/mandos/release : revision 24.1.152

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

64

69

65

import dbus

70

66

import dbus.service

75

71

import ctypes.util

76

72

import xml.dom.minidom

77

73

import inspect

78

import GnuPGInterface

79

74

80

75

try:

81

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

80

except ImportError:

86

81

SO_BINDTODEVICE = None

87

82

88

version = "1.4.1"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

83

84

version = "1.0.14"

85

86

logger = logging.Logger(u'mandos')

92

87

syslogger = (logging.handlers.SysLogHandler

93

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet'])

146

147

def __enter__(self):

148

return self

149

150

def __exit__ (self, exc_type, exc_value, traceback):

151

self._cleanup()

152

return False

153

154

def __del__(self):

155

self._cleanup()

156

157

def _cleanup(self):

158

if self.tempdir is not None:

159

# Delete contents of tempdir

160

for root, dirs, files in os.walk(self.tempdir,

161

topdown = False):

162

for filename in files:

163

os.remove(os.path.join(root, filename))

164

for dirname in dirs:

165

os.rmdir(os.path.join(root, dirname))

166

# Remove tempdir

167

os.rmdir(self.tempdir)

168

self.tempdir = None

169

170

def password_encode(self, password):

171

# Passphrase can not be empty and can not contain newlines or

172

# NUL bytes. So we prefix it and hex encode it.

173

return b"mandos" + binascii.hexlify(password)

174

175

def encrypt(self, data, password):

176

self.gnupg.passphrase = self.password_encode(password)

177

with open(os.devnull) as devnull:

178

try:

179

proc = self.gnupg.run(['--symmetric'],

180

create_fhs=['stdin', 'stdout'],

181

attach_fhs={'stderr': devnull})

182

with contextlib.closing(proc.handles['stdin']) as f:

183

f.write(data)

184

with contextlib.closing(proc.handles['stdout']) as f:

185

ciphertext = f.read()

186

proc.wait()

187

except IOError as e:

188

raise PGPError(e)

189

self.gnupg.passphrase = None

190

return ciphertext

191

192

def decrypt(self, data, password):

193

self.gnupg.passphrase = self.password_encode(password)

194

with open(os.devnull) as devnull:

195

try:

196

proc = self.gnupg.run(['--decrypt'],

197

create_fhs=['stdin', 'stdout'],

198

attach_fhs={'stderr': devnull})

199

with contextlib.closing(proc.handles['stdin'] ) as f:

200

f.write(data)

201

with contextlib.closing(proc.handles['stdout']) as f:

202

decrypted_plaintext = f.read()

203

proc.wait()

204

except IOError as e:

205

raise PGPError(e)

206

self.gnupg.passphrase = None

207

return decrypted_plaintext

208

209

89

address = "/dev/log"))

90

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

93

logger.addHandler(syslogger)

94

95

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

logger.addHandler(console)

210

100

211

101

class AvahiError(Exception):

212

102

def __init__(self, value, *args, **kwargs):

228

118

Attributes:

229

119

interface: integer; avahi.IF_UNSPEC or an interface index.

230

120

Used to optionally bind to the specified interface.

231

232

type: string; Example: '_mandos._tcp'.

121

122

type: string; Example: u'_mandos._tcp'.

233

123

See <http://www.dns-sd.org/ServiceTypes.html>

234

124

port: integer; what port to announce

235

125

TXT: list of strings; TXT record for the service

244

134

"""

245

135

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

246

136

servicetype = None, port = None, TXT = None,

247

domain = "", host = "", max_renames = 32768,

137

domain = u"", host = u"", max_renames = 32768,

248

138

protocol = avahi.PROTO_UNSPEC, bus = None):

249

139

self.interface = interface

250

140

self.name = name

259

149

self.group = None # our entry group

260

150

self.server = None

261

151

self.bus = bus

262

self.entry_group_state_changed_match = None

263

152

def rename(self):

264

153

"""Derived from the Avahi example code"""

265

154

if self.rename_count >= self.max_renames:

266

logger.critical("No suitable Zeroconf service name found"

267

" after %i retries, exiting.",

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

268

157

self.rename_count)

269

raise AvahiServiceError("Too many renames")

270

self.name = unicode(self.server

271

.GetAlternativeServiceName(self.name))

272

logger.info("Changing Zeroconf service name to %r ...",

273

self.name)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

162

syslogger.setFormatter(logging.Formatter

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

165

% self.name))

274

166

self.remove()

275

try:

276

self.add()

277

except dbus.exceptions.DBusException as error:

278

logger.critical("DBusException: %s", error)

279

self.cleanup()

280

os._exit(1)

167

self.add()

281

168

self.rename_count += 1

282

169

def remove(self):

283

170

"""Derived from the Avahi example code"""

284

if self.entry_group_state_changed_match is not None:

285

self.entry_group_state_changed_match.remove()

286

self.entry_group_state_changed_match = None

287

171

if self.group is not None:

288

172

self.group.Reset()

289

173

def add(self):

290

174

"""Derived from the Avahi example code"""

291

self.remove()

292

175

if self.group is None:

293

176

self.group = dbus.Interface(

294

177

self.bus.get_object(avahi.DBUS_NAME,

295

178

self.server.EntryGroupNew()),

296

179

avahi.DBUS_INTERFACE_ENTRY_GROUP)

297

self.entry_group_state_changed_match = (

298

self.group.connect_to_signal(

299

'StateChanged', self.entry_group_state_changed))

300

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

301

184

self.name, self.type)

302

185

self.group.AddService(

303

186

self.interface,

310

193

self.group.Commit()

311

194

def entry_group_state_changed(self, state, error):

312

195

"""Derived from the Avahi example code"""

313

logger.debug("Avahi entry group state change: %i", state)

196

logger.debug(u"Avahi state change: %i", state)

314

197

315

198

if state == avahi.ENTRY_GROUP_ESTABLISHED:

316

logger.debug("Zeroconf service established.")

199

logger.debug(u"Zeroconf service established.")

317

200

elif state == avahi.ENTRY_GROUP_COLLISION:

318

logger.info("Zeroconf service name collision.")

201

logger.warning(u"Zeroconf service name collision.")

319

202

self.rename()

320

203

elif state == avahi.ENTRY_GROUP_FAILURE:

321

logger.critical("Avahi: Error in group state changed %s",

204

logger.critical(u"Avahi: Error in group state changed %s",

322

205

unicode(error))

323

raise AvahiGroupError("State changed: %s"

206

raise AvahiGroupError(u"State changed: %s"

324

207

% unicode(error))

325

208

def cleanup(self):

326

209

"""Derived from the Avahi example code"""

327

210

if self.group is not None:

328

try:

329

self.group.Free()

330

except (dbus.exceptions.UnknownMethodException,

331

dbus.exceptions.DBusException):

332

pass

211

self.group.Free()

333

212

self.group = None

334

self.remove()

335

def server_state_changed(self, state, error=None):

213

def server_state_changed(self, state):

336

214

"""Derived from the Avahi example code"""

337

logger.debug("Avahi server state change: %i", state)

338

bad_states = { avahi.SERVER_INVALID:

339

"Zeroconf server invalid",

340

avahi.SERVER_REGISTERING: None,

341

avahi.SERVER_COLLISION:

342

"Zeroconf server name collision",

343

avahi.SERVER_FAILURE:

344

"Zeroconf server failure" }

345

if state in bad_states:

346

if bad_states[state] is not None:

347

if error is None:

348

logger.error(bad_states[state])

349

else:

350

logger.error(bad_states[state] + ": %r", error)

351

self.cleanup()

215

if state == avahi.SERVER_COLLISION:

216

logger.error(u"Zeroconf server name collision")

217

self.remove()

352

218

elif state == avahi.SERVER_RUNNING:

353

219

self.add()

354

else:

355

if error is None:

356

logger.debug("Unknown state: %r", state)

357

else:

358

logger.debug("Unknown state: %r: %r", state, error)

359

220

def activate(self):

360

221

"""Derived from the Avahi example code"""

361

222

if self.server is None:

362

223

self.server = dbus.Interface(

363

224

self.bus.get_object(avahi.DBUS_NAME,

364

avahi.DBUS_PATH_SERVER,

365

follow_name_owner_changes=True),

225

avahi.DBUS_PATH_SERVER),

366

226

avahi.DBUS_INTERFACE_SERVER)

367

self.server.connect_to_signal("StateChanged",

227

self.server.connect_to_signal(u"StateChanged",

368

228

self.server_state_changed)

369

229

self.server_state_changed(self.server.GetState())

370

230

371

class AvahiServiceToSyslog(AvahiService):

372

def rename(self):

373

"""Add the new name to the syslog messages"""

374

ret = AvahiService.rename(self)

375

syslogger.setFormatter(logging.Formatter

376

('Mandos (%s) [%%(process)d]:'

377

' %%(levelname)s: %%(message)s'

378

% self.name))

379

return ret

380

231

381

def timedelta_to_milliseconds(td):

382

"Convert a datetime.timedelta() to milliseconds"

383

return ((td.days * 24 * 60 * 60 * 1000)

384

+ (td.seconds * 1000)

385

+ (td.microseconds // 1000))

386

387

232

class Client(object):

388

233

"""A representation of a client host served by this server.

389

234

390

235

Attributes:

391

approved: bool(); 'None' if not yet approved/disapproved

392

approval_delay: datetime.timedelta(); Time to wait for approval

393

approval_duration: datetime.timedelta(); Duration of one approval

236

237

D-Bus identifiers

238

fingerprint: string (40 or 32 hexadecimal digits); used to

239

uniquely identify the client

240

secret: bytestring; sent verbatim (over TLS) to client

241

host: string; available for use by the checker command

242

created: datetime.datetime(); (UTC) object creation

243

last_enabled: datetime.datetime(); (UTC)

244

enabled: bool()

245

last_checked_ok: datetime.datetime(); (UTC) or None

246

timeout: datetime.timedelta(); How long from last_checked_ok

247

until this client is disabled

248

interval: datetime.timedelta(); How often to start a new checker

249

disable_hook: If set, called by disable() as disable_hook(self)

394

250

checker: subprocess.Popen(); a running checker process used

395

251

to see if the client lives.

396

252

'None' if no process is running.

397

checker_callback_tag: a gobject event source tag, or None

398

checker_command: string; External command which is run to check

399

if client lives. %() expansions are done at

253

checker_initiator_tag: a gobject event source tag, or None

254

disable_initiator_tag: - '' -

255

checker_callback_tag: - '' -

256

checker_command: string; External command which is run to check if

257

client lives. %() expansions are done at

400

258

runtime with vars(self) as dict, so that for

401

259

instance %(name)s can be used in the command.

402

checker_initiator_tag: a gobject event source tag, or None

403

created: datetime.datetime(); (UTC) object creation

404

client_structure: Object describing what attributes a client has

405

and is used for storing the client at exit

406

260

current_checker_command: string; current running checker_command

407

disable_initiator_tag: a gobject event source tag, or None

408

enabled: bool()

409

fingerprint: string (40 or 32 hexadecimal digits); used to

410

uniquely identify the client

411

host: string; available for use by the checker command

412

interval: datetime.timedelta(); How often to start a new checker

413

last_approval_request: datetime.datetime(); (UTC) or None

414

last_checked_ok: datetime.datetime(); (UTC) or None

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

419

420

D-Bus identifiers

421

secret: bytestring; sent verbatim (over TLS) to client

422

timeout: datetime.timedelta(); How long from last_checked_ok

423

until this client is disabled

424

extended_timeout: extra long timeout when password has been sent

425

runtime_expansions: Allowed attributes for runtime expansion.

426

expires: datetime.datetime(); time (UTC) when a client will be

427

disabled, or None

261

approved_delay: datetime.timedelta(); Time to wait for approval

262

_approved: bool(); 'None' if not yet approved/disapproved

263

approved_duration: datetime.timedelta(); Duration of one approval

428

264

"""

429

265

430

runtime_expansions = ("approval_delay", "approval_duration",

431

"created", "enabled", "fingerprint",

432

"host", "interval", "last_checked_ok",

433

"last_enabled", "name", "timeout")

434

client_defaults = { "timeout": "5m",

435

"extended_timeout": "15m",

436

"interval": "2m",

437

"checker": "fping -q -- %%(host)s",

438

"host": "",

439

"approval_delay": "0s",

440

"approval_duration": "1s",

441

"approved_by_default": "True",

442

"enabled": "True",

443

}

266

@staticmethod

267

def _timedelta_to_milliseconds(td):

268

"Convert a datetime.timedelta() to milliseconds"

269

return ((td.days * 24 * 60 * 60 * 1000)

270

+ (td.seconds * 1000)

271

+ (td.microseconds // 1000))

444

272

445

273

def timeout_milliseconds(self):

446

274

"Return the 'timeout' attribute in milliseconds"

447

return timedelta_to_milliseconds(self.timeout)

448

449

def extended_timeout_milliseconds(self):

450

"Return the 'extended_timeout' attribute in milliseconds"

451

return timedelta_to_milliseconds(self.extended_timeout)

275

return self._timedelta_to_milliseconds(self.timeout)

452

276

453

277

def interval_milliseconds(self):

454

278

"Return the 'interval' attribute in milliseconds"

455

return timedelta_to_milliseconds(self.interval)

279

return self._timedelta_to_milliseconds(self.interval)

280

281

def approved_delay_milliseconds(self):

282

return self._timedelta_to_milliseconds(self.approved_delay)

456

283

457

def approval_delay_milliseconds(self):

458

return timedelta_to_milliseconds(self.approval_delay)

459

460

@staticmethod

461

def config_parser(config):

462

""" Construct a new dict of client settings of this form:

463

{ client_name: {setting_name: value, ...}, ...}

464

with exceptions for any special settings as defined above"""

465

settings = {}

466

for client_name in config.sections():

467

section = dict(config.items(client_name))

468

client = settings[client_name] = {}

469

470

client["host"] = section["host"]

471

# Reformat values from string types to Python types

472

client["approved_by_default"] = config.getboolean(

473

client_name, "approved_by_default")

474

client["enabled"] = config.getboolean(client_name, "enabled")

475

476

client["fingerprint"] = (section["fingerprint"].upper()

477

.replace(" ", ""))

478

if "secret" in section:

479

client["secret"] = section["secret"].decode("base64")

480

elif "secfile" in section:

481

with open(os.path.expanduser(os.path.expandvars

482

(section["secfile"])),

483

"rb") as secfile:

484

client["secret"] = secfile.read()

485

else:

486

raise TypeError("No secret or secfile for section %s"

487

% section)

488

client["timeout"] = string_to_delta(section["timeout"])

489

client["extended_timeout"] = string_to_delta(

490

section["extended_timeout"])

491

client["interval"] = string_to_delta(section["interval"])

492

client["approval_delay"] = string_to_delta(

493

section["approval_delay"])

494

client["approval_duration"] = string_to_delta(

495

section["approval_duration"])

496

client["checker_command"] = section["checker"]

497

client["last_approval_request"] = None

498

client["last_checked_ok"] = None

499

client["last_checker_status"] = None

500

if client["enabled"]:

501

client["last_enabled"] = datetime.datetime.utcnow()

502

client["expires"] = (datetime.datetime.utcnow()

503

+ client["timeout"])

504

else:

505

client["last_enabled"] = None

506

client["expires"] = None

507

508

return settings

509

510

511

def __init__(self, settings, name = None):

284

def __init__(self, name = None, disable_hook=None, config=None):

512

285

"""Note: the 'checker' key in 'config' sets the

513

286

'checker_command' attribute and *not* the 'checker'

514

287

attribute."""

515

288

self.name = name

516

# adding all client settings

517

for setting, value in settings.iteritems():

518

setattr(self, setting, value)

519

520

logger.debug("Creating client %r", self.name)

289

if config is None:

290

config = {}

291

logger.debug(u"Creating client %r", self.name)

521

292

# Uppercase and remove spaces from fingerprint for later

522

293

# comparison purposes with return value from the fingerprint()

523

294

# function

524

logger.debug(" Fingerprint: %s", self.fingerprint)

525

self.created = settings.get("created", datetime.datetime.utcnow())

526

527

# attributes specific for this server instance

295

self.fingerprint = (config[u"fingerprint"].upper()

296

.replace(u" ", u""))

297

logger.debug(u" Fingerprint: %s", self.fingerprint)

298

if u"secret" in config:

299

self.secret = config[u"secret"].decode(u"base64")

300

elif u"secfile" in config:

301

with open(os.path.expanduser(os.path.expandvars

302

(config[u"secfile"])),

303

"rb") as secfile:

304

self.secret = secfile.read()

305

else:

306

#XXX Need to allow secret on demand!

307

raise TypeError(u"No secret or secfile for client %s"

308

% self.name)

309

self.host = config.get(u"host", u"")

310

self.created = datetime.datetime.utcnow()

311

self.enabled = False

312

self.last_enabled = None

313

self.last_checked_ok = None

314

self.timeout = string_to_delta(config[u"timeout"])

315

self.interval = string_to_delta(config[u"interval"])

316

self.disable_hook = disable_hook

528

317

self.checker = None

529

318

self.checker_initiator_tag = None

530

319

self.disable_initiator_tag = None

531

320

self.checker_callback_tag = None

321

self.checker_command = config[u"checker"]

532

322

self.current_checker_command = None

533

self.approved = None

323

self.last_connect = None

534

324

self.approvals_pending = 0

535

self.changedstate = (multiprocessing_manager

536

.Condition(multiprocessing_manager

537

.Lock()))

538

self.client_structure = [attr for attr in

539

self.__dict__.iterkeys()

540

if not attr.startswith("_")]

541

self.client_structure.append("client_structure")

542

543

for name, t in inspect.getmembers(type(self),

544

lambda obj:

545

isinstance(obj,

546

property)):

547

if not name.startswith("_"):

548

self.client_structure.append(name)

549

550

# Send notice to process children that client state has changed

325

self._approved = None

326

self.approved_by_default = config.get(u"approved_by_default",

327

False)

328

self.approved_delay = string_to_delta(

329

config[u"approved_delay"])

330

self.approved_duration = string_to_delta(

331

config[u"approved_duration"])

332

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

333

551

334

def send_changedstate(self):

552

with self.changedstate:

553

self.changedstate.notify_all()

554

335

self.changedstate.acquire()

336

self.changedstate.notify_all()

337

self.changedstate.release()

338

555

339

def enable(self):

556

340

"""Start this client's checker and timeout hooks"""

557

if getattr(self, "enabled", False):

341

if getattr(self, u"enabled", False):

558

342

# Already enabled

559

343

return

560

344

self.send_changedstate()

561

self.expires = datetime.datetime.utcnow() + self.timeout

562

self.enabled = True

563

345

self.last_enabled = datetime.datetime.utcnow()

564

self.init_checker()

565

566

def disable(self, quiet=True):

567

"""Disable this client."""

568

if not getattr(self, "enabled", False):

569

return False

570

if not quiet:

571

self.send_changedstate()

572

if not quiet:

573

logger.info("Disabling client %s", self.name)

574

if getattr(self, "disable_initiator_tag", False):

575

gobject.source_remove(self.disable_initiator_tag)

576

self.disable_initiator_tag = None

577

self.expires = None

578

if getattr(self, "checker_initiator_tag", False):

579

gobject.source_remove(self.checker_initiator_tag)

580

self.checker_initiator_tag = None

581

self.stop_checker()

582

self.enabled = False

583

# Do not run this again if called by a gobject.timeout_add

584

return False

585

586

def __del__(self):

587

self.disable()

588

589

def init_checker(self):

590

346

# Schedule a new checker to be started an 'interval' from now,

591

347

# and every interval from then on.

592

348

self.checker_initiator_tag = (gobject.timeout_add

596

352

self.disable_initiator_tag = (gobject.timeout_add

597

353

(self.timeout_milliseconds(),

598

354

self.disable))

355

self.enabled = True

599

356

# Also start a new checker *right now*.

600

357

self.start_checker()

601

358

359

def disable(self, quiet=True):

360

"""Disable this client."""

361

if not getattr(self, "enabled", False):

362

return False

363

if not quiet:

364

self.send_changedstate()

365

if not quiet:

366

logger.info(u"Disabling client %s", self.name)

367

if getattr(self, u"disable_initiator_tag", False):

368

gobject.source_remove(self.disable_initiator_tag)

369

self.disable_initiator_tag = None

370

if getattr(self, u"checker_initiator_tag", False):

371

gobject.source_remove(self.checker_initiator_tag)

372

self.checker_initiator_tag = None

373

self.stop_checker()

374

if self.disable_hook:

375

self.disable_hook(self)

376

self.enabled = False

377

# Do not run this again if called by a gobject.timeout_add

378

return False

379

380

def __del__(self):

381

self.disable_hook = None

382

self.disable()

383

602

384

def checker_callback(self, pid, condition, command):

603

385

"""The checker has completed, so take appropriate actions."""

604

386

self.checker_callback_tag = None

605

387

self.checker = None

606

388

if os.WIFEXITED(condition):

607

self.last_checker_status = os.WEXITSTATUS(condition)

608

if self.last_checker_status == 0:

609

logger.info("Checker for %(name)s succeeded",

389

exitstatus = os.WEXITSTATUS(condition)

390

if exitstatus == 0:

391

logger.info(u"Checker for %(name)s succeeded",

610

392

vars(self))

611

393

self.checked_ok()

612

394

else:

613

logger.info("Checker for %(name)s failed",

395

logger.info(u"Checker for %(name)s failed",

614

396

vars(self))

615

397

else:

616

self.last_checker_status = -1

617

logger.warning("Checker for %(name)s crashed?",

398

logger.warning(u"Checker for %(name)s crashed?",

618

399

vars(self))

619

400

620

def checked_ok(self, timeout=None):

401

def checked_ok(self):

621

402

"""Bump up the timeout for this client.

622

403

623

404

This should only be called when the client has been seen,

624

405

alive and well.

625

406

"""

626

if timeout is None:

627

timeout = self.timeout

628

407

self.last_checked_ok = datetime.datetime.utcnow()

629

if self.disable_initiator_tag is not None:

630

gobject.source_remove(self.disable_initiator_tag)

631

if getattr(self, "enabled", False):

632

self.disable_initiator_tag = (gobject.timeout_add

633

(timedelta_to_milliseconds

634

(timeout), self.disable))

635

self.expires = datetime.datetime.utcnow() + timeout

636

637

def need_approval(self):

638

self.last_approval_request = datetime.datetime.utcnow()

408

gobject.source_remove(self.disable_initiator_tag)

409

self.disable_initiator_tag = (gobject.timeout_add

410

(self.timeout_milliseconds(),

411

self.disable))

639

412

640

413

def start_checker(self):

641

414

"""Start a new checker subprocess if one is not running.

654

427

# If a checker exists, make sure it is not a zombie

655

428

try:

656

429

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

657

except (AttributeError, OSError) as error:

430

except (AttributeError, OSError), error:

658

431

if (isinstance(error, OSError)

659

432

and error.errno != errno.ECHILD):

660

433

raise error

661

434

else:

662

435

if pid:

663

logger.warning("Checker was a zombie")

436

logger.warning(u"Checker was a zombie")

664

437

gobject.source_remove(self.checker_callback_tag)

665

438

self.checker_callback(pid, status,

666

439

self.current_checker_command)

671

444

command = self.checker_command % self.host

672

445

except TypeError:

673

446

# Escape attributes for the shell

674

escaped_attrs = dict(

675

(attr,

676

re.escape(unicode(str(getattr(self, attr, "")),

677

errors=

678

'replace')))

679

for attr in

680

self.runtime_expansions)

681

447

escaped_attrs = dict((key,

448

re.escape(unicode(str(val),

449

errors=

450

u'replace')))

451

for key, val in

452

vars(self).iteritems())

682

453

try:

683

454

command = self.checker_command % escaped_attrs

684

except TypeError as error:

685

logger.error('Could not format string "%s":'

686

' %s', self.checker_command, error)

455

except TypeError, error:

456

logger.error(u'Could not format string "%s":'

457

u' %s', self.checker_command, error)

687

458

return True # Try again later

688

459

self.current_checker_command = command

689

460

try:

690

logger.info("Starting checker %r for %s",

461

logger.info(u"Starting checker %r for %s",

691

462

command, self.name)

692

463

# We don't need to redirect stdout and stderr, since

693

464

# in normal mode, that is already done by daemon(),

695

466

# always replaced by /dev/null.)

696

467

self.checker = subprocess.Popen(command,

697

468

close_fds=True,

698

shell=True, cwd="/")

469

shell=True, cwd=u"/")

699

470

self.checker_callback_tag = (gobject.child_watch_add

700

471

(self.checker.pid,

701

472

self.checker_callback,

706

477

if pid:

707

478

gobject.source_remove(self.checker_callback_tag)

708

479

self.checker_callback(pid, status, command)

709

except OSError as error:

710

logger.error("Failed to start subprocess: %s",

480

except OSError, error:

481

logger.error(u"Failed to start subprocess: %s",

711

482

error)

712

483

# Re-run this periodically if run by gobject.timeout_add

713

484

return True

717

488

if self.checker_callback_tag:

718

489

gobject.source_remove(self.checker_callback_tag)

719

490

self.checker_callback_tag = None

720

if getattr(self, "checker", None) is None:

491

if getattr(self, u"checker", None) is None:

721

492

return

722

logger.debug("Stopping checker for %(name)s", vars(self))

493

logger.debug(u"Stopping checker for %(name)s", vars(self))

723

494

try:

724

495

os.kill(self.checker.pid, signal.SIGTERM)

725

496

#time.sleep(0.5)

726

497

#if self.checker.poll() is None:

727

498

# os.kill(self.checker.pid, signal.SIGKILL)

728

except OSError as error:

499

except OSError, error:

729

500

if error.errno != errno.ESRCH: # No such process

730

501

raise

731

502

self.checker = None

732

503

733

734

def dbus_service_property(dbus_interface, signature="v",

735

access="readwrite", byte_arrays=False):

504

def dbus_service_property(dbus_interface, signature=u"v",

505

access=u"readwrite", byte_arrays=False):

736

506

"""Decorators for marking methods of a DBusObjectWithProperties to

737

507

become properties on the D-Bus.

738

508

745

515

"""

746

516

# Encoding deeply encoded byte arrays is not supported yet by the

747

517

# "Set" method, so we fail early here:

748

if byte_arrays and signature != "ay":

749

raise ValueError("Byte arrays not supported for non-'ay'"

750

" signature %r" % signature)

518

if byte_arrays and signature != u"ay":

519

raise ValueError(u"Byte arrays not supported for non-'ay'"

520

u" signature %r" % signature)

751

521

def decorator(func):

752

522

func._dbus_is_property = True

753

523

func._dbus_interface = dbus_interface

754

524

func._dbus_signature = signature

755

525

func._dbus_access = access

756

526

func._dbus_name = func.__name__

757

if func._dbus_name.endswith("_dbus_property"):

527

if func._dbus_name.endswith(u"_dbus_property"):

758

528

func._dbus_name = func._dbus_name[:-14]

759

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

529

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

760

530

return func

761

531

return decorator

762

532

782

552

783

553

class DBusObjectWithProperties(dbus.service.Object):

784

554

"""A D-Bus object with properties.

785

555

786

556

Classes inheriting from this can use the dbus_service_property

787

557

decorator to expose methods as D-Bus properties. It exposes the

788

558

standard Get(), Set(), and GetAll() methods on the D-Bus.

790

560

791

561

@staticmethod

792

562

def _is_dbus_property(obj):

793

return getattr(obj, "_dbus_is_property", False)

563

return getattr(obj, u"_dbus_is_property", False)

794

564

795

565

def _get_all_dbus_properties(self):

796

566

"""Returns a generator of (name, attribute) pairs

797

567

"""

798

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

799

for cls in self.__class__.__mro__

568

return ((prop._dbus_name, prop)

800

569

for name, prop in

801

inspect.getmembers(cls, self._is_dbus_property))

570

inspect.getmembers(self, self._is_dbus_property))

802

571

803

572

def _get_dbus_property(self, interface_name, property_name):

804

573

"""Returns a bound method if one exists which is a D-Bus

805

574

property with the specified name and interface.

806

575

"""

807

for cls in self.__class__.__mro__:

808

for name, value in (inspect.getmembers

809

(cls, self._is_dbus_property)):

810

if (value._dbus_name == property_name

811

and value._dbus_interface == interface_name):

812

return value.__get__(self)

813

576

for name in (property_name,

577

property_name + u"_dbus_property"):

578

prop = getattr(self, name, None)

579

if (prop is None

580

or not self._is_dbus_property(prop)

581

or prop._dbus_name != property_name

582

or (interface_name and prop._dbus_interface

583

and interface_name != prop._dbus_interface)):

584

continue

585

return prop

814

586

# No such property

815

raise DBusPropertyNotFound(self.dbus_object_path + ":"

816

+ interface_name + "."

587

raise DBusPropertyNotFound(self.dbus_object_path + u":"

588

+ interface_name + u"."

817

589

+ property_name)

818

590

819

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

820

out_signature="v")

591

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

592

out_signature=u"v")

821

593

def Get(self, interface_name, property_name):

822

594

"""Standard D-Bus property Get() method, see D-Bus standard.

823

595

"""

824

596

prop = self._get_dbus_property(interface_name, property_name)

825

if prop._dbus_access == "write":

597

if prop._dbus_access == u"write":

826

598

raise DBusPropertyAccessException(property_name)

827

599

value = prop()

828

if not hasattr(value, "variant_level"):

600

if not hasattr(value, u"variant_level"):

829

601

return value

830

602

return type(value)(value, variant_level=value.variant_level+1)

831

603

832

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

604

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

833

605

def Set(self, interface_name, property_name, value):

834

606

"""Standard D-Bus property Set() method, see D-Bus standard.

835

607

"""

836

608

prop = self._get_dbus_property(interface_name, property_name)

837

if prop._dbus_access == "read":

609

if prop._dbus_access == u"read":

838

610

raise DBusPropertyAccessException(property_name)

839

if prop._dbus_get_args_options["byte_arrays"]:

611

if prop._dbus_get_args_options[u"byte_arrays"]:

840

612

# The byte_arrays option is not supported yet on

841

613

# signatures other than "ay".

842

if prop._dbus_signature != "ay":

614

if prop._dbus_signature != u"ay":

843

615

raise ValueError

844

616

value = dbus.ByteArray(''.join(unichr(byte)

845

617

for byte in value))

846

618

prop(value)

847

619

848

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

849

out_signature="a{sv}")

620

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

621

out_signature=u"a{sv}")

850

622

def GetAll(self, interface_name):

851

623

"""Standard D-Bus property GetAll() method, see D-Bus

852

624

standard.

853

625

854

626

Note: Will not include properties with access="write".

855

627

"""

856

properties = {}

628

all = {}

857

629

for name, prop in self._get_all_dbus_properties():

858

630

if (interface_name

859

631

and interface_name != prop._dbus_interface):

860

632

# Interface non-empty but did not match

861

633

continue

862

634

# Ignore write-only properties

863

if prop._dbus_access == "write":

635

if prop._dbus_access == u"write":

864

636

continue

865

637

value = prop()

866

if not hasattr(value, "variant_level"):

867

properties[name] = value

638

if not hasattr(value, u"variant_level"):

639

all[name] = value

868

640

continue

869

properties[name] = type(value)(value, variant_level=

870

value.variant_level+1)

871

return dbus.Dictionary(properties, signature="sv")

641

all[name] = type(value)(value, variant_level=

642

value.variant_level+1)

643

return dbus.Dictionary(all, signature=u"sv")

872

644

873

645

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

874

out_signature="s",

646

out_signature=u"s",

875

647

path_keyword='object_path',

876

648

connection_keyword='connection')

877

649

def Introspect(self, object_path, connection):

882

654

try:

883

655

document = xml.dom.minidom.parseString(xmlstring)

884

656

def make_tag(document, name, prop):

885

e = document.createElement("property")

886

e.setAttribute("name", name)

887

e.setAttribute("type", prop._dbus_signature)

888

e.setAttribute("access", prop._dbus_access)

657

e = document.createElement(u"property")

658

e.setAttribute(u"name", name)

659

e.setAttribute(u"type", prop._dbus_signature)

660

e.setAttribute(u"access", prop._dbus_access)

889

661

return e

890

for if_tag in document.getElementsByTagName("interface"):

662

for if_tag in document.getElementsByTagName(u"interface"):

891

663

for tag in (make_tag(document, name, prop)

892

664

for name, prop

893

665

in self._get_all_dbus_properties()

894

666

if prop._dbus_interface

895

== if_tag.getAttribute("name")):

667

== if_tag.getAttribute(u"name")):

896

668

if_tag.appendChild(tag)

897

669

# Add the names to the return values for the

898

670

# "org.freedesktop.DBus.Properties" methods

899

if (if_tag.getAttribute("name")

900

== "org.freedesktop.DBus.Properties"):

901

for cn in if_tag.getElementsByTagName("method"):

902

if cn.getAttribute("name") == "Get":

903

for arg in cn.getElementsByTagName("arg"):

904

if (arg.getAttribute("direction")

905

== "out"):

906

arg.setAttribute("name", "value")

907

elif cn.getAttribute("name") == "GetAll":

908

for arg in cn.getElementsByTagName("arg"):

909

if (arg.getAttribute("direction")

910

== "out"):

911

arg.setAttribute("name", "props")

912

xmlstring = document.toxml("utf-8")

671

if (if_tag.getAttribute(u"name")

672

== u"org.freedesktop.DBus.Properties"):

673

for cn in if_tag.getElementsByTagName(u"method"):

674

if cn.getAttribute(u"name") == u"Get":

675

for arg in cn.getElementsByTagName(u"arg"):

676

if (arg.getAttribute(u"direction")

677

== u"out"):

678

arg.setAttribute(u"name", u"value")

679

elif cn.getAttribute(u"name") == u"GetAll":

680

for arg in cn.getElementsByTagName(u"arg"):

681

if (arg.getAttribute(u"direction")

682

== u"out"):

683

arg.setAttribute(u"name", u"props")

684

xmlstring = document.toxml(u"utf-8")

913

685

document.unlink()

914

686

except (AttributeError, xml.dom.DOMException,

915

xml.parsers.expat.ExpatError) as error:

916

logger.error("Failed to override Introspection method",

687

xml.parsers.expat.ExpatError), error:

688

logger.error(u"Failed to override Introspection method",

917

689

error)

918

690

return xmlstring

919

691

920

692

921

def datetime_to_dbus (dt, variant_level=0):

922

"""Convert a UTC datetime.datetime() to a D-Bus type."""

923

if dt is None:

924

return dbus.String("", variant_level = variant_level)

925

return dbus.String(dt.isoformat(),

926

variant_level=variant_level)

927

928

929

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

930

.__metaclass__):

931

"""Applied to an empty subclass of a D-Bus object, this metaclass

932

will add additional D-Bus attributes matching a certain pattern.

933

"""

934

def __new__(mcs, name, bases, attr):

935

# Go through all the base classes which could have D-Bus

936

# methods, signals, or properties in them

937

for base in (b for b in bases

938

if issubclass(b, dbus.service.Object)):

939

# Go though all attributes of the base class

940

for attrname, attribute in inspect.getmembers(base):

941

# Ignore non-D-Bus attributes, and D-Bus attributes

942

# with the wrong interface name

943

if (not hasattr(attribute, "_dbus_interface")

944

or not attribute._dbus_interface

945

.startswith("se.recompile.Mandos")):

946

continue

947

# Create an alternate D-Bus interface name based on

948

# the current name

949

alt_interface = (attribute._dbus_interface

950

.replace("se.recompile.Mandos",

951

"se.bsnet.fukt.Mandos"))

952

# Is this a D-Bus signal?

953

if getattr(attribute, "_dbus_is_signal", False):

954

# Extract the original non-method function by

955

# black magic

956

nonmethod_func = (dict(

957

zip(attribute.func_code.co_freevars,

958

attribute.__closure__))["func"]

959

.cell_contents)

960

# Create a new, but exactly alike, function

961

# object, and decorate it to be a new D-Bus signal

962

# with the alternate D-Bus interface name

963

new_function = (dbus.service.signal

964

(alt_interface,

965

attribute._dbus_signature)

966

(types.FunctionType(

967

nonmethod_func.func_code,

968

nonmethod_func.func_globals,

969

nonmethod_func.func_name,

970

nonmethod_func.func_defaults,

971

nonmethod_func.func_closure)))

972

# Define a creator of a function to call both the

973

# old and new functions, so both the old and new

974

# signals gets sent when the function is called

975

def fixscope(func1, func2):

976

"""This function is a scope container to pass

977

func1 and func2 to the "call_both" function

978

outside of its arguments"""

979

def call_both(*args, **kwargs):

980

"""This function will emit two D-Bus

981

signals by calling func1 and func2"""

982

func1(*args, **kwargs)

983

func2(*args, **kwargs)

984

return call_both

985

# Create the "call_both" function and add it to

986

# the class

987

attr[attrname] = fixscope(attribute,

988

new_function)

989

# Is this a D-Bus method?

990

elif getattr(attribute, "_dbus_is_method", False):

991

# Create a new, but exactly alike, function

992

# object. Decorate it to be a new D-Bus method

993

# with the alternate D-Bus interface name. Add it

994

# to the class.

995

attr[attrname] = (dbus.service.method

996

(alt_interface,

997

attribute._dbus_in_signature,

998

attribute._dbus_out_signature)

999

(types.FunctionType

1000

(attribute.func_code,

1001

attribute.func_globals,

1002

attribute.func_name,

1003

attribute.func_defaults,

1004

attribute.func_closure)))

1005

# Is this a D-Bus property?

1006

elif getattr(attribute, "_dbus_is_property", False):

1007

# Create a new, but exactly alike, function

1008

# object, and decorate it to be a new D-Bus

1009

# property with the alternate D-Bus interface

1010

# name. Add it to the class.

1011

attr[attrname] = (dbus_service_property

1012

(alt_interface,

1013

attribute._dbus_signature,

1014

attribute._dbus_access,

1015

attribute

1016

._dbus_get_args_options

1017

["byte_arrays"])

1018

(types.FunctionType

1019

(attribute.func_code,

1020

attribute.func_globals,

1021

attribute.func_name,

1022

attribute.func_defaults,

1023

attribute.func_closure)))

1024

return type.__new__(mcs, name, bases, attr)

1025

1026

1027

693

class ClientDBus(Client, DBusObjectWithProperties):

1028

694

"""A Client class using D-Bus

1029

695

1031

697

dbus_object_path: dbus.ObjectPath

1032

698

bus: dbus.SystemBus()

1033

699

"""

1034

1035

runtime_expansions = (Client.runtime_expansions

1036

+ ("dbus_object_path",))

1037

1038

700

# dbus.service.Object doesn't use super(), so we can't either.

1039

701

1040

702

def __init__(self, bus = None, *args, **kwargs):

1041

703

self.bus = bus

1042

704

Client.__init__(self, *args, **kwargs)

1043

self._approvals_pending = 0

1044

1045

self._approvals_pending = 0

1046

705

# Only now, when this client is initialized, can it show up on

1047

706

# the D-Bus

1048

client_object_name = unicode(self.name).translate(

1049

{ord("."): ord("_"),

1050

ord("-"): ord("_")})

1051

707

self.dbus_object_path = (dbus.ObjectPath

1052

("/clients/" + client_object_name))

708

(u"/clients/"

709

+ self.name.replace(u".", u"_")))

1053

710

DBusObjectWithProperties.__init__(self, self.bus,

1054

711

self.dbus_object_path)

1055

1056

def notifychangeproperty(transform_func,

1057

dbus_name, type_func=lambda x: x,

1058

variant_level=1):

1059

""" Modify a variable so that it's a property which announces

1060

its changes to DBus.

1061

1062

transform_fun: Function that takes a value and a variant_level

1063

and transforms it to a D-Bus type.

1064

dbus_name: D-Bus name of the variable

1065

type_func: Function that transform the value before sending it

1066

to the D-Bus. Default: no transform

1067

variant_level: D-Bus variant level. Default: 1

1068

"""

1069

attrname = "_{0}".format(dbus_name)

1070

def setter(self, value):

1071

if hasattr(self, "dbus_object_path"):

1072

if (not hasattr(self, attrname) or

1073

type_func(getattr(self, attrname, None))

1074

!= type_func(value)):

1075

dbus_value = transform_func(type_func(value),

1076

variant_level

1077

=variant_level)

1078

self.PropertyChanged(dbus.String(dbus_name),

1079

dbus_value)

1080

setattr(self, attrname, value)

1081

1082

return property(lambda self: getattr(self, attrname), setter)

1083

1084

1085

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1086

approvals_pending = notifychangeproperty(dbus.Boolean,

1087

"ApprovalPending",

1088

type_func = bool)

1089

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1090

last_enabled = notifychangeproperty(datetime_to_dbus,

1091

"LastEnabled")

1092

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1093

type_func = lambda checker:

1094

checker is not None)

1095

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1096

"LastCheckedOK")

1097

last_approval_request = notifychangeproperty(

1098

datetime_to_dbus, "LastApprovalRequest")

1099

approved_by_default = notifychangeproperty(dbus.Boolean,

1100

"ApprovedByDefault")

1101

approval_delay = notifychangeproperty(dbus.UInt64,

1102

"ApprovalDelay",

1103

type_func =

1104

timedelta_to_milliseconds)

1105

approval_duration = notifychangeproperty(

1106

dbus.UInt64, "ApprovalDuration",

1107

type_func = timedelta_to_milliseconds)

1108

host = notifychangeproperty(dbus.String, "Host")

1109

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1110

type_func =

1111

timedelta_to_milliseconds)

1112

extended_timeout = notifychangeproperty(

1113

dbus.UInt64, "ExtendedTimeout",

1114

type_func = timedelta_to_milliseconds)

1115

interval = notifychangeproperty(dbus.UInt64,

1116

"Interval",

1117

type_func =

1118

timedelta_to_milliseconds)

1119

checker_command = notifychangeproperty(dbus.String, "Checker")

1120

1121

del notifychangeproperty

712

713

@staticmethod

714

def _datetime_to_dbus(dt, variant_level=0):

715

"""Convert a UTC datetime.datetime() to a D-Bus type."""

716

return dbus.String(dt.isoformat(),

717

variant_level=variant_level)

718

719

def enable(self):

720

oldstate = getattr(self, u"enabled", False)

721

r = Client.enable(self)

722

if oldstate != self.enabled:

723

# Emit D-Bus signals

724

self.PropertyChanged(dbus.String(u"enabled"),

725

dbus.Boolean(True, variant_level=1))

726

self.PropertyChanged(

727

dbus.String(u"last_enabled"),

728

self._datetime_to_dbus(self.last_enabled,

729

variant_level=1))

730

return r

731

732

def disable(self, quiet = False):

733

oldstate = getattr(self, u"enabled", False)

734

r = Client.disable(self, quiet=quiet)

735

if not quiet and oldstate != self.enabled:

736

# Emit D-Bus signal

737

self.PropertyChanged(dbus.String(u"enabled"),

738

dbus.Boolean(False, variant_level=1))

739

return r

1122

740

1123

741

def __del__(self, *args, **kwargs):

1124

742

try:

1125

743

self.remove_from_connection()

1126

744

except LookupError:

1127

745

pass

1128

if hasattr(DBusObjectWithProperties, "__del__"):

746

if hasattr(DBusObjectWithProperties, u"__del__"):

1129

747

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1130

748

Client.__del__(self, *args, **kwargs)

1131

749

1133

751

*args, **kwargs):

1134

752

self.checker_callback_tag = None

1135

753

self.checker = None

754

# Emit D-Bus signal

755

self.PropertyChanged(dbus.String(u"checker_running"),

756

dbus.Boolean(False, variant_level=1))

1136

757

if os.WIFEXITED(condition):

1137

758

exitstatus = os.WEXITSTATUS(condition)

1138

759

# Emit D-Bus signal

1148

769

return Client.checker_callback(self, pid, condition, command,

1149

770

*args, **kwargs)

1150

771

772

def checked_ok(self, *args, **kwargs):

773

r = Client.checked_ok(self, *args, **kwargs)

774

# Emit D-Bus signal

775

self.PropertyChanged(

776

dbus.String(u"last_checked_ok"),

777

(self._datetime_to_dbus(self.last_checked_ok,

778

variant_level=1)))

779

return r

780

1151

781

def start_checker(self, *args, **kwargs):

1152

782

old_checker = self.checker

1153

783

if self.checker is not None:

1160

790

and old_checker_pid != self.checker.pid):

1161

791

# Emit D-Bus signal

1162

792

self.CheckerStarted(self.current_checker_command)

793

self.PropertyChanged(

794

dbus.String(u"checker_running"),

795

dbus.Boolean(True, variant_level=1))

1163

796

return r

1164

797

798

def stop_checker(self, *args, **kwargs):

799

old_checker = getattr(self, u"checker", None)

800

r = Client.stop_checker(self, *args, **kwargs)

801

if (old_checker is not None

802

and getattr(self, u"checker", None) is None):

803

self.PropertyChanged(dbus.String(u"checker_running"),

804

dbus.Boolean(False, variant_level=1))

805

return r

806

1165

807

def _reset_approved(self):

1166

self.approved = None

808

self._approved = None

1167

809

return False

1168

810

1169

811

def approve(self, value=True):

1170

self.send_changedstate()

1171

self.approved = value

1172

gobject.timeout_add(timedelta_to_milliseconds

1173

(self.approval_duration),

1174

self._reset_approved)

1175

812

self._approved = value

813

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

814

815

def approved_pending(self):

816

return self.approvals_pending > 0

817

1176

818

1177

819

## D-Bus methods, signals & properties

1178

_interface = "se.recompile.Mandos.Client"

820

_interface = u"se.bsnet.fukt.Mandos.Client"

1179

821

1180

822

## Signals

1181

823

1182

824

# CheckerCompleted - signal

1183

@dbus.service.signal(_interface, signature="nxs")

825

@dbus.service.signal(_interface, signature=u"nxs")

1184

826

def CheckerCompleted(self, exitcode, waitstatus, command):

1185

827

"D-Bus signal"

1186

828

pass

1187

829

1188

830

# CheckerStarted - signal

1189

@dbus.service.signal(_interface, signature="s")

831

@dbus.service.signal(_interface, signature=u"s")

1190

832

def CheckerStarted(self, command):

1191

833

"D-Bus signal"

1192

834

pass

1193

835

1194

836

# PropertyChanged - signal

1195

@dbus.service.signal(_interface, signature="sv")

837

@dbus.service.signal(_interface, signature=u"sv")

1196

838

def PropertyChanged(self, property, value):

1197

839

"D-Bus signal"

1198

840

pass

1200

842

# GotSecret - signal

1201

843

@dbus.service.signal(_interface)

1202

844

def GotSecret(self):

1203

"""D-Bus signal

1204

Is sent after a successful transfer of secret from the Mandos

1205

server to mandos-client

1206

"""

845

"D-Bus signal"

1207

846

pass

1208

847

1209

848

# Rejected - signal

1210

@dbus.service.signal(_interface, signature="s")

849

@dbus.service.signal(_interface, signature=u"s")

1211

850

def Rejected(self, reason):

1212

851

"D-Bus signal"

1213

852

pass

1214

853

1215

854

# NeedApproval - signal

1216

@dbus.service.signal(_interface, signature="tb")

855

@dbus.service.signal(_interface, signature=u"db")

1217

856

def NeedApproval(self, timeout, default):

1218

857

"D-Bus signal"

1219

return self.need_approval()

1220

1221

# NeRwequest - signal

1222

@dbus.service.signal(_interface, signature="s")

1223

def NewRequest(self, ip):

1224

"""D-Bus signal

1225

Is sent after a client request a password.

1226

"""

1227

858

pass

1228

859

1229

860

## Methods

1230

861

1231

862

# Approve - method

1232

@dbus.service.method(_interface, in_signature="b")

863

@dbus.service.method(_interface, in_signature=u"b")

1233

864

def Approve(self, value):

1234

865

self.approve(value)

1235

866

1236

867

# CheckedOK - method

1237

868

@dbus.service.method(_interface)

1238

869

def CheckedOK(self):

1239

self.checked_ok()

870

return self.checked_ok()

1240

871

1241

872

# Enable - method

1242

873

@dbus.service.method(_interface)

1263

894

1264

895

## Properties

1265

896

1266

# ApprovalPending - property

1267

@dbus_service_property(_interface, signature="b", access="read")

1268

def ApprovalPending_dbus_property(self):

1269

return dbus.Boolean(bool(self.approvals_pending))

1270

1271

# ApprovedByDefault - property

1272

@dbus_service_property(_interface, signature="b",

1273

access="readwrite")

1274

def ApprovedByDefault_dbus_property(self, value=None):

1275

if value is None: # get

1276

return dbus.Boolean(self.approved_by_default)

1277

self.approved_by_default = bool(value)

1278

1279

# ApprovalDelay - property

1280

@dbus_service_property(_interface, signature="t",

1281

access="readwrite")

1282

def ApprovalDelay_dbus_property(self, value=None):

1283

if value is None: # get

1284

return dbus.UInt64(self.approval_delay_milliseconds())

1285

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1286

1287

# ApprovalDuration - property

1288

@dbus_service_property(_interface, signature="t",

1289

access="readwrite")

1290

def ApprovalDuration_dbus_property(self, value=None):

1291

if value is None: # get

1292

return dbus.UInt64(timedelta_to_milliseconds(

1293

self.approval_duration))

1294

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1295

1296

# Name - property

1297

@dbus_service_property(_interface, signature="s", access="read")

1298

def Name_dbus_property(self):

897

# approved_pending - property

898

@dbus_service_property(_interface, signature=u"b", access=u"read")

899

def approved_pending_dbus_property(self):

900

return dbus.Boolean(self.approved_pending())

901

902

# approved_by_default - property

903

@dbus_service_property(_interface, signature=u"b",

904

access=u"readwrite")

905

def approved_by_default_dbus_property(self):

906

return dbus.Boolean(self.approved_by_default)

907

908

# approved_delay - property

909

@dbus_service_property(_interface, signature=u"t",

910

access=u"readwrite")

911

def approved_delay_dbus_property(self):

912

return dbus.UInt64(self.approved_delay_milliseconds())

913

914

# approved_duration - property

915

@dbus_service_property(_interface, signature=u"t",

916

access=u"readwrite")

917

def approved_duration_dbus_property(self):

918

return dbus.UInt64(self._timedelta_to_milliseconds(

919

self.approved_duration))

920

921

# name - property

922

@dbus_service_property(_interface, signature=u"s", access=u"read")

923

def name_dbus_property(self):

1299

924

return dbus.String(self.name)

1300

925

1301

# Fingerprint - property

1302

@dbus_service_property(_interface, signature="s", access="read")

1303

def Fingerprint_dbus_property(self):

926

# fingerprint - property

927

@dbus_service_property(_interface, signature=u"s", access=u"read")

928

def fingerprint_dbus_property(self):

1304

929

return dbus.String(self.fingerprint)

1305

930

1306

# Host - property

1307

@dbus_service_property(_interface, signature="s",

1308

access="readwrite")

1309

def Host_dbus_property(self, value=None):

931

# host - property

932

@dbus_service_property(_interface, signature=u"s",

933

access=u"readwrite")

934

def host_dbus_property(self, value=None):

1310

935

if value is None: # get

1311

936

return dbus.String(self.host)

1312

self.host = unicode(value)

1313

1314

# Created - property

1315

@dbus_service_property(_interface, signature="s", access="read")

1316

def Created_dbus_property(self):

1317

return datetime_to_dbus(self.created)

1318

1319

# LastEnabled - property

1320

@dbus_service_property(_interface, signature="s", access="read")

1321

def LastEnabled_dbus_property(self):

1322

return datetime_to_dbus(self.last_enabled)

1323

1324

# Enabled - property

1325

@dbus_service_property(_interface, signature="b",

1326

access="readwrite")

1327

def Enabled_dbus_property(self, value=None):

937

self.host = value

938

# Emit D-Bus signal

939

self.PropertyChanged(dbus.String(u"host"),

940

dbus.String(value, variant_level=1))

941

942

# created - property

943

@dbus_service_property(_interface, signature=u"s", access=u"read")

944

def created_dbus_property(self):

945

return dbus.String(self._datetime_to_dbus(self.created))

946

947

# last_enabled - property

948

@dbus_service_property(_interface, signature=u"s", access=u"read")

949

def last_enabled_dbus_property(self):

950

if self.last_enabled is None:

951

return dbus.String(u"")

952

return dbus.String(self._datetime_to_dbus(self.last_enabled))

953

954

# enabled - property

955

@dbus_service_property(_interface, signature=u"b",

956

access=u"readwrite")

957

def enabled_dbus_property(self, value=None):

1328

958

if value is None: # get

1329

959

return dbus.Boolean(self.enabled)

1330

960

if value:

1332

962

else:

1333

963

self.disable()

1334

964

1335

# LastCheckedOK - property

1336

@dbus_service_property(_interface, signature="s",

1337

access="readwrite")

1338

def LastCheckedOK_dbus_property(self, value=None):

965

# last_checked_ok - property

966

@dbus_service_property(_interface, signature=u"s",

967

access=u"readwrite")

968

def last_checked_ok_dbus_property(self, value=None):

1339

969

if value is not None:

1340

970

self.checked_ok()

1341

971

return

1342

return datetime_to_dbus(self.last_checked_ok)

1343

1344

# Expires - property

1345

@dbus_service_property(_interface, signature="s", access="read")

1346

def Expires_dbus_property(self):

1347

return datetime_to_dbus(self.expires)

1348

1349

# LastApprovalRequest - property

1350

@dbus_service_property(_interface, signature="s", access="read")

1351

def LastApprovalRequest_dbus_property(self):

1352

return datetime_to_dbus(self.last_approval_request)

1353

1354

# Timeout - property

1355

@dbus_service_property(_interface, signature="t",

1356

access="readwrite")

1357

def Timeout_dbus_property(self, value=None):

972

if self.last_checked_ok is None:

973

return dbus.String(u"")

974

return dbus.String(self._datetime_to_dbus(self

975

.last_checked_ok))

976

977

# timeout - property

978

@dbus_service_property(_interface, signature=u"t",

979

access=u"readwrite")

980

def timeout_dbus_property(self, value=None):

1358

981

if value is None: # get

1359

982

return dbus.UInt64(self.timeout_milliseconds())

1360

983

self.timeout = datetime.timedelta(0, 0, 0, value)

1361

if getattr(self, "disable_initiator_tag", None) is None:

984

# Emit D-Bus signal

985

self.PropertyChanged(dbus.String(u"timeout"),

986

dbus.UInt64(value, variant_level=1))

987

if getattr(self, u"disable_initiator_tag", None) is None:

1362

988

return

1363

989

# Reschedule timeout

1364

990

gobject.source_remove(self.disable_initiator_tag)

1365

991

self.disable_initiator_tag = None

1366

self.expires = None

1367

time_to_die = timedelta_to_milliseconds((self

1368

.last_checked_ok

1369

+ self.timeout)

1370

- datetime.datetime

1371

.utcnow())

992

time_to_die = (self.

993

_timedelta_to_milliseconds((self

994

.last_checked_ok

995

+ self.timeout)

996

- datetime.datetime

997

.utcnow()))

1372

998

if time_to_die <= 0:

1373

999

# The timeout has passed

1374

1000

self.disable()

1375

1001

else:

1376

self.expires = (datetime.datetime.utcnow()

1377

+ datetime.timedelta(milliseconds =

1378

time_to_die))

1379

1002

self.disable_initiator_tag = (gobject.timeout_add

1380

1003

(time_to_die, self.disable))

1381

1004

1382

# ExtendedTimeout - property

1383

@dbus_service_property(_interface, signature="t",

1384

access="readwrite")

1385

def ExtendedTimeout_dbus_property(self, value=None):

1386

if value is None: # get

1387

return dbus.UInt64(self.extended_timeout_milliseconds())

1388

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1389

1390

# Interval - property

1391

@dbus_service_property(_interface, signature="t",

1392

access="readwrite")

1393

def Interval_dbus_property(self, value=None):

1005

# interval - property

1006

@dbus_service_property(_interface, signature=u"t",

1007

access=u"readwrite")

1008

def interval_dbus_property(self, value=None):

1394

1009

if value is None: # get

1395

1010

return dbus.UInt64(self.interval_milliseconds())

1396

1011

self.interval = datetime.timedelta(0, 0, 0, value)

1397

if getattr(self, "checker_initiator_tag", None) is None:

1012

# Emit D-Bus signal

1013

self.PropertyChanged(dbus.String(u"interval"),

1014

dbus.UInt64(value, variant_level=1))

1015

if getattr(self, u"checker_initiator_tag", None) is None:

1398

1016

return

1399

if self.enabled:

1400

# Reschedule checker run

1401

gobject.source_remove(self.checker_initiator_tag)

1402

self.checker_initiator_tag = (gobject.timeout_add

1403

(value, self.start_checker))

1404

self.start_checker() # Start one now, too

1405

1406

# Checker - property

1407

@dbus_service_property(_interface, signature="s",

1408

access="readwrite")

1409

def Checker_dbus_property(self, value=None):

1017

# Reschedule checker run

1018

gobject.source_remove(self.checker_initiator_tag)

1019

self.checker_initiator_tag = (gobject.timeout_add

1020

(value, self.start_checker))

1021

self.start_checker() # Start one now, too

1022

1023

# checker - property

1024

@dbus_service_property(_interface, signature=u"s",

1025

access=u"readwrite")

1026

def checker_dbus_property(self, value=None):

1410

1027

if value is None: # get

1411

1028

return dbus.String(self.checker_command)

1412

self.checker_command = unicode(value)

1029

self.checker_command = value

1030

# Emit D-Bus signal

1031

self.PropertyChanged(dbus.String(u"checker"),

1032

dbus.String(self.checker_command,

1033

variant_level=1))

1413

1034

1414

# CheckerRunning - property

1415

@dbus_service_property(_interface, signature="b",

1416

access="readwrite")

1417

def CheckerRunning_dbus_property(self, value=None):

1035

# checker_running - property

1036

@dbus_service_property(_interface, signature=u"b",

1037

access=u"readwrite")

1038

def checker_running_dbus_property(self, value=None):

1418

1039

if value is None: # get

1419

1040

return dbus.Boolean(self.checker is not None)

1420

1041

if value:

1422

1043

else:

1423

1044

self.stop_checker()

1424

1045

1425

# ObjectPath - property

1426

@dbus_service_property(_interface, signature="o", access="read")

1427

def ObjectPath_dbus_property(self):

1046

# object_path - property

1047

@dbus_service_property(_interface, signature=u"o", access=u"read")

1048

def object_path_dbus_property(self):

1428

1049

return self.dbus_object_path # is already a dbus.ObjectPath

1429

1050

1430

# Secret = property

1431

@dbus_service_property(_interface, signature="ay",

1432

access="write", byte_arrays=True)

1433

def Secret_dbus_property(self, value):

1051

# secret = property

1052

@dbus_service_property(_interface, signature=u"ay",

1053

access=u"write", byte_arrays=True)

1054

def secret_dbus_property(self, value):

1434

1055

self.secret = str(value)

1435

1056

1436

1057

del _interface

1442

1063

self._pipe.send(('init', fpr, address))

1443

1064

if not self._pipe.recv():

1444

1065

raise KeyError()

1445

1066

1446

1067

def __getattribute__(self, name):

1447

if name == '_pipe':

1068

if(name == '_pipe'):

1448

1069

return super(ProxyClient, self).__getattribute__(name)

1449

1070

self._pipe.send(('getattr', name))

1450

1071

data = self._pipe.recv()

1455

1076

self._pipe.send(('funcall', name, args, kwargs))

1456

1077

return self._pipe.recv()[1]

1457

1078

return func

1458

1079

1459

1080

def __setattr__(self, name, value):

1460

if name == '_pipe':

1081

if(name == '_pipe'):

1461

1082

return super(ProxyClient, self).__setattr__(name, value)

1462

1083

self._pipe.send(('setattr', name, value))

1463

1084

1464

1085

1465

class ClientDBusTransitional(ClientDBus):

1466

__metaclass__ = AlternateDBusNamesMetaclass

1467

1468

1469

1086

class ClientHandler(socketserver.BaseRequestHandler, object):

1470

1087

"""A class to handle client connections.

1471

1088

1474

1091

1475

1092

def handle(self):

1476

1093

with contextlib.closing(self.server.child_pipe) as child_pipe:

1477

logger.info("TCP connection from: %s",

1094

logger.info(u"TCP connection from: %s",

1478

1095

unicode(self.client_address))

1479

logger.debug("Pipe FD: %d",

1096

logger.debug(u"Pipe FD: %d",

1480

1097

self.server.child_pipe.fileno())

1481

1098

1482

1099

session = (gnutls.connection

1483

1100

.ClientSession(self.request,

1484

1101

gnutls.connection

1485

1102

.X509Credentials()))

1486

1103

1487

1104

# Note: gnutls.connection.X509Credentials is really a

1488

1105

# generic GnuTLS certificate credentials object so long as

1489

1106

# no X.509 keys are added to it. Therefore, we can use it

1490

1107

# here despite using OpenPGP certificates.

1491

1492

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1493

# "+AES-256-CBC", "+SHA1",

1494

# "+COMP-NULL", "+CTYPE-OPENPGP",

1495

# "+DHE-DSS"))

1108

1109

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1110

# u"+AES-256-CBC", u"+SHA1",

1111

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1112

# u"+DHE-DSS"))

1496

1113

# Use a fallback default, since this MUST be set.

1497

1114

priority = self.server.gnutls_priority

1498

1115

if priority is None:

1499

priority = "NORMAL"

1116

priority = u"NORMAL"

1500

1117

(gnutls.library.functions

1501

1118

.gnutls_priority_set_direct(session._c_object,

1502

1119

priority, None))

1503

1120

1504

1121

# Start communication using the Mandos protocol

1505

1122

# Get protocol number

1506

1123

line = self.request.makefile().readline()

1507

logger.debug("Protocol version: %r", line)

1124

logger.debug(u"Protocol version: %r", line)

1508

1125

try:

1509

1126

if int(line.strip().split()[0]) > 1:

1510

1127

raise RuntimeError

1511

except (ValueError, IndexError, RuntimeError) as error:

1512

logger.error("Unknown protocol version: %s", error)

1128

except (ValueError, IndexError, RuntimeError), error:

1129

logger.error(u"Unknown protocol version: %s", error)

1513

1130

return

1514

1131

1515

1132

# Start GnuTLS connection

1516

1133

try:

1517

1134

session.handshake()

1518

except gnutls.errors.GNUTLSError as error:

1519

logger.warning("Handshake failed: %s", error)

1135

except gnutls.errors.GNUTLSError, error:

1136

logger.warning(u"Handshake failed: %s", error)

1520

1137

# Do not run session.bye() here: the session is not

1521

1138

# established. Just abandon the request.

1522

1139

return

1523

logger.debug("Handshake succeeded")

1524

1140

logger.debug(u"Handshake succeeded")

1141

1525

1142

approval_required = False

1526

1143

try:

1527

1144

try:

1528

1145

fpr = self.fingerprint(self.peer_certificate

1529

1146

(session))

1530

except (TypeError,

1531

gnutls.errors.GNUTLSError) as error:

1532

logger.warning("Bad certificate: %s", error)

1147

except (TypeError, gnutls.errors.GNUTLSError), error:

1148

logger.warning(u"Bad certificate: %s", error)

1533

1149

return

1534

logger.debug("Fingerprint: %s", fpr)

1535

1150

logger.debug(u"Fingerprint: %s", fpr)

1151

1536

1152

try:

1537

1153

client = ProxyClient(child_pipe, fpr,

1538

1154

self.client_address)

1539

1155

except KeyError:

1540

1156

return

1541

1157

1542

if self.server.use_dbus:

1543

# Emit D-Bus signal

1544

client.NewRequest(str(self.client_address))

1545

1546

if client.approval_delay:

1547

delay = client.approval_delay

1158

if client.approved_delay:

1159

delay = client.approved_delay

1548

1160

client.approvals_pending += 1

1549

1161

approval_required = True

1550

1162

1551

1163

while True:

1552

1164

if not client.enabled:

1553

logger.info("Client %s is disabled",

1165

logger.warning(u"Client %s is disabled",

1554

1166

client.name)

1555

1167

if self.server.use_dbus:

1556

1168

# Emit D-Bus signal

1557

client.Rejected("Disabled")

1169

client.Rejected("Disabled")

1558

1170

return

1559

1171

1560

if client.approved or not client.approval_delay:

1172

if client._approved or not client.approved_delay:

1561

1173

#We are approved or approval is disabled

1562

1174

break

1563

elif client.approved is None:

1564

logger.info("Client %s needs approval",

1175

elif client._approved is None:

1176

logger.info(u"Client %s need approval",

1565

1177

client.name)

1566

1178

if self.server.use_dbus:

1567

1179

# Emit D-Bus signal

1568

1180

client.NeedApproval(

1569

client.approval_delay_milliseconds(),

1181

client.approved_delay_milliseconds(),

1570

1182

client.approved_by_default)

1571

1183

else:

1572

logger.warning("Client %s was not approved",

1184

logger.warning(u"Client %s was not approved",

1573

1185

client.name)

1574

1186

if self.server.use_dbus:

1575

1187

# Emit D-Bus signal

1576

client.Rejected("Denied")

1188

client.Rejected("Disapproved")

1577

1189

return

1578

1190

1579

1191

#wait until timeout or approved

1192

#x = float(client._timedelta_to_milliseconds(delay))

1580

1193

time = datetime.datetime.now()

1581

1194

client.changedstate.acquire()

1582

(client.changedstate.wait

1583

(float(client.timedelta_to_milliseconds(delay)

1584

/ 1000)))

1195

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1585

1196

client.changedstate.release()

1586

1197

time2 = datetime.datetime.now()

1587

1198

if (time2 - time) >= delay:

1591

1202

client.name)

1592

1203

if self.server.use_dbus:

1593

1204

# Emit D-Bus signal

1594

client.Rejected("Approval timed out")

1205

client.Rejected("Time out")

1595

1206

return

1596

1207

else:

1597

1208

break

1600

1211

1601

1212

sent_size = 0

1602

1213

while sent_size < len(client.secret):

1603

try:

1604

sent = session.send(client.secret[sent_size:])

1605

except gnutls.errors.GNUTLSError as error:

1606

logger.warning("gnutls send failed")

1607

return

1608

logger.debug("Sent: %d, remaining: %d",

1214

# XXX handle session exception

1215

sent = session.send(client.secret[sent_size:])

1216

logger.debug(u"Sent: %d, remaining: %d",

1609

1217

sent, len(client.secret)

1610

1218

- (sent_size + sent))

1611

1219

sent_size += sent

1612

1613

logger.info("Sending secret to %s", client.name)

1614

# bump the timeout using extended_timeout

1615

client.checked_ok(client.extended_timeout)

1220

1221

logger.info(u"Sending secret to %s", client.name)

1222

# bump the timeout as if seen

1223

client.checked_ok()

1616

1224

if self.server.use_dbus:

1617

1225

# Emit D-Bus signal

1618

1226

client.GotSecret()

1620

1228

finally:

1621

1229

if approval_required:

1622

1230

client.approvals_pending -= 1

1623

try:

1624

session.bye()

1625

except gnutls.errors.GNUTLSError as error:

1626

logger.warning("GnuTLS bye failed")

1231

session.bye()

1627

1232

1628

1233

@staticmethod

1629

1234

def peer_certificate(session):

1639

1244

.gnutls_certificate_get_peers

1640

1245

(session._c_object, ctypes.byref(list_size)))

1641

1246

if not bool(cert_list) and list_size.value != 0:

1642

raise gnutls.errors.GNUTLSError("error getting peer"

1643

" certificate")

1247

raise gnutls.errors.GNUTLSError(u"error getting peer"

1248

u" certificate")

1644

1249

if list_size.value == 0:

1645

1250

return None

1646

1251

cert = cert_list[0]

1672

1277

if crtverify.value != 0:

1673

1278

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1674

1279

raise (gnutls.errors.CertificateSecurityError

1675

("Verify failed"))

1280

(u"Verify failed"))

1676

1281

# New buffer for the fingerprint

1677

1282

buf = ctypes.create_string_buffer(20)

1678

1283

buf_len = ctypes.c_size_t()

1685

1290

# Convert the buffer to a Python bytestring

1686

1291

fpr = ctypes.string_at(buf, buf_len.value)

1687

1292

# Convert the bytestring to hexadecimal notation

1688

hex_fpr = binascii.hexlify(fpr).upper()

1293

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1689

1294

return hex_fpr

1690

1295

1691

1296

1694

1299

def sub_process_main(self, request, address):

1695

1300

try:

1696

1301

self.finish_request(request, address)

1697

except Exception:

1302

except:

1698

1303

self.handle_error(request, address)

1699

1304

self.close_request(request)

1700

1305

1701

1306

def process_request(self, request, address):

1702

1307

"""Start a new process to process the request."""

1703

proc = multiprocessing.Process(target = self.sub_process_main,

1704

args = (request,

1705

address))

1706

proc.start()

1707

return proc

1708

1308

multiprocessing.Process(target = self.sub_process_main,

1309

args = (request, address)).start()

1709

1310

1710

1311

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1711

1312

""" adds a pipe to the MixIn """

1715

1316

This function creates a new pipe in self.pipe

1716

1317

"""

1717

1318

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1718

1719

proc = MultiprocessingMixIn.process_request(self, request,

1720

client_address)

1319

1320

super(MultiprocessingMixInWithPipe,

1321

self).process_request(request, client_address)

1721

1322

self.child_pipe.close()

1722

self.add_pipe(parent_pipe, proc)

1723

1724

def add_pipe(self, parent_pipe, proc):

1323

self.add_pipe(parent_pipe)

1324

1325

def add_pipe(self, parent_pipe):

1725

1326

"""Dummy function; override as necessary"""

1726

raise NotImplementedError

1727

1327

pass

1728

1328

1729

1329

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1730

1330

socketserver.TCPServer, object):

1748

1348

bind to an address or port if they were not specified."""

1749

1349

if self.interface is not None:

1750

1350

if SO_BINDTODEVICE is None:

1751

logger.error("SO_BINDTODEVICE does not exist;"

1752

" cannot bind to interface %s",

1351

logger.error(u"SO_BINDTODEVICE does not exist;"

1352

u" cannot bind to interface %s",

1753

1353

self.interface)

1754

1354

else:

1755

1355

try:

1756

1356

self.socket.setsockopt(socket.SOL_SOCKET,

1757

1357

SO_BINDTODEVICE,

1758

1358

str(self.interface

1759

+ '\0'))

1760

except socket.error as error:

1359

+ u'\0'))

1360

except socket.error, error:

1761

1361

if error[0] == errno.EPERM:

1762

logger.error("No permission to"

1763

" bind to interface %s",

1362

logger.error(u"No permission to"

1363

u" bind to interface %s",

1764

1364

self.interface)

1765

1365

elif error[0] == errno.ENOPROTOOPT:

1766

logger.error("SO_BINDTODEVICE not available;"

1767

" cannot bind to interface %s",

1366

logger.error(u"SO_BINDTODEVICE not available;"

1367

u" cannot bind to interface %s",

1768

1368

self.interface)

1769

1369

else:

1770

1370

raise

1772

1372

if self.server_address[0] or self.server_address[1]:

1773

1373

if not self.server_address[0]:

1774

1374

if self.address_family == socket.AF_INET6:

1775

any_address = "::" # in6addr_any

1375

any_address = u"::" # in6addr_any

1776

1376

else:

1777

1377

any_address = socket.INADDR_ANY

1778

1378

self.server_address = (any_address,

1805

1405

self.enabled = False

1806

1406

self.clients = clients

1807

1407

if self.clients is None:

1808

self.clients = {}

1408

self.clients = set()

1809

1409

self.use_dbus = use_dbus

1810

1410

self.gnutls_priority = gnutls_priority

1811

1411

IPv6_TCPServer.__init__(self, server_address,

1815

1415

def server_activate(self):

1816

1416

if self.enabled:

1817

1417

return socketserver.TCPServer.server_activate(self)

1818

1819

1418

def enable(self):

1820

1419

self.enabled = True

1821

1822

def add_pipe(self, parent_pipe, proc):

1420

def add_pipe(self, parent_pipe):

1823

1421

# Call "handle_ipc" for both data and EOF events

1824

1422

gobject.io_add_watch(parent_pipe.fileno(),

1825

1423

gobject.IO_IN | gobject.IO_HUP,

1826

1424

functools.partial(self.handle_ipc,

1827

parent_pipe =

1828

parent_pipe,

1829

proc = proc))

1830

1425

parent_pipe = parent_pipe))

1426

1831

1427

def handle_ipc(self, source, condition, parent_pipe=None,

1832

proc = None, client_object=None):

1428

client_object=None):

1833

1429

condition_names = {

1834

gobject.IO_IN: "IN", # There is data to read.

1835

gobject.IO_OUT: "OUT", # Data can be written (without

1430

gobject.IO_IN: u"IN", # There is data to read.

1431

gobject.IO_OUT: u"OUT", # Data can be written (without

1836

1432

# blocking).

1837

gobject.IO_PRI: "PRI", # There is urgent data to read.

1838

gobject.IO_ERR: "ERR", # Error condition.

1839

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1433

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1434

gobject.IO_ERR: u"ERR", # Error condition.

1435

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1840

1436

# broken, usually for pipes and

1841

1437

# sockets).

1842

1438

}

1844

1440

for cond, name in

1845

1441

condition_names.iteritems()

1846

1442

if cond & condition)

1847

# error, or the other end of multiprocessing.Pipe has closed

1848

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1849

# Wait for other process to exit

1850

proc.join()

1443

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1444

conditions_string)

1445

1446

# error or the other end of multiprocessing.Pipe has closed

1447

if condition & gobject.IO_HUP or condition & gobject.IO_ERR:

1851

1448

return False

1852

1449

1853

1450

# Read a request from the child

1854

1451

request = parent_pipe.recv()

1452

logger.debug(u"IPC request: %s", repr(request))

1855

1453

command = request[0]

1856

1454

1857

1455

if command == 'init':

1858

1456

fpr = request[1]

1859

1457

address = request[2]

1860

1458

1861

for c in self.clients.itervalues():

1459

for c in self.clients:

1862

1460

if c.fingerprint == fpr:

1863

1461

client = c

1864

1462

break

1865

1463

else:

1866

logger.info("Client not found for fingerprint: %s, ad"

1867

"dress: %s", fpr, address)

1464

logger.warning(u"Client not found for fingerprint: %s, ad"

1465

u"dress: %s", fpr, address)

1868

1466

if self.use_dbus:

1869

1467

# Emit D-Bus signal

1870

mandos_dbus_service.ClientNotFound(fpr,

1871

address[0])

1468

mandos_dbus_service.ClientNotFound(fpr, address)

1872

1469

parent_pipe.send(False)

1873

1470

return False

1874

1471

1875

1472

gobject.io_add_watch(parent_pipe.fileno(),

1876

1473

gobject.IO_IN | gobject.IO_HUP,

1877

1474

functools.partial(self.handle_ipc,

1878

parent_pipe =

1879

parent_pipe,

1880

proc = proc,

1881

client_object =

1882

client))

1475

parent_pipe = parent_pipe,

1476

client_object = client))

1883

1477

parent_pipe.send(True)

1884

# remove the old hook in favor of the new above hook on

1885

# same fileno

1478

# remove the old hook in favor of the new above hook on same fileno

1886

1479

return False

1887

1480

if command == 'funcall':

1888

1481

funcname = request[1]

1889

1482

args = request[2]

1890

1483

kwargs = request[3]

1891

1484

1892

parent_pipe.send(('data', getattr(client_object,

1893

funcname)(*args,

1894

**kwargs)))

1895

1485

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1486

1896

1487

if command == 'getattr':

1897

1488

attrname = request[1]

1898

1489

if callable(client_object.__getattribute__(attrname)):

1899

1490

parent_pipe.send(('function',))

1900

1491

else:

1901

parent_pipe.send(('data', client_object

1902

.__getattribute__(attrname)))

1903

1492

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1493

1904

1494

if command == 'setattr':

1905

1495

attrname = request[1]

1906

1496

value = request[2]

1907

1497

setattr(client_object, attrname, value)

1908

1498

1909

1499

return True

1910

1500

1911

1501

1912

1502

def string_to_delta(interval):

1913

1503

"""Parse a string and return a datetime.timedelta

1914

1504

1915

>>> string_to_delta('7d')

1505

>>> string_to_delta(u'7d')

1916

1506

datetime.timedelta(7)

1917

>>> string_to_delta('60s')

1507

>>> string_to_delta(u'60s')

1918

1508

datetime.timedelta(0, 60)

1919

>>> string_to_delta('60m')

1509

>>> string_to_delta(u'60m')

1920

1510

datetime.timedelta(0, 3600)

1921

>>> string_to_delta('24h')

1511

>>> string_to_delta(u'24h')

1922

1512

datetime.timedelta(1)

1923

>>> string_to_delta('1w')

1513

>>> string_to_delta(u'1w')

1924

1514

datetime.timedelta(7)

1925

>>> string_to_delta('5m 30s')

1515

>>> string_to_delta(u'5m 30s')

1926

1516

datetime.timedelta(0, 330)

1927

1517

"""

1928

1518

timevalue = datetime.timedelta(0)

1930

1520

try:

1931

1521

suffix = unicode(s[-1])

1932

1522

value = int(s[:-1])

1933

if suffix == "d":

1523

if suffix == u"d":

1934

1524

delta = datetime.timedelta(value)

1935

elif suffix == "s":

1525

elif suffix == u"s":

1936

1526

delta = datetime.timedelta(0, value)

1937

elif suffix == "m":

1527

elif suffix == u"m":

1938

1528

delta = datetime.timedelta(0, 0, 0, 0, value)

1939

elif suffix == "h":

1529

elif suffix == u"h":

1940

1530

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1941

elif suffix == "w":

1531

elif suffix == u"w":

1942

1532

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1943

1533

else:

1944

raise ValueError("Unknown suffix %r" % suffix)

1945

except (ValueError, IndexError) as e:

1946

raise ValueError(*(e.args))

1534

raise ValueError(u"Unknown suffix %r" % suffix)

1535

except (ValueError, IndexError), e:

1536

raise ValueError(e.message)

1947

1537

timevalue += delta

1948

1538

return timevalue

1949

1539

1950

1540

1541

def if_nametoindex(interface):

1542

"""Call the C function if_nametoindex(), or equivalent

1543

1544

Note: This function cannot accept a unicode string."""

1545

global if_nametoindex

1546

try:

1547

if_nametoindex = (ctypes.cdll.LoadLibrary

1548

(ctypes.util.find_library(u"c"))

1549

.if_nametoindex)

1550

except (OSError, AttributeError):

1551

logger.warning(u"Doing if_nametoindex the hard way")

1552

def if_nametoindex(interface):

1553

"Get an interface index the hard way, i.e. using fcntl()"

1554

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1555

with contextlib.closing(socket.socket()) as s:

1556

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1557

struct.pack(str(u"16s16x"),

1558

interface))

1559

interface_index = struct.unpack(str(u"I"),

1560

ifreq[16:20])[0]

1561

return interface_index

1562

return if_nametoindex(interface)

1563

1564

1951

1565

def daemon(nochdir = False, noclose = False):

1952

1566

"""See daemon(3). Standard BSD Unix function.

1953

1567

1956

1570

sys.exit()

1957

1571

os.setsid()

1958

1572

if not nochdir:

1959

os.chdir("/")

1573

os.chdir(u"/")

1960

1574

if os.fork():

1961

1575

sys.exit()

1962

1576

if not noclose:

1964

1578

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1965

1579

if not stat.S_ISCHR(os.fstat(null).st_mode):

1966

1580

raise OSError(errno.ENODEV,

1967

"%s not a character device"

1581

u"%s not a character device"

1968

1582

% os.path.devnull)

1969

1583

os.dup2(null, sys.stdin.fileno())

1970

1584

os.dup2(null, sys.stdout.fileno())

1978

1592

##################################################################

1979

1593

# Parsing of options, both command line and config file

1980

1594

1981

parser = argparse.ArgumentParser()

1982

parser.add_argument("-v", "--version", action="version",

1983

version = "%%(prog)s %s" % version,

1984

help="show version number and exit")

1985

parser.add_argument("-i", "--interface", metavar="IF",

1986

help="Bind to interface IF")

1987

parser.add_argument("-a", "--address",

1988

help="Address to listen for requests on")

1989

parser.add_argument("-p", "--port", type=int,

1990

help="Port number to receive requests on")

1991

parser.add_argument("--check", action="store_true",

1992

help="Run self-test")

1993

parser.add_argument("--debug", action="store_true",

1994

help="Debug mode; run in foreground and log"

1995

" to terminal")

1996

parser.add_argument("--debuglevel", metavar="LEVEL",

1997

help="Debug level for stdout output")

1998

parser.add_argument("--priority", help="GnuTLS"

1999

" priority string (see GnuTLS documentation)")

2000

parser.add_argument("--servicename",

2001

metavar="NAME", help="Zeroconf service name")

2002

parser.add_argument("--configdir",

2003

default="/etc/mandos", metavar="DIR",

2004

help="Directory to search for configuration"

2005

" files")

2006

parser.add_argument("--no-dbus", action="store_false",

2007

dest="use_dbus", help="Do not provide D-Bus"

2008

" system bus interface")

2009

parser.add_argument("--no-ipv6", action="store_false",

2010

dest="use_ipv6", help="Do not use IPv6")

2011

parser.add_argument("--no-restore", action="store_false",

2012

dest="restore", help="Do not restore stored"

2013

" state")

2014

parser.add_argument("--statedir", metavar="DIR",

2015

help="Directory to save/restore state in")

2016

2017

options = parser.parse_args()

1595

parser = optparse.OptionParser(version = "%%prog %s" % version)

1596

parser.add_option("-i", u"--interface", type=u"string",

1597

metavar="IF", help=u"Bind to interface IF")

1598

parser.add_option("-a", u"--address", type=u"string",

1599

help=u"Address to listen for requests on")

1600

parser.add_option("-p", u"--port", type=u"int",

1601

help=u"Port number to receive requests on")

1602

parser.add_option("--check", action=u"store_true",

1603

help=u"Run self-test")

1604

parser.add_option("--debug", action=u"store_true",

1605

help=u"Debug mode; run in foreground and log to"

1606

u" terminal")

1607

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1608

u" priority string (see GnuTLS documentation)")

1609

parser.add_option("--servicename", type=u"string",

1610

metavar=u"NAME", help=u"Zeroconf service name")

1611

parser.add_option("--configdir", type=u"string",

1612

default=u"/etc/mandos", metavar=u"DIR",

1613

help=u"Directory to search for configuration"

1614

u" files")

1615

parser.add_option("--no-dbus", action=u"store_false",

1616

dest=u"use_dbus", help=u"Do not provide D-Bus"

1617

u" system bus interface")

1618

parser.add_option("--no-ipv6", action=u"store_false",

1619

dest=u"use_ipv6", help=u"Do not use IPv6")

1620

options = parser.parse_args()[0]

2018

1621

2019

1622

if options.check:

2020

1623

import doctest

2022

1625

sys.exit()

2023

1626

2024

1627

# Default values for config file for server-global settings

2025

server_defaults = { "interface": "",

2026

"address": "",

2027

"port": "",

2028

"debug": "False",

2029

"priority":

2030

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2031

"servicename": "Mandos",

2032

"use_dbus": "True",

2033

"use_ipv6": "True",

2034

"debuglevel": "",

2035

"restore": "True",

2036

"statedir": "/var/lib/mandos"

1628

server_defaults = { u"interface": u"",

1629

u"address": u"",

1630

u"port": u"",

1631

u"debug": u"False",

1632

u"priority":

1633

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1634

u"servicename": u"Mandos",

1635

u"use_dbus": u"True",

1636

u"use_ipv6": u"True",

2037

1637

}

2038

1638

2039

1639

# Parse config file for server-global settings

2040

1640

server_config = configparser.SafeConfigParser(server_defaults)

2041

1641

del server_defaults

2042

1642

server_config.read(os.path.join(options.configdir,

2043

"mandos.conf"))

1643

u"mandos.conf"))

2044

1644

# Convert the SafeConfigParser object to a dict

2045

1645

server_settings = server_config.defaults()

2046

1646

# Use the appropriate methods on the non-string config options

2047

for option in ("debug", "use_dbus", "use_ipv6"):

2048

server_settings[option] = server_config.getboolean("DEFAULT",

1647

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1648

server_settings[option] = server_config.getboolean(u"DEFAULT",

2049

1649

option)

2050

1650

if server_settings["port"]:

2051

server_settings["port"] = server_config.getint("DEFAULT",

2052

"port")

1651

server_settings["port"] = server_config.getint(u"DEFAULT",

1652

u"port")

2053

1653

del server_config

2054

1654

2055

1655

# Override the settings from the config file with command line

2056

1656

# options, if set.

2057

for option in ("interface", "address", "port", "debug",

2058

"priority", "servicename", "configdir",

2059

"use_dbus", "use_ipv6", "debuglevel", "restore",

2060

"statedir"):

1657

for option in (u"interface", u"address", u"port", u"debug",

1658

u"priority", u"servicename", u"configdir",

1659

u"use_dbus", u"use_ipv6"):

2061

1660

value = getattr(options, option)

2062

1661

if value is not None:

2063

1662

server_settings[option] = value

2071

1670

##################################################################

2072

1671

2073

1672

# For convenience

2074

debug = server_settings["debug"]

2075

debuglevel = server_settings["debuglevel"]

2076

use_dbus = server_settings["use_dbus"]

2077

use_ipv6 = server_settings["use_ipv6"]

2078

stored_state_path = os.path.join(server_settings["statedir"],

2079

stored_state_file)

2080

2081

if debug:

2082

initlogger(debug, logging.DEBUG)

2083

else:

2084

if not debuglevel:

2085

initlogger(debug)

2086

else:

2087

level = getattr(logging, debuglevel.upper())

2088

initlogger(debug, level)

2089

2090

if server_settings["servicename"] != "Mandos":

1673

debug = server_settings[u"debug"]

1674

use_dbus = server_settings[u"use_dbus"]

1675

use_ipv6 = server_settings[u"use_ipv6"]

1676

1677

if not debug:

1678

syslogger.setLevel(logging.WARNING)

1679

console.setLevel(logging.WARNING)

1680

1681

if server_settings[u"servicename"] != u"Mandos":

2091

1682

syslogger.setFormatter(logging.Formatter

2092

('Mandos (%s) [%%(process)d]:'

2093

' %%(levelname)s: %%(message)s'

2094

% server_settings["servicename"]))

1683

(u'Mandos (%s) [%%(process)d]:'

1684

u' %%(levelname)s: %%(message)s'

1685

% server_settings[u"servicename"]))

2095

1686

2096

1687

# Parse config file with clients

2097

client_config = configparser.SafeConfigParser(Client.client_defaults)

2098

client_config.read(os.path.join(server_settings["configdir"],

2099

"clients.conf"))

1688

client_defaults = { u"timeout": u"1h",

1689

u"interval": u"5m",

1690

u"checker": u"fping -q -- %%(host)s",

1691

u"host": u"",

1692

u"approved_delay": u"5m",

1693

u"approved_duration": u"1s",

1694

}

1695

client_config = configparser.SafeConfigParser(client_defaults)

1696

client_config.read(os.path.join(server_settings[u"configdir"],

1697

u"clients.conf"))

2100

1698

2101

1699

global mandos_dbus_service

2102

1700

mandos_dbus_service = None

2103

1701

2104

tcp_server = MandosServer((server_settings["address"],

2105

server_settings["port"]),

1702

tcp_server = MandosServer((server_settings[u"address"],

1703

server_settings[u"port"]),

2106

1704

ClientHandler,

2107

interface=(server_settings["interface"]

2108

or None),

1705

interface=server_settings[u"interface"],

2109

1706

use_ipv6=use_ipv6,

2110

1707

gnutls_priority=

2111

server_settings["priority"],

1708

server_settings[u"priority"],

2112

1709

use_dbus=use_dbus)

2113

if not debug:

2114

pidfilename = "/var/run/mandos.pid"

2115

try:

2116

pidfile = open(pidfilename, "w")

2117

except IOError:

2118

logger.error("Could not open file %r", pidfilename)

1710

pidfilename = u"/var/run/mandos.pid"

1711

try:

1712

pidfile = open(pidfilename, u"w")

1713

except IOError:

1714

logger.error(u"Could not open file %r", pidfilename)

2119

1715

2120

1716

try:

2121

uid = pwd.getpwnam("_mandos").pw_uid

2122

gid = pwd.getpwnam("_mandos").pw_gid

1717

uid = pwd.getpwnam(u"_mandos").pw_uid

1718

gid = pwd.getpwnam(u"_mandos").pw_gid

2123

1719

except KeyError:

2124

1720

try:

2125

uid = pwd.getpwnam("mandos").pw_uid

2126

gid = pwd.getpwnam("mandos").pw_gid

1721

uid = pwd.getpwnam(u"mandos").pw_uid

1722

gid = pwd.getpwnam(u"mandos").pw_gid

2127

1723

except KeyError:

2128

1724

try:

2129

uid = pwd.getpwnam("nobody").pw_uid

2130

gid = pwd.getpwnam("nobody").pw_gid

1725

uid = pwd.getpwnam(u"nobody").pw_uid

1726

gid = pwd.getpwnam(u"nobody").pw_gid

2131

1727

except KeyError:

2132

1728

uid = 65534

2133

1729

gid = 65534

2134

1730

try:

2135

1731

os.setgid(gid)

2136

1732

os.setuid(uid)

2137

except OSError as error:

1733

except OSError, error:

2138

1734

if error[0] != errno.EPERM:

2139

1735

raise error

2140

1736

1737

# Enable all possible GnuTLS debugging

2141

1738

if debug:

2142

# Enable all possible GnuTLS debugging

2143

2144

1739

# "Use a log level over 10 to enable all debugging options."

2145

1740

# - GnuTLS manual

2146

1741

gnutls.library.functions.gnutls_global_set_log_level(11)

2147

1742

2148

1743

@gnutls.library.types.gnutls_log_func

2149

1744

def debug_gnutls(level, string):

2150

logger.debug("GnuTLS: %s", string[:-1])

1745

logger.debug(u"GnuTLS: %s", string[:-1])

2151

1746

2152

1747

(gnutls.library.functions

2153

1748

.gnutls_global_set_log_function(debug_gnutls))

2154

2155

# Redirect stdin so all checkers get /dev/null

2156

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2157

os.dup2(null, sys.stdin.fileno())

2158

if null > 2:

2159

os.close(null)

2160

2161

# Need to fork before connecting to D-Bus

2162

if not debug:

2163

# Close all input and output, do double fork, etc.

2164

daemon()

2165

2166

gobject.threads_init()

2167

1749

2168

1750

global main_loop

2169

1751

# From the Avahi example code

2173

1755

# End of Avahi example code

2174

1756

if use_dbus:

2175

1757

try:

2176

bus_name = dbus.service.BusName("se.recompile.Mandos",

1758

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2177

1759

bus, do_not_queue=True)

2178

old_bus_name = (dbus.service.BusName

2179

("se.bsnet.fukt.Mandos", bus,

2180

do_not_queue=True))

2181

except dbus.exceptions.NameExistsException as e:

2182

logger.error(unicode(e) + ", disabling D-Bus")

1760

except dbus.exceptions.NameExistsException, e:

1761

logger.error(unicode(e) + u", disabling D-Bus")

2183

1762

use_dbus = False

2184

server_settings["use_dbus"] = False

1763

server_settings[u"use_dbus"] = False

2185

1764

tcp_server.use_dbus = False

2186

1765

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2187

service = AvahiServiceToSyslog(name =

2188

server_settings["servicename"],

2189

servicetype = "_mandos._tcp",

2190

protocol = protocol, bus = bus)

1766

service = AvahiService(name = server_settings[u"servicename"],

1767

servicetype = u"_mandos._tcp",

1768

protocol = protocol, bus = bus)

2191

1769

if server_settings["interface"]:

2192

1770

service.interface = (if_nametoindex

2193

(str(server_settings["interface"])))

2194

1771

(str(server_settings[u"interface"])))

1772

2195

1773

global multiprocessing_manager

2196

1774

multiprocessing_manager = multiprocessing.Manager()

2197

1775

2198

1776

client_class = Client

2199

1777

if use_dbus:

2200

client_class = functools.partial(ClientDBusTransitional,

2201

bus = bus)

2202

2203

client_settings = Client.config_parser(client_config)

2204

old_client_settings = {}

2205

clients_data = {}

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

except EOFError as e:

2220

logger.warning("Could not load persistent state: "

2221

"EOFError: {0}".format(e))

2222

2223

with PGPEngine() as pgp:

2224

for client_name, client in clients_data.iteritems():

2225

# Decide which value to use after restoring saved state.

2226

# We have three different values: Old config file,

2227

# new config file, and saved state.

2228

# New config value takes precedence if it differs from old

2229

# config value, otherwise use saved state.

2230

for name, value in client_settings[client_name].items():

2231

try:

2232

# For each value in new config, check if it

2233

# differs from the old config value (Except for

2234

# the "secret" attribute)

2235

if (name != "secret" and

2236

value != old_client_settings[client_name]

2237

[name]):

2238

client[name] = value

2239

except KeyError:

2240

pass

2241

2242

# Clients who has passed its expire date can still be

2243

# enabled if its last checker was successful. Clients

2244

# whose checker failed before we stored its state is

2245

# assumed to have failed all checkers during downtime.

2246

if client["enabled"]:

2247

if datetime.datetime.utcnow() >= client["expires"]:

2248

if not client["last_checked_ok"]:

2249

logger.warning(

2250

"disabling client {0} - Client never "

2251

"performed a successfull checker"

2252

.format(client["name"]))

2253

client["enabled"] = False

2254

elif client["last_checker_status"] != 0:

2255

logger.warning(

2256

"disabling client {0} - Client "

2257

"last checker failed with error code {1}"

2258

.format(client["name"],

2259

client["last_checker_status"]))

2260

client["enabled"] = False

2261

else:

2262

client["expires"] = (datetime.datetime

2263

.utcnow()

2264

+ client["timeout"])

2265

1778

client_class = functools.partial(ClientDBus, bus = bus)

1779

def client_config_items(config, section):

1780

special_settings = {

1781

"approved_by_default":

1782

lambda: config.getboolean(section,

1783

"approved_by_default"),

1784

}

1785

for name, value in config.items(section):

2266

1786

try:

2267

client["secret"] = (

2268

pgp.decrypt(client["encrypted_secret"],

2269

client_settings[client_name]

2270

["secret"]))

2271

except PGPError:

2272

# If decryption fails, we use secret from new settings

2273

logger.debug("Failed to decrypt {0} old secret"

2274

.format(client_name))

2275

client["secret"] = (

2276

client_settings[client_name]["secret"])

2277

2278

2279

# Add/remove clients based on new changes made to config

2280

for client_name in set(old_client_settings) - set(client_settings):

2281

del clients_data[client_name]

2282

for client_name in set(client_settings) - set(old_client_settings):

2283

clients_data[client_name] = client_settings[client_name]

2284

2285

# Create clients all clients

2286

for client_name, client in clients_data.iteritems():

2287

tcp_server.clients[client_name] = client_class(

2288

name = client_name, settings = client)

2289

1787

yield (name, special_settings[name]())

1788

except KeyError:

1789

yield (name, value)

1790

1791

tcp_server.clients.update(set(

1792

client_class(name = section,

1793

config= dict(client_config_items(

1794

client_config, section)))

1795

for section in client_config.sections()))

2290

1796

if not tcp_server.clients:

2291

logger.warning("No clients defined")

2292

1797

logger.warning(u"No clients defined")

1798

1799

if debug:

1800

# Redirect stdin so all checkers get /dev/null

1801

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1802

os.dup2(null, sys.stdin.fileno())

1803

if null > 2:

1804

os.close(null)

1805

else:

1806

# No console logging

1807

logger.removeHandler(console)

1808

# Close all input and output, do double fork, etc.

1809

daemon()

1810

1811

try:

1812

with pidfile:

1813

pid = os.getpid()

1814

pidfile.write(str(pid) + "\n")

1815

del pidfile

1816

except IOError:

1817

logger.error(u"Could not write to file %r with PID %d",

1818

pidfilename, pid)

1819

except NameError:

1820

# "pidfile" was never created

1821

pass

1822

del pidfilename

1823

2293

1824

if not debug:

2294

try:

2295

with pidfile:

2296

pid = os.getpid()

2297

pidfile.write(str(pid) + "\n".encode("utf-8"))

2298

del pidfile

2299

except IOError:

2300

logger.error("Could not write to file %r with PID %d",

2301

pidfilename, pid)

2302

except NameError:

2303

# "pidfile" was never created

2304

pass

2305

del pidfilename

2306

1825

signal.signal(signal.SIGINT, signal.SIG_IGN)

2307

2308

1826

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2309

1827

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2310

1828

2312

1830

class MandosDBusService(dbus.service.Object):

2313

1831

"""A D-Bus proxy object"""

2314

1832

def __init__(self):

2315

dbus.service.Object.__init__(self, bus, "/")

2316

_interface = "se.recompile.Mandos"

1833

dbus.service.Object.__init__(self, bus, u"/")

1834

_interface = u"se.bsnet.fukt.Mandos"

2317

1835

2318

@dbus.service.signal(_interface, signature="o")

1836

@dbus.service.signal(_interface, signature=u"o")

2319

1837

def ClientAdded(self, objpath):

2320

1838

"D-Bus signal"

2321

1839

pass

2322

1840

2323

@dbus.service.signal(_interface, signature="ss")

1841

@dbus.service.signal(_interface, signature=u"ss")

2324

1842

def ClientNotFound(self, fingerprint, address):

2325

1843

"D-Bus signal"

2326

1844

pass

2327

1845

2328

@dbus.service.signal(_interface, signature="os")

1846

@dbus.service.signal(_interface, signature=u"os")

2329

1847

def ClientRemoved(self, objpath, name):

2330

1848

"D-Bus signal"

2331

1849

pass

2332

1850

2333

@dbus.service.method(_interface, out_signature="ao")

1851

@dbus.service.method(_interface, out_signature=u"ao")

2334

1852

def GetAllClients(self):

2335

1853

"D-Bus method"

2336

1854

return dbus.Array(c.dbus_object_path

2337

for c in

2338

tcp_server.clients.itervalues())

1855

for c in tcp_server.clients)

2339

1856

2340

1857

@dbus.service.method(_interface,

2341

out_signature="a{oa{sv}}")

1858

out_signature=u"a{oa{sv}}")

2342

1859

def GetAllClientsWithProperties(self):

2343

1860

"D-Bus method"

2344

1861

return dbus.Dictionary(

2345

((c.dbus_object_path, c.GetAll(""))

2346

for c in tcp_server.clients.itervalues()),

2347

signature="oa{sv}")

1862

((c.dbus_object_path, c.GetAll(u""))

1863

for c in tcp_server.clients),

1864

signature=u"oa{sv}")

2348

1865

2349

@dbus.service.method(_interface, in_signature="o")

1866

@dbus.service.method(_interface, in_signature=u"o")

2350

1867

def RemoveClient(self, object_path):

2351

1868

"D-Bus method"

2352

for c in tcp_server.clients.itervalues():

1869

for c in tcp_server.clients:

2353

1870

if c.dbus_object_path == object_path:

2354

del tcp_server.clients[c.name]

1871

tcp_server.clients.remove(c)

2355

1872

c.remove_from_connection()

2356

1873

# Don't signal anything except ClientRemoved

2357

1874

c.disable(quiet=True)

2362

1879

2363

1880

del _interface

2364

1881

2365

class MandosDBusServiceTransitional(MandosDBusService):

2366

__metaclass__ = AlternateDBusNamesMetaclass

2367

mandos_dbus_service = MandosDBusServiceTransitional()

1882

mandos_dbus_service = MandosDBusService()

2368

1883

2369

1884

def cleanup():

2370

1885

"Cleanup function; run on exit"

2371

1886

service.cleanup()

2372

1887

2373

multiprocessing.active_children()

2374

if not (tcp_server.clients or client_settings):

2375

return

2376

2377

# Store client before exiting. Secrets are encrypted with key

2378

# based on what config file has. If config file is

2379

# removed/edited, old secret will thus be unrecovable.

2380

clients = {}

2381

with PGPEngine() as pgp:

2382

for client in tcp_server.clients.itervalues():

2383

key = client_settings[client.name]["secret"]

2384

client.encrypted_secret = pgp.encrypt(client.secret,

2385

key)

2386

client_dict = {}

2387

2388

# A list of attributes that can not be pickled

2389

# + secret.

2390

exclude = set(("bus", "changedstate", "secret",

2391

"checker"))

2392

for name, typ in (inspect.getmembers

2393

(dbus.service.Object)):

2394

exclude.add(name)

2395

2396

client_dict["encrypted_secret"] = (client

2397

.encrypted_secret)

2398

for attr in client.client_structure:

2399

if attr not in exclude:

2400

client_dict[attr] = getattr(client, attr)

2401

2402

clients[client.name] = client_dict

2403

del client_settings[client.name]["secret"]

2404

2405

try:

2406

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2407

prefix="clients-",

2408

dir=os.path.dirname

2409

(stored_state_path))

2410

with os.fdopen(tempfd, "wb") as stored_state:

2411

pickle.dump((clients, client_settings), stored_state)

2412

os.rename(tempname, stored_state_path)

2413

except (IOError, OSError) as e:

2414

logger.warning("Could not save persistent state: {0}"

2415

.format(e))

2416

if not debug:

2417

try:

2418

os.remove(tempname)

2419

except NameError:

2420

pass

2421

if e.errno not in set((errno.ENOENT, errno.EACCES,

2422

errno.EEXIST)):

2423

raise e

2424

2425

# Delete all clients, and settings from config

2426

1888

while tcp_server.clients:

2427

name, client = tcp_server.clients.popitem()

1889

client = tcp_server.clients.pop()

2428

1890

if use_dbus:

2429

1891

client.remove_from_connection()

1892

client.disable_hook = None

2430

1893

# Don't signal anything except ClientRemoved

2431

1894

client.disable(quiet=True)

2432

1895

if use_dbus:

2433

1896

# Emit D-Bus signal

2434

mandos_dbus_service.ClientRemoved(client

2435

.dbus_object_path,

1897

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2436

1898

client.name)

2437

client_settings.clear()

2438

1899

2439

1900

atexit.register(cleanup)

2440

1901

2441

for client in tcp_server.clients.itervalues():

1902

for client in tcp_server.clients:

2442

1903

if use_dbus:

2443

1904

# Emit D-Bus signal

2444

1905

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2445

# Need to initiate checking of clients

2446

if client.enabled:

2447

client.init_checker()

1906

client.enable()

2448

1907

2449

1908

tcp_server.enable()

2450

1909

tcp_server.server_activate()

2452

1911

# Find out what port we got

2453

1912

service.port = tcp_server.socket.getsockname()[1]

2454

1913

if use_ipv6:

2455

logger.info("Now listening on address %r, port %d,"

1914

logger.info(u"Now listening on address %r, port %d,"

2456

1915

" flowinfo %d, scope_id %d"

2457

1916

% tcp_server.socket.getsockname())

2458

1917

else: # IPv4

2459

logger.info("Now listening on address %r, port %d"

1918

logger.info(u"Now listening on address %r, port %d"

2460

1919

% tcp_server.socket.getsockname())

2461

1920

2462

1921

#service.interface = tcp_server.socket.getsockname()[3]

2465

1924

# From the Avahi example code

2466

1925

try:

2467

1926

service.activate()

2468

except dbus.exceptions.DBusException as error:

2469

logger.critical("DBusException: %s", error)

1927

except dbus.exceptions.DBusException, error:

1928

logger.critical(u"DBusException: %s", error)

2470

1929

cleanup()

2471

1930

sys.exit(1)

2472

1931

# End of Avahi example code

2476

1935

(tcp_server.handle_request

2477

1936

(*args[2:], **kwargs) or True))

2478

1937

2479

logger.debug("Starting main loop")

1938

logger.debug(u"Starting main loop")

2480

1939

main_loop.run()

2481

except AvahiError as error:

2482

logger.critical("AvahiError: %s", error)

1940

except AvahiError, error:

1941

logger.critical(u"AvahiError: %s", error)

2483

1942

cleanup()

2484

1943

sys.exit(1)

2485

1944

except KeyboardInterrupt:

2486

1945

if debug:

2487

print("", file=sys.stderr)

2488

logger.debug("Server received KeyboardInterrupt")

2489

logger.debug("Server exiting")

1946

print >> sys.stderr

1947

logger.debug(u"Server received KeyboardInterrupt")

1948

logger.debug(u"Server exiting")

2490

1949

# Must run before the D-Bus bus name gets deregistered

2491

1950

cleanup()

2492

1951