/mandos/trunk : revision 520

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

65

67

66

68

import dbus

67

69

import dbus.service

72

74

import ctypes.util

73

75

import xml.dom.minidom

74

76

import inspect

77

import Crypto.Cipher.AES

75

78

76

79

try:

77

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

85

SO_BINDTODEVICE = None

83

86

84

87

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

89

93

syslogger = (logging.handlers.SysLogHandler

90

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

95

address = str("/dev/log")))

95

99

logger.addHandler(syslogger)

96

100

97

101

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

99

104

' %(levelname)s:'

100

105

' %(message)s'))

101

106

logger.addHandler(console)

102

107

108

103

109

class AvahiError(Exception):

104

110

def __init__(self, value, *args, **kwargs):

105

111

self.value = value

159

165

" after %i retries, exiting.",

160

166

self.rename_count)

161

167

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

163

170

logger.info("Changing Zeroconf service name to %r ...",

164

171

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

172

self.remove()

170

173

try:

171

174

self.add()

176

179

self.rename_count += 1

177

180

def remove(self):

178

181

"""Derived from the Avahi example code"""

179

if self.group is not None:

180

try:

181

self.group.Free()

182

except (dbus.exceptions.UnknownMethodException,

183

dbus.exceptions.DBusException) as e:

184

pass

185

self.group = None

186

182

if self.entry_group_state_changed_match is not None:

187

183

self.entry_group_state_changed_match.remove()

188

184

self.entry_group_state_changed_match = None

185

if self.group is not None:

186

self.group.Reset()

189

187

def add(self):

190

188

"""Derived from the Avahi example code"""

191

189

self.remove()

192

self.group = dbus.Interface(

193

self.bus.get_object(avahi.DBUS_NAME,

194

self.server.EntryGroupNew(),

195

follow_name_owner_changes=True),

196

avahi.DBUS_INTERFACE_ENTRY_GROUP)

190

if self.group is None:

191

self.group = dbus.Interface(

192

self.bus.get_object(avahi.DBUS_NAME,

193

self.server.EntryGroupNew()),

194

avahi.DBUS_INTERFACE_ENTRY_GROUP)

197

195

self.entry_group_state_changed_match = (

198

196

self.group.connect_to_signal(

199

'StateChanged', self .entry_group_state_changed))

197

'StateChanged', self.entry_group_state_changed))

200

198

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

201

199

self.name, self.type)

202

200

self.group.AddService(

224

222

% unicode(error))

225

223

def cleanup(self):

226

224

"""Derived from the Avahi example code"""

225

if self.group is not None:

226

try:

227

self.group.Free()

228

except (dbus.exceptions.UnknownMethodException,

229

dbus.exceptions.DBusException) as e:

230

pass

231

self.group = None

227

232

self.remove()

228

233

def server_state_changed(self, state, error=None):

229

234

"""Derived from the Avahi example code"""

236

241

avahi.SERVER_FAILURE:

237

242

"Zeroconf server failure" }

238

243

if state in bad_states:

239

if bad_states[state]:

240

logger.error(bad_states[state])

241

self.remove()

244

if bad_states[state] is not None:

245

if error is None:

246

logger.error(bad_states[state])

247

else:

248

logger.error(bad_states[state] + ": %r", error)

249

self.cleanup()

242

250

elif state == avahi.SERVER_RUNNING:

243

251

self.add()

244

252

else:

245

logger.debug("Unknown state: %r", state)

253

if error is None:

254

logger.debug("Unknown state: %r", state)

255

else:

256

logger.debug("Unknown state: %r: %r", state, error)

246

257

def activate(self):

247

258

"""Derived from the Avahi example code"""

248

259

if self.server is None:

255

266

self.server_state_changed)

256

267

self.server_state_changed(self.server.GetState())

257

268

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

258

278

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

259

285

class Client(object):

260

286

"""A representation of a client host served by this server.

261

287

273

299

instance %(name)s can be used in the command.

274

300

checker_initiator_tag: a gobject event source tag, or None

275

301

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

276

304

current_checker_command: string; current running checker_command

277

disable_hook: If set, called by disable() as disable_hook(self)

278

305

disable_initiator_tag: a gobject event source tag, or None

279

306

enabled: bool()

280

307

fingerprint: string (40 or 32 hexadecimal digits); used to

283

310

interval: datetime.timedelta(); How often to start a new checker

284

311

last_approval_request: datetime.datetime(); (UTC) or None

285

312

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

286

316

last_enabled: datetime.datetime(); (UTC)

287

317

name: string; from the config file, used in log messages and

288

318

D-Bus identifiers

289

319

secret: bytestring; sent verbatim (over TLS) to client

290

320

timeout: datetime.timedelta(); How long from last_checked_ok

291

321

until this client is disabled

322

extended_timeout: extra long timeout when password has been sent

292

323

runtime_expansions: Allowed attributes for runtime expansion.

324

expires: datetime.datetime(); time (UTC) when a client will be

325

disabled, or None

293

326

"""

294

327

295

328

runtime_expansions = ("approval_delay", "approval_duration",

297

330

"host", "interval", "last_checked_ok",

298

331

"last_enabled", "name", "timeout")

299

332

300

@staticmethod

301

def _timedelta_to_milliseconds(td):

302

"Convert a datetime.timedelta() to milliseconds"

303

return ((td.days * 24 * 60 * 60 * 1000)

304

+ (td.seconds * 1000)

305

+ (td.microseconds // 1000))

306

307

333

def timeout_milliseconds(self):

308

334

"Return the 'timeout' attribute in milliseconds"

309

return self._timedelta_to_milliseconds(self.timeout)

335

return _timedelta_to_milliseconds(self.timeout)

336

337

def extended_timeout_milliseconds(self):

338

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

310

340

311

341

def interval_milliseconds(self):

312

342

"Return the 'interval' attribute in milliseconds"

313

return self._timedelta_to_milliseconds(self.interval)

314

343

return _timedelta_to_milliseconds(self.interval)

344

315

345

def approval_delay_milliseconds(self):

316

return self._timedelta_to_milliseconds(self.approval_delay)

346

return _timedelta_to_milliseconds(self.approval_delay)

317

347

318

def __init__(self, name = None, disable_hook=None, config=None):

348

def __init__(self, name = None, config=None):

319

349

"""Note: the 'checker' key in 'config' sets the

320

350

'checker_command' attribute and *not* the 'checker'

321

351

attribute."""

341

371

% self.name)

342

372

self.host = config.get("host", "")

343

373

self.created = datetime.datetime.utcnow()

344

self.enabled = False

374

self.enabled = True

345

375

self.last_approval_request = None

346

self.last_enabled = None

376

self.last_enabled = datetime.datetime.utcnow()

347

377

self.last_checked_ok = None

378

self.last_checker_status = None

348

379

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

349

382

self.interval = string_to_delta(config["interval"])

350

self.disable_hook = disable_hook

351

383

self.checker = None

352

384

self.checker_initiator_tag = None

353

385

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

354

387

self.checker_callback_tag = None

355

388

self.checker_command = config["checker"]

356

389

self.current_checker_command = None

357

self.last_connect = None

358

390

self._approved = None

359

391

self.approved_by_default = config.get("approved_by_default",

360

392

True)

363

395

config["approval_delay"])

364

396

self.approval_duration = string_to_delta(

365

397

config["approval_duration"])

366

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

367

409

410

# Send notice to process children that client state has changed

368

411

def send_changedstate(self):

369

self.changedstate.acquire()

370

self.changedstate.notify_all()

371

self.changedstate.release()

372

412

with self.changedstate:

413

self.changedstate.notify_all()

414

373

415

def enable(self):

374

416

"""Start this client's checker and timeout hooks"""

375

417

if getattr(self, "enabled", False):

376

418

# Already enabled

377

419

return

378

420

self.send_changedstate()

421

self.expires = datetime.datetime.utcnow() + self.timeout

422

self.enabled = True

379

423

self.last_enabled = datetime.datetime.utcnow()

380

# Schedule a new checker to be started an 'interval' from now,

381

# and every interval from then on.

382

self.checker_initiator_tag = (gobject.timeout_add

383

(self.interval_milliseconds(),

384

self.start_checker))

385

# Schedule a disable() when 'timeout' has passed

386

self.disable_initiator_tag = (gobject.timeout_add

387

(self.timeout_milliseconds(),

388

self.disable))

389

self.enabled = True

390

# Also start a new checker *right now*.

391

self.start_checker()

424

self.init_checker()

392

425

393

426

def disable(self, quiet=True):

394

427

"""Disable this client."""

401

434

if getattr(self, "disable_initiator_tag", False):

402

435

gobject.source_remove(self.disable_initiator_tag)

403

436

self.disable_initiator_tag = None

437

self.expires = None

404

438

if getattr(self, "checker_initiator_tag", False):

405

439

gobject.source_remove(self.checker_initiator_tag)

406

440

self.checker_initiator_tag = None

407

441

self.stop_checker()

408

if self.disable_hook:

409

self.disable_hook(self)

410

442

self.enabled = False

411

443

# Do not run this again if called by a gobject.timeout_add

412

444

return False

413

445

414

446

def __del__(self):

415

self.disable_hook = None

416

447

self.disable()

417

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

418

463

def checker_callback(self, pid, condition, command):

419

464

"""The checker has completed, so take appropriate actions."""

420

465

self.checker_callback_tag = None

421

466

self.checker = None

422

467

if os.WIFEXITED(condition):

423

exitstatus = os.WEXITSTATUS(condition)

424

if exitstatus == 0:

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

425

470

logger.info("Checker for %(name)s succeeded",

426

471

vars(self))

427

472

self.checked_ok()

429

474

logger.info("Checker for %(name)s failed",

430

475

vars(self))

431

476

else:

477

self.last_checker_status = -1

432

478

logger.warning("Checker for %(name)s crashed?",

433

479

vars(self))

434

480

435

def checked_ok(self):

481

def checked_ok(self, timeout=None):

436

482

"""Bump up the timeout for this client.

437

483

438

484

This should only be called when the client has been seen,

439

485

alive and well.

440

486

"""

487

if timeout is None:

488

timeout = self.timeout

441

489

self.last_checked_ok = datetime.datetime.utcnow()

442

gobject.source_remove(self.disable_initiator_tag)

443

self.disable_initiator_tag = (gobject.timeout_add

444

(self.timeout_milliseconds(),

445

self.disable))

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

446

497

447

498

def need_approval(self):

448

499

self.last_approval_request = datetime.datetime.utcnow()

488

539

'replace')))

489

540

for attr in

490

541

self.runtime_expansions)

491

542

492

543

try:

493

544

command = self.checker_command % escaped_attrs

494

545

except TypeError as error:

540

591

raise

541

592

self.checker = None

542

593

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

640

543

641

def dbus_service_property(dbus_interface, signature="v",

544

642

access="readwrite", byte_arrays=False):

545

643

"""Decorators for marking methods of a DBusObjectWithProperties to

591

689

592

690

class DBusObjectWithProperties(dbus.service.Object):

593

691

"""A D-Bus object with properties.

594

692

595

693

Classes inheriting from this can use the dbus_service_property

596

694

decorator to expose methods as D-Bus properties. It exposes the

597

695

standard Get(), Set(), and GetAll() methods on the D-Bus.

604

702

def _get_all_dbus_properties(self):

605

703

"""Returns a generator of (name, attribute) pairs

606

704

"""

607

return ((prop._dbus_name, prop)

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

706

for cls in self.__class__.__mro__

608

707

for name, prop in

609

inspect.getmembers(self, self._is_dbus_property))

708

inspect.getmembers(cls, self._is_dbus_property))

610

709

611

710

def _get_dbus_property(self, interface_name, property_name):

612

711

"""Returns a bound method if one exists which is a D-Bus

613

712

property with the specified name and interface.

614

713

"""

615

for name in (property_name,

616

property_name + "_dbus_property"):

617

prop = getattr(self, name, None)

618

if (prop is None

619

or not self._is_dbus_property(prop)

620

or prop._dbus_name != property_name

621

or (interface_name and prop._dbus_interface

622

and interface_name != prop._dbus_interface)):

623

continue

624

return prop

714

for cls in self.__class__.__mro__:

715

for name, value in (inspect.getmembers

716

(cls, self._is_dbus_property)):

717

if (value._dbus_name == property_name

718

and value._dbus_interface == interface_name):

719

return value.__get__(self)

720

625

721

# No such property

626

722

raise DBusPropertyNotFound(self.dbus_object_path + ":"

627

723

+ interface_name + "."

661

757

def GetAll(self, interface_name):

662

758

"""Standard D-Bus property GetAll() method, see D-Bus

663

759

standard.

664

760

665

761

Note: Will not include properties with access="write".

666

762

"""

667

763

all = {}

729

825

return xmlstring

730

826

731

827

828

def datetime_to_dbus (dt, variant_level=0):

829

"""Convert a UTC datetime.datetime() to a D-Bus type."""

830

if dt is None:

831

return dbus.String("", variant_level = variant_level)

832

return dbus.String(dt.isoformat(),

833

variant_level=variant_level)

834

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

839

"""

840

def __new__(mcs, name, bases, attr):

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

847

# Ignore non-D-Bus attributes, and D-Bus attributes

848

# with the wrong interface name

849

if (not hasattr(attribute, "_dbus_interface")

850

or not attribute._dbus_interface

851

.startswith("se.recompile.Mandos")):

852

continue

853

# Create an alternate D-Bus interface name based on

854

# the current name

855

alt_interface = (attribute._dbus_interface

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

858

# Is this a D-Bus signal?

859

if getattr(attribute, "_dbus_is_signal", False):

860

# Extract the original non-method function by

861

# black magic

862

nonmethod_func = (dict(

863

zip(attribute.func_code.co_freevars,

864

attribute.__closure__))["func"]

865

.cell_contents)

866

# Create a new, but exactly alike, function

867

# object, and decorate it to be a new D-Bus signal

868

# with the alternate D-Bus interface name

869

new_function = (dbus.service.signal

870

(alt_interface,

871

attribute._dbus_signature)

872

(types.FunctionType(

873

nonmethod_func.func_code,

874

nonmethod_func.func_globals,

875

nonmethod_func.func_name,

876

nonmethod_func.func_defaults,

877

nonmethod_func.func_closure)))

878

# Define a creator of a function to call both the

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

881

def fixscope(func1, func2):

882

"""This function is a scope container to pass

883

func1 and func2 to the "call_both" function

884

outside of its arguments"""

885

def call_both(*args, **kwargs):

886

"""This function will emit two D-Bus

887

signals by calling func1 and func2"""

888

func1(*args, **kwargs)

889

func2(*args, **kwargs)

890

return call_both

891

# Create the "call_both" function and add it to

892

# the class

893

attr[attrname] = fixscope(attribute,

894

new_function)

895

# Is this a D-Bus method?

896

elif getattr(attribute, "_dbus_is_method", False):

897

# Create a new, but exactly alike, function

898

# object. Decorate it to be a new D-Bus method

899

# with the alternate D-Bus interface name. Add it

900

# to the class.

901

attr[attrname] = (dbus.service.method

902

(alt_interface,

903

attribute._dbus_in_signature,

904

attribute._dbus_out_signature)

905

(types.FunctionType

906

(attribute.func_code,

907

attribute.func_globals,

908

attribute.func_name,

909

attribute.func_defaults,

910

attribute.func_closure)))

911

# Is this a D-Bus property?

912

elif getattr(attribute, "_dbus_is_property", False):

913

# Create a new, but exactly alike, function

914

# object, and decorate it to be a new D-Bus

915

# property with the alternate D-Bus interface

916

# name. Add it to the class.

917

attr[attrname] = (dbus_service_property

918

(alt_interface,

919

attribute._dbus_signature,

920

attribute._dbus_access,

921

attribute

922

._dbus_get_args_options

923

["byte_arrays"])

924

(types.FunctionType

925

(attribute.func_code,

926

attribute.func_globals,

927

attribute.func_name,

928

attribute.func_defaults,

929

attribute.func_closure)))

930

return type.__new__(mcs, name, bases, attr)

931

732

932

class ClientDBus(Client, DBusObjectWithProperties):

733

933

"""A Client class using D-Bus

734

934

743

943

# dbus.service.Object doesn't use super(), so we can't either.

744

944

745

945

def __init__(self, bus = None, *args, **kwargs):

946

self.bus = bus

947

Client.__init__(self, *args, **kwargs)

948

746

949

self._approvals_pending = 0

747

self.bus = bus

748

Client.__init__(self, *args, **kwargs)

749

950

# Only now, when this client is initialized, can it show up on

750

951

# the D-Bus

751

952

client_object_name = unicode(self.name).translate(

756

957

DBusObjectWithProperties.__init__(self, self.bus,

757

958

self.dbus_object_path)

758

959

759

def _get_approvals_pending(self):

760

return self._approvals_pending

761

def _set_approvals_pending(self, value):

762

old_value = self._approvals_pending

763

self._approvals_pending = value

764

bval = bool(value)

765

if (hasattr(self, "dbus_object_path")

766

and bval is not bool(old_value)):

767

dbus_bool = dbus.Boolean(bval, variant_level=1)

768

self.PropertyChanged(dbus.String("ApprovalPending"),

769

dbus_bool)

960

def notifychangeproperty(transform_func,

961

dbus_name, type_func=lambda x: x,

962

variant_level=1):

963

""" Modify a variable so that it's a property which announces

964

its changes to DBus.

770

965

771

approvals_pending = property(_get_approvals_pending,

772

_set_approvals_pending)

773

del _get_approvals_pending, _set_approvals_pending

774

775

@staticmethod

776

def _datetime_to_dbus(dt, variant_level=0):

777

"""Convert a UTC datetime.datetime() to a D-Bus type."""

778

return dbus.String(dt.isoformat(),

779

variant_level=variant_level)

780

781

def enable(self):

782

oldstate = getattr(self, "enabled", False)

783

r = Client.enable(self)

784

if oldstate != self.enabled:

785

# Emit D-Bus signals

786

self.PropertyChanged(dbus.String("Enabled"),

787

dbus.Boolean(True, variant_level=1))

788

self.PropertyChanged(

789

dbus.String("LastEnabled"),

790

self._datetime_to_dbus(self.last_enabled,

791

variant_level=1))

792

return r

793

794

def disable(self, quiet = False):

795

oldstate = getattr(self, "enabled", False)

796

r = Client.disable(self, quiet=quiet)

797

if not quiet and oldstate != self.enabled:

798

# Emit D-Bus signal

799

self.PropertyChanged(dbus.String("Enabled"),

800

dbus.Boolean(False, variant_level=1))

801

return r

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

968

dbus_name: D-Bus name of the variable

969

type_func: Function that transform the value before sending it

970

to the D-Bus. Default: no transform

971

variant_level: D-Bus variant level. Default: 1

972

"""

973

attrname = "_{0}".format(dbus_name)

974

def setter(self, value):

975

if hasattr(self, "dbus_object_path"):

976

if (not hasattr(self, attrname) or

977

type_func(getattr(self, attrname, None))

978

!= type_func(value)):

979

dbus_value = transform_func(type_func(value),

980

variant_level

981

=variant_level)

982

self.PropertyChanged(dbus.String(dbus_name),

983

dbus_value)

984

setattr(self, attrname, value)

985

986

return property(lambda self: getattr(self, attrname), setter)

987

988

989

expires = notifychangeproperty(datetime_to_dbus, "Expires")

990

approvals_pending = notifychangeproperty(dbus.Boolean,

991

"ApprovalPending",

992

type_func = bool)

993

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

994

last_enabled = notifychangeproperty(datetime_to_dbus,

995

"LastEnabled")

996

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

997

type_func = lambda checker:

998

checker is not None)

999

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1000

"LastCheckedOK")

1001

last_approval_request = notifychangeproperty(

1002

datetime_to_dbus, "LastApprovalRequest")

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

1004

"ApprovedByDefault")

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1006

"ApprovalDelay",

1007

type_func =

1008

_timedelta_to_milliseconds)

1009

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

1012

host = notifychangeproperty(dbus.String, "Host")

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1014

type_func =

1015

_timedelta_to_milliseconds)

1016

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1020

"Interval",

1021

type_func =

1022

_timedelta_to_milliseconds)

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

1024

1025

del notifychangeproperty

802

1026

803

1027

def __del__(self, *args, **kwargs):

804

1028

try:

813

1037

*args, **kwargs):

814

1038

self.checker_callback_tag = None

815

1039

self.checker = None

816

# Emit D-Bus signal

817

self.PropertyChanged(dbus.String("CheckerRunning"),

818

dbus.Boolean(False, variant_level=1))

819

1040

if os.WIFEXITED(condition):

820

1041

exitstatus = os.WEXITSTATUS(condition)

821

1042

# Emit D-Bus signal

831

1052

return Client.checker_callback(self, pid, condition, command,

832

1053

*args, **kwargs)

833

1054

834

def checked_ok(self, *args, **kwargs):

835

Client.checked_ok(self, *args, **kwargs)

836

# Emit D-Bus signal

837

self.PropertyChanged(

838

dbus.String("LastCheckedOK"),

839

(self._datetime_to_dbus(self.last_checked_ok,

840

variant_level=1)))

841

842

def need_approval(self, *args, **kwargs):

843

r = Client.need_approval(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastApprovalRequest"),

847

(self._datetime_to_dbus(self.last_approval_request,

848

variant_level=1)))

849

return r

850

851

1055

def start_checker(self, *args, **kwargs):

852

1056

old_checker = self.checker

853

1057

if self.checker is not None:

860

1064

and old_checker_pid != self.checker.pid):

861

1065

# Emit D-Bus signal

862

1066

self.CheckerStarted(self.current_checker_command)

863

self.PropertyChanged(

864

dbus.String("CheckerRunning"),

865

dbus.Boolean(True, variant_level=1))

866

1067

return r

867

1068

868

def stop_checker(self, *args, **kwargs):

869

old_checker = getattr(self, "checker", None)

870

r = Client.stop_checker(self, *args, **kwargs)

871

if (old_checker is not None

872

and getattr(self, "checker", None) is None):

873

self.PropertyChanged(dbus.String("CheckerRunning"),

874

dbus.Boolean(False, variant_level=1))

875

return r

876

877

1069

def _reset_approved(self):

878

1070

self._approved = None

879

1071

return False

881

1073

def approve(self, value=True):

882

1074

self.send_changedstate()

883

1075

self._approved = value

884

gobject.timeout_add(self._timedelta_to_milliseconds

1076

gobject.timeout_add(_timedelta_to_milliseconds

885

1077

(self.approval_duration),

886

1078

self._reset_approved)

887

1079

888

1080

889

1081

## D-Bus methods, signals & properties

890

_interface = "se.bsnet.fukt.Mandos.Client"

1082

_interface = "se.recompile.Mandos.Client"

891

1083

892

1084

## Signals

893

1085

979

1171

if value is None: # get

980

1172

return dbus.Boolean(self.approved_by_default)

981

1173

self.approved_by_default = bool(value)

982

# Emit D-Bus signal

983

self.PropertyChanged(dbus.String("ApprovedByDefault"),

984

dbus.Boolean(value, variant_level=1))

985

1174

986

1175

# ApprovalDelay - property

987

1176

@dbus_service_property(_interface, signature="t",

990

1179

if value is None: # get

991

1180

return dbus.UInt64(self.approval_delay_milliseconds())

992

1181

self.approval_delay = datetime.timedelta(0, 0, 0, value)

993

# Emit D-Bus signal

994

self.PropertyChanged(dbus.String("ApprovalDelay"),

995

dbus.UInt64(value, variant_level=1))

996

1182

997

1183

# ApprovalDuration - property

998

1184

@dbus_service_property(_interface, signature="t",

999

1185

access="readwrite")

1000

1186

def ApprovalDuration_dbus_property(self, value=None):

1001

1187

if value is None: # get

1002

return dbus.UInt64(self._timedelta_to_milliseconds(

1188

return dbus.UInt64(_timedelta_to_milliseconds(

1003

1189

self.approval_duration))

1004

1190

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1005

# Emit D-Bus signal

1006

self.PropertyChanged(dbus.String("ApprovalDuration"),

1007

dbus.UInt64(value, variant_level=1))

1008

1191

1009

1192

# Name - property

1010

1193

@dbus_service_property(_interface, signature="s", access="read")

1023

1206

if value is None: # get

1024

1207

return dbus.String(self.host)

1025

1208

self.host = value

1026

# Emit D-Bus signal

1027

self.PropertyChanged(dbus.String("Host"),

1028

dbus.String(value, variant_level=1))

1029

1209

1030

1210

# Created - property

1031

1211

@dbus_service_property(_interface, signature="s", access="read")

1032

1212

def Created_dbus_property(self):

1033

return dbus.String(self._datetime_to_dbus(self.created))

1213

return dbus.String(datetime_to_dbus(self.created))

1034

1214

1035

1215

# LastEnabled - property

1036

1216

@dbus_service_property(_interface, signature="s", access="read")

1037

1217

def LastEnabled_dbus_property(self):

1038

if self.last_enabled is None:

1039

return dbus.String("")

1040

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1218

return datetime_to_dbus(self.last_enabled)

1041

1219

1042

1220

# Enabled - property

1043

1221

@dbus_service_property(_interface, signature="b",

1057

1235

if value is not None:

1058

1236

self.checked_ok()

1059

1237

return

1060

if self.last_checked_ok is None:

1061

return dbus.String("")

1062

return dbus.String(self._datetime_to_dbus(self

1063

.last_checked_ok))

1238

return datetime_to_dbus(self.last_checked_ok)

1239

1240

# Expires - property

1241

@dbus_service_property(_interface, signature="s", access="read")

1242

def Expires_dbus_property(self):

1243

return datetime_to_dbus(self.expires)

1064

1244

1065

1245

# LastApprovalRequest - property

1066

1246

@dbus_service_property(_interface, signature="s", access="read")

1067

1247

def LastApprovalRequest_dbus_property(self):

1068

if self.last_approval_request is None:

1069

return dbus.String("")

1070

return dbus.String(self.

1071

_datetime_to_dbus(self

1072

.last_approval_request))

1248

return datetime_to_dbus(self.last_approval_request)

1073

1249

1074

1250

# Timeout - property

1075

1251

@dbus_service_property(_interface, signature="t",

1078

1254

if value is None: # get

1079

1255

return dbus.UInt64(self.timeout_milliseconds())

1080

1256

self.timeout = datetime.timedelta(0, 0, 0, value)

1081

# Emit D-Bus signal

1082

self.PropertyChanged(dbus.String("Timeout"),

1083

dbus.UInt64(value, variant_level=1))

1084

1257

if getattr(self, "disable_initiator_tag", None) is None:

1085

1258

return

1086

1259

# Reschedule timeout

1087

1260

gobject.source_remove(self.disable_initiator_tag)

1088

1261

self.disable_initiator_tag = None

1089

time_to_die = (self.

1090

_timedelta_to_milliseconds((self

1091

.last_checked_ok

1092

+ self.timeout)

1093

- datetime.datetime

1094

.utcnow()))

1262

self.expires = None

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1095

1268

if time_to_die <= 0:

1096

1269

# The timeout has passed

1097

1270

self.disable()

1098

1271

else:

1272

self.expires = (datetime.datetime.utcnow()

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1099

1275

self.disable_initiator_tag = (gobject.timeout_add

1100

1276

(time_to_die, self.disable))

1101

1277

1278

# ExtendedTimeout - property

1279

@dbus_service_property(_interface, signature="t",

1280

access="readwrite")

1281

def ExtendedTimeout_dbus_property(self, value=None):

1282

if value is None: # get

1283

return dbus.UInt64(self.extended_timeout_milliseconds())

1284

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1285

1102

1286

# Interval - property

1103

1287

@dbus_service_property(_interface, signature="t",

1104

1288

access="readwrite")

1106

1290

if value is None: # get

1107

1291

return dbus.UInt64(self.interval_milliseconds())

1108

1292

self.interval = datetime.timedelta(0, 0, 0, value)

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Interval"),

1111

dbus.UInt64(value, variant_level=1))

1112

1293

if getattr(self, "checker_initiator_tag", None) is None:

1113

1294

return

1114

1295

# Reschedule checker run

1116

1297

self.checker_initiator_tag = (gobject.timeout_add

1117

1298

(value, self.start_checker))

1118

1299

self.start_checker() # Start one now, too

1119

1300

1120

1301

# Checker - property

1121

1302

@dbus_service_property(_interface, signature="s",

1122

1303

access="readwrite")

1124

1305

if value is None: # get

1125

1306

return dbus.String(self.checker_command)

1126

1307

self.checker_command = value

1127

# Emit D-Bus signal

1128

self.PropertyChanged(dbus.String("Checker"),

1129

dbus.String(self.checker_command,

1130

variant_level=1))

1131

1308

1132

1309

# CheckerRunning - property

1133

1310

@dbus_service_property(_interface, signature="b",

1160

1337

self._pipe.send(('init', fpr, address))

1161

1338

if not self._pipe.recv():

1162

1339

raise KeyError()

1163

1340

1164

1341

def __getattribute__(self, name):

1165

1342

if(name == '_pipe'):

1166

1343

return super(ProxyClient, self).__getattribute__(name)

1173

1350

self._pipe.send(('funcall', name, args, kwargs))

1174

1351

return self._pipe.recv()[1]

1175

1352

return func

1176

1353

1177

1354

def __setattr__(self, name, value):

1178

1355

if(name == '_pipe'):

1179

1356

return super(ProxyClient, self).__setattr__(name, value)

1180

1357

self._pipe.send(('setattr', name, value))

1181

1358

1359

class ClientDBusTransitional(ClientDBus):

1360

__metaclass__ = AlternateDBusNamesMetaclass

1182

1361

1183

1362

class ClientHandler(socketserver.BaseRequestHandler, object):

1184

1363

"""A class to handle client connections.

1192

1371

unicode(self.client_address))

1193

1372

logger.debug("Pipe FD: %d",

1194

1373

self.server.child_pipe.fileno())

1195

1374

1196

1375

session = (gnutls.connection

1197

1376

.ClientSession(self.request,

1198

1377

gnutls.connection

1199

1378

.X509Credentials()))

1200

1379

1201

1380

# Note: gnutls.connection.X509Credentials is really a

1202

1381

# generic GnuTLS certificate credentials object so long as

1203

1382

# no X.509 keys are added to it. Therefore, we can use it

1204

1383

# here despite using OpenPGP certificates.

1205

1384

1206

1385

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1207

1386

# "+AES-256-CBC", "+SHA1",

1208

1387

# "+COMP-NULL", "+CTYPE-OPENPGP",

1214

1393

(gnutls.library.functions

1215

1394

.gnutls_priority_set_direct(session._c_object,

1216

1395

priority, None))

1217

1396

1218

1397

# Start communication using the Mandos protocol

1219

1398

# Get protocol number

1220

1399

line = self.request.makefile().readline()

1225

1404

except (ValueError, IndexError, RuntimeError) as error:

1226

1405

logger.error("Unknown protocol version: %s", error)

1227

1406

return

1228

1407

1229

1408

# Start GnuTLS connection

1230

1409

try:

1231

1410

session.handshake()

1235

1414

# established. Just abandon the request.

1236

1415

return

1237

1416

logger.debug("Handshake succeeded")

1238

1417

1239

1418

approval_required = False

1240

1419

try:

1241

1420

try:

1246

1425

logger.warning("Bad certificate: %s", error)

1247

1426

return

1248

1427

logger.debug("Fingerprint: %s", fpr)

1249

1428

1250

1429

try:

1251

1430

client = ProxyClient(child_pipe, fpr,

1252

1431

self.client_address)

1260

1439

1261

1440

while True:

1262

1441

if not client.enabled:

1263

logger.warning("Client %s is disabled",

1442

logger.info("Client %s is disabled",

1264

1443

client.name)

1265

1444

if self.server.use_dbus:

1266

1445

# Emit D-Bus signal

1267

client.Rejected("Disabled")

1446

client.Rejected("Disabled")

1268

1447

return

1269

1448

1270

1449

if client._approved or not client.approval_delay:

1287

1466

return

1288

1467

1289

1468

#wait until timeout or approved

1290

#x = float(client._timedelta_to_milliseconds(delay))

1291

1469

time = datetime.datetime.now()

1292

1470

client.changedstate.acquire()

1293

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1471

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1473

/ 1000)))

1294

1474

client.changedstate.release()

1295

1475

time2 = datetime.datetime.now()

1296

1476

if (time2 - time) >= delay:

1318

1498

sent, len(client.secret)

1319

1499

- (sent_size + sent))

1320

1500

sent_size += sent

1321

1501

1322

1502

logger.info("Sending secret to %s", client.name)

1323

# bump the timeout as if seen

1324

client.checked_ok()

1503

# bump the timeout using extended_timeout

1504

client.checked_ok(client.extended_timeout)

1325

1505

if self.server.use_dbus:

1326

1506

# Emit D-Bus signal

1327

1507

client.GotSecret()

1406

1586

except:

1407

1587

self.handle_error(request, address)

1408

1588

self.close_request(request)

1409

1589

1410

1590

def process_request(self, request, address):

1411

1591

"""Start a new process to process the request."""

1412

multiprocessing.Process(target = self.sub_process_main,

1413

args = (request, address)).start()

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1593

args = (request,

1594

address))

1595

proc.start()

1596

return proc

1597

1414

1598

1415

1599

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1416

1600

""" adds a pipe to the MixIn """

1420

1604

This function creates a new pipe in self.pipe

1421

1605

"""

1422

1606

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1423

1424

super(MultiprocessingMixInWithPipe,

1425

self).process_request(request, client_address)

1607

1608

proc = MultiprocessingMixIn.process_request(self, request,

1609

client_address)

1426

1610

self.child_pipe.close()

1427

self.add_pipe(parent_pipe)

1428

1429

def add_pipe(self, parent_pipe):

1611

self.add_pipe(parent_pipe, proc)

1612

1613

def add_pipe(self, parent_pipe, proc):

1430

1614

"""Dummy function; override as necessary"""

1431

1615

raise NotImplementedError

1432

1616

1617

1433

1618

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1434

1619

socketserver.TCPServer, object):

1435

1620

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1509

1694

self.enabled = False

1510

1695

self.clients = clients

1511

1696

if self.clients is None:

1512

self.clients = set()

1697

self.clients = {}

1513

1698

self.use_dbus = use_dbus

1514

1699

self.gnutls_priority = gnutls_priority

1515

1700

IPv6_TCPServer.__init__(self, server_address,

1519

1704

def server_activate(self):

1520

1705

if self.enabled:

1521

1706

return socketserver.TCPServer.server_activate(self)

1707

1522

1708

def enable(self):

1523

1709

self.enabled = True

1524

def add_pipe(self, parent_pipe):

1710

1711

def add_pipe(self, parent_pipe, proc):

1525

1712

# Call "handle_ipc" for both data and EOF events

1526

1713

gobject.io_add_watch(parent_pipe.fileno(),

1527

1714

gobject.IO_IN | gobject.IO_HUP,

1528

1715

functools.partial(self.handle_ipc,

1529

parent_pipe = parent_pipe))

1530

1716

parent_pipe =

1717

parent_pipe,

1718

proc = proc))

1719

1531

1720

def handle_ipc(self, source, condition, parent_pipe=None,

1532

client_object=None):

1721

proc = None, client_object=None):

1533

1722

condition_names = {

1534

1723

gobject.IO_IN: "IN", # There is data to read.

1535

1724

gobject.IO_OUT: "OUT", # Data can be written (without

1544

1733

for cond, name in

1545

1734

condition_names.iteritems()

1546

1735

if cond & condition)

1547

# error or the other end of multiprocessing.Pipe has closed

1736

# error, or the other end of multiprocessing.Pipe has closed

1548

1737

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1738

# Wait for other process to exit

1739

proc.join()

1549

1740

return False

1550

1741

1551

1742

# Read a request from the child

1556

1747

fpr = request[1]

1557

1748

address = request[2]

1558

1749

1559

for c in self.clients:

1750

for c in self.clients.itervalues():

1560

1751

if c.fingerprint == fpr:

1561

1752

client = c

1562

1753

break

1563

1754

else:

1564

logger.warning("Client not found for fingerprint: %s, ad"

1565

"dress: %s", fpr, address)

1755

logger.info("Client not found for fingerprint: %s, ad"

1756

"dress: %s", fpr, address)

1566

1757

if self.use_dbus:

1567

1758

# Emit D-Bus signal

1568

mandos_dbus_service.ClientNotFound(fpr, address[0])

1759

mandos_dbus_service.ClientNotFound(fpr,

1760

address[0])

1569

1761

parent_pipe.send(False)

1570

1762

return False

1571

1763

1572

1764

gobject.io_add_watch(parent_pipe.fileno(),

1573

1765

gobject.IO_IN | gobject.IO_HUP,

1574

1766

functools.partial(self.handle_ipc,

1575

parent_pipe = parent_pipe,

1576

client_object = client))

1767

parent_pipe =

1768

parent_pipe,

1769

proc = proc,

1770

client_object =

1771

client))

1577

1772

parent_pipe.send(True)

1578

# remove the old hook in favor of the new above hook on same fileno

1773

# remove the old hook in favor of the new above hook on

1774

# same fileno

1579

1775

return False

1580

1776

if command == 'funcall':

1581

1777

funcname = request[1]

1582

1778

args = request[2]

1583

1779

kwargs = request[3]

1584

1780

1585

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1586

1781

parent_pipe.send(('data', getattr(client_object,

1782

funcname)(*args,

1783

**kwargs)))

1784

1587

1785

if command == 'getattr':

1588

1786

attrname = request[1]

1589

1787

if callable(client_object.__getattribute__(attrname)):

1590

1788

parent_pipe.send(('function',))

1591

1789

else:

1592

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1790

parent_pipe.send(('data', client_object

1791

.__getattribute__(attrname)))

1593

1792

1594

1793

if command == 'setattr':

1595

1794

attrname = request[1]

1596

1795

value = request[2]

1597

1796

setattr(client_object, attrname, value)

1598

1797

1599

1798

return True

1600

1799

1601

1800

1722

1921

" system bus interface")

1723

1922

parser.add_argument("--no-ipv6", action="store_false",

1724

1923

dest="use_ipv6", help="Do not use IPv6")

1924

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

1725

1928

options = parser.parse_args()

1726

1929

1727

1930

if options.check:

1762

1965

# options, if set.

1763

1966

for option in ("interface", "address", "port", "debug",

1764

1967

"priority", "servicename", "configdir",

1765

"use_dbus", "use_ipv6", "debuglevel"):

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1766

1969

value = getattr(options, option)

1767

1970

if value is not None:

1768

1971

server_settings[option] = value

1780

1983

debuglevel = server_settings["debuglevel"]

1781

1984

use_dbus = server_settings["use_dbus"]

1782

1985

use_ipv6 = server_settings["use_ipv6"]

1783

1986

1784

1987

if server_settings["servicename"] != "Mandos":

1785

1988

syslogger.setFormatter(logging.Formatter

1786

1989

('Mandos (%s) [%%(process)d]:'

1788

1991

% server_settings["servicename"]))

1789

1992

1790

1993

# Parse config file with clients

1791

client_defaults = { "timeout": "1h",

1792

"interval": "5m",

1994

client_defaults = { "timeout": "5m",

1995

"extended_timeout": "15m",

1996

"interval": "2m",

1793

1997

"checker": "fping -q -- %%(host)s",

1794

1998

"host": "",

1795

1999

"approval_delay": "0s",

1840

2044

raise error

1841

2045

1842

2046

if not debug and not debuglevel:

1843

syslogger.setLevel(logging.WARNING)

1844

console.setLevel(logging.WARNING)

2047

logger.setLevel(logging.WARNING)

1845

2048

if debuglevel:

1846

2049

level = getattr(logging, debuglevel.upper())

1847

syslogger.setLevel(level)

1848

console.setLevel(level)

1849

2050

logger.setLevel(level)

2051

1850

2052

if debug:

2053

logger.setLevel(logging.DEBUG)

1851

2054

# Enable all possible GnuTLS debugging

1852

2055

1853

2056

# "Use a log level over 10 to enable all debugging options."

1883

2086

# End of Avahi example code

1884

2087

if use_dbus:

1885

2088

try:

1886

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2089

bus_name = dbus.service.BusName("se.recompile.Mandos",

1887

2090

bus, do_not_queue=True)

2091

old_bus_name = (dbus.service.BusName

2092

("se.bsnet.fukt.Mandos", bus,

2093

do_not_queue=True))

1888

2094

except dbus.exceptions.NameExistsException as e:

1889

2095

logger.error(unicode(e) + ", disabling D-Bus")

1890

2096

use_dbus = False

1891

2097

server_settings["use_dbus"] = False

1892

2098

tcp_server.use_dbus = False

1893

2099

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1894

service = AvahiService(name = server_settings["servicename"],

1895

servicetype = "_mandos._tcp",

1896

protocol = protocol, bus = bus)

2100

service = AvahiServiceToSyslog(name =

2101

server_settings["servicename"],

2102

servicetype = "_mandos._tcp",

2103

protocol = protocol, bus = bus)

1897

2104

if server_settings["interface"]:

1898

2105

service.interface = (if_nametoindex

1899

2106

(str(server_settings["interface"])))

1903

2110

1904

2111

client_class = Client

1905

2112

if use_dbus:

1906

client_class = functools.partial(ClientDBus, bus = bus)

1907

def client_config_items(config, section):

1908

special_settings = {

1909

"approved_by_default":

1910

lambda: config.getboolean(section,

1911

"approved_by_default"),

1912

}

1913

for name, value in config.items(section):

2113

client_class = functools.partial(ClientDBusTransitional,

2114

bus = bus)

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2133

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2137

if server_settings["restore"]:

2138

try:

2139

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2141

os.remove(stored_state_path)

2142

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2145

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

1914

2156

try:

1915

yield (name, special_settings[name]())

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

1916

2162

except KeyError:

1917

yield (name, value)

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

1918

2209

1919

tcp_server.clients.update(set(

1920

client_class(name = section,

1921

config= dict(client_config_items(

1922

client_config, section)))

1923

for section in client_config.sections()))

2210

1924

2211

if not tcp_server.clients:

1925

2212

logger.warning("No clients defined")

1926

2213

1939

2226

del pidfilename

1940

2227

1941

2228

signal.signal(signal.SIGINT, signal.SIG_IGN)

1942

2229

1943

2230

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1944

2231

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1945

2232

1948

2235

"""A D-Bus proxy object"""

1949

2236

def __init__(self):

1950

2237

dbus.service.Object.__init__(self, bus, "/")

1951

_interface = "se.bsnet.fukt.Mandos"

2238

_interface = "se.recompile.Mandos"

1952

2239

1953

2240

@dbus.service.signal(_interface, signature="o")

1954

2241

def ClientAdded(self, objpath):

1969

2256

def GetAllClients(self):

1970

2257

"D-Bus method"

1971

2258

return dbus.Array(c.dbus_object_path

1972

for c in tcp_server.clients)

2259

for c in

2260

tcp_server.clients.itervalues())

1973

2261

1974

2262

@dbus.service.method(_interface,

1975

2263

out_signature="a{oa{sv}}")

1977

2265

"D-Bus method"

1978

2266

return dbus.Dictionary(

1979

2267

((c.dbus_object_path, c.GetAll(""))

1980

for c in tcp_server.clients),

2268

for c in tcp_server.clients.itervalues()),

1981

2269

signature="oa{sv}")

1982

2270

1983

2271

@dbus.service.method(_interface, in_signature="o")

1984

2272

def RemoveClient(self, object_path):

1985

2273

"D-Bus method"

1986

for c in tcp_server.clients:

2274

for c in tcp_server.clients.itervalues():

1987

2275

if c.dbus_object_path == object_path:

1988

tcp_server.clients.remove(c)

2276

del tcp_server.clients[c.name]

1989

2277

c.remove_from_connection()

1990

2278

# Don't signal anything except ClientRemoved

1991

2279

c.disable(quiet=True)

1996

2284

1997

2285

del _interface

1998

2286

1999

mandos_dbus_service = MandosDBusService()

2287

class MandosDBusServiceTransitional(MandosDBusService):

2288

__metaclass__ = AlternateDBusNamesMetaclass

2289

mandos_dbus_service = MandosDBusServiceTransitional()

2000

2290

2001

2291

def cleanup():

2002

2292

"Cleanup function; run on exit"

2003

2293

service.cleanup()

2004

2294

2295

multiprocessing.active_children()

2296

if not (tcp_server.clients or client_settings):

2297

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2321

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2323

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2329

# Delete all clients, and settings from config

2005

2330

while tcp_server.clients:

2006

client = tcp_server.clients.pop()

2331

name, client = tcp_server.clients.popitem()

2007

2332

if use_dbus:

2008

2333

client.remove_from_connection()

2009

client.disable_hook = None

2010

2334

# Don't signal anything except ClientRemoved

2011

2335

client.disable(quiet=True)

2012

2336

if use_dbus:

2013

2337

# Emit D-Bus signal

2014

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2338

mandos_dbus_service.ClientRemoved(client

2339

.dbus_object_path,

2015

2340

client.name)

2341

client_settings.clear()

2016

2342

2017

2343

atexit.register(cleanup)

2018

2344

2019

for client in tcp_server.clients:

2345

for client in tcp_server.clients.itervalues():

2020

2346

if use_dbus:

2021

2347

# Emit D-Bus signal

2022

2348

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2023

client.enable()

2349

# Need to initiate checking of clients

2350

if client.enabled:

2351

client.init_checker()

2352

2024

2353

2025

2354

tcp_server.enable()

2026

2355

tcp_server.server_activate()

2066

2395

# Must run before the D-Bus bus name gets deregistered

2067

2396

cleanup()

2068

2397

2398

2069

2399

if __name__ == '__main__':

2070

2400

main()