/mandos/trunk : revision 493

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

67

65

68

66

import dbus

69

67

import dbus.service

74

72

import ctypes.util

75

73

import xml.dom.minidom

76

74

import inspect

77

import Crypto.Cipher.AES

78

75

79

76

try:

80

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

SO_BINDTODEVICE = None

86

83

87

84

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

93

89

syslogger = (logging.handlers.SysLogHandler

94

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

91

address = str("/dev/log")))

99

95

logger.addHandler(syslogger)

100

96

101

97

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

104

99

' %(levelname)s:'

105

100

' %(message)s'))

106

101

logger.addHandler(console)

107

102

108

109

103

class AvahiError(Exception):

110

104

def __init__(self, value, *args, **kwargs):

111

105

self.value = value

165

159

" after %i retries, exiting.",

166

160

self.rename_count)

167

161

raise AvahiServiceError("Too many renames")

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

170

163

logger.info("Changing Zeroconf service name to %r ...",

171

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

172

169

self.remove()

173

170

try:

174

171

self.add()

194

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

195

192

self.entry_group_state_changed_match = (

196

193

self.group.connect_to_signal(

197

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

198

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

199

196

self.name, self.type)

200

197

self.group.AddService(

266

263

self.server_state_changed)

267

264

self.server_state_changed(self.server.GetState())

268

265

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

278

266

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

285

267

class Client(object):

286

268

"""A representation of a client host served by this server.

287

269

299

281

instance %(name)s can be used in the command.

300

282

checker_initiator_tag: a gobject event source tag, or None

301

283

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

304

284

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

305

286

disable_initiator_tag: a gobject event source tag, or None

306

287

enabled: bool()

307

288

fingerprint: string (40 or 32 hexadecimal digits); used to

310

291

interval: datetime.timedelta(); How often to start a new checker

311

292

last_approval_request: datetime.datetime(); (UTC) or None

312

293

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit

314

status of last checker. -1 reflect crashed

315

checker, or None.

316

294

last_enabled: datetime.datetime(); (UTC)

317

295

name: string; from the config file, used in log messages and

318

296

D-Bus identifiers

319

297

secret: bytestring; sent verbatim (over TLS) to client

320

298

timeout: datetime.timedelta(); How long from last_checked_ok

321

299

until this client is disabled

322

extended_timeout: extra long timeout when password has been sent

323

300

runtime_expansions: Allowed attributes for runtime expansion.

324

expires: datetime.datetime(); time (UTC) when a client will be

325

disabled, or None

326

301

"""

327

302

328

303

runtime_expansions = ("approval_delay", "approval_duration",

330

305

"host", "interval", "last_checked_ok",

331

306

"last_enabled", "name", "timeout")

332

307

308

@staticmethod

309

def _timedelta_to_milliseconds(td):

310

"Convert a datetime.timedelta() to milliseconds"

311

return ((td.days * 24 * 60 * 60 * 1000)

312

+ (td.seconds * 1000)

313

+ (td.microseconds // 1000))

314

333

315

def timeout_milliseconds(self):

334

316

"Return the 'timeout' attribute in milliseconds"

335

return _timedelta_to_milliseconds(self.timeout)

336

337

def extended_timeout_milliseconds(self):

338

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

317

return self._timedelta_to_milliseconds(self.timeout)

340

318

341

319

def interval_milliseconds(self):

342

320

"Return the 'interval' attribute in milliseconds"

343

return _timedelta_to_milliseconds(self.interval)

344

321

return self._timedelta_to_milliseconds(self.interval)

322

345

323

def approval_delay_milliseconds(self):

346

return _timedelta_to_milliseconds(self.approval_delay)

324

return self._timedelta_to_milliseconds(self.approval_delay)

347

325

348

def __init__(self, name = None, config=None):

326

def __init__(self, name = None, disable_hook=None, config=None):

349

327

"""Note: the 'checker' key in 'config' sets the

350

328

'checker_command' attribute and *not* the 'checker'

351

329

attribute."""

371

349

% self.name)

372

350

self.host = config.get("host", "")

373

351

self.created = datetime.datetime.utcnow()

374

self.enabled = True

352

self.enabled = False

375

353

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

354

self.last_enabled = None

377

355

self.last_checked_ok = None

378

self.last_checker_status = None

379

356

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

382

357

self.interval = string_to_delta(config["interval"])

358

self.disable_hook = disable_hook

383

359

self.checker = None

384

360

self.checker_initiator_tag = None

385

361

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

387

362

self.checker_callback_tag = None

388

363

self.checker_command = config["checker"]

389

364

self.current_checker_command = None

365

self.last_connect = None

390

366

self._approved = None

391

367

self.approved_by_default = config.get("approved_by_default",

392

368

True)

395

371

config["approval_delay"])

396

372

self.approval_duration = string_to_delta(

397

373

config["approval_duration"])

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr

402

in self.__dict__.iterkeys()

403

if not attr.startswith("_")]

404

self.client_structure.append("client_structure")

405

406

407

for name, t in inspect.getmembers(type(self),

408

lambda obj:

409

isinstance(obj,

410

property)):

411

if not name.startswith("_"):

412

self.client_structure.append(name)

374

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

413

375

414

# Send notice to process children that client state has changed

415

376

def send_changedstate(self):

416

with self.changedstate:

417

self.changedstate.notify_all()

418

377

self.changedstate.acquire()

378

self.changedstate.notify_all()

379

self.changedstate.release()

380

419

381

def enable(self):

420

382

"""Start this client's checker and timeout hooks"""

421

383

if getattr(self, "enabled", False):

422

384

# Already enabled

423

385

return

424

386

self.send_changedstate()

425

self.expires = datetime.datetime.utcnow() + self.timeout

387

self.last_enabled = datetime.datetime.utcnow()

388

# Schedule a new checker to be started an 'interval' from now,

389

# and every interval from then on.

390

self.checker_initiator_tag = (gobject.timeout_add

391

(self.interval_milliseconds(),

392

self.start_checker))

393

# Schedule a disable() when 'timeout' has passed

394

self.disable_initiator_tag = (gobject.timeout_add

395

(self.timeout_milliseconds(),

396

self.disable))

426

397

self.enabled = True

427

self.last_enabled = datetime.datetime.utcnow()

428

self.init_checker()

398

# Also start a new checker *right now*.

399

self.start_checker()

429

400

430

401

def disable(self, quiet=True):

431

402

"""Disable this client."""

438

409

if getattr(self, "disable_initiator_tag", False):

439

410

gobject.source_remove(self.disable_initiator_tag)

440

411

self.disable_initiator_tag = None

441

self.expires = None

442

412

if getattr(self, "checker_initiator_tag", False):

443

413

gobject.source_remove(self.checker_initiator_tag)

444

414

self.checker_initiator_tag = None

445

415

self.stop_checker()

416

if self.disable_hook:

417

self.disable_hook(self)

446

418

self.enabled = False

447

419

# Do not run this again if called by a gobject.timeout_add

448

420

return False

449

421

450

422

def __del__(self):

423

self.disable_hook = None

451

424

self.disable()

452

453

def init_checker(self):

454

# Schedule a new checker to be started an 'interval' from now,

455

# and every interval from then on.

456

self.checker_initiator_tag = (gobject.timeout_add

457

(self.interval_milliseconds(),

458

self.start_checker))

459

# Schedule a disable() when 'timeout' has passed

460

self.disable_initiator_tag = (gobject.timeout_add

461

(self.timeout_milliseconds(),

462

self.disable))

463

# Also start a new checker *right now*.

464

self.start_checker()

465

466

425

467

426

def checker_callback(self, pid, condition, command):

468

427

"""The checker has completed, so take appropriate actions."""

469

428

self.checker_callback_tag = None

470

429

self.checker = None

471

430

if os.WIFEXITED(condition):

472

self.last_checker_status = os.WEXITSTATUS(condition)

473

if self.last_checker_status == 0:

431

exitstatus = os.WEXITSTATUS(condition)

432

if exitstatus == 0:

474

433

logger.info("Checker for %(name)s succeeded",

475

434

vars(self))

476

435

self.checked_ok()

478

437

logger.info("Checker for %(name)s failed",

479

438

vars(self))

480

439

else:

481

self.last_checker_status = -1

482

440

logger.warning("Checker for %(name)s crashed?",

483

441

vars(self))

484

442

485

def checked_ok(self, timeout=None):

443

def checked_ok(self):

486

444

"""Bump up the timeout for this client.

487

445

488

446

This should only be called when the client has been seen,

489

447

alive and well.

490

448

"""

491

if timeout is None:

492

timeout = self.timeout

493

449

self.last_checked_ok = datetime.datetime.utcnow()

494

if self.disable_initiator_tag is not None:

495

gobject.source_remove(self.disable_initiator_tag)

496

if getattr(self, "enabled", False):

497

self.disable_initiator_tag = (gobject.timeout_add

498

(_timedelta_to_milliseconds

499

(timeout), self.disable))

500

self.expires = datetime.datetime.utcnow() + timeout

450

gobject.source_remove(self.disable_initiator_tag)

451

self.disable_initiator_tag = (gobject.timeout_add

452

(self.timeout_milliseconds(),

453

self.disable))

501

454

502

455

def need_approval(self):

503

456

self.last_approval_request = datetime.datetime.utcnow()

543

496

'replace')))

544

497

for attr in

545

498

self.runtime_expansions)

546

499

547

500

try:

548

501

command = self.checker_command % escaped_attrs

549

502

except TypeError as error:

595

548

raise

596

549

self.checker = None

597

550

598

# Encrypts a client secret and stores it in a varible

599

# encrypted_secret

600

def encrypt_secret(self, key):

601

# Encryption-key need to be of a specific size, so we hash

602

# supplied key

603

hasheng = hashlib.sha256()

604

hasheng.update(key)

605

encryptionkey = hasheng.digest()

606

607

# Create validation hash so we know at decryption if it was

608

# sucessful

609

hasheng = hashlib.sha256()

610

hasheng.update(self.secret)

611

validationhash = hasheng.digest()

612

613

# Encrypt secret

614

iv = os.urandom(Crypto.Cipher.AES.block_size)

615

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

616

Crypto.Cipher.AES.MODE_CFB, iv)

617

ciphertext = ciphereng.encrypt(validationhash+self.secret)

618

self.encrypted_secret = (ciphertext, iv)

619

620

# Decrypt a encrypted client secret

621

def decrypt_secret(self, key):

622

# Decryption-key need to be of a specific size, so we hash

623

# supplied key

624

hasheng = hashlib.sha256()

625

hasheng.update(key)

626

encryptionkey = hasheng.digest()

627

628

# Decrypt encrypted secret

629

ciphertext, iv = self.encrypted_secret

630

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

631

Crypto.Cipher.AES.MODE_CFB, iv)

632

plain = ciphereng.decrypt(ciphertext)

633

634

# Validate decrypted secret to know if it was succesful

635

hasheng = hashlib.sha256()

636

validationhash = plain[:hasheng.digest_size]

637

secret = plain[hasheng.digest_size:]

638

hasheng.update(secret)

639

640

# If validation fails, we use key as new secret. Otherwise, we

641

# use the decrypted secret

642

if hasheng.digest() == validationhash:

643

self.secret = secret

644

else:

645

self.secret = key

646

del self.encrypted_secret

647

648

649

551

def dbus_service_property(dbus_interface, signature="v",

650

552

access="readwrite", byte_arrays=False):

651

553

"""Decorators for marking methods of a DBusObjectWithProperties to

697

599

698

600

class DBusObjectWithProperties(dbus.service.Object):

699

601

"""A D-Bus object with properties.

700

602

701

603

Classes inheriting from this can use the dbus_service_property

702

604

decorator to expose methods as D-Bus properties. It exposes the

703

605

standard Get(), Set(), and GetAll() methods on the D-Bus.

710

612

def _get_all_dbus_properties(self):

711

613

"""Returns a generator of (name, attribute) pairs

712

614

"""

713

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

714

for cls in self.__class__.__mro__

615

return ((prop._dbus_name, prop)

715

616

for name, prop in

716

inspect.getmembers(cls, self._is_dbus_property))

617

inspect.getmembers(self, self._is_dbus_property))

717

618

718

619

def _get_dbus_property(self, interface_name, property_name):

719

620

"""Returns a bound method if one exists which is a D-Bus

720

621

property with the specified name and interface.

721

622

"""

722

for cls in self.__class__.__mro__:

723

for name, value in (inspect.getmembers

724

(cls, self._is_dbus_property)):

725

if (value._dbus_name == property_name

726

and value._dbus_interface == interface_name):

727

return value.__get__(self)

728

623

for name in (property_name,

624

property_name + "_dbus_property"):

625

prop = getattr(self, name, None)

626

if (prop is None

627

or not self._is_dbus_property(prop)

628

or prop._dbus_name != property_name

629

or (interface_name and prop._dbus_interface

630

and interface_name != prop._dbus_interface)):

631

continue

632

return prop

729

633

# No such property

730

634

raise DBusPropertyNotFound(self.dbus_object_path + ":"

731

635

+ interface_name + "."

765

669

def GetAll(self, interface_name):

766

670

"""Standard D-Bus property GetAll() method, see D-Bus

767

671

standard.

768

672

769

673

Note: Will not include properties with access="write".

770

674

"""

771

675

all = {}

833

737

return xmlstring

834

738

835

739

836

def datetime_to_dbus (dt, variant_level=0):

837

"""Convert a UTC datetime.datetime() to a D-Bus type."""

838

if dt is None:

839

return dbus.String("", variant_level = variant_level)

840

return dbus.String(dt.isoformat(),

841

variant_level=variant_level)

842

843

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

844

.__metaclass__):

845

"""Applied to an empty subclass of a D-Bus object, this metaclass

846

will add additional D-Bus attributes matching a certain pattern.

847

"""

848

def __new__(mcs, name, bases, attr):

849

# Go through all the base classes which could have D-Bus

850

# methods, signals, or properties in them

851

for base in (b for b in bases

852

if issubclass(b, dbus.service.Object)):

853

# Go though all attributes of the base class

854

for attrname, attribute in inspect.getmembers(base):

855

# Ignore non-D-Bus attributes, and D-Bus attributes

856

# with the wrong interface name

857

if (not hasattr(attribute, "_dbus_interface")

858

or not attribute._dbus_interface

859

.startswith("se.recompile.Mandos")):

860

continue

861

# Create an alternate D-Bus interface name based on

862

# the current name

863

alt_interface = (attribute._dbus_interface

864

.replace("se.recompile.Mandos",

865

"se.bsnet.fukt.Mandos"))

866

# Is this a D-Bus signal?

867

if getattr(attribute, "_dbus_is_signal", False):

868

# Extract the original non-method function by

869

# black magic

870

nonmethod_func = (dict(

871

zip(attribute.func_code.co_freevars,

872

attribute.__closure__))["func"]

873

.cell_contents)

874

# Create a new, but exactly alike, function

875

# object, and decorate it to be a new D-Bus signal

876

# with the alternate D-Bus interface name

877

new_function = (dbus.service.signal

878

(alt_interface,

879

attribute._dbus_signature)

880

(types.FunctionType(

881

nonmethod_func.func_code,

882

nonmethod_func.func_globals,

883

nonmethod_func.func_name,

884

nonmethod_func.func_defaults,

885

nonmethod_func.func_closure)))

886

# Define a creator of a function to call both the

887

# old and new functions, so both the old and new

888

# signals gets sent when the function is called

889

def fixscope(func1, func2):

890

"""This function is a scope container to pass

891

func1 and func2 to the "call_both" function

892

outside of its arguments"""

893

def call_both(*args, **kwargs):

894

"""This function will emit two D-Bus

895

signals by calling func1 and func2"""

896

func1(*args, **kwargs)

897

func2(*args, **kwargs)

898

return call_both

899

# Create the "call_both" function and add it to

900

# the class

901

attr[attrname] = fixscope(attribute,

902

new_function)

903

# Is this a D-Bus method?

904

elif getattr(attribute, "_dbus_is_method", False):

905

# Create a new, but exactly alike, function

906

# object. Decorate it to be a new D-Bus method

907

# with the alternate D-Bus interface name. Add it

908

# to the class.

909

attr[attrname] = (dbus.service.method

910

(alt_interface,

911

attribute._dbus_in_signature,

912

attribute._dbus_out_signature)

913

(types.FunctionType

914

(attribute.func_code,

915

attribute.func_globals,

916

attribute.func_name,

917

attribute.func_defaults,

918

attribute.func_closure)))

919

# Is this a D-Bus property?

920

elif getattr(attribute, "_dbus_is_property", False):

921

# Create a new, but exactly alike, function

922

# object, and decorate it to be a new D-Bus

923

# property with the alternate D-Bus interface

924

# name. Add it to the class.

925

attr[attrname] = (dbus_service_property

926

(alt_interface,

927

attribute._dbus_signature,

928

attribute._dbus_access,

929

attribute

930

._dbus_get_args_options

931

["byte_arrays"])

932

(types.FunctionType

933

(attribute.func_code,

934

attribute.func_globals,

935

attribute.func_name,

936

attribute.func_defaults,

937

attribute.func_closure)))

938

return type.__new__(mcs, name, bases, attr)

939

940

740

class ClientDBus(Client, DBusObjectWithProperties):

941

741

"""A Client class using D-Bus

942

742

951

751

# dbus.service.Object doesn't use super(), so we can't either.

952

752

953

753

def __init__(self, bus = None, *args, **kwargs):

954

self.bus = bus

955

754

self._approvals_pending = 0

755

self.bus = bus

956

756

Client.__init__(self, *args, **kwargs)

957

self.add_to_dbus()

958

959

def add_to_dbus(self):

960

757

# Only now, when this client is initialized, can it show up on

961

758

# the D-Bus

962

759

client_object_name = unicode(self.name).translate(

967

764

DBusObjectWithProperties.__init__(self, self.bus,

968

765

self.dbus_object_path)

969

766

970

def notifychangeproperty(transform_func,

971

dbus_name, type_func=lambda x: x,

972

variant_level=1):

973

""" Modify a variable so that it's a property which announces

974

its changes to DBus.

767

def _get_approvals_pending(self):

768

return self._approvals_pending

769

def _set_approvals_pending(self, value):

770

old_value = self._approvals_pending

771

self._approvals_pending = value

772

bval = bool(value)

773

if (hasattr(self, "dbus_object_path")

774

and bval is not bool(old_value)):

775

dbus_bool = dbus.Boolean(bval, variant_level=1)

776

self.PropertyChanged(dbus.String("ApprovalPending"),

777

dbus_bool)

975

778

976

transform_fun: Function that takes a value and a variant_level

977

and transforms it to a D-Bus type.

978

dbus_name: D-Bus name of the variable

979

type_func: Function that transform the value before sending it

980

to the D-Bus. Default: no transform

981

variant_level: D-Bus variant level. Default: 1

982

"""

983

attrname = "_{0}".format(dbus_name)

984

def setter(self, value):

985

if hasattr(self, "dbus_object_path"):

986

if (not hasattr(self, attrname) or

987

type_func(getattr(self, attrname, None))

988

!= type_func(value)):

989

dbus_value = transform_func(type_func(value),

990

variant_level

991

=variant_level)

992

self.PropertyChanged(dbus.String(dbus_name),

993

dbus_value)

994

setattr(self, attrname, value)

995

996

return property(lambda self: getattr(self, attrname), setter)

997

998

999

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1000

approvals_pending = notifychangeproperty(dbus.Boolean,

1001

"ApprovalPending",

1002

type_func = bool)

1003

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1004

last_enabled = notifychangeproperty(datetime_to_dbus,

1005

"LastEnabled")

1006

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1007

type_func = lambda checker:

1008

checker is not None)

1009

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1010

"LastCheckedOK")

1011

last_approval_request = notifychangeproperty(

1012

datetime_to_dbus, "LastApprovalRequest")

1013

approved_by_default = notifychangeproperty(dbus.Boolean,

1014

"ApprovedByDefault")

1015

approval_delay = notifychangeproperty(dbus.UInt16,

1016

"ApprovalDelay",

1017

type_func =

1018

_timedelta_to_milliseconds)

1019

approval_duration = notifychangeproperty(

1020

dbus.UInt16, "ApprovalDuration",

1021

type_func = _timedelta_to_milliseconds)

1022

host = notifychangeproperty(dbus.String, "Host")

1023

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1024

type_func =

1025

_timedelta_to_milliseconds)

1026

extended_timeout = notifychangeproperty(

1027

dbus.UInt16, "ExtendedTimeout",

1028

type_func = _timedelta_to_milliseconds)

1029

interval = notifychangeproperty(dbus.UInt16,

1030

"Interval",

1031

type_func =

1032

_timedelta_to_milliseconds)

1033

checker_command = notifychangeproperty(dbus.String, "Checker")

1034

1035

del notifychangeproperty

779

approvals_pending = property(_get_approvals_pending,

780

_set_approvals_pending)

781

del _get_approvals_pending, _set_approvals_pending

782

783

@staticmethod

784

def _datetime_to_dbus(dt, variant_level=0):

785

"""Convert a UTC datetime.datetime() to a D-Bus type."""

786

return dbus.String(dt.isoformat(),

787

variant_level=variant_level)

788

789

def enable(self):

790

oldstate = getattr(self, "enabled", False)

791

r = Client.enable(self)

792

if oldstate != self.enabled:

793

# Emit D-Bus signals

794

self.PropertyChanged(dbus.String("Enabled"),

795

dbus.Boolean(True, variant_level=1))

796

self.PropertyChanged(

797

dbus.String("LastEnabled"),

798

self._datetime_to_dbus(self.last_enabled,

799

variant_level=1))

800

return r

801

802

def disable(self, quiet = False):

803

oldstate = getattr(self, "enabled", False)

804

r = Client.disable(self, quiet=quiet)

805

if not quiet and oldstate != self.enabled:

806

# Emit D-Bus signal

807

self.PropertyChanged(dbus.String("Enabled"),

808

dbus.Boolean(False, variant_level=1))

809

return r

1036

810

1037

811

def __del__(self, *args, **kwargs):

1038

812

try:

1047

821

*args, **kwargs):

1048

822

self.checker_callback_tag = None

1049

823

self.checker = None

824

# Emit D-Bus signal

825

self.PropertyChanged(dbus.String("CheckerRunning"),

826

dbus.Boolean(False, variant_level=1))

1050

827

if os.WIFEXITED(condition):

1051

828

exitstatus = os.WEXITSTATUS(condition)

1052

829

# Emit D-Bus signal

1062

839

return Client.checker_callback(self, pid, condition, command,

1063

840

*args, **kwargs)

1064

841

842

def checked_ok(self, *args, **kwargs):

843

Client.checked_ok(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastCheckedOK"),

847

(self._datetime_to_dbus(self.last_checked_ok,

848

variant_level=1)))

849

850

def need_approval(self, *args, **kwargs):

851

r = Client.need_approval(self, *args, **kwargs)

852

# Emit D-Bus signal

853

self.PropertyChanged(

854

dbus.String("LastApprovalRequest"),

855

(self._datetime_to_dbus(self.last_approval_request,

856

variant_level=1)))

857

return r

858

1065

859

def start_checker(self, *args, **kwargs):

1066

860

old_checker = self.checker

1067

861

if self.checker is not None:

1074

868

and old_checker_pid != self.checker.pid):

1075

869

# Emit D-Bus signal

1076

870

self.CheckerStarted(self.current_checker_command)

871

self.PropertyChanged(

872

dbus.String("CheckerRunning"),

873

dbus.Boolean(True, variant_level=1))

1077

874

return r

1078

875

876

def stop_checker(self, *args, **kwargs):

877

old_checker = getattr(self, "checker", None)

878

r = Client.stop_checker(self, *args, **kwargs)

879

if (old_checker is not None

880

and getattr(self, "checker", None) is None):

881

self.PropertyChanged(dbus.String("CheckerRunning"),

882

dbus.Boolean(False, variant_level=1))

883

return r

884

1079

885

def _reset_approved(self):

1080

886

self._approved = None

1081

887

return False

1083

889

def approve(self, value=True):

1084

890

self.send_changedstate()

1085

891

self._approved = value

1086

gobject.timeout_add(_timedelta_to_milliseconds

892

gobject.timeout_add(self._timedelta_to_milliseconds

1087

893

(self.approval_duration),

1088

894

self._reset_approved)

1089

895

1090

896

1091

897

## D-Bus methods, signals & properties

1092

_interface = "se.recompile.Mandos.Client"

898

_interface = "se.bsnet.fukt.Mandos.Client"

1093

899

1094

900

## Signals

1095

901

1181

987

if value is None: # get

1182

988

return dbus.Boolean(self.approved_by_default)

1183

989

self.approved_by_default = bool(value)

990

# Emit D-Bus signal

991

self.PropertyChanged(dbus.String("ApprovedByDefault"),

992

dbus.Boolean(value, variant_level=1))

1184

993

1185

994

# ApprovalDelay - property

1186

995

@dbus_service_property(_interface, signature="t",

1189

998

if value is None: # get

1190

999

return dbus.UInt64(self.approval_delay_milliseconds())

1191

1000

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1001

# Emit D-Bus signal

1002

self.PropertyChanged(dbus.String("ApprovalDelay"),

1003

dbus.UInt64(value, variant_level=1))

1192

1004

1193

1005

# ApprovalDuration - property

1194

1006

@dbus_service_property(_interface, signature="t",

1195

1007

access="readwrite")

1196

1008

def ApprovalDuration_dbus_property(self, value=None):

1197

1009

if value is None: # get

1198

return dbus.UInt64(_timedelta_to_milliseconds(

1010

return dbus.UInt64(self._timedelta_to_milliseconds(

1199

1011

self.approval_duration))

1200

1012

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1013

# Emit D-Bus signal

1014

self.PropertyChanged(dbus.String("ApprovalDuration"),

1015

dbus.UInt64(value, variant_level=1))

1201

1016

1202

1017

# Name - property

1203

1018

@dbus_service_property(_interface, signature="s", access="read")

1216

1031

if value is None: # get

1217

1032

return dbus.String(self.host)

1218

1033

self.host = value

1034

# Emit D-Bus signal

1035

self.PropertyChanged(dbus.String("Host"),

1036

dbus.String(value, variant_level=1))

1219

1037

1220

1038

# Created - property

1221

1039

@dbus_service_property(_interface, signature="s", access="read")

1222

1040

def Created_dbus_property(self):

1223

return dbus.String(datetime_to_dbus(self.created))

1041

return dbus.String(self._datetime_to_dbus(self.created))

1224

1042

1225

1043

# LastEnabled - property

1226

1044

@dbus_service_property(_interface, signature="s", access="read")

1227

1045

def LastEnabled_dbus_property(self):

1228

return datetime_to_dbus(self.last_enabled)

1046

if self.last_enabled is None:

1047

return dbus.String("")

1048

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1229

1049

1230

1050

# Enabled - property

1231

1051

@dbus_service_property(_interface, signature="b",

1245

1065

if value is not None:

1246

1066

self.checked_ok()

1247

1067

return

1248

return datetime_to_dbus(self.last_checked_ok)

1249

1250

# Expires - property

1251

@dbus_service_property(_interface, signature="s", access="read")

1252

def Expires_dbus_property(self):

1253

return datetime_to_dbus(self.expires)

1068

if self.last_checked_ok is None:

1069

return dbus.String("")

1070

return dbus.String(self._datetime_to_dbus(self

1071

.last_checked_ok))

1254

1072

1255

1073

# LastApprovalRequest - property

1256

1074

@dbus_service_property(_interface, signature="s", access="read")

1257

1075

def LastApprovalRequest_dbus_property(self):

1258

return datetime_to_dbus(self.last_approval_request)

1076

if self.last_approval_request is None:

1077

return dbus.String("")

1078

return dbus.String(self.

1079

_datetime_to_dbus(self

1080

.last_approval_request))

1259

1081

1260

1082

# Timeout - property

1261

1083

@dbus_service_property(_interface, signature="t",

1264

1086

if value is None: # get

1265

1087

return dbus.UInt64(self.timeout_milliseconds())

1266

1088

self.timeout = datetime.timedelta(0, 0, 0, value)

1089

# Emit D-Bus signal

1090

self.PropertyChanged(dbus.String("Timeout"),

1091

dbus.UInt64(value, variant_level=1))

1267

1092

if getattr(self, "disable_initiator_tag", None) is None:

1268

1093

return

1269

1094

# Reschedule timeout

1270

1095

gobject.source_remove(self.disable_initiator_tag)

1271

1096

self.disable_initiator_tag = None

1272

self.expires = None

1273

time_to_die = _timedelta_to_milliseconds((self

1274

.last_checked_ok

1275

+ self.timeout)

1276

- datetime.datetime

1277

.utcnow())

1097

time_to_die = (self.

1098

_timedelta_to_milliseconds((self

1099

.last_checked_ok

1100

+ self.timeout)

1101

- datetime.datetime

1102

.utcnow()))

1278

1103

if time_to_die <= 0:

1279

1104

# The timeout has passed

1280

1105

self.disable()

1281

1106

else:

1282

self.expires = (datetime.datetime.utcnow()

1283

+ datetime.timedelta(milliseconds =

1284

time_to_die))

1285

1107

self.disable_initiator_tag = (gobject.timeout_add

1286

1108

(time_to_die, self.disable))

1287

1109

1288

# ExtendedTimeout - property

1289

@dbus_service_property(_interface, signature="t",

1290

access="readwrite")

1291

def ExtendedTimeout_dbus_property(self, value=None):

1292

if value is None: # get

1293

return dbus.UInt64(self.extended_timeout_milliseconds())

1294

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1295

1296

1110

# Interval - property

1297

1111

@dbus_service_property(_interface, signature="t",

1298

1112

access="readwrite")

1300

1114

if value is None: # get

1301

1115

return dbus.UInt64(self.interval_milliseconds())

1302

1116

self.interval = datetime.timedelta(0, 0, 0, value)

1117

# Emit D-Bus signal

1118

self.PropertyChanged(dbus.String("Interval"),

1119

dbus.UInt64(value, variant_level=1))

1303

1120

if getattr(self, "checker_initiator_tag", None) is None:

1304

1121

return

1305

1122

# Reschedule checker run

1307

1124

self.checker_initiator_tag = (gobject.timeout_add

1308

1125

(value, self.start_checker))

1309

1126

self.start_checker() # Start one now, too

1310

1127

1311

1128

# Checker - property

1312

1129

@dbus_service_property(_interface, signature="s",

1313

1130

access="readwrite")

1315

1132

if value is None: # get

1316

1133

return dbus.String(self.checker_command)

1317

1134

self.checker_command = value

1135

# Emit D-Bus signal

1136

self.PropertyChanged(dbus.String("Checker"),

1137

dbus.String(self.checker_command,

1138

variant_level=1))

1318

1139

1319

1140

# CheckerRunning - property

1320

1141

@dbus_service_property(_interface, signature="b",

1347

1168

self._pipe.send(('init', fpr, address))

1348

1169

if not self._pipe.recv():

1349

1170

raise KeyError()

1350

1171

1351

1172

def __getattribute__(self, name):

1352

1173

if(name == '_pipe'):

1353

1174

return super(ProxyClient, self).__getattribute__(name)

1360

1181

self._pipe.send(('funcall', name, args, kwargs))

1361

1182

return self._pipe.recv()[1]

1362

1183

return func

1363

1184

1364

1185

def __setattr__(self, name, value):

1365

1186

if(name == '_pipe'):

1366

1187

return super(ProxyClient, self).__setattr__(name, value)

1367

1188

self._pipe.send(('setattr', name, value))

1368

1189

1369

class ClientDBusTransitional(ClientDBus):

1370

__metaclass__ = AlternateDBusNamesMetaclass

1371

1190

1372

1191

class ClientHandler(socketserver.BaseRequestHandler, object):

1373

1192

"""A class to handle client connections.

1381

1200

unicode(self.client_address))

1382

1201

logger.debug("Pipe FD: %d",

1383

1202

self.server.child_pipe.fileno())

1384

1203

1385

1204

session = (gnutls.connection

1386

1205

.ClientSession(self.request,

1387

1206

gnutls.connection

1388

1207

.X509Credentials()))

1389

1208

1390

1209

# Note: gnutls.connection.X509Credentials is really a

1391

1210

# generic GnuTLS certificate credentials object so long as

1392

1211

# no X.509 keys are added to it. Therefore, we can use it

1393

1212

# here despite using OpenPGP certificates.

1394

1213

1395

1214

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1396

1215

# "+AES-256-CBC", "+SHA1",

1397

1216

# "+COMP-NULL", "+CTYPE-OPENPGP",

1403

1222

(gnutls.library.functions

1404

1223

.gnutls_priority_set_direct(session._c_object,

1405

1224

priority, None))

1406

1225

1407

1226

# Start communication using the Mandos protocol

1408

1227

# Get protocol number

1409

1228

line = self.request.makefile().readline()

1414

1233

except (ValueError, IndexError, RuntimeError) as error:

1415

1234

logger.error("Unknown protocol version: %s", error)

1416

1235

return

1417

1236

1418

1237

# Start GnuTLS connection

1419

1238

try:

1420

1239

session.handshake()

1424

1243

# established. Just abandon the request.

1425

1244

return

1426

1245

logger.debug("Handshake succeeded")

1427

1246

1428

1247

approval_required = False

1429

1248

try:

1430

1249

try:

1435

1254

logger.warning("Bad certificate: %s", error)

1436

1255

return

1437

1256

logger.debug("Fingerprint: %s", fpr)

1438

1257

1439

1258

try:

1440

1259

client = ProxyClient(child_pipe, fpr,

1441

1260

self.client_address)

1453

1272

client.name)

1454

1273

if self.server.use_dbus:

1455

1274

# Emit D-Bus signal

1456

client.Rejected("Disabled")

1275

client.Rejected("Disabled")

1457

1276

return

1458

1277

1459

1278

if client._approved or not client.approval_delay:

1476

1295

return

1477

1296

1478

1297

#wait until timeout or approved

1298

#x = float(client._timedelta_to_milliseconds(delay))

1479

1299

time = datetime.datetime.now()

1480

1300

client.changedstate.acquire()

1481

(client.changedstate.wait

1482

(float(client._timedelta_to_milliseconds(delay)

1483

/ 1000)))

1301

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1484

1302

client.changedstate.release()

1485

1303

time2 = datetime.datetime.now()

1486

1304

if (time2 - time) >= delay:

1508

1326

sent, len(client.secret)

1509

1327

- (sent_size + sent))

1510

1328

sent_size += sent

1511

1329

1512

1330

logger.info("Sending secret to %s", client.name)

1513

# bump the timeout using extended_timeout

1514

client.checked_ok(client.extended_timeout)

1331

# bump the timeout as if seen

1332

client.checked_ok()

1515

1333

if self.server.use_dbus:

1516

1334

# Emit D-Bus signal

1517

1335

client.GotSecret()

1596

1414

except:

1597

1415

self.handle_error(request, address)

1598

1416

self.close_request(request)

1599

1417

1600

1418

def process_request(self, request, address):

1601

1419

"""Start a new process to process the request."""

1602

proc = multiprocessing.Process(target = self.sub_process_main,

1603

args = (request,

1604

address))

1605

proc.start()

1606

return proc

1607

1420

multiprocessing.Process(target = self.sub_process_main,

1421

args = (request, address)).start()

1608

1422

1609

1423

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1610

1424

""" adds a pipe to the MixIn """

1614

1428

This function creates a new pipe in self.pipe

1615

1429

"""

1616

1430

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1617

1618

proc = MultiprocessingMixIn.process_request(self, request,

1619

client_address)

1431

1432

super(MultiprocessingMixInWithPipe,

1433

self).process_request(request, client_address)

1620

1434

self.child_pipe.close()

1621

self.add_pipe(parent_pipe, proc)

1622

1623

def add_pipe(self, parent_pipe, proc):

1435

self.add_pipe(parent_pipe)

1436

1437

def add_pipe(self, parent_pipe):

1624

1438

"""Dummy function; override as necessary"""

1625

1439

raise NotImplementedError

1626

1440

1627

1628

1441

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1629

1442

socketserver.TCPServer, object):

1630

1443

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1704

1517

self.enabled = False

1705

1518

self.clients = clients

1706

1519

if self.clients is None:

1707

self.clients = {}

1520

self.clients = set()

1708

1521

self.use_dbus = use_dbus

1709

1522

self.gnutls_priority = gnutls_priority

1710

1523

IPv6_TCPServer.__init__(self, server_address,

1714

1527

def server_activate(self):

1715

1528

if self.enabled:

1716

1529

return socketserver.TCPServer.server_activate(self)

1717

1718

1530

def enable(self):

1719

1531

self.enabled = True

1720

1721

def add_pipe(self, parent_pipe, proc):

1532

def add_pipe(self, parent_pipe):

1722

1533

# Call "handle_ipc" for both data and EOF events

1723

1534

gobject.io_add_watch(parent_pipe.fileno(),

1724

1535

gobject.IO_IN | gobject.IO_HUP,

1725

1536

functools.partial(self.handle_ipc,

1726

parent_pipe =

1727

parent_pipe,

1728

proc = proc))

1729

1537

parent_pipe = parent_pipe))

1538

1730

1539

def handle_ipc(self, source, condition, parent_pipe=None,

1731

proc = None, client_object=None):

1540

client_object=None):

1732

1541

condition_names = {

1733

1542

gobject.IO_IN: "IN", # There is data to read.

1734

1543

gobject.IO_OUT: "OUT", # Data can be written (without

1743

1552

for cond, name in

1744

1553

condition_names.iteritems()

1745

1554

if cond & condition)

1746

# error, or the other end of multiprocessing.Pipe has closed

1555

# error or the other end of multiprocessing.Pipe has closed

1747

1556

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1748

# Wait for other process to exit

1749

proc.join()

1750

1557

return False

1751

1558

1752

1559

# Read a request from the child

1757

1564

fpr = request[1]

1758

1565

address = request[2]

1759

1566

1760

for c in self.clients.itervalues():

1567

for c in self.clients:

1761

1568

if c.fingerprint == fpr:

1762

1569

client = c

1763

1570

break

1766

1573

"dress: %s", fpr, address)

1767

1574

if self.use_dbus:

1768

1575

# Emit D-Bus signal

1769

mandos_dbus_service.ClientNotFound(fpr,

1770

address[0])

1576

mandos_dbus_service.ClientNotFound(fpr, address[0])

1771

1577

parent_pipe.send(False)

1772

1578

return False

1773

1579

1774

1580

gobject.io_add_watch(parent_pipe.fileno(),

1775

1581

gobject.IO_IN | gobject.IO_HUP,

1776

1582

functools.partial(self.handle_ipc,

1777

parent_pipe =

1778

parent_pipe,

1779

proc = proc,

1780

client_object =

1781

client))

1583

parent_pipe = parent_pipe,

1584

client_object = client))

1782

1585

parent_pipe.send(True)

1783

# remove the old hook in favor of the new above hook on

1784

# same fileno

1586

# remove the old hook in favor of the new above hook on same fileno

1785

1587

return False

1786

1588

if command == 'funcall':

1787

1589

funcname = request[1]

1788

1590

args = request[2]

1789

1591

kwargs = request[3]

1790

1592

1791

parent_pipe.send(('data', getattr(client_object,

1792

funcname)(*args,

1793

**kwargs)))

1794

1593

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1594

1795

1595

if command == 'getattr':

1796

1596

attrname = request[1]

1797

1597

if callable(client_object.__getattribute__(attrname)):

1798

1598

parent_pipe.send(('function',))

1799

1599

else:

1800

parent_pipe.send(('data', client_object

1801

.__getattribute__(attrname)))

1600

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1802

1601

1803

1602

if command == 'setattr':

1804

1603

attrname = request[1]

1805

1604

value = request[2]

1806

1605

setattr(client_object, attrname, value)

1807

1606

1808

1607

return True

1809

1608

1810

1609

1931

1730

" system bus interface")

1932

1731

parser.add_argument("--no-ipv6", action="store_false",

1933

1732

dest="use_ipv6", help="Do not use IPv6")

1934

parser.add_argument("--no-restore", action="store_false",

1935

dest="restore",

1936

help="Do not restore stored state",

1937

default=True)

1938

1939

1733

options = parser.parse_args()

1940

1734

1941

1735

if options.check:

1976

1770

# options, if set.

1977

1771

for option in ("interface", "address", "port", "debug",

1978

1772

"priority", "servicename", "configdir",

1979

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1773

"use_dbus", "use_ipv6", "debuglevel"):

1980

1774

value = getattr(options, option)

1981

1775

if value is not None:

1982

1776

server_settings[option] = value

1994

1788

debuglevel = server_settings["debuglevel"]

1995

1789

use_dbus = server_settings["use_dbus"]

1996

1790

use_ipv6 = server_settings["use_ipv6"]

1997

1791

1998

1792

if server_settings["servicename"] != "Mandos":

1999

1793

syslogger.setFormatter(logging.Formatter

2000

1794

('Mandos (%s) [%%(process)d]:'

2002

1796

% server_settings["servicename"]))

2003

1797

2004

1798

# Parse config file with clients

2005

client_defaults = { "timeout": "5m",

2006

"extended_timeout": "15m",

2007

"interval": "2m",

1799

client_defaults = { "timeout": "1h",

1800

"interval": "5m",

2008

1801

"checker": "fping -q -- %%(host)s",

2009

1802

"host": "",

2010

1803

"approval_delay": "0s",

2055

1848

raise error

2056

1849

2057

1850

if not debug and not debuglevel:

2058

logger.setLevel(logging.WARNING)

1851

syslogger.setLevel(logging.WARNING)

1852

console.setLevel(logging.WARNING)

2059

1853

if debuglevel:

2060

1854

level = getattr(logging, debuglevel.upper())

2061

logger.setLevel(level)

2062

1855

syslogger.setLevel(level)

1856

console.setLevel(level)

1857

2063

1858

if debug:

2064

logger.setLevel(logging.DEBUG)

2065

1859

# Enable all possible GnuTLS debugging

2066

1860

2067

1861

# "Use a log level over 10 to enable all debugging options."

2097

1891

# End of Avahi example code

2098

1892

if use_dbus:

2099

1893

try:

2100

bus_name = dbus.service.BusName("se.recompile.Mandos",

1894

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2101

1895

bus, do_not_queue=True)

2102

old_bus_name = (dbus.service.BusName

2103

("se.bsnet.fukt.Mandos", bus,

2104

do_not_queue=True))

2105

1896

except dbus.exceptions.NameExistsException as e:

2106

1897

logger.error(unicode(e) + ", disabling D-Bus")

2107

1898

use_dbus = False

2108

1899

server_settings["use_dbus"] = False

2109

1900

tcp_server.use_dbus = False

2110

1901

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2111

service = AvahiServiceToSyslog(name =

2112

server_settings["servicename"],

2113

servicetype = "_mandos._tcp",

2114

protocol = protocol, bus = bus)

1902

service = AvahiService(name = server_settings["servicename"],

1903

servicetype = "_mandos._tcp",

1904

protocol = protocol, bus = bus)

2115

1905

if server_settings["interface"]:

2116

1906

service.interface = (if_nametoindex

2117

1907

(str(server_settings["interface"])))

2121

1911

2122

1912

client_class = Client

2123

1913

if use_dbus:

2124

client_class = functools.partial(ClientDBusTransitional,

2125

bus = bus)

2126

2127

special_settings = {

2128

# Some settings need to be accessd by special methods;

2129

# booleans need .getboolean(), etc. Here is a list of them:

2130

"approved_by_default":

2131

lambda section:

2132

client_config.getboolean(section, "approved_by_default"),

2133

}

2134

# Construct a new dict of client settings of this form:

2135

# { client_name: {setting_name: value, ...}, ...}

2136

# with exceptions for any special settings as defined above

2137

client_settings = dict((clientname,

2138

dict((setting,

2139

(value if

2140

setting not in special_settings

2141

else special_settings[setting]

2142

(clientname)))

2143

for setting, value

2144

in client_config.items(clientname)))

2145

for clientname in client_config.sections())

2146

2147

old_client_settings = {}

2148

clients_data = []

2149

2150

# Get client data and settings from last running state.

2151

if server_settings["restore"]:

2152

try:

2153

with open(stored_state_path, "rb") as stored_state:

2154

clients_data, old_client_settings = (

2155

pickle.load(stored_state))

2156

os.remove(stored_state_path)

2157

except IOError as e:

2158

logger.warning("Could not load persistant state: {0}"

2159

.format(e))

2160

if e.errno != errno.ENOENT:

2161

raise

2162

2163

for client in clients_data:

2164

client_name = client["name"]

2165

2166

# Decide which value to use after restoring saved state.

2167

# We have three different values: Old config file,

2168

# new config file, and saved state.

2169

# New config value takes precedence if it differs from old

2170

# config value, otherwise use saved state.

2171

for name, value in client_settings[client_name].items():

1914

client_class = functools.partial(ClientDBus, bus = bus)

1915

def client_config_items(config, section):

1916

special_settings = {

1917

"approved_by_default":

1918

lambda: config.getboolean(section,

1919

"approved_by_default"),

1920

}

1921

for name, value in config.items(section):

2172

1922

try:

2173

# For each value in new config, check if it differs

2174

# from the old config value (Except for the "secret"

2175

# attribute)

2176

if (name != "secret" and

2177

value != old_client_settings[client_name][name]):

2178

setattr(client, name, value)

1923

yield (name, special_settings[name]())

2179

1924

except KeyError:

2180

pass

2181

2182

# Clients who has passed its expire date, can still be enabled

2183

# if its last checker was sucessful. Clients who checkers

2184

# failed before we stored it state is asumed to had failed

2185

# checker during downtime.

2186

if client["enabled"] and client["last_checked_ok"]:

2187

if ((datetime.datetime.utcnow()

2188

- client["last_checked_ok"]) > client["interval"]):

2189

if client["last_checker_status"] != 0:

2190

client["enabled"] = False

2191

else:

2192

client["expires"] = (datetime.datetime.utcnow()

2193

+ client["timeout"])

2194

2195

client["changedstate"] = (multiprocessing_manager

2196

.Condition(multiprocessing_manager

2197

.Lock()))

2198

if use_dbus:

2199

new_client = ClientDBusTransitional.__new__(

2200

ClientDBusTransitional)

2201

tcp_server.clients[client_name] = new_client

2202

new_client.bus = bus

2203

for name, value in client.iteritems():

2204

setattr(new_client, name, value)

2205

new_client._approvals_pending = 0

2206

new_client.add_to_dbus()

2207

else:

2208

tcp_server.clients[client_name] = Client.__new__(Client)

2209

for name, value in client.iteritems():

2210

setattr(tcp_server.clients[client_name], name, value)

2211

2212

tcp_server.clients[client_name].decrypt_secret(

2213

client_settings[client_name]["secret"])

2214

2215

# Create/remove clients based on new changes made to config

2216

for clientname in set(old_client_settings) - set(client_settings):

2217

del tcp_server.clients[clientname]

2218

for clientname in set(client_settings) - set(old_client_settings):

2219

tcp_server.clients[clientname] = client_class(name

2220

= clientname,

2221

config =

2222

client_settings

2223

[clientname])

1925

yield (name, value)

2224

1926

1927

tcp_server.clients.update(set(

1928

client_class(name = section,

1929

config= dict(client_config_items(

1930

client_config, section)))

1931

for section in client_config.sections()))

2225

1932

if not tcp_server.clients:

2226

1933

logger.warning("No clients defined")

2227

1934

2240

1947

del pidfilename

2241

1948

2242

1949

signal.signal(signal.SIGINT, signal.SIG_IGN)

2243

1950

2244

1951

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2245

1952

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2246

1953

2249

1956

"""A D-Bus proxy object"""

2250

1957

def __init__(self):

2251

1958

dbus.service.Object.__init__(self, bus, "/")

2252

_interface = "se.recompile.Mandos"

1959

_interface = "se.bsnet.fukt.Mandos"

2253

1960

2254

1961

@dbus.service.signal(_interface, signature="o")

2255

1962

def ClientAdded(self, objpath):

2270

1977

def GetAllClients(self):

2271

1978

"D-Bus method"

2272

1979

return dbus.Array(c.dbus_object_path

2273

for c in

2274

tcp_server.clients.itervalues())

1980

for c in tcp_server.clients)

2275

1981

2276

1982

@dbus.service.method(_interface,

2277

1983

out_signature="a{oa{sv}}")

2279

1985

"D-Bus method"

2280

1986

return dbus.Dictionary(

2281

1987

((c.dbus_object_path, c.GetAll(""))

2282

for c in tcp_server.clients.itervalues()),

1988

for c in tcp_server.clients),

2283

1989

signature="oa{sv}")

2284

1990

2285

1991

@dbus.service.method(_interface, in_signature="o")

2286

1992

def RemoveClient(self, object_path):

2287

1993

"D-Bus method"

2288

for c in tcp_server.clients.itervalues():

1994

for c in tcp_server.clients:

2289

1995

if c.dbus_object_path == object_path:

2290

del tcp_server.clients[c.name]

1996

tcp_server.clients.remove(c)

2291

1997

c.remove_from_connection()

2292

1998

# Don't signal anything except ClientRemoved

2293

1999

c.disable(quiet=True)

2298

2004

2299

2005

del _interface

2300

2006

2301

class MandosDBusServiceTransitional(MandosDBusService):

2302

__metaclass__ = AlternateDBusNamesMetaclass

2303

mandos_dbus_service = MandosDBusServiceTransitional()

2007

mandos_dbus_service = MandosDBusService()

2304

2008

2305

2009

def cleanup():

2306

2010

"Cleanup function; run on exit"

2307

2011

service.cleanup()

2308

2012

2309

multiprocessing.active_children()

2310

if not (tcp_server.clients or client_settings):

2311

return

2312

2313

# Store client before exiting. Secrets are encrypted with key

2314

# based on what config file has. If config file is

2315

# removed/edited, old secret will thus be unrecovable.

2316

clients = []

2317

for client in tcp_server.clients.itervalues():

2318

client.encrypt_secret(

2319

client_settings[client.name]["secret"])

2320

2321

client_dict = {}

2322

2323

# A list of attributes that will not be stored when

2324

# shutting down.

2325

exclude = set(("bus", "changedstate", "secret"))

2326

for name, typ in inspect.getmembers(dbus.service.Object):

2327

exclude.add(name)

2328

2329

client_dict["encrypted_secret"] = client.encrypted_secret

2330

for attr in client.client_structure:

2331

if attr not in exclude:

2332

client_dict[attr] = getattr(client, attr)

2333

2334

clients.append(client_dict)

2335

del client_settings[client.name]["secret"]

2336

2337

try:

2338

with os.fdopen(os.open(stored_state_path,

2339

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2340

stat.S_IRUSR | stat.S_IWUSR),

2341

"wb") as stored_state:

2342

pickle.dump((clients, client_settings), stored_state)

2343

except IOError as e:

2344

logger.warning("Could not save persistant state: {0}"

2345

.format(e))

2346

if e.errno != errno.ENOENT:

2347

raise

2348

2349

# Delete all clients, and settings from config

2350

2013

while tcp_server.clients:

2351

name, client = tcp_server.clients.popitem()

2014

client = tcp_server.clients.pop()

2352

2015

if use_dbus:

2353

2016

client.remove_from_connection()

2017

client.disable_hook = None

2354

2018

# Don't signal anything except ClientRemoved

2355

2019

client.disable(quiet=True)

2356

2020

if use_dbus:

2357

2021

# Emit D-Bus signal

2358

mandos_dbus_service.ClientRemoved(client

2359

.dbus_object_path,

2022

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2360

2023

client.name)

2361

client_settings.clear()

2362

2024

2363

2025

atexit.register(cleanup)

2364

2026

2365

for client in tcp_server.clients.itervalues():

2027

for client in tcp_server.clients:

2366

2028

if use_dbus:

2367

2029

# Emit D-Bus signal

2368

2030

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2369

# Need to initiate checking of clients

2370

if client.enabled:

2371

client.init_checker()

2372

2031

client.enable()

2373

2032

2374

2033

tcp_server.enable()

2375

2034

tcp_server.server_activate()

2415

2074

# Must run before the D-Bus bus name gets deregistered

2416

2075

cleanup()

2417

2076

2418

2419

2077

if __name__ == '__main__':

2420

2078

main()