/mandos/trunk : revision 518.1.3

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

65

67

66

68

import dbus

67

69

import dbus.service

72

74

import ctypes.util

73

75

import xml.dom.minidom

74

76

import inspect

77

import Crypto.Cipher.AES

75

78

76

79

try:

77

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

85

SO_BINDTODEVICE = None

83

86

84

87

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

89

93

syslogger = (logging.handlers.SysLogHandler

90

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

95

address = str("/dev/log")))

95

99

logger.addHandler(syslogger)

96

100

97

101

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

99

104

' %(levelname)s:'

100

105

' %(message)s'))

101

106

logger.addHandler(console)

102

107

108

103

109

class AvahiError(Exception):

104

110

def __init__(self, value, *args, **kwargs):

105

111

self.value = value

159

165

" after %i retries, exiting.",

160

166

self.rename_count)

161

167

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

163

170

logger.info("Changing Zeroconf service name to %r ...",

164

171

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

172

self.remove()

170

173

try:

171

174

self.add()

191

194

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

195

self.entry_group_state_changed_match = (

193

196

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

197

'StateChanged', self.entry_group_state_changed))

195

198

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

196

199

self.name, self.type)

197

200

self.group.AddService(

263

266

self.server_state_changed)

264

267

self.server_state_changed(self.server.GetState())

265

268

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

266

278

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

267

285

class Client(object):

268

286

"""A representation of a client host served by this server.

269

287

281

299

instance %(name)s can be used in the command.

282

300

checker_initiator_tag: a gobject event source tag, or None

283

301

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

284

304

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

305

disable_initiator_tag: a gobject event source tag, or None

287

306

enabled: bool()

288

307

fingerprint: string (40 or 32 hexadecimal digits); used to

291

310

interval: datetime.timedelta(); How often to start a new checker

292

311

last_approval_request: datetime.datetime(); (UTC) or None

293

312

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

294

316

last_enabled: datetime.datetime(); (UTC)

295

317

name: string; from the config file, used in log messages and

296

318

D-Bus identifiers

297

319

secret: bytestring; sent verbatim (over TLS) to client

298

320

timeout: datetime.timedelta(); How long from last_checked_ok

299

321

until this client is disabled

322

extended_timeout: extra long timeout when password has been sent

300

323

runtime_expansions: Allowed attributes for runtime expansion.

324

expires: datetime.datetime(); time (UTC) when a client will be

325

disabled, or None

301

326

"""

302

327

303

328

runtime_expansions = ("approval_delay", "approval_duration",

305

330

"host", "interval", "last_checked_ok",

306

331

"last_enabled", "name", "timeout")

307

332

308

@staticmethod

309

def _timedelta_to_milliseconds(td):

310

"Convert a datetime.timedelta() to milliseconds"

311

return ((td.days * 24 * 60 * 60 * 1000)

312

+ (td.seconds * 1000)

313

+ (td.microseconds // 1000))

314

315

333

def timeout_milliseconds(self):

316

334

"Return the 'timeout' attribute in milliseconds"

317

return self._timedelta_to_milliseconds(self.timeout)

335

return _timedelta_to_milliseconds(self.timeout)

336

337

def extended_timeout_milliseconds(self):

338

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

318

340

319

341

def interval_milliseconds(self):

320

342

"Return the 'interval' attribute in milliseconds"

321

return self._timedelta_to_milliseconds(self.interval)

322

343

return _timedelta_to_milliseconds(self.interval)

344

323

345

def approval_delay_milliseconds(self):

324

return self._timedelta_to_milliseconds(self.approval_delay)

346

return _timedelta_to_milliseconds(self.approval_delay)

325

347

326

def __init__(self, name = None, disable_hook=None, config=None):

348

def __init__(self, name = None, config=None):

327

349

"""Note: the 'checker' key in 'config' sets the

328

350

'checker_command' attribute and *not* the 'checker'

329

351

attribute."""

349

371

% self.name)

350

372

self.host = config.get("host", "")

351

373

self.created = datetime.datetime.utcnow()

352

self.enabled = False

374

self.enabled = True

353

375

self.last_approval_request = None

354

self.last_enabled = None

376

self.last_enabled = datetime.datetime.utcnow()

355

377

self.last_checked_ok = None

378

self.last_checker_status = None

356

379

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

357

382

self.interval = string_to_delta(config["interval"])

358

self.disable_hook = disable_hook

359

383

self.checker = None

360

384

self.checker_initiator_tag = None

361

385

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

362

387

self.checker_callback_tag = None

363

388

self.checker_command = config["checker"]

364

389

self.current_checker_command = None

365

self.last_connect = None

366

390

self._approved = None

367

391

self.approved_by_default = config.get("approved_by_default",

368

392

True)

371

395

config["approval_delay"])

372

396

self.approval_duration = string_to_delta(

373

397

config["approval_duration"])

374

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

375

409

410

# Send notice to process children that client state has changed

376

411

def send_changedstate(self):

377

self.changedstate.acquire()

378

self.changedstate.notify_all()

379

self.changedstate.release()

380

412

with self.changedstate:

413

self.changedstate.notify_all()

414

381

415

def enable(self):

382

416

"""Start this client's checker and timeout hooks"""

383

417

if getattr(self, "enabled", False):

384

418

# Already enabled

385

419

return

386

420

self.send_changedstate()

421

self.expires = datetime.datetime.utcnow() + self.timeout

422

self.enabled = True

387

423

self.last_enabled = datetime.datetime.utcnow()

388

# Schedule a new checker to be started an 'interval' from now,

389

# and every interval from then on.

390

self.checker_initiator_tag = (gobject.timeout_add

391

(self.interval_milliseconds(),

392

self.start_checker))

393

# Schedule a disable() when 'timeout' has passed

394

self.disable_initiator_tag = (gobject.timeout_add

395

(self.timeout_milliseconds(),

396

self.disable))

397

self.enabled = True

398

# Also start a new checker *right now*.

399

self.start_checker()

424

self.init_checker()

400

425

401

426

def disable(self, quiet=True):

402

427

"""Disable this client."""

409

434

if getattr(self, "disable_initiator_tag", False):

410

435

gobject.source_remove(self.disable_initiator_tag)

411

436

self.disable_initiator_tag = None

437

self.expires = None

412

438

if getattr(self, "checker_initiator_tag", False):

413

439

gobject.source_remove(self.checker_initiator_tag)

414

440

self.checker_initiator_tag = None

415

441

self.stop_checker()

416

if self.disable_hook:

417

self.disable_hook(self)

418

442

self.enabled = False

419

443

# Do not run this again if called by a gobject.timeout_add

420

444

return False

421

445

422

446

def __del__(self):

423

self.disable_hook = None

424

447

self.disable()

425

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

426

463

def checker_callback(self, pid, condition, command):

427

464

"""The checker has completed, so take appropriate actions."""

428

465

self.checker_callback_tag = None

429

466

self.checker = None

430

467

if os.WIFEXITED(condition):

431

exitstatus = os.WEXITSTATUS(condition)

432

if exitstatus == 0:

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

433

470

logger.info("Checker for %(name)s succeeded",

434

471

vars(self))

435

472

self.checked_ok()

437

474

logger.info("Checker for %(name)s failed",

438

475

vars(self))

439

476

else:

477

self.last_checker_status = -1

440

478

logger.warning("Checker for %(name)s crashed?",

441

479

vars(self))

442

480

443

def checked_ok(self):

481

def checked_ok(self, timeout=None):

444

482

"""Bump up the timeout for this client.

445

483

446

484

This should only be called when the client has been seen,

447

485

alive and well.

448

486

"""

487

if timeout is None:

488

timeout = self.timeout

449

489

self.last_checked_ok = datetime.datetime.utcnow()

450

gobject.source_remove(self.disable_initiator_tag)

451

self.disable_initiator_tag = (gobject.timeout_add

452

(self.timeout_milliseconds(),

453

self.disable))

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

454

497

455

498

def need_approval(self):

456

499

self.last_approval_request = datetime.datetime.utcnow()

496

539

'replace')))

497

540

for attr in

498

541

self.runtime_expansions)

499

542

500

543

try:

501

544

command = self.checker_command % escaped_attrs

502

545

except TypeError as error:

548

591

raise

549

592

self.checker = None

550

593

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

640

551

641

def dbus_service_property(dbus_interface, signature="v",

552

642

access="readwrite", byte_arrays=False):

553

643

"""Decorators for marking methods of a DBusObjectWithProperties to

599

689

600

690

class DBusObjectWithProperties(dbus.service.Object):

601

691

"""A D-Bus object with properties.

602

692

603

693

Classes inheriting from this can use the dbus_service_property

604

694

decorator to expose methods as D-Bus properties. It exposes the

605

695

standard Get(), Set(), and GetAll() methods on the D-Bus.

612

702

def _get_all_dbus_properties(self):

613

703

"""Returns a generator of (name, attribute) pairs

614

704

"""

615

return ((prop._dbus_name, prop)

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

706

for cls in self.__class__.__mro__

616

707

for name, prop in

617

inspect.getmembers(self, self._is_dbus_property))

708

inspect.getmembers(cls, self._is_dbus_property))

618

709

619

710

def _get_dbus_property(self, interface_name, property_name):

620

711

"""Returns a bound method if one exists which is a D-Bus

621

712

property with the specified name and interface.

622

713

"""

623

for name in (property_name,

624

property_name + "_dbus_property"):

625

prop = getattr(self, name, None)

626

if (prop is None

627

or not self._is_dbus_property(prop)

628

or prop._dbus_name != property_name

629

or (interface_name and prop._dbus_interface

630

and interface_name != prop._dbus_interface)):

631

continue

632

return prop

714

for cls in self.__class__.__mro__:

715

for name, value in (inspect.getmembers

716

(cls, self._is_dbus_property)):

717

if (value._dbus_name == property_name

718

and value._dbus_interface == interface_name):

719

return value.__get__(self)

720

633

721

# No such property

634

722

raise DBusPropertyNotFound(self.dbus_object_path + ":"

635

723

+ interface_name + "."

669

757

def GetAll(self, interface_name):

670

758

"""Standard D-Bus property GetAll() method, see D-Bus

671

759

standard.

672

760

673

761

Note: Will not include properties with access="write".

674

762

"""

675

763

all = {}

737

825

return xmlstring

738

826

739

827

828

def datetime_to_dbus (dt, variant_level=0):

829

"""Convert a UTC datetime.datetime() to a D-Bus type."""

830

if dt is None:

831

return dbus.String("", variant_level = variant_level)

832

return dbus.String(dt.isoformat(),

833

variant_level=variant_level)

834

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

839

"""

840

def __new__(mcs, name, bases, attr):

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

847

# Ignore non-D-Bus attributes, and D-Bus attributes

848

# with the wrong interface name

849

if (not hasattr(attribute, "_dbus_interface")

850

or not attribute._dbus_interface

851

.startswith("se.recompile.Mandos")):

852

continue

853

# Create an alternate D-Bus interface name based on

854

# the current name

855

alt_interface = (attribute._dbus_interface

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

858

# Is this a D-Bus signal?

859

if getattr(attribute, "_dbus_is_signal", False):

860

# Extract the original non-method function by

861

# black magic

862

nonmethod_func = (dict(

863

zip(attribute.func_code.co_freevars,

864

attribute.__closure__))["func"]

865

.cell_contents)

866

# Create a new, but exactly alike, function

867

# object, and decorate it to be a new D-Bus signal

868

# with the alternate D-Bus interface name

869

new_function = (dbus.service.signal

870

(alt_interface,

871

attribute._dbus_signature)

872

(types.FunctionType(

873

nonmethod_func.func_code,

874

nonmethod_func.func_globals,

875

nonmethod_func.func_name,

876

nonmethod_func.func_defaults,

877

nonmethod_func.func_closure)))

878

# Define a creator of a function to call both the

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

881

def fixscope(func1, func2):

882

"""This function is a scope container to pass

883

func1 and func2 to the "call_both" function

884

outside of its arguments"""

885

def call_both(*args, **kwargs):

886

"""This function will emit two D-Bus

887

signals by calling func1 and func2"""

888

func1(*args, **kwargs)

889

func2(*args, **kwargs)

890

return call_both

891

# Create the "call_both" function and add it to

892

# the class

893

attr[attrname] = fixscope(attribute,

894

new_function)

895

# Is this a D-Bus method?

896

elif getattr(attribute, "_dbus_is_method", False):

897

# Create a new, but exactly alike, function

898

# object. Decorate it to be a new D-Bus method

899

# with the alternate D-Bus interface name. Add it

900

# to the class.

901

attr[attrname] = (dbus.service.method

902

(alt_interface,

903

attribute._dbus_in_signature,

904

attribute._dbus_out_signature)

905

(types.FunctionType

906

(attribute.func_code,

907

attribute.func_globals,

908

attribute.func_name,

909

attribute.func_defaults,

910

attribute.func_closure)))

911

# Is this a D-Bus property?

912

elif getattr(attribute, "_dbus_is_property", False):

913

# Create a new, but exactly alike, function

914

# object, and decorate it to be a new D-Bus

915

# property with the alternate D-Bus interface

916

# name. Add it to the class.

917

attr[attrname] = (dbus_service_property

918

(alt_interface,

919

attribute._dbus_signature,

920

attribute._dbus_access,

921

attribute

922

._dbus_get_args_options

923

["byte_arrays"])

924

(types.FunctionType

925

(attribute.func_code,

926

attribute.func_globals,

927

attribute.func_name,

928

attribute.func_defaults,

929

attribute.func_closure)))

930

return type.__new__(mcs, name, bases, attr)

931

740

932

class ClientDBus(Client, DBusObjectWithProperties):

741

933

"""A Client class using D-Bus

742

934

751

943

# dbus.service.Object doesn't use super(), so we can't either.

752

944

753

945

def __init__(self, bus = None, *args, **kwargs):

946

self.bus = bus

947

Client.__init__(self, *args, **kwargs)

948

754

949

self._approvals_pending = 0

755

self.bus = bus

756

Client.__init__(self, *args, **kwargs)

757

950

# Only now, when this client is initialized, can it show up on

758

951

# the D-Bus

759

952

client_object_name = unicode(self.name).translate(

764

957

DBusObjectWithProperties.__init__(self, self.bus,

765

958

self.dbus_object_path)

766

959

767

def _get_approvals_pending(self):

768

return self._approvals_pending

769

def _set_approvals_pending(self, value):

770

old_value = self._approvals_pending

771

self._approvals_pending = value

772

bval = bool(value)

773

if (hasattr(self, "dbus_object_path")

774

and bval is not bool(old_value)):

775

dbus_bool = dbus.Boolean(bval, variant_level=1)

776

self.PropertyChanged(dbus.String("ApprovalPending"),

777

dbus_bool)

960

def notifychangeproperty(transform_func,

961

dbus_name, type_func=lambda x: x,

962

variant_level=1):

963

""" Modify a variable so that it's a property which announces

964

its changes to DBus.

778

965

779

approvals_pending = property(_get_approvals_pending,

780

_set_approvals_pending)

781

del _get_approvals_pending, _set_approvals_pending

782

783

@staticmethod

784

def _datetime_to_dbus(dt, variant_level=0):

785

"""Convert a UTC datetime.datetime() to a D-Bus type."""

786

return dbus.String(dt.isoformat(),

787

variant_level=variant_level)

788

789

def enable(self):

790

oldstate = getattr(self, "enabled", False)

791

r = Client.enable(self)

792

if oldstate != self.enabled:

793

# Emit D-Bus signals

794

self.PropertyChanged(dbus.String("Enabled"),

795

dbus.Boolean(True, variant_level=1))

796

self.PropertyChanged(

797

dbus.String("LastEnabled"),

798

self._datetime_to_dbus(self.last_enabled,

799

variant_level=1))

800

return r

801

802

def disable(self, quiet = False):

803

oldstate = getattr(self, "enabled", False)

804

r = Client.disable(self, quiet=quiet)

805

if not quiet and oldstate != self.enabled:

806

# Emit D-Bus signal

807

self.PropertyChanged(dbus.String("Enabled"),

808

dbus.Boolean(False, variant_level=1))

809

return r

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

968

dbus_name: D-Bus name of the variable

969

type_func: Function that transform the value before sending it

970

to the D-Bus. Default: no transform

971

variant_level: D-Bus variant level. Default: 1

972

"""

973

attrname = "_{0}".format(dbus_name)

974

def setter(self, value):

975

if hasattr(self, "dbus_object_path"):

976

if (not hasattr(self, attrname) or

977

type_func(getattr(self, attrname, None))

978

!= type_func(value)):

979

dbus_value = transform_func(type_func(value),

980

variant_level

981

=variant_level)

982

self.PropertyChanged(dbus.String(dbus_name),

983

dbus_value)

984

setattr(self, attrname, value)

985

986

return property(lambda self: getattr(self, attrname), setter)

987

988

989

expires = notifychangeproperty(datetime_to_dbus, "Expires")

990

approvals_pending = notifychangeproperty(dbus.Boolean,

991

"ApprovalPending",

992

type_func = bool)

993

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

994

last_enabled = notifychangeproperty(datetime_to_dbus,

995

"LastEnabled")

996

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

997

type_func = lambda checker:

998

checker is not None)

999

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1000

"LastCheckedOK")

1001

last_approval_request = notifychangeproperty(

1002

datetime_to_dbus, "LastApprovalRequest")

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

1004

"ApprovedByDefault")

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1006

"ApprovalDelay",

1007

type_func =

1008

_timedelta_to_milliseconds)

1009

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

1012

host = notifychangeproperty(dbus.String, "Host")

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1014

type_func =

1015

_timedelta_to_milliseconds)

1016

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1020

"Interval",

1021

type_func =

1022

_timedelta_to_milliseconds)

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

1024

1025

del notifychangeproperty

810

1026

811

1027

def __del__(self, *args, **kwargs):

812

1028

try:

821

1037

*args, **kwargs):

822

1038

self.checker_callback_tag = None

823

1039

self.checker = None

824

# Emit D-Bus signal

825

self.PropertyChanged(dbus.String("CheckerRunning"),

826

dbus.Boolean(False, variant_level=1))

827

1040

if os.WIFEXITED(condition):

828

1041

exitstatus = os.WEXITSTATUS(condition)

829

1042

# Emit D-Bus signal

839

1052

return Client.checker_callback(self, pid, condition, command,

840

1053

*args, **kwargs)

841

1054

842

def checked_ok(self, *args, **kwargs):

843

Client.checked_ok(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastCheckedOK"),

847

(self._datetime_to_dbus(self.last_checked_ok,

848

variant_level=1)))

849

850

def need_approval(self, *args, **kwargs):

851

r = Client.need_approval(self, *args, **kwargs)

852

# Emit D-Bus signal

853

self.PropertyChanged(

854

dbus.String("LastApprovalRequest"),

855

(self._datetime_to_dbus(self.last_approval_request,

856

variant_level=1)))

857

return r

858

859

1055

def start_checker(self, *args, **kwargs):

860

1056

old_checker = self.checker

861

1057

if self.checker is not None:

868

1064

and old_checker_pid != self.checker.pid):

869

1065

# Emit D-Bus signal

870

1066

self.CheckerStarted(self.current_checker_command)

871

self.PropertyChanged(

872

dbus.String("CheckerRunning"),

873

dbus.Boolean(True, variant_level=1))

874

1067

return r

875

1068

876

def stop_checker(self, *args, **kwargs):

877

old_checker = getattr(self, "checker", None)

878

r = Client.stop_checker(self, *args, **kwargs)

879

if (old_checker is not None

880

and getattr(self, "checker", None) is None):

881

self.PropertyChanged(dbus.String("CheckerRunning"),

882

dbus.Boolean(False, variant_level=1))

883

return r

884

885

1069

def _reset_approved(self):

886

1070

self._approved = None

887

1071

return False

889

1073

def approve(self, value=True):

890

1074

self.send_changedstate()

891

1075

self._approved = value

892

gobject.timeout_add(self._timedelta_to_milliseconds

1076

gobject.timeout_add(_timedelta_to_milliseconds

893

1077

(self.approval_duration),

894

1078

self._reset_approved)

895

1079

896

1080

897

1081

## D-Bus methods, signals & properties

898

_interface = "se.bsnet.fukt.Mandos.Client"

1082

_interface = "se.recompile.Mandos.Client"

899

1083

900

1084

## Signals

901

1085

938

1122

"D-Bus signal"

939

1123

return self.need_approval()

940

1124

1125

# NeRwequest - signal

1126

@dbus.service.signal(_interface, signature="s")

1127

def NewRequest(self, ip):

1128

"""D-Bus signal

1129

Is sent after a client request a password.

1130

"""

1131

pass

1132

941

1133

## Methods

942

1134

943

1135

# Approve - method

987

1179

if value is None: # get

988

1180

return dbus.Boolean(self.approved_by_default)

989

1181

self.approved_by_default = bool(value)

990

# Emit D-Bus signal

991

self.PropertyChanged(dbus.String("ApprovedByDefault"),

992

dbus.Boolean(value, variant_level=1))

993

1182

994

1183

# ApprovalDelay - property

995

1184

@dbus_service_property(_interface, signature="t",

998

1187

if value is None: # get

999

1188

return dbus.UInt64(self.approval_delay_milliseconds())

1000

1189

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1001

# Emit D-Bus signal

1002

self.PropertyChanged(dbus.String("ApprovalDelay"),

1003

dbus.UInt64(value, variant_level=1))

1004

1190

1005

1191

# ApprovalDuration - property

1006

1192

@dbus_service_property(_interface, signature="t",

1007

1193

access="readwrite")

1008

1194

def ApprovalDuration_dbus_property(self, value=None):

1009

1195

if value is None: # get

1010

return dbus.UInt64(self._timedelta_to_milliseconds(

1196

return dbus.UInt64(_timedelta_to_milliseconds(

1011

1197

self.approval_duration))

1012

1198

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1013

# Emit D-Bus signal

1014

self.PropertyChanged(dbus.String("ApprovalDuration"),

1015

dbus.UInt64(value, variant_level=1))

1016

1199

1017

1200

# Name - property

1018

1201

@dbus_service_property(_interface, signature="s", access="read")

1031

1214

if value is None: # get

1032

1215

return dbus.String(self.host)

1033

1216

self.host = value

1034

# Emit D-Bus signal

1035

self.PropertyChanged(dbus.String("Host"),

1036

dbus.String(value, variant_level=1))

1037

1217

1038

1218

# Created - property

1039

1219

@dbus_service_property(_interface, signature="s", access="read")

1040

1220

def Created_dbus_property(self):

1041

return dbus.String(self._datetime_to_dbus(self.created))

1221

return dbus.String(datetime_to_dbus(self.created))

1042

1222

1043

1223

# LastEnabled - property

1044

1224

@dbus_service_property(_interface, signature="s", access="read")

1045

1225

def LastEnabled_dbus_property(self):

1046

if self.last_enabled is None:

1047

return dbus.String("")

1048

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1226

return datetime_to_dbus(self.last_enabled)

1049

1227

1050

1228

# Enabled - property

1051

1229

@dbus_service_property(_interface, signature="b",

1065

1243

if value is not None:

1066

1244

self.checked_ok()

1067

1245

return

1068

if self.last_checked_ok is None:

1069

return dbus.String("")

1070

return dbus.String(self._datetime_to_dbus(self

1071

.last_checked_ok))

1246

return datetime_to_dbus(self.last_checked_ok)

1247

1248

# Expires - property

1249

@dbus_service_property(_interface, signature="s", access="read")

1250

def Expires_dbus_property(self):

1251

return datetime_to_dbus(self.expires)

1072

1252

1073

1253

# LastApprovalRequest - property

1074

1254

@dbus_service_property(_interface, signature="s", access="read")

1075

1255

def LastApprovalRequest_dbus_property(self):

1076

if self.last_approval_request is None:

1077

return dbus.String("")

1078

return dbus.String(self.

1079

_datetime_to_dbus(self

1080

.last_approval_request))

1256

return datetime_to_dbus(self.last_approval_request)

1081

1257

1082

1258

# Timeout - property

1083

1259

@dbus_service_property(_interface, signature="t",

1086

1262

if value is None: # get

1087

1263

return dbus.UInt64(self.timeout_milliseconds())

1088

1264

self.timeout = datetime.timedelta(0, 0, 0, value)

1089

# Emit D-Bus signal

1090

self.PropertyChanged(dbus.String("Timeout"),

1091

dbus.UInt64(value, variant_level=1))

1092

1265

if getattr(self, "disable_initiator_tag", None) is None:

1093

1266

return

1094

1267

# Reschedule timeout

1095

1268

gobject.source_remove(self.disable_initiator_tag)

1096

1269

self.disable_initiator_tag = None

1097

time_to_die = (self.

1098

_timedelta_to_milliseconds((self

1099

.last_checked_ok

1100

+ self.timeout)

1101

- datetime.datetime

1102

.utcnow()))

1270

self.expires = None

1271

time_to_die = _timedelta_to_milliseconds((self

1272

.last_checked_ok

1273

+ self.timeout)

1274

- datetime.datetime

1275

.utcnow())

1103

1276

if time_to_die <= 0:

1104

1277

# The timeout has passed

1105

1278

self.disable()

1106

1279

else:

1280

self.expires = (datetime.datetime.utcnow()

1281

+ datetime.timedelta(milliseconds =

1282

time_to_die))

1107

1283

self.disable_initiator_tag = (gobject.timeout_add

1108

1284

(time_to_die, self.disable))

1109

1285

1286

# ExtendedTimeout - property

1287

@dbus_service_property(_interface, signature="t",

1288

access="readwrite")

1289

def ExtendedTimeout_dbus_property(self, value=None):

1290

if value is None: # get

1291

return dbus.UInt64(self.extended_timeout_milliseconds())

1292

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1293

1110

1294

# Interval - property

1111

1295

@dbus_service_property(_interface, signature="t",

1112

1296

access="readwrite")

1114

1298

if value is None: # get

1115

1299

return dbus.UInt64(self.interval_milliseconds())

1116

1300

self.interval = datetime.timedelta(0, 0, 0, value)

1117

# Emit D-Bus signal

1118

self.PropertyChanged(dbus.String("Interval"),

1119

dbus.UInt64(value, variant_level=1))

1120

1301

if getattr(self, "checker_initiator_tag", None) is None:

1121

1302

return

1122

1303

# Reschedule checker run

1124

1305

self.checker_initiator_tag = (gobject.timeout_add

1125

1306

(value, self.start_checker))

1126

1307

self.start_checker() # Start one now, too

1127

1308

1128

1309

# Checker - property

1129

1310

@dbus_service_property(_interface, signature="s",

1130

1311

access="readwrite")

1132

1313

if value is None: # get

1133

1314

return dbus.String(self.checker_command)

1134

1315

self.checker_command = value

1135

# Emit D-Bus signal

1136

self.PropertyChanged(dbus.String("Checker"),

1137

dbus.String(self.checker_command,

1138

variant_level=1))

1139

1316

1140

1317

# CheckerRunning - property

1141

1318

@dbus_service_property(_interface, signature="b",

1168

1345

self._pipe.send(('init', fpr, address))

1169

1346

if not self._pipe.recv():

1170

1347

raise KeyError()

1171

1348

1172

1349

def __getattribute__(self, name):

1173

1350

if(name == '_pipe'):

1174

1351

return super(ProxyClient, self).__getattribute__(name)

1181

1358

self._pipe.send(('funcall', name, args, kwargs))

1182

1359

return self._pipe.recv()[1]

1183

1360

return func

1184

1361

1185

1362

def __setattr__(self, name, value):

1186

1363

if(name == '_pipe'):

1187

1364

return super(ProxyClient, self).__setattr__(name, value)

1188

1365

self._pipe.send(('setattr', name, value))

1189

1366

1367

class ClientDBusTransitional(ClientDBus):

1368

__metaclass__ = AlternateDBusNamesMetaclass

1190

1369

1191

1370

class ClientHandler(socketserver.BaseRequestHandler, object):

1192

1371

"""A class to handle client connections.

1200

1379

unicode(self.client_address))

1201

1380

logger.debug("Pipe FD: %d",

1202

1381

self.server.child_pipe.fileno())

1203

1382

1204

1383

session = (gnutls.connection

1205

1384

.ClientSession(self.request,

1206

1385

gnutls.connection

1207

1386

.X509Credentials()))

1208

1387

1209

1388

# Note: gnutls.connection.X509Credentials is really a

1210

1389

# generic GnuTLS certificate credentials object so long as

1211

1390

# no X.509 keys are added to it. Therefore, we can use it

1212

1391

# here despite using OpenPGP certificates.

1213

1392

1214

1393

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1215

1394

# "+AES-256-CBC", "+SHA1",

1216

1395

# "+COMP-NULL", "+CTYPE-OPENPGP",

1222

1401

(gnutls.library.functions

1223

1402

.gnutls_priority_set_direct(session._c_object,

1224

1403

priority, None))

1225

1404

1226

1405

# Start communication using the Mandos protocol

1227

1406

# Get protocol number

1228

1407

line = self.request.makefile().readline()

1233

1412

except (ValueError, IndexError, RuntimeError) as error:

1234

1413

logger.error("Unknown protocol version: %s", error)

1235

1414

return

1236

1415

1237

1416

# Start GnuTLS connection

1238

1417

try:

1239

1418

session.handshake()

1243

1422

# established. Just abandon the request.

1244

1423

return

1245

1424

logger.debug("Handshake succeeded")

1246

1425

1247

1426

approval_required = False

1248

1427

try:

1249

1428

try:

1254

1433

logger.warning("Bad certificate: %s", error)

1255

1434

return

1256

1435

logger.debug("Fingerprint: %s", fpr)

1257

1436

if self.server.use_dbus:

1437

# Emit D-Bus signal

1438

client.NewRequest(str(self.client_address))

1439

1258

1440

try:

1259

1441

client = ProxyClient(child_pipe, fpr,

1260

1442

self.client_address)

1268

1450

1269

1451

while True:

1270

1452

if not client.enabled:

1271

logger.warning("Client %s is disabled",

1453

logger.info("Client %s is disabled",

1272

1454

client.name)

1273

1455

if self.server.use_dbus:

1274

1456

# Emit D-Bus signal

1275

client.Rejected("Disabled")

1457

client.Rejected("Disabled")

1276

1458

return

1277

1459

1278

1460

if client._approved or not client.approval_delay:

1295

1477

return

1296

1478

1297

1479

#wait until timeout or approved

1298

#x = float(client._timedelta_to_milliseconds(delay))

1299

1480

time = datetime.datetime.now()

1300

1481

client.changedstate.acquire()

1301

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1482

(client.changedstate.wait

1483

(float(client._timedelta_to_milliseconds(delay)

1484

/ 1000)))

1302

1485

client.changedstate.release()

1303

1486

time2 = datetime.datetime.now()

1304

1487

if (time2 - time) >= delay:

1326

1509

sent, len(client.secret)

1327

1510

- (sent_size + sent))

1328

1511

sent_size += sent

1329

1512

1330

1513

logger.info("Sending secret to %s", client.name)

1331

# bump the timeout as if seen

1332

client.checked_ok()

1514

# bump the timeout using extended_timeout

1515

client.checked_ok(client.extended_timeout)

1333

1516

if self.server.use_dbus:

1334

1517

# Emit D-Bus signal

1335

1518

client.GotSecret()

1414

1597

except:

1415

1598

self.handle_error(request, address)

1416

1599

self.close_request(request)

1417

1600

1418

1601

def process_request(self, request, address):

1419

1602

"""Start a new process to process the request."""

1420

multiprocessing.Process(target = self.sub_process_main,

1421

args = (request, address)).start()

1603

proc = multiprocessing.Process(target = self.sub_process_main,

1604

args = (request,

1605

address))

1606

proc.start()

1607

return proc

1608

1422

1609

1423

1610

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1424

1611

""" adds a pipe to the MixIn """

1428

1615

This function creates a new pipe in self.pipe

1429

1616

"""

1430

1617

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1431

1432

super(MultiprocessingMixInWithPipe,

1433

self).process_request(request, client_address)

1618

1619

proc = MultiprocessingMixIn.process_request(self, request,

1620

client_address)

1434

1621

self.child_pipe.close()

1435

self.add_pipe(parent_pipe)

1436

1437

def add_pipe(self, parent_pipe):

1622

self.add_pipe(parent_pipe, proc)

1623

1624

def add_pipe(self, parent_pipe, proc):

1438

1625

"""Dummy function; override as necessary"""

1439

1626

raise NotImplementedError

1440

1627

1628

1441

1629

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1442

1630

socketserver.TCPServer, object):

1443

1631

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1517

1705

self.enabled = False

1518

1706

self.clients = clients

1519

1707

if self.clients is None:

1520

self.clients = set()

1708

self.clients = {}

1521

1709

self.use_dbus = use_dbus

1522

1710

self.gnutls_priority = gnutls_priority

1523

1711

IPv6_TCPServer.__init__(self, server_address,

1527

1715

def server_activate(self):

1528

1716

if self.enabled:

1529

1717

return socketserver.TCPServer.server_activate(self)

1718

1530

1719

def enable(self):

1531

1720

self.enabled = True

1532

def add_pipe(self, parent_pipe):

1721

1722

def add_pipe(self, parent_pipe, proc):

1533

1723

# Call "handle_ipc" for both data and EOF events

1534

1724

gobject.io_add_watch(parent_pipe.fileno(),

1535

1725

gobject.IO_IN | gobject.IO_HUP,

1536

1726

functools.partial(self.handle_ipc,

1537

parent_pipe = parent_pipe))

1538

1727

parent_pipe =

1728

parent_pipe,

1729

proc = proc))

1730

1539

1731

def handle_ipc(self, source, condition, parent_pipe=None,

1540

client_object=None):

1732

proc = None, client_object=None):

1541

1733

condition_names = {

1542

1734

gobject.IO_IN: "IN", # There is data to read.

1543

1735

gobject.IO_OUT: "OUT", # Data can be written (without

1552

1744

for cond, name in

1553

1745

condition_names.iteritems()

1554

1746

if cond & condition)

1555

# error or the other end of multiprocessing.Pipe has closed

1747

# error, or the other end of multiprocessing.Pipe has closed

1556

1748

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1749

# Wait for other process to exit

1750

proc.join()

1557

1751

return False

1558

1752

1559

1753

# Read a request from the child

1564

1758

fpr = request[1]

1565

1759

address = request[2]

1566

1760

1567

for c in self.clients:

1761

for c in self.clients.itervalues():

1568

1762

if c.fingerprint == fpr:

1569

1763

client = c

1570

1764

break

1571

1765

else:

1572

logger.warning("Client not found for fingerprint: %s, ad"

1573

"dress: %s", fpr, address)

1766

logger.info("Client not found for fingerprint: %s, ad"

1767

"dress: %s", fpr, address)

1574

1768

if self.use_dbus:

1575

1769

# Emit D-Bus signal

1576

mandos_dbus_service.ClientNotFound(fpr, address[0])

1770

mandos_dbus_service.ClientNotFound(fpr,

1771

address[0])

1577

1772

parent_pipe.send(False)

1578

1773

return False

1579

1774

1580

1775

gobject.io_add_watch(parent_pipe.fileno(),

1581

1776

gobject.IO_IN | gobject.IO_HUP,

1582

1777

functools.partial(self.handle_ipc,

1583

parent_pipe = parent_pipe,

1584

client_object = client))

1778

parent_pipe =

1779

parent_pipe,

1780

proc = proc,

1781

client_object =

1782

client))

1585

1783

parent_pipe.send(True)

1586

# remove the old hook in favor of the new above hook on same fileno

1784

# remove the old hook in favor of the new above hook on

1785

# same fileno

1587

1786

return False

1588

1787

if command == 'funcall':

1589

1788

funcname = request[1]

1590

1789

args = request[2]

1591

1790

kwargs = request[3]

1592

1791

1593

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1594

1792

parent_pipe.send(('data', getattr(client_object,

1793

funcname)(*args,

1794

**kwargs)))

1795

1595

1796

if command == 'getattr':

1596

1797

attrname = request[1]

1597

1798

if callable(client_object.__getattribute__(attrname)):

1598

1799

parent_pipe.send(('function',))

1599

1800

else:

1600

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1801

parent_pipe.send(('data', client_object

1802

.__getattribute__(attrname)))

1601

1803

1602

1804

if command == 'setattr':

1603

1805

attrname = request[1]

1604

1806

value = request[2]

1605

1807

setattr(client_object, attrname, value)

1606

1808

1607

1809

return True

1608

1810

1609

1811

1730

1932

" system bus interface")

1731

1933

parser.add_argument("--no-ipv6", action="store_false",

1732

1934

dest="use_ipv6", help="Do not use IPv6")

1935

parser.add_argument("--no-restore", action="store_false",

1936

dest="restore", help="Do not restore stored state",

1937

default=True)

1938

1733

1939

options = parser.parse_args()

1734

1940

1735

1941

if options.check:

1770

1976

# options, if set.

1771

1977

for option in ("interface", "address", "port", "debug",

1772

1978

"priority", "servicename", "configdir",

1773

"use_dbus", "use_ipv6", "debuglevel"):

1979

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1774

1980

value = getattr(options, option)

1775

1981

if value is not None:

1776

1982

server_settings[option] = value

1788

1994

debuglevel = server_settings["debuglevel"]

1789

1995

use_dbus = server_settings["use_dbus"]

1790

1996

use_ipv6 = server_settings["use_ipv6"]

1791

1997

1792

1998

if server_settings["servicename"] != "Mandos":

1793

1999

syslogger.setFormatter(logging.Formatter

1794

2000

('Mandos (%s) [%%(process)d]:'

1796

2002

% server_settings["servicename"]))

1797

2003

1798

2004

# Parse config file with clients

1799

client_defaults = { "timeout": "1h",

1800

"interval": "5m",

2005

client_defaults = { "timeout": "5m",

2006

"extended_timeout": "15m",

2007

"interval": "2m",

1801

2008

"checker": "fping -q -- %%(host)s",

1802

2009

"host": "",

1803

2010

"approval_delay": "0s",

1848

2055

raise error

1849

2056

1850

2057

if not debug and not debuglevel:

1851

syslogger.setLevel(logging.WARNING)

1852

console.setLevel(logging.WARNING)

2058

logger.setLevel(logging.WARNING)

1853

2059

if debuglevel:

1854

2060

level = getattr(logging, debuglevel.upper())

1855

syslogger.setLevel(level)

1856

console.setLevel(level)

1857

2061

logger.setLevel(level)

2062

1858

2063

if debug:

2064

logger.setLevel(logging.DEBUG)

1859

2065

# Enable all possible GnuTLS debugging

1860

2066

1861

2067

# "Use a log level over 10 to enable all debugging options."

1891

2097

# End of Avahi example code

1892

2098

if use_dbus:

1893

2099

try:

1894

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2100

bus_name = dbus.service.BusName("se.recompile.Mandos",

1895

2101

bus, do_not_queue=True)

2102

old_bus_name = (dbus.service.BusName

2103

("se.bsnet.fukt.Mandos", bus,

2104

do_not_queue=True))

1896

2105

except dbus.exceptions.NameExistsException as e:

1897

2106

logger.error(unicode(e) + ", disabling D-Bus")

1898

2107

use_dbus = False

1899

2108

server_settings["use_dbus"] = False

1900

2109

tcp_server.use_dbus = False

1901

2110

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1902

service = AvahiService(name = server_settings["servicename"],

1903

servicetype = "_mandos._tcp",

1904

protocol = protocol, bus = bus)

2111

service = AvahiServiceToSyslog(name =

2112

server_settings["servicename"],

2113

servicetype = "_mandos._tcp",

2114

protocol = protocol, bus = bus)

1905

2115

if server_settings["interface"]:

1906

2116

service.interface = (if_nametoindex

1907

2117

(str(server_settings["interface"])))

1911

2121

1912

2122

client_class = Client

1913

2123

if use_dbus:

1914

client_class = functools.partial(ClientDBus, bus = bus)

1915

def client_config_items(config, section):

1916

special_settings = {

1917

"approved_by_default":

1918

lambda: config.getboolean(section,

1919

"approved_by_default"),

1920

}

1921

for name, value in config.items(section):

2124

client_class = functools.partial(ClientDBusTransitional,

2125

bus = bus)

2126

2127

special_settings = {

2128

# Some settings need to be accessd by special methods;

2129

# booleans need .getboolean(), etc. Here is a list of them:

2130

"approved_by_default":

2131

lambda section:

2132

client_config.getboolean(section, "approved_by_default"),

2133

}

2134

# Construct a new dict of client settings of this form:

2135

# { client_name: {setting_name: value, ...}, ...}

2136

# with exceptions for any special settings as defined above

2137

client_settings = dict((clientname,

2138

dict((setting,

2139

(value if setting not in special_settings

2140

else special_settings[setting](clientname)))

2141

for setting, value in client_config.items(clientname)))

2142

for clientname in client_config.sections())

2143

2144

old_client_settings = {}

2145

clients_data = []

2146

2147

# Get client data and settings from last running state.

2148

if server_settings["restore"]:

2149

try:

2150

with open(stored_state_path, "rb") as stored_state:

2151

clients_data, old_client_settings = pickle.load(stored_state)

2152

os.remove(stored_state_path)

2153

except IOError as e:

2154

logger.warning("Could not load persistant state: {0}".format(e))

2155

if e.errno != errno.ENOENT:

2156

raise

2157

2158

for client in clients_data:

2159

client_name = client["name"]

2160

2161

# Decide which value to use after restoring saved state.

2162

# We have three different values: Old config file,

2163

# new config file, and saved state.

2164

# New config value takes precedence if it differs from old

2165

# config value, otherwise use saved state.

2166

for name, value in client_settings[client_name].items():

1922

2167

try:

1923

yield (name, special_settings[name]())

2168

# For each value in new config, check if it differs

2169

# from the old config value (Except for the "secret"

2170

# attribute)

2171

if name != "secret" and value != old_client_settings[client_name][name]:

2172

setattr(client, name, value)

1924

2173

except KeyError:

1925

yield (name, value)

2174

pass

2175

2176

# Clients who has passed its expire date, can still be enabled if its

2177

# last checker was sucessful. Clients who checkers failed before we

2178

# stored it state is asumed to had failed checker during downtime.

2179

if client["enabled"] and client["last_checked_ok"]:

2180

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2181

> client["interval"]):

2182

if client["last_checker_status"] != 0:

2183

client["enabled"] = False

2184

else:

2185

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2186

2187

client["changedstate"] = (multiprocessing_manager

2188

.Condition(multiprocessing_manager

2189

.Lock()))

2190

if use_dbus:

2191

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2192

tcp_server.clients[client_name] = new_client

2193

new_client.bus = bus

2194

for name, value in client.iteritems():

2195

setattr(new_client, name, value)

2196

client_object_name = unicode(client_name).translate(

2197

{ord("."): ord("_"),

2198

ord("-"): ord("_")})

2199

new_client.dbus_object_path = (dbus.ObjectPath

2200

("/clients/" + client_object_name))

2201

DBusObjectWithProperties.__init__(new_client,

2202

new_client.bus,

2203

new_client.dbus_object_path)

2204

else:

2205

tcp_server.clients[client_name] = Client.__new__(Client)

2206

for name, value in client.iteritems():

2207

setattr(tcp_server.clients[client_name], name, value)

2208

2209

tcp_server.clients[client_name].decrypt_secret(

2210

client_settings[client_name]["secret"])

2211

2212

# Create/remove clients based on new changes made to config

2213

for clientname in set(old_client_settings) - set(client_settings):

2214

del tcp_server.clients[clientname]

2215

for clientname in set(client_settings) - set(old_client_settings):

2216

tcp_server.clients[clientname] = (client_class(name = clientname,

2217

config =

2218

client_settings

2219

[clientname]))

1926

2220

1927

tcp_server.clients.update(set(

1928

client_class(name = section,

1929

config= dict(client_config_items(

1930

client_config, section)))

1931

for section in client_config.sections()))

2221

1932

2222

if not tcp_server.clients:

1933

2223

logger.warning("No clients defined")

1934

2224

1947

2237

del pidfilename

1948

2238

1949

2239

signal.signal(signal.SIGINT, signal.SIG_IGN)

1950

2240

1951

2241

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1952

2242

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1953

2243

1956

2246

"""A D-Bus proxy object"""

1957

2247

def __init__(self):

1958

2248

dbus.service.Object.__init__(self, bus, "/")

1959

_interface = "se.bsnet.fukt.Mandos"

2249

_interface = "se.recompile.Mandos"

1960

2250

1961

2251

@dbus.service.signal(_interface, signature="o")

1962

2252

def ClientAdded(self, objpath):

1977

2267

def GetAllClients(self):

1978

2268

"D-Bus method"

1979

2269

return dbus.Array(c.dbus_object_path

1980

for c in tcp_server.clients)

2270

for c in

2271

tcp_server.clients.itervalues())

1981

2272

1982

2273

@dbus.service.method(_interface,

1983

2274

out_signature="a{oa{sv}}")

1985

2276

"D-Bus method"

1986

2277

return dbus.Dictionary(

1987

2278

((c.dbus_object_path, c.GetAll(""))

1988

for c in tcp_server.clients),

2279

for c in tcp_server.clients.itervalues()),

1989

2280

signature="oa{sv}")

1990

2281

1991

2282

@dbus.service.method(_interface, in_signature="o")

1992

2283

def RemoveClient(self, object_path):

1993

2284

"D-Bus method"

1994

for c in tcp_server.clients:

2285

for c in tcp_server.clients.itervalues():

1995

2286

if c.dbus_object_path == object_path:

1996

tcp_server.clients.remove(c)

2287

del tcp_server.clients[c.name]

1997

2288

c.remove_from_connection()

1998

2289

# Don't signal anything except ClientRemoved

1999

2290

c.disable(quiet=True)

2004

2295

2005

2296

del _interface

2006

2297

2007

mandos_dbus_service = MandosDBusService()

2298

class MandosDBusServiceTransitional(MandosDBusService):

2299

__metaclass__ = AlternateDBusNamesMetaclass

2300

mandos_dbus_service = MandosDBusServiceTransitional()

2008

2301

2009

2302

def cleanup():

2010

2303

"Cleanup function; run on exit"

2011

2304

service.cleanup()

2012

2305

2306

multiprocessing.active_children()

2307

if not (tcp_server.clients or client_settings):

2308

return

2309

2310

# Store client before exiting. Secrets are encrypted with key based

2311

# on what config file has. If config file is removed/edited, old

2312

# secret will thus be unrecovable.

2313

clients = []

2314

for client in tcp_server.clients.itervalues():

2315

client.encrypt_secret(client_settings[client.name]["secret"])

2316

2317

client_dict = {}

2318

2319

# A list of attributes that will not be stored when shuting down.

2320

exclude = set(("bus", "changedstate", "secret"))

2321

for name, typ in inspect.getmembers(dbus.service.Object):

2322

exclude.add(name)

2323

2324

client_dict["encrypted_secret"] = client.encrypted_secret

2325

for attr in client.client_structure:

2326

if attr not in exclude:

2327

client_dict[attr] = getattr(client, attr)

2328

2329

clients.append(client_dict)

2330

del client_settings[client.name]["secret"]

2331

2332

try:

2333

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2334

pickle.dump((clients, client_settings), stored_state)

2335

except IOError as e:

2336

logger.warning("Could not save persistant state: {0}".format(e))

2337

if e.errno != errno.ENOENT:

2338

raise

2339

2340

# Delete all clients, and settings from config

2013

2341

while tcp_server.clients:

2014

client = tcp_server.clients.pop()

2342

name, client = tcp_server.clients.popitem()

2015

2343

if use_dbus:

2016

2344

client.remove_from_connection()

2017

client.disable_hook = None

2018

2345

# Don't signal anything except ClientRemoved

2019

2346

client.disable(quiet=True)

2020

2347

if use_dbus:

2021

2348

# Emit D-Bus signal

2022

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2349

mandos_dbus_service.ClientRemoved(client

2350

.dbus_object_path,

2023

2351

client.name)

2352

client_settings.clear()

2024

2353

2025

2354

atexit.register(cleanup)

2026

2355

2027

for client in tcp_server.clients:

2356

for client in tcp_server.clients.itervalues():

2028

2357

if use_dbus:

2029

2358

# Emit D-Bus signal

2030

2359

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2031

client.enable()

2360

# Need to initiate checking of clients

2361

if client.enabled:

2362

client.init_checker()

2363

2032

2364

2033

2365

tcp_server.enable()

2034

2366

tcp_server.server_activate()

2074

2406

# Must run before the D-Bus bus name gets deregistered

2075

2407

cleanup()

2076

2408

2409

2077

2410

if __name__ == '__main__':

2078

2411

main()