To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 757
- compare with another revision
- download diff
- download tarball
- view history from revision 757
- Committer: Teddy Hogeborn
- Date: 2015-06-02 17:43:53 UTC
- Revision ID: teddy@recompile.se-20150602174353-tvqw31mgxfapl985
mandos.service ([Service]/KillMode): Changed to "mixed".
- files added:
- debian/upstream
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2013 Teddy Hogeborn
15
# Copyright © 2008-2013 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
69
78
import tempfile
70
79
import itertools
71
80
import collections
81
import codecs
72
82
73
83
import dbus
74
84
import dbus.service
75
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
76
89
import avahi
77
90
from dbus.mainloop.glib import DBusGMainLoop
78
91
import ctypes
88
101
except ImportError:
89
102
SO_BINDTODEVICE = None
90
103
91
version = "1.6.2"
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
92
108
stored_state_file = "clients.pickle"
93
109
94
110
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
111
syslogger = None
98
112
99
113
try:
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
103
116
except (OSError, AttributeError):
117
104
118
def if_nametoindex(interface):
105
119
"Get an interface index the hard way, i.e. using fcntl()"
106
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
121
with contextlib.closing(socket.socket()) as s:
108
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
125
return interface_index
114
126
115
127
116
128
def initlogger(debug, level=logging.WARNING):
117
129
"""init logger and add loglevel"""
118
130
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
119
135
syslogger.setFormatter(logging.Formatter
120
136
('Mandos [%(process)d]: %(levelname)s:'
121
137
' %(message)s'))
138
154
139
155
class PGPEngine(object):
140
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
141
158
def __init__(self):
142
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
160
self.gnupgargs = ['--batch',
182
199
183
200
def encrypt(self, data, password):
184
201
passphrase = self.password_encode(password)
185
with tempfile.NamedTemporaryFile(dir=self.tempdir
186
) as passfile:
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
187
204
passfile.write(passphrase)
188
205
passfile.flush()
189
206
proc = subprocess.Popen(['gpg', '--symmetric',
200
217
201
218
def decrypt(self, data, password):
202
219
passphrase = self.password_encode(password)
203
with tempfile.NamedTemporaryFile(dir = self.tempdir
204
) as passfile:
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
205
222
passfile.write(passphrase)
206
223
passfile.flush()
207
224
proc = subprocess.Popen(['gpg', '--decrypt',
211
228
stdin = subprocess.PIPE,
212
229
stdout = subprocess.PIPE,
213
230
stderr = subprocess.PIPE)
214
decrypted_plaintext, err = proc.communicate(input
215
= data)
231
decrypted_plaintext, err = proc.communicate(input = data)
216
232
if proc.returncode != 0:
217
233
raise PGPError(err)
218
234
return decrypted_plaintext
221
237
class AvahiError(Exception):
222
238
def __init__(self, value, *args, **kwargs):
223
239
self.value = value
224
super(AvahiError, self).__init__(value, *args, **kwargs)
225
def __unicode__(self):
226
return unicode(repr(self.value))
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
227
243
228
244
class AvahiServiceError(AvahiError):
229
245
pass
230
246
247
231
248
class AvahiGroupError(AvahiError):
232
249
pass
233
250
253
270
bus: dbus.SystemBus()
254
271
"""
255
272
256
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
257
servicetype = None, port = None, TXT = None,
258
domain = "", host = "", max_renames = 32768,
259
protocol = avahi.PROTO_UNSPEC, bus = None):
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
260
284
self.interface = interface
261
285
self.name = name
262
286
self.type = servicetype
272
296
self.bus = bus
273
297
self.entry_group_state_changed_match = None
274
298
275
def rename(self):
299
def rename(self, remove=True):
276
300
"""Derived from the Avahi example code"""
277
301
if self.rename_count >= self.max_renames:
278
302
logger.critical("No suitable Zeroconf service name found"
279
303
" after %i retries, exiting.",
280
304
self.rename_count)
281
305
raise AvahiServiceError("Too many renames")
282
self.name = unicode(self.server
283
.GetAlternativeServiceName(self.name))
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
284
309
logger.info("Changing Zeroconf service name to %r ...",
285
310
self.name)
286
self.remove()
311
if remove:
312
self.remove()
287
313
try:
288
314
self.add()
289
315
except dbus.exceptions.DBusException as error:
290
logger.critical("D-Bus Exception", exc_info=error)
291
self.cleanup()
292
os._exit(1)
293
self.rename_count += 1
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
294
324
295
325
def remove(self):
296
326
"""Derived from the Avahi example code"""
334
364
self.rename()
335
365
elif state == avahi.ENTRY_GROUP_FAILURE:
336
366
logger.critical("Avahi: Error in group state changed %s",
337
unicode(error))
338
raise AvahiGroupError("State changed: {0!s}"
339
.format(error))
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
340
369
341
370
def cleanup(self):
342
371
"""Derived from the Avahi example code"""
352
381
def server_state_changed(self, state, error=None):
353
382
"""Derived from the Avahi example code"""
354
383
logger.debug("Avahi server state change: %i", state)
355
bad_states = { avahi.SERVER_INVALID:
356
"Zeroconf server invalid",
357
avahi.SERVER_REGISTERING: None,
358
avahi.SERVER_COLLISION:
359
"Zeroconf server name collision",
360
avahi.SERVER_FAILURE:
361
"Zeroconf server failure" }
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
362
390
if state in bad_states:
363
391
if bad_states[state] is not None:
364
392
if error is None:
383
411
follow_name_owner_changes=True),
384
412
avahi.DBUS_INTERFACE_SERVER)
385
413
self.server.connect_to_signal("StateChanged",
386
self.server_state_changed)
414
self.server_state_changed)
387
415
self.server_state_changed(self.server.GetState())
388
416
389
417
390
418
class AvahiServiceToSyslog(AvahiService):
391
def rename(self):
419
def rename(self, *args, **kwargs):
392
420
"""Add the new name to the syslog messages"""
393
ret = AvahiService.rename(self)
394
syslogger.setFormatter(logging.Formatter
395
('Mandos ({0}) [%(process)d]:'
396
' %(levelname)s: %(message)s'
397
.format(self.name)))
421
ret = AvahiService.rename(self, *args, **kwargs)
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
.format(self.name)))
398
425
return ret
399
426
400
401
def timedelta_to_milliseconds(td):
402
"Convert a datetime.timedelta() to milliseconds"
403
return ((td.days * 24 * 60 * 60 * 1000)
404
+ (td.seconds * 1000)
405
+ (td.microseconds // 1000))
406
427
def call_pipe(connection, # : multiprocessing.Connection
428
func, *args, **kwargs):
429
"""This function is meant to be called by multiprocessing.Process
430
431
This function runs func(*args, **kwargs), and writes the resulting
432
return value on the provided multiprocessing.Connection.
433
"""
434
connection.send(func(*args, **kwargs))
435
connection.close()
407
436
408
437
class Client(object):
409
438
"""A representation of a client host served by this server.
436
465
last_checker_status: integer between 0 and 255 reflecting exit
437
466
status of last checker. -1 reflects crashed
438
467
checker, -2 means no checker completed yet.
468
last_checker_signal: The signal which killed the last checker, if
469
last_checker_status is -1
439
470
last_enabled: datetime.datetime(); (UTC) or None
440
471
name: string; from the config file, used in log messages and
441
472
D-Bus identifiers
454
485
"fingerprint", "host", "interval",
455
486
"last_approval_request", "last_checked_ok",
456
487
"last_enabled", "name", "timeout")
457
client_defaults = { "timeout": "PT5M",
458
"extended_timeout": "PT15M",
459
"interval": "PT2M",
460
"checker": "fping -q -- %%(host)s",
461
"host": "",
462
"approval_delay": "PT0S",
463
"approval_duration": "PT1S",
464
"approved_by_default": "True",
465
"enabled": "True",
466
}
467
468
def timeout_milliseconds(self):
469
"Return the 'timeout' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.timeout)
471
472
def extended_timeout_milliseconds(self):
473
"Return the 'extended_timeout' attribute in milliseconds"
474
return timedelta_to_milliseconds(self.extended_timeout)
475
476
def interval_milliseconds(self):
477
"Return the 'interval' attribute in milliseconds"
478
return timedelta_to_milliseconds(self.interval)
479
480
def approval_delay_milliseconds(self):
481
return timedelta_to_milliseconds(self.approval_delay)
488
client_defaults = {
489
"timeout": "PT5M",
490
"extended_timeout": "PT15M",
491
"interval": "PT2M",
492
"checker": "fping -q -- %%(host)s",
493
"host": "",
494
"approval_delay": "PT0S",
495
"approval_duration": "PT1S",
496
"approved_by_default": "True",
497
"enabled": "True",
498
}
482
499
483
500
@staticmethod
484
501
def config_parser(config):
500
517
client["enabled"] = config.getboolean(client_name,
501
518
"enabled")
502
519
520
# Uppercase and remove spaces from fingerprint for later
521
# comparison purposes with return value from the
522
# fingerprint() function
503
523
client["fingerprint"] = (section["fingerprint"].upper()
504
524
.replace(" ", ""))
505
525
if "secret" in section:
510
530
"rb") as secfile:
511
531
client["secret"] = secfile.read()
512
532
else:
513
raise TypeError("No secret or secfile for section {0}"
533
raise TypeError("No secret or secfile for section {}"
514
534
.format(section))
515
535
client["timeout"] = string_to_delta(section["timeout"])
516
536
client["extended_timeout"] = string_to_delta(
533
553
server_settings = {}
534
554
self.server_settings = server_settings
535
555
# adding all client settings
536
for setting, value in settings.iteritems():
556
for setting, value in settings.items():
537
557
setattr(self, setting, value)
538
558
539
559
if self.enabled:
547
567
self.expires = None
548
568
549
569
logger.debug("Creating client %r", self.name)
550
# Uppercase and remove spaces from fingerprint for later
551
# comparison purposes with return value from the fingerprint()
552
# function
553
570
logger.debug(" Fingerprint: %s", self.fingerprint)
554
571
self.created = settings.get("created",
555
572
datetime.datetime.utcnow())
562
579
self.current_checker_command = None
563
580
self.approved = None
564
581
self.approvals_pending = 0
565
self.changedstate = (multiprocessing_manager
566
.Condition(multiprocessing_manager
567
.Lock()))
568
self.client_structure = [attr for attr in
569
self.__dict__.iterkeys()
582
self.changedstate = multiprocessing_manager.Condition(
583
multiprocessing_manager.Lock())
584
self.client_structure = [attr
585
for attr in self.__dict__.iterkeys()
570
586
if not attr.startswith("_")]
571
587
self.client_structure.append("client_structure")
572
588
573
for name, t in inspect.getmembers(type(self),
574
lambda obj:
575
isinstance(obj,
576
property)):
589
for name, t in inspect.getmembers(
590
type(self), lambda obj: isinstance(obj, property)):
577
591
if not name.startswith("_"):
578
592
self.client_structure.append(name)
579
593
621
635
# and every interval from then on.
622
636
if self.checker_initiator_tag is not None:
623
637
gobject.source_remove(self.checker_initiator_tag)
624
self.checker_initiator_tag = (gobject.timeout_add
625
(self.interval_milliseconds(),
626
self.start_checker))
638
self.checker_initiator_tag = gobject.timeout_add(
639
int(self.interval.total_seconds() * 1000),
640
self.start_checker)
627
641
# Schedule a disable() when 'timeout' has passed
628
642
if self.disable_initiator_tag is not None:
629
643
gobject.source_remove(self.disable_initiator_tag)
630
self.disable_initiator_tag = (gobject.timeout_add
631
(self.timeout_milliseconds(),
632
self.disable))
644
self.disable_initiator_tag = gobject.timeout_add(
645
int(self.timeout.total_seconds() * 1000), self.disable)
633
646
# Also start a new checker *right now*.
634
647
self.start_checker()
635
648
636
def checker_callback(self, pid, condition, command):
649
def checker_callback(self, source, condition, connection,
650
command):
637
651
"""The checker has completed, so take appropriate actions."""
638
652
self.checker_callback_tag = None
639
653
self.checker = None
640
if os.WIFEXITED(condition):
641
self.last_checker_status = os.WEXITSTATUS(condition)
654
# Read return code from connection (see call_pipe)
655
returncode = connection.recv()
656
connection.close()
657
658
if returncode >= 0:
659
self.last_checker_status = returncode
660
self.last_checker_signal = None
642
661
if self.last_checker_status == 0:
643
662
logger.info("Checker for %(name)s succeeded",
644
663
vars(self))
645
664
self.checked_ok()
646
665
else:
647
logger.info("Checker for %(name)s failed",
648
vars(self))
666
logger.info("Checker for %(name)s failed", vars(self))
649
667
else:
650
668
self.last_checker_status = -1
669
self.last_checker_signal = -returncode
651
670
logger.warning("Checker for %(name)s crashed?",
652
671
vars(self))
672
return False
653
673
654
674
def checked_ok(self):
655
675
"""Assert that the client has been seen, alive and well."""
656
676
self.last_checked_ok = datetime.datetime.utcnow()
657
677
self.last_checker_status = 0
678
self.last_checker_signal = None
658
679
self.bump_timeout()
659
680
660
681
def bump_timeout(self, timeout=None):
665
686
gobject.source_remove(self.disable_initiator_tag)
666
687
self.disable_initiator_tag = None
667
688
if getattr(self, "enabled", False):
668
self.disable_initiator_tag = (gobject.timeout_add
669
(timedelta_to_milliseconds
670
(timeout), self.disable))
689
self.disable_initiator_tag = gobject.timeout_add(
690
int(timeout.total_seconds() * 1000), self.disable)
671
691
self.expires = datetime.datetime.utcnow() + timeout
672
692
673
693
def need_approval(self):
687
707
# than 'timeout' for the client to be disabled, which is as it
688
708
# should be.
689
709
690
# If a checker exists, make sure it is not a zombie
691
try:
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except AttributeError:
694
pass
695
except OSError as error:
696
if error.errno != errno.ECHILD:
697
raise
698
else:
699
if pid:
700
logger.warning("Checker was a zombie")
701
gobject.source_remove(self.checker_callback_tag)
702
self.checker_callback(pid, status,
703
self.current_checker_command)
710
if self.checker is not None and not self.checker.is_alive():
711
logger.warning("Checker was not alive; joining")
712
self.checker.join()
713
self.checker = None
704
714
# Start a new checker if needed
705
715
if self.checker is None:
706
716
# Escape attributes for the shell
707
escaped_attrs = dict(
708
(attr, re.escape(unicode(getattr(self, attr))))
709
for attr in
710
self.runtime_expansions)
717
escaped_attrs = {
718
attr: re.escape(str(getattr(self, attr)))
719
for attr in self.runtime_expansions }
711
720
try:
712
721
command = self.checker_command % escaped_attrs
713
722
except TypeError as error:
714
723
logger.error('Could not format string "%s"',
715
self.checker_command, exc_info=error)
716
return True # Try again later
724
self.checker_command,
725
exc_info=error)
726
return True # Try again later
717
727
self.current_checker_command = command
718
try:
719
logger.info("Starting checker %r for %s",
720
command, self.name)
721
# We don't need to redirect stdout and stderr, since
722
# in normal mode, that is already done by daemon(),
723
# and in debug mode we don't want to. (Stdin is
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
727
# created wnull.
728
popen_args = {}
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
732
"stderr": wnull })
733
self.checker = subprocess.Popen(command,
734
close_fds=True,
735
shell=True, cwd="/",
736
**popen_args)
737
except OSError as error:
738
logger.error("Failed to start subprocess",
739
exc_info=error)
740
return True
741
self.checker_callback_tag = (gobject.child_watch_add
742
(self.checker.pid,
743
self.checker_callback,
744
data=command))
745
# The checker may have completed before the gobject
746
# watch was added. Check for this.
747
try:
748
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
749
except OSError as error:
750
if error.errno == errno.ECHILD:
751
# This should never happen
752
logger.error("Child process vanished",
753
exc_info=error)
754
return True
755
raise
756
if pid:
757
gobject.source_remove(self.checker_callback_tag)
758
self.checker_callback(pid, status, command)
728
logger.info("Starting checker %r for %s", command,
729
self.name)
730
# We don't need to redirect stdout and stderr, since
731
# in normal mode, that is already done by daemon(),
732
# and in debug mode we don't want to. (Stdin is
733
# always replaced by /dev/null.)
734
# The exception is when not debugging but nevertheless
735
# running in the foreground; use the previously
736
# created wnull.
737
popen_args = { "close_fds": True,
738
"shell": True,
739
"cwd": "/" }
740
if (not self.server_settings["debug"]
741
and self.server_settings["foreground"]):
742
popen_args.update({"stdout": wnull,
743
"stderr": wnull })
744
pipe = multiprocessing.Pipe(duplex = False)
745
self.checker = multiprocessing.Process(
746
target = call_pipe,
747
args = (pipe[1], subprocess.call, command),
748
kwargs = popen_args)
749
self.checker.start()
750
self.checker_callback_tag = gobject.io_add_watch(
751
pipe[0].fileno(), gobject.IO_IN,
752
self.checker_callback, pipe[0], command)
759
753
# Re-run this periodically if run by gobject.timeout_add
760
754
return True
761
755
767
761
if getattr(self, "checker", None) is None:
768
762
return
769
763
logger.debug("Stopping checker for %(name)s", vars(self))
770
try:
771
self.checker.terminate()
772
#time.sleep(0.5)
773
#if self.checker.poll() is None:
774
# self.checker.kill()
775
except OSError as error:
776
if error.errno != errno.ESRCH: # No such process
777
raise
764
self.checker.terminate()
778
765
self.checker = None
779
766
780
767
781
def dbus_service_property(dbus_interface, signature="v",
782
access="readwrite", byte_arrays=False):
768
def dbus_service_property(dbus_interface,
769
signature="v",
770
access="readwrite",
771
byte_arrays=False):
783
772
"""Decorators for marking methods of a DBusObjectWithProperties to
784
773
become properties on the D-Bus.
785
774
794
783
# "Set" method, so we fail early here:
795
784
if byte_arrays and signature != "ay":
796
785
raise ValueError("Byte arrays not supported for non-'ay'"
797
" signature {0!r}".format(signature))
786
" signature {!r}".format(signature))
787
798
788
def decorator(func):
799
789
func._dbus_is_property = True
800
790
func._dbus_interface = dbus_interface
805
795
func._dbus_name = func._dbus_name[:-14]
806
796
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
807
797
return func
798
808
799
return decorator
809
800
810
801
819
810
"org.freedesktop.DBus.Property.EmitsChangedSignal":
820
811
"false"}
821
812
"""
813
822
814
def decorator(func):
823
815
func._dbus_is_interface = True
824
816
func._dbus_interface = dbus_interface
825
817
func._dbus_name = dbus_interface
826
818
return func
819
827
820
return decorator
828
821
829
822
831
824
"""Decorator to annotate D-Bus methods, signals or properties
832
825
Usage:
833
826
827
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
828
"org.freedesktop.DBus.Property."
829
"EmitsChangedSignal": "false"})
834
830
@dbus_service_property("org.example.Interface", signature="b",
835
831
access="r")
836
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
837
"org.freedesktop.DBus.Property."
838
"EmitsChangedSignal": "false"})
839
832
def Property_dbus_property(self):
840
833
return dbus.Boolean(False)
841
834
"""
835
842
836
def decorator(func):
843
837
func._dbus_annotations = annotations
844
838
return func
839
845
840
return decorator
846
841
847
842
848
843
class DBusPropertyException(dbus.exceptions.DBusException):
849
844
"""A base class for D-Bus property-related exceptions
850
845
"""
851
def __unicode__(self):
852
return unicode(str(self))
846
pass
853
847
854
848
855
849
class DBusPropertyAccessException(DBusPropertyException):
879
873
If called like _is_dbus_thing("method") it returns a function
880
874
suitable for use as predicate to inspect.getmembers().
881
875
"""
882
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
876
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
883
877
False)
884
878
885
879
def _get_all_dbus_things(self, thing):
886
880
"""Returns a generator of (name, attribute) pairs
887
881
"""
888
return ((getattr(athing.__get__(self), "_dbus_name",
889
name),
882
return ((getattr(athing.__get__(self), "_dbus_name", name),
890
883
athing.__get__(self))
891
884
for cls in self.__class__.__mro__
892
885
for name, athing in
893
inspect.getmembers(cls,
894
self._is_dbus_thing(thing)))
886
inspect.getmembers(cls, self._is_dbus_thing(thing)))
895
887
896
888
def _get_dbus_property(self, interface_name, property_name):
897
889
"""Returns a bound method if one exists which is a D-Bus
898
890
property with the specified name and interface.
899
891
"""
900
for cls in self.__class__.__mro__:
901
for name, value in (inspect.getmembers
902
(cls,
903
self._is_dbus_thing("property"))):
892
for cls in self.__class__.__mro__:
893
for name, value in inspect.getmembers(
894
cls, self._is_dbus_thing("property")):
904
895
if (value._dbus_name == property_name
905
896
and value._dbus_interface == interface_name):
906
897
return value.__get__(self)
907
898
908
899
# No such property
909
raise DBusPropertyNotFound(self.dbus_object_path + ":"
910
+ interface_name + "."
911
+ property_name)
900
raise DBusPropertyNotFound("{}:{}.{}".format(
901
self.dbus_object_path, interface_name, property_name))
912
902
913
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
903
@dbus.service.method(dbus.PROPERTIES_IFACE,
904
in_signature="ss",
914
905
out_signature="v")
915
906
def Get(self, interface_name, property_name):
916
907
"""Standard D-Bus property Get() method, see D-Bus standard.
934
925
# The byte_arrays option is not supported yet on
935
926
# signatures other than "ay".
936
927
if prop._dbus_signature != "ay":
937
raise ValueError
928
raise ValueError("Byte arrays not supported for non-"
929
"'ay' signature {!r}"
930
.format(prop._dbus_signature))
938
931
value = dbus.ByteArray(b''.join(chr(byte)
939
932
for byte in value))
940
933
prop(value)
941
934
942
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
935
@dbus.service.method(dbus.PROPERTIES_IFACE,
936
in_signature="s",
943
937
out_signature="a{sv}")
944
938
def GetAll(self, interface_name):
945
939
"""Standard D-Bus property GetAll() method, see D-Bus
960
954
if not hasattr(value, "variant_level"):
961
955
properties[name] = value
962
956
continue
963
properties[name] = type(value)(value, variant_level=
964
value.variant_level+1)
957
properties[name] = type(value)(
958
value, variant_level = value.variant_level + 1)
965
959
return dbus.Dictionary(properties, signature="sv")
966
960
961
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
962
def PropertiesChanged(self, interface_name, changed_properties,
963
invalidated_properties):
964
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
965
standard.
966
"""
967
pass
968
967
969
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
968
970
out_signature="s",
969
971
path_keyword='object_path',
977
979
connection)
978
980
try:
979
981
document = xml.dom.minidom.parseString(xmlstring)
982
980
983
def make_tag(document, name, prop):
981
984
e = document.createElement("property")
982
985
e.setAttribute("name", name)
983
986
e.setAttribute("type", prop._dbus_signature)
984
987
e.setAttribute("access", prop._dbus_access)
985
988
return e
989
986
990
for if_tag in document.getElementsByTagName("interface"):
987
991
# Add property tags
988
992
for tag in (make_tag(document, name, prop)
1000
1004
if (name == tag.getAttribute("name")
1001
1005
and prop._dbus_interface
1002
1006
== if_tag.getAttribute("name")):
1003
annots.update(getattr
1004
(prop,
1005
"_dbus_annotations",
1006
{}))
1007
for name, value in annots.iteritems():
1007
annots.update(getattr(
1008
prop, "_dbus_annotations", {}))
1009
for name, value in annots.items():
1008
1010
ann_tag = document.createElement(
1009
1011
"annotation")
1010
1012
ann_tag.setAttribute("name", name)
1013
1015
# Add interface annotation tags
1014
1016
for annotation, value in dict(
1015
1017
itertools.chain.from_iterable(
1016
annotations().iteritems()
1017
for name, annotations in
1018
self._get_all_dbus_things("interface")
1018
annotations().items()
1019
for name, annotations
1020
in self._get_all_dbus_things("interface")
1019
1021
if name == if_tag.getAttribute("name")
1020
)).iteritems():
1022
)).items():
1021
1023
ann_tag = document.createElement("annotation")
1022
1024
ann_tag.setAttribute("name", annotation)
1023
1025
ann_tag.setAttribute("value", value)
1050
1052
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1051
1053
if dt is None:
1052
1054
return dbus.String("", variant_level = variant_level)
1053
return dbus.String(dt.isoformat(),
1054
variant_level=variant_level)
1055
return dbus.String(dt.isoformat(), variant_level=variant_level)
1055
1056
1056
1057
1057
1058
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1077
1078
(from DBusObjectWithProperties) and interfaces (from the
1078
1079
dbus_interface_annotations decorator).
1079
1080
"""
1081
1080
1082
def wrapper(cls):
1081
1083
for orig_interface_name, alt_interface_name in (
1082
alt_interface_names.iteritems()):
1084
alt_interface_names.items()):
1083
1085
attr = {}
1084
1086
interface_names = set()
1085
1087
# Go though all attributes of the class
1087
1089
# Ignore non-D-Bus attributes, and D-Bus attributes
1088
1090
# with the wrong interface name
1089
1091
if (not hasattr(attribute, "_dbus_interface")
1090
or not attribute._dbus_interface
1091
.startswith(orig_interface_name)):
1092
or not attribute._dbus_interface.startswith(
1093
orig_interface_name)):
1092
1094
continue
1093
1095
# Create an alternate D-Bus interface name based on
1094
1096
# the current name
1095
alt_interface = (attribute._dbus_interface
1096
.replace(orig_interface_name,
1097
alt_interface_name))
1097
alt_interface = attribute._dbus_interface.replace(
1098
orig_interface_name, alt_interface_name)
1098
1099
interface_names.add(alt_interface)
1099
1100
# Is this a D-Bus signal?
1100
1101
if getattr(attribute, "_dbus_is_signal", False):
1101
# Extract the original non-method undecorated
1102
# function by black magic
1103
nonmethod_func = (dict(
1102
if sys.version_info.major == 2:
1103
# Extract the original non-method undecorated
1104
# function by black magic
1105
nonmethod_func = (dict(
1104
1106
zip(attribute.func_code.co_freevars,
1105
attribute.__closure__))["func"]
1106
.cell_contents)
1107
attribute.__closure__))
1108
["func"].cell_contents)
1109
else:
1110
nonmethod_func = attribute
1107
1111
# Create a new, but exactly alike, function
1108
1112
# object, and decorate it to be a new D-Bus signal
1109
1113
# with the alternate D-Bus interface name
1110
new_function = (dbus.service.signal
1111
(alt_interface,
1112
attribute._dbus_signature)
1113
(types.FunctionType(
1114
nonmethod_func.func_code,
1115
nonmethod_func.func_globals,
1116
nonmethod_func.func_name,
1117
nonmethod_func.func_defaults,
1118
nonmethod_func.func_closure)))
1114
if sys.version_info.major == 2:
1115
new_function = types.FunctionType(
1116
nonmethod_func.func_code,
1117
nonmethod_func.func_globals,
1118
nonmethod_func.func_name,
1119
nonmethod_func.func_defaults,
1120
nonmethod_func.func_closure)
1121
else:
1122
new_function = types.FunctionType(
1123
nonmethod_func.__code__,
1124
nonmethod_func.__globals__,
1125
nonmethod_func.__name__,
1126
nonmethod_func.__defaults__,
1127
nonmethod_func.__closure__)
1128
new_function = (dbus.service.signal(
1129
alt_interface,
1130
attribute._dbus_signature)(new_function))
1119
1131
# Copy annotations, if any
1120
1132
try:
1121
new_function._dbus_annotations = (
1122
dict(attribute._dbus_annotations))
1133
new_function._dbus_annotations = dict(
1134
attribute._dbus_annotations)
1123
1135
except AttributeError:
1124
1136
pass
1125
1137
# Define a creator of a function to call both the
1130
1142
"""This function is a scope container to pass
1131
1143
func1 and func2 to the "call_both" function
1132
1144
outside of its arguments"""
1145
1133
1146
def call_both(*args, **kwargs):
1134
1147
"""This function will emit two D-Bus
1135
1148
signals by calling func1 and func2"""
1136
1149
func1(*args, **kwargs)
1137
1150
func2(*args, **kwargs)
1151
1138
1152
return call_both
1139
1153
# Create the "call_both" function and add it to
1140
1154
# the class
1145
1159
# object. Decorate it to be a new D-Bus method
1146
1160
# with the alternate D-Bus interface name. Add it
1147
1161
# to the class.
1148
attr[attrname] = (dbus.service.method
1149
(alt_interface,
1150
attribute._dbus_in_signature,
1151
attribute._dbus_out_signature)
1152
(types.FunctionType
1153
(attribute.func_code,
1154
attribute.func_globals,
1155
attribute.func_name,
1156
attribute.func_defaults,
1157
attribute.func_closure)))
1162
attr[attrname] = (
1163
dbus.service.method(
1164
alt_interface,
1165
attribute._dbus_in_signature,
1166
attribute._dbus_out_signature)
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1158
1172
# Copy annotations, if any
1159
1173
try:
1160
attr[attrname]._dbus_annotations = (
1161
dict(attribute._dbus_annotations))
1174
attr[attrname]._dbus_annotations = dict(
1175
attribute._dbus_annotations)
1162
1176
except AttributeError:
1163
1177
pass
1164
1178
# Is this a D-Bus property?
1167
1181
# object, and decorate it to be a new D-Bus
1168
1182
# property with the alternate D-Bus interface
1169
1183
# name. Add it to the class.
1170
attr[attrname] = (dbus_service_property
1171
(alt_interface,
1172
attribute._dbus_signature,
1173
attribute._dbus_access,
1174
attribute
1175
._dbus_get_args_options
1176
["byte_arrays"])
1177
(types.FunctionType
1178
(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1184
attr[attrname] = (dbus_service_property(
1185
alt_interface, attribute._dbus_signature,
1186
attribute._dbus_access,
1187
attribute._dbus_get_args_options
1188
["byte_arrays"])
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1183
1195
# Copy annotations, if any
1184
1196
try:
1185
attr[attrname]._dbus_annotations = (
1186
dict(attribute._dbus_annotations))
1197
attr[attrname]._dbus_annotations = dict(
1198
attribute._dbus_annotations)
1187
1199
except AttributeError:
1188
1200
pass
1189
1201
# Is this a D-Bus interface?
1192
1204
# object. Decorate it to be a new D-Bus interface
1193
1205
# with the alternate D-Bus interface name. Add it
1194
1206
# to the class.
1195
attr[attrname] = (dbus_interface_annotations
1196
(alt_interface)
1197
(types.FunctionType
1198
(attribute.func_code,
1199
attribute.func_globals,
1200
attribute.func_name,
1201
attribute.func_defaults,
1202
attribute.func_closure)))
1207
attr[attrname] = (
1208
dbus_interface_annotations(alt_interface)
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1203
1214
if deprecate:
1204
1215
# Deprecate all alternate interfaces
1205
iname="_AlternateDBusNames_interface_annotation{0}"
1216
iname="_AlternateDBusNames_interface_annotation{}"
1206
1217
for interface_name in interface_names:
1218
1207
1219
@dbus_interface_annotations(interface_name)
1208
1220
def func(self):
1209
1221
return { "org.freedesktop.DBus.Deprecated":
1210
"true" }
1222
"true" }
1211
1223
# Find an unused name
1212
1224
for aname in (iname.format(i)
1213
1225
for i in itertools.count()):
1217
1229
if interface_names:
1218
1230
# Replace the class with a new subclass of it with
1219
1231
# methods, signals, etc. as created above.
1220
cls = type(b"{0}Alternate".format(cls.__name__),
1221
(cls,), attr)
1232
cls = type(b"{}Alternate".format(cls.__name__),
1233
(cls, ), attr)
1222
1234
return cls
1235
1223
1236
return wrapper
1224
1237
1225
1238
1226
1239
@alternate_dbus_interfaces({"se.recompile.Mandos":
1227
"se.bsnet.fukt.Mandos"})
1240
"se.bsnet.fukt.Mandos"})
1228
1241
class ClientDBus(Client, DBusObjectWithProperties):
1229
1242
"""A Client class using D-Bus
1230
1243
1234
1247
"""
1235
1248
1236
1249
runtime_expansions = (Client.runtime_expansions
1237
+ ("dbus_object_path",))
1250
+ ("dbus_object_path", ))
1251
1252
_interface = "se.recompile.Mandos.Client"
1238
1253
1239
1254
# dbus.service.Object doesn't use super(), so we can't either.
1240
1255
1243
1258
Client.__init__(self, *args, **kwargs)
1244
1259
# Only now, when this client is initialized, can it show up on
1245
1260
# the D-Bus
1246
client_object_name = unicode(self.name).translate(
1261
client_object_name = str(self.name).translate(
1247
1262
{ord("."): ord("_"),
1248
1263
ord("-"): ord("_")})
1249
self.dbus_object_path = (dbus.ObjectPath
1250
("/clients/" + client_object_name))
1264
self.dbus_object_path = dbus.ObjectPath(
1265
"/clients/" + client_object_name)
1251
1266
DBusObjectWithProperties.__init__(self, self.bus,
1252
1267
self.dbus_object_path)
1253
1268
1254
def notifychangeproperty(transform_func,
1255
dbus_name, type_func=lambda x: x,
1256
variant_level=1):
1269
def notifychangeproperty(transform_func, dbus_name,
1270
type_func=lambda x: x,
1271
variant_level=1,
1272
invalidate_only=False,
1273
_interface=_interface):
1257
1274
""" Modify a variable so that it's a property which announces
1258
1275
its changes to DBus.
1259
1276
1264
1281
to the D-Bus. Default: no transform
1265
1282
variant_level: D-Bus variant level. Default: 1
1266
1283
"""
1267
attrname = "_{0}".format(dbus_name)
1284
attrname = "_{}".format(dbus_name)
1285
1268
1286
def setter(self, value):
1269
1287
if hasattr(self, "dbus_object_path"):
1270
1288
if (not hasattr(self, attrname) or
1271
1289
type_func(getattr(self, attrname, None))
1272
1290
!= type_func(value)):
1273
dbus_value = transform_func(type_func(value),
1274
variant_level
1275
=variant_level)
1276
self.PropertyChanged(dbus.String(dbus_name),
1277
dbus_value)
1291
if invalidate_only:
1292
self.PropertiesChanged(
1293
_interface, dbus.Dictionary(),
1294
dbus.Array((dbus_name, )))
1295
else:
1296
dbus_value = transform_func(
1297
type_func(value),
1298
variant_level = variant_level)
1299
self.PropertyChanged(dbus.String(dbus_name),
1300
dbus_value)
1301
self.PropertiesChanged(
1302
_interface,
1303
dbus.Dictionary({ dbus.String(dbus_name):
1304
dbus_value }),
1305
dbus.Array())
1278
1306
setattr(self, attrname, value)
1279
1307
1280
1308
return property(lambda self: getattr(self, attrname), setter)
1286
1314
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1287
1315
last_enabled = notifychangeproperty(datetime_to_dbus,
1288
1316
"LastEnabled")
1289
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1290
type_func = lambda checker:
1291
checker is not None)
1317
checker = notifychangeproperty(
1318
dbus.Boolean, "CheckerRunning",
1319
type_func = lambda checker: checker is not None)
1292
1320
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1293
1321
"LastCheckedOK")
1294
1322
last_checker_status = notifychangeproperty(dbus.Int16,
1297
1325
datetime_to_dbus, "LastApprovalRequest")
1298
1326
approved_by_default = notifychangeproperty(dbus.Boolean,
1299
1327
"ApprovedByDefault")
1300
approval_delay = notifychangeproperty(dbus.UInt64,
1301
"ApprovalDelay",
1302
type_func =
1303
timedelta_to_milliseconds)
1328
approval_delay = notifychangeproperty(
1329
dbus.UInt64, "ApprovalDelay",
1330
type_func = lambda td: td.total_seconds() * 1000)
1304
1331
approval_duration = notifychangeproperty(
1305
1332
dbus.UInt64, "ApprovalDuration",
1306
type_func = timedelta_to_milliseconds)
1333
type_func = lambda td: td.total_seconds() * 1000)
1307
1334
host = notifychangeproperty(dbus.String, "Host")
1308
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1309
type_func =
1310
timedelta_to_milliseconds)
1335
timeout = notifychangeproperty(
1336
dbus.UInt64, "Timeout",
1337
type_func = lambda td: td.total_seconds() * 1000)
1311
1338
extended_timeout = notifychangeproperty(
1312
1339
dbus.UInt64, "ExtendedTimeout",
1313
type_func = timedelta_to_milliseconds)
1314
interval = notifychangeproperty(dbus.UInt64,
1315
"Interval",
1316
type_func =
1317
timedelta_to_milliseconds)
1340
type_func = lambda td: td.total_seconds() * 1000)
1341
interval = notifychangeproperty(
1342
dbus.UInt64, "Interval",
1343
type_func = lambda td: td.total_seconds() * 1000)
1318
1344
checker_command = notifychangeproperty(dbus.String, "Checker")
1345
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1346
invalidate_only=True)
1319
1347
1320
1348
del notifychangeproperty
1321
1349
1328
1356
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1329
1357
Client.__del__(self, *args, **kwargs)
1330
1358
1331
def checker_callback(self, pid, condition, command,
1332
*args, **kwargs):
1333
self.checker_callback_tag = None
1334
self.checker = None
1335
if os.WIFEXITED(condition):
1336
exitstatus = os.WEXITSTATUS(condition)
1359
def checker_callback(self, source, condition,
1360
connection, command, *args, **kwargs):
1361
ret = Client.checker_callback(self, source, condition,
1362
connection, command, *args,
1363
**kwargs)
1364
exitstatus = self.last_checker_status
1365
if exitstatus >= 0:
1337
1366
# Emit D-Bus signal
1338
1367
self.CheckerCompleted(dbus.Int16(exitstatus),
1339
dbus.Int64(condition),
1368
dbus.Int64(0),
1340
1369
dbus.String(command))
1341
1370
else:
1342
1371
# Emit D-Bus signal
1343
1372
self.CheckerCompleted(dbus.Int16(-1),
1344
dbus.Int64(condition),
1373
dbus.Int64(
1374
self.last_checker_signal),
1345
1375
dbus.String(command))
1346
1347
return Client.checker_callback(self, pid, condition, command,
1348
*args, **kwargs)
1376
return ret
1349
1377
1350
1378
def start_checker(self, *args, **kwargs):
1351
old_checker = self.checker
1352
if self.checker is not None:
1353
old_checker_pid = self.checker.pid
1354
else:
1355
old_checker_pid = None
1379
old_checker_pid = getattr(self.checker, "pid", None)
1356
1380
r = Client.start_checker(self, *args, **kwargs)
1357
1381
# Only if new checker process was started
1358
1382
if (self.checker is not None
1367
1391
1368
1392
def approve(self, value=True):
1369
1393
self.approved = value
1370
gobject.timeout_add(timedelta_to_milliseconds
1371
(self.approval_duration),
1372
self._reset_approved)
1394
gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
* 1000), self._reset_approved)
1373
1396
self.send_changedstate()
1374
1397
1375
1398
## D-Bus methods, signals & properties
1376
_interface = "se.recompile.Mandos.Client"
1377
1399
1378
1400
## Interfaces
1379
1401
1380
@dbus_interface_annotations(_interface)
1381
def _foo(self):
1382
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1383
"false"}
1384
1385
1402
## Signals
1386
1403
1387
1404
# CheckerCompleted - signal
1397
1414
pass
1398
1415
1399
1416
# PropertyChanged - signal
1417
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1400
1418
@dbus.service.signal(_interface, signature="sv")
1401
1419
def PropertyChanged(self, property, value):
1402
1420
"D-Bus signal"
1466
1484
return dbus.Boolean(bool(self.approvals_pending))
1467
1485
1468
1486
# ApprovedByDefault - property
1469
@dbus_service_property(_interface, signature="b",
1487
@dbus_service_property(_interface,
1488
signature="b",
1470
1489
access="readwrite")
1471
1490
def ApprovedByDefault_dbus_property(self, value=None):
1472
1491
if value is None: # get
1474
1493
self.approved_by_default = bool(value)
1475
1494
1476
1495
# ApprovalDelay - property
1477
@dbus_service_property(_interface, signature="t",
1496
@dbus_service_property(_interface,
1497
signature="t",
1478
1498
access="readwrite")
1479
1499
def ApprovalDelay_dbus_property(self, value=None):
1480
1500
if value is None: # get
1481
return dbus.UInt64(self.approval_delay_milliseconds())
1501
return dbus.UInt64(self.approval_delay.total_seconds()
1502
* 1000)
1482
1503
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1483
1504
1484
1505
# ApprovalDuration - property
1485
@dbus_service_property(_interface, signature="t",
1506
@dbus_service_property(_interface,
1507
signature="t",
1486
1508
access="readwrite")
1487
1509
def ApprovalDuration_dbus_property(self, value=None):
1488
1510
if value is None: # get
1489
return dbus.UInt64(timedelta_to_milliseconds(
1490
self.approval_duration))
1511
return dbus.UInt64(self.approval_duration.total_seconds()
1512
* 1000)
1491
1513
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1492
1514
1493
1515
# Name - property
1501
1523
return dbus.String(self.fingerprint)
1502
1524
1503
1525
# Host - property
1504
@dbus_service_property(_interface, signature="s",
1526
@dbus_service_property(_interface,
1527
signature="s",
1505
1528
access="readwrite")
1506
1529
def Host_dbus_property(self, value=None):
1507
1530
if value is None: # get
1508
1531
return dbus.String(self.host)
1509
self.host = unicode(value)
1532
self.host = str(value)
1510
1533
1511
1534
# Created - property
1512
1535
@dbus_service_property(_interface, signature="s", access="read")
1519
1542
return datetime_to_dbus(self.last_enabled)
1520
1543
1521
1544
# Enabled - property
1522
@dbus_service_property(_interface, signature="b",
1545
@dbus_service_property(_interface,
1546
signature="b",
1523
1547
access="readwrite")
1524
1548
def Enabled_dbus_property(self, value=None):
1525
1549
if value is None: # get
1530
1554
self.disable()
1531
1555
1532
1556
# LastCheckedOK - property
1533
@dbus_service_property(_interface, signature="s",
1557
@dbus_service_property(_interface,
1558
signature="s",
1534
1559
access="readwrite")
1535
1560
def LastCheckedOK_dbus_property(self, value=None):
1536
1561
if value is not None:
1539
1564
return datetime_to_dbus(self.last_checked_ok)
1540
1565
1541
1566
# LastCheckerStatus - property
1542
@dbus_service_property(_interface, signature="n",
1543
access="read")
1567
@dbus_service_property(_interface, signature="n", access="read")
1544
1568
def LastCheckerStatus_dbus_property(self):
1545
1569
return dbus.Int16(self.last_checker_status)
1546
1570
1555
1579
return datetime_to_dbus(self.last_approval_request)
1556
1580
1557
1581
# Timeout - property
1558
@dbus_service_property(_interface, signature="t",
1582
@dbus_service_property(_interface,
1583
signature="t",
1559
1584
access="readwrite")
1560
1585
def Timeout_dbus_property(self, value=None):
1561
1586
if value is None: # get
1562
return dbus.UInt64(self.timeout_milliseconds())
1587
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1563
1588
old_timeout = self.timeout
1564
1589
self.timeout = datetime.timedelta(0, 0, 0, value)
1565
1590
# Reschedule disabling
1574
1599
is None):
1575
1600
return
1576
1601
gobject.source_remove(self.disable_initiator_tag)
1577
self.disable_initiator_tag = (
1578
gobject.timeout_add(
1579
timedelta_to_milliseconds(self.expires - now),
1580
self.disable))
1602
self.disable_initiator_tag = gobject.timeout_add(
1603
int((self.expires - now).total_seconds() * 1000),
1604
self.disable)
1581
1605
1582
1606
# ExtendedTimeout - property
1583
@dbus_service_property(_interface, signature="t",
1607
@dbus_service_property(_interface,
1608
signature="t",
1584
1609
access="readwrite")
1585
1610
def ExtendedTimeout_dbus_property(self, value=None):
1586
1611
if value is None: # get
1587
return dbus.UInt64(self.extended_timeout_milliseconds())
1612
return dbus.UInt64(self.extended_timeout.total_seconds()
1613
* 1000)
1588
1614
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1589
1615
1590
1616
# Interval - property
1591
@dbus_service_property(_interface, signature="t",
1617
@dbus_service_property(_interface,
1618
signature="t",
1592
1619
access="readwrite")
1593
1620
def Interval_dbus_property(self, value=None):
1594
1621
if value is None: # get
1595
return dbus.UInt64(self.interval_milliseconds())
1622
return dbus.UInt64(self.interval.total_seconds() * 1000)
1596
1623
self.interval = datetime.timedelta(0, 0, 0, value)
1597
1624
if getattr(self, "checker_initiator_tag", None) is None:
1598
1625
return
1599
1626
if self.enabled:
1600
1627
# Reschedule checker run
1601
1628
gobject.source_remove(self.checker_initiator_tag)
1602
self.checker_initiator_tag = (gobject.timeout_add
1603
(value, self.start_checker))
1604
self.start_checker() # Start one now, too
1629
self.checker_initiator_tag = gobject.timeout_add(
1630
value, self.start_checker)
1631
self.start_checker() # Start one now, too
1605
1632
1606
1633
# Checker - property
1607
@dbus_service_property(_interface, signature="s",
1634
@dbus_service_property(_interface,
1635
signature="s",
1608
1636
access="readwrite")
1609
1637
def Checker_dbus_property(self, value=None):
1610
1638
if value is None: # get
1611
1639
return dbus.String(self.checker_command)
1612
self.checker_command = unicode(value)
1640
self.checker_command = str(value)
1613
1641
1614
1642
# CheckerRunning - property
1615
@dbus_service_property(_interface, signature="b",
1643
@dbus_service_property(_interface,
1644
signature="b",
1616
1645
access="readwrite")
1617
1646
def CheckerRunning_dbus_property(self, value=None):
1618
1647
if value is None: # get
1628
1657
return self.dbus_object_path # is already a dbus.ObjectPath
1629
1658
1630
1659
# Secret = property
1631
@dbus_service_property(_interface, signature="ay",
1632
access="write", byte_arrays=True)
1660
@dbus_service_property(_interface,
1661
signature="ay",
1662
access="write",
1663
byte_arrays=True)
1633
1664
def Secret_dbus_property(self, value):
1634
self.secret = str(value)
1665
self.secret = bytes(value)
1635
1666
1636
1667
del _interface
1637
1668
1641
1672
self._pipe = child_pipe
1642
1673
self._pipe.send(('init', fpr, address))
1643
1674
if not self._pipe.recv():
1644
raise KeyError()
1675
raise KeyError(fpr)
1645
1676
1646
1677
def __getattribute__(self, name):
1647
1678
if name == '_pipe':
1651
1682
if data[0] == 'data':
1652
1683
return data[1]
1653
1684
if data[0] == 'function':
1685
1654
1686
def func(*args, **kwargs):
1655
1687
self._pipe.send(('funcall', name, args, kwargs))
1656
1688
return self._pipe.recv()[1]
1689
1657
1690
return func
1658
1691
1659
1692
def __setattr__(self, name, value):
1671
1704
def handle(self):
1672
1705
with contextlib.closing(self.server.child_pipe) as child_pipe:
1673
1706
logger.info("TCP connection from: %s",
1674
unicode(self.client_address))
1707
str(self.client_address))
1675
1708
logger.debug("Pipe FD: %d",
1676
1709
self.server.child_pipe.fileno())
1677
1710
1678
session = (gnutls.connection
1679
.ClientSession(self.request,
1680
gnutls.connection
1681
.X509Credentials()))
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1682
1713
1683
1714
# Note: gnutls.connection.X509Credentials is really a
1684
1715
# generic GnuTLS certificate credentials object so long as
1693
1724
priority = self.server.gnutls_priority
1694
1725
if priority is None:
1695
1726
priority = "NORMAL"
1696
(gnutls.library.functions
1697
.gnutls_priority_set_direct(session._c_object,
1698
priority, None))
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
1699
1729
1700
1730
# Start communication using the Mandos protocol
1701
1731
# Get protocol number
1721
1751
approval_required = False
1722
1752
try:
1723
1753
try:
1724
fpr = self.fingerprint(self.peer_certificate
1725
(session))
1754
fpr = self.fingerprint(
1755
self.peer_certificate(session))
1726
1756
except (TypeError,
1727
1757
gnutls.errors.GNUTLSError) as error:
1728
1758
logger.warning("Bad certificate: %s", error)
1743
1773
while True:
1744
1774
if not client.enabled:
1745
1775
logger.info("Client %s is disabled",
1746
client.name)
1776
client.name)
1747
1777
if self.server.use_dbus:
1748
1778
# Emit D-Bus signal
1749
1779
client.Rejected("Disabled")
1758
1788
if self.server.use_dbus:
1759
1789
# Emit D-Bus signal
1760
1790
client.NeedApproval(
1761
client.approval_delay_milliseconds(),
1762
client.approved_by_default)
1791
client.approval_delay.total_seconds()
1792
* 1000, client.approved_by_default)
1763
1793
else:
1764
1794
logger.warning("Client %s was not approved",
1765
1795
client.name)
1771
1801
#wait until timeout or approved
1772
1802
time = datetime.datetime.now()
1773
1803
client.changedstate.acquire()
1774
client.changedstate.wait(
1775
float(timedelta_to_milliseconds(delay)
1776
/ 1000))
1804
client.changedstate.wait(delay.total_seconds())
1777
1805
client.changedstate.release()
1778
1806
time2 = datetime.datetime.now()
1779
1807
if (time2 - time) >= delay:
1798
1826
logger.warning("gnutls send failed",
1799
1827
exc_info=error)
1800
1828
return
1801
logger.debug("Sent: %d, remaining: %d",
1802
sent, len(client.secret)
1803
- (sent_size + sent))
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1831
+ sent))
1804
1832
sent_size += sent
1805
1833
1806
1834
logger.info("Sending secret to %s", client.name)
1823
1851
def peer_certificate(session):
1824
1852
"Return the peer's OpenPGP certificate as a bytestring"
1825
1853
# If not an OpenPGP certificate...
1826
if (gnutls.library.functions
1827
.gnutls_certificate_type_get(session._c_object)
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
session._c_object)
1828
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1829
1857
# ...do the normal thing
1830
1858
return session.peer_certificate
1844
1872
def fingerprint(openpgp):
1845
1873
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1846
1874
# New GnuTLS "datum" with the OpenPGP public key
1847
datum = (gnutls.library.types
1848
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1849
ctypes.POINTER
1850
(ctypes.c_ubyte)),
1851
ctypes.c_uint(len(openpgp))))
1875
datum = gnutls.library.types.gnutls_datum_t(
1876
ctypes.cast(ctypes.c_char_p(openpgp),
1877
ctypes.POINTER(ctypes.c_ubyte)),
1878
ctypes.c_uint(len(openpgp)))
1852
1879
# New empty GnuTLS certificate
1853
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1854
(gnutls.library.functions
1855
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1882
ctypes.byref(crt))
1856
1883
# Import the OpenPGP public key into the certificate
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1859
gnutls.library.constants
1860
.GNUTLS_OPENPGP_FMT_RAW))
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1861
1887
# Verify the self signature in the key
1862
1888
crtverify = ctypes.c_uint()
1863
(gnutls.library.functions
1864
.gnutls_openpgp_crt_verify_self(crt, 0,
1865
ctypes.byref(crtverify)))
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
1866
1891
if crtverify.value != 0:
1867
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1868
raise (gnutls.errors.CertificateSecurityError
1869
("Verify failed"))
1893
raise gnutls.errors.CertificateSecurityError(
1894
"Verify failed")
1870
1895
# New buffer for the fingerprint
1871
1896
buf = ctypes.create_string_buffer(20)
1872
1897
buf_len = ctypes.c_size_t()
1873
1898
# Get the fingerprint from the certificate into the buffer
1874
(gnutls.library.functions
1875
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1876
ctypes.byref(buf_len)))
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1877
1901
# Deinit the certificate
1878
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1879
1903
# Convert the buffer to a Python bytestring
1885
1909
1886
1910
class MultiprocessingMixIn(object):
1887
1911
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1912
1888
1913
def sub_process_main(self, request, address):
1889
1914
try:
1890
1915
self.finish_request(request, address)
1902
1927
1903
1928
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1904
1929
""" adds a pipe to the MixIn """
1930
1905
1931
def process_request(self, request, client_address):
1906
1932
"""Overrides and wraps the original process_request().
1907
1933
1928
1954
interface: None or a network interface name (string)
1929
1955
use_ipv6: Boolean; to use IPv6 or not
1930
1956
"""
1957
1931
1958
def __init__(self, server_address, RequestHandlerClass,
1932
interface=None, use_ipv6=True, socketfd=None):
1959
interface=None,
1960
use_ipv6=True,
1961
socketfd=None):
1933
1962
"""If socketfd is set, use that file descriptor instead of
1934
1963
creating a new one with socket.socket().
1935
1964
"""
1976
2005
self.interface)
1977
2006
else:
1978
2007
try:
1979
self.socket.setsockopt(socket.SOL_SOCKET,
1980
SO_BINDTODEVICE,
1981
str(self.interface + '\0'))
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
1982
2011
except socket.error as error:
1983
2012
if error.errno == errno.EPERM:
1984
2013
logger.error("No permission to bind to"
2002
2031
self.server_address = (any_address,
2003
2032
self.server_address[1])
2004
2033
elif not self.server_address[1]:
2005
self.server_address = (self.server_address[0],
2006
0)
2034
self.server_address = (self.server_address[0], 0)
2007
2035
# if self.interface:
2008
2036
# self.server_address = (self.server_address[0],
2009
2037
# 0, # port
2023
2051
2024
2052
Assumes a gobject.MainLoop event loop.
2025
2053
"""
2054
2026
2055
def __init__(self, server_address, RequestHandlerClass,
2027
interface=None, use_ipv6=True, clients=None,
2028
gnutls_priority=None, use_dbus=True, socketfd=None):
2056
interface=None,
2057
use_ipv6=True,
2058
clients=None,
2059
gnutls_priority=None,
2060
use_dbus=True,
2061
socketfd=None):
2029
2062
self.enabled = False
2030
2063
self.clients = clients
2031
2064
if self.clients is None:
2037
2070
interface = interface,
2038
2071
use_ipv6 = use_ipv6,
2039
2072
socketfd = socketfd)
2073
2040
2074
def server_activate(self):
2041
2075
if self.enabled:
2042
2076
return socketserver.TCPServer.server_activate(self)
2046
2080
2047
2081
def add_pipe(self, parent_pipe, proc):
2048
2082
# Call "handle_ipc" for both data and EOF events
2049
gobject.io_add_watch(parent_pipe.fileno(),
2050
gobject.IO_IN | gobject.IO_HUP,
2051
functools.partial(self.handle_ipc,
2052
parent_pipe =
2053
parent_pipe,
2054
proc = proc))
2083
gobject.io_add_watch(
2084
parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2086
functools.partial(self.handle_ipc,
2087
parent_pipe = parent_pipe,
2088
proc = proc))
2055
2089
2056
def handle_ipc(self, source, condition, parent_pipe=None,
2057
proc = None, client_object=None):
2090
def handle_ipc(self, source, condition,
2091
parent_pipe=None,
2092
proc = None,
2093
client_object=None):
2058
2094
# error, or the other end of multiprocessing.Pipe has closed
2059
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2060
2096
# Wait for other process to exit
2083
2119
parent_pipe.send(False)
2084
2120
return False
2085
2121
2086
gobject.io_add_watch(parent_pipe.fileno(),
2087
gobject.IO_IN | gobject.IO_HUP,
2088
functools.partial(self.handle_ipc,
2089
parent_pipe =
2090
parent_pipe,
2091
proc = proc,
2092
client_object =
2093
client))
2122
gobject.io_add_watch(
2123
parent_pipe.fileno(),
2124
gobject.IO_IN | gobject.IO_HUP,
2125
functools.partial(self.handle_ipc,
2126
parent_pipe = parent_pipe,
2127
proc = proc,
2128
client_object = client))
2094
2129
parent_pipe.send(True)
2095
2130
# remove the old hook in favor of the new above hook on
2096
2131
# same fileno
2102
2137
2103
2138
parent_pipe.send(('data', getattr(client_object,
2104
2139
funcname)(*args,
2105
**kwargs)))
2140
**kwargs)))
2106
2141
2107
2142
if command == 'getattr':
2108
2143
attrname = request[1]
2109
if callable(client_object.__getattribute__(attrname)):
2110
parent_pipe.send(('function',))
2144
if isinstance(client_object.__getattribute__(attrname),
2145
collections.Callable):
2146
parent_pipe.send(('function', ))
2111
2147
else:
2112
parent_pipe.send(('data', client_object
2113
.__getattribute__(attrname)))
2148
parent_pipe.send((
2149
'data', client_object.__getattribute__(attrname)))
2114
2150
2115
2151
if command == 'setattr':
2116
2152
attrname = request[1]
2147
2183
# avoid excessive use of external libraries.
2148
2184
2149
2185
# New type for defining tokens, syntax, and semantics all-in-one
2150
Token = collections.namedtuple("Token",
2151
("regexp", # To match token; if
2152
# "value" is not None,
2153
# must have a "group"
2154
# containing digits
2155
"value", # datetime.timedelta or
2156
# None
2157
"followers")) # Tokens valid after
2158
# this token
2186
Token = collections.namedtuple("Token", (
2187
"regexp", # To match token; if "value" is not None, must have
2188
# a "group" containing digits
2189
"value", # datetime.timedelta or None
2190
"followers")) # Tokens valid after this token
2159
2191
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2160
2192
# the "duration" ABNF definition in RFC 3339, Appendix A.
2161
2193
token_end = Token(re.compile(r"$"), None, frozenset())
2162
2194
token_second = Token(re.compile(r"(\d+)S"),
2163
2195
datetime.timedelta(seconds=1),
2164
frozenset((token_end,)))
2196
frozenset((token_end, )))
2165
2197
token_minute = Token(re.compile(r"(\d+)M"),
2166
2198
datetime.timedelta(minutes=1),
2167
2199
frozenset((token_second, token_end)))
2183
2215
frozenset((token_month, token_end)))
2184
2216
token_week = Token(re.compile(r"(\d+)W"),
2185
2217
datetime.timedelta(weeks=1),
2186
frozenset((token_end,)))
2218
frozenset((token_end, )))
2187
2219
token_duration = Token(re.compile(r"P"), None,
2188
2220
frozenset((token_year, token_month,
2189
2221
token_day, token_time,
2190
token_week))),
2222
token_week)))
2191
2223
# Define starting values
2192
2224
value = datetime.timedelta() # Value so far
2193
2225
found_token = None
2194
followers = frozenset(token_duration,) # Following valid tokens
2226
followers = frozenset((token_duration, )) # Following valid tokens
2195
2227
s = duration # String left to parse
2196
2228
# Loop until end token is found
2197
2229
while found_token is not token_end:
2214
2246
break
2215
2247
else:
2216
2248
# No currently valid tokens were found
2217
raise ValueError("Invalid RFC 3339 duration")
2249
raise ValueError("Invalid RFC 3339 duration: {!r}"
2250
.format(duration))
2218
2251
# End token found
2219
2252
return value
2220
2253
2244
2277
timevalue = datetime.timedelta(0)
2245
2278
for s in interval.split():
2246
2279
try:
2247
suffix = unicode(s[-1])
2280
suffix = s[-1]
2248
2281
value = int(s[:-1])
2249
2282
if suffix == "d":
2250
2283
delta = datetime.timedelta(value)
2257
2290
elif suffix == "w":
2258
2291
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2259
2292
else:
2260
raise ValueError("Unknown suffix {0!r}"
2261
.format(suffix))
2293
raise ValueError("Unknown suffix {!r}".format(suffix))
2262
2294
except IndexError as e:
2263
2295
raise ValueError(*(e.args))
2264
2296
timevalue += delta
2281
2313
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2282
2314
if not stat.S_ISCHR(os.fstat(null).st_mode):
2283
2315
raise OSError(errno.ENODEV,
2284
"{0} not a character device"
2316
"{} not a character device"
2285
2317
.format(os.devnull))
2286
2318
os.dup2(null, sys.stdin.fileno())
2287
2319
os.dup2(null, sys.stdout.fileno())
2297
2329
2298
2330
parser = argparse.ArgumentParser()
2299
2331
parser.add_argument("-v", "--version", action="version",
2300
version = "%(prog)s {0}".format(version),
2332
version = "%(prog)s {}".format(version),
2301
2333
help="show version number and exit")
2302
2334
parser.add_argument("-i", "--interface", metavar="IF",
2303
2335
help="Bind to interface IF")
2336
2368
help="Directory to save/restore state in")
2337
2369
parser.add_argument("--foreground", action="store_true",
2338
2370
help="Run in foreground", default=None)
2371
parser.add_argument("--no-zeroconf", action="store_false",
2372
dest="zeroconf", help="Do not use Zeroconf",
2373
default=None)
2339
2374
2340
2375
options = parser.parse_args()
2341
2376
2342
2377
if options.check:
2343
2378
import doctest
2344
doctest.testmod()
2345
sys.exit()
2379
fail_count, test_count = doctest.testmod()
2380
sys.exit(os.EX_OK if fail_count == 0 else 1)
2346
2381
2347
2382
# Default values for config file for server-global settings
2348
2383
server_defaults = { "interface": "",
2350
2385
"port": "",
2351
2386
"debug": "False",
2352
2387
"priority":
2353
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2388
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2389
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2354
2390
"servicename": "Mandos",
2355
2391
"use_dbus": "True",
2356
2392
"use_ipv6": "True",
2359
2395
"socket": "",
2360
2396
"statedir": "/var/lib/mandos",
2361
2397
"foreground": "False",
2362
}
2398
"zeroconf": "True",
2399
}
2363
2400
2364
2401
# Parse config file for server-global settings
2365
2402
server_config = configparser.SafeConfigParser(server_defaults)
2366
2403
del server_defaults
2367
server_config.read(os.path.join(options.configdir,
2368
"mandos.conf"))
2404
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2369
2405
# Convert the SafeConfigParser object to a dict
2370
2406
server_settings = server_config.defaults()
2371
2407
# Use the appropriate methods on the non-string config options
2389
2425
# Override the settings from the config file with command line
2390
2426
# options, if set.
2391
2427
for option in ("interface", "address", "port", "debug",
2392
"priority", "servicename", "configdir",
2393
"use_dbus", "use_ipv6", "debuglevel", "restore",
2394
"statedir", "socket", "foreground"):
2428
"priority", "servicename", "configdir", "use_dbus",
2429
"use_ipv6", "debuglevel", "restore", "statedir",
2430
"socket", "foreground", "zeroconf"):
2395
2431
value = getattr(options, option)
2396
2432
if value is not None:
2397
2433
server_settings[option] = value
2398
2434
del options
2399
2435
# Force all strings to be unicode
2400
2436
for option in server_settings.keys():
2401
if type(server_settings[option]) is str:
2402
server_settings[option] = unicode(server_settings[option])
2437
if isinstance(server_settings[option], bytes):
2438
server_settings[option] = (server_settings[option]
2439
.decode("utf-8"))
2403
2440
# Force all boolean options to be boolean
2404
2441
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2405
"foreground"):
2442
"foreground", "zeroconf"):
2406
2443
server_settings[option] = bool(server_settings[option])
2407
2444
# Debug implies foreground
2408
2445
if server_settings["debug"]:
2411
2448
2412
2449
##################################################################
2413
2450
2451
if (not server_settings["zeroconf"]
2452
and not (server_settings["port"]
2453
or server_settings["socket"] != "")):
2454
parser.error("Needs port or socket to work without Zeroconf")
2455
2414
2456
# For convenience
2415
2457
debug = server_settings["debug"]
2416
2458
debuglevel = server_settings["debuglevel"]
2419
2461
stored_state_path = os.path.join(server_settings["statedir"],
2420
2462
stored_state_file)
2421
2463
foreground = server_settings["foreground"]
2464
zeroconf = server_settings["zeroconf"]
2422
2465
2423
2466
if debug:
2424
2467
initlogger(debug, logging.DEBUG)
2430
2473
initlogger(debug, level)
2431
2474
2432
2475
if server_settings["servicename"] != "Mandos":
2433
syslogger.setFormatter(logging.Formatter
2434
('Mandos ({0}) [%(process)d]:'
2435
' %(levelname)s: %(message)s'
2436
.format(server_settings
2437
["servicename"])))
2476
syslogger.setFormatter(
2477
logging.Formatter('Mandos ({}) [%(process)d]:'
2478
' %(levelname)s: %(message)s'.format(
2479
server_settings["servicename"])))
2438
2480
2439
2481
# Parse config file with clients
2440
2482
client_config = configparser.SafeConfigParser(Client
2445
2487
global mandos_dbus_service
2446
2488
mandos_dbus_service = None
2447
2489
2448
tcp_server = MandosServer((server_settings["address"],
2449
server_settings["port"]),
2450
ClientHandler,
2451
interface=(server_settings["interface"]
2452
or None),
2453
use_ipv6=use_ipv6,
2454
gnutls_priority=
2455
server_settings["priority"],
2456
use_dbus=use_dbus,
2457
socketfd=(server_settings["socket"]
2458
or None))
2490
socketfd = None
2491
if server_settings["socket"] != "":
2492
socketfd = server_settings["socket"]
2493
tcp_server = MandosServer(
2494
(server_settings["address"], server_settings["port"]),
2495
ClientHandler,
2496
interface=(server_settings["interface"] or None),
2497
use_ipv6=use_ipv6,
2498
gnutls_priority=server_settings["priority"],
2499
use_dbus=use_dbus,
2500
socketfd=socketfd)
2459
2501
if not foreground:
2460
2502
pidfilename = "/run/mandos.pid"
2461
2503
if not os.path.isdir("/run/."):
2462
2504
pidfilename = "/var/run/mandos.pid"
2463
2505
pidfile = None
2464
2506
try:
2465
pidfile = open(pidfilename, "w")
2507
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2466
2508
except IOError as e:
2467
2509
logger.error("Could not open file %r", pidfilename,
2468
2510
exc_info=e)
2495
2537
def debug_gnutls(level, string):
2496
2538
logger.debug("GnuTLS: %s", string[:-1])
2497
2539
2498
(gnutls.library.functions
2499
.gnutls_global_set_log_function(debug_gnutls))
2540
gnutls.library.functions.gnutls_global_set_log_function(
2541
debug_gnutls)
2500
2542
2501
2543
# Redirect stdin so all checkers get /dev/null
2502
2544
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2522
2564
if use_dbus:
2523
2565
try:
2524
2566
bus_name = dbus.service.BusName("se.recompile.Mandos",
2525
bus, do_not_queue=True)
2526
old_bus_name = (dbus.service.BusName
2527
("se.bsnet.fukt.Mandos", bus,
2528
do_not_queue=True))
2529
except dbus.exceptions.NameExistsException as e:
2567
bus,
2568
do_not_queue=True)
2569
old_bus_name = dbus.service.BusName(
2570
"se.bsnet.fukt.Mandos", bus,
2571
do_not_queue=True)
2572
except dbus.exceptions.DBusException as e:
2530
2573
logger.error("Disabling D-Bus:", exc_info=e)
2531
2574
use_dbus = False
2532
2575
server_settings["use_dbus"] = False
2533
2576
tcp_server.use_dbus = False
2534
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2535
service = AvahiServiceToSyslog(name =
2536
server_settings["servicename"],
2537
servicetype = "_mandos._tcp",
2538
protocol = protocol, bus = bus)
2539
if server_settings["interface"]:
2540
service.interface = (if_nametoindex
2541
(str(server_settings["interface"])))
2577
if zeroconf:
2578
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2579
service = AvahiServiceToSyslog(
2580
name = server_settings["servicename"],
2581
servicetype = "_mandos._tcp",
2582
protocol = protocol,
2583
bus = bus)
2584
if server_settings["interface"]:
2585
service.interface = if_nametoindex(
2586
server_settings["interface"].encode("utf-8"))
2542
2587
2543
2588
global multiprocessing_manager
2544
2589
multiprocessing_manager = multiprocessing.Manager()
2563
2608
if server_settings["restore"]:
2564
2609
try:
2565
2610
with open(stored_state_path, "rb") as stored_state:
2566
clients_data, old_client_settings = (pickle.load
2567
(stored_state))
2611
clients_data, old_client_settings = pickle.load(
2612
stored_state)
2568
2613
os.remove(stored_state_path)
2569
2614
except IOError as e:
2570
2615
if e.errno == errno.ENOENT:
2571
logger.warning("Could not load persistent state: {0}"
2572
.format(os.strerror(e.errno)))
2616
logger.warning("Could not load persistent state:"
2617
" {}".format(os.strerror(e.errno)))
2573
2618
else:
2574
2619
logger.critical("Could not load persistent state:",
2575
2620
exc_info=e)
2576
2621
raise
2577
2622
except EOFError as e:
2578
2623
logger.warning("Could not load persistent state: "
2579
"EOFError:", exc_info=e)
2624
"EOFError:",
2625
exc_info=e)
2580
2626
2581
2627
with PGPEngine() as pgp:
2582
for client_name, client in clients_data.iteritems():
2628
for client_name, client in clients_data.items():
2583
2629
# Skip removed clients
2584
2630
if client_name not in client_settings:
2585
2631
continue
2594
2640
# For each value in new config, check if it
2595
2641
# differs from the old config value (Except for
2596
2642
# the "secret" attribute)
2597
if (name != "secret" and
2598
value != old_client_settings[client_name]
2599
[name]):
2643
if (name != "secret"
2644
and (value !=
2645
old_client_settings[client_name][name])):
2600
2646
client[name] = value
2601
2647
except KeyError:
2602
2648
pass
2603
2649
2604
2650
# Clients who has passed its expire date can still be
2605
# enabled if its last checker was successful. Clients
2651
# enabled if its last checker was successful. A Client
2606
2652
# whose checker succeeded before we stored its state is
2607
2653
# assumed to have successfully run all checkers during
2608
2654
# downtime.
2610
2656
if datetime.datetime.utcnow() >= client["expires"]:
2611
2657
if not client["last_checked_ok"]:
2612
2658
logger.warning(
2613
"disabling client {0} - Client never "
2614
"performed a successful checker"
2615
.format(client_name))
2659
"disabling client {} - Client never "
2660
"performed a successful checker".format(
2661
client_name))
2616
2662
client["enabled"] = False
2617
2663
elif client["last_checker_status"] != 0:
2618
2664
logger.warning(
2619
"disabling client {0} - Client "
2620
"last checker failed with error code {1}"
2621
.format(client_name,
2622
client["last_checker_status"]))
2665
"disabling client {} - Client last"
2666
" checker failed with error code"
2667
" {}".format(
2668
client_name,
2669
client["last_checker_status"]))
2623
2670
client["enabled"] = False
2624
2671
else:
2625
client["expires"] = (datetime.datetime
2626
.utcnow()
2627
+ client["timeout"])
2672
client["expires"] = (
2673
datetime.datetime.utcnow()
2674
+ client["timeout"])
2628
2675
logger.debug("Last checker succeeded,"
2629
" keeping {0} enabled"
2630
.format(client_name))
2676
" keeping {} enabled".format(
2677
client_name))
2631
2678
try:
2632
client["secret"] = (
2633
pgp.decrypt(client["encrypted_secret"],
2634
client_settings[client_name]
2635
["secret"]))
2679
client["secret"] = pgp.decrypt(
2680
client["encrypted_secret"],
2681
client_settings[client_name]["secret"])
2636
2682
except PGPError:
2637
2683
# If decryption fails, we use secret from new settings
2638
logger.debug("Failed to decrypt {0} old secret"
2639
.format(client_name))
2640
client["secret"] = (
2641
client_settings[client_name]["secret"])
2684
logger.debug("Failed to decrypt {} old secret".format(
2685
client_name))
2686
client["secret"] = (client_settings[client_name]
2687
["secret"])
2642
2688
2643
2689
# Add/remove clients based on new changes made to config
2644
2690
for client_name in (set(old_client_settings)
2649
2695
clients_data[client_name] = client_settings[client_name]
2650
2696
2651
2697
# Create all client objects
2652
for client_name, client in clients_data.iteritems():
2698
for client_name, client in clients_data.items():
2653
2699
tcp_server.clients[client_name] = client_class(
2654
name = client_name, settings = client,
2700
name = client_name,
2701
settings = client,
2655
2702
server_settings = server_settings)
2656
2703
2657
2704
if not tcp_server.clients:
2659
2706
2660
2707
if not foreground:
2661
2708
if pidfile is not None:
2709
pid = os.getpid()
2662
2710
try:
2663
2711
with pidfile:
2664
pid = os.getpid()
2665
pidfile.write(str(pid) + "\n".encode("utf-8"))
2712
print(pid, file=pidfile)
2666
2713
except IOError:
2667
2714
logger.error("Could not write to file %r with PID %d",
2668
2715
pidfilename, pid)
2673
2720
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2674
2721
2675
2722
if use_dbus:
2676
@alternate_dbus_interfaces({"se.recompile.Mandos":
2677
"se.bsnet.fukt.Mandos"})
2723
2724
@alternate_dbus_interfaces(
2725
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2678
2726
class MandosDBusService(DBusObjectWithProperties):
2679
2727
"""A D-Bus proxy object"""
2728
2680
2729
def __init__(self):
2681
2730
dbus.service.Object.__init__(self, bus, "/")
2731
2682
2732
_interface = "se.recompile.Mandos"
2683
2733
2684
2734
@dbus_interface_annotations(_interface)
2685
2735
def _foo(self):
2686
return { "org.freedesktop.DBus.Property"
2687
".EmitsChangedSignal":
2688
"false"}
2736
return {
2737
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2738
"false" }
2689
2739
2690
2740
@dbus.service.signal(_interface, signature="o")
2691
2741
def ClientAdded(self, objpath):
2705
2755
@dbus.service.method(_interface, out_signature="ao")
2706
2756
def GetAllClients(self):
2707
2757
"D-Bus method"
2708
return dbus.Array(c.dbus_object_path
2709
for c in
2758
return dbus.Array(c.dbus_object_path for c in
2710
2759
tcp_server.clients.itervalues())
2711
2760
2712
2761
@dbus.service.method(_interface,
2714
2763
def GetAllClientsWithProperties(self):
2715
2764
"D-Bus method"
2716
2765
return dbus.Dictionary(
2717
((c.dbus_object_path, c.GetAll(""))
2718
for c in tcp_server.clients.itervalues()),
2766
{ c.dbus_object_path: c.GetAll("")
2767
for c in tcp_server.clients.itervalues() },
2719
2768
signature="oa{sv}")
2720
2769
2721
2770
@dbus.service.method(_interface, in_signature="o")
2738
2787
2739
2788
def cleanup():
2740
2789
"Cleanup function; run on exit"
2741
service.cleanup()
2790
if zeroconf:
2791
service.cleanup()
2742
2792
2743
2793
multiprocessing.active_children()
2744
2794
wnull.close()
2758
2808
2759
2809
# A list of attributes that can not be pickled
2760
2810
# + secret.
2761
exclude = set(("bus", "changedstate", "secret",
2762
"checker", "server_settings"))
2763
for name, typ in (inspect.getmembers
2764
(dbus.service.Object)):
2811
exclude = { "bus", "changedstate", "secret",
2812
"checker", "server_settings" }
2813
for name, typ in inspect.getmembers(dbus.service
2814
.Object):
2765
2815
exclude.add(name)
2766
2816
2767
2817
client_dict["encrypted_secret"] = (client
2774
2824
del client_settings[client.name]["secret"]
2775
2825
2776
2826
try:
2777
with (tempfile.NamedTemporaryFile
2778
(mode='wb', suffix=".pickle", prefix='clients-',
2779
dir=os.path.dirname(stored_state_path),
2780
delete=False)) as stored_state:
2827
with tempfile.NamedTemporaryFile(
2828
mode='wb',
2829
suffix=".pickle",
2830
prefix='clients-',
2831
dir=os.path.dirname(stored_state_path),
2832
delete=False) as stored_state:
2781
2833
pickle.dump((clients, client_settings), stored_state)
2782
tempname=stored_state.name
2834
tempname = stored_state.name
2783
2835
os.rename(tempname, stored_state_path)
2784
2836
except (IOError, OSError) as e:
2785
2837
if not debug:
2788
2840
except NameError:
2789
2841
pass
2790
2842
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2791
logger.warning("Could not save persistent state: {0}"
2843
logger.warning("Could not save persistent state: {}"
2792
2844
.format(os.strerror(e.errno)))
2793
2845
else:
2794
2846
logger.warning("Could not save persistent state:",
2804
2856
client.disable(quiet=True)
2805
2857
if use_dbus:
2806
2858
# Emit D-Bus signal
2807
mandos_dbus_service.ClientRemoved(client
2808
.dbus_object_path,
2809
client.name)
2859
mandos_dbus_service.ClientRemoved(
2860
client.dbus_object_path, client.name)
2810
2861
client_settings.clear()
2811
2862
2812
2863
atexit.register(cleanup)
2823
2874
tcp_server.server_activate()
2824
2875
2825
2876
# Find out what port we got
2826
service.port = tcp_server.socket.getsockname()[1]
2877
if zeroconf:
2878
service.port = tcp_server.socket.getsockname()[1]
2827
2879
if use_ipv6:
2828
2880
logger.info("Now listening on address %r, port %d,"
2829
2881
" flowinfo %d, scope_id %d",
2835
2887
#service.interface = tcp_server.socket.getsockname()[3]
2836
2888
2837
2889
try:
2838
# From the Avahi example code
2839
try:
2840
service.activate()
2841
except dbus.exceptions.DBusException as error:
2842
logger.critical("D-Bus Exception", exc_info=error)
2843
cleanup()
2844
sys.exit(1)
2845
# End of Avahi example code
2890
if zeroconf:
2891
# From the Avahi example code
2892
try:
2893
service.activate()
2894
except dbus.exceptions.DBusException as error:
2895
logger.critical("D-Bus Exception", exc_info=error)
2896
cleanup()
2897
sys.exit(1)
2898
# End of Avahi example code
2846
2899
2847
2900
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2848
2901
lambda *args, **kwargs:
2863
2916
# Must run before the D-Bus bus name gets deregistered
2864
2917
cleanup()
2865
2918
2919
2866
2920
if __name__ == '__main__':
2867
2921
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0