/mandos/trunk : revision 515

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

66

70

67

import dbus

71

68

import dbus.service

76

73

import ctypes.util

77

74

import xml.dom.minidom

78

75

import inspect

79

import GnuPGInterface

80

76

81

77

try:

82

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

86

82

except ImportError:

87

83

SO_BINDTODEVICE = None

88

84

89

version = "1.5.3"

90

stored_state_file = "clients.pickle"

91

92

logger = logging.getLogger()

85

86

version = "1.4.0"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

93

90

syslogger = (logging.handlers.SysLogHandler

94

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

92

address = str("/dev/log")))

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(debug, level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

if debug:

123

console = logging.StreamHandler()

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

125

' [%(process)d]:'

126

' %(levelname)s:'

127

' %(message)s'))

128

logger.addHandler(console)

129

logger.setLevel(level)

130

131

132

class PGPError(Exception):

133

"""Exception if encryption/decryption fails"""

134

pass

135

136

137

class PGPEngine(object):

138

"""A simple class for OpenPGP symmetric encryption & decryption"""

139

def __init__(self):

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.gnupg.options.meta_interactive = False

144

self.gnupg.options.homedir = self.tempdir

145

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

148

149

def __enter__(self):

150

return self

151

152

def __exit__ (self, exc_type, exc_value, traceback):

153

self._cleanup()

154

return False

155

156

def __del__(self):

157

self._cleanup()

158

159

def _cleanup(self):

160

if self.tempdir is not None:

161

# Delete contents of tempdir

162

for root, dirs, files in os.walk(self.tempdir,

163

topdown = False):

164

for filename in files:

165

os.remove(os.path.join(root, filename))

166

for dirname in dirs:

167

os.rmdir(os.path.join(root, dirname))

168

# Remove tempdir

169

os.rmdir(self.tempdir)

170

self.tempdir = None

171

172

def password_encode(self, password):

173

# Passphrase can not be empty and can not contain newlines or

174

# NUL bytes. So we prefix it and hex encode it.

175

return b"mandos" + binascii.hexlify(password)

176

177

def encrypt(self, data, password):

178

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

180

try:

181

proc = self.gnupg.run(['--symmetric'],

182

create_fhs=['stdin', 'stdout'],

183

attach_fhs={'stderr': devnull})

184

with contextlib.closing(proc.handles['stdin']) as f:

185

f.write(data)

186

with contextlib.closing(proc.handles['stdout']) as f:

187

ciphertext = f.read()

188

proc.wait()

189

except IOError as e:

190

raise PGPError(e)

191

self.gnupg.passphrase = None

192

return ciphertext

193

194

def decrypt(self, data, password):

195

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

197

try:

198

proc = self.gnupg.run(['--decrypt'],

199

create_fhs=['stdin', 'stdout'],

200

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

202

f.write(data)

203

with contextlib.closing(proc.handles['stdout']) as f:

204

decrypted_plaintext = f.read()

205

proc.wait()

206

except IOError as e:

207

raise PGPError(e)

208

self.gnupg.passphrase = None

209

return decrypted_plaintext

210

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

211

103

212

104

class AvahiError(Exception):

213

105

def __init__(self, value, *args, **kwargs):

243

135

server: D-Bus Server

244

136

bus: dbus.SystemBus()

245

137

"""

246

247

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

139

servicetype = None, port = None, TXT = None,

249

140

domain = "", host = "", max_renames = 32768,

262

153

self.server = None

263

154

self.bus = bus

264

155

self.entry_group_state_changed_match = None

265

266

156

def rename(self):

267

157

"""Derived from the Avahi example code"""

268

158

if self.rename_count >= self.max_renames:

274

164

.GetAlternativeServiceName(self.name))

275

165

logger.info("Changing Zeroconf service name to %r ...",

276

166

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

277

171

self.remove()

278

172

try:

279

173

self.add()

280

174

except dbus.exceptions.DBusException as error:

281

logger.critical("D-Bus Exception", exc_info=error)

175

logger.critical("DBusException: %s", error)

282

176

self.cleanup()

283

177

os._exit(1)

284

178

self.rename_count += 1

285

286

179

def remove(self):

287

180

"""Derived from the Avahi example code"""

288

181

if self.entry_group_state_changed_match is not None:

290

183

self.entry_group_state_changed_match = None

291

184

if self.group is not None:

292

185

self.group.Reset()

293

294

186

def add(self):

295

187

"""Derived from the Avahi example code"""

296

188

self.remove()

301

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

302

194

self.entry_group_state_changed_match = (

303

195

self.group.connect_to_signal(

304

'StateChanged', self.entry_group_state_changed))

196

'StateChanged', self .entry_group_state_changed))

305

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

306

198

self.name, self.type)

307

199

self.group.AddService(

313

205

dbus.UInt16(self.port),

314

206

avahi.string_array_to_txt_array(self.TXT))

315

207

self.group.Commit()

316

317

208

def entry_group_state_changed(self, state, error):

318

209

"""Derived from the Avahi example code"""

319

210

logger.debug("Avahi entry group state change: %i", state)

326

217

elif state == avahi.ENTRY_GROUP_FAILURE:

327

218

logger.critical("Avahi: Error in group state changed %s",

328

219

unicode(error))

329

raise AvahiGroupError("State changed: {0!s}"

330

.format(error))

331

220

raise AvahiGroupError("State changed: %s"

221

% unicode(error))

332

222

def cleanup(self):

333

223

"""Derived from the Avahi example code"""

334

224

if self.group is not None:

335

225

try:

336

226

self.group.Free()

337

227

except (dbus.exceptions.UnknownMethodException,

338

dbus.exceptions.DBusException):

228

dbus.exceptions.DBusException) as e:

339

229

pass

340

230

self.group = None

341

231

self.remove()

342

343

232

def server_state_changed(self, state, error=None):

344

233

"""Derived from the Avahi example code"""

345

234

logger.debug("Avahi server state change: %i", state)

364

253

logger.debug("Unknown state: %r", state)

365

254

else:

366

255

logger.debug("Unknown state: %r: %r", state, error)

367

368

256

def activate(self):

369

257

"""Derived from the Avahi example code"""

370

258

if self.server is None:

377

265

self.server_state_changed)

378

266

self.server_state_changed(self.server.GetState())

379

267

380

class AvahiServiceToSyslog(AvahiService):

381

def rename(self):

382

"""Add the new name to the syslog messages"""

383

ret = AvahiService.rename(self)

384

syslogger.setFormatter(logging.Formatter

385

('Mandos ({0}) [%(process)d]:'

386

' %(levelname)s: %(message)s'

387

.format(self.name)))

388

return ret

389

268

390

def timedelta_to_milliseconds(td):

269

def _timedelta_to_milliseconds(td):

391

270

"Convert a datetime.timedelta() to milliseconds"

392

271

return ((td.days * 24 * 60 * 60 * 1000)

393

272

+ (td.seconds * 1000)

394

273

+ (td.microseconds // 1000))

395

274

396

275

class Client(object):

397

276

"""A representation of a client host served by this server.

398

277

399

278

Attributes:

400

approved: bool(); 'None' if not yet approved/disapproved

279

_approved: bool(); 'None' if not yet approved/disapproved

401

280

approval_delay: datetime.timedelta(); Time to wait for approval

402

281

approval_duration: datetime.timedelta(); Duration of one approval

403

282

checker: subprocess.Popen(); a running checker process used

410

289

instance %(name)s can be used in the command.

411

290

checker_initiator_tag: a gobject event source tag, or None

412

291

created: datetime.datetime(); (UTC) object creation

413

client_structure: Object describing what attributes a client has

414

and is used for storing the client at exit

415

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

416

294

disable_initiator_tag: a gobject event source tag, or None

417

295

enabled: bool()

418

296

fingerprint: string (40 or 32 hexadecimal digits); used to

421

299

interval: datetime.timedelta(); How often to start a new checker

422

300

last_approval_request: datetime.datetime(); (UTC) or None

423

301

last_checked_ok: datetime.datetime(); (UTC) or None

424

last_checker_status: integer between 0 and 255 reflecting exit

425

status of last checker. -1 reflects crashed

426

checker, -2 means no checker completed yet.

427

last_enabled: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

428

303

name: string; from the config file, used in log messages and

429

304

D-Bus identifiers

430

305

secret: bytestring; sent verbatim (over TLS) to client

431

306

timeout: datetime.timedelta(); How long from last_checked_ok

432

307

until this client is disabled

433

extended_timeout: extra long timeout when secret has been sent

308

extended_timeout: extra long timeout when password has been sent

434

309

runtime_expansions: Allowed attributes for runtime expansion.

435

310

expires: datetime.datetime(); time (UTC) when a client will be

436

311

disabled, or None

440

315

"created", "enabled", "fingerprint",

441

316

"host", "interval", "last_checked_ok",

442

317

"last_enabled", "name", "timeout")

443

client_defaults = { "timeout": "5m",

444

"extended_timeout": "15m",

445

"interval": "2m",

446

"checker": "fping -q -- %%(host)s",

447

"host": "",

448

"approval_delay": "0s",

449

"approval_duration": "1s",

450

"approved_by_default": "True",

451

"enabled": "True",

452

}

453

318

454

319

def timeout_milliseconds(self):

455

320

"Return the 'timeout' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

457

322

458

323

def extended_timeout_milliseconds(self):

459

324

"Return the 'extended_timeout' attribute in milliseconds"

460

return timedelta_to_milliseconds(self.extended_timeout)

325

return _timedelta_to_milliseconds(self.extended_timeout)

461

326

462

327

def interval_milliseconds(self):

463

328

"Return the 'interval' attribute in milliseconds"

464

return timedelta_to_milliseconds(self.interval)

329

return _timedelta_to_milliseconds(self.interval)

465

330

466

331

def approval_delay_milliseconds(self):

467

return timedelta_to_milliseconds(self.approval_delay)

468

469

@staticmethod

470

def config_parser(config):

471

"""Construct a new dict of client settings of this form:

472

{ client_name: {setting_name: value, ...}, ...}

473

with exceptions for any special settings as defined above.

474

NOTE: Must be a pure function. Must return the same result

475

value given the same arguments.

476

"""

477

settings = {}

478

for client_name in config.sections():

479

section = dict(config.items(client_name))

480

client = settings[client_name] = {}

481

482

client["host"] = section["host"]

483

# Reformat values from string types to Python types

484

client["approved_by_default"] = config.getboolean(

485

client_name, "approved_by_default")

486

client["enabled"] = config.getboolean(client_name,

487

"enabled")

488

489

client["fingerprint"] = (section["fingerprint"].upper()

490

.replace(" ", ""))

491

if "secret" in section:

492

client["secret"] = section["secret"].decode("base64")

493

elif "secfile" in section:

494

with open(os.path.expanduser(os.path.expandvars

495

(section["secfile"])),

496

"rb") as secfile:

497

client["secret"] = secfile.read()

498

else:

499

raise TypeError("No secret or secfile for section {0}"

500

.format(section))

501

client["timeout"] = string_to_delta(section["timeout"])

502

client["extended_timeout"] = string_to_delta(

503

section["extended_timeout"])

504

client["interval"] = string_to_delta(section["interval"])

505

client["approval_delay"] = string_to_delta(

506

section["approval_delay"])

507

client["approval_duration"] = string_to_delta(

508

section["approval_duration"])

509

client["checker_command"] = section["checker"]

510

client["last_approval_request"] = None

511

client["last_checked_ok"] = None

512

client["last_checker_status"] = -2

513

514

return settings

515

516

def __init__(self, settings, name = None):

332

return _timedelta_to_milliseconds(self.approval_delay)

333

334

def __init__(self, name = None, disable_hook=None, config=None):

335

"""Note: the 'checker' key in 'config' sets the

336

'checker_command' attribute and *not* the 'checker'

337

attribute."""

517

338

self.name = name

518

# adding all client settings

519

for setting, value in settings.iteritems():

520

setattr(self, setting, value)

521

522

if self.enabled:

523

if not hasattr(self, "last_enabled"):

524

self.last_enabled = datetime.datetime.utcnow()

525

if not hasattr(self, "expires"):

526

self.expires = (datetime.datetime.utcnow()

527

+ self.timeout)

528

else:

529

self.last_enabled = None

530

self.expires = None

531

339

if config is None:

340

config = {}

532

341

logger.debug("Creating client %r", self.name)

533

342

# Uppercase and remove spaces from fingerprint for later

534

343

# comparison purposes with return value from the fingerprint()

535

344

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

536

347

logger.debug(" Fingerprint: %s", self.fingerprint)

537

self.created = settings.get("created",

538

datetime.datetime.utcnow())

539

540

# attributes specific for this server instance

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

351

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

353

"rb") as secfile:

354

self.secret = secfile.read()

355

else:

356

raise TypeError("No secret or secfile for client %s"

357

% self.name)

358

self.host = config.get("host", "")

359

self.created = datetime.datetime.utcnow()

360

self.enabled = False

361

self.last_approval_request = None

362

self.last_enabled = None

363

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

541

369

self.checker = None

542

370

self.checker_initiator_tag = None

543

371

self.disable_initiator_tag = None

372

self.expires = None

544

373

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

545

375

self.current_checker_command = None

546

self.approved = None

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

547

380

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

548

385

self.changedstate = (multiprocessing_manager

549

386

.Condition(multiprocessing_manager

550

387

.Lock()))

551

self.client_structure = [attr for attr in

552

self.__dict__.iterkeys()

553

if not attr.startswith("_")]

554

self.client_structure.append("client_structure")

555

556

for name, t in inspect.getmembers(type(self),

557

lambda obj:

558

isinstance(obj,

559

property)):

560

if not name.startswith("_"):

561

self.client_structure.append(name)

562

388

563

# Send notice to process children that client state has changed

564

389

def send_changedstate(self):

565

with self.changedstate:

566

self.changedstate.notify_all()

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

567

393

568

394

def enable(self):

569

395

"""Start this client's checker and timeout hooks"""

571

397

# Already enabled

572

398

return

573

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

574

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

575

410

self.enabled = True

576

411

self.last_enabled = datetime.datetime.utcnow()

577

self.init_checker()

412

# Also start a new checker *right now*.

413

self.start_checker()

578

414

579

415

def disable(self, quiet=True):

580

416

"""Disable this client."""

592

428

gobject.source_remove(self.checker_initiator_tag)

593

429

self.checker_initiator_tag = None

594

430

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

595

433

self.enabled = False

596

434

# Do not run this again if called by a gobject.timeout_add

597

435

return False

598

436

599

437

def __del__(self):

438

self.disable_hook = None

600

439

self.disable()

601

440

602

def init_checker(self):

603

# Schedule a new checker to be started an 'interval' from now,

604

# and every interval from then on.

605

self.checker_initiator_tag = (gobject.timeout_add

606

(self.interval_milliseconds(),

607

self.start_checker))

608

# Schedule a disable() when 'timeout' has passed

609

self.disable_initiator_tag = (gobject.timeout_add

610

(self.timeout_milliseconds(),

611

self.disable))

612

# Also start a new checker *right now*.

613

self.start_checker()

614

615

441

def checker_callback(self, pid, condition, command):

616

442

"""The checker has completed, so take appropriate actions."""

617

443

self.checker_callback_tag = None

618

444

self.checker = None

619

445

if os.WIFEXITED(condition):

620

self.last_checker_status = os.WEXITSTATUS(condition)

621

if self.last_checker_status == 0:

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

622

448

logger.info("Checker for %(name)s succeeded",

623

449

vars(self))

624

450

self.checked_ok()

626

452

logger.info("Checker for %(name)s failed",

627

453

vars(self))

628

454

else:

629

self.last_checker_status = -1

630

455

logger.warning("Checker for %(name)s crashed?",

631

456

vars(self))

632

457

633

def checked_ok(self):

634

"""Assert that the client has been seen, alive and well."""

635

self.last_checked_ok = datetime.datetime.utcnow()

636

self.last_checker_status = 0

637

self.bump_timeout()

638

639

def bump_timeout(self, timeout=None):

640

"""Bump up the timeout for this client."""

458

def checked_ok(self, timeout=None):

459

"""Bump up the timeout for this client.

460

461

This should only be called when the client has been seen,

462

alive and well.

463

"""

641

464

if timeout is None:

642

465

timeout = self.timeout

643

if self.disable_initiator_tag is not None:

644

gobject.source_remove(self.disable_initiator_tag)

645

if getattr(self, "enabled", False):

646

self.disable_initiator_tag = (gobject.timeout_add

647

(timedelta_to_milliseconds

648

(timeout), self.disable))

649

self.expires = datetime.datetime.utcnow() + timeout

466

self.last_checked_ok = datetime.datetime.utcnow()

467

gobject.source_remove(self.disable_initiator_tag)

468

self.disable_initiator_tag = (gobject.timeout_add

469

(_timedelta_to_milliseconds

470

(timeout), self.disable))

471

self.expires = datetime.datetime.utcnow() + timeout

650

472

651

473

def need_approval(self):

652

474

self.last_approval_request = datetime.datetime.utcnow()

696

518

try:

697

519

command = self.checker_command % escaped_attrs

698

520

except TypeError as error:

699

logger.error('Could not format string "%s"',

700

self.checker_command, exc_info=error)

521

logger.error('Could not format string "%s":'

522

' %s', self.checker_command, error)

701

523

return True # Try again later

702

524

self.current_checker_command = command

703

525

try:

721

543

gobject.source_remove(self.checker_callback_tag)

722

544

self.checker_callback(pid, status, command)

723

545

except OSError as error:

724

logger.error("Failed to start subprocess",

725

exc_info=error)

546

logger.error("Failed to start subprocess: %s",

547

error)

726

548

# Re-run this periodically if run by gobject.timeout_add

727

549

return True

728

550

735

557

return

736

558

logger.debug("Stopping checker for %(name)s", vars(self))

737

559

try:

738

self.checker.terminate()

560

os.kill(self.checker.pid, signal.SIGTERM)

739

561

#time.sleep(0.5)

740

562

#if self.checker.poll() is None:

741

# self.checker.kill()

563

# os.kill(self.checker.pid, signal.SIGKILL)

742

564

except OSError as error:

743

565

if error.errno != errno.ESRCH: # No such process

744

566

raise

761

583

# "Set" method, so we fail early here:

762

584

if byte_arrays and signature != "ay":

763

585

raise ValueError("Byte arrays not supported for non-'ay'"

764

" signature {0!r}".format(signature))

586

" signature %r" % signature)

765

587

def decorator(func):

766

588

func._dbus_is_property = True

767

589

func._dbus_interface = dbus_interface

775

597

return decorator

776

598

777

599

778

def dbus_interface_annotations(dbus_interface):

779

"""Decorator for marking functions returning interface annotations

780

781

Usage:

782

783

@dbus_interface_annotations("org.example.Interface")

784

def _foo(self): # Function name does not matter

785

return {"org.freedesktop.DBus.Deprecated": "true",

786

"org.freedesktop.DBus.Property.EmitsChangedSignal":

787

"false"}

788

"""

789

def decorator(func):

790

func._dbus_is_interface = True

791

func._dbus_interface = dbus_interface

792

func._dbus_name = dbus_interface

793

return func

794

return decorator

795

796

797

def dbus_annotations(annotations):

798

"""Decorator to annotate D-Bus methods, signals or properties

799

Usage:

800

801

@dbus_service_property("org.example.Interface", signature="b",

802

access="r")

803

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

804

"org.freedesktop.DBus.Property."

805

"EmitsChangedSignal": "false"})

806

def Property_dbus_property(self):

807

return dbus.Boolean(False)

808

"""

809

def decorator(func):

810

func._dbus_annotations = annotations

811

return func

812

return decorator

813

814

815

600

class DBusPropertyException(dbus.exceptions.DBusException):

816

601

"""A base class for D-Bus property-related exceptions

817

602

"""

840

625

"""

841

626

842

627

@staticmethod

843

def _is_dbus_thing(thing):

844

"""Returns a function testing if an attribute is a D-Bus thing

845

846

If called like _is_dbus_thing("method") it returns a function

847

suitable for use as predicate to inspect.getmembers().

848

"""

849

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

850

False)

628

def _is_dbus_property(obj):

629

return getattr(obj, "_dbus_is_property", False)

851

630

852

def _get_all_dbus_things(self, thing):

631

def _get_all_dbus_properties(self):

853

632

"""Returns a generator of (name, attribute) pairs

854

633

"""

855

return ((getattr(athing.__get__(self), "_dbus_name",

856

name),

857

athing.__get__(self))

634

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

858

635

for cls in self.__class__.__mro__

859

for name, athing in

860

inspect.getmembers(cls,

861

self._is_dbus_thing(thing)))

636

for name, prop in

637

inspect.getmembers(cls, self._is_dbus_property))

862

638

863

639

def _get_dbus_property(self, interface_name, property_name):

864

640

"""Returns a bound method if one exists which is a D-Bus

866

642

"""

867

643

for cls in self.__class__.__mro__:

868

644

for name, value in (inspect.getmembers

869

(cls,

870

self._is_dbus_thing("property"))):

645

(cls, self._is_dbus_property)):

871

646

if (value._dbus_name == property_name

872

647

and value._dbus_interface == interface_name):

873

648

return value.__get__(self)

902

677

# signatures other than "ay".

903

678

if prop._dbus_signature != "ay":

904

679

raise ValueError

905

value = dbus.ByteArray(b''.join(chr(byte)

906

for byte in value))

680

value = dbus.ByteArray(''.join(unichr(byte)

681

for byte in value))

907

682

prop(value)

908

683

909

684

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

914

689

915

690

Note: Will not include properties with access="write".

916

691

"""

917

properties = {}

918

for name, prop in self._get_all_dbus_things("property"):

692

all = {}

693

for name, prop in self._get_all_dbus_properties():

919

694

if (interface_name

920

695

and interface_name != prop._dbus_interface):

921

696

# Interface non-empty but did not match

925

700

continue

926

701

value = prop()

927

702

if not hasattr(value, "variant_level"):

928

properties[name] = value

703

all[name] = value

929

704

continue

930

properties[name] = type(value)(value, variant_level=

931

value.variant_level+1)

932

return dbus.Dictionary(properties, signature="sv")

705

all[name] = type(value)(value, variant_level=

706

value.variant_level+1)

707

return dbus.Dictionary(all, signature="sv")

933

708

934

709

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

935

710

out_signature="s",

936

711

path_keyword='object_path',

937

712

connection_keyword='connection')

938

713

def Introspect(self, object_path, connection):

939

"""Overloading of standard D-Bus method.

940

941

Inserts property tags and interface annotation tags.

714

"""Standard D-Bus method, overloaded to insert property tags.

942

715

"""

943

716

xmlstring = dbus.service.Object.Introspect(self, object_path,

944

717

connection)

951

724

e.setAttribute("access", prop._dbus_access)

952

725

return e

953

726

for if_tag in document.getElementsByTagName("interface"):

954

# Add property tags

955

727

for tag in (make_tag(document, name, prop)

956

728

for name, prop

957

in self._get_all_dbus_things("property")

729

in self._get_all_dbus_properties()

958

730

if prop._dbus_interface

959

731

== if_tag.getAttribute("name")):

960

732

if_tag.appendChild(tag)

961

# Add annotation tags

962

for typ in ("method", "signal", "property"):

963

for tag in if_tag.getElementsByTagName(typ):

964

annots = dict()

965

for name, prop in (self.

966

_get_all_dbus_things(typ)):

967

if (name == tag.getAttribute("name")

968

and prop._dbus_interface

969

== if_tag.getAttribute("name")):

970

annots.update(getattr

971

(prop,

972

"_dbus_annotations",

973

{}))

974

for name, value in annots.iteritems():

975

ann_tag = document.createElement(

976

"annotation")

977

ann_tag.setAttribute("name", name)

978

ann_tag.setAttribute("value", value)

979

tag.appendChild(ann_tag)

980

# Add interface annotation tags

981

for annotation, value in dict(

982

itertools.chain(

983

*(annotations().iteritems()

984

for name, annotations in

985

self._get_all_dbus_things("interface")

986

if name == if_tag.getAttribute("name")

987

))).iteritems():

988

ann_tag = document.createElement("annotation")

989

ann_tag.setAttribute("name", annotation)

990

ann_tag.setAttribute("value", value)

991

if_tag.appendChild(ann_tag)

992

733

# Add the names to the return values for the

993

734

# "org.freedesktop.DBus.Properties" methods

994

735

if (if_tag.getAttribute("name")

1009

750

except (AttributeError, xml.dom.DOMException,

1010

751

xml.parsers.expat.ExpatError) as error:

1011

752

logger.error("Failed to override Introspection method",

1012

exc_info=error)

753

error)

1013

754

return xmlstring

1014

755

1015

756

1020

761

return dbus.String(dt.isoformat(),

1021

762

variant_level=variant_level)

1022

763

1023

1024

764

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

1025

765

.__metaclass__):

1026

766

"""Applied to an empty subclass of a D-Bus object, this metaclass

1029

769

def __new__(mcs, name, bases, attr):

1030

770

# Go through all the base classes which could have D-Bus

1031

771

# methods, signals, or properties in them

1032

old_interface_names = []

1033

772

for base in (b for b in bases

1034

773

if issubclass(b, dbus.service.Object)):

1035

774

# Go though all attributes of the base class

1045

784

alt_interface = (attribute._dbus_interface

1046

785

.replace("se.recompile.Mandos",

1047

786

"se.bsnet.fukt.Mandos"))

1048

if alt_interface != attribute._dbus_interface:

1049

old_interface_names.append(alt_interface)

1050

787

# Is this a D-Bus signal?

1051

788

if getattr(attribute, "_dbus_is_signal", False):

1052

789

# Extract the original non-method function by

1067

804

nonmethod_func.func_name,

1068

805

nonmethod_func.func_defaults,

1069

806

nonmethod_func.func_closure)))

1070

# Copy annotations, if any

1071

try:

1072

new_function._dbus_annotations = (

1073

dict(attribute._dbus_annotations))

1074

except AttributeError:

1075

pass

1076

807

# Define a creator of a function to call both the

1077

808

# old and new functions, so both the old and new

1078

809

# signals gets sent when the function is called

1106

837

attribute.func_name,

1107

838

attribute.func_defaults,

1108

839

attribute.func_closure)))

1109

# Copy annotations, if any

1110

try:

1111

attr[attrname]._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1113

except AttributeError:

1114

pass

1115

840

# Is this a D-Bus property?

1116

841

elif getattr(attribute, "_dbus_is_property", False):

1117

842

# Create a new, but exactly alike, function

1131

856

attribute.func_name,

1132

857

attribute.func_defaults,

1133

858

attribute.func_closure)))

1134

# Copy annotations, if any

1135

try:

1136

attr[attrname]._dbus_annotations = (

1137

dict(attribute._dbus_annotations))

1138

except AttributeError:

1139

pass

1140

# Is this a D-Bus interface?

1141

elif getattr(attribute, "_dbus_is_interface", False):

1142

# Create a new, but exactly alike, function

1143

# object. Decorate it to be a new D-Bus interface

1144

# with the alternate D-Bus interface name. Add it

1145

# to the class.

1146

attr[attrname] = (dbus_interface_annotations

1147

(alt_interface)

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1154

# Deprecate all old interfaces

1155

iname="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1156

for old_interface_name in old_interface_names:

1157

@dbus_interface_annotations(old_interface_name)

1158

def func(self):

1159

return { "org.freedesktop.DBus.Deprecated": "true" }

1160

# Find an unused name

1161

for aname in (iname.format(i) for i in itertools.count()):

1162

if aname not in attr:

1163

attr[aname] = func

1164

break

1165

859

return type.__new__(mcs, name, bases, attr)

1166

860

1167

1168

861

class ClientDBus(Client, DBusObjectWithProperties):

1169

862

"""A Client class using D-Bus

1170

863

1179

872

# dbus.service.Object doesn't use super(), so we can't either.

1180

873

1181

874

def __init__(self, bus = None, *args, **kwargs):

875

self._approvals_pending = 0

1182

876

self.bus = bus

1183

877

Client.__init__(self, *args, **kwargs)

1184

878

# Only now, when this client is initialized, can it show up on

1190

884

("/clients/" + client_object_name))

1191

885

DBusObjectWithProperties.__init__(self, self.bus,

1192

886

self.dbus_object_path)

1193

887

1194

888

def notifychangeproperty(transform_func,

1195

889

dbus_name, type_func=lambda x: x,

1196

890

variant_level=1):

1197

891

""" Modify a variable so that it's a property which announces

1198

892

its changes to DBus.

1199

1200

transform_fun: Function that takes a value and a variant_level

1201

and transforms it to a D-Bus type.

893

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

1202

896

dbus_name: D-Bus name of the variable

1203

897

type_func: Function that transform the value before sending it

1204

898

to the D-Bus. Default: no transform

1211

905

type_func(getattr(self, attrname, None))

1212

906

!= type_func(value)):

1213

907

dbus_value = transform_func(type_func(value),

1214

variant_level

1215

=variant_level)

908

variant_level)

1216

909

self.PropertyChanged(dbus.String(dbus_name),

1217

910

dbus_value)

1218

911

setattr(self, attrname, value)

1219

912

1220

913

return property(lambda self: getattr(self, attrname), setter)

1221

914

915

1222

916

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1223

917

approvals_pending = notifychangeproperty(dbus.Boolean,

1224

918

"ApprovalPending",

1231

925

checker is not None)

1232

926

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1233

927

"LastCheckedOK")

1234

last_checker_status = notifychangeproperty(dbus.Int16,

1235

"LastCheckerStatus")

1236

928

last_approval_request = notifychangeproperty(

1237

929

datetime_to_dbus, "LastApprovalRequest")

1238

930

approved_by_default = notifychangeproperty(dbus.Boolean,

1239

931

"ApprovedByDefault")

1240

approval_delay = notifychangeproperty(dbus.UInt64,

932

approval_delay = notifychangeproperty(dbus.UInt16,

1241

933

"ApprovalDelay",

1242

934

type_func =

1243

timedelta_to_milliseconds)

935

_timedelta_to_milliseconds)

1244

936

approval_duration = notifychangeproperty(

1245

dbus.UInt64, "ApprovalDuration",

1246

type_func = timedelta_to_milliseconds)

937

dbus.UInt16, "ApprovalDuration",

938

type_func = _timedelta_to_milliseconds)

1247

939

host = notifychangeproperty(dbus.String, "Host")

1248

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

940

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1249

941

type_func =

1250

timedelta_to_milliseconds)

942

_timedelta_to_milliseconds)

1251

943

extended_timeout = notifychangeproperty(

1252

dbus.UInt64, "ExtendedTimeout",

1253

type_func = timedelta_to_milliseconds)

1254

interval = notifychangeproperty(dbus.UInt64,

944

dbus.UInt16, "ExtendedTimeout",

945

type_func = _timedelta_to_milliseconds)

946

interval = notifychangeproperty(dbus.UInt16,

1255

947

"Interval",

1256

948

type_func =

1257

timedelta_to_milliseconds)

949

_timedelta_to_milliseconds)

1258

950

checker_command = notifychangeproperty(dbus.String, "Checker")

1259

951

1260

952

del notifychangeproperty

1302

994

return r

1303

995

1304

996

def _reset_approved(self):

1305

self.approved = None

997

self._approved = None

1306

998

return False

1307

999

1308

1000

def approve(self, value=True):

1309

1001

self.send_changedstate()

1310

self.approved = value

1311

gobject.timeout_add(timedelta_to_milliseconds

1002

self._approved = value

1003

gobject.timeout_add(_timedelta_to_milliseconds

1312

1004

(self.approval_duration),

1313

1005

self._reset_approved)

1314

1006

1007

1315

1008

## D-Bus methods, signals & properties

1316

1009

_interface = "se.recompile.Mandos.Client"

1317

1010

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1325

1011

## Signals

1326

1012

1327

1013

# CheckerCompleted - signal

1426

1112

access="readwrite")

1427

1113

def ApprovalDuration_dbus_property(self, value=None):

1428

1114

if value is None: # get

1429

return dbus.UInt64(timedelta_to_milliseconds(

1115

return dbus.UInt64(_timedelta_to_milliseconds(

1430

1116

self.approval_duration))

1431

1117

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1432

1118

1446

1132

def Host_dbus_property(self, value=None):

1447

1133

if value is None: # get

1448

1134

return dbus.String(self.host)

1449

self.host = unicode(value)

1135

self.host = value

1450

1136

1451

1137

# Created - property

1452

1138

@dbus_service_property(_interface, signature="s", access="read")

1453

1139

def Created_dbus_property(self):

1454

return datetime_to_dbus(self.created)

1140

return dbus.String(datetime_to_dbus(self.created))

1455

1141

1456

1142

# LastEnabled - property

1457

1143

@dbus_service_property(_interface, signature="s", access="read")

1478

1164

return

1479

1165

return datetime_to_dbus(self.last_checked_ok)

1480

1166

1481

# LastCheckerStatus - property

1482

@dbus_service_property(_interface, signature="n",

1483

access="read")

1484

def LastCheckerStatus_dbus_property(self):

1485

return dbus.Int16(self.last_checker_status)

1486

1487

1167

# Expires - property

1488

1168

@dbus_service_property(_interface, signature="s", access="read")

1489

1169

def Expires_dbus_property(self):

1501

1181

if value is None: # get

1502

1182

return dbus.UInt64(self.timeout_milliseconds())

1503

1183

self.timeout = datetime.timedelta(0, 0, 0, value)

1184

if getattr(self, "disable_initiator_tag", None) is None:

1185

return

1504

1186

# Reschedule timeout

1505

if self.enabled:

1506

now = datetime.datetime.utcnow()

1507

time_to_die = timedelta_to_milliseconds(

1508

(self.last_checked_ok + self.timeout) - now)

1509

if time_to_die <= 0:

1510

# The timeout has passed

1511

self.disable()

1512

else:

1513

self.expires = (now +

1514

datetime.timedelta(milliseconds =

1515

time_to_die))

1516

if (getattr(self, "disable_initiator_tag", None)

1517

is None):

1518

return

1519

gobject.source_remove(self.disable_initiator_tag)

1520

self.disable_initiator_tag = (gobject.timeout_add

1521

(time_to_die,

1522

self.disable))

1187

gobject.source_remove(self.disable_initiator_tag)

1188

self.disable_initiator_tag = None

1189

self.expires = None

1190

time_to_die = (self.

1191

_timedelta_to_milliseconds((self

1192

.last_checked_ok

1193

+ self.timeout)

1194

- datetime.datetime

1195

.utcnow()))

1196

if time_to_die <= 0:

1197

# The timeout has passed

1198

self.disable()

1199

else:

1200

self.expires = (datetime.datetime.utcnow()

1201

+ datetime.timedelta(milliseconds =

1202

time_to_die))

1203

self.disable_initiator_tag = (gobject.timeout_add

1204

(time_to_die, self.disable))

1523

1205

1524

1206

# ExtendedTimeout - property

1525

1207

@dbus_service_property(_interface, signature="t",

1538

1220

self.interval = datetime.timedelta(0, 0, 0, value)

1539

1221

if getattr(self, "checker_initiator_tag", None) is None:

1540

1222

return

1541

if self.enabled:

1542

# Reschedule checker run

1543

gobject.source_remove(self.checker_initiator_tag)

1544

self.checker_initiator_tag = (gobject.timeout_add

1545

(value, self.start_checker))

1546

self.start_checker() # Start one now, too

1223

# Reschedule checker run

1224

gobject.source_remove(self.checker_initiator_tag)

1225

self.checker_initiator_tag = (gobject.timeout_add

1226

(value, self.start_checker))

1227

self.start_checker() # Start one now, too

1547

1228

1548

1229

# Checker - property

1549

1230

@dbus_service_property(_interface, signature="s",

1551

1232

def Checker_dbus_property(self, value=None):

1552

1233

if value is None: # get

1553

1234

return dbus.String(self.checker_command)

1554

self.checker_command = unicode(value)

1235

self.checker_command = value

1555

1236

1556

1237

# CheckerRunning - property

1557

1238

@dbus_service_property(_interface, signature="b",

1586

1267

raise KeyError()

1587

1268

1588

1269

def __getattribute__(self, name):

1589

if name == '_pipe':

1270

if(name == '_pipe'):

1590

1271

return super(ProxyClient, self).__getattribute__(name)

1591

1272

self._pipe.send(('getattr', name))

1592

1273

data = self._pipe.recv()

1599

1280

return func

1600

1281

1601

1282

def __setattr__(self, name, value):

1602

if name == '_pipe':

1283

if(name == '_pipe'):

1603

1284

return super(ProxyClient, self).__setattr__(name, value)

1604

1285

self._pipe.send(('setattr', name, value))

1605

1286

1606

1607

1287

class ClientDBusTransitional(ClientDBus):

1608

1288

__metaclass__ = AlternateDBusNamesMetaclass

1609

1289

1610

1611

1290

class ClientHandler(socketserver.BaseRequestHandler, object):

1612

1291

"""A class to handle client connections.

1613

1292

1695

1374

client.Rejected("Disabled")

1696

1375

return

1697

1376

1698

if client.approved or not client.approval_delay:

1377

if client._approved or not client.approval_delay:

1699

1378

#We are approved or approval is disabled

1700

1379

break

1701

elif client.approved is None:

1380

elif client._approved is None:

1702

1381

logger.info("Client %s needs approval",

1703

1382

client.name)

1704

1383

if self.server.use_dbus:

1718

1397

time = datetime.datetime.now()

1719

1398

client.changedstate.acquire()

1720

1399

(client.changedstate.wait

1721

(float(client.timedelta_to_milliseconds(delay)

1400

(float(client._timedelta_to_milliseconds(delay)

1722

1401

/ 1000)))

1723

1402

client.changedstate.release()

1724

1403

time2 = datetime.datetime.now()

1741

1420

try:

1742

1421

sent = session.send(client.secret[sent_size:])

1743

1422

except gnutls.errors.GNUTLSError as error:

1744

logger.warning("gnutls send failed",

1745

exc_info=error)

1423

logger.warning("gnutls send failed")

1746

1424

return

1747

1425

logger.debug("Sent: %d, remaining: %d",

1748

1426

sent, len(client.secret)

1751

1429

1752

1430

logger.info("Sending secret to %s", client.name)

1753

1431

# bump the timeout using extended_timeout

1754

client.bump_timeout(client.extended_timeout)

1432

client.checked_ok(client.extended_timeout)

1755

1433

if self.server.use_dbus:

1756

1434

# Emit D-Bus signal

1757

1435

client.GotSecret()

1762

1440

try:

1763

1441

session.bye()

1764

1442

except gnutls.errors.GNUTLSError as error:

1765

logger.warning("GnuTLS bye failed",

1766

exc_info=error)

1443

logger.warning("GnuTLS bye failed")

1767

1444

1768

1445

@staticmethod

1769

1446

def peer_certificate(session):

1825

1502

# Convert the buffer to a Python bytestring

1826

1503

fpr = ctypes.string_at(buf, buf_len.value)

1827

1504

# Convert the bytestring to hexadecimal notation

1828

hex_fpr = binascii.hexlify(fpr).upper()

1505

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1829

1506

return hex_fpr

1830

1507

1831

1508

1834

1511

def sub_process_main(self, request, address):

1835

1512

try:

1836

1513

self.finish_request(request, address)

1837

except Exception:

1514

except:

1838

1515

self.handle_error(request, address)

1839

1516

self.close_request(request)

1840

1517

1945

1622

self.enabled = False

1946

1623

self.clients = clients

1947

1624

if self.clients is None:

1948

self.clients = {}

1625

self.clients = set()

1949

1626

self.use_dbus = use_dbus

1950

1627

self.gnutls_priority = gnutls_priority

1951

1628

IPv6_TCPServer.__init__(self, server_address,

1998

1675

fpr = request[1]

1999

1676

address = request[2]

2000

1677

2001

for c in self.clients.itervalues():

1678

for c in self.clients:

2002

1679

if c.fingerprint == fpr:

2003

1680

client = c

2004

1681

break

2081

1758

elif suffix == "w":

2082

1759

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2083

1760

else:

2084

raise ValueError("Unknown suffix {0!r}"

2085

.format(suffix))

1761

raise ValueError("Unknown suffix %r" % suffix)

2086

1762

except (ValueError, IndexError) as e:

2087

1763

raise ValueError(*(e.args))

2088

1764

timevalue += delta

2089

1765

return timevalue

2090

1766

2091

1767

1768

def if_nametoindex(interface):

1769

"""Call the C function if_nametoindex(), or equivalent

1770

1771

Note: This function cannot accept a unicode string."""

1772

global if_nametoindex

1773

try:

1774

if_nametoindex = (ctypes.cdll.LoadLibrary

1775

(ctypes.util.find_library("c"))

1776

.if_nametoindex)

1777

except (OSError, AttributeError):

1778

logger.warning("Doing if_nametoindex the hard way")

1779

def if_nametoindex(interface):

1780

"Get an interface index the hard way, i.e. using fcntl()"

1781

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1782

with contextlib.closing(socket.socket()) as s:

1783

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1784

struct.pack(str("16s16x"),

1785

interface))

1786

interface_index = struct.unpack(str("I"),

1787

ifreq[16:20])[0]

1788

return interface_index

1789

return if_nametoindex(interface)

1790

1791

2092

1792

def daemon(nochdir = False, noclose = False):

2093

1793

"""See daemon(3). Standard BSD Unix function.

2094

1794

2102

1802

sys.exit()

2103

1803

if not noclose:

2104

1804

# Close all standard open file descriptors

2105

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1805

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2106

1806

if not stat.S_ISCHR(os.fstat(null).st_mode):

2107

1807

raise OSError(errno.ENODEV,

2108

"{0} not a character device"

2109

.format(os.devnull))

1808

"%s not a character device"

1809

% os.path.devnull)

2110

1810

os.dup2(null, sys.stdin.fileno())

2111

1811

os.dup2(null, sys.stdout.fileno())

2112

1812

os.dup2(null, sys.stderr.fileno())

2121

1821

2122

1822

parser = argparse.ArgumentParser()

2123

1823

parser.add_argument("-v", "--version", action="version",

2124

version = "%(prog)s {0}".format(version),

1824

version = "%%(prog)s %s" % version,

2125

1825

help="show version number and exit")

2126

1826

parser.add_argument("-i", "--interface", metavar="IF",

2127

1827

help="Bind to interface IF")

2149

1849

" system bus interface")

2150

1850

parser.add_argument("--no-ipv6", action="store_false",

2151

1851

dest="use_ipv6", help="Do not use IPv6")

2152

parser.add_argument("--no-restore", action="store_false",

2153

dest="restore", help="Do not restore stored"

2154

" state")

2155

parser.add_argument("--statedir", metavar="DIR",

2156

help="Directory to save/restore state in")

2157

2158

1852

options = parser.parse_args()

2159

1853

2160

1854

if options.check:

2173

1867

"use_dbus": "True",

2174

1868

"use_ipv6": "True",

2175

1869

"debuglevel": "",

2176

"restore": "True",

2177

"statedir": "/var/lib/mandos"

2178

1870

}

2179

1871

2180

1872

# Parse config file for server-global settings

2197

1889

# options, if set.

2198

1890

for option in ("interface", "address", "port", "debug",

2199

1891

"priority", "servicename", "configdir",

2200

"use_dbus", "use_ipv6", "debuglevel", "restore",

2201

"statedir"):

1892

"use_dbus", "use_ipv6", "debuglevel"):

2202

1893

value = getattr(options, option)

2203

1894

if value is not None:

2204

1895

server_settings[option] = value

2216

1907

debuglevel = server_settings["debuglevel"]

2217

1908

use_dbus = server_settings["use_dbus"]

2218

1909

use_ipv6 = server_settings["use_ipv6"]

2219

stored_state_path = os.path.join(server_settings["statedir"],

2220

stored_state_file)

2221

2222

if debug:

2223

initlogger(debug, logging.DEBUG)

2224

else:

2225

if not debuglevel:

2226

initlogger(debug)

2227

else:

2228

level = getattr(logging, debuglevel.upper())

2229

initlogger(debug, level)

2230

1910

2231

1911

if server_settings["servicename"] != "Mandos":

2232

1912

syslogger.setFormatter(logging.Formatter

2233

('Mandos ({0}) [%(process)d]:'

2234

' %(levelname)s: %(message)s'

2235

.format(server_settings

2236

["servicename"])))

1913

('Mandos (%s) [%%(process)d]:'

1914

' %%(levelname)s: %%(message)s'

1915

% server_settings["servicename"]))

2237

1916

2238

1917

# Parse config file with clients

2239

client_config = configparser.SafeConfigParser(Client

2240

.client_defaults)

1918

client_defaults = { "timeout": "5m",

1919

"extended_timeout": "15m",

1920

"interval": "2m",

1921

"checker": "fping -q -- %%(host)s",

1922

"host": "",

1923

"approval_delay": "0s",

1924

"approval_duration": "1s",

1925

}

1926

client_config = configparser.SafeConfigParser(client_defaults)

2241

1927

client_config.read(os.path.join(server_settings["configdir"],

2242

1928

"clients.conf"))

2243

1929

2257

1943

pidfilename = "/var/run/mandos.pid"

2258

1944

try:

2259

1945

pidfile = open(pidfilename, "w")

2260

except IOError as e:

2261

logger.error("Could not open file %r", pidfilename,

2262

exc_info=e)

1946

except IOError:

1947

logger.error("Could not open file %r", pidfilename)

2263

1948

2264

for name in ("_mandos", "mandos", "nobody"):

1949

try:

1950

uid = pwd.getpwnam("_mandos").pw_uid

1951

gid = pwd.getpwnam("_mandos").pw_gid

1952

except KeyError:

2265

1953

try:

2266

uid = pwd.getpwnam(name).pw_uid

2267

gid = pwd.getpwnam(name).pw_gid

2268

break

1954

uid = pwd.getpwnam("mandos").pw_uid

1955

gid = pwd.getpwnam("mandos").pw_gid

2269

1956

except KeyError:

2270

continue

2271

else:

2272

uid = 65534

2273

gid = 65534

1957

try:

1958

uid = pwd.getpwnam("nobody").pw_uid

1959

gid = pwd.getpwnam("nobody").pw_gid

1960

except KeyError:

1961

uid = 65534

1962

gid = 65534

2274

1963

try:

2275

1964

os.setgid(gid)

2276

1965

os.setuid(uid)

2278

1967

if error[0] != errno.EPERM:

2279

1968

raise error

2280

1969

1970

if not debug and not debuglevel:

1971

syslogger.setLevel(logging.WARNING)

1972

console.setLevel(logging.WARNING)

1973

if debuglevel:

1974

level = getattr(logging, debuglevel.upper())

1975

syslogger.setLevel(level)

1976

console.setLevel(level)

1977

2281

1978

if debug:

2282

1979

# Enable all possible GnuTLS debugging

2283

1980

2293

1990

.gnutls_global_set_log_function(debug_gnutls))

2294

1991

2295

1992

# Redirect stdin so all checkers get /dev/null

2296

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1993

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2297

1994

os.dup2(null, sys.stdin.fileno())

2298

1995

if null > 2:

2299

1996

os.close(null)

1997

else:

1998

# No console logging

1999

logger.removeHandler(console)

2300

2000

2301

2001

# Need to fork before connecting to D-Bus

2302

2002

if not debug:

2303

2003

# Close all input and output, do double fork, etc.

2304

2004

daemon()

2305

2005

2306

gobject.threads_init()

2307

2308

2006

global main_loop

2309

2007

# From the Avahi example code

2310

DBusGMainLoop(set_as_default=True)

2008

DBusGMainLoop(set_as_default=True )

2311

2009

main_loop = gobject.MainLoop()

2312

2010

bus = dbus.SystemBus()

2313

2011

# End of Avahi example code

2319

2017

("se.bsnet.fukt.Mandos", bus,

2320

2018

do_not_queue=True))

2321

2019

except dbus.exceptions.NameExistsException as e:

2322

logger.error("Disabling D-Bus:", exc_info=e)

2020

logger.error(unicode(e) + ", disabling D-Bus")

2323

2021

use_dbus = False

2324

2022

server_settings["use_dbus"] = False

2325

2023

tcp_server.use_dbus = False

2326

2024

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2327

service = AvahiServiceToSyslog(name =

2328

server_settings["servicename"],

2329

servicetype = "_mandos._tcp",

2330

protocol = protocol, bus = bus)

2025

service = AvahiService(name = server_settings["servicename"],

2026

servicetype = "_mandos._tcp",

2027

protocol = protocol, bus = bus)

2331

2028

if server_settings["interface"]:

2332

2029

service.interface = (if_nametoindex

2333

2030

(str(server_settings["interface"])))

2339

2036

if use_dbus:

2340

2037

client_class = functools.partial(ClientDBusTransitional,

2341

2038

bus = bus)

2342

2343

client_settings = Client.config_parser(client_config)

2344

old_client_settings = {}

2345

clients_data = {}

2346

2347

# Get client data and settings from last running state.

2348

if server_settings["restore"]:

2349

try:

2350

with open(stored_state_path, "rb") as stored_state:

2351

clients_data, old_client_settings = (pickle.load

2352

(stored_state))

2353

os.remove(stored_state_path)

2354

except IOError as e:

2355

if e.errno == errno.ENOENT:

2356

logger.warning("Could not load persistent state: {0}"

2357

.format(os.strerror(e.errno)))

2358

else:

2359

logger.critical("Could not load persistent state:",

2360

exc_info=e)

2361

raise

2362

except EOFError as e:

2363

logger.warning("Could not load persistent state: "

2364

"EOFError:", exc_info=e)

2365

2366

with PGPEngine() as pgp:

2367

for client_name, client in clients_data.iteritems():

2368

# Decide which value to use after restoring saved state.

2369

# We have three different values: Old config file,

2370

# new config file, and saved state.

2371

# New config value takes precedence if it differs from old

2372

# config value, otherwise use saved state.

2373

for name, value in client_settings[client_name].items():

2374

try:

2375

# For each value in new config, check if it

2376

# differs from the old config value (Except for

2377

# the "secret" attribute)

2378

if (name != "secret" and

2379

value != old_client_settings[client_name]

2380

[name]):

2381

client[name] = value

2382

except KeyError:

2383

pass

2384

2385

# Clients who has passed its expire date can still be

2386

# enabled if its last checker was successful. Clients

2387

# whose checker succeeded before we stored its state is

2388

# assumed to have successfully run all checkers during

2389

# downtime.

2390

if client["enabled"]:

2391

if datetime.datetime.utcnow() >= client["expires"]:

2392

if not client["last_checked_ok"]:

2393

logger.warning(

2394

"disabling client {0} - Client never "

2395

"performed a successful checker"

2396

.format(client_name))

2397

client["enabled"] = False

2398

elif client["last_checker_status"] != 0:

2399

logger.warning(

2400

"disabling client {0} - Client "

2401

"last checker failed with error code {1}"

2402

.format(client_name,

2403

client["last_checker_status"]))

2404

client["enabled"] = False

2405

else:

2406

client["expires"] = (datetime.datetime

2407

.utcnow()

2408

+ client["timeout"])

2409

logger.debug("Last checker succeeded,"

2410

" keeping {0} enabled"

2411

.format(client_name))

2039

def client_config_items(config, section):

2040

special_settings = {

2041

"approved_by_default":

2042

lambda: config.getboolean(section,

2043

"approved_by_default"),

2044

}

2045

for name, value in config.items(section):

2412

2046

try:

2413

client["secret"] = (

2414

pgp.decrypt(client["encrypted_secret"],

2415

client_settings[client_name]

2416

["secret"]))

2417

except PGPError:

2418

# If decryption fails, we use secret from new settings

2419

logger.debug("Failed to decrypt {0} old secret"

2420

.format(client_name))

2421

client["secret"] = (

2422

client_settings[client_name]["secret"])

2423

2424

# Add/remove clients based on new changes made to config

2425

for client_name in (set(old_client_settings)

2426

- set(client_settings)):

2427

del clients_data[client_name]

2428

for client_name in (set(client_settings)

2429

- set(old_client_settings)):

2430

clients_data[client_name] = client_settings[client_name]

2431

2432

# Create all client objects

2433

for client_name, client in clients_data.iteritems():

2434

tcp_server.clients[client_name] = client_class(

2435

name = client_name, settings = client)

2436

2047

yield (name, special_settings[name]())

2048

except KeyError:

2049

yield (name, value)

2050

2051

tcp_server.clients.update(set(

2052

client_class(name = section,

2053

config= dict(client_config_items(

2054

client_config, section)))

2055

for section in client_config.sections()))

2437

2056

if not tcp_server.clients:

2438

2057

logger.warning("No clients defined")

2439

2058

2440

2059

if not debug:

2441

2060

try:

2442

2061

with pidfile:

2450

2069

# "pidfile" was never created

2451

2070

pass

2452

2071

del pidfilename

2072

2453

2073

signal.signal(signal.SIGINT, signal.SIG_IGN)

2454

2074

2455

2075

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2456

2076

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2457

2077

2458

2078

if use_dbus:

2459

class MandosDBusService(DBusObjectWithProperties):

2079

class MandosDBusService(dbus.service.Object):

2460

2080

"""A D-Bus proxy object"""

2461

2081

def __init__(self):

2462

2082

dbus.service.Object.__init__(self, bus, "/")

2463

2083

_interface = "se.recompile.Mandos"

2464

2084

2465

@dbus_interface_annotations(_interface)

2466

def _foo(self):

2467

return { "org.freedesktop.DBus.Property"

2468

".EmitsChangedSignal":

2469

"false"}

2470

2471

2085

@dbus.service.signal(_interface, signature="o")

2472

2086

def ClientAdded(self, objpath):

2473

2087

"D-Bus signal"

2487

2101

def GetAllClients(self):

2488

2102

"D-Bus method"

2489

2103

return dbus.Array(c.dbus_object_path

2490

for c in

2491

tcp_server.clients.itervalues())

2104

for c in tcp_server.clients)

2492

2105

2493

2106

@dbus.service.method(_interface,

2494

2107

out_signature="a{oa{sv}}")

2496

2109

"D-Bus method"

2497

2110

return dbus.Dictionary(

2498

2111

((c.dbus_object_path, c.GetAll(""))

2499

for c in tcp_server.clients.itervalues()),

2112

for c in tcp_server.clients),

2500

2113

signature="oa{sv}")

2501

2114

2502

2115

@dbus.service.method(_interface, in_signature="o")

2503

2116

def RemoveClient(self, object_path):

2504

2117

"D-Bus method"

2505

for c in tcp_server.clients.itervalues():

2118

for c in tcp_server.clients:

2506

2119

if c.dbus_object_path == object_path:

2507

del tcp_server.clients[c.name]

2120

tcp_server.clients.remove(c)

2508

2121

c.remove_from_connection()

2509

2122

# Don't signal anything except ClientRemoved

2510

2123

c.disable(quiet=True)

2524

2137

service.cleanup()

2525

2138

2526

2139

multiprocessing.active_children()

2527

if not (tcp_server.clients or client_settings):

2528

return

2529

2530

# Store client before exiting. Secrets are encrypted with key

2531

# based on what config file has. If config file is

2532

# removed/edited, old secret will thus be unrecovable.

2533

clients = {}

2534

with PGPEngine() as pgp:

2535

for client in tcp_server.clients.itervalues():

2536

key = client_settings[client.name]["secret"]

2537

client.encrypted_secret = pgp.encrypt(client.secret,

2538

key)

2539

client_dict = {}

2540

2541

# A list of attributes that can not be pickled

2542

# + secret.

2543

exclude = set(("bus", "changedstate", "secret",

2544

"checker"))

2545

for name, typ in (inspect.getmembers

2546

(dbus.service.Object)):

2547

exclude.add(name)

2548

2549

client_dict["encrypted_secret"] = (client

2550

.encrypted_secret)

2551

for attr in client.client_structure:

2552

if attr not in exclude:

2553

client_dict[attr] = getattr(client, attr)

2554

2555

clients[client.name] = client_dict

2556

del client_settings[client.name]["secret"]

2557

2558

try:

2559

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2560

prefix="clients-",

2561

dir=os.path.dirname

2562

(stored_state_path))

2563

with os.fdopen(tempfd, "wb") as stored_state:

2564

pickle.dump((clients, client_settings), stored_state)

2565

os.rename(tempname, stored_state_path)

2566

except (IOError, OSError) as e:

2567

if not debug:

2568

try:

2569

os.remove(tempname)

2570

except NameError:

2571

pass

2572

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2573

logger.warning("Could not save persistent state: {0}"

2574

.format(os.strerror(e.errno)))

2575

else:

2576

logger.warning("Could not save persistent state:",

2577

exc_info=e)

2578

raise e

2579

2580

# Delete all clients, and settings from config

2581

2140

while tcp_server.clients:

2582

name, client = tcp_server.clients.popitem()

2141

client = tcp_server.clients.pop()

2583

2142

if use_dbus:

2584

2143

client.remove_from_connection()

2144

client.disable_hook = None

2585

2145

# Don't signal anything except ClientRemoved

2586

2146

client.disable(quiet=True)

2587

2147

if use_dbus:

2589

2149

mandos_dbus_service.ClientRemoved(client

2590

2150

.dbus_object_path,

2591

2151

client.name)

2592

client_settings.clear()

2593

2152

2594

2153

atexit.register(cleanup)

2595

2154

2596

for client in tcp_server.clients.itervalues():

2155

for client in tcp_server.clients:

2597

2156

if use_dbus:

2598

2157

# Emit D-Bus signal

2599

2158

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2600

# Need to initiate checking of clients

2601

if client.enabled:

2602

client.init_checker()

2159

client.enable()

2603

2160

2604

2161

tcp_server.enable()

2605

2162

tcp_server.server_activate()

2608

2165

service.port = tcp_server.socket.getsockname()[1]

2609

2166

if use_ipv6:

2610

2167

logger.info("Now listening on address %r, port %d,"

2611

" flowinfo %d, scope_id %d",

2612

*tcp_server.socket.getsockname())

2168

" flowinfo %d, scope_id %d"

2169

% tcp_server.socket.getsockname())

2613

2170

else: # IPv4

2614

logger.info("Now listening on address %r, port %d",

2615

*tcp_server.socket.getsockname())

2171

logger.info("Now listening on address %r, port %d"

2172

% tcp_server.socket.getsockname())

2616

2173

2617

2174

#service.interface = tcp_server.socket.getsockname()[3]

2618

2175

2621

2178

try:

2622

2179

service.activate()

2623

2180

except dbus.exceptions.DBusException as error:

2624

logger.critical("D-Bus Exception", exc_info=error)

2181

logger.critical("DBusException: %s", error)

2625

2182

cleanup()

2626

2183

sys.exit(1)

2627

2184

# End of Avahi example code

2634

2191

logger.debug("Starting main loop")

2635

2192

main_loop.run()

2636

2193

except AvahiError as error:

2637

logger.critical("Avahi Error", exc_info=error)

2194

logger.critical("AvahiError: %s", error)

2638

2195

cleanup()

2639

2196

sys.exit(1)

2640

2197

except KeyboardInterrupt:

2645

2202

# Must run before the D-Bus bus name gets deregistered

2646

2203

cleanup()

2647

2204

2205

2648

2206

if __name__ == '__main__':

2649

2207

main()