To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 755
- compare with another revision
- download diff
- download tarball
- view history from revision 755
- Committer: Teddy Hogeborn
- Date: 2015-05-31 19:05:32 UTC
- Revision ID: teddy@recompile.se-20150531190532-pfc7mega72dzzzka
mandos: More Python 3 fixes.
mandos (MandosServer/handle_ipc): Do not use callable().
mandos (MandosServer/handle_ipc): Do not use callable().
- files modified:
- TODO
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
69
78
import tempfile
70
79
import itertools
71
80
import collections
81
import codecs
72
82
73
83
import dbus
74
84
import dbus.service
75
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
76
89
import avahi
77
90
from dbus.mainloop.glib import DBusGMainLoop
78
91
import ctypes
98
111
syslogger = None
99
112
100
113
try:
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
104
116
except (OSError, AttributeError):
117
105
118
def if_nametoindex(interface):
106
119
"Get an interface index the hard way, i.e. using fcntl()"
107
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
116
129
"""init logger and add loglevel"""
117
130
118
131
global syslogger
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
123
135
syslogger.setFormatter(logging.Formatter
124
136
('Mandos [%(process)d]: %(levelname)s:'
125
137
' %(message)s'))
142
154
143
155
class PGPEngine(object):
144
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
145
158
def __init__(self):
146
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
147
160
self.gnupgargs = ['--batch',
186
199
187
200
def encrypt(self, data, password):
188
201
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
191
204
passfile.write(passphrase)
192
205
passfile.flush()
193
206
proc = subprocess.Popen(['gpg', '--symmetric',
204
217
205
218
def decrypt(self, data, password):
206
219
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
209
222
passfile.write(passphrase)
210
223
passfile.flush()
211
224
proc = subprocess.Popen(['gpg', '--decrypt',
215
228
stdin = subprocess.PIPE,
216
229
stdout = subprocess.PIPE,
217
230
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
231
decrypted_plaintext, err = proc.communicate(input = data)
220
232
if proc.returncode != 0:
221
233
raise PGPError(err)
222
234
return decrypted_plaintext
228
240
return super(AvahiError, self).__init__(value, *args,
229
241
**kwargs)
230
242
243
231
244
class AvahiServiceError(AvahiError):
232
245
pass
233
246
247
234
248
class AvahiGroupError(AvahiError):
235
249
pass
236
250
256
270
bus: dbus.SystemBus()
257
271
"""
258
272
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
263
284
self.interface = interface
264
285
self.name = name
265
286
self.type = servicetype
282
303
" after %i retries, exiting.",
283
304
self.rename_count)
284
305
raise AvahiServiceError("Too many renames")
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
287
308
self.rename_count += 1
288
309
logger.info("Changing Zeroconf service name to %r ...",
289
310
self.name)
344
365
elif state == avahi.ENTRY_GROUP_FAILURE:
345
366
logger.critical("Avahi: Error in group state changed %s",
346
367
str(error))
347
raise AvahiGroupError("State changed: {!s}"
348
.format(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
349
369
350
370
def cleanup(self):
351
371
"""Derived from the Avahi example code"""
361
381
def server_state_changed(self, state, error=None):
362
382
"""Derived from the Avahi example code"""
363
383
logger.debug("Avahi server state change: %i", state)
364
bad_states = { avahi.SERVER_INVALID:
365
"Zeroconf server invalid",
366
avahi.SERVER_REGISTERING: None,
367
avahi.SERVER_COLLISION:
368
"Zeroconf server name collision",
369
avahi.SERVER_FAILURE:
370
"Zeroconf server failure" }
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
371
390
if state in bad_states:
372
391
if bad_states[state] is not None:
373
392
if error is None:
392
411
follow_name_owner_changes=True),
393
412
avahi.DBUS_INTERFACE_SERVER)
394
413
self.server.connect_to_signal("StateChanged",
395
self.server_state_changed)
414
self.server_state_changed)
396
415
self.server_state_changed(self.server.GetState())
397
416
398
417
400
419
def rename(self, *args, **kwargs):
401
420
"""Add the new name to the syslog messages"""
402
421
ret = AvahiService.rename(self, *args, **kwargs)
403
syslogger.setFormatter(logging.Formatter
404
('Mandos ({}) [%(process)d]:'
405
' %(levelname)s: %(message)s'
406
.format(self.name)))
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
.format(self.name)))
407
425
return ret
408
426
409
427
456
474
"fingerprint", "host", "interval",
457
475
"last_approval_request", "last_checked_ok",
458
476
"last_enabled", "name", "timeout")
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
477
client_defaults = {
478
"timeout": "PT5M",
479
"extended_timeout": "PT15M",
480
"interval": "PT2M",
481
"checker": "fping -q -- %%(host)s",
482
"host": "",
483
"approval_delay": "PT0S",
484
"approval_duration": "PT1S",
485
"approved_by_default": "True",
486
"enabled": "True",
487
}
469
488
470
489
@staticmethod
471
490
def config_parser(config):
549
568
self.current_checker_command = None
550
569
self.approved = None
551
570
self.approvals_pending = 0
552
self.changedstate = (multiprocessing_manager
553
.Condition(multiprocessing_manager
554
.Lock()))
555
self.client_structure = [attr for attr in
556
self.__dict__.iterkeys()
571
self.changedstate = multiprocessing_manager.Condition(
572
multiprocessing_manager.Lock())
573
self.client_structure = [attr
574
for attr in self.__dict__.iterkeys()
557
575
if not attr.startswith("_")]
558
576
self.client_structure.append("client_structure")
559
577
560
for name, t in inspect.getmembers(type(self),
561
lambda obj:
562
isinstance(obj,
563
property)):
578
for name, t in inspect.getmembers(
579
type(self), lambda obj: isinstance(obj, property)):
564
580
if not name.startswith("_"):
565
581
self.client_structure.append(name)
566
582
608
624
# and every interval from then on.
609
625
if self.checker_initiator_tag is not None:
610
626
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = (gobject.timeout_add
612
(int(self.interval
613
.total_seconds() * 1000),
614
self.start_checker))
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
629
self.start_checker)
615
630
# Schedule a disable() when 'timeout' has passed
616
631
if self.disable_initiator_tag is not None:
617
632
gobject.source_remove(self.disable_initiator_tag)
618
self.disable_initiator_tag = (gobject.timeout_add
619
(int(self.timeout
620
.total_seconds() * 1000),
621
self.disable))
633
self.disable_initiator_tag = gobject.timeout_add(
634
int(self.timeout.total_seconds() * 1000), self.disable)
622
635
# Also start a new checker *right now*.
623
636
self.start_checker()
624
637
633
646
vars(self))
634
647
self.checked_ok()
635
648
else:
636
logger.info("Checker for %(name)s failed",
637
vars(self))
649
logger.info("Checker for %(name)s failed", vars(self))
638
650
else:
639
651
self.last_checker_status = -1
640
652
logger.warning("Checker for %(name)s crashed?",
654
666
gobject.source_remove(self.disable_initiator_tag)
655
667
self.disable_initiator_tag = None
656
668
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(int(timeout.total_seconds()
659
* 1000), self.disable))
669
self.disable_initiator_tag = gobject.timeout_add(
670
int(timeout.total_seconds() * 1000), self.disable)
660
671
self.expires = datetime.datetime.utcnow() + timeout
661
672
662
673
def need_approval(self):
693
704
# Start a new checker if needed
694
705
if self.checker is None:
695
706
# Escape attributes for the shell
696
escaped_attrs = { attr:
697
re.escape(str(getattr(self, attr)))
698
for attr in self.runtime_expansions }
707
escaped_attrs = {
708
attr: re.escape(str(getattr(self, attr)))
709
for attr in self.runtime_expansions }
699
710
try:
700
711
command = self.checker_command % escaped_attrs
701
712
except TypeError as error:
702
713
logger.error('Could not format string "%s"',
703
self.checker_command, exc_info=error)
704
return True # Try again later
714
self.checker_command,
715
exc_info=error)
716
return True # Try again later
705
717
self.current_checker_command = command
706
718
try:
707
logger.info("Starting checker %r for %s",
708
command, self.name)
719
logger.info("Starting checker %r for %s", command,
720
self.name)
709
721
# We don't need to redirect stdout and stderr, since
710
722
# in normal mode, that is already done by daemon(),
711
723
# and in debug mode we don't want to. (Stdin is
720
732
"stderr": wnull })
721
733
self.checker = subprocess.Popen(command,
722
734
close_fds=True,
723
shell=True, cwd="/",
735
shell=True,
736
cwd="/",
724
737
**popen_args)
725
738
except OSError as error:
726
739
logger.error("Failed to start subprocess",
727
740
exc_info=error)
728
741
return True
729
self.checker_callback_tag = (gobject.child_watch_add
730
(self.checker.pid,
731
self.checker_callback,
732
data=command))
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
733
744
# The checker may have completed before the gobject
734
745
# watch was added. Check for this.
735
746
try:
766
777
self.checker = None
767
778
768
779
769
def dbus_service_property(dbus_interface, signature="v",
770
access="readwrite", byte_arrays=False):
780
def dbus_service_property(dbus_interface,
781
signature="v",
782
access="readwrite",
783
byte_arrays=False):
771
784
"""Decorators for marking methods of a DBusObjectWithProperties to
772
785
become properties on the D-Bus.
773
786
783
796
if byte_arrays and signature != "ay":
784
797
raise ValueError("Byte arrays not supported for non-'ay'"
785
798
" signature {!r}".format(signature))
799
786
800
def decorator(func):
787
801
func._dbus_is_property = True
788
802
func._dbus_interface = dbus_interface
793
807
func._dbus_name = func._dbus_name[:-14]
794
808
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
795
809
return func
810
796
811
return decorator
797
812
798
813
807
822
"org.freedesktop.DBus.Property.EmitsChangedSignal":
808
823
"false"}
809
824
"""
825
810
826
def decorator(func):
811
827
func._dbus_is_interface = True
812
828
func._dbus_interface = dbus_interface
813
829
func._dbus_name = dbus_interface
814
830
return func
831
815
832
return decorator
816
833
817
834
827
844
def Property_dbus_property(self):
828
845
return dbus.Boolean(False)
829
846
"""
847
830
848
def decorator(func):
831
849
func._dbus_annotations = annotations
832
850
return func
851
833
852
return decorator
834
853
835
854
838
857
"""
839
858
pass
840
859
860
841
861
class DBusPropertyAccessException(DBusPropertyException):
842
862
"""A property's access permissions disallows an operation.
843
863
"""
871
891
def _get_all_dbus_things(self, thing):
872
892
"""Returns a generator of (name, attribute) pairs
873
893
"""
874
return ((getattr(athing.__get__(self), "_dbus_name",
875
name),
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
876
895
athing.__get__(self))
877
896
for cls in self.__class__.__mro__
878
897
for name, athing in
879
inspect.getmembers(cls,
880
self._is_dbus_thing(thing)))
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
881
899
882
900
def _get_dbus_property(self, interface_name, property_name):
883
901
"""Returns a bound method if one exists which is a D-Bus
884
902
property with the specified name and interface.
885
903
"""
886
for cls in self.__class__.__mro__:
887
for name, value in (inspect.getmembers
888
(cls,
889
self._is_dbus_thing("property"))):
904
for cls in self.__class__.__mro__:
905
for name, value in inspect.getmembers(
906
cls, self._is_dbus_thing("property")):
890
907
if (value._dbus_name == property_name
891
908
and value._dbus_interface == interface_name):
892
909
return value.__get__(self)
893
910
894
911
# No such property
895
raise DBusPropertyNotFound(self.dbus_object_path + ":"
896
+ interface_name + "."
897
+ property_name)
912
raise DBusPropertyNotFound("{}:{}.{}".format(
913
self.dbus_object_path, interface_name, property_name))
898
914
899
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
916
in_signature="ss",
900
917
out_signature="v")
901
918
def Get(self, interface_name, property_name):
902
919
"""Standard D-Bus property Get() method, see D-Bus standard.
927
944
for byte in value))
928
945
prop(value)
929
946
930
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
947
@dbus.service.method(dbus.PROPERTIES_IFACE,
948
in_signature="s",
931
949
out_signature="a{sv}")
932
950
def GetAll(self, interface_name):
933
951
"""Standard D-Bus property GetAll() method, see D-Bus
948
966
if not hasattr(value, "variant_level"):
949
967
properties[name] = value
950
968
continue
951
properties[name] = type(value)(value, variant_level=
952
value.variant_level+1)
969
properties[name] = type(value)(
970
value, variant_level = value.variant_level + 1)
953
971
return dbus.Dictionary(properties, signature="sv")
954
972
955
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
991
connection)
974
992
try:
975
993
document = xml.dom.minidom.parseString(xmlstring)
994
976
995
def make_tag(document, name, prop):
977
996
e = document.createElement("property")
978
997
e.setAttribute("name", name)
979
998
e.setAttribute("type", prop._dbus_signature)
980
999
e.setAttribute("access", prop._dbus_access)
981
1000
return e
1001
982
1002
for if_tag in document.getElementsByTagName("interface"):
983
1003
# Add property tags
984
1004
for tag in (make_tag(document, name, prop)
996
1016
if (name == tag.getAttribute("name")
997
1017
and prop._dbus_interface
998
1018
== if_tag.getAttribute("name")):
999
annots.update(getattr
1000
(prop,
1001
"_dbus_annotations",
1002
{}))
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1003
1021
for name, value in annots.items():
1004
1022
ann_tag = document.createElement(
1005
1023
"annotation")
1010
1028
for annotation, value in dict(
1011
1029
itertools.chain.from_iterable(
1012
1030
annotations().items()
1013
for name, annotations in
1014
self._get_all_dbus_things("interface")
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1015
1033
if name == if_tag.getAttribute("name")
1016
1034
)).items():
1017
1035
ann_tag = document.createElement("annotation")
1046
1064
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1047
1065
if dt is None:
1048
1066
return dbus.String("", variant_level = variant_level)
1049
return dbus.String(dt.isoformat(),
1050
variant_level=variant_level)
1067
return dbus.String(dt.isoformat(), variant_level=variant_level)
1051
1068
1052
1069
1053
1070
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1073
1090
(from DBusObjectWithProperties) and interfaces (from the
1074
1091
dbus_interface_annotations decorator).
1075
1092
"""
1093
1076
1094
def wrapper(cls):
1077
1095
for orig_interface_name, alt_interface_name in (
1078
alt_interface_names.items()):
1096
alt_interface_names.items()):
1079
1097
attr = {}
1080
1098
interface_names = set()
1081
1099
# Go though all attributes of the class
1083
1101
# Ignore non-D-Bus attributes, and D-Bus attributes
1084
1102
# with the wrong interface name
1085
1103
if (not hasattr(attribute, "_dbus_interface")
1086
or not attribute._dbus_interface
1087
.startswith(orig_interface_name)):
1104
or not attribute._dbus_interface.startswith(
1105
orig_interface_name)):
1088
1106
continue
1089
1107
# Create an alternate D-Bus interface name based on
1090
1108
# the current name
1091
alt_interface = (attribute._dbus_interface
1092
.replace(orig_interface_name,
1093
alt_interface_name))
1109
alt_interface = attribute._dbus_interface.replace(
1110
orig_interface_name, alt_interface_name)
1094
1111
interface_names.add(alt_interface)
1095
1112
# Is this a D-Bus signal?
1096
1113
if getattr(attribute, "_dbus_is_signal", False):
1097
# Extract the original non-method undecorated
1098
# function by black magic
1099
nonmethod_func = (dict(
1114
if sys.version == 2:
1115
# Extract the original non-method undecorated
1116
# function by black magic
1117
nonmethod_func = (dict(
1100
1118
zip(attribute.func_code.co_freevars,
1101
attribute.__closure__))["func"]
1102
.cell_contents)
1119
attribute.__closure__))
1120
["func"].cell_contents)
1121
else:
1122
nonmethod_func = attribute
1103
1123
# Create a new, but exactly alike, function
1104
1124
# object, and decorate it to be a new D-Bus signal
1105
1125
# with the alternate D-Bus interface name
1106
new_function = (dbus.service.signal
1107
(alt_interface,
1108
attribute._dbus_signature)
1109
(types.FunctionType(
1110
nonmethod_func.func_code,
1111
nonmethod_func.func_globals,
1112
nonmethod_func.func_name,
1113
nonmethod_func.func_defaults,
1114
nonmethod_func.func_closure)))
1126
if sys.version == 2:
1127
new_function = types.FunctionType(
1128
nonmethod_func.func_code,
1129
nonmethod_func.func_globals,
1130
nonmethod_func.func_name,
1131
nonmethod_func.func_defaults,
1132
nonmethod_func.func_closure)
1133
else:
1134
new_function = types.FunctionType(
1135
nonmethod_func.__code__,
1136
nonmethod_func.__globals__,
1137
nonmethod_func.__name__,
1138
nonmethod_func.__defaults__,
1139
nonmethod_func.__closure__)
1140
new_function = (dbus.service.signal(
1141
alt_interface,
1142
attribute._dbus_signature)(new_function))
1115
1143
# Copy annotations, if any
1116
1144
try:
1117
new_function._dbus_annotations = (
1118
dict(attribute._dbus_annotations))
1145
new_function._dbus_annotations = dict(
1146
attribute._dbus_annotations)
1119
1147
except AttributeError:
1120
1148
pass
1121
1149
# Define a creator of a function to call both the
1126
1154
"""This function is a scope container to pass
1127
1155
func1 and func2 to the "call_both" function
1128
1156
outside of its arguments"""
1157
1129
1158
def call_both(*args, **kwargs):
1130
1159
"""This function will emit two D-Bus
1131
1160
signals by calling func1 and func2"""
1132
1161
func1(*args, **kwargs)
1133
1162
func2(*args, **kwargs)
1163
1134
1164
return call_both
1135
1165
# Create the "call_both" function and add it to
1136
1166
# the class
1141
1171
# object. Decorate it to be a new D-Bus method
1142
1172
# with the alternate D-Bus interface name. Add it
1143
1173
# to the class.
1144
attr[attrname] = (dbus.service.method
1145
(alt_interface,
1146
attribute._dbus_in_signature,
1147
attribute._dbus_out_signature)
1148
(types.FunctionType
1149
(attribute.func_code,
1150
attribute.func_globals,
1151
attribute.func_name,
1152
attribute.func_defaults,
1153
attribute.func_closure)))
1174
attr[attrname] = (
1175
dbus.service.method(
1176
alt_interface,
1177
attribute._dbus_in_signature,
1178
attribute._dbus_out_signature)
1179
(types.FunctionType(attribute.func_code,
1180
attribute.func_globals,
1181
attribute.func_name,
1182
attribute.func_defaults,
1183
attribute.func_closure)))
1154
1184
# Copy annotations, if any
1155
1185
try:
1156
attr[attrname]._dbus_annotations = (
1157
dict(attribute._dbus_annotations))
1186
attr[attrname]._dbus_annotations = dict(
1187
attribute._dbus_annotations)
1158
1188
except AttributeError:
1159
1189
pass
1160
1190
# Is this a D-Bus property?
1163
1193
# object, and decorate it to be a new D-Bus
1164
1194
# property with the alternate D-Bus interface
1165
1195
# name. Add it to the class.
1166
attr[attrname] = (dbus_service_property
1167
(alt_interface,
1168
attribute._dbus_signature,
1169
attribute._dbus_access,
1170
attribute
1171
._dbus_get_args_options
1172
["byte_arrays"])
1173
(types.FunctionType
1174
(attribute.func_code,
1175
attribute.func_globals,
1176
attribute.func_name,
1177
attribute.func_defaults,
1178
attribute.func_closure)))
1196
attr[attrname] = (dbus_service_property(
1197
alt_interface, attribute._dbus_signature,
1198
attribute._dbus_access,
1199
attribute._dbus_get_args_options
1200
["byte_arrays"])
1201
(types.FunctionType(
1202
attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1179
1207
# Copy annotations, if any
1180
1208
try:
1181
attr[attrname]._dbus_annotations = (
1182
dict(attribute._dbus_annotations))
1209
attr[attrname]._dbus_annotations = dict(
1210
attribute._dbus_annotations)
1183
1211
except AttributeError:
1184
1212
pass
1185
1213
# Is this a D-Bus interface?
1188
1216
# object. Decorate it to be a new D-Bus interface
1189
1217
# with the alternate D-Bus interface name. Add it
1190
1218
# to the class.
1191
attr[attrname] = (dbus_interface_annotations
1192
(alt_interface)
1193
(types.FunctionType
1194
(attribute.func_code,
1195
attribute.func_globals,
1196
attribute.func_name,
1197
attribute.func_defaults,
1198
attribute.func_closure)))
1219
attr[attrname] = (
1220
dbus_interface_annotations(alt_interface)
1221
(types.FunctionType(attribute.func_code,
1222
attribute.func_globals,
1223
attribute.func_name,
1224
attribute.func_defaults,
1225
attribute.func_closure)))
1199
1226
if deprecate:
1200
1227
# Deprecate all alternate interfaces
1201
1228
iname="_AlternateDBusNames_interface_annotation{}"
1202
1229
for interface_name in interface_names:
1230
1203
1231
@dbus_interface_annotations(interface_name)
1204
1232
def func(self):
1205
1233
return { "org.freedesktop.DBus.Deprecated":
1206
"true" }
1234
"true" }
1207
1235
# Find an unused name
1208
1236
for aname in (iname.format(i)
1209
1237
for i in itertools.count()):
1214
1242
# Replace the class with a new subclass of it with
1215
1243
# methods, signals, etc. as created above.
1216
1244
cls = type(b"{}Alternate".format(cls.__name__),
1217
(cls,), attr)
1245
(cls, ), attr)
1218
1246
return cls
1247
1219
1248
return wrapper
1220
1249
1221
1250
1222
1251
@alternate_dbus_interfaces({"se.recompile.Mandos":
1223
"se.bsnet.fukt.Mandos"})
1252
"se.bsnet.fukt.Mandos"})
1224
1253
class ClientDBus(Client, DBusObjectWithProperties):
1225
1254
"""A Client class using D-Bus
1226
1255
1230
1259
"""
1231
1260
1232
1261
runtime_expansions = (Client.runtime_expansions
1233
+ ("dbus_object_path",))
1262
+ ("dbus_object_path", ))
1234
1263
1235
1264
_interface = "se.recompile.Mandos.Client"
1236
1265
1244
1273
client_object_name = str(self.name).translate(
1245
1274
{ord("."): ord("_"),
1246
1275
ord("-"): ord("_")})
1247
self.dbus_object_path = (dbus.ObjectPath
1248
("/clients/" + client_object_name))
1276
self.dbus_object_path = dbus.ObjectPath(
1277
"/clients/" + client_object_name)
1249
1278
DBusObjectWithProperties.__init__(self, self.bus,
1250
1279
self.dbus_object_path)
1251
1280
1252
def notifychangeproperty(transform_func,
1253
dbus_name, type_func=lambda x: x,
1254
variant_level=1, invalidate_only=False,
1281
def notifychangeproperty(transform_func, dbus_name,
1282
type_func=lambda x: x,
1283
variant_level=1,
1284
invalidate_only=False,
1255
1285
_interface=_interface):
1256
1286
""" Modify a variable so that it's a property which announces
1257
1287
its changes to DBus.
1264
1294
variant_level: D-Bus variant level. Default: 1
1265
1295
"""
1266
1296
attrname = "_{}".format(dbus_name)
1297
1267
1298
def setter(self, value):
1268
1299
if hasattr(self, "dbus_object_path"):
1269
1300
if (not hasattr(self, attrname) or
1270
1301
type_func(getattr(self, attrname, None))
1271
1302
!= type_func(value)):
1272
1303
if invalidate_only:
1273
self.PropertiesChanged(_interface,
1274
dbus.Dictionary(),
1275
dbus.Array
1276
((dbus_name,)))
1304
self.PropertiesChanged(
1305
_interface, dbus.Dictionary(),
1306
dbus.Array((dbus_name, )))
1277
1307
else:
1278
dbus_value = transform_func(type_func(value),
1279
variant_level
1280
=variant_level)
1308
dbus_value = transform_func(
1309
type_func(value),
1310
variant_level = variant_level)
1281
1311
self.PropertyChanged(dbus.String(dbus_name),
1282
1312
dbus_value)
1283
self.PropertiesChanged(_interface,
1284
dbus.Dictionary({
1285
dbus.String(dbus_name):
1286
dbus_value }), dbus.Array())
1313
self.PropertiesChanged(
1314
_interface,
1315
dbus.Dictionary({ dbus.String(dbus_name):
1316
dbus_value }),
1317
dbus.Array())
1287
1318
setattr(self, attrname, value)
1288
1319
1289
1320
return property(lambda self: getattr(self, attrname), setter)
1295
1326
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1296
1327
last_enabled = notifychangeproperty(datetime_to_dbus,
1297
1328
"LastEnabled")
1298
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1299
type_func = lambda checker:
1300
checker is not None)
1329
checker = notifychangeproperty(
1330
dbus.Boolean, "CheckerRunning",
1331
type_func = lambda checker: checker is not None)
1301
1332
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1302
1333
"LastCheckedOK")
1303
1334
last_checker_status = notifychangeproperty(dbus.Int16,
1306
1337
datetime_to_dbus, "LastApprovalRequest")
1307
1338
approved_by_default = notifychangeproperty(dbus.Boolean,
1308
1339
"ApprovedByDefault")
1309
approval_delay = notifychangeproperty(dbus.UInt64,
1310
"ApprovalDelay",
1311
type_func =
1312
lambda td: td.total_seconds()
1313
* 1000)
1340
approval_delay = notifychangeproperty(
1341
dbus.UInt64, "ApprovalDelay",
1342
type_func = lambda td: td.total_seconds() * 1000)
1314
1343
approval_duration = notifychangeproperty(
1315
1344
dbus.UInt64, "ApprovalDuration",
1316
1345
type_func = lambda td: td.total_seconds() * 1000)
1317
1346
host = notifychangeproperty(dbus.String, "Host")
1318
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1319
type_func = lambda td:
1320
td.total_seconds() * 1000)
1347
timeout = notifychangeproperty(
1348
dbus.UInt64, "Timeout",
1349
type_func = lambda td: td.total_seconds() * 1000)
1321
1350
extended_timeout = notifychangeproperty(
1322
1351
dbus.UInt64, "ExtendedTimeout",
1323
1352
type_func = lambda td: td.total_seconds() * 1000)
1324
interval = notifychangeproperty(dbus.UInt64,
1325
"Interval",
1326
type_func =
1327
lambda td: td.total_seconds()
1328
* 1000)
1353
interval = notifychangeproperty(
1354
dbus.UInt64, "Interval",
1355
type_func = lambda td: td.total_seconds() * 1000)
1329
1356
checker_command = notifychangeproperty(dbus.String, "Checker")
1330
1357
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1331
1358
invalidate_only=True)
1469
1496
return dbus.Boolean(bool(self.approvals_pending))
1470
1497
1471
1498
# ApprovedByDefault - property
1472
@dbus_service_property(_interface, signature="b",
1499
@dbus_service_property(_interface,
1500
signature="b",
1473
1501
access="readwrite")
1474
1502
def ApprovedByDefault_dbus_property(self, value=None):
1475
1503
if value is None: # get
1477
1505
self.approved_by_default = bool(value)
1478
1506
1479
1507
# ApprovalDelay - property
1480
@dbus_service_property(_interface, signature="t",
1508
@dbus_service_property(_interface,
1509
signature="t",
1481
1510
access="readwrite")
1482
1511
def ApprovalDelay_dbus_property(self, value=None):
1483
1512
if value is None: # get
1486
1515
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1487
1516
1488
1517
# ApprovalDuration - property
1489
@dbus_service_property(_interface, signature="t",
1518
@dbus_service_property(_interface,
1519
signature="t",
1490
1520
access="readwrite")
1491
1521
def ApprovalDuration_dbus_property(self, value=None):
1492
1522
if value is None: # get
1505
1535
return dbus.String(self.fingerprint)
1506
1536
1507
1537
# Host - property
1508
@dbus_service_property(_interface, signature="s",
1538
@dbus_service_property(_interface,
1539
signature="s",
1509
1540
access="readwrite")
1510
1541
def Host_dbus_property(self, value=None):
1511
1542
if value is None: # get
1523
1554
return datetime_to_dbus(self.last_enabled)
1524
1555
1525
1556
# Enabled - property
1526
@dbus_service_property(_interface, signature="b",
1557
@dbus_service_property(_interface,
1558
signature="b",
1527
1559
access="readwrite")
1528
1560
def Enabled_dbus_property(self, value=None):
1529
1561
if value is None: # get
1534
1566
self.disable()
1535
1567
1536
1568
# LastCheckedOK - property
1537
@dbus_service_property(_interface, signature="s",
1569
@dbus_service_property(_interface,
1570
signature="s",
1538
1571
access="readwrite")
1539
1572
def LastCheckedOK_dbus_property(self, value=None):
1540
1573
if value is not None:
1543
1576
return datetime_to_dbus(self.last_checked_ok)
1544
1577
1545
1578
# LastCheckerStatus - property
1546
@dbus_service_property(_interface, signature="n",
1547
access="read")
1579
@dbus_service_property(_interface, signature="n", access="read")
1548
1580
def LastCheckerStatus_dbus_property(self):
1549
1581
return dbus.Int16(self.last_checker_status)
1550
1582
1559
1591
return datetime_to_dbus(self.last_approval_request)
1560
1592
1561
1593
# Timeout - property
1562
@dbus_service_property(_interface, signature="t",
1594
@dbus_service_property(_interface,
1595
signature="t",
1563
1596
access="readwrite")
1564
1597
def Timeout_dbus_property(self, value=None):
1565
1598
if value is None: # get
1578
1611
is None):
1579
1612
return
1580
1613
gobject.source_remove(self.disable_initiator_tag)
1581
self.disable_initiator_tag = (
1582
gobject.timeout_add(
1583
int((self.expires - now).total_seconds()
1584
* 1000), self.disable))
1614
self.disable_initiator_tag = gobject.timeout_add(
1615
int((self.expires - now).total_seconds() * 1000),
1616
self.disable)
1585
1617
1586
1618
# ExtendedTimeout - property
1587
@dbus_service_property(_interface, signature="t",
1619
@dbus_service_property(_interface,
1620
signature="t",
1588
1621
access="readwrite")
1589
1622
def ExtendedTimeout_dbus_property(self, value=None):
1590
1623
if value is None: # get
1593
1626
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1594
1627
1595
1628
# Interval - property
1596
@dbus_service_property(_interface, signature="t",
1629
@dbus_service_property(_interface,
1630
signature="t",
1597
1631
access="readwrite")
1598
1632
def Interval_dbus_property(self, value=None):
1599
1633
if value is None: # get
1604
1638
if self.enabled:
1605
1639
# Reschedule checker run
1606
1640
gobject.source_remove(self.checker_initiator_tag)
1607
self.checker_initiator_tag = (gobject.timeout_add
1608
(value, self.start_checker))
1609
self.start_checker() # Start one now, too
1641
self.checker_initiator_tag = gobject.timeout_add(
1642
value, self.start_checker)
1643
self.start_checker() # Start one now, too
1610
1644
1611
1645
# Checker - property
1612
@dbus_service_property(_interface, signature="s",
1646
@dbus_service_property(_interface,
1647
signature="s",
1613
1648
access="readwrite")
1614
1649
def Checker_dbus_property(self, value=None):
1615
1650
if value is None: # get
1617
1652
self.checker_command = str(value)
1618
1653
1619
1654
# CheckerRunning - property
1620
@dbus_service_property(_interface, signature="b",
1655
@dbus_service_property(_interface,
1656
signature="b",
1621
1657
access="readwrite")
1622
1658
def CheckerRunning_dbus_property(self, value=None):
1623
1659
if value is None: # get
1633
1669
return self.dbus_object_path # is already a dbus.ObjectPath
1634
1670
1635
1671
# Secret = property
1636
@dbus_service_property(_interface, signature="ay",
1637
access="write", byte_arrays=True)
1672
@dbus_service_property(_interface,
1673
signature="ay",
1674
access="write",
1675
byte_arrays=True)
1638
1676
def Secret_dbus_property(self, value):
1639
1677
self.secret = bytes(value)
1640
1678
1646
1684
self._pipe = child_pipe
1647
1685
self._pipe.send(('init', fpr, address))
1648
1686
if not self._pipe.recv():
1649
raise KeyError()
1687
raise KeyError(fpr)
1650
1688
1651
1689
def __getattribute__(self, name):
1652
1690
if name == '_pipe':
1656
1694
if data[0] == 'data':
1657
1695
return data[1]
1658
1696
if data[0] == 'function':
1697
1659
1698
def func(*args, **kwargs):
1660
1699
self._pipe.send(('funcall', name, args, kwargs))
1661
1700
return self._pipe.recv()[1]
1701
1662
1702
return func
1663
1703
1664
1704
def __setattr__(self, name, value):
1680
1720
logger.debug("Pipe FD: %d",
1681
1721
self.server.child_pipe.fileno())
1682
1722
1683
session = (gnutls.connection
1684
.ClientSession(self.request,
1685
gnutls.connection
1686
.X509Credentials()))
1723
session = gnutls.connection.ClientSession(
1724
self.request, gnutls.connection .X509Credentials())
1687
1725
1688
1726
# Note: gnutls.connection.X509Credentials is really a
1689
1727
# generic GnuTLS certificate credentials object so long as
1698
1736
priority = self.server.gnutls_priority
1699
1737
if priority is None:
1700
1738
priority = "NORMAL"
1701
(gnutls.library.functions
1702
.gnutls_priority_set_direct(session._c_object,
1703
priority, None))
1739
gnutls.library.functions.gnutls_priority_set_direct(
1740
session._c_object, priority, None)
1704
1741
1705
1742
# Start communication using the Mandos protocol
1706
1743
# Get protocol number
1726
1763
approval_required = False
1727
1764
try:
1728
1765
try:
1729
fpr = self.fingerprint(self.peer_certificate
1730
(session))
1766
fpr = self.fingerprint(
1767
self.peer_certificate(session))
1731
1768
except (TypeError,
1732
1769
gnutls.errors.GNUTLSError) as error:
1733
1770
logger.warning("Bad certificate: %s", error)
1748
1785
while True:
1749
1786
if not client.enabled:
1750
1787
logger.info("Client %s is disabled",
1751
client.name)
1788
client.name)
1752
1789
if self.server.use_dbus:
1753
1790
# Emit D-Bus signal
1754
1791
client.Rejected("Disabled")
1801
1838
logger.warning("gnutls send failed",
1802
1839
exc_info=error)
1803
1840
return
1804
logger.debug("Sent: %d, remaining: %d",
1805
sent, len(client.secret)
1806
- (sent_size + sent))
1841
logger.debug("Sent: %d, remaining: %d", sent,
1842
len(client.secret) - (sent_size
1843
+ sent))
1807
1844
sent_size += sent
1808
1845
1809
1846
logger.info("Sending secret to %s", client.name)
1826
1863
def peer_certificate(session):
1827
1864
"Return the peer's OpenPGP certificate as a bytestring"
1828
1865
# If not an OpenPGP certificate...
1829
if (gnutls.library.functions
1830
.gnutls_certificate_type_get(session._c_object)
1866
if (gnutls.library.functions.gnutls_certificate_type_get(
1867
session._c_object)
1831
1868
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1832
1869
# ...do the normal thing
1833
1870
return session.peer_certificate
1847
1884
def fingerprint(openpgp):
1848
1885
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1849
1886
# New GnuTLS "datum" with the OpenPGP public key
1850
datum = (gnutls.library.types
1851
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
ctypes.POINTER
1853
(ctypes.c_ubyte)),
1854
ctypes.c_uint(len(openpgp))))
1887
datum = gnutls.library.types.gnutls_datum_t(
1888
ctypes.cast(ctypes.c_char_p(openpgp),
1889
ctypes.POINTER(ctypes.c_ubyte)),
1890
ctypes.c_uint(len(openpgp)))
1855
1891
# New empty GnuTLS certificate
1856
1892
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1893
gnutls.library.functions.gnutls_openpgp_crt_init(
1894
ctypes.byref(crt))
1859
1895
# Import the OpenPGP public key into the certificate
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1862
gnutls.library.constants
1863
.GNUTLS_OPENPGP_FMT_RAW))
1896
gnutls.library.functions.gnutls_openpgp_crt_import(
1897
crt, ctypes.byref(datum),
1898
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1864
1899
# Verify the self signature in the key
1865
1900
crtverify = ctypes.c_uint()
1866
(gnutls.library.functions
1867
.gnutls_openpgp_crt_verify_self(crt, 0,
1868
ctypes.byref(crtverify)))
1901
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1902
crt, 0, ctypes.byref(crtverify))
1869
1903
if crtverify.value != 0:
1870
1904
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1871
raise (gnutls.errors.CertificateSecurityError
1872
("Verify failed"))
1905
raise gnutls.errors.CertificateSecurityError(
1906
"Verify failed")
1873
1907
# New buffer for the fingerprint
1874
1908
buf = ctypes.create_string_buffer(20)
1875
1909
buf_len = ctypes.c_size_t()
1876
1910
# Get the fingerprint from the certificate into the buffer
1877
(gnutls.library.functions
1878
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1879
ctypes.byref(buf_len)))
1911
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1912
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1880
1913
# Deinit the certificate
1881
1914
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1882
1915
# Convert the buffer to a Python bytestring
1888
1921
1889
1922
class MultiprocessingMixIn(object):
1890
1923
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1924
1891
1925
def sub_process_main(self, request, address):
1892
1926
try:
1893
1927
self.finish_request(request, address)
1905
1939
1906
1940
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1907
1941
""" adds a pipe to the MixIn """
1942
1908
1943
def process_request(self, request, client_address):
1909
1944
"""Overrides and wraps the original process_request().
1910
1945
1931
1966
interface: None or a network interface name (string)
1932
1967
use_ipv6: Boolean; to use IPv6 or not
1933
1968
"""
1969
1934
1970
def __init__(self, server_address, RequestHandlerClass,
1935
interface=None, use_ipv6=True, socketfd=None):
1971
interface=None,
1972
use_ipv6=True,
1973
socketfd=None):
1936
1974
"""If socketfd is set, use that file descriptor instead of
1937
1975
creating a new one with socket.socket().
1938
1976
"""
1979
2017
self.interface)
1980
2018
else:
1981
2019
try:
1982
self.socket.setsockopt(socket.SOL_SOCKET,
1983
SO_BINDTODEVICE,
1984
(self.interface + "\0")
1985
.encode("utf-8"))
2020
self.socket.setsockopt(
2021
socket.SOL_SOCKET, SO_BINDTODEVICE,
2022
(self.interface + "\0").encode("utf-8"))
1986
2023
except socket.error as error:
1987
2024
if error.errno == errno.EPERM:
1988
2025
logger.error("No permission to bind to"
2006
2043
self.server_address = (any_address,
2007
2044
self.server_address[1])
2008
2045
elif not self.server_address[1]:
2009
self.server_address = (self.server_address[0],
2010
0)
2046
self.server_address = (self.server_address[0], 0)
2011
2047
# if self.interface:
2012
2048
# self.server_address = (self.server_address[0],
2013
2049
# 0, # port
2027
2063
2028
2064
Assumes a gobject.MainLoop event loop.
2029
2065
"""
2066
2030
2067
def __init__(self, server_address, RequestHandlerClass,
2031
interface=None, use_ipv6=True, clients=None,
2032
gnutls_priority=None, use_dbus=True, socketfd=None):
2068
interface=None,
2069
use_ipv6=True,
2070
clients=None,
2071
gnutls_priority=None,
2072
use_dbus=True,
2073
socketfd=None):
2033
2074
self.enabled = False
2034
2075
self.clients = clients
2035
2076
if self.clients is None:
2041
2082
interface = interface,
2042
2083
use_ipv6 = use_ipv6,
2043
2084
socketfd = socketfd)
2085
2044
2086
def server_activate(self):
2045
2087
if self.enabled:
2046
2088
return socketserver.TCPServer.server_activate(self)
2050
2092
2051
2093
def add_pipe(self, parent_pipe, proc):
2052
2094
# Call "handle_ipc" for both data and EOF events
2053
gobject.io_add_watch(parent_pipe.fileno(),
2054
gobject.IO_IN | gobject.IO_HUP,
2055
functools.partial(self.handle_ipc,
2056
parent_pipe =
2057
parent_pipe,
2058
proc = proc))
2095
gobject.io_add_watch(
2096
parent_pipe.fileno(),
2097
gobject.IO_IN | gobject.IO_HUP,
2098
functools.partial(self.handle_ipc,
2099
parent_pipe = parent_pipe,
2100
proc = proc))
2059
2101
2060
def handle_ipc(self, source, condition, parent_pipe=None,
2061
proc = None, client_object=None):
2102
def handle_ipc(self, source, condition,
2103
parent_pipe=None,
2104
proc = None,
2105
client_object=None):
2062
2106
# error, or the other end of multiprocessing.Pipe has closed
2063
2107
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2064
2108
# Wait for other process to exit
2087
2131
parent_pipe.send(False)
2088
2132
return False
2089
2133
2090
gobject.io_add_watch(parent_pipe.fileno(),
2091
gobject.IO_IN | gobject.IO_HUP,
2092
functools.partial(self.handle_ipc,
2093
parent_pipe =
2094
parent_pipe,
2095
proc = proc,
2096
client_object =
2097
client))
2134
gobject.io_add_watch(
2135
parent_pipe.fileno(),
2136
gobject.IO_IN | gobject.IO_HUP,
2137
functools.partial(self.handle_ipc,
2138
parent_pipe = parent_pipe,
2139
proc = proc,
2140
client_object = client))
2098
2141
parent_pipe.send(True)
2099
2142
# remove the old hook in favor of the new above hook on
2100
2143
# same fileno
2106
2149
2107
2150
parent_pipe.send(('data', getattr(client_object,
2108
2151
funcname)(*args,
2109
**kwargs)))
2152
**kwargs)))
2110
2153
2111
2154
if command == 'getattr':
2112
2155
attrname = request[1]
2113
if callable(client_object.__getattribute__(attrname)):
2114
parent_pipe.send(('function',))
2156
if isinstance(client_object.__getattribute__(attrname),
2157
collections.Callable):
2158
parent_pipe.send(('function', ))
2115
2159
else:
2116
parent_pipe.send(('data', client_object
2117
.__getattribute__(attrname)))
2160
parent_pipe.send((
2161
'data', client_object.__getattribute__(attrname)))
2118
2162
2119
2163
if command == 'setattr':
2120
2164
attrname = request[1]
2151
2195
# avoid excessive use of external libraries.
2152
2196
2153
2197
# New type for defining tokens, syntax, and semantics all-in-one
2154
Token = collections.namedtuple("Token",
2155
("regexp", # To match token; if
2156
# "value" is not None,
2157
# must have a "group"
2158
# containing digits
2159
"value", # datetime.timedelta or
2160
# None
2161
"followers")) # Tokens valid after
2162
# this token
2198
Token = collections.namedtuple("Token", (
2199
"regexp", # To match token; if "value" is not None, must have
2200
# a "group" containing digits
2201
"value", # datetime.timedelta or None
2202
"followers")) # Tokens valid after this token
2163
2203
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
2204
# the "duration" ABNF definition in RFC 3339, Appendix A.
2165
2205
token_end = Token(re.compile(r"$"), None, frozenset())
2166
2206
token_second = Token(re.compile(r"(\d+)S"),
2167
2207
datetime.timedelta(seconds=1),
2168
frozenset((token_end,)))
2208
frozenset((token_end, )))
2169
2209
token_minute = Token(re.compile(r"(\d+)M"),
2170
2210
datetime.timedelta(minutes=1),
2171
2211
frozenset((token_second, token_end)))
2187
2227
frozenset((token_month, token_end)))
2188
2228
token_week = Token(re.compile(r"(\d+)W"),
2189
2229
datetime.timedelta(weeks=1),
2190
frozenset((token_end,)))
2230
frozenset((token_end, )))
2191
2231
token_duration = Token(re.compile(r"P"), None,
2192
2232
frozenset((token_year, token_month,
2193
2233
token_day, token_time,
2195
2235
# Define starting values
2196
2236
value = datetime.timedelta() # Value so far
2197
2237
found_token = None
2198
followers = frozenset((token_duration,)) # Following valid tokens
2238
followers = frozenset((token_duration, )) # Following valid tokens
2199
2239
s = duration # String left to parse
2200
2240
# Loop until end token is found
2201
2241
while found_token is not token_end:
2218
2258
break
2219
2259
else:
2220
2260
# No currently valid tokens were found
2221
raise ValueError("Invalid RFC 3339 duration")
2261
raise ValueError("Invalid RFC 3339 duration: {!r}"
2262
.format(duration))
2222
2263
# End token found
2223
2264
return value
2224
2265
2261
2302
elif suffix == "w":
2262
2303
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2263
2304
else:
2264
raise ValueError("Unknown suffix {!r}"
2265
.format(suffix))
2305
raise ValueError("Unknown suffix {!r}".format(suffix))
2266
2306
except IndexError as e:
2267
2307
raise ValueError(*(e.args))
2268
2308
timevalue += delta
2284
2324
# Close all standard open file descriptors
2285
2325
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2286
2326
if not stat.S_ISCHR(os.fstat(null).st_mode):
2287
raise OSError(errno.ENODEV, "{} not a character device"
2327
raise OSError(errno.ENODEV,
2328
"{} not a character device"
2288
2329
.format(os.devnull))
2289
2330
os.dup2(null, sys.stdin.fileno())
2290
2331
os.dup2(null, sys.stdout.fileno())
2367
2408
"statedir": "/var/lib/mandos",
2368
2409
"foreground": "False",
2369
2410
"zeroconf": "True",
2370
}
2411
}
2371
2412
2372
2413
# Parse config file for server-global settings
2373
2414
server_config = configparser.SafeConfigParser(server_defaults)
2374
2415
del server_defaults
2375
server_config.read(os.path.join(options.configdir,
2376
"mandos.conf"))
2416
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2377
2417
# Convert the SafeConfigParser object to a dict
2378
2418
server_settings = server_config.defaults()
2379
2419
# Use the appropriate methods on the non-string config options
2397
2437
# Override the settings from the config file with command line
2398
2438
# options, if set.
2399
2439
for option in ("interface", "address", "port", "debug",
2400
"priority", "servicename", "configdir",
2401
"use_dbus", "use_ipv6", "debuglevel", "restore",
2402
"statedir", "socket", "foreground", "zeroconf"):
2440
"priority", "servicename", "configdir", "use_dbus",
2441
"use_ipv6", "debuglevel", "restore", "statedir",
2442
"socket", "foreground", "zeroconf"):
2403
2443
value = getattr(options, option)
2404
2444
if value is not None:
2405
2445
server_settings[option] = value
2420
2460
2421
2461
##################################################################
2422
2462
2423
if (not server_settings["zeroconf"] and
2424
not (server_settings["port"]
2425
or server_settings["socket"] != "")):
2426
parser.error("Needs port or socket to work without"
2427
" Zeroconf")
2463
if (not server_settings["zeroconf"]
2464
and not (server_settings["port"]
2465
or server_settings["socket"] != "")):
2466
parser.error("Needs port or socket to work without Zeroconf")
2428
2467
2429
2468
# For convenience
2430
2469
debug = server_settings["debug"]
2446
2485
initlogger(debug, level)
2447
2486
2448
2487
if server_settings["servicename"] != "Mandos":
2449
syslogger.setFormatter(logging.Formatter
2450
('Mandos ({}) [%(process)d]:'
2451
' %(levelname)s: %(message)s'
2452
.format(server_settings
2453
["servicename"])))
2488
syslogger.setFormatter(
2489
logging.Formatter('Mandos ({}) [%(process)d]:'
2490
' %(levelname)s: %(message)s'.format(
2491
server_settings["servicename"])))
2454
2492
2455
2493
# Parse config file with clients
2456
2494
client_config = configparser.SafeConfigParser(Client
2464
2502
socketfd = None
2465
2503
if server_settings["socket"] != "":
2466
2504
socketfd = server_settings["socket"]
2467
tcp_server = MandosServer((server_settings["address"],
2468
server_settings["port"]),
2469
ClientHandler,
2470
interface=(server_settings["interface"]
2471
or None),
2472
use_ipv6=use_ipv6,
2473
gnutls_priority=
2474
server_settings["priority"],
2475
use_dbus=use_dbus,
2476
socketfd=socketfd)
2505
tcp_server = MandosServer(
2506
(server_settings["address"], server_settings["port"]),
2507
ClientHandler,
2508
interface=(server_settings["interface"] or None),
2509
use_ipv6=use_ipv6,
2510
gnutls_priority=server_settings["priority"],
2511
use_dbus=use_dbus,
2512
socketfd=socketfd)
2477
2513
if not foreground:
2478
2514
pidfilename = "/run/mandos.pid"
2479
2515
if not os.path.isdir("/run/."):
2480
2516
pidfilename = "/var/run/mandos.pid"
2481
2517
pidfile = None
2482
2518
try:
2483
pidfile = open(pidfilename, "w")
2519
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2484
2520
except IOError as e:
2485
2521
logger.error("Could not open file %r", pidfilename,
2486
2522
exc_info=e)
2513
2549
def debug_gnutls(level, string):
2514
2550
logger.debug("GnuTLS: %s", string[:-1])
2515
2551
2516
(gnutls.library.functions
2517
.gnutls_global_set_log_function(debug_gnutls))
2552
gnutls.library.functions.gnutls_global_set_log_function(
2553
debug_gnutls)
2518
2554
2519
2555
# Redirect stdin so all checkers get /dev/null
2520
2556
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2540
2576
if use_dbus:
2541
2577
try:
2542
2578
bus_name = dbus.service.BusName("se.recompile.Mandos",
2543
bus, do_not_queue=True)
2544
old_bus_name = (dbus.service.BusName
2545
("se.bsnet.fukt.Mandos", bus,
2546
do_not_queue=True))
2547
except dbus.exceptions.NameExistsException as e:
2579
bus,
2580
do_not_queue=True)
2581
old_bus_name = dbus.service.BusName(
2582
"se.bsnet.fukt.Mandos", bus,
2583
do_not_queue=True)
2584
except dbus.exceptions.DBusException as e:
2548
2585
logger.error("Disabling D-Bus:", exc_info=e)
2549
2586
use_dbus = False
2550
2587
server_settings["use_dbus"] = False
2551
2588
tcp_server.use_dbus = False
2552
2589
if zeroconf:
2553
2590
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2554
service = AvahiServiceToSyslog(name =
2555
server_settings["servicename"],
2556
servicetype = "_mandos._tcp",
2557
protocol = protocol, bus = bus)
2591
service = AvahiServiceToSyslog(
2592
name = server_settings["servicename"],
2593
servicetype = "_mandos._tcp",
2594
protocol = protocol,
2595
bus = bus)
2558
2596
if server_settings["interface"]:
2559
service.interface = (if_nametoindex
2560
(server_settings["interface"]
2561
.encode("utf-8")))
2597
service.interface = if_nametoindex(
2598
server_settings["interface"].encode("utf-8"))
2562
2599
2563
2600
global multiprocessing_manager
2564
2601
multiprocessing_manager = multiprocessing.Manager()
2583
2620
if server_settings["restore"]:
2584
2621
try:
2585
2622
with open(stored_state_path, "rb") as stored_state:
2586
clients_data, old_client_settings = (pickle.load
2587
(stored_state))
2623
clients_data, old_client_settings = pickle.load(
2624
stored_state)
2588
2625
os.remove(stored_state_path)
2589
2626
except IOError as e:
2590
2627
if e.errno == errno.ENOENT:
2591
logger.warning("Could not load persistent state: {}"
2592
.format(os.strerror(e.errno)))
2628
logger.warning("Could not load persistent state:"
2629
" {}".format(os.strerror(e.errno)))
2593
2630
else:
2594
2631
logger.critical("Could not load persistent state:",
2595
2632
exc_info=e)
2596
2633
raise
2597
2634
except EOFError as e:
2598
2635
logger.warning("Could not load persistent state: "
2599
"EOFError:", exc_info=e)
2636
"EOFError:",
2637
exc_info=e)
2600
2638
2601
2639
with PGPEngine() as pgp:
2602
2640
for client_name, client in clients_data.items():
2614
2652
# For each value in new config, check if it
2615
2653
# differs from the old config value (Except for
2616
2654
# the "secret" attribute)
2617
if (name != "secret" and
2618
value != old_client_settings[client_name]
2619
[name]):
2655
if (name != "secret"
2656
and (value !=
2657
old_client_settings[client_name][name])):
2620
2658
client[name] = value
2621
2659
except KeyError:
2622
2660
pass
2631
2669
if not client["last_checked_ok"]:
2632
2670
logger.warning(
2633
2671
"disabling client {} - Client never "
2634
"performed a successful checker"
2635
.format(client_name))
2672
"performed a successful checker".format(
2673
client_name))
2636
2674
client["enabled"] = False
2637
2675
elif client["last_checker_status"] != 0:
2638
2676
logger.warning(
2639
2677
"disabling client {} - Client last"
2640
" checker failed with error code {}"
2641
.format(client_name,
2642
client["last_checker_status"]))
2678
" checker failed with error code"
2679
" {}".format(
2680
client_name,
2681
client["last_checker_status"]))
2643
2682
client["enabled"] = False
2644
2683
else:
2645
client["expires"] = (datetime.datetime
2646
.utcnow()
2647
+ client["timeout"])
2684
client["expires"] = (
2685
datetime.datetime.utcnow()
2686
+ client["timeout"])
2648
2687
logger.debug("Last checker succeeded,"
2649
" keeping {} enabled"
2650
.format(client_name))
2688
" keeping {} enabled".format(
2689
client_name))
2651
2690
try:
2652
client["secret"] = (
2653
pgp.decrypt(client["encrypted_secret"],
2654
client_settings[client_name]
2655
["secret"]))
2691
client["secret"] = pgp.decrypt(
2692
client["encrypted_secret"],
2693
client_settings[client_name]["secret"])
2656
2694
except PGPError:
2657
2695
# If decryption fails, we use secret from new settings
2658
logger.debug("Failed to decrypt {} old secret"
2659
.format(client_name))
2660
client["secret"] = (
2661
client_settings[client_name]["secret"])
2696
logger.debug("Failed to decrypt {} old secret".format(
2697
client_name))
2698
client["secret"] = (client_settings[client_name]
2699
["secret"])
2662
2700
2663
2701
# Add/remove clients based on new changes made to config
2664
2702
for client_name in (set(old_client_settings)
2671
2709
# Create all client objects
2672
2710
for client_name, client in clients_data.items():
2673
2711
tcp_server.clients[client_name] = client_class(
2674
name = client_name, settings = client,
2712
name = client_name,
2713
settings = client,
2675
2714
server_settings = server_settings)
2676
2715
2677
2716
if not tcp_server.clients:
2679
2718
2680
2719
if not foreground:
2681
2720
if pidfile is not None:
2721
pid = os.getpid()
2682
2722
try:
2683
2723
with pidfile:
2684
pid = os.getpid()
2685
pidfile.write("{}\n".format(pid).encode("utf-8"))
2724
print(pid, file=pidfile)
2686
2725
except IOError:
2687
2726
logger.error("Could not write to file %r with PID %d",
2688
2727
pidfilename, pid)
2693
2732
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2694
2733
2695
2734
if use_dbus:
2696
@alternate_dbus_interfaces({"se.recompile.Mandos":
2697
"se.bsnet.fukt.Mandos"})
2735
2736
@alternate_dbus_interfaces(
2737
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2698
2738
class MandosDBusService(DBusObjectWithProperties):
2699
2739
"""A D-Bus proxy object"""
2740
2700
2741
def __init__(self):
2701
2742
dbus.service.Object.__init__(self, bus, "/")
2743
2702
2744
_interface = "se.recompile.Mandos"
2703
2745
2704
2746
@dbus_interface_annotations(_interface)
2705
2747
def _foo(self):
2706
return { "org.freedesktop.DBus.Property"
2707
".EmitsChangedSignal":
2708
"false"}
2748
return {
2749
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2750
"false" }
2709
2751
2710
2752
@dbus.service.signal(_interface, signature="o")
2711
2753
def ClientAdded(self, objpath):
2725
2767
@dbus.service.method(_interface, out_signature="ao")
2726
2768
def GetAllClients(self):
2727
2769
"D-Bus method"
2728
return dbus.Array(c.dbus_object_path
2729
for c in
2770
return dbus.Array(c.dbus_object_path for c in
2730
2771
tcp_server.clients.itervalues())
2731
2772
2732
2773
@dbus.service.method(_interface,
2781
2822
# + secret.
2782
2823
exclude = { "bus", "changedstate", "secret",
2783
2824
"checker", "server_settings" }
2784
for name, typ in (inspect.getmembers
2785
(dbus.service.Object)):
2825
for name, typ in inspect.getmembers(dbus.service
2826
.Object):
2786
2827
exclude.add(name)
2787
2828
2788
2829
client_dict["encrypted_secret"] = (client
2795
2836
del client_settings[client.name]["secret"]
2796
2837
2797
2838
try:
2798
with (tempfile.NamedTemporaryFile
2799
(mode='wb', suffix=".pickle", prefix='clients-',
2800
dir=os.path.dirname(stored_state_path),
2801
delete=False)) as stored_state:
2839
with tempfile.NamedTemporaryFile(
2840
mode='wb',
2841
suffix=".pickle",
2842
prefix='clients-',
2843
dir=os.path.dirname(stored_state_path),
2844
delete=False) as stored_state:
2802
2845
pickle.dump((clients, client_settings), stored_state)
2803
tempname=stored_state.name
2846
tempname = stored_state.name
2804
2847
os.rename(tempname, stored_state_path)
2805
2848
except (IOError, OSError) as e:
2806
2849
if not debug:
2825
2868
client.disable(quiet=True)
2826
2869
if use_dbus:
2827
2870
# Emit D-Bus signal
2828
mandos_dbus_service.ClientRemoved(client
2829
.dbus_object_path,
2830
client.name)
2871
mandos_dbus_service.ClientRemoved(
2872
client.dbus_object_path, client.name)
2831
2873
client_settings.clear()
2832
2874
2833
2875
atexit.register(cleanup)
2886
2928
# Must run before the D-Bus bus name gets deregistered
2887
2929
cleanup()
2888
2930
2931
2889
2932
if __name__ == '__main__':
2890
2933
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0