/mandos/release : revision 237.7.281

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.6.2"

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.8"

92

95

stored_state_file = "clients.pickle"

93

96

94

97

logger = logging.getLogger()

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

98

syslogger = None

98

99

100

try:

100

101

if_nametoindex = (ctypes.cdll.LoadLibrary

106

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

108

with contextlib.closing(socket.socket()) as s:

108

109

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

110

struct.pack(b"16s16x", interface))

111

interface_index = struct.unpack("I", ifreq[16:20])[0]

113

112

return interface_index

114

113

115

114

116

115

def initlogger(debug, level=logging.WARNING):

117

116

"""init logger and add loglevel"""

118

117

118

global syslogger

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

119

123

syslogger.setFormatter(logging.Formatter

120

124

('Mandos [%(process)d]: %(levelname)s:'

121

125

' %(message)s'))

221

225

class AvahiError(Exception):

222

226

def __init__(self, value, *args, **kwargs):

223

227

self.value = value

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

228

return super(AvahiError, self).__init__(value, *args,

229

**kwargs)

227

230

228

231

class AvahiServiceError(AvahiError):

229

232

pass

279

282

" after %i retries, exiting.",

280

283

self.rename_count)

281

284

raise AvahiServiceError("Too many renames")

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

284

287

logger.info("Changing Zeroconf service name to %r ...",

285

288

self.name)

286

289

self.remove()

334

337

self.rename()

335

338

elif state == avahi.ENTRY_GROUP_FAILURE:

336

339

logger.critical("Avahi: Error in group state changed %s",

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

340

str(error))

341

raise AvahiGroupError("State changed: {!s}"

339

342

.format(error))

340

343

341

344

def cleanup(self):

392

395

"""Add the new name to the syslog messages"""

393

396

ret = AvahiService.rename(self)

394

397

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

398

('Mandos ({}) [%(process)d]:'

396

399

' %(levelname)s: %(message)s'

397

400

.format(self.name)))

398

401

return ret

399

402

400

403

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

407

408

404

class Client(object):

409

405

"""A representation of a client host served by this server.

410

406

465

461

"enabled": "True",

466

462

}

467

463

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

482

483

464

@staticmethod

484

465

def config_parser(config):

485

466

"""Construct a new dict of client settings of this form:

510

491

"rb") as secfile:

511

492

client["secret"] = secfile.read()

512

493

else:

513

raise TypeError("No secret or secfile for section {0}"

494

raise TypeError("No secret or secfile for section {}"

514

495

.format(section))

515

496

client["timeout"] = string_to_delta(section["timeout"])

516

497

client["extended_timeout"] = string_to_delta(

533

514

server_settings = {}

534

515

self.server_settings = server_settings

535

516

# adding all client settings

536

for setting, value in settings.iteritems():

517

for setting, value in settings.items():

537

518

setattr(self, setting, value)

538

519

539

520

if self.enabled:

622

603

if self.checker_initiator_tag is not None:

623

604

gobject.source_remove(self.checker_initiator_tag)

624

605

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

606

(int(self.interval

607

.total_seconds() * 1000),

626

608

self.start_checker))

627

609

# Schedule a disable() when 'timeout' has passed

628

610

if self.disable_initiator_tag is not None:

629

611

gobject.source_remove(self.disable_initiator_tag)

630

612

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

633

616

# Also start a new checker *right now*.

634

617

self.start_checker()

635

618

666

649

self.disable_initiator_tag = None

667

650

if getattr(self, "enabled", False):

668

651

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

671

654

self.expires = datetime.datetime.utcnow() + timeout

672

655

673

656

def need_approval(self):

690

673

# If a checker exists, make sure it is not a zombie

691

674

try:

692

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except (AttributeError, OSError) as error:

694

if (isinstance(error, OSError)

695

and error.errno != errno.ECHILD):

696

raise error

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

697

681

else:

698

682

if pid:

699

683

logger.warning("Checker was a zombie")

703

687

# Start a new checker if needed

704

688

if self.checker is None:

705

689

# Escape attributes for the shell

706

escaped_attrs = dict(

707

(attr, re.escape(unicode(getattr(self, attr))))

708

for attr in

709

self.runtime_expansions)

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

710

693

try:

711

694

command = self.checker_command % escaped_attrs

712

695

except TypeError as error:

793

776

# "Set" method, so we fail early here:

794

777

if byte_arrays and signature != "ay":

795

778

raise ValueError("Byte arrays not supported for non-'ay'"

796

" signature {0!r}".format(signature))

779

" signature {!r}".format(signature))

797

780

def decorator(func):

798

781

func._dbus_is_property = True

799

782

func._dbus_interface = dbus_interface

830

813

"""Decorator to annotate D-Bus methods, signals or properties

831

814

Usage:

832

815

816

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

817

"org.freedesktop.DBus.Property."

818

"EmitsChangedSignal": "false"})

833

819

@dbus_service_property("org.example.Interface", signature="b",

834

820

access="r")

835

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

836

"org.freedesktop.DBus.Property."

837

"EmitsChangedSignal": "false"})

838

821

def Property_dbus_property(self):

839

822

return dbus.Boolean(False)

840

823

"""

847

830

class DBusPropertyException(dbus.exceptions.DBusException):

848

831

"""A base class for D-Bus property-related exceptions

849

832

"""

850

def __unicode__(self):

851

return unicode(str(self))

852

833

pass

853

834

854

835

class DBusPropertyAccessException(DBusPropertyException):

855

836

"""A property's access permissions disallows an operation.

878

859

If called like _is_dbus_thing("method") it returns a function

879

860

suitable for use as predicate to inspect.getmembers().

880

861

"""

881

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

862

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

882

863

False)

883

864

884

865

def _get_all_dbus_things(self, thing):

933

914

# The byte_arrays option is not supported yet on

934

915

# signatures other than "ay".

935

916

if prop._dbus_signature != "ay":

936

raise ValueError

917

raise ValueError("Byte arrays not supported for non-"

918

"'ay' signature {!r}"

919

.format(prop._dbus_signature))

937

920

value = dbus.ByteArray(b''.join(chr(byte)

938

921

for byte in value))

939

922

prop(value)

963

946

value.variant_level+1)

964

947

return dbus.Dictionary(properties, signature="sv")

965

948

949

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

950

def PropertiesChanged(self, interface_name, changed_properties,

951

invalidated_properties):

952

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

953

standard.

954

"""

955

pass

956

966

957

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

967

958

out_signature="s",

968

959

path_keyword='object_path',

1003

994

(prop,

1004

995

"_dbus_annotations",

1005

996

{}))

1006

for name, value in annots.iteritems():

997

for name, value in annots.items():

1007

998

ann_tag = document.createElement(

1008

999

"annotation")

1009

1000

ann_tag.setAttribute("name", name)

1012

1003

# Add interface annotation tags

1013

1004

for annotation, value in dict(

1014

1005

itertools.chain.from_iterable(

1015

annotations().iteritems()

1006

annotations().items()

1016

1007

for name, annotations in

1017

1008

self._get_all_dbus_things("interface")

1018

1009

if name == if_tag.getAttribute("name")

1019

)).iteritems():

1010

)).items():

1020

1011

ann_tag = document.createElement("annotation")

1021

1012

ann_tag.setAttribute("name", annotation)

1022

1013

ann_tag.setAttribute("value", value)

1078

1069

"""

1079

1070

def wrapper(cls):

1080

1071

for orig_interface_name, alt_interface_name in (

1081

alt_interface_names.iteritems()):

1072

alt_interface_names.items()):

1082

1073

attr = {}

1083

1074

interface_names = set()

1084

1075

# Go though all attributes of the class

1201

1192

attribute.func_closure)))

1202

1193

if deprecate:

1203

1194

# Deprecate all alternate interfaces

1204

iname="_AlternateDBusNames_interface_annotation{0}"

1195

iname="_AlternateDBusNames_interface_annotation{}"

1205

1196

for interface_name in interface_names:

1206

1197

@dbus_interface_annotations(interface_name)

1207

1198

def func(self):

1216

1207

if interface_names:

1217

1208

# Replace the class with a new subclass of it with

1218

1209

# methods, signals, etc. as created above.

1219

cls = type(b"{0}Alternate".format(cls.__name__),

1210

cls = type(b"{}Alternate".format(cls.__name__),

1220

1211

(cls,), attr)

1221

1212

return cls

1222

1213

return wrapper

1235

1226

runtime_expansions = (Client.runtime_expansions

1236

1227

+ ("dbus_object_path",))

1237

1228

1229

_interface = "se.recompile.Mandos.Client"

1230

1238

1231

# dbus.service.Object doesn't use super(), so we can't either.

1239

1232

1240

1233

def __init__(self, bus = None, *args, **kwargs):

1242

1235

Client.__init__(self, *args, **kwargs)

1243

1236

# Only now, when this client is initialized, can it show up on

1244

1237

# the D-Bus

1245

client_object_name = unicode(self.name).translate(

1238

client_object_name = str(self.name).translate(

1246

1239

{ord("."): ord("_"),

1247

1240

ord("-"): ord("_")})

1248

1241

self.dbus_object_path = (dbus.ObjectPath

1252

1245

1253

1246

def notifychangeproperty(transform_func,

1254

1247

dbus_name, type_func=lambda x: x,

1255

variant_level=1):

1248

variant_level=1, invalidate_only=False,

1249

_interface=_interface):

1256

1250

""" Modify a variable so that it's a property which announces

1257

1251

its changes to DBus.

1258

1252

1263

1257

to the D-Bus. Default: no transform

1264

1258

variant_level: D-Bus variant level. Default: 1

1265

1259

"""

1266

attrname = "_{0}".format(dbus_name)

1260

attrname = "_{}".format(dbus_name)

1267

1261

def setter(self, value):

1268

1262

if hasattr(self, "dbus_object_path"):

1269

1263

if (not hasattr(self, attrname) or

1270

1264

type_func(getattr(self, attrname, None))

1271

1265

!= type_func(value)):

1272

dbus_value = transform_func(type_func(value),

1273

variant_level

1274

=variant_level)

1275

self.PropertyChanged(dbus.String(dbus_name),

1276

dbus_value)

1266

if invalidate_only:

1267

self.PropertiesChanged(_interface,

1268

dbus.Dictionary(),

1269

dbus.Array

1270

((dbus_name,)))

1271

else:

1272

dbus_value = transform_func(type_func(value),

1273

variant_level

1274

=variant_level)

1275

self.PropertyChanged(dbus.String(dbus_name),

1276

dbus_value)

1277

self.PropertiesChanged(_interface,

1278

dbus.Dictionary({

1279

dbus.String(dbus_name):

1280

dbus_value }), dbus.Array())

1277

1281

setattr(self, attrname, value)

1278

1282

1279

1283

return property(lambda self: getattr(self, attrname), setter)

1299

1303

approval_delay = notifychangeproperty(dbus.UInt64,

1300

1304

"ApprovalDelay",

1301

1305

type_func =

1302

timedelta_to_milliseconds)

1306

lambda td: td.total_seconds()

1307

* 1000)

1303

1308

approval_duration = notifychangeproperty(

1304

1309

dbus.UInt64, "ApprovalDuration",

1305

type_func = timedelta_to_milliseconds)

1310

type_func = lambda td: td.total_seconds() * 1000)

1306

1311

host = notifychangeproperty(dbus.String, "Host")

1307

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1308

type_func =

1309

timedelta_to_milliseconds)

1313

type_func = lambda td:

1314

td.total_seconds() * 1000)

1310

1315

extended_timeout = notifychangeproperty(

1311

1316

dbus.UInt64, "ExtendedTimeout",

1312

type_func = timedelta_to_milliseconds)

1317

type_func = lambda td: td.total_seconds() * 1000)

1313

1318

interval = notifychangeproperty(dbus.UInt64,

1314

1319

"Interval",

1315

1320

type_func =

1316

timedelta_to_milliseconds)

1321

lambda td: td.total_seconds()

1322

* 1000)

1317

1323

checker_command = notifychangeproperty(dbus.String, "Checker")

1324

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1325

invalidate_only=True)

1318

1326

1319

1327

del notifychangeproperty

1320

1328

1347

1355

*args, **kwargs)

1348

1356

1349

1357

def start_checker(self, *args, **kwargs):

1350

old_checker = self.checker

1351

if self.checker is not None:

1352

old_checker_pid = self.checker.pid

1353

else:

1354

old_checker_pid = None

1358

old_checker_pid = getattr(self.checker, "pid", None)

1355

1359

r = Client.start_checker(self, *args, **kwargs)

1356

1360

# Only if new checker process was started

1357

1361

if (self.checker is not None

1366

1370

1367

1371

def approve(self, value=True):

1368

1372

self.approved = value

1369

gobject.timeout_add(timedelta_to_milliseconds

1370

(self.approval_duration),

1371

self._reset_approved)

1373

gobject.timeout_add(int(self.approval_duration.total_seconds()

1374

* 1000), self._reset_approved)

1372

1375

self.send_changedstate()

1373

1376

1374

1377

## D-Bus methods, signals & properties

1375

_interface = "se.recompile.Mandos.Client"

1376

1378

1377

1379

## Interfaces

1378

1380

1379

@dbus_interface_annotations(_interface)

1380

def _foo(self):

1381

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1382

"false"}

1383

1384

1381

## Signals

1385

1382

1386

1383

# CheckerCompleted - signal

1396

1393

pass

1397

1394

1398

1395

# PropertyChanged - signal

1396

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1399

1397

@dbus.service.signal(_interface, signature="sv")

1400

1398

def PropertyChanged(self, property, value):

1401

1399

"D-Bus signal"

1477

1475

access="readwrite")

1478

1476

def ApprovalDelay_dbus_property(self, value=None):

1479

1477

if value is None: # get

1480

return dbus.UInt64(self.approval_delay_milliseconds())

1478

return dbus.UInt64(self.approval_delay.total_seconds()

1479

* 1000)

1481

1480

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1482

1481

1483

1482

# ApprovalDuration - property

1485

1484

access="readwrite")

1486

1485

def ApprovalDuration_dbus_property(self, value=None):

1487

1486

if value is None: # get

1488

return dbus.UInt64(timedelta_to_milliseconds(

1489

self.approval_duration))

1487

return dbus.UInt64(self.approval_duration.total_seconds()

1488

* 1000)

1490

1489

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1491

1490

1492

1491

# Name - property

1505

1504

def Host_dbus_property(self, value=None):

1506

1505

if value is None: # get

1507

1506

return dbus.String(self.host)

1508

self.host = unicode(value)

1507

self.host = str(value)

1509

1508

1510

1509

# Created - property

1511

1510

@dbus_service_property(_interface, signature="s", access="read")

1558

1557

access="readwrite")

1559

1558

def Timeout_dbus_property(self, value=None):

1560

1559

if value is None: # get

1561

return dbus.UInt64(self.timeout_milliseconds())

1560

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1562

1561

old_timeout = self.timeout

1563

1562

self.timeout = datetime.timedelta(0, 0, 0, value)

1564

1563

# Reschedule disabling

1575

1574

gobject.source_remove(self.disable_initiator_tag)

1576

1575

self.disable_initiator_tag = (

1577

1576

gobject.timeout_add(

1578

timedelta_to_milliseconds(self.expires - now),

1579

self.disable))

1577

int((self.expires - now).total_seconds()

1578

* 1000), self.disable))

1580

1579

1581

1580

# ExtendedTimeout - property

1582

1581

@dbus_service_property(_interface, signature="t",

1583

1582

access="readwrite")

1584

1583

def ExtendedTimeout_dbus_property(self, value=None):

1585

1584

if value is None: # get

1586

return dbus.UInt64(self.extended_timeout_milliseconds())

1585

return dbus.UInt64(self.extended_timeout.total_seconds()

1586

* 1000)

1587

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1588

1589

# Interval - property

1591

access="readwrite")

1592

def Interval_dbus_property(self, value=None):

1593

if value is None: # get

1594

return dbus.UInt64(self.interval_milliseconds())

1594

return dbus.UInt64(self.interval.total_seconds() * 1000)

1595

self.interval = datetime.timedelta(0, 0, 0, value)

1596

if getattr(self, "checker_initiator_tag", None) is None:

1597

return

1608

def Checker_dbus_property(self, value=None):

1609

if value is None: # get

1610

return dbus.String(self.checker_command)

1611

self.checker_command = unicode(value)

1611

self.checker_command = str(value)

1612

1613

# CheckerRunning - property

1614

@dbus_service_property(_interface, signature="b",

1630

@dbus_service_property(_interface, signature="ay",

1631

access="write", byte_arrays=True)

1632

def Secret_dbus_property(self, value):

1633

self.secret = str(value)

1633

self.secret = bytes(value)

1634

1635

del _interface

1636

1670

def handle(self):

1671

with contextlib.closing(self.server.child_pipe) as child_pipe:

1672

logger.info("TCP connection from: %s",

1673

unicode(self.client_address))

1673

str(self.client_address))

1674

logger.debug("Pipe FD: %d",

1675

self.server.child_pipe.fileno())

1676

1702

logger.debug("Protocol version: %r", line)

1703

try:

1704

if int(line.strip().split()[0]) > 1:

1705

raise RuntimeError

1705

raise RuntimeError(line)

1706

except (ValueError, IndexError, RuntimeError) as error:

1707

logger.error("Unknown protocol version: %s", error)

1708

return

1757

if self.server.use_dbus:

1758

# Emit D-Bus signal

1759

client.NeedApproval(

1760

client.approval_delay_milliseconds(),

1761

client.approved_by_default)

1760

client.approval_delay.total_seconds()

1761

* 1000, client.approved_by_default)

1762

else:

1763

logger.warning("Client %s was not approved",

1764

client.name)

1770

#wait until timeout or approved

1771

time = datetime.datetime.now()

1772

client.changedstate.acquire()

1773

client.changedstate.wait(

1774

float(timedelta_to_milliseconds(delay)

1775

/ 1000))

1773

client.changedstate.wait(delay.total_seconds())

1776

1774

client.changedstate.release()

1777

1775

time2 = datetime.datetime.now()

1778

1776

if (time2 - time) >= delay:

1915

1913

1916

1914

def add_pipe(self, parent_pipe, proc):

1917

1915

"""Dummy function; override as necessary"""

1918

raise NotImplementedError

1916

raise NotImplementedError()

1919

1917

1920

1918

1921

1919

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1977

1975

try:

1978

1976

self.socket.setsockopt(socket.SOL_SOCKET,

1979

1977

SO_BINDTODEVICE,

1980

str(self.interface + '\0'))

1978

(self.interface + "\0")

1979

.encode("utf-8"))

1981

1980

except socket.error as error:

1982

1981

if error.errno == errno.EPERM:

1983

1982

logger.error("No permission to bind to"

2186

2185

token_duration = Token(re.compile(r"P"), None,

2187

2186

frozenset((token_year, token_month,

2188

2187

token_day, token_time,

2189

token_week))),

2188

token_week)))

2190

2189

# Define starting values

2191

2190

value = datetime.timedelta() # Value so far

2192

2191

found_token = None

2193

followers = frozenset(token_duration,) # Following valid tokens

2192

followers = frozenset((token_duration,)) # Following valid tokens

2194

2193

s = duration # String left to parse

2195

2194

# Loop until end token is found

2196

2195

while found_token is not token_end:

2243

2242

timevalue = datetime.timedelta(0)

2244

2243

for s in interval.split():

2245

2244

try:

2246

suffix = unicode(s[-1])

2245

suffix = s[-1]

2247

2246

value = int(s[:-1])

2248

2247

if suffix == "d":

2249

2248

delta = datetime.timedelta(value)

