/mandos/trunk : revision 24.2.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

64

69

65

import dbus

70

66

import dbus.service

75

71

import ctypes.util

76

72

import xml.dom.minidom

77

73

import inspect

78

import GnuPGInterface

79

74

80

75

try:

81

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

80

except ImportError:

86

81

SO_BINDTODEVICE = None

87

82

88

version = "1.4.1"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

83

84

version = "1.0.14"

85

86

logger = logging.Logger(u'mandos')

92

87

syslogger = (logging.handlers.SysLogHandler

93

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

210

89

address = "/dev/log"))

90

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

93

logger.addHandler(syslogger)

94

95

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

logger.addHandler(console)

100

101

multiprocessing_manager = multiprocessing.Manager()

211

102

212

103

class AvahiError(Exception):

213

104

def __init__(self, value, *args, **kwargs):

229

120

Attributes:

230

121

interface: integer; avahi.IF_UNSPEC or an interface index.

231

122

Used to optionally bind to the specified interface.

232

233

type: string; Example: '_mandos._tcp'.

123

124

type: string; Example: u'_mandos._tcp'.

234

125

See <http://www.dns-sd.org/ServiceTypes.html>

235

126

port: integer; what port to announce

236

127

TXT: list of strings; TXT record for the service

245

136

"""

246

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

247

138

servicetype = None, port = None, TXT = None,

248

domain = "", host = "", max_renames = 32768,

139

domain = u"", host = u"", max_renames = 32768,

249

140

protocol = avahi.PROTO_UNSPEC, bus = None):

250

141

self.interface = interface

251

142

self.name = name

260

151

self.group = None # our entry group

261

152

self.server = None

262

153

self.bus = bus

263

self.entry_group_state_changed_match = None

264

154

def rename(self):

265

155

"""Derived from the Avahi example code"""

266

156

if self.rename_count >= self.max_renames:

267

logger.critical("No suitable Zeroconf service name found"

268

" after %i retries, exiting.",

157

logger.critical(u"No suitable Zeroconf service name found"

158

u" after %i retries, exiting.",

269

159

self.rename_count)

270

raise AvahiServiceError("Too many renames")

271

self.name = unicode(self.server

272

.GetAlternativeServiceName(self.name))

273

logger.info("Changing Zeroconf service name to %r ...",

274

self.name)

160

raise AvahiServiceError(u"Too many renames")

161

self.name = self.server.GetAlternativeServiceName(self.name)

162

logger.info(u"Changing Zeroconf service name to %r ...",

163

unicode(self.name))

164

syslogger.setFormatter(logging.Formatter

165

(u'Mandos (%s) [%%(process)d]:'

166

u' %%(levelname)s: %%(message)s'

167

% self.name))

275

168

self.remove()

276

try:

277

self.add()

278

except dbus.exceptions.DBusException as error:

279

logger.critical("DBusException: %s", error)

280

self.cleanup()

281

os._exit(1)

169

self.add()

282

170

self.rename_count += 1

283

171

def remove(self):

284

172

"""Derived from the Avahi example code"""

285

if self.entry_group_state_changed_match is not None:

286

self.entry_group_state_changed_match.remove()

287

self.entry_group_state_changed_match = None

288

173

if self.group is not None:

289

174

self.group.Reset()

290

175

def add(self):

291

176

"""Derived from the Avahi example code"""

292

self.remove()

293

177

if self.group is None:

294

178

self.group = dbus.Interface(

295

179

self.bus.get_object(avahi.DBUS_NAME,

296

180

self.server.EntryGroupNew()),

297

181

avahi.DBUS_INTERFACE_ENTRY_GROUP)

298

self.entry_group_state_changed_match = (

299

self.group.connect_to_signal(

300

'StateChanged', self.entry_group_state_changed))

301

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

self.group.connect_to_signal('StateChanged',

183

self

184

.entry_group_state_changed)

185

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

302

186

self.name, self.type)

303

187

self.group.AddService(

304

188

self.interface,

311

195

self.group.Commit()

312

196

def entry_group_state_changed(self, state, error):

313

197

"""Derived from the Avahi example code"""

314

logger.debug("Avahi entry group state change: %i", state)

198

logger.debug(u"Avahi state change: %i", state)

315

199

316

200

if state == avahi.ENTRY_GROUP_ESTABLISHED:

317

logger.debug("Zeroconf service established.")

201

logger.debug(u"Zeroconf service established.")

318

202

elif state == avahi.ENTRY_GROUP_COLLISION:

319

logger.info("Zeroconf service name collision.")

203

logger.warning(u"Zeroconf service name collision.")

320

204

self.rename()

321

205

elif state == avahi.ENTRY_GROUP_FAILURE:

322

logger.critical("Avahi: Error in group state changed %s",

206

logger.critical(u"Avahi: Error in group state changed %s",

323

207

unicode(error))

324

raise AvahiGroupError("State changed: %s"

208

raise AvahiGroupError(u"State changed: %s"

325

209

% unicode(error))

326

210

def cleanup(self):

327

211

"""Derived from the Avahi example code"""

328

212

if self.group is not None:

329

try:

330

self.group.Free()

331

except (dbus.exceptions.UnknownMethodException,

332

dbus.exceptions.DBusException):

333

pass

213

self.group.Free()

334

214

self.group = None

335

self.remove()

336

def server_state_changed(self, state, error=None):

215

def server_state_changed(self, state):

337

216

"""Derived from the Avahi example code"""

338

logger.debug("Avahi server state change: %i", state)

339

bad_states = { avahi.SERVER_INVALID:

340

"Zeroconf server invalid",

341

avahi.SERVER_REGISTERING: None,

342

avahi.SERVER_COLLISION:

343

"Zeroconf server name collision",

344

avahi.SERVER_FAILURE:

345

"Zeroconf server failure" }

346

if state in bad_states:

347

if bad_states[state] is not None:

348

if error is None:

349

logger.error(bad_states[state])

350

else:

351

logger.error(bad_states[state] + ": %r", error)

352

self.cleanup()

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

353

220

elif state == avahi.SERVER_RUNNING:

354

221

self.add()

355

else:

356

if error is None:

357

logger.debug("Unknown state: %r", state)

358

else:

359

logger.debug("Unknown state: %r: %r", state, error)

360

222

def activate(self):

361

223

"""Derived from the Avahi example code"""

362

224

if self.server is None:

363

225

self.server = dbus.Interface(

364

226

self.bus.get_object(avahi.DBUS_NAME,

365

avahi.DBUS_PATH_SERVER,

366

follow_name_owner_changes=True),

227

avahi.DBUS_PATH_SERVER),

367

228

avahi.DBUS_INTERFACE_SERVER)

368

self.server.connect_to_signal("StateChanged",

229

self.server.connect_to_signal(u"StateChanged",

369

230

self.server_state_changed)

370

231

self.server_state_changed(self.server.GetState())

371

232

372

class AvahiServiceToSyslog(AvahiService):

373

def rename(self):

374

"""Add the new name to the syslog messages"""

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

380

return ret

381

233

382

def timedelta_to_milliseconds(td):

383

"Convert a datetime.timedelta() to milliseconds"

384

return ((td.days * 24 * 60 * 60 * 1000)

385

+ (td.seconds * 1000)

386

+ (td.microseconds // 1000))

387

388

234

class Client(object):

389

235

"""A representation of a client host served by this server.

390

236

391

237

Attributes:

392

approved: bool(); 'None' if not yet approved/disapproved

393

approval_delay: datetime.timedelta(); Time to wait for approval

394

approval_duration: datetime.timedelta(); Duration of one approval

238

239

D-Bus identifiers

240

fingerprint: string (40 or 32 hexadecimal digits); used to

241

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

245

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

248

timeout: datetime.timedelta(); How long from last_checked_ok

249

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

395

252

checker: subprocess.Popen(); a running checker process used

396

253

to see if the client lives.

397

254

'None' if no process is running.

398

checker_callback_tag: a gobject event source tag, or None

399

checker_command: string; External command which is run to check

400

if client lives. %() expansions are done at

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

401

260

runtime with vars(self) as dict, so that for

402

261

instance %(name)s can be used in the command.

403

checker_initiator_tag: a gobject event source tag, or None

404

created: datetime.datetime(); (UTC) object creation

405

client_structure: Object describing what attributes a client has

406

and is used for storing the client at exit

407

262

current_checker_command: string; current running checker_command

408

disable_initiator_tag: a gobject event source tag, or None

409

enabled: bool()

410

fingerprint: string (40 or 32 hexadecimal digits); used to

411

uniquely identify the client

412

host: string; available for use by the checker command

413

interval: datetime.timedelta(); How often to start a new checker

414

last_approval_request: datetime.datetime(); (UTC) or None

415

last_checked_ok: datetime.datetime(); (UTC) or None

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, or None.

419

last_enabled: datetime.datetime(); (UTC) or None

420

421

D-Bus identifiers

422

secret: bytestring; sent verbatim (over TLS) to client

423

timeout: datetime.timedelta(); How long from last_checked_ok

424

until this client is disabled

425

extended_timeout: extra long timeout when password has been sent

426

runtime_expansions: Allowed attributes for runtime expansion.

427

expires: datetime.datetime(); time (UTC) when a client will be

428

disabled, or None

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

429

266

"""

430

267

431

runtime_expansions = ("approval_delay", "approval_duration",

432

"created", "enabled", "fingerprint",

433

"host", "interval", "last_checked_ok",

434

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

268

@staticmethod

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

445

274

446

275

def timeout_milliseconds(self):

447

276

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

449

450

def extended_timeout_milliseconds(self):

451

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

277

return self._timedelta_to_milliseconds(self.timeout)

453

278

454

279

def interval_milliseconds(self):

455

280

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

457

285

458

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

""" Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above"""

466

settings = {}

467

for client_name in config.sections():

468

section = dict(config.items(client_name))

469

client = settings[client_name] = {}

470

471

client["host"] = section["host"]

472

# Reformat values from string types to Python types

473

client["approved_by_default"] = config.getboolean(

474

client_name, "approved_by_default")

475

client["enabled"] = config.getboolean(client_name, "enabled")

476

477

client["fingerprint"] = (section["fingerprint"].upper()

478

.replace(" ", ""))

479

if "secret" in section:

480

client["secret"] = section["secret"].decode("base64")

481

elif "secfile" in section:

482

with open(os.path.expanduser(os.path.expandvars

483

(section["secfile"])),

484

"rb") as secfile:

485

client["secret"] = secfile.read()

486

else:

487

raise TypeError("No secret or secfile for section %s"

488

% section)

489

client["timeout"] = string_to_delta(section["timeout"])

490

client["extended_timeout"] = string_to_delta(

491

section["extended_timeout"])

492

client["interval"] = string_to_delta(section["interval"])

493

client["approval_delay"] = string_to_delta(

494

section["approval_delay"])

495

client["approval_duration"] = string_to_delta(

496

section["approval_duration"])

497

client["checker_command"] = section["checker"]

498

client["last_approval_request"] = None

499

client["last_checked_ok"] = None

500

client["last_checker_status"] = None

501

if client["enabled"]:

502

client["last_enabled"] = datetime.datetime.utcnow()

503

client["expires"] = (datetime.datetime.utcnow()

504

+ client["timeout"])

505

else:

506

client["last_enabled"] = None

507

client["expires"] = None

508

509

return settings

510

511

512

def __init__(self, settings, name = None):

286

def __init__(self, name = None, disable_hook=None, config=None):

513

287

"""Note: the 'checker' key in 'config' sets the

514

288

'checker_command' attribute and *not* the 'checker'

515

289

attribute."""

516

290

self.name = name

517

# adding all client settings

518

for setting, value in settings.iteritems():

519

setattr(self, setting, value)

520

521

logger.debug("Creating client %r", self.name)

291

if config is None:

292

config = {}

293

logger.debug(u"Creating client %r", self.name)

522

294

# Uppercase and remove spaces from fingerprint for later

523

295

# comparison purposes with return value from the fingerprint()

524

296

# function

525

logger.debug(" Fingerprint: %s", self.fingerprint)

526

self.created = settings.get("created", datetime.datetime.utcnow())

527

528

# attributes specific for this server instance

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

303

with open(os.path.expanduser(os.path.expandvars

304

(config[u"secfile"])),

305

"rb") as secfile:

306

self.secret = secfile.read()

307

else:

308

#XXX Need to allow secret on demand!

309

raise TypeError(u"No secret or secfile for client %s"

310

% self.name)

311

self.host = config.get(u"host", u"")

312

self.created = datetime.datetime.utcnow()

313

self.enabled = False

314

self.last_enabled = None

315

self.last_checked_ok = None

316

self.timeout = string_to_delta(config[u"timeout"])

317

self.interval = string_to_delta(config[u"interval"])

318

self.disable_hook = disable_hook

529

319

self.checker = None

530

320

self.checker_initiator_tag = None

531

321

self.disable_initiator_tag = None

532

322

self.checker_callback_tag = None

323

self.checker_command = config[u"checker"]

533

324

self.current_checker_command = None

534

self.approved = None

325

self.last_connect = None

535

326

self.approvals_pending = 0

536

self.changedstate = (multiprocessing_manager

537

.Condition(multiprocessing_manager

538

.Lock()))

539

self.client_structure = [attr for attr in

540

self.__dict__.iterkeys()

541

if not attr.startswith("_")]

542

self.client_structure.append("client_structure")

543

544

for name, t in inspect.getmembers(type(self),

545

lambda obj:

546

isinstance(obj,

547

property)):

548

if not name.startswith("_"):

549

self.client_structure.append(name)

550

551

# Send notice to process children that client state has changed

327

self._approved = None

328

self.approved_by_default = config.get(u"approved_by_default",

329

True)

330

self.approved_delay = string_to_delta(

331

config[u"approved_delay"])

332

self.approved_duration = string_to_delta(

333

config[u"approved_duration"])

334

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

335

552

336

def send_changedstate(self):

553

with self.changedstate:

554

self.changedstate.notify_all()

555

337

self.changedstate.acquire()

338

self.changedstate.notify_all()

339

self.changedstate.release()

340

556

341

def enable(self):

557

342

"""Start this client's checker and timeout hooks"""

558

if getattr(self, "enabled", False):

343

if getattr(self, u"enabled", False):

559

344

# Already enabled

560

345

return

561

346

self.send_changedstate()

562

self.expires = datetime.datetime.utcnow() + self.timeout

563

self.enabled = True

564

347

self.last_enabled = datetime.datetime.utcnow()

565

self.init_checker()

566

567

def disable(self, quiet=True):

568

"""Disable this client."""

569

if not getattr(self, "enabled", False):

570

return False

571

if not quiet:

572

self.send_changedstate()

573

if not quiet:

574

logger.info("Disabling client %s", self.name)

575

if getattr(self, "disable_initiator_tag", False):

576

gobject.source_remove(self.disable_initiator_tag)

577

self.disable_initiator_tag = None

578

self.expires = None

579

if getattr(self, "checker_initiator_tag", False):

580

gobject.source_remove(self.checker_initiator_tag)

581

self.checker_initiator_tag = None

582

self.stop_checker()

583

self.enabled = False

584

# Do not run this again if called by a gobject.timeout_add

585

return False

586

587

def __del__(self):

588

self.disable()

589

590

def init_checker(self):

591

348

# Schedule a new checker to be started an 'interval' from now,

592

349

# and every interval from then on.

593

350

self.checker_initiator_tag = (gobject.timeout_add

597

354

self.disable_initiator_tag = (gobject.timeout_add

598

355

(self.timeout_milliseconds(),

599

356

self.disable))

357

self.enabled = True

600

358

# Also start a new checker *right now*.

601

359

self.start_checker()

602

360

361

def disable(self, quiet=True):

362

"""Disable this client."""

363

if not getattr(self, "enabled", False):

364

return False

365

if not quiet:

366

self.send_changedstate()

367

if not quiet:

368

logger.info(u"Disabling client %s", self.name)

369

if getattr(self, u"disable_initiator_tag", False):

370

gobject.source_remove(self.disable_initiator_tag)

371

self.disable_initiator_tag = None

372

if getattr(self, u"checker_initiator_tag", False):

373

gobject.source_remove(self.checker_initiator_tag)

374

self.checker_initiator_tag = None

375

self.stop_checker()

376

if self.disable_hook:

377

self.disable_hook(self)

378

self.enabled = False

379

# Do not run this again if called by a gobject.timeout_add

380

return False

381

382

def __del__(self):

383

self.disable_hook = None

384

self.disable()

385

603

386

def checker_callback(self, pid, condition, command):

604

387

"""The checker has completed, so take appropriate actions."""

605

388

self.checker_callback_tag = None

606

389

self.checker = None

607

390

if os.WIFEXITED(condition):

608

self.last_checker_status = os.WEXITSTATUS(condition)

609

if self.last_checker_status == 0:

610

logger.info("Checker for %(name)s succeeded",

391

exitstatus = os.WEXITSTATUS(condition)

392

if exitstatus == 0:

393

logger.info(u"Checker for %(name)s succeeded",

611

394

vars(self))

612

395

self.checked_ok()

613

396

else:

614

logger.info("Checker for %(name)s failed",

397

logger.info(u"Checker for %(name)s failed",

615

398

vars(self))

616

399

else:

617

self.last_checker_status = -1

618

logger.warning("Checker for %(name)s crashed?",

400

logger.warning(u"Checker for %(name)s crashed?",

619

401

vars(self))

620

402

621

def checked_ok(self, timeout=None):

403

def checked_ok(self):

622

404

"""Bump up the timeout for this client.

623

405

624

406

This should only be called when the client has been seen,

625

407

alive and well.

626

408

"""

627

if timeout is None:

628

timeout = self.timeout

629

409

self.last_checked_ok = datetime.datetime.utcnow()

630

if self.disable_initiator_tag is not None:

631

gobject.source_remove(self.disable_initiator_tag)

632

if getattr(self, "enabled", False):

633

self.disable_initiator_tag = (gobject.timeout_add

634

(timedelta_to_milliseconds

635

(timeout), self.disable))

636

self.expires = datetime.datetime.utcnow() + timeout

637

638

def need_approval(self):

639

self.last_approval_request = datetime.datetime.utcnow()

410

gobject.source_remove(self.disable_initiator_tag)

411

self.disable_initiator_tag = (gobject.timeout_add

412

(self.timeout_milliseconds(),

413

self.disable))

640

414

641

415

def start_checker(self):

642

416

"""Start a new checker subprocess if one is not running.

655

429

# If a checker exists, make sure it is not a zombie

656

430

try:

657

431

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

658

except (AttributeError, OSError) as error:

432

except (AttributeError, OSError), error:

659

433

if (isinstance(error, OSError)

660

434

and error.errno != errno.ECHILD):

661

435

raise error

662

436

else:

663

437

if pid:

664

logger.warning("Checker was a zombie")

438

logger.warning(u"Checker was a zombie")

665

439

gobject.source_remove(self.checker_callback_tag)

666

440

self.checker_callback(pid, status,

667

441

self.current_checker_command)

672

446

command = self.checker_command % self.host

673

447

except TypeError:

674

448

# Escape attributes for the shell

675

escaped_attrs = dict(

676

(attr,

677

re.escape(unicode(str(getattr(self, attr, "")),

678

errors=

679

'replace')))

680

for attr in

681

self.runtime_expansions)

682

449

escaped_attrs = dict((key,

450

re.escape(unicode(str(val),

451

errors=

452

u'replace')))

453

for key, val in

454

vars(self).iteritems())

683

455

try:

684

456

command = self.checker_command % escaped_attrs

685

except TypeError as error:

686

logger.error('Could not format string "%s":'

687

' %s', self.checker_command, error)

457

except TypeError, error:

458

logger.error(u'Could not format string "%s":'

459

u' %s', self.checker_command, error)

688

460

return True # Try again later

689

461

self.current_checker_command = command

690

462

try:

691

logger.info("Starting checker %r for %s",

463

logger.info(u"Starting checker %r for %s",

692

464

command, self.name)

693

465

# We don't need to redirect stdout and stderr, since

694

466

# in normal mode, that is already done by daemon(),

696

468

# always replaced by /dev/null.)

697

469

self.checker = subprocess.Popen(command,

698

470

close_fds=True,

699

shell=True, cwd="/")

471

shell=True, cwd=u"/")

700

472

self.checker_callback_tag = (gobject.child_watch_add

701

473

(self.checker.pid,

702

474

self.checker_callback,

707

479

if pid:

708

480

gobject.source_remove(self.checker_callback_tag)

709

481

self.checker_callback(pid, status, command)

710

except OSError as error:

711

logger.error("Failed to start subprocess: %s",

482

except OSError, error:

483

logger.error(u"Failed to start subprocess: %s",

712

484

error)

713

485

# Re-run this periodically if run by gobject.timeout_add

714

486

return True

718

490

if self.checker_callback_tag:

719

491

gobject.source_remove(self.checker_callback_tag)

720

492

self.checker_callback_tag = None

721

if getattr(self, "checker", None) is None:

493

if getattr(self, u"checker", None) is None:

722

494

return

723

logger.debug("Stopping checker for %(name)s", vars(self))

495

logger.debug(u"Stopping checker for %(name)s", vars(self))

724

496

try:

725

497

os.kill(self.checker.pid, signal.SIGTERM)

726

498

#time.sleep(0.5)

727

499

#if self.checker.poll() is None:

728

500

# os.kill(self.checker.pid, signal.SIGKILL)

729

except OSError as error:

501

except OSError, error:

730

502

if error.errno != errno.ESRCH: # No such process

731

503

raise

732

504

self.checker = None

733

505

734

735

def dbus_service_property(dbus_interface, signature="v",

736

access="readwrite", byte_arrays=False):

506

def dbus_service_property(dbus_interface, signature=u"v",

507

access=u"readwrite", byte_arrays=False):

737

508

"""Decorators for marking methods of a DBusObjectWithProperties to

738

509

become properties on the D-Bus.

739

510

746

517

"""

747

518

# Encoding deeply encoded byte arrays is not supported yet by the

748

519

# "Set" method, so we fail early here:

749

if byte_arrays and signature != "ay":

750

raise ValueError("Byte arrays not supported for non-'ay'"

751

" signature %r" % signature)

520

if byte_arrays and signature != u"ay":

521

raise ValueError(u"Byte arrays not supported for non-'ay'"

522

u" signature %r" % signature)

752

523

def decorator(func):

753

524

func._dbus_is_property = True

754

525

func._dbus_interface = dbus_interface

755

526

func._dbus_signature = signature

756

527

func._dbus_access = access

757

528

func._dbus_name = func.__name__

758

if func._dbus_name.endswith("_dbus_property"):

529

if func._dbus_name.endswith(u"_dbus_property"):

759

530

func._dbus_name = func._dbus_name[:-14]

760

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

531

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

761

532

return func

762

533

return decorator

763

534

783

554

784

555

class DBusObjectWithProperties(dbus.service.Object):

785

556

"""A D-Bus object with properties.

786

557

787

558

Classes inheriting from this can use the dbus_service_property

788

559

decorator to expose methods as D-Bus properties. It exposes the

789

560

standard Get(), Set(), and GetAll() methods on the D-Bus.

791

562

792

563

@staticmethod

793

564

def _is_dbus_property(obj):

794

return getattr(obj, "_dbus_is_property", False)

565

return getattr(obj, u"_dbus_is_property", False)

795

566

796

567

def _get_all_dbus_properties(self):

797

568

"""Returns a generator of (name, attribute) pairs

798

569

"""

799

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

800

for cls in self.__class__.__mro__

570

return ((prop._dbus_name, prop)

801

571

for name, prop in

802

inspect.getmembers(cls, self._is_dbus_property))

572

inspect.getmembers(self, self._is_dbus_property))

803

573

804

574

def _get_dbus_property(self, interface_name, property_name):

805

575

"""Returns a bound method if one exists which is a D-Bus

806

576

property with the specified name and interface.

807

577

"""

808

for cls in self.__class__.__mro__:

809

for name, value in (inspect.getmembers

810

(cls, self._is_dbus_property)):

811

if (value._dbus_name == property_name

812

and value._dbus_interface == interface_name):

813

return value.__get__(self)

814

578

for name in (property_name,

579

property_name + u"_dbus_property"):

580

prop = getattr(self, name, None)

581

if (prop is None

582

or not self._is_dbus_property(prop)

583

or prop._dbus_name != property_name

584

or (interface_name and prop._dbus_interface

585

and interface_name != prop._dbus_interface)):

586

continue

587

return prop

815

588

# No such property

816

raise DBusPropertyNotFound(self.dbus_object_path + ":"

817

+ interface_name + "."

589

raise DBusPropertyNotFound(self.dbus_object_path + u":"

590

+ interface_name + u"."

818

591

+ property_name)

819

592

820

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

821

out_signature="v")

593

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

594

out_signature=u"v")

822

595

def Get(self, interface_name, property_name):

823

596

"""Standard D-Bus property Get() method, see D-Bus standard.

824

597

"""

825

598

prop = self._get_dbus_property(interface_name, property_name)

826

if prop._dbus_access == "write":

599

if prop._dbus_access == u"write":

827

600

raise DBusPropertyAccessException(property_name)

828

601

value = prop()

829

if not hasattr(value, "variant_level"):

602

if not hasattr(value, u"variant_level"):

830

603

return value

831

604

return type(value)(value, variant_level=value.variant_level+1)

832

605

833

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

606

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

834

607

def Set(self, interface_name, property_name, value):

835

608

"""Standard D-Bus property Set() method, see D-Bus standard.

836

609

"""

837

610

prop = self._get_dbus_property(interface_name, property_name)

838

if prop._dbus_access == "read":

611

if prop._dbus_access == u"read":

839

612

raise DBusPropertyAccessException(property_name)

840

if prop._dbus_get_args_options["byte_arrays"]:

613

if prop._dbus_get_args_options[u"byte_arrays"]:

841

614

# The byte_arrays option is not supported yet on

842

615

# signatures other than "ay".

843

if prop._dbus_signature != "ay":

616

if prop._dbus_signature != u"ay":

844

617

raise ValueError

845

618

value = dbus.ByteArray(''.join(unichr(byte)

846

619

for byte in value))

847

620

prop(value)

848

621

849

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

850

out_signature="a{sv}")

622

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

623

out_signature=u"a{sv}")

851

624

def GetAll(self, interface_name):

852

625

"""Standard D-Bus property GetAll() method, see D-Bus

853

626

standard.

854

627

855

628

Note: Will not include properties with access="write".

856

629

"""

857

properties = {}

630

all = {}

858

631

for name, prop in self._get_all_dbus_properties():

859

632

if (interface_name

860

633

and interface_name != prop._dbus_interface):

861

634

# Interface non-empty but did not match

862

635

continue

863

636

# Ignore write-only properties

864

if prop._dbus_access == "write":

637

if prop._dbus_access == u"write":

865

638

continue

866

639

value = prop()

867

if not hasattr(value, "variant_level"):

868

properties[name] = value

640

if not hasattr(value, u"variant_level"):

641

all[name] = value

869

642

continue

870

properties[name] = type(value)(value, variant_level=

871

value.variant_level+1)

872

return dbus.Dictionary(properties, signature="sv")

643

all[name] = type(value)(value, variant_level=

644

value.variant_level+1)

645

return dbus.Dictionary(all, signature=u"sv")

873

646

874

647

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

875

out_signature="s",

648

out_signature=u"s",

876

649

path_keyword='object_path',

877

650

connection_keyword='connection')

878

651

def Introspect(self, object_path, connection):

883

656

try:

884

657

document = xml.dom.minidom.parseString(xmlstring)

885

658

def make_tag(document, name, prop):

886

e = document.createElement("property")

887

e.setAttribute("name", name)

888

e.setAttribute("type", prop._dbus_signature)

889

e.setAttribute("access", prop._dbus_access)

659

e = document.createElement(u"property")

660

e.setAttribute(u"name", name)

661

e.setAttribute(u"type", prop._dbus_signature)

662

e.setAttribute(u"access", prop._dbus_access)

890

663

return e

891

for if_tag in document.getElementsByTagName("interface"):

664

for if_tag in document.getElementsByTagName(u"interface"):

892

665

for tag in (make_tag(document, name, prop)

893

666

for name, prop

894

667

in self._get_all_dbus_properties()

895

668

if prop._dbus_interface

896

== if_tag.getAttribute("name")):

669

== if_tag.getAttribute(u"name")):

897

670

if_tag.appendChild(tag)

898

671

# Add the names to the return values for the

899

672

# "org.freedesktop.DBus.Properties" methods

900

if (if_tag.getAttribute("name")

901

== "org.freedesktop.DBus.Properties"):

902

for cn in if_tag.getElementsByTagName("method"):

903

if cn.getAttribute("name") == "Get":

904

for arg in cn.getElementsByTagName("arg"):

905

if (arg.getAttribute("direction")

906

== "out"):

907

arg.setAttribute("name", "value")

908

elif cn.getAttribute("name") == "GetAll":

909

for arg in cn.getElementsByTagName("arg"):

910

if (arg.getAttribute("direction")

911

== "out"):

912

arg.setAttribute("name", "props")

913

xmlstring = document.toxml("utf-8")

673

if (if_tag.getAttribute(u"name")

674

== u"org.freedesktop.DBus.Properties"):

675

for cn in if_tag.getElementsByTagName(u"method"):

676

if cn.getAttribute(u"name") == u"Get":

677

for arg in cn.getElementsByTagName(u"arg"):

678

if (arg.getAttribute(u"direction")

679

== u"out"):

680

arg.setAttribute(u"name", u"value")

681

elif cn.getAttribute(u"name") == u"GetAll":

682

for arg in cn.getElementsByTagName(u"arg"):

683

if (arg.getAttribute(u"direction")

684

== u"out"):

685

arg.setAttribute(u"name", u"props")

686

xmlstring = document.toxml(u"utf-8")

914

687

document.unlink()

915

688

except (AttributeError, xml.dom.DOMException,

916

xml.parsers.expat.ExpatError) as error:

917

logger.error("Failed to override Introspection method",

689

xml.parsers.expat.ExpatError), error:

690

logger.error(u"Failed to override Introspection method",

918

691

error)

919

692

return xmlstring

920

693

921

694

922

def datetime_to_dbus (dt, variant_level=0):

923

"""Convert a UTC datetime.datetime() to a D-Bus type."""

924

if dt is None:

925

return dbus.String("", variant_level = variant_level)

926

return dbus.String(dt.isoformat(),

927

variant_level=variant_level)

928

929

930

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

931

.__metaclass__):

932

"""Applied to an empty subclass of a D-Bus object, this metaclass

933

will add additional D-Bus attributes matching a certain pattern.

934

"""

935

def __new__(mcs, name, bases, attr):

936

# Go through all the base classes which could have D-Bus

937

# methods, signals, or properties in them

938

for base in (b for b in bases

939

if issubclass(b, dbus.service.Object)):

940

# Go though all attributes of the base class

941

for attrname, attribute in inspect.getmembers(base):

942

# Ignore non-D-Bus attributes, and D-Bus attributes

943

# with the wrong interface name

944

if (not hasattr(attribute, "_dbus_interface")

945

or not attribute._dbus_interface

946

.startswith("se.recompile.Mandos")):

947

continue

948

# Create an alternate D-Bus interface name based on

949

# the current name

950

alt_interface = (attribute._dbus_interface

951

.replace("se.recompile.Mandos",

952

"se.bsnet.fukt.Mandos"))

953

# Is this a D-Bus signal?

954

if getattr(attribute, "_dbus_is_signal", False):

955

# Extract the original non-method function by

956

# black magic

957

nonmethod_func = (dict(

958

zip(attribute.func_code.co_freevars,

959

attribute.__closure__))["func"]

960

.cell_contents)

961

# Create a new, but exactly alike, function

962

# object, and decorate it to be a new D-Bus signal

963

# with the alternate D-Bus interface name

964

new_function = (dbus.service.signal

965

(alt_interface,

966

attribute._dbus_signature)

967

(types.FunctionType(

968

nonmethod_func.func_code,

969

nonmethod_func.func_globals,

970

nonmethod_func.func_name,

971

nonmethod_func.func_defaults,

972

nonmethod_func.func_closure)))

973

# Define a creator of a function to call both the

974

# old and new functions, so both the old and new

975

# signals gets sent when the function is called

976

def fixscope(func1, func2):

977

"""This function is a scope container to pass

978

func1 and func2 to the "call_both" function

979

outside of its arguments"""

980

def call_both(*args, **kwargs):

981

"""This function will emit two D-Bus

982

signals by calling func1 and func2"""

983

func1(*args, **kwargs)

984

func2(*args, **kwargs)

985

return call_both

986

# Create the "call_both" function and add it to

987

# the class

988

attr[attrname] = fixscope(attribute,

989

new_function)

990

# Is this a D-Bus method?

991

elif getattr(attribute, "_dbus_is_method", False):

992

# Create a new, but exactly alike, function

993

# object. Decorate it to be a new D-Bus method

994

# with the alternate D-Bus interface name. Add it

995

# to the class.

996

attr[attrname] = (dbus.service.method

997

(alt_interface,

998

attribute._dbus_in_signature,

999

attribute._dbus_out_signature)

1000

(types.FunctionType

1001

(attribute.func_code,

1002

attribute.func_globals,

1003

attribute.func_name,

1004

attribute.func_defaults,

1005

attribute.func_closure)))

1006

# Is this a D-Bus property?

1007

elif getattr(attribute, "_dbus_is_property", False):

1008

# Create a new, but exactly alike, function

1009

# object, and decorate it to be a new D-Bus

1010

# property with the alternate D-Bus interface

1011

# name. Add it to the class.

1012

attr[attrname] = (dbus_service_property

1013

(alt_interface,

1014

attribute._dbus_signature,

1015

attribute._dbus_access,

1016

attribute

1017

._dbus_get_args_options

1018

["byte_arrays"])

1019

(types.FunctionType

1020

(attribute.func_code,

1021

attribute.func_globals,

1022

attribute.func_name,

1023

attribute.func_defaults,

1024

attribute.func_closure)))

1025

return type.__new__(mcs, name, bases, attr)

1026

1027

1028

695

class ClientDBus(Client, DBusObjectWithProperties):

1029

696

"""A Client class using D-Bus

1030

697

1032

699

dbus_object_path: dbus.ObjectPath

1033

700

bus: dbus.SystemBus()

1034

701

"""

1035

1036

runtime_expansions = (Client.runtime_expansions

1037

+ ("dbus_object_path",))

1038

1039

702

# dbus.service.Object doesn't use super(), so we can't either.

1040

703

1041

704

def __init__(self, bus = None, *args, **kwargs):

1042

705

self.bus = bus

1043

706

Client.__init__(self, *args, **kwargs)

1044

self._approvals_pending = 0

1045

1046

self._approvals_pending = 0

1047

707

# Only now, when this client is initialized, can it show up on

1048

708

# the D-Bus

1049

client_object_name = unicode(self.name).translate(

1050

{ord("."): ord("_"),

1051

ord("-"): ord("_")})

1052

709

self.dbus_object_path = (dbus.ObjectPath

1053

("/clients/" + client_object_name))

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

1054

712

DBusObjectWithProperties.__init__(self, self.bus,

1055

713

self.dbus_object_path)

1056

1057

def notifychangeproperty(transform_func,

1058

dbus_name, type_func=lambda x: x,

1059

variant_level=1):

1060

""" Modify a variable so that it's a property which announces

1061

its changes to DBus.

1062

1063

transform_fun: Function that takes a value and a variant_level

1064

and transforms it to a D-Bus type.

1065

dbus_name: D-Bus name of the variable

1066

type_func: Function that transform the value before sending it

1067

to the D-Bus. Default: no transform

1068

variant_level: D-Bus variant level. Default: 1

1069

"""

1070

attrname = "_{0}".format(dbus_name)

1071

def setter(self, value):

1072

if hasattr(self, "dbus_object_path"):

1073

if (not hasattr(self, attrname) or

1074

type_func(getattr(self, attrname, None))

1075

!= type_func(value)):

1076

dbus_value = transform_func(type_func(value),

1077

variant_level

1078

=variant_level)

1079

self.PropertyChanged(dbus.String(dbus_name),

1080

dbus_value)

1081

setattr(self, attrname, value)

1082

1083

return property(lambda self: getattr(self, attrname), setter)

1084

1085

1086

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1087

approvals_pending = notifychangeproperty(dbus.Boolean,

1088

"ApprovalPending",

1089

type_func = bool)

1090

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1091

last_enabled = notifychangeproperty(datetime_to_dbus,

1092

"LastEnabled")

1093

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1094

type_func = lambda checker:

1095

checker is not None)

1096

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1097

"LastCheckedOK")

1098

last_approval_request = notifychangeproperty(

1099

datetime_to_dbus, "LastApprovalRequest")

1100

approved_by_default = notifychangeproperty(dbus.Boolean,

1101

"ApprovedByDefault")

1102

approval_delay = notifychangeproperty(dbus.UInt64,

1103

"ApprovalDelay",

1104

type_func =

1105

timedelta_to_milliseconds)

1106

approval_duration = notifychangeproperty(

1107

dbus.UInt64, "ApprovalDuration",

1108

type_func = timedelta_to_milliseconds)

1109

host = notifychangeproperty(dbus.String, "Host")

1110

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1111

type_func =

1112

timedelta_to_milliseconds)

1113

extended_timeout = notifychangeproperty(

1114

dbus.UInt64, "ExtendedTimeout",

1115

type_func = timedelta_to_milliseconds)

1116

interval = notifychangeproperty(dbus.UInt64,

1117

"Interval",

1118

type_func =

1119

timedelta_to_milliseconds)

1120

checker_command = notifychangeproperty(dbus.String, "Checker")

1121

1122

del notifychangeproperty

714

715

@staticmethod

716

def _datetime_to_dbus(dt, variant_level=0):

717

"""Convert a UTC datetime.datetime() to a D-Bus type."""

718

return dbus.String(dt.isoformat(),

719

variant_level=variant_level)

720

721

def enable(self):

722

oldstate = getattr(self, u"enabled", False)

723

r = Client.enable(self)

724

if oldstate != self.enabled:

725

# Emit D-Bus signals

726

self.PropertyChanged(dbus.String(u"enabled"),

727

dbus.Boolean(True, variant_level=1))

728

self.PropertyChanged(

729

dbus.String(u"last_enabled"),

730

self._datetime_to_dbus(self.last_enabled,

731

variant_level=1))

732

return r

733

734

def disable(self, quiet = False):

735

oldstate = getattr(self, u"enabled", False)

736

r = Client.disable(self, quiet=quiet)

737

if not quiet and oldstate != self.enabled:

738

# Emit D-Bus signal

739

self.PropertyChanged(dbus.String(u"enabled"),

740

dbus.Boolean(False, variant_level=1))

741

return r

1123

742

1124

743

def __del__(self, *args, **kwargs):

1125

744

try:

1126

745

self.remove_from_connection()

1127

746

except LookupError:

1128

747

pass

1129

if hasattr(DBusObjectWithProperties, "__del__"):

748

if hasattr(DBusObjectWithProperties, u"__del__"):

1130

749

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1131

750

Client.__del__(self, *args, **kwargs)

1132

751

1134

753

*args, **kwargs):

1135

754

self.checker_callback_tag = None

1136

755

self.checker = None

756

# Emit D-Bus signal

757

self.PropertyChanged(dbus.String(u"checker_running"),

758

dbus.Boolean(False, variant_level=1))

1137

759

if os.WIFEXITED(condition):

1138

760

exitstatus = os.WEXITSTATUS(condition)

1139

761

# Emit D-Bus signal

1149

771

return Client.checker_callback(self, pid, condition, command,

1150

772

*args, **kwargs)

1151

773

774

def checked_ok(self, *args, **kwargs):

775

r = Client.checked_ok(self, *args, **kwargs)

776

# Emit D-Bus signal

777

self.PropertyChanged(

778

dbus.String(u"last_checked_ok"),

779

(self._datetime_to_dbus(self.last_checked_ok,

780

variant_level=1)))

781

return r

782

1152

783

def start_checker(self, *args, **kwargs):

1153

784

old_checker = self.checker

1154

785

if self.checker is not None:

1161

792

and old_checker_pid != self.checker.pid):

1162

793

# Emit D-Bus signal

1163

794

self.CheckerStarted(self.current_checker_command)

795

self.PropertyChanged(

796

dbus.String(u"checker_running"),

797

dbus.Boolean(True, variant_level=1))

1164

798

return r

1165

799

800

def stop_checker(self, *args, **kwargs):

801

old_checker = getattr(self, u"checker", None)

802

r = Client.stop_checker(self, *args, **kwargs)

803

if (old_checker is not None

804

and getattr(self, u"checker", None) is None):

805

self.PropertyChanged(dbus.String(u"checker_running"),

806

dbus.Boolean(False, variant_level=1))

807

return r

808

1166

809

def _reset_approved(self):

1167

self.approved = None

810

self._approved = None

1168

811

return False

1169

812

1170

813

def approve(self, value=True):

1171

self.send_changedstate()

1172

self.approved = value

1173

gobject.timeout_add(timedelta_to_milliseconds

1174

(self.approval_duration),

1175

self._reset_approved)

814

self._approved = value

815

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

816

817

def approved_pending(self):

818

return self.approvals_pending > 0

1176

819

1177

820

1178

821

## D-Bus methods, signals & properties

1179

_interface = "se.recompile.Mandos.Client"

822

_interface = u"se.bsnet.fukt.Mandos.Client"

1180

823

1181

824

## Signals

1182

825

1183

826

# CheckerCompleted - signal

1184

@dbus.service.signal(_interface, signature="nxs")

827

@dbus.service.signal(_interface, signature=u"nxs")

1185

828

def CheckerCompleted(self, exitcode, waitstatus, command):

1186

829

"D-Bus signal"

1187

830

pass

1188

831

1189

832

# CheckerStarted - signal

1190

@dbus.service.signal(_interface, signature="s")

833

@dbus.service.signal(_interface, signature=u"s")

1191

834

def CheckerStarted(self, command):

1192

835

"D-Bus signal"

1193

836

pass

1194

837

1195

838

# PropertyChanged - signal

1196

@dbus.service.signal(_interface, signature="sv")

839

@dbus.service.signal(_interface, signature=u"sv")

1197

840

def PropertyChanged(self, property, value):

1198

841

"D-Bus signal"

1199

842

pass

1201

844

# GotSecret - signal

1202

845

@dbus.service.signal(_interface)

1203

846

def GotSecret(self):

1204

"""D-Bus signal

1205

Is sent after a successful transfer of secret from the Mandos

1206

server to mandos-client

1207

"""

1208

pass

847

"D-Bus signal"

848

if self.approved_pending():

849

self.PropertyChanged(dbus.String(u"checker_running"),

850

dbus.Boolean(False, variant_level=1))

1209

851

1210

852

# Rejected - signal

1211

@dbus.service.signal(_interface, signature="s")

853

@dbus.service.signal(_interface, signature=u"s")

1212

854

def Rejected(self, reason):

1213

855

"D-Bus signal"

1214

pass

856

if self.approved_pending():

857

self.PropertyChanged(dbus.String(u"checker_running"),

858

dbus.Boolean(False, variant_level=1))

1215

859

1216

860

# NeedApproval - signal

1217

@dbus.service.signal(_interface, signature="tb")

861

@dbus.service.signal(_interface, signature=u"db")

1218

862

def NeedApproval(self, timeout, default):

1219

863

"D-Bus signal"

1220

return self.need_approval()

1221

1222

# NeRwequest - signal

1223

@dbus.service.signal(_interface, signature="s")

1224

def NewRequest(self, ip):

1225

"""D-Bus signal

1226

Is sent after a client request a password.

1227

"""

1228

pass

864

if not self.approved_pending():

865

self.PropertyChanged(dbus.String(u"approved_pending"),

866

dbus.Boolean(True, variant_level=1))

1229

867

1230

868

## Methods

1231

869

1232

870

# Approve - method

1233

@dbus.service.method(_interface, in_signature="b")

871

@dbus.service.method(_interface, in_signature=u"b")

1234

872

def Approve(self, value):

1235

873

self.approve(value)

1236

874

1237

875

# CheckedOK - method

1238

876

@dbus.service.method(_interface)

1239

877

def CheckedOK(self):

1240

self.checked_ok()

878

return self.checked_ok()

1241

879

1242

880

# Enable - method

1243

881

@dbus.service.method(_interface)

1264

902

1265

903

## Properties

1266

904

1267

# ApprovalPending - property

1268

@dbus_service_property(_interface, signature="b", access="read")

1269

def ApprovalPending_dbus_property(self):

1270

return dbus.Boolean(bool(self.approvals_pending))

1271

1272

# ApprovedByDefault - property

1273

@dbus_service_property(_interface, signature="b",

1274

access="readwrite")

1275

def ApprovedByDefault_dbus_property(self, value=None):

1276

if value is None: # get

1277

return dbus.Boolean(self.approved_by_default)

1278

self.approved_by_default = bool(value)

1279

1280

# ApprovalDelay - property

1281

@dbus_service_property(_interface, signature="t",

1282

access="readwrite")

1283

def ApprovalDelay_dbus_property(self, value=None):

1284

if value is None: # get

1285

return dbus.UInt64(self.approval_delay_milliseconds())

1286

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1287

1288

# ApprovalDuration - property

1289

@dbus_service_property(_interface, signature="t",

1290

access="readwrite")

1291

def ApprovalDuration_dbus_property(self, value=None):

1292

if value is None: # get

1293

return dbus.UInt64(timedelta_to_milliseconds(

1294

self.approval_duration))

1295

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1296

1297

# Name - property

1298

@dbus_service_property(_interface, signature="s", access="read")

1299

def Name_dbus_property(self):

905

# approved_pending - property

906

@dbus_service_property(_interface, signature=u"b", access=u"read")

907

def approved_pending_dbus_property(self):

908

return dbus.Boolean(self.approved_pending())

909

910

# approved_by_default - property

911

@dbus_service_property(_interface, signature=u"b",

912

access=u"readwrite")

913

def approved_by_default_dbus_property(self):

914

return dbus.Boolean(self.approved_by_default)

915

916

# approved_delay - property

917

@dbus_service_property(_interface, signature=u"t",

918

access=u"readwrite")

919

def approved_delay_dbus_property(self):

920

return dbus.UInt64(self.approved_delay_milliseconds())

921

922

# approved_duration - property

923

@dbus_service_property(_interface, signature=u"t",

924

access=u"readwrite")

925

def approved_duration_dbus_property(self):

926

return dbus.UInt64(self._timedelta_to_milliseconds(

927

self.approved_duration))

928

929

# name - property

930

@dbus_service_property(_interface, signature=u"s", access=u"read")

931

def name_dbus_property(self):

1300

932

return dbus.String(self.name)

1301

933

1302

# Fingerprint - property

1303

@dbus_service_property(_interface, signature="s", access="read")

1304

def Fingerprint_dbus_property(self):

934

# fingerprint - property

935

@dbus_service_property(_interface, signature=u"s", access=u"read")

936

def fingerprint_dbus_property(self):

1305

937

return dbus.String(self.fingerprint)

1306

938

1307

# Host - property

1308

@dbus_service_property(_interface, signature="s",

1309

access="readwrite")

1310

def Host_dbus_property(self, value=None):

939

# host - property

940

@dbus_service_property(_interface, signature=u"s",

941

access=u"readwrite")

942

def host_dbus_property(self, value=None):

1311

943

if value is None: # get

1312

944

return dbus.String(self.host)

1313

self.host = unicode(value)

1314

1315

# Created - property

1316

@dbus_service_property(_interface, signature="s", access="read")

1317

def Created_dbus_property(self):

1318

return datetime_to_dbus(self.created)

1319

1320

# LastEnabled - property

1321

@dbus_service_property(_interface, signature="s", access="read")

1322

def LastEnabled_dbus_property(self):

1323

return datetime_to_dbus(self.last_enabled)

1324

1325

# Enabled - property

1326

@dbus_service_property(_interface, signature="b",

1327

access="readwrite")

1328

def Enabled_dbus_property(self, value=None):

945

self.host = value

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"host"),

948

dbus.String(value, variant_level=1))

949

950

# created - property

951

@dbus_service_property(_interface, signature=u"s", access=u"read")

952

def created_dbus_property(self):

953

return dbus.String(self._datetime_to_dbus(self.created))

954

955

# last_enabled - property

956

@dbus_service_property(_interface, signature=u"s", access=u"read")

957

def last_enabled_dbus_property(self):

958

if self.last_enabled is None:

959

return dbus.String(u"")

960

return dbus.String(self._datetime_to_dbus(self.last_enabled))

961

962

# enabled - property

963

@dbus_service_property(_interface, signature=u"b",

964

access=u"readwrite")

965

def enabled_dbus_property(self, value=None):

1329

966

if value is None: # get

1330

967

return dbus.Boolean(self.enabled)

1331

968

if value:

1333

970

else:

1334

971

self.disable()

1335

972

1336

# LastCheckedOK - property

1337

@dbus_service_property(_interface, signature="s",

1338

access="readwrite")

1339

def LastCheckedOK_dbus_property(self, value=None):

973

# last_checked_ok - property

974

@dbus_service_property(_interface, signature=u"s",

975

access=u"readwrite")

976

def last_checked_ok_dbus_property(self, value=None):

1340

977

if value is not None:

1341

978

self.checked_ok()

1342

979

return

1343

return datetime_to_dbus(self.last_checked_ok)

1344

1345

# Expires - property

1346

@dbus_service_property(_interface, signature="s", access="read")

1347

def Expires_dbus_property(self):

1348

return datetime_to_dbus(self.expires)

1349

1350

# LastApprovalRequest - property

1351

@dbus_service_property(_interface, signature="s", access="read")

1352

def LastApprovalRequest_dbus_property(self):

1353

return datetime_to_dbus(self.last_approval_request)

1354

1355

# Timeout - property

1356

@dbus_service_property(_interface, signature="t",

1357

access="readwrite")

1358

def Timeout_dbus_property(self, value=None):

980

if self.last_checked_ok is None:

981

return dbus.String(u"")

982

return dbus.String(self._datetime_to_dbus(self

983

.last_checked_ok))

984

985

# timeout - property

986

@dbus_service_property(_interface, signature=u"t",

987

access=u"readwrite")

988

def timeout_dbus_property(self, value=None):

1359

989

if value is None: # get

1360

990

return dbus.UInt64(self.timeout_milliseconds())

1361

991

self.timeout = datetime.timedelta(0, 0, 0, value)

1362

if getattr(self, "disable_initiator_tag", None) is None:

992

# Emit D-Bus signal

993

self.PropertyChanged(dbus.String(u"timeout"),

994

dbus.UInt64(value, variant_level=1))

995

if getattr(self, u"disable_initiator_tag", None) is None:

1363

996

return

1364

997

# Reschedule timeout

1365

998

gobject.source_remove(self.disable_initiator_tag)

1366

999

self.disable_initiator_tag = None

1367

self.expires = None

1368

time_to_die = timedelta_to_milliseconds((self

1369

.last_checked_ok

1370

+ self.timeout)

1371

- datetime.datetime

1372

.utcnow())

1000

time_to_die = (self.

1001

_timedelta_to_milliseconds((self

1002

.last_checked_ok

1003

+ self.timeout)

1004

- datetime.datetime

1005

.utcnow()))

1373

1006

if time_to_die <= 0:

1374

1007

# The timeout has passed

1375

1008

self.disable()

1376

1009

else:

1377

self.expires = (datetime.datetime.utcnow()

1378

+ datetime.timedelta(milliseconds =

1379

time_to_die))

1380

1010

self.disable_initiator_tag = (gobject.timeout_add

1381

1011

(time_to_die, self.disable))

1382

1012

1383

# ExtendedTimeout - property

1384

@dbus_service_property(_interface, signature="t",

1385

access="readwrite")

1386

def ExtendedTimeout_dbus_property(self, value=None):

1387

if value is None: # get

1388

return dbus.UInt64(self.extended_timeout_milliseconds())

1389

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1390

1391

# Interval - property

1392

@dbus_service_property(_interface, signature="t",

1393

access="readwrite")

1394

def Interval_dbus_property(self, value=None):

1013

# interval - property

1014

@dbus_service_property(_interface, signature=u"t",

1015

access=u"readwrite")

1016

def interval_dbus_property(self, value=None):

1395

1017

if value is None: # get

1396

1018

return dbus.UInt64(self.interval_milliseconds())

1397

1019

self.interval = datetime.timedelta(0, 0, 0, value)

1398

if getattr(self, "checker_initiator_tag", None) is None:

1020

# Emit D-Bus signal

1021

self.PropertyChanged(dbus.String(u"interval"),

1022

dbus.UInt64(value, variant_level=1))

1023

if getattr(self, u"checker_initiator_tag", None) is None:

1399

1024

return

1400

if self.enabled:

1401

# Reschedule checker run

1402

gobject.source_remove(self.checker_initiator_tag)

1403

self.checker_initiator_tag = (gobject.timeout_add

1404

(value, self.start_checker))

1405

self.start_checker() # Start one now, too

1406

1407

# Checker - property

1408

@dbus_service_property(_interface, signature="s",

1409

access="readwrite")

1410

def Checker_dbus_property(self, value=None):

1025

# Reschedule checker run

1026

gobject.source_remove(self.checker_initiator_tag)

1027

self.checker_initiator_tag = (gobject.timeout_add

1028

(value, self.start_checker))

1029

self.start_checker() # Start one now, too

1030

1031

# checker - property

1032

@dbus_service_property(_interface, signature=u"s",

1033

access=u"readwrite")

1034

def checker_dbus_property(self, value=None):

1411

1035

if value is None: # get

1412

1036

return dbus.String(self.checker_command)

1413

self.checker_command = unicode(value)

1037

self.checker_command = value

1038

# Emit D-Bus signal

1039

self.PropertyChanged(dbus.String(u"checker"),

1040

dbus.String(self.checker_command,

1041

variant_level=1))

1414

1042

1415

# CheckerRunning - property

1416

@dbus_service_property(_interface, signature="b",

1417

access="readwrite")

1418

def CheckerRunning_dbus_property(self, value=None):

1043

# checker_running - property

1044

@dbus_service_property(_interface, signature=u"b",

1045

access=u"readwrite")

1046

def checker_running_dbus_property(self, value=None):

1419

1047

if value is None: # get

1420

1048

return dbus.Boolean(self.checker is not None)

1421

1049

if value:

1423

1051

else:

1424

1052

self.stop_checker()

1425

1053

1426

# ObjectPath - property

1427

@dbus_service_property(_interface, signature="o", access="read")

1428

def ObjectPath_dbus_property(self):

1054

# object_path - property

1055

@dbus_service_property(_interface, signature=u"o", access=u"read")

1056

def object_path_dbus_property(self):

1429

1057

return self.dbus_object_path # is already a dbus.ObjectPath

1430

1058

1431

# Secret = property

1432

@dbus_service_property(_interface, signature="ay",

1433

access="write", byte_arrays=True)

1434

def Secret_dbus_property(self, value):

1059

# secret = property

1060

@dbus_service_property(_interface, signature=u"ay",

1061

access=u"write", byte_arrays=True)

1062

def secret_dbus_property(self, value):

1435

1063

self.secret = str(value)

1436

1064

1437

1065

del _interface

1443

1071

self._pipe.send(('init', fpr, address))

1444

1072

if not self._pipe.recv():

1445

1073

raise KeyError()

1446

1074

1447

1075

def __getattribute__(self, name):

1448

if name == '_pipe':

1076

if(name == '_pipe'):

1449

1077

return super(ProxyClient, self).__getattribute__(name)

1450

1078

self._pipe.send(('getattr', name))

1451

1079

data = self._pipe.recv()

1456

1084

self._pipe.send(('funcall', name, args, kwargs))

1457

1085

return self._pipe.recv()[1]

1458

1086

return func

1459

1087

1460

1088

def __setattr__(self, name, value):

1461

if name == '_pipe':

1089

if(name == '_pipe'):

1462

1090

return super(ProxyClient, self).__setattr__(name, value)

1463

1091

self._pipe.send(('setattr', name, value))

1464

1092

1465

1093

1466

class ClientDBusTransitional(ClientDBus):

1467

__metaclass__ = AlternateDBusNamesMetaclass

1468

1469

1470

1094

class ClientHandler(socketserver.BaseRequestHandler, object):

1471

1095

"""A class to handle client connections.

1472

1096

1475

1099

1476

1100

def handle(self):

1477

1101

with contextlib.closing(self.server.child_pipe) as child_pipe:

1478

logger.info("TCP connection from: %s",

1102

logger.info(u"TCP connection from: %s",

1479

1103

unicode(self.client_address))

1480

logger.debug("Pipe FD: %d",

1104

logger.debug(u"Pipe FD: %d",

1481

1105

self.server.child_pipe.fileno())

1482

1106

1483

1107

session = (gnutls.connection

1484

1108

.ClientSession(self.request,

1485

1109

gnutls.connection

1486

1110

.X509Credentials()))

1487

1111

1488

1112

# Note: gnutls.connection.X509Credentials is really a

1489

1113

# generic GnuTLS certificate credentials object so long as

1490

1114

# no X.509 keys are added to it. Therefore, we can use it

1491

1115

# here despite using OpenPGP certificates.

1492

1493

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1494

# "+AES-256-CBC", "+SHA1",

1495

# "+COMP-NULL", "+CTYPE-OPENPGP",

1496

# "+DHE-DSS"))

1116

1117

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1118

# u"+AES-256-CBC", u"+SHA1",

1119

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1120

# u"+DHE-DSS"))

1497

1121

# Use a fallback default, since this MUST be set.

1498

1122

priority = self.server.gnutls_priority

1499

1123

if priority is None:

1500

priority = "NORMAL"

1124

priority = u"NORMAL"

1501

1125

(gnutls.library.functions

1502

1126

.gnutls_priority_set_direct(session._c_object,

1503

1127

priority, None))

1504

1128

1505

1129

# Start communication using the Mandos protocol

1506

1130

# Get protocol number

1507

1131

line = self.request.makefile().readline()

1508

logger.debug("Protocol version: %r", line)

1132

logger.debug(u"Protocol version: %r", line)

1509

1133

try:

1510

1134

if int(line.strip().split()[0]) > 1:

1511

1135

raise RuntimeError

1512

except (ValueError, IndexError, RuntimeError) as error:

1513

logger.error("Unknown protocol version: %s", error)

1136

except (ValueError, IndexError, RuntimeError), error:

1137

logger.error(u"Unknown protocol version: %s", error)

1514

1138

return

1515

1139

1516

1140

# Start GnuTLS connection

1517

1141

try:

1518

1142

session.handshake()

1519

except gnutls.errors.GNUTLSError as error:

1520

logger.warning("Handshake failed: %s", error)

1143

except gnutls.errors.GNUTLSError, error:

1144

logger.warning(u"Handshake failed: %s", error)

1521

1145

# Do not run session.bye() here: the session is not

1522

1146

# established. Just abandon the request.

1523

1147

return

1524

logger.debug("Handshake succeeded")

1525

1148

logger.debug(u"Handshake succeeded")

1149

1526

1150

approval_required = False

1527

1151

try:

1528

1152

try:

1529

1153

fpr = self.fingerprint(self.peer_certificate

1530

1154

(session))

1531

except (TypeError,

1532

gnutls.errors.GNUTLSError) as error:

1533

logger.warning("Bad certificate: %s", error)

1155

except (TypeError, gnutls.errors.GNUTLSError), error:

1156

logger.warning(u"Bad certificate: %s", error)

1534

1157

return

1535

logger.debug("Fingerprint: %s", fpr)

1536

1158

logger.debug(u"Fingerprint: %s", fpr)

1159

1537

1160

try:

1538

1161

client = ProxyClient(child_pipe, fpr,

1539

1162

self.client_address)

1540

1163

except KeyError:

1541

1164

return

1542

1165

1543

if self.server.use_dbus:

1544

# Emit D-Bus signal

1545

client.NewRequest(str(self.client_address))

1546

1547

if client.approval_delay:

1548

delay = client.approval_delay

1166

if client.approved_delay:

1167

delay = client.approved_delay

1549

1168

client.approvals_pending += 1

1550

1169

approval_required = True

1551

1170

1552

1171

while True:

1553

1172

if not client.enabled:

1554

logger.info("Client %s is disabled",

1173

logger.warning(u"Client %s is disabled",

1555

1174

client.name)

1556

1175

if self.server.use_dbus:

1557

1176

# Emit D-Bus signal

1558

client.Rejected("Disabled")

1177

client.Rejected("Disabled")

1559

1178

return

1560

1179

1561

if client.approved or not client.approval_delay:

1180

if client._approved or not client.approved_delay:

1562

1181

#We are approved or approval is disabled

1563

1182

break

1564

elif client.approved is None:

1565

logger.info("Client %s needs approval",

1183

elif client._approved is None:

1184

logger.info(u"Client %s need approval",

1566

1185

client.name)

1567

1186

if self.server.use_dbus:

1568

1187

# Emit D-Bus signal

1569

1188

client.NeedApproval(

1570

client.approval_delay_milliseconds(),

1189

client.approved_delay_milliseconds(),

1571

1190

client.approved_by_default)

1572

1191

else:

1573

logger.warning("Client %s was not approved",

1192

logger.warning(u"Client %s was not approved",

1574

1193

client.name)

1575

1194

if self.server.use_dbus:

1576

1195

# Emit D-Bus signal

1577

client.Rejected("Denied")

1196

client.Rejected("Disapproved")

1578

1197

return

1579

1198

1580

1199

#wait until timeout or approved

1200

#x = float(client._timedelta_to_milliseconds(delay))

1581

1201

time = datetime.datetime.now()

1582

1202

client.changedstate.acquire()

1583

(client.changedstate.wait

1584

(float(client.timedelta_to_milliseconds(delay)

1585

/ 1000)))

1203

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1586

1204

client.changedstate.release()

1587

1205

time2 = datetime.datetime.now()

1588

1206

if (time2 - time) >= delay:

1592

1210

client.name)

1593

1211

if self.server.use_dbus:

1594

1212

# Emit D-Bus signal

1595

client.Rejected("Approval timed out")

1213

client.Rejected("Time out")

1596

1214

return

1597

1215

else:

1598

1216

break

1601

1219

1602

1220

sent_size = 0

1603

1221

while sent_size < len(client.secret):

1604

try:

1605

sent = session.send(client.secret[sent_size:])

1606

except gnutls.errors.GNUTLSError as error:

1607

logger.warning("gnutls send failed")

1608

return

1609

logger.debug("Sent: %d, remaining: %d",

1222

# XXX handle session exception

1223

sent = session.send(client.secret[sent_size:])

1224

logger.debug(u"Sent: %d, remaining: %d",

1610

1225

sent, len(client.secret)

1611

1226

- (sent_size + sent))

1612

1227

sent_size += sent

1613

1614

logger.info("Sending secret to %s", client.name)

1615

# bump the timeout using extended_timeout

1616

client.checked_ok(client.extended_timeout)

1228

1229

logger.info(u"Sending secret to %s", client.name)

1230

# bump the timeout as if seen

1231

client.checked_ok()

1617

1232

if self.server.use_dbus:

1618

1233

# Emit D-Bus signal

1619

1234

client.GotSecret()

1621

1236

finally:

1622

1237

if approval_required:

1623

1238

client.approvals_pending -= 1

1624

try:

1625

session.bye()

1626

except gnutls.errors.GNUTLSError as error:

1627

logger.warning("GnuTLS bye failed")

1239

session.bye()

1628

1240

1629

1241

@staticmethod

1630

1242

def peer_certificate(session):

1640

1252

.gnutls_certificate_get_peers

1641

1253

(session._c_object, ctypes.byref(list_size)))

1642

1254

if not bool(cert_list) and list_size.value != 0:

1643

raise gnutls.errors.GNUTLSError("error getting peer"

1644

" certificate")

1255

raise gnutls.errors.GNUTLSError(u"error getting peer"

1256

u" certificate")

1645

1257

if list_size.value == 0:

1646

1258

return None

1647

1259

cert = cert_list[0]

1673

1285

if crtverify.value != 0:

1674

1286

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1675

1287

raise (gnutls.errors.CertificateSecurityError

1676

("Verify failed"))

1288

(u"Verify failed"))

1677

1289

# New buffer for the fingerprint

1678

1290

buf = ctypes.create_string_buffer(20)

1679

1291

buf_len = ctypes.c_size_t()

1686

1298

# Convert the buffer to a Python bytestring

1687

1299

fpr = ctypes.string_at(buf, buf_len.value)

1688

1300

# Convert the bytestring to hexadecimal notation

1689

hex_fpr = binascii.hexlify(fpr).upper()

1301

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1690

1302

return hex_fpr

1691

1303

1692

1304

1695

1307

def sub_process_main(self, request, address):

1696

1308

try:

1697

1309

self.finish_request(request, address)

1698

except Exception:

1310

except:

1699

1311

self.handle_error(request, address)

1700

1312

self.close_request(request)

1701

1313

1702

1314

def process_request(self, request, address):

1703

1315

"""Start a new process to process the request."""

1704

proc = multiprocessing.Process(target = self.sub_process_main,

1705

args = (request,

1706

address))

1707

proc.start()

1708

return proc

1709

1316

multiprocessing.Process(target = self.sub_process_main,

1317

args = (request, address)).start()

1710

1318

1711

1319

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1712

1320

""" adds a pipe to the MixIn """

1716

1324

This function creates a new pipe in self.pipe

1717

1325

"""

1718

1326

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1719

1720

proc = MultiprocessingMixIn.process_request(self, request,

1721

client_address)

1722

self.child_pipe.close()

1723

self.add_pipe(parent_pipe, proc)

1724

1725

def add_pipe(self, parent_pipe, proc):

1327

1328

super(MultiprocessingMixInWithPipe,

1329

self).process_request(request, client_address)

1330

self.add_pipe(parent_pipe)

1331

def add_pipe(self, parent_pipe):

1726

1332

"""Dummy function; override as necessary"""

1727

raise NotImplementedError

1728

1333

pass

1729

1334

1730

1335

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1731

1336

socketserver.TCPServer, object):

1749

1354

bind to an address or port if they were not specified."""

1750

1355

if self.interface is not None:

1751

1356

if SO_BINDTODEVICE is None:

1752

logger.error("SO_BINDTODEVICE does not exist;"

1753

" cannot bind to interface %s",

1357

logger.error(u"SO_BINDTODEVICE does not exist;"

1358

u" cannot bind to interface %s",

1754

1359

self.interface)

1755

1360

else:

1756

1361

try:

1757

1362

self.socket.setsockopt(socket.SOL_SOCKET,

1758

1363

SO_BINDTODEVICE,

1759

1364

str(self.interface

1760

+ '\0'))

1761

except socket.error as error:

1365

+ u'\0'))

1366

except socket.error, error:

1762

1367

if error[0] == errno.EPERM:

1763

logger.error("No permission to"

1764

" bind to interface %s",

1368

logger.error(u"No permission to"

1369

u" bind to interface %s",

1765

1370

self.interface)

1766

1371

elif error[0] == errno.ENOPROTOOPT:

1767

logger.error("SO_BINDTODEVICE not available;"

1768

" cannot bind to interface %s",

1372

logger.error(u"SO_BINDTODEVICE not available;"

1373

u" cannot bind to interface %s",

1769

1374

self.interface)

1770

1375

else:

1771

1376

raise

1773

1378

if self.server_address[0] or self.server_address[1]:

1774

1379

if not self.server_address[0]:

1775

1380

if self.address_family == socket.AF_INET6:

1776

any_address = "::" # in6addr_any

1381

any_address = u"::" # in6addr_any

1777

1382

else:

1778

1383

any_address = socket.INADDR_ANY

1779

1384

self.server_address = (any_address,

1806

1411

self.enabled = False

1807

1412

self.clients = clients

1808

1413

if self.clients is None:

1809

self.clients = {}

1414

self.clients = set()

1810

1415

self.use_dbus = use_dbus

1811

1416

self.gnutls_priority = gnutls_priority

1812

1417

IPv6_TCPServer.__init__(self, server_address,

1816

1421

def server_activate(self):

1817

1422

if self.enabled:

1818

1423

return socketserver.TCPServer.server_activate(self)

1819

1820

1424

def enable(self):

1821

1425

self.enabled = True

1822

1823

def add_pipe(self, parent_pipe, proc):

1426

def add_pipe(self, parent_pipe):

1824

1427

# Call "handle_ipc" for both data and EOF events

1825

1428

gobject.io_add_watch(parent_pipe.fileno(),

1826

1429

gobject.IO_IN | gobject.IO_HUP,

1827

1430

functools.partial(self.handle_ipc,

1828

parent_pipe =

1829

parent_pipe,

1830

proc = proc))

1831

1431

parent_pipe = parent_pipe))

1432

1832

1433

def handle_ipc(self, source, condition, parent_pipe=None,

1833

proc = None, client_object=None):

1434

client_object=None):

1834

1435

condition_names = {

1835

gobject.IO_IN: "IN", # There is data to read.

1836

gobject.IO_OUT: "OUT", # Data can be written (without

1436

gobject.IO_IN: u"IN", # There is data to read.

1437

gobject.IO_OUT: u"OUT", # Data can be written (without

1837

1438

# blocking).

1838

gobject.IO_PRI: "PRI", # There is urgent data to read.

1839

gobject.IO_ERR: "ERR", # Error condition.

1840

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1439

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1440

gobject.IO_ERR: u"ERR", # Error condition.

1441

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1841

1442

# broken, usually for pipes and

1842

1443

# sockets).

1843

1444

}

1845

1446

for cond, name in

1846

1447

condition_names.iteritems()

1847

1448

if cond & condition)

1848

# error, or the other end of multiprocessing.Pipe has closed

1849

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1850

# Wait for other process to exit

1851

proc.join()

1852

return False

1449

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1450

conditions_string)

1853

1451

1854

1452

# Read a request from the child

1855

1453

request = parent_pipe.recv()

1859

1457

fpr = request[1]

1860

1458

address = request[2]

1861

1459

1862

for c in self.clients.itervalues():

1460

for c in self.clients:

1863

1461

if c.fingerprint == fpr:

1864

1462

client = c

1865

1463

break

1866

1464

else:

1867

logger.info("Client not found for fingerprint: %s, ad"

1868

"dress: %s", fpr, address)

1465

logger.warning(u"Client not found for fingerprint: %s, ad"

1466

u"dress: %s", fpr, address)

1869

1467

if self.use_dbus:

1870

1468

# Emit D-Bus signal

1871

mandos_dbus_service.ClientNotFound(fpr,

1872

address[0])

1469

mandos_dbus_service.ClientNotFound(fpr, address)

1873

1470

parent_pipe.send(False)

1874

1471

return False

1875

1472

1876

1473

gobject.io_add_watch(parent_pipe.fileno(),

1877

1474

gobject.IO_IN | gobject.IO_HUP,

1878

1475

functools.partial(self.handle_ipc,

1879

parent_pipe =

1880

parent_pipe,

1881

proc = proc,

1882

client_object =

1883

client))

1476

parent_pipe = parent_pipe,

1477

client_object = client))

1884

1478

parent_pipe.send(True)

1885

# remove the old hook in favor of the new above hook on

1886

# same fileno

1479

# remove the old hook in favor of the new above hook on same fileno

1887

1480

return False

1888

1481

if command == 'funcall':

1889

1482

funcname = request[1]

1890

1483

args = request[2]

1891

1484

kwargs = request[3]

1892

1485

1893

parent_pipe.send(('data', getattr(client_object,

1894

funcname)(*args,

1895

**kwargs)))

1896

1486

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1487

1897

1488

if command == 'getattr':

1898

1489

attrname = request[1]

1899

1490

if callable(client_object.__getattribute__(attrname)):

1900

1491

parent_pipe.send(('function',))

1901

1492

else:

1902

parent_pipe.send(('data', client_object

1903

.__getattribute__(attrname)))

1904

1493

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1494

1905

1495

if command == 'setattr':

1906

1496

attrname = request[1]

1907

1497

value = request[2]

1908

1498

setattr(client_object, attrname, value)

1909

1499

1910

1500

return True

1911

1501

1912

1502

1913

1503

def string_to_delta(interval):

1914

1504

"""Parse a string and return a datetime.timedelta

1915

1505

1916

>>> string_to_delta('7d')

1506

>>> string_to_delta(u'7d')

1917

1507

datetime.timedelta(7)

1918

>>> string_to_delta('60s')

1508

>>> string_to_delta(u'60s')

1919

1509

datetime.timedelta(0, 60)

1920

>>> string_to_delta('60m')

1510

>>> string_to_delta(u'60m')

1921

1511

datetime.timedelta(0, 3600)

1922

>>> string_to_delta('24h')

1512

>>> string_to_delta(u'24h')

1923

1513

datetime.timedelta(1)

1924

>>> string_to_delta('1w')

1514

>>> string_to_delta(u'1w')

1925

1515

datetime.timedelta(7)

1926

>>> string_to_delta('5m 30s')

1516

>>> string_to_delta(u'5m 30s')

1927

1517

datetime.timedelta(0, 330)

1928

1518

"""

1929

1519

timevalue = datetime.timedelta(0)

1931

1521

try:

1932

1522

suffix = unicode(s[-1])

1933

1523

value = int(s[:-1])

1934

if suffix == "d":

1524

if suffix == u"d":

1935

1525

delta = datetime.timedelta(value)

1936

elif suffix == "s":

1526

elif suffix == u"s":

1937

1527

delta = datetime.timedelta(0, value)

1938

elif suffix == "m":

1528

elif suffix == u"m":

1939

1529

delta = datetime.timedelta(0, 0, 0, 0, value)

1940

elif suffix == "h":

1530

elif suffix == u"h":

1941

1531

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1942

elif suffix == "w":

1532

elif suffix == u"w":

1943

1533

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1944

1534

else:

1945

raise ValueError("Unknown suffix %r" % suffix)

1946

except (ValueError, IndexError) as e:

1947

raise ValueError(*(e.args))

1535

raise ValueError(u"Unknown suffix %r" % suffix)

1536

except (ValueError, IndexError), e:

1537

raise ValueError(e.message)

1948

1538

timevalue += delta

1949

1539

return timevalue

1950

1540

1951

1541

1542

def if_nametoindex(interface):

1543

"""Call the C function if_nametoindex(), or equivalent

1544

1545

Note: This function cannot accept a unicode string."""

1546

global if_nametoindex

1547

try:

1548

if_nametoindex = (ctypes.cdll.LoadLibrary

1549

(ctypes.util.find_library(u"c"))

1550

.if_nametoindex)

1551

except (OSError, AttributeError):

1552

logger.warning(u"Doing if_nametoindex the hard way")

1553

def if_nametoindex(interface):

1554

"Get an interface index the hard way, i.e. using fcntl()"

1555

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1556

with contextlib.closing(socket.socket()) as s:

1557

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1558

struct.pack(str(u"16s16x"),

1559

interface))

1560

interface_index = struct.unpack(str(u"I"),

1561

ifreq[16:20])[0]

1562

return interface_index

1563

return if_nametoindex(interface)

1564

1565

1952

1566

def daemon(nochdir = False, noclose = False):

1953

1567

"""See daemon(3). Standard BSD Unix function.

1954

1568

1957

1571

sys.exit()

1958

1572

os.setsid()

1959

1573

if not nochdir:

1960

os.chdir("/")

1574

os.chdir(u"/")

1961

1575

if os.fork():

1962

1576

sys.exit()

1963

1577

if not noclose:

1965

1579

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1966

1580

if not stat.S_ISCHR(os.fstat(null).st_mode):

1967

1581

raise OSError(errno.ENODEV,

1968

"%s not a character device"

1582

u"%s not a character device"

1969

1583

% os.path.devnull)

1970

1584

os.dup2(null, sys.stdin.fileno())

1971

1585

os.dup2(null, sys.stdout.fileno())

1979

1593

##################################################################

1980

1594

# Parsing of options, both command line and config file

1981

1595

1982

parser = argparse.ArgumentParser()

1983

parser.add_argument("-v", "--version", action="version",

1984

version = "%%(prog)s %s" % version,

1985

help="show version number and exit")

1986

parser.add_argument("-i", "--interface", metavar="IF",

1987

help="Bind to interface IF")

1988

parser.add_argument("-a", "--address",

1989

help="Address to listen for requests on")

1990

parser.add_argument("-p", "--port", type=int,

1991

help="Port number to receive requests on")

1992

parser.add_argument("--check", action="store_true",

1993

help="Run self-test")

1994

parser.add_argument("--debug", action="store_true",

1995

help="Debug mode; run in foreground and log"

1996

" to terminal")

1997

parser.add_argument("--debuglevel", metavar="LEVEL",

1998

help="Debug level for stdout output")

1999

parser.add_argument("--priority", help="GnuTLS"

2000

" priority string (see GnuTLS documentation)")

2001

parser.add_argument("--servicename",

2002

metavar="NAME", help="Zeroconf service name")

2003

parser.add_argument("--configdir",

2004

default="/etc/mandos", metavar="DIR",

2005

help="Directory to search for configuration"

2006

" files")

2007

parser.add_argument("--no-dbus", action="store_false",

2008

dest="use_dbus", help="Do not provide D-Bus"

2009

" system bus interface")

2010

parser.add_argument("--no-ipv6", action="store_false",

2011

dest="use_ipv6", help="Do not use IPv6")

2012

parser.add_argument("--no-restore", action="store_false",

2013

dest="restore", help="Do not restore stored"

2014

" state")

2015

parser.add_argument("--statedir", metavar="DIR",

2016

help="Directory to save/restore state in")

2017

2018

options = parser.parse_args()

1596

parser = optparse.OptionParser(version = "%%prog %s" % version)

1597

parser.add_option("-i", u"--interface", type=u"string",

1598

metavar="IF", help=u"Bind to interface IF")

1599

parser.add_option("-a", u"--address", type=u"string",

1600

help=u"Address to listen for requests on")

1601

parser.add_option("-p", u"--port", type=u"int",

1602

help=u"Port number to receive requests on")

1603

parser.add_option("--check", action=u"store_true",

1604

help=u"Run self-test")

1605

parser.add_option("--debug", action=u"store_true",

1606

help=u"Debug mode; run in foreground and log to"

1607

u" terminal")

1608

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1609

u" priority string (see GnuTLS documentation)")

1610

parser.add_option("--servicename", type=u"string",

1611

metavar=u"NAME", help=u"Zeroconf service name")

1612

parser.add_option("--configdir", type=u"string",

1613

default=u"/etc/mandos", metavar=u"DIR",

1614

help=u"Directory to search for configuration"

1615

u" files")

1616

parser.add_option("--no-dbus", action=u"store_false",

1617

dest=u"use_dbus", help=u"Do not provide D-Bus"

1618

u" system bus interface")

1619

parser.add_option("--no-ipv6", action=u"store_false",

1620

dest=u"use_ipv6", help=u"Do not use IPv6")

1621

options = parser.parse_args()[0]

2019

1622

2020

1623

if options.check:

2021

1624

import doctest

2023

1626

sys.exit()

2024

1627

2025

1628

# Default values for config file for server-global settings

2026

server_defaults = { "interface": "",

2027

"address": "",

2028

"port": "",

2029

"debug": "False",

2030

"priority":

2031

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2032

"servicename": "Mandos",

2033

"use_dbus": "True",

2034

"use_ipv6": "True",

2035

"debuglevel": "",

2036

"restore": "True",

2037

"statedir": "/var/lib/mandos"

1629

server_defaults = { u"interface": u"",

1630

u"address": u"",

1631

u"port": u"",

1632

u"debug": u"False",

1633

u"priority":

1634

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1635

u"servicename": u"Mandos",

1636

u"use_dbus": u"True",

1637

u"use_ipv6": u"True",

2038

1638

}

2039

1639

2040

1640

# Parse config file for server-global settings

2041

1641

server_config = configparser.SafeConfigParser(server_defaults)

2042

1642

del server_defaults

2043

1643

server_config.read(os.path.join(options.configdir,

2044

"mandos.conf"))

1644

u"mandos.conf"))

2045

1645

# Convert the SafeConfigParser object to a dict

2046

1646

server_settings = server_config.defaults()

2047

1647

# Use the appropriate methods on the non-string config options

2048

for option in ("debug", "use_dbus", "use_ipv6"):

2049

server_settings[option] = server_config.getboolean("DEFAULT",

1648

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1649

server_settings[option] = server_config.getboolean(u"DEFAULT",

2050

1650

option)

2051

1651

if server_settings["port"]:

2052

server_settings["port"] = server_config.getint("DEFAULT",

2053

"port")

1652

server_settings["port"] = server_config.getint(u"DEFAULT",

1653

u"port")

2054

1654

del server_config

2055

1655

2056

1656

# Override the settings from the config file with command line

2057

1657

# options, if set.

2058

for option in ("interface", "address", "port", "debug",

2059

"priority", "servicename", "configdir",

2060

"use_dbus", "use_ipv6", "debuglevel", "restore",

2061

"statedir"):

1658

for option in (u"interface", u"address", u"port", u"debug",

1659

u"priority", u"servicename", u"configdir",

1660

u"use_dbus", u"use_ipv6"):

2062

1661

value = getattr(options, option)

2063

1662

if value is not None:

2064

1663

server_settings[option] = value

2072

1671

##################################################################

2073

1672

2074

1673

# For convenience

2075

debug = server_settings["debug"]

2076

debuglevel = server_settings["debuglevel"]

2077

use_dbus = server_settings["use_dbus"]

2078

use_ipv6 = server_settings["use_ipv6"]

2079

stored_state_path = os.path.join(server_settings["statedir"],

2080

stored_state_file)

2081

2082

if debug:

2083

initlogger(debug, logging.DEBUG)

2084

else:

2085

if not debuglevel:

2086

initlogger(debug)

2087

else:

2088

level = getattr(logging, debuglevel.upper())

2089

initlogger(debug, level)

2090

2091

if server_settings["servicename"] != "Mandos":

1674

debug = server_settings[u"debug"]

1675

use_dbus = server_settings[u"use_dbus"]

1676

use_ipv6 = server_settings[u"use_ipv6"]

1677

1678

if not debug:

1679

syslogger.setLevel(logging.WARNING)

1680

console.setLevel(logging.WARNING)

1681

1682

if server_settings[u"servicename"] != u"Mandos":

2092

1683

syslogger.setFormatter(logging.Formatter

2093

('Mandos (%s) [%%(process)d]:'

2094

' %%(levelname)s: %%(message)s'

2095

% server_settings["servicename"]))

1684

(u'Mandos (%s) [%%(process)d]:'

1685

u' %%(levelname)s: %%(message)s'

1686

% server_settings[u"servicename"]))

2096

1687

2097

1688

# Parse config file with clients

2098

client_config = configparser.SafeConfigParser(Client.client_defaults)

2099

client_config.read(os.path.join(server_settings["configdir"],

2100

"clients.conf"))

1689

client_defaults = { u"timeout": u"1h",

1690

u"interval": u"5m",

1691

u"checker": u"fping -q -- %%(host)s",

1692

u"host": u"",

1693

u"approved_delay": u"0s",

1694

u"approved_duration": u"1s",

1695

}

1696

client_config = configparser.SafeConfigParser(client_defaults)

1697

client_config.read(os.path.join(server_settings[u"configdir"],

1698

u"clients.conf"))

2101

1699

2102

1700

global mandos_dbus_service

2103

1701

mandos_dbus_service = None

2104

1702

2105

tcp_server = MandosServer((server_settings["address"],

2106

server_settings["port"]),

1703

tcp_server = MandosServer((server_settings[u"address"],

1704

server_settings[u"port"]),

2107

1705

ClientHandler,

2108

interface=(server_settings["interface"]

2109

or None),

1706

interface=server_settings[u"interface"],

2110

1707

use_ipv6=use_ipv6,

2111

1708

gnutls_priority=

2112

server_settings["priority"],

1709

server_settings[u"priority"],

2113

1710

use_dbus=use_dbus)

2114

if not debug:

2115

pidfilename = "/var/run/mandos.pid"

2116

try:

2117

pidfile = open(pidfilename, "w")

2118

except IOError:

2119

logger.error("Could not open file %r", pidfilename)

1711

pidfilename = u"/var/run/mandos.pid"

1712

try:

1713

pidfile = open(pidfilename, u"w")

1714

except IOError:

1715

logger.error(u"Could not open file %r", pidfilename)

2120

1716

2121

1717

try:

2122

uid = pwd.getpwnam("_mandos").pw_uid

2123

gid = pwd.getpwnam("_mandos").pw_gid

1718

uid = pwd.getpwnam(u"_mandos").pw_uid

1719

gid = pwd.getpwnam(u"_mandos").pw_gid

2124

1720

except KeyError:

2125

1721

try:

2126

uid = pwd.getpwnam("mandos").pw_uid

2127

gid = pwd.getpwnam("mandos").pw_gid

1722

uid = pwd.getpwnam(u"mandos").pw_uid

1723

gid = pwd.getpwnam(u"mandos").pw_gid

2128

1724

except KeyError:

2129

1725

try:

2130

uid = pwd.getpwnam("nobody").pw_uid

2131

gid = pwd.getpwnam("nobody").pw_gid

1726

uid = pwd.getpwnam(u"nobody").pw_uid

1727

gid = pwd.getpwnam(u"nobody").pw_gid

2132

1728

except KeyError:

2133

1729

uid = 65534

2134

1730

gid = 65534

2135

1731

try:

2136

1732

os.setgid(gid)

2137

1733

os.setuid(uid)

2138

except OSError as error:

1734

except OSError, error:

2139

1735

if error[0] != errno.EPERM:

2140

1736

raise error

2141

1737

1738

# Enable all possible GnuTLS debugging

2142

1739

if debug:

2143

# Enable all possible GnuTLS debugging

2144

2145

1740

# "Use a log level over 10 to enable all debugging options."

2146

1741

# - GnuTLS manual

2147

1742

gnutls.library.functions.gnutls_global_set_log_level(11)

2148

1743

2149

1744

@gnutls.library.types.gnutls_log_func

2150

1745

def debug_gnutls(level, string):

2151

logger.debug("GnuTLS: %s", string[:-1])

1746

logger.debug(u"GnuTLS: %s", string[:-1])

2152

1747

2153

1748

(gnutls.library.functions

2154

1749

.gnutls_global_set_log_function(debug_gnutls))

2155

2156

# Redirect stdin so all checkers get /dev/null

2157

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2158

os.dup2(null, sys.stdin.fileno())

2159

if null > 2:

2160

os.close(null)

2161

2162

# Need to fork before connecting to D-Bus

2163

if not debug:

2164

# Close all input and output, do double fork, etc.

2165

daemon()

2166

2167

gobject.threads_init()

2168

1750

2169

1751

global main_loop

2170

1752

# From the Avahi example code

2174

1756

# End of Avahi example code

2175

1757

if use_dbus:

2176

1758

try:

2177

bus_name = dbus.service.BusName("se.recompile.Mandos",

1759

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2178

1760

bus, do_not_queue=True)

2179

old_bus_name = (dbus.service.BusName

2180

("se.bsnet.fukt.Mandos", bus,

2181

do_not_queue=True))

2182

except dbus.exceptions.NameExistsException as e:

2183

logger.error(unicode(e) + ", disabling D-Bus")

1761

except dbus.exceptions.NameExistsException, e:

1762

logger.error(unicode(e) + u", disabling D-Bus")

2184

1763

use_dbus = False

2185

server_settings["use_dbus"] = False

1764

server_settings[u"use_dbus"] = False

2186

1765

tcp_server.use_dbus = False

2187

1766

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2188

service = AvahiServiceToSyslog(name =

2189

server_settings["servicename"],

2190

servicetype = "_mandos._tcp",

2191

protocol = protocol, bus = bus)

1767

service = AvahiService(name = server_settings[u"servicename"],

1768

servicetype = u"_mandos._tcp",

1769

protocol = protocol, bus = bus)

2192

1770

if server_settings["interface"]:

2193

1771

service.interface = (if_nametoindex

2194

(str(server_settings["interface"])))

2195

2196

global multiprocessing_manager

2197

multiprocessing_manager = multiprocessing.Manager()

1772

(str(server_settings[u"interface"])))

2198

1773

2199

1774

client_class = Client

2200

1775

if use_dbus:

2201

client_class = functools.partial(ClientDBusTransitional,

2202

bus = bus)

2203

2204

client_settings = Client.config_parser(client_config)

2205

old_client_settings = {}

2206

clients_data = {}

2207

2208

# Get client data and settings from last running state.

2209

if server_settings["restore"]:

2210

try:

2211

with open(stored_state_path, "rb") as stored_state:

2212

clients_data, old_client_settings = (pickle.load

2213

(stored_state))

2214

os.remove(stored_state_path)

2215

except IOError as e:

2216

logger.warning("Could not load persistent state: {0}"

2217

.format(e))

2218

if e.errno != errno.ENOENT:

2219

raise

2220

except EOFError as e:

2221

logger.warning("Could not load persistent state: "

2222

"EOFError: {0}".format(e))

2223

2224

with PGPEngine() as pgp:

2225

for client_name, client in clients_data.iteritems():

2226

# Decide which value to use after restoring saved state.

2227

# We have three different values: Old config file,

2228

# new config file, and saved state.

2229

# New config value takes precedence if it differs from old

2230

# config value, otherwise use saved state.

2231

for name, value in client_settings[client_name].items():

2232

try:

2233

# For each value in new config, check if it

2234

# differs from the old config value (Except for

2235

# the "secret" attribute)

2236

if (name != "secret" and

2237

value != old_client_settings[client_name]

2238

[name]):

2239

client[name] = value

2240

except KeyError:

2241

pass

2242

2243

# Clients who has passed its expire date can still be

2244

# enabled if its last checker was successful. Clients

2245

# whose checker failed before we stored its state is

2246

# assumed to have failed all checkers during downtime.

2247

if client["enabled"]:

2248

if datetime.datetime.utcnow() >= client["expires"]:

2249

if not client["last_checked_ok"]:

2250

logger.warning(

2251

"disabling client {0} - Client never "

2252

"performed a successfull checker"

2253

.format(client["name"]))

2254

client["enabled"] = False

2255

elif client["last_checker_status"] != 0:

2256

logger.warning(

2257

"disabling client {0} - Client "

2258

"last checker failed with error code {1}"

2259

.format(client["name"],

2260

client["last_checker_status"]))

2261

client["enabled"] = False

2262

else:

2263

client["expires"] = (datetime.datetime

2264

.utcnow()

2265

+ client["timeout"])

2266

1776

client_class = functools.partial(ClientDBus, bus = bus)

1777

def client_config_items(config, section):

1778

special_settings = {

1779

"approved_by_default":

1780

lambda: config.getboolean(section,

1781

"approved_by_default"),

1782

}

1783

for name, value in config.items(section):

2267

1784

try:

2268

client["secret"] = (

2269

pgp.decrypt(client["encrypted_secret"],

2270

client_settings[client_name]

2271

["secret"]))

2272

except PGPError:

2273

# If decryption fails, we use secret from new settings

2274

logger.debug("Failed to decrypt {0} old secret"

2275

.format(client_name))

2276

client["secret"] = (

2277

client_settings[client_name]["secret"])

2278

2279

2280

# Add/remove clients based on new changes made to config

2281

for client_name in set(old_client_settings) - set(client_settings):

2282

del clients_data[client_name]

2283

for client_name in set(client_settings) - set(old_client_settings):

2284

clients_data[client_name] = client_settings[client_name]

2285

2286

# Create clients all clients

2287

for client_name, client in clients_data.iteritems():

2288

tcp_server.clients[client_name] = client_class(

2289

name = client_name, settings = client)

2290

1785

yield (name, special_settings[name]())

1786

except KeyError:

1787

yield (name, value)

1788

1789

tcp_server.clients.update(set(

1790

client_class(name = section,

1791

config= dict(client_config_items(

1792

client_config, section)))

1793

for section in client_config.sections()))

2291

1794

if not tcp_server.clients:

2292

logger.warning("No clients defined")

2293

1795

logger.warning(u"No clients defined")

1796

1797

if debug:

1798

# Redirect stdin so all checkers get /dev/null

1799

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1800

os.dup2(null, sys.stdin.fileno())

1801

if null > 2:

1802

os.close(null)

1803

else:

1804

# No console logging

1805

logger.removeHandler(console)

1806

# Close all input and output, do double fork, etc.

1807

daemon()

1808

1809

try:

1810

with pidfile:

1811

pid = os.getpid()

1812

pidfile.write(str(pid) + "\n")

1813

del pidfile

1814

except IOError:

1815

logger.error(u"Could not write to file %r with PID %d",

1816

pidfilename, pid)

1817

except NameError:

1818

# "pidfile" was never created

1819

pass

1820

del pidfilename

1821

2294

1822

if not debug:

2295

try:

2296

with pidfile:

2297

pid = os.getpid()

2298

pidfile.write(str(pid) + "\n".encode("utf-8"))

2299

del pidfile

2300

except IOError:

2301

logger.error("Could not write to file %r with PID %d",

2302

pidfilename, pid)

2303

except NameError:

2304

# "pidfile" was never created

2305

pass

2306

del pidfilename

2307

1823

signal.signal(signal.SIGINT, signal.SIG_IGN)

2308

2309

1824

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2310

1825

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2311

1826

2313

1828

class MandosDBusService(dbus.service.Object):

2314

1829

"""A D-Bus proxy object"""

2315

1830

def __init__(self):

2316

dbus.service.Object.__init__(self, bus, "/")

2317

_interface = "se.recompile.Mandos"

1831

dbus.service.Object.__init__(self, bus, u"/")

1832

_interface = u"se.bsnet.fukt.Mandos"

2318

1833

2319

@dbus.service.signal(_interface, signature="o")

1834

@dbus.service.signal(_interface, signature=u"o")

2320

1835

def ClientAdded(self, objpath):

2321

1836

"D-Bus signal"

2322

1837

pass

2323

1838

2324

@dbus.service.signal(_interface, signature="ss")

1839

@dbus.service.signal(_interface, signature=u"ss")

2325

1840

def ClientNotFound(self, fingerprint, address):

2326

1841

"D-Bus signal"

2327

1842

pass

2328

1843

2329

@dbus.service.signal(_interface, signature="os")

1844

@dbus.service.signal(_interface, signature=u"os")

2330

1845

def ClientRemoved(self, objpath, name):

2331

1846

"D-Bus signal"

2332

1847

pass

2333

1848

2334

@dbus.service.method(_interface, out_signature="ao")

1849

@dbus.service.method(_interface, out_signature=u"ao")

2335

1850

def GetAllClients(self):

2336

1851

"D-Bus method"

2337

1852

return dbus.Array(c.dbus_object_path

2338

for c in

2339

tcp_server.clients.itervalues())

1853

for c in tcp_server.clients)

2340

1854

2341

1855

@dbus.service.method(_interface,

2342

out_signature="a{oa{sv}}")

1856

out_signature=u"a{oa{sv}}")

2343

1857

def GetAllClientsWithProperties(self):

2344

1858

"D-Bus method"

2345

1859

return dbus.Dictionary(

2346

((c.dbus_object_path, c.GetAll(""))

2347

for c in tcp_server.clients.itervalues()),

2348

signature="oa{sv}")

1860

((c.dbus_object_path, c.GetAll(u""))

1861

for c in tcp_server.clients),

1862

signature=u"oa{sv}")

2349

1863

2350

@dbus.service.method(_interface, in_signature="o")

1864

@dbus.service.method(_interface, in_signature=u"o")

2351

1865

def RemoveClient(self, object_path):

2352

1866

"D-Bus method"

2353

for c in tcp_server.clients.itervalues():

1867

for c in tcp_server.clients:

2354

1868

if c.dbus_object_path == object_path:

2355

del tcp_server.clients[c.name]

1869

tcp_server.clients.remove(c)

2356

1870

c.remove_from_connection()

2357

1871

# Don't signal anything except ClientRemoved

2358

1872

c.disable(quiet=True)

2363

1877

2364

1878

del _interface

2365

1879

2366

class MandosDBusServiceTransitional(MandosDBusService):

2367

__metaclass__ = AlternateDBusNamesMetaclass

2368

mandos_dbus_service = MandosDBusServiceTransitional()

1880

mandos_dbus_service = MandosDBusService()

2369

1881

2370

1882

def cleanup():

2371

1883

"Cleanup function; run on exit"

2372

1884

service.cleanup()

2373

1885

2374

multiprocessing.active_children()

2375

if not (tcp_server.clients or client_settings):

2376

return

2377

2378

# Store client before exiting. Secrets are encrypted with key

2379

# based on what config file has. If config file is

2380

# removed/edited, old secret will thus be unrecovable.

2381

clients = {}

2382

with PGPEngine() as pgp:

2383

for client in tcp_server.clients.itervalues():

2384

key = client_settings[client.name]["secret"]

2385

client.encrypted_secret = pgp.encrypt(client.secret,

2386

key)

2387

client_dict = {}

2388

2389

# A list of attributes that can not be pickled

2390

# + secret.

2391

exclude = set(("bus", "changedstate", "secret",

2392

"checker"))

2393

for name, typ in (inspect.getmembers

2394

(dbus.service.Object)):

2395

exclude.add(name)

2396

2397

client_dict["encrypted_secret"] = (client

2398

.encrypted_secret)

2399

for attr in client.client_structure:

2400

if attr not in exclude:

2401

client_dict[attr] = getattr(client, attr)

2402

2403

clients[client.name] = client_dict

2404

del client_settings[client.name]["secret"]

2405

2406

try:

2407

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2408

prefix="clients-",

2409

dir=os.path.dirname

2410

(stored_state_path))

2411

with os.fdopen(tempfd, "wb") as stored_state:

2412

pickle.dump((clients, client_settings), stored_state)

2413

os.rename(tempname, stored_state_path)

2414

except (IOError, OSError) as e:

2415

logger.warning("Could not save persistent state: {0}"

2416

.format(e))

2417

if not debug:

2418

try:

2419

os.remove(tempname)

2420

except NameError:

2421

pass

2422

if e.errno not in set((errno.ENOENT, errno.EACCES,

2423

errno.EEXIST)):

2424

raise e

2425

2426

# Delete all clients, and settings from config

2427

1886

while tcp_server.clients:

2428

name, client = tcp_server.clients.popitem()

1887

client = tcp_server.clients.pop()

2429

1888

if use_dbus:

2430

1889

client.remove_from_connection()

1890

client.disable_hook = None

2431

1891

# Don't signal anything except ClientRemoved

2432

1892

client.disable(quiet=True)

2433

1893

if use_dbus:

2434

1894

# Emit D-Bus signal

2435

mandos_dbus_service.ClientRemoved(client

2436

.dbus_object_path,

1895

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2437

1896

client.name)

2438

client_settings.clear()

2439

1897

2440

1898

atexit.register(cleanup)

2441

1899

2442

for client in tcp_server.clients.itervalues():

1900

for client in tcp_server.clients:

2443

1901

if use_dbus:

2444

1902

# Emit D-Bus signal

2445

1903

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2446

# Need to initiate checking of clients

2447

if client.enabled:

2448

client.init_checker()

1904

client.enable()

2449

1905

2450

1906

tcp_server.enable()

2451

1907

tcp_server.server_activate()

2453

1909

# Find out what port we got

2454

1910

service.port = tcp_server.socket.getsockname()[1]

2455

1911

if use_ipv6:

2456

logger.info("Now listening on address %r, port %d,"

1912

logger.info(u"Now listening on address %r, port %d,"

2457

1913

" flowinfo %d, scope_id %d"

2458

1914

% tcp_server.socket.getsockname())

2459

1915

else: # IPv4

2460

logger.info("Now listening on address %r, port %d"

1916

logger.info(u"Now listening on address %r, port %d"

2461

1917

% tcp_server.socket.getsockname())

2462

1918

2463

1919

#service.interface = tcp_server.socket.getsockname()[3]

2466

1922

# From the Avahi example code

2467

1923

try:

2468

1924

service.activate()

2469

except dbus.exceptions.DBusException as error:

2470

logger.critical("DBusException: %s", error)

1925

except dbus.exceptions.DBusException, error:

1926

logger.critical(u"DBusException: %s", error)

2471

1927

cleanup()

2472

1928

sys.exit(1)

2473

1929

# End of Avahi example code

2477

1933

(tcp_server.handle_request

2478

1934

(*args[2:], **kwargs) or True))

2479

1935

2480

logger.debug("Starting main loop")

1936

logger.debug(u"Starting main loop")

2481

1937

main_loop.run()

2482

except AvahiError as error:

2483

logger.critical("AvahiError: %s", error)

1938

except AvahiError, error:

1939

logger.critical(u"AvahiError: %s", error)

2484

1940

cleanup()

2485

1941

sys.exit(1)

2486

1942

except KeyboardInterrupt:

2487

1943

if debug:

2488

print("", file=sys.stderr)

2489

logger.debug("Server received KeyboardInterrupt")

2490

logger.debug("Server exiting")

1944

print >> sys.stderr

1945

logger.debug(u"Server received KeyboardInterrupt")

1946

logger.debug(u"Server exiting")

2491

1947

# Must run before the D-Bus bus name gets deregistered

2492

1948

cleanup()

2493

1949