186
352
dbus.UInt16(self.port),
187
353
avahi.string_array_to_txt_array(self.TXT))
188
354
self.group.Commit()
189
356
def entry_group_state_changed(self, state, error):
190
357
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
358
logger.debug("Avahi entry group state change: %i", state)
193
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
361
logger.debug("Zeroconf service established.")
195
362
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
363
logger.info("Zeroconf service name collision.")
198
365
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
201
raise AvahiGroupError(u"State changed: %s"
366
logger.critical("Avahi: Error in group state changed %s",
368
raise AvahiGroupError("State changed: {!s}".format(error))
203
370
def cleanup(self):
204
371
"""Derived from the Avahi example code"""
205
372
if self.group is not None:
375
except (dbus.exceptions.UnknownMethodException,
376
dbus.exceptions.DBusException):
207
378
self.group = None
208
def server_state_changed(self, state):
381
def server_state_changed(self, state, error=None):
209
382
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
383
logger.debug("Avahi server state change: %i", state)
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
390
if state in bad_states:
391
if bad_states[state] is not None:
393
logger.error(bad_states[state])
395
logger.error(bad_states[state] + ": %r", error)
213
397
elif state == avahi.SERVER_RUNNING:
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
405
return self.rename(remove=False)
407
logger.critical("D-Bus Exception", exc_info=error)
412
logger.debug("Unknown state: %r", state)
414
logger.debug("Unknown state: %r: %r", state, error)
215
416
def activate(self):
216
417
"""Derived from the Avahi example code"""
217
418
if self.server is None:
218
419
self.server = dbus.Interface(
219
420
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
421
avahi.DBUS_PATH_SERVER,
422
follow_name_owner_changes=True),
221
423
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
424
self.server.connect_to_signal("StateChanged",
425
self.server_state_changed)
224
426
self.server_state_changed(self.server.GetState())
429
class AvahiServiceToSyslog(AvahiService):
430
def rename(self, *args, **kwargs):
431
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
445
connection.send(func(*args, **kwargs))
227
448
class Client(object):
228
449
"""A representation of a client host served by this server.
231
name: string; from the config file, used in log messages and
233
fingerprint: string (40 or 32 hexadecimal digits); used to
234
uniquely identify the client
235
secret: bytestring; sent verbatim (over TLS) to client
236
host: string; available for use by the checker command
237
created: datetime.datetime(); (UTC) object creation
238
last_enabled: datetime.datetime(); (UTC)
240
last_checked_ok: datetime.datetime(); (UTC) or None
241
timeout: datetime.timedelta(); How long from last_checked_ok
242
until this client is invalid
243
interval: datetime.timedelta(); How often to start a new checker
244
disable_hook: If set, called by disable() as disable_hook(self)
452
approved: bool(); 'None' if not yet approved/disapproved
453
approval_delay: datetime.timedelta(); Time to wait for approval
454
approval_duration: datetime.timedelta(); Duration of one approval
245
455
checker: subprocess.Popen(); a running checker process used
246
456
to see if the client lives.
247
457
'None' if no process is running.
248
checker_initiator_tag: a gobject event source tag, or None
249
disable_initiator_tag: - '' -
250
checker_callback_tag: - '' -
251
checker_command: string; External command which is run to check if
252
client lives. %() expansions are done at
458
checker_callback_tag: a gobject event source tag, or None
459
checker_command: string; External command which is run to check
460
if client lives. %() expansions are done at
253
461
runtime with vars(self) as dict, so that for
254
462
instance %(name)s can be used in the command.
463
checker_initiator_tag: a gobject event source tag, or None
464
created: datetime.datetime(); (UTC) object creation
465
client_structure: Object describing what attributes a client has
466
and is used for storing the client at exit
255
467
current_checker_command: string; current running checker_command
468
disable_initiator_tag: a gobject event source tag, or None
470
fingerprint: string (40 or 32 hexadecimal digits); used to
471
uniquely identify the client
472
host: string; available for use by the checker command
473
interval: datetime.timedelta(); How often to start a new checker
474
last_approval_request: datetime.datetime(); (UTC) or None
475
last_checked_ok: datetime.datetime(); (UTC) or None
476
last_checker_status: integer between 0 and 255 reflecting exit
477
status of last checker. -1 reflects crashed
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
481
last_enabled: datetime.datetime(); (UTC) or None
482
name: string; from the config file, used in log messages and
484
secret: bytestring; sent verbatim (over TLS) to client
485
timeout: datetime.timedelta(); How long from last_checked_ok
486
until this client is disabled
487
extended_timeout: extra long timeout when secret has been sent
488
runtime_expansions: Allowed attributes for runtime expansion.
489
expires: datetime.datetime(); time (UTC) when a client will be
491
server_settings: The server_settings dict from main()
494
runtime_expansions = ("approval_delay", "approval_duration",
495
"created", "enabled", "expires",
496
"fingerprint", "host", "interval",
497
"last_approval_request", "last_checked_ok",
498
"last_enabled", "name", "timeout")
501
"extended_timeout": "PT15M",
503
"checker": "fping -q -- %%(host)s",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
265
def timeout_milliseconds(self):
266
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
269
def interval_milliseconds(self):
270
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
273
def __init__(self, name = None, disable_hook=None, config=None):
274
"""Note: the 'checker' key in 'config' sets the
275
'checker_command' attribute and *not* the 'checker'
512
def config_parser(config):
513
"""Construct a new dict of client settings of this form:
514
{ client_name: {setting_name: value, ...}, ...}
515
with exceptions for any special settings as defined above.
516
NOTE: Must be a pure function. Must return the same result
517
value given the same arguments.
520
for client_name in config.sections():
521
section = dict(config.items(client_name))
522
client = settings[client_name] = {}
524
client["host"] = section["host"]
525
# Reformat values from string types to Python types
526
client["approved_by_default"] = config.getboolean(
527
client_name, "approved_by_default")
528
client["enabled"] = config.getboolean(client_name,
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
534
client["fingerprint"] = (section["fingerprint"].upper()
536
if "secret" in section:
537
client["secret"] = section["secret"].decode("base64")
538
elif "secfile" in section:
539
with open(os.path.expanduser(os.path.expandvars
540
(section["secfile"])),
542
client["secret"] = secfile.read()
544
raise TypeError("No secret or secfile for section {}"
546
client["timeout"] = string_to_delta(section["timeout"])
547
client["extended_timeout"] = string_to_delta(
548
section["extended_timeout"])
549
client["interval"] = string_to_delta(section["interval"])
550
client["approval_delay"] = string_to_delta(
551
section["approval_delay"])
552
client["approval_duration"] = string_to_delta(
553
section["approval_duration"])
554
client["checker_command"] = section["checker"]
555
client["last_approval_request"] = None
556
client["last_checked_ok"] = None
557
client["last_checker_status"] = -2
561
def __init__(self, settings, name = None, server_settings=None):
280
logger.debug(u"Creating client %r", self.name)
281
# Uppercase and remove spaces from fingerprint for later
282
# comparison purposes with return value from the fingerprint()
284
self.fingerprint = (config[u"fingerprint"].upper()
286
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
290
with closing(open(os.path.expanduser
292
(config[u"secfile"])))) as secfile:
293
self.secret = secfile.read()
563
if server_settings is None:
565
self.server_settings = server_settings
566
# adding all client settings
567
for setting, value in settings.items():
568
setattr(self, setting, value)
571
if not hasattr(self, "last_enabled"):
572
self.last_enabled = datetime.datetime.utcnow()
573
if not hasattr(self, "expires"):
574
self.expires = (datetime.datetime.utcnow()
295
raise TypeError(u"No secret or secfile for client %s"
297
self.host = config.get(u"host", u"")
298
self.created = datetime.datetime.utcnow()
300
self.last_enabled = None
301
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
304
self.disable_hook = disable_hook
577
self.last_enabled = None
580
logger.debug("Creating client %r", self.name)
581
logger.debug(" Fingerprint: %s", self.fingerprint)
582
self.created = settings.get("created",
583
datetime.datetime.utcnow())
585
# attributes specific for this server instance
305
586
self.checker = None
306
587
self.checker_initiator_tag = None
307
588
self.disable_initiator_tag = None
308
589
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
590
self.current_checker_command = None
311
self.last_connect = None
592
self.approvals_pending = 0
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
597
if not attr.startswith("_")]
598
self.client_structure.append("client_structure")
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
602
if not name.startswith("_"):
603
self.client_structure.append(name)
605
# Send notice to process children that client state has changed
606
def send_changedstate(self):
607
with self.changedstate:
608
self.changedstate.notify_all()
313
610
def enable(self):
314
611
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
612
if getattr(self, "enabled", False):
316
613
# Already enabled
615
self.expires = datetime.datetime.utcnow() + self.timeout
318
617
self.last_enabled = datetime.datetime.utcnow()
319
# Schedule a new checker to be started an 'interval' from now,
320
# and every interval from then on.
321
self.checker_initiator_tag = (gobject.timeout_add
322
(self.interval_milliseconds(),
324
# Also start a new checker *right now*.
326
# Schedule a disable() when 'timeout' has passed
327
self.disable_initiator_tag = (gobject.timeout_add
328
(self.timeout_milliseconds(),
619
self.send_changedstate()
621
def disable(self, quiet=True):
333
622
"""Disable this client."""
334
623
if not getattr(self, "enabled", False):
336
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
626
logger.info("Disabling client %s", self.name)
627
if getattr(self, "disable_initiator_tag", None) is not None:
338
628
gobject.source_remove(self.disable_initiator_tag)
339
629
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
631
if getattr(self, "checker_initiator_tag", None) is not None:
341
632
gobject.source_remove(self.checker_initiator_tag)
342
633
self.checker_initiator_tag = None
343
634
self.stop_checker()
344
if self.disable_hook:
345
self.disable_hook(self)
346
635
self.enabled = False
637
self.send_changedstate()
347
638
# Do not run this again if called by a gobject.timeout_add
350
641
def __del__(self):
351
self.disable_hook = None
354
def checker_callback(self, pid, condition, command):
644
def init_checker(self):
645
# Schedule a new checker to be started an 'interval' from now,
646
# and every interval from then on.
647
if self.checker_initiator_tag is not None:
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
652
# Schedule a disable() when 'timeout' has passed
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
657
# Also start a new checker *right now*.
660
def checker_callback(self, source, condition, connection,
355
662
"""The checker has completed, so take appropriate actions."""
356
663
self.checker_callback_tag = None
357
664
self.checker = None
358
if os.WIFEXITED(condition):
359
exitstatus = os.WEXITSTATUS(condition)
361
logger.info(u"Checker for %(name)s succeeded",
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
672
if self.last_checker_status == 0:
673
logger.info("Checker for %(name)s succeeded",
363
675
self.checked_ok()
365
logger.info(u"Checker for %(name)s failed",
677
logger.info("Checker for %(name)s failed", vars(self))
368
logger.warning(u"Checker for %(name)s crashed?",
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
681
logger.warning("Checker for %(name)s crashed?",
371
685
def checked_ok(self):
372
"""Bump up the timeout for this client.
374
This should only be called when the client has been seen,
686
"""Assert that the client has been seen, alive and well."""
377
687
self.last_checked_ok = datetime.datetime.utcnow()
378
gobject.source_remove(self.disable_initiator_tag)
379
self.disable_initiator_tag = (gobject.timeout_add
380
(self.timeout_milliseconds(),
688
self.last_checker_status = 0
689
self.last_checker_signal = None
692
def bump_timeout(self, timeout=None):
693
"""Bump up the timeout for this client."""
695
timeout = self.timeout
696
if self.disable_initiator_tag is not None:
697
gobject.source_remove(self.disable_initiator_tag)
698
self.disable_initiator_tag = None
699
if getattr(self, "enabled", False):
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
702
self.expires = datetime.datetime.utcnow() + timeout
704
def need_approval(self):
705
self.last_approval_request = datetime.datetime.utcnow()
383
707
def start_checker(self):
384
708
"""Start a new checker subprocess if one is not running.
453
769
if self.checker_callback_tag:
454
770
gobject.source_remove(self.checker_callback_tag)
455
771
self.checker_callback_tag = None
456
if getattr(self, u"checker", None) is None:
772
if getattr(self, "checker", None) is None:
458
logger.debug(u"Stopping checker for %(name)s", vars(self))
774
logger.debug("Stopping checker for %(name)s", vars(self))
775
self.checker.terminate()
779
def dbus_service_property(dbus_interface,
783
"""Decorators for marking methods of a DBusObjectWithProperties to
784
become properties on the D-Bus.
786
The decorated method will be called with no arguments by "Get"
787
and with one argument by "Set".
789
The parameters, where they are supported, are the same as
790
dbus.service.method, except there is only "signature", since the
791
type from Get() and the type sent to Set() is the same.
793
# Encoding deeply encoded byte arrays is not supported yet by the
794
# "Set" method, so we fail early here:
795
if byte_arrays and signature != "ay":
796
raise ValueError("Byte arrays not supported for non-'ay'"
797
" signature {!r}".format(signature))
800
func._dbus_is_property = True
801
func._dbus_interface = dbus_interface
802
func._dbus_signature = signature
803
func._dbus_access = access
804
func._dbus_name = func.__name__
805
if func._dbus_name.endswith("_dbus_property"):
806
func._dbus_name = func._dbus_name[:-14]
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
813
def dbus_interface_annotations(dbus_interface):
814
"""Decorator for marking functions returning interface annotations
818
@dbus_interface_annotations("org.example.Interface")
819
def _foo(self): # Function name does not matter
820
return {"org.freedesktop.DBus.Deprecated": "true",
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
826
func._dbus_is_interface = True
827
func._dbus_interface = dbus_interface
828
func._dbus_name = dbus_interface
834
def dbus_annotations(annotations):
835
"""Decorator to annotate D-Bus methods, signals or properties
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
@dbus_service_property("org.example.Interface", signature="b",
843
def Property_dbus_property(self):
844
return dbus.Boolean(False)
848
func._dbus_annotations = annotations
854
class DBusPropertyException(dbus.exceptions.DBusException):
855
"""A base class for D-Bus property-related exceptions
860
class DBusPropertyAccessException(DBusPropertyException):
861
"""A property's access permissions disallows an operation.
866
class DBusPropertyNotFound(DBusPropertyException):
867
"""An attempt was made to access a non-existing property.
872
class DBusObjectWithProperties(dbus.service.Object):
873
"""A D-Bus object with properties.
875
Classes inheriting from this can use the dbus_service_property
876
decorator to expose methods as D-Bus properties. It exposes the
877
standard Get(), Set(), and GetAll() methods on the D-Bus.
881
def _is_dbus_thing(thing):
882
"""Returns a function testing if an attribute is a D-Bus thing
884
If called like _is_dbus_thing("method") it returns a function
885
suitable for use as predicate to inspect.getmembers().
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
890
def _get_all_dbus_things(self, thing):
891
"""Returns a generator of (name, attribute) pairs
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
894
athing.__get__(self))
895
for cls in self.__class__.__mro__
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
899
def _get_dbus_property(self, interface_name, property_name):
900
"""Returns a bound method if one exists which is a D-Bus
901
property with the specified name and interface.
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
906
if (value._dbus_name == property_name
907
and value._dbus_interface == interface_name):
908
return value.__get__(self)
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
917
def Get(self, interface_name, property_name):
918
"""Standard D-Bus property Get() method, see D-Bus standard.
920
prop = self._get_dbus_property(interface_name, property_name)
921
if prop._dbus_access == "write":
922
raise DBusPropertyAccessException(property_name)
924
if not hasattr(value, "variant_level"):
926
return type(value)(value, variant_level=value.variant_level+1)
928
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
929
def Set(self, interface_name, property_name, value):
930
"""Standard D-Bus property Set() method, see D-Bus standard.
932
prop = self._get_dbus_property(interface_name, property_name)
933
if prop._dbus_access == "read":
934
raise DBusPropertyAccessException(property_name)
935
if prop._dbus_get_args_options["byte_arrays"]:
936
# The byte_arrays option is not supported yet on
937
# signatures other than "ay".
938
if prop._dbus_signature != "ay":
939
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {!r}"
941
.format(prop._dbus_signature))
942
value = dbus.ByteArray(b''.join(chr(byte)
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
948
out_signature="a{sv}")
949
def GetAll(self, interface_name):
950
"""Standard D-Bus property GetAll() method, see D-Bus
953
Note: Will not include properties with access="write".
956
for name, prop in self._get_all_dbus_things("property"):
958
and interface_name != prop._dbus_interface):
959
# Interface non-empty but did not match
961
# Ignore write-only properties
962
if prop._dbus_access == "write":
965
if not hasattr(value, "variant_level"):
966
properties[name] = value
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
970
return dbus.Dictionary(properties, signature="sv")
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
def PropertiesChanged(self, interface_name, changed_properties,
974
invalidated_properties):
975
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
980
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
982
path_keyword='object_path',
983
connection_keyword='connection')
984
def Introspect(self, object_path, connection):
985
"""Overloading of standard D-Bus method.
987
Inserts property tags and interface annotation tags.
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
460
os.kill(self.checker.pid, signal.SIGTERM)
462
#if self.checker.poll() is None:
463
# os.kill(self.checker.pid, signal.SIGKILL)
464
except OSError, error:
465
if error.errno != errno.ESRCH: # No such process
469
def still_valid(self):
470
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
473
now = datetime.datetime.utcnow()
474
if self.last_checked_ok is None:
475
return now < (self.created + self.timeout)
477
return now < (self.last_checked_ok + self.timeout)
480
class ClientDBus(Client, dbus.service.Object):
992
document = xml.dom.minidom.parseString(xmlstring)
994
def make_tag(document, name, prop):
995
e = document.createElement("property")
996
e.setAttribute("name", name)
997
e.setAttribute("type", prop._dbus_signature)
998
e.setAttribute("access", prop._dbus_access)
1001
for if_tag in document.getElementsByTagName("interface"):
1003
for tag in (make_tag(document, name, prop)
1005
in self._get_all_dbus_things("property")
1006
if prop._dbus_interface
1007
== if_tag.getAttribute("name")):
1008
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1038
# Add the names to the return values for the
1039
# "org.freedesktop.DBus.Properties" methods
1040
if (if_tag.getAttribute("name")
1041
== "org.freedesktop.DBus.Properties"):
1042
for cn in if_tag.getElementsByTagName("method"):
1043
if cn.getAttribute("name") == "Get":
1044
for arg in cn.getElementsByTagName("arg"):
1045
if (arg.getAttribute("direction")
1047
arg.setAttribute("name", "value")
1048
elif cn.getAttribute("name") == "GetAll":
1049
for arg in cn.getElementsByTagName("arg"):
1050
if (arg.getAttribute("direction")
1052
arg.setAttribute("name", "props")
1053
xmlstring = document.toxml("utf-8")
1055
except (AttributeError, xml.dom.DOMException,
1056
xml.parsers.expat.ExpatError) as error:
1057
logger.error("Failed to override Introspection method",
1062
def datetime_to_dbus(dt, variant_level=0):
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
return dbus.String("", variant_level = variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
"""A class decorator; applied to a subclass of
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1072
interface names according to the "alt_interface_names" mapping.
1075
@alternate_dbus_interfaces({"org.example.Interface":
1076
"net.example.AlternateInterface"})
1077
class SampleDBusObject(dbus.service.Object):
1078
@dbus.service.method("org.example.Interface")
1079
def SampleDBusMethod():
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
reachable via two interfaces: "org.example.Interface" and
1084
"net.example.AlternateInterface", the latter of which will have
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
"true", unless "deprecate" is passed with a False value.
1088
This works for methods and signals, and also for D-Bus properties
1089
(from DBusObjectWithProperties) and interfaces (from the
1090
dbus_interface_annotations decorator).
1094
for orig_interface_name, alt_interface_name in (
1095
alt_interface_names.items()):
1097
interface_names = set()
1098
# Go though all attributes of the class
1099
for attrname, attribute in inspect.getmembers(cls):
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
1101
# with the wrong interface name
1102
if (not hasattr(attribute, "_dbus_interface")
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
1106
# Create an alternate D-Bus interface name based on
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1110
interface_names.add(alt_interface)
1111
# Is this a D-Bus signal?
1112
if getattr(attribute, "_dbus_is_signal", False):
1113
if sys.version_info.major == 2:
1114
# Extract the original non-method undecorated
1115
# function by black magic
1116
nonmethod_func = (dict(
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1121
nonmethod_func = attribute
1122
# Create a new, but exactly alike, function
1123
# object, and decorate it to be a new D-Bus signal
1124
# with the alternate D-Bus interface name
1125
if sys.version_info.major == 2:
1126
new_function = types.FunctionType(
1127
nonmethod_func.func_code,
1128
nonmethod_func.func_globals,
1129
nonmethod_func.func_name,
1130
nonmethod_func.func_defaults,
1131
nonmethod_func.func_closure)
1133
new_function = types.FunctionType(
1134
nonmethod_func.__code__,
1135
nonmethod_func.__globals__,
1136
nonmethod_func.__name__,
1137
nonmethod_func.__defaults__,
1138
nonmethod_func.__closure__)
1139
new_function = (dbus.service.signal(
1141
attribute._dbus_signature)(new_function))
1142
# Copy annotations, if any
1144
new_function._dbus_annotations = dict(
1145
attribute._dbus_annotations)
1146
except AttributeError:
1148
# Define a creator of a function to call both the
1149
# original and alternate functions, so both the
1150
# original and alternate signals gets sent when
1151
# the function is called
1152
def fixscope(func1, func2):
1153
"""This function is a scope container to pass
1154
func1 and func2 to the "call_both" function
1155
outside of its arguments"""
1157
def call_both(*args, **kwargs):
1158
"""This function will emit two D-Bus
1159
signals by calling func1 and func2"""
1160
func1(*args, **kwargs)
1161
func2(*args, **kwargs)
1164
# Create the "call_both" function and add it to
1166
attr[attrname] = fixscope(attribute, new_function)
1167
# Is this a D-Bus method?
1168
elif getattr(attribute, "_dbus_is_method", False):
1169
# Create a new, but exactly alike, function
1170
# object. Decorate it to be a new D-Bus method
1171
# with the alternate D-Bus interface name. Add it
1174
dbus.service.method(
1176
attribute._dbus_in_signature,
1177
attribute._dbus_out_signature)
1178
(types.FunctionType(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1183
# Copy annotations, if any
1185
attr[attrname]._dbus_annotations = dict(
1186
attribute._dbus_annotations)
1187
except AttributeError:
1189
# Is this a D-Bus property?
1190
elif getattr(attribute, "_dbus_is_property", False):
1191
# Create a new, but exactly alike, function
1192
# object, and decorate it to be a new D-Bus
1193
# property with the alternate D-Bus interface
1194
# name. Add it to the class.
1195
attr[attrname] = (dbus_service_property(
1196
alt_interface, attribute._dbus_signature,
1197
attribute._dbus_access,
1198
attribute._dbus_get_args_options
1200
(types.FunctionType(
1201
attribute.func_code,
1202
attribute.func_globals,
1203
attribute.func_name,
1204
attribute.func_defaults,
1205
attribute.func_closure)))
1206
# Copy annotations, if any
1208
attr[attrname]._dbus_annotations = dict(
1209
attribute._dbus_annotations)
1210
except AttributeError:
1212
# Is this a D-Bus interface?
1213
elif getattr(attribute, "_dbus_is_interface", False):
1214
# Create a new, but exactly alike, function
1215
# object. Decorate it to be a new D-Bus interface
1216
# with the alternate D-Bus interface name. Add it
1219
dbus_interface_annotations(alt_interface)
1220
(types.FunctionType(attribute.func_code,
1221
attribute.func_globals,
1222
attribute.func_name,
1223
attribute.func_defaults,
1224
attribute.func_closure)))
1226
# Deprecate all alternate interfaces
1227
iname="_AlternateDBusNames_interface_annotation{}"
1228
for interface_name in interface_names:
1230
@dbus_interface_annotations(interface_name)
1232
return { "org.freedesktop.DBus.Deprecated":
1234
# Find an unused name
1235
for aname in (iname.format(i)
1236
for i in itertools.count()):
1237
if aname not in attr:
1241
# Replace the class with a new subclass of it with
1242
# methods, signals, etc. as created above.
1243
cls = type(b"{}Alternate".format(cls.__name__),
1250
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
"se.bsnet.fukt.Mandos"})
1252
class ClientDBus(Client, DBusObjectWithProperties):
481
1253
"""A Client class using D-Bus
484
1256
dbus_object_path: dbus.ObjectPath
485
1257
bus: dbus.SystemBus()
1260
runtime_expansions = (Client.runtime_expansions
1261
+ ("dbus_object_path", ))
1263
_interface = "se.recompile.Mandos.Client"
487
1265
# dbus.service.Object doesn't use super(), so we can't either.
489
1267
def __init__(self, bus = None, *args, **kwargs):
491
1269
Client.__init__(self, *args, **kwargs)
492
1270
# Only now, when this client is initialized, can it show up on
494
self.dbus_object_path = (dbus.ObjectPath
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
1272
client_object_name = str(self.name).translate(
1273
{ord("."): ord("_"),
1274
ord("-"): ord("_")})
1275
self.dbus_object_path = dbus.ObjectPath(
1276
"/clients/" + client_object_name)
1277
DBusObjectWithProperties.__init__(self, self.bus,
1278
self.dbus_object_path)
1280
def notifychangeproperty(transform_func, dbus_name,
1281
type_func=lambda x: x,
1283
invalidate_only=False,
1284
_interface=_interface):
1285
""" Modify a variable so that it's a property which announces
1286
its changes to DBus.
1288
transform_fun: Function that takes a value and a variant_level
1289
and transforms it to a D-Bus type.
1290
dbus_name: D-Bus name of the variable
1291
type_func: Function that transform the value before sending it
1292
to the D-Bus. Default: no transform
1293
variant_level: D-Bus variant level. Default: 1
1295
attrname = "_{}".format(dbus_name)
1297
def setter(self, value):
1298
if hasattr(self, "dbus_object_path"):
1299
if (not hasattr(self, attrname) or
1300
type_func(getattr(self, attrname, None))
1301
!= type_func(value)):
1303
self.PropertiesChanged(
1304
_interface, dbus.Dictionary(),
1305
dbus.Array((dbus_name, )))
1307
dbus_value = transform_func(
1309
variant_level = variant_level)
1310
self.PropertyChanged(dbus.String(dbus_name),
1312
self.PropertiesChanged(
1314
dbus.Dictionary({ dbus.String(dbus_name):
1317
setattr(self, attrname, value)
1319
return property(lambda self: getattr(self, attrname), setter)
1321
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1322
approvals_pending = notifychangeproperty(dbus.Boolean,
1325
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
last_enabled = notifychangeproperty(datetime_to_dbus,
1328
checker = notifychangeproperty(
1329
dbus.Boolean, "CheckerRunning",
1330
type_func = lambda checker: checker is not None)
1331
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1333
last_checker_status = notifychangeproperty(dbus.Int16,
1334
"LastCheckerStatus")
1335
last_approval_request = notifychangeproperty(
1336
datetime_to_dbus, "LastApprovalRequest")
1337
approved_by_default = notifychangeproperty(dbus.Boolean,
1338
"ApprovedByDefault")
1339
approval_delay = notifychangeproperty(
1340
dbus.UInt64, "ApprovalDelay",
1341
type_func = lambda td: td.total_seconds() * 1000)
1342
approval_duration = notifychangeproperty(
1343
dbus.UInt64, "ApprovalDuration",
1344
type_func = lambda td: td.total_seconds() * 1000)
1345
host = notifychangeproperty(dbus.String, "Host")
1346
timeout = notifychangeproperty(
1347
dbus.UInt64, "Timeout",
1348
type_func = lambda td: td.total_seconds() * 1000)
1349
extended_timeout = notifychangeproperty(
1350
dbus.UInt64, "ExtendedTimeout",
1351
type_func = lambda td: td.total_seconds() * 1000)
1352
interval = notifychangeproperty(
1353
dbus.UInt64, "Interval",
1354
type_func = lambda td: td.total_seconds() * 1000)
1355
checker_command = notifychangeproperty(dbus.String, "Checker")
1356
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
invalidate_only=True)
1359
del notifychangeproperty
528
1361
def __del__(self, *args, **kwargs):
530
1363
self.remove_from_connection()
531
1364
except LookupError:
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
1366
if hasattr(DBusObjectWithProperties, "__del__"):
1367
DBusObjectWithProperties.__del__(self, *args, **kwargs)
535
1368
Client.__del__(self, *args, **kwargs)
537
def checker_callback(self, pid, condition, command,
539
self.checker_callback_tag = None
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
1370
def checker_callback(self, source, condition,
1371
connection, command, *args, **kwargs):
1372
ret = Client.checker_callback(self, source, condition,
1373
connection, command, *args,
1375
exitstatus = self.last_checker_status
546
1377
# Emit D-Bus signal
547
1378
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
1379
# This is specific to GNU libC
1380
dbus.Int64(exitstatus << 8),
549
1381
dbus.String(command))
551
1383
# Emit D-Bus signal
552
1384
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
1386
# This is specific to GNU libC
1388
| self.last_checker_signal),
554
1389
dbus.String(command))
556
return Client.checker_callback(self, pid, condition, command,
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
568
1392
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
573
old_checker_pid = None
1393
old_checker_pid = getattr(self.checker, "pid", None)
574
1394
r = Client.start_checker(self, *args, **kwargs)
575
1395
# Only if new checker process was started
576
1396
if (self.checker is not None
577
1397
and old_checker_pid != self.checker.pid):
578
1398
# Emit D-Bus signal
579
1399
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
594
## D-Bus methods & signals
595
_interface = u"se.bsnet.fukt.Mandos.Client"
598
@dbus.service.method(_interface)
600
return self.checked_ok()
1402
def _reset_approved(self):
1403
self.approved = None
1406
def approve(self, value=True):
1407
self.approved = value
1408
gobject.timeout_add(int(self.approval_duration.total_seconds()
1409
* 1000), self._reset_approved)
1410
self.send_changedstate()
1412
## D-Bus methods, signals & properties
602
1418
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
1419
@dbus.service.signal(_interface, signature="nxs")
604
1420
def CheckerCompleted(self, exitcode, waitstatus, command):
608
1424
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
1425
@dbus.service.signal(_interface, signature="s")
610
1426
def CheckerStarted(self, command):
614
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
616
def GetAllProperties(self):
618
return dbus.Dictionary({
619
dbus.String(u"name"):
620
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
622
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
624
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
631
if self.last_enabled is not None
632
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
634
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
638
if self.last_checked_ok is not None
639
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
641
dbus.UInt64(self.timeout_milliseconds(),
643
dbus.String(u"interval"):
644
dbus.UInt64(self.interval_milliseconds(),
646
dbus.String(u"checker"):
647
dbus.String(self.checker_command,
649
dbus.String(u"checker_running"):
650
dbus.Boolean(self.checker is not None,
652
dbus.String(u"object_path"):
653
dbus.ObjectPath(self.dbus_object_path,
657
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
662
1430
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
1431
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1432
@dbus.service.signal(_interface, signature="sv")
664
1433
def PropertyChanged(self, property, value):
668
# ReceivedSecret - signal
1437
# GotSecret - signal
669
1438
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
1439
def GotSecret(self):
1441
Is sent after a successful transfer of secret from the Mandos
1442
server to mandos-client
674
1446
# Rejected - signal
675
@dbus.service.signal(_interface)
1447
@dbus.service.signal(_interface, signature="s")
1448
def Rejected(self, reason):
680
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
682
def SetChecker(self, checker):
683
"D-Bus setter method"
684
self.checker_command = checker
686
self.PropertyChanged(dbus.String(u"checker"),
687
dbus.String(self.checker_command,
691
@dbus.service.method(_interface, in_signature=u"s")
692
def SetHost(self, host):
693
"D-Bus setter method"
696
self.PropertyChanged(dbus.String(u"host"),
697
dbus.String(self.host, variant_level=1))
699
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
701
def SetInterval(self, milliseconds):
702
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
704
self.PropertyChanged(dbus.String(u"interval"),
705
(dbus.UInt64(self.interval_milliseconds(),
709
@dbus.service.method(_interface, in_signature=u"ay",
711
def SetSecret(self, secret):
712
"D-Bus setter method"
713
self.secret = str(secret)
715
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
717
def SetTimeout(self, milliseconds):
718
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
720
self.PropertyChanged(dbus.String(u"timeout"),
721
(dbus.UInt64(self.timeout_milliseconds(),
1452
# NeedApproval - signal
1453
@dbus.service.signal(_interface, signature="tb")
1454
def NeedApproval(self, timeout, default):
1456
return self.need_approval()
1461
@dbus.service.method(_interface, in_signature="b")
1462
def Approve(self, value):
1465
# CheckedOK - method
1466
@dbus.service.method(_interface)
1467
def CheckedOK(self):
724
1470
# Enable - method
1471
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
725
1472
@dbus.service.method(_interface)
726
1473
def Enable(self):
730
1477
# StartChecker - method
1478
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
731
1479
@dbus.service.method(_interface)
732
1480
def StartChecker(self):
734
1482
self.start_checker()
736
1484
# Disable - method
1485
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
737
1486
@dbus.service.method(_interface)
738
1487
def Disable(self):
742
1491
# StopChecker - method
1492
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
743
1493
@dbus.service.method(_interface)
744
1494
def StopChecker(self):
745
1495
self.stop_checker()
1499
# ApprovalPending - property
1500
@dbus_service_property(_interface, signature="b", access="read")
1501
def ApprovalPending_dbus_property(self):
1502
return dbus.Boolean(bool(self.approvals_pending))
1504
# ApprovedByDefault - property
1505
@dbus_service_property(_interface,
1508
def ApprovedByDefault_dbus_property(self, value=None):
1509
if value is None: # get
1510
return dbus.Boolean(self.approved_by_default)
1511
self.approved_by_default = bool(value)
1513
# ApprovalDelay - property
1514
@dbus_service_property(_interface,
1517
def ApprovalDelay_dbus_property(self, value=None):
1518
if value is None: # get
1519
return dbus.UInt64(self.approval_delay.total_seconds()
1521
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1523
# ApprovalDuration - property
1524
@dbus_service_property(_interface,
1527
def ApprovalDuration_dbus_property(self, value=None):
1528
if value is None: # get
1529
return dbus.UInt64(self.approval_duration.total_seconds()
1531
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1535
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1536
@dbus_service_property(_interface, signature="s", access="read")
1537
def Name_dbus_property(self):
1538
return dbus.String(self.name)
1540
# Fingerprint - property
1542
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1543
@dbus_service_property(_interface, signature="s", access="read")
1544
def Fingerprint_dbus_property(self):
1545
return dbus.String(self.fingerprint)
1548
@dbus_service_property(_interface,
1551
def Host_dbus_property(self, value=None):
1552
if value is None: # get
1553
return dbus.String(self.host)
1554
self.host = str(value)
1556
# Created - property
1558
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1559
@dbus_service_property(_interface, signature="s", access="read")
1560
def Created_dbus_property(self):
1561
return datetime_to_dbus(self.created)
1563
# LastEnabled - property
1564
@dbus_service_property(_interface, signature="s", access="read")
1565
def LastEnabled_dbus_property(self):
1566
return datetime_to_dbus(self.last_enabled)
1568
# Enabled - property
1569
@dbus_service_property(_interface,
1572
def Enabled_dbus_property(self, value=None):
1573
if value is None: # get
1574
return dbus.Boolean(self.enabled)
1580
# LastCheckedOK - property
1581
@dbus_service_property(_interface,
1584
def LastCheckedOK_dbus_property(self, value=None):
1585
if value is not None:
1588
return datetime_to_dbus(self.last_checked_ok)
1590
# LastCheckerStatus - property
1591
@dbus_service_property(_interface, signature="n", access="read")
1592
def LastCheckerStatus_dbus_property(self):
1593
return dbus.Int16(self.last_checker_status)
1595
# Expires - property
1596
@dbus_service_property(_interface, signature="s", access="read")
1597
def Expires_dbus_property(self):
1598
return datetime_to_dbus(self.expires)
1600
# LastApprovalRequest - property
1601
@dbus_service_property(_interface, signature="s", access="read")
1602
def LastApprovalRequest_dbus_property(self):
1603
return datetime_to_dbus(self.last_approval_request)
1605
# Timeout - property
1606
@dbus_service_property(_interface,
1609
def Timeout_dbus_property(self, value=None):
1610
if value is None: # get
1611
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1612
old_timeout = self.timeout
1613
self.timeout = datetime.timedelta(0, 0, 0, value)
1614
# Reschedule disabling
1616
now = datetime.datetime.utcnow()
1617
self.expires += self.timeout - old_timeout
1618
if self.expires <= now:
1619
# The timeout has passed
1622
if (getattr(self, "disable_initiator_tag", None)
1625
gobject.source_remove(self.disable_initiator_tag)
1626
self.disable_initiator_tag = gobject.timeout_add(
1627
int((self.expires - now).total_seconds() * 1000),
1630
# ExtendedTimeout - property
1631
@dbus_service_property(_interface,
1634
def ExtendedTimeout_dbus_property(self, value=None):
1635
if value is None: # get
1636
return dbus.UInt64(self.extended_timeout.total_seconds()
1638
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1640
# Interval - property
1641
@dbus_service_property(_interface,
1644
def Interval_dbus_property(self, value=None):
1645
if value is None: # get
1646
return dbus.UInt64(self.interval.total_seconds() * 1000)
1647
self.interval = datetime.timedelta(0, 0, 0, value)
1648
if getattr(self, "checker_initiator_tag", None) is None:
1651
# Reschedule checker run
1652
gobject.source_remove(self.checker_initiator_tag)
1653
self.checker_initiator_tag = gobject.timeout_add(
1654
value, self.start_checker)
1655
self.start_checker() # Start one now, too
1657
# Checker - property
1658
@dbus_service_property(_interface,
1661
def Checker_dbus_property(self, value=None):
1662
if value is None: # get
1663
return dbus.String(self.checker_command)
1664
self.checker_command = str(value)
1666
# CheckerRunning - property
1667
@dbus_service_property(_interface,
1670
def CheckerRunning_dbus_property(self, value=None):
1671
if value is None: # get
1672
return dbus.Boolean(self.checker is not None)
1674
self.start_checker()
1678
# ObjectPath - property
1680
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
1681
"org.freedesktop.DBus.Deprecated": "true"})
1682
@dbus_service_property(_interface, signature="o", access="read")
1683
def ObjectPath_dbus_property(self):
1684
return self.dbus_object_path # is already a dbus.ObjectPath
1688
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
1690
@dbus_service_property(_interface,
1694
def Secret_dbus_property(self, value):
1695
self.secret = bytes(value)
1700
class ProxyClient(object):
1701
def __init__(self, child_pipe, fpr, address):
1702
self._pipe = child_pipe
1703
self._pipe.send(('init', fpr, address))
1704
if not self._pipe.recv():
1707
def __getattribute__(self, name):
1709
return super(ProxyClient, self).__getattribute__(name)
1710
self._pipe.send(('getattr', name))
1711
data = self._pipe.recv()
1712
if data[0] == 'data':
1714
if data[0] == 'function':
1716
def func(*args, **kwargs):
1717
self._pipe.send(('funcall', name, args, kwargs))
1718
return self._pipe.recv()[1]
1722
def __setattr__(self, name, value):
1724
return super(ProxyClient, self).__setattr__(name, value)
1725
self._pipe.send(('setattr', name, value))
750
1728
class ClientHandler(socketserver.BaseRequestHandler, object):
751
1729
"""A class to handle client connections.
754
1732
Note: This will run in its own forked process."""
756
1734
def handle(self):
757
logger.info(u"TCP connection from: %s",
758
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
1735
with contextlib.closing(self.server.child_pipe) as child_pipe:
1736
logger.info("TCP connection from: %s",
1737
str(self.client_address))
1738
logger.debug("Pipe FD: %d",
1739
self.server.child_pipe.fileno())
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
770
if int(line.strip().split()[0]) > 1:
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
1741
session = gnutls.connection.ClientSession(
1742
self.request, gnutls.connection .X509Credentials())
776
1744
# Note: gnutls.connection.X509Credentials is really a
777
1745
# generic GnuTLS certificate credentials object so long as
778
1746
# no X.509 keys are added to it. Therefore, we can use it
779
1747
# here despite using OpenPGP certificates.
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1749
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1750
# "+AES-256-CBC", "+SHA1",
1751
# "+COMP-NULL", "+CTYPE-OPENPGP",
785
1753
# Use a fallback default, since this MUST be set.
786
1754
priority = self.server.gnutls_priority
787
1755
if priority is None:
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
1757
gnutls.library.functions.gnutls_priority_set_direct(
1758
session._c_object, priority, None)
1760
# Start communication using the Mandos protocol
1761
# Get protocol number
1762
line = self.request.makefile().readline()
1763
logger.debug("Protocol version: %r", line)
1765
if int(line.strip().split()[0]) > 1:
1766
raise RuntimeError(line)
1767
except (ValueError, IndexError, RuntimeError) as error:
1768
logger.error("Unknown protocol version: %s", error)
1771
# Start GnuTLS connection
794
1773
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
1774
except gnutls.errors.GNUTLSError as error:
1775
logger.warning("Handshake failed: %s", error)
797
1776
# Do not run session.bye() here: the session is not
798
1777
# established. Just abandon the request.
800
logger.debug(u"Handshake succeeded")
1779
logger.debug("Handshake succeeded")
1781
approval_required = False
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
807
logger.debug(u"Fingerprint: %s", fpr)
1784
fpr = self.fingerprint(
1785
self.peer_certificate(session))
1787
gnutls.errors.GNUTLSError) as error:
1788
logger.warning("Bad certificate: %s", error)
1790
logger.debug("Fingerprint: %s", fpr)
1793
client = ProxyClient(child_pipe, fpr,
1794
self.client_address)
1798
if client.approval_delay:
1799
delay = client.approval_delay
1800
client.approvals_pending += 1
1801
approval_required = True
1804
if not client.enabled:
1805
logger.info("Client %s is disabled",
1807
if self.server.use_dbus:
1809
client.Rejected("Disabled")
1812
if client.approved or not client.approval_delay:
1813
#We are approved or approval is disabled
1815
elif client.approved is None:
1816
logger.info("Client %s needs approval",
1818
if self.server.use_dbus:
1820
client.NeedApproval(
1821
client.approval_delay.total_seconds()
1822
* 1000, client.approved_by_default)
1824
logger.warning("Client %s was not approved",
1826
if self.server.use_dbus:
1828
client.Rejected("Denied")
1831
#wait until timeout or approved
1832
time = datetime.datetime.now()
1833
client.changedstate.acquire()
1834
client.changedstate.wait(delay.total_seconds())
1835
client.changedstate.release()
1836
time2 = datetime.datetime.now()
1837
if (time2 - time) >= delay:
1838
if not client.approved_by_default:
1839
logger.warning("Client %s timed out while"
1840
" waiting for approval",
1842
if self.server.use_dbus:
1844
client.Rejected("Approval timed out")
1849
delay -= time2 - time
1852
while sent_size < len(client.secret):
1854
sent = session.send(client.secret[sent_size:])
1855
except gnutls.errors.GNUTLSError as error:
1856
logger.warning("gnutls send failed",
1859
logger.debug("Sent: %d, remaining: %d", sent,
1860
len(client.secret) - (sent_size
1864
logger.info("Sending secret to %s", client.name)
1865
# bump the timeout using extended_timeout
1866
client.bump_timeout(client.extended_timeout)
1867
if self.server.use_dbus:
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
814
ipc.write(u"NOTFOUND %s %s\n"
815
% (fpr, unicode(self.client_address)))
818
# Have to check if client.still_valid(), since it is
819
# possible that the client timed out while establishing
820
# the GnuTLS session.
821
if not client.still_valid():
822
ipc.write(u"INVALID %s\n" % client.name)
825
ipc.write(u"SENDING %s\n" % client.name)
827
while sent_size < len(client.secret):
828
sent = session.send(client.secret[sent_size:])
829
logger.debug(u"Sent: %d, remaining: %d",
830
sent, len(client.secret)
831
- (sent_size + sent))
1872
if approval_required:
1873
client.approvals_pending -= 1
1876
except gnutls.errors.GNUTLSError as error:
1877
logger.warning("GnuTLS bye failed",
836
1881
def peer_certificate(session):
837
1882
"Return the peer's OpenPGP certificate as a bytestring"
838
1883
# If not an OpenPGP certificate...
839
if (gnutls.library.functions
840
.gnutls_certificate_type_get(session._c_object)
1884
if (gnutls.library.functions.gnutls_certificate_type_get(
841
1886
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
1887
# ...do the normal thing
843
1888
return session.peer_certificate
983
2078
clients: set of Client objects
984
2079
gnutls_priority GnuTLS priority string
985
2080
use_dbus: Boolean; to emit D-Bus signals or not
986
clients: set of Client objects
987
gnutls_priority GnuTLS priority string
988
use_dbus: Boolean; to emit D-Bus signals or not
990
2082
Assumes a gobject.MainLoop event loop.
992
2085
def __init__(self, server_address, RequestHandlerClass,
993
interface=None, use_ipv6=True, clients=None,
994
gnutls_priority=None, use_dbus=True):
2089
gnutls_priority=None,
995
2092
self.enabled = False
996
2093
self.clients = clients
997
2094
if self.clients is None:
999
2096
self.use_dbus = use_dbus
1000
2097
self.gnutls_priority = gnutls_priority
1001
2098
IPv6_TCPServer.__init__(self, server_address,
1002
2099
RequestHandlerClass,
1003
2100
interface = interface,
1004
use_ipv6 = use_ipv6)
2101
use_ipv6 = use_ipv6,
2102
socketfd = socketfd)
1005
2104
def server_activate(self):
1006
2105
if self.enabled:
1007
2106
return socketserver.TCPServer.server_activate(self)
1008
2108
def enable(self):
1009
2109
self.enabled = True
1010
def add_pipe(self, pipe):
2111
def add_pipe(self, parent_pipe, proc):
1011
2112
# Call "handle_ipc" for both data and EOF events
1012
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1014
def handle_ipc(self, source, condition, file_objects={}):
1016
gobject.IO_IN: u"IN", # There is data to read.
1017
gobject.IO_OUT: u"OUT", # Data can be written (without
1019
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1020
gobject.IO_ERR: u"ERR", # Error condition.
1021
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1022
# broken, usually for pipes and
1025
conditions_string = ' | '.join(name
1027
condition_names.iteritems()
1028
if cond & condition)
1029
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1032
# Turn the pipe file descriptor into a Python file object
1033
if source not in file_objects:
1034
file_objects[source] = os.fdopen(source, u"r", 1)
1036
# Read a line from the file object
1037
cmdline = file_objects[source].readline()
1038
if not cmdline: # Empty line means end of file
1039
# close the IPC pipe
1040
file_objects[source].close()
1041
del file_objects[source]
1043
# Stop calling this function
1046
logger.debug(u"IPC command: %r", cmdline)
1048
# Parse and act on command
1049
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1051
if cmd == u"NOTFOUND":
1052
logger.warning(u"Client not found for fingerprint: %s",
1056
mandos_dbus_service.ClientNotFound(args)
1057
elif cmd == u"INVALID":
1058
for client in self.clients:
1059
if client.name == args:
1060
logger.warning(u"Client %s is invalid", args)
1066
logger.error(u"Unknown client %s is invalid", args)
1067
elif cmd == u"SENDING":
1068
for client in self.clients:
1069
if client.name == args:
1070
logger.info(u"Sending secret to %s", client.name)
1074
client.ReceivedSecret()
1077
logger.error(u"Sending secret to unknown client %s",
2113
gobject.io_add_watch(
2114
parent_pipe.fileno(),
2115
gobject.IO_IN | gobject.IO_HUP,
2116
functools.partial(self.handle_ipc,
2117
parent_pipe = parent_pipe,
2120
def handle_ipc(self, source, condition,
2123
client_object=None):
2124
# error, or the other end of multiprocessing.Pipe has closed
2125
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2126
# Wait for other process to exit
2130
# Read a request from the child
2131
request = parent_pipe.recv()
2132
command = request[0]
2134
if command == 'init':
2136
address = request[2]
2138
for c in self.clients.itervalues():
2139
if c.fingerprint == fpr:
2143
logger.info("Client not found for fingerprint: %s, ad"
2144
"dress: %s", fpr, address)
2147
mandos_dbus_service.ClientNotFound(fpr,
2149
parent_pipe.send(False)
2152
gobject.io_add_watch(
2153
parent_pipe.fileno(),
2154
gobject.IO_IN | gobject.IO_HUP,
2155
functools.partial(self.handle_ipc,
2156
parent_pipe = parent_pipe,
2158
client_object = client))
2159
parent_pipe.send(True)
2160
# remove the old hook in favor of the new above hook on
2163
if command == 'funcall':
2164
funcname = request[1]
2168
parent_pipe.send(('data', getattr(client_object,
2172
if command == 'getattr':
2173
attrname = request[1]
2174
if isinstance(client_object.__getattribute__(attrname),
2175
collections.Callable):
2176
parent_pipe.send(('function', ))
2179
'data', client_object.__getattribute__(attrname)))
2181
if command == 'setattr':
2182
attrname = request[1]
2184
setattr(client_object, attrname, value)
2189
def rfc3339_duration_to_delta(duration):
2190
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2192
>>> rfc3339_duration_to_delta("P7D")
2193
datetime.timedelta(7)
2194
>>> rfc3339_duration_to_delta("PT60S")
2195
datetime.timedelta(0, 60)
2196
>>> rfc3339_duration_to_delta("PT60M")
2197
datetime.timedelta(0, 3600)
2198
>>> rfc3339_duration_to_delta("PT24H")
2199
datetime.timedelta(1)
2200
>>> rfc3339_duration_to_delta("P1W")
2201
datetime.timedelta(7)
2202
>>> rfc3339_duration_to_delta("PT5M30S")
2203
datetime.timedelta(0, 330)
2204
>>> rfc3339_duration_to_delta("P1DT3M20S")
2205
datetime.timedelta(1, 200)
2208
# Parsing an RFC 3339 duration with regular expressions is not
2209
# possible - there would have to be multiple places for the same
2210
# values, like seconds. The current code, while more esoteric, is
2211
# cleaner without depending on a parsing library. If Python had a
2212
# built-in library for parsing we would use it, but we'd like to
2213
# avoid excessive use of external libraries.
2215
# New type for defining tokens, syntax, and semantics all-in-one
2216
Token = collections.namedtuple("Token", (
2217
"regexp", # To match token; if "value" is not None, must have
2218
# a "group" containing digits
2219
"value", # datetime.timedelta or None
2220
"followers")) # Tokens valid after this token
2221
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2222
# the "duration" ABNF definition in RFC 3339, Appendix A.
2223
token_end = Token(re.compile(r"$"), None, frozenset())
2224
token_second = Token(re.compile(r"(\d+)S"),
2225
datetime.timedelta(seconds=1),
2226
frozenset((token_end, )))
2227
token_minute = Token(re.compile(r"(\d+)M"),
2228
datetime.timedelta(minutes=1),
2229
frozenset((token_second, token_end)))
2230
token_hour = Token(re.compile(r"(\d+)H"),
2231
datetime.timedelta(hours=1),
2232
frozenset((token_minute, token_end)))
2233
token_time = Token(re.compile(r"T"),
2235
frozenset((token_hour, token_minute,
2237
token_day = Token(re.compile(r"(\d+)D"),
2238
datetime.timedelta(days=1),
2239
frozenset((token_time, token_end)))
2240
token_month = Token(re.compile(r"(\d+)M"),
2241
datetime.timedelta(weeks=4),
2242
frozenset((token_day, token_end)))
2243
token_year = Token(re.compile(r"(\d+)Y"),
2244
datetime.timedelta(weeks=52),
2245
frozenset((token_month, token_end)))
2246
token_week = Token(re.compile(r"(\d+)W"),
2247
datetime.timedelta(weeks=1),
2248
frozenset((token_end, )))
2249
token_duration = Token(re.compile(r"P"), None,
2250
frozenset((token_year, token_month,
2251
token_day, token_time,
2253
# Define starting values
2254
value = datetime.timedelta() # Value so far
2256
followers = frozenset((token_duration, )) # Following valid tokens
2257
s = duration # String left to parse
2258
# Loop until end token is found
2259
while found_token is not token_end:
2260
# Search for any currently valid tokens
2261
for token in followers:
2262
match = token.regexp.match(s)
2263
if match is not None:
2265
if token.value is not None:
2266
# Value found, parse digits
2267
factor = int(match.group(1), 10)
2268
# Add to value so far
2269
value += factor * token.value
2270
# Strip token from string
2271
s = token.regexp.sub("", s, 1)
2274
# Set valid next tokens
2275
followers = found_token.followers
1080
logger.error(u"Unknown IPC command: %r", cmdline)
1082
# Keep calling this function
2278
# No currently valid tokens were found
2279
raise ValueError("Invalid RFC 3339 duration: {!r}"
1086
2285
def string_to_delta(interval):
1087
2286
"""Parse a string and return a datetime.timedelta
1089
>>> string_to_delta(u'7d')
2288
>>> string_to_delta('7d')
1090
2289
datetime.timedelta(7)
1091
>>> string_to_delta(u'60s')
2290
>>> string_to_delta('60s')
1092
2291
datetime.timedelta(0, 60)
1093
>>> string_to_delta(u'60m')
2292
>>> string_to_delta('60m')
1094
2293
datetime.timedelta(0, 3600)
1095
>>> string_to_delta(u'24h')
2294
>>> string_to_delta('24h')
1096
2295
datetime.timedelta(1)
1097
>>> string_to_delta(u'1w')
2296
>>> string_to_delta('1w')
1098
2297
datetime.timedelta(7)
1099
>>> string_to_delta(u'5m 30s')
2298
>>> string_to_delta('5m 30s')
1100
2299
datetime.timedelta(0, 330)
2303
return rfc3339_duration_to_delta(interval)
1102
2307
timevalue = datetime.timedelta(0)
1103
2308
for s in interval.split():
1105
suffix = unicode(s[-1])
1106
2311
value = int(s[:-1])
1108
2313
delta = datetime.timedelta(value)
1109
elif suffix == u"s":
1110
2315
delta = datetime.timedelta(0, value)
1111
elif suffix == u"m":
1112
2317
delta = datetime.timedelta(0, 0, 0, 0, value)
1113
elif suffix == u"h":
1114
2319
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1115
elif suffix == u"w":
1116
2321
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1119
except (ValueError, IndexError):
2323
raise ValueError("Unknown suffix {!r}".format(suffix))
2324
except IndexError as e:
2325
raise ValueError(*(e.args))
1121
2326
timevalue += delta
1122
2327
return timevalue
1125
def if_nametoindex(interface):
1126
"""Call the C function if_nametoindex(), or equivalent
1128
Note: This function cannot accept a unicode string."""
1129
global if_nametoindex
1131
if_nametoindex = (ctypes.cdll.LoadLibrary
1132
(ctypes.util.find_library(u"c"))
1134
except (OSError, AttributeError):
1135
logger.warning(u"Doing if_nametoindex the hard way")
1136
def if_nametoindex(interface):
1137
"Get an interface index the hard way, i.e. using fcntl()"
1138
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1139
with closing(socket.socket()) as s:
1140
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1141
struct.pack(str(u"16s16x"),
1143
interface_index = struct.unpack(str(u"I"),
1145
return interface_index
1146
return if_nametoindex(interface)
1149
2330
def daemon(nochdir = False, noclose = False):
1150
2331
"""See daemon(3). Standard BSD Unix function.
1175
######################################################################
2357
##################################################################
1176
2358
# Parsing of options, both command line and config file
1178
parser = optparse.OptionParser(version = "%%prog %s" % version)
1179
parser.add_option("-i", u"--interface", type=u"string",
1180
metavar="IF", help=u"Bind to interface IF")
1181
parser.add_option("-a", u"--address", type=u"string",
1182
help=u"Address to listen for requests on")
1183
parser.add_option("-p", u"--port", type=u"int",
1184
help=u"Port number to receive requests on")
1185
parser.add_option("--check", action=u"store_true",
1186
help=u"Run self-test")
1187
parser.add_option("--debug", action=u"store_true",
1188
help=u"Debug mode; run in foreground and log to"
1190
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1191
u" priority string (see GnuTLS documentation)")
1192
parser.add_option("--servicename", type=u"string",
1193
metavar=u"NAME", help=u"Zeroconf service name")
1194
parser.add_option("--configdir", type=u"string",
1195
default=u"/etc/mandos", metavar=u"DIR",
1196
help=u"Directory to search for configuration"
1198
parser.add_option("--no-dbus", action=u"store_false",
1200
help=optparse.SUPPRESS_HELP) # XXX: Not done yet
1201
parser.add_option("--no-ipv6", action=u"store_false",
1202
dest=u"use_ipv6", help=u"Do not use IPv6")
1203
options = parser.parse_args()[0]
2360
parser = argparse.ArgumentParser()
2361
parser.add_argument("-v", "--version", action="version",
2362
version = "%(prog)s {}".format(version),
2363
help="show version number and exit")
2364
parser.add_argument("-i", "--interface", metavar="IF",
2365
help="Bind to interface IF")
2366
parser.add_argument("-a", "--address",
2367
help="Address to listen for requests on")
2368
parser.add_argument("-p", "--port", type=int,
2369
help="Port number to receive requests on")
2370
parser.add_argument("--check", action="store_true",
2371
help="Run self-test")
2372
parser.add_argument("--debug", action="store_true",
2373
help="Debug mode; run in foreground and log"
2374
" to terminal", default=None)
2375
parser.add_argument("--debuglevel", metavar="LEVEL",
2376
help="Debug level for stdout output")
2377
parser.add_argument("--priority", help="GnuTLS"
2378
" priority string (see GnuTLS documentation)")
2379
parser.add_argument("--servicename",
2380
metavar="NAME", help="Zeroconf service name")
2381
parser.add_argument("--configdir",
2382
default="/etc/mandos", metavar="DIR",
2383
help="Directory to search for configuration"
2385
parser.add_argument("--no-dbus", action="store_false",
2386
dest="use_dbus", help="Do not provide D-Bus"
2387
" system bus interface", default=None)
2388
parser.add_argument("--no-ipv6", action="store_false",
2389
dest="use_ipv6", help="Do not use IPv6",
2391
parser.add_argument("--no-restore", action="store_false",
2392
dest="restore", help="Do not restore stored"
2393
" state", default=None)
2394
parser.add_argument("--socket", type=int,
2395
help="Specify a file descriptor to a network"
2396
" socket to use instead of creating one")
2397
parser.add_argument("--statedir", metavar="DIR",
2398
help="Directory to save/restore state in")
2399
parser.add_argument("--foreground", action="store_true",
2400
help="Run in foreground", default=None)
2401
parser.add_argument("--no-zeroconf", action="store_false",
2402
dest="zeroconf", help="Do not use Zeroconf",
2405
options = parser.parse_args()
1205
2407
if options.check:
2409
fail_count, test_count = doctest.testmod()
2410
sys.exit(os.EX_OK if fail_count == 0 else 1)
1210
2412
# Default values for config file for server-global settings
1211
server_defaults = { u"interface": u"",
1216
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1217
u"servicename": u"Mandos",
1218
u"use_dbus": u"True",
1219
u"use_ipv6": u"True",
2413
server_defaults = { "interface": "",
2418
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2419
":+SIGN-DSA-SHA256",
2420
"servicename": "Mandos",
2426
"statedir": "/var/lib/mandos",
2427
"foreground": "False",
1222
2431
# Parse config file for server-global settings
1223
2432
server_config = configparser.SafeConfigParser(server_defaults)
1224
2433
del server_defaults
1225
server_config.read(os.path.join(options.configdir,
2434
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1227
2435
# Convert the SafeConfigParser object to a dict
1228
2436
server_settings = server_config.defaults()
1229
2437
# Use the appropriate methods on the non-string config options
1230
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1231
server_settings[option] = server_config.getboolean(u"DEFAULT",
2438
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2439
server_settings[option] = server_config.getboolean("DEFAULT",
1233
2441
if server_settings["port"]:
1234
server_settings["port"] = server_config.getint(u"DEFAULT",
2442
server_settings["port"] = server_config.getint("DEFAULT",
2444
if server_settings["socket"]:
2445
server_settings["socket"] = server_config.getint("DEFAULT",
2447
# Later, stdin will, and stdout and stderr might, be dup'ed
2448
# over with an opened os.devnull. But we don't want this to
2449
# happen with a supplied network socket.
2450
if 0 <= server_settings["socket"] <= 2:
2451
server_settings["socket"] = os.dup(server_settings
1236
2453
del server_config
1238
2455
# Override the settings from the config file with command line
1239
2456
# options, if set.
1240
for option in (u"interface", u"address", u"port", u"debug",
1241
u"priority", u"servicename", u"configdir",
1242
u"use_dbus", u"use_ipv6"):
2457
for option in ("interface", "address", "port", "debug",
2458
"priority", "servicename", "configdir", "use_dbus",
2459
"use_ipv6", "debuglevel", "restore", "statedir",
2460
"socket", "foreground", "zeroconf"):
1243
2461
value = getattr(options, option)
1244
2462
if value is not None:
1245
2463
server_settings[option] = value
1247
2465
# Force all strings to be unicode
1248
2466
for option in server_settings.keys():
1249
if type(server_settings[option]) is str:
1250
server_settings[option] = unicode(server_settings[option])
2467
if isinstance(server_settings[option], bytes):
2468
server_settings[option] = (server_settings[option]
2470
# Force all boolean options to be boolean
2471
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2472
"foreground", "zeroconf"):
2473
server_settings[option] = bool(server_settings[option])
2474
# Debug implies foreground
2475
if server_settings["debug"]:
2476
server_settings["foreground"] = True
1251
2477
# Now we have our good server settings in "server_settings"
1253
2479
##################################################################
2481
if (not server_settings["zeroconf"]
2482
and not (server_settings["port"]
2483
or server_settings["socket"] != "")):
2484
parser.error("Needs port or socket to work without Zeroconf")
1255
2486
# For convenience
1256
debug = server_settings[u"debug"]
1257
use_dbus = server_settings[u"use_dbus"]
1258
use_dbus = False # XXX: Not done yet
1259
use_ipv6 = server_settings[u"use_ipv6"]
1262
syslogger.setLevel(logging.WARNING)
1263
console.setLevel(logging.WARNING)
1265
if server_settings[u"servicename"] != u"Mandos":
1266
syslogger.setFormatter(logging.Formatter
1267
(u'Mandos (%s) [%%(process)d]:'
1268
u' %%(levelname)s: %%(message)s'
1269
% server_settings[u"servicename"]))
2487
debug = server_settings["debug"]
2488
debuglevel = server_settings["debuglevel"]
2489
use_dbus = server_settings["use_dbus"]
2490
use_ipv6 = server_settings["use_ipv6"]
2491
stored_state_path = os.path.join(server_settings["statedir"],
2493
foreground = server_settings["foreground"]
2494
zeroconf = server_settings["zeroconf"]
2497
initlogger(debug, logging.DEBUG)
2502
level = getattr(logging, debuglevel.upper())
2503
initlogger(debug, level)
2505
if server_settings["servicename"] != "Mandos":
2506
syslogger.setFormatter(
2507
logging.Formatter('Mandos ({}) [%(process)d]:'
2508
' %(levelname)s: %(message)s'.format(
2509
server_settings["servicename"])))
1271
2511
# Parse config file with clients
1272
client_defaults = { u"timeout": u"1h",
1274
u"checker": u"fping -q -- %%(host)s",
1277
client_config = configparser.SafeConfigParser(client_defaults)
1278
client_config.read(os.path.join(server_settings[u"configdir"],
2512
client_config = configparser.SafeConfigParser(Client
2514
client_config.read(os.path.join(server_settings["configdir"],
1281
2517
global mandos_dbus_service
1282
2518
mandos_dbus_service = None
1284
tcp_server = MandosServer((server_settings[u"address"],
1285
server_settings[u"port"]),
1287
interface=server_settings[u"interface"],
1290
server_settings[u"priority"],
1292
pidfilename = u"/var/run/mandos.pid"
1294
pidfile = open(pidfilename, u"w")
1296
logger.error(u"Could not open file %r", pidfilename)
2521
if server_settings["socket"] != "":
2522
socketfd = server_settings["socket"]
2523
tcp_server = MandosServer(
2524
(server_settings["address"], server_settings["port"]),
2526
interface=(server_settings["interface"] or None),
2528
gnutls_priority=server_settings["priority"],
2532
pidfilename = "/run/mandos.pid"
2533
if not os.path.isdir("/run/."):
2534
pidfilename = "/var/run/mandos.pid"
2537
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2538
except IOError as e:
2539
logger.error("Could not open file %r", pidfilename,
1299
uid = pwd.getpwnam(u"_mandos").pw_uid
1300
gid = pwd.getpwnam(u"_mandos").pw_gid
2542
for name in ("_mandos", "mandos", "nobody"):
1303
uid = pwd.getpwnam(u"mandos").pw_uid
1304
gid = pwd.getpwnam(u"mandos").pw_gid
2544
uid = pwd.getpwnam(name).pw_uid
2545
gid = pwd.getpwnam(name).pw_gid
1305
2547
except KeyError:
1307
uid = pwd.getpwnam(u"nobody").pw_uid
1308
gid = pwd.getpwnam(u"nobody").pw_gid
1315
except OSError, error:
1316
if error[0] != errno.EPERM:
2555
except OSError as error:
2556
if error.errno != errno.EPERM:
1319
# Enable all possible GnuTLS debugging
2560
# Enable all possible GnuTLS debugging
1321
2562
# "Use a log level over 10 to enable all debugging options."
1322
2563
# - GnuTLS manual
1323
2564
gnutls.library.functions.gnutls_global_set_log_level(11)
1325
2566
@gnutls.library.types.gnutls_log_func
1326
2567
def debug_gnutls(level, string):
1327
logger.debug(u"GnuTLS: %s", string[:-1])
1329
(gnutls.library.functions
1330
.gnutls_global_set_log_function(debug_gnutls))
2568
logger.debug("GnuTLS: %s", string[:-1])
2570
gnutls.library.functions.gnutls_global_set_log_function(
2573
# Redirect stdin so all checkers get /dev/null
2574
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2575
os.dup2(null, sys.stdin.fileno())
2579
# Need to fork before connecting to D-Bus
2581
# Close all input and output, do double fork, etc.
2584
# multiprocessing will use threads, so before we use gobject we
2585
# need to inform gobject that threads will be used.
2586
gobject.threads_init()
1332
2588
global main_loop
1333
2589
# From the Avahi example code
1334
DBusGMainLoop(set_as_default=True )
2590
DBusGMainLoop(set_as_default=True)
1335
2591
main_loop = gobject.MainLoop()
1336
2592
bus = dbus.SystemBus()
1337
2593
# End of Avahi example code
1339
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1340
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1341
service = AvahiService(name = server_settings[u"servicename"],
1342
servicetype = u"_mandos._tcp",
1343
protocol = protocol, bus = bus)
1344
if server_settings["interface"]:
1345
service.interface = (if_nametoindex
1346
(str(server_settings[u"interface"])))
2596
bus_name = dbus.service.BusName("se.recompile.Mandos",
2599
old_bus_name = dbus.service.BusName(
2600
"se.bsnet.fukt.Mandos", bus,
2602
except dbus.exceptions.DBusException as e:
2603
logger.error("Disabling D-Bus:", exc_info=e)
2605
server_settings["use_dbus"] = False
2606
tcp_server.use_dbus = False
2608
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2609
service = AvahiServiceToSyslog(
2610
name = server_settings["servicename"],
2611
servicetype = "_mandos._tcp",
2612
protocol = protocol,
2614
if server_settings["interface"]:
2615
service.interface = if_nametoindex(
2616
server_settings["interface"].encode("utf-8"))
2618
global multiprocessing_manager
2619
multiprocessing_manager = multiprocessing.Manager()
1348
2621
client_class = Client
1350
2623
client_class = functools.partial(ClientDBus, bus = bus)
1351
tcp_server.clients.update(set(
1352
client_class(name = section,
1353
config= dict(client_config.items(section)))
1354
for section in client_config.sections()))
2625
client_settings = Client.config_parser(client_config)
2626
old_client_settings = {}
2629
# This is used to redirect stdout and stderr for checker processes
2631
wnull = open(os.devnull, "w") # A writable /dev/null
2632
# Only used if server is running in foreground but not in debug
2634
if debug or not foreground:
2637
# Get client data and settings from last running state.
2638
if server_settings["restore"]:
2640
with open(stored_state_path, "rb") as stored_state:
2641
clients_data, old_client_settings = pickle.load(
2643
os.remove(stored_state_path)
2644
except IOError as e:
2645
if e.errno == errno.ENOENT:
2646
logger.warning("Could not load persistent state:"
2647
" {}".format(os.strerror(e.errno)))
2649
logger.critical("Could not load persistent state:",
2652
except EOFError as e:
2653
logger.warning("Could not load persistent state: "
2657
with PGPEngine() as pgp:
2658
for client_name, client in clients_data.items():
2659
# Skip removed clients
2660
if client_name not in client_settings:
2663
# Decide which value to use after restoring saved state.
2664
# We have three different values: Old config file,
2665
# new config file, and saved state.
2666
# New config value takes precedence if it differs from old
2667
# config value, otherwise use saved state.
2668
for name, value in client_settings[client_name].items():
2670
# For each value in new config, check if it
2671
# differs from the old config value (Except for
2672
# the "secret" attribute)
2673
if (name != "secret"
2675
old_client_settings[client_name][name])):
2676
client[name] = value
2680
# Clients who has passed its expire date can still be
2681
# enabled if its last checker was successful. A Client
2682
# whose checker succeeded before we stored its state is
2683
# assumed to have successfully run all checkers during
2685
if client["enabled"]:
2686
if datetime.datetime.utcnow() >= client["expires"]:
2687
if not client["last_checked_ok"]:
2689
"disabling client {} - Client never "
2690
"performed a successful checker".format(
2692
client["enabled"] = False
2693
elif client["last_checker_status"] != 0:
2695
"disabling client {} - Client last"
2696
" checker failed with error code"
2699
client["last_checker_status"]))
2700
client["enabled"] = False
2702
client["expires"] = (
2703
datetime.datetime.utcnow()
2704
+ client["timeout"])
2705
logger.debug("Last checker succeeded,"
2706
" keeping {} enabled".format(
2709
client["secret"] = pgp.decrypt(
2710
client["encrypted_secret"],
2711
client_settings[client_name]["secret"])
2713
# If decryption fails, we use secret from new settings
2714
logger.debug("Failed to decrypt {} old secret".format(
2716
client["secret"] = (client_settings[client_name]
2719
# Add/remove clients based on new changes made to config
2720
for client_name in (set(old_client_settings)
2721
- set(client_settings)):
2722
del clients_data[client_name]
2723
for client_name in (set(client_settings)
2724
- set(old_client_settings)):
2725
clients_data[client_name] = client_settings[client_name]
2727
# Create all client objects
2728
for client_name, client in clients_data.items():
2729
tcp_server.clients[client_name] = client_class(
2732
server_settings = server_settings)
1355
2734
if not tcp_server.clients:
1356
logger.warning(u"No clients defined")
1359
# Redirect stdin so all checkers get /dev/null
1360
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1361
os.dup2(null, sys.stdin.fileno())
1365
# No console logging
1366
logger.removeHandler(console)
1367
# Close all input and output, do double fork, etc.
1371
with closing(pidfile):
2735
logger.warning("No clients defined")
2738
if pidfile is not None:
1372
2739
pid = os.getpid()
1373
pidfile.write(str(pid) + "\n")
2742
print(pid, file=pidfile)
2744
logger.error("Could not write to file %r with PID %d",
1376
logger.error(u"Could not write to file %r with PID %d",
1379
# "pidfile" was never created
1384
"Cleanup function; run on exit"
1387
while tcp_server.clients:
1388
client = tcp_server.clients.pop()
1389
client.disable_hook = None
1392
atexit.register(cleanup)
1395
signal.signal(signal.SIGINT, signal.SIG_IGN)
1396
2749
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1397
2750
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1400
class MandosDBusService(dbus.service.Object):
2754
@alternate_dbus_interfaces(
2755
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2756
class MandosDBusService(DBusObjectWithProperties):
1401
2757
"""A D-Bus proxy object"""
1402
2759
def __init__(self):
1403
dbus.service.Object.__init__(self, bus, u"/")
1404
_interface = u"se.bsnet.fukt.Mandos"
1406
@dbus.service.signal(_interface, signature=u"oa{sv}")
1407
def ClientAdded(self, objpath, properties):
1411
@dbus.service.signal(_interface, signature=u"s")
1412
def ClientNotFound(self, fingerprint):
1416
@dbus.service.signal(_interface, signature=u"os")
2760
dbus.service.Object.__init__(self, bus, "/")
2762
_interface = "se.recompile.Mandos"
2764
@dbus_interface_annotations(_interface)
2767
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2770
@dbus.service.signal(_interface, signature="o")
2771
def ClientAdded(self, objpath):
2775
@dbus.service.signal(_interface, signature="ss")
2776
def ClientNotFound(self, fingerprint, address):
2780
@dbus.service.signal(_interface, signature="os")
1417
2781
def ClientRemoved(self, objpath, name):
1421
@dbus.service.method(_interface, out_signature=u"ao")
2785
@dbus.service.method(_interface, out_signature="ao")
1422
2786
def GetAllClients(self):
1424
return dbus.Array(c.dbus_object_path
1425
for c in tcp_server.clients)
2788
return dbus.Array(c.dbus_object_path for c in
2789
tcp_server.clients.itervalues())
1427
2791
@dbus.service.method(_interface,
1428
out_signature=u"a{oa{sv}}")
2792
out_signature="a{oa{sv}}")
1429
2793
def GetAllClientsWithProperties(self):
1431
2795
return dbus.Dictionary(
1432
((c.dbus_object_path, c.GetAllProperties())
1433
for c in tcp_server.clients),
1434
signature=u"oa{sv}")
2796
{ c.dbus_object_path: c.GetAll("")
2797
for c in tcp_server.clients.itervalues() },
1436
@dbus.service.method(_interface, in_signature=u"o")
2800
@dbus.service.method(_interface, in_signature="o")
1437
2801
def RemoveClient(self, object_path):
1439
for c in tcp_server.clients:
2803
for c in tcp_server.clients.itervalues():
1440
2804
if c.dbus_object_path == object_path:
1441
tcp_server.clients.remove(c)
2805
del tcp_server.clients[c.name]
1442
2806
c.remove_from_connection()
1443
2807
# Don't signal anything except ClientRemoved
1444
c.disable(signal=False)
2808
c.disable(quiet=True)
1445
2809
# Emit D-Bus signal
1446
2810
self.ClientRemoved(object_path, c.name)
2812
raise KeyError(object_path)
1452
2816
mandos_dbus_service = MandosDBusService()
1454
for client in tcp_server.clients:
2819
"Cleanup function; run on exit"
2823
multiprocessing.active_children()
2825
if not (tcp_server.clients or client_settings):
2828
# Store client before exiting. Secrets are encrypted with key
2829
# based on what config file has. If config file is
2830
# removed/edited, old secret will thus be unrecovable.
2832
with PGPEngine() as pgp:
2833
for client in tcp_server.clients.itervalues():
2834
key = client_settings[client.name]["secret"]
2835
client.encrypted_secret = pgp.encrypt(client.secret,
2839
# A list of attributes that can not be pickled
2841
exclude = { "bus", "changedstate", "secret",
2842
"checker", "server_settings" }
2843
for name, typ in inspect.getmembers(dbus.service
2847
client_dict["encrypted_secret"] = (client
2849
for attr in client.client_structure:
2850
if attr not in exclude:
2851
client_dict[attr] = getattr(client, attr)
2853
clients[client.name] = client_dict
2854
del client_settings[client.name]["secret"]
2857
with tempfile.NamedTemporaryFile(
2861
dir=os.path.dirname(stored_state_path),
2862
delete=False) as stored_state:
2863
pickle.dump((clients, client_settings), stored_state)
2864
tempname = stored_state.name
2865
os.rename(tempname, stored_state_path)
2866
except (IOError, OSError) as e:
2872
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2873
logger.warning("Could not save persistent state: {}"
2874
.format(os.strerror(e.errno)))
2876
logger.warning("Could not save persistent state:",
2880
# Delete all clients, and settings from config
2881
while tcp_server.clients:
2882
name, client = tcp_server.clients.popitem()
2884
client.remove_from_connection()
2885
# Don't signal anything except ClientRemoved
2886
client.disable(quiet=True)
2889
mandos_dbus_service.ClientRemoved(
2890
client.dbus_object_path, client.name)
2891
client_settings.clear()
2893
atexit.register(cleanup)
2895
for client in tcp_server.clients.itervalues():
1456
2897
# Emit D-Bus signal
1457
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1458
client.GetAllProperties())
2898
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2899
# Need to initiate checking of clients
2901
client.init_checker()
1461
2903
tcp_server.enable()
1462
2904
tcp_server.server_activate()
1464
2906
# Find out what port we got
1465
service.port = tcp_server.socket.getsockname()[1]
2908
service.port = tcp_server.socket.getsockname()[1]
1467
logger.info(u"Now listening on address %r, port %d,"
1468
" flowinfo %d, scope_id %d"
1469
% tcp_server.socket.getsockname())
2910
logger.info("Now listening on address %r, port %d,"
2911
" flowinfo %d, scope_id %d",
2912
*tcp_server.socket.getsockname())
1471
logger.info(u"Now listening on address %r, port %d"
1472
% tcp_server.socket.getsockname())
2914
logger.info("Now listening on address %r, port %d",
2915
*tcp_server.socket.getsockname())
1474
2917
#service.interface = tcp_server.socket.getsockname()[3]
1477
# From the Avahi example code
1480
except dbus.exceptions.DBusException, error:
1481
logger.critical(u"DBusException: %s", error)
1483
# End of Avahi example code
2921
# From the Avahi example code
2924
except dbus.exceptions.DBusException as error:
2925
logger.critical("D-Bus Exception", exc_info=error)
2928
# End of Avahi example code
1485
2930
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1486
2931
lambda *args, **kwargs:
1487
2932
(tcp_server.handle_request
1488
2933
(*args[2:], **kwargs) or True))
1490
logger.debug(u"Starting main loop")
2935
logger.debug("Starting main loop")
1491
2936
main_loop.run()
1492
except AvahiError, error:
1493
logger.critical(u"AvahiError: %s", error)
2937
except AvahiError as error:
2938
logger.critical("Avahi Error", exc_info=error)
1495
2941
except KeyboardInterrupt:
1498
logger.debug(u"Server received KeyboardInterrupt")
1499
logger.debug(u"Server exiting")
2943
print("", file=sys.stderr)
2944
logger.debug("Server received KeyboardInterrupt")
2945
logger.debug("Server exiting")
2946
# Must run before the D-Bus bus name gets deregistered
1501
2950
if __name__ == '__main__':