/mandos/release : revision 237.7.120

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

import itertools

66

69

67

70

import dbus

68

71

import dbus.service

73

76

import ctypes.util

74

77

import xml.dom.minidom

75

78

import inspect

79

import GnuPGInterface

76

80

77

81

try:

78

82

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

86

except ImportError:

83

87

SO_BINDTODEVICE = None

84

88

85

86

version = "1.4.0"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

89

version = "1.5.3"

90

stored_state_file = "clients.pickle"

91

92

logger = logging.getLogger()

90

93

syslogger = (logging.handlers.SysLogHandler

91

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

95

address = str("/dev/log")))

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(debug, level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

if debug:

123

console = logging.StreamHandler()

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

125

' [%(process)d]:'

126

' %(levelname)s:'

127

' %(message)s'))

128

logger.addHandler(console)

129

logger.setLevel(level)

130

131

132

class PGPError(Exception):

133

"""Exception if encryption/decryption fails"""

134

pass

135

136

137

class PGPEngine(object):

138

"""A simple class for OpenPGP symmetric encryption & decryption"""

139

def __init__(self):

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.gnupg.options.meta_interactive = False

144

self.gnupg.options.homedir = self.tempdir

145

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

148

149

def __enter__(self):

150

return self

151

152

def __exit__ (self, exc_type, exc_value, traceback):

153

self._cleanup()

154

return False

155

156

def __del__(self):

157

self._cleanup()

158

159

def _cleanup(self):

160

if self.tempdir is not None:

161

# Delete contents of tempdir

162

for root, dirs, files in os.walk(self.tempdir,

163

topdown = False):

164

for filename in files:

165

os.remove(os.path.join(root, filename))

166

for dirname in dirs:

167

os.rmdir(os.path.join(root, dirname))

168

# Remove tempdir

169

os.rmdir(self.tempdir)

170

self.tempdir = None

171

172

def password_encode(self, password):

173

# Passphrase can not be empty and can not contain newlines or

174

# NUL bytes. So we prefix it and hex encode it.

175

return b"mandos" + binascii.hexlify(password)

176

177

def encrypt(self, data, password):

178

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

180

try:

181

proc = self.gnupg.run(['--symmetric'],

182

create_fhs=['stdin', 'stdout'],

183

attach_fhs={'stderr': devnull})

184

with contextlib.closing(proc.handles['stdin']) as f:

185

f.write(data)

186

with contextlib.closing(proc.handles['stdout']) as f:

187

ciphertext = f.read()

188

proc.wait()

189

except IOError as e:

190

raise PGPError(e)

191

self.gnupg.passphrase = None

192

return ciphertext

193

194

def decrypt(self, data, password):

195

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

197

try:

198

proc = self.gnupg.run(['--decrypt'],

199

create_fhs=['stdin', 'stdout'],

200

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

202

f.write(data)

203

with contextlib.closing(proc.handles['stdout']) as f:

204

decrypted_plaintext = f.read()

205

proc.wait()

206

except IOError as e:

207

raise PGPError(e)

208

self.gnupg.passphrase = None

209

return decrypted_plaintext

210

211

103

212

104

213

class AvahiError(Exception):

105

214

def __init__(self, value, *args, **kwargs):

164

273

.GetAlternativeServiceName(self.name))

165

274

logger.info("Changing Zeroconf service name to %r ...",

166

275

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

171

276

self.remove()

172

277

try:

173

278

self.add()

174

279

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

280

logger.critical("D-Bus Exception", exc_info=error)

176

281

self.cleanup()

177

282

os._exit(1)

178

283

self.rename_count += 1

193

298

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

299

self.entry_group_state_changed_match = (

195

300

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

301

'StateChanged', self.entry_group_state_changed))

197

302

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

198

303

self.name, self.type)

199

304

self.group.AddService(

217

322

elif state == avahi.ENTRY_GROUP_FAILURE:

218

323

logger.critical("Avahi: Error in group state changed %s",

219

324

unicode(error))

220

raise AvahiGroupError("State changed: %s"

221

% unicode(error))

325

raise AvahiGroupError("State changed: {0!s}"

326

.format(error))

222

327

def cleanup(self):

223

328

"""Derived from the Avahi example code"""

224

329

if self.group is not None:

225

330

try:

226

331

self.group.Free()

227

332

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

333

dbus.exceptions.DBusException):

229

334

pass

230

335

self.group = None

231

336

self.remove()

265

370

self.server_state_changed)

266

371

self.server_state_changed(self.server.GetState())

267

372

373

class AvahiServiceToSyslog(AvahiService):

374

def rename(self):

375

"""Add the new name to the syslog messages"""

376

ret = AvahiService.rename(self)

377

syslogger.setFormatter(logging.Formatter

378

('Mandos ({0}) [%(process)d]:'

379

' %(levelname)s: %(message)s'

380

.format(self.name)))

381

return ret

268

382

269

def _timedelta_to_milliseconds(td):

383

def timedelta_to_milliseconds(td):

270

384

"Convert a datetime.timedelta() to milliseconds"

271

385

return ((td.days * 24 * 60 * 60 * 1000)

272

386

+ (td.seconds * 1000)

276

390

"""A representation of a client host served by this server.

277

391

278

392

Attributes:

279

_approved: bool(); 'None' if not yet approved/disapproved

393

approved: bool(); 'None' if not yet approved/disapproved

280

394

approval_delay: datetime.timedelta(); Time to wait for approval

281

395

approval_duration: datetime.timedelta(); Duration of one approval

282

396

checker: subprocess.Popen(); a running checker process used

289

403

instance %(name)s can be used in the command.

290

404

checker_initiator_tag: a gobject event source tag, or None

291

405

created: datetime.datetime(); (UTC) object creation

406

client_structure: Object describing what attributes a client has

407

and is used for storing the client at exit

292

408

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

409

disable_initiator_tag: a gobject event source tag, or None

295

410

enabled: bool()

296

411

fingerprint: string (40 or 32 hexadecimal digits); used to

299

414

interval: datetime.timedelta(); How often to start a new checker

300

415

last_approval_request: datetime.datetime(); (UTC) or None

301

416

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

417

last_checker_status: integer between 0 and 255 reflecting exit

418

status of last checker. -1 reflects crashed

419

checker, -2 means no checker completed yet.

420

last_enabled: datetime.datetime(); (UTC) or None

303

421

name: string; from the config file, used in log messages and

304

422

D-Bus identifiers

305

423

secret: bytestring; sent verbatim (over TLS) to client

306

424

timeout: datetime.timedelta(); How long from last_checked_ok

307

425

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

426

extended_timeout: extra long timeout when secret has been sent

309

427

runtime_expansions: Allowed attributes for runtime expansion.

310

428

expires: datetime.datetime(); time (UTC) when a client will be

311

429

disabled, or None

315

433

"created", "enabled", "fingerprint",

316

434

"host", "interval", "last_checked_ok",

317

435

"last_enabled", "name", "timeout")

436

client_defaults = { "timeout": "5m",

437

"extended_timeout": "15m",

438

"interval": "2m",

439

"checker": "fping -q -- %%(host)s",

440

"host": "",

441

"approval_delay": "0s",

442

"approval_duration": "1s",

443

"approved_by_default": "True",

444

"enabled": "True",

445

}

318

446

319

447

def timeout_milliseconds(self):

320

448

"Return the 'timeout' attribute in milliseconds"

321

return _timedelta_to_milliseconds(self.timeout)

449

return timedelta_to_milliseconds(self.timeout)

322

450

323

451

def extended_timeout_milliseconds(self):

324

452

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

453

return timedelta_to_milliseconds(self.extended_timeout)

326

454

327

455

def interval_milliseconds(self):

328

456

"Return the 'interval' attribute in milliseconds"

329

return _timedelta_to_milliseconds(self.interval)

457

return timedelta_to_milliseconds(self.interval)

330

458

331

459

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

333

334

def __init__(self, name = None, disable_hook=None, config=None):

460

return timedelta_to_milliseconds(self.approval_delay)

461

462

@staticmethod

463

def config_parser(config):

464

"""Construct a new dict of client settings of this form:

465

{ client_name: {setting_name: value, ...}, ...}

466

with exceptions for any special settings as defined above.

467

NOTE: Must be a pure function. Must return the same result

468

value given the same arguments.

469

"""

470

settings = {}

471

for client_name in config.sections():

472

section = dict(config.items(client_name))

473

client = settings[client_name] = {}

474

475

client["host"] = section["host"]

476

# Reformat values from string types to Python types

477

client["approved_by_default"] = config.getboolean(

478

client_name, "approved_by_default")

479

client["enabled"] = config.getboolean(client_name,

480

"enabled")

481

482

client["fingerprint"] = (section["fingerprint"].upper()

483

.replace(" ", ""))

484

if "secret" in section:

485

client["secret"] = section["secret"].decode("base64")

486

elif "secfile" in section:

487

with open(os.path.expanduser(os.path.expandvars

488

(section["secfile"])),

489

"rb") as secfile:

490

client["secret"] = secfile.read()

491

else:

492

raise TypeError("No secret or secfile for section {0}"

493

.format(section))

494

client["timeout"] = string_to_delta(section["timeout"])

495

client["extended_timeout"] = string_to_delta(

496

section["extended_timeout"])

497

client["interval"] = string_to_delta(section["interval"])

498

client["approval_delay"] = string_to_delta(

499

section["approval_delay"])

500

client["approval_duration"] = string_to_delta(

501

section["approval_duration"])

502

client["checker_command"] = section["checker"]

503

client["last_approval_request"] = None

504

client["last_checked_ok"] = None

505

client["last_checker_status"] = -2

506

507

return settings

508

509

510

def __init__(self, settings, name = None):

335

511

"""Note: the 'checker' key in 'config' sets the

336

512

'checker_command' attribute and *not* the 'checker'

337

513

attribute."""

338

514

self.name = name

339

if config is None:

340

config = {}

515

# adding all client settings

516

for setting, value in settings.iteritems():

517

setattr(self, setting, value)

518

519

if self.enabled:

520

if not hasattr(self, "last_enabled"):

521

self.last_enabled = datetime.datetime.utcnow()

522

if not hasattr(self, "expires"):

523

self.expires = (datetime.datetime.utcnow()

524

+ self.timeout)

525

else:

526

self.last_enabled = None

527

self.expires = None

528

341

529

logger.debug("Creating client %r", self.name)

342

530

# Uppercase and remove spaces from fingerprint for later

343

531

# comparison purposes with return value from the fingerprint()

344

532

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

533

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

351

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

353

"rb") as secfile:

354

self.secret = secfile.read()

355

else:

356

raise TypeError("No secret or secfile for client %s"

357

% self.name)

358

self.host = config.get("host", "")

359

self.created = datetime.datetime.utcnow()

360

self.enabled = False

361

self.last_approval_request = None

362

self.last_enabled = None

363

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

534

self.created = settings.get("created",

535

datetime.datetime.utcnow())

536

537

# attributes specific for this server instance

369

538

self.checker = None

370

539

self.checker_initiator_tag = None

371

540

self.disable_initiator_tag = None

372

self.expires = None

373

541

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

375

542

self.current_checker_command = None

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

543

self.approved = None

380

544

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

545

self.changedstate = (multiprocessing_manager

386

546

.Condition(multiprocessing_manager

387

547

.Lock()))

548

self.client_structure = [attr for attr in

549

self.__dict__.iterkeys()

550

if not attr.startswith("_")]

551

self.client_structure.append("client_structure")

552

553

for name, t in inspect.getmembers(type(self),

554

lambda obj:

555

isinstance(obj,

556

property)):

557

if not name.startswith("_"):

558

self.client_structure.append(name)

388

559

560

# Send notice to process children that client state has changed

389

561

def send_changedstate(self):

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

562

with self.changedstate:

563

self.changedstate.notify_all()

393

564

394

565

def enable(self):

395

566

"""Start this client's checker and timeout hooks"""

397

568

# Already enabled

398

569

return

399

570

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

406

571

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

410

572

self.enabled = True

411

573

self.last_enabled = datetime.datetime.utcnow()

412

# Also start a new checker *right now*.

413

self.start_checker()

574

self.init_checker()

414

575

415

576

def disable(self, quiet=True):

416

577

"""Disable this client."""

428

589

gobject.source_remove(self.checker_initiator_tag)

429

590

self.checker_initiator_tag = None

430

591

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

433

592

self.enabled = False

434

593

# Do not run this again if called by a gobject.timeout_add

435

594

return False

436

595

437

596

def __del__(self):

438

self.disable_hook = None

439

597

self.disable()

440

598

599

def init_checker(self):

600

# Schedule a new checker to be started an 'interval' from now,

601

# and every interval from then on.

602

self.checker_initiator_tag = (gobject.timeout_add

603

(self.interval_milliseconds(),

604

self.start_checker))

605

# Schedule a disable() when 'timeout' has passed

606

self.disable_initiator_tag = (gobject.timeout_add

607

(self.timeout_milliseconds(),

608

self.disable))

609

# Also start a new checker *right now*.

610

self.start_checker()

611

441

612

def checker_callback(self, pid, condition, command):

442

613

"""The checker has completed, so take appropriate actions."""

443

614

self.checker_callback_tag = None

444

615

self.checker = None

445

616

if os.WIFEXITED(condition):

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

617

self.last_checker_status = os.WEXITSTATUS(condition)

618

if self.last_checker_status == 0:

448

619

logger.info("Checker for %(name)s succeeded",

449

620

vars(self))

450

621

self.checked_ok()

452

623

logger.info("Checker for %(name)s failed",

453

624

vars(self))

454

625

else:

626

self.last_checker_status = -1

455

627

logger.warning("Checker for %(name)s crashed?",

456

628

vars(self))

457

629

458

def checked_ok(self, timeout=None):

459

"""Bump up the timeout for this client.

460

461

This should only be called when the client has been seen,

462

alive and well.

463

"""

630

def checked_ok(self):

631

"""Assert that the client has been seen, alive and well."""

632

self.last_checked_ok = datetime.datetime.utcnow()

633

self.last_checker_status = 0

634

self.bump_timeout()

635

636

def bump_timeout(self, timeout=None):

637

"""Bump up the timeout for this client."""

464

638

if timeout is None:

465

639

timeout = self.timeout

466

self.last_checked_ok = datetime.datetime.utcnow()

467

640

if self.disable_initiator_tag is not None:

468

641

gobject.source_remove(self.disable_initiator_tag)

469

642

if getattr(self, "enabled", False):

470

643

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

644

(timedelta_to_milliseconds

472

645

(timeout), self.disable))

473

646

self.expires = datetime.datetime.utcnow() + timeout

474

647

520

693

try:

521

694

command = self.checker_command % escaped_attrs

522

695

except TypeError as error:

523

logger.error('Could not format string "%s":'

524

' %s', self.checker_command, error)

696

logger.error('Could not format string "%s"',

697

self.checker_command, exc_info=error)

525

698

return True # Try again later

526

699

self.current_checker_command = command

527

700

try:

545

718

gobject.source_remove(self.checker_callback_tag)

546

719

self.checker_callback(pid, status, command)

547

720

except OSError as error:

548

logger.error("Failed to start subprocess: %s",

549

error)

721

logger.error("Failed to start subprocess",

722

exc_info=error)

550

723

# Re-run this periodically if run by gobject.timeout_add

551

724

return True

552

725

559

732

return

560

733

logger.debug("Stopping checker for %(name)s", vars(self))

561

734

try:

562

os.kill(self.checker.pid, signal.SIGTERM)

735

self.checker.terminate()

563

736

#time.sleep(0.5)

564

737

#if self.checker.poll() is None:

565

# os.kill(self.checker.pid, signal.SIGKILL)

738

# self.checker.kill()

566

739

except OSError as error:

567

740

if error.errno != errno.ESRCH: # No such process

568

741

raise

585

758

# "Set" method, so we fail early here:

586

759

if byte_arrays and signature != "ay":

587

760

raise ValueError("Byte arrays not supported for non-'ay'"

588

" signature %r" % signature)

761

" signature {0!r}".format(signature))

589

762

def decorator(func):

590

763

func._dbus_is_property = True

591

764

func._dbus_interface = dbus_interface

599

772

return decorator

600

773

601

774

775

def dbus_interface_annotations(dbus_interface):

776

"""Decorator for marking functions returning interface annotations.

777

778

Usage:

779

780

@dbus_interface_annotations("org.example.Interface")

781

def _foo(self): # Function name does not matter

782

return {"org.freedesktop.DBus.Deprecated": "true",

783

"org.freedesktop.DBus.Property.EmitsChangedSignal":

784

"false"}

785

"""

786

def decorator(func):

787

func._dbus_is_interface = True

788

func._dbus_interface = dbus_interface

789

func._dbus_name = dbus_interface

790

return func

791

return decorator

792

793

794

def dbus_annotations(annotations):

795

"""Decorator to annotate D-Bus methods, signals or properties

796

Usage:

797

798

@dbus_service_property("org.example.Interface", signature="b",

799

access="r")

800

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

801

"org.freedesktop.DBus.Property."

802

"EmitsChangedSignal": "false"})

803

def Property_dbus_property(self):

804

return dbus.Boolean(False)

805

"""

806

def decorator(func):

807

func._dbus_annotations = annotations

808

return func

809

return decorator

810

811

602

812

class DBusPropertyException(dbus.exceptions.DBusException):

603

813

"""A base class for D-Bus property-related exceptions

604

814

"""

627

837

"""

628

838

629

839

@staticmethod

630

def _is_dbus_property(obj):

631

return getattr(obj, "_dbus_is_property", False)

840

def _is_dbus_thing(thing):

841

"""Returns a function testing if an attribute is a D-Bus thing

842

843

If called like _is_dbus_thing("method") it returns a function

844

suitable for use as predicate to inspect.getmembers().

845

"""

846

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

847

False)

632

848

633

def _get_all_dbus_properties(self):

849

def _get_all_dbus_things(self, thing):

634

850

"""Returns a generator of (name, attribute) pairs

635

851

"""

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

852

return ((getattr(athing.__get__(self), "_dbus_name",

853

name),

854

athing.__get__(self))

637

855

for cls in self.__class__.__mro__

638

for name, prop in

639

inspect.getmembers(cls, self._is_dbus_property))

856

for name, athing in

857

inspect.getmembers(cls,

858

self._is_dbus_thing(thing)))

640

859

641

860

def _get_dbus_property(self, interface_name, property_name):

642

861

"""Returns a bound method if one exists which is a D-Bus

644

863

"""

645

864

for cls in self.__class__.__mro__:

646

865

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

866

(cls,

867

self._is_dbus_thing("property"))):

648

868

if (value._dbus_name == property_name

649

869

and value._dbus_interface == interface_name):

650

870

return value.__get__(self)

679

899

# signatures other than "ay".

680

900

if prop._dbus_signature != "ay":

681

901

raise ValueError

682

value = dbus.ByteArray(''.join(unichr(byte)

683

for byte in value))

902

value = dbus.ByteArray(b''.join(chr(byte)

903

for byte in value))

684

904

prop(value)

685

905

686

906

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

691

911

692

912

Note: Will not include properties with access="write".

693

913

"""

694

all = {}

695

for name, prop in self._get_all_dbus_properties():

914

properties = {}

915

for name, prop in self._get_all_dbus_things("property"):

696

916

if (interface_name

697

917

and interface_name != prop._dbus_interface):

698

918

# Interface non-empty but did not match

702

922

continue

703

923

value = prop()

704

924

if not hasattr(value, "variant_level"):

705

all[name] = value

925

properties[name] = value

706

926

continue

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

927

properties[name] = type(value)(value, variant_level=

928

value.variant_level+1)

929

return dbus.Dictionary(properties, signature="sv")

710

930

711

931

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

712

932

out_signature="s",

713

933

path_keyword='object_path',

714

934

connection_keyword='connection')

715

935

def Introspect(self, object_path, connection):

716

"""Standard D-Bus method, overloaded to insert property tags.

936

"""Overloading of standard D-Bus method.

937

938

Inserts property tags and interface annotation tags.

717

939

"""

718

940

xmlstring = dbus.service.Object.Introspect(self, object_path,

719

941

connection)

726

948

e.setAttribute("access", prop._dbus_access)

727

949

return e

728

950

for if_tag in document.getElementsByTagName("interface"):

951

# Add property tags

729

952

for tag in (make_tag(document, name, prop)

730

953

for name, prop

731

in self._get_all_dbus_properties()

954

in self._get_all_dbus_things("property")

732

955

if prop._dbus_interface

733

956

== if_tag.getAttribute("name")):

734

957

if_tag.appendChild(tag)

958

# Add annotation tags

959

for typ in ("method", "signal", "property"):

960

for tag in if_tag.getElementsByTagName(typ):

961

annots = dict()

962

for name, prop in (self.

963

_get_all_dbus_things(typ)):

964

if (name == tag.getAttribute("name")

965

and prop._dbus_interface

966

== if_tag.getAttribute("name")):

967

annots.update(getattr

968

(prop,

969

"_dbus_annotations",

970

{}))

971

for name, value in annots.iteritems():

972

ann_tag = document.createElement(

973

"annotation")

974

ann_tag.setAttribute("name", name)

975

ann_tag.setAttribute("value", value)

976

tag.appendChild(ann_tag)

977

# Add interface annotation tags

978

for annotation, value in dict(

979

itertools.chain(

980

*(annotations().iteritems()

981

for name, annotations in

982

self._get_all_dbus_things("interface")

983

if name == if_tag.getAttribute("name")

984

))).iteritems():

985

ann_tag = document.createElement("annotation")

986

ann_tag.setAttribute("name", annotation)

987

ann_tag.setAttribute("value", value)

988

if_tag.appendChild(ann_tag)

735

989

# Add the names to the return values for the

736

990

# "org.freedesktop.DBus.Properties" methods

737

991

if (if_tag.getAttribute("name")

752

1006

except (AttributeError, xml.dom.DOMException,

753

1007

xml.parsers.expat.ExpatError) as error:

754

1008

logger.error("Failed to override Introspection method",

755

error)

1009

exc_info=error)

756

1010

return xmlstring

757

1011

758

1012

763

1017

return dbus.String(dt.isoformat(),

764

1018

variant_level=variant_level)

765

1019

1020

766

1021

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

1022

.__metaclass__):

768

1023

"""Applied to an empty subclass of a D-Bus object, this metaclass

771

1026

def __new__(mcs, name, bases, attr):

772

1027

# Go through all the base classes which could have D-Bus

773

1028

# methods, signals, or properties in them

1029

old_interface_names = []

774

1030

for base in (b for b in bases

775

1031

if issubclass(b, dbus.service.Object)):

776

1032

# Go though all attributes of the base class

786

1042

alt_interface = (attribute._dbus_interface

787

1043

.replace("se.recompile.Mandos",

788

1044

"se.bsnet.fukt.Mandos"))

1045

if alt_interface != attribute._dbus_interface:

1046

old_interface_names.append(alt_interface)

789

1047

# Is this a D-Bus signal?

790

1048

if getattr(attribute, "_dbus_is_signal", False):

791

1049

# Extract the original non-method function by

806

1064

nonmethod_func.func_name,

807

1065

nonmethod_func.func_defaults,

808

1066

nonmethod_func.func_closure)))

1067

# Copy annotations, if any

1068

try:

1069

new_function._dbus_annotations = (

1070

dict(attribute._dbus_annotations))

1071

except AttributeError:

1072

pass

809

1073

# Define a creator of a function to call both the

810

1074

# old and new functions, so both the old and new

811

1075

# signals gets sent when the function is called

839

1103

attribute.func_name,

840

1104

attribute.func_defaults,

841

1105

attribute.func_closure)))

1106

# Copy annotations, if any

1107

try:

1108

attr[attrname]._dbus_annotations = (

1109

dict(attribute._dbus_annotations))

1110

except AttributeError:

1111

pass

842

1112

# Is this a D-Bus property?

843

1113

elif getattr(attribute, "_dbus_is_property", False):

844

1114

# Create a new, but exactly alike, function

858

1128

attribute.func_name,

859

1129

attribute.func_defaults,

860

1130

attribute.func_closure)))

1131

# Copy annotations, if any

1132

try:

1133

attr[attrname]._dbus_annotations = (

1134

dict(attribute._dbus_annotations))

1135

except AttributeError:

1136

pass

1137

# Is this a D-Bus interface?

1138

elif getattr(attribute, "_dbus_is_interface", False):

1139

# Create a new, but exactly alike, function

1140

# object. Decorate it to be a new D-Bus interface

1141

# with the alternate D-Bus interface name. Add it

1142

# to the class.

1143

attr[attrname] = (dbus_interface_annotations

1144

(alt_interface)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1151

# Deprecate all old interfaces

1152

basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1153

for old_interface_name in old_interface_names:

1154

@dbus_interface_annotations(old_interface_name)

1155

def func(self):

1156

return { "org.freedesktop.DBus.Deprecated": "true" }

1157

# Find an unused name

1158

for aname in (basename.format(i) for i in

1159

itertools.count()):

1160

if aname not in attr:

1161

attr[aname] = func

1162

break

861

1163

return type.__new__(mcs, name, bases, attr)

862

1164

1165

863

1166

class ClientDBus(Client, DBusObjectWithProperties):

864

1167

"""A Client class using D-Bus

865

1168

874

1177

# dbus.service.Object doesn't use super(), so we can't either.

875

1178

876

1179

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

878

1180

self.bus = bus

879

1181

Client.__init__(self, *args, **kwargs)

880

1182

# Only now, when this client is initialized, can it show up on

892

1194

variant_level=1):

893

1195

""" Modify a variable so that it's a property which announces

894

1196

its changes to DBus.

895

1197

896

1198

transform_fun: Function that takes a value and a variant_level

897

1199

and transforms it to a D-Bus type.

898

1200

dbus_name: D-Bus name of the variable

928

1230

checker is not None)

929

1231

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

1232

"LastCheckedOK")

1233

last_checker_status = notifychangeproperty(dbus.Int16,

1234

"LastCheckerStatus")

931

1235

last_approval_request = notifychangeproperty(

932

1236

datetime_to_dbus, "LastApprovalRequest")

933

1237

approved_by_default = notifychangeproperty(dbus.Boolean,

934

1238

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

1239

approval_delay = notifychangeproperty(dbus.UInt64,

936

1240

"ApprovalDelay",

937

1241

type_func =

938

_timedelta_to_milliseconds)

1242

timedelta_to_milliseconds)

939

1243

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

1244

dbus.UInt64, "ApprovalDuration",

1245

type_func = timedelta_to_milliseconds)

942

1246

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1247

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

944

1248

type_func =

945

_timedelta_to_milliseconds)

1249

timedelta_to_milliseconds)

946

1250

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

1251

dbus.UInt64, "ExtendedTimeout",

1252

type_func = timedelta_to_milliseconds)

1253

interval = notifychangeproperty(dbus.UInt64,

950

1254

"Interval",

951

1255

type_func =

952

_timedelta_to_milliseconds)

1256

timedelta_to_milliseconds)

953

1257

checker_command = notifychangeproperty(dbus.String, "Checker")

954

1258

955

1259

del notifychangeproperty

997

1301

return r

998

1302

999

1303

def _reset_approved(self):

1000

self._approved = None

1304

self.approved = None

1001

1305

return False

1002

1306

1003

1307

def approve(self, value=True):

1004

1308

self.send_changedstate()

1005

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

1309

self.approved = value

1310

gobject.timeout_add(timedelta_to_milliseconds

1007

1311

(self.approval_duration),

1008

1312

self._reset_approved)

1009

1313

1011

1315

## D-Bus methods, signals & properties

1012

1316

_interface = "se.recompile.Mandos.Client"

1013

1317

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1014

1325

## Signals

1015

1326

1016

1327

# CheckerCompleted - signal

1115

1426

access="readwrite")

1116

1427

def ApprovalDuration_dbus_property(self, value=None):

1117

1428

if value is None: # get

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1429

return dbus.UInt64(timedelta_to_milliseconds(

1119

1430

self.approval_duration))

1120

1431

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1121

1432

1135

1446

def Host_dbus_property(self, value=None):

1136

1447

if value is None: # get

1137

1448

return dbus.String(self.host)

1138

self.host = value

1449

self.host = unicode(value)

1139

1450

1140

1451

# Created - property

1141

1452

@dbus_service_property(_interface, signature="s", access="read")

1142

1453

def Created_dbus_property(self):

1143

return dbus.String(datetime_to_dbus(self.created))

1454

return datetime_to_dbus(self.created)

1144

1455

1145

1456

# LastEnabled - property

1146

1457

@dbus_service_property(_interface, signature="s", access="read")

1167

1478

return

1168

1479

return datetime_to_dbus(self.last_checked_ok)

1169

1480

1481

# LastCheckerStatus - property

1482

@dbus_service_property(_interface, signature="n",

1483

access="read")

1484

def LastCheckerStatus_dbus_property(self):

1485

return dbus.Int16(self.last_checker_status)

1486

1170

1487

# Expires - property

1171

1488

@dbus_service_property(_interface, signature="s", access="read")

1172

1489

def Expires_dbus_property(self):

1184

1501

if value is None: # get

1185

1502

return dbus.UInt64(self.timeout_milliseconds())

1186

1503

self.timeout = datetime.timedelta(0, 0, 0, value)

1187

if getattr(self, "disable_initiator_tag", None) is None:

1188

return

1189

1504

# Reschedule timeout

1190

gobject.source_remove(self.disable_initiator_tag)

1191

self.disable_initiator_tag = None

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1198

if time_to_die <= 0:

1199

# The timeout has passed

1200

self.disable()

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1205

self.disable_initiator_tag = (gobject.timeout_add

1206

(time_to_die, self.disable))

1505

if self.enabled:

1506

now = datetime.datetime.utcnow()

1507

time_to_die = timedelta_to_milliseconds(

1508

(self.last_checked_ok + self.timeout) - now)

1509

if time_to_die <= 0:

1510

# The timeout has passed

1511

self.disable()

1512

else:

1513

self.expires = (now +

1514

datetime.timedelta(milliseconds =

1515

time_to_die))

1516

if (getattr(self, "disable_initiator_tag", None)

1517

is None):

1518

return

1519

gobject.source_remove(self.disable_initiator_tag)

1520

self.disable_initiator_tag = (gobject.timeout_add

1521

(time_to_die,

1522

self.disable))

1207

1523

1208

1524

# ExtendedTimeout - property

1209

1525

@dbus_service_property(_interface, signature="t",

1222

1538

self.interval = datetime.timedelta(0, 0, 0, value)

1223

1539

if getattr(self, "checker_initiator_tag", None) is None:

1224

1540

return

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1541

if self.enabled:

1542

# Reschedule checker run

1543

gobject.source_remove(self.checker_initiator_tag)

1544

self.checker_initiator_tag = (gobject.timeout_add

1545

(value, self.start_checker))

1546

self.start_checker() # Start one now, too

1230

1547

1231

1548

# Checker - property

1232

1549

@dbus_service_property(_interface, signature="s",

1234

1551

def Checker_dbus_property(self, value=None):

1235

1552

if value is None: # get

1236

1553

return dbus.String(self.checker_command)

1237

self.checker_command = value

1554

self.checker_command = unicode(value)

1238

1555

1239

1556

# CheckerRunning - property

1240

1557

@dbus_service_property(_interface, signature="b",

1269

1586

raise KeyError()

1270

1587

1271

1588

def __getattribute__(self, name):

1272

if(name == '_pipe'):

1589

if name == '_pipe':

1273

1590

return super(ProxyClient, self).__getattribute__(name)

1274

1591

self._pipe.send(('getattr', name))

1275

1592

data = self._pipe.recv()

1282

1599

return func

1283

1600

1284

1601

def __setattr__(self, name, value):

1285

if(name == '_pipe'):

1602

if name == '_pipe':

1286

1603

return super(ProxyClient, self).__setattr__(name, value)

1287

1604

self._pipe.send(('setattr', name, value))

1288

1605

1606

1289

1607

class ClientDBusTransitional(ClientDBus):

1290

1608

__metaclass__ = AlternateDBusNamesMetaclass

1291

1609

1610

1292

1611

class ClientHandler(socketserver.BaseRequestHandler, object):

1293

1612

"""A class to handle client connections.

1294

1613

1376

1695

client.Rejected("Disabled")

1377

1696

return

1378

1697

1379

if client._approved or not client.approval_delay:

1698

if client.approved or not client.approval_delay:

1380

1699

#We are approved or approval is disabled

1381

1700

break

1382

elif client._approved is None:

1701

elif client.approved is None:

1383

1702

logger.info("Client %s needs approval",

1384

1703

client.name)

1385

1704

if self.server.use_dbus:

1399

1718

time = datetime.datetime.now()

1400

1719

client.changedstate.acquire()

1401

1720

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1721

(float(client.timedelta_to_milliseconds(delay)

1403

1722

/ 1000)))

1404

1723

client.changedstate.release()

1405

1724

time2 = datetime.datetime.now()

1431

1750

1432

1751

logger.info("Sending secret to %s", client.name)

1433

1752

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1753

client.bump_timeout(client.extended_timeout)

1435

1754

if self.server.use_dbus:

1436

1755

# Emit D-Bus signal

1437

1756

client.GotSecret()

1504

1823

# Convert the buffer to a Python bytestring

1505

1824

fpr = ctypes.string_at(buf, buf_len.value)

1506

1825

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1826

hex_fpr = binascii.hexlify(fpr).upper()

1508

1827

return hex_fpr

1509

1828

1510

1829

1513

1832

def sub_process_main(self, request, address):

1514

1833

try:

1515

1834

self.finish_request(request, address)

1516

except:

1835

except Exception:

1517

1836

self.handle_error(request, address)

1518

1837

self.close_request(request)

1519

1838

1624

1943

self.enabled = False

1625

1944

self.clients = clients

1626

1945

if self.clients is None:

1627

self.clients = set()

1946

self.clients = {}

1628

1947

self.use_dbus = use_dbus

1629

1948

self.gnutls_priority = gnutls_priority

1630

1949

IPv6_TCPServer.__init__(self, server_address,

1677

1996

fpr = request[1]

1678

1997

address = request[2]

1679

1998

1680

for c in self.clients:

1999

for c in self.clients.itervalues():

1681

2000

if c.fingerprint == fpr:

1682

2001

client = c

1683

2002

break

1760

2079

elif suffix == "w":

1761

2080

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1762

2081

else:

1763

raise ValueError("Unknown suffix %r" % suffix)

2082

raise ValueError("Unknown suffix {0!r}"

2083

.format(suffix))

1764

2084

except (ValueError, IndexError) as e:

1765

2085

raise ValueError(*(e.args))

1766

2086

timevalue += delta

1767

2087

return timevalue

1768

2088

1769

2089

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

1794

2090

def daemon(nochdir = False, noclose = False):

1795

2091

"""See daemon(3). Standard BSD Unix function.

1796

2092

1804

2100

sys.exit()

1805

2101

if not noclose:

1806

2102

# Close all standard open file descriptors

1807

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2103

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1808

2104

if not stat.S_ISCHR(os.fstat(null).st_mode):

1809

2105

raise OSError(errno.ENODEV,

1810

"%s not a character device"

1811

% os.path.devnull)

2106

"{0} not a character device"

2107

.format(os.devnull))

1812

2108

os.dup2(null, sys.stdin.fileno())

1813

2109

os.dup2(null, sys.stdout.fileno())

1814

2110

os.dup2(null, sys.stderr.fileno())

1823

2119

1824

2120

parser = argparse.ArgumentParser()

1825

2121

parser.add_argument("-v", "--version", action="version",

1826

version = "%%(prog)s %s" % version,

2122

version = "%(prog)s {0}".format(version),

1827

2123

help="show version number and exit")

1828

2124

parser.add_argument("-i", "--interface", metavar="IF",

1829

2125

help="Bind to interface IF")

1851

2147

" system bus interface")

1852

2148

parser.add_argument("--no-ipv6", action="store_false",

1853

2149

dest="use_ipv6", help="Do not use IPv6")

2150

parser.add_argument("--no-restore", action="store_false",

2151

dest="restore", help="Do not restore stored"

2152

" state")

2153

parser.add_argument("--statedir", metavar="DIR",

2154

help="Directory to save/restore state in")

2155

1854

2156

options = parser.parse_args()

1855

2157

1856

2158

if options.check:

1869

2171

"use_dbus": "True",

1870

2172

"use_ipv6": "True",

1871

2173

"debuglevel": "",

2174

"restore": "True",

2175

"statedir": "/var/lib/mandos"

1872

2176

}

1873

2177

1874

2178

# Parse config file for server-global settings

1891

2195

# options, if set.

1892

2196

for option in ("interface", "address", "port", "debug",

1893

2197

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

2198

"use_dbus", "use_ipv6", "debuglevel", "restore",

2199

"statedir"):

1895

2200

value = getattr(options, option)

1896

2201

if value is not None:

1897

2202

server_settings[option] = value

1909

2214

debuglevel = server_settings["debuglevel"]

1910

2215

use_dbus = server_settings["use_dbus"]

1911

2216

use_ipv6 = server_settings["use_ipv6"]

2217

stored_state_path = os.path.join(server_settings["statedir"],

2218

stored_state_file)

2219

2220

if debug:

2221

initlogger(debug, logging.DEBUG)

2222

else:

2223

if not debuglevel:

2224

initlogger(debug)

2225

else:

2226

level = getattr(logging, debuglevel.upper())

2227

initlogger(debug, level)

1912

2228

1913

2229

if server_settings["servicename"] != "Mandos":

1914

2230

syslogger.setFormatter(logging.Formatter

1915

('Mandos (%s) [%%(process)d]:'

1916

' %%(levelname)s: %%(message)s'

1917

% server_settings["servicename"]))

2231

('Mandos ({0}) [%(process)d]:'

2232

' %(levelname)s: %(message)s'

2233

.format(server_settings

2234

["servicename"])))

1918

2235

1919

2236

# Parse config file with clients

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1927

}

1928

client_config = configparser.SafeConfigParser(client_defaults)

2237

client_config = configparser.SafeConfigParser(Client

2238

.client_defaults)

1929

2239

client_config.read(os.path.join(server_settings["configdir"],

1930

2240

"clients.conf"))

1931

2241

1948

2258

except IOError:

1949

2259

logger.error("Could not open file %r", pidfilename)

1950

2260

1951

try:

1952

uid = pwd.getpwnam("_mandos").pw_uid

1953

gid = pwd.getpwnam("_mandos").pw_gid

1954

except KeyError:

2261

for name in ("_mandos", "mandos", "nobody"):

1955

2262

try:

1956

uid = pwd.getpwnam("mandos").pw_uid

1957

gid = pwd.getpwnam("mandos").pw_gid

2263

uid = pwd.getpwnam(name).pw_uid

2264

gid = pwd.getpwnam(name).pw_gid

2265

break

1958

2266

except KeyError:

1959

try:

1960

uid = pwd.getpwnam("nobody").pw_uid

1961

gid = pwd.getpwnam("nobody").pw_gid

1962

except KeyError:

1963

uid = 65534

1964

gid = 65534

2267

continue

2268

else:

2269

uid = 65534

2270

gid = 65534

1965

2271

try:

1966

2272

os.setgid(gid)

1967

2273

os.setuid(uid)

1969

2275

if error[0] != errno.EPERM:

1970

2276

raise error

1971

2277

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

1980

2278

if debug:

1981

2279

# Enable all possible GnuTLS debugging

1982

2280

1992

2290

.gnutls_global_set_log_function(debug_gnutls))

1993

2291

1994

2292

# Redirect stdin so all checkers get /dev/null

1995

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2293

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1996

2294

os.dup2(null, sys.stdin.fileno())

1997

2295

if null > 2:

1998

2296

os.close(null)

1999

else:

2000

# No console logging

2001

logger.removeHandler(console)

2002

2297

2003

2298

# Need to fork before connecting to D-Bus

2004

2299

if not debug:

2005

2300

# Close all input and output, do double fork, etc.

2006

2301

daemon()

2007

2302

2303

gobject.threads_init()

2304

2008

2305

global main_loop

2009

2306

# From the Avahi example code

2010

DBusGMainLoop(set_as_default=True )

2307

DBusGMainLoop(set_as_default=True)

2011

2308

main_loop = gobject.MainLoop()

2012

2309

bus = dbus.SystemBus()

2013

2310

# End of Avahi example code

2024

2321

server_settings["use_dbus"] = False

2025

2322

tcp_server.use_dbus = False

2026

2323

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2324

service = AvahiServiceToSyslog(name =

2325

server_settings["servicename"],

2326

servicetype = "_mandos._tcp",

2327

protocol = protocol, bus = bus)

2030

2328

if server_settings["interface"]:

2031

2329

service.interface = (if_nametoindex

2032

2330

(str(server_settings["interface"])))

2038

2336

if use_dbus:

2039

2337

client_class = functools.partial(ClientDBusTransitional,

2040

2338

bus = bus)

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2339

2340

client_settings = Client.config_parser(client_config)

2341

old_client_settings = {}

2342

clients_data = {}

2343

2344

# Get client data and settings from last running state.

2345

if server_settings["restore"]:

2346

try:

2347

with open(stored_state_path, "rb") as stored_state:

2348

clients_data, old_client_settings = (pickle.load

2349

(stored_state))

2350

os.remove(stored_state_path)

2351

except IOError as e:

2352

logger.warning("Could not load persistent state: {0}"

2353

.format(e))

2354

if e.errno != errno.ENOENT:

2355

raise

2356

except EOFError as e:

2357

logger.warning("Could not load persistent state: "

2358

"EOFError: {0}".format(e))

2359

2360

with PGPEngine() as pgp:

2361

for client_name, client in clients_data.iteritems():

2362

# Decide which value to use after restoring saved state.

2363

# We have three different values: Old config file,

2364

# new config file, and saved state.

2365

# New config value takes precedence if it differs from old

2366

# config value, otherwise use saved state.

2367

for name, value in client_settings[client_name].items():

2368

try:

2369

# For each value in new config, check if it

2370

# differs from the old config value (Except for

2371

# the "secret" attribute)

2372

if (name != "secret" and

2373

value != old_client_settings[client_name]

2374

[name]):

2375

client[name] = value

2376

except KeyError:

2377

pass

2378

2379

# Clients who has passed its expire date can still be

2380

# enabled if its last checker was successful. Clients

2381

# whose checker succeeded before we stored its state is

2382

# assumed to have successfully run all checkers during

2383

# downtime.

2384

if client["enabled"]:

2385

if datetime.datetime.utcnow() >= client["expires"]:

2386

if not client["last_checked_ok"]:

2387

logger.warning(

2388

"disabling client {0} - Client never "

2389

"performed a successful checker"

2390

.format(client_name))

2391

client["enabled"] = False

2392

elif client["last_checker_status"] != 0:

2393

logger.warning(

2394

"disabling client {0} - Client "

2395

"last checker failed with error code {1}"

2396

.format(client_name,

2397

client["last_checker_status"]))

2398

client["enabled"] = False

2399

else:

2400

client["expires"] = (datetime.datetime

2401

.utcnow()

2402

+ client["timeout"])

2403

logger.debug("Last checker succeeded,"

2404

" keeping {0} enabled"

2405

.format(client_name))

2048

2406

try:

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2407

client["secret"] = (

2408

pgp.decrypt(client["encrypted_secret"],

2409

client_settings[client_name]

2410

["secret"]))

2411

except PGPError:

2412

# If decryption fails, we use secret from new settings

2413

logger.debug("Failed to decrypt {0} old secret"

2414

.format(client_name))

2415

client["secret"] = (

2416

client_settings[client_name]["secret"])

2417

2418

2419

# Add/remove clients based on new changes made to config

2420

for client_name in (set(old_client_settings)

2421

- set(client_settings)):

2422

del clients_data[client_name]

2423

for client_name in (set(client_settings)

2424

- set(old_client_settings)):

2425

clients_data[client_name] = client_settings[client_name]

2426

2427

# Create all client objects

2428

for client_name, client in clients_data.iteritems():

2429

tcp_server.clients[client_name] = client_class(

2430

name = client_name, settings = client)

2431

2058

2432

if not tcp_server.clients:

2059

2433

logger.warning("No clients defined")

2060

2434

2071

2445

# "pidfile" was never created

2072

2446

pass

2073

2447

del pidfilename

2074

2075

2448

signal.signal(signal.SIGINT, signal.SIG_IGN)

2076

2449

2077

2450

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2078

2451

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2079

2452

2080

2453

if use_dbus:

2081

class MandosDBusService(dbus.service.Object):

2454

class MandosDBusService(DBusObjectWithProperties):

2082

2455

"""A D-Bus proxy object"""

2083

2456

def __init__(self):

2084

2457

dbus.service.Object.__init__(self, bus, "/")

2085

2458

_interface = "se.recompile.Mandos"

2086

2459

2460

@dbus_interface_annotations(_interface)

2461

def _foo(self):

2462

return { "org.freedesktop.DBus.Property"

2463

".EmitsChangedSignal":

2464

"false"}

2465

2087

2466

@dbus.service.signal(_interface, signature="o")

2088

2467

def ClientAdded(self, objpath):

2089

2468

"D-Bus signal"

2103

2482

def GetAllClients(self):

2104

2483

"D-Bus method"

2105

2484

return dbus.Array(c.dbus_object_path

2106

for c in tcp_server.clients)

2485

for c in

2486

tcp_server.clients.itervalues())

2107

2487

2108

2488

@dbus.service.method(_interface,

2109

2489

out_signature="a{oa{sv}}")

2111

2491

"D-Bus method"

2112

2492

return dbus.Dictionary(

2113

2493

((c.dbus_object_path, c.GetAll(""))

2114

for c in tcp_server.clients),

2494

for c in tcp_server.clients.itervalues()),

2115

2495

signature="oa{sv}")

2116

2496

2117

2497

@dbus.service.method(_interface, in_signature="o")

2118

2498

def RemoveClient(self, object_path):

2119

2499

"D-Bus method"

2120

for c in tcp_server.clients:

2500

for c in tcp_server.clients.itervalues():

2121

2501

if c.dbus_object_path == object_path:

2122

tcp_server.clients.remove(c)

2502

del tcp_server.clients[c.name]

2123

2503

c.remove_from_connection()

2124

2504

# Don't signal anything except ClientRemoved

2125

2505

c.disable(quiet=True)

2139

2519

service.cleanup()

2140

2520

2141

2521

multiprocessing.active_children()

2522

if not (tcp_server.clients or client_settings):

2523

return

2524

2525

# Store client before exiting. Secrets are encrypted with key

2526

# based on what config file has. If config file is

2527

# removed/edited, old secret will thus be unrecovable.

2528

clients = {}

2529

with PGPEngine() as pgp:

2530

for client in tcp_server.clients.itervalues():

2531

key = client_settings[client.name]["secret"]

2532

client.encrypted_secret = pgp.encrypt(client.secret,

2533

key)

2534

client_dict = {}

2535

2536

# A list of attributes that can not be pickled

2537

# + secret.

2538

exclude = set(("bus", "changedstate", "secret",

2539

"checker"))

2540

for name, typ in (inspect.getmembers

2541

(dbus.service.Object)):

2542

exclude.add(name)

2543

2544

client_dict["encrypted_secret"] = (client

2545

.encrypted_secret)

2546

for attr in client.client_structure:

2547

if attr not in exclude:

2548

client_dict[attr] = getattr(client, attr)

2549

2550

clients[client.name] = client_dict

2551

del client_settings[client.name]["secret"]

2552

2553

try:

2554

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2555

prefix="clients-",

2556

dir=os.path.dirname

2557

(stored_state_path))

2558

with os.fdopen(tempfd, "wb") as stored_state:

2559

pickle.dump((clients, client_settings), stored_state)

2560

os.rename(tempname, stored_state_path)

2561

except (IOError, OSError) as e:

2562

logger.warning("Could not save persistent state: {0}"

2563

.format(e))

2564

if not debug:

2565

try:

2566

os.remove(tempname)

2567

except NameError:

2568

pass

2569

if e.errno not in set((errno.ENOENT, errno.EACCES,

2570

errno.EEXIST)):

2571

raise e

2572

2573

# Delete all clients, and settings from config

2142

2574

while tcp_server.clients:

2143

client = tcp_server.clients.pop()

2575

name, client = tcp_server.clients.popitem()

2144

2576

if use_dbus:

2145

2577

client.remove_from_connection()

2146

client.disable_hook = None

2147

2578

# Don't signal anything except ClientRemoved

2148

2579

client.disable(quiet=True)

2149

2580

if use_dbus:

2151

2582

mandos_dbus_service.ClientRemoved(client

2152

2583

.dbus_object_path,

2153

2584

client.name)

2585

client_settings.clear()

2154

2586

2155

2587

atexit.register(cleanup)

2156

2588

2157

for client in tcp_server.clients:

2589

for client in tcp_server.clients.itervalues():

2158

2590

if use_dbus:

2159

2591

# Emit D-Bus signal

2160

2592

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2161

client.enable()

2593

# Need to initiate checking of clients

2594

if client.enabled:

2595

client.init_checker()

2162

2596

2163

2597

tcp_server.enable()

2164

2598

tcp_server.server_activate()

2167

2601

service.port = tcp_server.socket.getsockname()[1]

2168

2602

if use_ipv6:

2169

2603

logger.info("Now listening on address %r, port %d,"

2170

" flowinfo %d, scope_id %d"

2171

% tcp_server.socket.getsockname())

2604

" flowinfo %d, scope_id %d",

2605

*tcp_server.socket.getsockname())

2172

2606

else: # IPv4

2173

logger.info("Now listening on address %r, port %d"

2174

% tcp_server.socket.getsockname())

2607

logger.info("Now listening on address %r, port %d",

2608

*tcp_server.socket.getsockname())

2175

2609

2176

2610

#service.interface = tcp_server.socket.getsockname()[3]

2177

2611

2180

2614

try:

2181

2615

service.activate()

2182

2616

except dbus.exceptions.DBusException as error:

2183

logger.critical("DBusException: %s", error)

2617

logger.critical("D-Bus Exception", exc_info=error)

2184

2618

cleanup()

2185

2619

sys.exit(1)

2186

2620

# End of Avahi example code

2193

2627

logger.debug("Starting main loop")

2194

2628

main_loop.run()

2195

2629

except AvahiError as error:

2196

logger.critical("AvahiError: %s", error)

2630

logger.critical("Avahi Error", exc_info=error)

2197

2631

cleanup()

2198

2632

sys.exit(1)

2199

2633

except KeyboardInterrupt:

2204

2638

# Must run before the D-Bus bus name gets deregistered

2205

2639

cleanup()

2206

2640

2207

2208

2641

if __name__ == '__main__':

2209

2642

main()