/mandos/trunk : revision 520

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

66

67

68

import dbus

68

69

import dbus.service

73

74

import ctypes.util

74

75

import xml.dom.minidom

75

76

import inspect

77

import Crypto.Cipher.AES

76

78

77

79

try:

78

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

83

85

SO_BINDTODEVICE = None

84

86

85

87

86

version = "1.3.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

90

93

syslogger = (logging.handlers.SysLogHandler

91

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

95

address = str("/dev/log")))

96

99

logger.addHandler(syslogger)

97

100

98

101

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

100

104

' %(levelname)s:'

101

105

' %(message)s'))

102

106

logger.addHandler(console)

103

107

108

104

109

class AvahiError(Exception):

105

110

def __init__(self, value, *args, **kwargs):

106

111

self.value = value

160

165

" after %i retries, exiting.",

161

166

self.rename_count)

162

167

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

164

170

logger.info("Changing Zeroconf service name to %r ...",

165

171

self.name)

166

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

169

% self.name))

170

172

self.remove()

171

173

try:

172

174

self.add()

192

194

avahi.DBUS_INTERFACE_ENTRY_GROUP)

193

195

self.entry_group_state_changed_match = (

194

196

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

197

'StateChanged', self.entry_group_state_changed))

196

198

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

197

199

self.name, self.type)

198

200

self.group.AddService(

264

266

self.server_state_changed)

265

267

self.server_state_changed(self.server.GetState())

266

268

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

267

278

268

279

def _timedelta_to_milliseconds(td):

269

280

"Convert a datetime.timedelta() to milliseconds"

288

299

instance %(name)s can be used in the command.

289

300

checker_initiator_tag: a gobject event source tag, or None

290

301

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

291

304

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

305

disable_initiator_tag: a gobject event source tag, or None

294

306

enabled: bool()

295

307

fingerprint: string (40 or 32 hexadecimal digits); used to

298

310

interval: datetime.timedelta(); How often to start a new checker

299

311

last_approval_request: datetime.datetime(); (UTC) or None

300

312

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

301

316

last_enabled: datetime.datetime(); (UTC)

302

317

name: string; from the config file, used in log messages and

303

318

D-Bus identifiers

321

336

322

337

def extended_timeout_milliseconds(self):

323

338

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

339

return _timedelta_to_milliseconds(self.extended_timeout)

325

340

326

341

def interval_milliseconds(self):

327

342

"Return the 'interval' attribute in milliseconds"

330

345

def approval_delay_milliseconds(self):

331

346

return _timedelta_to_milliseconds(self.approval_delay)

332

347

333

def __init__(self, name = None, disable_hook=None, config=None):

348

def __init__(self, name = None, config=None):

334

349

"""Note: the 'checker' key in 'config' sets the

335

350

'checker_command' attribute and *not* the 'checker'

336

351

attribute."""

356

371

% self.name)

357

372

self.host = config.get("host", "")

358

373

self.created = datetime.datetime.utcnow()

359

self.enabled = False

374

self.enabled = True

360

375

self.last_approval_request = None

361

self.last_enabled = None

376

self.last_enabled = datetime.datetime.utcnow()

362

377

self.last_checked_ok = None

378

self.last_checker_status = None

363

379

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

365

382

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

367

383

self.checker = None

368

384

self.checker_initiator_tag = None

369

385

self.disable_initiator_tag = None

370

self.expires = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

371

387

self.checker_callback_tag = None

372

388

self.checker_command = config["checker"]

373

389

self.current_checker_command = None

374

self.last_connect = None

375

390

self._approved = None

376

391

self.approved_by_default = config.get("approved_by_default",

377

392

True)

380

395

config["approval_delay"])

381

396

self.approval_duration = string_to_delta(

382

397

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

384

409

410

# Send notice to process children that client state has changed

385

411

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

412

with self.changedstate:

413

self.changedstate.notify_all()

414

390

415

def enable(self):

391

416

"""Start this client's checker and timeout hooks"""

392

417

if getattr(self, "enabled", False):

393

418

# Already enabled

394

419

return

395

420

self.send_changedstate()

396

# Schedule a new checker to be started an 'interval' from now,

397

# and every interval from then on.

398

self.checker_initiator_tag = (gobject.timeout_add

399

(self.interval_milliseconds(),

400

self.start_checker))

401

# Schedule a disable() when 'timeout' has passed

402

421

self.expires = datetime.datetime.utcnow() + self.timeout

403

self.disable_initiator_tag = (gobject.timeout_add

404

(self.timeout_milliseconds(),

405

self.disable))

406

422

self.enabled = True

407

423

self.last_enabled = datetime.datetime.utcnow()

408

# Also start a new checker *right now*.

409

self.start_checker()

424

self.init_checker()

410

425

411

426

def disable(self, quiet=True):

412

427

"""Disable this client."""

424

439

gobject.source_remove(self.checker_initiator_tag)

425

440

self.checker_initiator_tag = None

426

441

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

429

442

self.enabled = False

430

443

# Do not run this again if called by a gobject.timeout_add

431

444

return False

432

445

433

446

def __del__(self):

434

self.disable_hook = None

435

447

self.disable()

436

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

437

463

def checker_callback(self, pid, condition, command):

438

464

"""The checker has completed, so take appropriate actions."""

439

465

self.checker_callback_tag = None

440

466

self.checker = None

441

467

if os.WIFEXITED(condition):

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

444

470

logger.info("Checker for %(name)s succeeded",

445

471

vars(self))

446

472

self.checked_ok()

448

474

logger.info("Checker for %(name)s failed",

449

475

vars(self))

450

476

else:

477

self.last_checker_status = -1

451

478

logger.warning("Checker for %(name)s crashed?",

452

479

vars(self))

453

480

460

487

if timeout is None:

461

488

timeout = self.timeout

462

489

self.last_checked_ok = datetime.datetime.utcnow()

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

467

self.disable))

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

468

497

469

498

def need_approval(self):

470

499

self.last_approval_request = datetime.datetime.utcnow()

562

591

raise

563

592

self.checker = None

564

593

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

565

640

566

641

def dbus_service_property(dbus_interface, signature="v",

567

642

access="readwrite", byte_arrays=False):

629

704

"""

630

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

706

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

707

for name, prop in

708

inspect.getmembers(cls, self._is_dbus_property))

633

709

634

710

def _get_dbus_property(self, interface_name, property_name):

635

711

"""Returns a bound method if one exists which is a D-Bus

636

712

property with the specified name and interface.

637

713

"""

638

714

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

715

for name, value in (inspect.getmembers

716

(cls, self._is_dbus_property)):

717

if (value._dbus_name == property_name

718

and value._dbus_interface == interface_name):

641

719

return value.__get__(self)

642

720

643

721

# No such property

644

722

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

723

+ interface_name + "."

646

724

+ property_name)

647

648

725

649

726

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

650

727

out_signature="v")

755

832

return dbus.String(dt.isoformat(),

756

833

variant_level=variant_level)

757

834

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

839

"""

759

840

def __new__(mcs, name, bases, attr):

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

847

# Ignore non-D-Bus attributes, and D-Bus attributes

848

# with the wrong interface name

849

if (not hasattr(attribute, "_dbus_interface")

850

or not attribute._dbus_interface

851

.startswith("se.recompile.Mandos")):

852

continue

853

# Create an alternate D-Bus interface name based on

854

# the current name

855

alt_interface = (attribute._dbus_interface

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

858

# Is this a D-Bus signal?

859

if getattr(attribute, "_dbus_is_signal", False):

860

# Extract the original non-method function by

861

# black magic

862

nonmethod_func = (dict(

863

zip(attribute.func_code.co_freevars,

864

attribute.__closure__))["func"]

865

.cell_contents)

866

# Create a new, but exactly alike, function

867

# object, and decorate it to be a new D-Bus signal

868

# with the alternate D-Bus interface name

869

new_function = (dbus.service.signal

870

(alt_interface,

871

attribute._dbus_signature)

872

(types.FunctionType(

873

nonmethod_func.func_code,

874

nonmethod_func.func_globals,

875

nonmethod_func.func_name,

876

nonmethod_func.func_defaults,

877

nonmethod_func.func_closure)))

878

# Define a creator of a function to call both the

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

881

def fixscope(func1, func2):

882

"""This function is a scope container to pass

883

func1 and func2 to the "call_both" function

884

outside of its arguments"""

885

def call_both(*args, **kwargs):

886

"""This function will emit two D-Bus

887

signals by calling func1 and func2"""

888

func1(*args, **kwargs)

889

func2(*args, **kwargs)

890

return call_both

891

# Create the "call_both" function and add it to

892

# the class

893

attr[attrname] = fixscope(attribute,

894

new_function)

895

# Is this a D-Bus method?

896

elif getattr(attribute, "_dbus_is_method", False):

897

# Create a new, but exactly alike, function

898

# object. Decorate it to be a new D-Bus method

899

# with the alternate D-Bus interface name. Add it

900

# to the class.

901

attr[attrname] = (dbus.service.method

902

(alt_interface,

903

attribute._dbus_in_signature,

904

attribute._dbus_out_signature)

905

(types.FunctionType

906

(attribute.func_code,

907

attribute.func_globals,

908

attribute.func_name,

909

attribute.func_defaults,

910

attribute.func_closure)))

911

# Is this a D-Bus property?

912

elif getattr(attribute, "_dbus_is_property", False):

913

# Create a new, but exactly alike, function

914

# object, and decorate it to be a new D-Bus

915

# property with the alternate D-Bus interface

916

# name. Add it to the class.

917

attr[attrname] = (dbus_service_property

918

(alt_interface,

919

attribute._dbus_signature,

920

attribute._dbus_access,

921

attribute

922

._dbus_get_args_options

923

["byte_arrays"])

924

(types.FunctionType

925

(attribute.func_code,

926

attribute.func_globals,

927

attribute.func_name,

928

attribute.func_defaults,

929

attribute.func_closure)))

812

930

return type.__new__(mcs, name, bases, attr)

813

931

814

932

class ClientDBus(Client, DBusObjectWithProperties):

825

943

# dbus.service.Object doesn't use super(), so we can't either.

826

944

827

945

def __init__(self, bus = None, *args, **kwargs):

946

self.bus = bus

947

Client.__init__(self, *args, **kwargs)

948

828

949

self._approvals_pending = 0

829

self.bus = bus

830

Client.__init__(self, *args, **kwargs)

831

950

# Only now, when this client is initialized, can it show up on

832

951

# the D-Bus

833

952

client_object_name = unicode(self.name).translate(

841

960

def notifychangeproperty(transform_func,

842

961

dbus_name, type_func=lambda x: x,

843

962

variant_level=1):

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

963

""" Modify a variable so that it's a property which announces

964

its changes to DBus.

965

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

968

dbus_name: D-Bus name of the variable

849

969

type_func: Function that transform the value before sending it

850

to DBus

851

variant_level: DBus variant level. default: 1

970

to the D-Bus. Default: no transform

971

variant_level: D-Bus variant level. Default: 1

852

972

"""

853

real_value = [None,]

973

attrname = "_{0}".format(dbus_name)

854

974

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

857

975

if hasattr(self, "dbus_object_path"):

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

976

if (not hasattr(self, attrname) or

977

type_func(getattr(self, attrname, None))

978

!= type_func(value)):

979

dbus_value = transform_func(type_func(value),

980

variant_level

981

=variant_level)

861

982

self.PropertyChanged(dbus.String(dbus_name),

862

983

dbus_value)

984

setattr(self, attrname, value)

863

985

864

return property(lambda self: real_value[0], setter)

986

return property(lambda self: getattr(self, attrname), setter)

865

987

866

988

867

989

expires = notifychangeproperty(datetime_to_dbus, "Expires")

872

994

last_enabled = notifychangeproperty(datetime_to_dbus,

873

995

"LastEnabled")

874

996

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

875

type_func = lambda checker: checker is not None)

997

type_func = lambda checker:

998

checker is not None)

876

999

last_checked_ok = notifychangeproperty(datetime_to_dbus,

877

1000

"LastCheckedOK")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

1001

last_approval_request = notifychangeproperty(

1002

datetime_to_dbus, "LastApprovalRequest")

880

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

881

1004

"ApprovedByDefault")

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1006

"ApprovalDelay",

1007

type_func =

1008

_timedelta_to_milliseconds)

1009

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

886

1012

host = notifychangeproperty(dbus.String, "Host")

887

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

1014

type_func =

1015

_timedelta_to_milliseconds)

1016

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1020

"Interval",

1021

type_func =

1022

_timedelta_to_milliseconds)

893

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

894

1024

895

1025

del notifychangeproperty

949

1079

950

1080

951

1081

## D-Bus methods, signals & properties

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

1082

_interface = "se.recompile.Mandos.Client"

1083

954

1084

## Signals

955

1085

956

1086

# CheckerCompleted - signal

1130

1260

gobject.source_remove(self.disable_initiator_tag)

1131

1261

self.disable_initiator_tag = None

1132

1262

self.expires = None

1133

time_to_die = (self.

1134

_timedelta_to_milliseconds((self

1135

.last_checked_ok

1136

+ self.timeout)

1137

- datetime.datetime

1138

.utcnow()))

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1139

1268

if time_to_die <= 0:

1140

1269

# The timeout has passed

1141

1270

self.disable()

1142

1271

else:

1143

1272

self.expires = (datetime.datetime.utcnow()

1144

+ datetime.timedelta(milliseconds = time_to_die))

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1145

1275

self.disable_initiator_tag = (gobject.timeout_add

1146

1276

(time_to_die, self.disable))

1147

1277

1227

1357

self._pipe.send(('setattr', name, value))

1228

1358

1229

1359

class ClientDBusTransitional(ClientDBus):

1230

__metaclass__ = transitional_dbus_metaclass

1360

__metaclass__ = AlternateDBusNamesMetaclass

1231

1361

1232

1362

class ClientHandler(socketserver.BaseRequestHandler, object):

1233

1363

"""A class to handle client connections.

1313

1443

client.name)

1314

1444

if self.server.use_dbus:

1315

1445

# Emit D-Bus signal

1316

client.Rejected("Disabled")

1446

client.Rejected("Disabled")

1317

1447

return

1318

1448

1319

1449

if client._approved or not client.approval_delay:

1336

1466

return

1337

1467

1338

1468

#wait until timeout or approved

1339

#x = float(client._timedelta_to_milliseconds(delay))

1340

1469

time = datetime.datetime.now()

1341

1470

client.changedstate.acquire()

1342

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1471

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1473

/ 1000)))

1343

1474

client.changedstate.release()

1344

1475

time2 = datetime.datetime.now()

1345

1476

if (time2 - time) >= delay:

1369

1500

sent_size += sent

1370

1501

1371

1502

logger.info("Sending secret to %s", client.name)

1372

# bump the timeout as if seen

1503

# bump the timeout using extended_timeout

1373

1504

client.checked_ok(client.extended_timeout)

1374

1505

if self.server.use_dbus:

1375

1506

# Emit D-Bus signal

1455

1586

except:

1456

1587

self.handle_error(request, address)

1457

1588

self.close_request(request)

1458

1589

1459

1590

def process_request(self, request, address):

1460

1591

"""Start a new process to process the request."""

1461

multiprocessing.Process(target = self.sub_process_main,

1462

args = (request, address)).start()

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1593

args = (request,

1594

address))

1595

proc.start()

1596

return proc

1463

1597

1464

1598

1465

1599

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1471

1605

"""

1472

1606

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1473

1607

1474

super(MultiprocessingMixInWithPipe,

1475

self).process_request(request, client_address)

1608

proc = MultiprocessingMixIn.process_request(self, request,

1609

client_address)

1476

1610

self.child_pipe.close()

1477

self.add_pipe(parent_pipe)

1611

self.add_pipe(parent_pipe, proc)

1478

1612

1479

def add_pipe(self, parent_pipe):

1613

def add_pipe(self, parent_pipe, proc):

1480

1614

"""Dummy function; override as necessary"""

1481

1615

raise NotImplementedError

1482

1616

1560

1694

self.enabled = False

1561

1695

self.clients = clients

1562

1696

if self.clients is None:

1563

self.clients = set()

1697

self.clients = {}

1564

1698

self.use_dbus = use_dbus

1565

1699

self.gnutls_priority = gnutls_priority

1566

1700

IPv6_TCPServer.__init__(self, server_address,

1570

1704

def server_activate(self):

1571

1705

if self.enabled:

1572

1706

return socketserver.TCPServer.server_activate(self)

1707

1573

1708

def enable(self):

1574

1709

self.enabled = True

1575

def add_pipe(self, parent_pipe):

1710

1711

def add_pipe(self, parent_pipe, proc):

1576

1712

# Call "handle_ipc" for both data and EOF events

1577

1713

gobject.io_add_watch(parent_pipe.fileno(),

1578

1714

gobject.IO_IN | gobject.IO_HUP,

1579

1715

functools.partial(self.handle_ipc,

1580

parent_pipe = parent_pipe))

1581

1716

parent_pipe =

1717

parent_pipe,

1718

proc = proc))

1719

1582

1720

def handle_ipc(self, source, condition, parent_pipe=None,

1583

client_object=None):

1721

proc = None, client_object=None):

1584

1722

condition_names = {

1585

1723

gobject.IO_IN: "IN", # There is data to read.

1586

1724

gobject.IO_OUT: "OUT", # Data can be written (without

1595

1733

for cond, name in

1596

1734

condition_names.iteritems()

1597

1735

if cond & condition)

1598

# error or the other end of multiprocessing.Pipe has closed

1736

# error, or the other end of multiprocessing.Pipe has closed

1599

1737

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1738

# Wait for other process to exit

1739

proc.join()

1600

1740

return False

1601

1741

1602

1742

# Read a request from the child

1607

1747

fpr = request[1]

1608

1748

address = request[2]

1609

1749

1610

for c in self.clients:

1750

for c in self.clients.itervalues():

1611

1751

if c.fingerprint == fpr:

1612

1752

client = c

1613

1753

break

1616

1756

"dress: %s", fpr, address)

1617

1757

if self.use_dbus:

1618

1758

# Emit D-Bus signal

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1759

mandos_dbus_service.ClientNotFound(fpr,

1760

address[0])

1620

1761

parent_pipe.send(False)

1621

1762

return False

1622

1763

1623

1764

gobject.io_add_watch(parent_pipe.fileno(),

1624

1765

gobject.IO_IN | gobject.IO_HUP,

1625

1766

functools.partial(self.handle_ipc,

1626

parent_pipe = parent_pipe,

1627

client_object = client))

1767

parent_pipe =

1768

parent_pipe,

1769

proc = proc,

1770

client_object =

1771

client))

1628

1772

parent_pipe.send(True)

1629

# remove the old hook in favor of the new above hook on same fileno

1773

# remove the old hook in favor of the new above hook on

1774

# same fileno

1630

1775

return False

1631

1776

if command == 'funcall':

1632

1777

funcname = request[1]

1633

1778

args = request[2]

1634

1779

kwargs = request[3]

1635

1780

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1781

parent_pipe.send(('data', getattr(client_object,

1782

funcname)(*args,

1783

**kwargs)))

1637

1784

1638

1785

if command == 'getattr':

1639

1786

attrname = request[1]

1640

1787

if callable(client_object.__getattribute__(attrname)):

1641

1788

parent_pipe.send(('function',))

1642

1789

else:

1643

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1790

parent_pipe.send(('data', client_object

1791

.__getattribute__(attrname)))

1644

1792

1645

1793

if command == 'setattr':

1646

1794

attrname = request[1]

1773

1921

" system bus interface")

1774

1922

parser.add_argument("--no-ipv6", action="store_false",

1775

1923

dest="use_ipv6", help="Do not use IPv6")

1924

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

1776

1928

options = parser.parse_args()

1777

1929

1778

1930

if options.check:

1813

1965

# options, if set.

1814

1966

for option in ("interface", "address", "port", "debug",

1815

1967

"priority", "servicename", "configdir",

1816

"use_dbus", "use_ipv6", "debuglevel"):

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1817

1969

value = getattr(options, option)

1818

1970

if value is not None:

1819

1971

server_settings[option] = value

1892

2044

raise error

1893

2045

1894

2046

if not debug and not debuglevel:

1895

syslogger.setLevel(logging.WARNING)

1896

console.setLevel(logging.WARNING)

2047

logger.setLevel(logging.WARNING)

1897

2048

if debuglevel:

1898

2049

level = getattr(logging, debuglevel.upper())

1899

syslogger.setLevel(level)

1900

console.setLevel(level)

2050

logger.setLevel(level)

1901

2051

1902

2052

if debug:

2053

logger.setLevel(logging.DEBUG)

1903

2054

# Enable all possible GnuTLS debugging

1904

2055

1905

2056

# "Use a log level over 10 to enable all debugging options."

1935

2086

# End of Avahi example code

1936

2087

if use_dbus:

1937

2088

try:

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

2089

bus_name = dbus.service.BusName("se.recompile.Mandos",

2090

bus, do_not_queue=True)

2091

old_bus_name = (dbus.service.BusName

2092

("se.bsnet.fukt.Mandos", bus,

2093

do_not_queue=True))

1942

2094

except dbus.exceptions.NameExistsException as e:

1943

2095

logger.error(unicode(e) + ", disabling D-Bus")

1944

2096

use_dbus = False

1945

2097

server_settings["use_dbus"] = False

1946

2098

tcp_server.use_dbus = False

1947

2099

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1950

protocol = protocol, bus = bus)

2100

service = AvahiServiceToSyslog(name =

2101

server_settings["servicename"],

2102

servicetype = "_mandos._tcp",

2103

protocol = protocol, bus = bus)

1951

2104

if server_settings["interface"]:

1952

2105

service.interface = (if_nametoindex

1953

2106

(str(server_settings["interface"])))

1957

2110

1958

2111

client_class = Client

1959

2112

if use_dbus:

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1961

def client_config_items(config, section):

1962

special_settings = {

1963

"approved_by_default":

1964

lambda: config.getboolean(section,

1965

"approved_by_default"),

1966

}

1967

for name, value in config.items(section):

2113

client_class = functools.partial(ClientDBusTransitional,

2114

bus = bus)

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2133

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2137

if server_settings["restore"]:

2138

try:

2139

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2141

os.remove(stored_state_path)

2142

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2145

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

1968

2156

try:

1969

yield (name, special_settings[name]())

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

1970

2162

except KeyError:

1971

yield (name, value)

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

1972

2209

1973

tcp_server.clients.update(set(

1974

client_class(name = section,

1975

config= dict(client_config_items(

1976

client_config, section)))

1977

for section in client_config.sections()))

2210

1978

2211

if not tcp_server.clients:

1979

2212

logger.warning("No clients defined")

1980

2213

2002

2235

"""A D-Bus proxy object"""

2003

2236

def __init__(self):

2004

2237

dbus.service.Object.__init__(self, bus, "/")

2005

_interface = "se.bsnet.fukt.Mandos"

2238

_interface = "se.recompile.Mandos"

2006

2239

2007

2240

@dbus.service.signal(_interface, signature="o")

2008

2241

def ClientAdded(self, objpath):

2023

2256

def GetAllClients(self):

2024

2257

"D-Bus method"

2025

2258

return dbus.Array(c.dbus_object_path

2026

for c in tcp_server.clients)

2259

for c in

2260

tcp_server.clients.itervalues())

2027

2261

2028

2262

@dbus.service.method(_interface,

2029

2263

out_signature="a{oa{sv}}")

2031

2265

"D-Bus method"

2032

2266

return dbus.Dictionary(

2033

2267

((c.dbus_object_path, c.GetAll(""))

2034

for c in tcp_server.clients),

2268

for c in tcp_server.clients.itervalues()),

2035

2269

signature="oa{sv}")

2036

2270

2037

2271

@dbus.service.method(_interface, in_signature="o")

2038

2272

def RemoveClient(self, object_path):

2039

2273

"D-Bus method"

2040

for c in tcp_server.clients:

2274

for c in tcp_server.clients.itervalues():

2041

2275

if c.dbus_object_path == object_path:

2042

tcp_server.clients.remove(c)

2276

del tcp_server.clients[c.name]

2043

2277

c.remove_from_connection()

2044

2278

# Don't signal anything except ClientRemoved

2045

2279

c.disable(quiet=True)

2051

2285

del _interface

2052

2286

2053

2287

class MandosDBusServiceTransitional(MandosDBusService):

2054

__metaclass__ = transitional_dbus_metaclass

2288

__metaclass__ = AlternateDBusNamesMetaclass

2055

2289

mandos_dbus_service = MandosDBusServiceTransitional()

2056

2290

2057

2291

def cleanup():

2058

2292

"Cleanup function; run on exit"

2059

2293

service.cleanup()

2060

2294

2295

multiprocessing.active_children()

2296

if not (tcp_server.clients or client_settings):

2297

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2321

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2323

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2329

# Delete all clients, and settings from config

2061

2330

while tcp_server.clients:

2062

client = tcp_server.clients.pop()

2331

name, client = tcp_server.clients.popitem()

2063

2332

if use_dbus:

2064

2333

client.remove_from_connection()

2065

client.disable_hook = None

2066

2334

# Don't signal anything except ClientRemoved

2067

2335

client.disable(quiet=True)

2068

2336

if use_dbus:

2069

2337

# Emit D-Bus signal

2070

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2338

mandos_dbus_service.ClientRemoved(client

2339

.dbus_object_path,

2071

2340

client.name)

2341

client_settings.clear()

2072

2342

2073

2343

atexit.register(cleanup)

2074

2344

2075

for client in tcp_server.clients:

2345

for client in tcp_server.clients.itervalues():

2076

2346

if use_dbus:

2077

2347

# Emit D-Bus signal

2078

2348

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2079

client.enable()

2349

# Need to initiate checking of clients

2350

if client.enabled:

2351

client.init_checker()

2352

2080

2353

2081

2354

tcp_server.enable()

2082

2355

tcp_server.server_activate()