To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 755
- compare with another revision
- download diff
- download tarball
- view history from revision 755
- Committer: Teddy Hogeborn
- Date: 2015-05-31 19:05:32 UTC
- Revision ID: teddy@recompile.se-20150531190532-pfc7mega72dzzzka
mandos: More Python 3 fixes.
mandos (MandosServer/handle_ipc): Do not use callable().
mandos (MandosServer/handle_ipc): Do not use callable().
- files added:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- debian/upstream
- network-hooks.d
- files removed:
- etc-plugins.d-README
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
27
28
# along with this program. If not, see
28
29
# <http://www.gnu.org/licenses/>.
29
30
#
30
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
31
32
#
32
33
33
from __future__ import division
34
35
import SocketServer
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
36
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
36
43
import socket
37
import select
38
from optparse import OptionParser
44
import argparse
39
45
import datetime
40
46
import errno
41
47
import gnutls.crypto
44
50
import gnutls.library.functions
45
51
import gnutls.library.constants
46
52
import gnutls.library.types
47
import ConfigParser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
48
57
import sys
49
58
import re
50
59
import os
51
60
import signal
52
from sets import Set
53
61
import subprocess
54
62
import atexit
55
63
import stat
56
64
import logging
57
65
import logging.handlers
58
66
import pwd
67
import contextlib
68
import struct
69
import fcntl
70
import functools
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
75
import multiprocessing
76
import types
77
import binascii
78
import tempfile
79
import itertools
80
import collections
81
import codecs
59
82
60
83
import dbus
61
import gobject
84
import dbus.service
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
62
89
import avahi
63
90
from dbus.mainloop.glib import DBusGMainLoop
64
91
import ctypes
65
66
version = "1.0"
67
68
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
74
logger.addHandler(syslogger)
75
76
console = logging.StreamHandler()
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
79
logger.addHandler(console)
92
import ctypes.util
93
import xml.dom.minidom
94
import inspect
95
96
try:
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
98
except AttributeError:
99
try:
100
from IN import SO_BINDTODEVICE
101
except ImportError:
102
SO_BINDTODEVICE = None
103
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
108
stored_state_file = "clients.pickle"
109
110
logger = logging.getLogger()
111
syslogger = None
112
113
try:
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
116
except (OSError, AttributeError):
117
118
def if_nametoindex(interface):
119
"Get an interface index the hard way, i.e. using fcntl()"
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
with contextlib.closing(socket.socket()) as s:
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
125
return interface_index
126
127
128
def initlogger(debug, level=logging.WARNING):
129
"""init logger and add loglevel"""
130
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
syslogger.setFormatter(logging.Formatter
136
('Mandos [%(process)d]: %(levelname)s:'
137
' %(message)s'))
138
logger.addHandler(syslogger)
139
140
if debug:
141
console = logging.StreamHandler()
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
143
' [%(process)d]:'
144
' %(levelname)s:'
145
' %(message)s'))
146
logger.addHandler(console)
147
logger.setLevel(level)
148
149
150
class PGPError(Exception):
151
"""Exception if encryption/decryption fails"""
152
pass
153
154
155
class PGPEngine(object):
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
158
def __init__(self):
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
162
'--force-mdc',
163
'--quiet',
164
'--no-use-agent']
165
166
def __enter__(self):
167
return self
168
169
def __exit__(self, exc_type, exc_value, traceback):
170
self._cleanup()
171
return False
172
173
def __del__(self):
174
self._cleanup()
175
176
def _cleanup(self):
177
if self.tempdir is not None:
178
# Delete contents of tempdir
179
for root, dirs, files in os.walk(self.tempdir,
180
topdown = False):
181
for filename in files:
182
os.remove(os.path.join(root, filename))
183
for dirname in dirs:
184
os.rmdir(os.path.join(root, dirname))
185
# Remove tempdir
186
os.rmdir(self.tempdir)
187
self.tempdir = None
188
189
def password_encode(self, password):
190
# Passphrase can not be empty and can not contain newlines or
191
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
198
return encoded
199
200
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
205
passfile.flush()
206
proc = subprocess.Popen(['gpg', '--symmetric',
207
'--passphrase-file',
208
passfile.name]
209
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
215
raise PGPError(err)
216
return ciphertext
217
218
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
223
passfile.flush()
224
proc = subprocess.Popen(['gpg', '--decrypt',
225
'--passphrase-file',
226
passfile.name]
227
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
233
raise PGPError(err)
234
return decrypted_plaintext
235
80
236
81
237
class AvahiError(Exception):
82
def __init__(self, value):
238
def __init__(self, value, *args, **kwargs):
83
239
self.value = value
84
def __str__(self):
85
return repr(self.value)
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
86
243
87
244
class AvahiServiceError(AvahiError):
88
245
pass
89
246
247
90
248
class AvahiGroupError(AvahiError):
91
249
pass
92
250
93
251
94
252
class AvahiService(object):
95
253
"""An Avahi (Zeroconf) service.
254
96
255
Attributes:
97
256
interface: integer; avahi.IF_UNSPEC or an interface index.
98
257
Used to optionally bind to the specified interface.
99
258
name: string; Example: 'Mandos'
100
259
type: string; Example: '_mandos._tcp'.
101
See <http://www.dns-sd.org/ServiceTypes.html>
260
See <https://www.iana.org/assignments/service-names-port-numbers>
102
261
port: integer; what port to announce
103
262
TXT: list of strings; TXT record for the service
104
263
domain: string; Domain to publish on, default to .local if empty.
106
265
max_renames: integer; maximum number of renames
107
266
rename_count: integer; counter so we only rename after collisions
108
267
a sensible number of times
268
group: D-Bus Entry Group
269
server: D-Bus Server
270
bus: dbus.SystemBus()
109
271
"""
110
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
272
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
113
284
self.interface = interface
114
285
self.name = name
115
self.type = type
286
self.type = servicetype
116
287
self.port = port
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
288
self.TXT = TXT if TXT is not None else []
121
289
self.domain = domain
122
290
self.host = host
123
291
self.rename_count = 0
124
292
self.max_renames = max_renames
125
def rename(self):
293
self.protocol = protocol
294
self.group = None # our entry group
295
self.server = None
296
self.bus = bus
297
self.entry_group_state_changed_match = None
298
299
def rename(self, remove=True):
126
300
"""Derived from the Avahi example code"""
127
301
if self.rename_count >= self.max_renames:
128
logger.critical(u"No suitable Zeroconf service name found"
129
u" after %i retries, exiting.",
130
rename_count)
302
logger.critical("No suitable Zeroconf service name found"
303
" after %i retries, exiting.",
304
self.rename_count)
131
305
raise AvahiServiceError("Too many renames")
132
self.name = server.GetAlternativeServiceName(self.name)
133
logger.info(u"Changing Zeroconf service name to %r ...",
134
str(self.name))
135
syslogger.setFormatter(logging.Formatter\
136
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
138
self.remove()
139
self.add()
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
140
308
self.rename_count += 1
309
logger.info("Changing Zeroconf service name to %r ...",
310
self.name)
311
if remove:
312
self.remove()
313
try:
314
self.add()
315
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
324
141
325
def remove(self):
142
326
"""Derived from the Avahi example code"""
143
if group is not None:
144
group.Reset()
327
if self.entry_group_state_changed_match is not None:
328
self.entry_group_state_changed_match.remove()
329
self.entry_group_state_changed_match = None
330
if self.group is not None:
331
self.group.Reset()
332
145
333
def add(self):
146
334
"""Derived from the Avahi example code"""
147
global group
148
if group is None:
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
151
server.EntryGroupNew()),
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
group.connect_to_signal('StateChanged',
154
entry_group_state_changed)
155
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
156
service.name, service.type)
157
group.AddService(
158
self.interface, # interface
159
avahi.PROTO_INET6, # protocol
160
dbus.UInt32(0), # flags
161
self.name, self.type,
162
self.domain, self.host,
163
dbus.UInt16(self.port),
164
avahi.string_array_to_txt_array(self.TXT))
165
group.Commit()
166
167
# From the Avahi example code:
168
group = None # our entry group
169
# End of Avahi example code
335
self.remove()
336
if self.group is None:
337
self.group = dbus.Interface(
338
self.bus.get_object(avahi.DBUS_NAME,
339
self.server.EntryGroupNew()),
340
avahi.DBUS_INTERFACE_ENTRY_GROUP)
341
self.entry_group_state_changed_match = (
342
self.group.connect_to_signal(
343
'StateChanged', self.entry_group_state_changed))
344
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
345
self.name, self.type)
346
self.group.AddService(
347
self.interface,
348
self.protocol,
349
dbus.UInt32(0), # flags
350
self.name, self.type,
351
self.domain, self.host,
352
dbus.UInt16(self.port),
353
avahi.string_array_to_txt_array(self.TXT))
354
self.group.Commit()
355
356
def entry_group_state_changed(self, state, error):
357
"""Derived from the Avahi example code"""
358
logger.debug("Avahi entry group state change: %i", state)
359
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
361
logger.debug("Zeroconf service established.")
362
elif state == avahi.ENTRY_GROUP_COLLISION:
363
logger.info("Zeroconf service name collision.")
364
self.rename()
365
elif state == avahi.ENTRY_GROUP_FAILURE:
366
logger.critical("Avahi: Error in group state changed %s",
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
369
370
def cleanup(self):
371
"""Derived from the Avahi example code"""
372
if self.group is not None:
373
try:
374
self.group.Free()
375
except (dbus.exceptions.UnknownMethodException,
376
dbus.exceptions.DBusException):
377
pass
378
self.group = None
379
self.remove()
380
381
def server_state_changed(self, state, error=None):
382
"""Derived from the Avahi example code"""
383
logger.debug("Avahi server state change: %i", state)
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
390
if state in bad_states:
391
if bad_states[state] is not None:
392
if error is None:
393
logger.error(bad_states[state])
394
else:
395
logger.error(bad_states[state] + ": %r", error)
396
self.cleanup()
397
elif state == avahi.SERVER_RUNNING:
398
self.add()
399
else:
400
if error is None:
401
logger.debug("Unknown state: %r", state)
402
else:
403
logger.debug("Unknown state: %r: %r", state, error)
404
405
def activate(self):
406
"""Derived from the Avahi example code"""
407
if self.server is None:
408
self.server = dbus.Interface(
409
self.bus.get_object(avahi.DBUS_NAME,
410
avahi.DBUS_PATH_SERVER,
411
follow_name_owner_changes=True),
412
avahi.DBUS_INTERFACE_SERVER)
413
self.server.connect_to_signal("StateChanged",
414
self.server_state_changed)
415
self.server_state_changed(self.server.GetState())
416
417
418
class AvahiServiceToSyslog(AvahiService):
419
def rename(self, *args, **kwargs):
420
"""Add the new name to the syslog messages"""
421
ret = AvahiService.rename(self, *args, **kwargs)
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
.format(self.name)))
425
return ret
170
426
171
427
172
428
class Client(object):
173
429
"""A representation of a client host served by this server.
430
174
431
Attributes:
175
name: string; from the config file, used in log messages
432
approved: bool(); 'None' if not yet approved/disapproved
433
approval_delay: datetime.timedelta(); Time to wait for approval
434
approval_duration: datetime.timedelta(); Duration of one approval
435
checker: subprocess.Popen(); a running checker process used
436
to see if the client lives.
437
'None' if no process is running.
438
checker_callback_tag: a gobject event source tag, or None
439
checker_command: string; External command which is run to check
440
if client lives. %() expansions are done at
441
runtime with vars(self) as dict, so that for
442
instance %(name)s can be used in the command.
443
checker_initiator_tag: a gobject event source tag, or None
444
created: datetime.datetime(); (UTC) object creation
445
client_structure: Object describing what attributes a client has
446
and is used for storing the client at exit
447
current_checker_command: string; current running checker_command
448
disable_initiator_tag: a gobject event source tag, or None
449
enabled: bool()
176
450
fingerprint: string (40 or 32 hexadecimal digits); used to
177
451
uniquely identify the client
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
189
checker_initiator_tag: a gobject event source tag, or None
190
stop_initiator_tag: - '' -
191
checker_callback_tag: - '' -
192
checker_command: string; External command which is run to check if
193
client lives. %() expansions are done at
194
runtime with vars(self) as dict, so that for
195
instance %(name)s can be used in the command.
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
452
host: string; available for use by the checker command
453
interval: datetime.timedelta(); How often to start a new checker
454
last_approval_request: datetime.datetime(); (UTC) or None
455
last_checked_ok: datetime.datetime(); (UTC) or None
456
last_checker_status: integer between 0 and 255 reflecting exit
457
status of last checker. -1 reflects crashed
458
checker, -2 means no checker completed yet.
459
last_enabled: datetime.datetime(); (UTC) or None
460
name: string; from the config file, used in log messages and
461
D-Bus identifiers
462
secret: bytestring; sent verbatim (over TLS) to client
463
timeout: datetime.timedelta(); How long from last_checked_ok
464
until this client is disabled
465
extended_timeout: extra long timeout when secret has been sent
466
runtime_expansions: Allowed attributes for runtime expansion.
467
expires: datetime.datetime(); time (UTC) when a client will be
468
disabled, or None
469
server_settings: The server_settings dict from main()
201
470
"""
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
226
"""Note: the 'checker' key in 'config' sets the
227
'checker_command' attribute and *not* the 'checker'
228
attribute."""
471
472
runtime_expansions = ("approval_delay", "approval_duration",
473
"created", "enabled", "expires",
474
"fingerprint", "host", "interval",
475
"last_approval_request", "last_checked_ok",
476
"last_enabled", "name", "timeout")
477
client_defaults = {
478
"timeout": "PT5M",
479
"extended_timeout": "PT15M",
480
"interval": "PT2M",
481
"checker": "fping -q -- %%(host)s",
482
"host": "",
483
"approval_delay": "PT0S",
484
"approval_duration": "PT1S",
485
"approved_by_default": "True",
486
"enabled": "True",
487
}
488
489
@staticmethod
490
def config_parser(config):
491
"""Construct a new dict of client settings of this form:
492
{ client_name: {setting_name: value, ...}, ...}
493
with exceptions for any special settings as defined above.
494
NOTE: Must be a pure function. Must return the same result
495
value given the same arguments.
496
"""
497
settings = {}
498
for client_name in config.sections():
499
section = dict(config.items(client_name))
500
client = settings[client_name] = {}
501
502
client["host"] = section["host"]
503
# Reformat values from string types to Python types
504
client["approved_by_default"] = config.getboolean(
505
client_name, "approved_by_default")
506
client["enabled"] = config.getboolean(client_name,
507
"enabled")
508
509
# Uppercase and remove spaces from fingerprint for later
510
# comparison purposes with return value from the
511
# fingerprint() function
512
client["fingerprint"] = (section["fingerprint"].upper()
513
.replace(" ", ""))
514
if "secret" in section:
515
client["secret"] = section["secret"].decode("base64")
516
elif "secfile" in section:
517
with open(os.path.expanduser(os.path.expandvars
518
(section["secfile"])),
519
"rb") as secfile:
520
client["secret"] = secfile.read()
521
else:
522
raise TypeError("No secret or secfile for section {}"
523
.format(section))
524
client["timeout"] = string_to_delta(section["timeout"])
525
client["extended_timeout"] = string_to_delta(
526
section["extended_timeout"])
527
client["interval"] = string_to_delta(section["interval"])
528
client["approval_delay"] = string_to_delta(
529
section["approval_delay"])
530
client["approval_duration"] = string_to_delta(
531
section["approval_duration"])
532
client["checker_command"] = section["checker"]
533
client["last_approval_request"] = None
534
client["last_checked_ok"] = None
535
client["last_checker_status"] = -2
536
537
return settings
538
539
def __init__(self, settings, name = None, server_settings=None):
229
540
self.name = name
230
logger.debug(u"Creating client %r", self.name)
231
# Uppercase and remove spaces from fingerprint for later
232
# comparison purposes with return value from the fingerprint()
233
# function
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
if "secret" in config:
238
self.secret = config["secret"].decode(u"base64")
239
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
541
if server_settings is None:
542
server_settings = {}
543
self.server_settings = server_settings
544
# adding all client settings
545
for setting, value in settings.items():
546
setattr(self, setting, value)
547
548
if self.enabled:
549
if not hasattr(self, "last_enabled"):
550
self.last_enabled = datetime.datetime.utcnow()
551
if not hasattr(self, "expires"):
552
self.expires = (datetime.datetime.utcnow()
553
+ self.timeout)
243
554
else:
244
raise TypeError(u"No secret or secfile for client %s"
245
% self.name)
246
self.host = config.get("host", "")
247
self.created = datetime.datetime.now()
248
self.last_checked_ok = None
249
self.timeout = string_to_delta(config["timeout"])
250
self.interval = string_to_delta(config["interval"])
251
self.stop_hook = stop_hook
555
self.last_enabled = None
556
self.expires = None
557
558
logger.debug("Creating client %r", self.name)
559
logger.debug(" Fingerprint: %s", self.fingerprint)
560
self.created = settings.get("created",
561
datetime.datetime.utcnow())
562
563
# attributes specific for this server instance
252
564
self.checker = None
253
565
self.checker_initiator_tag = None
254
self.stop_initiator_tag = None
566
self.disable_initiator_tag = None
255
567
self.checker_callback_tag = None
256
self.check_command = config["checker"]
257
def start(self):
568
self.current_checker_command = None
569
self.approved = None
570
self.approvals_pending = 0
571
self.changedstate = multiprocessing_manager.Condition(
572
multiprocessing_manager.Lock())
573
self.client_structure = [attr
574
for attr in self.__dict__.iterkeys()
575
if not attr.startswith("_")]
576
self.client_structure.append("client_structure")
577
578
for name, t in inspect.getmembers(
579
type(self), lambda obj: isinstance(obj, property)):
580
if not name.startswith("_"):
581
self.client_structure.append(name)
582
583
# Send notice to process children that client state has changed
584
def send_changedstate(self):
585
with self.changedstate:
586
self.changedstate.notify_all()
587
588
def enable(self):
258
589
"""Start this client's checker and timeout hooks"""
590
if getattr(self, "enabled", False):
591
# Already enabled
592
return
593
self.expires = datetime.datetime.utcnow() + self.timeout
594
self.enabled = True
595
self.last_enabled = datetime.datetime.utcnow()
596
self.init_checker()
597
self.send_changedstate()
598
599
def disable(self, quiet=True):
600
"""Disable this client."""
601
if not getattr(self, "enabled", False):
602
return False
603
if not quiet:
604
logger.info("Disabling client %s", self.name)
605
if getattr(self, "disable_initiator_tag", None) is not None:
606
gobject.source_remove(self.disable_initiator_tag)
607
self.disable_initiator_tag = None
608
self.expires = None
609
if getattr(self, "checker_initiator_tag", None) is not None:
610
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = None
612
self.stop_checker()
613
self.enabled = False
614
if not quiet:
615
self.send_changedstate()
616
# Do not run this again if called by a gobject.timeout_add
617
return False
618
619
def __del__(self):
620
self.disable()
621
622
def init_checker(self):
259
623
# Schedule a new checker to be started an 'interval' from now,
260
624
# and every interval from then on.
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
625
if self.checker_initiator_tag is not None:
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
629
self.start_checker)
630
# Schedule a disable() when 'timeout' has passed
631
if self.disable_initiator_tag is not None:
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
634
int(self.timeout.total_seconds() * 1000), self.disable)
264
635
# Also start a new checker *right now*.
265
636
self.start_checker()
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
279
return False
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
283
if getattr(self, "checker_initiator_tag", False):
284
gobject.source_remove(self.checker_initiator_tag)
285
self.checker_initiator_tag = None
286
self.stop_checker()
287
if self.stop_hook:
288
self.stop_hook(self)
289
# Do not run this again if called by a gobject.timeout_add
290
return False
291
def __del__(self):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
637
638
def checker_callback(self, pid, condition, command):
295
639
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
640
self.checker_callback_tag = None
298
641
self.checker = None
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
301
logger.info(u"Checker for %(name)s succeeded",
302
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
308
elif not os.WIFEXITED(condition):
309
logger.warning(u"Checker for %(name)s crashed?",
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
644
if self.last_checker_status == 0:
645
logger.info("Checker for %(name)s succeeded",
646
vars(self))
647
self.checked_ok()
648
else:
649
logger.info("Checker for %(name)s failed", vars(self))
650
else:
651
self.last_checker_status = -1
652
logger.warning("Checker for %(name)s crashed?",
310
653
vars(self))
311
else:
312
logger.info(u"Checker for %(name)s failed",
313
vars(self))
654
655
def checked_ok(self):
656
"""Assert that the client has been seen, alive and well."""
657
self.last_checked_ok = datetime.datetime.utcnow()
658
self.last_checker_status = 0
659
self.bump_timeout()
660
661
def bump_timeout(self, timeout=None):
662
"""Bump up the timeout for this client."""
663
if timeout is None:
664
timeout = self.timeout
665
if self.disable_initiator_tag is not None:
666
gobject.source_remove(self.disable_initiator_tag)
667
self.disable_initiator_tag = None
668
if getattr(self, "enabled", False):
669
self.disable_initiator_tag = gobject.timeout_add(
670
int(timeout.total_seconds() * 1000), self.disable)
671
self.expires = datetime.datetime.utcnow() + timeout
672
673
def need_approval(self):
674
self.last_approval_request = datetime.datetime.utcnow()
675
314
676
def start_checker(self):
315
677
"""Start a new checker subprocess if one is not running.
678
316
679
If a checker already exists, leave it running and do
317
680
nothing."""
318
681
# The reason for not killing a running checker is that if we
319
# did that, then if a checker (for some reason) started
320
# running slowly and taking more than 'interval' time, the
321
# client would inevitably timeout, since no checker would get
322
# a chance to run to completion. If we instead leave running
682
# did that, and if a checker (for some reason) started running
683
# slowly and taking more than 'interval' time, then the client
684
# would inevitably timeout, since no checker would get a
685
# chance to run to completion. If we instead leave running
323
686
# checkers alone, the checker would have to take more time
324
# than 'timeout' for the client to be declared invalid, which
325
# is as it should be.
687
# than 'timeout' for the client to be disabled, which is as it
688
# should be.
689
690
# If a checker exists, make sure it is not a zombie
691
try:
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except AttributeError:
694
pass
695
except OSError as error:
696
if error.errno != errno.ECHILD:
697
raise
698
else:
699
if pid:
700
logger.warning("Checker was a zombie")
701
gobject.source_remove(self.checker_callback_tag)
702
self.checker_callback(pid, status,
703
self.current_checker_command)
704
# Start a new checker if needed
326
705
if self.checker is None:
327
try:
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
330
except TypeError:
331
# Escape attributes for the shell
332
escaped_attrs = dict((key, re.escape(str(val)))
333
for key, val in
334
vars(self).iteritems())
335
try:
336
command = self.check_command % escaped_attrs
337
except TypeError, error:
338
logger.error(u'Could not format string "%s":'
339
u' %s', self.check_command, error)
340
return True # Try again later
341
try:
342
logger.info(u"Starting checker %r for %s",
343
command, self.name)
706
# Escape attributes for the shell
707
escaped_attrs = {
708
attr: re.escape(str(getattr(self, attr)))
709
for attr in self.runtime_expansions }
710
try:
711
command = self.checker_command % escaped_attrs
712
except TypeError as error:
713
logger.error('Could not format string "%s"',
714
self.checker_command,
715
exc_info=error)
716
return True # Try again later
717
self.current_checker_command = command
718
try:
719
logger.info("Starting checker %r for %s", command,
720
self.name)
344
721
# We don't need to redirect stdout and stderr, since
345
722
# in normal mode, that is already done by daemon(),
346
723
# and in debug mode we don't want to. (Stdin is
347
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
727
# created wnull.
728
popen_args = {}
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
732
"stderr": wnull })
348
733
self.checker = subprocess.Popen(command,
349
734
close_fds=True,
350
shell=True, cwd="/")
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
354
except OSError, error:
355
logger.error(u"Failed to start subprocess: %s",
356
error)
735
shell=True,
736
cwd="/",
737
**popen_args)
738
except OSError as error:
739
logger.error("Failed to start subprocess",
740
exc_info=error)
741
return True
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
746
try:
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
752
exc_info=error)
753
return True
754
raise
755
if pid:
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
357
758
# Re-run this periodically if run by gobject.timeout_add
358
759
return True
760
359
761
def stop_checker(self):
360
762
"""Force the checker process, if any, to stop."""
361
763
if self.checker_callback_tag:
363
765
self.checker_callback_tag = None
364
766
if getattr(self, "checker", None) is None:
365
767
return
366
logger.debug(u"Stopping checker for %(name)s", vars(self))
768
logger.debug("Stopping checker for %(name)s", vars(self))
367
769
try:
368
os.kill(self.checker.pid, signal.SIGTERM)
369
#os.sleep(0.5)
770
self.checker.terminate()
771
#time.sleep(0.5)
370
772
#if self.checker.poll() is None:
371
# os.kill(self.checker.pid, signal.SIGKILL)
372
except OSError, error:
773
# self.checker.kill()
774
except OSError as error:
373
775
if error.errno != errno.ESRCH: # No such process
374
776
raise
375
777
self.checker = None
376
def still_valid(self):
377
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
379
if self.last_checked_ok is None:
380
return now < (self.created + self.timeout)
381
else:
382
return now < (self.last_checked_ok + self.timeout)
383
384
385
def peer_certificate(session):
386
"Return the peer's OpenPGP certificate as a bytestring"
387
# If not an OpenPGP certificate...
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
391
# ...do the normal thing
392
return session.peer_certificate
393
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
396
if list_size.value == 0:
397
return None
398
cert = cert_list[0]
399
return ctypes.string_at(cert.data, cert.size)
400
401
402
def fingerprint(openpgp):
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
# New GnuTLS "datum" with the OpenPGP public key
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
409
# New empty GnuTLS certificate
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
413
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
417
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
421
if crtverify.value != 0:
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
427
# Get the fingerprint from the certificate into the buffer
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
430
# Deinit the certificate
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
434
# Convert the bytestring to hexadecimal notation
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
436
return hex_fpr
437
438
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
440
"""A TCP request handler class.
441
Instantiated by IPv6_TCPServer for each request to handle it.
778
779
780
def dbus_service_property(dbus_interface,
781
signature="v",
782
access="readwrite",
783
byte_arrays=False):
784
"""Decorators for marking methods of a DBusObjectWithProperties to
785
become properties on the D-Bus.
786
787
The decorated method will be called with no arguments by "Get"
788
and with one argument by "Set".
789
790
The parameters, where they are supported, are the same as
791
dbus.service.method, except there is only "signature", since the
792
type from Get() and the type sent to Set() is the same.
793
"""
794
# Encoding deeply encoded byte arrays is not supported yet by the
795
# "Set" method, so we fail early here:
796
if byte_arrays and signature != "ay":
797
raise ValueError("Byte arrays not supported for non-'ay'"
798
" signature {!r}".format(signature))
799
800
def decorator(func):
801
func._dbus_is_property = True
802
func._dbus_interface = dbus_interface
803
func._dbus_signature = signature
804
func._dbus_access = access
805
func._dbus_name = func.__name__
806
if func._dbus_name.endswith("_dbus_property"):
807
func._dbus_name = func._dbus_name[:-14]
808
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
809
return func
810
811
return decorator
812
813
814
def dbus_interface_annotations(dbus_interface):
815
"""Decorator for marking functions returning interface annotations
816
817
Usage:
818
819
@dbus_interface_annotations("org.example.Interface")
820
def _foo(self): # Function name does not matter
821
return {"org.freedesktop.DBus.Deprecated": "true",
822
"org.freedesktop.DBus.Property.EmitsChangedSignal":
823
"false"}
824
"""
825
826
def decorator(func):
827
func._dbus_is_interface = True
828
func._dbus_interface = dbus_interface
829
func._dbus_name = dbus_interface
830
return func
831
832
return decorator
833
834
835
def dbus_annotations(annotations):
836
"""Decorator to annotate D-Bus methods, signals or properties
837
Usage:
838
839
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
842
@dbus_service_property("org.example.Interface", signature="b",
843
access="r")
844
def Property_dbus_property(self):
845
return dbus.Boolean(False)
846
"""
847
848
def decorator(func):
849
func._dbus_annotations = annotations
850
return func
851
852
return decorator
853
854
855
class DBusPropertyException(dbus.exceptions.DBusException):
856
"""A base class for D-Bus property-related exceptions
857
"""
858
pass
859
860
861
class DBusPropertyAccessException(DBusPropertyException):
862
"""A property's access permissions disallows an operation.
863
"""
864
pass
865
866
867
class DBusPropertyNotFound(DBusPropertyException):
868
"""An attempt was made to access a non-existing property.
869
"""
870
pass
871
872
873
class DBusObjectWithProperties(dbus.service.Object):
874
"""A D-Bus object with properties.
875
876
Classes inheriting from this can use the dbus_service_property
877
decorator to expose methods as D-Bus properties. It exposes the
878
standard Get(), Set(), and GetAll() methods on the D-Bus.
879
"""
880
881
@staticmethod
882
def _is_dbus_thing(thing):
883
"""Returns a function testing if an attribute is a D-Bus thing
884
885
If called like _is_dbus_thing("method") it returns a function
886
suitable for use as predicate to inspect.getmembers().
887
"""
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
889
False)
890
891
def _get_all_dbus_things(self, thing):
892
"""Returns a generator of (name, attribute) pairs
893
"""
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
895
athing.__get__(self))
896
for cls in self.__class__.__mro__
897
for name, athing in
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
899
900
def _get_dbus_property(self, interface_name, property_name):
901
"""Returns a bound method if one exists which is a D-Bus
902
property with the specified name and interface.
903
"""
904
for cls in self.__class__.__mro__:
905
for name, value in inspect.getmembers(
906
cls, self._is_dbus_thing("property")):
907
if (value._dbus_name == property_name
908
and value._dbus_interface == interface_name):
909
return value.__get__(self)
910
911
# No such property
912
raise DBusPropertyNotFound("{}:{}.{}".format(
913
self.dbus_object_path, interface_name, property_name))
914
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
916
in_signature="ss",
917
out_signature="v")
918
def Get(self, interface_name, property_name):
919
"""Standard D-Bus property Get() method, see D-Bus standard.
920
"""
921
prop = self._get_dbus_property(interface_name, property_name)
922
if prop._dbus_access == "write":
923
raise DBusPropertyAccessException(property_name)
924
value = prop()
925
if not hasattr(value, "variant_level"):
926
return value
927
return type(value)(value, variant_level=value.variant_level+1)
928
929
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
930
def Set(self, interface_name, property_name, value):
931
"""Standard D-Bus property Set() method, see D-Bus standard.
932
"""
933
prop = self._get_dbus_property(interface_name, property_name)
934
if prop._dbus_access == "read":
935
raise DBusPropertyAccessException(property_name)
936
if prop._dbus_get_args_options["byte_arrays"]:
937
# The byte_arrays option is not supported yet on
938
# signatures other than "ay".
939
if prop._dbus_signature != "ay":
940
raise ValueError("Byte arrays not supported for non-"
941
"'ay' signature {!r}"
942
.format(prop._dbus_signature))
943
value = dbus.ByteArray(b''.join(chr(byte)
944
for byte in value))
945
prop(value)
946
947
@dbus.service.method(dbus.PROPERTIES_IFACE,
948
in_signature="s",
949
out_signature="a{sv}")
950
def GetAll(self, interface_name):
951
"""Standard D-Bus property GetAll() method, see D-Bus
952
standard.
953
954
Note: Will not include properties with access="write".
955
"""
956
properties = {}
957
for name, prop in self._get_all_dbus_things("property"):
958
if (interface_name
959
and interface_name != prop._dbus_interface):
960
# Interface non-empty but did not match
961
continue
962
# Ignore write-only properties
963
if prop._dbus_access == "write":
964
continue
965
value = prop()
966
if not hasattr(value, "variant_level"):
967
properties[name] = value
968
continue
969
properties[name] = type(value)(
970
value, variant_level = value.variant_level + 1)
971
return dbus.Dictionary(properties, signature="sv")
972
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
974
def PropertiesChanged(self, interface_name, changed_properties,
975
invalidated_properties):
976
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
977
standard.
978
"""
979
pass
980
981
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
982
out_signature="s",
983
path_keyword='object_path',
984
connection_keyword='connection')
985
def Introspect(self, object_path, connection):
986
"""Overloading of standard D-Bus method.
987
988
Inserts property tags and interface annotation tags.
989
"""
990
xmlstring = dbus.service.Object.Introspect(self, object_path,
991
connection)
992
try:
993
document = xml.dom.minidom.parseString(xmlstring)
994
995
def make_tag(document, name, prop):
996
e = document.createElement("property")
997
e.setAttribute("name", name)
998
e.setAttribute("type", prop._dbus_signature)
999
e.setAttribute("access", prop._dbus_access)
1000
return e
1001
1002
for if_tag in document.getElementsByTagName("interface"):
1003
# Add property tags
1004
for tag in (make_tag(document, name, prop)
1005
for name, prop
1006
in self._get_all_dbus_things("property")
1007
if prop._dbus_interface
1008
== if_tag.getAttribute("name")):
1009
if_tag.appendChild(tag)
1010
# Add annotation tags
1011
for typ in ("method", "signal", "property"):
1012
for tag in if_tag.getElementsByTagName(typ):
1013
annots = dict()
1014
for name, prop in (self.
1015
_get_all_dbus_things(typ)):
1016
if (name == tag.getAttribute("name")
1017
and prop._dbus_interface
1018
== if_tag.getAttribute("name")):
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
1022
ann_tag = document.createElement(
1023
"annotation")
1024
ann_tag.setAttribute("name", name)
1025
ann_tag.setAttribute("value", value)
1026
tag.appendChild(ann_tag)
1027
# Add interface annotation tags
1028
for annotation, value in dict(
1029
itertools.chain.from_iterable(
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1033
if name == if_tag.getAttribute("name")
1034
)).items():
1035
ann_tag = document.createElement("annotation")
1036
ann_tag.setAttribute("name", annotation)
1037
ann_tag.setAttribute("value", value)
1038
if_tag.appendChild(ann_tag)
1039
# Add the names to the return values for the
1040
# "org.freedesktop.DBus.Properties" methods
1041
if (if_tag.getAttribute("name")
1042
== "org.freedesktop.DBus.Properties"):
1043
for cn in if_tag.getElementsByTagName("method"):
1044
if cn.getAttribute("name") == "Get":
1045
for arg in cn.getElementsByTagName("arg"):
1046
if (arg.getAttribute("direction")
1047
== "out"):
1048
arg.setAttribute("name", "value")
1049
elif cn.getAttribute("name") == "GetAll":
1050
for arg in cn.getElementsByTagName("arg"):
1051
if (arg.getAttribute("direction")
1052
== "out"):
1053
arg.setAttribute("name", "props")
1054
xmlstring = document.toxml("utf-8")
1055
document.unlink()
1056
except (AttributeError, xml.dom.DOMException,
1057
xml.parsers.expat.ExpatError) as error:
1058
logger.error("Failed to override Introspection method",
1059
exc_info=error)
1060
return xmlstring
1061
1062
1063
def datetime_to_dbus(dt, variant_level=0):
1064
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
if dt is None:
1066
return dbus.String("", variant_level = variant_level)
1067
return dbus.String(dt.isoformat(), variant_level=variant_level)
1068
1069
1070
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1071
"""A class decorator; applied to a subclass of
1072
dbus.service.Object, it will add alternate D-Bus attributes with
1073
interface names according to the "alt_interface_names" mapping.
1074
Usage:
1075
1076
@alternate_dbus_interfaces({"org.example.Interface":
1077
"net.example.AlternateInterface"})
1078
class SampleDBusObject(dbus.service.Object):
1079
@dbus.service.method("org.example.Interface")
1080
def SampleDBusMethod():
1081
pass
1082
1083
The above "SampleDBusMethod" on "SampleDBusObject" will be
1084
reachable via two interfaces: "org.example.Interface" and
1085
"net.example.AlternateInterface", the latter of which will have
1086
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1087
"true", unless "deprecate" is passed with a False value.
1088
1089
This works for methods and signals, and also for D-Bus properties
1090
(from DBusObjectWithProperties) and interfaces (from the
1091
dbus_interface_annotations decorator).
1092
"""
1093
1094
def wrapper(cls):
1095
for orig_interface_name, alt_interface_name in (
1096
alt_interface_names.items()):
1097
attr = {}
1098
interface_names = set()
1099
# Go though all attributes of the class
1100
for attrname, attribute in inspect.getmembers(cls):
1101
# Ignore non-D-Bus attributes, and D-Bus attributes
1102
# with the wrong interface name
1103
if (not hasattr(attribute, "_dbus_interface")
1104
or not attribute._dbus_interface.startswith(
1105
orig_interface_name)):
1106
continue
1107
# Create an alternate D-Bus interface name based on
1108
# the current name
1109
alt_interface = attribute._dbus_interface.replace(
1110
orig_interface_name, alt_interface_name)
1111
interface_names.add(alt_interface)
1112
# Is this a D-Bus signal?
1113
if getattr(attribute, "_dbus_is_signal", False):
1114
if sys.version == 2:
1115
# Extract the original non-method undecorated
1116
# function by black magic
1117
nonmethod_func = (dict(
1118
zip(attribute.func_code.co_freevars,
1119
attribute.__closure__))
1120
["func"].cell_contents)
1121
else:
1122
nonmethod_func = attribute
1123
# Create a new, but exactly alike, function
1124
# object, and decorate it to be a new D-Bus signal
1125
# with the alternate D-Bus interface name
1126
if sys.version == 2:
1127
new_function = types.FunctionType(
1128
nonmethod_func.func_code,
1129
nonmethod_func.func_globals,
1130
nonmethod_func.func_name,
1131
nonmethod_func.func_defaults,
1132
nonmethod_func.func_closure)
1133
else:
1134
new_function = types.FunctionType(
1135
nonmethod_func.__code__,
1136
nonmethod_func.__globals__,
1137
nonmethod_func.__name__,
1138
nonmethod_func.__defaults__,
1139
nonmethod_func.__closure__)
1140
new_function = (dbus.service.signal(
1141
alt_interface,
1142
attribute._dbus_signature)(new_function))
1143
# Copy annotations, if any
1144
try:
1145
new_function._dbus_annotations = dict(
1146
attribute._dbus_annotations)
1147
except AttributeError:
1148
pass
1149
# Define a creator of a function to call both the
1150
# original and alternate functions, so both the
1151
# original and alternate signals gets sent when
1152
# the function is called
1153
def fixscope(func1, func2):
1154
"""This function is a scope container to pass
1155
func1 and func2 to the "call_both" function
1156
outside of its arguments"""
1157
1158
def call_both(*args, **kwargs):
1159
"""This function will emit two D-Bus
1160
signals by calling func1 and func2"""
1161
func1(*args, **kwargs)
1162
func2(*args, **kwargs)
1163
1164
return call_both
1165
# Create the "call_both" function and add it to
1166
# the class
1167
attr[attrname] = fixscope(attribute, new_function)
1168
# Is this a D-Bus method?
1169
elif getattr(attribute, "_dbus_is_method", False):
1170
# Create a new, but exactly alike, function
1171
# object. Decorate it to be a new D-Bus method
1172
# with the alternate D-Bus interface name. Add it
1173
# to the class.
1174
attr[attrname] = (
1175
dbus.service.method(
1176
alt_interface,
1177
attribute._dbus_in_signature,
1178
attribute._dbus_out_signature)
1179
(types.FunctionType(attribute.func_code,
1180
attribute.func_globals,
1181
attribute.func_name,
1182
attribute.func_defaults,
1183
attribute.func_closure)))
1184
# Copy annotations, if any
1185
try:
1186
attr[attrname]._dbus_annotations = dict(
1187
attribute._dbus_annotations)
1188
except AttributeError:
1189
pass
1190
# Is this a D-Bus property?
1191
elif getattr(attribute, "_dbus_is_property", False):
1192
# Create a new, but exactly alike, function
1193
# object, and decorate it to be a new D-Bus
1194
# property with the alternate D-Bus interface
1195
# name. Add it to the class.
1196
attr[attrname] = (dbus_service_property(
1197
alt_interface, attribute._dbus_signature,
1198
attribute._dbus_access,
1199
attribute._dbus_get_args_options
1200
["byte_arrays"])
1201
(types.FunctionType(
1202
attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1207
# Copy annotations, if any
1208
try:
1209
attr[attrname]._dbus_annotations = dict(
1210
attribute._dbus_annotations)
1211
except AttributeError:
1212
pass
1213
# Is this a D-Bus interface?
1214
elif getattr(attribute, "_dbus_is_interface", False):
1215
# Create a new, but exactly alike, function
1216
# object. Decorate it to be a new D-Bus interface
1217
# with the alternate D-Bus interface name. Add it
1218
# to the class.
1219
attr[attrname] = (
1220
dbus_interface_annotations(alt_interface)
1221
(types.FunctionType(attribute.func_code,
1222
attribute.func_globals,
1223
attribute.func_name,
1224
attribute.func_defaults,
1225
attribute.func_closure)))
1226
if deprecate:
1227
# Deprecate all alternate interfaces
1228
iname="_AlternateDBusNames_interface_annotation{}"
1229
for interface_name in interface_names:
1230
1231
@dbus_interface_annotations(interface_name)
1232
def func(self):
1233
return { "org.freedesktop.DBus.Deprecated":
1234
"true" }
1235
# Find an unused name
1236
for aname in (iname.format(i)
1237
for i in itertools.count()):
1238
if aname not in attr:
1239
attr[aname] = func
1240
break
1241
if interface_names:
1242
# Replace the class with a new subclass of it with
1243
# methods, signals, etc. as created above.
1244
cls = type(b"{}Alternate".format(cls.__name__),
1245
(cls, ), attr)
1246
return cls
1247
1248
return wrapper
1249
1250
1251
@alternate_dbus_interfaces({"se.recompile.Mandos":
1252
"se.bsnet.fukt.Mandos"})
1253
class ClientDBus(Client, DBusObjectWithProperties):
1254
"""A Client class using D-Bus
1255
1256
Attributes:
1257
dbus_object_path: dbus.ObjectPath
1258
bus: dbus.SystemBus()
1259
"""
1260
1261
runtime_expansions = (Client.runtime_expansions
1262
+ ("dbus_object_path", ))
1263
1264
_interface = "se.recompile.Mandos.Client"
1265
1266
# dbus.service.Object doesn't use super(), so we can't either.
1267
1268
def __init__(self, bus = None, *args, **kwargs):
1269
self.bus = bus
1270
Client.__init__(self, *args, **kwargs)
1271
# Only now, when this client is initialized, can it show up on
1272
# the D-Bus
1273
client_object_name = str(self.name).translate(
1274
{ord("."): ord("_"),
1275
ord("-"): ord("_")})
1276
self.dbus_object_path = dbus.ObjectPath(
1277
"/clients/" + client_object_name)
1278
DBusObjectWithProperties.__init__(self, self.bus,
1279
self.dbus_object_path)
1280
1281
def notifychangeproperty(transform_func, dbus_name,
1282
type_func=lambda x: x,
1283
variant_level=1,
1284
invalidate_only=False,
1285
_interface=_interface):
1286
""" Modify a variable so that it's a property which announces
1287
its changes to DBus.
1288
1289
transform_fun: Function that takes a value and a variant_level
1290
and transforms it to a D-Bus type.
1291
dbus_name: D-Bus name of the variable
1292
type_func: Function that transform the value before sending it
1293
to the D-Bus. Default: no transform
1294
variant_level: D-Bus variant level. Default: 1
1295
"""
1296
attrname = "_{}".format(dbus_name)
1297
1298
def setter(self, value):
1299
if hasattr(self, "dbus_object_path"):
1300
if (not hasattr(self, attrname) or
1301
type_func(getattr(self, attrname, None))
1302
!= type_func(value)):
1303
if invalidate_only:
1304
self.PropertiesChanged(
1305
_interface, dbus.Dictionary(),
1306
dbus.Array((dbus_name, )))
1307
else:
1308
dbus_value = transform_func(
1309
type_func(value),
1310
variant_level = variant_level)
1311
self.PropertyChanged(dbus.String(dbus_name),
1312
dbus_value)
1313
self.PropertiesChanged(
1314
_interface,
1315
dbus.Dictionary({ dbus.String(dbus_name):
1316
dbus_value }),
1317
dbus.Array())
1318
setattr(self, attrname, value)
1319
1320
return property(lambda self: getattr(self, attrname), setter)
1321
1322
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1323
approvals_pending = notifychangeproperty(dbus.Boolean,
1324
"ApprovalPending",
1325
type_func = bool)
1326
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1327
last_enabled = notifychangeproperty(datetime_to_dbus,
1328
"LastEnabled")
1329
checker = notifychangeproperty(
1330
dbus.Boolean, "CheckerRunning",
1331
type_func = lambda checker: checker is not None)
1332
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1333
"LastCheckedOK")
1334
last_checker_status = notifychangeproperty(dbus.Int16,
1335
"LastCheckerStatus")
1336
last_approval_request = notifychangeproperty(
1337
datetime_to_dbus, "LastApprovalRequest")
1338
approved_by_default = notifychangeproperty(dbus.Boolean,
1339
"ApprovedByDefault")
1340
approval_delay = notifychangeproperty(
1341
dbus.UInt64, "ApprovalDelay",
1342
type_func = lambda td: td.total_seconds() * 1000)
1343
approval_duration = notifychangeproperty(
1344
dbus.UInt64, "ApprovalDuration",
1345
type_func = lambda td: td.total_seconds() * 1000)
1346
host = notifychangeproperty(dbus.String, "Host")
1347
timeout = notifychangeproperty(
1348
dbus.UInt64, "Timeout",
1349
type_func = lambda td: td.total_seconds() * 1000)
1350
extended_timeout = notifychangeproperty(
1351
dbus.UInt64, "ExtendedTimeout",
1352
type_func = lambda td: td.total_seconds() * 1000)
1353
interval = notifychangeproperty(
1354
dbus.UInt64, "Interval",
1355
type_func = lambda td: td.total_seconds() * 1000)
1356
checker_command = notifychangeproperty(dbus.String, "Checker")
1357
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1358
invalidate_only=True)
1359
1360
del notifychangeproperty
1361
1362
def __del__(self, *args, **kwargs):
1363
try:
1364
self.remove_from_connection()
1365
except LookupError:
1366
pass
1367
if hasattr(DBusObjectWithProperties, "__del__"):
1368
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1369
Client.__del__(self, *args, **kwargs)
1370
1371
def checker_callback(self, pid, condition, command,
1372
*args, **kwargs):
1373
self.checker_callback_tag = None
1374
self.checker = None
1375
if os.WIFEXITED(condition):
1376
exitstatus = os.WEXITSTATUS(condition)
1377
# Emit D-Bus signal
1378
self.CheckerCompleted(dbus.Int16(exitstatus),
1379
dbus.Int64(condition),
1380
dbus.String(command))
1381
else:
1382
# Emit D-Bus signal
1383
self.CheckerCompleted(dbus.Int16(-1),
1384
dbus.Int64(condition),
1385
dbus.String(command))
1386
1387
return Client.checker_callback(self, pid, condition, command,
1388
*args, **kwargs)
1389
1390
def start_checker(self, *args, **kwargs):
1391
old_checker_pid = getattr(self.checker, "pid", None)
1392
r = Client.start_checker(self, *args, **kwargs)
1393
# Only if new checker process was started
1394
if (self.checker is not None
1395
and old_checker_pid != self.checker.pid):
1396
# Emit D-Bus signal
1397
self.CheckerStarted(self.current_checker_command)
1398
return r
1399
1400
def _reset_approved(self):
1401
self.approved = None
1402
return False
1403
1404
def approve(self, value=True):
1405
self.approved = value
1406
gobject.timeout_add(int(self.approval_duration.total_seconds()
1407
* 1000), self._reset_approved)
1408
self.send_changedstate()
1409
1410
## D-Bus methods, signals & properties
1411
1412
## Interfaces
1413
1414
## Signals
1415
1416
# CheckerCompleted - signal
1417
@dbus.service.signal(_interface, signature="nxs")
1418
def CheckerCompleted(self, exitcode, waitstatus, command):
1419
"D-Bus signal"
1420
pass
1421
1422
# CheckerStarted - signal
1423
@dbus.service.signal(_interface, signature="s")
1424
def CheckerStarted(self, command):
1425
"D-Bus signal"
1426
pass
1427
1428
# PropertyChanged - signal
1429
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1430
@dbus.service.signal(_interface, signature="sv")
1431
def PropertyChanged(self, property, value):
1432
"D-Bus signal"
1433
pass
1434
1435
# GotSecret - signal
1436
@dbus.service.signal(_interface)
1437
def GotSecret(self):
1438
"""D-Bus signal
1439
Is sent after a successful transfer of secret from the Mandos
1440
server to mandos-client
1441
"""
1442
pass
1443
1444
# Rejected - signal
1445
@dbus.service.signal(_interface, signature="s")
1446
def Rejected(self, reason):
1447
"D-Bus signal"
1448
pass
1449
1450
# NeedApproval - signal
1451
@dbus.service.signal(_interface, signature="tb")
1452
def NeedApproval(self, timeout, default):
1453
"D-Bus signal"
1454
return self.need_approval()
1455
1456
## Methods
1457
1458
# Approve - method
1459
@dbus.service.method(_interface, in_signature="b")
1460
def Approve(self, value):
1461
self.approve(value)
1462
1463
# CheckedOK - method
1464
@dbus.service.method(_interface)
1465
def CheckedOK(self):
1466
self.checked_ok()
1467
1468
# Enable - method
1469
@dbus.service.method(_interface)
1470
def Enable(self):
1471
"D-Bus method"
1472
self.enable()
1473
1474
# StartChecker - method
1475
@dbus.service.method(_interface)
1476
def StartChecker(self):
1477
"D-Bus method"
1478
self.start_checker()
1479
1480
# Disable - method
1481
@dbus.service.method(_interface)
1482
def Disable(self):
1483
"D-Bus method"
1484
self.disable()
1485
1486
# StopChecker - method
1487
@dbus.service.method(_interface)
1488
def StopChecker(self):
1489
self.stop_checker()
1490
1491
## Properties
1492
1493
# ApprovalPending - property
1494
@dbus_service_property(_interface, signature="b", access="read")
1495
def ApprovalPending_dbus_property(self):
1496
return dbus.Boolean(bool(self.approvals_pending))
1497
1498
# ApprovedByDefault - property
1499
@dbus_service_property(_interface,
1500
signature="b",
1501
access="readwrite")
1502
def ApprovedByDefault_dbus_property(self, value=None):
1503
if value is None: # get
1504
return dbus.Boolean(self.approved_by_default)
1505
self.approved_by_default = bool(value)
1506
1507
# ApprovalDelay - property
1508
@dbus_service_property(_interface,
1509
signature="t",
1510
access="readwrite")
1511
def ApprovalDelay_dbus_property(self, value=None):
1512
if value is None: # get
1513
return dbus.UInt64(self.approval_delay.total_seconds()
1514
* 1000)
1515
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1516
1517
# ApprovalDuration - property
1518
@dbus_service_property(_interface,
1519
signature="t",
1520
access="readwrite")
1521
def ApprovalDuration_dbus_property(self, value=None):
1522
if value is None: # get
1523
return dbus.UInt64(self.approval_duration.total_seconds()
1524
* 1000)
1525
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1526
1527
# Name - property
1528
@dbus_service_property(_interface, signature="s", access="read")
1529
def Name_dbus_property(self):
1530
return dbus.String(self.name)
1531
1532
# Fingerprint - property
1533
@dbus_service_property(_interface, signature="s", access="read")
1534
def Fingerprint_dbus_property(self):
1535
return dbus.String(self.fingerprint)
1536
1537
# Host - property
1538
@dbus_service_property(_interface,
1539
signature="s",
1540
access="readwrite")
1541
def Host_dbus_property(self, value=None):
1542
if value is None: # get
1543
return dbus.String(self.host)
1544
self.host = str(value)
1545
1546
# Created - property
1547
@dbus_service_property(_interface, signature="s", access="read")
1548
def Created_dbus_property(self):
1549
return datetime_to_dbus(self.created)
1550
1551
# LastEnabled - property
1552
@dbus_service_property(_interface, signature="s", access="read")
1553
def LastEnabled_dbus_property(self):
1554
return datetime_to_dbus(self.last_enabled)
1555
1556
# Enabled - property
1557
@dbus_service_property(_interface,
1558
signature="b",
1559
access="readwrite")
1560
def Enabled_dbus_property(self, value=None):
1561
if value is None: # get
1562
return dbus.Boolean(self.enabled)
1563
if value:
1564
self.enable()
1565
else:
1566
self.disable()
1567
1568
# LastCheckedOK - property
1569
@dbus_service_property(_interface,
1570
signature="s",
1571
access="readwrite")
1572
def LastCheckedOK_dbus_property(self, value=None):
1573
if value is not None:
1574
self.checked_ok()
1575
return
1576
return datetime_to_dbus(self.last_checked_ok)
1577
1578
# LastCheckerStatus - property
1579
@dbus_service_property(_interface, signature="n", access="read")
1580
def LastCheckerStatus_dbus_property(self):
1581
return dbus.Int16(self.last_checker_status)
1582
1583
# Expires - property
1584
@dbus_service_property(_interface, signature="s", access="read")
1585
def Expires_dbus_property(self):
1586
return datetime_to_dbus(self.expires)
1587
1588
# LastApprovalRequest - property
1589
@dbus_service_property(_interface, signature="s", access="read")
1590
def LastApprovalRequest_dbus_property(self):
1591
return datetime_to_dbus(self.last_approval_request)
1592
1593
# Timeout - property
1594
@dbus_service_property(_interface,
1595
signature="t",
1596
access="readwrite")
1597
def Timeout_dbus_property(self, value=None):
1598
if value is None: # get
1599
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1600
old_timeout = self.timeout
1601
self.timeout = datetime.timedelta(0, 0, 0, value)
1602
# Reschedule disabling
1603
if self.enabled:
1604
now = datetime.datetime.utcnow()
1605
self.expires += self.timeout - old_timeout
1606
if self.expires <= now:
1607
# The timeout has passed
1608
self.disable()
1609
else:
1610
if (getattr(self, "disable_initiator_tag", None)
1611
is None):
1612
return
1613
gobject.source_remove(self.disable_initiator_tag)
1614
self.disable_initiator_tag = gobject.timeout_add(
1615
int((self.expires - now).total_seconds() * 1000),
1616
self.disable)
1617
1618
# ExtendedTimeout - property
1619
@dbus_service_property(_interface,
1620
signature="t",
1621
access="readwrite")
1622
def ExtendedTimeout_dbus_property(self, value=None):
1623
if value is None: # get
1624
return dbus.UInt64(self.extended_timeout.total_seconds()
1625
* 1000)
1626
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1627
1628
# Interval - property
1629
@dbus_service_property(_interface,
1630
signature="t",
1631
access="readwrite")
1632
def Interval_dbus_property(self, value=None):
1633
if value is None: # get
1634
return dbus.UInt64(self.interval.total_seconds() * 1000)
1635
self.interval = datetime.timedelta(0, 0, 0, value)
1636
if getattr(self, "checker_initiator_tag", None) is None:
1637
return
1638
if self.enabled:
1639
# Reschedule checker run
1640
gobject.source_remove(self.checker_initiator_tag)
1641
self.checker_initiator_tag = gobject.timeout_add(
1642
value, self.start_checker)
1643
self.start_checker() # Start one now, too
1644
1645
# Checker - property
1646
@dbus_service_property(_interface,
1647
signature="s",
1648
access="readwrite")
1649
def Checker_dbus_property(self, value=None):
1650
if value is None: # get
1651
return dbus.String(self.checker_command)
1652
self.checker_command = str(value)
1653
1654
# CheckerRunning - property
1655
@dbus_service_property(_interface,
1656
signature="b",
1657
access="readwrite")
1658
def CheckerRunning_dbus_property(self, value=None):
1659
if value is None: # get
1660
return dbus.Boolean(self.checker is not None)
1661
if value:
1662
self.start_checker()
1663
else:
1664
self.stop_checker()
1665
1666
# ObjectPath - property
1667
@dbus_service_property(_interface, signature="o", access="read")
1668
def ObjectPath_dbus_property(self):
1669
return self.dbus_object_path # is already a dbus.ObjectPath
1670
1671
# Secret = property
1672
@dbus_service_property(_interface,
1673
signature="ay",
1674
access="write",
1675
byte_arrays=True)
1676
def Secret_dbus_property(self, value):
1677
self.secret = bytes(value)
1678
1679
del _interface
1680
1681
1682
class ProxyClient(object):
1683
def __init__(self, child_pipe, fpr, address):
1684
self._pipe = child_pipe
1685
self._pipe.send(('init', fpr, address))
1686
if not self._pipe.recv():
1687
raise KeyError(fpr)
1688
1689
def __getattribute__(self, name):
1690
if name == '_pipe':
1691
return super(ProxyClient, self).__getattribute__(name)
1692
self._pipe.send(('getattr', name))
1693
data = self._pipe.recv()
1694
if data[0] == 'data':
1695
return data[1]
1696
if data[0] == 'function':
1697
1698
def func(*args, **kwargs):
1699
self._pipe.send(('funcall', name, args, kwargs))
1700
return self._pipe.recv()[1]
1701
1702
return func
1703
1704
def __setattr__(self, name, value):
1705
if name == '_pipe':
1706
return super(ProxyClient, self).__setattr__(name, value)
1707
self._pipe.send(('setattr', name, value))
1708
1709
1710
class ClientHandler(socketserver.BaseRequestHandler, object):
1711
"""A class to handle client connections.
1712
1713
Instantiated once for each connection to handle it.
442
1714
Note: This will run in its own forked process."""
443
1715
444
1716
def handle(self):
445
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
449
450
line = self.request.makefile().readline()
451
logger.debug(u"Protocol version: %r", line)
452
try:
453
if int(line.strip().split()[0]) > 1:
454
raise RuntimeError
455
except (ValueError, IndexError, RuntimeError), error:
456
logger.error(u"Unknown protocol version: %s", error)
457
return
458
459
# Note: gnutls.connection.X509Credentials is really a generic
460
# GnuTLS certificate credentials object so long as no X.509
461
# keys are added to it. Therefore, we can use it here despite
462
# using OpenPGP certificates.
463
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
473
474
try:
475
session.handshake()
476
except gnutls.errors.GNUTLSError, error:
477
logger.warning(u"Handshake failed: %s", error)
478
# Do not run session.bye() here: the session is not
479
# established. Just abandon the request.
480
return
481
try:
482
fpr = fingerprint(peer_certificate(session))
483
except (TypeError, gnutls.errors.GNUTLSError), error:
484
logger.warning(u"Bad certificate: %s", error)
485
session.bye()
486
return
487
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
489
for c in self.server.clients:
490
if c.fingerprint == fpr:
491
client = c
492
break
493
if not client:
494
logger.warning(u"Client not found for fingerprint: %s",
495
fpr)
496
session.bye()
497
return
498
# Have to check if client.still_valid(), since it is possible
499
# that the client timed out while establishing the GnuTLS
500
# session.
501
if not client.still_valid():
502
logger.warning(u"Client %(name)s is invalid",
503
vars(client))
504
session.bye()
505
return
506
sent_size = 0
507
while sent_size < len(client.secret):
508
sent = session.send(client.secret[sent_size:])
509
logger.debug(u"Sent: %d, remaining: %d",
510
sent, len(client.secret)
511
- (sent_size + sent))
512
sent_size += sent
513
session.bye()
514
515
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1717
with contextlib.closing(self.server.child_pipe) as child_pipe:
1718
logger.info("TCP connection from: %s",
1719
str(self.client_address))
1720
logger.debug("Pipe FD: %d",
1721
self.server.child_pipe.fileno())
1722
1723
session = gnutls.connection.ClientSession(
1724
self.request, gnutls.connection .X509Credentials())
1725
1726
# Note: gnutls.connection.X509Credentials is really a
1727
# generic GnuTLS certificate credentials object so long as
1728
# no X.509 keys are added to it. Therefore, we can use it
1729
# here despite using OpenPGP certificates.
1730
1731
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1732
# "+AES-256-CBC", "+SHA1",
1733
# "+COMP-NULL", "+CTYPE-OPENPGP",
1734
# "+DHE-DSS"))
1735
# Use a fallback default, since this MUST be set.
1736
priority = self.server.gnutls_priority
1737
if priority is None:
1738
priority = "NORMAL"
1739
gnutls.library.functions.gnutls_priority_set_direct(
1740
session._c_object, priority, None)
1741
1742
# Start communication using the Mandos protocol
1743
# Get protocol number
1744
line = self.request.makefile().readline()
1745
logger.debug("Protocol version: %r", line)
1746
try:
1747
if int(line.strip().split()[0]) > 1:
1748
raise RuntimeError(line)
1749
except (ValueError, IndexError, RuntimeError) as error:
1750
logger.error("Unknown protocol version: %s", error)
1751
return
1752
1753
# Start GnuTLS connection
1754
try:
1755
session.handshake()
1756
except gnutls.errors.GNUTLSError as error:
1757
logger.warning("Handshake failed: %s", error)
1758
# Do not run session.bye() here: the session is not
1759
# established. Just abandon the request.
1760
return
1761
logger.debug("Handshake succeeded")
1762
1763
approval_required = False
1764
try:
1765
try:
1766
fpr = self.fingerprint(
1767
self.peer_certificate(session))
1768
except (TypeError,
1769
gnutls.errors.GNUTLSError) as error:
1770
logger.warning("Bad certificate: %s", error)
1771
return
1772
logger.debug("Fingerprint: %s", fpr)
1773
1774
try:
1775
client = ProxyClient(child_pipe, fpr,
1776
self.client_address)
1777
except KeyError:
1778
return
1779
1780
if client.approval_delay:
1781
delay = client.approval_delay
1782
client.approvals_pending += 1
1783
approval_required = True
1784
1785
while True:
1786
if not client.enabled:
1787
logger.info("Client %s is disabled",
1788
client.name)
1789
if self.server.use_dbus:
1790
# Emit D-Bus signal
1791
client.Rejected("Disabled")
1792
return
1793
1794
if client.approved or not client.approval_delay:
1795
#We are approved or approval is disabled
1796
break
1797
elif client.approved is None:
1798
logger.info("Client %s needs approval",
1799
client.name)
1800
if self.server.use_dbus:
1801
# Emit D-Bus signal
1802
client.NeedApproval(
1803
client.approval_delay.total_seconds()
1804
* 1000, client.approved_by_default)
1805
else:
1806
logger.warning("Client %s was not approved",
1807
client.name)
1808
if self.server.use_dbus:
1809
# Emit D-Bus signal
1810
client.Rejected("Denied")
1811
return
1812
1813
#wait until timeout or approved
1814
time = datetime.datetime.now()
1815
client.changedstate.acquire()
1816
client.changedstate.wait(delay.total_seconds())
1817
client.changedstate.release()
1818
time2 = datetime.datetime.now()
1819
if (time2 - time) >= delay:
1820
if not client.approved_by_default:
1821
logger.warning("Client %s timed out while"
1822
" waiting for approval",
1823
client.name)
1824
if self.server.use_dbus:
1825
# Emit D-Bus signal
1826
client.Rejected("Approval timed out")
1827
return
1828
else:
1829
break
1830
else:
1831
delay -= time2 - time
1832
1833
sent_size = 0
1834
while sent_size < len(client.secret):
1835
try:
1836
sent = session.send(client.secret[sent_size:])
1837
except gnutls.errors.GNUTLSError as error:
1838
logger.warning("gnutls send failed",
1839
exc_info=error)
1840
return
1841
logger.debug("Sent: %d, remaining: %d", sent,
1842
len(client.secret) - (sent_size
1843
+ sent))
1844
sent_size += sent
1845
1846
logger.info("Sending secret to %s", client.name)
1847
# bump the timeout using extended_timeout
1848
client.bump_timeout(client.extended_timeout)
1849
if self.server.use_dbus:
1850
# Emit D-Bus signal
1851
client.GotSecret()
1852
1853
finally:
1854
if approval_required:
1855
client.approvals_pending -= 1
1856
try:
1857
session.bye()
1858
except gnutls.errors.GNUTLSError as error:
1859
logger.warning("GnuTLS bye failed",
1860
exc_info=error)
1861
1862
@staticmethod
1863
def peer_certificate(session):
1864
"Return the peer's OpenPGP certificate as a bytestring"
1865
# If not an OpenPGP certificate...
1866
if (gnutls.library.functions.gnutls_certificate_type_get(
1867
session._c_object)
1868
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1869
# ...do the normal thing
1870
return session.peer_certificate
1871
list_size = ctypes.c_uint(1)
1872
cert_list = (gnutls.library.functions
1873
.gnutls_certificate_get_peers
1874
(session._c_object, ctypes.byref(list_size)))
1875
if not bool(cert_list) and list_size.value != 0:
1876
raise gnutls.errors.GNUTLSError("error getting peer"
1877
" certificate")
1878
if list_size.value == 0:
1879
return None
1880
cert = cert_list[0]
1881
return ctypes.string_at(cert.data, cert.size)
1882
1883
@staticmethod
1884
def fingerprint(openpgp):
1885
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1886
# New GnuTLS "datum" with the OpenPGP public key
1887
datum = gnutls.library.types.gnutls_datum_t(
1888
ctypes.cast(ctypes.c_char_p(openpgp),
1889
ctypes.POINTER(ctypes.c_ubyte)),
1890
ctypes.c_uint(len(openpgp)))
1891
# New empty GnuTLS certificate
1892
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1893
gnutls.library.functions.gnutls_openpgp_crt_init(
1894
ctypes.byref(crt))
1895
# Import the OpenPGP public key into the certificate
1896
gnutls.library.functions.gnutls_openpgp_crt_import(
1897
crt, ctypes.byref(datum),
1898
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1899
# Verify the self signature in the key
1900
crtverify = ctypes.c_uint()
1901
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1902
crt, 0, ctypes.byref(crtverify))
1903
if crtverify.value != 0:
1904
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1905
raise gnutls.errors.CertificateSecurityError(
1906
"Verify failed")
1907
# New buffer for the fingerprint
1908
buf = ctypes.create_string_buffer(20)
1909
buf_len = ctypes.c_size_t()
1910
# Get the fingerprint from the certificate into the buffer
1911
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1912
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1913
# Deinit the certificate
1914
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1915
# Convert the buffer to a Python bytestring
1916
fpr = ctypes.string_at(buf, buf_len.value)
1917
# Convert the bytestring to hexadecimal notation
1918
hex_fpr = binascii.hexlify(fpr).upper()
1919
return hex_fpr
1920
1921
1922
class MultiprocessingMixIn(object):
1923
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1924
1925
def sub_process_main(self, request, address):
1926
try:
1927
self.finish_request(request, address)
1928
except Exception:
1929
self.handle_error(request, address)
1930
self.close_request(request)
1931
1932
def process_request(self, request, address):
1933
"""Start a new process to process the request."""
1934
proc = multiprocessing.Process(target = self.sub_process_main,
1935
args = (request, address))
1936
proc.start()
1937
return proc
1938
1939
1940
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1941
""" adds a pipe to the MixIn """
1942
1943
def process_request(self, request, client_address):
1944
"""Overrides and wraps the original process_request().
1945
1946
This function creates a new pipe in self.pipe
1947
"""
1948
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1949
1950
proc = MultiprocessingMixIn.process_request(self, request,
1951
client_address)
1952
self.child_pipe.close()
1953
self.add_pipe(parent_pipe, proc)
1954
1955
def add_pipe(self, parent_pipe, proc):
1956
"""Dummy function; override as necessary"""
1957
raise NotImplementedError()
1958
1959
1960
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1961
socketserver.TCPServer, object):
1962
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1963
518
1964
Attributes:
519
settings: Server settings
520
clients: Set() of Client objects
521
1965
enabled: Boolean; whether this server is activated yet
1966
interface: None or a network interface name (string)
1967
use_ipv6: Boolean; to use IPv6 or not
522
1968
"""
523
address_family = socket.AF_INET6
524
def __init__(self, *args, **kwargs):
525
if "settings" in kwargs:
526
self.settings = kwargs["settings"]
527
del kwargs["settings"]
528
if "clients" in kwargs:
529
self.clients = kwargs["clients"]
530
del kwargs["clients"]
531
self.enabled = False
532
return super(type(self), self).__init__(*args, **kwargs)
1969
1970
def __init__(self, server_address, RequestHandlerClass,
1971
interface=None,
1972
use_ipv6=True,
1973
socketfd=None):
1974
"""If socketfd is set, use that file descriptor instead of
1975
creating a new one with socket.socket().
1976
"""
1977
self.interface = interface
1978
if use_ipv6:
1979
self.address_family = socket.AF_INET6
1980
if socketfd is not None:
1981
# Save the file descriptor
1982
self.socketfd = socketfd
1983
# Save the original socket.socket() function
1984
self.socket_socket = socket.socket
1985
# To implement --socket, we monkey patch socket.socket.
1986
#
1987
# (When socketserver.TCPServer is a new-style class, we
1988
# could make self.socket into a property instead of monkey
1989
# patching socket.socket.)
1990
#
1991
# Create a one-time-only replacement for socket.socket()
1992
@functools.wraps(socket.socket)
1993
def socket_wrapper(*args, **kwargs):
1994
# Restore original function so subsequent calls are
1995
# not affected.
1996
socket.socket = self.socket_socket
1997
del self.socket_socket
1998
# This time only, return a new socket object from the
1999
# saved file descriptor.
2000
return socket.fromfd(self.socketfd, *args, **kwargs)
2001
# Replace socket.socket() function with wrapper
2002
socket.socket = socket_wrapper
2003
# The socketserver.TCPServer.__init__ will call
2004
# socket.socket(), which might be our replacement,
2005
# socket_wrapper(), if socketfd was set.
2006
socketserver.TCPServer.__init__(self, server_address,
2007
RequestHandlerClass)
2008
533
2009
def server_bind(self):
534
2010
"""This overrides the normal server_bind() function
535
2011
to bind to an interface if one was specified, and also NOT to
536
2012
bind to an address or port if they were not specified."""
537
if self.settings["interface"]:
538
# 25 is from /usr/include/asm-i486/socket.h
539
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
540
try:
541
self.socket.setsockopt(socket.SOL_SOCKET,
542
SO_BINDTODEVICE,
543
self.settings["interface"])
544
except socket.error, error:
545
if error[0] == errno.EPERM:
546
logger.error(u"No permission to"
547
u" bind to interface %s",
548
self.settings["interface"])
549
else:
550
raise error
2013
if self.interface is not None:
2014
if SO_BINDTODEVICE is None:
2015
logger.error("SO_BINDTODEVICE does not exist;"
2016
" cannot bind to interface %s",
2017
self.interface)
2018
else:
2019
try:
2020
self.socket.setsockopt(
2021
socket.SOL_SOCKET, SO_BINDTODEVICE,
2022
(self.interface + "\0").encode("utf-8"))
2023
except socket.error as error:
2024
if error.errno == errno.EPERM:
2025
logger.error("No permission to bind to"
2026
" interface %s", self.interface)
2027
elif error.errno == errno.ENOPROTOOPT:
2028
logger.error("SO_BINDTODEVICE not available;"
2029
" cannot bind to interface %s",
2030
self.interface)
2031
elif error.errno == errno.ENODEV:
2032
logger.error("Interface %s does not exist,"
2033
" cannot bind", self.interface)
2034
else:
2035
raise
551
2036
# Only bind(2) the socket if we really need to.
552
2037
if self.server_address[0] or self.server_address[1]:
553
2038
if not self.server_address[0]:
554
in6addr_any = "::"
555
self.server_address = (in6addr_any,
2039
if self.address_family == socket.AF_INET6:
2040
any_address = "::" # in6addr_any
2041
else:
2042
any_address = "0.0.0.0" # INADDR_ANY
2043
self.server_address = (any_address,
556
2044
self.server_address[1])
557
2045
elif not self.server_address[1]:
558
self.server_address = (self.server_address[0],
559
0)
560
# if self.settings["interface"]:
2046
self.server_address = (self.server_address[0], 0)
2047
# if self.interface:
561
2048
# self.server_address = (self.server_address[0],
562
2049
# 0, # port
563
2050
# 0, # flowinfo
564
2051
# if_nametoindex
565
# (self.settings
566
# ["interface"]))
567
return super(type(self), self).server_bind()
2052
# (self.interface))
2053
return socketserver.TCPServer.server_bind(self)
2054
2055
2056
class MandosServer(IPv6_TCPServer):
2057
"""Mandos server.
2058
2059
Attributes:
2060
clients: set of Client objects
2061
gnutls_priority GnuTLS priority string
2062
use_dbus: Boolean; to emit D-Bus signals or not
2063
2064
Assumes a gobject.MainLoop event loop.
2065
"""
2066
2067
def __init__(self, server_address, RequestHandlerClass,
2068
interface=None,
2069
use_ipv6=True,
2070
clients=None,
2071
gnutls_priority=None,
2072
use_dbus=True,
2073
socketfd=None):
2074
self.enabled = False
2075
self.clients = clients
2076
if self.clients is None:
2077
self.clients = {}
2078
self.use_dbus = use_dbus
2079
self.gnutls_priority = gnutls_priority
2080
IPv6_TCPServer.__init__(self, server_address,
2081
RequestHandlerClass,
2082
interface = interface,
2083
use_ipv6 = use_ipv6,
2084
socketfd = socketfd)
2085
568
2086
def server_activate(self):
569
2087
if self.enabled:
570
return super(type(self), self).server_activate()
2088
return socketserver.TCPServer.server_activate(self)
2089
571
2090
def enable(self):
572
2091
self.enabled = True
2092
2093
def add_pipe(self, parent_pipe, proc):
2094
# Call "handle_ipc" for both data and EOF events
2095
gobject.io_add_watch(
2096
parent_pipe.fileno(),
2097
gobject.IO_IN | gobject.IO_HUP,
2098
functools.partial(self.handle_ipc,
2099
parent_pipe = parent_pipe,
2100
proc = proc))
2101
2102
def handle_ipc(self, source, condition,
2103
parent_pipe=None,
2104
proc = None,
2105
client_object=None):
2106
# error, or the other end of multiprocessing.Pipe has closed
2107
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2108
# Wait for other process to exit
2109
proc.join()
2110
return False
2111
2112
# Read a request from the child
2113
request = parent_pipe.recv()
2114
command = request[0]
2115
2116
if command == 'init':
2117
fpr = request[1]
2118
address = request[2]
2119
2120
for c in self.clients.itervalues():
2121
if c.fingerprint == fpr:
2122
client = c
2123
break
2124
else:
2125
logger.info("Client not found for fingerprint: %s, ad"
2126
"dress: %s", fpr, address)
2127
if self.use_dbus:
2128
# Emit D-Bus signal
2129
mandos_dbus_service.ClientNotFound(fpr,
2130
address[0])
2131
parent_pipe.send(False)
2132
return False
2133
2134
gobject.io_add_watch(
2135
parent_pipe.fileno(),
2136
gobject.IO_IN | gobject.IO_HUP,
2137
functools.partial(self.handle_ipc,
2138
parent_pipe = parent_pipe,
2139
proc = proc,
2140
client_object = client))
2141
parent_pipe.send(True)
2142
# remove the old hook in favor of the new above hook on
2143
# same fileno
2144
return False
2145
if command == 'funcall':
2146
funcname = request[1]
2147
args = request[2]
2148
kwargs = request[3]
2149
2150
parent_pipe.send(('data', getattr(client_object,
2151
funcname)(*args,
2152
**kwargs)))
2153
2154
if command == 'getattr':
2155
attrname = request[1]
2156
if isinstance(client_object.__getattribute__(attrname),
2157
collections.Callable):
2158
parent_pipe.send(('function', ))
2159
else:
2160
parent_pipe.send((
2161
'data', client_object.__getattribute__(attrname)))
2162
2163
if command == 'setattr':
2164
attrname = request[1]
2165
value = request[2]
2166
setattr(client_object, attrname, value)
2167
2168
return True
2169
2170
2171
def rfc3339_duration_to_delta(duration):
2172
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2173
2174
>>> rfc3339_duration_to_delta("P7D")
2175
datetime.timedelta(7)
2176
>>> rfc3339_duration_to_delta("PT60S")
2177
datetime.timedelta(0, 60)
2178
>>> rfc3339_duration_to_delta("PT60M")
2179
datetime.timedelta(0, 3600)
2180
>>> rfc3339_duration_to_delta("PT24H")
2181
datetime.timedelta(1)
2182
>>> rfc3339_duration_to_delta("P1W")
2183
datetime.timedelta(7)
2184
>>> rfc3339_duration_to_delta("PT5M30S")
2185
datetime.timedelta(0, 330)
2186
>>> rfc3339_duration_to_delta("P1DT3M20S")
2187
datetime.timedelta(1, 200)
2188
"""
2189
2190
# Parsing an RFC 3339 duration with regular expressions is not
2191
# possible - there would have to be multiple places for the same
2192
# values, like seconds. The current code, while more esoteric, is
2193
# cleaner without depending on a parsing library. If Python had a
2194
# built-in library for parsing we would use it, but we'd like to
2195
# avoid excessive use of external libraries.
2196
2197
# New type for defining tokens, syntax, and semantics all-in-one
2198
Token = collections.namedtuple("Token", (
2199
"regexp", # To match token; if "value" is not None, must have
2200
# a "group" containing digits
2201
"value", # datetime.timedelta or None
2202
"followers")) # Tokens valid after this token
2203
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2204
# the "duration" ABNF definition in RFC 3339, Appendix A.
2205
token_end = Token(re.compile(r"$"), None, frozenset())
2206
token_second = Token(re.compile(r"(\d+)S"),
2207
datetime.timedelta(seconds=1),
2208
frozenset((token_end, )))
2209
token_minute = Token(re.compile(r"(\d+)M"),
2210
datetime.timedelta(minutes=1),
2211
frozenset((token_second, token_end)))
2212
token_hour = Token(re.compile(r"(\d+)H"),
2213
datetime.timedelta(hours=1),
2214
frozenset((token_minute, token_end)))
2215
token_time = Token(re.compile(r"T"),
2216
None,
2217
frozenset((token_hour, token_minute,
2218
token_second)))
2219
token_day = Token(re.compile(r"(\d+)D"),
2220
datetime.timedelta(days=1),
2221
frozenset((token_time, token_end)))
2222
token_month = Token(re.compile(r"(\d+)M"),
2223
datetime.timedelta(weeks=4),
2224
frozenset((token_day, token_end)))
2225
token_year = Token(re.compile(r"(\d+)Y"),
2226
datetime.timedelta(weeks=52),
2227
frozenset((token_month, token_end)))
2228
token_week = Token(re.compile(r"(\d+)W"),
2229
datetime.timedelta(weeks=1),
2230
frozenset((token_end, )))
2231
token_duration = Token(re.compile(r"P"), None,
2232
frozenset((token_year, token_month,
2233
token_day, token_time,
2234
token_week)))
2235
# Define starting values
2236
value = datetime.timedelta() # Value so far
2237
found_token = None
2238
followers = frozenset((token_duration, )) # Following valid tokens
2239
s = duration # String left to parse
2240
# Loop until end token is found
2241
while found_token is not token_end:
2242
# Search for any currently valid tokens
2243
for token in followers:
2244
match = token.regexp.match(s)
2245
if match is not None:
2246
# Token found
2247
if token.value is not None:
2248
# Value found, parse digits
2249
factor = int(match.group(1), 10)
2250
# Add to value so far
2251
value += factor * token.value
2252
# Strip token from string
2253
s = token.regexp.sub("", s, 1)
2254
# Go to found token
2255
found_token = token
2256
# Set valid next tokens
2257
followers = found_token.followers
2258
break
2259
else:
2260
# No currently valid tokens were found
2261
raise ValueError("Invalid RFC 3339 duration: {!r}"
2262
.format(duration))
2263
# End token found
2264
return value
573
2265
574
2266
575
2267
def string_to_delta(interval):
576
2268
"""Parse a string and return a datetime.timedelta
577
2269
578
2270
>>> string_to_delta('7d')
579
2271
datetime.timedelta(7)
580
2272
>>> string_to_delta('60s')
583
2275
datetime.timedelta(0, 3600)
584
2276
>>> string_to_delta('24h')
585
2277
datetime.timedelta(1)
586
>>> string_to_delta(u'1w')
2278
>>> string_to_delta('1w')
587
2279
datetime.timedelta(7)
588
2280
>>> string_to_delta('5m 30s')
589
2281
datetime.timedelta(0, 330)
590
2282
"""
2283
2284
try:
2285
return rfc3339_duration_to_delta(interval)
2286
except ValueError:
2287
pass
2288
591
2289
timevalue = datetime.timedelta(0)
592
2290
for s in interval.split():
593
2291
try:
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
596
if suffix == u"d":
2292
suffix = s[-1]
2293
value = int(s[:-1])
2294
if suffix == "d":
597
2295
delta = datetime.timedelta(value)
598
elif suffix == u"s":
2296
elif suffix == "s":
599
2297
delta = datetime.timedelta(0, value)
600
elif suffix == u"m":
2298
elif suffix == "m":
601
2299
delta = datetime.timedelta(0, 0, 0, 0, value)
602
elif suffix == u"h":
2300
elif suffix == "h":
603
2301
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
604
elif suffix == u"w":
2302
elif suffix == "w":
605
2303
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
606
2304
else:
607
raise ValueError
608
except (ValueError, IndexError):
609
raise ValueError
2305
raise ValueError("Unknown suffix {!r}".format(suffix))
2306
except IndexError as e:
2307
raise ValueError(*(e.args))
610
2308
timevalue += delta
611
2309
return timevalue
612
2310
613
2311
614
def server_state_changed(state):
615
"""Derived from the Avahi example code"""
616
if state == avahi.SERVER_COLLISION:
617
logger.error(u"Zeroconf server name collision")
618
service.remove()
619
elif state == avahi.SERVER_RUNNING:
620
service.add()
621
622
623
def entry_group_state_changed(state, error):
624
"""Derived from the Avahi example code"""
625
logger.debug(u"Avahi state change: %i", state)
626
627
if state == avahi.ENTRY_GROUP_ESTABLISHED:
628
logger.debug(u"Zeroconf service established.")
629
elif state == avahi.ENTRY_GROUP_COLLISION:
630
logger.warning(u"Zeroconf service name collision.")
631
service.rename()
632
elif state == avahi.ENTRY_GROUP_FAILURE:
633
logger.critical(u"Avahi: Error in group state changed %s",
634
unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
636
637
def if_nametoindex(interface):
638
"""Call the C function if_nametoindex(), or equivalent"""
639
global if_nametoindex
640
try:
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
645
except (OSError, AttributeError):
646
if "struct" not in sys.modules:
647
import struct
648
if "fcntl" not in sys.modules:
649
import fcntl
650
def if_nametoindex(interface):
651
"Get an interface index the hard way, i.e. using fcntl()"
652
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
657
interface_index = struct.unpack("I", ifreq[16:20])[0]
658
return interface_index
659
return if_nametoindex(interface)
660
661
662
2312
def daemon(nochdir = False, noclose = False):
663
2313
"""See daemon(3). Standard BSD Unix function.
2314
664
2315
This should really exist as os.daemon, but it doesn't (yet)."""
665
2316
if os.fork():
666
2317
sys.exit()
671
2322
sys.exit()
672
2323
if not noclose:
673
2324
# Close all standard open file descriptors
674
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2325
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
675
2326
if not stat.S_ISCHR(os.fstat(null).st_mode):
676
2327
raise OSError(errno.ENODEV,
677
"/dev/null not a character device")
2328
"{} not a character device"
2329
.format(os.devnull))
678
2330
os.dup2(null, sys.stdin.fileno())
679
2331
os.dup2(null, sys.stdout.fileno())
680
2332
os.dup2(null, sys.stderr.fileno())
683
2335
684
2336
685
2337
def main():
686
global main_loop_started
687
main_loop_started = False
688
689
parser = OptionParser(version = "%%prog %s" % version)
690
parser.add_option("-i", "--interface", type="string",
691
metavar="IF", help="Bind to interface IF")
692
parser.add_option("-a", "--address", type="string",
693
help="Address to listen for requests on")
694
parser.add_option("-p", "--port", type="int",
695
help="Port number to receive requests on")
696
parser.add_option("--check", action="store_true", default=False,
697
help="Run self-test")
698
parser.add_option("--debug", action="store_true",
699
help="Debug mode; run in foreground and log to"
700
" terminal")
701
parser.add_option("--priority", type="string", help="GnuTLS"
702
" priority string (see GnuTLS documentation)")
703
parser.add_option("--servicename", type="string", metavar="NAME",
704
help="Zeroconf service name")
705
parser.add_option("--configdir", type="string",
706
default="/etc/mandos", metavar="DIR",
707
help="Directory to search for configuration"
708
" files")
709
(options, args) = parser.parse_args()
2338
2339
##################################################################
2340
# Parsing of options, both command line and config file
2341
2342
parser = argparse.ArgumentParser()
2343
parser.add_argument("-v", "--version", action="version",
2344
version = "%(prog)s {}".format(version),
2345
help="show version number and exit")
2346
parser.add_argument("-i", "--interface", metavar="IF",
2347
help="Bind to interface IF")
2348
parser.add_argument("-a", "--address",
2349
help="Address to listen for requests on")
2350
parser.add_argument("-p", "--port", type=int,
2351
help="Port number to receive requests on")
2352
parser.add_argument("--check", action="store_true",
2353
help="Run self-test")
2354
parser.add_argument("--debug", action="store_true",
2355
help="Debug mode; run in foreground and log"
2356
" to terminal", default=None)
2357
parser.add_argument("--debuglevel", metavar="LEVEL",
2358
help="Debug level for stdout output")
2359
parser.add_argument("--priority", help="GnuTLS"
2360
" priority string (see GnuTLS documentation)")
2361
parser.add_argument("--servicename",
2362
metavar="NAME", help="Zeroconf service name")
2363
parser.add_argument("--configdir",
2364
default="/etc/mandos", metavar="DIR",
2365
help="Directory to search for configuration"
2366
" files")
2367
parser.add_argument("--no-dbus", action="store_false",
2368
dest="use_dbus", help="Do not provide D-Bus"
2369
" system bus interface", default=None)
2370
parser.add_argument("--no-ipv6", action="store_false",
2371
dest="use_ipv6", help="Do not use IPv6",
2372
default=None)
2373
parser.add_argument("--no-restore", action="store_false",
2374
dest="restore", help="Do not restore stored"
2375
" state", default=None)
2376
parser.add_argument("--socket", type=int,
2377
help="Specify a file descriptor to a network"
2378
" socket to use instead of creating one")
2379
parser.add_argument("--statedir", metavar="DIR",
2380
help="Directory to save/restore state in")
2381
parser.add_argument("--foreground", action="store_true",
2382
help="Run in foreground", default=None)
2383
parser.add_argument("--no-zeroconf", action="store_false",
2384
dest="zeroconf", help="Do not use Zeroconf",
2385
default=None)
2386
2387
options = parser.parse_args()
710
2388
711
2389
if options.check:
712
2390
import doctest
713
doctest.testmod()
714
sys.exit()
2391
fail_count, test_count = doctest.testmod()
2392
sys.exit(os.EX_OK if fail_count == 0 else 1)
715
2393
716
2394
# Default values for config file for server-global settings
717
2395
server_defaults = { "interface": "",
719
2397
"port": "",
720
2398
"debug": "False",
721
2399
"priority":
722
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2400
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2401
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
723
2402
"servicename": "Mandos",
724
}
2403
"use_dbus": "True",
2404
"use_ipv6": "True",
2405
"debuglevel": "",
2406
"restore": "True",
2407
"socket": "",
2408
"statedir": "/var/lib/mandos",
2409
"foreground": "False",
2410
"zeroconf": "True",
2411
}
725
2412
726
2413
# Parse config file for server-global settings
727
server_config = ConfigParser.SafeConfigParser(server_defaults)
2414
server_config = configparser.SafeConfigParser(server_defaults)
728
2415
del server_defaults
729
2416
server_config.read(os.path.join(options.configdir, "mandos.conf"))
730
2417
# Convert the SafeConfigParser object to a dict
731
2418
server_settings = server_config.defaults()
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
2419
# Use the appropriate methods on the non-string config options
2420
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2421
server_settings[option] = server_config.getboolean("DEFAULT",
2422
option)
2423
if server_settings["port"]:
2424
server_settings["port"] = server_config.getint("DEFAULT",
2425
"port")
2426
if server_settings["socket"]:
2427
server_settings["socket"] = server_config.getint("DEFAULT",
2428
"socket")
2429
# Later, stdin will, and stdout and stderr might, be dup'ed
2430
# over with an opened os.devnull. But we don't want this to
2431
# happen with a supplied network socket.
2432
if 0 <= server_settings["socket"] <= 2:
2433
server_settings["socket"] = os.dup(server_settings
2434
["socket"])
735
2435
del server_config
736
2436
737
2437
# Override the settings from the config file with command line
738
2438
# options, if set.
739
2439
for option in ("interface", "address", "port", "debug",
740
"priority", "servicename", "configdir"):
2440
"priority", "servicename", "configdir", "use_dbus",
2441
"use_ipv6", "debuglevel", "restore", "statedir",
2442
"socket", "foreground", "zeroconf"):
741
2443
value = getattr(options, option)
742
2444
if value is not None:
743
2445
server_settings[option] = value
744
2446
del options
2447
# Force all strings to be unicode
2448
for option in server_settings.keys():
2449
if isinstance(server_settings[option], bytes):
2450
server_settings[option] = (server_settings[option]
2451
.decode("utf-8"))
2452
# Force all boolean options to be boolean
2453
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2454
"foreground", "zeroconf"):
2455
server_settings[option] = bool(server_settings[option])
2456
# Debug implies foreground
2457
if server_settings["debug"]:
2458
server_settings["foreground"] = True
745
2459
# Now we have our good server settings in "server_settings"
746
2460
2461
##################################################################
2462
2463
if (not server_settings["zeroconf"]
2464
and not (server_settings["port"]
2465
or server_settings["socket"] != "")):
2466
parser.error("Needs port or socket to work without Zeroconf")
2467
2468
# For convenience
747
2469
debug = server_settings["debug"]
2470
debuglevel = server_settings["debuglevel"]
2471
use_dbus = server_settings["use_dbus"]
2472
use_ipv6 = server_settings["use_ipv6"]
2473
stored_state_path = os.path.join(server_settings["statedir"],
2474
stored_state_file)
2475
foreground = server_settings["foreground"]
2476
zeroconf = server_settings["zeroconf"]
748
2477
749
if not debug:
750
syslogger.setLevel(logging.WARNING)
751
console.setLevel(logging.WARNING)
2478
if debug:
2479
initlogger(debug, logging.DEBUG)
2480
else:
2481
if not debuglevel:
2482
initlogger(debug)
2483
else:
2484
level = getattr(logging, debuglevel.upper())
2485
initlogger(debug, level)
752
2486
753
2487
if server_settings["servicename"] != "Mandos":
754
syslogger.setFormatter(logging.Formatter\
755
('Mandos (%s): %%(levelname)s:'
756
' %%(message)s'
757
% server_settings["servicename"]))
2488
syslogger.setFormatter(
2489
logging.Formatter('Mandos ({}) [%(process)d]:'
2490
' %(levelname)s: %(message)s'.format(
2491
server_settings["servicename"])))
758
2492
759
2493
# Parse config file with clients
760
client_defaults = { "timeout": "1h",
761
"interval": "5m",
762
"checker": "fping -q -- %(host)s",
763
"host": "",
764
}
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
2494
client_config = configparser.SafeConfigParser(Client
2495
.client_defaults)
766
2496
client_config.read(os.path.join(server_settings["configdir"],
767
2497
"clients.conf"))
768
2498
769
clients = Set()
770
tcp_server = IPv6_TCPServer((server_settings["address"],
771
server_settings["port"]),
772
tcp_handler,
773
settings=server_settings,
774
clients=clients)
775
pidfilename = "/var/run/mandos.pid"
776
try:
777
pidfile = open(pidfilename, "w")
778
except IOError, error:
779
logger.error("Could not open file %r", pidfilename)
780
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
797
try:
2499
global mandos_dbus_service
2500
mandos_dbus_service = None
2501
2502
socketfd = None
2503
if server_settings["socket"] != "":
2504
socketfd = server_settings["socket"]
2505
tcp_server = MandosServer(
2506
(server_settings["address"], server_settings["port"]),
2507
ClientHandler,
2508
interface=(server_settings["interface"] or None),
2509
use_ipv6=use_ipv6,
2510
gnutls_priority=server_settings["priority"],
2511
use_dbus=use_dbus,
2512
socketfd=socketfd)
2513
if not foreground:
2514
pidfilename = "/run/mandos.pid"
2515
if not os.path.isdir("/run/."):
2516
pidfilename = "/var/run/mandos.pid"
2517
pidfile = None
2518
try:
2519
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2520
except IOError as e:
2521
logger.error("Could not open file %r", pidfilename,
2522
exc_info=e)
2523
2524
for name in ("_mandos", "mandos", "nobody"):
2525
try:
2526
uid = pwd.getpwnam(name).pw_uid
2527
gid = pwd.getpwnam(name).pw_gid
2528
break
2529
except KeyError:
2530
continue
2531
else:
2532
uid = 65534
2533
gid = 65534
2534
try:
2535
os.setgid(gid)
798
2536
os.setuid(uid)
799
os.setgid(gid)
800
except OSError, error:
801
if error[0] != errno.EPERM:
802
raise error
803
804
global service
805
service = AvahiService(name = server_settings["servicename"],
806
type = "_mandos._tcp", );
807
if server_settings["interface"]:
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
2537
except OSError as error:
2538
if error.errno != errno.EPERM:
2539
raise
2540
2541
if debug:
2542
# Enable all possible GnuTLS debugging
2543
2544
# "Use a log level over 10 to enable all debugging options."
2545
# - GnuTLS manual
2546
gnutls.library.functions.gnutls_global_set_log_level(11)
2547
2548
@gnutls.library.types.gnutls_log_func
2549
def debug_gnutls(level, string):
2550
logger.debug("GnuTLS: %s", string[:-1])
2551
2552
gnutls.library.functions.gnutls_global_set_log_function(
2553
debug_gnutls)
2554
2555
# Redirect stdin so all checkers get /dev/null
2556
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2557
os.dup2(null, sys.stdin.fileno())
2558
if null > 2:
2559
os.close(null)
2560
2561
# Need to fork before connecting to D-Bus
2562
if not foreground:
2563
# Close all input and output, do double fork, etc.
2564
daemon()
2565
2566
# multiprocessing will use threads, so before we use gobject we
2567
# need to inform gobject that threads will be used.
2568
gobject.threads_init()
810
2569
811
2570
global main_loop
812
global bus
813
global server
814
2571
# From the Avahi example code
815
DBusGMainLoop(set_as_default=True )
2572
DBusGMainLoop(set_as_default=True)
816
2573
main_loop = gobject.MainLoop()
817
2574
bus = dbus.SystemBus()
818
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
819
avahi.DBUS_PATH_SERVER),
820
avahi.DBUS_INTERFACE_SERVER)
821
2575
# End of Avahi example code
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
828
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
831
config
832
= dict(client_config.items(section)))
833
for section in client_config.sections()))
834
if not clients:
835
logger.critical(u"No clients defined")
836
sys.exit(1)
837
838
if debug:
839
# Redirect stdin so all checkers get /dev/null
840
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
841
os.dup2(null, sys.stdin.fileno())
842
if null > 2:
843
os.close(null)
844
else:
845
# No console logging
846
logger.removeHandler(console)
847
# Close all input and output, do double fork, etc.
848
daemon()
849
850
try:
851
pid = os.getpid()
852
pidfile.write(str(pid) + "\n")
853
pidfile.close()
2576
if use_dbus:
2577
try:
2578
bus_name = dbus.service.BusName("se.recompile.Mandos",
2579
bus,
2580
do_not_queue=True)
2581
old_bus_name = dbus.service.BusName(
2582
"se.bsnet.fukt.Mandos", bus,
2583
do_not_queue=True)
2584
except dbus.exceptions.DBusException as e:
2585
logger.error("Disabling D-Bus:", exc_info=e)
2586
use_dbus = False
2587
server_settings["use_dbus"] = False
2588
tcp_server.use_dbus = False
2589
if zeroconf:
2590
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2591
service = AvahiServiceToSyslog(
2592
name = server_settings["servicename"],
2593
servicetype = "_mandos._tcp",
2594
protocol = protocol,
2595
bus = bus)
2596
if server_settings["interface"]:
2597
service.interface = if_nametoindex(
2598
server_settings["interface"].encode("utf-8"))
2599
2600
global multiprocessing_manager
2601
multiprocessing_manager = multiprocessing.Manager()
2602
2603
client_class = Client
2604
if use_dbus:
2605
client_class = functools.partial(ClientDBus, bus = bus)
2606
2607
client_settings = Client.config_parser(client_config)
2608
old_client_settings = {}
2609
clients_data = {}
2610
2611
# This is used to redirect stdout and stderr for checker processes
2612
global wnull
2613
wnull = open(os.devnull, "w") # A writable /dev/null
2614
# Only used if server is running in foreground but not in debug
2615
# mode
2616
if debug or not foreground:
2617
wnull.close()
2618
2619
# Get client data and settings from last running state.
2620
if server_settings["restore"]:
2621
try:
2622
with open(stored_state_path, "rb") as stored_state:
2623
clients_data, old_client_settings = pickle.load(
2624
stored_state)
2625
os.remove(stored_state_path)
2626
except IOError as e:
2627
if e.errno == errno.ENOENT:
2628
logger.warning("Could not load persistent state:"
2629
" {}".format(os.strerror(e.errno)))
2630
else:
2631
logger.critical("Could not load persistent state:",
2632
exc_info=e)
2633
raise
2634
except EOFError as e:
2635
logger.warning("Could not load persistent state: "
2636
"EOFError:",
2637
exc_info=e)
2638
2639
with PGPEngine() as pgp:
2640
for client_name, client in clients_data.items():
2641
# Skip removed clients
2642
if client_name not in client_settings:
2643
continue
2644
2645
# Decide which value to use after restoring saved state.
2646
# We have three different values: Old config file,
2647
# new config file, and saved state.
2648
# New config value takes precedence if it differs from old
2649
# config value, otherwise use saved state.
2650
for name, value in client_settings[client_name].items():
2651
try:
2652
# For each value in new config, check if it
2653
# differs from the old config value (Except for
2654
# the "secret" attribute)
2655
if (name != "secret"
2656
and (value !=
2657
old_client_settings[client_name][name])):
2658
client[name] = value
2659
except KeyError:
2660
pass
2661
2662
# Clients who has passed its expire date can still be
2663
# enabled if its last checker was successful. Clients
2664
# whose checker succeeded before we stored its state is
2665
# assumed to have successfully run all checkers during
2666
# downtime.
2667
if client["enabled"]:
2668
if datetime.datetime.utcnow() >= client["expires"]:
2669
if not client["last_checked_ok"]:
2670
logger.warning(
2671
"disabling client {} - Client never "
2672
"performed a successful checker".format(
2673
client_name))
2674
client["enabled"] = False
2675
elif client["last_checker_status"] != 0:
2676
logger.warning(
2677
"disabling client {} - Client last"
2678
" checker failed with error code"
2679
" {}".format(
2680
client_name,
2681
client["last_checker_status"]))
2682
client["enabled"] = False
2683
else:
2684
client["expires"] = (
2685
datetime.datetime.utcnow()
2686
+ client["timeout"])
2687
logger.debug("Last checker succeeded,"
2688
" keeping {} enabled".format(
2689
client_name))
2690
try:
2691
client["secret"] = pgp.decrypt(
2692
client["encrypted_secret"],
2693
client_settings[client_name]["secret"])
2694
except PGPError:
2695
# If decryption fails, we use secret from new settings
2696
logger.debug("Failed to decrypt {} old secret".format(
2697
client_name))
2698
client["secret"] = (client_settings[client_name]
2699
["secret"])
2700
2701
# Add/remove clients based on new changes made to config
2702
for client_name in (set(old_client_settings)
2703
- set(client_settings)):
2704
del clients_data[client_name]
2705
for client_name in (set(client_settings)
2706
- set(old_client_settings)):
2707
clients_data[client_name] = client_settings[client_name]
2708
2709
# Create all client objects
2710
for client_name, client in clients_data.items():
2711
tcp_server.clients[client_name] = client_class(
2712
name = client_name,
2713
settings = client,
2714
server_settings = server_settings)
2715
2716
if not tcp_server.clients:
2717
logger.warning("No clients defined")
2718
2719
if not foreground:
2720
if pidfile is not None:
2721
pid = os.getpid()
2722
try:
2723
with pidfile:
2724
print(pid, file=pidfile)
2725
except IOError:
2726
logger.error("Could not write to file %r with PID %d",
2727
pidfilename, pid)
854
2728
del pidfile
855
except IOError, err:
856
logger.error(u"Could not write to file %r with PID %d",
857
pidfilename, pid)
858
except NameError:
859
# "pidfile" was never created
860
pass
861
del pidfilename
2729
del pidfilename
2730
2731
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2732
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2733
2734
if use_dbus:
2735
2736
@alternate_dbus_interfaces(
2737
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2738
class MandosDBusService(DBusObjectWithProperties):
2739
"""A D-Bus proxy object"""
2740
2741
def __init__(self):
2742
dbus.service.Object.__init__(self, bus, "/")
2743
2744
_interface = "se.recompile.Mandos"
2745
2746
@dbus_interface_annotations(_interface)
2747
def _foo(self):
2748
return {
2749
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2750
"false" }
2751
2752
@dbus.service.signal(_interface, signature="o")
2753
def ClientAdded(self, objpath):
2754
"D-Bus signal"
2755
pass
2756
2757
@dbus.service.signal(_interface, signature="ss")
2758
def ClientNotFound(self, fingerprint, address):
2759
"D-Bus signal"
2760
pass
2761
2762
@dbus.service.signal(_interface, signature="os")
2763
def ClientRemoved(self, objpath, name):
2764
"D-Bus signal"
2765
pass
2766
2767
@dbus.service.method(_interface, out_signature="ao")
2768
def GetAllClients(self):
2769
"D-Bus method"
2770
return dbus.Array(c.dbus_object_path for c in
2771
tcp_server.clients.itervalues())
2772
2773
@dbus.service.method(_interface,
2774
out_signature="a{oa{sv}}")
2775
def GetAllClientsWithProperties(self):
2776
"D-Bus method"
2777
return dbus.Dictionary(
2778
{ c.dbus_object_path: c.GetAll("")
2779
for c in tcp_server.clients.itervalues() },
2780
signature="oa{sv}")
2781
2782
@dbus.service.method(_interface, in_signature="o")
2783
def RemoveClient(self, object_path):
2784
"D-Bus method"
2785
for c in tcp_server.clients.itervalues():
2786
if c.dbus_object_path == object_path:
2787
del tcp_server.clients[c.name]
2788
c.remove_from_connection()
2789
# Don't signal anything except ClientRemoved
2790
c.disable(quiet=True)
2791
# Emit D-Bus signal
2792
self.ClientRemoved(object_path, c.name)
2793
return
2794
raise KeyError(object_path)
2795
2796
del _interface
2797
2798
mandos_dbus_service = MandosDBusService()
862
2799
863
2800
def cleanup():
864
2801
"Cleanup function; run on exit"
865
global group
866
# From the Avahi example code
867
if not group is None:
868
group.Free()
869
group = None
870
# End of Avahi example code
871
872
while clients:
873
client = clients.pop()
874
client.stop_hook = None
875
client.stop()
2802
if zeroconf:
2803
service.cleanup()
2804
2805
multiprocessing.active_children()
2806
wnull.close()
2807
if not (tcp_server.clients or client_settings):
2808
return
2809
2810
# Store client before exiting. Secrets are encrypted with key
2811
# based on what config file has. If config file is
2812
# removed/edited, old secret will thus be unrecovable.
2813
clients = {}
2814
with PGPEngine() as pgp:
2815
for client in tcp_server.clients.itervalues():
2816
key = client_settings[client.name]["secret"]
2817
client.encrypted_secret = pgp.encrypt(client.secret,
2818
key)
2819
client_dict = {}
2820
2821
# A list of attributes that can not be pickled
2822
# + secret.
2823
exclude = { "bus", "changedstate", "secret",
2824
"checker", "server_settings" }
2825
for name, typ in inspect.getmembers(dbus.service
2826
.Object):
2827
exclude.add(name)
2828
2829
client_dict["encrypted_secret"] = (client
2830
.encrypted_secret)
2831
for attr in client.client_structure:
2832
if attr not in exclude:
2833
client_dict[attr] = getattr(client, attr)
2834
2835
clients[client.name] = client_dict
2836
del client_settings[client.name]["secret"]
2837
2838
try:
2839
with tempfile.NamedTemporaryFile(
2840
mode='wb',
2841
suffix=".pickle",
2842
prefix='clients-',
2843
dir=os.path.dirname(stored_state_path),
2844
delete=False) as stored_state:
2845
pickle.dump((clients, client_settings), stored_state)
2846
tempname = stored_state.name
2847
os.rename(tempname, stored_state_path)
2848
except (IOError, OSError) as e:
2849
if not debug:
2850
try:
2851
os.remove(tempname)
2852
except NameError:
2853
pass
2854
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2855
logger.warning("Could not save persistent state: {}"
2856
.format(os.strerror(e.errno)))
2857
else:
2858
logger.warning("Could not save persistent state:",
2859
exc_info=e)
2860
raise
2861
2862
# Delete all clients, and settings from config
2863
while tcp_server.clients:
2864
name, client = tcp_server.clients.popitem()
2865
if use_dbus:
2866
client.remove_from_connection()
2867
# Don't signal anything except ClientRemoved
2868
client.disable(quiet=True)
2869
if use_dbus:
2870
# Emit D-Bus signal
2871
mandos_dbus_service.ClientRemoved(
2872
client.dbus_object_path, client.name)
2873
client_settings.clear()
876
2874
877
2875
atexit.register(cleanup)
878
2876
879
if not debug:
880
signal.signal(signal.SIGINT, signal.SIG_IGN)
881
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
882
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
883
884
for client in clients:
885
client.start()
2877
for client in tcp_server.clients.itervalues():
2878
if use_dbus:
2879
# Emit D-Bus signal
2880
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2881
# Need to initiate checking of clients
2882
if client.enabled:
2883
client.init_checker()
886
2884
887
2885
tcp_server.enable()
888
2886
tcp_server.server_activate()
889
2887
890
2888
# Find out what port we got
891
service.port = tcp_server.socket.getsockname()[1]
892
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
893
u" scope_id %d" % tcp_server.socket.getsockname())
2889
if zeroconf:
2890
service.port = tcp_server.socket.getsockname()[1]
2891
if use_ipv6:
2892
logger.info("Now listening on address %r, port %d,"
2893
" flowinfo %d, scope_id %d",
2894
*tcp_server.socket.getsockname())
2895
else: # IPv4
2896
logger.info("Now listening on address %r, port %d",
2897
*tcp_server.socket.getsockname())
894
2898
895
2899
#service.interface = tcp_server.socket.getsockname()[3]
896
2900
897
2901
try:
898
# From the Avahi example code
899
server.connect_to_signal("StateChanged", server_state_changed)
900
try:
901
server_state_changed(server.GetState())
902
except dbus.exceptions.DBusException, error:
903
logger.critical(u"DBusException: %s", error)
904
sys.exit(1)
905
# End of Avahi example code
2902
if zeroconf:
2903
# From the Avahi example code
2904
try:
2905
service.activate()
2906
except dbus.exceptions.DBusException as error:
2907
logger.critical("D-Bus Exception", exc_info=error)
2908
cleanup()
2909
sys.exit(1)
2910
# End of Avahi example code
906
2911
907
2912
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
908
2913
lambda *args, **kwargs:
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
2914
(tcp_server.handle_request
2915
(*args[2:], **kwargs) or True))
911
2916
912
logger.debug(u"Starting main loop")
913
main_loop_started = True
2917
logger.debug("Starting main loop")
914
2918
main_loop.run()
915
except AvahiError, error:
916
logger.critical(u"AvahiError: %s" + unicode(error))
2919
except AvahiError as error:
2920
logger.critical("Avahi Error", exc_info=error)
2921
cleanup()
917
2922
sys.exit(1)
918
2923
except KeyboardInterrupt:
919
2924
if debug:
920
print
2925
print("", file=sys.stderr)
2926
logger.debug("Server received KeyboardInterrupt")
2927
logger.debug("Server exiting")
2928
# Must run before the D-Bus bus name gets deregistered
2929
cleanup()
2930
921
2931
922
2932
if __name__ == '__main__':
923
2933
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0