63
import cPickle as pickle
69
import cPickle as pickle
64
72
import multiprocessing
69
81
import dbus.service
82
from gi.repository import GLib
72
83
from dbus.mainloop.glib import DBusGMainLoop
75
86
import xml.dom.minidom
77
import Crypto.Cipher.AES
89
# Try to find the value of SO_BINDTODEVICE:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
80
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
94
except AttributeError:
96
# This is where SO_BINDTODEVICE was up to and including Python
83
98
from IN import SO_BINDTODEVICE
84
99
except ImportError:
85
SO_BINDTODEVICE = None
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
112
SO_BINDTODEVICE = None
114
if sys.version_info.major == 2:
118
stored_state_file = "clients.pickle"
90
120
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
93
syslogger = (logging.handlers.SysLogHandler
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
address = str("/dev/log")))
96
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
99
logger.addHandler(syslogger)
101
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
106
logger.addHandler(console)
124
if_nametoindex = ctypes.cdll.LoadLibrary(
125
ctypes.util.find_library("c")).if_nametoindex
126
except (OSError, AttributeError):
128
def if_nametoindex(interface):
129
"Get an interface index the hard way, i.e. using fcntl()"
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
131
with contextlib.closing(socket.socket()) as s:
132
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
133
struct.pack(b"16s16x", interface))
134
interface_index = struct.unpack("I", ifreq[16:20])[0]
135
return interface_index
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
147
return types.FunctionType(func.__code__,
154
def initlogger(debug, level=logging.WARNING):
155
"""init logger and add loglevel"""
158
syslogger = (logging.handlers.SysLogHandler(
159
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
160
address = "/dev/log"))
161
syslogger.setFormatter(logging.Formatter
162
('Mandos [%(process)d]: %(levelname)s:'
164
logger.addHandler(syslogger)
167
console = logging.StreamHandler()
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
172
logger.addHandler(console)
173
logger.setLevel(level)
176
class PGPError(Exception):
177
"""Exception if encryption/decryption fails"""
181
class PGPEngine(object):
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
195
if e.errno != errno.ENOENT:
197
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
208
def __exit__(self, exc_type, exc_value, traceback):
216
if self.tempdir is not None:
217
# Delete contents of tempdir
218
for root, dirs, files in os.walk(self.tempdir,
220
for filename in files:
221
os.remove(os.path.join(root, filename))
223
os.rmdir(os.path.join(root, dirname))
225
os.rmdir(self.tempdir)
228
def password_encode(self, password):
229
# Passphrase can not be empty and can not contain newlines or
230
# NUL bytes. So we prefix it and hex encode it.
231
encoded = b"mandos" + binascii.hexlify(password)
232
if len(encoded) > 2048:
233
# GnuPG can't handle long passwords, so encode differently
234
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
235
.replace(b"\n", b"\\n")
236
.replace(b"\0", b"\\x00"))
239
def encrypt(self, data, password):
240
passphrase = self.password_encode(password)
241
with tempfile.NamedTemporaryFile(
242
dir=self.tempdir) as passfile:
243
passfile.write(passphrase)
245
proc = subprocess.Popen([self.gpg, '--symmetric',
249
stdin = subprocess.PIPE,
250
stdout = subprocess.PIPE,
251
stderr = subprocess.PIPE)
252
ciphertext, err = proc.communicate(input = data)
253
if proc.returncode != 0:
257
def decrypt(self, data, password):
258
passphrase = self.password_encode(password)
259
with tempfile.NamedTemporaryFile(
260
dir = self.tempdir) as passfile:
261
passfile.write(passphrase)
263
proc = subprocess.Popen([self.gpg, '--decrypt',
267
stdin = subprocess.PIPE,
268
stdout = subprocess.PIPE,
269
stderr = subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input = data)
271
if proc.returncode != 0:
273
return decrypted_plaintext
275
# Pretend that we have an Avahi module
277
"""This isn't so much a class as it is a module-like namespace.
278
It is instantiated once, and simulates having an Avahi module."""
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
283
DBUS_NAME = "org.freedesktop.Avahi"
284
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
285
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
286
DBUS_PATH_SERVER = "/"
287
def string_array_to_txt_array(self, t):
288
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
289
for s in t), signature="ay")
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
109
300
class AvahiError(Exception):
110
301
def __init__(self, value, *args, **kwargs):
111
302
self.value = value
112
super(AvahiError, self).__init__(value, *args, **kwargs)
113
def __unicode__(self):
114
return unicode(repr(self.value))
303
return super(AvahiError, self).__init__(value, *args,
116
307
class AvahiServiceError(AvahiError):
119
311
class AvahiGroupError(AvahiError):
263
485
follow_name_owner_changes=True),
264
486
avahi.DBUS_INTERFACE_SERVER)
265
487
self.server.connect_to_signal("StateChanged",
266
self.server_state_changed)
488
self.server_state_changed)
267
489
self.server_state_changed(self.server.GetState())
269
492
class AvahiServiceToSyslog(AvahiService):
493
def rename(self, *args, **kwargs):
271
494
"""Add the new name to the syslog messages"""
272
ret = AvahiService.rename(self)
273
syslogger.setFormatter(logging.Formatter
274
('Mandos (%s) [%%(process)d]:'
275
' %%(levelname)s: %%(message)s'
495
ret = AvahiService.rename(self, *args, **kwargs)
496
syslogger.setFormatter(logging.Formatter(
497
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
279
def _timedelta_to_milliseconds(td):
280
"Convert a datetime.timedelta() to milliseconds"
281
return ((td.days * 24 * 60 * 60 * 1000)
282
+ (td.seconds * 1000)
283
+ (td.microseconds // 1000))
501
# Pretend that we have a GnuTLS module
502
class GnuTLS(object):
503
"""This isn't so much a class as it is a module-like namespace.
504
It is instantiated once, and simulates having a GnuTLS module."""
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
508
_need_version = b"3.3.0"
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
517
# Unless otherwise indicated, the constants and types below are
518
# all from the gnutls/gnutls.h C header file.
528
E_NO_CERTIFICATE_FOUND = -49
529
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
532
class session_int(ctypes.Structure):
534
session_t = ctypes.POINTER(session_int)
535
class certificate_credentials_st(ctypes.Structure):
537
certificate_credentials_t = ctypes.POINTER(
538
certificate_credentials_st)
539
certificate_type_t = ctypes.c_int
540
class datum_t(ctypes.Structure):
541
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
542
('size', ctypes.c_uint)]
543
class openpgp_crt_int(ctypes.Structure):
545
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
547
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
548
credentials_type_t = ctypes.c_int
549
transport_ptr_t = ctypes.c_void_p
550
close_request_t = ctypes.c_int
553
class Error(Exception):
554
# We need to use the class name "GnuTLS" here, since this
555
# exception might be raised from within GnuTLS.__init__,
556
# which is called before the assignment to the "gnutls"
557
# global variable has happened.
558
def __init__(self, message = None, code = None, args=()):
559
# Default usage is by a message string, but if a return
560
# code is passed, convert it to a string with
563
if message is None and code is not None:
564
message = GnuTLS.strerror(code)
565
return super(GnuTLS.Error, self).__init__(
568
class CertificateSecurityError(Error):
572
class Credentials(object):
574
self._c_object = gnutls.certificate_credentials_t()
575
gnutls.certificate_allocate_credentials(
576
ctypes.byref(self._c_object))
577
self.type = gnutls.CRD_CERTIFICATE
580
gnutls.certificate_free_credentials(self._c_object)
582
class ClientSession(object):
583
def __init__(self, socket, credentials = None):
584
self._c_object = gnutls.session_t()
585
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
586
gnutls.set_default_priority(self._c_object)
587
gnutls.transport_set_ptr(self._c_object, socket.fileno())
588
gnutls.handshake_set_private_extensions(self._c_object,
591
if credentials is None:
592
credentials = gnutls.Credentials()
593
gnutls.credentials_set(self._c_object, credentials.type,
594
ctypes.cast(credentials._c_object,
596
self.credentials = credentials
599
gnutls.deinit(self._c_object)
602
return gnutls.handshake(self._c_object)
604
def send(self, data):
608
data_len -= gnutls.record_send(self._c_object,
613
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
615
# Error handling functions
616
def _error_code(result):
617
"""A function to raise exceptions on errors, suitable
618
for the 'restype' attribute on ctypes functions"""
621
if result == gnutls.E_NO_CERTIFICATE_FOUND:
622
raise gnutls.CertificateSecurityError(code = result)
623
raise gnutls.Error(code = result)
625
def _retry_on_error(result, func, arguments):
626
"""A function to retry on some errors, suitable
627
for the 'errcheck' attribute on ctypes functions"""
629
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
630
return _error_code(result)
631
result = func(*arguments)
634
# Unless otherwise indicated, the function declarations below are
635
# all from the gnutls/gnutls.h C header file.
638
priority_set_direct = _library.gnutls_priority_set_direct
639
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
640
ctypes.POINTER(ctypes.c_char_p)]
641
priority_set_direct.restype = _error_code
643
init = _library.gnutls_init
644
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
645
init.restype = _error_code
647
set_default_priority = _library.gnutls_set_default_priority
648
set_default_priority.argtypes = [session_t]
649
set_default_priority.restype = _error_code
651
record_send = _library.gnutls_record_send
652
record_send.argtypes = [session_t, ctypes.c_void_p,
654
record_send.restype = ctypes.c_ssize_t
655
record_send.errcheck = _retry_on_error
657
certificate_allocate_credentials = (
658
_library.gnutls_certificate_allocate_credentials)
659
certificate_allocate_credentials.argtypes = [
660
ctypes.POINTER(certificate_credentials_t)]
661
certificate_allocate_credentials.restype = _error_code
663
certificate_free_credentials = (
664
_library.gnutls_certificate_free_credentials)
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
666
certificate_free_credentials.restype = None
668
handshake_set_private_extensions = (
669
_library.gnutls_handshake_set_private_extensions)
670
handshake_set_private_extensions.argtypes = [session_t,
672
handshake_set_private_extensions.restype = None
674
credentials_set = _library.gnutls_credentials_set
675
credentials_set.argtypes = [session_t, credentials_type_t,
677
credentials_set.restype = _error_code
679
strerror = _library.gnutls_strerror
680
strerror.argtypes = [ctypes.c_int]
681
strerror.restype = ctypes.c_char_p
683
certificate_type_get = _library.gnutls_certificate_type_get
684
certificate_type_get.argtypes = [session_t]
685
certificate_type_get.restype = _error_code
687
certificate_get_peers = _library.gnutls_certificate_get_peers
688
certificate_get_peers.argtypes = [session_t,
689
ctypes.POINTER(ctypes.c_uint)]
690
certificate_get_peers.restype = ctypes.POINTER(datum_t)
692
global_set_log_level = _library.gnutls_global_set_log_level
693
global_set_log_level.argtypes = [ctypes.c_int]
694
global_set_log_level.restype = None
696
global_set_log_function = _library.gnutls_global_set_log_function
697
global_set_log_function.argtypes = [log_func]
698
global_set_log_function.restype = None
700
deinit = _library.gnutls_deinit
701
deinit.argtypes = [session_t]
702
deinit.restype = None
704
handshake = _library.gnutls_handshake
705
handshake.argtypes = [session_t]
706
handshake.restype = _error_code
707
handshake.errcheck = _retry_on_error
709
transport_set_ptr = _library.gnutls_transport_set_ptr
710
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
711
transport_set_ptr.restype = None
713
bye = _library.gnutls_bye
714
bye.argtypes = [session_t, close_request_t]
715
bye.restype = _error_code
716
bye.errcheck = _retry_on_error
718
check_version = _library.gnutls_check_version
719
check_version.argtypes = [ctypes.c_char_p]
720
check_version.restype = ctypes.c_char_p
722
# All the function declarations below are from gnutls/openpgp.h
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
726
openpgp_crt_init.restype = _error_code
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
730
ctypes.POINTER(datum_t),
732
openpgp_crt_import.restype = _error_code
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
736
ctypes.POINTER(ctypes.c_uint)]
737
openpgp_crt_verify_self.restype = _error_code
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
741
openpgp_crt_deinit.restype = None
743
openpgp_crt_get_fingerprint = (
744
_library.gnutls_openpgp_crt_get_fingerprint)
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
749
openpgp_crt_get_fingerprint.restype = _error_code
751
# Remove non-public functions
752
del _error_code, _retry_on_error
753
# Create the global "gnutls" object, simulating a module
756
def call_pipe(connection, # : multiprocessing.Connection
757
func, *args, **kwargs):
758
"""This function is meant to be called by multiprocessing.Process
760
This function runs func(*args, **kwargs), and writes the resulting
761
return value on the provided multiprocessing.Connection.
763
connection.send(func(*args, **kwargs))
285
766
class Client(object):
286
767
"""A representation of a client host served by this server.
289
_approved: bool(); 'None' if not yet approved/disapproved
770
approved: bool(); 'None' if not yet approved/disapproved
290
771
approval_delay: datetime.timedelta(); Time to wait for approval
291
772
approval_duration: datetime.timedelta(); Duration of one approval
292
773
checker: subprocess.Popen(); a running checker process used
293
774
to see if the client lives.
294
775
'None' if no process is running.
295
checker_callback_tag: a gobject event source tag, or None
776
checker_callback_tag: a GLib event source tag, or None
296
777
checker_command: string; External command which is run to check
297
778
if client lives. %() expansions are done at
298
779
runtime with vars(self) as dict, so that for
299
780
instance %(name)s can be used in the command.
300
checker_initiator_tag: a gobject event source tag, or None
781
checker_initiator_tag: a GLib event source tag, or None
301
782
created: datetime.datetime(); (UTC) object creation
302
783
client_structure: Object describing what attributes a client has
303
784
and is used for storing the client at exit
304
785
current_checker_command: string; current running checker_command
305
disable_initiator_tag: a gobject event source tag, or None
786
disable_initiator_tag: a GLib event source tag, or None
307
788
fingerprint: string (40 or 32 hexadecimal digits); used to
308
789
uniquely identify the client
310
791
interval: datetime.timedelta(); How often to start a new checker
311
792
last_approval_request: datetime.datetime(); (UTC) or None
312
793
last_checked_ok: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit status
314
of last checker. -1 reflect crashed checker,
316
last_enabled: datetime.datetime(); (UTC)
794
last_checker_status: integer between 0 and 255 reflecting exit
795
status of last checker. -1 reflects crashed
796
checker, -2 means no checker completed yet.
797
last_checker_signal: The signal which killed the last checker, if
798
last_checker_status is -1
799
last_enabled: datetime.datetime(); (UTC) or None
317
800
name: string; from the config file, used in log messages and
318
801
D-Bus identifiers
319
802
secret: bytestring; sent verbatim (over TLS) to client
320
803
timeout: datetime.timedelta(); How long from last_checked_ok
321
804
until this client is disabled
322
extended_timeout: extra long timeout when password has been sent
805
extended_timeout: extra long timeout when secret has been sent
323
806
runtime_expansions: Allowed attributes for runtime expansion.
324
807
expires: datetime.datetime(); time (UTC) when a client will be
325
808
disabled, or None
809
server_settings: The server_settings dict from main()
328
812
runtime_expansions = ("approval_delay", "approval_duration",
329
"created", "enabled", "fingerprint",
330
"host", "interval", "last_checked_ok",
813
"created", "enabled", "expires",
814
"fingerprint", "host", "interval",
815
"last_approval_request", "last_checked_ok",
331
816
"last_enabled", "name", "timeout")
333
def timeout_milliseconds(self):
334
"Return the 'timeout' attribute in milliseconds"
335
return _timedelta_to_milliseconds(self.timeout)
337
def extended_timeout_milliseconds(self):
338
"Return the 'extended_timeout' attribute in milliseconds"
339
return _timedelta_to_milliseconds(self.extended_timeout)
341
def interval_milliseconds(self):
342
"Return the 'interval' attribute in milliseconds"
343
return _timedelta_to_milliseconds(self.interval)
345
def approval_delay_milliseconds(self):
346
return _timedelta_to_milliseconds(self.approval_delay)
348
def __init__(self, name = None, config=None):
349
"""Note: the 'checker' key in 'config' sets the
350
'checker_command' attribute and *not* the 'checker'
819
"extended_timeout": "PT15M",
821
"checker": "fping -q -- %%(host)s",
823
"approval_delay": "PT0S",
824
"approval_duration": "PT1S",
825
"approved_by_default": "True",
830
def config_parser(config):
831
"""Construct a new dict of client settings of this form:
832
{ client_name: {setting_name: value, ...}, ...}
833
with exceptions for any special settings as defined above.
834
NOTE: Must be a pure function. Must return the same result
835
value given the same arguments.
838
for client_name in config.sections():
839
section = dict(config.items(client_name))
840
client = settings[client_name] = {}
842
client["host"] = section["host"]
843
# Reformat values from string types to Python types
844
client["approved_by_default"] = config.getboolean(
845
client_name, "approved_by_default")
846
client["enabled"] = config.getboolean(client_name,
849
# Uppercase and remove spaces from fingerprint for later
850
# comparison purposes with return value from the
851
# fingerprint() function
852
client["fingerprint"] = (section["fingerprint"].upper()
854
if "secret" in section:
855
client["secret"] = codecs.decode(section["secret"]
858
elif "secfile" in section:
859
with open(os.path.expanduser(os.path.expandvars
860
(section["secfile"])),
862
client["secret"] = secfile.read()
864
raise TypeError("No secret or secfile for section {}"
866
client["timeout"] = string_to_delta(section["timeout"])
867
client["extended_timeout"] = string_to_delta(
868
section["extended_timeout"])
869
client["interval"] = string_to_delta(section["interval"])
870
client["approval_delay"] = string_to_delta(
871
section["approval_delay"])
872
client["approval_duration"] = string_to_delta(
873
section["approval_duration"])
874
client["checker_command"] = section["checker"]
875
client["last_approval_request"] = None
876
client["last_checked_ok"] = None
877
client["last_checker_status"] = -2
881
def __init__(self, settings, name = None, server_settings=None):
883
if server_settings is None:
885
self.server_settings = server_settings
886
# adding all client settings
887
for setting, value in settings.items():
888
setattr(self, setting, value)
891
if not hasattr(self, "last_enabled"):
892
self.last_enabled = datetime.datetime.utcnow()
893
if not hasattr(self, "expires"):
894
self.expires = (datetime.datetime.utcnow()
897
self.last_enabled = None
355
900
logger.debug("Creating client %r", self.name)
356
# Uppercase and remove spaces from fingerprint for later
357
# comparison purposes with return value from the fingerprint()
359
self.fingerprint = (config["fingerprint"].upper()
361
901
logger.debug(" Fingerprint: %s", self.fingerprint)
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
365
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
368
self.secret = secfile.read()
370
raise TypeError("No secret or secfile for client %s"
372
self.host = config.get("host", "")
373
self.created = datetime.datetime.utcnow()
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
377
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
902
self.created = settings.get("created",
903
datetime.datetime.utcnow())
905
# attributes specific for this server instance
383
906
self.checker = None
384
907
self.checker_initiator_tag = None
385
908
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
387
909
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
389
910
self.current_checker_command = None
390
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
393
912
self.approvals_pending = 0
394
self.approval_delay = string_to_delta(
395
config["approval_delay"])
396
self.approval_duration = string_to_delta(
397
config["approval_duration"])
398
self.changedstate = (multiprocessing_manager
399
.Condition(multiprocessing_manager
401
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
913
self.changedstate = multiprocessing_manager.Condition(
914
multiprocessing_manager.Lock())
915
self.client_structure = [attr
916
for attr in self.__dict__.keys()
917
if not attr.startswith("_")]
402
918
self.client_structure.append("client_structure")
405
for name, t in inspect.getmembers(type(self),
406
lambda obj: isinstance(obj, property)):
920
for name, t in inspect.getmembers(
921
type(self), lambda obj: isinstance(obj, property)):
407
922
if not name.startswith("_"):
408
923
self.client_structure.append(name)
417
932
if getattr(self, "enabled", False):
418
933
# Already enabled
420
self.send_changedstate()
421
935
self.expires = datetime.datetime.utcnow() + self.timeout
422
936
self.enabled = True
423
937
self.last_enabled = datetime.datetime.utcnow()
424
938
self.init_checker()
939
self.send_changedstate()
426
941
def disable(self, quiet=True):
427
942
"""Disable this client."""
428
943
if not getattr(self, "enabled", False):
431
self.send_changedstate()
433
946
logger.info("Disabling client %s", self.name)
434
if getattr(self, "disable_initiator_tag", False):
435
gobject.source_remove(self.disable_initiator_tag)
947
if getattr(self, "disable_initiator_tag", None) is not None:
948
GLib.source_remove(self.disable_initiator_tag)
436
949
self.disable_initiator_tag = None
437
950
self.expires = None
438
if getattr(self, "checker_initiator_tag", False):
439
gobject.source_remove(self.checker_initiator_tag)
951
if getattr(self, "checker_initiator_tag", None) is not None:
952
GLib.source_remove(self.checker_initiator_tag)
440
953
self.checker_initiator_tag = None
441
954
self.stop_checker()
442
955
self.enabled = False
443
# Do not run this again if called by a gobject.timeout_add
957
self.send_changedstate()
958
# Do not run this again if called by a GLib.timeout_add
446
961
def __del__(self):
449
964
def init_checker(self):
450
965
# Schedule a new checker to be started an 'interval' from now,
451
966
# and every interval from then on.
452
self.checker_initiator_tag = (gobject.timeout_add
453
(self.interval_milliseconds(),
967
if self.checker_initiator_tag is not None:
968
GLib.source_remove(self.checker_initiator_tag)
969
self.checker_initiator_tag = GLib.timeout_add(
970
int(self.interval.total_seconds() * 1000),
455
972
# Schedule a disable() when 'timeout' has passed
456
self.disable_initiator_tag = (gobject.timeout_add
457
(self.timeout_milliseconds(),
973
if self.disable_initiator_tag is not None:
974
GLib.source_remove(self.disable_initiator_tag)
975
self.disable_initiator_tag = GLib.timeout_add(
976
int(self.timeout.total_seconds() * 1000), self.disable)
459
977
# Also start a new checker *right now*.
460
978
self.start_checker()
463
def checker_callback(self, pid, condition, command):
980
def checker_callback(self, source, condition, connection,
464
982
"""The checker has completed, so take appropriate actions."""
465
983
self.checker_callback_tag = None
466
984
self.checker = None
467
if os.WIFEXITED(condition):
468
self.last_checker_status = os.WEXITSTATUS(condition)
985
# Read return code from connection (see call_pipe)
986
returncode = connection.recv()
990
self.last_checker_status = returncode
991
self.last_checker_signal = None
469
992
if self.last_checker_status == 0:
470
993
logger.info("Checker for %(name)s succeeded",
472
995
self.checked_ok()
474
logger.info("Checker for %(name)s failed",
997
logger.info("Checker for %(name)s failed", vars(self))
477
999
self.last_checker_status = -1
1000
self.last_checker_signal = -returncode
478
1001
logger.warning("Checker for %(name)s crashed?",
481
def checked_ok(self, timeout=None):
482
"""Bump up the timeout for this client.
484
This should only be called when the client has been seen,
1005
def checked_ok(self):
1006
"""Assert that the client has been seen, alive and well."""
1007
self.last_checked_ok = datetime.datetime.utcnow()
1008
self.last_checker_status = 0
1009
self.last_checker_signal = None
1012
def bump_timeout(self, timeout=None):
1013
"""Bump up the timeout for this client."""
487
1014
if timeout is None:
488
1015
timeout = self.timeout
489
self.last_checked_ok = datetime.datetime.utcnow()
490
1016
if self.disable_initiator_tag is not None:
491
gobject.source_remove(self.disable_initiator_tag)
1017
GLib.source_remove(self.disable_initiator_tag)
1018
self.disable_initiator_tag = None
492
1019
if getattr(self, "enabled", False):
493
self.disable_initiator_tag = (gobject.timeout_add
494
(_timedelta_to_milliseconds
495
(timeout), self.disable))
1020
self.disable_initiator_tag = GLib.timeout_add(
1021
int(timeout.total_seconds() * 1000), self.disable)
496
1022
self.expires = datetime.datetime.utcnow() + timeout
498
1024
def need_approval(self):
504
1030
If a checker already exists, leave it running and do
506
1032
# The reason for not killing a running checker is that if we
507
# did that, then if a checker (for some reason) started
508
# running slowly and taking more than 'interval' time, the
509
# client would inevitably timeout, since no checker would get
510
# a chance to run to completion. If we instead leave running
1033
# did that, and if a checker (for some reason) started running
1034
# slowly and taking more than 'interval' time, then the client
1035
# would inevitably timeout, since no checker would get a
1036
# chance to run to completion. If we instead leave running
511
1037
# checkers alone, the checker would have to take more time
512
1038
# than 'timeout' for the client to be disabled, which is as it
515
# If a checker exists, make sure it is not a zombie
517
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
518
except (AttributeError, OSError) as error:
519
if (isinstance(error, OSError)
520
and error.errno != errno.ECHILD):
524
logger.warning("Checker was a zombie")
525
gobject.source_remove(self.checker_callback_tag)
526
self.checker_callback(pid, status,
527
self.current_checker_command)
1041
if self.checker is not None and not self.checker.is_alive():
1042
logger.warning("Checker was not alive; joining")
528
1045
# Start a new checker if needed
529
1046
if self.checker is None:
1047
# Escape attributes for the shell
1049
attr: re.escape(str(getattr(self, attr)))
1050
for attr in self.runtime_expansions }
531
# In case checker_command has exactly one % operator
532
command = self.checker_command % self.host
534
# Escape attributes for the shell
535
escaped_attrs = dict(
537
re.escape(unicode(str(getattr(self, attr, "")),
541
self.runtime_expansions)
544
command = self.checker_command % escaped_attrs
545
except TypeError as error:
546
logger.error('Could not format string "%s":'
547
' %s', self.checker_command, error)
548
return True # Try again later
1052
command = self.checker_command % escaped_attrs
1053
except TypeError as error:
1054
logger.error('Could not format string "%s"',
1055
self.checker_command,
1057
return True # Try again later
549
1058
self.current_checker_command = command
551
logger.info("Starting checker %r for %s",
553
# We don't need to redirect stdout and stderr, since
554
# in normal mode, that is already done by daemon(),
555
# and in debug mode we don't want to. (Stdin is
556
# always replaced by /dev/null.)
557
self.checker = subprocess.Popen(command,
560
self.checker_callback_tag = (gobject.child_watch_add
562
self.checker_callback,
564
# The checker may have completed before the gobject
565
# watch was added. Check for this.
566
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
568
gobject.source_remove(self.checker_callback_tag)
569
self.checker_callback(pid, status, command)
570
except OSError as error:
571
logger.error("Failed to start subprocess: %s",
573
# Re-run this periodically if run by gobject.timeout_add
1059
logger.info("Starting checker %r for %s", command,
1061
# We don't need to redirect stdout and stderr, since
1062
# in normal mode, that is already done by daemon(),
1063
# and in debug mode we don't want to. (Stdin is
1064
# always replaced by /dev/null.)
1065
# The exception is when not debugging but nevertheless
1066
# running in the foreground; use the previously
1068
popen_args = { "close_fds": True,
1071
if (not self.server_settings["debug"]
1072
and self.server_settings["foreground"]):
1073
popen_args.update({"stdout": wnull,
1075
pipe = multiprocessing.Pipe(duplex = False)
1076
self.checker = multiprocessing.Process(
1078
args = (pipe[1], subprocess.call, command),
1079
kwargs = popen_args)
1080
self.checker.start()
1081
self.checker_callback_tag = GLib.io_add_watch(
1082
pipe[0].fileno(), GLib.IO_IN,
1083
self.checker_callback, pipe[0], command)
1084
# Re-run this periodically if run by GLib.timeout_add
576
1087
def stop_checker(self):
577
1088
"""Force the checker process, if any, to stop."""
