/mandos/release : revision 24.1.157

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

64

69

65

import dbus

70

66

import dbus.service

75

71

import ctypes.util

76

72

import xml.dom.minidom

77

73

import inspect

78

import GnuPGInterface

79

74

80

75

try:

81

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

80

except ImportError:

86

81

SO_BINDTODEVICE = None

87

82

88

version = "1.4.1"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

83

84

version = "1.0.14"

85

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

92

88

syslogger = (logging.handlers.SysLogHandler

93

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

console = logging.StreamHandler()

122

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

123

' [%(process)d]:'

124

' %(levelname)s:'

125

' %(message)s'))

126

logger.addHandler(console)

127

logger.setLevel(level)

128

129

130

class PGPError(Exception):

131

"""Exception if encryption/decryption fails"""

132

pass

133

134

135

class PGPEngine(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise PGPError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise PGPError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

208

90

address = "/dev/log"))

91

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

logger.addHandler(syslogger)

95

96

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

100

logger.addHandler(console)

209

101

210

102

class AvahiError(Exception):

211

103

def __init__(self, value, *args, **kwargs):

227

119

Attributes:

228

120

interface: integer; avahi.IF_UNSPEC or an interface index.

229

121

Used to optionally bind to the specified interface.

230

231

type: string; Example: '_mandos._tcp'.

122

123

type: string; Example: u'_mandos._tcp'.

232

124

See <http://www.dns-sd.org/ServiceTypes.html>

233

125

port: integer; what port to announce

234

126

TXT: list of strings; TXT record for the service

243

135

"""

244

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

245

137

servicetype = None, port = None, TXT = None,

246

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

247

139

protocol = avahi.PROTO_UNSPEC, bus = None):

248

140

self.interface = interface

249

141

self.name = name

258

150

self.group = None # our entry group

259

151

self.server = None

260

152

self.bus = bus

261

self.entry_group_state_changed_match = None

262

153

def rename(self):

263

154

"""Derived from the Avahi example code"""

264

155

if self.rename_count >= self.max_renames:

265

logger.critical("No suitable Zeroconf service name found"

266

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

267

158

self.rename_count)

268

raise AvahiServiceError("Too many renames")

269

self.name = unicode(self.server

270

.GetAlternativeServiceName(self.name))

271

logger.info("Changing Zeroconf service name to %r ...",

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

272

162

self.name)

163

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

166

% self.name))

273

167

self.remove()

274

try:

275

self.add()

276

except dbus.exceptions.DBusException as error:

277

logger.critical("DBusException: %s", error)

278

self.cleanup()

279

os._exit(1)

168

self.add()

280

169

self.rename_count += 1

281

170

def remove(self):

282

171

"""Derived from the Avahi example code"""

283

if self.entry_group_state_changed_match is not None:

284

self.entry_group_state_changed_match.remove()

285

self.entry_group_state_changed_match = None

286

172

if self.group is not None:

287

173

self.group.Reset()

288

174

def add(self):

289

175

"""Derived from the Avahi example code"""

290

self.remove()

291

176

if self.group is None:

292

177

self.group = dbus.Interface(

293

178

self.bus.get_object(avahi.DBUS_NAME,

294

179

self.server.EntryGroupNew()),

295

180

avahi.DBUS_INTERFACE_ENTRY_GROUP)

296

self.entry_group_state_changed_match = (

297

self.group.connect_to_signal(

298

'StateChanged', self.entry_group_state_changed))

299

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

181

self.group.connect_to_signal('StateChanged',

182

self

183

.entry_group_state_changed)

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

300

185

self.name, self.type)

301

186

self.group.AddService(

302

187

self.interface,

309

194

self.group.Commit()

310

195

def entry_group_state_changed(self, state, error):

311

196

"""Derived from the Avahi example code"""

312

logger.debug("Avahi entry group state change: %i", state)

197

logger.debug(u"Avahi entry group state change: %i", state)

313

198

314

199

if state == avahi.ENTRY_GROUP_ESTABLISHED:

315

logger.debug("Zeroconf service established.")

200

logger.debug(u"Zeroconf service established.")

316

201

elif state == avahi.ENTRY_GROUP_COLLISION:

317

logger.info("Zeroconf service name collision.")

202

logger.warning(u"Zeroconf service name collision.")

318

203

self.rename()

319

204

elif state == avahi.ENTRY_GROUP_FAILURE:

320

logger.critical("Avahi: Error in group state changed %s",

205

logger.critical(u"Avahi: Error in group state changed %s",

321

206

unicode(error))

322

raise AvahiGroupError("State changed: %s"

207

raise AvahiGroupError(u"State changed: %s"

323

208

% unicode(error))

324

209

def cleanup(self):

325

210

"""Derived from the Avahi example code"""

326

211

if self.group is not None:

327

try:

328

self.group.Free()

329

except (dbus.exceptions.UnknownMethodException,

330

dbus.exceptions.DBusException):

331

pass

212

self.group.Free()

332

213

self.group = None

333

self.remove()

334

def server_state_changed(self, state, error=None):

214

def server_state_changed(self, state):

335

215

"""Derived from the Avahi example code"""

336

logger.debug("Avahi server state change: %i", state)

337

bad_states = { avahi.SERVER_INVALID:

338

"Zeroconf server invalid",

339

avahi.SERVER_REGISTERING: None,

340

avahi.SERVER_COLLISION:

341

"Zeroconf server name collision",

342

avahi.SERVER_FAILURE:

343

"Zeroconf server failure" }

344

if state in bad_states:

345

if bad_states[state] is not None:

346

if error is None:

347

logger.error(bad_states[state])

348

else:

349

logger.error(bad_states[state] + ": %r", error)

350

self.cleanup()

216

logger.debug(u"Avahi server state change: %i", state)

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

351

220

elif state == avahi.SERVER_RUNNING:

352

221

self.add()

353

else:

354

if error is None:

355

logger.debug("Unknown state: %r", state)

356

else:

357

logger.debug("Unknown state: %r: %r", state, error)

358

222

def activate(self):

359

223

"""Derived from the Avahi example code"""

360

224

if self.server is None:

361

225

self.server = dbus.Interface(

362

226

self.bus.get_object(avahi.DBUS_NAME,

363

avahi.DBUS_PATH_SERVER,

364

follow_name_owner_changes=True),

227

avahi.DBUS_PATH_SERVER),

365

228

avahi.DBUS_INTERFACE_SERVER)

366

self.server.connect_to_signal("StateChanged",

229

self.server.connect_to_signal(u"StateChanged",

367

230

self.server_state_changed)

368

231

self.server_state_changed(self.server.GetState())

369

232

370

class AvahiServiceToSyslog(AvahiService):

371

def rename(self):

372

"""Add the new name to the syslog messages"""

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

378

return ret

379

233

380

def timedelta_to_milliseconds(td):

381

"Convert a datetime.timedelta() to milliseconds"

382

return ((td.days * 24 * 60 * 60 * 1000)

383

+ (td.seconds * 1000)

384

+ (td.microseconds // 1000))

385

386

234

class Client(object):

387

235

"""A representation of a client host served by this server.

388

236

389

237

Attributes:

390

approved: bool(); 'None' if not yet approved/disapproved

391

approval_delay: datetime.timedelta(); Time to wait for approval

392

approval_duration: datetime.timedelta(); Duration of one approval

238

239

D-Bus identifiers

240

fingerprint: string (40 or 32 hexadecimal digits); used to

241

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

245

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

248

timeout: datetime.timedelta(); How long from last_checked_ok

249

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

393

252

checker: subprocess.Popen(); a running checker process used

394

253

to see if the client lives.

395

254

'None' if no process is running.

396

checker_callback_tag: a gobject event source tag, or None

397

checker_command: string; External command which is run to check

398

if client lives. %() expansions are done at

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

399

260

runtime with vars(self) as dict, so that for

400

261

instance %(name)s can be used in the command.

401

checker_initiator_tag: a gobject event source tag, or None

402

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

405

262

current_checker_command: string; current running checker_command

406

disable_initiator_tag: a gobject event source tag, or None

407

enabled: bool()

408

fingerprint: string (40 or 32 hexadecimal digits); used to

409

uniquely identify the client

410

host: string; available for use by the checker command

411

interval: datetime.timedelta(); How often to start a new checker

412

last_approval_request: datetime.datetime(); (UTC) or None

413

last_checked_ok: datetime.datetime(); (UTC) or None

414

last_checker_status: integer between 0 and 255 reflecting exit

415

status of last checker. -1 reflects crashed

416

checker, or None.

417

last_enabled: datetime.datetime(); (UTC) or None

418

419

D-Bus identifiers

420

secret: bytestring; sent verbatim (over TLS) to client

421

timeout: datetime.timedelta(); How long from last_checked_ok

422

until this client is disabled

423

extended_timeout: extra long timeout when password has been sent

424

runtime_expansions: Allowed attributes for runtime expansion.

425

expires: datetime.datetime(); time (UTC) when a client will be

426

disabled, or None

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

427

266

"""

428

267

429

runtime_expansions = ("approval_delay", "approval_duration",

430

"created", "enabled", "fingerprint",

431

"host", "interval", "last_checked_ok",

432

"last_enabled", "name", "timeout")

433

client_defaults = { "timeout": "5m",

434

"extended_timeout": "15m",

435

"interval": "2m",

436

"checker": "fping -q -- %%(host)s",

437

"host": "",

438

"approval_delay": "0s",

439

"approval_duration": "1s",

440

"approved_by_default": "True",

441

"enabled": "True",

442

}

268

@staticmethod

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

443

274

444

275

def timeout_milliseconds(self):

445

276

"Return the 'timeout' attribute in milliseconds"

446

return timedelta_to_milliseconds(self.timeout)

447

448

def extended_timeout_milliseconds(self):

449

"Return the 'extended_timeout' attribute in milliseconds"

450

return timedelta_to_milliseconds(self.extended_timeout)

277

return self._timedelta_to_milliseconds(self.timeout)

451

278

452

279

def interval_milliseconds(self):

453

280

"Return the 'interval' attribute in milliseconds"

454

return timedelta_to_milliseconds(self.interval)

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

455

285

456

def approval_delay_milliseconds(self):

457

return timedelta_to_milliseconds(self.approval_delay)

458

459

@staticmethod

460

def config_parser(config):

461

""" Construct a new dict of client settings of this form:

462

{ client_name: {setting_name: value, ...}, ...}

463

with exceptions for any special settings as defined above"""

464

settings = {}

465

for client_name in config.sections():

466

section = dict(config.items(client_name))

467

client = settings[client_name] = {}

468

469

client["host"] = section["host"]

470

# Reformat values from string types to Python types

471

client["approved_by_default"] = config.getboolean(

472

client_name, "approved_by_default")

473

client["enabled"] = config.getboolean(client_name, "enabled")

474

475

client["fingerprint"] = (section["fingerprint"].upper()

476

.replace(" ", ""))

477

if "secret" in section:

478

client["secret"] = section["secret"].decode("base64")

479

elif "secfile" in section:

480

with open(os.path.expanduser(os.path.expandvars

481

(section["secfile"])),

482

"rb") as secfile:

483

client["secret"] = secfile.read()

484

else:

485

raise TypeError("No secret or secfile for section %s"

486

% section)

487

client["timeout"] = string_to_delta(section["timeout"])

488

client["extended_timeout"] = string_to_delta(

489

section["extended_timeout"])

490

client["interval"] = string_to_delta(section["interval"])

491

client["approval_delay"] = string_to_delta(

492

section["approval_delay"])

493

client["approval_duration"] = string_to_delta(

494

section["approval_duration"])

495

client["checker_command"] = section["checker"]

496

client["last_approval_request"] = None

497

client["last_checked_ok"] = None

498

client["last_checker_status"] = None

499

if client["enabled"]:

500

client["last_enabled"] = datetime.datetime.utcnow()

501

client["expires"] = (datetime.datetime.utcnow()

502

+ client["timeout"])

503

else:

504

client["last_enabled"] = None

505

client["expires"] = None

506

507

return settings

508

509

510

def __init__(self, settings, name = None):

286

def __init__(self, name = None, disable_hook=None, config=None):

511

287

"""Note: the 'checker' key in 'config' sets the

512

288

'checker_command' attribute and *not* the 'checker'

513

289

attribute."""

514

290

self.name = name

515

# adding all client settings

516

for setting, value in settings.iteritems():

517

setattr(self, setting, value)

518

519

logger.debug("Creating client %r", self.name)

291

if config is None:

292

config = {}

293

logger.debug(u"Creating client %r", self.name)

520

294

# Uppercase and remove spaces from fingerprint for later

521

295

# comparison purposes with return value from the fingerprint()

522

296

# function

523

logger.debug(" Fingerprint: %s", self.fingerprint)

524

self.created = settings.get("created", datetime.datetime.utcnow())

525

526

# attributes specific for this server instance

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

303

with open(os.path.expanduser(os.path.expandvars

304

(config[u"secfile"])),

305

"rb") as secfile:

306

self.secret = secfile.read()

307

else:

308

raise TypeError(u"No secret or secfile for client %s"

309

% self.name)

310

self.host = config.get(u"host", u"")

311

self.created = datetime.datetime.utcnow()

312

self.enabled = False

313

self.last_enabled = None

314

self.last_checked_ok = None

315

self.timeout = string_to_delta(config[u"timeout"])

316

self.interval = string_to_delta(config[u"interval"])

317

self.disable_hook = disable_hook

527

318

self.checker = None

528

319

self.checker_initiator_tag = None

529

320

self.disable_initiator_tag = None

530

321

self.checker_callback_tag = None

322

self.checker_command = config[u"checker"]

531

323

self.current_checker_command = None

532

self.approved = None

324

self.last_connect = None

325

self._approved = None

326

self.approved_by_default = config.get(u"approved_by_default",

327

True)

533

328

self.approvals_pending = 0

534

self.changedstate = (multiprocessing_manager

535

.Condition(multiprocessing_manager

536

.Lock()))

537

self.client_structure = [attr for attr in

538

self.__dict__.iterkeys()

539

if not attr.startswith("_")]

540

self.client_structure.append("client_structure")

541

542

for name, t in inspect.getmembers(type(self),

543

lambda obj:

544

isinstance(obj,

545

property)):

546

if not name.startswith("_"):

547

self.client_structure.append(name)

329

self.approved_delay = string_to_delta(

330

config[u"approved_delay"])

331

self.approved_duration = string_to_delta(

332

config[u"approved_duration"])

333

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

548

334

549

# Send notice to process children that client state has changed

550

335

def send_changedstate(self):

551

with self.changedstate:

552

self.changedstate.notify_all()

553

336

self.changedstate.acquire()

337

self.changedstate.notify_all()

338

self.changedstate.release()

339

554

340

def enable(self):

555

341

"""Start this client's checker and timeout hooks"""

556

if getattr(self, "enabled", False):

342

if getattr(self, u"enabled", False):

557

343

# Already enabled

558

344

return

559

345

self.send_changedstate()

560

self.expires = datetime.datetime.utcnow() + self.timeout

561

self.enabled = True

562

346

self.last_enabled = datetime.datetime.utcnow()

563

self.init_checker()

564

565

def disable(self, quiet=True):

566

"""Disable this client."""

567

if not getattr(self, "enabled", False):

568

return False

569

if not quiet:

570

self.send_changedstate()

571

if not quiet:

572

logger.info("Disabling client %s", self.name)

573

if getattr(self, "disable_initiator_tag", False):

574

gobject.source_remove(self.disable_initiator_tag)

575

self.disable_initiator_tag = None

576

self.expires = None

577

if getattr(self, "checker_initiator_tag", False):

578

gobject.source_remove(self.checker_initiator_tag)

579

self.checker_initiator_tag = None

580

self.stop_checker()

581

self.enabled = False

582

# Do not run this again if called by a gobject.timeout_add

583

return False

584

585

def __del__(self):

586

self.disable()

587

588

def init_checker(self):

589

347

# Schedule a new checker to be started an 'interval' from now,

590

348

# and every interval from then on.

591

349

self.checker_initiator_tag = (gobject.timeout_add

595

353

self.disable_initiator_tag = (gobject.timeout_add

596

354

(self.timeout_milliseconds(),

597

355

self.disable))

356

self.enabled = True

598

357

# Also start a new checker *right now*.

599

358

self.start_checker()

600

359

360

def disable(self, quiet=True):

361

"""Disable this client."""

362

if not getattr(self, "enabled", False):

363

return False

364

if not quiet:

365

self.send_changedstate()

366

if not quiet:

367

logger.info(u"Disabling client %s", self.name)

368

if getattr(self, u"disable_initiator_tag", False):

369

gobject.source_remove(self.disable_initiator_tag)

370

self.disable_initiator_tag = None

371

if getattr(self, u"checker_initiator_tag", False):

372

gobject.source_remove(self.checker_initiator_tag)

373

self.checker_initiator_tag = None

374

self.stop_checker()

375

if self.disable_hook:

376

self.disable_hook(self)

377

self.enabled = False

378

# Do not run this again if called by a gobject.timeout_add

379

return False

380

381

def __del__(self):

382

self.disable_hook = None

383

self.disable()

384

601

385

def checker_callback(self, pid, condition, command):

602

386

"""The checker has completed, so take appropriate actions."""

603

387

self.checker_callback_tag = None

604

388

self.checker = None

605

389

if os.WIFEXITED(condition):

606

self.last_checker_status = os.WEXITSTATUS(condition)

607

if self.last_checker_status == 0:

608

logger.info("Checker for %(name)s succeeded",

390

exitstatus = os.WEXITSTATUS(condition)

391

if exitstatus == 0:

392

logger.info(u"Checker for %(name)s succeeded",

609

393

vars(self))

610

394

self.checked_ok()

611

395

else:

612

logger.info("Checker for %(name)s failed",

396

logger.info(u"Checker for %(name)s failed",

613

397

vars(self))

614

398

else:

615

self.last_checker_status = -1

616

logger.warning("Checker for %(name)s crashed?",

399

logger.warning(u"Checker for %(name)s crashed?",

617

400

vars(self))

618

401

619

def checked_ok(self, timeout=None):

402

def checked_ok(self):

620

403

"""Bump up the timeout for this client.

621

404

622

405

This should only be called when the client has been seen,

623

406

alive and well.

624

407

"""

625

if timeout is None:

626

timeout = self.timeout

627

408

self.last_checked_ok = datetime.datetime.utcnow()

628

if self.disable_initiator_tag is not None:

629

gobject.source_remove(self.disable_initiator_tag)

630

if getattr(self, "enabled", False):

631

self.disable_initiator_tag = (gobject.timeout_add

632

(timedelta_to_milliseconds

633

(timeout), self.disable))

634

self.expires = datetime.datetime.utcnow() + timeout

635

636

def need_approval(self):

637

self.last_approval_request = datetime.datetime.utcnow()

409

gobject.source_remove(self.disable_initiator_tag)

410

self.disable_initiator_tag = (gobject.timeout_add

411

(self.timeout_milliseconds(),

412

self.disable))

638

413

639

414

def start_checker(self):

640

415

"""Start a new checker subprocess if one is not running.

653

428

# If a checker exists, make sure it is not a zombie

654

429

try:

655

430

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

656

except (AttributeError, OSError) as error:

431

except (AttributeError, OSError), error:

657

432

if (isinstance(error, OSError)

658

433

and error.errno != errno.ECHILD):

659

434

raise error

660

435

else:

661

436

if pid:

662

logger.warning("Checker was a zombie")

437

logger.warning(u"Checker was a zombie")

663

438

gobject.source_remove(self.checker_callback_tag)

664

439

self.checker_callback(pid, status,

665

440

self.current_checker_command)

670

445

command = self.checker_command % self.host

671

446

except TypeError:

672

447

# Escape attributes for the shell

673

escaped_attrs = dict(

674

(attr,

675

re.escape(unicode(str(getattr(self, attr, "")),

676

errors=

677

'replace')))

678

for attr in

679

self.runtime_expansions)

680

448

escaped_attrs = dict((key,

449

re.escape(unicode(str(val),

450

errors=

451

u'replace')))

452

for key, val in

453

vars(self).iteritems())

681

454

try:

682

455

command = self.checker_command % escaped_attrs

683

except TypeError as error:

684

logger.error('Could not format string "%s":'

685

' %s', self.checker_command, error)

456

except TypeError, error:

457

logger.error(u'Could not format string "%s":'

458

u' %s', self.checker_command, error)

686

459

return True # Try again later

687

460

self.current_checker_command = command

688

461

try:

689

logger.info("Starting checker %r for %s",

462

logger.info(u"Starting checker %r for %s",

690

463

command, self.name)

691

464

# We don't need to redirect stdout and stderr, since

692

465

# in normal mode, that is already done by daemon(),

694

467

# always replaced by /dev/null.)

695

468

self.checker = subprocess.Popen(command,

696

469

close_fds=True,

697

shell=True, cwd="/")

470

shell=True, cwd=u"/")

698

471

self.checker_callback_tag = (gobject.child_watch_add

699

472

(self.checker.pid,

700

473

self.checker_callback,

705

478

if pid:

706

479

gobject.source_remove(self.checker_callback_tag)

707

480

self.checker_callback(pid, status, command)

708

except OSError as error:

709

logger.error("Failed to start subprocess: %s",

481

except OSError, error:

482

logger.error(u"Failed to start subprocess: %s",

710

483

error)

711

484

# Re-run this periodically if run by gobject.timeout_add

712

485

return True

716

489

if self.checker_callback_tag:

717

490

gobject.source_remove(self.checker_callback_tag)

718

491

self.checker_callback_tag = None

719

if getattr(self, "checker", None) is None:

492

if getattr(self, u"checker", None) is None:

720

493

return

721

logger.debug("Stopping checker for %(name)s", vars(self))

494

logger.debug(u"Stopping checker for %(name)s", vars(self))

722

495

try:

723

496

os.kill(self.checker.pid, signal.SIGTERM)

724

497

#time.sleep(0.5)

725

498

#if self.checker.poll() is None:

726

499

# os.kill(self.checker.pid, signal.SIGKILL)

727

except OSError as error:

500

except OSError, error:

728

501

if error.errno != errno.ESRCH: # No such process

729

502

raise

730

503

self.checker = None

731

504

732

733

def dbus_service_property(dbus_interface, signature="v",

734

access="readwrite", byte_arrays=False):

505

def dbus_service_property(dbus_interface, signature=u"v",

506

access=u"readwrite", byte_arrays=False):

735

507

"""Decorators for marking methods of a DBusObjectWithProperties to

736

508

become properties on the D-Bus.

737

509

744

516

"""

745

517

# Encoding deeply encoded byte arrays is not supported yet by the

746

518

# "Set" method, so we fail early here:

747

if byte_arrays and signature != "ay":

748

raise ValueError("Byte arrays not supported for non-'ay'"

749

" signature %r" % signature)

519

if byte_arrays and signature != u"ay":

520

raise ValueError(u"Byte arrays not supported for non-'ay'"

521

u" signature %r" % signature)

750

522

def decorator(func):

751

523

func._dbus_is_property = True

752

524

func._dbus_interface = dbus_interface

753

525

func._dbus_signature = signature

754

526

func._dbus_access = access

755

527

func._dbus_name = func.__name__

756

if func._dbus_name.endswith("_dbus_property"):

528

if func._dbus_name.endswith(u"_dbus_property"):

757

529

func._dbus_name = func._dbus_name[:-14]

758

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

530

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

759

531

return func

760

532

return decorator

761

533

781

553

782

554

class DBusObjectWithProperties(dbus.service.Object):

783

555

"""A D-Bus object with properties.

784

556

785

557

Classes inheriting from this can use the dbus_service_property

786

558

decorator to expose methods as D-Bus properties. It exposes the

787

559

standard Get(), Set(), and GetAll() methods on the D-Bus.

789

561

790

562

@staticmethod

791

563

def _is_dbus_property(obj):

792

return getattr(obj, "_dbus_is_property", False)

564

return getattr(obj, u"_dbus_is_property", False)

793

565

794

566

def _get_all_dbus_properties(self):

795

567

"""Returns a generator of (name, attribute) pairs

796

568

"""

797

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

798

for cls in self.__class__.__mro__

569

return ((prop._dbus_name, prop)

799

570

for name, prop in

800

inspect.getmembers(cls, self._is_dbus_property))

571

inspect.getmembers(self, self._is_dbus_property))

801

572

802

573

def _get_dbus_property(self, interface_name, property_name):

803

574

"""Returns a bound method if one exists which is a D-Bus

804

575

property with the specified name and interface.

805

576

"""

806

for cls in self.__class__.__mro__:

807

for name, value in (inspect.getmembers

808

(cls, self._is_dbus_property)):

809

if (value._dbus_name == property_name

810

and value._dbus_interface == interface_name):

811

return value.__get__(self)

812

577

for name in (property_name,

578

property_name + u"_dbus_property"):

579

prop = getattr(self, name, None)

580

if (prop is None

581

or not self._is_dbus_property(prop)

582

or prop._dbus_name != property_name

583

or (interface_name and prop._dbus_interface

584

and interface_name != prop._dbus_interface)):

585

continue

586

return prop

813

587

# No such property

814

raise DBusPropertyNotFound(self.dbus_object_path + ":"

815

+ interface_name + "."

588

raise DBusPropertyNotFound(self.dbus_object_path + u":"

589

+ interface_name + u"."

816

590

+ property_name)

817

591

818

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

819

out_signature="v")

592

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

593

out_signature=u"v")

820

594

def Get(self, interface_name, property_name):

821

595

"""Standard D-Bus property Get() method, see D-Bus standard.

822

596

"""

823

597

prop = self._get_dbus_property(interface_name, property_name)

824

if prop._dbus_access == "write":

598

if prop._dbus_access == u"write":

825

599

raise DBusPropertyAccessException(property_name)

826

600

value = prop()

827

if not hasattr(value, "variant_level"):

601

if not hasattr(value, u"variant_level"):

828

602

return value

829

603

return type(value)(value, variant_level=value.variant_level+1)

830

604

831

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

605

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

832

606

def Set(self, interface_name, property_name, value):

833

607

"""Standard D-Bus property Set() method, see D-Bus standard.

834

608

"""

835

609

prop = self._get_dbus_property(interface_name, property_name)

836

if prop._dbus_access == "read":

610

if prop._dbus_access == u"read":

837

611

raise DBusPropertyAccessException(property_name)

838

if prop._dbus_get_args_options["byte_arrays"]:

612

if prop._dbus_get_args_options[u"byte_arrays"]:

839

613

# The byte_arrays option is not supported yet on

840

614

# signatures other than "ay".

841

if prop._dbus_signature != "ay":

615

if prop._dbus_signature != u"ay":

842

616

raise ValueError

843

617

value = dbus.ByteArray(''.join(unichr(byte)

844

618

for byte in value))

845

619

prop(value)

846

620

847

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

848

out_signature="a{sv}")

621

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

622

out_signature=u"a{sv}")

849

623

def GetAll(self, interface_name):

850

624

"""Standard D-Bus property GetAll() method, see D-Bus

851

625

standard.

852

626

853

627

Note: Will not include properties with access="write".

854

628

"""

855

properties = {}

629

all = {}

856

630

for name, prop in self._get_all_dbus_properties():

857

631

if (interface_name

858

632

and interface_name != prop._dbus_interface):

859

633

# Interface non-empty but did not match

860

634

continue

861

635

# Ignore write-only properties

862

if prop._dbus_access == "write":

636

if prop._dbus_access == u"write":

863

637

continue

864

638

value = prop()

865

if not hasattr(value, "variant_level"):

866

properties[name] = value

639

if not hasattr(value, u"variant_level"):

640

all[name] = value

867

641

continue

868

properties[name] = type(value)(value, variant_level=

869

value.variant_level+1)

870

return dbus.Dictionary(properties, signature="sv")

642

all[name] = type(value)(value, variant_level=

643

value.variant_level+1)

644

return dbus.Dictionary(all, signature=u"sv")

871

645

872

646

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

873

out_signature="s",

647

out_signature=u"s",

874

648

path_keyword='object_path',

875

649

connection_keyword='connection')

876

650

def Introspect(self, object_path, connection):

881

655

try:

882

656

document = xml.dom.minidom.parseString(xmlstring)

883

657

def make_tag(document, name, prop):

884

e = document.createElement("property")

885

e.setAttribute("name", name)

886

e.setAttribute("type", prop._dbus_signature)

887

e.setAttribute("access", prop._dbus_access)

658

e = document.createElement(u"property")

659

e.setAttribute(u"name", name)

660

e.setAttribute(u"type", prop._dbus_signature)

661

e.setAttribute(u"access", prop._dbus_access)

888

662

return e

889

for if_tag in document.getElementsByTagName("interface"):

663

for if_tag in document.getElementsByTagName(u"interface"):

890

664

for tag in (make_tag(document, name, prop)

891

665

for name, prop

892

666

in self._get_all_dbus_properties()

893

667

if prop._dbus_interface

894

== if_tag.getAttribute("name")):

668

== if_tag.getAttribute(u"name")):

895

669

if_tag.appendChild(tag)

896

670

# Add the names to the return values for the

897

671

# "org.freedesktop.DBus.Properties" methods

898

if (if_tag.getAttribute("name")

899

== "org.freedesktop.DBus.Properties"):

900

for cn in if_tag.getElementsByTagName("method"):

901

if cn.getAttribute("name") == "Get":

902

for arg in cn.getElementsByTagName("arg"):

903

if (arg.getAttribute("direction")

904

== "out"):

905

arg.setAttribute("name", "value")

906

elif cn.getAttribute("name") == "GetAll":

907

for arg in cn.getElementsByTagName("arg"):

908

if (arg.getAttribute("direction")

909

== "out"):

910

arg.setAttribute("name", "props")

911

xmlstring = document.toxml("utf-8")

672

if (if_tag.getAttribute(u"name")

673

== u"org.freedesktop.DBus.Properties"):

674

for cn in if_tag.getElementsByTagName(u"method"):

675

if cn.getAttribute(u"name") == u"Get":

676

for arg in cn.getElementsByTagName(u"arg"):

677

if (arg.getAttribute(u"direction")

678

== u"out"):

679

arg.setAttribute(u"name", u"value")

680

elif cn.getAttribute(u"name") == u"GetAll":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"props")

685

xmlstring = document.toxml(u"utf-8")

912

686

document.unlink()

913

687

except (AttributeError, xml.dom.DOMException,

914

xml.parsers.expat.ExpatError) as error:

915

logger.error("Failed to override Introspection method",

688

xml.parsers.expat.ExpatError), error:

689

logger.error(u"Failed to override Introspection method",

916

690

error)

917

691

return xmlstring

918

692

919

693

920

def datetime_to_dbus (dt, variant_level=0):

921

"""Convert a UTC datetime.datetime() to a D-Bus type."""

922

if dt is None:

923

return dbus.String("", variant_level = variant_level)

924

return dbus.String(dt.isoformat(),

925

variant_level=variant_level)

926

927

928

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

929

.__metaclass__):

930

"""Applied to an empty subclass of a D-Bus object, this metaclass

931

will add additional D-Bus attributes matching a certain pattern.

932

"""

933

def __new__(mcs, name, bases, attr):

934

# Go through all the base classes which could have D-Bus

935

# methods, signals, or properties in them

936

for base in (b for b in bases

937

if issubclass(b, dbus.service.Object)):

938

# Go though all attributes of the base class

939

for attrname, attribute in inspect.getmembers(base):

940

# Ignore non-D-Bus attributes, and D-Bus attributes

941

# with the wrong interface name

942

if (not hasattr(attribute, "_dbus_interface")

943

or not attribute._dbus_interface

944

.startswith("se.recompile.Mandos")):

945

continue

946

# Create an alternate D-Bus interface name based on

947

# the current name

948

alt_interface = (attribute._dbus_interface

949

.replace("se.recompile.Mandos",

950

"se.bsnet.fukt.Mandos"))

951

# Is this a D-Bus signal?

952

if getattr(attribute, "_dbus_is_signal", False):

953

# Extract the original non-method function by

954

# black magic

955

nonmethod_func = (dict(

956

zip(attribute.func_code.co_freevars,

957

attribute.__closure__))["func"]

958

.cell_contents)

959

# Create a new, but exactly alike, function

960

# object, and decorate it to be a new D-Bus signal

961

# with the alternate D-Bus interface name

962

new_function = (dbus.service.signal

963

(alt_interface,

964

attribute._dbus_signature)

965

(types.FunctionType(

966

nonmethod_func.func_code,

967

nonmethod_func.func_globals,

968

nonmethod_func.func_name,

969

nonmethod_func.func_defaults,

970

nonmethod_func.func_closure)))

971

# Define a creator of a function to call both the

972

# old and new functions, so both the old and new

973

# signals gets sent when the function is called

974

def fixscope(func1, func2):

975

"""This function is a scope container to pass

976

func1 and func2 to the "call_both" function

977

outside of its arguments"""

978

def call_both(*args, **kwargs):

979

"""This function will emit two D-Bus

980

signals by calling func1 and func2"""

981

func1(*args, **kwargs)

982

func2(*args, **kwargs)

983

return call_both

984

# Create the "call_both" function and add it to

985

# the class

986

attr[attrname] = fixscope(attribute,

987

new_function)

988

# Is this a D-Bus method?

989

elif getattr(attribute, "_dbus_is_method", False):

990

# Create a new, but exactly alike, function

991

# object. Decorate it to be a new D-Bus method

992

# with the alternate D-Bus interface name. Add it

993

# to the class.

994

attr[attrname] = (dbus.service.method

995

(alt_interface,

996

attribute._dbus_in_signature,

997

attribute._dbus_out_signature)

998

(types.FunctionType

999

(attribute.func_code,

1000

attribute.func_globals,

1001

attribute.func_name,

1002

attribute.func_defaults,

1003

attribute.func_closure)))

1004

# Is this a D-Bus property?

1005

elif getattr(attribute, "_dbus_is_property", False):

1006

# Create a new, but exactly alike, function

1007

# object, and decorate it to be a new D-Bus

1008

# property with the alternate D-Bus interface

1009

# name. Add it to the class.

1010

attr[attrname] = (dbus_service_property

1011

(alt_interface,

1012

attribute._dbus_signature,

1013

attribute._dbus_access,

1014

attribute

1015

._dbus_get_args_options

1016

["byte_arrays"])

1017

(types.FunctionType

1018

(attribute.func_code,

1019

attribute.func_globals,

1020

attribute.func_name,

1021

attribute.func_defaults,

1022

attribute.func_closure)))

1023

return type.__new__(mcs, name, bases, attr)

1024

1025

1026

694

class ClientDBus(Client, DBusObjectWithProperties):

1027

695

"""A Client class using D-Bus

1028

696

1030

698

dbus_object_path: dbus.ObjectPath

1031

699

bus: dbus.SystemBus()

1032

700

"""

1033

1034

runtime_expansions = (Client.runtime_expansions

1035

+ ("dbus_object_path",))

1036

1037

701

# dbus.service.Object doesn't use super(), so we can't either.

1038

702

1039

703

def __init__(self, bus = None, *args, **kwargs):

704

self._approvals_pending = 0

1040

705

self.bus = bus

1041

706

Client.__init__(self, *args, **kwargs)

1042

self._approvals_pending = 0

1043

1044

self._approvals_pending = 0

1045

707

# Only now, when this client is initialized, can it show up on

1046

708

# the D-Bus

1047

client_object_name = unicode(self.name).translate(

1048

{ord("."): ord("_"),

1049

ord("-"): ord("_")})

1050

709

self.dbus_object_path = (dbus.ObjectPath

1051

("/clients/" + client_object_name))

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

1052

712

DBusObjectWithProperties.__init__(self, self.bus,

1053

713

self.dbus_object_path)

1054

1055

def notifychangeproperty(transform_func,

1056

dbus_name, type_func=lambda x: x,

1057

variant_level=1):

1058

""" Modify a variable so that it's a property which announces

1059

its changes to DBus.

1060

1061

transform_fun: Function that takes a value and a variant_level

1062

and transforms it to a D-Bus type.

1063

dbus_name: D-Bus name of the variable

1064

type_func: Function that transform the value before sending it

1065

to the D-Bus. Default: no transform

1066

variant_level: D-Bus variant level. Default: 1

1067

"""

1068

attrname = "_{0}".format(dbus_name)

1069

def setter(self, value):

1070

if hasattr(self, "dbus_object_path"):

1071

if (not hasattr(self, attrname) or

1072

type_func(getattr(self, attrname, None))

1073

!= type_func(value)):

1074

dbus_value = transform_func(type_func(value),

1075

variant_level

1076

=variant_level)

1077

self.PropertyChanged(dbus.String(dbus_name),

1078

dbus_value)

1079

setattr(self, attrname, value)

1080

1081

return property(lambda self: getattr(self, attrname), setter)

1082

1083

1084

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1085

approvals_pending = notifychangeproperty(dbus.Boolean,

1086

"ApprovalPending",

1087

type_func = bool)

1088

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1089

last_enabled = notifychangeproperty(datetime_to_dbus,

1090

"LastEnabled")

1091

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1092

type_func = lambda checker:

1093

checker is not None)

1094

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1095

"LastCheckedOK")

1096

last_approval_request = notifychangeproperty(

1097

datetime_to_dbus, "LastApprovalRequest")

1098

approved_by_default = notifychangeproperty(dbus.Boolean,

1099

"ApprovedByDefault")

1100

approval_delay = notifychangeproperty(dbus.UInt64,

1101

"ApprovalDelay",

1102

type_func =

1103

timedelta_to_milliseconds)

1104

approval_duration = notifychangeproperty(

1105

dbus.UInt64, "ApprovalDuration",

1106

type_func = timedelta_to_milliseconds)

1107

host = notifychangeproperty(dbus.String, "Host")

1108

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1109

type_func =

1110

timedelta_to_milliseconds)

1111

extended_timeout = notifychangeproperty(

1112

dbus.UInt64, "ExtendedTimeout",

1113

type_func = timedelta_to_milliseconds)

1114

interval = notifychangeproperty(dbus.UInt64,

1115

"Interval",

1116

type_func =

1117

timedelta_to_milliseconds)

1118

checker_command = notifychangeproperty(dbus.String, "Checker")

1119

1120

del notifychangeproperty

714

715

def _get_approvals_pending(self):

716

return self._approvals_pending

717

def _set_approvals_pending(self, value):

718

old_value = self._approvals_pending

719

self._approvals_pending = value

720

bval = bool(value)

721

if (hasattr(self, "dbus_object_path")

722

and bval is not bool(old_value)):

723

dbus_bool = dbus.Boolean(bval, variant_level=1)

724

self.PropertyChanged(dbus.String(u"approved_pending"),

725

dbus_bool)

726

727

approvals_pending = property(_get_approvals_pending,

728

_set_approvals_pending)

729

del _get_approvals_pending, _set_approvals_pending

730

731

@staticmethod

732

def _datetime_to_dbus(dt, variant_level=0):

733

"""Convert a UTC datetime.datetime() to a D-Bus type."""

734

return dbus.String(dt.isoformat(),

735

variant_level=variant_level)

736

737

def enable(self):

738

oldstate = getattr(self, u"enabled", False)

739

r = Client.enable(self)

740

if oldstate != self.enabled:

741

# Emit D-Bus signals

742

self.PropertyChanged(dbus.String(u"enabled"),

743

dbus.Boolean(True, variant_level=1))

744

self.PropertyChanged(

745

dbus.String(u"last_enabled"),

746

self._datetime_to_dbus(self.last_enabled,

747

variant_level=1))

748

return r

749

750

def disable(self, quiet = False):

751

oldstate = getattr(self, u"enabled", False)

752

r = Client.disable(self, quiet=quiet)

753

if not quiet and oldstate != self.enabled:

754

# Emit D-Bus signal

755

self.PropertyChanged(dbus.String(u"enabled"),

756

dbus.Boolean(False, variant_level=1))

757

return r

1121

758

1122

759

def __del__(self, *args, **kwargs):

1123

760

try:

1124

761

self.remove_from_connection()

1125

762

except LookupError:

1126

763

pass

1127

if hasattr(DBusObjectWithProperties, "__del__"):

764

if hasattr(DBusObjectWithProperties, u"__del__"):

1128

765

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1129

766

Client.__del__(self, *args, **kwargs)

1130

767

1132

769

*args, **kwargs):

1133

770

self.checker_callback_tag = None

1134

771

self.checker = None

772

# Emit D-Bus signal

773

self.PropertyChanged(dbus.String(u"checker_running"),

774

dbus.Boolean(False, variant_level=1))

1135

775

if os.WIFEXITED(condition):

1136

776

exitstatus = os.WEXITSTATUS(condition)

1137

777

# Emit D-Bus signal

1147

787

return Client.checker_callback(self, pid, condition, command,

1148

788

*args, **kwargs)

1149

789

790

def checked_ok(self, *args, **kwargs):

791

r = Client.checked_ok(self, *args, **kwargs)

792

# Emit D-Bus signal

793

self.PropertyChanged(

794

dbus.String(u"last_checked_ok"),

795

(self._datetime_to_dbus(self.last_checked_ok,

796

variant_level=1)))

797

return r

798

1150

799

def start_checker(self, *args, **kwargs):

1151

800

old_checker = self.checker

1152

801

if self.checker is not None:

1159

808

and old_checker_pid != self.checker.pid):

1160

809

# Emit D-Bus signal

1161

810

self.CheckerStarted(self.current_checker_command)

811

self.PropertyChanged(

812

dbus.String(u"checker_running"),

813

dbus.Boolean(True, variant_level=1))

1162

814

return r

1163

815

816

def stop_checker(self, *args, **kwargs):

817

old_checker = getattr(self, u"checker", None)

818

r = Client.stop_checker(self, *args, **kwargs)

819

if (old_checker is not None

820

and getattr(self, u"checker", None) is None):

821

self.PropertyChanged(dbus.String(u"checker_running"),

822

dbus.Boolean(False, variant_level=1))

823

return r

824

1164

825

def _reset_approved(self):

1165

self.approved = None

826

self._approved = None

1166

827

return False

1167

828

1168

829

def approve(self, value=True):

1169

830

self.send_changedstate()

1170

self.approved = value

1171

gobject.timeout_add(timedelta_to_milliseconds

1172

(self.approval_duration),

831

self._approved = value

832

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

1173

833

self._reset_approved)

1174

834

1175

835

1176

836

## D-Bus methods, signals & properties

1177

_interface = "se.recompile.Mandos.Client"

837

_interface = u"se.bsnet.fukt.Mandos.Client"

1178

838

1179

839

## Signals

1180

840

1181

841

# CheckerCompleted - signal

1182

@dbus.service.signal(_interface, signature="nxs")

842

@dbus.service.signal(_interface, signature=u"nxs")

1183

843

def CheckerCompleted(self, exitcode, waitstatus, command):

1184

844

"D-Bus signal"

1185

845

pass

1186

846

1187

847

# CheckerStarted - signal

1188

@dbus.service.signal(_interface, signature="s")

848

@dbus.service.signal(_interface, signature=u"s")

1189

849

def CheckerStarted(self, command):

1190

850

"D-Bus signal"

1191

851

pass

1192

852

1193

853

# PropertyChanged - signal

1194

@dbus.service.signal(_interface, signature="sv")

854

@dbus.service.signal(_interface, signature=u"sv")

1195

855

def PropertyChanged(self, property, value):

1196

856

"D-Bus signal"

1197

857

pass

1206

866

pass

1207

867

1208

868

# Rejected - signal

1209

@dbus.service.signal(_interface, signature="s")

869

@dbus.service.signal(_interface, signature=u"s")

1210

870

def Rejected(self, reason):

1211

871

"D-Bus signal"

1212

872

pass

1213

873

1214

874

# NeedApproval - signal

1215

@dbus.service.signal(_interface, signature="tb")

875

@dbus.service.signal(_interface, signature=u"db")

1216

876

def NeedApproval(self, timeout, default):

1217

877

"D-Bus signal"

1218

return self.need_approval()

1219

1220

# NeRwequest - signal

1221

@dbus.service.signal(_interface, signature="s")

1222

def NewRequest(self, ip):

1223

"""D-Bus signal

1224

Is sent after a client request a password.

1225

"""

1226

878

pass

1227

879

1228

880

## Methods

1229

881

1230

882

# Approve - method

1231

@dbus.service.method(_interface, in_signature="b")

883

@dbus.service.method(_interface, in_signature=u"b")

1232

884

def Approve(self, value):

1233

885

self.approve(value)

1234

886

1235

887

# CheckedOK - method

1236

888

@dbus.service.method(_interface)

1237

889

def CheckedOK(self):

1238

self.checked_ok()

890

return self.checked_ok()

1239

891

1240

892

# Enable - method

1241

893

@dbus.service.method(_interface)

1262

914

1263

915

## Properties

1264

916

1265

# ApprovalPending - property

1266

@dbus_service_property(_interface, signature="b", access="read")

1267

def ApprovalPending_dbus_property(self):

917

# approved_pending - property

918

@dbus_service_property(_interface, signature=u"b", access=u"read")

919

def approved_pending_dbus_property(self):

1268

920

return dbus.Boolean(bool(self.approvals_pending))

1269

921

1270

# ApprovedByDefault - property

1271

@dbus_service_property(_interface, signature="b",

1272

access="readwrite")

1273

def ApprovedByDefault_dbus_property(self, value=None):

1274

if value is None: # get

1275

return dbus.Boolean(self.approved_by_default)

1276

self.approved_by_default = bool(value)

1277

1278

# ApprovalDelay - property

1279

@dbus_service_property(_interface, signature="t",

1280

access="readwrite")

1281

def ApprovalDelay_dbus_property(self, value=None):

1282

if value is None: # get

1283

return dbus.UInt64(self.approval_delay_milliseconds())

1284

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1285

1286

# ApprovalDuration - property

1287

@dbus_service_property(_interface, signature="t",

1288

access="readwrite")

1289

def ApprovalDuration_dbus_property(self, value=None):

1290

if value is None: # get

1291

return dbus.UInt64(timedelta_to_milliseconds(

1292

self.approval_duration))

1293

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1294

1295

# Name - property

1296

@dbus_service_property(_interface, signature="s", access="read")

1297

def Name_dbus_property(self):

922

# approved_by_default - property

923

@dbus_service_property(_interface, signature=u"b",

924

access=u"readwrite")

925

def approved_by_default_dbus_property(self):

926

return dbus.Boolean(self.approved_by_default)

927

928

# approved_delay - property

929

@dbus_service_property(_interface, signature=u"t",

930

access=u"readwrite")

931

def approved_delay_dbus_property(self):

932

return dbus.UInt64(self.approved_delay_milliseconds())

933

934

# approved_duration - property

935

@dbus_service_property(_interface, signature=u"t",

936

access=u"readwrite")

937

def approved_duration_dbus_property(self):

938

return dbus.UInt64(self._timedelta_to_milliseconds(

939

self.approved_duration))

940

941

# name - property

942

@dbus_service_property(_interface, signature=u"s", access=u"read")

943

def name_dbus_property(self):

1298

944

return dbus.String(self.name)

1299

945

1300

# Fingerprint - property

1301

@dbus_service_property(_interface, signature="s", access="read")

1302

def Fingerprint_dbus_property(self):

946

# fingerprint - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def fingerprint_dbus_property(self):

1303

949

return dbus.String(self.fingerprint)

1304

950

1305

# Host - property

1306

@dbus_service_property(_interface, signature="s",

1307

access="readwrite")

1308

def Host_dbus_property(self, value=None):

951

# host - property

952

@dbus_service_property(_interface, signature=u"s",

953

access=u"readwrite")

954

def host_dbus_property(self, value=None):

1309

955

if value is None: # get

1310

956

return dbus.String(self.host)

1311

self.host = unicode(value)

1312

1313

# Created - property

1314

@dbus_service_property(_interface, signature="s", access="read")

1315

def Created_dbus_property(self):

1316

return datetime_to_dbus(self.created)

1317

1318

# LastEnabled - property

1319

@dbus_service_property(_interface, signature="s", access="read")

1320

def LastEnabled_dbus_property(self):

1321

return datetime_to_dbus(self.last_enabled)

1322

1323

# Enabled - property

1324

@dbus_service_property(_interface, signature="b",

1325

access="readwrite")

1326

def Enabled_dbus_property(self, value=None):

957

self.host = value

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"host"),

960

dbus.String(value, variant_level=1))

961

962

# created - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

964

def created_dbus_property(self):

965

return dbus.String(self._datetime_to_dbus(self.created))

966

967

# last_enabled - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def last_enabled_dbus_property(self):

970

if self.last_enabled is None:

971

return dbus.String(u"")

972

return dbus.String(self._datetime_to_dbus(self.last_enabled))

973

974

# enabled - property

975

@dbus_service_property(_interface, signature=u"b",

976

access=u"readwrite")

977

def enabled_dbus_property(self, value=None):

1327

978

if value is None: # get

1328

979

return dbus.Boolean(self.enabled)

1329

980

if value:

1331

982

else:

1332

983

self.disable()

1333

984

1334

# LastCheckedOK - property

1335

@dbus_service_property(_interface, signature="s",

1336

access="readwrite")

1337

def LastCheckedOK_dbus_property(self, value=None):

985

# last_checked_ok - property

986

@dbus_service_property(_interface, signature=u"s",

987

access=u"readwrite")

988

def last_checked_ok_dbus_property(self, value=None):

1338

989

if value is not None:

1339

990

self.checked_ok()

1340

991

return

1341

return datetime_to_dbus(self.last_checked_ok)

1342

1343

# Expires - property

1344

@dbus_service_property(_interface, signature="s", access="read")

1345

def Expires_dbus_property(self):

1346

return datetime_to_dbus(self.expires)

1347

1348

# LastApprovalRequest - property

1349

@dbus_service_property(_interface, signature="s", access="read")

1350

def LastApprovalRequest_dbus_property(self):

1351

return datetime_to_dbus(self.last_approval_request)

1352

1353

# Timeout - property

1354

@dbus_service_property(_interface, signature="t",

1355

access="readwrite")

1356

def Timeout_dbus_property(self, value=None):

992

if self.last_checked_ok is None:

993

return dbus.String(u"")

994

return dbus.String(self._datetime_to_dbus(self

995

.last_checked_ok))

996

997

# timeout - property

998

@dbus_service_property(_interface, signature=u"t",

999

access=u"readwrite")

1000

def timeout_dbus_property(self, value=None):

1357

1001

if value is None: # get

1358

1002

return dbus.UInt64(self.timeout_milliseconds())

1359

1003

self.timeout = datetime.timedelta(0, 0, 0, value)

1360

if getattr(self, "disable_initiator_tag", None) is None:

1004

# Emit D-Bus signal

1005

self.PropertyChanged(dbus.String(u"timeout"),

1006

dbus.UInt64(value, variant_level=1))

1007

if getattr(self, u"disable_initiator_tag", None) is None:

1361

1008

return

1362

1009

# Reschedule timeout

1363

1010

gobject.source_remove(self.disable_initiator_tag)

1364

1011

self.disable_initiator_tag = None

1365

self.expires = None

1366

time_to_die = timedelta_to_milliseconds((self

1367

.last_checked_ok

1368

+ self.timeout)

1369

- datetime.datetime

1370

.utcnow())

1012

time_to_die = (self.

1013

_timedelta_to_milliseconds((self

1014

.last_checked_ok

1015

+ self.timeout)

1016

- datetime.datetime

1017

.utcnow()))

1371

1018

if time_to_die <= 0:

1372

1019

# The timeout has passed

1373

1020

self.disable()

1374

1021

else:

1375

self.expires = (datetime.datetime.utcnow()

1376

+ datetime.timedelta(milliseconds =

1377

time_to_die))

1378

1022

self.disable_initiator_tag = (gobject.timeout_add

1379

1023

(time_to_die, self.disable))

1380

1024

1381

# ExtendedTimeout - property

1382

@dbus_service_property(_interface, signature="t",

1383

access="readwrite")

1384

def ExtendedTimeout_dbus_property(self, value=None):

1385

if value is None: # get

1386

return dbus.UInt64(self.extended_timeout_milliseconds())

1387

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1388

1389

# Interval - property

1390

@dbus_service_property(_interface, signature="t",

1391

access="readwrite")

1392

def Interval_dbus_property(self, value=None):

1025

# interval - property

1026

@dbus_service_property(_interface, signature=u"t",

1027

access=u"readwrite")

1028

def interval_dbus_property(self, value=None):

1393

1029

if value is None: # get

1394

1030

return dbus.UInt64(self.interval_milliseconds())

1395

1031

self.interval = datetime.timedelta(0, 0, 0, value)

1396

if getattr(self, "checker_initiator_tag", None) is None:

1032

# Emit D-Bus signal

1033

self.PropertyChanged(dbus.String(u"interval"),

1034

dbus.UInt64(value, variant_level=1))

1035

if getattr(self, u"checker_initiator_tag", None) is None:

1397

1036

return

1398

if self.enabled:

1399

# Reschedule checker run

1400

gobject.source_remove(self.checker_initiator_tag)

1401

self.checker_initiator_tag = (gobject.timeout_add

1402

(value, self.start_checker))

1403

self.start_checker() # Start one now, too

1404

1405

# Checker - property

1406

@dbus_service_property(_interface, signature="s",

1407

access="readwrite")

1408

def Checker_dbus_property(self, value=None):

1037

# Reschedule checker run

1038

gobject.source_remove(self.checker_initiator_tag)

1039

self.checker_initiator_tag = (gobject.timeout_add

1040

(value, self.start_checker))

1041

self.start_checker() # Start one now, too

1042

1043

# checker - property

1044

@dbus_service_property(_interface, signature=u"s",

1045

access=u"readwrite")

1046

def checker_dbus_property(self, value=None):

1409

1047

if value is None: # get

1410

1048

return dbus.String(self.checker_command)

1411

self.checker_command = unicode(value)

1049

self.checker_command = value

1050

# Emit D-Bus signal

1051

self.PropertyChanged(dbus.String(u"checker"),

1052

dbus.String(self.checker_command,

1053

variant_level=1))

1412

1054

1413

# CheckerRunning - property

1414

@dbus_service_property(_interface, signature="b",

1415

access="readwrite")

1416

def CheckerRunning_dbus_property(self, value=None):

1055

# checker_running - property

1056

@dbus_service_property(_interface, signature=u"b",

1057

access=u"readwrite")

1058

def checker_running_dbus_property(self, value=None):

1417

1059

if value is None: # get

1418

1060

return dbus.Boolean(self.checker is not None)

1419

1061

if value:

1421

1063

else:

1422

1064

self.stop_checker()

1423

1065

1424

# ObjectPath - property

1425

@dbus_service_property(_interface, signature="o", access="read")

1426

def ObjectPath_dbus_property(self):

1066

# object_path - property

1067

@dbus_service_property(_interface, signature=u"o", access=u"read")

1068

def object_path_dbus_property(self):

1427

1069

return self.dbus_object_path # is already a dbus.ObjectPath

1428

1070

1429

# Secret = property

1430

@dbus_service_property(_interface, signature="ay",

1431

access="write", byte_arrays=True)

1432

def Secret_dbus_property(self, value):

1071

# secret = property

1072

@dbus_service_property(_interface, signature=u"ay",

1073

access=u"write", byte_arrays=True)

1074

def secret_dbus_property(self, value):

1433

1075

self.secret = str(value)

1434

1076

1435

1077

del _interface

1441

1083

self._pipe.send(('init', fpr, address))

1442

1084

if not self._pipe.recv():

1443

1085

raise KeyError()

1444

1086

1445

1087

def __getattribute__(self, name):

1446

if name == '_pipe':

1088

if(name == '_pipe'):

1447

1089

return super(ProxyClient, self).__getattribute__(name)

1448

1090

self._pipe.send(('getattr', name))

1449

1091

data = self._pipe.recv()

1454

1096

self._pipe.send(('funcall', name, args, kwargs))

1455

1097

return self._pipe.recv()[1]

1456

1098

return func

1457

1099

1458

1100

def __setattr__(self, name, value):

1459

if name == '_pipe':

1101

if(name == '_pipe'):

1460

1102

return super(ProxyClient, self).__setattr__(name, value)

1461

1103

self._pipe.send(('setattr', name, value))

1462

1104

1463

1105

1464

class ClientDBusTransitional(ClientDBus):

1465

__metaclass__ = AlternateDBusNamesMetaclass

1466

1467

1468

1106

class ClientHandler(socketserver.BaseRequestHandler, object):

1469

1107

"""A class to handle client connections.

1470

1108

1473

1111

1474

1112

def handle(self):

1475

1113

with contextlib.closing(self.server.child_pipe) as child_pipe:

1476

logger.info("TCP connection from: %s",

1114

logger.info(u"TCP connection from: %s",

1477

1115

unicode(self.client_address))

1478

logger.debug("Pipe FD: %d",

1116

logger.debug(u"Pipe FD: %d",

1479

1117

self.server.child_pipe.fileno())

1480

1118

1481

1119

session = (gnutls.connection

1482

1120

.ClientSession(self.request,

1483

1121

gnutls.connection

1484

1122

.X509Credentials()))

1485

1123

1486

1124

# Note: gnutls.connection.X509Credentials is really a

1487

1125

# generic GnuTLS certificate credentials object so long as

1488

1126

# no X.509 keys are added to it. Therefore, we can use it

1489

1127

# here despite using OpenPGP certificates.

1490

1491

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1492

# "+AES-256-CBC", "+SHA1",

1493

# "+COMP-NULL", "+CTYPE-OPENPGP",

1494

# "+DHE-DSS"))

1128

1129

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1130

# u"+AES-256-CBC", u"+SHA1",

1131

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1132

# u"+DHE-DSS"))

1495

1133

# Use a fallback default, since this MUST be set.

1496

1134

priority = self.server.gnutls_priority

1497

1135

if priority is None:

1498

priority = "NORMAL"

1136

priority = u"NORMAL"

1499

1137

(gnutls.library.functions

1500

1138

.gnutls_priority_set_direct(session._c_object,

1501

1139

priority, None))

1502

1140

1503

1141

# Start communication using the Mandos protocol

1504

1142

# Get protocol number

1505

1143

line = self.request.makefile().readline()

1506

logger.debug("Protocol version: %r", line)

1144

logger.debug(u"Protocol version: %r", line)

1507

1145

try:

1508

1146

if int(line.strip().split()[0]) > 1:

1509

1147

raise RuntimeError

1510

except (ValueError, IndexError, RuntimeError) as error:

1511

logger.error("Unknown protocol version: %s", error)

1148

except (ValueError, IndexError, RuntimeError), error:

1149

logger.error(u"Unknown protocol version: %s", error)

1512

1150

return

1513

1151

1514

1152

# Start GnuTLS connection

1515

1153

try:

1516

1154

session.handshake()

1517

except gnutls.errors.GNUTLSError as error:

1518

logger.warning("Handshake failed: %s", error)

1155

except gnutls.errors.GNUTLSError, error:

1156

logger.warning(u"Handshake failed: %s", error)

1519

1157

# Do not run session.bye() here: the session is not

1520

1158

# established. Just abandon the request.

1521

1159

return

1522

logger.debug("Handshake succeeded")

1523

1160

logger.debug(u"Handshake succeeded")

1161

1524

1162

approval_required = False

1525

1163

try:

1526

1164

try:

1527

1165

fpr = self.fingerprint(self.peer_certificate

1528

1166

(session))

1529

except (TypeError,

1530

gnutls.errors.GNUTLSError) as error:

1531

logger.warning("Bad certificate: %s", error)

1167

except (TypeError, gnutls.errors.GNUTLSError), error:

1168

logger.warning(u"Bad certificate: %s", error)

1532

1169

return

1533

logger.debug("Fingerprint: %s", fpr)

1534

1170

logger.debug(u"Fingerprint: %s", fpr)

1171

1535

1172

try:

1536

1173

client = ProxyClient(child_pipe, fpr,

1537

1174

self.client_address)

1538

1175

except KeyError:

1539

1176

return

1540

1177

1541

if self.server.use_dbus:

1542

# Emit D-Bus signal

1543

client.NewRequest(str(self.client_address))

1544

1545

if client.approval_delay:

1546

delay = client.approval_delay

1178

if client.approved_delay:

1179

delay = client.approved_delay

1547

1180

client.approvals_pending += 1

1548

1181

approval_required = True

1549

1182

1550

1183

while True:

1551

1184

if not client.enabled:

1552

logger.info("Client %s is disabled",

1185

logger.warning(u"Client %s is disabled",

1553

1186

client.name)

1554

1187

if self.server.use_dbus:

1555

1188

# Emit D-Bus signal

1556

client.Rejected("Disabled")

1189

client.Rejected("Disabled")

1557

1190

return

1558

1191

1559

if client.approved or not client.approval_delay:

1192

if client._approved or not client.approved_delay:

1560

1193

#We are approved or approval is disabled

1561

1194

break

1562

elif client.approved is None:

1563

logger.info("Client %s needs approval",

1195

elif client._approved is None:

1196

logger.info(u"Client %s need approval",

1564

1197

client.name)

1565

1198

if self.server.use_dbus:

1566

1199

# Emit D-Bus signal

1567

1200

client.NeedApproval(

1568

client.approval_delay_milliseconds(),

1201

client.approved_delay_milliseconds(),

1569

1202

client.approved_by_default)

1570

1203

else:

1571

logger.warning("Client %s was not approved",

1204

logger.warning(u"Client %s was not approved",

1572

1205

client.name)

1573

1206

if self.server.use_dbus:

1574

1207

# Emit D-Bus signal

1575

client.Rejected("Denied")

1208

client.Rejected("Disapproved")

1576

1209

return

1577

1210

1578

1211

#wait until timeout or approved

1212

#x = float(client._timedelta_to_milliseconds(delay))

1579

1213

time = datetime.datetime.now()

1580

1214

client.changedstate.acquire()

1581

(client.changedstate.wait

1582

(float(client.timedelta_to_milliseconds(delay)

1583

/ 1000)))

1215

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1584

1216

client.changedstate.release()

1585

1217

time2 = datetime.datetime.now()

1586

1218

if (time2 - time) >= delay:

1590

1222

client.name)

1591

1223

if self.server.use_dbus:

1592

1224

# Emit D-Bus signal

1593

client.Rejected("Approval timed out")

1225

client.Rejected("Time out")

1594

1226

return

1595

1227

else:

1596

1228

break

1601

1233

while sent_size < len(client.secret):

1602

1234

try:

1603

1235

sent = session.send(client.secret[sent_size:])

1604

except gnutls.errors.GNUTLSError as error:

1236

except (gnutls.errors.GNUTLSError), error:

1605

1237

logger.warning("gnutls send failed")

1606

1238

return

1607

logger.debug("Sent: %d, remaining: %d",

1239

logger.debug(u"Sent: %d, remaining: %d",

1608

1240

sent, len(client.secret)

1609

1241

- (sent_size + sent))

1610

1242

sent_size += sent

1611

1612

logger.info("Sending secret to %s", client.name)

1613

# bump the timeout using extended_timeout

1614

client.checked_ok(client.extended_timeout)

1243

1244

logger.info(u"Sending secret to %s", client.name)

1245

# bump the timeout as if seen

1246

client.checked_ok()

1615

1247

if self.server.use_dbus:

1616

1248

# Emit D-Bus signal

1617

1249

client.GotSecret()

1621

1253

client.approvals_pending -= 1

1622

1254

try:

1623

1255

session.bye()

1624

except gnutls.errors.GNUTLSError as error:

1625

logger.warning("GnuTLS bye failed")

1256

except (gnutls.errors.GNUTLSError), error:

1257

logger.warning("gnutls bye failed")

1626

1258

1627

1259

@staticmethod

1628

1260

def peer_certificate(session):

1638

1270

.gnutls_certificate_get_peers

1639

1271

(session._c_object, ctypes.byref(list_size)))

1640

1272

if not bool(cert_list) and list_size.value != 0:

1641

raise gnutls.errors.GNUTLSError("error getting peer"

1642

" certificate")

1273

raise gnutls.errors.GNUTLSError(u"error getting peer"

1274

u" certificate")

1643

1275

if list_size.value == 0:

1644

1276

return None

1645

1277

cert = cert_list[0]

1671

1303

if crtverify.value != 0:

1672

1304

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1673

1305

raise (gnutls.errors.CertificateSecurityError

1674

("Verify failed"))

1306

(u"Verify failed"))

1675

1307

# New buffer for the fingerprint

1676

1308

buf = ctypes.create_string_buffer(20)

1677

1309

buf_len = ctypes.c_size_t()

1684

1316

# Convert the buffer to a Python bytestring

1685

1317

fpr = ctypes.string_at(buf, buf_len.value)

1686

1318

# Convert the bytestring to hexadecimal notation

1687

hex_fpr = binascii.hexlify(fpr).upper()

1319

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1688

1320

return hex_fpr

1689

1321

1690

1322

1693

1325

def sub_process_main(self, request, address):

1694

1326

try:

1695

1327

self.finish_request(request, address)

1696

except Exception:

1328

except:

1697

1329

self.handle_error(request, address)

1698

1330

self.close_request(request)

1699

1331

1700

1332

def process_request(self, request, address):

1701

1333

"""Start a new process to process the request."""

1702

proc = multiprocessing.Process(target = self.sub_process_main,

1703

args = (request,

1704

address))

1705

proc.start()

1706

return proc

1707

1334

multiprocessing.Process(target = self.sub_process_main,

1335

args = (request, address)).start()

1708

1336

1709

1337

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1710

1338

""" adds a pipe to the MixIn """

1714

1342

This function creates a new pipe in self.pipe

1715

1343

"""

1716

1344

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1717

1718

proc = MultiprocessingMixIn.process_request(self, request,

1719

client_address)

1345

1346

super(MultiprocessingMixInWithPipe,

1347

self).process_request(request, client_address)

1720

1348

self.child_pipe.close()

1721

self.add_pipe(parent_pipe, proc)

1722

1723

def add_pipe(self, parent_pipe, proc):

1349

self.add_pipe(parent_pipe)

1350

1351

def add_pipe(self, parent_pipe):

1724

1352

"""Dummy function; override as necessary"""

1725

raise NotImplementedError

1726

1353

pass

1727

1354

1728

1355

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1729

1356

socketserver.TCPServer, object):

1747

1374

bind to an address or port if they were not specified."""

1748

1375

if self.interface is not None:

1749

1376

if SO_BINDTODEVICE is None:

1750

logger.error("SO_BINDTODEVICE does not exist;"

1751

" cannot bind to interface %s",

1377

logger.error(u"SO_BINDTODEVICE does not exist;"

1378

u" cannot bind to interface %s",

1752

1379

self.interface)

1753

1380

else:

1754

1381

try:

1755

1382

self.socket.setsockopt(socket.SOL_SOCKET,

1756

1383

SO_BINDTODEVICE,

1757

1384

str(self.interface

1758

+ '\0'))

1759

except socket.error as error:

1385

+ u'\0'))

1386

except socket.error, error:

1760

1387

if error[0] == errno.EPERM:

1761

logger.error("No permission to"

1762

" bind to interface %s",

1388

logger.error(u"No permission to"

1389

u" bind to interface %s",

1763

1390

self.interface)

1764

1391

elif error[0] == errno.ENOPROTOOPT:

1765

logger.error("SO_BINDTODEVICE not available;"

1766

" cannot bind to interface %s",

1392

logger.error(u"SO_BINDTODEVICE not available;"

1393

u" cannot bind to interface %s",

1767

1394

self.interface)

1768

1395

else:

1769

1396

raise

1771

1398

if self.server_address[0] or self.server_address[1]:

1772

1399

if not self.server_address[0]:

1773

1400

if self.address_family == socket.AF_INET6:

1774

any_address = "::" # in6addr_any

1401

any_address = u"::" # in6addr_any

1775

1402

else:

1776

1403

any_address = socket.INADDR_ANY

1777

1404

self.server_address = (any_address,

1804

1431

self.enabled = False

1805

1432

self.clients = clients

1806

1433

if self.clients is None:

1807

self.clients = {}

1434

self.clients = set()

1808

1435

self.use_dbus = use_dbus

1809

1436

self.gnutls_priority = gnutls_priority

1810

1437

IPv6_TCPServer.__init__(self, server_address,

1814

1441

def server_activate(self):

1815

1442

if self.enabled:

1816

1443

return socketserver.TCPServer.server_activate(self)

1817

1818

1444

def enable(self):

1819

1445

self.enabled = True

1820

1821

def add_pipe(self, parent_pipe, proc):

1446

def add_pipe(self, parent_pipe):

1822

1447

# Call "handle_ipc" for both data and EOF events

1823

1448

gobject.io_add_watch(parent_pipe.fileno(),

1824

1449

gobject.IO_IN | gobject.IO_HUP,

1825

1450

functools.partial(self.handle_ipc,

1826

parent_pipe =

1827

parent_pipe,

1828

proc = proc))

1829

1451

parent_pipe = parent_pipe))

1452

1830

1453

def handle_ipc(self, source, condition, parent_pipe=None,

1831

proc = None, client_object=None):

1454

client_object=None):

1832

1455

condition_names = {

1833

gobject.IO_IN: "IN", # There is data to read.

1834

gobject.IO_OUT: "OUT", # Data can be written (without

1456

gobject.IO_IN: u"IN", # There is data to read.

1457

gobject.IO_OUT: u"OUT", # Data can be written (without

1835

1458

# blocking).

1836

gobject.IO_PRI: "PRI", # There is urgent data to read.

1837

gobject.IO_ERR: "ERR", # Error condition.

1838

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1459

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1460

gobject.IO_ERR: u"ERR", # Error condition.

1461

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1839

1462

# broken, usually for pipes and

1840

1463

# sockets).

1841

1464

}

1843

1466

for cond, name in

1844

1467

condition_names.iteritems()

1845

1468

if cond & condition)

1846

# error, or the other end of multiprocessing.Pipe has closed

1469

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1470

conditions_string)

1471

1472

# error or the other end of multiprocessing.Pipe has closed

1847

1473

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1848

# Wait for other process to exit

1849

proc.join()

1850

1474

return False

1851

1475

1852

1476

# Read a request from the child

1853

1477

request = parent_pipe.recv()

1478

logger.debug(u"IPC request: %s", repr(request))

1854

1479

command = request[0]

1855

1480

1856

1481

if command == 'init':

1857

1482

fpr = request[1]

1858

1483

address = request[2]

1859

1484

1860

for c in self.clients.itervalues():

1485

for c in self.clients:

1861

1486

if c.fingerprint == fpr:

1862

1487

client = c

1863

1488

break

1864

1489

else:

1865

logger.info("Client not found for fingerprint: %s, ad"

1866

"dress: %s", fpr, address)

1490

logger.warning(u"Client not found for fingerprint: %s, ad"

1491

u"dress: %s", fpr, address)

1867

1492

if self.use_dbus:

1868

1493

# Emit D-Bus signal

1869

mandos_dbus_service.ClientNotFound(fpr,

1870

address[0])

1494

mandos_dbus_service.ClientNotFound(fpr, address)

1871

1495

parent_pipe.send(False)

1872

1496

return False

1873

1497

1874

1498

gobject.io_add_watch(parent_pipe.fileno(),

1875

1499

gobject.IO_IN | gobject.IO_HUP,

1876

1500

functools.partial(self.handle_ipc,

1877

parent_pipe =

1878

parent_pipe,

1879

proc = proc,

1880

client_object =

1881

client))

1501

parent_pipe = parent_pipe,

1502

client_object = client))

1882

1503

parent_pipe.send(True)

1883

# remove the old hook in favor of the new above hook on

1884

# same fileno

1504

# remove the old hook in favor of the new above hook on same fileno

1885

1505

return False

1886

1506

if command == 'funcall':

1887

1507

funcname = request[1]

1888

1508

args = request[2]

1889

1509

kwargs = request[3]

1890

1510

1891

parent_pipe.send(('data', getattr(client_object,

1892

funcname)(*args,

1893

**kwargs)))

1894

1511

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1512

1895

1513

if command == 'getattr':

1896

1514

attrname = request[1]

1897

1515

if callable(client_object.__getattribute__(attrname)):

1898

1516

parent_pipe.send(('function',))

1899

1517

else:

1900

parent_pipe.send(('data', client_object

1901

.__getattribute__(attrname)))

1518

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1902

1519

1903

1520

if command == 'setattr':

1904

1521

attrname = request[1]

1905

1522

value = request[2]

1906

1523

setattr(client_object, attrname, value)

1907

1524

1908

1525

return True

1909

1526

1910

1527

1911

1528

def string_to_delta(interval):

1912

1529

"""Parse a string and return a datetime.timedelta

1913

1530

1914

>>> string_to_delta('7d')

1531

>>> string_to_delta(u'7d')

1915

1532

datetime.timedelta(7)

1916

>>> string_to_delta('60s')

1533

>>> string_to_delta(u'60s')

1917

1534

datetime.timedelta(0, 60)

1918

>>> string_to_delta('60m')

1535

>>> string_to_delta(u'60m')

1919

1536

datetime.timedelta(0, 3600)

1920

>>> string_to_delta('24h')

1537

>>> string_to_delta(u'24h')

1921

1538

datetime.timedelta(1)

1922

>>> string_to_delta('1w')

1539

>>> string_to_delta(u'1w')

1923

1540

datetime.timedelta(7)

1924

>>> string_to_delta('5m 30s')

1541

>>> string_to_delta(u'5m 30s')

1925

1542

datetime.timedelta(0, 330)

1926

1543

"""

1927

1544

timevalue = datetime.timedelta(0)

1929

1546

try:

1930

1547

suffix = unicode(s[-1])

1931

1548

value = int(s[:-1])

1932

if suffix == "d":

1549

if suffix == u"d":

1933

1550

delta = datetime.timedelta(value)

1934

elif suffix == "s":

1551

elif suffix == u"s":

1935

1552

delta = datetime.timedelta(0, value)

1936

elif suffix == "m":

1553

elif suffix == u"m":

1937

1554

delta = datetime.timedelta(0, 0, 0, 0, value)

1938

elif suffix == "h":

1555

elif suffix == u"h":

1939

1556

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1940

elif suffix == "w":

1557

elif suffix == u"w":

1941

1558

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1942

1559

else:

1943

raise ValueError("Unknown suffix %r" % suffix)

1944

except (ValueError, IndexError) as e:

1945

raise ValueError(*(e.args))

1560

raise ValueError(u"Unknown suffix %r" % suffix)

1561

except (ValueError, IndexError), e:

1562

raise ValueError(e.message)

1946

1563

timevalue += delta

1947

1564

return timevalue

1948

1565

1949

1566

1567

def if_nametoindex(interface):

1568

"""Call the C function if_nametoindex(), or equivalent

1569

1570

Note: This function cannot accept a unicode string."""

1571

global if_nametoindex

1572

try:

1573

if_nametoindex = (ctypes.cdll.LoadLibrary

1574

(ctypes.util.find_library(u"c"))

1575

.if_nametoindex)

1576

except (OSError, AttributeError):

1577

logger.warning(u"Doing if_nametoindex the hard way")

1578

def if_nametoindex(interface):

1579

"Get an interface index the hard way, i.e. using fcntl()"

1580

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1581

with contextlib.closing(socket.socket()) as s:

1582

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1583

struct.pack(str(u"16s16x"),

1584

interface))

1585

interface_index = struct.unpack(str(u"I"),

1586

ifreq[16:20])[0]

1587

return interface_index

1588

return if_nametoindex(interface)

1589

1590

1950

1591

def daemon(nochdir = False, noclose = False):

1951

1592

"""See daemon(3). Standard BSD Unix function.

1952

1593

1955

1596

sys.exit()

1956

1597

os.setsid()

1957

1598

if not nochdir:

1958

os.chdir("/")

1599

os.chdir(u"/")

1959

1600

if os.fork():

1960

1601

sys.exit()

1961

1602

if not noclose:

1963

1604

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1964

1605

if not stat.S_ISCHR(os.fstat(null).st_mode):

1965

1606

raise OSError(errno.ENODEV,

1966

"%s not a character device"

1607

u"%s not a character device"

1967

1608

% os.path.devnull)

1968

1609

os.dup2(null, sys.stdin.fileno())

1969

1610

os.dup2(null, sys.stdout.fileno())

1977

1618

##################################################################

1978

1619

# Parsing of options, both command line and config file

1979

1620

1980

parser = argparse.ArgumentParser()

1981

parser.add_argument("-v", "--version", action="version",

1982

version = "%%(prog)s %s" % version,

1983

help="show version number and exit")

1984

parser.add_argument("-i", "--interface", metavar="IF",

1985

help="Bind to interface IF")

1986

parser.add_argument("-a", "--address",

1987

help="Address to listen for requests on")

1988

parser.add_argument("-p", "--port", type=int,

1989

help="Port number to receive requests on")

1990

parser.add_argument("--check", action="store_true",

1991

help="Run self-test")

1992

parser.add_argument("--debug", action="store_true",

1993

help="Debug mode; run in foreground and log"

1994

" to terminal")

1995

parser.add_argument("--debuglevel", metavar="LEVEL",

1996

help="Debug level for stdout output")

1997

parser.add_argument("--priority", help="GnuTLS"

1998

" priority string (see GnuTLS documentation)")

1999

parser.add_argument("--servicename",

2000

metavar="NAME", help="Zeroconf service name")

2001

parser.add_argument("--configdir",

2002

default="/etc/mandos", metavar="DIR",

2003

help="Directory to search for configuration"

2004

" files")

2005

parser.add_argument("--no-dbus", action="store_false",

2006

dest="use_dbus", help="Do not provide D-Bus"

2007

" system bus interface")

2008

parser.add_argument("--no-ipv6", action="store_false",

2009

dest="use_ipv6", help="Do not use IPv6")

2010

parser.add_argument("--no-restore", action="store_false",

2011

dest="restore", help="Do not restore stored"

2012

" state")

2013

parser.add_argument("--statedir", metavar="DIR",

2014

help="Directory to save/restore state in")

2015

2016

options = parser.parse_args()

1621

parser = optparse.OptionParser(version = "%%prog %s" % version)

1622

parser.add_option("-i", u"--interface", type=u"string",

1623

metavar="IF", help=u"Bind to interface IF")

1624

parser.add_option("-a", u"--address", type=u"string",

1625

help=u"Address to listen for requests on")

1626

parser.add_option("-p", u"--port", type=u"int",

1627

help=u"Port number to receive requests on")

1628

parser.add_option("--check", action=u"store_true",

1629

help=u"Run self-test")

1630

parser.add_option("--debug", action=u"store_true",

1631

help=u"Debug mode; run in foreground and log to"

1632

u" terminal")

1633

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1634

help=u"Debug level for stdout output")

1635

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1636

u" priority string (see GnuTLS documentation)")

1637

parser.add_option("--servicename", type=u"string",

1638

metavar=u"NAME", help=u"Zeroconf service name")

1639

parser.add_option("--configdir", type=u"string",

1640

default=u"/etc/mandos", metavar=u"DIR",

1641

help=u"Directory to search for configuration"

1642

u" files")

1643

parser.add_option("--no-dbus", action=u"store_false",

1644

dest=u"use_dbus", help=u"Do not provide D-Bus"

1645

u" system bus interface")

1646

parser.add_option("--no-ipv6", action=u"store_false",

1647

dest=u"use_ipv6", help=u"Do not use IPv6")

1648

options = parser.parse_args()[0]

2017

1649

2018

1650

if options.check:

2019

1651

import doctest

2021

1653

sys.exit()

2022

1654

2023

1655

# Default values for config file for server-global settings

2024

server_defaults = { "interface": "",

2025

"address": "",

2026

"port": "",

2027

"debug": "False",

2028

"priority":

2029

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2030

"servicename": "Mandos",

2031

"use_dbus": "True",

2032

"use_ipv6": "True",

2033

"debuglevel": "",

2034

"restore": "True",

2035

"statedir": "/var/lib/mandos"

1656

server_defaults = { u"interface": u"",

1657

u"address": u"",

1658

u"port": u"",

1659

u"debug": u"False",

1660

u"priority":

1661

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1662

u"servicename": u"Mandos",

1663

u"use_dbus": u"True",

1664

u"use_ipv6": u"True",

1665

u"debuglevel": u"",

2036

1666

}

2037

1667

2038

1668

# Parse config file for server-global settings

2039

1669

server_config = configparser.SafeConfigParser(server_defaults)

2040

1670

del server_defaults

2041

1671

server_config.read(os.path.join(options.configdir,

2042

"mandos.conf"))

1672

u"mandos.conf"))

2043

1673

# Convert the SafeConfigParser object to a dict

2044

1674

server_settings = server_config.defaults()

2045

1675

# Use the appropriate methods on the non-string config options

2046

for option in ("debug", "use_dbus", "use_ipv6"):

2047

server_settings[option] = server_config.getboolean("DEFAULT",

1676

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1677

server_settings[option] = server_config.getboolean(u"DEFAULT",

2048

1678

option)

2049

1679

if server_settings["port"]:

2050

server_settings["port"] = server_config.getint("DEFAULT",

2051

"port")

1680

server_settings["port"] = server_config.getint(u"DEFAULT",

1681

u"port")

2052

1682

del server_config

2053

1683

2054

1684

# Override the settings from the config file with command line

2055

1685

# options, if set.

2056

for option in ("interface", "address", "port", "debug",

2057

"priority", "servicename", "configdir",

2058

"use_dbus", "use_ipv6", "debuglevel", "restore",

2059

"statedir"):

1686

for option in (u"interface", u"address", u"port", u"debug",

1687

u"priority", u"servicename", u"configdir",

1688

u"use_dbus", u"use_ipv6", u"debuglevel"):

2060

1689

value = getattr(options, option)

2061

1690

if value is not None:

2062

1691

server_settings[option] = value

2070

1699

##################################################################

2071

1700

2072

1701

# For convenience

2073

debug = server_settings["debug"]

2074

debuglevel = server_settings["debuglevel"]

2075

use_dbus = server_settings["use_dbus"]

2076

use_ipv6 = server_settings["use_ipv6"]

2077

stored_state_path = os.path.join(server_settings["statedir"],

2078

stored_state_file)

2079

2080

if debug:

2081

initlogger(logging.DEBUG)

2082

else:

2083

if not debuglevel:

2084

initlogger()

2085

else:

2086

level = getattr(logging, debuglevel.upper())

2087

initlogger(level)

2088

2089

if server_settings["servicename"] != "Mandos":

1702

debug = server_settings[u"debug"]

1703

debuglevel = server_settings[u"debuglevel"]

1704

use_dbus = server_settings[u"use_dbus"]

1705

use_ipv6 = server_settings[u"use_ipv6"]

1706

1707

if server_settings[u"servicename"] != u"Mandos":

2090

1708

syslogger.setFormatter(logging.Formatter

2091

('Mandos (%s) [%%(process)d]:'

2092

' %%(levelname)s: %%(message)s'

2093

% server_settings["servicename"]))

1709

(u'Mandos (%s) [%%(process)d]:'

1710

u' %%(levelname)s: %%(message)s'

1711

% server_settings[u"servicename"]))

2094

1712

2095

1713

# Parse config file with clients

2096

client_config = configparser.SafeConfigParser(Client.client_defaults)

2097

client_config.read(os.path.join(server_settings["configdir"],

2098

"clients.conf"))

1714

client_defaults = { u"timeout": u"1h",

1715

u"interval": u"5m",

1716

u"checker": u"fping -q -- %%(host)s",

1717

u"host": u"",

1718

u"approved_delay": u"0s",

1719

u"approved_duration": u"1s",

1720

}

1721

client_config = configparser.SafeConfigParser(client_defaults)

1722

client_config.read(os.path.join(server_settings[u"configdir"],

1723

u"clients.conf"))

2099

1724

2100

1725

global mandos_dbus_service

2101

1726

mandos_dbus_service = None

2102

1727

2103

tcp_server = MandosServer((server_settings["address"],

2104

server_settings["port"]),

1728

tcp_server = MandosServer((server_settings[u"address"],

1729

server_settings[u"port"]),

2105

1730

ClientHandler,

2106

interface=(server_settings["interface"]

2107

or None),

1731

interface=server_settings[u"interface"],

2108

1732

use_ipv6=use_ipv6,

2109

1733

gnutls_priority=

2110

server_settings["priority"],

1734

server_settings[u"priority"],

2111

1735

use_dbus=use_dbus)

2112

if not debug:

2113

pidfilename = "/var/run/mandos.pid"

2114

try:

2115

pidfile = open(pidfilename, "w")

2116

except IOError:

2117

logger.error("Could not open file %r", pidfilename)

1736

pidfilename = u"/var/run/mandos.pid"

1737

try:

1738

pidfile = open(pidfilename, u"w")

1739

except IOError:

1740

logger.error(u"Could not open file %r", pidfilename)

2118

1741

2119

1742

try:

2120

uid = pwd.getpwnam("_mandos").pw_uid

2121

gid = pwd.getpwnam("_mandos").pw_gid

1743

uid = pwd.getpwnam(u"_mandos").pw_uid

1744

gid = pwd.getpwnam(u"_mandos").pw_gid

2122

1745

except KeyError:

2123

1746

try:

2124

uid = pwd.getpwnam("mandos").pw_uid

2125

gid = pwd.getpwnam("mandos").pw_gid

1747

uid = pwd.getpwnam(u"mandos").pw_uid

1748

gid = pwd.getpwnam(u"mandos").pw_gid

2126

1749

except KeyError:

2127

1750

try:

2128

uid = pwd.getpwnam("nobody").pw_uid

2129

gid = pwd.getpwnam("nobody").pw_gid

1751

uid = pwd.getpwnam(u"nobody").pw_uid

1752

gid = pwd.getpwnam(u"nobody").pw_gid

2130

1753

except KeyError:

2131

1754

uid = 65534

2132

1755

gid = 65534

2133

1756

try:

2134

1757

os.setgid(gid)

2135

1758

os.setuid(uid)

2136

except OSError as error:

1759

except OSError, error:

2137

1760

if error[0] != errno.EPERM:

2138

1761

raise error

2139

1762

1763

# Enable all possible GnuTLS debugging

1764

1765

1766

if not debug and not debuglevel:

1767

syslogger.setLevel(logging.WARNING)

1768

console.setLevel(logging.WARNING)

1769

if debuglevel:

1770

level = getattr(logging, debuglevel.upper())

1771

syslogger.setLevel(level)

1772

console.setLevel(level)

1773

2140

1774

if debug:

2141

# Enable all possible GnuTLS debugging

2142

2143

1775

# "Use a log level over 10 to enable all debugging options."

2144

1776

# - GnuTLS manual

2145

1777

gnutls.library.functions.gnutls_global_set_log_level(11)

2146

1778

2147

1779

@gnutls.library.types.gnutls_log_func

2148

1780

def debug_gnutls(level, string):

2149

logger.debug("GnuTLS: %s", string[:-1])

1781

logger.debug(u"GnuTLS: %s", string[:-1])

2150

1782

2151

1783

(gnutls.library.functions

2152

1784

.gnutls_global_set_log_function(debug_gnutls))

2153

1785

2154

1786

# Redirect stdin so all checkers get /dev/null

2155

1787

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2156

1788

os.dup2(null, sys.stdin.fileno())

2159

1791

else:

2160

1792

# No console logging

2161

1793

logger.removeHandler(console)

2162

2163

# Need to fork before connecting to D-Bus

2164

if not debug:

2165

# Close all input and output, do double fork, etc.

2166

daemon()

1794

2167

1795

2168

1796

global main_loop

2169

1797

# From the Avahi example code

2173

1801

# End of Avahi example code

2174

1802

if use_dbus:

2175

1803

try:

2176

bus_name = dbus.service.BusName("se.recompile.Mandos",

1804

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2177

1805

bus, do_not_queue=True)

2178

old_bus_name = (dbus.service.BusName

2179

("se.bsnet.fukt.Mandos", bus,

2180

do_not_queue=True))

2181

except dbus.exceptions.NameExistsException as e:

2182

logger.error(unicode(e) + ", disabling D-Bus")

1806

except dbus.exceptions.NameExistsException, e:

1807

logger.error(unicode(e) + u", disabling D-Bus")

2183

1808

use_dbus = False

2184

server_settings["use_dbus"] = False

1809

server_settings[u"use_dbus"] = False

2185

1810

tcp_server.use_dbus = False

2186

1811

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2187

service = AvahiServiceToSyslog(name =

2188

server_settings["servicename"],

2189

servicetype = "_mandos._tcp",

2190

protocol = protocol, bus = bus)

1812

service = AvahiService(name = server_settings[u"servicename"],

1813

servicetype = u"_mandos._tcp",

1814

protocol = protocol, bus = bus)

2191

1815

if server_settings["interface"]:

2192

1816

service.interface = (if_nametoindex

2193

(str(server_settings["interface"])))

2194

1817

(str(server_settings[u"interface"])))

1818

1819

if not debug:

1820

# Close all input and output, do double fork, etc.

1821

daemon()

1822

2195

1823

global multiprocessing_manager

2196

1824

multiprocessing_manager = multiprocessing.Manager()

2197

1825

2198

1826

client_class = Client

2199

1827

if use_dbus:

2200

client_class = functools.partial(ClientDBusTransitional,

2201

bus = bus)

2202

2203

client_settings = Client.config_parser(client_config)

2204

old_client_settings = {}

2205

clients_data = {}

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

2220

with PGPEngine() as pgp:

2221

for client_name, client in clients_data.iteritems():

2222

# Decide which value to use after restoring saved state.

2223

# We have three different values: Old config file,

2224

# new config file, and saved state.

2225

# New config value takes precedence if it differs from old

2226

# config value, otherwise use saved state.

2227

for name, value in client_settings[client_name].items():

2228

try:

2229

# For each value in new config, check if it

2230

# differs from the old config value (Except for

2231

# the "secret" attribute)

2232

if (name != "secret" and

2233

value != old_client_settings[client_name]

2234

[name]):

2235

client[name] = value

2236

except KeyError:

2237

pass

2238

2239

# Clients who has passed its expire date can still be

2240

# enabled if its last checker was successful. Clients

2241

# whose checker failed before we stored its state is

2242

# assumed to have failed all checkers during downtime.

2243

if client["enabled"]:

2244

if datetime.datetime.utcnow() >= client["expires"]:

2245

if not client["last_checked_ok"]:

2246

logger.warning(

2247

"disabling client {0} - Client never "

2248

"performed a successfull checker"

2249

.format(client["name"]))

2250

client["enabled"] = False

2251

elif client["last_checker_status"] != 0:

2252

logger.warning(

2253

"disabling client {0} - Client "

2254

"last checker failed with error code {1}"

2255

.format(client["name"],

2256

client["last_checker_status"]))

2257

client["enabled"] = False

2258

else:

2259

client["expires"] = (datetime.datetime

2260

.utcnow()

2261

+ client["timeout"])

2262

1828

client_class = functools.partial(ClientDBus, bus = bus)

1829

def client_config_items(config, section):

1830

special_settings = {

1831

"approved_by_default":

1832

lambda: config.getboolean(section,

1833

"approved_by_default"),

1834

}

1835

for name, value in config.items(section):

2263

1836

try:

2264

client["secret"] = (

2265

pgp.decrypt(client["encrypted_secret"],

2266

client_settings[client_name]

2267

["secret"]))

2268

except PGPError:

2269

# If decryption fails, we use secret from new settings

2270

logger.debug("Failed to decrypt {0} old secret"

2271

.format(client_name))

2272

client["secret"] = (

2273

client_settings[client_name]["secret"])

2274

2275

2276

# Add/remove clients based on new changes made to config

2277

for client_name in set(old_client_settings) - set(client_settings):

2278

del clients_data[client_name]

2279

for client_name in set(client_settings) - set(old_client_settings):

2280

clients_data[client_name] = client_settings[client_name]

2281

2282

# Create clients all clients

2283

for client_name, client in clients_data.iteritems():

2284

tcp_server.clients[client_name] = client_class(

2285

name = client_name, settings = client)

2286

1837

yield (name, special_settings[name]())

1838

except KeyError:

1839

yield (name, value)

1840

1841

tcp_server.clients.update(set(

1842

client_class(name = section,

1843

config= dict(client_config_items(

1844

client_config, section)))

1845

for section in client_config.sections()))

2287

1846

if not tcp_server.clients:

2288

logger.warning("No clients defined")

1847

logger.warning(u"No clients defined")

2289

1848

1849

try:

1850

with pidfile:

1851

pid = os.getpid()

1852

pidfile.write(str(pid) + "\n")

1853

del pidfile

1854

except IOError:

1855

logger.error(u"Could not write to file %r with PID %d",

1856

pidfilename, pid)

1857

except NameError:

1858

# "pidfile" was never created

1859

pass

1860

del pidfilename

1861

2290

1862

if not debug:

2291

try:

2292

with pidfile:

2293

pid = os.getpid()

2294

pidfile.write(str(pid) + "\n".encode("utf-8"))

2295

del pidfile

2296

except IOError:

2297

logger.error("Could not write to file %r with PID %d",

2298

pidfilename, pid)

2299

except NameError:

2300

# "pidfile" was never created

2301

pass

2302

del pidfilename

2303

1863

signal.signal(signal.SIGINT, signal.SIG_IGN)

2304

2305

1864

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2306

1865

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2307

1866

2309

1868

class MandosDBusService(dbus.service.Object):

2310

1869

"""A D-Bus proxy object"""

2311

1870

def __init__(self):

2312

dbus.service.Object.__init__(self, bus, "/")

2313

_interface = "se.recompile.Mandos"

1871

dbus.service.Object.__init__(self, bus, u"/")

1872

_interface = u"se.bsnet.fukt.Mandos"

2314

1873

2315

@dbus.service.signal(_interface, signature="o")

1874

@dbus.service.signal(_interface, signature=u"o")

2316

1875

def ClientAdded(self, objpath):

2317

1876

"D-Bus signal"

2318

1877

pass

2319

1878

2320

@dbus.service.signal(_interface, signature="ss")

1879

@dbus.service.signal(_interface, signature=u"ss")

2321

1880

def ClientNotFound(self, fingerprint, address):

2322

1881

"D-Bus signal"

2323

1882

pass

2324

1883

2325

@dbus.service.signal(_interface, signature="os")

1884

@dbus.service.signal(_interface, signature=u"os")

2326

1885

def ClientRemoved(self, objpath, name):

2327

1886

"D-Bus signal"

2328

1887

pass

2329

1888

2330

@dbus.service.method(_interface, out_signature="ao")

1889

@dbus.service.method(_interface, out_signature=u"ao")

2331

1890

def GetAllClients(self):

2332

1891

"D-Bus method"

2333

1892

return dbus.Array(c.dbus_object_path

2334

for c in

2335

tcp_server.clients.itervalues())

1893

for c in tcp_server.clients)

2336

1894

2337

1895

@dbus.service.method(_interface,

2338

out_signature="a{oa{sv}}")

1896

out_signature=u"a{oa{sv}}")

2339

1897

def GetAllClientsWithProperties(self):

2340

1898

"D-Bus method"

2341

1899

return dbus.Dictionary(

2342

((c.dbus_object_path, c.GetAll(""))

2343

for c in tcp_server.clients.itervalues()),

2344

signature="oa{sv}")

1900

((c.dbus_object_path, c.GetAll(u""))

1901

for c in tcp_server.clients),

1902

signature=u"oa{sv}")

2345

1903

2346

@dbus.service.method(_interface, in_signature="o")

1904

@dbus.service.method(_interface, in_signature=u"o")

2347

1905

def RemoveClient(self, object_path):

2348

1906

"D-Bus method"

2349

for c in tcp_server.clients.itervalues():

1907

for c in tcp_server.clients:

2350

1908

if c.dbus_object_path == object_path:

2351

del tcp_server.clients[c.name]

1909

tcp_server.clients.remove(c)

2352

1910

c.remove_from_connection()

2353

1911

# Don't signal anything except ClientRemoved

2354

1912

c.disable(quiet=True)

2359

1917

2360

1918

del _interface

2361

1919

2362

class MandosDBusServiceTransitional(MandosDBusService):

2363

__metaclass__ = AlternateDBusNamesMetaclass

2364

mandos_dbus_service = MandosDBusServiceTransitional()

1920

mandos_dbus_service = MandosDBusService()

2365

1921

2366

1922

def cleanup():

2367

1923

"Cleanup function; run on exit"

2368

1924

service.cleanup()

2369

1925

2370

multiprocessing.active_children()

2371

if not (tcp_server.clients or client_settings):

2372

return

2373

2374

# Store client before exiting. Secrets are encrypted with key

2375

# based on what config file has. If config file is

2376

# removed/edited, old secret will thus be unrecovable.

2377

clients = {}

2378

with PGPEngine() as pgp:

2379

for client in tcp_server.clients.itervalues():

2380

key = client_settings[client.name]["secret"]

2381

client.encrypted_secret = pgp.encrypt(client.secret,

2382

key)

2383

client_dict = {}

2384

2385

# A list of attributes that can not be pickled

2386

# + secret.

2387

exclude = set(("bus", "changedstate", "secret",

2388

"checker"))

2389

for name, typ in (inspect.getmembers

2390

(dbus.service.Object)):

2391

exclude.add(name)

2392

2393

client_dict["encrypted_secret"] = (client

2394

.encrypted_secret)

2395

for attr in client.client_structure:

2396

if attr not in exclude:

2397

client_dict[attr] = getattr(client, attr)

2398

2399

clients[client.name] = client_dict

2400

del client_settings[client.name]["secret"]

2401

2402

try:

2403

with os.fdopen(os.open(stored_state_path,

2404

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2405

0600), "wb") as stored_state:

2406

pickle.dump((clients, client_settings), stored_state)

2407

except (IOError, OSError) as e:

2408

logger.warning("Could not save persistent state: {0}"

2409

.format(e))

2410

if e.errno not in (errno.ENOENT, errno.EACCES):

2411

raise

2412

2413

# Delete all clients, and settings from config

2414

1926

while tcp_server.clients:

2415

name, client = tcp_server.clients.popitem()

1927

client = tcp_server.clients.pop()

2416

1928

if use_dbus:

2417

1929

client.remove_from_connection()

1930

client.disable_hook = None

2418

1931

# Don't signal anything except ClientRemoved

2419

1932

client.disable(quiet=True)

2420

1933

if use_dbus:

2421

1934

# Emit D-Bus signal

2422

mandos_dbus_service.ClientRemoved(client

2423

.dbus_object_path,

1935

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2424

1936

client.name)

2425

client_settings.clear()

2426

1937

2427

1938

atexit.register(cleanup)

2428

1939

2429

for client in tcp_server.clients.itervalues():

1940

for client in tcp_server.clients:

2430

1941

if use_dbus:

2431

1942

# Emit D-Bus signal

2432

1943

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2433

# Need to initiate checking of clients

2434

if client.enabled:

2435

client.init_checker()

1944

client.enable()

2436

1945

2437

1946

tcp_server.enable()

2438

1947

tcp_server.server_activate()

2440

1949

# Find out what port we got

2441

1950

service.port = tcp_server.socket.getsockname()[1]

2442

1951

if use_ipv6:

2443

logger.info("Now listening on address %r, port %d,"

1952

logger.info(u"Now listening on address %r, port %d,"

2444

1953

" flowinfo %d, scope_id %d"

2445

1954

% tcp_server.socket.getsockname())

2446

1955

else: # IPv4

2447

logger.info("Now listening on address %r, port %d"

1956

logger.info(u"Now listening on address %r, port %d"

2448

1957

% tcp_server.socket.getsockname())

2449

1958

2450

1959

#service.interface = tcp_server.socket.getsockname()[3]

2453

1962

# From the Avahi example code

2454

1963

try:

2455

1964

service.activate()

2456

except dbus.exceptions.DBusException as error:

2457

logger.critical("DBusException: %s", error)

1965

except dbus.exceptions.DBusException, error:

1966

logger.critical(u"DBusException: %s", error)

2458

1967

cleanup()

2459

1968

sys.exit(1)

2460

1969

# End of Avahi example code

2464

1973

(tcp_server.handle_request

2465

1974

(*args[2:], **kwargs) or True))

2466

1975

2467

logger.debug("Starting main loop")

1976

logger.debug(u"Starting main loop")

2468

1977

main_loop.run()

2469

except AvahiError as error:

2470

logger.critical("AvahiError: %s", error)

1978

except AvahiError, error:

1979

logger.critical(u"AvahiError: %s", error)

2471

1980

cleanup()

2472

1981

sys.exit(1)

2473

1982

except KeyboardInterrupt:

2474

1983

if debug:

2475

print("", file=sys.stderr)

2476

logger.debug("Server received KeyboardInterrupt")

2477

logger.debug("Server exiting")

1984

print >> sys.stderr

1985

logger.debug(u"Server received KeyboardInterrupt")

1986

logger.debug(u"Server exiting")

2478

1987

# Must run before the D-Bus bus name gets deregistered

2479

1988

cleanup()

2480

1989