/mandos/release : revision 237.7.47

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

65

69

66

import dbus

70

67

import dbus.service

75

72

import ctypes.util

76

73

import xml.dom.minidom

77

74

import inspect

78

import GnuPGInterface

79

75

80

76

try:

81

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

81

except ImportError:

86

82

SO_BINDTODEVICE = None

87

83

88

version = "1.4.1"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

84

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

92

89

syslogger = (logging.handlers.SysLogHandler

93

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

91

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

console = logging.StreamHandler()

122

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

123

' [%(process)d]:'

124

' %(levelname)s:'

125

' %(message)s'))

126

logger.addHandler(console)

127

logger.setLevel(level)

128

129

130

class PGPError(Exception):

131

"""Exception if encryption/decryption fails"""

132

pass

133

134

135

class PGPEngine(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise PGPError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise PGPError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

208

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

209

102

210

103

class AvahiError(Exception):

211

104

def __init__(self, value, *args, **kwargs):

266

159

" after %i retries, exiting.",

267

160

self.rename_count)

268

161

raise AvahiServiceError("Too many renames")

269

self.name = unicode(self.server

270

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

271

163

logger.info("Changing Zeroconf service name to %r ...",

272

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

273

169

self.remove()

274

170

try:

275

171

self.add()

295

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

296

192

self.entry_group_state_changed_match = (

297

193

self.group.connect_to_signal(

298

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

299

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

300

196

self.name, self.type)

301

197

self.group.AddService(

327

223

try:

328

224

self.group.Free()

329

225

except (dbus.exceptions.UnknownMethodException,

330

dbus.exceptions.DBusException):

226

dbus.exceptions.DBusException) as e:

331

227

pass

332

228

self.group = None

333

229

self.remove()

367

263

self.server_state_changed)

368

264

self.server_state_changed(self.server.GetState())

369

265

370

class AvahiServiceToSyslog(AvahiService):

371

def rename(self):

372

"""Add the new name to the syslog messages"""

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

378

return ret

379

266

380

def timedelta_to_milliseconds(td):

381

"Convert a datetime.timedelta() to milliseconds"

382

return ((td.days * 24 * 60 * 60 * 1000)

383

+ (td.seconds * 1000)

384

+ (td.microseconds // 1000))

385

386

267

class Client(object):

387

268

"""A representation of a client host served by this server.

388

269

389

270

Attributes:

390

approved: bool(); 'None' if not yet approved/disapproved

271

_approved: bool(); 'None' if not yet approved/disapproved

391

272

approval_delay: datetime.timedelta(); Time to wait for approval

392

273

approval_duration: datetime.timedelta(); Duration of one approval

393

274

checker: subprocess.Popen(); a running checker process used

400

281

instance %(name)s can be used in the command.

401

282

checker_initiator_tag: a gobject event source tag, or None

402

283

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

405

284

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

406

286

disable_initiator_tag: a gobject event source tag, or None

407

287

enabled: bool()

408

288

fingerprint: string (40 or 32 hexadecimal digits); used to

411

291

interval: datetime.timedelta(); How often to start a new checker

412

292

last_approval_request: datetime.datetime(); (UTC) or None

413

293

last_checked_ok: datetime.datetime(); (UTC) or None

414

last_checker_status: integer between 0 and 255 reflecting exit

415

status of last checker. -1 reflects crashed

416

checker, or None.

417

last_enabled: datetime.datetime(); (UTC) or None

294

last_enabled: datetime.datetime(); (UTC)

418

295

name: string; from the config file, used in log messages and

419

296

D-Bus identifiers

420

297

secret: bytestring; sent verbatim (over TLS) to client

430

307

"created", "enabled", "fingerprint",

431

308

"host", "interval", "last_checked_ok",

432

309

"last_enabled", "name", "timeout")

433

client_defaults = { "timeout": "5m",

434

"extended_timeout": "15m",

435

"interval": "2m",

436

"checker": "fping -q -- %%(host)s",

437

"host": "",

438

"approval_delay": "0s",

439

"approval_duration": "1s",

440

"approved_by_default": "True",

441

"enabled": "True",

442

}

310

311

@staticmethod

312

def _timedelta_to_milliseconds(td):

313

"Convert a datetime.timedelta() to milliseconds"

314

return ((td.days * 24 * 60 * 60 * 1000)

315

+ (td.seconds * 1000)

316

+ (td.microseconds // 1000))

443

317

444

318

def timeout_milliseconds(self):

445

319

"Return the 'timeout' attribute in milliseconds"

446

return timedelta_to_milliseconds(self.timeout)

447

320

return self._timedelta_to_milliseconds(self.timeout)

321

448

322

def extended_timeout_milliseconds(self):

449

323

"Return the 'extended_timeout' attribute in milliseconds"

450

return timedelta_to_milliseconds(self.extended_timeout)

324

return self._timedelta_to_milliseconds(self.extended_timeout)

451

325

452

326

def interval_milliseconds(self):

453

327

"Return the 'interval' attribute in milliseconds"

454

return timedelta_to_milliseconds(self.interval)

455

328

return self._timedelta_to_milliseconds(self.interval)

329

456

330

def approval_delay_milliseconds(self):

457

return timedelta_to_milliseconds(self.approval_delay)

458

459

@staticmethod

460

def config_parser(config):

461

""" Construct a new dict of client settings of this form:

462

{ client_name: {setting_name: value, ...}, ...}

463

with exceptions for any special settings as defined above"""

464

settings = {}

465

for client_name in config.sections():

466

section = dict(config.items(client_name))

467

client = settings[client_name] = {}

468

469

client["host"] = section["host"]

470

# Reformat values from string types to Python types

471

client["approved_by_default"] = config.getboolean(

472

client_name, "approved_by_default")

473

client["enabled"] = config.getboolean(client_name, "enabled")

474

475

client["fingerprint"] = (section["fingerprint"].upper()

476

.replace(" ", ""))

477

if "secret" in section:

478

client["secret"] = section["secret"].decode("base64")

479

elif "secfile" in section:

480

with open(os.path.expanduser(os.path.expandvars

481

(section["secfile"])),

482

"rb") as secfile:

483

client["secret"] = secfile.read()

484

else:

485

raise TypeError("No secret or secfile for section %s"

486

% section)

487

client["timeout"] = string_to_delta(section["timeout"])

488

client["extended_timeout"] = string_to_delta(

489

section["extended_timeout"])

490

client["interval"] = string_to_delta(section["interval"])

491

client["approval_delay"] = string_to_delta(

492

section["approval_delay"])

493

client["approval_duration"] = string_to_delta(

494

section["approval_duration"])

495

client["checker_command"] = section["checker"]

496

client["last_approval_request"] = None

497

client["last_checked_ok"] = None

498

client["last_checker_status"] = None

499

if client["enabled"]:

500

client["last_enabled"] = datetime.datetime.utcnow()

501

client["expires"] = (datetime.datetime.utcnow()

502

+ client["timeout"])

503

else:

504

client["last_enabled"] = None

505

client["expires"] = None

506

507

return settings

508

509

510

def __init__(self, settings, name = None):

331

return self._timedelta_to_milliseconds(self.approval_delay)

332

333

def __init__(self, name = None, disable_hook=None, config=None):

511

334

"""Note: the 'checker' key in 'config' sets the

512

335

'checker_command' attribute and *not* the 'checker'

513

336

attribute."""

514

337

self.name = name

515

# adding all client settings

516

for setting, value in settings.iteritems():

517

setattr(self, setting, value)

518

338

if config is None:

339

config = {}

519

340

logger.debug("Creating client %r", self.name)

520

341

# Uppercase and remove spaces from fingerprint for later

521

342

# comparison purposes with return value from the fingerprint()

522

343

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

523

346

logger.debug(" Fingerprint: %s", self.fingerprint)

524

self.created = settings.get("created", datetime.datetime.utcnow())

525

526

# attributes specific for this server instance

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

353

self.secret = secfile.read()

354

else:

355

raise TypeError("No secret or secfile for client %s"

356

% self.name)

357

self.host = config.get("host", "")

358

self.created = datetime.datetime.utcnow()

359

self.enabled = False

360

self.last_approval_request = None

361

self.last_enabled = None

362

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

527

367

self.checker = None

528

368

self.checker_initiator_tag = None

529

369

self.disable_initiator_tag = None

370

self.expires = None

530

371

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

531

373

self.current_checker_command = None

532

self.approved = None

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

533

378

self.approvals_pending = 0

534

self.changedstate = (multiprocessing_manager

535

.Condition(multiprocessing_manager

536

.Lock()))

537

self.client_structure = [attr for attr in

538

self.__dict__.iterkeys()

539

if not attr.startswith("_")]

540

self.client_structure.append("client_structure")

541

542

for name, t in inspect.getmembers(type(self),

543

lambda obj:

544

isinstance(obj,

545

property)):

546

if not name.startswith("_"):

547

self.client_structure.append(name)

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

548

384

549

# Send notice to process children that client state has changed

550

385

def send_changedstate(self):

551

with self.changedstate:

552

self.changedstate.notify_all()

553

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

554

390

def enable(self):

555

391

"""Start this client's checker and timeout hooks"""

556

392

if getattr(self, "enabled", False):

557

393

# Already enabled

558

394

return

559

395

self.send_changedstate()

396

self.last_enabled = datetime.datetime.utcnow()

397

# Schedule a new checker to be started an 'interval' from now,

398

# and every interval from then on.

399

self.checker_initiator_tag = (gobject.timeout_add

400

(self.interval_milliseconds(),

401

self.start_checker))

402

# Schedule a disable() when 'timeout' has passed

560

403

self.expires = datetime.datetime.utcnow() + self.timeout

404

self.disable_initiator_tag = (gobject.timeout_add

405

(self.timeout_milliseconds(),

406

self.disable))

561

407

self.enabled = True

562

self.last_enabled = datetime.datetime.utcnow()

563

self.init_checker()

408

# Also start a new checker *right now*.

409

self.start_checker()

564

410

565

411

def disable(self, quiet=True):

566

412

"""Disable this client."""

578

424

gobject.source_remove(self.checker_initiator_tag)

579

425

self.checker_initiator_tag = None

580

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

581

429

self.enabled = False

582

430

# Do not run this again if called by a gobject.timeout_add

583

431

return False

584

432

585

433

def __del__(self):

434

self.disable_hook = None

586

435

self.disable()

587

436

588

def init_checker(self):

589

# Schedule a new checker to be started an 'interval' from now,

590

# and every interval from then on.

591

self.checker_initiator_tag = (gobject.timeout_add

592

(self.interval_milliseconds(),

593

self.start_checker))

594

# Schedule a disable() when 'timeout' has passed

595

self.disable_initiator_tag = (gobject.timeout_add

596

(self.timeout_milliseconds(),

597

self.disable))

598

# Also start a new checker *right now*.

599

self.start_checker()

600

601

437

def checker_callback(self, pid, condition, command):

602

438

"""The checker has completed, so take appropriate actions."""

603

439

self.checker_callback_tag = None

604

440

self.checker = None

605

441

if os.WIFEXITED(condition):

606

self.last_checker_status = os.WEXITSTATUS(condition)

607

if self.last_checker_status == 0:

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

608

444

logger.info("Checker for %(name)s succeeded",

609

445

vars(self))

610

446

self.checked_ok()

612

448

logger.info("Checker for %(name)s failed",

613

449

vars(self))

614

450

else:

615

self.last_checker_status = -1

616

451

logger.warning("Checker for %(name)s crashed?",

617

452

vars(self))

618

453

625

460

if timeout is None:

626

461

timeout = self.timeout

627

462

self.last_checked_ok = datetime.datetime.utcnow()

628

if self.disable_initiator_tag is not None:

629

gobject.source_remove(self.disable_initiator_tag)

630

if getattr(self, "enabled", False):

631

self.disable_initiator_tag = (gobject.timeout_add

632

(timedelta_to_milliseconds

633

(timeout), self.disable))

634

self.expires = datetime.datetime.utcnow() + timeout

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(self._timedelta_to_milliseconds(timeout),

467

self.disable))

635

468

636

469

def need_approval(self):

637

470

self.last_approval_request = datetime.datetime.utcnow()

677

510

'replace')))

678

511

for attr in

679

512

self.runtime_expansions)

680

513

681

514

try:

682

515

command = self.checker_command % escaped_attrs

683

516

except TypeError as error:

729

562

raise

730

563

self.checker = None

731

564

732

733

565

def dbus_service_property(dbus_interface, signature="v",

734

566

access="readwrite", byte_arrays=False):

735

567

"""Decorators for marking methods of a DBusObjectWithProperties to

781

613

782

614

class DBusObjectWithProperties(dbus.service.Object):

783

615

"""A D-Bus object with properties.

784

616

785

617

Classes inheriting from this can use the dbus_service_property

786

618

decorator to expose methods as D-Bus properties. It exposes the

787

619

standard Get(), Set(), and GetAll() methods on the D-Bus.

794

626

def _get_all_dbus_properties(self):

795

627

"""Returns a generator of (name, attribute) pairs

796

628

"""

797

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

798

for cls in self.__class__.__mro__

629

return ((prop._dbus_name, prop)

799

630

for name, prop in

800

inspect.getmembers(cls, self._is_dbus_property))

631

inspect.getmembers(self, self._is_dbus_property))

801

632

802

633

def _get_dbus_property(self, interface_name, property_name):

803

634

"""Returns a bound method if one exists which is a D-Bus

804

635

property with the specified name and interface.

805

636

"""

806

for cls in self.__class__.__mro__:

807

for name, value in (inspect.getmembers

808

(cls, self._is_dbus_property)):

809

if (value._dbus_name == property_name

810

and value._dbus_interface == interface_name):

811

return value.__get__(self)

812

637

for name in (property_name,

638

property_name + "_dbus_property"):

639

prop = getattr(self, name, None)

640

if (prop is None

641

or not self._is_dbus_property(prop)

642

or prop._dbus_name != property_name

643

or (interface_name and prop._dbus_interface

644

and interface_name != prop._dbus_interface)):

645

continue

646

return prop

813

647

# No such property

814

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

815

649

+ interface_name + "."

849

683

def GetAll(self, interface_name):

850

684

"""Standard D-Bus property GetAll() method, see D-Bus

851

685

standard.

852

686

853

687

Note: Will not include properties with access="write".

854

688

"""

855

properties = {}

689

all = {}

856

690

for name, prop in self._get_all_dbus_properties():

857

691

if (interface_name

858

692

and interface_name != prop._dbus_interface):

863

697

continue

864

698

value = prop()

865

699

if not hasattr(value, "variant_level"):

866

properties[name] = value

700

all[name] = value

867

701

continue

868

properties[name] = type(value)(value, variant_level=

869

value.variant_level+1)

870

return dbus.Dictionary(properties, signature="sv")

702

all[name] = type(value)(value, variant_level=

703

value.variant_level+1)

704

return dbus.Dictionary(all, signature="sv")

871

705

872

706

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

873

707

out_signature="s",

917

751

return xmlstring

918

752

919

753

920

def datetime_to_dbus (dt, variant_level=0):

921

"""Convert a UTC datetime.datetime() to a D-Bus type."""

922

if dt is None:

923

return dbus.String("", variant_level = variant_level)

924

return dbus.String(dt.isoformat(),

925

variant_level=variant_level)

926

927

928

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

929

.__metaclass__):

930

"""Applied to an empty subclass of a D-Bus object, this metaclass

931

will add additional D-Bus attributes matching a certain pattern.

932

"""

933

def __new__(mcs, name, bases, attr):

934

# Go through all the base classes which could have D-Bus

935

# methods, signals, or properties in them

936

for base in (b for b in bases

937

if issubclass(b, dbus.service.Object)):

938

# Go though all attributes of the base class

939

for attrname, attribute in inspect.getmembers(base):

940

# Ignore non-D-Bus attributes, and D-Bus attributes

941

# with the wrong interface name

942

if (not hasattr(attribute, "_dbus_interface")

943

or not attribute._dbus_interface

944

.startswith("se.recompile.Mandos")):

945

continue

946

# Create an alternate D-Bus interface name based on

947

# the current name

948

alt_interface = (attribute._dbus_interface

949

.replace("se.recompile.Mandos",

950

"se.bsnet.fukt.Mandos"))

951

# Is this a D-Bus signal?

952

if getattr(attribute, "_dbus_is_signal", False):

953

# Extract the original non-method function by

954

# black magic

955

nonmethod_func = (dict(

956

zip(attribute.func_code.co_freevars,

957

attribute.__closure__))["func"]

958

.cell_contents)

959

# Create a new, but exactly alike, function

960

# object, and decorate it to be a new D-Bus signal

961

# with the alternate D-Bus interface name

962

new_function = (dbus.service.signal

963

(alt_interface,

964

attribute._dbus_signature)

965

(types.FunctionType(

966

nonmethod_func.func_code,

967

nonmethod_func.func_globals,

968

nonmethod_func.func_name,

969

nonmethod_func.func_defaults,

970

nonmethod_func.func_closure)))

971

# Define a creator of a function to call both the

972

# old and new functions, so both the old and new

973

# signals gets sent when the function is called

974

def fixscope(func1, func2):

975

"""This function is a scope container to pass

976

func1 and func2 to the "call_both" function

977

outside of its arguments"""

978

def call_both(*args, **kwargs):

979

"""This function will emit two D-Bus

980

signals by calling func1 and func2"""

981

func1(*args, **kwargs)

982

func2(*args, **kwargs)

983

return call_both

984

# Create the "call_both" function and add it to

985

# the class

986

attr[attrname] = fixscope(attribute,

987

new_function)

988

# Is this a D-Bus method?

989

elif getattr(attribute, "_dbus_is_method", False):

990

# Create a new, but exactly alike, function

991

# object. Decorate it to be a new D-Bus method

992

# with the alternate D-Bus interface name. Add it

993

# to the class.

994

attr[attrname] = (dbus.service.method

995

(alt_interface,

996

attribute._dbus_in_signature,

997

attribute._dbus_out_signature)

998

(types.FunctionType

999

(attribute.func_code,

1000

attribute.func_globals,

1001

attribute.func_name,

1002

attribute.func_defaults,

1003

attribute.func_closure)))

1004

# Is this a D-Bus property?

1005

elif getattr(attribute, "_dbus_is_property", False):

1006

# Create a new, but exactly alike, function

1007

# object, and decorate it to be a new D-Bus

1008

# property with the alternate D-Bus interface

1009

# name. Add it to the class.

1010

attr[attrname] = (dbus_service_property

1011

(alt_interface,

1012

attribute._dbus_signature,

1013

attribute._dbus_access,

1014

attribute

1015

._dbus_get_args_options

1016

["byte_arrays"])

1017

(types.FunctionType

1018

(attribute.func_code,

1019

attribute.func_globals,

1020

attribute.func_name,

1021

attribute.func_defaults,

1022

attribute.func_closure)))

1023

return type.__new__(mcs, name, bases, attr)

1024

1025

1026

754

class ClientDBus(Client, DBusObjectWithProperties):

1027

755

"""A Client class using D-Bus

1028

756

1037

765

# dbus.service.Object doesn't use super(), so we can't either.

1038

766

1039

767

def __init__(self, bus = None, *args, **kwargs):

768

self._approvals_pending = 0

1040

769

self.bus = bus

1041

770

Client.__init__(self, *args, **kwargs)

1042

self._approvals_pending = 0

1043

1044

self._approvals_pending = 0

1045

771

# Only now, when this client is initialized, can it show up on

1046

772

# the D-Bus

1047

773

client_object_name = unicode(self.name).translate(

1051

777

("/clients/" + client_object_name))

1052

778

DBusObjectWithProperties.__init__(self, self.bus,

1053

779

self.dbus_object_path)

1054

1055

def notifychangeproperty(transform_func,

1056

dbus_name, type_func=lambda x: x,

1057

variant_level=1):

1058

""" Modify a variable so that it's a property which announces

1059

its changes to DBus.

1060

1061

transform_fun: Function that takes a value and a variant_level

1062

and transforms it to a D-Bus type.

1063

dbus_name: D-Bus name of the variable

1064

type_func: Function that transform the value before sending it

1065

to the D-Bus. Default: no transform

1066

variant_level: D-Bus variant level. Default: 1

1067

"""

1068

attrname = "_{0}".format(dbus_name)

1069

def setter(self, value):

1070

if hasattr(self, "dbus_object_path"):

1071

if (not hasattr(self, attrname) or

1072

type_func(getattr(self, attrname, None))

1073

!= type_func(value)):

1074

dbus_value = transform_func(type_func(value),

1075

variant_level

1076

=variant_level)

1077

self.PropertyChanged(dbus.String(dbus_name),

1078

dbus_value)

1079

setattr(self, attrname, value)

1080

1081

return property(lambda self: getattr(self, attrname), setter)

1082

1083

1084

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1085

approvals_pending = notifychangeproperty(dbus.Boolean,

1086

"ApprovalPending",

1087

type_func = bool)

1088

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1089

last_enabled = notifychangeproperty(datetime_to_dbus,

1090

"LastEnabled")

1091

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1092

type_func = lambda checker:

1093

checker is not None)

1094

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1095

"LastCheckedOK")

1096

last_approval_request = notifychangeproperty(

1097

datetime_to_dbus, "LastApprovalRequest")

1098

approved_by_default = notifychangeproperty(dbus.Boolean,

1099

"ApprovedByDefault")

1100

approval_delay = notifychangeproperty(dbus.UInt64,

1101

"ApprovalDelay",

1102

type_func =

1103

timedelta_to_milliseconds)

1104

approval_duration = notifychangeproperty(

1105

dbus.UInt64, "ApprovalDuration",

1106

type_func = timedelta_to_milliseconds)

1107

host = notifychangeproperty(dbus.String, "Host")

1108

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1109

type_func =

1110

timedelta_to_milliseconds)

1111

extended_timeout = notifychangeproperty(

1112

dbus.UInt64, "ExtendedTimeout",

1113

type_func = timedelta_to_milliseconds)

1114

interval = notifychangeproperty(dbus.UInt64,

1115

"Interval",

1116

type_func =

1117

timedelta_to_milliseconds)

1118

checker_command = notifychangeproperty(dbus.String, "Checker")

1119

1120

del notifychangeproperty

780

def _set_expires(self, value):

781

old_value = getattr(self, "_expires", None)

782

self._expires = value

783

if hasattr(self, "dbus_object_path") and old_value != value:

784

dbus_time = (self._datetime_to_dbus(self._expires,

785

variant_level=1))

786

self.PropertyChanged(dbus.String("Expires"),

787

dbus_time)

788

expires = property(lambda self: self._expires, _set_expires)

789

del _set_expires

790

791

def _get_approvals_pending(self):

792

return self._approvals_pending

793

def _set_approvals_pending(self, value):

794

old_value = self._approvals_pending

795

self._approvals_pending = value

796

bval = bool(value)

797

if (hasattr(self, "dbus_object_path")

798

and bval is not bool(old_value)):

799

dbus_bool = dbus.Boolean(bval, variant_level=1)

800

self.PropertyChanged(dbus.String("ApprovalPending"),

801

dbus_bool)

802

803

approvals_pending = property(_get_approvals_pending,

804

_set_approvals_pending)

805

del _get_approvals_pending, _set_approvals_pending

806

807

@staticmethod

808

def _datetime_to_dbus(dt, variant_level=0):

809

"""Convert a UTC datetime.datetime() to a D-Bus type."""

810

if dt is None:

811

return dbus.String("", variant_level = variant_level)

812

return dbus.String(dt.isoformat(),

813

variant_level=variant_level)

814

815

def enable(self):

816

oldstate = getattr(self, "enabled", False)

817

r = Client.enable(self)

818

if oldstate != self.enabled:

819

# Emit D-Bus signals

820

self.PropertyChanged(dbus.String("Enabled"),

821

dbus.Boolean(True, variant_level=1))

822

self.PropertyChanged(

823

dbus.String("LastEnabled"),

824

self._datetime_to_dbus(self.last_enabled,

825

variant_level=1))

826

return r

827

828

def disable(self, quiet = False):

829

oldstate = getattr(self, "enabled", False)

830

r = Client.disable(self, quiet=quiet)

831

if not quiet and oldstate != self.enabled:

832

# Emit D-Bus signal

833

self.PropertyChanged(dbus.String("Enabled"),

834

dbus.Boolean(False, variant_level=1))

835

return r

1121

836

1122

837

def __del__(self, *args, **kwargs):

1123

838

try:

1132

847

*args, **kwargs):

1133

848

self.checker_callback_tag = None

1134

849

self.checker = None

850

# Emit D-Bus signal

851

self.PropertyChanged(dbus.String("CheckerRunning"),

852

dbus.Boolean(False, variant_level=1))

1135

853

if os.WIFEXITED(condition):

1136

854

exitstatus = os.WEXITSTATUS(condition)

1137

855

# Emit D-Bus signal

1147

865

return Client.checker_callback(self, pid, condition, command,

1148

866

*args, **kwargs)

1149

867

868

def checked_ok(self, *args, **kwargs):

869

Client.checked_ok(self, *args, **kwargs)

870

# Emit D-Bus signal

871

self.PropertyChanged(

872

dbus.String("LastCheckedOK"),

873

(self._datetime_to_dbus(self.last_checked_ok,

874

variant_level=1)))

875

876

def need_approval(self, *args, **kwargs):

877

r = Client.need_approval(self, *args, **kwargs)

878

# Emit D-Bus signal

879

self.PropertyChanged(

880

dbus.String("LastApprovalRequest"),

881

(self._datetime_to_dbus(self.last_approval_request,

882

variant_level=1)))

883

return r

884

1150

885

def start_checker(self, *args, **kwargs):

1151

886

old_checker = self.checker

1152

887

if self.checker is not None:

1159

894

and old_checker_pid != self.checker.pid):

1160

895

# Emit D-Bus signal

1161

896

self.CheckerStarted(self.current_checker_command)

897

self.PropertyChanged(

898

dbus.String("CheckerRunning"),

899

dbus.Boolean(True, variant_level=1))

1162

900

return r

1163

901

902

def stop_checker(self, *args, **kwargs):

903

old_checker = getattr(self, "checker", None)

904

r = Client.stop_checker(self, *args, **kwargs)

905

if (old_checker is not None

906

and getattr(self, "checker", None) is None):

907

self.PropertyChanged(dbus.String("CheckerRunning"),

908

dbus.Boolean(False, variant_level=1))

909

return r

910

1164

911

def _reset_approved(self):

1165

self.approved = None

912

self._approved = None

1166

913

return False

1167

914

1168

915

def approve(self, value=True):

1169

916

self.send_changedstate()

1170

self.approved = value

1171

gobject.timeout_add(timedelta_to_milliseconds

917

self._approved = value

918

gobject.timeout_add(self._timedelta_to_milliseconds

1172

919

(self.approval_duration),

1173

920

self._reset_approved)

1174

921

1175

922

1176

923

## D-Bus methods, signals & properties

1177

_interface = "se.recompile.Mandos.Client"

924

_interface = "se.bsnet.fukt.Mandos.Client"

1178

925

1179

926

## Signals

1180

927

1217

964

"D-Bus signal"

1218

965

return self.need_approval()

1219

966

1220

# NeRwequest - signal

1221

@dbus.service.signal(_interface, signature="s")

1222

def NewRequest(self, ip):

1223

"""D-Bus signal

1224

Is sent after a client request a password.

1225

"""

1226

pass

1227

1228

967

## Methods

1229

968

1230

969

# Approve - method

1273

1012

def ApprovedByDefault_dbus_property(self, value=None):

1274

1013

if value is None: # get

1275

1014

return dbus.Boolean(self.approved_by_default)

1015

old_value = self.approved_by_default

1276

1016

self.approved_by_default = bool(value)

1017

# Emit D-Bus signal

1018

if old_value != self.approved_by_default:

1019

self.PropertyChanged(dbus.String("ApprovedByDefault"),

1020

dbus.Boolean(value, variant_level=1))

1277

1021

1278

1022

# ApprovalDelay - property

1279

1023

@dbus_service_property(_interface, signature="t",

1281

1025

def ApprovalDelay_dbus_property(self, value=None):

1282

1026

if value is None: # get

1283

1027

return dbus.UInt64(self.approval_delay_milliseconds())

1028

old_value = self.approval_delay

1284

1029

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1030

# Emit D-Bus signal

1031

if old_value != self.approval_delay:

1032

self.PropertyChanged(dbus.String("ApprovalDelay"),

1033

dbus.UInt64(value, variant_level=1))

1285

1034

1286

1035

# ApprovalDuration - property

1287

1036

@dbus_service_property(_interface, signature="t",

1288

1037

access="readwrite")

1289

1038

def ApprovalDuration_dbus_property(self, value=None):

1290

1039

if value is None: # get

1291

return dbus.UInt64(timedelta_to_milliseconds(

1040

return dbus.UInt64(self._timedelta_to_milliseconds(

1292

1041

self.approval_duration))

1042

old_value = self.approval_duration

1293

1043

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1044

# Emit D-Bus signal

1045

if old_value != self.approval_duration:

1046

self.PropertyChanged(dbus.String("ApprovalDuration"),

1047

dbus.UInt64(value, variant_level=1))

1294

1048

1295

1049

# Name - property

1296

1050

@dbus_service_property(_interface, signature="s", access="read")

1308

1062

def Host_dbus_property(self, value=None):

1309

1063

if value is None: # get

1310

1064

return dbus.String(self.host)

1311

self.host = unicode(value)

1065

old_value = self.host

1066

self.host = value

1067

# Emit D-Bus signal

1068

if old_value != self.host:

1069

self.PropertyChanged(dbus.String("Host"),

1070

dbus.String(value, variant_level=1))

1312

1071

1313

1072

# Created - property

1314

1073

@dbus_service_property(_interface, signature="s", access="read")

1315

1074

def Created_dbus_property(self):

1316

return datetime_to_dbus(self.created)

1075

return dbus.String(self._datetime_to_dbus(self.created))

1317

1076

1318

1077

# LastEnabled - property

1319

1078

@dbus_service_property(_interface, signature="s", access="read")

1320

1079

def LastEnabled_dbus_property(self):

1321

return datetime_to_dbus(self.last_enabled)

1080

return self._datetime_to_dbus(self.last_enabled)

1322

1081

1323

1082

# Enabled - property

1324

1083

@dbus_service_property(_interface, signature="b",

1338

1097

if value is not None:

1339

1098

self.checked_ok()

1340

1099

return

1341

return datetime_to_dbus(self.last_checked_ok)

1100

return self._datetime_to_dbus(self.last_checked_ok)

1342

1101

1343

1102

# Expires - property

1344

1103

@dbus_service_property(_interface, signature="s", access="read")

1345

1104

def Expires_dbus_property(self):

1346

return datetime_to_dbus(self.expires)

1105

return self._datetime_to_dbus(self.expires)

1347

1106

1348

1107

# LastApprovalRequest - property

1349

1108

@dbus_service_property(_interface, signature="s", access="read")

1350

1109

def LastApprovalRequest_dbus_property(self):

1351

return datetime_to_dbus(self.last_approval_request)

1110

return self._datetime_to_dbus(self.last_approval_request)

1352

1111

1353

1112

# Timeout - property

1354

1113

@dbus_service_property(_interface, signature="t",

1356

1115

def Timeout_dbus_property(self, value=None):

1357

1116

if value is None: # get

1358

1117

return dbus.UInt64(self.timeout_milliseconds())

1118

old_value = self.timeout

1359

1119

self.timeout = datetime.timedelta(0, 0, 0, value)

1120

# Emit D-Bus signal

1121

if old_value != self.timeout:

1122

self.PropertyChanged(dbus.String("Timeout"),

1123

dbus.UInt64(value, variant_level=1))

1360

1124

if getattr(self, "disable_initiator_tag", None) is None:

1361

1125

return

1362

1126

# Reschedule timeout

1363

1127

gobject.source_remove(self.disable_initiator_tag)

1364

1128

self.disable_initiator_tag = None

1365

1129

self.expires = None

1366

time_to_die = timedelta_to_milliseconds((self

1367

.last_checked_ok

1368

+ self.timeout)

1369

- datetime.datetime

1370

.utcnow())

1130

time_to_die = (self.

1131

_timedelta_to_milliseconds((self

1132

.last_checked_ok

1133

+ self.timeout)

1134

- datetime.datetime

1135

.utcnow()))

1371

1136

if time_to_die <= 0:

1372

1137

# The timeout has passed

1373

1138

self.disable()

1374

1139

else:

1375

1140

self.expires = (datetime.datetime.utcnow()

1376

+ datetime.timedelta(milliseconds =

1377

time_to_die))

1141

+ datetime.timedelta(milliseconds = time_to_die))

1378

1142

self.disable_initiator_tag = (gobject.timeout_add

1379

1143

(time_to_die, self.disable))

1380

1144

1381

1145

# ExtendedTimeout - property

1382

1146

@dbus_service_property(_interface, signature="t",

1383

1147

access="readwrite")

1384

1148

def ExtendedTimeout_dbus_property(self, value=None):

1385

1149

if value is None: # get

1386

1150

return dbus.UInt64(self.extended_timeout_milliseconds())

1151

old_value = self.extended_timeout

1387

1152

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1388

1153

# Emit D-Bus signal

1154

if old_value != self.extended_timeout:

1155

self.PropertyChanged(dbus.String("ExtendedTimeout"),

1156

dbus.UInt64(value, variant_level=1))

1157

1389

1158

# Interval - property

1390

1159

@dbus_service_property(_interface, signature="t",

1391

1160

access="readwrite")

1392

1161

def Interval_dbus_property(self, value=None):

1393

1162

if value is None: # get

1394

1163

return dbus.UInt64(self.interval_milliseconds())

1164

old_value = self.interval

1395

1165

self.interval = datetime.timedelta(0, 0, 0, value)

1166

# Emit D-Bus signal

1167

if old_value != self.interval:

1168

self.PropertyChanged(dbus.String("Interval"),

1169

dbus.UInt64(value, variant_level=1))

1396

1170

if getattr(self, "checker_initiator_tag", None) is None:

1397

1171

return

1398

if self.enabled:

1399

# Reschedule checker run

1400

gobject.source_remove(self.checker_initiator_tag)

1401

self.checker_initiator_tag = (gobject.timeout_add

1402

(value, self.start_checker))

1403

self.start_checker() # Start one now, too

1404

1172

# Reschedule checker run

1173

gobject.source_remove(self.checker_initiator_tag)

1174

self.checker_initiator_tag = (gobject.timeout_add

1175

(value, self.start_checker))

1176

self.start_checker() # Start one now, too

1177

1405

1178

# Checker - property

1406

1179

@dbus_service_property(_interface, signature="s",

1407

1180

access="readwrite")

1408

1181

def Checker_dbus_property(self, value=None):

1409

1182

if value is None: # get

1410

1183

return dbus.String(self.checker_command)

1411

self.checker_command = unicode(value)

1184

old_value = self.checker_command

1185

self.checker_command = value

1186

# Emit D-Bus signal

1187

if old_value != self.checker_command:

1188

self.PropertyChanged(dbus.String("Checker"),

1189

dbus.String(self.checker_command,

1190

variant_level=1))

1412

1191

1413

1192

# CheckerRunning - property

1414

1193

@dbus_service_property(_interface, signature="b",

1441

1220

self._pipe.send(('init', fpr, address))

1442

1221

if not self._pipe.recv():

1443

1222

raise KeyError()

1444

1223

1445

1224

def __getattribute__(self, name):

1446

if name == '_pipe':

1225

if(name == '_pipe'):

1447

1226

return super(ProxyClient, self).__getattribute__(name)

1448

1227

self._pipe.send(('getattr', name))

1449

1228

data = self._pipe.recv()

1454

1233

self._pipe.send(('funcall', name, args, kwargs))

1455

1234

return self._pipe.recv()[1]

1456

1235

return func

1457

1236

1458

1237

def __setattr__(self, name, value):

1459

if name == '_pipe':

1238

if(name == '_pipe'):

1460

1239

return super(ProxyClient, self).__setattr__(name, value)

1461

1240

self._pipe.send(('setattr', name, value))

1462

1241

1463

1242

1464

class ClientDBusTransitional(ClientDBus):

1465

__metaclass__ = AlternateDBusNamesMetaclass

1466

1467

1468

1243

class ClientHandler(socketserver.BaseRequestHandler, object):

1469

1244

"""A class to handle client connections.

1470

1245

1477

1252

unicode(self.client_address))

1478

1253

logger.debug("Pipe FD: %d",

1479

1254

self.server.child_pipe.fileno())

1480

1255

1481

1256

session = (gnutls.connection

1482

1257

.ClientSession(self.request,

1483

1258

gnutls.connection

1484

1259

.X509Credentials()))

1485

1260

1486

1261

# Note: gnutls.connection.X509Credentials is really a

1487

1262

# generic GnuTLS certificate credentials object so long as

1488

1263

# no X.509 keys are added to it. Therefore, we can use it

1489

1264

# here despite using OpenPGP certificates.

1490

1265

1491

1266

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1492

1267

# "+AES-256-CBC", "+SHA1",

1493

1268

# "+COMP-NULL", "+CTYPE-OPENPGP",

1499

1274

(gnutls.library.functions

1500

1275

.gnutls_priority_set_direct(session._c_object,

1501

1276

priority, None))

1502

1277

1503

1278

# Start communication using the Mandos protocol

1504

1279

# Get protocol number

1505

1280

line = self.request.makefile().readline()

1510

1285

except (ValueError, IndexError, RuntimeError) as error:

1511

1286

logger.error("Unknown protocol version: %s", error)

1512

1287

return

1513

1288

1514

1289

# Start GnuTLS connection

1515

1290

try:

1516

1291

session.handshake()

1520

1295

# established. Just abandon the request.

1521

1296

return

1522

1297

logger.debug("Handshake succeeded")

1523

1298

1524

1299

approval_required = False

1525

1300

try:

1526

1301

try:

1531

1306

logger.warning("Bad certificate: %s", error)

1532

1307

return

1533

1308

logger.debug("Fingerprint: %s", fpr)

1534

1309

1535

1310

try:

1536

1311

client = ProxyClient(child_pipe, fpr,

1537

1312

self.client_address)

1538

1313

except KeyError:

1539

1314

return

1540

1315

1541

if self.server.use_dbus:

1542

# Emit D-Bus signal

1543

client.NewRequest(str(self.client_address))

1544

1545

1316

if client.approval_delay:

1546

1317

delay = client.approval_delay

1547

1318

client.approvals_pending += 1

1553

1324

client.name)

1554

1325

if self.server.use_dbus:

1555

1326

# Emit D-Bus signal

1556

client.Rejected("Disabled")

1327

client.Rejected("Disabled")

1557

1328

return

1558

1329

1559

if client.approved or not client.approval_delay:

1330

if client._approved or not client.approval_delay:

1560

1331

#We are approved or approval is disabled

1561

1332

break

1562

elif client.approved is None:

1333

elif client._approved is None:

1563

1334

logger.info("Client %s needs approval",

1564

1335

client.name)

1565

1336

if self.server.use_dbus:

1576

1347

return

1577

1348

1578

1349

#wait until timeout or approved

1350

#x = float(client._timedelta_to_milliseconds(delay))

1579

1351

time = datetime.datetime.now()

1580

1352

client.changedstate.acquire()

1581

(client.changedstate.wait

1582

(float(client.timedelta_to_milliseconds(delay)

1583

/ 1000)))

1353

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1584

1354

client.changedstate.release()

1585

1355

time2 = datetime.datetime.now()

1586

1356

if (time2 - time) >= delay:

1608

1378

sent, len(client.secret)

1609

1379

- (sent_size + sent))

1610

1380

sent_size += sent

1611

1381

1612

1382

logger.info("Sending secret to %s", client.name)

1613

# bump the timeout using extended_timeout

1383

# bump the timeout as if seen

1614

1384

client.checked_ok(client.extended_timeout)

1615

1385

if self.server.use_dbus:

1616

1386

# Emit D-Bus signal

1684

1454

# Convert the buffer to a Python bytestring

1685

1455

fpr = ctypes.string_at(buf, buf_len.value)

1686

1456

# Convert the bytestring to hexadecimal notation

1687

hex_fpr = binascii.hexlify(fpr).upper()

1457

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1688

1458

return hex_fpr

1689

1459

1690

1460

1693

1463

def sub_process_main(self, request, address):

1694

1464

try:

1695

1465

self.finish_request(request, address)

1696

except Exception:

1466

except:

1697

1467

self.handle_error(request, address)

1698

1468

self.close_request(request)

1699

1469

1700

1470

def process_request(self, request, address):

1701

1471

"""Start a new process to process the request."""

1702

proc = multiprocessing.Process(target = self.sub_process_main,

1703

args = (request,

1704

address))

1705

proc.start()

1706

return proc

1707

1472

multiprocessing.Process(target = self.sub_process_main,

1473

args = (request, address)).start()

1708

1474

1709

1475

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1710

1476

""" adds a pipe to the MixIn """

1714

1480

This function creates a new pipe in self.pipe

1715

1481

"""

1716

1482

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1717

1718

proc = MultiprocessingMixIn.process_request(self, request,

1719

client_address)

1483

1484

super(MultiprocessingMixInWithPipe,

1485

self).process_request(request, client_address)

1720

1486

self.child_pipe.close()

1721

self.add_pipe(parent_pipe, proc)

1722

1723

def add_pipe(self, parent_pipe, proc):

1487

self.add_pipe(parent_pipe)

1488

1489

def add_pipe(self, parent_pipe):

1724

1490

"""Dummy function; override as necessary"""

1725

1491

raise NotImplementedError

1726

1492

1727

1728

1493

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1729

1494

socketserver.TCPServer, object):

1730

1495

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1804

1569

self.enabled = False

1805

1570

self.clients = clients

1806

1571

if self.clients is None:

1807

self.clients = {}

1572

self.clients = set()

1808

1573

self.use_dbus = use_dbus

1809

1574

self.gnutls_priority = gnutls_priority

1810

1575

IPv6_TCPServer.__init__(self, server_address,

1814

1579

def server_activate(self):

1815

1580

if self.enabled:

1816

1581

return socketserver.TCPServer.server_activate(self)

1817

1818

1582

def enable(self):

1819

1583

self.enabled = True

1820

1821

def add_pipe(self, parent_pipe, proc):

1584

def add_pipe(self, parent_pipe):

1822

1585

# Call "handle_ipc" for both data and EOF events

1823

1586

gobject.io_add_watch(parent_pipe.fileno(),

1824

1587

gobject.IO_IN | gobject.IO_HUP,

1825

1588

functools.partial(self.handle_ipc,

1826

parent_pipe =

1827

parent_pipe,

1828

proc = proc))

1829

1589

parent_pipe = parent_pipe))

1590

1830

1591

def handle_ipc(self, source, condition, parent_pipe=None,

1831

proc = None, client_object=None):

1592

client_object=None):

1832

1593

condition_names = {

1833

1594

gobject.IO_IN: "IN", # There is data to read.

1834

1595

gobject.IO_OUT: "OUT", # Data can be written (without

1843

1604

for cond, name in

1844

1605

condition_names.iteritems()

1845

1606

if cond & condition)

1846

# error, or the other end of multiprocessing.Pipe has closed

1607

# error or the other end of multiprocessing.Pipe has closed

1847

1608

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1848

# Wait for other process to exit

1849

proc.join()

1850

1609

return False

1851

1610

1852

1611

# Read a request from the child

1857

1616

fpr = request[1]

1858

1617

address = request[2]

1859

1618

1860

for c in self.clients.itervalues():

1619

for c in self.clients:

1861

1620

if c.fingerprint == fpr:

1862

1621

client = c

1863

1622

break

1866

1625

"dress: %s", fpr, address)

1867

1626

if self.use_dbus:

1868

1627

# Emit D-Bus signal

1869

mandos_dbus_service.ClientNotFound(fpr,

1870

address[0])

1628

mandos_dbus_service.ClientNotFound(fpr, address[0])

1871

1629

parent_pipe.send(False)

1872

1630

return False

1873

1631

1874

1632

gobject.io_add_watch(parent_pipe.fileno(),

1875

1633

gobject.IO_IN | gobject.IO_HUP,

1876

1634

functools.partial(self.handle_ipc,

1877

parent_pipe =

1878

parent_pipe,

1879

proc = proc,

1880

client_object =

1881

client))

1635

parent_pipe = parent_pipe,

1636

client_object = client))

1882

1637

parent_pipe.send(True)

1883

# remove the old hook in favor of the new above hook on

1884

# same fileno

1638

# remove the old hook in favor of the new above hook on same fileno

1885

1639

return False

1886

1640

if command == 'funcall':

1887

1641

funcname = request[1]

1888

1642

args = request[2]

1889

1643

kwargs = request[3]

1890

1644

1891

parent_pipe.send(('data', getattr(client_object,

1892

funcname)(*args,

1893

**kwargs)))

1894

1645

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1646

1895

1647

if command == 'getattr':

1896

1648

attrname = request[1]

1897

1649

if callable(client_object.__getattribute__(attrname)):

1898

1650

parent_pipe.send(('function',))

1899

1651

else:

1900

parent_pipe.send(('data', client_object

1901

.__getattribute__(attrname)))

1652

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1902

1653

1903

1654

if command == 'setattr':

1904

1655

attrname = request[1]

1905

1656

value = request[2]

1906

1657

setattr(client_object, attrname, value)

1907

1658

1908

1659

return True

1909

1660

1910

1661

1947

1698

return timevalue

1948

1699

1949

1700

1701

def if_nametoindex(interface):

1702

"""Call the C function if_nametoindex(), or equivalent

1703

1704

Note: This function cannot accept a unicode string."""

1705

global if_nametoindex

1706

try:

1707

if_nametoindex = (ctypes.cdll.LoadLibrary

1708

(ctypes.util.find_library("c"))

1709

.if_nametoindex)

1710

except (OSError, AttributeError):

1711

logger.warning("Doing if_nametoindex the hard way")

1712

def if_nametoindex(interface):

1713

"Get an interface index the hard way, i.e. using fcntl()"

1714

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1715

with contextlib.closing(socket.socket()) as s:

1716

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1717

struct.pack(str("16s16x"),

1718

interface))

1719

interface_index = struct.unpack(str("I"),

1720

ifreq[16:20])[0]

1721

return interface_index

1722

return if_nametoindex(interface)

1723

1724

1950

1725

def daemon(nochdir = False, noclose = False):

1951

1726

"""See daemon(3). Standard BSD Unix function.

1952

1727

2007

1782

" system bus interface")

2008

1783

parser.add_argument("--no-ipv6", action="store_false",

2009

1784

dest="use_ipv6", help="Do not use IPv6")

2010

parser.add_argument("--no-restore", action="store_false",

2011

dest="restore", help="Do not restore stored"

2012

" state")

2013

parser.add_argument("--statedir", metavar="DIR",

2014

help="Directory to save/restore state in")

2015

2016

1785

options = parser.parse_args()

2017

1786

2018

1787

if options.check:

2031

1800

"use_dbus": "True",

2032

1801

"use_ipv6": "True",

2033

1802

"debuglevel": "",

2034

"restore": "True",

2035

"statedir": "/var/lib/mandos"

2036

1803

}

2037

1804

2038

1805

# Parse config file for server-global settings

2055

1822

# options, if set.

2056

1823

for option in ("interface", "address", "port", "debug",

2057

1824

"priority", "servicename", "configdir",

2058

"use_dbus", "use_ipv6", "debuglevel", "restore",

2059

"statedir"):

1825

"use_dbus", "use_ipv6", "debuglevel"):

2060

1826

value = getattr(options, option)

2061

1827

if value is not None:

2062

1828

server_settings[option] = value

2074

1840

debuglevel = server_settings["debuglevel"]

2075

1841

use_dbus = server_settings["use_dbus"]

2076

1842

use_ipv6 = server_settings["use_ipv6"]

2077

stored_state_path = os.path.join(server_settings["statedir"],

2078

stored_state_file)

2079

2080

if debug:

2081

initlogger(logging.DEBUG)

2082

else:

2083

if not debuglevel:

2084

initlogger()

2085

else:

2086

level = getattr(logging, debuglevel.upper())

2087

initlogger(level)

2088

1843

2089

1844

if server_settings["servicename"] != "Mandos":

2090

1845

syslogger.setFormatter(logging.Formatter

2091

1846

('Mandos (%s) [%%(process)d]:'

2093

1848

% server_settings["servicename"]))

2094

1849

2095

1850

# Parse config file with clients

2096

client_config = configparser.SafeConfigParser(Client.client_defaults)

1851

client_defaults = { "timeout": "5m",

1852

"extended_timeout": "15m",

1853

"interval": "2m",

1854

"checker": "fping -q -- %%(host)s",

1855

"host": "",

1856

"approval_delay": "0s",

1857

"approval_duration": "1s",

1858

}

1859

client_config = configparser.SafeConfigParser(client_defaults)

2097

1860

client_config.read(os.path.join(server_settings["configdir"],

2098

1861

"clients.conf"))

2099

1862

2137

1900

if error[0] != errno.EPERM:

2138

1901

raise error

2139

1902

1903

if not debug and not debuglevel:

1904

syslogger.setLevel(logging.WARNING)

1905

console.setLevel(logging.WARNING)

1906

if debuglevel:

1907

level = getattr(logging, debuglevel.upper())

1908

syslogger.setLevel(level)

1909

console.setLevel(level)

1910

2140

1911

if debug:

2141

1912

# Enable all possible GnuTLS debugging

2142

1913

2165

1936

# Close all input and output, do double fork, etc.

2166

1937

daemon()

2167

1938

2168

gobject.threads_init()

2169

2170

1939

global main_loop

2171

1940

# From the Avahi example code

2172

1941

DBusGMainLoop(set_as_default=True )

2175

1944

# End of Avahi example code

2176

1945

if use_dbus:

2177

1946

try:

2178

bus_name = dbus.service.BusName("se.recompile.Mandos",

1947

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2179

1948

bus, do_not_queue=True)

2180

old_bus_name = (dbus.service.BusName

2181

("se.bsnet.fukt.Mandos", bus,

2182

do_not_queue=True))

2183

1949

except dbus.exceptions.NameExistsException as e:

2184

1950

logger.error(unicode(e) + ", disabling D-Bus")

2185

1951

use_dbus = False

2186

1952

server_settings["use_dbus"] = False

2187

1953

tcp_server.use_dbus = False

2188

1954

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2189

service = AvahiServiceToSyslog(name =

2190

server_settings["servicename"],

2191

servicetype = "_mandos._tcp",

2192

protocol = protocol, bus = bus)

1955

service = AvahiService(name = server_settings["servicename"],

1956

servicetype = "_mandos._tcp",

1957

protocol = protocol, bus = bus)

2193

1958

if server_settings["interface"]:

2194

1959

service.interface = (if_nametoindex

2195

1960

(str(server_settings["interface"])))

2199

1964

2200

1965

client_class = Client

2201

1966

if use_dbus:

2202

client_class = functools.partial(ClientDBusTransitional,

2203

bus = bus)

2204

2205

client_settings = Client.config_parser(client_config)

2206

old_client_settings = {}

2207

clients_data = {}

2208

2209

# Get client data and settings from last running state.

2210

if server_settings["restore"]:

2211

try:

2212

with open(stored_state_path, "rb") as stored_state:

2213

clients_data, old_client_settings = (pickle.load

2214

(stored_state))

2215

os.remove(stored_state_path)

2216

except IOError as e:

2217

logger.warning("Could not load persistent state: {0}"

2218

.format(e))

2219

if e.errno != errno.ENOENT:

2220

raise

2221

except EOFError as e:

2222

logger.warning("Could not load persistent state: "

2223

"EOFError: {0}".format(e))

2224

2225

with PGPEngine() as pgp:

2226

for client_name, client in clients_data.iteritems():

2227

# Decide which value to use after restoring saved state.

2228

# We have three different values: Old config file,

2229

# new config file, and saved state.

2230

# New config value takes precedence if it differs from old

2231

# config value, otherwise use saved state.

2232

for name, value in client_settings[client_name].items():

2233

try:

2234

# For each value in new config, check if it

2235

# differs from the old config value (Except for

2236

# the "secret" attribute)

2237

if (name != "secret" and

2238

value != old_client_settings[client_name]

2239

[name]):

2240

client[name] = value

2241

except KeyError:

2242

pass

2243

2244

# Clients who has passed its expire date can still be

2245

# enabled if its last checker was successful. Clients

2246

# whose checker failed before we stored its state is

2247

# assumed to have failed all checkers during downtime.

2248

if client["enabled"]:

2249

if datetime.datetime.utcnow() >= client["expires"]:

2250

if not client["last_checked_ok"]:

2251

logger.warning(

2252

"disabling client {0} - Client never "

2253

"performed a successfull checker"

2254

.format(client["name"]))

2255

client["enabled"] = False

2256

elif client["last_checker_status"] != 0:

2257

logger.warning(

2258

"disabling client {0} - Client "

2259

"last checker failed with error code {1}"

2260

.format(client["name"],

2261

client["last_checker_status"]))

2262

client["enabled"] = False

2263

else:

2264

client["expires"] = (datetime.datetime

2265

.utcnow()

2266

+ client["timeout"])

2267

1967

client_class = functools.partial(ClientDBus, bus = bus)

1968

def client_config_items(config, section):

1969

special_settings = {

1970

"approved_by_default":

1971

lambda: config.getboolean(section,

1972

"approved_by_default"),

1973

}

1974

for name, value in config.items(section):

2268

1975

try:

2269

client["secret"] = (

2270

pgp.decrypt(client["encrypted_secret"],

2271

client_settings[client_name]

2272

["secret"]))

2273

except PGPError:

2274

# If decryption fails, we use secret from new settings

2275

logger.debug("Failed to decrypt {0} old secret"

2276

.format(client_name))

2277

client["secret"] = (

2278

client_settings[client_name]["secret"])

2279

2280

2281

# Add/remove clients based on new changes made to config

2282

for client_name in set(old_client_settings) - set(client_settings):

2283

del clients_data[client_name]

2284

for client_name in set(client_settings) - set(old_client_settings):

2285

clients_data[client_name] = client_settings[client_name]

2286

2287

# Create clients all clients

2288

for client_name, client in clients_data.iteritems():

2289

tcp_server.clients[client_name] = client_class(

2290

name = client_name, settings = client)

2291

1976

yield (name, special_settings[name]())

1977

except KeyError:

1978

yield (name, value)

1979

1980

tcp_server.clients.update(set(

1981

client_class(name = section,

1982

config= dict(client_config_items(

1983

client_config, section)))

1984

for section in client_config.sections()))

2292

1985

if not tcp_server.clients:

2293

1986

logger.warning("No clients defined")

2294

1987

2305

1998

# "pidfile" was never created

2306

1999

pass

2307

2000

del pidfilename

2001

2308

2002

signal.signal(signal.SIGINT, signal.SIG_IGN)

2309

2003

2310

2004

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2311

2005

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2312

2006

2315

2009

"""A D-Bus proxy object"""

2316

2010

def __init__(self):

2317

2011

dbus.service.Object.__init__(self, bus, "/")

2318

_interface = "se.recompile.Mandos"

2012

_interface = "se.bsnet.fukt.Mandos"

2319

2013

2320

2014

@dbus.service.signal(_interface, signature="o")

2321

2015

def ClientAdded(self, objpath):

2336

2030

def GetAllClients(self):

2337

2031

"D-Bus method"

2338

2032

return dbus.Array(c.dbus_object_path

2339

for c in

2340

tcp_server.clients.itervalues())

2033

for c in tcp_server.clients)

2341

2034

2342

2035

@dbus.service.method(_interface,

2343

2036

out_signature="a{oa{sv}}")

2345

2038

"D-Bus method"

2346

2039

return dbus.Dictionary(

2347

2040

((c.dbus_object_path, c.GetAll(""))

2348

for c in tcp_server.clients.itervalues()),

2041

for c in tcp_server.clients),

2349

2042

signature="oa{sv}")

2350

2043

2351

2044

@dbus.service.method(_interface, in_signature="o")

2352

2045

def RemoveClient(self, object_path):

2353

2046

"D-Bus method"

2354

for c in tcp_server.clients.itervalues():

2047

for c in tcp_server.clients:

2355

2048

if c.dbus_object_path == object_path:

2356

del tcp_server.clients[c.name]

2049

tcp_server.clients.remove(c)

2357

2050

c.remove_from_connection()

2358

2051

# Don't signal anything except ClientRemoved

2359

2052

c.disable(quiet=True)

2364

2057

2365

2058

del _interface

2366

2059

2367

class MandosDBusServiceTransitional(MandosDBusService):

2368

__metaclass__ = AlternateDBusNamesMetaclass

2369

mandos_dbus_service = MandosDBusServiceTransitional()

2060

mandos_dbus_service = MandosDBusService()

2370

2061

2371

2062

def cleanup():

2372

2063

"Cleanup function; run on exit"

2373

2064

service.cleanup()

2374

2065

2375

multiprocessing.active_children()

2376

if not (tcp_server.clients or client_settings):

2377

return

2378

2379

# Store client before exiting. Secrets are encrypted with key

2380

# based on what config file has. If config file is

2381

# removed/edited, old secret will thus be unrecovable.

2382

clients = {}

2383

with PGPEngine() as pgp:

2384

for client in tcp_server.clients.itervalues():

2385

key = client_settings[client.name]["secret"]

2386

client.encrypted_secret = pgp.encrypt(client.secret,

2387

key)

2388

client_dict = {}

2389

2390

# A list of attributes that can not be pickled

2391

# + secret.

2392

exclude = set(("bus", "changedstate", "secret",

2393

"checker"))

2394

for name, typ in (inspect.getmembers

2395

(dbus.service.Object)):

2396

exclude.add(name)

2397

2398

client_dict["encrypted_secret"] = (client

2399

.encrypted_secret)

2400

for attr in client.client_structure:

2401

if attr not in exclude:

2402

client_dict[attr] = getattr(client, attr)

2403

2404

clients[client.name] = client_dict

2405

del client_settings[client.name]["secret"]

2406

2407

try:

2408

with os.fdopen(os.open(stored_state_path,

2409

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2410

0600), "wb") as stored_state:

2411

pickle.dump((clients, client_settings), stored_state)

2412

except (IOError, OSError) as e:

2413

logger.warning("Could not save persistent state: {0}"

2414

.format(e))

2415

if e.errno not in (errno.ENOENT, errno.EACCES):

2416

raise

2417

2418

# Delete all clients, and settings from config

2419

2066

while tcp_server.clients:

2420

name, client = tcp_server.clients.popitem()

2067

client = tcp_server.clients.pop()

2421

2068

if use_dbus:

2422

2069

client.remove_from_connection()

2070

client.disable_hook = None

2423

2071

# Don't signal anything except ClientRemoved

2424

2072

client.disable(quiet=True)

2425

2073

if use_dbus:

2426

2074

# Emit D-Bus signal

2427

mandos_dbus_service.ClientRemoved(client

2428

.dbus_object_path,

2075

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2429

2076

client.name)

2430

client_settings.clear()

2431

2077

2432

2078

atexit.register(cleanup)

2433

2079

2434

for client in tcp_server.clients.itervalues():

2080

for client in tcp_server.clients:

2435

2081

if use_dbus:

2436

2082

# Emit D-Bus signal

2437

2083

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2438

# Need to initiate checking of clients

2439

if client.enabled:

2440

client.init_checker()

2084

client.enable()

2441

2085

2442

2086

tcp_server.enable()

2443

2087

tcp_server.server_activate()