/mandos/trunk : revision 502.1.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

64

62

import functools

65

63

import cPickle as pickle

66

64

import multiprocessing

67

import types

68

import binascii

69

import tempfile

70

import itertools

71

import collections

72

65

73

66

import dbus

74

67

import dbus.service

79

72

import ctypes.util

80

73

import xml.dom.minidom

81

74

import inspect

82

import GnuPGInterface

83

75

84

76

try:

85

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

89

81

except ImportError:

90

82

SO_BINDTODEVICE = None

91

83

92

version = "1.6.0"

93

stored_state_file = "clients.pickle"

94

95

logger = logging.getLogger()

84

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

96

89

syslogger = (logging.handlers.SysLogHandler

97

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

98

91

address = str("/dev/log")))

99

100

try:

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

104

except (OSError, AttributeError):

105

def if_nametoindex(interface):

106

"Get an interface index the hard way, i.e. using fcntl()"

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

108

with contextlib.closing(socket.socket()) as s:

109

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

110

struct.pack(str("16s16x"),

111

interface))

112

interface_index = struct.unpack(str("I"),

113

ifreq[16:20])[0]

114

return interface_index

115

116

117

def initlogger(debug, level=logging.WARNING):

118

"""init logger and add loglevel"""

119

120

syslogger.setFormatter(logging.Formatter

121

('Mandos [%(process)d]: %(levelname)s:'

122

' %(message)s'))

123

logger.addHandler(syslogger)

124

125

if debug:

126

console = logging.StreamHandler()

127

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

128

' [%(process)d]:'

129

' %(levelname)s:'

130

' %(message)s'))

131

logger.addHandler(console)

132

logger.setLevel(level)

133

134

135

class PGPError(Exception):

136

"""Exception if encryption/decryption fails"""

137

pass

138

139

140

class PGPEngine(object):

141

"""A simple class for OpenPGP symmetric encryption & decryption"""

142

def __init__(self):

143

self.gnupg = GnuPGInterface.GnuPG()

144

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

145

self.gnupg = GnuPGInterface.GnuPG()

146

self.gnupg.options.meta_interactive = False

147

self.gnupg.options.homedir = self.tempdir

148

self.gnupg.options.extra_args.extend(['--force-mdc',

149

'--quiet',

150

'--no-use-agent'])

151

152

def __enter__(self):

153

return self

154

155

def __exit__(self, exc_type, exc_value, traceback):

156

self._cleanup()

157

return False

158

159

def __del__(self):

160

self._cleanup()

161

162

def _cleanup(self):

163

if self.tempdir is not None:

164

# Delete contents of tempdir

165

for root, dirs, files in os.walk(self.tempdir,

166

topdown = False):

167

for filename in files:

168

os.remove(os.path.join(root, filename))

169

for dirname in dirs:

170

os.rmdir(os.path.join(root, dirname))

171

# Remove tempdir

172

os.rmdir(self.tempdir)

173

self.tempdir = None

174

175

def password_encode(self, password):

176

# Passphrase can not be empty and can not contain newlines or

177

# NUL bytes. So we prefix it and hex encode it.

178

return b"mandos" + binascii.hexlify(password)

179

180

def encrypt(self, data, password):

181

self.gnupg.passphrase = self.password_encode(password)

182

with open(os.devnull, "w") as devnull:

183

try:

184

proc = self.gnupg.run(['--symmetric'],

185

create_fhs=['stdin', 'stdout'],

186

attach_fhs={'stderr': devnull})

187

with contextlib.closing(proc.handles['stdin']) as f:

188

f.write(data)

189

with contextlib.closing(proc.handles['stdout']) as f:

190

ciphertext = f.read()

191

proc.wait()

192

except IOError as e:

193

raise PGPError(e)

194

self.gnupg.passphrase = None

195

return ciphertext

196

197

def decrypt(self, data, password):

198

self.gnupg.passphrase = self.password_encode(password)

199

with open(os.devnull, "w") as devnull:

200

try:

201

proc = self.gnupg.run(['--decrypt'],

202

create_fhs=['stdin', 'stdout'],

203

attach_fhs={'stderr': devnull})

204

with contextlib.closing(proc.handles['stdin']) as f:

205

f.write(data)

206

with contextlib.closing(proc.handles['stdout']) as f:

207

decrypted_plaintext = f.read()

208

proc.wait()

209

except IOError as e:

210

raise PGPError(e)

211

self.gnupg.passphrase = None

212

return decrypted_plaintext

213

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

214

102

215

103

class AvahiError(Exception):

216

104

def __init__(self, value, *args, **kwargs):

246

134

server: D-Bus Server

247

135

bus: dbus.SystemBus()

248

136

"""

249

250

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

251

138

servicetype = None, port = None, TXT = None,

252

139

domain = "", host = "", max_renames = 32768,

265

152

self.server = None

266

153

self.bus = bus

267

154

self.entry_group_state_changed_match = None

268

269

155

def rename(self):

270

156

"""Derived from the Avahi example code"""

271

157

if self.rename_count >= self.max_renames:

273

159

" after %i retries, exiting.",

274

160

self.rename_count)

275

161

raise AvahiServiceError("Too many renames")

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

278

163

logger.info("Changing Zeroconf service name to %r ...",

279

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

280

169

self.remove()

281

170

try:

282

171

self.add()

283

172

except dbus.exceptions.DBusException as error:

284

logger.critical("D-Bus Exception", exc_info=error)

173

logger.critical("DBusException: %s", error)

285

174

self.cleanup()

286

175

os._exit(1)

287

176

self.rename_count += 1

288

289

177

def remove(self):

290

178

"""Derived from the Avahi example code"""

291

179

if self.entry_group_state_changed_match is not None:

293

181

self.entry_group_state_changed_match = None

294

182

if self.group is not None:

295

183

self.group.Reset()

296

297

184

def add(self):

298

185

"""Derived from the Avahi example code"""

299

186

self.remove()

304

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

305

192

self.entry_group_state_changed_match = (

306

193

self.group.connect_to_signal(

307

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

308

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

309

196

self.name, self.type)

310

197

self.group.AddService(

316

203

dbus.UInt16(self.port),

317

204

avahi.string_array_to_txt_array(self.TXT))

318

205

self.group.Commit()

319

320

206

def entry_group_state_changed(self, state, error):

321

207

"""Derived from the Avahi example code"""

322

208

logger.debug("Avahi entry group state change: %i", state)

329

215

elif state == avahi.ENTRY_GROUP_FAILURE:

330

216

logger.critical("Avahi: Error in group state changed %s",

331

217

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

333

.format(error))

334

218

raise AvahiGroupError("State changed: %s"

219

% unicode(error))

335

220

def cleanup(self):

336

221

"""Derived from the Avahi example code"""

337

222

if self.group is not None:

338

223

try:

339

224

self.group.Free()

340

225

except (dbus.exceptions.UnknownMethodException,

341

dbus.exceptions.DBusException):

226

dbus.exceptions.DBusException) as e:

342

227

pass

343

228

self.group = None

344

229

self.remove()

345

346

230

def server_state_changed(self, state, error=None):

347

231

"""Derived from the Avahi example code"""

348

232

logger.debug("Avahi server state change: %i", state)

367

251

logger.debug("Unknown state: %r", state)

368

252

else:

369

253

logger.debug("Unknown state: %r: %r", state, error)

370

371

254

def activate(self):

372

255

"""Derived from the Avahi example code"""

373

256

if self.server is None:

381

264

self.server_state_changed(self.server.GetState())

382

265

383

266

384

class AvahiServiceToSyslog(AvahiService):

385

def rename(self):

386

"""Add the new name to the syslog messages"""

387

ret = AvahiService.rename(self)

388

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

390

' %(levelname)s: %(message)s'

391

.format(self.name)))

392

return ret

393

394

395

def timedelta_to_milliseconds(td):

267

def _timedelta_to_milliseconds(td):

396

268

"Convert a datetime.timedelta() to milliseconds"

397

269

return ((td.days * 24 * 60 * 60 * 1000)

398

270

+ (td.seconds * 1000)

399

271

+ (td.microseconds // 1000))

400

401

272

402

273

class Client(object):

403

274

"""A representation of a client host served by this server.

404

275

405

276

Attributes:

406

approved: bool(); 'None' if not yet approved/disapproved

277

_approved: bool(); 'None' if not yet approved/disapproved

407

278

approval_delay: datetime.timedelta(); Time to wait for approval

408

279

approval_duration: datetime.timedelta(); Duration of one approval

409

280

checker: subprocess.Popen(); a running checker process used

416

287

instance %(name)s can be used in the command.

417

288

checker_initiator_tag: a gobject event source tag, or None

418

289

created: datetime.datetime(); (UTC) object creation

419

client_structure: Object describing what attributes a client has

420

and is used for storing the client at exit

421

290

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

422

292

disable_initiator_tag: a gobject event source tag, or None

423

293

enabled: bool()

424

294

fingerprint: string (40 or 32 hexadecimal digits); used to

427

297

interval: datetime.timedelta(); How often to start a new checker

428

298

last_approval_request: datetime.datetime(); (UTC) or None

429

299

last_checked_ok: datetime.datetime(); (UTC) or None

430

last_checker_status: integer between 0 and 255 reflecting exit

431

status of last checker. -1 reflects crashed

432

checker, -2 means no checker completed yet.

433

last_enabled: datetime.datetime(); (UTC) or None

300

last_enabled: datetime.datetime(); (UTC)

434

301

name: string; from the config file, used in log messages and

435

302

D-Bus identifiers

436

303

secret: bytestring; sent verbatim (over TLS) to client

437

304

timeout: datetime.timedelta(); How long from last_checked_ok

438

305

until this client is disabled

439

extended_timeout: extra long timeout when secret has been sent

306

extended_timeout: extra long timeout when password has been sent

440

307

runtime_expansions: Allowed attributes for runtime expansion.

441

308

expires: datetime.datetime(); time (UTC) when a client will be

442

309

disabled, or None

443

310

"""

444

311

445

312

runtime_expansions = ("approval_delay", "approval_duration",

446

"created", "enabled", "expires",

447

"fingerprint", "host", "interval",

448

"last_approval_request", "last_checked_ok",

313

"created", "enabled", "fingerprint",

314

"host", "interval", "last_checked_ok",

449

315

"last_enabled", "name", "timeout")

450

client_defaults = { "timeout": "PT5M",

451

"extended_timeout": "PT15M",

452

"interval": "PT2M",

453

"checker": "fping -q -- %%(host)s",

454

"host": "",

455

"approval_delay": "PT0S",

456

"approval_duration": "PT1S",

457

"approved_by_default": "True",

458

"enabled": "True",

459

}

460

316

461

317

def timeout_milliseconds(self):

462

318

"Return the 'timeout' attribute in milliseconds"

463

return timedelta_to_milliseconds(self.timeout)

319

return _timedelta_to_milliseconds(self.timeout)

464

320

465

321

def extended_timeout_milliseconds(self):

466

322

"Return the 'extended_timeout' attribute in milliseconds"

467

return timedelta_to_milliseconds(self.extended_timeout)

323

return _timedelta_to_milliseconds(self.extended_timeout)

468

324

469

325

def interval_milliseconds(self):

470

326

"Return the 'interval' attribute in milliseconds"

471

return timedelta_to_milliseconds(self.interval)

327

return _timedelta_to_milliseconds(self.interval)

472

328

473

329

def approval_delay_milliseconds(self):

474

return timedelta_to_milliseconds(self.approval_delay)

475

476

@staticmethod

477

def config_parser(config):

478

"""Construct a new dict of client settings of this form:

479

{ client_name: {setting_name: value, ...}, ...}

480

with exceptions for any special settings as defined above.

481

NOTE: Must be a pure function. Must return the same result

482

value given the same arguments.

483

"""

484

settings = {}

485

for client_name in config.sections():

486

section = dict(config.items(client_name))

487

client = settings[client_name] = {}

488

489

client["host"] = section["host"]

490

# Reformat values from string types to Python types

491

client["approved_by_default"] = config.getboolean(

492

client_name, "approved_by_default")

493

client["enabled"] = config.getboolean(client_name,

494

"enabled")

495

496

client["fingerprint"] = (section["fingerprint"].upper()

497

.replace(" ", ""))

498

if "secret" in section:

499

client["secret"] = section["secret"].decode("base64")

500

elif "secfile" in section:

501

with open(os.path.expanduser(os.path.expandvars

502

(section["secfile"])),

503

"rb") as secfile:

504

client["secret"] = secfile.read()

505

else:

506

raise TypeError("No secret or secfile for section {0}"

507

.format(section))

508

client["timeout"] = string_to_delta(section["timeout"])

509

client["extended_timeout"] = string_to_delta(

510

section["extended_timeout"])

511

client["interval"] = string_to_delta(section["interval"])

512

client["approval_delay"] = string_to_delta(

513

section["approval_delay"])

514

client["approval_duration"] = string_to_delta(

515

section["approval_duration"])

516

client["checker_command"] = section["checker"]

517

client["last_approval_request"] = None

518

client["last_checked_ok"] = None

519

client["last_checker_status"] = -2

520

521

return settings

522

523

def __init__(self, settings, name = None):

330

return _timedelta_to_milliseconds(self.approval_delay)

331

332

def __init__(self, name = None, disable_hook=None, config=None):

333

"""Note: the 'checker' key in 'config' sets the

334

'checker_command' attribute and *not* the 'checker'

335

attribute."""

524

336

self.name = name

525

# adding all client settings

526

for setting, value in settings.iteritems():

527

setattr(self, setting, value)

528

529

if self.enabled:

530

if not hasattr(self, "last_enabled"):

531

self.last_enabled = datetime.datetime.utcnow()

532

if not hasattr(self, "expires"):

533

self.expires = (datetime.datetime.utcnow()

534

+ self.timeout)

535

else:

536

self.last_enabled = None

537

self.expires = None

538

337

if config is None:

338

config = {}

539

339

logger.debug("Creating client %r", self.name)

540

340

# Uppercase and remove spaces from fingerprint for later

541

341

# comparison purposes with return value from the fingerprint()

542

342

# function

343

self.fingerprint = (config["fingerprint"].upper()

344

.replace(" ", ""))

543

345

logger.debug(" Fingerprint: %s", self.fingerprint)

544

self.created = settings.get("created",

545

datetime.datetime.utcnow())

546

547

# attributes specific for this server instance

346

if "secret" in config:

347

self.secret = config["secret"].decode("base64")

348

elif "secfile" in config:

349

with open(os.path.expanduser(os.path.expandvars

350

(config["secfile"])),

351

"rb") as secfile:

352

self.secret = secfile.read()

353

else:

354

raise TypeError("No secret or secfile for client %s"

355

% self.name)

356

self.host = config.get("host", "")

357

self.created = datetime.datetime.utcnow()

358

self.enabled = False

359

self.last_approval_request = None

360

self.last_enabled = None

361

self.last_checked_ok = None

362

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

364

self.interval = string_to_delta(config["interval"])

365

self.disable_hook = disable_hook

548

366

self.checker = None

549

367

self.checker_initiator_tag = None

550

368

self.disable_initiator_tag = None

369

self.expires = None

551

370

self.checker_callback_tag = None

371

self.checker_command = config["checker"]

552

372

self.current_checker_command = None

553

self.approved = None

373

self.last_connect = None

374

self._approved = None

375

self.approved_by_default = config.get("approved_by_default",

376

True)

554

377

self.approvals_pending = 0

555

self.changedstate = (multiprocessing_manager

556

.Condition(multiprocessing_manager

557

.Lock()))

558

self.client_structure = [attr for attr in

559

self.__dict__.iterkeys()

560

if not attr.startswith("_")]

561

self.client_structure.append("client_structure")

562

563

for name, t in inspect.getmembers(type(self),

564

lambda obj:

565

isinstance(obj,

566

property)):

567

if not name.startswith("_"):

568

self.client_structure.append(name)

378

self.approval_delay = string_to_delta(

379

config["approval_delay"])

380

self.approval_duration = string_to_delta(

381

config["approval_duration"])

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

569

383

570

# Send notice to process children that client state has changed

571

384

def send_changedstate(self):

572

with self.changedstate:

573

self.changedstate.notify_all()

574

385

self.changedstate.acquire()

386

self.changedstate.notify_all()

387

self.changedstate.release()

388

575

389

def enable(self):

576

390

"""Start this client's checker and timeout hooks"""

577

391

if getattr(self, "enabled", False):

578

392

# Already enabled

579

393

return

394

self.send_changedstate()

395

# Schedule a new checker to be started an 'interval' from now,

396

# and every interval from then on.

397

self.checker_initiator_tag = (gobject.timeout_add

398

(self.interval_milliseconds(),

399

self.start_checker))

400

# Schedule a disable() when 'timeout' has passed

580

401

self.expires = datetime.datetime.utcnow() + self.timeout

402

self.disable_initiator_tag = (gobject.timeout_add

403

(self.timeout_milliseconds(),

404

self.disable))

581

405

self.enabled = True

582

406

self.last_enabled = datetime.datetime.utcnow()

583

self.init_checker()

584

self.send_changedstate()

407

# Also start a new checker *right now*.

408

self.start_checker()

585

409

586

410

def disable(self, quiet=True):

587

411

"""Disable this client."""

588

412

if not getattr(self, "enabled", False):

589

413

return False

590

414

if not quiet:

415

self.send_changedstate()

416

if not quiet:

591

417

logger.info("Disabling client %s", self.name)

592

if getattr(self, "disable_initiator_tag", None) is not None:

418

if getattr(self, "disable_initiator_tag", False):

593

419

gobject.source_remove(self.disable_initiator_tag)

594

420

self.disable_initiator_tag = None

595

421

self.expires = None

596

if getattr(self, "checker_initiator_tag", None) is not None:

422

if getattr(self, "checker_initiator_tag", False):

597

423

gobject.source_remove(self.checker_initiator_tag)

598

424

self.checker_initiator_tag = None

599

425

self.stop_checker()

426

if self.disable_hook:

427

self.disable_hook(self)

600

428

self.enabled = False

601

if not quiet:

602

self.send_changedstate()

603

429

# Do not run this again if called by a gobject.timeout_add

604

430

return False

605

431

606

432

def __del__(self):

433

self.disable_hook = None

607

434

self.disable()

608

435

609

def init_checker(self):

610

# Schedule a new checker to be started an 'interval' from now,

611

# and every interval from then on.

612

if self.checker_initiator_tag is not None:

613

gobject.source_remove(self.checker_initiator_tag)

614

self.checker_initiator_tag = (gobject.timeout_add

615

(self.interval_milliseconds(),

616

self.start_checker))

617

# Schedule a disable() when 'timeout' has passed

618

if self.disable_initiator_tag is not None:

619

gobject.source_remove(self.disable_initiator_tag)

620

self.disable_initiator_tag = (gobject.timeout_add

621

(self.timeout_milliseconds(),

622

self.disable))

623

# Also start a new checker *right now*.

624

self.start_checker()

625

626

436

def checker_callback(self, pid, condition, command):

627

437

"""The checker has completed, so take appropriate actions."""

628

438

self.checker_callback_tag = None

629

439

self.checker = None

630

440

if os.WIFEXITED(condition):

631

self.last_checker_status = os.WEXITSTATUS(condition)

632

if self.last_checker_status == 0:

441

exitstatus = os.WEXITSTATUS(condition)

442

if exitstatus == 0:

633

443

logger.info("Checker for %(name)s succeeded",

634

444

vars(self))

635

445

self.checked_ok()

637

447

logger.info("Checker for %(name)s failed",

638

448

vars(self))

639

449

else:

640

self.last_checker_status = -1

641

450

logger.warning("Checker for %(name)s crashed?",

642

451

vars(self))

643

452

644

def checked_ok(self):

645

"""Assert that the client has been seen, alive and well."""

646

self.last_checked_ok = datetime.datetime.utcnow()

647

self.last_checker_status = 0

648

self.bump_timeout()

649

650

def bump_timeout(self, timeout=None):

651

"""Bump up the timeout for this client."""

453

def checked_ok(self, timeout=None):

454

"""Bump up the timeout for this client.

455

456

This should only be called when the client has been seen,

457

alive and well.

458

"""

652

459

if timeout is None:

653

460

timeout = self.timeout

654

if self.disable_initiator_tag is not None:

655

gobject.source_remove(self.disable_initiator_tag)

656

self.disable_initiator_tag = None

657

if getattr(self, "enabled", False):

658

self.disable_initiator_tag = (gobject.timeout_add

659

(timedelta_to_milliseconds

660

(timeout), self.disable))

661

self.expires = datetime.datetime.utcnow() + timeout

461

self.last_checked_ok = datetime.datetime.utcnow()

462

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

464

self.disable_initiator_tag = (gobject.timeout_add

465

(_timedelta_to_milliseconds(timeout),

466

self.disable))

662

467

663

468

def need_approval(self):

664

469

self.last_approval_request = datetime.datetime.utcnow()

669

474

If a checker already exists, leave it running and do

670

475

nothing."""

671

476

# The reason for not killing a running checker is that if we

672

# did that, and if a checker (for some reason) started running

673

# slowly and taking more than 'interval' time, then the client

674

# would inevitably timeout, since no checker would get a

675

# chance to run to completion. If we instead leave running

477

# did that, then if a checker (for some reason) started

478

# running slowly and taking more than 'interval' time, the

479

# client would inevitably timeout, since no checker would get

480

# a chance to run to completion. If we instead leave running

676

481

# checkers alone, the checker would have to take more time

677

482

# than 'timeout' for the client to be disabled, which is as it

678

483

# should be.

692

497

self.current_checker_command)

693

498

# Start a new checker if needed

694

499

if self.checker is None:

695

# Escape attributes for the shell

696

escaped_attrs = dict(

697

(attr, re.escape(unicode(getattr(self, attr))))

698

for attr in

699

self.runtime_expansions)

700

500

try:

701

command = self.checker_command % escaped_attrs

702

except TypeError as error:

703

logger.error('Could not format string "%s"',

704

self.checker_command, exc_info=error)

705

return True # Try again later

501

# In case checker_command has exactly one % operator

502

command = self.checker_command % self.host

503

except TypeError:

504

# Escape attributes for the shell

505

escaped_attrs = dict(

506

(attr,

507

re.escape(unicode(str(getattr(self, attr, "")),

508

errors=

509

'replace')))

510

for attr in

511

self.runtime_expansions)

512

513

try:

514

command = self.checker_command % escaped_attrs

515

except TypeError as error:

516

logger.error('Could not format string "%s":'

517

' %s', self.checker_command, error)

518

return True # Try again later

706

519

self.current_checker_command = command

707

520

try:

708

521

logger.info("Starting checker %r for %s",

714

527

self.checker = subprocess.Popen(command,

715

528

close_fds=True,

716

529

shell=True, cwd="/")

530

self.checker_callback_tag = (gobject.child_watch_add

531

(self.checker.pid,

532

self.checker_callback,

533

data=command))

534

# The checker may have completed before the gobject

535

# watch was added. Check for this.

536

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

537

if pid:

538

gobject.source_remove(self.checker_callback_tag)

539

self.checker_callback(pid, status, command)

717

540

except OSError as error:

718

logger.error("Failed to start subprocess",

719

exc_info=error)

720

self.checker_callback_tag = (gobject.child_watch_add

721

(self.checker.pid,

722

self.checker_callback,

723

data=command))

724

# The checker may have completed before the gobject

725

# watch was added. Check for this.

726

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

727

if pid:

728

gobject.source_remove(self.checker_callback_tag)

729

self.checker_callback(pid, status, command)

541

logger.error("Failed to start subprocess: %s",

542

error)

730

543

# Re-run this periodically if run by gobject.timeout_add

731

544

return True

732

545

739

552

return

740

553

logger.debug("Stopping checker for %(name)s", vars(self))

741

554

try:

742

self.checker.terminate()

555

os.kill(self.checker.pid, signal.SIGTERM)

743

556

#time.sleep(0.5)

744

557

#if self.checker.poll() is None:

745

# self.checker.kill()

558

# os.kill(self.checker.pid, signal.SIGKILL)

746

559

except OSError as error:

747

560

if error.errno != errno.ESRCH: # No such process

748

561

raise

765

578

# "Set" method, so we fail early here:

766

579

if byte_arrays and signature != "ay":

767

580

raise ValueError("Byte arrays not supported for non-'ay'"

768

" signature {0!r}".format(signature))

581

" signature %r" % signature)

769

582

def decorator(func):

770

583

func._dbus_is_property = True

771

584

func._dbus_interface = dbus_interface

779

592

return decorator

780

593

781

594

782

def dbus_interface_annotations(dbus_interface):

783

"""Decorator for marking functions returning interface annotations

784

785

Usage:

786

787

@dbus_interface_annotations("org.example.Interface")

788

def _foo(self): # Function name does not matter

789

return {"org.freedesktop.DBus.Deprecated": "true",

790

"org.freedesktop.DBus.Property.EmitsChangedSignal":

791

"false"}

792

"""

793

def decorator(func):

794

func._dbus_is_interface = True

795

func._dbus_interface = dbus_interface

796

func._dbus_name = dbus_interface

797

return func

798

return decorator

799

800

801

def dbus_annotations(annotations):

802

"""Decorator to annotate D-Bus methods, signals or properties

803

Usage:

804

805

@dbus_service_property("org.example.Interface", signature="b",

806

access="r")

807

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

808

"org.freedesktop.DBus.Property."

809

"EmitsChangedSignal": "false"})

810

def Property_dbus_property(self):

811

return dbus.Boolean(False)

812

"""

813

def decorator(func):

814

func._dbus_annotations = annotations

815

return func

816

return decorator

817

818

819

595

class DBusPropertyException(dbus.exceptions.DBusException):

820

596

"""A base class for D-Bus property-related exceptions

821

597

"""

844

620

"""

845

621

846

622

@staticmethod

847

def _is_dbus_thing(thing):

848

"""Returns a function testing if an attribute is a D-Bus thing

849

850

If called like _is_dbus_thing("method") it returns a function

851

suitable for use as predicate to inspect.getmembers().

852

"""

853

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

854

False)

623

def _is_dbus_property(obj):

624

return getattr(obj, "_dbus_is_property", False)

855

625

856

def _get_all_dbus_things(self, thing):

626

def _get_all_dbus_properties(self):

857

627

"""Returns a generator of (name, attribute) pairs

858

628

"""

859

return ((getattr(athing.__get__(self), "_dbus_name",

860

name),

861

athing.__get__(self))

862

for cls in self.__class__.__mro__

863

for name, athing in

864

inspect.getmembers(cls,

865

self._is_dbus_thing(thing)))

629

return ((prop._dbus_name, prop)

630

for name, prop in

631

inspect.getmembers(self, self._is_dbus_property))

866

632

867

633

def _get_dbus_property(self, interface_name, property_name):

868

634

"""Returns a bound method if one exists which is a D-Bus

869

635

property with the specified name and interface.

870

636

"""

871

for cls in self.__class__.__mro__:

872

for name, value in (inspect.getmembers

873

(cls,

874

self._is_dbus_thing("property"))):

875

if (value._dbus_name == property_name

876

and value._dbus_interface == interface_name):

877

return value.__get__(self)

878

637

for name in (property_name,

638

property_name + "_dbus_property"):

639

prop = getattr(self, name, None)

640

if (prop is None

641

or not self._is_dbus_property(prop)

642

or prop._dbus_name != property_name

643

or (interface_name and prop._dbus_interface

644

and interface_name != prop._dbus_interface)):

645

continue

646

return prop

879

647

# No such property

880

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

881

649

+ interface_name + "."

906

674

# signatures other than "ay".

907

675

if prop._dbus_signature != "ay":

908

676

raise ValueError

909

value = dbus.ByteArray(b''.join(chr(byte)

910

for byte in value))

677

value = dbus.ByteArray(''.join(unichr(byte)

678

for byte in value))

911

679

prop(value)

912

680

913

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

918

686

919

687

Note: Will not include properties with access="write".

920

688

"""

921

properties = {}

922

for name, prop in self._get_all_dbus_things("property"):

689

all = {}

690

for name, prop in self._get_all_dbus_properties():

923

691

if (interface_name

924

692

and interface_name != prop._dbus_interface):

925

693

# Interface non-empty but did not match

929

697

continue

930

698

value = prop()

931

699

if not hasattr(value, "variant_level"):

932

properties[name] = value

700

all[name] = value

933

701

continue

934

properties[name] = type(value)(value, variant_level=

935

value.variant_level+1)

936

return dbus.Dictionary(properties, signature="sv")

702

all[name] = type(value)(value, variant_level=

703

value.variant_level+1)

704

return dbus.Dictionary(all, signature="sv")

937

705

938

706

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

939

707

out_signature="s",

940

708

path_keyword='object_path',

941

709

connection_keyword='connection')

942

710

def Introspect(self, object_path, connection):

943

"""Overloading of standard D-Bus method.

944

945

Inserts property tags and interface annotation tags.

711

"""Standard D-Bus method, overloaded to insert property tags.

946

712

"""

947

713

xmlstring = dbus.service.Object.Introspect(self, object_path,

948

714

connection)

955

721

e.setAttribute("access", prop._dbus_access)

956

722

return e

957

723

for if_tag in document.getElementsByTagName("interface"):

958

# Add property tags

959

724

for tag in (make_tag(document, name, prop)

960

725

for name, prop

961

in self._get_all_dbus_things("property")

726

in self._get_all_dbus_properties()

962

727

if prop._dbus_interface

963

728

== if_tag.getAttribute("name")):

964

729

if_tag.appendChild(tag)

965

# Add annotation tags

966

for typ in ("method", "signal", "property"):

967

for tag in if_tag.getElementsByTagName(typ):

968

annots = dict()

969

for name, prop in (self.

970

_get_all_dbus_things(typ)):

971

if (name == tag.getAttribute("name")

972

and prop._dbus_interface

973

== if_tag.getAttribute("name")):

974

annots.update(getattr

975

(prop,

976

"_dbus_annotations",

977

{}))

978

for name, value in annots.iteritems():

979

ann_tag = document.createElement(

980

"annotation")

981

ann_tag.setAttribute("name", name)

982

ann_tag.setAttribute("value", value)

983

tag.appendChild(ann_tag)

984

# Add interface annotation tags

985

for annotation, value in dict(

986

itertools.chain.from_iterable(

987

annotations().iteritems()

988

for name, annotations in

989

self._get_all_dbus_things("interface")

990

if name == if_tag.getAttribute("name")

991

)).iteritems():

992

ann_tag = document.createElement("annotation")

993

ann_tag.setAttribute("name", annotation)

994

ann_tag.setAttribute("value", value)

995

if_tag.appendChild(ann_tag)

996

730

# Add the names to the return values for the

997

731

# "org.freedesktop.DBus.Properties" methods

998

732

if (if_tag.getAttribute("name")

1013

747

except (AttributeError, xml.dom.DOMException,

1014

748

xml.parsers.expat.ExpatError) as error:

1015

749

logger.error("Failed to override Introspection method",

1016

exc_info=error)

750

error)

1017

751

return xmlstring

1018

752

1019

753

1020

def datetime_to_dbus(dt, variant_level=0):

754

def datetime_to_dbus (dt, variant_level=0):

1021

755

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1022

756

if dt is None:

1023

757

return dbus.String("", variant_level = variant_level)

1025

759

variant_level=variant_level)

1026

760

1027

761

1028

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1029

"""A class decorator; applied to a subclass of

1030

dbus.service.Object, it will add alternate D-Bus attributes with

1031

interface names according to the "alt_interface_names" mapping.

1032

Usage:

1033

1034

@alternate_dbus_interfaces({"org.example.Interface":

1035

"net.example.AlternateInterface"})

1036

class SampleDBusObject(dbus.service.Object):

1037

@dbus.service.method("org.example.Interface")

1038

def SampleDBusMethod():

1039

pass

1040

1041

The above "SampleDBusMethod" on "SampleDBusObject" will be

1042

reachable via two interfaces: "org.example.Interface" and

1043

"net.example.AlternateInterface", the latter of which will have

1044

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1045

"true", unless "deprecate" is passed with a False value.

1046

1047

This works for methods and signals, and also for D-Bus properties

1048

(from DBusObjectWithProperties) and interfaces (from the

1049

dbus_interface_annotations decorator).

1050

"""

1051

def wrapper(cls):

1052

for orig_interface_name, alt_interface_name in (

1053

alt_interface_names.iteritems()):

1054

attr = {}

1055

interface_names = set()

1056

# Go though all attributes of the class

1057

for attrname, attribute in inspect.getmembers(cls):

1058

# Ignore non-D-Bus attributes, and D-Bus attributes

1059

# with the wrong interface name

1060

if (not hasattr(attribute, "_dbus_interface")

1061

or not attribute._dbus_interface

1062

.startswith(orig_interface_name)):

1063

continue

1064

# Create an alternate D-Bus interface name based on

1065

# the current name

1066

alt_interface = (attribute._dbus_interface

1067

.replace(orig_interface_name,

1068

alt_interface_name))

1069

interface_names.add(alt_interface)

1070

# Is this a D-Bus signal?

1071

if getattr(attribute, "_dbus_is_signal", False):

1072

# Extract the original non-method function by

1073

# black magic

1074

nonmethod_func = (dict(

1075

zip(attribute.func_code.co_freevars,

1076

attribute.__closure__))["func"]

1077

.cell_contents)

1078

# Create a new, but exactly alike, function

1079

# object, and decorate it to be a new D-Bus signal

1080

# with the alternate D-Bus interface name

1081

new_function = (dbus.service.signal

1082

(alt_interface,

1083

attribute._dbus_signature)

1084

(types.FunctionType(

1085

nonmethod_func.func_code,

1086

nonmethod_func.func_globals,

1087

nonmethod_func.func_name,

1088

nonmethod_func.func_defaults,

1089

nonmethod_func.func_closure)))

1090

# Copy annotations, if any

1091

try:

1092

new_function._dbus_annotations = (

1093

dict(attribute._dbus_annotations))

1094

except AttributeError:

1095

pass

1096

# Define a creator of a function to call both the

1097

# original and alternate functions, so both the

1098

# original and alternate signals gets sent when

1099

# the function is called

1100

def fixscope(func1, func2):

1101

"""This function is a scope container to pass

1102

func1 and func2 to the "call_both" function

1103

outside of its arguments"""

1104

def call_both(*args, **kwargs):

1105

"""This function will emit two D-Bus

1106

signals by calling func1 and func2"""

1107

func1(*args, **kwargs)

1108

func2(*args, **kwargs)

1109

return call_both

1110

# Create the "call_both" function and add it to

1111

# the class

1112

attr[attrname] = fixscope(attribute, new_function)

1113

# Is this a D-Bus method?

1114

elif getattr(attribute, "_dbus_is_method", False):

1115

# Create a new, but exactly alike, function

1116

# object. Decorate it to be a new D-Bus method

1117

# with the alternate D-Bus interface name. Add it

1118

# to the class.

1119

attr[attrname] = (dbus.service.method

1120

(alt_interface,

1121

attribute._dbus_in_signature,

1122

attribute._dbus_out_signature)

1123

(types.FunctionType

1124

(attribute.func_code,

1125

attribute.func_globals,

1126

attribute.func_name,

1127

attribute.func_defaults,

1128

attribute.func_closure)))

1129

# Copy annotations, if any

1130

try:

1131

attr[attrname]._dbus_annotations = (

1132

dict(attribute._dbus_annotations))

1133

except AttributeError:

1134

pass

1135

# Is this a D-Bus property?

1136

elif getattr(attribute, "_dbus_is_property", False):

1137

# Create a new, but exactly alike, function

1138

# object, and decorate it to be a new D-Bus

1139

# property with the alternate D-Bus interface

1140

# name. Add it to the class.

1141

attr[attrname] = (dbus_service_property

1142

(alt_interface,

1143

attribute._dbus_signature,

1144

attribute._dbus_access,

1145

attribute

1146

._dbus_get_args_options

1147

["byte_arrays"])

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1154

# Copy annotations, if any

1155

try:

1156

attr[attrname]._dbus_annotations = (

1157

dict(attribute._dbus_annotations))

1158

except AttributeError:

1159

pass

1160

# Is this a D-Bus interface?

1161

elif getattr(attribute, "_dbus_is_interface", False):

1162

# Create a new, but exactly alike, function

1163

# object. Decorate it to be a new D-Bus interface

1164

# with the alternate D-Bus interface name. Add it

1165

# to the class.

1166

attr[attrname] = (dbus_interface_annotations

1167

(alt_interface)

1168

(types.FunctionType

1169

(attribute.func_code,

1170

attribute.func_globals,

1171

attribute.func_name,

1172

attribute.func_defaults,

1173

attribute.func_closure)))

1174

if deprecate:

1175

# Deprecate all alternate interfaces

1176

iname="_AlternateDBusNames_interface_annotation{0}"

1177

for interface_name in interface_names:

1178

@dbus_interface_annotations(interface_name)

1179

def func(self):

1180

return { "org.freedesktop.DBus.Deprecated":

1181

"true" }

1182

# Find an unused name

1183

for aname in (iname.format(i)

1184

for i in itertools.count()):

1185

if aname not in attr:

1186

attr[aname] = func

1187

break

1188

if interface_names:

1189

# Replace the class with a new subclass of it with

1190

# methods, signals, etc. as created above.

1191

cls = type(b"{0}Alternate".format(cls.__name__),

1192

(cls,), attr)

1193

return cls

1194

return wrapper

1195

1196

1197

@alternate_dbus_interfaces({"se.recompile.Mandos":

1198

"se.bsnet.fukt.Mandos"})

1199

762

class ClientDBus(Client, DBusObjectWithProperties):

1200

763

"""A Client class using D-Bus

1201

764

1210

773

# dbus.service.Object doesn't use super(), so we can't either.

1211

774

1212

775

def __init__(self, bus = None, *args, **kwargs):

776

self._approvals_pending = 0

1213

777

self.bus = bus

1214

778

Client.__init__(self, *args, **kwargs)

1215

779

# Only now, when this client is initialized, can it show up on

1221

785

("/clients/" + client_object_name))

1222

786

DBusObjectWithProperties.__init__(self, self.bus,

1223

787

self.dbus_object_path)

1224

788

1225

789

def notifychangeproperty(transform_func,

1226

790

dbus_name, type_func=lambda x: x,

1227

791

variant_level=1):

1228

""" Modify a variable so that it's a property which announces

1229

its changes to DBus.

1230

1231

transform_fun: Function that takes a value and a variant_level

1232

and transforms it to a D-Bus type.

1233

dbus_name: D-Bus name of the variable

792

""" Modify a variable so that its a property that announce its

793

changes to DBus.

794

transform_fun: Function that takes a value and transform it to

795

DBus type.

796

dbus_name: DBus name of the variable

1234

797

type_func: Function that transform the value before sending it

1235

to the D-Bus. Default: no transform

1236

variant_level: D-Bus variant level. Default: 1

798

to DBus

799

variant_level: DBus variant level. default: 1

1237

800

"""

1238

attrname = "_{0}".format(dbus_name)

801

real_value = [None,]

1239

802

def setter(self, value):

803

old_value = real_value[0]

804

real_value[0] = value

1240

805

if hasattr(self, "dbus_object_path"):

1241

if (not hasattr(self, attrname) or

1242

type_func(getattr(self, attrname, None))

1243

!= type_func(value)):

1244

dbus_value = transform_func(type_func(value),

1245

variant_level

1246

=variant_level)

806

if type_func(old_value) != type_func(real_value[0]):

807

dbus_value = transform_func(type_func(real_value[0]),

808

variant_level)

1247

809

self.PropertyChanged(dbus.String(dbus_name),

1248

810

dbus_value)

1249

setattr(self, attrname, value)

1250

811

1251

return property(lambda self: getattr(self, attrname), setter)

812

return property(lambda self: real_value[0], setter)

813

1252

814

1253

815

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1254

816

approvals_pending = notifychangeproperty(dbus.Boolean,

1258

820

last_enabled = notifychangeproperty(datetime_to_dbus,

1259

821

"LastEnabled")

1260

822

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1261

type_func = lambda checker:

1262

checker is not None)

823

type_func = lambda checker: checker is not None)

1263

824

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1264

825

"LastCheckedOK")

1265

last_checker_status = notifychangeproperty(dbus.Int16,

1266

"LastCheckerStatus")

1267

last_approval_request = notifychangeproperty(

1268

datetime_to_dbus, "LastApprovalRequest")

826

last_approval_request = notifychangeproperty(datetime_to_dbus,

827

"LastApprovalRequest")

1269

828

approved_by_default = notifychangeproperty(dbus.Boolean,

1270

829

"ApprovedByDefault")

1271

approval_delay = notifychangeproperty(dbus.UInt64,

1272

"ApprovalDelay",

1273

type_func =

1274

timedelta_to_milliseconds)

1275

approval_duration = notifychangeproperty(

1276

dbus.UInt64, "ApprovalDuration",

1277

type_func = timedelta_to_milliseconds)

830

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

831

type_func = _timedelta_to_milliseconds)

832

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

833

type_func = _timedelta_to_milliseconds)

1278

834

host = notifychangeproperty(dbus.String, "Host")

1279

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1280

type_func =

1281

timedelta_to_milliseconds)

1282

extended_timeout = notifychangeproperty(

1283

dbus.UInt64, "ExtendedTimeout",

1284

type_func = timedelta_to_milliseconds)

1285

interval = notifychangeproperty(dbus.UInt64,

1286

"Interval",

1287

type_func =

1288

timedelta_to_milliseconds)

835

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

836

type_func = _timedelta_to_milliseconds)

837

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

838

type_func = _timedelta_to_milliseconds)

839

interval = notifychangeproperty(dbus.UInt16, "Interval",

840

type_func = _timedelta_to_milliseconds)

1289

841

checker_command = notifychangeproperty(dbus.String, "Checker")

1290

842

1291

843

del notifychangeproperty

1333

885

return r

1334

886

1335

887

def _reset_approved(self):

1336

self.approved = None

888

self._approved = None

1337

889

return False

1338

890

1339

891

def approve(self, value=True):

1340

self.approved = value

1341

gobject.timeout_add(timedelta_to_milliseconds

892

self.send_changedstate()

893

self._approved = value

894

gobject.timeout_add(_timedelta_to_milliseconds

1342

895

(self.approval_duration),

1343

896

self._reset_approved)

1344

self.send_changedstate()

897

1345

898

1346

899

## D-Bus methods, signals & properties

1347

_interface = "se.recompile.Mandos.Client"

1348

1349

## Interfaces

1350

1351

@dbus_interface_annotations(_interface)

1352

def _foo(self):

1353

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1354

"false"}

900

_interface = "se.bsnet.fukt.Mandos.Client"

1355

901

1356

902

## Signals

1357

903

1457

1003

access="readwrite")

1458

1004

def ApprovalDuration_dbus_property(self, value=None):

1459

1005

if value is None: # get

1460

return dbus.UInt64(timedelta_to_milliseconds(

1006

return dbus.UInt64(_timedelta_to_milliseconds(

1461

1007

self.approval_duration))

1462

1008

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1463

1009

1477

1023

def Host_dbus_property(self, value=None):

1478

1024

if value is None: # get

1479

1025

return dbus.String(self.host)

1480

self.host = unicode(value)

1026

self.host = value

1481

1027

1482

1028

# Created - property

1483

1029

@dbus_service_property(_interface, signature="s", access="read")

1484

1030

def Created_dbus_property(self):

1485

return datetime_to_dbus(self.created)

1031

return dbus.String(datetime_to_dbus(self.created))

1486

1032

1487

1033

# LastEnabled - property

1488

1034

@dbus_service_property(_interface, signature="s", access="read")

1509

1055

return

1510

1056

return datetime_to_dbus(self.last_checked_ok)

1511

1057

1512

# LastCheckerStatus - property

1513

@dbus_service_property(_interface, signature="n",

1514

access="read")

1515

def LastCheckerStatus_dbus_property(self):

1516

return dbus.Int16(self.last_checker_status)

1517

1518

1058

# Expires - property

1519

1059

@dbus_service_property(_interface, signature="s", access="read")

1520

1060

def Expires_dbus_property(self):

1531

1071

def Timeout_dbus_property(self, value=None):

1532

1072

if value is None: # get

1533

1073

return dbus.UInt64(self.timeout_milliseconds())

1534

old_timeout = self.timeout

1535

1074

self.timeout = datetime.timedelta(0, 0, 0, value)

1536

# Reschedule disabling

1537

if self.enabled:

1538

now = datetime.datetime.utcnow()

1539

self.expires += self.timeout - old_timeout

1540

if self.expires <= now:

1541

# The timeout has passed

1542

self.disable()

1543

else:

1544

if (getattr(self, "disable_initiator_tag", None)

1545

is None):

1546

return

1547

gobject.source_remove(self.disable_initiator_tag)

1548

self.disable_initiator_tag = (

1549

gobject.timeout_add(

1550

timedelta_to_milliseconds(self.expires - now),

1551

self.disable))

1075

if getattr(self, "disable_initiator_tag", None) is None:

1076

return

1077

# Reschedule timeout

1078

gobject.source_remove(self.disable_initiator_tag)

1079

self.disable_initiator_tag = None

1080

self.expires = None

1081

time_to_die = (self.

1082

_timedelta_to_milliseconds((self

1083

.last_checked_ok

1084

+ self.timeout)

1085

- datetime.datetime

1086

.utcnow()))

1087

if time_to_die <= 0:

1088

# The timeout has passed

1089

self.disable()

1090

else:

1091

self.expires = (datetime.datetime.utcnow()

1092

+ datetime.timedelta(milliseconds = time_to_die))

1093

self.disable_initiator_tag = (gobject.timeout_add

1094

(time_to_die, self.disable))

1552

1095

1553

1096

# ExtendedTimeout - property

1554

1097

@dbus_service_property(_interface, signature="t",

1567

1110

self.interval = datetime.timedelta(0, 0, 0, value)

1568

1111

if getattr(self, "checker_initiator_tag", None) is None:

1569

1112

return

1570

if self.enabled:

1571

# Reschedule checker run

1572

gobject.source_remove(self.checker_initiator_tag)

1573

self.checker_initiator_tag = (gobject.timeout_add

1574

(value, self.start_checker))

1575

self.start_checker() # Start one now, too

1113

# Reschedule checker run

1114

gobject.source_remove(self.checker_initiator_tag)

1115

self.checker_initiator_tag = (gobject.timeout_add

1116

(value, self.start_checker))

1117

self.start_checker() # Start one now, too

1576

1118

1577

1119

# Checker - property

1578

1120

@dbus_service_property(_interface, signature="s",

1580

1122

def Checker_dbus_property(self, value=None):

1581

1123

if value is None: # get

1582

1124

return dbus.String(self.checker_command)

1583

self.checker_command = unicode(value)

1125

self.checker_command = value

1584

1126

1585

1127

# CheckerRunning - property

1586

1128

@dbus_service_property(_interface, signature="b",

1615

1157

raise KeyError()

1616

1158

1617

1159

def __getattribute__(self, name):

1618

if name == '_pipe':

1160

if(name == '_pipe'):

1619

1161

return super(ProxyClient, self).__getattribute__(name)

1620

1162

self._pipe.send(('getattr', name))

1621

1163

data = self._pipe.recv()

1628

1170

return func

1629

1171

1630

1172

def __setattr__(self, name, value):

1631

if name == '_pipe':

1173

if(name == '_pipe'):

1632

1174

return super(ProxyClient, self).__setattr__(name, value)

1633

1175

self._pipe.send(('setattr', name, value))

1634

1176

1717

1259

client.name)

1718

1260

if self.server.use_dbus:

1719

1261

# Emit D-Bus signal

1720

client.Rejected("Disabled")

1262

client.Rejected("Disabled")

1721

1263

return

1722

1264

1723

if client.approved or not client.approval_delay:

1265

if client._approved or not client.approval_delay:

1724

1266

#We are approved or approval is disabled

1725

1267

break

1726

elif client.approved is None:

1268

elif client._approved is None:

1727

1269

logger.info("Client %s needs approval",

1728

1270

client.name)

1729

1271

if self.server.use_dbus:

1740

1282

return

1741

1283

1742

1284

#wait until timeout or approved

1285

#x = float(client._timedelta_to_milliseconds(delay))

1743

1286

time = datetime.datetime.now()

1744

1287

client.changedstate.acquire()

1745

client.changedstate.wait(

1746

float(timedelta_to_milliseconds(delay)

1747

/ 1000))

1288

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1748

1289

client.changedstate.release()

1749

1290

time2 = datetime.datetime.now()

1750

1291

if (time2 - time) >= delay:

1766

1307

try:

1767

1308

sent = session.send(client.secret[sent_size:])

1768

1309

except gnutls.errors.GNUTLSError as error:

1769

logger.warning("gnutls send failed",

1770

exc_info=error)

1310

logger.warning("gnutls send failed")

1771

1311

return

1772

1312

logger.debug("Sent: %d, remaining: %d",

1773

1313

sent, len(client.secret)

1775

1315

sent_size += sent

1776

1316

1777

1317

logger.info("Sending secret to %s", client.name)

1778

# bump the timeout using extended_timeout

1779

client.bump_timeout(client.extended_timeout)

1318

# bump the timeout as if seen

1319

client.checked_ok(client.extended_timeout)

1780

1320

if self.server.use_dbus:

1781

1321

# Emit D-Bus signal

1782

1322

client.GotSecret()

1787

1327

try:

1788

1328

session.bye()

1789

1329

except gnutls.errors.GNUTLSError as error:

1790

logger.warning("GnuTLS bye failed",

1791

exc_info=error)

1330

logger.warning("GnuTLS bye failed")

1792

1331

1793

1332

@staticmethod

1794

1333

def peer_certificate(session):

1850

1389

# Convert the buffer to a Python bytestring

1851

1390

fpr = ctypes.string_at(buf, buf_len.value)

1852

1391

# Convert the bytestring to hexadecimal notation

1853

hex_fpr = binascii.hexlify(fpr).upper()

1392

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1854

1393

return hex_fpr

1855

1394

1856

1395

1859

1398

def sub_process_main(self, request, address):

1860

1399

try:

1861

1400

self.finish_request(request, address)

1862

except Exception:

1401

except:

1863

1402

self.handle_error(request, address)

1864

1403

self.close_request(request)

1865

1404

1866

1405

def process_request(self, request, address):

1867

1406

"""Start a new process to process the request."""

1868

proc = multiprocessing.Process(target = self.sub_process_main,

1869

args = (request, address))

1870

proc.start()

1871

return proc

1407

multiprocessing.Process(target = self.sub_process_main,

1408

args = (request, address)).start()

1872

1409

1873

1410

1874

1411

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1880

1417

"""

1881

1418

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1882

1419

1883

proc = MultiprocessingMixIn.process_request(self, request,

1884

client_address)

1420

super(MultiprocessingMixInWithPipe,

1421

self).process_request(request, client_address)

1885

1422

self.child_pipe.close()

1886

self.add_pipe(parent_pipe, proc)

1423

self.add_pipe(parent_pipe)

1887

1424

1888

def add_pipe(self, parent_pipe, proc):

1425

def add_pipe(self, parent_pipe):

1889

1426

"""Dummy function; override as necessary"""

1890

1427

raise NotImplementedError

1891

1428

1900

1437

use_ipv6: Boolean; to use IPv6 or not

1901

1438

"""

1902

1439

def __init__(self, server_address, RequestHandlerClass,

1903

interface=None, use_ipv6=True, socketfd=None):

1904

"""If socketfd is set, use that file descriptor instead of

1905

creating a new one with socket.socket().

1906

"""

1440

interface=None, use_ipv6=True):

1907

1441

self.interface = interface

1908

1442

if use_ipv6:

1909

1443

self.address_family = socket.AF_INET6

1910

if socketfd is not None:

1911

# Save the file descriptor

1912

self.socketfd = socketfd

1913

# Save the original socket.socket() function

1914

self.socket_socket = socket.socket

1915

# To implement --socket, we monkey patch socket.socket.

1916

#

1917

# (When socketserver.TCPServer is a new-style class, we

1918

# could make self.socket into a property instead of monkey

1919

# patching socket.socket.)

1920

#

1921

# Create a one-time-only replacement for socket.socket()

1922

@functools.wraps(socket.socket)

1923

def socket_wrapper(*args, **kwargs):

1924

# Restore original function so subsequent calls are

1925

# not affected.

1926

socket.socket = self.socket_socket

1927

del self.socket_socket

1928

# This time only, return a new socket object from the

1929

# saved file descriptor.

1930

return socket.fromfd(self.socketfd, *args, **kwargs)

1931

# Replace socket.socket() function with wrapper

1932

socket.socket = socket_wrapper

1933

# The socketserver.TCPServer.__init__ will call

1934

# socket.socket(), which might be our replacement,

1935

# socket_wrapper(), if socketfd was set.

1936

1444

socketserver.TCPServer.__init__(self, server_address,

1937

1445

RequestHandlerClass)

1938

1939

1446

def server_bind(self):

1940

1447

"""This overrides the normal server_bind() function

1941

1448

to bind to an interface if one was specified, and also NOT to

1949

1456

try:

1950

1457

self.socket.setsockopt(socket.SOL_SOCKET,

1951

1458

SO_BINDTODEVICE,

1952

str(self.interface + '\0'))

1459

str(self.interface

1460

+ '\0'))

1953

1461

except socket.error as error:

1954

if error.errno == errno.EPERM:

1955

logger.error("No permission to bind to"

1956

" interface %s", self.interface)

1957

elif error.errno == errno.ENOPROTOOPT:

1462

if error[0] == errno.EPERM:

1463

logger.error("No permission to"

1464

" bind to interface %s",

1465

self.interface)

1466

elif error[0] == errno.ENOPROTOOPT:

1958

1467

logger.error("SO_BINDTODEVICE not available;"

1959

1468

" cannot bind to interface %s",

1960

1469

self.interface)

1961

elif error.errno == errno.ENODEV:

1962

logger.error("Interface %s does not exist,"

1963

" cannot bind", self.interface)

1964

1470

else:

1965

1471

raise

1966

1472

# Only bind(2) the socket if we really need to.

1996

1502

"""

1997

1503

def __init__(self, server_address, RequestHandlerClass,

1998

1504

interface=None, use_ipv6=True, clients=None,

1999

gnutls_priority=None, use_dbus=True, socketfd=None):

1505

gnutls_priority=None, use_dbus=True):

2000

1506

self.enabled = False

2001

1507

self.clients = clients

2002

1508

if self.clients is None:

2003

self.clients = {}

1509

self.clients = set()

2004

1510

self.use_dbus = use_dbus

2005

1511

self.gnutls_priority = gnutls_priority

2006

1512

IPv6_TCPServer.__init__(self, server_address,

2007

1513

RequestHandlerClass,

2008

1514

interface = interface,

2009

use_ipv6 = use_ipv6,

2010

socketfd = socketfd)

1515

use_ipv6 = use_ipv6)

2011

1516

def server_activate(self):

2012

1517

if self.enabled:

2013

1518

return socketserver.TCPServer.server_activate(self)

2014

2015

1519

def enable(self):

2016

1520

self.enabled = True

2017

2018

def add_pipe(self, parent_pipe, proc):

1521

def add_pipe(self, parent_pipe):

2019

1522

# Call "handle_ipc" for both data and EOF events

2020

1523

gobject.io_add_watch(parent_pipe.fileno(),

2021

1524

gobject.IO_IN | gobject.IO_HUP,

2022

1525

functools.partial(self.handle_ipc,

2023

parent_pipe =

2024

parent_pipe,

2025

proc = proc))

2026

1526

parent_pipe = parent_pipe))

1527

2027

1528

def handle_ipc(self, source, condition, parent_pipe=None,

2028

proc = None, client_object=None):

2029

# error, or the other end of multiprocessing.Pipe has closed

2030

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2031

# Wait for other process to exit

2032

proc.join()

1529

client_object=None):

1530

condition_names = {

1531

gobject.IO_IN: "IN", # There is data to read.

1532

gobject.IO_OUT: "OUT", # Data can be written (without

1533

# blocking).

1534

gobject.IO_PRI: "PRI", # There is urgent data to read.

1535

gobject.IO_ERR: "ERR", # Error condition.

1536

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1537

# broken, usually for pipes and

1538

# sockets).

1539

}

1540

conditions_string = ' | '.join(name

1541

for cond, name in

1542

condition_names.iteritems()

1543

if cond & condition)

1544

# error or the other end of multiprocessing.Pipe has closed

1545

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2033

1546

return False

2034

1547

2035

1548

# Read a request from the child

2040

1553

fpr = request[1]

2041

1554

address = request[2]

2042

1555

2043

for c in self.clients.itervalues():

1556

for c in self.clients:

2044

1557

if c.fingerprint == fpr:

2045

1558

client = c

2046

1559

break

2049

1562

"dress: %s", fpr, address)

2050

1563

if self.use_dbus:

2051

1564

# Emit D-Bus signal

2052

mandos_dbus_service.ClientNotFound(fpr,

2053

address[0])

1565

mandos_dbus_service.ClientNotFound(fpr, address[0])

2054

1566

parent_pipe.send(False)

2055

1567

return False

2056

1568

2057

1569

gobject.io_add_watch(parent_pipe.fileno(),

2058

1570

gobject.IO_IN | gobject.IO_HUP,

2059

1571

functools.partial(self.handle_ipc,

2060

parent_pipe =

2061

parent_pipe,

2062

proc = proc,

2063

client_object =

2064

client))

1572

parent_pipe = parent_pipe,

1573

client_object = client))

2065

1574

parent_pipe.send(True)

2066

# remove the old hook in favor of the new above hook on

2067

# same fileno

1575

# remove the old hook in favor of the new above hook on same fileno

2068

1576

return False

2069

1577

if command == 'funcall':

2070

1578

funcname = request[1]

2071

1579

args = request[2]

2072

1580

kwargs = request[3]

2073

1581

2074

parent_pipe.send(('data', getattr(client_object,

2075

funcname)(*args,

2076

**kwargs)))

1582

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

2077

1583

2078

1584

if command == 'getattr':

2079

1585

attrname = request[1]

2080

1586

if callable(client_object.__getattribute__(attrname)):

2081

1587

parent_pipe.send(('function',))

2082

1588

else:

2083

parent_pipe.send(('data', client_object

2084

.__getattribute__(attrname)))

1589

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2085

1590

2086

1591

if command == 'setattr':

2087

1592

attrname = request[1]

2091

1596

return True

2092

1597

2093

1598

2094

def rfc3339_duration_to_delta(duration):

2095

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2096

2097

>>> rfc3339_duration_to_delta("P7D")

2098

datetime.timedelta(7)

2099

>>> rfc3339_duration_to_delta("PT60S")

2100

datetime.timedelta(0, 60)

2101

>>> rfc3339_duration_to_delta("PT60M")

2102

datetime.timedelta(0, 3600)

2103

>>> rfc3339_duration_to_delta("PT24H")

2104

datetime.timedelta(1)

2105

>>> rfc3339_duration_to_delta("P1W")

2106

datetime.timedelta(7)

2107

>>> rfc3339_duration_to_delta("PT5M30S")

2108

datetime.timedelta(0, 330)

2109

>>> rfc3339_duration_to_delta("P1DT3M20S")

2110

datetime.timedelta(1, 200)

2111

"""

2112

2113

# Parsing an RFC 3339 duration with regular expressions is not

2114

# possible - there would have to be multiple places for the same

2115

# values, like seconds. The current code, while more esoteric, is

2116

# cleaner without depending on a parsing library. If Python had a

2117

# built-in library for parsing we would use it, but we'd like to

2118

# avoid excessive use of external libraries.

2119

2120

# New type for defining tokens, syntax, and semantics all-in-one

2121

Token = collections.namedtuple("Token",

2122

("regexp", # To match token; if

2123

# "value" is not None,

2124

# must have a "group"

2125

# containing digits

2126

"value", # datetime.timedelta or

2127

# None

2128

"followers")) # Tokens valid after

2129

# this token

2130

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2131

# the "duration" ABNF definition in RFC 3339, Appendix A.

2132

token_end = Token(re.compile(r"$"), None, frozenset())

2133

token_second = Token(re.compile(r"(\d+)S"),

2134

datetime.timedelta(seconds=1),

2135

frozenset((token_end,)))

2136

token_minute = Token(re.compile(r"(\d+)M"),

2137

datetime.timedelta(minutes=1),

2138

frozenset((token_second, token_end)))

2139

token_hour = Token(re.compile(r"(\d+)H"),

2140

datetime.timedelta(hours=1),

2141

frozenset((token_minute, token_end)))

2142

token_time = Token(re.compile(r"T"),

2143

None,

2144

frozenset((token_hour, token_minute,

2145

token_second)))

2146

token_day = Token(re.compile(r"(\d+)D"),

2147

datetime.timedelta(days=1),

2148

frozenset((token_time, token_end)))

2149

token_month = Token(re.compile(r"(\d+)M"),

2150

datetime.timedelta(weeks=4),

2151

frozenset((token_day, token_end)))

2152

token_year = Token(re.compile(r"(\d+)Y"),

2153

datetime.timedelta(weeks=52),

2154

frozenset((token_month, token_end)))

2155

token_week = Token(re.compile(r"(\d+)W"),

2156

datetime.timedelta(weeks=1),

2157

frozenset((token_end,)))

2158

token_duration = Token(re.compile(r"P"), None,

2159

frozenset((token_year, token_month,

2160

token_day, token_time,

2161

token_week))),

2162

# Define starting values

2163

value = datetime.timedelta() # Value so far

2164

found_token = None

2165

followers = frozenset(token_duration,) # Following valid tokens

2166

s = duration # String left to parse

2167

# Loop until end token is found

2168

while found_token is not token_end:

2169

# Search for any currently valid tokens

2170

for token in followers:

2171

match = token.regexp.match(s)

2172

if match is not None:

2173

# Token found

2174

if token.value is not None:

2175

# Value found, parse digits

2176

factor = int(match.group(1), 10)

2177

# Add to value so far

2178

value += factor * token.value

2179

# Strip token from string

2180

s = token.regexp.sub("", s, 1)

2181

# Go to found token

2182

found_token = token

2183

# Set valid next tokens

2184

followers = found_token.followers

2185

break

2186

else:

2187

# No currently valid tokens were found

2188

raise ValueError("Invalid RFC 3339 duration")

2189

# End token found

2190

return value

2191

2192

2193

1599

def string_to_delta(interval):

2194

1600

"""Parse a string and return a datetime.timedelta

2195

1601

2206

1612

>>> string_to_delta('5m 30s')

2207

1613

datetime.timedelta(0, 330)

2208

1614

"""

2209

2210

try:

2211

return rfc3339_duration_to_delta(interval)

2212

except ValueError:

2213

pass

2214

2215

1615

timevalue = datetime.timedelta(0)

2216

1616

for s in interval.split():

2217

1617

try:

2228

1628

elif suffix == "w":

2229

1629

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2230

1630

else:

2231

raise ValueError("Unknown suffix {0!r}"

2232

.format(suffix))

1631

raise ValueError("Unknown suffix %r" % suffix)

2233

1632

except (ValueError, IndexError) as e:

2234

1633

raise ValueError(*(e.args))

2235

1634

timevalue += delta

2236

1635

return timevalue

2237

1636

2238

1637

1638

def if_nametoindex(interface):

1639

"""Call the C function if_nametoindex(), or equivalent

1640

1641

Note: This function cannot accept a unicode string."""

1642

global if_nametoindex

1643

try:

1644

if_nametoindex = (ctypes.cdll.LoadLibrary

1645

(ctypes.util.find_library("c"))

1646

.if_nametoindex)

1647

except (OSError, AttributeError):

1648

logger.warning("Doing if_nametoindex the hard way")

1649

def if_nametoindex(interface):

1650

"Get an interface index the hard way, i.e. using fcntl()"

1651

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1652

with contextlib.closing(socket.socket()) as s:

1653

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1654

struct.pack(str("16s16x"),

1655

interface))

1656

interface_index = struct.unpack(str("I"),

1657

ifreq[16:20])[0]

1658

return interface_index

1659

return if_nametoindex(interface)

1660

1661

2239

1662

def daemon(nochdir = False, noclose = False):

2240

1663

"""See daemon(3). Standard BSD Unix function.

2241

1664

2249

1672

sys.exit()

2250

1673

if not noclose:

2251

1674

# Close all standard open file descriptors

2252

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1675

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2253

1676

if not stat.S_ISCHR(os.fstat(null).st_mode):

2254

1677

raise OSError(errno.ENODEV,

2255

"{0} not a character device"

2256

.format(os.devnull))

1678

"%s not a character device"

1679

% os.path.devnull)

2257

1680

os.dup2(null, sys.stdin.fileno())

2258

1681

os.dup2(null, sys.stdout.fileno())

2259

1682

os.dup2(null, sys.stderr.fileno())

2268

1691

2269

1692

parser = argparse.ArgumentParser()

2270

1693

parser.add_argument("-v", "--version", action="version",

2271

version = "%(prog)s {0}".format(version),

1694

version = "%%(prog)s %s" % version,

2272

1695

help="show version number and exit")

2273

1696

parser.add_argument("-i", "--interface", metavar="IF",

2274

1697

help="Bind to interface IF")

2296

1719

" system bus interface")

2297

1720

parser.add_argument("--no-ipv6", action="store_false",

2298

1721

dest="use_ipv6", help="Do not use IPv6")

2299

parser.add_argument("--no-restore", action="store_false",

2300

dest="restore", help="Do not restore stored"

2301

" state")

2302

parser.add_argument("--socket", type=int,

2303

help="Specify a file descriptor to a network"

2304

" socket to use instead of creating one")

2305

parser.add_argument("--statedir", metavar="DIR",

2306

help="Directory to save/restore state in")

2307

parser.add_argument("--foreground", action="store_true",

2308

help="Run in foreground")

2309

2310

1722

options = parser.parse_args()

2311

1723

2312

1724

if options.check:

2325

1737

"use_dbus": "True",

2326

1738

"use_ipv6": "True",

2327

1739

"debuglevel": "",

2328

"restore": "True",

2329

"socket": "",

2330

"statedir": "/var/lib/mandos",

2331

"foreground": "False",

2332

1740

}

2333

1741

2334

1742

# Parse config file for server-global settings

2339

1747

# Convert the SafeConfigParser object to a dict

2340

1748

server_settings = server_config.defaults()

2341

1749

# Use the appropriate methods on the non-string config options

2342

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1750

for option in ("debug", "use_dbus", "use_ipv6"):

2343

1751

server_settings[option] = server_config.getboolean("DEFAULT",

2344

1752

option)

2345

1753

if server_settings["port"]:

2346

1754

server_settings["port"] = server_config.getint("DEFAULT",

2347

1755

"port")

2348

if server_settings["socket"]:

2349

server_settings["socket"] = server_config.getint("DEFAULT",

2350

"socket")

2351

# Later, stdin will, and stdout and stderr might, be dup'ed

2352

# over with an opened os.devnull. But we don't want this to

2353

# happen with a supplied network socket.

2354

if 0 <= server_settings["socket"] <= 2:

2355

server_settings["socket"] = os.dup(server_settings

2356

["socket"])

2357

1756

del server_config

2358

1757

2359

1758

# Override the settings from the config file with command line

2360

1759

# options, if set.

2361

1760

for option in ("interface", "address", "port", "debug",

2362

1761

"priority", "servicename", "configdir",

2363

"use_dbus", "use_ipv6", "debuglevel", "restore",

2364

"statedir", "socket", "foreground"):

1762

"use_dbus", "use_ipv6", "debuglevel"):

2365

1763

value = getattr(options, option)

2366

1764

if value is not None:

2367

1765

server_settings[option] = value

2370

1768

for option in server_settings.keys():

2371

1769

if type(server_settings[option]) is str:

2372

1770

server_settings[option] = unicode(server_settings[option])

2373

# Debug implies foreground

2374

if server_settings["debug"]:

2375

server_settings["foreground"] = True

2376

1771

# Now we have our good server settings in "server_settings"

2377

1772

2378

1773

##################################################################

2382

1777

debuglevel = server_settings["debuglevel"]

2383

1778

use_dbus = server_settings["use_dbus"]

2384

1779

use_ipv6 = server_settings["use_ipv6"]

2385

stored_state_path = os.path.join(server_settings["statedir"],

2386

stored_state_file)

2387

foreground = server_settings["foreground"]

2388

2389

if debug:

2390

initlogger(debug, logging.DEBUG)

2391

else:

2392

if not debuglevel:

2393

initlogger(debug)

2394

else:

2395

level = getattr(logging, debuglevel.upper())

2396

initlogger(debug, level)

2397

1780

2398

1781

if server_settings["servicename"] != "Mandos":

2399

1782

syslogger.setFormatter(logging.Formatter

2400

('Mandos ({0}) [%(process)d]:'

2401

' %(levelname)s: %(message)s'

2402

.format(server_settings

2403

["servicename"])))

1783

('Mandos (%s) [%%(process)d]:'

1784

' %%(levelname)s: %%(message)s'

1785

% server_settings["servicename"]))

2404

1786

2405

1787

# Parse config file with clients

2406

client_config = configparser.SafeConfigParser(Client

2407

.client_defaults)

1788

client_defaults = { "timeout": "5m",

1789

"extended_timeout": "15m",

1790

"interval": "2m",

1791

"checker": "fping -q -- %%(host)s",

1792

"host": "",

1793

"approval_delay": "0s",

1794

"approval_duration": "1s",

1795

}

1796

client_config = configparser.SafeConfigParser(client_defaults)

2408

1797

client_config.read(os.path.join(server_settings["configdir"],

2409

1798

"clients.conf"))

2410

1799

2419

1808

use_ipv6=use_ipv6,

2420

1809

gnutls_priority=

2421

1810

server_settings["priority"],

2422

use_dbus=use_dbus,

2423

socketfd=(server_settings["socket"]

2424

or None))

2425

if not foreground:

1811

use_dbus=use_dbus)

1812

if not debug:

2426

1813

pidfilename = "/var/run/mandos.pid"

2427

pidfile = None

2428

1814

try:

2429

1815

pidfile = open(pidfilename, "w")

2430

except IOError as e:

2431

logger.error("Could not open file %r", pidfilename,

2432

exc_info=e)

1816

except IOError:

1817

logger.error("Could not open file %r", pidfilename)

2433

1818

2434

for name in ("_mandos", "mandos", "nobody"):

1819

try:

1820

uid = pwd.getpwnam("_mandos").pw_uid

1821

gid = pwd.getpwnam("_mandos").pw_gid

1822

except KeyError:

2435

1823

try:

2436

uid = pwd.getpwnam(name).pw_uid

2437

gid = pwd.getpwnam(name).pw_gid

2438

break

1824

uid = pwd.getpwnam("mandos").pw_uid

1825

gid = pwd.getpwnam("mandos").pw_gid

2439

1826

except KeyError:

2440

continue

2441

else:

2442

uid = 65534

2443

gid = 65534

1827

try:

1828

uid = pwd.getpwnam("nobody").pw_uid

1829

gid = pwd.getpwnam("nobody").pw_gid

1830

except KeyError:

1831

uid = 65534

1832

gid = 65534

2444

1833

try:

2445

1834

os.setgid(gid)

2446

1835

os.setuid(uid)

2447

1836

except OSError as error:

2448

if error.errno != errno.EPERM:

1837

if error[0] != errno.EPERM:

2449

1838

raise error

2450

1839

1840

if not debug and not debuglevel:

1841

syslogger.setLevel(logging.WARNING)

1842

console.setLevel(logging.WARNING)

1843

if debuglevel:

1844

level = getattr(logging, debuglevel.upper())

1845

syslogger.setLevel(level)

1846

console.setLevel(level)

1847

2451

1848

if debug:

2452

1849

# Enable all possible GnuTLS debugging

2453

1850

2463

1860

.gnutls_global_set_log_function(debug_gnutls))

2464

1861

2465

1862

# Redirect stdin so all checkers get /dev/null

2466

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1863

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2467

1864

os.dup2(null, sys.stdin.fileno())

2468

1865

if null > 2:

2469

1866

os.close(null)

1867

else:

1868

# No console logging

1869

logger.removeHandler(console)

2470

1870

2471

1871

# Need to fork before connecting to D-Bus

2472

if not foreground:

1872

if not debug:

2473

1873

# Close all input and output, do double fork, etc.

2474

1874

daemon()

2475

1875

2476

# multiprocessing will use threads, so before we use gobject we

2477

# need to inform gobject that threads will be used.

2478

gobject.threads_init()

2479

2480

1876

global main_loop

2481

1877

# From the Avahi example code

2482

DBusGMainLoop(set_as_default=True)

1878

DBusGMainLoop(set_as_default=True )

2483

1879

main_loop = gobject.MainLoop()

2484

1880

bus = dbus.SystemBus()

2485

1881

# End of Avahi example code

2486

1882

if use_dbus:

2487

1883

try:

2488

bus_name = dbus.service.BusName("se.recompile.Mandos",

1884

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2489

1885

bus, do_not_queue=True)

2490

old_bus_name = (dbus.service.BusName

2491

("se.bsnet.fukt.Mandos", bus,

2492

do_not_queue=True))

2493

1886

except dbus.exceptions.NameExistsException as e:

2494

logger.error("Disabling D-Bus:", exc_info=e)

1887

logger.error(unicode(e) + ", disabling D-Bus")

2495

1888

use_dbus = False

2496

1889

server_settings["use_dbus"] = False

2497

1890

tcp_server.use_dbus = False

2498

1891

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2499

service = AvahiServiceToSyslog(name =

2500

server_settings["servicename"],

2501

servicetype = "_mandos._tcp",

2502

protocol = protocol, bus = bus)

1892

service = AvahiService(name = server_settings["servicename"],

1893

servicetype = "_mandos._tcp",

1894

protocol = protocol, bus = bus)

2503

1895

if server_settings["interface"]:

2504

1896

service.interface = (if_nametoindex

2505

1897

(str(server_settings["interface"])))

2510

1902

client_class = Client

2511

1903

if use_dbus:

2512

1904

client_class = functools.partial(ClientDBus, bus = bus)

2513

2514

client_settings = Client.config_parser(client_config)

2515

old_client_settings = {}

2516

clients_data = {}

2517

2518

# Get client data and settings from last running state.

2519

if server_settings["restore"]:

2520

try:

2521

with open(stored_state_path, "rb") as stored_state:

2522

clients_data, old_client_settings = (pickle.load

2523

(stored_state))

2524

os.remove(stored_state_path)

2525

except IOError as e:

2526

if e.errno == errno.ENOENT:

2527

logger.warning("Could not load persistent state: {0}"

2528

.format(os.strerror(e.errno)))

2529

else:

2530

logger.critical("Could not load persistent state:",

2531

exc_info=e)

2532

raise

2533

except EOFError as e:

2534

logger.warning("Could not load persistent state: "

2535

"EOFError:", exc_info=e)

2536

2537

with PGPEngine() as pgp:

2538

for client_name, client in clients_data.iteritems():

2539

# Decide which value to use after restoring saved state.

2540

# We have three different values: Old config file,

2541

# new config file, and saved state.

2542

# New config value takes precedence if it differs from old

2543

# config value, otherwise use saved state.

2544

for name, value in client_settings[client_name].items():

2545

try:

2546

# For each value in new config, check if it

2547

# differs from the old config value (Except for

2548

# the "secret" attribute)

2549

if (name != "secret" and

2550

value != old_client_settings[client_name]

2551

[name]):

2552

client[name] = value

2553

except KeyError:

2554

pass

2555

2556

# Clients who has passed its expire date can still be

2557

# enabled if its last checker was successful. Clients

2558

# whose checker succeeded before we stored its state is

2559

# assumed to have successfully run all checkers during

2560

# downtime.

2561

if client["enabled"]:

2562

if datetime.datetime.utcnow() >= client["expires"]:

2563

if not client["last_checked_ok"]:

2564

logger.warning(

2565

"disabling client {0} - Client never "

2566

"performed a successful checker"

2567

.format(client_name))

2568

client["enabled"] = False

2569

elif client["last_checker_status"] != 0:

2570

logger.warning(

2571

"disabling client {0} - Client "

2572

"last checker failed with error code {1}"

2573

.format(client_name,

2574

client["last_checker_status"]))

2575

client["enabled"] = False

2576

else:

2577

client["expires"] = (datetime.datetime

2578

.utcnow()

2579

+ client["timeout"])

2580

logger.debug("Last checker succeeded,"

2581

" keeping {0} enabled"

2582

.format(client_name))

1905

def client_config_items(config, section):

1906

special_settings = {

1907

"approved_by_default":

1908

lambda: config.getboolean(section,

1909

"approved_by_default"),

1910

}

1911

for name, value in config.items(section):

2583

1912

try:

2584

client["secret"] = (

2585

pgp.decrypt(client["encrypted_secret"],

2586

client_settings[client_name]

2587

["secret"]))

2588

except PGPError:

2589

# If decryption fails, we use secret from new settings

2590

logger.debug("Failed to decrypt {0} old secret"

2591

.format(client_name))

2592

client["secret"] = (

2593

client_settings[client_name]["secret"])

2594

2595

# Add/remove clients based on new changes made to config

2596

for client_name in (set(old_client_settings)

2597

- set(client_settings)):

2598

del clients_data[client_name]

2599

for client_name in (set(client_settings)

2600

- set(old_client_settings)):

2601

clients_data[client_name] = client_settings[client_name]

2602

2603

# Create all client objects

2604

for client_name, client in clients_data.iteritems():

2605

tcp_server.clients[client_name] = client_class(

2606

name = client_name, settings = client)

2607

1913

yield (name, special_settings[name]())

1914

except KeyError:

1915

yield (name, value)

1916

1917

tcp_server.clients.update(set(

1918

client_class(name = section,

1919

config= dict(client_config_items(

1920

client_config, section)))

1921

for section in client_config.sections()))

2608

1922

if not tcp_server.clients:

2609

1923

logger.warning("No clients defined")

2610

2611

if not foreground:

2612

if pidfile is not None:

2613

try:

2614

with pidfile:

2615

pid = os.getpid()

2616

pidfile.write(str(pid) + "\n".encode("utf-8"))

2617

except IOError:

2618

logger.error("Could not write to file %r with PID %d",

2619

pidfilename, pid)

2620

del pidfile

1924

1925

if not debug:

1926

try:

1927

with pidfile:

1928

pid = os.getpid()

1929

pidfile.write(str(pid) + "\n".encode("utf-8"))

1930

del pidfile

1931

except IOError:

1932

logger.error("Could not write to file %r with PID %d",

1933

pidfilename, pid)

1934

except NameError:

1935

# "pidfile" was never created

1936

pass

2621

1937

del pidfilename

1938

1939

signal.signal(signal.SIGINT, signal.SIG_IGN)

2622

1940

2623

1941

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2624

1942

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2625

1943

2626

1944

if use_dbus:

2627

@alternate_dbus_interfaces({"se.recompile.Mandos":

2628

"se.bsnet.fukt.Mandos"})

2629

class MandosDBusService(DBusObjectWithProperties):

1945

class MandosDBusService(dbus.service.Object):

2630

1946

"""A D-Bus proxy object"""

2631

1947

def __init__(self):

2632

1948

dbus.service.Object.__init__(self, bus, "/")

2633

_interface = "se.recompile.Mandos"

2634

2635

@dbus_interface_annotations(_interface)

2636

def _foo(self):

2637

return { "org.freedesktop.DBus.Property"

2638

".EmitsChangedSignal":

2639

"false"}

1949

_interface = "se.bsnet.fukt.Mandos"

2640

1950

2641

1951

@dbus.service.signal(_interface, signature="o")

2642

1952

def ClientAdded(self, objpath):

2657

1967

def GetAllClients(self):

2658

1968

"D-Bus method"

2659

1969

return dbus.Array(c.dbus_object_path

2660

for c in

2661

tcp_server.clients.itervalues())

1970

for c in tcp_server.clients)

2662

1971

2663

1972

@dbus.service.method(_interface,

2664

1973

out_signature="a{oa{sv}}")

2666

1975

"D-Bus method"

2667

1976

return dbus.Dictionary(

2668

1977

((c.dbus_object_path, c.GetAll(""))

2669

for c in tcp_server.clients.itervalues()),

1978

for c in tcp_server.clients),

2670

1979

signature="oa{sv}")

2671

1980

2672

1981

@dbus.service.method(_interface, in_signature="o")

2673

1982

def RemoveClient(self, object_path):

2674

1983

"D-Bus method"

2675

for c in tcp_server.clients.itervalues():

1984

for c in tcp_server.clients:

2676

1985

if c.dbus_object_path == object_path:

2677

del tcp_server.clients[c.name]

1986

tcp_server.clients.remove(c)

2678

1987

c.remove_from_connection()

2679

1988

# Don't signal anything except ClientRemoved

2680

1989

c.disable(quiet=True)

2691

2000

"Cleanup function; run on exit"

2692

2001

service.cleanup()

2693

2002

2694

multiprocessing.active_children()

2695

if not (tcp_server.clients or client_settings):

2696

return

2697

2698

# Store client before exiting. Secrets are encrypted with key

2699

# based on what config file has. If config file is

2700

# removed/edited, old secret will thus be unrecovable.

2701

clients = {}

2702

with PGPEngine() as pgp:

2703

for client in tcp_server.clients.itervalues():

2704

key = client_settings[client.name]["secret"]

2705

client.encrypted_secret = pgp.encrypt(client.secret,

2706

key)

2707

client_dict = {}

2708

2709

# A list of attributes that can not be pickled

2710

# + secret.

2711

exclude = set(("bus", "changedstate", "secret",

2712

"checker"))

2713

for name, typ in (inspect.getmembers

2714

(dbus.service.Object)):

2715

exclude.add(name)

2716

2717

client_dict["encrypted_secret"] = (client

2718

.encrypted_secret)

2719

for attr in client.client_structure:

2720

if attr not in exclude:

2721

client_dict[attr] = getattr(client, attr)

2722

2723

clients[client.name] = client_dict

2724

del client_settings[client.name]["secret"]

2725

2726

try:

2727

with (tempfile.NamedTemporaryFile

2728

(mode='wb', suffix=".pickle", prefix='clients-',

2729

dir=os.path.dirname(stored_state_path),

2730

delete=False)) as stored_state:

2731

pickle.dump((clients, client_settings), stored_state)

2732

tempname=stored_state.name

2733

os.rename(tempname, stored_state_path)

2734

except (IOError, OSError) as e:

2735

if not debug:

2736

try:

2737

os.remove(tempname)

2738

except NameError:

2739

pass

2740

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2741

logger.warning("Could not save persistent state: {0}"

2742

.format(os.strerror(e.errno)))

2743

else:

2744

logger.warning("Could not save persistent state:",

2745

exc_info=e)

2746

raise e

2747

2748

# Delete all clients, and settings from config

2749

2003

while tcp_server.clients:

2750

name, client = tcp_server.clients.popitem()

2004

client = tcp_server.clients.pop()

2751

2005

if use_dbus:

2752

2006

client.remove_from_connection()

2007

client.disable_hook = None

2753

2008

# Don't signal anything except ClientRemoved

2754

2009

client.disable(quiet=True)

2755

2010

if use_dbus:

2756

2011

# Emit D-Bus signal

2757

mandos_dbus_service.ClientRemoved(client

2758

.dbus_object_path,

2012

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2759

2013

client.name)

2760

client_settings.clear()

2761

2014

2762

2015

atexit.register(cleanup)

2763

2016

2764

for client in tcp_server.clients.itervalues():

2017

for client in tcp_server.clients:

2765

2018

if use_dbus:

2766

2019

# Emit D-Bus signal

2767

2020

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2768

# Need to initiate checking of clients

2769

if client.enabled:

2770

client.init_checker()

2021

client.enable()

2771

2022

2772

2023

tcp_server.enable()

2773

2024

tcp_server.server_activate()

2776

2027

service.port = tcp_server.socket.getsockname()[1]

2777

2028

if use_ipv6:

2778

2029

logger.info("Now listening on address %r, port %d,"

2779

" flowinfo %d, scope_id %d",

2780

*tcp_server.socket.getsockname())

2030

" flowinfo %d, scope_id %d"

2031

% tcp_server.socket.getsockname())

2781

2032

else: # IPv4

2782

logger.info("Now listening on address %r, port %d",

2783

*tcp_server.socket.getsockname())

2033

logger.info("Now listening on address %r, port %d"

2034

% tcp_server.socket.getsockname())

2784

2035

2785

2036

#service.interface = tcp_server.socket.getsockname()[3]

2786

2037

2789

2040

try:

2790

2041

service.activate()

2791

2042

except dbus.exceptions.DBusException as error:

2792

logger.critical("D-Bus Exception", exc_info=error)

2043

logger.critical("DBusException: %s", error)

2793

2044

cleanup()

2794

2045

sys.exit(1)

2795

2046

# End of Avahi example code

2802

2053

logger.debug("Starting main loop")

2803

2054

main_loop.run()

2804

2055

except AvahiError as error:

2805

logger.critical("Avahi Error", exc_info=error)

2056

logger.critical("AvahiError: %s", error)

2806

2057

cleanup()

2807

2058

sys.exit(1)

2808

2059

except KeyboardInterrupt:

2813

2064

# Must run before the D-Bus bus name gets deregistered

2814

2065

cleanup()

2815

2066

2067

2816

2068

if __name__ == '__main__':

2817

2069

main()