2256

2255

elif suffix == "w":

2257

2256

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2258

2257

else:

2259

raise ValueError("Unknown suffix {0!r}"

2258

raise ValueError("Unknown suffix {!r}"

2260

2259

.format(suffix))

2261

except (ValueError, IndexError) as e:

2260

except IndexError as e:

2262

2261

raise ValueError(*(e.args))

2263

2262

timevalue += delta

2264

2263

return timevalue

2279

2278

# Close all standard open file descriptors

2280

2279

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2281

2280

if not stat.S_ISCHR(os.fstat(null).st_mode):

2282

raise OSError(errno.ENODEV,

2283

"{0} not a character device"

2281

raise OSError(errno.ENODEV, "{} not a character device"

2284

2282

.format(os.devnull))

2285

2283

os.dup2(null, sys.stdin.fileno())

2286

2284

os.dup2(null, sys.stdout.fileno())

2296

2294

2297

2295

parser = argparse.ArgumentParser()

2298

2296

parser.add_argument("-v", "--version", action="version",

2299

version = "%(prog)s {0}".format(version),

2297

version = "%(prog)s {}".format(version),

2300

2298

help="show version number and exit")

2301

2299

parser.add_argument("-i", "--interface", metavar="IF",

2302

2300

help="Bind to interface IF")

2335

2333

help="Directory to save/restore state in")

2336

2334

parser.add_argument("--foreground", action="store_true",

2337

2335

help="Run in foreground", default=None)

2336

parser.add_argument("--no-zeroconf", action="store_false",

2337

dest="zeroconf", help="Do not use Zeroconf",

2338

default=None)

2338

2339

2340

options = parser.parse_args()

2340

2341

2342

if options.check:

2342

2343

import doctest

2343

doctest.testmod()

2344

sys.exit()

2344

fail_count, test_count = doctest.testmod()

2345

sys.exit(os.EX_OK if fail_count == 0 else 1)

2345

2346

2347

# Default values for config file for server-global settings

2347

2348

server_defaults = { "interface": "",

2358

2359

"socket": "",

2359

2360

"statedir": "/var/lib/mandos",

2360

2361

"foreground": "False",

2362

"zeroconf": "True",

2361

2363

}

2362

2364

2363

2365

# Parse config file for server-global settings

2390

2392

for option in ("interface", "address", "port", "debug",

2391

2393

"priority", "servicename", "configdir",

2392

2394

"use_dbus", "use_ipv6", "debuglevel", "restore",

2393

"statedir", "socket", "foreground"):

2395

"statedir", "socket", "foreground", "zeroconf"):

2394

2396

value = getattr(options, option)

2395

2397

if value is not None:

2396

2398

server_settings[option] = value

2397

2399

del options

2398

2400

# Force all strings to be unicode

2399

2401

for option in server_settings.keys():

2400

if type(server_settings[option]) is str:

2401

server_settings[option] = unicode(server_settings[option])

2402

if isinstance(server_settings[option], bytes):

2403

server_settings[option] = (server_settings[option]

2404

.decode("utf-8"))

2402

2405

# Force all boolean options to be boolean

2403

2406

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2404

"foreground"):

2407

"foreground", "zeroconf"):

2405

2408

server_settings[option] = bool(server_settings[option])

2406

2409

# Debug implies foreground

2407

2410

if server_settings["debug"]:

2410

2413

2411

2414

##################################################################

2412

2415

2416

if (not server_settings["zeroconf"] and

2417

not (server_settings["port"]

2418

or server_settings["socket"] != "")):

2419

parser.error("Needs port or socket to work without"

2420

" Zeroconf")

2421

2413

2422

# For convenience

2414

2423

debug = server_settings["debug"]

2415

2424

debuglevel = server_settings["debuglevel"]

2418

2427

stored_state_path = os.path.join(server_settings["statedir"],

2419

2428

stored_state_file)

2420

2429

foreground = server_settings["foreground"]

2430

zeroconf = server_settings["zeroconf"]

2421

2431

2422

2432

if debug:

2423

2433

initlogger(debug, logging.DEBUG)

2430

2440

2431

2441

if server_settings["servicename"] != "Mandos":

2432

2442

syslogger.setFormatter(logging.Formatter

2433

('Mandos ({0}) [%(process)d]:'

2443

('Mandos ({}) [%(process)d]:'

2434

2444

' %(levelname)s: %(message)s'

2435

2445

.format(server_settings

2436

2446

["servicename"])))

2444

2454

global mandos_dbus_service

2445

2455

mandos_dbus_service = None

2446

2456

2457

socketfd = None

2458

if server_settings["socket"] != "":

2459

socketfd = server_settings["socket"]

2447

2460

tcp_server = MandosServer((server_settings["address"],

2448

2461

server_settings["port"]),

2449

2462

ClientHandler,

2453

2466

gnutls_priority=

2454

2467

server_settings["priority"],

2455

2468

use_dbus=use_dbus,

2456

socketfd=(server_settings["socket"]

2457

or None))

2469

socketfd=socketfd)

2458

2470

if not foreground:

2459

2471

pidfilename = "/run/mandos.pid"

2460

2472

if not os.path.isdir("/run/."):

2481

2493

os.setuid(uid)

2482

2494

except OSError as error:

2483

2495

if error.errno != errno.EPERM:

2484

raise error

2496

raise

2485

2497

2486

2498

if debug:

2487

2499

# Enable all possible GnuTLS debugging

2530

2542

use_dbus = False

2531

2543

server_settings["use_dbus"] = False

2532

2544

tcp_server.use_dbus = False

2533

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2534

service = AvahiServiceToSyslog(name =

2535

server_settings["servicename"],

2536

servicetype = "_mandos._tcp",

2537

protocol = protocol, bus = bus)

2538

if server_settings["interface"]:

2539

service.interface = (if_nametoindex

2540

(str(server_settings["interface"])))

2545

if zeroconf:

2546

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2547

service = AvahiServiceToSyslog(name =

2548

server_settings["servicename"],

2549

servicetype = "_mandos._tcp",

2550

protocol = protocol, bus = bus)

2551

if server_settings["interface"]:

2552

service.interface = (if_nametoindex

2553

(server_settings["interface"]

2554

.encode("utf-8")))

2541

2555

2542

2556

global multiprocessing_manager

2543

2557

multiprocessing_manager = multiprocessing.Manager()

2567

2581

os.remove(stored_state_path)

2568

2582

except IOError as e:

2569

2583

if e.errno == errno.ENOENT:

2570

logger.warning("Could not load persistent state: {0}"

2584

logger.warning("Could not load persistent state: {}"

2571

2585

.format(os.strerror(e.errno)))

2572

2586

else:

2573

2587

logger.critical("Could not load persistent state:",

2578

2592

"EOFError:", exc_info=e)

2579

2593

2580

2594

with PGPEngine() as pgp:

2581

for client_name, client in clients_data.iteritems():

2595

for client_name, client in clients_data.items():

2582

2596

# Skip removed clients

2583

2597

if client_name not in client_settings:

2584

2598

continue

2609

2623

if datetime.datetime.utcnow() >= client["expires"]:

2610

2624

if not client["last_checked_ok"]:

2611

2625

logger.warning(

2612

"disabling client {0} - Client never "

2626

"disabling client {} - Client never "

2613

2627

"performed a successful checker"

2614

2628

.format(client_name))

2615

2629

client["enabled"] = False

2616

2630

elif client["last_checker_status"] != 0:

2617

2631

logger.warning(

2618

"disabling client {0} - Client "

2619

"last checker failed with error code {1}"

2632

"disabling client {} - Client last"

2633

" checker failed with error code {}"

2620

2634

.format(client_name,

2621

2635

client["last_checker_status"]))

2622

2636

client["enabled"] = False

2625

2639

.utcnow()

2626

2640

+ client["timeout"])

2627

2641

logger.debug("Last checker succeeded,"

2628

" keeping {0} enabled"

2642

" keeping {} enabled"

2629

2643

.format(client_name))

2630

2644

try:

2631

2645

client["secret"] = (

2634

2648

["secret"]))

2635

2649

except PGPError:

2636

2650

# If decryption fails, we use secret from new settings

2637

logger.debug("Failed to decrypt {0} old secret"

2651

logger.debug("Failed to decrypt {} old secret"

2638

2652

.format(client_name))

2639

2653

client["secret"] = (

2640

2654

client_settings[client_name]["secret"])

2648

2662

clients_data[client_name] = client_settings[client_name]

2649

2663

2650

2664

# Create all client objects

2651

for client_name, client in clients_data.iteritems():

2665

for client_name, client in clients_data.items():

2652

2666

tcp_server.clients[client_name] = client_class(

2653

2667

name = client_name, settings = client,

2654

2668

server_settings = server_settings)

2661

2675

try:

2662

2676

with pidfile:

2663

2677

pid = os.getpid()

2664

pidfile.write(str(pid) + "\n".encode("utf-8"))

2678

pidfile.write("{}\n".format(pid).encode("utf-8"))

2665

2679

except IOError:

2666

2680

logger.error("Could not write to file %r with PID %d",

2667

2681

pidfilename, pid)

2713

2727

def GetAllClientsWithProperties(self):

2714

2728

"D-Bus method"

2715

2729

return dbus.Dictionary(

2716

((c.dbus_object_path, c.GetAll(""))

2717

for c in tcp_server.clients.itervalues()),

2730

{ c.dbus_object_path: c.GetAll("")

2731

for c in tcp_server.clients.itervalues() },

2718

2732

signature="oa{sv}")

2719

2733

2720

2734

@dbus.service.method(_interface, in_signature="o")

2737

2751

2738

2752

def cleanup():

2739

2753

"Cleanup function; run on exit"

2740

service.cleanup()

2754

if zeroconf:

2755

service.cleanup()

2741

2756

2742

2757

multiprocessing.active_children()

2743

2758

wnull.close()

2757

2772

2758

2773

# A list of attributes that can not be pickled

2759

2774

# + secret.

2760

exclude = set(("bus", "changedstate", "secret",

2761

"checker", "server_settings"))

2775

exclude = { "bus", "changedstate", "secret",

2776

"checker", "server_settings" }

2762

2777

for name, typ in (inspect.getmembers

2763

2778

(dbus.service.Object)):

2764

2779

exclude.add(name)

2787

2802

except NameError:

2788

2803

pass

2789

2804

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2790

logger.warning("Could not save persistent state: {0}"

2805

logger.warning("Could not save persistent state: {}"

2791

2806

.format(os.strerror(e.errno)))

2792

2807

else:

2793

2808

logger.warning("Could not save persistent state:",

2794

2809

exc_info=e)

2795

raise e

2810

raise

2796

2811

2797

2812

# Delete all clients, and settings from config

2798

2813

while tcp_server.clients:

2822

2837

tcp_server.server_activate()

2823

2838

2824

2839

# Find out what port we got

2825

service.port = tcp_server.socket.getsockname()[1]

2840

if zeroconf:

2841

service.port = tcp_server.socket.getsockname()[1]

2826

2842

if use_ipv6:

2827

2843

logger.info("Now listening on address %r, port %d,"

2828

2844

" flowinfo %d, scope_id %d",

2834

2850

#service.interface = tcp_server.socket.getsockname()[3]

2835

2851

2836

2852

try:

2837

# From the Avahi example code

2838

try:

2839

service.activate()

2840

except dbus.exceptions.DBusException as error:

2841

logger.critical("D-Bus Exception", exc_info=error)

2842

cleanup()

2843

sys.exit(1)

2844

# End of Avahi example code

2853

if zeroconf:

2854

# From the Avahi example code

2855

try:

2856

service.activate()

2857

except dbus.exceptions.DBusException as error:

2858

logger.critical("D-Bus Exception", exc_info=error)

2859

cleanup()

2860

sys.exit(1)

2861

# End of Avahi example code

2845

2862

2846

2863

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2847

2864

lambda *args, **kwargs: