/mandos/trunk : revision 505.1.4

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

66

70

67

import dbus

71

68

import dbus.service

76

73

import ctypes.util

77

74

import xml.dom.minidom

78

75

import inspect

79

import GnuPGInterface

80

76

81

77

try:

82

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

86

82

except ImportError:

87

83

SO_BINDTODEVICE = None

88

84

89

version = "1.5.3"

90

stored_state_file = "clients.pickle"

91

92

logger = logging.getLogger()

85

86

version = "1.3.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

93

90

syslogger = (logging.handlers.SysLogHandler

94

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

92

address = str("/dev/log")))

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(debug, level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

if debug:

123

console = logging.StreamHandler()

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

125

' [%(process)d]:'

126

' %(levelname)s:'

127

' %(message)s'))

128

logger.addHandler(console)

129

logger.setLevel(level)

130

131

132

class PGPError(Exception):

133

"""Exception if encryption/decryption fails"""

134

pass

135

136

137

class PGPEngine(object):

138

"""A simple class for OpenPGP symmetric encryption & decryption"""

139

def __init__(self):

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.gnupg.options.meta_interactive = False

144

self.gnupg.options.homedir = self.tempdir

145

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

148

149

def __enter__(self):

150

return self

151

152

def __exit__ (self, exc_type, exc_value, traceback):

153

self._cleanup()

154

return False

155

156

def __del__(self):

157

self._cleanup()

158

159

def _cleanup(self):

160

if self.tempdir is not None:

161

# Delete contents of tempdir

162

for root, dirs, files in os.walk(self.tempdir,

163

topdown = False):

164

for filename in files:

165

os.remove(os.path.join(root, filename))

166

for dirname in dirs:

167

os.rmdir(os.path.join(root, dirname))

168

# Remove tempdir

169

os.rmdir(self.tempdir)

170

self.tempdir = None

171

172

def password_encode(self, password):

173

# Passphrase can not be empty and can not contain newlines or

174

# NUL bytes. So we prefix it and hex encode it.

175

return b"mandos" + binascii.hexlify(password)

176

177

def encrypt(self, data, password):

178

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

180

try:

181

proc = self.gnupg.run(['--symmetric'],

182

create_fhs=['stdin', 'stdout'],

183

attach_fhs={'stderr': devnull})

184

with contextlib.closing(proc.handles['stdin']) as f:

185

f.write(data)

186

with contextlib.closing(proc.handles['stdout']) as f:

187

ciphertext = f.read()

188

proc.wait()

189

except IOError as e:

190

raise PGPError(e)

191

self.gnupg.passphrase = None

192

return ciphertext

193

194

def decrypt(self, data, password):

195

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

197

try:

198

proc = self.gnupg.run(['--decrypt'],

199

create_fhs=['stdin', 'stdout'],

200

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

202

f.write(data)

203

with contextlib.closing(proc.handles['stdout']) as f:

204

decrypted_plaintext = f.read()

205

proc.wait()

206

except IOError as e:

207

raise PGPError(e)

208

self.gnupg.passphrase = None

209

return decrypted_plaintext

210

211

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

212

103

213

104

class AvahiError(Exception):

214

105

def __init__(self, value, *args, **kwargs):

273

164

.GetAlternativeServiceName(self.name))

274

165

logger.info("Changing Zeroconf service name to %r ...",

275

166

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

276

171

self.remove()

277

172

try:

278

173

self.add()

298

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

299

194

self.entry_group_state_changed_match = (

300

195

self.group.connect_to_signal(

301

'StateChanged', self.entry_group_state_changed))

196

'StateChanged', self .entry_group_state_changed))

302

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

303

198

self.name, self.type)

304

199

self.group.AddService(

330

225

try:

331

226

self.group.Free()

332

227

except (dbus.exceptions.UnknownMethodException,

333

dbus.exceptions.DBusException):

228

dbus.exceptions.DBusException) as e:

334

229

pass

335

230

self.group = None

336

231

self.remove()

370

265

self.server_state_changed)

371

266

self.server_state_changed(self.server.GetState())

372

267

373

class AvahiServiceToSyslog(AvahiService):

374

def rename(self):

375

"""Add the new name to the syslog messages"""

376

ret = AvahiService.rename(self)

377

syslogger.setFormatter(logging.Formatter

378

('Mandos (%s) [%%(process)d]:'

379

' %%(levelname)s: %%(message)s'

380

% self.name))

381

return ret

382

268

383

def timedelta_to_milliseconds(td):

269

def _timedelta_to_milliseconds(td):

384

270

"Convert a datetime.timedelta() to milliseconds"

385

271

return ((td.days * 24 * 60 * 60 * 1000)

386

272

+ (td.seconds * 1000)

390

276

"""A representation of a client host served by this server.

391

277

392

278

Attributes:

393

approved: bool(); 'None' if not yet approved/disapproved

279

_approved: bool(); 'None' if not yet approved/disapproved

394

280

approval_delay: datetime.timedelta(); Time to wait for approval

395

281

approval_duration: datetime.timedelta(); Duration of one approval

396

282

checker: subprocess.Popen(); a running checker process used

403

289

instance %(name)s can be used in the command.

404

290

checker_initiator_tag: a gobject event source tag, or None

405

291

created: datetime.datetime(); (UTC) object creation

406

client_structure: Object describing what attributes a client has

407

and is used for storing the client at exit

408

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

409

294

disable_initiator_tag: a gobject event source tag, or None

410

295

enabled: bool()

411

296

fingerprint: string (40 or 32 hexadecimal digits); used to

414

299

interval: datetime.timedelta(); How often to start a new checker

415

300

last_approval_request: datetime.datetime(); (UTC) or None

416

301

last_checked_ok: datetime.datetime(); (UTC) or None

417

last_checker_status: integer between 0 and 255 reflecting exit

418

status of last checker. -1 reflects crashed

419

checker, -2 means no checker completed yet.

420

last_enabled: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

421

303

name: string; from the config file, used in log messages and

422

304

D-Bus identifiers

423

305

secret: bytestring; sent verbatim (over TLS) to client

424

306

timeout: datetime.timedelta(); How long from last_checked_ok

425

307

until this client is disabled

426

extended_timeout: extra long timeout when secret has been sent

308

extended_timeout: extra long timeout when password has been sent

427

309

runtime_expansions: Allowed attributes for runtime expansion.

