevel = server_settings["debuglevel"]
2076
2406
use_ipv6 = server_settings["use_ipv6"]
2077
2407
stored_state_path = os.path.join(server_settings["statedir"],
2078
2408
stored_state_file)
2409
foreground = server_settings["foreground"]
2410
zeroconf = server_settings["zeroconf"]
2079
2411
2080
2412
if debug:
2081
initlogger(logging.DEBUG)
2413
initlogger(debug, logging.DEBUG)
2082
2414
else:
2083
2415
if not debuglevel:
2084
initlogger()
2416
initlogger(debug)
2085
2417
else:
2086
2418
level = getattr(logging, debuglevel.upper())
2087
initlogger(level)
2419
initlogger(debug, level)
2088
2420
2089
2421
if server_settings["servicename"] != "Mandos":
2090
2422
syslogger.setFormatter(logging.Formatter
2091
('Mandos (%s) [%%(process)d]:'
2092
' %%(levelname)s: %%(message)s'
2093
% server_settings["servicename"]))
2423
('Mandos ({}) [%(process)d]:'
2424
' %(levelname)s: %(message)s'
2425
.format(server_settings
2426
["servicename"])))
2094
2427
2095
2428
# Parse config file with clients
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
2429
client_config = configparser.SafeConfigParser(Client
2430
.client_defaults)
2097
2431
client_config.read(os.path.join(server_settings["configdir"],
2098
2432
"clients.conf"))
2099
2433
2100
2434
global mandos_dbus_service
2101
2435
mandos_dbus_service = None
2102
2436
2437
socketfd = None
2438
if server_settings["socket"] != "":
2439
socketfd = server_settings["socket"]
2103
2440
tcp_server = MandosServer((server_settings["address"],
2104
2441
server_settings["port"]),
2105
2442
ClientHandler,
2108
2445
use_ipv6=use_ipv6,
2109
2446
gnutls_priority=
2110
2447
server_settings["priority"],
2111
use_dbus=use_dbus)
2112
if not debug:
2113
pidfilename = "/var/run/mandos.pid"
2448
use_dbus=use_dbus,
2449
socketfd=socketfd)
2450
if not foreground:
2451
pidfilename = "/run/mandos.pid"
2452
if not os.path.isdir("/run/."):
2453
pidfilename = "/var/run/mandos.pid"
2454
pidfile = None
2114
2455
try:
2115
2456
pidfile = open(pidfilename, "w")
2116
except IOError:
2117
logger.error("Could not open file %r", pidfilename)
2457
except IOError as e:
2458
logger.error("Could not open file %r", pidfilename,
2459
exc_info=e)
2118
2460
2119
try:
2120
uid = pwd.getpwnam("_mandos").pw_uid
2121
gid = pwd.getpwnam("_mandos").pw_gid
2122
except KeyError:
2461
for name in ("_mandos", "mandos", "nobody"):
2123
2462
try:
2124
uid = pwd.getpwnam("mandos").pw_uid
2125
gid = pwd.getpwnam("mandos").pw_gid
2463
uid = pwd.getpwnam(name).pw_uid
2464
gid = pwd.getpwnam(name).pw_gid
2465
break
2126
2466
except KeyError:
2127
try:
2128
uid = pwd.getpwnam("nobody").pw_uid
2129
gid = pwd.getpwnam("nobody").pw_gid
2130
except KeyError:
2131
uid = 65534
2132
gid = 65534
2467
continue
2468
else:
2469
uid = 65534
2470
gid = 65534
2133
2471
try:
2134
2472
os.setgid(gid)
2135
2473
os.setuid(uid)
2136
2474
except OSError as error:
2137
if error[0] != errno.EPERM:
2138
raise error
2475
if error.errno != errno.EPERM:
2476
raise
2139
2477
2140
2478
if debug:
2141
2479
# Enable all possible GnuTLS debugging
2152
2490
.gnutls_global_set_log_function(debug_gnutls))
2153
2491
2154
2492
# Redirect stdin so all checkers get /dev/null
2155
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2493
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2156
2494
os.dup2(null, sys.stdin.fileno())
2157
2495
if null > 2:
2158
2496
os.close(null)
2159
else:
2160
# No console logging
2161
logger.removeHandler(console)
2162
2497
2163
2498
# Need to fork before connecting to D-Bus
2164
if not debug:
2499
if not foreground:
2165
2500
# Close all input and output, do double fork, etc.
2166
2501
daemon()
2167
2502
2503
# multiprocessing will use threads, so before we use gobject we
2504
# need to inform gobject that threads will be used.
2505
gobject.threads_init()
2506
2168
2507
global main_loop
2169
2508
# From the Avahi example code
2170
DBusGMainLoop(set_as_default=True )
2509
DBusGMainLoop(set_as_default=True)
2171
2510
main_loop = gobject.MainLoop()
2172
2511
bus = dbus.SystemBus()
2173
2512
# End of Avahi example code
2179
2518
("se.bsnet.fukt.Mandos", bus,
2180
2519
do_not_queue=True))
2181
2520
except dbus.exceptions.NameExistsException as e:
2182
logger.error(unicode(e) + ", disabling D-Bus")
2521
logger.error("Disabling D-Bus:", exc_info=e)
2183
2522
use_dbus = False
2184
2523
server_settings["use_dbus"] = False
2185
2524
tcp_server.use_dbus = False
2186
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2187
service = AvahiServiceToSyslog(name =
2188
server_settings["servicename"],
2189
servicetype = "_mandos._tcp",
2190
protocol = protocol, bus = bus)
2191
if server_settings["interface"]:
2192
service.interface = (if_nametoindex
2193
(str(server_settings["interface"])))
2525
if zeroconf:
2526
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2527
service = AvahiServiceToSyslog(name =
2528
server_settings["servicename"],
2529
servicetype = "_mandos._tcp",
2530
protocol = protocol, bus = bus)
2531
if server_settings["interface"]:
2532
service.interface = (if_nametoindex
2533
(server_settings["interface"]
2534
.encode("utf-8")))
2194
2535
2195
2536
global multiprocessing_manager
2196
2537
multiprocessing_manager = multiprocessing.Manager()
2197
2538
2198
2539
client_class = Client
2199
2540
if use_dbus:
2200
client_class = functools.partial(ClientDBusTransitional,
2201
bus = bus)
2541
client_class = functools.partial(ClientDBus, bus = bus)
2202
2542
2203
2543
client_settings = Client.config_parser(client_config)
2204
2544
old_client_settings = {}
2205
2545
clients_data = {}
2206
2546
2547
# This is used to redirect stdout and stderr for checker processes
2548
global wnull
2549
wnull = open(os.devnull, "w") # A writable /dev/null
2550
# Only used if server is running in foreground but not in debug
2551
# mode
2552
if debug or not foreground:
2553
wnull.close()
2554
2207
2555
# Get client data and settings from last running state.
2208
2556
if server_settings["restore"]:
2209
2557
try:
2212
2560
(stored_state))
2213
2561
os.remove(stored_state_path)
2214
2562
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2217
if e.errno != errno.ENOENT:
2563
if e.errno == errno.ENOENT:
2564
logger.warning("Could not load persistent state: {}"
2565
.format(os.strerror(e.errno)))
2566
else:
2567
logger.critical("Could not load persistent state:",
2568
exc_info=e)
2218
2569
raise
2570
except EOFError as e:
2571
logger.warning("Could not load persistent state: "
2572
"EOFError:", exc_info=e)
2219
2573
2220
2574
with PGPEngine() as pgp:
2221
for client_name, client in clients_data.iteritems():
2575
for client_name, client in clients_data.items():
2576
# Skip removed clients
2577
if client_name not in client_settings:
2578
continue
2579
2222
2580
# Decide which value to use after restoring saved state.
2223
2581
# We have three different values: Old config file,
2224
2582
# new config file, and saved state.
2238
2596
2239
2597
# Clients who has passed its expire date can still be
2240
2598
# enabled if its last checker was successful. Clients
2241
# whose checker failed before we stored its state is
2242
# assumed to have failed all checkers during downtime.
2599
# whose checker succeeded before we stored its state is
2600
# assumed to have successfully run all checkers during
2601
# downtime.
2243
2602
if client["enabled"]:
2244
2603
if datetime.datetime.utcnow() >= client["expires"]:
2245
2604
if not client["last_checked_ok"]:
2246
2605
logger.warning(
2247
"disabling client {0} - Client never "
2248
"performed a successfull checker"
2249
.format(client["name"]))
2606
"disabling client {} - Client never "
2607
"performed a successful checker"
2608
.format(client_name))
2250
2609
client["enabled"] = False
2251
2610
elif client["last_checker_status"] != 0:
2252
2611
logger.warning(
2253
"disabling client {0} - Client "
2254
"last checker failed with error code {1}"
2255
.format(client["name"],
2612
"disabling client {} - Client last"
2613
" checker failed with error code {}"
2614
.format(client_name,
2256
2615
client["last_checker_status"]))
2257
2616
client["enabled"] = False
2258
2617
else:
2259
2618
client["expires"] = (datetime.datetime
2260
2619
.utcnow()
2261
2620
+ client["timeout"])
2262
2621
logger.debug("Last checker succeeded,"
2622
" keeping {} enabled"
2623
.format(client_name))
2263
2624
try:
2264
2625
client["secret"] = (
2265
2626
pgp.decrypt(client["encrypted_secret"],
2267
2628
["secret"]))
2268
2629
except PGPError:
2269
2630
# If decryption fails, we use secret from new settings
2270
logger.debug("Failed to decrypt {0} old secret"
2631
logger.debug("Failed to decrypt {} old secret"
2271
2632
.format(client_name))
2272
2633
client["secret"] = (
2273
2634
client_settings[client_name]["secret"])
2274
2275
2635
2276
2636
# Add/remove clients based on new changes made to config
2277
for client_name in set(old_client_settings) - set(client_settings):
2637
for client_name in (set(old_client_settings)
2638
- set(client_settings)):
2278
2639
del clients_data[client_name]
2279
for client_name in set(client_settings) - set(old_client_settings):
2640
for client_name in (set(client_settings)
2641
- set(old_client_settings)):
2280
2642
clients_data[client_name] = client_settings[client_name]
2281
2282
# Create clients all clients
2283
for client_name, client in clients_data.iteritems():
2643
2644
# Create all client objects
2645
for client_name, client in clients_data.items():
2284
2646
tcp_server.clients[client_name] = client_class(
2285
name = client_name, settings = client)
2647
name = client_name, settings = client,
2648
server_settings = server_settings)
2286
2649
2287
2650
if not tcp_server.clients:
2288
2651
logger.warning("No clients defined")
2289
2290
if not debug:
2291
try:
2292
with pidfile:
2293
pid = os.getpid()
2294
pidfile.write(str(pid) + "\n".encode("utf-8"))
2295
del pidfile
2296
except IOError:
2297
logger.error("Could not write to file %r with PID %d",
2298
pidfilename, pid)
2299
except NameError:
2300
# "pidfile" was never created
2301
pass
2652
2653
if not foreground:
2654
if pidfile is not None:
2655
try:
2656
with pidfile:
2657
pid = os.getpid()
2658
pidfile.write("{}\n".format(pid).encode("utf-8"))
2659
except IOError:
2660
logger.error("Could not write to file %r with PID %d",
2661
pidfilename, pid)
2662
del pidfile
2302
2663
del pidfilename
2303
signal.signal(signal.SIGINT, signal.SIG_IGN)
2304
2664
2305
2665
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2306
2666
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2307
2667
2308
2668
if use_dbus:
2309
class MandosDBusService(dbus.service.Object):
2669
@alternate_dbus_interfaces({"se.recompile.Mandos":
2670
"se.bsnet.fukt.Mandos"})
2671
class MandosDBusService(DBusObjectWithProperties):
2310
2672
"""A D-Bus proxy object"""
2311
2673
def __init__(self):
2312
2674
dbus.service.Object.__init__(self, bus, "/")
2313
2675
_interface = "se.recompile.Mandos"
2314
2676
2677
@dbus_interface_annotations(_interface)
2678
def _foo(self):
2679
return { "org.freedesktop.DBus.Property"
2680
".EmitsChangedSignal":
2681
"false"}
2682
2315
2683
@dbus.service.signal(_interface, signature="o")
2316
2684
def ClientAdded(self, objpath):
2317
2685
"D-Bus signal"
2359
2727
2360
2728
del _interface
2361
2729
2362
class MandosDBusServiceTransitional(MandosDBusService):
2363
__metaclass__ = AlternateDBusNamesMetaclass
2364
mandos_dbus_service = MandosDBusServiceTransitional()
2730
mandos_dbus_service = MandosDBusService()
2365
2731
2366
2732
def cleanup():
2367
2733
"Cleanup function; run on exit"
2368
service.cleanup()
2734
if zeroconf:
2735
service.cleanup()
2369
2736
2370
2737
multiprocessing.active_children()
2738
wnull.close()
2371
2739
if not (tcp_server.clients or client_settings):
2372
2740
return
2373
2741
2384
2752
2385
2753
# A list of attributes that can not be pickled
2386
2754
# + secret.
2387
exclude = set(("bus", "changedstate", "secret",
2388
"checker"))
2755
exclude = { "bus", "changedstate", "secret",
2756
"checker", "server_settings" }
2389
2757
for name, typ in (inspect.getmembers
2390
2758
(dbus.service.Object)):
2391
2759
exclude.add(name)
2400
2768
del client_settings[client.name]["secret"]
2401
2769
2402
2770
try:
2403
with os.fdopen(os.open(stored_state_path,
2404
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2405
0600), "wb") as stored_state:
2771
with (tempfile.NamedTemporaryFile
2772
(mode='wb', suffix=".pickle", prefix='clients-',
2773
dir=os.path.dirname(stored_state_path),
2774
delete=False)) as stored_state:
2406
2775
pickle.dump((clients, client_settings), stored_state)
2776
tempname=stored_state.name
2777
os.rename(tempname, stored_state_path)
2407
2778
except (IOError, OSError) as e:
2408
logger.warning("Could not save persistent state: {0}"
2409
.format(e))
2410
if e.errno not in (errno.ENOENT, errno.EACCES):
2779
if not debug:
2780
try:
2781
os.remove(tempname)
2782
except NameError:
2783
pass
2784
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2785
logger.warning("Could not save persistent state: {}"
2786
.format(os.strerror(e.errno)))
2787
else:
2788
logger.warning("Could not save persistent state:",
2789
exc_info=e)
2411
2790
raise
2412
2791
2413
2792
# Delete all clients, and settings from config
2438
2817
tcp_server.server_activate()
2439
2818
2440
2819
# Find out what port we got
2441
service.port = tcp_server.socket.getsockname()[1]
2820
if zeroconf:
2821
service.port = tcp_server.socket.getsockname()[1]
2442
2822
if use_ipv6:
2443
2823
logger.info("Now listening on address %r, port %d,"
2444
" flowinfo %d, scope_id %d"
2445
% tcp_server.socket.getsockname())
2824
" flowinfo %d, scope_id %d",
2825
*tcp_server.socket.getsockname())
2446
2826
else: # IPv4
2447
logger.info("Now listening on address %r, port %d"
2448
% tcp_server.socket.getsockname())
2827
logger.info("Now listening on address %r, port %d",
2828
*tcp_server.socket.getsockname())
2449
2829
2450
2830
#service.interface = tcp_server.socket.getsockname()[3]
2451
2831
2452
2832
try:
2453
# From the Avahi example code
2454
try:
2455
service.activate()
2456
except dbus.exceptions.DBusException as error:
2457
logger.critical("DBusException: %s", error)
2458
cleanup()
2459
sys.exit(1)
2460
# End of Avahi example code
2833
if zeroconf:
2834
# From the Avahi example code
2835
try:
2836
service.activate()
2837
except dbus.exceptions.DBusException as error:
2838
logger.critical("D-Bus Exception", exc_info=error)
2839
cleanup()
2840
sys.exit(1)
2841
# End of Avahi example code
2461
2842
2462
2843
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2463
2844
lambda *args, **kwargs:
2467
2848
logger.debug("Starting main loop")
2468
2849
main_loop.run()
2469
2850
except AvahiError as error:
2470
logger.critical("AvahiError: %s", error)
2851
logger.critical("Avahi Error", exc_info=error)
2471
2852
cleanup()
2472
2853
sys.exit(1)
2473
2854
except KeyboardInterrupt:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0