/mandos/release : revision 237.7.20

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

import argparse

39

import optparse

42

40

import datetime

43

41

import errno

44

42

import gnutls.crypto

64

62

import functools

65

63

import cPickle as pickle

66

64

import multiprocessing

67

import types

68

import binascii

69

import tempfile

70

import itertools

71

import collections

72

65

73

66

import dbus

74

67

import dbus.service

88

81

except ImportError:

89

82

SO_BINDTODEVICE = None

90

83

91

version = "1.6.3"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

84

85

version = "1.2.3"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

95

89

syslogger = (logging.handlers.SysLogHandler

96

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

91

address = str("/dev/log")))

98

99

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

def if_nametoindex(interface):

105

"Get an interface index the hard way, i.e. using fcntl()"

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

with contextlib.closing(socket.socket()) as s:

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

113

return interface_index

114

115

116

def initlogger(debug, level=logging.WARNING):

117

"""init logger and add loglevel"""

118

119

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

132

133

134

class PGPError(Exception):

135

"""Exception if encryption/decryption fails"""

136

pass

137

138

139

class PGPEngine(object):

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

141

def __init__(self):

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

143

self.gnupgargs = ['--batch',

144

'--home', self.tempdir,

145

'--force-mdc',

146

'--quiet',

147

'--no-use-agent']

148

149

def __enter__(self):

150

return self

151

152

def __exit__(self, exc_type, exc_value, traceback):

153

self._cleanup()

154

return False

155

156

def __del__(self):

157

self._cleanup()

158

159

def _cleanup(self):

160

if self.tempdir is not None:

161

# Delete contents of tempdir

162

for root, dirs, files in os.walk(self.tempdir,

163

topdown = False):

164

for filename in files:

165

os.remove(os.path.join(root, filename))

166

for dirname in dirs:

167

os.rmdir(os.path.join(root, dirname))

168

# Remove tempdir

169

os.rmdir(self.tempdir)

170

self.tempdir = None

171

172

def password_encode(self, password):

173

# Passphrase can not be empty and can not contain newlines or

174

# NUL bytes. So we prefix it and hex encode it.

175

encoded = b"mandos" + binascii.hexlify(password)

176

if len(encoded) > 2048:

177

# GnuPG can't handle long passwords, so encode differently

178

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

179

.replace(b"\n", b"\\n")

180

.replace(b"\0", b"\\x00"))

181

return encoded

182

183

def encrypt(self, data, password):

184

passphrase = self.password_encode(password)

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

187

passfile.write(passphrase)

188

passfile.flush()

189

proc = subprocess.Popen(['gpg', '--symmetric',

190

'--passphrase-file',

191

passfile.name]

192

+ self.gnupgargs,

193

stdin = subprocess.PIPE,

194

stdout = subprocess.PIPE,

195

stderr = subprocess.PIPE)

196

ciphertext, err = proc.communicate(input = data)

197

if proc.returncode != 0:

198

raise PGPError(err)

199

return ciphertext

200

201

def decrypt(self, data, password):

202

passphrase = self.password_encode(password)

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

205

passfile.write(passphrase)

206

passfile.flush()

207

proc = subprocess.Popen(['gpg', '--decrypt',

208

'--passphrase-file',

209

passfile.name]

210

+ self.gnupgargs,

211

stdin = subprocess.PIPE,

212

stdout = subprocess.PIPE,

213

stderr = subprocess.PIPE)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

216

if proc.returncode != 0:

217

raise PGPError(err)

218

return decrypted_plaintext

219

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

220

102

221

103

class AvahiError(Exception):

222

104

def __init__(self, value, *args, **kwargs):

240

122

Used to optionally bind to the specified interface.

241

123

name: string; Example: 'Mandos'

242

124

type: string; Example: '_mandos._tcp'.

243

See <https://www.iana.org/assignments/service-names-port-numbers>

125

See <http://www.dns-sd.org/ServiceTypes.html>

244

126

port: integer; what port to announce

245

127

TXT: list of strings; TXT record for the service

246

128

domain: string; Domain to publish on, default to .local if empty.

252

134

server: D-Bus Server

253

135

bus: dbus.SystemBus()

254

136

"""

255

256

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

138

servicetype = None, port = None, TXT = None,

258

139

domain = "", host = "", max_renames = 32768,

270

151

self.group = None # our entry group

271

152

self.server = None

272

153

self.bus = bus

273

self.entry_group_state_changed_match = None

274

275

154

def rename(self):

276

155

"""Derived from the Avahi example code"""

277

156

if self.rename_count >= self.max_renames:

279

158

" after %i retries, exiting.",

280

159

self.rename_count)

281

160

raise AvahiServiceError("Too many renames")

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

161

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

284

162

logger.info("Changing Zeroconf service name to %r ...",

285

163

self.name)

164

syslogger.setFormatter(logging.Formatter

165

('Mandos (%s) [%%(process)d]:'

166

' %%(levelname)s: %%(message)s'

167

% self.name))

286

168

self.remove()

287

169

try:

288

170

self.add()

289

except dbus.exceptions.DBusException as error:

290

logger.critical("D-Bus Exception", exc_info=error)

171

except dbus.exceptions.DBusException, error:

172

logger.critical("DBusException: %s", error)

291

173

self.cleanup()

292

174

os._exit(1)

293

175

self.rename_count += 1

294

295

176

def remove(self):

296

177

"""Derived from the Avahi example code"""

297

if self.entry_group_state_changed_match is not None:

298

self.entry_group_state_changed_match.remove()

299

self.entry_group_state_changed_match = None

300

178

if self.group is not None:

301

179

self.group.Reset()

302

303

180

def add(self):

304

181

"""Derived from the Avahi example code"""

305

self.remove()

306

182

if self.group is None:

307

183

self.group = dbus.Interface(

308

184

self.bus.get_object(avahi.DBUS_NAME,

309

185

self.server.EntryGroupNew()),

310

186

avahi.DBUS_INTERFACE_ENTRY_GROUP)

311

self.entry_group_state_changed_match = (

312

self.group.connect_to_signal(

313

'StateChanged', self.entry_group_state_changed))

187

self.group.connect_to_signal('StateChanged',

188

self

189

.entry_group_state_changed)

314

190

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

315

191

self.name, self.type)

316

192

self.group.AddService(

322

198

dbus.UInt16(self.port),

323

199

avahi.string_array_to_txt_array(self.TXT))

324

200

self.group.Commit()

325

326

201

def entry_group_state_changed(self, state, error):

327

202

"""Derived from the Avahi example code"""

328

203

logger.debug("Avahi entry group state change: %i", state)

335

210

elif state == avahi.ENTRY_GROUP_FAILURE:

336

211

logger.critical("Avahi: Error in group state changed %s",

337

212

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

340

213

raise AvahiGroupError("State changed: %s"

214

% unicode(error))

341

215

def cleanup(self):

342

216

"""Derived from the Avahi example code"""

343

217

if self.group is not None:

344

try:

345

self.group.Free()

346

except (dbus.exceptions.UnknownMethodException,

347

dbus.exceptions.DBusException):

348

pass

218

self.group.Free()

349

219

self.group = None

350

self.remove()

351

352

def server_state_changed(self, state, error=None):

220

def server_state_changed(self, state):

353

221

"""Derived from the Avahi example code"""

354

222

logger.debug("Avahi server state change: %i", state)

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

362

if state in bad_states:

363

if bad_states[state] is not None:

364

if error is None:

365

logger.error(bad_states[state])

366

else:

367

logger.error(bad_states[state] + ": %r", error)

368

self.cleanup()

223

if state == avahi.SERVER_COLLISION:

224

logger.error("Zeroconf server name collision")

225

self.remove()

369

226

elif state == avahi.SERVER_RUNNING:

370

227

self.add()

371

else:

372

if error is None:

373

logger.debug("Unknown state: %r", state)

374

else:

375

logger.debug("Unknown state: %r: %r", state, error)

376

377

228

def activate(self):

378

229

"""Derived from the Avahi example code"""

379

230

if self.server is None:

380

231

self.server = dbus.Interface(

381

232

self.bus.get_object(avahi.DBUS_NAME,

382

avahi.DBUS_PATH_SERVER,

383

follow_name_owner_changes=True),

233

avahi.DBUS_PATH_SERVER),

384

234

avahi.DBUS_INTERFACE_SERVER)

385

235

self.server.connect_to_signal("StateChanged",

386

236

self.server_state_changed)

387

237

self.server_state_changed(self.server.GetState())

388

238

389

239

390

class AvahiServiceToSyslog(AvahiService):

391

def rename(self):

392

"""Add the new name to the syslog messages"""

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

398

return ret

399

400

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

407

408

240

class Client(object):

409

241

"""A representation of a client host served by this server.

410

242

411

243

Attributes:

412

approved: bool(); 'None' if not yet approved/disapproved

244

_approved: bool(); 'None' if not yet approved/disapproved

413

245

approval_delay: datetime.timedelta(); Time to wait for approval

414

246

approval_duration: datetime.timedelta(); Duration of one approval

415

247

checker: subprocess.Popen(); a running checker process used

422

254

instance %(name)s can be used in the command.

423

255

checker_initiator_tag: a gobject event source tag, or None

424

256

created: datetime.datetime(); (UTC) object creation

425

client_structure: Object describing what attributes a client has

426

and is used for storing the client at exit

427

257

current_checker_command: string; current running checker_command

258

disable_hook: If set, called by disable() as disable_hook(self)

428

259

disable_initiator_tag: a gobject event source tag, or None

429

260

enabled: bool()

430

261

fingerprint: string (40 or 32 hexadecimal digits); used to

433

264

interval: datetime.timedelta(); How often to start a new checker

434

265

last_approval_request: datetime.datetime(); (UTC) or None

435

266

last_checked_ok: datetime.datetime(); (UTC) or None

436

last_checker_status: integer between 0 and 255 reflecting exit

437

status of last checker. -1 reflects crashed

438

checker, -2 means no checker completed yet.

439

last_enabled: datetime.datetime(); (UTC) or None

267

last_enabled: datetime.datetime(); (UTC)

440

268

name: string; from the config file, used in log messages and

441

269

D-Bus identifiers

442

270

secret: bytestring; sent verbatim (over TLS) to client

443

271

timeout: datetime.timedelta(); How long from last_checked_ok

444

272

until this client is disabled

445

extended_timeout: extra long timeout when secret has been sent

446

273

runtime_expansions: Allowed attributes for runtime expansion.

447

expires: datetime.datetime(); time (UTC) when a client will be

448

disabled, or None

449

server_settings: The server_settings dict from main()

450

274

"""

451

275

452

276

runtime_expansions = ("approval_delay", "approval_duration",

453

"created", "enabled", "expires",

454

"fingerprint", "host", "interval",

455

"last_approval_request", "last_checked_ok",

277

"created", "enabled", "fingerprint",

278

"host", "interval", "last_checked_ok",

456

279

"last_enabled", "name", "timeout")

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

280

281

@staticmethod

282

def _timedelta_to_milliseconds(td):

283

"Convert a datetime.timedelta() to milliseconds"

284

return ((td.days * 24 * 60 * 60 * 1000)

285

+ (td.seconds * 1000)

286

+ (td.microseconds // 1000))

467

287

468

288

def timeout_milliseconds(self):

469

289

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

290

return self._timedelta_to_milliseconds(self.timeout)

475

291

476

292

def interval_milliseconds(self):

477

293

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

294

return self._timedelta_to_milliseconds(self.interval)

295

480

296

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

482

483

@staticmethod

484

def config_parser(config):

485

"""Construct a new dict of client settings of this form:

486

{ client_name: {setting_name: value, ...}, ...}

487

with exceptions for any special settings as defined above.

488

NOTE: Must be a pure function. Must return the same result

489

value given the same arguments.

490

"""

491

settings = {}

492

for client_name in config.sections():

493

section = dict(config.items(client_name))

494

client = settings[client_name] = {}

495

496

client["host"] = section["host"]

497

# Reformat values from string types to Python types

498

client["approved_by_default"] = config.getboolean(

499

client_name, "approved_by_default")

500

client["enabled"] = config.getboolean(client_name,

501

"enabled")

502

503

client["fingerprint"] = (section["fingerprint"].upper()

504

.replace(" ", ""))

505

if "secret" in section:

506

client["secret"] = section["secret"].decode("base64")

507

elif "secfile" in section:

508

with open(os.path.expanduser(os.path.expandvars

509

(section["secfile"])),

510

"rb") as secfile:

511

client["secret"] = secfile.read()

512

else:

513

raise TypeError("No secret or secfile for section {0}"

514

.format(section))

515

client["timeout"] = string_to_delta(section["timeout"])

516

client["extended_timeout"] = string_to_delta(

517

section["extended_timeout"])

518

client["interval"] = string_to_delta(section["interval"])

519

client["approval_delay"] = string_to_delta(

520

section["approval_delay"])

521

client["approval_duration"] = string_to_delta(

522

section["approval_duration"])

523

client["checker_command"] = section["checker"]

524

client["last_approval_request"] = None

525

client["last_checked_ok"] = None

526

client["last_checker_status"] = -2

527

528

return settings

529

530

def __init__(self, settings, name = None, server_settings=None):

297

return self._timedelta_to_milliseconds(self.approval_delay)

298

299

def __init__(self, name = None, disable_hook=None, config=None):

300

"""Note: the 'checker' key in 'config' sets the

301

'checker_command' attribute and *not* the 'checker'

302

attribute."""

531

303

self.name = name

532

if server_settings is None:

533

server_settings = {}

534

self.server_settings = server_settings

535

# adding all client settings

536

for setting, value in settings.iteritems():

537

setattr(self, setting, value)

538

539

if self.enabled:

540

if not hasattr(self, "last_enabled"):

541

self.last_enabled = datetime.datetime.utcnow()

542

if not hasattr(self, "expires"):

543

self.expires = (datetime.datetime.utcnow()

544

+ self.timeout)

545

else:

546

self.last_enabled = None

547

self.expires = None

548

304

if config is None:

305

config = {}

549

306

logger.debug("Creating client %r", self.name)

550

307

# Uppercase and remove spaces from fingerprint for later

551

308

# comparison purposes with return value from the fingerprint()

552

309

# function

310

self.fingerprint = (config["fingerprint"].upper()

311

.replace(" ", ""))

553

312

logger.debug(" Fingerprint: %s", self.fingerprint)

554

self.created = settings.get("created",

555

datetime.datetime.utcnow())

556

557

# attributes specific for this server instance

313

if "secret" in config:

314

self.secret = config["secret"].decode("base64")

315

elif "secfile" in config:

316

with open(os.path.expanduser(os.path.expandvars

317

(config["secfile"])),

318

"rb") as secfile:

319

self.secret = secfile.read()

320

else:

321

raise TypeError("No secret or secfile for client %s"

322

% self.name)

323

self.host = config.get("host", "")

324

self.created = datetime.datetime.utcnow()

325

self.enabled = False

326

self.last_approval_request = None

327

self.last_enabled = None

328

self.last_checked_ok = None

329

self.timeout = string_to_delta(config["timeout"])

330

self.interval = string_to_delta(config["interval"])

331

self.disable_hook = disable_hook

558

332

self.checker = None

559

333

self.checker_initiator_tag = None

560

334

self.disable_initiator_tag = None

561

335

self.checker_callback_tag = None

336

self.checker_command = config["checker"]

562

337

self.current_checker_command = None

563

self.approved = None

338

self.last_connect = None

339

self._approved = None

340

self.approved_by_default = config.get("approved_by_default",

341

True)

564

342

self.approvals_pending = 0

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

570

if not attr.startswith("_")]

571

self.client_structure.append("client_structure")

572

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

577

if not name.startswith("_"):

578

self.client_structure.append(name)

343

self.approval_delay = string_to_delta(

344

config["approval_delay"])

345

self.approval_duration = string_to_delta(

346

config["approval_duration"])

347

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

579

348

580

# Send notice to process children that client state has changed

581

349

def send_changedstate(self):

582

with self.changedstate:

583

self.changedstate.notify_all()

584

350

self.changedstate.acquire()

351

self.changedstate.notify_all()

352

self.changedstate.release()

353

585

354

def enable(self):

586

355

"""Start this client's checker and timeout hooks"""

587

356

if getattr(self, "enabled", False):

588

357

# Already enabled

589

358

return

590

self.expires = datetime.datetime.utcnow() + self.timeout

591

self.enabled = True

359

self.send_changedstate()

592

360

self.last_enabled = datetime.datetime.utcnow()

593

self.init_checker()

594

self.send_changedstate()

595

596

def disable(self, quiet=True):

597

"""Disable this client."""

598

if not getattr(self, "enabled", False):

599

return False

600

if not quiet:

601

logger.info("Disabling client %s", self.name)

602

if getattr(self, "disable_initiator_tag", None) is not None:

603

gobject.source_remove(self.disable_initiator_tag)

604

self.disable_initiator_tag = None

605

self.expires = None

606

if getattr(self, "checker_initiator_tag", None) is not None:

607

gobject.source_remove(self.checker_initiator_tag)

608

self.checker_initiator_tag = None

609

self.stop_checker()

610

self.enabled = False

611

if not quiet:

612

self.send_changedstate()

613

# Do not run this again if called by a gobject.timeout_add

614

return False

615

616

def __del__(self):

617

self.disable()

618

619

def init_checker(self):

620

361

# Schedule a new checker to be started an 'interval' from now,

621

362

# and every interval from then on.

622

if self.checker_initiator_tag is not None:

623

gobject.source_remove(self.checker_initiator_tag)

624

363

self.checker_initiator_tag = (gobject.timeout_add

625

364

(self.interval_milliseconds(),

626

365

self.start_checker))

627

366

# Schedule a disable() when 'timeout' has passed

628

if self.disable_initiator_tag is not None:

629

gobject.source_remove(self.disable_initiator_tag)

630

367

self.disable_initiator_tag = (gobject.timeout_add

631

368

(self.timeout_milliseconds(),

632

369

self.disable))

370

self.enabled = True

633

371

# Also start a new checker *right now*.

634

372

self.start_checker()

635

373

374

def disable(self, quiet=True):

375

"""Disable this client."""

376

if not getattr(self, "enabled", False):

377

return False

378

if not quiet:

379

self.send_changedstate()

380

if not quiet:

381

logger.info("Disabling client %s", self.name)

382

if getattr(self, "disable_initiator_tag", False):

383

gobject.source_remove(self.disable_initiator_tag)

384

self.disable_initiator_tag = None

385

if getattr(self, "checker_initiator_tag", False):

386

gobject.source_remove(self.checker_initiator_tag)

387

self.checker_initiator_tag = None

388

self.stop_checker()

389

if self.disable_hook:

390

self.disable_hook(self)

391

self.enabled = False

392

# Do not run this again if called by a gobject.timeout_add

393

return False

394

395

def __del__(self):

396

self.disable_hook = None

397

self.disable()

398

636

399

def checker_callback(self, pid, condition, command):

637

400

"""The checker has completed, so take appropriate actions."""

638

401

self.checker_callback_tag = None

639

402

self.checker = None

640

403

if os.WIFEXITED(condition):

641

self.last_checker_status = os.WEXITSTATUS(condition)

642

if self.last_checker_status == 0:

404

exitstatus = os.WEXITSTATUS(condition)

405

if exitstatus == 0:

643

406

logger.info("Checker for %(name)s succeeded",

644

407

vars(self))

645

408

self.checked_ok()

647

410

logger.info("Checker for %(name)s failed",

648

411

vars(self))

649

412

else:

650

self.last_checker_status = -1

651

413

logger.warning("Checker for %(name)s crashed?",

652

414

vars(self))

653

415

654

416

def checked_ok(self):

655

"""Assert that the client has been seen, alive and well."""

417

"""Bump up the timeout for this client.

418

419

This should only be called when the client has been seen,

420

alive and well.

421

"""

656

422

self.last_checked_ok = datetime.datetime.utcnow()

657

self.last_checker_status = 0

658

self.bump_timeout()

659

660

def bump_timeout(self, timeout=None):

661

"""Bump up the timeout for this client."""

662

if timeout is None:

663

timeout = self.timeout

664

if self.disable_initiator_tag is not None:

665

gobject.source_remove(self.disable_initiator_tag)

666

self.disable_initiator_tag = None

667

if getattr(self, "enabled", False):

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

671

self.expires = datetime.datetime.utcnow() + timeout

423

gobject.source_remove(self.disable_initiator_tag)

424

self.disable_initiator_tag = (gobject.timeout_add

425

(self.timeout_milliseconds(),

426

self.disable))

672

427

673

428

def need_approval(self):

674

429

self.last_approval_request = datetime.datetime.utcnow()

679

434

If a checker already exists, leave it running and do

680

435

nothing."""

681

436

# The reason for not killing a running checker is that if we

682

# did that, and if a checker (for some reason) started running

683

# slowly and taking more than 'interval' time, then the client

684

# would inevitably timeout, since no checker would get a

685

# chance to run to completion. If we instead leave running

437

# did that, then if a checker (for some reason) started

438

# running slowly and taking more than 'interval' time, the

439

# client would inevitably timeout, since no checker would get

440

# a chance to run to completion. If we instead leave running

686

441

# checkers alone, the checker would have to take more time

687

442

# than 'timeout' for the client to be disabled, which is as it

688

443

# should be.

690

445

# If a checker exists, make sure it is not a zombie

691

446

try:

692

447

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

448

except (AttributeError, OSError), error:

449

if (isinstance(error, OSError)

450

and error.errno != errno.ECHILD):

451

raise error

698

452

else:

699

453

if pid:

700

454

logger.warning("Checker was a zombie")

703

457

self.current_checker_command)

704

458

# Start a new checker if needed

705

459

if self.checker is None:

706

# Escape attributes for the shell

707

escaped_attrs = dict(

708

(attr, re.escape(unicode(getattr(self, attr))))

709

for attr in

710

self.runtime_expansions)

711

460

try:

712

command = self.checker_command % escaped_attrs

713

except TypeError as error:

714

logger.error('Could not format string "%s"',

715

self.checker_command, exc_info=error)

716

return True # Try again later

461

# In case checker_command has exactly one % operator

462

command = self.checker_command % self.host

463

except TypeError:

464

# Escape attributes for the shell

465

escaped_attrs = dict(

466

(attr,

467

re.escape(unicode(str(getattr(self, attr, "")),

468

errors=

469

'replace')))

470

for attr in

471

self.runtime_expansions)

472

473

try:

474

command = self.checker_command % escaped_attrs

475

except TypeError, error:

476

logger.error('Could not format string "%s":'

477

' %s', self.checker_command, error)

478

return True # Try again later

717

479

self.current_checker_command = command

718

480

try:

719

481

logger.info("Starting checker %r for %s",

722

484

# in normal mode, that is already done by daemon(),

723

485

# and in debug mode we don't want to. (Stdin is

724

486

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

487

self.checker = subprocess.Popen(command,

734

488

close_fds=True,

735

shell=True, cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

739

exc_info=error)

740

return True

741

self.checker_callback_tag = (gobject.child_watch_add

742

(self.checker.pid,

743

self.checker_callback,

744

data=command))

745

# The checker may have completed before the gobject

746

# watch was added. Check for this.

747

try:

489

shell=True, cwd="/")

490

self.checker_callback_tag = (gobject.child_watch_add

491

(self.checker.pid,

492

self.checker_callback,

493

data=command))

494

# The checker may have completed before the gobject

495

# watch was added. Check for this.

748

496

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

749

except OSError as error:

750

if error.errno == errno.ECHILD:

751

# This should never happen

752

logger.error("Child process vanished",

753

exc_info=error)

754

return True

755

raise

756

if pid:

757

gobject.source_remove(self.checker_callback_tag)

758

self.checker_callback(pid, status, command)

497

if pid:

498

gobject.source_remove(self.checker_callback_tag)

499

self.checker_callback(pid, status, command)

500

except OSError, error:

501

logger.error("Failed to start subprocess: %s",

502

error)

759

503

# Re-run this periodically if run by gobject.timeout_add

760

504

return True

761

505

768

512

return

769

513

logger.debug("Stopping checker for %(name)s", vars(self))

770

514

try:

771

self.checker.terminate()

515

os.kill(self.checker.pid, signal.SIGTERM)

772

516

#time.sleep(0.5)

773

517

#if self.checker.poll() is None:

774

# self.checker.kill()

775

except OSError as error:

518

# os.kill(self.checker.pid, signal.SIGKILL)

519

except OSError, error:

776

520

if error.errno != errno.ESRCH: # No such process

777

521

raise

778

522

self.checker = None

779

523

780

781

524

def dbus_service_property(dbus_interface, signature="v",

782

525

access="readwrite", byte_arrays=False):

783

526

"""Decorators for marking methods of a DBusObjectWithProperties to

794

537

# "Set" method, so we fail early here:

795

538

if byte_arrays and signature != "ay":

796

539

raise ValueError("Byte arrays not supported for non-'ay'"

797

" signature {0!r}".format(signature))

540

" signature %r" % signature)

798

541

def decorator(func):

799

542

func._dbus_is_property = True

800

543

func._dbus_interface = dbus_interface

808

551

return decorator

809

552

810

553

811

def dbus_interface_annotations(dbus_interface):

812

"""Decorator for marking functions returning interface annotations

813

814

Usage:

815

816

@dbus_interface_annotations("org.example.Interface")

817

def _foo(self): # Function name does not matter

818

return {"org.freedesktop.DBus.Deprecated": "true",

819

"org.freedesktop.DBus.Property.EmitsChangedSignal":

820

"false"}

821

"""

822

def decorator(func):

823

func._dbus_is_interface = True

824

func._dbus_interface = dbus_interface

825

func._dbus_name = dbus_interface

826

return func

827

return decorator

828

829

830

def dbus_annotations(annotations):

831

"""Decorator to annotate D-Bus methods, signals or properties

832

Usage:

833

834

@dbus_service_property("org.example.Interface", signature="b",

835

access="r")

836

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

837

"org.freedesktop.DBus.Property."

838

"EmitsChangedSignal": "false"})

839

def Property_dbus_property(self):

840

return dbus.Boolean(False)

841

"""

842

def decorator(func):

843

func._dbus_annotations = annotations

844

return func

845

return decorator

846

847

848

554

class DBusPropertyException(dbus.exceptions.DBusException):

849

555

"""A base class for D-Bus property-related exceptions

850

556

"""

866

572

867

573

class DBusObjectWithProperties(dbus.service.Object):

868

574

"""A D-Bus object with properties.

869

575

870

576

Classes inheriting from this can use the dbus_service_property

871

577

decorator to expose methods as D-Bus properties. It exposes the

872

578

standard Get(), Set(), and GetAll() methods on the D-Bus.

873

579

"""

874

580

875

581

@staticmethod

876

def _is_dbus_thing(thing):

877

"""Returns a function testing if an attribute is a D-Bus thing

878

879

If called like _is_dbus_thing("method") it returns a function

880

suitable for use as predicate to inspect.getmembers().

881

"""

882

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

883

False)

582

def _is_dbus_property(obj):

583

return getattr(obj, "_dbus_is_property", False)

884

584

885

def _get_all_dbus_things(self, thing):

585

def _get_all_dbus_properties(self):

886

586

"""Returns a generator of (name, attribute) pairs

887

587

"""

888

return ((getattr(athing.__get__(self), "_dbus_name",

889

name),

890

athing.__get__(self))

891

for cls in self.__class__.__mro__

892

for name, athing in

893

inspect.getmembers(cls,

894

self._is_dbus_thing(thing)))

588

return ((prop._dbus_name, prop)

589

for name, prop in

590

inspect.getmembers(self, self._is_dbus_property))

895

591

896

592

def _get_dbus_property(self, interface_name, property_name):

897

593

"""Returns a bound method if one exists which is a D-Bus

898

594

property with the specified name and interface.

899

595

"""

900

for cls in self.__class__.__mro__:

901

for name, value in (inspect.getmembers

902

(cls,

903

self._is_dbus_thing("property"))):

904

if (value._dbus_name == property_name

905

and value._dbus_interface == interface_name):

906

return value.__get__(self)

907

596

for name in (property_name,

597

property_name + "_dbus_property"):

598

prop = getattr(self, name, None)

599

if (prop is None

600

or not self._is_dbus_property(prop)

601

or prop._dbus_name != property_name

602

or (interface_name and prop._dbus_interface

603

and interface_name != prop._dbus_interface)):

604

continue

605

return prop

908

606

# No such property

909

607

raise DBusPropertyNotFound(self.dbus_object_path + ":"

910

608

+ interface_name + "."

934

632

# The byte_arrays option is not supported yet on

935

633

# signatures other than "ay".

936

634

if prop._dbus_signature != "ay":

937

raise ValueError("Byte arrays not supported for non-"

938

"'ay' signature {0!r}"

939

.format(prop._dbus_signature))

940

value = dbus.ByteArray(b''.join(chr(byte)

941

for byte in value))

635

raise ValueError

636

value = dbus.ByteArray(''.join(unichr(byte)

637

for byte in value))

942

638

prop(value)

943

639

944

640

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

946

642

def GetAll(self, interface_name):

947

643

"""Standard D-Bus property GetAll() method, see D-Bus

948

644

standard.

949

645

950

646

Note: Will not include properties with access="write".

951

647

"""

952

properties = {}

953

for name, prop in self._get_all_dbus_things("property"):

648

all = {}

649

for name, prop in self._get_all_dbus_properties():

954

650

if (interface_name

955

651

and interface_name != prop._dbus_interface):

956

652

# Interface non-empty but did not match

960

656

continue

961

657

value = prop()

962

658

if not hasattr(value, "variant_level"):

963

properties[name] = value

659

all[name] = value

964

660

continue

965

properties[name] = type(value)(value, variant_level=

966

value.variant_level+1)

967

return dbus.Dictionary(properties, signature="sv")

661

all[name] = type(value)(value, variant_level=

662

value.variant_level+1)

663

return dbus.Dictionary(all, signature="sv")

968

664

969

665

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

970

666

out_signature="s",

971

667

path_keyword='object_path',

972

668

connection_keyword='connection')

973

669

def Introspect(self, object_path, connection):

974

"""Overloading of standard D-Bus method.

975

976

Inserts property tags and interface annotation tags.

670

"""Standard D-Bus method, overloaded to insert property tags.

977

671

"""

978

672

xmlstring = dbus.service.Object.Introspect(self, object_path,

979

673

connection)

986

680

e.setAttribute("access", prop._dbus_access)

987

681

return e

988

682

for if_tag in document.getElementsByTagName("interface"):

989

# Add property tags

990

683

for tag in (make_tag(document, name, prop)

991

684

for name, prop

992

in self._get_all_dbus_things("property")

685

in self._get_all_dbus_properties()

993

686

if prop._dbus_interface

994

687

== if_tag.getAttribute("name")):

995

688

if_tag.appendChild(tag)

996

# Add annotation tags

997

for typ in ("method", "signal", "property"):

998

for tag in if_tag.getElementsByTagName(typ):

999

annots = dict()

1000

for name, prop in (self.

1001

_get_all_dbus_things(typ)):

1002

if (name == tag.getAttribute("name")

1003

and prop._dbus_interface

1004

== if_tag.getAttribute("name")):

1005

annots.update(getattr

1006

(prop,

1007

"_dbus_annotations",

1008

{}))

1009

for name, value in annots.iteritems():

1010

ann_tag = document.createElement(

1011

"annotation")

1012

ann_tag.setAttribute("name", name)

1013

ann_tag.setAttribute("value", value)

1014

tag.appendChild(ann_tag)

1015

# Add interface annotation tags

1016

for annotation, value in dict(

1017

itertools.chain.from_iterable(

1018

annotations().iteritems()

1019

for name, annotations in

1020

self._get_all_dbus_things("interface")

1021

if name == if_tag.getAttribute("name")

1022

)).iteritems():

1023

ann_tag = document.createElement("annotation")

1024

ann_tag.setAttribute("name", annotation)

1025

ann_tag.setAttribute("value", value)

1026

if_tag.appendChild(ann_tag)

1027

689

# Add the names to the return values for the

1028

690

# "org.freedesktop.DBus.Properties" methods

1029

691

if (if_tag.getAttribute("name")

1042

704

xmlstring = document.toxml("utf-8")

1043

705

document.unlink()

1044

706

except (AttributeError, xml.dom.DOMException,

1045

xml.parsers.expat.ExpatError) as error:

707

xml.parsers.expat.ExpatError), error:

1046

708

logger.error("Failed to override Introspection method",

1047

exc_info=error)

709

error)

1048

710

return xmlstring

1049

711

1050

712

1051

def datetime_to_dbus(dt, variant_level=0):

1052

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1053

if dt is None:

1054

return dbus.String("", variant_level = variant_level)

1055

return dbus.String(dt.isoformat(),

1056

variant_level=variant_level)

1057

1058

1059

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1060

"""A class decorator; applied to a subclass of

1061

dbus.service.Object, it will add alternate D-Bus attributes with

1062

interface names according to the "alt_interface_names" mapping.

1063

Usage:

1064

1065

@alternate_dbus_interfaces({"org.example.Interface":

1066

"net.example.AlternateInterface"})

1067

class SampleDBusObject(dbus.service.Object):

1068

@dbus.service.method("org.example.Interface")

1069

def SampleDBusMethod():

1070

pass

1071

1072

The above "SampleDBusMethod" on "SampleDBusObject" will be

1073

reachable via two interfaces: "org.example.Interface" and

1074

"net.example.AlternateInterface", the latter of which will have

1075

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1076

"true", unless "deprecate" is passed with a False value.

1077

1078

This works for methods and signals, and also for D-Bus properties

1079

(from DBusObjectWithProperties) and interfaces (from the

1080

dbus_interface_annotations decorator).

1081

"""

1082

def wrapper(cls):

1083

for orig_interface_name, alt_interface_name in (

1084

alt_interface_names.iteritems()):

1085

attr = {}

1086

interface_names = set()

1087

# Go though all attributes of the class

1088

for attrname, attribute in inspect.getmembers(cls):

1089

# Ignore non-D-Bus attributes, and D-Bus attributes

1090

# with the wrong interface name

1091

if (not hasattr(attribute, "_dbus_interface")

1092

or not attribute._dbus_interface

1093

.startswith(orig_interface_name)):

1094

continue

1095

# Create an alternate D-Bus interface name based on

1096

# the current name

1097

alt_interface = (attribute._dbus_interface

1098

.replace(orig_interface_name,

1099

alt_interface_name))

1100

interface_names.add(alt_interface)

1101

# Is this a D-Bus signal?

1102

if getattr(attribute, "_dbus_is_signal", False):

1103

# Extract the original non-method undecorated

1104

# function by black magic

1105

nonmethod_func = (dict(

1106

zip(attribute.func_code.co_freevars,

1107

attribute.__closure__))["func"]

1108

.cell_contents)

1109

# Create a new, but exactly alike, function

1110

# object, and decorate it to be a new D-Bus signal

1111

# with the alternate D-Bus interface name

1112

new_function = (dbus.service.signal

1113

(alt_interface,

1114

attribute._dbus_signature)

1115

(types.FunctionType(

1116

nonmethod_func.func_code,

1117

nonmethod_func.func_globals,

1118

nonmethod_func.func_name,

1119

nonmethod_func.func_defaults,

1120

nonmethod_func.func_closure)))

1121

# Copy annotations, if any

1122

try:

1123

new_function._dbus_annotations = (

1124

dict(attribute._dbus_annotations))

1125

except AttributeError:

1126

pass

1127

# Define a creator of a function to call both the

1128

# original and alternate functions, so both the

1129

# original and alternate signals gets sent when

1130

# the function is called

1131

def fixscope(func1, func2):

1132

"""This function is a scope container to pass

1133

func1 and func2 to the "call_both" function

1134

outside of its arguments"""

1135

def call_both(*args, **kwargs):

1136

"""This function will emit two D-Bus

1137

signals by calling func1 and func2"""

1138

func1(*args, **kwargs)

1139

func2(*args, **kwargs)

1140

return call_both

1141

# Create the "call_both" function and add it to

1142

# the class

1143

attr[attrname] = fixscope(attribute, new_function)

1144

# Is this a D-Bus method?

1145

elif getattr(attribute, "_dbus_is_method", False):

1146

# Create a new, but exactly alike, function

1147

# object. Decorate it to be a new D-Bus method

1148

# with the alternate D-Bus interface name. Add it

1149

# to the class.

1150

attr[attrname] = (dbus.service.method

1151

(alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType

1155

(attribute.func_code,

1156

attribute.func_globals,

1157

attribute.func_name,

1158

attribute.func_defaults,

1159

attribute.func_closure)))

1160

# Copy annotations, if any

1161

try:

1162

attr[attrname]._dbus_annotations = (

1163

dict(attribute._dbus_annotations))

1164

except AttributeError:

1165

pass

1166

# Is this a D-Bus property?

1167

elif getattr(attribute, "_dbus_is_property", False):

1168

# Create a new, but exactly alike, function

1169

# object, and decorate it to be a new D-Bus

1170

# property with the alternate D-Bus interface

1171

# name. Add it to the class.

1172

attr[attrname] = (dbus_service_property

1173

(alt_interface,

1174

attribute._dbus_signature,

1175

attribute._dbus_access,

1176

attribute

1177

._dbus_get_args_options

1178

["byte_arrays"])

1179

(types.FunctionType

1180

(attribute.func_code,

1181

attribute.func_globals,

1182

attribute.func_name,

1183

attribute.func_defaults,

1184

attribute.func_closure)))

1185

# Copy annotations, if any

1186

try:

1187

attr[attrname]._dbus_annotations = (

1188

dict(attribute._dbus_annotations))

1189

except AttributeError:

1190

pass

1191

# Is this a D-Bus interface?

1192

elif getattr(attribute, "_dbus_is_interface", False):

1193

# Create a new, but exactly alike, function

1194

# object. Decorate it to be a new D-Bus interface

1195

# with the alternate D-Bus interface name. Add it

1196

# to the class.

1197

attr[attrname] = (dbus_interface_annotations

1198

(alt_interface)

1199

(types.FunctionType

1200

(attribute.func_code,

1201

attribute.func_globals,

1202

attribute.func_name,

1203

attribute.func_defaults,

1204

attribute.func_closure)))

1205

if deprecate:

1206

# Deprecate all alternate interfaces

1207

iname="_AlternateDBusNames_interface_annotation{0}"

1208

for interface_name in interface_names:

1209

@dbus_interface_annotations(interface_name)

1210

def func(self):

1211

return { "org.freedesktop.DBus.Deprecated":

1212

"true" }

1213

# Find an unused name

1214

for aname in (iname.format(i)

1215

for i in itertools.count()):

1216

if aname not in attr:

1217

attr[aname] = func

1218

break

1219

if interface_names:

1220

# Replace the class with a new subclass of it with

1221

# methods, signals, etc. as created above.

1222

cls = type(b"{0}Alternate".format(cls.__name__),

1223

(cls,), attr)

1224

return cls

1225

return wrapper

1226

1227

1228

@alternate_dbus_interfaces({"se.recompile.Mandos":

1229

"se.bsnet.fukt.Mandos"})

1230

713

class ClientDBus(Client, DBusObjectWithProperties):

1231

714

"""A Client class using D-Bus

1232

715

1241

724

# dbus.service.Object doesn't use super(), so we can't either.

1242

725

1243

726

def __init__(self, bus = None, *args, **kwargs):

727

self._approvals_pending = 0

1244

728

self.bus = bus

1245

729

Client.__init__(self, *args, **kwargs)

1246

730

# Only now, when this client is initialized, can it show up on

1252

736

("/clients/" + client_object_name))

1253

737

DBusObjectWithProperties.__init__(self, self.bus,

1254

738

self.dbus_object_path)

1255

1256

def notifychangeproperty(transform_func,

1257

dbus_name, type_func=lambda x: x,

1258

variant_level=1):

1259

""" Modify a variable so that it's a property which announces

1260

its changes to DBus.

1261

1262

transform_fun: Function that takes a value and a variant_level

1263

and transforms it to a D-Bus type.

1264

dbus_name: D-Bus name of the variable

1265

type_func: Function that transform the value before sending it

1266

to the D-Bus. Default: no transform

1267

variant_level: D-Bus variant level. Default: 1

1268

"""

1269

attrname = "_{0}".format(dbus_name)

1270

def setter(self, value):

1271

if hasattr(self, "dbus_object_path"):

1272

if (not hasattr(self, attrname) or

1273

type_func(getattr(self, attrname, None))

1274

!= type_func(value)):

1275

dbus_value = transform_func(type_func(value),

1276

variant_level

1277

=variant_level)

1278

self.PropertyChanged(dbus.String(dbus_name),

1279

dbus_value)

1280

setattr(self, attrname, value)

1281

1282

return property(lambda self: getattr(self, attrname), setter)

1283

1284

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1285

approvals_pending = notifychangeproperty(dbus.Boolean,

1286

"ApprovalPending",

1287

type_func = bool)

1288

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1289

last_enabled = notifychangeproperty(datetime_to_dbus,

1290

"LastEnabled")

1291

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1292

type_func = lambda checker:

1293

checker is not None)

1294

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1295

"LastCheckedOK")

1296

last_checker_status = notifychangeproperty(dbus.Int16,

1297

"LastCheckerStatus")

1298

last_approval_request = notifychangeproperty(

1299

datetime_to_dbus, "LastApprovalRequest")

1300

approved_by_default = notifychangeproperty(dbus.Boolean,

1301

"ApprovedByDefault")

1302

approval_delay = notifychangeproperty(dbus.UInt64,

1303

"ApprovalDelay",

1304

type_func =

1305

timedelta_to_milliseconds)

1306

approval_duration = notifychangeproperty(

1307

dbus.UInt64, "ApprovalDuration",

1308

type_func = timedelta_to_milliseconds)

1309

host = notifychangeproperty(dbus.String, "Host")

1310

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1311

type_func =

1312

timedelta_to_milliseconds)

1313

extended_timeout = notifychangeproperty(

1314

dbus.UInt64, "ExtendedTimeout",

1315

type_func = timedelta_to_milliseconds)

1316

interval = notifychangeproperty(dbus.UInt64,

1317

"Interval",

1318

type_func =

1319

timedelta_to_milliseconds)

1320

checker_command = notifychangeproperty(dbus.String, "Checker")

1321

1322

del notifychangeproperty

739

740

def _get_approvals_pending(self):

741

return self._approvals_pending

742

def _set_approvals_pending(self, value):

743

old_value = self._approvals_pending

744

self._approvals_pending = value

745

bval = bool(value)

746

if (hasattr(self, "dbus_object_path")

747

and bval is not bool(old_value)):

748

dbus_bool = dbus.Boolean(bval, variant_level=1)

749

self.PropertyChanged(dbus.String("ApprovalPending"),

750

dbus_bool)

751

752

approvals_pending = property(_get_approvals_pending,

753

_set_approvals_pending)

754

del _get_approvals_pending, _set_approvals_pending

755

756

@staticmethod

757

def _datetime_to_dbus(dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

return dbus.String(dt.isoformat(),

760

variant_level=variant_level)

761

762

def enable(self):

763

oldstate = getattr(self, "enabled", False)

764

r = Client.enable(self)

765

if oldstate != self.enabled:

766

# Emit D-Bus signals

767

self.PropertyChanged(dbus.String("Enabled"),

768

dbus.Boolean(True, variant_level=1))

769

self.PropertyChanged(

770

dbus.String("LastEnabled"),

771

self._datetime_to_dbus(self.last_enabled,

772

variant_level=1))

773

return r

774

775

def disable(self, quiet = False):

776

oldstate = getattr(self, "enabled", False)

777

r = Client.disable(self, quiet=quiet)

778

if not quiet and oldstate != self.enabled:

779

# Emit D-Bus signal

780

self.PropertyChanged(dbus.String("Enabled"),

781

dbus.Boolean(False, variant_level=1))

782

return r

1323

783

1324

784

def __del__(self, *args, **kwargs):

1325

785

try:

1334

794

*args, **kwargs):

1335

795

self.checker_callback_tag = None

1336

796

self.checker = None

797

# Emit D-Bus signal

798

self.PropertyChanged(dbus.String("CheckerRunning"),

799

dbus.Boolean(False, variant_level=1))

1337

800

if os.WIFEXITED(condition):

1338

801

exitstatus = os.WEXITSTATUS(condition)

1339

802

# Emit D-Bus signal

1349

812

return Client.checker_callback(self, pid, condition, command,

1350

813

*args, **kwargs)

1351

814

815

def checked_ok(self, *args, **kwargs):

816

r = Client.checked_ok(self, *args, **kwargs)

817

# Emit D-Bus signal

818

self.PropertyChanged(

819

dbus.String("LastCheckedOK"),

820

(self._datetime_to_dbus(self.last_checked_ok,

821

variant_level=1)))

822

return r

823

824

def need_approval(self, *args, **kwargs):

825

r = Client.need_approval(self, *args, **kwargs)

826

# Emit D-Bus signal

827

self.PropertyChanged(

828

dbus.String("LastApprovalRequest"),

829

(self._datetime_to_dbus(self.last_approval_request,

830

variant_level=1)))

831

return r

832

1352

833

def start_checker(self, *args, **kwargs):

1353

834

old_checker = self.checker

1354

835

if self.checker is not None:

1361

842

and old_checker_pid != self.checker.pid):

1362

843

# Emit D-Bus signal

1363

844

self.CheckerStarted(self.current_checker_command)

845

self.PropertyChanged(

846

dbus.String("CheckerRunning"),

847

dbus.Boolean(True, variant_level=1))

1364

848

return r

1365

849

850

def stop_checker(self, *args, **kwargs):

851

old_checker = getattr(self, "checker", None)

852

r = Client.stop_checker(self, *args, **kwargs)

853

if (old_checker is not None

854

and getattr(self, "checker", None) is None):

855

self.PropertyChanged(dbus.String("CheckerRunning"),

856

dbus.Boolean(False, variant_level=1))

857

return r

858

1366

859

def _reset_approved(self):

1367

self.approved = None

860

self._approved = None

1368

861

return False

1369

862

1370

863

def approve(self, value=True):

1371

self.approved = value

1372

gobject.timeout_add(timedelta_to_milliseconds

864

self.send_changedstate()

865

self._approved = value

866

gobject.timeout_add(self._timedelta_to_milliseconds

1373

867

(self.approval_duration),

1374

868

self._reset_approved)

1375

self.send_changedstate()

869

1376

870

1377

871

## D-Bus methods, signals & properties

1378

_interface = "se.recompile.Mandos.Client"

1379

1380

## Interfaces

1381

1382

@dbus_interface_annotations(_interface)

1383

def _foo(self):

1384

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1385

"false"}

872

_interface = "se.bsnet.fukt.Mandos.Client"

1386

873

1387

874

## Signals

1388

875

1435

922

# CheckedOK - method

1436

923

@dbus.service.method(_interface)

1437

924

def CheckedOK(self):

1438

self.checked_ok()

925

return self.checked_ok()

1439

926

1440

927

# Enable - method

1441

928

@dbus.service.method(_interface)

1474

961

if value is None: # get

1475

962

return dbus.Boolean(self.approved_by_default)

1476

963

self.approved_by_default = bool(value)

964

# Emit D-Bus signal

965

self.PropertyChanged(dbus.String("ApprovedByDefault"),

966

dbus.Boolean(value, variant_level=1))

1477

967

1478

968

# ApprovalDelay - property

1479

969

@dbus_service_property(_interface, signature="t",

1482

972

if value is None: # get

1483

973

return dbus.UInt64(self.approval_delay_milliseconds())

1484

974

self.approval_delay = datetime.timedelta(0, 0, 0, value)

975

# Emit D-Bus signal

976

self.PropertyChanged(dbus.String("ApprovalDelay"),

977

dbus.UInt64(value, variant_level=1))

1485

978

1486

979

# ApprovalDuration - property

1487

980

@dbus_service_property(_interface, signature="t",

1488

981

access="readwrite")

1489

982

def ApprovalDuration_dbus_property(self, value=None):

1490

983

if value is None: # get

1491

return dbus.UInt64(timedelta_to_milliseconds(

984

return dbus.UInt64(self._timedelta_to_milliseconds(

1492

985

self.approval_duration))

1493

986

self.approval_duration = datetime.timedelta(0, 0, 0, value)

987

# Emit D-Bus signal

988

self.PropertyChanged(dbus.String("ApprovalDuration"),

989

dbus.UInt64(value, variant_level=1))

1494

990

1495

991

# Name - property

1496

992

@dbus_service_property(_interface, signature="s", access="read")

1508

1004

def Host_dbus_property(self, value=None):

1509

1005

if value is None: # get

1510

1006

return dbus.String(self.host)

1511

self.host = unicode(value)

1007

self.host = value

1008

# Emit D-Bus signal

1009

self.PropertyChanged(dbus.String("Host"),

1010

dbus.String(value, variant_level=1))

1512

1011

1513

1012

# Created - property

1514

1013

@dbus_service_property(_interface, signature="s", access="read")

1515

1014

def Created_dbus_property(self):

1516

return datetime_to_dbus(self.created)

1015

return dbus.String(self._datetime_to_dbus(self.created))

1517

1016

1518

1017

# LastEnabled - property

1519

1018

@dbus_service_property(_interface, signature="s", access="read")

1520

1019

def LastEnabled_dbus_property(self):

1521

return datetime_to_dbus(self.last_enabled)

1020

if self.last_enabled is None:

1021

return dbus.String("")

1022

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1522

1023

1523

1024

# Enabled - property

1524

1025

@dbus_service_property(_interface, signature="b",

1538

1039

if value is not None:

1539

1040

self.checked_ok()

1540

1041

return

1541

return datetime_to_dbus(self.last_checked_ok)

1542

1543

# LastCheckerStatus - property

1544

@dbus_service_property(_interface, signature="n",

1545

access="read")

1546

def LastCheckerStatus_dbus_property(self):

1547

return dbus.Int16(self.last_checker_status)

1548

1549

# Expires - property

1550

@dbus_service_property(_interface, signature="s", access="read")

1551

def Expires_dbus_property(self):

1552

return datetime_to_dbus(self.expires)

1042

if self.last_checked_ok is None:

1043

return dbus.String("")

1044

return dbus.String(self._datetime_to_dbus(self

1045

.last_checked_ok))

1553

1046

1554

1047

# LastApprovalRequest - property

1555

1048

@dbus_service_property(_interface, signature="s", access="read")

1556

1049

def LastApprovalRequest_dbus_property(self):

1557

return datetime_to_dbus(self.last_approval_request)

1050

if self.last_approval_request is None:

1051

return dbus.String("")

1052

return dbus.String(self.

1053

_datetime_to_dbus(self

1054

.last_approval_request))

1558

1055

1559

1056

# Timeout - property

1560

1057

@dbus_service_property(_interface, signature="t",

1562

1059

def Timeout_dbus_property(self, value=None):

1563

1060

if value is None: # get

1564

1061

return dbus.UInt64(self.timeout_milliseconds())

1565

old_timeout = self.timeout

1566

1062

self.timeout = datetime.timedelta(0, 0, 0, value)

1567

# Reschedule disabling

1568

if self.enabled:

1569

now = datetime.datetime.utcnow()

1570

self.expires += self.timeout - old_timeout

1571

if self.expires <= now:

1572

# The timeout has passed

1573

self.disable()

1574

else:

1575

if (getattr(self, "disable_initiator_tag", None)

1576

is None):

1577

return

1578

gobject.source_remove(self.disable_initiator_tag)

1579

self.disable_initiator_tag = (

1580

gobject.timeout_add(

1581

timedelta_to_milliseconds(self.expires - now),

1582

self.disable))

1583

1584

# ExtendedTimeout - property

1585

@dbus_service_property(_interface, signature="t",

1586

access="readwrite")

1587

def ExtendedTimeout_dbus_property(self, value=None):

1588

if value is None: # get

1589

return dbus.UInt64(self.extended_timeout_milliseconds())

1590

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1063

# Emit D-Bus signal

1064

self.PropertyChanged(dbus.String("Timeout"),

1065

dbus.UInt64(value, variant_level=1))

1066

if getattr(self, "disable_initiator_tag", None) is None:

1067

return

1068

# Reschedule timeout

1069

gobject.source_remove(self.disable_initiator_tag)

1070

self.disable_initiator_tag = None

1071

time_to_die = (self.

1072

_timedelta_to_milliseconds((self

1073

.last_checked_ok

1074

+ self.timeout)

1075

- datetime.datetime

1076

.utcnow()))

1077

if time_to_die <= 0:

1078

# The timeout has passed

1079

self.disable()

1080

else:

1081

self.disable_initiator_tag = (gobject.timeout_add

1082

(time_to_die, self.disable))

1591

1083

1592

1084

# Interval - property

1593

1085

@dbus_service_property(_interface, signature="t",

1596

1088

if value is None: # get

1597

1089

return dbus.UInt64(self.interval_milliseconds())

1598

1090

self.interval = datetime.timedelta(0, 0, 0, value)

1091

# Emit D-Bus signal

1092

self.PropertyChanged(dbus.String("Interval"),

1093

dbus.UInt64(value, variant_level=1))

1599

1094

if getattr(self, "checker_initiator_tag", None) is None:

1600

1095

return

1601

if self.enabled:

1602

# Reschedule checker run

1603

gobject.source_remove(self.checker_initiator_tag)

1604

self.checker_initiator_tag = (gobject.timeout_add

1605

(value, self.start_checker))

1606

self.start_checker() # Start one now, too

1607

1096

# Reschedule checker run

1097

gobject.source_remove(self.checker_initiator_tag)

1098

self.checker_initiator_tag = (gobject.timeout_add

1099

(value, self.start_checker))

1100

self.start_checker() # Start one now, too

1101

1608

1102

# Checker - property

1609

1103

@dbus_service_property(_interface, signature="s",

1610

1104

access="readwrite")

1611

1105

def Checker_dbus_property(self, value=None):

1612

1106

if value is None: # get

1613

1107

return dbus.String(self.checker_command)

1614

self.checker_command = unicode(value)

1108

self.checker_command = value

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Checker"),

1111

dbus.String(self.checker_command,

1112

variant_level=1))

1615

1113

1616

1114

# CheckerRunning - property

1617

1115

@dbus_service_property(_interface, signature="b",

1644

1142

self._pipe.send(('init', fpr, address))

1645

1143

if not self._pipe.recv():

1646

1144

raise KeyError()

1647

1145

1648

1146

def __getattribute__(self, name):

1649

if name == '_pipe':

1147

if(name == '_pipe'):

1650

1148

return super(ProxyClient, self).__getattribute__(name)

1651

1149

self._pipe.send(('getattr', name))

1652

1150

data = self._pipe.recv()

1657

1155

self._pipe.send(('funcall', name, args, kwargs))

1658

1156

return self._pipe.recv()[1]

1659

1157

return func

1660

1158

1661

1159

def __setattr__(self, name, value):

1662

if name == '_pipe':

1160

if(name == '_pipe'):

1663

1161

return super(ProxyClient, self).__setattr__(name, value)

1664

1162

self._pipe.send(('setattr', name, value))

1665

1163

1676

1174

unicode(self.client_address))

1677

1175

logger.debug("Pipe FD: %d",

1678

1176

self.server.child_pipe.fileno())

1679

1177

1680

1178

session = (gnutls.connection

1681

1179

.ClientSession(self.request,

1682

1180

gnutls.connection

1683

1181

.X509Credentials()))

1684

1182

1685

1183

# Note: gnutls.connection.X509Credentials is really a

1686

1184

# generic GnuTLS certificate credentials object so long as

1687

1185

# no X.509 keys are added to it. Therefore, we can use it

1688

1186

# here despite using OpenPGP certificates.

1689

1187

1690

1188

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1691

1189

# "+AES-256-CBC", "+SHA1",

1692

1190

# "+COMP-NULL", "+CTYPE-OPENPGP",

1698

1196

(gnutls.library.functions

1699

1197

.gnutls_priority_set_direct(session._c_object,

1700

1198

priority, None))

1701

1199

1702

1200

# Start communication using the Mandos protocol

1703

1201

# Get protocol number

1704

1202

line = self.request.makefile().readline()

1705

1203

logger.debug("Protocol version: %r", line)

1706

1204

try:

1707

1205

if int(line.strip().split()[0]) > 1:

1708

raise RuntimeError(line)

1709

except (ValueError, IndexError, RuntimeError) as error:

1206

raise RuntimeError

1207

except (ValueError, IndexError, RuntimeError), error:

1710

1208

logger.error("Unknown protocol version: %s", error)

1711

1209

return

1712

1210

1713

1211

# Start GnuTLS connection

1714

1212

try:

1715

1213

session.handshake()

1716

except gnutls.errors.GNUTLSError as error:

1214

except gnutls.errors.GNUTLSError, error:

1717

1215

logger.warning("Handshake failed: %s", error)

1718

1216

# Do not run session.bye() here: the session is not

1719

1217

# established. Just abandon the request.

1720

1218

return

1721

1219

logger.debug("Handshake succeeded")

1722

1220

1723

1221

approval_required = False

1724

1222

try:

1725

1223

try:

1726

1224

fpr = self.fingerprint(self.peer_certificate

1727

1225

(session))

1728

except (TypeError,

1729

gnutls.errors.GNUTLSError) as error:

1226

except (TypeError, gnutls.errors.GNUTLSError), error:

1730

1227

logger.warning("Bad certificate: %s", error)

1731

1228

return

1732

1229

logger.debug("Fingerprint: %s", fpr)

1733

1230

1734

1231

try:

1735

1232

client = ProxyClient(child_pipe, fpr,

1736

1233

self.client_address)

1744

1241

1745

1242

while True:

1746

1243

if not client.enabled:

1747

logger.info("Client %s is disabled",

1244

logger.warning("Client %s is disabled",

1748

1245

client.name)

1749

1246

if self.server.use_dbus:

1750

1247

# Emit D-Bus signal

1751

client.Rejected("Disabled")

1248

client.Rejected("Disabled")

1752

1249

return

1753

1250

1754

if client.approved or not client.approval_delay:

1251

if client._approved or not client.approval_delay:

1755

1252

#We are approved or approval is disabled

1756

1253

break

1757

elif client.approved is None:

1254

elif client._approved is None:

1758

1255

logger.info("Client %s needs approval",

1759

1256

client.name)

1760

1257

if self.server.use_dbus:

1771

1268

return

1772

1269

1773

1270

#wait until timeout or approved

1271

#x = float(client._timedelta_to_milliseconds(delay))

1774

1272

time = datetime.datetime.now()

1775

1273

client.changedstate.acquire()

1776

client.changedstate.wait(

1777

float(timedelta_to_milliseconds(delay)

1778

/ 1000))

1274

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1779

1275

client.changedstate.release()

1780

1276

time2 = datetime.datetime.now()

1781

1277

if (time2 - time) >= delay:

1796

1292

while sent_size < len(client.secret):

1797

1293

try:

1798

1294

sent = session.send(client.secret[sent_size:])

1799

except gnutls.errors.GNUTLSError as error:

1800

logger.warning("gnutls send failed",

1801

exc_info=error)

1295

except (gnutls.errors.GNUTLSError), error:

1296

logger.warning("gnutls send failed")

1802

1297

return

1803

1298

logger.debug("Sent: %d, remaining: %d",

1804

1299

sent, len(client.secret)

1805

1300

- (sent_size + sent))

1806

1301

sent_size += sent

1807

1302

1808

1303

logger.info("Sending secret to %s", client.name)

1809

# bump the timeout using extended_timeout

1810

client.bump_timeout(client.extended_timeout)

1304

# bump the timeout as if seen

1305

client.checked_ok()

1811

1306

if self.server.use_dbus:

1812

1307

# Emit D-Bus signal

1813

1308

client.GotSecret()

1817

1312

client.approvals_pending -= 1

1818

1313

try:

1819

1314

session.bye()

1820

except gnutls.errors.GNUTLSError as error:

1821

logger.warning("GnuTLS bye failed",

1822

exc_info=error)

1315

except (gnutls.errors.GNUTLSError), error:

1316

logger.warning("GnuTLS bye failed")

1823

1317

1824

1318

@staticmethod

1825

1319

def peer_certificate(session):

1881

1375

# Convert the buffer to a Python bytestring

1882

1376

fpr = ctypes.string_at(buf, buf_len.value)

1883

1377

# Convert the bytestring to hexadecimal notation

1884

hex_fpr = binascii.hexlify(fpr).upper()

1378

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1885

1379

return hex_fpr

1886

1380

1887

1381

1890

1384

def sub_process_main(self, request, address):

1891

1385

try:

1892

1386

self.finish_request(request, address)

1893

except Exception:

1387

except:

1894

1388

self.handle_error(request, address)

1895

1389

self.close_request(request)

1896

1390

1897

1391

def process_request(self, request, address):

1898

1392

"""Start a new process to process the request."""

1899

proc = multiprocessing.Process(target = self.sub_process_main,

1900

args = (request, address))

1901

proc.start()

1902

return proc

1903

1393

multiprocessing.Process(target = self.sub_process_main,

1394

args = (request, address)).start()

1904

1395

1905

1396

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1906

1397

""" adds a pipe to the MixIn """

1910

1401

This function creates a new pipe in self.pipe

1911

1402

"""

1912

1403

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1913

1914

proc = MultiprocessingMixIn.process_request(self, request,

1915

client_address)

1404

1405

super(MultiprocessingMixInWithPipe,

1406

self).process_request(request, client_address)

1916

1407

self.child_pipe.close()

1917

self.add_pipe(parent_pipe, proc)

1918

1919

def add_pipe(self, parent_pipe, proc):

1408

self.add_pipe(parent_pipe)

1409

1410

def add_pipe(self, parent_pipe):

1920

1411

"""Dummy function; override as necessary"""

1921

raise NotImplementedError()

1922

1412

raise NotImplementedError

1923

1413

1924

1414

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1925

1415

socketserver.TCPServer, object):

1931

1421

use_ipv6: Boolean; to use IPv6 or not

1932

1422

"""

1933

1423

def __init__(self, server_address, RequestHandlerClass,

1934

interface=None, use_ipv6=True, socketfd=None):

1935

"""If socketfd is set, use that file descriptor instead of

1936

creating a new one with socket.socket().

1937

"""

1424

interface=None, use_ipv6=True):

1938

1425

self.interface = interface

1939

1426

if use_ipv6:

1940

1427

self.address_family = socket.AF_INET6

1941

if socketfd is not None:

1942

# Save the file descriptor

1943

self.socketfd = socketfd

1944

# Save the original socket.socket() function

1945

self.socket_socket = socket.socket

1946

# To implement --socket, we monkey patch socket.socket.

1947

#

1948

# (When socketserver.TCPServer is a new-style class, we

1949

# could make self.socket into a property instead of monkey

1950

# patching socket.socket.)

1951

#

1952

# Create a one-time-only replacement for socket.socket()

1953

@functools.wraps(socket.socket)

1954

def socket_wrapper(*args, **kwargs):

1955

# Restore original function so subsequent calls are

1956

# not affected.

1957

socket.socket = self.socket_socket

1958

del self.socket_socket

1959

# This time only, return a new socket object from the

1960

# saved file descriptor.

1961

return socket.fromfd(self.socketfd, *args, **kwargs)

1962

# Replace socket.socket() function with wrapper

1963

socket.socket = socket_wrapper

1964

# The socketserver.TCPServer.__init__ will call

1965

# socket.socket(), which might be our replacement,

1966

# socket_wrapper(), if socketfd was set.

1967

1428

socketserver.TCPServer.__init__(self, server_address,

1968

1429

RequestHandlerClass)

1969

1970

1430

def server_bind(self):

1971

1431

"""This overrides the normal server_bind() function

1972

1432

to bind to an interface if one was specified, and also NOT to

1980

1440

try:

1981

1441

self.socket.setsockopt(socket.SOL_SOCKET,

1982

1442

SO_BINDTODEVICE,

1983

str(self.interface + '\0'))

1984

except socket.error as error:

1985

if error.errno == errno.EPERM:

1986

logger.error("No permission to bind to"

1987

" interface %s", self.interface)

1988

elif error.errno == errno.ENOPROTOOPT:

1443

str(self.interface

1444

+ '\0'))

1445

except socket.error, error:

1446

if error[0] == errno.EPERM:

1447

logger.error("No permission to"

1448

" bind to interface %s",

1449

self.interface)

1450

elif error[0] == errno.ENOPROTOOPT:

1989

1451

logger.error("SO_BINDTODEVICE not available;"

1990

1452

" cannot bind to interface %s",

1991

1453

self.interface)

1992

elif error.errno == errno.ENODEV:

1993

logger.error("Interface %s does not exist,"

1994

" cannot bind", self.interface)

1995

1454

else:

1996

1455

raise

1997

1456

# Only bind(2) the socket if we really need to.

2000

1459

if self.address_family == socket.AF_INET6:

2001

1460

any_address = "::" # in6addr_any

2002

1461

else:

2003

any_address = "0.0.0.0" # INADDR_ANY

1462

any_address = socket.INADDR_ANY

2004

1463

self.server_address = (any_address,

2005

1464

self.server_address[1])

2006

1465

elif not self.server_address[1]:

2027

1486

"""

2028

1487

def __init__(self, server_address, RequestHandlerClass,

2029

1488

interface=None, use_ipv6=True, clients=None,

2030

gnutls_priority=None, use_dbus=True, socketfd=None):

1489

gnutls_priority=None, use_dbus=True):

2031

1490

self.enabled = False

2032

1491

self.clients = clients

2033

1492

if self.clients is None:

2034

self.clients = {}

1493

self.clients = set()

2035

1494

self.use_dbus = use_dbus

2036

1495

self.gnutls_priority = gnutls_priority

2037

1496

IPv6_TCPServer.__init__(self, server_address,

2038

1497

RequestHandlerClass,

2039

1498

interface = interface,

2040

use_ipv6 = use_ipv6,

2041

socketfd = socketfd)

1499

use_ipv6 = use_ipv6)

2042

1500

def server_activate(self):

2043

1501

if self.enabled:

2044

1502

return socketserver.TCPServer.server_activate(self)

2045

2046

1503

def enable(self):

2047

1504

self.enabled = True

2048

2049

def add_pipe(self, parent_pipe, proc):

1505

def add_pipe(self, parent_pipe):

2050

1506

# Call "handle_ipc" for both data and EOF events

2051

1507

gobject.io_add_watch(parent_pipe.fileno(),

2052

1508

gobject.IO_IN | gobject.IO_HUP,

2053

1509

functools.partial(self.handle_ipc,

2054

parent_pipe =

2055

parent_pipe,

2056

proc = proc))

2057

1510

parent_pipe = parent_pipe))

1511

2058

1512

def handle_ipc(self, source, condition, parent_pipe=None,

2059

proc = None, client_object=None):

2060

# error, or the other end of multiprocessing.Pipe has closed

2061

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2062

# Wait for other process to exit

2063

proc.join()

1513

client_object=None):

1514

condition_names = {

1515

gobject.IO_IN: "IN", # There is data to read.

1516

gobject.IO_OUT: "OUT", # Data can be written (without

1517

# blocking).

1518

gobject.IO_PRI: "PRI", # There is urgent data to read.

1519

gobject.IO_ERR: "ERR", # Error condition.

1520

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1521

# broken, usually for pipes and

1522

# sockets).

1523

}

1524

conditions_string = ' | '.join(name

1525

for cond, name in

1526

condition_names.iteritems()

1527

if cond & condition)

1528

# error or the other end of multiprocessing.Pipe has closed

1529

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2064

1530

return False

2065

1531

2066

1532

# Read a request from the child

2071

1537

fpr = request[1]

2072

1538

address = request[2]

2073

1539

2074

for c in self.clients.itervalues():

1540

for c in self.clients:

2075

1541

if c.fingerprint == fpr:

2076

1542

client = c

2077

1543

break

2078

1544

else:

2079

logger.info("Client not found for fingerprint: %s, ad"

2080

"dress: %s", fpr, address)

1545

logger.warning("Client not found for fingerprint: %s, ad"

1546

"dress: %s", fpr, address)

2081

1547

if self.use_dbus:

2082

1548

# Emit D-Bus signal

2083

mandos_dbus_service.ClientNotFound(fpr,

2084

address[0])

1549

mandos_dbus_service.ClientNotFound(fpr, address[0])

2085

1550

parent_pipe.send(False)

2086

1551

return False

2087

1552

2088

1553

gobject.io_add_watch(parent_pipe.fileno(),

2089

1554

gobject.IO_IN | gobject.IO_HUP,

2090

1555

functools.partial(self.handle_ipc,

2091

parent_pipe =

2092

parent_pipe,

2093

proc = proc,

2094

client_object =

2095

client))

1556

parent_pipe = parent_pipe,

1557

client_object = client))

2096

1558

parent_pipe.send(True)

2097

# remove the old hook in favor of the new above hook on

2098

# same fileno

1559

# remove the old hook in favor of the new above hook on same fileno

2099

1560

return False

2100

1561

if command == 'funcall':

2101

1562

funcname = request[1]

2102

1563

args = request[2]

2103

1564

kwargs = request[3]

2104

1565

2105

parent_pipe.send(('data', getattr(client_object,

2106

funcname)(*args,

2107

**kwargs)))

2108

1566

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1567

2109

1568

if command == 'getattr':

2110

1569

attrname = request[1]

2111

1570

if callable(client_object.__getattribute__(attrname)):

2112

1571

parent_pipe.send(('function',))

2113

1572

else:

2114

parent_pipe.send(('data', client_object

2115

.__getattribute__(attrname)))

1573

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2116

1574

2117

1575

if command == 'setattr':

2118

1576

attrname = request[1]

2119

1577

value = request[2]

2120

1578

setattr(client_object, attrname, value)

2121

1579

2122

1580

return True

2123

1581

2124

1582

2125

def rfc3339_duration_to_delta(duration):

2126

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2127

2128

>>> rfc3339_duration_to_delta("P7D")

2129

datetime.timedelta(7)

2130

>>> rfc3339_duration_to_delta("PT60S")

2131

datetime.timedelta(0, 60)

2132

>>> rfc3339_duration_to_delta("PT60M")

2133

datetime.timedelta(0, 3600)

2134

>>> rfc3339_duration_to_delta("PT24H")

2135

datetime.timedelta(1)

2136

>>> rfc3339_duration_to_delta("P1W")

2137

datetime.timedelta(7)

2138

>>> rfc3339_duration_to_delta("PT5M30S")

2139

datetime.timedelta(0, 330)

2140

>>> rfc3339_duration_to_delta("P1DT3M20S")

2141

datetime.timedelta(1, 200)

2142

"""

2143

2144

# Parsing an RFC 3339 duration with regular expressions is not

2145

# possible - there would have to be multiple places for the same

2146

# values, like seconds. The current code, while more esoteric, is

2147

# cleaner without depending on a parsing library. If Python had a

2148

# built-in library for parsing we would use it, but we'd like to

2149

# avoid excessive use of external libraries.

2150

2151

# New type for defining tokens, syntax, and semantics all-in-one

2152

Token = collections.namedtuple("Token",

2153

("regexp", # To match token; if

2154

# "value" is not None,

2155

# must have a "group"

2156

# containing digits

2157

"value", # datetime.timedelta or

2158

# None

2159

"followers")) # Tokens valid after

2160

# this token

2161

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2162

# the "duration" ABNF definition in RFC 3339, Appendix A.

2163

token_end = Token(re.compile(r"$"), None, frozenset())

2164

token_second = Token(re.compile(r"(\d+)S"),

2165

datetime.timedelta(seconds=1),

2166

frozenset((token_end,)))

2167

token_minute = Token(re.compile(r"(\d+)M"),

2168

datetime.timedelta(minutes=1),

2169

frozenset((token_second, token_end)))

2170

token_hour = Token(re.compile(r"(\d+)H"),

2171

datetime.timedelta(hours=1),

2172

frozenset((token_minute, token_end)))

2173

token_time = Token(re.compile(r"T"),

2174

None,

2175

frozenset((token_hour, token_minute,

2176

token_second)))

2177

token_day = Token(re.compile(r"(\d+)D"),

2178

datetime.timedelta(days=1),

2179

frozenset((token_time, token_end)))

2180

token_month = Token(re.compile(r"(\d+)M"),

2181

datetime.timedelta(weeks=4),

2182

frozenset((token_day, token_end)))

2183

token_year = Token(re.compile(r"(\d+)Y"),

2184

datetime.timedelta(weeks=52),

2185

frozenset((token_month, token_end)))

2186

token_week = Token(re.compile(r"(\d+)W"),

2187

datetime.timedelta(weeks=1),

2188

frozenset((token_end,)))

2189

token_duration = Token(re.compile(r"P"), None,

2190

frozenset((token_year, token_month,

2191

token_day, token_time,

2192

token_week))),

2193

# Define starting values

2194

value = datetime.timedelta() # Value so far

2195

found_token = None

2196

followers = frozenset(token_duration,) # Following valid tokens

2197

s = duration # String left to parse

2198

# Loop until end token is found

2199

while found_token is not token_end:

2200

# Search for any currently valid tokens

2201

for token in followers:

2202

match = token.regexp.match(s)

2203

if match is not None:

2204

# Token found

2205

if token.value is not None:

2206

# Value found, parse digits

2207

factor = int(match.group(1), 10)

2208

# Add to value so far

2209

value += factor * token.value

2210

# Strip token from string

2211

s = token.regexp.sub("", s, 1)

2212

# Go to found token

2213

found_token = token

2214

# Set valid next tokens

2215

followers = found_token.followers

2216

break

2217

else:

2218

# No currently valid tokens were found

2219

raise ValueError("Invalid RFC 3339 duration")

2220

# End token found

2221

return value

2222

2223

2224

1583

def string_to_delta(interval):

2225

1584

"""Parse a string and return a datetime.timedelta

2226

1585

2237

1596

>>> string_to_delta('5m 30s')

2238

1597

datetime.timedelta(0, 330)

2239

1598

"""

2240

2241

try:

2242

return rfc3339_duration_to_delta(interval)

2243

except ValueError:

2244

pass

2245

2246

1599

timevalue = datetime.timedelta(0)

2247

1600

for s in interval.split():

2248

1601

try:

2259

1612

elif suffix == "w":

2260

1613

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2261

1614

else:

2262

raise ValueError("Unknown suffix {0!r}"

2263

.format(suffix))

2264

except IndexError as e:

1615

raise ValueError("Unknown suffix %r" % suffix)

1616

except (ValueError, IndexError), e:

2265

1617

raise ValueError(*(e.args))

2266

1618

timevalue += delta

2267

1619

return timevalue

2268

1620

2269

1621

1622

def if_nametoindex(interface):

1623

"""Call the C function if_nametoindex(), or equivalent

1624

1625

Note: This function cannot accept a unicode string."""

1626

global if_nametoindex

1627

try:

1628

if_nametoindex = (ctypes.cdll.LoadLibrary

1629

(ctypes.util.find_library("c"))

1630

.if_nametoindex)

1631

except (OSError, AttributeError):

1632

logger.warning("Doing if_nametoindex the hard way")

1633

def if_nametoindex(interface):

1634

"Get an interface index the hard way, i.e. using fcntl()"

1635

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1636

with contextlib.closing(socket.socket()) as s:

1637

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1638

struct.pack(str("16s16x"),

1639

interface))

1640

interface_index = struct.unpack(str("I"),

1641

ifreq[16:20])[0]

1642

return interface_index

1643

return if_nametoindex(interface)

1644

1645

2270

1646

def daemon(nochdir = False, noclose = False):

2271

1647

"""See daemon(3). Standard BSD Unix function.

2272

1648

2280

1656

sys.exit()

2281

1657

if not noclose:

2282

1658

# Close all standard open file descriptors

2283

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1659

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2284

1660

if not stat.S_ISCHR(os.fstat(null).st_mode):

2285

1661

raise OSError(errno.ENODEV,

2286

"{0} not a character device"

2287

.format(os.devnull))

1662

"%s not a character device"

1663

% os.path.devnull)

2288

1664

os.dup2(null, sys.stdin.fileno())

2289

1665

os.dup2(null, sys.stdout.fileno())

2290

1666

os.dup2(null, sys.stderr.fileno())

2297

1673

##################################################################

2298

1674

# Parsing of options, both command line and config file

2299

1675

2300

parser = argparse.ArgumentParser()

2301

parser.add_argument("-v", "--version", action="version",

2302

version = "%(prog)s {0}".format(version),

2303

help="show version number and exit")

2304

parser.add_argument("-i", "--interface", metavar="IF",

2305

help="Bind to interface IF")

2306

parser.add_argument("-a", "--address",

2307

help="Address to listen for requests on")

2308

parser.add_argument("-p", "--port", type=int,

2309

help="Port number to receive requests on")

2310

parser.add_argument("--check", action="store_true",

2311

help="Run self-test")

2312

parser.add_argument("--debug", action="store_true",

2313

help="Debug mode; run in foreground and log"

2314

" to terminal", default=None)

2315

parser.add_argument("--debuglevel", metavar="LEVEL",

2316

help="Debug level for stdout output")

2317

parser.add_argument("--priority", help="GnuTLS"

2318

" priority string (see GnuTLS documentation)")

2319

parser.add_argument("--servicename",

2320

metavar="NAME", help="Zeroconf service name")

2321

parser.add_argument("--configdir",

2322

default="/etc/mandos", metavar="DIR",

2323

help="Directory to search for configuration"

2324

" files")

2325

parser.add_argument("--no-dbus", action="store_false",

2326

dest="use_dbus", help="Do not provide D-Bus"

2327

" system bus interface", default=None)

2328

parser.add_argument("--no-ipv6", action="store_false",

2329

dest="use_ipv6", help="Do not use IPv6",

2330

default=None)

2331

parser.add_argument("--no-restore", action="store_false",

2332

dest="restore", help="Do not restore stored"

2333

" state", default=None)

2334

parser.add_argument("--socket", type=int,

2335

help="Specify a file descriptor to a network"

2336

" socket to use instead of creating one")

2337

parser.add_argument("--statedir", metavar="DIR",

2338

help="Directory to save/restore state in")

2339

parser.add_argument("--foreground", action="store_true",

2340

help="Run in foreground", default=None)

2341

2342

options = parser.parse_args()

1676

parser = optparse.OptionParser(version = "%%prog %s" % version)

1677

parser.add_option("-i", "--interface", type="string",

1678

metavar="IF", help="Bind to interface IF")

1679

parser.add_option("-a", "--address", type="string",

1680

help="Address to listen for requests on")

1681

parser.add_option("-p", "--port", type="int",

1682

help="Port number to receive requests on")

1683

parser.add_option("--check", action="store_true",

1684

help="Run self-test")

1685

parser.add_option("--debug", action="store_true",

1686

help="Debug mode; run in foreground and log to"

1687

" terminal")

1688

parser.add_option("--debuglevel", type="string", metavar="LEVEL",

1689

help="Debug level for stdout output")

1690

parser.add_option("--priority", type="string", help="GnuTLS"

1691

" priority string (see GnuTLS documentation)")

1692

parser.add_option("--servicename", type="string",

1693

metavar="NAME", help="Zeroconf service name")

1694

parser.add_option("--configdir", type="string",

1695

default="/etc/mandos", metavar="DIR",

1696

help="Directory to search for configuration"

1697

" files")

1698

parser.add_option("--no-dbus", action="store_false",

1699

dest="use_dbus", help="Do not provide D-Bus"

1700

" system bus interface")

1701

parser.add_option("--no-ipv6", action="store_false",

1702

dest="use_ipv6", help="Do not use IPv6")

1703

options = parser.parse_args()[0]

2343

1704

2344

1705

if options.check:

2345

1706

import doctest

2352

1713

"port": "",

2353

1714

"debug": "False",

2354

1715

"priority":

2355

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

1716

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2356

1717

"servicename": "Mandos",

2357

1718

"use_dbus": "True",

2358

1719

"use_ipv6": "True",

2359

1720

"debuglevel": "",

2360

"restore": "True",

2361

"socket": "",

2362

"statedir": "/var/lib/mandos",

2363

"foreground": "False",

2364

1721

}

2365

1722

2366

1723

# Parse config file for server-global settings

2371

1728

# Convert the SafeConfigParser object to a dict

2372

1729

server_settings = server_config.defaults()

2373

1730

# Use the appropriate methods on the non-string config options

2374

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1731

for option in ("debug", "use_dbus", "use_ipv6"):

2375

1732

server_settings[option] = server_config.getboolean("DEFAULT",

2376

1733

option)

2377

1734

if server_settings["port"]:

2378

1735

server_settings["port"] = server_config.getint("DEFAULT",

2379

1736

"port")

2380

if server_settings["socket"]:

2381

server_settings["socket"] = server_config.getint("DEFAULT",

2382

"socket")

2383

# Later, stdin will, and stdout and stderr might, be dup'ed

2384

# over with an opened os.devnull. But we don't want this to

2385

# happen with a supplied network socket.

2386

if 0 <= server_settings["socket"] <= 2:

2387

server_settings["socket"] = os.dup(server_settings

2388

["socket"])

2389

1737

del server_config

2390

1738

2391

1739

# Override the settings from the config file with command line

2392

1740

# options, if set.

2393

1741

for option in ("interface", "address", "port", "debug",

2394

1742

"priority", "servicename", "configdir",

2395

"use_dbus", "use_ipv6", "debuglevel", "restore",

2396

"statedir", "socket", "foreground"):

1743

"use_dbus", "use_ipv6", "debuglevel"):

2397

1744

value = getattr(options, option)

2398

1745

if value is not None:

2399

1746

server_settings[option] = value

2402

1749

for option in server_settings.keys():

2403

1750

if type(server_settings[option]) is str:

2404

1751

server_settings[option] = unicode(server_settings[option])

2405

# Force all boolean options to be boolean

2406

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2407

"foreground"):

2408

server_settings[option] = bool(server_settings[option])

2409

# Debug implies foreground

2410

if server_settings["debug"]:

2411

server_settings["foreground"] = True

2412

1752

# Now we have our good server settings in "server_settings"

2413

1753

2414

1754

##################################################################

2418

1758

debuglevel = server_settings["debuglevel"]

2419

1759

use_dbus = server_settings["use_dbus"]

2420

1760

use_ipv6 = server_settings["use_ipv6"]

2421

stored_state_path = os.path.join(server_settings["statedir"],

2422

stored_state_file)

2423

foreground = server_settings["foreground"]

2424

2425

if debug:

2426

initlogger(debug, logging.DEBUG)

2427

else:

2428

if not debuglevel:

2429

initlogger(debug)

2430

else:

2431

level = getattr(logging, debuglevel.upper())

2432

initlogger(debug, level)

2433

1761

2434

1762

if server_settings["servicename"] != "Mandos":

2435

1763

syslogger.setFormatter(logging.Formatter

2436

('Mandos ({0}) [%(process)d]:'

2437

' %(levelname)s: %(message)s'

2438

.format(server_settings

2439

["servicename"])))

1764

('Mandos (%s) [%%(process)d]:'

1765

' %%(levelname)s: %%(message)s'

1766

% server_settings["servicename"]))

2440

1767

2441

1768

# Parse config file with clients

2442

client_config = configparser.SafeConfigParser(Client

2443

.client_defaults)

1769

client_defaults = { "timeout": "1h",

1770

"interval": "5m",

1771

"checker": "fping -q -- %%(host)s",

1772

"host": "",

1773

"approval_delay": "0s",

1774

"approval_duration": "1s",

1775

}

1776

client_config = configparser.SafeConfigParser(client_defaults)

2444

1777

client_config.read(os.path.join(server_settings["configdir"],

2445

1778

"clients.conf"))

2446

1779

2455

1788

use_ipv6=use_ipv6,

2456

1789

gnutls_priority=

2457

1790

server_settings["priority"],

2458

use_dbus=use_dbus,

2459

socketfd=(server_settings["socket"]

2460

or None))

2461

if not foreground:

2462

pidfilename = "/run/mandos.pid"

2463

if not os.path.isdir("/run/."):

2464

pidfilename = "/var/run/mandos.pid"

2465

pidfile = None

1791

use_dbus=use_dbus)

1792

if not debug:

1793

pidfilename = "/var/run/mandos.pid"

2466

1794

try:

2467

1795

pidfile = open(pidfilename, "w")

2468

except IOError as e:

2469

logger.error("Could not open file %r", pidfilename,

2470

exc_info=e)

1796

except IOError:

1797

logger.error("Could not open file %r", pidfilename)

2471

1798

2472

for name in ("_mandos", "mandos", "nobody"):

1799

try:

1800

uid = pwd.getpwnam("_mandos").pw_uid

1801

gid = pwd.getpwnam("_mandos").pw_gid

1802

except KeyError:

2473

1803

try:

2474

uid = pwd.getpwnam(name).pw_uid

2475

gid = pwd.getpwnam(name).pw_gid

2476

break

1804

uid = pwd.getpwnam("mandos").pw_uid

1805

gid = pwd.getpwnam("mandos").pw_gid

2477

1806

except KeyError:

2478

continue

2479

else:

2480

uid = 65534

2481

gid = 65534

1807

try:

1808

uid = pwd.getpwnam("nobody").pw_uid

1809

gid = pwd.getpwnam("nobody").pw_gid

1810

except KeyError:

1811

uid = 65534

1812

gid = 65534

2482

1813

try:

2483

1814

os.setgid(gid)

2484

1815

os.setuid(uid)

2485

except OSError as error:

2486

if error.errno != errno.EPERM:

2487

raise

1816

except OSError, error:

1817

if error[0] != errno.EPERM:

1818

raise error

2488

1819

1820

if not debug and not debuglevel:

1821

syslogger.setLevel(logging.WARNING)

1822

console.setLevel(logging.WARNING)

1823

if debuglevel:

1824

level = getattr(logging, debuglevel.upper())

1825

syslogger.setLevel(level)

1826

console.setLevel(level)

1827

2489

1828

if debug:

2490

1829

# Enable all possible GnuTLS debugging

2491

1830

2501

1840

.gnutls_global_set_log_function(debug_gnutls))

2502

1841

2503

1842

# Redirect stdin so all checkers get /dev/null

2504

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1843

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2505

1844

os.dup2(null, sys.stdin.fileno())

2506

1845

if null > 2:

2507

1846

os.close(null)

1847

else:

1848

# No console logging

1849

logger.removeHandler(console)

2508

1850

2509

1851

# Need to fork before connecting to D-Bus

2510

if not foreground:

1852

if not debug:

2511

1853

# Close all input and output, do double fork, etc.

2512

1854

daemon()

2513

1855

2514

# multiprocessing will use threads, so before we use gobject we

2515

# need to inform gobject that threads will be used.

2516

gobject.threads_init()

2517

2518

1856

global main_loop

2519

1857

# From the Avahi example code

2520

DBusGMainLoop(set_as_default=True)

1858

DBusGMainLoop(set_as_default=True )

2521

1859

main_loop = gobject.MainLoop()

2522

1860

bus = dbus.SystemBus()

2523

1861

# End of Avahi example code

2524

1862

if use_dbus:

2525

1863

try:

2526

bus_name = dbus.service.BusName("se.recompile.Mandos",

1864

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2527

1865

bus, do_not_queue=True)

2528

old_bus_name = (dbus.service.BusName

2529

("se.bsnet.fukt.Mandos", bus,

2530

do_not_queue=True))

2531

except dbus.exceptions.NameExistsException as e:

2532

logger.error("Disabling D-Bus:", exc_info=e)

1866

except dbus.exceptions.NameExistsException, e:

1867

logger.error(unicode(e) + ", disabling D-Bus")

2533

1868

use_dbus = False

2534

1869

server_settings["use_dbus"] = False

2535

1870

tcp_server.use_dbus = False

2536

1871

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2537

service = AvahiServiceToSyslog(name =

2538

server_settings["servicename"],

2539

servicetype = "_mandos._tcp",

2540

protocol = protocol, bus = bus)

1872

service = AvahiService(name = server_settings["servicename"],

1873

servicetype = "_mandos._tcp",

1874

protocol = protocol, bus = bus)

2541

1875

if server_settings["interface"]:

2542

1876

service.interface = (if_nametoindex

2543

1877

(str(server_settings["interface"])))

2548

1882

client_class = Client

2549

1883

if use_dbus:

2550

1884

client_class = functools.partial(ClientDBus, bus = bus)

2551

2552

client_settings = Client.config_parser(client_config)

2553

old_client_settings = {}

2554

clients_data = {}

2555

2556

# This is used to redirect stdout and stderr for checker processes

2557

global wnull

2558

wnull = open(os.devnull, "w") # A writable /dev/null

2559

# Only used if server is running in foreground but not in debug

2560

# mode

2561

if debug or not foreground:

2562

wnull.close()

2563

2564

# Get client data and settings from last running state.

2565

if server_settings["restore"]:

2566

try:

2567

with open(stored_state_path, "rb") as stored_state:

2568

clients_data, old_client_settings = (pickle.load

2569

(stored_state))

2570

os.remove(stored_state_path)

2571

except IOError as e:

2572

if e.errno == errno.ENOENT:

2573

logger.warning("Could not load persistent state: {0}"

2574

.format(os.strerror(e.errno)))

2575

else:

2576

logger.critical("Could not load persistent state:",

2577

exc_info=e)

2578

raise

2579

except EOFError as e:

2580

logger.warning("Could not load persistent state: "

2581

"EOFError:", exc_info=e)

2582

2583

with PGPEngine() as pgp:

2584

for client_name, client in clients_data.iteritems():

2585

# Skip removed clients

2586

if client_name not in client_settings:

2587

continue

2588

2589

# Decide which value to use after restoring saved state.

2590

# We have three different values: Old config file,

2591

# new config file, and saved state.

2592

# New config value takes precedence if it differs from old

2593

# config value, otherwise use saved state.

2594

for name, value in client_settings[client_name].items():

2595

try:

2596

# For each value in new config, check if it

2597

# differs from the old config value (Except for

2598

# the "secret" attribute)

2599

if (name != "secret" and

2600

value != old_client_settings[client_name]

2601

[name]):

2602

client[name] = value

2603

except KeyError:

2604

pass

2605

2606

# Clients who has passed its expire date can still be

2607

# enabled if its last checker was successful. Clients

2608

# whose checker succeeded before we stored its state is

2609

# assumed to have successfully run all checkers during

2610

# downtime.

2611

if client["enabled"]:

2612

if datetime.datetime.utcnow() >= client["expires"]:

2613

if not client["last_checked_ok"]:

2614

logger.warning(

2615

"disabling client {0} - Client never "

2616

"performed a successful checker"

2617

.format(client_name))

2618

client["enabled"] = False

2619

elif client["last_checker_status"] != 0:

2620

logger.warning(

2621

"disabling client {0} - Client "

2622

"last checker failed with error code {1}"

2623

.format(client_name,

2624

client["last_checker_status"]))

2625

client["enabled"] = False

2626

else:

2627

client["expires"] = (datetime.datetime

2628

.utcnow()

2629

+ client["timeout"])

2630

logger.debug("Last checker succeeded,"

2631

" keeping {0} enabled"

2632

.format(client_name))

1885

def client_config_items(config, section):

1886

special_settings = {

1887

"approved_by_default":

1888

lambda: config.getboolean(section,

1889

"approved_by_default"),

1890

}

1891

for name, value in config.items(section):

2633

1892

try:

2634

client["secret"] = (

2635

pgp.decrypt(client["encrypted_secret"],

2636

client_settings[client_name]

2637

["secret"]))

2638

except PGPError:

2639

# If decryption fails, we use secret from new settings

2640

logger.debug("Failed to decrypt {0} old secret"

2641

.format(client_name))

2642

client["secret"] = (

2643

client_settings[client_name]["secret"])

2644

2645

# Add/remove clients based on new changes made to config

2646

for client_name in (set(old_client_settings)

2647

- set(client_settings)):

2648

del clients_data[client_name]

2649

for client_name in (set(client_settings)

2650

- set(old_client_settings)):

2651

clients_data[client_name] = client_settings[client_name]

2652

2653

# Create all client objects

2654

for client_name, client in clients_data.iteritems():

2655

tcp_server.clients[client_name] = client_class(

2656

name = client_name, settings = client,

2657

server_settings = server_settings)

2658

1893

yield (name, special_settings[name]())

1894

except KeyError:

1895

yield (name, value)

1896

1897

tcp_server.clients.update(set(

1898

client_class(name = section,

1899

config= dict(client_config_items(

1900

client_config, section)))

1901

for section in client_config.sections()))

2659

1902

if not tcp_server.clients:

2660

1903

logger.warning("No clients defined")

2661

2662

if not foreground:

2663

if pidfile is not None:

2664

try:

2665

with pidfile:

2666

pid = os.getpid()

2667

pidfile.write(str(pid) + "\n".encode("utf-8"))

2668

except IOError:

2669

logger.error("Could not write to file %r with PID %d",

2670

pidfilename, pid)

2671

del pidfile

1904

1905

if not debug:

1906

try:

1907

with pidfile:

1908

pid = os.getpid()

1909

pidfile.write(str(pid) + "\n".encode("utf-8"))

1910

del pidfile

1911

except IOError:

1912

logger.error("Could not write to file %r with PID %d",

1913

pidfilename, pid)

1914

except NameError:

1915

# "pidfile" was never created

1916

pass

2672

1917

del pidfilename

2673

1918

1919

signal.signal(signal.SIGINT, signal.SIG_IGN)

1920

2674

1921

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2675

1922

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2676

1923

2677

1924

if use_dbus:

2678

@alternate_dbus_interfaces({"se.recompile.Mandos":

2679

"se.bsnet.fukt.Mandos"})

2680

class MandosDBusService(DBusObjectWithProperties):

1925

class MandosDBusService(dbus.service.Object):

2681

1926

"""A D-Bus proxy object"""

2682

1927

def __init__(self):

2683

1928

dbus.service.Object.__init__(self, bus, "/")

2684

_interface = "se.recompile.Mandos"

2685

2686

@dbus_interface_annotations(_interface)

2687

def _foo(self):

2688

return { "org.freedesktop.DBus.Property"

2689

".EmitsChangedSignal":

2690

"false"}

1929

_interface = "se.bsnet.fukt.Mandos"

2691

1930

2692

1931

@dbus.service.signal(_interface, signature="o")

2693

1932

def ClientAdded(self, objpath):

2708

1947

def GetAllClients(self):

2709

1948

"D-Bus method"

2710

1949

return dbus.Array(c.dbus_object_path

2711

for c in

2712

tcp_server.clients.itervalues())

1950

for c in tcp_server.clients)

2713

1951

2714

1952

@dbus.service.method(_interface,

2715

1953

out_signature="a{oa{sv}}")

2717

1955

"D-Bus method"

2718

1956

return dbus.Dictionary(

2719

1957

((c.dbus_object_path, c.GetAll(""))

2720

for c in tcp_server.clients.itervalues()),

1958

for c in tcp_server.clients),

2721

1959

signature="oa{sv}")

2722

1960

2723

1961

@dbus.service.method(_interface, in_signature="o")

2724

1962

def RemoveClient(self, object_path):

2725

1963

"D-Bus method"

2726

for c in tcp_server.clients.itervalues():

1964

for c in tcp_server.clients:

2727

1965

if c.dbus_object_path == object_path:

2728

del tcp_server.clients[c.name]

1966

tcp_server.clients.remove(c)

2729

1967

c.remove_from_connection()

2730

1968

# Don't signal anything except ClientRemoved

2731

1969

c.disable(quiet=True)

2742

1980

"Cleanup function; run on exit"

2743

1981

service.cleanup()

2744

1982

2745

multiprocessing.active_children()

2746

wnull.close()

2747

if not (tcp_server.clients or client_settings):

2748

return

2749

2750

# Store client before exiting. Secrets are encrypted with key

2751

# based on what config file has. If config file is

2752

# removed/edited, old secret will thus be unrecovable.

2753

clients = {}

2754

with PGPEngine() as pgp:

2755

for client in tcp_server.clients.itervalues():

2756

key = client_settings[client.name]["secret"]

2757

client.encrypted_secret = pgp.encrypt(client.secret,

2758

key)

2759

client_dict = {}

2760

2761

# A list of attributes that can not be pickled

2762

# + secret.

2763

exclude = set(("bus", "changedstate", "secret",

2764

"checker", "server_settings"))

2765

for name, typ in (inspect.getmembers

2766

(dbus.service.Object)):

2767

exclude.add(name)

2768

2769

client_dict["encrypted_secret"] = (client

2770

.encrypted_secret)

2771

for attr in client.client_structure:

2772

if attr not in exclude:

2773

client_dict[attr] = getattr(client, attr)

2774

2775

clients[client.name] = client_dict

2776

del client_settings[client.name]["secret"]

2777

2778

try:

2779

with (tempfile.NamedTemporaryFile

2780

(mode='wb', suffix=".pickle", prefix='clients-',

2781

dir=os.path.dirname(stored_state_path),

2782

delete=False)) as stored_state:

2783

pickle.dump((clients, client_settings), stored_state)

2784

tempname=stored_state.name

2785

os.rename(tempname, stored_state_path)

2786

except (IOError, OSError) as e:

2787

if not debug:

2788

try:

2789

os.remove(tempname)

2790

except NameError:

2791

pass

2792

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2793

logger.warning("Could not save persistent state: {0}"

2794

.format(os.strerror(e.errno)))

2795

else:

2796

logger.warning("Could not save persistent state:",

2797

exc_info=e)

2798

raise

2799

2800

# Delete all clients, and settings from config

2801

1983

while tcp_server.clients:

2802

name, client = tcp_server.clients.popitem()

1984

client = tcp_server.clients.pop()

2803

1985

if use_dbus:

2804

1986

client.remove_from_connection()

1987

client.disable_hook = None

2805

1988

# Don't signal anything except ClientRemoved

2806

1989

client.disable(quiet=True)

2807

1990

if use_dbus:

2808

1991

# Emit D-Bus signal

2809

mandos_dbus_service.ClientRemoved(client

2810

.dbus_object_path,

1992

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2811

1993

client.name)

2812

client_settings.clear()

2813

1994

2814

1995

atexit.register(cleanup)

2815

1996

2816

for client in tcp_server.clients.itervalues():

1997

for client in tcp_server.clients:

2817

1998

if use_dbus:

2818

1999

# Emit D-Bus signal

2819

2000

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2820

# Need to initiate checking of clients

2821

if client.enabled:

2822

client.init_checker()

2001

client.enable()

2823

2002

2824

2003

tcp_server.enable()

2825

2004

tcp_server.server_activate()

2828

2007

service.port = tcp_server.socket.getsockname()[1]

2829

2008

if use_ipv6:

2830

2009

logger.info("Now listening on address %r, port %d,"

2831

" flowinfo %d, scope_id %d",

2832

*tcp_server.socket.getsockname())

2010

" flowinfo %d, scope_id %d"

2011

% tcp_server.socket.getsockname())

2833

2012

else: # IPv4

2834

logger.info("Now listening on address %r, port %d",

2835

*tcp_server.socket.getsockname())

2013

logger.info("Now listening on address %r, port %d"

2014

% tcp_server.socket.getsockname())

2836

2015

2837

2016

#service.interface = tcp_server.socket.getsockname()[3]

2838

2017

2840

2019

# From the Avahi example code

2841

2020

try:

2842

2021

service.activate()

2843

except dbus.exceptions.DBusException as error:

2844

logger.critical("D-Bus Exception", exc_info=error)

2022

except dbus.exceptions.DBusException, error:

2023

logger.critical("DBusException: %s", error)

2845

2024

cleanup()

2846

2025

sys.exit(1)

2847

2026

# End of Avahi example code

2853

2032

2854

2033

logger.debug("Starting main loop")

2855

2034

main_loop.run()

2856

except AvahiError as error:

2857

logger.critical("Avahi Error", exc_info=error)

2035

except AvahiError, error:

2036

logger.critical("AvahiError: %s", error)

2858

2037

cleanup()

2859

2038

sys.exit(1)

2860

2039

except KeyboardInterrupt: