/mandos/trunk : revision 482

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

67

65

68

66

import dbus

69

67

import dbus.service

74

72

import ctypes.util

75

73

import xml.dom.minidom

76

74

import inspect

77

import Crypto.Cipher.AES

78

75

79

76

try:

80

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

SO_BINDTODEVICE = None

86

83

87

84

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

93

89

syslogger = (logging.handlers.SysLogHandler

94

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

91

address = str("/dev/log")))

99

95

logger.addHandler(syslogger)

100

96

101

97

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

104

99

' %(levelname)s:'

105

100

' %(message)s'))

106

101

logger.addHandler(console)

107

102

108

109

103

class AvahiError(Exception):

110

104

def __init__(self, value, *args, **kwargs):

111

105

self.value = value

165

159

" after %i retries, exiting.",

166

160

self.rename_count)

167

161

raise AvahiServiceError("Too many renames")

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

170

163

logger.info("Changing Zeroconf service name to %r ...",

171

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

172

169

self.remove()

173

170

try:

174

171

self.add()

179

176

self.rename_count += 1

180

177

def remove(self):

181

178

"""Derived from the Avahi example code"""

179

if self.group is not None:

180

try:

181

self.group.Free()

182

except (dbus.exceptions.UnknownMethodException,

183

dbus.exceptions.DBusException) as e:

184

pass

185

self.group = None

182

186

if self.entry_group_state_changed_match is not None:

183

187

self.entry_group_state_changed_match.remove()

184

188

self.entry_group_state_changed_match = None

185

if self.group is not None:

186

self.group.Reset()

187

189

def add(self):

188

190

"""Derived from the Avahi example code"""

189

191

self.remove()

190

if self.group is None:

191

self.group = dbus.Interface(

192

self.bus.get_object(avahi.DBUS_NAME,

193

self.server.EntryGroupNew()),

194

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

self.group = dbus.Interface(

193

self.bus.get_object(avahi.DBUS_NAME,

194

self.server.EntryGroupNew(),

195

follow_name_owner_changes=True),

196

avahi.DBUS_INTERFACE_ENTRY_GROUP)

195

197

self.entry_group_state_changed_match = (

196

198

self.group.connect_to_signal(

197

'StateChanged', self.entry_group_state_changed))

199

'StateChanged', self .entry_group_state_changed))

198

200

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

199

201

self.name, self.type)

200

202

self.group.AddService(

222

224

% unicode(error))

223

225

def cleanup(self):

224

226

"""Derived from the Avahi example code"""

225

if self.group is not None:

226

try:

227

self.group.Free()

228

except (dbus.exceptions.UnknownMethodException,

229

dbus.exceptions.DBusException) as e:

230

pass

231

self.group = None

232

227

self.remove()

233

228

def server_state_changed(self, state, error=None):

234

229

"""Derived from the Avahi example code"""

241

236

avahi.SERVER_FAILURE:

242

237

"Zeroconf server failure" }

243

238

if state in bad_states:

244

if bad_states[state] is not None:

245

if error is None:

246

logger.error(bad_states[state])

247

else:

248

logger.error(bad_states[state] + ": %r", error)

249

self.cleanup()

239

if bad_states[state]:

240

logger.error(bad_states[state])

241

self.remove()

250

242

elif state == avahi.SERVER_RUNNING:

251

243

self.add()

252

244

else:

253

if error is None:

254

logger.debug("Unknown state: %r", state)

255

else:

256

logger.debug("Unknown state: %r: %r", state, error)

245

logger.debug("Unknown state: %r", state)

257

246

def activate(self):

258

247

"""Derived from the Avahi example code"""

259

248

if self.server is None:

266

255

self.server_state_changed)

267

256

self.server_state_changed(self.server.GetState())

268

257

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

278

258

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

285

259

class Client(object):

286

260

"""A representation of a client host served by this server.

287

261

299

273

instance %(name)s can be used in the command.

300

274

checker_initiator_tag: a gobject event source tag, or None

301

275

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

304

276

current_checker_command: string; current running checker_command

277

disable_hook: If set, called by disable() as disable_hook(self)

305

278

disable_initiator_tag: a gobject event source tag, or None

306

279

enabled: bool()

307

280

fingerprint: string (40 or 32 hexadecimal digits); used to

310

283

interval: datetime.timedelta(); How often to start a new checker

311

284

last_approval_request: datetime.datetime(); (UTC) or None

312

285

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit

314

status of last checker. -1 reflect crashed

315

checker, or None.

316

286

last_enabled: datetime.datetime(); (UTC)

317

287

name: string; from the config file, used in log messages and

318

288

D-Bus identifiers

319

289

secret: bytestring; sent verbatim (over TLS) to client

320

290

timeout: datetime.timedelta(); How long from last_checked_ok

321

291

until this client is disabled

322

extended_timeout: extra long timeout when password has been sent

323

292

runtime_expansions: Allowed attributes for runtime expansion.

324

expires: datetime.datetime(); time (UTC) when a client will be

325

disabled, or None

326

293

"""

327

294

328

295

runtime_expansions = ("approval_delay", "approval_duration",

330

297

"host", "interval", "last_checked_ok",

331

298

"last_enabled", "name", "timeout")

332

299

300

@staticmethod

301

def _timedelta_to_milliseconds(td):

302

"Convert a datetime.timedelta() to milliseconds"

303

return ((td.days * 24 * 60 * 60 * 1000)

304

+ (td.seconds * 1000)

305

+ (td.microseconds // 1000))

306

333

307

def timeout_milliseconds(self):

334

308

"Return the 'timeout' attribute in milliseconds"

335

return _timedelta_to_milliseconds(self.timeout)

336

337

def extended_timeout_milliseconds(self):

338

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

309

return self._timedelta_to_milliseconds(self.timeout)

340

310

341

311

def interval_milliseconds(self):

342

312

"Return the 'interval' attribute in milliseconds"

343

return _timedelta_to_milliseconds(self.interval)

344

313

return self._timedelta_to_milliseconds(self.interval)

314

345

315

def approval_delay_milliseconds(self):

346

return _timedelta_to_milliseconds(self.approval_delay)

316

return self._timedelta_to_milliseconds(self.approval_delay)

347

317

348

def __init__(self, name = None, config=None):

318

def __init__(self, name = None, disable_hook=None, config=None):

349

319

"""Note: the 'checker' key in 'config' sets the

350

320

'checker_command' attribute and *not* the 'checker'

351

321

attribute."""

371

341

% self.name)

372

342

self.host = config.get("host", "")

373

343

self.created = datetime.datetime.utcnow()

374

self.enabled = True

344

self.enabled = False

375

345

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

346

self.last_enabled = None

377

347

self.last_checked_ok = None

378

self.last_checker_status = None

379

348

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

382

349

self.interval = string_to_delta(config["interval"])

350

self.disable_hook = disable_hook

383

351

self.checker = None

384

352

self.checker_initiator_tag = None

385

353

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

387

354

self.checker_callback_tag = None

388

355

self.checker_command = config["checker"]

389

356

self.current_checker_command = None

357

self.last_connect = None

390

358

self._approved = None

391

359

self.approved_by_default = config.get("approved_by_default",

392

360

True)

395

363

config["approval_delay"])

396

364

self.approval_duration = string_to_delta(

397

365

config["approval_duration"])

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr

402

in self.__dict__.iterkeys()

403

if not attr.startswith("_")]

404

self.client_structure.append("client_structure")

405

406

407

for name, t in inspect.getmembers(type(self),

408

lambda obj:

409

isinstance(obj,

410

property)):

411

if not name.startswith("_"):

412

self.client_structure.append(name)

366

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

413

367

414

# Send notice to process children that client state has changed

415

368

def send_changedstate(self):

416

with self.changedstate:

417

self.changedstate.notify_all()

418

369

self.changedstate.acquire()

370

self.changedstate.notify_all()

371

self.changedstate.release()

372

419

373

def enable(self):

420

374

"""Start this client's checker and timeout hooks"""

421

375

if getattr(self, "enabled", False):

422

376

# Already enabled

423

377

return

424

378

self.send_changedstate()

425

self.expires = datetime.datetime.utcnow() + self.timeout

379

self.last_enabled = datetime.datetime.utcnow()

380

# Schedule a new checker to be started an 'interval' from now,

381

# and every interval from then on.

382

self.checker_initiator_tag = (gobject.timeout_add

383

(self.interval_milliseconds(),

384

self.start_checker))

385

# Schedule a disable() when 'timeout' has passed

386

self.disable_initiator_tag = (gobject.timeout_add

387

(self.timeout_milliseconds(),

388

self.disable))

426

389

self.enabled = True

427

self.last_enabled = datetime.datetime.utcnow()

428

self.init_checker()

390

# Also start a new checker *right now*.

391

self.start_checker()

429

392

430

393

def disable(self, quiet=True):

431

394

"""Disable this client."""

438

401

if getattr(self, "disable_initiator_tag", False):

439

402

gobject.source_remove(self.disable_initiator_tag)

440

403

self.disable_initiator_tag = None

441

self.expires = None

442

404

if getattr(self, "checker_initiator_tag", False):

443

405

gobject.source_remove(self.checker_initiator_tag)

444

406

self.checker_initiator_tag = None

445

407

self.stop_checker()

408

if self.disable_hook:

409

self.disable_hook(self)

446

410

self.enabled = False

447

411

# Do not run this again if called by a gobject.timeout_add

448

412

return False

449

413

450

414

def __del__(self):

415

self.disable_hook = None

451

416

self.disable()

452

453

def init_checker(self):

454

# Schedule a new checker to be started an 'interval' from now,

455

# and every interval from then on.

456

self.checker_initiator_tag = (gobject.timeout_add

457

(self.interval_milliseconds(),

458

self.start_checker))

459

# Schedule a disable() when 'timeout' has passed

460

self.disable_initiator_tag = (gobject.timeout_add

461

(self.timeout_milliseconds(),

462

self.disable))

463

# Also start a new checker *right now*.

464

self.start_checker()

465

466

417

467

418

def checker_callback(self, pid, condition, command):

468

419

"""The checker has completed, so take appropriate actions."""

469

420

self.checker_callback_tag = None

470

421

self.checker = None

471

422

if os.WIFEXITED(condition):

472

self.last_checker_status = os.WEXITSTATUS(condition)

473

if self.last_checker_status == 0:

423

exitstatus = os.WEXITSTATUS(condition)

424

if exitstatus == 0:

474

425

logger.info("Checker for %(name)s succeeded",

475

426

vars(self))

476

427

self.checked_ok()

478

429

logger.info("Checker for %(name)s failed",

479

430

vars(self))

480

431

else:

481

self.last_checker_status = -1

482

432

logger.warning("Checker for %(name)s crashed?",

483

433

vars(self))

484

434

485

def checked_ok(self, timeout=None):

435

def checked_ok(self):

486

436

"""Bump up the timeout for this client.

487

437

488

438

This should only be called when the client has been seen,

489

439

alive and well.

490

440

"""

491

if timeout is None:

492

timeout = self.timeout

493

441

self.last_checked_ok = datetime.datetime.utcnow()

494

if self.disable_initiator_tag is not None:

495

gobject.source_remove(self.disable_initiator_tag)

496

if getattr(self, "enabled", False):

497

self.disable_initiator_tag = (gobject.timeout_add

498

(_timedelta_to_milliseconds

499

(timeout), self.disable))

500

self.expires = datetime.datetime.utcnow() + timeout

442

gobject.source_remove(self.disable_initiator_tag)

443

self.disable_initiator_tag = (gobject.timeout_add

444

(self.timeout_milliseconds(),

445

self.disable))

501

446

502

447

def need_approval(self):

503

448

self.last_approval_request = datetime.datetime.utcnow()

543

488

'replace')))

544

489

for attr in

545

490

self.runtime_expansions)

546

491

547

492

try:

548

493

command = self.checker_command % escaped_attrs

549

494

except TypeError as error:

595

540

raise

596

541

self.checker = None

597

542

598

# Encrypts a client secret and stores it in a varible

599

# encrypted_secret

600

def encrypt_secret(self, key):

601

# Encryption-key need to be of a specific size, so we hash

602

# supplied key

603

hasheng = hashlib.sha256()

604

hasheng.update(key)

605

encryptionkey = hasheng.digest()

606

607

# Create validation hash so we know at decryption if it was

608

# sucessful

609

hasheng = hashlib.sha256()

610

hasheng.update(self.secret)

611

validationhash = hasheng.digest()

612

613

# Encrypt secret

614

iv = os.urandom(Crypto.Cipher.AES.block_size)

615

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

616

Crypto.Cipher.AES.MODE_CFB, iv)

617

ciphertext = ciphereng.encrypt(validationhash+self.secret)

618

self.encrypted_secret = (ciphertext, iv)

619

620

# Decrypt a encrypted client secret

621

def decrypt_secret(self, key):

622

# Decryption-key need to be of a specific size, so we hash

623

# supplied key

624

hasheng = hashlib.sha256()

625

hasheng.update(key)

626

encryptionkey = hasheng.digest()

627

628

# Decrypt encrypted secret

629

ciphertext, iv = self.encrypted_secret

630

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

631

Crypto.Cipher.AES.MODE_CFB, iv)

632

plain = ciphereng.decrypt(ciphertext)

633

634

# Validate decrypted secret to know if it was succesful

635

hasheng = hashlib.sha256()

636

validationhash = plain[:hasheng.digest_size]

637

secret = plain[hasheng.digest_size:]

638

hasheng.update(secret)

639

640

# If validation fails, we use key as new secret. Otherwise, we

641

# use the decrypted secret

642

if hasheng.digest() == validationhash:

643

self.secret = secret

644

else:

645

self.secret = key

646

del self.encrypted_secret

647

648

649

543

def dbus_service_property(dbus_interface, signature="v",

650

544

access="readwrite", byte_arrays=False):

651

545

"""Decorators for marking methods of a DBusObjectWithProperties to

697

591

698

592

class DBusObjectWithProperties(dbus.service.Object):

699

593

"""A D-Bus object with properties.

700

594

701

595

Classes inheriting from this can use the dbus_service_property

702

596

decorator to expose methods as D-Bus properties. It exposes the

703

597

standard Get(), Set(), and GetAll() methods on the D-Bus.

710

604

def _get_all_dbus_properties(self):

711

605

"""Returns a generator of (name, attribute) pairs

712

606

"""

713

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

714

for cls in self.__class__.__mro__

607

return ((prop._dbus_name, prop)

715

608

for name, prop in

716

inspect.getmembers(cls, self._is_dbus_property))

609

inspect.getmembers(self, self._is_dbus_property))

717

610

718

611

def _get_dbus_property(self, interface_name, property_name):

719

612

"""Returns a bound method if one exists which is a D-Bus

720

613

property with the specified name and interface.

721

614

"""

722

for cls in self.__class__.__mro__:

723

for name, value in (inspect.getmembers

724

(cls, self._is_dbus_property)):

725

if (value._dbus_name == property_name

726

and value._dbus_interface == interface_name):

727

return value.__get__(self)

728

615

for name in (property_name,

616

property_name + "_dbus_property"):

617

prop = getattr(self, name, None)

618

if (prop is None

619

or not self._is_dbus_property(prop)

620

or prop._dbus_name != property_name

621

or (interface_name and prop._dbus_interface

622

and interface_name != prop._dbus_interface)):

623

continue

624

return prop

729

625

# No such property

730

626

raise DBusPropertyNotFound(self.dbus_object_path + ":"

731

627

+ interface_name + "."

765

661

def GetAll(self, interface_name):

766

662

"""Standard D-Bus property GetAll() method, see D-Bus

767

663

standard.

768

664

769

665

Note: Will not include properties with access="write".

770

666

"""

771

667

all = {}

833

729

return xmlstring

834

730

835

731

836

def datetime_to_dbus (dt, variant_level=0):

837

"""Convert a UTC datetime.datetime() to a D-Bus type."""

838

if dt is None:

839

return dbus.String("", variant_level = variant_level)

840

return dbus.String(dt.isoformat(),

841

variant_level=variant_level)

842

843

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

844

.__metaclass__):

845

"""Applied to an empty subclass of a D-Bus object, this metaclass

846

will add additional D-Bus attributes matching a certain pattern.

847

"""

848

def __new__(mcs, name, bases, attr):

849

# Go through all the base classes which could have D-Bus

850

# methods, signals, or properties in them

851

for base in (b for b in bases

852

if issubclass(b, dbus.service.Object)):

853

# Go though all attributes of the base class

854

for attrname, attribute in inspect.getmembers(base):

855

# Ignore non-D-Bus attributes, and D-Bus attributes

856

# with the wrong interface name

857

if (not hasattr(attribute, "_dbus_interface")

858

or not attribute._dbus_interface

859

.startswith("se.recompile.Mandos")):

860

continue

861

# Create an alternate D-Bus interface name based on

862

# the current name

863

alt_interface = (attribute._dbus_interface

864

.replace("se.recompile.Mandos",

865

"se.bsnet.fukt.Mandos"))

866

# Is this a D-Bus signal?

867

if getattr(attribute, "_dbus_is_signal", False):

868

# Extract the original non-method function by

869

# black magic

870

nonmethod_func = (dict(

871

zip(attribute.func_code.co_freevars,

872

attribute.__closure__))["func"]

873

.cell_contents)

874

# Create a new, but exactly alike, function

875

# object, and decorate it to be a new D-Bus signal

876

# with the alternate D-Bus interface name

877

new_function = (dbus.service.signal

878

(alt_interface,

879

attribute._dbus_signature)

880

(types.FunctionType(

881

nonmethod_func.func_code,

882

nonmethod_func.func_globals,

883

nonmethod_func.func_name,

884

nonmethod_func.func_defaults,

885

nonmethod_func.func_closure)))

886

# Define a creator of a function to call both the

887

# old and new functions, so both the old and new

888

# signals gets sent when the function is called

889

def fixscope(func1, func2):

890

"""This function is a scope container to pass

891

func1 and func2 to the "call_both" function

892

outside of its arguments"""

893

def call_both(*args, **kwargs):

894

"""This function will emit two D-Bus

895

signals by calling func1 and func2"""

896

func1(*args, **kwargs)

897

func2(*args, **kwargs)

898

return call_both

899

# Create the "call_both" function and add it to

900

# the class

901

attr[attrname] = fixscope(attribute,

902

new_function)

903

# Is this a D-Bus method?

904

elif getattr(attribute, "_dbus_is_method", False):

905

# Create a new, but exactly alike, function

906

# object. Decorate it to be a new D-Bus method

907

# with the alternate D-Bus interface name. Add it

908

# to the class.

909

attr[attrname] = (dbus.service.method

910

(alt_interface,

911

attribute._dbus_in_signature,

912

attribute._dbus_out_signature)

913

(types.FunctionType

914

(attribute.func_code,

915

attribute.func_globals,

916

attribute.func_name,

917

attribute.func_defaults,

918

attribute.func_closure)))

919

# Is this a D-Bus property?

920

elif getattr(attribute, "_dbus_is_property", False):

921

# Create a new, but exactly alike, function

922

# object, and decorate it to be a new D-Bus

923

# property with the alternate D-Bus interface

924

# name. Add it to the class.

925

attr[attrname] = (dbus_service_property

926

(alt_interface,

927

attribute._dbus_signature,

928

attribute._dbus_access,

929

attribute

930

._dbus_get_args_options

931

["byte_arrays"])

932

(types.FunctionType

933

(attribute.func_code,

934

attribute.func_globals,

935

attribute.func_name,

936

attribute.func_defaults,

937

attribute.func_closure)))

938

return type.__new__(mcs, name, bases, attr)

939

940

732

class ClientDBus(Client, DBusObjectWithProperties):

941

733

"""A Client class using D-Bus

942

734

951

743

# dbus.service.Object doesn't use super(), so we can't either.

952

744

953

745

def __init__(self, bus = None, *args, **kwargs):

954

self.bus = bus

955

746

self._approvals_pending = 0

747

self.bus = bus

956

748

Client.__init__(self, *args, **kwargs)

957

self.add_to_dbus()

958

959

def add_to_dbus(self):

960

749

# Only now, when this client is initialized, can it show up on

961

750

# the D-Bus

962

751

client_object_name = unicode(self.name).translate(

967

756

DBusObjectWithProperties.__init__(self, self.bus,

968

757

self.dbus_object_path)

969

758

970

def notifychangeproperty(transform_func,

971

dbus_name, type_func=lambda x: x,

972

variant_level=1):

973

""" Modify a variable so that it's a property which announces

974

its changes to DBus.

759

def _get_approvals_pending(self):

760

return self._approvals_pending

761

def _set_approvals_pending(self, value):

762

old_value = self._approvals_pending

763

self._approvals_pending = value

764

bval = bool(value)

765

if (hasattr(self, "dbus_object_path")

766

and bval is not bool(old_value)):

767

dbus_bool = dbus.Boolean(bval, variant_level=1)

768

self.PropertyChanged(dbus.String("ApprovalPending"),

769

dbus_bool)

975

770

976

transform_fun: Function that takes a value and a variant_level

977

and transforms it to a D-Bus type.

978

dbus_name: D-Bus name of the variable

979

type_func: Function that transform the value before sending it

980

to the D-Bus. Default: no transform

981

variant_level: D-Bus variant level. Default: 1

982

"""

983

attrname = "_{0}".format(dbus_name)

984

def setter(self, value):

985

if hasattr(self, "dbus_object_path"):

986

if (not hasattr(self, attrname) or

987

type_func(getattr(self, attrname, None))

988

!= type_func(value)):

989

dbus_value = transform_func(type_func(value),

990

variant_level

991

=variant_level)

992

self.PropertyChanged(dbus.String(dbus_name),

993

dbus_value)

994

setattr(self, attrname, value)

995

996

return property(lambda self: getattr(self, attrname), setter)

997

998

999

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1000

approvals_pending = notifychangeproperty(dbus.Boolean,

1001

"ApprovalPending",

1002

type_func = bool)

1003

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1004

last_enabled = notifychangeproperty(datetime_to_dbus,

1005

"LastEnabled")

1006

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1007

type_func = lambda checker:

1008

checker is not None)

1009

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1010

"LastCheckedOK")

1011

last_approval_request = notifychangeproperty(

1012

datetime_to_dbus, "LastApprovalRequest")

1013

approved_by_default = notifychangeproperty(dbus.Boolean,

1014

"ApprovedByDefault")

1015

approval_delay = notifychangeproperty(dbus.UInt16,

1016

"ApprovalDelay",

1017

type_func =

1018

_timedelta_to_milliseconds)

1019

approval_duration = notifychangeproperty(

1020

dbus.UInt16, "ApprovalDuration",

1021

type_func = _timedelta_to_milliseconds)

1022

host = notifychangeproperty(dbus.String, "Host")

1023

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1024

type_func =

1025

_timedelta_to_milliseconds)

1026

extended_timeout = notifychangeproperty(

1027

dbus.UInt16, "ExtendedTimeout",

1028

type_func = _timedelta_to_milliseconds)

1029

interval = notifychangeproperty(dbus.UInt16,

1030

"Interval",

1031

type_func =

1032

_timedelta_to_milliseconds)

1033

checker_command = notifychangeproperty(dbus.String, "Checker")

1034

1035

del notifychangeproperty

771

approvals_pending = property(_get_approvals_pending,

772

_set_approvals_pending)

773

del _get_approvals_pending, _set_approvals_pending

774

775

@staticmethod

776

def _datetime_to_dbus(dt, variant_level=0):

777

"""Convert a UTC datetime.datetime() to a D-Bus type."""

778

return dbus.String(dt.isoformat(),

779

variant_level=variant_level)

780

781

def enable(self):

782

oldstate = getattr(self, "enabled", False)

783

r = Client.enable(self)

784

if oldstate != self.enabled:

785

# Emit D-Bus signals

786

self.PropertyChanged(dbus.String("Enabled"),

787

dbus.Boolean(True, variant_level=1))

788

self.PropertyChanged(

789

dbus.String("LastEnabled"),

790

self._datetime_to_dbus(self.last_enabled,

791

variant_level=1))

792

return r

793

794

def disable(self, quiet = False):

795

oldstate = getattr(self, "enabled", False)

796

r = Client.disable(self, quiet=quiet)

797

if not quiet and oldstate != self.enabled:

798

# Emit D-Bus signal

799

self.PropertyChanged(dbus.String("Enabled"),

800

dbus.Boolean(False, variant_level=1))

801

return r

1036

802

1037

803

def __del__(self, *args, **kwargs):

1038

804

try:

1047

813

*args, **kwargs):

1048

814

self.checker_callback_tag = None

1049

815

self.checker = None

816

# Emit D-Bus signal

817

self.PropertyChanged(dbus.String("CheckerRunning"),

818

dbus.Boolean(False, variant_level=1))

1050

819

if os.WIFEXITED(condition):

1051

820

exitstatus = os.WEXITSTATUS(condition)

1052

821

# Emit D-Bus signal

1062

831

return Client.checker_callback(self, pid, condition, command,

1063

832

*args, **kwargs)

1064

833

834

def checked_ok(self, *args, **kwargs):

835

Client.checked_ok(self, *args, **kwargs)

836

# Emit D-Bus signal

837

self.PropertyChanged(

838

dbus.String("LastCheckedOK"),

839

(self._datetime_to_dbus(self.last_checked_ok,

840

variant_level=1)))

841

842

def need_approval(self, *args, **kwargs):

843

r = Client.need_approval(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastApprovalRequest"),

847

(self._datetime_to_dbus(self.last_approval_request,

848

variant_level=1)))

849

return r

850

1065

851

def start_checker(self, *args, **kwargs):

1066

852

old_checker = self.checker

1067

853

if self.checker is not None:

1074

860

and old_checker_pid != self.checker.pid):

1075

861

# Emit D-Bus signal

1076

862

self.CheckerStarted(self.current_checker_command)

863

self.PropertyChanged(

864

dbus.String("CheckerRunning"),

865

dbus.Boolean(True, variant_level=1))

1077

866

return r

1078

867

868

def stop_checker(self, *args, **kwargs):

869

old_checker = getattr(self, "checker", None)

870

r = Client.stop_checker(self, *args, **kwargs)

871

if (old_checker is not None

872

and getattr(self, "checker", None) is None):

873

self.PropertyChanged(dbus.String("CheckerRunning"),

874

dbus.Boolean(False, variant_level=1))

875

return r

876

1079

877

def _reset_approved(self):

1080

878

self._approved = None

1081

879

return False

1083

881

def approve(self, value=True):

1084

882

self.send_changedstate()

1085

883

self._approved = value

1086

gobject.timeout_add(_timedelta_to_milliseconds

884

gobject.timeout_add(self._timedelta_to_milliseconds

1087

885

(self.approval_duration),

1088

886

self._reset_approved)

1089

887

1090

888

1091

889

## D-Bus methods, signals & properties

1092

_interface = "se.recompile.Mandos.Client"

890

_interface = "se.bsnet.fukt.Mandos.Client"

1093

891

1094

892

## Signals

1095

893

1181

979

if value is None: # get

1182

980

return dbus.Boolean(self.approved_by_default)

1183

981

self.approved_by_default = bool(value)

982

# Emit D-Bus signal

983

self.PropertyChanged(dbus.String("ApprovedByDefault"),

984

dbus.Boolean(value, variant_level=1))

1184

985

1185

986

# ApprovalDelay - property

1186

987

@dbus_service_property(_interface, signature="t",

1189

990

if value is None: # get

1190

991

return dbus.UInt64(self.approval_delay_milliseconds())

1191

992

self.approval_delay = datetime.timedelta(0, 0, 0, value)

993

# Emit D-Bus signal

994

self.PropertyChanged(dbus.String("ApprovalDelay"),

995

dbus.UInt64(value, variant_level=1))

1192

996

1193

997

# ApprovalDuration - property

1194

998

@dbus_service_property(_interface, signature="t",

1195

999

access="readwrite")

1196

1000

def ApprovalDuration_dbus_property(self, value=None):

1197

1001

if value is None: # get

1198

return dbus.UInt64(_timedelta_to_milliseconds(

1002

return dbus.UInt64(self._timedelta_to_milliseconds(

1199

1003

self.approval_duration))

1200

1004

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1005

# Emit D-Bus signal

1006

self.PropertyChanged(dbus.String("ApprovalDuration"),

1007

dbus.UInt64(value, variant_level=1))

1201

1008

1202

1009

# Name - property

1203

1010

@dbus_service_property(_interface, signature="s", access="read")

1216

1023

if value is None: # get

1217

1024

return dbus.String(self.host)

1218

1025

self.host = value

1026

# Emit D-Bus signal

1027

self.PropertyChanged(dbus.String("Host"),

1028

dbus.String(value, variant_level=1))

1219

1029

1220

1030

# Created - property

1221

1031

@dbus_service_property(_interface, signature="s", access="read")

1222

1032

def Created_dbus_property(self):

1223

return dbus.String(datetime_to_dbus(self.created))

1033

return dbus.String(self._datetime_to_dbus(self.created))

1224

1034

1225

1035

# LastEnabled - property

1226

1036

@dbus_service_property(_interface, signature="s", access="read")

1227

1037

def LastEnabled_dbus_property(self):

1228

return datetime_to_dbus(self.last_enabled)

1038

if self.last_enabled is None:

1039

return dbus.String("")

1040

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1229

1041

1230

1042

# Enabled - property

1231

1043

@dbus_service_property(_interface, signature="b",

1245

1057

if value is not None:

1246

1058

self.checked_ok()

1247

1059

return

1248

return datetime_to_dbus(self.last_checked_ok)

1249

1250

# Expires - property

1251

@dbus_service_property(_interface, signature="s", access="read")

1252

def Expires_dbus_property(self):

1253

return datetime_to_dbus(self.expires)

1060

if self.last_checked_ok is None:

1061

return dbus.String("")

1062

return dbus.String(self._datetime_to_dbus(self

1063

.last_checked_ok))

1254

1064

1255

1065

# LastApprovalRequest - property

1256

1066

@dbus_service_property(_interface, signature="s", access="read")

1257

1067

def LastApprovalRequest_dbus_property(self):

1258

return datetime_to_dbus(self.last_approval_request)

1068

if self.last_approval_request is None:

1069

return dbus.String("")

1070

return dbus.String(self.

1071

_datetime_to_dbus(self

1072

.last_approval_request))

1259

1073

1260

1074

# Timeout - property

1261

1075

@dbus_service_property(_interface, signature="t",

1264

1078

if value is None: # get

1265

1079

return dbus.UInt64(self.timeout_milliseconds())

1266

1080

self.timeout = datetime.timedelta(0, 0, 0, value)

1081

# Emit D-Bus signal

1082

self.PropertyChanged(dbus.String("Timeout"),

1083

dbus.UInt64(value, variant_level=1))

1267

1084

if getattr(self, "disable_initiator_tag", None) is None:

1268

1085

return

1269

1086

# Reschedule timeout

1270

1087

gobject.source_remove(self.disable_initiator_tag)

1271

1088

self.disable_initiator_tag = None

1272

self.expires = None

1273

time_to_die = _timedelta_to_milliseconds((self

1274

.last_checked_ok

1275

+ self.timeout)

1276

- datetime.datetime

1277

.utcnow())

1089

time_to_die = (self.

1090

_timedelta_to_milliseconds((self

1091

.last_checked_ok

1092

+ self.timeout)

1093

- datetime.datetime

1094

.utcnow()))

1278

1095

if time_to_die <= 0:

1279

1096

# The timeout has passed

1280

1097

self.disable()

1281

1098

else:

1282

self.expires = (datetime.datetime.utcnow()

1283

+ datetime.timedelta(milliseconds =

1284

time_to_die))

1285

1099

self.disable_initiator_tag = (gobject.timeout_add

1286

1100

(time_to_die, self.disable))

1287

1101

1288

# ExtendedTimeout - property

1289

@dbus_service_property(_interface, signature="t",

1290

access="readwrite")

1291

def ExtendedTimeout_dbus_property(self, value=None):

1292

if value is None: # get

1293

return dbus.UInt64(self.extended_timeout_milliseconds())

1294

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1295

1296

1102

# Interval - property

1297

1103

@dbus_service_property(_interface, signature="t",

1298

1104

access="readwrite")

1300

1106

if value is None: # get

1301

1107

return dbus.UInt64(self.interval_milliseconds())

1302

1108

self.interval = datetime.timedelta(0, 0, 0, value)

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Interval"),

1111

dbus.UInt64(value, variant_level=1))

1303

1112

if getattr(self, "checker_initiator_tag", None) is None:

1304

1113

return

1305

1114

# Reschedule checker run

1307

1116

self.checker_initiator_tag = (gobject.timeout_add

1308

1117

(value, self.start_checker))

1309

1118

self.start_checker() # Start one now, too

1310

1119

1311

1120

# Checker - property

1312

1121

@dbus_service_property(_interface, signature="s",

1313

1122

access="readwrite")

1315

1124

if value is None: # get

1316

1125

return dbus.String(self.checker_command)

1317

1126

self.checker_command = value

1127

# Emit D-Bus signal

1128

self.PropertyChanged(dbus.String("Checker"),

1129

dbus.String(self.checker_command,

1130

variant_level=1))

1318

1131

1319

1132

# CheckerRunning - property

1320

1133

@dbus_service_property(_interface, signature="b",

1347

1160

self._pipe.send(('init', fpr, address))

1348

1161

if not self._pipe.recv():

1349

1162

raise KeyError()

1350

1163

1351

1164

def __getattribute__(self, name):

1352

1165

if(name == '_pipe'):

1353

1166

return super(ProxyClient, self).__getattribute__(name)

1360

1173

self._pipe.send(('funcall', name, args, kwargs))

1361

1174

return self._pipe.recv()[1]

1362

1175

return func

1363

1176

1364

1177

def __setattr__(self, name, value):

1365

1178

if(name == '_pipe'):

1366

1179

return super(ProxyClient, self).__setattr__(name, value)

1367

1180

self._pipe.send(('setattr', name, value))

1368

1181

1369

class ClientDBusTransitional(ClientDBus):

1370

__metaclass__ = AlternateDBusNamesMetaclass

1371

1182

1372

1183

class ClientHandler(socketserver.BaseRequestHandler, object):

1373

1184

"""A class to handle client connections.

1381

1192

unicode(self.client_address))

1382

1193

logger.debug("Pipe FD: %d",

1383

1194

self.server.child_pipe.fileno())

1384

1195

1385

1196

session = (gnutls.connection

1386

1197

.ClientSession(self.request,

1387

1198

gnutls.connection

1388

1199

.X509Credentials()))

1389

1200

1390

1201

# Note: gnutls.connection.X509Credentials is really a

1391

1202

# generic GnuTLS certificate credentials object so long as

1392

1203

# no X.509 keys are added to it. Therefore, we can use it

1393

1204

# here despite using OpenPGP certificates.

1394

1205

1395

1206

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1396

1207

# "+AES-256-CBC", "+SHA1",

1397

1208

# "+COMP-NULL", "+CTYPE-OPENPGP",

1403

1214

(gnutls.library.functions

1404

1215

.gnutls_priority_set_direct(session._c_object,

1405

1216

priority, None))

1406

1217

1407

1218

# Start communication using the Mandos protocol

1408

1219

# Get protocol number

1409

1220

line = self.request.makefile().readline()

1414

1225

except (ValueError, IndexError, RuntimeError) as error:

1415

1226

logger.error("Unknown protocol version: %s", error)

1416

1227

return

1417

1228

1418

1229

# Start GnuTLS connection

1419

1230

try:

1420

1231

session.handshake()

1424

1235

# established. Just abandon the request.

1425

1236

return

1426

1237

logger.debug("Handshake succeeded")

1427

1238

1428

1239

approval_required = False

1429

1240

try:

1430

1241

try:

1435

1246

logger.warning("Bad certificate: %s", error)

1436

1247

return

1437

1248

logger.debug("Fingerprint: %s", fpr)

1438

1249

1439

1250

try:

1440

1251

client = ProxyClient(child_pipe, fpr,

1441

1252

self.client_address)

1449

1260

1450

1261

while True:

1451

1262

if not client.enabled:

1452

logger.info("Client %s is disabled",

1263

logger.warning("Client %s is disabled",

1453

1264

client.name)

1454

1265

if self.server.use_dbus:

1455

1266

# Emit D-Bus signal

1456

client.Rejected("Disabled")

1267

client.Rejected("Disabled")

1457

1268

return

1458

1269

1459

1270

if client._approved or not client.approval_delay:

1476

1287

return

1477

1288

1478

1289

#wait until timeout or approved

1290

#x = float(client._timedelta_to_milliseconds(delay))

1479

1291

time = datetime.datetime.now()

1480

1292

client.changedstate.acquire()

1481

(client.changedstate.wait

1482

(float(client._timedelta_to_milliseconds(delay)

1483

/ 1000)))

1293

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1484

1294

client.changedstate.release()

1485

1295

time2 = datetime.datetime.now()

1486

1296

if (time2 - time) >= delay:

1508

1318

sent, len(client.secret)

1509

1319

- (sent_size + sent))

1510

1320

sent_size += sent

1511

1321

1512

1322

logger.info("Sending secret to %s", client.name)

1513

# bump the timeout using extended_timeout

1514

client.checked_ok(client.extended_timeout)

1323

# bump the timeout as if seen

1324

client.checked_ok()

1515

1325

if self.server.use_dbus:

1516

1326

# Emit D-Bus signal

1517

1327

client.GotSecret()

1596

1406

except:

1597

1407

self.handle_error(request, address)

1598

1408

self.close_request(request)

1599

1409

1600

1410

def process_request(self, request, address):

1601

1411

"""Start a new process to process the request."""

1602

proc = multiprocessing.Process(target = self.sub_process_main,

1603

args = (request,

1604

address))

1605

proc.start()

1606

return proc

1607

1412

multiprocessing.Process(target = self.sub_process_main,

1413

args = (request, address)).start()

1608

1414

1609

1415

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1610

1416

""" adds a pipe to the MixIn """

1614

1420

This function creates a new pipe in self.pipe

1615

1421

"""

1616

1422

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1617

1618

proc = MultiprocessingMixIn.process_request(self, request,

1619

client_address)

1423

1424

super(MultiprocessingMixInWithPipe,

1425

self).process_request(request, client_address)

1620

1426

self.child_pipe.close()

1621

self.add_pipe(parent_pipe, proc)

1622

1623

def add_pipe(self, parent_pipe, proc):

1427

self.add_pipe(parent_pipe)

1428

1429

def add_pipe(self, parent_pipe):

1624

1430

"""Dummy function; override as necessary"""

1625

1431

raise NotImplementedError

1626

1432

1627

1628

1433

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1629

1434

socketserver.TCPServer, object):

1630

1435

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1704

1509

self.enabled = False

1705

1510

self.clients = clients

1706

1511

if self.clients is None:

1707

self.clients = {}

1512

self.clients = set()

1708

1513

self.use_dbus = use_dbus

1709

1514

self.gnutls_priority = gnutls_priority

1710

1515

IPv6_TCPServer.__init__(self, server_address,

1714

1519

def server_activate(self):

1715

1520

if self.enabled:

1716

1521

return socketserver.TCPServer.server_activate(self)

1717

1718

1522

def enable(self):

1719

1523

self.enabled = True

1720

1721

def add_pipe(self, parent_pipe, proc):

1524

def add_pipe(self, parent_pipe):

1722

1525

# Call "handle_ipc" for both data and EOF events

1723

1526

gobject.io_add_watch(parent_pipe.fileno(),

1724

1527

gobject.IO_IN | gobject.IO_HUP,

1725

1528

functools.partial(self.handle_ipc,

1726

parent_pipe =

1727

parent_pipe,

1728

proc = proc))

1729

1529

parent_pipe = parent_pipe))

1530

1730

1531

def handle_ipc(self, source, condition, parent_pipe=None,

1731

proc = None, client_object=None):

1532

client_object=None):

1732

1533

condition_names = {

1733

1534

gobject.IO_IN: "IN", # There is data to read.

1734

1535

gobject.IO_OUT: "OUT", # Data can be written (without

1743

1544

for cond, name in

1744

1545

condition_names.iteritems()

1745

1546

if cond & condition)

1746

# error, or the other end of multiprocessing.Pipe has closed

1547

# error or the other end of multiprocessing.Pipe has closed

1747

1548

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1748

# Wait for other process to exit

1749

proc.join()

1750

1549

return False

1751

1550

1752

1551

# Read a request from the child

1757

1556

fpr = request[1]

1758

1557

address = request[2]

1759

1558

1760

for c in self.clients.itervalues():

1559

for c in self.clients:

1761

1560

if c.fingerprint == fpr:

1762

1561

client = c

1763

1562

break

1764

1563

else:

1765

logger.info("Client not found for fingerprint: %s, ad"

1766

"dress: %s", fpr, address)

1564

logger.warning("Client not found for fingerprint: %s, ad"

1565

"dress: %s", fpr, address)

1767

1566

if self.use_dbus:

1768

1567

# Emit D-Bus signal

1769

mandos_dbus_service.ClientNotFound(fpr,

1770

address[0])

1568

mandos_dbus_service.ClientNotFound(fpr, address[0])

1771

1569

parent_pipe.send(False)

1772

1570

return False

1773

1571

1774

1572

gobject.io_add_watch(parent_pipe.fileno(),

1775

1573

gobject.IO_IN | gobject.IO_HUP,

1776

1574

functools.partial(self.handle_ipc,

1777

parent_pipe =

1778

parent_pipe,

1779

proc = proc,

1780

client_object =

1781

client))

1575

parent_pipe = parent_pipe,

1576

client_object = client))

1782

1577

parent_pipe.send(True)

1783

# remove the old hook in favor of the new above hook on

1784

# same fileno

1578

# remove the old hook in favor of the new above hook on same fileno

1785

1579

return False

1786

1580

if command == 'funcall':

1787

1581

funcname = request[1]

1788

1582

args = request[2]

1789

1583

kwargs = request[3]

1790

1584

1791

parent_pipe.send(('data', getattr(client_object,

1792

funcname)(*args,

1793

**kwargs)))

1794

1585

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1586

1795

1587

if command == 'getattr':

1796

1588

attrname = request[1]

1797

1589

if callable(client_object.__getattribute__(attrname)):

1798

1590

parent_pipe.send(('function',))

1799

1591

else:

1800

parent_pipe.send(('data', client_object

1801

.__getattribute__(attrname)))

1592

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1802

1593

1803

1594

if command == 'setattr':

1804

1595

attrname = request[1]

1805

1596

value = request[2]

1806

1597

setattr(client_object, attrname, value)

1807

1598

1808

1599

return True

1809

1600

1810

1601

1931

1722

" system bus interface")

1932

1723

parser.add_argument("--no-ipv6", action="store_false",

1933

1724

dest="use_ipv6", help="Do not use IPv6")

1934

parser.add_argument("--no-restore", action="store_false",

1935

dest="restore",

1936

help="Do not restore stored state",

1937

default=True)

1938

1939

1725

options = parser.parse_args()

1940

1726

1941

1727

if options.check:

1976

1762

# options, if set.

1977

1763

for option in ("interface", "address", "port", "debug",

1978

1764

"priority", "servicename", "configdir",

1979

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1765

"use_dbus", "use_ipv6", "debuglevel"):

1980

1766

value = getattr(options, option)

1981

1767

if value is not None:

1982

1768

server_settings[option] = value

1994

1780

debuglevel = server_settings["debuglevel"]

1995

1781

use_dbus = server_settings["use_dbus"]

1996

1782

use_ipv6 = server_settings["use_ipv6"]

1997

1783

1998

1784

if server_settings["servicename"] != "Mandos":

1999

1785

syslogger.setFormatter(logging.Formatter

2000

1786

('Mandos (%s) [%%(process)d]:'

2002

1788

% server_settings["servicename"]))

2003

1789

2004

1790

# Parse config file with clients

2005

client_defaults = { "timeout": "5m",

2006

"extended_timeout": "15m",

2007

"interval": "2m",

1791

client_defaults = { "timeout": "1h",

1792

"interval": "5m",

2008

1793

"checker": "fping -q -- %%(host)s",

2009

1794

"host": "",

2010

1795

"approval_delay": "0s",

2055

1840

raise error

2056

1841

2057

1842

if not debug and not debuglevel:

2058

logger.setLevel(logging.WARNING)

1843

syslogger.setLevel(logging.WARNING)

1844

console.setLevel(logging.WARNING)

2059

1845

if debuglevel:

2060

1846

level = getattr(logging, debuglevel.upper())

2061

logger.setLevel(level)

2062

1847

syslogger.setLevel(level)

1848

console.setLevel(level)

1849

2063

1850

if debug:

2064

logger.setLevel(logging.DEBUG)

2065

1851

# Enable all possible GnuTLS debugging

2066

1852

2067

1853

# "Use a log level over 10 to enable all debugging options."

2097

1883

# End of Avahi example code

2098

1884

if use_dbus:

2099

1885

try:

2100

bus_name = dbus.service.BusName("se.recompile.Mandos",

1886

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2101

1887

bus, do_not_queue=True)

2102

old_bus_name = (dbus.service.BusName

2103

("se.bsnet.fukt.Mandos", bus,

2104

do_not_queue=True))

2105

1888

except dbus.exceptions.NameExistsException as e:

2106

1889

logger.error(unicode(e) + ", disabling D-Bus")

2107

1890

use_dbus = False

2108

1891

server_settings["use_dbus"] = False

2109

1892

tcp_server.use_dbus = False

2110

1893

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2111

service = AvahiServiceToSyslog(name =

2112

server_settings["servicename"],

2113

servicetype = "_mandos._tcp",

2114

protocol = protocol, bus = bus)

1894

service = AvahiService(name = server_settings["servicename"],

1895

servicetype = "_mandos._tcp",

1896

protocol = protocol, bus = bus)

2115

1897

if server_settings["interface"]:

2116

1898

service.interface = (if_nametoindex

2117

1899

(str(server_settings["interface"])))

2121

1903

2122

1904

client_class = Client

2123

1905

if use_dbus:

2124

client_class = functools.partial(ClientDBusTransitional,

2125

bus = bus)

2126

2127

special_settings = {

2128

# Some settings need to be accessd by special methods;

2129

# booleans need .getboolean(), etc. Here is a list of them:

2130

"approved_by_default":

2131

lambda section:

2132

client_config.getboolean(section, "approved_by_default"),

2133

}

2134

# Construct a new dict of client settings of this form:

2135

# { client_name: {setting_name: value, ...}, ...}

2136

# with exceptions for any special settings as defined above

2137

client_settings = dict((clientname,

2138

dict((setting,

2139

(value if

2140

setting not in special_settings

2141

else special_settings[setting]

2142

(clientname)))

2143

for setting, value

2144

in client_config.items(clientname)))

2145

for clientname in client_config.sections())

2146

2147

old_client_settings = {}

2148

clients_data = []

2149

2150

# Get client data and settings from last running state.

2151

if server_settings["restore"]:

2152

try:

2153

with open(stored_state_path, "rb") as stored_state:

2154

clients_data, old_client_settings = (

2155

pickle.load(stored_state))

2156

os.remove(stored_state_path)

2157

except IOError as e:

2158

logger.warning("Could not load persistant state: {0}"

2159

.format(e))

2160

if e.errno != errno.ENOENT:

2161

raise

2162

2163

for client in clients_data:

2164

client_name = client["name"]

2165

2166

# Decide which value to use after restoring saved state.

2167

# We have three different values: Old config file,

2168

# new config file, and saved state.

2169

# New config value takes precedence if it differs from old

2170

# config value, otherwise use saved state.

2171

for name, value in client_settings[client_name].items():

1906

client_class = functools.partial(ClientDBus, bus = bus)

1907

def client_config_items(config, section):

1908

special_settings = {

1909

"approved_by_default":

1910

lambda: config.getboolean(section,

1911

"approved_by_default"),

1912

}

1913

for name, value in config.items(section):

2172

1914

try:

2173

# For each value in new config, check if it differs

2174

# from the old config value (Except for the "secret"

2175

# attribute)

2176

if (name != "secret" and

2177

value != old_client_settings[client_name][name]):

2178

setattr(client, name, value)

1915

yield (name, special_settings[name]())

2179

1916

except KeyError:

2180

pass

2181

2182

# Clients who has passed its expire date, can still be enabled

2183

# if its last checker was sucessful. Clients who checkers

2184

# failed before we stored it state is asumed to had failed

2185

# checker during downtime.

2186

if client["enabled"] and client["last_checked_ok"]:

2187

if ((datetime.datetime.utcnow()

2188

- client["last_checked_ok"]) > client["interval"]):

2189

if client["last_checker_status"] != 0:

2190

client["enabled"] = False

2191

else:

2192

client["expires"] = (datetime.datetime.utcnow()

2193

+ client["timeout"])

2194

2195

client["changedstate"] = (multiprocessing_manager

2196

.Condition(multiprocessing_manager

2197

.Lock()))

2198

if use_dbus:

2199

new_client = ClientDBusTransitional.__new__(

2200

ClientDBusTransitional)

2201

tcp_server.clients[client_name] = new_client

2202

new_client.bus = bus

2203

for name, value in client.iteritems():

2204

setattr(new_client, name, value)

2205

new_client._approvals_pending = 0

2206

new_client.add_to_dbus()

2207

else:

2208

tcp_server.clients[client_name] = Client.__new__(Client)

2209

for name, value in client.iteritems():

2210

setattr(tcp_server.clients[client_name], name, value)

2211

2212

tcp_server.clients[client_name].decrypt_secret(

2213

client_settings[client_name]["secret"])

2214

2215

# Create/remove clients based on new changes made to config

2216

for clientname in set(old_client_settings) - set(client_settings):

2217

del tcp_server.clients[clientname]

2218

for clientname in set(client_settings) - set(old_client_settings):

2219

tcp_server.clients[clientname] = client_class(name

2220

= clientname,

2221

config =

2222

client_settings

2223

[clientname])

1917

yield (name, value)

2224

1918

1919

tcp_server.clients.update(set(

1920

client_class(name = section,

1921

config= dict(client_config_items(

1922

client_config, section)))

1923

for section in client_config.sections()))

2225

1924

if not tcp_server.clients:

2226

1925

logger.warning("No clients defined")

2227

1926

2240

1939

del pidfilename

2241

1940

2242

1941

signal.signal(signal.SIGINT, signal.SIG_IGN)

2243

1942

2244

1943

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2245

1944

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2246

1945

2249

1948

"""A D-Bus proxy object"""

2250

1949

def __init__(self):

2251

1950

dbus.service.Object.__init__(self, bus, "/")

2252

_interface = "se.recompile.Mandos"

1951

_interface = "se.bsnet.fukt.Mandos"

2253

1952

2254

1953

@dbus.service.signal(_interface, signature="o")

2255

1954

def ClientAdded(self, objpath):

2270

1969

def GetAllClients(self):

2271

1970

"D-Bus method"

2272

1971

return dbus.Array(c.dbus_object_path

2273

for c in

2274

tcp_server.clients.itervalues())

1972

for c in tcp_server.clients)

2275

1973

2276

1974

@dbus.service.method(_interface,

2277

1975

out_signature="a{oa{sv}}")

2279

1977

"D-Bus method"

2280

1978

return dbus.Dictionary(

2281

1979

((c.dbus_object_path, c.GetAll(""))

2282

for c in tcp_server.clients.itervalues()),

1980

for c in tcp_server.clients),

2283

1981

signature="oa{sv}")

2284

1982

2285

1983

@dbus.service.method(_interface, in_signature="o")

2286

1984

def RemoveClient(self, object_path):

2287

1985

"D-Bus method"

2288

for c in tcp_server.clients.itervalues():

1986

for c in tcp_server.clients:

2289

1987

if c.dbus_object_path == object_path:

2290

del tcp_server.clients[c.name]

1988

tcp_server.clients.remove(c)

2291

1989

c.remove_from_connection()

2292

1990

# Don't signal anything except ClientRemoved

2293

1991

c.disable(quiet=True)

2298

1996

2299

1997

del _interface

2300

1998

2301

class MandosDBusServiceTransitional(MandosDBusService):

2302

__metaclass__ = AlternateDBusNamesMetaclass

2303

mandos_dbus_service = MandosDBusServiceTransitional()

1999

mandos_dbus_service = MandosDBusService()

2304

2000

2305

2001

def cleanup():

2306

2002

"Cleanup function; run on exit"

2307

2003

service.cleanup()

2308

2004

2309

multiprocessing.active_children()

2310

if not (tcp_server.clients or client_settings):

2311

return

2312

2313

# Store client before exiting. Secrets are encrypted with key

2314

# based on what config file has. If config file is

2315

# removed/edited, old secret will thus be unrecovable.

2316

clients = []

2317

for client in tcp_server.clients.itervalues():

2318

client.encrypt_secret(

2319

client_settings[client.name]["secret"])

2320

2321

client_dict = {}

2322

2323

# A list of attributes that will not be stored when

2324

# shutting down.

2325

exclude = set(("bus", "changedstate", "secret"))

2326

for name, typ in inspect.getmembers(dbus.service.Object):

2327

exclude.add(name)

2328

2329

client_dict["encrypted_secret"] = client.encrypted_secret

2330

for attr in client.client_structure:

2331

if attr not in exclude:

2332

client_dict[attr] = getattr(client, attr)

2333

2334

clients.append(client_dict)

2335

del client_settings[client.name]["secret"]

2336

2337

try:

2338

with os.fdopen(os.open(stored_state_path,

2339

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2340

stat.S_IRUSR | stat.S_IWUSR),

2341

"wb") as stored_state:

2342

pickle.dump((clients, client_settings), stored_state)

2343

except IOError as e:

2344

logger.warning("Could not save persistant state: {0}"

2345

.format(e))

2346

if e.errno != errno.ENOENT:

2347

raise

2348

2349

# Delete all clients, and settings from config

2350

2005

while tcp_server.clients:

2351

name, client = tcp_server.clients.popitem()

2006

client = tcp_server.clients.pop()

2352

2007

if use_dbus:

2353

2008

client.remove_from_connection()

2009

client.disable_hook = None

2354

2010

# Don't signal anything except ClientRemoved

2355

2011

client.disable(quiet=True)

2356

2012

if use_dbus:

2357

2013

# Emit D-Bus signal

2358

mandos_dbus_service.ClientRemoved(client

2359

.dbus_object_path,

2014

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2360

2015

client.name)

2361

client_settings.clear()

2362

2016

2363

2017

atexit.register(cleanup)

2364

2018

2365

for client in tcp_server.clients.itervalues():

2019

for client in tcp_server.clients:

2366

2020

if use_dbus:

2367

2021

# Emit D-Bus signal

2368

2022

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2369

# Need to initiate checking of clients

2370

if client.enabled:

2371

client.init_checker()

2372

2023

client.enable()

2373

2024

2374

2025

tcp_server.enable()

2375

2026

tcp_server.server_activate()

2415

2066

# Must run before the D-Bus bus name gets deregistered

2416

2067

cleanup()

2417

2068

2418

2419

2069

if __name__ == '__main__':

2420

2070

main()