/mandos/trunk : revision 24.2.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

64

69

65

import dbus

70

66

import dbus.service

75

71

import ctypes.util

76

72

import xml.dom.minidom

77

73

import inspect

78

import GnuPGInterface

79

74

80

75

try:

81

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

80

except ImportError:

86

81

SO_BINDTODEVICE = None

87

82

88

version = "1.5.3"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

83

84

version = "1.0.14"

85

86

logger = logging.Logger(u'mandos')

92

87

syslogger = (logging.handlers.SysLogHandler

93

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

210

89

address = "/dev/log"))

90

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

93

logger.addHandler(syslogger)

94

95

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

logger.addHandler(console)

100

101

multiprocessing_manager = multiprocessing.Manager()

211

102

212

103

class AvahiError(Exception):

213

104

def __init__(self, value, *args, **kwargs):

229

120

Attributes:

230

121

interface: integer; avahi.IF_UNSPEC or an interface index.

231

122

Used to optionally bind to the specified interface.

232

233

type: string; Example: '_mandos._tcp'.

123

124

type: string; Example: u'_mandos._tcp'.

234

125

See <http://www.dns-sd.org/ServiceTypes.html>

235

126

port: integer; what port to announce

236

127

TXT: list of strings; TXT record for the service

245

136

"""

246

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

247

138

servicetype = None, port = None, TXT = None,

248

domain = "", host = "", max_renames = 32768,

139

domain = u"", host = u"", max_renames = 32768,

249

140

protocol = avahi.PROTO_UNSPEC, bus = None):

250

141

self.interface = interface

251

142

self.name = name

260

151

self.group = None # our entry group

261

152

self.server = None

262

153

self.bus = bus

263

self.entry_group_state_changed_match = None

264

154

def rename(self):

265

155

"""Derived from the Avahi example code"""

266

156

if self.rename_count >= self.max_renames:

267

logger.critical("No suitable Zeroconf service name found"

268

" after %i retries, exiting.",

157

logger.critical(u"No suitable Zeroconf service name found"

158

u" after %i retries, exiting.",

269

159

self.rename_count)

270

raise AvahiServiceError("Too many renames")

271

self.name = unicode(self.server

272

.GetAlternativeServiceName(self.name))

273

logger.info("Changing Zeroconf service name to %r ...",

274

self.name)

160

raise AvahiServiceError(u"Too many renames")

161

self.name = self.server.GetAlternativeServiceName(self.name)

162

logger.info(u"Changing Zeroconf service name to %r ...",

163

unicode(self.name))

164

syslogger.setFormatter(logging.Formatter

165

(u'Mandos (%s) [%%(process)d]:'

166

u' %%(levelname)s: %%(message)s'

167

% self.name))

275

168

self.remove()

276

try:

277

self.add()

278

except dbus.exceptions.DBusException as error:

279

logger.critical("DBusException: %s", error)

280

self.cleanup()

281

os._exit(1)

169

self.add()

282

170

self.rename_count += 1

283

171

def remove(self):

284

172

"""Derived from the Avahi example code"""

285

if self.entry_group_state_changed_match is not None:

286

self.entry_group_state_changed_match.remove()

287

self.entry_group_state_changed_match = None

288

173

if self.group is not None:

289

174

self.group.Reset()

290

175

def add(self):

291

176

"""Derived from the Avahi example code"""

292

self.remove()

293

177

if self.group is None:

294

178

self.group = dbus.Interface(

295

179

self.bus.get_object(avahi.DBUS_NAME,

296

180

self.server.EntryGroupNew()),

297

181

avahi.DBUS_INTERFACE_ENTRY_GROUP)

298

self.entry_group_state_changed_match = (

299

self.group.connect_to_signal(

300

'StateChanged', self.entry_group_state_changed))

301

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

self.group.connect_to_signal('StateChanged',

183

self

184

.entry_group_state_changed)

185

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

302

186

self.name, self.type)

303

187

self.group.AddService(

304

188

self.interface,

311

195

self.group.Commit()

312

196

def entry_group_state_changed(self, state, error):

313

197

"""Derived from the Avahi example code"""

314

logger.debug("Avahi entry group state change: %i", state)

198

logger.debug(u"Avahi state change: %i", state)

315

199

316

200

if state == avahi.ENTRY_GROUP_ESTABLISHED:

317

logger.debug("Zeroconf service established.")

201

logger.debug(u"Zeroconf service established.")

318

202

elif state == avahi.ENTRY_GROUP_COLLISION:

319

logger.info("Zeroconf service name collision.")

203

logger.warning(u"Zeroconf service name collision.")

320

204

self.rename()

321

205

elif state == avahi.ENTRY_GROUP_FAILURE:

322

logger.critical("Avahi: Error in group state changed %s",

206

logger.critical(u"Avahi: Error in group state changed %s",

323

207

unicode(error))

324

raise AvahiGroupError("State changed: %s"

208

raise AvahiGroupError(u"State changed: %s"

325

209

% unicode(error))

326

210

def cleanup(self):

327

211

"""Derived from the Avahi example code"""

328

212

if self.group is not None:

329

try:

330

self.group.Free()

331

except (dbus.exceptions.UnknownMethodException,

332

dbus.exceptions.DBusException):

333

pass

213

self.group.Free()

334

214

self.group = None

335

self.remove()

336

def server_state_changed(self, state, error=None):

215

def server_state_changed(self, state):

337

216

"""Derived from the Avahi example code"""

338

logger.debug("Avahi server state change: %i", state)

339

bad_states = { avahi.SERVER_INVALID:

340

"Zeroconf server invalid",

341

avahi.SERVER_REGISTERING: None,

342

avahi.SERVER_COLLISION:

343

"Zeroconf server name collision",

344

avahi.SERVER_FAILURE:

345

"Zeroconf server failure" }

346

if state in bad_states:

347

if bad_states[state] is not None:

348

if error is None:

349

logger.error(bad_states[state])

350

else:

351

logger.error(bad_states[state] + ": %r", error)

352

self.cleanup()

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

353

220

elif state == avahi.SERVER_RUNNING:

354

221

self.add()

355

else:

356

if error is None:

357

logger.debug("Unknown state: %r", state)

358

else:

359

logger.debug("Unknown state: %r: %r", state, error)

360

222

def activate(self):

361

223

"""Derived from the Avahi example code"""

362

224

if self.server is None:

363

225

self.server = dbus.Interface(

364

226

self.bus.get_object(avahi.DBUS_NAME,

365

avahi.DBUS_PATH_SERVER,

366

follow_name_owner_changes=True),

227

avahi.DBUS_PATH_SERVER),

367

228

avahi.DBUS_INTERFACE_SERVER)

368

self.server.connect_to_signal("StateChanged",

229

self.server.connect_to_signal(u"StateChanged",

369

230

self.server_state_changed)

370

231

self.server_state_changed(self.server.GetState())

371

232

372

class AvahiServiceToSyslog(AvahiService):

373

def rename(self):

374

"""Add the new name to the syslog messages"""

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

380

return ret

381

233

382

def timedelta_to_milliseconds(td):

383

"Convert a datetime.timedelta() to milliseconds"

384

return ((td.days * 24 * 60 * 60 * 1000)

385

+ (td.seconds * 1000)

386

+ (td.microseconds // 1000))

387

388

234

class Client(object):

389

235

"""A representation of a client host served by this server.

390

236

391

237

Attributes:

392

approved: bool(); 'None' if not yet approved/disapproved

393

approval_delay: datetime.timedelta(); Time to wait for approval

394

approval_duration: datetime.timedelta(); Duration of one approval

238

239

D-Bus identifiers

240

fingerprint: string (40 or 32 hexadecimal digits); used to

241

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

245

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

248

timeout: datetime.timedelta(); How long from last_checked_ok

249

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

395

252

checker: subprocess.Popen(); a running checker process used

396

253

to see if the client lives.

397

254

'None' if no process is running.

398

checker_callback_tag: a gobject event source tag, or None

399

checker_command: string; External command which is run to check

400

if client lives. %() expansions are done at

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

401

260

runtime with vars(self) as dict, so that for

402

261

instance %(name)s can be used in the command.

403

checker_initiator_tag: a gobject event source tag, or None

404

created: datetime.datetime(); (UTC) object creation

405

client_structure: Object describing what attributes a client has

406

and is used for storing the client at exit

407

262

current_checker_command: string; current running checker_command

408

disable_initiator_tag: a gobject event source tag, or None

409

enabled: bool()

410

fingerprint: string (40 or 32 hexadecimal digits); used to

411

uniquely identify the client

412

host: string; available for use by the checker command

413

interval: datetime.timedelta(); How often to start a new checker

414

last_approval_request: datetime.datetime(); (UTC) or None

415

last_checked_ok: datetime.datetime(); (UTC) or None

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, -2 means no checker completed yet.

419

last_enabled: datetime.datetime(); (UTC) or None

420

421

D-Bus identifiers

422

secret: bytestring; sent verbatim (over TLS) to client

423

timeout: datetime.timedelta(); How long from last_checked_ok

424

until this client is disabled

425

extended_timeout: extra long timeout when secret has been sent

426

runtime_expansions: Allowed attributes for runtime expansion.

427

expires: datetime.datetime(); time (UTC) when a client will be

428

disabled, or None

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

429

266

"""

430

267

431

runtime_expansions = ("approval_delay", "approval_duration",

432

"created", "enabled", "fingerprint",

433

"host", "interval", "last_checked_ok",

434

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

268

@staticmethod

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

445

274

446

275

def timeout_milliseconds(self):

447

276

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

449

450

def extended_timeout_milliseconds(self):

451

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

277

return self._timedelta_to_milliseconds(self.timeout)

453

278

454

279

def interval_milliseconds(self):

455

280

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

457

285

458

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

"""Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above.

466

NOTE: Must be a pure function. Must return the same result

467

value given the same arguments.

468

"""

469

settings = {}

470

for client_name in config.sections():

471

section = dict(config.items(client_name))

472

client = settings[client_name] = {}

473

474

client["host"] = section["host"]

475

# Reformat values from string types to Python types

476

client["approved_by_default"] = config.getboolean(

477

client_name, "approved_by_default")

478

client["enabled"] = config.getboolean(client_name,

479

"enabled")

480

481

client["fingerprint"] = (section["fingerprint"].upper()

482

.replace(" ", ""))

483

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

485

elif "secfile" in section:

486

with open(os.path.expanduser(os.path.expandvars

487

(section["secfile"])),

488

"rb") as secfile:

489

client["secret"] = secfile.read()

490

else:

491

raise TypeError("No secret or secfile for section %s"

492

% section)

493

client["timeout"] = string_to_delta(section["timeout"])

494

client["extended_timeout"] = string_to_delta(

495

section["extended_timeout"])

496

client["interval"] = string_to_delta(section["interval"])

497

client["approval_delay"] = string_to_delta(

498

section["approval_delay"])

499

client["approval_duration"] = string_to_delta(

500

section["approval_duration"])

501

client["checker_command"] = section["checker"]

502

client["last_approval_request"] = None

503

client["last_checked_ok"] = None

504

client["last_checker_status"] = -2

505

506

return settings

507

508

509

def __init__(self, settings, name = None):

286

def __init__(self, name = None, disable_hook=None, config=None):

510

287

"""Note: the 'checker' key in 'config' sets the

511

288

'checker_command' attribute and *not* the 'checker'

512

289

attribute."""

513

290

self.name = name

514

# adding all client settings

515

for setting, value in settings.iteritems():

516

setattr(self, setting, value)

517

518

if self.enabled:

519

if not hasattr(self, "last_enabled"):

520

self.last_enabled = datetime.datetime.utcnow()

521

if not hasattr(self, "expires"):

522

self.expires = (datetime.datetime.utcnow()

523

+ self.timeout)

524

else:

525

self.last_enabled = None

526

self.expires = None

527

528

logger.debug("Creating client %r", self.name)

291

if config is None:

292

config = {}

293

logger.debug(u"Creating client %r", self.name)

529

294

# Uppercase and remove spaces from fingerprint for later

530

295

# comparison purposes with return value from the fingerprint()

531

296

# function

532

logger.debug(" Fingerprint: %s", self.fingerprint)

533

self.created = settings.get("created",

534

datetime.datetime.utcnow())

535

536

# attributes specific for this server instance

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

303

with open(os.path.expanduser(os.path.expandvars

304

(config[u"secfile"])),

305

"rb") as secfile:

306

self.secret = secfile.read()

307

else:

308

#XXX Need to allow secret on demand!

309

raise TypeError(u"No secret or secfile for client %s"

310

% self.name)

311

self.host = config.get(u"host", u"")

312

self.created = datetime.datetime.utcnow()

313

self.enabled = False

314

self.last_enabled = None

315

self.last_checked_ok = None

316

self.timeout = string_to_delta(config[u"timeout"])

317

self.interval = string_to_delta(config[u"interval"])

318

self.disable_hook = disable_hook

537

319

self.checker = None

538

320

self.checker_initiator_tag = None

539

321

self.disable_initiator_tag = None

540

322

self.checker_callback_tag = None

323

self.checker_command = config[u"checker"]

541

324

self.current_checker_command = None

542

self.approved = None

325

self.last_connect = None

543

326

self.approvals_pending = 0

544

self.changedstate = (multiprocessing_manager

545

.Condition(multiprocessing_manager

546

.Lock()))

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

549

if not attr.startswith("_")]

550

self.client_structure.append("client_structure")

551

552

for name, t in inspect.getmembers(type(self),

553

lambda obj:

554

isinstance(obj,

555

property)):

556

if not name.startswith("_"):

557

self.client_structure.append(name)

558

559

# Send notice to process children that client state has changed

327

self._approved = None

328

self.approved_by_default = config.get(u"approved_by_default",

329

True)

330

self.approved_delay = string_to_delta(

331

config[u"approved_delay"])

332

self.approved_duration = string_to_delta(

333

config[u"approved_duration"])

334

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

335

560

336

def send_changedstate(self):

561

with self.changedstate:

562

self.changedstate.notify_all()

563

337

self.changedstate.acquire()

338

self.changedstate.notify_all()

339

self.changedstate.release()

340

564

341

def enable(self):

565

342

"""Start this client's checker and timeout hooks"""

566

if getattr(self, "enabled", False):

343

if getattr(self, u"enabled", False):

567

344

# Already enabled

568

345

return

569

346

self.send_changedstate()

570

self.expires = datetime.datetime.utcnow() + self.timeout

571

self.enabled = True

572

347

self.last_enabled = datetime.datetime.utcnow()

573

self.init_checker()

574

575

def disable(self, quiet=True):

576

"""Disable this client."""

577

if not getattr(self, "enabled", False):

578

return False

579

if not quiet:

580

self.send_changedstate()

581

if not quiet:

582

logger.info("Disabling client %s", self.name)

583

if getattr(self, "disable_initiator_tag", False):

584

gobject.source_remove(self.disable_initiator_tag)

585

self.disable_initiator_tag = None

586

self.expires = None

587

if getattr(self, "checker_initiator_tag", False):

588

gobject.source_remove(self.checker_initiator_tag)

589

self.checker_initiator_tag = None

590

self.stop_checker()

591

self.enabled = False

592

# Do not run this again if called by a gobject.timeout_add

593

return False

594

595

def __del__(self):

596

self.disable()

597

598

def init_checker(self):

599

348

# Schedule a new checker to be started an 'interval' from now,

600

349

# and every interval from then on.

601

350

self.checker_initiator_tag = (gobject.timeout_add

605

354

self.disable_initiator_tag = (gobject.timeout_add

606

355

(self.timeout_milliseconds(),

607

356

self.disable))

357

self.enabled = True

608

358

# Also start a new checker *right now*.

609

359

self.start_checker()

610

360

361

def disable(self, quiet=True):

362

"""Disable this client."""

363

if not getattr(self, "enabled", False):

364

return False

365

if not quiet:

366

self.send_changedstate()

367

if not quiet:

368

logger.info(u"Disabling client %s", self.name)

369

if getattr(self, u"disable_initiator_tag", False):

370

gobject.source_remove(self.disable_initiator_tag)

371

self.disable_initiator_tag = None

372

if getattr(self, u"checker_initiator_tag", False):

373

gobject.source_remove(self.checker_initiator_tag)

374

self.checker_initiator_tag = None

375

self.stop_checker()

376

if self.disable_hook:

377

self.disable_hook(self)

378

self.enabled = False

379

# Do not run this again if called by a gobject.timeout_add

380

return False

381

382

def __del__(self):

383

self.disable_hook = None

384

self.disable()

385

611

386

def checker_callback(self, pid, condition, command):

612

387

"""The checker has completed, so take appropriate actions."""

613

388

self.checker_callback_tag = None

614

389

self.checker = None

615

390

if os.WIFEXITED(condition):

616

self.last_checker_status = os.WEXITSTATUS(condition)

617

if self.last_checker_status == 0:

618

logger.info("Checker for %(name)s succeeded",

391

exitstatus = os.WEXITSTATUS(condition)

392

if exitstatus == 0:

393

logger.info(u"Checker for %(name)s succeeded",

619

394

vars(self))

620

395

self.checked_ok()

621

396

else:

622

logger.info("Checker for %(name)s failed",

397

logger.info(u"Checker for %(name)s failed",

623

398

vars(self))

624

399

else:

625

self.last_checker_status = -1

626

logger.warning("Checker for %(name)s crashed?",

400

logger.warning(u"Checker for %(name)s crashed?",

627

401

vars(self))

628

402

629

403

def checked_ok(self):

630

"""Assert that the client has been seen, alive and well."""

404

"""Bump up the timeout for this client.

405

406

This should only be called when the client has been seen,

407

alive and well.

408

"""

631

409

self.last_checked_ok = datetime.datetime.utcnow()

632

self.last_checker_status = 0

633

self.bump_timeout()

634

635

def bump_timeout(self, timeout=None):

636

"""Bump up the timeout for this client."""

637

if timeout is None:

638

timeout = self.timeout

639

if self.disable_initiator_tag is not None:

640

gobject.source_remove(self.disable_initiator_tag)

641

if getattr(self, "enabled", False):

642

self.disable_initiator_tag = (gobject.timeout_add

643

(timedelta_to_milliseconds

644

(timeout), self.disable))

645

self.expires = datetime.datetime.utcnow() + timeout

646

647

def need_approval(self):

648

self.last_approval_request = datetime.datetime.utcnow()

410

gobject.source_remove(self.disable_initiator_tag)

411

self.disable_initiator_tag = (gobject.timeout_add

412

(self.timeout_milliseconds(),

413

self.disable))

649

414

650

415

def start_checker(self):

651

416

"""Start a new checker subprocess if one is not running.

664

429

# If a checker exists, make sure it is not a zombie

665

430

try:

666

431

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

667

except (AttributeError, OSError) as error:

432

except (AttributeError, OSError), error:

668

433

if (isinstance(error, OSError)

669

434

and error.errno != errno.ECHILD):

670

435

raise error

671

436

else:

672

437

if pid:

673

logger.warning("Checker was a zombie")

438

logger.warning(u"Checker was a zombie")

674

439

gobject.source_remove(self.checker_callback_tag)

675

440

self.checker_callback(pid, status,

676

441

self.current_checker_command)

681

446

command = self.checker_command % self.host

682

447

except TypeError:

683

448

# Escape attributes for the shell

684

escaped_attrs = dict(

685

(attr,

686

re.escape(unicode(str(getattr(self, attr, "")),

687

errors=

688

'replace')))

689

for attr in

690

self.runtime_expansions)

691

449

escaped_attrs = dict((key,

450

re.escape(unicode(str(val),

451

errors=

452

u'replace')))

453

for key, val in

454

vars(self).iteritems())

692

455

try:

693

456

command = self.checker_command % escaped_attrs

694

except TypeError as error:

695

logger.error('Could not format string "%s":'

696

' %s', self.checker_command, error)

457

except TypeError, error:

458

logger.error(u'Could not format string "%s":'

459

u' %s', self.checker_command, error)

697

460

return True # Try again later

698

461

self.current_checker_command = command

699

462

try:

700

logger.info("Starting checker %r for %s",

463

logger.info(u"Starting checker %r for %s",

701

464

command, self.name)

702

465

# We don't need to redirect stdout and stderr, since

703

466

# in normal mode, that is already done by daemon(),

705

468

# always replaced by /dev/null.)

706

469

self.checker = subprocess.Popen(command,

707

470

close_fds=True,

708

shell=True, cwd="/")

471

shell=True, cwd=u"/")

709

472

self.checker_callback_tag = (gobject.child_watch_add

710

473

(self.checker.pid,

711

474

self.checker_callback,

716

479

if pid:

717

480

gobject.source_remove(self.checker_callback_tag)

718

481

self.checker_callback(pid, status, command)

719

except OSError as error:

720

logger.error("Failed to start subprocess: %s",

482

except OSError, error:

483

logger.error(u"Failed to start subprocess: %s",

721

484

error)

722

485

# Re-run this periodically if run by gobject.timeout_add

723

486

return True

727

490

if self.checker_callback_tag:

728

491

gobject.source_remove(self.checker_callback_tag)

729

492

self.checker_callback_tag = None

730

if getattr(self, "checker", None) is None:

493

if getattr(self, u"checker", None) is None:

731

494

return

732

logger.debug("Stopping checker for %(name)s", vars(self))

495

logger.debug(u"Stopping checker for %(name)s", vars(self))

733

496

try:

734

497

os.kill(self.checker.pid, signal.SIGTERM)

735

498

#time.sleep(0.5)

736

499

#if self.checker.poll() is None:

737

500

# os.kill(self.checker.pid, signal.SIGKILL)

738

except OSError as error:

501

except OSError, error:

739

502

if error.errno != errno.ESRCH: # No such process

740

503

raise

741

504

self.checker = None

742

505

743

744

def dbus_service_property(dbus_interface, signature="v",

745

access="readwrite", byte_arrays=False):

506

def dbus_service_property(dbus_interface, signature=u"v",

507

access=u"readwrite", byte_arrays=False):

746

508

"""Decorators for marking methods of a DBusObjectWithProperties to

747

509

become properties on the D-Bus.

748

510

755

517

"""

756

518

# Encoding deeply encoded byte arrays is not supported yet by the

757

519

# "Set" method, so we fail early here:

758

if byte_arrays and signature != "ay":

759

raise ValueError("Byte arrays not supported for non-'ay'"

760

" signature %r" % signature)

520

if byte_arrays and signature != u"ay":

521

raise ValueError(u"Byte arrays not supported for non-'ay'"

522

u" signature %r" % signature)

761

523

def decorator(func):

762

524

func._dbus_is_property = True

763

525

func._dbus_interface = dbus_interface

764

526

func._dbus_signature = signature

765

527

func._dbus_access = access

766

528

func._dbus_name = func.__name__

767

if func._dbus_name.endswith("_dbus_property"):

529

if func._dbus_name.endswith(u"_dbus_property"):

768

530

func._dbus_name = func._dbus_name[:-14]

769

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

531

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

770

532

return func

771

533

return decorator

772

534

792

554

793

555

class DBusObjectWithProperties(dbus.service.Object):

794

556

"""A D-Bus object with properties.

795

557

796

558

Classes inheriting from this can use the dbus_service_property

797

559

decorator to expose methods as D-Bus properties. It exposes the

798

560

standard Get(), Set(), and GetAll() methods on the D-Bus.

800

562

801

563

@staticmethod

802

564

def _is_dbus_property(obj):

803

return getattr(obj, "_dbus_is_property", False)

565

return getattr(obj, u"_dbus_is_property", False)

804

566

805

567

def _get_all_dbus_properties(self):

806

568

"""Returns a generator of (name, attribute) pairs

807

569

"""

808

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

809

for cls in self.__class__.__mro__

570

return ((prop._dbus_name, prop)

810

571

for name, prop in

811

inspect.getmembers(cls, self._is_dbus_property))

572

inspect.getmembers(self, self._is_dbus_property))

812

573

813

574

def _get_dbus_property(self, interface_name, property_name):

814

575

"""Returns a bound method if one exists which is a D-Bus

815

576

property with the specified name and interface.

816

577

"""

817

for cls in self.__class__.__mro__:

818

for name, value in (inspect.getmembers

819

(cls, self._is_dbus_property)):

820

if (value._dbus_name == property_name

821

and value._dbus_interface == interface_name):

822

return value.__get__(self)

823

578

for name in (property_name,

579

property_name + u"_dbus_property"):

580

prop = getattr(self, name, None)

581

if (prop is None

582

or not self._is_dbus_property(prop)

583

or prop._dbus_name != property_name

584

or (interface_name and prop._dbus_interface

585

and interface_name != prop._dbus_interface)):

586

continue

587

return prop

824

588

# No such property

825

raise DBusPropertyNotFound(self.dbus_object_path + ":"

826

+ interface_name + "."

589

raise DBusPropertyNotFound(self.dbus_object_path + u":"

590

+ interface_name + u"."

827

591

+ property_name)

828

592

829

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

830

out_signature="v")

593

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

594

out_signature=u"v")

831

595

def Get(self, interface_name, property_name):

832

596

"""Standard D-Bus property Get() method, see D-Bus standard.

833

597

"""

834

598

prop = self._get_dbus_property(interface_name, property_name)

835

if prop._dbus_access == "write":

599

if prop._dbus_access == u"write":

836

600

raise DBusPropertyAccessException(property_name)

837

601

value = prop()

838

if not hasattr(value, "variant_level"):

602

if not hasattr(value, u"variant_level"):

839

603

return value

840

604

return type(value)(value, variant_level=value.variant_level+1)

841

605

842

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

606

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

843

607

def Set(self, interface_name, property_name, value):

844

608

"""Standard D-Bus property Set() method, see D-Bus standard.

845

609

"""

846

610

prop = self._get_dbus_property(interface_name, property_name)

847

if prop._dbus_access == "read":

611

if prop._dbus_access == u"read":

848

612

raise DBusPropertyAccessException(property_name)

849

if prop._dbus_get_args_options["byte_arrays"]:

613

if prop._dbus_get_args_options[u"byte_arrays"]:

850

614

# The byte_arrays option is not supported yet on

851

615

# signatures other than "ay".

852

if prop._dbus_signature != "ay":

616

if prop._dbus_signature != u"ay":

853

617

raise ValueError

854

value = dbus.ByteArray(b''.join(chr(byte)

855

for byte in value))

618

value = dbus.ByteArray(''.join(unichr(byte)

619

for byte in value))

856

620

prop(value)

857

621

858

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

859

out_signature="a{sv}")

622

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

623

out_signature=u"a{sv}")

860

624

def GetAll(self, interface_name):

861

625

"""Standard D-Bus property GetAll() method, see D-Bus

862

626

standard.

863

627

864

628

Note: Will not include properties with access="write".

865

629

"""

866

properties = {}

630

all = {}

867

631

for name, prop in self._get_all_dbus_properties():

868

632

if (interface_name

869

633

and interface_name != prop._dbus_interface):

870

634

# Interface non-empty but did not match

871

635

continue

872

636

# Ignore write-only properties

873

if prop._dbus_access == "write":

637

if prop._dbus_access == u"write":

874

638

continue

875

639

value = prop()

876

if not hasattr(value, "variant_level"):

877

properties[name] = value

640

if not hasattr(value, u"variant_level"):

641

all[name] = value

878

642

continue

879

properties[name] = type(value)(value, variant_level=

880

value.variant_level+1)

881

return dbus.Dictionary(properties, signature="sv")

643

all[name] = type(value)(value, variant_level=

644

value.variant_level+1)

645

return dbus.Dictionary(all, signature=u"sv")

882

646

883

647

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

884

out_signature="s",

648

out_signature=u"s",

885

649

path_keyword='object_path',

886

650

connection_keyword='connection')

887

651

def Introspect(self, object_path, connection):

892

656

try:

893

657

document = xml.dom.minidom.parseString(xmlstring)

894

658

def make_tag(document, name, prop):

895

e = document.createElement("property")

896

e.setAttribute("name", name)

897

e.setAttribute("type", prop._dbus_signature)

898

e.setAttribute("access", prop._dbus_access)

659

e = document.createElement(u"property")

660

e.setAttribute(u"name", name)

661

e.setAttribute(u"type", prop._dbus_signature)

662

e.setAttribute(u"access", prop._dbus_access)

899

663

return e

900

for if_tag in document.getElementsByTagName("interface"):

664

for if_tag in document.getElementsByTagName(u"interface"):

901

665

for tag in (make_tag(document, name, prop)

902

666

for name, prop

903

667

in self._get_all_dbus_properties()

904

668

if prop._dbus_interface

905

== if_tag.getAttribute("name")):

669

== if_tag.getAttribute(u"name")):

906

670

if_tag.appendChild(tag)

907

671

# Add the names to the return values for the

908

672

# "org.freedesktop.DBus.Properties" methods

909

if (if_tag.getAttribute("name")

910

== "org.freedesktop.DBus.Properties"):

911

for cn in if_tag.getElementsByTagName("method"):

912

if cn.getAttribute("name") == "Get":

913

for arg in cn.getElementsByTagName("arg"):

914

if (arg.getAttribute("direction")

915

== "out"):

916

arg.setAttribute("name", "value")

917

elif cn.getAttribute("name") == "GetAll":

918

for arg in cn.getElementsByTagName("arg"):

919

if (arg.getAttribute("direction")

920

== "out"):

921

arg.setAttribute("name", "props")

922

xmlstring = document.toxml("utf-8")

673

if (if_tag.getAttribute(u"name")

674

== u"org.freedesktop.DBus.Properties"):

675

for cn in if_tag.getElementsByTagName(u"method"):

676

if cn.getAttribute(u"name") == u"Get":

677

for arg in cn.getElementsByTagName(u"arg"):

678

if (arg.getAttribute(u"direction")

679

== u"out"):

680

arg.setAttribute(u"name", u"value")

681

elif cn.getAttribute(u"name") == u"GetAll":

682

for arg in cn.getElementsByTagName(u"arg"):

683

if (arg.getAttribute(u"direction")

684

== u"out"):

685

arg.setAttribute(u"name", u"props")

686

xmlstring = document.toxml(u"utf-8")

923

687

document.unlink()

924

688

except (AttributeError, xml.dom.DOMException,

925

xml.parsers.expat.ExpatError) as error:

926

logger.error("Failed to override Introspection method",

689

xml.parsers.expat.ExpatError), error:

690

logger.error(u"Failed to override Introspection method",

927

691

error)

928

692

return xmlstring

929

693

930

694

931

def datetime_to_dbus (dt, variant_level=0):

932

"""Convert a UTC datetime.datetime() to a D-Bus type."""

933

if dt is None:

934

return dbus.String("", variant_level = variant_level)

935

return dbus.String(dt.isoformat(),

936

variant_level=variant_level)

937

938

939

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

940

.__metaclass__):

941

"""Applied to an empty subclass of a D-Bus object, this metaclass

942

will add additional D-Bus attributes matching a certain pattern.

943

"""

944

def __new__(mcs, name, bases, attr):

945

# Go through all the base classes which could have D-Bus

946

# methods, signals, or properties in them

947

for base in (b for b in bases

948

if issubclass(b, dbus.service.Object)):

949

# Go though all attributes of the base class

950

for attrname, attribute in inspect.getmembers(base):

951

# Ignore non-D-Bus attributes, and D-Bus attributes

952

# with the wrong interface name

953

if (not hasattr(attribute, "_dbus_interface")

954

or not attribute._dbus_interface

955

.startswith("se.recompile.Mandos")):

956

continue

957

# Create an alternate D-Bus interface name based on

958

# the current name

959

alt_interface = (attribute._dbus_interface

960

.replace("se.recompile.Mandos",

961

"se.bsnet.fukt.Mandos"))

962

# Is this a D-Bus signal?

963

if getattr(attribute, "_dbus_is_signal", False):

964

# Extract the original non-method function by

965

# black magic

966

nonmethod_func = (dict(

967

zip(attribute.func_code.co_freevars,

968

attribute.__closure__))["func"]

969

.cell_contents)

970

# Create a new, but exactly alike, function

971

# object, and decorate it to be a new D-Bus signal

972

# with the alternate D-Bus interface name

973

new_function = (dbus.service.signal

974

(alt_interface,

975

attribute._dbus_signature)

976

(types.FunctionType(

977

nonmethod_func.func_code,

978

nonmethod_func.func_globals,

979

nonmethod_func.func_name,

980

nonmethod_func.func_defaults,

981

nonmethod_func.func_closure)))

982

# Define a creator of a function to call both the

983

# old and new functions, so both the old and new

984

# signals gets sent when the function is called

985

def fixscope(func1, func2):

986

"""This function is a scope container to pass

987

func1 and func2 to the "call_both" function

988

outside of its arguments"""

989

def call_both(*args, **kwargs):

990

"""This function will emit two D-Bus

991

signals by calling func1 and func2"""

992

func1(*args, **kwargs)

993

func2(*args, **kwargs)

994

return call_both

995

# Create the "call_both" function and add it to

996

# the class

997

attr[attrname] = fixscope(attribute,

998

new_function)

999

# Is this a D-Bus method?

1000

elif getattr(attribute, "_dbus_is_method", False):

1001

# Create a new, but exactly alike, function

1002

# object. Decorate it to be a new D-Bus method

1003

# with the alternate D-Bus interface name. Add it

1004

# to the class.

1005

attr[attrname] = (dbus.service.method

1006

(alt_interface,

1007

attribute._dbus_in_signature,

1008

attribute._dbus_out_signature)

1009

(types.FunctionType

1010

(attribute.func_code,

1011

attribute.func_globals,

1012

attribute.func_name,

1013

attribute.func_defaults,

1014

attribute.func_closure)))

1015

# Is this a D-Bus property?

1016

elif getattr(attribute, "_dbus_is_property", False):

1017

# Create a new, but exactly alike, function

1018

# object, and decorate it to be a new D-Bus

1019

# property with the alternate D-Bus interface

1020

# name. Add it to the class.

1021

attr[attrname] = (dbus_service_property

1022

(alt_interface,

1023

attribute._dbus_signature,

1024

attribute._dbus_access,

1025

attribute

1026

._dbus_get_args_options

1027

["byte_arrays"])

1028

(types.FunctionType

1029

(attribute.func_code,

1030

attribute.func_globals,

1031

attribute.func_name,

1032

attribute.func_defaults,

1033

attribute.func_closure)))

1034

return type.__new__(mcs, name, bases, attr)

1035

1036

1037

695

class ClientDBus(Client, DBusObjectWithProperties):

1038

696

"""A Client class using D-Bus

1039

697

1041

699

dbus_object_path: dbus.ObjectPath

1042

700

bus: dbus.SystemBus()

1043

701

"""

1044

1045

runtime_expansions = (Client.runtime_expansions

1046

+ ("dbus_object_path",))

1047

1048

702

# dbus.service.Object doesn't use super(), so we can't either.

1049

703

1050

704

def __init__(self, bus = None, *args, **kwargs):

1052

706

Client.__init__(self, *args, **kwargs)

1053

707

# Only now, when this client is initialized, can it show up on

1054

708

# the D-Bus

1055

client_object_name = unicode(self.name).translate(

1056

{ord("."): ord("_"),

1057

ord("-"): ord("_")})

1058

709

self.dbus_object_path = (dbus.ObjectPath

1059

("/clients/" + client_object_name))

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

1060

712

DBusObjectWithProperties.__init__(self, self.bus,

1061

713

self.dbus_object_path)

1062

1063

def notifychangeproperty(transform_func,

1064

dbus_name, type_func=lambda x: x,

1065

variant_level=1):

1066

""" Modify a variable so that it's a property which announces

1067

its changes to DBus.

1068

1069

transform_fun: Function that takes a value and a variant_level

1070

and transforms it to a D-Bus type.

1071

dbus_name: D-Bus name of the variable

1072

type_func: Function that transform the value before sending it

1073

to the D-Bus. Default: no transform

1074

variant_level: D-Bus variant level. Default: 1

1075

"""

1076

attrname = "_{0}".format(dbus_name)

1077

def setter(self, value):

1078

if hasattr(self, "dbus_object_path"):

1079

if (not hasattr(self, attrname) or

1080

type_func(getattr(self, attrname, None))

1081

!= type_func(value)):

1082

dbus_value = transform_func(type_func(value),

1083

variant_level

1084

=variant_level)

1085

self.PropertyChanged(dbus.String(dbus_name),

1086

dbus_value)

1087

setattr(self, attrname, value)

1088

1089

return property(lambda self: getattr(self, attrname), setter)

1090

1091

1092

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1093

approvals_pending = notifychangeproperty(dbus.Boolean,

1094

"ApprovalPending",

1095

type_func = bool)

1096

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1097

last_enabled = notifychangeproperty(datetime_to_dbus,

1098

"LastEnabled")

1099

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1100

type_func = lambda checker:

1101

checker is not None)

1102

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1103

"LastCheckedOK")

1104

last_checker_status = notifychangeproperty(dbus.Int16,

1105

"LastCheckerStatus")

1106

last_approval_request = notifychangeproperty(

1107

datetime_to_dbus, "LastApprovalRequest")

1108

approved_by_default = notifychangeproperty(dbus.Boolean,

1109

"ApprovedByDefault")

1110

approval_delay = notifychangeproperty(dbus.UInt64,

1111

"ApprovalDelay",

1112

type_func =

1113

timedelta_to_milliseconds)

1114

approval_duration = notifychangeproperty(

1115

dbus.UInt64, "ApprovalDuration",

1116

type_func = timedelta_to_milliseconds)

1117

host = notifychangeproperty(dbus.String, "Host")

1118

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1119

type_func =

1120

timedelta_to_milliseconds)

1121

extended_timeout = notifychangeproperty(

1122

dbus.UInt64, "ExtendedTimeout",

1123

type_func = timedelta_to_milliseconds)

1124

interval = notifychangeproperty(dbus.UInt64,

1125

"Interval",

1126

type_func =

1127

timedelta_to_milliseconds)

1128

checker_command = notifychangeproperty(dbus.String, "Checker")

1129

1130

del notifychangeproperty

714

715

@staticmethod

716

def _datetime_to_dbus(dt, variant_level=0):

717

"""Convert a UTC datetime.datetime() to a D-Bus type."""

718

return dbus.String(dt.isoformat(),

719

variant_level=variant_level)

720

721

def enable(self):

722

oldstate = getattr(self, u"enabled", False)

723

r = Client.enable(self)

724

if oldstate != self.enabled:

725

# Emit D-Bus signals

726

self.PropertyChanged(dbus.String(u"enabled"),

727

dbus.Boolean(True, variant_level=1))

728

self.PropertyChanged(

729

dbus.String(u"last_enabled"),

730

self._datetime_to_dbus(self.last_enabled,

731

variant_level=1))

732

return r

733

734

def disable(self, quiet = False):

735

oldstate = getattr(self, u"enabled", False)

736

r = Client.disable(self, quiet=quiet)

737

if not quiet and oldstate != self.enabled:

738

# Emit D-Bus signal

739

self.PropertyChanged(dbus.String(u"enabled"),

740

dbus.Boolean(False, variant_level=1))

741

return r

1131

742

1132

743

def __del__(self, *args, **kwargs):

1133

744

try:

1134

745

self.remove_from_connection()

1135

746

except LookupError:

1136

747

pass

1137

if hasattr(DBusObjectWithProperties, "__del__"):

748

if hasattr(DBusObjectWithProperties, u"__del__"):

1138

749

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1139

750

Client.__del__(self, *args, **kwargs)

1140

751

1142

753

*args, **kwargs):

1143

754

self.checker_callback_tag = None

1144

755

self.checker = None

756

# Emit D-Bus signal

757

self.PropertyChanged(dbus.String(u"checker_running"),

758

dbus.Boolean(False, variant_level=1))

1145

759

if os.WIFEXITED(condition):

1146

760

exitstatus = os.WEXITSTATUS(condition)

1147

761

# Emit D-Bus signal

1157

771

return Client.checker_callback(self, pid, condition, command,

1158

772

*args, **kwargs)

1159

773

774

def checked_ok(self, *args, **kwargs):

775

r = Client.checked_ok(self, *args, **kwargs)

776

# Emit D-Bus signal

777

self.PropertyChanged(

778

dbus.String(u"last_checked_ok"),

779

(self._datetime_to_dbus(self.last_checked_ok,

780

variant_level=1)))

781

return r

782

1160

783

def start_checker(self, *args, **kwargs):

1161

784

old_checker = self.checker

1162

785

if self.checker is not None:

1169

792

and old_checker_pid != self.checker.pid):

1170

793

# Emit D-Bus signal

1171

794

self.CheckerStarted(self.current_checker_command)

795

self.PropertyChanged(

796

dbus.String(u"checker_running"),

797

dbus.Boolean(True, variant_level=1))

1172

798

return r

1173

799

800

def stop_checker(self, *args, **kwargs):

801

old_checker = getattr(self, u"checker", None)

802

r = Client.stop_checker(self, *args, **kwargs)

803

if (old_checker is not None

804

and getattr(self, u"checker", None) is None):

805

self.PropertyChanged(dbus.String(u"checker_running"),

806

dbus.Boolean(False, variant_level=1))

807

return r

808

1174

809

def _reset_approved(self):

1175

self.approved = None

810

self._approved = None

1176

811

return False

1177

812

1178

813

def approve(self, value=True):

1179

self.send_changedstate()

1180

self.approved = value

1181

gobject.timeout_add(timedelta_to_milliseconds

1182

(self.approval_duration),

1183

self._reset_approved)

814

self._approved = value

815

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

816

817

def approved_pending(self):

818

return self.approvals_pending > 0

1184

819

1185

820

1186

821

## D-Bus methods, signals & properties

1187

_interface = "se.recompile.Mandos.Client"

822

_interface = u"se.bsnet.fukt.Mandos.Client"

1188

823

1189

824

## Signals

1190

825

1191

826

# CheckerCompleted - signal

1192

@dbus.service.signal(_interface, signature="nxs")

827

@dbus.service.signal(_interface, signature=u"nxs")

1193

828

def CheckerCompleted(self, exitcode, waitstatus, command):

1194

829

"D-Bus signal"

1195

830

pass

1196

831

1197

832

# CheckerStarted - signal

1198

@dbus.service.signal(_interface, signature="s")

833

@dbus.service.signal(_interface, signature=u"s")

1199

834

def CheckerStarted(self, command):

1200

835

"D-Bus signal"

1201

836

pass

1202

837

1203

838

# PropertyChanged - signal

1204

@dbus.service.signal(_interface, signature="sv")

839

@dbus.service.signal(_interface, signature=u"sv")

1205

840

def PropertyChanged(self, property, value):

1206

841

"D-Bus signal"

1207

842

pass

1209

844

# GotSecret - signal

1210

845

@dbus.service.signal(_interface)

1211

846

def GotSecret(self):

1212

"""D-Bus signal

1213

Is sent after a successful transfer of secret from the Mandos

1214

server to mandos-client

1215

"""

1216

pass

847

"D-Bus signal"

848

if self.approved_pending():

849

self.PropertyChanged(dbus.String(u"checker_running"),

850

dbus.Boolean(False, variant_level=1))

1217

851

1218

852

# Rejected - signal

1219

@dbus.service.signal(_interface, signature="s")

853

@dbus.service.signal(_interface, signature=u"s")

1220

854

def Rejected(self, reason):

1221

855

"D-Bus signal"

1222

pass

856

if self.approved_pending():

857

self.PropertyChanged(dbus.String(u"checker_running"),

858

dbus.Boolean(False, variant_level=1))

1223

859

1224

860

# NeedApproval - signal

1225

@dbus.service.signal(_interface, signature="tb")

861

@dbus.service.signal(_interface, signature=u"db")

1226

862

def NeedApproval(self, timeout, default):

1227

863

"D-Bus signal"

1228

return self.need_approval()

864

if not self.approved_pending():

865

self.PropertyChanged(dbus.String(u"approved_pending"),

866

dbus.Boolean(True, variant_level=1))

1229

867

1230

868

## Methods

1231

869

1232

870

# Approve - method

1233

@dbus.service.method(_interface, in_signature="b")

871

@dbus.service.method(_interface, in_signature=u"b")

1234

872

def Approve(self, value):

1235

873

self.approve(value)

1236

874

1237

875

# CheckedOK - method

1238

876

@dbus.service.method(_interface)

1239

877

def CheckedOK(self):

1240

self.checked_ok()

878

return self.checked_ok()

1241

879

1242

880

# Enable - method

1243

881

@dbus.service.method(_interface)

1264

902

1265

903

## Properties

1266

904

1267

# ApprovalPending - property

1268

@dbus_service_property(_interface, signature="b", access="read")

1269

def ApprovalPending_dbus_property(self):

1270

return dbus.Boolean(bool(self.approvals_pending))

1271

1272

# ApprovedByDefault - property

1273

@dbus_service_property(_interface, signature="b",

1274

access="readwrite")

1275

def ApprovedByDefault_dbus_property(self, value=None):

1276

if value is None: # get

1277

return dbus.Boolean(self.approved_by_default)

1278

self.approved_by_default = bool(value)

1279

1280

# ApprovalDelay - property

1281

@dbus_service_property(_interface, signature="t",

1282

access="readwrite")

1283

def ApprovalDelay_dbus_property(self, value=None):

1284

if value is None: # get

1285

return dbus.UInt64(self.approval_delay_milliseconds())

1286

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1287

1288

# ApprovalDuration - property

1289

@dbus_service_property(_interface, signature="t",

1290

access="readwrite")

1291

def ApprovalDuration_dbus_property(self, value=None):

1292

if value is None: # get

1293

return dbus.UInt64(timedelta_to_milliseconds(

1294

self.approval_duration))

1295

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1296

1297

# Name - property

1298

@dbus_service_property(_interface, signature="s", access="read")

1299

def Name_dbus_property(self):

905

# approved_pending - property

906

@dbus_service_property(_interface, signature=u"b", access=u"read")

907

def approved_pending_dbus_property(self):

908

return dbus.Boolean(self.approved_pending())

909

910

# approved_by_default - property

911

@dbus_service_property(_interface, signature=u"b",

912

access=u"readwrite")

913

def approved_by_default_dbus_property(self):

914

return dbus.Boolean(self.approved_by_default)

915

916

# approved_delay - property

917

@dbus_service_property(_interface, signature=u"t",

918

access=u"readwrite")

919

def approved_delay_dbus_property(self):

920

return dbus.UInt64(self.approved_delay_milliseconds())

921

922

# approved_duration - property

923

@dbus_service_property(_interface, signature=u"t",

924

access=u"readwrite")

925

def approved_duration_dbus_property(self):

926

return dbus.UInt64(self._timedelta_to_milliseconds(

927

self.approved_duration))

928

929

# name - property

930

@dbus_service_property(_interface, signature=u"s", access=u"read")

931

def name_dbus_property(self):

1300

932

return dbus.String(self.name)

1301

933

1302

# Fingerprint - property

1303

@dbus_service_property(_interface, signature="s", access="read")

1304

def Fingerprint_dbus_property(self):

934

# fingerprint - property

935

@dbus_service_property(_interface, signature=u"s", access=u"read")

936

def fingerprint_dbus_property(self):

1305

937

return dbus.String(self.fingerprint)

1306

938

1307

# Host - property

1308

@dbus_service_property(_interface, signature="s",

1309

access="readwrite")

1310

def Host_dbus_property(self, value=None):

939

# host - property

940

@dbus_service_property(_interface, signature=u"s",

941

access=u"readwrite")

942

def host_dbus_property(self, value=None):

1311

943

if value is None: # get

1312

944

return dbus.String(self.host)

1313

self.host = unicode(value)

1314

1315

# Created - property

1316

@dbus_service_property(_interface, signature="s", access="read")

1317

def Created_dbus_property(self):

1318

return datetime_to_dbus(self.created)

1319

1320

# LastEnabled - property

1321

@dbus_service_property(_interface, signature="s", access="read")

1322

def LastEnabled_dbus_property(self):

1323

return datetime_to_dbus(self.last_enabled)

1324

1325

# Enabled - property

1326

@dbus_service_property(_interface, signature="b",

1327

access="readwrite")

1328

def Enabled_dbus_property(self, value=None):

945

self.host = value

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"host"),

948

dbus.String(value, variant_level=1))

949

950

# created - property

951

@dbus_service_property(_interface, signature=u"s", access=u"read")

952

def created_dbus_property(self):

953

return dbus.String(self._datetime_to_dbus(self.created))

954

955

# last_enabled - property

956

@dbus_service_property(_interface, signature=u"s", access=u"read")

957

def last_enabled_dbus_property(self):

958

if self.last_enabled is None:

959

return dbus.String(u"")

960

return dbus.String(self._datetime_to_dbus(self.last_enabled))

961

962

# enabled - property

963

@dbus_service_property(_interface, signature=u"b",

964

access=u"readwrite")

965

def enabled_dbus_property(self, value=None):

1329

966

if value is None: # get

1330

967

return dbus.Boolean(self.enabled)

1331

968

if value:

1333

970

else:

1334

971

self.disable()

1335

972

1336

# LastCheckedOK - property

1337

@dbus_service_property(_interface, signature="s",

1338

access="readwrite")

1339

def LastCheckedOK_dbus_property(self, value=None):

973

# last_checked_ok - property

974

@dbus_service_property(_interface, signature=u"s",

975

access=u"readwrite")

976

def last_checked_ok_dbus_property(self, value=None):

1340

977

if value is not None:

1341

978

self.checked_ok()

1342

979

return

1343

return datetime_to_dbus(self.last_checked_ok)

1344

1345

# LastCheckerStatus - property

1346

@dbus_service_property(_interface, signature="n",

1347

access="read")

1348

def LastCheckerStatus_dbus_property(self):

1349

return dbus.Int16(self.last_checker_status)

1350

1351

# Expires - property

1352

@dbus_service_property(_interface, signature="s", access="read")

1353

def Expires_dbus_property(self):

1354

return datetime_to_dbus(self.expires)

1355

1356

# LastApprovalRequest - property

1357

@dbus_service_property(_interface, signature="s", access="read")

1358

def LastApprovalRequest_dbus_property(self):

1359

return datetime_to_dbus(self.last_approval_request)

1360

1361

# Timeout - property

1362

@dbus_service_property(_interface, signature="t",

1363

access="readwrite")

1364

def Timeout_dbus_property(self, value=None):

980

if self.last_checked_ok is None:

981

return dbus.String(u"")

982

return dbus.String(self._datetime_to_dbus(self

983

.last_checked_ok))

984

985

# timeout - property

986

@dbus_service_property(_interface, signature=u"t",

987

access=u"readwrite")

988

def timeout_dbus_property(self, value=None):

1365

989

if value is None: # get

1366

990

return dbus.UInt64(self.timeout_milliseconds())

1367

991

self.timeout = datetime.timedelta(0, 0, 0, value)

992

# Emit D-Bus signal

993

self.PropertyChanged(dbus.String(u"timeout"),

994

dbus.UInt64(value, variant_level=1))

995

if getattr(self, u"disable_initiator_tag", None) is None:

996

return

1368

997

# Reschedule timeout

1369

if self.enabled:

1370

now = datetime.datetime.utcnow()

1371

time_to_die = timedelta_to_milliseconds(

1372

(self.last_checked_ok + self.timeout) - now)

1373

if time_to_die <= 0:

1374

# The timeout has passed

1375

self.disable()

1376

else:

1377

self.expires = (now +

1378

datetime.timedelta(milliseconds =

1379

time_to_die))

1380

if (getattr(self, "disable_initiator_tag", None)

1381

is None):

1382

return

1383

gobject.source_remove(self.disable_initiator_tag)

1384

self.disable_initiator_tag = (gobject.timeout_add

1385

(time_to_die,

1386

self.disable))

1387

1388

# ExtendedTimeout - property

1389

@dbus_service_property(_interface, signature="t",

1390

access="readwrite")

1391

def ExtendedTimeout_dbus_property(self, value=None):

1392

if value is None: # get

1393

return dbus.UInt64(self.extended_timeout_milliseconds())

1394

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1395

1396

# Interval - property

1397

@dbus_service_property(_interface, signature="t",

1398

access="readwrite")

1399

def Interval_dbus_property(self, value=None):

998

gobject.source_remove(self.disable_initiator_tag)

999

self.disable_initiator_tag = None

1000

time_to_die = (self.

1001

_timedelta_to_milliseconds((self

1002

.last_checked_ok

1003

+ self.timeout)

1004

- datetime.datetime

1005

.utcnow()))

1006

if time_to_die <= 0:

1007

# The timeout has passed

1008

self.disable()

1009

else:

1010

self.disable_initiator_tag = (gobject.timeout_add

1011

(time_to_die, self.disable))

1012

1013

# interval - property

1014

@dbus_service_property(_interface, signature=u"t",

1015

access=u"readwrite")

1016

def interval_dbus_property(self, value=None):

1400

1017

if value is None: # get

1401

1018

return dbus.UInt64(self.interval_milliseconds())

1402

1019

self.interval = datetime.timedelta(0, 0, 0, value)

1403

if getattr(self, "checker_initiator_tag", None) is None:

1020

# Emit D-Bus signal

1021

self.PropertyChanged(dbus.String(u"interval"),

1022

dbus.UInt64(value, variant_level=1))

1023

if getattr(self, u"checker_initiator_tag", None) is None:

1404

1024

return

1405

if self.enabled:

1406

# Reschedule checker run

1407

gobject.source_remove(self.checker_initiator_tag)

1408

self.checker_initiator_tag = (gobject.timeout_add

1409

(value, self.start_checker))

1410

self.start_checker() # Start one now, too

1411

1412

# Checker - property

1413

@dbus_service_property(_interface, signature="s",

1414

access="readwrite")

1415

def Checker_dbus_property(self, value=None):

1025

# Reschedule checker run

1026

gobject.source_remove(self.checker_initiator_tag)

1027

self.checker_initiator_tag = (gobject.timeout_add

1028

(value, self.start_checker))

1029

self.start_checker() # Start one now, too

1030

1031

# checker - property

1032

@dbus_service_property(_interface, signature=u"s",

1033

access=u"readwrite")

1034

def checker_dbus_property(self, value=None):

1416

1035

if value is None: # get

1417

1036

return dbus.String(self.checker_command)

1418

self.checker_command = unicode(value)

1037

self.checker_command = value

1038

# Emit D-Bus signal

1039

self.PropertyChanged(dbus.String(u"checker"),

1040

dbus.String(self.checker_command,

1041

variant_level=1))

1419

1042

1420

# CheckerRunning - property

1421

@dbus_service_property(_interface, signature="b",

1422

access="readwrite")

1423

def CheckerRunning_dbus_property(self, value=None):

1043

# checker_running - property

1044

@dbus_service_property(_interface, signature=u"b",

1045

access=u"readwrite")

1046

def checker_running_dbus_property(self, value=None):

1424

1047

if value is None: # get

1425

1048

return dbus.Boolean(self.checker is not None)

1426

1049

if value:

1428

1051

else:

1429

1052

self.stop_checker()

1430

1053

1431

# ObjectPath - property

1432

@dbus_service_property(_interface, signature="o", access="read")

1433

def ObjectPath_dbus_property(self):

1054

# object_path - property

1055

@dbus_service_property(_interface, signature=u"o", access=u"read")

1056

def object_path_dbus_property(self):

1434

1057

return self.dbus_object_path # is already a dbus.ObjectPath

1435

1058

1436

# Secret = property

1437

@dbus_service_property(_interface, signature="ay",

1438

access="write", byte_arrays=True)

1439

def Secret_dbus_property(self, value):

1059

# secret = property

1060

@dbus_service_property(_interface, signature=u"ay",

1061

access=u"write", byte_arrays=True)

1062

def secret_dbus_property(self, value):

1440

1063

self.secret = str(value)

1441

1064

1442

1065

del _interface

1448

1071

self._pipe.send(('init', fpr, address))

1449

1072

if not self._pipe.recv():

1450

1073

raise KeyError()

1451

1074

1452

1075

def __getattribute__(self, name):

1453

if name == '_pipe':

1076

if(name == '_pipe'):

1454

1077

return super(ProxyClient, self).__getattribute__(name)

1455

1078

self._pipe.send(('getattr', name))

1456

1079

data = self._pipe.recv()

1461

1084

self._pipe.send(('funcall', name, args, kwargs))

1462

1085

return self._pipe.recv()[1]

1463

1086

return func

1464

1087

1465

1088

def __setattr__(self, name, value):

1466

if name == '_pipe':

1089

if(name == '_pipe'):

1467

1090

return super(ProxyClient, self).__setattr__(name, value)

1468

1091

self._pipe.send(('setattr', name, value))

1469

1092

1470

1093

1471

class ClientDBusTransitional(ClientDBus):

1472

__metaclass__ = AlternateDBusNamesMetaclass

1473

1474

1475

1094

class ClientHandler(socketserver.BaseRequestHandler, object):

1476

1095

"""A class to handle client connections.

1477

1096

1480

1099

1481

1100

def handle(self):

1482

1101

with contextlib.closing(self.server.child_pipe) as child_pipe:

1483

logger.info("TCP connection from: %s",

1102

logger.info(u"TCP connection from: %s",

1484

1103

unicode(self.client_address))

1485

logger.debug("Pipe FD: %d",

1104

logger.debug(u"Pipe FD: %d",

1486

1105

self.server.child_pipe.fileno())

1487

1106

1488

1107

session = (gnutls.connection

1489

1108

.ClientSession(self.request,

1490

1109

gnutls.connection

1491

1110

.X509Credentials()))

1492

1111

1493

1112

# Note: gnutls.connection.X509Credentials is really a

1494

1113

# generic GnuTLS certificate credentials object so long as

1495

1114

# no X.509 keys are added to it. Therefore, we can use it

1496

1115

# here despite using OpenPGP certificates.

1497

1498

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1499

# "+AES-256-CBC", "+SHA1",

1500

# "+COMP-NULL", "+CTYPE-OPENPGP",

1501

# "+DHE-DSS"))

1116

1117

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1118

# u"+AES-256-CBC", u"+SHA1",

1119

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1120

# u"+DHE-DSS"))

1502

1121

# Use a fallback default, since this MUST be set.

1503

1122

priority = self.server.gnutls_priority

1504

1123

if priority is None:

1505

priority = "NORMAL"

1124

priority = u"NORMAL"

1506

1125

(gnutls.library.functions

1507

1126

.gnutls_priority_set_direct(session._c_object,

1508

1127

priority, None))

1509

1128

1510

1129

# Start communication using the Mandos protocol

1511

1130

# Get protocol number

1512

1131

line = self.request.makefile().readline()

1513

logger.debug("Protocol version: %r", line)

1132

logger.debug(u"Protocol version: %r", line)

1514

1133

try:

1515

1134

if int(line.strip().split()[0]) > 1:

1516

1135

raise RuntimeError

1517

except (ValueError, IndexError, RuntimeError) as error:

1518

logger.error("Unknown protocol version: %s", error)

1136

except (ValueError, IndexError, RuntimeError), error:

1137

logger.error(u"Unknown protocol version: %s", error)

1519

1138

return

1520

1139

1521

1140

# Start GnuTLS connection

1522

1141

try:

1523

1142

session.handshake()

1524

except gnutls.errors.GNUTLSError as error:

1525

logger.warning("Handshake failed: %s", error)

1143

except gnutls.errors.GNUTLSError, error:

1144

logger.warning(u"Handshake failed: %s", error)

1526

1145

# Do not run session.bye() here: the session is not

1527

1146

# established. Just abandon the request.

1528

1147

return

1529

logger.debug("Handshake succeeded")

1530

1148

logger.debug(u"Handshake succeeded")

1149

1531

1150

approval_required = False

1532

1151

try:

1533

1152

try:

1534

1153

fpr = self.fingerprint(self.peer_certificate

1535

1154

(session))

1536

except (TypeError,

1537

gnutls.errors.GNUTLSError) as error:

1538

logger.warning("Bad certificate: %s", error)

1155

except (TypeError, gnutls.errors.GNUTLSError), error:

1156

logger.warning(u"Bad certificate: %s", error)

1539

1157

return

1540

logger.debug("Fingerprint: %s", fpr)

1541

1158

logger.debug(u"Fingerprint: %s", fpr)

1159

1542

1160

try:

1543

1161

client = ProxyClient(child_pipe, fpr,

1544

1162

self.client_address)

1545

1163

except KeyError:

1546

1164

return

1547

1165

1548

if client.approval_delay:

1549

delay = client.approval_delay

1166

if client.approved_delay:

1167

delay = client.approved_delay

1550

1168

client.approvals_pending += 1

1551

1169

approval_required = True

1552

1170

1553

1171

while True:

1554

1172

if not client.enabled:

1555

logger.info("Client %s is disabled",

1173

logger.warning(u"Client %s is disabled",

1556

1174

client.name)

1557

1175

if self.server.use_dbus:

1558

1176

# Emit D-Bus signal

1559

client.Rejected("Disabled")

1177

client.Rejected("Disabled")

1560

1178

return

1561

1179

1562

if client.approved or not client.approval_delay:

1180

if client._approved or not client.approved_delay:

1563

1181

#We are approved or approval is disabled

1564

1182

break

1565

elif client.approved is None:

1566

logger.info("Client %s needs approval",

1183

elif client._approved is None:

1184

logger.info(u"Client %s need approval",

1567

1185

client.name)

1568

1186

if self.server.use_dbus:

1569

1187

# Emit D-Bus signal

1570

1188

client.NeedApproval(

1571

client.approval_delay_milliseconds(),

1189

client.approved_delay_milliseconds(),

1572

1190

client.approved_by_default)

1573

1191

else:

1574

logger.warning("Client %s was not approved",

1192

logger.warning(u"Client %s was not approved",

1575

1193

client.name)

1576

1194

if self.server.use_dbus:

1577

1195

# Emit D-Bus signal

1578

client.Rejected("Denied")

1196

client.Rejected("Disapproved")

1579

1197

return

1580

1198

1581

1199

#wait until timeout or approved

1200

#x = float(client._timedelta_to_milliseconds(delay))

1582

1201

time = datetime.datetime.now()

1583

1202

client.changedstate.acquire()

1584

(client.changedstate.wait

1585

(float(client.timedelta_to_milliseconds(delay)

1586

/ 1000)))

1203

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1587

1204

client.changedstate.release()

1588

1205

time2 = datetime.datetime.now()

1589

1206

if (time2 - time) >= delay:

1593

1210

client.name)

1594

1211

if self.server.use_dbus:

1595

1212

# Emit D-Bus signal

1596

client.Rejected("Approval timed out")

1213

client.Rejected("Time out")

1597

1214

return

1598

1215

else:

1599

1216

break

1602

1219

1603

1220

sent_size = 0

1604

1221

while sent_size < len(client.secret):

1605

try:

1606

sent = session.send(client.secret[sent_size:])

1607

except gnutls.errors.GNUTLSError as error:

1608

logger.warning("gnutls send failed")

1609

return

1610

logger.debug("Sent: %d, remaining: %d",

1222

# XXX handle session exception

1223

sent = session.send(client.secret[sent_size:])

1224

logger.debug(u"Sent: %d, remaining: %d",

1611

1225

sent, len(client.secret)

1612

1226

- (sent_size + sent))

1613

1227

sent_size += sent

1614

1615

logger.info("Sending secret to %s", client.name)

1616

# bump the timeout using extended_timeout

1617

client.bump_timeout(client.extended_timeout)

1228

1229

logger.info(u"Sending secret to %s", client.name)

1230

# bump the timeout as if seen

1231

client.checked_ok()

1618

1232

if self.server.use_dbus:

1619

1233

# Emit D-Bus signal

1620

1234

client.GotSecret()

1622

1236

finally:

1623

1237

if approval_required:

1624

1238

client.approvals_pending -= 1

1625

try:

1626

session.bye()

1627

except gnutls.errors.GNUTLSError as error:

1628

logger.warning("GnuTLS bye failed")

1239

session.bye()

1629

1240

1630

1241

@staticmethod

1631

1242

def peer_certificate(session):

1641

1252

.gnutls_certificate_get_peers

1642

1253

(session._c_object, ctypes.byref(list_size)))

1643

1254

if not bool(cert_list) and list_size.value != 0:

1644

raise gnutls.errors.GNUTLSError("error getting peer"

1645

" certificate")

1255

raise gnutls.errors.GNUTLSError(u"error getting peer"

1256

u" certificate")

1646

1257

if list_size.value == 0:

1647

1258

return None

1648

1259

cert = cert_list[0]

1674

1285

if crtverify.value != 0:

1675

1286

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1676

1287

raise (gnutls.errors.CertificateSecurityError

1677

("Verify failed"))

1288

(u"Verify failed"))

1678

1289

# New buffer for the fingerprint

1679

1290

buf = ctypes.create_string_buffer(20)

1680

1291

buf_len = ctypes.c_size_t()

1687

1298

# Convert the buffer to a Python bytestring

1688

1299

fpr = ctypes.string_at(buf, buf_len.value)

1689

1300

# Convert the bytestring to hexadecimal notation

1690

hex_fpr = binascii.hexlify(fpr).upper()

1301

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1691

1302

return hex_fpr

1692

1303

1693

1304

1696

1307

def sub_process_main(self, request, address):

1697

1308

try:

1698

1309

self.finish_request(request, address)

1699

except Exception:

1310

except:

1700

1311

self.handle_error(request, address)

1701

1312

self.close_request(request)

1702

1313

1703

1314

def process_request(self, request, address):

1704

1315

"""Start a new process to process the request."""

1705

proc = multiprocessing.Process(target = self.sub_process_main,

1706

args = (request,

1707

address))

1708

proc.start()

1709

return proc

1710

1316

multiprocessing.Process(target = self.sub_process_main,

1317

args = (request, address)).start()

1711

1318

1712

1319

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1713

1320

""" adds a pipe to the MixIn """

1717

1324

This function creates a new pipe in self.pipe

1718

1325

"""

1719

1326

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1720

1721

proc = MultiprocessingMixIn.process_request(self, request,

1722

client_address)

1723

self.child_pipe.close()

1724

self.add_pipe(parent_pipe, proc)

1725

1726

def add_pipe(self, parent_pipe, proc):

1327

1328

super(MultiprocessingMixInWithPipe,

1329

self).process_request(request, client_address)

1330

self.add_pipe(parent_pipe)

1331

def add_pipe(self, parent_pipe):

1727

1332

"""Dummy function; override as necessary"""

1728

raise NotImplementedError

1729

1333

pass

1730

1334

1731

1335

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1732

1336

socketserver.TCPServer, object):

1750

1354

bind to an address or port if they were not specified."""

1751

1355

if self.interface is not None:

1752

1356

if SO_BINDTODEVICE is None:

1753

logger.error("SO_BINDTODEVICE does not exist;"

1754

" cannot bind to interface %s",

1357

logger.error(u"SO_BINDTODEVICE does not exist;"

1358

u" cannot bind to interface %s",

1755

1359

self.interface)

1756

1360

else:

1757

1361

try:

1758

1362

self.socket.setsockopt(socket.SOL_SOCKET,

1759

1363

SO_BINDTODEVICE,

1760

1364

str(self.interface

1761

+ '\0'))

1762

except socket.error as error:

1365

+ u'\0'))

1366

except socket.error, error:

1763

1367

if error[0] == errno.EPERM:

1764

logger.error("No permission to"

1765

" bind to interface %s",

1368

logger.error(u"No permission to"

1369

u" bind to interface %s",

1766

1370

self.interface)

1767

1371

elif error[0] == errno.ENOPROTOOPT:

1768

logger.error("SO_BINDTODEVICE not available;"

1769

" cannot bind to interface %s",

1372

logger.error(u"SO_BINDTODEVICE not available;"

1373

u" cannot bind to interface %s",

1770

1374

self.interface)

1771

1375

else:

1772

1376

raise

1774

1378

if self.server_address[0] or self.server_address[1]:

1775

1379

if not self.server_address[0]:

1776

1380

if self.address_family == socket.AF_INET6:

1777

any_address = "::" # in6addr_any

1381

any_address = u"::" # in6addr_any

1778

1382

else:

1779

1383

any_address = socket.INADDR_ANY

1780

1384

self.server_address = (any_address,

1807

1411

self.enabled = False

1808

1412

self.clients = clients

1809

1413

if self.clients is None:

1810

self.clients = {}

1414

self.clients = set()

1811

1415

self.use_dbus = use_dbus

1812

1416

self.gnutls_priority = gnutls_priority

1813

1417

IPv6_TCPServer.__init__(self, server_address,

1817

1421

def server_activate(self):

1818

1422

if self.enabled:

1819

1423

return socketserver.TCPServer.server_activate(self)

1820

1821

1424

def enable(self):

1822

1425

self.enabled = True

1823

1824

def add_pipe(self, parent_pipe, proc):

1426

def add_pipe(self, parent_pipe):

1825

1427

# Call "handle_ipc" for both data and EOF events

1826

1428

gobject.io_add_watch(parent_pipe.fileno(),

1827

1429

gobject.IO_IN | gobject.IO_HUP,

1828

1430

functools.partial(self.handle_ipc,

1829

parent_pipe =

1830

parent_pipe,

1831

proc = proc))

1832

1431

parent_pipe = parent_pipe))

1432

1833

1433

def handle_ipc(self, source, condition, parent_pipe=None,

1834

proc = None, client_object=None):

1434

client_object=None):

1835

1435

condition_names = {

1836

gobject.IO_IN: "IN", # There is data to read.

1837

gobject.IO_OUT: "OUT", # Data can be written (without

1436

gobject.IO_IN: u"IN", # There is data to read.

1437

gobject.IO_OUT: u"OUT", # Data can be written (without

1838

1438

# blocking).

1839

gobject.IO_PRI: "PRI", # There is urgent data to read.

1840

gobject.IO_ERR: "ERR", # Error condition.

1841

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1439

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1440

gobject.IO_ERR: u"ERR", # Error condition.

1441

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1842

1442

# broken, usually for pipes and

1843

1443

# sockets).

1844

1444

}

1846

1446

for cond, name in

1847

1447

condition_names.iteritems()

1848

1448

if cond & condition)

1849

# error, or the other end of multiprocessing.Pipe has closed

1850

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1851

# Wait for other process to exit

1852

proc.join()

1853

return False

1449

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1450

conditions_string)

1854

1451

1855

1452

# Read a request from the child

1856

1453

request = parent_pipe.recv()

1860

1457

fpr = request[1]

1861

1458

address = request[2]

1862

1459

1863

for c in self.clients.itervalues():

1460

for c in self.clients:

1864

1461

if c.fingerprint == fpr:

1865

1462

client = c

1866

1463

break

1867

1464

else:

1868

logger.info("Client not found for fingerprint: %s, ad"

1869

"dress: %s", fpr, address)

1465

logger.warning(u"Client not found for fingerprint: %s, ad"

1466

u"dress: %s", fpr, address)

1870

1467

if self.use_dbus:

1871

1468

# Emit D-Bus signal

1872

mandos_dbus_service.ClientNotFound(fpr,

1873

address[0])

1469

mandos_dbus_service.ClientNotFound(fpr, address)

1874

1470

parent_pipe.send(False)

1875

1471

return False

1876

1472

1877

1473

gobject.io_add_watch(parent_pipe.fileno(),

1878

1474

gobject.IO_IN | gobject.IO_HUP,

1879

1475

functools.partial(self.handle_ipc,

1880

parent_pipe =

1881

parent_pipe,

1882

proc = proc,

1883

client_object =

1884

client))

1476

parent_pipe = parent_pipe,

1477

client_object = client))

1885

1478

parent_pipe.send(True)

1886

# remove the old hook in favor of the new above hook on

1887

# same fileno

1479

# remove the old hook in favor of the new above hook on same fileno

1888

1480

return False

1889

1481

if command == 'funcall':

1890

1482

funcname = request[1]

1891

1483

args = request[2]

1892

1484

kwargs = request[3]

1893

1485

1894

parent_pipe.send(('data', getattr(client_object,

1895

funcname)(*args,

1896

**kwargs)))

1897

1486

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1487

1898

1488

if command == 'getattr':

1899

1489

attrname = request[1]

1900

1490

if callable(client_object.__getattribute__(attrname)):

1901

1491

parent_pipe.send(('function',))

1902

1492

else:

1903

parent_pipe.send(('data', client_object

1904

.__getattribute__(attrname)))

1905

1493

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1494

1906

1495

if command == 'setattr':

1907

1496

attrname = request[1]

1908

1497

value = request[2]

1909

1498

setattr(client_object, attrname, value)

1910

1499

1911

1500

return True

1912

1501

1913

1502

1914

1503

def string_to_delta(interval):

1915

1504

"""Parse a string and return a datetime.timedelta

1916

1505

1917

>>> string_to_delta('7d')

1506

>>> string_to_delta(u'7d')

1918

1507

datetime.timedelta(7)

1919

>>> string_to_delta('60s')

1508

>>> string_to_delta(u'60s')

1920

1509

datetime.timedelta(0, 60)

1921

>>> string_to_delta('60m')

1510

>>> string_to_delta(u'60m')

1922

1511

datetime.timedelta(0, 3600)

1923

>>> string_to_delta('24h')

1512

>>> string_to_delta(u'24h')

1924

1513

datetime.timedelta(1)

1925

>>> string_to_delta('1w')

1514

>>> string_to_delta(u'1w')

1926

1515

datetime.timedelta(7)

1927

>>> string_to_delta('5m 30s')

1516

>>> string_to_delta(u'5m 30s')

1928

1517

datetime.timedelta(0, 330)

1929

1518

"""

1930

1519

timevalue = datetime.timedelta(0)

1932

1521

try:

1933

1522

suffix = unicode(s[-1])

1934

1523

value = int(s[:-1])

1935

if suffix == "d":

1524

if suffix == u"d":

1936

1525

delta = datetime.timedelta(value)

1937

elif suffix == "s":

1526

elif suffix == u"s":

1938

1527

delta = datetime.timedelta(0, value)

1939

elif suffix == "m":

1528

elif suffix == u"m":

1940

1529

delta = datetime.timedelta(0, 0, 0, 0, value)

1941

elif suffix == "h":

1530

elif suffix == u"h":

1942

1531

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1943

elif suffix == "w":

1532

elif suffix == u"w":

1944

1533

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1945

1534

else:

1946

raise ValueError("Unknown suffix %r" % suffix)

1947

except (ValueError, IndexError) as e:

1948

raise ValueError(*(e.args))

1535

raise ValueError(u"Unknown suffix %r" % suffix)

1536

except (ValueError, IndexError), e:

1537

raise ValueError(e.message)

1949

1538

timevalue += delta

1950

1539

return timevalue

1951

1540

1952

1541

1542

def if_nametoindex(interface):

1543

"""Call the C function if_nametoindex(), or equivalent

1544

1545

Note: This function cannot accept a unicode string."""

1546

global if_nametoindex

1547

try:

1548

if_nametoindex = (ctypes.cdll.LoadLibrary

1549

(ctypes.util.find_library(u"c"))

1550

.if_nametoindex)

1551

except (OSError, AttributeError):

1552

logger.warning(u"Doing if_nametoindex the hard way")

1553

def if_nametoindex(interface):

1554

"Get an interface index the hard way, i.e. using fcntl()"

1555

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1556

with contextlib.closing(socket.socket()) as s:

1557

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1558

struct.pack(str(u"16s16x"),

1559

interface))

1560

interface_index = struct.unpack(str(u"I"),

1561

ifreq[16:20])[0]

1562

return interface_index

1563

return if_nametoindex(interface)

1564

1565

1953

1566

def daemon(nochdir = False, noclose = False):

1954

1567

"""See daemon(3). Standard BSD Unix function.

1955

1568

1958

1571

sys.exit()

1959

1572

os.setsid()

1960

1573

if not nochdir:

1961

os.chdir("/")

1574

os.chdir(u"/")

1962

1575

if os.fork():

1963

1576

sys.exit()

1964

1577

if not noclose:

1966

1579

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1967

1580

if not stat.S_ISCHR(os.fstat(null).st_mode):

1968

1581

raise OSError(errno.ENODEV,

1969

"%s not a character device"

1582

u"%s not a character device"

1970

1583

% os.path.devnull)

1971

1584

os.dup2(null, sys.stdin.fileno())

1972

1585

os.dup2(null, sys.stdout.fileno())

1980

1593

##################################################################

1981

1594

# Parsing of options, both command line and config file

1982

1595

1983

parser = argparse.ArgumentParser()

1984

parser.add_argument("-v", "--version", action="version",

1985

version = "%%(prog)s %s" % version,

1986

help="show version number and exit")

1987

parser.add_argument("-i", "--interface", metavar="IF",

1988

help="Bind to interface IF")

1989

parser.add_argument("-a", "--address",

1990

help="Address to listen for requests on")

1991

parser.add_argument("-p", "--port", type=int,

1992

help="Port number to receive requests on")

1993

parser.add_argument("--check", action="store_true",

1994

help="Run self-test")

1995

parser.add_argument("--debug", action="store_true",

1996

help="Debug mode; run in foreground and log"

1997

" to terminal")

1998

parser.add_argument("--debuglevel", metavar="LEVEL",

1999

help="Debug level for stdout output")

2000

parser.add_argument("--priority", help="GnuTLS"

2001

" priority string (see GnuTLS documentation)")

2002

parser.add_argument("--servicename",

2003

metavar="NAME", help="Zeroconf service name")

2004

parser.add_argument("--configdir",

2005

default="/etc/mandos", metavar="DIR",

2006

help="Directory to search for configuration"

2007

" files")

2008

parser.add_argument("--no-dbus", action="store_false",

2009

dest="use_dbus", help="Do not provide D-Bus"

2010

" system bus interface")

2011

parser.add_argument("--no-ipv6", action="store_false",

2012

dest="use_ipv6", help="Do not use IPv6")

2013

parser.add_argument("--no-restore", action="store_false",

2014

dest="restore", help="Do not restore stored"

2015

" state")

2016

parser.add_argument("--statedir", metavar="DIR",

2017

help="Directory to save/restore state in")

2018

2019

options = parser.parse_args()

1596

parser = optparse.OptionParser(version = "%%prog %s" % version)

1597

parser.add_option("-i", u"--interface", type=u"string",

1598

metavar="IF", help=u"Bind to interface IF")

1599

parser.add_option("-a", u"--address", type=u"string",

1600

help=u"Address to listen for requests on")

1601

parser.add_option("-p", u"--port", type=u"int",

1602

help=u"Port number to receive requests on")

1603

parser.add_option("--check", action=u"store_true",

1604

help=u"Run self-test")

1605

parser.add_option("--debug", action=u"store_true",

1606

help=u"Debug mode; run in foreground and log to"

1607

u" terminal")

1608

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1609

u" priority string (see GnuTLS documentation)")

1610

parser.add_option("--servicename", type=u"string",

1611

metavar=u"NAME", help=u"Zeroconf service name")

1612

parser.add_option("--configdir", type=u"string",

1613

default=u"/etc/mandos", metavar=u"DIR",

1614

help=u"Directory to search for configuration"

1615

u" files")

1616

parser.add_option("--no-dbus", action=u"store_false",

1617

dest=u"use_dbus", help=u"Do not provide D-Bus"

1618

u" system bus interface")

1619

parser.add_option("--no-ipv6", action=u"store_false",

1620

dest=u"use_ipv6", help=u"Do not use IPv6")

1621

options = parser.parse_args()[0]

2020

1622

2021

1623

if options.check:

2022

1624

import doctest

2024

1626

sys.exit()

2025

1627

2026

1628

# Default values for config file for server-global settings

2027

server_defaults = { "interface": "",

2028

"address": "",

2029

"port": "",

2030

"debug": "False",

2031

"priority":

2032

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2033

"servicename": "Mandos",

2034

"use_dbus": "True",

2035

"use_ipv6": "True",

2036

"debuglevel": "",

2037

"restore": "True",

2038

"statedir": "/var/lib/mandos"

1629

server_defaults = { u"interface": u"",

1630

u"address": u"",

1631

u"port": u"",

1632

u"debug": u"False",

1633

u"priority":

1634

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1635

u"servicename": u"Mandos",

1636

u"use_dbus": u"True",

1637

u"use_ipv6": u"True",

2039

1638

}

2040

1639

2041

1640

# Parse config file for server-global settings

2042

1641

server_config = configparser.SafeConfigParser(server_defaults)

2043

1642

del server_defaults

2044

1643

server_config.read(os.path.join(options.configdir,

2045

"mandos.conf"))

1644

u"mandos.conf"))

2046

1645

# Convert the SafeConfigParser object to a dict

2047

1646

server_settings = server_config.defaults()

2048

1647

# Use the appropriate methods on the non-string config options

2049

for option in ("debug", "use_dbus", "use_ipv6"):

2050

server_settings[option] = server_config.getboolean("DEFAULT",

1648

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1649

server_settings[option] = server_config.getboolean(u"DEFAULT",

2051

1650

option)

2052

1651

if server_settings["port"]:

2053

server_settings["port"] = server_config.getint("DEFAULT",

2054

"port")

1652

server_settings["port"] = server_config.getint(u"DEFAULT",

1653

u"port")

2055

1654

del server_config

2056

1655

2057

1656

# Override the settings from the config file with command line

2058

1657

# options, if set.

2059

for option in ("interface", "address", "port", "debug",

2060

"priority", "servicename", "configdir",

2061

"use_dbus", "use_ipv6", "debuglevel", "restore",

2062

"statedir"):

1658

for option in (u"interface", u"address", u"port", u"debug",

1659

u"priority", u"servicename", u"configdir",

1660

u"use_dbus", u"use_ipv6"):

2063

1661

value = getattr(options, option)

2064

1662

if value is not None:

2065

1663

server_settings[option] = value

2073

1671

##################################################################

2074

1672

2075

1673

# For convenience

2076

debug = server_settings["debug"]

2077

debuglevel = server_settings["debuglevel"]

2078

use_dbus = server_settings["use_dbus"]

2079

use_ipv6 = server_settings["use_ipv6"]

2080

stored_state_path = os.path.join(server_settings["statedir"],

2081

stored_state_file)

2082

2083

if debug:

2084

initlogger(debug, logging.DEBUG)

2085

else:

2086

if not debuglevel:

2087

initlogger(debug)

2088

else:

2089

level = getattr(logging, debuglevel.upper())

2090

initlogger(debug, level)

2091

2092

if server_settings["servicename"] != "Mandos":

1674

debug = server_settings[u"debug"]

1675

use_dbus = server_settings[u"use_dbus"]

1676

use_ipv6 = server_settings[u"use_ipv6"]

1677

1678

if not debug:

1679

syslogger.setLevel(logging.WARNING)

1680

console.setLevel(logging.WARNING)

1681

1682

if server_settings[u"servicename"] != u"Mandos":

2093

1683

syslogger.setFormatter(logging.Formatter

2094

('Mandos (%s) [%%(process)d]:'

2095

' %%(levelname)s: %%(message)s'

2096

% server_settings["servicename"]))

1684

(u'Mandos (%s) [%%(process)d]:'

1685

u' %%(levelname)s: %%(message)s'

1686

% server_settings[u"servicename"]))

2097

1687

2098

1688

# Parse config file with clients

2099

client_config = configparser.SafeConfigParser(Client

2100

.client_defaults)

2101

client_config.read(os.path.join(server_settings["configdir"],

2102

"clients.conf"))

1689

client_defaults = { u"timeout": u"1h",

1690

u"interval": u"5m",

1691

u"checker": u"fping -q -- %%(host)s",

1692

u"host": u"",

1693

u"approved_delay": u"0s",

1694

u"approved_duration": u"1s",

1695

}

1696

client_config = configparser.SafeConfigParser(client_defaults)

1697

client_config.read(os.path.join(server_settings[u"configdir"],

1698

u"clients.conf"))

2103

1699

2104

1700

global mandos_dbus_service

2105

1701

mandos_dbus_service = None

2106

1702

2107

tcp_server = MandosServer((server_settings["address"],

2108

server_settings["port"]),

1703

tcp_server = MandosServer((server_settings[u"address"],

1704

server_settings[u"port"]),

2109

1705

ClientHandler,

2110

interface=(server_settings["interface"]

2111

or None),

1706

interface=server_settings[u"interface"],

2112

1707

use_ipv6=use_ipv6,

2113

1708

gnutls_priority=

2114

server_settings["priority"],

1709

server_settings[u"priority"],

2115

1710

use_dbus=use_dbus)

2116

if not debug:

2117

pidfilename = "/var/run/mandos.pid"

2118

try:

2119

pidfile = open(pidfilename, "w")

2120

except IOError:

2121

logger.error("Could not open file %r", pidfilename)

1711

pidfilename = u"/var/run/mandos.pid"

1712

try:

1713

pidfile = open(pidfilename, u"w")

1714

except IOError:

1715

logger.error(u"Could not open file %r", pidfilename)

2122

1716

2123

1717

try:

2124

uid = pwd.getpwnam("_mandos").pw_uid

2125

gid = pwd.getpwnam("_mandos").pw_gid

1718

uid = pwd.getpwnam(u"_mandos").pw_uid

1719

gid = pwd.getpwnam(u"_mandos").pw_gid

2126

1720

except KeyError:

2127

1721

try:

2128

uid = pwd.getpwnam("mandos").pw_uid

2129

gid = pwd.getpwnam("mandos").pw_gid

1722

uid = pwd.getpwnam(u"mandos").pw_uid

1723

gid = pwd.getpwnam(u"mandos").pw_gid

2130

1724

except KeyError:

2131

1725

try:

2132

uid = pwd.getpwnam("nobody").pw_uid

2133

gid = pwd.getpwnam("nobody").pw_gid

1726

uid = pwd.getpwnam(u"nobody").pw_uid

1727

gid = pwd.getpwnam(u"nobody").pw_gid

2134

1728

except KeyError:

2135

1729

uid = 65534

2136

1730

gid = 65534

2137

1731

try:

2138

1732

os.setgid(gid)

2139

1733

os.setuid(uid)

2140

except OSError as error:

1734

except OSError, error:

2141

1735

if error[0] != errno.EPERM:

2142

1736

raise error

2143

1737

1738

# Enable all possible GnuTLS debugging

2144

1739

if debug:

2145

# Enable all possible GnuTLS debugging

2146

2147

1740

# "Use a log level over 10 to enable all debugging options."

2148

1741

# - GnuTLS manual

2149

1742

gnutls.library.functions.gnutls_global_set_log_level(11)

2150

1743

2151

1744

@gnutls.library.types.gnutls_log_func

2152

1745

def debug_gnutls(level, string):

2153

logger.debug("GnuTLS: %s", string[:-1])

1746

logger.debug(u"GnuTLS: %s", string[:-1])

2154

1747

2155

1748

(gnutls.library.functions

2156

1749

.gnutls_global_set_log_function(debug_gnutls))

2157

2158

# Redirect stdin so all checkers get /dev/null

2159

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2160

os.dup2(null, sys.stdin.fileno())

2161

if null > 2:

2162

os.close(null)

2163

2164

# Need to fork before connecting to D-Bus

2165

if not debug:

2166

# Close all input and output, do double fork, etc.

2167

daemon()

2168

2169

gobject.threads_init()

2170

1750

2171

1751

global main_loop

2172

1752

# From the Avahi example code

2176

1756

# End of Avahi example code

2177

1757

if use_dbus:

2178

1758

try:

2179

bus_name = dbus.service.BusName("se.recompile.Mandos",

1759

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2180

1760

bus, do_not_queue=True)

2181

old_bus_name = (dbus.service.BusName

2182

("se.bsnet.fukt.Mandos", bus,

2183

do_not_queue=True))

2184

except dbus.exceptions.NameExistsException as e:

2185

logger.error(unicode(e) + ", disabling D-Bus")

1761

except dbus.exceptions.NameExistsException, e:

1762

logger.error(unicode(e) + u", disabling D-Bus")

2186

1763

use_dbus = False

2187

server_settings["use_dbus"] = False

1764

server_settings[u"use_dbus"] = False

2188

1765

tcp_server.use_dbus = False

2189

1766

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2190

service = AvahiServiceToSyslog(name =

2191

server_settings["servicename"],

2192

servicetype = "_mandos._tcp",

2193

protocol = protocol, bus = bus)

1767

service = AvahiService(name = server_settings[u"servicename"],

1768

servicetype = u"_mandos._tcp",

1769

protocol = protocol, bus = bus)

2194

1770

if server_settings["interface"]:

2195

1771

service.interface = (if_nametoindex

2196

(str(server_settings["interface"])))

2197

2198

global multiprocessing_manager

2199

multiprocessing_manager = multiprocessing.Manager()

1772

(str(server_settings[u"interface"])))

2200

1773

2201

1774

client_class = Client

2202

1775

if use_dbus:

2203

client_class = functools.partial(ClientDBusTransitional,

2204

bus = bus)

2205

2206

client_settings = Client.config_parser(client_config)

2207

old_client_settings = {}

2208

clients_data = {}

2209

2210

# Get client data and settings from last running state.

2211

if server_settings["restore"]:

2212

try:

2213

with open(stored_state_path, "rb") as stored_state:

2214

clients_data, old_client_settings = (pickle.load

2215

(stored_state))

2216

os.remove(stored_state_path)

2217

except IOError as e:

2218

logger.warning("Could not load persistent state: {0}"

2219

.format(e))

2220

if e.errno != errno.ENOENT:

2221

raise

2222

except EOFError as e:

2223

logger.warning("Could not load persistent state: "

2224

"EOFError: {0}".format(e))

2225

2226

with PGPEngine() as pgp:

2227

for client_name, client in clients_data.iteritems():

2228

# Decide which value to use after restoring saved state.

2229

# We have three different values: Old config file,

2230

# new config file, and saved state.

2231

# New config value takes precedence if it differs from old

2232

# config value, otherwise use saved state.

2233

for name, value in client_settings[client_name].items():

2234

try:

2235

# For each value in new config, check if it

2236

# differs from the old config value (Except for

2237

# the "secret" attribute)

2238

if (name != "secret" and

2239

value != old_client_settings[client_name]

2240

[name]):

2241

client[name] = value

2242

except KeyError:

2243

pass

2244

2245

# Clients who has passed its expire date can still be

2246

# enabled if its last checker was successful. Clients

2247

# whose checker succeeded before we stored its state is

2248

# assumed to have successfully run all checkers during

2249

# downtime.

2250

if client["enabled"]:

2251

if datetime.datetime.utcnow() >= client["expires"]:

2252

if not client["last_checked_ok"]:

2253

logger.warning(

2254

"disabling client {0} - Client never "

2255

"performed a successful checker"

2256

.format(client_name))

2257

client["enabled"] = False

2258

elif client["last_checker_status"] != 0:

2259

logger.warning(

2260

"disabling client {0} - Client "

2261

"last checker failed with error code {1}"

2262

.format(client_name,

2263

client["last_checker_status"]))

2264

client["enabled"] = False

2265

else:

2266

client["expires"] = (datetime.datetime

2267

.utcnow()

2268

+ client["timeout"])

2269

logger.debug("Last checker succeeded,"

2270

" keeping {0} enabled"

2271

.format(client_name))

1776

client_class = functools.partial(ClientDBus, bus = bus)

1777

def client_config_items(config, section):

1778

special_settings = {

1779

"approved_by_default":

1780

lambda: config.getboolean(section,

1781

"approved_by_default"),

1782

}

1783

for name, value in config.items(section):

2272

1784

try:

2273

client["secret"] = (

2274

pgp.decrypt(client["encrypted_secret"],

2275

client_settings[client_name]

2276

["secret"]))

2277

except PGPError:

2278

# If decryption fails, we use secret from new settings

2279

logger.debug("Failed to decrypt {0} old secret"

2280

.format(client_name))

2281

client["secret"] = (

2282

client_settings[client_name]["secret"])

2283

2284

2285

# Add/remove clients based on new changes made to config

2286

for client_name in (set(old_client_settings)

2287

- set(client_settings)):

2288

del clients_data[client_name]

2289

for client_name in (set(client_settings)

2290

- set(old_client_settings)):

2291

clients_data[client_name] = client_settings[client_name]

2292

2293

# Create all client objects

2294

for client_name, client in clients_data.iteritems():

2295

tcp_server.clients[client_name] = client_class(

2296

name = client_name, settings = client)

2297

1785

yield (name, special_settings[name]())

1786

except KeyError:

1787

yield (name, value)

1788

1789

tcp_server.clients.update(set(

1790

client_class(name = section,

1791

config= dict(client_config_items(

1792

client_config, section)))

1793

for section in client_config.sections()))

2298

1794

if not tcp_server.clients:

2299

logger.warning("No clients defined")

2300

1795

logger.warning(u"No clients defined")

1796

1797

if debug:

1798

# Redirect stdin so all checkers get /dev/null

1799

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1800

os.dup2(null, sys.stdin.fileno())

1801

if null > 2:

1802

os.close(null)

1803

else:

1804

# No console logging

1805

logger.removeHandler(console)

1806

# Close all input and output, do double fork, etc.

1807

daemon()

1808

1809

try:

1810

with pidfile:

1811

pid = os.getpid()

1812

pidfile.write(str(pid) + "\n")

1813

del pidfile

1814

except IOError:

1815

logger.error(u"Could not write to file %r with PID %d",

1816

pidfilename, pid)

1817

except NameError:

1818

# "pidfile" was never created

1819

pass

1820

del pidfilename

1821

2301

1822

if not debug:

2302

try:

2303

with pidfile:

2304

pid = os.getpid()

2305

pidfile.write(str(pid) + "\n".encode("utf-8"))

2306

del pidfile

2307

except IOError:

2308

logger.error("Could not write to file %r with PID %d",

2309

pidfilename, pid)

2310

except NameError:

2311

# "pidfile" was never created

2312

pass

2313

del pidfilename

2314

1823

signal.signal(signal.SIGINT, signal.SIG_IGN)

2315

2316

1824

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2317

1825

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2318

1826

2320

1828

class MandosDBusService(dbus.service.Object):

2321

1829

"""A D-Bus proxy object"""

2322

1830

def __init__(self):

2323

dbus.service.Object.__init__(self, bus, "/")

2324

_interface = "se.recompile.Mandos"

1831

dbus.service.Object.__init__(self, bus, u"/")

1832

_interface = u"se.bsnet.fukt.Mandos"

2325

1833

2326

@dbus.service.signal(_interface, signature="o")

1834

@dbus.service.signal(_interface, signature=u"o")

2327

1835

def ClientAdded(self, objpath):

2328

1836

"D-Bus signal"

2329

1837

pass

2330

1838

2331

@dbus.service.signal(_interface, signature="ss")

1839

@dbus.service.signal(_interface, signature=u"ss")

2332

1840

def ClientNotFound(self, fingerprint, address):

2333

1841

"D-Bus signal"

2334

1842

pass

2335

1843

2336

@dbus.service.signal(_interface, signature="os")

1844

@dbus.service.signal(_interface, signature=u"os")

2337

1845

def ClientRemoved(self, objpath, name):

2338

1846

"D-Bus signal"

2339

1847

pass

2340

1848

2341

@dbus.service.method(_interface, out_signature="ao")

1849

@dbus.service.method(_interface, out_signature=u"ao")

2342

1850

def GetAllClients(self):

2343

1851

"D-Bus method"

2344

1852

return dbus.Array(c.dbus_object_path

2345

for c in

2346

tcp_server.clients.itervalues())

1853

for c in tcp_server.clients)

2347

1854

2348

1855

@dbus.service.method(_interface,

2349

out_signature="a{oa{sv}}")

1856

out_signature=u"a{oa{sv}}")

2350

1857

def GetAllClientsWithProperties(self):

2351

1858

"D-Bus method"

2352

1859

return dbus.Dictionary(

2353

((c.dbus_object_path, c.GetAll(""))

2354

for c in tcp_server.clients.itervalues()),

2355

signature="oa{sv}")

1860

((c.dbus_object_path, c.GetAll(u""))

1861

for c in tcp_server.clients),

1862

signature=u"oa{sv}")

2356

1863

2357

@dbus.service.method(_interface, in_signature="o")

1864

@dbus.service.method(_interface, in_signature=u"o")

2358

1865

def RemoveClient(self, object_path):

2359

1866

"D-Bus method"

2360

for c in tcp_server.clients.itervalues():

1867

for c in tcp_server.clients:

2361

1868

if c.dbus_object_path == object_path:

2362

del tcp_server.clients[c.name]

1869

tcp_server.clients.remove(c)

2363

1870

c.remove_from_connection()

2364

1871

# Don't signal anything except ClientRemoved

2365

1872

c.disable(quiet=True)

2370

1877

2371

1878

del _interface

2372

1879

2373

class MandosDBusServiceTransitional(MandosDBusService):

2374

__metaclass__ = AlternateDBusNamesMetaclass

2375

mandos_dbus_service = MandosDBusServiceTransitional()

1880

mandos_dbus_service = MandosDBusService()

2376

1881

2377

1882

def cleanup():

2378

1883

"Cleanup function; run on exit"

2379

1884

service.cleanup()

2380

1885

2381

multiprocessing.active_children()

2382

if not (tcp_server.clients or client_settings):

2383

return

2384

2385

# Store client before exiting. Secrets are encrypted with key

2386

# based on what config file has. If config file is

2387

# removed/edited, old secret will thus be unrecovable.

2388

clients = {}

2389

with PGPEngine() as pgp:

2390

for client in tcp_server.clients.itervalues():

2391

key = client_settings[client.name]["secret"]

2392

client.encrypted_secret = pgp.encrypt(client.secret,

2393

key)

2394

client_dict = {}

2395

2396

# A list of attributes that can not be pickled

2397

# + secret.

2398

exclude = set(("bus", "changedstate", "secret",

2399

"checker"))

2400

for name, typ in (inspect.getmembers

2401

(dbus.service.Object)):

2402

exclude.add(name)

2403

2404

client_dict["encrypted_secret"] = (client

2405

.encrypted_secret)

2406

for attr in client.client_structure:

2407

if attr not in exclude:

2408

client_dict[attr] = getattr(client, attr)

2409

2410

clients[client.name] = client_dict

2411

del client_settings[client.name]["secret"]

2412

2413

try:

2414

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2415

prefix="clients-",

2416

dir=os.path.dirname

2417

(stored_state_path))

2418

with os.fdopen(tempfd, "wb") as stored_state:

2419

pickle.dump((clients, client_settings), stored_state)

2420

os.rename(tempname, stored_state_path)

2421

except (IOError, OSError) as e:

2422

logger.warning("Could not save persistent state: {0}"

2423

.format(e))

2424

if not debug:

2425

try:

2426

os.remove(tempname)

2427

except NameError:

2428

pass

2429

if e.errno not in set((errno.ENOENT, errno.EACCES,

2430

errno.EEXIST)):

2431

raise e

2432

2433

# Delete all clients, and settings from config

2434

1886

while tcp_server.clients:

2435

name, client = tcp_server.clients.popitem()

1887

client = tcp_server.clients.pop()

2436

1888

if use_dbus:

2437

1889

client.remove_from_connection()

1890

client.disable_hook = None

2438

1891

# Don't signal anything except ClientRemoved

2439

1892

client.disable(quiet=True)

2440

1893

if use_dbus:

2441

1894

# Emit D-Bus signal

2442

mandos_dbus_service.ClientRemoved(client

2443

.dbus_object_path,

1895

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2444

1896

client.name)

2445

client_settings.clear()

2446

1897

2447

1898

atexit.register(cleanup)

2448

1899

2449

for client in tcp_server.clients.itervalues():

1900

for client in tcp_server.clients:

2450

1901

if use_dbus:

2451

1902

# Emit D-Bus signal

2452

1903

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2453

# Need to initiate checking of clients

2454

if client.enabled:

2455

client.init_checker()

1904

client.enable()

2456

1905

2457

1906

tcp_server.enable()

2458

1907

tcp_server.server_activate()

2460

1909

# Find out what port we got

2461

1910

service.port = tcp_server.socket.getsockname()[1]

2462

1911

if use_ipv6:

2463

logger.info("Now listening on address %r, port %d,"

1912

logger.info(u"Now listening on address %r, port %d,"

2464

1913

" flowinfo %d, scope_id %d"

2465

1914

% tcp_server.socket.getsockname())

2466

1915

else: # IPv4

2467

logger.info("Now listening on address %r, port %d"

1916

logger.info(u"Now listening on address %r, port %d"

2468

1917

% tcp_server.socket.getsockname())

2469

1918

2470

1919

#service.interface = tcp_server.socket.getsockname()[3]

2473

1922

# From the Avahi example code

2474

1923

try:

2475

1924

service.activate()

2476

except dbus.exceptions.DBusException as error:

2477

logger.critical("DBusException: %s", error)

1925

except dbus.exceptions.DBusException, error:

1926

logger.critical(u"DBusException: %s", error)

2478

1927

cleanup()

2479

1928

sys.exit(1)

2480

1929

# End of Avahi example code

2484

1933

(tcp_server.handle_request

2485

1934

(*args[2:], **kwargs) or True))

2486

1935

2487

logger.debug("Starting main loop")

1936

logger.debug(u"Starting main loop")

2488

1937

main_loop.run()

2489

except AvahiError as error:

2490

logger.critical("AvahiError: %s", error)

1938

except AvahiError, error:

1939

logger.critical(u"AvahiError: %s", error)

2491

1940

cleanup()

2492

1941

sys.exit(1)

2493

1942

except KeyboardInterrupt:

2494

1943

if debug:

2495

print("", file=sys.stderr)

2496

logger.debug("Server received KeyboardInterrupt")

2497

logger.debug("Server exiting")

1944

print >> sys.stderr

1945

logger.debug(u"Server received KeyboardInterrupt")

1946

logger.debug(u"Server exiting")

2498

1947

# Must run before the D-Bus bus name gets deregistered

2499

1948

cleanup()

2500

1949