88
82
except ImportError:
89
83
SO_BINDTODEVICE = None
91
if sys.version_info.major == 2:
95
stored_state_file = "clients.pickle"
97
logger = logging.getLogger()
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
104
except (OSError, AttributeError):
105
def if_nametoindex(interface):
106
"Get an interface index the hard way, i.e. using fcntl()"
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
108
with contextlib.closing(socket.socket()) as s:
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
110
struct.pack(b"16s16x", interface))
111
interface_index = struct.unpack("I", ifreq[16:20])[0]
112
return interface_index
115
def initlogger(debug, level=logging.WARNING):
116
"""init logger and add loglevel"""
119
syslogger = (logging.handlers.SysLogHandler
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
123
syslogger.setFormatter(logging.Formatter
124
('Mandos [%(process)d]: %(levelname)s:'
126
logger.addHandler(syslogger)
129
console = logging.StreamHandler()
130
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
134
logger.addHandler(console)
135
logger.setLevel(level)
138
class PGPError(Exception):
139
"""Exception if encryption/decryption fails"""
143
class PGPEngine(object):
144
"""A simple class for OpenPGP symmetric encryption & decryption"""
146
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
147
self.gnupgargs = ['--batch',
148
'--home', self.tempdir,
156
def __exit__(self, exc_type, exc_value, traceback):
164
if self.tempdir is not None:
165
# Delete contents of tempdir
166
for root, dirs, files in os.walk(self.tempdir,
168
for filename in files:
169
os.remove(os.path.join(root, filename))
171
os.rmdir(os.path.join(root, dirname))
173
os.rmdir(self.tempdir)
176
def password_encode(self, password):
177
# Passphrase can not be empty and can not contain newlines or
178
# NUL bytes. So we prefix it and hex encode it.
179
encoded = b"mandos" + binascii.hexlify(password)
180
if len(encoded) > 2048:
181
# GnuPG can't handle long passwords, so encode differently
182
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
183
.replace(b"\n", b"\\n")
184
.replace(b"\0", b"\\x00"))
187
def encrypt(self, data, password):
188
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
191
passfile.write(passphrase)
193
proc = subprocess.Popen(['gpg', '--symmetric',
197
stdin = subprocess.PIPE,
198
stdout = subprocess.PIPE,
199
stderr = subprocess.PIPE)
200
ciphertext, err = proc.communicate(input = data)
201
if proc.returncode != 0:
205
def decrypt(self, data, password):
206
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
209
passfile.write(passphrase)
211
proc = subprocess.Popen(['gpg', '--decrypt',
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
220
if proc.returncode != 0:
222
return decrypted_plaintext
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
90
syslogger = (logging.handlers.SysLogHandler
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
address = str("/dev/log")))
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
96
logger.addHandler(syslogger)
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
102
logger.addHandler(console)
225
104
class AvahiError(Exception):
226
105
def __init__(self, value, *args, **kwargs):
227
106
self.value = value
228
return super(AvahiError, self).__init__(value, *args,
107
super(AvahiError, self).__init__(value, *args, **kwargs)
108
def __unicode__(self):
109
return unicode(repr(self.value))
231
111
class AvahiServiceError(AvahiError):
429
299
interval: datetime.timedelta(); How often to start a new checker
430
300
last_approval_request: datetime.datetime(); (UTC) or None
431
301
last_checked_ok: datetime.datetime(); (UTC) or None
432
last_checker_status: integer between 0 and 255 reflecting exit
433
status of last checker. -1 reflects crashed
434
checker, -2 means no checker completed yet.
435
last_enabled: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
436
303
name: string; from the config file, used in log messages and
437
304
D-Bus identifiers
438
305
secret: bytestring; sent verbatim (over TLS) to client
439
306
timeout: datetime.timedelta(); How long from last_checked_ok
440
307
until this client is disabled
441
extended_timeout: extra long timeout when secret has been sent
308
extended_timeout: extra long timeout when password has been sent
442
309
runtime_expansions: Allowed attributes for runtime expansion.
443
310
expires: datetime.datetime(); time (UTC) when a client will be
444
311
disabled, or None
445
server_settings: The server_settings dict from main()
448
314
runtime_expansions = ("approval_delay", "approval_duration",
449
"created", "enabled", "expires",
450
"fingerprint", "host", "interval",
451
"last_approval_request", "last_checked_ok",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
452
317
"last_enabled", "name", "timeout")
453
client_defaults = { "timeout": "PT5M",
454
"extended_timeout": "PT15M",
456
"checker": "fping -q -- %%(host)s",
458
"approval_delay": "PT0S",
459
"approval_duration": "PT1S",
460
"approved_by_default": "True",
465
def config_parser(config):
466
"""Construct a new dict of client settings of this form:
467
{ client_name: {setting_name: value, ...}, ...}
468
with exceptions for any special settings as defined above.
469
NOTE: Must be a pure function. Must return the same result
470
value given the same arguments.
473
for client_name in config.sections():
474
section = dict(config.items(client_name))
475
client = settings[client_name] = {}
477
client["host"] = section["host"]
478
# Reformat values from string types to Python types
479
client["approved_by_default"] = config.getboolean(
480
client_name, "approved_by_default")
481
client["enabled"] = config.getboolean(client_name,
484
client["fingerprint"] = (section["fingerprint"].upper()
486
if "secret" in section:
487
client["secret"] = section["secret"].decode("base64")
488
elif "secfile" in section:
489
with open(os.path.expanduser(os.path.expandvars
490
(section["secfile"])),
492
client["secret"] = secfile.read()
494
raise TypeError("No secret or secfile for section {}"
496
client["timeout"] = string_to_delta(section["timeout"])
497
client["extended_timeout"] = string_to_delta(
498
section["extended_timeout"])
499
client["interval"] = string_to_delta(section["interval"])
500
client["approval_delay"] = string_to_delta(
501
section["approval_delay"])
502
client["approval_duration"] = string_to_delta(
503
section["approval_duration"])
504
client["checker_command"] = section["checker"]
505
client["last_approval_request"] = None
506
client["last_checked_ok"] = None
507
client["last_checker_status"] = -2
511
def __init__(self, settings, name = None, server_settings=None):
319
def timeout_milliseconds(self):
320
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
323
def extended_timeout_milliseconds(self):
324
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
327
def interval_milliseconds(self):
328
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
331
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
334
def __init__(self, name = None, disable_hook=None, config=None):
335
"""Note: the 'checker' key in 'config' sets the
336
'checker_command' attribute and *not* the 'checker'
513
if server_settings is None:
515
self.server_settings = server_settings
516
# adding all client settings
517
for setting, value in settings.items():
518
setattr(self, setting, value)
521
if not hasattr(self, "last_enabled"):
522
self.last_enabled = datetime.datetime.utcnow()
523
if not hasattr(self, "expires"):
524
self.expires = (datetime.datetime.utcnow()
527
self.last_enabled = None
530
341
logger.debug("Creating client %r", self.name)
531
342
# Uppercase and remove spaces from fingerprint for later
532
343
# comparison purposes with return value from the fingerprint()
345
self.fingerprint = (config["fingerprint"].upper()
534
347
logger.debug(" Fingerprint: %s", self.fingerprint)
535
self.created = settings.get("created",
536
datetime.datetime.utcnow())
538
# attributes specific for this server instance
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
354
self.secret = secfile.read()
356
raise TypeError("No secret or secfile for client %s"
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
539
369
self.checker = None
540
370
self.checker_initiator_tag = None
541
371
self.disable_initiator_tag = None
542
373
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
543
375
self.current_checker_command = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
545
380
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
546
385
self.changedstate = (multiprocessing_manager
547
386
.Condition(multiprocessing_manager
549
self.client_structure = [attr for attr in
550
self.__dict__.iterkeys()
551
if not attr.startswith("_")]
552
self.client_structure.append("client_structure")
554
for name, t in inspect.getmembers(type(self),
558
if not name.startswith("_"):
559
self.client_structure.append(name)
561
# Send notice to process children that client state has changed
562
389
def send_changedstate(self):
563
with self.changedstate:
564
self.changedstate.notify_all()
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
566
394
def enable(self):
567
395
"""Start this client's checker and timeout hooks"""
568
396
if getattr(self, "enabled", False):
569
397
# Already enabled
399
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
405
# Schedule a disable() when 'timeout' has passed
571
406
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
572
410
self.enabled = True
573
411
self.last_enabled = datetime.datetime.utcnow()
575
self.send_changedstate()
412
# Also start a new checker *right now*.
577
415
def disable(self, quiet=True):
578
416
"""Disable this client."""
579
417
if not getattr(self, "enabled", False):
420
self.send_changedstate()
582
422
logger.info("Disabling client %s", self.name)
583
if getattr(self, "disable_initiator_tag", None) is not None:
423
if getattr(self, "disable_initiator_tag", False):
584
424
gobject.source_remove(self.disable_initiator_tag)
585
425
self.disable_initiator_tag = None
586
426
self.expires = None
587
if getattr(self, "checker_initiator_tag", None) is not None:
427
if getattr(self, "checker_initiator_tag", False):
588
428
gobject.source_remove(self.checker_initiator_tag)
589
429
self.checker_initiator_tag = None
590
430
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
591
433
self.enabled = False
593
self.send_changedstate()
594
434
# Do not run this again if called by a gobject.timeout_add
597
437
def __del__(self):
438
self.disable_hook = None
600
def init_checker(self):
601
# Schedule a new checker to be started an 'interval' from now,
602
# and every interval from then on.
603
if self.checker_initiator_tag is not None:
604
gobject.source_remove(self.checker_initiator_tag)
605
self.checker_initiator_tag = (gobject.timeout_add
607
.total_seconds() * 1000),
609
# Schedule a disable() when 'timeout' has passed
610
if self.disable_initiator_tag is not None:
611
gobject.source_remove(self.disable_initiator_tag)
612
self.disable_initiator_tag = (gobject.timeout_add
614
.total_seconds() * 1000),
616
# Also start a new checker *right now*.
619
441
def checker_callback(self, pid, condition, command):
620
442
"""The checker has completed, so take appropriate actions."""
621
443
self.checker_callback_tag = None
622
444
self.checker = None
623
445
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
625
if self.last_checker_status == 0:
446
exitstatus = os.WEXITSTATUS(condition)
626
448
logger.info("Checker for %(name)s succeeded",
628
450
self.checked_ok()
1032
750
except (AttributeError, xml.dom.DOMException,
1033
751
xml.parsers.expat.ExpatError) as error:
1034
752
logger.error("Failed to override Introspection method",
1036
754
return xmlstring
1039
def datetime_to_dbus(dt, variant_level=0):
757
def datetime_to_dbus (dt, variant_level=0):
1040
758
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1042
760
return dbus.String("", variant_level = variant_level)
1043
761
return dbus.String(dt.isoformat(),
1044
762
variant_level=variant_level)
1047
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1048
"""A class decorator; applied to a subclass of
1049
dbus.service.Object, it will add alternate D-Bus attributes with
1050
interface names according to the "alt_interface_names" mapping.
1053
@alternate_dbus_interfaces({"org.example.Interface":
1054
"net.example.AlternateInterface"})
1055
class SampleDBusObject(dbus.service.Object):
1056
@dbus.service.method("org.example.Interface")
1057
def SampleDBusMethod():
1060
The above "SampleDBusMethod" on "SampleDBusObject" will be
1061
reachable via two interfaces: "org.example.Interface" and
1062
"net.example.AlternateInterface", the latter of which will have
1063
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1064
"true", unless "deprecate" is passed with a False value.
1066
This works for methods and signals, and also for D-Bus properties
1067
(from DBusObjectWithProperties) and interfaces (from the
1068
dbus_interface_annotations decorator).
764
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
766
"""Applied to an empty subclass of a D-Bus object, this metaclass
767
will add additional D-Bus attributes matching a certain pattern.
1071
for orig_interface_name, alt_interface_name in (
1072
alt_interface_names.items()):
1074
interface_names = set()
1075
# Go though all attributes of the class
1076
for attrname, attribute in inspect.getmembers(cls):
769
def __new__(mcs, name, bases, attr):
770
# Go through all the base classes which could have D-Bus
771
# methods, signals, or properties in them
772
for base in (b for b in bases
773
if issubclass(b, dbus.service.Object)):
774
# Go though all attributes of the base class
775
for attrname, attribute in inspect.getmembers(base):
1077
776
# Ignore non-D-Bus attributes, and D-Bus attributes
1078
777
# with the wrong interface name
1079
778
if (not hasattr(attribute, "_dbus_interface")
1080
779
or not attribute._dbus_interface
1081
.startswith(orig_interface_name)):
780
.startswith("se.recompile.Mandos")):
1083
782
# Create an alternate D-Bus interface name based on
1084
783
# the current name
1085
784
alt_interface = (attribute._dbus_interface
1086
.replace(orig_interface_name,
1087
alt_interface_name))
1088
interface_names.add(alt_interface)
785
.replace("se.recompile.Mandos",
786
"se.bsnet.fukt.Mandos"))
1089
787
# Is this a D-Bus signal?
1090
788
if getattr(attribute, "_dbus_is_signal", False):
1091
# Extract the original non-method undecorated
1092
# function by black magic
789
# Extract the original non-method function by
1093
791
nonmethod_func = (dict(
1094
792
zip(attribute.func_code.co_freevars,
1095
793
attribute.__closure__))["func"]
1294
926
checker is not None)
1295
927
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1296
928
"LastCheckedOK")
1297
last_checker_status = notifychangeproperty(dbus.Int16,
1298
"LastCheckerStatus")
1299
929
last_approval_request = notifychangeproperty(
1300
930
datetime_to_dbus, "LastApprovalRequest")
1301
931
approved_by_default = notifychangeproperty(dbus.Boolean,
1302
932
"ApprovedByDefault")
1303
approval_delay = notifychangeproperty(dbus.UInt64,
933
approval_delay = notifychangeproperty(dbus.UInt16,
1304
934
"ApprovalDelay",
1306
lambda td: td.total_seconds()
936
_timedelta_to_milliseconds)
1308
937
approval_duration = notifychangeproperty(
1309
dbus.UInt64, "ApprovalDuration",
1310
type_func = lambda td: td.total_seconds() * 1000)
938
dbus.UInt16, "ApprovalDuration",
939
type_func = _timedelta_to_milliseconds)
1311
940
host = notifychangeproperty(dbus.String, "Host")
1312
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1313
type_func = lambda td:
1314
td.total_seconds() * 1000)
941
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
943
_timedelta_to_milliseconds)
1315
944
extended_timeout = notifychangeproperty(
1316
dbus.UInt64, "ExtendedTimeout",
1317
type_func = lambda td: td.total_seconds() * 1000)
1318
interval = notifychangeproperty(dbus.UInt64,
945
dbus.UInt16, "ExtendedTimeout",
946
type_func = _timedelta_to_milliseconds)
947
interval = notifychangeproperty(dbus.UInt16,
1321
lambda td: td.total_seconds()
950
_timedelta_to_milliseconds)
1323
951
checker_command = notifychangeproperty(dbus.String, "Checker")
1324
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1325
invalidate_only=True)
1327
953
del notifychangeproperty
2121
def rfc3339_duration_to_delta(duration):
2122
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2124
>>> rfc3339_duration_to_delta("P7D")
2125
datetime.timedelta(7)
2126
>>> rfc3339_duration_to_delta("PT60S")
2127
datetime.timedelta(0, 60)
2128
>>> rfc3339_duration_to_delta("PT60M")
2129
datetime.timedelta(0, 3600)
2130
>>> rfc3339_duration_to_delta("PT24H")
2131
datetime.timedelta(1)
2132
>>> rfc3339_duration_to_delta("P1W")
2133
datetime.timedelta(7)
2134
>>> rfc3339_duration_to_delta("PT5M30S")
2135
datetime.timedelta(0, 330)
2136
>>> rfc3339_duration_to_delta("P1DT3M20S")
2137
datetime.timedelta(1, 200)
2140
# Parsing an RFC 3339 duration with regular expressions is not
2141
# possible - there would have to be multiple places for the same
2142
# values, like seconds. The current code, while more esoteric, is
2143
# cleaner without depending on a parsing library. If Python had a
2144
# built-in library for parsing we would use it, but we'd like to
2145
# avoid excessive use of external libraries.
2147
# New type for defining tokens, syntax, and semantics all-in-one
2148
Token = collections.namedtuple("Token",
2149
("regexp", # To match token; if
2150
# "value" is not None,
2151
# must have a "group"
2153
"value", # datetime.timedelta or
2155
"followers")) # Tokens valid after
2157
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2158
# the "duration" ABNF definition in RFC 3339, Appendix A.
2159
token_end = Token(re.compile(r"$"), None, frozenset())
2160
token_second = Token(re.compile(r"(\d+)S"),
2161
datetime.timedelta(seconds=1),
2162
frozenset((token_end,)))
2163
token_minute = Token(re.compile(r"(\d+)M"),
2164
datetime.timedelta(minutes=1),
2165
frozenset((token_second, token_end)))
2166
token_hour = Token(re.compile(r"(\d+)H"),
2167
datetime.timedelta(hours=1),
2168
frozenset((token_minute, token_end)))
2169
token_time = Token(re.compile(r"T"),
2171
frozenset((token_hour, token_minute,
2173
token_day = Token(re.compile(r"(\d+)D"),
2174
datetime.timedelta(days=1),
2175
frozenset((token_time, token_end)))
2176
token_month = Token(re.compile(r"(\d+)M"),
2177
datetime.timedelta(weeks=4),
2178
frozenset((token_day, token_end)))
2179
token_year = Token(re.compile(r"(\d+)Y"),
2180
datetime.timedelta(weeks=52),
2181
frozenset((token_month, token_end)))
2182
token_week = Token(re.compile(r"(\d+)W"),
2183
datetime.timedelta(weeks=1),
2184
frozenset((token_end,)))
2185
token_duration = Token(re.compile(r"P"), None,
2186
frozenset((token_year, token_month,
2187
token_day, token_time,
2189
# Define starting values
2190
value = datetime.timedelta() # Value so far
2192
followers = frozenset((token_duration,)) # Following valid tokens
2193
s = duration # String left to parse
2194
# Loop until end token is found
2195
while found_token is not token_end:
2196
# Search for any currently valid tokens
2197
for token in followers:
2198
match = token.regexp.match(s)
2199
if match is not None:
2201
if token.value is not None:
2202
# Value found, parse digits
2203
factor = int(match.group(1), 10)
2204
# Add to value so far
2205
value += factor * token.value
2206
# Strip token from string
2207
s = token.regexp.sub("", s, 1)
2210
# Set valid next tokens
2211
followers = found_token.followers
2214
# No currently valid tokens were found
2215
raise ValueError("Invalid RFC 3339 duration")
2220
1729
def string_to_delta(interval):
2221
1730
"""Parse a string and return a datetime.timedelta
2370
1877
# Convert the SafeConfigParser object to a dict
2371
1878
server_settings = server_config.defaults()
2372
1879
# Use the appropriate methods on the non-string config options
2373
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1880
for option in ("debug", "use_dbus", "use_ipv6"):
2374
1881
server_settings[option] = server_config.getboolean("DEFAULT",
2376
1883
if server_settings["port"]:
2377
1884
server_settings["port"] = server_config.getint("DEFAULT",
2379
if server_settings["socket"]:
2380
server_settings["socket"] = server_config.getint("DEFAULT",
2382
# Later, stdin will, and stdout and stderr might, be dup'ed
2383
# over with an opened os.devnull. But we don't want this to
2384
# happen with a supplied network socket.
2385
if 0 <= server_settings["socket"] <= 2:
2386
server_settings["socket"] = os.dup(server_settings
2388
1886
del server_config
2390
1888
# Override the settings from the config file with command line
2391
1889
# options, if set.
2392
1890
for option in ("interface", "address", "port", "debug",
2393
1891
"priority", "servicename", "configdir",
2394
"use_dbus", "use_ipv6", "debuglevel", "restore",
2395
"statedir", "socket", "foreground", "zeroconf"):
1892
"use_dbus", "use_ipv6", "debuglevel"):
2396
1893
value = getattr(options, option)
2397
1894
if value is not None:
2398
1895
server_settings[option] = value
2400
1897
# Force all strings to be unicode
2401
1898
for option in server_settings.keys():
2402
if isinstance(server_settings[option], bytes):
2403
server_settings[option] = (server_settings[option]
2405
# Force all boolean options to be boolean
2406
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2407
"foreground", "zeroconf"):
2408
server_settings[option] = bool(server_settings[option])
2409
# Debug implies foreground
2410
if server_settings["debug"]:
2411
server_settings["foreground"] = True
1899
if type(server_settings[option]) is str:
1900
server_settings[option] = unicode(server_settings[option])
2412
1901
# Now we have our good server settings in "server_settings"
2414
1903
##################################################################
2416
if (not server_settings["zeroconf"] and
2417
not (server_settings["port"]
2418
or server_settings["socket"] != "")):
2419
parser.error("Needs port or socket to work without"
2422
1905
# For convenience
2423
1906
debug = server_settings["debug"]
2424
1907
debuglevel = server_settings["debuglevel"]
2425
1908
use_dbus = server_settings["use_dbus"]
2426
1909
use_ipv6 = server_settings["use_ipv6"]
2427
stored_state_path = os.path.join(server_settings["statedir"],
2429
foreground = server_settings["foreground"]
2430
zeroconf = server_settings["zeroconf"]
2433
initlogger(debug, logging.DEBUG)
2438
level = getattr(logging, debuglevel.upper())
2439
initlogger(debug, level)
2441
1911
if server_settings["servicename"] != "Mandos":
2442
1912
syslogger.setFormatter(logging.Formatter
2443
('Mandos ({}) [%(process)d]:'
2444
' %(levelname)s: %(message)s'
2445
.format(server_settings
1913
('Mandos (%s) [%%(process)d]:'
1914
' %%(levelname)s: %%(message)s'
1915
% server_settings["servicename"]))
2448
1917
# Parse config file with clients
2449
client_config = configparser.SafeConfigParser(Client
1918
client_defaults = { "timeout": "5m",
1919
"extended_timeout": "15m",
1921
"checker": "fping -q -- %%(host)s",
1923
"approval_delay": "0s",
1924
"approval_duration": "1s",
1926
client_config = configparser.SafeConfigParser(client_defaults)
2451
1927
client_config.read(os.path.join(server_settings["configdir"],
2452
1928
"clients.conf"))
2454
1930
global mandos_dbus_service
2455
1931
mandos_dbus_service = None
2458
if server_settings["socket"] != "":
2459
socketfd = server_settings["socket"]
2460
1933
tcp_server = MandosServer((server_settings["address"],
2461
1934
server_settings["port"]),
2538
2017
("se.bsnet.fukt.Mandos", bus,
2539
2018
do_not_queue=True))
2540
2019
except dbus.exceptions.NameExistsException as e:
2541
logger.error("Disabling D-Bus:", exc_info=e)
2020
logger.error(unicode(e) + ", disabling D-Bus")
2542
2021
use_dbus = False
2543
2022
server_settings["use_dbus"] = False
2544
2023
tcp_server.use_dbus = False
2546
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2547
service = AvahiServiceToSyslog(name =
2548
server_settings["servicename"],
2549
servicetype = "_mandos._tcp",
2550
protocol = protocol, bus = bus)
2551
if server_settings["interface"]:
2552
service.interface = (if_nametoindex
2553
(server_settings["interface"]
2024
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2025
service = AvahiService(name = server_settings["servicename"],
2026
servicetype = "_mandos._tcp",
2027
protocol = protocol, bus = bus)
2028
if server_settings["interface"]:
2029
service.interface = (if_nametoindex
2030
(str(server_settings["interface"])))
2556
2032
global multiprocessing_manager
2557
2033
multiprocessing_manager = multiprocessing.Manager()
2559
2035
client_class = Client
2561
client_class = functools.partial(ClientDBus, bus = bus)
2563
client_settings = Client.config_parser(client_config)
2564
old_client_settings = {}
2567
# This is used to redirect stdout and stderr for checker processes
2569
wnull = open(os.devnull, "w") # A writable /dev/null
2570
# Only used if server is running in foreground but not in debug
2572
if debug or not foreground:
2575
# Get client data and settings from last running state.
2576
if server_settings["restore"]:
2578
with open(stored_state_path, "rb") as stored_state:
2579
clients_data, old_client_settings = (pickle.load
2581
os.remove(stored_state_path)
2582
except IOError as e:
2583
if e.errno == errno.ENOENT:
2584
logger.warning("Could not load persistent state: {}"
2585
.format(os.strerror(e.errno)))
2587
logger.critical("Could not load persistent state:",
2590
except EOFError as e:
2591
logger.warning("Could not load persistent state: "
2592
"EOFError:", exc_info=e)
2594
with PGPEngine() as pgp:
2595
for client_name, client in clients_data.items():
2596
# Skip removed clients
2597
if client_name not in client_settings:
2600
# Decide which value to use after restoring saved state.
2601
# We have three different values: Old config file,
2602
# new config file, and saved state.
2603
# New config value takes precedence if it differs from old
2604
# config value, otherwise use saved state.
2605
for name, value in client_settings[client_name].items():
2607
# For each value in new config, check if it
2608
# differs from the old config value (Except for
2609
# the "secret" attribute)
2610
if (name != "secret" and
2611
value != old_client_settings[client_name]
2613
client[name] = value
2617
# Clients who has passed its expire date can still be
2618
# enabled if its last checker was successful. Clients
2619
# whose checker succeeded before we stored its state is
2620
# assumed to have successfully run all checkers during
2622
if client["enabled"]:
2623
if datetime.datetime.utcnow() >= client["expires"]:
2624
if not client["last_checked_ok"]:
2626
"disabling client {} - Client never "
2627
"performed a successful checker"
2628
.format(client_name))
2629
client["enabled"] = False
2630
elif client["last_checker_status"] != 0:
2632
"disabling client {} - Client last"
2633
" checker failed with error code {}"
2634
.format(client_name,
2635
client["last_checker_status"]))
2636
client["enabled"] = False
2638
client["expires"] = (datetime.datetime
2640
+ client["timeout"])
2641
logger.debug("Last checker succeeded,"
2642
" keeping {} enabled"
2643
.format(client_name))
2037
client_class = functools.partial(ClientDBusTransitional,
2039
def client_config_items(config, section):
2040
special_settings = {
2041
"approved_by_default":
2042
lambda: config.getboolean(section,
2043
"approved_by_default"),
2045
for name, value in config.items(section):
2645
client["secret"] = (
2646
pgp.decrypt(client["encrypted_secret"],
2647
client_settings[client_name]
2650
# If decryption fails, we use secret from new settings
2651
logger.debug("Failed to decrypt {} old secret"
2652
.format(client_name))
2653
client["secret"] = (
2654
client_settings[client_name]["secret"])
2656
# Add/remove clients based on new changes made to config
2657
for client_name in (set(old_client_settings)
2658
- set(client_settings)):
2659
del clients_data[client_name]
2660
for client_name in (set(client_settings)
2661
- set(old_client_settings)):
2662
clients_data[client_name] = client_settings[client_name]
2664
# Create all client objects
2665
for client_name, client in clients_data.items():
2666
tcp_server.clients[client_name] = client_class(
2667
name = client_name, settings = client,
2668
server_settings = server_settings)
2047
yield (name, special_settings[name]())
2051
tcp_server.clients.update(set(
2052
client_class(name = section,
2053
config= dict(client_config_items(
2054
client_config, section)))
2055
for section in client_config.sections()))
2670
2056
if not tcp_server.clients:
2671
2057
logger.warning("No clients defined")
2674
if pidfile is not None:
2678
pidfile.write("{}\n".format(pid).encode("utf-8"))
2680
logger.error("Could not write to file %r with PID %d",
2063
pidfile.write(str(pid) + "\n".encode("utf-8"))
2066
logger.error("Could not write to file %r with PID %d",
2069
# "pidfile" was never created
2683
2071
del pidfilename
2073
signal.signal(signal.SIGINT, signal.SIG_IGN)
2685
2075
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2686
2076
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2689
@alternate_dbus_interfaces({"se.recompile.Mandos":
2690
"se.bsnet.fukt.Mandos"})
2691
class MandosDBusService(DBusObjectWithProperties):
2079
class MandosDBusService(dbus.service.Object):
2692
2080
"""A D-Bus proxy object"""
2693
2081
def __init__(self):
2694
2082
dbus.service.Object.__init__(self, bus, "/")
2695
2083
_interface = "se.recompile.Mandos"
2697
@dbus_interface_annotations(_interface)
2699
return { "org.freedesktop.DBus.Property"
2700
".EmitsChangedSignal":
2703
2085
@dbus.service.signal(_interface, signature="o")
2704
2086
def ClientAdded(self, objpath):
2750
mandos_dbus_service = MandosDBusService()
2131
class MandosDBusServiceTransitional(MandosDBusService):
2132
__metaclass__ = AlternateDBusNamesMetaclass
2133
mandos_dbus_service = MandosDBusServiceTransitional()
2753
2136
"Cleanup function; run on exit"
2757
2139
multiprocessing.active_children()
2759
if not (tcp_server.clients or client_settings):
2762
# Store client before exiting. Secrets are encrypted with key
2763
# based on what config file has. If config file is
2764
# removed/edited, old secret will thus be unrecovable.
2766
with PGPEngine() as pgp:
2767
for client in tcp_server.clients.itervalues():
2768
key = client_settings[client.name]["secret"]
2769
client.encrypted_secret = pgp.encrypt(client.secret,
2773
# A list of attributes that can not be pickled
2775
exclude = { "bus", "changedstate", "secret",
2776
"checker", "server_settings" }
2777
for name, typ in (inspect.getmembers
2778
(dbus.service.Object)):
2781
client_dict["encrypted_secret"] = (client
2783
for attr in client.client_structure:
2784
if attr not in exclude:
2785
client_dict[attr] = getattr(client, attr)
2787
clients[client.name] = client_dict
2788
del client_settings[client.name]["secret"]
2791
with (tempfile.NamedTemporaryFile
2792
(mode='wb', suffix=".pickle", prefix='clients-',
2793
dir=os.path.dirname(stored_state_path),
2794
delete=False)) as stored_state:
2795
pickle.dump((clients, client_settings), stored_state)
2796
tempname=stored_state.name
2797
os.rename(tempname, stored_state_path)
2798
except (IOError, OSError) as e:
2804
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2805
logger.warning("Could not save persistent state: {}"
2806
.format(os.strerror(e.errno)))
2808
logger.warning("Could not save persistent state:",
2812
# Delete all clients, and settings from config
2813
2140
while tcp_server.clients:
2814
name, client = tcp_server.clients.popitem()
2141
client = tcp_server.clients.pop()
2816
2143
client.remove_from_connection()
2144
client.disable_hook = None
2817
2145
# Don't signal anything except ClientRemoved
2818
2146
client.disable(quiet=True)