/mandos/trunk : revision 482

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

67

65

68

66

import dbus

69

67

import dbus.service

74

72

import ctypes.util

75

73

import xml.dom.minidom

76

74

import inspect

77

import Crypto.Cipher.AES

78

75

79

76

try:

80

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

SO_BINDTODEVICE = None

86

83

87

84

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

93

89

syslogger = (logging.handlers.SysLogHandler

94

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

91

address = str("/dev/log")))

99

95

logger.addHandler(syslogger)

100

96

101

97

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

104

99

' %(levelname)s:'

105

100

' %(message)s'))

106

101

logger.addHandler(console)

107

102

108

109

103

class AvahiError(Exception):

110

104

def __init__(self, value, *args, **kwargs):

111

105

self.value = value

165

159

" after %i retries, exiting.",

166

160

self.rename_count)

167

161

raise AvahiServiceError("Too many renames")

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

170

163

logger.info("Changing Zeroconf service name to %r ...",

171

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

172

169

self.remove()

173

170

try:

174

171

self.add()

179

176

self.rename_count += 1

180

177

def remove(self):

181

178

"""Derived from the Avahi example code"""

179

if self.group is not None:

180

try:

181

self.group.Free()

182

except (dbus.exceptions.UnknownMethodException,

183

dbus.exceptions.DBusException) as e:

184

pass

185

self.group = None

182

186

if self.entry_group_state_changed_match is not None:

183

187

self.entry_group_state_changed_match.remove()

184

188

self.entry_group_state_changed_match = None

185

if self.group is not None:

186

self.group.Reset()

187

189

def add(self):

188

190

"""Derived from the Avahi example code"""

189

191

self.remove()

190

if self.group is None:

191

self.group = dbus.Interface(

192

self.bus.get_object(avahi.DBUS_NAME,

193

self.server.EntryGroupNew()),

194

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

self.group = dbus.Interface(

193

self.bus.get_object(avahi.DBUS_NAME,

194

self.server.EntryGroupNew(),

195

follow_name_owner_changes=True),

196

avahi.DBUS_INTERFACE_ENTRY_GROUP)

195

197

self.entry_group_state_changed_match = (

196

198

self.group.connect_to_signal(

197

'StateChanged', self.entry_group_state_changed))

199

'StateChanged', self .entry_group_state_changed))

198

200

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

199

201

self.name, self.type)

200

202

self.group.AddService(

222

224

% unicode(error))

223

225

def cleanup(self):

224

226

"""Derived from the Avahi example code"""

225

if self.group is not None:

226

try:

227

self.group.Free()

228

except (dbus.exceptions.UnknownMethodException,

229

dbus.exceptions.DBusException) as e:

230

pass

231

self.group = None

232

227

self.remove()

233

228

def server_state_changed(self, state, error=None):

234

229

"""Derived from the Avahi example code"""

241

236

avahi.SERVER_FAILURE:

242

237

"Zeroconf server failure" }

243

238

if state in bad_states:

244

if bad_states[state] is not None:

245

if error is None:

246

logger.error(bad_states[state])

247

else:

248

logger.error(bad_states[state] + ": %r", error)

249

self.cleanup()

239

if bad_states[state]:

240

logger.error(bad_states[state])

241

self.remove()

250

242

elif state == avahi.SERVER_RUNNING:

251

243

self.add()

252

244

else:

253

if error is None:

254

logger.debug("Unknown state: %r", state)

255

else:

256

logger.debug("Unknown state: %r: %r", state, error)

245

logger.debug("Unknown state: %r", state)

257

246

def activate(self):

258

247

"""Derived from the Avahi example code"""

259

248

if self.server is None:

266

255

self.server_state_changed)

267

256

self.server_state_changed(self.server.GetState())

268

257

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

278

258

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

285

259

class Client(object):

286

260

"""A representation of a client host served by this server.

287

261

299

273

instance %(name)s can be used in the command.

300

274

checker_initiator_tag: a gobject event source tag, or None

301

275

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

304

276

current_checker_command: string; current running checker_command

277

disable_hook: If set, called by disable() as disable_hook(self)

305

278

disable_initiator_tag: a gobject event source tag, or None

306

279

enabled: bool()

307

280

fingerprint: string (40 or 32 hexadecimal digits); used to

310

283

interval: datetime.timedelta(); How often to start a new checker

311

284

last_approval_request: datetime.datetime(); (UTC) or None

312

285

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

316

286

last_enabled: datetime.datetime(); (UTC)

317

287

name: string; from the config file, used in log messages and

318

288

D-Bus identifiers

319

289

secret: bytestring; sent verbatim (over TLS) to client

320

290

timeout: datetime.timedelta(); How long from last_checked_ok

321

291

until this client is disabled

322

extended_timeout: extra long timeout when password has been sent

323

292

runtime_expansions: Allowed attributes for runtime expansion.

324

expires: datetime.datetime(); time (UTC) when a client will be

325

disabled, or None

326

293

"""

327

294

328

295

runtime_expansions = ("approval_delay", "approval_duration",

330

297

"host", "interval", "last_checked_ok",

331

298

"last_enabled", "name", "timeout")

332

299

300

@staticmethod

301

def _timedelta_to_milliseconds(td):

302

"Convert a datetime.timedelta() to milliseconds"

303

return ((td.days * 24 * 60 * 60 * 1000)

304

+ (td.seconds * 1000)

305

+ (td.microseconds // 1000))

306

333

307

def timeout_milliseconds(self):

334

308

"Return the 'timeout' attribute in milliseconds"

335

return _timedelta_to_milliseconds(self.timeout)

336

337

def extended_timeout_milliseconds(self):

338

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

309

return self._timedelta_to_milliseconds(self.timeout)

340

310

341

311

def interval_milliseconds(self):

342

312

"Return the 'interval' attribute in milliseconds"

343

return _timedelta_to_milliseconds(self.interval)

344

313

return self._timedelta_to_milliseconds(self.interval)

314

345

315

def approval_delay_milliseconds(self):

346

return _timedelta_to_milliseconds(self.approval_delay)

316

return self._timedelta_to_milliseconds(self.approval_delay)

347

317

348

def __init__(self, name = None, config=None):

318

def __init__(self, name = None, disable_hook=None, config=None):

349

319

"""Note: the 'checker' key in 'config' sets the

350

320

'checker_command' attribute and *not* the 'checker'

351

321

attribute."""

371

341

% self.name)

372

342

self.host = config.get("host", "")

373

343

self.created = datetime.datetime.utcnow()

374

self.enabled = True

344

self.enabled = False

375

345

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

346

self.last_enabled = None

377

347

self.last_checked_ok = None

378

self.last_checker_status = None

379

348

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

382

349

self.interval = string_to_delta(config["interval"])

350

self.disable_hook = disable_hook

383

351

self.checker = None

384

352

self.checker_initiator_tag = None

385

353

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

387

354

self.checker_callback_tag = None

388

355

self.checker_command = config["checker"]

389

356

self.current_checker_command = None

357

self.last_connect = None

390

358

self._approved = None

391

359

self.approved_by_default = config.get("approved_by_default",

392

360

True)

395

363

config["approval_delay"])

396

364

self.approval_duration = string_to_delta(

397

365

config["approval_duration"])

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

366

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

409

367

410

# Send notice to process children that client state has changed

411

368

def send_changedstate(self):

412

with self.changedstate:

413

self.changedstate.notify_all()

414

369

self.changedstate.acquire()

370

self.changedstate.notify_all()

371

self.changedstate.release()

372

415

373

def enable(self):

416

374

"""Start this client's checker and timeout hooks"""

417

375

if getattr(self, "enabled", False):

418

376

# Already enabled

419

377

return

420

378

self.send_changedstate()

421

self.expires = datetime.datetime.utcnow() + self.timeout

379

self.last_enabled = datetime.datetime.utcnow()

380

# Schedule a new checker to be started an 'interval' from now,

381

# and every interval from then on.

382

self.checker_initiator_tag = (gobject.timeout_add

383

(self.interval_milliseconds(),

384

self.start_checker))

385

# Schedule a disable() when 'timeout' has passed

386

self.disable_initiator_tag = (gobject.timeout_add

387

(self.timeout_milliseconds(),

388

self.disable))

422

389

self.enabled = True

423

self.last_enabled = datetime.datetime.utcnow()

424

self.init_checker()

390

# Also start a new checker *right now*.

391

self.start_checker()

425

392

426

393

def disable(self, quiet=True):

427

394

"""Disable this client."""

434

401

if getattr(self, "disable_initiator_tag", False):

435

402

gobject.source_remove(self.disable_initiator_tag)

436

403

self.disable_initiator_tag = None

437

self.expires = None

438

404

if getattr(self, "checker_initiator_tag", False):

439

405

gobject.source_remove(self.checker_initiator_tag)

440

406

self.checker_initiator_tag = None

441

407

self.stop_checker()

408

if self.disable_hook:

409

self.disable_hook(self)

442

410

self.enabled = False

443

411

# Do not run this again if called by a gobject.timeout_add

444

412

return False

445

413

446

414

def __del__(self):

415

self.disable_hook = None

447

416

self.disable()

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

417

463

418

def checker_callback(self, pid, condition, command):

464

419

"""The checker has completed, so take appropriate actions."""

465

420

self.checker_callback_tag = None

466

421

self.checker = None

467

422

if os.WIFEXITED(condition):

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

423

exitstatus = os.WEXITSTATUS(condition)

424

if exitstatus == 0:

470

425

logger.info("Checker for %(name)s succeeded",

471

426

vars(self))

472

427

self.checked_ok()

474

429

logger.info("Checker for %(name)s failed",

475

430

vars(self))

476

431

else:

477

self.last_checker_status = -1

478

432

logger.warning("Checker for %(name)s crashed?",

479

433

vars(self))

480

434

481

def checked_ok(self, timeout=None):

435

def checked_ok(self):

482

436

"""Bump up the timeout for this client.

483

437

484

438

This should only be called when the client has been seen,

485

439

alive and well.

486

440

"""

487

if timeout is None:

488

timeout = self.timeout

489

441

self.last_checked_ok = datetime.datetime.utcnow()

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

442

gobject.source_remove(self.disable_initiator_tag)

443

self.disable_initiator_tag = (gobject.timeout_add

444

(self.timeout_milliseconds(),

445

self.disable))

497

446

498

447

def need_approval(self):

499

448

self.last_approval_request = datetime.datetime.utcnow()

539

488

'replace')))

540

489

for attr in

541

490

self.runtime_expansions)

542

491

543

492

try:

544

493

command = self.checker_command % escaped_attrs

545

494

except TypeError as error:

591

540

raise

592

541

self.checker = None

593

542

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

640

641

543

def dbus_service_property(dbus_interface, signature="v",

642

544

access="readwrite", byte_arrays=False):

643

545

"""Decorators for marking methods of a DBusObjectWithProperties to

689

591

690

592

class DBusObjectWithProperties(dbus.service.Object):

691

593

"""A D-Bus object with properties.

692

594

693

595

Classes inheriting from this can use the dbus_service_property

694

596

decorator to expose methods as D-Bus properties. It exposes the

695

597

standard Get(), Set(), and GetAll() methods on the D-Bus.

702

604

def _get_all_dbus_properties(self):

703

605

"""Returns a generator of (name, attribute) pairs

704

606

"""

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

706

for cls in self.__class__.__mro__

607

return ((prop._dbus_name, prop)

707

608

for name, prop in

708

inspect.getmembers(cls, self._is_dbus_property))

609

inspect.getmembers(self, self._is_dbus_property))

709

610

710

611

def _get_dbus_property(self, interface_name, property_name):

711

612

"""Returns a bound method if one exists which is a D-Bus

712

613

property with the specified name and interface.

713

614

"""

714

for cls in self.__class__.__mro__:

715

for name, value in (inspect.getmembers

716

(cls, self._is_dbus_property)):

717

if (value._dbus_name == property_name

718

and value._dbus_interface == interface_name):

719

return value.__get__(self)

720

615

for name in (property_name,

616

property_name + "_dbus_property"):

617

prop = getattr(self, name, None)

618

if (prop is None

619

or not self._is_dbus_property(prop)

620

or prop._dbus_name != property_name

621

or (interface_name and prop._dbus_interface

622

and interface_name != prop._dbus_interface)):

623

continue

624

return prop

721

625

# No such property

722

626

raise DBusPropertyNotFound(self.dbus_object_path + ":"

723

627

+ interface_name + "."

757

661

def GetAll(self, interface_name):

758

662

"""Standard D-Bus property GetAll() method, see D-Bus

759

663

standard.

760

664

761

665

Note: Will not include properties with access="write".

762

666

"""

763

667

all = {}

825

729

return xmlstring

826

730

827

731

828

def datetime_to_dbus (dt, variant_level=0):

829

"""Convert a UTC datetime.datetime() to a D-Bus type."""

830

if dt is None:

831

return dbus.String("", variant_level = variant_level)

832

return dbus.String(dt.isoformat(),

833

variant_level=variant_level)

834

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

839

"""

840

def __new__(mcs, name, bases, attr):

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

847

# Ignore non-D-Bus attributes, and D-Bus attributes

848

# with the wrong interface name

849

if (not hasattr(attribute, "_dbus_interface")

850

or not attribute._dbus_interface

851

.startswith("se.recompile.Mandos")):

852

continue

853

# Create an alternate D-Bus interface name based on

854

# the current name

855

alt_interface = (attribute._dbus_interface

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

858

# Is this a D-Bus signal?

859

if getattr(attribute, "_dbus_is_signal", False):

860

# Extract the original non-method function by

861

# black magic

862

nonmethod_func = (dict(

863

zip(attribute.func_code.co_freevars,

864

attribute.__closure__))["func"]

865

.cell_contents)

866

# Create a new, but exactly alike, function

867

# object, and decorate it to be a new D-Bus signal

868

# with the alternate D-Bus interface name

869

new_function = (dbus.service.signal

870

(alt_interface,

871

attribute._dbus_signature)

872

(types.FunctionType(

873

nonmethod_func.func_code,

874

nonmethod_func.func_globals,

875

nonmethod_func.func_name,

876

nonmethod_func.func_defaults,

877

nonmethod_func.func_closure)))

878

# Define a creator of a function to call both the

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

881

def fixscope(func1, func2):

882

"""This function is a scope container to pass

883

func1 and func2 to the "call_both" function

884

outside of its arguments"""

885

def call_both(*args, **kwargs):

886

"""This function will emit two D-Bus

887

signals by calling func1 and func2"""

888

func1(*args, **kwargs)

889

func2(*args, **kwargs)

890

return call_both

891

# Create the "call_both" function and add it to

892

# the class

893

attr[attrname] = fixscope(attribute,

894

new_function)

895

# Is this a D-Bus method?

896

elif getattr(attribute, "_dbus_is_method", False):

897

# Create a new, but exactly alike, function

898

# object. Decorate it to be a new D-Bus method

899

# with the alternate D-Bus interface name. Add it

900

# to the class.

901

attr[attrname] = (dbus.service.method

902

(alt_interface,

903

attribute._dbus_in_signature,

904

attribute._dbus_out_signature)

905

(types.FunctionType

906

(attribute.func_code,

907

attribute.func_globals,

908

attribute.func_name,

909

attribute.func_defaults,

910

attribute.func_closure)))

911

# Is this a D-Bus property?

912

elif getattr(attribute, "_dbus_is_property", False):

913

# Create a new, but exactly alike, function

914

# object, and decorate it to be a new D-Bus

915

# property with the alternate D-Bus interface

916

# name. Add it to the class.

917

attr[attrname] = (dbus_service_property

918

(alt_interface,

919

attribute._dbus_signature,

920

attribute._dbus_access,

921

attribute

922

._dbus_get_args_options

923

["byte_arrays"])

924

(types.FunctionType

925

(attribute.func_code,

926

attribute.func_globals,

927

attribute.func_name,

928

attribute.func_defaults,

929

attribute.func_closure)))

930

return type.__new__(mcs, name, bases, attr)

931

932

732

class ClientDBus(Client, DBusObjectWithProperties):

933

733

"""A Client class using D-Bus

934

734

943

743

# dbus.service.Object doesn't use super(), so we can't either.

944

744

945

745

def __init__(self, bus = None, *args, **kwargs):

746

self._approvals_pending = 0

946

747

self.bus = bus

947

748

Client.__init__(self, *args, **kwargs)

948

949

self._approvals_pending = 0

950

749

# Only now, when this client is initialized, can it show up on

951

750

# the D-Bus

952

751

client_object_name = unicode(self.name).translate(

957

756

DBusObjectWithProperties.__init__(self, self.bus,

958

757

self.dbus_object_path)

959

758

960

def notifychangeproperty(transform_func,

961

dbus_name, type_func=lambda x: x,

962

variant_level=1):

963

""" Modify a variable so that it's a property which announces

964

its changes to DBus.

759

def _get_approvals_pending(self):

760

return self._approvals_pending

761

def _set_approvals_pending(self, value):

762

old_value = self._approvals_pending

763

self._approvals_pending = value

764

bval = bool(value)

765

if (hasattr(self, "dbus_object_path")

766

and bval is not bool(old_value)):

767

dbus_bool = dbus.Boolean(bval, variant_level=1)

768

self.PropertyChanged(dbus.String("ApprovalPending"),

769

dbus_bool)

965

770

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

968

dbus_name: D-Bus name of the variable

969

type_func: Function that transform the value before sending it

970

to the D-Bus. Default: no transform

971

variant_level: D-Bus variant level. Default: 1

972

"""

973

attrname = "_{0}".format(dbus_name)

974

def setter(self, value):

975

if hasattr(self, "dbus_object_path"):

976

if (not hasattr(self, attrname) or

977

type_func(getattr(self, attrname, None))

978

!= type_func(value)):

979

dbus_value = transform_func(type_func(value),

980

variant_level

981

=variant_level)

982

self.PropertyChanged(dbus.String(dbus_name),

983

dbus_value)

984

setattr(self, attrname, value)

985

986

return property(lambda self: getattr(self, attrname), setter)

987

988

989

expires = notifychangeproperty(datetime_to_dbus, "Expires")

990

approvals_pending = notifychangeproperty(dbus.Boolean,

991

"ApprovalPending",

992

type_func = bool)

993

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

994

last_enabled = notifychangeproperty(datetime_to_dbus,

995

"LastEnabled")

996

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

997

type_func = lambda checker:

998

checker is not None)

999

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1000

"LastCheckedOK")

1001

last_approval_request = notifychangeproperty(

1002

datetime_to_dbus, "LastApprovalRequest")

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

1004

"ApprovedByDefault")

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1006

"ApprovalDelay",

1007

type_func =

1008

_timedelta_to_milliseconds)

1009

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

1012

host = notifychangeproperty(dbus.String, "Host")

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1014

type_func =

1015

_timedelta_to_milliseconds)

1016

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1020

"Interval",

1021

type_func =

1022

_timedelta_to_milliseconds)

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

1024

1025

del notifychangeproperty

771

approvals_pending = property(_get_approvals_pending,

772

_set_approvals_pending)

773

del _get_approvals_pending, _set_approvals_pending

774

775

@staticmethod

776

def _datetime_to_dbus(dt, variant_level=0):

777

"""Convert a UTC datetime.datetime() to a D-Bus type."""

778

return dbus.String(dt.isoformat(),

779

variant_level=variant_level)

780

781

def enable(self):

782

oldstate = getattr(self, "enabled", False)

783

r = Client.enable(self)

784

if oldstate != self.enabled:

785

# Emit D-Bus signals

786

self.PropertyChanged(dbus.String("Enabled"),

787

dbus.Boolean(True, variant_level=1))

788

self.PropertyChanged(

789

dbus.String("LastEnabled"),

790

self._datetime_to_dbus(self.last_enabled,

791

variant_level=1))

792

return r

793

794

def disable(self, quiet = False):

795

oldstate = getattr(self, "enabled", False)

796

r = Client.disable(self, quiet=quiet)

797

if not quiet and oldstate != self.enabled:

798

# Emit D-Bus signal

799

self.PropertyChanged(dbus.String("Enabled"),

800

dbus.Boolean(False, variant_level=1))

801

return r

1026

802

1027

803

def __del__(self, *args, **kwargs):

1028

804

try:

1037

813

*args, **kwargs):

1038

814

self.checker_callback_tag = None

1039

815

self.checker = None

816

# Emit D-Bus signal

817

self.PropertyChanged(dbus.String("CheckerRunning"),

818

dbus.Boolean(False, variant_level=1))

1040

819

if os.WIFEXITED(condition):

1041

820

exitstatus = os.WEXITSTATUS(condition)

1042

821

# Emit D-Bus signal

1052

831

return Client.checker_callback(self, pid, condition, command,

1053

832

*args, **kwargs)

1054

833

834

def checked_ok(self, *args, **kwargs):

835

Client.checked_ok(self, *args, **kwargs)

836

# Emit D-Bus signal

837

self.PropertyChanged(

838

dbus.String("LastCheckedOK"),

839

(self._datetime_to_dbus(self.last_checked_ok,

840

variant_level=1)))

841

842

def need_approval(self, *args, **kwargs):

843

r = Client.need_approval(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastApprovalRequest"),

847

(self._datetime_to_dbus(self.last_approval_request,

848

variant_level=1)))

849

return r

850

1055

851

def start_checker(self, *args, **kwargs):

1056

852

old_checker = self.checker

1057

853

if self.checker is not None:

1064

860

and old_checker_pid != self.checker.pid):

1065

861

# Emit D-Bus signal

1066

862

self.CheckerStarted(self.current_checker_command)

863

self.PropertyChanged(

864

dbus.String("CheckerRunning"),

865

dbus.Boolean(True, variant_level=1))

1067

866

return r

1068

867

868

def stop_checker(self, *args, **kwargs):

869

old_checker = getattr(self, "checker", None)

870

r = Client.stop_checker(self, *args, **kwargs)

871

if (old_checker is not None

872

and getattr(self, "checker", None) is None):

873

self.PropertyChanged(dbus.String("CheckerRunning"),

874

dbus.Boolean(False, variant_level=1))

875

return r

876

1069

877

def _reset_approved(self):

1070

878

self._approved = None

1071

879

return False

1073

881

def approve(self, value=True):

1074

882

self.send_changedstate()

1075

883

self._approved = value

1076

gobject.timeout_add(_timedelta_to_milliseconds

884

gobject.timeout_add(self._timedelta_to_milliseconds

1077

885

(self.approval_duration),

1078

886

self._reset_approved)

1079

887

1080

888

1081

889

## D-Bus methods, signals & properties

1082

_interface = "se.recompile.Mandos.Client"

890

_interface = "se.bsnet.fukt.Mandos.Client"

1083

891

1084

892

## Signals

1085

893

1171

979

if value is None: # get

1172

980

return dbus.Boolean(self.approved_by_default)

1173

981

self.approved_by_default = bool(value)

982

# Emit D-Bus signal

983

self.PropertyChanged(dbus.String("ApprovedByDefault"),

984

dbus.Boolean(value, variant_level=1))

1174

985

1175

986

# ApprovalDelay - property

1176

987

@dbus_service_property(_interface, signature="t",

1179

990

if value is None: # get

1180

991

return dbus.UInt64(self.approval_delay_milliseconds())

1181

992

self.approval_delay = datetime.timedelta(0, 0, 0, value)

993

# Emit D-Bus signal

994

self.PropertyChanged(dbus.String("ApprovalDelay"),

995

dbus.UInt64(value, variant_level=1))

1182

996

1183

997

# ApprovalDuration - property

1184

998

@dbus_service_property(_interface, signature="t",

1185

999

access="readwrite")

1186

1000

def ApprovalDuration_dbus_property(self, value=None):

1187

1001

if value is None: # get

1188

return dbus.UInt64(_timedelta_to_milliseconds(

1002

return dbus.UInt64(self._timedelta_to_milliseconds(

1189

1003

self.approval_duration))

1190

1004

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1005

# Emit D-Bus signal

1006

self.PropertyChanged(dbus.String("ApprovalDuration"),

1007

dbus.UInt64(value, variant_level=1))

1191

1008

1192

1009

# Name - property

1193

1010

@dbus_service_property(_interface, signature="s", access="read")

1206

1023

if value is None: # get

1207

1024

return dbus.String(self.host)

1208

1025

self.host = value

1026

# Emit D-Bus signal

1027

self.PropertyChanged(dbus.String("Host"),

1028

dbus.String(value, variant_level=1))

1209

1029

1210

1030

# Created - property

1211

1031

@dbus_service_property(_interface, signature="s", access="read")

1212

1032

def Created_dbus_property(self):

1213

return dbus.String(datetime_to_dbus(self.created))

1033

return dbus.String(self._datetime_to_dbus(self.created))

1214

1034

1215

1035

# LastEnabled - property

1216

1036

@dbus_service_property(_interface, signature="s", access="read")

1217

1037

def LastEnabled_dbus_property(self):

1218

return datetime_to_dbus(self.last_enabled)

1038

if self.last_enabled is None:

1039

return dbus.String("")

1040

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1219

1041

1220

1042

# Enabled - property

1221

1043

@dbus_service_property(_interface, signature="b",

1235

1057

if value is not None:

1236

1058

self.checked_ok()

1237

1059

return

1238

return datetime_to_dbus(self.last_checked_ok)

1239

1240

# Expires - property

1241

@dbus_service_property(_interface, signature="s", access="read")

1242

def Expires_dbus_property(self):

1243

return datetime_to_dbus(self.expires)

1060

if self.last_checked_ok is None:

1061

return dbus.String("")

1062

return dbus.String(self._datetime_to_dbus(self

1063

.last_checked_ok))

1244

1064

1245

1065

# LastApprovalRequest - property

1246

1066

@dbus_service_property(_interface, signature="s", access="read")

1247

1067

def LastApprovalRequest_dbus_property(self):

1248

return datetime_to_dbus(self.last_approval_request)

1068

if self.last_approval_request is None:

1069

return dbus.String("")

1070

return dbus.String(self.

1071

_datetime_to_dbus(self

1072

.last_approval_request))

1249

1073

1250

1074

# Timeout - property

1251

1075

@dbus_service_property(_interface, signature="t",

1254

1078

if value is None: # get

1255

1079

return dbus.UInt64(self.timeout_milliseconds())

1256

1080

self.timeout = datetime.timedelta(0, 0, 0, value)

1081

# Emit D-Bus signal

1082

self.PropertyChanged(dbus.String("Timeout"),

1083

dbus.UInt64(value, variant_level=1))

1257

1084

if getattr(self, "disable_initiator_tag", None) is None:

1258

1085

return

1259

1086

# Reschedule timeout

1260

1087

gobject.source_remove(self.disable_initiator_tag)

1261

1088

self.disable_initiator_tag = None

1262

self.expires = None

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1089

time_to_die = (self.

1090

_timedelta_to_milliseconds((self

1091

.last_checked_ok

1092

+ self.timeout)

1093

- datetime.datetime

1094

.utcnow()))

1268

1095

if time_to_die <= 0:

1269

1096

# The timeout has passed

1270

1097

self.disable()

1271

1098

else:

1272

self.expires = (datetime.datetime.utcnow()

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1275

1099

self.disable_initiator_tag = (gobject.timeout_add

1276

1100

(time_to_die, self.disable))

1277

1101

1278

# ExtendedTimeout - property

1279

@dbus_service_property(_interface, signature="t",

1280

access="readwrite")

1281

def ExtendedTimeout_dbus_property(self, value=None):

1282

if value is None: # get

1283

return dbus.UInt64(self.extended_timeout_milliseconds())

1284

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1285

1286

1102

# Interval - property

1287

1103

@dbus_service_property(_interface, signature="t",

1288

1104

access="readwrite")

1290

1106

if value is None: # get

1291

1107

return dbus.UInt64(self.interval_milliseconds())

1292

1108

self.interval = datetime.timedelta(0, 0, 0, value)

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Interval"),

1111

dbus.UInt64(value, variant_level=1))

1293

1112

if getattr(self, "checker_initiator_tag", None) is None:

1294

1113

return

1295

1114

# Reschedule checker run

1297

1116

self.checker_initiator_tag = (gobject.timeout_add

1298

1117

(value, self.start_checker))

1299

1118

self.start_checker() # Start one now, too

1300

1119

1301

1120

# Checker - property

1302

1121

@dbus_service_property(_interface, signature="s",

1303

1122

access="readwrite")

1305

1124

if value is None: # get

1306

1125

return dbus.String(self.checker_command)

1307

1126

self.checker_command = value

1127

# Emit D-Bus signal

1128

self.PropertyChanged(dbus.String("Checker"),

1129

dbus.String(self.checker_command,

1130

variant_level=1))

1308

1131

1309

1132

# CheckerRunning - property

1310

1133

@dbus_service_property(_interface, signature="b",

1337

1160

self._pipe.send(('init', fpr, address))

1338

1161

if not self._pipe.recv():

1339

1162

raise KeyError()

1340

1163

1341

1164

def __getattribute__(self, name):

1342

1165

if(name == '_pipe'):

1343

1166

return super(ProxyClient, self).__getattribute__(name)

1350

1173

self._pipe.send(('funcall', name, args, kwargs))

1351

1174

return self._pipe.recv()[1]

1352

1175

return func

1353

1176

1354

1177

def __setattr__(self, name, value):

1355

1178

if(name == '_pipe'):

1356

1179

return super(ProxyClient, self).__setattr__(name, value)

1357

1180

self._pipe.send(('setattr', name, value))

1358

1181

1359

class ClientDBusTransitional(ClientDBus):

1360

__metaclass__ = AlternateDBusNamesMetaclass

1361

1182

1362

1183

class ClientHandler(socketserver.BaseRequestHandler, object):

1363

1184

"""A class to handle client connections.

1371

1192

unicode(self.client_address))

1372

1193

logger.debug("Pipe FD: %d",

1373

1194

self.server.child_pipe.fileno())

1374

1195

1375

1196

session = (gnutls.connection

1376

1197

.ClientSession(self.request,

1377

1198

gnutls.connection

1378

1199

.X509Credentials()))

1379

1200

1380

1201

# Note: gnutls.connection.X509Credentials is really a

1381

1202

# generic GnuTLS certificate credentials object so long as

1382

1203

# no X.509 keys are added to it. Therefore, we can use it

1383

1204

# here despite using OpenPGP certificates.

1384

1205

1385

1206

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1386

1207

# "+AES-256-CBC", "+SHA1",

1387

1208

# "+COMP-NULL", "+CTYPE-OPENPGP",

1393

1214

(gnutls.library.functions

1394

1215

.gnutls_priority_set_direct(session._c_object,

1395

1216

priority, None))

1396

1217

1397

1218

# Start communication using the Mandos protocol

1398

1219

# Get protocol number

1399

1220

line = self.request.makefile().readline()

1404

1225

except (ValueError, IndexError, RuntimeError) as error:

1405

1226

logger.error("Unknown protocol version: %s", error)

1406

1227

return

1407

1228

1408

1229

# Start GnuTLS connection

1409

1230

try:

1410

1231

session.handshake()

1414

1235

# established. Just abandon the request.

1415

1236

return

1416

1237

logger.debug("Handshake succeeded")

1417

1238

1418

1239

approval_required = False

1419

1240

try:

1420

1241

try:

1425

1246

logger.warning("Bad certificate: %s", error)

1426

1247

return

1427

1248

logger.debug("Fingerprint: %s", fpr)

1428

1249

1429

1250

try:

1430

1251

client = ProxyClient(child_pipe, fpr,

1431

1252

self.client_address)

1439

1260

1440

1261

while True:

1441

1262

if not client.enabled:

1442

logger.info("Client %s is disabled",

1263

logger.warning("Client %s is disabled",

1443

1264

client.name)

1444

1265

if self.server.use_dbus:

1445

1266

# Emit D-Bus signal

1446

client.Rejected("Disabled")

1267

client.Rejected("Disabled")

1447

1268

return

1448

1269

1449

1270

if client._approved or not client.approval_delay:

1466

1287

return

1467

1288

1468

1289

#wait until timeout or approved

1290

#x = float(client._timedelta_to_milliseconds(delay))

1469

1291

time = datetime.datetime.now()

1470

1292

client.changedstate.acquire()

1471

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1473

/ 1000)))

1293

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1474

1294

client.changedstate.release()

1475

1295

time2 = datetime.datetime.now()

1476

1296

if (time2 - time) >= delay:

1498

1318

sent, len(client.secret)

1499

1319

- (sent_size + sent))

1500

1320

sent_size += sent

1501

1321

1502

1322

logger.info("Sending secret to %s", client.name)

1503

# bump the timeout using extended_timeout

1504

client.checked_ok(client.extended_timeout)

1323

# bump the timeout as if seen

1324

client.checked_ok()

1505

1325

if self.server.use_dbus:

1506

1326

# Emit D-Bus signal

1507

1327

client.GotSecret()

1586

1406

except:

1587

1407

self.handle_error(request, address)

1588

1408

self.close_request(request)

1589

1409

1590

1410

def process_request(self, request, address):

1591

1411

"""Start a new process to process the request."""

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1593

args = (request,

1594

address))

1595

proc.start()

1596

return proc

1597

1412

multiprocessing.Process(target = self.sub_process_main,

1413

args = (request, address)).start()

1598

1414

1599

1415

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1600

1416

""" adds a pipe to the MixIn """

1604

1420

This function creates a new pipe in self.pipe

1605

1421

"""

1606

1422

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1607

1608

proc = MultiprocessingMixIn.process_request(self, request,

1609

client_address)

1423

1424

super(MultiprocessingMixInWithPipe,

1425

self).process_request(request, client_address)

1610

1426

self.child_pipe.close()

1611

self.add_pipe(parent_pipe, proc)

1612

1613

def add_pipe(self, parent_pipe, proc):

1427

self.add_pipe(parent_pipe)

1428

1429

def add_pipe(self, parent_pipe):

1614

1430

"""Dummy function; override as necessary"""

1615

1431

raise NotImplementedError

1616

1432

1617

1618

1433

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1619

1434

socketserver.TCPServer, object):

1620

1435

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1694

1509

self.enabled = False

1695

1510

self.clients = clients

1696

1511

if self.clients is None:

1697

self.clients = {}

1512

self.clients = set()

1698

1513

self.use_dbus = use_dbus

1699

1514

self.gnutls_priority = gnutls_priority

1700

1515

IPv6_TCPServer.__init__(self, server_address,

1704

1519

def server_activate(self):

1705

1520

if self.enabled:

1706

1521

return socketserver.TCPServer.server_activate(self)

1707

1708

1522

def enable(self):

1709

1523

self.enabled = True

1710

1711

def add_pipe(self, parent_pipe, proc):

1524

def add_pipe(self, parent_pipe):

1712

1525

# Call "handle_ipc" for both data and EOF events

1713

1526

gobject.io_add_watch(parent_pipe.fileno(),

1714

1527

gobject.IO_IN | gobject.IO_HUP,

1715

1528

functools.partial(self.handle_ipc,

1716

parent_pipe =

1717

parent_pipe,

1718

proc = proc))

1719

1529

parent_pipe = parent_pipe))

1530

1720

1531

def handle_ipc(self, source, condition, parent_pipe=None,

1721

proc = None, client_object=None):

1532

client_object=None):

1722

1533

condition_names = {

1723

1534

gobject.IO_IN: "IN", # There is data to read.

1724

1535

gobject.IO_OUT: "OUT", # Data can be written (without

1733

1544

for cond, name in

1734

1545

condition_names.iteritems()

1735

1546

if cond & condition)

1736

# error, or the other end of multiprocessing.Pipe has closed

1547

# error or the other end of multiprocessing.Pipe has closed

1737

1548

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1738

# Wait for other process to exit

1739

proc.join()

1740

1549

return False

1741

1550

1742

1551

# Read a request from the child

1747

1556

fpr = request[1]

1748

1557

address = request[2]

1749

1558

1750

for c in self.clients.itervalues():

1559

for c in self.clients:

1751

1560

if c.fingerprint == fpr:

1752

1561

client = c

1753

1562

break

1754

1563

else:

1755

logger.info("Client not found for fingerprint: %s, ad"

1756

"dress: %s", fpr, address)

1564

logger.warning("Client not found for fingerprint: %s, ad"

1565

"dress: %s", fpr, address)

1757

1566

if self.use_dbus:

1758

1567

# Emit D-Bus signal

1759

mandos_dbus_service.ClientNotFound(fpr,

1760

address[0])

1568

mandos_dbus_service.ClientNotFound(fpr, address[0])

1761

1569

parent_pipe.send(False)

1762

1570

return False

1763

1571

1764

1572

gobject.io_add_watch(parent_pipe.fileno(),

1765

1573

gobject.IO_IN | gobject.IO_HUP,

1766

1574

functools.partial(self.handle_ipc,

1767

parent_pipe =

1768

parent_pipe,

1769

proc = proc,

1770

client_object =

1771

client))

1575

parent_pipe = parent_pipe,

1576

client_object = client))

1772

1577

parent_pipe.send(True)

1773

# remove the old hook in favor of the new above hook on

1774

# same fileno

1578

# remove the old hook in favor of the new above hook on same fileno

1775

1579

return False

1776

1580

if command == 'funcall':

1777

1581

funcname = request[1]

1778

1582

args = request[2]

1779

1583

kwargs = request[3]

1780

1584

1781

parent_pipe.send(('data', getattr(client_object,

1782

funcname)(*args,

1783

**kwargs)))

1784

1585

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1586

1785

1587

if command == 'getattr':

1786

1588

attrname = request[1]

1787

1589

if callable(client_object.__getattribute__(attrname)):

1788

1590

parent_pipe.send(('function',))

1789

1591

else:

1790

parent_pipe.send(('data', client_object

1791

.__getattribute__(attrname)))

1592

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1792

1593

1793

1594

if command == 'setattr':

1794

1595

attrname = request[1]

1795

1596

value = request[2]

1796

1597

setattr(client_object, attrname, value)

1797

1598

1798

1599

return True

1799

1600

1800

1601

1921

1722

" system bus interface")

1922

1723

parser.add_argument("--no-ipv6", action="store_false",

1923

1724

dest="use_ipv6", help="Do not use IPv6")

1924

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

1928

1725

options = parser.parse_args()

1929

1726

1930

1727

if options.check:

1965

1762

# options, if set.

1966

1763

for option in ("interface", "address", "port", "debug",

1967

1764

"priority", "servicename", "configdir",

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1765

"use_dbus", "use_ipv6", "debuglevel"):

1969

1766

value = getattr(options, option)

1970

1767

if value is not None:

1971

1768

server_settings[option] = value

1983

1780

debuglevel = server_settings["debuglevel"]

1984

1781

use_dbus = server_settings["use_dbus"]

1985

1782

use_ipv6 = server_settings["use_ipv6"]

1986

1783

1987

1784

if server_settings["servicename"] != "Mandos":

1988

1785

syslogger.setFormatter(logging.Formatter

1989

1786

('Mandos (%s) [%%(process)d]:'

1991

1788

% server_settings["servicename"]))

1992

1789

1993

1790

# Parse config file with clients

1994

client_defaults = { "timeout": "5m",

1995

"extended_timeout": "15m",

1996

"interval": "2m",

1791

client_defaults = { "timeout": "1h",

1792

"interval": "5m",

1997

1793

"checker": "fping -q -- %%(host)s",

1998

1794

"host": "",

1999

1795

"approval_delay": "0s",

2044

1840

raise error

2045

1841

2046

1842

if not debug and not debuglevel:

2047

logger.setLevel(logging.WARNING)

1843

syslogger.setLevel(logging.WARNING)

1844

console.setLevel(logging.WARNING)

2048

1845

if debuglevel:

2049

1846

level = getattr(logging, debuglevel.upper())

2050

logger.setLevel(level)

2051

1847

syslogger.setLevel(level)

1848

console.setLevel(level)

1849

2052

1850

if debug:

2053

logger.setLevel(logging.DEBUG)

2054

1851

# Enable all possible GnuTLS debugging

2055

1852

2056

1853

# "Use a log level over 10 to enable all debugging options."

2086

1883

# End of Avahi example code

2087

1884

if use_dbus:

2088

1885

try:

2089

bus_name = dbus.service.BusName("se.recompile.Mandos",

1886

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2090

1887

bus, do_not_queue=True)

2091

old_bus_name = (dbus.service.BusName

2092

("se.bsnet.fukt.Mandos", bus,

2093

do_not_queue=True))

2094

1888

except dbus.exceptions.NameExistsException as e:

2095

1889

logger.error(unicode(e) + ", disabling D-Bus")

2096

1890

use_dbus = False

2097

1891

server_settings["use_dbus"] = False

2098

1892

tcp_server.use_dbus = False

2099

1893

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2100

service = AvahiServiceToSyslog(name =

2101

server_settings["servicename"],

2102

servicetype = "_mandos._tcp",

2103

protocol = protocol, bus = bus)

1894

service = AvahiService(name = server_settings["servicename"],

1895

servicetype = "_mandos._tcp",

1896

protocol = protocol, bus = bus)

2104

1897

if server_settings["interface"]:

2105

1898

service.interface = (if_nametoindex

2106

1899

(str(server_settings["interface"])))

2110

1903

2111

1904

client_class = Client

2112

1905

if use_dbus:

2113

client_class = functools.partial(ClientDBusTransitional,

2114

bus = bus)

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2133

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2137

if server_settings["restore"]:

2138

try:

2139

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2141

os.remove(stored_state_path)

2142

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2145

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

1906

client_class = functools.partial(ClientDBus, bus = bus)

1907

def client_config_items(config, section):

1908

special_settings = {

1909

"approved_by_default":

1910

lambda: config.getboolean(section,

1911

"approved_by_default"),

1912

}

1913

for name, value in config.items(section):

2156

1914

try:

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

1915

yield (name, special_settings[name]())

2162

1916

except KeyError:

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

1917

yield (name, value)

2209

1918

2210

1919

tcp_server.clients.update(set(

1920

client_class(name = section,

1921

config= dict(client_config_items(

1922

client_config, section)))

1923

for section in client_config.sections()))

2211

1924

if not tcp_server.clients:

2212

1925

logger.warning("No clients defined")

2213

1926

2226

1939

del pidfilename

2227

1940

2228

1941

signal.signal(signal.SIGINT, signal.SIG_IGN)

2229

1942

2230

1943

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2231

1944

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2232

1945

2235

1948

"""A D-Bus proxy object"""

2236

1949

def __init__(self):

2237

1950

dbus.service.Object.__init__(self, bus, "/")

2238

_interface = "se.recompile.Mandos"

1951

_interface = "se.bsnet.fukt.Mandos"

2239

1952

2240

1953

@dbus.service.signal(_interface, signature="o")

2241

1954

def ClientAdded(self, objpath):

2256

1969

def GetAllClients(self):

2257

1970

"D-Bus method"

2258

1971

return dbus.Array(c.dbus_object_path

2259

for c in

2260

tcp_server.clients.itervalues())

1972

for c in tcp_server.clients)

2261

1973

2262

1974

@dbus.service.method(_interface,

2263

1975

out_signature="a{oa{sv}}")

2265

1977

"D-Bus method"

2266

1978

return dbus.Dictionary(

2267

1979

((c.dbus_object_path, c.GetAll(""))

2268

for c in tcp_server.clients.itervalues()),

1980

for c in tcp_server.clients),

2269

1981

signature="oa{sv}")

2270

1982

2271

1983

@dbus.service.method(_interface, in_signature="o")

2272

1984

def RemoveClient(self, object_path):

2273

1985

"D-Bus method"

2274

for c in tcp_server.clients.itervalues():

1986

for c in tcp_server.clients:

2275

1987

if c.dbus_object_path == object_path:

2276

del tcp_server.clients[c.name]

1988

tcp_server.clients.remove(c)

2277

1989

c.remove_from_connection()

2278

1990

# Don't signal anything except ClientRemoved

2279

1991

c.disable(quiet=True)

2284

1996

2285

1997

del _interface

2286

1998

2287

class MandosDBusServiceTransitional(MandosDBusService):

2288

__metaclass__ = AlternateDBusNamesMetaclass

2289

mandos_dbus_service = MandosDBusServiceTransitional()

1999

mandos_dbus_service = MandosDBusService()

2290

2000

2291

2001

def cleanup():

2292

2002

"Cleanup function; run on exit"

2293

2003

service.cleanup()

2294

2004

2295

multiprocessing.active_children()

2296

if not (tcp_server.clients or client_settings):

2297

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2321

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2323

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2329

# Delete all clients, and settings from config

2330

2005

while tcp_server.clients:

2331

name, client = tcp_server.clients.popitem()

2006

client = tcp_server.clients.pop()

2332

2007

if use_dbus:

2333

2008

client.remove_from_connection()

2009

client.disable_hook = None

2334

2010

# Don't signal anything except ClientRemoved

2335

2011

client.disable(quiet=True)

2336

2012

if use_dbus:

2337

2013

# Emit D-Bus signal

2338

mandos_dbus_service.ClientRemoved(client

2339

.dbus_object_path,

2014

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2340

2015

client.name)

2341

client_settings.clear()

2342

2016

2343

2017

atexit.register(cleanup)

2344

2018

2345

for client in tcp_server.clients.itervalues():

2019

for client in tcp_server.clients:

2346

2020

if use_dbus:

2347

2021

# Emit D-Bus signal

2348

2022

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2349

# Need to initiate checking of clients

2350

if client.enabled:

2351

client.init_checker()

2352

2023

client.enable()

2353

2024

2354

2025

tcp_server.enable()

2355

2026

tcp_server.server_activate()

2395

2066

# Must run before the D-Bus bus name gets deregistered

2396

2067

cleanup()

2397

2068

2398

2399

2069

if __name__ == '__main__':

2400

2070

main()