/mandos/release : revision 237.7.127

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.5.5"

91

version = "1.5.3"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

151

def __enter__(self):

152

return self

153

154

def __exit__(self, exc_type, exc_value, traceback):

154

def __exit__ (self, exc_type, exc_value, traceback):

155

self._cleanup()

156

return False

157

379

self.server_state_changed)

380

self.server_state_changed(self.server.GetState())

381

382

383

382

class AvahiServiceToSyslog(AvahiService):

384

383

def rename(self):

385

384

"""Add the new name to the syslog messages"""

390

389

.format(self.name)))

391

390

return ret

392

391

393

394

392

def timedelta_to_milliseconds(td):

395

393

"Convert a datetime.timedelta() to milliseconds"

396

394

return ((td.days * 24 * 60 * 60 * 1000)

397

395

+ (td.seconds * 1000)

398

396

+ (td.microseconds // 1000))

399

397

400

401

398

class Client(object):

402

399

"""A representation of a client host served by this server.

403

400

442

439

"""

443

440

444

441

runtime_expansions = ("approval_delay", "approval_duration",

445

"created", "enabled", "expires",

446

"fingerprint", "host", "interval",

447

"last_approval_request", "last_checked_ok",

442

"created", "enabled", "fingerprint",

443

"host", "interval", "last_checked_ok",

448

444

"last_enabled", "name", "timeout")

449

445

client_defaults = { "timeout": "5m",

450

446

"extended_timeout": "15m",

576

572

if getattr(self, "enabled", False):

577

573

# Already enabled

578

574

return

575

self.send_changedstate()

579

576

self.expires = datetime.datetime.utcnow() + self.timeout

580

577

self.enabled = True

581

578

self.last_enabled = datetime.datetime.utcnow()

582

579

self.init_checker()

583

self.send_changedstate()

584

580

585

581

def disable(self, quiet=True):

586

582

"""Disable this client."""

587

583

if not getattr(self, "enabled", False):

588

584

return False

589

585

if not quiet:

586

self.send_changedstate()

587

if not quiet:

590

588

logger.info("Disabling client %s", self.name)

591

if getattr(self, "disable_initiator_tag", None) is not None:

589

if getattr(self, "disable_initiator_tag", False):

592

590

gobject.source_remove(self.disable_initiator_tag)

593

591

self.disable_initiator_tag = None

594

592

self.expires = None

595

if getattr(self, "checker_initiator_tag", None) is not None:

593

if getattr(self, "checker_initiator_tag", False):

596

594

gobject.source_remove(self.checker_initiator_tag)

597

595

self.checker_initiator_tag = None

598

596

self.stop_checker()

599

597

self.enabled = False

600

if not quiet:

601

self.send_changedstate()

602

598

# Do not run this again if called by a gobject.timeout_add

603

599

return False

604

600

608

604

def init_checker(self):

609

605

# Schedule a new checker to be started an 'interval' from now,

610

606

# and every interval from then on.

611

if self.checker_initiator_tag is not None:

612

gobject.source_remove(self.checker_initiator_tag)

613

607

self.checker_initiator_tag = (gobject.timeout_add

614

608

(self.interval_milliseconds(),

615

609

self.start_checker))

616

610

# Schedule a disable() when 'timeout' has passed

617

if self.disable_initiator_tag is not None:

618

gobject.source_remove(self.disable_initiator_tag)

619

611

self.disable_initiator_tag = (gobject.timeout_add

620

612

(self.timeout_milliseconds(),

621

613

self.disable))

652

644

timeout = self.timeout

653

645

if self.disable_initiator_tag is not None:

654

646

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = None

656

647

if getattr(self, "enabled", False):

657

648

self.disable_initiator_tag = (gobject.timeout_add

658

649

(timedelta_to_milliseconds

691

682

self.current_checker_command)

692

683

# Start a new checker if needed

693

684

if self.checker is None:

694

# Escape attributes for the shell

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

699

685

try:

700

command = self.checker_command % escaped_attrs

701

except TypeError as error:

702

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

686

# In case checker_command has exactly one % operator

687

command = self.checker_command % self.host

688

except TypeError:

689

# Escape attributes for the shell

690

escaped_attrs = dict(

691

(attr,

692

re.escape(unicode(str(getattr(self, attr, "")),

693

errors=

694

'replace')))

695

for attr in

696

self.runtime_expansions)

697

698

try:

699

command = self.checker_command % escaped_attrs

700

except TypeError as error:

701

logger.error('Could not format string "%s"',

702

self.checker_command, exc_info=error)

703

return True # Try again later

705

704

self.current_checker_command = command

706

705

try:

707

706

logger.info("Starting checker %r for %s",

713

712

self.checker = subprocess.Popen(command,

714

713

close_fds=True,

715

714

shell=True, cwd="/")

715

self.checker_callback_tag = (gobject.child_watch_add

716

(self.checker.pid,

717

self.checker_callback,

718

data=command))

719

# The checker may have completed before the gobject

720

# watch was added. Check for this.

721

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

722

if pid:

723

gobject.source_remove(self.checker_callback_tag)

724

self.checker_callback(pid, status, command)

716

725

except OSError as error:

717

726

logger.error("Failed to start subprocess",

718

727

exc_info=error)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

729

728

# Re-run this periodically if run by gobject.timeout_add

730

729

return True

731

730

1016

1015

return xmlstring

1017

1016

1018

1017

1019

def datetime_to_dbus(dt, variant_level=0):

1018

def datetime_to_dbus (dt, variant_level=0):

1020

1019

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1021

1020

if dt is None:

1022

1021

return dbus.String("", variant_level = variant_level)

1030

1029

interface names according to the "alt_interface_names" mapping.

1031

1030

Usage:

1032

1031

1033

@alternate_dbus_interfaces({"org.example.Interface":

1034

"net.example.AlternateInterface"})

1032

@alternate_dbus_names({"org.example.Interface":

1033

"net.example.AlternateInterface"})

1035

1034

class SampleDBusObject(dbus.service.Object):

1036

1035

@dbus.service.method("org.example.Interface")

1037

1036

def SampleDBusMethod():

1336

1335

return False

1337

1336

1338

1337

def approve(self, value=True):

1338

self.send_changedstate()

1339

self.approved = value

1340

gobject.timeout_add(timedelta_to_milliseconds

1341

(self.approval_duration),

1342

self._reset_approved)

1343

self.send_changedstate()

1344

1343

1345

1344

## D-Bus methods, signals & properties

1346

1345

_interface = "se.recompile.Mandos.Client"

1530

1529

def Timeout_dbus_property(self, value=None):

1531

1530

if value is None: # get

1532

1531

return dbus.UInt64(self.timeout_milliseconds())

1533

old_timeout = self.timeout

1534

1532

self.timeout = datetime.timedelta(0, 0, 0, value)

1535

# Reschedule disabling

1533

# Reschedule timeout

1536

1534

if self.enabled:

1537

1535

now = datetime.datetime.utcnow()

1538

self.expires += self.timeout - old_timeout

1539

if self.expires <= now:

1536

time_to_die = timedelta_to_milliseconds(

1537

(self.last_checked_ok + self.timeout) - now)

1538

if time_to_die <= 0:

1540

1539

# The timeout has passed

1541

1540

self.disable()

1542

1541

else:

1542

self.expires = (now +

1543

datetime.timedelta(milliseconds =

1544

time_to_die))

1543

1545

if (getattr(self, "disable_initiator_tag", None)

1544

1546

is None):

1545

1547

return

1546

1548

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1549

self.disable_initiator_tag = (gobject.timeout_add

1550

(time_to_die,

1551

self.disable))

1551

1552

1553

# ExtendedTimeout - property

1553

1554

@dbus_service_property(_interface, signature="t",

1741

1742

#wait until timeout or approved

1742

1743

time = datetime.datetime.now()

1743

1744

client.changedstate.acquire()

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1745

(client.changedstate.wait

1746

(float(client.timedelta_to_milliseconds(delay)

1747

/ 1000)))

1747

1748

client.changedstate.release()

1748

1749

time2 = datetime.datetime.now()

1749

1750

if (time2 - time) >= delay:

1899

1900

use_ipv6: Boolean; to use IPv6 or not

1900

1901

"""

1901

1902

def __init__(self, server_address, RequestHandlerClass,

1902

interface=None, use_ipv6=True, socketfd=None):

1903

"""If socketfd is set, use that file descriptor instead of

1904

creating a new one with socket.socket().

1905

"""

1903

interface=None, use_ipv6=True):

1906

1904

self.interface = interface

1907

1905

if use_ipv6:

1908

1906

self.address_family = socket.AF_INET6

1909

if socketfd is not None:

1910

# Save the file descriptor

1911

self.socketfd = socketfd

1912

# Save the original socket.socket() function

1913

self.socket_socket = socket.socket

1914

# To implement --socket, we monkey patch socket.socket.

1915

#

1916

# (When socketserver.TCPServer is a new-style class, we

1917

# could make self.socket into a property instead of monkey

1918

# patching socket.socket.)

1919

#

1920

# Create a one-time-only replacement for socket.socket()

1921

@functools.wraps(socket.socket)

1922

def socket_wrapper(*args, **kwargs):

1923

# Restore original function so subsequent calls are

1924

# not affected.

1925

socket.socket = self.socket_socket

1926

del self.socket_socket

1927

# This time only, return a new socket object from the

1928

# saved file descriptor.

1929

return socket.fromfd(self.socketfd, *args, **kwargs)

1930

# Replace socket.socket() function with wrapper

1931

socket.socket = socket_wrapper

1932

# The socketserver.TCPServer.__init__ will call

1933

# socket.socket(), which might be our replacement,

1934

# socket_wrapper(), if socketfd was set.

1935

1907

socketserver.TCPServer.__init__(self, server_address,

1936

1908

RequestHandlerClass)

1937

1938

1909

def server_bind(self):

1939

1910

"""This overrides the normal server_bind() function

1940

1911

to bind to an interface if one was specified, and also NOT to

1951

1922

str(self.interface

1952

1923

+ '\0'))

1953

1924

except socket.error as error:

1954

if error.errno == errno.EPERM:

1925

if error[0] == errno.EPERM:

1955

1926

logger.error("No permission to"

1956

1927

" bind to interface %s",

1957

1928

self.interface)

1958

elif error.errno == errno.ENOPROTOOPT:

1929

elif error[0] == errno.ENOPROTOOPT:

1959

1930

logger.error("SO_BINDTODEVICE not available;"

1960

1931

" cannot bind to interface %s",

1961

1932

self.interface)

1962

elif error.errno == errno.ENODEV:

1963

logger.error("Interface %s does not"

1964

" exist, cannot bind",

1965

self.interface)

1966

1933

else:

1967

1934

raise

1968

1935

# Only bind(2) the socket if we really need to.

1998

1965

"""

1999

1966

def __init__(self, server_address, RequestHandlerClass,

2000

1967

interface=None, use_ipv6=True, clients=None,

2001

gnutls_priority=None, use_dbus=True, socketfd=None):

1968

gnutls_priority=None, use_dbus=True):

2002

1969

self.enabled = False

2003

1970

self.clients = clients

2004

1971

if self.clients is None:

2008

1975

IPv6_TCPServer.__init__(self, server_address,

2009

1976

RequestHandlerClass,

2010

1977

interface = interface,

2011

use_ipv6 = use_ipv6,

2012

socketfd = socketfd)

1978

use_ipv6 = use_ipv6)

2013

1979

def server_activate(self):

2014

1980

if self.enabled:

2015

1981

return socketserver.TCPServer.server_activate(self)

2196

2162

parser.add_argument("--no-restore", action="store_false",

2197

2163

dest="restore", help="Do not restore stored"

2198

2164

" state")

2199

parser.add_argument("--socket", type=int,

2200

help="Specify a file descriptor to a network"

2201

" socket to use instead of creating one")

2202

2165

parser.add_argument("--statedir", metavar="DIR",

2203

2166

help="Directory to save/restore state in")

2204

2167

2221

2184

"use_ipv6": "True",

2222

2185

"debuglevel": "",

2223

2186

"restore": "True",

2224

"socket": "",

2225

2187

"statedir": "/var/lib/mandos"

2226

2188

}

2227

2189

2239

2201

if server_settings["port"]:

2240

2202

server_settings["port"] = server_config.getint("DEFAULT",

2241

2203

"port")

2242

if server_settings["socket"]:

2243

server_settings["socket"] = server_config.getint("DEFAULT",

2244

"socket")

2245

# Later, stdin will, and stdout and stderr might, be dup'ed

2246

# over with an opened os.devnull. But we don't want this to

2247

# happen with a supplied network socket.

2248

if 0 <= server_settings["socket"] <= 2:

2249

server_settings["socket"] = os.dup(server_settings

2250

["socket"])

2251

2204

del server_config

2252

2205

2253

2206

# Override the settings from the config file with command line

2255

2208

for option in ("interface", "address", "port", "debug",

2256

2209

"priority", "servicename", "configdir",

2257

2210

"use_dbus", "use_ipv6", "debuglevel", "restore",

2258

"statedir", "socket"):

2211

"statedir"):

2259

2212

value = getattr(options, option)

2260

2213

if value is not None:

2261

2214

server_settings[option] = value

2309

2262

use_ipv6=use_ipv6,

2310

2263

gnutls_priority=

2311

2264

server_settings["priority"],

2312

use_dbus=use_dbus,

2313

socketfd=(server_settings["socket"]

2314

or None))

2265

use_dbus=use_dbus)

2315

2266

if not debug:

2316

2267

pidfilename = "/var/run/mandos.pid"

2317

2268

try:

2334

2285

os.setgid(gid)

2335

2286

os.setuid(uid)

2336

2287

except OSError as error:

2337

if error.errno != errno.EPERM:

2288

if error[0] != errno.EPERM:

2338

2289

raise error

2339

2290

2340

2291

if debug:

2362

2313

# Close all input and output, do double fork, etc.

2363

2314

daemon()

2364

2315

2365

# multiprocessing will use threads, so before we use gobject we

2366

# need to inform gobject that threads will be used.

2367

2316

gobject.threads_init()

2368

2317

2369

2318

global main_loop

2510

2459

# "pidfile" was never created

2511

2460

pass

2512

2461

del pidfilename

2462

signal.signal(signal.SIGINT, signal.SIG_IGN)

2513

2463

2514

2464

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2515

2465

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())