/mandos/trunk : revision 505.2.8

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

65

66

67

import dbus

67

68

import dbus.service

82

83

SO_BINDTODEVICE = None

83

84

85

version = "1.3.1"

86

version = "1.4.1"

86

87

88

#logger = logging.getLogger('mandos')

88

89

logger = logging.Logger('mandos')

159

160

" after %i retries, exiting.",

160

161

self.rename_count)

161

162

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

163

165

logger.info("Changing Zeroconf service name to %r ...",

164

166

self.name)

165

167

syslogger.setFormatter(logging.Formatter

264

266

self.server_state_changed(self.server.GetState())

265

267

266

268

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

267

275

class Client(object):

268

276

"""A representation of a client host served by this server.

269

277

297

305

secret: bytestring; sent verbatim (over TLS) to client

298

306

timeout: datetime.timedelta(); How long from last_checked_ok

299

307

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

300

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

301

312

"""

302

313

303

314

runtime_expansions = ("approval_delay", "approval_duration",

305

316

"host", "interval", "last_checked_ok",

306

317

"last_enabled", "name", "timeout")

307

318

308

@staticmethod

309

def _timedelta_to_milliseconds(td):

310

"Convert a datetime.timedelta() to milliseconds"

311

return ((td.days * 24 * 60 * 60 * 1000)

312

+ (td.seconds * 1000)

313

+ (td.microseconds // 1000))

314

315

319

def timeout_milliseconds(self):

316

320

"Return the 'timeout' attribute in milliseconds"

317

return self._timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

318

326

319

327

def interval_milliseconds(self):

320

328

"Return the 'interval' attribute in milliseconds"

321

return self._timedelta_to_milliseconds(self.interval)

322

329

return _timedelta_to_milliseconds(self.interval)

330

323

331

def approval_delay_milliseconds(self):

324

return self._timedelta_to_milliseconds(self.approval_delay)

332

return _timedelta_to_milliseconds(self.approval_delay)

325

333

326

334

def __init__(self, name = None, disable_hook=None, config=None):

327

335

"""Note: the 'checker' key in 'config' sets the

354

362

self.last_enabled = None

355

363

self.last_checked_ok = None

356

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

357

367

self.interval = string_to_delta(config["interval"])

358

368

self.disable_hook = disable_hook

359

369

self.checker = None

360

370

self.checker_initiator_tag = None

361

371

self.disable_initiator_tag = None

372

self.expires = None

362

373

self.checker_callback_tag = None

363

374

self.checker_command = config["checker"]

364

375

self.current_checker_command = None

371

382

config["approval_delay"])

372

383

self.approval_duration = string_to_delta(

373

384

config["approval_duration"])

374

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

375

388

376

389

def send_changedstate(self):

377

390

self.changedstate.acquire()

378

391

self.changedstate.notify_all()

379

392

self.changedstate.release()

380

393

381

394

def enable(self):

382

395

"""Start this client's checker and timeout hooks"""

383

396

if getattr(self, "enabled", False):

384

397

# Already enabled

385

398

return

386

399

self.send_changedstate()

387

self.last_enabled = datetime.datetime.utcnow()

388

400

# Schedule a new checker to be started an 'interval' from now,

389

401

# and every interval from then on.

390

402

self.checker_initiator_tag = (gobject.timeout_add

391

403

(self.interval_milliseconds(),

392

404

self.start_checker))

393

405

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

394

407

self.disable_initiator_tag = (gobject.timeout_add

395

408

(self.timeout_milliseconds(),

396

409

self.disable))

397

410

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

398

412

# Also start a new checker *right now*.

399

413

self.start_checker()

400

414

409

423

if getattr(self, "disable_initiator_tag", False):

410

424

gobject.source_remove(self.disable_initiator_tag)

411

425

self.disable_initiator_tag = None

426

self.expires = None

412

427

if getattr(self, "checker_initiator_tag", False):

413

428

gobject.source_remove(self.checker_initiator_tag)

414

429

self.checker_initiator_tag = None

440

455

logger.warning("Checker for %(name)s crashed?",

441

456

vars(self))

442

457

443

def checked_ok(self):

458

def checked_ok(self, timeout=None):

444

459

"""Bump up the timeout for this client.

445

460

446

461

This should only be called when the client has been seen,

447

462

alive and well.

448

463

"""

464

if timeout is None:

465

timeout = self.timeout

449

466

self.last_checked_ok = datetime.datetime.utcnow()

450

gobject.source_remove(self.disable_initiator_tag)

451

self.disable_initiator_tag = (gobject.timeout_add

452

(self.timeout_milliseconds(),

453

self.disable))

467

if self.disable_initiator_tag is not None:

468

gobject.source_remove(self.disable_initiator_tag)

469

if getattr(self, "enabled", False):

470

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

472

(timeout), self.disable))

473

self.expires = datetime.datetime.utcnow() + timeout

454

474

455

475

def need_approval(self):

456

476

self.last_approval_request = datetime.datetime.utcnow()

496

516

'replace')))

497

517

for attr in

498

518

self.runtime_expansions)

499

519

500

520

try:

501

521

command = self.checker_command % escaped_attrs

502

522

except TypeError as error:

548

568

raise

549

569

self.checker = None

550

570

571

551

572

def dbus_service_property(dbus_interface, signature="v",

552

573

access="readwrite", byte_arrays=False):

553

574

"""Decorators for marking methods of a DBusObjectWithProperties to

599

620

600

621

class DBusObjectWithProperties(dbus.service.Object):

601

622

"""A D-Bus object with properties.

602

623

603

624

Classes inheriting from this can use the dbus_service_property

604

625

decorator to expose methods as D-Bus properties. It exposes the

605

626

standard Get(), Set(), and GetAll() methods on the D-Bus.

612

633

def _get_all_dbus_properties(self):

613

634

"""Returns a generator of (name, attribute) pairs

614

635

"""

615

return ((prop._dbus_name, prop)

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

637

for cls in self.__class__.__mro__

616

638

for name, prop in

617

inspect.getmembers(self, self._is_dbus_property))

639

inspect.getmembers(cls, self._is_dbus_property))

618

640

619

641

def _get_dbus_property(self, interface_name, property_name):

620

642

"""Returns a bound method if one exists which is a D-Bus

621

643

property with the specified name and interface.

622

644

"""

623

for name in (property_name,

624

property_name + "_dbus_property"):

625

prop = getattr(self, name, None)

626

if (prop is None

627

or not self._is_dbus_property(prop)

628

or prop._dbus_name != property_name

629

or (interface_name and prop._dbus_interface

630

and interface_name != prop._dbus_interface)):

631

continue

632

return prop

645

for cls in self.__class__.__mro__:

646

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

648

if (value._dbus_name == property_name

649

and value._dbus_interface == interface_name):

650

return value.__get__(self)

651

633

652

# No such property

634

653

raise DBusPropertyNotFound(self.dbus_object_path + ":"

635

654

+ interface_name + "."

669

688

def GetAll(self, interface_name):

670

689

"""Standard D-Bus property GetAll() method, see D-Bus

671

690

standard.

672

691

673

692

Note: Will not include properties with access="write".

674

693

"""

675

694

all = {}

737

756

return xmlstring

738

757

739

758

759

def datetime_to_dbus (dt, variant_level=0):

760

"""Convert a UTC datetime.datetime() to a D-Bus type."""

761

if dt is None:

762

return dbus.String("", variant_level = variant_level)

763

return dbus.String(dt.isoformat(),

764

variant_level=variant_level)

765

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

.__metaclass__):

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

769

will add additional D-Bus attributes matching a certain pattern.

770

"""

771

def __new__(mcs, name, bases, attr):

772

# Go through all the base classes which could have D-Bus

773

# methods, signals, or properties in them

774

for base in (b for b in bases

775

if issubclass(b, dbus.service.Object)):

776

# Go though all attributes of the base class

777

for attrname, attribute in inspect.getmembers(base):

778

# Ignore non-D-Bus attributes, and D-Bus attributes

779

# with the wrong interface name

780

if (not hasattr(attribute, "_dbus_interface")

781

or not attribute._dbus_interface

782

.startswith("se.recompile.Mandos")):

783

continue

784

# Create an alternate D-Bus interface name based on

785

# the current name

786

alt_interface = (attribute._dbus_interface

787

.replace("se.recompile.Mandos",

788

"se.bsnet.fukt.Mandos"))

789

# Is this a D-Bus signal?

790

if getattr(attribute, "_dbus_is_signal", False):

791

# Extract the original non-method function by

792

# black magic

793

nonmethod_func = (dict(

794

zip(attribute.func_code.co_freevars,

795

attribute.__closure__))["func"]

796

.cell_contents)

797

# Create a new, but exactly alike, function

798

# object, and decorate it to be a new D-Bus signal

799

# with the alternate D-Bus interface name

800

new_function = (dbus.service.signal

801

(alt_interface,

802

attribute._dbus_signature)

803

(types.FunctionType(

804

nonmethod_func.func_code,

805

nonmethod_func.func_globals,

806

nonmethod_func.func_name,

807

nonmethod_func.func_defaults,

808

nonmethod_func.func_closure)))

809

# Define a creator of a function to call both the

810

# old and new functions, so both the old and new

811

# signals gets sent when the function is called

812

def fixscope(func1, func2):

813

"""This function is a scope container to pass

814

func1 and func2 to the "call_both" function

815

outside of its arguments"""

816

def call_both(*args, **kwargs):

817

"""This function will emit two D-Bus

818

signals by calling func1 and func2"""

819

func1(*args, **kwargs)

820

func2(*args, **kwargs)

821

return call_both

822

# Create the "call_both" function and add it to

823

# the class

824

attr[attrname] = fixscope(attribute,

825

new_function)

826

# Is this a D-Bus method?

827

elif getattr(attribute, "_dbus_is_method", False):

828

# Create a new, but exactly alike, function

829

# object. Decorate it to be a new D-Bus method

830

# with the alternate D-Bus interface name. Add it

831

# to the class.

832

attr[attrname] = (dbus.service.method

833

(alt_interface,

834

attribute._dbus_in_signature,

835

attribute._dbus_out_signature)

836

(types.FunctionType

837

(attribute.func_code,

838

attribute.func_globals,

839

attribute.func_name,

840

attribute.func_defaults,

841

attribute.func_closure)))

842

# Is this a D-Bus property?

843

elif getattr(attribute, "_dbus_is_property", False):

844

# Create a new, but exactly alike, function

845

# object, and decorate it to be a new D-Bus

846

# property with the alternate D-Bus interface

847

# name. Add it to the class.

848

attr[attrname] = (dbus_service_property

849

(alt_interface,

850

attribute._dbus_signature,

851

attribute._dbus_access,

852

attribute

853

._dbus_get_args_options

854

["byte_arrays"])

855

(types.FunctionType

856

(attribute.func_code,

857

attribute.func_globals,

858

attribute.func_name,

859

attribute.func_defaults,

860

attribute.func_closure)))

861

return type.__new__(mcs, name, bases, attr)

862

740

863

class ClientDBus(Client, DBusObjectWithProperties):

741

864

"""A Client class using D-Bus

742

865

764

887

DBusObjectWithProperties.__init__(self, self.bus,

765

888

self.dbus_object_path)

766

889

767

def _get_approvals_pending(self):

768

return self._approvals_pending

769

def _set_approvals_pending(self, value):

770

old_value = self._approvals_pending

771

self._approvals_pending = value

772

bval = bool(value)

773

if (hasattr(self, "dbus_object_path")

774

and bval is not bool(old_value)):

775

dbus_bool = dbus.Boolean(bval, variant_level=1)

776

self.PropertyChanged(dbus.String("ApprovalPending"),

777

dbus_bool)

890

def notifychangeproperty(transform_func,

891

dbus_name, type_func=lambda x: x,

892

variant_level=1):

893

""" Modify a variable so that it's a property which announces

894

its changes to DBus.

778

895

779

approvals_pending = property(_get_approvals_pending,

780

_set_approvals_pending)

781

del _get_approvals_pending, _set_approvals_pending

782

783

@staticmethod

784

def _datetime_to_dbus(dt, variant_level=0):

785

"""Convert a UTC datetime.datetime() to a D-Bus type."""

786

return dbus.String(dt.isoformat(),

787

variant_level=variant_level)

788

789

def enable(self):

790

oldstate = getattr(self, "enabled", False)

791

r = Client.enable(self)

792

if oldstate != self.enabled:

793

# Emit D-Bus signals

794

self.PropertyChanged(dbus.String("Enabled"),

795

dbus.Boolean(True, variant_level=1))

796

self.PropertyChanged(

797

dbus.String("LastEnabled"),

798

self._datetime_to_dbus(self.last_enabled,

799

variant_level=1))

800

return r

801

802

def disable(self, quiet = False):

803

oldstate = getattr(self, "enabled", False)

804

r = Client.disable(self, quiet=quiet)

805

if not quiet and oldstate != self.enabled:

806

# Emit D-Bus signal

807

self.PropertyChanged(dbus.String("Enabled"),

808

dbus.Boolean(False, variant_level=1))

809

return r

896

transform_fun: Function that takes a value and a variant_level

897

and transforms it to a D-Bus type.

898

dbus_name: D-Bus name of the variable

899

type_func: Function that transform the value before sending it

900

to the D-Bus. Default: no transform

901

variant_level: D-Bus variant level. Default: 1

902

"""

903

attrname = "_{0}".format(dbus_name)

904

def setter(self, value):

905

if hasattr(self, "dbus_object_path"):

906

if (not hasattr(self, attrname) or

907

type_func(getattr(self, attrname, None))

908

!= type_func(value)):

909

dbus_value = transform_func(type_func(value),

910

variant_level

911

=variant_level)

912

self.PropertyChanged(dbus.String(dbus_name),

913

dbus_value)

914

setattr(self, attrname, value)

915

916

return property(lambda self: getattr(self, attrname), setter)

917

918

919

expires = notifychangeproperty(datetime_to_dbus, "Expires")

920

approvals_pending = notifychangeproperty(dbus.Boolean,

921

"ApprovalPending",

922

type_func = bool)

923

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

924

last_enabled = notifychangeproperty(datetime_to_dbus,

925

"LastEnabled")

926

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

927

type_func = lambda checker:

928

checker is not None)

929

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

"LastCheckedOK")

931

last_approval_request = notifychangeproperty(

932

datetime_to_dbus, "LastApprovalRequest")

933

approved_by_default = notifychangeproperty(dbus.Boolean,

934

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

936

"ApprovalDelay",

937

type_func =

938

_timedelta_to_milliseconds)

939

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

942

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

944

type_func =

945

_timedelta_to_milliseconds)

946

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

950

"Interval",

951

type_func =

952

_timedelta_to_milliseconds)

953

checker_command = notifychangeproperty(dbus.String, "Checker")

954

955

del notifychangeproperty

810

956

811

957

def __del__(self, *args, **kwargs):

812

958

try:

821

967

*args, **kwargs):

822

968

self.checker_callback_tag = None

823

969

self.checker = None

824

# Emit D-Bus signal

825

self.PropertyChanged(dbus.String("CheckerRunning"),

826

dbus.Boolean(False, variant_level=1))

827

970

if os.WIFEXITED(condition):

828

971

exitstatus = os.WEXITSTATUS(condition)

829

972

# Emit D-Bus signal

839

982

return Client.checker_callback(self, pid, condition, command,

840

983

*args, **kwargs)

841

984

842

def checked_ok(self, *args, **kwargs):

843

Client.checked_ok(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastCheckedOK"),

847

(self._datetime_to_dbus(self.last_checked_ok,

848

variant_level=1)))

849

850

def need_approval(self, *args, **kwargs):

851

r = Client.need_approval(self, *args, **kwargs)

852

# Emit D-Bus signal

853

self.PropertyChanged(

854

dbus.String("LastApprovalRequest"),

855

(self._datetime_to_dbus(self.last_approval_request,

856

variant_level=1)))

857

return r

858

859

985

def start_checker(self, *args, **kwargs):

860

986

old_checker = self.checker

861

987

if self.checker is not None:

868

994

and old_checker_pid != self.checker.pid):

869

995

# Emit D-Bus signal

870

996

self.CheckerStarted(self.current_checker_command)

871

self.PropertyChanged(

872

dbus.String("CheckerRunning"),

873

dbus.Boolean(True, variant_level=1))

874

997

return r

875

998

876

def stop_checker(self, *args, **kwargs):

877

old_checker = getattr(self, "checker", None)

878

r = Client.stop_checker(self, *args, **kwargs)

879

if (old_checker is not None

880

and getattr(self, "checker", None) is None):

881

self.PropertyChanged(dbus.String("CheckerRunning"),

882

dbus.Boolean(False, variant_level=1))

883

return r

884

885

999

def _reset_approved(self):

886

1000

self._approved = None

887

1001

return False

889

1003

def approve(self, value=True):

890

1004

self.send_changedstate()

891

1005

self._approved = value

892

gobject.timeout_add(self._timedelta_to_milliseconds

1006

gobject.timeout_add(_timedelta_to_milliseconds

893

1007

(self.approval_duration),

894

1008

self._reset_approved)

895

1009

896

1010

897

1011

## D-Bus methods, signals & properties

898

_interface = "se.bsnet.fukt.Mandos.Client"

1012

_interface = "se.recompile.Mandos.Client"

899

1013

900

1014

## Signals

901

1015

987

1101

if value is None: # get

988

1102

return dbus.Boolean(self.approved_by_default)

989

1103

self.approved_by_default = bool(value)

990

# Emit D-Bus signal

991

self.PropertyChanged(dbus.String("ApprovedByDefault"),

992

dbus.Boolean(value, variant_level=1))

993

1104

994

1105

# ApprovalDelay - property

995

1106

@dbus_service_property(_interface, signature="t",

998

1109

if value is None: # get

999

1110

return dbus.UInt64(self.approval_delay_milliseconds())

1000

1111

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1001

# Emit D-Bus signal

1002

self.PropertyChanged(dbus.String("ApprovalDelay"),

1003

dbus.UInt64(value, variant_level=1))

1004

1112

1005

1113

# ApprovalDuration - property

1006

1114

@dbus_service_property(_interface, signature="t",

1007

1115

access="readwrite")

1008

1116

def ApprovalDuration_dbus_property(self, value=None):

1009

1117

if value is None: # get

1010

return dbus.UInt64(self._timedelta_to_milliseconds(

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1011

1119

self.approval_duration))

1012

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1013

# Emit D-Bus signal

1014

self.PropertyChanged(dbus.String("ApprovalDuration"),

1015

dbus.UInt64(value, variant_level=1))

1016

1121

1017

1122

# Name - property

1018

1123

@dbus_service_property(_interface, signature="s", access="read")

1031

1136

if value is None: # get

1032

1137

return dbus.String(self.host)

1033

1138

self.host = value

1034

# Emit D-Bus signal

1035

self.PropertyChanged(dbus.String("Host"),

1036

dbus.String(value, variant_level=1))

1037

1139

1038

1140

# Created - property

1039

1141

@dbus_service_property(_interface, signature="s", access="read")

1040

1142

def Created_dbus_property(self):

1041

return dbus.String(self._datetime_to_dbus(self.created))

1143

return dbus.String(datetime_to_dbus(self.created))

1042

1144

1043

1145

# LastEnabled - property

1044

1146

@dbus_service_property(_interface, signature="s", access="read")

1045

1147

def LastEnabled_dbus_property(self):

1046

if self.last_enabled is None:

1047

return dbus.String("")

1048

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1148

return datetime_to_dbus(self.last_enabled)

1049

1149

1050

1150

# Enabled - property

1051

1151

@dbus_service_property(_interface, signature="b",

1065

1165

if value is not None:

1066

1166

self.checked_ok()

1067

1167

return

1068

if self.last_checked_ok is None:

1069

return dbus.String("")

1070

return dbus.String(self._datetime_to_dbus(self

1071

.last_checked_ok))

1168

return datetime_to_dbus(self.last_checked_ok)

1169

1170

# Expires - property

1171

@dbus_service_property(_interface, signature="s", access="read")

1172

def Expires_dbus_property(self):

1173

return datetime_to_dbus(self.expires)

1072

1174

1073

1175

# LastApprovalRequest - property

1074

1176

@dbus_service_property(_interface, signature="s", access="read")

1075

1177

def LastApprovalRequest_dbus_property(self):

1076

if self.last_approval_request is None:

1077

return dbus.String("")

1078

return dbus.String(self.

1079

_datetime_to_dbus(self

1080

.last_approval_request))

1178

return datetime_to_dbus(self.last_approval_request)

1081

1179

1082

1180

# Timeout - property

1083

1181

@dbus_service_property(_interface, signature="t",

1086

1184

if value is None: # get

1087

1185

return dbus.UInt64(self.timeout_milliseconds())

1088

1186

self.timeout = datetime.timedelta(0, 0, 0, value)

1089

# Emit D-Bus signal

1090

self.PropertyChanged(dbus.String("Timeout"),

1091

dbus.UInt64(value, variant_level=1))

1092

1187

if getattr(self, "disable_initiator_tag", None) is None:

1093

1188

return

1094

1189

# Reschedule timeout

1095

1190

gobject.source_remove(self.disable_initiator_tag)

1096

1191

self.disable_initiator_tag = None

1097

time_to_die = (self.

1098

_timedelta_to_milliseconds((self

1099

.last_checked_ok

1100

+ self.timeout)

1101

- datetime.datetime

1102

.utcnow()))

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1103

1198

if time_to_die <= 0:

1104

1199

# The timeout has passed

1105

1200

self.disable()

1106

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1107

1205

self.disable_initiator_tag = (gobject.timeout_add

1108

1206

(time_to_die, self.disable))

1109

1207

1208

# ExtendedTimeout - property

1209

@dbus_service_property(_interface, signature="t",

1210

access="readwrite")

1211

def ExtendedTimeout_dbus_property(self, value=None):

1212

if value is None: # get

1213

return dbus.UInt64(self.extended_timeout_milliseconds())

1214

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1215

1110

1216

# Interval - property

1111

1217

@dbus_service_property(_interface, signature="t",

1112

1218

access="readwrite")

1114

1220

if value is None: # get

1115

1221

return dbus.UInt64(self.interval_milliseconds())

1116

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1117

# Emit D-Bus signal

1118

self.PropertyChanged(dbus.String("Interval"),

1119

dbus.UInt64(value, variant_level=1))

1120

1223

if getattr(self, "checker_initiator_tag", None) is None:

1121

1224

return

1122

1225

# Reschedule checker run

1124

1227

self.checker_initiator_tag = (gobject.timeout_add

1125

1228

(value, self.start_checker))

1126

1229

self.start_checker() # Start one now, too

1127

1230

1128

1231

# Checker - property

1129

1232

@dbus_service_property(_interface, signature="s",

1130

1233

access="readwrite")

1132

1235

if value is None: # get

1133

1236

return dbus.String(self.checker_command)

1134

1237

self.checker_command = value

1135

# Emit D-Bus signal

1136

self.PropertyChanged(dbus.String("Checker"),

1137

dbus.String(self.checker_command,

1138

variant_level=1))

1139

1238

1140

1239

# CheckerRunning - property

1141

1240

@dbus_service_property(_interface, signature="b",

1168

1267

self._pipe.send(('init', fpr, address))

1169

1268

if not self._pipe.recv():

1170

1269

raise KeyError()

1171

1270

1172

1271

def __getattribute__(self, name):

1173

1272

if(name == '_pipe'):

1174

1273

return super(ProxyClient, self).__getattribute__(name)

1181

1280

self._pipe.send(('funcall', name, args, kwargs))

1182

1281

return self._pipe.recv()[1]

1183

1282

return func

1184

1283

1185

1284

def __setattr__(self, name, value):

1186

1285

if(name == '_pipe'):

1187

1286

return super(ProxyClient, self).__setattr__(name, value)

1188

1287

self._pipe.send(('setattr', name, value))

1189

1288

1289

class ClientDBusTransitional(ClientDBus):

1290

__metaclass__ = AlternateDBusNamesMetaclass

1190

1291

1191

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1192

1293

"""A class to handle client connections.

1200

1301

unicode(self.client_address))

1201

1302

logger.debug("Pipe FD: %d",

1202

1303

self.server.child_pipe.fileno())

1203

1304

1204

1305

session = (gnutls.connection

1205

1306

.ClientSession(self.request,

1206

1307

gnutls.connection

1207

1308

.X509Credentials()))

1208

1309

1209

1310

# Note: gnutls.connection.X509Credentials is really a

1210

1311

# generic GnuTLS certificate credentials object so long as

1211

1312

# no X.509 keys are added to it. Therefore, we can use it

1212

1313

# here despite using OpenPGP certificates.

1213

1314

1214

1315

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1215

1316

# "+AES-256-CBC", "+SHA1",

1216

1317

# "+COMP-NULL", "+CTYPE-OPENPGP",

1222

1323

(gnutls.library.functions

1223

1324

.gnutls_priority_set_direct(session._c_object,

1224

1325

priority, None))

1225

1326

1226

1327

# Start communication using the Mandos protocol

1227

1328

# Get protocol number

1228

1329

line = self.request.makefile().readline()

1233

1334

except (ValueError, IndexError, RuntimeError) as error:

1234

1335

logger.error("Unknown protocol version: %s", error)

1235

1336

return

1236

1337

1237

1338

# Start GnuTLS connection

1238

1339

try:

1239

1340

session.handshake()

1243

1344

# established. Just abandon the request.

1244

1345

return

1245

1346

logger.debug("Handshake succeeded")

1246

1347

1247

1348

approval_required = False

1248

1349

try:

1249

1350

try:

1254

1355

logger.warning("Bad certificate: %s", error)

1255

1356

return

1256

1357

logger.debug("Fingerprint: %s", fpr)

1257

1358

1258

1359

try:

1259

1360

client = ProxyClient(child_pipe, fpr,

1260

1361

self.client_address)

1272

1373

client.name)

1273

1374

if self.server.use_dbus:

1274

1375

# Emit D-Bus signal

1275

client.Rejected("Disabled")

1376

client.Rejected("Disabled")

1276

1377

return

1277

1378

1278

1379

if client._approved or not client.approval_delay:

1295

1396

return

1296

1397

1297

1398

#wait until timeout or approved

1298

#x = float(client._timedelta_to_milliseconds(delay))

1299

1399

time = datetime.datetime.now()

1300

1400

client.changedstate.acquire()

1301

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1302

1404

client.changedstate.release()

1303

1405

time2 = datetime.datetime.now()

1304

1406

if (time2 - time) >= delay:

1326

1428

sent, len(client.secret)

1327

1429

- (sent_size + sent))

1328

1430

sent_size += sent

1329

1431

1330

1432

logger.info("Sending secret to %s", client.name)

1331

# bump the timeout as if seen

1332

client.checked_ok()

1433

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1333

1435

if self.server.use_dbus:

1334

1436

# Emit D-Bus signal

1335

1437

client.GotSecret()

1414

1516

except:

1415

1517

self.handle_error(request, address)

1416

1518

self.close_request(request)

1417

1519

1418

1520

def process_request(self, request, address):

1419

1521

"""Start a new process to process the request."""

1420

multiprocessing.Process(target = self.sub_process_main,

1421

args = (request, address)).start()

1522

proc = multiprocessing.Process(target = self.sub_process_main,

1523

args = (request,

1524

address))

1525

proc.start()

1526

return proc

1527

1422

1528

1423

1529

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1424

1530

""" adds a pipe to the MixIn """

1428

1534

This function creates a new pipe in self.pipe

1429

1535

"""

1430

1536

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1431

1432

super(MultiprocessingMixInWithPipe,

1433

self).process_request(request, client_address)

1537

1538

proc = MultiprocessingMixIn.process_request(self, request,

1539

client_address)

1434

1540

self.child_pipe.close()

1435

self.add_pipe(parent_pipe)

1436

1437

def add_pipe(self, parent_pipe):

1541

self.add_pipe(parent_pipe, proc)

1542

1543

def add_pipe(self, parent_pipe, proc):

1438

1544

"""Dummy function; override as necessary"""

1439

1545

raise NotImplementedError

1440

1546

1547

1441

1548

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1442

1549

socketserver.TCPServer, object):

1443

1550

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1527

1634

def server_activate(self):

1528

1635

if self.enabled:

1529

1636

return socketserver.TCPServer.server_activate(self)

1637

1530

1638

def enable(self):

1531

1639

self.enabled = True

1532

def add_pipe(self, parent_pipe):

1640

1641

def add_pipe(self, parent_pipe, proc):

1533

1642

# Call "handle_ipc" for both data and EOF events

1534

1643

gobject.io_add_watch(parent_pipe.fileno(),

1535

1644

gobject.IO_IN | gobject.IO_HUP,

1536

1645

functools.partial(self.handle_ipc,

1537

parent_pipe = parent_pipe))

1538

1646

parent_pipe =

1647

parent_pipe,

1648

proc = proc))

1649

1539

1650

def handle_ipc(self, source, condition, parent_pipe=None,

1540

client_object=None):

1651

proc = None, client_object=None):

1541

1652

condition_names = {

1542

1653

gobject.IO_IN: "IN", # There is data to read.

1543

1654

gobject.IO_OUT: "OUT", # Data can be written (without

1552

1663

for cond, name in

1553

1664

condition_names.iteritems()

1554

1665

if cond & condition)

1555

# error or the other end of multiprocessing.Pipe has closed

1666

# error, or the other end of multiprocessing.Pipe has closed

1556

1667

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1668

# Wait for other process to exit

1669

proc.join()

1557

1670

return False

1558

1671

1559

1672

# Read a request from the child

1573

1686

"dress: %s", fpr, address)

1574

1687

if self.use_dbus:

1575

1688

# Emit D-Bus signal

1576

mandos_dbus_service.ClientNotFound(fpr, address[0])

1689

mandos_dbus_service.ClientNotFound(fpr,

1690

address[0])

1577

1691

parent_pipe.send(False)

1578

1692

return False

1579

1693

1580

1694

gobject.io_add_watch(parent_pipe.fileno(),

1581

1695

gobject.IO_IN | gobject.IO_HUP,

1582

1696

functools.partial(self.handle_ipc,

1583

parent_pipe = parent_pipe,

1584

client_object = client))

1697

parent_pipe =

1698

parent_pipe,

1699

proc = proc,

1700

client_object =

1701

client))

1585

1702

parent_pipe.send(True)

1586

# remove the old hook in favor of the new above hook on same fileno

1703

# remove the old hook in favor of the new above hook on

1704

# same fileno

1587

1705

return False

1588

1706

if command == 'funcall':

1589

1707

funcname = request[1]

1590

1708

args = request[2]

1591

1709

kwargs = request[3]

1592

1710

1593

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1594

1711

parent_pipe.send(('data', getattr(client_object,

1712

funcname)(*args,

1713

**kwargs)))

1714

1595

1715

if command == 'getattr':

1596

1716

attrname = request[1]

1597

1717

if callable(client_object.__getattribute__(attrname)):

1598

1718

parent_pipe.send(('function',))

1599

1719

else:

1600

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1720

parent_pipe.send(('data', client_object

1721

.__getattribute__(attrname)))

1601

1722

1602

1723

if command == 'setattr':

1603

1724

attrname = request[1]

1604

1725

value = request[2]

1605

1726

setattr(client_object, attrname, value)

1606

1727

1607

1728

return True

1608

1729

1609

1730

1788

1909

debuglevel = server_settings["debuglevel"]

1789

1910

use_dbus = server_settings["use_dbus"]

1790

1911

use_ipv6 = server_settings["use_ipv6"]

1791

1912

1792

1913

if server_settings["servicename"] != "Mandos":

1793

1914

syslogger.setFormatter(logging.Formatter

1794

1915

('Mandos (%s) [%%(process)d]:'

1796

1917

% server_settings["servicename"]))

1797

1918

1798

1919

# Parse config file with clients

1799

client_defaults = { "timeout": "1h",

1800

"interval": "5m",

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1801

1923

"checker": "fping -q -- %%(host)s",

1802

1924

"host": "",

1803

1925

"approval_delay": "0s",

1854

1976

level = getattr(logging, debuglevel.upper())

1855

1977

syslogger.setLevel(level)

1856

1978

console.setLevel(level)

1857

1979

1858

1980

if debug:

1859

1981

# Enable all possible GnuTLS debugging

1860

1982

1891

2013

# End of Avahi example code

1892

2014

if use_dbus:

1893

2015

try:

1894

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2016

bus_name = dbus.service.BusName("se.recompile.Mandos",

1895

2017

bus, do_not_queue=True)

2018

old_bus_name = (dbus.service.BusName

2019

("se.bsnet.fukt.Mandos", bus,

2020

do_not_queue=True))

1896

2021

except dbus.exceptions.NameExistsException as e:

1897

2022

logger.error(unicode(e) + ", disabling D-Bus")

1898

2023

use_dbus = False

1911

2036

1912

2037

client_class = Client

1913

2038

if use_dbus:

1914

client_class = functools.partial(ClientDBus, bus = bus)

2039

client_class = functools.partial(ClientDBusTransitional,

2040

bus = bus)

1915

2041

def client_config_items(config, section):

1916

2042

special_settings = {

1917

2043

"approved_by_default":

1947

2073

del pidfilename

1948

2074

1949

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

1950

2076

1951

2077

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1952

2078

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1953

2079

1956

2082

"""A D-Bus proxy object"""

1957

2083

def __init__(self):

1958

2084

dbus.service.Object.__init__(self, bus, "/")

1959

_interface = "se.bsnet.fukt.Mandos"

2085

_interface = "se.recompile.Mandos"

1960

2086

1961

2087

@dbus.service.signal(_interface, signature="o")

1962

2088

def ClientAdded(self, objpath):

2004

2130

2005

2131

del _interface

2006

2132

2007

mandos_dbus_service = MandosDBusService()

2133

class MandosDBusServiceTransitional(MandosDBusService):

2134

__metaclass__ = AlternateDBusNamesMetaclass

2135

mandos_dbus_service = MandosDBusServiceTransitional()

2008

2136

2009

2137

def cleanup():

2010

2138

"Cleanup function; run on exit"

2011

2139

service.cleanup()

2012

2140

2141

multiprocessing.active_children()

2013

2142

while tcp_server.clients:

2014

2143

client = tcp_server.clients.pop()

2015

2144

if use_dbus:

2019

2148

client.disable(quiet=True)

2020

2149

if use_dbus:

2021

2150

# Emit D-Bus signal

2022

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2151

mandos_dbus_service.ClientRemoved(client

2152

.dbus_object_path,

2023

2153

client.name)

2024

2154

2025

2155

atexit.register(cleanup)

2074

2204

# Must run before the D-Bus bus name gets deregistered

2075

2205

cleanup()

2076

2206

2207

2077

2208

if __name__ == '__main__':

2078

2209

main()