/mandos/release : revision 237.7.226

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.6.7"

91

version = "1.6.4"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

114

def initlogger(debug, level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

global syslogger

118

117

syslogger = (logging.handlers.SysLogHandler

119

118

(facility =

120

119

logging.handlers.SysLogHandler.LOG_DAEMON,

338

337

elif state == avahi.ENTRY_GROUP_FAILURE:

339

338

logger.critical("Avahi: Error in group state changed %s",

340

339

unicode(error))

341

raise AvahiGroupError("State changed: {!s}"

340

raise AvahiGroupError("State changed: {0!s}"

342

341

.format(error))

343

342

344

343

def cleanup(self):

395

394

"""Add the new name to the syslog messages"""

396

395

ret = AvahiService.rename(self)

397

396

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

397

('Mandos ({0}) [%(process)d]:'

399

398

' %(levelname)s: %(message)s'

400

399

.format(self.name)))

401

400

return ret

402

401

403

402

403

def timedelta_to_milliseconds(td):

404

"Convert a datetime.timedelta() to milliseconds"

405

return ((td.days * 24 * 60 * 60 * 1000)

406

+ (td.seconds * 1000)

407

+ (td.microseconds // 1000))

408

409

404

410

class Client(object):

405

411

"""A representation of a client host served by this server.

406

412

461

467

"enabled": "True",

462

468

}

463

469

470

def timeout_milliseconds(self):

471

"Return the 'timeout' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.timeout)

473

474

def extended_timeout_milliseconds(self):

475

"Return the 'extended_timeout' attribute in milliseconds"

476

return timedelta_to_milliseconds(self.extended_timeout)

477

478

def interval_milliseconds(self):

479

"Return the 'interval' attribute in milliseconds"

480

return timedelta_to_milliseconds(self.interval)

481

482

def approval_delay_milliseconds(self):

483

return timedelta_to_milliseconds(self.approval_delay)

484

464

485

@staticmethod

465

486

def config_parser(config):

466

487

"""Construct a new dict of client settings of this form:

491

512

"rb") as secfile:

492

513

client["secret"] = secfile.read()

493

514

else:

494

raise TypeError("No secret or secfile for section {}"

515

raise TypeError("No secret or secfile for section {0}"

495

516

.format(section))

496

517

client["timeout"] = string_to_delta(section["timeout"])

497

518

client["extended_timeout"] = string_to_delta(

514

535

server_settings = {}

515

536

self.server_settings = server_settings

516

537

# adding all client settings

517

for setting, value in settings.items():

538

for setting, value in settings.iteritems():

518

539

setattr(self, setting, value)

519

540

520

541

if self.enabled:

603

624

if self.checker_initiator_tag is not None:

604

625

gobject.source_remove(self.checker_initiator_tag)

605

626

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

627

(self.interval_milliseconds(),

608

628

self.start_checker))

609

629

# Schedule a disable() when 'timeout' has passed

610

630

if self.disable_initiator_tag is not None:

611

631

gobject.source_remove(self.disable_initiator_tag)

612

632

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

633

(self.timeout_milliseconds(),

634

self.disable))

616

635

# Also start a new checker *right now*.

617

636

self.start_checker()

618

637

649

668

self.disable_initiator_tag = None

650

669

if getattr(self, "enabled", False):

651

670

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

671

(timedelta_to_milliseconds

672

(timeout), self.disable))

654

673

self.expires = datetime.datetime.utcnow() + timeout

655

674

656

675

def need_approval(self):

687

706

# Start a new checker if needed

688

707

if self.checker is None:

689

708

# Escape attributes for the shell

690

escaped_attrs = { attr:

691

re.escape(unicode(getattr(self,

692

attr)))

693

for attr in self.runtime_expansions }

709

escaped_attrs = dict(

710

(attr, re.escape(unicode(getattr(self, attr))))

711

for attr in

712

self.runtime_expansions)

694

713

try:

695

714

command = self.checker_command % escaped_attrs

696

715

except TypeError as error:

777

796

# "Set" method, so we fail early here:

778

797

if byte_arrays and signature != "ay":

779

798

raise ValueError("Byte arrays not supported for non-'ay'"

780

" signature {!r}".format(signature))

799

" signature {0!r}".format(signature))

781

800

def decorator(func):

782

801

func._dbus_is_property = True

783

802

func._dbus_interface = dbus_interface

862

881

If called like _is_dbus_thing("method") it returns a function

863

882

suitable for use as predicate to inspect.getmembers().

864

883

"""

865

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

884

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

866

885

False)

867

886

868

887

def _get_all_dbus_things(self, thing):

918

937

# signatures other than "ay".

919

938

if prop._dbus_signature != "ay":

920

939

raise ValueError("Byte arrays not supported for non-"

921

"'ay' signature {!r}"

940

"'ay' signature {0!r}"

922

941

.format(prop._dbus_signature))

923

942

value = dbus.ByteArray(b''.join(chr(byte)

924

943

for byte in value))

989

1008

(prop,

990

1009

"_dbus_annotations",

991

1010

{}))

992

for name, value in annots.items():

1011

for name, value in annots.iteritems():

993

1012

ann_tag = document.createElement(

994

1013

"annotation")

995

1014

ann_tag.setAttribute("name", name)

998

1017

# Add interface annotation tags

999

1018

for annotation, value in dict(

1000

1019

itertools.chain.from_iterable(

1001

annotations().items()

1020

annotations().iteritems()

1002

1021

for name, annotations in

1003

1022

self._get_all_dbus_things("interface")

1004

1023

if name == if_tag.getAttribute("name")

1005

)).items():

1024

)).iteritems():

1006

1025

ann_tag = document.createElement("annotation")

1007

1026

ann_tag.setAttribute("name", annotation)

1008

1027

ann_tag.setAttribute("value", value)

1064

1083

"""

1065

1084

def wrapper(cls):

1066

1085

for orig_interface_name, alt_interface_name in (

1067

alt_interface_names.items()):

1086

alt_interface_names.iteritems()):

1068

1087

attr = {}

1069

1088

interface_names = set()

1070

1089

# Go though all attributes of the class

1187

1206

attribute.func_closure)))

1188

1207

if deprecate:

1189

1208

# Deprecate all alternate interfaces

1190

iname="_AlternateDBusNames_interface_annotation{}"

1209

iname="_AlternateDBusNames_interface_annotation{0}"

1191

1210

for interface_name in interface_names:

1192

1211

@dbus_interface_annotations(interface_name)

1193

1212

def func(self):

1202

1221

if interface_names:

1203

1222

# Replace the class with a new subclass of it with

1204

1223

# methods, signals, etc. as created above.

1205

cls = type(b"{}Alternate".format(cls.__name__),

1224

cls = type(b"{0}Alternate".format(cls.__name__),

1206

1225

(cls,), attr)

1207

1226

return cls

1208

1227

return wrapper

1249

1268

to the D-Bus. Default: no transform

1250

1269

variant_level: D-Bus variant level. Default: 1

1251

1270

"""

1252

attrname = "_{}".format(dbus_name)

1271

attrname = "_{0}".format(dbus_name)

1253

1272

def setter(self, value):

1254

1273

if hasattr(self, "dbus_object_path"):

1255

1274

if (not hasattr(self, attrname) or

1285

1304

approval_delay = notifychangeproperty(dbus.UInt64,

1286

1305

"ApprovalDelay",

1287

1306

type_func =

1288

lambda td: td.total_seconds()

1289

* 1000)

1307

timedelta_to_milliseconds)

1290

1308

approval_duration = notifychangeproperty(

1291

1309

dbus.UInt64, "ApprovalDuration",

1292

type_func = lambda td: td.total_seconds() * 1000)

1310

type_func = timedelta_to_milliseconds)

1293

1311

host = notifychangeproperty(dbus.String, "Host")

1294

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1295

type_func = lambda td:

1296

td.total_seconds() * 1000)

1313

type_func =

1314

timedelta_to_milliseconds)

1297

1315

extended_timeout = notifychangeproperty(

1298

1316

dbus.UInt64, "ExtendedTimeout",

1299

type_func = lambda td: td.total_seconds() * 1000)

1317

type_func = timedelta_to_milliseconds)

1300

1318

interval = notifychangeproperty(dbus.UInt64,

1301

1319

"Interval",

1302

1320

type_func =

1303

lambda td: td.total_seconds()

1304

* 1000)

1321

timedelta_to_milliseconds)

1305

1322

checker_command = notifychangeproperty(dbus.String, "Checker")

1306

1323

1307

1324

del notifychangeproperty

1350

1367

1351

1368

def approve(self, value=True):

1352

1369

self.approved = value

1353

gobject.timeout_add(int(self.approval_duration.total_seconds()

1354

* 1000), self._reset_approved)

1370

gobject.timeout_add(timedelta_to_milliseconds

1371

(self.approval_duration),

1372

self._reset_approved)

1355

1373

self.send_changedstate()

1356

1374

1357

1375

## D-Bus methods, signals & properties

1460

1478

access="readwrite")

1461

1479

def ApprovalDelay_dbus_property(self, value=None):

1462

1480

if value is None: # get

1463

return dbus.UInt64(self.approval_delay.total_seconds()

1464

* 1000)

1481

return dbus.UInt64(self.approval_delay_milliseconds())

1465

1482

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1466

1483

1467

1484

# ApprovalDuration - property

1469

1486

access="readwrite")

1470

1487

def ApprovalDuration_dbus_property(self, value=None):

1471

1488

if value is None: # get

1472

return dbus.UInt64(self.approval_duration.total_seconds()

1473

* 1000)

1489

return dbus.UInt64(timedelta_to_milliseconds(

1490

self.approval_duration))

1474

1491

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1475

1492

1476

1493

# Name - property

1542

1559

access="readwrite")

1543

1560

def Timeout_dbus_property(self, value=None):

1544

1561

if value is None: # get

1545

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1562

return dbus.UInt64(self.timeout_milliseconds())

1546

1563

old_timeout = self.timeout

1547

1564

self.timeout = datetime.timedelta(0, 0, 0, value)

1548

1565

# Reschedule disabling

1559

1576

gobject.source_remove(self.disable_initiator_tag)

1560

1577

self.disable_initiator_tag = (

1561

1578

gobject.timeout_add(

1562

int((self.expires - now).total_seconds()

1563

* 1000), self.disable))

1579

timedelta_to_milliseconds(self.expires - now),

1580

self.disable))

1564

1581

1565

1582

# ExtendedTimeout - property

1566

1583

@dbus_service_property(_interface, signature="t",

1567

1584

access="readwrite")

1568

1585

def ExtendedTimeout_dbus_property(self, value=None):

1569

1586

if value is None: # get

1570

return dbus.UInt64(self.extended_timeout.total_seconds()

1571

* 1000)

1587

return dbus.UInt64(self.extended_timeout_milliseconds())

1572

1588

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1573

1589

1574

1590

# Interval - property

1576

1592

access="readwrite")

1577

1593

def Interval_dbus_property(self, value=None):

1578

1594

if value is None: # get

1579

return dbus.UInt64(self.interval.total_seconds() * 1000)

1595

return dbus.UInt64(self.interval_milliseconds())

1580

1596

self.interval = datetime.timedelta(0, 0, 0, value)

1581

1597

if getattr(self, "checker_initiator_tag", None) is None:

1582

1598

return

1742

1758

if self.server.use_dbus:

1743

1759

# Emit D-Bus signal

1744

1760

client.NeedApproval(

1745

client.approval_delay.total_seconds()

1746

* 1000, client.approved_by_default)

1761

client.approval_delay_milliseconds(),

1762

client.approved_by_default)

1747

1763

else:

1748

1764

logger.warning("Client %s was not approved",

1749

1765

client.name)

1755

1771

#wait until timeout or approved

1756

1772

time = datetime.datetime.now()

1757

1773

client.changedstate.acquire()

1758

client.changedstate.wait(delay.total_seconds())

1774

client.changedstate.wait(

1775

float(timedelta_to_milliseconds(delay)

1776

/ 1000))

1759

1777

client.changedstate.release()

1760

1778

time2 = datetime.datetime.now()

1761

1779

if (time2 - time) >= delay:

2169

2187

token_duration = Token(re.compile(r"P"), None,

2170

2188

frozenset((token_year, token_month,

2171

2189

token_day, token_time,

2172

token_week)))

2190

token_week))),

2173

2191

# Define starting values

2174

2192

value = datetime.timedelta() # Value so far

2175

2193

found_token = None

2176

followers = frozenset((token_duration,)) # Following valid tokens

2194

followers = frozenset(token_duration,) # Following valid tokens

2177

2195

s = duration # String left to parse

2178

2196

# Loop until end token is found

2179

2197

while found_token is not token_end:

2239

2257

elif suffix == "w":

2240

2258

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2241

2259

else:

2242

raise ValueError("Unknown suffix {!r}"

2260

raise ValueError("Unknown suffix {0!r}"

2243

2261

.format(suffix))

2244

2262

except IndexError as e:

2245

2263

raise ValueError(*(e.args))

2262

2280

# Close all standard open file descriptors

2263

2281

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2264

2282

if not stat.S_ISCHR(os.fstat(null).st_mode):

2265

raise OSError(errno.ENODEV, "{} not a character device"

2283

raise OSError(errno.ENODEV,

2284

"{0} not a character device"

2266

2285

.format(os.devnull))

2267

2286

os.dup2(null, sys.stdin.fileno())

2268

2287

os.dup2(null, sys.stdout.fileno())

2278

2297

2279

2298

parser = argparse.ArgumentParser()

2280

2299

parser.add_argument("-v", "--version", action="version",

2281

version = "%(prog)s {}".format(version),

2300

version = "%(prog)s {0}".format(version),

2282

2301

help="show version number and exit")

2283

2302

parser.add_argument("-i", "--interface", metavar="IF",

2284

2303

help="Bind to interface IF")

2317

2336

help="Directory to save/restore state in")

2318

2337

parser.add_argument("--foreground", action="store_true",

2319

2338

help="Run in foreground", default=None)

2320

parser.add_argument("--no-zeroconf", action="store_false",

2321

dest="zeroconf", help="Do not use Zeroconf",

2322

default=None)

2323

2339

2324

2340

options = parser.parse_args()

2325

2341

2343

2359

"socket": "",

2344

2360

"statedir": "/var/lib/mandos",

2345

2361

"foreground": "False",

2346

"zeroconf": "True",

2347

2362

}

2348

2363

2349

2364

# Parse config file for server-global settings

2376

2391

for option in ("interface", "address", "port", "debug",

2377

2392

"priority", "servicename", "configdir",

2378

2393

"use_dbus", "use_ipv6", "debuglevel", "restore",

2379

"statedir", "socket", "foreground", "zeroconf"):

2394

"statedir", "socket", "foreground"):

2380

2395

value = getattr(options, option)

2381

2396

if value is not None:

2382

2397

server_settings[option] = value

2387

2402

server_settings[option] = unicode(server_settings[option])

2388

2403

# Force all boolean options to be boolean

2389

2404

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2390

"foreground", "zeroconf"):

2405

"foreground"):

2391

2406

server_settings[option] = bool(server_settings[option])

2392

2407

# Debug implies foreground

2393

2408

if server_settings["debug"]:

2396

2411

2397

2412

##################################################################

2398

2413

2399

if (not server_settings["zeroconf"] and

2400

not (server_settings["port"]

2401

or server_settings["socket"] != "")):

2402

parser.error("Needs port or socket to work without"

2403

" Zeroconf")

2404

2405

2414

# For convenience

2406

2415

debug = server_settings["debug"]

2407

2416

debuglevel = server_settings["debuglevel"]

2410

2419

stored_state_path = os.path.join(server_settings["statedir"],

2411

2420

stored_state_file)

2412

2421

foreground = server_settings["foreground"]

2413

zeroconf = server_settings["zeroconf"]

2414

2422

2415

2423

if debug:

2416

2424

initlogger(debug, logging.DEBUG)

2423

2431

2424

2432

if server_settings["servicename"] != "Mandos":

2425

2433

syslogger.setFormatter(logging.Formatter

2426

('Mandos ({}) [%(process)d]:'

2434

('Mandos ({0}) [%(process)d]:'

2427

2435

' %(levelname)s: %(message)s'

2428

2436

.format(server_settings

2429

2437

["servicename"])))

2437

2445

global mandos_dbus_service

2438

2446

mandos_dbus_service = None

2439

2447

2440

socketfd = None

2441

if server_settings["socket"] != "":

2442

socketfd = server_settings["socket"]

2443

2448

tcp_server = MandosServer((server_settings["address"],

2444

2449

server_settings["port"]),

2445

2450

ClientHandler,

2449

2454

gnutls_priority=

2450

2455

server_settings["priority"],

2451

2456

use_dbus=use_dbus,

2452

socketfd=socketfd)

2457

socketfd=(server_settings["socket"]

2458

or None))

2453

2459

if not foreground:

2454

2460

pidfilename = "/run/mandos.pid"

2455

2461

if not os.path.isdir("/run/."):

2525

2531

use_dbus = False

2526

2532

server_settings["use_dbus"] = False

2527

2533

tcp_server.use_dbus = False

2528

if zeroconf:

2529

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2530

service = AvahiServiceToSyslog(name =

2531

server_settings["servicename"],

2532

servicetype = "_mandos._tcp",

2533

protocol = protocol, bus = bus)

2534

if server_settings["interface"]:

2535

service.interface = (if_nametoindex

2536

(str(server_settings["interface"])))

2534

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2535

service = AvahiServiceToSyslog(name =

2536

server_settings["servicename"],

2537

servicetype = "_mandos._tcp",

2538

protocol = protocol, bus = bus)

2539

if server_settings["interface"]:

2540

service.interface = (if_nametoindex

2541

(str(server_settings["interface"])))

2537

2542

2538

2543

global multiprocessing_manager

2539

2544

multiprocessing_manager = multiprocessing.Manager()

2563

2568

os.remove(stored_state_path)

2564

2569

except IOError as e:

2565

2570

if e.errno == errno.ENOENT:

2566

logger.warning("Could not load persistent state: {}"

2571

logger.warning("Could not load persistent state: {0}"

2567

2572

.format(os.strerror(e.errno)))

2568

2573

else:

2569

2574

logger.critical("Could not load persistent state:",

2574

2579

"EOFError:", exc_info=e)

2575

2580

2576

2581

with PGPEngine() as pgp:

2577

for client_name, client in clients_data.items():

2582

for client_name, client in clients_data.iteritems():

2578

2583

# Skip removed clients

2579

2584

if client_name not in client_settings:

2580

2585

continue

2605

2610

if datetime.datetime.utcnow() >= client["expires"]:

2606

2611

if not client["last_checked_ok"]:

2607

2612

logger.warning(

2608

"disabling client {} - Client never "

2613

"disabling client {0} - Client never "

2609

2614

"performed a successful checker"

2610

2615

.format(client_name))

2611

2616

client["enabled"] = False

2612

2617

elif client["last_checker_status"] != 0:

2613

2618

logger.warning(

2614

"disabling client {} - Client last"

2615

" checker failed with error code {}"

2619

"disabling client {0} - Client "

2620

"last checker failed with error code {1}"

2616

2621

.format(client_name,

2617

2622

client["last_checker_status"]))

2618

2623

client["enabled"] = False

2621

2626

.utcnow()

2622

2627

+ client["timeout"])

2623

2628

logger.debug("Last checker succeeded,"

2624

" keeping {} enabled"

2629

" keeping {0} enabled"

2625

2630

.format(client_name))

2626

2631

try:

2627

2632

client["secret"] = (

2630

2635

["secret"]))

2631

2636

except PGPError:

2632

2637

# If decryption fails, we use secret from new settings

2633

logger.debug("Failed to decrypt {} old secret"

2638

logger.debug("Failed to decrypt {0} old secret"

2634

2639

.format(client_name))

2635

2640

client["secret"] = (

2636

2641

client_settings[client_name]["secret"])

2644

2649

clients_data[client_name] = client_settings[client_name]

2645

2650

2646

2651

# Create all client objects

2647

for client_name, client in clients_data.items():

2652

for client_name, client in clients_data.iteritems():

2648

2653

tcp_server.clients[client_name] = client_class(

2649

2654

name = client_name, settings = client,

2650

2655

server_settings = server_settings)

2733

2738

2734

2739

def cleanup():

2735

2740

"Cleanup function; run on exit"

2736

if zeroconf:

2737

service.cleanup()

2741

service.cleanup()

2738

2742

2739

2743

multiprocessing.active_children()

2740

2744

wnull.close()

2754

2758

2755

2759

# A list of attributes that can not be pickled

2756

2760

# + secret.

2757

exclude = { "bus", "changedstate", "secret",

2758

"checker", "server_settings" }

2761

exclude = set(("bus", "changedstate", "secret",

2762

"checker", "server_settings"))

2759

2763

for name, typ in (inspect.getmembers

2760

2764

(dbus.service.Object)):

2761

2765

exclude.add(name)

2784

2788

except NameError:

2785

2789

pass

2786

2790

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2787

logger.warning("Could not save persistent state: {}"

2791

logger.warning("Could not save persistent state: {0}"

2788

2792

.format(os.strerror(e.errno)))

2789

2793

else:

2790

2794

logger.warning("Could not save persistent state:",

2819

2823

tcp_server.server_activate()

2820

2824

2821

2825

# Find out what port we got

2822

if zeroconf:

2823

service.port = tcp_server.socket.getsockname()[1]

2826

service.port = tcp_server.socket.getsockname()[1]

2824

2827

if use_ipv6:

2825

2828

logger.info("Now listening on address %r, port %d,"

2826

2829

" flowinfo %d, scope_id %d",

2832

2835

#service.interface = tcp_server.socket.getsockname()[3]

2833

2836

2834

2837

try:

2835

if zeroconf:

2836

# From the Avahi example code

2837

try:

2838

service.activate()

2839

except dbus.exceptions.DBusException as error:

2840

logger.critical("D-Bus Exception", exc_info=error)

2841

cleanup()

2842

sys.exit(1)

2843

# End of Avahi example code

2838

# From the Avahi example code

2839

try:

2840

service.activate()

2841

except dbus.exceptions.DBusException as error:

2842

logger.critical("D-Bus Exception", exc_info=error)

2843

cleanup()

2844

sys.exit(1)

2845

# End of Avahi example code

2844

2846

2845

2847

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2846

2848

lambda *args, **kwargs: