To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 750
- compare with another revision
- download diff
- download tarball
- view history from revision 750
- Committer: Teddy Hogeborn
- Date: 2015-05-30 16:47:00 UTC
- Revision ID: teddy@recompile.se-20150530164700-77zrd7964gdhbk1f
mandos: Disable D-Bus if any DBusException is raised when connecting.
- files added:
- debian/mandos-client.examples
- debian/upstream
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
import SocketServer as socketserver
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
38
43
import socket
39
44
import argparse
40
45
import datetime
45
50
import gnutls.library.functions
46
51
import gnutls.library.constants
47
52
import gnutls.library.types
48
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
49
57
import sys
50
58
import re
51
59
import os
60
68
import struct
61
69
import fcntl
62
70
import functools
63
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
64
75
import multiprocessing
65
76
import types
66
77
import binascii
67
78
import tempfile
79
import itertools
80
import collections
68
81
69
82
import dbus
70
83
import dbus.service
71
import gobject
84
try:
85
import gobject
86
except ImportError:
87
from gi.repository import GObject as gobject
72
88
import avahi
73
89
from dbus.mainloop.glib import DBusGMainLoop
74
90
import ctypes
75
91
import ctypes.util
76
92
import xml.dom.minidom
77
93
import inspect
78
import GnuPGInterface
79
94
80
95
try:
81
96
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
100
except ImportError:
86
101
SO_BINDTODEVICE = None
87
102
88
version = "1.5.2"
103
if sys.version_info.major == 2:
104
str = unicode
105
106
version = "1.6.9"
89
107
stored_state_file = "clients.pickle"
90
108
91
109
logger = logging.getLogger()
92
syslogger = (logging.handlers.SysLogHandler
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
address = str("/dev/log")))
110
syslogger = None
95
111
96
112
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
113
if_nametoindex = ctypes.cdll.LoadLibrary(
114
ctypes.util.find_library("c")).if_nametoindex
100
115
except (OSError, AttributeError):
116
101
117
def if_nametoindex(interface):
102
118
"Get an interface index the hard way, i.e. using fcntl()"
103
119
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
120
with contextlib.closing(socket.socket()) as s:
105
121
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
122
struct.pack(b"16s16x", interface))
123
interface_index = struct.unpack("I", ifreq[16:20])[0]
110
124
return interface_index
111
125
112
126
113
127
def initlogger(debug, level=logging.WARNING):
114
128
"""init logger and add loglevel"""
115
129
130
global syslogger
131
syslogger = (logging.handlers.SysLogHandler(
132
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
address = "/dev/log"))
116
134
syslogger.setFormatter(logging.Formatter
117
135
('Mandos [%(process)d]: %(levelname)s:'
118
136
' %(message)s'))
135
153
136
154
class PGPEngine(object):
137
155
"""A simple class for OpenPGP symmetric encryption & decryption"""
156
138
157
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
158
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
159
self.gnupgargs = ['--batch',
160
'--home', self.tempdir,
161
'--force-mdc',
162
'--quiet',
163
'--no-use-agent']
147
164
148
165
def __enter__(self):
149
166
return self
150
167
151
def __exit__ (self, exc_type, exc_value, traceback):
168
def __exit__(self, exc_type, exc_value, traceback):
152
169
self._cleanup()
153
170
return False
154
171
171
188
def password_encode(self, password):
172
189
# Passphrase can not be empty and can not contain newlines or
173
190
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
191
encoded = b"mandos" + binascii.hexlify(password)
192
if len(encoded) > 2048:
193
# GnuPG can't handle long passwords, so encode differently
194
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
195
.replace(b"\n", b"\\n")
196
.replace(b"\0", b"\\x00"))
197
return encoded
175
198
176
199
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
200
passphrase = self.password_encode(password)
201
with tempfile.NamedTemporaryFile(
202
dir=self.tempdir) as passfile:
203
passfile.write(passphrase)
204
passfile.flush()
205
proc = subprocess.Popen(['gpg', '--symmetric',
206
'--passphrase-file',
207
passfile.name]
208
+ self.gnupgargs,
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
213
if proc.returncode != 0:
214
raise PGPError(err)
191
215
return ciphertext
192
216
193
217
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
218
passphrase = self.password_encode(password)
219
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
221
passfile.write(passphrase)
222
passfile.flush()
223
proc = subprocess.Popen(['gpg', '--decrypt',
224
'--passphrase-file',
225
passfile.name]
226
+ self.gnupgargs,
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
231
if proc.returncode != 0:
232
raise PGPError(err)
208
233
return decrypted_plaintext
209
234
210
235
211
212
236
class AvahiError(Exception):
213
237
def __init__(self, value, *args, **kwargs):
214
238
self.value = value
215
super(AvahiError, self).__init__(value, *args, **kwargs)
216
def __unicode__(self):
217
return unicode(repr(self.value))
239
return super(AvahiError, self).__init__(value, *args,
240
**kwargs)
241
218
242
219
243
class AvahiServiceError(AvahiError):
220
244
pass
221
245
246
222
247
class AvahiGroupError(AvahiError):
223
248
pass
224
249
231
256
Used to optionally bind to the specified interface.
232
257
name: string; Example: 'Mandos'
233
258
type: string; Example: '_mandos._tcp'.
234
See <http://www.dns-sd.org/ServiceTypes.html>
259
See <https://www.iana.org/assignments/service-names-port-numbers>
235
260
port: integer; what port to announce
236
261
TXT: list of strings; TXT record for the service
237
262
domain: string; Domain to publish on, default to .local if empty.
243
268
server: D-Bus Server
244
269
bus: dbus.SystemBus()
245
270
"""
246
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
247
servicetype = None, port = None, TXT = None,
248
domain = "", host = "", max_renames = 32768,
249
protocol = avahi.PROTO_UNSPEC, bus = None):
271
272
def __init__(self,
273
interface = avahi.IF_UNSPEC,
274
name = None,
275
servicetype = None,
276
port = None,
277
TXT = None,
278
domain = "",
279
host = "",
280
max_renames = 32768,
281
protocol = avahi.PROTO_UNSPEC,
282
bus = None):
250
283
self.interface = interface
251
284
self.name = name
252
285
self.type = servicetype
261
294
self.server = None
262
295
self.bus = bus
263
296
self.entry_group_state_changed_match = None
264
def rename(self):
297
298
def rename(self, remove=True):
265
299
"""Derived from the Avahi example code"""
266
300
if self.rename_count >= self.max_renames:
267
301
logger.critical("No suitable Zeroconf service name found"
268
302
" after %i retries, exiting.",
269
303
self.rename_count)
270
304
raise AvahiServiceError("Too many renames")
271
self.name = unicode(self.server
272
.GetAlternativeServiceName(self.name))
305
self.name = str(
306
self.server.GetAlternativeServiceName(self.name))
307
self.rename_count += 1
273
308
logger.info("Changing Zeroconf service name to %r ...",
274
309
self.name)
275
self.remove()
310
if remove:
311
self.remove()
276
312
try:
277
313
self.add()
278
314
except dbus.exceptions.DBusException as error:
279
logger.critical("DBusException: %s", error)
280
self.cleanup()
281
os._exit(1)
282
self.rename_count += 1
315
if (error.get_dbus_name()
316
== "org.freedesktop.Avahi.CollisionError"):
317
logger.info("Local Zeroconf service name collision.")
318
return self.rename(remove=False)
319
else:
320
logger.critical("D-Bus Exception", exc_info=error)
321
self.cleanup()
322
os._exit(1)
323
283
324
def remove(self):
284
325
"""Derived from the Avahi example code"""
285
326
if self.entry_group_state_changed_match is not None:
287
328
self.entry_group_state_changed_match = None
288
329
if self.group is not None:
289
330
self.group.Reset()
331
290
332
def add(self):
291
333
"""Derived from the Avahi example code"""
292
334
self.remove()
309
351
dbus.UInt16(self.port),
310
352
avahi.string_array_to_txt_array(self.TXT))
311
353
self.group.Commit()
354
312
355
def entry_group_state_changed(self, state, error):
313
356
"""Derived from the Avahi example code"""
314
357
logger.debug("Avahi entry group state change: %i", state)
320
363
self.rename()
321
364
elif state == avahi.ENTRY_GROUP_FAILURE:
322
365
logger.critical("Avahi: Error in group state changed %s",
323
unicode(error))
324
raise AvahiGroupError("State changed: %s"
325
% unicode(error))
366
str(error))
367
raise AvahiGroupError("State changed: {!s}".format(error))
368
326
369
def cleanup(self):
327
370
"""Derived from the Avahi example code"""
328
371
if self.group is not None:
333
376
pass
334
377
self.group = None
335
378
self.remove()
379
336
380
def server_state_changed(self, state, error=None):
337
381
"""Derived from the Avahi example code"""
338
382
logger.debug("Avahi server state change: %i", state)
339
bad_states = { avahi.SERVER_INVALID:
340
"Zeroconf server invalid",
341
avahi.SERVER_REGISTERING: None,
342
avahi.SERVER_COLLISION:
343
"Zeroconf server name collision",
344
avahi.SERVER_FAILURE:
345
"Zeroconf server failure" }
383
bad_states = {
384
avahi.SERVER_INVALID: "Zeroconf server invalid",
385
avahi.SERVER_REGISTERING: None,
386
avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
avahi.SERVER_FAILURE: "Zeroconf server failure",
388
}
346
389
if state in bad_states:
347
390
if bad_states[state] is not None:
348
391
if error is None:
357
400
logger.debug("Unknown state: %r", state)
358
401
else:
359
402
logger.debug("Unknown state: %r: %r", state, error)
403
360
404
def activate(self):
361
405
"""Derived from the Avahi example code"""
362
406
if self.server is None:
366
410
follow_name_owner_changes=True),
367
411
avahi.DBUS_INTERFACE_SERVER)
368
412
self.server.connect_to_signal("StateChanged",
369
self.server_state_changed)
413
self.server_state_changed)
370
414
self.server_state_changed(self.server.GetState())
371
415
416
372
417
class AvahiServiceToSyslog(AvahiService):
373
def rename(self):
418
def rename(self, *args, **kwargs):
374
419
"""Add the new name to the syslog messages"""
375
ret = AvahiService.rename(self)
376
syslogger.setFormatter(logging.Formatter
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
420
ret = AvahiService.rename(self, *args, **kwargs)
421
syslogger.setFormatter(logging.Formatter(
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
423
.format(self.name)))
380
424
return ret
381
425
382
def timedelta_to_milliseconds(td):
383
"Convert a datetime.timedelta() to milliseconds"
384
return ((td.days * 24 * 60 * 60 * 1000)
385
+ (td.seconds * 1000)
386
+ (td.microseconds // 1000))
387
426
388
427
class Client(object):
389
428
"""A representation of a client host served by this server.
390
429
426
465
runtime_expansions: Allowed attributes for runtime expansion.
427
466
expires: datetime.datetime(); time (UTC) when a client will be
428
467
disabled, or None
468
server_settings: The server_settings dict from main()
429
469
"""
430
470
431
471
runtime_expansions = ("approval_delay", "approval_duration",
432
"created", "enabled", "fingerprint",
433
"host", "interval", "last_checked_ok",
472
"created", "enabled", "expires",
473
"fingerprint", "host", "interval",
474
"last_approval_request", "last_checked_ok",
434
475
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
446
def timeout_milliseconds(self):
447
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
449
450
def extended_timeout_milliseconds(self):
451
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
453
454
def interval_milliseconds(self):
455
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
457
458
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
476
client_defaults = {
477
"timeout": "PT5M",
478
"extended_timeout": "PT15M",
479
"interval": "PT2M",
480
"checker": "fping -q -- %%(host)s",
481
"host": "",
482
"approval_delay": "PT0S",
483
"approval_duration": "PT1S",
484
"approved_by_default": "True",
485
"enabled": "True",
486
}
487
461
488
@staticmethod
462
489
def config_parser(config):
463
490
"""Construct a new dict of client settings of this form:
478
505
client["enabled"] = config.getboolean(client_name,
479
506
"enabled")
480
507
508
# Uppercase and remove spaces from fingerprint for later
509
# comparison purposes with return value from the
510
# fingerprint() function
481
511
client["fingerprint"] = (section["fingerprint"].upper()
482
512
.replace(" ", ""))
483
513
if "secret" in section:
488
518
"rb") as secfile:
489
519
client["secret"] = secfile.read()
490
520
else:
491
raise TypeError("No secret or secfile for section %s"
492
% section)
521
raise TypeError("No secret or secfile for section {}"
522
.format(section))
493
523
client["timeout"] = string_to_delta(section["timeout"])
494
524
client["extended_timeout"] = string_to_delta(
495
525
section["extended_timeout"])
504
534
client["last_checker_status"] = -2
505
535
506
536
return settings
507
508
509
def __init__(self, settings, name = None):
510
"""Note: the 'checker' key in 'config' sets the
511
'checker_command' attribute and *not* the 'checker'
512
attribute."""
537
538
def __init__(self, settings, name = None, server_settings=None):
513
539
self.name = name
540
if server_settings is None:
541
server_settings = {}
542
self.server_settings = server_settings
514
543
# adding all client settings
515
for setting, value in settings.iteritems():
544
for setting, value in settings.items():
516
545
setattr(self, setting, value)
517
546
518
547
if self.enabled:
524
553
else:
525
554
self.last_enabled = None
526
555
self.expires = None
527
556
528
557
logger.debug("Creating client %r", self.name)
529
# Uppercase and remove spaces from fingerprint for later
530
# comparison purposes with return value from the fingerprint()
531
# function
532
558
logger.debug(" Fingerprint: %s", self.fingerprint)
533
559
self.created = settings.get("created",
534
560
datetime.datetime.utcnow())
535
561
536
562
# attributes specific for this server instance
537
563
self.checker = None
538
564
self.checker_initiator_tag = None
541
567
self.current_checker_command = None
542
568
self.approved = None
543
569
self.approvals_pending = 0
544
self.changedstate = (multiprocessing_manager
545
.Condition(multiprocessing_manager
546
.Lock()))
547
self.client_structure = [attr for attr in
548
self.__dict__.iterkeys()
570
self.changedstate = multiprocessing_manager.Condition(
571
multiprocessing_manager.Lock())
572
self.client_structure = [attr
573
for attr in self.__dict__.iterkeys()
549
574
if not attr.startswith("_")]
550
575
self.client_structure.append("client_structure")
551
576
552
for name, t in inspect.getmembers(type(self),
553
lambda obj:
554
isinstance(obj,
555
property)):
577
for name, t in inspect.getmembers(
578
type(self), lambda obj: isinstance(obj, property)):
556
579
if not name.startswith("_"):
557
580
self.client_structure.append(name)
558
581
566
589
if getattr(self, "enabled", False):
567
590
# Already enabled
568
591
return
569
self.send_changedstate()
570
592
self.expires = datetime.datetime.utcnow() + self.timeout
571
593
self.enabled = True
572
594
self.last_enabled = datetime.datetime.utcnow()
573
595
self.init_checker()
596
self.send_changedstate()
574
597
575
598
def disable(self, quiet=True):
576
599
"""Disable this client."""
577
600
if not getattr(self, "enabled", False):
578
601
return False
579
602
if not quiet:
580
self.send_changedstate()
581
if not quiet:
582
603
logger.info("Disabling client %s", self.name)
583
if getattr(self, "disable_initiator_tag", False):
604
if getattr(self, "disable_initiator_tag", None) is not None:
584
605
gobject.source_remove(self.disable_initiator_tag)
585
606
self.disable_initiator_tag = None
586
607
self.expires = None
587
if getattr(self, "checker_initiator_tag", False):
608
if getattr(self, "checker_initiator_tag", None) is not None:
588
609
gobject.source_remove(self.checker_initiator_tag)
589
610
self.checker_initiator_tag = None
590
611
self.stop_checker()
591
612
self.enabled = False
613
if not quiet:
614
self.send_changedstate()
592
615
# Do not run this again if called by a gobject.timeout_add
593
616
return False
594
617
598
621
def init_checker(self):
599
622
# Schedule a new checker to be started an 'interval' from now,
600
623
# and every interval from then on.
601
self.checker_initiator_tag = (gobject.timeout_add
602
(self.interval_milliseconds(),
603
self.start_checker))
624
if self.checker_initiator_tag is not None:
625
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = gobject.timeout_add(
627
int(self.interval.total_seconds() * 1000),
628
self.start_checker)
604
629
# Schedule a disable() when 'timeout' has passed
605
self.disable_initiator_tag = (gobject.timeout_add
606
(self.timeout_milliseconds(),
607
self.disable))
630
if self.disable_initiator_tag is not None:
631
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = gobject.timeout_add(
633
int(self.timeout.total_seconds() * 1000), self.disable)
608
634
# Also start a new checker *right now*.
609
635
self.start_checker()
610
636
619
645
vars(self))
620
646
self.checked_ok()
621
647
else:
622
logger.info("Checker for %(name)s failed",
623
vars(self))
648
logger.info("Checker for %(name)s failed", vars(self))
624
649
else:
625
650
self.last_checker_status = -1
626
651
logger.warning("Checker for %(name)s crashed?",
638
663
timeout = self.timeout
639
664
if self.disable_initiator_tag is not None:
640
665
gobject.source_remove(self.disable_initiator_tag)
666
self.disable_initiator_tag = None
641
667
if getattr(self, "enabled", False):
642
self.disable_initiator_tag = (gobject.timeout_add
643
(timedelta_to_milliseconds
644
(timeout), self.disable))
668
self.disable_initiator_tag = gobject.timeout_add(
669
int(timeout.total_seconds() * 1000), self.disable)
645
670
self.expires = datetime.datetime.utcnow() + timeout
646
671
647
672
def need_approval(self):
653
678
If a checker already exists, leave it running and do
654
679
nothing."""
655
680
# The reason for not killing a running checker is that if we
656
# did that, then if a checker (for some reason) started
657
# running slowly and taking more than 'interval' time, the
658
# client would inevitably timeout, since no checker would get
659
# a chance to run to completion. If we instead leave running
681
# did that, and if a checker (for some reason) started running
682
# slowly and taking more than 'interval' time, then the client
683
# would inevitably timeout, since no checker would get a
684
# chance to run to completion. If we instead leave running
660
685
# checkers alone, the checker would have to take more time
661
686
# than 'timeout' for the client to be disabled, which is as it
662
687
# should be.
664
689
# If a checker exists, make sure it is not a zombie
665
690
try:
666
691
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
667
except (AttributeError, OSError) as error:
668
if (isinstance(error, OSError)
669
and error.errno != errno.ECHILD):
670
raise error
692
except AttributeError:
693
pass
694
except OSError as error:
695
if error.errno != errno.ECHILD:
696
raise
671
697
else:
672
698
if pid:
673
699
logger.warning("Checker was a zombie")
676
702
self.current_checker_command)
677
703
# Start a new checker if needed
678
704
if self.checker is None:
705
# Escape attributes for the shell
706
escaped_attrs = {
707
attr: re.escape(str(getattr(self, attr)))
708
for attr in self.runtime_expansions }
679
709
try:
680
# In case checker_command has exactly one % operator
681
command = self.checker_command % self.host
682
except TypeError:
683
# Escape attributes for the shell
684
escaped_attrs = dict(
685
(attr,
686
re.escape(unicode(str(getattr(self, attr, "")),
687
errors=
688
'replace')))
689
for attr in
690
self.runtime_expansions)
691
692
try:
693
command = self.checker_command % escaped_attrs
694
except TypeError as error:
695
logger.error('Could not format string "%s":'
696
' %s', self.checker_command, error)
697
return True # Try again later
710
command = self.checker_command % escaped_attrs
711
except TypeError as error:
712
logger.error('Could not format string "%s"',
713
self.checker_command,
714
exc_info=error)
715
return True # Try again later
698
716
self.current_checker_command = command
699
717
try:
700
logger.info("Starting checker %r for %s",
701
command, self.name)
718
logger.info("Starting checker %r for %s", command,
719
self.name)
702
720
# We don't need to redirect stdout and stderr, since
703
721
# in normal mode, that is already done by daemon(),
704
722
# and in debug mode we don't want to. (Stdin is
705
723
# always replaced by /dev/null.)
724
# The exception is when not debugging but nevertheless
725
# running in the foreground; use the previously
726
# created wnull.
727
popen_args = {}
728
if (not self.server_settings["debug"]
729
and self.server_settings["foreground"]):
730
popen_args.update({"stdout": wnull,
731
"stderr": wnull })
706
732
self.checker = subprocess.Popen(command,
707
733
close_fds=True,
708
shell=True, cwd="/")
709
self.checker_callback_tag = (gobject.child_watch_add
710
(self.checker.pid,
711
self.checker_callback,
712
data=command))
713
# The checker may have completed before the gobject
714
# watch was added. Check for this.
734
shell=True,
735
cwd="/",
736
**popen_args)
737
except OSError as error:
738
logger.error("Failed to start subprocess",
739
exc_info=error)
740
return True
741
self.checker_callback_tag = gobject.child_watch_add(
742
self.checker.pid, self.checker_callback, data=command)
743
# The checker may have completed before the gobject
744
# watch was added. Check for this.
745
try:
715
746
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
716
if pid:
717
gobject.source_remove(self.checker_callback_tag)
718
self.checker_callback(pid, status, command)
719
747
except OSError as error:
720
logger.error("Failed to start subprocess: %s",
721
error)
748
if error.errno == errno.ECHILD:
749
# This should never happen
750
logger.error("Child process vanished",
751
exc_info=error)
752
return True
753
raise
754
if pid:
755
gobject.source_remove(self.checker_callback_tag)
756
self.checker_callback(pid, status, command)
722
757
# Re-run this periodically if run by gobject.timeout_add
723
758
return True
724
759
731
766
return
732
767
logger.debug("Stopping checker for %(name)s", vars(self))
733
768
try:
734
os.kill(self.checker.pid, signal.SIGTERM)
769
self.checker.terminate()
735
770
#time.sleep(0.5)
736
771
#if self.checker.poll() is None:
737
# os.kill(self.checker.pid, signal.SIGKILL)
772
# self.checker.kill()
738
773
except OSError as error:
739
774
if error.errno != errno.ESRCH: # No such process
740
775
raise
741
776
self.checker = None
742
777
743
778
744
def dbus_service_property(dbus_interface, signature="v",
745
access="readwrite", byte_arrays=False):
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
746
783
"""Decorators for marking methods of a DBusObjectWithProperties to
747
784
become properties on the D-Bus.
748
785
757
794
# "Set" method, so we fail early here:
758
795
if byte_arrays and signature != "ay":
759
796
raise ValueError("Byte arrays not supported for non-'ay'"
760
" signature %r" % signature)
797
" signature {!r}".format(signature))
798
761
799
def decorator(func):
762
800
func._dbus_is_property = True
763
801
func._dbus_interface = dbus_interface
768
806
func._dbus_name = func._dbus_name[:-14]
769
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
770
808
return func
809
810
return decorator
811
812
813
def dbus_interface_annotations(dbus_interface):
814
"""Decorator for marking functions returning interface annotations
815
816
Usage:
817
818
@dbus_interface_annotations("org.example.Interface")
819
def _foo(self): # Function name does not matter
820
return {"org.freedesktop.DBus.Deprecated": "true",
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
822
"false"}
823
"""
824
825
def decorator(func):
826
func._dbus_is_interface = True
827
func._dbus_interface = dbus_interface
828
func._dbus_name = dbus_interface
829
return func
830
831
return decorator
832
833
834
def dbus_annotations(annotations):
835
"""Decorator to annotate D-Bus methods, signals or properties
836
Usage:
837
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
@dbus_service_property("org.example.Interface", signature="b",
842
access="r")
843
def Property_dbus_property(self):
844
return dbus.Boolean(False)
845
"""
846
847
def decorator(func):
848
func._dbus_annotations = annotations
849
return func
850
771
851
return decorator
772
852
773
853
774
854
class DBusPropertyException(dbus.exceptions.DBusException):
775
855
"""A base class for D-Bus property-related exceptions
776
856
"""
777
def __unicode__(self):
778
return unicode(str(self))
857
pass
779
858
780
859
781
860
class DBusPropertyAccessException(DBusPropertyException):
799
878
"""
800
879
801
880
@staticmethod
802
def _is_dbus_property(obj):
803
return getattr(obj, "_dbus_is_property", False)
881
def _is_dbus_thing(thing):
882
"""Returns a function testing if an attribute is a D-Bus thing
883
884
If called like _is_dbus_thing("method") it returns a function
885
suitable for use as predicate to inspect.getmembers().
886
"""
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
888
False)
804
889
805
def _get_all_dbus_properties(self):
890
def _get_all_dbus_things(self, thing):
806
891
"""Returns a generator of (name, attribute) pairs
807
892
"""
808
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
894
athing.__get__(self))
809
895
for cls in self.__class__.__mro__
810
for name, prop in
811
inspect.getmembers(cls, self._is_dbus_property))
896
for name, athing in
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
812
898
813
899
def _get_dbus_property(self, interface_name, property_name):
814
900
"""Returns a bound method if one exists which is a D-Bus
815
901
property with the specified name and interface.
816
902
"""
817
for cls in self.__class__.__mro__:
818
for name, value in (inspect.getmembers
819
(cls, self._is_dbus_property)):
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
820
906
if (value._dbus_name == property_name
821
907
and value._dbus_interface == interface_name):
822
908
return value.__get__(self)
823
909
824
910
# No such property
825
raise DBusPropertyNotFound(self.dbus_object_path + ":"
826
+ interface_name + "."
827
+ property_name)
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
828
913
829
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
915
in_signature="ss",
830
916
out_signature="v")
831
917
def Get(self, interface_name, property_name):
832
918
"""Standard D-Bus property Get() method, see D-Bus standard.
850
936
# The byte_arrays option is not supported yet on
851
937
# signatures other than "ay".
852
938
if prop._dbus_signature != "ay":
853
raise ValueError
939
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {!r}"
941
.format(prop._dbus_signature))
854
942
value = dbus.ByteArray(b''.join(chr(byte)
855
943
for byte in value))
856
944
prop(value)
857
945
858
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
947
in_signature="s",
859
948
out_signature="a{sv}")
860
949
def GetAll(self, interface_name):
861
950
"""Standard D-Bus property GetAll() method, see D-Bus
864
953
Note: Will not include properties with access="write".
865
954
"""
866
955
properties = {}
867
for name, prop in self._get_all_dbus_properties():
956
for name, prop in self._get_all_dbus_things("property"):
868
957
if (interface_name
869
958
and interface_name != prop._dbus_interface):
870
959
# Interface non-empty but did not match
876
965
if not hasattr(value, "variant_level"):
877
966
properties[name] = value
878
967
continue
879
properties[name] = type(value)(value, variant_level=
880
value.variant_level+1)
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
881
970
return dbus.Dictionary(properties, signature="sv")
882
971
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
def PropertiesChanged(self, interface_name, changed_properties,
974
invalidated_properties):
975
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
976
standard.
977
"""
978
pass
979
883
980
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
884
981
out_signature="s",
885
982
path_keyword='object_path',
886
983
connection_keyword='connection')
887
984
def Introspect(self, object_path, connection):
888
"""Standard D-Bus method, overloaded to insert property tags.
985
"""Overloading of standard D-Bus method.
986
987
Inserts property tags and interface annotation tags.
889
988
"""
890
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
891
990
connection)
892
991
try:
893
992
document = xml.dom.minidom.parseString(xmlstring)
993
894
994
def make_tag(document, name, prop):
895
995
e = document.createElement("property")
896
996
e.setAttribute("name", name)
897
997
e.setAttribute("type", prop._dbus_signature)
898
998
e.setAttribute("access", prop._dbus_access)
899
999
return e
1000
900
1001
for if_tag in document.getElementsByTagName("interface"):
1002
# Add property tags
901
1003
for tag in (make_tag(document, name, prop)
902
1004
for name, prop
903
in self._get_all_dbus_properties()
1005
in self._get_all_dbus_things("property")
904
1006
if prop._dbus_interface
905
1007
== if_tag.getAttribute("name")):
906
1008
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1012
annots = dict()
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1022
"annotation")
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1033
)).items():
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
907
1038
# Add the names to the return values for the
908
1039
# "org.freedesktop.DBus.Properties" methods
909
1040
if (if_tag.getAttribute("name")
924
1055
except (AttributeError, xml.dom.DOMException,
925
1056
xml.parsers.expat.ExpatError) as error:
926
1057
logger.error("Failed to override Introspection method",
927
error)
1058
exc_info=error)
928
1059
return xmlstring
929
1060
930
1061
931
def datetime_to_dbus (dt, variant_level=0):
1062
def datetime_to_dbus(dt, variant_level=0):
932
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
933
1064
if dt is None:
934
1065
return dbus.String("", variant_level = variant_level)
935
return dbus.String(dt.isoformat(),
936
variant_level=variant_level)
937
938
939
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
940
.__metaclass__):
941
"""Applied to an empty subclass of a D-Bus object, this metaclass
942
will add additional D-Bus attributes matching a certain pattern.
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1067
1068
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
"""A class decorator; applied to a subclass of
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1072
interface names according to the "alt_interface_names" mapping.
1073
Usage:
1074
1075
@alternate_dbus_interfaces({"org.example.Interface":
1076
"net.example.AlternateInterface"})
1077
class SampleDBusObject(dbus.service.Object):
1078
@dbus.service.method("org.example.Interface")
1079
def SampleDBusMethod():
1080
pass
1081
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
reachable via two interfaces: "org.example.Interface" and
1084
"net.example.AlternateInterface", the latter of which will have
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
"true", unless "deprecate" is passed with a False value.
1087
1088
This works for methods and signals, and also for D-Bus properties
1089
(from DBusObjectWithProperties) and interfaces (from the
1090
dbus_interface_annotations decorator).
943
1091
"""
944
def __new__(mcs, name, bases, attr):
945
# Go through all the base classes which could have D-Bus
946
# methods, signals, or properties in them
947
for base in (b for b in bases
948
if issubclass(b, dbus.service.Object)):
949
# Go though all attributes of the base class
950
for attrname, attribute in inspect.getmembers(base):
1092
1093
def wrapper(cls):
1094
for orig_interface_name, alt_interface_name in (
1095
alt_interface_names.items()):
1096
attr = {}
1097
interface_names = set()
1098
# Go though all attributes of the class
1099
for attrname, attribute in inspect.getmembers(cls):
951
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
952
1101
# with the wrong interface name
953
1102
if (not hasattr(attribute, "_dbus_interface")
954
or not attribute._dbus_interface
955
.startswith("se.recompile.Mandos")):
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
956
1105
continue
957
1106
# Create an alternate D-Bus interface name based on
958
1107
# the current name
959
alt_interface = (attribute._dbus_interface
960
.replace("se.recompile.Mandos",
961
"se.bsnet.fukt.Mandos"))
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1110
interface_names.add(alt_interface)
962
1111
# Is this a D-Bus signal?
963
1112
if getattr(attribute, "_dbus_is_signal", False):
964
# Extract the original non-method function by
965
# black magic
1113
# Extract the original non-method undecorated
1114
# function by black magic
966
1115
nonmethod_func = (dict(
967
zip(attribute.func_code.co_freevars,
968
attribute.__closure__))["func"]
969
.cell_contents)
1116
zip(attribute.func_code.co_freevars,
1117
attribute.__closure__))
1118
["func"].cell_contents)
970
1119
# Create a new, but exactly alike, function
971
1120
# object, and decorate it to be a new D-Bus signal
972
1121
# with the alternate D-Bus interface name
973
new_function = (dbus.service.signal
974
(alt_interface,
975
attribute._dbus_signature)
1122
new_function = (dbus.service.signal(
1123
alt_interface, attribute._dbus_signature)
976
1124
(types.FunctionType(
977
nonmethod_func.func_code,
978
nonmethod_func.func_globals,
979
nonmethod_func.func_name,
980
nonmethod_func.func_defaults,
981
nonmethod_func.func_closure)))
1125
nonmethod_func.func_code,
1126
nonmethod_func.func_globals,
1127
nonmethod_func.func_name,
1128
nonmethod_func.func_defaults,
1129
nonmethod_func.func_closure)))
1130
# Copy annotations, if any
1131
try:
1132
new_function._dbus_annotations = dict(
1133
attribute._dbus_annotations)
1134
except AttributeError:
1135
pass
982
1136
# Define a creator of a function to call both the
983
# old and new functions, so both the old and new
984
# signals gets sent when the function is called
1137
# original and alternate functions, so both the
1138
# original and alternate signals gets sent when
1139
# the function is called
985
1140
def fixscope(func1, func2):
986
1141
"""This function is a scope container to pass
987
1142
func1 and func2 to the "call_both" function
988
1143
outside of its arguments"""
1144
989
1145
def call_both(*args, **kwargs):
990
1146
"""This function will emit two D-Bus
991
1147
signals by calling func1 and func2"""
992
1148
func1(*args, **kwargs)
993
1149
func2(*args, **kwargs)
1150
994
1151
return call_both
995
1152
# Create the "call_both" function and add it to
996
1153
# the class
997
attr[attrname] = fixscope(attribute,
998
new_function)
1154
attr[attrname] = fixscope(attribute, new_function)
999
1155
# Is this a D-Bus method?
1000
1156
elif getattr(attribute, "_dbus_is_method", False):
1001
1157
# Create a new, but exactly alike, function
1002
1158
# object. Decorate it to be a new D-Bus method
1003
1159
# with the alternate D-Bus interface name. Add it
1004
1160
# to the class.
1005
attr[attrname] = (dbus.service.method
1006
(alt_interface,
1007
attribute._dbus_in_signature,
1008
attribute._dbus_out_signature)
1009
(types.FunctionType
1010
(attribute.func_code,
1011
attribute.func_globals,
1012
attribute.func_name,
1013
attribute.func_defaults,
1014
attribute.func_closure)))
1161
attr[attrname] = (
1162
dbus.service.method(
1163
alt_interface,
1164
attribute._dbus_in_signature,
1165
attribute._dbus_out_signature)
1166
(types.FunctionType(attribute.func_code,
1167
attribute.func_globals,
1168
attribute.func_name,
1169
attribute.func_defaults,
1170
attribute.func_closure)))
1171
# Copy annotations, if any
1172
try:
1173
attr[attrname]._dbus_annotations = dict(
1174
attribute._dbus_annotations)
1175
except AttributeError:
1176
pass
1015
1177
# Is this a D-Bus property?
1016
1178
elif getattr(attribute, "_dbus_is_property", False):
1017
1179
# Create a new, but exactly alike, function
1018
1180
# object, and decorate it to be a new D-Bus
1019
1181
# property with the alternate D-Bus interface
1020
1182
# name. Add it to the class.
1021
attr[attrname] = (dbus_service_property
1022
(alt_interface,
1023
attribute._dbus_signature,
1024
attribute._dbus_access,
1025
attribute
1026
._dbus_get_args_options
1027
["byte_arrays"])
1028
(types.FunctionType
1029
(attribute.func_code,
1030
attribute.func_globals,
1031
attribute.func_name,
1032
attribute.func_defaults,
1033
attribute.func_closure)))
1034
return type.__new__(mcs, name, bases, attr)
1035
1036
1183
attr[attrname] = (dbus_service_property(
1184
alt_interface, attribute._dbus_signature,
1185
attribute._dbus_access,
1186
attribute._dbus_get_args_options
1187
["byte_arrays"])
1188
(types.FunctionType(
1189
attribute.func_code,
1190
attribute.func_globals,
1191
attribute.func_name,
1192
attribute.func_defaults,
1193
attribute.func_closure)))
1194
# Copy annotations, if any
1195
try:
1196
attr[attrname]._dbus_annotations = dict(
1197
attribute._dbus_annotations)
1198
except AttributeError:
1199
pass
1200
# Is this a D-Bus interface?
1201
elif getattr(attribute, "_dbus_is_interface", False):
1202
# Create a new, but exactly alike, function
1203
# object. Decorate it to be a new D-Bus interface
1204
# with the alternate D-Bus interface name. Add it
1205
# to the class.
1206
attr[attrname] = (
1207
dbus_interface_annotations(alt_interface)
1208
(types.FunctionType(attribute.func_code,
1209
attribute.func_globals,
1210
attribute.func_name,
1211
attribute.func_defaults,
1212
attribute.func_closure)))
1213
if deprecate:
1214
# Deprecate all alternate interfaces
1215
iname="_AlternateDBusNames_interface_annotation{}"
1216
for interface_name in interface_names:
1217
1218
@dbus_interface_annotations(interface_name)
1219
def func(self):
1220
return { "org.freedesktop.DBus.Deprecated":
1221
"true" }
1222
# Find an unused name
1223
for aname in (iname.format(i)
1224
for i in itertools.count()):
1225
if aname not in attr:
1226
attr[aname] = func
1227
break
1228
if interface_names:
1229
# Replace the class with a new subclass of it with
1230
# methods, signals, etc. as created above.
1231
cls = type(b"{}Alternate".format(cls.__name__),
1232
(cls, ), attr)
1233
return cls
1234
1235
return wrapper
1236
1237
1238
@alternate_dbus_interfaces({"se.recompile.Mandos":
1239
"se.bsnet.fukt.Mandos"})
1037
1240
class ClientDBus(Client, DBusObjectWithProperties):
1038
1241
"""A Client class using D-Bus
1039
1242
1043
1246
"""
1044
1247
1045
1248
runtime_expansions = (Client.runtime_expansions
1046
+ ("dbus_object_path",))
1249
+ ("dbus_object_path", ))
1250
1251
_interface = "se.recompile.Mandos.Client"
1047
1252
1048
1253
# dbus.service.Object doesn't use super(), so we can't either.
1049
1254
1052
1257
Client.__init__(self, *args, **kwargs)
1053
1258
# Only now, when this client is initialized, can it show up on
1054
1259
# the D-Bus
1055
client_object_name = unicode(self.name).translate(
1260
client_object_name = str(self.name).translate(
1056
1261
{ord("."): ord("_"),
1057
1262
ord("-"): ord("_")})
1058
self.dbus_object_path = (dbus.ObjectPath
1059
("/clients/" + client_object_name))
1263
self.dbus_object_path = dbus.ObjectPath(
1264
"/clients/" + client_object_name)
1060
1265
DBusObjectWithProperties.__init__(self, self.bus,
1061
1266
self.dbus_object_path)
1062
1063
def notifychangeproperty(transform_func,
1064
dbus_name, type_func=lambda x: x,
1065
variant_level=1):
1267
1268
def notifychangeproperty(transform_func, dbus_name,
1269
type_func=lambda x: x,
1270
variant_level=1,
1271
invalidate_only=False,
1272
_interface=_interface):
1066
1273
""" Modify a variable so that it's a property which announces
1067
1274
its changes to DBus.
1068
1275
1073
1280
to the D-Bus. Default: no transform
1074
1281
variant_level: D-Bus variant level. Default: 1
1075
1282
"""
1076
attrname = "_{0}".format(dbus_name)
1283
attrname = "_{}".format(dbus_name)
1284
1077
1285
def setter(self, value):
1078
1286
if hasattr(self, "dbus_object_path"):
1079
1287
if (not hasattr(self, attrname) or
1080
1288
type_func(getattr(self, attrname, None))
1081
1289
!= type_func(value)):
1082
dbus_value = transform_func(type_func(value),
1083
variant_level
1084
=variant_level)
1085
self.PropertyChanged(dbus.String(dbus_name),
1086
dbus_value)
1290
if invalidate_only:
1291
self.PropertiesChanged(
1292
_interface, dbus.Dictionary(),
1293
dbus.Array((dbus_name, )))
1294
else:
1295
dbus_value = transform_func(
1296
type_func(value),
1297
variant_level = variant_level)
1298
self.PropertyChanged(dbus.String(dbus_name),
1299
dbus_value)
1300
self.PropertiesChanged(
1301
_interface,
1302
dbus.Dictionary({ dbus.String(dbus_name):
1303
dbus_value }),
1304
dbus.Array())
1087
1305
setattr(self, attrname, value)
1088
1306
1089
1307
return property(lambda self: getattr(self, attrname), setter)
1090
1308
1091
1092
1309
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1093
1310
approvals_pending = notifychangeproperty(dbus.Boolean,
1094
1311
"ApprovalPending",
1096
1313
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1097
1314
last_enabled = notifychangeproperty(datetime_to_dbus,
1098
1315
"LastEnabled")
1099
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1100
type_func = lambda checker:
1101
checker is not None)
1316
checker = notifychangeproperty(
1317
dbus.Boolean, "CheckerRunning",
1318
type_func = lambda checker: checker is not None)
1102
1319
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1103
1320
"LastCheckedOK")
1104
1321
last_checker_status = notifychangeproperty(dbus.Int16,
1107
1324
datetime_to_dbus, "LastApprovalRequest")
1108
1325
approved_by_default = notifychangeproperty(dbus.Boolean,
1109
1326
"ApprovedByDefault")
1110
approval_delay = notifychangeproperty(dbus.UInt64,
1111
"ApprovalDelay",
1112
type_func =
1113
timedelta_to_milliseconds)
1327
approval_delay = notifychangeproperty(
1328
dbus.UInt64, "ApprovalDelay",
1329
type_func = lambda td: td.total_seconds() * 1000)
1114
1330
approval_duration = notifychangeproperty(
1115
1331
dbus.UInt64, "ApprovalDuration",
1116
type_func = timedelta_to_milliseconds)
1332
type_func = lambda td: td.total_seconds() * 1000)
1117
1333
host = notifychangeproperty(dbus.String, "Host")
1118
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1119
type_func =
1120
timedelta_to_milliseconds)
1334
timeout = notifychangeproperty(
1335
dbus.UInt64, "Timeout",
1336
type_func = lambda td: td.total_seconds() * 1000)
1121
1337
extended_timeout = notifychangeproperty(
1122
1338
dbus.UInt64, "ExtendedTimeout",
1123
type_func = timedelta_to_milliseconds)
1124
interval = notifychangeproperty(dbus.UInt64,
1125
"Interval",
1126
type_func =
1127
timedelta_to_milliseconds)
1339
type_func = lambda td: td.total_seconds() * 1000)
1340
interval = notifychangeproperty(
1341
dbus.UInt64, "Interval",
1342
type_func = lambda td: td.total_seconds() * 1000)
1128
1343
checker_command = notifychangeproperty(dbus.String, "Checker")
1344
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1345
invalidate_only=True)
1129
1346
1130
1347
del notifychangeproperty
1131
1348
1158
1375
*args, **kwargs)
1159
1376
1160
1377
def start_checker(self, *args, **kwargs):
1161
old_checker = self.checker
1162
if self.checker is not None:
1163
old_checker_pid = self.checker.pid
1164
else:
1165
old_checker_pid = None
1378
old_checker_pid = getattr(self.checker, "pid", None)
1166
1379
r = Client.start_checker(self, *args, **kwargs)
1167
1380
# Only if new checker process was started
1168
1381
if (self.checker is not None
1176
1389
return False
1177
1390
1178
1391
def approve(self, value=True):
1179
self.send_changedstate()
1180
1392
self.approved = value
1181
gobject.timeout_add(timedelta_to_milliseconds
1182
(self.approval_duration),
1183
self._reset_approved)
1184
1393
gobject.timeout_add(int(self.approval_duration.total_seconds()
1394
* 1000), self._reset_approved)
1395
self.send_changedstate()
1185
1396
1186
1397
## D-Bus methods, signals & properties
1187
_interface = "se.recompile.Mandos.Client"
1398
1399
## Interfaces
1188
1400
1189
1401
## Signals
1190
1402
1201
1413
pass
1202
1414
1203
1415
# PropertyChanged - signal
1416
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1204
1417
@dbus.service.signal(_interface, signature="sv")
1205
1418
def PropertyChanged(self, property, value):
1206
1419
"D-Bus signal"
1270
1483
return dbus.Boolean(bool(self.approvals_pending))
1271
1484
1272
1485
# ApprovedByDefault - property
1273
@dbus_service_property(_interface, signature="b",
1486
@dbus_service_property(_interface,
1487
signature="b",
1274
1488
access="readwrite")
1275
1489
def ApprovedByDefault_dbus_property(self, value=None):
1276
1490
if value is None: # get
1278
1492
self.approved_by_default = bool(value)
1279
1493
1280
1494
# ApprovalDelay - property
1281
@dbus_service_property(_interface, signature="t",
1495
@dbus_service_property(_interface,
1496
signature="t",
1282
1497
access="readwrite")
1283
1498
def ApprovalDelay_dbus_property(self, value=None):
1284
1499
if value is None: # get
1285
return dbus.UInt64(self.approval_delay_milliseconds())
1500
return dbus.UInt64(self.approval_delay.total_seconds()
1501
* 1000)
1286
1502
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1287
1503
1288
1504
# ApprovalDuration - property
1289
@dbus_service_property(_interface, signature="t",
1505
@dbus_service_property(_interface,
1506
signature="t",
1290
1507
access="readwrite")
1291
1508
def ApprovalDuration_dbus_property(self, value=None):
1292
1509
if value is None: # get
1293
return dbus.UInt64(timedelta_to_milliseconds(
1294
self.approval_duration))
1510
return dbus.UInt64(self.approval_duration.total_seconds()
1511
* 1000)
1295
1512
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1296
1513
1297
1514
# Name - property
1305
1522
return dbus.String(self.fingerprint)
1306
1523
1307
1524
# Host - property
1308
@dbus_service_property(_interface, signature="s",
1525
@dbus_service_property(_interface,
1526
signature="s",
1309
1527
access="readwrite")
1310
1528
def Host_dbus_property(self, value=None):
1311
1529
if value is None: # get
1312
1530
return dbus.String(self.host)
1313
self.host = unicode(value)
1531
self.host = str(value)
1314
1532
1315
1533
# Created - property
1316
1534
@dbus_service_property(_interface, signature="s", access="read")
1323
1541
return datetime_to_dbus(self.last_enabled)
1324
1542
1325
1543
# Enabled - property
1326
@dbus_service_property(_interface, signature="b",
1544
@dbus_service_property(_interface,
1545
signature="b",
1327
1546
access="readwrite")
1328
1547
def Enabled_dbus_property(self, value=None):
1329
1548
if value is None: # get
1334
1553
self.disable()
1335
1554
1336
1555
# LastCheckedOK - property
1337
@dbus_service_property(_interface, signature="s",
1556
@dbus_service_property(_interface,
1557
signature="s",
1338
1558
access="readwrite")
1339
1559
def LastCheckedOK_dbus_property(self, value=None):
1340
1560
if value is not None:
1343
1563
return datetime_to_dbus(self.last_checked_ok)
1344
1564
1345
1565
# LastCheckerStatus - property
1346
@dbus_service_property(_interface, signature="n",
1347
access="read")
1566
@dbus_service_property(_interface, signature="n", access="read")
1348
1567
def LastCheckerStatus_dbus_property(self):
1349
1568
return dbus.Int16(self.last_checker_status)
1350
1569
1359
1578
return datetime_to_dbus(self.last_approval_request)
1360
1579
1361
1580
# Timeout - property
1362
@dbus_service_property(_interface, signature="t",
1581
@dbus_service_property(_interface,
1582
signature="t",
1363
1583
access="readwrite")
1364
1584
def Timeout_dbus_property(self, value=None):
1365
1585
if value is None: # get
1366
return dbus.UInt64(self.timeout_milliseconds())
1586
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1587
old_timeout = self.timeout
1367
1588
self.timeout = datetime.timedelta(0, 0, 0, value)
1368
# Reschedule timeout
1589
# Reschedule disabling
1369
1590
if self.enabled:
1370
1591
now = datetime.datetime.utcnow()
1371
time_to_die = timedelta_to_milliseconds(
1372
(self.last_checked_ok + self.timeout) - now)
1373
if time_to_die <= 0:
1592
self.expires += self.timeout - old_timeout
1593
if self.expires <= now:
1374
1594
# The timeout has passed
1375
1595
self.disable()
1376
1596
else:
1377
self.expires = (now +
1378
datetime.timedelta(milliseconds =
1379
time_to_die))
1380
1597
if (getattr(self, "disable_initiator_tag", None)
1381
1598
is None):
1382
1599
return
1383
1600
gobject.source_remove(self.disable_initiator_tag)
1384
self.disable_initiator_tag = (gobject.timeout_add
1385
(time_to_die,
1386
self.disable))
1601
self.disable_initiator_tag = gobject.timeout_add(
1602
int((self.expires - now).total_seconds() * 1000),
1603
self.disable)
1387
1604
1388
1605
# ExtendedTimeout - property
1389
@dbus_service_property(_interface, signature="t",
1606
@dbus_service_property(_interface,
1607
signature="t",
1390
1608
access="readwrite")
1391
1609
def ExtendedTimeout_dbus_property(self, value=None):
1392
1610
if value is None: # get
1393
return dbus.UInt64(self.extended_timeout_milliseconds())
1611
return dbus.UInt64(self.extended_timeout.total_seconds()
1612
* 1000)
1394
1613
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1395
1614
1396
1615
# Interval - property
1397
@dbus_service_property(_interface, signature="t",
1616
@dbus_service_property(_interface,
1617
signature="t",
1398
1618
access="readwrite")
1399
1619
def Interval_dbus_property(self, value=None):
1400
1620
if value is None: # get
1401
return dbus.UInt64(self.interval_milliseconds())
1621
return dbus.UInt64(self.interval.total_seconds() * 1000)
1402
1622
self.interval = datetime.timedelta(0, 0, 0, value)
1403
1623
if getattr(self, "checker_initiator_tag", None) is None:
1404
1624
return
1405
1625
if self.enabled:
1406
1626
# Reschedule checker run
1407
1627
gobject.source_remove(self.checker_initiator_tag)
1408
self.checker_initiator_tag = (gobject.timeout_add
1409
(value, self.start_checker))
1410
self.start_checker() # Start one now, too
1628
self.checker_initiator_tag = gobject.timeout_add(
1629
value, self.start_checker)
1630
self.start_checker() # Start one now, too
1411
1631
1412
1632
# Checker - property
1413
@dbus_service_property(_interface, signature="s",
1633
@dbus_service_property(_interface,
1634
signature="s",
1414
1635
access="readwrite")
1415
1636
def Checker_dbus_property(self, value=None):
1416
1637
if value is None: # get
1417
1638
return dbus.String(self.checker_command)
1418
self.checker_command = unicode(value)
1639
self.checker_command = str(value)
1419
1640
1420
1641
# CheckerRunning - property
1421
@dbus_service_property(_interface, signature="b",
1642
@dbus_service_property(_interface,
1643
signature="b",
1422
1644
access="readwrite")
1423
1645
def CheckerRunning_dbus_property(self, value=None):
1424
1646
if value is None: # get
1434
1656
return self.dbus_object_path # is already a dbus.ObjectPath
1435
1657
1436
1658
# Secret = property
1437
@dbus_service_property(_interface, signature="ay",
1438
access="write", byte_arrays=True)
1659
@dbus_service_property(_interface,
1660
signature="ay",
1661
access="write",
1662
byte_arrays=True)
1439
1663
def Secret_dbus_property(self, value):
1440
self.secret = str(value)
1664
self.secret = bytes(value)
1441
1665
1442
1666
del _interface
1443
1667
1457
1681
if data[0] == 'data':
1458
1682
return data[1]
1459
1683
if data[0] == 'function':
1684
1460
1685
def func(*args, **kwargs):
1461
1686
self._pipe.send(('funcall', name, args, kwargs))
1462
1687
return self._pipe.recv()[1]
1688
1463
1689
return func
1464
1690
1465
1691
def __setattr__(self, name, value):
1468
1694
self._pipe.send(('setattr', name, value))
1469
1695
1470
1696
1471
class ClientDBusTransitional(ClientDBus):
1472
__metaclass__ = AlternateDBusNamesMetaclass
1473
1474
1475
1697
class ClientHandler(socketserver.BaseRequestHandler, object):
1476
1698
"""A class to handle client connections.
1477
1699
1481
1703
def handle(self):
1482
1704
with contextlib.closing(self.server.child_pipe) as child_pipe:
1483
1705
logger.info("TCP connection from: %s",
1484
unicode(self.client_address))
1706
str(self.client_address))
1485
1707
logger.debug("Pipe FD: %d",
1486
1708
self.server.child_pipe.fileno())
1487
1709
1488
session = (gnutls.connection
1489
.ClientSession(self.request,
1490
gnutls.connection
1491
.X509Credentials()))
1710
session = gnutls.connection.ClientSession(
1711
self.request, gnutls.connection .X509Credentials())
1492
1712
1493
1713
# Note: gnutls.connection.X509Credentials is really a
1494
1714
# generic GnuTLS certificate credentials object so long as
1503
1723
priority = self.server.gnutls_priority
1504
1724
if priority is None:
1505
1725
priority = "NORMAL"
1506
(gnutls.library.functions
1507
.gnutls_priority_set_direct(session._c_object,
1508
priority, None))
1726
gnutls.library.functions.gnutls_priority_set_direct(
1727
session._c_object, priority, None)
1509
1728
1510
1729
# Start communication using the Mandos protocol
1511
1730
# Get protocol number
1513
1732
logger.debug("Protocol version: %r", line)
1514
1733
try:
1515
1734
if int(line.strip().split()[0]) > 1:
1516
raise RuntimeError
1735
raise RuntimeError(line)
1517
1736
except (ValueError, IndexError, RuntimeError) as error:
1518
1737
logger.error("Unknown protocol version: %s", error)
1519
1738
return
1531
1750
approval_required = False
1532
1751
try:
1533
1752
try:
1534
fpr = self.fingerprint(self.peer_certificate
1535
(session))
1753
fpr = self.fingerprint(
1754
self.peer_certificate(session))
1536
1755
except (TypeError,
1537
1756
gnutls.errors.GNUTLSError) as error:
1538
1757
logger.warning("Bad certificate: %s", error)
1553
1772
while True:
1554
1773
if not client.enabled:
1555
1774
logger.info("Client %s is disabled",
1556
client.name)
1775
client.name)
1557
1776
if self.server.use_dbus:
1558
1777
# Emit D-Bus signal
1559
1778
client.Rejected("Disabled")
1568
1787
if self.server.use_dbus:
1569
1788
# Emit D-Bus signal
1570
1789
client.NeedApproval(
1571
client.approval_delay_milliseconds(),
1572
client.approved_by_default)
1790
client.approval_delay.total_seconds()
1791
* 1000, client.approved_by_default)
1573
1792
else:
1574
1793
logger.warning("Client %s was not approved",
1575
1794
client.name)
1581
1800
#wait until timeout or approved
1582
1801
time = datetime.datetime.now()
1583
1802
client.changedstate.acquire()
1584
(client.changedstate.wait
1585
(float(client.timedelta_to_milliseconds(delay)
1586
/ 1000)))
1803
client.changedstate.wait(delay.total_seconds())
1587
1804
client.changedstate.release()
1588
1805
time2 = datetime.datetime.now()
1589
1806
if (time2 - time) >= delay:
1605
1822
try:
1606
1823
sent = session.send(client.secret[sent_size:])
1607
1824
except gnutls.errors.GNUTLSError as error:
1608
logger.warning("gnutls send failed")
1825
logger.warning("gnutls send failed",
1826
exc_info=error)
1609
1827
return
1610
logger.debug("Sent: %d, remaining: %d",
1611
sent, len(client.secret)
1612
- (sent_size + sent))
1828
logger.debug("Sent: %d, remaining: %d", sent,
1829
len(client.secret) - (sent_size
1830
+ sent))
1613
1831
sent_size += sent
1614
1832
1615
1833
logger.info("Sending secret to %s", client.name)
1625
1843
try:
1626
1844
session.bye()
1627
1845
except gnutls.errors.GNUTLSError as error:
1628
logger.warning("GnuTLS bye failed")
1846
logger.warning("GnuTLS bye failed",
1847
exc_info=error)
1629
1848
1630
1849
@staticmethod
1631
1850
def peer_certificate(session):
1632
1851
"Return the peer's OpenPGP certificate as a bytestring"
1633
1852
# If not an OpenPGP certificate...
1634
if (gnutls.library.functions
1635
.gnutls_certificate_type_get(session._c_object)
1853
if (gnutls.library.functions.gnutls_certificate_type_get(
1854
session._c_object)
1636
1855
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1637
1856
# ...do the normal thing
1638
1857
return session.peer_certificate
1652
1871
def fingerprint(openpgp):
1653
1872
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1654
1873
# New GnuTLS "datum" with the OpenPGP public key
1655
datum = (gnutls.library.types
1656
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1657
ctypes.POINTER
1658
(ctypes.c_ubyte)),
1659
ctypes.c_uint(len(openpgp))))
1874
datum = gnutls.library.types.gnutls_datum_t(
1875
ctypes.cast(ctypes.c_char_p(openpgp),
1876
ctypes.POINTER(ctypes.c_ubyte)),
1877
ctypes.c_uint(len(openpgp)))
1660
1878
# New empty GnuTLS certificate
1661
1879
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1662
(gnutls.library.functions
1663
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1880
gnutls.library.functions.gnutls_openpgp_crt_init(
1881
ctypes.byref(crt))
1664
1882
# Import the OpenPGP public key into the certificate
1665
(gnutls.library.functions
1666
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1667
gnutls.library.constants
1668
.GNUTLS_OPENPGP_FMT_RAW))
1883
gnutls.library.functions.gnutls_openpgp_crt_import(
1884
crt, ctypes.byref(datum),
1885
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1669
1886
# Verify the self signature in the key
1670
1887
crtverify = ctypes.c_uint()
1671
(gnutls.library.functions
1672
.gnutls_openpgp_crt_verify_self(crt, 0,
1673
ctypes.byref(crtverify)))
1888
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1889
crt, 0, ctypes.byref(crtverify))
1674
1890
if crtverify.value != 0:
1675
1891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1676
raise (gnutls.errors.CertificateSecurityError
1677
("Verify failed"))
1892
raise gnutls.errors.CertificateSecurityError(
1893
"Verify failed")
1678
1894
# New buffer for the fingerprint
1679
1895
buf = ctypes.create_string_buffer(20)
1680
1896
buf_len = ctypes.c_size_t()
1681
1897
# Get the fingerprint from the certificate into the buffer
1682
(gnutls.library.functions
1683
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1684
ctypes.byref(buf_len)))
1898
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1899
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1685
1900
# Deinit the certificate
1686
1901
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1687
1902
# Convert the buffer to a Python bytestring
1693
1908
1694
1909
class MultiprocessingMixIn(object):
1695
1910
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1911
1696
1912
def sub_process_main(self, request, address):
1697
1913
try:
1698
1914
self.finish_request(request, address)
1703
1919
def process_request(self, request, address):
1704
1920
"""Start a new process to process the request."""
1705
1921
proc = multiprocessing.Process(target = self.sub_process_main,
1706
args = (request,
1707
address))
1922
args = (request, address))
1708
1923
proc.start()
1709
1924
return proc
1710
1925
1711
1926
1712
1927
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1713
1928
""" adds a pipe to the MixIn """
1929
1714
1930
def process_request(self, request, client_address):
1715
1931
"""Overrides and wraps the original process_request().
1716
1932
1725
1941
1726
1942
def add_pipe(self, parent_pipe, proc):
1727
1943
"""Dummy function; override as necessary"""
1728
raise NotImplementedError
1944
raise NotImplementedError()
1729
1945
1730
1946
1731
1947
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1737
1953
interface: None or a network interface name (string)
1738
1954
use_ipv6: Boolean; to use IPv6 or not
1739
1955
"""
1956
1740
1957
def __init__(self, server_address, RequestHandlerClass,
1741
interface=None, use_ipv6=True):
1958
interface=None,
1959
use_ipv6=True,
1960
socketfd=None):
1961
"""If socketfd is set, use that file descriptor instead of
1962
creating a new one with socket.socket().
1963
"""
1742
1964
self.interface = interface
1743
1965
if use_ipv6:
1744
1966
self.address_family = socket.AF_INET6
1967
if socketfd is not None:
1968
# Save the file descriptor
1969
self.socketfd = socketfd
1970
# Save the original socket.socket() function
1971
self.socket_socket = socket.socket
1972
# To implement --socket, we monkey patch socket.socket.
1973
#
1974
# (When socketserver.TCPServer is a new-style class, we
1975
# could make self.socket into a property instead of monkey
1976
# patching socket.socket.)
1977
#
1978
# Create a one-time-only replacement for socket.socket()
1979
@functools.wraps(socket.socket)
1980
def socket_wrapper(*args, **kwargs):
1981
# Restore original function so subsequent calls are
1982
# not affected.
1983
socket.socket = self.socket_socket
1984
del self.socket_socket
1985
# This time only, return a new socket object from the
1986
# saved file descriptor.
1987
return socket.fromfd(self.socketfd, *args, **kwargs)
1988
# Replace socket.socket() function with wrapper
1989
socket.socket = socket_wrapper
1990
# The socketserver.TCPServer.__init__ will call
1991
# socket.socket(), which might be our replacement,
1992
# socket_wrapper(), if socketfd was set.
1745
1993
socketserver.TCPServer.__init__(self, server_address,
1746
1994
RequestHandlerClass)
1995
1747
1996
def server_bind(self):
1748
1997
"""This overrides the normal server_bind() function
1749
1998
to bind to an interface if one was specified, and also NOT to
1755
2004
self.interface)
1756
2005
else:
1757
2006
try:
1758
self.socket.setsockopt(socket.SOL_SOCKET,
1759
SO_BINDTODEVICE,
1760
str(self.interface
1761
+ '\0'))
2007
self.socket.setsockopt(
2008
socket.SOL_SOCKET, SO_BINDTODEVICE,
2009
(self.interface + "\0").encode("utf-8"))
1762
2010
except socket.error as error:
1763
if error[0] == errno.EPERM:
1764
logger.error("No permission to"
1765
" bind to interface %s",
1766
self.interface)
1767
elif error[0] == errno.ENOPROTOOPT:
2011
if error.errno == errno.EPERM:
2012
logger.error("No permission to bind to"
2013
" interface %s", self.interface)
2014
elif error.errno == errno.ENOPROTOOPT:
1768
2015
logger.error("SO_BINDTODEVICE not available;"
1769
2016
" cannot bind to interface %s",
1770
2017
self.interface)
2018
elif error.errno == errno.ENODEV:
2019
logger.error("Interface %s does not exist,"
2020
" cannot bind", self.interface)
1771
2021
else:
1772
2022
raise
1773
2023
# Only bind(2) the socket if we really need to.
1776
2026
if self.address_family == socket.AF_INET6:
1777
2027
any_address = "::" # in6addr_any
1778
2028
else:
1779
any_address = socket.INADDR_ANY
2029
any_address = "0.0.0.0" # INADDR_ANY
1780
2030
self.server_address = (any_address,
1781
2031
self.server_address[1])
1782
2032
elif not self.server_address[1]:
1783
self.server_address = (self.server_address[0],
1784
0)
2033
self.server_address = (self.server_address[0], 0)
1785
2034
# if self.interface:
1786
2035
# self.server_address = (self.server_address[0],
1787
2036
# 0, # port
1801
2050
1802
2051
Assumes a gobject.MainLoop event loop.
1803
2052
"""
2053
1804
2054
def __init__(self, server_address, RequestHandlerClass,
1805
interface=None, use_ipv6=True, clients=None,
1806
gnutls_priority=None, use_dbus=True):
2055
interface=None,
2056
use_ipv6=True,
2057
clients=None,
2058
gnutls_priority=None,
2059
use_dbus=True,
2060
socketfd=None):
1807
2061
self.enabled = False
1808
2062
self.clients = clients
1809
2063
if self.clients is None:
1813
2067
IPv6_TCPServer.__init__(self, server_address,
1814
2068
RequestHandlerClass,
1815
2069
interface = interface,
1816
use_ipv6 = use_ipv6)
2070
use_ipv6 = use_ipv6,
2071
socketfd = socketfd)
2072
1817
2073
def server_activate(self):
1818
2074
if self.enabled:
1819
2075
return socketserver.TCPServer.server_activate(self)
1823
2079
1824
2080
def add_pipe(self, parent_pipe, proc):
1825
2081
# Call "handle_ipc" for both data and EOF events
1826
gobject.io_add_watch(parent_pipe.fileno(),
1827
gobject.IO_IN | gobject.IO_HUP,
1828
functools.partial(self.handle_ipc,
1829
parent_pipe =
1830
parent_pipe,
1831
proc = proc))
2082
gobject.io_add_watch(
2083
parent_pipe.fileno(),
2084
gobject.IO_IN | gobject.IO_HUP,
2085
functools.partial(self.handle_ipc,
2086
parent_pipe = parent_pipe,
2087
proc = proc))
1832
2088
1833
def handle_ipc(self, source, condition, parent_pipe=None,
1834
proc = None, client_object=None):
1835
condition_names = {
1836
gobject.IO_IN: "IN", # There is data to read.
1837
gobject.IO_OUT: "OUT", # Data can be written (without
1838
# blocking).
1839
gobject.IO_PRI: "PRI", # There is urgent data to read.
1840
gobject.IO_ERR: "ERR", # Error condition.
1841
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1842
# broken, usually for pipes and
1843
# sockets).
1844
}
1845
conditions_string = ' | '.join(name
1846
for cond, name in
1847
condition_names.iteritems()
1848
if cond & condition)
2089
def handle_ipc(self, source, condition,
2090
parent_pipe=None,
2091
proc = None,
2092
client_object=None):
1849
2093
# error, or the other end of multiprocessing.Pipe has closed
1850
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2094
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1851
2095
# Wait for other process to exit
1852
2096
proc.join()
1853
2097
return False
1874
2118
parent_pipe.send(False)
1875
2119
return False
1876
2120
1877
gobject.io_add_watch(parent_pipe.fileno(),
1878
gobject.IO_IN | gobject.IO_HUP,
1879
functools.partial(self.handle_ipc,
1880
parent_pipe =
1881
parent_pipe,
1882
proc = proc,
1883
client_object =
1884
client))
2121
gobject.io_add_watch(
2122
parent_pipe.fileno(),
2123
gobject.IO_IN | gobject.IO_HUP,
2124
functools.partial(self.handle_ipc,
2125
parent_pipe = parent_pipe,
2126
proc = proc,
2127
client_object = client))
1885
2128
parent_pipe.send(True)
1886
2129
# remove the old hook in favor of the new above hook on
1887
2130
# same fileno
1893
2136
1894
2137
parent_pipe.send(('data', getattr(client_object,
1895
2138
funcname)(*args,
1896
**kwargs)))
2139
**kwargs)))
1897
2140
1898
2141
if command == 'getattr':
1899
2142
attrname = request[1]
1900
2143
if callable(client_object.__getattribute__(attrname)):
1901
parent_pipe.send(('function',))
2144
parent_pipe.send(('function', ))
1902
2145
else:
1903
parent_pipe.send(('data', client_object
1904
.__getattribute__(attrname)))
2146
parent_pipe.send((
2147
'data', client_object.__getattribute__(attrname)))
1905
2148
1906
2149
if command == 'setattr':
1907
2150
attrname = request[1]
1911
2154
return True
1912
2155
1913
2156
2157
def rfc3339_duration_to_delta(duration):
2158
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2159
2160
>>> rfc3339_duration_to_delta("P7D")
2161
datetime.timedelta(7)
2162
>>> rfc3339_duration_to_delta("PT60S")
2163
datetime.timedelta(0, 60)
2164
>>> rfc3339_duration_to_delta("PT60M")
2165
datetime.timedelta(0, 3600)
2166
>>> rfc3339_duration_to_delta("PT24H")
2167
datetime.timedelta(1)
2168
>>> rfc3339_duration_to_delta("P1W")
2169
datetime.timedelta(7)
2170
>>> rfc3339_duration_to_delta("PT5M30S")
2171
datetime.timedelta(0, 330)
2172
>>> rfc3339_duration_to_delta("P1DT3M20S")
2173
datetime.timedelta(1, 200)
2174
"""
2175
2176
# Parsing an RFC 3339 duration with regular expressions is not
2177
# possible - there would have to be multiple places for the same
2178
# values, like seconds. The current code, while more esoteric, is
2179
# cleaner without depending on a parsing library. If Python had a
2180
# built-in library for parsing we would use it, but we'd like to
2181
# avoid excessive use of external libraries.
2182
2183
# New type for defining tokens, syntax, and semantics all-in-one
2184
Token = collections.namedtuple("Token",
2185
("regexp", # To match token; if
2186
# "value" is not None,
2187
# must have a "group"
2188
# containing digits
2189
"value", # datetime.timedelta or
2190
# None
2191
"followers")) # Tokens valid after
2192
# this token
2193
Token = collections.namedtuple("Token", (
2194
"regexp", # To match token; if "value" is not None, must have
2195
# a "group" containing digits
2196
"value", # datetime.timedelta or None
2197
"followers")) # Tokens valid after this token
2198
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2199
# the "duration" ABNF definition in RFC 3339, Appendix A.
2200
token_end = Token(re.compile(r"$"), None, frozenset())
2201
token_second = Token(re.compile(r"(\d+)S"),
2202
datetime.timedelta(seconds=1),
2203
frozenset((token_end, )))
2204
token_minute = Token(re.compile(r"(\d+)M"),
2205
datetime.timedelta(minutes=1),
2206
frozenset((token_second, token_end)))
2207
token_hour = Token(re.compile(r"(\d+)H"),
2208
datetime.timedelta(hours=1),
2209
frozenset((token_minute, token_end)))
2210
token_time = Token(re.compile(r"T"),
2211
None,
2212
frozenset((token_hour, token_minute,
2213
token_second)))
2214
token_day = Token(re.compile(r"(\d+)D"),
2215
datetime.timedelta(days=1),
2216
frozenset((token_time, token_end)))
2217
token_month = Token(re.compile(r"(\d+)M"),
2218
datetime.timedelta(weeks=4),
2219
frozenset((token_day, token_end)))
2220
token_year = Token(re.compile(r"(\d+)Y"),
2221
datetime.timedelta(weeks=52),
2222
frozenset((token_month, token_end)))
2223
token_week = Token(re.compile(r"(\d+)W"),
2224
datetime.timedelta(weeks=1),
2225
frozenset((token_end, )))
2226
token_duration = Token(re.compile(r"P"), None,
2227
frozenset((token_year, token_month,
2228
token_day, token_time,
2229
token_week)))
2230
# Define starting values
2231
value = datetime.timedelta() # Value so far
2232
found_token = None
2233
followers = frozenset((token_duration,)) # Following valid tokens
2234
s = duration # String left to parse
2235
# Loop until end token is found
2236
while found_token is not token_end:
2237
# Search for any currently valid tokens
2238
for token in followers:
2239
match = token.regexp.match(s)
2240
if match is not None:
2241
# Token found
2242
if token.value is not None:
2243
# Value found, parse digits
2244
factor = int(match.group(1), 10)
2245
# Add to value so far
2246
value += factor * token.value
2247
# Strip token from string
2248
s = token.regexp.sub("", s, 1)
2249
# Go to found token
2250
found_token = token
2251
# Set valid next tokens
2252
followers = found_token.followers
2253
break
2254
else:
2255
# No currently valid tokens were found
2256
raise ValueError("Invalid RFC 3339 duration")
2257
# End token found
2258
return value
2259
2260
1914
2261
def string_to_delta(interval):
1915
2262
"""Parse a string and return a datetime.timedelta
1916
2263
1927
2274
>>> string_to_delta('5m 30s')
1928
2275
datetime.timedelta(0, 330)
1929
2276
"""
2277
2278
try:
2279
return rfc3339_duration_to_delta(interval)
2280
except ValueError:
2281
pass
2282
1930
2283
timevalue = datetime.timedelta(0)
1931
2284
for s in interval.split():
1932
2285
try:
1933
suffix = unicode(s[-1])
2286
suffix = s[-1]
1934
2287
value = int(s[:-1])
1935
2288
if suffix == "d":
1936
2289
delta = datetime.timedelta(value)
1943
2296
elif suffix == "w":
1944
2297
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1945
2298
else:
1946
raise ValueError("Unknown suffix %r" % suffix)
1947
except (ValueError, IndexError) as e:
2299
raise ValueError("Unknown suffix {!r}".format(suffix))
2300
except IndexError as e:
1948
2301
raise ValueError(*(e.args))
1949
2302
timevalue += delta
1950
2303
return timevalue
1963
2316
sys.exit()
1964
2317
if not noclose:
1965
2318
# Close all standard open file descriptors
1966
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2319
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1967
2320
if not stat.S_ISCHR(os.fstat(null).st_mode):
1968
2321
raise OSError(errno.ENODEV,
1969
"%s not a character device"
1970
% os.path.devnull)
2322
"{} not a character device"
2323
.format(os.devnull))
1971
2324
os.dup2(null, sys.stdin.fileno())
1972
2325
os.dup2(null, sys.stdout.fileno())
1973
2326
os.dup2(null, sys.stderr.fileno())
1982
2335
1983
2336
parser = argparse.ArgumentParser()
1984
2337
parser.add_argument("-v", "--version", action="version",
1985
version = "%%(prog)s %s" % version,
2338
version = "%(prog)s {}".format(version),
1986
2339
help="show version number and exit")
1987
2340
parser.add_argument("-i", "--interface", metavar="IF",
1988
2341
help="Bind to interface IF")
1994
2347
help="Run self-test")
1995
2348
parser.add_argument("--debug", action="store_true",
1996
2349
help="Debug mode; run in foreground and log"
1997
" to terminal")
2350
" to terminal", default=None)
1998
2351
parser.add_argument("--debuglevel", metavar="LEVEL",
1999
2352
help="Debug level for stdout output")
2000
2353
parser.add_argument("--priority", help="GnuTLS"
2007
2360
" files")
2008
2361
parser.add_argument("--no-dbus", action="store_false",
2009
2362
dest="use_dbus", help="Do not provide D-Bus"
2010
" system bus interface")
2363
" system bus interface", default=None)
2011
2364
parser.add_argument("--no-ipv6", action="store_false",
2012
dest="use_ipv6", help="Do not use IPv6")
2365
dest="use_ipv6", help="Do not use IPv6",
2366
default=None)
2013
2367
parser.add_argument("--no-restore", action="store_false",
2014
2368
dest="restore", help="Do not restore stored"
2015
" state")
2369
" state", default=None)
2370
parser.add_argument("--socket", type=int,
2371
help="Specify a file descriptor to a network"
2372
" socket to use instead of creating one")
2016
2373
parser.add_argument("--statedir", metavar="DIR",
2017
2374
help="Directory to save/restore state in")
2375
parser.add_argument("--foreground", action="store_true",
2376
help="Run in foreground", default=None)
2377
parser.add_argument("--no-zeroconf", action="store_false",
2378
dest="zeroconf", help="Do not use Zeroconf",
2379
default=None)
2018
2380
2019
2381
options = parser.parse_args()
2020
2382
2021
2383
if options.check:
2022
2384
import doctest
2023
doctest.testmod()
2024
sys.exit()
2385
fail_count, test_count = doctest.testmod()
2386
sys.exit(os.EX_OK if fail_count == 0 else 1)
2025
2387
2026
2388
# Default values for config file for server-global settings
2027
2389
server_defaults = { "interface": "",
2029
2391
"port": "",
2030
2392
"debug": "False",
2031
2393
"priority":
2032
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2394
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2395
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2033
2396
"servicename": "Mandos",
2034
2397
"use_dbus": "True",
2035
2398
"use_ipv6": "True",
2036
2399
"debuglevel": "",
2037
2400
"restore": "True",
2038
"statedir": "/var/lib/mandos"
2039
}
2401
"socket": "",
2402
"statedir": "/var/lib/mandos",
2403
"foreground": "False",
2404
"zeroconf": "True",
2405
}
2040
2406
2041
2407
# Parse config file for server-global settings
2042
2408
server_config = configparser.SafeConfigParser(server_defaults)
2043
2409
del server_defaults
2044
server_config.read(os.path.join(options.configdir,
2045
"mandos.conf"))
2410
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2046
2411
# Convert the SafeConfigParser object to a dict
2047
2412
server_settings = server_config.defaults()
2048
2413
# Use the appropriate methods on the non-string config options
2049
for option in ("debug", "use_dbus", "use_ipv6"):
2414
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2050
2415
server_settings[option] = server_config.getboolean("DEFAULT",
2051
2416
option)
2052
2417
if server_settings["port"]:
2053
2418
server_settings["port"] = server_config.getint("DEFAULT",
2054
2419
"port")
2420
if server_settings["socket"]:
2421
server_settings["socket"] = server_config.getint("DEFAULT",
2422
"socket")
2423
# Later, stdin will, and stdout and stderr might, be dup'ed
2424
# over with an opened os.devnull. But we don't want this to
2425
# happen with a supplied network socket.
2426
if 0 <= server_settings["socket"] <= 2:
2427
server_settings["socket"] = os.dup(server_settings
2428
["socket"])
2055
2429
del server_config
2056
2430
2057
2431
# Override the settings from the config file with command line
2058
2432
# options, if set.
2059
2433
for option in ("interface", "address", "port", "debug",
2060
"priority", "servicename", "configdir",
2061
"use_dbus", "use_ipv6", "debuglevel", "restore",
2062
"statedir"):
2434
"priority", "servicename", "configdir", "use_dbus",
2435
"use_ipv6", "debuglevel", "restore", "statedir",
2436
"socket", "foreground", "zeroconf"):
2063
2437
value = getattr(options, option)
2064
2438
if value is not None:
2065
2439
server_settings[option] = value
2066
2440
del options
2067
2441
# Force all strings to be unicode
2068
2442
for option in server_settings.keys():
2069
if type(server_settings[option]) is str:
2070
server_settings[option] = unicode(server_settings[option])
2443
if isinstance(server_settings[option], bytes):
2444
server_settings[option] = (server_settings[option]
2445
.decode("utf-8"))
2446
# Force all boolean options to be boolean
2447
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2448
"foreground", "zeroconf"):
2449
server_settings[option] = bool(server_settings[option])
2450
# Debug implies foreground
2451
if server_settings["debug"]:
2452
server_settings["foreground"] = True
2071
2453
# Now we have our good server settings in "server_settings"
2072
2454
2073
2455
##################################################################
2074
2456
2457
if (not server_settings["zeroconf"]
2458
and not (server_settings["port"]
2459
or server_settings["socket"] != "")):
2460
parser.error("Needs port or socket to work without Zeroconf")
2461
2075
2462
# For convenience
2076
2463
debug = server_settings["debug"]
2077
2464
debuglevel = server_settings["debuglevel"]
2079
2466
use_ipv6 = server_settings["use_ipv6"]
2080
2467
stored_state_path = os.path.join(server_settings["statedir"],
2081
2468
stored_state_file)
2469
foreground = server_settings["foreground"]
2470
zeroconf = server_settings["zeroconf"]
2082
2471
2083
2472
if debug:
2084
2473
initlogger(debug, logging.DEBUG)
2090
2479
initlogger(debug, level)
2091
2480
2092
2481
if server_settings["servicename"] != "Mandos":
2093
syslogger.setFormatter(logging.Formatter
2094
('Mandos (%s) [%%(process)d]:'
2095
' %%(levelname)s: %%(message)s'
2096
% server_settings["servicename"]))
2482
syslogger.setFormatter(
2483
logging.Formatter('Mandos ({}) [%(process)d]:'
2484
' %(levelname)s: %(message)s'.format(
2485
server_settings["servicename"])))
2097
2486
2098
2487
# Parse config file with clients
2099
2488
client_config = configparser.SafeConfigParser(Client
2104
2493
global mandos_dbus_service
2105
2494
mandos_dbus_service = None
2106
2495
2107
tcp_server = MandosServer((server_settings["address"],
2108
server_settings["port"]),
2109
ClientHandler,
2110
interface=(server_settings["interface"]
2111
or None),
2112
use_ipv6=use_ipv6,
2113
gnutls_priority=
2114
server_settings["priority"],
2115
use_dbus=use_dbus)
2116
if not debug:
2117
pidfilename = "/var/run/mandos.pid"
2496
socketfd = None
2497
if server_settings["socket"] != "":
2498
socketfd = server_settings["socket"]
2499
tcp_server = MandosServer(
2500
(server_settings["address"], server_settings["port"]),
2501
ClientHandler,
2502
interface=(server_settings["interface"] or None),
2503
use_ipv6=use_ipv6,
2504
gnutls_priority=server_settings["priority"],
2505
use_dbus=use_dbus,
2506
socketfd=socketfd)
2507
if not foreground:
2508
pidfilename = "/run/mandos.pid"
2509
if not os.path.isdir("/run/."):
2510
pidfilename = "/var/run/mandos.pid"
2511
pidfile = None
2118
2512
try:
2119
2513
pidfile = open(pidfilename, "w")
2120
except IOError:
2121
logger.error("Could not open file %r", pidfilename)
2514
except IOError as e:
2515
logger.error("Could not open file %r", pidfilename,
2516
exc_info=e)
2122
2517
2123
try:
2124
uid = pwd.getpwnam("_mandos").pw_uid
2125
gid = pwd.getpwnam("_mandos").pw_gid
2126
except KeyError:
2518
for name in ("_mandos", "mandos", "nobody"):
2127
2519
try:
2128
uid = pwd.getpwnam("mandos").pw_uid
2129
gid = pwd.getpwnam("mandos").pw_gid
2520
uid = pwd.getpwnam(name).pw_uid
2521
gid = pwd.getpwnam(name).pw_gid
2522
break
2130
2523
except KeyError:
2131
try:
2132
uid = pwd.getpwnam("nobody").pw_uid
2133
gid = pwd.getpwnam("nobody").pw_gid
2134
except KeyError:
2135
uid = 65534
2136
gid = 65534
2524
continue
2525
else:
2526
uid = 65534
2527
gid = 65534
2137
2528
try:
2138
2529
os.setgid(gid)
2139
2530
os.setuid(uid)
2140
2531
except OSError as error:
2141
if error[0] != errno.EPERM:
2142
raise error
2532
if error.errno != errno.EPERM:
2533
raise
2143
2534
2144
2535
if debug:
2145
2536
# Enable all possible GnuTLS debugging
2152
2543
def debug_gnutls(level, string):
2153
2544
logger.debug("GnuTLS: %s", string[:-1])
2154
2545
2155
(gnutls.library.functions
2156
.gnutls_global_set_log_function(debug_gnutls))
2546
gnutls.library.functions.gnutls_global_set_log_function(
2547
debug_gnutls)
2157
2548
2158
2549
# Redirect stdin so all checkers get /dev/null
2159
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2550
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2160
2551
os.dup2(null, sys.stdin.fileno())
2161
2552
if null > 2:
2162
2553
os.close(null)
2163
2554
2164
2555
# Need to fork before connecting to D-Bus
2165
if not debug:
2556
if not foreground:
2166
2557
# Close all input and output, do double fork, etc.
2167
2558
daemon()
2168
2559
2560
# multiprocessing will use threads, so before we use gobject we
2561
# need to inform gobject that threads will be used.
2169
2562
gobject.threads_init()
2170
2563
2171
2564
global main_loop
2172
2565
# From the Avahi example code
2173
DBusGMainLoop(set_as_default=True )
2566
DBusGMainLoop(set_as_default=True)
2174
2567
main_loop = gobject.MainLoop()
2175
2568
bus = dbus.SystemBus()
2176
2569
# End of Avahi example code
2177
2570
if use_dbus:
2178
2571
try:
2179
2572
bus_name = dbus.service.BusName("se.recompile.Mandos",
2180
bus, do_not_queue=True)
2181
old_bus_name = (dbus.service.BusName
2182
("se.bsnet.fukt.Mandos", bus,
2183
do_not_queue=True))
2184
except dbus.exceptions.NameExistsException as e:
2185
logger.error(unicode(e) + ", disabling D-Bus")
2573
bus,
2574
do_not_queue=True)
2575
old_bus_name = dbus.service.BusName(
2576
"se.bsnet.fukt.Mandos", bus,
2577
do_not_queue=True)
2578
except dbus.exceptions.DBusException as e:
2579
logger.error("Disabling D-Bus:", exc_info=e)
2186
2580
use_dbus = False
2187
2581
server_settings["use_dbus"] = False
2188
2582
tcp_server.use_dbus = False
2189
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2190
service = AvahiServiceToSyslog(name =
2191
server_settings["servicename"],
2192
servicetype = "_mandos._tcp",
2193
protocol = protocol, bus = bus)
2194
if server_settings["interface"]:
2195
service.interface = (if_nametoindex
2196
(str(server_settings["interface"])))
2583
if zeroconf:
2584
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2585
service = AvahiServiceToSyslog(
2586
name = server_settings["servicename"],
2587
servicetype = "_mandos._tcp",
2588
protocol = protocol,
2589
bus = bus)
2590
if server_settings["interface"]:
2591
service.interface = if_nametoindex(
2592
server_settings["interface"].encode("utf-8"))
2197
2593
2198
2594
global multiprocessing_manager
2199
2595
multiprocessing_manager = multiprocessing.Manager()
2200
2596
2201
2597
client_class = Client
2202
2598
if use_dbus:
2203
client_class = functools.partial(ClientDBusTransitional,
2204
bus = bus)
2599
client_class = functools.partial(ClientDBus, bus = bus)
2205
2600
2206
2601
client_settings = Client.config_parser(client_config)
2207
2602
old_client_settings = {}
2208
2603
clients_data = {}
2209
2604
2605
# This is used to redirect stdout and stderr for checker processes
2606
global wnull
2607
wnull = open(os.devnull, "w") # A writable /dev/null
2608
# Only used if server is running in foreground but not in debug
2609
# mode
2610
if debug or not foreground:
2611
wnull.close()
2612
2210
2613
# Get client data and settings from last running state.
2211
2614
if server_settings["restore"]:
2212
2615
try:
2213
2616
with open(stored_state_path, "rb") as stored_state:
2214
clients_data, old_client_settings = (pickle.load
2215
(stored_state))
2617
clients_data, old_client_settings = pickle.load(
2618
stored_state)
2216
2619
os.remove(stored_state_path)
2217
2620
except IOError as e:
2218
logger.warning("Could not load persistent state: {0}"
2219
.format(e))
2220
if e.errno != errno.ENOENT:
2621
if e.errno == errno.ENOENT:
2622
logger.warning("Could not load persistent state:"
2623
" {}".format(os.strerror(e.errno)))
2624
else:
2625
logger.critical("Could not load persistent state:",
2626
exc_info=e)
2221
2627
raise
2222
2628
except EOFError as e:
2223
2629
logger.warning("Could not load persistent state: "
2224
"EOFError: {0}".format(e))
2630
"EOFError:",
2631
exc_info=e)
2225
2632
2226
2633
with PGPEngine() as pgp:
2227
for client_name, client in clients_data.iteritems():
2634
for client_name, client in clients_data.items():
2635
# Skip removed clients
2636
if client_name not in client_settings:
2637
continue
2638
2228
2639
# Decide which value to use after restoring saved state.
2229
2640
# We have three different values: Old config file,
2230
2641
# new config file, and saved state.
2235
2646
# For each value in new config, check if it
2236
2647
# differs from the old config value (Except for
2237
2648
# the "secret" attribute)
2238
if (name != "secret" and
2239
value != old_client_settings[client_name]
2240
[name]):
2649
if (name != "secret"
2650
and (value !=
2651
old_client_settings[client_name][name])):
2241
2652
client[name] = value
2242
2653
except KeyError:
2243
2654
pass
2251
2662
if datetime.datetime.utcnow() >= client["expires"]:
2252
2663
if not client["last_checked_ok"]:
2253
2664
logger.warning(
2254
"disabling client {0} - Client never "
2255
"performed a successful checker"
2256
.format(client_name))
2665
"disabling client {} - Client never "
2666
"performed a successful checker".format(
2667
client_name))
2257
2668
client["enabled"] = False
2258
2669
elif client["last_checker_status"] != 0:
2259
2670
logger.warning(
2260
"disabling client {0} - Client "
2261
"last checker failed with error code {1}"
2262
.format(client_name,
2263
client["last_checker_status"]))
2671
"disabling client {} - Client last"
2672
" checker failed with error code"
2673
" {}".format(
2674
client_name,
2675
client["last_checker_status"]))
2264
2676
client["enabled"] = False
2265
2677
else:
2266
client["expires"] = (datetime.datetime
2267
.utcnow()
2268
+ client["timeout"])
2678
client["expires"] = (
2679
datetime.datetime.utcnow()
2680
+ client["timeout"])
2269
2681
logger.debug("Last checker succeeded,"
2270
" keeping {0} enabled"
2271
.format(client_name))
2682
" keeping {} enabled".format(
2683
client_name))
2272
2684
try:
2273
client["secret"] = (
2274
pgp.decrypt(client["encrypted_secret"],
2275
client_settings[client_name]
2276
["secret"]))
2685
client["secret"] = pgp.decrypt(
2686
client["encrypted_secret"],
2687
client_settings[client_name]["secret"])
2277
2688
except PGPError:
2278
2689
# If decryption fails, we use secret from new settings
2279
logger.debug("Failed to decrypt {0} old secret"
2280
.format(client_name))
2281
client["secret"] = (
2282
client_settings[client_name]["secret"])
2283
2690
logger.debug("Failed to decrypt {} old secret".format(
2691
client_name))
2692
client["secret"] = (client_settings[client_name]
2693
["secret"])
2284
2694
2285
2695
# Add/remove clients based on new changes made to config
2286
2696
for client_name in (set(old_client_settings)
2289
2699
for client_name in (set(client_settings)
2290
2700
- set(old_client_settings)):
2291
2701
clients_data[client_name] = client_settings[client_name]
2292
2702
2293
2703
# Create all client objects
2294
for client_name, client in clients_data.iteritems():
2704
for client_name, client in clients_data.items():
2295
2705
tcp_server.clients[client_name] = client_class(
2296
name = client_name, settings = client)
2706
name = client_name,
2707
settings = client,
2708
server_settings = server_settings)
2297
2709
2298
2710
if not tcp_server.clients:
2299
2711
logger.warning("No clients defined")
2300
2301
if not debug:
2302
try:
2303
with pidfile:
2304
pid = os.getpid()
2305
pidfile.write(str(pid) + "\n".encode("utf-8"))
2306
del pidfile
2307
except IOError:
2308
logger.error("Could not write to file %r with PID %d",
2309
pidfilename, pid)
2310
except NameError:
2311
# "pidfile" was never created
2312
pass
2712
2713
if not foreground:
2714
if pidfile is not None:
2715
try:
2716
with pidfile:
2717
pid = os.getpid()
2718
pidfile.write("{}\n".format(pid).encode("utf-8"))
2719
except IOError:
2720
logger.error("Could not write to file %r with PID %d",
2721
pidfilename, pid)
2722
del pidfile
2313
2723
del pidfilename
2314
signal.signal(signal.SIGINT, signal.SIG_IGN)
2315
2724
2316
2725
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2317
2726
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2318
2727
2319
2728
if use_dbus:
2320
class MandosDBusService(dbus.service.Object):
2729
2730
@alternate_dbus_interfaces(
2731
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2732
class MandosDBusService(DBusObjectWithProperties):
2321
2733
"""A D-Bus proxy object"""
2734
2322
2735
def __init__(self):
2323
2736
dbus.service.Object.__init__(self, bus, "/")
2737
2324
2738
_interface = "se.recompile.Mandos"
2325
2739
2740
@dbus_interface_annotations(_interface)
2741
def _foo(self):
2742
return {
2743
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2744
"false" }
2745
2326
2746
@dbus.service.signal(_interface, signature="o")
2327
2747
def ClientAdded(self, objpath):
2328
2748
"D-Bus signal"
2341
2761
@dbus.service.method(_interface, out_signature="ao")
2342
2762
def GetAllClients(self):
2343
2763
"D-Bus method"
2344
return dbus.Array(c.dbus_object_path
2345
for c in
2764
return dbus.Array(c.dbus_object_path for c in
2346
2765
tcp_server.clients.itervalues())
2347
2766
2348
2767
@dbus.service.method(_interface,
2350
2769
def GetAllClientsWithProperties(self):
2351
2770
"D-Bus method"
2352
2771
return dbus.Dictionary(
2353
((c.dbus_object_path, c.GetAll(""))
2354
for c in tcp_server.clients.itervalues()),
2772
{ c.dbus_object_path: c.GetAll("")
2773
for c in tcp_server.clients.itervalues() },
2355
2774
signature="oa{sv}")
2356
2775
2357
2776
@dbus.service.method(_interface, in_signature="o")
2370
2789
2371
2790
del _interface
2372
2791
2373
class MandosDBusServiceTransitional(MandosDBusService):
2374
__metaclass__ = AlternateDBusNamesMetaclass
2375
mandos_dbus_service = MandosDBusServiceTransitional()
2792
mandos_dbus_service = MandosDBusService()
2376
2793
2377
2794
def cleanup():
2378
2795
"Cleanup function; run on exit"
2379
service.cleanup()
2796
if zeroconf:
2797
service.cleanup()
2380
2798
2381
2799
multiprocessing.active_children()
2800
wnull.close()
2382
2801
if not (tcp_server.clients or client_settings):
2383
2802
return
2384
2803
2395
2814
2396
2815
# A list of attributes that can not be pickled
2397
2816
# + secret.
2398
exclude = set(("bus", "changedstate", "secret",
2399
"checker"))
2400
for name, typ in (inspect.getmembers
2401
(dbus.service.Object)):
2817
exclude = { "bus", "changedstate", "secret",
2818
"checker", "server_settings" }
2819
for name, typ in inspect.getmembers(dbus.service
2820
.Object):
2402
2821
exclude.add(name)
2403
2822
2404
2823
client_dict["encrypted_secret"] = (client
2411
2830
del client_settings[client.name]["secret"]
2412
2831
2413
2832
try:
2414
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2415
prefix="clients-",
2416
dir=os.path.dirname
2417
(stored_state_path))
2418
with os.fdopen(tempfd, "wb") as stored_state:
2833
with tempfile.NamedTemporaryFile(
2834
mode='wb',
2835
suffix=".pickle",
2836
prefix='clients-',
2837
dir=os.path.dirname(stored_state_path),
2838
delete=False) as stored_state:
2419
2839
pickle.dump((clients, client_settings), stored_state)
2840
tempname = stored_state.name
2420
2841
os.rename(tempname, stored_state_path)
2421
2842
except (IOError, OSError) as e:
2422
logger.warning("Could not save persistent state: {0}"
2423
.format(e))
2424
2843
if not debug:
2425
2844
try:
2426
2845
os.remove(tempname)
2427
2846
except NameError:
2428
2847
pass
2429
if e.errno not in set((errno.ENOENT, errno.EACCES,
2430
errno.EEXIST)):
2431
raise e
2848
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2849
logger.warning("Could not save persistent state: {}"
2850
.format(os.strerror(e.errno)))
2851
else:
2852
logger.warning("Could not save persistent state:",
2853
exc_info=e)
2854
raise
2432
2855
2433
2856
# Delete all clients, and settings from config
2434
2857
while tcp_server.clients:
2439
2862
client.disable(quiet=True)
2440
2863
if use_dbus:
2441
2864
# Emit D-Bus signal
2442
mandos_dbus_service.ClientRemoved(client
2443
.dbus_object_path,
2444
client.name)
2865
mandos_dbus_service.ClientRemoved(
2866
client.dbus_object_path, client.name)
2445
2867
client_settings.clear()
2446
2868
2447
2869
atexit.register(cleanup)
2458
2880
tcp_server.server_activate()
2459
2881
2460
2882
# Find out what port we got
2461
service.port = tcp_server.socket.getsockname()[1]
2883
if zeroconf:
2884
service.port = tcp_server.socket.getsockname()[1]
2462
2885
if use_ipv6:
2463
2886
logger.info("Now listening on address %r, port %d,"
2464
" flowinfo %d, scope_id %d"
2465
% tcp_server.socket.getsockname())
2887
" flowinfo %d, scope_id %d",
2888
*tcp_server.socket.getsockname())
2466
2889
else: # IPv4
2467
logger.info("Now listening on address %r, port %d"
2468
% tcp_server.socket.getsockname())
2890
logger.info("Now listening on address %r, port %d",
2891
*tcp_server.socket.getsockname())
2469
2892
2470
2893
#service.interface = tcp_server.socket.getsockname()[3]
2471
2894
2472
2895
try:
2473
# From the Avahi example code
2474
try:
2475
service.activate()
2476
except dbus.exceptions.DBusException as error:
2477
logger.critical("DBusException: %s", error)
2478
cleanup()
2479
sys.exit(1)
2480
# End of Avahi example code
2896
if zeroconf:
2897
# From the Avahi example code
2898
try:
2899
service.activate()
2900
except dbus.exceptions.DBusException as error:
2901
logger.critical("D-Bus Exception", exc_info=error)
2902
cleanup()
2903
sys.exit(1)
2904
# End of Avahi example code
2481
2905
2482
2906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2483
2907
lambda *args, **kwargs:
2487
2911
logger.debug("Starting main loop")
2488
2912
main_loop.run()
2489
2913
except AvahiError as error:
2490
logger.critical("AvahiError: %s", error)
2914
logger.critical("Avahi Error", exc_info=error)
2491
2915
cleanup()
2492
2916
sys.exit(1)
2493
2917
except KeyboardInterrupt:
2498
2922
# Must run before the D-Bus bus name gets deregistered
2499
2923
cleanup()
2500
2924
2925
2501
2926
if __name__ == '__main__':
2502
2927
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0