To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 749.1.2
- compare with another revision
- download diff
- download tarball
- view history from revision 749.1.2
- Committer: Teddy Hogeborn
- Date: 2015-05-25 07:54:07 UTC
- mto: This revision was merged to the branch mainline in revision 756.
- Revision ID: teddy@recompile.se-20150525075407-x7u0z4f1zej6bm87
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
Generalize "subprocess_call_pipe" to "call_pipe" which takes an
additional "func" argument which is the function to be run.
Generalize "subprocess_call_pipe" to "call_pipe" which takes an
additional "func" argument which is the function to be run.
- files added:
- debian/mandos-client.examples
- debian/upstream
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
import SocketServer as socketserver
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
38
43
import socket
39
44
import argparse
40
45
import datetime
45
50
import gnutls.library.functions
46
51
import gnutls.library.constants
47
52
import gnutls.library.types
48
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
49
57
import sys
50
58
import re
51
59
import os
60
68
import struct
61
69
import fcntl
62
70
import functools
63
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
64
75
import multiprocessing
65
76
import types
66
77
import binascii
67
78
import tempfile
79
import itertools
80
import collections
68
81
69
82
import dbus
70
83
import dbus.service
71
import gobject
84
try:
85
import gobject
86
except ImportError:
87
from gi.repository import GObject as gobject
72
88
import avahi
73
89
from dbus.mainloop.glib import DBusGMainLoop
74
90
import ctypes
75
91
import ctypes.util
76
92
import xml.dom.minidom
77
93
import inspect
78
import GnuPGInterface
79
94
80
95
try:
81
96
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
100
except ImportError:
86
101
SO_BINDTODEVICE = None
87
102
88
version = "1.5.3"
103
if sys.version_info.major == 2:
104
str = unicode
105
106
version = "1.6.9"
89
107
stored_state_file = "clients.pickle"
90
108
91
109
logger = logging.getLogger()
92
syslogger = (logging.handlers.SysLogHandler
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
address = str("/dev/log")))
110
syslogger = None
95
111
96
112
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
113
if_nametoindex = ctypes.cdll.LoadLibrary(
114
ctypes.util.find_library("c")).if_nametoindex
100
115
except (OSError, AttributeError):
116
101
117
def if_nametoindex(interface):
102
118
"Get an interface index the hard way, i.e. using fcntl()"
103
119
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
120
with contextlib.closing(socket.socket()) as s:
105
121
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
122
struct.pack(b"16s16x", interface))
123
interface_index = struct.unpack("I", ifreq[16:20])[0]
110
124
return interface_index
111
125
112
126
113
127
def initlogger(debug, level=logging.WARNING):
114
128
"""init logger and add loglevel"""
115
129
130
global syslogger
131
syslogger = (logging.handlers.SysLogHandler(
132
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
address = "/dev/log"))
116
134
syslogger.setFormatter(logging.Formatter
117
135
('Mandos [%(process)d]: %(levelname)s:'
118
136
' %(message)s'))
135
153
136
154
class PGPEngine(object):
137
155
"""A simple class for OpenPGP symmetric encryption & decryption"""
156
138
157
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
158
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
159
self.gnupgargs = ['--batch',
160
'--home', self.tempdir,
161
'--force-mdc',
162
'--quiet',
163
'--no-use-agent']
147
164
148
165
def __enter__(self):
149
166
return self
150
167
151
def __exit__ (self, exc_type, exc_value, traceback):
168
def __exit__(self, exc_type, exc_value, traceback):
152
169
self._cleanup()
153
170
return False
154
171
171
188
def password_encode(self, password):
172
189
# Passphrase can not be empty and can not contain newlines or
173
190
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
191
encoded = b"mandos" + binascii.hexlify(password)
192
if len(encoded) > 2048:
193
# GnuPG can't handle long passwords, so encode differently
194
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
195
.replace(b"\n", b"\\n")
196
.replace(b"\0", b"\\x00"))
197
return encoded
175
198
176
199
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
200
passphrase = self.password_encode(password)
201
with tempfile.NamedTemporaryFile(
202
dir=self.tempdir) as passfile:
203
passfile.write(passphrase)
204
passfile.flush()
205
proc = subprocess.Popen(['gpg', '--symmetric',
206
'--passphrase-file',
207
passfile.name]
208
+ self.gnupgargs,
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
213
if proc.returncode != 0:
214
raise PGPError(err)
191
215
return ciphertext
192
216
193
217
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
218
passphrase = self.password_encode(password)
219
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
221
passfile.write(passphrase)
222
passfile.flush()
223
proc = subprocess.Popen(['gpg', '--decrypt',
224
'--passphrase-file',
225
passfile.name]
226
+ self.gnupgargs,
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
231
if proc.returncode != 0:
232
raise PGPError(err)
208
233
return decrypted_plaintext
209
234
210
235
211
212
236
class AvahiError(Exception):
213
237
def __init__(self, value, *args, **kwargs):
214
238
self.value = value
215
super(AvahiError, self).__init__(value, *args, **kwargs)
216
def __unicode__(self):
217
return unicode(repr(self.value))
239
return super(AvahiError, self).__init__(value, *args,
240
**kwargs)
241
218
242
219
243
class AvahiServiceError(AvahiError):
220
244
pass
221
245
246
222
247
class AvahiGroupError(AvahiError):
223
248
pass
224
249
231
256
Used to optionally bind to the specified interface.
232
257
name: string; Example: 'Mandos'
233
258
type: string; Example: '_mandos._tcp'.
234
See <http://www.dns-sd.org/ServiceTypes.html>
259
See <https://www.iana.org/assignments/service-names-port-numbers>
235
260
port: integer; what port to announce
236
261
TXT: list of strings; TXT record for the service
237
262
domain: string; Domain to publish on, default to .local if empty.
243
268
server: D-Bus Server
244
269
bus: dbus.SystemBus()
245
270
"""
246
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
247
servicetype = None, port = None, TXT = None,
248
domain = "", host = "", max_renames = 32768,
249
protocol = avahi.PROTO_UNSPEC, bus = None):
271
272
def __init__(self,
273
interface = avahi.IF_UNSPEC,
274
name = None,
275
servicetype = None,
276
port = None,
277
TXT = None,
278
domain = "",
279
host = "",
280
max_renames = 32768,
281
protocol = avahi.PROTO_UNSPEC,
282
bus = None):
250
283
self.interface = interface
251
284
self.name = name
252
285
self.type = servicetype
261
294
self.server = None
262
295
self.bus = bus
263
296
self.entry_group_state_changed_match = None
264
def rename(self):
297
298
def rename(self, remove=True):
265
299
"""Derived from the Avahi example code"""
266
300
if self.rename_count >= self.max_renames:
267
301
logger.critical("No suitable Zeroconf service name found"
268
302
" after %i retries, exiting.",
269
303
self.rename_count)
270
304
raise AvahiServiceError("Too many renames")
271
self.name = unicode(self.server
272
.GetAlternativeServiceName(self.name))
305
self.name = str(
306
self.server.GetAlternativeServiceName(self.name))
307
self.rename_count += 1
273
308
logger.info("Changing Zeroconf service name to %r ...",
274
309
self.name)
275
self.remove()
310
if remove:
311
self.remove()
276
312
try:
277
313
self.add()
278
314
except dbus.exceptions.DBusException as error:
279
logger.critical("DBusException: %s", error)
280
self.cleanup()
281
os._exit(1)
282
self.rename_count += 1
315
if (error.get_dbus_name()
316
== "org.freedesktop.Avahi.CollisionError"):
317
logger.info("Local Zeroconf service name collision.")
318
return self.rename(remove=False)
319
else:
320
logger.critical("D-Bus Exception", exc_info=error)
321
self.cleanup()
322
os._exit(1)
323
283
324
def remove(self):
284
325
"""Derived from the Avahi example code"""
285
326
if self.entry_group_state_changed_match is not None:
287
328
self.entry_group_state_changed_match = None
288
329
if self.group is not None:
289
330
self.group.Reset()
331
290
332
def add(self):
291
333
"""Derived from the Avahi example code"""
292
334
self.remove()
309
351
dbus.UInt16(self.port),
310
352
avahi.string_array_to_txt_array(self.TXT))
311
353
self.group.Commit()
354
312
355
def entry_group_state_changed(self, state, error):
313
356
"""Derived from the Avahi example code"""
314
357
logger.debug("Avahi entry group state change: %i", state)
320
363
self.rename()
321
364
elif state == avahi.ENTRY_GROUP_FAILURE:
322
365
logger.critical("Avahi: Error in group state changed %s",
323
unicode(error))
324
raise AvahiGroupError("State changed: %s"
325
% unicode(error))
366
str(error))
367
raise AvahiGroupError("State changed: {!s}".format(error))
368
326
369
def cleanup(self):
327
370
"""Derived from the Avahi example code"""
328
371
if self.group is not None:
333
376
pass
334
377
self.group = None
335
378
self.remove()
379
336
380
def server_state_changed(self, state, error=None):
337
381
"""Derived from the Avahi example code"""
338
382
logger.debug("Avahi server state change: %i", state)
339
bad_states = { avahi.SERVER_INVALID:
340
"Zeroconf server invalid",
341
avahi.SERVER_REGISTERING: None,
342
avahi.SERVER_COLLISION:
343
"Zeroconf server name collision",
344
avahi.SERVER_FAILURE:
345
"Zeroconf server failure" }
383
bad_states = {
384
avahi.SERVER_INVALID: "Zeroconf server invalid",
385
avahi.SERVER_REGISTERING: None,
386
avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
avahi.SERVER_FAILURE: "Zeroconf server failure",
388
}
346
389
if state in bad_states:
347
390
if bad_states[state] is not None:
348
391
if error is None:
357
400
logger.debug("Unknown state: %r", state)
358
401
else:
359
402
logger.debug("Unknown state: %r: %r", state, error)
403
360
404
def activate(self):
361
405
"""Derived from the Avahi example code"""
362
406
if self.server is None:
366
410
follow_name_owner_changes=True),
367
411
avahi.DBUS_INTERFACE_SERVER)
368
412
self.server.connect_to_signal("StateChanged",
369
self.server_state_changed)
413
self.server_state_changed)
370
414
self.server_state_changed(self.server.GetState())
371
415
416
372
417
class AvahiServiceToSyslog(AvahiService):
373
def rename(self):
418
def rename(self, *args, **kwargs):
374
419
"""Add the new name to the syslog messages"""
375
ret = AvahiService.rename(self)
376
syslogger.setFormatter(logging.Formatter
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
420
ret = AvahiService.rename(self, *args, **kwargs)
421
syslogger.setFormatter(logging.Formatter(
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
423
.format(self.name)))
380
424
return ret
381
425
382
def timedelta_to_milliseconds(td):
383
"Convert a datetime.timedelta() to milliseconds"
384
return ((td.days * 24 * 60 * 60 * 1000)
385
+ (td.seconds * 1000)
386
+ (td.microseconds // 1000))
387
426
def call_pipe(connection, # : multiprocessing.Connection
427
func, *args, **kwargs):
428
"""This function is meant to be called by multiprocessing.Process
429
430
This function runs func(*args, **kwargs), and writes the resulting
431
return value on the provided multiprocessing.Connection.
432
"""
433
connection.send(func(*args, **kwargs))
434
connection.close()
435
388
436
class Client(object):
389
437
"""A representation of a client host served by this server.
390
438
416
464
last_checker_status: integer between 0 and 255 reflecting exit
417
465
status of last checker. -1 reflects crashed
418
466
checker, -2 means no checker completed yet.
467
last_checker_signal: The signal which killed the last checker, if
468
last_checker_status is -1
419
469
last_enabled: datetime.datetime(); (UTC) or None
420
470
name: string; from the config file, used in log messages and
421
471
D-Bus identifiers
426
476
runtime_expansions: Allowed attributes for runtime expansion.
427
477
expires: datetime.datetime(); time (UTC) when a client will be
428
478
disabled, or None
479
server_settings: The server_settings dict from main()
429
480
"""
430
481
431
482
runtime_expansions = ("approval_delay", "approval_duration",
432
"created", "enabled", "fingerprint",
433
"host", "interval", "last_checked_ok",
483
"created", "enabled", "expires",
484
"fingerprint", "host", "interval",
485
"last_approval_request", "last_checked_ok",
434
486
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
446
def timeout_milliseconds(self):
447
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
449
450
def extended_timeout_milliseconds(self):
451
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
453
454
def interval_milliseconds(self):
455
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
457
458
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
487
client_defaults = {
488
"timeout": "PT5M",
489
"extended_timeout": "PT15M",
490
"interval": "PT2M",
491
"checker": "fping -q -- %%(host)s",
492
"host": "",
493
"approval_delay": "PT0S",
494
"approval_duration": "PT1S",
495
"approved_by_default": "True",
496
"enabled": "True",
497
}
498
461
499
@staticmethod
462
500
def config_parser(config):
463
501
"""Construct a new dict of client settings of this form:
478
516
client["enabled"] = config.getboolean(client_name,
479
517
"enabled")
480
518
519
# Uppercase and remove spaces from fingerprint for later
520
# comparison purposes with return value from the
521
# fingerprint() function
481
522
client["fingerprint"] = (section["fingerprint"].upper()
482
523
.replace(" ", ""))
483
524
if "secret" in section:
488
529
"rb") as secfile:
489
530
client["secret"] = secfile.read()
490
531
else:
491
raise TypeError("No secret or secfile for section %s"
492
% section)
532
raise TypeError("No secret or secfile for section {}"
533
.format(section))
493
534
client["timeout"] = string_to_delta(section["timeout"])
494
535
client["extended_timeout"] = string_to_delta(
495
536
section["extended_timeout"])
504
545
client["last_checker_status"] = -2
505
546
506
547
return settings
507
508
509
def __init__(self, settings, name = None):
510
"""Note: the 'checker' key in 'config' sets the
511
'checker_command' attribute and *not* the 'checker'
512
attribute."""
548
549
def __init__(self, settings, name = None, server_settings=None):
513
550
self.name = name
551
if server_settings is None:
552
server_settings = {}
553
self.server_settings = server_settings
514
554
# adding all client settings
515
for setting, value in settings.iteritems():
555
for setting, value in settings.items():
516
556
setattr(self, setting, value)
517
557
518
558
if self.enabled:
524
564
else:
525
565
self.last_enabled = None
526
566
self.expires = None
527
567
528
568
logger.debug("Creating client %r", self.name)
529
# Uppercase and remove spaces from fingerprint for later
530
# comparison purposes with return value from the fingerprint()
531
# function
532
569
logger.debug(" Fingerprint: %s", self.fingerprint)
533
570
self.created = settings.get("created",
534
571
datetime.datetime.utcnow())
535
572
536
573
# attributes specific for this server instance
537
574
self.checker = None
538
575
self.checker_initiator_tag = None
541
578
self.current_checker_command = None
542
579
self.approved = None
543
580
self.approvals_pending = 0
544
self.changedstate = (multiprocessing_manager
545
.Condition(multiprocessing_manager
546
.Lock()))
547
self.client_structure = [attr for attr in
548
self.__dict__.iterkeys()
581
self.changedstate = multiprocessing_manager.Condition(
582
multiprocessing_manager.Lock())
583
self.client_structure = [attr
584
for attr in self.__dict__.iterkeys()
549
585
if not attr.startswith("_")]
550
586
self.client_structure.append("client_structure")
551
587
552
for name, t in inspect.getmembers(type(self),
553
lambda obj:
554
isinstance(obj,
555
property)):
588
for name, t in inspect.getmembers(
589
type(self), lambda obj: isinstance(obj, property)):
556
590
if not name.startswith("_"):
557
591
self.client_structure.append(name)
558
592
566
600
if getattr(self, "enabled", False):
567
601
# Already enabled
568
602
return
569
self.send_changedstate()
570
603
self.expires = datetime.datetime.utcnow() + self.timeout
571
604
self.enabled = True
572
605
self.last_enabled = datetime.datetime.utcnow()
573
606
self.init_checker()
607
self.send_changedstate()
574
608
575
609
def disable(self, quiet=True):
576
610
"""Disable this client."""
577
611
if not getattr(self, "enabled", False):
578
612
return False
579
613
if not quiet:
580
self.send_changedstate()
581
if not quiet:
582
614
logger.info("Disabling client %s", self.name)
583
if getattr(self, "disable_initiator_tag", False):
615
if getattr(self, "disable_initiator_tag", None) is not None:
584
616
gobject.source_remove(self.disable_initiator_tag)
585
617
self.disable_initiator_tag = None
586
618
self.expires = None
587
if getattr(self, "checker_initiator_tag", False):
619
if getattr(self, "checker_initiator_tag", None) is not None:
588
620
gobject.source_remove(self.checker_initiator_tag)
589
621
self.checker_initiator_tag = None
590
622
self.stop_checker()
591
623
self.enabled = False
624
if not quiet:
625
self.send_changedstate()
592
626
# Do not run this again if called by a gobject.timeout_add
593
627
return False
594
628
598
632
def init_checker(self):
599
633
# Schedule a new checker to be started an 'interval' from now,
600
634
# and every interval from then on.
601
self.checker_initiator_tag = (gobject.timeout_add
602
(self.interval_milliseconds(),
603
self.start_checker))
635
if self.checker_initiator_tag is not None:
636
gobject.source_remove(self.checker_initiator_tag)
637
self.checker_initiator_tag = gobject.timeout_add(
638
int(self.interval.total_seconds() * 1000),
639
self.start_checker)
604
640
# Schedule a disable() when 'timeout' has passed
605
self.disable_initiator_tag = (gobject.timeout_add
606
(self.timeout_milliseconds(),
607
self.disable))
641
if self.disable_initiator_tag is not None:
642
gobject.source_remove(self.disable_initiator_tag)
643
self.disable_initiator_tag = gobject.timeout_add(
644
int(self.timeout.total_seconds() * 1000), self.disable)
608
645
# Also start a new checker *right now*.
609
646
self.start_checker()
610
647
611
def checker_callback(self, pid, condition, command):
648
def checker_callback(self, source, condition,
649
(connection, command)):
612
650
"""The checker has completed, so take appropriate actions."""
613
651
self.checker_callback_tag = None
614
652
self.checker = None
615
if os.WIFEXITED(condition):
616
self.last_checker_status = os.WEXITSTATUS(condition)
653
# Read return code from connection (see call_pipe)
654
returncode = connection.recv()
655
connection.close()
656
657
if returncode >= 0:
658
self.last_checker_status = returncode
659
self.last_checker_signal = None
617
660
if self.last_checker_status == 0:
618
661
logger.info("Checker for %(name)s succeeded",
619
662
vars(self))
620
663
self.checked_ok()
621
664
else:
622
logger.info("Checker for %(name)s failed",
623
vars(self))
665
logger.info("Checker for %(name)s failed", vars(self))
624
666
else:
625
667
self.last_checker_status = -1
668
self.last_checker_signal = -returncode
626
669
logger.warning("Checker for %(name)s crashed?",
627
670
vars(self))
671
return False
628
672
629
673
def checked_ok(self):
630
674
"""Assert that the client has been seen, alive and well."""
631
675
self.last_checked_ok = datetime.datetime.utcnow()
632
676
self.last_checker_status = 0
677
self.last_checker_signal = None
633
678
self.bump_timeout()
634
679
635
680
def bump_timeout(self, timeout=None):
638
683
timeout = self.timeout
639
684
if self.disable_initiator_tag is not None:
640
685
gobject.source_remove(self.disable_initiator_tag)
686
self.disable_initiator_tag = None
641
687
if getattr(self, "enabled", False):
642
self.disable_initiator_tag = (gobject.timeout_add
643
(timedelta_to_milliseconds
644
(timeout), self.disable))
688
self.disable_initiator_tag = gobject.timeout_add(
689
int(timeout.total_seconds() * 1000), self.disable)
645
690
self.expires = datetime.datetime.utcnow() + timeout
646
691
647
692
def need_approval(self):
653
698
If a checker already exists, leave it running and do
654
699
nothing."""
655
700
# The reason for not killing a running checker is that if we
656
# did that, then if a checker (for some reason) started
657
# running slowly and taking more than 'interval' time, the
658
# client would inevitably timeout, since no checker would get
659
# a chance to run to completion. If we instead leave running
701
# did that, and if a checker (for some reason) started running
702
# slowly and taking more than 'interval' time, then the client
703
# would inevitably timeout, since no checker would get a
704
# chance to run to completion. If we instead leave running
660
705
# checkers alone, the checker would have to take more time
661
706
# than 'timeout' for the client to be disabled, which is as it
662
707
# should be.
663
708
664
# If a checker exists, make sure it is not a zombie
665
try:
666
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
667
except (AttributeError, OSError) as error:
668
if (isinstance(error, OSError)
669
and error.errno != errno.ECHILD):
670
raise error
671
else:
672
if pid:
673
logger.warning("Checker was a zombie")
674
gobject.source_remove(self.checker_callback_tag)
675
self.checker_callback(pid, status,
676
self.current_checker_command)
709
if self.checker is not None and not self.checker.is_alive():
710
logger.warning("Checker was not alive; joining")
711
self.checker.join()
712
self.checker = None
677
713
# Start a new checker if needed
678
714
if self.checker is None:
715
# Escape attributes for the shell
716
escaped_attrs = {
717
attr: re.escape(str(getattr(self, attr)))
718
for attr in self.runtime_expansions }
679
719
try:
680
# In case checker_command has exactly one % operator
681
command = self.checker_command % self.host
682
except TypeError:
683
# Escape attributes for the shell
684
escaped_attrs = dict(
685
(attr,
686
re.escape(unicode(str(getattr(self, attr, "")),
687
errors=
688
'replace')))
689
for attr in
690
self.runtime_expansions)
691
692
try:
693
command = self.checker_command % escaped_attrs
694
except TypeError as error:
695
logger.error('Could not format string "%s":'
696
' %s', self.checker_command, error)
697
return True # Try again later
720
command = self.checker_command % escaped_attrs
721
except TypeError as error:
722
logger.error('Could not format string "%s"',
723
self.checker_command,
724
exc_info=error)
725
return True # Try again later
698
726
self.current_checker_command = command
699
try:
700
logger.info("Starting checker %r for %s",
701
command, self.name)
702
# We don't need to redirect stdout and stderr, since
703
# in normal mode, that is already done by daemon(),
704
# and in debug mode we don't want to. (Stdin is
705
# always replaced by /dev/null.)
706
self.checker = subprocess.Popen(command,
707
close_fds=True,
708
shell=True, cwd="/")
709
self.checker_callback_tag = (gobject.child_watch_add
710
(self.checker.pid,
711
self.checker_callback,
712
data=command))
713
# The checker may have completed before the gobject
714
# watch was added. Check for this.
715
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
716
if pid:
717
gobject.source_remove(self.checker_callback_tag)
718
self.checker_callback(pid, status, command)
719
except OSError as error:
720
logger.error("Failed to start subprocess: %s",
721
error)
727
logger.info("Starting checker %r for %s", command,
728
self.name)
729
# We don't need to redirect stdout and stderr, since
730
# in normal mode, that is already done by daemon(),
731
# and in debug mode we don't want to. (Stdin is
732
# always replaced by /dev/null.)
733
# The exception is when not debugging but nevertheless
734
# running in the foreground; use the previously
735
# created wnull.
736
popen_args = { "close_fds": True,
737
"shell": True,
738
"cwd": "/" }
739
if (not self.server_settings["debug"]
740
and self.server_settings["foreground"]):
741
popen_args.update({"stdout": wnull,
742
"stderr": wnull })
743
pipe = multiprocessing.Pipe(duplex=False)
744
self.checker = multiprocessing.Process(
745
target = call_pipe,
746
args = (subprocess.call, pipe[1], command),
747
kwargs = popen_args)
748
self.checker.start()
749
self.checker_callback_tag = gobject.io_add_watch(
750
pipe[0].fileno(), gobject.IO_IN,
751
self.checker_callback, (pipe[0], command))
722
752
# Re-run this periodically if run by gobject.timeout_add
723
753
return True
724
754
730
760
if getattr(self, "checker", None) is None:
731
761
return
732
762
logger.debug("Stopping checker for %(name)s", vars(self))
733
try:
734
os.kill(self.checker.pid, signal.SIGTERM)
735
#time.sleep(0.5)
736
#if self.checker.poll() is None:
737
# os.kill(self.checker.pid, signal.SIGKILL)
738
except OSError as error:
739
if error.errno != errno.ESRCH: # No such process
740
raise
763
self.checker.terminate()
741
764
self.checker = None
742
765
743
766
744
def dbus_service_property(dbus_interface, signature="v",
745
access="readwrite", byte_arrays=False):
767
def dbus_service_property(dbus_interface,
768
signature="v",
769
access="readwrite",
770
byte_arrays=False):
746
771
"""Decorators for marking methods of a DBusObjectWithProperties to
747
772
become properties on the D-Bus.
748
773
757
782
# "Set" method, so we fail early here:
758
783
if byte_arrays and signature != "ay":
759
784
raise ValueError("Byte arrays not supported for non-'ay'"
760
" signature %r" % signature)
785
" signature {!r}".format(signature))
786
761
787
def decorator(func):
762
788
func._dbus_is_property = True
763
789
func._dbus_interface = dbus_interface
768
794
func._dbus_name = func._dbus_name[:-14]
769
795
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
770
796
return func
797
798
return decorator
799
800
801
def dbus_interface_annotations(dbus_interface):
802
"""Decorator for marking functions returning interface annotations
803
804
Usage:
805
806
@dbus_interface_annotations("org.example.Interface")
807
def _foo(self): # Function name does not matter
808
return {"org.freedesktop.DBus.Deprecated": "true",
809
"org.freedesktop.DBus.Property.EmitsChangedSignal":
810
"false"}
811
"""
812
813
def decorator(func):
814
func._dbus_is_interface = True
815
func._dbus_interface = dbus_interface
816
func._dbus_name = dbus_interface
817
return func
818
819
return decorator
820
821
822
def dbus_annotations(annotations):
823
"""Decorator to annotate D-Bus methods, signals or properties
824
Usage:
825
826
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
827
"org.freedesktop.DBus.Property."
828
"EmitsChangedSignal": "false"})
829
@dbus_service_property("org.example.Interface", signature="b",
830
access="r")
831
def Property_dbus_property(self):
832
return dbus.Boolean(False)
833
"""
834
835
def decorator(func):
836
func._dbus_annotations = annotations
837
return func
838
771
839
return decorator
772
840
773
841
774
842
class DBusPropertyException(dbus.exceptions.DBusException):
775
843
"""A base class for D-Bus property-related exceptions
776
844
"""
777
def __unicode__(self):
778
return unicode(str(self))
845
pass
779
846
780
847
781
848
class DBusPropertyAccessException(DBusPropertyException):
799
866
"""
800
867
801
868
@staticmethod
802
def _is_dbus_property(obj):
803
return getattr(obj, "_dbus_is_property", False)
869
def _is_dbus_thing(thing):
870
"""Returns a function testing if an attribute is a D-Bus thing
871
872
If called like _is_dbus_thing("method") it returns a function
873
suitable for use as predicate to inspect.getmembers().
874
"""
875
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
876
False)
804
877
805
def _get_all_dbus_properties(self):
878
def _get_all_dbus_things(self, thing):
806
879
"""Returns a generator of (name, attribute) pairs
807
880
"""
808
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
881
return ((getattr(athing.__get__(self), "_dbus_name", name),
882
athing.__get__(self))
809
883
for cls in self.__class__.__mro__
810
for name, prop in
811
inspect.getmembers(cls, self._is_dbus_property))
884
for name, athing in
885
inspect.getmembers(cls, self._is_dbus_thing(thing)))
812
886
813
887
def _get_dbus_property(self, interface_name, property_name):
814
888
"""Returns a bound method if one exists which is a D-Bus
815
889
property with the specified name and interface.
816
890
"""
817
for cls in self.__class__.__mro__:
818
for name, value in (inspect.getmembers
819
(cls, self._is_dbus_property)):
891
for cls in self.__class__.__mro__:
892
for name, value in inspect.getmembers(
893
cls, self._is_dbus_thing("property")):
820
894
if (value._dbus_name == property_name
821
895
and value._dbus_interface == interface_name):
822
896
return value.__get__(self)
823
897
824
898
# No such property
825
raise DBusPropertyNotFound(self.dbus_object_path + ":"
826
+ interface_name + "."
827
+ property_name)
899
raise DBusPropertyNotFound("{}:{}.{}".format(
900
self.dbus_object_path, interface_name, property_name))
828
901
829
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
902
@dbus.service.method(dbus.PROPERTIES_IFACE,
903
in_signature="ss",
830
904
out_signature="v")
831
905
def Get(self, interface_name, property_name):
832
906
"""Standard D-Bus property Get() method, see D-Bus standard.
850
924
# The byte_arrays option is not supported yet on
851
925
# signatures other than "ay".
852
926
if prop._dbus_signature != "ay":
853
raise ValueError
927
raise ValueError("Byte arrays not supported for non-"
928
"'ay' signature {!r}"
929
.format(prop._dbus_signature))
854
930
value = dbus.ByteArray(b''.join(chr(byte)
855
931
for byte in value))
856
932
prop(value)
857
933
858
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
934
@dbus.service.method(dbus.PROPERTIES_IFACE,
935
in_signature="s",
859
936
out_signature="a{sv}")
860
937
def GetAll(self, interface_name):
861
938
"""Standard D-Bus property GetAll() method, see D-Bus
864
941
Note: Will not include properties with access="write".
865
942
"""
866
943
properties = {}
867
for name, prop in self._get_all_dbus_properties():
944
for name, prop in self._get_all_dbus_things("property"):
868
945
if (interface_name
869
946
and interface_name != prop._dbus_interface):
870
947
# Interface non-empty but did not match
876
953
if not hasattr(value, "variant_level"):
877
954
properties[name] = value
878
955
continue
879
properties[name] = type(value)(value, variant_level=
880
value.variant_level+1)
956
properties[name] = type(value)(
957
value, variant_level = value.variant_level + 1)
881
958
return dbus.Dictionary(properties, signature="sv")
882
959
960
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
961
def PropertiesChanged(self, interface_name, changed_properties,
962
invalidated_properties):
963
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
964
standard.
965
"""
966
pass
967
883
968
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
884
969
out_signature="s",
885
970
path_keyword='object_path',
886
971
connection_keyword='connection')
887
972
def Introspect(self, object_path, connection):
888
"""Standard D-Bus method, overloaded to insert property tags.
973
"""Overloading of standard D-Bus method.
974
975
Inserts property tags and interface annotation tags.
889
976
"""
890
977
xmlstring = dbus.service.Object.Introspect(self, object_path,
891
978
connection)
892
979
try:
893
980
document = xml.dom.minidom.parseString(xmlstring)
981
894
982
def make_tag(document, name, prop):
895
983
e = document.createElement("property")
896
984
e.setAttribute("name", name)
897
985
e.setAttribute("type", prop._dbus_signature)
898
986
e.setAttribute("access", prop._dbus_access)
899
987
return e
988
900
989
for if_tag in document.getElementsByTagName("interface"):
990
# Add property tags
901
991
for tag in (make_tag(document, name, prop)
902
992
for name, prop
903
in self._get_all_dbus_properties()
993
in self._get_all_dbus_things("property")
904
994
if prop._dbus_interface
905
995
== if_tag.getAttribute("name")):
906
996
if_tag.appendChild(tag)
997
# Add annotation tags
998
for typ in ("method", "signal", "property"):
999
for tag in if_tag.getElementsByTagName(typ):
1000
annots = dict()
1001
for name, prop in (self.
1002
_get_all_dbus_things(typ)):
1003
if (name == tag.getAttribute("name")
1004
and prop._dbus_interface
1005
== if_tag.getAttribute("name")):
1006
annots.update(getattr(
1007
prop, "_dbus_annotations", {}))
1008
for name, value in annots.items():
1009
ann_tag = document.createElement(
1010
"annotation")
1011
ann_tag.setAttribute("name", name)
1012
ann_tag.setAttribute("value", value)
1013
tag.appendChild(ann_tag)
1014
# Add interface annotation tags
1015
for annotation, value in dict(
1016
itertools.chain.from_iterable(
1017
annotations().items()
1018
for name, annotations
1019
in self._get_all_dbus_things("interface")
1020
if name == if_tag.getAttribute("name")
1021
)).items():
1022
ann_tag = document.createElement("annotation")
1023
ann_tag.setAttribute("name", annotation)
1024
ann_tag.setAttribute("value", value)
1025
if_tag.appendChild(ann_tag)
907
1026
# Add the names to the return values for the
908
1027
# "org.freedesktop.DBus.Properties" methods
909
1028
if (if_tag.getAttribute("name")
924
1043
except (AttributeError, xml.dom.DOMException,
925
1044
xml.parsers.expat.ExpatError) as error:
926
1045
logger.error("Failed to override Introspection method",
927
error)
1046
exc_info=error)
928
1047
return xmlstring
929
1048
930
1049
931
def datetime_to_dbus (dt, variant_level=0):
1050
def datetime_to_dbus(dt, variant_level=0):
932
1051
"""Convert a UTC datetime.datetime() to a D-Bus type."""
933
1052
if dt is None:
934
1053
return dbus.String("", variant_level = variant_level)
935
return dbus.String(dt.isoformat(),
936
variant_level=variant_level)
937
938
939
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
940
.__metaclass__):
941
"""Applied to an empty subclass of a D-Bus object, this metaclass
942
will add additional D-Bus attributes matching a certain pattern.
1054
return dbus.String(dt.isoformat(), variant_level=variant_level)
1055
1056
1057
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1058
"""A class decorator; applied to a subclass of
1059
dbus.service.Object, it will add alternate D-Bus attributes with
1060
interface names according to the "alt_interface_names" mapping.
1061
Usage:
1062
1063
@alternate_dbus_interfaces({"org.example.Interface":
1064
"net.example.AlternateInterface"})
1065
class SampleDBusObject(dbus.service.Object):
1066
@dbus.service.method("org.example.Interface")
1067
def SampleDBusMethod():
1068
pass
1069
1070
The above "SampleDBusMethod" on "SampleDBusObject" will be
1071
reachable via two interfaces: "org.example.Interface" and
1072
"net.example.AlternateInterface", the latter of which will have
1073
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1074
"true", unless "deprecate" is passed with a False value.
1075
1076
This works for methods and signals, and also for D-Bus properties
1077
(from DBusObjectWithProperties) and interfaces (from the
1078
dbus_interface_annotations decorator).
943
1079
"""
944
def __new__(mcs, name, bases, attr):
945
# Go through all the base classes which could have D-Bus
946
# methods, signals, or properties in them
947
for base in (b for b in bases
948
if issubclass(b, dbus.service.Object)):
949
# Go though all attributes of the base class
950
for attrname, attribute in inspect.getmembers(base):
1080
1081
def wrapper(cls):
1082
for orig_interface_name, alt_interface_name in (
1083
alt_interface_names.items()):
1084
attr = {}
1085
interface_names = set()
1086
# Go though all attributes of the class
1087
for attrname, attribute in inspect.getmembers(cls):
951
1088
# Ignore non-D-Bus attributes, and D-Bus attributes
952
1089
# with the wrong interface name
953
1090
if (not hasattr(attribute, "_dbus_interface")
954
or not attribute._dbus_interface
955
.startswith("se.recompile.Mandos")):
1091
or not attribute._dbus_interface.startswith(
1092
orig_interface_name)):
956
1093
continue
957
1094
# Create an alternate D-Bus interface name based on
958
1095
# the current name
959
alt_interface = (attribute._dbus_interface
960
.replace("se.recompile.Mandos",
961
"se.bsnet.fukt.Mandos"))
1096
alt_interface = attribute._dbus_interface.replace(
1097
orig_interface_name, alt_interface_name)
1098
interface_names.add(alt_interface)
962
1099
# Is this a D-Bus signal?
963
1100
if getattr(attribute, "_dbus_is_signal", False):
964
# Extract the original non-method function by
965
# black magic
1101
# Extract the original non-method undecorated
1102
# function by black magic
966
1103
nonmethod_func = (dict(
967
zip(attribute.func_code.co_freevars,
968
attribute.__closure__))["func"]
969
.cell_contents)
1104
zip(attribute.func_code.co_freevars,
1105
attribute.__closure__))
1106
["func"].cell_contents)
970
1107
# Create a new, but exactly alike, function
971
1108
# object, and decorate it to be a new D-Bus signal
972
1109
# with the alternate D-Bus interface name
973
new_function = (dbus.service.signal
974
(alt_interface,
975
attribute._dbus_signature)
1110
new_function = (dbus.service.signal(
1111
alt_interface, attribute._dbus_signature)
976
1112
(types.FunctionType(
977
nonmethod_func.func_code,
978
nonmethod_func.func_globals,
979
nonmethod_func.func_name,
980
nonmethod_func.func_defaults,
981
nonmethod_func.func_closure)))
1113
nonmethod_func.func_code,
1114
nonmethod_func.func_globals,
1115
nonmethod_func.func_name,
1116
nonmethod_func.func_defaults,
1117
nonmethod_func.func_closure)))
1118
# Copy annotations, if any
1119
try:
1120
new_function._dbus_annotations = dict(
1121
attribute._dbus_annotations)
1122
except AttributeError:
1123
pass
982
1124
# Define a creator of a function to call both the
983
# old and new functions, so both the old and new
984
# signals gets sent when the function is called
1125
# original and alternate functions, so both the
1126
# original and alternate signals gets sent when
1127
# the function is called
985
1128
def fixscope(func1, func2):
986
1129
"""This function is a scope container to pass
987
1130
func1 and func2 to the "call_both" function
988
1131
outside of its arguments"""
1132
989
1133
def call_both(*args, **kwargs):
990
1134
"""This function will emit two D-Bus
991
1135
signals by calling func1 and func2"""
992
1136
func1(*args, **kwargs)
993
1137
func2(*args, **kwargs)
1138
994
1139
return call_both
995
1140
# Create the "call_both" function and add it to
996
1141
# the class
997
attr[attrname] = fixscope(attribute,
998
new_function)
1142
attr[attrname] = fixscope(attribute, new_function)
999
1143
# Is this a D-Bus method?
1000
1144
elif getattr(attribute, "_dbus_is_method", False):
1001
1145
# Create a new, but exactly alike, function
1002
1146
# object. Decorate it to be a new D-Bus method
1003
1147
# with the alternate D-Bus interface name. Add it
1004
1148
# to the class.
1005
attr[attrname] = (dbus.service.method
1006
(alt_interface,
1007
attribute._dbus_in_signature,
1008
attribute._dbus_out_signature)
1009
(types.FunctionType
1010
(attribute.func_code,
1011
attribute.func_globals,
1012
attribute.func_name,
1013
attribute.func_defaults,
1014
attribute.func_closure)))
1149
attr[attrname] = (
1150
dbus.service.method(
1151
alt_interface,
1152
attribute._dbus_in_signature,
1153
attribute._dbus_out_signature)
1154
(types.FunctionType(attribute.func_code,
1155
attribute.func_globals,
1156
attribute.func_name,
1157
attribute.func_defaults,
1158
attribute.func_closure)))
1159
# Copy annotations, if any
1160
try:
1161
attr[attrname]._dbus_annotations = dict(
1162
attribute._dbus_annotations)
1163
except AttributeError:
1164
pass
1015
1165
# Is this a D-Bus property?
1016
1166
elif getattr(attribute, "_dbus_is_property", False):
1017
1167
# Create a new, but exactly alike, function
1018
1168
# object, and decorate it to be a new D-Bus
1019
1169
# property with the alternate D-Bus interface
1020
1170
# name. Add it to the class.
1021
attr[attrname] = (dbus_service_property
1022
(alt_interface,
1023
attribute._dbus_signature,
1024
attribute._dbus_access,
1025
attribute
1026
._dbus_get_args_options
1027
["byte_arrays"])
1028
(types.FunctionType
1029
(attribute.func_code,
1030
attribute.func_globals,
1031
attribute.func_name,
1032
attribute.func_defaults,
1033
attribute.func_closure)))
1034
return type.__new__(mcs, name, bases, attr)
1035
1036
1171
attr[attrname] = (dbus_service_property(
1172
alt_interface, attribute._dbus_signature,
1173
attribute._dbus_access,
1174
attribute._dbus_get_args_options
1175
["byte_arrays"])
1176
(types.FunctionType(
1177
attribute.func_code,
1178
attribute.func_globals,
1179
attribute.func_name,
1180
attribute.func_defaults,
1181
attribute.func_closure)))
1182
# Copy annotations, if any
1183
try:
1184
attr[attrname]._dbus_annotations = dict(
1185
attribute._dbus_annotations)
1186
except AttributeError:
1187
pass
1188
# Is this a D-Bus interface?
1189
elif getattr(attribute, "_dbus_is_interface", False):
1190
# Create a new, but exactly alike, function
1191
# object. Decorate it to be a new D-Bus interface
1192
# with the alternate D-Bus interface name. Add it
1193
# to the class.
1194
attr[attrname] = (
1195
dbus_interface_annotations(alt_interface)
1196
(types.FunctionType(attribute.func_code,
1197
attribute.func_globals,
1198
attribute.func_name,
1199
attribute.func_defaults,
1200
attribute.func_closure)))
1201
if deprecate:
1202
# Deprecate all alternate interfaces
1203
iname="_AlternateDBusNames_interface_annotation{}"
1204
for interface_name in interface_names:
1205
1206
@dbus_interface_annotations(interface_name)
1207
def func(self):
1208
return { "org.freedesktop.DBus.Deprecated":
1209
"true" }
1210
# Find an unused name
1211
for aname in (iname.format(i)
1212
for i in itertools.count()):
1213
if aname not in attr:
1214
attr[aname] = func
1215
break
1216
if interface_names:
1217
# Replace the class with a new subclass of it with
1218
# methods, signals, etc. as created above.
1219
cls = type(b"{}Alternate".format(cls.__name__),
1220
(cls, ), attr)
1221
return cls
1222
1223
return wrapper
1224
1225
1226
@alternate_dbus_interfaces({"se.recompile.Mandos":
1227
"se.bsnet.fukt.Mandos"})
1037
1228
class ClientDBus(Client, DBusObjectWithProperties):
1038
1229
"""A Client class using D-Bus
1039
1230
1043
1234
"""
1044
1235
1045
1236
runtime_expansions = (Client.runtime_expansions
1046
+ ("dbus_object_path",))
1237
+ ("dbus_object_path", ))
1238
1239
_interface = "se.recompile.Mandos.Client"
1047
1240
1048
1241
# dbus.service.Object doesn't use super(), so we can't either.
1049
1242
1052
1245
Client.__init__(self, *args, **kwargs)
1053
1246
# Only now, when this client is initialized, can it show up on
1054
1247
# the D-Bus
1055
client_object_name = unicode(self.name).translate(
1248
client_object_name = str(self.name).translate(
1056
1249
{ord("."): ord("_"),
1057
1250
ord("-"): ord("_")})
1058
self.dbus_object_path = (dbus.ObjectPath
1059
("/clients/" + client_object_name))
1251
self.dbus_object_path = dbus.ObjectPath(
1252
"/clients/" + client_object_name)
1060
1253
DBusObjectWithProperties.__init__(self, self.bus,
1061
1254
self.dbus_object_path)
1062
1063
def notifychangeproperty(transform_func,
1064
dbus_name, type_func=lambda x: x,
1065
variant_level=1):
1255
1256
def notifychangeproperty(transform_func, dbus_name,
1257
type_func=lambda x: x,
1258
variant_level=1,
1259
invalidate_only=False,
1260
_interface=_interface):
1066
1261
""" Modify a variable so that it's a property which announces
1067
1262
its changes to DBus.
1068
1263
1073
1268
to the D-Bus. Default: no transform
1074
1269
variant_level: D-Bus variant level. Default: 1
1075
1270
"""
1076
attrname = "_{0}".format(dbus_name)
1271
attrname = "_{}".format(dbus_name)
1272
1077
1273
def setter(self, value):
1078
1274
if hasattr(self, "dbus_object_path"):
1079
1275
if (not hasattr(self, attrname) or
1080
1276
type_func(getattr(self, attrname, None))
1081
1277
!= type_func(value)):
1082
dbus_value = transform_func(type_func(value),
1083
variant_level
1084
=variant_level)
1085
self.PropertyChanged(dbus.String(dbus_name),
1086
dbus_value)
1278
if invalidate_only:
1279
self.PropertiesChanged(
1280
_interface, dbus.Dictionary(),
1281
dbus.Array((dbus_name, )))
1282
else:
1283
dbus_value = transform_func(
1284
type_func(value),
1285
variant_level = variant_level)
1286
self.PropertyChanged(dbus.String(dbus_name),
1287
dbus_value)
1288
self.PropertiesChanged(
1289
_interface,
1290
dbus.Dictionary({ dbus.String(dbus_name):
1291
dbus_value }),
1292
dbus.Array())
1087
1293
setattr(self, attrname, value)
1088
1294
1089
1295
return property(lambda self: getattr(self, attrname), setter)
1090
1296
1091
1092
1297
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1093
1298
approvals_pending = notifychangeproperty(dbus.Boolean,
1094
1299
"ApprovalPending",
1096
1301
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1097
1302
last_enabled = notifychangeproperty(datetime_to_dbus,
1098
1303
"LastEnabled")
1099
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1100
type_func = lambda checker:
1101
checker is not None)
1304
checker = notifychangeproperty(
1305
dbus.Boolean, "CheckerRunning",
1306
type_func = lambda checker: checker is not None)
1102
1307
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1103
1308
"LastCheckedOK")
1104
1309
last_checker_status = notifychangeproperty(dbus.Int16,
1107
1312
datetime_to_dbus, "LastApprovalRequest")
1108
1313
approved_by_default = notifychangeproperty(dbus.Boolean,
1109
1314
"ApprovedByDefault")
1110
approval_delay = notifychangeproperty(dbus.UInt64,
1111
"ApprovalDelay",
1112
type_func =
1113
timedelta_to_milliseconds)
1315
approval_delay = notifychangeproperty(
1316
dbus.UInt64, "ApprovalDelay",
1317
type_func = lambda td: td.total_seconds() * 1000)
1114
1318
approval_duration = notifychangeproperty(
1115
1319
dbus.UInt64, "ApprovalDuration",
1116
type_func = timedelta_to_milliseconds)
1320
type_func = lambda td: td.total_seconds() * 1000)
1117
1321
host = notifychangeproperty(dbus.String, "Host")
1118
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1119
type_func =
1120
timedelta_to_milliseconds)
1322
timeout = notifychangeproperty(
1323
dbus.UInt64, "Timeout",
1324
type_func = lambda td: td.total_seconds() * 1000)
1121
1325
extended_timeout = notifychangeproperty(
1122
1326
dbus.UInt64, "ExtendedTimeout",
1123
type_func = timedelta_to_milliseconds)
1124
interval = notifychangeproperty(dbus.UInt64,
1125
"Interval",
1126
type_func =
1127
timedelta_to_milliseconds)
1327
type_func = lambda td: td.total_seconds() * 1000)
1328
interval = notifychangeproperty(
1329
dbus.UInt64, "Interval",
1330
type_func = lambda td: td.total_seconds() * 1000)
1128
1331
checker_command = notifychangeproperty(dbus.String, "Checker")
1332
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1333
invalidate_only=True)
1129
1334
1130
1335
del notifychangeproperty
1131
1336
1138
1343
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1139
1344
Client.__del__(self, *args, **kwargs)
1140
1345
1141
def checker_callback(self, pid, condition, command,
1142
*args, **kwargs):
1143
self.checker_callback_tag = None
1144
self.checker = None
1145
if os.WIFEXITED(condition):
1146
exitstatus = os.WEXITSTATUS(condition)
1346
def checker_callback(self, source, condition,
1347
(connection, command), *args, **kwargs):
1348
ret = Client.checker_callback(self, source, condition,
1349
(connection, command), *args,
1350
**kwargs)
1351
exitstatus = self.last_checker_status
1352
if exitstatus >= 0:
1147
1353
# Emit D-Bus signal
1148
1354
self.CheckerCompleted(dbus.Int16(exitstatus),
1149
dbus.Int64(condition),
1355
dbus.Int64(0),
1150
1356
dbus.String(command))
1151
1357
else:
1152
1358
# Emit D-Bus signal
1153
1359
self.CheckerCompleted(dbus.Int16(-1),
1154
dbus.Int64(condition),
1360
dbus.Int64(
1361
self.last_checker_signal),
1155
1362
dbus.String(command))
1156
1157
return Client.checker_callback(self, pid, condition, command,
1158
*args, **kwargs)
1363
return ret
1159
1364
1160
1365
def start_checker(self, *args, **kwargs):
1161
old_checker = self.checker
1162
if self.checker is not None:
1163
old_checker_pid = self.checker.pid
1164
else:
1165
old_checker_pid = None
1366
old_checker_pid = getattr(self.checker, "pid", None)
1166
1367
r = Client.start_checker(self, *args, **kwargs)
1167
1368
# Only if new checker process was started
1168
1369
if (self.checker is not None
1176
1377
return False
1177
1378
1178
1379
def approve(self, value=True):
1179
self.send_changedstate()
1180
1380
self.approved = value
1181
gobject.timeout_add(timedelta_to_milliseconds
1182
(self.approval_duration),
1183
self._reset_approved)
1184
1381
gobject.timeout_add(int(self.approval_duration.total_seconds()
1382
* 1000), self._reset_approved)
1383
self.send_changedstate()
1185
1384
1186
1385
## D-Bus methods, signals & properties
1187
_interface = "se.recompile.Mandos.Client"
1386
1387
## Interfaces
1188
1388
1189
1389
## Signals
1190
1390
1201
1401
pass
1202
1402
1203
1403
# PropertyChanged - signal
1404
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1204
1405
@dbus.service.signal(_interface, signature="sv")
1205
1406
def PropertyChanged(self, property, value):
1206
1407
"D-Bus signal"
1270
1471
return dbus.Boolean(bool(self.approvals_pending))
1271
1472
1272
1473
# ApprovedByDefault - property
1273
@dbus_service_property(_interface, signature="b",
1474
@dbus_service_property(_interface,
1475
signature="b",
1274
1476
access="readwrite")
1275
1477
def ApprovedByDefault_dbus_property(self, value=None):
1276
1478
if value is None: # get
1278
1480
self.approved_by_default = bool(value)
1279
1481
1280
1482
# ApprovalDelay - property
1281
@dbus_service_property(_interface, signature="t",
1483
@dbus_service_property(_interface,
1484
signature="t",
1282
1485
access="readwrite")
1283
1486
def ApprovalDelay_dbus_property(self, value=None):
1284
1487
if value is None: # get
1285
return dbus.UInt64(self.approval_delay_milliseconds())
1488
return dbus.UInt64(self.approval_delay.total_seconds()
1489
* 1000)
1286
1490
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1287
1491
1288
1492
# ApprovalDuration - property
1289
@dbus_service_property(_interface, signature="t",
1493
@dbus_service_property(_interface,
1494
signature="t",
1290
1495
access="readwrite")
1291
1496
def ApprovalDuration_dbus_property(self, value=None):
1292
1497
if value is None: # get
1293
return dbus.UInt64(timedelta_to_milliseconds(
1294
self.approval_duration))
1498
return dbus.UInt64(self.approval_duration.total_seconds()
1499
* 1000)
1295
1500
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1296
1501
1297
1502
# Name - property
1305
1510
return dbus.String(self.fingerprint)
1306
1511
1307
1512
# Host - property
1308
@dbus_service_property(_interface, signature="s",
1513
@dbus_service_property(_interface,
1514
signature="s",
1309
1515
access="readwrite")
1310
1516
def Host_dbus_property(self, value=None):
1311
1517
if value is None: # get
1312
1518
return dbus.String(self.host)
1313
self.host = unicode(value)
1519
self.host = str(value)
1314
1520
1315
1521
# Created - property
1316
1522
@dbus_service_property(_interface, signature="s", access="read")
1323
1529
return datetime_to_dbus(self.last_enabled)
1324
1530
1325
1531
# Enabled - property
1326
@dbus_service_property(_interface, signature="b",
1532
@dbus_service_property(_interface,
1533
signature="b",
1327
1534
access="readwrite")
1328
1535
def Enabled_dbus_property(self, value=None):
1329
1536
if value is None: # get
1334
1541
self.disable()
1335
1542
1336
1543
# LastCheckedOK - property
1337
@dbus_service_property(_interface, signature="s",
1544
@dbus_service_property(_interface,
1545
signature="s",
1338
1546
access="readwrite")
1339
1547
def LastCheckedOK_dbus_property(self, value=None):
1340
1548
if value is not None:
1343
1551
return datetime_to_dbus(self.last_checked_ok)
1344
1552
1345
1553
# LastCheckerStatus - property
1346
@dbus_service_property(_interface, signature="n",
1347
access="read")
1554
@dbus_service_property(_interface, signature="n", access="read")
1348
1555
def LastCheckerStatus_dbus_property(self):
1349
1556
return dbus.Int16(self.last_checker_status)
1350
1557
1359
1566
return datetime_to_dbus(self.last_approval_request)
1360
1567
1361
1568
# Timeout - property
1362
@dbus_service_property(_interface, signature="t",
1569
@dbus_service_property(_interface,
1570
signature="t",
1363
1571
access="readwrite")
1364
1572
def Timeout_dbus_property(self, value=None):
1365
1573
if value is None: # get
1366
return dbus.UInt64(self.timeout_milliseconds())
1574
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1575
old_timeout = self.timeout
1367
1576
self.timeout = datetime.timedelta(0, 0, 0, value)
1368
# Reschedule timeout
1577
# Reschedule disabling
1369
1578
if self.enabled:
1370
1579
now = datetime.datetime.utcnow()
1371
time_to_die = timedelta_to_milliseconds(
1372
(self.last_checked_ok + self.timeout) - now)
1373
if time_to_die <= 0:
1580
self.expires += self.timeout - old_timeout
1581
if self.expires <= now:
1374
1582
# The timeout has passed
1375
1583
self.disable()
1376
1584
else:
1377
self.expires = (now +
1378
datetime.timedelta(milliseconds =
1379
time_to_die))
1380
1585
if (getattr(self, "disable_initiator_tag", None)
1381
1586
is None):
1382
1587
return
1383
1588
gobject.source_remove(self.disable_initiator_tag)
1384
self.disable_initiator_tag = (gobject.timeout_add
1385
(time_to_die,
1386
self.disable))
1589
self.disable_initiator_tag = gobject.timeout_add(
1590
int((self.expires - now).total_seconds() * 1000),
1591
self.disable)
1387
1592
1388
1593
# ExtendedTimeout - property
1389
@dbus_service_property(_interface, signature="t",
1594
@dbus_service_property(_interface,
1595
signature="t",
1390
1596
access="readwrite")
1391
1597
def ExtendedTimeout_dbus_property(self, value=None):
1392
1598
if value is None: # get
1393
return dbus.UInt64(self.extended_timeout_milliseconds())
1599
return dbus.UInt64(self.extended_timeout.total_seconds()
1600
* 1000)
1394
1601
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1395
1602
1396
1603
# Interval - property
1397
@dbus_service_property(_interface, signature="t",
1604
@dbus_service_property(_interface,
1605
signature="t",
1398
1606
access="readwrite")
1399
1607
def Interval_dbus_property(self, value=None):
1400
1608
if value is None: # get
1401
return dbus.UInt64(self.interval_milliseconds())
1609
return dbus.UInt64(self.interval.total_seconds() * 1000)
1402
1610
self.interval = datetime.timedelta(0, 0, 0, value)
1403
1611
if getattr(self, "checker_initiator_tag", None) is None:
1404
1612
return
1405
1613
if self.enabled:
1406
1614
# Reschedule checker run
1407
1615
gobject.source_remove(self.checker_initiator_tag)
1408
self.checker_initiator_tag = (gobject.timeout_add
1409
(value, self.start_checker))
1410
self.start_checker() # Start one now, too
1616
self.checker_initiator_tag = gobject.timeout_add(
1617
value, self.start_checker)
1618
self.start_checker() # Start one now, too
1411
1619
1412
1620
# Checker - property
1413
@dbus_service_property(_interface, signature="s",
1621
@dbus_service_property(_interface,
1622
signature="s",
1414
1623
access="readwrite")
1415
1624
def Checker_dbus_property(self, value=None):
1416
1625
if value is None: # get
1417
1626
return dbus.String(self.checker_command)
1418
self.checker_command = unicode(value)
1627
self.checker_command = str(value)
1419
1628
1420
1629
# CheckerRunning - property
1421
@dbus_service_property(_interface, signature="b",
1630
@dbus_service_property(_interface,
1631
signature="b",
1422
1632
access="readwrite")
1423
1633
def CheckerRunning_dbus_property(self, value=None):
1424
1634
if value is None: # get
1434
1644
return self.dbus_object_path # is already a dbus.ObjectPath
1435
1645
1436
1646
# Secret = property
1437
@dbus_service_property(_interface, signature="ay",
1438
access="write", byte_arrays=True)
1647
@dbus_service_property(_interface,
1648
signature="ay",
1649
access="write",
1650
byte_arrays=True)
1439
1651
def Secret_dbus_property(self, value):
1440
self.secret = str(value)
1652
self.secret = bytes(value)
1441
1653
1442
1654
del _interface
1443
1655
1457
1669
if data[0] == 'data':
1458
1670
return data[1]
1459
1671
if data[0] == 'function':
1672
1460
1673
def func(*args, **kwargs):
1461
1674
self._pipe.send(('funcall', name, args, kwargs))
1462
1675
return self._pipe.recv()[1]
1676
1463
1677
return func
1464
1678
1465
1679
def __setattr__(self, name, value):
1468
1682
self._pipe.send(('setattr', name, value))
1469
1683
1470
1684
1471
class ClientDBusTransitional(ClientDBus):
1472
__metaclass__ = AlternateDBusNamesMetaclass
1473
1474
1475
1685
class ClientHandler(socketserver.BaseRequestHandler, object):
1476
1686
"""A class to handle client connections.
1477
1687
1481
1691
def handle(self):
1482
1692
with contextlib.closing(self.server.child_pipe) as child_pipe:
1483
1693
logger.info("TCP connection from: %s",
1484
unicode(self.client_address))
1694
str(self.client_address))
1485
1695
logger.debug("Pipe FD: %d",
1486
1696
self.server.child_pipe.fileno())
1487
1697
1488
session = (gnutls.connection
1489
.ClientSession(self.request,
1490
gnutls.connection
1491
.X509Credentials()))
1698
session = gnutls.connection.ClientSession(
1699
self.request, gnutls.connection .X509Credentials())
1492
1700
1493
1701
# Note: gnutls.connection.X509Credentials is really a
1494
1702
# generic GnuTLS certificate credentials object so long as
1503
1711
priority = self.server.gnutls_priority
1504
1712
if priority is None:
1505
1713
priority = "NORMAL"
1506
(gnutls.library.functions
1507
.gnutls_priority_set_direct(session._c_object,
1508
priority, None))
1714
gnutls.library.functions.gnutls_priority_set_direct(
1715
session._c_object, priority, None)
1509
1716
1510
1717
# Start communication using the Mandos protocol
1511
1718
# Get protocol number
1513
1720
logger.debug("Protocol version: %r", line)
1514
1721
try:
1515
1722
if int(line.strip().split()[0]) > 1:
1516
raise RuntimeError
1723
raise RuntimeError(line)
1517
1724
except (ValueError, IndexError, RuntimeError) as error:
1518
1725
logger.error("Unknown protocol version: %s", error)
1519
1726
return
1531
1738
approval_required = False
1532
1739
try:
1533
1740
try:
1534
fpr = self.fingerprint(self.peer_certificate
1535
(session))
1741
fpr = self.fingerprint(
1742
self.peer_certificate(session))
1536
1743
except (TypeError,
1537
1744
gnutls.errors.GNUTLSError) as error:
1538
1745
logger.warning("Bad certificate: %s", error)
1553
1760
while True:
1554
1761
if not client.enabled:
1555
1762
logger.info("Client %s is disabled",
1556
client.name)
1763
client.name)
1557
1764
if self.server.use_dbus:
1558
1765
# Emit D-Bus signal
1559
1766
client.Rejected("Disabled")
1568
1775
if self.server.use_dbus:
1569
1776
# Emit D-Bus signal
1570
1777
client.NeedApproval(
1571
client.approval_delay_milliseconds(),
1572
client.approved_by_default)
1778
client.approval_delay.total_seconds()
1779
* 1000, client.approved_by_default)
1573
1780
else:
1574
1781
logger.warning("Client %s was not approved",
1575
1782
client.name)
1581
1788
#wait until timeout or approved
1582
1789
time = datetime.datetime.now()
1583
1790
client.changedstate.acquire()
1584
(client.changedstate.wait
1585
(float(client.timedelta_to_milliseconds(delay)
1586
/ 1000)))
1791
client.changedstate.wait(delay.total_seconds())
1587
1792
client.changedstate.release()
1588
1793
time2 = datetime.datetime.now()
1589
1794
if (time2 - time) >= delay:
1605
1810
try:
1606
1811
sent = session.send(client.secret[sent_size:])
1607
1812
except gnutls.errors.GNUTLSError as error:
1608
logger.warning("gnutls send failed")
1813
logger.warning("gnutls send failed",
1814
exc_info=error)
1609
1815
return
1610
logger.debug("Sent: %d, remaining: %d",
1611
sent, len(client.secret)
1612
- (sent_size + sent))
1816
logger.debug("Sent: %d, remaining: %d", sent,
1817
len(client.secret) - (sent_size
1818
+ sent))
1613
1819
sent_size += sent
1614
1820
1615
1821
logger.info("Sending secret to %s", client.name)
1625
1831
try:
1626
1832
session.bye()
1627
1833
except gnutls.errors.GNUTLSError as error:
1628
logger.warning("GnuTLS bye failed")
1834
logger.warning("GnuTLS bye failed",
1835
exc_info=error)
1629
1836
1630
1837
@staticmethod
1631
1838
def peer_certificate(session):
1632
1839
"Return the peer's OpenPGP certificate as a bytestring"
1633
1840
# If not an OpenPGP certificate...
1634
if (gnutls.library.functions
1635
.gnutls_certificate_type_get(session._c_object)
1841
if (gnutls.library.functions.gnutls_certificate_type_get(
1842
session._c_object)
1636
1843
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1637
1844
# ...do the normal thing
1638
1845
return session.peer_certificate
1652
1859
def fingerprint(openpgp):
1653
1860
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1654
1861
# New GnuTLS "datum" with the OpenPGP public key
1655
datum = (gnutls.library.types
1656
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1657
ctypes.POINTER
1658
(ctypes.c_ubyte)),
1659
ctypes.c_uint(len(openpgp))))
1862
datum = gnutls.library.types.gnutls_datum_t(
1863
ctypes.cast(ctypes.c_char_p(openpgp),
1864
ctypes.POINTER(ctypes.c_ubyte)),
1865
ctypes.c_uint(len(openpgp)))
1660
1866
# New empty GnuTLS certificate
1661
1867
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1662
(gnutls.library.functions
1663
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1868
gnutls.library.functions.gnutls_openpgp_crt_init(
1869
ctypes.byref(crt))
1664
1870
# Import the OpenPGP public key into the certificate
1665
(gnutls.library.functions
1666
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1667
gnutls.library.constants
1668
.GNUTLS_OPENPGP_FMT_RAW))
1871
gnutls.library.functions.gnutls_openpgp_crt_import(
1872
crt, ctypes.byref(datum),
1873
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1669
1874
# Verify the self signature in the key
1670
1875
crtverify = ctypes.c_uint()
1671
(gnutls.library.functions
1672
.gnutls_openpgp_crt_verify_self(crt, 0,
1673
ctypes.byref(crtverify)))
1876
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1877
crt, 0, ctypes.byref(crtverify))
1674
1878
if crtverify.value != 0:
1675
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1676
raise (gnutls.errors.CertificateSecurityError
1677
("Verify failed"))
1880
raise gnutls.errors.CertificateSecurityError(
1881
"Verify failed")
1678
1882
# New buffer for the fingerprint
1679
1883
buf = ctypes.create_string_buffer(20)
1680
1884
buf_len = ctypes.c_size_t()
1681
1885
# Get the fingerprint from the certificate into the buffer
1682
(gnutls.library.functions
1683
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1684
ctypes.byref(buf_len)))
1886
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1887
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1685
1888
# Deinit the certificate
1686
1889
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1687
1890
# Convert the buffer to a Python bytestring
1693
1896
1694
1897
class MultiprocessingMixIn(object):
1695
1898
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1899
1696
1900
def sub_process_main(self, request, address):
1697
1901
try:
1698
1902
self.finish_request(request, address)
1703
1907
def process_request(self, request, address):
1704
1908
"""Start a new process to process the request."""
1705
1909
proc = multiprocessing.Process(target = self.sub_process_main,
1706
args = (request,
1707
address))
1910
args = (request, address))
1708
1911
proc.start()
1709
1912
return proc
1710
1913
1711
1914
1712
1915
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1713
1916
""" adds a pipe to the MixIn """
1917
1714
1918
def process_request(self, request, client_address):
1715
1919
"""Overrides and wraps the original process_request().
1716
1920
1725
1929
1726
1930
def add_pipe(self, parent_pipe, proc):
1727
1931
"""Dummy function; override as necessary"""
1728
raise NotImplementedError
1932
raise NotImplementedError()
1729
1933
1730
1934
1731
1935
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1737
1941
interface: None or a network interface name (string)
1738
1942
use_ipv6: Boolean; to use IPv6 or not
1739
1943
"""
1944
1740
1945
def __init__(self, server_address, RequestHandlerClass,
1741
interface=None, use_ipv6=True):
1946
interface=None,
1947
use_ipv6=True,
1948
socketfd=None):
1949
"""If socketfd is set, use that file descriptor instead of
1950
creating a new one with socket.socket().
1951
"""
1742
1952
self.interface = interface
1743
1953
if use_ipv6:
1744
1954
self.address_family = socket.AF_INET6
1955
if socketfd is not None:
1956
# Save the file descriptor
1957
self.socketfd = socketfd
1958
# Save the original socket.socket() function
1959
self.socket_socket = socket.socket
1960
# To implement --socket, we monkey patch socket.socket.
1961
#
1962
# (When socketserver.TCPServer is a new-style class, we
1963
# could make self.socket into a property instead of monkey
1964
# patching socket.socket.)
1965
#
1966
# Create a one-time-only replacement for socket.socket()
1967
@functools.wraps(socket.socket)
1968
def socket_wrapper(*args, **kwargs):
1969
# Restore original function so subsequent calls are
1970
# not affected.
1971
socket.socket = self.socket_socket
1972
del self.socket_socket
1973
# This time only, return a new socket object from the
1974
# saved file descriptor.
1975
return socket.fromfd(self.socketfd, *args, **kwargs)
1976
# Replace socket.socket() function with wrapper
1977
socket.socket = socket_wrapper
1978
# The socketserver.TCPServer.__init__ will call
1979
# socket.socket(), which might be our replacement,
1980
# socket_wrapper(), if socketfd was set.
1745
1981
socketserver.TCPServer.__init__(self, server_address,
1746
1982
RequestHandlerClass)
1983
1747
1984
def server_bind(self):
1748
1985
"""This overrides the normal server_bind() function
1749
1986
to bind to an interface if one was specified, and also NOT to
1755
1992
self.interface)
1756
1993
else:
1757
1994
try:
1758
self.socket.setsockopt(socket.SOL_SOCKET,
1759
SO_BINDTODEVICE,
1760
str(self.interface
1761
+ '\0'))
1995
self.socket.setsockopt(
1996
socket.SOL_SOCKET, SO_BINDTODEVICE,
1997
(self.interface + "\0").encode("utf-8"))
1762
1998
except socket.error as error:
1763
if error[0] == errno.EPERM:
1764
logger.error("No permission to"
1765
" bind to interface %s",
1766
self.interface)
1767
elif error[0] == errno.ENOPROTOOPT:
1999
if error.errno == errno.EPERM:
2000
logger.error("No permission to bind to"
2001
" interface %s", self.interface)
2002
elif error.errno == errno.ENOPROTOOPT:
1768
2003
logger.error("SO_BINDTODEVICE not available;"
1769
2004
" cannot bind to interface %s",
1770
2005
self.interface)
2006
elif error.errno == errno.ENODEV:
2007
logger.error("Interface %s does not exist,"
2008
" cannot bind", self.interface)
1771
2009
else:
1772
2010
raise
1773
2011
# Only bind(2) the socket if we really need to.
1776
2014
if self.address_family == socket.AF_INET6:
1777
2015
any_address = "::" # in6addr_any
1778
2016
else:
1779
any_address = socket.INADDR_ANY
2017
any_address = "0.0.0.0" # INADDR_ANY
1780
2018
self.server_address = (any_address,
1781
2019
self.server_address[1])
1782
2020
elif not self.server_address[1]:
1783
self.server_address = (self.server_address[0],
1784
0)
2021
self.server_address = (self.server_address[0], 0)
1785
2022
# if self.interface:
1786
2023
# self.server_address = (self.server_address[0],
1787
2024
# 0, # port
1801
2038
1802
2039
Assumes a gobject.MainLoop event loop.
1803
2040
"""
2041
1804
2042
def __init__(self, server_address, RequestHandlerClass,
1805
interface=None, use_ipv6=True, clients=None,
1806
gnutls_priority=None, use_dbus=True):
2043
interface=None,
2044
use_ipv6=True,
2045
clients=None,
2046
gnutls_priority=None,
2047
use_dbus=True,
2048
socketfd=None):
1807
2049
self.enabled = False
1808
2050
self.clients = clients
1809
2051
if self.clients is None:
1813
2055
IPv6_TCPServer.__init__(self, server_address,
1814
2056
RequestHandlerClass,
1815
2057
interface = interface,
1816
use_ipv6 = use_ipv6)
2058
use_ipv6 = use_ipv6,
2059
socketfd = socketfd)
2060
1817
2061
def server_activate(self):
1818
2062
if self.enabled:
1819
2063
return socketserver.TCPServer.server_activate(self)
1823
2067
1824
2068
def add_pipe(self, parent_pipe, proc):
1825
2069
# Call "handle_ipc" for both data and EOF events
1826
gobject.io_add_watch(parent_pipe.fileno(),
1827
gobject.IO_IN | gobject.IO_HUP,
1828
functools.partial(self.handle_ipc,
1829
parent_pipe =
1830
parent_pipe,
1831
proc = proc))
2070
gobject.io_add_watch(
2071
parent_pipe.fileno(),
2072
gobject.IO_IN | gobject.IO_HUP,
2073
functools.partial(self.handle_ipc,
2074
parent_pipe = parent_pipe,
2075
proc = proc))
1832
2076
1833
def handle_ipc(self, source, condition, parent_pipe=None,
1834
proc = None, client_object=None):
1835
condition_names = {
1836
gobject.IO_IN: "IN", # There is data to read.
1837
gobject.IO_OUT: "OUT", # Data can be written (without
1838
# blocking).
1839
gobject.IO_PRI: "PRI", # There is urgent data to read.
1840
gobject.IO_ERR: "ERR", # Error condition.
1841
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1842
# broken, usually for pipes and
1843
# sockets).
1844
}
1845
conditions_string = ' | '.join(name
1846
for cond, name in
1847
condition_names.iteritems()
1848
if cond & condition)
2077
def handle_ipc(self, source, condition,
2078
parent_pipe=None,
2079
proc = None,
2080
client_object=None):
1849
2081
# error, or the other end of multiprocessing.Pipe has closed
1850
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2082
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1851
2083
# Wait for other process to exit
1852
2084
proc.join()
1853
2085
return False
1874
2106
parent_pipe.send(False)
1875
2107
return False
1876
2108
1877
gobject.io_add_watch(parent_pipe.fileno(),
1878
gobject.IO_IN | gobject.IO_HUP,
1879
functools.partial(self.handle_ipc,
1880
parent_pipe =
1881
parent_pipe,
1882
proc = proc,
1883
client_object =
1884
client))
2109
gobject.io_add_watch(
2110
parent_pipe.fileno(),
2111
gobject.IO_IN | gobject.IO_HUP,
2112
functools.partial(self.handle_ipc,
2113
parent_pipe = parent_pipe,
2114
proc = proc,
2115
client_object = client))
1885
2116
parent_pipe.send(True)
1886
2117
# remove the old hook in favor of the new above hook on
1887
2118
# same fileno
1893
2124
1894
2125
parent_pipe.send(('data', getattr(client_object,
1895
2126
funcname)(*args,
1896
**kwargs)))
2127
**kwargs)))
1897
2128
1898
2129
if command == 'getattr':
1899
2130
attrname = request[1]
1900
2131
if callable(client_object.__getattribute__(attrname)):
1901
parent_pipe.send(('function',))
2132
parent_pipe.send(('function', ))
1902
2133
else:
1903
parent_pipe.send(('data', client_object
1904
.__getattribute__(attrname)))
2134
parent_pipe.send((
2135
'data', client_object.__getattribute__(attrname)))
1905
2136
1906
2137
if command == 'setattr':
1907
2138
attrname = request[1]
1911
2142
return True
1912
2143
1913
2144
2145
def rfc3339_duration_to_delta(duration):
2146
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2147
2148
>>> rfc3339_duration_to_delta("P7D")
2149
datetime.timedelta(7)
2150
>>> rfc3339_duration_to_delta("PT60S")
2151
datetime.timedelta(0, 60)
2152
>>> rfc3339_duration_to_delta("PT60M")
2153
datetime.timedelta(0, 3600)
2154
>>> rfc3339_duration_to_delta("PT24H")
2155
datetime.timedelta(1)
2156
>>> rfc3339_duration_to_delta("P1W")
2157
datetime.timedelta(7)
2158
>>> rfc3339_duration_to_delta("PT5M30S")
2159
datetime.timedelta(0, 330)
2160
>>> rfc3339_duration_to_delta("P1DT3M20S")
2161
datetime.timedelta(1, 200)
2162
"""
2163
2164
# Parsing an RFC 3339 duration with regular expressions is not
2165
# possible - there would have to be multiple places for the same
2166
# values, like seconds. The current code, while more esoteric, is
2167
# cleaner without depending on a parsing library. If Python had a
2168
# built-in library for parsing we would use it, but we'd like to
2169
# avoid excessive use of external libraries.
2170
2171
# New type for defining tokens, syntax, and semantics all-in-one
2172
Token = collections.namedtuple("Token",
2173
("regexp", # To match token; if
2174
# "value" is not None,
2175
# must have a "group"
2176
# containing digits
2177
"value", # datetime.timedelta or
2178
# None
2179
"followers")) # Tokens valid after
2180
# this token
2181
Token = collections.namedtuple("Token", (
2182
"regexp", # To match token; if "value" is not None, must have
2183
# a "group" containing digits
2184
"value", # datetime.timedelta or None
2185
"followers")) # Tokens valid after this token
2186
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2187
# the "duration" ABNF definition in RFC 3339, Appendix A.
2188
token_end = Token(re.compile(r"$"), None, frozenset())
2189
token_second = Token(re.compile(r"(\d+)S"),
2190
datetime.timedelta(seconds=1),
2191
frozenset((token_end, )))
2192
token_minute = Token(re.compile(r"(\d+)M"),
2193
datetime.timedelta(minutes=1),
2194
frozenset((token_second, token_end)))
2195
token_hour = Token(re.compile(r"(\d+)H"),
2196
datetime.timedelta(hours=1),
2197
frozenset((token_minute, token_end)))
2198
token_time = Token(re.compile(r"T"),
2199
None,
2200
frozenset((token_hour, token_minute,
2201
token_second)))
2202
token_day = Token(re.compile(r"(\d+)D"),
2203
datetime.timedelta(days=1),
2204
frozenset((token_time, token_end)))
2205
token_month = Token(re.compile(r"(\d+)M"),
2206
datetime.timedelta(weeks=4),
2207
frozenset((token_day, token_end)))
2208
token_year = Token(re.compile(r"(\d+)Y"),
2209
datetime.timedelta(weeks=52),
2210
frozenset((token_month, token_end)))
2211
token_week = Token(re.compile(r"(\d+)W"),
2212
datetime.timedelta(weeks=1),
2213
frozenset((token_end, )))
2214
token_duration = Token(re.compile(r"P"), None,
2215
frozenset((token_year, token_month,
2216
token_day, token_time,
2217
token_week)))
2218
# Define starting values
2219
value = datetime.timedelta() # Value so far
2220
found_token = None
2221
followers = frozenset((token_duration,)) # Following valid tokens
2222
s = duration # String left to parse
2223
# Loop until end token is found
2224
while found_token is not token_end:
2225
# Search for any currently valid tokens
2226
for token in followers:
2227
match = token.regexp.match(s)
2228
if match is not None:
2229
# Token found
2230
if token.value is not None:
2231
# Value found, parse digits
2232
factor = int(match.group(1), 10)
2233
# Add to value so far
2234
value += factor * token.value
2235
# Strip token from string
2236
s = token.regexp.sub("", s, 1)
2237
# Go to found token
2238
found_token = token
2239
# Set valid next tokens
2240
followers = found_token.followers
2241
break
2242
else:
2243
# No currently valid tokens were found
2244
raise ValueError("Invalid RFC 3339 duration")
2245
# End token found
2246
return value
2247
2248
1914
2249
def string_to_delta(interval):
1915
2250
"""Parse a string and return a datetime.timedelta
1916
2251
1927
2262
>>> string_to_delta('5m 30s')
1928
2263
datetime.timedelta(0, 330)
1929
2264
"""
2265
2266
try:
2267
return rfc3339_duration_to_delta(interval)
2268
except ValueError:
2269
pass
2270
1930
2271
timevalue = datetime.timedelta(0)
1931
2272
for s in interval.split():
1932
2273
try:
1933
suffix = unicode(s[-1])
2274
suffix = s[-1]
1934
2275
value = int(s[:-1])
1935
2276
if suffix == "d":
1936
2277
delta = datetime.timedelta(value)
1943
2284
elif suffix == "w":
1944
2285
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1945
2286
else:
1946
raise ValueError("Unknown suffix %r" % suffix)
1947
except (ValueError, IndexError) as e:
2287
raise ValueError("Unknown suffix {!r}".format(suffix))
2288
except IndexError as e:
1948
2289
raise ValueError(*(e.args))
1949
2290
timevalue += delta
1950
2291
return timevalue
1963
2304
sys.exit()
1964
2305
if not noclose:
1965
2306
# Close all standard open file descriptors
1966
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2307
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1967
2308
if not stat.S_ISCHR(os.fstat(null).st_mode):
1968
2309
raise OSError(errno.ENODEV,
1969
"%s not a character device"
1970
% os.path.devnull)
2310
"{} not a character device"
2311
.format(os.devnull))
1971
2312
os.dup2(null, sys.stdin.fileno())
1972
2313
os.dup2(null, sys.stdout.fileno())
1973
2314
os.dup2(null, sys.stderr.fileno())
1982
2323
1983
2324
parser = argparse.ArgumentParser()
1984
2325
parser.add_argument("-v", "--version", action="version",
1985
version = "%%(prog)s %s" % version,
2326
version = "%(prog)s {}".format(version),
1986
2327
help="show version number and exit")
1987
2328
parser.add_argument("-i", "--interface", metavar="IF",
1988
2329
help="Bind to interface IF")
1994
2335
help="Run self-test")
1995
2336
parser.add_argument("--debug", action="store_true",
1996
2337
help="Debug mode; run in foreground and log"
1997
" to terminal")
2338
" to terminal", default=None)
1998
2339
parser.add_argument("--debuglevel", metavar="LEVEL",
1999
2340
help="Debug level for stdout output")
2000
2341
parser.add_argument("--priority", help="GnuTLS"
2007
2348
" files")
2008
2349
parser.add_argument("--no-dbus", action="store_false",
2009
2350
dest="use_dbus", help="Do not provide D-Bus"
2010
" system bus interface")
2351
" system bus interface", default=None)
2011
2352
parser.add_argument("--no-ipv6", action="store_false",
2012
dest="use_ipv6", help="Do not use IPv6")
2353
dest="use_ipv6", help="Do not use IPv6",
2354
default=None)
2013
2355
parser.add_argument("--no-restore", action="store_false",
2014
2356
dest="restore", help="Do not restore stored"
2015
" state")
2357
" state", default=None)
2358
parser.add_argument("--socket", type=int,
2359
help="Specify a file descriptor to a network"
2360
" socket to use instead of creating one")
2016
2361
parser.add_argument("--statedir", metavar="DIR",
2017
2362
help="Directory to save/restore state in")
2363
parser.add_argument("--foreground", action="store_true",
2364
help="Run in foreground", default=None)
2365
parser.add_argument("--no-zeroconf", action="store_false",
2366
dest="zeroconf", help="Do not use Zeroconf",
2367
default=None)
2018
2368
2019
2369
options = parser.parse_args()
2020
2370
2021
2371
if options.check:
2022
2372
import doctest
2023
doctest.testmod()
2024
sys.exit()
2373
fail_count, test_count = doctest.testmod()
2374
sys.exit(os.EX_OK if fail_count == 0 else 1)
2025
2375
2026
2376
# Default values for config file for server-global settings
2027
2377
server_defaults = { "interface": "",
2029
2379
"port": "",
2030
2380
"debug": "False",
2031
2381
"priority":
2032
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2382
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2383
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2033
2384
"servicename": "Mandos",
2034
2385
"use_dbus": "True",
2035
2386
"use_ipv6": "True",
2036
2387
"debuglevel": "",
2037
2388
"restore": "True",
2038
"statedir": "/var/lib/mandos"
2039
}
2389
"socket": "",
2390
"statedir": "/var/lib/mandos",
2391
"foreground": "False",
2392
"zeroconf": "True",
2393
}
2040
2394
2041
2395
# Parse config file for server-global settings
2042
2396
server_config = configparser.SafeConfigParser(server_defaults)
2043
2397
del server_defaults
2044
server_config.read(os.path.join(options.configdir,
2045
"mandos.conf"))
2398
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2046
2399
# Convert the SafeConfigParser object to a dict
2047
2400
server_settings = server_config.defaults()
2048
2401
# Use the appropriate methods on the non-string config options
2049
for option in ("debug", "use_dbus", "use_ipv6"):
2402
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2050
2403
server_settings[option] = server_config.getboolean("DEFAULT",
2051
2404
option)
2052
2405
if server_settings["port"]:
2053
2406
server_settings["port"] = server_config.getint("DEFAULT",
2054
2407
"port")
2408
if server_settings["socket"]:
2409
server_settings["socket"] = server_config.getint("DEFAULT",
2410
"socket")
2411
# Later, stdin will, and stdout and stderr might, be dup'ed
2412
# over with an opened os.devnull. But we don't want this to
2413
# happen with a supplied network socket.
2414
if 0 <= server_settings["socket"] <= 2:
2415
server_settings["socket"] = os.dup(server_settings
2416
["socket"])
2055
2417
del server_config
2056
2418
2057
2419
# Override the settings from the config file with command line
2058
2420
# options, if set.
2059
2421
for option in ("interface", "address", "port", "debug",
2060
"priority", "servicename", "configdir",
2061
"use_dbus", "use_ipv6", "debuglevel", "restore",
2062
"statedir"):
2422
"priority", "servicename", "configdir", "use_dbus",
2423
"use_ipv6", "debuglevel", "restore", "statedir",
2424
"socket", "foreground", "zeroconf"):
2063
2425
value = getattr(options, option)
2064
2426
if value is not None:
2065
2427
server_settings[option] = value
2066
2428
del options
2067
2429
# Force all strings to be unicode
2068
2430
for option in server_settings.keys():
2069
if type(server_settings[option]) is str:
2070
server_settings[option] = unicode(server_settings[option])
2431
if isinstance(server_settings[option], bytes):
2432
server_settings[option] = (server_settings[option]
2433
.decode("utf-8"))
2434
# Force all boolean options to be boolean
2435
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2436
"foreground", "zeroconf"):
2437
server_settings[option] = bool(server_settings[option])
2438
# Debug implies foreground
2439
if server_settings["debug"]:
2440
server_settings["foreground"] = True
2071
2441
# Now we have our good server settings in "server_settings"
2072
2442
2073
2443
##################################################################
2074
2444
2445
if (not server_settings["zeroconf"]
2446
and not (server_settings["port"]
2447
or server_settings["socket"] != "")):
2448
parser.error("Needs port or socket to work without Zeroconf")
2449
2075
2450
# For convenience
2076
2451
debug = server_settings["debug"]
2077
2452
debuglevel = server_settings["debuglevel"]
2079
2454
use_ipv6 = server_settings["use_ipv6"]
2080
2455
stored_state_path = os.path.join(server_settings["statedir"],
2081
2456
stored_state_file)
2457
foreground = server_settings["foreground"]
2458
zeroconf = server_settings["zeroconf"]
2082
2459
2083
2460
if debug:
2084
2461
initlogger(debug, logging.DEBUG)
2090
2467
initlogger(debug, level)
2091
2468
2092
2469
if server_settings["servicename"] != "Mandos":
2093
syslogger.setFormatter(logging.Formatter
2094
('Mandos (%s) [%%(process)d]:'
2095
' %%(levelname)s: %%(message)s'
2096
% server_settings["servicename"]))
2470
syslogger.setFormatter(
2471
logging.Formatter('Mandos ({}) [%(process)d]:'
2472
' %(levelname)s: %(message)s'.format(
2473
server_settings["servicename"])))
2097
2474
2098
2475
# Parse config file with clients
2099
2476
client_config = configparser.SafeConfigParser(Client
2104
2481
global mandos_dbus_service
2105
2482
mandos_dbus_service = None
2106
2483
2107
tcp_server = MandosServer((server_settings["address"],
2108
server_settings["port"]),
2109
ClientHandler,
2110
interface=(server_settings["interface"]
2111
or None),
2112
use_ipv6=use_ipv6,
2113
gnutls_priority=
2114
server_settings["priority"],
2115
use_dbus=use_dbus)
2116
if not debug:
2117
pidfilename = "/var/run/mandos.pid"
2484
socketfd = None
2485
if server_settings["socket"] != "":
2486
socketfd = server_settings["socket"]
2487
tcp_server = MandosServer(
2488
(server_settings["address"], server_settings["port"]),
2489
ClientHandler,
2490
interface=(server_settings["interface"] or None),
2491
use_ipv6=use_ipv6,
2492
gnutls_priority=server_settings["priority"],
2493
use_dbus=use_dbus,
2494
socketfd=socketfd)
2495
if not foreground:
2496
pidfilename = "/run/mandos.pid"
2497
if not os.path.isdir("/run/."):
2498
pidfilename = "/var/run/mandos.pid"
2499
pidfile = None
2118
2500
try:
2119
2501
pidfile = open(pidfilename, "w")
2120
except IOError:
2121
logger.error("Could not open file %r", pidfilename)
2502
except IOError as e:
2503
logger.error("Could not open file %r", pidfilename,
2504
exc_info=e)
2122
2505
2123
try:
2124
uid = pwd.getpwnam("_mandos").pw_uid
2125
gid = pwd.getpwnam("_mandos").pw_gid
2126
except KeyError:
2506
for name in ("_mandos", "mandos", "nobody"):
2127
2507
try:
2128
uid = pwd.getpwnam("mandos").pw_uid
2129
gid = pwd.getpwnam("mandos").pw_gid
2508
uid = pwd.getpwnam(name).pw_uid
2509
gid = pwd.getpwnam(name).pw_gid
2510
break
2130
2511
except KeyError:
2131
try:
2132
uid = pwd.getpwnam("nobody").pw_uid
2133
gid = pwd.getpwnam("nobody").pw_gid
2134
except KeyError:
2135
uid = 65534
2136
gid = 65534
2512
continue
2513
else:
2514
uid = 65534
2515
gid = 65534
2137
2516
try:
2138
2517
os.setgid(gid)
2139
2518
os.setuid(uid)
2140
2519
except OSError as error:
2141
if error[0] != errno.EPERM:
2142
raise error
2520
if error.errno != errno.EPERM:
2521
raise
2143
2522
2144
2523
if debug:
2145
2524
# Enable all possible GnuTLS debugging
2152
2531
def debug_gnutls(level, string):
2153
2532
logger.debug("GnuTLS: %s", string[:-1])
2154
2533
2155
(gnutls.library.functions
2156
.gnutls_global_set_log_function(debug_gnutls))
2534
gnutls.library.functions.gnutls_global_set_log_function(
2535
debug_gnutls)
2157
2536
2158
2537
# Redirect stdin so all checkers get /dev/null
2159
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2538
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2160
2539
os.dup2(null, sys.stdin.fileno())
2161
2540
if null > 2:
2162
2541
os.close(null)
2163
2542
2164
2543
# Need to fork before connecting to D-Bus
2165
if not debug:
2544
if not foreground:
2166
2545
# Close all input and output, do double fork, etc.
2167
2546
daemon()
2168
2547
2548
# multiprocessing will use threads, so before we use gobject we
2549
# need to inform gobject that threads will be used.
2169
2550
gobject.threads_init()
2170
2551
2171
2552
global main_loop
2172
2553
# From the Avahi example code
2173
DBusGMainLoop(set_as_default=True )
2554
DBusGMainLoop(set_as_default=True)
2174
2555
main_loop = gobject.MainLoop()
2175
2556
bus = dbus.SystemBus()
2176
2557
# End of Avahi example code
2177
2558
if use_dbus:
2178
2559
try:
2179
2560
bus_name = dbus.service.BusName("se.recompile.Mandos",
2180
bus, do_not_queue=True)
2181
old_bus_name = (dbus.service.BusName
2182
("se.bsnet.fukt.Mandos", bus,
2183
do_not_queue=True))
2561
bus,
2562
do_not_queue=True)
2563
old_bus_name = dbus.service.BusName(
2564
"se.bsnet.fukt.Mandos", bus,
2565
do_not_queue=True)
2184
2566
except dbus.exceptions.NameExistsException as e:
2185
logger.error(unicode(e) + ", disabling D-Bus")
2567
logger.error("Disabling D-Bus:", exc_info=e)
2186
2568
use_dbus = False
2187
2569
server_settings["use_dbus"] = False
2188
2570
tcp_server.use_dbus = False
2189
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2190
service = AvahiServiceToSyslog(name =
2191
server_settings["servicename"],
2192
servicetype = "_mandos._tcp",
2193
protocol = protocol, bus = bus)
2194
if server_settings["interface"]:
2195
service.interface = (if_nametoindex
2196
(str(server_settings["interface"])))
2571
if zeroconf:
2572
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2573
service = AvahiServiceToSyslog(
2574
name = server_settings["servicename"],
2575
servicetype = "_mandos._tcp",
2576
protocol = protocol,
2577
bus = bus)
2578
if server_settings["interface"]:
2579
service.interface = if_nametoindex(
2580
server_settings["interface"].encode("utf-8"))
2197
2581
2198
2582
global multiprocessing_manager
2199
2583
multiprocessing_manager = multiprocessing.Manager()
2200
2584
2201
2585
client_class = Client
2202
2586
if use_dbus:
2203
client_class = functools.partial(ClientDBusTransitional,
2204
bus = bus)
2587
client_class = functools.partial(ClientDBus, bus = bus)
2205
2588
2206
2589
client_settings = Client.config_parser(client_config)
2207
2590
old_client_settings = {}
2208
2591
clients_data = {}
2209
2592
2593
# This is used to redirect stdout and stderr for checker processes
2594
global wnull
2595
wnull = open(os.devnull, "w") # A writable /dev/null
2596
# Only used if server is running in foreground but not in debug
2597
# mode
2598
if debug or not foreground:
2599
wnull.close()
2600
2210
2601
# Get client data and settings from last running state.
2211
2602
if server_settings["restore"]:
2212
2603
try:
2213
2604
with open(stored_state_path, "rb") as stored_state:
2214
clients_data, old_client_settings = (pickle.load
2215
(stored_state))
2605
clients_data, old_client_settings = pickle.load(
2606
stored_state)
2216
2607
os.remove(stored_state_path)
2217
2608
except IOError as e:
2218
logger.warning("Could not load persistent state: {0}"
2219
.format(e))
2220
if e.errno != errno.ENOENT:
2609
if e.errno == errno.ENOENT:
2610
logger.warning("Could not load persistent state:"
2611
" {}".format(os.strerror(e.errno)))
2612
else:
2613
logger.critical("Could not load persistent state:",
2614
exc_info=e)
2221
2615
raise
2222
2616
except EOFError as e:
2223
2617
logger.warning("Could not load persistent state: "
2224
"EOFError: {0}".format(e))
2618
"EOFError:",
2619
exc_info=e)
2225
2620
2226
2621
with PGPEngine() as pgp:
2227
for client_name, client in clients_data.iteritems():
2622
for client_name, client in clients_data.items():
2623
# Skip removed clients
2624
if client_name not in client_settings:
2625
continue
2626
2228
2627
# Decide which value to use after restoring saved state.
2229
2628
# We have three different values: Old config file,
2230
2629
# new config file, and saved state.
2235
2634
# For each value in new config, check if it
2236
2635
# differs from the old config value (Except for
2237
2636
# the "secret" attribute)
2238
if (name != "secret" and
2239
value != old_client_settings[client_name]
2240
[name]):
2637
if (name != "secret"
2638
and (value !=
2639
old_client_settings[client_name][name])):
2241
2640
client[name] = value
2242
2641
except KeyError:
2243
2642
pass
2244
2643
2245
2644
# Clients who has passed its expire date can still be
2246
# enabled if its last checker was successful. Clients
2645
# enabled if its last checker was successful. A Client
2247
2646
# whose checker succeeded before we stored its state is
2248
2647
# assumed to have successfully run all checkers during
2249
2648
# downtime.
2251
2650
if datetime.datetime.utcnow() >= client["expires"]:
2252
2651
if not client["last_checked_ok"]:
2253
2652
logger.warning(
2254
"disabling client {0} - Client never "
2255
"performed a successful checker"
2256
.format(client_name))
2653
"disabling client {} - Client never "
2654
"performed a successful checker".format(
2655
client_name))
2257
2656
client["enabled"] = False
2258
2657
elif client["last_checker_status"] != 0:
2259
2658
logger.warning(
2260
"disabling client {0} - Client "
2261
"last checker failed with error code {1}"
2262
.format(client_name,
2263
client["last_checker_status"]))
2659
"disabling client {} - Client last"
2660
" checker failed with error code"
2661
" {}".format(
2662
client_name,
2663
client["last_checker_status"]))
2264
2664
client["enabled"] = False
2265
2665
else:
2266
client["expires"] = (datetime.datetime
2267
.utcnow()
2268
+ client["timeout"])
2666
client["expires"] = (
2667
datetime.datetime.utcnow()
2668
+ client["timeout"])
2269
2669
logger.debug("Last checker succeeded,"
2270
" keeping {0} enabled"
2271
.format(client_name))
2670
" keeping {} enabled".format(
2671
client_name))
2272
2672
try:
2273
client["secret"] = (
2274
pgp.decrypt(client["encrypted_secret"],
2275
client_settings[client_name]
2276
["secret"]))
2673
client["secret"] = pgp.decrypt(
2674
client["encrypted_secret"],
2675
client_settings[client_name]["secret"])
2277
2676
except PGPError:
2278
2677
# If decryption fails, we use secret from new settings
2279
logger.debug("Failed to decrypt {0} old secret"
2280
.format(client_name))
2281
client["secret"] = (
2282
client_settings[client_name]["secret"])
2283
2678
logger.debug("Failed to decrypt {} old secret".format(
2679
client_name))
2680
client["secret"] = (client_settings[client_name]
2681
["secret"])
2284
2682
2285
2683
# Add/remove clients based on new changes made to config
2286
2684
for client_name in (set(old_client_settings)
2289
2687
for client_name in (set(client_settings)
2290
2688
- set(old_client_settings)):
2291
2689
clients_data[client_name] = client_settings[client_name]
2292
2690
2293
2691
# Create all client objects
2294
for client_name, client in clients_data.iteritems():
2692
for client_name, client in clients_data.items():
2295
2693
tcp_server.clients[client_name] = client_class(
2296
name = client_name, settings = client)
2694
name = client_name,
2695
settings = client,
2696
server_settings = server_settings)
2297
2697
2298
2698
if not tcp_server.clients:
2299
2699
logger.warning("No clients defined")
2300
2301
if not debug:
2302
try:
2303
with pidfile:
2304
pid = os.getpid()
2305
pidfile.write(str(pid) + "\n".encode("utf-8"))
2306
del pidfile
2307
except IOError:
2308
logger.error("Could not write to file %r with PID %d",
2309
pidfilename, pid)
2310
except NameError:
2311
# "pidfile" was never created
2312
pass
2700
2701
if not foreground:
2702
if pidfile is not None:
2703
try:
2704
with pidfile:
2705
pid = os.getpid()
2706
pidfile.write("{}\n".format(pid).encode("utf-8"))
2707
except IOError:
2708
logger.error("Could not write to file %r with PID %d",
2709
pidfilename, pid)
2710
del pidfile
2313
2711
del pidfilename
2314
signal.signal(signal.SIGINT, signal.SIG_IGN)
2315
2712
2316
2713
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2317
2714
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2318
2715
2319
2716
if use_dbus:
2320
class MandosDBusService(dbus.service.Object):
2717
2718
@alternate_dbus_interfaces(
2719
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2720
class MandosDBusService(DBusObjectWithProperties):
2321
2721
"""A D-Bus proxy object"""
2722
2322
2723
def __init__(self):
2323
2724
dbus.service.Object.__init__(self, bus, "/")
2725
2324
2726
_interface = "se.recompile.Mandos"
2325
2727
2728
@dbus_interface_annotations(_interface)
2729
def _foo(self):
2730
return {
2731
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2732
"false" }
2733
2326
2734
@dbus.service.signal(_interface, signature="o")
2327
2735
def ClientAdded(self, objpath):
2328
2736
"D-Bus signal"
2341
2749
@dbus.service.method(_interface, out_signature="ao")
2342
2750
def GetAllClients(self):
2343
2751
"D-Bus method"
2344
return dbus.Array(c.dbus_object_path
2345
for c in
2752
return dbus.Array(c.dbus_object_path for c in
2346
2753
tcp_server.clients.itervalues())
2347
2754
2348
2755
@dbus.service.method(_interface,
2350
2757
def GetAllClientsWithProperties(self):
2351
2758
"D-Bus method"
2352
2759
return dbus.Dictionary(
2353
((c.dbus_object_path, c.GetAll(""))
2354
for c in tcp_server.clients.itervalues()),
2760
{ c.dbus_object_path: c.GetAll("")
2761
for c in tcp_server.clients.itervalues() },
2355
2762
signature="oa{sv}")
2356
2763
2357
2764
@dbus.service.method(_interface, in_signature="o")
2370
2777
2371
2778
del _interface
2372
2779
2373
class MandosDBusServiceTransitional(MandosDBusService):
2374
__metaclass__ = AlternateDBusNamesMetaclass
2375
mandos_dbus_service = MandosDBusServiceTransitional()
2780
mandos_dbus_service = MandosDBusService()
2376
2781
2377
2782
def cleanup():
2378
2783
"Cleanup function; run on exit"
2379
service.cleanup()
2784
if zeroconf:
2785
service.cleanup()
2380
2786
2381
2787
multiprocessing.active_children()
2788
wnull.close()
2382
2789
if not (tcp_server.clients or client_settings):
2383
2790
return
2384
2791
2395
2802
2396
2803
# A list of attributes that can not be pickled
2397
2804
# + secret.
2398
exclude = set(("bus", "changedstate", "secret",
2399
"checker"))
2400
for name, typ in (inspect.getmembers
2401
(dbus.service.Object)):
2805
exclude = { "bus", "changedstate", "secret",
2806
"checker", "server_settings" }
2807
for name, typ in inspect.getmembers(dbus.service
2808
.Object):
2402
2809
exclude.add(name)
2403
2810
2404
2811
client_dict["encrypted_secret"] = (client
2411
2818
del client_settings[client.name]["secret"]
2412
2819
2413
2820
try:
2414
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2415
prefix="clients-",
2416
dir=os.path.dirname
2417
(stored_state_path))
2418
with os.fdopen(tempfd, "wb") as stored_state:
2821
with tempfile.NamedTemporaryFile(
2822
mode='wb',
2823
suffix=".pickle",
2824
prefix='clients-',
2825
dir=os.path.dirname(stored_state_path),
2826
delete=False) as stored_state:
2419
2827
pickle.dump((clients, client_settings), stored_state)
2828
tempname = stored_state.name
2420
2829
os.rename(tempname, stored_state_path)
2421
2830
except (IOError, OSError) as e:
2422
logger.warning("Could not save persistent state: {0}"
2423
.format(e))
2424
2831
if not debug:
2425
2832
try:
2426
2833
os.remove(tempname)
2427
2834
except NameError:
2428
2835
pass
2429
if e.errno not in set((errno.ENOENT, errno.EACCES,
2430
errno.EEXIST)):
2431
raise e
2836
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2837
logger.warning("Could not save persistent state: {}"
2838
.format(os.strerror(e.errno)))
2839
else:
2840
logger.warning("Could not save persistent state:",
2841
exc_info=e)
2842
raise
2432
2843
2433
2844
# Delete all clients, and settings from config
2434
2845
while tcp_server.clients:
2439
2850
client.disable(quiet=True)
2440
2851
if use_dbus:
2441
2852
# Emit D-Bus signal
2442
mandos_dbus_service.ClientRemoved(client
2443
.dbus_object_path,
2444
client.name)
2853
mandos_dbus_service.ClientRemoved(
2854
client.dbus_object_path, client.name)
2445
2855
client_settings.clear()
2446
2856
2447
2857
atexit.register(cleanup)
2458
2868
tcp_server.server_activate()
2459
2869
2460
2870
# Find out what port we got
2461
service.port = tcp_server.socket.getsockname()[1]
2871
if zeroconf:
2872
service.port = tcp_server.socket.getsockname()[1]
2462
2873
if use_ipv6:
2463
2874
logger.info("Now listening on address %r, port %d,"
2464
" flowinfo %d, scope_id %d"
2465
% tcp_server.socket.getsockname())
2875
" flowinfo %d, scope_id %d",
2876
*tcp_server.socket.getsockname())
2466
2877
else: # IPv4
2467
logger.info("Now listening on address %r, port %d"
2468
% tcp_server.socket.getsockname())
2878
logger.info("Now listening on address %r, port %d",
2879
*tcp_server.socket.getsockname())
2469
2880
2470
2881
#service.interface = tcp_server.socket.getsockname()[3]
2471
2882
2472
2883
try:
2473
# From the Avahi example code
2474
try:
2475
service.activate()
2476
except dbus.exceptions.DBusException as error:
2477
logger.critical("DBusException: %s", error)
2478
cleanup()
2479
sys.exit(1)
2480
# End of Avahi example code
2884
if zeroconf:
2885
# From the Avahi example code
2886
try:
2887
service.activate()
2888
except dbus.exceptions.DBusException as error:
2889
logger.critical("D-Bus Exception", exc_info=error)
2890
cleanup()
2891
sys.exit(1)
2892
# End of Avahi example code
2481
2893
2482
2894
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2483
2895
lambda *args, **kwargs:
2487
2899
logger.debug("Starting main loop")
2488
2900
main_loop.run()
2489
2901
except AvahiError as error:
2490
logger.critical("AvahiError: %s", error)
2902
logger.critical("Avahi Error", exc_info=error)
2491
2903
cleanup()
2492
2904
sys.exit(1)
2493
2905
except KeyboardInterrupt:
2498
2910
# Must run before the D-Bus bus name gets deregistered
2499
2911
cleanup()
2500
2912
2913
2501
2914
if __name__ == '__main__':
2502
2915
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0