2
2
# -*- mode: python; coding: utf-8 -*-
4
from __future__ import division
4
# Mandos server - give out binary blobs to connecting clients.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
# GNU General Public License for more details.
27
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
31
# Contact the authors at <mandos@recompile.se>.
34
from __future__ import (division, absolute_import, print_function,
37
from future_builtins import *
40
import SocketServer as socketserver
9
from optparse import OptionParser
13
import gnutls.connection
15
import gnutls.library.functions
16
import gnutls.library.constants
17
import gnutls.library.types
48
import ConfigParser as configparser
59
import logging.handlers
66
import cPickle as pickle
69
import multiprocessing
82
from gi.repository import GObject as gobject
31
84
from dbus.mainloop.glib import DBusGMainLoop
35
import logging.handlers
37
logger = logging.Logger('mandos')
38
syslogger = logging.handlers.SysLogHandler\
39
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
40
syslogger.setFormatter(logging.Formatter\
41
('%(levelname)s: %(message)s'))
42
logger.addHandler(syslogger)
45
# This variable is used to optionally bind to a specified interface.
46
# It is a global variable to fit in with the other variables from the
47
# Avahi server example code.
48
serviceInterface = avahi.IF_UNSPEC
49
# From the Avahi server example code:
50
serviceName = "Mandos"
51
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
52
servicePort = None # Not known at startup
53
serviceTXT = [] # TXT record for the service
54
domain = "" # Domain to publish on, default to .local
55
host = "" # Host to publish records for, default to localhost
56
group = None #our entry group
57
rename_count = 12 # Counter so we only rename after collisions a
58
# sensible number of times
59
# End of Avahi example code
87
import xml.dom.minidom
91
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
except AttributeError:
94
from IN import SO_BINDTODEVICE
96
SO_BINDTODEVICE = None
98
if sys.version_info.major == 2:
102
stored_state_file = "clients.pickle"
104
logger = logging.getLogger()
108
if_nametoindex = ctypes.cdll.LoadLibrary(
109
ctypes.util.find_library("c")).if_nametoindex
110
except (OSError, AttributeError):
112
def if_nametoindex(interface):
113
"Get an interface index the hard way, i.e. using fcntl()"
114
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
115
with contextlib.closing(socket.socket()) as s:
116
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
117
struct.pack(b"16s16x", interface))
118
interface_index = struct.unpack("I", ifreq[16:20])[0]
119
return interface_index
122
def initlogger(debug, level=logging.WARNING):
123
"""init logger and add loglevel"""
126
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
129
syslogger.setFormatter(logging.Formatter
130
('Mandos [%(process)d]: %(levelname)s:'
132
logger.addHandler(syslogger)
135
console = logging.StreamHandler()
136
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
140
logger.addHandler(console)
141
logger.setLevel(level)
144
class PGPError(Exception):
145
"""Exception if encryption/decryption fails"""
149
class PGPEngine(object):
150
"""A simple class for OpenPGP symmetric encryption & decryption"""
153
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
self.gnupgargs = ['--batch',
155
'--home', self.tempdir,
163
def __exit__(self, exc_type, exc_value, traceback):
171
if self.tempdir is not None:
172
# Delete contents of tempdir
173
for root, dirs, files in os.walk(self.tempdir,
175
for filename in files:
176
os.remove(os.path.join(root, filename))
178
os.rmdir(os.path.join(root, dirname))
180
os.rmdir(self.tempdir)
183
def password_encode(self, password):
184
# Passphrase can not be empty and can not contain newlines or
185
# NUL bytes. So we prefix it and hex encode it.
186
encoded = b"mandos" + binascii.hexlify(password)
187
if len(encoded) > 2048:
188
# GnuPG can't handle long passwords, so encode differently
189
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
190
.replace(b"\n", b"\\n")
191
.replace(b"\0", b"\\x00"))
194
def encrypt(self, data, password):
195
passphrase = self.password_encode(password)
196
with tempfile.NamedTemporaryFile(
197
dir=self.tempdir) as passfile:
198
passfile.write(passphrase)
200
proc = subprocess.Popen(['gpg', '--symmetric',
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
208
if proc.returncode != 0:
212
def decrypt(self, data, password):
213
passphrase = self.password_encode(password)
214
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
216
passfile.write(passphrase)
218
proc = subprocess.Popen(['gpg', '--decrypt',
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
226
if proc.returncode != 0:
228
return decrypted_plaintext
231
class AvahiError(Exception):
232
def __init__(self, value, *args, **kwargs):
234
return super(AvahiError, self).__init__(value, *args,
238
class AvahiServiceError(AvahiError):
242
class AvahiGroupError(AvahiError):
246
class AvahiService(object):
247
"""An Avahi (Zeroconf) service.
250
interface: integer; avahi.IF_UNSPEC or an interface index.
251
Used to optionally bind to the specified interface.
252
name: string; Example: 'Mandos'
253
type: string; Example: '_mandos._tcp'.
254
See <https://www.iana.org/assignments/service-names-port-numbers>
255
port: integer; what port to announce
256
TXT: list of strings; TXT record for the service
257
domain: string; Domain to publish on, default to .local if empty.
258
host: string; Host to publish records for, default is localhost
259
max_renames: integer; maximum number of renames
260
rename_count: integer; counter so we only rename after collisions
261
a sensible number of times
262
group: D-Bus Entry Group
264
bus: dbus.SystemBus()
268
interface = avahi.IF_UNSPEC,
276
protocol = avahi.PROTO_UNSPEC,
278
self.interface = interface
280
self.type = servicetype
282
self.TXT = TXT if TXT is not None else []
285
self.rename_count = 0
286
self.max_renames = max_renames
287
self.protocol = protocol
288
self.group = None # our entry group
291
self.entry_group_state_changed_match = None
293
def rename(self, remove=True):
294
"""Derived from the Avahi example code"""
295
if self.rename_count >= self.max_renames:
296
logger.critical("No suitable Zeroconf service name found"
297
" after %i retries, exiting.",
299
raise AvahiServiceError("Too many renames")
301
self.server.GetAlternativeServiceName(self.name))
302
self.rename_count += 1
303
logger.info("Changing Zeroconf service name to %r ...",
309
except dbus.exceptions.DBusException as error:
310
if (error.get_dbus_name()
311
== "org.freedesktop.Avahi.CollisionError"):
312
logger.info("Local Zeroconf service name collision.")
313
return self.rename(remove=False)
315
logger.critical("D-Bus Exception", exc_info=error)
320
"""Derived from the Avahi example code"""
321
if self.entry_group_state_changed_match is not None:
322
self.entry_group_state_changed_match.remove()
323
self.entry_group_state_changed_match = None
324
if self.group is not None:
328
"""Derived from the Avahi example code"""
330
if self.group is None:
331
self.group = dbus.Interface(
332
self.bus.get_object(avahi.DBUS_NAME,
333
self.server.EntryGroupNew()),
334
avahi.DBUS_INTERFACE_ENTRY_GROUP)
335
self.entry_group_state_changed_match = (
336
self.group.connect_to_signal(
337
'StateChanged', self.entry_group_state_changed))
338
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
339
self.name, self.type)
340
self.group.AddService(
343
dbus.UInt32(0), # flags
344
self.name, self.type,
345
self.domain, self.host,
346
dbus.UInt16(self.port),
347
avahi.string_array_to_txt_array(self.TXT))
350
def entry_group_state_changed(self, state, error):
351
"""Derived from the Avahi example code"""
352
logger.debug("Avahi entry group state change: %i", state)
354
if state == avahi.ENTRY_GROUP_ESTABLISHED:
355
logger.debug("Zeroconf service established.")
356
elif state == avahi.ENTRY_GROUP_COLLISION:
357
logger.info("Zeroconf service name collision.")
359
elif state == avahi.ENTRY_GROUP_FAILURE:
360
logger.critical("Avahi: Error in group state changed %s",
362
raise AvahiGroupError("State changed: {!s}".format(error))
365
"""Derived from the Avahi example code"""
366
if self.group is not None:
369
except (dbus.exceptions.UnknownMethodException,
370
dbus.exceptions.DBusException):
375
def server_state_changed(self, state, error=None):
376
"""Derived from the Avahi example code"""
377
logger.debug("Avahi server state change: %i", state)
379
avahi.SERVER_INVALID: "Zeroconf server invalid",
380
avahi.SERVER_REGISTERING: None,
381
avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
avahi.SERVER_FAILURE: "Zeroconf server failure",
384
if state in bad_states:
385
if bad_states[state] is not None:
387
logger.error(bad_states[state])
389
logger.error(bad_states[state] + ": %r", error)
391
elif state == avahi.SERVER_RUNNING:
394
except dbus.exceptions.DBusException as error:
395
if (error.get_dbus_name()
396
== "org.freedesktop.Avahi.CollisionError"):
397
logger.info("Local Zeroconf service name"
399
return self.rename(remove=False)
401
logger.critical("D-Bus Exception", exc_info=error)
406
logger.debug("Unknown state: %r", state)
408
logger.debug("Unknown state: %r: %r", state, error)
411
"""Derived from the Avahi example code"""
412
if self.server is None:
413
self.server = dbus.Interface(
414
self.bus.get_object(avahi.DBUS_NAME,
415
avahi.DBUS_PATH_SERVER,
416
follow_name_owner_changes=True),
417
avahi.DBUS_INTERFACE_SERVER)
418
self.server.connect_to_signal("StateChanged",
419
self.server_state_changed)
420
self.server_state_changed(self.server.GetState())
423
class AvahiServiceToSyslog(AvahiService):
424
def rename(self, *args, **kwargs):
425
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
427
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
432
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
448
# Unless otherwise indicated, the constants and types below are
449
# all from the gnutls/gnutls.h C header file.
459
E_NO_CERTIFICATE_FOUND = -49
460
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
463
class session_int(ctypes.Structure):
465
session_t = ctypes.POINTER(session_int)
466
class certificate_credentials_st(ctypes.Structure):
468
certificate_credentials_t = ctypes.POINTER(
469
certificate_credentials_st)
470
certificate_type_t = ctypes.c_int
471
class datum_t(ctypes.Structure):
472
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
('size', ctypes.c_uint)]
474
class openpgp_crt_int(ctypes.Structure):
476
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
480
transport_ptr_t = ctypes.c_void_p
481
close_request_t = ctypes.c_int
484
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
490
# Default usage is by a message string, but if a return
491
# code is passed, convert it to a string with
494
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
499
class CertificateSecurityError(Error):
503
class Credentials(object):
505
self._c_object = gnutls.certificate_credentials_t()
506
gnutls.certificate_allocate_credentials(
507
ctypes.byref(self._c_object))
508
self.type = gnutls.CRD_CERTIFICATE
511
gnutls.certificate_free_credentials(self._c_object)
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
515
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
gnutls.set_default_priority(self._c_object)
518
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
gnutls.handshake_set_private_extensions(self._c_object,
522
if credentials is None:
523
credentials = gnutls.Credentials()
524
gnutls.credentials_set(self._c_object, credentials.type,
525
ctypes.cast(credentials._c_object,
527
self.credentials = credentials
530
gnutls.deinit(self._c_object)
533
return gnutls.handshake(self._c_object)
535
def send(self, data):
539
data_len -= gnutls.record_send(self._c_object,
544
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
546
# Error handling functions
547
def _error_code(result):
548
"""A function to raise exceptions on errors, suitable
549
for the 'restype' attribute on ctypes functions"""
552
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
556
def _retry_on_error(result, func, arguments):
557
"""A function to retry on some errors, suitable
558
for the 'errcheck' attribute on ctypes functions"""
560
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
561
return _error_code(result)
562
result = func(*arguments)
565
# Unless otherwise indicated, the function declarations below are
566
# all from the gnutls/gnutls.h C header file.
569
priority_set_direct = _library.gnutls_priority_set_direct
570
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
ctypes.POINTER(ctypes.c_char_p)]
572
priority_set_direct.restype = _error_code
574
init = _library.gnutls_init
575
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
init.restype = _error_code
578
set_default_priority = _library.gnutls_set_default_priority
579
set_default_priority.argtypes = [session_t]
580
set_default_priority.restype = _error_code
582
record_send = _library.gnutls_record_send
583
record_send.argtypes = [session_t, ctypes.c_void_p,
585
record_send.restype = ctypes.c_ssize_t
586
record_send.errcheck = _retry_on_error
588
certificate_allocate_credentials = (
589
_library.gnutls_certificate_allocate_credentials)
590
certificate_allocate_credentials.argtypes = [
591
ctypes.POINTER(certificate_credentials_t)]
592
certificate_allocate_credentials.restype = _error_code
594
certificate_free_credentials = (
595
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
597
certificate_free_credentials.restype = None
599
handshake_set_private_extensions = (
600
_library.gnutls_handshake_set_private_extensions)
601
handshake_set_private_extensions.argtypes = [session_t,
603
handshake_set_private_extensions.restype = None
605
credentials_set = _library.gnutls_credentials_set
606
credentials_set.argtypes = [session_t, credentials_type_t,
608
credentials_set.restype = _error_code
610
strerror = _library.gnutls_strerror
611
strerror.argtypes = [ctypes.c_int]
612
strerror.restype = ctypes.c_char_p
614
certificate_type_get = _library.gnutls_certificate_type_get
615
certificate_type_get.argtypes = [session_t]
616
certificate_type_get.restype = _error_code
618
certificate_get_peers = _library.gnutls_certificate_get_peers
619
certificate_get_peers.argtypes = [session_t,
620
ctypes.POINTER(ctypes.c_uint)]
621
certificate_get_peers.restype = ctypes.POINTER(datum_t)
623
global_set_log_level = _library.gnutls_global_set_log_level
624
global_set_log_level.argtypes = [ctypes.c_int]
625
global_set_log_level.restype = None
627
global_set_log_function = _library.gnutls_global_set_log_function
628
global_set_log_function.argtypes = [log_func]
629
global_set_log_function.restype = None
631
deinit = _library.gnutls_deinit
632
deinit.argtypes = [session_t]
633
deinit.restype = None
635
handshake = _library.gnutls_handshake
636
handshake.argtypes = [session_t]
637
handshake.restype = _error_code
638
handshake.errcheck = _retry_on_error
640
transport_set_ptr = _library.gnutls_transport_set_ptr
641
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
transport_set_ptr.restype = None
644
bye = _library.gnutls_bye
645
bye.argtypes = [session_t, close_request_t]
646
bye.restype = _error_code
647
bye.errcheck = _retry_on_error
649
check_version = _library.gnutls_check_version
650
check_version.argtypes = [ctypes.c_char_p]
651
check_version.restype = ctypes.c_char_p
653
# All the function declarations below are from gnutls/openpgp.h
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
663
openpgp_crt_import.restype = _error_code
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
680
openpgp_crt_get_fingerprint.restype = _error_code
682
# Remove non-public functions
683
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
687
def call_pipe(connection, # : multiprocessing.Connection
688
func, *args, **kwargs):
689
"""This function is meant to be called by multiprocessing.Process
691
This function runs func(*args, **kwargs), and writes the resulting
692
return value on the provided multiprocessing.Connection.
694
connection.send(func(*args, **kwargs))
62
697
class Client(object):
63
698
"""A representation of a client host served by this server.
65
name: string; from the config file, used in log messages
701
approved: bool(); 'None' if not yet approved/disapproved
702
approval_delay: datetime.timedelta(); Time to wait for approval
703
approval_duration: datetime.timedelta(); Duration of one approval
704
checker: subprocess.Popen(); a running checker process used
705
to see if the client lives.
706
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
708
checker_command: string; External command which is run to check
709
if client lives. %() expansions are done at
710
runtime with vars(self) as dict, so that for
711
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
713
created: datetime.datetime(); (UTC) object creation
714
client_structure: Object describing what attributes a client has
715
and is used for storing the client at exit
716
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
66
719
fingerprint: string (40 or 32 hexadecimal digits); used to
67
720
uniquely identify the client
68
secret: bytestring; sent verbatim (over TLS) to client
69
fqdn: string (FQDN); available for use by the checker command
70
created: datetime.datetime()
71
last_seen: datetime.datetime() or None if not yet seen
72
timeout: datetime.timedelta(); How long from last_seen until
73
this client is invalid
74
interval: datetime.timedelta(); How often to start a new checker
75
stop_hook: If set, called by stop() as stop_hook(self)
76
checker: subprocess.Popen(); a running checker process used
77
to see if the client lives.
78
Is None if no process is running.
79
checker_initiator_tag: a gobject event source tag, or None
80
stop_initiator_tag: - '' -
81
checker_callback_tag: - '' -
82
checker_command: string; External command which is run to check if
83
client lives. %()s expansions are done at
84
runtime with vars(self) as dict, so that for
85
instance %(name)s can be used in the command.
87
_timeout: Real variable for 'timeout'
88
_interval: Real variable for 'interval'
89
_timeout_milliseconds: Used by gobject.timeout_add()
90
_interval_milliseconds: - '' -
721
host: string; available for use by the checker command
722
interval: datetime.timedelta(); How often to start a new checker
723
last_approval_request: datetime.datetime(); (UTC) or None
724
last_checked_ok: datetime.datetime(); (UTC) or None
725
last_checker_status: integer between 0 and 255 reflecting exit
726
status of last checker. -1 reflects crashed
727
checker, -2 means no checker completed yet.
728
last_checker_signal: The signal which killed the last checker, if
729
last_checker_status is -1
730
last_enabled: datetime.datetime(); (UTC) or None
731
name: string; from the config file, used in log messages and
733
secret: bytestring; sent verbatim (over TLS) to client
734
timeout: datetime.timedelta(); How long from last_checked_ok
735
until this client is disabled
736
extended_timeout: extra long timeout when secret has been sent
737
runtime_expansions: Allowed attributes for runtime expansion.
738
expires: datetime.datetime(); time (UTC) when a client will be
740
server_settings: The server_settings dict from main()
92
def _set_timeout(self, timeout):
93
"Setter function for 'timeout' attribute"
94
self._timeout = timeout
95
self._timeout_milliseconds = ((self.timeout.days
96
* 24 * 60 * 60 * 1000)
97
+ (self.timeout.seconds * 1000)
98
+ (self.timeout.microseconds
100
timeout = property(lambda self: self._timeout,
103
def _set_interval(self, interval):
104
"Setter function for 'interval' attribute"
105
self._interval = interval
106
self._interval_milliseconds = ((self.interval.days
107
* 24 * 60 * 60 * 1000)
108
+ (self.interval.seconds
110
+ (self.interval.microseconds
112
interval = property(lambda self: self._interval,
115
def __init__(self, name=None, options=None, stop_hook=None,
116
fingerprint=None, secret=None, secfile=None,
117
fqdn=None, timeout=None, interval=-1, checker=None):
743
runtime_expansions = ("approval_delay", "approval_duration",
744
"created", "enabled", "expires",
745
"fingerprint", "host", "interval",
746
"last_approval_request", "last_checked_ok",
747
"last_enabled", "name", "timeout")
750
"extended_timeout": "PT15M",
752
"checker": "fping -q -- %%(host)s",
754
"approval_delay": "PT0S",
755
"approval_duration": "PT1S",
756
"approved_by_default": "True",
761
def config_parser(config):
762
"""Construct a new dict of client settings of this form:
763
{ client_name: {setting_name: value, ...}, ...}
764
with exceptions for any special settings as defined above.
765
NOTE: Must be a pure function. Must return the same result
766
value given the same arguments.
769
for client_name in config.sections():
770
section = dict(config.items(client_name))
771
client = settings[client_name] = {}
773
client["host"] = section["host"]
774
# Reformat values from string types to Python types
775
client["approved_by_default"] = config.getboolean(
776
client_name, "approved_by_default")
777
client["enabled"] = config.getboolean(client_name,
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
783
client["fingerprint"] = (section["fingerprint"].upper()
785
if "secret" in section:
786
client["secret"] = section["secret"].decode("base64")
787
elif "secfile" in section:
788
with open(os.path.expanduser(os.path.expandvars
789
(section["secfile"])),
791
client["secret"] = secfile.read()
793
raise TypeError("No secret or secfile for section {}"
795
client["timeout"] = string_to_delta(section["timeout"])
796
client["extended_timeout"] = string_to_delta(
797
section["extended_timeout"])
798
client["interval"] = string_to_delta(section["interval"])
799
client["approval_delay"] = string_to_delta(
800
section["approval_delay"])
801
client["approval_duration"] = string_to_delta(
802
section["approval_duration"])
803
client["checker_command"] = section["checker"]
804
client["last_approval_request"] = None
805
client["last_checked_ok"] = None
806
client["last_checker_status"] = -2
810
def __init__(self, settings, name = None, server_settings=None):
119
# Uppercase and remove spaces from fingerprint
120
# for later comparison purposes with return value of
121
# the fingerprint() function
122
self.fingerprint = fingerprint.upper().replace(u" ", u"")
124
self.secret = secret.decode(u"base64")
127
self.secret = sf.read()
130
raise RuntimeError(u"No secret or secfile for client %s"
132
self.fqdn = fqdn # string
133
self.created = datetime.datetime.now()
134
self.last_seen = None
136
self.timeout = options.timeout
138
self.timeout = string_to_delta(timeout)
140
self.interval = options.interval
142
self.interval = string_to_delta(interval)
143
self.stop_hook = stop_hook
812
if server_settings is None:
814
self.server_settings = server_settings
815
# adding all client settings
816
for setting, value in settings.items():
817
setattr(self, setting, value)
820
if not hasattr(self, "last_enabled"):
821
self.last_enabled = datetime.datetime.utcnow()
822
if not hasattr(self, "expires"):
823
self.expires = (datetime.datetime.utcnow()
826
self.last_enabled = None
829
logger.debug("Creating client %r", self.name)
830
logger.debug(" Fingerprint: %s", self.fingerprint)
831
self.created = settings.get("created",
832
datetime.datetime.utcnow())
834
# attributes specific for this server instance
144
835
self.checker = None
145
836
self.checker_initiator_tag = None
146
self.stop_initiator_tag = None
837
self.disable_initiator_tag = None
147
838
self.checker_callback_tag = None
148
self.check_command = checker
150
"""Start this clients checker and timeout hooks"""
839
self.current_checker_command = None
841
self.approvals_pending = 0
842
self.changedstate = multiprocessing_manager.Condition(
843
multiprocessing_manager.Lock())
844
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
846
if not attr.startswith("_")]
847
self.client_structure.append("client_structure")
849
for name, t in inspect.getmembers(
850
type(self), lambda obj: isinstance(obj, property)):
851
if not name.startswith("_"):
852
self.client_structure.append(name)
854
# Send notice to process children that client state has changed
855
def send_changedstate(self):
856
with self.changedstate:
857
self.changedstate.notify_all()
860
"""Start this client's checker and timeout hooks"""
861
if getattr(self, "enabled", False):
864
self.expires = datetime.datetime.utcnow() + self.timeout
866
self.last_enabled = datetime.datetime.utcnow()
868
self.send_changedstate()
870
def disable(self, quiet=True):
871
"""Disable this client."""
872
if not getattr(self, "enabled", False):
875
logger.info("Disabling client %s", self.name)
876
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
878
self.disable_initiator_tag = None
880
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
882
self.checker_initiator_tag = None
886
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
893
def init_checker(self):
151
894
# Schedule a new checker to be started an 'interval' from now,
152
895
# and every interval from then on.
153
self.checker_initiator_tag = gobject.timeout_add\
154
(self._interval_milliseconds,
896
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
901
# Schedule a disable() when 'timeout' has passed
902
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
905
int(self.timeout.total_seconds() * 1000), self.disable)
156
906
# Also start a new checker *right now*.
157
907
self.start_checker()
158
# Schedule a stop() when 'timeout' has passed
159
self.stop_initiator_tag = gobject.timeout_add\
160
(self._timeout_milliseconds,
164
The possibility that this client might be restarted is left
165
open, but not currently used."""
166
logger.debug(u"Stopping client %s", self.name)
168
if self.stop_initiator_tag:
169
gobject.source_remove(self.stop_initiator_tag)
170
self.stop_initiator_tag = None
171
if self.checker_initiator_tag:
172
gobject.source_remove(self.checker_initiator_tag)
173
self.checker_initiator_tag = None
177
# Do not run this again if called by a gobject.timeout_add
180
# Some code duplication here and in stop()
181
if hasattr(self, "stop_initiator_tag") \
182
and self.stop_initiator_tag:
183
gobject.source_remove(self.stop_initiator_tag)
184
self.stop_initiator_tag = None
185
if hasattr(self, "checker_initiator_tag") \
186
and self.checker_initiator_tag:
187
gobject.source_remove(self.checker_initiator_tag)
188
self.checker_initiator_tag = None
190
def checker_callback(self, pid, condition):
909
def checker_callback(self, source, condition, connection,
191
911
"""The checker has completed, so take appropriate actions."""
192
now = datetime.datetime.now()
193
if os.WIFEXITED(condition) \
194
and (os.WEXITSTATUS(condition) == 0):
195
logger.debug(u"Checker for %(name)s succeeded",
198
gobject.source_remove(self.stop_initiator_tag)
199
self.stop_initiator_tag = gobject.timeout_add\
200
(self._timeout_milliseconds,
202
elif not os.WIFEXITED(condition):
203
logger.warning(u"Checker for %(name)s crashed?",
912
self.checker_callback_tag = None
914
# Read return code from connection (see call_pipe)
915
returncode = connection.recv()
919
self.last_checker_status = returncode
920
self.last_checker_signal = None
921
if self.last_checker_status == 0:
922
logger.info("Checker for %(name)s succeeded",
926
logger.info("Checker for %(name)s failed", vars(self))
928
self.last_checker_status = -1
929
self.last_checker_signal = -returncode
930
logger.warning("Checker for %(name)s crashed?",
206
logger.debug(u"Checker for %(name)s failed",
209
self.checker_callback_tag = None
934
def checked_ok(self):
935
"""Assert that the client has been seen, alive and well."""
936
self.last_checked_ok = datetime.datetime.utcnow()
937
self.last_checker_status = 0
938
self.last_checker_signal = None
941
def bump_timeout(self, timeout=None):
942
"""Bump up the timeout for this client."""
944
timeout = self.timeout
945
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
947
self.disable_initiator_tag = None
948
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
950
int(timeout.total_seconds() * 1000), self.disable)
951
self.expires = datetime.datetime.utcnow() + timeout
953
def need_approval(self):
954
self.last_approval_request = datetime.datetime.utcnow()
210
956
def start_checker(self):
211
957
"""Start a new checker subprocess if one is not running.
212
959
If a checker already exists, leave it running and do
961
# The reason for not killing a running checker is that if we
962
# did that, and if a checker (for some reason) started running
963
# slowly and taking more than 'interval' time, then the client
964
# would inevitably timeout, since no checker would get a
965
# chance to run to completion. If we instead leave running
966
# checkers alone, the checker would have to take more time
967
# than 'timeout' for the client to be disabled, which is as it
970
if self.checker is not None and not self.checker.is_alive():
971
logger.warning("Checker was not alive; joining")
974
# Start a new checker if needed
214
975
if self.checker is None:
216
command = self.check_command % self.fqdn
218
escaped_attrs = dict((key, re.escape(str(val)))
220
vars(self).iteritems())
222
command = self.check_command % escaped_attrs
223
except TypeError, error:
224
logger.critical(u'Could not format string "%s":'
225
u' %s', self.check_command, error)
226
return True # Try again later
228
logger.debug(u"Starting checker %r for %s",
230
self.checker = subprocess.\
232
close_fds=True, shell=True,
234
self.checker_callback_tag = gobject.child_watch_add\
236
self.checker_callback)
237
except subprocess.OSError, error:
238
logger.error(u"Failed to start subprocess: %s",
976
# Escape attributes for the shell
978
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
981
command = self.checker_command % escaped_attrs
982
except TypeError as error:
983
logger.error('Could not format string "%s"',
984
self.checker_command,
986
return True # Try again later
987
self.current_checker_command = command
988
logger.info("Starting checker %r for %s", command,
990
# We don't need to redirect stdout and stderr, since
991
# in normal mode, that is already done by daemon(),
992
# and in debug mode we don't want to. (Stdin is
993
# always replaced by /dev/null.)
994
# The exception is when not debugging but nevertheless
995
# running in the foreground; use the previously
997
popen_args = { "close_fds": True,
1000
if (not self.server_settings["debug"]
1001
and self.server_settings["foreground"]):
1002
popen_args.update({"stdout": wnull,
1004
pipe = multiprocessing.Pipe(duplex = False)
1005
self.checker = multiprocessing.Process(
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1009
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1012
self.checker_callback, pipe[0], command)
240
1013
# Re-run this periodically if run by gobject.timeout_add
242
1016
def stop_checker(self):
243
1017
"""Force the checker process, if any, to stop."""
244
if not hasattr(self, "checker") or self.checker is None:
1018
if self.checker_callback_tag:
1019
gobject.source_remove(self.checker_callback_tag)
1020
self.checker_callback_tag = None
1021
if getattr(self, "checker", None) is None:
246
gobject.source_remove(self.checker_callback_tag)
247
self.checker_callback_tag = None
248
os.kill(self.checker.pid, signal.SIGTERM)
249
if self.checker.poll() is None:
250
os.kill(self.checker.pid, signal.SIGKILL)
1023
logger.debug("Stopping checker for %(name)s", vars(self))
1024
self.checker.terminate()
251
1025
self.checker = None
252
def still_valid(self, now=None):
253
"""Has the timeout not yet passed for this client?"""
255
now = datetime.datetime.now()
256
if self.last_seen is None:
257
return now < (self.created + self.timeout)
259
return now < (self.last_seen + self.timeout)
262
def peer_certificate(session):
263
"Return an OpenPGP data packet string for the peer's certificate"
264
# If not an OpenPGP certificate...
265
if gnutls.library.functions.gnutls_certificate_type_get\
266
(session._c_object) \
267
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
268
# ...do the normal thing
269
return session.peer_certificate
270
list_size = ctypes.c_uint()
271
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
272
(session._c_object, ctypes.byref(list_size))
273
if list_size.value == 0:
276
return ctypes.string_at(cert.data, cert.size)
279
def fingerprint(openpgp):
280
"Convert an OpenPGP data string to a hexdigit fingerprint string"
281
# New empty GnuTLS certificate
282
crt = gnutls.library.types.gnutls_openpgp_crt_t()
283
gnutls.library.functions.gnutls_openpgp_crt_init\
285
# New GnuTLS "datum" with the OpenPGP public key
286
datum = gnutls.library.types.gnutls_datum_t\
287
(ctypes.cast(ctypes.c_char_p(openpgp),
288
ctypes.POINTER(ctypes.c_ubyte)),
289
ctypes.c_uint(len(openpgp)))
290
# Import the OpenPGP public key into the certificate
291
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
294
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
295
# New buffer for the fingerprint
296
buffer = ctypes.create_string_buffer(20)
297
buffer_length = ctypes.c_size_t()
298
# Get the fingerprint from the certificate into the buffer
299
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
300
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
301
# Deinit the certificate
302
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
303
# Convert the buffer to a Python bytestring
304
fpr = ctypes.string_at(buffer, buffer_length.value)
305
# Convert the bytestring to hexadecimal notation
306
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
310
class tcp_handler(SocketServer.BaseRequestHandler, object):
311
"""A TCP request handler class.
312
Instantiated by IPv6_TCPServer for each request to handle it.
1028
def dbus_service_property(dbus_interface,
1032
"""Decorators for marking methods of a DBusObjectWithProperties to
1033
become properties on the D-Bus.
1035
The decorated method will be called with no arguments by "Get"
1036
and with one argument by "Set".
1038
The parameters, where they are supported, are the same as
1039
dbus.service.method, except there is only "signature", since the
1040
type from Get() and the type sent to Set() is the same.
1042
# Encoding deeply encoded byte arrays is not supported yet by the
1043
# "Set" method, so we fail early here:
1044
if byte_arrays and signature != "ay":
1045
raise ValueError("Byte arrays not supported for non-'ay'"
1046
" signature {!r}".format(signature))
1048
def decorator(func):
1049
func._dbus_is_property = True
1050
func._dbus_interface = dbus_interface
1051
func._dbus_signature = signature
1052
func._dbus_access = access
1053
func._dbus_name = func.__name__
1054
if func._dbus_name.endswith("_dbus_property"):
1055
func._dbus_name = func._dbus_name[:-14]
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1062
def dbus_interface_annotations(dbus_interface):
1063
"""Decorator for marking functions returning interface annotations
1067
@dbus_interface_annotations("org.example.Interface")
1068
def _foo(self): # Function name does not matter
1069
return {"org.freedesktop.DBus.Deprecated": "true",
1070
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1074
def decorator(func):
1075
func._dbus_is_interface = True
1076
func._dbus_interface = dbus_interface
1077
func._dbus_name = dbus_interface
1083
def dbus_annotations(annotations):
1084
"""Decorator to annotate D-Bus methods, signals or properties
1087
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
"org.freedesktop.DBus.Property."
1089
"EmitsChangedSignal": "false"})
1090
@dbus_service_property("org.example.Interface", signature="b",
1092
def Property_dbus_property(self):
1093
return dbus.Boolean(False)
1095
See also the DBusObjectWithAnnotations class.
1098
def decorator(func):
1099
func._dbus_annotations = annotations
1105
class DBusPropertyException(dbus.exceptions.DBusException):
1106
"""A base class for D-Bus property-related exceptions
1111
class DBusPropertyAccessException(DBusPropertyException):
1112
"""A property's access permissions disallows an operation.
1117
class DBusPropertyNotFound(DBusPropertyException):
1118
"""An attempt was made to access a non-existing property.
1123
class DBusObjectWithAnnotations(dbus.service.Object):
1124
"""A D-Bus object with annotations.
1126
Classes inheriting from this can use the dbus_annotations
1127
decorator to add annotations to methods or signals.
1131
def _is_dbus_thing(thing):
1132
"""Returns a function testing if an attribute is a D-Bus thing
1134
If called like _is_dbus_thing("method") it returns a function
1135
suitable for use as predicate to inspect.getmembers().
1137
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1140
def _get_all_dbus_things(self, thing):
1141
"""Returns a generator of (name, attribute) pairs
1143
return ((getattr(athing.__get__(self), "_dbus_name", name),
1144
athing.__get__(self))
1145
for cls in self.__class__.__mro__
1147
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1149
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1153
def Introspect(self, object_path, connection):
1154
"""Overloading of standard D-Bus method.
1156
Inserts annotation tags on methods and signals.
1158
xmlstring = dbus.service.Object.Introspect(self, object_path,
1161
document = xml.dom.minidom.parseString(xmlstring)
1163
for if_tag in document.getElementsByTagName("interface"):
1164
# Add annotation tags
1165
for typ in ("method", "signal"):
1166
for tag in if_tag.getElementsByTagName(typ):
1168
for name, prop in (self.
1169
_get_all_dbus_things(typ)):
1170
if (name == tag.getAttribute("name")
1171
and prop._dbus_interface
1172
== if_tag.getAttribute("name")):
1173
annots.update(getattr(
1174
prop, "_dbus_annotations", {}))
1175
for name, value in annots.items():
1176
ann_tag = document.createElement(
1178
ann_tag.setAttribute("name", name)
1179
ann_tag.setAttribute("value", value)
1180
tag.appendChild(ann_tag)
1181
# Add interface annotation tags
1182
for annotation, value in dict(
1183
itertools.chain.from_iterable(
1184
annotations().items()
1185
for name, annotations
1186
in self._get_all_dbus_things("interface")
1187
if name == if_tag.getAttribute("name")
1189
ann_tag = document.createElement("annotation")
1190
ann_tag.setAttribute("name", annotation)
1191
ann_tag.setAttribute("value", value)
1192
if_tag.appendChild(ann_tag)
1193
# Fix argument name for the Introspect method itself
1194
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1196
for cn in if_tag.getElementsByTagName("method"):
1197
if cn.getAttribute("name") == "Introspect":
1198
for arg in cn.getElementsByTagName("arg"):
1199
if (arg.getAttribute("direction")
1201
arg.setAttribute("name",
1203
xmlstring = document.toxml("utf-8")
1205
except (AttributeError, xml.dom.DOMException,
1206
xml.parsers.expat.ExpatError) as error:
1207
logger.error("Failed to override Introspection method",
1212
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
"""A D-Bus object with properties.
1215
Classes inheriting from this can use the dbus_service_property
1216
decorator to expose methods as D-Bus properties. It exposes the
1217
standard Get(), Set(), and GetAll() methods on the D-Bus.
1220
def _get_dbus_property(self, interface_name, property_name):
1221
"""Returns a bound method if one exists which is a D-Bus
1222
property with the specified name and interface.
1224
for cls in self.__class__.__mro__:
1225
for name, value in inspect.getmembers(
1226
cls, self._is_dbus_thing("property")):
1227
if (value._dbus_name == property_name
1228
and value._dbus_interface == interface_name):
1229
return value.__get__(self)
1232
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
self.dbus_object_path, interface_name, property_name))
1236
def _get_all_interface_names(cls):
1237
"""Get a sequence of all interfaces supported by an object"""
1238
return (name for name in set(getattr(getattr(x, attr),
1239
"_dbus_interface", None)
1240
for x in (inspect.getmro(cls))
1242
if name is not None)
1244
@dbus.service.method(dbus.PROPERTIES_IFACE,
1247
def Get(self, interface_name, property_name):
1248
"""Standard D-Bus property Get() method, see D-Bus standard.
1250
prop = self._get_dbus_property(interface_name, property_name)
1251
if prop._dbus_access == "write":
1252
raise DBusPropertyAccessException(property_name)
1254
if not hasattr(value, "variant_level"):
1256
return type(value)(value, variant_level=value.variant_level+1)
1258
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1259
def Set(self, interface_name, property_name, value):
1260
"""Standard D-Bus property Set() method, see D-Bus standard.
1262
prop = self._get_dbus_property(interface_name, property_name)
1263
if prop._dbus_access == "read":
1264
raise DBusPropertyAccessException(property_name)
1265
if prop._dbus_get_args_options["byte_arrays"]:
1266
# The byte_arrays option is not supported yet on
1267
# signatures other than "ay".
1268
if prop._dbus_signature != "ay":
1269
raise ValueError("Byte arrays not supported for non-"
1270
"'ay' signature {!r}"
1271
.format(prop._dbus_signature))
1272
value = dbus.ByteArray(b''.join(chr(byte)
1276
@dbus.service.method(dbus.PROPERTIES_IFACE,
1278
out_signature="a{sv}")
1279
def GetAll(self, interface_name):
1280
"""Standard D-Bus property GetAll() method, see D-Bus
1283
Note: Will not include properties with access="write".
1286
for name, prop in self._get_all_dbus_things("property"):
1288
and interface_name != prop._dbus_interface):
1289
# Interface non-empty but did not match
1291
# Ignore write-only properties
1292
if prop._dbus_access == "write":
1295
if not hasattr(value, "variant_level"):
1296
properties[name] = value
1298
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
1300
return dbus.Dictionary(properties, signature="sv")
1302
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
def PropertiesChanged(self, interface_name, changed_properties,
1304
invalidated_properties):
1305
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1310
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1312
path_keyword='object_path',
1313
connection_keyword='connection')
1314
def Introspect(self, object_path, connection):
1315
"""Overloading of standard D-Bus method.
1317
Inserts property tags and interface annotation tags.
1319
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1323
document = xml.dom.minidom.parseString(xmlstring)
1325
def make_tag(document, name, prop):
1326
e = document.createElement("property")
1327
e.setAttribute("name", name)
1328
e.setAttribute("type", prop._dbus_signature)
1329
e.setAttribute("access", prop._dbus_access)
1332
for if_tag in document.getElementsByTagName("interface"):
1334
for tag in (make_tag(document, name, prop)
1336
in self._get_all_dbus_things("property")
1337
if prop._dbus_interface
1338
== if_tag.getAttribute("name")):
1339
if_tag.appendChild(tag)
1340
# Add annotation tags for properties
1341
for tag in if_tag.getElementsByTagName("property"):
1343
for name, prop in self._get_all_dbus_things(
1345
if (name == tag.getAttribute("name")
1346
and prop._dbus_interface
1347
== if_tag.getAttribute("name")):
1348
annots.update(getattr(
1349
prop, "_dbus_annotations", {}))
1350
for name, value in annots.items():
1351
ann_tag = document.createElement(
1353
ann_tag.setAttribute("name", name)
1354
ann_tag.setAttribute("value", value)
1355
tag.appendChild(ann_tag)
1356
# Add the names to the return values for the
1357
# "org.freedesktop.DBus.Properties" methods
1358
if (if_tag.getAttribute("name")
1359
== "org.freedesktop.DBus.Properties"):
1360
for cn in if_tag.getElementsByTagName("method"):
1361
if cn.getAttribute("name") == "Get":
1362
for arg in cn.getElementsByTagName("arg"):
1363
if (arg.getAttribute("direction")
1365
arg.setAttribute("name", "value")
1366
elif cn.getAttribute("name") == "GetAll":
1367
for arg in cn.getElementsByTagName("arg"):
1368
if (arg.getAttribute("direction")
1370
arg.setAttribute("name", "props")
1371
xmlstring = document.toxml("utf-8")
1373
except (AttributeError, xml.dom.DOMException,
1374
xml.parsers.expat.ExpatError) as error:
1375
logger.error("Failed to override Introspection method",
1380
dbus.OBJECT_MANAGER_IFACE
1381
except AttributeError:
1382
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1384
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
"""A D-Bus object with an ObjectManager.
1387
Classes inheriting from this exposes the standard
1388
GetManagedObjects call and the InterfacesAdded and
1389
InterfacesRemoved signals on the standard
1390
"org.freedesktop.DBus.ObjectManager" interface.
1392
Note: No signals are sent automatically; they must be sent
1395
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1397
def GetManagedObjects(self):
1398
"""This function must be overridden"""
1399
raise NotImplementedError()
1401
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1403
def InterfacesAdded(self, object_path, interfaces_and_properties):
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1407
def InterfacesRemoved(self, object_path, interfaces):
1410
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1414
def Introspect(self, object_path, connection):
1415
"""Overloading of standard D-Bus method.
1417
Override return argument name of GetManagedObjects to be
1418
"objpath_interfaces_and_properties"
1420
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1424
document = xml.dom.minidom.parseString(xmlstring)
1426
for if_tag in document.getElementsByTagName("interface"):
1427
# Fix argument name for the GetManagedObjects method
1428
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1430
for cn in if_tag.getElementsByTagName("method"):
1431
if (cn.getAttribute("name")
1432
== "GetManagedObjects"):
1433
for arg in cn.getElementsByTagName("arg"):
1434
if (arg.getAttribute("direction")
1438
"objpath_interfaces"
1440
xmlstring = document.toxml("utf-8")
1442
except (AttributeError, xml.dom.DOMException,
1443
xml.parsers.expat.ExpatError) as error:
1444
logger.error("Failed to override Introspection method",
1448
def datetime_to_dbus(dt, variant_level=0):
1449
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1451
return dbus.String("", variant_level = variant_level)
1452
return dbus.String(dt.isoformat(), variant_level=variant_level)
1455
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1456
"""A class decorator; applied to a subclass of
1457
dbus.service.Object, it will add alternate D-Bus attributes with
1458
interface names according to the "alt_interface_names" mapping.
1461
@alternate_dbus_interfaces({"org.example.Interface":
1462
"net.example.AlternateInterface"})
1463
class SampleDBusObject(dbus.service.Object):
1464
@dbus.service.method("org.example.Interface")
1465
def SampleDBusMethod():
1468
The above "SampleDBusMethod" on "SampleDBusObject" will be
1469
reachable via two interfaces: "org.example.Interface" and
1470
"net.example.AlternateInterface", the latter of which will have
1471
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1472
"true", unless "deprecate" is passed with a False value.
1474
This works for methods and signals, and also for D-Bus properties
1475
(from DBusObjectWithProperties) and interfaces (from the
1476
dbus_interface_annotations decorator).
1480
for orig_interface_name, alt_interface_name in (
1481
alt_interface_names.items()):
1483
interface_names = set()
1484
# Go though all attributes of the class
1485
for attrname, attribute in inspect.getmembers(cls):
1486
# Ignore non-D-Bus attributes, and D-Bus attributes
1487
# with the wrong interface name
1488
if (not hasattr(attribute, "_dbus_interface")
1489
or not attribute._dbus_interface.startswith(
1490
orig_interface_name)):
1492
# Create an alternate D-Bus interface name based on
1494
alt_interface = attribute._dbus_interface.replace(
1495
orig_interface_name, alt_interface_name)
1496
interface_names.add(alt_interface)
1497
# Is this a D-Bus signal?
1498
if getattr(attribute, "_dbus_is_signal", False):
1499
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
nonmethod_func = (dict(
1503
zip(attribute.func_code.co_freevars,
1504
attribute.__closure__))
1505
["func"].cell_contents)
1507
nonmethod_func = attribute
1508
# Create a new, but exactly alike, function
1509
# object, and decorate it to be a new D-Bus signal
1510
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1525
new_function = (dbus.service.signal(
1527
attribute._dbus_signature)(new_function))
1528
# Copy annotations, if any
1530
new_function._dbus_annotations = dict(
1531
attribute._dbus_annotations)
1532
except AttributeError:
1534
# Define a creator of a function to call both the
1535
# original and alternate functions, so both the
1536
# original and alternate signals gets sent when
1537
# the function is called
1538
def fixscope(func1, func2):
1539
"""This function is a scope container to pass
1540
func1 and func2 to the "call_both" function
1541
outside of its arguments"""
1543
@functools.wraps(func2)
1544
def call_both(*args, **kwargs):
1545
"""This function will emit two D-Bus
1546
signals by calling func1 and func2"""
1547
func1(*args, **kwargs)
1548
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1550
for name, attr in inspect.getmembers(func2):
1551
if name.startswith("_dbus_"):
1552
setattr(call_both, name, attr)
1555
# Create the "call_both" function and add it to
1557
attr[attrname] = fixscope(attribute, new_function)
1558
# Is this a D-Bus method?
1559
elif getattr(attribute, "_dbus_is_method", False):
1560
# Create a new, but exactly alike, function
1561
# object. Decorate it to be a new D-Bus method
1562
# with the alternate D-Bus interface name. Add it
1565
dbus.service.method(
1567
attribute._dbus_in_signature,
1568
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1574
# Copy annotations, if any
1576
attr[attrname]._dbus_annotations = dict(
1577
attribute._dbus_annotations)
1578
except AttributeError:
1580
# Is this a D-Bus property?
1581
elif getattr(attribute, "_dbus_is_property", False):
1582
# Create a new, but exactly alike, function
1583
# object, and decorate it to be a new D-Bus
1584
# property with the alternate D-Bus interface
1585
# name. Add it to the class.
1586
attr[attrname] = (dbus_service_property(
1587
alt_interface, attribute._dbus_signature,
1588
attribute._dbus_access,
1589
attribute._dbus_get_args_options
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1597
# Copy annotations, if any
1599
attr[attrname]._dbus_annotations = dict(
1600
attribute._dbus_annotations)
1601
except AttributeError:
1603
# Is this a D-Bus interface?
1604
elif getattr(attribute, "_dbus_is_interface", False):
1605
# Create a new, but exactly alike, function
1606
# object. Decorate it to be a new D-Bus interface
1607
# with the alternate D-Bus interface name. Add it
1610
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1617
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1619
for interface_name in interface_names:
1621
@dbus_interface_annotations(interface_name)
1623
return { "org.freedesktop.DBus.Deprecated":
1625
# Find an unused name
1626
for aname in (iname.format(i)
1627
for i in itertools.count()):
1628
if aname not in attr:
1632
# Replace the class with a new subclass of it with
1633
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1641
@alternate_dbus_interfaces({"se.recompile.Mandos":
1642
"se.bsnet.fukt.Mandos"})
1643
class ClientDBus(Client, DBusObjectWithProperties):
1644
"""A Client class using D-Bus
1647
dbus_object_path: dbus.ObjectPath
1648
bus: dbus.SystemBus()
1651
runtime_expansions = (Client.runtime_expansions
1652
+ ("dbus_object_path", ))
1654
_interface = "se.recompile.Mandos.Client"
1656
# dbus.service.Object doesn't use super(), so we can't either.
1658
def __init__(self, bus = None, *args, **kwargs):
1660
Client.__init__(self, *args, **kwargs)
1661
# Only now, when this client is initialized, can it show up on
1663
client_object_name = str(self.name).translate(
1664
{ord("."): ord("_"),
1665
ord("-"): ord("_")})
1666
self.dbus_object_path = dbus.ObjectPath(
1667
"/clients/" + client_object_name)
1668
DBusObjectWithProperties.__init__(self, self.bus,
1669
self.dbus_object_path)
1671
def notifychangeproperty(transform_func, dbus_name,
1672
type_func=lambda x: x,
1674
invalidate_only=False,
1675
_interface=_interface):
1676
""" Modify a variable so that it's a property which announces
1677
its changes to DBus.
1679
transform_fun: Function that takes a value and a variant_level
1680
and transforms it to a D-Bus type.
1681
dbus_name: D-Bus name of the variable
1682
type_func: Function that transform the value before sending it
1683
to the D-Bus. Default: no transform
1684
variant_level: D-Bus variant level. Default: 1
1686
attrname = "_{}".format(dbus_name)
1688
def setter(self, value):
1689
if hasattr(self, "dbus_object_path"):
1690
if (not hasattr(self, attrname) or
1691
type_func(getattr(self, attrname, None))
1692
!= type_func(value)):
1694
self.PropertiesChanged(
1695
_interface, dbus.Dictionary(),
1696
dbus.Array((dbus_name, )))
1698
dbus_value = transform_func(
1700
variant_level = variant_level)
1701
self.PropertyChanged(dbus.String(dbus_name),
1703
self.PropertiesChanged(
1705
dbus.Dictionary({ dbus.String(dbus_name):
1708
setattr(self, attrname, value)
1710
return property(lambda self: getattr(self, attrname), setter)
1712
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1713
approvals_pending = notifychangeproperty(dbus.Boolean,
1716
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
last_enabled = notifychangeproperty(datetime_to_dbus,
1719
checker = notifychangeproperty(
1720
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1722
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1724
last_checker_status = notifychangeproperty(dbus.Int16,
1725
"LastCheckerStatus")
1726
last_approval_request = notifychangeproperty(
1727
datetime_to_dbus, "LastApprovalRequest")
1728
approved_by_default = notifychangeproperty(dbus.Boolean,
1729
"ApprovedByDefault")
1730
approval_delay = notifychangeproperty(
1731
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1733
approval_duration = notifychangeproperty(
1734
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1736
host = notifychangeproperty(dbus.String, "Host")
1737
timeout = notifychangeproperty(
1738
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1740
extended_timeout = notifychangeproperty(
1741
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1743
interval = notifychangeproperty(
1744
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1746
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
invalidate_only=True)
1750
del notifychangeproperty
1752
def __del__(self, *args, **kwargs):
1754
self.remove_from_connection()
1757
if hasattr(DBusObjectWithProperties, "__del__"):
1758
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
Client.__del__(self, *args, **kwargs)
1761
def checker_callback(self, source, condition,
1762
connection, command, *args, **kwargs):
1763
ret = Client.checker_callback(self, source, condition,
1764
connection, command, *args,
1766
exitstatus = self.last_checker_status
1769
self.CheckerCompleted(dbus.Int16(exitstatus),
1770
# This is specific to GNU libC
1771
dbus.Int64(exitstatus << 8),
1772
dbus.String(command))
1775
self.CheckerCompleted(dbus.Int16(-1),
1777
# This is specific to GNU libC
1779
| self.last_checker_signal),
1780
dbus.String(command))
1783
def start_checker(self, *args, **kwargs):
1784
old_checker_pid = getattr(self.checker, "pid", None)
1785
r = Client.start_checker(self, *args, **kwargs)
1786
# Only if new checker process was started
1787
if (self.checker is not None
1788
and old_checker_pid != self.checker.pid):
1790
self.CheckerStarted(self.current_checker_command)
1793
def _reset_approved(self):
1794
self.approved = None
1797
def approve(self, value=True):
1798
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1801
self.send_changedstate()
1803
## D-Bus methods, signals & properties
1809
# CheckerCompleted - signal
1810
@dbus.service.signal(_interface, signature="nxs")
1811
def CheckerCompleted(self, exitcode, waitstatus, command):
1815
# CheckerStarted - signal
1816
@dbus.service.signal(_interface, signature="s")
1817
def CheckerStarted(self, command):
1821
# PropertyChanged - signal
1822
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
@dbus.service.signal(_interface, signature="sv")
1824
def PropertyChanged(self, property, value):
1828
# GotSecret - signal
1829
@dbus.service.signal(_interface)
1830
def GotSecret(self):
1832
Is sent after a successful transfer of secret from the Mandos
1833
server to mandos-client
1838
@dbus.service.signal(_interface, signature="s")
1839
def Rejected(self, reason):
1843
# NeedApproval - signal
1844
@dbus.service.signal(_interface, signature="tb")
1845
def NeedApproval(self, timeout, default):
1847
return self.need_approval()
1852
@dbus.service.method(_interface, in_signature="b")
1853
def Approve(self, value):
1856
# CheckedOK - method
1857
@dbus.service.method(_interface)
1858
def CheckedOK(self):
1862
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1863
@dbus.service.method(_interface)
1868
# StartChecker - method
1869
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1870
@dbus.service.method(_interface)
1871
def StartChecker(self):
1873
self.start_checker()
1876
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1877
@dbus.service.method(_interface)
1882
# StopChecker - method
1883
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1884
@dbus.service.method(_interface)
1885
def StopChecker(self):
1890
# ApprovalPending - property
1891
@dbus_service_property(_interface, signature="b", access="read")
1892
def ApprovalPending_dbus_property(self):
1893
return dbus.Boolean(bool(self.approvals_pending))
1895
# ApprovedByDefault - property
1896
@dbus_service_property(_interface,
1899
def ApprovedByDefault_dbus_property(self, value=None):
1900
if value is None: # get
1901
return dbus.Boolean(self.approved_by_default)
1902
self.approved_by_default = bool(value)
1904
# ApprovalDelay - property
1905
@dbus_service_property(_interface,
1908
def ApprovalDelay_dbus_property(self, value=None):
1909
if value is None: # get
1910
return dbus.UInt64(self.approval_delay.total_seconds()
1912
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1914
# ApprovalDuration - property
1915
@dbus_service_property(_interface,
1918
def ApprovalDuration_dbus_property(self, value=None):
1919
if value is None: # get
1920
return dbus.UInt64(self.approval_duration.total_seconds()
1922
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1926
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1927
@dbus_service_property(_interface, signature="s", access="read")
1928
def Name_dbus_property(self):
1929
return dbus.String(self.name)
1931
# Fingerprint - property
1933
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1934
@dbus_service_property(_interface, signature="s", access="read")
1935
def Fingerprint_dbus_property(self):
1936
return dbus.String(self.fingerprint)
1939
@dbus_service_property(_interface,
1942
def Host_dbus_property(self, value=None):
1943
if value is None: # get
1944
return dbus.String(self.host)
1945
self.host = str(value)
1947
# Created - property
1949
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1950
@dbus_service_property(_interface, signature="s", access="read")
1951
def Created_dbus_property(self):
1952
return datetime_to_dbus(self.created)
1954
# LastEnabled - property
1955
@dbus_service_property(_interface, signature="s", access="read")
1956
def LastEnabled_dbus_property(self):
1957
return datetime_to_dbus(self.last_enabled)
1959
# Enabled - property
1960
@dbus_service_property(_interface,
1963
def Enabled_dbus_property(self, value=None):
1964
if value is None: # get
1965
return dbus.Boolean(self.enabled)
1971
# LastCheckedOK - property
1972
@dbus_service_property(_interface,
1975
def LastCheckedOK_dbus_property(self, value=None):
1976
if value is not None:
1979
return datetime_to_dbus(self.last_checked_ok)
1981
# LastCheckerStatus - property
1982
@dbus_service_property(_interface, signature="n", access="read")
1983
def LastCheckerStatus_dbus_property(self):
1984
return dbus.Int16(self.last_checker_status)
1986
# Expires - property
1987
@dbus_service_property(_interface, signature="s", access="read")
1988
def Expires_dbus_property(self):
1989
return datetime_to_dbus(self.expires)
1991
# LastApprovalRequest - property
1992
@dbus_service_property(_interface, signature="s", access="read")
1993
def LastApprovalRequest_dbus_property(self):
1994
return datetime_to_dbus(self.last_approval_request)
1996
# Timeout - property
1997
@dbus_service_property(_interface,
2000
def Timeout_dbus_property(self, value=None):
2001
if value is None: # get
2002
return dbus.UInt64(self.timeout.total_seconds() * 1000)
2003
old_timeout = self.timeout
2004
self.timeout = datetime.timedelta(0, 0, 0, value)
2005
# Reschedule disabling
2007
now = datetime.datetime.utcnow()
2008
self.expires += self.timeout - old_timeout
2009
if self.expires <= now:
2010
# The timeout has passed
2013
if (getattr(self, "disable_initiator_tag", None)
2016
gobject.source_remove(self.disable_initiator_tag)
2017
self.disable_initiator_tag = gobject.timeout_add(
2018
int((self.expires - now).total_seconds() * 1000),
2021
# ExtendedTimeout - property
2022
@dbus_service_property(_interface,
2025
def ExtendedTimeout_dbus_property(self, value=None):
2026
if value is None: # get
2027
return dbus.UInt64(self.extended_timeout.total_seconds()
2029
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2031
# Interval - property
2032
@dbus_service_property(_interface,
2035
def Interval_dbus_property(self, value=None):
2036
if value is None: # get
2037
return dbus.UInt64(self.interval.total_seconds() * 1000)
2038
self.interval = datetime.timedelta(0, 0, 0, value)
2039
if getattr(self, "checker_initiator_tag", None) is None:
2042
# Reschedule checker run
2043
gobject.source_remove(self.checker_initiator_tag)
2044
self.checker_initiator_tag = gobject.timeout_add(
2045
value, self.start_checker)
2046
self.start_checker() # Start one now, too
2048
# Checker - property
2049
@dbus_service_property(_interface,
2052
def Checker_dbus_property(self, value=None):
2053
if value is None: # get
2054
return dbus.String(self.checker_command)
2055
self.checker_command = str(value)
2057
# CheckerRunning - property
2058
@dbus_service_property(_interface,
2061
def CheckerRunning_dbus_property(self, value=None):
2062
if value is None: # get
2063
return dbus.Boolean(self.checker is not None)
2065
self.start_checker()
2069
# ObjectPath - property
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
"org.freedesktop.DBus.Deprecated": "true"})
2073
@dbus_service_property(_interface, signature="o", access="read")
2074
def ObjectPath_dbus_property(self):
2075
return self.dbus_object_path # is already a dbus.ObjectPath
2079
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2081
@dbus_service_property(_interface,
2085
def Secret_dbus_property(self, value):
2086
self.secret = bytes(value)
2091
class ProxyClient(object):
2092
def __init__(self, child_pipe, fpr, address):
2093
self._pipe = child_pipe
2094
self._pipe.send(('init', fpr, address))
2095
if not self._pipe.recv():
2098
def __getattribute__(self, name):
2100
return super(ProxyClient, self).__getattribute__(name)
2101
self._pipe.send(('getattr', name))
2102
data = self._pipe.recv()
2103
if data[0] == 'data':
2105
if data[0] == 'function':
2107
def func(*args, **kwargs):
2108
self._pipe.send(('funcall', name, args, kwargs))
2109
return self._pipe.recv()[1]
2113
def __setattr__(self, name, value):
2115
return super(ProxyClient, self).__setattr__(name, value)
2116
self._pipe.send(('setattr', name, value))
2119
class ClientHandler(socketserver.BaseRequestHandler, object):
2120
"""A class to handle client connections.
2122
Instantiated once for each connection to handle it.
313
2123
Note: This will run in its own forked process."""
315
2125
def handle(self):
316
logger.debug(u"TCP connection from: %s",
317
unicode(self.client_address))
318
session = gnutls.connection.ClientSession(self.request,
322
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
323
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
325
priority = "SECURE256"
327
gnutls.library.functions.gnutls_priority_set_direct\
328
(session._c_object, priority, None);
332
except gnutls.errors.GNUTLSError, error:
333
logger.debug(u"Handshake failed: %s", error)
334
# Do not run session.bye() here: the session is not
335
# established. Just abandon the request.
338
fpr = fingerprint(peer_certificate(session))
339
except (TypeError, gnutls.errors.GNUTLSError), error:
340
logger.debug(u"Bad certificate: %s", error)
343
logger.debug(u"Fingerprint: %s", fpr)
346
if c.fingerprint == fpr:
349
# Have to check if client.still_valid(), since it is possible
350
# that the client timed out while establishing the GnuTLS
352
if (not client) or (not client.still_valid()):
354
logger.debug(u"Client %(name)s is invalid",
357
logger.debug(u"Client not found for fingerprint: %s",
362
while sent_size < len(client.secret):
363
sent = session.send(client.secret[sent_size:])
364
logger.debug(u"Sent: %d, remaining: %d",
365
sent, len(client.secret)
366
- (sent_size + sent))
371
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
372
"""IPv6 TCP server. Accepts 'None' as address and/or port.
2126
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
logger.info("TCP connection from: %s",
2128
str(self.client_address))
2129
logger.debug("Pipe FD: %d",
2130
self.server.child_pipe.fileno())
2132
session = gnutls.ClientSession(self.request)
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
# "+AES-256-CBC", "+SHA1",
2136
# "+COMP-NULL", "+CTYPE-OPENPGP",
2138
# Use a fallback default, since this MUST be set.
2139
priority = self.server.gnutls_priority
2140
if priority is None:
2142
gnutls.priority_set_direct(session._c_object, priority,
2145
# Start communication using the Mandos protocol
2146
# Get protocol number
2147
line = self.request.makefile().readline()
2148
logger.debug("Protocol version: %r", line)
2150
if int(line.strip().split()[0]) > 1:
2151
raise RuntimeError(line)
2152
except (ValueError, IndexError, RuntimeError) as error:
2153
logger.error("Unknown protocol version: %s", error)
2156
# Start GnuTLS connection
2159
except gnutls.Error as error:
2160
logger.warning("Handshake failed: %s", error)
2161
# Do not run session.bye() here: the session is not
2162
# established. Just abandon the request.
2164
logger.debug("Handshake succeeded")
2166
approval_required = False
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
2172
logger.warning("Bad certificate: %s", error)
2174
logger.debug("Fingerprint: %s", fpr)
2177
client = ProxyClient(child_pipe, fpr,
2178
self.client_address)
2182
if client.approval_delay:
2183
delay = client.approval_delay
2184
client.approvals_pending += 1
2185
approval_required = True
2188
if not client.enabled:
2189
logger.info("Client %s is disabled",
2191
if self.server.use_dbus:
2193
client.Rejected("Disabled")
2196
if client.approved or not client.approval_delay:
2197
#We are approved or approval is disabled
2199
elif client.approved is None:
2200
logger.info("Client %s needs approval",
2202
if self.server.use_dbus:
2204
client.NeedApproval(
2205
client.approval_delay.total_seconds()
2206
* 1000, client.approved_by_default)
2208
logger.warning("Client %s was not approved",
2210
if self.server.use_dbus:
2212
client.Rejected("Denied")
2215
#wait until timeout or approved
2216
time = datetime.datetime.now()
2217
client.changedstate.acquire()
2218
client.changedstate.wait(delay.total_seconds())
2219
client.changedstate.release()
2220
time2 = datetime.datetime.now()
2221
if (time2 - time) >= delay:
2222
if not client.approved_by_default:
2223
logger.warning("Client %s timed out while"
2224
" waiting for approval",
2226
if self.server.use_dbus:
2228
client.Rejected("Approval timed out")
2233
delay -= time2 - time
2236
session.send(client.secret)
2237
except gnutls.Error as error:
2238
logger.warning("gnutls send failed",
2242
logger.info("Sending secret to %s", client.name)
2243
# bump the timeout using extended_timeout
2244
client.bump_timeout(client.extended_timeout)
2245
if self.server.use_dbus:
2250
if approval_required:
2251
client.approvals_pending -= 1
2254
except gnutls.Error as error:
2255
logger.warning("GnuTLS bye failed",
2259
def peer_certificate(session):
2260
"Return the peer's OpenPGP certificate as a bytestring"
2261
# If not an OpenPGP certificate...
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2264
# ...return invalid data
2266
list_size = ctypes.c_uint(1)
2267
cert_list = (gnutls.certificate_get_peers
2268
(session._c_object, ctypes.byref(list_size)))
2269
if not bool(cert_list) and list_size.value != 0:
2270
raise gnutls.Error("error getting peer certificate")
2271
if list_size.value == 0:
2274
return ctypes.string_at(cert.data, cert.size)
2277
def fingerprint(openpgp):
2278
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2279
# New GnuTLS "datum" with the OpenPGP public key
2280
datum = gnutls.datum_t(
2281
ctypes.cast(ctypes.c_char_p(openpgp),
2282
ctypes.POINTER(ctypes.c_ubyte)),
2283
ctypes.c_uint(len(openpgp)))
2284
# New empty GnuTLS certificate
2285
crt = gnutls.openpgp_crt_t()
2286
gnutls.openpgp_crt_init(ctypes.byref(crt))
2287
# Import the OpenPGP public key into the certificate
2288
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2289
gnutls.OPENPGP_FMT_RAW)
2290
# Verify the self signature in the key
2291
crtverify = ctypes.c_uint()
2292
gnutls.openpgp_crt_verify_self(crt, 0,
2293
ctypes.byref(crtverify))
2294
if crtverify.value != 0:
2295
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
2297
# New buffer for the fingerprint
2298
buf = ctypes.create_string_buffer(20)
2299
buf_len = ctypes.c_size_t()
2300
# Get the fingerprint from the certificate into the buffer
2301
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2302
ctypes.byref(buf_len))
2303
# Deinit the certificate
2304
gnutls.openpgp_crt_deinit(crt)
2305
# Convert the buffer to a Python bytestring
2306
fpr = ctypes.string_at(buf, buf_len.value)
2307
# Convert the bytestring to hexadecimal notation
2308
hex_fpr = binascii.hexlify(fpr).upper()
2312
class MultiprocessingMixIn(object):
2313
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2315
def sub_process_main(self, request, address):
2317
self.finish_request(request, address)
2319
self.handle_error(request, address)
2320
self.close_request(request)
2322
def process_request(self, request, address):
2323
"""Start a new process to process the request."""
2324
proc = multiprocessing.Process(target = self.sub_process_main,
2325
args = (request, address))
2330
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2331
""" adds a pipe to the MixIn """
2333
def process_request(self, request, client_address):
2334
"""Overrides and wraps the original process_request().
2336
This function creates a new pipe in self.pipe
2338
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2340
proc = MultiprocessingMixIn.process_request(self, request,
2342
self.child_pipe.close()
2343
self.add_pipe(parent_pipe, proc)
2345
def add_pipe(self, parent_pipe, proc):
2346
"""Dummy function; override as necessary"""
2347
raise NotImplementedError()
2350
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2351
socketserver.TCPServer, object):
2352
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
374
options: Command line options
375
clients: Set() of Client objects
2355
enabled: Boolean; whether this server is activated yet
2356
interface: None or a network interface name (string)
2357
use_ipv6: Boolean; to use IPv6 or not
377
address_family = socket.AF_INET6
378
def __init__(self, *args, **kwargs):
379
if "options" in kwargs:
380
self.options = kwargs["options"]
381
del kwargs["options"]
382
if "clients" in kwargs:
383
self.clients = kwargs["clients"]
384
del kwargs["clients"]
385
return super(type(self), self).__init__(*args, **kwargs)
2360
def __init__(self, server_address, RequestHandlerClass,
2364
"""If socketfd is set, use that file descriptor instead of
2365
creating a new one with socket.socket().
2367
self.interface = interface
2369
self.address_family = socket.AF_INET6
2370
if socketfd is not None:
2371
# Save the file descriptor
2372
self.socketfd = socketfd
2373
# Save the original socket.socket() function
2374
self.socket_socket = socket.socket
2375
# To implement --socket, we monkey patch socket.socket.
2377
# (When socketserver.TCPServer is a new-style class, we
2378
# could make self.socket into a property instead of monkey
2379
# patching socket.socket.)
2381
# Create a one-time-only replacement for socket.socket()
2382
@functools.wraps(socket.socket)
2383
def socket_wrapper(*args, **kwargs):
2384
# Restore original function so subsequent calls are
2386
socket.socket = self.socket_socket
2387
del self.socket_socket
2388
# This time only, return a new socket object from the
2389
# saved file descriptor.
2390
return socket.fromfd(self.socketfd, *args, **kwargs)
2391
# Replace socket.socket() function with wrapper
2392
socket.socket = socket_wrapper
2393
# The socketserver.TCPServer.__init__ will call
2394
# socket.socket(), which might be our replacement,
2395
# socket_wrapper(), if socketfd was set.
2396
socketserver.TCPServer.__init__(self, server_address,
2397
RequestHandlerClass)
386
2399
def server_bind(self):
387
2400
"""This overrides the normal server_bind() function
388
2401
to bind to an interface if one was specified, and also NOT to
389
2402
bind to an address or port if they were not specified."""
390
if self.options.interface:
391
if not hasattr(socket, "SO_BINDTODEVICE"):
392
# From /usr/include/asm-i486/socket.h
393
socket.SO_BINDTODEVICE = 25
395
self.socket.setsockopt(socket.SOL_SOCKET,
396
socket.SO_BINDTODEVICE,
397
self.options.interface)
398
except socket.error, error:
399
if error[0] == errno.EPERM:
400
logger.warning(u"No permission to"
401
u" bind to interface %s",
402
self.options.interface)
2403
if self.interface is not None:
2404
if SO_BINDTODEVICE is None:
2405
logger.error("SO_BINDTODEVICE does not exist;"
2406
" cannot bind to interface %s",
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
2413
except socket.error as error:
2414
if error.errno == errno.EPERM:
2415
logger.error("No permission to bind to"
2416
" interface %s", self.interface)
2417
elif error.errno == errno.ENOPROTOOPT:
2418
logger.error("SO_BINDTODEVICE not available;"
2419
" cannot bind to interface %s",
2421
elif error.errno == errno.ENODEV:
2422
logger.error("Interface %s does not exist,"
2423
" cannot bind", self.interface)
405
2426
# Only bind(2) the socket if we really need to.
406
2427
if self.server_address[0] or self.server_address[1]:
407
2428
if not self.server_address[0]:
409
self.server_address = (in6addr_any,
2429
if self.address_family == socket.AF_INET6:
2430
any_address = "::" # in6addr_any
2432
any_address = "0.0.0.0" # INADDR_ANY
2433
self.server_address = (any_address,
410
2434
self.server_address[1])
411
elif self.server_address[1] is None:
412
self.server_address = (self.server_address[0],
414
return super(type(self), self).server_bind()
2435
elif not self.server_address[1]:
2436
self.server_address = (self.server_address[0], 0)
2437
# if self.interface:
2438
# self.server_address = (self.server_address[0],
2443
return socketserver.TCPServer.server_bind(self)
2446
class MandosServer(IPv6_TCPServer):
2450
clients: set of Client objects
2451
gnutls_priority GnuTLS priority string
2452
use_dbus: Boolean; to emit D-Bus signals or not
2454
Assumes a gobject.MainLoop event loop.
2457
def __init__(self, server_address, RequestHandlerClass,
2461
gnutls_priority=None,
2464
self.enabled = False
2465
self.clients = clients
2466
if self.clients is None:
2468
self.use_dbus = use_dbus
2469
self.gnutls_priority = gnutls_priority
2470
IPv6_TCPServer.__init__(self, server_address,
2471
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2476
def server_activate(self):
2478
return socketserver.TCPServer.server_activate(self)
2483
def add_pipe(self, parent_pipe, proc):
2484
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2488
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2492
def handle_ipc(self, source, condition,
2495
client_object=None):
2496
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2498
# Wait for other process to exit
2502
# Read a request from the child
2503
request = parent_pipe.recv()
2504
command = request[0]
2506
if command == 'init':
2508
address = request[2]
2510
for c in self.clients.itervalues():
2511
if c.fingerprint == fpr:
2515
logger.info("Client not found for fingerprint: %s, ad"
2516
"dress: %s", fpr, address)
2519
mandos_dbus_service.ClientNotFound(fpr,
2521
parent_pipe.send(False)
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2527
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2530
client_object = client))
2531
parent_pipe.send(True)
2532
# remove the old hook in favor of the new above hook on
2535
if command == 'funcall':
2536
funcname = request[1]
2540
parent_pipe.send(('data', getattr(client_object,
2544
if command == 'getattr':
2545
attrname = request[1]
2546
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2548
parent_pipe.send(('function', ))
2551
'data', client_object.__getattribute__(attrname)))
2553
if command == 'setattr':
2554
attrname = request[1]
2556
setattr(client_object, attrname, value)
2561
def rfc3339_duration_to_delta(duration):
2562
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2564
>>> rfc3339_duration_to_delta("P7D")
2565
datetime.timedelta(7)
2566
>>> rfc3339_duration_to_delta("PT60S")
2567
datetime.timedelta(0, 60)
2568
>>> rfc3339_duration_to_delta("PT60M")
2569
datetime.timedelta(0, 3600)
2570
>>> rfc3339_duration_to_delta("PT24H")
2571
datetime.timedelta(1)
2572
>>> rfc3339_duration_to_delta("P1W")
2573
datetime.timedelta(7)
2574
>>> rfc3339_duration_to_delta("PT5M30S")
2575
datetime.timedelta(0, 330)
2576
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
datetime.timedelta(1, 200)
2580
# Parsing an RFC 3339 duration with regular expressions is not
2581
# possible - there would have to be multiple places for the same
2582
# values, like seconds. The current code, while more esoteric, is
2583
# cleaner without depending on a parsing library. If Python had a
2584
# built-in library for parsing we would use it, but we'd like to
2585
# avoid excessive use of external libraries.
2587
# New type for defining tokens, syntax, and semantics all-in-one
2588
Token = collections.namedtuple("Token", (
2589
"regexp", # To match token; if "value" is not None, must have
2590
# a "group" containing digits
2591
"value", # datetime.timedelta or None
2592
"followers")) # Tokens valid after this token
2593
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2594
# the "duration" ABNF definition in RFC 3339, Appendix A.
2595
token_end = Token(re.compile(r"$"), None, frozenset())
2596
token_second = Token(re.compile(r"(\d+)S"),
2597
datetime.timedelta(seconds=1),
2598
frozenset((token_end, )))
2599
token_minute = Token(re.compile(r"(\d+)M"),
2600
datetime.timedelta(minutes=1),
2601
frozenset((token_second, token_end)))
2602
token_hour = Token(re.compile(r"(\d+)H"),
2603
datetime.timedelta(hours=1),
2604
frozenset((token_minute, token_end)))
2605
token_time = Token(re.compile(r"T"),
2607
frozenset((token_hour, token_minute,
2609
token_day = Token(re.compile(r"(\d+)D"),
2610
datetime.timedelta(days=1),
2611
frozenset((token_time, token_end)))
2612
token_month = Token(re.compile(r"(\d+)M"),
2613
datetime.timedelta(weeks=4),
2614
frozenset((token_day, token_end)))
2615
token_year = Token(re.compile(r"(\d+)Y"),
2616
datetime.timedelta(weeks=52),
2617
frozenset((token_month, token_end)))
2618
token_week = Token(re.compile(r"(\d+)W"),
2619
datetime.timedelta(weeks=1),
2620
frozenset((token_end, )))
2621
token_duration = Token(re.compile(r"P"), None,
2622
frozenset((token_year, token_month,
2623
token_day, token_time,
2625
# Define starting values
2626
value = datetime.timedelta() # Value so far
2628
followers = frozenset((token_duration, )) # Following valid tokens
2629
s = duration # String left to parse
2630
# Loop until end token is found
2631
while found_token is not token_end:
2632
# Search for any currently valid tokens
2633
for token in followers:
2634
match = token.regexp.match(s)
2635
if match is not None:
2637
if token.value is not None:
2638
# Value found, parse digits
2639
factor = int(match.group(1), 10)
2640
# Add to value so far
2641
value += factor * token.value
2642
# Strip token from string
2643
s = token.regexp.sub("", s, 1)
2646
# Set valid next tokens
2647
followers = found_token.followers
2650
# No currently valid tokens were found
2651
raise ValueError("Invalid RFC 3339 duration: {!r}"
417
2657
def string_to_delta(interval):
418
2658
"""Parse a string and return a datetime.timedelta
420
2660
>>> string_to_delta('7d')
421
2661
datetime.timedelta(7)
422
2662
>>> string_to_delta('60s')
561
def killme(status = 0):
562
logger.debug("Stopping server with exit status %d", status)
564
if main_loop_started:
570
if __name__ == '__main__':
572
main_loop_started = False
573
parser = OptionParser()
574
parser.add_option("-i", "--interface", type="string",
575
default=None, metavar="IF",
576
help="Bind to interface IF")
577
parser.add_option("-p", "--port", type="int", default=None,
578
help="Port number to receive requests on")
579
parser.add_option("--timeout", type="string", # Parsed later
581
help="Amount of downtime allowed for clients")
582
parser.add_option("--interval", type="string", # Parsed later
584
help="How often to check that a client is up")
585
parser.add_option("--check", action="store_true", default=False,
586
help="Run self-test")
587
parser.add_option("--debug", action="store_true", default=False,
589
(options, args) = parser.parse_args()
2729
##################################################################
2730
# Parsing of options, both command line and config file
2732
parser = argparse.ArgumentParser()
2733
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
2735
help="show version number and exit")
2736
parser.add_argument("-i", "--interface", metavar="IF",
2737
help="Bind to interface IF")
2738
parser.add_argument("-a", "--address",
2739
help="Address to listen for requests on")
2740
parser.add_argument("-p", "--port", type=int,
2741
help="Port number to receive requests on")
2742
parser.add_argument("--check", action="store_true",
2743
help="Run self-test")
2744
parser.add_argument("--debug", action="store_true",
2745
help="Debug mode; run in foreground and log"
2746
" to terminal", default=None)
2747
parser.add_argument("--debuglevel", metavar="LEVEL",
2748
help="Debug level for stdout output")
2749
parser.add_argument("--priority", help="GnuTLS"
2750
" priority string (see GnuTLS documentation)")
2751
parser.add_argument("--servicename",
2752
metavar="NAME", help="Zeroconf service name")
2753
parser.add_argument("--configdir",
2754
default="/etc/mandos", metavar="DIR",
2755
help="Directory to search for configuration"
2757
parser.add_argument("--no-dbus", action="store_false",
2758
dest="use_dbus", help="Do not provide D-Bus"
2759
" system bus interface", default=None)
2760
parser.add_argument("--no-ipv6", action="store_false",
2761
dest="use_ipv6", help="Do not use IPv6",
2763
parser.add_argument("--no-restore", action="store_false",
2764
dest="restore", help="Do not restore stored"
2765
" state", default=None)
2766
parser.add_argument("--socket", type=int,
2767
help="Specify a file descriptor to a network"
2768
" socket to use instead of creating one")
2769
parser.add_argument("--statedir", metavar="DIR",
2770
help="Directory to save/restore state in")
2771
parser.add_argument("--foreground", action="store_true",
2772
help="Run in foreground", default=None)
2773
parser.add_argument("--no-zeroconf", action="store_false",
2774
dest="zeroconf", help="Do not use Zeroconf",
2777
options = parser.parse_args()
591
2779
if options.check:
596
# Parse the time arguments
598
options.timeout = string_to_delta(options.timeout)
600
parser.error("option --timeout: Unparseable time")
602
options.interval = string_to_delta(options.interval)
604
parser.error("option --interval: Unparseable time")
607
defaults = { "checker": "fping -q -- %%(fqdn)s" }
608
client_config = ConfigParser.SafeConfigParser(defaults)
609
#client_config.readfp(open("secrets.conf"), "secrets.conf")
610
client_config.read("mandos-clients.conf")
612
# From the Avahi server example code
613
DBusGMainLoop(set_as_default=True )
2781
fail_count, test_count = doctest.testmod()
2782
sys.exit(os.EX_OK if fail_count == 0 else 1)
2784
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
2803
# Parse config file for server-global settings
2804
server_config = configparser.SafeConfigParser(server_defaults)
2806
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2807
# Convert the SafeConfigParser object to a dict
2808
server_settings = server_config.defaults()
2809
# Use the appropriate methods on the non-string config options
2810
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2811
server_settings[option] = server_config.getboolean("DEFAULT",
2813
if server_settings["port"]:
2814
server_settings["port"] = server_config.getint("DEFAULT",
2816
if server_settings["socket"]:
2817
server_settings["socket"] = server_config.getint("DEFAULT",
2819
# Later, stdin will, and stdout and stderr might, be dup'ed
2820
# over with an opened os.devnull. But we don't want this to
2821
# happen with a supplied network socket.
2822
if 0 <= server_settings["socket"] <= 2:
2823
server_settings["socket"] = os.dup(server_settings
2827
# Override the settings from the config file with command line
2829
for option in ("interface", "address", "port", "debug",
2830
"priority", "servicename", "configdir", "use_dbus",
2831
"use_ipv6", "debuglevel", "restore", "statedir",
2832
"socket", "foreground", "zeroconf"):
2833
value = getattr(options, option)
2834
if value is not None:
2835
server_settings[option] = value
2837
# Force all strings to be unicode
2838
for option in server_settings.keys():
2839
if isinstance(server_settings[option], bytes):
2840
server_settings[option] = (server_settings[option]
2842
# Force all boolean options to be boolean
2843
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2844
"foreground", "zeroconf"):
2845
server_settings[option] = bool(server_settings[option])
2846
# Debug implies foreground
2847
if server_settings["debug"]:
2848
server_settings["foreground"] = True
2849
# Now we have our good server settings in "server_settings"
2851
##################################################################
2853
if (not server_settings["zeroconf"]
2854
and not (server_settings["port"]
2855
or server_settings["socket"] != "")):
2856
parser.error("Needs port or socket to work without Zeroconf")
2859
debug = server_settings["debug"]
2860
debuglevel = server_settings["debuglevel"]
2861
use_dbus = server_settings["use_dbus"]
2862
use_ipv6 = server_settings["use_ipv6"]
2863
stored_state_path = os.path.join(server_settings["statedir"],
2865
foreground = server_settings["foreground"]
2866
zeroconf = server_settings["zeroconf"]
2869
initlogger(debug, logging.DEBUG)
2874
level = getattr(logging, debuglevel.upper())
2875
initlogger(debug, level)
2877
if server_settings["servicename"] != "Mandos":
2878
syslogger.setFormatter(
2879
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
' %(levelname)s: %(message)s'.format(
2881
server_settings["servicename"])))
2883
# Parse config file with clients
2884
client_config = configparser.SafeConfigParser(Client
2886
client_config.read(os.path.join(server_settings["configdir"],
2889
global mandos_dbus_service
2890
mandos_dbus_service = None
2893
if server_settings["socket"] != "":
2894
socketfd = server_settings["socket"]
2895
tcp_server = MandosServer(
2896
(server_settings["address"], server_settings["port"]),
2898
interface=(server_settings["interface"] or None),
2900
gnutls_priority=server_settings["priority"],
2904
pidfilename = "/run/mandos.pid"
2905
if not os.path.isdir("/run/."):
2906
pidfilename = "/var/run/mandos.pid"
2909
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2910
except IOError as e:
2911
logger.error("Could not open file %r", pidfilename,
2914
for name in ("_mandos", "mandos", "nobody"):
2916
uid = pwd.getpwnam(name).pw_uid
2917
gid = pwd.getpwnam(name).pw_gid
2927
except OSError as error:
2928
if error.errno != errno.EPERM:
2932
# Enable all possible GnuTLS debugging
2934
# "Use a log level over 10 to enable all debugging options."
2936
gnutls.global_set_log_level(11)
2939
def debug_gnutls(level, string):
2940
logger.debug("GnuTLS: %s", string[:-1])
2942
gnutls.global_set_log_function(debug_gnutls)
2944
# Redirect stdin so all checkers get /dev/null
2945
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2946
os.dup2(null, sys.stdin.fileno())
2950
# Need to fork before connecting to D-Bus
2952
# Close all input and output, do double fork, etc.
2955
# multiprocessing will use threads, so before we use gobject we
2956
# need to inform gobject that threads will be used.
2957
gobject.threads_init()
2960
# From the Avahi example code
2961
DBusGMainLoop(set_as_default=True)
614
2962
main_loop = gobject.MainLoop()
615
2963
bus = dbus.SystemBus()
616
server = dbus.Interface(
617
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
618
avahi.DBUS_INTERFACE_SERVER )
619
2964
# End of Avahi example code
621
debug = options.debug
624
console = logging.StreamHandler()
625
# console.setLevel(logging.DEBUG)
626
console.setFormatter(logging.Formatter\
627
('%(levelname)s: %(message)s'))
628
logger.addHandler(console)
632
def remove_from_clients(client):
633
clients.remove(client)
635
logger.debug(u"No clients left, exiting")
638
clients.update(Set(Client(name=section, options=options,
639
stop_hook = remove_from_clients,
640
**(dict(client_config\
642
for section in client_config.sections()))
2967
bus_name = dbus.service.BusName("se.recompile.Mandos",
2970
old_bus_name = dbus.service.BusName(
2971
"se.bsnet.fukt.Mandos", bus,
2973
except dbus.exceptions.DBusException as e:
2974
logger.error("Disabling D-Bus:", exc_info=e)
2976
server_settings["use_dbus"] = False
2977
tcp_server.use_dbus = False
2979
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2985
if server_settings["interface"]:
2986
service.interface = if_nametoindex(
2987
server_settings["interface"].encode("utf-8"))
2989
global multiprocessing_manager
2990
multiprocessing_manager = multiprocessing.Manager()
2992
client_class = Client
2994
client_class = functools.partial(ClientDBus, bus = bus)
2996
client_settings = Client.config_parser(client_config)
2997
old_client_settings = {}
3000
# This is used to redirect stdout and stderr for checker processes
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3003
# Only used if server is running in foreground but not in debug
3005
if debug or not foreground:
3008
# Get client data and settings from last running state.
3009
if server_settings["restore"]:
3011
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3014
os.remove(stored_state_path)
3015
except IOError as e:
3016
if e.errno == errno.ENOENT:
3017
logger.warning("Could not load persistent state:"
3018
" {}".format(os.strerror(e.errno)))
3020
logger.critical("Could not load persistent state:",
3023
except EOFError as e:
3024
logger.warning("Could not load persistent state: "
3028
with PGPEngine() as pgp:
3029
for client_name, client in clients_data.items():
3030
# Skip removed clients
3031
if client_name not in client_settings:
3034
# Decide which value to use after restoring saved state.
3035
# We have three different values: Old config file,
3036
# new config file, and saved state.
3037
# New config value takes precedence if it differs from old
3038
# config value, otherwise use saved state.
3039
for name, value in client_settings[client_name].items():
3041
# For each value in new config, check if it
3042
# differs from the old config value (Except for
3043
# the "secret" attribute)
3044
if (name != "secret"
3046
old_client_settings[client_name][name])):
3047
client[name] = value
3051
# Clients who has passed its expire date can still be
3052
# enabled if its last checker was successful. A Client
3053
# whose checker succeeded before we stored its state is
3054
# assumed to have successfully run all checkers during
3056
if client["enabled"]:
3057
if datetime.datetime.utcnow() >= client["expires"]:
3058
if not client["last_checked_ok"]:
3060
"disabling client {} - Client never "
3061
"performed a successful checker".format(
3063
client["enabled"] = False
3064
elif client["last_checker_status"] != 0:
3066
"disabling client {} - Client last"
3067
" checker failed with error code"
3070
client["last_checker_status"]))
3071
client["enabled"] = False
3073
client["expires"] = (
3074
datetime.datetime.utcnow()
3075
+ client["timeout"])
3076
logger.debug("Last checker succeeded,"
3077
" keeping {} enabled".format(
3080
client["secret"] = pgp.decrypt(
3081
client["encrypted_secret"],
3082
client_settings[client_name]["secret"])
3084
# If decryption fails, we use secret from new settings
3085
logger.debug("Failed to decrypt {} old secret".format(
3087
client["secret"] = (client_settings[client_name]
3090
# Add/remove clients based on new changes made to config
3091
for client_name in (set(old_client_settings)
3092
- set(client_settings)):
3093
del clients_data[client_name]
3094
for client_name in (set(client_settings)
3095
- set(old_client_settings)):
3096
clients_data[client_name] = client_settings[client_name]
3098
# Create all client objects
3099
for client_name, client in clients_data.items():
3100
tcp_server.clients[client_name] = client_class(
3103
server_settings = server_settings)
3105
if not tcp_server.clients:
3106
logger.warning("No clients defined")
3109
if pidfile is not None:
3113
print(pid, file=pidfile)
3115
logger.error("Could not write to file %r with PID %d",
3120
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3125
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3127
class MandosDBusService(DBusObjectWithObjectManager):
3128
"""A D-Bus proxy object"""
3131
dbus.service.Object.__init__(self, bus, "/")
3133
_interface = "se.recompile.Mandos"
3135
@dbus.service.signal(_interface, signature="o")
3136
def ClientAdded(self, objpath):
3140
@dbus.service.signal(_interface, signature="ss")
3141
def ClientNotFound(self, fingerprint, address):
3145
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3147
@dbus.service.signal(_interface, signature="os")
3148
def ClientRemoved(self, objpath, name):
3152
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3154
@dbus.service.method(_interface, out_signature="ao")
3155
def GetAllClients(self):
3157
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
3160
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3162
@dbus.service.method(_interface,
3163
out_signature="a{oa{sv}}")
3164
def GetAllClientsWithProperties(self):
3166
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3168
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
3172
@dbus.service.method(_interface, in_signature="o")
3173
def RemoveClient(self, object_path):
3175
for c in tcp_server.clients.itervalues():
3176
if c.dbus_object_path == object_path:
3177
del tcp_server.clients[c.name]
3178
c.remove_from_connection()
3179
# Don't signal the disabling
3180
c.disable(quiet=True)
3181
# Emit D-Bus signal for removal
3182
self.client_removed_signal(c)
3184
raise KeyError(object_path)
3188
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3190
def GetManagedObjects(self):
3192
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3195
{ interface: client.GetAll(interface)
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3200
def client_added_signal(self, client):
3201
"""Send the new standard signal and the old signal"""
3203
# New standard signal
3204
self.InterfacesAdded(
3205
client.dbus_object_path,
3207
{ interface: client.GetAll(interface)
3209
client._get_all_interface_names()}))
3211
self.ClientAdded(client.dbus_object_path)
3213
def client_removed_signal(self, client):
3214
"""Send the new standard signal and the old signal"""
3216
# New standard signal
3217
self.InterfacesRemoved(
3218
client.dbus_object_path,
3219
client._get_all_interface_names())
3221
self.ClientRemoved(client.dbus_object_path,
3224
mandos_dbus_service = MandosDBusService()
648
3227
"Cleanup function; run on exit"
650
# From the Avahi server example code
651
if not group is None:
654
# End of Avahi example code
656
for client in clients:
657
client.stop_hook = None
3231
multiprocessing.active_children()
3233
if not (tcp_server.clients or client_settings):
3236
# Store client before exiting. Secrets are encrypted with key
3237
# based on what config file has. If config file is
3238
# removed/edited, old secret will thus be unrecovable.
3240
with PGPEngine() as pgp:
3241
for client in tcp_server.clients.itervalues():
3242
key = client_settings[client.name]["secret"]
3243
client.encrypted_secret = pgp.encrypt(client.secret,
3247
# A list of attributes that can not be pickled
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3251
for name, typ in inspect.getmembers(dbus.service
3255
client_dict["encrypted_secret"] = (client
3257
for attr in client.client_structure:
3258
if attr not in exclude:
3259
client_dict[attr] = getattr(client, attr)
3261
clients[client.name] = client_dict
3262
del client_settings[client.name]["secret"]
3265
with tempfile.NamedTemporaryFile(
3269
dir=os.path.dirname(stored_state_path),
3270
delete=False) as stored_state:
3271
pickle.dump((clients, client_settings), stored_state)
3272
tempname = stored_state.name
3273
os.rename(tempname, stored_state_path)
3274
except (IOError, OSError) as e:
3280
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3281
logger.warning("Could not save persistent state: {}"
3282
.format(os.strerror(e.errno)))
3284
logger.warning("Could not save persistent state:",
3288
# Delete all clients, and settings from config
3289
while tcp_server.clients:
3290
name, client = tcp_server.clients.popitem()
3292
client.remove_from_connection()
3293
# Don't signal the disabling
3294
client.disable(quiet=True)
3295
# Emit D-Bus signal for removal
3297
mandos_dbus_service.client_removed_signal(client)
3298
client_settings.clear()
660
3300
atexit.register(cleanup)
663
signal.signal(signal.SIGINT, signal.SIG_IGN)
664
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
665
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
667
for client in clients:
670
tcp_server = IPv6_TCPServer((None, options.port),
674
# Find out what random port we got
675
servicePort = tcp_server.socket.getsockname()[1]
676
logger.debug(u"Now listening on port %d", servicePort)
678
if options.interface is not None:
679
serviceInterface = if_nametoindex(options.interface)
681
# From the Avahi server example code
682
server.connect_to_signal("StateChanged", server_state_changed)
684
server_state_changed(server.GetState())
685
except dbus.exceptions.DBusException, error:
686
logger.critical(u"DBusException: %s", error)
688
# End of Avahi example code
690
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
691
lambda *args, **kwargs:
692
tcp_server.handle_request(*args[2:],
695
main_loop_started = True
3302
for client in tcp_server.clients.itervalues():
3304
# Emit D-Bus signal for adding
3305
mandos_dbus_service.client_added_signal(client)
3306
# Need to initiate checking of clients
3308
client.init_checker()
3311
tcp_server.server_activate()
3313
# Find out what port we got
3315
service.port = tcp_server.socket.getsockname()[1]
3317
logger.info("Now listening on address %r, port %d,"
3318
" flowinfo %d, scope_id %d",
3319
*tcp_server.socket.getsockname())
3321
logger.info("Now listening on address %r, port %d",
3322
*tcp_server.socket.getsockname())
3324
#service.interface = tcp_server.socket.getsockname()[3]
3328
# From the Avahi example code
3331
except dbus.exceptions.DBusException as error:
3332
logger.critical("D-Bus Exception", exc_info=error)
3335
# End of Avahi example code
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
lambda *args, **kwargs:
3339
(tcp_server.handle_request
3340
(*args[2:], **kwargs) or True))
3342
logger.debug("Starting main loop")
3344
except AvahiError as error:
3345
logger.critical("Avahi Error", exc_info=error)
697
3348
except KeyboardInterrupt:
3350
print("", file=sys.stderr)
3351
logger.debug("Server received KeyboardInterrupt")
3352
logger.debug("Server exiting")
3353
# Must run before the D-Bus bus name gets deregistered
3357
if __name__ == '__main__':