/mandos/release : revision 237.2.197

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

64

69

65

import dbus

70

66

import dbus.service

75

71

import ctypes.util

76

72

import xml.dom.minidom

77

73

import inspect

78

import GnuPGInterface

79

74

80

75

try:

81

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

80

except ImportError:

86

81

SO_BINDTODEVICE = None

87

82

88

version = "1.5.1"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

83

84

version = "1.0.14"

85

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

92

88

syslogger = (logging.handlers.SysLogHandler

93

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

210

90

address = "/dev/log"))

91

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

logger.addHandler(syslogger)

95

96

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

100

logger.addHandler(console)

211

101

212

102

class AvahiError(Exception):

213

103

def __init__(self, value, *args, **kwargs):

229

119

Attributes:

230

120

interface: integer; avahi.IF_UNSPEC or an interface index.

231

121

Used to optionally bind to the specified interface.

232

233

type: string; Example: '_mandos._tcp'.

122

123

type: string; Example: u'_mandos._tcp'.

234

124

See <http://www.dns-sd.org/ServiceTypes.html>

235

125

port: integer; what port to announce

236

126

TXT: list of strings; TXT record for the service

245

135

"""

246

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

247

137

servicetype = None, port = None, TXT = None,

248

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

249

139

protocol = avahi.PROTO_UNSPEC, bus = None):

250

140

self.interface = interface

251

141

self.name = name

260

150

self.group = None # our entry group

261

151

self.server = None

262

152

self.bus = bus

263

self.entry_group_state_changed_match = None

264

153

def rename(self):

265

154

"""Derived from the Avahi example code"""

266

155

if self.rename_count >= self.max_renames:

267

logger.critical("No suitable Zeroconf service name found"

268

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

269

158

self.rename_count)

270

raise AvahiServiceError("Too many renames")

271

self.name = unicode(self.server

272

.GetAlternativeServiceName(self.name))

273

logger.info("Changing Zeroconf service name to %r ...",

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

274

162

self.name)

163

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

166

% self.name))

275

167

self.remove()

276

168

try:

277

169

self.add()

278

except dbus.exceptions.DBusException as error:

279

logger.critical("DBusException: %s", error)

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

280

172

self.cleanup()

281

173

os._exit(1)

282

174

self.rename_count += 1

283

175

def remove(self):

284

176

"""Derived from the Avahi example code"""

285

if self.entry_group_state_changed_match is not None:

286

self.entry_group_state_changed_match.remove()

287

self.entry_group_state_changed_match = None

288

177

if self.group is not None:

289

178

self.group.Reset()

290

179

def add(self):

291

180

"""Derived from the Avahi example code"""

292

self.remove()

293

181

if self.group is None:

294

182

self.group = dbus.Interface(

295

183

self.bus.get_object(avahi.DBUS_NAME,

296

184

self.server.EntryGroupNew()),

297

185

avahi.DBUS_INTERFACE_ENTRY_GROUP)

298

self.entry_group_state_changed_match = (

299

self.group.connect_to_signal(

300

'StateChanged', self.entry_group_state_changed))

301

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

302

190

self.name, self.type)

303

191

self.group.AddService(

304

192

self.interface,

311

199

self.group.Commit()

312

200

def entry_group_state_changed(self, state, error):

313

201

"""Derived from the Avahi example code"""

314

logger.debug("Avahi entry group state change: %i", state)

202

logger.debug(u"Avahi entry group state change: %i", state)

315

203

316

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

317

logger.debug("Zeroconf service established.")

205

logger.debug(u"Zeroconf service established.")

318

206

elif state == avahi.ENTRY_GROUP_COLLISION:

319

logger.info("Zeroconf service name collision.")

207

logger.warning(u"Zeroconf service name collision.")

320

208

self.rename()

321

209

elif state == avahi.ENTRY_GROUP_FAILURE:

322

logger.critical("Avahi: Error in group state changed %s",

210

logger.critical(u"Avahi: Error in group state changed %s",

323

211

unicode(error))

324

raise AvahiGroupError("State changed: %s"

212

raise AvahiGroupError(u"State changed: %s"

325

213

% unicode(error))

326

214

def cleanup(self):

327

215

"""Derived from the Avahi example code"""

328

216

if self.group is not None:

329

try:

330

self.group.Free()

331

except (dbus.exceptions.UnknownMethodException,

332

dbus.exceptions.DBusException):

333

pass

217

self.group.Free()

334

218

self.group = None

335

self.remove()

336

def server_state_changed(self, state, error=None):

219

def server_state_changed(self, state):

337

220

"""Derived from the Avahi example code"""

338

logger.debug("Avahi server state change: %i", state)

339

bad_states = { avahi.SERVER_INVALID:

340

"Zeroconf server invalid",

341

avahi.SERVER_REGISTERING: None,

342

avahi.SERVER_COLLISION:

343

"Zeroconf server name collision",

344

avahi.SERVER_FAILURE:

345

"Zeroconf server failure" }

346

if state in bad_states:

347

if bad_states[state] is not None:

348

if error is None:

349

logger.error(bad_states[state])

350

else:

351

logger.error(bad_states[state] + ": %r", error)

352

self.cleanup()

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

353

225

elif state == avahi.SERVER_RUNNING:

354

226

self.add()

355

else:

356

if error is None:

357

logger.debug("Unknown state: %r", state)

358

else:

359

logger.debug("Unknown state: %r: %r", state, error)

360

227

def activate(self):

361

228

"""Derived from the Avahi example code"""

362

229

if self.server is None:

363

230

self.server = dbus.Interface(

364

231

self.bus.get_object(avahi.DBUS_NAME,

365

avahi.DBUS_PATH_SERVER,

366

follow_name_owner_changes=True),

232

avahi.DBUS_PATH_SERVER),

367

233

avahi.DBUS_INTERFACE_SERVER)

368

self.server.connect_to_signal("StateChanged",

234

self.server.connect_to_signal(u"StateChanged",

369

235

self.server_state_changed)

370

236

self.server_state_changed(self.server.GetState())

371

237

372

class AvahiServiceToSyslog(AvahiService):

373

def rename(self):

374

"""Add the new name to the syslog messages"""

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

380

return ret

381

238

382

def timedelta_to_milliseconds(td):

383

"Convert a datetime.timedelta() to milliseconds"

384

return ((td.days * 24 * 60 * 60 * 1000)

385

+ (td.seconds * 1000)

386

+ (td.microseconds // 1000))

387

388

239

class Client(object):

389

240

"""A representation of a client host served by this server.

390

241

391

242

Attributes:

392

approved: bool(); 'None' if not yet approved/disapproved

393

approval_delay: datetime.timedelta(); Time to wait for approval

394

approval_duration: datetime.timedelta(); Duration of one approval

243

244

D-Bus identifiers

245

fingerprint: string (40 or 32 hexadecimal digits); used to

246

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

250

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

253

timeout: datetime.timedelta(); How long from last_checked_ok

254

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

395

257

checker: subprocess.Popen(); a running checker process used

396

258

to see if the client lives.

397

259

'None' if no process is running.

398

checker_callback_tag: a gobject event source tag, or None

399

checker_command: string; External command which is run to check

400

if client lives. %() expansions are done at

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

401

265

runtime with vars(self) as dict, so that for

402

266

instance %(name)s can be used in the command.

403

checker_initiator_tag: a gobject event source tag, or None

404

created: datetime.datetime(); (UTC) object creation

405

client_structure: Object describing what attributes a client has

406

and is used for storing the client at exit

407

267

current_checker_command: string; current running checker_command

408

disable_initiator_tag: a gobject event source tag, or None

409

enabled: bool()

410

fingerprint: string (40 or 32 hexadecimal digits); used to

411

uniquely identify the client

412

host: string; available for use by the checker command

413

interval: datetime.timedelta(); How often to start a new checker

414

last_approval_request: datetime.datetime(); (UTC) or None

415

last_checked_ok: datetime.datetime(); (UTC) or None

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, or None.

419

last_enabled: datetime.datetime(); (UTC) or None

420

421

D-Bus identifiers

422

secret: bytestring; sent verbatim (over TLS) to client

423

timeout: datetime.timedelta(); How long from last_checked_ok

424

until this client is disabled

425

extended_timeout: extra long timeout when secret has been sent

426

runtime_expansions: Allowed attributes for runtime expansion.

427

expires: datetime.datetime(); time (UTC) when a client will be

428

disabled, or None

268

approval_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approval_duration: datetime.timedelta(); Duration of one approval

429

271

"""

430

272

431

runtime_expansions = ("approval_delay", "approval_duration",

432

"created", "enabled", "fingerprint",

433

"host", "interval", "last_checked_ok",

434

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

273

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

445

279

446

280

def timeout_milliseconds(self):

447

281

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

449

450

def extended_timeout_milliseconds(self):

451

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

282

return self._timedelta_to_milliseconds(self.timeout)

453

283

454

284

def interval_milliseconds(self):

455

285

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

457

286

return self._timedelta_to_milliseconds(self.interval)

287

458

288

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

"""Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above.

466

NOTE: Must be a pure function. Must return the same result

467

value given the same arguments.

468

"""

469

settings = {}

470

for client_name in config.sections():

471

section = dict(config.items(client_name))

472

client = settings[client_name] = {}

473

474

client["host"] = section["host"]

475

# Reformat values from string types to Python types

476

client["approved_by_default"] = config.getboolean(

477

client_name, "approved_by_default")

478

client["enabled"] = config.getboolean(client_name,

479

"enabled")

480

481

client["fingerprint"] = (section["fingerprint"].upper()

482

.replace(" ", ""))

483

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

485

elif "secfile" in section:

486

with open(os.path.expanduser(os.path.expandvars

487

(section["secfile"])),

488

"rb") as secfile:

489

client["secret"] = secfile.read()

490

else:

491

raise TypeError("No secret or secfile for section %s"

492

% section)

493

client["timeout"] = string_to_delta(section["timeout"])

494

client["extended_timeout"] = string_to_delta(

495

section["extended_timeout"])

496

client["interval"] = string_to_delta(section["interval"])

497

client["approval_delay"] = string_to_delta(

498

section["approval_delay"])

499

client["approval_duration"] = string_to_delta(

500

section["approval_duration"])

501

client["checker_command"] = section["checker"]

502

client["last_approval_request"] = None

503

client["last_checked_ok"] = None

504

client["last_checker_status"] = None

505

506

return settings

507

508

509

def __init__(self, settings, name = None):

289

return self._timedelta_to_milliseconds(self.approval_delay)

290

291

def __init__(self, name = None, disable_hook=None, config=None):

510

292

"""Note: the 'checker' key in 'config' sets the

511

293

'checker_command' attribute and *not* the 'checker'

512

294

attribute."""

513

295

self.name = name

514

# adding all client settings

515

for setting, value in settings.iteritems():

516

setattr(self, setting, value)

517

518

if self.enabled:

519

if not hasattr(self, "last_enabled"):

520

self.last_enabled = datetime.datetime.utcnow()

521

if not hasattr(self, "expires"):

522

self.expires = (datetime.datetime.utcnow()

523

+ self.timeout)

524

else:

525

self.last_enabled = None

526

self.expires = None

527

528

logger.debug("Creating client %r", self.name)

296

if config is None:

297

config = {}

298

logger.debug(u"Creating client %r", self.name)

529

299

# Uppercase and remove spaces from fingerprint for later

530

300

# comparison purposes with return value from the fingerprint()

531

301

# function

532

logger.debug(" Fingerprint: %s", self.fingerprint)

533

self.created = settings.get("created",

534

datetime.datetime.utcnow())

535

536

# attributes specific for this server instance

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

308

with open(os.path.expanduser(os.path.expandvars

309

(config[u"secfile"])),

310

"rb") as secfile:

311

self.secret = secfile.read()

312

else:

313

raise TypeError(u"No secret or secfile for client %s"

314

% self.name)

315

self.host = config.get(u"host", u"")

316

self.created = datetime.datetime.utcnow()

317

self.enabled = False

318

self.last_enabled = None

319

self.last_checked_ok = None

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

322

self.disable_hook = disable_hook

537

323

self.checker = None

538

324

self.checker_initiator_tag = None

539

325

self.disable_initiator_tag = None

540

326

self.checker_callback_tag = None

327

self.checker_command = config[u"checker"]

541

328

self.current_checker_command = None

542

self.approved = None

329

self.last_connect = None

330

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

332

True)

543

333

self.approvals_pending = 0

544

self.changedstate = (multiprocessing_manager

545

.Condition(multiprocessing_manager

546

.Lock()))

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

549

if not attr.startswith("_")]

550

self.client_structure.append("client_structure")

551

552

for name, t in inspect.getmembers(type(self),

553

lambda obj:

554

isinstance(obj,

555

property)):

556

if not name.startswith("_"):

557

self.client_structure.append(name)

334

self.approval_delay = string_to_delta(

335

config[u"approval_delay"])

336

self.approval_duration = string_to_delta(

337

config[u"approval_duration"])

338

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

558

339

559

# Send notice to process children that client state has changed

560

340

def send_changedstate(self):

561

with self.changedstate:

562

self.changedstate.notify_all()

563

341

self.changedstate.acquire()

342

self.changedstate.notify_all()

343

self.changedstate.release()

344

564

345

def enable(self):

565

346

"""Start this client's checker and timeout hooks"""

566

if getattr(self, "enabled", False):

347

if getattr(self, u"enabled", False):

567

348

# Already enabled

568

349

return

569

350

self.send_changedstate()

570

self.expires = datetime.datetime.utcnow() + self.timeout

571

self.enabled = True

572

351

self.last_enabled = datetime.datetime.utcnow()

573

self.init_checker()

574

575

def disable(self, quiet=True):

576

"""Disable this client."""

577

if not getattr(self, "enabled", False):

578

return False

579

if not quiet:

580

self.send_changedstate()

581

if not quiet:

582

logger.info("Disabling client %s", self.name)

583

if getattr(self, "disable_initiator_tag", False):

584

gobject.source_remove(self.disable_initiator_tag)

585

self.disable_initiator_tag = None

586

self.expires = None

587

if getattr(self, "checker_initiator_tag", False):

588

gobject.source_remove(self.checker_initiator_tag)

589

self.checker_initiator_tag = None

590

self.stop_checker()

591

self.enabled = False

592

# Do not run this again if called by a gobject.timeout_add

593

return False

594

595

def __del__(self):

596

self.disable()

597

598

def init_checker(self):

599

352

# Schedule a new checker to be started an 'interval' from now,

600

353

# and every interval from then on.

601

354

self.checker_initiator_tag = (gobject.timeout_add

605

358

self.disable_initiator_tag = (gobject.timeout_add

606

359

(self.timeout_milliseconds(),

607

360

self.disable))

361

self.enabled = True

608

362

# Also start a new checker *right now*.

609

363

self.start_checker()

610

364

365

def disable(self, quiet=True):

366

"""Disable this client."""

367

if not getattr(self, "enabled", False):

368

return False

369

if not quiet:

370

self.send_changedstate()

371

if not quiet:

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

374

gobject.source_remove(self.disable_initiator_tag)

375

self.disable_initiator_tag = None

376

if getattr(self, u"checker_initiator_tag", False):

377

gobject.source_remove(self.checker_initiator_tag)

378

self.checker_initiator_tag = None

379

self.stop_checker()

380

if self.disable_hook:

381

self.disable_hook(self)

382

self.enabled = False

383

# Do not run this again if called by a gobject.timeout_add

384

return False

385

386

def __del__(self):

387

self.disable_hook = None

388

self.disable()

389

611

390

def checker_callback(self, pid, condition, command):

612

391

"""The checker has completed, so take appropriate actions."""

613

392

self.checker_callback_tag = None

614

393

self.checker = None

615

394

if os.WIFEXITED(condition):

616

self.last_checker_status = os.WEXITSTATUS(condition)

617

if self.last_checker_status == 0:

618

logger.info("Checker for %(name)s succeeded",

395

exitstatus = os.WEXITSTATUS(condition)

396

if exitstatus == 0:

397

logger.info(u"Checker for %(name)s succeeded",

619

398

vars(self))

620

399

self.checked_ok()

621

400

else:

622

logger.info("Checker for %(name)s failed",

401

logger.info(u"Checker for %(name)s failed",

623

402

vars(self))

624

403

else:

625

self.last_checker_status = -1

626

logger.warning("Checker for %(name)s crashed?",

404

logger.warning(u"Checker for %(name)s crashed?",

627

405

vars(self))

628

406

629

def checked_ok(self, timeout=None):

407

def checked_ok(self):

630

408

"""Bump up the timeout for this client.

631

409

632

410

This should only be called when the client has been seen,

633

411

alive and well.

634

412

"""

635

if timeout is None:

636

timeout = self.timeout

637

413

self.last_checked_ok = datetime.datetime.utcnow()

638

if self.disable_initiator_tag is not None:

639

gobject.source_remove(self.disable_initiator_tag)

640

if getattr(self, "enabled", False):

641

self.disable_initiator_tag = (gobject.timeout_add

642

(timedelta_to_milliseconds

643

(timeout), self.disable))

644

self.expires = datetime.datetime.utcnow() + timeout

645

646

def need_approval(self):

647

self.last_approval_request = datetime.datetime.utcnow()

414

gobject.source_remove(self.disable_initiator_tag)

415

self.disable_initiator_tag = (gobject.timeout_add

416

(self.timeout_milliseconds(),

417

self.disable))

648

418

649

419

def start_checker(self):

650

420

"""Start a new checker subprocess if one is not running.

663

433

# If a checker exists, make sure it is not a zombie

664

434

try:

665

435

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

666

except (AttributeError, OSError) as error:

436

except (AttributeError, OSError), error:

667

437

if (isinstance(error, OSError)

668

438

and error.errno != errno.ECHILD):

669

439

raise error

670

440

else:

671

441

if pid:

672

logger.warning("Checker was a zombie")

442

logger.warning(u"Checker was a zombie")

673

443

gobject.source_remove(self.checker_callback_tag)

674

444

self.checker_callback(pid, status,

675

445

self.current_checker_command)

680

450

command = self.checker_command % self.host

681

451

except TypeError:

682

452

# Escape attributes for the shell

683

escaped_attrs = dict(

684

(attr,

685

re.escape(unicode(str(getattr(self, attr, "")),

686

errors=

687

'replace')))

688

for attr in

689

self.runtime_expansions)

690

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

691

459

try:

692

460

command = self.checker_command % escaped_attrs

693

except TypeError as error:

694

logger.error('Could not format string "%s":'

695

' %s', self.checker_command, error)

461

except TypeError, error:

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

696

464

return True # Try again later

697

465

self.current_checker_command = command

698

466

try:

699

logger.info("Starting checker %r for %s",

467

logger.info(u"Starting checker %r for %s",

700

468

command, self.name)

701

469

# We don't need to redirect stdout and stderr, since

702

470

# in normal mode, that is already done by daemon(),

704

472

# always replaced by /dev/null.)

705

473

self.checker = subprocess.Popen(command,

706

474

close_fds=True,

707

shell=True, cwd="/")

475

shell=True, cwd=u"/")

708

476

self.checker_callback_tag = (gobject.child_watch_add

709

477

(self.checker.pid,

710

478

self.checker_callback,

715

483

if pid:

716

484

gobject.source_remove(self.checker_callback_tag)

717

485

self.checker_callback(pid, status, command)

718

except OSError as error:

719

logger.error("Failed to start subprocess: %s",

486

except OSError, error:

487

logger.error(u"Failed to start subprocess: %s",

720

488

error)

721

489

# Re-run this periodically if run by gobject.timeout_add

722

490

return True

726

494

if self.checker_callback_tag:

727

495

gobject.source_remove(self.checker_callback_tag)

728

496

self.checker_callback_tag = None

729

if getattr(self, "checker", None) is None:

497

if getattr(self, u"checker", None) is None:

730

498

return

731

logger.debug("Stopping checker for %(name)s", vars(self))

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

732

500

try:

733

501

os.kill(self.checker.pid, signal.SIGTERM)

734

502

#time.sleep(0.5)

735

503

#if self.checker.poll() is None:

736

504

# os.kill(self.checker.pid, signal.SIGKILL)

737

except OSError as error:

505

except OSError, error:

738

506

if error.errno != errno.ESRCH: # No such process

739

507

raise

740

508

self.checker = None

741

509

742

743

def dbus_service_property(dbus_interface, signature="v",

744

access="readwrite", byte_arrays=False):

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

745

512

"""Decorators for marking methods of a DBusObjectWithProperties to

746

513

become properties on the D-Bus.

747

514

754

521

"""

755

522

# Encoding deeply encoded byte arrays is not supported yet by the

756

523

# "Set" method, so we fail early here:

757

if byte_arrays and signature != "ay":

758

raise ValueError("Byte arrays not supported for non-'ay'"

759

" signature %r" % signature)

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

760

527

def decorator(func):

761

528

func._dbus_is_property = True

762

529

func._dbus_interface = dbus_interface

763

530

func._dbus_signature = signature

764

531

func._dbus_access = access

765

532

func._dbus_name = func.__name__

766

if func._dbus_name.endswith("_dbus_property"):

533

if func._dbus_name.endswith(u"_dbus_property"):

767

534

func._dbus_name = func._dbus_name[:-14]

768

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

769

536

return func

770

537

return decorator

771

538

791

558

792

559

class DBusObjectWithProperties(dbus.service.Object):

793

560

"""A D-Bus object with properties.

794

561

795

562

Classes inheriting from this can use the dbus_service_property

796

563

decorator to expose methods as D-Bus properties. It exposes the

797

564

standard Get(), Set(), and GetAll() methods on the D-Bus.

799

566

800

567

@staticmethod

801

568

def _is_dbus_property(obj):

802

return getattr(obj, "_dbus_is_property", False)

569

return getattr(obj, u"_dbus_is_property", False)

803

570

804

571

def _get_all_dbus_properties(self):

805

572

"""Returns a generator of (name, attribute) pairs

806

573

"""

807

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

808

for cls in self.__class__.__mro__

574

return ((prop._dbus_name, prop)

809

575

for name, prop in

810

inspect.getmembers(cls, self._is_dbus_property))

576

inspect.getmembers(self, self._is_dbus_property))

811

577

812

578

def _get_dbus_property(self, interface_name, property_name):

813

579

"""Returns a bound method if one exists which is a D-Bus

814

580

property with the specified name and interface.

815

581

"""

816

for cls in self.__class__.__mro__:

817

for name, value in (inspect.getmembers

818

(cls, self._is_dbus_property)):

819

if (value._dbus_name == property_name

820

and value._dbus_interface == interface_name):

821

return value.__get__(self)

822

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

823

592

# No such property

824

raise DBusPropertyNotFound(self.dbus_object_path + ":"

825

+ interface_name + "."

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

826

595

+ property_name)

827

596

828

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

829

out_signature="v")

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

830

599

def Get(self, interface_name, property_name):

831

600

"""Standard D-Bus property Get() method, see D-Bus standard.

832

601

"""

833

602

prop = self._get_dbus_property(interface_name, property_name)

834

if prop._dbus_access == "write":

603

if prop._dbus_access == u"write":

835

604

raise DBusPropertyAccessException(property_name)

836

605

value = prop()

837

if not hasattr(value, "variant_level"):

606

if not hasattr(value, u"variant_level"):

838

607

return value

839

608

return type(value)(value, variant_level=value.variant_level+1)

840

609

841

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

842

611

def Set(self, interface_name, property_name, value):

843

612

"""Standard D-Bus property Set() method, see D-Bus standard.

844

613

"""

845

614

prop = self._get_dbus_property(interface_name, property_name)

846

if prop._dbus_access == "read":

615

if prop._dbus_access == u"read":

847

616

raise DBusPropertyAccessException(property_name)

848

if prop._dbus_get_args_options["byte_arrays"]:

617

if prop._dbus_get_args_options[u"byte_arrays"]:

849

618

# The byte_arrays option is not supported yet on

850

619

# signatures other than "ay".

851

if prop._dbus_signature != "ay":

620

if prop._dbus_signature != u"ay":

852

621

raise ValueError

853

value = dbus.ByteArray(b''.join(chr(byte)

854

for byte in value))

622

value = dbus.ByteArray(''.join(unichr(byte)

623

for byte in value))

855

624

prop(value)

856

625

857

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

858

out_signature="a{sv}")

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

859

628

def GetAll(self, interface_name):

860

629

"""Standard D-Bus property GetAll() method, see D-Bus

861

630

standard.

862

631

863

632

Note: Will not include properties with access="write".

864

633

"""

865

properties = {}

634

all = {}

866

635

for name, prop in self._get_all_dbus_properties():

867

636

if (interface_name

868

637

and interface_name != prop._dbus_interface):

869

638

# Interface non-empty but did not match

870

639

continue

871

640

# Ignore write-only properties

872

if prop._dbus_access == "write":

641

if prop._dbus_access == u"write":

873

642

continue

874

643

value = prop()

875

if not hasattr(value, "variant_level"):

876

properties[name] = value

644

if not hasattr(value, u"variant_level"):

645

all[name] = value

877

646

continue

878

properties[name] = type(value)(value, variant_level=

879

value.variant_level+1)

880

return dbus.Dictionary(properties, signature="sv")

647

all[name] = type(value)(value, variant_level=

648

value.variant_level+1)

649

return dbus.Dictionary(all, signature=u"sv")

881

650

882

651

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

883

out_signature="s",

652

out_signature=u"s",

884

653

path_keyword='object_path',

885

654

connection_keyword='connection')

886

655

def Introspect(self, object_path, connection):

891

660

try:

892

661

document = xml.dom.minidom.parseString(xmlstring)

893

662

def make_tag(document, name, prop):

894

e = document.createElement("property")

895

e.setAttribute("name", name)

896

e.setAttribute("type", prop._dbus_signature)

897

e.setAttribute("access", prop._dbus_access)

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

898

667

return e

899

for if_tag in document.getElementsByTagName("interface"):

668

for if_tag in document.getElementsByTagName(u"interface"):

900

669

for tag in (make_tag(document, name, prop)

901

670

for name, prop

902

671

in self._get_all_dbus_properties()

903

672

if prop._dbus_interface

904

== if_tag.getAttribute("name")):

673

== if_tag.getAttribute(u"name")):

905

674

if_tag.appendChild(tag)

906

675

# Add the names to the return values for the

907

676

# "org.freedesktop.DBus.Properties" methods

908

if (if_tag.getAttribute("name")

909

== "org.freedesktop.DBus.Properties"):

910

for cn in if_tag.getElementsByTagName("method"):

911

if cn.getAttribute("name") == "Get":

912

for arg in cn.getElementsByTagName("arg"):

913

if (arg.getAttribute("direction")

914

== "out"):

915

arg.setAttribute("name", "value")

916

elif cn.getAttribute("name") == "GetAll":

917

for arg in cn.getElementsByTagName("arg"):

918

if (arg.getAttribute("direction")

919

== "out"):

920

arg.setAttribute("name", "props")

921

xmlstring = document.toxml("utf-8")

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

922

691

document.unlink()

923

692

except (AttributeError, xml.dom.DOMException,

924

xml.parsers.expat.ExpatError) as error:

925

logger.error("Failed to override Introspection method",

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

926

695

error)

927

696

return xmlstring

928

697

929

698

930

def datetime_to_dbus (dt, variant_level=0):

931

"""Convert a UTC datetime.datetime() to a D-Bus type."""

932

if dt is None:

933

return dbus.String("", variant_level = variant_level)

934

return dbus.String(dt.isoformat(),

935

variant_level=variant_level)

936

937

938

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

939

.__metaclass__):

940

"""Applied to an empty subclass of a D-Bus object, this metaclass

941

will add additional D-Bus attributes matching a certain pattern.

942

"""

943

def __new__(mcs, name, bases, attr):

944

# Go through all the base classes which could have D-Bus

945

# methods, signals, or properties in them

946

for base in (b for b in bases

947

if issubclass(b, dbus.service.Object)):

948

# Go though all attributes of the base class

949

for attrname, attribute in inspect.getmembers(base):

950

# Ignore non-D-Bus attributes, and D-Bus attributes

951

# with the wrong interface name

952

if (not hasattr(attribute, "_dbus_interface")

953

or not attribute._dbus_interface

954

.startswith("se.recompile.Mandos")):

955

continue

956

# Create an alternate D-Bus interface name based on

957

# the current name

958

alt_interface = (attribute._dbus_interface

959

.replace("se.recompile.Mandos",

960

"se.bsnet.fukt.Mandos"))

961

# Is this a D-Bus signal?

962

if getattr(attribute, "_dbus_is_signal", False):

963

# Extract the original non-method function by

964

# black magic

965

nonmethod_func = (dict(

966

zip(attribute.func_code.co_freevars,

967

attribute.__closure__))["func"]

968

.cell_contents)

969

# Create a new, but exactly alike, function

970

# object, and decorate it to be a new D-Bus signal

971

# with the alternate D-Bus interface name

972

new_function = (dbus.service.signal

973

(alt_interface,

974

attribute._dbus_signature)

975

(types.FunctionType(

976

nonmethod_func.func_code,

977

nonmethod_func.func_globals,

978

nonmethod_func.func_name,

979

nonmethod_func.func_defaults,

980

nonmethod_func.func_closure)))

981

# Define a creator of a function to call both the

982

# old and new functions, so both the old and new

983

# signals gets sent when the function is called

984

def fixscope(func1, func2):

985

"""This function is a scope container to pass

986

func1 and func2 to the "call_both" function

987

outside of its arguments"""

988

def call_both(*args, **kwargs):

989

"""This function will emit two D-Bus

990

signals by calling func1 and func2"""

991

func1(*args, **kwargs)

992

func2(*args, **kwargs)

993

return call_both

994

# Create the "call_both" function and add it to

995

# the class

996

attr[attrname] = fixscope(attribute,

997

new_function)

998

# Is this a D-Bus method?

999

elif getattr(attribute, "_dbus_is_method", False):

1000

# Create a new, but exactly alike, function

1001

# object. Decorate it to be a new D-Bus method

1002

# with the alternate D-Bus interface name. Add it

1003

# to the class.

1004

attr[attrname] = (dbus.service.method

1005

(alt_interface,

1006

attribute._dbus_in_signature,

1007

attribute._dbus_out_signature)

1008

(types.FunctionType

1009

(attribute.func_code,

1010

attribute.func_globals,

1011

attribute.func_name,

1012

attribute.func_defaults,

1013

attribute.func_closure)))

1014

# Is this a D-Bus property?

1015

elif getattr(attribute, "_dbus_is_property", False):

1016

# Create a new, but exactly alike, function

1017

# object, and decorate it to be a new D-Bus

1018

# property with the alternate D-Bus interface

1019

# name. Add it to the class.

1020

attr[attrname] = (dbus_service_property

1021

(alt_interface,

1022

attribute._dbus_signature,

1023

attribute._dbus_access,

1024

attribute

1025

._dbus_get_args_options

1026

["byte_arrays"])

1027

(types.FunctionType

1028

(attribute.func_code,

1029

attribute.func_globals,

1030

attribute.func_name,

1031

attribute.func_defaults,

1032

attribute.func_closure)))

1033

return type.__new__(mcs, name, bases, attr)

1034

1035

1036

699

class ClientDBus(Client, DBusObjectWithProperties):

1037

700

"""A Client class using D-Bus

1038

701

1040

703

dbus_object_path: dbus.ObjectPath

1041

704

bus: dbus.SystemBus()

1042

705

"""

1043

1044

runtime_expansions = (Client.runtime_expansions

1045

+ ("dbus_object_path",))

1046

1047

706

# dbus.service.Object doesn't use super(), so we can't either.

1048

707

1049

708

def __init__(self, bus = None, *args, **kwargs):

709

self._approvals_pending = 0

1050

710

self.bus = bus

1051

711

Client.__init__(self, *args, **kwargs)

1052

712

# Only now, when this client is initialized, can it show up on

1053

713

# the D-Bus

1054

client_object_name = unicode(self.name).translate(

1055

{ord("."): ord("_"),

1056

ord("-"): ord("_")})

1057

714

self.dbus_object_path = (dbus.ObjectPath

1058

("/clients/" + client_object_name))

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

1059

717

DBusObjectWithProperties.__init__(self, self.bus,

1060

718

self.dbus_object_path)

1061

719

1062

def notifychangeproperty(transform_func,

1063

dbus_name, type_func=lambda x: x,

1064

variant_level=1):

1065

""" Modify a variable so that it's a property which announces

1066

its changes to DBus.

1067

1068

transform_fun: Function that takes a value and a variant_level

1069

and transforms it to a D-Bus type.

1070

dbus_name: D-Bus name of the variable

1071

type_func: Function that transform the value before sending it

1072

to the D-Bus. Default: no transform

1073

variant_level: D-Bus variant level. Default: 1

1074

"""

1075

attrname = "_{0}".format(dbus_name)

1076

def setter(self, value):

1077

if hasattr(self, "dbus_object_path"):

1078

if (not hasattr(self, attrname) or

1079

type_func(getattr(self, attrname, None))

1080

!= type_func(value)):

1081

dbus_value = transform_func(type_func(value),

1082

variant_level

1083

=variant_level)

1084

self.PropertyChanged(dbus.String(dbus_name),

1085

dbus_value)

1086

setattr(self, attrname, value)

1087

1088

return property(lambda self: getattr(self, attrname), setter)

1089

1090

1091

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1092

approvals_pending = notifychangeproperty(dbus.Boolean,

1093

"ApprovalPending",

1094

type_func = bool)

1095

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1096

last_enabled = notifychangeproperty(datetime_to_dbus,

1097

"LastEnabled")

1098

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1099

type_func = lambda checker:

1100

checker is not None)

1101

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1102

"LastCheckedOK")

1103

last_approval_request = notifychangeproperty(

1104

datetime_to_dbus, "LastApprovalRequest")

1105

approved_by_default = notifychangeproperty(dbus.Boolean,

1106

"ApprovedByDefault")

1107

approval_delay = notifychangeproperty(dbus.UInt64,

1108

"ApprovalDelay",

1109

type_func =

1110

timedelta_to_milliseconds)

1111

approval_duration = notifychangeproperty(

1112

dbus.UInt64, "ApprovalDuration",

1113

type_func = timedelta_to_milliseconds)

1114

host = notifychangeproperty(dbus.String, "Host")

1115

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1116

type_func =

1117

timedelta_to_milliseconds)

1118

extended_timeout = notifychangeproperty(

1119

dbus.UInt64, "ExtendedTimeout",

1120

type_func = timedelta_to_milliseconds)

1121

interval = notifychangeproperty(dbus.UInt64,

1122

"Interval",

1123

type_func =

1124

timedelta_to_milliseconds)

1125

checker_command = notifychangeproperty(dbus.String, "Checker")

1126

1127

del notifychangeproperty

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"ApprovalPending"),

730

dbus_bool)

731

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

735

736

@staticmethod

737

def _datetime_to_dbus(dt, variant_level=0):

738

"""Convert a UTC datetime.datetime() to a D-Bus type."""

739

return dbus.String(dt.isoformat(),

740

variant_level=variant_level)

741

742

def enable(self):

743

oldstate = getattr(self, u"enabled", False)

744

r = Client.enable(self)

745

if oldstate != self.enabled:

746

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"Enabled"),

748

dbus.Boolean(True, variant_level=1))

749

self.PropertyChanged(

750

dbus.String(u"LastEnabled"),

751

self._datetime_to_dbus(self.last_enabled,

752

variant_level=1))

753

return r

754

755

def disable(self, quiet = False):

756

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

759

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"Enabled"),

761

dbus.Boolean(False, variant_level=1))

762

return r

1128

763

1129

764

def __del__(self, *args, **kwargs):

1130

765

try:

1131

766

self.remove_from_connection()

1132

767

except LookupError:

1133

768

pass

1134

if hasattr(DBusObjectWithProperties, "__del__"):

769

if hasattr(DBusObjectWithProperties, u"__del__"):

1135

770

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1136

771

Client.__del__(self, *args, **kwargs)

1137

772

1139

774

*args, **kwargs):

1140

775

self.checker_callback_tag = None

1141

776

self.checker = None

777

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"CheckerRunning"),

779

dbus.Boolean(False, variant_level=1))

1142

780

if os.WIFEXITED(condition):

1143

781

exitstatus = os.WEXITSTATUS(condition)

1144

782

# Emit D-Bus signal

1154

792

return Client.checker_callback(self, pid, condition, command,

1155

793

*args, **kwargs)

1156

794

795

def checked_ok(self, *args, **kwargs):

796

r = Client.checked_ok(self, *args, **kwargs)

797

# Emit D-Bus signal

798

self.PropertyChanged(

799

dbus.String(u"LastCheckedOK"),

800

(self._datetime_to_dbus(self.last_checked_ok,

801

variant_level=1)))

802

return r

803

1157

804

def start_checker(self, *args, **kwargs):

1158

805

old_checker = self.checker

1159

806

if self.checker is not None:

1166

813

and old_checker_pid != self.checker.pid):

1167

814

# Emit D-Bus signal

1168

815

self.CheckerStarted(self.current_checker_command)

816

self.PropertyChanged(

817

dbus.String(u"CheckerRunning"),

818

dbus.Boolean(True, variant_level=1))

1169

819

return r

1170

820

821

def stop_checker(self, *args, **kwargs):

822

old_checker = getattr(self, u"checker", None)

823

r = Client.stop_checker(self, *args, **kwargs)

824

if (old_checker is not None

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"CheckerRunning"),

827

dbus.Boolean(False, variant_level=1))

828

return r

829

1171

830

def _reset_approved(self):

1172

self.approved = None

831

self._approved = None

1173

832

return False

1174

833

1175

834

def approve(self, value=True):

1176

835

self.send_changedstate()

1177

self.approved = value

1178

gobject.timeout_add(timedelta_to_milliseconds

836

self._approved = value

837

gobject.timeout_add(self._timedelta_to_milliseconds

1179

838

(self.approval_duration),

1180

839

self._reset_approved)

1181

840

1182

841

1183

842

## D-Bus methods, signals & properties

1184

_interface = "se.recompile.Mandos.Client"

843

_interface = u"se.bsnet.fukt.Mandos.Client"

1185

844

1186

845

## Signals

1187

846

1188

847

# CheckerCompleted - signal

1189

@dbus.service.signal(_interface, signature="nxs")

848

@dbus.service.signal(_interface, signature=u"nxs")

1190

849

def CheckerCompleted(self, exitcode, waitstatus, command):

1191

850

"D-Bus signal"

1192

851

pass

1193

852

1194

853

# CheckerStarted - signal

1195

@dbus.service.signal(_interface, signature="s")

854

@dbus.service.signal(_interface, signature=u"s")

1196

855

def CheckerStarted(self, command):

1197

856

"D-Bus signal"

1198

857

pass

1199

858

1200

859

# PropertyChanged - signal

1201

@dbus.service.signal(_interface, signature="sv")

860

@dbus.service.signal(_interface, signature=u"sv")

1202

861

def PropertyChanged(self, property, value):

1203

862

"D-Bus signal"

1204

863

pass

1213

872

pass

1214

873

1215

874

# Rejected - signal

1216

@dbus.service.signal(_interface, signature="s")

875

@dbus.service.signal(_interface, signature=u"s")

1217

876

def Rejected(self, reason):

1218

877

"D-Bus signal"

1219

878

pass

1220

879

1221

880

# NeedApproval - signal

1222

@dbus.service.signal(_interface, signature="tb")

881

@dbus.service.signal(_interface, signature=u"tb")

1223

882

def NeedApproval(self, timeout, default):

1224

883

"D-Bus signal"

1225

return self.need_approval()

1226

1227

# NewRequest - signal

1228

@dbus.service.signal(_interface, signature="s")

1229

def NewRequest(self, ip):

1230

"""D-Bus signal

1231

Is sent after a client request a secret.

1232

"""

1233

884

pass

1234

885

1235

886

## Methods

1236

887

1237

888

# Approve - method

1238

@dbus.service.method(_interface, in_signature="b")

889

@dbus.service.method(_interface, in_signature=u"b")

1239

890

def Approve(self, value):

1240

891

self.approve(value)

1241

892

1242

893

# CheckedOK - method

1243

894

@dbus.service.method(_interface)

1244

895

def CheckedOK(self):

1245

self.checked_ok()

896

return self.checked_ok()

1246

897

1247

898

# Enable - method

1248

899

@dbus.service.method(_interface)

1270

921

## Properties

1271

922

1272

923

# ApprovalPending - property

1273

@dbus_service_property(_interface, signature="b", access="read")

924

@dbus_service_property(_interface, signature=u"b", access=u"read")

1274

925

def ApprovalPending_dbus_property(self):

1275

926

return dbus.Boolean(bool(self.approvals_pending))

1276

927

1277

928

# ApprovedByDefault - property

1278

@dbus_service_property(_interface, signature="b",

1279

access="readwrite")

929

@dbus_service_property(_interface, signature=u"b",

930

access=u"readwrite")

1280

931

def ApprovedByDefault_dbus_property(self, value=None):

1281

932

if value is None: # get

1282

933

return dbus.Boolean(self.approved_by_default)

1283

934

self.approved_by_default = bool(value)

935

# Emit D-Bus signal

936

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

937

dbus.Boolean(value, variant_level=1))

1284

938

1285

939

# ApprovalDelay - property

1286

@dbus_service_property(_interface, signature="t",

1287

access="readwrite")

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

1288

942

def ApprovalDelay_dbus_property(self, value=None):

1289

943

if value is None: # get

1290

944

return dbus.UInt64(self.approval_delay_milliseconds())

1291

945

self.approval_delay = datetime.timedelta(0, 0, 0, value)

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

948

dbus.UInt64(value, variant_level=1))

1292

949

1293

950

# ApprovalDuration - property

1294

@dbus_service_property(_interface, signature="t",

1295

access="readwrite")

951

@dbus_service_property(_interface, signature=u"t",

952

access=u"readwrite")

1296

953

def ApprovalDuration_dbus_property(self, value=None):

1297

954

if value is None: # get

1298

return dbus.UInt64(timedelta_to_milliseconds(

955

return dbus.UInt64(self._timedelta_to_milliseconds(

1299

956

self.approval_duration))

1300

957

self.approval_duration = datetime.timedelta(0, 0, 0, value)

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

960

dbus.UInt64(value, variant_level=1))

1301

961

1302

962

# Name - property

1303

@dbus_service_property(_interface, signature="s", access="read")

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

1304

964

def Name_dbus_property(self):

1305

965

return dbus.String(self.name)

1306

966

1307

967

# Fingerprint - property

1308

@dbus_service_property(_interface, signature="s", access="read")

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

1309

969

def Fingerprint_dbus_property(self):

1310

970

return dbus.String(self.fingerprint)

1311

971

1312

972

# Host - property

1313

@dbus_service_property(_interface, signature="s",

1314

access="readwrite")

973

@dbus_service_property(_interface, signature=u"s",

974

access=u"readwrite")

1315

975

def Host_dbus_property(self, value=None):

1316

976

if value is None: # get

1317

977

return dbus.String(self.host)

1318

self.host = unicode(value)

978

self.host = value

979

# Emit D-Bus signal

980

self.PropertyChanged(dbus.String(u"Host"),

981

dbus.String(value, variant_level=1))

1319

982

1320

983

# Created - property

1321

@dbus_service_property(_interface, signature="s", access="read")

984

@dbus_service_property(_interface, signature=u"s", access=u"read")

1322

985

def Created_dbus_property(self):

1323

return datetime_to_dbus(self.created)

986

return dbus.String(self._datetime_to_dbus(self.created))

1324

987

1325

988

# LastEnabled - property

1326

@dbus_service_property(_interface, signature="s", access="read")

989

@dbus_service_property(_interface, signature=u"s", access=u"read")

1327

990

def LastEnabled_dbus_property(self):

1328

return datetime_to_dbus(self.last_enabled)

991

if self.last_enabled is None:

992

return dbus.String(u"")

993

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1329

994

1330

995

# Enabled - property

1331

@dbus_service_property(_interface, signature="b",

1332

access="readwrite")

996

@dbus_service_property(_interface, signature=u"b",

997

access=u"readwrite")

1333

998

def Enabled_dbus_property(self, value=None):

1334

999

if value is None: # get

1335

1000

return dbus.Boolean(self.enabled)

1339

1004

self.disable()

1340

1005

1341

1006

# LastCheckedOK - property

1342

@dbus_service_property(_interface, signature="s",

1343

access="readwrite")

1007

@dbus_service_property(_interface, signature=u"s",

1008

access=u"readwrite")

1344

1009

def LastCheckedOK_dbus_property(self, value=None):

1345

1010

if value is not None:

1346

1011

self.checked_ok()

1347

1012

return

1348

return datetime_to_dbus(self.last_checked_ok)

1349

1350

# Expires - property

1351

@dbus_service_property(_interface, signature="s", access="read")

1352

def Expires_dbus_property(self):

1353

return datetime_to_dbus(self.expires)

1354

1355

# LastApprovalRequest - property

1356

@dbus_service_property(_interface, signature="s", access="read")

1357

def LastApprovalRequest_dbus_property(self):

1358

return datetime_to_dbus(self.last_approval_request)

1013

if self.last_checked_ok is None:

1014

return dbus.String(u"")

1015

return dbus.String(self._datetime_to_dbus(self

1016

.last_checked_ok))

1359

1017

1360

1018

# Timeout - property

1361

@dbus_service_property(_interface, signature="t",

1362

access="readwrite")

1019

@dbus_service_property(_interface, signature=u"t",

1020

access=u"readwrite")

1363

1021

def Timeout_dbus_property(self, value=None):

1364

1022

if value is None: # get

1365

1023

return dbus.UInt64(self.timeout_milliseconds())

1366

1024

self.timeout = datetime.timedelta(0, 0, 0, value)

1025

# Emit D-Bus signal

1026

self.PropertyChanged(dbus.String(u"Timeout"),

1027

dbus.UInt64(value, variant_level=1))

1028

if getattr(self, u"disable_initiator_tag", None) is None:

1029

return

1367

1030

# Reschedule timeout

1368

if self.enabled:

1369

now = datetime.datetime.utcnow()

1370

time_to_die = timedelta_to_milliseconds(

1371

(self.last_checked_ok + self.timeout) - now)

1372

if time_to_die <= 0:

1373

# The timeout has passed

1374

self.disable()

1375

else:

1376

self.expires = (now +

1377

datetime.timedelta(milliseconds =

1378

time_to_die))

1379

if (getattr(self, "disable_initiator_tag", None)

1380

is None):

1381

return

1382

gobject.source_remove(self.disable_initiator_tag)

1383

self.disable_initiator_tag = (gobject.timeout_add

1384

(time_to_die,

1385

self.disable))

1386

1387

# ExtendedTimeout - property

1388

@dbus_service_property(_interface, signature="t",

1389

access="readwrite")

1390

def ExtendedTimeout_dbus_property(self, value=None):

1391

if value is None: # get

1392

return dbus.UInt64(self.extended_timeout_milliseconds())

1393

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1031

gobject.source_remove(self.disable_initiator_tag)

1032

self.disable_initiator_tag = None

1033

time_to_die = (self.

1034

_timedelta_to_milliseconds((self

1035

.last_checked_ok

1036

+ self.timeout)

1037

- datetime.datetime

1038

.utcnow()))

1039

if time_to_die <= 0:

1040

# The timeout has passed

1041

self.disable()

1042

else:

1043

self.disable_initiator_tag = (gobject.timeout_add

1044

(time_to_die, self.disable))

1394

1045

1395

1046

# Interval - property

1396

@dbus_service_property(_interface, signature="t",

1397

access="readwrite")

1047

@dbus_service_property(_interface, signature=u"t",

1048

access=u"readwrite")

1398

1049

def Interval_dbus_property(self, value=None):

1399

1050

if value is None: # get

1400

1051

return dbus.UInt64(self.interval_milliseconds())

1401

1052

self.interval = datetime.timedelta(0, 0, 0, value)

1402

if getattr(self, "checker_initiator_tag", None) is None:

1053

# Emit D-Bus signal

1054

self.PropertyChanged(dbus.String(u"Interval"),

1055

dbus.UInt64(value, variant_level=1))

1056

if getattr(self, u"checker_initiator_tag", None) is None:

1403

1057

return

1404

if self.enabled:

1405

# Reschedule checker run

1406

gobject.source_remove(self.checker_initiator_tag)

1407

self.checker_initiator_tag = (gobject.timeout_add

1408

(value, self.start_checker))

1409

self.start_checker() # Start one now, too

1410

1058

# Reschedule checker run

1059

gobject.source_remove(self.checker_initiator_tag)

1060

self.checker_initiator_tag = (gobject.timeout_add

1061

(value, self.start_checker))

1062

self.start_checker() # Start one now, too

1063

1411

1064

# Checker - property

1412

@dbus_service_property(_interface, signature="s",

1413

access="readwrite")

1065

@dbus_service_property(_interface, signature=u"s",

1066

access=u"readwrite")

1414

1067

def Checker_dbus_property(self, value=None):

1415

1068

if value is None: # get

1416

1069

return dbus.String(self.checker_command)

1417

self.checker_command = unicode(value)

1070

self.checker_command = value

1071

# Emit D-Bus signal

1072

self.PropertyChanged(dbus.String(u"Checker"),

1073

dbus.String(self.checker_command,

1074

variant_level=1))

1418

1075

1419

1076

# CheckerRunning - property

1420

@dbus_service_property(_interface, signature="b",

1421

access="readwrite")

1077

@dbus_service_property(_interface, signature=u"b",

1078

access=u"readwrite")

1422

1079

def CheckerRunning_dbus_property(self, value=None):

1423

1080

if value is None: # get

1424

1081

return dbus.Boolean(self.checker is not None)

1428

1085

self.stop_checker()

1429

1086

1430

1087

# ObjectPath - property

1431

@dbus_service_property(_interface, signature="o", access="read")

1088

@dbus_service_property(_interface, signature=u"o", access=u"read")

1432

1089

def ObjectPath_dbus_property(self):

1433

1090

return self.dbus_object_path # is already a dbus.ObjectPath

1434

1091

1435

1092

# Secret = property

1436

@dbus_service_property(_interface, signature="ay",

1437

access="write", byte_arrays=True)

1093

@dbus_service_property(_interface, signature=u"ay",

1094

access=u"write", byte_arrays=True)

1438

1095

def Secret_dbus_property(self, value):

1439

1096

self.secret = str(value)

1440

1097

1447

1104

self._pipe.send(('init', fpr, address))

1448

1105

if not self._pipe.recv():

1449

1106

raise KeyError()

1450

1107

1451

1108

def __getattribute__(self, name):

1452

if name == '_pipe':

1109

if(name == '_pipe'):

1453

1110

return super(ProxyClient, self).__getattribute__(name)

1454

1111

self._pipe.send(('getattr', name))

1455

1112

data = self._pipe.recv()

1460

1117

self._pipe.send(('funcall', name, args, kwargs))

1461

1118

return self._pipe.recv()[1]

1462

1119

return func

1463

1120

1464

1121

def __setattr__(self, name, value):

1465

if name == '_pipe':

1122

if(name == '_pipe'):

1466

1123

return super(ProxyClient, self).__setattr__(name, value)

1467

1124

self._pipe.send(('setattr', name, value))

1468

1125

1469

1126

1470

class ClientDBusTransitional(ClientDBus):

1471

__metaclass__ = AlternateDBusNamesMetaclass

1472

1473

1474

1127

class ClientHandler(socketserver.BaseRequestHandler, object):

1475

1128

"""A class to handle client connections.

1476

1129

1479

1132

1480

1133

def handle(self):

1481

1134

with contextlib.closing(self.server.child_pipe) as child_pipe:

1482

logger.info("TCP connection from: %s",

1135

logger.info(u"TCP connection from: %s",

1483

1136

unicode(self.client_address))

1484

logger.debug("Pipe FD: %d",

1137

logger.debug(u"Pipe FD: %d",

1485

1138

self.server.child_pipe.fileno())

1486

1139

1487

1140

session = (gnutls.connection

1488

1141

.ClientSession(self.request,

1489

1142

gnutls.connection

1490

1143

.X509Credentials()))

1491

1144

1492

1145

# Note: gnutls.connection.X509Credentials is really a

1493

1146

# generic GnuTLS certificate credentials object so long as

1494

1147

# no X.509 keys are added to it. Therefore, we can use it

1495

1148

# here despite using OpenPGP certificates.

1496

1497

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1498

# "+AES-256-CBC", "+SHA1",

1499

# "+COMP-NULL", "+CTYPE-OPENPGP",

1500

# "+DHE-DSS"))

1149

1150

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1151

# u"+AES-256-CBC", u"+SHA1",

1152

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1153

# u"+DHE-DSS"))

1501

1154

# Use a fallback default, since this MUST be set.

1502

1155

priority = self.server.gnutls_priority

1503

1156

if priority is None:

1504

priority = "NORMAL"

1157

priority = u"NORMAL"

1505

1158

(gnutls.library.functions

1506

1159

.gnutls_priority_set_direct(session._c_object,

1507

1160

priority, None))

1508

1161

1509

1162

# Start communication using the Mandos protocol

1510

1163

# Get protocol number

1511

1164

line = self.request.makefile().readline()

1512

logger.debug("Protocol version: %r", line)

1165

logger.debug(u"Protocol version: %r", line)

1513

1166

try:

1514

1167

if int(line.strip().split()[0]) > 1:

1515

1168

raise RuntimeError

1516

except (ValueError, IndexError, RuntimeError) as error:

1517

logger.error("Unknown protocol version: %s", error)

1169

except (ValueError, IndexError, RuntimeError), error:

1170

logger.error(u"Unknown protocol version: %s", error)

1518

1171

return

1519

1172

1520

1173

# Start GnuTLS connection

1521

1174

try:

1522

1175

session.handshake()

1523

except gnutls.errors.GNUTLSError as error:

1524

logger.warning("Handshake failed: %s", error)

1176

except gnutls.errors.GNUTLSError, error:

1177

logger.warning(u"Handshake failed: %s", error)

1525

1178

# Do not run session.bye() here: the session is not

1526

1179

# established. Just abandon the request.

1527

1180

return

1528

logger.debug("Handshake succeeded")

1529

1181

logger.debug(u"Handshake succeeded")

1182

1530

1183

approval_required = False

1531

1184

try:

1532

1185

try:

1533

1186

fpr = self.fingerprint(self.peer_certificate

1534

1187

(session))

1535

except (TypeError,

1536

gnutls.errors.GNUTLSError) as error:

1537

logger.warning("Bad certificate: %s", error)

1188

except (TypeError, gnutls.errors.GNUTLSError), error:

1189

logger.warning(u"Bad certificate: %s", error)

1538

1190

return

1539

logger.debug("Fingerprint: %s", fpr)

1540

1191

logger.debug(u"Fingerprint: %s", fpr)

1192

1541

1193

try:

1542

1194

client = ProxyClient(child_pipe, fpr,

1543

1195

self.client_address)

1544

1196

except KeyError:

1545

1197

return

1546

1198

1547

if self.server.use_dbus:

1548

# Emit D-Bus signal

1549

client.NewRequest(unicode(self.client_address)[0])

1550

1551

1199

if client.approval_delay:

1552

1200

delay = client.approval_delay

1553

1201

client.approvals_pending += 1

1555

1203

1556

1204

while True:

1557

1205

if not client.enabled:

1558

logger.info("Client %s is disabled",

1206

logger.warning(u"Client %s is disabled",

1559

1207

client.name)

1560

1208

if self.server.use_dbus:

1561

1209

# Emit D-Bus signal

1562

client.Rejected("Disabled")

1210

client.Rejected("Disabled")

1563

1211

return

1564

1212

1565

if client.approved or not client.approval_delay:

1213

if client._approved or not client.approval_delay:

1566

1214

#We are approved or approval is disabled

1567

1215

break

1568

elif client.approved is None:

1569

logger.info("Client %s needs approval",

1216

elif client._approved is None:

1217

logger.info(u"Client %s needs approval",

1570

1218

client.name)

1571

1219

if self.server.use_dbus:

1572

1220

# Emit D-Bus signal

1574

1222

client.approval_delay_milliseconds(),

1575

1223

client.approved_by_default)

1576

1224

else:

1577

logger.warning("Client %s was not approved",

1225

logger.warning(u"Client %s was not approved",

1578

1226

client.name)

1579

1227

if self.server.use_dbus:

1580

1228

# Emit D-Bus signal

1582

1230

return

1583

1231

1584

1232

#wait until timeout or approved

1233

#x = float(client._timedelta_to_milliseconds(delay))

1585

1234

time = datetime.datetime.now()

1586

1235

client.changedstate.acquire()

1587

(client.changedstate.wait

1588

(float(client.timedelta_to_milliseconds(delay)

1589

/ 1000)))

1236

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1590

1237

client.changedstate.release()

1591

1238

time2 = datetime.datetime.now()

1592

1239

if (time2 - time) >= delay:

1607

1254

while sent_size < len(client.secret):

1608

1255

try:

1609

1256

sent = session.send(client.secret[sent_size:])

1610

except gnutls.errors.GNUTLSError as error:

1257

except (gnutls.errors.GNUTLSError), error:

1611

1258

logger.warning("gnutls send failed")

1612

1259

return

1613

logger.debug("Sent: %d, remaining: %d",

1260

logger.debug(u"Sent: %d, remaining: %d",

1614

1261

sent, len(client.secret)

1615

1262

- (sent_size + sent))

1616

1263

sent_size += sent

1617

1618

logger.info("Sending secret to %s", client.name)

1619

# bump the timeout using extended_timeout

1620

client.checked_ok(client.extended_timeout)

1264

1265

logger.info(u"Sending secret to %s", client.name)

1266

# bump the timeout as if seen

1267

client.checked_ok()

1621

1268

if self.server.use_dbus:

1622

1269

# Emit D-Bus signal

1623

1270

client.GotSecret()

1627

1274

client.approvals_pending -= 1

1628

1275

try:

1629

1276

session.bye()

1630

except gnutls.errors.GNUTLSError as error:

1277

except (gnutls.errors.GNUTLSError), error:

1631

1278

logger.warning("GnuTLS bye failed")

1632

1279

1633

1280

@staticmethod

1644

1291

.gnutls_certificate_get_peers

1645

1292

(session._c_object, ctypes.byref(list_size)))

1646

1293

if not bool(cert_list) and list_size.value != 0:

1647

raise gnutls.errors.GNUTLSError("error getting peer"

1648

" certificate")

1294

raise gnutls.errors.GNUTLSError(u"error getting peer"

1295

u" certificate")

1649

1296

if list_size.value == 0:

1650

1297

return None

1651

1298

cert = cert_list[0]

1677

1324

if crtverify.value != 0:

1678

1325

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1679

1326

raise (gnutls.errors.CertificateSecurityError

1680

("Verify failed"))

1327

(u"Verify failed"))

1681

1328

# New buffer for the fingerprint

1682

1329

buf = ctypes.create_string_buffer(20)

1683

1330

buf_len = ctypes.c_size_t()

1690

1337

# Convert the buffer to a Python bytestring

1691

1338

fpr = ctypes.string_at(buf, buf_len.value)

1692

1339

# Convert the bytestring to hexadecimal notation

1693

hex_fpr = binascii.hexlify(fpr).upper()

1340

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1694

1341

return hex_fpr

1695

1342

1696

1343

1699

1346

def sub_process_main(self, request, address):

1700

1347

try:

1701

1348

self.finish_request(request, address)

1702

except Exception:

1349

except:

1703

1350

self.handle_error(request, address)

1704

1351

self.close_request(request)

1705

1352

1706

1353

def process_request(self, request, address):

1707

1354

"""Start a new process to process the request."""

1708

proc = multiprocessing.Process(target = self.sub_process_main,

1709

args = (request,

1710

address))

1711

proc.start()

1712

return proc

1713

1355

multiprocessing.Process(target = self.sub_process_main,

1356

args = (request, address)).start()

1714

1357

1715

1358

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1716

1359

""" adds a pipe to the MixIn """

1720

1363

This function creates a new pipe in self.pipe

1721

1364

"""

1722

1365

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1723

1724

proc = MultiprocessingMixIn.process_request(self, request,

1725

client_address)

1366

1367

super(MultiprocessingMixInWithPipe,

1368

self).process_request(request, client_address)

1726

1369

self.child_pipe.close()

1727

self.add_pipe(parent_pipe, proc)

1728

1729

def add_pipe(self, parent_pipe, proc):

1370

self.add_pipe(parent_pipe)

1371

1372

def add_pipe(self, parent_pipe):

1730

1373

"""Dummy function; override as necessary"""

1731

raise NotImplementedError

1732

1374

pass

1733

1375

1734

1376

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1735

1377

socketserver.TCPServer, object):

1753

1395

bind to an address or port if they were not specified."""

1754

1396

if self.interface is not None:

1755

1397

if SO_BINDTODEVICE is None:

1756

logger.error("SO_BINDTODEVICE does not exist;"

1757

" cannot bind to interface %s",

1398

logger.error(u"SO_BINDTODEVICE does not exist;"

1399

u" cannot bind to interface %s",

1758

1400

self.interface)

1759

1401

else:

1760

1402

try:

1761

1403

self.socket.setsockopt(socket.SOL_SOCKET,

1762

1404

SO_BINDTODEVICE,

1763

1405

str(self.interface

1764

+ '\0'))

1765

except socket.error as error:

1406

+ u'\0'))

1407

except socket.error, error:

1766

1408

if error[0] == errno.EPERM:

1767

logger.error("No permission to"

1768

" bind to interface %s",

1409

logger.error(u"No permission to"

1410

u" bind to interface %s",

1769

1411

self.interface)

1770

1412

elif error[0] == errno.ENOPROTOOPT:

1771

logger.error("SO_BINDTODEVICE not available;"

1772

" cannot bind to interface %s",

1413

logger.error(u"SO_BINDTODEVICE not available;"

1414

u" cannot bind to interface %s",

1773

1415

self.interface)

1774

1416

else:

1775

1417

raise

1777

1419

if self.server_address[0] or self.server_address[1]:

1778

1420

if not self.server_address[0]:

1779

1421

if self.address_family == socket.AF_INET6:

1780

any_address = "::" # in6addr_any

1422

any_address = u"::" # in6addr_any

1781

1423

else:

1782

1424

any_address = socket.INADDR_ANY

1783

1425

self.server_address = (any_address,

1810

1452

self.enabled = False

1811

1453

self.clients = clients

1812

1454

if self.clients is None:

1813

self.clients = {}

1455

self.clients = set()

1814

1456

self.use_dbus = use_dbus

1815

1457

self.gnutls_priority = gnutls_priority

1816

1458

IPv6_TCPServer.__init__(self, server_address,

1820

1462

def server_activate(self):

1821

1463

if self.enabled:

1822

1464

return socketserver.TCPServer.server_activate(self)

1823

1824

1465

def enable(self):

1825

1466

self.enabled = True

1826

1827

def add_pipe(self, parent_pipe, proc):

1467

def add_pipe(self, parent_pipe):

1828

1468

# Call "handle_ipc" for both data and EOF events

1829

1469

gobject.io_add_watch(parent_pipe.fileno(),

1830

1470

gobject.IO_IN | gobject.IO_HUP,

1831

1471

functools.partial(self.handle_ipc,

1832

parent_pipe =

1833

parent_pipe,

1834

proc = proc))

1835

1472

parent_pipe = parent_pipe))

1473

1836

1474

def handle_ipc(self, source, condition, parent_pipe=None,

1837

proc = None, client_object=None):

1475

client_object=None):

1838

1476

condition_names = {

1839

gobject.IO_IN: "IN", # There is data to read.

1840

gobject.IO_OUT: "OUT", # Data can be written (without

1477

gobject.IO_IN: u"IN", # There is data to read.

1478

gobject.IO_OUT: u"OUT", # Data can be written (without

1841

1479

# blocking).

1842

gobject.IO_PRI: "PRI", # There is urgent data to read.

1843

gobject.IO_ERR: "ERR", # Error condition.

1844

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1480

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1481

gobject.IO_ERR: u"ERR", # Error condition.

1482

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1845

1483

# broken, usually for pipes and

1846

1484

# sockets).

1847

1485

}

1849

1487

for cond, name in

1850

1488

condition_names.iteritems()

1851

1489

if cond & condition)

1852

# error, or the other end of multiprocessing.Pipe has closed

1490

# error or the other end of multiprocessing.Pipe has closed

1853

1491

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1854

# Wait for other process to exit

1855

proc.join()

1856

1492

return False

1857

1493

1858

1494

# Read a request from the child

1863

1499

fpr = request[1]

1864

1500

address = request[2]

1865

1501

1866

for c in self.clients.itervalues():

1502

for c in self.clients:

1867

1503

if c.fingerprint == fpr:

1868

1504

client = c

1869

1505

break

1870

1506

else:

1871

logger.info("Client not found for fingerprint: %s, ad"

1872

"dress: %s", fpr, address)

1507

logger.warning(u"Client not found for fingerprint: %s, ad"

1508

u"dress: %s", fpr, address)

1873

1509

if self.use_dbus:

1874

1510

# Emit D-Bus signal

1875

mandos_dbus_service.ClientNotFound(fpr,

1876

address[0])

1511

mandos_dbus_service.ClientNotFound(fpr, address)

1877

1512

parent_pipe.send(False)

1878

1513

return False

1879

1514

1880

1515

gobject.io_add_watch(parent_pipe.fileno(),

1881

1516

gobject.IO_IN | gobject.IO_HUP,

1882

1517

functools.partial(self.handle_ipc,

1883

parent_pipe =

1884

parent_pipe,

1885

proc = proc,

1886

client_object =

1887

client))

1518

parent_pipe = parent_pipe,

1519

client_object = client))

1888

1520

parent_pipe.send(True)

1889

# remove the old hook in favor of the new above hook on

1890

# same fileno

1521

# remove the old hook in favor of the new above hook on same fileno

1891

1522

return False

1892

1523

if command == 'funcall':

1893

1524

funcname = request[1]

1894

1525

args = request[2]

1895

1526

kwargs = request[3]

1896

1527

1897

parent_pipe.send(('data', getattr(client_object,

1898

funcname)(*args,

1899

**kwargs)))

1900

1528

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1529

1901

1530

if command == 'getattr':

1902

1531

attrname = request[1]

1903

1532

if callable(client_object.__getattribute__(attrname)):

1904

1533

parent_pipe.send(('function',))

1905

1534

else:

1906

parent_pipe.send(('data', client_object

1907

.__getattribute__(attrname)))

1535

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1908

1536

1909

1537

if command == 'setattr':

1910

1538

attrname = request[1]

1911

1539

value = request[2]

1912

1540

setattr(client_object, attrname, value)

1913

1541

1914

1542

return True

1915

1543

1916

1544

1917

1545

def string_to_delta(interval):

1918

1546

"""Parse a string and return a datetime.timedelta

1919

1547

1920

>>> string_to_delta('7d')

1548

>>> string_to_delta(u'7d')

1921

1549

datetime.timedelta(7)

1922

>>> string_to_delta('60s')

1550

>>> string_to_delta(u'60s')

1923

1551

datetime.timedelta(0, 60)

1924

>>> string_to_delta('60m')

1552

>>> string_to_delta(u'60m')

1925

1553

datetime.timedelta(0, 3600)

1926

>>> string_to_delta('24h')

1554

>>> string_to_delta(u'24h')

1927

1555

datetime.timedelta(1)

1928

>>> string_to_delta('1w')

1556

>>> string_to_delta(u'1w')

1929

1557

datetime.timedelta(7)

1930

>>> string_to_delta('5m 30s')

1558

>>> string_to_delta(u'5m 30s')

1931

1559

datetime.timedelta(0, 330)

1932

1560

"""

1933

1561

timevalue = datetime.timedelta(0)

1935

1563

try:

1936

1564

suffix = unicode(s[-1])

1937

1565

value = int(s[:-1])

1938

if suffix == "d":

1566

if suffix == u"d":

1939

1567

delta = datetime.timedelta(value)

1940

elif suffix == "s":

1568

elif suffix == u"s":

1941

1569

delta = datetime.timedelta(0, value)

1942

elif suffix == "m":

1570

elif suffix == u"m":

1943

1571

delta = datetime.timedelta(0, 0, 0, 0, value)

1944

elif suffix == "h":

1572

elif suffix == u"h":

1945

1573

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1946

elif suffix == "w":

1574

elif suffix == u"w":

1947

1575

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1948

1576

else:

1949

raise ValueError("Unknown suffix %r" % suffix)

1950

except (ValueError, IndexError) as e:

1951

raise ValueError(*(e.args))

1577

raise ValueError(u"Unknown suffix %r" % suffix)

1578

except (ValueError, IndexError), e:

1579

raise ValueError(e.message)

1952

1580

timevalue += delta

1953

1581

return timevalue

1954

1582

1955

1583

1584

def if_nametoindex(interface):

1585

"""Call the C function if_nametoindex(), or equivalent

1586

1587

Note: This function cannot accept a unicode string."""

1588

global if_nametoindex

1589

try:

1590

if_nametoindex = (ctypes.cdll.LoadLibrary

1591

(ctypes.util.find_library(u"c"))

1592

.if_nametoindex)

1593

except (OSError, AttributeError):

1594

logger.warning(u"Doing if_nametoindex the hard way")

1595

def if_nametoindex(interface):

1596

"Get an interface index the hard way, i.e. using fcntl()"

1597

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1598

with contextlib.closing(socket.socket()) as s:

1599

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1600

struct.pack(str(u"16s16x"),

1601

interface))

1602

interface_index = struct.unpack(str(u"I"),

1603

ifreq[16:20])[0]

1604

return interface_index

1605

return if_nametoindex(interface)

1606

1607

1956

1608

def daemon(nochdir = False, noclose = False):

1957

1609

"""See daemon(3). Standard BSD Unix function.

1958

1610

1961

1613

sys.exit()

1962

1614

os.setsid()

1963

1615

if not nochdir:

1964

os.chdir("/")

1616

os.chdir(u"/")

1965

1617

if os.fork():

1966

1618

sys.exit()

1967

1619

if not noclose:

1969

1621

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1970

1622

if not stat.S_ISCHR(os.fstat(null).st_mode):

1971

1623

raise OSError(errno.ENODEV,

1972

"%s not a character device"

1624

u"%s not a character device"

1973

1625

% os.path.devnull)

1974

1626

os.dup2(null, sys.stdin.fileno())

1975

1627

os.dup2(null, sys.stdout.fileno())

1983

1635

##################################################################

1984

1636

# Parsing of options, both command line and config file

1985

1637

1986

parser = argparse.ArgumentParser()

1987

parser.add_argument("-v", "--version", action="version",

1988

version = "%%(prog)s %s" % version,

1989

help="show version number and exit")

1990

parser.add_argument("-i", "--interface", metavar="IF",

1991

help="Bind to interface IF")

1992

parser.add_argument("-a", "--address",

1993

help="Address to listen for requests on")

1994

parser.add_argument("-p", "--port", type=int,

1995

help="Port number to receive requests on")

1996

parser.add_argument("--check", action="store_true",

1997

help="Run self-test")

1998

parser.add_argument("--debug", action="store_true",

1999

help="Debug mode; run in foreground and log"

2000

" to terminal")

2001

parser.add_argument("--debuglevel", metavar="LEVEL",

2002

help="Debug level for stdout output")

2003

parser.add_argument("--priority", help="GnuTLS"

2004

" priority string (see GnuTLS documentation)")

2005

parser.add_argument("--servicename",

2006

metavar="NAME", help="Zeroconf service name")

2007

parser.add_argument("--configdir",

2008

default="/etc/mandos", metavar="DIR",

2009

help="Directory to search for configuration"

2010

" files")

2011

parser.add_argument("--no-dbus", action="store_false",

2012

dest="use_dbus", help="Do not provide D-Bus"

2013

" system bus interface")

2014

parser.add_argument("--no-ipv6", action="store_false",

2015

dest="use_ipv6", help="Do not use IPv6")

2016

parser.add_argument("--no-restore", action="store_false",

2017

dest="restore", help="Do not restore stored"

2018

" state")

2019

parser.add_argument("--statedir", metavar="DIR",

2020

help="Directory to save/restore state in")

2021

2022

options = parser.parse_args()

1638

parser = optparse.OptionParser(version = "%%prog %s" % version)

1639

parser.add_option("-i", u"--interface", type=u"string",

1640

metavar="IF", help=u"Bind to interface IF")

1641

parser.add_option("-a", u"--address", type=u"string",

1642

help=u"Address to listen for requests on")

1643

parser.add_option("-p", u"--port", type=u"int",

1644

help=u"Port number to receive requests on")

1645

parser.add_option("--check", action=u"store_true",

1646

help=u"Run self-test")

1647

parser.add_option("--debug", action=u"store_true",

1648

help=u"Debug mode; run in foreground and log to"

1649

u" terminal")

1650

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1651

help=u"Debug level for stdout output")

1652

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1653

u" priority string (see GnuTLS documentation)")

1654

parser.add_option("--servicename", type=u"string",

1655

metavar=u"NAME", help=u"Zeroconf service name")

1656

parser.add_option("--configdir", type=u"string",

1657

default=u"/etc/mandos", metavar=u"DIR",

1658

help=u"Directory to search for configuration"

1659

u" files")

1660

parser.add_option("--no-dbus", action=u"store_false",

1661

dest=u"use_dbus", help=u"Do not provide D-Bus"

1662

u" system bus interface")

1663

parser.add_option("--no-ipv6", action=u"store_false",

1664

dest=u"use_ipv6", help=u"Do not use IPv6")

1665

options = parser.parse_args()[0]

2023

1666

2024

1667

if options.check:

2025

1668

import doctest

2027

1670

sys.exit()

2028

1671

2029

1672

# Default values for config file for server-global settings

2030

server_defaults = { "interface": "",

2031

"address": "",

2032

"port": "",

2033

"debug": "False",

2034

"priority":

2035

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2036

"servicename": "Mandos",

2037

"use_dbus": "True",

2038

"use_ipv6": "True",

2039

"debuglevel": "",

2040

"restore": "True",

2041

"statedir": "/var/lib/mandos"

1673

server_defaults = { u"interface": u"",

1674

u"address": u"",

1675

u"port": u"",

1676

u"debug": u"False",

1677

u"priority":

1678

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1679

u"servicename": u"Mandos",

1680

u"use_dbus": u"True",

1681

u"use_ipv6": u"True",

1682

u"debuglevel": u"",

2042

1683

}

2043

1684

2044

1685

# Parse config file for server-global settings

2045

1686

server_config = configparser.SafeConfigParser(server_defaults)

2046

1687

del server_defaults

2047

1688

server_config.read(os.path.join(options.configdir,

2048

"mandos.conf"))

1689

u"mandos.conf"))

2049

1690

# Convert the SafeConfigParser object to a dict

2050

1691

server_settings = server_config.defaults()

2051

1692

# Use the appropriate methods on the non-string config options

2052

for option in ("debug", "use_dbus", "use_ipv6"):

2053

server_settings[option] = server_config.getboolean("DEFAULT",

1693

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1694

server_settings[option] = server_config.getboolean(u"DEFAULT",

2054

1695

option)

2055

1696

if server_settings["port"]:

2056

server_settings["port"] = server_config.getint("DEFAULT",

2057

"port")

1697

server_settings["port"] = server_config.getint(u"DEFAULT",

1698

u"port")

2058

1699

del server_config

2059

1700

2060

1701

# Override the settings from the config file with command line

2061

1702

# options, if set.

2062

for option in ("interface", "address", "port", "debug",

2063

"priority", "servicename", "configdir",

2064

"use_dbus", "use_ipv6", "debuglevel", "restore",

2065

"statedir"):

1703

for option in (u"interface", u"address", u"port", u"debug",

1704

u"priority", u"servicename", u"configdir",

1705

u"use_dbus", u"use_ipv6", u"debuglevel"):

2066

1706

value = getattr(options, option)

2067

1707

if value is not None:

2068

1708

server_settings[option] = value

2076

1716

##################################################################

2077

1717

2078

1718

# For convenience

2079

debug = server_settings["debug"]

2080

debuglevel = server_settings["debuglevel"]

2081

use_dbus = server_settings["use_dbus"]

2082

use_ipv6 = server_settings["use_ipv6"]

2083

stored_state_path = os.path.join(server_settings["statedir"],

2084

stored_state_file)

2085

2086

if debug:

2087

initlogger(debug, logging.DEBUG)

2088

else:

2089

if not debuglevel:

2090

initlogger(debug)

2091

else:

2092

level = getattr(logging, debuglevel.upper())

2093

initlogger(debug, level)

2094

2095

if server_settings["servicename"] != "Mandos":

1719

debug = server_settings[u"debug"]

1720

debuglevel = server_settings[u"debuglevel"]

1721

use_dbus = server_settings[u"use_dbus"]

1722

use_ipv6 = server_settings[u"use_ipv6"]

1723

1724

if server_settings[u"servicename"] != u"Mandos":

2096

1725

syslogger.setFormatter(logging.Formatter

2097

('Mandos (%s) [%%(process)d]:'

2098

' %%(levelname)s: %%(message)s'

2099

% server_settings["servicename"]))

1726

(u'Mandos (%s) [%%(process)d]:'

1727

u' %%(levelname)s: %%(message)s'

1728

% server_settings[u"servicename"]))

2100

1729

2101

1730

# Parse config file with clients

2102

client_config = configparser.SafeConfigParser(Client

2103

.client_defaults)

2104

client_config.read(os.path.join(server_settings["configdir"],

2105

"clients.conf"))

1731

client_defaults = { u"timeout": u"1h",

1732

u"interval": u"5m",

1733

u"checker": u"fping -q -- %%(host)s",

1734

u"host": u"",

1735

u"approval_delay": u"0s",

1736

u"approval_duration": u"1s",

1737

}

1738

client_config = configparser.SafeConfigParser(client_defaults)

1739

client_config.read(os.path.join(server_settings[u"configdir"],

1740

u"clients.conf"))

2106

1741

2107

1742

global mandos_dbus_service

2108

1743

mandos_dbus_service = None

2109

1744

2110

tcp_server = MandosServer((server_settings["address"],

2111

server_settings["port"]),

1745

tcp_server = MandosServer((server_settings[u"address"],

1746

server_settings[u"port"]),

2112

1747

ClientHandler,

2113

interface=(server_settings["interface"]

1748

interface=(server_settings[u"interface"]

2114

1749

or None),

2115

1750

use_ipv6=use_ipv6,

2116

1751

gnutls_priority=

2117

server_settings["priority"],

1752

server_settings[u"priority"],

2118

1753

use_dbus=use_dbus)

2119

if not debug:

2120

pidfilename = "/var/run/mandos.pid"

2121

try:

2122

pidfile = open(pidfilename, "w")

2123

except IOError:

2124

logger.error("Could not open file %r", pidfilename)

1754

pidfilename = u"/var/run/mandos.pid"

1755

try:

1756

pidfile = open(pidfilename, u"w")

1757

except IOError:

1758

logger.error(u"Could not open file %r", pidfilename)

2125

1759

2126

1760

try:

2127

uid = pwd.getpwnam("_mandos").pw_uid

2128

gid = pwd.getpwnam("_mandos").pw_gid

1761

uid = pwd.getpwnam(u"_mandos").pw_uid

1762

gid = pwd.getpwnam(u"_mandos").pw_gid

2129

1763

except KeyError:

2130

1764

try:

2131

uid = pwd.getpwnam("mandos").pw_uid

2132

gid = pwd.getpwnam("mandos").pw_gid

1765

uid = pwd.getpwnam(u"mandos").pw_uid

1766

gid = pwd.getpwnam(u"mandos").pw_gid

2133

1767

except KeyError:

2134

1768

try:

2135

uid = pwd.getpwnam("nobody").pw_uid

2136

gid = pwd.getpwnam("nobody").pw_gid

1769

uid = pwd.getpwnam(u"nobody").pw_uid

1770

gid = pwd.getpwnam(u"nobody").pw_gid

2137

1771

except KeyError:

2138

1772

uid = 65534

2139

1773

gid = 65534

2140

1774

try:

2141

1775

os.setgid(gid)

2142

1776

os.setuid(uid)

2143

except OSError as error:

1777

except OSError, error:

2144

1778

if error[0] != errno.EPERM:

2145

1779

raise error

2146

1780

1781

if not debug and not debuglevel:

1782

syslogger.setLevel(logging.WARNING)

1783

console.setLevel(logging.WARNING)

1784

if debuglevel:

1785

level = getattr(logging, debuglevel.upper())

1786

syslogger.setLevel(level)

1787

console.setLevel(level)

1788

2147

1789

if debug:

2148

1790

# Enable all possible GnuTLS debugging

2149

1791

2153

1795

2154

1796

@gnutls.library.types.gnutls_log_func

2155

1797

def debug_gnutls(level, string):

2156

logger.debug("GnuTLS: %s", string[:-1])

1798

logger.debug(u"GnuTLS: %s", string[:-1])

2157

1799

2158

1800

(gnutls.library.functions

2159

1801

.gnutls_global_set_log_function(debug_gnutls))

2163

1805

os.dup2(null, sys.stdin.fileno())

2164

1806

if null > 2:

2165

1807

os.close(null)

2166

2167

# Need to fork before connecting to D-Bus

2168

if not debug:

2169

# Close all input and output, do double fork, etc.

2170

daemon()

2171

2172

gobject.threads_init()

1808

else:

1809

# No console logging

1810

logger.removeHandler(console)

1811

2173

1812

2174

1813

global main_loop

2175

1814

# From the Avahi example code

2179

1818

# End of Avahi example code

2180

1819

if use_dbus:

2181

1820

try:

2182

bus_name = dbus.service.BusName("se.recompile.Mandos",

1821

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2183

1822

bus, do_not_queue=True)

2184

old_bus_name = (dbus.service.BusName

2185

("se.bsnet.fukt.Mandos", bus,

2186

do_not_queue=True))

2187

except dbus.exceptions.NameExistsException as e:

2188

logger.error(unicode(e) + ", disabling D-Bus")

1823

except dbus.exceptions.NameExistsException, e:

1824

logger.error(unicode(e) + u", disabling D-Bus")

2189

1825

use_dbus = False

2190

server_settings["use_dbus"] = False

1826

server_settings[u"use_dbus"] = False

2191

1827

tcp_server.use_dbus = False

2192

1828

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2193

service = AvahiServiceToSyslog(name =

2194

server_settings["servicename"],

2195

servicetype = "_mandos._tcp",

2196

protocol = protocol, bus = bus)

1829

service = AvahiService(name = server_settings[u"servicename"],

1830

servicetype = u"_mandos._tcp",

1831

protocol = protocol, bus = bus)

2197

1832

if server_settings["interface"]:

2198

1833

service.interface = (if_nametoindex

2199

(str(server_settings["interface"])))

2200

1834

(str(server_settings[u"interface"])))

1835

1836

if not debug:

1837

# Close all input and output, do double fork, etc.

1838

daemon()

1839

2201

1840

global multiprocessing_manager

2202

1841

multiprocessing_manager = multiprocessing.Manager()

2203

1842

2204

1843

client_class = Client

2205

1844

if use_dbus:

2206

client_class = functools.partial(ClientDBusTransitional,

2207

bus = bus)

2208

2209

client_settings = Client.config_parser(client_config)

2210

old_client_settings = {}

2211

clients_data = {}

2212

2213

# Get client data and settings from last running state.

2214

if server_settings["restore"]:

2215

try:

2216

with open(stored_state_path, "rb") as stored_state:

2217

clients_data, old_client_settings = (pickle.load

2218

(stored_state))

2219

os.remove(stored_state_path)

2220

except IOError as e:

2221

logger.warning("Could not load persistent state: {0}"

2222

.format(e))

2223

if e.errno != errno.ENOENT:

2224

raise

2225

except EOFError as e:

2226

logger.warning("Could not load persistent state: "

2227

"EOFError: {0}".format(e))

2228

2229

with PGPEngine() as pgp:

2230

for client_name, client in clients_data.iteritems():

2231

# Decide which value to use after restoring saved state.

2232

# We have three different values: Old config file,

2233

# new config file, and saved state.

2234

# New config value takes precedence if it differs from old

2235

# config value, otherwise use saved state.

2236

for name, value in client_settings[client_name].items():

2237

try:

2238

# For each value in new config, check if it

2239

# differs from the old config value (Except for

2240

# the "secret" attribute)

2241

if (name != "secret" and

2242

value != old_client_settings[client_name]

2243

[name]):

2244

client[name] = value

2245

except KeyError:

2246

pass

2247

2248

# Clients who has passed its expire date can still be

2249

# enabled if its last checker was successful. Clients

2250

# whose checker succeeded before we stored its state is

2251

# assumed to have successfully run all checkers during

2252

# downtime.

2253

if client["enabled"]:

2254

if datetime.datetime.utcnow() >= client["expires"]:

2255

if not client["last_checked_ok"]:

2256

logger.warning(

2257

"disabling client {0} - Client never "

2258

"performed a successful checker"

2259

.format(client_name))

2260

client["enabled"] = False

2261

elif client["last_checker_status"] != 0:

2262

logger.warning(

2263

"disabling client {0} - Client "

2264

"last checker failed with error code {1}"

2265

.format(client_name,

2266

client["last_checker_status"]))

2267

client["enabled"] = False

2268

else:

2269

client["expires"] = (datetime.datetime

2270

.utcnow()

2271

+ client["timeout"])

2272

logger.debug("Last checker succeeded,"

2273

" keeping {0} enabled"

2274

.format(client_name))

1845

client_class = functools.partial(ClientDBus, bus = bus)

1846

def client_config_items(config, section):

1847

special_settings = {

1848

"approved_by_default":

1849

lambda: config.getboolean(section,

1850

"approved_by_default"),

1851

}

1852

for name, value in config.items(section):

2275

1853

try:

2276

client["secret"] = (

2277

pgp.decrypt(client["encrypted_secret"],

2278

client_settings[client_name]

2279

["secret"]))

2280

except PGPError:

2281

# If decryption fails, we use secret from new settings

2282

logger.debug("Failed to decrypt {0} old secret"

2283

.format(client_name))

2284

client["secret"] = (

2285

client_settings[client_name]["secret"])

2286

2287

2288

# Add/remove clients based on new changes made to config

2289

for client_name in (set(old_client_settings)

2290

- set(client_settings)):

2291

del clients_data[client_name]

2292

for client_name in (set(client_settings)

2293

- set(old_client_settings)):

2294

clients_data[client_name] = client_settings[client_name]

2295

2296

# Create all client objects

2297

for client_name, client in clients_data.iteritems():

2298

tcp_server.clients[client_name] = client_class(

2299

name = client_name, settings = client)

2300

1854

yield (name, special_settings[name]())

1855

except KeyError:

1856

yield (name, value)

1857

1858

tcp_server.clients.update(set(

1859

client_class(name = section,

1860

config= dict(client_config_items(

1861

client_config, section)))

1862

for section in client_config.sections()))

2301

1863

if not tcp_server.clients:

2302

logger.warning("No clients defined")

1864

logger.warning(u"No clients defined")

2303

1865

1866

try:

1867

with pidfile:

1868

pid = os.getpid()

1869

pidfile.write(str(pid) + "\n")

1870

del pidfile

1871

except IOError:

1872

logger.error(u"Could not write to file %r with PID %d",

1873

pidfilename, pid)

1874

except NameError:

1875

# "pidfile" was never created

1876

pass

1877

del pidfilename

1878

2304

1879

if not debug:

2305

try:

2306

with pidfile:

2307

pid = os.getpid()

2308

pidfile.write(str(pid) + "\n".encode("utf-8"))

2309

del pidfile

2310

except IOError:

2311

logger.error("Could not write to file %r with PID %d",

2312

pidfilename, pid)

2313

except NameError:

2314

# "pidfile" was never created

2315

pass

2316

del pidfilename

2317

1880

signal.signal(signal.SIGINT, signal.SIG_IGN)

2318

2319

1881

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2320

1882

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2321

1883

2323

1885

class MandosDBusService(dbus.service.Object):

2324

1886

"""A D-Bus proxy object"""

2325

1887

def __init__(self):

2326

dbus.service.Object.__init__(self, bus, "/")

2327

_interface = "se.recompile.Mandos"

1888

dbus.service.Object.__init__(self, bus, u"/")

1889

_interface = u"se.bsnet.fukt.Mandos"

2328

1890

2329

@dbus.service.signal(_interface, signature="o")

1891

@dbus.service.signal(_interface, signature=u"o")

2330

1892

def ClientAdded(self, objpath):

2331

1893

"D-Bus signal"

2332

1894

pass

2333

1895

2334

@dbus.service.signal(_interface, signature="ss")

1896

@dbus.service.signal(_interface, signature=u"ss")

2335

1897

def ClientNotFound(self, fingerprint, address):

2336

1898

"D-Bus signal"

2337

1899

pass

2338

1900

2339

@dbus.service.signal(_interface, signature="os")

1901

@dbus.service.signal(_interface, signature=u"os")

2340

1902

def ClientRemoved(self, objpath, name):

2341

1903

"D-Bus signal"

2342

1904

pass

2343

1905

2344

@dbus.service.method(_interface, out_signature="ao")

1906

@dbus.service.method(_interface, out_signature=u"ao")

2345

1907

def GetAllClients(self):

2346

1908

"D-Bus method"

2347

1909

return dbus.Array(c.dbus_object_path

2348

for c in

2349

tcp_server.clients.itervalues())

1910

for c in tcp_server.clients)

2350

1911

2351

1912

@dbus.service.method(_interface,

2352

out_signature="a{oa{sv}}")

1913

out_signature=u"a{oa{sv}}")

2353

1914

def GetAllClientsWithProperties(self):

2354

1915

"D-Bus method"

2355

1916

return dbus.Dictionary(

2356

((c.dbus_object_path, c.GetAll(""))

2357

for c in tcp_server.clients.itervalues()),

2358

signature="oa{sv}")

1917

((c.dbus_object_path, c.GetAll(u""))

1918

for c in tcp_server.clients),

1919

signature=u"oa{sv}")

2359

1920

2360

@dbus.service.method(_interface, in_signature="o")

1921

@dbus.service.method(_interface, in_signature=u"o")

2361

1922

def RemoveClient(self, object_path):

2362

1923

"D-Bus method"

2363

for c in tcp_server.clients.itervalues():

1924

for c in tcp_server.clients:

2364

1925

if c.dbus_object_path == object_path:

2365

del tcp_server.clients[c.name]

1926

tcp_server.clients.remove(c)

2366

1927

c.remove_from_connection()

2367

1928

# Don't signal anything except ClientRemoved

2368

1929

c.disable(quiet=True)

2373

1934

2374

1935

del _interface

2375

1936

2376

class MandosDBusServiceTransitional(MandosDBusService):

2377

__metaclass__ = AlternateDBusNamesMetaclass

2378

mandos_dbus_service = MandosDBusServiceTransitional()

1937

mandos_dbus_service = MandosDBusService()

2379

1938

2380

1939

def cleanup():

2381

1940

"Cleanup function; run on exit"

2382

1941

service.cleanup()

2383

1942

2384

multiprocessing.active_children()

2385

if not (tcp_server.clients or client_settings):

2386

return

2387

2388

# Store client before exiting. Secrets are encrypted with key

2389

# based on what config file has. If config file is

2390

# removed/edited, old secret will thus be unrecovable.

2391

clients = {}

2392

with PGPEngine() as pgp:

2393

for client in tcp_server.clients.itervalues():

2394

key = client_settings[client.name]["secret"]

2395

client.encrypted_secret = pgp.encrypt(client.secret,

2396

key)

2397

client_dict = {}

2398

2399

# A list of attributes that can not be pickled

2400

# + secret.

2401

exclude = set(("bus", "changedstate", "secret",

2402

"checker"))

2403

for name, typ in (inspect.getmembers

2404

(dbus.service.Object)):

2405

exclude.add(name)

2406

2407

client_dict["encrypted_secret"] = (client

2408

.encrypted_secret)

2409

for attr in client.client_structure:

2410

if attr not in exclude:

2411

client_dict[attr] = getattr(client, attr)

2412

2413

clients[client.name] = client_dict

2414

del client_settings[client.name]["secret"]

2415

2416

try:

2417

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2418

prefix="clients-",

2419

dir=os.path.dirname

2420

(stored_state_path))

2421

with os.fdopen(tempfd, "wb") as stored_state:

2422

pickle.dump((clients, client_settings), stored_state)

2423

os.rename(tempname, stored_state_path)

2424

except (IOError, OSError) as e:

2425

logger.warning("Could not save persistent state: {0}"

2426

.format(e))

2427

if not debug:

2428

try:

2429

os.remove(tempname)

2430

except NameError:

2431

pass

2432

if e.errno not in set((errno.ENOENT, errno.EACCES,

2433

errno.EEXIST)):

2434

raise e

2435

2436

# Delete all clients, and settings from config

2437

1943

while tcp_server.clients:

2438

name, client = tcp_server.clients.popitem()

1944

client = tcp_server.clients.pop()

2439

1945

if use_dbus:

2440

1946

client.remove_from_connection()

1947

client.disable_hook = None

2441

1948

# Don't signal anything except ClientRemoved

2442

1949

client.disable(quiet=True)

2443

1950

if use_dbus:

2444

1951

# Emit D-Bus signal

2445

mandos_dbus_service.ClientRemoved(client

2446

.dbus_object_path,

1952

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2447

1953

client.name)

2448

client_settings.clear()

2449

1954

2450

1955

atexit.register(cleanup)

2451

1956

2452

for client in tcp_server.clients.itervalues():

1957

for client in tcp_server.clients:

2453

1958

if use_dbus:

2454

1959

# Emit D-Bus signal

2455

1960

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2456

# Need to initiate checking of clients

2457

if client.enabled:

2458

client.init_checker()

1961

client.enable()

2459

1962

2460

1963

tcp_server.enable()

2461

1964

tcp_server.server_activate()

2463

1966

# Find out what port we got

2464

1967

service.port = tcp_server.socket.getsockname()[1]

2465

1968

if use_ipv6:

2466

logger.info("Now listening on address %r, port %d,"

1969

logger.info(u"Now listening on address %r, port %d,"

2467

1970

" flowinfo %d, scope_id %d"

2468

1971

% tcp_server.socket.getsockname())

2469

1972

else: # IPv4

2470

logger.info("Now listening on address %r, port %d"

1973

logger.info(u"Now listening on address %r, port %d"

2471

1974

% tcp_server.socket.getsockname())

2472

1975

2473

1976

#service.interface = tcp_server.socket.getsockname()[3]

2476

1979

# From the Avahi example code

2477

1980

try:

2478

1981

service.activate()

2479

except dbus.exceptions.DBusException as error:

2480

logger.critical("DBusException: %s", error)

1982

except dbus.exceptions.DBusException, error:

1983

logger.critical(u"DBusException: %s", error)

2481

1984

cleanup()

2482

1985

sys.exit(1)

2483

1986

# End of Avahi example code

2487

1990

(tcp_server.handle_request

2488

1991

(*args[2:], **kwargs) or True))

2489

1992

2490

logger.debug("Starting main loop")

1993

logger.debug(u"Starting main loop")

2491

1994

main_loop.run()

2492

except AvahiError as error:

2493

logger.critical("AvahiError: %s", error)

1995

except AvahiError, error:

1996

logger.critical(u"AvahiError: %s", error)

2494

1997

cleanup()

2495

1998

sys.exit(1)

2496

1999

except KeyboardInterrupt:

2497

2000

if debug:

2498

print("", file=sys.stderr)

2499

logger.debug("Server received KeyboardInterrupt")

2500

logger.debug("Server exiting")

2001

print >> sys.stderr

2002

logger.debug(u"Server received KeyboardInterrupt")

2003

logger.debug(u"Server exiting")

2501

2004

# Must run before the D-Bus bus name gets deregistered

2502

2005

cleanup()

2503

2006