/mandos/trunk : revision 482

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

64

62

import functools

65

63

import cPickle as pickle

66

64

import multiprocessing

67

import types

68

import binascii

69

import tempfile

70

import itertools

71

65

72

66

import dbus

73

67

import dbus.service

78

72

import ctypes.util

79

73

import xml.dom.minidom

80

74

import inspect

81

import GnuPGInterface

82

75

83

76

try:

84

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

88

81

except ImportError:

89

82

SO_BINDTODEVICE = None

90

83

91

version = "1.5.3"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

84

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

95

89

syslogger = (logging.handlers.SysLogHandler

96

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

91

address = str("/dev/log")))

98

99

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

def if_nametoindex(interface):

105

"Get an interface index the hard way, i.e. using fcntl()"

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

with contextlib.closing(socket.socket()) as s:

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

113

return interface_index

114

115

116

def initlogger(debug, level=logging.WARNING):

117

"""init logger and add loglevel"""

118

119

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

132

133

134

class PGPError(Exception):

135

"""Exception if encryption/decryption fails"""

136

pass

137

138

139

class PGPEngine(object):

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

151

def __enter__(self):

152

return self

153

154

def __exit__ (self, exc_type, exc_value, traceback):

155

self._cleanup()

156

return False

157

158

def __del__(self):

159

self._cleanup()

160

161

def _cleanup(self):

162

if self.tempdir is not None:

163

# Delete contents of tempdir

164

for root, dirs, files in os.walk(self.tempdir,

165

topdown = False):

166

for filename in files:

167

os.remove(os.path.join(root, filename))

168

for dirname in dirs:

169

os.rmdir(os.path.join(root, dirname))

170

# Remove tempdir

171

os.rmdir(self.tempdir)

172

self.tempdir = None

173

174

def password_encode(self, password):

175

# Passphrase can not be empty and can not contain newlines or

176

# NUL bytes. So we prefix it and hex encode it.

177

return b"mandos" + binascii.hexlify(password)

178

179

def encrypt(self, data, password):

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

194

return ciphertext

195

196

def decrypt(self, data, password):

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

211

return decrypted_plaintext

212

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

213

102

214

103

class AvahiError(Exception):

215

104

def __init__(self, value, *args, **kwargs):

245

134

server: D-Bus Server

246

135

bus: dbus.SystemBus()

247

136

"""

248

249

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

138

servicetype = None, port = None, TXT = None,

251

139

domain = "", host = "", max_renames = 32768,

264

152

self.server = None

265

153

self.bus = bus

266

154

self.entry_group_state_changed_match = None

267

268

155

def rename(self):

269

156

"""Derived from the Avahi example code"""

270

157

if self.rename_count >= self.max_renames:

272

159

" after %i retries, exiting.",

273

160

self.rename_count)

274

161

raise AvahiServiceError("Too many renames")

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

277

163

logger.info("Changing Zeroconf service name to %r ...",

278

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

279

169

self.remove()

280

170

try:

281

171

self.add()

282

172

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

173

logger.critical("DBusException: %s", error)

284

174

self.cleanup()

285

175

os._exit(1)

286

176

self.rename_count += 1

287

288

177

def remove(self):

289

178

"""Derived from the Avahi example code"""

179

if self.group is not None:

180

try:

181

self.group.Free()

182

except (dbus.exceptions.UnknownMethodException,

183

dbus.exceptions.DBusException) as e:

184

pass

185

self.group = None

290

186

if self.entry_group_state_changed_match is not None:

291

187

self.entry_group_state_changed_match.remove()

292

188

self.entry_group_state_changed_match = None

293

if self.group is not None:

294

self.group.Reset()

295

296

189

def add(self):

297

190

"""Derived from the Avahi example code"""

298

191

self.remove()

299

if self.group is None:

300

self.group = dbus.Interface(

301

self.bus.get_object(avahi.DBUS_NAME,

302

self.server.EntryGroupNew()),

303

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

self.group = dbus.Interface(

193

self.bus.get_object(avahi.DBUS_NAME,

194

self.server.EntryGroupNew(),

195

follow_name_owner_changes=True),

196

avahi.DBUS_INTERFACE_ENTRY_GROUP)

304

197

self.entry_group_state_changed_match = (

305

198

self.group.connect_to_signal(

306

'StateChanged', self.entry_group_state_changed))

199

'StateChanged', self .entry_group_state_changed))

307

200

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

308

201

self.name, self.type)

309

202

self.group.AddService(

315

208

dbus.UInt16(self.port),

316

209

avahi.string_array_to_txt_array(self.TXT))

317

210

self.group.Commit()

318

319

211

def entry_group_state_changed(self, state, error):

320

212

"""Derived from the Avahi example code"""

321

213

logger.debug("Avahi entry group state change: %i", state)

328

220

elif state == avahi.ENTRY_GROUP_FAILURE:

329

221

logger.critical("Avahi: Error in group state changed %s",

330

222

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

223

raise AvahiGroupError("State changed: %s"

224

% unicode(error))

334

225

def cleanup(self):

335

226

"""Derived from the Avahi example code"""

336

if self.group is not None:

337

try:

338

self.group.Free()

339

except (dbus.exceptions.UnknownMethodException,

340

dbus.exceptions.DBusException):

341

pass

342

self.group = None

343

227

self.remove()

344

345

228

def server_state_changed(self, state, error=None):

346

229

"""Derived from the Avahi example code"""

347

230

logger.debug("Avahi server state change: %i", state)

353

236

avahi.SERVER_FAILURE:

354

237

"Zeroconf server failure" }

355

238

if state in bad_states:

356

if bad_states[state] is not None:

357

if error is None:

358

logger.error(bad_states[state])

359

else:

360

logger.error(bad_states[state] + ": %r", error)

361

self.cleanup()

239

if bad_states[state]:

240

logger.error(bad_states[state])

241

self.remove()

362

242

elif state == avahi.SERVER_RUNNING:

363

243

self.add()

364

244

else:

365

if error is None:

366

logger.debug("Unknown state: %r", state)

367

else:

368

logger.debug("Unknown state: %r: %r", state, error)

369

245

logger.debug("Unknown state: %r", state)

370

246

def activate(self):

371

247

"""Derived from the Avahi example code"""

372

248

if self.server is None:

379

255

self.server_state_changed)

380

256

self.server_state_changed(self.server.GetState())

381

257

382

class AvahiServiceToSyslog(AvahiService):

383

def rename(self):

384

"""Add the new name to the syslog messages"""

385

ret = AvahiService.rename(self)

386

syslogger.setFormatter(logging.Formatter

387

('Mandos ({0}) [%(process)d]:'

388

' %(levelname)s: %(message)s'

389

.format(self.name)))

390

return ret

391

392

def timedelta_to_milliseconds(td):

393

"Convert a datetime.timedelta() to milliseconds"

394

return ((td.days * 24 * 60 * 60 * 1000)

395

+ (td.seconds * 1000)

396

+ (td.microseconds // 1000))

397

258

398

259

class Client(object):

399

260

"""A representation of a client host served by this server.

400

261

401

262

Attributes:

402

approved: bool(); 'None' if not yet approved/disapproved

263

_approved: bool(); 'None' if not yet approved/disapproved

403

264

approval_delay: datetime.timedelta(); Time to wait for approval

404

265

approval_duration: datetime.timedelta(); Duration of one approval

405

266

checker: subprocess.Popen(); a running checker process used

412

273

instance %(name)s can be used in the command.

413

274

checker_initiator_tag: a gobject event source tag, or None

414

275

created: datetime.datetime(); (UTC) object creation

415

client_structure: Object describing what attributes a client has

416

and is used for storing the client at exit

417

276

current_checker_command: string; current running checker_command

277

disable_hook: If set, called by disable() as disable_hook(self)

418

278

disable_initiator_tag: a gobject event source tag, or None

419

279

enabled: bool()

420

280

fingerprint: string (40 or 32 hexadecimal digits); used to

423

283

interval: datetime.timedelta(); How often to start a new checker

424

284

last_approval_request: datetime.datetime(); (UTC) or None

425

285

last_checked_ok: datetime.datetime(); (UTC) or None

426

last_checker_status: integer between 0 and 255 reflecting exit

427

status of last checker. -1 reflects crashed

428

checker, -2 means no checker completed yet.

429

last_enabled: datetime.datetime(); (UTC) or None

286

last_enabled: datetime.datetime(); (UTC)

430

287

name: string; from the config file, used in log messages and

431

288

D-Bus identifiers

432

289

secret: bytestring; sent verbatim (over TLS) to client

433

290

timeout: datetime.timedelta(); How long from last_checked_ok

434

291

until this client is disabled

435

extended_timeout: extra long timeout when secret has been sent

436

292

runtime_expansions: Allowed attributes for runtime expansion.

437

expires: datetime.datetime(); time (UTC) when a client will be

438

disabled, or None

439

293

"""

440

294

441

295

runtime_expansions = ("approval_delay", "approval_duration",

442

296

"created", "enabled", "fingerprint",

443

297

"host", "interval", "last_checked_ok",

444

298

"last_enabled", "name", "timeout")

445

client_defaults = { "timeout": "5m",

446

"extended_timeout": "15m",

447

"interval": "2m",

448

"checker": "fping -q -- %%(host)s",

449

"host": "",

450

"approval_delay": "0s",

451

"approval_duration": "1s",

452

"approved_by_default": "True",

453

"enabled": "True",

454

}

299

300

@staticmethod

301

def _timedelta_to_milliseconds(td):

302

"Convert a datetime.timedelta() to milliseconds"

303

return ((td.days * 24 * 60 * 60 * 1000)

304

+ (td.seconds * 1000)

305

+ (td.microseconds // 1000))

455

306

456

307

def timeout_milliseconds(self):

457

308

"Return the 'timeout' attribute in milliseconds"

458

return timedelta_to_milliseconds(self.timeout)

459

460

def extended_timeout_milliseconds(self):

461

"Return the 'extended_timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.extended_timeout)

309

return self._timedelta_to_milliseconds(self.timeout)

463

310

464

311

def interval_milliseconds(self):

465

312

"Return the 'interval' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.interval)

467

313

return self._timedelta_to_milliseconds(self.interval)

314

468

315

def approval_delay_milliseconds(self):

469

return timedelta_to_milliseconds(self.approval_delay)

470

471

@staticmethod

472

def config_parser(config):

473

"""Construct a new dict of client settings of this form:

474

{ client_name: {setting_name: value, ...}, ...}

475

with exceptions for any special settings as defined above.

476

NOTE: Must be a pure function. Must return the same result

477

value given the same arguments.

478

"""

479

settings = {}

480

for client_name in config.sections():

481

section = dict(config.items(client_name))

482

client = settings[client_name] = {}

483

484

client["host"] = section["host"]

485

# Reformat values from string types to Python types

486

client["approved_by_default"] = config.getboolean(

487

client_name, "approved_by_default")

488

client["enabled"] = config.getboolean(client_name,

489

"enabled")

490

491

client["fingerprint"] = (section["fingerprint"].upper()

492

.replace(" ", ""))

493

if "secret" in section:

494

client["secret"] = section["secret"].decode("base64")

495

elif "secfile" in section:

496

with open(os.path.expanduser(os.path.expandvars

497

(section["secfile"])),

498

"rb") as secfile:

499

client["secret"] = secfile.read()

500

else:

501

raise TypeError("No secret or secfile for section {0}"

502

.format(section))

503

client["timeout"] = string_to_delta(section["timeout"])

504

client["extended_timeout"] = string_to_delta(

505

section["extended_timeout"])

506

client["interval"] = string_to_delta(section["interval"])

507

client["approval_delay"] = string_to_delta(

508

section["approval_delay"])

509

client["approval_duration"] = string_to_delta(

510

section["approval_duration"])

511

client["checker_command"] = section["checker"]

512

client["last_approval_request"] = None

513

client["last_checked_ok"] = None

514

client["last_checker_status"] = -2

515

516

return settings

517

518

def __init__(self, settings, name = None):

316

return self._timedelta_to_milliseconds(self.approval_delay)

317

318

def __init__(self, name = None, disable_hook=None, config=None):

319

"""Note: the 'checker' key in 'config' sets the

320

'checker_command' attribute and *not* the 'checker'

321

attribute."""

519

322

self.name = name

520

# adding all client settings

521

for setting, value in settings.iteritems():

522

setattr(self, setting, value)

523

524

if self.enabled:

525

if not hasattr(self, "last_enabled"):

526

self.last_enabled = datetime.datetime.utcnow()

527

if not hasattr(self, "expires"):

528

self.expires = (datetime.datetime.utcnow()

529

+ self.timeout)

530

else:

531

self.last_enabled = None

532

self.expires = None

533

323

if config is None:

324

config = {}

534

325

logger.debug("Creating client %r", self.name)

535

326

# Uppercase and remove spaces from fingerprint for later

536

327

# comparison purposes with return value from the fingerprint()

537

328

# function

329

self.fingerprint = (config["fingerprint"].upper()

330

.replace(" ", ""))

538

331

logger.debug(" Fingerprint: %s", self.fingerprint)

539

self.created = settings.get("created",

540

datetime.datetime.utcnow())

541

542

# attributes specific for this server instance

332

if "secret" in config:

333

self.secret = config["secret"].decode("base64")

334

elif "secfile" in config:

335

with open(os.path.expanduser(os.path.expandvars

336

(config["secfile"])),

337

"rb") as secfile:

338

self.secret = secfile.read()

339

else:

340

raise TypeError("No secret or secfile for client %s"

341

% self.name)

342

self.host = config.get("host", "")

343

self.created = datetime.datetime.utcnow()

344

self.enabled = False

345

self.last_approval_request = None

346

self.last_enabled = None

347

self.last_checked_ok = None

348

self.timeout = string_to_delta(config["timeout"])

349

self.interval = string_to_delta(config["interval"])

350

self.disable_hook = disable_hook

543

351

self.checker = None

544

352

self.checker_initiator_tag = None

545

353

self.disable_initiator_tag = None

546

354

self.checker_callback_tag = None

355

self.checker_command = config["checker"]

547

356

self.current_checker_command = None

548

self.approved = None

357

self.last_connect = None

358

self._approved = None

359

self.approved_by_default = config.get("approved_by_default",

360

True)

549

361

self.approvals_pending = 0

550

self.changedstate = (multiprocessing_manager

551

.Condition(multiprocessing_manager

552

.Lock()))

553

self.client_structure = [attr for attr in

554

self.__dict__.iterkeys()

555

if not attr.startswith("_")]

556

self.client_structure.append("client_structure")

557

558

for name, t in inspect.getmembers(type(self),

559

lambda obj:

560

isinstance(obj,

561

property)):

562

if not name.startswith("_"):

563

self.client_structure.append(name)

362

self.approval_delay = string_to_delta(

363

config["approval_delay"])

364

self.approval_duration = string_to_delta(

365

config["approval_duration"])

366

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

564

367

565

# Send notice to process children that client state has changed

566

368

def send_changedstate(self):

567

with self.changedstate:

568

self.changedstate.notify_all()

569

369

self.changedstate.acquire()

370

self.changedstate.notify_all()

371

self.changedstate.release()

372

570

373

def enable(self):

571

374

"""Start this client's checker and timeout hooks"""

572

375

if getattr(self, "enabled", False):

573

376

# Already enabled

574

377

return

575

self.expires = datetime.datetime.utcnow() + self.timeout

576

self.enabled = True

378

self.send_changedstate()

577

379

self.last_enabled = datetime.datetime.utcnow()

578

self.init_checker()

579

self.send_changedstate()

580

581

def disable(self, quiet=True):

582

"""Disable this client."""

583

if not getattr(self, "enabled", False):

584

return False

585

if not quiet:

586

logger.info("Disabling client %s", self.name)

587

if getattr(self, "disable_initiator_tag", None) is not None:

588

gobject.source_remove(self.disable_initiator_tag)

589

self.disable_initiator_tag = None

590

self.expires = None

591

if getattr(self, "checker_initiator_tag", None) is not None:

592

gobject.source_remove(self.checker_initiator_tag)

593

self.checker_initiator_tag = None

594

self.stop_checker()

595

self.enabled = False

596

if not quiet:

597

self.send_changedstate()

598

# Do not run this again if called by a gobject.timeout_add

599

return False

600

601

def __del__(self):

602

self.disable()

603

604

def init_checker(self):

605

380

# Schedule a new checker to be started an 'interval' from now,

606

381

# and every interval from then on.

607

if self.checker_initiator_tag is not None:

608

gobject.source_remove(self.checker_initiator_tag)

609

382

self.checker_initiator_tag = (gobject.timeout_add

610

383

(self.interval_milliseconds(),

611

384

self.start_checker))

612

385

# Schedule a disable() when 'timeout' has passed

613

if self.disable_initiator_tag is not None:

614

gobject.source_remove(self.disable_initiator_tag)

615

386

self.disable_initiator_tag = (gobject.timeout_add

616

387

(self.timeout_milliseconds(),

617

388

self.disable))

389

self.enabled = True

618

390

# Also start a new checker *right now*.

619

391

self.start_checker()

620

392

393

def disable(self, quiet=True):

394

"""Disable this client."""

395

if not getattr(self, "enabled", False):

396

return False

397

if not quiet:

398

self.send_changedstate()

399

if not quiet:

400

logger.info("Disabling client %s", self.name)

401

if getattr(self, "disable_initiator_tag", False):

402

gobject.source_remove(self.disable_initiator_tag)

403

self.disable_initiator_tag = None

404

if getattr(self, "checker_initiator_tag", False):

405

gobject.source_remove(self.checker_initiator_tag)

406

self.checker_initiator_tag = None

407

self.stop_checker()

408

if self.disable_hook:

409

self.disable_hook(self)

410

self.enabled = False

411

# Do not run this again if called by a gobject.timeout_add

412

return False

413

414

def __del__(self):

415

self.disable_hook = None

416

self.disable()

417

621

418

def checker_callback(self, pid, condition, command):

622

419

"""The checker has completed, so take appropriate actions."""

623

420

self.checker_callback_tag = None

624

421

self.checker = None

625

422

if os.WIFEXITED(condition):

626

self.last_checker_status = os.WEXITSTATUS(condition)

627

if self.last_checker_status == 0:

423

exitstatus = os.WEXITSTATUS(condition)

424

if exitstatus == 0:

628

425

logger.info("Checker for %(name)s succeeded",

629

426

vars(self))

630

427

self.checked_ok()

632

429

logger.info("Checker for %(name)s failed",

633

430

vars(self))

634

431

else:

635

self.last_checker_status = -1

636

432

logger.warning("Checker for %(name)s crashed?",

637

433

vars(self))

638

434

639

435

def checked_ok(self):

640

"""Assert that the client has been seen, alive and well."""

436

"""Bump up the timeout for this client.

437

438

This should only be called when the client has been seen,

439

alive and well.

440

"""

641

441

self.last_checked_ok = datetime.datetime.utcnow()

642

self.last_checker_status = 0

643

self.bump_timeout()

644

645

def bump_timeout(self, timeout=None):

646

"""Bump up the timeout for this client."""

647

if timeout is None:

648

timeout = self.timeout

649

if self.disable_initiator_tag is not None:

650

gobject.source_remove(self.disable_initiator_tag)

651

self.disable_initiator_tag = None

652

if getattr(self, "enabled", False):

653

self.disable_initiator_tag = (gobject.timeout_add

654

(timedelta_to_milliseconds

655

(timeout), self.disable))

656

self.expires = datetime.datetime.utcnow() + timeout

442

gobject.source_remove(self.disable_initiator_tag)

443

self.disable_initiator_tag = (gobject.timeout_add

444

(self.timeout_milliseconds(),

445

self.disable))

657

446

658

447

def need_approval(self):

659

448

self.last_approval_request = datetime.datetime.utcnow()

664

453

If a checker already exists, leave it running and do

665

454

nothing."""

666

455

# The reason for not killing a running checker is that if we

667

# did that, and if a checker (for some reason) started running

668

# slowly and taking more than 'interval' time, then the client

669

# would inevitably timeout, since no checker would get a

670

# chance to run to completion. If we instead leave running

456

# did that, then if a checker (for some reason) started

457

# running slowly and taking more than 'interval' time, the

458

# client would inevitably timeout, since no checker would get

459

# a chance to run to completion. If we instead leave running

671

460

# checkers alone, the checker would have to take more time

672

461

# than 'timeout' for the client to be disabled, which is as it

673

462

# should be.

699

488

'replace')))

700

489

for attr in

701

490

self.runtime_expansions)

702

491

703

492

try:

704

493

command = self.checker_command % escaped_attrs

705

494

except TypeError as error:

706

logger.error('Could not format string "%s"',

707

self.checker_command, exc_info=error)

495

logger.error('Could not format string "%s":'

496

' %s', self.checker_command, error)

708

497

return True # Try again later

709

498

self.current_checker_command = command

710

499

try:

728

517

gobject.source_remove(self.checker_callback_tag)

729

518

self.checker_callback(pid, status, command)

730

519

except OSError as error:

731

logger.error("Failed to start subprocess",

732

exc_info=error)

520

logger.error("Failed to start subprocess: %s",

521

error)

733

522

# Re-run this periodically if run by gobject.timeout_add

734

523

return True

735

524

742

531

return

743

532

logger.debug("Stopping checker for %(name)s", vars(self))

744

533

try:

745

self.checker.terminate()

534

os.kill(self.checker.pid, signal.SIGTERM)

746

535

#time.sleep(0.5)

747

536

#if self.checker.poll() is None:

748

# self.checker.kill()

537

# os.kill(self.checker.pid, signal.SIGKILL)

749

538

except OSError as error:

750

539

if error.errno != errno.ESRCH: # No such process

751

540

raise

752

541

self.checker = None

753

542

754

755

543

def dbus_service_property(dbus_interface, signature="v",

756

544

access="readwrite", byte_arrays=False):

757

545

"""Decorators for marking methods of a DBusObjectWithProperties to

768

556

# "Set" method, so we fail early here:

769

557

if byte_arrays and signature != "ay":

770

558

raise ValueError("Byte arrays not supported for non-'ay'"

771

" signature {0!r}".format(signature))

559

" signature %r" % signature)

772

560

def decorator(func):

773

561

func._dbus_is_property = True

774

562

func._dbus_interface = dbus_interface

782

570

return decorator

783

571

784

572

785

def dbus_interface_annotations(dbus_interface):

786

"""Decorator for marking functions returning interface annotations

787

788

Usage:

789

790

@dbus_interface_annotations("org.example.Interface")

791

def _foo(self): # Function name does not matter

792

return {"org.freedesktop.DBus.Deprecated": "true",

793

"org.freedesktop.DBus.Property.EmitsChangedSignal":

794

"false"}

795

"""

796

def decorator(func):

797

func._dbus_is_interface = True

798

func._dbus_interface = dbus_interface

799

func._dbus_name = dbus_interface

800

return func

801

return decorator

802

803

804

def dbus_annotations(annotations):

805

"""Decorator to annotate D-Bus methods, signals or properties

806

Usage:

807

808

@dbus_service_property("org.example.Interface", signature="b",

809

access="r")

810

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

811

"org.freedesktop.DBus.Property."

812

"EmitsChangedSignal": "false"})

813

def Property_dbus_property(self):

814

return dbus.Boolean(False)

815

"""

816

def decorator(func):

817

func._dbus_annotations = annotations

818

return func

819

return decorator

820

821

822

573

class DBusPropertyException(dbus.exceptions.DBusException):

823

574

"""A base class for D-Bus property-related exceptions

824

575

"""

840

591

841

592

class DBusObjectWithProperties(dbus.service.Object):

842

593

"""A D-Bus object with properties.

843

594

844

595

Classes inheriting from this can use the dbus_service_property

845

596

decorator to expose methods as D-Bus properties. It exposes the

846

597

standard Get(), Set(), and GetAll() methods on the D-Bus.

847

598

"""

848

599

849

600

@staticmethod

850

def _is_dbus_thing(thing):

851

"""Returns a function testing if an attribute is a D-Bus thing

852

853

If called like _is_dbus_thing("method") it returns a function

854

suitable for use as predicate to inspect.getmembers().

855

"""

856

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

857

False)

601

def _is_dbus_property(obj):

602

return getattr(obj, "_dbus_is_property", False)

858

603

859

def _get_all_dbus_things(self, thing):

604

def _get_all_dbus_properties(self):

860

605

"""Returns a generator of (name, attribute) pairs

861

606

"""

862

return ((getattr(athing.__get__(self), "_dbus_name",

863

name),

864

athing.__get__(self))

865

for cls in self.__class__.__mro__

866

for name, athing in

867

inspect.getmembers(cls,

868

self._is_dbus_thing(thing)))

607

return ((prop._dbus_name, prop)

608

for name, prop in

609

inspect.getmembers(self, self._is_dbus_property))

869

610

870

611

def _get_dbus_property(self, interface_name, property_name):

871

612

"""Returns a bound method if one exists which is a D-Bus

872

613

property with the specified name and interface.

873

614

"""

874

for cls in self.__class__.__mro__:

875

for name, value in (inspect.getmembers

876

(cls,

877

self._is_dbus_thing("property"))):

878

if (value._dbus_name == property_name

879

and value._dbus_interface == interface_name):

880

return value.__get__(self)

881

615

for name in (property_name,

616

property_name + "_dbus_property"):

617

prop = getattr(self, name, None)

618

if (prop is None

619

or not self._is_dbus_property(prop)

620

or prop._dbus_name != property_name

621

or (interface_name and prop._dbus_interface

622

and interface_name != prop._dbus_interface)):

623

continue

624

return prop

882

625

# No such property

883

626

raise DBusPropertyNotFound(self.dbus_object_path + ":"

884

627

+ interface_name + "."

909

652

# signatures other than "ay".

910

653

if prop._dbus_signature != "ay":

911

654

raise ValueError

912

value = dbus.ByteArray(b''.join(chr(byte)

913

for byte in value))

655

value = dbus.ByteArray(''.join(unichr(byte)

656

for byte in value))

914

657

prop(value)

915

658

916

659

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

918

661

def GetAll(self, interface_name):

919

662

"""Standard D-Bus property GetAll() method, see D-Bus

920

663

standard.

921

664

922

665

Note: Will not include properties with access="write".

923

666

"""

924

properties = {}

925

for name, prop in self._get_all_dbus_things("property"):

667

all = {}

668

for name, prop in self._get_all_dbus_properties():

926

669

if (interface_name

927

670

and interface_name != prop._dbus_interface):

928

671

# Interface non-empty but did not match

932

675

continue

933

676

value = prop()

934

677

if not hasattr(value, "variant_level"):

935

properties[name] = value

678

all[name] = value

936

679

continue

937

properties[name] = type(value)(value, variant_level=

938

value.variant_level+1)

939

return dbus.Dictionary(properties, signature="sv")

680

all[name] = type(value)(value, variant_level=

681

value.variant_level+1)

682

return dbus.Dictionary(all, signature="sv")

940

683

941

684

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

942

685

out_signature="s",

943

686

path_keyword='object_path',

944

687

connection_keyword='connection')

945

688

def Introspect(self, object_path, connection):

946

"""Overloading of standard D-Bus method.

947

948

Inserts property tags and interface annotation tags.

689

"""Standard D-Bus method, overloaded to insert property tags.

949

690

"""

950

691

xmlstring = dbus.service.Object.Introspect(self, object_path,

951

692

connection)

958

699

e.setAttribute("access", prop._dbus_access)

959

700

return e

960

701

for if_tag in document.getElementsByTagName("interface"):

961

# Add property tags

962

702

for tag in (make_tag(document, name, prop)

963

703

for name, prop

964

in self._get_all_dbus_things("property")

704

in self._get_all_dbus_properties()

965

705

if prop._dbus_interface

966

706

== if_tag.getAttribute("name")):

967

707

if_tag.appendChild(tag)

968

# Add annotation tags

969

for typ in ("method", "signal", "property"):

970

for tag in if_tag.getElementsByTagName(typ):

971

annots = dict()

972

for name, prop in (self.

973

_get_all_dbus_things(typ)):

974

if (name == tag.getAttribute("name")

975

and prop._dbus_interface

976

== if_tag.getAttribute("name")):

977

annots.update(getattr

978

(prop,

979

"_dbus_annotations",

980

{}))

981

for name, value in annots.iteritems():

982

ann_tag = document.createElement(

983

"annotation")

984

ann_tag.setAttribute("name", name)

985

ann_tag.setAttribute("value", value)

986

tag.appendChild(ann_tag)

987

# Add interface annotation tags

988

for annotation, value in dict(

989

itertools.chain.from_iterable(

990

annotations().iteritems()

991

for name, annotations in

992

self._get_all_dbus_things("interface")

993

if name == if_tag.getAttribute("name")

994

)).iteritems():

995

ann_tag = document.createElement("annotation")

996

ann_tag.setAttribute("name", annotation)

997

ann_tag.setAttribute("value", value)

998

if_tag.appendChild(ann_tag)

999

708

# Add the names to the return values for the

1000

709

# "org.freedesktop.DBus.Properties" methods

1001

710

if (if_tag.getAttribute("name")

1016

725

except (AttributeError, xml.dom.DOMException,

1017

726

xml.parsers.expat.ExpatError) as error:

1018

727

logger.error("Failed to override Introspection method",

1019

exc_info=error)

728

error)

1020

729

return xmlstring

1021

730

1022

731

1023

def datetime_to_dbus (dt, variant_level=0):

1024

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1025

if dt is None:

1026

return dbus.String("", variant_level = variant_level)

1027

return dbus.String(dt.isoformat(),

1028

variant_level=variant_level)

1029

1030

1031

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1032

"""A class decorator; applied to a subclass of

1033

dbus.service.Object, it will add alternate D-Bus attributes with

1034

interface names according to the "alt_interface_names" mapping.

1035

Usage:

1036

1037

@alternate_dbus_names({"org.example.Interface":

1038

"net.example.AlternateInterface"})

1039

class SampleDBusObject(dbus.service.Object):

1040

@dbus.service.method("org.example.Interface")

1041

def SampleDBusMethod():

1042

pass

1043

1044

The above "SampleDBusMethod" on "SampleDBusObject" will be

1045

reachable via two interfaces: "org.example.Interface" and

1046

"net.example.AlternateInterface", the latter of which will have

1047

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1048

"true", unless "deprecate" is passed with a False value.

1049

1050

This works for methods and signals, and also for D-Bus properties

1051

(from DBusObjectWithProperties) and interfaces (from the

1052

dbus_interface_annotations decorator).

1053

"""

1054

def wrapper(cls):

1055

for orig_interface_name, alt_interface_name in (

1056

alt_interface_names.iteritems()):

1057

attr = {}

1058

interface_names = set()

1059

# Go though all attributes of the class

1060

for attrname, attribute in inspect.getmembers(cls):

1061

# Ignore non-D-Bus attributes, and D-Bus attributes

1062

# with the wrong interface name

1063

if (not hasattr(attribute, "_dbus_interface")

1064

or not attribute._dbus_interface

1065

.startswith(orig_interface_name)):

1066

continue

1067

# Create an alternate D-Bus interface name based on

1068

# the current name

1069

alt_interface = (attribute._dbus_interface

1070

.replace(orig_interface_name,

1071

alt_interface_name))

1072

interface_names.add(alt_interface)

1073

# Is this a D-Bus signal?

1074

if getattr(attribute, "_dbus_is_signal", False):

1075

# Extract the original non-method function by

1076

# black magic

1077

nonmethod_func = (dict(

1078

zip(attribute.func_code.co_freevars,

1079

attribute.__closure__))["func"]

1080

.cell_contents)

1081

# Create a new, but exactly alike, function

1082

# object, and decorate it to be a new D-Bus signal

1083

# with the alternate D-Bus interface name

1084

new_function = (dbus.service.signal

1085

(alt_interface,

1086

attribute._dbus_signature)

1087

(types.FunctionType(

1088

nonmethod_func.func_code,

1089

nonmethod_func.func_globals,

1090

nonmethod_func.func_name,

1091

nonmethod_func.func_defaults,

1092

nonmethod_func.func_closure)))

1093

# Copy annotations, if any

1094

try:

1095

new_function._dbus_annotations = (

1096

dict(attribute._dbus_annotations))

1097

except AttributeError:

1098

pass

1099

# Define a creator of a function to call both the

1100

# original and alternate functions, so both the

1101

# original and alternate signals gets sent when

1102

# the function is called

1103

def fixscope(func1, func2):

1104

"""This function is a scope container to pass

1105

func1 and func2 to the "call_both" function

1106

outside of its arguments"""

1107

def call_both(*args, **kwargs):

1108

"""This function will emit two D-Bus

1109

signals by calling func1 and func2"""

1110

func1(*args, **kwargs)

1111

func2(*args, **kwargs)

1112

return call_both

1113

# Create the "call_both" function and add it to

1114

# the class

1115

attr[attrname] = fixscope(attribute, new_function)

1116

# Is this a D-Bus method?

1117

elif getattr(attribute, "_dbus_is_method", False):

1118

# Create a new, but exactly alike, function

1119

# object. Decorate it to be a new D-Bus method

1120

# with the alternate D-Bus interface name. Add it

1121

# to the class.

1122

attr[attrname] = (dbus.service.method

1123

(alt_interface,

1124

attribute._dbus_in_signature,

1125

attribute._dbus_out_signature)

1126

(types.FunctionType

1127

(attribute.func_code,

1128

attribute.func_globals,

1129

attribute.func_name,

1130

attribute.func_defaults,

1131

attribute.func_closure)))

1132

# Copy annotations, if any

1133

try:

1134

attr[attrname]._dbus_annotations = (

1135

dict(attribute._dbus_annotations))

1136

except AttributeError:

1137

pass

1138

# Is this a D-Bus property?

1139

elif getattr(attribute, "_dbus_is_property", False):

1140

# Create a new, but exactly alike, function

1141

# object, and decorate it to be a new D-Bus

1142

# property with the alternate D-Bus interface

1143

# name. Add it to the class.

1144

attr[attrname] = (dbus_service_property

1145

(alt_interface,

1146

attribute._dbus_signature,

1147

attribute._dbus_access,

1148

attribute

1149

._dbus_get_args_options

1150

["byte_arrays"])

1151

(types.FunctionType

1152

(attribute.func_code,

1153

attribute.func_globals,

1154

attribute.func_name,

1155

attribute.func_defaults,

1156

attribute.func_closure)))

1157

# Copy annotations, if any

1158

try:

1159

attr[attrname]._dbus_annotations = (

1160

dict(attribute._dbus_annotations))

1161

except AttributeError:

1162

pass

1163

# Is this a D-Bus interface?

1164

elif getattr(attribute, "_dbus_is_interface", False):

1165

# Create a new, but exactly alike, function

1166

# object. Decorate it to be a new D-Bus interface

1167

# with the alternate D-Bus interface name. Add it

1168

# to the class.

1169

attr[attrname] = (dbus_interface_annotations

1170

(alt_interface)

1171

(types.FunctionType

1172

(attribute.func_code,

1173

attribute.func_globals,

1174

attribute.func_name,

1175

attribute.func_defaults,

1176

attribute.func_closure)))

1177

if deprecate:

1178

# Deprecate all alternate interfaces

1179

iname="_AlternateDBusNames_interface_annotation{0}"

1180

for interface_name in interface_names:

1181

@dbus_interface_annotations(interface_name)

1182

def func(self):

1183

return { "org.freedesktop.DBus.Deprecated":

1184

"true" }

1185

# Find an unused name

1186

for aname in (iname.format(i)

1187

for i in itertools.count()):

1188

if aname not in attr:

1189

attr[aname] = func

1190

break

1191

if interface_names:

1192

# Replace the class with a new subclass of it with

1193

# methods, signals, etc. as created above.

1194

cls = type(b"{0}Alternate".format(cls.__name__),

1195

(cls,), attr)

1196

return cls

1197

return wrapper

1198

1199

1200

@alternate_dbus_interfaces({"se.recompile.Mandos":

1201

"se.bsnet.fukt.Mandos"})

1202

732

class ClientDBus(Client, DBusObjectWithProperties):

1203

733

"""A Client class using D-Bus

1204

734

1213

743

# dbus.service.Object doesn't use super(), so we can't either.

1214

744

1215

745

def __init__(self, bus = None, *args, **kwargs):

746

self._approvals_pending = 0

1216

747

self.bus = bus

1217

748

Client.__init__(self, *args, **kwargs)

1218

749

# Only now, when this client is initialized, can it show up on

1224

755

("/clients/" + client_object_name))

1225

756

DBusObjectWithProperties.__init__(self, self.bus,

1226

757

self.dbus_object_path)

1227

1228

def notifychangeproperty(transform_func,

1229

dbus_name, type_func=lambda x: x,

1230

variant_level=1):

1231

""" Modify a variable so that it's a property which announces

1232

its changes to DBus.

1233

1234

transform_fun: Function that takes a value and a variant_level

1235

and transforms it to a D-Bus type.

1236

dbus_name: D-Bus name of the variable

1237

type_func: Function that transform the value before sending it

1238

to the D-Bus. Default: no transform

1239

variant_level: D-Bus variant level. Default: 1

1240

"""

1241

attrname = "_{0}".format(dbus_name)

1242

def setter(self, value):

1243

if hasattr(self, "dbus_object_path"):

1244

if (not hasattr(self, attrname) or

1245

type_func(getattr(self, attrname, None))

1246

!= type_func(value)):

1247

dbus_value = transform_func(type_func(value),

1248

variant_level

1249

=variant_level)

1250

self.PropertyChanged(dbus.String(dbus_name),

1251

dbus_value)

1252

setattr(self, attrname, value)

1253

1254

return property(lambda self: getattr(self, attrname), setter)

1255

1256

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1257

approvals_pending = notifychangeproperty(dbus.Boolean,

1258

"ApprovalPending",

1259

type_func = bool)

1260

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1261

last_enabled = notifychangeproperty(datetime_to_dbus,

1262

"LastEnabled")

1263

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1264

type_func = lambda checker:

1265

checker is not None)

1266

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1267

"LastCheckedOK")

1268

last_checker_status = notifychangeproperty(dbus.Int16,

1269

"LastCheckerStatus")

1270

last_approval_request = notifychangeproperty(

1271

datetime_to_dbus, "LastApprovalRequest")

1272

approved_by_default = notifychangeproperty(dbus.Boolean,

1273

"ApprovedByDefault")

1274

approval_delay = notifychangeproperty(dbus.UInt64,

1275

"ApprovalDelay",

1276

type_func =

1277

timedelta_to_milliseconds)

1278

approval_duration = notifychangeproperty(

1279

dbus.UInt64, "ApprovalDuration",

1280

type_func = timedelta_to_milliseconds)

1281

host = notifychangeproperty(dbus.String, "Host")

1282

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1283

type_func =

1284

timedelta_to_milliseconds)

1285

extended_timeout = notifychangeproperty(

1286

dbus.UInt64, "ExtendedTimeout",

1287

type_func = timedelta_to_milliseconds)

1288

interval = notifychangeproperty(dbus.UInt64,

1289

"Interval",

1290

type_func =

1291

timedelta_to_milliseconds)

1292

checker_command = notifychangeproperty(dbus.String, "Checker")

1293

1294

del notifychangeproperty

758

759

def _get_approvals_pending(self):

760

return self._approvals_pending

761

def _set_approvals_pending(self, value):

762

old_value = self._approvals_pending

763

self._approvals_pending = value

764

bval = bool(value)

765

if (hasattr(self, "dbus_object_path")

766

and bval is not bool(old_value)):

767

dbus_bool = dbus.Boolean(bval, variant_level=1)

768

self.PropertyChanged(dbus.String("ApprovalPending"),

769

dbus_bool)

770

771

approvals_pending = property(_get_approvals_pending,

772

_set_approvals_pending)

773

del _get_approvals_pending, _set_approvals_pending

774

775

@staticmethod

776

def _datetime_to_dbus(dt, variant_level=0):

777

"""Convert a UTC datetime.datetime() to a D-Bus type."""

778

return dbus.String(dt.isoformat(),

779

variant_level=variant_level)

780

781

def enable(self):

782

oldstate = getattr(self, "enabled", False)

783

r = Client.enable(self)

784

if oldstate != self.enabled:

785

# Emit D-Bus signals

786

self.PropertyChanged(dbus.String("Enabled"),

787

dbus.Boolean(True, variant_level=1))

788

self.PropertyChanged(

789

dbus.String("LastEnabled"),

790

self._datetime_to_dbus(self.last_enabled,

791

variant_level=1))

792

return r

793

794

def disable(self, quiet = False):

795

oldstate = getattr(self, "enabled", False)

796

r = Client.disable(self, quiet=quiet)

797

if not quiet and oldstate != self.enabled:

798

# Emit D-Bus signal

799

self.PropertyChanged(dbus.String("Enabled"),

800

dbus.Boolean(False, variant_level=1))

801

return r

1295

802

1296

803

def __del__(self, *args, **kwargs):

1297

804

try:

1306

813

*args, **kwargs):

1307

814

self.checker_callback_tag = None

1308

815

self.checker = None

816

# Emit D-Bus signal

817

self.PropertyChanged(dbus.String("CheckerRunning"),

818

dbus.Boolean(False, variant_level=1))

1309

819

if os.WIFEXITED(condition):

1310

820

exitstatus = os.WEXITSTATUS(condition)

1311

821

# Emit D-Bus signal

1321

831

return Client.checker_callback(self, pid, condition, command,

1322

832

*args, **kwargs)

1323

833

834

def checked_ok(self, *args, **kwargs):

835

Client.checked_ok(self, *args, **kwargs)

836

# Emit D-Bus signal

837

self.PropertyChanged(

838

dbus.String("LastCheckedOK"),

839

(self._datetime_to_dbus(self.last_checked_ok,

840

variant_level=1)))

841

842

def need_approval(self, *args, **kwargs):

843

r = Client.need_approval(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastApprovalRequest"),

847

(self._datetime_to_dbus(self.last_approval_request,

848

variant_level=1)))

849

return r

850

1324

851

def start_checker(self, *args, **kwargs):

1325

852

old_checker = self.checker

1326

853

if self.checker is not None:

1333

860

and old_checker_pid != self.checker.pid):

1334

861

# Emit D-Bus signal

1335

862

self.CheckerStarted(self.current_checker_command)

863

self.PropertyChanged(

864

dbus.String("CheckerRunning"),

865

dbus.Boolean(True, variant_level=1))

1336

866

return r

1337

867

868

def stop_checker(self, *args, **kwargs):

869

old_checker = getattr(self, "checker", None)

870

r = Client.stop_checker(self, *args, **kwargs)

871

if (old_checker is not None

872

and getattr(self, "checker", None) is None):

873

self.PropertyChanged(dbus.String("CheckerRunning"),

874

dbus.Boolean(False, variant_level=1))

875

return r

876

1338

877

def _reset_approved(self):

1339

self.approved = None

878

self._approved = None

1340

879

return False

1341

880

1342

881

def approve(self, value=True):

1343

self.approved = value

1344

gobject.timeout_add(timedelta_to_milliseconds

882

self.send_changedstate()

883

self._approved = value

884

gobject.timeout_add(self._timedelta_to_milliseconds

1345

885

(self.approval_duration),

1346

886

self._reset_approved)

1347

self.send_changedstate()

887

1348

888

1349

889

## D-Bus methods, signals & properties

1350

_interface = "se.recompile.Mandos.Client"

1351

1352

## Interfaces

1353

1354

@dbus_interface_annotations(_interface)

1355

def _foo(self):

1356

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1357

"false"}

890

_interface = "se.bsnet.fukt.Mandos.Client"

1358

891

1359

892

## Signals

1360

893

1446

979

if value is None: # get

1447

980

return dbus.Boolean(self.approved_by_default)

1448

981

self.approved_by_default = bool(value)

982

# Emit D-Bus signal

983

self.PropertyChanged(dbus.String("ApprovedByDefault"),

984

dbus.Boolean(value, variant_level=1))

1449

985

1450

986

# ApprovalDelay - property

1451

987

@dbus_service_property(_interface, signature="t",

1454

990

if value is None: # get

1455

991

return dbus.UInt64(self.approval_delay_milliseconds())

1456

992

self.approval_delay = datetime.timedelta(0, 0, 0, value)

993

# Emit D-Bus signal

994

self.PropertyChanged(dbus.String("ApprovalDelay"),

995

dbus.UInt64(value, variant_level=1))

1457

996

1458

997

# ApprovalDuration - property

1459

998

@dbus_service_property(_interface, signature="t",

1460

999

access="readwrite")

1461

1000

def ApprovalDuration_dbus_property(self, value=None):

1462

1001

if value is None: # get

1463

return dbus.UInt64(timedelta_to_milliseconds(

1002

return dbus.UInt64(self._timedelta_to_milliseconds(

1464

1003

self.approval_duration))

1465

1004

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1005

# Emit D-Bus signal

1006

self.PropertyChanged(dbus.String("ApprovalDuration"),

1007

dbus.UInt64(value, variant_level=1))

1466

1008

1467

1009

# Name - property

1468

1010

@dbus_service_property(_interface, signature="s", access="read")

1480

1022

def Host_dbus_property(self, value=None):

1481

1023

if value is None: # get

1482

1024

return dbus.String(self.host)

1483

self.host = unicode(value)

1025

self.host = value

1026

# Emit D-Bus signal

1027

self.PropertyChanged(dbus.String("Host"),

1028

dbus.String(value, variant_level=1))

1484

1029

1485

1030

# Created - property

1486

1031

@dbus_service_property(_interface, signature="s", access="read")

1487

1032

def Created_dbus_property(self):

1488

return datetime_to_dbus(self.created)

1033

return dbus.String(self._datetime_to_dbus(self.created))

1489

1034

1490

1035

# LastEnabled - property

1491

1036

@dbus_service_property(_interface, signature="s", access="read")

1492

1037

def LastEnabled_dbus_property(self):

1493

return datetime_to_dbus(self.last_enabled)

1038

if self.last_enabled is None:

1039

return dbus.String("")

1040

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1494

1041

1495

1042

# Enabled - property

1496

1043

@dbus_service_property(_interface, signature="b",

1510

1057

if value is not None:

1511

1058

self.checked_ok()

1512

1059

return

1513

return datetime_to_dbus(self.last_checked_ok)

1514

1515

# LastCheckerStatus - property

1516

@dbus_service_property(_interface, signature="n",

1517

access="read")

1518

def LastCheckerStatus_dbus_property(self):

1519

return dbus.Int16(self.last_checker_status)

1520

1521

# Expires - property

1522

@dbus_service_property(_interface, signature="s", access="read")

1523

def Expires_dbus_property(self):

1524

return datetime_to_dbus(self.expires)

1060

if self.last_checked_ok is None:

1061

return dbus.String("")

1062

return dbus.String(self._datetime_to_dbus(self

1063

.last_checked_ok))

1525

1064

1526

1065

# LastApprovalRequest - property

1527

1066

@dbus_service_property(_interface, signature="s", access="read")

1528

1067

def LastApprovalRequest_dbus_property(self):

1529

return datetime_to_dbus(self.last_approval_request)

1068

if self.last_approval_request is None:

1069

return dbus.String("")

1070

return dbus.String(self.

1071

_datetime_to_dbus(self

1072

.last_approval_request))

1530

1073

1531

1074

# Timeout - property

1532

1075

@dbus_service_property(_interface, signature="t",

1534

1077

def Timeout_dbus_property(self, value=None):

1535

1078

if value is None: # get

1536

1079

return dbus.UInt64(self.timeout_milliseconds())

1537

old_timeout = self.timeout

1538

1080

self.timeout = datetime.timedelta(0, 0, 0, value)

1539

# Reschedule disabling

1540

if self.enabled:

1541

now = datetime.datetime.utcnow()

1542

self.expires += self.timeout - old_timeout

1543

if self.expires <= now:

1544

# The timeout has passed

1545

self.disable()

1546

else:

1547

if (getattr(self, "disable_initiator_tag", None)

1548

is None):

1549

return

1550

gobject.source_remove(self.disable_initiator_tag)

1551

self.disable_initiator_tag = (

1552

gobject.timeout_add(

1553

timedelta_to_milliseconds(self.expires - now),

1554

self.disable))

1555

1556

# ExtendedTimeout - property

1557

@dbus_service_property(_interface, signature="t",

1558

access="readwrite")

1559

def ExtendedTimeout_dbus_property(self, value=None):

1560

if value is None: # get

1561

return dbus.UInt64(self.extended_timeout_milliseconds())

1562

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1081

# Emit D-Bus signal

1082

self.PropertyChanged(dbus.String("Timeout"),

1083

dbus.UInt64(value, variant_level=1))

1084

if getattr(self, "disable_initiator_tag", None) is None:

1085

return

1086

# Reschedule timeout

1087

gobject.source_remove(self.disable_initiator_tag)

1088

self.disable_initiator_tag = None

1089

time_to_die = (self.

1090

_timedelta_to_milliseconds((self

1091

.last_checked_ok

1092

+ self.timeout)

1093

- datetime.datetime

1094

.utcnow()))

1095

if time_to_die <= 0:

1096

# The timeout has passed

1097

self.disable()

1098

else:

1099

self.disable_initiator_tag = (gobject.timeout_add

1100

(time_to_die, self.disable))

1563

1101

1564

1102

# Interval - property

1565

1103

@dbus_service_property(_interface, signature="t",

1568

1106

if value is None: # get

1569

1107

return dbus.UInt64(self.interval_milliseconds())

1570

1108

self.interval = datetime.timedelta(0, 0, 0, value)

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Interval"),

1111

dbus.UInt64(value, variant_level=1))

1571

1112

if getattr(self, "checker_initiator_tag", None) is None:

1572

1113

return

1573

if self.enabled:

1574

# Reschedule checker run

1575

gobject.source_remove(self.checker_initiator_tag)

1576

self.checker_initiator_tag = (gobject.timeout_add

1577

(value, self.start_checker))

1578

self.start_checker() # Start one now, too

1579

1114

# Reschedule checker run

1115

gobject.source_remove(self.checker_initiator_tag)

1116

self.checker_initiator_tag = (gobject.timeout_add

1117

(value, self.start_checker))

1118

self.start_checker() # Start one now, too

1119

1580

1120

# Checker - property

1581

1121

@dbus_service_property(_interface, signature="s",

1582

1122

access="readwrite")

1583

1123

def Checker_dbus_property(self, value=None):

1584

1124

if value is None: # get

1585

1125

return dbus.String(self.checker_command)

1586

self.checker_command = unicode(value)

1126

self.checker_command = value

1127

# Emit D-Bus signal

1128

self.PropertyChanged(dbus.String("Checker"),

1129

dbus.String(self.checker_command,

1130

variant_level=1))

1587

1131

1588

1132

# CheckerRunning - property

1589

1133

@dbus_service_property(_interface, signature="b",

1616

1160

self._pipe.send(('init', fpr, address))

1617

1161

if not self._pipe.recv():

1618

1162

raise KeyError()

1619

1163

1620

1164

def __getattribute__(self, name):

1621

if name == '_pipe':

1165

if(name == '_pipe'):

1622

1166

return super(ProxyClient, self).__getattribute__(name)

1623

1167

self._pipe.send(('getattr', name))

1624

1168

data = self._pipe.recv()

1629

1173

self._pipe.send(('funcall', name, args, kwargs))

1630

1174

return self._pipe.recv()[1]

1631

1175

return func

1632

1176

1633

1177

def __setattr__(self, name, value):

1634

if name == '_pipe':

1178

if(name == '_pipe'):

1635

1179

return super(ProxyClient, self).__setattr__(name, value)

1636

1180

self._pipe.send(('setattr', name, value))

1637

1181

1648

1192

unicode(self.client_address))

1649

1193

logger.debug("Pipe FD: %d",

1650

1194

self.server.child_pipe.fileno())

1651

1195

1652

1196

session = (gnutls.connection

1653

1197

.ClientSession(self.request,

1654

1198

gnutls.connection

1655

1199

.X509Credentials()))

1656

1200

1657

1201

# Note: gnutls.connection.X509Credentials is really a

1658

1202

# generic GnuTLS certificate credentials object so long as

1659

1203

# no X.509 keys are added to it. Therefore, we can use it

1660

1204

# here despite using OpenPGP certificates.

1661

1205

1662

1206

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1663

1207

# "+AES-256-CBC", "+SHA1",

1664

1208

# "+COMP-NULL", "+CTYPE-OPENPGP",

1670

1214

(gnutls.library.functions

1671

1215

.gnutls_priority_set_direct(session._c_object,

1672

1216

priority, None))

1673

1217

1674

1218

# Start communication using the Mandos protocol

1675

1219

# Get protocol number

1676

1220

line = self.request.makefile().readline()

1681

1225

except (ValueError, IndexError, RuntimeError) as error:

1682

1226

logger.error("Unknown protocol version: %s", error)

1683

1227

return

1684

1228

1685

1229

# Start GnuTLS connection

1686

1230

try:

1687

1231

session.handshake()

1691

1235

# established. Just abandon the request.

1692

1236

return

1693

1237

logger.debug("Handshake succeeded")

1694

1238

1695

1239

approval_required = False

1696

1240

try:

1697

1241

try:

1702

1246

logger.warning("Bad certificate: %s", error)

1703

1247

return

1704

1248

logger.debug("Fingerprint: %s", fpr)

1705

1249

1706

1250

try:

1707

1251

client = ProxyClient(child_pipe, fpr,

1708

1252

self.client_address)

1716

1260

1717

1261

while True:

1718

1262

if not client.enabled:

1719

logger.info("Client %s is disabled",

1263

logger.warning("Client %s is disabled",

1720

1264

client.name)

1721

1265

if self.server.use_dbus:

1722

1266

# Emit D-Bus signal

1723

client.Rejected("Disabled")

1267

client.Rejected("Disabled")

1724

1268

return

1725

1269

1726

if client.approved or not client.approval_delay:

1270

if client._approved or not client.approval_delay:

1727

1271

#We are approved or approval is disabled

1728

1272

break

1729

elif client.approved is None:

1273

elif client._approved is None:

1730

1274

logger.info("Client %s needs approval",

1731

1275

client.name)

1732

1276

if self.server.use_dbus:

1743

1287

return

1744

1288

1745

1289

#wait until timeout or approved

1290

#x = float(client._timedelta_to_milliseconds(delay))

1746

1291

time = datetime.datetime.now()

1747

1292

client.changedstate.acquire()

1748

client.changedstate.wait(

1749

float(timedelta_to_milliseconds(delay)

1750

/ 1000))

1293

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1751

1294

client.changedstate.release()

1752

1295

time2 = datetime.datetime.now()

1753

1296

if (time2 - time) >= delay:

1769

1312

try:

1770

1313

sent = session.send(client.secret[sent_size:])

1771

1314

except gnutls.errors.GNUTLSError as error:

1772

logger.warning("gnutls send failed",

1773

exc_info=error)

1315

logger.warning("gnutls send failed")

1774

1316

return

1775

1317

logger.debug("Sent: %d, remaining: %d",

1776

1318

sent, len(client.secret)

1777

1319

- (sent_size + sent))

1778

1320

sent_size += sent

1779

1321

1780

1322

logger.info("Sending secret to %s", client.name)

1781

# bump the timeout using extended_timeout

1782

client.bump_timeout(client.extended_timeout)

1323

# bump the timeout as if seen

1324

client.checked_ok()

1783

1325

if self.server.use_dbus:

1784

1326

# Emit D-Bus signal

1785

1327

client.GotSecret()

1790

1332

try:

1791

1333

session.bye()

1792

1334

except gnutls.errors.GNUTLSError as error:

1793

logger.warning("GnuTLS bye failed",

1794

exc_info=error)

1335

logger.warning("GnuTLS bye failed")

1795

1336

1796

1337

@staticmethod

1797

1338

def peer_certificate(session):

1853

1394

# Convert the buffer to a Python bytestring

1854

1395

fpr = ctypes.string_at(buf, buf_len.value)

1855

1396

# Convert the bytestring to hexadecimal notation

1856

hex_fpr = binascii.hexlify(fpr).upper()

1397

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1857

1398

return hex_fpr

1858

1399

1859

1400

1862

1403

def sub_process_main(self, request, address):

1863

1404

try:

1864

1405

self.finish_request(request, address)

1865

except Exception:

1406

except:

1866

1407

self.handle_error(request, address)

1867

1408

self.close_request(request)

1868

1409

1869

1410

def process_request(self, request, address):

1870

1411

"""Start a new process to process the request."""

1871

proc = multiprocessing.Process(target = self.sub_process_main,

1872

args = (request, address))

1873

proc.start()

1874

return proc

1875

1412

multiprocessing.Process(target = self.sub_process_main,

1413

args = (request, address)).start()

1876

1414

1877

1415

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1878

1416

""" adds a pipe to the MixIn """

1882

1420

This function creates a new pipe in self.pipe

1883

1421

"""

1884

1422

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1885

1886

proc = MultiprocessingMixIn.process_request(self, request,

1887

client_address)

1423

1424

super(MultiprocessingMixInWithPipe,

1425

self).process_request(request, client_address)

1888

1426

self.child_pipe.close()

1889

self.add_pipe(parent_pipe, proc)

1890

1891

def add_pipe(self, parent_pipe, proc):

1427

self.add_pipe(parent_pipe)

1428

1429

def add_pipe(self, parent_pipe):

1892

1430

"""Dummy function; override as necessary"""

1893

1431

raise NotImplementedError

1894

1432

1895

1896

1433

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1897

1434

socketserver.TCPServer, object):

1898

1435

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1972

1509

self.enabled = False

1973

1510

self.clients = clients

1974

1511

if self.clients is None:

1975

self.clients = {}

1512

self.clients = set()

1976

1513

self.use_dbus = use_dbus

1977

1514

self.gnutls_priority = gnutls_priority

1978

1515

IPv6_TCPServer.__init__(self, server_address,

1982

1519

def server_activate(self):

1983

1520

if self.enabled:

1984

1521

return socketserver.TCPServer.server_activate(self)

1985

1986

1522

def enable(self):

1987

1523

self.enabled = True

1988

1989

def add_pipe(self, parent_pipe, proc):

1524

def add_pipe(self, parent_pipe):

1990

1525

# Call "handle_ipc" for both data and EOF events

1991

1526

gobject.io_add_watch(parent_pipe.fileno(),

1992

1527

gobject.IO_IN | gobject.IO_HUP,

1993

1528

functools.partial(self.handle_ipc,

1994

parent_pipe =

1995

parent_pipe,

1996

proc = proc))

1997

1529

parent_pipe = parent_pipe))

1530

1998

1531

def handle_ipc(self, source, condition, parent_pipe=None,

1999

proc = None, client_object=None):

2000

# error, or the other end of multiprocessing.Pipe has closed

2001

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2002

# Wait for other process to exit

2003

proc.join()

1532

client_object=None):

1533

condition_names = {

1534

gobject.IO_IN: "IN", # There is data to read.

1535

gobject.IO_OUT: "OUT", # Data can be written (without

1536

# blocking).

1537

gobject.IO_PRI: "PRI", # There is urgent data to read.

1538

gobject.IO_ERR: "ERR", # Error condition.

1539

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1540

# broken, usually for pipes and

1541

# sockets).

1542

}

1543

conditions_string = ' | '.join(name

1544

for cond, name in

1545

condition_names.iteritems()

1546

if cond & condition)

1547

# error or the other end of multiprocessing.Pipe has closed

1548

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2004

1549

return False

2005

1550

2006

1551

# Read a request from the child

2011

1556

fpr = request[1]

2012

1557

address = request[2]

2013

1558

2014

for c in self.clients.itervalues():

1559

for c in self.clients:

2015

1560

if c.fingerprint == fpr:

2016

1561

client = c

2017

1562

break

2018

1563

else:

2019

logger.info("Client not found for fingerprint: %s, ad"

2020

"dress: %s", fpr, address)

1564

logger.warning("Client not found for fingerprint: %s, ad"

1565

"dress: %s", fpr, address)

2021

1566

if self.use_dbus:

2022

1567

# Emit D-Bus signal

2023

mandos_dbus_service.ClientNotFound(fpr,

2024

address[0])

1568

mandos_dbus_service.ClientNotFound(fpr, address[0])

2025

1569

parent_pipe.send(False)

2026

1570

return False

2027

1571

2028

1572

gobject.io_add_watch(parent_pipe.fileno(),

2029

1573

gobject.IO_IN | gobject.IO_HUP,

2030

1574

functools.partial(self.handle_ipc,

2031

parent_pipe =

2032

parent_pipe,

2033

proc = proc,

2034

client_object =

2035

client))

1575

parent_pipe = parent_pipe,

1576

client_object = client))

2036

1577

parent_pipe.send(True)

2037

# remove the old hook in favor of the new above hook on

2038

# same fileno

1578

# remove the old hook in favor of the new above hook on same fileno

2039

1579

return False

2040

1580

if command == 'funcall':

2041

1581

funcname = request[1]

2042

1582

args = request[2]

2043

1583

kwargs = request[3]

2044

1584

2045

parent_pipe.send(('data', getattr(client_object,

2046

funcname)(*args,

2047

**kwargs)))

2048

1585

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1586

2049

1587

if command == 'getattr':

2050

1588

attrname = request[1]

2051

1589

if callable(client_object.__getattribute__(attrname)):

2052

1590

parent_pipe.send(('function',))

2053

1591

else:

2054

parent_pipe.send(('data', client_object

2055

.__getattribute__(attrname)))

1592

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2056

1593

2057

1594

if command == 'setattr':

2058

1595

attrname = request[1]

2059

1596

value = request[2]

2060

1597

setattr(client_object, attrname, value)

2061

1598

2062

1599

return True

2063

1600

2064

1601

2094

1631

elif suffix == "w":

2095

1632

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2096

1633

else:

2097

raise ValueError("Unknown suffix {0!r}"

2098

.format(suffix))

1634

raise ValueError("Unknown suffix %r" % suffix)

2099

1635

except (ValueError, IndexError) as e:

2100

1636

raise ValueError(*(e.args))

2101

1637

timevalue += delta

2102

1638

return timevalue

2103

1639

2104

1640

1641

def if_nametoindex(interface):

1642

"""Call the C function if_nametoindex(), or equivalent

1643

1644

Note: This function cannot accept a unicode string."""

1645

global if_nametoindex

1646

try:

1647

if_nametoindex = (ctypes.cdll.LoadLibrary

1648

(ctypes.util.find_library("c"))

1649

.if_nametoindex)

1650

except (OSError, AttributeError):

1651

logger.warning("Doing if_nametoindex the hard way")

1652

def if_nametoindex(interface):

1653

"Get an interface index the hard way, i.e. using fcntl()"

1654

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1655

with contextlib.closing(socket.socket()) as s:

1656

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1657

struct.pack(str("16s16x"),

1658

interface))

1659

interface_index = struct.unpack(str("I"),

1660

ifreq[16:20])[0]

1661

return interface_index

1662

return if_nametoindex(interface)

1663

1664

2105

1665

def daemon(nochdir = False, noclose = False):

2106

1666

"""See daemon(3). Standard BSD Unix function.

2107

1667

2115

1675

sys.exit()

2116

1676

if not noclose:

2117

1677

# Close all standard open file descriptors

2118

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1678

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2119

1679

if not stat.S_ISCHR(os.fstat(null).st_mode):

2120

1680

raise OSError(errno.ENODEV,

2121

"{0} not a character device"

2122

.format(os.devnull))

1681

"%s not a character device"

1682

% os.path.devnull)

2123

1683

os.dup2(null, sys.stdin.fileno())

2124

1684

os.dup2(null, sys.stdout.fileno())

2125

1685

os.dup2(null, sys.stderr.fileno())

2134

1694

2135

1695

parser = argparse.ArgumentParser()

2136

1696

parser.add_argument("-v", "--version", action="version",

2137

version = "%(prog)s {0}".format(version),

1697

version = "%%(prog)s %s" % version,

2138

1698

help="show version number and exit")

2139

1699

parser.add_argument("-i", "--interface", metavar="IF",

2140

1700

help="Bind to interface IF")

2162

1722

" system bus interface")

2163

1723

parser.add_argument("--no-ipv6", action="store_false",

2164

1724

dest="use_ipv6", help="Do not use IPv6")

2165

parser.add_argument("--no-restore", action="store_false",

2166

dest="restore", help="Do not restore stored"

2167

" state")

2168

parser.add_argument("--statedir", metavar="DIR",

2169

help="Directory to save/restore state in")

2170

2171

1725

options = parser.parse_args()

2172

1726

2173

1727

if options.check:

2186

1740

"use_dbus": "True",

2187

1741

"use_ipv6": "True",

2188

1742

"debuglevel": "",

2189

"restore": "True",

2190

"statedir": "/var/lib/mandos"

2191

1743

}

2192

1744

2193

1745

# Parse config file for server-global settings

2210

1762

# options, if set.

2211

1763

for option in ("interface", "address", "port", "debug",

2212

1764

"priority", "servicename", "configdir",

2213

"use_dbus", "use_ipv6", "debuglevel", "restore",

2214

"statedir"):

1765

"use_dbus", "use_ipv6", "debuglevel"):

2215

1766

value = getattr(options, option)

2216

1767

if value is not None:

2217

1768

server_settings[option] = value

2229

1780

debuglevel = server_settings["debuglevel"]

2230

1781

use_dbus = server_settings["use_dbus"]

2231

1782

use_ipv6 = server_settings["use_ipv6"]

2232

stored_state_path = os.path.join(server_settings["statedir"],

2233

stored_state_file)

2234

2235

if debug:

2236

initlogger(debug, logging.DEBUG)

2237

else:

2238

if not debuglevel:

2239

initlogger(debug)

2240

else:

2241

level = getattr(logging, debuglevel.upper())

2242

initlogger(debug, level)

2243

1783

2244

1784

if server_settings["servicename"] != "Mandos":

2245

1785

syslogger.setFormatter(logging.Formatter

2246

('Mandos ({0}) [%(process)d]:'

2247

' %(levelname)s: %(message)s'

2248

.format(server_settings

2249

["servicename"])))

1786

('Mandos (%s) [%%(process)d]:'

1787

' %%(levelname)s: %%(message)s'

1788

% server_settings["servicename"]))

2250

1789

2251

1790

# Parse config file with clients

2252

client_config = configparser.SafeConfigParser(Client

2253

.client_defaults)

1791

client_defaults = { "timeout": "1h",

1792

"interval": "5m",

1793

"checker": "fping -q -- %%(host)s",

1794

"host": "",

1795

"approval_delay": "0s",

1796

"approval_duration": "1s",

1797

}

1798

client_config = configparser.SafeConfigParser(client_defaults)

2254

1799

client_config.read(os.path.join(server_settings["configdir"],

2255

1800

"clients.conf"))

2256

1801

2270

1815

pidfilename = "/var/run/mandos.pid"

2271

1816

try:

2272

1817

pidfile = open(pidfilename, "w")

2273

except IOError as e:

2274

logger.error("Could not open file %r", pidfilename,

2275

exc_info=e)

1818

except IOError:

1819

logger.error("Could not open file %r", pidfilename)

2276

1820

2277

for name in ("_mandos", "mandos", "nobody"):

1821

try:

1822

uid = pwd.getpwnam("_mandos").pw_uid

1823

gid = pwd.getpwnam("_mandos").pw_gid

1824

except KeyError:

2278

1825

try:

2279

uid = pwd.getpwnam(name).pw_uid

2280

gid = pwd.getpwnam(name).pw_gid

2281

break

1826

uid = pwd.getpwnam("mandos").pw_uid

1827

gid = pwd.getpwnam("mandos").pw_gid

2282

1828

except KeyError:

2283

continue

2284

else:

2285

uid = 65534

2286

gid = 65534

1829

try:

1830

uid = pwd.getpwnam("nobody").pw_uid

1831

gid = pwd.getpwnam("nobody").pw_gid

1832

except KeyError:

1833

uid = 65534

1834

gid = 65534

2287

1835

try:

2288

1836

os.setgid(gid)

2289

1837

os.setuid(uid)

2291

1839

if error[0] != errno.EPERM:

2292

1840

raise error

2293

1841

1842

if not debug and not debuglevel:

1843

syslogger.setLevel(logging.WARNING)

1844

console.setLevel(logging.WARNING)

1845

if debuglevel:

1846

level = getattr(logging, debuglevel.upper())

1847

syslogger.setLevel(level)

1848

console.setLevel(level)

1849

2294

1850

if debug:

2295

1851

# Enable all possible GnuTLS debugging

2296

1852

2306

1862

.gnutls_global_set_log_function(debug_gnutls))

2307

1863

2308

1864

# Redirect stdin so all checkers get /dev/null

2309

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1865

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2310

1866

os.dup2(null, sys.stdin.fileno())

2311

1867

if null > 2:

2312

1868

os.close(null)

1869

else:

1870

# No console logging

1871

logger.removeHandler(console)

2313

1872

2314

1873

# Need to fork before connecting to D-Bus

2315

1874

if not debug:

2316

1875

# Close all input and output, do double fork, etc.

2317

1876

daemon()

2318

1877

2319

gobject.threads_init()

2320

2321

1878

global main_loop

2322

1879

# From the Avahi example code

2323

DBusGMainLoop(set_as_default=True)

1880

DBusGMainLoop(set_as_default=True )

2324

1881

main_loop = gobject.MainLoop()

2325

1882

bus = dbus.SystemBus()

2326

1883

# End of Avahi example code

2327

1884

if use_dbus:

2328

1885

try:

2329

bus_name = dbus.service.BusName("se.recompile.Mandos",

1886

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2330

1887

bus, do_not_queue=True)

2331

old_bus_name = (dbus.service.BusName

2332

("se.bsnet.fukt.Mandos", bus,

2333

do_not_queue=True))

2334

1888

except dbus.exceptions.NameExistsException as e:

2335

logger.error("Disabling D-Bus:", exc_info=e)

1889

logger.error(unicode(e) + ", disabling D-Bus")

2336

1890

use_dbus = False

2337

1891

server_settings["use_dbus"] = False

2338

1892

tcp_server.use_dbus = False

2339

1893

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2340

service = AvahiServiceToSyslog(name =

2341

server_settings["servicename"],

2342

servicetype = "_mandos._tcp",

2343

protocol = protocol, bus = bus)

1894

service = AvahiService(name = server_settings["servicename"],

1895

servicetype = "_mandos._tcp",

1896

protocol = protocol, bus = bus)

2344

1897

if server_settings["interface"]:

2345

1898

service.interface = (if_nametoindex

2346

1899

(str(server_settings["interface"])))

2351

1904

client_class = Client

2352

1905

if use_dbus:

2353

1906

client_class = functools.partial(ClientDBus, bus = bus)

2354

2355

client_settings = Client.config_parser(client_config)

2356

old_client_settings = {}

2357

clients_data = {}

2358

2359

# Get client data and settings from last running state.

2360

if server_settings["restore"]:

2361

try:

2362

with open(stored_state_path, "rb") as stored_state:

2363

clients_data, old_client_settings = (pickle.load

2364

(stored_state))

2365

os.remove(stored_state_path)

2366

except IOError as e:

2367

if e.errno == errno.ENOENT:

2368

logger.warning("Could not load persistent state: {0}"

2369

.format(os.strerror(e.errno)))

2370

else:

2371

logger.critical("Could not load persistent state:",

2372

exc_info=e)

2373

raise

2374

except EOFError as e:

2375

logger.warning("Could not load persistent state: "

2376

"EOFError:", exc_info=e)

2377

2378

with PGPEngine() as pgp:

2379

for client_name, client in clients_data.iteritems():

2380

# Decide which value to use after restoring saved state.

2381

# We have three different values: Old config file,

2382

# new config file, and saved state.

2383

# New config value takes precedence if it differs from old

2384

# config value, otherwise use saved state.

2385

for name, value in client_settings[client_name].items():

2386

try:

2387

# For each value in new config, check if it

2388

# differs from the old config value (Except for

2389

# the "secret" attribute)

2390

if (name != "secret" and

2391

value != old_client_settings[client_name]

2392

[name]):

2393

client[name] = value

2394

except KeyError:

2395

pass

2396

2397

# Clients who has passed its expire date can still be

2398

# enabled if its last checker was successful. Clients

2399

# whose checker succeeded before we stored its state is

2400

# assumed to have successfully run all checkers during

2401

# downtime.

2402

if client["enabled"]:

2403

if datetime.datetime.utcnow() >= client["expires"]:

2404

if not client["last_checked_ok"]:

2405

logger.warning(

2406

"disabling client {0} - Client never "

2407

"performed a successful checker"

2408

.format(client_name))

2409

client["enabled"] = False

2410

elif client["last_checker_status"] != 0:

2411

logger.warning(

2412

"disabling client {0} - Client "

2413

"last checker failed with error code {1}"

2414

.format(client_name,

2415

client["last_checker_status"]))

2416

client["enabled"] = False

2417

else:

2418

client["expires"] = (datetime.datetime

2419

.utcnow()

2420

+ client["timeout"])

2421

logger.debug("Last checker succeeded,"

2422

" keeping {0} enabled"

2423

.format(client_name))

1907

def client_config_items(config, section):

1908

special_settings = {

1909

"approved_by_default":

1910

lambda: config.getboolean(section,

1911

"approved_by_default"),

1912

}

1913

for name, value in config.items(section):

2424

1914

try:

2425

client["secret"] = (

2426

pgp.decrypt(client["encrypted_secret"],

2427

client_settings[client_name]

2428

["secret"]))

2429

except PGPError:

2430

# If decryption fails, we use secret from new settings

2431

logger.debug("Failed to decrypt {0} old secret"

2432

.format(client_name))

2433

client["secret"] = (

2434

client_settings[client_name]["secret"])

2435

2436

# Add/remove clients based on new changes made to config

2437

for client_name in (set(old_client_settings)

2438

- set(client_settings)):

2439

del clients_data[client_name]

2440

for client_name in (set(client_settings)

2441

- set(old_client_settings)):

2442

clients_data[client_name] = client_settings[client_name]

2443

2444

# Create all client objects

2445

for client_name, client in clients_data.iteritems():

2446

tcp_server.clients[client_name] = client_class(

2447

name = client_name, settings = client)

2448

1915

yield (name, special_settings[name]())

1916

except KeyError:

1917

yield (name, value)

1918

1919

tcp_server.clients.update(set(

1920

client_class(name = section,

1921

config= dict(client_config_items(

1922

client_config, section)))

1923

for section in client_config.sections()))

2449

1924

if not tcp_server.clients:

2450

1925

logger.warning("No clients defined")

2451

1926

2452

1927

if not debug:

2453

1928

try:

2454

1929

with pidfile:

2462

1937

# "pidfile" was never created

2463

1938

pass

2464

1939

del pidfilename

1940

2465

1941

signal.signal(signal.SIGINT, signal.SIG_IGN)

2466

1942

2467

1943

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2468

1944

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2469

1945

2470

1946

if use_dbus:

2471

@alternate_dbus_interfaces({"se.recompile.Mandos":

2472

"se.bsnet.fukt.Mandos"})

2473

class MandosDBusService(DBusObjectWithProperties):

1947

class MandosDBusService(dbus.service.Object):

2474

1948

"""A D-Bus proxy object"""

2475

1949

def __init__(self):

2476

1950

dbus.service.Object.__init__(self, bus, "/")

2477

_interface = "se.recompile.Mandos"

2478

2479

@dbus_interface_annotations(_interface)

2480

def _foo(self):

2481

return { "org.freedesktop.DBus.Property"

2482

".EmitsChangedSignal":

2483

"false"}

1951

_interface = "se.bsnet.fukt.Mandos"

2484

1952

2485

1953

@dbus.service.signal(_interface, signature="o")

2486

1954

def ClientAdded(self, objpath):

2501

1969

def GetAllClients(self):

2502

1970

"D-Bus method"

2503

1971

return dbus.Array(c.dbus_object_path

2504

for c in

2505

tcp_server.clients.itervalues())

1972

for c in tcp_server.clients)

2506

1973

2507

1974

@dbus.service.method(_interface,

2508

1975

out_signature="a{oa{sv}}")

2510

1977

"D-Bus method"

2511

1978

return dbus.Dictionary(

2512

1979

((c.dbus_object_path, c.GetAll(""))

2513

for c in tcp_server.clients.itervalues()),

1980

for c in tcp_server.clients),

2514

1981

signature="oa{sv}")

2515

1982

2516

1983

@dbus.service.method(_interface, in_signature="o")

2517

1984

def RemoveClient(self, object_path):

2518

1985

"D-Bus method"

2519

for c in tcp_server.clients.itervalues():

1986

for c in tcp_server.clients:

2520

1987

if c.dbus_object_path == object_path:

2521

del tcp_server.clients[c.name]

1988

tcp_server.clients.remove(c)

2522

1989

c.remove_from_connection()

2523

1990

# Don't signal anything except ClientRemoved

2524

1991

c.disable(quiet=True)

2535

2002

"Cleanup function; run on exit"

2536

2003

service.cleanup()

2537

2004

2538

multiprocessing.active_children()

2539

if not (tcp_server.clients or client_settings):

2540

return

2541

2542

# Store client before exiting. Secrets are encrypted with key

2543

# based on what config file has. If config file is

2544

# removed/edited, old secret will thus be unrecovable.

2545

clients = {}

2546

with PGPEngine() as pgp:

2547

for client in tcp_server.clients.itervalues():

2548

key = client_settings[client.name]["secret"]

2549

client.encrypted_secret = pgp.encrypt(client.secret,

2550

key)

2551

client_dict = {}

2552

2553

# A list of attributes that can not be pickled

2554

# + secret.

2555

exclude = set(("bus", "changedstate", "secret",

2556

"checker"))

2557

for name, typ in (inspect.getmembers

2558

(dbus.service.Object)):

2559

exclude.add(name)

2560

2561

client_dict["encrypted_secret"] = (client

2562

.encrypted_secret)

2563

for attr in client.client_structure:

2564

if attr not in exclude:

2565

client_dict[attr] = getattr(client, attr)

2566

2567

clients[client.name] = client_dict

2568

del client_settings[client.name]["secret"]

2569

2570

try:

2571

with (tempfile.NamedTemporaryFile

2572

(mode='wb', suffix=".pickle", prefix='clients-',

2573

dir=os.path.dirname(stored_state_path),

2574

delete=False)) as stored_state:

2575

pickle.dump((clients, client_settings), stored_state)

2576

tempname=stored_state.name

2577

os.rename(tempname, stored_state_path)

2578

except (IOError, OSError) as e:

2579

if not debug:

2580

try:

2581

os.remove(tempname)

2582

except NameError:

2583

pass

2584

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2585

logger.warning("Could not save persistent state: {0}"

2586

.format(os.strerror(e.errno)))

2587

else:

2588

logger.warning("Could not save persistent state:",

2589

exc_info=e)

2590

raise e

2591

2592

# Delete all clients, and settings from config

2593

2005

while tcp_server.clients:

2594

name, client = tcp_server.clients.popitem()

2006

client = tcp_server.clients.pop()

2595

2007

if use_dbus:

2596

2008

client.remove_from_connection()

2009

client.disable_hook = None

2597

2010

# Don't signal anything except ClientRemoved

2598

2011

client.disable(quiet=True)

2599

2012

if use_dbus:

2600

2013

# Emit D-Bus signal

2601

mandos_dbus_service.ClientRemoved(client

2602

.dbus_object_path,

2014

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2603

2015

client.name)

2604

client_settings.clear()

2605

2016

2606

2017

atexit.register(cleanup)

2607

2018

2608

for client in tcp_server.clients.itervalues():

2019

for client in tcp_server.clients:

2609

2020

if use_dbus:

2610

2021

# Emit D-Bus signal

2611

2022

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2612

# Need to initiate checking of clients

2613

if client.enabled:

2614

client.init_checker()

2023

client.enable()

2615

2024

2616

2025

tcp_server.enable()

2617

2026

tcp_server.server_activate()

2620

2029

service.port = tcp_server.socket.getsockname()[1]

2621

2030

if use_ipv6:

2622

2031

logger.info("Now listening on address %r, port %d,"

2623

" flowinfo %d, scope_id %d",

2624

*tcp_server.socket.getsockname())

2032

" flowinfo %d, scope_id %d"

2033

% tcp_server.socket.getsockname())

2625

2034

else: # IPv4

2626

logger.info("Now listening on address %r, port %d",

2627

*tcp_server.socket.getsockname())

2035

logger.info("Now listening on address %r, port %d"

2036

% tcp_server.socket.getsockname())

2628

2037

2629

2038

#service.interface = tcp_server.socket.getsockname()[3]

2630

2039

2633

2042

try:

2634

2043

service.activate()

2635

2044

except dbus.exceptions.DBusException as error:

2636

logger.critical("D-Bus Exception", exc_info=error)

2045

logger.critical("DBusException: %s", error)

2637

2046

cleanup()

2638

2047

sys.exit(1)

2639

2048

# End of Avahi example code

2646

2055

logger.debug("Starting main loop")

2647

2056

main_loop.run()

2648

2057

except AvahiError as error:

2649

logger.critical("Avahi Error", exc_info=error)

2058

logger.critical("AvahiError: %s", error)

2650

2059

cleanup()

2651

2060

sys.exit(1)

2652

2061

except KeyboardInterrupt: