/mandos/trunk : revision 500

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

67

65

68

66

import dbus

69

67

import dbus.service

74

72

import ctypes.util

75

73

import xml.dom.minidom

76

74

import inspect

77

import Crypto.Cipher.AES

78

75

79

76

try:

80

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

SO_BINDTODEVICE = None

86

83

87

84

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

93

89

syslogger = (logging.handlers.SysLogHandler

94

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

91

address = str("/dev/log")))

99

95

logger.addHandler(syslogger)

100

96

101

97

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

104

99

' %(levelname)s:'

105

100

' %(message)s'))

106

101

logger.addHandler(console)

107

102

108

109

103

class AvahiError(Exception):

110

104

def __init__(self, value, *args, **kwargs):

111

105

self.value = value

165

159

" after %i retries, exiting.",

166

160

self.rename_count)

167

161

raise AvahiServiceError("Too many renames")

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

170

163

logger.info("Changing Zeroconf service name to %r ...",

171

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

172

169

self.remove()

173

170

try:

174

171

self.add()

194

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

195

192

self.entry_group_state_changed_match = (

196

193

self.group.connect_to_signal(

197

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

198

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

199

196

self.name, self.type)

200

197

self.group.AddService(

266

263

self.server_state_changed)

267

264

self.server_state_changed(self.server.GetState())

268

265

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

278

266

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

285

267

class Client(object):

286

268

"""A representation of a client host served by this server.

287

269

299

281

instance %(name)s can be used in the command.

300

282

checker_initiator_tag: a gobject event source tag, or None

301

283

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

304

284

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

305

286

disable_initiator_tag: a gobject event source tag, or None

306

287

enabled: bool()

307

288

fingerprint: string (40 or 32 hexadecimal digits); used to

310

291

interval: datetime.timedelta(); How often to start a new checker

311

292

last_approval_request: datetime.datetime(); (UTC) or None

312

293

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit

314

status of last checker. -1 reflect crashed

315

checker, or None.

316

294

last_enabled: datetime.datetime(); (UTC)

317

295

name: string; from the config file, used in log messages and

318

296

D-Bus identifiers

330

308

"host", "interval", "last_checked_ok",

331

309

"last_enabled", "name", "timeout")

332

310

311

@staticmethod

312

def _timedelta_to_milliseconds(td):

313

"Convert a datetime.timedelta() to milliseconds"

314

return ((td.days * 24 * 60 * 60 * 1000)

315

+ (td.seconds * 1000)

316

+ (td.microseconds // 1000))

317

333

318

def timeout_milliseconds(self):

334

319

"Return the 'timeout' attribute in milliseconds"

335

return _timedelta_to_milliseconds(self.timeout)

336

320

return self._timedelta_to_milliseconds(self.timeout)

321

337

322

def extended_timeout_milliseconds(self):

338

323

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

324

return self._timedelta_to_milliseconds(self.extended_timeout)

340

325

341

326

def interval_milliseconds(self):

342

327

"Return the 'interval' attribute in milliseconds"

343

return _timedelta_to_milliseconds(self.interval)

344

328

return self._timedelta_to_milliseconds(self.interval)

329

345

330

def approval_delay_milliseconds(self):

346

return _timedelta_to_milliseconds(self.approval_delay)

331

return self._timedelta_to_milliseconds(self.approval_delay)

347

332

348

def __init__(self, name = None, config=None):

333

def __init__(self, name = None, disable_hook=None, config=None):

349

334

"""Note: the 'checker' key in 'config' sets the

350

335

'checker_command' attribute and *not* the 'checker'

351

336

attribute."""

371

356

% self.name)

372

357

self.host = config.get("host", "")

373

358

self.created = datetime.datetime.utcnow()

374

self.enabled = True

359

self.enabled = False

375

360

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

361

self.last_enabled = None

377

362

self.last_checked_ok = None

378

self.last_checker_status = None

379

363

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

382

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

383

367

self.checker = None

384

368

self.checker_initiator_tag = None

385

369

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

370

self.expires = None

387

371

self.checker_callback_tag = None

388

372

self.checker_command = config["checker"]

389

373

self.current_checker_command = None

374

self.last_connect = None

390

375

self._approved = None

391

376

self.approved_by_default = config.get("approved_by_default",

392

377

True)

395

380

config["approval_delay"])

396

381

self.approval_duration = string_to_delta(

397

382

config["approval_duration"])

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr

402

in self.__dict__.iterkeys()

403

if not attr.startswith("_")]

404

self.client_structure.append("client_structure")

405

406

407

for name, t in inspect.getmembers(type(self),

408

lambda obj:

409

isinstance(obj,

410

property)):

411

if not name.startswith("_"):

412

self.client_structure.append(name)

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

413

384

414

# Send notice to process children that client state has changed

415

385

def send_changedstate(self):

416

with self.changedstate:

417

self.changedstate.notify_all()

418

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

419

390

def enable(self):

420

391

"""Start this client's checker and timeout hooks"""

421

392

if getattr(self, "enabled", False):

422

393

# Already enabled

423

394

return

424

395

self.send_changedstate()

396

self.last_enabled = datetime.datetime.utcnow()

397

# Schedule a new checker to be started an 'interval' from now,

398

# and every interval from then on.

399

self.checker_initiator_tag = (gobject.timeout_add

400

(self.interval_milliseconds(),

401

self.start_checker))

402

# Schedule a disable() when 'timeout' has passed

425

403

self.expires = datetime.datetime.utcnow() + self.timeout

404

self.disable_initiator_tag = (gobject.timeout_add

405

(self.timeout_milliseconds(),

406

self.disable))

426

407

self.enabled = True

427

self.last_enabled = datetime.datetime.utcnow()

428

self.init_checker()

408

# Also start a new checker *right now*.

409

self.start_checker()

429

410

430

411

def disable(self, quiet=True):

431

412

"""Disable this client."""

443

424

gobject.source_remove(self.checker_initiator_tag)

444

425

self.checker_initiator_tag = None

445

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

446

429

self.enabled = False

447

430

# Do not run this again if called by a gobject.timeout_add

448

431

return False

449

432

450

433

def __del__(self):

434

self.disable_hook = None

451

435

self.disable()

452

453

def init_checker(self):

454

# Schedule a new checker to be started an 'interval' from now,

455

# and every interval from then on.

456

self.checker_initiator_tag = (gobject.timeout_add

457

(self.interval_milliseconds(),

458

self.start_checker))

459

# Schedule a disable() when 'timeout' has passed

460

self.disable_initiator_tag = (gobject.timeout_add

461

(self.timeout_milliseconds(),

462

self.disable))

463

# Also start a new checker *right now*.

464

self.start_checker()

465

466

436

467

437

def checker_callback(self, pid, condition, command):

468

438

"""The checker has completed, so take appropriate actions."""

469

439

self.checker_callback_tag = None

470

440

self.checker = None

471

441

if os.WIFEXITED(condition):

472

self.last_checker_status = os.WEXITSTATUS(condition)

473

if self.last_checker_status == 0:

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

474

444

logger.info("Checker for %(name)s succeeded",

475

445

vars(self))

476

446

self.checked_ok()

478

448

logger.info("Checker for %(name)s failed",

479

449

vars(self))

480

450

else:

481

self.last_checker_status = -1

482

451

logger.warning("Checker for %(name)s crashed?",

483

452

vars(self))

484

453

491

460

if timeout is None:

492

461

timeout = self.timeout

493

462

self.last_checked_ok = datetime.datetime.utcnow()

494

if self.disable_initiator_tag is not None:

495

gobject.source_remove(self.disable_initiator_tag)

496

if getattr(self, "enabled", False):

497

self.disable_initiator_tag = (gobject.timeout_add

498

(_timedelta_to_milliseconds

499

(timeout), self.disable))

500

self.expires = datetime.datetime.utcnow() + timeout

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(self._timedelta_to_milliseconds(timeout),

467

self.disable))

501

468

502

469

def need_approval(self):

503

470

self.last_approval_request = datetime.datetime.utcnow()

543

510

'replace')))

544

511

for attr in

545

512

self.runtime_expansions)

546

513

547

514

try:

548

515

command = self.checker_command % escaped_attrs

549

516

except TypeError as error:

595

562

raise

596

563

self.checker = None

597

564

598

# Encrypts a client secret and stores it in a varible

599

# encrypted_secret

600

def encrypt_secret(self, key):

601

# Encryption-key need to be of a specific size, so we hash

602

# supplied key

603

hasheng = hashlib.sha256()

604

hasheng.update(key)

605

encryptionkey = hasheng.digest()

606

607

# Create validation hash so we know at decryption if it was

608

# sucessful

609

hasheng = hashlib.sha256()

610

hasheng.update(self.secret)

611

validationhash = hasheng.digest()

612

613

# Encrypt secret

614

iv = os.urandom(Crypto.Cipher.AES.block_size)

615

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

616

Crypto.Cipher.AES.MODE_CFB, iv)

617

ciphertext = ciphereng.encrypt(validationhash+self.secret)

618

self.encrypted_secret = (ciphertext, iv)

619

620

# Decrypt a encrypted client secret

621

def decrypt_secret(self, key):

622

# Decryption-key need to be of a specific size, so we hash

623

# supplied key

624

hasheng = hashlib.sha256()

625

hasheng.update(key)

626

encryptionkey = hasheng.digest()

627

628

# Decrypt encrypted secret

629

ciphertext, iv = self.encrypted_secret

630

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

631

Crypto.Cipher.AES.MODE_CFB, iv)

632

plain = ciphereng.decrypt(ciphertext)

633

634

# Validate decrypted secret to know if it was succesful

635

hasheng = hashlib.sha256()

636

validationhash = plain[:hasheng.digest_size]

637

secret = plain[hasheng.digest_size:]

638

hasheng.update(secret)

639

640

# If validation fails, we use key as new secret. Otherwise, we

641

# use the decrypted secret

642

if hasheng.digest() == validationhash:

643

self.secret = secret

644

else:

645

self.secret = key

646

del self.encrypted_secret

647

648

649

565

def dbus_service_property(dbus_interface, signature="v",

650

566

access="readwrite", byte_arrays=False):

651

567

"""Decorators for marking methods of a DBusObjectWithProperties to

697

613

698

614

class DBusObjectWithProperties(dbus.service.Object):

699

615

"""A D-Bus object with properties.

700

616

701

617

Classes inheriting from this can use the dbus_service_property

702

618

decorator to expose methods as D-Bus properties. It exposes the

703

619

standard Get(), Set(), and GetAll() methods on the D-Bus.

710

626

def _get_all_dbus_properties(self):

711

627

"""Returns a generator of (name, attribute) pairs

712

628

"""

713

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

714

for cls in self.__class__.__mro__

629

return ((prop._dbus_name, prop)

715

630

for name, prop in

716

inspect.getmembers(cls, self._is_dbus_property))

631

inspect.getmembers(self, self._is_dbus_property))

717

632

718

633

def _get_dbus_property(self, interface_name, property_name):

719

634

"""Returns a bound method if one exists which is a D-Bus

720

635

property with the specified name and interface.

721

636

"""

722

for cls in self.__class__.__mro__:

723

for name, value in (inspect.getmembers

724

(cls, self._is_dbus_property)):

725

if (value._dbus_name == property_name

726

and value._dbus_interface == interface_name):

727

return value.__get__(self)

728

637

for name in (property_name,

638

property_name + "_dbus_property"):

639

prop = getattr(self, name, None)

640

if (prop is None

641

or not self._is_dbus_property(prop)

642

or prop._dbus_name != property_name

643

or (interface_name and prop._dbus_interface

644

and interface_name != prop._dbus_interface)):

645

continue

646

return prop

729

647

# No such property

730

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

731

649

+ interface_name + "."

765

683

def GetAll(self, interface_name):

766

684

"""Standard D-Bus property GetAll() method, see D-Bus

767

685

standard.

768

686

769

687

Note: Will not include properties with access="write".

770

688

"""

771

689

all = {}

833

751

return xmlstring

834

752

835

753

836

def datetime_to_dbus (dt, variant_level=0):

837

"""Convert a UTC datetime.datetime() to a D-Bus type."""

838

if dt is None:

839

return dbus.String("", variant_level = variant_level)

840

return dbus.String(dt.isoformat(),

841

variant_level=variant_level)

842

843

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

844

.__metaclass__):

845

"""Applied to an empty subclass of a D-Bus object, this metaclass

846

will add additional D-Bus attributes matching a certain pattern.

847

"""

848

def __new__(mcs, name, bases, attr):

849

# Go through all the base classes which could have D-Bus

850

# methods, signals, or properties in them

851

for base in (b for b in bases

852

if issubclass(b, dbus.service.Object)):

853

# Go though all attributes of the base class

854

for attrname, attribute in inspect.getmembers(base):

855

# Ignore non-D-Bus attributes, and D-Bus attributes

856

# with the wrong interface name

857

if (not hasattr(attribute, "_dbus_interface")

858

or not attribute._dbus_interface

859

.startswith("se.recompile.Mandos")):

860

continue

861

# Create an alternate D-Bus interface name based on

862

# the current name

863

alt_interface = (attribute._dbus_interface

864

.replace("se.recompile.Mandos",

865

"se.bsnet.fukt.Mandos"))

866

# Is this a D-Bus signal?

867

if getattr(attribute, "_dbus_is_signal", False):

868

# Extract the original non-method function by

869

# black magic

870

nonmethod_func = (dict(

871

zip(attribute.func_code.co_freevars,

872

attribute.__closure__))["func"]

873

.cell_contents)

874

# Create a new, but exactly alike, function

875

# object, and decorate it to be a new D-Bus signal

876

# with the alternate D-Bus interface name

877

new_function = (dbus.service.signal

878

(alt_interface,

879

attribute._dbus_signature)

880

(types.FunctionType(

881

nonmethod_func.func_code,

882

nonmethod_func.func_globals,

883

nonmethod_func.func_name,

884

nonmethod_func.func_defaults,

885

nonmethod_func.func_closure)))

886

# Define a creator of a function to call both the

887

# old and new functions, so both the old and new

888

# signals gets sent when the function is called

889

def fixscope(func1, func2):

890

"""This function is a scope container to pass

891

func1 and func2 to the "call_both" function

892

outside of its arguments"""

893

def call_both(*args, **kwargs):

894

"""This function will emit two D-Bus

895

signals by calling func1 and func2"""

896

func1(*args, **kwargs)

897

func2(*args, **kwargs)

898

return call_both

899

# Create the "call_both" function and add it to

900

# the class

901

attr[attrname] = fixscope(attribute,

902

new_function)

903

# Is this a D-Bus method?

904

elif getattr(attribute, "_dbus_is_method", False):

905

# Create a new, but exactly alike, function

906

# object. Decorate it to be a new D-Bus method

907

# with the alternate D-Bus interface name. Add it

908

# to the class.

909

attr[attrname] = (dbus.service.method

910

(alt_interface,

911

attribute._dbus_in_signature,

912

attribute._dbus_out_signature)

913

(types.FunctionType

914

(attribute.func_code,

915

attribute.func_globals,

916

attribute.func_name,

917

attribute.func_defaults,

918

attribute.func_closure)))

919

# Is this a D-Bus property?

920

elif getattr(attribute, "_dbus_is_property", False):

921

# Create a new, but exactly alike, function

922

# object, and decorate it to be a new D-Bus

923

# property with the alternate D-Bus interface

924

# name. Add it to the class.

925

attr[attrname] = (dbus_service_property

926

(alt_interface,

927

attribute._dbus_signature,

928

attribute._dbus_access,

929

attribute

930

._dbus_get_args_options

931

["byte_arrays"])

932

(types.FunctionType

933

(attribute.func_code,

934

attribute.func_globals,

935

attribute.func_name,

936

attribute.func_defaults,

937

attribute.func_closure)))

938

return type.__new__(mcs, name, bases, attr)

939

940

754

class ClientDBus(Client, DBusObjectWithProperties):

941

755

"""A Client class using D-Bus

942

756

951

765

# dbus.service.Object doesn't use super(), so we can't either.

952

766

953

767

def __init__(self, bus = None, *args, **kwargs):

954

self.bus = bus

955

768

self._approvals_pending = 0

769

self.bus = bus

956

770

Client.__init__(self, *args, **kwargs)

957

self.add_to_dbus()

958

959

def add_to_dbus(self):

960

771

# Only now, when this client is initialized, can it show up on

961

772

# the D-Bus

962

773

client_object_name = unicode(self.name).translate(

966

777

("/clients/" + client_object_name))

967

778

DBusObjectWithProperties.__init__(self, self.bus,

968

779

self.dbus_object_path)

780

def _set_expires(self, value):

781

old_value = getattr(self, "_expires", None)

782

self._expires = value

783

if hasattr(self, "dbus_object_path") and old_value != value:

784

dbus_time = (self._datetime_to_dbus(self._expires,

785

variant_level=1))

786

self.PropertyChanged(dbus.String("Expires"),

787

dbus_time)

788

expires = property(lambda self: self._expires, _set_expires)

789

del _set_expires

969

790

970

def notifychangeproperty(transform_func,

971

dbus_name, type_func=lambda x: x,

972

variant_level=1):

973

""" Modify a variable so that it's a property which announces

974

its changes to DBus.

791

def _get_approvals_pending(self):

792

return self._approvals_pending

793

def _set_approvals_pending(self, value):

794

old_value = self._approvals_pending

795

self._approvals_pending = value

796

bval = bool(value)

797

if (hasattr(self, "dbus_object_path")

798

and bval is not bool(old_value)):

799

dbus_bool = dbus.Boolean(bval, variant_level=1)

800

self.PropertyChanged(dbus.String("ApprovalPending"),

801

dbus_bool)

975

802

976

transform_fun: Function that takes a value and a variant_level

977

and transforms it to a D-Bus type.

978

dbus_name: D-Bus name of the variable

979

type_func: Function that transform the value before sending it

980

to the D-Bus. Default: no transform

981

variant_level: D-Bus variant level. Default: 1

982

"""

983

attrname = "_{0}".format(dbus_name)

984

def setter(self, value):

985

if hasattr(self, "dbus_object_path"):

986

if (not hasattr(self, attrname) or

987

type_func(getattr(self, attrname, None))

988

!= type_func(value)):

989

dbus_value = transform_func(type_func(value),

990

variant_level

991

=variant_level)

992

self.PropertyChanged(dbus.String(dbus_name),

993

dbus_value)

994

setattr(self, attrname, value)

995

996

return property(lambda self: getattr(self, attrname), setter)

997

998

999

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1000

approvals_pending = notifychangeproperty(dbus.Boolean,

1001

"ApprovalPending",

1002

type_func = bool)

1003

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1004

last_enabled = notifychangeproperty(datetime_to_dbus,

1005

"LastEnabled")

1006

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1007

type_func = lambda checker:

1008

checker is not None)

1009

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1010

"LastCheckedOK")

1011

last_approval_request = notifychangeproperty(

1012

datetime_to_dbus, "LastApprovalRequest")

1013

approved_by_default = notifychangeproperty(dbus.Boolean,

1014

"ApprovedByDefault")

1015

approval_delay = notifychangeproperty(dbus.UInt16,

1016

"ApprovalDelay",

1017

type_func =

1018

_timedelta_to_milliseconds)

1019

approval_duration = notifychangeproperty(

1020

dbus.UInt16, "ApprovalDuration",

1021

type_func = _timedelta_to_milliseconds)

1022

host = notifychangeproperty(dbus.String, "Host")

1023

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1024

type_func =

1025

_timedelta_to_milliseconds)

1026

extended_timeout = notifychangeproperty(

1027

dbus.UInt16, "ExtendedTimeout",

1028

type_func = _timedelta_to_milliseconds)

1029

interval = notifychangeproperty(dbus.UInt16,

1030

"Interval",

1031

type_func =

1032

_timedelta_to_milliseconds)

1033

checker_command = notifychangeproperty(dbus.String, "Checker")

1034

1035

del notifychangeproperty

803

approvals_pending = property(_get_approvals_pending,

804

_set_approvals_pending)

805

del _get_approvals_pending, _set_approvals_pending

806

807

@staticmethod

808

def _datetime_to_dbus(dt, variant_level=0):

809

"""Convert a UTC datetime.datetime() to a D-Bus type."""

810

if dt is None:

811

return dbus.String("", variant_level = variant_level)

812

return dbus.String(dt.isoformat(),

813

variant_level=variant_level)

814

815

def enable(self):

816

oldstate = getattr(self, "enabled", False)

817

r = Client.enable(self)

818

if oldstate != self.enabled:

819

# Emit D-Bus signals

820

self.PropertyChanged(dbus.String("Enabled"),

821

dbus.Boolean(True, variant_level=1))

822

self.PropertyChanged(

823

dbus.String("LastEnabled"),

824

self._datetime_to_dbus(self.last_enabled,

825

variant_level=1))

826

return r

827

828

def disable(self, quiet = False):

829

oldstate = getattr(self, "enabled", False)

830

r = Client.disable(self, quiet=quiet)

831

if not quiet and oldstate != self.enabled:

832

# Emit D-Bus signal

833

self.PropertyChanged(dbus.String("Enabled"),

834

dbus.Boolean(False, variant_level=1))

835

return r

1036

836

1037

837

def __del__(self, *args, **kwargs):

1038

838

try:

1047

847

*args, **kwargs):

1048

848

self.checker_callback_tag = None

1049

849

self.checker = None

850

# Emit D-Bus signal

851

self.PropertyChanged(dbus.String("CheckerRunning"),

852

dbus.Boolean(False, variant_level=1))

1050

853

if os.WIFEXITED(condition):

1051

854

exitstatus = os.WEXITSTATUS(condition)

1052

855

# Emit D-Bus signal

1062

865

return Client.checker_callback(self, pid, condition, command,

1063

866

*args, **kwargs)

1064

867

868

def checked_ok(self, *args, **kwargs):

869

Client.checked_ok(self, *args, **kwargs)

870

# Emit D-Bus signal

871

self.PropertyChanged(

872

dbus.String("LastCheckedOK"),

873

(self._datetime_to_dbus(self.last_checked_ok,

874

variant_level=1)))

875

876

def need_approval(self, *args, **kwargs):

877

r = Client.need_approval(self, *args, **kwargs)

878

# Emit D-Bus signal

879

self.PropertyChanged(

880

dbus.String("LastApprovalRequest"),

881

(self._datetime_to_dbus(self.last_approval_request,

882

variant_level=1)))

883

return r

884

1065

885

def start_checker(self, *args, **kwargs):

1066

886

old_checker = self.checker

1067

887

if self.checker is not None:

1074

894

and old_checker_pid != self.checker.pid):

1075

895

# Emit D-Bus signal

1076

896

self.CheckerStarted(self.current_checker_command)

897

self.PropertyChanged(

898

dbus.String("CheckerRunning"),

899

dbus.Boolean(True, variant_level=1))

1077

900

return r

1078

901

902

def stop_checker(self, *args, **kwargs):

903

old_checker = getattr(self, "checker", None)

904

r = Client.stop_checker(self, *args, **kwargs)

905

if (old_checker is not None

906

and getattr(self, "checker", None) is None):

907

self.PropertyChanged(dbus.String("CheckerRunning"),

908

dbus.Boolean(False, variant_level=1))

909

return r

910

1079

911

def _reset_approved(self):

1080

912

self._approved = None

1081

913

return False

1083

915

def approve(self, value=True):

1084

916

self.send_changedstate()

1085

917

self._approved = value

1086

gobject.timeout_add(_timedelta_to_milliseconds

918

gobject.timeout_add(self._timedelta_to_milliseconds

1087

919

(self.approval_duration),

1088

920

self._reset_approved)

1089

921

1090

922

1091

923

## D-Bus methods, signals & properties

1092

_interface = "se.recompile.Mandos.Client"

924

_interface = "se.bsnet.fukt.Mandos.Client"

1093

925

1094

926

## Signals

1095

927

1180

1012

def ApprovedByDefault_dbus_property(self, value=None):

1181

1013

if value is None: # get

1182

1014

return dbus.Boolean(self.approved_by_default)

1015

old_value = self.approved_by_default

1183

1016

self.approved_by_default = bool(value)

1017

# Emit D-Bus signal

1018

if old_value != self.approved_by_default:

1019

self.PropertyChanged(dbus.String("ApprovedByDefault"),

1020

dbus.Boolean(value, variant_level=1))

1184

1021

1185

1022

# ApprovalDelay - property

1186

1023

@dbus_service_property(_interface, signature="t",

1188

1025

def ApprovalDelay_dbus_property(self, value=None):

1189

1026

if value is None: # get

1190

1027

return dbus.UInt64(self.approval_delay_milliseconds())

1028

old_value = self.approval_delay

1191

1029

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1030

# Emit D-Bus signal

1031

if old_value != self.approval_delay:

1032

self.PropertyChanged(dbus.String("ApprovalDelay"),

1033

dbus.UInt64(value, variant_level=1))

1192

1034

1193

1035

# ApprovalDuration - property

1194

1036

@dbus_service_property(_interface, signature="t",

1195

1037

access="readwrite")

1196

1038

def ApprovalDuration_dbus_property(self, value=None):

1197

1039

if value is None: # get

1198

return dbus.UInt64(_timedelta_to_milliseconds(

1040

return dbus.UInt64(self._timedelta_to_milliseconds(

1199

1041

self.approval_duration))

1042

old_value = self.approval_duration

1200

1043

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1044

# Emit D-Bus signal

1045

if old_value != self.approval_duration:

1046

self.PropertyChanged(dbus.String("ApprovalDuration"),

1047

dbus.UInt64(value, variant_level=1))

1201

1048

1202

1049

# Name - property

1203

1050

@dbus_service_property(_interface, signature="s", access="read")

1215

1062

def Host_dbus_property(self, value=None):

1216

1063

if value is None: # get

1217

1064

return dbus.String(self.host)

1065

old_value = self.host

1218

1066

self.host = value

1067

# Emit D-Bus signal

1068

if old_value != self.host:

1069

self.PropertyChanged(dbus.String("Host"),

1070

dbus.String(value, variant_level=1))

1219

1071

1220

1072

# Created - property

1221

1073

@dbus_service_property(_interface, signature="s", access="read")

1222

1074

def Created_dbus_property(self):

1223

return dbus.String(datetime_to_dbus(self.created))

1075

return dbus.String(self._datetime_to_dbus(self.created))

1224

1076

1225

1077

# LastEnabled - property

1226

1078

@dbus_service_property(_interface, signature="s", access="read")

1227

1079

def LastEnabled_dbus_property(self):

1228

return datetime_to_dbus(self.last_enabled)

1080

return self._datetime_to_dbus(self.last_enabled)

1229

1081

1230

1082

# Enabled - property

1231

1083

@dbus_service_property(_interface, signature="b",

1245

1097

if value is not None:

1246

1098

self.checked_ok()

1247

1099

return

1248

return datetime_to_dbus(self.last_checked_ok)

1100

return self._datetime_to_dbus(self.last_checked_ok)

1249

1101

1250

1102

# Expires - property

1251

1103

@dbus_service_property(_interface, signature="s", access="read")

1252

1104

def Expires_dbus_property(self):

1253

return datetime_to_dbus(self.expires)

1105

return self._datetime_to_dbus(self.expires)

1254

1106

1255

1107

# LastApprovalRequest - property

1256

1108

@dbus_service_property(_interface, signature="s", access="read")

1257

1109

def LastApprovalRequest_dbus_property(self):

1258

return datetime_to_dbus(self.last_approval_request)

1110

return self._datetime_to_dbus(self.last_approval_request)

1259

1111

1260

1112

# Timeout - property

1261

1113

@dbus_service_property(_interface, signature="t",

1263

1115

def Timeout_dbus_property(self, value=None):

1264

1116

if value is None: # get

1265

1117

return dbus.UInt64(self.timeout_milliseconds())

1118

old_value = self.timeout

1266

1119

self.timeout = datetime.timedelta(0, 0, 0, value)

1120

# Emit D-Bus signal

1121

if old_value != self.timeout:

1122

self.PropertyChanged(dbus.String("Timeout"),

1123

dbus.UInt64(value, variant_level=1))

1267

1124

if getattr(self, "disable_initiator_tag", None) is None:

1268

1125

return

1269

1126

# Reschedule timeout

1270

1127

gobject.source_remove(self.disable_initiator_tag)

1271

1128

self.disable_initiator_tag = None

1272

1129

self.expires = None

1273

time_to_die = _timedelta_to_milliseconds((self

1274

.last_checked_ok

1275

+ self.timeout)

1276

- datetime.datetime

1277

.utcnow())

1130

time_to_die = (self.

1131

_timedelta_to_milliseconds((self

1132

.last_checked_ok

1133

+ self.timeout)

1134

- datetime.datetime

1135

.utcnow()))

1278

1136

if time_to_die <= 0:

1279

1137

# The timeout has passed

1280

1138

self.disable()

1281

1139

else:

1282

1140

self.expires = (datetime.datetime.utcnow()

1283

+ datetime.timedelta(milliseconds =

1284

time_to_die))

1141

+ datetime.timedelta(milliseconds = time_to_die))

1285

1142

self.disable_initiator_tag = (gobject.timeout_add

1286

1143

(time_to_die, self.disable))

1287

1144

1288

1145

# ExtendedTimeout - property

1289

1146

@dbus_service_property(_interface, signature="t",

1290

1147

access="readwrite")

1291

1148

def ExtendedTimeout_dbus_property(self, value=None):

1292

1149

if value is None: # get

1293

1150

return dbus.UInt64(self.extended_timeout_milliseconds())

1151

old_value = self.extended_timeout

1294

1152

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1295

1153

# Emit D-Bus signal

1154

if old_value != self.extended_timeout:

1155

self.PropertyChanged(dbus.String("ExtendedTimeout"),

1156

dbus.UInt64(value, variant_level=1))

1157

1296

1158

# Interval - property

1297

1159

@dbus_service_property(_interface, signature="t",

1298

1160

access="readwrite")

1299

1161

def Interval_dbus_property(self, value=None):

1300

1162

if value is None: # get

1301

1163

return dbus.UInt64(self.interval_milliseconds())

1164

old_value = self.interval

1302

1165

self.interval = datetime.timedelta(0, 0, 0, value)

1166

# Emit D-Bus signal

1167

if old_value != self.interval:

1168

self.PropertyChanged(dbus.String("Interval"),

1169

dbus.UInt64(value, variant_level=1))

1303

1170

if getattr(self, "checker_initiator_tag", None) is None:

1304

1171

return

1305

1172

# Reschedule checker run

1307

1174

self.checker_initiator_tag = (gobject.timeout_add

1308

1175

(value, self.start_checker))

1309

1176

self.start_checker() # Start one now, too

1310

1177

1311

1178

# Checker - property

1312

1179

@dbus_service_property(_interface, signature="s",

1313

1180

access="readwrite")

1314

1181

def Checker_dbus_property(self, value=None):

1315

1182

if value is None: # get

1316

1183

return dbus.String(self.checker_command)

1184

old_value = self.checker_command

1317

1185

self.checker_command = value

1186

# Emit D-Bus signal

1187

if old_value != self.checker_command:

1188

self.PropertyChanged(dbus.String("Checker"),

1189

dbus.String(self.checker_command,

1190

variant_level=1))

1318

1191

1319

1192

# CheckerRunning - property

1320

1193

@dbus_service_property(_interface, signature="b",

1347

1220

self._pipe.send(('init', fpr, address))

1348

1221

if not self._pipe.recv():

1349

1222

raise KeyError()

1350

1223

1351

1224

def __getattribute__(self, name):

1352

1225

if(name == '_pipe'):

1353

1226

return super(ProxyClient, self).__getattribute__(name)

1360

1233

self._pipe.send(('funcall', name, args, kwargs))

1361

1234

return self._pipe.recv()[1]

1362

1235

return func

1363

1236

1364

1237

def __setattr__(self, name, value):

1365

1238

if(name == '_pipe'):

1366

1239

return super(ProxyClient, self).__setattr__(name, value)

1367

1240

self._pipe.send(('setattr', name, value))

1368

1241

1369

class ClientDBusTransitional(ClientDBus):

1370

__metaclass__ = AlternateDBusNamesMetaclass

1371

1242

1372

1243

class ClientHandler(socketserver.BaseRequestHandler, object):

1373

1244

"""A class to handle client connections.

1381

1252

unicode(self.client_address))

1382

1253

logger.debug("Pipe FD: %d",

1383

1254

self.server.child_pipe.fileno())

1384

1255

1385

1256

session = (gnutls.connection

1386

1257

.ClientSession(self.request,

1387

1258

gnutls.connection

1388

1259

.X509Credentials()))

1389

1260

1390

1261

# Note: gnutls.connection.X509Credentials is really a

1391

1262

# generic GnuTLS certificate credentials object so long as

1392

1263

# no X.509 keys are added to it. Therefore, we can use it

1393

1264

# here despite using OpenPGP certificates.

1394

1265

1395

1266

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1396

1267

# "+AES-256-CBC", "+SHA1",

1397

1268

# "+COMP-NULL", "+CTYPE-OPENPGP",

1403

1274

(gnutls.library.functions

1404

1275

.gnutls_priority_set_direct(session._c_object,

1405

1276

priority, None))

1406

1277

1407

1278

# Start communication using the Mandos protocol

1408

1279

# Get protocol number

1409

1280

line = self.request.makefile().readline()

1414

1285

except (ValueError, IndexError, RuntimeError) as error:

1415

1286

logger.error("Unknown protocol version: %s", error)

1416

1287

return

1417

1288

1418

1289

# Start GnuTLS connection

1419

1290

try:

1420

1291

session.handshake()

1424

1295

# established. Just abandon the request.

1425

1296

return

1426

1297

logger.debug("Handshake succeeded")

1427

1298

1428

1299

approval_required = False

1429

1300

try:

1430

1301

try:

1435

1306

logger.warning("Bad certificate: %s", error)

1436

1307

return

1437

1308

logger.debug("Fingerprint: %s", fpr)

1438

1309

1439

1310

try:

1440

1311

client = ProxyClient(child_pipe, fpr,

1441

1312

self.client_address)

1453

1324

client.name)

1454

1325

if self.server.use_dbus:

1455

1326

# Emit D-Bus signal

1456

client.Rejected("Disabled")

1327

client.Rejected("Disabled")

1457

1328

return

1458

1329

1459

1330

if client._approved or not client.approval_delay:

1476

1347

return

1477

1348

1478

1349

#wait until timeout or approved

1350

#x = float(client._timedelta_to_milliseconds(delay))

1479

1351

time = datetime.datetime.now()

1480

1352

client.changedstate.acquire()

1481

(client.changedstate.wait

1482

(float(client._timedelta_to_milliseconds(delay)

1483

/ 1000)))

1353

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1484

1354

client.changedstate.release()

1485

1355

time2 = datetime.datetime.now()

1486

1356

if (time2 - time) >= delay:

1508

1378

sent, len(client.secret)

1509

1379

- (sent_size + sent))

1510

1380

sent_size += sent

1511

1381

1512

1382

logger.info("Sending secret to %s", client.name)

1513

# bump the timeout using extended_timeout

1383

# bump the timeout as if seen

1514

1384

client.checked_ok(client.extended_timeout)

1515

1385

if self.server.use_dbus:

1516

1386

# Emit D-Bus signal

1596

1466

except:

1597

1467

self.handle_error(request, address)

1598

1468

self.close_request(request)

1599

1469

1600

1470

def process_request(self, request, address):

1601

1471

"""Start a new process to process the request."""

1602

proc = multiprocessing.Process(target = self.sub_process_main,

1603

args = (request,

1604

address))

1605

proc.start()

1606

return proc

1607

1472

multiprocessing.Process(target = self.sub_process_main,

1473

args = (request, address)).start()

1608

1474

1609

1475

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1610

1476

""" adds a pipe to the MixIn """

1614

1480

This function creates a new pipe in self.pipe

1615

1481

"""

1616

1482

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1617

1618

proc = MultiprocessingMixIn.process_request(self, request,

1619

client_address)

1483

1484

super(MultiprocessingMixInWithPipe,

1485

self).process_request(request, client_address)

1620

1486

self.child_pipe.close()

1621

self.add_pipe(parent_pipe, proc)

1622

1623

def add_pipe(self, parent_pipe, proc):

1487

self.add_pipe(parent_pipe)

1488

1489

def add_pipe(self, parent_pipe):

1624

1490

"""Dummy function; override as necessary"""

1625

1491

raise NotImplementedError

1626

1492

1627

1628

1493

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1629

1494

socketserver.TCPServer, object):

1630

1495

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1704

1569

self.enabled = False

1705

1570

self.clients = clients

1706

1571

if self.clients is None:

1707

self.clients = {}

1572

self.clients = set()

1708

1573

self.use_dbus = use_dbus

1709

1574

self.gnutls_priority = gnutls_priority

1710

1575

IPv6_TCPServer.__init__(self, server_address,

1714

1579

def server_activate(self):

1715

1580

if self.enabled:

1716

1581

return socketserver.TCPServer.server_activate(self)

1717

1718

1582

def enable(self):

1719

1583

self.enabled = True

1720

1721

def add_pipe(self, parent_pipe, proc):

1584

def add_pipe(self, parent_pipe):

1722

1585

# Call "handle_ipc" for both data and EOF events

1723

1586

gobject.io_add_watch(parent_pipe.fileno(),

1724

1587

gobject.IO_IN | gobject.IO_HUP,

1725

1588

functools.partial(self.handle_ipc,

1726

parent_pipe =

1727

parent_pipe,

1728

proc = proc))

1729

1589

parent_pipe = parent_pipe))

1590

1730

1591

def handle_ipc(self, source, condition, parent_pipe=None,

1731

proc = None, client_object=None):

1592

client_object=None):

1732

1593

condition_names = {

1733

1594

gobject.IO_IN: "IN", # There is data to read.

1734

1595

gobject.IO_OUT: "OUT", # Data can be written (without

1743

1604

for cond, name in

1744

1605

condition_names.iteritems()

1745

1606

if cond & condition)

1746

# error, or the other end of multiprocessing.Pipe has closed

1607

# error or the other end of multiprocessing.Pipe has closed

1747

1608

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1748

# Wait for other process to exit

1749

proc.join()

1750

1609

return False

1751

1610

1752

1611

# Read a request from the child

1757

1616

fpr = request[1]

1758

1617

address = request[2]

1759

1618

1760

for c in self.clients.itervalues():

1619

for c in self.clients:

1761

1620

if c.fingerprint == fpr:

1762

1621

client = c

1763

1622

break

1766

1625

"dress: %s", fpr, address)

1767

1626

if self.use_dbus:

1768

1627

# Emit D-Bus signal

1769

mandos_dbus_service.ClientNotFound(fpr,

1770

address[0])

1628

mandos_dbus_service.ClientNotFound(fpr, address[0])

1771

1629

parent_pipe.send(False)

1772

1630

return False

1773

1631

1774

1632

gobject.io_add_watch(parent_pipe.fileno(),

1775

1633

gobject.IO_IN | gobject.IO_HUP,

1776

1634

functools.partial(self.handle_ipc,

1777

parent_pipe =

1778

parent_pipe,

1779

proc = proc,

1780

client_object =

1781

client))

1635

parent_pipe = parent_pipe,

1636

client_object = client))

1782

1637

parent_pipe.send(True)

1783

# remove the old hook in favor of the new above hook on

1784

# same fileno

1638

# remove the old hook in favor of the new above hook on same fileno

1785

1639

return False

1786

1640

if command == 'funcall':

1787

1641

funcname = request[1]

1788

1642

args = request[2]

1789

1643

kwargs = request[3]

1790

1644

1791

parent_pipe.send(('data', getattr(client_object,

1792

funcname)(*args,

1793

**kwargs)))

1794

1645

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1646

1795

1647

if command == 'getattr':

1796

1648

attrname = request[1]

1797

1649

if callable(client_object.__getattribute__(attrname)):

1798

1650

parent_pipe.send(('function',))

1799

1651

else:

1800

parent_pipe.send(('data', client_object

1801

.__getattribute__(attrname)))

1652

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1802

1653

1803

1654

if command == 'setattr':

1804

1655

attrname = request[1]

1805

1656

value = request[2]

1806

1657

setattr(client_object, attrname, value)

1807

1658

1808

1659

return True

1809

1660

1810

1661

1931

1782

" system bus interface")

1932

1783

parser.add_argument("--no-ipv6", action="store_false",

1933

1784

dest="use_ipv6", help="Do not use IPv6")

1934

parser.add_argument("--no-restore", action="store_false",

1935

dest="restore",

1936

help="Do not restore stored state",

1937

default=True)

1938

1939

1785

options = parser.parse_args()

1940

1786

1941

1787

if options.check:

1976

1822

# options, if set.

1977

1823

for option in ("interface", "address", "port", "debug",

1978

1824

"priority", "servicename", "configdir",

1979

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1825

"use_dbus", "use_ipv6", "debuglevel"):

1980

1826

value = getattr(options, option)

1981

1827

if value is not None:

1982

1828

server_settings[option] = value

1994

1840

debuglevel = server_settings["debuglevel"]

1995

1841

use_dbus = server_settings["use_dbus"]

1996

1842

use_ipv6 = server_settings["use_ipv6"]

1997

1843

1998

1844

if server_settings["servicename"] != "Mandos":

1999

1845

syslogger.setFormatter(logging.Formatter

2000

1846

('Mandos (%s) [%%(process)d]:'

2055

1901

raise error

2056

1902

2057

1903

if not debug and not debuglevel:

2058

logger.setLevel(logging.WARNING)

1904

syslogger.setLevel(logging.WARNING)

1905

console.setLevel(logging.WARNING)

2059

1906

if debuglevel:

2060

1907

level = getattr(logging, debuglevel.upper())

2061

logger.setLevel(level)

2062

1908

syslogger.setLevel(level)

1909

console.setLevel(level)

1910

2063

1911

if debug:

2064

logger.setLevel(logging.DEBUG)

2065

1912

# Enable all possible GnuTLS debugging

2066

1913

2067

1914

# "Use a log level over 10 to enable all debugging options."

2097

1944

# End of Avahi example code

2098

1945

if use_dbus:

2099

1946

try:

2100

bus_name = dbus.service.BusName("se.recompile.Mandos",

1947

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2101

1948

bus, do_not_queue=True)

2102

old_bus_name = (dbus.service.BusName

2103

("se.bsnet.fukt.Mandos", bus,

2104

do_not_queue=True))

2105

1949

except dbus.exceptions.NameExistsException as e:

2106

1950

logger.error(unicode(e) + ", disabling D-Bus")

2107

1951

use_dbus = False

2108

1952

server_settings["use_dbus"] = False

2109

1953

tcp_server.use_dbus = False

2110

1954

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2111

service = AvahiServiceToSyslog(name =

2112

server_settings["servicename"],

2113

servicetype = "_mandos._tcp",

2114

protocol = protocol, bus = bus)

1955

service = AvahiService(name = server_settings["servicename"],

1956

servicetype = "_mandos._tcp",

1957

protocol = protocol, bus = bus)

2115

1958

if server_settings["interface"]:

2116

1959

service.interface = (if_nametoindex

2117

1960

(str(server_settings["interface"])))

2121

1964

2122

1965

client_class = Client

2123

1966

if use_dbus:

2124

client_class = functools.partial(ClientDBusTransitional,

2125

bus = bus)

2126

2127

special_settings = {

2128

# Some settings need to be accessd by special methods;

2129

# booleans need .getboolean(), etc. Here is a list of them:

2130

"approved_by_default":

2131

lambda section:

2132

client_config.getboolean(section, "approved_by_default"),

2133

}

2134

# Construct a new dict of client settings of this form:

2135

# { client_name: {setting_name: value, ...}, ...}

2136

# with exceptions for any special settings as defined above

2137

client_settings = dict((clientname,

2138

dict((setting,

2139

(value if

2140

setting not in special_settings

2141

else special_settings[setting]

2142

(clientname)))

2143

for setting, value

2144

in client_config.items(clientname)))

2145

for clientname in client_config.sections())

2146

2147

old_client_settings = {}

2148

clients_data = []

2149

2150

# Get client data and settings from last running state.

2151

if server_settings["restore"]:

2152

try:

2153

with open(stored_state_path, "rb") as stored_state:

2154

clients_data, old_client_settings = (

2155

pickle.load(stored_state))

2156

os.remove(stored_state_path)

2157

except IOError as e:

2158

logger.warning("Could not load persistant state: {0}"

2159

.format(e))

2160

if e.errno != errno.ENOENT:

2161

raise

2162

2163

for client in clients_data:

2164

client_name = client["name"]

2165

2166

# Decide which value to use after restoring saved state.

2167

# We have three different values: Old config file,

2168

# new config file, and saved state.

2169

# New config value takes precedence if it differs from old

2170

# config value, otherwise use saved state.

2171

for name, value in client_settings[client_name].items():

1967

client_class = functools.partial(ClientDBus, bus = bus)

1968

def client_config_items(config, section):

1969

special_settings = {

1970

"approved_by_default":

1971

lambda: config.getboolean(section,

1972

"approved_by_default"),

1973

}

1974

for name, value in config.items(section):

2172

1975

try:

2173

# For each value in new config, check if it differs

2174

# from the old config value (Except for the "secret"

2175

# attribute)

2176

if (name != "secret" and

2177

value != old_client_settings[client_name][name]):

2178

setattr(client, name, value)

1976

yield (name, special_settings[name]())

2179

1977

except KeyError:

2180

pass

2181

2182

# Clients who has passed its expire date, can still be enabled

2183

# if its last checker was sucessful. Clients who checkers

2184

# failed before we stored it state is asumed to had failed

2185

# checker during downtime.

2186

if client["enabled"] and client["last_checked_ok"]:

2187

if ((datetime.datetime.utcnow()

2188

- client["last_checked_ok"]) > client["interval"]):

2189

if client["last_checker_status"] != 0:

2190

client["enabled"] = False

2191

else:

2192

client["expires"] = (datetime.datetime.utcnow()

2193

+ client["timeout"])

2194

2195

client["changedstate"] = (multiprocessing_manager

2196

.Condition(multiprocessing_manager

2197

.Lock()))

2198

if use_dbus:

2199

new_client = ClientDBusTransitional.__new__(

2200

ClientDBusTransitional)

2201

tcp_server.clients[client_name] = new_client

2202

new_client.bus = bus

2203

for name, value in client.iteritems():

2204

setattr(new_client, name, value)

2205

new_client._approvals_pending = 0

2206

new_client.add_to_dbus()

2207

else:

2208

tcp_server.clients[client_name] = Client.__new__(Client)

2209

for name, value in client.iteritems():

2210

setattr(tcp_server.clients[client_name], name, value)

2211

2212

tcp_server.clients[client_name].decrypt_secret(

2213

client_settings[client_name]["secret"])

2214

2215

# Create/remove clients based on new changes made to config

2216

for clientname in set(old_client_settings) - set(client_settings):

2217

del tcp_server.clients[clientname]

2218

for clientname in set(client_settings) - set(old_client_settings):

2219

tcp_server.clients[clientname] = client_class(name

2220

= clientname,

2221

config =

2222

client_settings

2223

[clientname])

1978

yield (name, value)

2224

1979

1980

tcp_server.clients.update(set(

1981

client_class(name = section,

1982

config= dict(client_config_items(

1983

client_config, section)))

1984

for section in client_config.sections()))

2225

1985

if not tcp_server.clients:

2226

1986

logger.warning("No clients defined")

2227

1987

2240

2000

del pidfilename

2241

2001

2242

2002

signal.signal(signal.SIGINT, signal.SIG_IGN)

2243

2003

2244

2004

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2245

2005

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2246

2006

2249

2009

"""A D-Bus proxy object"""

2250

2010

def __init__(self):

2251

2011

dbus.service.Object.__init__(self, bus, "/")

2252

_interface = "se.recompile.Mandos"

2012

_interface = "se.bsnet.fukt.Mandos"

2253

2013

2254

2014

@dbus.service.signal(_interface, signature="o")

2255

2015

def ClientAdded(self, objpath):

2270

2030

def GetAllClients(self):

2271

2031

"D-Bus method"

2272

2032

return dbus.Array(c.dbus_object_path

2273

for c in

2274

tcp_server.clients.itervalues())

2033

for c in tcp_server.clients)

2275

2034

2276

2035

@dbus.service.method(_interface,

2277

2036

out_signature="a{oa{sv}}")

2279

2038

"D-Bus method"

2280

2039

return dbus.Dictionary(

2281

2040

((c.dbus_object_path, c.GetAll(""))

2282

for c in tcp_server.clients.itervalues()),

2041

for c in tcp_server.clients),

2283

2042

signature="oa{sv}")

2284

2043

2285

2044

@dbus.service.method(_interface, in_signature="o")

2286

2045

def RemoveClient(self, object_path):

2287

2046

"D-Bus method"

2288

for c in tcp_server.clients.itervalues():

2047

for c in tcp_server.clients:

2289

2048

if c.dbus_object_path == object_path:

2290

del tcp_server.clients[c.name]

2049

tcp_server.clients.remove(c)

2291

2050

c.remove_from_connection()

2292

2051

# Don't signal anything except ClientRemoved

2293

2052

c.disable(quiet=True)

2298

2057

2299

2058

del _interface

2300

2059

2301

class MandosDBusServiceTransitional(MandosDBusService):

2302

__metaclass__ = AlternateDBusNamesMetaclass

2303

mandos_dbus_service = MandosDBusServiceTransitional()

2060

mandos_dbus_service = MandosDBusService()

2304

2061

2305

2062

def cleanup():

2306

2063

"Cleanup function; run on exit"

2307

2064

service.cleanup()

2308

2065

2309

multiprocessing.active_children()

2310

if not (tcp_server.clients or client_settings):

2311

return

2312

2313

# Store client before exiting. Secrets are encrypted with key

2314

# based on what config file has. If config file is

2315

# removed/edited, old secret will thus be unrecovable.

2316

clients = []

2317

for client in tcp_server.clients.itervalues():

2318

client.encrypt_secret(

2319

client_settings[client.name]["secret"])

2320

2321

client_dict = {}

2322

2323

# A list of attributes that will not be stored when

2324

# shutting down.

2325

exclude = set(("bus", "changedstate", "secret"))

2326

for name, typ in inspect.getmembers(dbus.service.Object):

2327

exclude.add(name)

2328

2329

client_dict["encrypted_secret"] = client.encrypted_secret

2330

for attr in client.client_structure:

2331

if attr not in exclude:

2332

client_dict[attr] = getattr(client, attr)

2333

2334

clients.append(client_dict)

2335

del client_settings[client.name]["secret"]

2336

2337

try:

2338

with os.fdopen(os.open(stored_state_path,

2339

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2340

stat.S_IRUSR | stat.S_IWUSR),

2341

"wb") as stored_state:

2342

pickle.dump((clients, client_settings), stored_state)

2343

except IOError as e:

2344

logger.warning("Could not save persistant state: {0}"

2345

.format(e))

2346

if e.errno != errno.ENOENT:

2347

raise

2348

2349

# Delete all clients, and settings from config

2350

2066

while tcp_server.clients:

2351

name, client = tcp_server.clients.popitem()

2067

client = tcp_server.clients.pop()

2352

2068

if use_dbus:

2353

2069

client.remove_from_connection()

2070

client.disable_hook = None

2354

2071

# Don't signal anything except ClientRemoved

2355

2072

client.disable(quiet=True)

2356

2073

if use_dbus:

2357

2074

# Emit D-Bus signal

2358

mandos_dbus_service.ClientRemoved(client

2359

.dbus_object_path,

2075

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2360

2076

client.name)

2361

client_settings.clear()

2362

2077

2363

2078

atexit.register(cleanup)

2364

2079

2365

for client in tcp_server.clients.itervalues():

2080

for client in tcp_server.clients:

2366

2081

if use_dbus:

2367

2082

# Emit D-Bus signal

2368

2083

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2369

# Need to initiate checking of clients

2370

if client.enabled:

2371

client.init_checker()

2372

2084

client.enable()

2373

2085

2374

2086

tcp_server.enable()

2375

2087

tcp_server.server_activate()

2415

2127

# Must run before the D-Bus bus name gets deregistered

2416

2128

cleanup()

2417

2129

2418

2419

2130

if __name__ == '__main__':

2420

2131

main()