/mandos/trunk : revision 237.4.10

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

64

69

65

import dbus

70

66

import dbus.service

75

71

import ctypes.util

76

72

import xml.dom.minidom

77

73

import inspect

78

import GnuPGInterface

79

74

80

75

try:

81

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

80

except ImportError:

86

81

SO_BINDTODEVICE = None

87

82

88

version = "1.5.3"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

83

84

version = "1.2.2"

85

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

92

88

syslogger = (logging.handlers.SysLogHandler

93

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

210

90

address = "/dev/log"))

91

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

logger.addHandler(syslogger)

95

96

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

100

logger.addHandler(console)

211

101

212

102

class AvahiError(Exception):

213

103

def __init__(self, value, *args, **kwargs):

229

119

Attributes:

230

120

interface: integer; avahi.IF_UNSPEC or an interface index.

231

121

Used to optionally bind to the specified interface.

232

233

type: string; Example: '_mandos._tcp'.

122

123

type: string; Example: u'_mandos._tcp'.

234

124

See <http://www.dns-sd.org/ServiceTypes.html>

235

125

port: integer; what port to announce

236

126

TXT: list of strings; TXT record for the service

245

135

"""

246

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

247

137

servicetype = None, port = None, TXT = None,

248

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

249

139

protocol = avahi.PROTO_UNSPEC, bus = None):

250

140

self.interface = interface

251

141

self.name = name

260

150

self.group = None # our entry group

261

151

self.server = None

262

152

self.bus = bus

263

self.entry_group_state_changed_match = None

264

153

def rename(self):

265

154

"""Derived from the Avahi example code"""

266

155

if self.rename_count >= self.max_renames:

267

logger.critical("No suitable Zeroconf service name found"

268

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

269

158

self.rename_count)

270

raise AvahiServiceError("Too many renames")

271

self.name = unicode(self.server

272

.GetAlternativeServiceName(self.name))

273

logger.info("Changing Zeroconf service name to %r ...",

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

274

162

self.name)

163

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

166

% self.name))

275

167

self.remove()

276

168

try:

277

169

self.add()

278

except dbus.exceptions.DBusException as error:

279

logger.critical("DBusException: %s", error)

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

280

172

self.cleanup()

281

173

os._exit(1)

282

174

self.rename_count += 1

283

175

def remove(self):

284

176

"""Derived from the Avahi example code"""

285

if self.entry_group_state_changed_match is not None:

286

self.entry_group_state_changed_match.remove()

287

self.entry_group_state_changed_match = None

288

177

if self.group is not None:

289

178

self.group.Reset()

290

179

def add(self):

291

180

"""Derived from the Avahi example code"""

292

self.remove()

293

181

if self.group is None:

294

182

self.group = dbus.Interface(

295

183

self.bus.get_object(avahi.DBUS_NAME,

296

184

self.server.EntryGroupNew()),

297

185

avahi.DBUS_INTERFACE_ENTRY_GROUP)

298

self.entry_group_state_changed_match = (

299

self.group.connect_to_signal(

300

'StateChanged', self.entry_group_state_changed))

301

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

302

190

self.name, self.type)

303

191

self.group.AddService(

304

192

self.interface,

311

199

self.group.Commit()

312

200

def entry_group_state_changed(self, state, error):

313

201

"""Derived from the Avahi example code"""

314

logger.debug("Avahi entry group state change: %i", state)

202

logger.debug(u"Avahi entry group state change: %i", state)

315

203

316

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

317

logger.debug("Zeroconf service established.")

205

logger.debug(u"Zeroconf service established.")

318

206

elif state == avahi.ENTRY_GROUP_COLLISION:

319

logger.info("Zeroconf service name collision.")

207

logger.warning(u"Zeroconf service name collision.")

320

208

self.rename()

321

209

elif state == avahi.ENTRY_GROUP_FAILURE:

322

logger.critical("Avahi: Error in group state changed %s",

210

logger.critical(u"Avahi: Error in group state changed %s",

323

211

unicode(error))

324

raise AvahiGroupError("State changed: %s"

212

raise AvahiGroupError(u"State changed: %s"

325

213

% unicode(error))

326

214

def cleanup(self):

327

215

"""Derived from the Avahi example code"""

328

216

if self.group is not None:

329

try:

330

self.group.Free()

331

except (dbus.exceptions.UnknownMethodException,

332

dbus.exceptions.DBusException):

333

pass

217

self.group.Free()

334

218

self.group = None

335

self.remove()

336

def server_state_changed(self, state, error=None):

219

def server_state_changed(self, state):

337

220

"""Derived from the Avahi example code"""

338

logger.debug("Avahi server state change: %i", state)

339

bad_states = { avahi.SERVER_INVALID:

340

"Zeroconf server invalid",

341

avahi.SERVER_REGISTERING: None,

342

avahi.SERVER_COLLISION:

343

"Zeroconf server name collision",

344

avahi.SERVER_FAILURE:

345

"Zeroconf server failure" }

346

if state in bad_states:

347

if bad_states[state] is not None:

348

if error is None:

349

logger.error(bad_states[state])

350

else:

351

logger.error(bad_states[state] + ": %r", error)

352

self.cleanup()

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

353

225

elif state == avahi.SERVER_RUNNING:

354

226

self.add()

355

else:

356

if error is None:

357

logger.debug("Unknown state: %r", state)

358

else:

359

logger.debug("Unknown state: %r: %r", state, error)

360

227

def activate(self):

361

228

"""Derived from the Avahi example code"""

362

229

if self.server is None:

363

230

self.server = dbus.Interface(

364

231

self.bus.get_object(avahi.DBUS_NAME,

365

avahi.DBUS_PATH_SERVER,

366

follow_name_owner_changes=True),

232

avahi.DBUS_PATH_SERVER),

367

233

avahi.DBUS_INTERFACE_SERVER)

368

self.server.connect_to_signal("StateChanged",

234

self.server.connect_to_signal(u"StateChanged",

369

235

self.server_state_changed)

370

236

self.server_state_changed(self.server.GetState())

371

237

372

class AvahiServiceToSyslog(AvahiService):

373

def rename(self):

374

"""Add the new name to the syslog messages"""

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

380

return ret

381

238

382

def timedelta_to_milliseconds(td):

383

"Convert a datetime.timedelta() to milliseconds"

384

return ((td.days * 24 * 60 * 60 * 1000)

385

+ (td.seconds * 1000)

386

+ (td.microseconds // 1000))

387

388

239

class Client(object):

389

240

"""A representation of a client host served by this server.

390

241

391

242

Attributes:

392

approved: bool(); 'None' if not yet approved/disapproved

243

_approved: bool(); 'None' if not yet approved/disapproved

393

244

approval_delay: datetime.timedelta(); Time to wait for approval

394

245

approval_duration: datetime.timedelta(); Duration of one approval

395

246

checker: subprocess.Popen(); a running checker process used

402

253

instance %(name)s can be used in the command.

403

254

checker_initiator_tag: a gobject event source tag, or None

404

255

created: datetime.datetime(); (UTC) object creation

405

client_structure: Object describing what attributes a client has

406

and is used for storing the client at exit

407

256

current_checker_command: string; current running checker_command

257

disable_hook: If set, called by disable() as disable_hook(self)

408

258

disable_initiator_tag: a gobject event source tag, or None

409

259

enabled: bool()

410

260

fingerprint: string (40 or 32 hexadecimal digits); used to

413

263

interval: datetime.timedelta(); How often to start a new checker

414

264

last_approval_request: datetime.datetime(); (UTC) or None

415

265

last_checked_ok: datetime.datetime(); (UTC) or None

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, -2 means no checker completed yet.

419

last_enabled: datetime.datetime(); (UTC) or None

266

last_enabled: datetime.datetime(); (UTC)

420

267

421

268

D-Bus identifiers

422

269

secret: bytestring; sent verbatim (over TLS) to client

423

270

timeout: datetime.timedelta(); How long from last_checked_ok

424

271

until this client is disabled

425

extended_timeout: extra long timeout when secret has been sent

426

272

runtime_expansions: Allowed attributes for runtime expansion.

427

expires: datetime.datetime(); time (UTC) when a client will be

428

disabled, or None

429

273

"""

430

274

431

runtime_expansions = ("approval_delay", "approval_duration",

432

"created", "enabled", "fingerprint",

433

"host", "interval", "last_checked_ok",

434

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

@staticmethod

281

def _timedelta_to_milliseconds(td):

282

"Convert a datetime.timedelta() to milliseconds"

283

return ((td.days * 24 * 60 * 60 * 1000)

284

+ (td.seconds * 1000)

285

+ (td.microseconds // 1000))

445

286

446

287

def timeout_milliseconds(self):

447

288

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

449

450

def extended_timeout_milliseconds(self):

451

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

289

return self._timedelta_to_milliseconds(self.timeout)

453

290

454

291

def interval_milliseconds(self):

455

292

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

457

293

return self._timedelta_to_milliseconds(self.interval)

294

458

295

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

"""Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above.

466

NOTE: Must be a pure function. Must return the same result

467

value given the same arguments.

468

"""

469

settings = {}

470

for client_name in config.sections():

471

section = dict(config.items(client_name))

472

client = settings[client_name] = {}

473

474

client["host"] = section["host"]

475

# Reformat values from string types to Python types

476

client["approved_by_default"] = config.getboolean(

477

client_name, "approved_by_default")

478

client["enabled"] = config.getboolean(client_name,

479

"enabled")

480

481

client["fingerprint"] = (section["fingerprint"].upper()

482

.replace(" ", ""))

483

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

485

elif "secfile" in section:

486

with open(os.path.expanduser(os.path.expandvars

487

(section["secfile"])),

488

"rb") as secfile:

489

client["secret"] = secfile.read()

490

else:

491

raise TypeError("No secret or secfile for section %s"

492

% section)

493

client["timeout"] = string_to_delta(section["timeout"])

494

client["extended_timeout"] = string_to_delta(

495

section["extended_timeout"])

496

client["interval"] = string_to_delta(section["interval"])

497

client["approval_delay"] = string_to_delta(

498

section["approval_delay"])

499

client["approval_duration"] = string_to_delta(

500

section["approval_duration"])

501

client["checker_command"] = section["checker"]

502

client["last_approval_request"] = None

503

client["last_checked_ok"] = None

504

client["last_checker_status"] = -2

505

506

return settings

507

508

509

def __init__(self, settings, name = None):

296

return self._timedelta_to_milliseconds(self.approval_delay)

297

298

def __init__(self, name = None, disable_hook=None, config=None):

510

299

"""Note: the 'checker' key in 'config' sets the

511

300

'checker_command' attribute and *not* the 'checker'

512

301

attribute."""

513

302

self.name = name

514

# adding all client settings

515

for setting, value in settings.iteritems():

516

setattr(self, setting, value)

517

518

if self.enabled:

519

if not hasattr(self, "last_enabled"):

520

self.last_enabled = datetime.datetime.utcnow()

521

if not hasattr(self, "expires"):

522

self.expires = (datetime.datetime.utcnow()

523

+ self.timeout)

524

else:

525

self.last_enabled = None

526

self.expires = None

527

528

logger.debug("Creating client %r", self.name)

303

if config is None:

304

config = {}

305

logger.debug(u"Creating client %r", self.name)

529

306

# Uppercase and remove spaces from fingerprint for later

530

307

# comparison purposes with return value from the fingerprint()

531

308

# function

532

logger.debug(" Fingerprint: %s", self.fingerprint)

533

self.created = settings.get("created",

534

datetime.datetime.utcnow())

535

536

# attributes specific for this server instance

309

self.fingerprint = (config[u"fingerprint"].upper()

310

.replace(u" ", u""))

311

logger.debug(u" Fingerprint: %s", self.fingerprint)

312

if u"secret" in config:

313

self.secret = config[u"secret"].decode(u"base64")

314

elif u"secfile" in config:

315

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

317

"rb") as secfile:

318

self.secret = secfile.read()

319

else:

320

raise TypeError(u"No secret or secfile for client %s"

321

% self.name)

322

self.host = config.get(u"host", u"")

323

self.created = datetime.datetime.utcnow()

324

self.enabled = False

325

self.last_approval_request = None

326

self.last_enabled = None

327

self.last_checked_ok = None

328

self.timeout = string_to_delta(config[u"timeout"])

329

self.interval = string_to_delta(config[u"interval"])

330

self.disable_hook = disable_hook

537

331

self.checker = None

538

332

self.checker_initiator_tag = None

539

333

self.disable_initiator_tag = None

540

334

self.checker_callback_tag = None

335

self.checker_command = config[u"checker"]

541

336

self.current_checker_command = None

542

self.approved = None

337

self.last_connect = None

338

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

340

True)

543

341

self.approvals_pending = 0

544

self.changedstate = (multiprocessing_manager

545

.Condition(multiprocessing_manager

546

.Lock()))

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

549

if not attr.startswith("_")]

550

self.client_structure.append("client_structure")

551

552

for name, t in inspect.getmembers(type(self),

553

lambda obj:

554

isinstance(obj,

555

property)):

556

if not name.startswith("_"):

557

self.client_structure.append(name)

342

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

344

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

558

347

559

# Send notice to process children that client state has changed

560

348

def send_changedstate(self):

561

with self.changedstate:

562

self.changedstate.notify_all()

563

349

self.changedstate.acquire()

350

self.changedstate.notify_all()

351

self.changedstate.release()

352

564

353

def enable(self):

565

354

"""Start this client's checker and timeout hooks"""

566

if getattr(self, "enabled", False):

355

if getattr(self, u"enabled", False):

567

356

# Already enabled

568

357

return

569

358

self.send_changedstate()

570

self.expires = datetime.datetime.utcnow() + self.timeout

571

self.enabled = True

572

359

self.last_enabled = datetime.datetime.utcnow()

573

self.init_checker()

574

575

def disable(self, quiet=True):

576

"""Disable this client."""

577

if not getattr(self, "enabled", False):

578

return False

579

if not quiet:

580

self.send_changedstate()

581

if not quiet:

582

logger.info("Disabling client %s", self.name)

583

if getattr(self, "disable_initiator_tag", False):

584

gobject.source_remove(self.disable_initiator_tag)

585

self.disable_initiator_tag = None

586

self.expires = None

587

if getattr(self, "checker_initiator_tag", False):

588

gobject.source_remove(self.checker_initiator_tag)

589

self.checker_initiator_tag = None

590

self.stop_checker()

591

self.enabled = False

592

# Do not run this again if called by a gobject.timeout_add

593

return False

594

595

def __del__(self):

596

self.disable()

597

598

def init_checker(self):

599

360

# Schedule a new checker to be started an 'interval' from now,

600

361

# and every interval from then on.

601

362

self.checker_initiator_tag = (gobject.timeout_add

605

366

self.disable_initiator_tag = (gobject.timeout_add

606

367

(self.timeout_milliseconds(),

607

368

self.disable))

369

self.enabled = True

608

370

# Also start a new checker *right now*.

609

371

self.start_checker()

610

372

373

def disable(self, quiet=True):

374

"""Disable this client."""

375

if not getattr(self, "enabled", False):

376

return False

377

if not quiet:

378

self.send_changedstate()

379

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

381

if getattr(self, u"disable_initiator_tag", False):

382

gobject.source_remove(self.disable_initiator_tag)

383

self.disable_initiator_tag = None

384

if getattr(self, u"checker_initiator_tag", False):

385

gobject.source_remove(self.checker_initiator_tag)

386

self.checker_initiator_tag = None

387

self.stop_checker()

388

if self.disable_hook:

389

self.disable_hook(self)

390

self.enabled = False

391

# Do not run this again if called by a gobject.timeout_add

392

return False

393

394

def __del__(self):

395

self.disable_hook = None

396

self.disable()

397

611

398

def checker_callback(self, pid, condition, command):

612

399

"""The checker has completed, so take appropriate actions."""

613

400

self.checker_callback_tag = None

614

401

self.checker = None

615

402

if os.WIFEXITED(condition):

616

self.last_checker_status = os.WEXITSTATUS(condition)

617

if self.last_checker_status == 0:

618

logger.info("Checker for %(name)s succeeded",

403

exitstatus = os.WEXITSTATUS(condition)

404

if exitstatus == 0:

405

logger.info(u"Checker for %(name)s succeeded",

619

406

vars(self))

620

407

self.checked_ok()

621

408

else:

622

logger.info("Checker for %(name)s failed",

409

logger.info(u"Checker for %(name)s failed",

623

410

vars(self))

624

411

else:

625

self.last_checker_status = -1

626

logger.warning("Checker for %(name)s crashed?",

412

logger.warning(u"Checker for %(name)s crashed?",

627

413

vars(self))

628

414

629

415

def checked_ok(self):

630

"""Assert that the client has been seen, alive and well."""

416

"""Bump up the timeout for this client.

417

418

This should only be called when the client has been seen,

419

alive and well.

420

"""

631

421

self.last_checked_ok = datetime.datetime.utcnow()

632

self.last_checker_status = 0

633

self.bump_timeout()

634

635

def bump_timeout(self, timeout=None):

636

"""Bump up the timeout for this client."""

637

if timeout is None:

638

timeout = self.timeout

639

if self.disable_initiator_tag is not None:

640

gobject.source_remove(self.disable_initiator_tag)

641

if getattr(self, "enabled", False):

642

self.disable_initiator_tag = (gobject.timeout_add

643

(timedelta_to_milliseconds

644

(timeout), self.disable))

645

self.expires = datetime.datetime.utcnow() + timeout

422

gobject.source_remove(self.disable_initiator_tag)

423

self.disable_initiator_tag = (gobject.timeout_add

424

(self.timeout_milliseconds(),

425

self.disable))

646

426

647

427

def need_approval(self):

648

428

self.last_approval_request = datetime.datetime.utcnow()

664

444

# If a checker exists, make sure it is not a zombie

665

445

try:

666

446

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

667

except (AttributeError, OSError) as error:

447

except (AttributeError, OSError), error:

668

448

if (isinstance(error, OSError)

669

449

and error.errno != errno.ECHILD):

670

450

raise error

671

451

else:

672

452

if pid:

673

logger.warning("Checker was a zombie")

453

logger.warning(u"Checker was a zombie")

674

454

gobject.source_remove(self.checker_callback_tag)

675

455

self.checker_callback(pid, status,

676

456

self.current_checker_command)

683

463

# Escape attributes for the shell

684

464

escaped_attrs = dict(

685

465

(attr,

686

re.escape(unicode(str(getattr(self, attr, "")),

466

re.escape(unicode(str(getattr(self, attr, u"")),

687

467

errors=

688

'replace')))

468

u'replace')))

689

469

for attr in

690

470

self.runtime_expansions)

691

471

692

472

try:

693

473

command = self.checker_command % escaped_attrs

694

except TypeError as error:

695

logger.error('Could not format string "%s":'

696

' %s', self.checker_command, error)

474

except TypeError, error:

475

logger.error(u'Could not format string "%s":'

476

u' %s', self.checker_command, error)

697

477

return True # Try again later

698

478

self.current_checker_command = command

699

479

try:

700

logger.info("Starting checker %r for %s",

480

logger.info(u"Starting checker %r for %s",

701

481

command, self.name)

702

482

# We don't need to redirect stdout and stderr, since

703

483

# in normal mode, that is already done by daemon(),

705

485

# always replaced by /dev/null.)

706

486

self.checker = subprocess.Popen(command,

707

487

close_fds=True,

708

shell=True, cwd="/")

488

shell=True, cwd=u"/")

709

489

self.checker_callback_tag = (gobject.child_watch_add

710

490

(self.checker.pid,

711

491

self.checker_callback,

716

496

if pid:

717

497

gobject.source_remove(self.checker_callback_tag)

718

498

self.checker_callback(pid, status, command)

719

except OSError as error:

720

logger.error("Failed to start subprocess: %s",

499

except OSError, error:

500

logger.error(u"Failed to start subprocess: %s",

721

501

error)

722

502

# Re-run this periodically if run by gobject.timeout_add

723

503

return True

727

507

if self.checker_callback_tag:

728

508

gobject.source_remove(self.checker_callback_tag)

729

509

self.checker_callback_tag = None

730

if getattr(self, "checker", None) is None:

510

if getattr(self, u"checker", None) is None:

731

511

return

732

logger.debug("Stopping checker for %(name)s", vars(self))

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

733

513

try:

734

514

os.kill(self.checker.pid, signal.SIGTERM)

735

515

#time.sleep(0.5)

736

516

#if self.checker.poll() is None:

737

517

# os.kill(self.checker.pid, signal.SIGKILL)

738

except OSError as error:

518

except OSError, error:

739

519

if error.errno != errno.ESRCH: # No such process

740

520

raise

741

521

self.checker = None

742

522

743

744

def dbus_service_property(dbus_interface, signature="v",

745

access="readwrite", byte_arrays=False):

523

def dbus_service_property(dbus_interface, signature=u"v",

524

access=u"readwrite", byte_arrays=False):

746

525

"""Decorators for marking methods of a DBusObjectWithProperties to

747

526

become properties on the D-Bus.

748

527

755

534

"""

756

535

# Encoding deeply encoded byte arrays is not supported yet by the

757

536

# "Set" method, so we fail early here:

758

if byte_arrays and signature != "ay":

759

raise ValueError("Byte arrays not supported for non-'ay'"

760

" signature %r" % signature)

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

761

540

def decorator(func):

762

541

func._dbus_is_property = True

763

542

func._dbus_interface = dbus_interface

764

543

func._dbus_signature = signature

765

544

func._dbus_access = access

766

545

func._dbus_name = func.__name__

767

if func._dbus_name.endswith("_dbus_property"):

546

if func._dbus_name.endswith(u"_dbus_property"):

768

547

func._dbus_name = func._dbus_name[:-14]

769

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

548

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

770

549

return func

771

550

return decorator

772

551

792

571

793

572

class DBusObjectWithProperties(dbus.service.Object):

794

573

"""A D-Bus object with properties.

795

574

796

575

Classes inheriting from this can use the dbus_service_property

797

576

decorator to expose methods as D-Bus properties. It exposes the

798

577

standard Get(), Set(), and GetAll() methods on the D-Bus.

800

579

801

580

@staticmethod

802

581

def _is_dbus_property(obj):

803

return getattr(obj, "_dbus_is_property", False)

582

return getattr(obj, u"_dbus_is_property", False)

804

583

805

584

def _get_all_dbus_properties(self):

806

585

"""Returns a generator of (name, attribute) pairs

807

586

"""

808

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

809

for cls in self.__class__.__mro__

587

return ((prop._dbus_name, prop)

810

588

for name, prop in

811

inspect.getmembers(cls, self._is_dbus_property))

589

inspect.getmembers(self, self._is_dbus_property))

812

590

813

591

def _get_dbus_property(self, interface_name, property_name):

814

592

"""Returns a bound method if one exists which is a D-Bus

815

593

property with the specified name and interface.

816

594

"""

817

for cls in self.__class__.__mro__:

818

for name, value in (inspect.getmembers

819

(cls, self._is_dbus_property)):

820

if (value._dbus_name == property_name

821

and value._dbus_interface == interface_name):

822

return value.__get__(self)

823

595

for name in (property_name,

596

property_name + u"_dbus_property"):

597

prop = getattr(self, name, None)

598

if (prop is None

599

or not self._is_dbus_property(prop)

600

or prop._dbus_name != property_name

601

or (interface_name and prop._dbus_interface

602

and interface_name != prop._dbus_interface)):

603

continue

604

return prop

824

605

# No such property

825

raise DBusPropertyNotFound(self.dbus_object_path + ":"

826

+ interface_name + "."

606

raise DBusPropertyNotFound(self.dbus_object_path + u":"

607

+ interface_name + u"."

827

608

+ property_name)

828

609

829

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

830

out_signature="v")

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

611

out_signature=u"v")

831

612

def Get(self, interface_name, property_name):

832

613

"""Standard D-Bus property Get() method, see D-Bus standard.

833

614

"""

834

615

prop = self._get_dbus_property(interface_name, property_name)

835

if prop._dbus_access == "write":

616

if prop._dbus_access == u"write":

836

617

raise DBusPropertyAccessException(property_name)

837

618

value = prop()

838

if not hasattr(value, "variant_level"):

619

if not hasattr(value, u"variant_level"):

839

620

return value

840

621

return type(value)(value, variant_level=value.variant_level+1)

841

622

842

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

623

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

843

624

def Set(self, interface_name, property_name, value):

844

625

"""Standard D-Bus property Set() method, see D-Bus standard.

845

626

"""

846

627

prop = self._get_dbus_property(interface_name, property_name)

847

if prop._dbus_access == "read":

628

if prop._dbus_access == u"read":

848

629

raise DBusPropertyAccessException(property_name)

849

if prop._dbus_get_args_options["byte_arrays"]:

630

if prop._dbus_get_args_options[u"byte_arrays"]:

850

631

# The byte_arrays option is not supported yet on

851

632

# signatures other than "ay".

852

if prop._dbus_signature != "ay":

633

if prop._dbus_signature != u"ay":

853

634

raise ValueError

854

value = dbus.ByteArray(b''.join(chr(byte)

855

for byte in value))

635

value = dbus.ByteArray(''.join(unichr(byte)

636

for byte in value))

856

637

prop(value)

857

638

858

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

859

out_signature="a{sv}")

639

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

640

out_signature=u"a{sv}")

860

641

def GetAll(self, interface_name):

861

642

"""Standard D-Bus property GetAll() method, see D-Bus

862

643

standard.

863

644

864

645

Note: Will not include properties with access="write".

865

646

"""

866

properties = {}

647

all = {}

867

648

for name, prop in self._get_all_dbus_properties():

868

649

if (interface_name

869

650

and interface_name != prop._dbus_interface):

870

651

# Interface non-empty but did not match

871

652

continue

872

653

# Ignore write-only properties

873

if prop._dbus_access == "write":

654

if prop._dbus_access == u"write":

874

655

continue

875

656

value = prop()

876

if not hasattr(value, "variant_level"):

877

properties[name] = value

657

if not hasattr(value, u"variant_level"):

658

all[name] = value

878

659

continue

879

properties[name] = type(value)(value, variant_level=

880

value.variant_level+1)

881

return dbus.Dictionary(properties, signature="sv")

660

all[name] = type(value)(value, variant_level=

661

value.variant_level+1)

662

return dbus.Dictionary(all, signature=u"sv")

882

663

883

664

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

884

out_signature="s",

665

out_signature=u"s",

885

666

path_keyword='object_path',

886

667

connection_keyword='connection')

887

668

def Introspect(self, object_path, connection):

892

673

try:

893

674

document = xml.dom.minidom.parseString(xmlstring)

894

675

def make_tag(document, name, prop):

895

e = document.createElement("property")

896

e.setAttribute("name", name)

897

e.setAttribute("type", prop._dbus_signature)

898

e.setAttribute("access", prop._dbus_access)

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

899

680

return e

900

for if_tag in document.getElementsByTagName("interface"):

681

for if_tag in document.getElementsByTagName(u"interface"):

901

682

for tag in (make_tag(document, name, prop)

902

683

for name, prop

903

684

in self._get_all_dbus_properties()

904

685

if prop._dbus_interface

905

== if_tag.getAttribute("name")):

686

== if_tag.getAttribute(u"name")):

906

687

if_tag.appendChild(tag)

907

688

# Add the names to the return values for the

908

689

# "org.freedesktop.DBus.Properties" methods

909

if (if_tag.getAttribute("name")

910

== "org.freedesktop.DBus.Properties"):

911

for cn in if_tag.getElementsByTagName("method"):

912

if cn.getAttribute("name") == "Get":

913

for arg in cn.getElementsByTagName("arg"):

914

if (arg.getAttribute("direction")

915

== "out"):

916

arg.setAttribute("name", "value")

917

elif cn.getAttribute("name") == "GetAll":

918

for arg in cn.getElementsByTagName("arg"):

919

if (arg.getAttribute("direction")

920

== "out"):

921

arg.setAttribute("name", "props")

922

xmlstring = document.toxml("utf-8")

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

923

704

document.unlink()

924

705

except (AttributeError, xml.dom.DOMException,

925

xml.parsers.expat.ExpatError) as error:

926

logger.error("Failed to override Introspection method",

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

927

708

error)

928

709

return xmlstring

929

710

930

711

931

def datetime_to_dbus (dt, variant_level=0):

932

"""Convert a UTC datetime.datetime() to a D-Bus type."""

933

if dt is None:

934

return dbus.String("", variant_level = variant_level)

935

return dbus.String(dt.isoformat(),

936

variant_level=variant_level)

937

938

939

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

940

.__metaclass__):

941

"""Applied to an empty subclass of a D-Bus object, this metaclass

942

will add additional D-Bus attributes matching a certain pattern.

943

"""

944

def __new__(mcs, name, bases, attr):

945

# Go through all the base classes which could have D-Bus

946

# methods, signals, or properties in them

947

for base in (b for b in bases

948

if issubclass(b, dbus.service.Object)):

949

# Go though all attributes of the base class

950

for attrname, attribute in inspect.getmembers(base):

951

# Ignore non-D-Bus attributes, and D-Bus attributes

952

# with the wrong interface name

953

if (not hasattr(attribute, "_dbus_interface")

954

or not attribute._dbus_interface

955

.startswith("se.recompile.Mandos")):

956

continue

957

# Create an alternate D-Bus interface name based on

958

# the current name

959

alt_interface = (attribute._dbus_interface

960

.replace("se.recompile.Mandos",

961

"se.bsnet.fukt.Mandos"))

962

# Is this a D-Bus signal?

963

if getattr(attribute, "_dbus_is_signal", False):

964

# Extract the original non-method function by

965

# black magic

966

nonmethod_func = (dict(

967

zip(attribute.func_code.co_freevars,

968

attribute.__closure__))["func"]

969

.cell_contents)

970

# Create a new, but exactly alike, function

971

# object, and decorate it to be a new D-Bus signal

972

# with the alternate D-Bus interface name

973

new_function = (dbus.service.signal

974

(alt_interface,

975

attribute._dbus_signature)

976

(types.FunctionType(

977

nonmethod_func.func_code,

978

nonmethod_func.func_globals,

979

nonmethod_func.func_name,

980

nonmethod_func.func_defaults,

981

nonmethod_func.func_closure)))

982

# Define a creator of a function to call both the

983

# old and new functions, so both the old and new

984

# signals gets sent when the function is called

985

def fixscope(func1, func2):

986

"""This function is a scope container to pass

987

func1 and func2 to the "call_both" function

988

outside of its arguments"""

989

def call_both(*args, **kwargs):

990

"""This function will emit two D-Bus

991

signals by calling func1 and func2"""

992

func1(*args, **kwargs)

993

func2(*args, **kwargs)

994

return call_both

995

# Create the "call_both" function and add it to

996

# the class

997

attr[attrname] = fixscope(attribute,

998

new_function)

999

# Is this a D-Bus method?

1000

elif getattr(attribute, "_dbus_is_method", False):

1001

# Create a new, but exactly alike, function

1002

# object. Decorate it to be a new D-Bus method

1003

# with the alternate D-Bus interface name. Add it

1004

# to the class.

1005

attr[attrname] = (dbus.service.method

1006

(alt_interface,

1007

attribute._dbus_in_signature,

1008

attribute._dbus_out_signature)

1009

(types.FunctionType

1010

(attribute.func_code,

1011

attribute.func_globals,

1012

attribute.func_name,

1013

attribute.func_defaults,

1014

attribute.func_closure)))

1015

# Is this a D-Bus property?

1016

elif getattr(attribute, "_dbus_is_property", False):

1017

# Create a new, but exactly alike, function

1018

# object, and decorate it to be a new D-Bus

1019

# property with the alternate D-Bus interface

1020

# name. Add it to the class.

1021

attr[attrname] = (dbus_service_property

1022

(alt_interface,

1023

attribute._dbus_signature,

1024

attribute._dbus_access,

1025

attribute

1026

._dbus_get_args_options

1027

["byte_arrays"])

1028

(types.FunctionType

1029

(attribute.func_code,

1030

attribute.func_globals,

1031

attribute.func_name,

1032

attribute.func_defaults,

1033

attribute.func_closure)))

1034

return type.__new__(mcs, name, bases, attr)

1035

1036

1037

712

class ClientDBus(Client, DBusObjectWithProperties):

1038

713

"""A Client class using D-Bus

1039

714

1043

718

"""

1044

719

1045

720

runtime_expansions = (Client.runtime_expansions

1046

+ ("dbus_object_path",))

721

+ (u"dbus_object_path",))

1047

722

1048

723

# dbus.service.Object doesn't use super(), so we can't either.

1049

724

1050

725

def __init__(self, bus = None, *args, **kwargs):

726

self._approvals_pending = 0

1051

727

self.bus = bus

1052

728

Client.__init__(self, *args, **kwargs)

1053

729

# Only now, when this client is initialized, can it show up on

1054

730

# the D-Bus

1055

731

client_object_name = unicode(self.name).translate(

1056

{ord("."): ord("_"),

1057

ord("-"): ord("_")})

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

1058

734

self.dbus_object_path = (dbus.ObjectPath

1059

("/clients/" + client_object_name))

735

(u"/clients/" + client_object_name))

1060

736

DBusObjectWithProperties.__init__(self, self.bus,

1061

737

self.dbus_object_path)

1062

738

1063

def notifychangeproperty(transform_func,

1064

dbus_name, type_func=lambda x: x,

1065

variant_level=1):

1066

""" Modify a variable so that it's a property which announces

1067

its changes to DBus.

1068

1069

transform_fun: Function that takes a value and a variant_level

1070

and transforms it to a D-Bus type.

1071

dbus_name: D-Bus name of the variable

1072

type_func: Function that transform the value before sending it

1073

to the D-Bus. Default: no transform

1074

variant_level: D-Bus variant level. Default: 1

1075

"""

1076

attrname = "_{0}".format(dbus_name)

1077

def setter(self, value):

1078

if hasattr(self, "dbus_object_path"):

1079

if (not hasattr(self, attrname) or

1080

type_func(getattr(self, attrname, None))

1081

!= type_func(value)):

1082

dbus_value = transform_func(type_func(value),

1083

variant_level

1084

=variant_level)

1085

self.PropertyChanged(dbus.String(dbus_name),

1086

dbus_value)

1087

setattr(self, attrname, value)

1088

1089

return property(lambda self: getattr(self, attrname), setter)

1090

1091

1092

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1093

approvals_pending = notifychangeproperty(dbus.Boolean,

1094

"ApprovalPending",

1095

type_func = bool)

1096

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1097

last_enabled = notifychangeproperty(datetime_to_dbus,

1098

"LastEnabled")

1099

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1100

type_func = lambda checker:

1101

checker is not None)

1102

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1103

"LastCheckedOK")

1104

last_checker_status = notifychangeproperty(dbus.Int16,

1105

"LastCheckerStatus")

1106

last_approval_request = notifychangeproperty(

1107

datetime_to_dbus, "LastApprovalRequest")

1108

approved_by_default = notifychangeproperty(dbus.Boolean,

1109

"ApprovedByDefault")

1110

approval_delay = notifychangeproperty(dbus.UInt64,

1111

"ApprovalDelay",

1112

type_func =

1113

timedelta_to_milliseconds)

1114

approval_duration = notifychangeproperty(

1115

dbus.UInt64, "ApprovalDuration",

1116

type_func = timedelta_to_milliseconds)

1117

host = notifychangeproperty(dbus.String, "Host")

1118

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1119

type_func =

1120

timedelta_to_milliseconds)

1121

extended_timeout = notifychangeproperty(

1122

dbus.UInt64, "ExtendedTimeout",

1123

type_func = timedelta_to_milliseconds)

1124

interval = notifychangeproperty(dbus.UInt64,

1125

"Interval",

1126

type_func =

1127

timedelta_to_milliseconds)

1128

checker_command = notifychangeproperty(dbus.String, "Checker")

1129

1130

del notifychangeproperty

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

750

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

755

@staticmethod

756

def _datetime_to_dbus(dt, variant_level=0):

757

"""Convert a UTC datetime.datetime() to a D-Bus type."""

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

def enable(self):

762

oldstate = getattr(self, u"enabled", False)

763

r = Client.enable(self)

764

if oldstate != self.enabled:

765

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

767

dbus.Boolean(True, variant_level=1))

768

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

770

self._datetime_to_dbus(self.last_enabled,

771

variant_level=1))

772

return r

773

774

def disable(self, quiet = False):

775

oldstate = getattr(self, u"enabled", False)

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

778

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

780

dbus.Boolean(False, variant_level=1))

781

return r

1131

782

1132

783

def __del__(self, *args, **kwargs):

1133

784

try:

1134

785

self.remove_from_connection()

1135

786

except LookupError:

1136

787

pass

1137

if hasattr(DBusObjectWithProperties, "__del__"):

788

if hasattr(DBusObjectWithProperties, u"__del__"):

1138

789

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1139

790

Client.__del__(self, *args, **kwargs)

1140

791

1142

793

*args, **kwargs):

1143

794

self.checker_callback_tag = None

1144

795

self.checker = None

796

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

798

dbus.Boolean(False, variant_level=1))

1145

799

if os.WIFEXITED(condition):

1146

800

exitstatus = os.WEXITSTATUS(condition)

1147

801

# Emit D-Bus signal

1157

811

return Client.checker_callback(self, pid, condition, command,

1158

812

*args, **kwargs)

1159

813

814

def checked_ok(self, *args, **kwargs):

815

r = Client.checked_ok(self, *args, **kwargs)

816

# Emit D-Bus signal

817

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

819

(self._datetime_to_dbus(self.last_checked_ok,

820

variant_level=1)))

821

return r

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

1160

832

def start_checker(self, *args, **kwargs):

1161

833

old_checker = self.checker

1162

834

if self.checker is not None:

1169

841

and old_checker_pid != self.checker.pid):

1170

842

# Emit D-Bus signal

1171

843

self.CheckerStarted(self.current_checker_command)

844

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

846

dbus.Boolean(True, variant_level=1))

1172

847

return r

1173

848

849

def stop_checker(self, *args, **kwargs):

850

old_checker = getattr(self, u"checker", None)

851

r = Client.stop_checker(self, *args, **kwargs)

852

if (old_checker is not None

853

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

855

dbus.Boolean(False, variant_level=1))

856

return r

857

1174

858

def _reset_approved(self):

1175

self.approved = None

859

self._approved = None

1176

860

return False

1177

861

1178

862

def approve(self, value=True):

1179

863

self.send_changedstate()

1180

self.approved = value

1181

gobject.timeout_add(timedelta_to_milliseconds

864

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

1182

866

(self.approval_duration),

1183

867

self._reset_approved)

1184

868

1185

869

1186

870

## D-Bus methods, signals & properties

1187

_interface = "se.recompile.Mandos.Client"

871

_interface = u"se.bsnet.fukt.Mandos.Client"

1188

872

1189

873

## Signals

1190

874

1191

875

# CheckerCompleted - signal

1192

@dbus.service.signal(_interface, signature="nxs")

876

@dbus.service.signal(_interface, signature=u"nxs")

1193

877

def CheckerCompleted(self, exitcode, waitstatus, command):

1194

878

"D-Bus signal"

1195

879

pass

1196

880

1197

881

# CheckerStarted - signal

1198

@dbus.service.signal(_interface, signature="s")

882

@dbus.service.signal(_interface, signature=u"s")

1199

883

def CheckerStarted(self, command):

1200

884

"D-Bus signal"

1201

885

pass

1202

886

1203

887

# PropertyChanged - signal

1204

@dbus.service.signal(_interface, signature="sv")

888

@dbus.service.signal(_interface, signature=u"sv")

1205

889

def PropertyChanged(self, property, value):

1206

890

"D-Bus signal"

1207

891

pass

1216

900

pass

1217

901

1218

902

# Rejected - signal

1219

@dbus.service.signal(_interface, signature="s")

903

@dbus.service.signal(_interface, signature=u"s")

1220

904

def Rejected(self, reason):

1221

905

"D-Bus signal"

1222

906

pass

1223

907

1224

908

# NeedApproval - signal

1225

@dbus.service.signal(_interface, signature="tb")

909

@dbus.service.signal(_interface, signature=u"tb")

1226

910

def NeedApproval(self, timeout, default):

1227

911

"D-Bus signal"

1228

912

return self.need_approval()

1230

914

## Methods

1231

915

1232

916

# Approve - method

1233

@dbus.service.method(_interface, in_signature="b")

917

@dbus.service.method(_interface, in_signature=u"b")

1234

918

def Approve(self, value):

1235

919

self.approve(value)

1236

920

1237

921

# CheckedOK - method

1238

922

@dbus.service.method(_interface)

1239

923

def CheckedOK(self):

1240

self.checked_ok()

924

return self.checked_ok()

1241

925

1242

926

# Enable - method

1243

927

@dbus.service.method(_interface)

1265

949

## Properties

1266

950

1267

951

# ApprovalPending - property

1268

@dbus_service_property(_interface, signature="b", access="read")

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

1269

953

def ApprovalPending_dbus_property(self):

1270

954

return dbus.Boolean(bool(self.approvals_pending))

1271

955

1272

956

# ApprovedByDefault - property

1273

@dbus_service_property(_interface, signature="b",

1274

access="readwrite")

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

1275

959

def ApprovedByDefault_dbus_property(self, value=None):

1276

960

if value is None: # get

1277

961

return dbus.Boolean(self.approved_by_default)

1278

962

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

1279

966

1280

967

# ApprovalDelay - property

1281

@dbus_service_property(_interface, signature="t",

1282

access="readwrite")

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

1283

970

def ApprovalDelay_dbus_property(self, value=None):

1284

971

if value is None: # get

1285

972

return dbus.UInt64(self.approval_delay_milliseconds())

1286

973

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

1287

977

1288

978

# ApprovalDuration - property

1289

@dbus_service_property(_interface, signature="t",

1290

access="readwrite")

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

1291

981

def ApprovalDuration_dbus_property(self, value=None):

1292

982

if value is None: # get

1293

return dbus.UInt64(timedelta_to_milliseconds(

983

return dbus.UInt64(self._timedelta_to_milliseconds(

1294

984

self.approval_duration))

1295

985

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

1296

989

1297

990

# Name - property

1298

@dbus_service_property(_interface, signature="s", access="read")

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

1299

992

def Name_dbus_property(self):

1300

993

return dbus.String(self.name)

1301

994

1302

995

# Fingerprint - property

1303

@dbus_service_property(_interface, signature="s", access="read")

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

1304

997

def Fingerprint_dbus_property(self):

1305

998

return dbus.String(self.fingerprint)

1306

999

1307

1000

# Host - property

1308

@dbus_service_property(_interface, signature="s",

1309

access="readwrite")

1001

@dbus_service_property(_interface, signature=u"s",

1002

access=u"readwrite")

1310

1003

def Host_dbus_property(self, value=None):

1311

1004

if value is None: # get

1312

1005

return dbus.String(self.host)

1313

self.host = unicode(value)

1006

self.host = value

1007

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

1009

dbus.String(value, variant_level=1))

1314

1010

1315

1011

# Created - property

1316

@dbus_service_property(_interface, signature="s", access="read")

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

1317

1013

def Created_dbus_property(self):

1318

return datetime_to_dbus(self.created)

1014

return dbus.String(self._datetime_to_dbus(self.created))

1319

1015

1320

1016

# LastEnabled - property

1321

@dbus_service_property(_interface, signature="s", access="read")

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

1322

1018

def LastEnabled_dbus_property(self):

1323

return datetime_to_dbus(self.last_enabled)

1019

if self.last_enabled is None:

1020

return dbus.String(u"")

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1324

1022

1325

1023

# Enabled - property

1326

@dbus_service_property(_interface, signature="b",

1327

access="readwrite")

1024

@dbus_service_property(_interface, signature=u"b",

1025

access=u"readwrite")

1328

1026

def Enabled_dbus_property(self, value=None):

1329

1027

if value is None: # get

1330

1028

return dbus.Boolean(self.enabled)

1334

1032

self.disable()

1335

1033

1336

1034

# LastCheckedOK - property

1337

@dbus_service_property(_interface, signature="s",

1338

access="readwrite")

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1339

1037

def LastCheckedOK_dbus_property(self, value=None):

1340

1038

if value is not None:

1341

1039

self.checked_ok()

1342

1040

return

1343

return datetime_to_dbus(self.last_checked_ok)

1344

1345

# LastCheckerStatus - property

1346

@dbus_service_property(_interface, signature="n",

1347

access="read")

1348

def LastCheckerStatus_dbus_property(self):

1349

return dbus.Int16(self.last_checker_status)

1350

1351

# Expires - property

1352

@dbus_service_property(_interface, signature="s", access="read")

1353

def Expires_dbus_property(self):

1354

return datetime_to_dbus(self.expires)

1041

if self.last_checked_ok is None:

1042

return dbus.String(u"")

1043

return dbus.String(self._datetime_to_dbus(self

1044

.last_checked_ok))

1355

1045

1356

1046

# LastApprovalRequest - property

1357

@dbus_service_property(_interface, signature="s", access="read")

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1358

1048

def LastApprovalRequest_dbus_property(self):

1359

return datetime_to_dbus(self.last_approval_request)

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1360

1054

1361

1055

# Timeout - property

1362

@dbus_service_property(_interface, signature="t",

1363

access="readwrite")

1056

@dbus_service_property(_interface, signature=u"t",

1057

access=u"readwrite")

1364

1058

def Timeout_dbus_property(self, value=None):

1365

1059

if value is None: # get

1366

1060

return dbus.UInt64(self.timeout_milliseconds())

1367

1061

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

1064

dbus.UInt64(value, variant_level=1))

1065

if getattr(self, u"disable_initiator_tag", None) is None:

1066

return

1368

1067

# Reschedule timeout

1369

if self.enabled:

1370

now = datetime.datetime.utcnow()

1371

time_to_die = timedelta_to_milliseconds(

1372

(self.last_checked_ok + self.timeout) - now)

1373

if time_to_die <= 0:

1374

# The timeout has passed

1375

self.disable()

1376

else:

1377

self.expires = (now +

1378

datetime.timedelta(milliseconds =

1379

time_to_die))

1380

if (getattr(self, "disable_initiator_tag", None)

1381

is None):

1382

return

1383

gobject.source_remove(self.disable_initiator_tag)

1384

self.disable_initiator_tag = (gobject.timeout_add

1385

(time_to_die,

1386

self.disable))

1387

1388

# ExtendedTimeout - property

1389

@dbus_service_property(_interface, signature="t",

1390

access="readwrite")

1391

def ExtendedTimeout_dbus_property(self, value=None):

1392

if value is None: # get

1393

return dbus.UInt64(self.extended_timeout_milliseconds())

1394

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1068

gobject.source_remove(self.disable_initiator_tag)

1069

self.disable_initiator_tag = None

1070

time_to_die = (self.

1071

_timedelta_to_milliseconds((self

1072

.last_checked_ok

1073

+ self.timeout)

1074

- datetime.datetime

1075

.utcnow()))

1076

if time_to_die <= 0:

1077

# The timeout has passed

1078

self.disable()

1079

else:

1080

self.disable_initiator_tag = (gobject.timeout_add

1081

(time_to_die, self.disable))

1395

1082

1396

1083

# Interval - property

1397

@dbus_service_property(_interface, signature="t",

1398

access="readwrite")

1084

@dbus_service_property(_interface, signature=u"t",

1085

access=u"readwrite")

1399

1086

def Interval_dbus_property(self, value=None):

1400

1087

if value is None: # get

1401

1088

return dbus.UInt64(self.interval_milliseconds())

1402

1089

self.interval = datetime.timedelta(0, 0, 0, value)

1403

if getattr(self, "checker_initiator_tag", None) is None:

1090

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

1092

dbus.UInt64(value, variant_level=1))

1093

if getattr(self, u"checker_initiator_tag", None) is None:

1404

1094

return

1405

if self.enabled:

1406

# Reschedule checker run

1407

gobject.source_remove(self.checker_initiator_tag)

1408

self.checker_initiator_tag = (gobject.timeout_add

1409

(value, self.start_checker))

1410

self.start_checker() # Start one now, too

1411

1095

# Reschedule checker run

1096

gobject.source_remove(self.checker_initiator_tag)

1097

self.checker_initiator_tag = (gobject.timeout_add

1098

(value, self.start_checker))

1099

self.start_checker() # Start one now, too

1100

1412

1101

# Checker - property

1413

@dbus_service_property(_interface, signature="s",

1414

access="readwrite")

1102

@dbus_service_property(_interface, signature=u"s",

1103

access=u"readwrite")

1415

1104

def Checker_dbus_property(self, value=None):

1416

1105

if value is None: # get

1417

1106

return dbus.String(self.checker_command)

1418

self.checker_command = unicode(value)

1107

self.checker_command = value

1108

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1110

dbus.String(self.checker_command,

1111

variant_level=1))

1419

1112

1420

1113

# CheckerRunning - property

1421

@dbus_service_property(_interface, signature="b",

1422

access="readwrite")

1114

@dbus_service_property(_interface, signature=u"b",

1115

access=u"readwrite")

1423

1116

def CheckerRunning_dbus_property(self, value=None):

1424

1117

if value is None: # get

1425

1118

return dbus.Boolean(self.checker is not None)

1429

1122

self.stop_checker()

1430

1123

1431

1124

# ObjectPath - property

1432

@dbus_service_property(_interface, signature="o", access="read")

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

1433

1126

def ObjectPath_dbus_property(self):

1434

1127

return self.dbus_object_path # is already a dbus.ObjectPath

1435

1128

1436

1129

# Secret = property

1437

@dbus_service_property(_interface, signature="ay",

1438

access="write", byte_arrays=True)

1130

@dbus_service_property(_interface, signature=u"ay",

1131

access=u"write", byte_arrays=True)

1439

1132

def Secret_dbus_property(self, value):

1440

1133

self.secret = str(value)

1441

1134

1448

1141

self._pipe.send(('init', fpr, address))

1449

1142

if not self._pipe.recv():

1450

1143

raise KeyError()

1451

1144

1452

1145

def __getattribute__(self, name):

1453

if name == '_pipe':

1146

if(name == '_pipe'):

1454

1147

return super(ProxyClient, self).__getattribute__(name)

1455

1148

self._pipe.send(('getattr', name))

1456

1149

data = self._pipe.recv()

1461

1154

self._pipe.send(('funcall', name, args, kwargs))

1462

1155

return self._pipe.recv()[1]

1463

1156

return func

1464

1157

1465

1158

def __setattr__(self, name, value):

1466

if name == '_pipe':

1159

if(name == '_pipe'):

1467

1160

return super(ProxyClient, self).__setattr__(name, value)

1468

1161

self._pipe.send(('setattr', name, value))

1469

1162

1470

1163

1471

class ClientDBusTransitional(ClientDBus):

1472

__metaclass__ = AlternateDBusNamesMetaclass

1473

1474

1475

1164

class ClientHandler(socketserver.BaseRequestHandler, object):

1476

1165

"""A class to handle client connections.

1477

1166

1480

1169

1481

1170

def handle(self):

1482

1171

with contextlib.closing(self.server.child_pipe) as child_pipe:

1483

logger.info("TCP connection from: %s",

1172

logger.info(u"TCP connection from: %s",

1484

1173

unicode(self.client_address))

1485

logger.debug("Pipe FD: %d",

1174

logger.debug(u"Pipe FD: %d",

1486

1175

self.server.child_pipe.fileno())

1487

1176

1488

1177

session = (gnutls.connection

1489

1178

.ClientSession(self.request,

1490

1179

gnutls.connection

1491

1180

.X509Credentials()))

1492

1181

1493

1182

# Note: gnutls.connection.X509Credentials is really a

1494

1183

# generic GnuTLS certificate credentials object so long as

1495

1184

# no X.509 keys are added to it. Therefore, we can use it

1496

1185

# here despite using OpenPGP certificates.

1497

1498

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1499

# "+AES-256-CBC", "+SHA1",

1500

# "+COMP-NULL", "+CTYPE-OPENPGP",

1501

# "+DHE-DSS"))

1186

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1188

# u"+AES-256-CBC", u"+SHA1",

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1190

# u"+DHE-DSS"))

1502

1191

# Use a fallback default, since this MUST be set.

1503

1192

priority = self.server.gnutls_priority

1504

1193

if priority is None:

1505

priority = "NORMAL"

1194

priority = u"NORMAL"

1506

1195

(gnutls.library.functions

1507

1196

.gnutls_priority_set_direct(session._c_object,

1508

1197

priority, None))

1509

1198

1510

1199

# Start communication using the Mandos protocol

1511

1200

# Get protocol number

1512

1201

line = self.request.makefile().readline()

1513

logger.debug("Protocol version: %r", line)

1202

logger.debug(u"Protocol version: %r", line)

1514

1203

try:

1515

1204

if int(line.strip().split()[0]) > 1:

1516

1205

raise RuntimeError

1517

except (ValueError, IndexError, RuntimeError) as error:

1518

logger.error("Unknown protocol version: %s", error)

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1519

1208

return

1520

1209

1521

1210

# Start GnuTLS connection

1522

1211

try:

1523

1212

session.handshake()

1524

except gnutls.errors.GNUTLSError as error:

1525

logger.warning("Handshake failed: %s", error)

1213

except gnutls.errors.GNUTLSError, error:

1214

logger.warning(u"Handshake failed: %s", error)

1526

1215

# Do not run session.bye() here: the session is not

1527

1216

# established. Just abandon the request.

1528

1217

return

1529

logger.debug("Handshake succeeded")

1530

1218

logger.debug(u"Handshake succeeded")

1219

1531

1220

approval_required = False

1532

1221

try:

1533

1222

try:

1534

1223

fpr = self.fingerprint(self.peer_certificate

1535

1224

(session))

1536

except (TypeError,

1537

gnutls.errors.GNUTLSError) as error:

1538

logger.warning("Bad certificate: %s", error)

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1539

1227

return

1540

logger.debug("Fingerprint: %s", fpr)

1541

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1542

1230

try:

1543

1231

client = ProxyClient(child_pipe, fpr,

1544

1232

self.client_address)

1552

1240

1553

1241

while True:

1554

1242

if not client.enabled:

1555

logger.info("Client %s is disabled",

1243

logger.warning(u"Client %s is disabled",

1556

1244

client.name)

1557

1245

if self.server.use_dbus:

1558

1246

# Emit D-Bus signal

1559

client.Rejected("Disabled")

1247

client.Rejected("Disabled")

1560

1248

return

1561

1249

1562

if client.approved or not client.approval_delay:

1250

if client._approved or not client.approval_delay:

1563

1251

#We are approved or approval is disabled

1564

1252

break

1565

elif client.approved is None:

1566

logger.info("Client %s needs approval",

1253

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1567

1255

client.name)

1568

1256

if self.server.use_dbus:

1569

1257

# Emit D-Bus signal

1571

1259

client.approval_delay_milliseconds(),

1572

1260

client.approved_by_default)

1573

1261

else:

1574

logger.warning("Client %s was not approved",

1262

logger.warning(u"Client %s was not approved",

1575

1263

client.name)

1576

1264

if self.server.use_dbus:

1577

1265

# Emit D-Bus signal

1579

1267

return

1580

1268

1581

1269

#wait until timeout or approved

1270

#x = float(client._timedelta_to_milliseconds(delay))

1582

1271

time = datetime.datetime.now()

1583

1272

client.changedstate.acquire()

1584

(client.changedstate.wait

1585

(float(client.timedelta_to_milliseconds(delay)

1586

/ 1000)))

1273

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1587

1274

client.changedstate.release()

1588

1275

time2 = datetime.datetime.now()

1589

1276

if (time2 - time) >= delay:

1604

1291

while sent_size < len(client.secret):

1605

1292

try:

1606

1293

sent = session.send(client.secret[sent_size:])

1607

except gnutls.errors.GNUTLSError as error:

1294

except (gnutls.errors.GNUTLSError), error:

1608

1295

logger.warning("gnutls send failed")

1609

1296

return

1610

logger.debug("Sent: %d, remaining: %d",

1297

logger.debug(u"Sent: %d, remaining: %d",

1611

1298

sent, len(client.secret)

1612

1299

- (sent_size + sent))

1613

1300

sent_size += sent

1614

1615

logger.info("Sending secret to %s", client.name)

1616

# bump the timeout using extended_timeout

1617

client.bump_timeout(client.extended_timeout)

1301

1302

logger.info(u"Sending secret to %s", client.name)

1303

# bump the timeout as if seen

1304

client.checked_ok()

1618

1305

if self.server.use_dbus:

1619

1306

# Emit D-Bus signal

1620

1307

client.GotSecret()

1624

1311

client.approvals_pending -= 1

1625

1312

try:

1626

1313

session.bye()

1627

except gnutls.errors.GNUTLSError as error:

1314

except (gnutls.errors.GNUTLSError), error:

1628

1315

logger.warning("GnuTLS bye failed")

1629

1316

1630

1317

@staticmethod

1641

1328

.gnutls_certificate_get_peers

1642

1329

(session._c_object, ctypes.byref(list_size)))

1643

1330

if not bool(cert_list) and list_size.value != 0:

1644

raise gnutls.errors.GNUTLSError("error getting peer"

1645

" certificate")

1331

raise gnutls.errors.GNUTLSError(u"error getting peer"

1332

u" certificate")

1646

1333

if list_size.value == 0:

1647

1334

return None

1648

1335

cert = cert_list[0]

1674

1361

if crtverify.value != 0:

1675

1362

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1676

1363

raise (gnutls.errors.CertificateSecurityError

1677

("Verify failed"))

1364

(u"Verify failed"))

1678

1365

# New buffer for the fingerprint

1679

1366

buf = ctypes.create_string_buffer(20)

1680

1367

buf_len = ctypes.c_size_t()

1687

1374

# Convert the buffer to a Python bytestring

1688

1375

fpr = ctypes.string_at(buf, buf_len.value)

1689

1376

# Convert the bytestring to hexadecimal notation

1690

hex_fpr = binascii.hexlify(fpr).upper()

1377

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1691

1378

return hex_fpr

1692

1379

1693

1380

1696

1383

def sub_process_main(self, request, address):

1697

1384

try:

1698

1385

self.finish_request(request, address)

1699

except Exception:

1386

except:

1700

1387

self.handle_error(request, address)

1701

1388

self.close_request(request)

1702

1389

1703

1390

def process_request(self, request, address):

1704

1391

"""Start a new process to process the request."""

1705

proc = multiprocessing.Process(target = self.sub_process_main,

1706

args = (request,

1707

address))

1708

proc.start()

1709

return proc

1710

1392

multiprocessing.Process(target = self.sub_process_main,

1393

args = (request, address)).start()

1711

1394

1712

1395

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1713

1396

""" adds a pipe to the MixIn """

1717

1400

This function creates a new pipe in self.pipe

1718

1401

"""

1719

1402

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1720

1721

proc = MultiprocessingMixIn.process_request(self, request,

1722

client_address)

1403

1404

super(MultiprocessingMixInWithPipe,

1405

self).process_request(request, client_address)

1723

1406

self.child_pipe.close()

1724

self.add_pipe(parent_pipe, proc)

1725

1726

def add_pipe(self, parent_pipe, proc):

1407

self.add_pipe(parent_pipe)

1408

1409

def add_pipe(self, parent_pipe):

1727

1410

"""Dummy function; override as necessary"""

1728

raise NotImplementedError

1729

1411

pass

1730

1412

1731

1413

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1732

1414

socketserver.TCPServer, object):

1750

1432

bind to an address or port if they were not specified."""

1751

1433

if self.interface is not None:

1752

1434

if SO_BINDTODEVICE is None:

1753

logger.error("SO_BINDTODEVICE does not exist;"

1754

" cannot bind to interface %s",

1435

logger.error(u"SO_BINDTODEVICE does not exist;"

1436

u" cannot bind to interface %s",

1755

1437

self.interface)

1756

1438

else:

1757

1439

try:

1758

1440

self.socket.setsockopt(socket.SOL_SOCKET,

1759

1441

SO_BINDTODEVICE,

1760

1442

str(self.interface

1761

+ '\0'))

1762

except socket.error as error:

1443

+ u'\0'))

1444

except socket.error, error:

1763

1445

if error[0] == errno.EPERM:

1764

logger.error("No permission to"

1765

" bind to interface %s",

1446

logger.error(u"No permission to"

1447

u" bind to interface %s",

1766

1448

self.interface)

1767

1449

elif error[0] == errno.ENOPROTOOPT:

1768

logger.error("SO_BINDTODEVICE not available;"

1769

" cannot bind to interface %s",

1450

logger.error(u"SO_BINDTODEVICE not available;"

1451

u" cannot bind to interface %s",

1770

1452

self.interface)

1771

1453

else:

1772

1454

raise

1774

1456

if self.server_address[0] or self.server_address[1]:

1775

1457

if not self.server_address[0]:

1776

1458

if self.address_family == socket.AF_INET6:

1777

any_address = "::" # in6addr_any

1459

any_address = u"::" # in6addr_any

1778

1460

else:

1779

1461

any_address = socket.INADDR_ANY

1780

1462

self.server_address = (any_address,

1807

1489

self.enabled = False

1808

1490

self.clients = clients

1809

1491

if self.clients is None:

1810

self.clients = {}

1492

self.clients = set()

1811

1493

self.use_dbus = use_dbus

1812

1494

self.gnutls_priority = gnutls_priority

1813

1495

IPv6_TCPServer.__init__(self, server_address,

1817

1499

def server_activate(self):

1818

1500

if self.enabled:

1819

1501

return socketserver.TCPServer.server_activate(self)

1820

1821

1502

def enable(self):

1822

1503

self.enabled = True

1823

1824

def add_pipe(self, parent_pipe, proc):

1504

def add_pipe(self, parent_pipe):

1825

1505

# Call "handle_ipc" for both data and EOF events

1826

1506

gobject.io_add_watch(parent_pipe.fileno(),

1827

1507

gobject.IO_IN | gobject.IO_HUP,

1828

1508

functools.partial(self.handle_ipc,

1829

parent_pipe =

1830

parent_pipe,

1831

proc = proc))

1832

1509

parent_pipe = parent_pipe))

1510

1833

1511

def handle_ipc(self, source, condition, parent_pipe=None,

1834

proc = None, client_object=None):

1512

client_object=None):

1835

1513

condition_names = {

1836

gobject.IO_IN: "IN", # There is data to read.

1837

gobject.IO_OUT: "OUT", # Data can be written (without

1514

gobject.IO_IN: u"IN", # There is data to read.

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

1838

1516

# blocking).

1839

gobject.IO_PRI: "PRI", # There is urgent data to read.

1840

gobject.IO_ERR: "ERR", # Error condition.

1841

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1517

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1518

gobject.IO_ERR: u"ERR", # Error condition.

1519

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1842

1520

# broken, usually for pipes and

1843

1521

# sockets).

1844

1522

}

1846

1524

for cond, name in

1847

1525

condition_names.iteritems()

1848

1526

if cond & condition)

1849

# error, or the other end of multiprocessing.Pipe has closed

1527

# error or the other end of multiprocessing.Pipe has closed

1850

1528

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1851

# Wait for other process to exit

1852

proc.join()

1853

1529

return False

1854

1530

1855

1531

# Read a request from the child

1860

1536

fpr = request[1]

1861

1537

address = request[2]

1862

1538

1863

for c in self.clients.itervalues():

1539

for c in self.clients:

1864

1540

if c.fingerprint == fpr:

1865

1541

client = c

1866

1542

break

1867

1543

else:

1868

logger.info("Client not found for fingerprint: %s, ad"

1869

"dress: %s", fpr, address)

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1870

1546

if self.use_dbus:

1871

1547

# Emit D-Bus signal

1872

mandos_dbus_service.ClientNotFound(fpr,

1873

address[0])

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1874

1549

parent_pipe.send(False)

1875

1550

return False

1876

1551

1877

1552

gobject.io_add_watch(parent_pipe.fileno(),

1878

1553

gobject.IO_IN | gobject.IO_HUP,

1879

1554

functools.partial(self.handle_ipc,

1880

parent_pipe =

1881

parent_pipe,

1882

proc = proc,

1883

client_object =

1884

client))

1555

parent_pipe = parent_pipe,

1556

client_object = client))

1885

1557

parent_pipe.send(True)

1886

# remove the old hook in favor of the new above hook on

1887

# same fileno

1558

# remove the old hook in favor of the new above hook on same fileno

1888

1559

return False

1889

1560

if command == 'funcall':

1890

1561

funcname = request[1]

1891

1562

args = request[2]

1892

1563

kwargs = request[3]

1893

1564

1894

parent_pipe.send(('data', getattr(client_object,

1895

funcname)(*args,

1896

**kwargs)))

1897

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1898

1567

if command == 'getattr':

1899

1568

attrname = request[1]

1900

1569

if callable(client_object.__getattribute__(attrname)):

1901

1570

parent_pipe.send(('function',))

1902

1571

else:

1903

parent_pipe.send(('data', client_object

1904

.__getattribute__(attrname)))

1572

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1905

1573

1906

1574

if command == 'setattr':

1907

1575

attrname = request[1]

1908

1576

value = request[2]

1909

1577

setattr(client_object, attrname, value)

1910

1578

1911

1579

return True

1912

1580

1913

1581

1914

1582

def string_to_delta(interval):

1915

1583

"""Parse a string and return a datetime.timedelta

1916

1584

1917

>>> string_to_delta('7d')

1585

>>> string_to_delta(u'7d')

1918

1586

datetime.timedelta(7)

1919

>>> string_to_delta('60s')

1587

>>> string_to_delta(u'60s')

1920

1588

datetime.timedelta(0, 60)

1921

>>> string_to_delta('60m')

1589

>>> string_to_delta(u'60m')

1922

1590

datetime.timedelta(0, 3600)

1923

>>> string_to_delta('24h')

1591

>>> string_to_delta(u'24h')

1924

1592

datetime.timedelta(1)

1925

>>> string_to_delta('1w')

1593

>>> string_to_delta(u'1w')

1926

1594

datetime.timedelta(7)

1927

>>> string_to_delta('5m 30s')

1595

>>> string_to_delta(u'5m 30s')

1928

1596

datetime.timedelta(0, 330)

1929

1597

"""

1930

1598

timevalue = datetime.timedelta(0)

1932

1600

try:

1933

1601

suffix = unicode(s[-1])

1934

1602

value = int(s[:-1])

1935

if suffix == "d":

1603

if suffix == u"d":

1936

1604

delta = datetime.timedelta(value)

1937

elif suffix == "s":

1605

elif suffix == u"s":

1938

1606

delta = datetime.timedelta(0, value)

1939

elif suffix == "m":

1607

elif suffix == u"m":

1940

1608

delta = datetime.timedelta(0, 0, 0, 0, value)

1941

elif suffix == "h":

1609

elif suffix == u"h":

1942

1610

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1943

elif suffix == "w":

1611

elif suffix == u"w":

1944

1612

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1945

1613

else:

1946

raise ValueError("Unknown suffix %r" % suffix)

1947

except (ValueError, IndexError) as e:

1948

raise ValueError(*(e.args))

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1949

1617

timevalue += delta

1950

1618

return timevalue

1951

1619

1952

1620

1621

def if_nametoindex(interface):

1622

"""Call the C function if_nametoindex(), or equivalent

1623

1624

Note: This function cannot accept a unicode string."""

1625

global if_nametoindex

1626

try:

1627

if_nametoindex = (ctypes.cdll.LoadLibrary

1628

(ctypes.util.find_library(u"c"))

1629

.if_nametoindex)

1630

except (OSError, AttributeError):

1631

logger.warning(u"Doing if_nametoindex the hard way")

1632

def if_nametoindex(interface):

1633

"Get an interface index the hard way, i.e. using fcntl()"

1634

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1635

with contextlib.closing(socket.socket()) as s:

1636

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1637

struct.pack(str(u"16s16x"),

1638

interface))

1639

interface_index = struct.unpack(str(u"I"),

1640

ifreq[16:20])[0]

1641

return interface_index

1642

return if_nametoindex(interface)

1643

1644

1953

1645

def daemon(nochdir = False, noclose = False):

1954

1646

"""See daemon(3). Standard BSD Unix function.

1955

1647

1958

1650

sys.exit()

1959

1651

os.setsid()

1960

1652

if not nochdir:

1961

os.chdir("/")

1653

os.chdir(u"/")

1962

1654

if os.fork():

1963

1655

sys.exit()

1964

1656

if not noclose:

1966

1658

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1967

1659

if not stat.S_ISCHR(os.fstat(null).st_mode):

1968

1660

raise OSError(errno.ENODEV,

1969

"%s not a character device"

1661

u"%s not a character device"

1970

1662

% os.path.devnull)

1971

1663

os.dup2(null, sys.stdin.fileno())

1972

1664

os.dup2(null, sys.stdout.fileno())

1980

1672

##################################################################

1981

1673

# Parsing of options, both command line and config file

1982

1674

1983

parser = argparse.ArgumentParser()

1984

parser.add_argument("-v", "--version", action="version",

1985

version = "%%(prog)s %s" % version,

1986

help="show version number and exit")

1987

parser.add_argument("-i", "--interface", metavar="IF",

1988

help="Bind to interface IF")

1989

parser.add_argument("-a", "--address",

1990

help="Address to listen for requests on")

1991

parser.add_argument("-p", "--port", type=int,

1992

help="Port number to receive requests on")

1993

parser.add_argument("--check", action="store_true",

1994

help="Run self-test")

1995

parser.add_argument("--debug", action="store_true",

1996

help="Debug mode; run in foreground and log"

1997

" to terminal")

1998

parser.add_argument("--debuglevel", metavar="LEVEL",

1999

help="Debug level for stdout output")

2000

parser.add_argument("--priority", help="GnuTLS"

2001

" priority string (see GnuTLS documentation)")

2002

parser.add_argument("--servicename",

2003

metavar="NAME", help="Zeroconf service name")

2004

parser.add_argument("--configdir",

2005

default="/etc/mandos", metavar="DIR",

2006

help="Directory to search for configuration"

2007

" files")

2008

parser.add_argument("--no-dbus", action="store_false",

2009

dest="use_dbus", help="Do not provide D-Bus"

2010

" system bus interface")

2011

parser.add_argument("--no-ipv6", action="store_false",

2012

dest="use_ipv6", help="Do not use IPv6")

2013

parser.add_argument("--no-restore", action="store_false",

2014

dest="restore", help="Do not restore stored"

2015

" state")

2016

parser.add_argument("--statedir", metavar="DIR",

2017

help="Directory to save/restore state in")

2018

2019

options = parser.parse_args()

1675

parser = optparse.OptionParser(version = "%%prog %s" % version)

1676

parser.add_option("-i", u"--interface", type=u"string",

1677

metavar="IF", help=u"Bind to interface IF")

1678

parser.add_option("-a", u"--address", type=u"string",

1679

help=u"Address to listen for requests on")

1680

parser.add_option("-p", u"--port", type=u"int",

1681

help=u"Port number to receive requests on")

1682

parser.add_option("--check", action=u"store_true",

1683

help=u"Run self-test")

1684

parser.add_option("--debug", action=u"store_true",

1685

help=u"Debug mode; run in foreground and log to"

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

u" priority string (see GnuTLS documentation)")

1691

parser.add_option("--servicename", type=u"string",

1692

metavar=u"NAME", help=u"Zeroconf service name")

1693

parser.add_option("--configdir", type=u"string",

1694

default=u"/etc/mandos", metavar=u"DIR",

1695

help=u"Directory to search for configuration"

1696

u" files")

1697

parser.add_option("--no-dbus", action=u"store_false",

1698

dest=u"use_dbus", help=u"Do not provide D-Bus"

1699

u" system bus interface")

1700

parser.add_option("--no-ipv6", action=u"store_false",

1701

dest=u"use_ipv6", help=u"Do not use IPv6")

1702

options = parser.parse_args()[0]

2020

1703

2021

1704

if options.check:

2022

1705

import doctest

2024

1707

sys.exit()

2025

1708

2026

1709

# Default values for config file for server-global settings

2027

server_defaults = { "interface": "",

2028

"address": "",

2029

"port": "",

2030

"debug": "False",

2031

"priority":

2032

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2033

"servicename": "Mandos",

2034

"use_dbus": "True",

2035

"use_ipv6": "True",

2036

"debuglevel": "",

2037

"restore": "True",

2038

"statedir": "/var/lib/mandos"

1710

server_defaults = { u"interface": u"",

1711

u"address": u"",

1712

u"port": u"",

1713

u"debug": u"False",

1714

u"priority":

1715

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1716

u"servicename": u"Mandos",

1717

u"use_dbus": u"True",

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

2039

1720

}

2040

1721

2041

1722

# Parse config file for server-global settings

2042

1723

server_config = configparser.SafeConfigParser(server_defaults)

2043

1724

del server_defaults

2044

1725

server_config.read(os.path.join(options.configdir,

2045

"mandos.conf"))

1726

u"mandos.conf"))

2046

1727

# Convert the SafeConfigParser object to a dict

2047

1728

server_settings = server_config.defaults()

2048

1729

# Use the appropriate methods on the non-string config options

2049

for option in ("debug", "use_dbus", "use_ipv6"):

2050

server_settings[option] = server_config.getboolean("DEFAULT",

1730

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1731

server_settings[option] = server_config.getboolean(u"DEFAULT",

2051

1732

option)

2052

1733

if server_settings["port"]:

2053

server_settings["port"] = server_config.getint("DEFAULT",

2054

"port")

1734

server_settings["port"] = server_config.getint(u"DEFAULT",

1735

u"port")

2055

1736

del server_config

2056

1737

2057

1738

# Override the settings from the config file with command line

2058

1739

# options, if set.

2059

for option in ("interface", "address", "port", "debug",

2060

"priority", "servicename", "configdir",

2061

"use_dbus", "use_ipv6", "debuglevel", "restore",

2062

"statedir"):

1740

for option in (u"interface", u"address", u"port", u"debug",

1741

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

2063

1743

value = getattr(options, option)

2064

1744

if value is not None:

2065

1745

server_settings[option] = value

2073

1753

##################################################################

2074

1754

2075

1755

# For convenience

2076

debug = server_settings["debug"]

2077

debuglevel = server_settings["debuglevel"]

2078

use_dbus = server_settings["use_dbus"]

2079

use_ipv6 = server_settings["use_ipv6"]

2080

stored_state_path = os.path.join(server_settings["statedir"],

2081

stored_state_file)

2082

2083

if debug:

2084

initlogger(debug, logging.DEBUG)

2085

else:

2086

if not debuglevel:

2087

initlogger(debug)

2088

else:

2089

level = getattr(logging, debuglevel.upper())

2090

initlogger(debug, level)

2091

2092

if server_settings["servicename"] != "Mandos":

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

use_dbus = server_settings[u"use_dbus"]

1759

use_ipv6 = server_settings[u"use_ipv6"]

1760

1761

if server_settings[u"servicename"] != u"Mandos":

2093

1762

syslogger.setFormatter(logging.Formatter

2094

('Mandos (%s) [%%(process)d]:'

2095

' %%(levelname)s: %%(message)s'

2096

% server_settings["servicename"]))

1763

(u'Mandos (%s) [%%(process)d]:'

1764

u' %%(levelname)s: %%(message)s'

1765

% server_settings[u"servicename"]))

2097

1766

2098

1767

# Parse config file with clients

2099

client_config = configparser.SafeConfigParser(Client

2100

.client_defaults)

2101

client_config.read(os.path.join(server_settings["configdir"],

2102

"clients.conf"))

1768

client_defaults = { u"timeout": u"1h",

1769

u"interval": u"5m",

1770

u"checker": u"fping -q -- %%(host)s",

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1774

}

1775

client_config = configparser.SafeConfigParser(client_defaults)

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1777

u"clients.conf"))

2103

1778

2104

1779

global mandos_dbus_service

2105

1780

mandos_dbus_service = None

2106

1781

2107

tcp_server = MandosServer((server_settings["address"],

2108

server_settings["port"]),

1782

tcp_server = MandosServer((server_settings[u"address"],

1783

server_settings[u"port"]),

2109

1784

ClientHandler,

2110

interface=(server_settings["interface"]

1785

interface=(server_settings[u"interface"]

2111

1786

or None),

2112

1787

use_ipv6=use_ipv6,

2113

1788

gnutls_priority=

2114

server_settings["priority"],

1789

server_settings[u"priority"],

2115

1790

use_dbus=use_dbus)

2116

1791

if not debug:

2117

pidfilename = "/var/run/mandos.pid"

1792

pidfilename = u"/var/run/mandos.pid"

2118

1793

try:

2119

pidfile = open(pidfilename, "w")

1794

pidfile = open(pidfilename, u"w")

2120

1795

except IOError:

2121

logger.error("Could not open file %r", pidfilename)

1796

logger.error(u"Could not open file %r", pidfilename)

2122

1797

2123

1798

try:

2124

uid = pwd.getpwnam("_mandos").pw_uid

2125

gid = pwd.getpwnam("_mandos").pw_gid

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1800

gid = pwd.getpwnam(u"_mandos").pw_gid

2126

1801

except KeyError:

2127

1802

try:

2128

uid = pwd.getpwnam("mandos").pw_uid

2129

gid = pwd.getpwnam("mandos").pw_gid

1803

uid = pwd.getpwnam(u"mandos").pw_uid

1804

gid = pwd.getpwnam(u"mandos").pw_gid

2130

1805

except KeyError:

2131

1806

try:

2132

uid = pwd.getpwnam("nobody").pw_uid

2133

gid = pwd.getpwnam("nobody").pw_gid

1807

uid = pwd.getpwnam(u"nobody").pw_uid

1808

gid = pwd.getpwnam(u"nobody").pw_gid

2134

1809

except KeyError:

2135

1810

uid = 65534

2136

1811

gid = 65534

2137

1812

try:

2138

1813

os.setgid(gid)

2139

1814

os.setuid(uid)

2140

except OSError as error:

1815

except OSError, error:

2141

1816

if error[0] != errno.EPERM:

2142

1817

raise error

2143

1818

1819

if not debug and not debuglevel:

1820

syslogger.setLevel(logging.WARNING)

1821

console.setLevel(logging.WARNING)

1822

if debuglevel:

1823

level = getattr(logging, debuglevel.upper())

1824

syslogger.setLevel(level)

1825

console.setLevel(level)

1826

2144

1827

if debug:

2145

1828

# Enable all possible GnuTLS debugging

2146

1829

2150

1833

2151

1834

@gnutls.library.types.gnutls_log_func

2152

1835

def debug_gnutls(level, string):

2153

logger.debug("GnuTLS: %s", string[:-1])

1836

logger.debug(u"GnuTLS: %s", string[:-1])

2154

1837

2155

1838

(gnutls.library.functions

2156

1839

.gnutls_global_set_log_function(debug_gnutls))

2160

1843

os.dup2(null, sys.stdin.fileno())

2161

1844

if null > 2:

2162

1845

os.close(null)

2163

2164

# Need to fork before connecting to D-Bus

2165

if not debug:

2166

# Close all input and output, do double fork, etc.

2167

daemon()

2168

2169

gobject.threads_init()

1846

else:

1847

# No console logging

1848

logger.removeHandler(console)

1849

2170

1850

2171

1851

global main_loop

2172

1852

# From the Avahi example code

2176

1856

# End of Avahi example code

2177

1857

if use_dbus:

2178

1858

try:

2179

bus_name = dbus.service.BusName("se.recompile.Mandos",

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2180

1860

bus, do_not_queue=True)

2181

old_bus_name = (dbus.service.BusName

2182

("se.bsnet.fukt.Mandos", bus,

2183

do_not_queue=True))

2184

except dbus.exceptions.NameExistsException as e:

2185

logger.error(unicode(e) + ", disabling D-Bus")

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

2186

1863

use_dbus = False

2187

server_settings["use_dbus"] = False

1864

server_settings[u"use_dbus"] = False

2188

1865

tcp_server.use_dbus = False

2189

1866

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2190

service = AvahiServiceToSyslog(name =

2191

server_settings["servicename"],

2192

servicetype = "_mandos._tcp",

2193

protocol = protocol, bus = bus)

1867

service = AvahiService(name = server_settings[u"servicename"],

1868

servicetype = u"_mandos._tcp",

1869

protocol = protocol, bus = bus)

2194

1870

if server_settings["interface"]:

2195

1871

service.interface = (if_nametoindex

2196

(str(server_settings["interface"])))

2197

1872

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

2198

1878

global multiprocessing_manager

2199

1879

multiprocessing_manager = multiprocessing.Manager()

2200

1880

2201

1881

client_class = Client

2202

1882

if use_dbus:

2203

client_class = functools.partial(ClientDBusTransitional,

2204

bus = bus)

2205

2206

client_settings = Client.config_parser(client_config)

2207

old_client_settings = {}

2208

clients_data = {}

2209

2210

# Get client data and settings from last running state.

2211

if server_settings["restore"]:

2212

try:

2213

with open(stored_state_path, "rb") as stored_state:

2214

clients_data, old_client_settings = (pickle.load

2215

(stored_state))

2216

os.remove(stored_state_path)

2217

except IOError as e:

2218

logger.warning("Could not load persistent state: {0}"

2219

.format(e))

2220

if e.errno != errno.ENOENT:

2221

raise

2222

except EOFError as e:

2223

logger.warning("Could not load persistent state: "

2224

"EOFError: {0}".format(e))

2225

2226

with PGPEngine() as pgp:

2227

for client_name, client in clients_data.iteritems():

2228

# Decide which value to use after restoring saved state.

2229

# We have three different values: Old config file,

2230

# new config file, and saved state.

2231

# New config value takes precedence if it differs from old

2232

# config value, otherwise use saved state.

2233

for name, value in client_settings[client_name].items():

2234

try:

2235

# For each value in new config, check if it

2236

# differs from the old config value (Except for

2237

# the "secret" attribute)

2238

if (name != "secret" and

2239

value != old_client_settings[client_name]

2240

[name]):

2241

client[name] = value

2242

except KeyError:

2243

pass

2244

2245

# Clients who has passed its expire date can still be

2246

# enabled if its last checker was successful. Clients

2247

# whose checker succeeded before we stored its state is

2248

# assumed to have successfully run all checkers during

2249

# downtime.

2250

if client["enabled"]:

2251

if datetime.datetime.utcnow() >= client["expires"]:

2252

if not client["last_checked_ok"]:

2253

logger.warning(

2254

"disabling client {0} - Client never "

2255

"performed a successful checker"

2256

.format(client_name))

2257

client["enabled"] = False

2258

elif client["last_checker_status"] != 0:

2259

logger.warning(

2260

"disabling client {0} - Client "

2261

"last checker failed with error code {1}"

2262

.format(client_name,

2263

client["last_checker_status"]))

2264

client["enabled"] = False

2265

else:

2266

client["expires"] = (datetime.datetime

2267

.utcnow()

2268

+ client["timeout"])

2269

logger.debug("Last checker succeeded,"

2270

" keeping {0} enabled"

2271

.format(client_name))

1883

client_class = functools.partial(ClientDBus, bus = bus)

1884

def client_config_items(config, section):

1885

special_settings = {

1886

"approved_by_default":

1887

lambda: config.getboolean(section,

1888

"approved_by_default"),

1889

}

1890

for name, value in config.items(section):

2272

1891

try:

2273

client["secret"] = (

2274

pgp.decrypt(client["encrypted_secret"],

2275

client_settings[client_name]

2276

["secret"]))

2277

except PGPError:

2278

# If decryption fails, we use secret from new settings

2279

logger.debug("Failed to decrypt {0} old secret"

2280

.format(client_name))

2281

client["secret"] = (

2282

client_settings[client_name]["secret"])

2283

2284

2285

# Add/remove clients based on new changes made to config

2286

for client_name in (set(old_client_settings)

2287

- set(client_settings)):

2288

del clients_data[client_name]

2289

for client_name in (set(client_settings)

2290

- set(old_client_settings)):

2291

clients_data[client_name] = client_settings[client_name]

2292

2293

# Create all client objects

2294

for client_name, client in clients_data.iteritems():

2295

tcp_server.clients[client_name] = client_class(

2296

name = client_name, settings = client)

2297

1892

yield (name, special_settings[name]())

1893

except KeyError:

1894

yield (name, value)

1895

1896

tcp_server.clients.update(set(

1897

client_class(name = section,

1898

config= dict(client_config_items(

1899

client_config, section)))

1900

for section in client_config.sections()))

2298

1901

if not tcp_server.clients:

2299

logger.warning("No clients defined")

1902

logger.warning(u"No clients defined")

2300

1903

2301

1904

if not debug:

2302

1905

try:

2303

1906

with pidfile:

2304

1907

pid = os.getpid()

2305

pidfile.write(str(pid) + "\n".encode("utf-8"))

1908

pidfile.write(str(pid) + "\n")

2306

1909

del pidfile

2307

1910

except IOError:

2308

logger.error("Could not write to file %r with PID %d",

1911

logger.error(u"Could not write to file %r with PID %d",

2309

1912

pidfilename, pid)

2310

1913

except NameError:

2311

1914

# "pidfile" was never created

2312

1915

pass

2313

1916

del pidfilename

1917

2314

1918

signal.signal(signal.SIGINT, signal.SIG_IGN)

2315

1919

2316

1920

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2317

1921

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2318

1922

2320

1924

class MandosDBusService(dbus.service.Object):

2321

1925

"""A D-Bus proxy object"""

2322

1926

def __init__(self):

2323

dbus.service.Object.__init__(self, bus, "/")

2324

_interface = "se.recompile.Mandos"

1927

dbus.service.Object.__init__(self, bus, u"/")

1928

_interface = u"se.bsnet.fukt.Mandos"

2325

1929

2326

@dbus.service.signal(_interface, signature="o")

1930

@dbus.service.signal(_interface, signature=u"o")

2327

1931

def ClientAdded(self, objpath):

2328

1932

"D-Bus signal"

2329

1933

pass

2330

1934

2331

@dbus.service.signal(_interface, signature="ss")

1935

@dbus.service.signal(_interface, signature=u"ss")

2332

1936

def ClientNotFound(self, fingerprint, address):

2333

1937

"D-Bus signal"

2334

1938

pass

2335

1939

2336

@dbus.service.signal(_interface, signature="os")

1940

@dbus.service.signal(_interface, signature=u"os")

2337

1941

def ClientRemoved(self, objpath, name):

2338

1942

"D-Bus signal"

2339

1943

pass

2340

1944

2341

@dbus.service.method(_interface, out_signature="ao")

1945

@dbus.service.method(_interface, out_signature=u"ao")

2342

1946

def GetAllClients(self):

2343

1947

"D-Bus method"

2344

1948

return dbus.Array(c.dbus_object_path

2345

for c in

2346

tcp_server.clients.itervalues())

1949

for c in tcp_server.clients)

2347

1950

2348

1951

@dbus.service.method(_interface,

2349

out_signature="a{oa{sv}}")

1952

out_signature=u"a{oa{sv}}")

2350

1953

def GetAllClientsWithProperties(self):

2351

1954

"D-Bus method"

2352

1955

return dbus.Dictionary(

2353

((c.dbus_object_path, c.GetAll(""))

2354

for c in tcp_server.clients.itervalues()),

2355

signature="oa{sv}")

1956

((c.dbus_object_path, c.GetAll(u""))

1957

for c in tcp_server.clients),

1958

signature=u"oa{sv}")

2356

1959

2357

@dbus.service.method(_interface, in_signature="o")

1960

@dbus.service.method(_interface, in_signature=u"o")

2358

1961

def RemoveClient(self, object_path):

2359

1962

"D-Bus method"

2360

for c in tcp_server.clients.itervalues():

1963

for c in tcp_server.clients:

2361

1964

if c.dbus_object_path == object_path:

2362

del tcp_server.clients[c.name]

1965

tcp_server.clients.remove(c)

2363

1966

c.remove_from_connection()

2364

1967

# Don't signal anything except ClientRemoved

2365

1968

c.disable(quiet=True)

2370

1973

2371

1974

del _interface

2372

1975

2373

class MandosDBusServiceTransitional(MandosDBusService):

2374

__metaclass__ = AlternateDBusNamesMetaclass

2375

mandos_dbus_service = MandosDBusServiceTransitional()

1976

mandos_dbus_service = MandosDBusService()

2376

1977

2377

1978

def cleanup():

2378

1979

"Cleanup function; run on exit"

2379

1980

service.cleanup()

2380

1981

2381

multiprocessing.active_children()

2382

if not (tcp_server.clients or client_settings):

2383

return

2384

2385

# Store client before exiting. Secrets are encrypted with key

2386

# based on what config file has. If config file is

2387

# removed/edited, old secret will thus be unrecovable.

2388

clients = {}

2389

with PGPEngine() as pgp:

2390

for client in tcp_server.clients.itervalues():

2391

key = client_settings[client.name]["secret"]

2392

client.encrypted_secret = pgp.encrypt(client.secret,

2393

key)

2394

client_dict = {}

2395

2396

# A list of attributes that can not be pickled

2397

# + secret.

2398

exclude = set(("bus", "changedstate", "secret",

2399

"checker"))

2400

for name, typ in (inspect.getmembers

2401

(dbus.service.Object)):

2402

exclude.add(name)

2403

2404

client_dict["encrypted_secret"] = (client

2405

.encrypted_secret)

2406

for attr in client.client_structure:

2407

if attr not in exclude:

2408

client_dict[attr] = getattr(client, attr)

2409

2410

clients[client.name] = client_dict

2411

del client_settings[client.name]["secret"]

2412

2413

try:

2414

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2415

prefix="clients-",

2416

dir=os.path.dirname

2417

(stored_state_path))

2418

with os.fdopen(tempfd, "wb") as stored_state:

2419

pickle.dump((clients, client_settings), stored_state)

2420

os.rename(tempname, stored_state_path)

2421

except (IOError, OSError) as e:

2422

logger.warning("Could not save persistent state: {0}"

2423

.format(e))

2424

if not debug:

2425

try:

2426

os.remove(tempname)

2427

except NameError:

2428

pass

2429

if e.errno not in set((errno.ENOENT, errno.EACCES,

2430

errno.EEXIST)):

2431

raise e

2432

2433

# Delete all clients, and settings from config

2434

1982

while tcp_server.clients:

2435

name, client = tcp_server.clients.popitem()

1983

client = tcp_server.clients.pop()

2436

1984

if use_dbus:

2437

1985

client.remove_from_connection()

1986

client.disable_hook = None

2438

1987

# Don't signal anything except ClientRemoved

2439

1988

client.disable(quiet=True)

2440

1989

if use_dbus:

2441

1990

# Emit D-Bus signal

2442

mandos_dbus_service.ClientRemoved(client

2443

.dbus_object_path,

1991

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2444

1992

client.name)

2445

client_settings.clear()

2446

1993

2447

1994

atexit.register(cleanup)

2448

1995

2449

for client in tcp_server.clients.itervalues():

1996

for client in tcp_server.clients:

2450

1997

if use_dbus:

2451

1998

# Emit D-Bus signal

2452

1999

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2453

# Need to initiate checking of clients

2454

if client.enabled:

2455

client.init_checker()

2000

client.enable()

2456

2001

2457

2002

tcp_server.enable()

2458

2003

tcp_server.server_activate()

2460

2005

# Find out what port we got

2461

2006

service.port = tcp_server.socket.getsockname()[1]

2462

2007

if use_ipv6:

2463

logger.info("Now listening on address %r, port %d,"

2008

logger.info(u"Now listening on address %r, port %d,"

2464

2009

" flowinfo %d, scope_id %d"

2465

2010

% tcp_server.socket.getsockname())

2466

2011

else: # IPv4

2467

logger.info("Now listening on address %r, port %d"

2012

logger.info(u"Now listening on address %r, port %d"

2468

2013

% tcp_server.socket.getsockname())

2469

2014

2470

2015

#service.interface = tcp_server.socket.getsockname()[3]

2473

2018

# From the Avahi example code

2474

2019

try:

2475

2020

service.activate()

2476

except dbus.exceptions.DBusException as error:

2477

logger.critical("DBusException: %s", error)

2021

except dbus.exceptions.DBusException, error:

2022

logger.critical(u"DBusException: %s", error)

2478

2023

cleanup()

2479

2024

sys.exit(1)

2480

2025

# End of Avahi example code

2484

2029

(tcp_server.handle_request

2485

2030

(*args[2:], **kwargs) or True))

2486

2031

2487

logger.debug("Starting main loop")

2032

logger.debug(u"Starting main loop")

2488

2033

main_loop.run()

2489

except AvahiError as error:

2490

logger.critical("AvahiError: %s", error)

2034

except AvahiError, error:

2035

logger.critical(u"AvahiError: %s", error)

2491

2036

cleanup()

2492

2037

sys.exit(1)

2493

2038

except KeyboardInterrupt:

2494

2039

if debug:

2495

print("", file=sys.stderr)

2496

logger.debug("Server received KeyboardInterrupt")

2497

logger.debug("Server exiting")

2040

print >> sys.stderr

2041

logger.debug(u"Server received KeyboardInterrupt")

2042

logger.debug(u"Server exiting")

2498

2043

# Must run before the D-Bus bus name gets deregistered

2499

2044

cleanup()

2500

2045