/mandos/trunk : revision 502

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

64

62

import functools

65

63

import cPickle as pickle

66

64

import multiprocessing

67

import types

68

import binascii

69

import tempfile

70

import itertools

71

65

72

66

import dbus

73

67

import dbus.service

78

72

import ctypes.util

79

73

import xml.dom.minidom

80

74

import inspect

81

import GnuPGInterface

82

75

83

76

try:

84

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

88

81

except ImportError:

89

82

SO_BINDTODEVICE = None

90

83

91

version = "1.5.3"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

84

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

95

89

syslogger = (logging.handlers.SysLogHandler

96

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

91

address = str("/dev/log")))

98

99

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

def if_nametoindex(interface):

105

"Get an interface index the hard way, i.e. using fcntl()"

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

with contextlib.closing(socket.socket()) as s:

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

113

return interface_index

114

115

116

def initlogger(debug, level=logging.WARNING):

117

"""init logger and add loglevel"""

118

119

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

132

133

134

class PGPError(Exception):

135

"""Exception if encryption/decryption fails"""

136

pass

137

138

139

class PGPEngine(object):

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

151

def __enter__(self):

152

return self

153

154

def __exit__ (self, exc_type, exc_value, traceback):

155

self._cleanup()

156

return False

157

158

def __del__(self):

159

self._cleanup()

160

161

def _cleanup(self):

162

if self.tempdir is not None:

163

# Delete contents of tempdir

164

for root, dirs, files in os.walk(self.tempdir,

165

topdown = False):

166

for filename in files:

167

os.remove(os.path.join(root, filename))

168

for dirname in dirs:

169

os.rmdir(os.path.join(root, dirname))

170

# Remove tempdir

171

os.rmdir(self.tempdir)

172

self.tempdir = None

173

174

def password_encode(self, password):

175

# Passphrase can not be empty and can not contain newlines or

176

# NUL bytes. So we prefix it and hex encode it.

177

return b"mandos" + binascii.hexlify(password)

178

179

def encrypt(self, data, password):

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

194

return ciphertext

195

196

def decrypt(self, data, password):

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

211

return decrypted_plaintext

212

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

213

102

214

103

class AvahiError(Exception):

215

104

def __init__(self, value, *args, **kwargs):

245

134

server: D-Bus Server

246

135

bus: dbus.SystemBus()

247

136

"""

248

249

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

138

servicetype = None, port = None, TXT = None,

251

139

domain = "", host = "", max_renames = 32768,

264

152

self.server = None

265

153

self.bus = bus

266

154

self.entry_group_state_changed_match = None

267

268

155

def rename(self):

269

156

"""Derived from the Avahi example code"""

270

157

if self.rename_count >= self.max_renames:

272

159

" after %i retries, exiting.",

273

160

self.rename_count)

274

161

raise AvahiServiceError("Too many renames")

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

277

163

logger.info("Changing Zeroconf service name to %r ...",

278

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

279

169

self.remove()

280

170

try:

281

171

self.add()

282

172

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

173

logger.critical("DBusException: %s", error)

284

174

self.cleanup()

285

175

os._exit(1)

286

176

self.rename_count += 1

287

288

177

def remove(self):

289

178

"""Derived from the Avahi example code"""

290

179

if self.entry_group_state_changed_match is not None:

292

181

self.entry_group_state_changed_match = None

293

182

if self.group is not None:

294

183

self.group.Reset()

295

296

184

def add(self):

297

185

"""Derived from the Avahi example code"""

298

186

self.remove()

303

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

304

192

self.entry_group_state_changed_match = (

305

193

self.group.connect_to_signal(

306

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

307

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

308

196

self.name, self.type)

309

197

self.group.AddService(

315

203

dbus.UInt16(self.port),

316

204

avahi.string_array_to_txt_array(self.TXT))

317

205

self.group.Commit()

318

319

206

def entry_group_state_changed(self, state, error):

320

207

"""Derived from the Avahi example code"""

321

208

logger.debug("Avahi entry group state change: %i", state)

328

215

elif state == avahi.ENTRY_GROUP_FAILURE:

329

216

logger.critical("Avahi: Error in group state changed %s",

330

217

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

218

raise AvahiGroupError("State changed: %s"

219

% unicode(error))

334

220

def cleanup(self):

335

221

"""Derived from the Avahi example code"""

336

222

if self.group is not None:

337

223

try:

338

224

self.group.Free()

339

225

except (dbus.exceptions.UnknownMethodException,

340

dbus.exceptions.DBusException):

226

dbus.exceptions.DBusException) as e:

341

227

pass

342

228

self.group = None

343

229

self.remove()

344

345

230

def server_state_changed(self, state, error=None):

346

231

"""Derived from the Avahi example code"""

347

232

logger.debug("Avahi server state change: %i", state)

366

251

logger.debug("Unknown state: %r", state)

367

252

else:

368

253

logger.debug("Unknown state: %r: %r", state, error)

369

370

254

def activate(self):

371

255

"""Derived from the Avahi example code"""

372

256

if self.server is None:

380

264

self.server_state_changed(self.server.GetState())

381

265

382

266

383

class AvahiServiceToSyslog(AvahiService):

384

def rename(self):

385

"""Add the new name to the syslog messages"""

386

ret = AvahiService.rename(self)

387

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

391

return ret

392

393

394

def timedelta_to_milliseconds(td):

267

def _timedelta_to_milliseconds(td):

395

268

"Convert a datetime.timedelta() to milliseconds"

396

269

return ((td.days * 24 * 60 * 60 * 1000)

397

270

+ (td.seconds * 1000)

398

271

+ (td.microseconds // 1000))

399

400

272

401

273

class Client(object):

402

274

"""A representation of a client host served by this server.

403

275

404

276

Attributes:

405

approved: bool(); 'None' if not yet approved/disapproved

277

_approved: bool(); 'None' if not yet approved/disapproved

406

278

approval_delay: datetime.timedelta(); Time to wait for approval

407

279

approval_duration: datetime.timedelta(); Duration of one approval

408

280

checker: subprocess.Popen(); a running checker process used

415

287

instance %(name)s can be used in the command.

416

288

checker_initiator_tag: a gobject event source tag, or None

417

289

created: datetime.datetime(); (UTC) object creation

418

client_structure: Object describing what attributes a client has

419

and is used for storing the client at exit

420

290

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

421

292

disable_initiator_tag: a gobject event source tag, or None

422

293

enabled: bool()

423

294

fingerprint: string (40 or 32 hexadecimal digits); used to

426

297

interval: datetime.timedelta(); How often to start a new checker

427

298

last_approval_request: datetime.datetime(); (UTC) or None

428

299

last_checked_ok: datetime.datetime(); (UTC) or None

429

last_checker_status: integer between 0 and 255 reflecting exit

430

status of last checker. -1 reflects crashed

431

checker, -2 means no checker completed yet.

432

last_enabled: datetime.datetime(); (UTC) or None

300

last_enabled: datetime.datetime(); (UTC)

433

301

name: string; from the config file, used in log messages and

434

302

D-Bus identifiers

435

303

secret: bytestring; sent verbatim (over TLS) to client

436

304

timeout: datetime.timedelta(); How long from last_checked_ok

437

305

until this client is disabled

438

extended_timeout: extra long timeout when secret has been sent

306

extended_timeout: extra long timeout when password has been sent

439

307

runtime_expansions: Allowed attributes for runtime expansion.

440

308

expires: datetime.datetime(); time (UTC) when a client will be

441

309

disabled, or None

442

310

"""

443

311

444

312

runtime_expansions = ("approval_delay", "approval_duration",

445

"created", "enabled", "expires",

446

"fingerprint", "host", "interval",

447

"last_approval_request", "last_checked_ok",

313

"created", "enabled", "fingerprint",

314

"host", "interval", "last_checked_ok",

448

315

"last_enabled", "name", "timeout")

449

client_defaults = { "timeout": "5m",

450

"extended_timeout": "15m",

451

"interval": "2m",

452

"checker": "fping -q -- %%(host)s",

453

"host": "",

454

"approval_delay": "0s",

455

"approval_duration": "1s",

456

"approved_by_default": "True",

457

"enabled": "True",

458

}

459

316

460

317

def timeout_milliseconds(self):

461

318

"Return the 'timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.timeout)

463

319

return _timedelta_to_milliseconds(self.timeout)

320

464

321

def extended_timeout_milliseconds(self):

465

322

"Return the 'extended_timeout' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.extended_timeout)

323

return _timedelta_to_milliseconds(self.extended_timeout)

467

324

468

325

def interval_milliseconds(self):

469

326

"Return the 'interval' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.interval)

471

327

return _timedelta_to_milliseconds(self.interval)

328

472

329

def approval_delay_milliseconds(self):

473

return timedelta_to_milliseconds(self.approval_delay)

474

475

@staticmethod

476

def config_parser(config):

477

"""Construct a new dict of client settings of this form:

478

{ client_name: {setting_name: value, ...}, ...}

479

with exceptions for any special settings as defined above.

480

NOTE: Must be a pure function. Must return the same result

481

value given the same arguments.

482

"""

483

settings = {}

484

for client_name in config.sections():

485

section = dict(config.items(client_name))

486

client = settings[client_name] = {}

487

488

client["host"] = section["host"]

489

# Reformat values from string types to Python types

490

client["approved_by_default"] = config.getboolean(

491

client_name, "approved_by_default")

492

client["enabled"] = config.getboolean(client_name,

493

"enabled")

494

495

client["fingerprint"] = (section["fingerprint"].upper()

496

.replace(" ", ""))

497

if "secret" in section:

498

client["secret"] = section["secret"].decode("base64")

499

elif "secfile" in section:

500

with open(os.path.expanduser(os.path.expandvars

501

(section["secfile"])),

502

"rb") as secfile:

503

client["secret"] = secfile.read()

504

else:

505

raise TypeError("No secret or secfile for section {0}"

506

.format(section))

507

client["timeout"] = string_to_delta(section["timeout"])

508

client["extended_timeout"] = string_to_delta(

509

section["extended_timeout"])

510

client["interval"] = string_to_delta(section["interval"])

511

client["approval_delay"] = string_to_delta(

512

section["approval_delay"])

513

client["approval_duration"] = string_to_delta(

514

section["approval_duration"])

515

client["checker_command"] = section["checker"]

516

client["last_approval_request"] = None

517

client["last_checked_ok"] = None

518

client["last_checker_status"] = -2

519

520

return settings

521

522

def __init__(self, settings, name = None):

330

return _timedelta_to_milliseconds(self.approval_delay)

331

332

def __init__(self, name = None, disable_hook=None, config=None):

333

"""Note: the 'checker' key in 'config' sets the

334

'checker_command' attribute and *not* the 'checker'

335

attribute."""

523

336

self.name = name

524

# adding all client settings

525

for setting, value in settings.iteritems():

526

setattr(self, setting, value)

527

528

if self.enabled:

529

if not hasattr(self, "last_enabled"):

530

self.last_enabled = datetime.datetime.utcnow()

531

if not hasattr(self, "expires"):

532

self.expires = (datetime.datetime.utcnow()

533

+ self.timeout)

534

else:

535

self.last_enabled = None

536

self.expires = None

537

337

if config is None:

338

config = {}

538

339

logger.debug("Creating client %r", self.name)

539

340

# Uppercase and remove spaces from fingerprint for later

540

341

# comparison purposes with return value from the fingerprint()

541

342

# function

343

self.fingerprint = (config["fingerprint"].upper()

344

.replace(" ", ""))

542

345

logger.debug(" Fingerprint: %s", self.fingerprint)

543

self.created = settings.get("created",

544

datetime.datetime.utcnow())

545

546

# attributes specific for this server instance

346

if "secret" in config:

347

self.secret = config["secret"].decode("base64")

348

elif "secfile" in config:

349

with open(os.path.expanduser(os.path.expandvars

350

(config["secfile"])),

351

"rb") as secfile:

352

self.secret = secfile.read()

353

else:

354

raise TypeError("No secret or secfile for client %s"

355

% self.name)

356

self.host = config.get("host", "")

357

self.created = datetime.datetime.utcnow()

358

self.enabled = False

359

self.last_approval_request = None

360

self.last_enabled = None

361

self.last_checked_ok = None

362

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

364

self.interval = string_to_delta(config["interval"])

365

self.disable_hook = disable_hook

547

366

self.checker = None

548

367

self.checker_initiator_tag = None

549

368

self.disable_initiator_tag = None

369

self.expires = None

550

370

self.checker_callback_tag = None

371

self.checker_command = config["checker"]

551

372

self.current_checker_command = None

552

self.approved = None

373

self.last_connect = None

374

self._approved = None

375

self.approved_by_default = config.get("approved_by_default",

376

True)

553

377

self.approvals_pending = 0

554

self.changedstate = (multiprocessing_manager

555

.Condition(multiprocessing_manager

556

.Lock()))

557

self.client_structure = [attr for attr in

558

self.__dict__.iterkeys()

559

if not attr.startswith("_")]

560

self.client_structure.append("client_structure")

561

562

for name, t in inspect.getmembers(type(self),

563

lambda obj:

564

isinstance(obj,

565

property)):

566

if not name.startswith("_"):

567

self.client_structure.append(name)

378

self.approval_delay = string_to_delta(

379

config["approval_delay"])

380

self.approval_duration = string_to_delta(

381

config["approval_duration"])

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

568

383

569

# Send notice to process children that client state has changed

570

384

def send_changedstate(self):

571

with self.changedstate:

572

self.changedstate.notify_all()

573

385

self.changedstate.acquire()

386

self.changedstate.notify_all()

387

self.changedstate.release()

388

574

389

def enable(self):

575

390

"""Start this client's checker and timeout hooks"""

576

391

if getattr(self, "enabled", False):

577

392

# Already enabled

578

393

return

394

self.send_changedstate()

395

# Schedule a new checker to be started an 'interval' from now,

396

# and every interval from then on.

397

self.checker_initiator_tag = (gobject.timeout_add

398

(self.interval_milliseconds(),

399

self.start_checker))

400

# Schedule a disable() when 'timeout' has passed

579

401

self.expires = datetime.datetime.utcnow() + self.timeout

402

self.disable_initiator_tag = (gobject.timeout_add

403

(self.timeout_milliseconds(),

404

self.disable))

580

405

self.enabled = True

581

406

self.last_enabled = datetime.datetime.utcnow()

582

self.init_checker()

583

self.send_changedstate()

407

# Also start a new checker *right now*.

408

self.start_checker()

584

409

585

410

def disable(self, quiet=True):

586

411

"""Disable this client."""

587

412

if not getattr(self, "enabled", False):

588

413

return False

589

414

if not quiet:

415

self.send_changedstate()

416

if not quiet:

590

417

logger.info("Disabling client %s", self.name)

591

if getattr(self, "disable_initiator_tag", None) is not None:

418

if getattr(self, "disable_initiator_tag", False):

592

419

gobject.source_remove(self.disable_initiator_tag)

593

420

self.disable_initiator_tag = None

594

421

self.expires = None

595

if getattr(self, "checker_initiator_tag", None) is not None:

422

if getattr(self, "checker_initiator_tag", False):

596

423

gobject.source_remove(self.checker_initiator_tag)

597

424

self.checker_initiator_tag = None

598

425

self.stop_checker()

426

if self.disable_hook:

427

self.disable_hook(self)

599

428

self.enabled = False

600

if not quiet:

601

self.send_changedstate()

602

429

# Do not run this again if called by a gobject.timeout_add

603

430

return False

604

431

605

432

def __del__(self):

433

self.disable_hook = None

606

434

self.disable()

607

435

608

def init_checker(self):

609

# Schedule a new checker to be started an 'interval' from now,

610

# and every interval from then on.

611

if self.checker_initiator_tag is not None:

612

gobject.source_remove(self.checker_initiator_tag)

613

self.checker_initiator_tag = (gobject.timeout_add

614

(self.interval_milliseconds(),

615

self.start_checker))

616

# Schedule a disable() when 'timeout' has passed

617

if self.disable_initiator_tag is not None:

618

gobject.source_remove(self.disable_initiator_tag)

619

self.disable_initiator_tag = (gobject.timeout_add

620

(self.timeout_milliseconds(),

621

self.disable))

622

# Also start a new checker *right now*.

623

self.start_checker()

624

625

436

def checker_callback(self, pid, condition, command):

626

437

"""The checker has completed, so take appropriate actions."""

627

438

self.checker_callback_tag = None

628

439

self.checker = None

629

440

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

631

if self.last_checker_status == 0:

441

exitstatus = os.WEXITSTATUS(condition)

442

if exitstatus == 0:

632

443

logger.info("Checker for %(name)s succeeded",

633

444

vars(self))

634

445

self.checked_ok()

636

447

logger.info("Checker for %(name)s failed",

637

448

vars(self))

638

449

else:

639

self.last_checker_status = -1

640

450

logger.warning("Checker for %(name)s crashed?",

641

451

vars(self))

642

452

643

def checked_ok(self):

644

"""Assert that the client has been seen, alive and well."""

645

self.last_checked_ok = datetime.datetime.utcnow()

646

self.last_checker_status = 0

647

self.bump_timeout()

648

649

def bump_timeout(self, timeout=None):

650

"""Bump up the timeout for this client."""

453

def checked_ok(self, timeout=None):

454

"""Bump up the timeout for this client.

455

456

This should only be called when the client has been seen,

457

alive and well.

458

"""

651

459

if timeout is None:

652

460

timeout = self.timeout

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = None

656

if getattr(self, "enabled", False):

657

self.disable_initiator_tag = (gobject.timeout_add

658

(timedelta_to_milliseconds

659

(timeout), self.disable))

660

self.expires = datetime.datetime.utcnow() + timeout

461

self.last_checked_ok = datetime.datetime.utcnow()

462

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

464

self.disable_initiator_tag = (gobject.timeout_add

465

(_timedelta_to_milliseconds(timeout),

466

self.disable))

661

467

662

468

def need_approval(self):

663

469

self.last_approval_request = datetime.datetime.utcnow()

668

474

If a checker already exists, leave it running and do

669

475

nothing."""

670

476

# The reason for not killing a running checker is that if we

671

# did that, and if a checker (for some reason) started running

672

# slowly and taking more than 'interval' time, then the client

673

# would inevitably timeout, since no checker would get a

674

# chance to run to completion. If we instead leave running

477

# did that, then if a checker (for some reason) started

478

# running slowly and taking more than 'interval' time, the

479

# client would inevitably timeout, since no checker would get

480

# a chance to run to completion. If we instead leave running

675

481

# checkers alone, the checker would have to take more time

676

482

# than 'timeout' for the client to be disabled, which is as it

677

483

# should be.

691

497

self.current_checker_command)

692

498

# Start a new checker if needed

693

499

if self.checker is None:

694

# Escape attributes for the shell

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

699

500

try:

700

command = self.checker_command % escaped_attrs

701

except TypeError as error:

702

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

501

# In case checker_command has exactly one % operator

502

command = self.checker_command % self.host

503

except TypeError:

504

# Escape attributes for the shell

505

escaped_attrs = dict(

506

(attr,

507

re.escape(unicode(str(getattr(self, attr, "")),

508

errors=

509

'replace')))

510

for attr in

511

self.runtime_expansions)

512

513

try:

514

command = self.checker_command % escaped_attrs

515

except TypeError as error:

516

logger.error('Could not format string "%s":'

517

' %s', self.checker_command, error)

518

return True # Try again later

705

519

self.current_checker_command = command

706

520

try:

707

521

logger.info("Starting checker %r for %s",

713

527

self.checker = subprocess.Popen(command,

714

528

close_fds=True,

715

529

shell=True, cwd="/")

530

self.checker_callback_tag = (gobject.child_watch_add

531

(self.checker.pid,

532

self.checker_callback,

533

data=command))

534

# The checker may have completed before the gobject

535

# watch was added. Check for this.

536

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

537

if pid:

538

gobject.source_remove(self.checker_callback_tag)

539

self.checker_callback(pid, status, command)

716

540

except OSError as error:

717

logger.error("Failed to start subprocess",

718

exc_info=error)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

541

logger.error("Failed to start subprocess: %s",

542

error)

729

543

# Re-run this periodically if run by gobject.timeout_add

730

544

return True

731

545

738

552

return

739

553

logger.debug("Stopping checker for %(name)s", vars(self))

740

554

try:

741

self.checker.terminate()

555

os.kill(self.checker.pid, signal.SIGTERM)

742

556

#time.sleep(0.5)

743

557

#if self.checker.poll() is None:

744

# self.checker.kill()

558

# os.kill(self.checker.pid, signal.SIGKILL)

745

559

except OSError as error:

746

560

if error.errno != errno.ESRCH: # No such process

747

561

raise

748

562

self.checker = None

749

563

750

751

564

def dbus_service_property(dbus_interface, signature="v",

752

565

access="readwrite", byte_arrays=False):

753

566

"""Decorators for marking methods of a DBusObjectWithProperties to

764

577

# "Set" method, so we fail early here:

765

578

if byte_arrays and signature != "ay":

766

579

raise ValueError("Byte arrays not supported for non-'ay'"

767

" signature {0!r}".format(signature))

580

" signature %r" % signature)

768

581

def decorator(func):

769

582

func._dbus_is_property = True

770

583

func._dbus_interface = dbus_interface

778

591

return decorator

779

592

780

593

781

def dbus_interface_annotations(dbus_interface):

782

"""Decorator for marking functions returning interface annotations

783

784

Usage:

785

786

@dbus_interface_annotations("org.example.Interface")

787

def _foo(self): # Function name does not matter

788

return {"org.freedesktop.DBus.Deprecated": "true",

789

"org.freedesktop.DBus.Property.EmitsChangedSignal":

790

"false"}

791

"""

792

def decorator(func):

793

func._dbus_is_interface = True

794

func._dbus_interface = dbus_interface

795

func._dbus_name = dbus_interface

796

return func

797

return decorator

798

799

800

def dbus_annotations(annotations):

801

"""Decorator to annotate D-Bus methods, signals or properties

802

Usage:

803

804

@dbus_service_property("org.example.Interface", signature="b",

805

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

809

def Property_dbus_property(self):

810

return dbus.Boolean(False)

811

"""

812

def decorator(func):

813

func._dbus_annotations = annotations

814

return func

815

return decorator

816

817

818

594

class DBusPropertyException(dbus.exceptions.DBusException):

819

595

"""A base class for D-Bus property-related exceptions

820

596

"""

836

612

837

613

class DBusObjectWithProperties(dbus.service.Object):

838

614

"""A D-Bus object with properties.

839

615

840

616

Classes inheriting from this can use the dbus_service_property

841

617

decorator to expose methods as D-Bus properties. It exposes the

842

618

standard Get(), Set(), and GetAll() methods on the D-Bus.

843

619

"""

844

620

845

621

@staticmethod

846

def _is_dbus_thing(thing):

847

"""Returns a function testing if an attribute is a D-Bus thing

848

849

If called like _is_dbus_thing("method") it returns a function

850

suitable for use as predicate to inspect.getmembers().

851

"""

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

853

False)

622

def _is_dbus_property(obj):

623

return getattr(obj, "_dbus_is_property", False)

854

624

855

def _get_all_dbus_things(self, thing):

625

def _get_all_dbus_properties(self):

856

626

"""Returns a generator of (name, attribute) pairs

857

627

"""

858

return ((getattr(athing.__get__(self), "_dbus_name",

859

name),

860

athing.__get__(self))

861

for cls in self.__class__.__mro__

862

for name, athing in

863

inspect.getmembers(cls,

864

self._is_dbus_thing(thing)))

628

return ((prop._dbus_name, prop)

629

for name, prop in

630

inspect.getmembers(self, self._is_dbus_property))

865

631

866

632

def _get_dbus_property(self, interface_name, property_name):

867

633

"""Returns a bound method if one exists which is a D-Bus

868

634

property with the specified name and interface.

869

635

"""

870

for cls in self.__class__.__mro__:

871

for name, value in (inspect.getmembers

872

(cls,

873

self._is_dbus_thing("property"))):

874

if (value._dbus_name == property_name

875

and value._dbus_interface == interface_name):

876

return value.__get__(self)

877

636

for name in (property_name,

637

property_name + "_dbus_property"):

638

prop = getattr(self, name, None)

639

if (prop is None

640

or not self._is_dbus_property(prop)

641

or prop._dbus_name != property_name

642

or (interface_name and prop._dbus_interface

643

and interface_name != prop._dbus_interface)):

644

continue

645

return prop

878

646

# No such property

879

647

raise DBusPropertyNotFound(self.dbus_object_path + ":"

880

648

+ interface_name + "."

905

673

# signatures other than "ay".

906

674

if prop._dbus_signature != "ay":

907

675

raise ValueError

908

value = dbus.ByteArray(b''.join(chr(byte)

909

for byte in value))

676

value = dbus.ByteArray(''.join(unichr(byte)

677

for byte in value))

910

678

prop(value)

911

679

912

680

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

914

682

def GetAll(self, interface_name):

915

683

"""Standard D-Bus property GetAll() method, see D-Bus

916

684

standard.

917

685

918

686

Note: Will not include properties with access="write".

919

687

"""

920

properties = {}

921

for name, prop in self._get_all_dbus_things("property"):

688

all = {}

689

for name, prop in self._get_all_dbus_properties():

922

690

if (interface_name

923

691

and interface_name != prop._dbus_interface):

924

692

# Interface non-empty but did not match

928

696

continue

929

697

value = prop()

930

698

if not hasattr(value, "variant_level"):

931

properties[name] = value

699

all[name] = value

932

700

continue

933

properties[name] = type(value)(value, variant_level=

934

value.variant_level+1)

935

return dbus.Dictionary(properties, signature="sv")

701

all[name] = type(value)(value, variant_level=

702

value.variant_level+1)

703

return dbus.Dictionary(all, signature="sv")

936

704

937

705

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

938

706

out_signature="s",

939

707

path_keyword='object_path',

940

708

connection_keyword='connection')

941

709

def Introspect(self, object_path, connection):

942

"""Overloading of standard D-Bus method.

943

944

Inserts property tags and interface annotation tags.

710

"""Standard D-Bus method, overloaded to insert property tags.

945

711

"""

946

712

xmlstring = dbus.service.Object.Introspect(self, object_path,

947

713

connection)

954

720

e.setAttribute("access", prop._dbus_access)

955

721

return e

956

722

for if_tag in document.getElementsByTagName("interface"):

957

# Add property tags

958

723

for tag in (make_tag(document, name, prop)

959

724

for name, prop

960

in self._get_all_dbus_things("property")

725

in self._get_all_dbus_properties()

961

726

if prop._dbus_interface

962

727

== if_tag.getAttribute("name")):

963

728

if_tag.appendChild(tag)

964

# Add annotation tags

965

for typ in ("method", "signal", "property"):

966

for tag in if_tag.getElementsByTagName(typ):

967

annots = dict()

968

for name, prop in (self.

969

_get_all_dbus_things(typ)):

970

if (name == tag.getAttribute("name")

971

and prop._dbus_interface

972

== if_tag.getAttribute("name")):

973

annots.update(getattr

974

(prop,

975

"_dbus_annotations",

976

{}))

977

for name, value in annots.iteritems():

978

ann_tag = document.createElement(

979

"annotation")

980

ann_tag.setAttribute("name", name)

981

ann_tag.setAttribute("value", value)

982

tag.appendChild(ann_tag)

983

# Add interface annotation tags

984

for annotation, value in dict(

985

itertools.chain.from_iterable(

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

989

if name == if_tag.getAttribute("name")

990

)).iteritems():

991

ann_tag = document.createElement("annotation")

992

ann_tag.setAttribute("name", annotation)

993

ann_tag.setAttribute("value", value)

994

if_tag.appendChild(ann_tag)

995

729

# Add the names to the return values for the

996

730

# "org.freedesktop.DBus.Properties" methods

997

731

if (if_tag.getAttribute("name")

1012

746

except (AttributeError, xml.dom.DOMException,

1013

747

xml.parsers.expat.ExpatError) as error:

1014

748

logger.error("Failed to override Introspection method",

1015

exc_info=error)

749

error)

1016

750

return xmlstring

1017

751

1018

752

1023

757

return dbus.String(dt.isoformat(),

1024

758

variant_level=variant_level)

1025

759

1026

1027

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1028

"""A class decorator; applied to a subclass of

1029

dbus.service.Object, it will add alternate D-Bus attributes with

1030

interface names according to the "alt_interface_names" mapping.

1031

Usage:

1032

1033

@alternate_dbus_names({"org.example.Interface":

1034

"net.example.AlternateInterface"})

1035

class SampleDBusObject(dbus.service.Object):

1036

@dbus.service.method("org.example.Interface")

1037

def SampleDBusMethod():

1038

pass

1039

1040

The above "SampleDBusMethod" on "SampleDBusObject" will be

1041

reachable via two interfaces: "org.example.Interface" and

1042

"net.example.AlternateInterface", the latter of which will have

1043

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1044

"true", unless "deprecate" is passed with a False value.

1045

1046

This works for methods and signals, and also for D-Bus properties

1047

(from DBusObjectWithProperties) and interfaces (from the

1048

dbus_interface_annotations decorator).

1049

"""

1050

def wrapper(cls):

1051

for orig_interface_name, alt_interface_name in (

1052

alt_interface_names.iteritems()):

1053

attr = {}

1054

interface_names = set()

1055

# Go though all attributes of the class

1056

for attrname, attribute in inspect.getmembers(cls):

1057

# Ignore non-D-Bus attributes, and D-Bus attributes

1058

# with the wrong interface name

1059

if (not hasattr(attribute, "_dbus_interface")

1060

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

1062

continue

1063

# Create an alternate D-Bus interface name based on

1064

# the current name

1065

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1068

interface_names.add(alt_interface)

1069

# Is this a D-Bus signal?

1070

if getattr(attribute, "_dbus_is_signal", False):

1071

# Extract the original non-method function by

1072

# black magic

1073

nonmethod_func = (dict(

1074

zip(attribute.func_code.co_freevars,

1075

attribute.__closure__))["func"]

1076

.cell_contents)

1077

# Create a new, but exactly alike, function

1078

# object, and decorate it to be a new D-Bus signal

1079

# with the alternate D-Bus interface name

1080

new_function = (dbus.service.signal

1081

(alt_interface,

1082

attribute._dbus_signature)

1083

(types.FunctionType(

1084

nonmethod_func.func_code,

1085

nonmethod_func.func_globals,

1086

nonmethod_func.func_name,

1087

nonmethod_func.func_defaults,

1088

nonmethod_func.func_closure)))

1089

# Copy annotations, if any

1090

try:

1091

new_function._dbus_annotations = (

1092

dict(attribute._dbus_annotations))

1093

except AttributeError:

1094

pass

1095

# Define a creator of a function to call both the

1096

# original and alternate functions, so both the

1097

# original and alternate signals gets sent when

1098

# the function is called

1099

def fixscope(func1, func2):

1100

"""This function is a scope container to pass

1101

func1 and func2 to the "call_both" function

1102

outside of its arguments"""

1103

def call_both(*args, **kwargs):

1104

"""This function will emit two D-Bus

1105

signals by calling func1 and func2"""

1106

func1(*args, **kwargs)

1107

func2(*args, **kwargs)

1108

return call_both

1109

# Create the "call_both" function and add it to

1110

# the class

1111

attr[attrname] = fixscope(attribute, new_function)

1112

# Is this a D-Bus method?

1113

elif getattr(attribute, "_dbus_is_method", False):

1114

# Create a new, but exactly alike, function

1115

# object. Decorate it to be a new D-Bus method

1116

# with the alternate D-Bus interface name. Add it

1117

# to the class.

1118

attr[attrname] = (dbus.service.method

1119

(alt_interface,

1120

attribute._dbus_in_signature,

1121

attribute._dbus_out_signature)

1122

(types.FunctionType

1123

(attribute.func_code,

1124

attribute.func_globals,

1125

attribute.func_name,

1126

attribute.func_defaults,

1127

attribute.func_closure)))

1128

# Copy annotations, if any

1129

try:

1130

attr[attrname]._dbus_annotations = (

1131

dict(attribute._dbus_annotations))

1132

except AttributeError:

1133

pass

1134

# Is this a D-Bus property?

1135

elif getattr(attribute, "_dbus_is_property", False):

1136

# Create a new, but exactly alike, function

1137

# object, and decorate it to be a new D-Bus

1138

# property with the alternate D-Bus interface

1139

# name. Add it to the class.

1140

attr[attrname] = (dbus_service_property

1141

(alt_interface,

1142

attribute._dbus_signature,

1143

attribute._dbus_access,

1144

attribute

1145

._dbus_get_args_options

1146

["byte_arrays"])

1147

(types.FunctionType

1148

(attribute.func_code,

1149

attribute.func_globals,

1150

attribute.func_name,

1151

attribute.func_defaults,

1152

attribute.func_closure)))

1153

# Copy annotations, if any

1154

try:

1155

attr[attrname]._dbus_annotations = (

1156

dict(attribute._dbus_annotations))

1157

except AttributeError:

1158

pass

1159

# Is this a D-Bus interface?

1160

elif getattr(attribute, "_dbus_is_interface", False):

1161

# Create a new, but exactly alike, function

1162

# object. Decorate it to be a new D-Bus interface

1163

# with the alternate D-Bus interface name. Add it

1164

# to the class.

1165

attr[attrname] = (dbus_interface_annotations

1166

(alt_interface)

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1173

if deprecate:

1174

# Deprecate all alternate interfaces

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1176

for interface_name in interface_names:

1177

@dbus_interface_annotations(interface_name)

1178

def func(self):

1179

return { "org.freedesktop.DBus.Deprecated":

1180

"true" }

1181

# Find an unused name

1182

for aname in (iname.format(i)

1183

for i in itertools.count()):

1184

if aname not in attr:

1185

attr[aname] = func

1186

break

1187

if interface_names:

1188

# Replace the class with a new subclass of it with

1189

# methods, signals, etc. as created above.

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1192

return cls

1193

return wrapper

1194

1195

1196

@alternate_dbus_interfaces({"se.recompile.Mandos":

1197

"se.bsnet.fukt.Mandos"})

1198

760

class ClientDBus(Client, DBusObjectWithProperties):

1199

761

"""A Client class using D-Bus

1200

762

1209

771

# dbus.service.Object doesn't use super(), so we can't either.

1210

772

1211

773

def __init__(self, bus = None, *args, **kwargs):

774

self._approvals_pending = 0

1212

775

self.bus = bus

1213

776

Client.__init__(self, *args, **kwargs)

1214

777

# Only now, when this client is initialized, can it show up on

1220

783

("/clients/" + client_object_name))

1221

784

DBusObjectWithProperties.__init__(self, self.bus,

1222

785

self.dbus_object_path)

1223

786

1224

787

def notifychangeproperty(transform_func,

1225

788

dbus_name, type_func=lambda x: x,

1226

789

variant_level=1):

1227

""" Modify a variable so that it's a property which announces

1228

its changes to DBus.

1229

1230

transform_fun: Function that takes a value and a variant_level

1231

and transforms it to a D-Bus type.

1232

dbus_name: D-Bus name of the variable

790

""" Modify a variable so that its a property that announce its

791

changes to DBus.

792

transform_fun: Function that takes a value and transform it to

793

DBus type.

794

dbus_name: DBus name of the variable

1233

795

type_func: Function that transform the value before sending it

1234

to the D-Bus. Default: no transform

1235

variant_level: D-Bus variant level. Default: 1

796

to DBus

797

variant_level: DBus variant level. default: 1

1236

798

"""

1237

attrname = "_{0}".format(dbus_name)

799

real_value = [None,]

1238

800

def setter(self, value):

801

old_value = real_value[0]

802

real_value[0] = value

1239

803

if hasattr(self, "dbus_object_path"):

1240

if (not hasattr(self, attrname) or

1241

type_func(getattr(self, attrname, None))

1242

!= type_func(value)):

1243

dbus_value = transform_func(type_func(value),

1244

variant_level

1245

=variant_level)

804

if type_func(old_value) != type_func(real_value[0]):

805

dbus_value = transform_func(type_func(real_value[0]),

806

variant_level)

1246

807

self.PropertyChanged(dbus.String(dbus_name),

1247

808

dbus_value)

1248

setattr(self, attrname, value)

1249

1250

return property(lambda self: getattr(self, attrname), setter)

1251

809

810

return property(lambda self: real_value[0], setter)

811

812

1252

813

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1253

814

approvals_pending = notifychangeproperty(dbus.Boolean,

1254

815

"ApprovalPending",

1257

818

last_enabled = notifychangeproperty(datetime_to_dbus,

1258

819

"LastEnabled")

1259

820

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1260

type_func = lambda checker:

1261

checker is not None)

821

type_func = lambda checker: checker is not None)

1262

822

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1263

823

"LastCheckedOK")

1264

last_checker_status = notifychangeproperty(dbus.Int16,

1265

"LastCheckerStatus")

1266

last_approval_request = notifychangeproperty(

1267

datetime_to_dbus, "LastApprovalRequest")

824

last_approval_request = notifychangeproperty(datetime_to_dbus,

825

"LastApprovalRequest")

1268

826

approved_by_default = notifychangeproperty(dbus.Boolean,

1269

827

"ApprovedByDefault")

1270

approval_delay = notifychangeproperty(dbus.UInt64,

1271

"ApprovalDelay",

1272

type_func =

1273

timedelta_to_milliseconds)

1274

approval_duration = notifychangeproperty(

1275

dbus.UInt64, "ApprovalDuration",

1276

type_func = timedelta_to_milliseconds)

828

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

829

type_func = _timedelta_to_milliseconds)

830

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

831

type_func = _timedelta_to_milliseconds)

1277

832

host = notifychangeproperty(dbus.String, "Host")

1278

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1279

type_func =

1280

timedelta_to_milliseconds)

1281

extended_timeout = notifychangeproperty(

1282

dbus.UInt64, "ExtendedTimeout",

1283

type_func = timedelta_to_milliseconds)

1284

interval = notifychangeproperty(dbus.UInt64,

1285

"Interval",

1286

type_func =

1287

timedelta_to_milliseconds)

833

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

834

type_func = _timedelta_to_milliseconds)

835

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

836

type_func = _timedelta_to_milliseconds)

837

interval = notifychangeproperty(dbus.UInt16, "Interval",

838

type_func = _timedelta_to_milliseconds)

1288

839

checker_command = notifychangeproperty(dbus.String, "Checker")

1289

840

1290

841

del notifychangeproperty

1316

867

1317

868

return Client.checker_callback(self, pid, condition, command,

1318

869

*args, **kwargs)

1319

870

1320

871

def start_checker(self, *args, **kwargs):

1321

872

old_checker = self.checker

1322

873

if self.checker is not None:

1332

883

return r

1333

884

1334

885

def _reset_approved(self):

1335

self.approved = None

886

self._approved = None

1336

887

return False

1337

888

1338

889

def approve(self, value=True):

1339

self.approved = value

1340

gobject.timeout_add(timedelta_to_milliseconds

890

self.send_changedstate()

891

self._approved = value

892

gobject.timeout_add(_timedelta_to_milliseconds

1341

893

(self.approval_duration),

1342

894

self._reset_approved)

1343

self.send_changedstate()

895

1344

896

1345

897

## D-Bus methods, signals & properties

1346

_interface = "se.recompile.Mandos.Client"

1347

1348

## Interfaces

1349

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

898

_interface = "se.bsnet.fukt.Mandos.Client"

1354

899

1355

900

## Signals

1356

901

1456

1001

access="readwrite")

1457

1002

def ApprovalDuration_dbus_property(self, value=None):

1458

1003

if value is None: # get

1459

return dbus.UInt64(timedelta_to_milliseconds(

1004

return dbus.UInt64(_timedelta_to_milliseconds(

1460

1005

self.approval_duration))

1461

1006

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1462

1007

1476

1021

def Host_dbus_property(self, value=None):

1477

1022

if value is None: # get

1478

1023

return dbus.String(self.host)

1479

self.host = unicode(value)

1024

self.host = value

1480

1025

1481

1026

# Created - property

1482

1027

@dbus_service_property(_interface, signature="s", access="read")

1483

1028

def Created_dbus_property(self):

1484

return datetime_to_dbus(self.created)

1029

return dbus.String(datetime_to_dbus(self.created))

1485

1030

1486

1031

# LastEnabled - property

1487

1032

@dbus_service_property(_interface, signature="s", access="read")

1508

1053

return

1509

1054

return datetime_to_dbus(self.last_checked_ok)

1510

1055

1511

# LastCheckerStatus - property

1512

@dbus_service_property(_interface, signature="n",

1513

access="read")

1514

def LastCheckerStatus_dbus_property(self):

1515

return dbus.Int16(self.last_checker_status)

1516

1517

1056

# Expires - property

1518

1057

@dbus_service_property(_interface, signature="s", access="read")

1519

1058

def Expires_dbus_property(self):

1530

1069

def Timeout_dbus_property(self, value=None):

1531

1070

if value is None: # get

1532

1071

return dbus.UInt64(self.timeout_milliseconds())

1533

old_timeout = self.timeout

1534

1072

self.timeout = datetime.timedelta(0, 0, 0, value)

1535

# Reschedule disabling

1536

if self.enabled:

1537

now = datetime.datetime.utcnow()

1538

self.expires += self.timeout - old_timeout

1539

if self.expires <= now:

1540

# The timeout has passed

1541

self.disable()

1542

else:

1543

if (getattr(self, "disable_initiator_tag", None)

1544

is None):

1545

return

1546

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1551

1073

if getattr(self, "disable_initiator_tag", None) is None:

1074

return

1075

# Reschedule timeout

1076

gobject.source_remove(self.disable_initiator_tag)

1077

self.disable_initiator_tag = None

1078

self.expires = None

1079

time_to_die = (self.

1080

_timedelta_to_milliseconds((self

1081

.last_checked_ok

1082

+ self.timeout)

1083

- datetime.datetime

1084

.utcnow()))

1085

if time_to_die <= 0:

1086

# The timeout has passed

1087

self.disable()

1088

else:

1089

self.expires = (datetime.datetime.utcnow()

1090

+ datetime.timedelta(milliseconds = time_to_die))

1091

self.disable_initiator_tag = (gobject.timeout_add

1092

(time_to_die, self.disable))

1093

1552

1094

# ExtendedTimeout - property

1553

1095

@dbus_service_property(_interface, signature="t",

1554

1096

access="readwrite")

1556

1098

if value is None: # get

1557

1099

return dbus.UInt64(self.extended_timeout_milliseconds())

1558

1100

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1559

1101

1560

1102

# Interval - property

1561

1103

@dbus_service_property(_interface, signature="t",

1562

1104

access="readwrite")

1566

1108

self.interval = datetime.timedelta(0, 0, 0, value)

1567

1109

if getattr(self, "checker_initiator_tag", None) is None:

1568

1110

return

1569

if self.enabled:

1570

# Reschedule checker run

1571

gobject.source_remove(self.checker_initiator_tag)

1572

self.checker_initiator_tag = (gobject.timeout_add

1573

(value, self.start_checker))

1574

self.start_checker() # Start one now, too

1575

1111

# Reschedule checker run

1112

gobject.source_remove(self.checker_initiator_tag)

1113

self.checker_initiator_tag = (gobject.timeout_add

1114

(value, self.start_checker))

1115

self.start_checker() # Start one now, too

1116

1576

1117

# Checker - property

1577

1118

@dbus_service_property(_interface, signature="s",

1578

1119

access="readwrite")

1579

1120

def Checker_dbus_property(self, value=None):

1580

1121

if value is None: # get

1581

1122

return dbus.String(self.checker_command)

1582

self.checker_command = unicode(value)

1123

self.checker_command = value

1583

1124

1584

1125

# CheckerRunning - property

1585

1126

@dbus_service_property(_interface, signature="b",

1612

1153

self._pipe.send(('init', fpr, address))

1613

1154

if not self._pipe.recv():

1614

1155

raise KeyError()

1615

1156

1616

1157

def __getattribute__(self, name):

1617

if name == '_pipe':

1158

if(name == '_pipe'):

1618

1159

return super(ProxyClient, self).__getattribute__(name)

1619

1160

self._pipe.send(('getattr', name))

1620

1161

data = self._pipe.recv()

1625

1166

self._pipe.send(('funcall', name, args, kwargs))

1626

1167

return self._pipe.recv()[1]

1627

1168

return func

1628

1169

1629

1170

def __setattr__(self, name, value):

1630

if name == '_pipe':

1171

if(name == '_pipe'):

1631

1172

return super(ProxyClient, self).__setattr__(name, value)

1632

1173

self._pipe.send(('setattr', name, value))

1633

1174

1644

1185

unicode(self.client_address))

1645

1186

logger.debug("Pipe FD: %d",

1646

1187

self.server.child_pipe.fileno())

1647

1188

1648

1189

session = (gnutls.connection

1649

1190

.ClientSession(self.request,

1650

1191

gnutls.connection

1651

1192

.X509Credentials()))

1652

1193

1653

1194

# Note: gnutls.connection.X509Credentials is really a

1654

1195

# generic GnuTLS certificate credentials object so long as

1655

1196

# no X.509 keys are added to it. Therefore, we can use it

1656

1197

# here despite using OpenPGP certificates.

1657

1198

1658

1199

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1659

1200

# "+AES-256-CBC", "+SHA1",

1660

1201

# "+COMP-NULL", "+CTYPE-OPENPGP",

1666

1207

(gnutls.library.functions

1667

1208

.gnutls_priority_set_direct(session._c_object,

1668

1209

priority, None))

1669

1210

1670

1211

# Start communication using the Mandos protocol

1671

1212

# Get protocol number

1672

1213

line = self.request.makefile().readline()

1677

1218

except (ValueError, IndexError, RuntimeError) as error:

1678

1219

logger.error("Unknown protocol version: %s", error)

1679

1220

return

1680

1221

1681

1222

# Start GnuTLS connection

1682

1223

try:

1683

1224

session.handshake()

1687

1228

# established. Just abandon the request.

1688

1229

return

1689

1230

logger.debug("Handshake succeeded")

1690

1231

1691

1232

approval_required = False

1692

1233

try:

1693

1234

try:

1698

1239

logger.warning("Bad certificate: %s", error)

1699

1240

return

1700

1241

logger.debug("Fingerprint: %s", fpr)

1701

1242

1702

1243

try:

1703

1244

client = ProxyClient(child_pipe, fpr,

1704

1245

self.client_address)

1716

1257

client.name)

1717

1258

if self.server.use_dbus:

1718

1259

# Emit D-Bus signal

1719

client.Rejected("Disabled")

1260

client.Rejected("Disabled")

1720

1261

return

1721

1262

1722

if client.approved or not client.approval_delay:

1263

if client._approved or not client.approval_delay:

1723

1264

#We are approved or approval is disabled

1724

1265

break

1725

elif client.approved is None:

1266

elif client._approved is None:

1726

1267

logger.info("Client %s needs approval",

1727

1268

client.name)

1728

1269

if self.server.use_dbus:

1739

1280

return

1740

1281

1741

1282

#wait until timeout or approved

1283

#x = float(client._timedelta_to_milliseconds(delay))

1742

1284

time = datetime.datetime.now()

1743

1285

client.changedstate.acquire()

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1286

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1747

1287

client.changedstate.release()

1748

1288

time2 = datetime.datetime.now()

1749

1289

if (time2 - time) >= delay:

1765

1305

try:

1766

1306

sent = session.send(client.secret[sent_size:])

1767

1307

except gnutls.errors.GNUTLSError as error:

1768

logger.warning("gnutls send failed",

1769

exc_info=error)

1308

logger.warning("gnutls send failed")

1770

1309

return

1771

1310

logger.debug("Sent: %d, remaining: %d",

1772

1311

sent, len(client.secret)

1773

1312

- (sent_size + sent))

1774

1313

sent_size += sent

1775

1314

1776

1315

logger.info("Sending secret to %s", client.name)

1777

# bump the timeout using extended_timeout

1778

client.bump_timeout(client.extended_timeout)

1316

# bump the timeout as if seen

1317

client.checked_ok(client.extended_timeout)

1779

1318

if self.server.use_dbus:

1780

1319

# Emit D-Bus signal

1781

1320

client.GotSecret()

1786

1325

try:

1787

1326

session.bye()

1788

1327

except gnutls.errors.GNUTLSError as error:

1789

logger.warning("GnuTLS bye failed",

1790

exc_info=error)

1328

logger.warning("GnuTLS bye failed")

1791

1329

1792

1330

@staticmethod

1793

1331

def peer_certificate(session):

1849

1387

# Convert the buffer to a Python bytestring

1850

1388

fpr = ctypes.string_at(buf, buf_len.value)

1851

1389

# Convert the bytestring to hexadecimal notation

1852

hex_fpr = binascii.hexlify(fpr).upper()

1390

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1853

1391

return hex_fpr

1854

1392

1855

1393

1858

1396

def sub_process_main(self, request, address):

1859

1397

try:

1860

1398

self.finish_request(request, address)

1861

except Exception:

1399

except:

1862

1400

self.handle_error(request, address)

1863

1401

self.close_request(request)

1864

1402

1865

1403

def process_request(self, request, address):

1866

1404

"""Start a new process to process the request."""

1867

proc = multiprocessing.Process(target = self.sub_process_main,

1868

args = (request, address))

1869

proc.start()

1870

return proc

1871

1405

multiprocessing.Process(target = self.sub_process_main,

1406

args = (request, address)).start()

1872

1407

1873

1408

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1874

1409

""" adds a pipe to the MixIn """

1878

1413

This function creates a new pipe in self.pipe

1879

1414

"""

1880

1415

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1881

1882

proc = MultiprocessingMixIn.process_request(self, request,

1883

client_address)

1416

1417

super(MultiprocessingMixInWithPipe,

1418

self).process_request(request, client_address)

1884

1419

self.child_pipe.close()

1885

self.add_pipe(parent_pipe, proc)

1886

1887

def add_pipe(self, parent_pipe, proc):

1420

self.add_pipe(parent_pipe)

1421

1422

def add_pipe(self, parent_pipe):

1888

1423

"""Dummy function; override as necessary"""

1889

1424

raise NotImplementedError

1890

1425

1891

1892

1426

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1893

1427

socketserver.TCPServer, object):

1894

1428

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1921

1455

str(self.interface

1922

1456

+ '\0'))

1923

1457

except socket.error as error:

1924

if error.errno == errno.EPERM:

1458

if error[0] == errno.EPERM:

1925

1459

logger.error("No permission to"

1926

1460

" bind to interface %s",

1927

1461

self.interface)

1928

elif error.errno == errno.ENOPROTOOPT:

1462

elif error[0] == errno.ENOPROTOOPT:

1929

1463

logger.error("SO_BINDTODEVICE not available;"

1930

1464

" cannot bind to interface %s",

1931

1465

self.interface)

1932

elif error.errno == errno.ENODEV:

1933

logger.error("Interface %s does not"

1934

" exist, cannot bind",

1935

self.interface)

1936

1466

else:

1937

1467

raise

1938

1468

# Only bind(2) the socket if we really need to.

1972

1502

self.enabled = False

1973

1503

self.clients = clients

1974

1504

if self.clients is None:

1975

self.clients = {}

1505

self.clients = set()

1976

1506

self.use_dbus = use_dbus

1977

1507

self.gnutls_priority = gnutls_priority

1978

1508

IPv6_TCPServer.__init__(self, server_address,

1982

1512

def server_activate(self):

1983

1513

if self.enabled:

1984

1514

return socketserver.TCPServer.server_activate(self)

1985

1986

1515

def enable(self):

1987

1516

self.enabled = True

1988

1989

def add_pipe(self, parent_pipe, proc):

1517

def add_pipe(self, parent_pipe):

1990

1518

# Call "handle_ipc" for both data and EOF events

1991

1519

gobject.io_add_watch(parent_pipe.fileno(),

1992

1520

gobject.IO_IN | gobject.IO_HUP,

1993

1521

functools.partial(self.handle_ipc,

1994

parent_pipe =

1995

parent_pipe,

1996

proc = proc))

1997

1522

parent_pipe = parent_pipe))

1523

1998

1524

def handle_ipc(self, source, condition, parent_pipe=None,

1999

proc = None, client_object=None):

2000

# error, or the other end of multiprocessing.Pipe has closed

2001

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2002

# Wait for other process to exit

2003

proc.join()

1525

client_object=None):

1526

condition_names = {

1527

gobject.IO_IN: "IN", # There is data to read.

1528

gobject.IO_OUT: "OUT", # Data can be written (without

1529

# blocking).

1530

gobject.IO_PRI: "PRI", # There is urgent data to read.

1531

gobject.IO_ERR: "ERR", # Error condition.

1532

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1533

# broken, usually for pipes and

1534

# sockets).

1535

}

1536

conditions_string = ' | '.join(name

1537

for cond, name in

1538

condition_names.iteritems()

1539

if cond & condition)

1540

# error or the other end of multiprocessing.Pipe has closed

1541

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2004

1542

return False

2005

1543

2006

1544

# Read a request from the child

2011

1549

fpr = request[1]

2012

1550

address = request[2]

2013

1551

2014

for c in self.clients.itervalues():

1552

for c in self.clients:

2015

1553

if c.fingerprint == fpr:

2016

1554

client = c

2017

1555

break

2020

1558

"dress: %s", fpr, address)

2021

1559

if self.use_dbus:

2022

1560

# Emit D-Bus signal

2023

mandos_dbus_service.ClientNotFound(fpr,

2024

address[0])

1561

mandos_dbus_service.ClientNotFound(fpr, address[0])

2025

1562

parent_pipe.send(False)

2026

1563

return False

2027

1564

2028

1565

gobject.io_add_watch(parent_pipe.fileno(),

2029

1566

gobject.IO_IN | gobject.IO_HUP,

2030

1567

functools.partial(self.handle_ipc,

2031

parent_pipe =

2032

parent_pipe,

2033

proc = proc,

2034

client_object =

2035

client))

1568

parent_pipe = parent_pipe,

1569

client_object = client))

2036

1570

parent_pipe.send(True)

2037

# remove the old hook in favor of the new above hook on

2038

# same fileno

1571

# remove the old hook in favor of the new above hook on same fileno

2039

1572

return False

2040

1573

if command == 'funcall':

2041

1574

funcname = request[1]

2042

1575

args = request[2]

2043

1576

kwargs = request[3]

2044

1577

2045

parent_pipe.send(('data', getattr(client_object,

2046

funcname)(*args,

2047

**kwargs)))

2048

1578

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1579

2049

1580

if command == 'getattr':

2050

1581

attrname = request[1]

2051

1582

if callable(client_object.__getattribute__(attrname)):

2052

1583

parent_pipe.send(('function',))

2053

1584

else:

2054

parent_pipe.send(('data', client_object

2055

.__getattribute__(attrname)))

1585

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2056

1586

2057

1587

if command == 'setattr':

2058

1588

attrname = request[1]

2059

1589

value = request[2]

2060

1590

setattr(client_object, attrname, value)

2061

1591

2062

1592

return True

2063

1593

2064

1594

2094

1624

elif suffix == "w":

2095

1625

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2096

1626

else:

2097

raise ValueError("Unknown suffix {0!r}"

2098

.format(suffix))

1627

raise ValueError("Unknown suffix %r" % suffix)

2099

1628

except (ValueError, IndexError) as e:

2100

1629

raise ValueError(*(e.args))

2101

1630

timevalue += delta

2102

1631

return timevalue

2103

1632

2104

1633

1634

def if_nametoindex(interface):

1635

"""Call the C function if_nametoindex(), or equivalent

1636

1637

Note: This function cannot accept a unicode string."""

1638

global if_nametoindex

1639

try:

1640

if_nametoindex = (ctypes.cdll.LoadLibrary

1641

(ctypes.util.find_library("c"))

1642

.if_nametoindex)

1643

except (OSError, AttributeError):

1644

logger.warning("Doing if_nametoindex the hard way")

1645

def if_nametoindex(interface):

1646

"Get an interface index the hard way, i.e. using fcntl()"

1647

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1648

with contextlib.closing(socket.socket()) as s:

1649

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1650

struct.pack(str("16s16x"),

1651

interface))

1652

interface_index = struct.unpack(str("I"),

1653

ifreq[16:20])[0]

1654

return interface_index

1655

return if_nametoindex(interface)

1656

1657

2105

1658

def daemon(nochdir = False, noclose = False):

2106

1659

"""See daemon(3). Standard BSD Unix function.

2107

1660

2115

1668

sys.exit()

2116

1669

if not noclose:

2117

1670

# Close all standard open file descriptors

2118

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1671

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2119

1672

if not stat.S_ISCHR(os.fstat(null).st_mode):

2120

1673

raise OSError(errno.ENODEV,

2121

"{0} not a character device"

2122

.format(os.devnull))

1674

"%s not a character device"

1675

% os.path.devnull)

2123

1676

os.dup2(null, sys.stdin.fileno())

2124

1677

os.dup2(null, sys.stdout.fileno())

2125

1678

os.dup2(null, sys.stderr.fileno())

2134

1687

2135

1688

parser = argparse.ArgumentParser()

2136

1689

parser.add_argument("-v", "--version", action="version",

2137

version = "%(prog)s {0}".format(version),

1690

version = "%%(prog)s %s" % version,

2138

1691

help="show version number and exit")

2139

1692

parser.add_argument("-i", "--interface", metavar="IF",

2140

1693

help="Bind to interface IF")

2162

1715

" system bus interface")

2163

1716

parser.add_argument("--no-ipv6", action="store_false",

2164

1717

dest="use_ipv6", help="Do not use IPv6")

2165

parser.add_argument("--no-restore", action="store_false",

2166

dest="restore", help="Do not restore stored"

2167

" state")

2168

parser.add_argument("--statedir", metavar="DIR",

2169

help="Directory to save/restore state in")

2170

2171

1718

options = parser.parse_args()

2172

1719

2173

1720

if options.check:

2186

1733

"use_dbus": "True",

2187

1734

"use_ipv6": "True",

2188

1735

"debuglevel": "",

2189

"restore": "True",

2190

"statedir": "/var/lib/mandos"

2191

1736

}

2192

1737

2193

1738

# Parse config file for server-global settings

2210

1755

# options, if set.

2211

1756

for option in ("interface", "address", "port", "debug",

2212

1757

"priority", "servicename", "configdir",

2213

"use_dbus", "use_ipv6", "debuglevel", "restore",

2214

"statedir"):

1758

"use_dbus", "use_ipv6", "debuglevel"):

2215

1759

value = getattr(options, option)

2216

1760

if value is not None:

2217

1761

server_settings[option] = value

2229

1773

debuglevel = server_settings["debuglevel"]

2230

1774

use_dbus = server_settings["use_dbus"]

2231

1775

use_ipv6 = server_settings["use_ipv6"]

2232

stored_state_path = os.path.join(server_settings["statedir"],

2233

stored_state_file)

2234

2235

if debug:

2236

initlogger(debug, logging.DEBUG)

2237

else:

2238

if not debuglevel:

2239

initlogger(debug)

2240

else:

2241

level = getattr(logging, debuglevel.upper())

2242

initlogger(debug, level)

2243

1776

2244

1777

if server_settings["servicename"] != "Mandos":

2245

1778

syslogger.setFormatter(logging.Formatter

2246

('Mandos ({0}) [%(process)d]:'

2247

' %(levelname)s: %(message)s'

2248

.format(server_settings

2249

["servicename"])))

1779

('Mandos (%s) [%%(process)d]:'

1780

' %%(levelname)s: %%(message)s'

1781

% server_settings["servicename"]))

2250

1782

2251

1783

# Parse config file with clients

2252

client_config = configparser.SafeConfigParser(Client

2253

.client_defaults)

1784

client_defaults = { "timeout": "5m",

1785

"extended_timeout": "15m",

1786

"interval": "2m",

1787

"checker": "fping -q -- %%(host)s",

1788

"host": "",

1789

"approval_delay": "0s",

1790

"approval_duration": "1s",

1791

}

1792

client_config = configparser.SafeConfigParser(client_defaults)

2254

1793

client_config.read(os.path.join(server_settings["configdir"],

2255

1794

"clients.conf"))

2256

1795

2270

1809

pidfilename = "/var/run/mandos.pid"

2271

1810

try:

2272

1811

pidfile = open(pidfilename, "w")

2273

except IOError as e:

2274

logger.error("Could not open file %r", pidfilename,

2275

exc_info=e)

1812

except IOError:

1813

logger.error("Could not open file %r", pidfilename)

2276

1814

2277

for name in ("_mandos", "mandos", "nobody"):

1815

try:

1816

uid = pwd.getpwnam("_mandos").pw_uid

1817

gid = pwd.getpwnam("_mandos").pw_gid

1818

except KeyError:

2278

1819

try:

2279

uid = pwd.getpwnam(name).pw_uid

2280

gid = pwd.getpwnam(name).pw_gid

2281

break

1820

uid = pwd.getpwnam("mandos").pw_uid

1821

gid = pwd.getpwnam("mandos").pw_gid

2282

1822

except KeyError:

2283

continue

2284

else:

2285

uid = 65534

2286

gid = 65534

1823

try:

1824

uid = pwd.getpwnam("nobody").pw_uid

1825

gid = pwd.getpwnam("nobody").pw_gid

1826

except KeyError:

1827

uid = 65534

1828

gid = 65534

2287

1829

try:

2288

1830

os.setgid(gid)

2289

1831

os.setuid(uid)

2290

1832

except OSError as error:

2291

if error.errno != errno.EPERM:

1833

if error[0] != errno.EPERM:

2292

1834

raise error

2293

1835

1836

if not debug and not debuglevel:

1837

syslogger.setLevel(logging.WARNING)

1838

console.setLevel(logging.WARNING)

1839

if debuglevel:

1840

level = getattr(logging, debuglevel.upper())

1841

syslogger.setLevel(level)

1842

console.setLevel(level)

1843

2294

1844

if debug:

2295

1845

# Enable all possible GnuTLS debugging

2296

1846

2306

1856

.gnutls_global_set_log_function(debug_gnutls))

2307

1857

2308

1858

# Redirect stdin so all checkers get /dev/null

2309

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1859

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2310

1860

os.dup2(null, sys.stdin.fileno())

2311

1861

if null > 2:

2312

1862

os.close(null)

1863

else:

1864

# No console logging

1865

logger.removeHandler(console)

2313

1866

2314

1867

# Need to fork before connecting to D-Bus

2315

1868

if not debug:

2316

1869

# Close all input and output, do double fork, etc.

2317

1870

daemon()

2318

1871

2319

gobject.threads_init()

2320

2321

1872

global main_loop

2322

1873

# From the Avahi example code

2323

DBusGMainLoop(set_as_default=True)

1874

DBusGMainLoop(set_as_default=True )

2324

1875

main_loop = gobject.MainLoop()

2325

1876

bus = dbus.SystemBus()

2326

1877

# End of Avahi example code

2327

1878

if use_dbus:

2328

1879

try:

2329

bus_name = dbus.service.BusName("se.recompile.Mandos",

1880

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2330

1881

bus, do_not_queue=True)

2331

old_bus_name = (dbus.service.BusName

2332

("se.bsnet.fukt.Mandos", bus,

2333

do_not_queue=True))

2334

1882

except dbus.exceptions.NameExistsException as e:

2335

logger.error("Disabling D-Bus:", exc_info=e)

1883

logger.error(unicode(e) + ", disabling D-Bus")

2336

1884

use_dbus = False

2337

1885

server_settings["use_dbus"] = False

2338

1886

tcp_server.use_dbus = False

2339

1887

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2340

service = AvahiServiceToSyslog(name =

2341

server_settings["servicename"],

2342

servicetype = "_mandos._tcp",

2343

protocol = protocol, bus = bus)

1888

service = AvahiService(name = server_settings["servicename"],

1889

servicetype = "_mandos._tcp",

1890

protocol = protocol, bus = bus)

2344

1891

if server_settings["interface"]:

2345

1892

service.interface = (if_nametoindex

2346

1893

(str(server_settings["interface"])))

2351

1898

client_class = Client

2352

1899

if use_dbus:

2353

1900

client_class = functools.partial(ClientDBus, bus = bus)

2354

2355

client_settings = Client.config_parser(client_config)

2356

old_client_settings = {}

2357

clients_data = {}

2358

2359

# Get client data and settings from last running state.

2360

if server_settings["restore"]:

2361

try:

2362

with open(stored_state_path, "rb") as stored_state:

2363

clients_data, old_client_settings = (pickle.load

2364

(stored_state))

2365

os.remove(stored_state_path)

2366

except IOError as e:

2367

if e.errno == errno.ENOENT:

2368

logger.warning("Could not load persistent state: {0}"

2369

.format(os.strerror(e.errno)))

2370

else:

2371

logger.critical("Could not load persistent state:",

2372

exc_info=e)

2373

raise

2374

except EOFError as e:

2375

logger.warning("Could not load persistent state: "

2376

"EOFError:", exc_info=e)

2377

2378

with PGPEngine() as pgp:

2379

for client_name, client in clients_data.iteritems():

2380

# Decide which value to use after restoring saved state.

2381

# We have three different values: Old config file,

2382

# new config file, and saved state.

2383

# New config value takes precedence if it differs from old

2384

# config value, otherwise use saved state.

2385

for name, value in client_settings[client_name].items():

2386

try:

2387

# For each value in new config, check if it

2388

# differs from the old config value (Except for

2389

# the "secret" attribute)

2390

if (name != "secret" and

2391

value != old_client_settings[client_name]

2392

[name]):

2393

client[name] = value

2394

except KeyError:

2395

pass

2396

2397

# Clients who has passed its expire date can still be

2398

# enabled if its last checker was successful. Clients

2399

# whose checker succeeded before we stored its state is

2400

# assumed to have successfully run all checkers during

2401

# downtime.

2402

if client["enabled"]:

2403

if datetime.datetime.utcnow() >= client["expires"]:

2404

if not client["last_checked_ok"]:

2405

logger.warning(

2406

"disabling client {0} - Client never "

2407

"performed a successful checker"

2408

.format(client_name))

2409

client["enabled"] = False

2410

elif client["last_checker_status"] != 0:

2411

logger.warning(

2412

"disabling client {0} - Client "

2413

"last checker failed with error code {1}"

2414

.format(client_name,

2415

client["last_checker_status"]))

2416

client["enabled"] = False

2417

else:

2418

client["expires"] = (datetime.datetime

2419

.utcnow()

2420

+ client["timeout"])

2421

logger.debug("Last checker succeeded,"

2422

" keeping {0} enabled"

2423

.format(client_name))

1901

def client_config_items(config, section):

1902

special_settings = {

1903

"approved_by_default":

1904

lambda: config.getboolean(section,

1905

"approved_by_default"),

1906

}

1907

for name, value in config.items(section):

2424

1908

try:

2425

client["secret"] = (

2426

pgp.decrypt(client["encrypted_secret"],

2427

client_settings[client_name]

2428

["secret"]))

2429

except PGPError:

2430

# If decryption fails, we use secret from new settings

2431

logger.debug("Failed to decrypt {0} old secret"

2432

.format(client_name))

2433

client["secret"] = (

2434

client_settings[client_name]["secret"])

2435

2436

# Add/remove clients based on new changes made to config

2437

for client_name in (set(old_client_settings)

2438

- set(client_settings)):

2439

del clients_data[client_name]

2440

for client_name in (set(client_settings)

2441

- set(old_client_settings)):

2442

clients_data[client_name] = client_settings[client_name]

2443

2444

# Create all client objects

2445

for client_name, client in clients_data.iteritems():

2446

tcp_server.clients[client_name] = client_class(

2447

name = client_name, settings = client)

2448

1909

yield (name, special_settings[name]())

1910

except KeyError:

1911

yield (name, value)

1912

1913

tcp_server.clients.update(set(

1914

client_class(name = section,

1915

config= dict(client_config_items(

1916

client_config, section)))

1917

for section in client_config.sections()))

2449

1918

if not tcp_server.clients:

2450

1919

logger.warning("No clients defined")

2451

1920

2452

1921

if not debug:

2453

1922

try:

2454

1923

with pidfile:

2462

1931

# "pidfile" was never created

2463

1932

pass

2464

1933

del pidfilename

2465

1934

1935

signal.signal(signal.SIGINT, signal.SIG_IGN)

1936

2466

1937

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2467

1938

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2468

1939

2469

1940

if use_dbus:

2470

@alternate_dbus_interfaces({"se.recompile.Mandos":

2471

"se.bsnet.fukt.Mandos"})

2472

class MandosDBusService(DBusObjectWithProperties):

1941

class MandosDBusService(dbus.service.Object):

2473

1942

"""A D-Bus proxy object"""

2474

1943

def __init__(self):

2475

1944

dbus.service.Object.__init__(self, bus, "/")

2476

_interface = "se.recompile.Mandos"

2477

2478

@dbus_interface_annotations(_interface)

2479

def _foo(self):

2480

return { "org.freedesktop.DBus.Property"

2481

".EmitsChangedSignal":

2482

"false"}

1945

_interface = "se.bsnet.fukt.Mandos"

2483

1946

2484

1947

@dbus.service.signal(_interface, signature="o")

2485

1948

def ClientAdded(self, objpath):

2500

1963

def GetAllClients(self):

2501

1964

"D-Bus method"

2502

1965

return dbus.Array(c.dbus_object_path

2503

for c in

2504

tcp_server.clients.itervalues())

1966

for c in tcp_server.clients)

2505

1967

2506

1968

@dbus.service.method(_interface,

2507

1969

out_signature="a{oa{sv}}")

2509

1971

"D-Bus method"

2510

1972

return dbus.Dictionary(

2511

1973

((c.dbus_object_path, c.GetAll(""))

2512

for c in tcp_server.clients.itervalues()),

1974

for c in tcp_server.clients),

2513

1975

signature="oa{sv}")

2514

1976

2515

1977

@dbus.service.method(_interface, in_signature="o")

2516

1978

def RemoveClient(self, object_path):

2517

1979

"D-Bus method"

2518

for c in tcp_server.clients.itervalues():

1980

for c in tcp_server.clients:

2519

1981

if c.dbus_object_path == object_path:

2520

del tcp_server.clients[c.name]

1982

tcp_server.clients.remove(c)

2521

1983

c.remove_from_connection()

2522

1984

# Don't signal anything except ClientRemoved

2523

1985

c.disable(quiet=True)

2534

1996

"Cleanup function; run on exit"

2535

1997

service.cleanup()

2536

1998

2537

multiprocessing.active_children()

2538

if not (tcp_server.clients or client_settings):

2539

return

2540

2541

# Store client before exiting. Secrets are encrypted with key

2542

# based on what config file has. If config file is

2543

# removed/edited, old secret will thus be unrecovable.

2544

clients = {}

2545

with PGPEngine() as pgp:

2546

for client in tcp_server.clients.itervalues():

2547

key = client_settings[client.name]["secret"]

2548

client.encrypted_secret = pgp.encrypt(client.secret,

2549

key)

2550

client_dict = {}

2551

2552

# A list of attributes that can not be pickled

2553

# + secret.

2554

exclude = set(("bus", "changedstate", "secret",

2555

"checker"))

2556

for name, typ in (inspect.getmembers

2557

(dbus.service.Object)):

2558

exclude.add(name)

2559

2560

client_dict["encrypted_secret"] = (client

2561

.encrypted_secret)

2562

for attr in client.client_structure:

2563

if attr not in exclude:

2564

client_dict[attr] = getattr(client, attr)

2565

2566

clients[client.name] = client_dict

2567

del client_settings[client.name]["secret"]

2568

2569

try:

2570

with (tempfile.NamedTemporaryFile

2571

(mode='wb', suffix=".pickle", prefix='clients-',

2572

dir=os.path.dirname(stored_state_path),

2573

delete=False)) as stored_state:

2574

pickle.dump((clients, client_settings), stored_state)

2575

tempname=stored_state.name

2576

os.rename(tempname, stored_state_path)

2577

except (IOError, OSError) as e:

2578

if not debug:

2579

try:

2580

os.remove(tempname)

2581

except NameError:

2582

pass

2583

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2584

logger.warning("Could not save persistent state: {0}"

2585

.format(os.strerror(e.errno)))

2586

else:

2587

logger.warning("Could not save persistent state:",

2588

exc_info=e)

2589

raise e

2590

2591

# Delete all clients, and settings from config

2592

1999

while tcp_server.clients:

2593

name, client = tcp_server.clients.popitem()

2000

client = tcp_server.clients.pop()

2594

2001

if use_dbus:

2595

2002

client.remove_from_connection()

2003

client.disable_hook = None

2596

2004

# Don't signal anything except ClientRemoved

2597

2005

client.disable(quiet=True)

2598

2006

if use_dbus:

2599

2007

# Emit D-Bus signal

2600

mandos_dbus_service.ClientRemoved(client

2601

.dbus_object_path,

2008

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2602

2009

client.name)

2603

client_settings.clear()

2604

2010

2605

2011

atexit.register(cleanup)

2606

2012

2607

for client in tcp_server.clients.itervalues():

2013

for client in tcp_server.clients:

2608

2014

if use_dbus:

2609

2015

# Emit D-Bus signal

2610

2016

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2611

# Need to initiate checking of clients

2612

if client.enabled:

2613

client.init_checker()

2017

client.enable()

2614

2018

2615

2019

tcp_server.enable()

2616

2020

tcp_server.server_activate()

2619

2023

service.port = tcp_server.socket.getsockname()[1]

2620

2024

if use_ipv6:

2621

2025

logger.info("Now listening on address %r, port %d,"

2622

" flowinfo %d, scope_id %d",

2623

*tcp_server.socket.getsockname())

2026

" flowinfo %d, scope_id %d"

2027

% tcp_server.socket.getsockname())

2624

2028

else: # IPv4

2625

logger.info("Now listening on address %r, port %d",

2626

*tcp_server.socket.getsockname())

2029

logger.info("Now listening on address %r, port %d"

2030

% tcp_server.socket.getsockname())

2627

2031

2628

2032

#service.interface = tcp_server.socket.getsockname()[3]

2629

2033

2632

2036

try:

2633

2037

service.activate()

2634

2038

except dbus.exceptions.DBusException as error:

2635

logger.critical("D-Bus Exception", exc_info=error)

2039

logger.critical("DBusException: %s", error)

2636

2040

cleanup()

2637

2041

sys.exit(1)

2638

2042

# End of Avahi example code

2645

2049

logger.debug("Starting main loop")

2646

2050

main_loop.run()

2647

2051

except AvahiError as error:

2648

logger.critical("Avahi Error", exc_info=error)

2052

logger.critical("AvahiError: %s", error)

2649

2053

cleanup()

2650

2054

sys.exit(1)

2651

2055

except KeyboardInterrupt: