To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 750
- compare with another revision
- download diff
- download tarball
- view history from revision 750
- Committer: Teddy Hogeborn
- Date: 2015-05-30 16:47:00 UTC
- Revision ID: teddy@recompile.se-20150530164700-77zrd7964gdhbk1f
mandos: Disable D-Bus if any DBusException is raised when connecting.
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
72
81
73
82
import dbus
74
83
import dbus.service
75
import gobject
84
try:
85
import gobject
86
except ImportError:
87
from gi.repository import GObject as gobject
76
88
import avahi
77
89
from dbus.mainloop.glib import DBusGMainLoop
78
90
import ctypes
98
110
syslogger = None
99
111
100
112
try:
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
113
if_nametoindex = ctypes.cdll.LoadLibrary(
114
ctypes.util.find_library("c")).if_nametoindex
104
115
except (OSError, AttributeError):
116
105
117
def if_nametoindex(interface):
106
118
"Get an interface index the hard way, i.e. using fcntl()"
107
119
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
116
128
"""init logger and add loglevel"""
117
129
118
130
global syslogger
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
131
syslogger = (logging.handlers.SysLogHandler(
132
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
address = "/dev/log"))
123
134
syslogger.setFormatter(logging.Formatter
124
135
('Mandos [%(process)d]: %(levelname)s:'
125
136
' %(message)s'))
142
153
143
154
class PGPEngine(object):
144
155
"""A simple class for OpenPGP symmetric encryption & decryption"""
156
145
157
def __init__(self):
146
158
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
147
159
self.gnupgargs = ['--batch',
186
198
187
199
def encrypt(self, data, password):
188
200
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
201
with tempfile.NamedTemporaryFile(
202
dir=self.tempdir) as passfile:
191
203
passfile.write(passphrase)
192
204
passfile.flush()
193
205
proc = subprocess.Popen(['gpg', '--symmetric',
204
216
205
217
def decrypt(self, data, password):
206
218
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
219
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
209
221
passfile.write(passphrase)
210
222
passfile.flush()
211
223
proc = subprocess.Popen(['gpg', '--decrypt',
215
227
stdin = subprocess.PIPE,
216
228
stdout = subprocess.PIPE,
217
229
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
230
decrypted_plaintext, err = proc.communicate(input = data)
220
231
if proc.returncode != 0:
221
232
raise PGPError(err)
222
233
return decrypted_plaintext
228
239
return super(AvahiError, self).__init__(value, *args,
229
240
**kwargs)
230
241
242
231
243
class AvahiServiceError(AvahiError):
232
244
pass
233
245
246
234
247
class AvahiGroupError(AvahiError):
235
248
pass
236
249
256
269
bus: dbus.SystemBus()
257
270
"""
258
271
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
272
def __init__(self,
273
interface = avahi.IF_UNSPEC,
274
name = None,
275
servicetype = None,
276
port = None,
277
TXT = None,
278
domain = "",
279
host = "",
280
max_renames = 32768,
281
protocol = avahi.PROTO_UNSPEC,
282
bus = None):
263
283
self.interface = interface
264
284
self.name = name
265
285
self.type = servicetype
282
302
" after %i retries, exiting.",
283
303
self.rename_count)
284
304
raise AvahiServiceError("Too many renames")
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
305
self.name = str(
306
self.server.GetAlternativeServiceName(self.name))
287
307
self.rename_count += 1
288
308
logger.info("Changing Zeroconf service name to %r ...",
289
309
self.name)
344
364
elif state == avahi.ENTRY_GROUP_FAILURE:
345
365
logger.critical("Avahi: Error in group state changed %s",
346
366
str(error))
347
raise AvahiGroupError("State changed: {!s}"
348
.format(error))
367
raise AvahiGroupError("State changed: {!s}".format(error))
349
368
350
369
def cleanup(self):
351
370
"""Derived from the Avahi example code"""
361
380
def server_state_changed(self, state, error=None):
362
381
"""Derived from the Avahi example code"""
363
382
logger.debug("Avahi server state change: %i", state)
364
bad_states = { avahi.SERVER_INVALID:
365
"Zeroconf server invalid",
366
avahi.SERVER_REGISTERING: None,
367
avahi.SERVER_COLLISION:
368
"Zeroconf server name collision",
369
avahi.SERVER_FAILURE:
370
"Zeroconf server failure" }
383
bad_states = {
384
avahi.SERVER_INVALID: "Zeroconf server invalid",
385
avahi.SERVER_REGISTERING: None,
386
avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
avahi.SERVER_FAILURE: "Zeroconf server failure",
388
}
371
389
if state in bad_states:
372
390
if bad_states[state] is not None:
373
391
if error is None:
392
410
follow_name_owner_changes=True),
393
411
avahi.DBUS_INTERFACE_SERVER)
394
412
self.server.connect_to_signal("StateChanged",
395
self.server_state_changed)
413
self.server_state_changed)
396
414
self.server_state_changed(self.server.GetState())
397
415
398
416
400
418
def rename(self, *args, **kwargs):
401
419
"""Add the new name to the syslog messages"""
402
420
ret = AvahiService.rename(self, *args, **kwargs)
403
syslogger.setFormatter(logging.Formatter
404
('Mandos ({}) [%(process)d]:'
405
' %(levelname)s: %(message)s'
406
.format(self.name)))
421
syslogger.setFormatter(logging.Formatter(
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
423
.format(self.name)))
407
424
return ret
408
425
409
426
456
473
"fingerprint", "host", "interval",
457
474
"last_approval_request", "last_checked_ok",
458
475
"last_enabled", "name", "timeout")
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
476
client_defaults = {
477
"timeout": "PT5M",
478
"extended_timeout": "PT15M",
479
"interval": "PT2M",
480
"checker": "fping -q -- %%(host)s",
481
"host": "",
482
"approval_delay": "PT0S",
483
"approval_duration": "PT1S",
484
"approved_by_default": "True",
485
"enabled": "True",
486
}
469
487
470
488
@staticmethod
471
489
def config_parser(config):
549
567
self.current_checker_command = None
550
568
self.approved = None
551
569
self.approvals_pending = 0
552
self.changedstate = (multiprocessing_manager
553
.Condition(multiprocessing_manager
554
.Lock()))
555
self.client_structure = [attr for attr in
556
self.__dict__.iterkeys()
570
self.changedstate = multiprocessing_manager.Condition(
571
multiprocessing_manager.Lock())
572
self.client_structure = [attr
573
for attr in self.__dict__.iterkeys()
557
574
if not attr.startswith("_")]
558
575
self.client_structure.append("client_structure")
559
576
560
for name, t in inspect.getmembers(type(self),
561
lambda obj:
562
isinstance(obj,
563
property)):
577
for name, t in inspect.getmembers(
578
type(self), lambda obj: isinstance(obj, property)):
564
579
if not name.startswith("_"):
565
580
self.client_structure.append(name)
566
581
608
623
# and every interval from then on.
609
624
if self.checker_initiator_tag is not None:
610
625
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = (gobject.timeout_add
612
(int(self.interval
613
.total_seconds() * 1000),
614
self.start_checker))
626
self.checker_initiator_tag = gobject.timeout_add(
627
int(self.interval.total_seconds() * 1000),
628
self.start_checker)
615
629
# Schedule a disable() when 'timeout' has passed
616
630
if self.disable_initiator_tag is not None:
617
631
gobject.source_remove(self.disable_initiator_tag)
618
self.disable_initiator_tag = (gobject.timeout_add
619
(int(self.timeout
620
.total_seconds() * 1000),
621
self.disable))
632
self.disable_initiator_tag = gobject.timeout_add(
633
int(self.timeout.total_seconds() * 1000), self.disable)
622
634
# Also start a new checker *right now*.
623
635
self.start_checker()
624
636
633
645
vars(self))
634
646
self.checked_ok()
635
647
else:
636
logger.info("Checker for %(name)s failed",
637
vars(self))
648
logger.info("Checker for %(name)s failed", vars(self))
638
649
else:
639
650
self.last_checker_status = -1
640
651
logger.warning("Checker for %(name)s crashed?",
654
665
gobject.source_remove(self.disable_initiator_tag)
655
666
self.disable_initiator_tag = None
656
667
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(int(timeout.total_seconds()
659
* 1000), self.disable))
668
self.disable_initiator_tag = gobject.timeout_add(
669
int(timeout.total_seconds() * 1000), self.disable)
660
670
self.expires = datetime.datetime.utcnow() + timeout
661
671
662
672
def need_approval(self):
693
703
# Start a new checker if needed
694
704
if self.checker is None:
695
705
# Escape attributes for the shell
696
escaped_attrs = { attr:
697
re.escape(str(getattr(self, attr)))
698
for attr in self.runtime_expansions }
706
escaped_attrs = {
707
attr: re.escape(str(getattr(self, attr)))
708
for attr in self.runtime_expansions }
699
709
try:
700
710
command = self.checker_command % escaped_attrs
701
711
except TypeError as error:
702
712
logger.error('Could not format string "%s"',
703
self.checker_command, exc_info=error)
704
return True # Try again later
713
self.checker_command,
714
exc_info=error)
715
return True # Try again later
705
716
self.current_checker_command = command
706
717
try:
707
logger.info("Starting checker %r for %s",
708
command, self.name)
718
logger.info("Starting checker %r for %s", command,
719
self.name)
709
720
# We don't need to redirect stdout and stderr, since
710
721
# in normal mode, that is already done by daemon(),
711
722
# and in debug mode we don't want to. (Stdin is
720
731
"stderr": wnull })
721
732
self.checker = subprocess.Popen(command,
722
733
close_fds=True,
723
shell=True, cwd="/",
734
shell=True,
735
cwd="/",
724
736
**popen_args)
725
737
except OSError as error:
726
738
logger.error("Failed to start subprocess",
727
739
exc_info=error)
728
740
return True
729
self.checker_callback_tag = (gobject.child_watch_add
730
(self.checker.pid,
731
self.checker_callback,
732
data=command))
741
self.checker_callback_tag = gobject.child_watch_add(
742
self.checker.pid, self.checker_callback, data=command)
733
743
# The checker may have completed before the gobject
734
744
# watch was added. Check for this.
735
745
try:
766
776
self.checker = None
767
777
768
778
769
def dbus_service_property(dbus_interface, signature="v",
770
access="readwrite", byte_arrays=False):
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
771
783
"""Decorators for marking methods of a DBusObjectWithProperties to
772
784
become properties on the D-Bus.
773
785
783
795
if byte_arrays and signature != "ay":
784
796
raise ValueError("Byte arrays not supported for non-'ay'"
785
797
" signature {!r}".format(signature))
798
786
799
def decorator(func):
787
800
func._dbus_is_property = True
788
801
func._dbus_interface = dbus_interface
793
806
func._dbus_name = func._dbus_name[:-14]
794
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
795
808
return func
809
796
810
return decorator
797
811
798
812
807
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
808
822
"false"}
809
823
"""
824
810
825
def decorator(func):
811
826
func._dbus_is_interface = True
812
827
func._dbus_interface = dbus_interface
813
828
func._dbus_name = dbus_interface
814
829
return func
830
815
831
return decorator
816
832
817
833
827
843
def Property_dbus_property(self):
828
844
return dbus.Boolean(False)
829
845
"""
846
830
847
def decorator(func):
831
848
func._dbus_annotations = annotations
832
849
return func
850
833
851
return decorator
834
852
835
853
838
856
"""
839
857
pass
840
858
859
841
860
class DBusPropertyAccessException(DBusPropertyException):
842
861
"""A property's access permissions disallows an operation.
843
862
"""
871
890
def _get_all_dbus_things(self, thing):
872
891
"""Returns a generator of (name, attribute) pairs
873
892
"""
874
return ((getattr(athing.__get__(self), "_dbus_name",
875
name),
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
876
894
athing.__get__(self))
877
895
for cls in self.__class__.__mro__
878
896
for name, athing in
879
inspect.getmembers(cls,
880
self._is_dbus_thing(thing)))
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
881
898
882
899
def _get_dbus_property(self, interface_name, property_name):
883
900
"""Returns a bound method if one exists which is a D-Bus
884
901
property with the specified name and interface.
885
902
"""
886
for cls in self.__class__.__mro__:
887
for name, value in (inspect.getmembers
888
(cls,
889
self._is_dbus_thing("property"))):
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
890
906
if (value._dbus_name == property_name
891
907
and value._dbus_interface == interface_name):
892
908
return value.__get__(self)
893
909
894
910
# No such property
895
raise DBusPropertyNotFound(self.dbus_object_path + ":"
896
+ interface_name + "."
897
+ property_name)
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
898
913
899
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
915
in_signature="ss",
900
916
out_signature="v")
901
917
def Get(self, interface_name, property_name):
902
918
"""Standard D-Bus property Get() method, see D-Bus standard.
927
943
for byte in value))
928
944
prop(value)
929
945
930
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
947
in_signature="s",
931
948
out_signature="a{sv}")
932
949
def GetAll(self, interface_name):
933
950
"""Standard D-Bus property GetAll() method, see D-Bus
948
965
if not hasattr(value, "variant_level"):
949
966
properties[name] = value
950
967
continue
951
properties[name] = type(value)(value, variant_level=
952
value.variant_level+1)
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
953
970
return dbus.Dictionary(properties, signature="sv")
954
971
955
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
990
connection)
974
991
try:
975
992
document = xml.dom.minidom.parseString(xmlstring)
993
976
994
def make_tag(document, name, prop):
977
995
e = document.createElement("property")
978
996
e.setAttribute("name", name)
979
997
e.setAttribute("type", prop._dbus_signature)
980
998
e.setAttribute("access", prop._dbus_access)
981
999
return e
1000
982
1001
for if_tag in document.getElementsByTagName("interface"):
983
1002
# Add property tags
984
1003
for tag in (make_tag(document, name, prop)
996
1015
if (name == tag.getAttribute("name")
997
1016
and prop._dbus_interface
998
1017
== if_tag.getAttribute("name")):
999
annots.update(getattr
1000
(prop,
1001
"_dbus_annotations",
1002
{}))
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1003
1020
for name, value in annots.items():
1004
1021
ann_tag = document.createElement(
1005
1022
"annotation")
1010
1027
for annotation, value in dict(
1011
1028
itertools.chain.from_iterable(
1012
1029
annotations().items()
1013
for name, annotations in
1014
self._get_all_dbus_things("interface")
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1015
1032
if name == if_tag.getAttribute("name")
1016
1033
)).items():
1017
1034
ann_tag = document.createElement("annotation")
1046
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1047
1064
if dt is None:
1048
1065
return dbus.String("", variant_level = variant_level)
1049
return dbus.String(dt.isoformat(),
1050
variant_level=variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1051
1067
1052
1068
1053
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1073
1089
(from DBusObjectWithProperties) and interfaces (from the
1074
1090
dbus_interface_annotations decorator).
1075
1091
"""
1092
1076
1093
def wrapper(cls):
1077
1094
for orig_interface_name, alt_interface_name in (
1078
alt_interface_names.items()):
1095
alt_interface_names.items()):
1079
1096
attr = {}
1080
1097
interface_names = set()
1081
1098
# Go though all attributes of the class
1083
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
1084
1101
# with the wrong interface name
1085
1102
if (not hasattr(attribute, "_dbus_interface")
1086
or not attribute._dbus_interface
1087
.startswith(orig_interface_name)):
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
1088
1105
continue
1089
1106
# Create an alternate D-Bus interface name based on
1090
1107
# the current name
1091
alt_interface = (attribute._dbus_interface
1092
.replace(orig_interface_name,
1093
alt_interface_name))
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1094
1110
interface_names.add(alt_interface)
1095
1111
# Is this a D-Bus signal?
1096
1112
if getattr(attribute, "_dbus_is_signal", False):
1097
1113
# Extract the original non-method undecorated
1098
1114
# function by black magic
1099
1115
nonmethod_func = (dict(
1100
zip(attribute.func_code.co_freevars,
1101
attribute.__closure__))["func"]
1102
.cell_contents)
1116
zip(attribute.func_code.co_freevars,
1117
attribute.__closure__))
1118
["func"].cell_contents)
1103
1119
# Create a new, but exactly alike, function
1104
1120
# object, and decorate it to be a new D-Bus signal
1105
1121
# with the alternate D-Bus interface name
1106
new_function = (dbus.service.signal
1107
(alt_interface,
1108
attribute._dbus_signature)
1122
new_function = (dbus.service.signal(
1123
alt_interface, attribute._dbus_signature)
1109
1124
(types.FunctionType(
1110
nonmethod_func.func_code,
1111
nonmethod_func.func_globals,
1112
nonmethod_func.func_name,
1113
nonmethod_func.func_defaults,
1114
nonmethod_func.func_closure)))
1125
nonmethod_func.func_code,
1126
nonmethod_func.func_globals,
1127
nonmethod_func.func_name,
1128
nonmethod_func.func_defaults,
1129
nonmethod_func.func_closure)))
1115
1130
# Copy annotations, if any
1116
1131
try:
1117
new_function._dbus_annotations = (
1118
dict(attribute._dbus_annotations))
1132
new_function._dbus_annotations = dict(
1133
attribute._dbus_annotations)
1119
1134
except AttributeError:
1120
1135
pass
1121
1136
# Define a creator of a function to call both the
1126
1141
"""This function is a scope container to pass
1127
1142
func1 and func2 to the "call_both" function
1128
1143
outside of its arguments"""
1144
1129
1145
def call_both(*args, **kwargs):
1130
1146
"""This function will emit two D-Bus
1131
1147
signals by calling func1 and func2"""
1132
1148
func1(*args, **kwargs)
1133
1149
func2(*args, **kwargs)
1150
1134
1151
return call_both
1135
1152
# Create the "call_both" function and add it to
1136
1153
# the class
1141
1158
# object. Decorate it to be a new D-Bus method
1142
1159
# with the alternate D-Bus interface name. Add it
1143
1160
# to the class.
1144
attr[attrname] = (dbus.service.method
1145
(alt_interface,
1146
attribute._dbus_in_signature,
1147
attribute._dbus_out_signature)
1148
(types.FunctionType
1149
(attribute.func_code,
1150
attribute.func_globals,
1151
attribute.func_name,
1152
attribute.func_defaults,
1153
attribute.func_closure)))
1161
attr[attrname] = (
1162
dbus.service.method(
1163
alt_interface,
1164
attribute._dbus_in_signature,
1165
attribute._dbus_out_signature)
1166
(types.FunctionType(attribute.func_code,
1167
attribute.func_globals,
1168
attribute.func_name,
1169
attribute.func_defaults,
1170
attribute.func_closure)))
1154
1171
# Copy annotations, if any
1155
1172
try:
1156
attr[attrname]._dbus_annotations = (
1157
dict(attribute._dbus_annotations))
1173
attr[attrname]._dbus_annotations = dict(
1174
attribute._dbus_annotations)
1158
1175
except AttributeError:
1159
1176
pass
1160
1177
# Is this a D-Bus property?
1163
1180
# object, and decorate it to be a new D-Bus
1164
1181
# property with the alternate D-Bus interface
1165
1182
# name. Add it to the class.
1166
attr[attrname] = (dbus_service_property
1167
(alt_interface,
1168
attribute._dbus_signature,
1169
attribute._dbus_access,
1170
attribute
1171
._dbus_get_args_options
1172
["byte_arrays"])
1173
(types.FunctionType
1174
(attribute.func_code,
1175
attribute.func_globals,
1176
attribute.func_name,
1177
attribute.func_defaults,
1178
attribute.func_closure)))
1183
attr[attrname] = (dbus_service_property(
1184
alt_interface, attribute._dbus_signature,
1185
attribute._dbus_access,
1186
attribute._dbus_get_args_options
1187
["byte_arrays"])
1188
(types.FunctionType(
1189
attribute.func_code,
1190
attribute.func_globals,
1191
attribute.func_name,
1192
attribute.func_defaults,
1193
attribute.func_closure)))
1179
1194
# Copy annotations, if any
1180
1195
try:
1181
attr[attrname]._dbus_annotations = (
1182
dict(attribute._dbus_annotations))
1196
attr[attrname]._dbus_annotations = dict(
1197
attribute._dbus_annotations)
1183
1198
except AttributeError:
1184
1199
pass
1185
1200
# Is this a D-Bus interface?
1188
1203
# object. Decorate it to be a new D-Bus interface
1189
1204
# with the alternate D-Bus interface name. Add it
1190
1205
# to the class.
1191
attr[attrname] = (dbus_interface_annotations
1192
(alt_interface)
1193
(types.FunctionType
1194
(attribute.func_code,
1195
attribute.func_globals,
1196
attribute.func_name,
1197
attribute.func_defaults,
1198
attribute.func_closure)))
1206
attr[attrname] = (
1207
dbus_interface_annotations(alt_interface)
1208
(types.FunctionType(attribute.func_code,
1209
attribute.func_globals,
1210
attribute.func_name,
1211
attribute.func_defaults,
1212
attribute.func_closure)))
1199
1213
if deprecate:
1200
1214
# Deprecate all alternate interfaces
1201
1215
iname="_AlternateDBusNames_interface_annotation{}"
1202
1216
for interface_name in interface_names:
1217
1203
1218
@dbus_interface_annotations(interface_name)
1204
1219
def func(self):
1205
1220
return { "org.freedesktop.DBus.Deprecated":
1206
"true" }
1221
"true" }
1207
1222
# Find an unused name
1208
1223
for aname in (iname.format(i)
1209
1224
for i in itertools.count()):
1214
1229
# Replace the class with a new subclass of it with
1215
1230
# methods, signals, etc. as created above.
1216
1231
cls = type(b"{}Alternate".format(cls.__name__),
1217
(cls,), attr)
1232
(cls, ), attr)
1218
1233
return cls
1234
1219
1235
return wrapper
1220
1236
1221
1237
1222
1238
@alternate_dbus_interfaces({"se.recompile.Mandos":
1223
"se.bsnet.fukt.Mandos"})
1239
"se.bsnet.fukt.Mandos"})
1224
1240
class ClientDBus(Client, DBusObjectWithProperties):
1225
1241
"""A Client class using D-Bus
1226
1242
1230
1246
"""
1231
1247
1232
1248
runtime_expansions = (Client.runtime_expansions
1233
+ ("dbus_object_path",))
1249
+ ("dbus_object_path", ))
1234
1250
1235
1251
_interface = "se.recompile.Mandos.Client"
1236
1252
1244
1260
client_object_name = str(self.name).translate(
1245
1261
{ord("."): ord("_"),
1246
1262
ord("-"): ord("_")})
1247
self.dbus_object_path = (dbus.ObjectPath
1248
("/clients/" + client_object_name))
1263
self.dbus_object_path = dbus.ObjectPath(
1264
"/clients/" + client_object_name)
1249
1265
DBusObjectWithProperties.__init__(self, self.bus,
1250
1266
self.dbus_object_path)
1251
1267
1252
def notifychangeproperty(transform_func,
1253
dbus_name, type_func=lambda x: x,
1254
variant_level=1, invalidate_only=False,
1268
def notifychangeproperty(transform_func, dbus_name,
1269
type_func=lambda x: x,
1270
variant_level=1,
1271
invalidate_only=False,
1255
1272
_interface=_interface):
1256
1273
""" Modify a variable so that it's a property which announces
1257
1274
its changes to DBus.
1264
1281
variant_level: D-Bus variant level. Default: 1
1265
1282
"""
1266
1283
attrname = "_{}".format(dbus_name)
1284
1267
1285
def setter(self, value):
1268
1286
if hasattr(self, "dbus_object_path"):
1269
1287
if (not hasattr(self, attrname) or
1270
1288
type_func(getattr(self, attrname, None))
1271
1289
!= type_func(value)):
1272
1290
if invalidate_only:
1273
self.PropertiesChanged(_interface,
1274
dbus.Dictionary(),
1275
dbus.Array
1276
((dbus_name,)))
1291
self.PropertiesChanged(
1292
_interface, dbus.Dictionary(),
1293
dbus.Array((dbus_name, )))
1277
1294
else:
1278
dbus_value = transform_func(type_func(value),
1279
variant_level
1280
=variant_level)
1295
dbus_value = transform_func(
1296
type_func(value),
1297
variant_level = variant_level)
1281
1298
self.PropertyChanged(dbus.String(dbus_name),
1282
1299
dbus_value)
1283
self.PropertiesChanged(_interface,
1284
dbus.Dictionary({
1285
dbus.String(dbus_name):
1286
dbus_value }), dbus.Array())
1300
self.PropertiesChanged(
1301
_interface,
1302
dbus.Dictionary({ dbus.String(dbus_name):
1303
dbus_value }),
1304
dbus.Array())
1287
1305
setattr(self, attrname, value)
1288
1306
1289
1307
return property(lambda self: getattr(self, attrname), setter)
1295
1313
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1296
1314
last_enabled = notifychangeproperty(datetime_to_dbus,
1297
1315
"LastEnabled")
1298
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1299
type_func = lambda checker:
1300
checker is not None)
1316
checker = notifychangeproperty(
1317
dbus.Boolean, "CheckerRunning",
1318
type_func = lambda checker: checker is not None)
1301
1319
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1302
1320
"LastCheckedOK")
1303
1321
last_checker_status = notifychangeproperty(dbus.Int16,
1306
1324
datetime_to_dbus, "LastApprovalRequest")
1307
1325
approved_by_default = notifychangeproperty(dbus.Boolean,
1308
1326
"ApprovedByDefault")
1309
approval_delay = notifychangeproperty(dbus.UInt64,
1310
"ApprovalDelay",
1311
type_func =
1312
lambda td: td.total_seconds()
1313
* 1000)
1327
approval_delay = notifychangeproperty(
1328
dbus.UInt64, "ApprovalDelay",
1329
type_func = lambda td: td.total_seconds() * 1000)
1314
1330
approval_duration = notifychangeproperty(
1315
1331
dbus.UInt64, "ApprovalDuration",
1316
1332
type_func = lambda td: td.total_seconds() * 1000)
1317
1333
host = notifychangeproperty(dbus.String, "Host")
1318
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1319
type_func = lambda td:
1320
td.total_seconds() * 1000)
1334
timeout = notifychangeproperty(
1335
dbus.UInt64, "Timeout",
1336
type_func = lambda td: td.total_seconds() * 1000)
1321
1337
extended_timeout = notifychangeproperty(
1322
1338
dbus.UInt64, "ExtendedTimeout",
1323
1339
type_func = lambda td: td.total_seconds() * 1000)
1324
interval = notifychangeproperty(dbus.UInt64,
1325
"Interval",
1326
type_func =
1327
lambda td: td.total_seconds()
1328
* 1000)
1340
interval = notifychangeproperty(
1341
dbus.UInt64, "Interval",
1342
type_func = lambda td: td.total_seconds() * 1000)
1329
1343
checker_command = notifychangeproperty(dbus.String, "Checker")
1330
1344
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1331
1345
invalidate_only=True)
1469
1483
return dbus.Boolean(bool(self.approvals_pending))
1470
1484
1471
1485
# ApprovedByDefault - property
1472
@dbus_service_property(_interface, signature="b",
1486
@dbus_service_property(_interface,
1487
signature="b",
1473
1488
access="readwrite")
1474
1489
def ApprovedByDefault_dbus_property(self, value=None):
1475
1490
if value is None: # get
1477
1492
self.approved_by_default = bool(value)
1478
1493
1479
1494
# ApprovalDelay - property
1480
@dbus_service_property(_interface, signature="t",
1495
@dbus_service_property(_interface,
1496
signature="t",
1481
1497
access="readwrite")
1482
1498
def ApprovalDelay_dbus_property(self, value=None):
1483
1499
if value is None: # get
1486
1502
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1487
1503
1488
1504
# ApprovalDuration - property
1489
@dbus_service_property(_interface, signature="t",
1505
@dbus_service_property(_interface,
1506
signature="t",
1490
1507
access="readwrite")
1491
1508
def ApprovalDuration_dbus_property(self, value=None):
1492
1509
if value is None: # get
1505
1522
return dbus.String(self.fingerprint)
1506
1523
1507
1524
# Host - property
1508
@dbus_service_property(_interface, signature="s",
1525
@dbus_service_property(_interface,
1526
signature="s",
1509
1527
access="readwrite")
1510
1528
def Host_dbus_property(self, value=None):
1511
1529
if value is None: # get
1523
1541
return datetime_to_dbus(self.last_enabled)
1524
1542
1525
1543
# Enabled - property
1526
@dbus_service_property(_interface, signature="b",
1544
@dbus_service_property(_interface,
1545
signature="b",
1527
1546
access="readwrite")
1528
1547
def Enabled_dbus_property(self, value=None):
1529
1548
if value is None: # get
1534
1553
self.disable()
1535
1554
1536
1555
# LastCheckedOK - property
1537
@dbus_service_property(_interface, signature="s",
1556
@dbus_service_property(_interface,
1557
signature="s",
1538
1558
access="readwrite")
1539
1559
def LastCheckedOK_dbus_property(self, value=None):
1540
1560
if value is not None:
1543
1563
return datetime_to_dbus(self.last_checked_ok)
1544
1564
1545
1565
# LastCheckerStatus - property
1546
@dbus_service_property(_interface, signature="n",
1547
access="read")
1566
@dbus_service_property(_interface, signature="n", access="read")
1548
1567
def LastCheckerStatus_dbus_property(self):
1549
1568
return dbus.Int16(self.last_checker_status)
1550
1569
1559
1578
return datetime_to_dbus(self.last_approval_request)
1560
1579
1561
1580
# Timeout - property
1562
@dbus_service_property(_interface, signature="t",
1581
@dbus_service_property(_interface,
1582
signature="t",
1563
1583
access="readwrite")
1564
1584
def Timeout_dbus_property(self, value=None):
1565
1585
if value is None: # get
1578
1598
is None):
1579
1599
return
1580
1600
gobject.source_remove(self.disable_initiator_tag)
1581
self.disable_initiator_tag = (
1582
gobject.timeout_add(
1583
int((self.expires - now).total_seconds()
1584
* 1000), self.disable))
1601
self.disable_initiator_tag = gobject.timeout_add(
1602
int((self.expires - now).total_seconds() * 1000),
1603
self.disable)
1585
1604
1586
1605
# ExtendedTimeout - property
1587
@dbus_service_property(_interface, signature="t",
1606
@dbus_service_property(_interface,
1607
signature="t",
1588
1608
access="readwrite")
1589
1609
def ExtendedTimeout_dbus_property(self, value=None):
1590
1610
if value is None: # get
1593
1613
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1594
1614
1595
1615
# Interval - property
1596
@dbus_service_property(_interface, signature="t",
1616
@dbus_service_property(_interface,
1617
signature="t",
1597
1618
access="readwrite")
1598
1619
def Interval_dbus_property(self, value=None):
1599
1620
if value is None: # get
1604
1625
if self.enabled:
1605
1626
# Reschedule checker run
1606
1627
gobject.source_remove(self.checker_initiator_tag)
1607
self.checker_initiator_tag = (gobject.timeout_add
1608
(value, self.start_checker))
1609
self.start_checker() # Start one now, too
1628
self.checker_initiator_tag = gobject.timeout_add(
1629
value, self.start_checker)
1630
self.start_checker() # Start one now, too
1610
1631
1611
1632
# Checker - property
1612
@dbus_service_property(_interface, signature="s",
1633
@dbus_service_property(_interface,
1634
signature="s",
1613
1635
access="readwrite")
1614
1636
def Checker_dbus_property(self, value=None):
1615
1637
if value is None: # get
1617
1639
self.checker_command = str(value)
1618
1640
1619
1641
# CheckerRunning - property
1620
@dbus_service_property(_interface, signature="b",
1642
@dbus_service_property(_interface,
1643
signature="b",
1621
1644
access="readwrite")
1622
1645
def CheckerRunning_dbus_property(self, value=None):
1623
1646
if value is None: # get
1633
1656
return self.dbus_object_path # is already a dbus.ObjectPath
1634
1657
1635
1658
# Secret = property
1636
@dbus_service_property(_interface, signature="ay",
1637
access="write", byte_arrays=True)
1659
@dbus_service_property(_interface,
1660
signature="ay",
1661
access="write",
1662
byte_arrays=True)
1638
1663
def Secret_dbus_property(self, value):
1639
1664
self.secret = bytes(value)
1640
1665
1656
1681
if data[0] == 'data':
1657
1682
return data[1]
1658
1683
if data[0] == 'function':
1684
1659
1685
def func(*args, **kwargs):
1660
1686
self._pipe.send(('funcall', name, args, kwargs))
1661
1687
return self._pipe.recv()[1]
1688
1662
1689
return func
1663
1690
1664
1691
def __setattr__(self, name, value):
1680
1707
logger.debug("Pipe FD: %d",
1681
1708
self.server.child_pipe.fileno())
1682
1709
1683
session = (gnutls.connection
1684
.ClientSession(self.request,
1685
gnutls.connection
1686
.X509Credentials()))
1710
session = gnutls.connection.ClientSession(
1711
self.request, gnutls.connection .X509Credentials())
1687
1712
1688
1713
# Note: gnutls.connection.X509Credentials is really a
1689
1714
# generic GnuTLS certificate credentials object so long as
1698
1723
priority = self.server.gnutls_priority
1699
1724
if priority is None:
1700
1725
priority = "NORMAL"
1701
(gnutls.library.functions
1702
.gnutls_priority_set_direct(session._c_object,
1703
priority, None))
1726
gnutls.library.functions.gnutls_priority_set_direct(
1727
session._c_object, priority, None)
1704
1728
1705
1729
# Start communication using the Mandos protocol
1706
1730
# Get protocol number
1726
1750
approval_required = False
1727
1751
try:
1728
1752
try:
1729
fpr = self.fingerprint(self.peer_certificate
1730
(session))
1753
fpr = self.fingerprint(
1754
self.peer_certificate(session))
1731
1755
except (TypeError,
1732
1756
gnutls.errors.GNUTLSError) as error:
1733
1757
logger.warning("Bad certificate: %s", error)
1748
1772
while True:
1749
1773
if not client.enabled:
1750
1774
logger.info("Client %s is disabled",
1751
client.name)
1775
client.name)
1752
1776
if self.server.use_dbus:
1753
1777
# Emit D-Bus signal
1754
1778
client.Rejected("Disabled")
1801
1825
logger.warning("gnutls send failed",
1802
1826
exc_info=error)
1803
1827
return
1804
logger.debug("Sent: %d, remaining: %d",
1805
sent, len(client.secret)
1806
- (sent_size + sent))
1828
logger.debug("Sent: %d, remaining: %d", sent,
1829
len(client.secret) - (sent_size
1830
+ sent))
1807
1831
sent_size += sent
1808
1832
1809
1833
logger.info("Sending secret to %s", client.name)
1826
1850
def peer_certificate(session):
1827
1851
"Return the peer's OpenPGP certificate as a bytestring"
1828
1852
# If not an OpenPGP certificate...
1829
if (gnutls.library.functions
1830
.gnutls_certificate_type_get(session._c_object)
1853
if (gnutls.library.functions.gnutls_certificate_type_get(
1854
session._c_object)
1831
1855
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1832
1856
# ...do the normal thing
1833
1857
return session.peer_certificate
1847
1871
def fingerprint(openpgp):
1848
1872
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1849
1873
# New GnuTLS "datum" with the OpenPGP public key
1850
datum = (gnutls.library.types
1851
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
ctypes.POINTER
1853
(ctypes.c_ubyte)),
1854
ctypes.c_uint(len(openpgp))))
1874
datum = gnutls.library.types.gnutls_datum_t(
1875
ctypes.cast(ctypes.c_char_p(openpgp),
1876
ctypes.POINTER(ctypes.c_ubyte)),
1877
ctypes.c_uint(len(openpgp)))
1855
1878
# New empty GnuTLS certificate
1856
1879
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1880
gnutls.library.functions.gnutls_openpgp_crt_init(
1881
ctypes.byref(crt))
1859
1882
# Import the OpenPGP public key into the certificate
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1862
gnutls.library.constants
1863
.GNUTLS_OPENPGP_FMT_RAW))
1883
gnutls.library.functions.gnutls_openpgp_crt_import(
1884
crt, ctypes.byref(datum),
1885
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1864
1886
# Verify the self signature in the key
1865
1887
crtverify = ctypes.c_uint()
1866
(gnutls.library.functions
1867
.gnutls_openpgp_crt_verify_self(crt, 0,
1868
ctypes.byref(crtverify)))
1888
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1889
crt, 0, ctypes.byref(crtverify))
1869
1890
if crtverify.value != 0:
1870
1891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1871
raise (gnutls.errors.CertificateSecurityError
1872
("Verify failed"))
1892
raise gnutls.errors.CertificateSecurityError(
1893
"Verify failed")
1873
1894
# New buffer for the fingerprint
1874
1895
buf = ctypes.create_string_buffer(20)
1875
1896
buf_len = ctypes.c_size_t()
1876
1897
# Get the fingerprint from the certificate into the buffer
1877
(gnutls.library.functions
1878
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1879
ctypes.byref(buf_len)))
1898
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1899
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1880
1900
# Deinit the certificate
1881
1901
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1882
1902
# Convert the buffer to a Python bytestring
1888
1908
1889
1909
class MultiprocessingMixIn(object):
1890
1910
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1911
1891
1912
def sub_process_main(self, request, address):
1892
1913
try:
1893
1914
self.finish_request(request, address)
1905
1926
1906
1927
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1907
1928
""" adds a pipe to the MixIn """
1929
1908
1930
def process_request(self, request, client_address):
1909
1931
"""Overrides and wraps the original process_request().
1910
1932
1931
1953
interface: None or a network interface name (string)
1932
1954
use_ipv6: Boolean; to use IPv6 or not
1933
1955
"""
1956
1934
1957
def __init__(self, server_address, RequestHandlerClass,
1935
interface=None, use_ipv6=True, socketfd=None):
1958
interface=None,
1959
use_ipv6=True,
1960
socketfd=None):
1936
1961
"""If socketfd is set, use that file descriptor instead of
1937
1962
creating a new one with socket.socket().
1938
1963
"""
1979
2004
self.interface)
1980
2005
else:
1981
2006
try:
1982
self.socket.setsockopt(socket.SOL_SOCKET,
1983
SO_BINDTODEVICE,
1984
(self.interface + "\0")
1985
.encode("utf-8"))
2007
self.socket.setsockopt(
2008
socket.SOL_SOCKET, SO_BINDTODEVICE,
2009
(self.interface + "\0").encode("utf-8"))
1986
2010
except socket.error as error:
1987
2011
if error.errno == errno.EPERM:
1988
2012
logger.error("No permission to bind to"
2006
2030
self.server_address = (any_address,
2007
2031
self.server_address[1])
2008
2032
elif not self.server_address[1]:
2009
self.server_address = (self.server_address[0],
2010
0)
2033
self.server_address = (self.server_address[0], 0)
2011
2034
# if self.interface:
2012
2035
# self.server_address = (self.server_address[0],
2013
2036
# 0, # port
2027
2050
2028
2051
Assumes a gobject.MainLoop event loop.
2029
2052
"""
2053
2030
2054
def __init__(self, server_address, RequestHandlerClass,
2031
interface=None, use_ipv6=True, clients=None,
2032
gnutls_priority=None, use_dbus=True, socketfd=None):
2055
interface=None,
2056
use_ipv6=True,
2057
clients=None,
2058
gnutls_priority=None,
2059
use_dbus=True,
2060
socketfd=None):
2033
2061
self.enabled = False
2034
2062
self.clients = clients
2035
2063
if self.clients is None:
2041
2069
interface = interface,
2042
2070
use_ipv6 = use_ipv6,
2043
2071
socketfd = socketfd)
2072
2044
2073
def server_activate(self):
2045
2074
if self.enabled:
2046
2075
return socketserver.TCPServer.server_activate(self)
2050
2079
2051
2080
def add_pipe(self, parent_pipe, proc):
2052
2081
# Call "handle_ipc" for both data and EOF events
2053
gobject.io_add_watch(parent_pipe.fileno(),
2054
gobject.IO_IN | gobject.IO_HUP,
2055
functools.partial(self.handle_ipc,
2056
parent_pipe =
2057
parent_pipe,
2058
proc = proc))
2082
gobject.io_add_watch(
2083
parent_pipe.fileno(),
2084
gobject.IO_IN | gobject.IO_HUP,
2085
functools.partial(self.handle_ipc,
2086
parent_pipe = parent_pipe,
2087
proc = proc))
2059
2088
2060
def handle_ipc(self, source, condition, parent_pipe=None,
2061
proc = None, client_object=None):
2089
def handle_ipc(self, source, condition,
2090
parent_pipe=None,
2091
proc = None,
2092
client_object=None):
2062
2093
# error, or the other end of multiprocessing.Pipe has closed
2063
2094
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2064
2095
# Wait for other process to exit
2087
2118
parent_pipe.send(False)
2088
2119
return False
2089
2120
2090
gobject.io_add_watch(parent_pipe.fileno(),
2091
gobject.IO_IN | gobject.IO_HUP,
2092
functools.partial(self.handle_ipc,
2093
parent_pipe =
2094
parent_pipe,
2095
proc = proc,
2096
client_object =
2097
client))
2121
gobject.io_add_watch(
2122
parent_pipe.fileno(),
2123
gobject.IO_IN | gobject.IO_HUP,
2124
functools.partial(self.handle_ipc,
2125
parent_pipe = parent_pipe,
2126
proc = proc,
2127
client_object = client))
2098
2128
parent_pipe.send(True)
2099
2129
# remove the old hook in favor of the new above hook on
2100
2130
# same fileno
2106
2136
2107
2137
parent_pipe.send(('data', getattr(client_object,
2108
2138
funcname)(*args,
2109
**kwargs)))
2139
**kwargs)))
2110
2140
2111
2141
if command == 'getattr':
2112
2142
attrname = request[1]
2113
2143
if callable(client_object.__getattribute__(attrname)):
2114
parent_pipe.send(('function',))
2144
parent_pipe.send(('function', ))
2115
2145
else:
2116
parent_pipe.send(('data', client_object
2117
.__getattribute__(attrname)))
2146
parent_pipe.send((
2147
'data', client_object.__getattribute__(attrname)))
2118
2148
2119
2149
if command == 'setattr':
2120
2150
attrname = request[1]
2160
2190
# None
2161
2191
"followers")) # Tokens valid after
2162
2192
# this token
2193
Token = collections.namedtuple("Token", (
2194
"regexp", # To match token; if "value" is not None, must have
2195
# a "group" containing digits
2196
"value", # datetime.timedelta or None
2197
"followers")) # Tokens valid after this token
2163
2198
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
2199
# the "duration" ABNF definition in RFC 3339, Appendix A.
2165
2200
token_end = Token(re.compile(r"$"), None, frozenset())
2166
2201
token_second = Token(re.compile(r"(\d+)S"),
2167
2202
datetime.timedelta(seconds=1),
2168
frozenset((token_end,)))
2203
frozenset((token_end, )))
2169
2204
token_minute = Token(re.compile(r"(\d+)M"),
2170
2205
datetime.timedelta(minutes=1),
2171
2206
frozenset((token_second, token_end)))
2187
2222
frozenset((token_month, token_end)))
2188
2223
token_week = Token(re.compile(r"(\d+)W"),
2189
2224
datetime.timedelta(weeks=1),
2190
frozenset((token_end,)))
2225
frozenset((token_end, )))
2191
2226
token_duration = Token(re.compile(r"P"), None,
2192
2227
frozenset((token_year, token_month,
2193
2228
token_day, token_time,
2261
2296
elif suffix == "w":
2262
2297
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2263
2298
else:
2264
raise ValueError("Unknown suffix {!r}"
2265
.format(suffix))
2299
raise ValueError("Unknown suffix {!r}".format(suffix))
2266
2300
except IndexError as e:
2267
2301
raise ValueError(*(e.args))
2268
2302
timevalue += delta
2284
2318
# Close all standard open file descriptors
2285
2319
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2286
2320
if not stat.S_ISCHR(os.fstat(null).st_mode):
2287
raise OSError(errno.ENODEV, "{} not a character device"
2321
raise OSError(errno.ENODEV,
2322
"{} not a character device"
2288
2323
.format(os.devnull))
2289
2324
os.dup2(null, sys.stdin.fileno())
2290
2325
os.dup2(null, sys.stdout.fileno())
2356
2391
"port": "",
2357
2392
"debug": "False",
2358
2393
"priority":
2359
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2394
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2395
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2360
2396
"servicename": "Mandos",
2361
2397
"use_dbus": "True",
2362
2398
"use_ipv6": "True",
2366
2402
"statedir": "/var/lib/mandos",
2367
2403
"foreground": "False",
2368
2404
"zeroconf": "True",
2369
}
2405
}
2370
2406
2371
2407
# Parse config file for server-global settings
2372
2408
server_config = configparser.SafeConfigParser(server_defaults)
2373
2409
del server_defaults
2374
server_config.read(os.path.join(options.configdir,
2375
"mandos.conf"))
2410
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2376
2411
# Convert the SafeConfigParser object to a dict
2377
2412
server_settings = server_config.defaults()
2378
2413
# Use the appropriate methods on the non-string config options
2396
2431
# Override the settings from the config file with command line
2397
2432
# options, if set.
2398
2433
for option in ("interface", "address", "port", "debug",
2399
"priority", "servicename", "configdir",
2400
"use_dbus", "use_ipv6", "debuglevel", "restore",
2401
"statedir", "socket", "foreground", "zeroconf"):
2434
"priority", "servicename", "configdir", "use_dbus",
2435
"use_ipv6", "debuglevel", "restore", "statedir",
2436
"socket", "foreground", "zeroconf"):
2402
2437
value = getattr(options, option)
2403
2438
if value is not None:
2404
2439
server_settings[option] = value
2419
2454
2420
2455
##################################################################
2421
2456
2422
if (not server_settings["zeroconf"] and
2423
not (server_settings["port"]
2424
or server_settings["socket"] != "")):
2425
parser.error("Needs port or socket to work without"
2426
" Zeroconf")
2457
if (not server_settings["zeroconf"]
2458
and not (server_settings["port"]
2459
or server_settings["socket"] != "")):
2460
parser.error("Needs port or socket to work without Zeroconf")
2427
2461
2428
2462
# For convenience
2429
2463
debug = server_settings["debug"]
2445
2479
initlogger(debug, level)
2446
2480
2447
2481
if server_settings["servicename"] != "Mandos":
2448
syslogger.setFormatter(logging.Formatter
2449
('Mandos ({}) [%(process)d]:'
2450
' %(levelname)s: %(message)s'
2451
.format(server_settings
2452
["servicename"])))
2482
syslogger.setFormatter(
2483
logging.Formatter('Mandos ({}) [%(process)d]:'
2484
' %(levelname)s: %(message)s'.format(
2485
server_settings["servicename"])))
2453
2486
2454
2487
# Parse config file with clients
2455
2488
client_config = configparser.SafeConfigParser(Client
2463
2496
socketfd = None
2464
2497
if server_settings["socket"] != "":
2465
2498
socketfd = server_settings["socket"]
2466
tcp_server = MandosServer((server_settings["address"],
2467
server_settings["port"]),
2468
ClientHandler,
2469
interface=(server_settings["interface"]
2470
or None),
2471
use_ipv6=use_ipv6,
2472
gnutls_priority=
2473
server_settings["priority"],
2474
use_dbus=use_dbus,
2475
socketfd=socketfd)
2499
tcp_server = MandosServer(
2500
(server_settings["address"], server_settings["port"]),
2501
ClientHandler,
2502
interface=(server_settings["interface"] or None),
2503
use_ipv6=use_ipv6,
2504
gnutls_priority=server_settings["priority"],
2505
use_dbus=use_dbus,
2506
socketfd=socketfd)
2476
2507
if not foreground:
2477
2508
pidfilename = "/run/mandos.pid"
2478
2509
if not os.path.isdir("/run/."):
2512
2543
def debug_gnutls(level, string):
2513
2544
logger.debug("GnuTLS: %s", string[:-1])
2514
2545
2515
(gnutls.library.functions
2516
.gnutls_global_set_log_function(debug_gnutls))
2546
gnutls.library.functions.gnutls_global_set_log_function(
2547
debug_gnutls)
2517
2548
2518
2549
# Redirect stdin so all checkers get /dev/null
2519
2550
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2539
2570
if use_dbus:
2540
2571
try:
2541
2572
bus_name = dbus.service.BusName("se.recompile.Mandos",
2542
bus, do_not_queue=True)
2543
old_bus_name = (dbus.service.BusName
2544
("se.bsnet.fukt.Mandos", bus,
2545
do_not_queue=True))
2546
except dbus.exceptions.NameExistsException as e:
2573
bus,
2574
do_not_queue=True)
2575
old_bus_name = dbus.service.BusName(
2576
"se.bsnet.fukt.Mandos", bus,
2577
do_not_queue=True)
2578
except dbus.exceptions.DBusException as e:
2547
2579
logger.error("Disabling D-Bus:", exc_info=e)
2548
2580
use_dbus = False
2549
2581
server_settings["use_dbus"] = False
2550
2582
tcp_server.use_dbus = False
2551
2583
if zeroconf:
2552
2584
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2553
service = AvahiServiceToSyslog(name =
2554
server_settings["servicename"],
2555
servicetype = "_mandos._tcp",
2556
protocol = protocol, bus = bus)
2585
service = AvahiServiceToSyslog(
2586
name = server_settings["servicename"],
2587
servicetype = "_mandos._tcp",
2588
protocol = protocol,
2589
bus = bus)
2557
2590
if server_settings["interface"]:
2558
service.interface = (if_nametoindex
2559
(server_settings["interface"]
2560
.encode("utf-8")))
2591
service.interface = if_nametoindex(
2592
server_settings["interface"].encode("utf-8"))
2561
2593
2562
2594
global multiprocessing_manager
2563
2595
multiprocessing_manager = multiprocessing.Manager()
2582
2614
if server_settings["restore"]:
2583
2615
try:
2584
2616
with open(stored_state_path, "rb") as stored_state:
2585
clients_data, old_client_settings = (pickle.load
2586
(stored_state))
2617
clients_data, old_client_settings = pickle.load(
2618
stored_state)
2587
2619
os.remove(stored_state_path)
2588
2620
except IOError as e:
2589
2621
if e.errno == errno.ENOENT:
2590
logger.warning("Could not load persistent state: {}"
2591
.format(os.strerror(e.errno)))
2622
logger.warning("Could not load persistent state:"
2623
" {}".format(os.strerror(e.errno)))
2592
2624
else:
2593
2625
logger.critical("Could not load persistent state:",
2594
2626
exc_info=e)
2595
2627
raise
2596
2628
except EOFError as e:
2597
2629
logger.warning("Could not load persistent state: "
2598
"EOFError:", exc_info=e)
2630
"EOFError:",
2631
exc_info=e)
2599
2632
2600
2633
with PGPEngine() as pgp:
2601
2634
for client_name, client in clients_data.items():
2613
2646
# For each value in new config, check if it
2614
2647
# differs from the old config value (Except for
2615
2648
# the "secret" attribute)
2616
if (name != "secret" and
2617
value != old_client_settings[client_name]
2618
[name]):
2649
if (name != "secret"
2650
and (value !=
2651
old_client_settings[client_name][name])):
2619
2652
client[name] = value
2620
2653
except KeyError:
2621
2654
pass
2630
2663
if not client["last_checked_ok"]:
2631
2664
logger.warning(
2632
2665
"disabling client {} - Client never "
2633
"performed a successful checker"
2634
.format(client_name))
2666
"performed a successful checker".format(
2667
client_name))
2635
2668
client["enabled"] = False
2636
2669
elif client["last_checker_status"] != 0:
2637
2670
logger.warning(
2638
2671
"disabling client {} - Client last"
2639
" checker failed with error code {}"
2640
.format(client_name,
2641
client["last_checker_status"]))
2672
" checker failed with error code"
2673
" {}".format(
2674
client_name,
2675
client["last_checker_status"]))
2642
2676
client["enabled"] = False
2643
2677
else:
2644
client["expires"] = (datetime.datetime
2645
.utcnow()
2646
+ client["timeout"])
2678
client["expires"] = (
2679
datetime.datetime.utcnow()
2680
+ client["timeout"])
2647
2681
logger.debug("Last checker succeeded,"
2648
" keeping {} enabled"
2649
.format(client_name))
2682
" keeping {} enabled".format(
2683
client_name))
2650
2684
try:
2651
client["secret"] = (
2652
pgp.decrypt(client["encrypted_secret"],
2653
client_settings[client_name]
2654
["secret"]))
2685
client["secret"] = pgp.decrypt(
2686
client["encrypted_secret"],
2687
client_settings[client_name]["secret"])
2655
2688
except PGPError:
2656
2689
# If decryption fails, we use secret from new settings
2657
logger.debug("Failed to decrypt {} old secret"
2658
.format(client_name))
2659
client["secret"] = (
2660
client_settings[client_name]["secret"])
2690
logger.debug("Failed to decrypt {} old secret".format(
2691
client_name))
2692
client["secret"] = (client_settings[client_name]
2693
["secret"])
2661
2694
2662
2695
# Add/remove clients based on new changes made to config
2663
2696
for client_name in (set(old_client_settings)
2670
2703
# Create all client objects
2671
2704
for client_name, client in clients_data.items():
2672
2705
tcp_server.clients[client_name] = client_class(
2673
name = client_name, settings = client,
2706
name = client_name,
2707
settings = client,
2674
2708
server_settings = server_settings)
2675
2709
2676
2710
if not tcp_server.clients:
2692
2726
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2693
2727
2694
2728
if use_dbus:
2695
@alternate_dbus_interfaces({"se.recompile.Mandos":
2696
"se.bsnet.fukt.Mandos"})
2729
2730
@alternate_dbus_interfaces(
2731
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2697
2732
class MandosDBusService(DBusObjectWithProperties):
2698
2733
"""A D-Bus proxy object"""
2734
2699
2735
def __init__(self):
2700
2736
dbus.service.Object.__init__(self, bus, "/")
2737
2701
2738
_interface = "se.recompile.Mandos"
2702
2739
2703
2740
@dbus_interface_annotations(_interface)
2704
2741
def _foo(self):
2705
return { "org.freedesktop.DBus.Property"
2706
".EmitsChangedSignal":
2707
"false"}
2742
return {
2743
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2744
"false" }
2708
2745
2709
2746
@dbus.service.signal(_interface, signature="o")
2710
2747
def ClientAdded(self, objpath):
2724
2761
@dbus.service.method(_interface, out_signature="ao")
2725
2762
def GetAllClients(self):
2726
2763
"D-Bus method"
2727
return dbus.Array(c.dbus_object_path
2728
for c in
2764
return dbus.Array(c.dbus_object_path for c in
2729
2765
tcp_server.clients.itervalues())
2730
2766
2731
2767
@dbus.service.method(_interface,
2780
2816
# + secret.
2781
2817
exclude = { "bus", "changedstate", "secret",
2782
2818
"checker", "server_settings" }
2783
for name, typ in (inspect.getmembers
2784
(dbus.service.Object)):
2819
for name, typ in inspect.getmembers(dbus.service
2820
.Object):
2785
2821
exclude.add(name)
2786
2822
2787
2823
client_dict["encrypted_secret"] = (client
2794
2830
del client_settings[client.name]["secret"]
2795
2831
2796
2832
try:
2797
with (tempfile.NamedTemporaryFile
2798
(mode='wb', suffix=".pickle", prefix='clients-',
2799
dir=os.path.dirname(stored_state_path),
2800
delete=False)) as stored_state:
2833
with tempfile.NamedTemporaryFile(
2834
mode='wb',
2835
suffix=".pickle",
2836
prefix='clients-',
2837
dir=os.path.dirname(stored_state_path),
2838
delete=False) as stored_state:
2801
2839
pickle.dump((clients, client_settings), stored_state)
2802
tempname=stored_state.name
2840
tempname = stored_state.name
2803
2841
os.rename(tempname, stored_state_path)
2804
2842
except (IOError, OSError) as e:
2805
2843
if not debug:
2824
2862
client.disable(quiet=True)
2825
2863
if use_dbus:
2826
2864
# Emit D-Bus signal
2827
mandos_dbus_service.ClientRemoved(client
2828
.dbus_object_path,
2829
client.name)
2865
mandos_dbus_service.ClientRemoved(
2866
client.dbus_object_path, client.name)
2830
2867
client_settings.clear()
2831
2868
2832
2869
atexit.register(cleanup)
2885
2922
# Must run before the D-Bus bus name gets deregistered
2886
2923
cleanup()
2887
2924
2925
2888
2926
if __name__ == '__main__':
2889
2927
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0