578
1089
if self.checker_callback_tag:
579
gobject.source_remove(self.checker_callback_tag)
1090
GLib.source_remove(self.checker_callback_tag)
580
1091
self.checker_callback_tag = None
581
1092
if getattr(self, "checker", None) is None:
583
1094
logger.debug("Stopping checker for %(name)s", vars(self))
585
os.kill(self.checker.pid, signal.SIGTERM)
587
#if self.checker.poll() is None:
588
# os.kill(self.checker.pid, signal.SIGKILL)
589
except OSError as error:
590
if error.errno != errno.ESRCH: # No such process
1095
self.checker.terminate()
592
1096
self.checker = None
594
# Encrypts a client secret and stores it in a varible encrypted_secret
595
def encrypt_secret(self, key):
596
# Encryption-key need to be of a specific size, so we hash inputed key
597
hasheng = hashlib.sha256()
599
encryptionkey = hasheng.digest()
601
# Create validation hash so we know at decryption if it was sucessful
602
hasheng = hashlib.sha256()
603
hasheng.update(self.secret)
604
validationhash = hasheng.digest()
607
iv = os.urandom(Crypto.Cipher.AES.block_size)
608
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
Crypto.Cipher.AES.MODE_CFB, iv)
610
ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
self.encrypted_secret = (ciphertext, iv)
613
# Decrypt a encrypted client secret
614
def decrypt_secret(self, key):
615
# Decryption-key need to be of a specific size, so we hash inputed key
616
hasheng = hashlib.sha256()
618
encryptionkey = hasheng.digest()
620
# Decrypt encrypted secret
621
ciphertext, iv = self.encrypted_secret
622
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
Crypto.Cipher.AES.MODE_CFB, iv)
624
plain = ciphereng.decrypt(ciphertext)
626
# Validate decrypted secret to know if it was succesful
627
hasheng = hashlib.sha256()
628
validationhash = plain[:hasheng.digest_size]
629
secret = plain[hasheng.digest_size:]
630
hasheng.update(secret)
632
# if validation fails, we use key as new secret. Otherwhise, we use
633
# the decrypted secret
634
if hasheng.digest() == validationhash:
638
del self.encrypted_secret
641
def dbus_service_property(dbus_interface, signature="v",
642
access="readwrite", byte_arrays=False):
1099
def dbus_service_property(dbus_interface,
643
1103
"""Decorators for marking methods of a DBusObjectWithProperties to
644
1104
become properties on the D-Bus.
821
1444
except (AttributeError, xml.dom.DOMException,
822
1445
xml.parsers.expat.ExpatError) as error:
823
1446
logger.error("Failed to override Introspection method",
828
def datetime_to_dbus (dt, variant_level=0):
1451
dbus.OBJECT_MANAGER_IFACE
1452
except AttributeError:
1453
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1455
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1456
"""A D-Bus object with an ObjectManager.
1458
Classes inheriting from this exposes the standard
1459
GetManagedObjects call and the InterfacesAdded and
1460
InterfacesRemoved signals on the standard
1461
"org.freedesktop.DBus.ObjectManager" interface.
1463
Note: No signals are sent automatically; they must be sent
1466
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1467
out_signature = "a{oa{sa{sv}}}")
1468
def GetManagedObjects(self):
1469
"""This function must be overridden"""
1470
raise NotImplementedError()
1472
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1473
signature = "oa{sa{sv}}")
1474
def InterfacesAdded(self, object_path, interfaces_and_properties):
1477
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1478
def InterfacesRemoved(self, object_path, interfaces):
1481
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1482
out_signature = "s",
1483
path_keyword = 'object_path',
1484
connection_keyword = 'connection')
1485
def Introspect(self, object_path, connection):
1486
"""Overloading of standard D-Bus method.
1488
Override return argument name of GetManagedObjects to be
1489
"objpath_interfaces_and_properties"
1491
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1495
document = xml.dom.minidom.parseString(xmlstring)
1497
for if_tag in document.getElementsByTagName("interface"):
1498
# Fix argument name for the GetManagedObjects method
1499
if (if_tag.getAttribute("name")
1500
== dbus.OBJECT_MANAGER_IFACE):
1501
for cn in if_tag.getElementsByTagName("method"):
1502
if (cn.getAttribute("name")
1503
== "GetManagedObjects"):
1504
for arg in cn.getElementsByTagName("arg"):
1505
if (arg.getAttribute("direction")
1509
"objpath_interfaces"
1511
xmlstring = document.toxml("utf-8")
1513
except (AttributeError, xml.dom.DOMException,
1514
xml.parsers.expat.ExpatError) as error:
1515
logger.error("Failed to override Introspection method",
1519
def datetime_to_dbus(dt, variant_level=0):
829
1520
"""Convert a UTC datetime.datetime() to a D-Bus type."""
831
1522
return dbus.String("", variant_level = variant_level)
832
return dbus.String(dt.isoformat(),
833
variant_level=variant_level)
835
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
837
"""Applied to an empty subclass of a D-Bus object, this metaclass
838
will add additional D-Bus attributes matching a certain pattern.
1523
return dbus.String(dt.isoformat(), variant_level=variant_level)
1526
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1527
"""A class decorator; applied to a subclass of
1528
dbus.service.Object, it will add alternate D-Bus attributes with
1529
interface names according to the "alt_interface_names" mapping.
1532
@alternate_dbus_interfaces({"org.example.Interface":
1533
"net.example.AlternateInterface"})
1534
class SampleDBusObject(dbus.service.Object):
1535
@dbus.service.method("org.example.Interface")
1536
def SampleDBusMethod():
1539
The above "SampleDBusMethod" on "SampleDBusObject" will be
1540
reachable via two interfaces: "org.example.Interface" and
1541
"net.example.AlternateInterface", the latter of which will have
1542
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1543
"true", unless "deprecate" is passed with a False value.
1545
This works for methods and signals, and also for D-Bus properties
1546
(from DBusObjectWithProperties) and interfaces (from the
1547
dbus_interface_annotations decorator).
840
def __new__(mcs, name, bases, attr):
841
# Go through all the base classes which could have D-Bus
842
# methods, signals, or properties in them
843
for base in (b for b in bases
844
if issubclass(b, dbus.service.Object)):
845
# Go though all attributes of the base class
846
for attrname, attribute in inspect.getmembers(base):
1551
for orig_interface_name, alt_interface_name in (
1552
alt_interface_names.items()):
1554
interface_names = set()
1555
# Go though all attributes of the class
1556
for attrname, attribute in inspect.getmembers(cls):
847
1557
# Ignore non-D-Bus attributes, and D-Bus attributes
848
1558
# with the wrong interface name
849
1559
if (not hasattr(attribute, "_dbus_interface")
850
or not attribute._dbus_interface
851
.startswith("se.recompile.Mandos")):
1560
or not attribute._dbus_interface.startswith(
1561
orig_interface_name)):
853
1563
# Create an alternate D-Bus interface name based on
854
1564
# the current name
855
alt_interface = (attribute._dbus_interface
856
.replace("se.recompile.Mandos",
857
"se.bsnet.fukt.Mandos"))
1565
alt_interface = attribute._dbus_interface.replace(
1566
orig_interface_name, alt_interface_name)
1567
interface_names.add(alt_interface)
858
1568
# Is this a D-Bus signal?
859
1569
if getattr(attribute, "_dbus_is_signal", False):
860
# Extract the original non-method function by
862
nonmethod_func = (dict(
1570
# Extract the original non-method undecorated
1571
# function by black magic
1572
if sys.version_info.major == 2:
1573
nonmethod_func = (dict(
863
1574
zip(attribute.func_code.co_freevars,
864
attribute.__closure__))["func"]
1575
attribute.__closure__))
1576
["func"].cell_contents)
1578
nonmethod_func = (dict(
1579
zip(attribute.__code__.co_freevars,
1580
attribute.__closure__))
1581
["func"].cell_contents)
866
1582
# Create a new, but exactly alike, function
867
1583
# object, and decorate it to be a new D-Bus signal
868
1584
# with the alternate D-Bus interface name
869
new_function = (dbus.service.signal
871
attribute._dbus_signature)
873
nonmethod_func.func_code,
874
nonmethod_func.func_globals,
875
nonmethod_func.func_name,
876
nonmethod_func.func_defaults,
877
nonmethod_func.func_closure)))
1585
new_function = copy_function(nonmethod_func)
1586
new_function = (dbus.service.signal(
1588
attribute._dbus_signature)(new_function))
1589
# Copy annotations, if any
1591
new_function._dbus_annotations = dict(
1592
attribute._dbus_annotations)
1593
except AttributeError:
878
1595
# Define a creator of a function to call both the
879
# old and new functions, so both the old and new
880
# signals gets sent when the function is called
1596
# original and alternate functions, so both the
1597
# original and alternate signals gets sent when
1598
# the function is called
881
1599
def fixscope(func1, func2):
882
1600
"""This function is a scope container to pass
883
1601
func1 and func2 to the "call_both" function
884
1602
outside of its arguments"""
1604
@functools.wraps(func2)
885
1605
def call_both(*args, **kwargs):
886
1606
"""This function will emit two D-Bus
887
1607
signals by calling func1 and func2"""
888
1608
func1(*args, **kwargs)
889
1609
func2(*args, **kwargs)
1610
# Make wrapper function look like a D-Bus signal
1611
for name, attr in inspect.getmembers(func2):
1612
if name.startswith("_dbus_"):
1613
setattr(call_both, name, attr)
890
1615
return call_both
891
1616
# Create the "call_both" function and add it to
893
attr[attrname] = fixscope(attribute,
1618
attr[attrname] = fixscope(attribute, new_function)
895
1619
# Is this a D-Bus method?
896
1620
elif getattr(attribute, "_dbus_is_method", False):
897
1621
# Create a new, but exactly alike, function
898
1622
# object. Decorate it to be a new D-Bus method
899
1623
# with the alternate D-Bus interface name. Add it
901
attr[attrname] = (dbus.service.method
903
attribute._dbus_in_signature,
904
attribute._dbus_out_signature)
906
(attribute.func_code,
907
attribute.func_globals,
909
attribute.func_defaults,
910
attribute.func_closure)))
1626
dbus.service.method(
1628
attribute._dbus_in_signature,
1629
attribute._dbus_out_signature)
1630
(copy_function(attribute)))
1631
# Copy annotations, if any
1633
attr[attrname]._dbus_annotations = dict(
1634
attribute._dbus_annotations)
1635
except AttributeError:
911
1637
# Is this a D-Bus property?
912
1638
elif getattr(attribute, "_dbus_is_property", False):
913
1639
# Create a new, but exactly alike, function
914
1640
# object, and decorate it to be a new D-Bus
915
1641
# property with the alternate D-Bus interface
916
1642
# name. Add it to the class.
917
attr[attrname] = (dbus_service_property
919
attribute._dbus_signature,
920
attribute._dbus_access,
922
._dbus_get_args_options
925
(attribute.func_code,
926
attribute.func_globals,
928
attribute.func_defaults,
929
attribute.func_closure)))
930
return type.__new__(mcs, name, bases, attr)
1643
attr[attrname] = (dbus_service_property(
1644
alt_interface, attribute._dbus_signature,
1645
attribute._dbus_access,
1646
attribute._dbus_get_args_options
1648
(copy_function(attribute)))
1649
# Copy annotations, if any
1651
attr[attrname]._dbus_annotations = dict(
1652
attribute._dbus_annotations)
1653
except AttributeError:
1655
# Is this a D-Bus interface?
1656
elif getattr(attribute, "_dbus_is_interface", False):
1657
# Create a new, but exactly alike, function
1658
# object. Decorate it to be a new D-Bus interface
1659
# with the alternate D-Bus interface name. Add it
1662
dbus_interface_annotations(alt_interface)
1663
(copy_function(attribute)))
1665
# Deprecate all alternate interfaces
1666
iname="_AlternateDBusNames_interface_annotation{}"
1667
for interface_name in interface_names:
1669
@dbus_interface_annotations(interface_name)
1671
return { "org.freedesktop.DBus.Deprecated":
1673
# Find an unused name
1674
for aname in (iname.format(i)
1675
for i in itertools.count()):
1676
if aname not in attr:
1680
# Replace the class with a new subclass of it with
1681
# methods, signals, etc. as created above.
1682
if sys.version_info.major == 2:
1683
cls = type(b"{}Alternate".format(cls.__name__),
1686
cls = type("{}Alternate".format(cls.__name__),
1693
@alternate_dbus_interfaces({"se.recompile.Mandos":
1694
"se.bsnet.fukt.Mandos"})
932
1695
class ClientDBus(Client, DBusObjectWithProperties):
933
1696
"""A Client class using D-Bus
1624
2409
interface: None or a network interface name (string)
1625
2410
use_ipv6: Boolean; to use IPv6 or not
1627
2413
def __init__(self, server_address, RequestHandlerClass,
1628
interface=None, use_ipv6=True):
2417
"""If socketfd is set, use that file descriptor instead of
2418
creating a new one with socket.socket().
1629
2420
self.interface = interface
1631
2422
self.address_family = socket.AF_INET6
2423
if socketfd is not None:
2424
# Save the file descriptor
2425
self.socketfd = socketfd
2426
# Save the original socket.socket() function
2427
self.socket_socket = socket.socket
2428
# To implement --socket, we monkey patch socket.socket.
2430
# (When socketserver.TCPServer is a new-style class, we
2431
# could make self.socket into a property instead of monkey
2432
# patching socket.socket.)
2434
# Create a one-time-only replacement for socket.socket()
2435
@functools.wraps(socket.socket)
2436
def socket_wrapper(*args, **kwargs):
2437
# Restore original function so subsequent calls are
2439
socket.socket = self.socket_socket
2440
del self.socket_socket
2441
# This time only, return a new socket object from the
2442
# saved file descriptor.
2443
return socket.fromfd(self.socketfd, *args, **kwargs)
2444
# Replace socket.socket() function with wrapper
2445
socket.socket = socket_wrapper
2446
# The socketserver.TCPServer.__init__ will call
2447
# socket.socket(), which might be our replacement,
2448
# socket_wrapper(), if socketfd was set.
1632
2449
socketserver.TCPServer.__init__(self, server_address,
1633
2450
RequestHandlerClass)
1634
2452
def server_bind(self):
1635
2453
"""This overrides the normal server_bind() function
1636
2454
to bind to an interface if one was specified, and also NOT to
1637
2455
bind to an address or port if they were not specified."""
2456
global SO_BINDTODEVICE
1638
2457
if self.interface is not None:
1639
2458
if SO_BINDTODEVICE is None:
1640
logger.error("SO_BINDTODEVICE does not exist;"
1641
" cannot bind to interface %s",
1645
self.socket.setsockopt(socket.SOL_SOCKET,
1649
except socket.error as error:
1650
if error[0] == errno.EPERM:
1651
logger.error("No permission to"
1652
" bind to interface %s",
1654
elif error[0] == errno.ENOPROTOOPT:
1655
logger.error("SO_BINDTODEVICE not available;"
1656
" cannot bind to interface %s",
2459
# Fall back to a hard-coded value which seems to be
2461
logger.warning("SO_BINDTODEVICE not found, trying 25")
2462
SO_BINDTODEVICE = 25
2464
self.socket.setsockopt(
2465
socket.SOL_SOCKET, SO_BINDTODEVICE,
2466
(self.interface + "\0").encode("utf-8"))
2467
except socket.error as error:
2468
if error.errno == errno.EPERM:
2469
logger.error("No permission to bind to"
2470
" interface %s", self.interface)
2471
elif error.errno == errno.ENOPROTOOPT:
2472
logger.error("SO_BINDTODEVICE not available;"
2473
" cannot bind to interface %s",
2475
elif error.errno == errno.ENODEV:
2476
logger.error("Interface %s does not exist,"
2477
" cannot bind", self.interface)
1660
2480
# Only bind(2) the socket if we really need to.
1661
2481
if self.server_address[0] or self.server_address[1]:
1662
2482
if not self.server_address[0]:
1663
2483
if self.address_family == socket.AF_INET6:
1664
2484
any_address = "::" # in6addr_any
1666
any_address = socket.INADDR_ANY
2486
any_address = "0.0.0.0" # INADDR_ANY
1667
2487
self.server_address = (any_address,
1668
2488
self.server_address[1])
1669
2489
elif not self.server_address[1]:
1670
self.server_address = (self.server_address[0],
2490
self.server_address = (self.server_address[0], 0)
1672
2491
# if self.interface:
1673
2492
# self.server_address = (self.server_address[0],
2615
def rfc3339_duration_to_delta(duration):
2616
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2618
>>> rfc3339_duration_to_delta("P7D")
2619
datetime.timedelta(7)
2620
>>> rfc3339_duration_to_delta("PT60S")
2621
datetime.timedelta(0, 60)
2622
>>> rfc3339_duration_to_delta("PT60M")
2623
datetime.timedelta(0, 3600)
2624
>>> rfc3339_duration_to_delta("PT24H")
2625
datetime.timedelta(1)
2626
>>> rfc3339_duration_to_delta("P1W")
2627
datetime.timedelta(7)
2628
>>> rfc3339_duration_to_delta("PT5M30S")
2629
datetime.timedelta(0, 330)
2630
>>> rfc3339_duration_to_delta("P1DT3M20S")
2631
datetime.timedelta(1, 200)
2634
# Parsing an RFC 3339 duration with regular expressions is not
2635
# possible - there would have to be multiple places for the same
2636
# values, like seconds. The current code, while more esoteric, is
2637
# cleaner without depending on a parsing library. If Python had a
2638
# built-in library for parsing we would use it, but we'd like to
2639
# avoid excessive use of external libraries.
2641
# New type for defining tokens, syntax, and semantics all-in-one
2642
Token = collections.namedtuple("Token", (
2643
"regexp", # To match token; if "value" is not None, must have
2644
# a "group" containing digits
2645
"value", # datetime.timedelta or None
2646
"followers")) # Tokens valid after this token
2647
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2648
# the "duration" ABNF definition in RFC 3339, Appendix A.
2649
token_end = Token(re.compile(r"$"), None, frozenset())
2650
token_second = Token(re.compile(r"(\d+)S"),
2651
datetime.timedelta(seconds=1),
2652
frozenset((token_end, )))
2653
token_minute = Token(re.compile(r"(\d+)M"),
2654
datetime.timedelta(minutes=1),
2655
frozenset((token_second, token_end)))
2656
token_hour = Token(re.compile(r"(\d+)H"),
2657
datetime.timedelta(hours=1),
2658
frozenset((token_minute, token_end)))
2659
token_time = Token(re.compile(r"T"),
2661
frozenset((token_hour, token_minute,
2663
token_day = Token(re.compile(r"(\d+)D"),
2664
datetime.timedelta(days=1),
2665
frozenset((token_time, token_end)))
2666
token_month = Token(re.compile(r"(\d+)M"),
2667
datetime.timedelta(weeks=4),
2668
frozenset((token_day, token_end)))
2669
token_year = Token(re.compile(r"(\d+)Y"),
2670
datetime.timedelta(weeks=52),
2671
frozenset((token_month, token_end)))
2672
token_week = Token(re.compile(r"(\d+)W"),
2673
datetime.timedelta(weeks=1),
2674
frozenset((token_end, )))
2675
token_duration = Token(re.compile(r"P"), None,
2676
frozenset((token_year, token_month,
2677
token_day, token_time,
2679
# Define starting values
2680
value = datetime.timedelta() # Value so far
2682
followers = frozenset((token_duration, )) # Following valid tokens
2683
s = duration # String left to parse
2684
# Loop until end token is found
2685
while found_token is not token_end:
2686
# Search for any currently valid tokens
2687
for token in followers:
2688
match = token.regexp.match(s)
2689
if match is not None:
2691
if token.value is not None:
2692
# Value found, parse digits
2693
factor = int(match.group(1), 10)
2694
# Add to value so far
2695
value += factor * token.value
2696
# Strip token from string
2697
s = token.regexp.sub("", s, 1)
2700
# Set valid next tokens
2701
followers = found_token.followers
2704
# No currently valid tokens were found
2705
raise ValueError("Invalid RFC 3339 duration: {!r}"
1801
2711
def string_to_delta(interval):
1802
2712
"""Parse a string and return a datetime.timedelta
1939
2842
"debug": "False",
1941
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2844
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2845
":+SIGN-DSA-SHA256",
1942
2846
"servicename": "Mandos",
1943
2847
"use_dbus": "True",
1944
2848
"use_ipv6": "True",
1945
2849
"debuglevel": "",
2852
"statedir": "/var/lib/mandos",
2853
"foreground": "False",
1948
2857
# Parse config file for server-global settings
1949
2858
server_config = configparser.SafeConfigParser(server_defaults)
1950
2859
del server_defaults
1951
server_config.read(os.path.join(options.configdir,
2860
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1953
2861
# Convert the SafeConfigParser object to a dict
1954
2862
server_settings = server_config.defaults()
1955
2863
# Use the appropriate methods on the non-string config options
1956
for option in ("debug", "use_dbus", "use_ipv6"):
2864
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1957
2865
server_settings[option] = server_config.getboolean("DEFAULT",
1959
2867
if server_settings["port"]:
1960
2868
server_settings["port"] = server_config.getint("DEFAULT",
2870
if server_settings["socket"]:
2871
server_settings["socket"] = server_config.getint("DEFAULT",
2873
# Later, stdin will, and stdout and stderr might, be dup'ed
2874
# over with an opened os.devnull. But we don't want this to
2875
# happen with a supplied network socket.
2876
if 0 <= server_settings["socket"] <= 2:
2877
server_settings["socket"] = os.dup(server_settings
1962
2879
del server_config
1964
2881
# Override the settings from the config file with command line
1965
2882
# options, if set.
1966
2883
for option in ("interface", "address", "port", "debug",
1967
"priority", "servicename", "configdir",
1968
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2884
"priority", "servicename", "configdir", "use_dbus",
2885
"use_ipv6", "debuglevel", "restore", "statedir",
2886
"socket", "foreground", "zeroconf"):
1969
2887
value = getattr(options, option)
1970
2888
if value is not None:
1971
2889
server_settings[option] = value
1973
2891
# Force all strings to be unicode
1974
2892
for option in server_settings.keys():
1975
if type(server_settings[option]) is str:
1976
server_settings[option] = unicode(server_settings[option])
2893
if isinstance(server_settings[option], bytes):
2894
server_settings[option] = (server_settings[option]
2896
# Force all boolean options to be boolean
2897
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2898
"foreground", "zeroconf"):
2899
server_settings[option] = bool(server_settings[option])
2900
# Debug implies foreground
2901
if server_settings["debug"]:
2902
server_settings["foreground"] = True
1977
2903
# Now we have our good server settings in "server_settings"
1979
2905
##################################################################
2907
if (not server_settings["zeroconf"]
2908
and not (server_settings["port"]
2909
or server_settings["socket"] != "")):
2910
parser.error("Needs port or socket to work without Zeroconf")
1981
2912
# For convenience
1982
2913
debug = server_settings["debug"]
1983
2914
debuglevel = server_settings["debuglevel"]
1984
2915
use_dbus = server_settings["use_dbus"]
1985
2916
use_ipv6 = server_settings["use_ipv6"]
2917
stored_state_path = os.path.join(server_settings["statedir"],
2919
foreground = server_settings["foreground"]
2920
zeroconf = server_settings["zeroconf"]
2923
initlogger(debug, logging.DEBUG)
2928
level = getattr(logging, debuglevel.upper())
2929
initlogger(debug, level)
1987
2931
if server_settings["servicename"] != "Mandos":
1988
syslogger.setFormatter(logging.Formatter
1989
('Mandos (%s) [%%(process)d]:'
1990
' %%(levelname)s: %%(message)s'
1991
% server_settings["servicename"]))
2932
syslogger.setFormatter(
2933
logging.Formatter('Mandos ({}) [%(process)d]:'
2934
' %(levelname)s: %(message)s'.format(
2935
server_settings["servicename"])))
1993
2937
# Parse config file with clients
1994
client_defaults = { "timeout": "5m",
1995
"extended_timeout": "15m",
1997
"checker": "fping -q -- %%(host)s",
1999
"approval_delay": "0s",
2000
"approval_duration": "1s",
2002
client_config = configparser.SafeConfigParser(client_defaults)
2938
client_config = configparser.SafeConfigParser(Client
2003
2940
client_config.read(os.path.join(server_settings["configdir"],
2004
2941
"clients.conf"))
2006
2943
global mandos_dbus_service
2007
2944
mandos_dbus_service = None
2009
tcp_server = MandosServer((server_settings["address"],
2010
server_settings["port"]),
2012
interface=(server_settings["interface"]
2016
server_settings["priority"],
2019
pidfilename = "/var/run/mandos.pid"
2947
if server_settings["socket"] != "":
2948
socketfd = server_settings["socket"]
2949
tcp_server = MandosServer(
2950
(server_settings["address"], server_settings["port"]),
2952
interface=(server_settings["interface"] or None),
2954
gnutls_priority=server_settings["priority"],
2958
pidfilename = "/run/mandos.pid"
2959
if not os.path.isdir("/run/."):
2960
pidfilename = "/var/run/mandos.pid"
2021
pidfile = open(pidfilename, "w")
2023
logger.error("Could not open file %r", pidfilename)
2963
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2964
except IOError as e:
2965
logger.error("Could not open file %r", pidfilename,
2026
uid = pwd.getpwnam("_mandos").pw_uid
2027
gid = pwd.getpwnam("_mandos").pw_gid
2968
for name, group in (("_mandos", "_mandos"),
2969
("mandos", "mandos"),
2970
("nobody", "nogroup")):
2030
uid = pwd.getpwnam("mandos").pw_uid
2031
gid = pwd.getpwnam("mandos").pw_gid
2972
uid = pwd.getpwnam(name).pw_uid
2973
gid = pwd.getpwnam(group).pw_gid
2032
2975
except KeyError:
2034
uid = pwd.getpwnam("nobody").pw_uid
2035
gid = pwd.getpwnam("nobody").pw_gid
2984
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2042
2986
except OSError as error:
2043
if error[0] != errno.EPERM:
2046
if not debug and not debuglevel:
2047
logger.setLevel(logging.WARNING)
2049
level = getattr(logging, debuglevel.upper())
2050
logger.setLevel(level)
2987
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2988
.format(uid, gid, os.strerror(error.errno)))
2989
if error.errno != errno.EPERM:
2053
logger.setLevel(logging.DEBUG)
2054
2993
# Enable all possible GnuTLS debugging
2056
2995
# "Use a log level over 10 to enable all debugging options."
2057
2996
# - GnuTLS manual
2058
gnutls.library.functions.gnutls_global_set_log_level(11)
2997
gnutls.global_set_log_level(11)
2060
@gnutls.library.types.gnutls_log_func
2061
3000
def debug_gnutls(level, string):
2062
3001
logger.debug("GnuTLS: %s", string[:-1])
2064
(gnutls.library.functions
2065
.gnutls_global_set_log_function(debug_gnutls))
3003
gnutls.global_set_log_function(debug_gnutls)
2067
3005
# Redirect stdin so all checkers get /dev/null
2068
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
3006
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2069
3007
os.dup2(null, sys.stdin.fileno())
2073
# No console logging
2074
logger.removeHandler(console)
2076
3011
# Need to fork before connecting to D-Bus
2078
3013
# Close all input and output, do double fork, etc.
3016
# multiprocessing will use threads, so before we use GLib we need
3017
# to inform GLib that threads will be used.
2081
3020
global main_loop
2082
3021
# From the Avahi example code
2083
DBusGMainLoop(set_as_default=True )
2084
main_loop = gobject.MainLoop()
3022
DBusGMainLoop(set_as_default=True)
3023
main_loop = GLib.MainLoop()
2085
3024
bus = dbus.SystemBus()
2086
3025
# End of Avahi example code
2089
3028
bus_name = dbus.service.BusName("se.recompile.Mandos",
2090
bus, do_not_queue=True)
2091
old_bus_name = (dbus.service.BusName
2092
("se.bsnet.fukt.Mandos", bus,
2094
except dbus.exceptions.NameExistsException as e:
2095
logger.error(unicode(e) + ", disabling D-Bus")
3031
old_bus_name = dbus.service.BusName(
3032
"se.bsnet.fukt.Mandos", bus,
3034
except dbus.exceptions.DBusException as e:
3035
logger.error("Disabling D-Bus:", exc_info=e)
2096
3036
use_dbus = False
2097
3037
server_settings["use_dbus"] = False
2098
3038
tcp_server.use_dbus = False
2099
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2100
service = AvahiServiceToSyslog(name =
2101
server_settings["servicename"],
2102
servicetype = "_mandos._tcp",
2103
protocol = protocol, bus = bus)
2104
if server_settings["interface"]:
2105
service.interface = (if_nametoindex
2106
(str(server_settings["interface"])))
3040
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3041
service = AvahiServiceToSyslog(
3042
name = server_settings["servicename"],
3043
servicetype = "_mandos._tcp",
3044
protocol = protocol,
3046
if server_settings["interface"]:
3047
service.interface = if_nametoindex(
3048
server_settings["interface"].encode("utf-8"))
2108
3050
global multiprocessing_manager
2109
3051
multiprocessing_manager = multiprocessing.Manager()
2111
3053
client_class = Client
2113
client_class = functools.partial(ClientDBusTransitional,
2116
special_settings = {
2117
# Some settings need to be accessd by special methods;
2118
# booleans need .getboolean(), etc. Here is a list of them:
2119
"approved_by_default":
2121
client_config.getboolean(section, "approved_by_default"),
2123
# Construct a new dict of client settings of this form:
2124
# { client_name: {setting_name: value, ...}, ...}
2125
# with exceptions for any special settings as defined above
2126
client_settings = dict((clientname,
2128
(value if setting not in special_settings
2129
else special_settings[setting](clientname)))
2130
for setting, value in client_config.items(clientname)))
2131
for clientname in client_config.sections())
3055
client_class = functools.partial(ClientDBus, bus = bus)
3057
client_settings = Client.config_parser(client_config)
2133
3058
old_client_settings = {}
2136
# Get client data and settings from last running state.
3061
# This is used to redirect stdout and stderr for checker processes
3063
wnull = open(os.devnull, "w") # A writable /dev/null
3064
# Only used if server is running in foreground but not in debug
3066
if debug or not foreground:
3069
# Get client data and settings from last running state.
2137
3070
if server_settings["restore"]:
2139
3072
with open(stored_state_path, "rb") as stored_state:
2140
clients_data, old_client_settings = pickle.load(stored_state)
3073
if sys.version_info.major == 2:
3074
clients_data, old_client_settings = pickle.load(
3077
bytes_clients_data, bytes_old_client_settings = (
3078
pickle.load(stored_state, encoding = "bytes"))
3079
### Fix bytes to strings
3082
clients_data = { (key.decode("utf-8")
3083
if isinstance(key, bytes)
3086
bytes_clients_data.items() }
3087
del bytes_clients_data
3088
for key in clients_data:
3089
value = { (k.decode("utf-8")
3090
if isinstance(k, bytes) else k): v
3092
clients_data[key].items() }
3093
clients_data[key] = value
3095
value["client_structure"] = [
3097
if isinstance(s, bytes)
3099
value["client_structure"] ]
3101
for k in ("name", "host"):
3102
if isinstance(value[k], bytes):
3103
value[k] = value[k].decode("utf-8")
3104
## old_client_settings
3106
old_client_settings = {
3107
(key.decode("utf-8")
3108
if isinstance(key, bytes)
3111
bytes_old_client_settings.items() }
3112
del bytes_old_client_settings
3114
for value in old_client_settings.values():
3115
if isinstance(value["host"], bytes):
3116
value["host"] = (value["host"]
2141
3118
os.remove(stored_state_path)
2142
3119
except IOError as e:
2143
logger.warning("Could not load persistant state: {0}".format(e))
2144
if e.errno != errno.ENOENT:
3120
if e.errno == errno.ENOENT:
3121
logger.warning("Could not load persistent state:"
3122
" {}".format(os.strerror(e.errno)))
3124
logger.critical("Could not load persistent state:",
2147
for client in clients_data:
2148
client_name = client["name"]
2150
# Decide which value to use after restoring saved state.
2151
# We have three different values: Old config file,
2152
# new config file, and saved state.
2153
# New config value takes precedence if it differs from old
2154
# config value, otherwise use saved state.
2155
for name, value in client_settings[client_name].items():
3127
except EOFError as e:
3128
logger.warning("Could not load persistent state: "
3132
with PGPEngine() as pgp:
3133
for client_name, client in clients_data.items():
3134
# Skip removed clients
3135
if client_name not in client_settings:
3138
# Decide which value to use after restoring saved state.
3139
# We have three different values: Old config file,
3140
# new config file, and saved state.
3141
# New config value takes precedence if it differs from old
3142
# config value, otherwise use saved state.
3143
for name, value in client_settings[client_name].items():
3145
# For each value in new config, check if it
3146
# differs from the old config value (Except for
3147
# the "secret" attribute)
3148
if (name != "secret"
3150
old_client_settings[client_name][name])):
3151
client[name] = value
3155
# Clients who has passed its expire date can still be
3156
# enabled if its last checker was successful. A Client
3157
# whose checker succeeded before we stored its state is
3158
# assumed to have successfully run all checkers during
3160
if client["enabled"]:
3161
if datetime.datetime.utcnow() >= client["expires"]:
3162
if not client["last_checked_ok"]:
3164
"disabling client {} - Client never "
3165
"performed a successful checker".format(
3167
client["enabled"] = False
3168
elif client["last_checker_status"] != 0:
3170
"disabling client {} - Client last"
3171
" checker failed with error code"
3174
client["last_checker_status"]))
3175
client["enabled"] = False
3177
client["expires"] = (
3178
datetime.datetime.utcnow()
3179
+ client["timeout"])
3180
logger.debug("Last checker succeeded,"
3181
" keeping {} enabled".format(
2157
# For each value in new config, check if it differs
2158
# from the old config value (Except for the "secret"
2160
if name != "secret" and value != old_client_settings[client_name][name]:
2161
setattr(client, name, value)
2165
# Clients who has passed its expire date, can still be enabled if its
2166
# last checker was sucessful. Clients who checkers failed before we
2167
# stored it state is asumed to had failed checker during downtime.
2168
if client["enabled"] and client["last_checked_ok"]:
2169
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2170
> client["interval"]):
2171
if client["last_checker_status"] != 0:
2172
client["enabled"] = False
2174
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2176
client["changedstate"] = (multiprocessing_manager
2177
.Condition(multiprocessing_manager
2180
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2181
tcp_server.clients[client_name] = new_client
2182
new_client.bus = bus
2183
for name, value in client.iteritems():
2184
setattr(new_client, name, value)
2185
client_object_name = unicode(client_name).translate(
2186
{ord("."): ord("_"),
2187
ord("-"): ord("_")})
2188
new_client.dbus_object_path = (dbus.ObjectPath
2189
("/clients/" + client_object_name))
2190
DBusObjectWithProperties.__init__(new_client,
2192
new_client.dbus_object_path)
2194
tcp_server.clients[client_name] = Client.__new__(Client)
2195
for name, value in client.iteritems():
2196
setattr(tcp_server.clients[client_name], name, value)
2198
tcp_server.clients[client_name].decrypt_secret(
2199
client_settings[client_name]["secret"])
2201
# Create/remove clients based on new changes made to config
2202
for clientname in set(old_client_settings) - set(client_settings):
2203
del tcp_server.clients[clientname]
2204
for clientname in set(client_settings) - set(old_client_settings):
2205
tcp_server.clients[clientname] = (client_class(name = clientname,
3184
client["secret"] = pgp.decrypt(
3185
client["encrypted_secret"],
3186
client_settings[client_name]["secret"])
3188
# If decryption fails, we use secret from new settings
3189
logger.debug("Failed to decrypt {} old secret".format(
3191
client["secret"] = (client_settings[client_name]
3194
# Add/remove clients based on new changes made to config
3195
for client_name in (set(old_client_settings)
3196
- set(client_settings)):
3197
del clients_data[client_name]
3198
for client_name in (set(client_settings)
3199
- set(old_client_settings)):
3200
clients_data[client_name] = client_settings[client_name]
3202
# Create all client objects
3203
for client_name, client in clients_data.items():
3204
tcp_server.clients[client_name] = client_class(
3207
server_settings = server_settings)
2211
3209
if not tcp_server.clients:
2212
3210
logger.warning("No clients defined")
2218
pidfile.write(str(pid) + "\n".encode("utf-8"))
2221
logger.error("Could not write to file %r with PID %d",
2224
# "pidfile" was never created
3213
if pidfile is not None:
3217
print(pid, file=pidfile)
3219
logger.error("Could not write to file %r with PID %d",
2226
3222
del pidfilename
3224
for termsig in (signal.SIGHUP, signal.SIGTERM):
3225
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3226
lambda: main_loop.quit() and False)
2228
signal.signal(signal.SIGINT, signal.SIG_IGN)
2230
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2231
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2234
class MandosDBusService(dbus.service.Object):
3230
@alternate_dbus_interfaces(
3231
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3232
class MandosDBusService(DBusObjectWithObjectManager):
2235
3233
"""A D-Bus proxy object"""
2236
3235
def __init__(self):
2237
3236
dbus.service.Object.__init__(self, bus, "/")
2238
3238
_interface = "se.recompile.Mandos"
2240
3240
@dbus.service.signal(_interface, signature="o")
3250
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2250
3252
@dbus.service.signal(_interface, signature="os")
2251
3253
def ClientRemoved(self, objpath, name):
3257
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2255
3259
@dbus.service.method(_interface, out_signature="ao")
2256
3260
def GetAllClients(self):
2258
return dbus.Array(c.dbus_object_path
2260
tcp_server.clients.itervalues())
3262
return dbus.Array(c.dbus_object_path for c in
3263
tcp_server.clients.values())
3265
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2262
3267
@dbus.service.method(_interface,
2263
3268
out_signature="a{oa{sv}}")
2264
3269
def GetAllClientsWithProperties(self):
2266
3271
return dbus.Dictionary(
2267
((c.dbus_object_path, c.GetAll(""))
2268
for c in tcp_server.clients.itervalues()),
3272
{ c.dbus_object_path: c.GetAll(
3273
"se.recompile.Mandos.Client")
3274
for c in tcp_server.clients.values() },
2269
3275
signature="oa{sv}")
2271
3277
@dbus.service.method(_interface, in_signature="o")
2272
3278
def RemoveClient(self, object_path):
2274
for c in tcp_server.clients.itervalues():
3280
for c in tcp_server.clients.values():
2275
3281
if c.dbus_object_path == object_path:
2276
3282
del tcp_server.clients[c.name]
2277
3283
c.remove_from_connection()
2278
# Don't signal anything except ClientRemoved
3284
# Don't signal the disabling
2279
3285
c.disable(quiet=True)
2281
self.ClientRemoved(object_path, c.name)
3286
# Emit D-Bus signal for removal
3287
self.client_removed_signal(c)
2283
3289
raise KeyError(object_path)
3293
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3294
out_signature = "a{oa{sa{sv}}}")
3295
def GetManagedObjects(self):
3297
return dbus.Dictionary(
3298
{ client.dbus_object_path:
3300
{ interface: client.GetAll(interface)
3302
client._get_all_interface_names()})
3303
for client in tcp_server.clients.values()})
3305
def client_added_signal(self, client):
3306
"""Send the new standard signal and the old signal"""
3308
# New standard signal
3309
self.InterfacesAdded(
3310
client.dbus_object_path,
3312
{ interface: client.GetAll(interface)
3314
client._get_all_interface_names()}))
3316
self.ClientAdded(client.dbus_object_path)
3318
def client_removed_signal(self, client):
3319
"""Send the new standard signal and the old signal"""
3321
# New standard signal
3322
self.InterfacesRemoved(
3323
client.dbus_object_path,
3324
client._get_all_interface_names())
3326
self.ClientRemoved(client.dbus_object_path,
2287
class MandosDBusServiceTransitional(MandosDBusService):
2288
__metaclass__ = AlternateDBusNamesMetaclass
2289
mandos_dbus_service = MandosDBusServiceTransitional()
3329
mandos_dbus_service = MandosDBusService()
3331
# Save modules to variables to exempt the modules from being
3332
# unloaded before the function registered with atexit() is run.
3333
mp = multiprocessing
2292
3336
"Cleanup function; run on exit"
2295
multiprocessing.active_children()
3340
mp.active_children()
2296
3342
if not (tcp_server.clients or client_settings):
2299
# Store client before exiting. Secrets are encrypted with key based
2300
# on what config file has. If config file is removed/edited, old
2301
# secret will thus be unrecovable.
2303
for client in tcp_server.clients.itervalues():
2304
client.encrypt_secret(client_settings[client.name]["secret"])
2308
# A list of attributes that will not be stored when shuting down.
2309
exclude = set(("bus", "changedstate", "secret"))
2310
for name, typ in inspect.getmembers(dbus.service.Object):
2313
client_dict["encrypted_secret"] = client.encrypted_secret
2314
for attr in client.client_structure:
2315
if attr not in exclude:
2316
client_dict[attr] = getattr(client, attr)
2318
clients.append(client_dict)
2319
del client_settings[client.name]["secret"]
3345
# Store client before exiting. Secrets are encrypted with key
3346
# based on what config file has. If config file is
3347
# removed/edited, old secret will thus be unrecovable.
3349
with PGPEngine() as pgp:
3350
for client in tcp_server.clients.values():
3351
key = client_settings[client.name]["secret"]
3352
client.encrypted_secret = pgp.encrypt(client.secret,
3356
# A list of attributes that can not be pickled
3358
exclude = { "bus", "changedstate", "secret",
3359
"checker", "server_settings" }
3360
for name, typ in inspect.getmembers(dbus.service
3364
client_dict["encrypted_secret"] = (client
3366
for attr in client.client_structure:
3367
if attr not in exclude:
3368
client_dict[attr] = getattr(client, attr)
3370
clients[client.name] = client_dict
3371
del client_settings[client.name]["secret"]
2322
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2323
pickle.dump((clients, client_settings), stored_state)
2324
except IOError as e:
2325
logger.warning("Could not save persistant state: {0}".format(e))
2326
if e.errno != errno.ENOENT:
3374
with tempfile.NamedTemporaryFile(
3378
dir=os.path.dirname(stored_state_path),
3379
delete=False) as stored_state:
3380
pickle.dump((clients, client_settings), stored_state,
3382
tempname = stored_state.name
3383
os.rename(tempname, stored_state_path)
3384
except (IOError, OSError) as e:
3390
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3391
logger.warning("Could not save persistent state: {}"
3392
.format(os.strerror(e.errno)))
3394
logger.warning("Could not save persistent state:",
2329
3398
# Delete all clients, and settings from config
2330
3399
while tcp_server.clients:
2331
3400
name, client = tcp_server.clients.popitem()
2333
3402
client.remove_from_connection()
2334
# Don't signal anything except ClientRemoved
3403
# Don't signal the disabling
2335
3404
client.disable(quiet=True)
3405
# Emit D-Bus signal for removal
2338
mandos_dbus_service.ClientRemoved(client
3407
mandos_dbus_service.client_removed_signal(client)
2341
3408
client_settings.clear()
2343
3410
atexit.register(cleanup)
2345
for client in tcp_server.clients.itervalues():
3412
for client in tcp_server.clients.values():
2348
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3414
# Emit D-Bus signal for adding
3415
mandos_dbus_service.client_added_signal(client)
2349
3416
# Need to initiate checking of clients
2350
3417
if client.enabled:
2351
3418
client.init_checker()
2354
3420
tcp_server.enable()
2355
3421
tcp_server.server_activate()
2357
3423
# Find out what port we got
2358
service.port = tcp_server.socket.getsockname()[1]
3425
service.port = tcp_server.socket.getsockname()[1]
2360
3427
logger.info("Now listening on address %r, port %d,"
2361
" flowinfo %d, scope_id %d"
2362
% tcp_server.socket.getsockname())
3428
" flowinfo %d, scope_id %d",
3429
*tcp_server.socket.getsockname())
2364
logger.info("Now listening on address %r, port %d"
2365
% tcp_server.socket.getsockname())
3431
logger.info("Now listening on address %r, port %d",
3432
*tcp_server.socket.getsockname())
2367
3434
#service.interface = tcp_server.socket.getsockname()[3]
2370
# From the Avahi example code
2373
except dbus.exceptions.DBusException as error:
2374
logger.critical("DBusException: %s", error)
2377
# End of Avahi example code
3438
# From the Avahi example code
3441
except dbus.exceptions.DBusException as error:
3442
logger.critical("D-Bus Exception", exc_info=error)
3445
# End of Avahi example code
2379
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2380
lambda *args, **kwargs:
2381
(tcp_server.handle_request
2382
(*args[2:], **kwargs) or True))
3447
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3448
lambda *args, **kwargs:
3449
(tcp_server.handle_request
3450
(*args[2:], **kwargs) or True))
2384
3452
logger.debug("Starting main loop")
2385
3453
main_loop.run()
2386
3454
except AvahiError as error:
2387
logger.critical("AvahiError: %s", error)
3455
logger.critical("Avahi Error", exc_info=error)
2390
3458
except KeyboardInterrupt: