/mandos/trunk : revision 518.2.4

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

68

70

69

import dbus

71

70

import dbus.service

86

85

except ImportError:

87

86

SO_BINDTODEVICE = None

88

87

89

version = "1.5.3"

88

89

version = "1.4.1"

90

stored_state_file = "clients.pickle"

91

92

logger = logging.getLogger()

111

return interface_index

112

113

114

def initlogger(debug, level=logging.WARNING):

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

if debug:

123

console = logging.StreamHandler()

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

125

' [%(process)d]:'

126

' %(levelname)s:'

127

' %(message)s'))

128

logger.addHandler(console)

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

129

128

logger.setLevel(level)

130

129

131

130

132

class PGPError(Exception):

133

"""Exception if encryption/decryption fails"""

131

class CryptoError(Exception):

134

132

pass

135

133

136

134

137

class PGPEngine(object):

135

class Crypto(object):

138

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

139

137

def __init__(self):

140

138

self.gnupg = GnuPGInterface.GnuPG()

143

141

self.gnupg.options.meta_interactive = False

144

142

self.gnupg.options.homedir = self.tempdir

145

143

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

144

'--quiet'])

148

145

149

146

def __enter__(self):

150

147

return self

176

173

177

174

def encrypt(self, data, password):

178

175

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

176

with open(os.devnull) as devnull:

180

177

try:

181

178

proc = self.gnupg.run(['--symmetric'],

182

179

create_fhs=['stdin', 'stdout'],

187

184

ciphertext = f.read()

188

185

proc.wait()

189

186

except IOError as e:

190

raise PGPError(e)

187

raise CryptoError(e)

191

188

self.gnupg.passphrase = None

192

189

return ciphertext

193

190

194

191

def decrypt(self, data, password):

195

192

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

193

with open(os.devnull) as devnull:

197

194

try:

198

195

proc = self.gnupg.run(['--decrypt'],

199

196

create_fhs=['stdin', 'stdout'],

200

197

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

198

with contextlib.closing(proc.handles['stdin'] ) as f:

202

199

f.write(data)

203

200

with contextlib.closing(proc.handles['stdout']) as f:

204

201

decrypted_plaintext = f.read()

205

202

proc.wait()

206

203

except IOError as e:

207

raise PGPError(e)

204

raise CryptoError(e)

208

205

self.gnupg.passphrase = None

209

206

return decrypted_plaintext

210

207

414

411

interval: datetime.timedelta(); How often to start a new checker

415

412

last_approval_request: datetime.datetime(); (UTC) or None

416

413

last_checked_ok: datetime.datetime(); (UTC) or None

414

417

415

last_checker_status: integer between 0 and 255 reflecting exit

418

416

status of last checker. -1 reflects crashed

419

checker, -2 means no checker completed yet.

417

checker, or None.

420

418

last_enabled: datetime.datetime(); (UTC) or None

421

419

name: string; from the config file, used in log messages and

422

420

D-Bus identifiers

423

421

secret: bytestring; sent verbatim (over TLS) to client

424

422

timeout: datetime.timedelta(); How long from last_checked_ok

425

423

until this client is disabled

426

extended_timeout: extra long timeout when secret has been sent

424

extended_timeout: extra long timeout when password has been sent

427

425

runtime_expansions: Allowed attributes for runtime expansion.

428

426

expires: datetime.datetime(); time (UTC) when a client will be

429

427

disabled, or None

433

431

"created", "enabled", "fingerprint",

434

432

"host", "interval", "last_checked_ok",

435

433

"last_enabled", "name", "timeout")

436

client_defaults = { "timeout": "5m",

437

"extended_timeout": "15m",

438

"interval": "2m",

439

"checker": "fping -q -- %%(host)s",

440

"host": "",

441

"approval_delay": "0s",

442

"approval_duration": "1s",

443

"approved_by_default": "True",

444

"enabled": "True",

445

}

446

434

447

435

def timeout_milliseconds(self):

448

436

"Return the 'timeout' attribute in milliseconds"

458

446

459

447

def approval_delay_milliseconds(self):

460

448

return timedelta_to_milliseconds(self.approval_delay)

461

462

@staticmethod

463

def config_parser(config):

464

"""Construct a new dict of client settings of this form:

465

{ client_name: {setting_name: value, ...}, ...}

466

with exceptions for any special settings as defined above.

467

NOTE: Must be a pure function. Must return the same result

468

value given the same arguments.

469

"""

470

settings = {}

471

for client_name in config.sections():

472

section = dict(config.items(client_name))

473

client = settings[client_name] = {}

474

475

client["host"] = section["host"]

476

# Reformat values from string types to Python types

477

client["approved_by_default"] = config.getboolean(

478

client_name, "approved_by_default")

479

client["enabled"] = config.getboolean(client_name,

480

"enabled")

481

482

client["fingerprint"] = (section["fingerprint"].upper()

483

.replace(" ", ""))

484

if "secret" in section:

485

client["secret"] = section["secret"].decode("base64")

486

elif "secfile" in section:

487

with open(os.path.expanduser(os.path.expandvars

488

(section["secfile"])),

489

"rb") as secfile:

490

client["secret"] = secfile.read()

491

else:

492

raise TypeError("No secret or secfile for section %s"

493

% section)

494

client["timeout"] = string_to_delta(section["timeout"])

495

client["extended_timeout"] = string_to_delta(

496

section["extended_timeout"])

497

client["interval"] = string_to_delta(section["interval"])

498

client["approval_delay"] = string_to_delta(

499

section["approval_delay"])

500

client["approval_duration"] = string_to_delta(

501

section["approval_duration"])

502

client["checker_command"] = section["checker"]

503

client["last_approval_request"] = None

504

client["last_checked_ok"] = None

505

client["last_checker_status"] = -2

506

507

return settings

508

509

510

def __init__(self, settings, name = None):

449

450

def __init__(self, name = None, config=None):

511

451

"""Note: the 'checker' key in 'config' sets the

512

452

'checker_command' attribute and *not* the 'checker'

513

453

attribute."""

514

454

self.name = name

515

# adding all client settings

516

for setting, value in settings.iteritems():

517

setattr(self, setting, value)

518

519

if self.enabled:

520

if not hasattr(self, "last_enabled"):

521

self.last_enabled = datetime.datetime.utcnow()

522

if not hasattr(self, "expires"):

523

self.expires = (datetime.datetime.utcnow()

524

+ self.timeout)

525

else:

526

self.last_enabled = None

527

self.expires = None

528

455

if config is None:

456

config = {}

529

457

logger.debug("Creating client %r", self.name)

530

458

# Uppercase and remove spaces from fingerprint for later

531

459

# comparison purposes with return value from the fingerprint()

532

460

# function

461

self.fingerprint = (config["fingerprint"].upper()

462

.replace(" ", ""))

533

463

logger.debug(" Fingerprint: %s", self.fingerprint)

534

self.created = settings.get("created",

535

datetime.datetime.utcnow())

536

537

# attributes specific for this server instance

464

if "secret" in config:

465

self.secret = config["secret"].decode("base64")

466

elif "secfile" in config:

467

with open(os.path.expanduser(os.path.expandvars

468

(config["secfile"])),

469

"rb") as secfile:

470

self.secret = secfile.read()

471

else:

472

raise TypeError("No secret or secfile for client %s"

473

% self.name)

474

self.host = config.get("host", "")

475

self.created = datetime.datetime.utcnow()

476

self.enabled = config.get("enabled", True)

477

self.last_approval_request = None

478

if self.enabled:

479

self.last_enabled = datetime.datetime.utcnow()

480

else:

481

self.last_enabled = None

482

self.last_checked_ok = None

483

self.last_checker_status = None

484

self.timeout = string_to_delta(config["timeout"])

485

self.extended_timeout = string_to_delta(config

486

["extended_timeout"])

487

self.interval = string_to_delta(config["interval"])

538

488

self.checker = None

539

489

self.checker_initiator_tag = None

540

490

self.disable_initiator_tag = None

491

if self.enabled:

492

self.expires = datetime.datetime.utcnow() + self.timeout

493

else:

494

self.expires = None

541

495

self.checker_callback_tag = None

496

self.checker_command = config["checker"]

542

497

self.current_checker_command = None

543

498

self.approved = None

499

self.approved_by_default = config.get("approved_by_default",

500

True)

544

501

self.approvals_pending = 0

502

self.approval_delay = string_to_delta(

503

config["approval_delay"])

504

self.approval_duration = string_to_delta(

505

config["approval_duration"])

545

506

self.changedstate = (multiprocessing_manager

546

507

.Condition(multiprocessing_manager

547

508

.Lock()))

614

575

self.checker_callback_tag = None

615

576

self.checker = None

616

577

if os.WIFEXITED(condition):

617

self.last_checker_status = os.WEXITSTATUS(condition)

578

self.last_checker_status = os.WEXITSTATUS(condition)

618

579

if self.last_checker_status == 0:

619

580

logger.info("Checker for %(name)s succeeded",

620

581

vars(self))

627

588

logger.warning("Checker for %(name)s crashed?",

628

589

vars(self))

629

590

630

def checked_ok(self):

631

"""Assert that the client has been seen, alive and well."""

632

self.last_checked_ok = datetime.datetime.utcnow()

633

self.last_checker_status = 0

634

self.bump_timeout()

635

636

def bump_timeout(self, timeout=None):

637

"""Bump up the timeout for this client."""

591

def checked_ok(self, timeout=None):

592

"""Bump up the timeout for this client.

593

594

This should only be called when the client has been seen,

595

alive and well.

596

"""

638

597

if timeout is None:

639

598

timeout = self.timeout

599

self.last_checked_ok = datetime.datetime.utcnow()

640

600

if self.disable_initiator_tag is not None:

641

601

gobject.source_remove(self.disable_initiator_tag)

642

602

if getattr(self, "enabled", False):

772

732

return decorator

773

733

774

734

775

def dbus_interface_annotations(dbus_interface):

776

"""Decorator for marking functions returning interface annotations.

777

778

Usage:

779

780

@dbus_interface_annotations("org.example.Interface")

781

def _foo(self): # Function name does not matter

782

return {"org.freedesktop.DBus.Deprecated": "true",

783

"org.freedesktop.DBus.Property.EmitsChangedSignal":

784

"false"}

785

"""

786

def decorator(func):

787

func._dbus_is_interface = True

788

func._dbus_interface = dbus_interface

789

func._dbus_name = dbus_interface

790

return func

791

return decorator

792

793

794

def dbus_annotations(annotations):

795

"""Decorator to annotate D-Bus methods, signals or properties

796

Usage:

797

798

@dbus_service_property("org.example.Interface", signature="b",

799

access="r")

800

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

801

"org.freedesktop.DBus.Property."

802

"EmitsChangedSignal": "false"})

803

def Property_dbus_property(self):

804

return dbus.Boolean(False)

805

"""

806

def decorator(func):

807

func._dbus_annotations = annotations

808

return func

809

return decorator

810

811

812

735

class DBusPropertyException(dbus.exceptions.DBusException):

813

736

"""A base class for D-Bus property-related exceptions

814

737

"""

837

760

"""

838

761

839

762

@staticmethod

840

def _is_dbus_thing(thing):

841

"""Returns a function testing if an attribute is a D-Bus thing

842

843

If called like _is_dbus_thing("method") it returns a function

844

suitable for use as predicate to inspect.getmembers().

845

"""

846

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

847

False)

763

def _is_dbus_property(obj):

764

return getattr(obj, "_dbus_is_property", False)

848

765

849

def _get_all_dbus_things(self, thing):

766

def _get_all_dbus_properties(self):

850

767

"""Returns a generator of (name, attribute) pairs

851

768

"""

852

return ((getattr(athing.__get__(self), "_dbus_name",

853

name),

854

athing.__get__(self))

769

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

855

770

for cls in self.__class__.__mro__

856

for name, athing in

857

inspect.getmembers(cls,

858

self._is_dbus_thing(thing)))

771

for name, prop in

772

inspect.getmembers(cls, self._is_dbus_property))

859

773

860

774

def _get_dbus_property(self, interface_name, property_name):

861

775

"""Returns a bound method if one exists which is a D-Bus

863

777

"""

864

778

for cls in self.__class__.__mro__:

865

779

for name, value in (inspect.getmembers

866

(cls,

867

self._is_dbus_thing("property"))):

780

(cls, self._is_dbus_property)):

868

781

if (value._dbus_name == property_name

869

782

and value._dbus_interface == interface_name):

870

783

return value.__get__(self)

899

812

# signatures other than "ay".

900

813

if prop._dbus_signature != "ay":

901

814

raise ValueError

902

value = dbus.ByteArray(b''.join(chr(byte)

903

for byte in value))

815

value = dbus.ByteArray(''.join(unichr(byte)

816

for byte in value))

904

817

prop(value)

905

818

906

819

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

912

825

Note: Will not include properties with access="write".

913

826

"""

914

827

properties = {}

915

for name, prop in self._get_all_dbus_things("property"):

828

for name, prop in self._get_all_dbus_properties():

916

829

if (interface_name

917

830

and interface_name != prop._dbus_interface):

918

831

# Interface non-empty but did not match

933

846

path_keyword='object_path',

934

847

connection_keyword='connection')

935

848

def Introspect(self, object_path, connection):

936

"""Overloading of standard D-Bus method.

937

938

Inserts property tags and interface annotation tags.

849

"""Standard D-Bus method, overloaded to insert property tags.

939

850

"""

940

851

xmlstring = dbus.service.Object.Introspect(self, object_path,

941

852

connection)

948

859

e.setAttribute("access", prop._dbus_access)

949

860

return e

950

861

for if_tag in document.getElementsByTagName("interface"):

951

# Add property tags

952

862

for tag in (make_tag(document, name, prop)

953

863

for name, prop

954

in self._get_all_dbus_things("property")

864

in self._get_all_dbus_properties()

955

865

if prop._dbus_interface

956

866

== if_tag.getAttribute("name")):

957

867

if_tag.appendChild(tag)

958

# Add annotation tags

959

for typ in ("method", "signal", "property"):

960

for tag in if_tag.getElementsByTagName(typ):

961

annots = dict()

962

for name, prop in (self.

963

_get_all_dbus_things(typ)):

964

if (name == tag.getAttribute("name")

965

and prop._dbus_interface

966

== if_tag.getAttribute("name")):

967

annots.update(getattr

968

(prop,

969

"_dbus_annotations",

970

{}))

971

for name, value in annots.iteritems():

972

ann_tag = document.createElement(

973

"annotation")

974

ann_tag.setAttribute("name", name)

975

ann_tag.setAttribute("value", value)

976

tag.appendChild(ann_tag)

977

# Add interface annotation tags

978

for annotation, value in dict(

979

itertools.chain(

980

*(annotations().iteritems()

981

for name, annotations in

982

self._get_all_dbus_things("interface")

983

if name == if_tag.getAttribute("name")

984

))).iteritems():

985

ann_tag = document.createElement("annotation")

986

ann_tag.setAttribute("name", annotation)

987

ann_tag.setAttribute("value", value)

988

if_tag.appendChild(ann_tag)

989

868

# Add the names to the return values for the

990

869

# "org.freedesktop.DBus.Properties" methods

991

870

if (if_tag.getAttribute("name")

1026

905

def __new__(mcs, name, bases, attr):

1027

906

# Go through all the base classes which could have D-Bus

1028

907

# methods, signals, or properties in them

1029

old_interface_names = []

1030

908

for base in (b for b in bases

1031

909

if issubclass(b, dbus.service.Object)):

1032

910

# Go though all attributes of the base class

1042

920

alt_interface = (attribute._dbus_interface

1043

921

.replace("se.recompile.Mandos",

1044

922

"se.bsnet.fukt.Mandos"))

1045

if alt_interface != attribute._dbus_interface:

1046

old_interface_names.append(alt_interface)

1047

923

# Is this a D-Bus signal?

1048

924

if getattr(attribute, "_dbus_is_signal", False):

1049

925

# Extract the original non-method function by

1064

940

nonmethod_func.func_name,

1065

941

nonmethod_func.func_defaults,

1066

942

nonmethod_func.func_closure)))

1067

# Copy annotations, if any

1068

try:

1069

new_function._dbus_annotations = (

1070

dict(attribute._dbus_annotations))

1071

except AttributeError:

1072

pass

1073

943

# Define a creator of a function to call both the

1074

944

# old and new functions, so both the old and new

1075

945

# signals gets sent when the function is called

1103

973

attribute.func_name,

1104

974

attribute.func_defaults,

1105

975

attribute.func_closure)))

1106

# Copy annotations, if any

1107

try:

1108

attr[attrname]._dbus_annotations = (

1109

dict(attribute._dbus_annotations))

1110

except AttributeError:

1111

pass

1112

976

# Is this a D-Bus property?

1113

977

elif getattr(attribute, "_dbus_is_property", False):

1114

978

# Create a new, but exactly alike, function

1128

992

attribute.func_name,

1129

993

attribute.func_defaults,

1130

994

attribute.func_closure)))

1131

# Copy annotations, if any

1132

try:

1133

attr[attrname]._dbus_annotations = (

1134

dict(attribute._dbus_annotations))

1135

except AttributeError:

1136

pass

1137

# Is this a D-Bus interface?

1138

elif getattr(attribute, "_dbus_is_interface", False):

1139

# Create a new, but exactly alike, function

1140

# object. Decorate it to be a new D-Bus interface

1141

# with the alternate D-Bus interface name. Add it

1142

# to the class.

1143

attr[attrname] = (dbus_interface_annotations

1144

(alt_interface)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1151

# Deprecate all old interfaces

1152

basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1153

for old_interface_name in old_interface_names:

1154

@dbus_interface_annotations(old_interface_name)

1155

def func(self):

1156

return { "org.freedesktop.DBus.Deprecated": "true" }

1157

# Find an unused name

1158

for aname in (basename.format(i) for i in

1159

itertools.count()):

1160

if aname not in attr:

1161

attr[aname] = func

1162

break

1163

995

return type.__new__(mcs, name, bases, attr)

1164

996

1165

997

1179

1011

def __init__(self, bus = None, *args, **kwargs):

1180

1012

self.bus = bus

1181

1013

Client.__init__(self, *args, **kwargs)

1014

1015

self._approvals_pending = 0

1182

1016

# Only now, when this client is initialized, can it show up on

1183

1017

# the D-Bus

1184

1018

client_object_name = unicode(self.name).translate(

1230

1064

checker is not None)

1231

1065

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1232

1066

"LastCheckedOK")

1233

last_checker_status = notifychangeproperty(dbus.Int16,

1234

"LastCheckerStatus")

1235

1067

last_approval_request = notifychangeproperty(

1236

1068

datetime_to_dbus, "LastApprovalRequest")

1237

1069

approved_by_default = notifychangeproperty(dbus.Boolean,

1238

1070

"ApprovedByDefault")

1239

approval_delay = notifychangeproperty(dbus.UInt64,

1071

approval_delay = notifychangeproperty(dbus.UInt16,

1240

1072

"ApprovalDelay",

1241

1073

type_func =

1242

1074

timedelta_to_milliseconds)

1243

1075

approval_duration = notifychangeproperty(

1244

dbus.UInt64, "ApprovalDuration",

1076

dbus.UInt16, "ApprovalDuration",

1245

1077

type_func = timedelta_to_milliseconds)

1246

1078

host = notifychangeproperty(dbus.String, "Host")

1247

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1079

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1248

1080

type_func =

1249

1081

timedelta_to_milliseconds)

1250

1082

extended_timeout = notifychangeproperty(

1251

dbus.UInt64, "ExtendedTimeout",

1083

dbus.UInt16, "ExtendedTimeout",

1252

1084

type_func = timedelta_to_milliseconds)

1253

interval = notifychangeproperty(dbus.UInt64,

1085

interval = notifychangeproperty(dbus.UInt16,

1254

1086

"Interval",

1255

1087

type_func =

1256

1088

timedelta_to_milliseconds)

1315

1147

## D-Bus methods, signals & properties

1316

1148

_interface = "se.recompile.Mandos.Client"

1317

1149

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1325

1150

## Signals

1326

1151

1327

1152

# CheckerCompleted - signal

1363

1188

"D-Bus signal"

1364

1189

return self.need_approval()

1365

1190

1191

# NeRwequest - signal

1192

@dbus.service.signal(_interface, signature="s")

1193

def NewRequest(self, ip):

1194

"""D-Bus signal

1195

Is sent after a client request a password.

1196

"""

1197

pass

1198

1366

1199

## Methods

1367

1200

1368

1201

# Approve - method

1446

1279

def Host_dbus_property(self, value=None):

1447

1280

if value is None: # get

1448

1281

return dbus.String(self.host)

1449

self.host = unicode(value)

1282

self.host = value

1450

1283

1451

1284

# Created - property

1452

1285

@dbus_service_property(_interface, signature="s", access="read")

1478

1311

return

1479

1312

return datetime_to_dbus(self.last_checked_ok)

1480

1313

1481

# LastCheckerStatus - property

1482

@dbus_service_property(_interface, signature="n",

1483

access="read")

1484

def LastCheckerStatus_dbus_property(self):

1485

return dbus.Int16(self.last_checker_status)

1486

1487

1314

# Expires - property

1488

1315

@dbus_service_property(_interface, signature="s", access="read")

1489

1316

def Expires_dbus_property(self):

1501

1328

if value is None: # get

1502

1329

return dbus.UInt64(self.timeout_milliseconds())

1503

1330

self.timeout = datetime.timedelta(0, 0, 0, value)

1331

if getattr(self, "disable_initiator_tag", None) is None:

1332

return

1504

1333

# Reschedule timeout

1505

if self.enabled:

1506

now = datetime.datetime.utcnow()

1507

time_to_die = timedelta_to_milliseconds(

1508

(self.last_checked_ok + self.timeout) - now)

1509

if time_to_die <= 0:

1510

# The timeout has passed

1511

self.disable()

1512

else:

1513

self.expires = (now +

1514

datetime.timedelta(milliseconds =

1515

time_to_die))

1516

if (getattr(self, "disable_initiator_tag", None)

1517

is None):

1518

return

1519

gobject.source_remove(self.disable_initiator_tag)

1520

self.disable_initiator_tag = (gobject.timeout_add

1521

(time_to_die,

1522

self.disable))

1334

gobject.source_remove(self.disable_initiator_tag)

1335

self.disable_initiator_tag = None

1336

self.expires = None

1337

time_to_die = timedelta_to_milliseconds((self

1338

.last_checked_ok

1339

+ self.timeout)

1340

- datetime.datetime

1341

.utcnow())

1342

if time_to_die <= 0:

1343

# The timeout has passed

1344

self.disable()

1345

else:

1346

self.expires = (datetime.datetime.utcnow()

1347

+ datetime.timedelta(milliseconds =

1348

time_to_die))

1349

self.disable_initiator_tag = (gobject.timeout_add

1350

(time_to_die, self.disable))

1523

1351

1524

1352

# ExtendedTimeout - property

1525

1353

@dbus_service_property(_interface, signature="t",

1551

1379

def Checker_dbus_property(self, value=None):

1552

1380

if value is None: # get

1553

1381

return dbus.String(self.checker_command)

1554

self.checker_command = unicode(value)

1382

self.checker_command = value

1555

1383

1556

1384

# CheckerRunning - property

1557

1385

@dbus_service_property(_interface, signature="b",

1681

1509

except KeyError:

1682

1510

return

1683

1511

1512

if self.server.use_dbus:

1513

# Emit D-Bus signal

1514

client.NewRequest(str(self.client_address))

1515

1684

1516

if client.approval_delay:

1685

1517

delay = client.approval_delay

1686

1518

client.approvals_pending += 1

1750

1582

1751

1583

logger.info("Sending secret to %s", client.name)

1752

1584

# bump the timeout using extended_timeout

1753

client.bump_timeout(client.extended_timeout)

1585

client.checked_ok(client.extended_timeout)

1754

1586

if self.server.use_dbus:

1755

1587

# Emit D-Bus signal

1756

1588

client.GotSecret()

1832

1664

def sub_process_main(self, request, address):

1833

1665

try:

1834

1666

self.finish_request(request, address)

1835

except Exception:

1667

except:

1836

1668

self.handle_error(request, address)

1837

1669

self.close_request(request)

1838

1670

2099

1931

sys.exit()

2100

1932

if not noclose:

2101

1933

# Close all standard open file descriptors

2102

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1934

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2103

1935

if not stat.S_ISCHR(os.fstat(null).st_mode):

2104

1936

raise OSError(errno.ENODEV,

2105

1937

"%s not a character device"

2106

% os.devnull)

1938

% os.path.devnull)

2107

1939

os.dup2(null, sys.stdin.fileno())

2108

1940

os.dup2(null, sys.stdout.fileno())

2109

1941

os.dup2(null, sys.stderr.fileno())

2217

2049

stored_state_file)

2218

2050

2219

2051

if debug:

2220

initlogger(debug, logging.DEBUG)

2052

initlogger(logging.DEBUG)

2221

2053

else:

2222

2054

if not debuglevel:

2223

initlogger(debug)

2055

initlogger()

2224

2056

else:

2225

2057

level = getattr(logging, debuglevel.upper())

2226

initlogger(debug, level)

2058

initlogger(level)

2227

2059

2228

2060

if server_settings["servicename"] != "Mandos":

2229

2061

syslogger.setFormatter(logging.Formatter

2232

2064

% server_settings["servicename"]))

2233

2065

2234

2066

# Parse config file with clients

2235

client_config = configparser.SafeConfigParser(Client

2236

.client_defaults)

2067

client_defaults = { "timeout": "5m",

2068

"extended_timeout": "15m",

2069

"interval": "2m",

2070

"checker": "fping -q -- %%(host)s",

2071

"host": "",

2072

"approval_delay": "0s",

2073

"approval_duration": "1s",

2074

}

2075

client_config = configparser.SafeConfigParser(client_defaults)

2237

2076

client_config.read(os.path.join(server_settings["configdir"],

2238

2077

"clients.conf"))

2239

2078

2292

2131

.gnutls_global_set_log_function(debug_gnutls))

2293

2132

2294

2133

# Redirect stdin so all checkers get /dev/null

2295

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2134

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2296

2135

os.dup2(null, sys.stdin.fileno())

2297

2136

if null > 2:

2298

2137

os.close(null)

2138

else:

2139

# No console logging

2140

logger.removeHandler(console)

2299

2141

2300

2142

# Need to fork before connecting to D-Bus

2301

2143

if not debug:

2302

2144

# Close all input and output, do double fork, etc.

2303

2145

daemon()

2304

2146

2305

gobject.threads_init()

2306

2307

2147

global main_loop

2308

2148

# From the Avahi example code

2309

DBusGMainLoop(set_as_default=True)

2149

DBusGMainLoop(set_as_default=True )

2310

2150

main_loop = gobject.MainLoop()

2311

2151

bus = dbus.SystemBus()

2312

2152

# End of Avahi example code

2339

2179

client_class = functools.partial(ClientDBusTransitional,

2340

2180

bus = bus)

2341

2181

2342

client_settings = Client.config_parser(client_config)

2182

special_settings = {

2183

# Some settings need to be accessd by special methods;

2184

# booleans need .getboolean(), etc. Here is a list of them:

2185

"approved_by_default":

2186

lambda section:

2187

client_config.getboolean(section, "approved_by_default"),

2188

"enabled":

2189

lambda section:

2190

client_config.getboolean(section, "enabled"),

2191

}

2192

# Construct a new dict of client settings of this form:

2193

# { client_name: {setting_name: value, ...}, ...}

2194

# with exceptions for any special settings as defined above

2195

client_settings = dict((clientname,

2196

dict((setting,

2197

(value

2198

if setting not in special_settings

2199

else special_settings[setting]

2200

(clientname)))

2201

for setting, value in

2202

client_config.items(clientname)))

2203

for clientname in client_config.sections())

2204

2343

2205

old_client_settings = {}

2344

clients_data = {}

2206

clients_data = []

2345

2207

2346

2208

# Get client data and settings from last running state.

2347

2209

if server_settings["restore"]:

2355

2217

.format(e))

2356

2218

if e.errno != errno.ENOENT:

2357

2219

raise

2358

except EOFError as e:

2359

logger.warning("Could not load persistent state: "

2360

"EOFError: {0}".format(e))

2361

2220

2362

with PGPEngine() as pgp:

2363

for client_name, client in clients_data.iteritems():

2221

with Crypto() as crypt:

2222

for client in clients_data:

2223

client_name = client["name"]

2224

2364

2225

# Decide which value to use after restoring saved state.

2365

2226

# We have three different values: Old config file,

2366

2227

# new config file, and saved state.

2374

2235

if (name != "secret" and

2375

2236

value != old_client_settings[client_name]

2376

2237

[name]):

2377

client[name] = value

2238

setattr(client, name, value)

2378

2239

except KeyError:

2379

2240

pass

2380

2241

2381

2242

# Clients who has passed its expire date can still be

2382

# enabled if its last checker was successful. Clients

2383

# whose checker succeeded before we stored its state is

2384

# assumed to have successfully run all checkers during

2385

# downtime.

2386

if client["enabled"]:

2387

if datetime.datetime.utcnow() >= client["expires"]:

2388

if not client["last_checked_ok"]:

2389

logger.warning(

2390

"disabling client {0} - Client never "

2391

"performed a successful checker"

2392

.format(client_name))

2393

client["enabled"] = False

2394

elif client["last_checker_status"] != 0:

2395

logger.warning(

2396

"disabling client {0} - Client "

2397

"last checker failed with error code {1}"

2398

.format(client_name,

2399

client["last_checker_status"]))

2243

# enabled if its last checker was sucessful. Clients

2244

# whose checker failed before we stored its state is

2245

# assumed to have failed all checkers during downtime.

2246

if client["enabled"] and client["last_checked_ok"]:

2247

if ((datetime.datetime.utcnow()

2248

- client["last_checked_ok"])

2249

> client["interval"]):

2250

if client["last_checker_status"] != 0:

2400

2251

client["enabled"] = False

2401

2252

else:

2402

2253

client["expires"] = (datetime.datetime

2403

2254

.utcnow()

2404

2255

+ client["timeout"])

2405

logger.debug("Last checker succeeded,"

2406

" keeping {0} enabled"

2407

.format(client_name))

2256

2257

client["changedstate"] = (multiprocessing_manager

2258

.Condition

2259

(multiprocessing_manager

2260

.Lock()))

2261

if use_dbus:

2262

new_client = (ClientDBusTransitional.__new__

2263

(ClientDBusTransitional))

2264

tcp_server.clients[client_name] = new_client

2265

new_client.bus = bus

2266

for name, value in client.iteritems():

2267

setattr(new_client, name, value)

2268

client_object_name = unicode(client_name).translate(

2269

{ord("."): ord("_"),

2270

ord("-"): ord("_")})

2271

new_client.dbus_object_path = (dbus.ObjectPath

2272

("/clients/"

2273

+ client_object_name))

2274

DBusObjectWithProperties.__init__(new_client,

2275

new_client.bus,

2276

new_client

2277

.dbus_object_path)

2278

else:

2279

tcp_server.clients[client_name] = (Client.__new__

2280

(Client))

2281

for name, value in client.iteritems():

2282

setattr(tcp_server.clients[client_name],

2283

name, value)

2284

2408

2285

try:

2409

client["secret"] = (

2410

pgp.decrypt(client["encrypted_secret"],

2411

client_settings[client_name]

2412

["secret"]))

2413

except PGPError:

2286

tcp_server.clients[client_name].secret = (

2287

crypt.decrypt(tcp_server.clients[client_name]

2288

.encrypted_secret,

2289

client_settings[client_name]

2290

["secret"]))

2291

except CryptoError:

2414

2292

# If decryption fails, we use secret from new settings

2415

logger.debug("Failed to decrypt {0} old secret"

2416

.format(client_name))

2417

client["secret"] = (

2293

tcp_server.clients[client_name].secret = (

2418

2294

client_settings[client_name]["secret"])

2419

2420

2295

2421

# Add/remove clients based on new changes made to config

2422

for client_name in (set(old_client_settings)

2423

- set(client_settings)):

2424

del clients_data[client_name]

2425

for client_name in (set(client_settings)

2426

- set(old_client_settings)):

2427

clients_data[client_name] = client_settings[client_name]

2428

2429

# Create all client objects

2430

for client_name, client in clients_data.iteritems():

2431

tcp_server.clients[client_name] = client_class(

2432

name = client_name, settings = client)

2296

# Create/remove clients based on new changes made to config

2297

for clientname in set(old_client_settings) - set(client_settings):

2298

del tcp_server.clients[clientname]

2299

for clientname in set(client_settings) - set(old_client_settings):

2300

tcp_server.clients[clientname] = (client_class(name

2301

= clientname,

2302

config =

2303

client_settings

2304

[clientname]))

2433

2305

2434

2306

if not tcp_server.clients:

2435

2307

logger.warning("No clients defined")

2447

2319

# "pidfile" was never created

2448

2320

pass

2449

2321

del pidfilename

2322

2450

2323

signal.signal(signal.SIGINT, signal.SIG_IGN)

2451

2324

2452

2325

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2453

2326

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2454

2327

2455

2328

if use_dbus:

2456

class MandosDBusService(DBusObjectWithProperties):

2329

class MandosDBusService(dbus.service.Object):

2457

2330

"""A D-Bus proxy object"""

2458

2331

def __init__(self):

2459

2332

dbus.service.Object.__init__(self, bus, "/")

2460

2333

_interface = "se.recompile.Mandos"

2461

2334

2462

@dbus_interface_annotations(_interface)

2463

def _foo(self):

2464

return { "org.freedesktop.DBus.Property"

2465

".EmitsChangedSignal":

2466

"false"}

2467

2468

2335

@dbus.service.signal(_interface, signature="o")

2469

2336

def ClientAdded(self, objpath):

2470

2337

"D-Bus signal"

2527

2394

# Store client before exiting. Secrets are encrypted with key

2528

2395

# based on what config file has. If config file is

2529

2396

# removed/edited, old secret will thus be unrecovable.

2530

clients = {}

2531

with PGPEngine() as pgp:

2397

clients = []

2398

with Crypto() as crypt:

2532

2399

for client in tcp_server.clients.itervalues():

2533

2400

key = client_settings[client.name]["secret"]

2534

client.encrypted_secret = pgp.encrypt(client.secret,

2535

key)

2401

client.encrypted_secret = crypt.encrypt(client.secret,

2402

key)

2536

2403

client_dict = {}

2537

2404

2538

# A list of attributes that can not be pickled

2539

# + secret.

2540

exclude = set(("bus", "changedstate", "secret",

2541

"checker"))

2405

# A list of attributes that will not be stored when

2406

# shutting down.

2407

exclude = set(("bus", "changedstate", "secret"))

2542

2408

for name, typ in (inspect.getmembers

2543

2409

(dbus.service.Object)):

2544

2410

exclude.add(name)

2549

2415

if attr not in exclude:

2550

2416

client_dict[attr] = getattr(client, attr)

2551

2417

2552

clients[client.name] = client_dict

2418

clients.append(client_dict)

2553

2419

del client_settings[client.name]["secret"]

2554

2420

2555

2421

try:

2556

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2557

prefix="clients-",

2558

dir=os.path.dirname

2559

(stored_state_path))

2560

with os.fdopen(tempfd, "wb") as stored_state:

2422

with os.fdopen(os.open(stored_state_path,

2423

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2424

0600), "wb") as stored_state:

2561

2425

pickle.dump((clients, client_settings), stored_state)

2562

os.rename(tempname, stored_state_path)

2563

2426

except (IOError, OSError) as e:

2564

2427

logger.warning("Could not save persistent state: {0}"

2565

2428

.format(e))

2566

if not debug:

2567

try:

2568

os.remove(tempname)

2569

except NameError:

2570

pass

2571

if e.errno not in set((errno.ENOENT, errno.EACCES,

2572

errno.EEXIST)):

2573

raise e

2429

if e.errno not in (errno.ENOENT, errno.EACCES):

2430

raise

2574

2431

2575

2432

# Delete all clients, and settings from config

2576

2433

while tcp_server.clients:

2640

2497

# Must run before the D-Bus bus name gets deregistered

2641

2498

cleanup()

2642

2499

2500

2643

2501

if __name__ == '__main__':

2644

2502

main()