/mandos/trunk : revision 24.1.186

36

37

import SocketServer as socketserver

38

import socket

39

import optparse

39

import argparse

40

import datetime

41

import errno

42

import gnutls.crypto

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

65

66

67

import dbus

67

68

import dbus.service

82

83

SO_BINDTODEVICE = None

83

84

85

version = "1.2.3"

86

version = "1.3.1"

86

87

88

#logger = logging.getLogger('mandos')

88

89

logger = logging.Logger('mandos')

151

152

self.group = None # our entry group

152

153

self.server = None

153

154

self.bus = bus

155

self.entry_group_state_changed_match = None

154

156

def rename(self):

155

157

"""Derived from the Avahi example code"""

156

158

if self.rename_count >= self.max_renames:

168

170

self.remove()

169

171

try:

170

172

self.add()

171

except dbus.exceptions.DBusException, error:

173

except dbus.exceptions.DBusException as error:

172

174

logger.critical("DBusException: %s", error)

173

175

self.cleanup()

174

176

os._exit(1)

175

177

self.rename_count += 1

176

178

def remove(self):

177

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

178

183

if self.group is not None:

179

184

self.group.Reset()

180

185

def add(self):

181

186

"""Derived from the Avahi example code"""

187

self.remove()

182

188

if self.group is None:

183

189

self.group = dbus.Interface(

184

190

self.bus.get_object(avahi.DBUS_NAME,

185

191

self.server.EntryGroupNew()),

186

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

187

self.group.connect_to_signal('StateChanged',

188

self

189

.entry_group_state_changed)

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

190

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

191

197

self.name, self.type)

192

198

self.group.AddService(

215

221

def cleanup(self):

216

222

"""Derived from the Avahi example code"""

217

223

if self.group is not None:

218

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

219

229

self.group = None

220

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

221

232

"""Derived from the Avahi example code"""

222

233

logger.debug("Avahi server state change: %i", state)

223

if state == avahi.SERVER_COLLISION:

224

logger.error("Zeroconf server name collision")

225

self.remove()

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

226

248

elif state == avahi.SERVER_RUNNING:

227

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

228

255

def activate(self):

229

256

"""Derived from the Avahi example code"""

230

257

if self.server is None:

231

258

self.server = dbus.Interface(

232

259

self.bus.get_object(avahi.DBUS_NAME,

233

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

234

262

avahi.DBUS_INTERFACE_SERVER)

235

263

self.server.connect_to_signal("StateChanged",

236

264

self.server_state_changed)

237

265

self.server_state_changed(self.server.GetState())

238

266

239

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

240

274

class Client(object):

241

275

"""A representation of a client host served by this server.

242

276

270

304

secret: bytestring; sent verbatim (over TLS) to client

271

305

timeout: datetime.timedelta(); How long from last_checked_ok

272

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

273

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

274

311

"""

275

312

276

313

runtime_expansions = ("approval_delay", "approval_duration",

278

315

"host", "interval", "last_checked_ok",

279

316

"last_enabled", "name", "timeout")

280

317

281

@staticmethod

282

def _timedelta_to_milliseconds(td):

283

"Convert a datetime.timedelta() to milliseconds"

284

return ((td.days * 24 * 60 * 60 * 1000)

285

+ (td.seconds * 1000)

286

+ (td.microseconds // 1000))

287

288

318

def timeout_milliseconds(self):

289

319

"Return the 'timeout' attribute in milliseconds"

290

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

291

325

292

326

def interval_milliseconds(self):

293

327

"Return the 'interval' attribute in milliseconds"

294

return self._timedelta_to_milliseconds(self.interval)

295

328

return _timedelta_to_milliseconds(self.interval)

329

296

330

def approval_delay_milliseconds(self):

297

return self._timedelta_to_milliseconds(self.approval_delay)

331

return _timedelta_to_milliseconds(self.approval_delay)

298

332

299

333

def __init__(self, name = None, disable_hook=None, config=None):

300

334

"""Note: the 'checker' key in 'config' sets the

327

361

self.last_enabled = None

328

362

self.last_checked_ok = None

329

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

330

365

self.interval = string_to_delta(config["interval"])

331

366

self.disable_hook = disable_hook

332

367

self.checker = None

333

368

self.checker_initiator_tag = None

334

369

self.disable_initiator_tag = None

370

self.expires = None

335

371

self.checker_callback_tag = None

336

372

self.checker_command = config["checker"]

337

373

self.current_checker_command = None

357

393

# Already enabled

358

394

return

359

395

self.send_changedstate()

360

self.last_enabled = datetime.datetime.utcnow()

361

396

# Schedule a new checker to be started an 'interval' from now,

362

397

# and every interval from then on.

363

398

self.checker_initiator_tag = (gobject.timeout_add

364

399

(self.interval_milliseconds(),

365

400

self.start_checker))

366

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

367

403

self.disable_initiator_tag = (gobject.timeout_add

368

404

(self.timeout_milliseconds(),

369

405

self.disable))

370

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

371

408

# Also start a new checker *right now*.

372

409

self.start_checker()

373

410

382

419

if getattr(self, "disable_initiator_tag", False):

383

420

gobject.source_remove(self.disable_initiator_tag)

384

421

self.disable_initiator_tag = None

422

self.expires = None

385

423

if getattr(self, "checker_initiator_tag", False):

386

424

gobject.source_remove(self.checker_initiator_tag)

387

425

self.checker_initiator_tag = None

413

451

logger.warning("Checker for %(name)s crashed?",

414

452

vars(self))

415

453

416

def checked_ok(self):

454

def checked_ok(self, timeout=None):

417

455

"""Bump up the timeout for this client.

418

456

419

457

This should only be called when the client has been seen,

420

458

alive and well.

421

459

"""

460

if timeout is None:

461

timeout = self.timeout

422

462

self.last_checked_ok = datetime.datetime.utcnow()

423

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

424

465

self.disable_initiator_tag = (gobject.timeout_add

425

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

426

467

self.disable))

427

468

428

469

def need_approval(self):

445

486

# If a checker exists, make sure it is not a zombie

446

487

try:

447

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

448

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

449

490

if (isinstance(error, OSError)

450

491

and error.errno != errno.ECHILD):

451

492

raise error

469

510

'replace')))

470

511

for attr in

471

512

self.runtime_expansions)

472

513

473

514

try:

474

515

command = self.checker_command % escaped_attrs

475

except TypeError, error:

516

except TypeError as error:

476

517

logger.error('Could not format string "%s":'

477

518

' %s', self.checker_command, error)

478

519

return True # Try again later

497

538

if pid:

498

539

gobject.source_remove(self.checker_callback_tag)

499

540

self.checker_callback(pid, status, command)

500

except OSError, error:

541

except OSError as error:

501

542

logger.error("Failed to start subprocess: %s",

502

543

error)

503

544

# Re-run this periodically if run by gobject.timeout_add

516

557

#time.sleep(0.5)

517

558

#if self.checker.poll() is None:

518

559

# os.kill(self.checker.pid, signal.SIGKILL)

519

except OSError, error:

560

except OSError as error:

520

561

if error.errno != errno.ESRCH: # No such process

521

562

raise

522

563

self.checker = None

523

564

565

524

566

def dbus_service_property(dbus_interface, signature="v",

525

567

access="readwrite", byte_arrays=False):

526

568

"""Decorators for marking methods of a DBusObjectWithProperties to

572

614

573

615

class DBusObjectWithProperties(dbus.service.Object):

574

616

"""A D-Bus object with properties.

575

617

576

618

Classes inheriting from this can use the dbus_service_property

577

619

decorator to expose methods as D-Bus properties. It exposes the

578

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

585

627

def _get_all_dbus_properties(self):

586

628

"""Returns a generator of (name, attribute) pairs

587

629

"""

588

return ((prop._dbus_name, prop)

589

for name, prop in

590

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

591

633

592

634

def _get_dbus_property(self, interface_name, property_name):

593

635

"""Returns a bound method if one exists which is a D-Bus

594

636

property with the specified name and interface.

595

637

"""

596

for name in (property_name,

597

property_name + "_dbus_property"):

598

prop = getattr(self, name, None)

599

if (prop is None

600

or not self._is_dbus_property(prop)

601

or prop._dbus_name != property_name

602

or (interface_name and prop._dbus_interface

603

and interface_name != prop._dbus_interface)):

604

continue

605

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

606

643

# No such property

607

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

608

645

+ interface_name + "."

609

646

+ property_name)

647

610

648

611

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

612

650

out_signature="v")

642

680

def GetAll(self, interface_name):

643

681

"""Standard D-Bus property GetAll() method, see D-Bus

644

682

standard.

645

683

646

684

Note: Will not include properties with access="write".

647

685

"""

648

686

all = {}

704

742

xmlstring = document.toxml("utf-8")

705

743

document.unlink()

706

744

except (AttributeError, xml.dom.DOMException,

707

xml.parsers.expat.ExpatError), error:

745

xml.parsers.expat.ExpatError) as error:

708

746

logger.error("Failed to override Introspection method",

709

747

error)

710

748

return xmlstring

711

749

712

750

751

def datetime_to_dbus (dt, variant_level=0):

752

"""Convert a UTC datetime.datetime() to a D-Bus type."""

753

if dt is None:

754

return dbus.String("", variant_level = variant_level)

755

return dbus.String(dt.isoformat(),

756

variant_level=variant_level)

757

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

759

def __new__(mcs, name, bases, attr):

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

812

return type.__new__(mcs, name, bases, attr)

813

713

814

class ClientDBus(Client, DBusObjectWithProperties):

714

815

"""A Client class using D-Bus

715

816

737

838

DBusObjectWithProperties.__init__(self, self.bus,

738

839

self.dbus_object_path)

739

840

740

def _get_approvals_pending(self):

741

return self._approvals_pending

742

def _set_approvals_pending(self, value):

743

old_value = self._approvals_pending

744

self._approvals_pending = value

745

bval = bool(value)

746

if (hasattr(self, "dbus_object_path")

747

and bval is not bool(old_value)):

748

dbus_bool = dbus.Boolean(bval, variant_level=1)

749

self.PropertyChanged(dbus.String("ApprovalPending"),

750

dbus_bool)

751

752

approvals_pending = property(_get_approvals_pending,

753

_set_approvals_pending)

754

del _get_approvals_pending, _set_approvals_pending

755

756

@staticmethod

757

def _datetime_to_dbus(dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

return dbus.String(dt.isoformat(),

760

variant_level=variant_level)

761

762

def enable(self):

763

oldstate = getattr(self, "enabled", False)

764

r = Client.enable(self)

765

if oldstate != self.enabled:

766

# Emit D-Bus signals

767

self.PropertyChanged(dbus.String("Enabled"),

768

dbus.Boolean(True, variant_level=1))

769

self.PropertyChanged(

770

dbus.String("LastEnabled"),

771

self._datetime_to_dbus(self.last_enabled,

772

variant_level=1))

773

return r

774

775

def disable(self, quiet = False):

776

oldstate = getattr(self, "enabled", False)

777

r = Client.disable(self, quiet=quiet)

778

if not quiet and oldstate != self.enabled:

779

# Emit D-Bus signal

780

self.PropertyChanged(dbus.String("Enabled"),

781

dbus.Boolean(False, variant_level=1))

782

return r

841

def notifychangeproperty(transform_func,

842

dbus_name, type_func=lambda x: x,

843

variant_level=1):

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

849

type_func: Function that transform the value before sending it

850

to DBus

851

variant_level: DBus variant level. default: 1

852

"""

853

real_value = [None,]

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

857

if hasattr(self, "dbus_object_path"):

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

861

self.PropertyChanged(dbus.String(dbus_name),

862

dbus_value)

863

864

return property(lambda self: real_value[0], setter)

865

866

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

868

approvals_pending = notifychangeproperty(dbus.Boolean,

869

"ApprovalPending",

870

type_func = bool)

871

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

872

last_enabled = notifychangeproperty(datetime_to_dbus,

873

"LastEnabled")

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

875

type_func = lambda checker: checker is not None)

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

877

"LastCheckedOK")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

880

approved_by_default = notifychangeproperty(dbus.Boolean,

881

"ApprovedByDefault")

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

886

host = notifychangeproperty(dbus.String, "Host")

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

893

checker_command = notifychangeproperty(dbus.String, "Checker")

894

895

del notifychangeproperty

783

896

784

897

def __del__(self, *args, **kwargs):

785

898

try:

794

907

*args, **kwargs):

795

908

self.checker_callback_tag = None

796

909

self.checker = None

797

# Emit D-Bus signal

798

self.PropertyChanged(dbus.String("CheckerRunning"),

799

dbus.Boolean(False, variant_level=1))

800

910

if os.WIFEXITED(condition):

801

911

exitstatus = os.WEXITSTATUS(condition)

802

912

# Emit D-Bus signal

812

922

return Client.checker_callback(self, pid, condition, command,

813

923

*args, **kwargs)

814

924

815

def checked_ok(self, *args, **kwargs):

816

r = Client.checked_ok(self, *args, **kwargs)

817

# Emit D-Bus signal

818

self.PropertyChanged(

819

dbus.String("LastCheckedOK"),

820

(self._datetime_to_dbus(self.last_checked_ok,

821

variant_level=1)))

822

return r

823

824

def need_approval(self, *args, **kwargs):

825

r = Client.need_approval(self, *args, **kwargs)

826

# Emit D-Bus signal

827

self.PropertyChanged(

828

dbus.String("LastApprovalRequest"),

829

(self._datetime_to_dbus(self.last_approval_request,

830

variant_level=1)))

831

return r

832

833

925

def start_checker(self, *args, **kwargs):

834

926

old_checker = self.checker

835

927

if self.checker is not None:

842

934

and old_checker_pid != self.checker.pid):

843

935

# Emit D-Bus signal

844

936

self.CheckerStarted(self.current_checker_command)

845

self.PropertyChanged(

846

dbus.String("CheckerRunning"),

847

dbus.Boolean(True, variant_level=1))

848

937

return r

849

938

850

def stop_checker(self, *args, **kwargs):

851

old_checker = getattr(self, "checker", None)

852

r = Client.stop_checker(self, *args, **kwargs)

853

if (old_checker is not None

854

and getattr(self, "checker", None) is None):

855

self.PropertyChanged(dbus.String("CheckerRunning"),

856

dbus.Boolean(False, variant_level=1))

857

return r

858

859

939

def _reset_approved(self):

860

940

self._approved = None

861

941

return False

863

943

def approve(self, value=True):

864

944

self.send_changedstate()

865

945

self._approved = value

866

gobject.timeout_add(self._timedelta_to_milliseconds

946

gobject.timeout_add(_timedelta_to_milliseconds

867

947

(self.approval_duration),

868

948

self._reset_approved)

869

949

870

950

871

951

## D-Bus methods, signals & properties

872

952

_interface = "se.bsnet.fukt.Mandos.Client"

873

953

874

954

## Signals

875

955

876

956

# CheckerCompleted - signal

922

1002

# CheckedOK - method

923

1003

@dbus.service.method(_interface)

924

1004

def CheckedOK(self):

925

return self.checked_ok()

1005

self.checked_ok()

926

1006

927

1007

# Enable - method

928

1008

@dbus.service.method(_interface)

961

1041

if value is None: # get

962

1042

return dbus.Boolean(self.approved_by_default)

963

1043

self.approved_by_default = bool(value)

964

# Emit D-Bus signal

965

self.PropertyChanged(dbus.String("ApprovedByDefault"),

966

dbus.Boolean(value, variant_level=1))

967

1044

968

1045

# ApprovalDelay - property

969

1046

@dbus_service_property(_interface, signature="t",

972

1049

if value is None: # get

973

1050

return dbus.UInt64(self.approval_delay_milliseconds())

974

1051

self.approval_delay = datetime.timedelta(0, 0, 0, value)

975

# Emit D-Bus signal

976

self.PropertyChanged(dbus.String("ApprovalDelay"),

977

dbus.UInt64(value, variant_level=1))

978

1052

979

1053

# ApprovalDuration - property

980

1054

@dbus_service_property(_interface, signature="t",

981

1055

access="readwrite")

982

1056

def ApprovalDuration_dbus_property(self, value=None):

983

1057

if value is None: # get

984

return dbus.UInt64(self._timedelta_to_milliseconds(

1058

return dbus.UInt64(_timedelta_to_milliseconds(

985

1059

self.approval_duration))

986

1060

self.approval_duration = datetime.timedelta(0, 0, 0, value)

987

# Emit D-Bus signal

988

self.PropertyChanged(dbus.String("ApprovalDuration"),

989

dbus.UInt64(value, variant_level=1))

990

1061

991

1062

# Name - property

992

1063

@dbus_service_property(_interface, signature="s", access="read")

1005

1076

if value is None: # get

1006

1077

return dbus.String(self.host)

1007

1078

self.host = value

1008

# Emit D-Bus signal

1009

self.PropertyChanged(dbus.String("Host"),

1010

dbus.String(value, variant_level=1))

1011

1079

1012

1080

# Created - property

1013

1081

@dbus_service_property(_interface, signature="s", access="read")

1014

1082

def Created_dbus_property(self):

1015

return dbus.String(self._datetime_to_dbus(self.created))

1083

return dbus.String(datetime_to_dbus(self.created))

1016

1084

1017

1085

# LastEnabled - property

1018

1086

@dbus_service_property(_interface, signature="s", access="read")

1019

1087

def LastEnabled_dbus_property(self):

1020

if self.last_enabled is None:

1021

return dbus.String("")

1022

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1088

return datetime_to_dbus(self.last_enabled)

1023

1089

1024

1090

# Enabled - property

1025

1091

@dbus_service_property(_interface, signature="b",

1039

1105

if value is not None:

1040

1106

self.checked_ok()

1041

1107

return

1042

if self.last_checked_ok is None:

1043

return dbus.String("")

1044

return dbus.String(self._datetime_to_dbus(self

1045

.last_checked_ok))

1108

return datetime_to_dbus(self.last_checked_ok)

1109

1110

# Expires - property

1111

@dbus_service_property(_interface, signature="s", access="read")

1112

def Expires_dbus_property(self):

1113

return datetime_to_dbus(self.expires)

1046

1114

1047

1115

# LastApprovalRequest - property

1048

1116

@dbus_service_property(_interface, signature="s", access="read")

1049

1117

def LastApprovalRequest_dbus_property(self):

1050

if self.last_approval_request is None:

1051

return dbus.String("")

1052

return dbus.String(self.

1053

_datetime_to_dbus(self

1054

.last_approval_request))

1118

return datetime_to_dbus(self.last_approval_request)

1055

1119

1056

1120

# Timeout - property

1057

1121

@dbus_service_property(_interface, signature="t",

1060

1124

if value is None: # get

1061

1125

return dbus.UInt64(self.timeout_milliseconds())

1062

1126

self.timeout = datetime.timedelta(0, 0, 0, value)

1063

# Emit D-Bus signal

1064

self.PropertyChanged(dbus.String("Timeout"),

1065

dbus.UInt64(value, variant_level=1))

1066

1127

if getattr(self, "disable_initiator_tag", None) is None:

1067

1128

return

1068

1129

# Reschedule timeout

1069

1130

gobject.source_remove(self.disable_initiator_tag)

1070

1131

self.disable_initiator_tag = None

1132

self.expires = None

1071

1133

time_to_die = (self.

1072

1134

_timedelta_to_milliseconds((self

1073

1135

.last_checked_ok

1078

1140

# The timeout has passed

1079

1141

self.disable()

1080

1142

else:

1143

self.expires = (datetime.datetime.utcnow()

1144

+ datetime.timedelta(milliseconds = time_to_die))

1081

1145

self.disable_initiator_tag = (gobject.timeout_add

1082

1146

(time_to_die, self.disable))

1083

1147

1148

# ExtendedTimeout - property

1149

@dbus_service_property(_interface, signature="t",

1150

access="readwrite")

1151

def ExtendedTimeout_dbus_property(self, value=None):

1152

if value is None: # get

1153

return dbus.UInt64(self.extended_timeout_milliseconds())

1154

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1155

1084

1156

# Interval - property

1085

1157

@dbus_service_property(_interface, signature="t",

1086

1158

access="readwrite")

1088

1160

if value is None: # get

1089

1161

return dbus.UInt64(self.interval_milliseconds())

1090

1162

self.interval = datetime.timedelta(0, 0, 0, value)

1091

# Emit D-Bus signal

1092

self.PropertyChanged(dbus.String("Interval"),

1093

dbus.UInt64(value, variant_level=1))

1094

1163

if getattr(self, "checker_initiator_tag", None) is None:

1095

1164

return

1096

1165

# Reschedule checker run

1098

1167

self.checker_initiator_tag = (gobject.timeout_add

1099

1168

(value, self.start_checker))

1100

1169

self.start_checker() # Start one now, too

1101

1170

1102

1171

# Checker - property

1103

1172

@dbus_service_property(_interface, signature="s",

1104

1173

access="readwrite")

1106

1175

if value is None: # get

1107

1176

return dbus.String(self.checker_command)

1108

1177

self.checker_command = value

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Checker"),

1111

dbus.String(self.checker_command,

1112

variant_level=1))

1113

1178

1114

1179

# CheckerRunning - property

1115

1180

@dbus_service_property(_interface, signature="b",

1142

1207

self._pipe.send(('init', fpr, address))

1143

1208

if not self._pipe.recv():

1144

1209

raise KeyError()

1145

1210

1146

1211

def __getattribute__(self, name):

1147

1212

if(name == '_pipe'):

1148

1213

return super(ProxyClient, self).__getattribute__(name)

1155

1220

self._pipe.send(('funcall', name, args, kwargs))

1156

1221

return self._pipe.recv()[1]

1157

1222

return func

1158

1223

1159

1224

def __setattr__(self, name, value):

1160

1225

if(name == '_pipe'):

1161

1226

return super(ProxyClient, self).__setattr__(name, value)

1162

1227

self._pipe.send(('setattr', name, value))

1163

1228

1229

class ClientDBusTransitional(ClientDBus):

1230

__metaclass__ = transitional_dbus_metaclass

1164

1231

1165

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

1166

1233

"""A class to handle client connections.

1174

1241

unicode(self.client_address))

1175

1242

logger.debug("Pipe FD: %d",

1176

1243

self.server.child_pipe.fileno())

1177

1244

1178

1245

session = (gnutls.connection

1179

1246

.ClientSession(self.request,

1180

1247

gnutls.connection

1181

1248

.X509Credentials()))

1182

1249

1183

1250

# Note: gnutls.connection.X509Credentials is really a

1184

1251

# generic GnuTLS certificate credentials object so long as

1185

1252

# no X.509 keys are added to it. Therefore, we can use it

1186

1253

# here despite using OpenPGP certificates.

1187

1254

1188

1255

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1189

1256

# "+AES-256-CBC", "+SHA1",

1190

1257

# "+COMP-NULL", "+CTYPE-OPENPGP",

1196

1263

(gnutls.library.functions

1197

1264

.gnutls_priority_set_direct(session._c_object,

1198

1265

priority, None))

1199

1266

1200

1267

# Start communication using the Mandos protocol

1201

1268

# Get protocol number

1202

1269

line = self.request.makefile().readline()

1204

1271

try:

1205

1272

if int(line.strip().split()[0]) > 1:

1206

1273

raise RuntimeError

1207

except (ValueError, IndexError, RuntimeError), error:

1274

except (ValueError, IndexError, RuntimeError) as error:

1208

1275

logger.error("Unknown protocol version: %s", error)

1209

1276

return

1210

1277

1211

1278

# Start GnuTLS connection

1212

1279

try:

1213

1280

session.handshake()

1214

except gnutls.errors.GNUTLSError, error:

1281

except gnutls.errors.GNUTLSError as error:

1215

1282

logger.warning("Handshake failed: %s", error)

1216

1283

# Do not run session.bye() here: the session is not

1217

1284

# established. Just abandon the request.

1218

1285

return

1219

1286

logger.debug("Handshake succeeded")

1220

1287

1221

1288

approval_required = False

1222

1289

try:

1223

1290

try:

1224

1291

fpr = self.fingerprint(self.peer_certificate

1225

1292

(session))

1226

except (TypeError, gnutls.errors.GNUTLSError), error:

1293

except (TypeError,

1294

gnutls.errors.GNUTLSError) as error:

1227

1295

logger.warning("Bad certificate: %s", error)

1228

1296

return

1229

1297

logger.debug("Fingerprint: %s", fpr)

1230

1298

1231

1299

try:

1232

1300

client = ProxyClient(child_pipe, fpr,

1233

1301

self.client_address)

1241

1309

1242

1310

while True:

1243

1311

if not client.enabled:

1244

logger.warning("Client %s is disabled",

1312

logger.info("Client %s is disabled",

1245

1313

client.name)

1246

1314

if self.server.use_dbus:

1247

1315

# Emit D-Bus signal

1292

1360

while sent_size < len(client.secret):

1293

1361

try:

1294

1362

sent = session.send(client.secret[sent_size:])

1295

except (gnutls.errors.GNUTLSError), error:

1363

except gnutls.errors.GNUTLSError as error:

1296

1364

logger.warning("gnutls send failed")

1297

1365

return

1298

1366

logger.debug("Sent: %d, remaining: %d",

1299

1367

sent, len(client.secret)

1300

1368

- (sent_size + sent))

1301

1369

sent_size += sent

1302

1370

1303

1371

logger.info("Sending secret to %s", client.name)

1304

1372

# bump the timeout as if seen

1305

client.checked_ok()

1373

client.checked_ok(client.extended_timeout)

1306

1374

if self.server.use_dbus:

1307

1375

# Emit D-Bus signal

1308

1376

client.GotSecret()

1312

1380

client.approvals_pending -= 1

1313

1381

try:

1314

1382

session.bye()

1315

except (gnutls.errors.GNUTLSError), error:

1383

except gnutls.errors.GNUTLSError as error:

1316

1384

logger.warning("GnuTLS bye failed")

1317

1385

1318

1386

@staticmethod

1393

1461

multiprocessing.Process(target = self.sub_process_main,

1394

1462

args = (request, address)).start()

1395

1463

1464

1396

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1397

1466

""" adds a pipe to the MixIn """

1398

1467

def process_request(self, request, client_address):

1401

1470

This function creates a new pipe in self.pipe

1402

1471

"""

1403

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1404

1473

1405

1474

super(MultiprocessingMixInWithPipe,

1406

1475

self).process_request(request, client_address)

1407

1476

self.child_pipe.close()

1408

1477

self.add_pipe(parent_pipe)

1409

1478

1410

1479

def add_pipe(self, parent_pipe):

1411

1480

"""Dummy function; override as necessary"""

1412

1481

raise NotImplementedError

1413

1482

1483

1414

1484

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1415

1485

socketserver.TCPServer, object):

1416

1486

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1442

1512

SO_BINDTODEVICE,

1443

1513

str(self.interface

1444

1514

+ '\0'))

1445

except socket.error, error:

1515

except socket.error as error:

1446

1516

if error[0] == errno.EPERM:

1447

1517

logger.error("No permission to"

1448

1518

" bind to interface %s",

1542

1612

client = c

1543

1613

break

1544

1614

else:

1545

logger.warning("Client not found for fingerprint: %s, ad"

1546

"dress: %s", fpr, address)

1615

logger.info("Client not found for fingerprint: %s, ad"

1616

"dress: %s", fpr, address)

1547

1617

if self.use_dbus:

1548

1618

# Emit D-Bus signal

1549

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1564

1634

kwargs = request[3]

1565

1635

1566

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1567

1637

1568

1638

if command == 'getattr':

1569

1639

attrname = request[1]

1570

1640

if callable(client_object.__getattribute__(attrname)):

1576

1646

attrname = request[1]

1577

1647

value = request[2]

1578

1648

setattr(client_object, attrname, value)

1579

1649

1580

1650

return True

1581

1651

1582

1652

1613

1683

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1614

1684

else:

1615

1685

raise ValueError("Unknown suffix %r" % suffix)

1616

except (ValueError, IndexError), e:

1686

except (ValueError, IndexError) as e:

1617

1687

raise ValueError(*(e.args))

1618

1688

timevalue += delta

1619

1689

return timevalue

1673

1743

##################################################################

1674

1744

# Parsing of options, both command line and config file

1675

1745

1676

parser = optparse.OptionParser(version = "%%prog %s" % version)

1677

parser.add_option("-i", "--interface", type="string",

1678

metavar="IF", help="Bind to interface IF")

1679

parser.add_option("-a", "--address", type="string",

1680

help="Address to listen for requests on")

1681

parser.add_option("-p", "--port", type="int",

1682

help="Port number to receive requests on")

1683

parser.add_option("--check", action="store_true",

1684

help="Run self-test")

1685

parser.add_option("--debug", action="store_true",

1686

help="Debug mode; run in foreground and log to"

1687

" terminal")

1688

parser.add_option("--debuglevel", type="string", metavar="LEVEL",

1689

help="Debug level for stdout output")

1690

parser.add_option("--priority", type="string", help="GnuTLS"

1691

" priority string (see GnuTLS documentation)")

1692

parser.add_option("--servicename", type="string",

1693

metavar="NAME", help="Zeroconf service name")

1694

parser.add_option("--configdir", type="string",

1695

default="/etc/mandos", metavar="DIR",

1696

help="Directory to search for configuration"

1697

" files")

1698

parser.add_option("--no-dbus", action="store_false",

1699

dest="use_dbus", help="Do not provide D-Bus"

1700

" system bus interface")

1701

parser.add_option("--no-ipv6", action="store_false",

1702

dest="use_ipv6", help="Do not use IPv6")

1703

options = parser.parse_args()[0]

1746

parser = argparse.ArgumentParser()

1747

parser.add_argument("-v", "--version", action="version",

1748

version = "%%(prog)s %s" % version,

1749

help="show version number and exit")

1750

parser.add_argument("-i", "--interface", metavar="IF",

1751

help="Bind to interface IF")

1752

parser.add_argument("-a", "--address",

1753

help="Address to listen for requests on")

1754

parser.add_argument("-p", "--port", type=int,

1755

help="Port number to receive requests on")

1756

parser.add_argument("--check", action="store_true",

1757

help="Run self-test")

1758

parser.add_argument("--debug", action="store_true",

1759

help="Debug mode; run in foreground and log"

1760

" to terminal")

1761

parser.add_argument("--debuglevel", metavar="LEVEL",

1762

help="Debug level for stdout output")

1763

parser.add_argument("--priority", help="GnuTLS"

1764

" priority string (see GnuTLS documentation)")

1765

parser.add_argument("--servicename",

1766

metavar="NAME", help="Zeroconf service name")

1767

parser.add_argument("--configdir",

1768

default="/etc/mandos", metavar="DIR",

1769

help="Directory to search for configuration"

1770

" files")

1771

parser.add_argument("--no-dbus", action="store_false",

1772

dest="use_dbus", help="Do not provide D-Bus"

1773

" system bus interface")

1774

parser.add_argument("--no-ipv6", action="store_false",

1775

dest="use_ipv6", help="Do not use IPv6")

1776

options = parser.parse_args()

1704

1777

1705

1778

if options.check:

1706

1779

import doctest

1758

1831

debuglevel = server_settings["debuglevel"]

1759

1832

use_dbus = server_settings["use_dbus"]

1760

1833

use_ipv6 = server_settings["use_ipv6"]

1761

1834

1762

1835

if server_settings["servicename"] != "Mandos":

1763

1836

syslogger.setFormatter(logging.Formatter

1764

1837

('Mandos (%s) [%%(process)d]:'

1766

1839

% server_settings["servicename"]))

1767

1840

1768

1841

# Parse config file with clients

1769

client_defaults = { "timeout": "1h",

1770

"interval": "5m",

1842

client_defaults = { "timeout": "5m",

1843

"extended_timeout": "15m",

1844

"interval": "2m",

1771

1845

"checker": "fping -q -- %%(host)s",

1772

1846

"host": "",

1773

1847

"approval_delay": "0s",

1813

1887

try:

1814

1888

os.setgid(gid)

1815

1889

os.setuid(uid)

1816

except OSError, error:

1890

except OSError as error:

1817

1891

if error[0] != errno.EPERM:

1818

1892

raise error

1819

1893

1824

1898

level = getattr(logging, debuglevel.upper())

1825

1899

syslogger.setLevel(level)

1826

1900

console.setLevel(level)

1827

1901

1828

1902

if debug:

1829

1903

# Enable all possible GnuTLS debugging

1830

1904

1863

1937

try:

1864

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1865

1939

bus, do_not_queue=True)

1866

except dbus.exceptions.NameExistsException, e:

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

1942

except dbus.exceptions.NameExistsException as e:

1867

1943

logger.error(unicode(e) + ", disabling D-Bus")

1868

1944

use_dbus = False

1869

1945

server_settings["use_dbus"] = False

1881

1957

1882

1958

client_class = Client

1883

1959

if use_dbus:

1884

client_class = functools.partial(ClientDBus, bus = bus)

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1885

1961

def client_config_items(config, section):

1886

1962

special_settings = {

1887

1963

"approved_by_default":

1917

1993

del pidfilename

1918

1994

1919

1995

signal.signal(signal.SIGINT, signal.SIG_IGN)

1920

1996

1921

1997

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1922

1998

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1923

1999

1974

2050

1975

2051

del _interface

1976

2052

1977

mandos_dbus_service = MandosDBusService()

2053

class MandosDBusServiceTransitional(MandosDBusService):

2054

__metaclass__ = transitional_dbus_metaclass

2055

mandos_dbus_service = MandosDBusServiceTransitional()

1978

2056

1979

2057

def cleanup():

1980

2058

"Cleanup function; run on exit"

2019

2097

# From the Avahi example code

2020

2098

try:

2021

2099

service.activate()

2022

except dbus.exceptions.DBusException, error:

2100

except dbus.exceptions.DBusException as error:

2023

2101

logger.critical("DBusException: %s", error)

2024

2102

cleanup()

2025

2103

sys.exit(1)

2032

2110

2033

2111

logger.debug("Starting main loop")

2034

2112

main_loop.run()

2035

except AvahiError, error:

2113

except AvahiError as error:

2036

2114

logger.critical("AvahiError: %s", error)

2037

2115

cleanup()

2038

2116

sys.exit(1)

2044

2122

# Must run before the D-Bus bus name gets deregistered

2045

2123

cleanup()

2046

2124

2125

2047

2126

if __name__ == '__main__':

2048

2127

main()