/mandos/trunk : revision 502

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

67

65

68

66

import dbus

69

67

import dbus.service

74

72

import ctypes.util

75

73

import xml.dom.minidom

76

74

import inspect

77

import Crypto.Cipher.AES

78

75

79

76

try:

80

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

SO_BINDTODEVICE = None

86

83

87

84

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

93

89

syslogger = (logging.handlers.SysLogHandler

94

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

91

address = str("/dev/log")))

99

95

logger.addHandler(syslogger)

100

96

101

97

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

104

99

' %(levelname)s:'

105

100

' %(message)s'))

106

101

logger.addHandler(console)

107

102

108

109

103

class AvahiError(Exception):

110

104

def __init__(self, value, *args, **kwargs):

111

105

self.value = value

165

159

" after %i retries, exiting.",

166

160

self.rename_count)

167

161

raise AvahiServiceError("Too many renames")

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

170

163

logger.info("Changing Zeroconf service name to %r ...",

171

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

172

169

self.remove()

173

170

try:

174

171

self.add()

194

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

195

192

self.entry_group_state_changed_match = (

196

193

self.group.connect_to_signal(

197

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

198

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

199

196

self.name, self.type)

200

197

self.group.AddService(

266

263

self.server_state_changed)

267

264

self.server_state_changed(self.server.GetState())

268

265

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

278

266

279

267

def _timedelta_to_milliseconds(td):

280

268

"Convert a datetime.timedelta() to milliseconds"

299

287

instance %(name)s can be used in the command.

300

288

checker_initiator_tag: a gobject event source tag, or None

301

289

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

304

290

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

305

292

disable_initiator_tag: a gobject event source tag, or None

306

293

enabled: bool()

307

294

fingerprint: string (40 or 32 hexadecimal digits); used to

310

297

interval: datetime.timedelta(); How often to start a new checker

311

298

last_approval_request: datetime.datetime(); (UTC) or None

312

299

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

316

300

last_enabled: datetime.datetime(); (UTC)

317

301

name: string; from the config file, used in log messages and

318

302

D-Bus identifiers

329

313

"created", "enabled", "fingerprint",

330

314

"host", "interval", "last_checked_ok",

331

315

"last_enabled", "name", "timeout")

332

316

333

317

def timeout_milliseconds(self):

334

318

"Return the 'timeout' attribute in milliseconds"

335

319

return _timedelta_to_milliseconds(self.timeout)

336

320

337

321

def extended_timeout_milliseconds(self):

338

322

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

323

return _timedelta_to_milliseconds(self.extended_timeout)

340

324

341

325

def interval_milliseconds(self):

342

326

"Return the 'interval' attribute in milliseconds"

343

327

return _timedelta_to_milliseconds(self.interval)

344

328

345

329

def approval_delay_milliseconds(self):

346

330

return _timedelta_to_milliseconds(self.approval_delay)

347

331

348

def __init__(self, name = None, config=None):

332

def __init__(self, name = None, disable_hook=None, config=None):

349

333

"""Note: the 'checker' key in 'config' sets the

350

334

'checker_command' attribute and *not* the 'checker'

351

335

attribute."""

371

355

% self.name)

372

356

self.host = config.get("host", "")

373

357

self.created = datetime.datetime.utcnow()

374

self.enabled = True

358

self.enabled = False

375

359

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

360

self.last_enabled = None

377

361

self.last_checked_ok = None

378

self.last_checker_status = None

379

362

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

382

364

self.interval = string_to_delta(config["interval"])

365

self.disable_hook = disable_hook

383

366

self.checker = None

384

367

self.checker_initiator_tag = None

385

368

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

369

self.expires = None

387

370

self.checker_callback_tag = None

388

371

self.checker_command = config["checker"]

389

372

self.current_checker_command = None

373

self.last_connect = None

390

374

self._approved = None

391

375

self.approved_by_default = config.get("approved_by_default",

392

376

True)

395

379

config["approval_delay"])

396

380

self.approval_duration = string_to_delta(

397

381

config["approval_duration"])

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

409

383

410

# Send notice to process children that client state has changed

411

384

def send_changedstate(self):

412

with self.changedstate:

413

self.changedstate.notify_all()

414

385

self.changedstate.acquire()

386

self.changedstate.notify_all()

387

self.changedstate.release()

388

415

389

def enable(self):

416

390

"""Start this client's checker and timeout hooks"""

417

391

if getattr(self, "enabled", False):

418

392

# Already enabled

419

393

return

420

394

self.send_changedstate()

395

# Schedule a new checker to be started an 'interval' from now,

396

# and every interval from then on.

397

self.checker_initiator_tag = (gobject.timeout_add

398

(self.interval_milliseconds(),

399

self.start_checker))

400

# Schedule a disable() when 'timeout' has passed

421

401

self.expires = datetime.datetime.utcnow() + self.timeout

402

self.disable_initiator_tag = (gobject.timeout_add

403

(self.timeout_milliseconds(),

404

self.disable))

422

405

self.enabled = True

423

406

self.last_enabled = datetime.datetime.utcnow()

424

self.init_checker()

407

# Also start a new checker *right now*.

408

self.start_checker()

425

409

426

410

def disable(self, quiet=True):

427

411

"""Disable this client."""

439

423

gobject.source_remove(self.checker_initiator_tag)

440

424

self.checker_initiator_tag = None

441

425

self.stop_checker()

426

if self.disable_hook:

427

self.disable_hook(self)

442

428

self.enabled = False

443

429

# Do not run this again if called by a gobject.timeout_add

444

430

return False

445

431

446

432

def __del__(self):

433

self.disable_hook = None

447

434

self.disable()

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

435

463

436

def checker_callback(self, pid, condition, command):

464

437

"""The checker has completed, so take appropriate actions."""

465

438

self.checker_callback_tag = None

466

439

self.checker = None

467

440

if os.WIFEXITED(condition):

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

441

exitstatus = os.WEXITSTATUS(condition)

442

if exitstatus == 0:

470

443

logger.info("Checker for %(name)s succeeded",

471

444

vars(self))

472

445

self.checked_ok()

474

447

logger.info("Checker for %(name)s failed",

475

448

vars(self))

476

449

else:

477

self.last_checker_status = -1

478

450

logger.warning("Checker for %(name)s crashed?",

479

451

vars(self))

480

452

487

459

if timeout is None:

488

460

timeout = self.timeout

489

461

self.last_checked_ok = datetime.datetime.utcnow()

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

462

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

464

self.disable_initiator_tag = (gobject.timeout_add

465

(_timedelta_to_milliseconds(timeout),

466

self.disable))

497

467

498

468

def need_approval(self):

499

469

self.last_approval_request = datetime.datetime.utcnow()

539

509

'replace')))

540

510

for attr in

541

511

self.runtime_expansions)

542

512

543

513

try:

544

514

command = self.checker_command % escaped_attrs

545

515

except TypeError as error:

591

561

raise

592

562

self.checker = None

593

563

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

640

641

564

def dbus_service_property(dbus_interface, signature="v",

642

565

access="readwrite", byte_arrays=False):

643

566

"""Decorators for marking methods of a DBusObjectWithProperties to

689

612

690

613

class DBusObjectWithProperties(dbus.service.Object):

691

614

"""A D-Bus object with properties.

692

615

693

616

Classes inheriting from this can use the dbus_service_property

694

617

decorator to expose methods as D-Bus properties. It exposes the

695

618

standard Get(), Set(), and GetAll() methods on the D-Bus.

702

625

def _get_all_dbus_properties(self):

703

626

"""Returns a generator of (name, attribute) pairs

704

627

"""

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

706

for cls in self.__class__.__mro__

628

return ((prop._dbus_name, prop)

707

629

for name, prop in

708

inspect.getmembers(cls, self._is_dbus_property))

630

inspect.getmembers(self, self._is_dbus_property))

709

631

710

632

def _get_dbus_property(self, interface_name, property_name):

711

633

"""Returns a bound method if one exists which is a D-Bus

712

634

property with the specified name and interface.

713

635

"""

714

for cls in self.__class__.__mro__:

715

for name, value in (inspect.getmembers

716

(cls, self._is_dbus_property)):

717

if (value._dbus_name == property_name

718

and value._dbus_interface == interface_name):

719

return value.__get__(self)

720

636

for name in (property_name,

637

property_name + "_dbus_property"):

638

prop = getattr(self, name, None)

639

if (prop is None

640

or not self._is_dbus_property(prop)

641

or prop._dbus_name != property_name

642

or (interface_name and prop._dbus_interface

643

and interface_name != prop._dbus_interface)):

644

continue

645

return prop

721

646

# No such property

722

647

raise DBusPropertyNotFound(self.dbus_object_path + ":"

723

648

+ interface_name + "."

757

682

def GetAll(self, interface_name):

758

683

"""Standard D-Bus property GetAll() method, see D-Bus

759

684

standard.

760

685

761

686

Note: Will not include properties with access="write".

762

687

"""

763

688

all = {}

832

757

return dbus.String(dt.isoformat(),

833

758

variant_level=variant_level)

834

759

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

839

"""

840

def __new__(mcs, name, bases, attr):

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

847

# Ignore non-D-Bus attributes, and D-Bus attributes

848

# with the wrong interface name

849

if (not hasattr(attribute, "_dbus_interface")

850

or not attribute._dbus_interface

851

.startswith("se.recompile.Mandos")):

852

continue

853

# Create an alternate D-Bus interface name based on

854

# the current name

855

alt_interface = (attribute._dbus_interface

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

858

# Is this a D-Bus signal?

859

if getattr(attribute, "_dbus_is_signal", False):

860

# Extract the original non-method function by

861

# black magic

862

nonmethod_func = (dict(

863

zip(attribute.func_code.co_freevars,

864

attribute.__closure__))["func"]

865

.cell_contents)

866

# Create a new, but exactly alike, function

867

# object, and decorate it to be a new D-Bus signal

868

# with the alternate D-Bus interface name

869

new_function = (dbus.service.signal

870

(alt_interface,

871

attribute._dbus_signature)

872

(types.FunctionType(

873

nonmethod_func.func_code,

874

nonmethod_func.func_globals,

875

nonmethod_func.func_name,

876

nonmethod_func.func_defaults,

877

nonmethod_func.func_closure)))

878

# Define a creator of a function to call both the

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

881

def fixscope(func1, func2):

882

"""This function is a scope container to pass

883

func1 and func2 to the "call_both" function

884

outside of its arguments"""

885

def call_both(*args, **kwargs):

886

"""This function will emit two D-Bus

887

signals by calling func1 and func2"""

888

func1(*args, **kwargs)

889

func2(*args, **kwargs)

890

return call_both

891

# Create the "call_both" function and add it to

892

# the class

893

attr[attrname] = fixscope(attribute,

894

new_function)

895

# Is this a D-Bus method?

896

elif getattr(attribute, "_dbus_is_method", False):

897

# Create a new, but exactly alike, function

898

# object. Decorate it to be a new D-Bus method

899

# with the alternate D-Bus interface name. Add it

900

# to the class.

901

attr[attrname] = (dbus.service.method

902

(alt_interface,

903

attribute._dbus_in_signature,

904

attribute._dbus_out_signature)

905

(types.FunctionType

906

(attribute.func_code,

907

attribute.func_globals,

908

attribute.func_name,

909

attribute.func_defaults,

910

attribute.func_closure)))

911

# Is this a D-Bus property?

912

elif getattr(attribute, "_dbus_is_property", False):

913

# Create a new, but exactly alike, function

914

# object, and decorate it to be a new D-Bus

915

# property with the alternate D-Bus interface

916

# name. Add it to the class.

917

attr[attrname] = (dbus_service_property

918

(alt_interface,

919

attribute._dbus_signature,

920

attribute._dbus_access,

921

attribute

922

._dbus_get_args_options

923

["byte_arrays"])

924

(types.FunctionType

925

(attribute.func_code,

926

attribute.func_globals,

927

attribute.func_name,

928

attribute.func_defaults,

929

attribute.func_closure)))

930

return type.__new__(mcs, name, bases, attr)

931

932

760

class ClientDBus(Client, DBusObjectWithProperties):

933

761

"""A Client class using D-Bus

934

762

943

771

# dbus.service.Object doesn't use super(), so we can't either.

944

772

945

773

def __init__(self, bus = None, *args, **kwargs):

774

self._approvals_pending = 0

946

775

self.bus = bus

947

776

Client.__init__(self, *args, **kwargs)

948

949

self._approvals_pending = 0

950

777

# Only now, when this client is initialized, can it show up on

951

778

# the D-Bus

952

779

client_object_name = unicode(self.name).translate(

960

787

def notifychangeproperty(transform_func,

961

788

dbus_name, type_func=lambda x: x,

962

789

variant_level=1):

963

""" Modify a variable so that it's a property which announces

964

its changes to DBus.

965

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

968

dbus_name: D-Bus name of the variable

790

""" Modify a variable so that its a property that announce its

791

changes to DBus.

792

transform_fun: Function that takes a value and transform it to

793

DBus type.

794

dbus_name: DBus name of the variable

969

795

type_func: Function that transform the value before sending it

970

to the D-Bus. Default: no transform

971

variant_level: D-Bus variant level. Default: 1

796

to DBus

797

variant_level: DBus variant level. default: 1

972

798

"""

973

attrname = "_{0}".format(dbus_name)

799

real_value = [None,]

974

800

def setter(self, value):

801

old_value = real_value[0]

802

real_value[0] = value

975

803

if hasattr(self, "dbus_object_path"):

976

if (not hasattr(self, attrname) or

977

type_func(getattr(self, attrname, None))

978

!= type_func(value)):

979

dbus_value = transform_func(type_func(value),

980

variant_level

981

=variant_level)

804

if type_func(old_value) != type_func(real_value[0]):

805

dbus_value = transform_func(type_func(real_value[0]),

806

variant_level)

982

807

self.PropertyChanged(dbus.String(dbus_name),

983

808

dbus_value)

984

setattr(self, attrname, value)

985

986

return property(lambda self: getattr(self, attrname), setter)

987

988

809

810

return property(lambda self: real_value[0], setter)

811

812

989

813

expires = notifychangeproperty(datetime_to_dbus, "Expires")

990

814

approvals_pending = notifychangeproperty(dbus.Boolean,

991

815

"ApprovalPending",

994

818

last_enabled = notifychangeproperty(datetime_to_dbus,

995

819

"LastEnabled")

996

820

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

997

type_func = lambda checker:

998

checker is not None)

821

type_func = lambda checker: checker is not None)

999

822

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1000

823

"LastCheckedOK")

1001

last_approval_request = notifychangeproperty(

1002

datetime_to_dbus, "LastApprovalRequest")

824

last_approval_request = notifychangeproperty(datetime_to_dbus,

825

"LastApprovalRequest")

1003

826

approved_by_default = notifychangeproperty(dbus.Boolean,

1004

827

"ApprovedByDefault")

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1006

"ApprovalDelay",

1007

type_func =

1008

_timedelta_to_milliseconds)

1009

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

828

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

829

type_func = _timedelta_to_milliseconds)

830

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

831

type_func = _timedelta_to_milliseconds)

1012

832

host = notifychangeproperty(dbus.String, "Host")

1013

833

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1014

type_func =

1015

_timedelta_to_milliseconds)

1016

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1020

"Interval",

1021

type_func =

1022

_timedelta_to_milliseconds)

834

type_func = _timedelta_to_milliseconds)

835

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

836

type_func = _timedelta_to_milliseconds)

837

interval = notifychangeproperty(dbus.UInt16, "Interval",

838

type_func = _timedelta_to_milliseconds)

1023

839

checker_command = notifychangeproperty(dbus.String, "Checker")

1024

840

1025

841

del notifychangeproperty

1051

867

1052

868

return Client.checker_callback(self, pid, condition, command,

1053

869

*args, **kwargs)

1054

870

1055

871

def start_checker(self, *args, **kwargs):

1056

872

old_checker = self.checker

1057

873

if self.checker is not None:

1079

895

1080

896

1081

897

## D-Bus methods, signals & properties

1082

_interface = "se.recompile.Mandos.Client"

898

_interface = "se.bsnet.fukt.Mandos.Client"

1083

899

1084

900

## Signals

1085

901

1260

1076

gobject.source_remove(self.disable_initiator_tag)

1261

1077

self.disable_initiator_tag = None

1262

1078

self.expires = None

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1079

time_to_die = (self.

1080

_timedelta_to_milliseconds((self

1081

.last_checked_ok

1082

+ self.timeout)

1083

- datetime.datetime

1084

.utcnow()))

1268

1085

if time_to_die <= 0:

1269

1086

# The timeout has passed

1270

1087

self.disable()

1271

1088

else:

1272

1089

self.expires = (datetime.datetime.utcnow()

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1090

+ datetime.timedelta(milliseconds = time_to_die))

1275

1091

self.disable_initiator_tag = (gobject.timeout_add

1276

1092

(time_to_die, self.disable))

1277

1093

1278

1094

# ExtendedTimeout - property

1279

1095

@dbus_service_property(_interface, signature="t",

1280

1096

access="readwrite")

1282

1098

if value is None: # get

1283

1099

return dbus.UInt64(self.extended_timeout_milliseconds())

1284

1100

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1285

1101

1286

1102

# Interval - property

1287

1103

@dbus_service_property(_interface, signature="t",

1288

1104

access="readwrite")

1297

1113

self.checker_initiator_tag = (gobject.timeout_add

1298

1114

(value, self.start_checker))

1299

1115

self.start_checker() # Start one now, too

1300

1116

1301

1117

# Checker - property

1302

1118

@dbus_service_property(_interface, signature="s",

1303

1119

access="readwrite")

1337

1153

self._pipe.send(('init', fpr, address))

1338

1154

if not self._pipe.recv():

1339

1155

raise KeyError()

1340

1156

1341

1157

def __getattribute__(self, name):

1342

1158

if(name == '_pipe'):

1343

1159

return super(ProxyClient, self).__getattribute__(name)

1350

1166

self._pipe.send(('funcall', name, args, kwargs))

1351

1167

return self._pipe.recv()[1]

1352

1168

return func

1353

1169

1354

1170

def __setattr__(self, name, value):

1355

1171

if(name == '_pipe'):

1356

1172

return super(ProxyClient, self).__setattr__(name, value)

1357

1173

self._pipe.send(('setattr', name, value))

1358

1174

1359

class ClientDBusTransitional(ClientDBus):

1360

__metaclass__ = AlternateDBusNamesMetaclass

1361

1175

1362

1176

class ClientHandler(socketserver.BaseRequestHandler, object):

1363

1177

"""A class to handle client connections.

1371

1185

unicode(self.client_address))

1372

1186

logger.debug("Pipe FD: %d",

1373

1187

self.server.child_pipe.fileno())

1374

1188

1375

1189

session = (gnutls.connection

1376

1190

.ClientSession(self.request,

1377

1191

gnutls.connection

1378

1192

.X509Credentials()))

1379

1193

1380

1194

# Note: gnutls.connection.X509Credentials is really a

1381

1195

# generic GnuTLS certificate credentials object so long as

1382

1196

# no X.509 keys are added to it. Therefore, we can use it

1383

1197

# here despite using OpenPGP certificates.

1384

1198

1385

1199

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1386

1200

# "+AES-256-CBC", "+SHA1",

1387

1201

# "+COMP-NULL", "+CTYPE-OPENPGP",

1393

1207

(gnutls.library.functions

1394

1208

.gnutls_priority_set_direct(session._c_object,

1395

1209

priority, None))

1396

1210

1397

1211

# Start communication using the Mandos protocol

1398

1212

# Get protocol number

1399

1213

line = self.request.makefile().readline()

1404

1218

except (ValueError, IndexError, RuntimeError) as error:

1405

1219

logger.error("Unknown protocol version: %s", error)

1406

1220

return

1407

1221

1408

1222

# Start GnuTLS connection

1409

1223

try:

1410

1224

session.handshake()

1414

1228

# established. Just abandon the request.

1415

1229

return

1416

1230

logger.debug("Handshake succeeded")

1417

1231

1418

1232

approval_required = False

1419

1233

try:

1420

1234

try:

1425

1239

logger.warning("Bad certificate: %s", error)

1426

1240

return

1427

1241

logger.debug("Fingerprint: %s", fpr)

1428

1242

1429

1243

try:

1430

1244

client = ProxyClient(child_pipe, fpr,

1431

1245

self.client_address)

1443

1257

client.name)

1444

1258

if self.server.use_dbus:

1445

1259

# Emit D-Bus signal

1446

client.Rejected("Disabled")

1260

client.Rejected("Disabled")

1447

1261

return

1448

1262

1449

1263

if client._approved or not client.approval_delay:

1466

1280

return

1467

1281

1468

1282

#wait until timeout or approved

1283

#x = float(client._timedelta_to_milliseconds(delay))

1469

1284

time = datetime.datetime.now()

1470

1285

client.changedstate.acquire()

1471

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1473

/ 1000)))

1286

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1474

1287

client.changedstate.release()

1475

1288

time2 = datetime.datetime.now()

1476

1289

if (time2 - time) >= delay:

1498

1311

sent, len(client.secret)

1499

1312

- (sent_size + sent))

1500

1313

sent_size += sent

1501

1314

1502

1315

logger.info("Sending secret to %s", client.name)

1503

# bump the timeout using extended_timeout

1316

# bump the timeout as if seen

1504

1317

client.checked_ok(client.extended_timeout)

1505

1318

if self.server.use_dbus:

1506

1319

# Emit D-Bus signal

1586

1399

except:

1587

1400

self.handle_error(request, address)

1588

1401

self.close_request(request)

1589

1402

1590

1403

def process_request(self, request, address):

1591

1404

"""Start a new process to process the request."""

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1593

args = (request,

1594

address))

1595

proc.start()

1596

return proc

1597

1405

multiprocessing.Process(target = self.sub_process_main,

1406

args = (request, address)).start()

1598

1407

1599

1408

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1600

1409

""" adds a pipe to the MixIn """

1604

1413

This function creates a new pipe in self.pipe

1605

1414

"""

1606

1415

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1607

1608

proc = MultiprocessingMixIn.process_request(self, request,

1609

client_address)

1416

1417

super(MultiprocessingMixInWithPipe,

1418

self).process_request(request, client_address)

1610

1419

self.child_pipe.close()

1611

self.add_pipe(parent_pipe, proc)

1612

1613

def add_pipe(self, parent_pipe, proc):

1420

self.add_pipe(parent_pipe)

1421

1422

def add_pipe(self, parent_pipe):

1614

1423

"""Dummy function; override as necessary"""

1615

1424

raise NotImplementedError

1616

1425

1617

1618

1426

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1619

1427

socketserver.TCPServer, object):

1620

1428

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1694

1502

self.enabled = False

1695

1503

self.clients = clients

1696

1504

if self.clients is None:

1697

self.clients = {}

1505

self.clients = set()

1698

1506

self.use_dbus = use_dbus

1699

1507

self.gnutls_priority = gnutls_priority

1700

1508

IPv6_TCPServer.__init__(self, server_address,

1704

1512

def server_activate(self):

1705

1513

if self.enabled:

1706

1514

return socketserver.TCPServer.server_activate(self)

1707

1708

1515

def enable(self):

1709

1516

self.enabled = True

1710

1711

def add_pipe(self, parent_pipe, proc):

1517

def add_pipe(self, parent_pipe):

1712

1518

# Call "handle_ipc" for both data and EOF events

1713

1519

gobject.io_add_watch(parent_pipe.fileno(),

1714

1520

gobject.IO_IN | gobject.IO_HUP,

1715

1521

functools.partial(self.handle_ipc,

1716

parent_pipe =

1717

parent_pipe,

1718

proc = proc))

1719

1522

parent_pipe = parent_pipe))

1523

1720

1524

def handle_ipc(self, source, condition, parent_pipe=None,

1721

proc = None, client_object=None):

1525

client_object=None):

1722

1526

condition_names = {

1723

1527

gobject.IO_IN: "IN", # There is data to read.

1724

1528

gobject.IO_OUT: "OUT", # Data can be written (without

1733

1537

for cond, name in

1734

1538

condition_names.iteritems()

1735

1539

if cond & condition)

1736

# error, or the other end of multiprocessing.Pipe has closed

1540

# error or the other end of multiprocessing.Pipe has closed

1737

1541

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1738

# Wait for other process to exit

1739

proc.join()

1740

1542

return False

1741

1543

1742

1544

# Read a request from the child

1747

1549

fpr = request[1]

1748

1550

address = request[2]

1749

1551

1750

for c in self.clients.itervalues():

1552

for c in self.clients:

1751

1553

if c.fingerprint == fpr:

1752

1554

client = c

1753

1555

break

1756

1558

"dress: %s", fpr, address)

1757

1559

if self.use_dbus:

1758

1560

# Emit D-Bus signal

1759

mandos_dbus_service.ClientNotFound(fpr,

1760

address[0])

1561

mandos_dbus_service.ClientNotFound(fpr, address[0])

1761

1562

parent_pipe.send(False)

1762

1563

return False

1763

1564

1764

1565

gobject.io_add_watch(parent_pipe.fileno(),

1765

1566

gobject.IO_IN | gobject.IO_HUP,

1766

1567

functools.partial(self.handle_ipc,

1767

parent_pipe =

1768

parent_pipe,

1769

proc = proc,

1770

client_object =

1771

client))

1568

parent_pipe = parent_pipe,

1569

client_object = client))

1772

1570

parent_pipe.send(True)

1773

# remove the old hook in favor of the new above hook on

1774

# same fileno

1571

# remove the old hook in favor of the new above hook on same fileno

1775

1572

return False

1776

1573

if command == 'funcall':

1777

1574

funcname = request[1]

1778

1575

args = request[2]

1779

1576

kwargs = request[3]

1780

1577

1781

parent_pipe.send(('data', getattr(client_object,

1782

funcname)(*args,

1783

**kwargs)))

1784

1578

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1579

1785

1580

if command == 'getattr':

1786

1581

attrname = request[1]

1787

1582

if callable(client_object.__getattribute__(attrname)):

1788

1583

parent_pipe.send(('function',))

1789

1584

else:

1790

parent_pipe.send(('data', client_object

1791

.__getattribute__(attrname)))

1585

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1792

1586

1793

1587

if command == 'setattr':

1794

1588

attrname = request[1]

1795

1589

value = request[2]

1796

1590

setattr(client_object, attrname, value)

1797

1591

1798

1592

return True

1799

1593

1800

1594

1921

1715

" system bus interface")

1922

1716

parser.add_argument("--no-ipv6", action="store_false",

1923

1717

dest="use_ipv6", help="Do not use IPv6")

1924

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

1928

1718

options = parser.parse_args()

1929

1719

1930

1720

if options.check:

1965

1755

# options, if set.

1966

1756

for option in ("interface", "address", "port", "debug",

1967

1757

"priority", "servicename", "configdir",

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1758

"use_dbus", "use_ipv6", "debuglevel"):

1969

1759

value = getattr(options, option)

1970

1760

if value is not None:

1971

1761

server_settings[option] = value

1983

1773

debuglevel = server_settings["debuglevel"]

1984

1774

use_dbus = server_settings["use_dbus"]

1985

1775

use_ipv6 = server_settings["use_ipv6"]

1986

1776

1987

1777

if server_settings["servicename"] != "Mandos":

1988

1778

syslogger.setFormatter(logging.Formatter

1989

1779

('Mandos (%s) [%%(process)d]:'

2044

1834

raise error

2045

1835

2046

1836

if not debug and not debuglevel:

2047

logger.setLevel(logging.WARNING)

1837

syslogger.setLevel(logging.WARNING)

1838

console.setLevel(logging.WARNING)

2048

1839

if debuglevel:

2049

1840

level = getattr(logging, debuglevel.upper())

2050

logger.setLevel(level)

2051

1841

syslogger.setLevel(level)

1842

console.setLevel(level)

1843

2052

1844

if debug:

2053

logger.setLevel(logging.DEBUG)

2054

1845

# Enable all possible GnuTLS debugging

2055

1846

2056

1847

# "Use a log level over 10 to enable all debugging options."

2086

1877

# End of Avahi example code

2087

1878

if use_dbus:

2088

1879

try:

2089

bus_name = dbus.service.BusName("se.recompile.Mandos",

1880

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2090

1881

bus, do_not_queue=True)

2091

old_bus_name = (dbus.service.BusName

2092

("se.bsnet.fukt.Mandos", bus,

2093

do_not_queue=True))

2094

1882

except dbus.exceptions.NameExistsException as e:

2095

1883

logger.error(unicode(e) + ", disabling D-Bus")

2096

1884

use_dbus = False

2097

1885

server_settings["use_dbus"] = False

2098

1886

tcp_server.use_dbus = False

2099

1887

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2100

service = AvahiServiceToSyslog(name =

2101

server_settings["servicename"],

2102

servicetype = "_mandos._tcp",

2103

protocol = protocol, bus = bus)

1888

service = AvahiService(name = server_settings["servicename"],

1889

servicetype = "_mandos._tcp",

1890

protocol = protocol, bus = bus)

2104

1891

if server_settings["interface"]:

2105

1892

service.interface = (if_nametoindex

2106

1893

(str(server_settings["interface"])))

2110

1897

2111

1898

client_class = Client

2112

1899

if use_dbus:

2113

client_class = functools.partial(ClientDBusTransitional,

2114

bus = bus)

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2133

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2137

if server_settings["restore"]:

2138

try:

2139

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2141

os.remove(stored_state_path)

2142

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2145

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

1900

client_class = functools.partial(ClientDBus, bus = bus)

1901

def client_config_items(config, section):

1902

special_settings = {

1903

"approved_by_default":

1904

lambda: config.getboolean(section,

1905

"approved_by_default"),

1906

}

1907

for name, value in config.items(section):

2156

1908

try:

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

1909

yield (name, special_settings[name]())

2162

1910

except KeyError:

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

1911

yield (name, value)

2209

1912

2210

1913

tcp_server.clients.update(set(

1914

client_class(name = section,

1915

config= dict(client_config_items(

1916

client_config, section)))

1917

for section in client_config.sections()))

2211

1918

if not tcp_server.clients:

2212

1919

logger.warning("No clients defined")

2213

1920

2226

1933

del pidfilename

2227

1934

2228

1935

signal.signal(signal.SIGINT, signal.SIG_IGN)

2229

1936

2230

1937

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2231

1938

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2232

1939

2235

1942

"""A D-Bus proxy object"""

2236

1943

def __init__(self):

2237

1944

dbus.service.Object.__init__(self, bus, "/")

2238

_interface = "se.recompile.Mandos"

1945

_interface = "se.bsnet.fukt.Mandos"

2239

1946

2240

1947

@dbus.service.signal(_interface, signature="o")

2241

1948

def ClientAdded(self, objpath):

2256

1963

def GetAllClients(self):

2257

1964

"D-Bus method"

2258

1965

return dbus.Array(c.dbus_object_path

2259

for c in

2260

tcp_server.clients.itervalues())

1966

for c in tcp_server.clients)

2261

1967

2262

1968

@dbus.service.method(_interface,

2263

1969

out_signature="a{oa{sv}}")

2265

1971

"D-Bus method"

2266

1972

return dbus.Dictionary(

2267

1973

((c.dbus_object_path, c.GetAll(""))

2268

for c in tcp_server.clients.itervalues()),

1974

for c in tcp_server.clients),

2269

1975

signature="oa{sv}")

2270

1976

2271

1977

@dbus.service.method(_interface, in_signature="o")

2272

1978

def RemoveClient(self, object_path):

2273

1979

"D-Bus method"

2274

for c in tcp_server.clients.itervalues():

1980

for c in tcp_server.clients:

2275

1981

if c.dbus_object_path == object_path:

2276

del tcp_server.clients[c.name]

1982

tcp_server.clients.remove(c)

2277

1983

c.remove_from_connection()

2278

1984

# Don't signal anything except ClientRemoved

2279

1985

c.disable(quiet=True)

2284

1990

2285

1991

del _interface

2286

1992

2287

class MandosDBusServiceTransitional(MandosDBusService):

2288

__metaclass__ = AlternateDBusNamesMetaclass

2289

mandos_dbus_service = MandosDBusServiceTransitional()

1993

mandos_dbus_service = MandosDBusService()

2290

1994

2291

1995

def cleanup():

2292

1996

"Cleanup function; run on exit"

2293

1997

service.cleanup()

2294

1998

2295

multiprocessing.active_children()

2296

if not (tcp_server.clients or client_settings):

2297

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2321

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2323

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2329

# Delete all clients, and settings from config

2330

1999

while tcp_server.clients:

2331

name, client = tcp_server.clients.popitem()

2000

client = tcp_server.clients.pop()

2332

2001

if use_dbus:

2333

2002

client.remove_from_connection()

2003

client.disable_hook = None

2334

2004

# Don't signal anything except ClientRemoved

2335

2005

client.disable(quiet=True)

2336

2006

if use_dbus:

2337

2007

# Emit D-Bus signal

2338

mandos_dbus_service.ClientRemoved(client

2339

.dbus_object_path,

2008

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2340

2009

client.name)

2341

client_settings.clear()

2342

2010

2343

2011

atexit.register(cleanup)

2344

2012

2345

for client in tcp_server.clients.itervalues():

2013

for client in tcp_server.clients:

2346

2014

if use_dbus:

2347

2015

# Emit D-Bus signal

2348

2016

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2349

# Need to initiate checking of clients

2350

if client.enabled:

2351

client.init_checker()

2352

2017

client.enable()

2353

2018

2354

2019

tcp_server.enable()

2355

2020

tcp_server.server_activate()

2395

2060

# Must run before the D-Bus bus name gets deregistered

2396

2061

cleanup()

2397

2062

2398

2399

2063

if __name__ == '__main__':

2400

2064

main()