428

310

expires: datetime.datetime(); time (UTC) when a client will be

429

311

disabled, or None

433

315

"created", "enabled", "fingerprint",

434

316

"host", "interval", "last_checked_ok",

435

317

"last_enabled", "name", "timeout")

436

client_defaults = { "timeout": "5m",

437

"extended_timeout": "15m",

438

"interval": "2m",

439

"checker": "fping -q -- %%(host)s",

440

"host": "",

441

"approval_delay": "0s",

442

"approval_duration": "1s",

443

"approved_by_default": "True",

444

"enabled": "True",

445

}

446

318

447

319

def timeout_milliseconds(self):

448

320

"Return the 'timeout' attribute in milliseconds"

449

return timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

450

322

451

323

def extended_timeout_milliseconds(self):

452

324

"Return the 'extended_timeout' attribute in milliseconds"

453

return timedelta_to_milliseconds(self.extended_timeout)

325

return _timedelta_to_milliseconds(self.extended_timeout)

454

326

455

327

def interval_milliseconds(self):

456

328

"Return the 'interval' attribute in milliseconds"

457

return timedelta_to_milliseconds(self.interval)

329

return _timedelta_to_milliseconds(self.interval)

458

330

459

331

def approval_delay_milliseconds(self):

460

return timedelta_to_milliseconds(self.approval_delay)

461

462

@staticmethod

463

def config_parser(config):

464

"""Construct a new dict of client settings of this form:

465

{ client_name: {setting_name: value, ...}, ...}

466

with exceptions for any special settings as defined above.

467

NOTE: Must be a pure function. Must return the same result

468

value given the same arguments.

469

"""

470

settings = {}

471

for client_name in config.sections():

472

section = dict(config.items(client_name))

473

client = settings[client_name] = {}

474

475

client["host"] = section["host"]

476

# Reformat values from string types to Python types

477

client["approved_by_default"] = config.getboolean(

478

client_name, "approved_by_default")

479

client["enabled"] = config.getboolean(client_name,

480

"enabled")

481

482

client["fingerprint"] = (section["fingerprint"].upper()

483

.replace(" ", ""))

484

if "secret" in section:

485

client["secret"] = section["secret"].decode("base64")

486

elif "secfile" in section:

487

with open(os.path.expanduser(os.path.expandvars

488

(section["secfile"])),

489

"rb") as secfile:

490

client["secret"] = secfile.read()

491

else:

492

raise TypeError("No secret or secfile for section %s"

493

% section)

494

client["timeout"] = string_to_delta(section["timeout"])

495

client["extended_timeout"] = string_to_delta(

496

section["extended_timeout"])

497

client["interval"] = string_to_delta(section["interval"])

498

client["approval_delay"] = string_to_delta(

499

section["approval_delay"])

500

client["approval_duration"] = string_to_delta(

501

section["approval_duration"])

502

client["checker_command"] = section["checker"]

503

client["last_approval_request"] = None

504

client["last_checked_ok"] = None

505

client["last_checker_status"] = -2

506

507

return settings

508

509

510

def __init__(self, settings, name = None):

332

return _timedelta_to_milliseconds(self.approval_delay)

333

334

def __init__(self, name = None, disable_hook=None, config=None):

511

335

"""Note: the 'checker' key in 'config' sets the

512

336

'checker_command' attribute and *not* the 'checker'

513

337

attribute."""

514

338

self.name = name

515

# adding all client settings

516

for setting, value in settings.iteritems():

517

setattr(self, setting, value)

518

519

if self.enabled:

520

if not hasattr(self, "last_enabled"):

521

self.last_enabled = datetime.datetime.utcnow()

522

if not hasattr(self, "expires"):

523

self.expires = (datetime.datetime.utcnow()

524

+ self.timeout)

525

else:

526

self.last_enabled = None

527

self.expires = None

528

339

if config is None:

340

config = {}

529

341

logger.debug("Creating client %r", self.name)

530

342

# Uppercase and remove spaces from fingerprint for later

531

343

# comparison purposes with return value from the fingerprint()

532

344

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

533

347

logger.debug(" Fingerprint: %s", self.fingerprint)

534

self.created = settings.get("created",

535

datetime.datetime.utcnow())

536

537

# attributes specific for this server instance

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

351

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

353

"rb") as secfile:

354

self.secret = secfile.read()

355

else:

356

raise TypeError("No secret or secfile for client %s"

357

% self.name)

358

self.host = config.get("host", "")

359

self.created = datetime.datetime.utcnow()

360

self.enabled = False

361

self.last_approval_request = None

362

self.last_enabled = None

363

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

538

369

self.checker = None

539

370

self.checker_initiator_tag = None

540

371

self.disable_initiator_tag = None

372

self.expires = None

541

373

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

542

375

self.current_checker_command = None

543

self.approved = None

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

544

380

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

545

385

self.changedstate = (multiprocessing_manager

546

386

.Condition(multiprocessing_manager

547

387

.Lock()))

548

self.client_structure = [attr for attr in

549

self.__dict__.iterkeys()

550

if not attr.startswith("_")]

551

self.client_structure.append("client_structure")

552

553

for name, t in inspect.getmembers(type(self),

554

lambda obj:

555

isinstance(obj,

556

property)):

557

if not name.startswith("_"):

558

self.client_structure.append(name)

559

388

560

# Send notice to process children that client state has changed

561

389

def send_changedstate(self):

562

with self.changedstate:

563

self.changedstate.notify_all()

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

564

393

565

394

def enable(self):

566

395

"""Start this client's checker and timeout hooks"""

568

397

# Already enabled

569

398

return

570

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

571

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

572

410

self.enabled = True

573

411

self.last_enabled = datetime.datetime.utcnow()

574

self.init_checker()

412

# Also start a new checker *right now*.

413

self.start_checker()

575

414

576

415

def disable(self, quiet=True):

577

416

"""Disable this client."""

589

428

gobject.source_remove(self.checker_initiator_tag)

590

429

self.checker_initiator_tag = None

591

430

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

592

433

self.enabled = False

593

434

# Do not run this again if called by a gobject.timeout_add

594

435

return False

595

436

596

437

def __del__(self):

438

self.disable_hook = None

597

439

self.disable()

598

440

599

def init_checker(self):

600

# Schedule a new checker to be started an 'interval' from now,

601

# and every interval from then on.

602

self.checker_initiator_tag = (gobject.timeout_add

603

(self.interval_milliseconds(),

604

self.start_checker))

605

# Schedule a disable() when 'timeout' has passed

606

self.disable_initiator_tag = (gobject.timeout_add

607

(self.timeout_milliseconds(),

608

self.disable))

609

# Also start a new checker *right now*.

610

self.start_checker()

611

612

441

def checker_callback(self, pid, condition, command):

613

442

"""The checker has completed, so take appropriate actions."""

614

443

self.checker_callback_tag = None

615

444

self.checker = None

616

445

if os.WIFEXITED(condition):

617

self.last_checker_status = os.WEXITSTATUS(condition)

618

if self.last_checker_status == 0:

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

619

448

logger.info("Checker for %(name)s succeeded",

620

449

vars(self))

621

450

self.checked_ok()

623

452

logger.info("Checker for %(name)s failed",

624

453

vars(self))

625

454

else:

626

self.last_checker_status = -1

627

455

logger.warning("Checker for %(name)s crashed?",

628

456

vars(self))

629

457

630

def checked_ok(self):

631

"""Assert that the client has been seen, alive and well."""

632

self.last_checked_ok = datetime.datetime.utcnow()

633

self.last_checker_status = 0

634

self.bump_timeout()

635

636

def bump_timeout(self, timeout=None):

637

"""Bump up the timeout for this client."""

458

def checked_ok(self, timeout=None):

459

"""Bump up the timeout for this client.

460

461

This should only be called when the client has been seen,

462

alive and well.

463

"""

638

464

if timeout is None:

639

465

timeout = self.timeout

640

if self.disable_initiator_tag is not None:

641

gobject.source_remove(self.disable_initiator_tag)

642

if getattr(self, "enabled", False):

643

self.disable_initiator_tag = (gobject.timeout_add

644

(timedelta_to_milliseconds

645

(timeout), self.disable))

646

self.expires = datetime.datetime.utcnow() + timeout

466

self.last_checked_ok = datetime.datetime.utcnow()

467

gobject.source_remove(self.disable_initiator_tag)

468

self.expires = datetime.datetime.utcnow() + timeout

469

self.disable_initiator_tag = (gobject.timeout_add

470

(_timedelta_to_milliseconds

471

(timeout), self.disable))

647

472

648

473

def need_approval(self):

649

474

self.last_approval_request = datetime.datetime.utcnow()

772

597

return decorator

773

598

774

599

775

def dbus_interface_annotations(dbus_interface):

776

"""Decorator for marking functions returning interface annotations.

777

778

Usage:

779

780

@dbus_interface_annotations("org.example.Interface")

781

def _foo(self): # Function name does not matter

782

return {"org.freedesktop.DBus.Deprecated": "true",

783

"org.freedesktop.DBus.Property.EmitsChangedSignal":

784

"false"}

785

"""

786

def decorator(func):

787

func._dbus_is_interface = True

788

func._dbus_interface = dbus_interface

789

func._dbus_name = dbus_interface

790

return func

791

return decorator

792

793

794

600

class DBusPropertyException(dbus.exceptions.DBusException):

795

601

"""A base class for D-Bus property-related exceptions

796

602

"""

819

625

"""

820

626

821

627

@staticmethod

822

def _is_dbus_thing(thing):

823

"""Returns a function testing if an attribute is a D-Bus thing

824

825

If called like _is_dbus_thing("method") it returns a function

826

suitable for use as predicate to inspect.getmembers().

827

"""

828

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

829

False)

628

def _is_dbus_property(obj):

629

return getattr(obj, "_dbus_is_property", False)

830

630

831

def _get_all_dbus_things(self, thing):

631

def _get_all_dbus_properties(self):

832

632

"""Returns a generator of (name, attribute) pairs

833

633

"""

834

return ((athing.__get__(self)._dbus_name,

835

athing.__get__(self))

634

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

836

635

for cls in self.__class__.__mro__

837

for name, athing in

838

inspect.getmembers(cls,

839

self._is_dbus_thing(thing)))

636

for name, prop in

637

inspect.getmembers(cls, self._is_dbus_property))

840

638

841

639

def _get_dbus_property(self, interface_name, property_name):

842

640

"""Returns a bound method if one exists which is a D-Bus

844

642

"""

845

643

for cls in self.__class__.__mro__:

846

644

for name, value in (inspect.getmembers

847

(cls,

848

self._is_dbus_thing("property"))):

645

(cls, self._is_dbus_property)):

849

646

if (value._dbus_name == property_name

850

647

and value._dbus_interface == interface_name):

851

648

return value.__get__(self)

880

677

# signatures other than "ay".

881

678

if prop._dbus_signature != "ay":

882

679

raise ValueError

883

value = dbus.ByteArray(b''.join(chr(byte)

884

for byte in value))

680

value = dbus.ByteArray(''.join(unichr(byte)

681

for byte in value))

885

682

prop(value)

886

683

887

684

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

892

689

893

690

Note: Will not include properties with access="write".

894

691

"""

895

properties = {}

896

for name, prop in self._get_all_dbus_things("property"):

692

all = {}

693

for name, prop in self._get_all_dbus_properties():

897

694

if (interface_name

898

695

and interface_name != prop._dbus_interface):

899

696

# Interface non-empty but did not match

903

700

continue

904

701

value = prop()

905

702

if not hasattr(value, "variant_level"):

906

properties[name] = value

703

all[name] = value

907

704

continue

908

properties[name] = type(value)(value, variant_level=

909

value.variant_level+1)

910

return dbus.Dictionary(properties, signature="sv")

705

all[name] = type(value)(value, variant_level=

706

value.variant_level+1)

707

return dbus.Dictionary(all, signature="sv")

911

708

912

709

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

913

710

out_signature="s",

914

711

path_keyword='object_path',

915

712

connection_keyword='connection')

916

713

def Introspect(self, object_path, connection):

917

"""Overloading of standard D-Bus method.

918

919

Inserts property tags and interface annotation tags.

714

"""Standard D-Bus method, overloaded to insert property tags.

920

715

"""

921

716

xmlstring = dbus.service.Object.Introspect(self, object_path,

922

717

connection)

929

724

e.setAttribute("access", prop._dbus_access)

930

725

return e

931

726

for if_tag in document.getElementsByTagName("interface"):

932

# Add property tags

933

727

for tag in (make_tag(document, name, prop)

934

728

for name, prop

935

in self._get_all_dbus_things("property")

729

in self._get_all_dbus_properties()

936

730

if prop._dbus_interface

937

731

== if_tag.getAttribute("name")):

938

732

if_tag.appendChild(tag)

939

# Add interface annotation tags

940

for annotation, value in dict(

941

itertools.chain(

942

*(annotations().iteritems()

943

for name, annotations in

944

self._get_all_dbus_things("interface")

945

if name == if_tag.getAttribute("name")

946

))).iteritems():

947

attr_tag = document.createElement("annotation")

948

attr_tag.setAttribute("name", annotation)

949

attr_tag.setAttribute("value", value)

950

if_tag.appendChild(attr_tag)

951

733

# Add the names to the return values for the

952

734

# "org.freedesktop.DBus.Properties" methods

953

735

if (if_tag.getAttribute("name")

979

761

return dbus.String(dt.isoformat(),

980

762

variant_level=variant_level)

981

763

982

983

764

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

984

765

.__metaclass__):

985

766

"""Applied to an empty subclass of a D-Bus object, this metaclass

988

769

def __new__(mcs, name, bases, attr):

989

770

# Go through all the base classes which could have D-Bus

990

771

# methods, signals, or properties in them

991

old_interface_names = []

992

772

for base in (b for b in bases

993

773

if issubclass(b, dbus.service.Object)):

994

774

# Go though all attributes of the base class

1004

784

alt_interface = (attribute._dbus_interface

1005

785

.replace("se.recompile.Mandos",

1006

786

"se.bsnet.fukt.Mandos"))

1007

if alt_interface != attribute._dbus_interface:

1008

old_interface_names.append(alt_interface)

1009

787

# Is this a D-Bus signal?

1010

788

if getattr(attribute, "_dbus_is_signal", False):

1011

789

# Extract the original non-method function by

1078

856

attribute.func_name,

1079

857

attribute.func_defaults,

1080

858

attribute.func_closure)))

1081

# Is this a D-Bus interface?

1082

elif getattr(attribute, "_dbus_is_interface", False):

1083

# Create a new, but exactly alike, function

1084

# object. Decorate it to be a new D-Bus interface

1085

# with the alternate D-Bus interface name. Add it

1086

# to the class.

1087

attr[attrname] = (dbus_interface_annotations

1088

(alt_interface)

1089

(types.FunctionType

1090

(attribute.func_code,

1091

attribute.func_globals,

1092

attribute.func_name,

1093

attribute.func_defaults,

1094

attribute.func_closure)))

1095

# Deprecate all old interfaces

1096

basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1097

for old_interface_name in old_interface_names:

1098

@dbus_interface_annotations(old_interface_name)

1099

def func(self):

1100

return { "org.freedesktop.DBus.Deprecated": "true" }

1101

# Find an unused name

1102

for aname in (basename.format(i) for i in

1103

itertools.count()):

1104

if aname not in attr:

1105

attr[aname] = func

1106

break

1107

859

return type.__new__(mcs, name, bases, attr)

1108

860

1109

1110

861

class ClientDBus(Client, DBusObjectWithProperties):

1111

862

"""A Client class using D-Bus

1112

863

1121

872

# dbus.service.Object doesn't use super(), so we can't either.

1122

873

1123

874

def __init__(self, bus = None, *args, **kwargs):

875

self._approvals_pending = 0

1124

876

self.bus = bus

1125

877

Client.__init__(self, *args, **kwargs)

1126

878

# Only now, when this client is initialized, can it show up on

1138

890

variant_level=1):

1139

891

""" Modify a variable so that it's a property which announces

1140

892

its changes to DBus.

1141

1142

transform_fun: Function that takes a value and a variant_level

1143

and transforms it to a D-Bus type.

893

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

1144

896

dbus_name: D-Bus name of the variable

1145

897

type_func: Function that transform the value before sending it

1146

898

to the D-Bus. Default: no transform

1147

899

variant_level: D-Bus variant level. Default: 1

1148

900

"""

1149

attrname = "_{0}".format(dbus_name)

901

real_value = [None,]

1150

902

def setter(self, value):

903

old_value = real_value[0]

904

real_value[0] = value

1151

905

if hasattr(self, "dbus_object_path"):

1152

if (not hasattr(self, attrname) or

1153

type_func(getattr(self, attrname, None))

1154

!= type_func(value)):

1155

dbus_value = transform_func(type_func(value),

1156

variant_level

1157

=variant_level)

906

if type_func(old_value) != type_func(real_value[0]):

907

dbus_value = transform_func(type_func

908

(real_value[0]),

909

variant_level)

1158

910

self.PropertyChanged(dbus.String(dbus_name),

1159

911

dbus_value)

1160

setattr(self, attrname, value)

1161

912

1162

return property(lambda self: getattr(self, attrname), setter)

913

return property(lambda self: real_value[0], setter)

1163

914

1164

915

1165

916

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1174

925

checker is not None)

1175

926

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1176

927

"LastCheckedOK")

1177

last_checker_status = notifychangeproperty(dbus.Int16,

1178

"LastCheckerStatus")

1179

928

last_approval_request = notifychangeproperty(

1180

929

datetime_to_dbus, "LastApprovalRequest")

1181

930

approved_by_default = notifychangeproperty(dbus.Boolean,

1182

931

"ApprovedByDefault")

1183

approval_delay = notifychangeproperty(dbus.UInt64,

932

approval_delay = notifychangeproperty(dbus.UInt16,

1184

933

"ApprovalDelay",

1185

934

type_func =

1186

timedelta_to_milliseconds)

935

_timedelta_to_milliseconds)

1187

936

approval_duration = notifychangeproperty(

1188

dbus.UInt64, "ApprovalDuration",

1189

type_func = timedelta_to_milliseconds)

937

dbus.UInt16, "ApprovalDuration",

938

type_func = _timedelta_to_milliseconds)

1190

939

host = notifychangeproperty(dbus.String, "Host")

1191

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

940

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1192

941

type_func =

1193

timedelta_to_milliseconds)

942

_timedelta_to_milliseconds)

1194

943

extended_timeout = notifychangeproperty(

1195

dbus.UInt64, "ExtendedTimeout",

1196

type_func = timedelta_to_milliseconds)

1197

interval = notifychangeproperty(dbus.UInt64,

944

dbus.UInt16, "ExtendedTimeout",

945

type_func = _timedelta_to_milliseconds)

946

interval = notifychangeproperty(dbus.UInt16,

1198

947

"Interval",

1199

948

type_func =

1200

timedelta_to_milliseconds)

949

_timedelta_to_milliseconds)

1201

950

checker_command = notifychangeproperty(dbus.String, "Checker")

1202

951

1203

952

del notifychangeproperty

1245

994

return r

1246

995

1247

996

def _reset_approved(self):

1248

self.approved = None

997

self._approved = None

1249

998

return False

1250

999

1251

1000

def approve(self, value=True):

1252

1001

self.send_changedstate()

1253

self.approved = value

1254

gobject.timeout_add(timedelta_to_milliseconds

1002

self._approved = value

1003

gobject.timeout_add(_timedelta_to_milliseconds

1255

1004

(self.approval_duration),

1256

1005

self._reset_approved)

1257

1006

1259

1008

## D-Bus methods, signals & properties

1260

1009

_interface = "se.recompile.Mandos.Client"

1261

1010

1262

## Interfaces

1263

1264

@dbus_interface_annotations(_interface)

1265

def _foo(self):

1266

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1267

"false"}

1268

1269

1011

## Signals

1270

1012

1271

1013

# CheckerCompleted - signal

1370

1112

access="readwrite")

1371

1113

def ApprovalDuration_dbus_property(self, value=None):

1372

1114

if value is None: # get

1373

return dbus.UInt64(timedelta_to_milliseconds(

1115

return dbus.UInt64(_timedelta_to_milliseconds(

1374

1116

self.approval_duration))

1375

1117

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1376

1118

1390

1132

def Host_dbus_property(self, value=None):

1391

1133

if value is None: # get

1392

1134

return dbus.String(self.host)

1393

self.host = unicode(value)

1135

self.host = value

1394

1136

1395

1137

# Created - property

1396

1138

@dbus_service_property(_interface, signature="s", access="read")

1397

1139

def Created_dbus_property(self):

1398

return datetime_to_dbus(self.created)

1140

return dbus.String(datetime_to_dbus(self.created))

1399

1141

1400

1142

# LastEnabled - property

1401

1143

@dbus_service_property(_interface, signature="s", access="read")

1422

1164

return

1423

1165

return datetime_to_dbus(self.last_checked_ok)

1424

1166

1425

# LastCheckerStatus - property

1426

@dbus_service_property(_interface, signature="n",

1427

access="read")

1428

def LastCheckerStatus_dbus_property(self):

1429

return dbus.Int16(self.last_checker_status)

1430

1431

1167

# Expires - property

1432

1168

@dbus_service_property(_interface, signature="s", access="read")

1433

1169

def Expires_dbus_property(self):

1445

1181

if value is None: # get

1446

1182

return dbus.UInt64(self.timeout_milliseconds())

1447

1183

self.timeout = datetime.timedelta(0, 0, 0, value)

1184

if getattr(self, "disable_initiator_tag", None) is None:

1185

return

1448

1186

# Reschedule timeout

1449

if self.enabled:

1450

now = datetime.datetime.utcnow()

1451

time_to_die = timedelta_to_milliseconds(

1452

(self.last_checked_ok + self.timeout) - now)

1453

if time_to_die <= 0:

1454

# The timeout has passed

1455

self.disable()

1456

else:

1457

self.expires = (now +

1458

datetime.timedelta(milliseconds =

1459

time_to_die))

1460

if (getattr(self, "disable_initiator_tag", None)

1461

is None):

1462

return

1463

gobject.source_remove(self.disable_initiator_tag)

1464

self.disable_initiator_tag = (gobject.timeout_add

1465

(time_to_die,

1466

self.disable))

1187

gobject.source_remove(self.disable_initiator_tag)

1188

self.disable_initiator_tag = None

1189

self.expires = None

1190

time_to_die = (self.

1191

_timedelta_to_milliseconds((self

1192

.last_checked_ok

1193

+ self.timeout)

1194

- datetime.datetime

1195

.utcnow()))

1196

if time_to_die <= 0:

1197

# The timeout has passed

1198

self.disable()

1199

else:

1200

self.expires = (datetime.datetime.utcnow()

1201

+ datetime.timedelta(milliseconds =

1202

time_to_die))

1203

self.disable_initiator_tag = (gobject.timeout_add

1204

(time_to_die, self.disable))

1467

1205

1468

1206

# ExtendedTimeout - property

1469

1207

@dbus_service_property(_interface, signature="t",

1482

1220

self.interval = datetime.timedelta(0, 0, 0, value)

1483

1221

if getattr(self, "checker_initiator_tag", None) is None:

1484

1222

return

1485

if self.enabled:

1486

# Reschedule checker run

1487

gobject.source_remove(self.checker_initiator_tag)

1488

self.checker_initiator_tag = (gobject.timeout_add

1489

(value, self.start_checker))

1490

self.start_checker() # Start one now, too

1223

# Reschedule checker run

1224

gobject.source_remove(self.checker_initiator_tag)

1225

self.checker_initiator_tag = (gobject.timeout_add

1226

(value, self.start_checker))

1227

self.start_checker() # Start one now, too

1491

1228

1492

1229

# Checker - property

1493

1230

@dbus_service_property(_interface, signature="s",

1495

1232

def Checker_dbus_property(self, value=None):

1496

1233

if value is None: # get

1497

1234

return dbus.String(self.checker_command)

1498

self.checker_command = unicode(value)

1235

self.checker_command = value

1499

1236

1500

1237

# CheckerRunning - property

1501

1238

@dbus_service_property(_interface, signature="b",

1530

1267

raise KeyError()

1531

1268

1532

1269

def __getattribute__(self, name):

1533

if name == '_pipe':

1270

if(name == '_pipe'):

1534

1271

return super(ProxyClient, self).__getattribute__(name)

1535

1272

self._pipe.send(('getattr', name))

1536

1273

data = self._pipe.recv()

1543

1280

return func

1544

1281

1545

1282

def __setattr__(self, name, value):

1546

if name == '_pipe':

1283

if(name == '_pipe'):

1547

1284

return super(ProxyClient, self).__setattr__(name, value)

1548

1285

self._pipe.send(('setattr', name, value))

1549

1286

1550

1551

1287

class ClientDBusTransitional(ClientDBus):

1552

1288

__metaclass__ = AlternateDBusNamesMetaclass

1553

1289

1554

1555

1290

class ClientHandler(socketserver.BaseRequestHandler, object):

1556

1291

"""A class to handle client connections.

1557

1292

1639

1374

client.Rejected("Disabled")

1640

1375

return

1641

1376

1642

if client.approved or not client.approval_delay:

1377

if client._approved or not client.approval_delay:

1643

1378

#We are approved or approval is disabled

1644

1379

break

1645

elif client.approved is None:

1380

elif client._approved is None:

1646

1381

logger.info("Client %s needs approval",

1647

1382

client.name)

1648

1383

if self.server.use_dbus:

1659

1394

return

1660

1395

1661

1396

#wait until timeout or approved

1397

#x = float(client

1398

# ._timedelta_to_milliseconds(delay))

1662

1399

time = datetime.datetime.now()

1663

1400

client.changedstate.acquire()

1664

1401

(client.changedstate.wait

1665

(float(client.timedelta_to_milliseconds(delay)

1402

(float(client._timedelta_to_milliseconds(delay)

1666

1403

/ 1000)))

1667

1404

client.changedstate.release()

1668

1405

time2 = datetime.datetime.now()

1693

1430

sent_size += sent

1694

1431

1695

1432

logger.info("Sending secret to %s", client.name)

1696

# bump the timeout using extended_timeout

1697

client.bump_timeout(client.extended_timeout)

1433

# bump the timeout as if seen

1434

client.checked_ok(client.extended_timeout)

1698

1435

if self.server.use_dbus:

1699

1436

# Emit D-Bus signal

1700

1437

client.GotSecret()

1767

1504

# Convert the buffer to a Python bytestring

1768

1505

fpr = ctypes.string_at(buf, buf_len.value)

1769

1506

# Convert the bytestring to hexadecimal notation

1770

hex_fpr = binascii.hexlify(fpr).upper()

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1771

1508

return hex_fpr

1772

1509

1773

1510

1776

1513

def sub_process_main(self, request, address):

1777

1514

try:

1778

1515

self.finish_request(request, address)

1779

except Exception:

1516

except:

1780

1517

self.handle_error(request, address)

1781

1518

self.close_request(request)

1782

1519

1783

1520

def process_request(self, request, address):

1784

1521

"""Start a new process to process the request."""

1785

proc = multiprocessing.Process(target = self.sub_process_main,

1786

args = (request,

1787

address))

1788

proc.start()

1789

return proc

1522

multiprocessing.Process(target = self.sub_process_main,

1523

args = (request, address)).start()

1790

1524

1791

1525

1792

1526

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1798

1532

"""

1799

1533

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1800

1534

1801

proc = MultiprocessingMixIn.process_request(self, request,

1802

client_address)

1535

super(MultiprocessingMixInWithPipe,

1536

self).process_request(request, client_address)

1803

1537

self.child_pipe.close()

1804

self.add_pipe(parent_pipe, proc)

1538

self.add_pipe(parent_pipe)

1805

1539

1806

def add_pipe(self, parent_pipe, proc):

1540

def add_pipe(self, parent_pipe):

1807

1541

"""Dummy function; override as necessary"""

1808

1542

raise NotImplementedError

1809

1543

1887

1621

self.enabled = False

1888

1622

self.clients = clients

1889

1623

if self.clients is None:

1890

self.clients = {}

1624

self.clients = set()

1891

1625

self.use_dbus = use_dbus

1892

1626

self.gnutls_priority = gnutls_priority

1893

1627

IPv6_TCPServer.__init__(self, server_address,

1897

1631

def server_activate(self):

1898

1632

if self.enabled:

1899

1633

return socketserver.TCPServer.server_activate(self)

1900

1901

1634

def enable(self):

1902

1635

self.enabled = True

1903

1904

def add_pipe(self, parent_pipe, proc):

1636

def add_pipe(self, parent_pipe):

1905

1637

# Call "handle_ipc" for both data and EOF events

1906

1638

gobject.io_add_watch(parent_pipe.fileno(),

1907

1639

gobject.IO_IN | gobject.IO_HUP,

1908

1640

functools.partial(self.handle_ipc,

1909

1641

parent_pipe =

1910

parent_pipe,

1911

proc = proc))

1912

1642

parent_pipe))

1643

1913

1644

def handle_ipc(self, source, condition, parent_pipe=None,

1914

proc = None, client_object=None):

1645

client_object=None):

1915

1646

condition_names = {

1916

1647

gobject.IO_IN: "IN", # There is data to read.

1917

1648

gobject.IO_OUT: "OUT", # Data can be written (without

1926

1657

for cond, name in

1927

1658

condition_names.iteritems()

1928

1659

if cond & condition)

1929

# error, or the other end of multiprocessing.Pipe has closed

1660

# error or the other end of multiprocessing.Pipe has closed

1930

1661

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1931

# Wait for other process to exit

1932

proc.join()

1933

1662

return False

1934

1663

1935

1664

# Read a request from the child

1940

1669

fpr = request[1]

1941

1670

address = request[2]

1942

1671

1943

for c in self.clients.itervalues():

1672

for c in self.clients:

1944

1673

if c.fingerprint == fpr:

1945

1674

client = c

1946

1675

break

1959

1688

functools.partial(self.handle_ipc,

1960

1689

parent_pipe =

1961

1690

parent_pipe,

1962

proc = proc,

1963

1691

client_object =

1964

1692

client))

1965

1693

parent_pipe.send(True)

2030

1758

return timevalue

2031

1759

2032

1760

1761

def if_nametoindex(interface):

1762

"""Call the C function if_nametoindex(), or equivalent

1763

1764

Note: This function cannot accept a unicode string."""

1765

global if_nametoindex

1766

try:

1767

if_nametoindex = (ctypes.cdll.LoadLibrary

1768

(ctypes.util.find_library("c"))

1769

.if_nametoindex)

1770

except (OSError, AttributeError):

1771

logger.warning("Doing if_nametoindex the hard way")

1772

def if_nametoindex(interface):

1773

"Get an interface index the hard way, i.e. using fcntl()"

1774

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1775

with contextlib.closing(socket.socket()) as s:

1776

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1777

struct.pack(str("16s16x"),

1778

interface))

1779

interface_index = struct.unpack(str("I"),

1780

ifreq[16:20])[0]

1781

return interface_index

1782

return if_nametoindex(interface)

1783

1784

2033

1785

def daemon(nochdir = False, noclose = False):

2034

1786

"""See daemon(3). Standard BSD Unix function.

2035

1787

2043

1795

sys.exit()

2044

1796

if not noclose:

2045

1797

# Close all standard open file descriptors

2046

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1798

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2047

1799

if not stat.S_ISCHR(os.fstat(null).st_mode):

2048

1800

raise OSError(errno.ENODEV,

2049

1801

"%s not a character device"

2050

% os.devnull)

1802

% os.path.devnull)

2051

1803

os.dup2(null, sys.stdin.fileno())

2052

1804

os.dup2(null, sys.stdout.fileno())

2053

1805

os.dup2(null, sys.stderr.fileno())

2090

1842

" system bus interface")

2091

1843

parser.add_argument("--no-ipv6", action="store_false",

2092

1844

dest="use_ipv6", help="Do not use IPv6")

2093

parser.add_argument("--no-restore", action="store_false",

2094

dest="restore", help="Do not restore stored"

2095

" state")

2096

parser.add_argument("--statedir", metavar="DIR",

2097

help="Directory to save/restore state in")

2098

2099

1845

options = parser.parse_args()

2100

1846

2101

1847

if options.check:

2114

1860

"use_dbus": "True",

2115

1861

"use_ipv6": "True",

2116

1862

"debuglevel": "",

2117

"restore": "True",

2118

"statedir": "/var/lib/mandos"

2119

1863

}

2120

1864

2121

1865

# Parse config file for server-global settings

2138

1882

# options, if set.

2139

1883

for option in ("interface", "address", "port", "debug",

2140

1884

"priority", "servicename", "configdir",

2141

"use_dbus", "use_ipv6", "debuglevel", "restore",

2142

"statedir"):

1885

"use_dbus", "use_ipv6", "debuglevel"):

2143

1886

value = getattr(options, option)

2144

1887

if value is not None:

2145

1888

server_settings[option] = value

2157

1900

debuglevel = server_settings["debuglevel"]

2158

1901

use_dbus = server_settings["use_dbus"]

2159

1902

use_ipv6 = server_settings["use_ipv6"]

2160

stored_state_path = os.path.join(server_settings["statedir"],

2161

stored_state_file)

2162

2163

if debug:

2164

initlogger(debug, logging.DEBUG)

2165

else:

2166

if not debuglevel:

2167

initlogger(debug)

2168

else:

2169

level = getattr(logging, debuglevel.upper())

2170

initlogger(debug, level)

2171

1903

2172

1904

if server_settings["servicename"] != "Mandos":

2173

1905

syslogger.setFormatter(logging.Formatter

2176

1908

% server_settings["servicename"]))

2177

1909

2178

1910

# Parse config file with clients

2179

client_config = configparser.SafeConfigParser(Client

2180

.client_defaults)

1911

client_defaults = { "timeout": "5m",

1912

"extended_timeout": "15m",

1913

"interval": "2m",

1914

"checker": "fping -q -- %%(host)s",

1915

"host": "",

1916

"approval_delay": "0s",

1917

"approval_duration": "1s",

1918

}

1919

client_config = configparser.SafeConfigParser(client_defaults)

2181

1920

client_config.read(os.path.join(server_settings["configdir"],

2182

1921

"clients.conf"))

2183

1922

2221

1960

if error[0] != errno.EPERM:

2222

1961

raise error

2223

1962

1963

if not debug and not debuglevel:

1964

syslogger.setLevel(logging.WARNING)

1965

console.setLevel(logging.WARNING)

1966

if debuglevel:

1967

level = getattr(logging, debuglevel.upper())

1968

syslogger.setLevel(level)

1969

console.setLevel(level)

1970

2224

1971

if debug:

2225

1972

# Enable all possible GnuTLS debugging

2226

1973

2236

1983

.gnutls_global_set_log_function(debug_gnutls))

2237

1984

2238

1985

# Redirect stdin so all checkers get /dev/null

2239

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1986

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2240

1987

os.dup2(null, sys.stdin.fileno())

2241

1988

if null > 2:

2242

1989

os.close(null)

1990

else:

1991

# No console logging

1992

logger.removeHandler(console)

2243

1993

2244

1994

# Need to fork before connecting to D-Bus

2245

1995

if not debug:

2246

1996

# Close all input and output, do double fork, etc.

2247

1997

daemon()

2248

1998

2249

gobject.threads_init()

2250

2251

1999

global main_loop

2252

2000

# From the Avahi example code

2253

DBusGMainLoop(set_as_default=True)

2001

DBusGMainLoop(set_as_default=True )

2254

2002

main_loop = gobject.MainLoop()

2255

2003

bus = dbus.SystemBus()

2256

2004

# End of Avahi example code

2267

2015

server_settings["use_dbus"] = False

2268

2016

tcp_server.use_dbus = False

2269

2017

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2270

service = AvahiServiceToSyslog(name =

2271

server_settings["servicename"],

2272

servicetype = "_mandos._tcp",

2273

protocol = protocol, bus = bus)

2018

service = AvahiService(name = server_settings["servicename"],

2019

servicetype = "_mandos._tcp",

2020

protocol = protocol, bus = bus)

2274

2021

if server_settings["interface"]:

2275

2022

service.interface = (if_nametoindex

2276

2023

(str(server_settings["interface"])))

2282

2029

if use_dbus:

2283

2030

client_class = functools.partial(ClientDBusTransitional,

2284

2031

bus = bus)

2285

2286

client_settings = Client.config_parser(client_config)

2287

old_client_settings = {}

2288

clients_data = {}

2289

2290

# Get client data and settings from last running state.

2291

if server_settings["restore"]:

2292

try:

2293

with open(stored_state_path, "rb") as stored_state:

2294

clients_data, old_client_settings = (pickle.load

2295

(stored_state))

2296

os.remove(stored_state_path)

2297

except IOError as e:

2298

logger.warning("Could not load persistent state: {0}"

2299

.format(e))

2300

if e.errno != errno.ENOENT:

2301

raise

2302

except EOFError as e:

2303

logger.warning("Could not load persistent state: "

2304

"EOFError: {0}".format(e))

2305

2306

with PGPEngine() as pgp:

2307

for client_name, client in clients_data.iteritems():

2308

# Decide which value to use after restoring saved state.

2309

# We have three different values: Old config file,

2310

# new config file, and saved state.

2311

# New config value takes precedence if it differs from old

2312

# config value, otherwise use saved state.

2313

for name, value in client_settings[client_name].items():

2314

try:

2315

# For each value in new config, check if it

2316

# differs from the old config value (Except for

2317

# the "secret" attribute)

2318

if (name != "secret" and

2319

value != old_client_settings[client_name]

2320

[name]):

2321

client[name] = value

2322

except KeyError:

2323

pass

2324

2325

# Clients who has passed its expire date can still be

2326

# enabled if its last checker was successful. Clients

2327

# whose checker succeeded before we stored its state is

2328

# assumed to have successfully run all checkers during

2329

# downtime.

2330

if client["enabled"]:

2331

if datetime.datetime.utcnow() >= client["expires"]:

2332

if not client["last_checked_ok"]:

2333

logger.warning(

2334

"disabling client {0} - Client never "

2335

"performed a successful checker"

2336

.format(client_name))

2337

client["enabled"] = False

2338

elif client["last_checker_status"] != 0:

2339

logger.warning(

2340

"disabling client {0} - Client "

2341

"last checker failed with error code {1}"

2342

.format(client_name,

2343

client["last_checker_status"]))

2344

client["enabled"] = False

2345

else:

2346

client["expires"] = (datetime.datetime

2347

.utcnow()

2348

+ client["timeout"])

2349

logger.debug("Last checker succeeded,"

2350

" keeping {0} enabled"

2351

.format(client_name))

2032

def client_config_items(config, section):

2033

special_settings = {

2034

"approved_by_default":

2035

lambda: config.getboolean(section,

2036

"approved_by_default"),

2037

}

2038

for name, value in config.items(section):

2352

2039

try:

2353

client["secret"] = (

2354

pgp.decrypt(client["encrypted_secret"],

2355

client_settings[client_name]

2356

["secret"]))

2357

except PGPError:

2358

# If decryption fails, we use secret from new settings

2359

logger.debug("Failed to decrypt {0} old secret"

2360

.format(client_name))

2361

client["secret"] = (

2362

client_settings[client_name]["secret"])

2363

2364

2365

# Add/remove clients based on new changes made to config

2366

for client_name in (set(old_client_settings)

2367

- set(client_settings)):

2368

del clients_data[client_name]

2369

for client_name in (set(client_settings)

2370

- set(old_client_settings)):

2371

clients_data[client_name] = client_settings[client_name]

2372

2373

# Create all client objects

2374

for client_name, client in clients_data.iteritems():

2375

tcp_server.clients[client_name] = client_class(

2376

name = client_name, settings = client)

2377

2040

yield (name, special_settings[name]())

2041

except KeyError:

2042

yield (name, value)

2043

2044

tcp_server.clients.update(set(

2045

client_class(name = section,

2046

config= dict(client_config_items(

2047

client_config, section)))

2048

for section in client_config.sections()))

2378

2049

if not tcp_server.clients:

2379

2050

logger.warning("No clients defined")

2380

2051

2391

2062

# "pidfile" was never created

2392

2063

pass

2393

2064

del pidfilename

2065

2394

2066

signal.signal(signal.SIGINT, signal.SIG_IGN)

2395

2067

2396

2068

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2397

2069

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2398

2070

2399

2071

if use_dbus:

2400

class MandosDBusService(DBusObjectWithProperties):

2072

class MandosDBusService(dbus.service.Object):

2401

2073

"""A D-Bus proxy object"""

2402

2074

def __init__(self):

2403

2075

dbus.service.Object.__init__(self, bus, "/")

2404

2076

_interface = "se.recompile.Mandos"

2405

2077

2406

@dbus_interface_annotations(_interface)

2407

def _foo(self):

2408

return { "org.freedesktop.DBus.Property"

2409

".EmitsChangedSignal":

2410

"false"}

2411

2412

2078

@dbus.service.signal(_interface, signature="o")

2413

2079

def ClientAdded(self, objpath):

2414

2080

"D-Bus signal"

2428

2094

def GetAllClients(self):

2429

2095

"D-Bus method"

2430

2096

return dbus.Array(c.dbus_object_path

2431

for c in

2432

tcp_server.clients.itervalues())

2097

for c in tcp_server.clients)

2433

2098

2434

2099

@dbus.service.method(_interface,

2435

2100

out_signature="a{oa{sv}}")

2437

2102

"D-Bus method"

2438

2103

return dbus.Dictionary(

2439

2104

((c.dbus_object_path, c.GetAll(""))

2440

for c in tcp_server.clients.itervalues()),

2105

for c in tcp_server.clients),

2441

2106

signature="oa{sv}")

2442

2107

2443

2108

@dbus.service.method(_interface, in_signature="o")

2444

2109

def RemoveClient(self, object_path):

2445

2110

"D-Bus method"

2446

for c in tcp_server.clients.itervalues():

2111

for c in tcp_server.clients:

2447

2112

if c.dbus_object_path == object_path:

2448

del tcp_server.clients[c.name]

2113

tcp_server.clients.remove(c)

2449

2114

c.remove_from_connection()

2450

2115

# Don't signal anything except ClientRemoved

2451

2116

c.disable(quiet=True)

2464

2129

"Cleanup function; run on exit"

2465

2130

service.cleanup()

2466

2131

2467

multiprocessing.active_children()

2468

if not (tcp_server.clients or client_settings):

2469

return

2470

2471

# Store client before exiting. Secrets are encrypted with key

2472

# based on what config file has. If config file is

2473

# removed/edited, old secret will thus be unrecovable.

2474

clients = {}

2475

with PGPEngine() as pgp:

2476

for client in tcp_server.clients.itervalues():

2477

key = client_settings[client.name]["secret"]

2478

client.encrypted_secret = pgp.encrypt(client.secret,

2479

key)

2480

client_dict = {}

2481

2482

# A list of attributes that can not be pickled

2483

# + secret.

2484

exclude = set(("bus", "changedstate", "secret",

2485

"checker"))

2486

for name, typ in (inspect.getmembers

2487

(dbus.service.Object)):

2488

exclude.add(name)

2489

2490

client_dict["encrypted_secret"] = (client

2491

.encrypted_secret)

2492

for attr in client.client_structure:

2493

if attr not in exclude:

2494

client_dict[attr] = getattr(client, attr)

2495

2496

clients[client.name] = client_dict

2497

del client_settings[client.name]["secret"]

2498

2499

try:

2500

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2501

prefix="clients-",

2502

dir=os.path.dirname

2503

(stored_state_path))

2504

with os.fdopen(tempfd, "wb") as stored_state:

2505

pickle.dump((clients, client_settings), stored_state)

2506

os.rename(tempname, stored_state_path)

2507

except (IOError, OSError) as e:

2508

logger.warning("Could not save persistent state: {0}"

2509

.format(e))

2510

if not debug:

2511

try:

2512

os.remove(tempname)

2513

except NameError:

2514

pass

2515

if e.errno not in set((errno.ENOENT, errno.EACCES,

2516

errno.EEXIST)):

2517

raise e

2518

2519

# Delete all clients, and settings from config

2520

2132

while tcp_server.clients:

2521

name, client = tcp_server.clients.popitem()

2133

client = tcp_server.clients.pop()

2522

2134

if use_dbus:

2523

2135

client.remove_from_connection()

2136

client.disable_hook = None

2524

2137

# Don't signal anything except ClientRemoved

2525

2138

client.disable(quiet=True)

2526

2139

if use_dbus:

2528

2141

mandos_dbus_service.ClientRemoved(client

2529

2142

.dbus_object_path,

2530

2143

client.name)

2531

client_settings.clear()

2532

2144

2533

2145

atexit.register(cleanup)

2534

2146

2535

for client in tcp_server.clients.itervalues():

2147

for client in tcp_server.clients:

2536

2148

if use_dbus:

2537

2149

# Emit D-Bus signal

2538

2150

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2539

# Need to initiate checking of clients

2540

if client.enabled:

2541

client.init_checker()

2151

client.enable()

2542

2152

2543

2153

tcp_server.enable()

2544

2154

tcp_server.server_activate()

2584

2194

# Must run before the D-Bus bus name gets deregistered

2585

2195

cleanup()

2586

2196

2197

2587

2198

if __name__ == '__main__':

2588

2199

main()