/mandos/release : revision 237.7.278

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.6.0"

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.8"

92

95

stored_state_file = "clients.pickle"

93

96

94

97

logger = logging.getLogger()

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

98

syslogger = None

98

99

100

try:

100

101

if_nametoindex = (ctypes.cdll.LoadLibrary

106

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

108

with contextlib.closing(socket.socket()) as s:

108

109

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

110

struct.pack(b"16s16x", interface))

111

interface_index = struct.unpack("I", ifreq[16:20])[0]

113

112

return interface_index

114

113

115

114

116

115

def initlogger(debug, level=logging.WARNING):

117

116

"""init logger and add loglevel"""

118

117

118

global syslogger

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

119

123

syslogger.setFormatter(logging.Formatter

120

124

('Mandos [%(process)d]: %(levelname)s:'

121

125

' %(message)s'))

172

176

def password_encode(self, password):

173

177

# Passphrase can not be empty and can not contain newlines or

174

178

# NUL bytes. So we prefix it and hex encode it.

175

return b"mandos" + binascii.hexlify(password)

179

encoded = b"mandos" + binascii.hexlify(password)

180

if len(encoded) > 2048:

181

# GnuPG can't handle long passwords, so encode differently

182

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

183

.replace(b"\n", b"\\n")

184

.replace(b"\0", b"\\x00"))

185

return encoded

176

186

177

187

def encrypt(self, data, password):

178

188

passphrase = self.password_encode(password)

215

225

class AvahiError(Exception):

216

226

def __init__(self, value, *args, **kwargs):

217

227

self.value = value

218

super(AvahiError, self).__init__(value, *args, **kwargs)

219

def __unicode__(self):

220

return unicode(repr(self.value))

228

return super(AvahiError, self).__init__(value, *args,

229

**kwargs)

221

230

222

231

class AvahiServiceError(AvahiError):

223

232

pass

273

282

" after %i retries, exiting.",

274

283

self.rename_count)

275

284

raise AvahiServiceError("Too many renames")

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

278

287

logger.info("Changing Zeroconf service name to %r ...",

279

288

self.name)

280

289

self.remove()

328

337

self.rename()

329

338

elif state == avahi.ENTRY_GROUP_FAILURE:

330

339

logger.critical("Avahi: Error in group state changed %s",

331

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

340

str(error))

341

raise AvahiGroupError("State changed: {!s}"

333

342

.format(error))

334

343

335

344

def cleanup(self):

386

395

"""Add the new name to the syslog messages"""

387

396

ret = AvahiService.rename(self)

388

397

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

398

('Mandos ({}) [%(process)d]:'

390

399

' %(levelname)s: %(message)s'

391

400

.format(self.name)))

392

401

return ret

393

402

394

403

395

def timedelta_to_milliseconds(td):

396

"Convert a datetime.timedelta() to milliseconds"

397

return ((td.days * 24 * 60 * 60 * 1000)

398

+ (td.seconds * 1000)

399

+ (td.microseconds // 1000))

400

401

402

404

class Client(object):

403

405

"""A representation of a client host served by this server.

404

406

459

461

"enabled": "True",

460

462

}

461

463

462

def timeout_milliseconds(self):

463

"Return the 'timeout' attribute in milliseconds"

464

return timedelta_to_milliseconds(self.timeout)

465

466

def extended_timeout_milliseconds(self):

467

"Return the 'extended_timeout' attribute in milliseconds"

468

return timedelta_to_milliseconds(self.extended_timeout)

469

470

def interval_milliseconds(self):

471

"Return the 'interval' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.interval)

473

474

def approval_delay_milliseconds(self):

475

return timedelta_to_milliseconds(self.approval_delay)

476

477

464

@staticmethod

478

465

def config_parser(config):

479

466

"""Construct a new dict of client settings of this form:

504

491

"rb") as secfile:

505

492

client["secret"] = secfile.read()

506

493

else:

507

raise TypeError("No secret or secfile for section {0}"

494

raise TypeError("No secret or secfile for section {}"

508

495

.format(section))

509

496

client["timeout"] = string_to_delta(section["timeout"])

510

497

client["extended_timeout"] = string_to_delta(

527

514

server_settings = {}

528

515

self.server_settings = server_settings

529

516

# adding all client settings

530

for setting, value in settings.iteritems():

517

for setting, value in settings.items():

531

518

setattr(self, setting, value)

532

519

533

520

if self.enabled:

616

603

if self.checker_initiator_tag is not None:

617

604

gobject.source_remove(self.checker_initiator_tag)

618

605

self.checker_initiator_tag = (gobject.timeout_add

619

(self.interval_milliseconds(),

606

(int(self.interval

607

.total_seconds() * 1000),

620

608

self.start_checker))

621

609

# Schedule a disable() when 'timeout' has passed

622

610

if self.disable_initiator_tag is not None:

623

611

gobject.source_remove(self.disable_initiator_tag)

624

612

self.disable_initiator_tag = (gobject.timeout_add

625

(self.timeout_milliseconds(),

626

self.disable))

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

627

616

# Also start a new checker *right now*.

628

617

self.start_checker()

629

618

660

649

self.disable_initiator_tag = None

661

650

if getattr(self, "enabled", False):

662

651

self.disable_initiator_tag = (gobject.timeout_add

663

(timedelta_to_milliseconds

664

(timeout), self.disable))

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

665

654

self.expires = datetime.datetime.utcnow() + timeout

666

655

667

656

def need_approval(self):

684

673

# If a checker exists, make sure it is not a zombie

685

674

try:

686

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

687

except (AttributeError, OSError) as error:

688

if (isinstance(error, OSError)

689

and error.errno != errno.ECHILD):

690

raise error

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

691

681

else:

692

682

if pid:

693

683

logger.warning("Checker was a zombie")

697

687

# Start a new checker if needed

698

688

if self.checker is None:

699

689

# Escape attributes for the shell

700

escaped_attrs = dict(

701

(attr, re.escape(unicode(getattr(self, attr))))

702

for attr in

703

self.runtime_expansions)

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

704

693

try:

705

694

command = self.checker_command % escaped_attrs

706

695

except TypeError as error:

787

776

# "Set" method, so we fail early here:

788

777

if byte_arrays and signature != "ay":

789

778

raise ValueError("Byte arrays not supported for non-'ay'"

790

" signature {0!r}".format(signature))

779

" signature {!r}".format(signature))

791

780

def decorator(func):

792

781

func._dbus_is_property = True

793

782

func._dbus_interface = dbus_interface

841

830

class DBusPropertyException(dbus.exceptions.DBusException):

842

831

"""A base class for D-Bus property-related exceptions

843

832

"""

844

def __unicode__(self):

845

return unicode(str(self))

846

833

pass

847

834

848

835

class DBusPropertyAccessException(DBusPropertyException):

849

836

"""A property's access permissions disallows an operation.

872

859

If called like _is_dbus_thing("method") it returns a function

873

860

suitable for use as predicate to inspect.getmembers().

874

861

"""

875

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

862

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

876

863

False)

877

864

878

865

def _get_all_dbus_things(self, thing):

927

914

# The byte_arrays option is not supported yet on

928

915

# signatures other than "ay".

929

916

if prop._dbus_signature != "ay":

930

raise ValueError

917

raise ValueError("Byte arrays not supported for non-"

918

"'ay' signature {!r}"

919

.format(prop._dbus_signature))

931

920

value = dbus.ByteArray(b''.join(chr(byte)

932

921

for byte in value))

933

922

prop(value)

997

986

(prop,

998

987

"_dbus_annotations",

999

988

{}))

1000

for name, value in annots.iteritems():

989

for name, value in annots.items():

1001

990

ann_tag = document.createElement(

1002

991

"annotation")

1003

992

ann_tag.setAttribute("name", name)

1006

995

# Add interface annotation tags

1007

996

for annotation, value in dict(

1008

997

itertools.chain.from_iterable(

1009

annotations().iteritems()

998

annotations().items()

1010

999

for name, annotations in

1011

1000

self._get_all_dbus_things("interface")

1012

1001

if name == if_tag.getAttribute("name")

1013

)).iteritems():

1002

)).items():

1014

1003

ann_tag = document.createElement("annotation")

1015

1004

ann_tag.setAttribute("name", annotation)

1016

1005

ann_tag.setAttribute("value", value)

1072

1061

"""

1073

1062

def wrapper(cls):

1074

1063

for orig_interface_name, alt_interface_name in (

1075

alt_interface_names.iteritems()):

1064

alt_interface_names.items()):

1076

1065

attr = {}

1077

1066

interface_names = set()

1078

1067

# Go though all attributes of the class

1195

1184

attribute.func_closure)))

1196

1185

if deprecate:

1197

1186

# Deprecate all alternate interfaces

1198

iname="_AlternateDBusNames_interface_annotation{0}"

1187

iname="_AlternateDBusNames_interface_annotation{}"

1199

1188

for interface_name in interface_names:

1200

1189

@dbus_interface_annotations(interface_name)

1201

1190

def func(self):

1210

1199

if interface_names:

1211

1200

# Replace the class with a new subclass of it with

1212

1201

# methods, signals, etc. as created above.

1213

cls = type(b"{0}Alternate".format(cls.__name__),

1202

cls = type(b"{}Alternate".format(cls.__name__),

1214

1203

(cls,), attr)

1215

1204

return cls

1216

1205

return wrapper

1236

1225

Client.__init__(self, *args, **kwargs)

1237

1226

# Only now, when this client is initialized, can it show up on

1238

1227

# the D-Bus

1239

client_object_name = unicode(self.name).translate(

1228

client_object_name = str(self.name).translate(

1240

1229

{ord("."): ord("_"),

1241

1230

ord("-"): ord("_")})

1242

1231

self.dbus_object_path = (dbus.ObjectPath

1257

1246

to the D-Bus. Default: no transform

1258

1247

variant_level: D-Bus variant level. Default: 1

1259

1248

"""

1260

attrname = "_{0}".format(dbus_name)

1249

attrname = "_{}".format(dbus_name)

1261

1250

def setter(self, value):

1262

1251

if hasattr(self, "dbus_object_path"):

1263

1252

if (not hasattr(self, attrname) or

1293

1282

approval_delay = notifychangeproperty(dbus.UInt64,

1294

1283

"ApprovalDelay",

1295

1284

type_func =

1296

timedelta_to_milliseconds)

1285

lambda td: td.total_seconds()

1286

* 1000)

1297

1287

approval_duration = notifychangeproperty(

1298

1288

dbus.UInt64, "ApprovalDuration",

1299

type_func = timedelta_to_milliseconds)

1289

type_func = lambda td: td.total_seconds() * 1000)

1300

1290

host = notifychangeproperty(dbus.String, "Host")

1301

1291

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1302

type_func =

1303

timedelta_to_milliseconds)

1292

type_func = lambda td:

1293

td.total_seconds() * 1000)

1304

1294

extended_timeout = notifychangeproperty(

1305

1295

dbus.UInt64, "ExtendedTimeout",

1306

type_func = timedelta_to_milliseconds)

1296

type_func = lambda td: td.total_seconds() * 1000)

1307

1297

interval = notifychangeproperty(dbus.UInt64,

1308

1298

"Interval",

1309

1299

type_func =

1310

timedelta_to_milliseconds)

1300

lambda td: td.total_seconds()

1301

* 1000)

1311

1302

checker_command = notifychangeproperty(dbus.String, "Checker")

1312

1303

1313

1304

del notifychangeproperty

1341

1332

*args, **kwargs)

1342

1333

1343

1334

def start_checker(self, *args, **kwargs):

1344

old_checker = self.checker

1345

if self.checker is not None:

1346

old_checker_pid = self.checker.pid

1347

else:

1348

old_checker_pid = None

1335

old_checker_pid = getattr(self.checker, "pid", None)

1349

1336

r = Client.start_checker(self, *args, **kwargs)

1350

1337

# Only if new checker process was started

1351

1338

if (self.checker is not None

1360

1347

1361

1348

def approve(self, value=True):

1362

1349

self.approved = value

1363

gobject.timeout_add(timedelta_to_milliseconds

1364

(self.approval_duration),

1365

self._reset_approved)

1350

gobject.timeout_add(int(self.approval_duration.total_seconds()

1351

* 1000), self._reset_approved)

1366

1352

self.send_changedstate()

1367

1353

1368

1354

## D-Bus methods, signals & properties

1471

1457

access="readwrite")

1472

1458

def ApprovalDelay_dbus_property(self, value=None):

1473

1459

if value is None: # get

1474

return dbus.UInt64(self.approval_delay_milliseconds())

1460

return dbus.UInt64(self.approval_delay.total_seconds()

1461

* 1000)

1475

1462

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1476

1463

1477

1464

# ApprovalDuration - property

1479

1466

access="readwrite")

1480

1467

def ApprovalDuration_dbus_property(self, value=None):

1481

1468

if value is None: # get

1482

return dbus.UInt64(timedelta_to_milliseconds(

1483

self.approval_duration))

1469

return dbus.UInt64(self.approval_duration.total_seconds()

1470

* 1000)

1484

1471

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1485

1472

1486

1473

# Name - property

1499

1486

def Host_dbus_property(self, value=None):

1500

1487

if value is None: # get

1501

1488

return dbus.String(self.host)

1502

self.host = unicode(value)

1489

self.host = str(value)

1503

1490

1504

1491

# Created - property

1505

1492

@dbus_service_property(_interface, signature="s", access="read")

1552

1539

access="readwrite")

1553

1540

def Timeout_dbus_property(self, value=None):

1554

1541

if value is None: # get

1555

return dbus.UInt64(self.timeout_milliseconds())

1542

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1556

1543

old_timeout = self.timeout

1557

1544

self.timeout = datetime.timedelta(0, 0, 0, value)

1558

1545

# Reschedule disabling

1569

1556

gobject.source_remove(self.disable_initiator_tag)

1570

1557

self.disable_initiator_tag = (

1571

1558

gobject.timeout_add(

1572

timedelta_to_milliseconds(self.expires - now),

1573

self.disable))

1559

int((self.expires - now).total_seconds()

1560

* 1000), self.disable))

1574

1561

1575

1562

# ExtendedTimeout - property

1576

1563

@dbus_service_property(_interface, signature="t",

1577

1564

access="readwrite")

1578

1565

def ExtendedTimeout_dbus_property(self, value=None):

1579

1566

if value is None: # get

1580

return dbus.UInt64(self.extended_timeout_milliseconds())

1567

return dbus.UInt64(self.extended_timeout.total_seconds()

1568

* 1000)

1581

1569

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1582

1570

1583

1571

# Interval - property

1585

1573

access="readwrite")

1586

1574

def Interval_dbus_property(self, value=None):

1587

1575

if value is None: # get

1588

return dbus.UInt64(self.interval_milliseconds())

1576

return dbus.UInt64(self.interval.total_seconds() * 1000)

1589

1577

self.interval = datetime.timedelta(0, 0, 0, value)

1590

1578

if getattr(self, "checker_initiator_tag", None) is None:

1591

1579

return

1602

1590

def Checker_dbus_property(self, value=None):

1603

1591

if value is None: # get

1604

1592

return dbus.String(self.checker_command)

1605

self.checker_command = unicode(value)

1593

self.checker_command = str(value)

1606

1594

1607

1595

# CheckerRunning - property

1608

1596

@dbus_service_property(_interface, signature="b",

1624

1612

@dbus_service_property(_interface, signature="ay",

1625

1613

access="write", byte_arrays=True)

1626

1614

def Secret_dbus_property(self, value):

1627

self.secret = str(value)

1615

self.secret = bytes(value)

1628

1616

1629

1617

del _interface

1630

1618

1664

1652

def handle(self):

1665

1653

with contextlib.closing(self.server.child_pipe) as child_pipe:

1666

1654

logger.info("TCP connection from: %s",

1667

unicode(self.client_address))

1655

str(self.client_address))

1668

1656

logger.debug("Pipe FD: %d",

1669

1657

self.server.child_pipe.fileno())

1670

1658

1696

1684

logger.debug("Protocol version: %r", line)

1697

1685

try:

1698

1686

if int(line.strip().split()[0]) > 1:

1699

raise RuntimeError

1687

raise RuntimeError(line)

1700

1688

except (ValueError, IndexError, RuntimeError) as error:

1701

1689

logger.error("Unknown protocol version: %s", error)

1702

1690

return

1751

1739

if self.server.use_dbus:

1752

1740

# Emit D-Bus signal

1753

1741

client.NeedApproval(

1754

client.approval_delay_milliseconds(),

1755

client.approved_by_default)

1742

client.approval_delay.total_seconds()

1743

* 1000, client.approved_by_default)

1756

1744

else:

1757

1745

logger.warning("Client %s was not approved",

1758

1746

client.name)

1764

1752

#wait until timeout or approved

1765

1753

time = datetime.datetime.now()

1766

1754

client.changedstate.acquire()

1767

client.changedstate.wait(

1768

float(timedelta_to_milliseconds(delay)

1769

/ 1000))

1755

client.changedstate.wait(delay.total_seconds())

1770

1756

client.changedstate.release()

1771

1757

time2 = datetime.datetime.now()

1772

1758

if (time2 - time) >= delay:

1909

1895

1910

1896

def add_pipe(self, parent_pipe, proc):

1911

1897

"""Dummy function; override as necessary"""

1912

raise NotImplementedError

1898

raise NotImplementedError()

1913

1899

1914

1900

1915

1901

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1971

1957

try:

1972

1958

self.socket.setsockopt(socket.SOL_SOCKET,

1973

1959

SO_BINDTODEVICE,

1974

str(self.interface + '\0'))

1960

(self.interface + "\0")

1961

.encode("utf-8"))

1975

1962

except socket.error as error:

1976

1963

if error.errno == errno.EPERM:

1977

1964

logger.error("No permission to bind to"

2180

2167

token_duration = Token(re.compile(r"P"), None,

2181

2168

frozenset((token_year, token_month,

2182

2169

token_day, token_time,

2183

token_week))),

2170

token_week)))

2184

2171

# Define starting values

2185

2172

value = datetime.timedelta() # Value so far

2186

2173

found_token = None

2187

followers = frozenset(token_duration,) # Following valid tokens

2174

followers = frozenset((token_duration,)) # Following valid tokens

2188

2175

s = duration # String left to parse

2189

2176

# Loop until end token is found

2190

2177

while found_token is not token_end:

2237

2224

timevalue = datetime.timedelta(0)

2238

2225

for s in interval.split():

2239

2226

try:

2240

suffix = unicode(s[-1])

2227

suffix = s[-1]

2241

2228

value = int(s[:-1])

2242

2229

if suffix == "d":

2243

2230

delta = datetime.timedelta(value)

2250

2237

elif suffix == "w":

2251

2238

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2252

2239

else:

2253

raise ValueError("Unknown suffix {0!r}"

2240

raise ValueError("Unknown suffix {!r}"

2254

2241

.format(suffix))

2255

except (ValueError, IndexError) as e:

2242

except IndexError as e:

2256

2243

raise ValueError(*(e.args))

2257

2244

timevalue += delta

2258

2245

return timevalue

2273

2260

# Close all standard open file descriptors

2274

2261

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2275

2262

if not stat.S_ISCHR(os.fstat(null).st_mode):

2276

raise OSError(errno.ENODEV,

2277

"{0} not a character device"

2263

raise OSError(errno.ENODEV, "{} not a character device"

2278

2264

.format(os.devnull))

2279

2265

os.dup2(null, sys.stdin.fileno())

2280

2266

os.dup2(null, sys.stdout.fileno())

2290

2276

2291

2277

parser = argparse.ArgumentParser()

2292

2278

parser.add_argument("-v", "--version", action="version",

2293

version = "%(prog)s {0}".format(version),

2279

version = "%(prog)s {}".format(version),

2294

2280

help="show version number and exit")

2295

2281

parser.add_argument("-i", "--interface", metavar="IF",

2296

2282

help="Bind to interface IF")

2329

2315

help="Directory to save/restore state in")

2330

2316

parser.add_argument("--foreground", action="store_true",

2331

2317

help="Run in foreground", default=None)

2318

parser.add_argument("--no-zeroconf", action="store_false",

2319

dest="zeroconf", help="Do not use Zeroconf",

2320

default=None)

2332

2321

2333

2322

options = parser.parse_args()

2334

2323

2335

2324

if options.check:

2336

2325

import doctest

2337

doctest.testmod()

2338

sys.exit()

2326

fail_count, test_count = doctest.testmod()

2327

sys.exit(os.EX_OK if fail_count == 0 else 1)

2339

2328

2340

2329

# Default values for config file for server-global settings

2341

2330

server_defaults = { "interface": "",

2343

2332

"port": "",

2344

2333

"debug": "False",

2345

2334

"priority":

2346

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",

2335

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2347

2336

"servicename": "Mandos",

2348

2337

"use_dbus": "True",

2349

2338

"use_ipv6": "True",

2352

2341

"socket": "",

2353

2342

"statedir": "/var/lib/mandos",

2354

2343

"foreground": "False",

2344

"zeroconf": "True",

2355

2345

}

2356

2346

2357

2347

# Parse config file for server-global settings

2384

2374

for option in ("interface", "address", "port", "debug",

2385

2375

"priority", "servicename", "configdir",

2386

2376

"use_dbus", "use_ipv6", "debuglevel", "restore",

2387

"statedir", "socket", "foreground"):

2377

"statedir", "socket", "foreground", "zeroconf"):

2388

2378

value = getattr(options, option)

2389

2379

if value is not None:

2390

2380

server_settings[option] = value

2391

2381

del options

2392

2382

# Force all strings to be unicode

2393

2383

for option in server_settings.keys():

2394

if type(server_settings[option]) is str:

2395

server_settings[option] = unicode(server_settings[option])

2384

if isinstance(server_settings[option], bytes):

2385

server_settings[option] = (server_settings[option]

2386

.decode("utf-8"))

2396

2387

# Force all boolean options to be boolean

2397

2388

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2398

"foreground"):

2389

"foreground", "zeroconf"):

2399

2390

server_settings[option] = bool(server_settings[option])

2400

2391

# Debug implies foreground

2401

2392

if server_settings["debug"]:

2404

2395

2405

2396

##################################################################

2406

2397

2398

if (not server_settings["zeroconf"] and

2399

not (server_settings["port"]

2400

or server_settings["socket"] != "")):

2401

parser.error("Needs port or socket to work without"

2402

" Zeroconf")

2403

2407

2404

# For convenience

2408

2405

debug = server_settings["debug"]

2409

2406

debuglevel = server_settings["debuglevel"]

2412

2409

stored_state_path = os.path.join(server_settings["statedir"],

2413

2410

stored_state_file)

2414

2411

foreground = server_settings["foreground"]

2412

zeroconf = server_settings["zeroconf"]

2415

2413

2416

2414

if debug:

2417

2415

initlogger(debug, logging.DEBUG)

2424

2422

2425

2423

if server_settings["servicename"] != "Mandos":

2426

2424

syslogger.setFormatter(logging.Formatter

2427

('Mandos ({0}) [%(process)d]:'

2425

('Mandos ({}) [%(process)d]:'

2428

2426

' %(levelname)s: %(message)s'

2429

2427

.format(server_settings

2430

2428

["servicename"])))

2438

2436

global mandos_dbus_service

2439

2437

mandos_dbus_service = None

2440

2438

2439

socketfd = None

2440

if server_settings["socket"] != "":

2441

socketfd = server_settings["socket"]

2441

2442

tcp_server = MandosServer((server_settings["address"],

2442

2443

server_settings["port"]),

2443

2444

ClientHandler,

2447

2448

gnutls_priority=

2448

2449

server_settings["priority"],

2449

2450

use_dbus=use_dbus,

2450

socketfd=(server_settings["socket"]

2451

or None))

2451

socketfd=socketfd)

2452

if not foreground:

2453

pidfilename = "/var/run/mandos.pid"

2453

pidfilename = "/run/mandos.pid"

2454

if not os.path.isdir("/run/."):

2455

pidfilename = "/var/run/mandos.pid"

2454

2456

pidfile = None

2455

2457

try:

2456

2458

pidfile = open(pidfilename, "w")

2473

2475

os.setuid(uid)

2474

2476

except OSError as error:

2475

2477

if error.errno != errno.EPERM:

2476

raise error

2478

raise

2477

2479

2478

2480

if debug:

2479

2481

# Enable all possible GnuTLS debugging

2522

2524

use_dbus = False

2523

2525

server_settings["use_dbus"] = False

2524

2526

tcp_server.use_dbus = False

2525

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2526

service = AvahiServiceToSyslog(name =

2527

server_settings["servicename"],

2528

servicetype = "_mandos._tcp",

2529

protocol = protocol, bus = bus)

2530

if server_settings["interface"]:

2531

service.interface = (if_nametoindex

2532

(str(server_settings["interface"])))

2527

if zeroconf:

2528

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2529

service = AvahiServiceToSyslog(name =

2530

server_settings["servicename"],

2531

servicetype = "_mandos._tcp",

2532

protocol = protocol, bus = bus)

2533

if server_settings["interface"]:

2534

service.interface = (if_nametoindex

2535

(server_settings["interface"]

2536

.encode("utf-8")))

2533

2537

2534

2538

global multiprocessing_manager

2535

2539

multiprocessing_manager = multiprocessing.Manager()

2559

2563

os.remove(stored_state_path)

2560

2564

except IOError as e:

2561

2565

if e.errno == errno.ENOENT:

2562

logger.warning("Could not load persistent state: {0}"

2566

logger.warning("Could not load persistent state: {}"

2563

2567

.format(os.strerror(e.errno)))

2564

2568

else:

2565

2569

logger.critical("Could not load persistent state:",

2570

2574

"EOFError:", exc_info=e)

2571

2575

2572

2576

with PGPEngine() as pgp:

2573

for client_name, client in clients_data.iteritems():

2577

for client_name, client in clients_data.items():

2574

2578

# Skip removed clients

2575

2579

if client_name not in client_settings:

2576

2580

continue

2601

2605

if datetime.datetime.utcnow() >= client["expires"]:

2602

2606

if not client["last_checked_ok"]:

2603

2607

logger.warning(

2604

"disabling client {0} - Client never "

2608

"disabling client {} - Client never "

2605

2609

"performed a successful checker"

2606

2610

.format(client_name))

2607

2611

client["enabled"] = False

2608

2612

elif client["last_checker_status"] != 0:

2609

2613

logger.warning(

2610

"disabling client {0} - Client "

2611

"last checker failed with error code {1}"

2614

"disabling client {} - Client last"

2615

" checker failed with error code {}"

2612

2616

.format(client_name,

2613

2617

client["last_checker_status"]))

2614

2618

client["enabled"] = False

2617

2621

.utcnow()

2618

2622

+ client["timeout"])

2619

2623

logger.debug("Last checker succeeded,"

2620

" keeping {0} enabled"

2624

" keeping {} enabled"

2621

2625

.format(client_name))

2622

2626

try:

2623

2627

client["secret"] = (

2626

2630

["secret"]))

2627

2631

except PGPError:

2628

2632

# If decryption fails, we use secret from new settings

2629

logger.debug("Failed to decrypt {0} old secret"

2633

logger.debug("Failed to decrypt {} old secret"

2630

2634

.format(client_name))

2631

2635

client["secret"] = (

2632

2636

client_settings[client_name]["secret"])

2640

2644

clients_data[client_name] = client_settings[client_name]

2641

2645

2642

2646

# Create all client objects

2643

for client_name, client in clients_data.iteritems():

2647

for client_name, client in clients_data.items():

2644

2648

tcp_server.clients[client_name] = client_class(

2645

2649

name = client_name, settings = client,

2646

2650

server_settings = server_settings)

2653

2657

try:

2654

2658

with pidfile:

2655

2659

pid = os.getpid()

2656

pidfile.write(str(pid) + "\n".encode("utf-8"))

2660

pidfile.write("{}\n".format(pid).encode("utf-8"))

2657

2661

except IOError:

2658

2662

logger.error("Could not write to file %r with PID %d",

2659

2663

pidfilename, pid)

2729

2733

2730

2734

def cleanup():

2731

2735

"Cleanup function; run on exit"

2732

service.cleanup()

2736

if zeroconf:

2737

service.cleanup()

2733

2738

2734

2739

multiprocessing.active_children()

2735

2740

wnull.close()

2749

2754

2750

2755

# A list of attributes that can not be pickled

2751

2756

# + secret.

2752

exclude = set(("bus", "changedstate", "secret",

2753

"checker", "server_settings"))

2757

exclude = { "bus", "changedstate", "secret",

2758

"checker", "server_settings" }

2754

2759

for name, typ in (inspect.getmembers

2755

2760

(dbus.service.Object)):

2756

2761

exclude.add(name)

2779

2784

except NameError:

2780

2785

pass

2781

2786

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2782

logger.warning("Could not save persistent state: {0}"

2787

logger.warning("Could not save persistent state: {}"

2783

2788

.format(os.strerror(e.errno)))

2784

2789

else:

2785

2790

logger.warning("Could not save persistent state:",

2786

2791

exc_info=e)

2787

raise e

2792

raise

2788

2793

2789

2794

# Delete all clients, and settings from config

2790

2795

while tcp_server.clients:

2814

2819

tcp_server.server_activate()

2815

2820

2816

2821

# Find out what port we got

2817

service.port = tcp_server.socket.getsockname()[1]

2822

if zeroconf:

2823

service.port = tcp_server.socket.getsockname()[1]

2818

2824

if use_ipv6:

2819

2825

logger.info("Now listening on address %r, port %d,"

2820

2826

" flowinfo %d, scope_id %d",

2826

2832

#service.interface = tcp_server.socket.getsockname()[3]

2827

2833

2828

2834

try:

2829

# From the Avahi example code

2830

try:

2831

service.activate()

2832

except dbus.exceptions.DBusException as error:

2833

logger.critical("D-Bus Exception", exc_info=error)

2834

cleanup()

2835

sys.exit(1)

2836

# End of Avahi example code

2835

if zeroconf:

2836

# From the Avahi example code

2837

try:

2838

service.activate()

2839

except dbus.exceptions.DBusException as error:

2840

logger.critical("D-Bus Exception", exc_info=error)

2841

cleanup()

2842

sys.exit(1)

2843

# End of Avahi example code

2837

2844

2838

2845

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2839

2846

lambda *args, **kwargs: