To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 755
- compare with another revision
- download diff
- download tarball
- view history from revision 755
- Committer: Teddy Hogeborn
- Date: 2015-05-31 19:05:32 UTC
- Revision ID: teddy@recompile.se-20150531190532-pfc7mega72dzzzka
mandos: More Python 3 fixes.
mandos (MandosServer/handle_ipc): Do not use callable().
mandos (MandosServer/handle_ipc): Do not use callable().
- files added:
- DBUS-API
- debian/source
- debian/upstream
- network-hooks.d
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
35
36
import SocketServer
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
36
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
37
43
import socket
38
import optparse
44
import argparse
39
45
import datetime
40
46
import errno
41
47
import gnutls.crypto
44
50
import gnutls.library.functions
45
51
import gnutls.library.constants
46
52
import gnutls.library.types
47
import ConfigParser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
48
57
import sys
49
58
import re
50
59
import os
51
60
import signal
52
from sets import Set
53
61
import subprocess
54
62
import atexit
55
63
import stat
56
64
import logging
57
65
import logging.handlers
58
66
import pwd
59
from contextlib import closing
67
import contextlib
68
import struct
69
import fcntl
70
import functools
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
75
import multiprocessing
76
import types
77
import binascii
78
import tempfile
79
import itertools
80
import collections
81
import codecs
60
82
61
83
import dbus
62
84
import dbus.service
63
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
64
89
import avahi
65
90
from dbus.mainloop.glib import DBusGMainLoop
66
91
import ctypes
67
92
import ctypes.util
68
69
version = "1.0.7"
70
71
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
78
logger.addHandler(syslogger)
79
80
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
83
logger.addHandler(console)
93
import xml.dom.minidom
94
import inspect
95
96
try:
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
98
except AttributeError:
99
try:
100
from IN import SO_BINDTODEVICE
101
except ImportError:
102
SO_BINDTODEVICE = None
103
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
108
stored_state_file = "clients.pickle"
109
110
logger = logging.getLogger()
111
syslogger = None
112
113
try:
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
116
except (OSError, AttributeError):
117
118
def if_nametoindex(interface):
119
"Get an interface index the hard way, i.e. using fcntl()"
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
with contextlib.closing(socket.socket()) as s:
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
125
return interface_index
126
127
128
def initlogger(debug, level=logging.WARNING):
129
"""init logger and add loglevel"""
130
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
syslogger.setFormatter(logging.Formatter
136
('Mandos [%(process)d]: %(levelname)s:'
137
' %(message)s'))
138
logger.addHandler(syslogger)
139
140
if debug:
141
console = logging.StreamHandler()
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
143
' [%(process)d]:'
144
' %(levelname)s:'
145
' %(message)s'))
146
logger.addHandler(console)
147
logger.setLevel(level)
148
149
150
class PGPError(Exception):
151
"""Exception if encryption/decryption fails"""
152
pass
153
154
155
class PGPEngine(object):
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
158
def __init__(self):
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
162
'--force-mdc',
163
'--quiet',
164
'--no-use-agent']
165
166
def __enter__(self):
167
return self
168
169
def __exit__(self, exc_type, exc_value, traceback):
170
self._cleanup()
171
return False
172
173
def __del__(self):
174
self._cleanup()
175
176
def _cleanup(self):
177
if self.tempdir is not None:
178
# Delete contents of tempdir
179
for root, dirs, files in os.walk(self.tempdir,
180
topdown = False):
181
for filename in files:
182
os.remove(os.path.join(root, filename))
183
for dirname in dirs:
184
os.rmdir(os.path.join(root, dirname))
185
# Remove tempdir
186
os.rmdir(self.tempdir)
187
self.tempdir = None
188
189
def password_encode(self, password):
190
# Passphrase can not be empty and can not contain newlines or
191
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
198
return encoded
199
200
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
205
passfile.flush()
206
proc = subprocess.Popen(['gpg', '--symmetric',
207
'--passphrase-file',
208
passfile.name]
209
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
215
raise PGPError(err)
216
return ciphertext
217
218
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
223
passfile.flush()
224
proc = subprocess.Popen(['gpg', '--decrypt',
225
'--passphrase-file',
226
passfile.name]
227
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
233
raise PGPError(err)
234
return decrypted_plaintext
235
84
236
85
237
class AvahiError(Exception):
86
238
def __init__(self, value, *args, **kwargs):
87
239
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
91
243
92
244
class AvahiServiceError(AvahiError):
93
245
pass
94
246
247
95
248
class AvahiGroupError(AvahiError):
96
249
pass
97
250
98
251
99
252
class AvahiService(object):
100
253
"""An Avahi (Zeroconf) service.
254
101
255
Attributes:
102
256
interface: integer; avahi.IF_UNSPEC or an interface index.
103
257
Used to optionally bind to the specified interface.
104
258
name: string; Example: 'Mandos'
105
259
type: string; Example: '_mandos._tcp'.
106
See <http://www.dns-sd.org/ServiceTypes.html>
260
See <https://www.iana.org/assignments/service-names-port-numbers>
107
261
port: integer; what port to announce
108
262
TXT: list of strings; TXT record for the service
109
263
domain: string; Domain to publish on, default to .local if empty.
111
265
max_renames: integer; maximum number of renames
112
266
rename_count: integer; counter so we only rename after collisions
113
267
a sensible number of times
268
group: D-Bus Entry Group
269
server: D-Bus Server
270
bus: dbus.SystemBus()
114
271
"""
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
272
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
119
284
self.interface = interface
120
285
self.name = name
121
286
self.type = servicetype
126
291
self.rename_count = 0
127
292
self.max_renames = max_renames
128
293
self.protocol = protocol
129
def rename(self):
294
self.group = None # our entry group
295
self.server = None
296
self.bus = bus
297
self.entry_group_state_changed_match = None
298
299
def rename(self, remove=True):
130
300
"""Derived from the Avahi example code"""
131
301
if self.rename_count >= self.max_renames:
132
logger.critical(u"No suitable Zeroconf service name found"
133
u" after %i retries, exiting.",
302
logger.critical("No suitable Zeroconf service name found"
303
" after %i retries, exiting.",
134
304
self.rename_count)
135
raise AvahiServiceError(u"Too many renames")
136
self.name = server.GetAlternativeServiceName(self.name)
137
logger.info(u"Changing Zeroconf service name to %r ...",
138
str(self.name))
139
syslogger.setFormatter(logging.Formatter
140
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
142
self.remove()
143
self.add()
305
raise AvahiServiceError("Too many renames")
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
144
308
self.rename_count += 1
309
logger.info("Changing Zeroconf service name to %r ...",
310
self.name)
311
if remove:
312
self.remove()
313
try:
314
self.add()
315
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
324
145
325
def remove(self):
146
326
"""Derived from the Avahi example code"""
147
if group is not None:
148
group.Reset()
327
if self.entry_group_state_changed_match is not None:
328
self.entry_group_state_changed_match.remove()
329
self.entry_group_state_changed_match = None
330
if self.group is not None:
331
self.group.Reset()
332
149
333
def add(self):
150
334
"""Derived from the Avahi example code"""
151
global group
152
if group is None:
153
group = dbus.Interface(bus.get_object
154
(avahi.DBUS_NAME,
155
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
group.connect_to_signal('StateChanged',
158
entry_group_state_changed)
159
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
service.name, service.type)
161
group.AddService(
162
self.interface, # interface
163
self.protocol, # protocol
164
dbus.UInt32(0), # flags
165
self.name, self.type,
166
self.domain, self.host,
167
dbus.UInt16(self.port),
168
avahi.string_array_to_txt_array(self.TXT))
169
group.Commit()
170
171
# From the Avahi example code:
172
group = None # our entry group
173
# End of Avahi example code
174
175
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
class Client(dbus.service.Object):
335
self.remove()
336
if self.group is None:
337
self.group = dbus.Interface(
338
self.bus.get_object(avahi.DBUS_NAME,
339
self.server.EntryGroupNew()),
340
avahi.DBUS_INTERFACE_ENTRY_GROUP)
341
self.entry_group_state_changed_match = (
342
self.group.connect_to_signal(
343
'StateChanged', self.entry_group_state_changed))
344
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
345
self.name, self.type)
346
self.group.AddService(
347
self.interface,
348
self.protocol,
349
dbus.UInt32(0), # flags
350
self.name, self.type,
351
self.domain, self.host,
352
dbus.UInt16(self.port),
353
avahi.string_array_to_txt_array(self.TXT))
354
self.group.Commit()
355
356
def entry_group_state_changed(self, state, error):
357
"""Derived from the Avahi example code"""
358
logger.debug("Avahi entry group state change: %i", state)
359
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
361
logger.debug("Zeroconf service established.")
362
elif state == avahi.ENTRY_GROUP_COLLISION:
363
logger.info("Zeroconf service name collision.")
364
self.rename()
365
elif state == avahi.ENTRY_GROUP_FAILURE:
366
logger.critical("Avahi: Error in group state changed %s",
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
369
370
def cleanup(self):
371
"""Derived from the Avahi example code"""
372
if self.group is not None:
373
try:
374
self.group.Free()
375
except (dbus.exceptions.UnknownMethodException,
376
dbus.exceptions.DBusException):
377
pass
378
self.group = None
379
self.remove()
380
381
def server_state_changed(self, state, error=None):
382
"""Derived from the Avahi example code"""
383
logger.debug("Avahi server state change: %i", state)
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
390
if state in bad_states:
391
if bad_states[state] is not None:
392
if error is None:
393
logger.error(bad_states[state])
394
else:
395
logger.error(bad_states[state] + ": %r", error)
396
self.cleanup()
397
elif state == avahi.SERVER_RUNNING:
398
self.add()
399
else:
400
if error is None:
401
logger.debug("Unknown state: %r", state)
402
else:
403
logger.debug("Unknown state: %r: %r", state, error)
404
405
def activate(self):
406
"""Derived from the Avahi example code"""
407
if self.server is None:
408
self.server = dbus.Interface(
409
self.bus.get_object(avahi.DBUS_NAME,
410
avahi.DBUS_PATH_SERVER,
411
follow_name_owner_changes=True),
412
avahi.DBUS_INTERFACE_SERVER)
413
self.server.connect_to_signal("StateChanged",
414
self.server_state_changed)
415
self.server_state_changed(self.server.GetState())
416
417
418
class AvahiServiceToSyslog(AvahiService):
419
def rename(self, *args, **kwargs):
420
"""Add the new name to the syslog messages"""
421
ret = AvahiService.rename(self, *args, **kwargs)
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
.format(self.name)))
425
return ret
426
427
428
class Client(object):
182
429
"""A representation of a client host served by this server.
430
183
431
Attributes:
184
name: string; from the config file, used in log messages and
185
D-Bus identifiers
186
fingerprint: string (40 or 32 hexadecimal digits); used to
187
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
192
enabled: bool()
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
432
approved: bool(); 'None' if not yet approved/disapproved
433
approval_delay: datetime.timedelta(); Time to wait for approval
434
approval_duration: datetime.timedelta(); Duration of one approval
198
435
checker: subprocess.Popen(); a running checker process used
199
436
to see if the client lives.
200
437
'None' if no process is running.
201
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
203
checker_callback_tag: - '' -
204
checker_command: string; External command which is run to check if
205
client lives. %() expansions are done at
438
checker_callback_tag: a gobject event source tag, or None
439
checker_command: string; External command which is run to check
440
if client lives. %() expansions are done at
206
441
runtime with vars(self) as dict, so that for
207
442
instance %(name)s can be used in the command.
443
checker_initiator_tag: a gobject event source tag, or None
444
created: datetime.datetime(); (UTC) object creation
445
client_structure: Object describing what attributes a client has
446
and is used for storing the client at exit
208
447
current_checker_command: string; current running checker_command
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
448
disable_initiator_tag: a gobject event source tag, or None
449
enabled: bool()
450
fingerprint: string (40 or 32 hexadecimal digits); used to
451
uniquely identify the client
452
host: string; available for use by the checker command
453
interval: datetime.timedelta(); How often to start a new checker
454
last_approval_request: datetime.datetime(); (UTC) or None
455
last_checked_ok: datetime.datetime(); (UTC) or None
456
last_checker_status: integer between 0 and 255 reflecting exit
457
status of last checker. -1 reflects crashed
458
checker, -2 means no checker completed yet.
459
last_enabled: datetime.datetime(); (UTC) or None
460
name: string; from the config file, used in log messages and
461
D-Bus identifiers
462
secret: bytestring; sent verbatim (over TLS) to client
463
timeout: datetime.timedelta(); How long from last_checked_ok
464
until this client is disabled
465
extended_timeout: extra long timeout when secret has been sent
466
runtime_expansions: Allowed attributes for runtime expansion.
467
expires: datetime.datetime(); time (UTC) when a client will be
468
disabled, or None
469
server_settings: The server_settings dict from main()
211
470
"""
212
def timeout_milliseconds(self):
213
"Return the 'timeout' attribute in milliseconds"
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
217
218
def interval_milliseconds(self):
219
"Return the 'interval' attribute in milliseconds"
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
223
224
def __init__(self, name = None, disable_hook=None, config=None,
225
use_dbus=True):
226
"""Note: the 'checker' key in 'config' sets the
227
'checker_command' attribute and *not* the 'checker'
228
attribute."""
471
472
runtime_expansions = ("approval_delay", "approval_duration",
473
"created", "enabled", "expires",
474
"fingerprint", "host", "interval",
475
"last_approval_request", "last_checked_ok",
476
"last_enabled", "name", "timeout")
477
client_defaults = {
478
"timeout": "PT5M",
479
"extended_timeout": "PT15M",
480
"interval": "PT2M",
481
"checker": "fping -q -- %%(host)s",
482
"host": "",
483
"approval_delay": "PT0S",
484
"approval_duration": "PT1S",
485
"approved_by_default": "True",
486
"enabled": "True",
487
}
488
489
@staticmethod
490
def config_parser(config):
491
"""Construct a new dict of client settings of this form:
492
{ client_name: {setting_name: value, ...}, ...}
493
with exceptions for any special settings as defined above.
494
NOTE: Must be a pure function. Must return the same result
495
value given the same arguments.
496
"""
497
settings = {}
498
for client_name in config.sections():
499
section = dict(config.items(client_name))
500
client = settings[client_name] = {}
501
502
client["host"] = section["host"]
503
# Reformat values from string types to Python types
504
client["approved_by_default"] = config.getboolean(
505
client_name, "approved_by_default")
506
client["enabled"] = config.getboolean(client_name,
507
"enabled")
508
509
# Uppercase and remove spaces from fingerprint for later
510
# comparison purposes with return value from the
511
# fingerprint() function
512
client["fingerprint"] = (section["fingerprint"].upper()
513
.replace(" ", ""))
514
if "secret" in section:
515
client["secret"] = section["secret"].decode("base64")
516
elif "secfile" in section:
517
with open(os.path.expanduser(os.path.expandvars
518
(section["secfile"])),
519
"rb") as secfile:
520
client["secret"] = secfile.read()
521
else:
522
raise TypeError("No secret or secfile for section {}"
523
.format(section))
524
client["timeout"] = string_to_delta(section["timeout"])
525
client["extended_timeout"] = string_to_delta(
526
section["extended_timeout"])
527
client["interval"] = string_to_delta(section["interval"])
528
client["approval_delay"] = string_to_delta(
529
section["approval_delay"])
530
client["approval_duration"] = string_to_delta(
531
section["approval_duration"])
532
client["checker_command"] = section["checker"]
533
client["last_approval_request"] = None
534
client["last_checked_ok"] = None
535
client["last_checker_status"] = -2
536
537
return settings
538
539
def __init__(self, settings, name = None, server_settings=None):
229
540
self.name = name
230
if config is None:
231
config = {}
232
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
234
# Uppercase and remove spaces from fingerprint for later
235
# comparison purposes with return value from the fingerprint()
236
# function
237
self.fingerprint = (config["fingerprint"].upper()
238
.replace(u" ", u""))
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
if "secret" in config:
241
self.secret = config["secret"].decode(u"base64")
242
elif "secfile" in config:
243
with closing(open(os.path.expanduser
244
(os.path.expandvars
245
(config["secfile"])))) as secfile:
246
self.secret = secfile.read()
541
if server_settings is None:
542
server_settings = {}
543
self.server_settings = server_settings
544
# adding all client settings
545
for setting, value in settings.items():
546
setattr(self, setting, value)
547
548
if self.enabled:
549
if not hasattr(self, "last_enabled"):
550
self.last_enabled = datetime.datetime.utcnow()
551
if not hasattr(self, "expires"):
552
self.expires = (datetime.datetime.utcnow()
553
+ self.timeout)
247
554
else:
248
raise TypeError(u"No secret or secfile for client %s"
249
% self.name)
250
self.host = config.get("host", "")
251
self.created = datetime.datetime.utcnow()
252
self.enabled = False
253
self.last_enabled = None
254
self.last_checked_ok = None
255
self.timeout = string_to_delta(config["timeout"])
256
self.interval = string_to_delta(config["interval"])
257
self.disable_hook = disable_hook
555
self.last_enabled = None
556
self.expires = None
557
558
logger.debug("Creating client %r", self.name)
559
logger.debug(" Fingerprint: %s", self.fingerprint)
560
self.created = settings.get("created",
561
datetime.datetime.utcnow())
562
563
# attributes specific for this server instance
258
564
self.checker = None
259
565
self.checker_initiator_tag = None
260
566
self.disable_initiator_tag = None
261
567
self.checker_callback_tag = None
262
self.checker_command = config["checker"]
263
568
self.current_checker_command = None
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
266
# the D-Bus
267
self.use_dbus = use_dbus
268
if self.use_dbus:
269
self.dbus_object_path = (dbus.ObjectPath
270
("/clients/"
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
569
self.approved = None
570
self.approvals_pending = 0
571
self.changedstate = multiprocessing_manager.Condition(
572
multiprocessing_manager.Lock())
573
self.client_structure = [attr
574
for attr in self.__dict__.iterkeys()
575
if not attr.startswith("_")]
576
self.client_structure.append("client_structure")
577
578
for name, t in inspect.getmembers(
579
type(self), lambda obj: isinstance(obj, property)):
580
if not name.startswith("_"):
581
self.client_structure.append(name)
582
583
# Send notice to process children that client state has changed
584
def send_changedstate(self):
585
with self.changedstate:
586
self.changedstate.notify_all()
274
587
275
588
def enable(self):
276
589
"""Start this client's checker and timeout hooks"""
590
if getattr(self, "enabled", False):
591
# Already enabled
592
return
593
self.expires = datetime.datetime.utcnow() + self.timeout
594
self.enabled = True
277
595
self.last_enabled = datetime.datetime.utcnow()
596
self.init_checker()
597
self.send_changedstate()
598
599
def disable(self, quiet=True):
600
"""Disable this client."""
601
if not getattr(self, "enabled", False):
602
return False
603
if not quiet:
604
logger.info("Disabling client %s", self.name)
605
if getattr(self, "disable_initiator_tag", None) is not None:
606
gobject.source_remove(self.disable_initiator_tag)
607
self.disable_initiator_tag = None
608
self.expires = None
609
if getattr(self, "checker_initiator_tag", None) is not None:
610
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = None
612
self.stop_checker()
613
self.enabled = False
614
if not quiet:
615
self.send_changedstate()
616
# Do not run this again if called by a gobject.timeout_add
617
return False
618
619
def __del__(self):
620
self.disable()
621
622
def init_checker(self):
278
623
# Schedule a new checker to be started an 'interval' from now,
279
624
# and every interval from then on.
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
282
self.start_checker))
625
if self.checker_initiator_tag is not None:
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
629
self.start_checker)
630
# Schedule a disable() when 'timeout' has passed
631
if self.disable_initiator_tag is not None:
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
634
int(self.timeout.total_seconds() * 1000), self.disable)
283
635
# Also start a new checker *right now*.
284
636
self.start_checker()
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
289
self.enabled = True
290
if self.use_dbus:
291
# Emit D-Bus signals
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
296
variant_level=1)))
297
298
def disable(self):
299
"""Disable this client."""
300
if not getattr(self, "enabled", False):
301
return False
302
logger.info(u"Disabling client %s", self.name)
303
if getattr(self, "disable_initiator_tag", False):
304
gobject.source_remove(self.disable_initiator_tag)
305
self.disable_initiator_tag = None
306
if getattr(self, "checker_initiator_tag", False):
307
gobject.source_remove(self.checker_initiator_tag)
308
self.checker_initiator_tag = None
309
self.stop_checker()
310
if self.disable_hook:
311
self.disable_hook(self)
312
self.enabled = False
313
if self.use_dbus:
314
# Emit D-Bus signal
315
self.PropertyChanged(dbus.String(u"enabled"),
316
dbus.Boolean(False, variant_level=1))
317
# Do not run this again if called by a gobject.timeout_add
318
return False
319
320
def __del__(self):
321
self.disable_hook = None
322
self.disable()
323
637
324
638
def checker_callback(self, pid, condition, command):
325
639
"""The checker has completed, so take appropriate actions."""
326
640
self.checker_callback_tag = None
327
641
self.checker = None
328
if self.use_dbus:
329
# Emit D-Bus signal
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
332
642
if os.WIFEXITED(condition):
333
exitstatus = os.WEXITSTATUS(condition)
334
if exitstatus == 0:
335
logger.info(u"Checker for %(name)s succeeded",
643
self.last_checker_status = os.WEXITSTATUS(condition)
644
if self.last_checker_status == 0:
645
logger.info("Checker for %(name)s succeeded",
336
646
vars(self))
337
647
self.checked_ok()
338
648
else:
339
logger.info(u"Checker for %(name)s failed",
340
vars(self))
341
if self.use_dbus:
342
# Emit D-Bus signal
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
649
logger.info("Checker for %(name)s failed", vars(self))
346
650
else:
347
logger.warning(u"Checker for %(name)s crashed?",
651
self.last_checker_status = -1
652
logger.warning("Checker for %(name)s crashed?",
348
653
vars(self))
349
if self.use_dbus:
350
# Emit D-Bus signal
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
354
654
355
655
def checked_ok(self):
356
"""Bump up the timeout for this client.
357
This should only be called when the client has been seen,
358
alive and well.
359
"""
656
"""Assert that the client has been seen, alive and well."""
360
657
self.last_checked_ok = datetime.datetime.utcnow()
361
gobject.source_remove(self.disable_initiator_tag)
362
self.disable_initiator_tag = (gobject.timeout_add
363
(self.timeout_milliseconds(),
364
self.disable))
365
if self.use_dbus:
366
# Emit D-Bus signal
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
370
variant_level=1)))
658
self.last_checker_status = 0
659
self.bump_timeout()
660
661
def bump_timeout(self, timeout=None):
662
"""Bump up the timeout for this client."""
663
if timeout is None:
664
timeout = self.timeout
665
if self.disable_initiator_tag is not None:
666
gobject.source_remove(self.disable_initiator_tag)
667
self.disable_initiator_tag = None
668
if getattr(self, "enabled", False):
669
self.disable_initiator_tag = gobject.timeout_add(
670
int(timeout.total_seconds() * 1000), self.disable)
671
self.expires = datetime.datetime.utcnow() + timeout
672
673
def need_approval(self):
674
self.last_approval_request = datetime.datetime.utcnow()
371
675
372
676
def start_checker(self):
373
677
"""Start a new checker subprocess if one is not running.
678
374
679
If a checker already exists, leave it running and do
375
680
nothing."""
376
681
# The reason for not killing a running checker is that if we
377
# did that, then if a checker (for some reason) started
378
# running slowly and taking more than 'interval' time, the
379
# client would inevitably timeout, since no checker would get
380
# a chance to run to completion. If we instead leave running
682
# did that, and if a checker (for some reason) started running
683
# slowly and taking more than 'interval' time, then the client
684
# would inevitably timeout, since no checker would get a
685
# chance to run to completion. If we instead leave running
381
686
# checkers alone, the checker would have to take more time
382
# than 'timeout' for the client to be declared invalid, which
383
# is as it should be.
687
# than 'timeout' for the client to be disabled, which is as it
688
# should be.
384
689
385
690
# If a checker exists, make sure it is not a zombie
386
if self.checker is not None:
691
try:
387
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except AttributeError:
694
pass
695
except OSError as error:
696
if error.errno != errno.ECHILD:
697
raise
698
else:
388
699
if pid:
389
700
logger.warning("Checker was a zombie")
390
701
gobject.source_remove(self.checker_callback_tag)
392
703
self.current_checker_command)
393
704
# Start a new checker if needed
394
705
if self.checker is None:
395
try:
396
# In case checker_command has exactly one % operator
397
command = self.checker_command % self.host
398
except TypeError:
399
# Escape attributes for the shell
400
escaped_attrs = dict((key, re.escape(str(val)))
401
for key, val in
402
vars(self).iteritems())
403
try:
404
command = self.checker_command % escaped_attrs
405
except TypeError, error:
406
logger.error(u'Could not format string "%s":'
407
u' %s', self.checker_command, error)
408
return True # Try again later
409
self.current_checker_command = command
410
try:
411
logger.info(u"Starting checker %r for %s",
412
command, self.name)
706
# Escape attributes for the shell
707
escaped_attrs = {
708
attr: re.escape(str(getattr(self, attr)))
709
for attr in self.runtime_expansions }
710
try:
711
command = self.checker_command % escaped_attrs
712
except TypeError as error:
713
logger.error('Could not format string "%s"',
714
self.checker_command,
715
exc_info=error)
716
return True # Try again later
717
self.current_checker_command = command
718
try:
719
logger.info("Starting checker %r for %s", command,
720
self.name)
413
721
# We don't need to redirect stdout and stderr, since
414
722
# in normal mode, that is already done by daemon(),
415
723
# and in debug mode we don't want to. (Stdin is
416
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
727
# created wnull.
728
popen_args = {}
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
732
"stderr": wnull })
417
733
self.checker = subprocess.Popen(command,
418
734
close_fds=True,
419
shell=True, cwd="/")
420
if self.use_dbus:
421
# Emit D-Bus signal
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
426
self.checker_callback_tag = (gobject.child_watch_add
427
(self.checker.pid,
428
self.checker_callback,
429
data=command))
430
# The checker may have completed before the gobject
431
# watch was added. Check for this.
735
shell=True,
736
cwd="/",
737
**popen_args)
738
except OSError as error:
739
logger.error("Failed to start subprocess",
740
exc_info=error)
741
return True
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
746
try:
432
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
433
if pid:
434
gobject.source_remove(self.checker_callback_tag)
435
self.checker_callback(pid, status, command)
436
except OSError, error:
437
logger.error(u"Failed to start subprocess: %s",
438
error)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
752
exc_info=error)
753
return True
754
raise
755
if pid:
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
439
758
# Re-run this periodically if run by gobject.timeout_add
440
759
return True
441
760
446
765
self.checker_callback_tag = None
447
766
if getattr(self, "checker", None) is None:
448
767
return
449
logger.debug(u"Stopping checker for %(name)s", vars(self))
768
logger.debug("Stopping checker for %(name)s", vars(self))
450
769
try:
451
os.kill(self.checker.pid, signal.SIGTERM)
452
#os.sleep(0.5)
770
self.checker.terminate()
771
#time.sleep(0.5)
453
772
#if self.checker.poll() is None:
454
# os.kill(self.checker.pid, signal.SIGKILL)
455
except OSError, error:
773
# self.checker.kill()
774
except OSError as error:
456
775
if error.errno != errno.ESRCH: # No such process
457
776
raise
458
777
self.checker = None
459
if self.use_dbus:
460
self.PropertyChanged(dbus.String(u"checker_running"),
461
dbus.Boolean(False, variant_level=1))
462
463
def still_valid(self):
464
"""Has the timeout not yet passed for this client?"""
465
if not getattr(self, "enabled", False):
466
return False
467
now = datetime.datetime.utcnow()
468
if self.last_checked_ok is None:
469
return now < (self.created + self.timeout)
778
779
780
def dbus_service_property(dbus_interface,
781
signature="v",
782
access="readwrite",
783
byte_arrays=False):
784
"""Decorators for marking methods of a DBusObjectWithProperties to
785
become properties on the D-Bus.
786
787
The decorated method will be called with no arguments by "Get"
788
and with one argument by "Set".
789
790
The parameters, where they are supported, are the same as
791
dbus.service.method, except there is only "signature", since the
792
type from Get() and the type sent to Set() is the same.
793
"""
794
# Encoding deeply encoded byte arrays is not supported yet by the
795
# "Set" method, so we fail early here:
796
if byte_arrays and signature != "ay":
797
raise ValueError("Byte arrays not supported for non-'ay'"
798
" signature {!r}".format(signature))
799
800
def decorator(func):
801
func._dbus_is_property = True
802
func._dbus_interface = dbus_interface
803
func._dbus_signature = signature
804
func._dbus_access = access
805
func._dbus_name = func.__name__
806
if func._dbus_name.endswith("_dbus_property"):
807
func._dbus_name = func._dbus_name[:-14]
808
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
809
return func
810
811
return decorator
812
813
814
def dbus_interface_annotations(dbus_interface):
815
"""Decorator for marking functions returning interface annotations
816
817
Usage:
818
819
@dbus_interface_annotations("org.example.Interface")
820
def _foo(self): # Function name does not matter
821
return {"org.freedesktop.DBus.Deprecated": "true",
822
"org.freedesktop.DBus.Property.EmitsChangedSignal":
823
"false"}
824
"""
825
826
def decorator(func):
827
func._dbus_is_interface = True
828
func._dbus_interface = dbus_interface
829
func._dbus_name = dbus_interface
830
return func
831
832
return decorator
833
834
835
def dbus_annotations(annotations):
836
"""Decorator to annotate D-Bus methods, signals or properties
837
Usage:
838
839
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
842
@dbus_service_property("org.example.Interface", signature="b",
843
access="r")
844
def Property_dbus_property(self):
845
return dbus.Boolean(False)
846
"""
847
848
def decorator(func):
849
func._dbus_annotations = annotations
850
return func
851
852
return decorator
853
854
855
class DBusPropertyException(dbus.exceptions.DBusException):
856
"""A base class for D-Bus property-related exceptions
857
"""
858
pass
859
860
861
class DBusPropertyAccessException(DBusPropertyException):
862
"""A property's access permissions disallows an operation.
863
"""
864
pass
865
866
867
class DBusPropertyNotFound(DBusPropertyException):
868
"""An attempt was made to access a non-existing property.
869
"""
870
pass
871
872
873
class DBusObjectWithProperties(dbus.service.Object):
874
"""A D-Bus object with properties.
875
876
Classes inheriting from this can use the dbus_service_property
877
decorator to expose methods as D-Bus properties. It exposes the
878
standard Get(), Set(), and GetAll() methods on the D-Bus.
879
"""
880
881
@staticmethod
882
def _is_dbus_thing(thing):
883
"""Returns a function testing if an attribute is a D-Bus thing
884
885
If called like _is_dbus_thing("method") it returns a function
886
suitable for use as predicate to inspect.getmembers().
887
"""
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
889
False)
890
891
def _get_all_dbus_things(self, thing):
892
"""Returns a generator of (name, attribute) pairs
893
"""
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
895
athing.__get__(self))
896
for cls in self.__class__.__mro__
897
for name, athing in
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
899
900
def _get_dbus_property(self, interface_name, property_name):
901
"""Returns a bound method if one exists which is a D-Bus
902
property with the specified name and interface.
903
"""
904
for cls in self.__class__.__mro__:
905
for name, value in inspect.getmembers(
906
cls, self._is_dbus_thing("property")):
907
if (value._dbus_name == property_name
908
and value._dbus_interface == interface_name):
909
return value.__get__(self)
910
911
# No such property
912
raise DBusPropertyNotFound("{}:{}.{}".format(
913
self.dbus_object_path, interface_name, property_name))
914
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
916
in_signature="ss",
917
out_signature="v")
918
def Get(self, interface_name, property_name):
919
"""Standard D-Bus property Get() method, see D-Bus standard.
920
"""
921
prop = self._get_dbus_property(interface_name, property_name)
922
if prop._dbus_access == "write":
923
raise DBusPropertyAccessException(property_name)
924
value = prop()
925
if not hasattr(value, "variant_level"):
926
return value
927
return type(value)(value, variant_level=value.variant_level+1)
928
929
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
930
def Set(self, interface_name, property_name, value):
931
"""Standard D-Bus property Set() method, see D-Bus standard.
932
"""
933
prop = self._get_dbus_property(interface_name, property_name)
934
if prop._dbus_access == "read":
935
raise DBusPropertyAccessException(property_name)
936
if prop._dbus_get_args_options["byte_arrays"]:
937
# The byte_arrays option is not supported yet on
938
# signatures other than "ay".
939
if prop._dbus_signature != "ay":
940
raise ValueError("Byte arrays not supported for non-"
941
"'ay' signature {!r}"
942
.format(prop._dbus_signature))
943
value = dbus.ByteArray(b''.join(chr(byte)
944
for byte in value))
945
prop(value)
946
947
@dbus.service.method(dbus.PROPERTIES_IFACE,
948
in_signature="s",
949
out_signature="a{sv}")
950
def GetAll(self, interface_name):
951
"""Standard D-Bus property GetAll() method, see D-Bus
952
standard.
953
954
Note: Will not include properties with access="write".
955
"""
956
properties = {}
957
for name, prop in self._get_all_dbus_things("property"):
958
if (interface_name
959
and interface_name != prop._dbus_interface):
960
# Interface non-empty but did not match
961
continue
962
# Ignore write-only properties
963
if prop._dbus_access == "write":
964
continue
965
value = prop()
966
if not hasattr(value, "variant_level"):
967
properties[name] = value
968
continue
969
properties[name] = type(value)(
970
value, variant_level = value.variant_level + 1)
971
return dbus.Dictionary(properties, signature="sv")
972
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
974
def PropertiesChanged(self, interface_name, changed_properties,
975
invalidated_properties):
976
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
977
standard.
978
"""
979
pass
980
981
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
982
out_signature="s",
983
path_keyword='object_path',
984
connection_keyword='connection')
985
def Introspect(self, object_path, connection):
986
"""Overloading of standard D-Bus method.
987
988
Inserts property tags and interface annotation tags.
989
"""
990
xmlstring = dbus.service.Object.Introspect(self, object_path,
991
connection)
992
try:
993
document = xml.dom.minidom.parseString(xmlstring)
994
995
def make_tag(document, name, prop):
996
e = document.createElement("property")
997
e.setAttribute("name", name)
998
e.setAttribute("type", prop._dbus_signature)
999
e.setAttribute("access", prop._dbus_access)
1000
return e
1001
1002
for if_tag in document.getElementsByTagName("interface"):
1003
# Add property tags
1004
for tag in (make_tag(document, name, prop)
1005
for name, prop
1006
in self._get_all_dbus_things("property")
1007
if prop._dbus_interface
1008
== if_tag.getAttribute("name")):
1009
if_tag.appendChild(tag)
1010
# Add annotation tags
1011
for typ in ("method", "signal", "property"):
1012
for tag in if_tag.getElementsByTagName(typ):
1013
annots = dict()
1014
for name, prop in (self.
1015
_get_all_dbus_things(typ)):
1016
if (name == tag.getAttribute("name")
1017
and prop._dbus_interface
1018
== if_tag.getAttribute("name")):
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
1022
ann_tag = document.createElement(
1023
"annotation")
1024
ann_tag.setAttribute("name", name)
1025
ann_tag.setAttribute("value", value)
1026
tag.appendChild(ann_tag)
1027
# Add interface annotation tags
1028
for annotation, value in dict(
1029
itertools.chain.from_iterable(
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1033
if name == if_tag.getAttribute("name")
1034
)).items():
1035
ann_tag = document.createElement("annotation")
1036
ann_tag.setAttribute("name", annotation)
1037
ann_tag.setAttribute("value", value)
1038
if_tag.appendChild(ann_tag)
1039
# Add the names to the return values for the
1040
# "org.freedesktop.DBus.Properties" methods
1041
if (if_tag.getAttribute("name")
1042
== "org.freedesktop.DBus.Properties"):
1043
for cn in if_tag.getElementsByTagName("method"):
1044
if cn.getAttribute("name") == "Get":
1045
for arg in cn.getElementsByTagName("arg"):
1046
if (arg.getAttribute("direction")
1047
== "out"):
1048
arg.setAttribute("name", "value")
1049
elif cn.getAttribute("name") == "GetAll":
1050
for arg in cn.getElementsByTagName("arg"):
1051
if (arg.getAttribute("direction")
1052
== "out"):
1053
arg.setAttribute("name", "props")
1054
xmlstring = document.toxml("utf-8")
1055
document.unlink()
1056
except (AttributeError, xml.dom.DOMException,
1057
xml.parsers.expat.ExpatError) as error:
1058
logger.error("Failed to override Introspection method",
1059
exc_info=error)
1060
return xmlstring
1061
1062
1063
def datetime_to_dbus(dt, variant_level=0):
1064
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
if dt is None:
1066
return dbus.String("", variant_level = variant_level)
1067
return dbus.String(dt.isoformat(), variant_level=variant_level)
1068
1069
1070
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1071
"""A class decorator; applied to a subclass of
1072
dbus.service.Object, it will add alternate D-Bus attributes with
1073
interface names according to the "alt_interface_names" mapping.
1074
Usage:
1075
1076
@alternate_dbus_interfaces({"org.example.Interface":
1077
"net.example.AlternateInterface"})
1078
class SampleDBusObject(dbus.service.Object):
1079
@dbus.service.method("org.example.Interface")
1080
def SampleDBusMethod():
1081
pass
1082
1083
The above "SampleDBusMethod" on "SampleDBusObject" will be
1084
reachable via two interfaces: "org.example.Interface" and
1085
"net.example.AlternateInterface", the latter of which will have
1086
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1087
"true", unless "deprecate" is passed with a False value.
1088
1089
This works for methods and signals, and also for D-Bus properties
1090
(from DBusObjectWithProperties) and interfaces (from the
1091
dbus_interface_annotations decorator).
1092
"""
1093
1094
def wrapper(cls):
1095
for orig_interface_name, alt_interface_name in (
1096
alt_interface_names.items()):
1097
attr = {}
1098
interface_names = set()
1099
# Go though all attributes of the class
1100
for attrname, attribute in inspect.getmembers(cls):
1101
# Ignore non-D-Bus attributes, and D-Bus attributes
1102
# with the wrong interface name
1103
if (not hasattr(attribute, "_dbus_interface")
1104
or not attribute._dbus_interface.startswith(
1105
orig_interface_name)):
1106
continue
1107
# Create an alternate D-Bus interface name based on
1108
# the current name
1109
alt_interface = attribute._dbus_interface.replace(
1110
orig_interface_name, alt_interface_name)
1111
interface_names.add(alt_interface)
1112
# Is this a D-Bus signal?
1113
if getattr(attribute, "_dbus_is_signal", False):
1114
if sys.version == 2:
1115
# Extract the original non-method undecorated
1116
# function by black magic
1117
nonmethod_func = (dict(
1118
zip(attribute.func_code.co_freevars,
1119
attribute.__closure__))
1120
["func"].cell_contents)
1121
else:
1122
nonmethod_func = attribute
1123
# Create a new, but exactly alike, function
1124
# object, and decorate it to be a new D-Bus signal
1125
# with the alternate D-Bus interface name
1126
if sys.version == 2:
1127
new_function = types.FunctionType(
1128
nonmethod_func.func_code,
1129
nonmethod_func.func_globals,
1130
nonmethod_func.func_name,
1131
nonmethod_func.func_defaults,
1132
nonmethod_func.func_closure)
1133
else:
1134
new_function = types.FunctionType(
1135
nonmethod_func.__code__,
1136
nonmethod_func.__globals__,
1137
nonmethod_func.__name__,
1138
nonmethod_func.__defaults__,
1139
nonmethod_func.__closure__)
1140
new_function = (dbus.service.signal(
1141
alt_interface,
1142
attribute._dbus_signature)(new_function))
1143
# Copy annotations, if any
1144
try:
1145
new_function._dbus_annotations = dict(
1146
attribute._dbus_annotations)
1147
except AttributeError:
1148
pass
1149
# Define a creator of a function to call both the
1150
# original and alternate functions, so both the
1151
# original and alternate signals gets sent when
1152
# the function is called
1153
def fixscope(func1, func2):
1154
"""This function is a scope container to pass
1155
func1 and func2 to the "call_both" function
1156
outside of its arguments"""
1157
1158
def call_both(*args, **kwargs):
1159
"""This function will emit two D-Bus
1160
signals by calling func1 and func2"""
1161
func1(*args, **kwargs)
1162
func2(*args, **kwargs)
1163
1164
return call_both
1165
# Create the "call_both" function and add it to
1166
# the class
1167
attr[attrname] = fixscope(attribute, new_function)
1168
# Is this a D-Bus method?
1169
elif getattr(attribute, "_dbus_is_method", False):
1170
# Create a new, but exactly alike, function
1171
# object. Decorate it to be a new D-Bus method
1172
# with the alternate D-Bus interface name. Add it
1173
# to the class.
1174
attr[attrname] = (
1175
dbus.service.method(
1176
alt_interface,
1177
attribute._dbus_in_signature,
1178
attribute._dbus_out_signature)
1179
(types.FunctionType(attribute.func_code,
1180
attribute.func_globals,
1181
attribute.func_name,
1182
attribute.func_defaults,
1183
attribute.func_closure)))
1184
# Copy annotations, if any
1185
try:
1186
attr[attrname]._dbus_annotations = dict(
1187
attribute._dbus_annotations)
1188
except AttributeError:
1189
pass
1190
# Is this a D-Bus property?
1191
elif getattr(attribute, "_dbus_is_property", False):
1192
# Create a new, but exactly alike, function
1193
# object, and decorate it to be a new D-Bus
1194
# property with the alternate D-Bus interface
1195
# name. Add it to the class.
1196
attr[attrname] = (dbus_service_property(
1197
alt_interface, attribute._dbus_signature,
1198
attribute._dbus_access,
1199
attribute._dbus_get_args_options
1200
["byte_arrays"])
1201
(types.FunctionType(
1202
attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1207
# Copy annotations, if any
1208
try:
1209
attr[attrname]._dbus_annotations = dict(
1210
attribute._dbus_annotations)
1211
except AttributeError:
1212
pass
1213
# Is this a D-Bus interface?
1214
elif getattr(attribute, "_dbus_is_interface", False):
1215
# Create a new, but exactly alike, function
1216
# object. Decorate it to be a new D-Bus interface
1217
# with the alternate D-Bus interface name. Add it
1218
# to the class.
1219
attr[attrname] = (
1220
dbus_interface_annotations(alt_interface)
1221
(types.FunctionType(attribute.func_code,
1222
attribute.func_globals,
1223
attribute.func_name,
1224
attribute.func_defaults,
1225
attribute.func_closure)))
1226
if deprecate:
1227
# Deprecate all alternate interfaces
1228
iname="_AlternateDBusNames_interface_annotation{}"
1229
for interface_name in interface_names:
1230
1231
@dbus_interface_annotations(interface_name)
1232
def func(self):
1233
return { "org.freedesktop.DBus.Deprecated":
1234
"true" }
1235
# Find an unused name
1236
for aname in (iname.format(i)
1237
for i in itertools.count()):
1238
if aname not in attr:
1239
attr[aname] = func
1240
break
1241
if interface_names:
1242
# Replace the class with a new subclass of it with
1243
# methods, signals, etc. as created above.
1244
cls = type(b"{}Alternate".format(cls.__name__),
1245
(cls, ), attr)
1246
return cls
1247
1248
return wrapper
1249
1250
1251
@alternate_dbus_interfaces({"se.recompile.Mandos":
1252
"se.bsnet.fukt.Mandos"})
1253
class ClientDBus(Client, DBusObjectWithProperties):
1254
"""A Client class using D-Bus
1255
1256
Attributes:
1257
dbus_object_path: dbus.ObjectPath
1258
bus: dbus.SystemBus()
1259
"""
1260
1261
runtime_expansions = (Client.runtime_expansions
1262
+ ("dbus_object_path", ))
1263
1264
_interface = "se.recompile.Mandos.Client"
1265
1266
# dbus.service.Object doesn't use super(), so we can't either.
1267
1268
def __init__(self, bus = None, *args, **kwargs):
1269
self.bus = bus
1270
Client.__init__(self, *args, **kwargs)
1271
# Only now, when this client is initialized, can it show up on
1272
# the D-Bus
1273
client_object_name = str(self.name).translate(
1274
{ord("."): ord("_"),
1275
ord("-"): ord("_")})
1276
self.dbus_object_path = dbus.ObjectPath(
1277
"/clients/" + client_object_name)
1278
DBusObjectWithProperties.__init__(self, self.bus,
1279
self.dbus_object_path)
1280
1281
def notifychangeproperty(transform_func, dbus_name,
1282
type_func=lambda x: x,
1283
variant_level=1,
1284
invalidate_only=False,
1285
_interface=_interface):
1286
""" Modify a variable so that it's a property which announces
1287
its changes to DBus.
1288
1289
transform_fun: Function that takes a value and a variant_level
1290
and transforms it to a D-Bus type.
1291
dbus_name: D-Bus name of the variable
1292
type_func: Function that transform the value before sending it
1293
to the D-Bus. Default: no transform
1294
variant_level: D-Bus variant level. Default: 1
1295
"""
1296
attrname = "_{}".format(dbus_name)
1297
1298
def setter(self, value):
1299
if hasattr(self, "dbus_object_path"):
1300
if (not hasattr(self, attrname) or
1301
type_func(getattr(self, attrname, None))
1302
!= type_func(value)):
1303
if invalidate_only:
1304
self.PropertiesChanged(
1305
_interface, dbus.Dictionary(),
1306
dbus.Array((dbus_name, )))
1307
else:
1308
dbus_value = transform_func(
1309
type_func(value),
1310
variant_level = variant_level)
1311
self.PropertyChanged(dbus.String(dbus_name),
1312
dbus_value)
1313
self.PropertiesChanged(
1314
_interface,
1315
dbus.Dictionary({ dbus.String(dbus_name):
1316
dbus_value }),
1317
dbus.Array())
1318
setattr(self, attrname, value)
1319
1320
return property(lambda self: getattr(self, attrname), setter)
1321
1322
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1323
approvals_pending = notifychangeproperty(dbus.Boolean,
1324
"ApprovalPending",
1325
type_func = bool)
1326
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1327
last_enabled = notifychangeproperty(datetime_to_dbus,
1328
"LastEnabled")
1329
checker = notifychangeproperty(
1330
dbus.Boolean, "CheckerRunning",
1331
type_func = lambda checker: checker is not None)
1332
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1333
"LastCheckedOK")
1334
last_checker_status = notifychangeproperty(dbus.Int16,
1335
"LastCheckerStatus")
1336
last_approval_request = notifychangeproperty(
1337
datetime_to_dbus, "LastApprovalRequest")
1338
approved_by_default = notifychangeproperty(dbus.Boolean,
1339
"ApprovedByDefault")
1340
approval_delay = notifychangeproperty(
1341
dbus.UInt64, "ApprovalDelay",
1342
type_func = lambda td: td.total_seconds() * 1000)
1343
approval_duration = notifychangeproperty(
1344
dbus.UInt64, "ApprovalDuration",
1345
type_func = lambda td: td.total_seconds() * 1000)
1346
host = notifychangeproperty(dbus.String, "Host")
1347
timeout = notifychangeproperty(
1348
dbus.UInt64, "Timeout",
1349
type_func = lambda td: td.total_seconds() * 1000)
1350
extended_timeout = notifychangeproperty(
1351
dbus.UInt64, "ExtendedTimeout",
1352
type_func = lambda td: td.total_seconds() * 1000)
1353
interval = notifychangeproperty(
1354
dbus.UInt64, "Interval",
1355
type_func = lambda td: td.total_seconds() * 1000)
1356
checker_command = notifychangeproperty(dbus.String, "Checker")
1357
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1358
invalidate_only=True)
1359
1360
del notifychangeproperty
1361
1362
def __del__(self, *args, **kwargs):
1363
try:
1364
self.remove_from_connection()
1365
except LookupError:
1366
pass
1367
if hasattr(DBusObjectWithProperties, "__del__"):
1368
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1369
Client.__del__(self, *args, **kwargs)
1370
1371
def checker_callback(self, pid, condition, command,
1372
*args, **kwargs):
1373
self.checker_callback_tag = None
1374
self.checker = None
1375
if os.WIFEXITED(condition):
1376
exitstatus = os.WEXITSTATUS(condition)
1377
# Emit D-Bus signal
1378
self.CheckerCompleted(dbus.Int16(exitstatus),
1379
dbus.Int64(condition),
1380
dbus.String(command))
470
1381
else:
471
return now < (self.last_checked_ok + self.timeout)
472
473
## D-Bus methods & signals
474
_interface = u"se.bsnet.fukt.Mandos.Client"
475
476
# CheckedOK - method
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
1382
# Emit D-Bus signal
1383
self.CheckerCompleted(dbus.Int16(-1),
1384
dbus.Int64(condition),
1385
dbus.String(command))
1386
1387
return Client.checker_callback(self, pid, condition, command,
1388
*args, **kwargs)
1389
1390
def start_checker(self, *args, **kwargs):
1391
old_checker_pid = getattr(self.checker, "pid", None)
1392
r = Client.start_checker(self, *args, **kwargs)
1393
# Only if new checker process was started
1394
if (self.checker is not None
1395
and old_checker_pid != self.checker.pid):
1396
# Emit D-Bus signal
1397
self.CheckerStarted(self.current_checker_command)
1398
return r
1399
1400
def _reset_approved(self):
1401
self.approved = None
1402
return False
1403
1404
def approve(self, value=True):
1405
self.approved = value
1406
gobject.timeout_add(int(self.approval_duration.total_seconds()
1407
* 1000), self._reset_approved)
1408
self.send_changedstate()
1409
1410
## D-Bus methods, signals & properties
1411
1412
## Interfaces
1413
1414
## Signals
479
1415
480
1416
# CheckerCompleted - signal
481
1417
@dbus.service.signal(_interface, signature="nxs")
489
1425
"D-Bus signal"
490
1426
pass
491
1427
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
495
"D-Bus method"
496
return dbus.Dictionary({
497
dbus.String("name"):
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
501
dbus.String("host"):
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
507
variant_level=1)
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
514
variant_level=1)
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
519
variant_level=1),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
522
variant_level=1),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
525
variant_level=1),
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
528
variant_level=1),
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
531
variant_level=1)
532
}, signature="sv")
533
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
(still_valid))
537
IsStillValid.__name__ = "IsStillValid"
538
539
1428
# PropertyChanged - signal
1429
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
540
1430
@dbus.service.signal(_interface, signature="sv")
541
1431
def PropertyChanged(self, property, value):
542
1432
"D-Bus signal"
543
1433
pass
544
1434
545
# SetChecker - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetChecker(self, checker):
548
"D-Bus setter method"
549
self.checker_command = checker
550
# Emit D-Bus signal
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
553
variant_level=1))
554
555
# SetHost - method
556
@dbus.service.method(_interface, in_signature="s")
557
def SetHost(self, host):
558
"D-Bus setter method"
559
self.host = host
560
# Emit D-Bus signal
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
563
564
# SetInterval - method
565
@dbus.service.method(_interface, in_signature="t")
566
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
# Emit D-Bus signal
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
571
variant_level=1)))
572
573
# SetSecret - method
574
@dbus.service.method(_interface, in_signature="ay",
575
byte_arrays=True)
576
def SetSecret(self, secret):
577
"D-Bus setter method"
578
self.secret = str(secret)
579
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
# Emit D-Bus signal
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
587
variant_level=1)))
1435
# GotSecret - signal
1436
@dbus.service.signal(_interface)
1437
def GotSecret(self):
1438
"""D-Bus signal
1439
Is sent after a successful transfer of secret from the Mandos
1440
server to mandos-client
1441
"""
1442
pass
1443
1444
# Rejected - signal
1445
@dbus.service.signal(_interface, signature="s")
1446
def Rejected(self, reason):
1447
"D-Bus signal"
1448
pass
1449
1450
# NeedApproval - signal
1451
@dbus.service.signal(_interface, signature="tb")
1452
def NeedApproval(self, timeout, default):
1453
"D-Bus signal"
1454
return self.need_approval()
1455
1456
## Methods
1457
1458
# Approve - method
1459
@dbus.service.method(_interface, in_signature="b")
1460
def Approve(self, value):
1461
self.approve(value)
1462
1463
# CheckedOK - method
1464
@dbus.service.method(_interface)
1465
def CheckedOK(self):
1466
self.checked_ok()
588
1467
589
1468
# Enable - method
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
1469
@dbus.service.method(_interface)
1470
def Enable(self):
1471
"D-Bus method"
1472
self.enable()
592
1473
593
1474
# StartChecker - method
594
1475
@dbus.service.method(_interface)
603
1484
self.disable()
604
1485
605
1486
# StopChecker - method
606
StopChecker = dbus.service.method(_interface)(stop_checker)
607
StopChecker.__name__ = "StopChecker"
1487
@dbus.service.method(_interface)
1488
def StopChecker(self):
1489
self.stop_checker()
1490
1491
## Properties
1492
1493
# ApprovalPending - property
1494
@dbus_service_property(_interface, signature="b", access="read")
1495
def ApprovalPending_dbus_property(self):
1496
return dbus.Boolean(bool(self.approvals_pending))
1497
1498
# ApprovedByDefault - property
1499
@dbus_service_property(_interface,
1500
signature="b",
1501
access="readwrite")
1502
def ApprovedByDefault_dbus_property(self, value=None):
1503
if value is None: # get
1504
return dbus.Boolean(self.approved_by_default)
1505
self.approved_by_default = bool(value)
1506
1507
# ApprovalDelay - property
1508
@dbus_service_property(_interface,
1509
signature="t",
1510
access="readwrite")
1511
def ApprovalDelay_dbus_property(self, value=None):
1512
if value is None: # get
1513
return dbus.UInt64(self.approval_delay.total_seconds()
1514
* 1000)
1515
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1516
1517
# ApprovalDuration - property
1518
@dbus_service_property(_interface,
1519
signature="t",
1520
access="readwrite")
1521
def ApprovalDuration_dbus_property(self, value=None):
1522
if value is None: # get
1523
return dbus.UInt64(self.approval_duration.total_seconds()
1524
* 1000)
1525
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1526
1527
# Name - property
1528
@dbus_service_property(_interface, signature="s", access="read")
1529
def Name_dbus_property(self):
1530
return dbus.String(self.name)
1531
1532
# Fingerprint - property
1533
@dbus_service_property(_interface, signature="s", access="read")
1534
def Fingerprint_dbus_property(self):
1535
return dbus.String(self.fingerprint)
1536
1537
# Host - property
1538
@dbus_service_property(_interface,
1539
signature="s",
1540
access="readwrite")
1541
def Host_dbus_property(self, value=None):
1542
if value is None: # get
1543
return dbus.String(self.host)
1544
self.host = str(value)
1545
1546
# Created - property
1547
@dbus_service_property(_interface, signature="s", access="read")
1548
def Created_dbus_property(self):
1549
return datetime_to_dbus(self.created)
1550
1551
# LastEnabled - property
1552
@dbus_service_property(_interface, signature="s", access="read")
1553
def LastEnabled_dbus_property(self):
1554
return datetime_to_dbus(self.last_enabled)
1555
1556
# Enabled - property
1557
@dbus_service_property(_interface,
1558
signature="b",
1559
access="readwrite")
1560
def Enabled_dbus_property(self, value=None):
1561
if value is None: # get
1562
return dbus.Boolean(self.enabled)
1563
if value:
1564
self.enable()
1565
else:
1566
self.disable()
1567
1568
# LastCheckedOK - property
1569
@dbus_service_property(_interface,
1570
signature="s",
1571
access="readwrite")
1572
def LastCheckedOK_dbus_property(self, value=None):
1573
if value is not None:
1574
self.checked_ok()
1575
return
1576
return datetime_to_dbus(self.last_checked_ok)
1577
1578
# LastCheckerStatus - property
1579
@dbus_service_property(_interface, signature="n", access="read")
1580
def LastCheckerStatus_dbus_property(self):
1581
return dbus.Int16(self.last_checker_status)
1582
1583
# Expires - property
1584
@dbus_service_property(_interface, signature="s", access="read")
1585
def Expires_dbus_property(self):
1586
return datetime_to_dbus(self.expires)
1587
1588
# LastApprovalRequest - property
1589
@dbus_service_property(_interface, signature="s", access="read")
1590
def LastApprovalRequest_dbus_property(self):
1591
return datetime_to_dbus(self.last_approval_request)
1592
1593
# Timeout - property
1594
@dbus_service_property(_interface,
1595
signature="t",
1596
access="readwrite")
1597
def Timeout_dbus_property(self, value=None):
1598
if value is None: # get
1599
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1600
old_timeout = self.timeout
1601
self.timeout = datetime.timedelta(0, 0, 0, value)
1602
# Reschedule disabling
1603
if self.enabled:
1604
now = datetime.datetime.utcnow()
1605
self.expires += self.timeout - old_timeout
1606
if self.expires <= now:
1607
# The timeout has passed
1608
self.disable()
1609
else:
1610
if (getattr(self, "disable_initiator_tag", None)
1611
is None):
1612
return
1613
gobject.source_remove(self.disable_initiator_tag)
1614
self.disable_initiator_tag = gobject.timeout_add(
1615
int((self.expires - now).total_seconds() * 1000),
1616
self.disable)
1617
1618
# ExtendedTimeout - property
1619
@dbus_service_property(_interface,
1620
signature="t",
1621
access="readwrite")
1622
def ExtendedTimeout_dbus_property(self, value=None):
1623
if value is None: # get
1624
return dbus.UInt64(self.extended_timeout.total_seconds()
1625
* 1000)
1626
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1627
1628
# Interval - property
1629
@dbus_service_property(_interface,
1630
signature="t",
1631
access="readwrite")
1632
def Interval_dbus_property(self, value=None):
1633
if value is None: # get
1634
return dbus.UInt64(self.interval.total_seconds() * 1000)
1635
self.interval = datetime.timedelta(0, 0, 0, value)
1636
if getattr(self, "checker_initiator_tag", None) is None:
1637
return
1638
if self.enabled:
1639
# Reschedule checker run
1640
gobject.source_remove(self.checker_initiator_tag)
1641
self.checker_initiator_tag = gobject.timeout_add(
1642
value, self.start_checker)
1643
self.start_checker() # Start one now, too
1644
1645
# Checker - property
1646
@dbus_service_property(_interface,
1647
signature="s",
1648
access="readwrite")
1649
def Checker_dbus_property(self, value=None):
1650
if value is None: # get
1651
return dbus.String(self.checker_command)
1652
self.checker_command = str(value)
1653
1654
# CheckerRunning - property
1655
@dbus_service_property(_interface,
1656
signature="b",
1657
access="readwrite")
1658
def CheckerRunning_dbus_property(self, value=None):
1659
if value is None: # get
1660
return dbus.Boolean(self.checker is not None)
1661
if value:
1662
self.start_checker()
1663
else:
1664
self.stop_checker()
1665
1666
# ObjectPath - property
1667
@dbus_service_property(_interface, signature="o", access="read")
1668
def ObjectPath_dbus_property(self):
1669
return self.dbus_object_path # is already a dbus.ObjectPath
1670
1671
# Secret = property
1672
@dbus_service_property(_interface,
1673
signature="ay",
1674
access="write",
1675
byte_arrays=True)
1676
def Secret_dbus_property(self, value):
1677
self.secret = bytes(value)
608
1678
609
1679
del _interface
610
1680
611
1681
612
def peer_certificate(session):
613
"Return the peer's OpenPGP certificate as a bytestring"
614
# If not an OpenPGP certificate...
615
if (gnutls.library.functions
616
.gnutls_certificate_type_get(session._c_object)
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
# ...do the normal thing
619
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
621
cert_list = (gnutls.library.functions
622
.gnutls_certificate_get_peers
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
626
" certificate")
627
if list_size.value == 0:
628
return None
629
cert = cert_list[0]
630
return ctypes.string_at(cert.data, cert.size)
631
632
633
def fingerprint(openpgp):
634
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
# New GnuTLS "datum" with the OpenPGP public key
636
datum = (gnutls.library.types
637
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
ctypes.POINTER
639
(ctypes.c_ubyte)),
640
ctypes.c_uint(len(openpgp))))
641
# New empty GnuTLS certificate
642
crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
(gnutls.library.functions
644
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
645
# Import the OpenPGP public key into the certificate
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
gnutls.library.constants
649
.GNUTLS_OPENPGP_FMT_RAW))
650
# Verify the self signature in the key
651
crtverify = ctypes.c_uint()
652
(gnutls.library.functions
653
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
654
if crtverify.value != 0:
655
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
raise gnutls.errors.CertificateSecurityError("Verify failed")
657
# New buffer for the fingerprint
658
buf = ctypes.create_string_buffer(20)
659
buf_len = ctypes.c_size_t()
660
# Get the fingerprint from the certificate into the buffer
661
(gnutls.library.functions
662
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
ctypes.byref(buf_len)))
664
# Deinit the certificate
665
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
# Convert the buffer to a Python bytestring
667
fpr = ctypes.string_at(buf, buf_len.value)
668
# Convert the bytestring to hexadecimal notation
669
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
670
return hex_fpr
671
672
673
class TCP_handler(SocketServer.BaseRequestHandler, object):
674
"""A TCP request handler class.
675
Instantiated by IPv6_TCPServer for each request to handle it.
1682
class ProxyClient(object):
1683
def __init__(self, child_pipe, fpr, address):
1684
self._pipe = child_pipe
1685
self._pipe.send(('init', fpr, address))
1686
if not self._pipe.recv():
1687
raise KeyError(fpr)
1688
1689
def __getattribute__(self, name):
1690
if name == '_pipe':
1691
return super(ProxyClient, self).__getattribute__(name)
1692
self._pipe.send(('getattr', name))
1693
data = self._pipe.recv()
1694
if data[0] == 'data':
1695
return data[1]
1696
if data[0] == 'function':
1697
1698
def func(*args, **kwargs):
1699
self._pipe.send(('funcall', name, args, kwargs))
1700
return self._pipe.recv()[1]
1701
1702
return func
1703
1704
def __setattr__(self, name, value):
1705
if name == '_pipe':
1706
return super(ProxyClient, self).__setattr__(name, value)
1707
self._pipe.send(('setattr', name, value))
1708
1709
1710
class ClientHandler(socketserver.BaseRequestHandler, object):
1711
"""A class to handle client connections.
1712
1713
Instantiated once for each connection to handle it.
676
1714
Note: This will run in its own forked process."""
677
1715
678
1716
def handle(self):
679
logger.info(u"TCP connection from: %s",
680
unicode(self.client_address))
681
session = (gnutls.connection
682
.ClientSession(self.request,
683
gnutls.connection
684
.X509Credentials()))
685
686
line = self.request.makefile().readline()
687
logger.debug(u"Protocol version: %r", line)
688
try:
689
if int(line.strip().split()[0]) > 1:
690
raise RuntimeError
691
except (ValueError, IndexError, RuntimeError), error:
692
logger.error(u"Unknown protocol version: %s", error)
693
return
694
695
# Note: gnutls.connection.X509Credentials is really a generic
696
# GnuTLS certificate credentials object so long as no X.509
697
# keys are added to it. Therefore, we can use it here despite
698
# using OpenPGP certificates.
699
700
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
# "+DHE-DSS"))
703
# Use a fallback default, since this MUST be set.
704
priority = self.server.settings.get("priority", "NORMAL")
705
(gnutls.library.functions
706
.gnutls_priority_set_direct(session._c_object,
707
priority, None))
708
709
try:
710
session.handshake()
711
except gnutls.errors.GNUTLSError, error:
712
logger.warning(u"Handshake failed: %s", error)
713
# Do not run session.bye() here: the session is not
714
# established. Just abandon the request.
715
return
716
logger.debug(u"Handshake succeeded")
717
try:
718
fpr = fingerprint(peer_certificate(session))
719
except (TypeError, gnutls.errors.GNUTLSError), error:
720
logger.warning(u"Bad certificate: %s", error)
721
session.bye()
722
return
723
logger.debug(u"Fingerprint: %s", fpr)
724
725
for c in self.server.clients:
726
if c.fingerprint == fpr:
727
client = c
728
break
729
else:
730
logger.warning(u"Client not found for fingerprint: %s",
731
fpr)
732
session.bye()
733
return
734
# Have to check if client.still_valid(), since it is possible
735
# that the client timed out while establishing the GnuTLS
736
# session.
737
if not client.still_valid():
738
logger.warning(u"Client %(name)s is invalid",
739
vars(client))
740
session.bye()
741
return
742
## This won't work here, since we're in a fork.
743
# client.checked_ok()
744
sent_size = 0
745
while sent_size < len(client.secret):
746
sent = session.send(client.secret[sent_size:])
747
logger.debug(u"Sent: %d, remaining: %d",
748
sent, len(client.secret)
749
- (sent_size + sent))
750
sent_size += sent
751
session.bye()
752
753
754
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
SocketServer.TCPServer, object):
1717
with contextlib.closing(self.server.child_pipe) as child_pipe:
1718
logger.info("TCP connection from: %s",
1719
str(self.client_address))
1720
logger.debug("Pipe FD: %d",
1721
self.server.child_pipe.fileno())
1722
1723
session = gnutls.connection.ClientSession(
1724
self.request, gnutls.connection .X509Credentials())
1725
1726
# Note: gnutls.connection.X509Credentials is really a
1727
# generic GnuTLS certificate credentials object so long as
1728
# no X.509 keys are added to it. Therefore, we can use it
1729
# here despite using OpenPGP certificates.
1730
1731
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1732
# "+AES-256-CBC", "+SHA1",
1733
# "+COMP-NULL", "+CTYPE-OPENPGP",
1734
# "+DHE-DSS"))
1735
# Use a fallback default, since this MUST be set.
1736
priority = self.server.gnutls_priority
1737
if priority is None:
1738
priority = "NORMAL"
1739
gnutls.library.functions.gnutls_priority_set_direct(
1740
session._c_object, priority, None)
1741
1742
# Start communication using the Mandos protocol
1743
# Get protocol number
1744
line = self.request.makefile().readline()
1745
logger.debug("Protocol version: %r", line)
1746
try:
1747
if int(line.strip().split()[0]) > 1:
1748
raise RuntimeError(line)
1749
except (ValueError, IndexError, RuntimeError) as error:
1750
logger.error("Unknown protocol version: %s", error)
1751
return
1752
1753
# Start GnuTLS connection
1754
try:
1755
session.handshake()
1756
except gnutls.errors.GNUTLSError as error:
1757
logger.warning("Handshake failed: %s", error)
1758
# Do not run session.bye() here: the session is not
1759
# established. Just abandon the request.
1760
return
1761
logger.debug("Handshake succeeded")
1762
1763
approval_required = False
1764
try:
1765
try:
1766
fpr = self.fingerprint(
1767
self.peer_certificate(session))
1768
except (TypeError,
1769
gnutls.errors.GNUTLSError) as error:
1770
logger.warning("Bad certificate: %s", error)
1771
return
1772
logger.debug("Fingerprint: %s", fpr)
1773
1774
try:
1775
client = ProxyClient(child_pipe, fpr,
1776
self.client_address)
1777
except KeyError:
1778
return
1779
1780
if client.approval_delay:
1781
delay = client.approval_delay
1782
client.approvals_pending += 1
1783
approval_required = True
1784
1785
while True:
1786
if not client.enabled:
1787
logger.info("Client %s is disabled",
1788
client.name)
1789
if self.server.use_dbus:
1790
# Emit D-Bus signal
1791
client.Rejected("Disabled")
1792
return
1793
1794
if client.approved or not client.approval_delay:
1795
#We are approved or approval is disabled
1796
break
1797
elif client.approved is None:
1798
logger.info("Client %s needs approval",
1799
client.name)
1800
if self.server.use_dbus:
1801
# Emit D-Bus signal
1802
client.NeedApproval(
1803
client.approval_delay.total_seconds()
1804
* 1000, client.approved_by_default)
1805
else:
1806
logger.warning("Client %s was not approved",
1807
client.name)
1808
if self.server.use_dbus:
1809
# Emit D-Bus signal
1810
client.Rejected("Denied")
1811
return
1812
1813
#wait until timeout or approved
1814
time = datetime.datetime.now()
1815
client.changedstate.acquire()
1816
client.changedstate.wait(delay.total_seconds())
1817
client.changedstate.release()
1818
time2 = datetime.datetime.now()
1819
if (time2 - time) >= delay:
1820
if not client.approved_by_default:
1821
logger.warning("Client %s timed out while"
1822
" waiting for approval",
1823
client.name)
1824
if self.server.use_dbus:
1825
# Emit D-Bus signal
1826
client.Rejected("Approval timed out")
1827
return
1828
else:
1829
break
1830
else:
1831
delay -= time2 - time
1832
1833
sent_size = 0
1834
while sent_size < len(client.secret):
1835
try:
1836
sent = session.send(client.secret[sent_size:])
1837
except gnutls.errors.GNUTLSError as error:
1838
logger.warning("gnutls send failed",
1839
exc_info=error)
1840
return
1841
logger.debug("Sent: %d, remaining: %d", sent,
1842
len(client.secret) - (sent_size
1843
+ sent))
1844
sent_size += sent
1845
1846
logger.info("Sending secret to %s", client.name)
1847
# bump the timeout using extended_timeout
1848
client.bump_timeout(client.extended_timeout)
1849
if self.server.use_dbus:
1850
# Emit D-Bus signal
1851
client.GotSecret()
1852
1853
finally:
1854
if approval_required:
1855
client.approvals_pending -= 1
1856
try:
1857
session.bye()
1858
except gnutls.errors.GNUTLSError as error:
1859
logger.warning("GnuTLS bye failed",
1860
exc_info=error)
1861
1862
@staticmethod
1863
def peer_certificate(session):
1864
"Return the peer's OpenPGP certificate as a bytestring"
1865
# If not an OpenPGP certificate...
1866
if (gnutls.library.functions.gnutls_certificate_type_get(
1867
session._c_object)
1868
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1869
# ...do the normal thing
1870
return session.peer_certificate
1871
list_size = ctypes.c_uint(1)
1872
cert_list = (gnutls.library.functions
1873
.gnutls_certificate_get_peers
1874
(session._c_object, ctypes.byref(list_size)))
1875
if not bool(cert_list) and list_size.value != 0:
1876
raise gnutls.errors.GNUTLSError("error getting peer"
1877
" certificate")
1878
if list_size.value == 0:
1879
return None
1880
cert = cert_list[0]
1881
return ctypes.string_at(cert.data, cert.size)
1882
1883
@staticmethod
1884
def fingerprint(openpgp):
1885
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1886
# New GnuTLS "datum" with the OpenPGP public key
1887
datum = gnutls.library.types.gnutls_datum_t(
1888
ctypes.cast(ctypes.c_char_p(openpgp),
1889
ctypes.POINTER(ctypes.c_ubyte)),
1890
ctypes.c_uint(len(openpgp)))
1891
# New empty GnuTLS certificate
1892
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1893
gnutls.library.functions.gnutls_openpgp_crt_init(
1894
ctypes.byref(crt))
1895
# Import the OpenPGP public key into the certificate
1896
gnutls.library.functions.gnutls_openpgp_crt_import(
1897
crt, ctypes.byref(datum),
1898
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1899
# Verify the self signature in the key
1900
crtverify = ctypes.c_uint()
1901
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1902
crt, 0, ctypes.byref(crtverify))
1903
if crtverify.value != 0:
1904
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1905
raise gnutls.errors.CertificateSecurityError(
1906
"Verify failed")
1907
# New buffer for the fingerprint
1908
buf = ctypes.create_string_buffer(20)
1909
buf_len = ctypes.c_size_t()
1910
# Get the fingerprint from the certificate into the buffer
1911
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1912
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1913
# Deinit the certificate
1914
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1915
# Convert the buffer to a Python bytestring
1916
fpr = ctypes.string_at(buf, buf_len.value)
1917
# Convert the bytestring to hexadecimal notation
1918
hex_fpr = binascii.hexlify(fpr).upper()
1919
return hex_fpr
1920
1921
1922
class MultiprocessingMixIn(object):
1923
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1924
1925
def sub_process_main(self, request, address):
1926
try:
1927
self.finish_request(request, address)
1928
except Exception:
1929
self.handle_error(request, address)
1930
self.close_request(request)
1931
1932
def process_request(self, request, address):
1933
"""Start a new process to process the request."""
1934
proc = multiprocessing.Process(target = self.sub_process_main,
1935
args = (request, address))
1936
proc.start()
1937
return proc
1938
1939
1940
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1941
""" adds a pipe to the MixIn """
1942
1943
def process_request(self, request, client_address):
1944
"""Overrides and wraps the original process_request().
1945
1946
This function creates a new pipe in self.pipe
1947
"""
1948
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1949
1950
proc = MultiprocessingMixIn.process_request(self, request,
1951
client_address)
1952
self.child_pipe.close()
1953
self.add_pipe(parent_pipe, proc)
1954
1955
def add_pipe(self, parent_pipe, proc):
1956
"""Dummy function; override as necessary"""
1957
raise NotImplementedError()
1958
1959
1960
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1961
socketserver.TCPServer, object):
756
1962
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1963
757
1964
Attributes:
758
settings: Server settings
759
clients: Set() of Client objects
760
1965
enabled: Boolean; whether this server is activated yet
1966
interface: None or a network interface name (string)
1967
use_ipv6: Boolean; to use IPv6 or not
761
1968
"""
762
address_family = socket.AF_INET6
763
def __init__(self, *args, **kwargs):
764
if "settings" in kwargs:
765
self.settings = kwargs["settings"]
766
del kwargs["settings"]
767
if "clients" in kwargs:
768
self.clients = kwargs["clients"]
769
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
774
self.enabled = False
775
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1969
1970
def __init__(self, server_address, RequestHandlerClass,
1971
interface=None,
1972
use_ipv6=True,
1973
socketfd=None):
1974
"""If socketfd is set, use that file descriptor instead of
1975
creating a new one with socket.socket().
1976
"""
1977
self.interface = interface
1978
if use_ipv6:
1979
self.address_family = socket.AF_INET6
1980
if socketfd is not None:
1981
# Save the file descriptor
1982
self.socketfd = socketfd
1983
# Save the original socket.socket() function
1984
self.socket_socket = socket.socket
1985
# To implement --socket, we monkey patch socket.socket.
1986
#
1987
# (When socketserver.TCPServer is a new-style class, we
1988
# could make self.socket into a property instead of monkey
1989
# patching socket.socket.)
1990
#
1991
# Create a one-time-only replacement for socket.socket()
1992
@functools.wraps(socket.socket)
1993
def socket_wrapper(*args, **kwargs):
1994
# Restore original function so subsequent calls are
1995
# not affected.
1996
socket.socket = self.socket_socket
1997
del self.socket_socket
1998
# This time only, return a new socket object from the
1999
# saved file descriptor.
2000
return socket.fromfd(self.socketfd, *args, **kwargs)
2001
# Replace socket.socket() function with wrapper
2002
socket.socket = socket_wrapper
2003
# The socketserver.TCPServer.__init__ will call
2004
# socket.socket(), which might be our replacement,
2005
# socket_wrapper(), if socketfd was set.
2006
socketserver.TCPServer.__init__(self, server_address,
2007
RequestHandlerClass)
2008
776
2009
def server_bind(self):
777
2010
"""This overrides the normal server_bind() function
778
2011
to bind to an interface if one was specified, and also NOT to
779
2012
bind to an address or port if they were not specified."""
780
if self.settings["interface"]:
781
# 25 is from /usr/include/asm-i486/socket.h
782
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
783
try:
784
self.socket.setsockopt(socket.SOL_SOCKET,
785
SO_BINDTODEVICE,
786
self.settings["interface"])
787
except socket.error, error:
788
if error[0] == errno.EPERM:
789
logger.error(u"No permission to"
790
u" bind to interface %s",
791
self.settings["interface"])
792
else:
793
raise
2013
if self.interface is not None:
2014
if SO_BINDTODEVICE is None:
2015
logger.error("SO_BINDTODEVICE does not exist;"
2016
" cannot bind to interface %s",
2017
self.interface)
2018
else:
2019
try:
2020
self.socket.setsockopt(
2021
socket.SOL_SOCKET, SO_BINDTODEVICE,
2022
(self.interface + "\0").encode("utf-8"))
2023
except socket.error as error:
2024
if error.errno == errno.EPERM:
2025
logger.error("No permission to bind to"
2026
" interface %s", self.interface)
2027
elif error.errno == errno.ENOPROTOOPT:
2028
logger.error("SO_BINDTODEVICE not available;"
2029
" cannot bind to interface %s",
2030
self.interface)
2031
elif error.errno == errno.ENODEV:
2032
logger.error("Interface %s does not exist,"
2033
" cannot bind", self.interface)
2034
else:
2035
raise
794
2036
# Only bind(2) the socket if we really need to.
795
2037
if self.server_address[0] or self.server_address[1]:
796
2038
if not self.server_address[0]:
797
2039
if self.address_family == socket.AF_INET6:
798
2040
any_address = "::" # in6addr_any
799
2041
else:
800
any_address = socket.INADDR_ANY
2042
any_address = "0.0.0.0" # INADDR_ANY
801
2043
self.server_address = (any_address,
802
2044
self.server_address[1])
803
2045
elif not self.server_address[1]:
804
self.server_address = (self.server_address[0],
805
0)
806
# if self.settings["interface"]:
2046
self.server_address = (self.server_address[0], 0)
2047
# if self.interface:
807
2048
# self.server_address = (self.server_address[0],
808
2049
# 0, # port
809
2050
# 0, # flowinfo
810
2051
# if_nametoindex
811
# (self.settings
812
# ["interface"]))
813
return super(IPv6_TCPServer, self).server_bind()
2052
# (self.interface))
2053
return socketserver.TCPServer.server_bind(self)
2054
2055
2056
class MandosServer(IPv6_TCPServer):
2057
"""Mandos server.
2058
2059
Attributes:
2060
clients: set of Client objects
2061
gnutls_priority GnuTLS priority string
2062
use_dbus: Boolean; to emit D-Bus signals or not
2063
2064
Assumes a gobject.MainLoop event loop.
2065
"""
2066
2067
def __init__(self, server_address, RequestHandlerClass,
2068
interface=None,
2069
use_ipv6=True,
2070
clients=None,
2071
gnutls_priority=None,
2072
use_dbus=True,
2073
socketfd=None):
2074
self.enabled = False
2075
self.clients = clients
2076
if self.clients is None:
2077
self.clients = {}
2078
self.use_dbus = use_dbus
2079
self.gnutls_priority = gnutls_priority
2080
IPv6_TCPServer.__init__(self, server_address,
2081
RequestHandlerClass,
2082
interface = interface,
2083
use_ipv6 = use_ipv6,
2084
socketfd = socketfd)
2085
814
2086
def server_activate(self):
815
2087
if self.enabled:
816
return super(IPv6_TCPServer, self).server_activate()
2088
return socketserver.TCPServer.server_activate(self)
2089
817
2090
def enable(self):
818
2091
self.enabled = True
2092
2093
def add_pipe(self, parent_pipe, proc):
2094
# Call "handle_ipc" for both data and EOF events
2095
gobject.io_add_watch(
2096
parent_pipe.fileno(),
2097
gobject.IO_IN | gobject.IO_HUP,
2098
functools.partial(self.handle_ipc,
2099
parent_pipe = parent_pipe,
2100
proc = proc))
2101
2102
def handle_ipc(self, source, condition,
2103
parent_pipe=None,
2104
proc = None,
2105
client_object=None):
2106
# error, or the other end of multiprocessing.Pipe has closed
2107
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2108
# Wait for other process to exit
2109
proc.join()
2110
return False
2111
2112
# Read a request from the child
2113
request = parent_pipe.recv()
2114
command = request[0]
2115
2116
if command == 'init':
2117
fpr = request[1]
2118
address = request[2]
2119
2120
for c in self.clients.itervalues():
2121
if c.fingerprint == fpr:
2122
client = c
2123
break
2124
else:
2125
logger.info("Client not found for fingerprint: %s, ad"
2126
"dress: %s", fpr, address)
2127
if self.use_dbus:
2128
# Emit D-Bus signal
2129
mandos_dbus_service.ClientNotFound(fpr,
2130
address[0])
2131
parent_pipe.send(False)
2132
return False
2133
2134
gobject.io_add_watch(
2135
parent_pipe.fileno(),
2136
gobject.IO_IN | gobject.IO_HUP,
2137
functools.partial(self.handle_ipc,
2138
parent_pipe = parent_pipe,
2139
proc = proc,
2140
client_object = client))
2141
parent_pipe.send(True)
2142
# remove the old hook in favor of the new above hook on
2143
# same fileno
2144
return False
2145
if command == 'funcall':
2146
funcname = request[1]
2147
args = request[2]
2148
kwargs = request[3]
2149
2150
parent_pipe.send(('data', getattr(client_object,
2151
funcname)(*args,
2152
**kwargs)))
2153
2154
if command == 'getattr':
2155
attrname = request[1]
2156
if isinstance(client_object.__getattribute__(attrname),
2157
collections.Callable):
2158
parent_pipe.send(('function', ))
2159
else:
2160
parent_pipe.send((
2161
'data', client_object.__getattribute__(attrname)))
2162
2163
if command == 'setattr':
2164
attrname = request[1]
2165
value = request[2]
2166
setattr(client_object, attrname, value)
2167
2168
return True
2169
2170
2171
def rfc3339_duration_to_delta(duration):
2172
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2173
2174
>>> rfc3339_duration_to_delta("P7D")
2175
datetime.timedelta(7)
2176
>>> rfc3339_duration_to_delta("PT60S")
2177
datetime.timedelta(0, 60)
2178
>>> rfc3339_duration_to_delta("PT60M")
2179
datetime.timedelta(0, 3600)
2180
>>> rfc3339_duration_to_delta("PT24H")
2181
datetime.timedelta(1)
2182
>>> rfc3339_duration_to_delta("P1W")
2183
datetime.timedelta(7)
2184
>>> rfc3339_duration_to_delta("PT5M30S")
2185
datetime.timedelta(0, 330)
2186
>>> rfc3339_duration_to_delta("P1DT3M20S")
2187
datetime.timedelta(1, 200)
2188
"""
2189
2190
# Parsing an RFC 3339 duration with regular expressions is not
2191
# possible - there would have to be multiple places for the same
2192
# values, like seconds. The current code, while more esoteric, is
2193
# cleaner without depending on a parsing library. If Python had a
2194
# built-in library for parsing we would use it, but we'd like to
2195
# avoid excessive use of external libraries.
2196
2197
# New type for defining tokens, syntax, and semantics all-in-one
2198
Token = collections.namedtuple("Token", (
2199
"regexp", # To match token; if "value" is not None, must have
2200
# a "group" containing digits
2201
"value", # datetime.timedelta or None
2202
"followers")) # Tokens valid after this token
2203
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2204
# the "duration" ABNF definition in RFC 3339, Appendix A.
2205
token_end = Token(re.compile(r"$"), None, frozenset())
2206
token_second = Token(re.compile(r"(\d+)S"),
2207
datetime.timedelta(seconds=1),
2208
frozenset((token_end, )))
2209
token_minute = Token(re.compile(r"(\d+)M"),
2210
datetime.timedelta(minutes=1),
2211
frozenset((token_second, token_end)))
2212
token_hour = Token(re.compile(r"(\d+)H"),
2213
datetime.timedelta(hours=1),
2214
frozenset((token_minute, token_end)))
2215
token_time = Token(re.compile(r"T"),
2216
None,
2217
frozenset((token_hour, token_minute,
2218
token_second)))
2219
token_day = Token(re.compile(r"(\d+)D"),
2220
datetime.timedelta(days=1),
2221
frozenset((token_time, token_end)))
2222
token_month = Token(re.compile(r"(\d+)M"),
2223
datetime.timedelta(weeks=4),
2224
frozenset((token_day, token_end)))
2225
token_year = Token(re.compile(r"(\d+)Y"),
2226
datetime.timedelta(weeks=52),
2227
frozenset((token_month, token_end)))
2228
token_week = Token(re.compile(r"(\d+)W"),
2229
datetime.timedelta(weeks=1),
2230
frozenset((token_end, )))
2231
token_duration = Token(re.compile(r"P"), None,
2232
frozenset((token_year, token_month,
2233
token_day, token_time,
2234
token_week)))
2235
# Define starting values
2236
value = datetime.timedelta() # Value so far
2237
found_token = None
2238
followers = frozenset((token_duration, )) # Following valid tokens
2239
s = duration # String left to parse
2240
# Loop until end token is found
2241
while found_token is not token_end:
2242
# Search for any currently valid tokens
2243
for token in followers:
2244
match = token.regexp.match(s)
2245
if match is not None:
2246
# Token found
2247
if token.value is not None:
2248
# Value found, parse digits
2249
factor = int(match.group(1), 10)
2250
# Add to value so far
2251
value += factor * token.value
2252
# Strip token from string
2253
s = token.regexp.sub("", s, 1)
2254
# Go to found token
2255
found_token = token
2256
# Set valid next tokens
2257
followers = found_token.followers
2258
break
2259
else:
2260
# No currently valid tokens were found
2261
raise ValueError("Invalid RFC 3339 duration: {!r}"
2262
.format(duration))
2263
# End token found
2264
return value
819
2265
820
2266
821
2267
def string_to_delta(interval):
829
2275
datetime.timedelta(0, 3600)
830
2276
>>> string_to_delta('24h')
831
2277
datetime.timedelta(1)
832
>>> string_to_delta(u'1w')
2278
>>> string_to_delta('1w')
833
2279
datetime.timedelta(7)
834
2280
>>> string_to_delta('5m 30s')
835
2281
datetime.timedelta(0, 330)
836
2282
"""
2283
2284
try:
2285
return rfc3339_duration_to_delta(interval)
2286
except ValueError:
2287
pass
2288
837
2289
timevalue = datetime.timedelta(0)
838
2290
for s in interval.split():
839
2291
try:
840
suffix = unicode(s[-1])
2292
suffix = s[-1]
841
2293
value = int(s[:-1])
842
if suffix == u"d":
2294
if suffix == "d":
843
2295
delta = datetime.timedelta(value)
844
elif suffix == u"s":
2296
elif suffix == "s":
845
2297
delta = datetime.timedelta(0, value)
846
elif suffix == u"m":
2298
elif suffix == "m":
847
2299
delta = datetime.timedelta(0, 0, 0, 0, value)
848
elif suffix == u"h":
2300
elif suffix == "h":
849
2301
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
850
elif suffix == u"w":
2302
elif suffix == "w":
851
2303
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
852
2304
else:
853
raise ValueError
854
except (ValueError, IndexError):
855
raise ValueError
2305
raise ValueError("Unknown suffix {!r}".format(suffix))
2306
except IndexError as e:
2307
raise ValueError(*(e.args))
856
2308
timevalue += delta
857
2309
return timevalue
858
2310
859
2311
860
def server_state_changed(state):
861
"""Derived from the Avahi example code"""
862
if state == avahi.SERVER_COLLISION:
863
logger.error(u"Zeroconf server name collision")
864
service.remove()
865
elif state == avahi.SERVER_RUNNING:
866
service.add()
867
868
869
def entry_group_state_changed(state, error):
870
"""Derived from the Avahi example code"""
871
logger.debug(u"Avahi state change: %i", state)
872
873
if state == avahi.ENTRY_GROUP_ESTABLISHED:
874
logger.debug(u"Zeroconf service established.")
875
elif state == avahi.ENTRY_GROUP_COLLISION:
876
logger.warning(u"Zeroconf service name collision.")
877
service.rename()
878
elif state == avahi.ENTRY_GROUP_FAILURE:
879
logger.critical(u"Avahi: Error in group state changed %s",
880
unicode(error))
881
raise AvahiGroupError(u"State changed: %s" % unicode(error))
882
883
def if_nametoindex(interface):
884
"""Call the C function if_nametoindex(), or equivalent"""
885
global if_nametoindex
886
try:
887
if_nametoindex = (ctypes.cdll.LoadLibrary
888
(ctypes.util.find_library("c"))
889
.if_nametoindex)
890
except (OSError, AttributeError):
891
if "struct" not in sys.modules:
892
import struct
893
if "fcntl" not in sys.modules:
894
import fcntl
895
def if_nametoindex(interface):
896
"Get an interface index the hard way, i.e. using fcntl()"
897
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
898
with closing(socket.socket()) as s:
899
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
900
struct.pack("16s16x", interface))
901
interface_index = struct.unpack("I", ifreq[16:20])[0]
902
return interface_index
903
return if_nametoindex(interface)
904
905
906
2312
def daemon(nochdir = False, noclose = False):
907
2313
"""See daemon(3). Standard BSD Unix function.
2314
908
2315
This should really exist as os.daemon, but it doesn't (yet)."""
909
2316
if os.fork():
910
2317
sys.exit()
915
2322
sys.exit()
916
2323
if not noclose:
917
2324
# Close all standard open file descriptors
918
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2325
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
919
2326
if not stat.S_ISCHR(os.fstat(null).st_mode):
920
2327
raise OSError(errno.ENODEV,
921
"/dev/null not a character device")
2328
"{} not a character device"
2329
.format(os.devnull))
922
2330
os.dup2(null, sys.stdin.fileno())
923
2331
os.dup2(null, sys.stdout.fileno())
924
2332
os.dup2(null, sys.stderr.fileno())
927
2335
928
2336
929
2337
def main():
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
931
parser.add_option("-i", "--interface", type="string",
932
metavar="IF", help="Bind to interface IF")
933
parser.add_option("-a", "--address", type="string",
934
help="Address to listen for requests on")
935
parser.add_option("-p", "--port", type="int",
936
help="Port number to receive requests on")
937
parser.add_option("--check", action="store_true",
938
help="Run self-test")
939
parser.add_option("--debug", action="store_true",
940
help="Debug mode; run in foreground and log to"
941
" terminal")
942
parser.add_option("--priority", type="string", help="GnuTLS"
943
" priority string (see GnuTLS documentation)")
944
parser.add_option("--servicename", type="string", metavar="NAME",
945
help="Zeroconf service name")
946
parser.add_option("--configdir", type="string",
947
default="/etc/mandos", metavar="DIR",
948
help="Directory to search for configuration"
949
" files")
950
parser.add_option("--no-dbus", action="store_false",
951
dest="use_dbus",
952
help="Do not provide D-Bus system bus"
953
" interface")
954
parser.add_option("--no-ipv6", action="store_false",
955
dest="use_ipv6", help="Do not use IPv6")
956
options = parser.parse_args()[0]
2338
2339
##################################################################
2340
# Parsing of options, both command line and config file
2341
2342
parser = argparse.ArgumentParser()
2343
parser.add_argument("-v", "--version", action="version",
2344
version = "%(prog)s {}".format(version),
2345
help="show version number and exit")
2346
parser.add_argument("-i", "--interface", metavar="IF",
2347
help="Bind to interface IF")
2348
parser.add_argument("-a", "--address",
2349
help="Address to listen for requests on")
2350
parser.add_argument("-p", "--port", type=int,
2351
help="Port number to receive requests on")
2352
parser.add_argument("--check", action="store_true",
2353
help="Run self-test")
2354
parser.add_argument("--debug", action="store_true",
2355
help="Debug mode; run in foreground and log"
2356
" to terminal", default=None)
2357
parser.add_argument("--debuglevel", metavar="LEVEL",
2358
help="Debug level for stdout output")
2359
parser.add_argument("--priority", help="GnuTLS"
2360
" priority string (see GnuTLS documentation)")
2361
parser.add_argument("--servicename",
2362
metavar="NAME", help="Zeroconf service name")
2363
parser.add_argument("--configdir",
2364
default="/etc/mandos", metavar="DIR",
2365
help="Directory to search for configuration"
2366
" files")
2367
parser.add_argument("--no-dbus", action="store_false",
2368
dest="use_dbus", help="Do not provide D-Bus"
2369
" system bus interface", default=None)
2370
parser.add_argument("--no-ipv6", action="store_false",
2371
dest="use_ipv6", help="Do not use IPv6",
2372
default=None)
2373
parser.add_argument("--no-restore", action="store_false",
2374
dest="restore", help="Do not restore stored"
2375
" state", default=None)
2376
parser.add_argument("--socket", type=int,
2377
help="Specify a file descriptor to a network"
2378
" socket to use instead of creating one")
2379
parser.add_argument("--statedir", metavar="DIR",
2380
help="Directory to save/restore state in")
2381
parser.add_argument("--foreground", action="store_true",
2382
help="Run in foreground", default=None)
2383
parser.add_argument("--no-zeroconf", action="store_false",
2384
dest="zeroconf", help="Do not use Zeroconf",
2385
default=None)
2386
2387
options = parser.parse_args()
957
2388
958
2389
if options.check:
959
2390
import doctest
960
doctest.testmod()
961
sys.exit()
2391
fail_count, test_count = doctest.testmod()
2392
sys.exit(os.EX_OK if fail_count == 0 else 1)
962
2393
963
2394
# Default values for config file for server-global settings
964
2395
server_defaults = { "interface": "",
966
2397
"port": "",
967
2398
"debug": "False",
968
2399
"priority":
969
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2400
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2401
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
970
2402
"servicename": "Mandos",
971
2403
"use_dbus": "True",
972
2404
"use_ipv6": "True",
973
}
2405
"debuglevel": "",
2406
"restore": "True",
2407
"socket": "",
2408
"statedir": "/var/lib/mandos",
2409
"foreground": "False",
2410
"zeroconf": "True",
2411
}
974
2412
975
2413
# Parse config file for server-global settings
976
server_config = ConfigParser.SafeConfigParser(server_defaults)
2414
server_config = configparser.SafeConfigParser(server_defaults)
977
2415
del server_defaults
978
2416
server_config.read(os.path.join(options.configdir, "mandos.conf"))
979
2417
# Convert the SafeConfigParser object to a dict
980
2418
server_settings = server_config.defaults()
981
2419
# Use the appropriate methods on the non-string config options
982
server_settings["debug"] = server_config.getboolean("DEFAULT",
983
"debug")
984
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
985
"use_dbus")
986
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
987
"use_ipv6")
2420
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2421
server_settings[option] = server_config.getboolean("DEFAULT",
2422
option)
988
2423
if server_settings["port"]:
989
2424
server_settings["port"] = server_config.getint("DEFAULT",
990
2425
"port")
2426
if server_settings["socket"]:
2427
server_settings["socket"] = server_config.getint("DEFAULT",
2428
"socket")
2429
# Later, stdin will, and stdout and stderr might, be dup'ed
2430
# over with an opened os.devnull. But we don't want this to
2431
# happen with a supplied network socket.
2432
if 0 <= server_settings["socket"] <= 2:
2433
server_settings["socket"] = os.dup(server_settings
2434
["socket"])
991
2435
del server_config
992
2436
993
2437
# Override the settings from the config file with command line
994
2438
# options, if set.
995
2439
for option in ("interface", "address", "port", "debug",
996
"priority", "servicename", "configdir",
997
"use_dbus", "use_ipv6"):
2440
"priority", "servicename", "configdir", "use_dbus",
2441
"use_ipv6", "debuglevel", "restore", "statedir",
2442
"socket", "foreground", "zeroconf"):
998
2443
value = getattr(options, option)
999
2444
if value is not None:
1000
2445
server_settings[option] = value
1001
2446
del options
2447
# Force all strings to be unicode
2448
for option in server_settings.keys():
2449
if isinstance(server_settings[option], bytes):
2450
server_settings[option] = (server_settings[option]
2451
.decode("utf-8"))
2452
# Force all boolean options to be boolean
2453
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2454
"foreground", "zeroconf"):
2455
server_settings[option] = bool(server_settings[option])
2456
# Debug implies foreground
2457
if server_settings["debug"]:
2458
server_settings["foreground"] = True
1002
2459
# Now we have our good server settings in "server_settings"
1003
2460
2461
##################################################################
2462
2463
if (not server_settings["zeroconf"]
2464
and not (server_settings["port"]
2465
or server_settings["socket"] != "")):
2466
parser.error("Needs port or socket to work without Zeroconf")
2467
1004
2468
# For convenience
1005
2469
debug = server_settings["debug"]
2470
debuglevel = server_settings["debuglevel"]
1006
2471
use_dbus = server_settings["use_dbus"]
1007
2472
use_ipv6 = server_settings["use_ipv6"]
2473
stored_state_path = os.path.join(server_settings["statedir"],
2474
stored_state_file)
2475
foreground = server_settings["foreground"]
2476
zeroconf = server_settings["zeroconf"]
1008
2477
1009
if not debug:
1010
syslogger.setLevel(logging.WARNING)
1011
console.setLevel(logging.WARNING)
2478
if debug:
2479
initlogger(debug, logging.DEBUG)
2480
else:
2481
if not debuglevel:
2482
initlogger(debug)
2483
else:
2484
level = getattr(logging, debuglevel.upper())
2485
initlogger(debug, level)
1012
2486
1013
2487
if server_settings["servicename"] != "Mandos":
1014
syslogger.setFormatter(logging.Formatter
1015
('Mandos (%s): %%(levelname)s:'
1016
' %%(message)s'
1017
% server_settings["servicename"]))
2488
syslogger.setFormatter(
2489
logging.Formatter('Mandos ({}) [%(process)d]:'
2490
' %(levelname)s: %(message)s'.format(
2491
server_settings["servicename"])))
1018
2492
1019
2493
# Parse config file with clients
1020
client_defaults = { "timeout": "1h",
1021
"interval": "5m",
1022
"checker": "fping -q -- %%(host)s",
1023
"host": "",
1024
}
1025
client_config = ConfigParser.SafeConfigParser(client_defaults)
2494
client_config = configparser.SafeConfigParser(Client
2495
.client_defaults)
1026
2496
client_config.read(os.path.join(server_settings["configdir"],
1027
2497
"clients.conf"))
1028
2498
1029
clients = Set()
1030
tcp_server = IPv6_TCPServer((server_settings["address"],
1031
server_settings["port"]),
1032
TCP_handler,
1033
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
1035
pidfilename = "/var/run/mandos.pid"
1036
try:
1037
pidfile = open(pidfilename, "w")
1038
except IOError:
1039
logger.error("Could not open file %r", pidfilename)
1040
1041
try:
1042
uid = pwd.getpwnam("_mandos").pw_uid
1043
gid = pwd.getpwnam("_mandos").pw_gid
1044
except KeyError:
1045
try:
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
gid = pwd.getpwnam("mandos").pw_gid
2499
global mandos_dbus_service
2500
mandos_dbus_service = None
2501
2502
socketfd = None
2503
if server_settings["socket"] != "":
2504
socketfd = server_settings["socket"]
2505
tcp_server = MandosServer(
2506
(server_settings["address"], server_settings["port"]),
2507
ClientHandler,
2508
interface=(server_settings["interface"] or None),
2509
use_ipv6=use_ipv6,
2510
gnutls_priority=server_settings["priority"],
2511
use_dbus=use_dbus,
2512
socketfd=socketfd)
2513
if not foreground:
2514
pidfilename = "/run/mandos.pid"
2515
if not os.path.isdir("/run/."):
2516
pidfilename = "/var/run/mandos.pid"
2517
pidfile = None
2518
try:
2519
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2520
except IOError as e:
2521
logger.error("Could not open file %r", pidfilename,
2522
exc_info=e)
2523
2524
for name in ("_mandos", "mandos", "nobody"):
2525
try:
2526
uid = pwd.getpwnam(name).pw_uid
2527
gid = pwd.getpwnam(name).pw_gid
2528
break
1048
2529
except KeyError:
1049
try:
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
gid = pwd.getpwnam("nogroup").pw_gid
1052
except KeyError:
1053
uid = 65534
1054
gid = 65534
2530
continue
2531
else:
2532
uid = 65534
2533
gid = 65534
1055
2534
try:
1056
2535
os.setgid(gid)
1057
2536
os.setuid(uid)
1058
except OSError, error:
1059
if error[0] != errno.EPERM:
1060
raise error
2537
except OSError as error:
2538
if error.errno != errno.EPERM:
2539
raise
1061
2540
1062
# Enable all possible GnuTLS debugging
1063
2541
if debug:
2542
# Enable all possible GnuTLS debugging
2543
1064
2544
# "Use a log level over 10 to enable all debugging options."
1065
2545
# - GnuTLS manual
1066
2546
gnutls.library.functions.gnutls_global_set_log_level(11)
1069
2549
def debug_gnutls(level, string):
1070
2550
logger.debug("GnuTLS: %s", string[:-1])
1071
2551
1072
(gnutls.library.functions
1073
.gnutls_global_set_log_function(debug_gnutls))
1074
1075
global service
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
service = AvahiService(name = server_settings["servicename"],
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
1080
if server_settings["interface"]:
1081
service.interface = (if_nametoindex
1082
(server_settings["interface"]))
2552
gnutls.library.functions.gnutls_global_set_log_function(
2553
debug_gnutls)
2554
2555
# Redirect stdin so all checkers get /dev/null
2556
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2557
os.dup2(null, sys.stdin.fileno())
2558
if null > 2:
2559
os.close(null)
2560
2561
# Need to fork before connecting to D-Bus
2562
if not foreground:
2563
# Close all input and output, do double fork, etc.
2564
daemon()
2565
2566
# multiprocessing will use threads, so before we use gobject we
2567
# need to inform gobject that threads will be used.
2568
gobject.threads_init()
1083
2569
1084
2570
global main_loop
1085
global bus
1086
global server
1087
2571
# From the Avahi example code
1088
DBusGMainLoop(set_as_default=True )
2572
DBusGMainLoop(set_as_default=True)
1089
2573
main_loop = gobject.MainLoop()
1090
2574
bus = dbus.SystemBus()
1091
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1092
avahi.DBUS_PATH_SERVER),
1093
avahi.DBUS_INTERFACE_SERVER)
1094
2575
# End of Avahi example code
1095
2576
if use_dbus:
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1097
1098
clients.update(Set(Client(name = section,
1099
config
1100
= dict(client_config.items(section)),
1101
use_dbus = use_dbus)
1102
for section in client_config.sections()))
1103
if not clients:
1104
logger.warning(u"No clients defined")
1105
1106
if debug:
1107
# Redirect stdin so all checkers get /dev/null
1108
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1109
os.dup2(null, sys.stdin.fileno())
1110
if null > 2:
1111
os.close(null)
1112
else:
1113
# No console logging
1114
logger.removeHandler(console)
1115
# Close all input and output, do double fork, etc.
1116
daemon()
1117
1118
try:
1119
pid = os.getpid()
1120
pidfile.write(str(pid) + "\n")
1121
pidfile.close()
2577
try:
2578
bus_name = dbus.service.BusName("se.recompile.Mandos",
2579
bus,
2580
do_not_queue=True)
2581
old_bus_name = dbus.service.BusName(
2582
"se.bsnet.fukt.Mandos", bus,
2583
do_not_queue=True)
2584
except dbus.exceptions.DBusException as e:
2585
logger.error("Disabling D-Bus:", exc_info=e)
2586
use_dbus = False
2587
server_settings["use_dbus"] = False
2588
tcp_server.use_dbus = False
2589
if zeroconf:
2590
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2591
service = AvahiServiceToSyslog(
2592
name = server_settings["servicename"],
2593
servicetype = "_mandos._tcp",
2594
protocol = protocol,
2595
bus = bus)
2596
if server_settings["interface"]:
2597
service.interface = if_nametoindex(
2598
server_settings["interface"].encode("utf-8"))
2599
2600
global multiprocessing_manager
2601
multiprocessing_manager = multiprocessing.Manager()
2602
2603
client_class = Client
2604
if use_dbus:
2605
client_class = functools.partial(ClientDBus, bus = bus)
2606
2607
client_settings = Client.config_parser(client_config)
2608
old_client_settings = {}
2609
clients_data = {}
2610
2611
# This is used to redirect stdout and stderr for checker processes
2612
global wnull
2613
wnull = open(os.devnull, "w") # A writable /dev/null
2614
# Only used if server is running in foreground but not in debug
2615
# mode
2616
if debug or not foreground:
2617
wnull.close()
2618
2619
# Get client data and settings from last running state.
2620
if server_settings["restore"]:
2621
try:
2622
with open(stored_state_path, "rb") as stored_state:
2623
clients_data, old_client_settings = pickle.load(
2624
stored_state)
2625
os.remove(stored_state_path)
2626
except IOError as e:
2627
if e.errno == errno.ENOENT:
2628
logger.warning("Could not load persistent state:"
2629
" {}".format(os.strerror(e.errno)))
2630
else:
2631
logger.critical("Could not load persistent state:",
2632
exc_info=e)
2633
raise
2634
except EOFError as e:
2635
logger.warning("Could not load persistent state: "
2636
"EOFError:",
2637
exc_info=e)
2638
2639
with PGPEngine() as pgp:
2640
for client_name, client in clients_data.items():
2641
# Skip removed clients
2642
if client_name not in client_settings:
2643
continue
2644
2645
# Decide which value to use after restoring saved state.
2646
# We have three different values: Old config file,
2647
# new config file, and saved state.
2648
# New config value takes precedence if it differs from old
2649
# config value, otherwise use saved state.
2650
for name, value in client_settings[client_name].items():
2651
try:
2652
# For each value in new config, check if it
2653
# differs from the old config value (Except for
2654
# the "secret" attribute)
2655
if (name != "secret"
2656
and (value !=
2657
old_client_settings[client_name][name])):
2658
client[name] = value
2659
except KeyError:
2660
pass
2661
2662
# Clients who has passed its expire date can still be
2663
# enabled if its last checker was successful. Clients
2664
# whose checker succeeded before we stored its state is
2665
# assumed to have successfully run all checkers during
2666
# downtime.
2667
if client["enabled"]:
2668
if datetime.datetime.utcnow() >= client["expires"]:
2669
if not client["last_checked_ok"]:
2670
logger.warning(
2671
"disabling client {} - Client never "
2672
"performed a successful checker".format(
2673
client_name))
2674
client["enabled"] = False
2675
elif client["last_checker_status"] != 0:
2676
logger.warning(
2677
"disabling client {} - Client last"
2678
" checker failed with error code"
2679
" {}".format(
2680
client_name,
2681
client["last_checker_status"]))
2682
client["enabled"] = False
2683
else:
2684
client["expires"] = (
2685
datetime.datetime.utcnow()
2686
+ client["timeout"])
2687
logger.debug("Last checker succeeded,"
2688
" keeping {} enabled".format(
2689
client_name))
2690
try:
2691
client["secret"] = pgp.decrypt(
2692
client["encrypted_secret"],
2693
client_settings[client_name]["secret"])
2694
except PGPError:
2695
# If decryption fails, we use secret from new settings
2696
logger.debug("Failed to decrypt {} old secret".format(
2697
client_name))
2698
client["secret"] = (client_settings[client_name]
2699
["secret"])
2700
2701
# Add/remove clients based on new changes made to config
2702
for client_name in (set(old_client_settings)
2703
- set(client_settings)):
2704
del clients_data[client_name]
2705
for client_name in (set(client_settings)
2706
- set(old_client_settings)):
2707
clients_data[client_name] = client_settings[client_name]
2708
2709
# Create all client objects
2710
for client_name, client in clients_data.items():
2711
tcp_server.clients[client_name] = client_class(
2712
name = client_name,
2713
settings = client,
2714
server_settings = server_settings)
2715
2716
if not tcp_server.clients:
2717
logger.warning("No clients defined")
2718
2719
if not foreground:
2720
if pidfile is not None:
2721
pid = os.getpid()
2722
try:
2723
with pidfile:
2724
print(pid, file=pidfile)
2725
except IOError:
2726
logger.error("Could not write to file %r with PID %d",
2727
pidfilename, pid)
1122
2728
del pidfile
1123
except IOError:
1124
logger.error(u"Could not write to file %r with PID %d",
1125
pidfilename, pid)
1126
except NameError:
1127
# "pidfile" was never created
1128
pass
1129
del pidfilename
1130
1131
def cleanup():
1132
"Cleanup function; run on exit"
1133
global group
1134
# From the Avahi example code
1135
if not group is None:
1136
group.Free()
1137
group = None
1138
# End of Avahi example code
1139
1140
while clients:
1141
client = clients.pop()
1142
client.disable_hook = None
1143
client.disable()
1144
1145
atexit.register(cleanup)
1146
1147
if not debug:
1148
signal.signal(signal.SIGINT, signal.SIG_IGN)
2729
del pidfilename
2730
1149
2731
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1150
2732
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1151
2733
1152
2734
if use_dbus:
1153
class MandosServer(dbus.service.Object):
2735
2736
@alternate_dbus_interfaces(
2737
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2738
class MandosDBusService(DBusObjectWithProperties):
1154
2739
"""A D-Bus proxy object"""
2740
1155
2741
def __init__(self):
1156
2742
dbus.service.Object.__init__(self, bus, "/")
1157
_interface = u"se.bsnet.fukt.Mandos"
1158
1159
@dbus.service.signal(_interface, signature="oa{sv}")
1160
def ClientAdded(self, objpath, properties):
2743
2744
_interface = "se.recompile.Mandos"
2745
2746
@dbus_interface_annotations(_interface)
2747
def _foo(self):
2748
return {
2749
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2750
"false" }
2751
2752
@dbus.service.signal(_interface, signature="o")
2753
def ClientAdded(self, objpath):
2754
"D-Bus signal"
2755
pass
2756
2757
@dbus.service.signal(_interface, signature="ss")
2758
def ClientNotFound(self, fingerprint, address):
1161
2759
"D-Bus signal"
1162
2760
pass
1163
2761
1169
2767
@dbus.service.method(_interface, out_signature="ao")
1170
2768
def GetAllClients(self):
1171
2769
"D-Bus method"
1172
return dbus.Array(c.dbus_object_path for c in clients)
2770
return dbus.Array(c.dbus_object_path for c in
2771
tcp_server.clients.itervalues())
1173
2772
1174
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
2773
@dbus.service.method(_interface,
2774
out_signature="a{oa{sv}}")
1175
2775
def GetAllClientsWithProperties(self):
1176
2776
"D-Bus method"
1177
2777
return dbus.Dictionary(
1178
((c.dbus_object_path, c.GetAllProperties())
1179
for c in clients),
2778
{ c.dbus_object_path: c.GetAll("")
2779
for c in tcp_server.clients.itervalues() },
1180
2780
signature="oa{sv}")
1181
2781
1182
2782
@dbus.service.method(_interface, in_signature="o")
1183
2783
def RemoveClient(self, object_path):
1184
2784
"D-Bus method"
1185
for c in clients:
2785
for c in tcp_server.clients.itervalues():
1186
2786
if c.dbus_object_path == object_path:
1187
clients.remove(c)
2787
del tcp_server.clients[c.name]
2788
c.remove_from_connection()
1188
2789
# Don't signal anything except ClientRemoved
1189
c.use_dbus = False
1190
c.disable()
2790
c.disable(quiet=True)
1191
2791
# Emit D-Bus signal
1192
2792
self.ClientRemoved(object_path, c.name)
1193
2793
return
1194
raise KeyError
2794
raise KeyError(object_path)
1195
2795
1196
2796
del _interface
1197
2797
1198
mandos_server = MandosServer()
1199
1200
for client in clients:
2798
mandos_dbus_service = MandosDBusService()
2799
2800
def cleanup():
2801
"Cleanup function; run on exit"
2802
if zeroconf:
2803
service.cleanup()
2804
2805
multiprocessing.active_children()
2806
wnull.close()
2807
if not (tcp_server.clients or client_settings):
2808
return
2809
2810
# Store client before exiting. Secrets are encrypted with key
2811
# based on what config file has. If config file is
2812
# removed/edited, old secret will thus be unrecovable.
2813
clients = {}
2814
with PGPEngine() as pgp:
2815
for client in tcp_server.clients.itervalues():
2816
key = client_settings[client.name]["secret"]
2817
client.encrypted_secret = pgp.encrypt(client.secret,
2818
key)
2819
client_dict = {}
2820
2821
# A list of attributes that can not be pickled
2822
# + secret.
2823
exclude = { "bus", "changedstate", "secret",
2824
"checker", "server_settings" }
2825
for name, typ in inspect.getmembers(dbus.service
2826
.Object):
2827
exclude.add(name)
2828
2829
client_dict["encrypted_secret"] = (client
2830
.encrypted_secret)
2831
for attr in client.client_structure:
2832
if attr not in exclude:
2833
client_dict[attr] = getattr(client, attr)
2834
2835
clients[client.name] = client_dict
2836
del client_settings[client.name]["secret"]
2837
2838
try:
2839
with tempfile.NamedTemporaryFile(
2840
mode='wb',
2841
suffix=".pickle",
2842
prefix='clients-',
2843
dir=os.path.dirname(stored_state_path),
2844
delete=False) as stored_state:
2845
pickle.dump((clients, client_settings), stored_state)
2846
tempname = stored_state.name
2847
os.rename(tempname, stored_state_path)
2848
except (IOError, OSError) as e:
2849
if not debug:
2850
try:
2851
os.remove(tempname)
2852
except NameError:
2853
pass
2854
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2855
logger.warning("Could not save persistent state: {}"
2856
.format(os.strerror(e.errno)))
2857
else:
2858
logger.warning("Could not save persistent state:",
2859
exc_info=e)
2860
raise
2861
2862
# Delete all clients, and settings from config
2863
while tcp_server.clients:
2864
name, client = tcp_server.clients.popitem()
2865
if use_dbus:
2866
client.remove_from_connection()
2867
# Don't signal anything except ClientRemoved
2868
client.disable(quiet=True)
2869
if use_dbus:
2870
# Emit D-Bus signal
2871
mandos_dbus_service.ClientRemoved(
2872
client.dbus_object_path, client.name)
2873
client_settings.clear()
2874
2875
atexit.register(cleanup)
2876
2877
for client in tcp_server.clients.itervalues():
1201
2878
if use_dbus:
1202
2879
# Emit D-Bus signal
1203
mandos_server.ClientAdded(client.dbus_object_path,
1204
client.GetAllProperties())
1205
client.enable()
2880
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2881
# Need to initiate checking of clients
2882
if client.enabled:
2883
client.init_checker()
1206
2884
1207
2885
tcp_server.enable()
1208
2886
tcp_server.server_activate()
1209
2887
1210
2888
# Find out what port we got
1211
service.port = tcp_server.socket.getsockname()[1]
2889
if zeroconf:
2890
service.port = tcp_server.socket.getsockname()[1]
1212
2891
if use_ipv6:
1213
logger.info(u"Now listening on address %r, port %d,"
1214
" flowinfo %d, scope_id %d"
1215
% tcp_server.socket.getsockname())
2892
logger.info("Now listening on address %r, port %d,"
2893
" flowinfo %d, scope_id %d",
2894
*tcp_server.socket.getsockname())
1216
2895
else: # IPv4
1217
logger.info(u"Now listening on address %r, port %d"
1218
% tcp_server.socket.getsockname())
2896
logger.info("Now listening on address %r, port %d",
2897
*tcp_server.socket.getsockname())
1219
2898
1220
2899
#service.interface = tcp_server.socket.getsockname()[3]
1221
2900
1222
2901
try:
1223
# From the Avahi example code
1224
server.connect_to_signal("StateChanged", server_state_changed)
1225
try:
1226
server_state_changed(server.GetState())
1227
except dbus.exceptions.DBusException, error:
1228
logger.critical(u"DBusException: %s", error)
1229
sys.exit(1)
1230
# End of Avahi example code
2902
if zeroconf:
2903
# From the Avahi example code
2904
try:
2905
service.activate()
2906
except dbus.exceptions.DBusException as error:
2907
logger.critical("D-Bus Exception", exc_info=error)
2908
cleanup()
2909
sys.exit(1)
2910
# End of Avahi example code
1231
2911
1232
2912
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1233
2913
lambda *args, **kwargs:
1234
2914
(tcp_server.handle_request
1235
2915
(*args[2:], **kwargs) or True))
1236
2916
1237
logger.debug(u"Starting main loop")
2917
logger.debug("Starting main loop")
1238
2918
main_loop.run()
1239
except AvahiError, error:
1240
logger.critical(u"AvahiError: %s", error)
2919
except AvahiError as error:
2920
logger.critical("Avahi Error", exc_info=error)
2921
cleanup()
1241
2922
sys.exit(1)
1242
2923
except KeyboardInterrupt:
1243
2924
if debug:
1244
print >> sys.stderr
2925
print("", file=sys.stderr)
1245
2926
logger.debug("Server received KeyboardInterrupt")
1246
2927
logger.debug("Server exiting")
2928
# Must run before the D-Bus bus name gets deregistered
2929
cleanup()
2930
1247
2931
1248
2932
if __name__ == '__main__':
1249
2933
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0