/mandos/trunk : revision 416.1.2

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

61

60

import fcntl

62

61

import functools

63

62

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

63

import select

68

64

69

65

import dbus

70

66

import dbus.service

75

71

import ctypes.util

76

72

import xml.dom.minidom

77

73

import inspect

78

import GnuPGInterface

79

74

80

75

try:

81

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

80

except ImportError:

86

81

SO_BINDTODEVICE = None

87

82

88

version = "1.5.2"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

83

84

version = "1.0.14"

85

86

logger = logging.Logger(u'mandos')

92

87

syslogger = (logging.handlers.SysLogHandler

93

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

210

89

address = "/dev/log"))

90

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

93

logger.addHandler(syslogger)

94

95

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

logger.addHandler(console)

211

100

212

101

class AvahiError(Exception):

213

102

def __init__(self, value, *args, **kwargs):

229

118

Attributes:

230

119

interface: integer; avahi.IF_UNSPEC or an interface index.

231

120

Used to optionally bind to the specified interface.

232

233

type: string; Example: '_mandos._tcp'.

121

122

type: string; Example: u'_mandos._tcp'.

234

123

See <http://www.dns-sd.org/ServiceTypes.html>

235

124

port: integer; what port to announce

236

125

TXT: list of strings; TXT record for the service

245

134

"""

246

135

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

247

136

servicetype = None, port = None, TXT = None,

248

domain = "", host = "", max_renames = 32768,

137

domain = u"", host = u"", max_renames = 32768,

249

138

protocol = avahi.PROTO_UNSPEC, bus = None):

250

139

self.interface = interface

251

140

self.name = name

260

149

self.group = None # our entry group

261

150

self.server = None

262

151

self.bus = bus

263

self.entry_group_state_changed_match = None

264

152

def rename(self):

265

153

"""Derived from the Avahi example code"""

266

154

if self.rename_count >= self.max_renames:

267

logger.critical("No suitable Zeroconf service name found"

268

" after %i retries, exiting.",

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

269

157

self.rename_count)

270

raise AvahiServiceError("Too many renames")

271

self.name = unicode(self.server

272

.GetAlternativeServiceName(self.name))

273

logger.info("Changing Zeroconf service name to %r ...",

274

self.name)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

162

syslogger.setFormatter(logging.Formatter

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

165

% self.name))

275

166

self.remove()

276

try:

277

self.add()

278

except dbus.exceptions.DBusException as error:

279

logger.critical("DBusException: %s", error)

280

self.cleanup()

281

os._exit(1)

167

self.add()

282

168

self.rename_count += 1

283

169

def remove(self):

284

170

"""Derived from the Avahi example code"""

285

if self.entry_group_state_changed_match is not None:

286

self.entry_group_state_changed_match.remove()

287

self.entry_group_state_changed_match = None

288

171

if self.group is not None:

289

172

self.group.Reset()

290

173

def add(self):

291

174

"""Derived from the Avahi example code"""

292

self.remove()

293

175

if self.group is None:

294

176

self.group = dbus.Interface(

295

177

self.bus.get_object(avahi.DBUS_NAME,

296

178

self.server.EntryGroupNew()),

297

179

avahi.DBUS_INTERFACE_ENTRY_GROUP)

298

self.entry_group_state_changed_match = (

299

self.group.connect_to_signal(

300

'StateChanged', self.entry_group_state_changed))

301

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

302

184

self.name, self.type)

303

185

self.group.AddService(

304

186

self.interface,

311

193

self.group.Commit()

312

194

def entry_group_state_changed(self, state, error):

313

195

"""Derived from the Avahi example code"""

314

logger.debug("Avahi entry group state change: %i", state)

196

logger.debug(u"Avahi state change: %i", state)

315

197

316

198

if state == avahi.ENTRY_GROUP_ESTABLISHED:

317

logger.debug("Zeroconf service established.")

199

logger.debug(u"Zeroconf service established.")

318

200

elif state == avahi.ENTRY_GROUP_COLLISION:

319

logger.info("Zeroconf service name collision.")

201

logger.warning(u"Zeroconf service name collision.")

320

202

self.rename()

321

203

elif state == avahi.ENTRY_GROUP_FAILURE:

322

logger.critical("Avahi: Error in group state changed %s",

204

logger.critical(u"Avahi: Error in group state changed %s",

323

205

unicode(error))

324

raise AvahiGroupError("State changed: %s"

206

raise AvahiGroupError(u"State changed: %s"

325

207

% unicode(error))

326

208

def cleanup(self):

327

209

"""Derived from the Avahi example code"""

328

210

if self.group is not None:

329

try:

330

self.group.Free()

331

except (dbus.exceptions.UnknownMethodException,

332

dbus.exceptions.DBusException):

333

pass

211

self.group.Free()

334

212

self.group = None

335

self.remove()

336

def server_state_changed(self, state, error=None):

213

def server_state_changed(self, state):

337

214

"""Derived from the Avahi example code"""

338

logger.debug("Avahi server state change: %i", state)

339

bad_states = { avahi.SERVER_INVALID:

340

"Zeroconf server invalid",

341

avahi.SERVER_REGISTERING: None,

342

avahi.SERVER_COLLISION:

343

"Zeroconf server name collision",

344

avahi.SERVER_FAILURE:

345

"Zeroconf server failure" }

346

if state in bad_states:

347

if bad_states[state] is not None:

348

if error is None:

349

logger.error(bad_states[state])

350

else:

351

logger.error(bad_states[state] + ": %r", error)

352

self.cleanup()

215

if state == avahi.SERVER_COLLISION:

216

logger.error(u"Zeroconf server name collision")

217

self.remove()

353

218

elif state == avahi.SERVER_RUNNING:

354

219

self.add()

355

else:

356

if error is None:

357

logger.debug("Unknown state: %r", state)

358

else:

359

logger.debug("Unknown state: %r: %r", state, error)

360

220

def activate(self):

361

221

"""Derived from the Avahi example code"""

362

222

if self.server is None:

363

223

self.server = dbus.Interface(

364

224

self.bus.get_object(avahi.DBUS_NAME,

365

avahi.DBUS_PATH_SERVER,

366

follow_name_owner_changes=True),

225

avahi.DBUS_PATH_SERVER),

367

226

avahi.DBUS_INTERFACE_SERVER)

368

self.server.connect_to_signal("StateChanged",

227

self.server.connect_to_signal(u"StateChanged",

369

228

self.server_state_changed)

370

229

self.server_state_changed(self.server.GetState())

371

230

372

class AvahiServiceToSyslog(AvahiService):

373

def rename(self):

374

"""Add the new name to the syslog messages"""

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

380

return ret

381

231

382

def timedelta_to_milliseconds(td):

383

"Convert a datetime.timedelta() to milliseconds"

384

return ((td.days * 24 * 60 * 60 * 1000)

385

+ (td.seconds * 1000)

386

+ (td.microseconds // 1000))

387

388

232

class Client(object):

389

233

"""A representation of a client host served by this server.

390

234

391

235

Attributes:

392

approved: bool(); 'None' if not yet approved/disapproved

393

approval_delay: datetime.timedelta(); Time to wait for approval

394

approval_duration: datetime.timedelta(); Duration of one approval

236

237

D-Bus identifiers

238

fingerprint: string (40 or 32 hexadecimal digits); used to

239

uniquely identify the client

240

secret: bytestring; sent verbatim (over TLS) to client

241

host: string; available for use by the checker command

242

created: datetime.datetime(); (UTC) object creation

243

last_enabled: datetime.datetime(); (UTC)

244

enabled: bool()

245

last_checked_ok: datetime.datetime(); (UTC) or None

246

timeout: datetime.timedelta(); How long from last_checked_ok

247

until this client is disabled

248

interval: datetime.timedelta(); How often to start a new checker

249

disable_hook: If set, called by disable() as disable_hook(self)

395

250

checker: subprocess.Popen(); a running checker process used

396

251

to see if the client lives.

397

252

'None' if no process is running.

398

checker_callback_tag: a gobject event source tag, or None

399

checker_command: string; External command which is run to check

400

if client lives. %() expansions are done at

253

checker_initiator_tag: a gobject event source tag, or None

254

disable_initiator_tag: - '' -

255

checker_callback_tag: - '' -

256

checker_command: string; External command which is run to check if

257

client lives. %() expansions are done at

401

258

runtime with vars(self) as dict, so that for

402

259

instance %(name)s can be used in the command.

403

checker_initiator_tag: a gobject event source tag, or None

404

created: datetime.datetime(); (UTC) object creation

405

client_structure: Object describing what attributes a client has

406

and is used for storing the client at exit

407

260

current_checker_command: string; current running checker_command

408

disable_initiator_tag: a gobject event source tag, or None

409

enabled: bool()

410

fingerprint: string (40 or 32 hexadecimal digits); used to

411

uniquely identify the client

412

host: string; available for use by the checker command

413

interval: datetime.timedelta(); How often to start a new checker

414

last_approval_request: datetime.datetime(); (UTC) or None

415

last_checked_ok: datetime.datetime(); (UTC) or None

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, -2 means no checker completed yet.

419

last_enabled: datetime.datetime(); (UTC) or None

420

421

D-Bus identifiers

422

secret: bytestring; sent verbatim (over TLS) to client

423

timeout: datetime.timedelta(); How long from last_checked_ok

424

until this client is disabled

425

extended_timeout: extra long timeout when secret has been sent

426

runtime_expansions: Allowed attributes for runtime expansion.

427

expires: datetime.datetime(); time (UTC) when a client will be

428

disabled, or None

429

261

"""

430

262

431

runtime_expansions = ("approval_delay", "approval_duration",

432

"created", "enabled", "fingerprint",

433

"host", "interval", "last_checked_ok",

434

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

263

@staticmethod

264

def _timedelta_to_milliseconds(td):

265

"Convert a datetime.timedelta() to milliseconds"

266

return ((td.days * 24 * 60 * 60 * 1000)

267

+ (td.seconds * 1000)

268

+ (td.microseconds // 1000))

445

269

446

270

def timeout_milliseconds(self):

447

271

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

449

450

def extended_timeout_milliseconds(self):

451

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

272

return self._timedelta_to_milliseconds(self.timeout)

453

273

454

274

def interval_milliseconds(self):

455

275

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

276

return self._timedelta_to_milliseconds(self.interval)

457

277

458

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

"""Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above.

466

NOTE: Must be a pure function. Must return the same result

467

value given the same arguments.

468

"""

469

settings = {}

470

for client_name in config.sections():

471

section = dict(config.items(client_name))

472

client = settings[client_name] = {}

473

474

client["host"] = section["host"]

475

# Reformat values from string types to Python types

476

client["approved_by_default"] = config.getboolean(

477

client_name, "approved_by_default")

478

client["enabled"] = config.getboolean(client_name,

479

"enabled")

480

481

client["fingerprint"] = (section["fingerprint"].upper()

482

.replace(" ", ""))

483

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

485

elif "secfile" in section:

486

with open(os.path.expanduser(os.path.expandvars

487

(section["secfile"])),

488

"rb") as secfile:

489

client["secret"] = secfile.read()

490

else:

491

raise TypeError("No secret or secfile for section %s"

492

% section)

493

client["timeout"] = string_to_delta(section["timeout"])

494

client["extended_timeout"] = string_to_delta(

495

section["extended_timeout"])

496

client["interval"] = string_to_delta(section["interval"])

497

client["approval_delay"] = string_to_delta(

498

section["approval_delay"])

499

client["approval_duration"] = string_to_delta(

500

section["approval_duration"])

501

client["checker_command"] = section["checker"]

502

client["last_approval_request"] = None

503

client["last_checked_ok"] = None

504

client["last_checker_status"] = -2

505

506

return settings

507

508

509

def __init__(self, settings, name = None):

278

def __init__(self, name = None, disable_hook=None, config=None):

510

279

"""Note: the 'checker' key in 'config' sets the

511

280

'checker_command' attribute and *not* the 'checker'

512

281

attribute."""

513

282

self.name = name

514

# adding all client settings

515

for setting, value in settings.iteritems():

516

setattr(self, setting, value)

517

518

if self.enabled:

519

if not hasattr(self, "last_enabled"):

520

self.last_enabled = datetime.datetime.utcnow()

521

if not hasattr(self, "expires"):

522

self.expires = (datetime.datetime.utcnow()

523

+ self.timeout)

524

else:

525

self.last_enabled = None

526

self.expires = None

527

528

logger.debug("Creating client %r", self.name)

283

if config is None:

284

config = {}

285

logger.debug(u"Creating client %r", self.name)

529

286

# Uppercase and remove spaces from fingerprint for later

530

287

# comparison purposes with return value from the fingerprint()

531

288

# function

532

logger.debug(" Fingerprint: %s", self.fingerprint)

533

self.created = settings.get("created",

534

datetime.datetime.utcnow())

535

536

# attributes specific for this server instance

289

self.fingerprint = (config[u"fingerprint"].upper()

290

.replace(u" ", u""))

291

logger.debug(u" Fingerprint: %s", self.fingerprint)

292

if u"secret" in config:

293

self.secret = config[u"secret"].decode(u"base64")

294

elif u"secfile" in config:

295

with open(os.path.expanduser(os.path.expandvars

296

(config[u"secfile"])),

297

"rb") as secfile:

298

self.secret = secfile.read()

299

else:

300

raise TypeError(u"No secret or secfile for client %s"

301

% self.name)

302

self.host = config.get(u"host", u"")

303

self.created = datetime.datetime.utcnow()

304

self.enabled = False

305

self.last_enabled = None

306

self.last_checked_ok = None

307

self.timeout = string_to_delta(config[u"timeout"])

308

self.interval = string_to_delta(config[u"interval"])

309

self.disable_hook = disable_hook

537

310

self.checker = None

538

311

self.checker_initiator_tag = None

539

312

self.disable_initiator_tag = None

540

313

self.checker_callback_tag = None

314

self.checker_command = config[u"checker"]

541

315

self.current_checker_command = None

542

self.approved = None

543

self.approvals_pending = 0

544

self.changedstate = (multiprocessing_manager

545

.Condition(multiprocessing_manager

546

.Lock()))

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

549

if not attr.startswith("_")]

550

self.client_structure.append("client_structure")

551

552

for name, t in inspect.getmembers(type(self),

553

lambda obj:

554

isinstance(obj,

555

property)):

556

if not name.startswith("_"):

557

self.client_structure.append(name)

558

559

# Send notice to process children that client state has changed

560

def send_changedstate(self):

561

with self.changedstate:

562

self.changedstate.notify_all()

316

self.last_connect = None

563

317

564

318

def enable(self):

565

319

"""Start this client's checker and timeout hooks"""

566

if getattr(self, "enabled", False):

320

if getattr(self, u"enabled", False):

567

321

# Already enabled

568

322

return

569

self.send_changedstate()

570

self.expires = datetime.datetime.utcnow() + self.timeout

571

self.enabled = True

572

323

self.last_enabled = datetime.datetime.utcnow()

573

self.init_checker()

574

575

def disable(self, quiet=True):

576

"""Disable this client."""

577

if not getattr(self, "enabled", False):

578

return False

579

if not quiet:

580

self.send_changedstate()

581

if not quiet:

582

logger.info("Disabling client %s", self.name)

583

if getattr(self, "disable_initiator_tag", False):

584

gobject.source_remove(self.disable_initiator_tag)

585

self.disable_initiator_tag = None

586

self.expires = None

587

if getattr(self, "checker_initiator_tag", False):

588

gobject.source_remove(self.checker_initiator_tag)

589

self.checker_initiator_tag = None

590

self.stop_checker()

591

self.enabled = False

592

# Do not run this again if called by a gobject.timeout_add

593

return False

594

595

def __del__(self):

596

self.disable()

597

598

def init_checker(self):

599

324

# Schedule a new checker to be started an 'interval' from now,

600

325

# and every interval from then on.

601

326

self.checker_initiator_tag = (gobject.timeout_add

605

330

self.disable_initiator_tag = (gobject.timeout_add

606

331

(self.timeout_milliseconds(),

607

332

self.disable))

333

self.enabled = True

608

334

# Also start a new checker *right now*.

609

335

self.start_checker()

610

336

337

def disable(self, quiet=True):

338

"""Disable this client."""

339

if not getattr(self, "enabled", False):

340

return False

341

if not quiet:

342

logger.info(u"Disabling client %s", self.name)

343

if getattr(self, u"disable_initiator_tag", False):

344

gobject.source_remove(self.disable_initiator_tag)

345

self.disable_initiator_tag = None

346

if getattr(self, u"checker_initiator_tag", False):

347

gobject.source_remove(self.checker_initiator_tag)

348

self.checker_initiator_tag = None

349

self.stop_checker()

350

if self.disable_hook:

351

self.disable_hook(self)

352

self.enabled = False

353

# Do not run this again if called by a gobject.timeout_add

354

return False

355

356

def __del__(self):

357

self.disable_hook = None

358

self.disable()

359

611

360

def checker_callback(self, pid, condition, command):

612

361

"""The checker has completed, so take appropriate actions."""

613

362

self.checker_callback_tag = None

614

363

self.checker = None

615

364

if os.WIFEXITED(condition):

616

self.last_checker_status = os.WEXITSTATUS(condition)

617

if self.last_checker_status == 0:

618

logger.info("Checker for %(name)s succeeded",

365

exitstatus = os.WEXITSTATUS(condition)

366

if exitstatus == 0:

367

logger.info(u"Checker for %(name)s succeeded",

619

368

vars(self))

620

369

self.checked_ok()

621

370

else:

622

logger.info("Checker for %(name)s failed",

371

logger.info(u"Checker for %(name)s failed",

623

372

vars(self))

624

373

else:

625

self.last_checker_status = -1

626

logger.warning("Checker for %(name)s crashed?",

374

logger.warning(u"Checker for %(name)s crashed?",

627

375

vars(self))

628

376

629

377

def checked_ok(self):

630

"""Assert that the client has been seen, alive and well."""

378

"""Bump up the timeout for this client.

379

380

This should only be called when the client has been seen,

381

alive and well.

382

"""

631

383

self.last_checked_ok = datetime.datetime.utcnow()

632

self.last_checker_status = 0

633

self.bump_timeout()

634

635

def bump_timeout(self, timeout=None):

636

"""Bump up the timeout for this client."""

637

if timeout is None:

638

timeout = self.timeout

639

if self.disable_initiator_tag is not None:

640

gobject.source_remove(self.disable_initiator_tag)

641

if getattr(self, "enabled", False):

642

self.disable_initiator_tag = (gobject.timeout_add

643

(timedelta_to_milliseconds

644

(timeout), self.disable))

645

self.expires = datetime.datetime.utcnow() + timeout

646

647

def need_approval(self):

648

self.last_approval_request = datetime.datetime.utcnow()

384

gobject.source_remove(self.disable_initiator_tag)

385

self.disable_initiator_tag = (gobject.timeout_add

386

(self.timeout_milliseconds(),

387

self.disable))

649

388

650

389

def start_checker(self):

651

390

"""Start a new checker subprocess if one is not running.

664

403

# If a checker exists, make sure it is not a zombie

665

404

try:

666

405

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

667

except (AttributeError, OSError) as error:

406

except (AttributeError, OSError), error:

668

407

if (isinstance(error, OSError)

669

408

and error.errno != errno.ECHILD):

670

409

raise error

671

410

else:

672

411

if pid:

673

logger.warning("Checker was a zombie")

412

logger.warning(u"Checker was a zombie")

674

413

gobject.source_remove(self.checker_callback_tag)

675

414

self.checker_callback(pid, status,

676

415

self.current_checker_command)

681

420

command = self.checker_command % self.host

682

421

except TypeError:

683

422

# Escape attributes for the shell

684

escaped_attrs = dict(

685

(attr,

686

re.escape(unicode(str(getattr(self, attr, "")),

687

errors=

688

'replace')))

689

for attr in

690

self.runtime_expansions)

691

423

escaped_attrs = dict((key,

424

re.escape(unicode(str(val),

425

errors=

426

u'replace')))

427

for key, val in

428

vars(self).iteritems())

692

429

try:

693

430

command = self.checker_command % escaped_attrs

694

except TypeError as error:

695

logger.error('Could not format string "%s":'

696

' %s', self.checker_command, error)

431

except TypeError, error:

432

logger.error(u'Could not format string "%s":'

433

u' %s', self.checker_command, error)

697

434

return True # Try again later

698

435

self.current_checker_command = command

699

436

try:

700

logger.info("Starting checker %r for %s",

437

logger.info(u"Starting checker %r for %s",

701

438

command, self.name)

702

439

# We don't need to redirect stdout and stderr, since

703

440

# in normal mode, that is already done by daemon(),

705

442

# always replaced by /dev/null.)

706

443

self.checker = subprocess.Popen(command,

707

444

close_fds=True,

708

shell=True, cwd="/")

445

shell=True, cwd=u"/")

709

446

self.checker_callback_tag = (gobject.child_watch_add

710

447

(self.checker.pid,

711

448

self.checker_callback,

716

453

if pid:

717

454

gobject.source_remove(self.checker_callback_tag)

718

455

self.checker_callback(pid, status, command)

719

except OSError as error:

720

logger.error("Failed to start subprocess: %s",

456

except OSError, error:

457

logger.error(u"Failed to start subprocess: %s",

721

458

error)

722

459

# Re-run this periodically if run by gobject.timeout_add

723

460

return True

727

464

if self.checker_callback_tag:

728

465

gobject.source_remove(self.checker_callback_tag)

729

466

self.checker_callback_tag = None

730

if getattr(self, "checker", None) is None:

467

if getattr(self, u"checker", None) is None:

731

468

return

732

logger.debug("Stopping checker for %(name)s", vars(self))

469

logger.debug(u"Stopping checker for %(name)s", vars(self))

733

470

try:

734

471

os.kill(self.checker.pid, signal.SIGTERM)

735

472

#time.sleep(0.5)

736

473

#if self.checker.poll() is None:

737

474

# os.kill(self.checker.pid, signal.SIGKILL)

738

except OSError as error:

475

except OSError, error:

739

476

if error.errno != errno.ESRCH: # No such process

740

477

raise

741

478

self.checker = None

742

479

743

480

744

def dbus_service_property(dbus_interface, signature="v",

745

access="readwrite", byte_arrays=False):

481

def dbus_service_property(dbus_interface, signature=u"v",

482

access=u"readwrite", byte_arrays=False):

746

483

"""Decorators for marking methods of a DBusObjectWithProperties to

747

484

become properties on the D-Bus.

748

485

755

492

"""

756

493

# Encoding deeply encoded byte arrays is not supported yet by the

757

494

# "Set" method, so we fail early here:

758

if byte_arrays and signature != "ay":

759

raise ValueError("Byte arrays not supported for non-'ay'"

760

" signature %r" % signature)

495

if byte_arrays and signature != u"ay":

496

raise ValueError(u"Byte arrays not supported for non-'ay'"

497

u" signature %r" % signature)

761

498

def decorator(func):

762

499

func._dbus_is_property = True

763

500

func._dbus_interface = dbus_interface

764

501

func._dbus_signature = signature

765

502

func._dbus_access = access

766

503

func._dbus_name = func.__name__

767

if func._dbus_name.endswith("_dbus_property"):

504

if func._dbus_name.endswith(u"_dbus_property"):

768

505

func._dbus_name = func._dbus_name[:-14]

769

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

506

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

770

507

return func

771

508

return decorator

772

509

792

529

793

530

class DBusObjectWithProperties(dbus.service.Object):

794

531

"""A D-Bus object with properties.

795

532

796

533

Classes inheriting from this can use the dbus_service_property

797

534

decorator to expose methods as D-Bus properties. It exposes the

798

535

standard Get(), Set(), and GetAll() methods on the D-Bus.

800

537

801

538

@staticmethod

802

539

def _is_dbus_property(obj):

803

return getattr(obj, "_dbus_is_property", False)

540

return getattr(obj, u"_dbus_is_property", False)

804

541

805

542

def _get_all_dbus_properties(self):

806

543

"""Returns a generator of (name, attribute) pairs

807

544

"""

808

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

809

for cls in self.__class__.__mro__

545

return ((prop._dbus_name, prop)

810

546

for name, prop in

811

inspect.getmembers(cls, self._is_dbus_property))

547

inspect.getmembers(self, self._is_dbus_property))

812

548

813

549

def _get_dbus_property(self, interface_name, property_name):

814

550

"""Returns a bound method if one exists which is a D-Bus

815

551

property with the specified name and interface.

816

552

"""

817

for cls in self.__class__.__mro__:

818

for name, value in (inspect.getmembers

819

(cls, self._is_dbus_property)):

820

if (value._dbus_name == property_name

821

and value._dbus_interface == interface_name):

822

return value.__get__(self)

823

553

for name in (property_name,

554

property_name + u"_dbus_property"):

555

prop = getattr(self, name, None)

556

if (prop is None

557

or not self._is_dbus_property(prop)

558

or prop._dbus_name != property_name

559

or (interface_name and prop._dbus_interface

560

and interface_name != prop._dbus_interface)):

561

continue

562

return prop

824

563

# No such property

825

raise DBusPropertyNotFound(self.dbus_object_path + ":"

826

+ interface_name + "."

564

raise DBusPropertyNotFound(self.dbus_object_path + u":"

565

+ interface_name + u"."

827

566

+ property_name)

828

567

829

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

830

out_signature="v")

568

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

569

out_signature=u"v")

831

570

def Get(self, interface_name, property_name):

832

571

"""Standard D-Bus property Get() method, see D-Bus standard.

833

572

"""

834

573

prop = self._get_dbus_property(interface_name, property_name)

835

if prop._dbus_access == "write":

574

if prop._dbus_access == u"write":

836

575

raise DBusPropertyAccessException(property_name)

837

576

value = prop()

838

if not hasattr(value, "variant_level"):

577

if not hasattr(value, u"variant_level"):

839

578

return value

840

579

return type(value)(value, variant_level=value.variant_level+1)

841

580

842

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

581

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

843

582

def Set(self, interface_name, property_name, value):

844

583

"""Standard D-Bus property Set() method, see D-Bus standard.

845

584

"""

846

585

prop = self._get_dbus_property(interface_name, property_name)

847

if prop._dbus_access == "read":

586

if prop._dbus_access == u"read":

848

587

raise DBusPropertyAccessException(property_name)

849

if prop._dbus_get_args_options["byte_arrays"]:

588

if prop._dbus_get_args_options[u"byte_arrays"]:

850

589

# The byte_arrays option is not supported yet on

851

590

# signatures other than "ay".

852

if prop._dbus_signature != "ay":

591

if prop._dbus_signature != u"ay":

853

592

raise ValueError

854

value = dbus.ByteArray(b''.join(chr(byte)

855

for byte in value))

593

value = dbus.ByteArray(''.join(unichr(byte)

594

for byte in value))

856

595

prop(value)

857

596

858

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

859

out_signature="a{sv}")

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

598

out_signature=u"a{sv}")

860

599

def GetAll(self, interface_name):

861

600

"""Standard D-Bus property GetAll() method, see D-Bus

862

601

standard.

863

602

864

603

Note: Will not include properties with access="write".

865

604

"""

866

properties = {}

605

all = {}

867

606

for name, prop in self._get_all_dbus_properties():

868

607

if (interface_name

869

608

and interface_name != prop._dbus_interface):

870

609

# Interface non-empty but did not match

871

610

continue

872

611

# Ignore write-only properties

873

if prop._dbus_access == "write":

612

if prop._dbus_access == u"write":

874

613

continue

875

614

value = prop()

876

if not hasattr(value, "variant_level"):

877

properties[name] = value

615

if not hasattr(value, u"variant_level"):

616

all[name] = value

878

617

continue

879

properties[name] = type(value)(value, variant_level=

880

value.variant_level+1)

881

return dbus.Dictionary(properties, signature="sv")

618

all[name] = type(value)(value, variant_level=

619

value.variant_level+1)

620

return dbus.Dictionary(all, signature=u"sv")

882

621

883

622

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

884

out_signature="s",

623

out_signature=u"s",

885

624

path_keyword='object_path',

886

625

connection_keyword='connection')

887

626

def Introspect(self, object_path, connection):

892

631

try:

893

632

document = xml.dom.minidom.parseString(xmlstring)

894

633

def make_tag(document, name, prop):

895

e = document.createElement("property")

896

e.setAttribute("name", name)

897

e.setAttribute("type", prop._dbus_signature)

898

e.setAttribute("access", prop._dbus_access)

634

e = document.createElement(u"property")

635

e.setAttribute(u"name", name)

636

e.setAttribute(u"type", prop._dbus_signature)

637

e.setAttribute(u"access", prop._dbus_access)

899

638

return e

900

for if_tag in document.getElementsByTagName("interface"):

639

for if_tag in document.getElementsByTagName(u"interface"):

901

640

for tag in (make_tag(document, name, prop)

902

641

for name, prop

903

642

in self._get_all_dbus_properties()

904

643

if prop._dbus_interface

905

== if_tag.getAttribute("name")):

644

== if_tag.getAttribute(u"name")):

906

645

if_tag.appendChild(tag)

907

646

# Add the names to the return values for the

908

647

# "org.freedesktop.DBus.Properties" methods

909

if (if_tag.getAttribute("name")

910

== "org.freedesktop.DBus.Properties"):

911

for cn in if_tag.getElementsByTagName("method"):

912

if cn.getAttribute("name") == "Get":

913

for arg in cn.getElementsByTagName("arg"):

914

if (arg.getAttribute("direction")

915

== "out"):

916

arg.setAttribute("name", "value")

917

elif cn.getAttribute("name") == "GetAll":

918

for arg in cn.getElementsByTagName("arg"):

919

if (arg.getAttribute("direction")

920

== "out"):

921

arg.setAttribute("name", "props")

922

xmlstring = document.toxml("utf-8")

648

if (if_tag.getAttribute(u"name")

649

== u"org.freedesktop.DBus.Properties"):

650

for cn in if_tag.getElementsByTagName(u"method"):

651

if cn.getAttribute(u"name") == u"Get":

652

for arg in cn.getElementsByTagName(u"arg"):

653

if (arg.getAttribute(u"direction")

654

== u"out"):

655

arg.setAttribute(u"name", u"value")

656

elif cn.getAttribute(u"name") == u"GetAll":

657

for arg in cn.getElementsByTagName(u"arg"):

658

if (arg.getAttribute(u"direction")

659

== u"out"):

660

arg.setAttribute(u"name", u"props")

661

xmlstring = document.toxml(u"utf-8")

923

662

document.unlink()

924

663

except (AttributeError, xml.dom.DOMException,

925

xml.parsers.expat.ExpatError) as error:

926

logger.error("Failed to override Introspection method",

664

xml.parsers.expat.ExpatError), error:

665

logger.error(u"Failed to override Introspection method",

927

666

error)

928

667

return xmlstring

929

668

930

669

931

def datetime_to_dbus (dt, variant_level=0):

932

"""Convert a UTC datetime.datetime() to a D-Bus type."""

933

if dt is None:

934

return dbus.String("", variant_level = variant_level)

935

return dbus.String(dt.isoformat(),

936

variant_level=variant_level)

937

938

939

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

940

.__metaclass__):

941

"""Applied to an empty subclass of a D-Bus object, this metaclass

942

will add additional D-Bus attributes matching a certain pattern.

943

"""

944

def __new__(mcs, name, bases, attr):

945

# Go through all the base classes which could have D-Bus

946

# methods, signals, or properties in them

947

for base in (b for b in bases

948

if issubclass(b, dbus.service.Object)):

949

# Go though all attributes of the base class

950

for attrname, attribute in inspect.getmembers(base):

951

# Ignore non-D-Bus attributes, and D-Bus attributes

952

# with the wrong interface name

953

if (not hasattr(attribute, "_dbus_interface")

954

or not attribute._dbus_interface

955

.startswith("se.recompile.Mandos")):

956

continue

957

# Create an alternate D-Bus interface name based on

958

# the current name

959

alt_interface = (attribute._dbus_interface

960

.replace("se.recompile.Mandos",

961

"se.bsnet.fukt.Mandos"))

962

# Is this a D-Bus signal?

963

if getattr(attribute, "_dbus_is_signal", False):

964

# Extract the original non-method function by

965

# black magic

966

nonmethod_func = (dict(

967

zip(attribute.func_code.co_freevars,

968

attribute.__closure__))["func"]

969

.cell_contents)

970

# Create a new, but exactly alike, function

971

# object, and decorate it to be a new D-Bus signal

972

# with the alternate D-Bus interface name

973

new_function = (dbus.service.signal

974

(alt_interface,

975

attribute._dbus_signature)

976

(types.FunctionType(

977

nonmethod_func.func_code,

978

nonmethod_func.func_globals,

979

nonmethod_func.func_name,

980

nonmethod_func.func_defaults,

981

nonmethod_func.func_closure)))

982

# Define a creator of a function to call both the

983

# old and new functions, so both the old and new

984

# signals gets sent when the function is called

985

def fixscope(func1, func2):

986

"""This function is a scope container to pass

987

func1 and func2 to the "call_both" function

988

outside of its arguments"""

989

def call_both(*args, **kwargs):

990

"""This function will emit two D-Bus

991

signals by calling func1 and func2"""

992

func1(*args, **kwargs)

993

func2(*args, **kwargs)

994

return call_both

995

# Create the "call_both" function and add it to

996

# the class

997

attr[attrname] = fixscope(attribute,

998

new_function)

999

# Is this a D-Bus method?

1000

elif getattr(attribute, "_dbus_is_method", False):

1001

# Create a new, but exactly alike, function

1002

# object. Decorate it to be a new D-Bus method

1003

# with the alternate D-Bus interface name. Add it

1004

# to the class.

1005

attr[attrname] = (dbus.service.method

1006

(alt_interface,

1007

attribute._dbus_in_signature,

1008

attribute._dbus_out_signature)

1009

(types.FunctionType

1010

(attribute.func_code,

1011

attribute.func_globals,

1012

attribute.func_name,

1013

attribute.func_defaults,

1014

attribute.func_closure)))

1015

# Is this a D-Bus property?

1016

elif getattr(attribute, "_dbus_is_property", False):

1017

# Create a new, but exactly alike, function

1018

# object, and decorate it to be a new D-Bus

1019

# property with the alternate D-Bus interface

1020

# name. Add it to the class.

1021

attr[attrname] = (dbus_service_property

1022

(alt_interface,

1023

attribute._dbus_signature,

1024

attribute._dbus_access,

1025

attribute

1026

._dbus_get_args_options

1027

["byte_arrays"])

1028

(types.FunctionType

1029

(attribute.func_code,

1030

attribute.func_globals,

1031

attribute.func_name,

1032

attribute.func_defaults,

1033

attribute.func_closure)))

1034

return type.__new__(mcs, name, bases, attr)

1035

1036

1037

670

class ClientDBus(Client, DBusObjectWithProperties):

1038

671

"""A Client class using D-Bus

1039

672

1041

674

dbus_object_path: dbus.ObjectPath

1042

675

bus: dbus.SystemBus()

1043

676

"""

1044

1045

runtime_expansions = (Client.runtime_expansions

1046

+ ("dbus_object_path",))

1047

1048

677

# dbus.service.Object doesn't use super(), so we can't either.

1049

678

1050

679

def __init__(self, bus = None, *args, **kwargs):

1052

681

Client.__init__(self, *args, **kwargs)

1053

682

# Only now, when this client is initialized, can it show up on

1054

683

# the D-Bus

1055

client_object_name = unicode(self.name).translate(

1056

{ord("."): ord("_"),

1057

ord("-"): ord("_")})

1058

684

self.dbus_object_path = (dbus.ObjectPath

1059

("/clients/" + client_object_name))

685

(u"/clients/"

686

+ self.name.replace(u".", u"_")))

1060

687

DBusObjectWithProperties.__init__(self, self.bus,

1061

688

self.dbus_object_path)

1062

1063

def notifychangeproperty(transform_func,

1064

dbus_name, type_func=lambda x: x,

1065

variant_level=1):

1066

""" Modify a variable so that it's a property which announces

1067

its changes to DBus.

1068

1069

transform_fun: Function that takes a value and a variant_level

1070

and transforms it to a D-Bus type.

1071

dbus_name: D-Bus name of the variable

1072

type_func: Function that transform the value before sending it

1073

to the D-Bus. Default: no transform

1074

variant_level: D-Bus variant level. Default: 1

1075

"""

1076

attrname = "_{0}".format(dbus_name)

1077

def setter(self, value):

1078

if hasattr(self, "dbus_object_path"):

1079

if (not hasattr(self, attrname) or

1080

type_func(getattr(self, attrname, None))

1081

!= type_func(value)):

1082

dbus_value = transform_func(type_func(value),

1083

variant_level

1084

=variant_level)

1085

self.PropertyChanged(dbus.String(dbus_name),

1086

dbus_value)

1087

setattr(self, attrname, value)

1088

1089

return property(lambda self: getattr(self, attrname), setter)

1090

1091

1092

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1093

approvals_pending = notifychangeproperty(dbus.Boolean,

1094

"ApprovalPending",

1095

type_func = bool)

1096

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1097

last_enabled = notifychangeproperty(datetime_to_dbus,

1098

"LastEnabled")

1099

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1100

type_func = lambda checker:

1101

checker is not None)

1102

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1103

"LastCheckedOK")

1104

last_checker_status = notifychangeproperty(dbus.Int16,

1105

"LastCheckerStatus")

1106

last_approval_request = notifychangeproperty(

1107

datetime_to_dbus, "LastApprovalRequest")

1108

approved_by_default = notifychangeproperty(dbus.Boolean,

1109

"ApprovedByDefault")

1110

approval_delay = notifychangeproperty(dbus.UInt64,

1111

"ApprovalDelay",

1112

type_func =

1113

timedelta_to_milliseconds)

1114

approval_duration = notifychangeproperty(

1115

dbus.UInt64, "ApprovalDuration",

1116

type_func = timedelta_to_milliseconds)

1117

host = notifychangeproperty(dbus.String, "Host")

1118

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1119

type_func =

1120

timedelta_to_milliseconds)

1121

extended_timeout = notifychangeproperty(

1122

dbus.UInt64, "ExtendedTimeout",

1123

type_func = timedelta_to_milliseconds)

1124

interval = notifychangeproperty(dbus.UInt64,

1125

"Interval",

1126

type_func =

1127

timedelta_to_milliseconds)

1128

checker_command = notifychangeproperty(dbus.String, "Checker")

1129

1130

del notifychangeproperty

689

690

@staticmethod

691

def _datetime_to_dbus(dt, variant_level=0):

692

"""Convert a UTC datetime.datetime() to a D-Bus type."""

693

return dbus.String(dt.isoformat(),

694

variant_level=variant_level)

695

696

def enable(self):

697

oldstate = getattr(self, u"enabled", False)

698

r = Client.enable(self)

699

if oldstate != self.enabled:

700

# Emit D-Bus signals

701

self.PropertyChanged(dbus.String(u"enabled"),

702

dbus.Boolean(True, variant_level=1))

703

self.PropertyChanged(

704

dbus.String(u"last_enabled"),

705

self._datetime_to_dbus(self.last_enabled,

706

variant_level=1))

707

return r

708

709

def disable(self, quiet = False):

710

oldstate = getattr(self, u"enabled", False)

711

r = Client.disable(self, quiet=quiet)

712

if not quiet and oldstate != self.enabled:

713

# Emit D-Bus signal

714

self.PropertyChanged(dbus.String(u"enabled"),

715

dbus.Boolean(False, variant_level=1))

716

return r

1131

717

1132

718

def __del__(self, *args, **kwargs):

1133

719

try:

1134

720

self.remove_from_connection()

1135

721

except LookupError:

1136

722

pass

1137

if hasattr(DBusObjectWithProperties, "__del__"):

723

if hasattr(DBusObjectWithProperties, u"__del__"):

1138

724

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1139

725

Client.__del__(self, *args, **kwargs)

1140

726

1142

728

*args, **kwargs):

1143

729

self.checker_callback_tag = None

1144

730

self.checker = None

731

# Emit D-Bus signal

732

self.PropertyChanged(dbus.String(u"checker_running"),

733

dbus.Boolean(False, variant_level=1))

1145

734

if os.WIFEXITED(condition):

1146

735

exitstatus = os.WEXITSTATUS(condition)

1147

736

# Emit D-Bus signal

1157

746

return Client.checker_callback(self, pid, condition, command,

1158

747

*args, **kwargs)

1159

748

749

def checked_ok(self, *args, **kwargs):

750

r = Client.checked_ok(self, *args, **kwargs)

751

# Emit D-Bus signal

752

self.PropertyChanged(

753

dbus.String(u"last_checked_ok"),

754

(self._datetime_to_dbus(self.last_checked_ok,

755

variant_level=1)))

756

return r

757

1160

758

def start_checker(self, *args, **kwargs):

1161

759

old_checker = self.checker

1162

760

if self.checker is not None:

1169

767

and old_checker_pid != self.checker.pid):

1170

768

# Emit D-Bus signal

1171

769

self.CheckerStarted(self.current_checker_command)

1172

return r

1173

1174

def _reset_approved(self):

1175

self.approved = None

1176

return False

1177

1178

def approve(self, value=True):

1179

self.send_changedstate()

1180

self.approved = value

1181

gobject.timeout_add(timedelta_to_milliseconds

1182

(self.approval_duration),

1183

self._reset_approved)

1184

770

self.PropertyChanged(

771

dbus.String(u"checker_running"),

772

dbus.Boolean(True, variant_level=1))

773

return r

774

775

def stop_checker(self, *args, **kwargs):

776

old_checker = getattr(self, u"checker", None)

777

r = Client.stop_checker(self, *args, **kwargs)

778

if (old_checker is not None

779

and getattr(self, u"checker", None) is None):

780

self.PropertyChanged(dbus.String(u"checker_running"),

781

dbus.Boolean(False, variant_level=1))

782

return r

1185

783

1186

784

## D-Bus methods, signals & properties

1187

_interface = "se.recompile.Mandos.Client"

785

_interface = u"se.bsnet.fukt.Mandos.Client"

1188

786

1189

787

## Signals

1190

788

1191

789

# CheckerCompleted - signal

1192

@dbus.service.signal(_interface, signature="nxs")

790

@dbus.service.signal(_interface, signature=u"nxs")

1193

791

def CheckerCompleted(self, exitcode, waitstatus, command):

1194

792

"D-Bus signal"

1195

793

pass

1196

794

1197

795

# CheckerStarted - signal

1198

@dbus.service.signal(_interface, signature="s")

796

@dbus.service.signal(_interface, signature=u"s")

1199

797

def CheckerStarted(self, command):

1200

798

"D-Bus signal"

1201

799

pass

1202

800

1203

801

# PropertyChanged - signal

1204

@dbus.service.signal(_interface, signature="sv")

802

@dbus.service.signal(_interface, signature=u"sv")

1205

803

def PropertyChanged(self, property, value):

1206

804

"D-Bus signal"

1207

805

pass

1209

807

# GotSecret - signal

1210

808

@dbus.service.signal(_interface)

1211

809

def GotSecret(self):

1212

"""D-Bus signal

1213

Is sent after a successful transfer of secret from the Mandos

1214

server to mandos-client

1215

"""

810

"D-Bus signal"

1216

811

pass

1217

812

1218

813

# Rejected - signal

1219

@dbus.service.signal(_interface, signature="s")

1220

def Rejected(self, reason):

814

@dbus.service.signal(_interface)

815

def Rejected(self):

1221

816

"D-Bus signal"

1222

817

pass

1223

818

1224

# NeedApproval - signal

1225

@dbus.service.signal(_interface, signature="tb")

1226

def NeedApproval(self, timeout, default):

1227

"D-Bus signal"

1228

return self.need_approval()

1229

1230

819

## Methods

1231

820

1232

# Approve - method

1233

@dbus.service.method(_interface, in_signature="b")

1234

def Approve(self, value):

1235

self.approve(value)

1236

1237

821

# CheckedOK - method

1238

822

@dbus.service.method(_interface)

1239

823

def CheckedOK(self):

1240

self.checked_ok()

824

return self.checked_ok()

1241

825

1242

826

# Enable - method

1243

827

@dbus.service.method(_interface)

1264

848

1265

849

## Properties

1266

850

1267

# ApprovalPending - property

1268

@dbus_service_property(_interface, signature="b", access="read")

1269

def ApprovalPending_dbus_property(self):

1270

return dbus.Boolean(bool(self.approvals_pending))

1271

1272

# ApprovedByDefault - property

1273

@dbus_service_property(_interface, signature="b",

1274

access="readwrite")

1275

def ApprovedByDefault_dbus_property(self, value=None):

1276

if value is None: # get

1277

return dbus.Boolean(self.approved_by_default)

1278

self.approved_by_default = bool(value)

1279

1280

# ApprovalDelay - property

1281

@dbus_service_property(_interface, signature="t",

1282

access="readwrite")

1283

def ApprovalDelay_dbus_property(self, value=None):

1284

if value is None: # get

1285

return dbus.UInt64(self.approval_delay_milliseconds())

1286

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1287

1288

# ApprovalDuration - property

1289

@dbus_service_property(_interface, signature="t",

1290

access="readwrite")

1291

def ApprovalDuration_dbus_property(self, value=None):

1292

if value is None: # get

1293

return dbus.UInt64(timedelta_to_milliseconds(

1294

self.approval_duration))

1295

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1296

1297

# Name - property

1298

@dbus_service_property(_interface, signature="s", access="read")

1299

def Name_dbus_property(self):

851

# name - property

852

@dbus_service_property(_interface, signature=u"s", access=u"read")

853

def name_dbus_property(self):

1300

854

return dbus.String(self.name)

1301

855

1302

# Fingerprint - property

1303

@dbus_service_property(_interface, signature="s", access="read")

1304

def Fingerprint_dbus_property(self):

856

# fingerprint - property

857

@dbus_service_property(_interface, signature=u"s", access=u"read")

858

def fingerprint_dbus_property(self):

1305

859

return dbus.String(self.fingerprint)

1306

860

1307

# Host - property

1308

@dbus_service_property(_interface, signature="s",

1309

access="readwrite")

1310

def Host_dbus_property(self, value=None):

861

# host - property

862

@dbus_service_property(_interface, signature=u"s",

863

access=u"readwrite")

864

def host_dbus_property(self, value=None):

1311

865

if value is None: # get

1312

866

return dbus.String(self.host)

1313

self.host = unicode(value)

1314

1315

# Created - property

1316

@dbus_service_property(_interface, signature="s", access="read")

1317

def Created_dbus_property(self):

1318

return datetime_to_dbus(self.created)

1319

1320

# LastEnabled - property

1321

@dbus_service_property(_interface, signature="s", access="read")

1322

def LastEnabled_dbus_property(self):

1323

return datetime_to_dbus(self.last_enabled)

1324

1325

# Enabled - property

1326

@dbus_service_property(_interface, signature="b",

1327

access="readwrite")

1328

def Enabled_dbus_property(self, value=None):

867

self.host = value

868

# Emit D-Bus signal

869

self.PropertyChanged(dbus.String(u"host"),

870

dbus.String(value, variant_level=1))

871

872

# created - property

873

@dbus_service_property(_interface, signature=u"s", access=u"read")

874

def created_dbus_property(self):

875

return dbus.String(self._datetime_to_dbus(self.created))

876

877

# last_enabled - property

878

@dbus_service_property(_interface, signature=u"s", access=u"read")

879

def last_enabled_dbus_property(self):

880

if self.last_enabled is None:

881

return dbus.String(u"")

882

return dbus.String(self._datetime_to_dbus(self.last_enabled))

883

884

# enabled - property

885

@dbus_service_property(_interface, signature=u"b",

886

access=u"readwrite")

887

def enabled_dbus_property(self, value=None):

1329

888

if value is None: # get

1330

889

return dbus.Boolean(self.enabled)

1331

890

if value:

1333

892

else:

1334

893

self.disable()

1335

894

1336

# LastCheckedOK - property

1337

@dbus_service_property(_interface, signature="s",

1338

access="readwrite")

1339

def LastCheckedOK_dbus_property(self, value=None):

895

# last_checked_ok - property

896

@dbus_service_property(_interface, signature=u"s",

897

access=u"readwrite")

898

def last_checked_ok_dbus_property(self, value=None):

1340

899

if value is not None:

1341

900

self.checked_ok()

1342

901

return

1343

return datetime_to_dbus(self.last_checked_ok)

1344

1345

# LastCheckerStatus - property

1346

@dbus_service_property(_interface, signature="n",

1347

access="read")

1348

def LastCheckerStatus_dbus_property(self):

1349

return dbus.Int16(self.last_checker_status)

1350

1351

# Expires - property

1352

@dbus_service_property(_interface, signature="s", access="read")

1353

def Expires_dbus_property(self):

1354

return datetime_to_dbus(self.expires)

1355

1356

# LastApprovalRequest - property

1357

@dbus_service_property(_interface, signature="s", access="read")

1358

def LastApprovalRequest_dbus_property(self):

1359

return datetime_to_dbus(self.last_approval_request)

1360

1361

# Timeout - property

1362

@dbus_service_property(_interface, signature="t",

1363

access="readwrite")

1364

def Timeout_dbus_property(self, value=None):

902

if self.last_checked_ok is None:

903

return dbus.String(u"")

904

return dbus.String(self._datetime_to_dbus(self

905

.last_checked_ok))

906

907

# timeout - property

908

@dbus_service_property(_interface, signature=u"t",

909

access=u"readwrite")

910

def timeout_dbus_property(self, value=None):

1365

911

if value is None: # get

1366

912

return dbus.UInt64(self.timeout_milliseconds())

1367

913

self.timeout = datetime.timedelta(0, 0, 0, value)

914

# Emit D-Bus signal

915

self.PropertyChanged(dbus.String(u"timeout"),

916

dbus.UInt64(value, variant_level=1))

917

if getattr(self, u"disable_initiator_tag", None) is None:

918

return

1368

919

# Reschedule timeout

1369

if self.enabled:

1370

now = datetime.datetime.utcnow()

1371

time_to_die = timedelta_to_milliseconds(

1372

(self.last_checked_ok + self.timeout) - now)

1373

if time_to_die <= 0:

1374

# The timeout has passed

1375

self.disable()

1376

else:

1377

self.expires = (now +

1378

datetime.timedelta(milliseconds =

1379

time_to_die))

1380

if (getattr(self, "disable_initiator_tag", None)

1381

is None):

1382

return

1383

gobject.source_remove(self.disable_initiator_tag)

1384

self.disable_initiator_tag = (gobject.timeout_add

1385

(time_to_die,

1386

self.disable))

1387

1388

# ExtendedTimeout - property

1389

@dbus_service_property(_interface, signature="t",

1390

access="readwrite")

1391

def ExtendedTimeout_dbus_property(self, value=None):

1392

if value is None: # get

1393

return dbus.UInt64(self.extended_timeout_milliseconds())

1394

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1395

1396

# Interval - property

1397

@dbus_service_property(_interface, signature="t",

1398

access="readwrite")

1399

def Interval_dbus_property(self, value=None):

920

gobject.source_remove(self.disable_initiator_tag)

921

self.disable_initiator_tag = None

922

time_to_die = (self.

923

_timedelta_to_milliseconds((self

924

.last_checked_ok

925

+ self.timeout)

926

- datetime.datetime

927

.utcnow()))

928

if time_to_die <= 0:

929

# The timeout has passed

930

self.disable()

931

else:

932

self.disable_initiator_tag = (gobject.timeout_add

933

(time_to_die, self.disable))

934

935

# interval - property

936

@dbus_service_property(_interface, signature=u"t",

937

access=u"readwrite")

938

def interval_dbus_property(self, value=None):

1400

939

if value is None: # get

1401

940

return dbus.UInt64(self.interval_milliseconds())

1402

941

self.interval = datetime.timedelta(0, 0, 0, value)

1403

if getattr(self, "checker_initiator_tag", None) is None:

942

# Emit D-Bus signal

943

self.PropertyChanged(dbus.String(u"interval"),

944

dbus.UInt64(value, variant_level=1))

945

if getattr(self, u"checker_initiator_tag", None) is None:

1404

946

return

1405

if self.enabled:

1406

# Reschedule checker run

1407

gobject.source_remove(self.checker_initiator_tag)

1408

self.checker_initiator_tag = (gobject.timeout_add

1409

(value, self.start_checker))

1410

self.start_checker() # Start one now, too

1411

1412

# Checker - property

1413

@dbus_service_property(_interface, signature="s",

1414

access="readwrite")

1415

def Checker_dbus_property(self, value=None):

947

# Reschedule checker run

948

gobject.source_remove(self.checker_initiator_tag)

949

self.checker_initiator_tag = (gobject.timeout_add

950

(value, self.start_checker))

951

self.start_checker() # Start one now, too

952

953

# checker - property

954

@dbus_service_property(_interface, signature=u"s",

955

access=u"readwrite")

956

def checker_dbus_property(self, value=None):

1416

957

if value is None: # get

1417

958

return dbus.String(self.checker_command)

1418

self.checker_command = unicode(value)

959

self.checker_command = value

960

# Emit D-Bus signal

961

self.PropertyChanged(dbus.String(u"checker"),

962

dbus.String(self.checker_command,

963

variant_level=1))

1419

964

1420

# CheckerRunning - property

1421

@dbus_service_property(_interface, signature="b",

1422

access="readwrite")

1423

def CheckerRunning_dbus_property(self, value=None):

965

# checker_running - property

966

@dbus_service_property(_interface, signature=u"b",

967

access=u"readwrite")

968

def checker_running_dbus_property(self, value=None):

1424

969

if value is None: # get

1425

970

return dbus.Boolean(self.checker is not None)

1426

971

if value:

1428

973

else:

1429

974

self.stop_checker()

1430

975

1431

# ObjectPath - property

1432

@dbus_service_property(_interface, signature="o", access="read")

1433

def ObjectPath_dbus_property(self):

976

# object_path - property

977

@dbus_service_property(_interface, signature=u"o", access=u"read")

978

def object_path_dbus_property(self):

1434

979

return self.dbus_object_path # is already a dbus.ObjectPath

1435

980

1436

# Secret = property

1437

@dbus_service_property(_interface, signature="ay",

1438

access="write", byte_arrays=True)

1439

def Secret_dbus_property(self, value):

981

# secret = property

982

@dbus_service_property(_interface, signature=u"ay",

983

access=u"write", byte_arrays=True)

984

def secret_dbus_property(self, value):

1440

985

self.secret = str(value)

1441

986

1442

987

del _interface

1443

988

1444

989

1445

class ProxyClient(object):

1446

def __init__(self, child_pipe, fpr, address):

1447

self._pipe = child_pipe

1448

self._pipe.send(('init', fpr, address))

1449

if not self._pipe.recv():

1450

raise KeyError()

1451

1452

def __getattribute__(self, name):

1453

if name == '_pipe':

1454

return super(ProxyClient, self).__getattribute__(name)

1455

self._pipe.send(('getattr', name))

1456

data = self._pipe.recv()

1457

if data[0] == 'data':

1458

return data[1]

1459

if data[0] == 'function':

1460

def func(*args, **kwargs):

1461

self._pipe.send(('funcall', name, args, kwargs))

1462

return self._pipe.recv()[1]

1463

return func

1464

1465

def __setattr__(self, name, value):

1466

if name == '_pipe':

1467

return super(ProxyClient, self).__setattr__(name, value)

1468

self._pipe.send(('setattr', name, value))

1469

1470

1471

class ClientDBusTransitional(ClientDBus):

1472

__metaclass__ = AlternateDBusNamesMetaclass

1473

1474

1475

990

class ClientHandler(socketserver.BaseRequestHandler, object):

1476

991

"""A class to handle client connections.

1477

992

1479

994

Note: This will run in its own forked process."""

1480

995

1481

996

def handle(self):

1482

with contextlib.closing(self.server.child_pipe) as child_pipe:

1483

logger.info("TCP connection from: %s",

1484

unicode(self.client_address))

1485

logger.debug("Pipe FD: %d",

1486

self.server.child_pipe.fileno())

1487

997

logger.info(u"TCP connection from: %s",

998

unicode(self.client_address))

999

logger.debug(u"IPC Pipe FD: %d",

1000

self.server.child_pipe[1].fileno())

1001

# Open IPC pipe to parent process

1002

with contextlib.nested(self.server.child_pipe[1],

1003

self.server.parent_pipe[0]

1004

) as (ipc, ipc_return):

1488

1005

session = (gnutls.connection

1489

1006

.ClientSession(self.request,

1490

1007

gnutls.connection

1495

1012

# no X.509 keys are added to it. Therefore, we can use it

1496

1013

# here despite using OpenPGP certificates.

1497

1014

1498

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1499

# "+AES-256-CBC", "+SHA1",

1500

# "+COMP-NULL", "+CTYPE-OPENPGP",

1501

# "+DHE-DSS"))

1015

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1016

# u"+AES-256-CBC", u"+SHA1",

1017

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1018

# u"+DHE-DSS"))

1502

1019

# Use a fallback default, since this MUST be set.

1503

1020

priority = self.server.gnutls_priority

1504

1021

if priority is None:

1505

priority = "NORMAL"

1022

priority = u"NORMAL"

1506

1023

(gnutls.library.functions

1507

1024

.gnutls_priority_set_direct(session._c_object,

1508

1025

priority, None))

1510

1027

# Start communication using the Mandos protocol

1511

1028

# Get protocol number

1512

1029

line = self.request.makefile().readline()

1513

logger.debug("Protocol version: %r", line)

1030

logger.debug(u"Protocol version: %r", line)

1514

1031

try:

1515

1032

if int(line.strip().split()[0]) > 1:

1516

1033

raise RuntimeError

1517

except (ValueError, IndexError, RuntimeError) as error:

1518

logger.error("Unknown protocol version: %s", error)

1034

except (ValueError, IndexError, RuntimeError), error:

1035

logger.error(u"Unknown protocol version: %s", error)

1519

1036

return

1520

1037

1521

1038

# Start GnuTLS connection

1522

1039

try:

1523

1040

session.handshake()

1524

except gnutls.errors.GNUTLSError as error:

1525

logger.warning("Handshake failed: %s", error)

1041

except gnutls.errors.GNUTLSError, error:

1042

logger.warning(u"Handshake failed: %s", error)

1526

1043

# Do not run session.bye() here: the session is not

1527

1044

# established. Just abandon the request.

1528

1045

return

1529

logger.debug("Handshake succeeded")

1530

1531

approval_required = False

1046

logger.debug(u"Handshake succeeded")

1532

1047

try:

1533

1048

try:

1534

1049

fpr = self.fingerprint(self.peer_certificate

1535

1050

(session))

1536

except (TypeError,

1537

gnutls.errors.GNUTLSError) as error:

1538

logger.warning("Bad certificate: %s", error)

1539

return

1540

logger.debug("Fingerprint: %s", fpr)

1541

1542

try:

1543

client = ProxyClient(child_pipe, fpr,

1544

self.client_address)

1545

except KeyError:

1546

return

1547

1548

if client.approval_delay:

1549

delay = client.approval_delay

1550

client.approvals_pending += 1

1551

approval_required = True

1552

1553

while True:

1554

if not client.enabled:

1555

logger.info("Client %s is disabled",

1556

client.name)

1557

if self.server.use_dbus:

1558

# Emit D-Bus signal

1559

client.Rejected("Disabled")

1560

return

1561

1562

if client.approved or not client.approval_delay:

1563

#We are approved or approval is disabled

1051

except (TypeError, gnutls.errors.GNUTLSError), error:

1052

logger.warning(u"Bad certificate: %s", error)

1053

return

1054

logger.debug(u"Fingerprint: %s", fpr)

1055

1056

for c in self.server.clients:

1057

if c.fingerprint == fpr:

1058

client = c

1564

1059

break

1565

elif client.approved is None:

1566

logger.info("Client %s needs approval",

1567

client.name)

1568

if self.server.use_dbus:

1569

# Emit D-Bus signal

1570

client.NeedApproval(

1571

client.approval_delay_milliseconds(),

1572

client.approved_by_default)

1573

else:

1574

logger.warning("Client %s was not approved",

1575

client.name)

1576

if self.server.use_dbus:

1577

# Emit D-Bus signal

1578

client.Rejected("Denied")

1579

return

1580

1581

#wait until timeout or approved

1582

time = datetime.datetime.now()

1583

client.changedstate.acquire()

1584

(client.changedstate.wait

1585

(float(client.timedelta_to_milliseconds(delay)

1586

/ 1000)))

1587

client.changedstate.release()

1588

time2 = datetime.datetime.now()

1589

if (time2 - time) >= delay:

1590

if not client.approved_by_default:

1591

logger.warning("Client %s timed out while"

1592

" waiting for approval",

1593

client.name)

1594

if self.server.use_dbus:

1595

# Emit D-Bus signal

1596

client.Rejected("Approval timed out")

1597

return

1598

else:

1599

break

1600

else:

1601

delay -= time2 - time

1602

1060

else:

1061

ipc.write(u"NOTFOUND %s %s\n"

1062

% (fpr, unicode(self.client_address)))

1063

return

1064

1065

class ClientProxy(object):

1066

"""Client proxy object. Not for calling methods."""

1067

def __init__(self, client):

1068

self.client = client

1069

def __getattr__(self, name):

1070

if name.startswith("ipc_"):

1071

def tempfunc():

1072

ipc.write("%s %s\n" % (name[4:].upper(),

1073

self.client.name))

1074

return tempfunc

1075

if not hasattr(self.client, name):

1076

raise AttributeError

1077

ipc.write(u"GETATTR %s %s\n"

1078

% (name, self.client.fingerprint))

1079

return pickle.load(ipc_return)

1080

clientproxy = ClientProxy(client)

1081

# Have to check if client.enabled, since it is

1082

# possible that the client was disabled since the

1083

# GnuTLS session was established.

1084

if not clientproxy.enabled:

1085

clientproxy.ipc_disabled()

1086

return

1087

1088

clientproxy.ipc_sending()

1603

1089

sent_size = 0

1604

1090

while sent_size < len(client.secret):

1605

try:

1606

sent = session.send(client.secret[sent_size:])

1607

except gnutls.errors.GNUTLSError as error:

1608

logger.warning("gnutls send failed")

1609

return

1610

logger.debug("Sent: %d, remaining: %d",

1091

sent = session.send(client.secret[sent_size:])

1092

logger.debug(u"Sent: %d, remaining: %d",

1611

1093

sent, len(client.secret)

1612

1094

- (sent_size + sent))

1613

1095

sent_size += sent

1614

1615

logger.info("Sending secret to %s", client.name)

1616

# bump the timeout using extended_timeout

1617

client.bump_timeout(client.extended_timeout)

1618

if self.server.use_dbus:

1619

# Emit D-Bus signal

1620

client.GotSecret()

1621

1622

1096

finally:

1623

if approval_required:

1624

client.approvals_pending -= 1

1625

try:

1626

session.bye()

1627

except gnutls.errors.GNUTLSError as error:

1628

logger.warning("GnuTLS bye failed")

1097

session.bye()

1629

1098

1630

1099

@staticmethod

1631

1100

def peer_certificate(session):

1641

1110

.gnutls_certificate_get_peers

1642

1111

(session._c_object, ctypes.byref(list_size)))

1643

1112

if not bool(cert_list) and list_size.value != 0:

1644

raise gnutls.errors.GNUTLSError("error getting peer"

1645

" certificate")

1113

raise gnutls.errors.GNUTLSError(u"error getting peer"

1114

u" certificate")

1646

1115

if list_size.value == 0:

1647

1116

return None

1648

1117

cert = cert_list[0]

1674

1143

if crtverify.value != 0:

1675

1144

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1676

1145

raise (gnutls.errors.CertificateSecurityError

1677

("Verify failed"))

1146

(u"Verify failed"))

1678

1147

# New buffer for the fingerprint

1679

1148

buf = ctypes.create_string_buffer(20)

1680

1149

buf_len = ctypes.c_size_t()

1687

1156

# Convert the buffer to a Python bytestring

1688

1157

fpr = ctypes.string_at(buf, buf_len.value)

1689

1158

# Convert the bytestring to hexadecimal notation

1690

hex_fpr = binascii.hexlify(fpr).upper()

1159

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1691

1160

return hex_fpr

1692

1161

1693

1162

1694

class MultiprocessingMixIn(object):

1695

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1696

def sub_process_main(self, request, address):

1697

try:

1698

self.finish_request(request, address)

1699

except Exception:

1700

self.handle_error(request, address)

1701

self.close_request(request)

1702

1703

def process_request(self, request, address):

1704

"""Start a new process to process the request."""

1705

proc = multiprocessing.Process(target = self.sub_process_main,

1706

args = (request,

1707

address))

1708

proc.start()

1709

return proc

1710

1711

1712

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1713

""" adds a pipe to the MixIn """

1163

class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):

1164

"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""

1714

1165

def process_request(self, request, client_address):

1715

1166

"""Overrides and wraps the original process_request().

1716

1167

1717

1168

This function creates a new pipe in self.pipe

1718

1169

"""

1719

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1720

1721

proc = MultiprocessingMixIn.process_request(self, request,

1722

client_address)

1723

self.child_pipe.close()

1724

self.add_pipe(parent_pipe, proc)

1725

1726

def add_pipe(self, parent_pipe, proc):

1170

# Child writes to child_pipe

1171

self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1172

# Parent writes to parent_pipe

1173

self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1174

super(ForkingMixInWithPipes,

1175

self).process_request(request, client_address)

1176

# Close unused ends for parent

1177

self.parent_pipe[0].close() # close read end

1178

self.child_pipe[1].close() # close write end

1179

self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])

1180

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1727

1181

"""Dummy function; override as necessary"""

1728

raise NotImplementedError

1729

1730

1731

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1182

child_pipe_fd.close()

1183

parent_pipe_fd.close()

1184

1185

1186

class IPv6_TCPServer(ForkingMixInWithPipes,

1732

1187

socketserver.TCPServer, object):

1733

1188

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1734

1189

1750

1205

bind to an address or port if they were not specified."""

1751

1206

if self.interface is not None:

1752

1207

if SO_BINDTODEVICE is None:

1753

logger.error("SO_BINDTODEVICE does not exist;"

1754

" cannot bind to interface %s",

1208

logger.error(u"SO_BINDTODEVICE does not exist;"

1209

u" cannot bind to interface %s",

1755

1210

self.interface)

1756

1211

else:

1757

1212

try:

1758

1213

self.socket.setsockopt(socket.SOL_SOCKET,

1759

1214

SO_BINDTODEVICE,

1760

1215

str(self.interface

1761

+ '\0'))

1762

except socket.error as error:

1216

+ u'\0'))

1217

except socket.error, error:

1763

1218

if error[0] == errno.EPERM:

1764

logger.error("No permission to"

1765

" bind to interface %s",

1219

logger.error(u"No permission to"

1220

u" bind to interface %s",

1766

1221

self.interface)

1767

1222

elif error[0] == errno.ENOPROTOOPT:

1768

logger.error("SO_BINDTODEVICE not available;"

1769

" cannot bind to interface %s",

1223

logger.error(u"SO_BINDTODEVICE not available;"

1224

u" cannot bind to interface %s",

1770

1225

self.interface)

1771

1226

else:

1772

1227

raise

1774

1229

if self.server_address[0] or self.server_address[1]:

1775

1230

if not self.server_address[0]:

1776

1231

if self.address_family == socket.AF_INET6:

1777

any_address = "::" # in6addr_any

1232

any_address = u"::" # in6addr_any

1778

1233

else:

1779

1234

any_address = socket.INADDR_ANY

1780

1235

self.server_address = (any_address,

1807

1262

self.enabled = False

1808

1263

self.clients = clients

1809

1264

if self.clients is None:

1810

self.clients = {}

1265

self.clients = set()

1811

1266

self.use_dbus = use_dbus

1812

1267

self.gnutls_priority = gnutls_priority

1813

1268

IPv6_TCPServer.__init__(self, server_address,

1817

1272

def server_activate(self):

1818

1273

if self.enabled:

1819

1274

return socketserver.TCPServer.server_activate(self)

1820

1821

1275

def enable(self):

1822

1276

self.enabled = True

1823

1824

def add_pipe(self, parent_pipe, proc):

1277

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1825

1278

# Call "handle_ipc" for both data and EOF events

1826

gobject.io_add_watch(parent_pipe.fileno(),

1279

gobject.io_add_watch(child_pipe_fd.fileno(),

1827

1280

gobject.IO_IN | gobject.IO_HUP,

1828

1281

functools.partial(self.handle_ipc,

1829

parent_pipe =

1830

parent_pipe,

1831

proc = proc))

1832

1833

def handle_ipc(self, source, condition, parent_pipe=None,

1834

proc = None, client_object=None):

1282

reply = parent_pipe_fd,

1283

sender= child_pipe_fd))

1284

def handle_ipc(self, source, condition, reply=None, sender=None):

1835

1285

condition_names = {

1836

gobject.IO_IN: "IN", # There is data to read.

1837

gobject.IO_OUT: "OUT", # Data can be written (without

1286

gobject.IO_IN: u"IN", # There is data to read.

1287

gobject.IO_OUT: u"OUT", # Data can be written (without

1838

1288

# blocking).

1839

gobject.IO_PRI: "PRI", # There is urgent data to read.

1840

gobject.IO_ERR: "ERR", # Error condition.

1841

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1289

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1290

gobject.IO_ERR: u"ERR", # Error condition.

1291

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1842

1292

# broken, usually for pipes and

1843

1293

# sockets).

1844

1294

}

1846

1296

for cond, name in

1847

1297

condition_names.iteritems()

1848

1298

if cond & condition)

1849

# error, or the other end of multiprocessing.Pipe has closed

1850

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1851

# Wait for other process to exit

1852

proc.join()

1853

return False

1854

1855

# Read a request from the child

1856

request = parent_pipe.recv()

1857

command = request[0]

1858

1859

if command == 'init':

1860

fpr = request[1]

1861

address = request[2]

1862

1863

for c in self.clients.itervalues():

1864

if c.fingerprint == fpr:

1865

client = c

1866

break

1867

else:

1868

logger.info("Client not found for fingerprint: %s, ad"

1869

"dress: %s", fpr, address)

1870

if self.use_dbus:

1871

# Emit D-Bus signal

1872

mandos_dbus_service.ClientNotFound(fpr,

1873

address[0])

1874

parent_pipe.send(False)

1875

return False

1876

1877

gobject.io_add_watch(parent_pipe.fileno(),

1878

gobject.IO_IN | gobject.IO_HUP,

1879

functools.partial(self.handle_ipc,

1880

parent_pipe =

1881

parent_pipe,

1882

proc = proc,

1883

client_object =

1884

client))

1885

parent_pipe.send(True)

1886

# remove the old hook in favor of the new above hook on

1887

# same fileno

1888

return False

1889

if command == 'funcall':

1890

funcname = request[1]

1891

args = request[2]

1892

kwargs = request[3]

1893

1894

parent_pipe.send(('data', getattr(client_object,

1895

funcname)(*args,

1896

**kwargs)))

1897

1898

if command == 'getattr':

1899

attrname = request[1]

1900

if callable(client_object.__getattribute__(attrname)):

1901

parent_pipe.send(('function',))

1902

else:

1903

parent_pipe.send(('data', client_object

1904

.__getattribute__(attrname)))

1905

1906

if command == 'setattr':

1907

attrname = request[1]

1908

value = request[2]

1909

setattr(client_object, attrname, value)

1910

1299

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1300

conditions_string)

1301

1302

# Read a line from the file object

1303

cmdline = sender.readline()

1304

if not cmdline: # Empty line means end of file

1305

# close the IPC pipes

1306

sender.close()

1307

reply.close()

1308

1309

# Stop calling this function

1310

return False

1311

1312

logger.debug(u"IPC command: %r", cmdline)

1313

1314

# Parse and act on command

1315

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1316

1317

if cmd == u"NOTFOUND":

1318

fpr, address = args.split(None, 1)

1319

logger.warning(u"Client not found for fingerprint: %s, ad"

1320

u"dress: %s", fpr, address)

1321

if self.use_dbus:

1322

# Emit D-Bus signal

1323

mandos_dbus_service.ClientNotFound(fpr, address)

1324

elif cmd == u"DISABLED":

1325

for client in self.clients:

1326

if client.name == args:

1327

logger.warning(u"Client %s is disabled", args)

1328

if self.use_dbus:

1329

# Emit D-Bus signal

1330

client.Rejected()

1331

break

1332

else:

1333

logger.error(u"Unknown client %s is disabled", args)

1334

elif cmd == u"SENDING":

1335

for client in self.clients:

1336

if client.name == args:

1337

logger.info(u"Sending secret to %s", client.name)

1338

client.checked_ok()

1339

if self.use_dbus:

1340

# Emit D-Bus signal

1341

client.GotSecret()

1342

break

1343

else:

1344

logger.error(u"Sending secret to unknown client %s",

1345

args)

1346

elif cmd == u"GETATTR":

1347

attr_name, fpr = args.split(None, 1)

1348

for client in self.clients:

1349

if client.fingerprint == fpr:

1350

attr_value = getattr(client, attr_name, None)

1351

logger.debug("IPC reply: %r", attr_value)

1352

pickle.dump(attr_value, reply)

1353

break

1354

else:

1355

logger.error(u"Client %s on address %s requesting "

1356

u"attribute %s not found", fpr, address,

1357

attr_name)

1358

pickle.dump(None, reply)

1359

else:

1360

logger.error(u"Unknown IPC command: %r", cmdline)

1361

1362

# Keep calling this function

1911

1363

return True

1912

1364

1913

1365

1914

1366

def string_to_delta(interval):

1915

1367

"""Parse a string and return a datetime.timedelta

1916

1368

1917

>>> string_to_delta('7d')

1369

>>> string_to_delta(u'7d')

1918

1370

datetime.timedelta(7)

1919

>>> string_to_delta('60s')

1371

>>> string_to_delta(u'60s')

1920

1372

datetime.timedelta(0, 60)

1921

>>> string_to_delta('60m')

1373

>>> string_to_delta(u'60m')

1922

1374

datetime.timedelta(0, 3600)

1923

>>> string_to_delta('24h')

1375

>>> string_to_delta(u'24h')

1924

1376

datetime.timedelta(1)

1925

>>> string_to_delta('1w')

1377

>>> string_to_delta(u'1w')

1926

1378

datetime.timedelta(7)

1927

>>> string_to_delta('5m 30s')

1379

>>> string_to_delta(u'5m 30s')

1928

1380

datetime.timedelta(0, 330)

1929

1381

"""

1930

1382

timevalue = datetime.timedelta(0)

1932

1384

try:

1933

1385

suffix = unicode(s[-1])

1934

1386

value = int(s[:-1])

1935

if suffix == "d":

1387

if suffix == u"d":

1936

1388

delta = datetime.timedelta(value)

1937

elif suffix == "s":

1389

elif suffix == u"s":

1938

1390

delta = datetime.timedelta(0, value)

1939

elif suffix == "m":

1391

elif suffix == u"m":

1940

1392

delta = datetime.timedelta(0, 0, 0, 0, value)

1941

elif suffix == "h":

1393

elif suffix == u"h":

1942

1394

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1943

elif suffix == "w":

1395

elif suffix == u"w":

1944

1396

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1945

1397

else:

1946

raise ValueError("Unknown suffix %r" % suffix)

1947

except (ValueError, IndexError) as e:

1948

raise ValueError(*(e.args))

1398

raise ValueError(u"Unknown suffix %r" % suffix)

1399

except (ValueError, IndexError), e:

1400

raise ValueError(e.message)

1949

1401

timevalue += delta

1950

1402

return timevalue

1951

1403

1952

1404

1405

def if_nametoindex(interface):

1406

"""Call the C function if_nametoindex(), or equivalent

1407

1408

Note: This function cannot accept a unicode string."""

1409

global if_nametoindex

1410

try:

1411

if_nametoindex = (ctypes.cdll.LoadLibrary

1412

(ctypes.util.find_library(u"c"))

1413

.if_nametoindex)

1414

except (OSError, AttributeError):

1415

logger.warning(u"Doing if_nametoindex the hard way")

1416

def if_nametoindex(interface):

1417

"Get an interface index the hard way, i.e. using fcntl()"

1418

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1419

with contextlib.closing(socket.socket()) as s:

1420

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1421

struct.pack(str(u"16s16x"),

1422

interface))

1423

interface_index = struct.unpack(str(u"I"),

1424

ifreq[16:20])[0]

1425

return interface_index

1426

return if_nametoindex(interface)

1427

1428

1953

1429

def daemon(nochdir = False, noclose = False):

1954

1430

"""See daemon(3). Standard BSD Unix function.

1955

1431

1958

1434

sys.exit()

1959

1435

os.setsid()

1960

1436

if not nochdir:

1961

os.chdir("/")

1437

os.chdir(u"/")

1962

1438

if os.fork():

1963

1439

sys.exit()

1964

1440

if not noclose:

1966

1442

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1967

1443

if not stat.S_ISCHR(os.fstat(null).st_mode):

1968

1444

raise OSError(errno.ENODEV,

1969

"%s not a character device"

1445

u"%s not a character device"

1970

1446

% os.path.devnull)

1971

1447

os.dup2(null, sys.stdin.fileno())

1972

1448

os.dup2(null, sys.stdout.fileno())

1980

1456

##################################################################

1981

1457

# Parsing of options, both command line and config file

1982

1458

1983

parser = argparse.ArgumentParser()

1984

parser.add_argument("-v", "--version", action="version",

1985

version = "%%(prog)s %s" % version,

1986

help="show version number and exit")

1987

parser.add_argument("-i", "--interface", metavar="IF",

1988

help="Bind to interface IF")

1989

parser.add_argument("-a", "--address",

1990

help="Address to listen for requests on")

1991

parser.add_argument("-p", "--port", type=int,

1992

help="Port number to receive requests on")

1993

parser.add_argument("--check", action="store_true",

1994

help="Run self-test")

1995

parser.add_argument("--debug", action="store_true",

1996

help="Debug mode; run in foreground and log"

1997

" to terminal")

1998

parser.add_argument("--debuglevel", metavar="LEVEL",

1999

help="Debug level for stdout output")

2000

parser.add_argument("--priority", help="GnuTLS"

2001

" priority string (see GnuTLS documentation)")

2002

parser.add_argument("--servicename",

2003

metavar="NAME", help="Zeroconf service name")

2004

parser.add_argument("--configdir",

2005

default="/etc/mandos", metavar="DIR",

2006

help="Directory to search for configuration"

2007

" files")

2008

parser.add_argument("--no-dbus", action="store_false",

2009

dest="use_dbus", help="Do not provide D-Bus"

2010

" system bus interface")

2011

parser.add_argument("--no-ipv6", action="store_false",

2012

dest="use_ipv6", help="Do not use IPv6")

2013

parser.add_argument("--no-restore", action="store_false",

2014

dest="restore", help="Do not restore stored"

2015

" state")

2016

parser.add_argument("--statedir", metavar="DIR",

2017

help="Directory to save/restore state in")

2018

2019

options = parser.parse_args()

1459

parser = optparse.OptionParser(version = "%%prog %s" % version)

1460

parser.add_option("-i", u"--interface", type=u"string",

1461

metavar="IF", help=u"Bind to interface IF")

1462

parser.add_option("-a", u"--address", type=u"string",

1463

help=u"Address to listen for requests on")

1464

parser.add_option("-p", u"--port", type=u"int",

1465

help=u"Port number to receive requests on")

1466

parser.add_option("--check", action=u"store_true",

1467

help=u"Run self-test")

1468

parser.add_option("--debug", action=u"store_true",

1469

help=u"Debug mode; run in foreground and log to"

1470

u" terminal")

1471

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1472

u" priority string (see GnuTLS documentation)")

1473

parser.add_option("--servicename", type=u"string",

1474

metavar=u"NAME", help=u"Zeroconf service name")

1475

parser.add_option("--configdir", type=u"string",

1476

default=u"/etc/mandos", metavar=u"DIR",

1477

help=u"Directory to search for configuration"

1478

u" files")

1479

parser.add_option("--no-dbus", action=u"store_false",

1480

dest=u"use_dbus", help=u"Do not provide D-Bus"

1481

u" system bus interface")

1482

parser.add_option("--no-ipv6", action=u"store_false",

1483

dest=u"use_ipv6", help=u"Do not use IPv6")

1484

options = parser.parse_args()[0]

2020

1485

2021

1486

if options.check:

2022

1487

import doctest

2024

1489

sys.exit()

2025

1490

2026

1491

# Default values for config file for server-global settings

2027

server_defaults = { "interface": "",

2028

"address": "",

2029

"port": "",

2030

"debug": "False",

2031

"priority":

2032

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2033

"servicename": "Mandos",

2034

"use_dbus": "True",

2035

"use_ipv6": "True",

2036

"debuglevel": "",

2037

"restore": "True",

2038

"statedir": "/var/lib/mandos"

1492

server_defaults = { u"interface": u"",

1493

u"address": u"",

1494

u"port": u"",

1495

u"debug": u"False",

1496

u"priority":

1497

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1498

u"servicename": u"Mandos",

1499

u"use_dbus": u"True",

1500

u"use_ipv6": u"True",

2039

1501

}

2040

1502

2041

1503

# Parse config file for server-global settings

2042

1504

server_config = configparser.SafeConfigParser(server_defaults)

2043

1505

del server_defaults

2044

1506

server_config.read(os.path.join(options.configdir,

2045

"mandos.conf"))

1507

u"mandos.conf"))

2046

1508

# Convert the SafeConfigParser object to a dict

2047

1509

server_settings = server_config.defaults()

2048

1510

# Use the appropriate methods on the non-string config options

2049

for option in ("debug", "use_dbus", "use_ipv6"):

2050

server_settings[option] = server_config.getboolean("DEFAULT",

1511

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1512

server_settings[option] = server_config.getboolean(u"DEFAULT",

2051

1513

option)

2052

1514

if server_settings["port"]:

2053

server_settings["port"] = server_config.getint("DEFAULT",

2054

"port")

1515

server_settings["port"] = server_config.getint(u"DEFAULT",

1516

u"port")

2055

1517

del server_config

2056

1518

2057

1519

# Override the settings from the config file with command line

2058

1520

# options, if set.

2059

for option in ("interface", "address", "port", "debug",

2060

"priority", "servicename", "configdir",

2061

"use_dbus", "use_ipv6", "debuglevel", "restore",

2062

"statedir"):

1521

for option in (u"interface", u"address", u"port", u"debug",

1522

u"priority", u"servicename", u"configdir",

1523

u"use_dbus", u"use_ipv6"):

2063

1524

value = getattr(options, option)

2064

1525

if value is not None:

2065

1526

server_settings[option] = value

2073

1534

##################################################################

2074

1535

2075

1536

# For convenience

2076

debug = server_settings["debug"]

2077

debuglevel = server_settings["debuglevel"]

2078

use_dbus = server_settings["use_dbus"]

2079

use_ipv6 = server_settings["use_ipv6"]

2080

stored_state_path = os.path.join(server_settings["statedir"],

2081

stored_state_file)

2082

2083

if debug:

2084

initlogger(debug, logging.DEBUG)

2085

else:

2086

if not debuglevel:

2087

initlogger(debug)

2088

else:

2089

level = getattr(logging, debuglevel.upper())

2090

initlogger(debug, level)

2091

2092

if server_settings["servicename"] != "Mandos":

1537

debug = server_settings[u"debug"]

1538

use_dbus = server_settings[u"use_dbus"]

1539

use_ipv6 = server_settings[u"use_ipv6"]

1540

1541

if not debug:

1542

syslogger.setLevel(logging.WARNING)

1543

console.setLevel(logging.WARNING)

1544

1545

if server_settings[u"servicename"] != u"Mandos":

2093

1546

syslogger.setFormatter(logging.Formatter

2094

('Mandos (%s) [%%(process)d]:'

2095

' %%(levelname)s: %%(message)s'

2096

% server_settings["servicename"]))

1547

(u'Mandos (%s) [%%(process)d]:'

1548

u' %%(levelname)s: %%(message)s'

1549

% server_settings[u"servicename"]))

2097

1550

2098

1551

# Parse config file with clients

2099

client_config = configparser.SafeConfigParser(Client

2100

.client_defaults)

2101

client_config.read(os.path.join(server_settings["configdir"],

2102

"clients.conf"))

1552

client_defaults = { u"timeout": u"1h",

1553

u"interval": u"5m",

1554

u"checker": u"fping -q -- %%(host)s",

1555

u"host": u"",

1556

}

1557

client_config = configparser.SafeConfigParser(client_defaults)

1558

client_config.read(os.path.join(server_settings[u"configdir"],

1559

u"clients.conf"))

2103

1560

2104

1561

global mandos_dbus_service

2105

1562

mandos_dbus_service = None

2106

1563

2107

tcp_server = MandosServer((server_settings["address"],

2108

server_settings["port"]),

1564

tcp_server = MandosServer((server_settings[u"address"],

1565

server_settings[u"port"]),

2109

1566

ClientHandler,

2110

interface=(server_settings["interface"]

2111

or None),

1567

interface=server_settings[u"interface"],

2112

1568

use_ipv6=use_ipv6,

2113

1569

gnutls_priority=

2114

server_settings["priority"],

1570

server_settings[u"priority"],

2115

1571

use_dbus=use_dbus)

2116

if not debug:

2117

pidfilename = "/var/run/mandos.pid"

2118

try:

2119

pidfile = open(pidfilename, "w")

2120

except IOError:

2121

logger.error("Could not open file %r", pidfilename)

1572

pidfilename = u"/var/run/mandos.pid"

1573

try:

1574

pidfile = open(pidfilename, u"w")

1575

except IOError:

1576

logger.error(u"Could not open file %r", pidfilename)

2122

1577

2123

1578

try:

2124

uid = pwd.getpwnam("_mandos").pw_uid

2125

gid = pwd.getpwnam("_mandos").pw_gid

1579

uid = pwd.getpwnam(u"_mandos").pw_uid

1580

gid = pwd.getpwnam(u"_mandos").pw_gid

2126

1581

except KeyError:

2127

1582

try:

2128

uid = pwd.getpwnam("mandos").pw_uid

2129

gid = pwd.getpwnam("mandos").pw_gid

1583

uid = pwd.getpwnam(u"mandos").pw_uid

1584

gid = pwd.getpwnam(u"mandos").pw_gid

2130

1585

except KeyError:

2131

1586

try:

2132

uid = pwd.getpwnam("nobody").pw_uid

2133

gid = pwd.getpwnam("nobody").pw_gid

1587

uid = pwd.getpwnam(u"nobody").pw_uid

1588

gid = pwd.getpwnam(u"nobody").pw_gid

2134

1589

except KeyError:

2135

1590

uid = 65534

2136

1591

gid = 65534

2137

1592

try:

2138

1593

os.setgid(gid)

2139

1594

os.setuid(uid)

2140

except OSError as error:

1595

except OSError, error:

2141

1596

if error[0] != errno.EPERM:

2142

1597

raise error

2143

1598

1599

# Enable all possible GnuTLS debugging

2144

1600

if debug:

2145

# Enable all possible GnuTLS debugging

2146

2147

1601

# "Use a log level over 10 to enable all debugging options."

2148

1602

# - GnuTLS manual

2149

1603

gnutls.library.functions.gnutls_global_set_log_level(11)

2150

1604

2151

1605

@gnutls.library.types.gnutls_log_func

2152

1606

def debug_gnutls(level, string):

2153

logger.debug("GnuTLS: %s", string[:-1])

1607

logger.debug(u"GnuTLS: %s", string[:-1])

2154

1608

2155

1609

(gnutls.library.functions

2156

1610

.gnutls_global_set_log_function(debug_gnutls))

2157

2158

# Redirect stdin so all checkers get /dev/null

2159

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2160

os.dup2(null, sys.stdin.fileno())

2161

if null > 2:

2162

os.close(null)

2163

2164

# Need to fork before connecting to D-Bus

2165

if not debug:

2166

# Close all input and output, do double fork, etc.

2167

daemon()

2168

2169

gobject.threads_init()

2170

1611

2171

1612

global main_loop

2172

1613

# From the Avahi example code

2176

1617

# End of Avahi example code

2177

1618

if use_dbus:

2178

1619

try:

2179

bus_name = dbus.service.BusName("se.recompile.Mandos",

1620

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2180

1621

bus, do_not_queue=True)

2181

old_bus_name = (dbus.service.BusName

2182

("se.bsnet.fukt.Mandos", bus,

2183

do_not_queue=True))

2184

except dbus.exceptions.NameExistsException as e:

2185

logger.error(unicode(e) + ", disabling D-Bus")

1622

except dbus.exceptions.NameExistsException, e:

1623

logger.error(unicode(e) + u", disabling D-Bus")

2186

1624

use_dbus = False

2187

server_settings["use_dbus"] = False

1625

server_settings[u"use_dbus"] = False

2188

1626

tcp_server.use_dbus = False

2189

1627

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2190

service = AvahiServiceToSyslog(name =

2191

server_settings["servicename"],

2192

servicetype = "_mandos._tcp",

2193

protocol = protocol, bus = bus)

1628

service = AvahiService(name = server_settings[u"servicename"],

1629

servicetype = u"_mandos._tcp",

1630

protocol = protocol, bus = bus)

2194

1631

if server_settings["interface"]:

2195

1632

service.interface = (if_nametoindex

2196

(str(server_settings["interface"])))

2197

2198

global multiprocessing_manager

2199

multiprocessing_manager = multiprocessing.Manager()

1633

(str(server_settings[u"interface"])))

2200

1634

2201

1635

client_class = Client

2202

1636

if use_dbus:

2203

client_class = functools.partial(ClientDBusTransitional,

2204

bus = bus)

2205

2206

client_settings = Client.config_parser(client_config)

2207

old_client_settings = {}

2208

clients_data = {}

2209

2210

# Get client data and settings from last running state.

2211

if server_settings["restore"]:

2212

try:

2213

with open(stored_state_path, "rb") as stored_state:

2214

clients_data, old_client_settings = (pickle.load

2215

(stored_state))

2216

os.remove(stored_state_path)

2217

except IOError as e:

2218

logger.warning("Could not load persistent state: {0}"

2219

.format(e))

2220

if e.errno != errno.ENOENT:

2221

raise

2222

except EOFError as e:

2223

logger.warning("Could not load persistent state: "

2224

"EOFError: {0}".format(e))

2225

2226

with PGPEngine() as pgp:

2227

for client_name, client in clients_data.iteritems():

2228

# Decide which value to use after restoring saved state.

2229

# We have three different values: Old config file,

2230

# new config file, and saved state.

2231

# New config value takes precedence if it differs from old

2232

# config value, otherwise use saved state.

2233

for name, value in client_settings[client_name].items():

2234

try:

2235

# For each value in new config, check if it

2236

# differs from the old config value (Except for

2237

# the "secret" attribute)

2238

if (name != "secret" and

2239

value != old_client_settings[client_name]

2240

[name]):

2241

client[name] = value

2242

except KeyError:

2243

pass

2244

2245

# Clients who has passed its expire date can still be

2246

# enabled if its last checker was successful. Clients

2247

# whose checker succeeded before we stored its state is

2248

# assumed to have successfully run all checkers during

2249

# downtime.

2250

if client["enabled"]:

2251

if datetime.datetime.utcnow() >= client["expires"]:

2252

if not client["last_checked_ok"]:

2253

logger.warning(

2254

"disabling client {0} - Client never "

2255

"performed a successful checker"

2256

.format(client_name))

2257

client["enabled"] = False

2258

elif client["last_checker_status"] != 0:

2259

logger.warning(

2260

"disabling client {0} - Client "

2261

"last checker failed with error code {1}"

2262

.format(client_name,

2263

client["last_checker_status"]))

2264

client["enabled"] = False

2265

else:

2266

client["expires"] = (datetime.datetime

2267

.utcnow()

2268

+ client["timeout"])

2269

logger.debug("Last checker succeeded,"

2270

" keeping {0} enabled"

2271

.format(client_name))

2272

try:

2273

client["secret"] = (

2274

pgp.decrypt(client["encrypted_secret"],

2275

client_settings[client_name]

2276

["secret"]))

2277

except PGPError:

2278

# If decryption fails, we use secret from new settings

2279

logger.debug("Failed to decrypt {0} old secret"

2280

.format(client_name))

2281

client["secret"] = (

2282

client_settings[client_name]["secret"])

2283

2284

2285

# Add/remove clients based on new changes made to config

2286

for client_name in (set(old_client_settings)

2287

- set(client_settings)):

2288

del clients_data[client_name]

2289

for client_name in (set(client_settings)

2290

- set(old_client_settings)):

2291

clients_data[client_name] = client_settings[client_name]

2292

2293

# Create all client objects

2294

for client_name, client in clients_data.iteritems():

2295

tcp_server.clients[client_name] = client_class(

2296

name = client_name, settings = client)

2297

1637

client_class = functools.partial(ClientDBus, bus = bus)

1638

tcp_server.clients.update(set(

1639

client_class(name = section,

1640

config= dict(client_config.items(section)))

1641

for section in client_config.sections()))

2298

1642

if not tcp_server.clients:

2299

logger.warning("No clients defined")

2300

1643

logger.warning(u"No clients defined")

1644

1645

if debug:

1646

# Redirect stdin so all checkers get /dev/null

1647

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1648

os.dup2(null, sys.stdin.fileno())

1649

if null > 2:

1650

os.close(null)

1651

else:

1652

# No console logging

1653

logger.removeHandler(console)

1654

# Close all input and output, do double fork, etc.

1655

daemon()

1656

1657

try:

1658

with pidfile:

1659

pid = os.getpid()

1660

pidfile.write(str(pid) + "\n")

1661

del pidfile

1662

except IOError:

1663

logger.error(u"Could not write to file %r with PID %d",

1664

pidfilename, pid)

1665

except NameError:

1666

# "pidfile" was never created

1667

pass

1668

del pidfilename

1669

2301

1670

if not debug:

2302

try:

2303

with pidfile:

2304

pid = os.getpid()

2305

pidfile.write(str(pid) + "\n".encode("utf-8"))

2306

del pidfile

2307

except IOError:

2308

logger.error("Could not write to file %r with PID %d",

2309

pidfilename, pid)

2310

except NameError:

2311

# "pidfile" was never created

2312

pass

2313

del pidfilename

2314

1671

signal.signal(signal.SIGINT, signal.SIG_IGN)

2315

2316

1672

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2317

1673

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2318

1674

2320

1676

class MandosDBusService(dbus.service.Object):

2321

1677

"""A D-Bus proxy object"""

2322

1678

def __init__(self):

2323

dbus.service.Object.__init__(self, bus, "/")

2324

_interface = "se.recompile.Mandos"

1679

dbus.service.Object.__init__(self, bus, u"/")

1680

_interface = u"se.bsnet.fukt.Mandos"

2325

1681

2326

@dbus.service.signal(_interface, signature="o")

1682

@dbus.service.signal(_interface, signature=u"o")

2327

1683

def ClientAdded(self, objpath):

2328

1684

"D-Bus signal"

2329

1685

pass

2330

1686

2331

@dbus.service.signal(_interface, signature="ss")

1687

@dbus.service.signal(_interface, signature=u"ss")

2332

1688

def ClientNotFound(self, fingerprint, address):

2333

1689

"D-Bus signal"

2334

1690

pass

2335

1691

2336

@dbus.service.signal(_interface, signature="os")

1692

@dbus.service.signal(_interface, signature=u"os")

2337

1693

def ClientRemoved(self, objpath, name):

2338

1694

"D-Bus signal"

2339

1695

pass

2340

1696

2341

@dbus.service.method(_interface, out_signature="ao")

1697

@dbus.service.method(_interface, out_signature=u"ao")

2342

1698

def GetAllClients(self):

2343

1699

"D-Bus method"

2344

1700

return dbus.Array(c.dbus_object_path

2345

for c in

2346

tcp_server.clients.itervalues())

1701

for c in tcp_server.clients)

2347

1702

2348

1703

@dbus.service.method(_interface,

2349

out_signature="a{oa{sv}}")

1704

out_signature=u"a{oa{sv}}")

2350

1705

def GetAllClientsWithProperties(self):

2351

1706

"D-Bus method"

2352

1707

return dbus.Dictionary(

2353

((c.dbus_object_path, c.GetAll(""))

2354

for c in tcp_server.clients.itervalues()),

2355

signature="oa{sv}")

1708

((c.dbus_object_path, c.GetAll(u""))

1709

for c in tcp_server.clients),

1710

signature=u"oa{sv}")

2356

1711

2357

@dbus.service.method(_interface, in_signature="o")

1712

@dbus.service.method(_interface, in_signature=u"o")

2358

1713

def RemoveClient(self, object_path):

2359

1714

"D-Bus method"

2360

for c in tcp_server.clients.itervalues():

1715

for c in tcp_server.clients:

2361

1716

if c.dbus_object_path == object_path:

2362

del tcp_server.clients[c.name]

1717

tcp_server.clients.remove(c)

2363

1718

c.remove_from_connection()

2364

1719

# Don't signal anything except ClientRemoved

2365

1720

c.disable(quiet=True)

2370

1725

2371

1726

del _interface

2372

1727

2373

class MandosDBusServiceTransitional(MandosDBusService):

2374

__metaclass__ = AlternateDBusNamesMetaclass

2375

mandos_dbus_service = MandosDBusServiceTransitional()

1728

mandos_dbus_service = MandosDBusService()

2376

1729

2377

1730

def cleanup():

2378

1731

"Cleanup function; run on exit"

2379

1732

service.cleanup()

2380

1733

2381

multiprocessing.active_children()

2382

if not (tcp_server.clients or client_settings):

2383

return

2384

2385

# Store client before exiting. Secrets are encrypted with key

2386

# based on what config file has. If config file is

2387

# removed/edited, old secret will thus be unrecovable.

2388

clients = {}

2389

with PGPEngine() as pgp:

2390

for client in tcp_server.clients.itervalues():

2391

key = client_settings[client.name]["secret"]

2392

client.encrypted_secret = pgp.encrypt(client.secret,

2393

key)

2394

client_dict = {}

2395

2396

# A list of attributes that can not be pickled

2397

# + secret.

2398

exclude = set(("bus", "changedstate", "secret",

2399

"checker"))

2400

for name, typ in (inspect.getmembers

2401

(dbus.service.Object)):

2402

exclude.add(name)

2403

2404

client_dict["encrypted_secret"] = (client

2405

.encrypted_secret)

2406

for attr in client.client_structure:

2407

if attr not in exclude:

2408

client_dict[attr] = getattr(client, attr)

2409

2410

clients[client.name] = client_dict

2411

del client_settings[client.name]["secret"]

2412

2413

try:

2414

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2415

prefix="clients-",

2416

dir=os.path.dirname

2417

(stored_state_path))

2418

with os.fdopen(tempfd, "wb") as stored_state:

2419

pickle.dump((clients, client_settings), stored_state)

2420

os.rename(tempname, stored_state_path)

2421

except (IOError, OSError) as e:

2422

logger.warning("Could not save persistent state: {0}"

2423

.format(e))

2424

if not debug:

2425

try:

2426

os.remove(tempname)

2427

except NameError:

2428

pass

2429

if e.errno not in set((errno.ENOENT, errno.EACCES,

2430

errno.EEXIST)):

2431

raise e

2432

2433

# Delete all clients, and settings from config

2434

1734

while tcp_server.clients:

2435

name, client = tcp_server.clients.popitem()

1735

client = tcp_server.clients.pop()

2436

1736

if use_dbus:

2437

1737

client.remove_from_connection()

1738

client.disable_hook = None

2438

1739

# Don't signal anything except ClientRemoved

2439

1740

client.disable(quiet=True)

2440

1741

if use_dbus:

2441

1742

# Emit D-Bus signal

2442

mandos_dbus_service.ClientRemoved(client

2443

.dbus_object_path,

1743

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2444

1744

client.name)

2445

client_settings.clear()

2446

1745

2447

1746

atexit.register(cleanup)

2448

1747

2449

for client in tcp_server.clients.itervalues():

1748

for client in tcp_server.clients:

2450

1749

if use_dbus:

2451

1750

# Emit D-Bus signal

2452

1751

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2453

# Need to initiate checking of clients

2454

if client.enabled:

2455

client.init_checker()

1752

client.enable()

2456

1753

2457

1754

tcp_server.enable()

2458

1755

tcp_server.server_activate()

2460

1757

# Find out what port we got

2461

1758

service.port = tcp_server.socket.getsockname()[1]

2462

1759

if use_ipv6:

2463

logger.info("Now listening on address %r, port %d,"

1760

logger.info(u"Now listening on address %r, port %d,"

2464

1761

" flowinfo %d, scope_id %d"

2465

1762

% tcp_server.socket.getsockname())

2466

1763

else: # IPv4

2467

logger.info("Now listening on address %r, port %d"

1764

logger.info(u"Now listening on address %r, port %d"

2468

1765

% tcp_server.socket.getsockname())

2469

1766

2470

1767

#service.interface = tcp_server.socket.getsockname()[3]

2473

1770

# From the Avahi example code

2474

1771

try:

2475

1772

service.activate()

2476

except dbus.exceptions.DBusException as error:

2477

logger.critical("DBusException: %s", error)

1773

except dbus.exceptions.DBusException, error:

1774

logger.critical(u"DBusException: %s", error)

2478

1775

cleanup()

2479

1776

sys.exit(1)

2480

1777

# End of Avahi example code

2484

1781

(tcp_server.handle_request

2485

1782

(*args[2:], **kwargs) or True))

2486

1783

2487

logger.debug("Starting main loop")

1784

logger.debug(u"Starting main loop")

2488

1785

main_loop.run()

2489

except AvahiError as error:

2490

logger.critical("AvahiError: %s", error)

1786

except AvahiError, error:

1787

logger.critical(u"AvahiError: %s", error)

2491

1788

cleanup()

2492

1789

sys.exit(1)

2493

1790

except KeyboardInterrupt:

2494

1791

if debug:

2495

print("", file=sys.stderr)

2496

logger.debug("Server received KeyboardInterrupt")

2497

logger.debug("Server exiting")

1792

print >> sys.stderr

1793

logger.debug(u"Server received KeyboardInterrupt")

1794

logger.debug(u"Server exiting")

2498

1795

# Must run before the D-Bus bus name gets deregistered

2499

1796

cleanup()

2500

1797