/mandos/trunk : revision 24.1.186

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

66

69

67

import dbus

70

68

import dbus.service

75

73

import ctypes.util

76

74

import xml.dom.minidom

77

75

import inspect

78

import GnuPGInterface

79

76

80

77

try:

81

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

except ImportError:

86

83

SO_BINDTODEVICE = None

87

84

88

version = "1.5.3"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

85

86

version = "1.3.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

92

90

syslogger = (logging.handlers.SysLogHandler

93

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

92

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

210

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

211

103

212

104

class AvahiError(Exception):

213

105

def __init__(self, value, *args, **kwargs):

268

160

" after %i retries, exiting.",

269

161

self.rename_count)

270

162

raise AvahiServiceError("Too many renames")

271

self.name = unicode(self.server

272

.GetAlternativeServiceName(self.name))

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

273

164

logger.info("Changing Zeroconf service name to %r ...",

274

165

self.name)

166

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

169

% self.name))

275

170

self.remove()

276

171

try:

277

172

self.add()

297

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

298

193

self.entry_group_state_changed_match = (

299

194

self.group.connect_to_signal(

300

'StateChanged', self.entry_group_state_changed))

195

'StateChanged', self .entry_group_state_changed))

301

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

302

197

self.name, self.type)

303

198

self.group.AddService(

329

224

try:

330

225

self.group.Free()

331

226

except (dbus.exceptions.UnknownMethodException,

332

dbus.exceptions.DBusException):

227

dbus.exceptions.DBusException) as e:

333

228

pass

334

229

self.group = None

335

230

self.remove()

369

264

self.server_state_changed)

370

265

self.server_state_changed(self.server.GetState())

371

266

372

class AvahiServiceToSyslog(AvahiService):

373

def rename(self):

374

"""Add the new name to the syslog messages"""

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

380

return ret

381

267

382

def timedelta_to_milliseconds(td):

268

def _timedelta_to_milliseconds(td):

383

269

"Convert a datetime.timedelta() to milliseconds"

384

270

return ((td.days * 24 * 60 * 60 * 1000)

385

271

+ (td.seconds * 1000)

389

275

"""A representation of a client host served by this server.

390

276

391

277

Attributes:

392

approved: bool(); 'None' if not yet approved/disapproved

278

_approved: bool(); 'None' if not yet approved/disapproved

393

279

approval_delay: datetime.timedelta(); Time to wait for approval

394

280

approval_duration: datetime.timedelta(); Duration of one approval

395

281

checker: subprocess.Popen(); a running checker process used

402

288

instance %(name)s can be used in the command.

403

289

checker_initiator_tag: a gobject event source tag, or None

404

290

created: datetime.datetime(); (UTC) object creation

405

client_structure: Object describing what attributes a client has

406

and is used for storing the client at exit

407

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

408

293

disable_initiator_tag: a gobject event source tag, or None

409

294

enabled: bool()

410

295

fingerprint: string (40 or 32 hexadecimal digits); used to

413

298

interval: datetime.timedelta(); How often to start a new checker

414

299

last_approval_request: datetime.datetime(); (UTC) or None

415

300

last_checked_ok: datetime.datetime(); (UTC) or None

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, -2 means no checker completed yet.

419

last_enabled: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

420

302

name: string; from the config file, used in log messages and

421

303

D-Bus identifiers

422

304

secret: bytestring; sent verbatim (over TLS) to client

423

305

timeout: datetime.timedelta(); How long from last_checked_ok

424

306

until this client is disabled

425

extended_timeout: extra long timeout when secret has been sent

307

extended_timeout: extra long timeout when password has been sent

426

308

runtime_expansions: Allowed attributes for runtime expansion.

427

309

expires: datetime.datetime(); time (UTC) when a client will be

428

310

disabled, or None

432

314

"created", "enabled", "fingerprint",

433

315

"host", "interval", "last_checked_ok",

434

316

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

445

317

446

318

def timeout_milliseconds(self):

447

319

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

449

321

450

322

def extended_timeout_milliseconds(self):

451

323

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

324

return _timedelta_to_milliseconds(self.extended_timeout)

453

325

454

326

def interval_milliseconds(self):

455

327

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

328

return _timedelta_to_milliseconds(self.interval)

457

329

458

330

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

"""Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above.

466

NOTE: Must be a pure function. Must return the same result

467

value given the same arguments.

468

"""

469

settings = {}

470

for client_name in config.sections():

471

section = dict(config.items(client_name))

472

client = settings[client_name] = {}

473

474

client["host"] = section["host"]

475

# Reformat values from string types to Python types

476

client["approved_by_default"] = config.getboolean(

477

client_name, "approved_by_default")

478

client["enabled"] = config.getboolean(client_name,

479

"enabled")

480

481

client["fingerprint"] = (section["fingerprint"].upper()

482

.replace(" ", ""))

483

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

485

elif "secfile" in section:

486

with open(os.path.expanduser(os.path.expandvars

487

(section["secfile"])),

488

"rb") as secfile:

489

client["secret"] = secfile.read()

490

else:

491

raise TypeError("No secret or secfile for section %s"

492

% section)

493

client["timeout"] = string_to_delta(section["timeout"])

494

client["extended_timeout"] = string_to_delta(

495

section["extended_timeout"])

496

client["interval"] = string_to_delta(section["interval"])

497

client["approval_delay"] = string_to_delta(

498

section["approval_delay"])

499

client["approval_duration"] = string_to_delta(

500

section["approval_duration"])

501

client["checker_command"] = section["checker"]

502

client["last_approval_request"] = None

503

client["last_checked_ok"] = None

504

client["last_checker_status"] = -2

505

506

return settings

507

508

509

def __init__(self, settings, name = None):

331

return _timedelta_to_milliseconds(self.approval_delay)

332

333

def __init__(self, name = None, disable_hook=None, config=None):

510

334

"""Note: the 'checker' key in 'config' sets the

511

335

'checker_command' attribute and *not* the 'checker'

512

336

attribute."""

513

337

self.name = name

514

# adding all client settings

515

for setting, value in settings.iteritems():

516

setattr(self, setting, value)

517

518

if self.enabled:

519

if not hasattr(self, "last_enabled"):

520

self.last_enabled = datetime.datetime.utcnow()

521

if not hasattr(self, "expires"):

522

self.expires = (datetime.datetime.utcnow()

523

+ self.timeout)

524

else:

525

self.last_enabled = None

526

self.expires = None

527

338

if config is None:

339

config = {}

528

340

logger.debug("Creating client %r", self.name)

529

341

# Uppercase and remove spaces from fingerprint for later

530

342

# comparison purposes with return value from the fingerprint()

531

343

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

532

346

logger.debug(" Fingerprint: %s", self.fingerprint)

533

self.created = settings.get("created",

534

datetime.datetime.utcnow())

535

536

# attributes specific for this server instance

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

353

self.secret = secfile.read()

354

else:

355

raise TypeError("No secret or secfile for client %s"

356

% self.name)

357

self.host = config.get("host", "")

358

self.created = datetime.datetime.utcnow()

359

self.enabled = False

360

self.last_approval_request = None

361

self.last_enabled = None

362

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

537

367

self.checker = None

538

368

self.checker_initiator_tag = None

539

369

self.disable_initiator_tag = None

370

self.expires = None

540

371

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

541

373

self.current_checker_command = None

542

self.approved = None

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

543

378

self.approvals_pending = 0

544

self.changedstate = (multiprocessing_manager

545

.Condition(multiprocessing_manager

546

.Lock()))

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

549

if not attr.startswith("_")]

550

self.client_structure.append("client_structure")

551

552

for name, t in inspect.getmembers(type(self),

553

lambda obj:

554

isinstance(obj,

555

property)):

556

if not name.startswith("_"):

557

self.client_structure.append(name)

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

558

384

559

# Send notice to process children that client state has changed

560

385

def send_changedstate(self):

561

with self.changedstate:

562

self.changedstate.notify_all()

563

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

564

390

def enable(self):

565

391

"""Start this client's checker and timeout hooks"""

566

392

if getattr(self, "enabled", False):

567

393

# Already enabled

568

394

return

569

395

self.send_changedstate()

396

# Schedule a new checker to be started an 'interval' from now,

397

# and every interval from then on.

398

self.checker_initiator_tag = (gobject.timeout_add

399

(self.interval_milliseconds(),

400

self.start_checker))

401

# Schedule a disable() when 'timeout' has passed

570

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

self.disable_initiator_tag = (gobject.timeout_add

404

(self.timeout_milliseconds(),

405

self.disable))

571

406

self.enabled = True

572

407

self.last_enabled = datetime.datetime.utcnow()

573

self.init_checker()

408

# Also start a new checker *right now*.

409

self.start_checker()

574

410

575

411

def disable(self, quiet=True):

576

412

"""Disable this client."""

588

424

gobject.source_remove(self.checker_initiator_tag)

589

425

self.checker_initiator_tag = None

590

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

591

429

self.enabled = False

592

430

# Do not run this again if called by a gobject.timeout_add

593

431

return False

594

432

595

433

def __del__(self):

434

self.disable_hook = None

596

435

self.disable()

597

436

598

def init_checker(self):

599

# Schedule a new checker to be started an 'interval' from now,

600

# and every interval from then on.

601

self.checker_initiator_tag = (gobject.timeout_add

602

(self.interval_milliseconds(),

603

self.start_checker))

604

# Schedule a disable() when 'timeout' has passed

605

self.disable_initiator_tag = (gobject.timeout_add

606

(self.timeout_milliseconds(),

607

self.disable))

608

# Also start a new checker *right now*.

609

self.start_checker()

610

611

437

def checker_callback(self, pid, condition, command):

612

438

"""The checker has completed, so take appropriate actions."""

613

439

self.checker_callback_tag = None

614

440

self.checker = None

615

441

if os.WIFEXITED(condition):

616

self.last_checker_status = os.WEXITSTATUS(condition)

617

if self.last_checker_status == 0:

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

618

444

logger.info("Checker for %(name)s succeeded",

619

445

vars(self))

620

446

self.checked_ok()

622

448

logger.info("Checker for %(name)s failed",

623

449

vars(self))

624

450

else:

625

self.last_checker_status = -1

626

451

logger.warning("Checker for %(name)s crashed?",

627

452

vars(self))

628

453

629

def checked_ok(self):

630

"""Assert that the client has been seen, alive and well."""

631

self.last_checked_ok = datetime.datetime.utcnow()

632

self.last_checker_status = 0

633

self.bump_timeout()

634

635

def bump_timeout(self, timeout=None):

636

"""Bump up the timeout for this client."""

454

def checked_ok(self, timeout=None):

455

"""Bump up the timeout for this client.

456

457

This should only be called when the client has been seen,

458

alive and well.

459

"""

637

460

if timeout is None:

638

461

timeout = self.timeout

639

if self.disable_initiator_tag is not None:

640

gobject.source_remove(self.disable_initiator_tag)

641

if getattr(self, "enabled", False):

642

self.disable_initiator_tag = (gobject.timeout_add

643

(timedelta_to_milliseconds

644

(timeout), self.disable))

645

self.expires = datetime.datetime.utcnow() + timeout

462

self.last_checked_ok = datetime.datetime.utcnow()

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

467

self.disable))

646

468

647

469

def need_approval(self):

648

470

self.last_approval_request = datetime.datetime.utcnow()

807

629

"""

808

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

809

631

for cls in self.__class__.__mro__

810

for name, prop in

811

inspect.getmembers(cls, self._is_dbus_property))

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

812

633

813

634

def _get_dbus_property(self, interface_name, property_name):

814

635

"""Returns a bound method if one exists which is a D-Bus

815

636

property with the specified name and interface.

816

637

"""

817

638

for cls in self.__class__.__mro__:

818

for name, value in (inspect.getmembers

819

(cls, self._is_dbus_property)):

820

if (value._dbus_name == property_name

821

and value._dbus_interface == interface_name):

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

822

641

return value.__get__(self)

823

642

824

643

# No such property

825

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

826

645

+ interface_name + "."

827

646

+ property_name)

647

828

648

829

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

830

650

out_signature="v")

851

671

# signatures other than "ay".

852

672

if prop._dbus_signature != "ay":

853

673

raise ValueError

854

value = dbus.ByteArray(b''.join(chr(byte)

855

for byte in value))

674

value = dbus.ByteArray(''.join(unichr(byte)

675

for byte in value))

856

676

prop(value)

857

677

858

678

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

863

683

864

684

Note: Will not include properties with access="write".

865

685

"""

866

properties = {}

686

all = {}

867

687

for name, prop in self._get_all_dbus_properties():

868

688

if (interface_name

869

689

and interface_name != prop._dbus_interface):

874

694

continue

875

695

value = prop()

876

696

if not hasattr(value, "variant_level"):

877

properties[name] = value

697

all[name] = value

878

698

continue

879

properties[name] = type(value)(value, variant_level=

880

value.variant_level+1)

881

return dbus.Dictionary(properties, signature="sv")

699

all[name] = type(value)(value, variant_level=

700

value.variant_level+1)

701

return dbus.Dictionary(all, signature="sv")

882

702

883

703

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

884

704

out_signature="s",

935

755

return dbus.String(dt.isoformat(),

936

756

variant_level=variant_level)

937

757

938

939

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

940

.__metaclass__):

941

"""Applied to an empty subclass of a D-Bus object, this metaclass

942

will add additional D-Bus attributes matching a certain pattern.

943

"""

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

944

759

def __new__(mcs, name, bases, attr):

945

# Go through all the base classes which could have D-Bus

946

# methods, signals, or properties in them

947

for base in (b for b in bases

948

if issubclass(b, dbus.service.Object)):

949

# Go though all attributes of the base class

950

for attrname, attribute in inspect.getmembers(base):

951

# Ignore non-D-Bus attributes, and D-Bus attributes

952

# with the wrong interface name

953

if (not hasattr(attribute, "_dbus_interface")

954

or not attribute._dbus_interface

955

.startswith("se.recompile.Mandos")):

956

continue

957

# Create an alternate D-Bus interface name based on

958

# the current name

959

alt_interface = (attribute._dbus_interface

960

.replace("se.recompile.Mandos",

961

"se.bsnet.fukt.Mandos"))

962

# Is this a D-Bus signal?

963

if getattr(attribute, "_dbus_is_signal", False):

964

# Extract the original non-method function by

965

# black magic

966

nonmethod_func = (dict(

967

zip(attribute.func_code.co_freevars,

968

attribute.__closure__))["func"]

969

.cell_contents)

970

# Create a new, but exactly alike, function

971

# object, and decorate it to be a new D-Bus signal

972

# with the alternate D-Bus interface name

973

new_function = (dbus.service.signal

974

(alt_interface,

975

attribute._dbus_signature)

976

(types.FunctionType(

977

nonmethod_func.func_code,

978

nonmethod_func.func_globals,

979

nonmethod_func.func_name,

980

nonmethod_func.func_defaults,

981

nonmethod_func.func_closure)))

982

# Define a creator of a function to call both the

983

# old and new functions, so both the old and new

984

# signals gets sent when the function is called

985

def fixscope(func1, func2):

986

"""This function is a scope container to pass

987

func1 and func2 to the "call_both" function

988

outside of its arguments"""

989

def call_both(*args, **kwargs):

990

"""This function will emit two D-Bus

991

signals by calling func1 and func2"""

992

func1(*args, **kwargs)

993

func2(*args, **kwargs)

994

return call_both

995

# Create the "call_both" function and add it to

996

# the class

997

attr[attrname] = fixscope(attribute,

998

new_function)

999

# Is this a D-Bus method?

1000

elif getattr(attribute, "_dbus_is_method", False):

1001

# Create a new, but exactly alike, function

1002

# object. Decorate it to be a new D-Bus method

1003

# with the alternate D-Bus interface name. Add it

1004

# to the class.

1005

attr[attrname] = (dbus.service.method

1006

(alt_interface,

1007

attribute._dbus_in_signature,

1008

attribute._dbus_out_signature)

1009

(types.FunctionType

1010

(attribute.func_code,

1011

attribute.func_globals,

1012

attribute.func_name,

1013

attribute.func_defaults,

1014

attribute.func_closure)))

1015

# Is this a D-Bus property?

1016

elif getattr(attribute, "_dbus_is_property", False):

1017

# Create a new, but exactly alike, function

1018

# object, and decorate it to be a new D-Bus

1019

# property with the alternate D-Bus interface

1020

# name. Add it to the class.

1021

attr[attrname] = (dbus_service_property

1022

(alt_interface,

1023

attribute._dbus_signature,

1024

attribute._dbus_access,

1025

attribute

1026

._dbus_get_args_options

1027

["byte_arrays"])

1028

(types.FunctionType

1029

(attribute.func_code,

1030

attribute.func_globals,

1031

attribute.func_name,

1032

attribute.func_defaults,

1033

attribute.func_closure)))

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

1034

812

return type.__new__(mcs, name, bases, attr)

1035

813

1036

1037

814

class ClientDBus(Client, DBusObjectWithProperties):

1038

815

"""A Client class using D-Bus

1039

816

1048

825

# dbus.service.Object doesn't use super(), so we can't either.

1049

826

1050

827

def __init__(self, bus = None, *args, **kwargs):

828

self._approvals_pending = 0

1051

829

self.bus = bus

1052

830

Client.__init__(self, *args, **kwargs)

1053

831

# Only now, when this client is initialized, can it show up on

1063

841

def notifychangeproperty(transform_func,

1064

842

dbus_name, type_func=lambda x: x,

1065

843

variant_level=1):

1066

""" Modify a variable so that it's a property which announces

1067

its changes to DBus.

1068

1069

transform_fun: Function that takes a value and a variant_level

1070

and transforms it to a D-Bus type.

1071

dbus_name: D-Bus name of the variable

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

1072

849

type_func: Function that transform the value before sending it

1073

to the D-Bus. Default: no transform

1074

variant_level: D-Bus variant level. Default: 1

850

to DBus

851

variant_level: DBus variant level. default: 1

1075

852

"""

1076

attrname = "_{0}".format(dbus_name)

853

real_value = [None,]

1077

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

1078

857

if hasattr(self, "dbus_object_path"):

1079

if (not hasattr(self, attrname) or

1080

type_func(getattr(self, attrname, None))

1081

!= type_func(value)):

1082

dbus_value = transform_func(type_func(value),

1083

variant_level

1084

=variant_level)

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

1085

861

self.PropertyChanged(dbus.String(dbus_name),

1086

862

dbus_value)

1087

setattr(self, attrname, value)

1088

863

1089

return property(lambda self: getattr(self, attrname), setter)

864

return property(lambda self: real_value[0], setter)

1090

865

1091

866

1092

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1097

872

last_enabled = notifychangeproperty(datetime_to_dbus,

1098

873

"LastEnabled")

1099

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1100

type_func = lambda checker:

1101

checker is not None)

875

type_func = lambda checker: checker is not None)

1102

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1103

877

"LastCheckedOK")

1104

last_checker_status = notifychangeproperty(dbus.Int16,

1105

"LastCheckerStatus")

1106

last_approval_request = notifychangeproperty(

1107

datetime_to_dbus, "LastApprovalRequest")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

1108

880

approved_by_default = notifychangeproperty(dbus.Boolean,

1109

881

"ApprovedByDefault")

1110

approval_delay = notifychangeproperty(dbus.UInt64,

1111

"ApprovalDelay",

1112

type_func =

1113

timedelta_to_milliseconds)

1114

approval_duration = notifychangeproperty(

1115

dbus.UInt64, "ApprovalDuration",

1116

type_func = timedelta_to_milliseconds)

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

1117

886

host = notifychangeproperty(dbus.String, "Host")

1118

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1119

type_func =

1120

timedelta_to_milliseconds)

1121

extended_timeout = notifychangeproperty(

1122

dbus.UInt64, "ExtendedTimeout",

1123

type_func = timedelta_to_milliseconds)

1124

interval = notifychangeproperty(dbus.UInt64,

1125

"Interval",

1126

type_func =

1127

timedelta_to_milliseconds)

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

1128

893

checker_command = notifychangeproperty(dbus.String, "Checker")

1129

894

1130

895

del notifychangeproperty

1172

937

return r

1173

938

1174

939

def _reset_approved(self):

1175

self.approved = None

940

self._approved = None

1176

941

return False

1177

942

1178

943

def approve(self, value=True):

1179

944

self.send_changedstate()

1180

self.approved = value

1181

gobject.timeout_add(timedelta_to_milliseconds

945

self._approved = value

946

gobject.timeout_add(_timedelta_to_milliseconds

1182

947

(self.approval_duration),

1183

948

self._reset_approved)

1184

949

1185

950

1186

951

## D-Bus methods, signals & properties

1187

_interface = "se.recompile.Mandos.Client"

1188

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

1189

954

## Signals

1190

955

1191

956

# CheckerCompleted - signal

1290

1055

access="readwrite")

1291

1056

def ApprovalDuration_dbus_property(self, value=None):

1292

1057

if value is None: # get

1293

return dbus.UInt64(timedelta_to_milliseconds(

1058

return dbus.UInt64(_timedelta_to_milliseconds(

1294

1059

self.approval_duration))

1295

1060

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1296

1061

1310

1075

def Host_dbus_property(self, value=None):

1311

1076

if value is None: # get

1312

1077

return dbus.String(self.host)

1313

self.host = unicode(value)

1078

self.host = value

1314

1079

1315

1080

# Created - property

1316

1081

@dbus_service_property(_interface, signature="s", access="read")

1317

1082

def Created_dbus_property(self):

1318

return datetime_to_dbus(self.created)

1083

return dbus.String(datetime_to_dbus(self.created))

1319

1084

1320

1085

# LastEnabled - property

1321

1086

@dbus_service_property(_interface, signature="s", access="read")

1342

1107

return

1343

1108

return datetime_to_dbus(self.last_checked_ok)

1344

1109

1345

# LastCheckerStatus - property

1346

@dbus_service_property(_interface, signature="n",

1347

access="read")

1348

def LastCheckerStatus_dbus_property(self):

1349

return dbus.Int16(self.last_checker_status)

1350

1351

1110

# Expires - property

1352

1111

@dbus_service_property(_interface, signature="s", access="read")

1353

1112

def Expires_dbus_property(self):

1365

1124

if value is None: # get

1366

1125

return dbus.UInt64(self.timeout_milliseconds())

1367

1126

self.timeout = datetime.timedelta(0, 0, 0, value)

1127

if getattr(self, "disable_initiator_tag", None) is None:

1128

return

1368

1129

# Reschedule timeout

1369

if self.enabled:

1370

now = datetime.datetime.utcnow()

1371

time_to_die = timedelta_to_milliseconds(

1372

(self.last_checked_ok + self.timeout) - now)

1373

if time_to_die <= 0:

1374

# The timeout has passed

1375

self.disable()

1376

else:

1377

self.expires = (now +

1378

datetime.timedelta(milliseconds =

1379

time_to_die))

1380

if (getattr(self, "disable_initiator_tag", None)

1381

is None):

1382

return

1383

gobject.source_remove(self.disable_initiator_tag)

1384

self.disable_initiator_tag = (gobject.timeout_add

1385

(time_to_die,

1386

self.disable))

1130

gobject.source_remove(self.disable_initiator_tag)

1131

self.disable_initiator_tag = None

1132

self.expires = None

1133

time_to_die = (self.

1134

_timedelta_to_milliseconds((self

1135

.last_checked_ok

1136

+ self.timeout)

1137

- datetime.datetime

1138

.utcnow()))

1139

if time_to_die <= 0:

1140

# The timeout has passed

1141

self.disable()

1142

else:

1143

self.expires = (datetime.datetime.utcnow()

1144

+ datetime.timedelta(milliseconds = time_to_die))

1145

self.disable_initiator_tag = (gobject.timeout_add

1146

(time_to_die, self.disable))

1387

1147

1388

1148

# ExtendedTimeout - property

1389

1149

@dbus_service_property(_interface, signature="t",

1402

1162

self.interval = datetime.timedelta(0, 0, 0, value)

1403

1163

if getattr(self, "checker_initiator_tag", None) is None:

1404

1164

return

1405

if self.enabled:

1406

# Reschedule checker run

1407

gobject.source_remove(self.checker_initiator_tag)

1408

self.checker_initiator_tag = (gobject.timeout_add

1409

(value, self.start_checker))

1410

self.start_checker() # Start one now, too

1165

# Reschedule checker run

1166

gobject.source_remove(self.checker_initiator_tag)

1167

self.checker_initiator_tag = (gobject.timeout_add

1168

(value, self.start_checker))

1169

self.start_checker() # Start one now, too

1411

1170

1412

1171

# Checker - property

1413

1172

@dbus_service_property(_interface, signature="s",

1415

1174

def Checker_dbus_property(self, value=None):

1416

1175

if value is None: # get

1417

1176

return dbus.String(self.checker_command)

1418

self.checker_command = unicode(value)

1177

self.checker_command = value

1419

1178

1420

1179

# CheckerRunning - property

1421

1180

@dbus_service_property(_interface, signature="b",

1450

1209

raise KeyError()

1451

1210

1452

1211

def __getattribute__(self, name):

1453

if name == '_pipe':

1212

if(name == '_pipe'):

1454

1213

return super(ProxyClient, self).__getattribute__(name)

1455

1214

self._pipe.send(('getattr', name))

1456

1215

data = self._pipe.recv()

1463

1222

return func

1464

1223

1465

1224

def __setattr__(self, name, value):

1466

if name == '_pipe':

1225

if(name == '_pipe'):

1467

1226

return super(ProxyClient, self).__setattr__(name, value)

1468

1227

self._pipe.send(('setattr', name, value))

1469

1228

1470

1471

1229

class ClientDBusTransitional(ClientDBus):

1472

__metaclass__ = AlternateDBusNamesMetaclass

1473

1230

__metaclass__ = transitional_dbus_metaclass

1474

1231

1475

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

1476

1233

"""A class to handle client connections.

1556

1313

client.name)

1557

1314

if self.server.use_dbus:

1558

1315

# Emit D-Bus signal

1559

client.Rejected("Disabled")

1316

client.Rejected("Disabled")

1560

1317

return

1561

1318

1562

if client.approved or not client.approval_delay:

1319

if client._approved or not client.approval_delay:

1563

1320

#We are approved or approval is disabled

1564

1321

break

1565

elif client.approved is None:

1322

elif client._approved is None:

1566

1323

logger.info("Client %s needs approval",

1567

1324

client.name)

1568

1325

if self.server.use_dbus:

1579

1336

return

1580

1337

1581

1338

#wait until timeout or approved

1339

#x = float(client._timedelta_to_milliseconds(delay))

1582

1340

time = datetime.datetime.now()

1583

1341

client.changedstate.acquire()

1584

(client.changedstate.wait

1585

(float(client.timedelta_to_milliseconds(delay)

1586

/ 1000)))

1342

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1587

1343

client.changedstate.release()

1588

1344

time2 = datetime.datetime.now()

1589

1345

if (time2 - time) >= delay:

1613

1369

sent_size += sent

1614

1370

1615

1371

logger.info("Sending secret to %s", client.name)

1616

# bump the timeout using extended_timeout

1617

client.bump_timeout(client.extended_timeout)

1372

# bump the timeout as if seen

1373

client.checked_ok(client.extended_timeout)

1618

1374

if self.server.use_dbus:

1619

1375

# Emit D-Bus signal

1620

1376

client.GotSecret()

1687

1443

# Convert the buffer to a Python bytestring

1688

1444

fpr = ctypes.string_at(buf, buf_len.value)

1689

1445

# Convert the bytestring to hexadecimal notation

1690

hex_fpr = binascii.hexlify(fpr).upper()

1446

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1691

1447

return hex_fpr

1692

1448

1693

1449

1696

1452

def sub_process_main(self, request, address):

1697

1453

try:

1698

1454

self.finish_request(request, address)

1699

except Exception:

1455

except:

1700

1456

self.handle_error(request, address)

1701

1457

self.close_request(request)

1702

1458

1703

1459

def process_request(self, request, address):

1704

1460

"""Start a new process to process the request."""

1705

proc = multiprocessing.Process(target = self.sub_process_main,

1706

args = (request,

1707

address))

1708

proc.start()

1709

return proc

1461

multiprocessing.Process(target = self.sub_process_main,

1462

args = (request, address)).start()

1710

1463

1711

1464

1712

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1718

1471

"""

1719

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1720

1473

1721

proc = MultiprocessingMixIn.process_request(self, request,

1722

client_address)

1474

super(MultiprocessingMixInWithPipe,

1475

self).process_request(request, client_address)

1723

1476

self.child_pipe.close()

1724

self.add_pipe(parent_pipe, proc)

1477

self.add_pipe(parent_pipe)

1725

1478

1726

def add_pipe(self, parent_pipe, proc):

1479

def add_pipe(self, parent_pipe):

1727

1480

"""Dummy function; override as necessary"""

1728

1481

raise NotImplementedError

1729

1482

1807

1560

self.enabled = False

1808

1561

self.clients = clients

1809

1562

if self.clients is None:

1810

self.clients = {}

1563

self.clients = set()

1811

1564

self.use_dbus = use_dbus

1812

1565

self.gnutls_priority = gnutls_priority

1813

1566

IPv6_TCPServer.__init__(self, server_address,

1817

1570

def server_activate(self):

1818

1571

if self.enabled:

1819

1572

return socketserver.TCPServer.server_activate(self)

1820

1821

1573

def enable(self):

1822

1574

self.enabled = True

1823

1824

def add_pipe(self, parent_pipe, proc):

1575

def add_pipe(self, parent_pipe):

1825

1576

# Call "handle_ipc" for both data and EOF events

1826

1577

gobject.io_add_watch(parent_pipe.fileno(),

1827

1578

gobject.IO_IN | gobject.IO_HUP,

1828

1579

functools.partial(self.handle_ipc,

1829

parent_pipe =

1830

parent_pipe,

1831

proc = proc))

1832

1580

parent_pipe = parent_pipe))

1581

1833

1582

def handle_ipc(self, source, condition, parent_pipe=None,

1834

proc = None, client_object=None):

1583

client_object=None):

1835

1584

condition_names = {

1836

1585

gobject.IO_IN: "IN", # There is data to read.

1837

1586

gobject.IO_OUT: "OUT", # Data can be written (without

1846

1595

for cond, name in

1847

1596

condition_names.iteritems()

1848

1597

if cond & condition)

1849

# error, or the other end of multiprocessing.Pipe has closed

1598

# error or the other end of multiprocessing.Pipe has closed

1850

1599

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1851

# Wait for other process to exit

1852

proc.join()

1853

1600

return False

1854

1601

1855

1602

# Read a request from the child

1860

1607

fpr = request[1]

1861

1608

address = request[2]

1862

1609

1863

for c in self.clients.itervalues():

1610

for c in self.clients:

1864

1611

if c.fingerprint == fpr:

1865

1612

client = c

1866

1613

break

1869

1616

"dress: %s", fpr, address)

1870

1617

if self.use_dbus:

1871

1618

# Emit D-Bus signal

1872

mandos_dbus_service.ClientNotFound(fpr,

1873

address[0])

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1874

1620

parent_pipe.send(False)

1875

1621

return False

1876

1622

1877

1623

gobject.io_add_watch(parent_pipe.fileno(),

1878

1624

gobject.IO_IN | gobject.IO_HUP,

1879

1625

functools.partial(self.handle_ipc,

1880

parent_pipe =

1881

parent_pipe,

1882

proc = proc,

1883

client_object =

1884

client))

1626

parent_pipe = parent_pipe,

1627

client_object = client))

1885

1628

parent_pipe.send(True)

1886

# remove the old hook in favor of the new above hook on

1887

# same fileno

1629

# remove the old hook in favor of the new above hook on same fileno

1888

1630

return False

1889

1631

if command == 'funcall':

1890

1632

funcname = request[1]

1891

1633

args = request[2]

1892

1634

kwargs = request[3]

1893

1635

1894

parent_pipe.send(('data', getattr(client_object,

1895

funcname)(*args,

1896

**kwargs)))

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1897

1637

1898

1638

if command == 'getattr':

1899

1639

attrname = request[1]

1900

1640

if callable(client_object.__getattribute__(attrname)):

1901

1641

parent_pipe.send(('function',))

1902

1642

else:

1903

parent_pipe.send(('data', client_object

1904

.__getattribute__(attrname)))

1643

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1905

1644

1906

1645

if command == 'setattr':

1907

1646

attrname = request[1]

1950

1689

return timevalue

1951

1690

1952

1691

1692

def if_nametoindex(interface):

1693

"""Call the C function if_nametoindex(), or equivalent

1694

1695

Note: This function cannot accept a unicode string."""

1696

global if_nametoindex

1697

try:

1698

if_nametoindex = (ctypes.cdll.LoadLibrary

1699

(ctypes.util.find_library("c"))

1700

.if_nametoindex)

1701

except (OSError, AttributeError):

1702

logger.warning("Doing if_nametoindex the hard way")

1703

def if_nametoindex(interface):

1704

"Get an interface index the hard way, i.e. using fcntl()"

1705

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1706

with contextlib.closing(socket.socket()) as s:

1707

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1708

struct.pack(str("16s16x"),

1709

interface))

1710

interface_index = struct.unpack(str("I"),

1711

ifreq[16:20])[0]

1712

return interface_index

1713

return if_nametoindex(interface)

1714

1715

1953

1716

def daemon(nochdir = False, noclose = False):

1954

1717

"""See daemon(3). Standard BSD Unix function.

1955

1718

2010

1773

" system bus interface")

2011

1774

parser.add_argument("--no-ipv6", action="store_false",

2012

1775

dest="use_ipv6", help="Do not use IPv6")

2013

parser.add_argument("--no-restore", action="store_false",

2014

dest="restore", help="Do not restore stored"

2015

" state")

2016

parser.add_argument("--statedir", metavar="DIR",

2017

help="Directory to save/restore state in")

2018

2019

1776

options = parser.parse_args()

2020

1777

2021

1778

if options.check:

2034

1791

"use_dbus": "True",

2035

1792

"use_ipv6": "True",

2036

1793

"debuglevel": "",

2037

"restore": "True",

2038

"statedir": "/var/lib/mandos"

2039

1794

}

2040

1795

2041

1796

# Parse config file for server-global settings

2058

1813

# options, if set.

2059

1814

for option in ("interface", "address", "port", "debug",

2060

1815

"priority", "servicename", "configdir",

2061

"use_dbus", "use_ipv6", "debuglevel", "restore",

2062

"statedir"):

1816

"use_dbus", "use_ipv6", "debuglevel"):

2063

1817

value = getattr(options, option)

2064

1818

if value is not None:

2065

1819

server_settings[option] = value

2077

1831

debuglevel = server_settings["debuglevel"]

2078

1832

use_dbus = server_settings["use_dbus"]

2079

1833

use_ipv6 = server_settings["use_ipv6"]

2080

stored_state_path = os.path.join(server_settings["statedir"],

2081

stored_state_file)

2082

2083

if debug:

2084

initlogger(debug, logging.DEBUG)

2085

else:

2086

if not debuglevel:

2087

initlogger(debug)

2088

else:

2089

level = getattr(logging, debuglevel.upper())

2090

initlogger(debug, level)

2091

1834

2092

1835

if server_settings["servicename"] != "Mandos":

2093

1836

syslogger.setFormatter(logging.Formatter

2096

1839

% server_settings["servicename"]))

2097

1840

2098

1841

# Parse config file with clients

2099

client_config = configparser.SafeConfigParser(Client

2100

.client_defaults)

1842

client_defaults = { "timeout": "5m",

1843

"extended_timeout": "15m",

1844

"interval": "2m",

1845

"checker": "fping -q -- %%(host)s",

1846

"host": "",

1847

"approval_delay": "0s",

1848

"approval_duration": "1s",

1849

}

1850

client_config = configparser.SafeConfigParser(client_defaults)

2101

1851

client_config.read(os.path.join(server_settings["configdir"],

2102

1852

"clients.conf"))

2103

1853

2141

1891

if error[0] != errno.EPERM:

2142

1892

raise error

2143

1893

1894

if not debug and not debuglevel:

1895

syslogger.setLevel(logging.WARNING)

1896

console.setLevel(logging.WARNING)

1897

if debuglevel:

1898

level = getattr(logging, debuglevel.upper())

1899

syslogger.setLevel(level)

1900

console.setLevel(level)

1901

2144

1902

if debug:

2145

1903

# Enable all possible GnuTLS debugging

2146

1904

2160

1918

os.dup2(null, sys.stdin.fileno())

2161

1919

if null > 2:

2162

1920

os.close(null)

1921

else:

1922

# No console logging

1923

logger.removeHandler(console)

2163

1924

2164

1925

# Need to fork before connecting to D-Bus

2165

1926

if not debug:

2166

1927

# Close all input and output, do double fork, etc.

2167

1928

daemon()

2168

1929

2169

gobject.threads_init()

2170

2171

1930

global main_loop

2172

1931

# From the Avahi example code

2173

1932

DBusGMainLoop(set_as_default=True )

2176

1935

# End of Avahi example code

2177

1936

if use_dbus:

2178

1937

try:

2179

bus_name = dbus.service.BusName("se.recompile.Mandos",

2180

bus, do_not_queue=True)

2181

old_bus_name = (dbus.service.BusName

2182

("se.bsnet.fukt.Mandos", bus,

2183

do_not_queue=True))

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

2184

1942

except dbus.exceptions.NameExistsException as e:

2185

1943

logger.error(unicode(e) + ", disabling D-Bus")

2186

1944

use_dbus = False

2187

1945

server_settings["use_dbus"] = False

2188

1946

tcp_server.use_dbus = False

2189

1947

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2190

service = AvahiServiceToSyslog(name =

2191

server_settings["servicename"],

2192

servicetype = "_mandos._tcp",

2193

protocol = protocol, bus = bus)

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1950

protocol = protocol, bus = bus)

2194

1951

if server_settings["interface"]:

2195

1952

service.interface = (if_nametoindex

2196

1953

(str(server_settings["interface"])))

2200

1957

2201

1958

client_class = Client

2202

1959

if use_dbus:

2203

client_class = functools.partial(ClientDBusTransitional,

2204

bus = bus)

2205

2206

client_settings = Client.config_parser(client_config)

2207

old_client_settings = {}

2208

clients_data = {}

2209

2210

# Get client data and settings from last running state.

2211

if server_settings["restore"]:

2212

try:

2213

with open(stored_state_path, "rb") as stored_state:

2214

clients_data, old_client_settings = (pickle.load

2215

(stored_state))

2216

os.remove(stored_state_path)

2217

except IOError as e:

2218

logger.warning("Could not load persistent state: {0}"

2219

.format(e))

2220

if e.errno != errno.ENOENT:

2221

raise

2222

except EOFError as e:

2223

logger.warning("Could not load persistent state: "

2224

"EOFError: {0}".format(e))

2225

2226

with PGPEngine() as pgp:

2227

for client_name, client in clients_data.iteritems():

2228

# Decide which value to use after restoring saved state.

2229

# We have three different values: Old config file,

2230

# new config file, and saved state.

2231

# New config value takes precedence if it differs from old

2232

# config value, otherwise use saved state.

2233

for name, value in client_settings[client_name].items():

2234

try:

2235

# For each value in new config, check if it

2236

# differs from the old config value (Except for

2237

# the "secret" attribute)

2238

if (name != "secret" and

2239

value != old_client_settings[client_name]

2240

[name]):

2241

client[name] = value

2242

except KeyError:

2243

pass

2244

2245

# Clients who has passed its expire date can still be

2246

# enabled if its last checker was successful. Clients

2247

# whose checker succeeded before we stored its state is

2248

# assumed to have successfully run all checkers during

2249

# downtime.

2250

if client["enabled"]:

2251

if datetime.datetime.utcnow() >= client["expires"]:

2252

if not client["last_checked_ok"]:

2253

logger.warning(

2254

"disabling client {0} - Client never "

2255

"performed a successful checker"

2256

.format(client_name))

2257

client["enabled"] = False

2258

elif client["last_checker_status"] != 0:

2259

logger.warning(

2260

"disabling client {0} - Client "

2261

"last checker failed with error code {1}"

2262

.format(client_name,

2263

client["last_checker_status"]))

2264

client["enabled"] = False

2265

else:

2266

client["expires"] = (datetime.datetime

2267

.utcnow()

2268

+ client["timeout"])

2269

logger.debug("Last checker succeeded,"

2270

" keeping {0} enabled"

2271

.format(client_name))

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1961

def client_config_items(config, section):

1962

special_settings = {

1963

"approved_by_default":

1964

lambda: config.getboolean(section,

1965

"approved_by_default"),

1966

}

1967

for name, value in config.items(section):

2272

1968

try:

2273

client["secret"] = (

2274

pgp.decrypt(client["encrypted_secret"],

2275

client_settings[client_name]

2276

["secret"]))

2277

except PGPError:

2278

# If decryption fails, we use secret from new settings

2279

logger.debug("Failed to decrypt {0} old secret"

2280

.format(client_name))

2281

client["secret"] = (

2282

client_settings[client_name]["secret"])

2283

2284

2285

# Add/remove clients based on new changes made to config

2286

for client_name in (set(old_client_settings)

2287

- set(client_settings)):

2288

del clients_data[client_name]

2289

for client_name in (set(client_settings)

2290

- set(old_client_settings)):

2291

clients_data[client_name] = client_settings[client_name]

2292

2293

# Create all client objects

2294

for client_name, client in clients_data.iteritems():

2295

tcp_server.clients[client_name] = client_class(

2296

name = client_name, settings = client)

2297

1969

yield (name, special_settings[name]())

1970

except KeyError:

1971

yield (name, value)

1972

1973

tcp_server.clients.update(set(

1974

client_class(name = section,

1975

config= dict(client_config_items(

1976

client_config, section)))

1977

for section in client_config.sections()))

2298

1978

if not tcp_server.clients:

2299

1979

logger.warning("No clients defined")

2300

1980

2311

1991

# "pidfile" was never created

2312

1992

pass

2313

1993

del pidfilename

1994

2314

1995

signal.signal(signal.SIGINT, signal.SIG_IGN)

2315

1996

2316

1997

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2321

2002

"""A D-Bus proxy object"""

2322

2003

def __init__(self):

2323

2004

dbus.service.Object.__init__(self, bus, "/")

2324

_interface = "se.recompile.Mandos"

2005

_interface = "se.bsnet.fukt.Mandos"

2325

2006

2326

2007

@dbus.service.signal(_interface, signature="o")

2327

2008

def ClientAdded(self, objpath):

2342

2023

def GetAllClients(self):

2343

2024

"D-Bus method"

2344

2025

return dbus.Array(c.dbus_object_path

2345

for c in

2346

tcp_server.clients.itervalues())

2026

for c in tcp_server.clients)

2347

2027

2348

2028

@dbus.service.method(_interface,

2349

2029

out_signature="a{oa{sv}}")

2351

2031

"D-Bus method"

2352

2032

return dbus.Dictionary(

2353

2033

((c.dbus_object_path, c.GetAll(""))

2354

for c in tcp_server.clients.itervalues()),

2034

for c in tcp_server.clients),

2355

2035

signature="oa{sv}")

2356

2036

2357

2037

@dbus.service.method(_interface, in_signature="o")

2358

2038

def RemoveClient(self, object_path):

2359

2039

"D-Bus method"

2360

for c in tcp_server.clients.itervalues():

2040

for c in tcp_server.clients:

2361

2041

if c.dbus_object_path == object_path:

2362

del tcp_server.clients[c.name]

2042

tcp_server.clients.remove(c)

2363

2043

c.remove_from_connection()

2364

2044

# Don't signal anything except ClientRemoved

2365

2045

c.disable(quiet=True)

2371

2051

del _interface

2372

2052

2373

2053

class MandosDBusServiceTransitional(MandosDBusService):

2374

__metaclass__ = AlternateDBusNamesMetaclass

2054

__metaclass__ = transitional_dbus_metaclass

2375

2055

mandos_dbus_service = MandosDBusServiceTransitional()

2376

2056

2377

2057

def cleanup():

2378

2058

"Cleanup function; run on exit"

2379

2059

service.cleanup()

2380

2060

2381

multiprocessing.active_children()

2382

if not (tcp_server.clients or client_settings):

2383

return

2384

2385

# Store client before exiting. Secrets are encrypted with key

2386

# based on what config file has. If config file is

2387

# removed/edited, old secret will thus be unrecovable.

2388

clients = {}

2389

with PGPEngine() as pgp:

2390

for client in tcp_server.clients.itervalues():

2391

key = client_settings[client.name]["secret"]

2392

client.encrypted_secret = pgp.encrypt(client.secret,

2393

key)

2394

client_dict = {}

2395

2396

# A list of attributes that can not be pickled

2397

# + secret.

2398

exclude = set(("bus", "changedstate", "secret",

2399

"checker"))

2400

for name, typ in (inspect.getmembers

2401

(dbus.service.Object)):

2402

exclude.add(name)

2403

2404

client_dict["encrypted_secret"] = (client

2405

.encrypted_secret)

2406

for attr in client.client_structure:

2407

if attr not in exclude:

2408

client_dict[attr] = getattr(client, attr)

2409

2410

clients[client.name] = client_dict

2411

del client_settings[client.name]["secret"]

2412

2413

try:

2414

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2415

prefix="clients-",

2416

dir=os.path.dirname

2417

(stored_state_path))

2418

with os.fdopen(tempfd, "wb") as stored_state:

2419

pickle.dump((clients, client_settings), stored_state)

2420

os.rename(tempname, stored_state_path)

2421

except (IOError, OSError) as e:

2422

logger.warning("Could not save persistent state: {0}"

2423

.format(e))

2424

if not debug:

2425

try:

2426

os.remove(tempname)

2427

except NameError:

2428

pass

2429

if e.errno not in set((errno.ENOENT, errno.EACCES,

2430

errno.EEXIST)):

2431

raise e

2432

2433

# Delete all clients, and settings from config

2434

2061

while tcp_server.clients:

2435

name, client = tcp_server.clients.popitem()

2062

client = tcp_server.clients.pop()

2436

2063

if use_dbus:

2437

2064

client.remove_from_connection()

2065

client.disable_hook = None

2438

2066

# Don't signal anything except ClientRemoved

2439

2067

client.disable(quiet=True)

2440

2068

if use_dbus:

2441

2069

# Emit D-Bus signal

2442

mandos_dbus_service.ClientRemoved(client

2443

.dbus_object_path,

2070

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2444

2071

client.name)

2445

client_settings.clear()

2446

2072

2447

2073

atexit.register(cleanup)

2448

2074

2449

for client in tcp_server.clients.itervalues():

2075

for client in tcp_server.clients:

2450

2076

if use_dbus:

2451

2077

# Emit D-Bus signal

2452

2078

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2453

# Need to initiate checking of clients

2454

if client.enabled:

2455

client.init_checker()

2079

client.enable()

2456

2080

2457

2081

tcp_server.enable()

2458

2082

tcp_server.server_activate()

2498

2122

# Must run before the D-Bus bus name gets deregistered

2499

2123

cleanup()

2500

2124

2125

2501

2126

if __name__ == '__main__':

2502

2127

main()