/mandos/trunk : revision 24.2.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

64

69

65

import dbus

70

66

import dbus.service

75

71

import ctypes.util

76

72

import xml.dom.minidom

77

73

import inspect

78

import GnuPGInterface

79

74

80

75

try:

81

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

80

except ImportError:

86

81

SO_BINDTODEVICE = None

87

82

88

version = "1.4.1"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

83

84

version = "1.0.14"

85

86

logger = logging.Logger(u'mandos')

92

87

syslogger = (logging.handlers.SysLogHandler

93

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet'])

146

147

def __enter__(self):

148

return self

149

150

def __exit__ (self, exc_type, exc_value, traceback):

151

self._cleanup()

152

return False

153

154

def __del__(self):

155

self._cleanup()

156

157

def _cleanup(self):

158

if self.tempdir is not None:

159

# Delete contents of tempdir

160

for root, dirs, files in os.walk(self.tempdir,

161

topdown = False):

162

for filename in files:

163

os.remove(os.path.join(root, filename))

164

for dirname in dirs:

165

os.rmdir(os.path.join(root, dirname))

166

# Remove tempdir

167

os.rmdir(self.tempdir)

168

self.tempdir = None

169

170

def password_encode(self, password):

171

# Passphrase can not be empty and can not contain newlines or

172

# NUL bytes. So we prefix it and hex encode it.

173

return b"mandos" + binascii.hexlify(password)

174

175

def encrypt(self, data, password):

176

self.gnupg.passphrase = self.password_encode(password)

177

with open(os.devnull) as devnull:

178

try:

179

proc = self.gnupg.run(['--symmetric'],

180

create_fhs=['stdin', 'stdout'],

181

attach_fhs={'stderr': devnull})

182

with contextlib.closing(proc.handles['stdin']) as f:

183

f.write(data)

184

with contextlib.closing(proc.handles['stdout']) as f:

185

ciphertext = f.read()

186

proc.wait()

187

except IOError as e:

188

raise PGPError(e)

189

self.gnupg.passphrase = None

190

return ciphertext

191

192

def decrypt(self, data, password):

193

self.gnupg.passphrase = self.password_encode(password)

194

with open(os.devnull) as devnull:

195

try:

196

proc = self.gnupg.run(['--decrypt'],

197

create_fhs=['stdin', 'stdout'],

198

attach_fhs={'stderr': devnull})

199

with contextlib.closing(proc.handles['stdin'] ) as f:

200

f.write(data)

201

with contextlib.closing(proc.handles['stdout']) as f:

202

decrypted_plaintext = f.read()

203

proc.wait()

204

except IOError as e:

205

raise PGPError(e)

206

self.gnupg.passphrase = None

207

return decrypted_plaintext

208

209

89

address = "/dev/log"))

90

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

93

logger.addHandler(syslogger)

94

95

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

logger.addHandler(console)

100

101

multiprocessing_manager = multiprocessing.Manager()

210

102

211

103

class AvahiError(Exception):

212

104

def __init__(self, value, *args, **kwargs):

228

120

Attributes:

229

121

interface: integer; avahi.IF_UNSPEC or an interface index.

230

122

Used to optionally bind to the specified interface.

231

232

type: string; Example: '_mandos._tcp'.

123

124

type: string; Example: u'_mandos._tcp'.

233

125

See <http://www.dns-sd.org/ServiceTypes.html>

234

126

port: integer; what port to announce

235

127

TXT: list of strings; TXT record for the service

244

136

"""

245

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

246

138

servicetype = None, port = None, TXT = None,

247

domain = "", host = "", max_renames = 32768,

139

domain = u"", host = u"", max_renames = 32768,

248

140

protocol = avahi.PROTO_UNSPEC, bus = None):

249

141

self.interface = interface

250

142

self.name = name

259

151

self.group = None # our entry group

260

152

self.server = None

261

153

self.bus = bus

262

self.entry_group_state_changed_match = None

263

154

def rename(self):

264

155

"""Derived from the Avahi example code"""

265

156

if self.rename_count >= self.max_renames:

266

logger.critical("No suitable Zeroconf service name found"

267

" after %i retries, exiting.",

157

logger.critical(u"No suitable Zeroconf service name found"

158

u" after %i retries, exiting.",

268

159

self.rename_count)

269

raise AvahiServiceError("Too many renames")

270

self.name = unicode(self.server

271

.GetAlternativeServiceName(self.name))

272

logger.info("Changing Zeroconf service name to %r ...",

273

self.name)

160

raise AvahiServiceError(u"Too many renames")

161

self.name = self.server.GetAlternativeServiceName(self.name)

162

logger.info(u"Changing Zeroconf service name to %r ...",

163

unicode(self.name))

164

syslogger.setFormatter(logging.Formatter

165

(u'Mandos (%s) [%%(process)d]:'

166

u' %%(levelname)s: %%(message)s'

167

% self.name))

274

168

self.remove()

275

try:

276

self.add()

277

except dbus.exceptions.DBusException as error:

278

logger.critical("DBusException: %s", error)

279

self.cleanup()

280

os._exit(1)

169

self.add()

281

170

self.rename_count += 1

282

171

def remove(self):

283

172

"""Derived from the Avahi example code"""

284

if self.entry_group_state_changed_match is not None:

285

self.entry_group_state_changed_match.remove()

286

self.entry_group_state_changed_match = None

287

173

if self.group is not None:

288

174

self.group.Reset()

289

175

def add(self):

290

176

"""Derived from the Avahi example code"""

291

self.remove()

292

177

if self.group is None:

293

178

self.group = dbus.Interface(

294

179

self.bus.get_object(avahi.DBUS_NAME,

295

180

self.server.EntryGroupNew()),

296

181

avahi.DBUS_INTERFACE_ENTRY_GROUP)

297

self.entry_group_state_changed_match = (

298

self.group.connect_to_signal(

299

'StateChanged', self.entry_group_state_changed))

300

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

self.group.connect_to_signal('StateChanged',

183

self

184

.entry_group_state_changed)

185

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

301

186

self.name, self.type)

302

187

self.group.AddService(

303

188

self.interface,

310

195

self.group.Commit()

311

196

def entry_group_state_changed(self, state, error):

312

197

"""Derived from the Avahi example code"""

313

logger.debug("Avahi entry group state change: %i", state)

198

logger.debug(u"Avahi state change: %i", state)

314

199

315

200

if state == avahi.ENTRY_GROUP_ESTABLISHED:

316

logger.debug("Zeroconf service established.")

201

logger.debug(u"Zeroconf service established.")

317

202

elif state == avahi.ENTRY_GROUP_COLLISION:

318

logger.info("Zeroconf service name collision.")

203

logger.warning(u"Zeroconf service name collision.")

319

204

self.rename()

320

205

elif state == avahi.ENTRY_GROUP_FAILURE:

321

logger.critical("Avahi: Error in group state changed %s",

206

logger.critical(u"Avahi: Error in group state changed %s",

322

207

unicode(error))

323

raise AvahiGroupError("State changed: %s"

208

raise AvahiGroupError(u"State changed: %s"

324

209

% unicode(error))

325

210

def cleanup(self):

326

211

"""Derived from the Avahi example code"""

327

212

if self.group is not None:

328

try:

329

self.group.Free()

330

except (dbus.exceptions.UnknownMethodException,

331

dbus.exceptions.DBusException):

332

pass

213

self.group.Free()

333

214

self.group = None

334

self.remove()

335

def server_state_changed(self, state, error=None):

215

def server_state_changed(self, state):

336

216

"""Derived from the Avahi example code"""

337

logger.debug("Avahi server state change: %i", state)

338

bad_states = { avahi.SERVER_INVALID:

339

"Zeroconf server invalid",

340

avahi.SERVER_REGISTERING: None,

341

avahi.SERVER_COLLISION:

342

"Zeroconf server name collision",

343

avahi.SERVER_FAILURE:

344

"Zeroconf server failure" }

345

if state in bad_states:

346

if bad_states[state] is not None:

347

if error is None:

348

logger.error(bad_states[state])

349

else:

350

logger.error(bad_states[state] + ": %r", error)

351

self.cleanup()

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

352

220

elif state == avahi.SERVER_RUNNING:

353

221

self.add()

354

else:

355

if error is None:

356

logger.debug("Unknown state: %r", state)

357

else:

358

logger.debug("Unknown state: %r: %r", state, error)

359

222

def activate(self):

360

223

"""Derived from the Avahi example code"""

361

224

if self.server is None:

362

225

self.server = dbus.Interface(

363

226

self.bus.get_object(avahi.DBUS_NAME,

364

avahi.DBUS_PATH_SERVER,

365

follow_name_owner_changes=True),

227

avahi.DBUS_PATH_SERVER),

366

228

avahi.DBUS_INTERFACE_SERVER)

367

self.server.connect_to_signal("StateChanged",

229

self.server.connect_to_signal(u"StateChanged",

368

230

self.server_state_changed)

369

231

self.server_state_changed(self.server.GetState())

370

232

371

class AvahiServiceToSyslog(AvahiService):

372

def rename(self):

373

"""Add the new name to the syslog messages"""

374

ret = AvahiService.rename(self)

375

syslogger.setFormatter(logging.Formatter

376

('Mandos (%s) [%%(process)d]:'

377

' %%(levelname)s: %%(message)s'

378

% self.name))

379

return ret

380

233

381

def timedelta_to_milliseconds(td):

382

"Convert a datetime.timedelta() to milliseconds"

383

return ((td.days * 24 * 60 * 60 * 1000)

384

+ (td.seconds * 1000)

385

+ (td.microseconds // 1000))

386

387

234

class Client(object):

388

235

"""A representation of a client host served by this server.

389

236

390

237

Attributes:

391

approved: bool(); 'None' if not yet approved/disapproved

392

approval_delay: datetime.timedelta(); Time to wait for approval

393

approval_duration: datetime.timedelta(); Duration of one approval

238

239

D-Bus identifiers

240

fingerprint: string (40 or 32 hexadecimal digits); used to

241

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

245

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

248

timeout: datetime.timedelta(); How long from last_checked_ok

249

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

394

252

checker: subprocess.Popen(); a running checker process used

395

253

to see if the client lives.

396

254

'None' if no process is running.

397

checker_callback_tag: a gobject event source tag, or None

398

checker_command: string; External command which is run to check

399

if client lives. %() expansions are done at

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

400

260

runtime with vars(self) as dict, so that for

401

261

instance %(name)s can be used in the command.

402

checker_initiator_tag: a gobject event source tag, or None

403

created: datetime.datetime(); (UTC) object creation

404

client_structure: Object describing what attributes a client has

405

and is used for storing the client at exit

406

262

current_checker_command: string; current running checker_command

407

disable_initiator_tag: a gobject event source tag, or None

408

enabled: bool()

409

fingerprint: string (40 or 32 hexadecimal digits); used to

410

uniquely identify the client

411

host: string; available for use by the checker command

412

interval: datetime.timedelta(); How often to start a new checker

413

last_approval_request: datetime.datetime(); (UTC) or None

414

last_checked_ok: datetime.datetime(); (UTC) or None

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

419

420

D-Bus identifiers

421

secret: bytestring; sent verbatim (over TLS) to client

422

timeout: datetime.timedelta(); How long from last_checked_ok

423

until this client is disabled

424

extended_timeout: extra long timeout when password has been sent

425

runtime_expansions: Allowed attributes for runtime expansion.

426

expires: datetime.datetime(); time (UTC) when a client will be

427

disabled, or None

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

428

266

"""

429

267

430

runtime_expansions = ("approval_delay", "approval_duration",

431

"created", "enabled", "fingerprint",

432

"host", "interval", "last_checked_ok",

433

"last_enabled", "name", "timeout")

434

client_defaults = { "timeout": "5m",

435

"extended_timeout": "15m",

436

"interval": "2m",

437

"checker": "fping -q -- %%(host)s",

438

"host": "",

439

"approval_delay": "0s",

440

"approval_duration": "1s",

441

"approved_by_default": "True",

442

"enabled": "True",

443

}

268

@staticmethod

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

444

274

445

275

def timeout_milliseconds(self):

446

276

"Return the 'timeout' attribute in milliseconds"

447

return timedelta_to_milliseconds(self.timeout)

448

449

def extended_timeout_milliseconds(self):

450

"Return the 'extended_timeout' attribute in milliseconds"

451

return timedelta_to_milliseconds(self.extended_timeout)

277

return self._timedelta_to_milliseconds(self.timeout)

452

278

453

279

def interval_milliseconds(self):

454

280

"Return the 'interval' attribute in milliseconds"

455

return timedelta_to_milliseconds(self.interval)

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

456

285

457

def approval_delay_milliseconds(self):

458

return timedelta_to_milliseconds(self.approval_delay)

459

460

@staticmethod

461

def config_parser(config):

462

""" Construct a new dict of client settings of this form:

463

{ client_name: {setting_name: value, ...}, ...}

464

with exceptions for any special settings as defined above"""

465

settings = {}

466

for client_name in config.sections():

467

section = dict(config.items(client_name))

468

client = settings[client_name] = {}

469

470

client["host"] = section["host"]

471

# Reformat values from string types to Python types

472

client["approved_by_default"] = config.getboolean(

473

client_name, "approved_by_default")

474

client["enabled"] = config.getboolean(client_name, "enabled")

475

476

client["fingerprint"] = (section["fingerprint"].upper()

477

.replace(" ", ""))

478

if "secret" in section:

479

client["secret"] = section["secret"].decode("base64")

480

elif "secfile" in section:

481

with open(os.path.expanduser(os.path.expandvars

482

(section["secfile"])),

483

"rb") as secfile:

484

client["secret"] = secfile.read()

485

else:

486

raise TypeError("No secret or secfile for section %s"

487

% section)

488

client["timeout"] = string_to_delta(section["timeout"])

489

client["extended_timeout"] = string_to_delta(

490

section["extended_timeout"])

491

client["interval"] = string_to_delta(section["interval"])

492

client["approval_delay"] = string_to_delta(

493

section["approval_delay"])

494

client["approval_duration"] = string_to_delta(

495

section["approval_duration"])

496

client["checker_command"] = section["checker"]

497

client["last_approval_request"] = None

498

client["last_checked_ok"] = None

499

client["last_checker_status"] = None

500

if client["enabled"]:

501

client["last_enabled"] = datetime.datetime.utcnow()

502

client["expires"] = (datetime.datetime.utcnow()

503

+ client["timeout"])

504

else:

505

client["last_enabled"] = None

506

client["expires"] = None

507

508

return settings

509

510

511

def __init__(self, settings, name = None):

286

def __init__(self, name = None, disable_hook=None, config=None):

512

287

"""Note: the 'checker' key in 'config' sets the

513

288

'checker_command' attribute and *not* the 'checker'

514

289

attribute."""

515

290

self.name = name

516

# adding all client settings

517

for setting, value in settings.iteritems():

518

setattr(self, setting, value)

519

520

logger.debug("Creating client %r", self.name)

291

if config is None:

292

config = {}

293

logger.debug(u"Creating client %r", self.name)

521

294

# Uppercase and remove spaces from fingerprint for later

522

295

# comparison purposes with return value from the fingerprint()

523

296

# function

524

logger.debug(" Fingerprint: %s", self.fingerprint)

525

self.created = settings.get("created", datetime.datetime.utcnow())

526

527

# attributes specific for this server instance

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

303

with open(os.path.expanduser(os.path.expandvars

304

(config[u"secfile"])),

305

"rb") as secfile:

306

self.secret = secfile.read()

307

else:

308

#XXX Need to allow secret on demand!

309

raise TypeError(u"No secret or secfile for client %s"

310

% self.name)

311

self.host = config.get(u"host", u"")

312

self.created = datetime.datetime.utcnow()

313

self.enabled = False

314

self.last_enabled = None

315

self.last_checked_ok = None

316

self.timeout = string_to_delta(config[u"timeout"])

317

self.interval = string_to_delta(config[u"interval"])

318

self.disable_hook = disable_hook

528

319

self.checker = None

529

320

self.checker_initiator_tag = None

530

321

self.disable_initiator_tag = None

531

322

self.checker_callback_tag = None

323

self.checker_command = config[u"checker"]

532

324

self.current_checker_command = None

533

self.approved = None

325

self.last_connect = None

534

326

self.approvals_pending = 0

535

self.changedstate = (multiprocessing_manager

536

.Condition(multiprocessing_manager

537

.Lock()))

538

self.client_structure = [attr for attr in

539

self.__dict__.iterkeys()

540

if not attr.startswith("_")]

541

self.client_structure.append("client_structure")

542

543

for name, t in inspect.getmembers(type(self),

544

lambda obj:

545

isinstance(obj,

546

property)):

547

if not name.startswith("_"):

548

self.client_structure.append(name)

549

550

# Send notice to process children that client state has changed

327

self._approved = None

328

self.approved_by_default = config.get(u"approved_by_default",

329

True)

330

self.approved_delay = string_to_delta(

331

config[u"approved_delay"])

332

self.approved_duration = string_to_delta(

333

config[u"approved_duration"])

334

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

335

551

336

def send_changedstate(self):

552

with self.changedstate:

553

self.changedstate.notify_all()

554

337

self.changedstate.acquire()

338

self.changedstate.notify_all()

339

self.changedstate.release()

340

555

341

def enable(self):

556

342

"""Start this client's checker and timeout hooks"""

557

if getattr(self, "enabled", False):

343

if getattr(self, u"enabled", False):

558

344

# Already enabled

559

345

return

560

346

self.send_changedstate()

561

self.expires = datetime.datetime.utcnow() + self.timeout

562

self.enabled = True

563

347

self.last_enabled = datetime.datetime.utcnow()

564

self.init_checker()

565

566

def disable(self, quiet=True):

567

"""Disable this client."""

568

if not getattr(self, "enabled", False):

569

return False

570

if not quiet:

571

self.send_changedstate()

572

if not quiet:

573

logger.info("Disabling client %s", self.name)

574

if getattr(self, "disable_initiator_tag", False):

575

gobject.source_remove(self.disable_initiator_tag)

576

self.disable_initiator_tag = None

577

self.expires = None

578

if getattr(self, "checker_initiator_tag", False):

579

gobject.source_remove(self.checker_initiator_tag)

580

self.checker_initiator_tag = None

581

self.stop_checker()

582

self.enabled = False

583

# Do not run this again if called by a gobject.timeout_add

584

return False

585

586

def __del__(self):

587

self.disable()

588

589

def init_checker(self):

590

348

# Schedule a new checker to be started an 'interval' from now,

591

349

# and every interval from then on.

592

350

self.checker_initiator_tag = (gobject.timeout_add

596

354

self.disable_initiator_tag = (gobject.timeout_add

597

355

(self.timeout_milliseconds(),

598

356

self.disable))

357

self.enabled = True

599

358

# Also start a new checker *right now*.

600

359

self.start_checker()

601

360

361

def disable(self, quiet=True):

362

"""Disable this client."""

363

if not getattr(self, "enabled", False):

364

return False

365

if not quiet:

366

self.send_changedstate()

367

if not quiet:

368

logger.info(u"Disabling client %s", self.name)

369

if getattr(self, u"disable_initiator_tag", False):

370

gobject.source_remove(self.disable_initiator_tag)

371

self.disable_initiator_tag = None

372

if getattr(self, u"checker_initiator_tag", False):

373

gobject.source_remove(self.checker_initiator_tag)

374

self.checker_initiator_tag = None

375

self.stop_checker()

376

if self.disable_hook:

377

self.disable_hook(self)

378

self.enabled = False

379

# Do not run this again if called by a gobject.timeout_add

380

return False

381

382

def __del__(self):

383

self.disable_hook = None

384

self.disable()

385

602

386

def checker_callback(self, pid, condition, command):

603

387

"""The checker has completed, so take appropriate actions."""

604

388

self.checker_callback_tag = None

605

389

self.checker = None

606

390

if os.WIFEXITED(condition):

607

self.last_checker_status = os.WEXITSTATUS(condition)

608

if self.last_checker_status == 0:

609

logger.info("Checker for %(name)s succeeded",

391

exitstatus = os.WEXITSTATUS(condition)

392

if exitstatus == 0:

393

logger.info(u"Checker for %(name)s succeeded",

610

394

vars(self))

611

395

self.checked_ok()

612

396

else:

613

logger.info("Checker for %(name)s failed",

397

logger.info(u"Checker for %(name)s failed",

614

398

vars(self))

615

399

else:

616

self.last_checker_status = -1

617

logger.warning("Checker for %(name)s crashed?",

400

logger.warning(u"Checker for %(name)s crashed?",

618

401

vars(self))

619

402

620

def checked_ok(self, timeout=None):

403

def checked_ok(self):

621

404

"""Bump up the timeout for this client.

622

405

623

406

This should only be called when the client has been seen,

624

407

alive and well.

625

408

"""

626

if timeout is None:

627

timeout = self.timeout

628

409

self.last_checked_ok = datetime.datetime.utcnow()

629

if self.disable_initiator_tag is not None:

630

gobject.source_remove(self.disable_initiator_tag)

631

if getattr(self, "enabled", False):

632

self.disable_initiator_tag = (gobject.timeout_add

633

(timedelta_to_milliseconds

634

(timeout), self.disable))

635

self.expires = datetime.datetime.utcnow() + timeout

636

637

def need_approval(self):

638

self.last_approval_request = datetime.datetime.utcnow()

410

gobject.source_remove(self.disable_initiator_tag)

411

self.disable_initiator_tag = (gobject.timeout_add

412

(self.timeout_milliseconds(),

413

self.disable))

639

414

640

415

def start_checker(self):

641

416

"""Start a new checker subprocess if one is not running.

654

429

# If a checker exists, make sure it is not a zombie

655

430

try:

656

431

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

657

except (AttributeError, OSError) as error:

432

except (AttributeError, OSError), error:

658

433

if (isinstance(error, OSError)

659

434

and error.errno != errno.ECHILD):

660

435

raise error

661

436

else:

662

437

if pid:

663

logger.warning("Checker was a zombie")

438

logger.warning(u"Checker was a zombie")

664

439

gobject.source_remove(self.checker_callback_tag)

665

440

self.checker_callback(pid, status,

666

441

self.current_checker_command)

671

446

command = self.checker_command % self.host

672

447

except TypeError:

673

448

# Escape attributes for the shell

674

escaped_attrs = dict(

675

(attr,

676

re.escape(unicode(str(getattr(self, attr, "")),

677

errors=

678

'replace')))

679

for attr in

680

self.runtime_expansions)

681

449

escaped_attrs = dict((key,

450

re.escape(unicode(str(val),

451

errors=

452

u'replace')))

453

for key, val in

454

vars(self).iteritems())

682

455

try:

683

456

command = self.checker_command % escaped_attrs

684

except TypeError as error:

685

logger.error('Could not format string "%s":'

686

' %s', self.checker_command, error)

457

except TypeError, error:

458

logger.error(u'Could not format string "%s":'

459

u' %s', self.checker_command, error)

687

460

return True # Try again later

688

461

self.current_checker_command = command

689

462

try:

690

logger.info("Starting checker %r for %s",

463

logger.info(u"Starting checker %r for %s",

691

464

command, self.name)

692

465

# We don't need to redirect stdout and stderr, since

693

466

# in normal mode, that is already done by daemon(),

695

468

# always replaced by /dev/null.)

696

469

self.checker = subprocess.Popen(command,

697

470

close_fds=True,

698

shell=True, cwd="/")

471

shell=True, cwd=u"/")

699

472

self.checker_callback_tag = (gobject.child_watch_add

700

473

(self.checker.pid,

701

474

self.checker_callback,

706

479

if pid:

707

480

gobject.source_remove(self.checker_callback_tag)

708

481

self.checker_callback(pid, status, command)

709

except OSError as error:

710

logger.error("Failed to start subprocess: %s",

482

except OSError, error:

483

logger.error(u"Failed to start subprocess: %s",

711

484

error)

712

485

# Re-run this periodically if run by gobject.timeout_add

713

486

return True

717

490

if self.checker_callback_tag:

718

491

gobject.source_remove(self.checker_callback_tag)

719

492

self.checker_callback_tag = None

720

if getattr(self, "checker", None) is None:

493

if getattr(self, u"checker", None) is None:

721

494

return

722

logger.debug("Stopping checker for %(name)s", vars(self))

495

logger.debug(u"Stopping checker for %(name)s", vars(self))

723

496

try:

724

497

os.kill(self.checker.pid, signal.SIGTERM)

725

498

#time.sleep(0.5)

726

499

#if self.checker.poll() is None:

727

500

# os.kill(self.checker.pid, signal.SIGKILL)

728

except OSError as error:

501

except OSError, error:

729

502

if error.errno != errno.ESRCH: # No such process

730

503

raise

731

504

self.checker = None

732

505

733

734

def dbus_service_property(dbus_interface, signature="v",

735

access="readwrite", byte_arrays=False):

506

def dbus_service_property(dbus_interface, signature=u"v",

507

access=u"readwrite", byte_arrays=False):

736

508

"""Decorators for marking methods of a DBusObjectWithProperties to

737

509

become properties on the D-Bus.

738

510

745

517

"""

746

518

# Encoding deeply encoded byte arrays is not supported yet by the

747

519

# "Set" method, so we fail early here:

748

if byte_arrays and signature != "ay":

749

raise ValueError("Byte arrays not supported for non-'ay'"

750

" signature %r" % signature)

520

if byte_arrays and signature != u"ay":

521

raise ValueError(u"Byte arrays not supported for non-'ay'"

522

u" signature %r" % signature)

751

523

def decorator(func):

752

524

func._dbus_is_property = True

753

525

func._dbus_interface = dbus_interface

754

526

func._dbus_signature = signature

755

527

func._dbus_access = access

756

528

func._dbus_name = func.__name__

757

if func._dbus_name.endswith("_dbus_property"):

529

if func._dbus_name.endswith(u"_dbus_property"):

758

530

func._dbus_name = func._dbus_name[:-14]

759

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

531

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

760

532

return func

761

533

return decorator

762

534

782

554

783

555

class DBusObjectWithProperties(dbus.service.Object):

784

556

"""A D-Bus object with properties.

785

557

786

558

Classes inheriting from this can use the dbus_service_property

787

559

decorator to expose methods as D-Bus properties. It exposes the

788

560

standard Get(), Set(), and GetAll() methods on the D-Bus.

790

562

791

563

@staticmethod

792

564

def _is_dbus_property(obj):

793

return getattr(obj, "_dbus_is_property", False)

565

return getattr(obj, u"_dbus_is_property", False)

794

566

795

567

def _get_all_dbus_properties(self):

796

568

"""Returns a generator of (name, attribute) pairs

797

569

"""

798

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

799

for cls in self.__class__.__mro__

570

return ((prop._dbus_name, prop)

800

571

for name, prop in

801

inspect.getmembers(cls, self._is_dbus_property))

572

inspect.getmembers(self, self._is_dbus_property))

802

573

803

574

def _get_dbus_property(self, interface_name, property_name):

804

575

"""Returns a bound method if one exists which is a D-Bus

805

576

property with the specified name and interface.

806

577

"""

807

for cls in self.__class__.__mro__:

808

for name, value in (inspect.getmembers

809

(cls, self._is_dbus_property)):

810

if (value._dbus_name == property_name

811

and value._dbus_interface == interface_name):

812

return value.__get__(self)

813

578

for name in (property_name,

579

property_name + u"_dbus_property"):

580

prop = getattr(self, name, None)

581

if (prop is None

582

or not self._is_dbus_property(prop)

583

or prop._dbus_name != property_name

584

or (interface_name and prop._dbus_interface

585

and interface_name != prop._dbus_interface)):

586

continue

587

return prop

814

588

# No such property

815

raise DBusPropertyNotFound(self.dbus_object_path + ":"

816

+ interface_name + "."

589

raise DBusPropertyNotFound(self.dbus_object_path + u":"

590

+ interface_name + u"."

817

591

+ property_name)

818

592

819

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

820

out_signature="v")

593

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

594

out_signature=u"v")

821

595

def Get(self, interface_name, property_name):

822

596

"""Standard D-Bus property Get() method, see D-Bus standard.

823

597

"""

824

598

prop = self._get_dbus_property(interface_name, property_name)

825

if prop._dbus_access == "write":

599

if prop._dbus_access == u"write":

826

600

raise DBusPropertyAccessException(property_name)

827

601

value = prop()

828

if not hasattr(value, "variant_level"):

602

if not hasattr(value, u"variant_level"):

829

603

return value

830

604

return type(value)(value, variant_level=value.variant_level+1)

831

605

832

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

606

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

833

607

def Set(self, interface_name, property_name, value):

834

608

"""Standard D-Bus property Set() method, see D-Bus standard.

835

609

"""

836

610

prop = self._get_dbus_property(interface_name, property_name)

837

if prop._dbus_access == "read":

611

if prop._dbus_access == u"read":

838

612

raise DBusPropertyAccessException(property_name)

839

if prop._dbus_get_args_options["byte_arrays"]:

613

if prop._dbus_get_args_options[u"byte_arrays"]:

840

614

# The byte_arrays option is not supported yet on

841

615

# signatures other than "ay".

842

if prop._dbus_signature != "ay":

616

if prop._dbus_signature != u"ay":

843

617

raise ValueError

844

618

value = dbus.ByteArray(''.join(unichr(byte)

845

619

for byte in value))

846

620

prop(value)

847

621

848

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

849

out_signature="a{sv}")

622

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

623

out_signature=u"a{sv}")

850

624

def GetAll(self, interface_name):

851

625

"""Standard D-Bus property GetAll() method, see D-Bus

852

626

standard.

853

627

854

628

Note: Will not include properties with access="write".

855

629

"""

856

properties = {}

630

all = {}

857

631

for name, prop in self._get_all_dbus_properties():

858

632

if (interface_name

859

633

and interface_name != prop._dbus_interface):

860

634

# Interface non-empty but did not match

861

635

continue

862

636

# Ignore write-only properties

863

if prop._dbus_access == "write":

637

if prop._dbus_access == u"write":

864

638

continue

865

639

value = prop()

866

if not hasattr(value, "variant_level"):

867

properties[name] = value

640

if not hasattr(value, u"variant_level"):

641

all[name] = value

868

642

continue

869

properties[name] = type(value)(value, variant_level=

870

value.variant_level+1)

871

return dbus.Dictionary(properties, signature="sv")

643

all[name] = type(value)(value, variant_level=

644

value.variant_level+1)

645

return dbus.Dictionary(all, signature=u"sv")

872

646

873

647

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

874

out_signature="s",

648

out_signature=u"s",

875

649

path_keyword='object_path',

876

650

connection_keyword='connection')

877

651

def Introspect(self, object_path, connection):

882

656

try:

883

657

document = xml.dom.minidom.parseString(xmlstring)

884

658

def make_tag(document, name, prop):

885

e = document.createElement("property")

886

e.setAttribute("name", name)

887

e.setAttribute("type", prop._dbus_signature)

888

e.setAttribute("access", prop._dbus_access)

659

e = document.createElement(u"property")

660

e.setAttribute(u"name", name)

661

e.setAttribute(u"type", prop._dbus_signature)

662

e.setAttribute(u"access", prop._dbus_access)

889

663

return e

890

for if_tag in document.getElementsByTagName("interface"):

664

for if_tag in document.getElementsByTagName(u"interface"):

891

665

for tag in (make_tag(document, name, prop)

892

666

for name, prop

893

667

in self._get_all_dbus_properties()

894

668

if prop._dbus_interface

895

== if_tag.getAttribute("name")):

669

== if_tag.getAttribute(u"name")):

896

670

if_tag.appendChild(tag)

897

671

# Add the names to the return values for the

898

672

# "org.freedesktop.DBus.Properties" methods

899

if (if_tag.getAttribute("name")

900

== "org.freedesktop.DBus.Properties"):

901

for cn in if_tag.getElementsByTagName("method"):

902

if cn.getAttribute("name") == "Get":

903

for arg in cn.getElementsByTagName("arg"):

904

if (arg.getAttribute("direction")

905

== "out"):

906

arg.setAttribute("name", "value")

907

elif cn.getAttribute("name") == "GetAll":

908

for arg in cn.getElementsByTagName("arg"):

909

if (arg.getAttribute("direction")

910

== "out"):

911

arg.setAttribute("name", "props")

912

xmlstring = document.toxml("utf-8")

673

if (if_tag.getAttribute(u"name")

674

== u"org.freedesktop.DBus.Properties"):

675

for cn in if_tag.getElementsByTagName(u"method"):

676

if cn.getAttribute(u"name") == u"Get":

677

for arg in cn.getElementsByTagName(u"arg"):

678

if (arg.getAttribute(u"direction")

679

== u"out"):

680

arg.setAttribute(u"name", u"value")

681

elif cn.getAttribute(u"name") == u"GetAll":

682

for arg in cn.getElementsByTagName(u"arg"):

683

if (arg.getAttribute(u"direction")

684

== u"out"):

685

arg.setAttribute(u"name", u"props")

686

xmlstring = document.toxml(u"utf-8")

913

687

document.unlink()

914

688

except (AttributeError, xml.dom.DOMException,

915

xml.parsers.expat.ExpatError) as error:

916

logger.error("Failed to override Introspection method",

689

xml.parsers.expat.ExpatError), error:

690

logger.error(u"Failed to override Introspection method",

917

691

error)

918

692

return xmlstring

919

693

920

694

921

def datetime_to_dbus (dt, variant_level=0):

922

"""Convert a UTC datetime.datetime() to a D-Bus type."""

923

if dt is None:

924

return dbus.String("", variant_level = variant_level)

925

return dbus.String(dt.isoformat(),

926

variant_level=variant_level)

927

928

929

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

930

.__metaclass__):

931

"""Applied to an empty subclass of a D-Bus object, this metaclass

932

will add additional D-Bus attributes matching a certain pattern.

933

"""

934

def __new__(mcs, name, bases, attr):

935

# Go through all the base classes which could have D-Bus

936

# methods, signals, or properties in them

937

for base in (b for b in bases

938

if issubclass(b, dbus.service.Object)):

939

# Go though all attributes of the base class

940

for attrname, attribute in inspect.getmembers(base):

941

# Ignore non-D-Bus attributes, and D-Bus attributes

942

# with the wrong interface name

943

if (not hasattr(attribute, "_dbus_interface")

944

or not attribute._dbus_interface

945

.startswith("se.recompile.Mandos")):

946

continue

947

# Create an alternate D-Bus interface name based on

948

# the current name

949

alt_interface = (attribute._dbus_interface

950

.replace("se.recompile.Mandos",

951

"se.bsnet.fukt.Mandos"))

952

# Is this a D-Bus signal?

953

if getattr(attribute, "_dbus_is_signal", False):

954

# Extract the original non-method function by

955

# black magic

956

nonmethod_func = (dict(

957

zip(attribute.func_code.co_freevars,

958

attribute.__closure__))["func"]

959

.cell_contents)

960

# Create a new, but exactly alike, function

961

# object, and decorate it to be a new D-Bus signal

962

# with the alternate D-Bus interface name

963

new_function = (dbus.service.signal

964

(alt_interface,

965

attribute._dbus_signature)

966

(types.FunctionType(

967

nonmethod_func.func_code,

968

nonmethod_func.func_globals,

969

nonmethod_func.func_name,

970

nonmethod_func.func_defaults,

971

nonmethod_func.func_closure)))

972

# Define a creator of a function to call both the

973

# old and new functions, so both the old and new

974

# signals gets sent when the function is called

975

def fixscope(func1, func2):

976

"""This function is a scope container to pass

977

func1 and func2 to the "call_both" function

978

outside of its arguments"""

979

def call_both(*args, **kwargs):

980

"""This function will emit two D-Bus

981

signals by calling func1 and func2"""

982

func1(*args, **kwargs)

983

func2(*args, **kwargs)

984

return call_both

985

# Create the "call_both" function and add it to

986

# the class

987

attr[attrname] = fixscope(attribute,

988

new_function)

989

# Is this a D-Bus method?

990

elif getattr(attribute, "_dbus_is_method", False):

991

# Create a new, but exactly alike, function

992

# object. Decorate it to be a new D-Bus method

993

# with the alternate D-Bus interface name. Add it

994

# to the class.

995

attr[attrname] = (dbus.service.method

996

(alt_interface,

997

attribute._dbus_in_signature,

998

attribute._dbus_out_signature)

999

(types.FunctionType

1000

(attribute.func_code,

1001

attribute.func_globals,

1002

attribute.func_name,

1003

attribute.func_defaults,

1004

attribute.func_closure)))

1005

# Is this a D-Bus property?

1006

elif getattr(attribute, "_dbus_is_property", False):

1007

# Create a new, but exactly alike, function

1008

# object, and decorate it to be a new D-Bus

1009

# property with the alternate D-Bus interface

1010

# name. Add it to the class.

1011

attr[attrname] = (dbus_service_property

1012

(alt_interface,

1013

attribute._dbus_signature,

1014

attribute._dbus_access,

1015

attribute

1016

._dbus_get_args_options

1017

["byte_arrays"])

1018

(types.FunctionType

1019

(attribute.func_code,

1020

attribute.func_globals,

1021

attribute.func_name,

1022

attribute.func_defaults,

1023

attribute.func_closure)))

1024

return type.__new__(mcs, name, bases, attr)

1025

1026

1027

695

class ClientDBus(Client, DBusObjectWithProperties):

1028

696

"""A Client class using D-Bus

1029

697

1031

699

dbus_object_path: dbus.ObjectPath

1032

700

bus: dbus.SystemBus()

1033

701

"""

1034

1035

runtime_expansions = (Client.runtime_expansions

1036

+ ("dbus_object_path",))

1037

1038

702

# dbus.service.Object doesn't use super(), so we can't either.

1039

703

1040

704

def __init__(self, bus = None, *args, **kwargs):

1041

705

self.bus = bus

1042

706

Client.__init__(self, *args, **kwargs)

1043

self._approvals_pending = 0

1044

1045

self._approvals_pending = 0

1046

707

# Only now, when this client is initialized, can it show up on

1047

708

# the D-Bus

1048

client_object_name = unicode(self.name).translate(

1049

{ord("."): ord("_"),

1050

ord("-"): ord("_")})

1051

709

self.dbus_object_path = (dbus.ObjectPath

1052

("/clients/" + client_object_name))

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

1053

712

DBusObjectWithProperties.__init__(self, self.bus,

1054

713

self.dbus_object_path)

1055

1056

def notifychangeproperty(transform_func,

1057

dbus_name, type_func=lambda x: x,

1058

variant_level=1):

1059

""" Modify a variable so that it's a property which announces

1060

its changes to DBus.

1061

1062

transform_fun: Function that takes a value and a variant_level

1063

and transforms it to a D-Bus type.

1064

dbus_name: D-Bus name of the variable

1065

type_func: Function that transform the value before sending it

1066

to the D-Bus. Default: no transform

1067

variant_level: D-Bus variant level. Default: 1

1068

"""

1069

attrname = "_{0}".format(dbus_name)

1070

def setter(self, value):

1071

if hasattr(self, "dbus_object_path"):

1072

if (not hasattr(self, attrname) or

1073

type_func(getattr(self, attrname, None))

1074

!= type_func(value)):

1075

dbus_value = transform_func(type_func(value),

1076

variant_level

1077

=variant_level)

1078

self.PropertyChanged(dbus.String(dbus_name),

1079

dbus_value)

1080

setattr(self, attrname, value)

1081

1082

return property(lambda self: getattr(self, attrname), setter)

1083

1084

1085

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1086

approvals_pending = notifychangeproperty(dbus.Boolean,

1087

"ApprovalPending",

1088

type_func = bool)

1089

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1090

last_enabled = notifychangeproperty(datetime_to_dbus,

1091

"LastEnabled")

1092

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1093

type_func = lambda checker:

1094

checker is not None)

1095

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1096

"LastCheckedOK")

1097

last_approval_request = notifychangeproperty(

1098

datetime_to_dbus, "LastApprovalRequest")

1099

approved_by_default = notifychangeproperty(dbus.Boolean,

1100

"ApprovedByDefault")

1101

approval_delay = notifychangeproperty(dbus.UInt64,

1102

"ApprovalDelay",

1103

type_func =

1104

timedelta_to_milliseconds)

1105

approval_duration = notifychangeproperty(

1106

dbus.UInt64, "ApprovalDuration",

1107

type_func = timedelta_to_milliseconds)

1108

host = notifychangeproperty(dbus.String, "Host")

1109

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1110

type_func =

1111

timedelta_to_milliseconds)

1112

extended_timeout = notifychangeproperty(

1113

dbus.UInt64, "ExtendedTimeout",

1114

type_func = timedelta_to_milliseconds)

1115

interval = notifychangeproperty(dbus.UInt64,

1116

"Interval",

1117

type_func =

1118

timedelta_to_milliseconds)

1119

checker_command = notifychangeproperty(dbus.String, "Checker")

1120

1121

del notifychangeproperty

714

715

@staticmethod

716

def _datetime_to_dbus(dt, variant_level=0):

717

"""Convert a UTC datetime.datetime() to a D-Bus type."""

718

return dbus.String(dt.isoformat(),

719

variant_level=variant_level)

720

721

def enable(self):

722

oldstate = getattr(self, u"enabled", False)

723

r = Client.enable(self)

724

if oldstate != self.enabled:

725

# Emit D-Bus signals

726

self.PropertyChanged(dbus.String(u"enabled"),

727

dbus.Boolean(True, variant_level=1))

728

self.PropertyChanged(

729

dbus.String(u"last_enabled"),

730

self._datetime_to_dbus(self.last_enabled,

731

variant_level=1))

732

return r

733

734

def disable(self, quiet = False):

735

oldstate = getattr(self, u"enabled", False)

736

r = Client.disable(self, quiet=quiet)

737

if not quiet and oldstate != self.enabled:

738

# Emit D-Bus signal

739

self.PropertyChanged(dbus.String(u"enabled"),

740

dbus.Boolean(False, variant_level=1))

741

return r

1122

742

1123

743

def __del__(self, *args, **kwargs):

1124

744

try:

1125

745

self.remove_from_connection()

1126

746

except LookupError:

1127

747

pass

1128

if hasattr(DBusObjectWithProperties, "__del__"):

748

if hasattr(DBusObjectWithProperties, u"__del__"):

1129

749

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1130

750

Client.__del__(self, *args, **kwargs)

1131

751

1133

753

*args, **kwargs):

1134

754

self.checker_callback_tag = None

1135

755

self.checker = None

756

# Emit D-Bus signal

757

self.PropertyChanged(dbus.String(u"checker_running"),

758

dbus.Boolean(False, variant_level=1))

1136

759

if os.WIFEXITED(condition):

1137

760

exitstatus = os.WEXITSTATUS(condition)

1138

761

# Emit D-Bus signal

1148

771

return Client.checker_callback(self, pid, condition, command,

1149

772

*args, **kwargs)

1150

773

774

def checked_ok(self, *args, **kwargs):

775

r = Client.checked_ok(self, *args, **kwargs)

776

# Emit D-Bus signal

777

self.PropertyChanged(

778

dbus.String(u"last_checked_ok"),

779

(self._datetime_to_dbus(self.last_checked_ok,

780

variant_level=1)))

781

return r

782

1151

783

def start_checker(self, *args, **kwargs):

1152

784

old_checker = self.checker

1153

785

if self.checker is not None:

1160

792

and old_checker_pid != self.checker.pid):

1161

793

# Emit D-Bus signal

1162

794

self.CheckerStarted(self.current_checker_command)

795

self.PropertyChanged(

796

dbus.String(u"checker_running"),

797

dbus.Boolean(True, variant_level=1))

1163

798

return r

1164

799

800

def stop_checker(self, *args, **kwargs):

801

old_checker = getattr(self, u"checker", None)

802

r = Client.stop_checker(self, *args, **kwargs)

803

if (old_checker is not None

804

and getattr(self, u"checker", None) is None):

805

self.PropertyChanged(dbus.String(u"checker_running"),

806

dbus.Boolean(False, variant_level=1))

807

return r

808

1165

809

def _reset_approved(self):

1166

self.approved = None

810

self._approved = None

1167

811

return False

1168

812

1169

813

def approve(self, value=True):

1170

self.send_changedstate()

1171

self.approved = value

1172

gobject.timeout_add(timedelta_to_milliseconds

1173

(self.approval_duration),

1174

self._reset_approved)

814

self._approved = value

815

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

816

817

def approved_pending(self):

818

return self.approvals_pending > 0

1175

819

1176

820

1177

821

## D-Bus methods, signals & properties

1178

_interface = "se.recompile.Mandos.Client"

822

_interface = u"se.bsnet.fukt.Mandos.Client"

1179

823

1180

824

## Signals

1181

825

1182

826

# CheckerCompleted - signal

1183

@dbus.service.signal(_interface, signature="nxs")

827

@dbus.service.signal(_interface, signature=u"nxs")

1184

828

def CheckerCompleted(self, exitcode, waitstatus, command):

1185

829

"D-Bus signal"

1186

830

pass

1187

831

1188

832

# CheckerStarted - signal

1189

@dbus.service.signal(_interface, signature="s")

833

@dbus.service.signal(_interface, signature=u"s")

1190

834

def CheckerStarted(self, command):

1191

835

"D-Bus signal"

1192

836

pass

1193

837

1194

838

# PropertyChanged - signal

1195

@dbus.service.signal(_interface, signature="sv")

839

@dbus.service.signal(_interface, signature=u"sv")

1196

840

def PropertyChanged(self, property, value):

1197

841

"D-Bus signal"

1198

842

pass

1200

844

# GotSecret - signal

1201

845

@dbus.service.signal(_interface)

1202

846

def GotSecret(self):

1203

"""D-Bus signal

1204

Is sent after a successful transfer of secret from the Mandos

1205

server to mandos-client

1206

"""

1207

pass

847

"D-Bus signal"

848

if self.approved_pending():

849

self.PropertyChanged(dbus.String(u"checker_running"),

850

dbus.Boolean(False, variant_level=1))

1208

851

1209

852

# Rejected - signal

1210

@dbus.service.signal(_interface, signature="s")

853

@dbus.service.signal(_interface, signature=u"s")

1211

854

def Rejected(self, reason):

1212

855

"D-Bus signal"

1213

pass

856

if self.approved_pending():

857

self.PropertyChanged(dbus.String(u"checker_running"),

858

dbus.Boolean(False, variant_level=1))

1214

859

1215

860

# NeedApproval - signal

1216

@dbus.service.signal(_interface, signature="tb")

861

@dbus.service.signal(_interface, signature=u"db")

1217

862

def NeedApproval(self, timeout, default):

1218

863

"D-Bus signal"

1219

return self.need_approval()

1220

1221

# NeRwequest - signal

1222

@dbus.service.signal(_interface, signature="s")

1223

def NewRequest(self, ip):

1224

"""D-Bus signal

1225

Is sent after a client request a password.

1226

"""

1227

pass

864

if not self.approved_pending():

865

self.PropertyChanged(dbus.String(u"approved_pending"),

866

dbus.Boolean(True, variant_level=1))

1228

867

1229

868

## Methods

1230

869

1231

870

# Approve - method

1232

@dbus.service.method(_interface, in_signature="b")

871

@dbus.service.method(_interface, in_signature=u"b")

1233

872

def Approve(self, value):

1234

873

self.approve(value)

1235

874

1236

875

# CheckedOK - method

1237

876

@dbus.service.method(_interface)

1238

877

def CheckedOK(self):

1239

self.checked_ok()

878

return self.checked_ok()

1240

879

1241

880

# Enable - method

1242

881

@dbus.service.method(_interface)

1263

902

1264

903

## Properties

1265

904

1266

# ApprovalPending - property

1267

@dbus_service_property(_interface, signature="b", access="read")

1268

def ApprovalPending_dbus_property(self):

1269

return dbus.Boolean(bool(self.approvals_pending))

1270

1271

# ApprovedByDefault - property

1272

@dbus_service_property(_interface, signature="b",

1273

access="readwrite")

1274

def ApprovedByDefault_dbus_property(self, value=None):

1275

if value is None: # get

1276

return dbus.Boolean(self.approved_by_default)

1277

self.approved_by_default = bool(value)

1278

1279

# ApprovalDelay - property

1280

@dbus_service_property(_interface, signature="t",

1281

access="readwrite")

1282

def ApprovalDelay_dbus_property(self, value=None):

1283

if value is None: # get

1284

return dbus.UInt64(self.approval_delay_milliseconds())

1285

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1286

1287

# ApprovalDuration - property

1288

@dbus_service_property(_interface, signature="t",

1289

access="readwrite")

1290

def ApprovalDuration_dbus_property(self, value=None):

1291

if value is None: # get

1292

return dbus.UInt64(timedelta_to_milliseconds(

1293

self.approval_duration))

1294

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1295

1296

# Name - property

1297

@dbus_service_property(_interface, signature="s", access="read")

1298

def Name_dbus_property(self):

905

# approved_pending - property

906

@dbus_service_property(_interface, signature=u"b", access=u"read")

907

def approved_pending_dbus_property(self):

908

return dbus.Boolean(self.approved_pending())

909

910

# approved_by_default - property

911

@dbus_service_property(_interface, signature=u"b",

912

access=u"readwrite")

913

def approved_by_default_dbus_property(self):

914

return dbus.Boolean(self.approved_by_default)

915

916

# approved_delay - property

917

@dbus_service_property(_interface, signature=u"t",

918

access=u"readwrite")

919

def approved_delay_dbus_property(self):

920

return dbus.UInt64(self.approved_delay_milliseconds())

921

922

# approved_duration - property

923

@dbus_service_property(_interface, signature=u"t",

924

access=u"readwrite")

925

def approved_duration_dbus_property(self):

926

return dbus.UInt64(self._timedelta_to_milliseconds(

927

self.approved_duration))

928

929

# name - property

930

@dbus_service_property(_interface, signature=u"s", access=u"read")

931

def name_dbus_property(self):

1299

932

return dbus.String(self.name)

1300

933

1301

# Fingerprint - property

1302

@dbus_service_property(_interface, signature="s", access="read")

1303

def Fingerprint_dbus_property(self):

934

# fingerprint - property

935

@dbus_service_property(_interface, signature=u"s", access=u"read")

936

def fingerprint_dbus_property(self):

1304

937

return dbus.String(self.fingerprint)

1305

938

1306

# Host - property

1307

@dbus_service_property(_interface, signature="s",

1308

access="readwrite")

1309

def Host_dbus_property(self, value=None):

939

# host - property

940

@dbus_service_property(_interface, signature=u"s",

941

access=u"readwrite")

942

def host_dbus_property(self, value=None):

1310

943

if value is None: # get

1311

944

return dbus.String(self.host)

1312

self.host = unicode(value)

1313

1314

# Created - property

1315

@dbus_service_property(_interface, signature="s", access="read")

1316

def Created_dbus_property(self):

1317

return datetime_to_dbus(self.created)

1318

1319

# LastEnabled - property

1320

@dbus_service_property(_interface, signature="s", access="read")

1321

def LastEnabled_dbus_property(self):

1322

return datetime_to_dbus(self.last_enabled)

1323

1324

# Enabled - property

1325

@dbus_service_property(_interface, signature="b",

1326

access="readwrite")

1327

def Enabled_dbus_property(self, value=None):

945

self.host = value

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"host"),

948

dbus.String(value, variant_level=1))

949

950

# created - property

951

@dbus_service_property(_interface, signature=u"s", access=u"read")

952

def created_dbus_property(self):

953

return dbus.String(self._datetime_to_dbus(self.created))

954

955

# last_enabled - property

956

@dbus_service_property(_interface, signature=u"s", access=u"read")

957

def last_enabled_dbus_property(self):

958

if self.last_enabled is None:

959

return dbus.String(u"")

960

return dbus.String(self._datetime_to_dbus(self.last_enabled))

961

962

# enabled - property

963

@dbus_service_property(_interface, signature=u"b",

964

access=u"readwrite")

965

def enabled_dbus_property(self, value=None):

1328

966

if value is None: # get

1329

967

return dbus.Boolean(self.enabled)

1330

968

if value:

1332

970

else:

1333

971

self.disable()

1334

972

1335

# LastCheckedOK - property

1336

@dbus_service_property(_interface, signature="s",

1337

access="readwrite")

1338

def LastCheckedOK_dbus_property(self, value=None):

973

# last_checked_ok - property

974

@dbus_service_property(_interface, signature=u"s",

975

access=u"readwrite")

976

def last_checked_ok_dbus_property(self, value=None):

1339

977

if value is not None:

1340

978

self.checked_ok()

1341

979

return

1342

return datetime_to_dbus(self.last_checked_ok)

1343

1344

# Expires - property

1345

@dbus_service_property(_interface, signature="s", access="read")

1346

def Expires_dbus_property(self):

1347

return datetime_to_dbus(self.expires)

1348

1349

# LastApprovalRequest - property

1350

@dbus_service_property(_interface, signature="s", access="read")

1351

def LastApprovalRequest_dbus_property(self):

1352

return datetime_to_dbus(self.last_approval_request)

1353

1354

# Timeout - property

1355

@dbus_service_property(_interface, signature="t",

1356

access="readwrite")

1357

def Timeout_dbus_property(self, value=None):

980

if self.last_checked_ok is None:

981

return dbus.String(u"")

982

return dbus.String(self._datetime_to_dbus(self

983

.last_checked_ok))

984

985

# timeout - property

986

@dbus_service_property(_interface, signature=u"t",

987

access=u"readwrite")

988

def timeout_dbus_property(self, value=None):

1358

989

if value is None: # get

1359

990

return dbus.UInt64(self.timeout_milliseconds())

1360

991

self.timeout = datetime.timedelta(0, 0, 0, value)

1361

if getattr(self, "disable_initiator_tag", None) is None:

992

# Emit D-Bus signal

993

self.PropertyChanged(dbus.String(u"timeout"),

994

dbus.UInt64(value, variant_level=1))

995

if getattr(self, u"disable_initiator_tag", None) is None:

1362

996

return

1363

997

# Reschedule timeout

1364

998

gobject.source_remove(self.disable_initiator_tag)

1365

999

self.disable_initiator_tag = None

1366

self.expires = None

1367

time_to_die = timedelta_to_milliseconds((self

1368

.last_checked_ok

1369

+ self.timeout)

1370

- datetime.datetime

1371

.utcnow())

1000

time_to_die = (self.

1001

_timedelta_to_milliseconds((self

1002

.last_checked_ok

1003

+ self.timeout)

1004

- datetime.datetime

1005

.utcnow()))

1372

1006

if time_to_die <= 0:

1373

1007

# The timeout has passed

1374

1008

self.disable()

1375

1009

else:

1376

self.expires = (datetime.datetime.utcnow()

1377

+ datetime.timedelta(milliseconds =

1378

time_to_die))

1379

1010

self.disable_initiator_tag = (gobject.timeout_add

1380

1011

(time_to_die, self.disable))

1381

1012

1382

# ExtendedTimeout - property

1383

@dbus_service_property(_interface, signature="t",

1384

access="readwrite")

1385

def ExtendedTimeout_dbus_property(self, value=None):

1386

if value is None: # get

1387

return dbus.UInt64(self.extended_timeout_milliseconds())

1388

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1389

1390

# Interval - property

1391

@dbus_service_property(_interface, signature="t",

1392

access="readwrite")

1393

def Interval_dbus_property(self, value=None):

1013

# interval - property

1014

@dbus_service_property(_interface, signature=u"t",

1015

access=u"readwrite")

1016

def interval_dbus_property(self, value=None):

1394

1017

if value is None: # get

1395

1018

return dbus.UInt64(self.interval_milliseconds())

1396

1019

self.interval = datetime.timedelta(0, 0, 0, value)

1397

if getattr(self, "checker_initiator_tag", None) is None:

1020

# Emit D-Bus signal

1021

self.PropertyChanged(dbus.String(u"interval"),

1022

dbus.UInt64(value, variant_level=1))

1023

if getattr(self, u"checker_initiator_tag", None) is None:

1398

1024

return

1399

if self.enabled:

1400

# Reschedule checker run

1401

gobject.source_remove(self.checker_initiator_tag)

1402

self.checker_initiator_tag = (gobject.timeout_add

1403

(value, self.start_checker))

1404

self.start_checker() # Start one now, too

1405

1406

# Checker - property

1407

@dbus_service_property(_interface, signature="s",

1408

access="readwrite")

1409

def Checker_dbus_property(self, value=None):

1025

# Reschedule checker run

1026

gobject.source_remove(self.checker_initiator_tag)

1027

self.checker_initiator_tag = (gobject.timeout_add

1028

(value, self.start_checker))

1029

self.start_checker() # Start one now, too

1030

1031

# checker - property

1032

@dbus_service_property(_interface, signature=u"s",

1033

access=u"readwrite")

1034

def checker_dbus_property(self, value=None):

1410

1035

if value is None: # get

1411

1036

return dbus.String(self.checker_command)

1412

self.checker_command = unicode(value)

1037

self.checker_command = value

1038

# Emit D-Bus signal

1039

self.PropertyChanged(dbus.String(u"checker"),

1040

dbus.String(self.checker_command,

1041

variant_level=1))

1413

1042

1414

# CheckerRunning - property

1415

@dbus_service_property(_interface, signature="b",

1416

access="readwrite")

1417

def CheckerRunning_dbus_property(self, value=None):

1043

# checker_running - property

1044

@dbus_service_property(_interface, signature=u"b",

1045

access=u"readwrite")

1046

def checker_running_dbus_property(self, value=None):

1418

1047

if value is None: # get

1419

1048

return dbus.Boolean(self.checker is not None)

1420

1049

if value:

1422

1051

else:

1423

1052

self.stop_checker()

1424

1053

1425

# ObjectPath - property

1426

@dbus_service_property(_interface, signature="o", access="read")

1427

def ObjectPath_dbus_property(self):

1054

# object_path - property

1055

@dbus_service_property(_interface, signature=u"o", access=u"read")

1056

def object_path_dbus_property(self):

1428

1057

return self.dbus_object_path # is already a dbus.ObjectPath

1429

1058

1430

# Secret = property

1431

@dbus_service_property(_interface, signature="ay",

1432

access="write", byte_arrays=True)

1433

def Secret_dbus_property(self, value):

1059

# secret = property

1060

@dbus_service_property(_interface, signature=u"ay",

1061

access=u"write", byte_arrays=True)

1062

def secret_dbus_property(self, value):

1434

1063

self.secret = str(value)

1435

1064

1436

1065

del _interface

1442

1071

self._pipe.send(('init', fpr, address))

1443

1072

if not self._pipe.recv():

1444

1073

raise KeyError()

1445

1074

1446

1075

def __getattribute__(self, name):

1447

if name == '_pipe':

1076

if(name == '_pipe'):

1448

1077

return super(ProxyClient, self).__getattribute__(name)

1449

1078

self._pipe.send(('getattr', name))

1450

1079

data = self._pipe.recv()

1455

1084

self._pipe.send(('funcall', name, args, kwargs))

1456

1085

return self._pipe.recv()[1]

1457

1086

return func

1458

1087

1459

1088

def __setattr__(self, name, value):

1460

if name == '_pipe':

1089

if(name == '_pipe'):

1461

1090

return super(ProxyClient, self).__setattr__(name, value)

1462

1091

self._pipe.send(('setattr', name, value))

1463

1092

1464

1093

1465

class ClientDBusTransitional(ClientDBus):

1466

__metaclass__ = AlternateDBusNamesMetaclass

1467

1468

1469

1094

class ClientHandler(socketserver.BaseRequestHandler, object):

1470

1095

"""A class to handle client connections.

1471

1096

1474

1099

1475

1100

def handle(self):

1476

1101

with contextlib.closing(self.server.child_pipe) as child_pipe:

1477

logger.info("TCP connection from: %s",

1102

logger.info(u"TCP connection from: %s",

1478

1103

unicode(self.client_address))

1479

logger.debug("Pipe FD: %d",

1104

logger.debug(u"Pipe FD: %d",

1480

1105

self.server.child_pipe.fileno())

1481

1106

1482

1107

session = (gnutls.connection

1483

1108

.ClientSession(self.request,

1484

1109

gnutls.connection

1485

1110

.X509Credentials()))

1486

1111

1487

1112

# Note: gnutls.connection.X509Credentials is really a

1488

1113

# generic GnuTLS certificate credentials object so long as

1489

1114

# no X.509 keys are added to it. Therefore, we can use it

1490

1115

# here despite using OpenPGP certificates.

1491

1492

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1493

# "+AES-256-CBC", "+SHA1",

1494

# "+COMP-NULL", "+CTYPE-OPENPGP",

1495

# "+DHE-DSS"))

1116

1117

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1118

# u"+AES-256-CBC", u"+SHA1",

1119

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1120

# u"+DHE-DSS"))

1496

1121

# Use a fallback default, since this MUST be set.

1497

1122

priority = self.server.gnutls_priority

1498

1123

if priority is None:

1499

priority = "NORMAL"

1124

priority = u"NORMAL"

1500

1125

(gnutls.library.functions

1501

1126

.gnutls_priority_set_direct(session._c_object,

1502

1127

priority, None))

1503

1128

1504

1129

# Start communication using the Mandos protocol

1505

1130

# Get protocol number

1506

1131

line = self.request.makefile().readline()

1507

logger.debug("Protocol version: %r", line)

1132

logger.debug(u"Protocol version: %r", line)

1508

1133

try:

1509

1134

if int(line.strip().split()[0]) > 1:

1510

1135

raise RuntimeError

1511

except (ValueError, IndexError, RuntimeError) as error:

1512

logger.error("Unknown protocol version: %s", error)

1136

except (ValueError, IndexError, RuntimeError), error:

1137

logger.error(u"Unknown protocol version: %s", error)

1513

1138

return

1514

1139

1515

1140

# Start GnuTLS connection

1516

1141

try:

1517

1142

session.handshake()

1518

except gnutls.errors.GNUTLSError as error:

1519

logger.warning("Handshake failed: %s", error)

1143

except gnutls.errors.GNUTLSError, error:

1144

logger.warning(u"Handshake failed: %s", error)

1520

1145

# Do not run session.bye() here: the session is not

1521

1146

# established. Just abandon the request.

1522

1147

return

1523

logger.debug("Handshake succeeded")

1524

1148

logger.debug(u"Handshake succeeded")

1149

1525

1150

approval_required = False

1526

1151

try:

1527

1152

try:

1528

1153

fpr = self.fingerprint(self.peer_certificate

1529

1154

(session))

1530

except (TypeError,

1531

gnutls.errors.GNUTLSError) as error:

1532

logger.warning("Bad certificate: %s", error)

1155

except (TypeError, gnutls.errors.GNUTLSError), error:

1156

logger.warning(u"Bad certificate: %s", error)

1533

1157

return

1534

logger.debug("Fingerprint: %s", fpr)

1535

1158

logger.debug(u"Fingerprint: %s", fpr)

1159

1536

1160

try:

1537

1161

client = ProxyClient(child_pipe, fpr,

1538

1162

self.client_address)

1539

1163

except KeyError:

1540

1164

return

1541

1165

1542

if self.server.use_dbus:

1543

# Emit D-Bus signal

1544

client.NewRequest(str(self.client_address))

1545

1546

if client.approval_delay:

1547

delay = client.approval_delay

1166

if client.approved_delay:

1167

delay = client.approved_delay

1548

1168

client.approvals_pending += 1

1549

1169

approval_required = True

1550

1170

1551

1171

while True:

1552

1172

if not client.enabled:

1553

logger.info("Client %s is disabled",

1173

logger.warning(u"Client %s is disabled",

1554

1174

client.name)

1555

1175

if self.server.use_dbus:

1556

1176

# Emit D-Bus signal

1557

client.Rejected("Disabled")

1177

client.Rejected("Disabled")

1558

1178

return

1559

1179

1560

if client.approved or not client.approval_delay:

1180

if client._approved or not client.approved_delay:

1561

1181

#We are approved or approval is disabled

1562

1182

break

1563

elif client.approved is None:

1564

logger.info("Client %s needs approval",

1183

elif client._approved is None:

1184

logger.info(u"Client %s need approval",

1565

1185

client.name)

1566

1186

if self.server.use_dbus:

1567

1187

# Emit D-Bus signal

1568

1188

client.NeedApproval(

1569

client.approval_delay_milliseconds(),

1189

client.approved_delay_milliseconds(),

1570

1190

client.approved_by_default)

1571

1191

else:

1572

logger.warning("Client %s was not approved",

1192

logger.warning(u"Client %s was not approved",

1573

1193

client.name)

1574

1194

if self.server.use_dbus:

1575

1195

# Emit D-Bus signal

1576

client.Rejected("Denied")

1196

client.Rejected("Disapproved")

1577

1197

return

1578

1198

1579

1199

#wait until timeout or approved

1200

#x = float(client._timedelta_to_milliseconds(delay))

1580

1201

time = datetime.datetime.now()

1581

1202

client.changedstate.acquire()

1582

(client.changedstate.wait

1583

(float(client.timedelta_to_milliseconds(delay)

1584

/ 1000)))

1203

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1585

1204

client.changedstate.release()

1586

1205

time2 = datetime.datetime.now()

1587

1206

if (time2 - time) >= delay:

1591

1210

client.name)

1592

1211

if self.server.use_dbus:

1593

1212

# Emit D-Bus signal

1594

client.Rejected("Approval timed out")

1213

client.Rejected("Time out")

1595

1214

return

1596

1215

else:

1597

1216

break

1600

1219

1601

1220

sent_size = 0

1602

1221

while sent_size < len(client.secret):

1603

try:

1604

sent = session.send(client.secret[sent_size:])

1605

except gnutls.errors.GNUTLSError as error:

1606

logger.warning("gnutls send failed")

1607

return

1608

logger.debug("Sent: %d, remaining: %d",

1222

# XXX handle session exception

1223

sent = session.send(client.secret[sent_size:])

1224

logger.debug(u"Sent: %d, remaining: %d",

1609

1225

sent, len(client.secret)

1610

1226

- (sent_size + sent))

1611

1227

sent_size += sent

1612

1613

logger.info("Sending secret to %s", client.name)

1614

# bump the timeout using extended_timeout

1615

client.checked_ok(client.extended_timeout)

1228

1229

logger.info(u"Sending secret to %s", client.name)

1230

# bump the timeout as if seen

1231

client.checked_ok()

1616

1232

if self.server.use_dbus:

1617

1233

# Emit D-Bus signal

1618

1234

client.GotSecret()

1620

1236

finally:

1621

1237

if approval_required:

1622

1238

client.approvals_pending -= 1

1623

try:

1624

session.bye()

1625

except gnutls.errors.GNUTLSError as error:

1626

logger.warning("GnuTLS bye failed")

1239

session.bye()

1627

1240

1628

1241

@staticmethod

1629

1242

def peer_certificate(session):

1639

1252

.gnutls_certificate_get_peers

1640

1253

(session._c_object, ctypes.byref(list_size)))

1641

1254

if not bool(cert_list) and list_size.value != 0:

1642

raise gnutls.errors.GNUTLSError("error getting peer"

1643

" certificate")

1255

raise gnutls.errors.GNUTLSError(u"error getting peer"

1256

u" certificate")

1644

1257

if list_size.value == 0:

1645

1258

return None

1646

1259

cert = cert_list[0]

1672

1285

if crtverify.value != 0:

1673

1286

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1674

1287

raise (gnutls.errors.CertificateSecurityError

1675

("Verify failed"))

1288

(u"Verify failed"))

1676

1289

# New buffer for the fingerprint

1677

1290

buf = ctypes.create_string_buffer(20)

1678

1291

buf_len = ctypes.c_size_t()

1685

1298

# Convert the buffer to a Python bytestring

1686

1299

fpr = ctypes.string_at(buf, buf_len.value)

1687

1300

# Convert the bytestring to hexadecimal notation

1688

hex_fpr = binascii.hexlify(fpr).upper()

1301

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1689

1302

return hex_fpr

1690

1303

1691

1304

1694

1307

def sub_process_main(self, request, address):

1695

1308

try:

1696

1309

self.finish_request(request, address)

1697

except Exception:

1310

except:

1698

1311

self.handle_error(request, address)

1699

1312

self.close_request(request)

1700

1313

1701

1314

def process_request(self, request, address):

1702

1315

"""Start a new process to process the request."""

1703

proc = multiprocessing.Process(target = self.sub_process_main,

1704

args = (request,

1705

address))

1706

proc.start()

1707

return proc

1708

1316

multiprocessing.Process(target = self.sub_process_main,

1317

args = (request, address)).start()

1709

1318

1710

1319

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1711

1320

""" adds a pipe to the MixIn """

1715

1324

This function creates a new pipe in self.pipe

1716

1325

"""

1717

1326

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1718

1719

proc = MultiprocessingMixIn.process_request(self, request,

1720

client_address)

1721

self.child_pipe.close()

1722

self.add_pipe(parent_pipe, proc)

1723

1724

def add_pipe(self, parent_pipe, proc):

1327

1328

super(MultiprocessingMixInWithPipe,

1329

self).process_request(request, client_address)

1330

self.add_pipe(parent_pipe)

1331

def add_pipe(self, parent_pipe):

1725

1332

"""Dummy function; override as necessary"""

1726

raise NotImplementedError

1727

1333

pass

1728

1334

1729

1335

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1730

1336

socketserver.TCPServer, object):

1748

1354

bind to an address or port if they were not specified."""

1749

1355

if self.interface is not None:

1750

1356

if SO_BINDTODEVICE is None:

1751

logger.error("SO_BINDTODEVICE does not exist;"

1752

" cannot bind to interface %s",

1357

logger.error(u"SO_BINDTODEVICE does not exist;"

1358

u" cannot bind to interface %s",

1753

1359

self.interface)

1754

1360

else:

1755

1361

try:

1756

1362

self.socket.setsockopt(socket.SOL_SOCKET,

1757

1363

SO_BINDTODEVICE,

1758

1364

str(self.interface

1759

+ '\0'))

1760

except socket.error as error:

1365

+ u'\0'))

1366

except socket.error, error:

1761

1367

if error[0] == errno.EPERM:

1762

logger.error("No permission to"

1763

" bind to interface %s",

1368

logger.error(u"No permission to"

1369

u" bind to interface %s",

1764

1370

self.interface)

1765

1371

elif error[0] == errno.ENOPROTOOPT:

1766

logger.error("SO_BINDTODEVICE not available;"

1767

" cannot bind to interface %s",

1372

logger.error(u"SO_BINDTODEVICE not available;"

1373

u" cannot bind to interface %s",

1768

1374

self.interface)

1769

1375

else:

1770

1376

raise

1772

1378

if self.server_address[0] or self.server_address[1]:

1773

1379

if not self.server_address[0]:

1774

1380

if self.address_family == socket.AF_INET6:

1775

any_address = "::" # in6addr_any

1381

any_address = u"::" # in6addr_any

1776

1382

else:

1777

1383

any_address = socket.INADDR_ANY

1778

1384

self.server_address = (any_address,

1805

1411

self.enabled = False

1806

1412

self.clients = clients

1807

1413

if self.clients is None:

1808

self.clients = {}

1414

self.clients = set()

1809

1415

self.use_dbus = use_dbus

1810

1416

self.gnutls_priority = gnutls_priority

1811

1417

IPv6_TCPServer.__init__(self, server_address,

1815

1421

def server_activate(self):

1816

1422

if self.enabled:

1817

1423

return socketserver.TCPServer.server_activate(self)

1818

1819

1424

def enable(self):

1820

1425

self.enabled = True

1821

1822

def add_pipe(self, parent_pipe, proc):

1426

def add_pipe(self, parent_pipe):

1823

1427

# Call "handle_ipc" for both data and EOF events

1824

1428

gobject.io_add_watch(parent_pipe.fileno(),

1825

1429

gobject.IO_IN | gobject.IO_HUP,

1826

1430

functools.partial(self.handle_ipc,

1827

parent_pipe =

1828

parent_pipe,

1829

proc = proc))

1830

1431

parent_pipe = parent_pipe))

1432

1831

1433

def handle_ipc(self, source, condition, parent_pipe=None,

1832

proc = None, client_object=None):

1434

client_object=None):

1833

1435

condition_names = {

1834

gobject.IO_IN: "IN", # There is data to read.

1835

gobject.IO_OUT: "OUT", # Data can be written (without

1436

gobject.IO_IN: u"IN", # There is data to read.

1437

gobject.IO_OUT: u"OUT", # Data can be written (without

1836

1438

# blocking).

1837

gobject.IO_PRI: "PRI", # There is urgent data to read.

1838

gobject.IO_ERR: "ERR", # Error condition.

1839

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1439

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1440

gobject.IO_ERR: u"ERR", # Error condition.

1441

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1840

1442

# broken, usually for pipes and

1841

1443

# sockets).

1842

1444

}

1844

1446

for cond, name in

1845

1447

condition_names.iteritems()

1846

1448

if cond & condition)

1847

# error, or the other end of multiprocessing.Pipe has closed

1848

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1849

# Wait for other process to exit

1850

proc.join()

1851

return False

1449

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1450

conditions_string)

1852

1451

1853

1452

# Read a request from the child

1854

1453

request = parent_pipe.recv()

1858

1457

fpr = request[1]

1859

1458

address = request[2]

1860

1459

1861

for c in self.clients.itervalues():

1460

for c in self.clients:

1862

1461

if c.fingerprint == fpr:

1863

1462

client = c

1864

1463

break

1865

1464

else:

1866

logger.info("Client not found for fingerprint: %s, ad"

1867

"dress: %s", fpr, address)

1465

logger.warning(u"Client not found for fingerprint: %s, ad"

1466

u"dress: %s", fpr, address)

1868

1467

if self.use_dbus:

1869

1468

# Emit D-Bus signal

1870

mandos_dbus_service.ClientNotFound(fpr,

1871

address[0])

1469

mandos_dbus_service.ClientNotFound(fpr, address)

1872

1470

parent_pipe.send(False)

1873

1471

return False

1874

1472

1875

1473

gobject.io_add_watch(parent_pipe.fileno(),

1876

1474

gobject.IO_IN | gobject.IO_HUP,

1877

1475

functools.partial(self.handle_ipc,

1878

parent_pipe =

1879

parent_pipe,

1880

proc = proc,

1881

client_object =

1882

client))

1476

parent_pipe = parent_pipe,

1477

client_object = client))

1883

1478

parent_pipe.send(True)

1884

# remove the old hook in favor of the new above hook on

1885

# same fileno

1479

# remove the old hook in favor of the new above hook on same fileno

1886

1480

return False

1887

1481

if command == 'funcall':

1888

1482

funcname = request[1]

1889

1483

args = request[2]

1890

1484

kwargs = request[3]

1891

1485

1892

parent_pipe.send(('data', getattr(client_object,

1893

funcname)(*args,

1894

**kwargs)))

1895

1486

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1487

1896

1488

if command == 'getattr':

1897

1489

attrname = request[1]

1898

1490

if callable(client_object.__getattribute__(attrname)):

1899

1491

parent_pipe.send(('function',))

1900

1492

else:

1901

parent_pipe.send(('data', client_object

1902

.__getattribute__(attrname)))

1903

1493

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1494

1904

1495

if command == 'setattr':

1905

1496

attrname = request[1]

1906

1497

value = request[2]

1907

1498

setattr(client_object, attrname, value)

1908

1499

1909

1500

return True

1910

1501

1911

1502

1912

1503

def string_to_delta(interval):

1913

1504

"""Parse a string and return a datetime.timedelta

1914

1505

1915

>>> string_to_delta('7d')

1506

>>> string_to_delta(u'7d')

1916

1507

datetime.timedelta(7)

1917

>>> string_to_delta('60s')

1508

>>> string_to_delta(u'60s')

1918

1509

datetime.timedelta(0, 60)

1919

>>> string_to_delta('60m')

1510

>>> string_to_delta(u'60m')

1920

1511

datetime.timedelta(0, 3600)

1921

>>> string_to_delta('24h')

1512

>>> string_to_delta(u'24h')

1922

1513

datetime.timedelta(1)

1923

>>> string_to_delta('1w')

1514

>>> string_to_delta(u'1w')

1924

1515

datetime.timedelta(7)

1925

>>> string_to_delta('5m 30s')

1516

>>> string_to_delta(u'5m 30s')

1926

1517

datetime.timedelta(0, 330)

1927

1518

"""

1928

1519

timevalue = datetime.timedelta(0)

1930

1521

try:

1931

1522

suffix = unicode(s[-1])

1932

1523

value = int(s[:-1])

1933

if suffix == "d":

1524

if suffix == u"d":

1934

1525

delta = datetime.timedelta(value)

1935

elif suffix == "s":

1526

elif suffix == u"s":

1936

1527

delta = datetime.timedelta(0, value)

1937

elif suffix == "m":

1528

elif suffix == u"m":

1938

1529

delta = datetime.timedelta(0, 0, 0, 0, value)

1939

elif suffix == "h":

1530

elif suffix == u"h":

1940

1531

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1941

elif suffix == "w":

1532

elif suffix == u"w":

1942

1533

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1943

1534

else:

1944

raise ValueError("Unknown suffix %r" % suffix)

1945

except (ValueError, IndexError) as e:

1946

raise ValueError(*(e.args))

1535

raise ValueError(u"Unknown suffix %r" % suffix)

1536

except (ValueError, IndexError), e:

1537

raise ValueError(e.message)

1947

1538

timevalue += delta

1948

1539

return timevalue

1949

1540

1950

1541

1542

def if_nametoindex(interface):

1543

"""Call the C function if_nametoindex(), or equivalent

1544

1545

Note: This function cannot accept a unicode string."""

1546

global if_nametoindex

1547

try:

1548

if_nametoindex = (ctypes.cdll.LoadLibrary

1549

(ctypes.util.find_library(u"c"))

1550

.if_nametoindex)

1551

except (OSError, AttributeError):

1552

logger.warning(u"Doing if_nametoindex the hard way")

1553

def if_nametoindex(interface):

1554

"Get an interface index the hard way, i.e. using fcntl()"

1555

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1556

with contextlib.closing(socket.socket()) as s:

1557

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1558

struct.pack(str(u"16s16x"),

1559

interface))

1560

interface_index = struct.unpack(str(u"I"),

1561

ifreq[16:20])[0]

1562

return interface_index

1563

return if_nametoindex(interface)

1564

1565

1951

1566

def daemon(nochdir = False, noclose = False):

1952

1567

"""See daemon(3). Standard BSD Unix function.

1953

1568

1956

1571

sys.exit()

1957

1572

os.setsid()

1958

1573

if not nochdir:

1959

os.chdir("/")

1574

os.chdir(u"/")

1960

1575

if os.fork():

1961

1576

sys.exit()

1962

1577

if not noclose:

1964

1579

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1965

1580

if not stat.S_ISCHR(os.fstat(null).st_mode):

1966

1581

raise OSError(errno.ENODEV,

1967

"%s not a character device"

1582

u"%s not a character device"

1968

1583

% os.path.devnull)

1969

1584

os.dup2(null, sys.stdin.fileno())

1970

1585

os.dup2(null, sys.stdout.fileno())

1978

1593

##################################################################

1979

1594

# Parsing of options, both command line and config file

1980

1595

1981

parser = argparse.ArgumentParser()

1982

parser.add_argument("-v", "--version", action="version",

1983

version = "%%(prog)s %s" % version,

1984

help="show version number and exit")

1985

parser.add_argument("-i", "--interface", metavar="IF",

1986

help="Bind to interface IF")

1987

parser.add_argument("-a", "--address",

1988

help="Address to listen for requests on")

1989

parser.add_argument("-p", "--port", type=int,

1990

help="Port number to receive requests on")

1991

parser.add_argument("--check", action="store_true",

1992

help="Run self-test")

1993

parser.add_argument("--debug", action="store_true",

1994

help="Debug mode; run in foreground and log"

1995

" to terminal")

1996

parser.add_argument("--debuglevel", metavar="LEVEL",

1997

help="Debug level for stdout output")

1998

parser.add_argument("--priority", help="GnuTLS"

1999

" priority string (see GnuTLS documentation)")

2000

parser.add_argument("--servicename",

2001

metavar="NAME", help="Zeroconf service name")

2002

parser.add_argument("--configdir",

2003

default="/etc/mandos", metavar="DIR",

2004

help="Directory to search for configuration"

2005

" files")

2006

parser.add_argument("--no-dbus", action="store_false",

2007

dest="use_dbus", help="Do not provide D-Bus"

2008

" system bus interface")

2009

parser.add_argument("--no-ipv6", action="store_false",

2010

dest="use_ipv6", help="Do not use IPv6")

2011

parser.add_argument("--no-restore", action="store_false",

2012

dest="restore", help="Do not restore stored"

2013

" state")

2014

parser.add_argument("--statedir", metavar="DIR",

2015

help="Directory to save/restore state in")

2016

2017

options = parser.parse_args()

1596

parser = optparse.OptionParser(version = "%%prog %s" % version)

1597

parser.add_option("-i", u"--interface", type=u"string",

1598

metavar="IF", help=u"Bind to interface IF")

1599

parser.add_option("-a", u"--address", type=u"string",

1600

help=u"Address to listen for requests on")

1601

parser.add_option("-p", u"--port", type=u"int",

1602

help=u"Port number to receive requests on")

1603

parser.add_option("--check", action=u"store_true",

1604

help=u"Run self-test")

1605

parser.add_option("--debug", action=u"store_true",

1606

help=u"Debug mode; run in foreground and log to"

1607

u" terminal")

1608

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1609

u" priority string (see GnuTLS documentation)")

1610

parser.add_option("--servicename", type=u"string",

1611

metavar=u"NAME", help=u"Zeroconf service name")

1612

parser.add_option("--configdir", type=u"string",

1613

default=u"/etc/mandos", metavar=u"DIR",

1614

help=u"Directory to search for configuration"

1615

u" files")

1616

parser.add_option("--no-dbus", action=u"store_false",

1617

dest=u"use_dbus", help=u"Do not provide D-Bus"

1618

u" system bus interface")

1619

parser.add_option("--no-ipv6", action=u"store_false",

1620

dest=u"use_ipv6", help=u"Do not use IPv6")

1621

options = parser.parse_args()[0]

2018

1622

2019

1623

if options.check:

2020

1624

import doctest

2022

1626

sys.exit()

2023

1627

2024

1628

# Default values for config file for server-global settings

2025

server_defaults = { "interface": "",

2026

"address": "",

2027

"port": "",

2028

"debug": "False",

2029

"priority":

2030

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2031

"servicename": "Mandos",

2032

"use_dbus": "True",

2033

"use_ipv6": "True",

2034

"debuglevel": "",

2035

"restore": "True",

2036

"statedir": "/var/lib/mandos"

1629

server_defaults = { u"interface": u"",

1630

u"address": u"",

1631

u"port": u"",

1632

u"debug": u"False",

1633

u"priority":

1634

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1635

u"servicename": u"Mandos",

1636

u"use_dbus": u"True",

1637

u"use_ipv6": u"True",

2037

1638

}

2038

1639

2039

1640

# Parse config file for server-global settings

2040

1641

server_config = configparser.SafeConfigParser(server_defaults)

2041

1642

del server_defaults

2042

1643

server_config.read(os.path.join(options.configdir,

2043

"mandos.conf"))

1644

u"mandos.conf"))

2044

1645

# Convert the SafeConfigParser object to a dict

2045

1646

server_settings = server_config.defaults()

2046

1647

# Use the appropriate methods on the non-string config options

2047

for option in ("debug", "use_dbus", "use_ipv6"):

2048

server_settings[option] = server_config.getboolean("DEFAULT",

1648

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1649

server_settings[option] = server_config.getboolean(u"DEFAULT",

2049

1650

option)

2050

1651

if server_settings["port"]:

2051

server_settings["port"] = server_config.getint("DEFAULT",

2052

"port")

1652

server_settings["port"] = server_config.getint(u"DEFAULT",

1653

u"port")

2053

1654

del server_config

2054

1655

2055

1656

# Override the settings from the config file with command line

2056

1657

# options, if set.

2057

for option in ("interface", "address", "port", "debug",

2058

"priority", "servicename", "configdir",

2059

"use_dbus", "use_ipv6", "debuglevel", "restore",

2060

"statedir"):

1658

for option in (u"interface", u"address", u"port", u"debug",

1659

u"priority", u"servicename", u"configdir",

1660

u"use_dbus", u"use_ipv6"):

2061

1661

value = getattr(options, option)

2062

1662

if value is not None:

2063

1663

server_settings[option] = value

2071

1671

##################################################################

2072

1672

2073

1673

# For convenience

2074

debug = server_settings["debug"]

2075

debuglevel = server_settings["debuglevel"]

2076

use_dbus = server_settings["use_dbus"]

2077

use_ipv6 = server_settings["use_ipv6"]

2078

stored_state_path = os.path.join(server_settings["statedir"],

2079

stored_state_file)

2080

2081

if debug:

2082

initlogger(debug, logging.DEBUG)

2083

else:

2084

if not debuglevel:

2085

initlogger(debug)

2086

else:

2087

level = getattr(logging, debuglevel.upper())

2088

initlogger(debug, level)

2089

2090

if server_settings["servicename"] != "Mandos":

1674

debug = server_settings[u"debug"]

1675

use_dbus = server_settings[u"use_dbus"]

1676

use_ipv6 = server_settings[u"use_ipv6"]

1677

1678

if not debug:

1679

syslogger.setLevel(logging.WARNING)

1680

console.setLevel(logging.WARNING)

1681

1682

if server_settings[u"servicename"] != u"Mandos":

2091

1683

syslogger.setFormatter(logging.Formatter

2092

('Mandos (%s) [%%(process)d]:'

2093

' %%(levelname)s: %%(message)s'

2094

% server_settings["servicename"]))

1684

(u'Mandos (%s) [%%(process)d]:'

1685

u' %%(levelname)s: %%(message)s'

1686

% server_settings[u"servicename"]))

2095

1687

2096

1688

# Parse config file with clients

2097

client_config = configparser.SafeConfigParser(Client.client_defaults)

2098

client_config.read(os.path.join(server_settings["configdir"],

2099

"clients.conf"))

1689

client_defaults = { u"timeout": u"1h",

1690

u"interval": u"5m",

1691

u"checker": u"fping -q -- %%(host)s",

1692

u"host": u"",

1693

u"approved_delay": u"0s",

1694

u"approved_duration": u"1s",

1695

}

1696

client_config = configparser.SafeConfigParser(client_defaults)

1697

client_config.read(os.path.join(server_settings[u"configdir"],

1698

u"clients.conf"))

2100

1699

2101

1700

global mandos_dbus_service

2102

1701

mandos_dbus_service = None

2103

1702

2104

tcp_server = MandosServer((server_settings["address"],

2105

server_settings["port"]),

1703

tcp_server = MandosServer((server_settings[u"address"],

1704

server_settings[u"port"]),

2106

1705

ClientHandler,

2107

interface=(server_settings["interface"]

2108

or None),

1706

interface=server_settings[u"interface"],

2109

1707

use_ipv6=use_ipv6,

2110

1708

gnutls_priority=

2111

server_settings["priority"],

1709

server_settings[u"priority"],

2112

1710

use_dbus=use_dbus)

2113

if not debug:

2114

pidfilename = "/var/run/mandos.pid"

2115

try:

2116

pidfile = open(pidfilename, "w")

2117

except IOError:

2118

logger.error("Could not open file %r", pidfilename)

1711

pidfilename = u"/var/run/mandos.pid"

1712

try:

1713

pidfile = open(pidfilename, u"w")

1714

except IOError:

1715

logger.error(u"Could not open file %r", pidfilename)

2119

1716

2120

1717

try:

2121

uid = pwd.getpwnam("_mandos").pw_uid

2122

gid = pwd.getpwnam("_mandos").pw_gid

1718

uid = pwd.getpwnam(u"_mandos").pw_uid

1719

gid = pwd.getpwnam(u"_mandos").pw_gid

2123

1720

except KeyError:

2124

1721

try:

2125

uid = pwd.getpwnam("mandos").pw_uid

2126

gid = pwd.getpwnam("mandos").pw_gid

1722

uid = pwd.getpwnam(u"mandos").pw_uid

1723

gid = pwd.getpwnam(u"mandos").pw_gid

2127

1724

except KeyError:

2128

1725

try:

2129

uid = pwd.getpwnam("nobody").pw_uid

2130

gid = pwd.getpwnam("nobody").pw_gid

1726

uid = pwd.getpwnam(u"nobody").pw_uid

1727

gid = pwd.getpwnam(u"nobody").pw_gid

2131

1728

except KeyError:

2132

1729

uid = 65534

2133

1730

gid = 65534

2134

1731

try:

2135

1732

os.setgid(gid)

2136

1733

os.setuid(uid)

2137

except OSError as error:

1734

except OSError, error:

2138

1735

if error[0] != errno.EPERM:

2139

1736

raise error

2140

1737

1738

# Enable all possible GnuTLS debugging

2141

1739

if debug:

2142

# Enable all possible GnuTLS debugging

2143

2144

1740

# "Use a log level over 10 to enable all debugging options."

2145

1741

# - GnuTLS manual

2146

1742

gnutls.library.functions.gnutls_global_set_log_level(11)

2147

1743

2148

1744

@gnutls.library.types.gnutls_log_func

2149

1745

def debug_gnutls(level, string):

2150

logger.debug("GnuTLS: %s", string[:-1])

1746

logger.debug(u"GnuTLS: %s", string[:-1])

2151

1747

2152

1748

(gnutls.library.functions

2153

1749

.gnutls_global_set_log_function(debug_gnutls))

2154

2155

# Redirect stdin so all checkers get /dev/null

2156

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2157

os.dup2(null, sys.stdin.fileno())

2158

if null > 2:

2159

os.close(null)

2160

2161

# Need to fork before connecting to D-Bus

2162

if not debug:

2163

# Close all input and output, do double fork, etc.

2164

daemon()

2165

2166

gobject.threads_init()

2167

1750

2168

1751

global main_loop

2169

1752

# From the Avahi example code

2173

1756

# End of Avahi example code

2174

1757

if use_dbus:

2175

1758

try:

2176

bus_name = dbus.service.BusName("se.recompile.Mandos",

1759

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2177

1760

bus, do_not_queue=True)

2178

old_bus_name = (dbus.service.BusName

2179

("se.bsnet.fukt.Mandos", bus,

2180

do_not_queue=True))

2181

except dbus.exceptions.NameExistsException as e:

2182

logger.error(unicode(e) + ", disabling D-Bus")

1761

except dbus.exceptions.NameExistsException, e:

1762

logger.error(unicode(e) + u", disabling D-Bus")

2183

1763

use_dbus = False

2184

server_settings["use_dbus"] = False

1764

server_settings[u"use_dbus"] = False

2185

1765

tcp_server.use_dbus = False

2186

1766

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2187

service = AvahiServiceToSyslog(name =

2188

server_settings["servicename"],

2189

servicetype = "_mandos._tcp",

2190

protocol = protocol, bus = bus)

1767

service = AvahiService(name = server_settings[u"servicename"],

1768

servicetype = u"_mandos._tcp",

1769

protocol = protocol, bus = bus)

2191

1770

if server_settings["interface"]:

2192

1771

service.interface = (if_nametoindex

2193

(str(server_settings["interface"])))

2194

2195

global multiprocessing_manager

2196

multiprocessing_manager = multiprocessing.Manager()

1772

(str(server_settings[u"interface"])))

2197

1773

2198

1774

client_class = Client

2199

1775

if use_dbus:

2200

client_class = functools.partial(ClientDBusTransitional,

2201

bus = bus)

2202

2203

client_settings = Client.config_parser(client_config)

2204

old_client_settings = {}

2205

clients_data = {}

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

except EOFError as e:

2220

logger.warning("Could not load persistent state: "

2221

"EOFError: {0}".format(e))

2222

2223

with PGPEngine() as pgp:

2224

for client_name, client in clients_data.iteritems():

2225

# Decide which value to use after restoring saved state.

2226

# We have three different values: Old config file,

2227

# new config file, and saved state.

2228

# New config value takes precedence if it differs from old

2229

# config value, otherwise use saved state.

2230

for name, value in client_settings[client_name].items():

2231

try:

2232

# For each value in new config, check if it

2233

# differs from the old config value (Except for

2234

# the "secret" attribute)

2235

if (name != "secret" and

2236

value != old_client_settings[client_name]

2237

[name]):

2238

client[name] = value

2239

except KeyError:

2240

pass

2241

2242

# Clients who has passed its expire date can still be

2243

# enabled if its last checker was successful. Clients

2244

# whose checker failed before we stored its state is

2245

# assumed to have failed all checkers during downtime.

2246

if client["enabled"]:

2247

if datetime.datetime.utcnow() >= client["expires"]:

2248

if not client["last_checked_ok"]:

2249

logger.warning(

2250

"disabling client {0} - Client never "

2251

"performed a successfull checker"

2252

.format(client["name"]))

2253

client["enabled"] = False

2254

elif client["last_checker_status"] != 0:

2255

logger.warning(

2256

"disabling client {0} - Client "

2257

"last checker failed with error code {1}"

2258

.format(client["name"],

2259

client["last_checker_status"]))

2260

client["enabled"] = False

2261

else:

2262

client["expires"] = (datetime.datetime

2263

.utcnow()

2264

+ client["timeout"])

2265

1776

client_class = functools.partial(ClientDBus, bus = bus)

1777

def client_config_items(config, section):

1778

special_settings = {

1779

"approved_by_default":

1780

lambda: config.getboolean(section,

1781

"approved_by_default"),

1782

}

1783

for name, value in config.items(section):

2266

1784

try:

2267

client["secret"] = (

2268

pgp.decrypt(client["encrypted_secret"],

2269

client_settings[client_name]

2270

["secret"]))

2271

except PGPError:

2272

# If decryption fails, we use secret from new settings

2273

logger.debug("Failed to decrypt {0} old secret"

2274

.format(client_name))

2275

client["secret"] = (

2276

client_settings[client_name]["secret"])

2277

2278

2279

# Add/remove clients based on new changes made to config

2280

for client_name in set(old_client_settings) - set(client_settings):

2281

del clients_data[client_name]

2282

for client_name in set(client_settings) - set(old_client_settings):

2283

clients_data[client_name] = client_settings[client_name]

2284

2285

# Create clients all clients

2286

for client_name, client in clients_data.iteritems():

2287

tcp_server.clients[client_name] = client_class(

2288

name = client_name, settings = client)

2289

1785

yield (name, special_settings[name]())

1786

except KeyError:

1787

yield (name, value)

1788

1789

tcp_server.clients.update(set(

1790

client_class(name = section,

1791

config= dict(client_config_items(

1792

client_config, section)))

1793

for section in client_config.sections()))

2290

1794

if not tcp_server.clients:

2291

logger.warning("No clients defined")

2292

1795

logger.warning(u"No clients defined")

1796

1797

if debug:

1798

# Redirect stdin so all checkers get /dev/null

1799

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1800

os.dup2(null, sys.stdin.fileno())

1801

if null > 2:

1802

os.close(null)

1803

else:

1804

# No console logging

1805

logger.removeHandler(console)

1806

# Close all input and output, do double fork, etc.

1807

daemon()

1808

1809

try:

1810

with pidfile:

1811

pid = os.getpid()

1812

pidfile.write(str(pid) + "\n")

1813

del pidfile

1814

except IOError:

1815

logger.error(u"Could not write to file %r with PID %d",

1816

pidfilename, pid)

1817

except NameError:

1818

# "pidfile" was never created

1819

pass

1820

del pidfilename

1821

2293

1822

if not debug:

2294

try:

2295

with pidfile:

2296

pid = os.getpid()

2297

pidfile.write(str(pid) + "\n".encode("utf-8"))

2298

del pidfile

2299

except IOError:

2300

logger.error("Could not write to file %r with PID %d",

2301

pidfilename, pid)

2302

except NameError:

2303

# "pidfile" was never created

2304

pass

2305

del pidfilename

2306

1823

signal.signal(signal.SIGINT, signal.SIG_IGN)

2307

2308

1824

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2309

1825

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2310

1826

2312

1828

class MandosDBusService(dbus.service.Object):

2313

1829

"""A D-Bus proxy object"""

2314

1830

def __init__(self):

2315

dbus.service.Object.__init__(self, bus, "/")

2316

_interface = "se.recompile.Mandos"

1831

dbus.service.Object.__init__(self, bus, u"/")

1832

_interface = u"se.bsnet.fukt.Mandos"

2317

1833

2318

@dbus.service.signal(_interface, signature="o")

1834

@dbus.service.signal(_interface, signature=u"o")

2319

1835

def ClientAdded(self, objpath):

2320

1836

"D-Bus signal"

2321

1837

pass

2322

1838

2323

@dbus.service.signal(_interface, signature="ss")

1839

@dbus.service.signal(_interface, signature=u"ss")

2324

1840

def ClientNotFound(self, fingerprint, address):

2325

1841

"D-Bus signal"

2326

1842

pass

2327

1843

2328

@dbus.service.signal(_interface, signature="os")

1844

@dbus.service.signal(_interface, signature=u"os")

2329

1845

def ClientRemoved(self, objpath, name):

2330

1846

"D-Bus signal"

2331

1847

pass

2332

1848

2333

@dbus.service.method(_interface, out_signature="ao")

1849

@dbus.service.method(_interface, out_signature=u"ao")

2334

1850

def GetAllClients(self):

2335

1851

"D-Bus method"

2336

1852

return dbus.Array(c.dbus_object_path

2337

for c in

2338

tcp_server.clients.itervalues())

1853

for c in tcp_server.clients)

2339

1854

2340

1855

@dbus.service.method(_interface,

2341

out_signature="a{oa{sv}}")

1856

out_signature=u"a{oa{sv}}")

2342

1857

def GetAllClientsWithProperties(self):

2343

1858

"D-Bus method"

2344

1859

return dbus.Dictionary(

2345

((c.dbus_object_path, c.GetAll(""))

2346

for c in tcp_server.clients.itervalues()),

2347

signature="oa{sv}")

1860

((c.dbus_object_path, c.GetAll(u""))

1861

for c in tcp_server.clients),

1862

signature=u"oa{sv}")

2348

1863

2349

@dbus.service.method(_interface, in_signature="o")

1864

@dbus.service.method(_interface, in_signature=u"o")

2350

1865

def RemoveClient(self, object_path):

2351

1866

"D-Bus method"

2352

for c in tcp_server.clients.itervalues():

1867

for c in tcp_server.clients:

2353

1868

if c.dbus_object_path == object_path:

2354

del tcp_server.clients[c.name]

1869

tcp_server.clients.remove(c)

2355

1870

c.remove_from_connection()

2356

1871

# Don't signal anything except ClientRemoved

2357

1872

c.disable(quiet=True)

2362

1877

2363

1878

del _interface

2364

1879

2365

class MandosDBusServiceTransitional(MandosDBusService):

2366

__metaclass__ = AlternateDBusNamesMetaclass

2367

mandos_dbus_service = MandosDBusServiceTransitional()

1880

mandos_dbus_service = MandosDBusService()

2368

1881

2369

1882

def cleanup():

2370

1883

"Cleanup function; run on exit"

2371

1884

service.cleanup()

2372

1885

2373

multiprocessing.active_children()

2374

if not (tcp_server.clients or client_settings):

2375

return

2376

2377

# Store client before exiting. Secrets are encrypted with key

2378

# based on what config file has. If config file is

2379

# removed/edited, old secret will thus be unrecovable.

2380

clients = {}

2381

with PGPEngine() as pgp:

2382

for client in tcp_server.clients.itervalues():

2383

key = client_settings[client.name]["secret"]

2384

client.encrypted_secret = pgp.encrypt(client.secret,

2385

key)

2386

client_dict = {}

2387

2388

# A list of attributes that can not be pickled

2389

# + secret.

2390

exclude = set(("bus", "changedstate", "secret",

2391

"checker"))

2392

for name, typ in (inspect.getmembers

2393

(dbus.service.Object)):

2394

exclude.add(name)

2395

2396

client_dict["encrypted_secret"] = (client

2397

.encrypted_secret)

2398

for attr in client.client_structure:

2399

if attr not in exclude:

2400

client_dict[attr] = getattr(client, attr)

2401

2402

clients[client.name] = client_dict

2403

del client_settings[client.name]["secret"]

2404

2405

try:

2406

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2407

prefix="clients-",

2408

dir=os.path.dirname

2409

(stored_state_path))

2410

with os.fdopen(tempfd, "wb") as stored_state:

2411

pickle.dump((clients, client_settings), stored_state)

2412

os.rename(tempname, stored_state_path)

2413

except (IOError, OSError) as e:

2414

logger.warning("Could not save persistent state: {0}"

2415

.format(e))

2416

if not debug:

2417

try:

2418

os.remove(tempname)

2419

except NameError:

2420

pass

2421

if e.errno not in set((errno.ENOENT, errno.EACCES,

2422

errno.EEXIST)):

2423

raise e

2424

2425

# Delete all clients, and settings from config

2426

1886

while tcp_server.clients:

2427

name, client = tcp_server.clients.popitem()

1887

client = tcp_server.clients.pop()

2428

1888

if use_dbus:

2429

1889

client.remove_from_connection()

1890

client.disable_hook = None

2430

1891

# Don't signal anything except ClientRemoved

2431

1892

client.disable(quiet=True)

2432

1893

if use_dbus:

2433

1894

# Emit D-Bus signal

2434

mandos_dbus_service.ClientRemoved(client

2435

.dbus_object_path,

1895

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2436

1896

client.name)

2437

client_settings.clear()

2438

1897

2439

1898

atexit.register(cleanup)

2440

1899

2441

for client in tcp_server.clients.itervalues():

1900

for client in tcp_server.clients:

2442

1901

if use_dbus:

2443

1902

# Emit D-Bus signal

2444

1903

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2445

# Need to initiate checking of clients

2446

if client.enabled:

2447

client.init_checker()

1904

client.enable()

2448

1905

2449

1906

tcp_server.enable()

2450

1907

tcp_server.server_activate()

2452

1909

# Find out what port we got

2453

1910

service.port = tcp_server.socket.getsockname()[1]

2454

1911

if use_ipv6:

2455

logger.info("Now listening on address %r, port %d,"

1912

logger.info(u"Now listening on address %r, port %d,"

2456

1913

" flowinfo %d, scope_id %d"

2457

1914

% tcp_server.socket.getsockname())

2458

1915

else: # IPv4

2459

logger.info("Now listening on address %r, port %d"

1916

logger.info(u"Now listening on address %r, port %d"

2460

1917

% tcp_server.socket.getsockname())

2461

1918

2462

1919

#service.interface = tcp_server.socket.getsockname()[3]

2465

1922

# From the Avahi example code

2466

1923

try:

2467

1924

service.activate()

2468

except dbus.exceptions.DBusException as error:

2469

logger.critical("DBusException: %s", error)

1925

except dbus.exceptions.DBusException, error:

1926

logger.critical(u"DBusException: %s", error)

2470

1927

cleanup()

2471

1928

sys.exit(1)

2472

1929

# End of Avahi example code

2476

1933

(tcp_server.handle_request

2477

1934

(*args[2:], **kwargs) or True))

2478

1935

2479

logger.debug("Starting main loop")

1936

logger.debug(u"Starting main loop")

2480

1937

main_loop.run()

2481

except AvahiError as error:

2482

logger.critical("AvahiError: %s", error)

1938

except AvahiError, error:

1939

logger.critical(u"AvahiError: %s", error)

2483

1940

cleanup()

2484

1941

sys.exit(1)

2485

1942

except KeyboardInterrupt:

2486

1943

if debug:

2487

print("", file=sys.stderr)

2488

logger.debug("Server received KeyboardInterrupt")

2489

logger.debug("Server exiting")

1944

print >> sys.stderr

1945

logger.debug(u"Server received KeyboardInterrupt")

1946

logger.debug(u"Server exiting")

2490

1947

# Must run before the D-Bus bus name gets deregistered

2491

1948

cleanup()

2492

1949