/mandos/trunk : revision 24.1.186

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

66

69

67

import dbus

70

68

import dbus.service

75

73

import ctypes.util

76

74

import xml.dom.minidom

77

75

import inspect

78

import GnuPGInterface

79

76

80

77

try:

81

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

except ImportError:

86

83

SO_BINDTODEVICE = None

87

84

88

version = "1.4.1"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

85

86

version = "1.3.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

92

90

syslogger = (logging.handlers.SysLogHandler

93

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

92

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet'])

146

147

def __enter__(self):

148

return self

149

150

def __exit__ (self, exc_type, exc_value, traceback):

151

self._cleanup()

152

return False

153

154

def __del__(self):

155

self._cleanup()

156

157

def _cleanup(self):

158

if self.tempdir is not None:

159

# Delete contents of tempdir

160

for root, dirs, files in os.walk(self.tempdir,

161

topdown = False):

162

for filename in files:

163

os.remove(os.path.join(root, filename))

164

for dirname in dirs:

165

os.rmdir(os.path.join(root, dirname))

166

# Remove tempdir

167

os.rmdir(self.tempdir)

168

self.tempdir = None

169

170

def password_encode(self, password):

171

# Passphrase can not be empty and can not contain newlines or

172

# NUL bytes. So we prefix it and hex encode it.

173

return b"mandos" + binascii.hexlify(password)

174

175

def encrypt(self, data, password):

176

self.gnupg.passphrase = self.password_encode(password)

177

with open(os.devnull) as devnull:

178

try:

179

proc = self.gnupg.run(['--symmetric'],

180

create_fhs=['stdin', 'stdout'],

181

attach_fhs={'stderr': devnull})

182

with contextlib.closing(proc.handles['stdin']) as f:

183

f.write(data)

184

with contextlib.closing(proc.handles['stdout']) as f:

185

ciphertext = f.read()

186

proc.wait()

187

except IOError as e:

188

raise PGPError(e)

189

self.gnupg.passphrase = None

190

return ciphertext

191

192

def decrypt(self, data, password):

193

self.gnupg.passphrase = self.password_encode(password)

194

with open(os.devnull) as devnull:

195

try:

196

proc = self.gnupg.run(['--decrypt'],

197

create_fhs=['stdin', 'stdout'],

198

attach_fhs={'stderr': devnull})

199

with contextlib.closing(proc.handles['stdin'] ) as f:

200

f.write(data)

201

with contextlib.closing(proc.handles['stdout']) as f:

202

decrypted_plaintext = f.read()

203

proc.wait()

204

except IOError as e:

205

raise PGPError(e)

206

self.gnupg.passphrase = None

207

return decrypted_plaintext

208

209

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

210

103

211

104

class AvahiError(Exception):

212

105

def __init__(self, value, *args, **kwargs):

267

160

" after %i retries, exiting.",

268

161

self.rename_count)

269

162

raise AvahiServiceError("Too many renames")

270

self.name = unicode(self.server

271

.GetAlternativeServiceName(self.name))

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

272

164

logger.info("Changing Zeroconf service name to %r ...",

273

165

self.name)

166

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

169

% self.name))

274

170

self.remove()

275

171

try:

276

172

self.add()

296

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

297

193

self.entry_group_state_changed_match = (

298

194

self.group.connect_to_signal(

299

'StateChanged', self.entry_group_state_changed))

195

'StateChanged', self .entry_group_state_changed))

300

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

301

197

self.name, self.type)

302

198

self.group.AddService(

328

224

try:

329

225

self.group.Free()

330

226

except (dbus.exceptions.UnknownMethodException,

331

dbus.exceptions.DBusException):

227

dbus.exceptions.DBusException) as e:

332

228

pass

333

229

self.group = None

334

230

self.remove()

368

264

self.server_state_changed)

369

265

self.server_state_changed(self.server.GetState())

370

266

371

class AvahiServiceToSyslog(AvahiService):

372

def rename(self):

373

"""Add the new name to the syslog messages"""

374

ret = AvahiService.rename(self)

375

syslogger.setFormatter(logging.Formatter

376

('Mandos (%s) [%%(process)d]:'

377

' %%(levelname)s: %%(message)s'

378

% self.name))

379

return ret

380

267

381

def timedelta_to_milliseconds(td):

268

def _timedelta_to_milliseconds(td):

382

269

"Convert a datetime.timedelta() to milliseconds"

383

270

return ((td.days * 24 * 60 * 60 * 1000)

384

271

+ (td.seconds * 1000)

388

275

"""A representation of a client host served by this server.

389

276

390

277

Attributes:

391

approved: bool(); 'None' if not yet approved/disapproved

278

_approved: bool(); 'None' if not yet approved/disapproved

392

279

approval_delay: datetime.timedelta(); Time to wait for approval

393

280

approval_duration: datetime.timedelta(); Duration of one approval

394

281

checker: subprocess.Popen(); a running checker process used

401

288

instance %(name)s can be used in the command.

402

289

checker_initiator_tag: a gobject event source tag, or None

403

290

created: datetime.datetime(); (UTC) object creation

404

client_structure: Object describing what attributes a client has

405

and is used for storing the client at exit

406

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

407

293

disable_initiator_tag: a gobject event source tag, or None

408

294

enabled: bool()

409

295

fingerprint: string (40 or 32 hexadecimal digits); used to

412

298

interval: datetime.timedelta(); How often to start a new checker

413

299

last_approval_request: datetime.datetime(); (UTC) or None

414

300

last_checked_ok: datetime.datetime(); (UTC) or None

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

419

302

name: string; from the config file, used in log messages and

420

303

D-Bus identifiers

421

304

secret: bytestring; sent verbatim (over TLS) to client

431

314

"created", "enabled", "fingerprint",

432

315

"host", "interval", "last_checked_ok",

433

316

"last_enabled", "name", "timeout")

434

client_defaults = { "timeout": "5m",

435

"extended_timeout": "15m",

436

"interval": "2m",

437

"checker": "fping -q -- %%(host)s",

438

"host": "",

439

"approval_delay": "0s",

440

"approval_duration": "1s",

441

"approved_by_default": "True",

442

"enabled": "True",

443

}

444

317

445

318

def timeout_milliseconds(self):

446

319

"Return the 'timeout' attribute in milliseconds"

447

return timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

448

321

449

322

def extended_timeout_milliseconds(self):

450

323

"Return the 'extended_timeout' attribute in milliseconds"

451

return timedelta_to_milliseconds(self.extended_timeout)

324

return _timedelta_to_milliseconds(self.extended_timeout)

452

325

453

326

def interval_milliseconds(self):

454

327

"Return the 'interval' attribute in milliseconds"

455

return timedelta_to_milliseconds(self.interval)

328

return _timedelta_to_milliseconds(self.interval)

456

329

457

330

def approval_delay_milliseconds(self):

458

return timedelta_to_milliseconds(self.approval_delay)

459

460

@staticmethod

461

def config_parser(config):

462

""" Construct a new dict of client settings of this form:

463

{ client_name: {setting_name: value, ...}, ...}

464

with exceptions for any special settings as defined above"""

465

settings = {}

466

for client_name in config.sections():

467

section = dict(config.items(client_name))

468

client = settings[client_name] = {}

469

470

client["host"] = section["host"]

471

# Reformat values from string types to Python types

472

client["approved_by_default"] = config.getboolean(

473

client_name, "approved_by_default")

474

client["enabled"] = config.getboolean(client_name, "enabled")

475

476

client["fingerprint"] = (section["fingerprint"].upper()

477

.replace(" ", ""))

478

if "secret" in section:

479

client["secret"] = section["secret"].decode("base64")

480

elif "secfile" in section:

481

with open(os.path.expanduser(os.path.expandvars

482

(section["secfile"])),

483

"rb") as secfile:

484

client["secret"] = secfile.read()

485

else:

486

raise TypeError("No secret or secfile for section %s"

487

% section)

488

client["timeout"] = string_to_delta(section["timeout"])

489

client["extended_timeout"] = string_to_delta(

490

section["extended_timeout"])

491

client["interval"] = string_to_delta(section["interval"])

492

client["approval_delay"] = string_to_delta(

493

section["approval_delay"])

494

client["approval_duration"] = string_to_delta(

495

section["approval_duration"])

496

client["checker_command"] = section["checker"]

497

client["last_approval_request"] = None

498

client["last_checked_ok"] = None

499

client["last_checker_status"] = None

500

if client["enabled"]:

501

client["last_enabled"] = datetime.datetime.utcnow()

502

client["expires"] = (datetime.datetime.utcnow()

503

+ client["timeout"])

504

else:

505

client["last_enabled"] = None

506

client["expires"] = None

507

508

return settings

509

510

511

def __init__(self, settings, name = None):

331

return _timedelta_to_milliseconds(self.approval_delay)

332

333

def __init__(self, name = None, disable_hook=None, config=None):

512

334

"""Note: the 'checker' key in 'config' sets the

513

335

'checker_command' attribute and *not* the 'checker'

514

336

attribute."""

515

337

self.name = name

516

# adding all client settings

517

for setting, value in settings.iteritems():

518

setattr(self, setting, value)

519

338

if config is None:

339

config = {}

520

340

logger.debug("Creating client %r", self.name)

521

341

# Uppercase and remove spaces from fingerprint for later

522

342

# comparison purposes with return value from the fingerprint()

523

343

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

524

346

logger.debug(" Fingerprint: %s", self.fingerprint)

525

self.created = settings.get("created", datetime.datetime.utcnow())

526

527

# attributes specific for this server instance

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

353

self.secret = secfile.read()

354

else:

355

raise TypeError("No secret or secfile for client %s"

356

% self.name)

357

self.host = config.get("host", "")

358

self.created = datetime.datetime.utcnow()

359

self.enabled = False

360

self.last_approval_request = None

361

self.last_enabled = None

362

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

528

367

self.checker = None

529

368

self.checker_initiator_tag = None

530

369

self.disable_initiator_tag = None

370

self.expires = None

531

371

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

532

373

self.current_checker_command = None

533

self.approved = None

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

534

378

self.approvals_pending = 0

535

self.changedstate = (multiprocessing_manager

536

.Condition(multiprocessing_manager

537

.Lock()))

538

self.client_structure = [attr for attr in

539

self.__dict__.iterkeys()

540

if not attr.startswith("_")]

541

self.client_structure.append("client_structure")

542

543

for name, t in inspect.getmembers(type(self),

544

lambda obj:

545

isinstance(obj,

546

property)):

547

if not name.startswith("_"):

548

self.client_structure.append(name)

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

549

384

550

# Send notice to process children that client state has changed

551

385

def send_changedstate(self):

552

with self.changedstate:

553

self.changedstate.notify_all()

554

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

555

390

def enable(self):

556

391

"""Start this client's checker and timeout hooks"""

557

392

if getattr(self, "enabled", False):

558

393

# Already enabled

559

394

return

560

395

self.send_changedstate()

396

# Schedule a new checker to be started an 'interval' from now,

397

# and every interval from then on.

398

self.checker_initiator_tag = (gobject.timeout_add

399

(self.interval_milliseconds(),

400

self.start_checker))

401

# Schedule a disable() when 'timeout' has passed

561

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

self.disable_initiator_tag = (gobject.timeout_add

404

(self.timeout_milliseconds(),

405

self.disable))

562

406

self.enabled = True

563

407

self.last_enabled = datetime.datetime.utcnow()

564

self.init_checker()

408

# Also start a new checker *right now*.

409

self.start_checker()

565

410

566

411

def disable(self, quiet=True):

567

412

"""Disable this client."""

579

424

gobject.source_remove(self.checker_initiator_tag)

580

425

self.checker_initiator_tag = None

581

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

582

429

self.enabled = False

583

430

# Do not run this again if called by a gobject.timeout_add

584

431

return False

585

432

586

433

def __del__(self):

434

self.disable_hook = None

587

435

self.disable()

588

436

589

def init_checker(self):

590

# Schedule a new checker to be started an 'interval' from now,

591

# and every interval from then on.

592

self.checker_initiator_tag = (gobject.timeout_add

593

(self.interval_milliseconds(),

594

self.start_checker))

595

# Schedule a disable() when 'timeout' has passed

596

self.disable_initiator_tag = (gobject.timeout_add

597

(self.timeout_milliseconds(),

598

self.disable))

599

# Also start a new checker *right now*.

600

self.start_checker()

601

602

437

def checker_callback(self, pid, condition, command):

603

438

"""The checker has completed, so take appropriate actions."""

604

439

self.checker_callback_tag = None

605

440

self.checker = None

606

441

if os.WIFEXITED(condition):

607

self.last_checker_status = os.WEXITSTATUS(condition)

608

if self.last_checker_status == 0:

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

609

444

logger.info("Checker for %(name)s succeeded",

610

445

vars(self))

611

446

self.checked_ok()

613

448

logger.info("Checker for %(name)s failed",

614

449

vars(self))

615

450

else:

616

self.last_checker_status = -1

617

451

logger.warning("Checker for %(name)s crashed?",

618

452

vars(self))

619

453

626

460

if timeout is None:

627

461

timeout = self.timeout

628

462

self.last_checked_ok = datetime.datetime.utcnow()

629

if self.disable_initiator_tag is not None:

630

gobject.source_remove(self.disable_initiator_tag)

631

if getattr(self, "enabled", False):

632

self.disable_initiator_tag = (gobject.timeout_add

633

(timedelta_to_milliseconds

634

(timeout), self.disable))

635

self.expires = datetime.datetime.utcnow() + timeout

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

467

self.disable))

636

468

637

469

def need_approval(self):

638

470

self.last_approval_request = datetime.datetime.utcnow()

797

629

"""

798

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

799

631

for cls in self.__class__.__mro__

800

for name, prop in

801

inspect.getmembers(cls, self._is_dbus_property))

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

802

633

803

634

def _get_dbus_property(self, interface_name, property_name):

804

635

"""Returns a bound method if one exists which is a D-Bus

805

636

property with the specified name and interface.

806

637

"""

807

638

for cls in self.__class__.__mro__:

808

for name, value in (inspect.getmembers

809

(cls, self._is_dbus_property)):

810

if (value._dbus_name == property_name

811

and value._dbus_interface == interface_name):

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

812

641

return value.__get__(self)

813

642

814

643

# No such property

815

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

816

645

+ interface_name + "."

817

646

+ property_name)

647

818

648

819

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

820

650

out_signature="v")

853

683

854

684

Note: Will not include properties with access="write".

855

685

"""

856

properties = {}

686

all = {}

857

687

for name, prop in self._get_all_dbus_properties():

858

688

if (interface_name

859

689

and interface_name != prop._dbus_interface):

864

694

continue

865

695

value = prop()

866

696

if not hasattr(value, "variant_level"):

867

properties[name] = value

697

all[name] = value

868

698

continue

869

properties[name] = type(value)(value, variant_level=

870

value.variant_level+1)

871

return dbus.Dictionary(properties, signature="sv")

699

all[name] = type(value)(value, variant_level=

700

value.variant_level+1)

701

return dbus.Dictionary(all, signature="sv")

872

702

873

703

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

874

704

out_signature="s",

925

755

return dbus.String(dt.isoformat(),

926

756

variant_level=variant_level)

927

757

928

929

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

930

.__metaclass__):

931

"""Applied to an empty subclass of a D-Bus object, this metaclass

932

will add additional D-Bus attributes matching a certain pattern.

933

"""

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

934

759

def __new__(mcs, name, bases, attr):

935

# Go through all the base classes which could have D-Bus

936

# methods, signals, or properties in them

937

for base in (b for b in bases

938

if issubclass(b, dbus.service.Object)):

939

# Go though all attributes of the base class

940

for attrname, attribute in inspect.getmembers(base):

941

# Ignore non-D-Bus attributes, and D-Bus attributes

942

# with the wrong interface name

943

if (not hasattr(attribute, "_dbus_interface")

944

or not attribute._dbus_interface

945

.startswith("se.recompile.Mandos")):

946

continue

947

# Create an alternate D-Bus interface name based on

948

# the current name

949

alt_interface = (attribute._dbus_interface

950

.replace("se.recompile.Mandos",

951

"se.bsnet.fukt.Mandos"))

952

# Is this a D-Bus signal?

953

if getattr(attribute, "_dbus_is_signal", False):

954

# Extract the original non-method function by

955

# black magic

956

nonmethod_func = (dict(

957

zip(attribute.func_code.co_freevars,

958

attribute.__closure__))["func"]

959

.cell_contents)

960

# Create a new, but exactly alike, function

961

# object, and decorate it to be a new D-Bus signal

962

# with the alternate D-Bus interface name

963

new_function = (dbus.service.signal

964

(alt_interface,

965

attribute._dbus_signature)

966

(types.FunctionType(

967

nonmethod_func.func_code,

968

nonmethod_func.func_globals,

969

nonmethod_func.func_name,

970

nonmethod_func.func_defaults,

971

nonmethod_func.func_closure)))

972

# Define a creator of a function to call both the

973

# old and new functions, so both the old and new

974

# signals gets sent when the function is called

975

def fixscope(func1, func2):

976

"""This function is a scope container to pass

977

func1 and func2 to the "call_both" function

978

outside of its arguments"""

979

def call_both(*args, **kwargs):

980

"""This function will emit two D-Bus

981

signals by calling func1 and func2"""

982

func1(*args, **kwargs)

983

func2(*args, **kwargs)

984

return call_both

985

# Create the "call_both" function and add it to

986

# the class

987

attr[attrname] = fixscope(attribute,

988

new_function)

989

# Is this a D-Bus method?

990

elif getattr(attribute, "_dbus_is_method", False):

991

# Create a new, but exactly alike, function

992

# object. Decorate it to be a new D-Bus method

993

# with the alternate D-Bus interface name. Add it

994

# to the class.

995

attr[attrname] = (dbus.service.method

996

(alt_interface,

997

attribute._dbus_in_signature,

998

attribute._dbus_out_signature)

999

(types.FunctionType

1000

(attribute.func_code,

1001

attribute.func_globals,

1002

attribute.func_name,

1003

attribute.func_defaults,

1004

attribute.func_closure)))

1005

# Is this a D-Bus property?

1006

elif getattr(attribute, "_dbus_is_property", False):

1007

# Create a new, but exactly alike, function

1008

# object, and decorate it to be a new D-Bus

1009

# property with the alternate D-Bus interface

1010

# name. Add it to the class.

1011

attr[attrname] = (dbus_service_property

1012

(alt_interface,

1013

attribute._dbus_signature,

1014

attribute._dbus_access,

1015

attribute

1016

._dbus_get_args_options

1017

["byte_arrays"])

1018

(types.FunctionType

1019

(attribute.func_code,

1020

attribute.func_globals,

1021

attribute.func_name,

1022

attribute.func_defaults,

1023

attribute.func_closure)))

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

1024

812

return type.__new__(mcs, name, bases, attr)

1025

813

1026

1027

814

class ClientDBus(Client, DBusObjectWithProperties):

1028

815

"""A Client class using D-Bus

1029

816

1038

825

# dbus.service.Object doesn't use super(), so we can't either.

1039

826

1040

827

def __init__(self, bus = None, *args, **kwargs):

828

self._approvals_pending = 0

1041

829

self.bus = bus

1042

830

Client.__init__(self, *args, **kwargs)

1043

self._approvals_pending = 0

1044

1045

self._approvals_pending = 0

1046

831

# Only now, when this client is initialized, can it show up on

1047

832

# the D-Bus

1048

833

client_object_name = unicode(self.name).translate(

1056

841

def notifychangeproperty(transform_func,

1057

842

dbus_name, type_func=lambda x: x,

1058

843

variant_level=1):

1059

""" Modify a variable so that it's a property which announces

1060

its changes to DBus.

1061

1062

transform_fun: Function that takes a value and a variant_level

1063

and transforms it to a D-Bus type.

1064

dbus_name: D-Bus name of the variable

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

1065

849

type_func: Function that transform the value before sending it

1066

to the D-Bus. Default: no transform

1067

variant_level: D-Bus variant level. Default: 1

850

to DBus

851

variant_level: DBus variant level. default: 1

1068

852

"""

1069

attrname = "_{0}".format(dbus_name)

853

real_value = [None,]

1070

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

1071

857

if hasattr(self, "dbus_object_path"):

1072

if (not hasattr(self, attrname) or

1073

type_func(getattr(self, attrname, None))

1074

!= type_func(value)):

1075

dbus_value = transform_func(type_func(value),

1076

variant_level

1077

=variant_level)

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

1078

861

self.PropertyChanged(dbus.String(dbus_name),

1079

862

dbus_value)

1080

setattr(self, attrname, value)

1081

863

1082

return property(lambda self: getattr(self, attrname), setter)

864

return property(lambda self: real_value[0], setter)

1083

865

1084

866

1085

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1090

872

last_enabled = notifychangeproperty(datetime_to_dbus,

1091

873

"LastEnabled")

1092

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1093

type_func = lambda checker:

1094

checker is not None)

875

type_func = lambda checker: checker is not None)

1095

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1096

877

"LastCheckedOK")

1097

last_approval_request = notifychangeproperty(

1098

datetime_to_dbus, "LastApprovalRequest")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

1099

880

approved_by_default = notifychangeproperty(dbus.Boolean,

1100

881

"ApprovedByDefault")

1101

approval_delay = notifychangeproperty(dbus.UInt64,

1102

"ApprovalDelay",

1103

type_func =

1104

timedelta_to_milliseconds)

1105

approval_duration = notifychangeproperty(

1106

dbus.UInt64, "ApprovalDuration",

1107

type_func = timedelta_to_milliseconds)

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

1108

886

host = notifychangeproperty(dbus.String, "Host")

1109

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1110

type_func =

1111

timedelta_to_milliseconds)

1112

extended_timeout = notifychangeproperty(

1113

dbus.UInt64, "ExtendedTimeout",

1114

type_func = timedelta_to_milliseconds)

1115

interval = notifychangeproperty(dbus.UInt64,

1116

"Interval",

1117

type_func =

1118

timedelta_to_milliseconds)

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

1119

893

checker_command = notifychangeproperty(dbus.String, "Checker")

1120

894

1121

895

del notifychangeproperty

1163

937

return r

1164

938

1165

939

def _reset_approved(self):

1166

self.approved = None

940

self._approved = None

1167

941

return False

1168

942

1169

943

def approve(self, value=True):

1170

944

self.send_changedstate()

1171

self.approved = value

1172

gobject.timeout_add(timedelta_to_milliseconds

945

self._approved = value

946

gobject.timeout_add(_timedelta_to_milliseconds

1173

947

(self.approval_duration),

1174

948

self._reset_approved)

1175

949

1176

950

1177

951

## D-Bus methods, signals & properties

1178

_interface = "se.recompile.Mandos.Client"

1179

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

1180

954

## Signals

1181

955

1182

956

# CheckerCompleted - signal

1218

992

"D-Bus signal"

1219

993

return self.need_approval()

1220

994

1221

# NeRwequest - signal

1222

@dbus.service.signal(_interface, signature="s")

1223

def NewRequest(self, ip):

1224

"""D-Bus signal

1225

Is sent after a client request a password.

1226

"""

1227

pass

1228

1229

995

## Methods

1230

996

1231

997

# Approve - method

1289

1055

access="readwrite")

1290

1056

def ApprovalDuration_dbus_property(self, value=None):

1291

1057

if value is None: # get

1292

return dbus.UInt64(timedelta_to_milliseconds(

1058

return dbus.UInt64(_timedelta_to_milliseconds(

1293

1059

self.approval_duration))

1294

1060

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1295

1061

1309

1075

def Host_dbus_property(self, value=None):

1310

1076

if value is None: # get

1311

1077

return dbus.String(self.host)

1312

self.host = unicode(value)

1078

self.host = value

1313

1079

1314

1080

# Created - property

1315

1081

@dbus_service_property(_interface, signature="s", access="read")

1316

1082

def Created_dbus_property(self):

1317

return datetime_to_dbus(self.created)

1083

return dbus.String(datetime_to_dbus(self.created))

1318

1084

1319

1085

# LastEnabled - property

1320

1086

@dbus_service_property(_interface, signature="s", access="read")

1364

1130

gobject.source_remove(self.disable_initiator_tag)

1365

1131

self.disable_initiator_tag = None

1366

1132

self.expires = None

1367

time_to_die = timedelta_to_milliseconds((self

1368

.last_checked_ok

1369

+ self.timeout)

1370

- datetime.datetime

1371

.utcnow())

1133

time_to_die = (self.

1134

_timedelta_to_milliseconds((self

1135

.last_checked_ok

1136

+ self.timeout)

1137

- datetime.datetime

1138

.utcnow()))

1372

1139

if time_to_die <= 0:

1373

1140

# The timeout has passed

1374

1141

self.disable()

1375

1142

else:

1376

1143

self.expires = (datetime.datetime.utcnow()

1377

+ datetime.timedelta(milliseconds =

1378

time_to_die))

1144

+ datetime.timedelta(milliseconds = time_to_die))

1379

1145

self.disable_initiator_tag = (gobject.timeout_add

1380

1146

(time_to_die, self.disable))

1381

1147

1396

1162

self.interval = datetime.timedelta(0, 0, 0, value)

1397

1163

if getattr(self, "checker_initiator_tag", None) is None:

1398

1164

return

1399

if self.enabled:

1400

# Reschedule checker run

1401

gobject.source_remove(self.checker_initiator_tag)

1402

self.checker_initiator_tag = (gobject.timeout_add

1403

(value, self.start_checker))

1404

self.start_checker() # Start one now, too

1165

# Reschedule checker run

1166

gobject.source_remove(self.checker_initiator_tag)

1167

self.checker_initiator_tag = (gobject.timeout_add

1168

(value, self.start_checker))

1169

self.start_checker() # Start one now, too

1405

1170

1406

1171

# Checker - property

1407

1172

@dbus_service_property(_interface, signature="s",

1409

1174

def Checker_dbus_property(self, value=None):

1410

1175

if value is None: # get

1411

1176

return dbus.String(self.checker_command)

1412

self.checker_command = unicode(value)

1177

self.checker_command = value

1413

1178

1414

1179

# CheckerRunning - property

1415

1180

@dbus_service_property(_interface, signature="b",

1444

1209

raise KeyError()

1445

1210

1446

1211

def __getattribute__(self, name):

1447

if name == '_pipe':

1212

if(name == '_pipe'):

1448

1213

return super(ProxyClient, self).__getattribute__(name)

1449

1214

self._pipe.send(('getattr', name))

1450

1215

data = self._pipe.recv()

1457

1222

return func

1458

1223

1459

1224

def __setattr__(self, name, value):

1460

if name == '_pipe':

1225

if(name == '_pipe'):

1461

1226

return super(ProxyClient, self).__setattr__(name, value)

1462

1227

self._pipe.send(('setattr', name, value))

1463

1228

1464

1465

1229

class ClientDBusTransitional(ClientDBus):

1466

__metaclass__ = AlternateDBusNamesMetaclass

1467

1230

__metaclass__ = transitional_dbus_metaclass

1468

1231

1469

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

1470

1233

"""A class to handle client connections.

1539

1302

except KeyError:

1540

1303

return

1541

1304

1542

if self.server.use_dbus:

1543

# Emit D-Bus signal

1544

client.NewRequest(str(self.client_address))

1545

1546

1305

if client.approval_delay:

1547

1306

delay = client.approval_delay

1548

1307

client.approvals_pending += 1

1554

1313

client.name)

1555

1314

if self.server.use_dbus:

1556

1315

# Emit D-Bus signal

1557

client.Rejected("Disabled")

1316

client.Rejected("Disabled")

1558

1317

return

1559

1318

1560

if client.approved or not client.approval_delay:

1319

if client._approved or not client.approval_delay:

1561

1320

#We are approved or approval is disabled

1562

1321

break

1563

elif client.approved is None:

1322

elif client._approved is None:

1564

1323

logger.info("Client %s needs approval",

1565

1324

client.name)

1566

1325

if self.server.use_dbus:

1577

1336

return

1578

1337

1579

1338

#wait until timeout or approved

1339

#x = float(client._timedelta_to_milliseconds(delay))

1580

1340

time = datetime.datetime.now()

1581

1341

client.changedstate.acquire()

1582

(client.changedstate.wait

1583

(float(client.timedelta_to_milliseconds(delay)

1584

/ 1000)))

1342

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1585

1343

client.changedstate.release()

1586

1344

time2 = datetime.datetime.now()

1587

1345

if (time2 - time) >= delay:

1611

1369

sent_size += sent

1612

1370

1613

1371

logger.info("Sending secret to %s", client.name)

1614

# bump the timeout using extended_timeout

1372

# bump the timeout as if seen

1615

1373

client.checked_ok(client.extended_timeout)

1616

1374

if self.server.use_dbus:

1617

1375

# Emit D-Bus signal

1685

1443

# Convert the buffer to a Python bytestring

1686

1444

fpr = ctypes.string_at(buf, buf_len.value)

1687

1445

# Convert the bytestring to hexadecimal notation

1688

hex_fpr = binascii.hexlify(fpr).upper()

1446

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1689

1447

return hex_fpr

1690

1448

1691

1449

1694

1452

def sub_process_main(self, request, address):

1695

1453

try:

1696

1454

self.finish_request(request, address)

1697

except Exception:

1455

except:

1698

1456

self.handle_error(request, address)

1699

1457

self.close_request(request)

1700

1458

1701

1459

def process_request(self, request, address):

1702

1460

"""Start a new process to process the request."""

1703

proc = multiprocessing.Process(target = self.sub_process_main,

1704

args = (request,

1705

address))

1706

proc.start()

1707

return proc

1461

multiprocessing.Process(target = self.sub_process_main,

1462

args = (request, address)).start()

1708

1463

1709

1464

1710

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1716

1471

"""

1717

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1718

1473

1719

proc = MultiprocessingMixIn.process_request(self, request,

1720

client_address)

1474

super(MultiprocessingMixInWithPipe,

1475

self).process_request(request, client_address)

1721

1476

self.child_pipe.close()

1722

self.add_pipe(parent_pipe, proc)

1477

self.add_pipe(parent_pipe)

1723

1478

1724

def add_pipe(self, parent_pipe, proc):

1479

def add_pipe(self, parent_pipe):

1725

1480

"""Dummy function; override as necessary"""

1726

1481

raise NotImplementedError

1727

1482

1805

1560

self.enabled = False

1806

1561

self.clients = clients

1807

1562

if self.clients is None:

1808

self.clients = {}

1563

self.clients = set()

1809

1564

self.use_dbus = use_dbus

1810

1565

self.gnutls_priority = gnutls_priority

1811

1566

IPv6_TCPServer.__init__(self, server_address,

1815

1570

def server_activate(self):

1816

1571

if self.enabled:

1817

1572

return socketserver.TCPServer.server_activate(self)

1818

1819

1573

def enable(self):

1820

1574

self.enabled = True

1821

1822

def add_pipe(self, parent_pipe, proc):

1575

def add_pipe(self, parent_pipe):

1823

1576

# Call "handle_ipc" for both data and EOF events

1824

1577

gobject.io_add_watch(parent_pipe.fileno(),

1825

1578

gobject.IO_IN | gobject.IO_HUP,

1826

1579

functools.partial(self.handle_ipc,

1827

parent_pipe =

1828

parent_pipe,

1829

proc = proc))

1830

1580

parent_pipe = parent_pipe))

1581

1831

1582

def handle_ipc(self, source, condition, parent_pipe=None,

1832

proc = None, client_object=None):

1583

client_object=None):

1833

1584

condition_names = {

1834

1585

gobject.IO_IN: "IN", # There is data to read.

1835

1586

gobject.IO_OUT: "OUT", # Data can be written (without

1844

1595

for cond, name in

1845

1596

condition_names.iteritems()

1846

1597

if cond & condition)

1847

# error, or the other end of multiprocessing.Pipe has closed

1598

# error or the other end of multiprocessing.Pipe has closed

1848

1599

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1849

# Wait for other process to exit

1850

proc.join()

1851

1600

return False

1852

1601

1853

1602

# Read a request from the child

1858

1607

fpr = request[1]

1859

1608

address = request[2]

1860

1609

1861

for c in self.clients.itervalues():

1610

for c in self.clients:

1862

1611

if c.fingerprint == fpr:

1863

1612

client = c

1864

1613

break

1867

1616

"dress: %s", fpr, address)

1868

1617

if self.use_dbus:

1869

1618

# Emit D-Bus signal

1870

mandos_dbus_service.ClientNotFound(fpr,

1871

address[0])

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1872

1620

parent_pipe.send(False)

1873

1621

return False

1874

1622

1875

1623

gobject.io_add_watch(parent_pipe.fileno(),

1876

1624

gobject.IO_IN | gobject.IO_HUP,

1877

1625

functools.partial(self.handle_ipc,

1878

parent_pipe =

1879

parent_pipe,

1880

proc = proc,

1881

client_object =

1882

client))

1626

parent_pipe = parent_pipe,

1627

client_object = client))

1883

1628

parent_pipe.send(True)

1884

# remove the old hook in favor of the new above hook on

1885

# same fileno

1629

# remove the old hook in favor of the new above hook on same fileno

1886

1630

return False

1887

1631

if command == 'funcall':

1888

1632

funcname = request[1]

1889

1633

args = request[2]

1890

1634

kwargs = request[3]

1891

1635

1892

parent_pipe.send(('data', getattr(client_object,

1893

funcname)(*args,

1894

**kwargs)))

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1895

1637

1896

1638

if command == 'getattr':

1897

1639

attrname = request[1]

1898

1640

if callable(client_object.__getattribute__(attrname)):

1899

1641

parent_pipe.send(('function',))

1900

1642

else:

1901

parent_pipe.send(('data', client_object

1902

.__getattribute__(attrname)))

1643

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1903

1644

1904

1645

if command == 'setattr':

1905

1646

attrname = request[1]

1948

1689

return timevalue

1949

1690

1950

1691

1692

def if_nametoindex(interface):

1693

"""Call the C function if_nametoindex(), or equivalent

1694

1695

Note: This function cannot accept a unicode string."""

1696

global if_nametoindex

1697

try:

1698

if_nametoindex = (ctypes.cdll.LoadLibrary

1699

(ctypes.util.find_library("c"))

1700

.if_nametoindex)

1701

except (OSError, AttributeError):

1702

logger.warning("Doing if_nametoindex the hard way")

1703

def if_nametoindex(interface):

1704

"Get an interface index the hard way, i.e. using fcntl()"

1705

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1706

with contextlib.closing(socket.socket()) as s:

1707

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1708

struct.pack(str("16s16x"),

1709

interface))

1710

interface_index = struct.unpack(str("I"),

1711

ifreq[16:20])[0]

1712

return interface_index

1713

return if_nametoindex(interface)

1714

1715

1951

1716

def daemon(nochdir = False, noclose = False):

1952

1717

"""See daemon(3). Standard BSD Unix function.

1953

1718

2008

1773

" system bus interface")

2009

1774

parser.add_argument("--no-ipv6", action="store_false",

2010

1775

dest="use_ipv6", help="Do not use IPv6")

2011

parser.add_argument("--no-restore", action="store_false",

2012

dest="restore", help="Do not restore stored"

2013

" state")

2014

parser.add_argument("--statedir", metavar="DIR",

2015

help="Directory to save/restore state in")

2016

2017

1776

options = parser.parse_args()

2018

1777

2019

1778

if options.check:

2032

1791

"use_dbus": "True",

2033

1792

"use_ipv6": "True",

2034

1793

"debuglevel": "",

2035

"restore": "True",

2036

"statedir": "/var/lib/mandos"

2037

1794

}

2038

1795

2039

1796

# Parse config file for server-global settings

2056

1813

# options, if set.

2057

1814

for option in ("interface", "address", "port", "debug",

2058

1815

"priority", "servicename", "configdir",

2059

"use_dbus", "use_ipv6", "debuglevel", "restore",

2060

"statedir"):

1816

"use_dbus", "use_ipv6", "debuglevel"):

2061

1817

value = getattr(options, option)

2062

1818

if value is not None:

2063

1819

server_settings[option] = value

2075

1831

debuglevel = server_settings["debuglevel"]

2076

1832

use_dbus = server_settings["use_dbus"]

2077

1833

use_ipv6 = server_settings["use_ipv6"]

2078

stored_state_path = os.path.join(server_settings["statedir"],

2079

stored_state_file)

2080

2081

if debug:

2082

initlogger(debug, logging.DEBUG)

2083

else:

2084

if not debuglevel:

2085

initlogger(debug)

2086

else:

2087

level = getattr(logging, debuglevel.upper())

2088

initlogger(debug, level)

2089

1834

2090

1835

if server_settings["servicename"] != "Mandos":

2091

1836

syslogger.setFormatter(logging.Formatter

2094

1839

% server_settings["servicename"]))

2095

1840

2096

1841

# Parse config file with clients

2097

client_config = configparser.SafeConfigParser(Client.client_defaults)

1842

client_defaults = { "timeout": "5m",

1843

"extended_timeout": "15m",

1844

"interval": "2m",

1845

"checker": "fping -q -- %%(host)s",

1846

"host": "",

1847

"approval_delay": "0s",

1848

"approval_duration": "1s",

1849

}

1850

client_config = configparser.SafeConfigParser(client_defaults)

2098

1851

client_config.read(os.path.join(server_settings["configdir"],

2099

1852

"clients.conf"))

2100

1853

2138

1891

if error[0] != errno.EPERM:

2139

1892

raise error

2140

1893

1894

if not debug and not debuglevel:

1895

syslogger.setLevel(logging.WARNING)

1896

console.setLevel(logging.WARNING)

1897

if debuglevel:

1898

level = getattr(logging, debuglevel.upper())

1899

syslogger.setLevel(level)

1900

console.setLevel(level)

1901

2141

1902

if debug:

2142

1903

# Enable all possible GnuTLS debugging

2143

1904

2157

1918

os.dup2(null, sys.stdin.fileno())

2158

1919

if null > 2:

2159

1920

os.close(null)

1921

else:

1922

# No console logging

1923

logger.removeHandler(console)

2160

1924

2161

1925

# Need to fork before connecting to D-Bus

2162

1926

if not debug:

2163

1927

# Close all input and output, do double fork, etc.

2164

1928

daemon()

2165

1929

2166

gobject.threads_init()

2167

2168

1930

global main_loop

2169

1931

# From the Avahi example code

2170

1932

DBusGMainLoop(set_as_default=True )

2173

1935

# End of Avahi example code

2174

1936

if use_dbus:

2175

1937

try:

2176

bus_name = dbus.service.BusName("se.recompile.Mandos",

2177

bus, do_not_queue=True)

2178

old_bus_name = (dbus.service.BusName

2179

("se.bsnet.fukt.Mandos", bus,

2180

do_not_queue=True))

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

2181

1942

except dbus.exceptions.NameExistsException as e:

2182

1943

logger.error(unicode(e) + ", disabling D-Bus")

2183

1944

use_dbus = False

2184

1945

server_settings["use_dbus"] = False

2185

1946

tcp_server.use_dbus = False

2186

1947

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2187

service = AvahiServiceToSyslog(name =

2188

server_settings["servicename"],

2189

servicetype = "_mandos._tcp",

2190

protocol = protocol, bus = bus)

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1950

protocol = protocol, bus = bus)

2191

1951

if server_settings["interface"]:

2192

1952

service.interface = (if_nametoindex

2193

1953

(str(server_settings["interface"])))

2197

1957

2198

1958

client_class = Client

2199

1959

if use_dbus:

2200

client_class = functools.partial(ClientDBusTransitional,

2201

bus = bus)

2202

2203

client_settings = Client.config_parser(client_config)

2204

old_client_settings = {}

2205

clients_data = {}

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

except EOFError as e:

2220

logger.warning("Could not load persistent state: "

2221

"EOFError: {0}".format(e))

2222

2223

with PGPEngine() as pgp:

2224

for client_name, client in clients_data.iteritems():

2225

# Decide which value to use after restoring saved state.

2226

# We have three different values: Old config file,

2227

# new config file, and saved state.

2228

# New config value takes precedence if it differs from old

2229

# config value, otherwise use saved state.

2230

for name, value in client_settings[client_name].items():

2231

try:

2232

# For each value in new config, check if it

2233

# differs from the old config value (Except for

2234

# the "secret" attribute)

2235

if (name != "secret" and

2236

value != old_client_settings[client_name]

2237

[name]):

2238

client[name] = value

2239

except KeyError:

2240

pass

2241

2242

# Clients who has passed its expire date can still be

2243

# enabled if its last checker was successful. Clients

2244

# whose checker failed before we stored its state is

2245

# assumed to have failed all checkers during downtime.

2246

if client["enabled"]:

2247

if datetime.datetime.utcnow() >= client["expires"]:

2248

if not client["last_checked_ok"]:

2249

logger.warning(

2250

"disabling client {0} - Client never "

2251

"performed a successfull checker"

2252

.format(client["name"]))

2253

client["enabled"] = False

2254

elif client["last_checker_status"] != 0:

2255

logger.warning(

2256

"disabling client {0} - Client "

2257

"last checker failed with error code {1}"

2258

.format(client["name"],

2259

client["last_checker_status"]))

2260

client["enabled"] = False

2261

else:

2262

client["expires"] = (datetime.datetime

2263

.utcnow()

2264

+ client["timeout"])

2265

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1961

def client_config_items(config, section):

1962

special_settings = {

1963

"approved_by_default":

1964

lambda: config.getboolean(section,

1965

"approved_by_default"),

1966

}

1967

for name, value in config.items(section):

2266

1968

try:

2267

client["secret"] = (

2268

pgp.decrypt(client["encrypted_secret"],

2269

client_settings[client_name]

2270

["secret"]))

2271

except PGPError:

2272

# If decryption fails, we use secret from new settings

2273

logger.debug("Failed to decrypt {0} old secret"

2274

.format(client_name))

2275

client["secret"] = (

2276

client_settings[client_name]["secret"])

2277

2278

2279

# Add/remove clients based on new changes made to config

2280

for client_name in set(old_client_settings) - set(client_settings):

2281

del clients_data[client_name]

2282

for client_name in set(client_settings) - set(old_client_settings):

2283

clients_data[client_name] = client_settings[client_name]

2284

2285

# Create clients all clients

2286

for client_name, client in clients_data.iteritems():

2287

tcp_server.clients[client_name] = client_class(

2288

name = client_name, settings = client)

2289

1969

yield (name, special_settings[name]())

1970

except KeyError:

1971

yield (name, value)

1972

1973

tcp_server.clients.update(set(

1974

client_class(name = section,

1975

config= dict(client_config_items(

1976

client_config, section)))

1977

for section in client_config.sections()))

2290

1978

if not tcp_server.clients:

2291

1979

logger.warning("No clients defined")

2292

1980

2303

1991

# "pidfile" was never created

2304

1992

pass

2305

1993

del pidfilename

1994

2306

1995

signal.signal(signal.SIGINT, signal.SIG_IGN)

2307

1996

2308

1997

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2313

2002

"""A D-Bus proxy object"""

2314

2003

def __init__(self):

2315

2004

dbus.service.Object.__init__(self, bus, "/")

2316

_interface = "se.recompile.Mandos"

2005

_interface = "se.bsnet.fukt.Mandos"

2317

2006

2318

2007

@dbus.service.signal(_interface, signature="o")

2319

2008

def ClientAdded(self, objpath):

2334

2023

def GetAllClients(self):

2335

2024

"D-Bus method"

2336

2025

return dbus.Array(c.dbus_object_path

2337

for c in

2338

tcp_server.clients.itervalues())

2026

for c in tcp_server.clients)

2339

2027

2340

2028

@dbus.service.method(_interface,

2341

2029

out_signature="a{oa{sv}}")

2343

2031

"D-Bus method"

2344

2032

return dbus.Dictionary(

2345

2033

((c.dbus_object_path, c.GetAll(""))

2346

for c in tcp_server.clients.itervalues()),

2034

for c in tcp_server.clients),

2347

2035

signature="oa{sv}")

2348

2036

2349

2037

@dbus.service.method(_interface, in_signature="o")

2350

2038

def RemoveClient(self, object_path):

2351

2039

"D-Bus method"

2352

for c in tcp_server.clients.itervalues():

2040

for c in tcp_server.clients:

2353

2041

if c.dbus_object_path == object_path:

2354

del tcp_server.clients[c.name]

2042

tcp_server.clients.remove(c)

2355

2043

c.remove_from_connection()

2356

2044

# Don't signal anything except ClientRemoved

2357

2045

c.disable(quiet=True)

2363

2051

del _interface

2364

2052

2365

2053

class MandosDBusServiceTransitional(MandosDBusService):

2366

__metaclass__ = AlternateDBusNamesMetaclass

2054

__metaclass__ = transitional_dbus_metaclass

2367

2055

mandos_dbus_service = MandosDBusServiceTransitional()

2368

2056

2369

2057

def cleanup():

2370

2058

"Cleanup function; run on exit"

2371

2059

service.cleanup()

2372

2060

2373

multiprocessing.active_children()

2374

if not (tcp_server.clients or client_settings):

2375

return

2376

2377

# Store client before exiting. Secrets are encrypted with key

2378

# based on what config file has. If config file is

2379

# removed/edited, old secret will thus be unrecovable.

2380

clients = {}

2381

with PGPEngine() as pgp:

2382

for client in tcp_server.clients.itervalues():

2383

key = client_settings[client.name]["secret"]

2384

client.encrypted_secret = pgp.encrypt(client.secret,

2385

key)

2386

client_dict = {}

2387

2388

# A list of attributes that can not be pickled

2389

# + secret.

2390

exclude = set(("bus", "changedstate", "secret",

2391

"checker"))

2392

for name, typ in (inspect.getmembers

2393

(dbus.service.Object)):

2394

exclude.add(name)

2395

2396

client_dict["encrypted_secret"] = (client

2397

.encrypted_secret)

2398

for attr in client.client_structure:

2399

if attr not in exclude:

2400

client_dict[attr] = getattr(client, attr)

2401

2402

clients[client.name] = client_dict

2403

del client_settings[client.name]["secret"]

2404

2405

try:

2406

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2407

prefix="clients-",

2408

dir=os.path.dirname

2409

(stored_state_path))

2410

with os.fdopen(tempfd, "wb") as stored_state:

2411

pickle.dump((clients, client_settings), stored_state)

2412

os.rename(tempname, stored_state_path)

2413

except (IOError, OSError) as e:

2414

logger.warning("Could not save persistent state: {0}"

2415

.format(e))

2416

if not debug:

2417

try:

2418

os.remove(tempname)

2419

except NameError:

2420

pass

2421

if e.errno not in set((errno.ENOENT, errno.EACCES,

2422

errno.EEXIST)):

2423

raise e

2424

2425

# Delete all clients, and settings from config

2426

2061

while tcp_server.clients:

2427

name, client = tcp_server.clients.popitem()

2062

client = tcp_server.clients.pop()

2428

2063

if use_dbus:

2429

2064

client.remove_from_connection()

2065

client.disable_hook = None

2430

2066

# Don't signal anything except ClientRemoved

2431

2067

client.disable(quiet=True)

2432

2068

if use_dbus:

2433

2069

# Emit D-Bus signal

2434

mandos_dbus_service.ClientRemoved(client

2435

.dbus_object_path,

2070

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2436

2071

client.name)

2437

client_settings.clear()

2438

2072

2439

2073

atexit.register(cleanup)

2440

2074

2441

for client in tcp_server.clients.itervalues():

2075

for client in tcp_server.clients:

2442

2076

if use_dbus:

2443

2077

# Emit D-Bus signal

2444

2078

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2445

# Need to initiate checking of clients

2446

if client.enabled:

2447

client.init_checker()

2079

client.enable()

2448

2080

2449

2081

tcp_server.enable()

2450

2082

tcp_server.server_activate()

2490

2122

# Must run before the D-Bus bus name gets deregistered

2491

2123

cleanup()

2492

2124

2125

2493

2126

if __name__ == '__main__':

2494

2127

main()