/mandos/trunk : revision 493

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

67

65

68

66

import dbus

69

67

import dbus.service

74

72

import ctypes.util

75

73

import xml.dom.minidom

76

74

import inspect

77

import Crypto.Cipher.AES

78

75

79

76

try:

80

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

SO_BINDTODEVICE = None

86

83

87

84

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

93

89

syslogger = (logging.handlers.SysLogHandler

94

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

91

address = str("/dev/log")))

99

95

logger.addHandler(syslogger)

100

96

101

97

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

104

99

' %(levelname)s:'

105

100

' %(message)s'))

106

101

logger.addHandler(console)

107

102

108

109

103

class AvahiError(Exception):

110

104

def __init__(self, value, *args, **kwargs):

111

105

self.value = value

165

159

" after %i retries, exiting.",

166

160

self.rename_count)

167

161

raise AvahiServiceError("Too many renames")

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

170

163

logger.info("Changing Zeroconf service name to %r ...",

171

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

172

169

self.remove()

173

170

try:

174

171

self.add()

194

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

195

192

self.entry_group_state_changed_match = (

196

193

self.group.connect_to_signal(

197

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

198

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

199

196

self.name, self.type)

200

197

self.group.AddService(

266

263

self.server_state_changed)

267

264

self.server_state_changed(self.server.GetState())

268

265

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

278

266

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

285

267

class Client(object):

286

268

"""A representation of a client host served by this server.

287

269

299

281

instance %(name)s can be used in the command.

300

282

checker_initiator_tag: a gobject event source tag, or None

301

283

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

304

284

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

305

286

disable_initiator_tag: a gobject event source tag, or None

306

287

enabled: bool()

307

288

fingerprint: string (40 or 32 hexadecimal digits); used to

310

291

interval: datetime.timedelta(); How often to start a new checker

311

292

last_approval_request: datetime.datetime(); (UTC) or None

312

293

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

316

294

last_enabled: datetime.datetime(); (UTC)

317

295

name: string; from the config file, used in log messages and

318

296

D-Bus identifiers

319

297

secret: bytestring; sent verbatim (over TLS) to client

320

298

timeout: datetime.timedelta(); How long from last_checked_ok

321

299

until this client is disabled

322

extended_timeout: extra long timeout when password has been sent

323

300

runtime_expansions: Allowed attributes for runtime expansion.

324

expires: datetime.datetime(); time (UTC) when a client will be

325

disabled, or None

326

301

"""

327

302

328

303

runtime_expansions = ("approval_delay", "approval_duration",

330

305

"host", "interval", "last_checked_ok",

331

306

"last_enabled", "name", "timeout")

332

307

308

@staticmethod

309

def _timedelta_to_milliseconds(td):

310

"Convert a datetime.timedelta() to milliseconds"

311

return ((td.days * 24 * 60 * 60 * 1000)

312

+ (td.seconds * 1000)

313

+ (td.microseconds // 1000))

314

333

315

def timeout_milliseconds(self):

334

316

"Return the 'timeout' attribute in milliseconds"

335

return _timedelta_to_milliseconds(self.timeout)

336

337

def extended_timeout_milliseconds(self):

338

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

317

return self._timedelta_to_milliseconds(self.timeout)

340

318

341

319

def interval_milliseconds(self):

342

320

"Return the 'interval' attribute in milliseconds"

343

return _timedelta_to_milliseconds(self.interval)

344

321

return self._timedelta_to_milliseconds(self.interval)

322

345

323

def approval_delay_milliseconds(self):

346

return _timedelta_to_milliseconds(self.approval_delay)

324

return self._timedelta_to_milliseconds(self.approval_delay)

347

325

348

def __init__(self, name = None, config=None):

326

def __init__(self, name = None, disable_hook=None, config=None):

349

327

"""Note: the 'checker' key in 'config' sets the

350

328

'checker_command' attribute and *not* the 'checker'

351

329

attribute."""

371

349

% self.name)

372

350

self.host = config.get("host", "")

373

351

self.created = datetime.datetime.utcnow()

374

self.enabled = True

352

self.enabled = False

375

353

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

354

self.last_enabled = None

377

355

self.last_checked_ok = None

378

self.last_checker_status = None

379

356

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

382

357

self.interval = string_to_delta(config["interval"])

358

self.disable_hook = disable_hook

383

359

self.checker = None

384

360

self.checker_initiator_tag = None

385

361

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

387

362

self.checker_callback_tag = None

388

363

self.checker_command = config["checker"]

389

364

self.current_checker_command = None

365

self.last_connect = None

390

366

self._approved = None

391

367

self.approved_by_default = config.get("approved_by_default",

392

368

True)

395

371

config["approval_delay"])

396

372

self.approval_duration = string_to_delta(

397

373

config["approval_duration"])

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

374

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

409

375

410

# Send notice to process children that client state has changed

411

376

def send_changedstate(self):

412

with self.changedstate:

413

self.changedstate.notify_all()

414

377

self.changedstate.acquire()

378

self.changedstate.notify_all()

379

self.changedstate.release()

380

415

381

def enable(self):

416

382

"""Start this client's checker and timeout hooks"""

417

383

if getattr(self, "enabled", False):

418

384

# Already enabled

419

385

return

420

386

self.send_changedstate()

421

self.expires = datetime.datetime.utcnow() + self.timeout

387

self.last_enabled = datetime.datetime.utcnow()

388

# Schedule a new checker to be started an 'interval' from now,

389

# and every interval from then on.

390

self.checker_initiator_tag = (gobject.timeout_add

391

(self.interval_milliseconds(),

392

self.start_checker))

393

# Schedule a disable() when 'timeout' has passed

394

self.disable_initiator_tag = (gobject.timeout_add

395

(self.timeout_milliseconds(),

396

self.disable))

422

397

self.enabled = True

423

self.last_enabled = datetime.datetime.utcnow()

424

self.init_checker()

398

# Also start a new checker *right now*.

399

self.start_checker()

425

400

426

401

def disable(self, quiet=True):

427

402

"""Disable this client."""

434

409

if getattr(self, "disable_initiator_tag", False):

435

410

gobject.source_remove(self.disable_initiator_tag)

436

411

self.disable_initiator_tag = None

437

self.expires = None

438

412

if getattr(self, "checker_initiator_tag", False):

439

413

gobject.source_remove(self.checker_initiator_tag)

440

414

self.checker_initiator_tag = None

441

415

self.stop_checker()

416

if self.disable_hook:

417

self.disable_hook(self)

442

418

self.enabled = False

443

419

# Do not run this again if called by a gobject.timeout_add

444

420

return False

445

421

446

422

def __del__(self):

423

self.disable_hook = None

447

424

self.disable()

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

425

463

426

def checker_callback(self, pid, condition, command):

464

427

"""The checker has completed, so take appropriate actions."""

465

428

self.checker_callback_tag = None

466

429

self.checker = None

467

430

if os.WIFEXITED(condition):

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

431

exitstatus = os.WEXITSTATUS(condition)

432

if exitstatus == 0:

470

433

logger.info("Checker for %(name)s succeeded",

471

434

vars(self))

472

435

self.checked_ok()

474

437

logger.info("Checker for %(name)s failed",

475

438

vars(self))

476

439

else:

477

self.last_checker_status = -1

478

440

logger.warning("Checker for %(name)s crashed?",

479

441

vars(self))

480

442

481

def checked_ok(self, timeout=None):

443

def checked_ok(self):

482

444

"""Bump up the timeout for this client.

483

445

484

446

This should only be called when the client has been seen,

485

447

alive and well.

486

448

"""

487

if timeout is None:

488

timeout = self.timeout

489

449

self.last_checked_ok = datetime.datetime.utcnow()

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

450

gobject.source_remove(self.disable_initiator_tag)

451

self.disable_initiator_tag = (gobject.timeout_add

452

(self.timeout_milliseconds(),

453

self.disable))

497

454

498

455

def need_approval(self):

499

456

self.last_approval_request = datetime.datetime.utcnow()

539

496

'replace')))

540

497

for attr in

541

498

self.runtime_expansions)

542

499

543

500

try:

544

501

command = self.checker_command % escaped_attrs

545

502

except TypeError as error:

591

548

raise

592

549

self.checker = None

593

550

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

640

641

551

def dbus_service_property(dbus_interface, signature="v",

642

552

access="readwrite", byte_arrays=False):

643

553

"""Decorators for marking methods of a DBusObjectWithProperties to

689

599

690

600

class DBusObjectWithProperties(dbus.service.Object):

691

601

"""A D-Bus object with properties.

692

602

693

603

Classes inheriting from this can use the dbus_service_property

694

604

decorator to expose methods as D-Bus properties. It exposes the

695

605

standard Get(), Set(), and GetAll() methods on the D-Bus.

702

612

def _get_all_dbus_properties(self):

703

613

"""Returns a generator of (name, attribute) pairs

704

614

"""

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

706

for cls in self.__class__.__mro__

615

return ((prop._dbus_name, prop)

707

616

for name, prop in

708

inspect.getmembers(cls, self._is_dbus_property))

617

inspect.getmembers(self, self._is_dbus_property))

709

618

710

619

def _get_dbus_property(self, interface_name, property_name):

711

620

"""Returns a bound method if one exists which is a D-Bus

712

621

property with the specified name and interface.

713

622

"""

714

for cls in self.__class__.__mro__:

715

for name, value in (inspect.getmembers

716

(cls, self._is_dbus_property)):

717

if (value._dbus_name == property_name

718

and value._dbus_interface == interface_name):

719

return value.__get__(self)

720

623

for name in (property_name,

624

property_name + "_dbus_property"):

625

prop = getattr(self, name, None)

626

if (prop is None

627

or not self._is_dbus_property(prop)

628

or prop._dbus_name != property_name

629

or (interface_name and prop._dbus_interface

630

and interface_name != prop._dbus_interface)):

631

continue

632

return prop

721

633

# No such property

722

634

raise DBusPropertyNotFound(self.dbus_object_path + ":"

723

635

+ interface_name + "."

757

669

def GetAll(self, interface_name):

758

670

"""Standard D-Bus property GetAll() method, see D-Bus

759

671

standard.

760

672

761

673

Note: Will not include properties with access="write".

762

674

"""

763

675

all = {}

825

737

return xmlstring

826

738

827

739

828

def datetime_to_dbus (dt, variant_level=0):

829

"""Convert a UTC datetime.datetime() to a D-Bus type."""

830

if dt is None:

831

return dbus.String("", variant_level = variant_level)

832

return dbus.String(dt.isoformat(),

833

variant_level=variant_level)

834

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

839

"""

840

def __new__(mcs, name, bases, attr):

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

847

# Ignore non-D-Bus attributes, and D-Bus attributes

848

# with the wrong interface name

849

if (not hasattr(attribute, "_dbus_interface")

850

or not attribute._dbus_interface

851

.startswith("se.recompile.Mandos")):

852

continue

853

# Create an alternate D-Bus interface name based on

854

# the current name

855

alt_interface = (attribute._dbus_interface

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

858

# Is this a D-Bus signal?

859

if getattr(attribute, "_dbus_is_signal", False):

860

# Extract the original non-method function by

861

# black magic

862

nonmethod_func = (dict(

863

zip(attribute.func_code.co_freevars,

864

attribute.__closure__))["func"]

865

.cell_contents)

866

# Create a new, but exactly alike, function

867

# object, and decorate it to be a new D-Bus signal

868

# with the alternate D-Bus interface name

869

new_function = (dbus.service.signal

870

(alt_interface,

871

attribute._dbus_signature)

872

(types.FunctionType(

873

nonmethod_func.func_code,

874

nonmethod_func.func_globals,

875

nonmethod_func.func_name,

876

nonmethod_func.func_defaults,

877

nonmethod_func.func_closure)))

878

# Define a creator of a function to call both the

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

881

def fixscope(func1, func2):

882

"""This function is a scope container to pass

883

func1 and func2 to the "call_both" function

884

outside of its arguments"""

885

def call_both(*args, **kwargs):

886

"""This function will emit two D-Bus

887

signals by calling func1 and func2"""

888

func1(*args, **kwargs)

889

func2(*args, **kwargs)

890

return call_both

891

# Create the "call_both" function and add it to

892

# the class

893

attr[attrname] = fixscope(attribute,

894

new_function)

895

# Is this a D-Bus method?

896

elif getattr(attribute, "_dbus_is_method", False):

897

# Create a new, but exactly alike, function

898

# object. Decorate it to be a new D-Bus method

899

# with the alternate D-Bus interface name. Add it

900

# to the class.

901

attr[attrname] = (dbus.service.method

902

(alt_interface,

903

attribute._dbus_in_signature,

904

attribute._dbus_out_signature)

905

(types.FunctionType

906

(attribute.func_code,

907

attribute.func_globals,

908

attribute.func_name,

909

attribute.func_defaults,

910

attribute.func_closure)))

911

# Is this a D-Bus property?

912

elif getattr(attribute, "_dbus_is_property", False):

913

# Create a new, but exactly alike, function

914

# object, and decorate it to be a new D-Bus

915

# property with the alternate D-Bus interface

916

# name. Add it to the class.

917

attr[attrname] = (dbus_service_property

918

(alt_interface,

919

attribute._dbus_signature,

920

attribute._dbus_access,

921

attribute

922

._dbus_get_args_options

923

["byte_arrays"])

924

(types.FunctionType

925

(attribute.func_code,

926

attribute.func_globals,

927

attribute.func_name,

928

attribute.func_defaults,

929

attribute.func_closure)))

930

return type.__new__(mcs, name, bases, attr)

931

932

740

class ClientDBus(Client, DBusObjectWithProperties):

933

741

"""A Client class using D-Bus

934

742

943

751

# dbus.service.Object doesn't use super(), so we can't either.

944

752

945

753

def __init__(self, bus = None, *args, **kwargs):

754

self._approvals_pending = 0

946

755

self.bus = bus

947

756

Client.__init__(self, *args, **kwargs)

948

949

self._approvals_pending = 0

950

757

# Only now, when this client is initialized, can it show up on

951

758

# the D-Bus

952

759

client_object_name = unicode(self.name).translate(

957

764

DBusObjectWithProperties.__init__(self, self.bus,

958

765

self.dbus_object_path)

959

766

960

def notifychangeproperty(transform_func,

961

dbus_name, type_func=lambda x: x,

962

variant_level=1):

963

""" Modify a variable so that it's a property which announces

964

its changes to DBus.

767

def _get_approvals_pending(self):

768

return self._approvals_pending

769

def _set_approvals_pending(self, value):

770

old_value = self._approvals_pending

771

self._approvals_pending = value

772

bval = bool(value)

773

if (hasattr(self, "dbus_object_path")

774

and bval is not bool(old_value)):

775

dbus_bool = dbus.Boolean(bval, variant_level=1)

776

self.PropertyChanged(dbus.String("ApprovalPending"),

777

dbus_bool)

965

778

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

968

dbus_name: D-Bus name of the variable

969

type_func: Function that transform the value before sending it

970

to the D-Bus. Default: no transform

971

variant_level: D-Bus variant level. Default: 1

972

"""

973

attrname = "_{0}".format(dbus_name)

974

def setter(self, value):

975

if hasattr(self, "dbus_object_path"):

976

if (not hasattr(self, attrname) or

977

type_func(getattr(self, attrname, None))

978

!= type_func(value)):

979

dbus_value = transform_func(type_func(value),

980

variant_level

981

=variant_level)

982

self.PropertyChanged(dbus.String(dbus_name),

983

dbus_value)

984

setattr(self, attrname, value)

985

986

return property(lambda self: getattr(self, attrname), setter)

987

988

989

expires = notifychangeproperty(datetime_to_dbus, "Expires")

990

approvals_pending = notifychangeproperty(dbus.Boolean,

991

"ApprovalPending",

992

type_func = bool)

993

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

994

last_enabled = notifychangeproperty(datetime_to_dbus,

995

"LastEnabled")

996

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

997

type_func = lambda checker:

998

checker is not None)

999

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1000

"LastCheckedOK")

1001

last_approval_request = notifychangeproperty(

1002

datetime_to_dbus, "LastApprovalRequest")

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

1004

"ApprovedByDefault")

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1006

"ApprovalDelay",

1007

type_func =

1008

_timedelta_to_milliseconds)

1009

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

1012

host = notifychangeproperty(dbus.String, "Host")

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1014

type_func =

1015

_timedelta_to_milliseconds)

1016

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1020

"Interval",

1021

type_func =

1022

_timedelta_to_milliseconds)

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

1024

1025

del notifychangeproperty

779

approvals_pending = property(_get_approvals_pending,

780

_set_approvals_pending)

781

del _get_approvals_pending, _set_approvals_pending

782

783

@staticmethod

784

def _datetime_to_dbus(dt, variant_level=0):

785

"""Convert a UTC datetime.datetime() to a D-Bus type."""

786

return dbus.String(dt.isoformat(),

787

variant_level=variant_level)

788

789

def enable(self):

790

oldstate = getattr(self, "enabled", False)

791

r = Client.enable(self)

792

if oldstate != self.enabled:

793

# Emit D-Bus signals

794

self.PropertyChanged(dbus.String("Enabled"),

795

dbus.Boolean(True, variant_level=1))

796

self.PropertyChanged(

797

dbus.String("LastEnabled"),

798

self._datetime_to_dbus(self.last_enabled,

799

variant_level=1))

800

return r

801

802

def disable(self, quiet = False):

803

oldstate = getattr(self, "enabled", False)

804

r = Client.disable(self, quiet=quiet)

805

if not quiet and oldstate != self.enabled:

806

# Emit D-Bus signal

807

self.PropertyChanged(dbus.String("Enabled"),

808

dbus.Boolean(False, variant_level=1))

809

return r

1026

810

1027

811

def __del__(self, *args, **kwargs):

1028

812

try:

1037

821

*args, **kwargs):

1038

822

self.checker_callback_tag = None

1039

823

self.checker = None

824

# Emit D-Bus signal

825

self.PropertyChanged(dbus.String("CheckerRunning"),

826

dbus.Boolean(False, variant_level=1))

1040

827

if os.WIFEXITED(condition):

1041

828

exitstatus = os.WEXITSTATUS(condition)

1042

829

# Emit D-Bus signal

1052

839

return Client.checker_callback(self, pid, condition, command,

1053

840

*args, **kwargs)

1054

841

842

def checked_ok(self, *args, **kwargs):

843

Client.checked_ok(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastCheckedOK"),

847

(self._datetime_to_dbus(self.last_checked_ok,

848

variant_level=1)))

849

850

def need_approval(self, *args, **kwargs):

851

r = Client.need_approval(self, *args, **kwargs)

852

# Emit D-Bus signal

853

self.PropertyChanged(

854

dbus.String("LastApprovalRequest"),

855

(self._datetime_to_dbus(self.last_approval_request,

856

variant_level=1)))

857

return r

858

1055

859

def start_checker(self, *args, **kwargs):

1056

860

old_checker = self.checker

1057

861

if self.checker is not None:

1064

868

and old_checker_pid != self.checker.pid):

1065

869

# Emit D-Bus signal

1066

870

self.CheckerStarted(self.current_checker_command)

871

self.PropertyChanged(

872

dbus.String("CheckerRunning"),

873

dbus.Boolean(True, variant_level=1))

1067

874

return r

1068

875

876

def stop_checker(self, *args, **kwargs):

877

old_checker = getattr(self, "checker", None)

878

r = Client.stop_checker(self, *args, **kwargs)

879

if (old_checker is not None

880

and getattr(self, "checker", None) is None):

881

self.PropertyChanged(dbus.String("CheckerRunning"),

882

dbus.Boolean(False, variant_level=1))

883

return r

884

1069

885

def _reset_approved(self):

1070

886

self._approved = None

1071

887

return False

1073

889

def approve(self, value=True):

1074

890

self.send_changedstate()

1075

891

self._approved = value

1076

gobject.timeout_add(_timedelta_to_milliseconds

892

gobject.timeout_add(self._timedelta_to_milliseconds

1077

893

(self.approval_duration),

1078

894

self._reset_approved)

1079

895

1080

896

1081

897

## D-Bus methods, signals & properties

1082

_interface = "se.recompile.Mandos.Client"

898

_interface = "se.bsnet.fukt.Mandos.Client"

1083

899

1084

900

## Signals

1085

901

1171

987

if value is None: # get

1172

988

return dbus.Boolean(self.approved_by_default)

1173

989

self.approved_by_default = bool(value)

990

# Emit D-Bus signal

991

self.PropertyChanged(dbus.String("ApprovedByDefault"),

992

dbus.Boolean(value, variant_level=1))

1174

993

1175

994

# ApprovalDelay - property

1176

995

@dbus_service_property(_interface, signature="t",

1179

998

if value is None: # get

1180

999

return dbus.UInt64(self.approval_delay_milliseconds())

1181

1000

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1001

# Emit D-Bus signal

1002

self.PropertyChanged(dbus.String("ApprovalDelay"),

1003

dbus.UInt64(value, variant_level=1))

1182

1004

1183

1005

# ApprovalDuration - property

1184

1006

@dbus_service_property(_interface, signature="t",

1185

1007

access="readwrite")

1186

1008

def ApprovalDuration_dbus_property(self, value=None):

1187

1009

if value is None: # get

1188

return dbus.UInt64(_timedelta_to_milliseconds(

1010

return dbus.UInt64(self._timedelta_to_milliseconds(

1189

1011

self.approval_duration))

1190

1012

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1013

# Emit D-Bus signal

1014

self.PropertyChanged(dbus.String("ApprovalDuration"),

1015

dbus.UInt64(value, variant_level=1))

1191

1016

1192

1017

# Name - property

1193

1018

@dbus_service_property(_interface, signature="s", access="read")

1206

1031

if value is None: # get

1207

1032

return dbus.String(self.host)

1208

1033

self.host = value

1034

# Emit D-Bus signal

1035

self.PropertyChanged(dbus.String("Host"),

1036

dbus.String(value, variant_level=1))

1209

1037

1210

1038

# Created - property

1211

1039

@dbus_service_property(_interface, signature="s", access="read")

1212

1040

def Created_dbus_property(self):

1213

return dbus.String(datetime_to_dbus(self.created))

1041

return dbus.String(self._datetime_to_dbus(self.created))

1214

1042

1215

1043

# LastEnabled - property

1216

1044

@dbus_service_property(_interface, signature="s", access="read")

1217

1045

def LastEnabled_dbus_property(self):

1218

return datetime_to_dbus(self.last_enabled)

1046

if self.last_enabled is None:

1047

return dbus.String("")

1048

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1219

1049

1220

1050

# Enabled - property

1221

1051

@dbus_service_property(_interface, signature="b",

1235

1065

if value is not None:

1236

1066

self.checked_ok()

1237

1067

return

1238

return datetime_to_dbus(self.last_checked_ok)

1239

1240

# Expires - property

1241

@dbus_service_property(_interface, signature="s", access="read")

1242

def Expires_dbus_property(self):

1243

return datetime_to_dbus(self.expires)

1068

if self.last_checked_ok is None:

1069

return dbus.String("")

1070

return dbus.String(self._datetime_to_dbus(self

1071

.last_checked_ok))

1244

1072

1245

1073

# LastApprovalRequest - property

1246

1074

@dbus_service_property(_interface, signature="s", access="read")

1247

1075

def LastApprovalRequest_dbus_property(self):

1248

return datetime_to_dbus(self.last_approval_request)

1076

if self.last_approval_request is None:

1077

return dbus.String("")

1078

return dbus.String(self.

1079

_datetime_to_dbus(self

1080

.last_approval_request))

1249

1081

1250

1082

# Timeout - property

1251

1083

@dbus_service_property(_interface, signature="t",

1254

1086

if value is None: # get

1255

1087

return dbus.UInt64(self.timeout_milliseconds())

1256

1088

self.timeout = datetime.timedelta(0, 0, 0, value)

1089

# Emit D-Bus signal

1090

self.PropertyChanged(dbus.String("Timeout"),

1091

dbus.UInt64(value, variant_level=1))

1257

1092

if getattr(self, "disable_initiator_tag", None) is None:

1258

1093

return

1259

1094

# Reschedule timeout

1260

1095

gobject.source_remove(self.disable_initiator_tag)

1261

1096

self.disable_initiator_tag = None

1262

self.expires = None

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1097

time_to_die = (self.

1098

_timedelta_to_milliseconds((self

1099

.last_checked_ok

1100

+ self.timeout)

1101

- datetime.datetime

1102

.utcnow()))

1268

1103

if time_to_die <= 0:

1269

1104

# The timeout has passed

1270

1105

self.disable()

1271

1106

else:

1272

self.expires = (datetime.datetime.utcnow()

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1275

1107

self.disable_initiator_tag = (gobject.timeout_add

1276

1108

(time_to_die, self.disable))

1277

1109

1278

# ExtendedTimeout - property

1279

@dbus_service_property(_interface, signature="t",

1280

access="readwrite")

1281

def ExtendedTimeout_dbus_property(self, value=None):

1282

if value is None: # get

1283

return dbus.UInt64(self.extended_timeout_milliseconds())

1284

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1285

1286

1110

# Interval - property

1287

1111

@dbus_service_property(_interface, signature="t",

1288

1112

access="readwrite")

1290

1114

if value is None: # get

1291

1115

return dbus.UInt64(self.interval_milliseconds())

1292

1116

self.interval = datetime.timedelta(0, 0, 0, value)

1117

# Emit D-Bus signal

1118

self.PropertyChanged(dbus.String("Interval"),

1119

dbus.UInt64(value, variant_level=1))

1293

1120

if getattr(self, "checker_initiator_tag", None) is None:

1294

1121

return

1295

1122

# Reschedule checker run

1297

1124

self.checker_initiator_tag = (gobject.timeout_add

1298

1125

(value, self.start_checker))

1299

1126

self.start_checker() # Start one now, too

1300

1127

1301

1128

# Checker - property

1302

1129

@dbus_service_property(_interface, signature="s",

1303

1130

access="readwrite")

1305

1132

if value is None: # get

1306

1133

return dbus.String(self.checker_command)

1307

1134

self.checker_command = value

1135

# Emit D-Bus signal

1136

self.PropertyChanged(dbus.String("Checker"),

1137

dbus.String(self.checker_command,

1138

variant_level=1))

1308

1139

1309

1140

# CheckerRunning - property

1310

1141

@dbus_service_property(_interface, signature="b",

1337

1168

self._pipe.send(('init', fpr, address))

1338

1169

if not self._pipe.recv():

1339

1170

raise KeyError()

1340

1171

1341

1172

def __getattribute__(self, name):

1342

1173

if(name == '_pipe'):

1343

1174

return super(ProxyClient, self).__getattribute__(name)

1350

1181

self._pipe.send(('funcall', name, args, kwargs))

1351

1182

return self._pipe.recv()[1]

1352

1183

return func

1353

1184

1354

1185

def __setattr__(self, name, value):

1355

1186

if(name == '_pipe'):

1356

1187

return super(ProxyClient, self).__setattr__(name, value)

1357

1188

self._pipe.send(('setattr', name, value))

1358

1189

1359

class ClientDBusTransitional(ClientDBus):

1360

__metaclass__ = AlternateDBusNamesMetaclass

1361

1190

1362

1191

class ClientHandler(socketserver.BaseRequestHandler, object):

1363

1192

"""A class to handle client connections.

1371

1200

unicode(self.client_address))

1372

1201

logger.debug("Pipe FD: %d",

1373

1202

self.server.child_pipe.fileno())

1374

1203

1375

1204

session = (gnutls.connection

1376

1205

.ClientSession(self.request,

1377

1206

gnutls.connection

1378

1207

.X509Credentials()))

1379

1208

1380

1209

# Note: gnutls.connection.X509Credentials is really a

1381

1210

# generic GnuTLS certificate credentials object so long as

1382

1211

# no X.509 keys are added to it. Therefore, we can use it

1383

1212

# here despite using OpenPGP certificates.

1384

1213

1385

1214

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1386

1215

# "+AES-256-CBC", "+SHA1",

1387

1216

# "+COMP-NULL", "+CTYPE-OPENPGP",

1393

1222

(gnutls.library.functions

1394

1223

.gnutls_priority_set_direct(session._c_object,

1395

1224

priority, None))

1396

1225

1397

1226

# Start communication using the Mandos protocol

1398

1227

# Get protocol number

1399

1228

line = self.request.makefile().readline()

1404

1233

except (ValueError, IndexError, RuntimeError) as error:

1405

1234

logger.error("Unknown protocol version: %s", error)

1406

1235

return

1407

1236

1408

1237

# Start GnuTLS connection

1409

1238

try:

1410

1239

session.handshake()

1414

1243

# established. Just abandon the request.

1415

1244

return

1416

1245

logger.debug("Handshake succeeded")

1417

1246

1418

1247

approval_required = False

1419

1248

try:

1420

1249

try:

1425

1254

logger.warning("Bad certificate: %s", error)

1426

1255

return

1427

1256

logger.debug("Fingerprint: %s", fpr)

1428

1257

1429

1258

try:

1430

1259

client = ProxyClient(child_pipe, fpr,

1431

1260

self.client_address)

1443

1272

client.name)

1444

1273

if self.server.use_dbus:

1445

1274

# Emit D-Bus signal

1446

client.Rejected("Disabled")

1275

client.Rejected("Disabled")

1447

1276

return

1448

1277

1449

1278

if client._approved or not client.approval_delay:

1466

1295

return

1467

1296

1468

1297

#wait until timeout or approved

1298

#x = float(client._timedelta_to_milliseconds(delay))

1469

1299

time = datetime.datetime.now()

1470

1300

client.changedstate.acquire()

1471

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1473

/ 1000)))

1301

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1474

1302

client.changedstate.release()

1475

1303

time2 = datetime.datetime.now()

1476

1304

if (time2 - time) >= delay:

1498

1326

sent, len(client.secret)

1499

1327

- (sent_size + sent))

1500

1328

sent_size += sent

1501

1329

1502

1330

logger.info("Sending secret to %s", client.name)

1503

# bump the timeout using extended_timeout

1504

client.checked_ok(client.extended_timeout)

1331

# bump the timeout as if seen

1332

client.checked_ok()

1505

1333

if self.server.use_dbus:

1506

1334

# Emit D-Bus signal

1507

1335

client.GotSecret()

1586

1414

except:

1587

1415

self.handle_error(request, address)

1588

1416

self.close_request(request)

1589

1417

1590

1418

def process_request(self, request, address):

1591

1419

"""Start a new process to process the request."""

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1593

args = (request,

1594

address))

1595

proc.start()

1596

return proc

1597

1420

multiprocessing.Process(target = self.sub_process_main,

1421

args = (request, address)).start()

1598

1422

1599

1423

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1600

1424

""" adds a pipe to the MixIn """

1604

1428

This function creates a new pipe in self.pipe

1605

1429

"""

1606

1430

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1607

1608

proc = MultiprocessingMixIn.process_request(self, request,

1609

client_address)

1431

1432

super(MultiprocessingMixInWithPipe,

1433

self).process_request(request, client_address)

1610

1434

self.child_pipe.close()

1611

self.add_pipe(parent_pipe, proc)

1612

1613

def add_pipe(self, parent_pipe, proc):

1435

self.add_pipe(parent_pipe)

1436

1437

def add_pipe(self, parent_pipe):

1614

1438

"""Dummy function; override as necessary"""

1615

1439

raise NotImplementedError

1616

1440

1617

1618

1441

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1619

1442

socketserver.TCPServer, object):

1620

1443

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1694

1517

self.enabled = False

1695

1518

self.clients = clients

1696

1519

if self.clients is None:

1697

self.clients = {}

1520

self.clients = set()

1698

1521

self.use_dbus = use_dbus

1699

1522

self.gnutls_priority = gnutls_priority

1700

1523

IPv6_TCPServer.__init__(self, server_address,

1704

1527

def server_activate(self):

1705

1528

if self.enabled:

1706

1529

return socketserver.TCPServer.server_activate(self)

1707

1708

1530

def enable(self):

1709

1531

self.enabled = True

1710

1711

def add_pipe(self, parent_pipe, proc):

1532

def add_pipe(self, parent_pipe):

1712

1533

# Call "handle_ipc" for both data and EOF events

1713

1534

gobject.io_add_watch(parent_pipe.fileno(),

1714

1535

gobject.IO_IN | gobject.IO_HUP,

1715

1536

functools.partial(self.handle_ipc,

1716

parent_pipe =

1717

parent_pipe,

1718

proc = proc))

1719

1537

parent_pipe = parent_pipe))

1538

1720

1539

def handle_ipc(self, source, condition, parent_pipe=None,

1721

proc = None, client_object=None):

1540

client_object=None):

1722

1541

condition_names = {

1723

1542

gobject.IO_IN: "IN", # There is data to read.

1724

1543

gobject.IO_OUT: "OUT", # Data can be written (without

1733

1552

for cond, name in

1734

1553

condition_names.iteritems()

1735

1554

if cond & condition)

1736

# error, or the other end of multiprocessing.Pipe has closed

1555

# error or the other end of multiprocessing.Pipe has closed

1737

1556

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1738

# Wait for other process to exit

1739

proc.join()

1740

1557

return False

1741

1558

1742

1559

# Read a request from the child

1747

1564

fpr = request[1]

1748

1565

address = request[2]

1749

1566

1750

for c in self.clients.itervalues():

1567

for c in self.clients:

1751

1568

if c.fingerprint == fpr:

1752

1569

client = c

1753

1570

break

1756

1573

"dress: %s", fpr, address)

1757

1574

if self.use_dbus:

1758

1575

# Emit D-Bus signal

1759

mandos_dbus_service.ClientNotFound(fpr,

1760

address[0])

1576

mandos_dbus_service.ClientNotFound(fpr, address[0])

1761

1577

parent_pipe.send(False)

1762

1578

return False

1763

1579

1764

1580

gobject.io_add_watch(parent_pipe.fileno(),

1765

1581

gobject.IO_IN | gobject.IO_HUP,

1766

1582

functools.partial(self.handle_ipc,

1767

parent_pipe =

1768

parent_pipe,

1769

proc = proc,

1770

client_object =

1771

client))

1583

parent_pipe = parent_pipe,

1584

client_object = client))

1772

1585

parent_pipe.send(True)

1773

# remove the old hook in favor of the new above hook on

1774

# same fileno

1586

# remove the old hook in favor of the new above hook on same fileno

1775

1587

return False

1776

1588

if command == 'funcall':

1777

1589

funcname = request[1]

1778

1590

args = request[2]

1779

1591

kwargs = request[3]

1780

1592

1781

parent_pipe.send(('data', getattr(client_object,

1782

funcname)(*args,

1783

**kwargs)))

1784

1593

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1594

1785

1595

if command == 'getattr':

1786

1596

attrname = request[1]

1787

1597

if callable(client_object.__getattribute__(attrname)):

1788

1598

parent_pipe.send(('function',))

1789

1599

else:

1790

parent_pipe.send(('data', client_object

1791

.__getattribute__(attrname)))

1600

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1792

1601

1793

1602

if command == 'setattr':

1794

1603

attrname = request[1]

1795

1604

value = request[2]

1796

1605

setattr(client_object, attrname, value)

1797

1606

1798

1607

return True

1799

1608

1800

1609

1921

1730

" system bus interface")

1922

1731

parser.add_argument("--no-ipv6", action="store_false",

1923

1732

dest="use_ipv6", help="Do not use IPv6")

1924

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

1928

1733

options = parser.parse_args()

1929

1734

1930

1735

if options.check:

1965

1770

# options, if set.

1966

1771

for option in ("interface", "address", "port", "debug",

1967

1772

"priority", "servicename", "configdir",

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1773

"use_dbus", "use_ipv6", "debuglevel"):

1969

1774

value = getattr(options, option)

1970

1775

if value is not None:

1971

1776

server_settings[option] = value

1983

1788

debuglevel = server_settings["debuglevel"]

1984

1789

use_dbus = server_settings["use_dbus"]

1985

1790

use_ipv6 = server_settings["use_ipv6"]

1986

1791

1987

1792

if server_settings["servicename"] != "Mandos":

1988

1793

syslogger.setFormatter(logging.Formatter

1989

1794

('Mandos (%s) [%%(process)d]:'

1991

1796

% server_settings["servicename"]))

1992

1797

1993

1798

# Parse config file with clients

1994

client_defaults = { "timeout": "5m",

1995

"extended_timeout": "15m",

1996

"interval": "2m",

1799

client_defaults = { "timeout": "1h",

1800

"interval": "5m",

1997

1801

"checker": "fping -q -- %%(host)s",

1998

1802

"host": "",

1999

1803

"approval_delay": "0s",

2044

1848

raise error

2045

1849

2046

1850

if not debug and not debuglevel:

2047

logger.setLevel(logging.WARNING)

1851

syslogger.setLevel(logging.WARNING)

1852

console.setLevel(logging.WARNING)

2048

1853

if debuglevel:

2049

1854

level = getattr(logging, debuglevel.upper())

2050

logger.setLevel(level)

2051

1855

syslogger.setLevel(level)

1856

console.setLevel(level)

1857

2052

1858

if debug:

2053

logger.setLevel(logging.DEBUG)

2054

1859

# Enable all possible GnuTLS debugging

2055

1860

2056

1861

# "Use a log level over 10 to enable all debugging options."

2086

1891

# End of Avahi example code

2087

1892

if use_dbus:

2088

1893

try:

2089

bus_name = dbus.service.BusName("se.recompile.Mandos",

1894

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2090

1895

bus, do_not_queue=True)

2091

old_bus_name = (dbus.service.BusName

2092

("se.bsnet.fukt.Mandos", bus,

2093

do_not_queue=True))

2094

1896

except dbus.exceptions.NameExistsException as e:

2095

1897

logger.error(unicode(e) + ", disabling D-Bus")

2096

1898

use_dbus = False

2097

1899

server_settings["use_dbus"] = False

2098

1900

tcp_server.use_dbus = False

2099

1901

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2100

service = AvahiServiceToSyslog(name =

2101

server_settings["servicename"],

2102

servicetype = "_mandos._tcp",

2103

protocol = protocol, bus = bus)

1902

service = AvahiService(name = server_settings["servicename"],

1903

servicetype = "_mandos._tcp",

1904

protocol = protocol, bus = bus)

2104

1905

if server_settings["interface"]:

2105

1906

service.interface = (if_nametoindex

2106

1907

(str(server_settings["interface"])))

2110

1911

2111

1912

client_class = Client

2112

1913

if use_dbus:

2113

client_class = functools.partial(ClientDBusTransitional,

2114

bus = bus)

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2133

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2137

if server_settings["restore"]:

2138

try:

2139

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2141

os.remove(stored_state_path)

2142

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2145

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

1914

client_class = functools.partial(ClientDBus, bus = bus)

1915

def client_config_items(config, section):

1916

special_settings = {

1917

"approved_by_default":

1918

lambda: config.getboolean(section,

1919

"approved_by_default"),

1920

}

1921

for name, value in config.items(section):

2156

1922

try:

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

1923

yield (name, special_settings[name]())

2162

1924

except KeyError:

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

1925

yield (name, value)

2209

1926

2210

1927

tcp_server.clients.update(set(

1928

client_class(name = section,

1929

config= dict(client_config_items(

1930

client_config, section)))

1931

for section in client_config.sections()))

2211

1932

if not tcp_server.clients:

2212

1933

logger.warning("No clients defined")

2213

1934

2226

1947

del pidfilename

2227

1948

2228

1949

signal.signal(signal.SIGINT, signal.SIG_IGN)

2229

1950

2230

1951

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2231

1952

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2232

1953

2235

1956

"""A D-Bus proxy object"""

2236

1957

def __init__(self):

2237

1958

dbus.service.Object.__init__(self, bus, "/")

2238

_interface = "se.recompile.Mandos"

1959

_interface = "se.bsnet.fukt.Mandos"

2239

1960

2240

1961

@dbus.service.signal(_interface, signature="o")

2241

1962

def ClientAdded(self, objpath):

2256

1977

def GetAllClients(self):

2257

1978

"D-Bus method"

2258

1979

return dbus.Array(c.dbus_object_path

2259

for c in

2260

tcp_server.clients.itervalues())

1980

for c in tcp_server.clients)

2261

1981

2262

1982

@dbus.service.method(_interface,

2263

1983

out_signature="a{oa{sv}}")

2265

1985

"D-Bus method"

2266

1986

return dbus.Dictionary(

2267

1987

((c.dbus_object_path, c.GetAll(""))

2268

for c in tcp_server.clients.itervalues()),

1988

for c in tcp_server.clients),

2269

1989

signature="oa{sv}")

2270

1990

2271

1991

@dbus.service.method(_interface, in_signature="o")

2272

1992

def RemoveClient(self, object_path):

2273

1993

"D-Bus method"

2274

for c in tcp_server.clients.itervalues():

1994

for c in tcp_server.clients:

2275

1995

if c.dbus_object_path == object_path:

2276

del tcp_server.clients[c.name]

1996

tcp_server.clients.remove(c)

2277

1997

c.remove_from_connection()

2278

1998

# Don't signal anything except ClientRemoved

2279

1999

c.disable(quiet=True)

2284

2004

2285

2005

del _interface

2286

2006

2287

class MandosDBusServiceTransitional(MandosDBusService):

2288

__metaclass__ = AlternateDBusNamesMetaclass

2289

mandos_dbus_service = MandosDBusServiceTransitional()

2007

mandos_dbus_service = MandosDBusService()

2290

2008

2291

2009

def cleanup():

2292

2010

"Cleanup function; run on exit"

2293

2011

service.cleanup()

2294

2012

2295

multiprocessing.active_children()

2296

if not (tcp_server.clients or client_settings):

2297

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2321

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2323

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2329

# Delete all clients, and settings from config

2330

2013

while tcp_server.clients:

2331

name, client = tcp_server.clients.popitem()

2014

client = tcp_server.clients.pop()

2332

2015

if use_dbus:

2333

2016

client.remove_from_connection()

2017

client.disable_hook = None

2334

2018

# Don't signal anything except ClientRemoved

2335

2019

client.disable(quiet=True)

2336

2020

if use_dbus:

2337

2021

# Emit D-Bus signal

2338

mandos_dbus_service.ClientRemoved(client

2339

.dbus_object_path,

2022

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2340

2023

client.name)

2341

client_settings.clear()

2342

2024

2343

2025

atexit.register(cleanup)

2344

2026

2345

for client in tcp_server.clients.itervalues():

2027

for client in tcp_server.clients:

2346

2028

if use_dbus:

2347

2029

# Emit D-Bus signal

2348

2030

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2349

# Need to initiate checking of clients

2350

if client.enabled:

2351

client.init_checker()

2352

2031

client.enable()

2353

2032

2354

2033

tcp_server.enable()

2355

2034

tcp_server.server_activate()

2395

2074

# Must run before the D-Bus bus name gets deregistered

2396

2075

cleanup()

2397

2076

2398

2399

2077

if __name__ == '__main__':

2400

2078

main()