/mandos/release : revision 296

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

67

65

import types

68

66

import binascii

69

67

import tempfile

70

import itertools

71

68

72

69

import dbus

73

70

import dbus.service

88

85

except ImportError:

89

86

SO_BINDTODEVICE = None

90

87

91

version = "1.5.3"

88

version = "1.5.2"

92

89

stored_state_file = "clients.pickle"

93

90

94

91

logger = logging.getLogger()

178

175

179

176

def encrypt(self, data, password):

180

177

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

178

with open(os.devnull) as devnull:

182

179

try:

183

180

proc = self.gnupg.run(['--symmetric'],

184

181

create_fhs=['stdin', 'stdout'],

195

192

196

193

def decrypt(self, data, password):

197

194

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

195

with open(os.devnull) as devnull:

199

196

try:

200

197

proc = self.gnupg.run(['--decrypt'],

201

198

create_fhs=['stdin', 'stdout'],

202

199

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

200

with contextlib.closing(proc.handles['stdin'] ) as f:

204

201

f.write(data)

205

202

with contextlib.closing(proc.handles['stdout']) as f:

206

203

decrypted_plaintext = f.read()

211

208

return decrypted_plaintext

212

209

213

210

211

214

212

class AvahiError(Exception):

215

213

def __init__(self, value, *args, **kwargs):

216

214

self.value = value

245

243

server: D-Bus Server

246

244

bus: dbus.SystemBus()

247

245

"""

248

249

246

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

247

servicetype = None, port = None, TXT = None,

251

248

domain = "", host = "", max_renames = 32768,

264

261

self.server = None

265

262

self.bus = bus

266

263

self.entry_group_state_changed_match = None

267

268

264

def rename(self):

269

265

"""Derived from the Avahi example code"""

270

266

if self.rename_count >= self.max_renames:

280

276

try:

281

277

self.add()

282

278

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

279

logger.critical("DBusException: %s", error)

284

280

self.cleanup()

285

281

os._exit(1)

286

282

self.rename_count += 1

287

288

283

def remove(self):

289

284

"""Derived from the Avahi example code"""

290

285

if self.entry_group_state_changed_match is not None:

292

287

self.entry_group_state_changed_match = None

293

288

if self.group is not None:

294

289

self.group.Reset()

295

296

290

def add(self):

297

291

"""Derived from the Avahi example code"""

298

292

self.remove()

315

309

dbus.UInt16(self.port),

316

310

avahi.string_array_to_txt_array(self.TXT))

317

311

self.group.Commit()

318

319

312

def entry_group_state_changed(self, state, error):

320

313

"""Derived from the Avahi example code"""

321

314

logger.debug("Avahi entry group state change: %i", state)

328

321

elif state == avahi.ENTRY_GROUP_FAILURE:

329

322

logger.critical("Avahi: Error in group state changed %s",

330

323

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

324

raise AvahiGroupError("State changed: %s"

325

% unicode(error))

334

326

def cleanup(self):

335

327

"""Derived from the Avahi example code"""

336

328

if self.group is not None:

341

333

pass

342

334

self.group = None

343

335

self.remove()

344

345

336

def server_state_changed(self, state, error=None):

346

337

"""Derived from the Avahi example code"""

347

338

logger.debug("Avahi server state change: %i", state)

366

357

logger.debug("Unknown state: %r", state)

367

358

else:

368

359

logger.debug("Unknown state: %r: %r", state, error)

369

370

360

def activate(self):

371

361

"""Derived from the Avahi example code"""

372

362

if self.server is None:

379

369

self.server_state_changed)

380

370

self.server_state_changed(self.server.GetState())

381

371

382

383

372

class AvahiServiceToSyslog(AvahiService):

384

373

def rename(self):

385

374

"""Add the new name to the syslog messages"""

386

375

ret = AvahiService.rename(self)

387

376

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

391

380

return ret

392

381

393

394

382

def timedelta_to_milliseconds(td):

395

383

"Convert a datetime.timedelta() to milliseconds"

396

384

return ((td.days * 24 * 60 * 60 * 1000)

397

385

+ (td.seconds * 1000)

398

386

+ (td.microseconds // 1000))

399

400

387

401

388

class Client(object):

402

389

"""A representation of a client host served by this server.

403

390

442

429

"""

443

430

444

431

runtime_expansions = ("approval_delay", "approval_duration",

445

"created", "enabled", "expires",

446

"fingerprint", "host", "interval",

447

"last_approval_request", "last_checked_ok",

432

"created", "enabled", "fingerprint",

433

"host", "interval", "last_checked_ok",

448

434

"last_enabled", "name", "timeout")

449

435

client_defaults = { "timeout": "5m",

450

436

"extended_timeout": "15m",

471

457

472

458

def approval_delay_milliseconds(self):

473

459

return timedelta_to_milliseconds(self.approval_delay)

474

460

475

461

@staticmethod

476

462

def config_parser(config):

477

463

"""Construct a new dict of client settings of this form:

502

488

"rb") as secfile:

503

489

client["secret"] = secfile.read()

504

490

else:

505

raise TypeError("No secret or secfile for section {0}"

506

.format(section))

491

raise TypeError("No secret or secfile for section %s"

492

% section)

507

493

client["timeout"] = string_to_delta(section["timeout"])

508

494

client["extended_timeout"] = string_to_delta(

509

495

section["extended_timeout"])

518

504

client["last_checker_status"] = -2

519

505

520

506

return settings

521

507

508

522

509

def __init__(self, settings, name = None):

510

"""Note: the 'checker' key in 'config' sets the

511

'checker_command' attribute and *not* the 'checker'

512

attribute."""

523

513

self.name = name

524

514

# adding all client settings

525

515

for setting, value in settings.iteritems():

534

524

else:

535

525

self.last_enabled = None

536

526

self.expires = None

537

527

538

528

logger.debug("Creating client %r", self.name)

539

529

# Uppercase and remove spaces from fingerprint for later

540

530

# comparison purposes with return value from the fingerprint()

542

532

logger.debug(" Fingerprint: %s", self.fingerprint)

543

533

self.created = settings.get("created",

544

534

datetime.datetime.utcnow())

545

535

546

536

# attributes specific for this server instance

547

537

self.checker = None

548

538

self.checker_initiator_tag = None

576

566

if getattr(self, "enabled", False):

577

567

# Already enabled

578

568

return

569

self.send_changedstate()

579

570

self.expires = datetime.datetime.utcnow() + self.timeout

580

571

self.enabled = True

581

572

self.last_enabled = datetime.datetime.utcnow()

582

573

self.init_checker()

583

self.send_changedstate()

584

574

585

575

def disable(self, quiet=True):

586

576

"""Disable this client."""

587

577

if not getattr(self, "enabled", False):

588

578

return False

589

579

if not quiet:

580

self.send_changedstate()

581

if not quiet:

590

582

logger.info("Disabling client %s", self.name)

591

if getattr(self, "disable_initiator_tag", None) is not None:

583

if getattr(self, "disable_initiator_tag", False):

592

584

gobject.source_remove(self.disable_initiator_tag)

593

585

self.disable_initiator_tag = None

594

586

self.expires = None

595

if getattr(self, "checker_initiator_tag", None) is not None:

587

if getattr(self, "checker_initiator_tag", False):

596

588

gobject.source_remove(self.checker_initiator_tag)

597

589

self.checker_initiator_tag = None

598

590

self.stop_checker()

599

591

self.enabled = False

600

if not quiet:

601

self.send_changedstate()

602

592

# Do not run this again if called by a gobject.timeout_add

603

593

return False

604

594

608

598

def init_checker(self):

609

599

# Schedule a new checker to be started an 'interval' from now,

610

600

# and every interval from then on.

611

if self.checker_initiator_tag is not None:

612

gobject.source_remove(self.checker_initiator_tag)

613

601

self.checker_initiator_tag = (gobject.timeout_add

614

602

(self.interval_milliseconds(),

615

603

self.start_checker))

616

604

# Schedule a disable() when 'timeout' has passed

617

if self.disable_initiator_tag is not None:

618

gobject.source_remove(self.disable_initiator_tag)

619

605

self.disable_initiator_tag = (gobject.timeout_add

620

606

(self.timeout_milliseconds(),

621

607

self.disable))

652

638

timeout = self.timeout

653

639

if self.disable_initiator_tag is not None:

654

640

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = None

656

641

if getattr(self, "enabled", False):

657

642

self.disable_initiator_tag = (gobject.timeout_add

658

643

(timedelta_to_milliseconds

668

653

If a checker already exists, leave it running and do

669

654

nothing."""

670

655

# The reason for not killing a running checker is that if we

671

# did that, and if a checker (for some reason) started running

672

# slowly and taking more than 'interval' time, then the client

673

# would inevitably timeout, since no checker would get a

674

# chance to run to completion. If we instead leave running

656

# did that, then if a checker (for some reason) started

657

# running slowly and taking more than 'interval' time, the

658

# client would inevitably timeout, since no checker would get

659

# a chance to run to completion. If we instead leave running

675

660

# checkers alone, the checker would have to take more time

676

661

# than 'timeout' for the client to be disabled, which is as it

677

662

# should be.

691

676

self.current_checker_command)

692

677

# Start a new checker if needed

693

678

if self.checker is None:

694

# Escape attributes for the shell

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

699

679

try:

700

command = self.checker_command % escaped_attrs

701

except TypeError as error:

702

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

680

# In case checker_command has exactly one % operator

681

command = self.checker_command % self.host

682

except TypeError:

683

# Escape attributes for the shell

684

escaped_attrs = dict(

685

(attr,

686

re.escape(unicode(str(getattr(self, attr, "")),

687

errors=

688

'replace')))

689

for attr in

690

self.runtime_expansions)

691

692

try:

693

command = self.checker_command % escaped_attrs

694

except TypeError as error:

695

logger.error('Could not format string "%s":'

696

' %s', self.checker_command, error)

697

return True # Try again later

705

698

self.current_checker_command = command

706

699

try:

707

700

logger.info("Starting checker %r for %s",

713

706

self.checker = subprocess.Popen(command,

714

707

close_fds=True,

715

708

shell=True, cwd="/")

709

self.checker_callback_tag = (gobject.child_watch_add

710

(self.checker.pid,

711

self.checker_callback,

712

data=command))

713

# The checker may have completed before the gobject

714

# watch was added. Check for this.

715

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

716

if pid:

717

gobject.source_remove(self.checker_callback_tag)

718

self.checker_callback(pid, status, command)

716

719

except OSError as error:

717

logger.error("Failed to start subprocess",

718

exc_info=error)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

720

logger.error("Failed to start subprocess: %s",

721

error)

729

722

# Re-run this periodically if run by gobject.timeout_add

730

723

return True

731

724

738

731

return

739

732

logger.debug("Stopping checker for %(name)s", vars(self))

740

733

try:

741

self.checker.terminate()

734

os.kill(self.checker.pid, signal.SIGTERM)

742

735

#time.sleep(0.5)

743

736

#if self.checker.poll() is None:

744

# self.checker.kill()

737

# os.kill(self.checker.pid, signal.SIGKILL)

745

738

except OSError as error:

746

739

if error.errno != errno.ESRCH: # No such process

747

740

raise

764

757

# "Set" method, so we fail early here:

765

758

if byte_arrays and signature != "ay":

766

759

raise ValueError("Byte arrays not supported for non-'ay'"

767

" signature {0!r}".format(signature))

760

" signature %r" % signature)

768

761

def decorator(func):

769

762

func._dbus_is_property = True

770

763

func._dbus_interface = dbus_interface

778

771

return decorator

779

772

780

773

781

def dbus_interface_annotations(dbus_interface):

782

"""Decorator for marking functions returning interface annotations

783

784

Usage:

785

786

@dbus_interface_annotations("org.example.Interface")

787

def _foo(self): # Function name does not matter

788

return {"org.freedesktop.DBus.Deprecated": "true",

789

"org.freedesktop.DBus.Property.EmitsChangedSignal":

790

"false"}

791

"""

792

def decorator(func):

793

func._dbus_is_interface = True

794

func._dbus_interface = dbus_interface

795

func._dbus_name = dbus_interface

796

return func

797

return decorator

798

799

800

def dbus_annotations(annotations):

801

"""Decorator to annotate D-Bus methods, signals or properties

802

Usage:

803

804

@dbus_service_property("org.example.Interface", signature="b",

805

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

809

def Property_dbus_property(self):

810

return dbus.Boolean(False)

811

"""

812

def decorator(func):

813

func._dbus_annotations = annotations

814

return func

815

return decorator

816

817

818

774

class DBusPropertyException(dbus.exceptions.DBusException):

819

775

"""A base class for D-Bus property-related exceptions

820

776

"""

843

799

"""

844

800

845

801

@staticmethod

846

def _is_dbus_thing(thing):

847

"""Returns a function testing if an attribute is a D-Bus thing

848

849

If called like _is_dbus_thing("method") it returns a function

850

suitable for use as predicate to inspect.getmembers().

851

"""

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

853

False)

802

def _is_dbus_property(obj):

803

return getattr(obj, "_dbus_is_property", False)

854

804

855

def _get_all_dbus_things(self, thing):

805

def _get_all_dbus_properties(self):

856

806

"""Returns a generator of (name, attribute) pairs

857

807

"""

858

return ((getattr(athing.__get__(self), "_dbus_name",

859

name),

860

athing.__get__(self))

808

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

861

809

for cls in self.__class__.__mro__

862

for name, athing in

863

inspect.getmembers(cls,

864

self._is_dbus_thing(thing)))

810

for name, prop in

811

inspect.getmembers(cls, self._is_dbus_property))

865

812

866

813

def _get_dbus_property(self, interface_name, property_name):

867

814

"""Returns a bound method if one exists which is a D-Bus

869

816

"""

870

817

for cls in self.__class__.__mro__:

871

818

for name, value in (inspect.getmembers

872

(cls,

873

self._is_dbus_thing("property"))):

819

(cls, self._is_dbus_property)):

874

820

if (value._dbus_name == property_name

875

821

and value._dbus_interface == interface_name):

876

822

return value.__get__(self)

918

864

Note: Will not include properties with access="write".

919

865

"""

920

866

properties = {}

921

for name, prop in self._get_all_dbus_things("property"):

867

for name, prop in self._get_all_dbus_properties():

922

868

if (interface_name

923

869

and interface_name != prop._dbus_interface):

924

870

# Interface non-empty but did not match

939

885

path_keyword='object_path',

940

886

connection_keyword='connection')

941

887

def Introspect(self, object_path, connection):

942

"""Overloading of standard D-Bus method.

943

944

Inserts property tags and interface annotation tags.

888

"""Standard D-Bus method, overloaded to insert property tags.

945

889

"""

946

890

xmlstring = dbus.service.Object.Introspect(self, object_path,

947

891

connection)

954

898

e.setAttribute("access", prop._dbus_access)

955

899

return e

956

900

for if_tag in document.getElementsByTagName("interface"):

957

# Add property tags

958

901

for tag in (make_tag(document, name, prop)

959

902

for name, prop

960

in self._get_all_dbus_things("property")

903

in self._get_all_dbus_properties()

961

904

if prop._dbus_interface

962

905

== if_tag.getAttribute("name")):

963

906

if_tag.appendChild(tag)

964

# Add annotation tags

965

for typ in ("method", "signal", "property"):

966

for tag in if_tag.getElementsByTagName(typ):

967

annots = dict()

968

for name, prop in (self.

969

_get_all_dbus_things(typ)):

970

if (name == tag.getAttribute("name")

971

and prop._dbus_interface

972

== if_tag.getAttribute("name")):

973

annots.update(getattr

974

(prop,

975

"_dbus_annotations",

976

{}))

977

for name, value in annots.iteritems():

978

ann_tag = document.createElement(

979

"annotation")

980

ann_tag.setAttribute("name", name)

981

ann_tag.setAttribute("value", value)

982

tag.appendChild(ann_tag)

983

# Add interface annotation tags

984

for annotation, value in dict(

985

itertools.chain.from_iterable(

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

989

if name == if_tag.getAttribute("name")

990

)).iteritems():

991

ann_tag = document.createElement("annotation")

992

ann_tag.setAttribute("name", annotation)

993

ann_tag.setAttribute("value", value)

994

if_tag.appendChild(ann_tag)

995

907

# Add the names to the return values for the

996

908

# "org.freedesktop.DBus.Properties" methods

997

909

if (if_tag.getAttribute("name")

1012

924

except (AttributeError, xml.dom.DOMException,

1013

925

xml.parsers.expat.ExpatError) as error:

1014

926

logger.error("Failed to override Introspection method",

1015

exc_info=error)

927

error)

1016

928

return xmlstring

1017

929

1018

930

1024

936

variant_level=variant_level)

1025

937

1026

938

1027

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1028

"""A class decorator; applied to a subclass of

1029

dbus.service.Object, it will add alternate D-Bus attributes with

1030

interface names according to the "alt_interface_names" mapping.

1031

Usage:

1032

1033

@alternate_dbus_names({"org.example.Interface":

1034

"net.example.AlternateInterface"})

1035

class SampleDBusObject(dbus.service.Object):

1036

@dbus.service.method("org.example.Interface")

1037

def SampleDBusMethod():

1038

pass

1039

1040

The above "SampleDBusMethod" on "SampleDBusObject" will be

1041

reachable via two interfaces: "org.example.Interface" and

1042

"net.example.AlternateInterface", the latter of which will have

1043

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1044

"true", unless "deprecate" is passed with a False value.

1045

1046

This works for methods and signals, and also for D-Bus properties

1047

(from DBusObjectWithProperties) and interfaces (from the

1048

dbus_interface_annotations decorator).

939

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

940

.__metaclass__):

941

"""Applied to an empty subclass of a D-Bus object, this metaclass

942

will add additional D-Bus attributes matching a certain pattern.

1049

943

"""

1050

def wrapper(cls):

1051

for orig_interface_name, alt_interface_name in (

1052

alt_interface_names.iteritems()):

1053

attr = {}

1054

interface_names = set()

1055

# Go though all attributes of the class

1056

for attrname, attribute in inspect.getmembers(cls):

944

def __new__(mcs, name, bases, attr):

945

# Go through all the base classes which could have D-Bus

946

# methods, signals, or properties in them

947

for base in (b for b in bases

948

if issubclass(b, dbus.service.Object)):

949

# Go though all attributes of the base class

950

for attrname, attribute in inspect.getmembers(base):

1057

951

# Ignore non-D-Bus attributes, and D-Bus attributes

1058

952

# with the wrong interface name

1059

953

if (not hasattr(attribute, "_dbus_interface")

1060

954

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

955

.startswith("se.recompile.Mandos")):

1062

956

continue

1063

957

# Create an alternate D-Bus interface name based on

1064

958

# the current name

1065

959

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1068

interface_names.add(alt_interface)

960

.replace("se.recompile.Mandos",

961

"se.bsnet.fukt.Mandos"))

1069

962

# Is this a D-Bus signal?

1070

963

if getattr(attribute, "_dbus_is_signal", False):

1071

964

# Extract the original non-method function by

1086

979

nonmethod_func.func_name,

1087

980

nonmethod_func.func_defaults,

1088

981

nonmethod_func.func_closure)))

1089

# Copy annotations, if any

1090

try:

1091

new_function._dbus_annotations = (

1092

dict(attribute._dbus_annotations))

1093

except AttributeError:

1094

pass

1095

982

# Define a creator of a function to call both the

1096

# original and alternate functions, so both the

1097

# original and alternate signals gets sent when

1098

# the function is called

983

# old and new functions, so both the old and new

984

# signals gets sent when the function is called

1099

985

def fixscope(func1, func2):

1100

986

"""This function is a scope container to pass

1101

987

func1 and func2 to the "call_both" function

1108

994

return call_both

1109

995

# Create the "call_both" function and add it to

1110

996

# the class

1111

attr[attrname] = fixscope(attribute, new_function)

997

attr[attrname] = fixscope(attribute,

998

new_function)

1112

999

# Is this a D-Bus method?

1113

1000

elif getattr(attribute, "_dbus_is_method", False):

1114

1001

# Create a new, but exactly alike, function

1125

1012

attribute.func_name,

1126

1013

attribute.func_defaults,

1127

1014

attribute.func_closure)))

1128

# Copy annotations, if any

1129

try:

1130

attr[attrname]._dbus_annotations = (

1131

dict(attribute._dbus_annotations))

1132

except AttributeError:

1133

pass

1134

1015

# Is this a D-Bus property?

1135

1016

elif getattr(attribute, "_dbus_is_property", False):

1136

1017

# Create a new, but exactly alike, function

1150

1031

attribute.func_name,

1151

1032

attribute.func_defaults,

1152

1033

attribute.func_closure)))

1153

# Copy annotations, if any

1154

try:

1155

attr[attrname]._dbus_annotations = (

1156

dict(attribute._dbus_annotations))

1157

except AttributeError:

1158

pass

1159

# Is this a D-Bus interface?

1160

elif getattr(attribute, "_dbus_is_interface", False):

1161

# Create a new, but exactly alike, function

1162

# object. Decorate it to be a new D-Bus interface

1163

# with the alternate D-Bus interface name. Add it

1164

# to the class.

1165

attr[attrname] = (dbus_interface_annotations

1166

(alt_interface)

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1173

if deprecate:

1174

# Deprecate all alternate interfaces

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1176

for interface_name in interface_names:

1177

@dbus_interface_annotations(interface_name)

1178

def func(self):

1179

return { "org.freedesktop.DBus.Deprecated":

1180

"true" }

1181

# Find an unused name

1182

for aname in (iname.format(i)

1183

for i in itertools.count()):

1184

if aname not in attr:

1185

attr[aname] = func

1186

break

1187

if interface_names:

1188

# Replace the class with a new subclass of it with

1189

# methods, signals, etc. as created above.

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1192

return cls

1193

return wrapper

1194

1195

1196

@alternate_dbus_interfaces({"se.recompile.Mandos":

1197

"se.bsnet.fukt.Mandos"})

1034

return type.__new__(mcs, name, bases, attr)

1035

1036

1198

1037

class ClientDBus(Client, DBusObjectWithProperties):

1199

1038

"""A Client class using D-Bus

1200

1039

1220

1059

("/clients/" + client_object_name))

1221

1060

DBusObjectWithProperties.__init__(self, self.bus,

1222

1061

self.dbus_object_path)

1223

1062

1224

1063

def notifychangeproperty(transform_func,

1225

1064

dbus_name, type_func=lambda x: x,

1226

1065

variant_level=1):

1249

1088

1250

1089

return property(lambda self: getattr(self, attrname), setter)

1251

1090

1091

1252

1092

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1253

1093

approvals_pending = notifychangeproperty(dbus.Boolean,

1254

1094

"ApprovalPending",

1336

1176

return False

1337

1177

1338

1178

def approve(self, value=True):

1179

self.send_changedstate()

1339

1180

self.approved = value

1340

1181

gobject.timeout_add(timedelta_to_milliseconds

1341

1182

(self.approval_duration),

1342

1183

self._reset_approved)

1343

self.send_changedstate()

1184

1344

1185

1345

1186

## D-Bus methods, signals & properties

1346

1187

_interface = "se.recompile.Mandos.Client"

1347

1188

1348

## Interfaces

1349

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

1354

1355

1189

## Signals

1356

1190

1357

1191

# CheckerCompleted - signal

1530

1364

def Timeout_dbus_property(self, value=None):

1531

1365

if value is None: # get

1532

1366

return dbus.UInt64(self.timeout_milliseconds())

1533

old_timeout = self.timeout

1534

1367

self.timeout = datetime.timedelta(0, 0, 0, value)

1535

# Reschedule disabling

1368

# Reschedule timeout

1536

1369

if self.enabled:

1537

1370

now = datetime.datetime.utcnow()

1538

self.expires += self.timeout - old_timeout

1539

if self.expires <= now:

1371

time_to_die = timedelta_to_milliseconds(

1372

(self.last_checked_ok + self.timeout) - now)

1373

if time_to_die <= 0:

1540

1374

# The timeout has passed

1541

1375

self.disable()

1542

1376

else:

1377

self.expires = (now +

1378

datetime.timedelta(milliseconds =

1379

time_to_die))

1543

1380

if (getattr(self, "disable_initiator_tag", None)

1544

1381

is None):

1545

1382

return

1546

1383

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1384

self.disable_initiator_tag = (gobject.timeout_add

1385

(time_to_die,

1386

self.disable))

1551

1387

1552

1388

# ExtendedTimeout - property

1553

1389

@dbus_service_property(_interface, signature="t",

1632

1468

self._pipe.send(('setattr', name, value))

1633

1469

1634

1470

1471

class ClientDBusTransitional(ClientDBus):

1472

__metaclass__ = AlternateDBusNamesMetaclass

1473

1474

1635

1475

class ClientHandler(socketserver.BaseRequestHandler, object):

1636

1476

"""A class to handle client connections.

1637

1477

1741

1581

#wait until timeout or approved

1742

1582

time = datetime.datetime.now()

1743

1583

client.changedstate.acquire()

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1584

(client.changedstate.wait

1585

(float(client.timedelta_to_milliseconds(delay)

1586

/ 1000)))

1747

1587

client.changedstate.release()

1748

1588

time2 = datetime.datetime.now()

1749

1589

if (time2 - time) >= delay:

1765

1605

try:

1766

1606

sent = session.send(client.secret[sent_size:])

1767

1607

except gnutls.errors.GNUTLSError as error:

1768

logger.warning("gnutls send failed",

1769

exc_info=error)

1608

logger.warning("gnutls send failed")

1770

1609

return

1771

1610

logger.debug("Sent: %d, remaining: %d",

1772

1611

sent, len(client.secret)

1786

1625

try:

1787

1626

session.bye()

1788

1627

except gnutls.errors.GNUTLSError as error:

1789

logger.warning("GnuTLS bye failed",

1790

exc_info=error)

1628

logger.warning("GnuTLS bye failed")

1791

1629

1792

1630

@staticmethod

1793

1631

def peer_certificate(session):

1865

1703

def process_request(self, request, address):

1866

1704

"""Start a new process to process the request."""

1867

1705

proc = multiprocessing.Process(target = self.sub_process_main,

1868

args = (request, address))

1706

args = (request,

1707

address))

1869

1708

proc.start()

1870

1709

return proc

1871

1710

1921

1760

str(self.interface

1922

1761

+ '\0'))

1923

1762

except socket.error as error:

1924

if error.errno == errno.EPERM:

1763

if error[0] == errno.EPERM:

1925

1764

logger.error("No permission to"

1926

1765

" bind to interface %s",

1927

1766

self.interface)

1928

elif error.errno == errno.ENOPROTOOPT:

1767

elif error[0] == errno.ENOPROTOOPT:

1929

1768

logger.error("SO_BINDTODEVICE not available;"

1930

1769

" cannot bind to interface %s",

1931

1770

self.interface)

1932

elif error.errno == errno.ENODEV:

1933

logger.error("Interface %s does not"

1934

" exist, cannot bind",

1935

self.interface)

1936

1771

else:

1937

1772

raise

1938

1773

# Only bind(2) the socket if we really need to.

1997

1832

1998

1833

def handle_ipc(self, source, condition, parent_pipe=None,

1999

1834

proc = None, client_object=None):

1835

condition_names = {

1836

gobject.IO_IN: "IN", # There is data to read.

1837

gobject.IO_OUT: "OUT", # Data can be written (without

1838

# blocking).

1839

gobject.IO_PRI: "PRI", # There is urgent data to read.

1840

gobject.IO_ERR: "ERR", # Error condition.

1841

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1842

# broken, usually for pipes and

1843

# sockets).

1844

}

1845

conditions_string = ' | '.join(name

1846

for cond, name in

1847

condition_names.iteritems()

1848

if cond & condition)

2000

1849

# error, or the other end of multiprocessing.Pipe has closed

2001

if condition & (gobject.IO_ERR | gobject.IO_HUP):

1850

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2002

1851

# Wait for other process to exit

2003

1852

proc.join()

2004

1853

return False

2094

1943

elif suffix == "w":

2095

1944

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2096

1945

else:

2097

raise ValueError("Unknown suffix {0!r}"

2098

.format(suffix))

1946

raise ValueError("Unknown suffix %r" % suffix)

2099

1947

except (ValueError, IndexError) as e:

2100

1948

raise ValueError(*(e.args))

2101

1949

timevalue += delta

2115

1963

sys.exit()

2116

1964

if not noclose:

2117

1965

# Close all standard open file descriptors

2118

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1966

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2119

1967

if not stat.S_ISCHR(os.fstat(null).st_mode):

2120

1968

raise OSError(errno.ENODEV,

2121

"{0} not a character device"

2122

.format(os.devnull))

1969

"%s not a character device"

1970

% os.path.devnull)

2123

1971

os.dup2(null, sys.stdin.fileno())

2124

1972

os.dup2(null, sys.stdout.fileno())

2125

1973

os.dup2(null, sys.stderr.fileno())

2134

1982

2135

1983

parser = argparse.ArgumentParser()

2136

1984

parser.add_argument("-v", "--version", action="version",

2137

version = "%(prog)s {0}".format(version),

1985

version = "%%(prog)s %s" % version,

2138

1986

help="show version number and exit")

2139

1987

parser.add_argument("-i", "--interface", metavar="IF",

2140

1988

help="Bind to interface IF")

2243

2091

2244

2092

if server_settings["servicename"] != "Mandos":

2245

2093

syslogger.setFormatter(logging.Formatter

2246

('Mandos ({0}) [%(process)d]:'

2247

' %(levelname)s: %(message)s'

2248

.format(server_settings

2249

["servicename"])))

2094

('Mandos (%s) [%%(process)d]:'

2095

' %%(levelname)s: %%(message)s'

2096

% server_settings["servicename"]))

2250

2097

2251

2098

# Parse config file with clients

2252

2099

client_config = configparser.SafeConfigParser(Client

2270

2117

pidfilename = "/var/run/mandos.pid"

2271

2118

try:

2272

2119

pidfile = open(pidfilename, "w")

2273

except IOError as e:

2274

logger.error("Could not open file %r", pidfilename,

2275

exc_info=e)

2120

except IOError:

2121

logger.error("Could not open file %r", pidfilename)

2276

2122

2277

for name in ("_mandos", "mandos", "nobody"):

2123

try:

2124

uid = pwd.getpwnam("_mandos").pw_uid

2125

gid = pwd.getpwnam("_mandos").pw_gid

2126

except KeyError:

2278

2127

try:

2279

uid = pwd.getpwnam(name).pw_uid

2280

gid = pwd.getpwnam(name).pw_gid

2281

break

2128

uid = pwd.getpwnam("mandos").pw_uid

2129

gid = pwd.getpwnam("mandos").pw_gid

2282

2130

except KeyError:

2283

continue

2284

else:

2285

uid = 65534

2286

gid = 65534

2131

try:

2132

uid = pwd.getpwnam("nobody").pw_uid

2133

gid = pwd.getpwnam("nobody").pw_gid

2134

except KeyError:

2135

uid = 65534

2136

gid = 65534

2287

2137

try:

2288

2138

os.setgid(gid)

2289

2139

os.setuid(uid)

2290

2140

except OSError as error:

2291

if error.errno != errno.EPERM:

2141

if error[0] != errno.EPERM:

2292

2142

raise error

2293

2143

2294

2144

if debug:

2306

2156

.gnutls_global_set_log_function(debug_gnutls))

2307

2157

2308

2158

# Redirect stdin so all checkers get /dev/null

2309

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2159

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2310

2160

os.dup2(null, sys.stdin.fileno())

2311

2161

if null > 2:

2312

2162

os.close(null)

2320

2170

2321

2171

global main_loop

2322

2172

# From the Avahi example code

2323

DBusGMainLoop(set_as_default=True)

2173

DBusGMainLoop(set_as_default=True )

2324

2174

main_loop = gobject.MainLoop()

2325

2175

bus = dbus.SystemBus()

2326

2176

# End of Avahi example code

2332

2182

("se.bsnet.fukt.Mandos", bus,

2333

2183

do_not_queue=True))

2334

2184

except dbus.exceptions.NameExistsException as e:

2335

logger.error("Disabling D-Bus:", exc_info=e)

2185

logger.error(unicode(e) + ", disabling D-Bus")

2336

2186

use_dbus = False

2337

2187

server_settings["use_dbus"] = False

2338

2188

tcp_server.use_dbus = False

2350

2200

2351

2201

client_class = Client

2352

2202

if use_dbus:

2353

client_class = functools.partial(ClientDBus, bus = bus)

2203

client_class = functools.partial(ClientDBusTransitional,

2204

bus = bus)

2354

2205

2355

2206

client_settings = Client.config_parser(client_config)

2356

2207

old_client_settings = {}

2364

2215

(stored_state))

2365

2216

os.remove(stored_state_path)

2366

2217

except IOError as e:

2367

if e.errno == errno.ENOENT:

2368

logger.warning("Could not load persistent state: {0}"

2369

.format(os.strerror(e.errno)))

2370

else:

2371

logger.critical("Could not load persistent state:",

2372

exc_info=e)

2218

logger.warning("Could not load persistent state: {0}"

2219

.format(e))

2220

if e.errno != errno.ENOENT:

2373

2221

raise

2374

2222

except EOFError as e:

2375

2223

logger.warning("Could not load persistent state: "

2376

"EOFError:", exc_info=e)

2224

"EOFError: {0}".format(e))

2377

2225

2378

2226

with PGPEngine() as pgp:

2379

2227

for client_name, client in clients_data.iteritems():

2432

2280

.format(client_name))

2433

2281

client["secret"] = (

2434

2282

client_settings[client_name]["secret"])

2283

2435

2284

2436

2285

# Add/remove clients based on new changes made to config

2437

2286

for client_name in (set(old_client_settings)

2440

2289

for client_name in (set(client_settings)

2441

2290

- set(old_client_settings)):

2442

2291

clients_data[client_name] = client_settings[client_name]

2443

2292

2444

2293

# Create all client objects

2445

2294

for client_name, client in clients_data.iteritems():

2446

2295

tcp_server.clients[client_name] = client_class(

2448

2297

2449

2298

if not tcp_server.clients:

2450

2299

logger.warning("No clients defined")

2451

2300

2452

2301

if not debug:

2453

2302

try:

2454

2303

with pidfile:

2462

2311

# "pidfile" was never created

2463

2312

pass

2464

2313

del pidfilename

2314

signal.signal(signal.SIGINT, signal.SIG_IGN)

2465

2315

2466

2316

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2467

2317

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2468

2318

2469

2319

if use_dbus:

2470

@alternate_dbus_interfaces({"se.recompile.Mandos":

2471

"se.bsnet.fukt.Mandos"})

2472

class MandosDBusService(DBusObjectWithProperties):

2320

class MandosDBusService(dbus.service.Object):

2473

2321

"""A D-Bus proxy object"""

2474

2322

def __init__(self):

2475

2323

dbus.service.Object.__init__(self, bus, "/")

2476

2324

_interface = "se.recompile.Mandos"

2477

2325

2478

@dbus_interface_annotations(_interface)

2479

def _foo(self):

2480

return { "org.freedesktop.DBus.Property"

2481

".EmitsChangedSignal":

2482

"false"}

2483

2484

2326

@dbus.service.signal(_interface, signature="o")

2485

2327

def ClientAdded(self, objpath):

2486

2328

"D-Bus signal"

2528

2370

2529

2371

del _interface

2530

2372

2531

mandos_dbus_service = MandosDBusService()

2373

class MandosDBusServiceTransitional(MandosDBusService):

2374

__metaclass__ = AlternateDBusNamesMetaclass

2375

mandos_dbus_service = MandosDBusServiceTransitional()

2532

2376

2533

2377

def cleanup():

2534

2378

"Cleanup function; run on exit"

2567

2411

del client_settings[client.name]["secret"]

2568

2412

2569

2413

try:

2570

with (tempfile.NamedTemporaryFile

2571

(mode='wb', suffix=".pickle", prefix='clients-',

2572

dir=os.path.dirname(stored_state_path),

2573

delete=False)) as stored_state:

2414

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2415

prefix="clients-",

2416

dir=os.path.dirname

2417

(stored_state_path))

2418

with os.fdopen(tempfd, "wb") as stored_state:

2574

2419

pickle.dump((clients, client_settings), stored_state)

2575

tempname=stored_state.name

2576

2420

os.rename(tempname, stored_state_path)

2577

2421

except (IOError, OSError) as e:

2422

logger.warning("Could not save persistent state: {0}"

2423

.format(e))

2578

2424

if not debug:

2579

2425

try:

2580

2426

os.remove(tempname)

2581

2427

except NameError:

2582

2428

pass

2583

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2584

logger.warning("Could not save persistent state: {0}"

2585

.format(os.strerror(e.errno)))

2586

else:

2587

logger.warning("Could not save persistent state:",

2588

exc_info=e)

2429

if e.errno not in set((errno.ENOENT, errno.EACCES,

2430

errno.EEXIST)):

2589

2431

raise e

2590

2432

2591

2433

# Delete all clients, and settings from config

2619

2461

service.port = tcp_server.socket.getsockname()[1]

2620

2462

if use_ipv6:

2621

2463

logger.info("Now listening on address %r, port %d,"

2622

" flowinfo %d, scope_id %d",

2623

*tcp_server.socket.getsockname())

2464

" flowinfo %d, scope_id %d"

2465

% tcp_server.socket.getsockname())

2624

2466

else: # IPv4

2625

logger.info("Now listening on address %r, port %d",

2626

*tcp_server.socket.getsockname())

2467

logger.info("Now listening on address %r, port %d"

2468

% tcp_server.socket.getsockname())

2627

2469

2628

2470

#service.interface = tcp_server.socket.getsockname()[3]

2629

2471

2632

2474

try:

2633

2475

service.activate()

2634

2476

except dbus.exceptions.DBusException as error:

2635

logger.critical("D-Bus Exception", exc_info=error)

2477

logger.critical("DBusException: %s", error)

2636

2478

cleanup()

2637

2479

sys.exit(1)

2638

2480

# End of Avahi example code

2645

2487

logger.debug("Starting main loop")

2646

2488

main_loop.run()

2647

2489

except AvahiError as error:

2648

logger.critical("Avahi Error", exc_info=error)

2490

logger.critical("AvahiError: %s", error)

2649

2491

cleanup()

2650

2492

sys.exit(1)

2651

2493

except KeyboardInterrupt: