/mandos/trunk : revision 520

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

65

67

66

68

import dbus

67

69

import dbus.service

72

74

import ctypes.util

73

75

import xml.dom.minidom

74

76

import inspect

77

import Crypto.Cipher.AES

75

78

76

79

try:

77

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

85

SO_BINDTODEVICE = None

83

86

84

87

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

89

93

syslogger = (logging.handlers.SysLogHandler

90

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

95

address = str("/dev/log")))

95

99

logger.addHandler(syslogger)

96

100

97

101

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

99

104

' %(levelname)s:'

100

105

' %(message)s'))

101

106

logger.addHandler(console)

102

107

108

103

109

class AvahiError(Exception):

104

110

def __init__(self, value, *args, **kwargs):

105

111

self.value = value

159

165

" after %i retries, exiting.",

160

166

self.rename_count)

161

167

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

163

170

logger.info("Changing Zeroconf service name to %r ...",

164

171

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

172

self.remove()

170

173

try:

171

174

self.add()

191

194

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

195

self.entry_group_state_changed_match = (

193

196

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

197

'StateChanged', self.entry_group_state_changed))

195

198

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

196

199

self.name, self.type)

197

200

self.group.AddService(

263

266

self.server_state_changed)

264

267

self.server_state_changed(self.server.GetState())

265

268

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

266

278

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

267

285

class Client(object):

268

286

"""A representation of a client host served by this server.

269

287

281

299

instance %(name)s can be used in the command.

282

300

checker_initiator_tag: a gobject event source tag, or None

283

301

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

284

304

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

305

disable_initiator_tag: a gobject event source tag, or None

287

306

enabled: bool()

288

307

fingerprint: string (40 or 32 hexadecimal digits); used to

291

310

interval: datetime.timedelta(); How often to start a new checker

292

311

last_approval_request: datetime.datetime(); (UTC) or None

293

312

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

294

316

last_enabled: datetime.datetime(); (UTC)

295

317

name: string; from the config file, used in log messages and

296

318

D-Bus identifiers

297

319

secret: bytestring; sent verbatim (over TLS) to client

298

320

timeout: datetime.timedelta(); How long from last_checked_ok

299

321

until this client is disabled

322

extended_timeout: extra long timeout when password has been sent

300

323

runtime_expansions: Allowed attributes for runtime expansion.

324

expires: datetime.datetime(); time (UTC) when a client will be

325

disabled, or None

301

326

"""

302

327

303

328

runtime_expansions = ("approval_delay", "approval_duration",

305

330

"host", "interval", "last_checked_ok",

306

331

"last_enabled", "name", "timeout")

307

332

308

@staticmethod

309

def _timedelta_to_milliseconds(td):

310

"Convert a datetime.timedelta() to milliseconds"

311

return ((td.days * 24 * 60 * 60 * 1000)

312

+ (td.seconds * 1000)

313

+ (td.microseconds // 1000))

314

315

333

def timeout_milliseconds(self):

316

334

"Return the 'timeout' attribute in milliseconds"

317

return self._timedelta_to_milliseconds(self.timeout)

335

return _timedelta_to_milliseconds(self.timeout)

336

337

def extended_timeout_milliseconds(self):

338

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

318

340

319

341

def interval_milliseconds(self):

320

342

"Return the 'interval' attribute in milliseconds"

321

return self._timedelta_to_milliseconds(self.interval)

322

343

return _timedelta_to_milliseconds(self.interval)

344

323

345

def approval_delay_milliseconds(self):

324

return self._timedelta_to_milliseconds(self.approval_delay)

346

return _timedelta_to_milliseconds(self.approval_delay)

325

347

326

def __init__(self, name = None, disable_hook=None, config=None):

348

def __init__(self, name = None, config=None):

327

349

"""Note: the 'checker' key in 'config' sets the

328

350

'checker_command' attribute and *not* the 'checker'

329

351

attribute."""

349

371

% self.name)

350

372

self.host = config.get("host", "")

351

373

self.created = datetime.datetime.utcnow()

352

self.enabled = False

374

self.enabled = True

353

375

self.last_approval_request = None

354

self.last_enabled = None

376

self.last_enabled = datetime.datetime.utcnow()

355

377

self.last_checked_ok = None

378

self.last_checker_status = None

356

379

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

357

382

self.interval = string_to_delta(config["interval"])

358

self.disable_hook = disable_hook

359

383

self.checker = None

360

384

self.checker_initiator_tag = None

361

385

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

362

387

self.checker_callback_tag = None

363

388

self.checker_command = config["checker"]

364

389

self.current_checker_command = None

365

self.last_connect = None

366

390

self._approved = None

367

391

self.approved_by_default = config.get("approved_by_default",

368

392

True)

371

395

config["approval_delay"])

372

396

self.approval_duration = string_to_delta(

373

397

config["approval_duration"])

374

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

375

409

410

# Send notice to process children that client state has changed

376

411

def send_changedstate(self):

377

self.changedstate.acquire()

378

self.changedstate.notify_all()

379

self.changedstate.release()

380

412

with self.changedstate:

413

self.changedstate.notify_all()

414

381

415

def enable(self):

382

416

"""Start this client's checker and timeout hooks"""

383

417

if getattr(self, "enabled", False):

384

418

# Already enabled

385

419

return

386

420

self.send_changedstate()

421

self.expires = datetime.datetime.utcnow() + self.timeout

422

self.enabled = True

387

423

self.last_enabled = datetime.datetime.utcnow()

388

# Schedule a new checker to be started an 'interval' from now,

389

# and every interval from then on.

390

self.checker_initiator_tag = (gobject.timeout_add

391

(self.interval_milliseconds(),

392

self.start_checker))

393

# Schedule a disable() when 'timeout' has passed

394

self.disable_initiator_tag = (gobject.timeout_add

395

(self.timeout_milliseconds(),

396

self.disable))

397

self.enabled = True

398

# Also start a new checker *right now*.

399

self.start_checker()

424

self.init_checker()

400

425

401

426

def disable(self, quiet=True):

402

427

"""Disable this client."""

409

434

if getattr(self, "disable_initiator_tag", False):

410

435

gobject.source_remove(self.disable_initiator_tag)

411

436

self.disable_initiator_tag = None

437

self.expires = None

412

438

if getattr(self, "checker_initiator_tag", False):

413

439

gobject.source_remove(self.checker_initiator_tag)

414

440

self.checker_initiator_tag = None

415

441

self.stop_checker()

416

if self.disable_hook:

417

self.disable_hook(self)

418

442

self.enabled = False

419

443

# Do not run this again if called by a gobject.timeout_add

420

444

return False

421

445

422

446

def __del__(self):

423

self.disable_hook = None

424

447

self.disable()

425

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

426

463

def checker_callback(self, pid, condition, command):

427

464

"""The checker has completed, so take appropriate actions."""

428

465

self.checker_callback_tag = None

429

466

self.checker = None

430

467

if os.WIFEXITED(condition):

431

exitstatus = os.WEXITSTATUS(condition)

432

if exitstatus == 0:

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

433

470

logger.info("Checker for %(name)s succeeded",

434

471

vars(self))

435

472

self.checked_ok()

437

474

logger.info("Checker for %(name)s failed",

438

475

vars(self))

439

476

else:

477

self.last_checker_status = -1

440

478

logger.warning("Checker for %(name)s crashed?",

441

479

vars(self))

442

480

443

def checked_ok(self):

481

def checked_ok(self, timeout=None):

444

482

"""Bump up the timeout for this client.

445

483

446

484

This should only be called when the client has been seen,

447

485

alive and well.

448

486

"""

487

if timeout is None:

488

timeout = self.timeout

449

489

self.last_checked_ok = datetime.datetime.utcnow()

450

gobject.source_remove(self.disable_initiator_tag)

451

self.disable_initiator_tag = (gobject.timeout_add

452

(self.timeout_milliseconds(),

453

self.disable))

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

454

497

455

498

def need_approval(self):

456

499

self.last_approval_request = datetime.datetime.utcnow()

496

539

'replace')))

497

540

for attr in

498

541

self.runtime_expansions)

499

542

500

543

try:

501

544

command = self.checker_command % escaped_attrs

502

545

except TypeError as error:

548

591

raise

549

592

self.checker = None

550

593

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

640

551

641

def dbus_service_property(dbus_interface, signature="v",

552

642

access="readwrite", byte_arrays=False):

553

643

"""Decorators for marking methods of a DBusObjectWithProperties to

599

689

600

690

class DBusObjectWithProperties(dbus.service.Object):

601

691

"""A D-Bus object with properties.

602

692

603

693

Classes inheriting from this can use the dbus_service_property

604

694

decorator to expose methods as D-Bus properties. It exposes the

605

695

standard Get(), Set(), and GetAll() methods on the D-Bus.

612

702

def _get_all_dbus_properties(self):

613

703

"""Returns a generator of (name, attribute) pairs

614

704

"""

615

return ((prop._dbus_name, prop)

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

706

for cls in self.__class__.__mro__

616

707

for name, prop in

617

inspect.getmembers(self, self._is_dbus_property))

708

inspect.getmembers(cls, self._is_dbus_property))

618

709

619

710

def _get_dbus_property(self, interface_name, property_name):

620

711

"""Returns a bound method if one exists which is a D-Bus

621

712

property with the specified name and interface.

622

713

"""

623

for name in (property_name,

624

property_name + "_dbus_property"):

625

prop = getattr(self, name, None)

626

if (prop is None

627

or not self._is_dbus_property(prop)

628

or prop._dbus_name != property_name

629

or (interface_name and prop._dbus_interface

630

and interface_name != prop._dbus_interface)):

631

continue

632

return prop

714

for cls in self.__class__.__mro__:

715

for name, value in (inspect.getmembers

716

(cls, self._is_dbus_property)):

717

if (value._dbus_name == property_name

718

and value._dbus_interface == interface_name):

719

return value.__get__(self)

720

633

721

# No such property

634

722

raise DBusPropertyNotFound(self.dbus_object_path + ":"

635

723

+ interface_name + "."

669

757

def GetAll(self, interface_name):

670

758

"""Standard D-Bus property GetAll() method, see D-Bus

671

759

standard.

672

760

673

761

Note: Will not include properties with access="write".

674

762

"""

675

763

all = {}

737

825

return xmlstring

738

826

739

827

828

def datetime_to_dbus (dt, variant_level=0):

829

"""Convert a UTC datetime.datetime() to a D-Bus type."""

830

if dt is None:

831

return dbus.String("", variant_level = variant_level)

832

return dbus.String(dt.isoformat(),

833

variant_level=variant_level)

834

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

839

"""

840

def __new__(mcs, name, bases, attr):

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

847

# Ignore non-D-Bus attributes, and D-Bus attributes

848

# with the wrong interface name

849

if (not hasattr(attribute, "_dbus_interface")

850

or not attribute._dbus_interface

851

.startswith("se.recompile.Mandos")):

852

continue

853

# Create an alternate D-Bus interface name based on

854

# the current name

855

alt_interface = (attribute._dbus_interface

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

858

# Is this a D-Bus signal?

859

if getattr(attribute, "_dbus_is_signal", False):

860

# Extract the original non-method function by

861

# black magic

862

nonmethod_func = (dict(

863

zip(attribute.func_code.co_freevars,

864

attribute.__closure__))["func"]

865

.cell_contents)

866

# Create a new, but exactly alike, function

867

# object, and decorate it to be a new D-Bus signal

868

# with the alternate D-Bus interface name

869

new_function = (dbus.service.signal

870

(alt_interface,

871

attribute._dbus_signature)

872

(types.FunctionType(

873

nonmethod_func.func_code,

874

nonmethod_func.func_globals,

875

nonmethod_func.func_name,

876

nonmethod_func.func_defaults,

877

nonmethod_func.func_closure)))

878

# Define a creator of a function to call both the

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

881

def fixscope(func1, func2):

882

"""This function is a scope container to pass

883

func1 and func2 to the "call_both" function

884

outside of its arguments"""

885

def call_both(*args, **kwargs):

886

"""This function will emit two D-Bus

887

signals by calling func1 and func2"""

888

func1(*args, **kwargs)

889

func2(*args, **kwargs)

890

return call_both

891

# Create the "call_both" function and add it to

892

# the class

893

attr[attrname] = fixscope(attribute,

894

new_function)

895

# Is this a D-Bus method?

896

elif getattr(attribute, "_dbus_is_method", False):

897

# Create a new, but exactly alike, function

898

# object. Decorate it to be a new D-Bus method

899

# with the alternate D-Bus interface name. Add it

900

# to the class.

901

attr[attrname] = (dbus.service.method

902

(alt_interface,

903

attribute._dbus_in_signature,

904

attribute._dbus_out_signature)

905

(types.FunctionType

906

(attribute.func_code,

907

attribute.func_globals,

908

attribute.func_name,

909

attribute.func_defaults,

910

attribute.func_closure)))

911

# Is this a D-Bus property?

912

elif getattr(attribute, "_dbus_is_property", False):

913

# Create a new, but exactly alike, function

914

# object, and decorate it to be a new D-Bus

915

# property with the alternate D-Bus interface

916

# name. Add it to the class.

917

attr[attrname] = (dbus_service_property

918

(alt_interface,

919

attribute._dbus_signature,

920

attribute._dbus_access,

921

attribute

922

._dbus_get_args_options

923

["byte_arrays"])

924

(types.FunctionType

925

(attribute.func_code,

926

attribute.func_globals,

927

attribute.func_name,

928

attribute.func_defaults,

929

attribute.func_closure)))

930

return type.__new__(mcs, name, bases, attr)

931

740

932

class ClientDBus(Client, DBusObjectWithProperties):

741

933

"""A Client class using D-Bus

742

934

751

943

# dbus.service.Object doesn't use super(), so we can't either.

752

944

753

945

def __init__(self, bus = None, *args, **kwargs):

946

self.bus = bus

947

Client.__init__(self, *args, **kwargs)

948

754

949

self._approvals_pending = 0

755

self.bus = bus

756

Client.__init__(self, *args, **kwargs)

757

950

# Only now, when this client is initialized, can it show up on

758

951

# the D-Bus

759

952

client_object_name = unicode(self.name).translate(

764

957

DBusObjectWithProperties.__init__(self, self.bus,

765

958

self.dbus_object_path)

766

959

767

def _get_approvals_pending(self):

768

return self._approvals_pending

769

def _set_approvals_pending(self, value):

770

old_value = self._approvals_pending

771

self._approvals_pending = value

772

bval = bool(value)

773

if (hasattr(self, "dbus_object_path")

774

and bval is not bool(old_value)):

775

dbus_bool = dbus.Boolean(bval, variant_level=1)

776

self.PropertyChanged(dbus.String("ApprovalPending"),

777

dbus_bool)

960

def notifychangeproperty(transform_func,

961

dbus_name, type_func=lambda x: x,

962

variant_level=1):

963

""" Modify a variable so that it's a property which announces

964

its changes to DBus.

778

965

779

approvals_pending = property(_get_approvals_pending,

780

_set_approvals_pending)

781

del _get_approvals_pending, _set_approvals_pending

782

783

@staticmethod

784

def _datetime_to_dbus(dt, variant_level=0):

785

"""Convert a UTC datetime.datetime() to a D-Bus type."""

786

return dbus.String(dt.isoformat(),

787

variant_level=variant_level)

788

789

def enable(self):

790

oldstate = getattr(self, "enabled", False)

791

r = Client.enable(self)

792

if oldstate != self.enabled:

793

# Emit D-Bus signals

794

self.PropertyChanged(dbus.String("Enabled"),

795

dbus.Boolean(True, variant_level=1))

796

self.PropertyChanged(

797

dbus.String("LastEnabled"),

798

self._datetime_to_dbus(self.last_enabled,

799

variant_level=1))

800

return r

801

802

def disable(self, quiet = False):

803

oldstate = getattr(self, "enabled", False)

804

r = Client.disable(self, quiet=quiet)

805

if not quiet and oldstate != self.enabled:

806

# Emit D-Bus signal

807

self.PropertyChanged(dbus.String("Enabled"),

808

dbus.Boolean(False, variant_level=1))

809

return r

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

968

dbus_name: D-Bus name of the variable

969

type_func: Function that transform the value before sending it

970

to the D-Bus. Default: no transform

971

variant_level: D-Bus variant level. Default: 1

972

"""

973

attrname = "_{0}".format(dbus_name)

974

def setter(self, value):

975

if hasattr(self, "dbus_object_path"):

976

if (not hasattr(self, attrname) or

977

type_func(getattr(self, attrname, None))

978

!= type_func(value)):

979

dbus_value = transform_func(type_func(value),

980

variant_level

981

=variant_level)

982

self.PropertyChanged(dbus.String(dbus_name),

983

dbus_value)

984

setattr(self, attrname, value)

985

986

return property(lambda self: getattr(self, attrname), setter)

987

988

989

expires = notifychangeproperty(datetime_to_dbus, "Expires")

990

approvals_pending = notifychangeproperty(dbus.Boolean,

991

"ApprovalPending",

992

type_func = bool)

993

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

994

last_enabled = notifychangeproperty(datetime_to_dbus,

995

"LastEnabled")

996

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

997

type_func = lambda checker:

998

checker is not None)

999

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1000

"LastCheckedOK")

1001

last_approval_request = notifychangeproperty(

1002

datetime_to_dbus, "LastApprovalRequest")

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

1004

"ApprovedByDefault")

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1006

"ApprovalDelay",

1007

type_func =

1008

_timedelta_to_milliseconds)

1009

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

1012

host = notifychangeproperty(dbus.String, "Host")

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1014

type_func =

1015

_timedelta_to_milliseconds)

1016

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1020

"Interval",

1021

type_func =

1022

_timedelta_to_milliseconds)

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

1024

1025

del notifychangeproperty

810

1026

811

1027

def __del__(self, *args, **kwargs):

812

1028

try:

821

1037

*args, **kwargs):

822

1038

self.checker_callback_tag = None

823

1039

self.checker = None

824

# Emit D-Bus signal

825

self.PropertyChanged(dbus.String("CheckerRunning"),

826

dbus.Boolean(False, variant_level=1))

827

1040

if os.WIFEXITED(condition):

828

1041

exitstatus = os.WEXITSTATUS(condition)

829

1042

# Emit D-Bus signal

839

1052

return Client.checker_callback(self, pid, condition, command,

840

1053

*args, **kwargs)

841

1054

842

def checked_ok(self, *args, **kwargs):

843

Client.checked_ok(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastCheckedOK"),

847

(self._datetime_to_dbus(self.last_checked_ok,

848

variant_level=1)))

849

850

def need_approval(self, *args, **kwargs):

851

r = Client.need_approval(self, *args, **kwargs)

852

# Emit D-Bus signal

853

self.PropertyChanged(

854

dbus.String("LastApprovalRequest"),

855

(self._datetime_to_dbus(self.last_approval_request,

856

variant_level=1)))

857

return r

858

859

1055

def start_checker(self, *args, **kwargs):

860

1056

old_checker = self.checker

861

1057

if self.checker is not None:

868

1064

and old_checker_pid != self.checker.pid):

869

1065

# Emit D-Bus signal

870

1066

self.CheckerStarted(self.current_checker_command)

871

self.PropertyChanged(

872

dbus.String("CheckerRunning"),

873

dbus.Boolean(True, variant_level=1))

874

1067

return r

875

1068

876

def stop_checker(self, *args, **kwargs):

877

old_checker = getattr(self, "checker", None)

878

r = Client.stop_checker(self, *args, **kwargs)

879

if (old_checker is not None

880

and getattr(self, "checker", None) is None):

881

self.PropertyChanged(dbus.String("CheckerRunning"),

882

dbus.Boolean(False, variant_level=1))

883

return r

884

885

1069

def _reset_approved(self):

886

1070

self._approved = None

887

1071

return False

889

1073

def approve(self, value=True):

890

1074

self.send_changedstate()

891

1075

self._approved = value

892

gobject.timeout_add(self._timedelta_to_milliseconds

1076

gobject.timeout_add(_timedelta_to_milliseconds

893

1077

(self.approval_duration),

894

1078

self._reset_approved)

895

1079

896

1080

897

1081

## D-Bus methods, signals & properties

898

_interface = "se.bsnet.fukt.Mandos.Client"

1082

_interface = "se.recompile.Mandos.Client"

899

1083

900

1084

## Signals

901

1085

987

1171

if value is None: # get

988

1172

return dbus.Boolean(self.approved_by_default)

989

1173

self.approved_by_default = bool(value)

990

# Emit D-Bus signal

991

self.PropertyChanged(dbus.String("ApprovedByDefault"),

992

dbus.Boolean(value, variant_level=1))

993

1174

994

1175

# ApprovalDelay - property

995

1176

@dbus_service_property(_interface, signature="t",

998

1179

if value is None: # get

999

1180

return dbus.UInt64(self.approval_delay_milliseconds())

1000

1181

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1001

# Emit D-Bus signal

1002

self.PropertyChanged(dbus.String("ApprovalDelay"),

1003

dbus.UInt64(value, variant_level=1))

1004

1182

1005

1183

# ApprovalDuration - property

1006

1184

@dbus_service_property(_interface, signature="t",

1007

1185

access="readwrite")

1008

1186

def ApprovalDuration_dbus_property(self, value=None):

1009

1187

if value is None: # get

1010

return dbus.UInt64(self._timedelta_to_milliseconds(

1188

return dbus.UInt64(_timedelta_to_milliseconds(

1011

1189

self.approval_duration))

1012

1190

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1013

# Emit D-Bus signal

1014

self.PropertyChanged(dbus.String("ApprovalDuration"),

1015

dbus.UInt64(value, variant_level=1))

1016

1191

1017

1192

# Name - property

1018

1193

@dbus_service_property(_interface, signature="s", access="read")

1031

1206

if value is None: # get

1032

1207

return dbus.String(self.host)

1033

1208

self.host = value

1034

# Emit D-Bus signal

1035

self.PropertyChanged(dbus.String("Host"),

1036

dbus.String(value, variant_level=1))

1037

1209

1038

1210

# Created - property

1039

1211

@dbus_service_property(_interface, signature="s", access="read")

1040

1212

def Created_dbus_property(self):

1041

return dbus.String(self._datetime_to_dbus(self.created))

1213

return dbus.String(datetime_to_dbus(self.created))

1042

1214

1043

1215

# LastEnabled - property

1044

1216

@dbus_service_property(_interface, signature="s", access="read")

1045

1217

def LastEnabled_dbus_property(self):

1046

if self.last_enabled is None:

1047

return dbus.String("")

1048

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1218

return datetime_to_dbus(self.last_enabled)

1049

1219

1050

1220

# Enabled - property

1051

1221

@dbus_service_property(_interface, signature="b",

1065

1235

if value is not None:

1066

1236

self.checked_ok()

1067

1237

return

1068

if self.last_checked_ok is None:

1069

return dbus.String("")

1070

return dbus.String(self._datetime_to_dbus(self

1071

.last_checked_ok))

1238

return datetime_to_dbus(self.last_checked_ok)

1239

1240

# Expires - property

1241

@dbus_service_property(_interface, signature="s", access="read")

1242

def Expires_dbus_property(self):

1243

return datetime_to_dbus(self.expires)

1072

1244

1073

1245

# LastApprovalRequest - property

1074

1246

@dbus_service_property(_interface, signature="s", access="read")

1075

1247

def LastApprovalRequest_dbus_property(self):

1076

if self.last_approval_request is None:

1077

return dbus.String("")

1078

return dbus.String(self.

1079

_datetime_to_dbus(self

1080

.last_approval_request))

1248

return datetime_to_dbus(self.last_approval_request)

1081

1249

1082

1250

# Timeout - property

1083

1251

@dbus_service_property(_interface, signature="t",

1086

1254

if value is None: # get

1087

1255

return dbus.UInt64(self.timeout_milliseconds())

1088

1256

self.timeout = datetime.timedelta(0, 0, 0, value)

1089

# Emit D-Bus signal

1090

self.PropertyChanged(dbus.String("Timeout"),

1091

dbus.UInt64(value, variant_level=1))

1092

1257

if getattr(self, "disable_initiator_tag", None) is None:

1093

1258

return

1094

1259

# Reschedule timeout

1095

1260

gobject.source_remove(self.disable_initiator_tag)

1096

1261

self.disable_initiator_tag = None

1097

time_to_die = (self.

1098

_timedelta_to_milliseconds((self

1099

.last_checked_ok

1100

+ self.timeout)

1101

- datetime.datetime

1102

.utcnow()))

1262

self.expires = None

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1103

1268

if time_to_die <= 0:

1104

1269

# The timeout has passed

1105

1270

self.disable()

1106

1271

else:

1272

self.expires = (datetime.datetime.utcnow()

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1107

1275

self.disable_initiator_tag = (gobject.timeout_add

1108

1276

(time_to_die, self.disable))

1109

1277

1278

# ExtendedTimeout - property

1279

@dbus_service_property(_interface, signature="t",

1280

access="readwrite")

1281

def ExtendedTimeout_dbus_property(self, value=None):

1282

if value is None: # get

1283

return dbus.UInt64(self.extended_timeout_milliseconds())

1284

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1285

1110

1286

# Interval - property

1111

1287

@dbus_service_property(_interface, signature="t",

1112

1288

access="readwrite")

1114

1290

if value is None: # get

1115

1291

return dbus.UInt64(self.interval_milliseconds())

1116

1292

self.interval = datetime.timedelta(0, 0, 0, value)

1117

# Emit D-Bus signal

1118

self.PropertyChanged(dbus.String("Interval"),

1119

dbus.UInt64(value, variant_level=1))

1120

1293

if getattr(self, "checker_initiator_tag", None) is None:

1121

1294

return

1122

1295

# Reschedule checker run

1124

1297

self.checker_initiator_tag = (gobject.timeout_add

1125

1298

(value, self.start_checker))

1126

1299

self.start_checker() # Start one now, too

1127

1300

1128

1301

# Checker - property

1129

1302

@dbus_service_property(_interface, signature="s",

1130

1303

access="readwrite")

1132

1305

if value is None: # get

1133

1306

return dbus.String(self.checker_command)

1134

1307

self.checker_command = value

1135

# Emit D-Bus signal

1136

self.PropertyChanged(dbus.String("Checker"),

1137

dbus.String(self.checker_command,

1138

variant_level=1))

1139

1308

1140

1309

# CheckerRunning - property

1141

1310

@dbus_service_property(_interface, signature="b",

1168

1337

self._pipe.send(('init', fpr, address))

1169

1338

if not self._pipe.recv():

1170

1339

raise KeyError()

1171

1340

1172

1341

def __getattribute__(self, name):

1173

1342

if(name == '_pipe'):

1174

1343

return super(ProxyClient, self).__getattribute__(name)

1181

1350

self._pipe.send(('funcall', name, args, kwargs))

1182

1351

return self._pipe.recv()[1]

1183

1352

return func

1184

1353

1185

1354

def __setattr__(self, name, value):

1186

1355

if(name == '_pipe'):

1187

1356

return super(ProxyClient, self).__setattr__(name, value)

1188

1357

self._pipe.send(('setattr', name, value))

1189

1358

1359

class ClientDBusTransitional(ClientDBus):

1360

__metaclass__ = AlternateDBusNamesMetaclass

1190

1361

1191

1362

class ClientHandler(socketserver.BaseRequestHandler, object):

1192

1363

"""A class to handle client connections.

1200

1371

unicode(self.client_address))

1201

1372

logger.debug("Pipe FD: %d",

1202

1373

self.server.child_pipe.fileno())

1203

1374

1204

1375

session = (gnutls.connection

1205

1376

.ClientSession(self.request,

1206

1377

gnutls.connection

1207

1378

.X509Credentials()))

1208

1379

1209

1380

# Note: gnutls.connection.X509Credentials is really a

1210

1381

# generic GnuTLS certificate credentials object so long as

1211

1382

# no X.509 keys are added to it. Therefore, we can use it

1212

1383

# here despite using OpenPGP certificates.

1213

1384

1214

1385

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1215

1386

# "+AES-256-CBC", "+SHA1",

1216

1387

# "+COMP-NULL", "+CTYPE-OPENPGP",

1222

1393

(gnutls.library.functions

1223

1394

.gnutls_priority_set_direct(session._c_object,

1224

1395

priority, None))

1225

1396

1226

1397

# Start communication using the Mandos protocol

1227

1398

# Get protocol number

1228

1399

line = self.request.makefile().readline()

1233

1404

except (ValueError, IndexError, RuntimeError) as error:

1234

1405

logger.error("Unknown protocol version: %s", error)

1235

1406

return

1236

1407

1237

1408

# Start GnuTLS connection

1238

1409

try:

1239

1410

session.handshake()

1243

1414

# established. Just abandon the request.

1244

1415

return

1245

1416

logger.debug("Handshake succeeded")

1246

1417

1247

1418

approval_required = False

1248

1419

try:

1249

1420

try:

1254

1425

logger.warning("Bad certificate: %s", error)

1255

1426

return

1256

1427

logger.debug("Fingerprint: %s", fpr)

1257

1428

1258

1429

try:

1259

1430

client = ProxyClient(child_pipe, fpr,

1260

1431

self.client_address)

1272

1443

client.name)

1273

1444

if self.server.use_dbus:

1274

1445

# Emit D-Bus signal

1275

client.Rejected("Disabled")

1446

client.Rejected("Disabled")

1276

1447

return

1277

1448

1278

1449

if client._approved or not client.approval_delay:

1295

1466

return

1296

1467

1297

1468

#wait until timeout or approved

1298

#x = float(client._timedelta_to_milliseconds(delay))

1299

1469

time = datetime.datetime.now()

1300

1470

client.changedstate.acquire()

1301

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1471

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1473

/ 1000)))

1302

1474

client.changedstate.release()

1303

1475

time2 = datetime.datetime.now()

1304

1476

if (time2 - time) >= delay:

1326

1498

sent, len(client.secret)

1327

1499

- (sent_size + sent))

1328

1500

sent_size += sent

1329

1501

1330

1502

logger.info("Sending secret to %s", client.name)

1331

# bump the timeout as if seen

1332

client.checked_ok()

1503

# bump the timeout using extended_timeout

1504

client.checked_ok(client.extended_timeout)

1333

1505

if self.server.use_dbus:

1334

1506

# Emit D-Bus signal

1335

1507

client.GotSecret()

1414

1586

except:

1415

1587

self.handle_error(request, address)

1416

1588

self.close_request(request)

1417

1589

1418

1590

def process_request(self, request, address):

1419

1591

"""Start a new process to process the request."""

1420

multiprocessing.Process(target = self.sub_process_main,

1421

args = (request, address)).start()

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1593

args = (request,

1594

address))

1595

proc.start()

1596

return proc

1597

1422

1598

1423

1599

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1424

1600

""" adds a pipe to the MixIn """

1428

1604

This function creates a new pipe in self.pipe

1429

1605

"""

1430

1606

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1431

1432

super(MultiprocessingMixInWithPipe,

1433

self).process_request(request, client_address)

1607

1608

proc = MultiprocessingMixIn.process_request(self, request,

1609

client_address)

1434

1610

self.child_pipe.close()

1435

self.add_pipe(parent_pipe)

1436

1437

def add_pipe(self, parent_pipe):

1611

self.add_pipe(parent_pipe, proc)

1612

1613

def add_pipe(self, parent_pipe, proc):

1438

1614

"""Dummy function; override as necessary"""

1439

1615

raise NotImplementedError

1440

1616

1617

1441

1618

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1442

1619

socketserver.TCPServer, object):

1443

1620

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1517

1694

self.enabled = False

1518

1695

self.clients = clients

1519

1696

if self.clients is None:

1520

self.clients = set()

1697

self.clients = {}

1521

1698

self.use_dbus = use_dbus

1522

1699

self.gnutls_priority = gnutls_priority

1523

1700

IPv6_TCPServer.__init__(self, server_address,

1527

1704

def server_activate(self):

1528

1705

if self.enabled:

1529

1706

return socketserver.TCPServer.server_activate(self)

1707

1530

1708

def enable(self):

1531

1709

self.enabled = True

1532

def add_pipe(self, parent_pipe):

1710

1711

def add_pipe(self, parent_pipe, proc):

1533

1712

# Call "handle_ipc" for both data and EOF events

1534

1713

gobject.io_add_watch(parent_pipe.fileno(),

1535

1714

gobject.IO_IN | gobject.IO_HUP,

1536

1715

functools.partial(self.handle_ipc,

1537

parent_pipe = parent_pipe))

1538

1716

parent_pipe =

1717

parent_pipe,

1718

proc = proc))

1719

1539

1720

def handle_ipc(self, source, condition, parent_pipe=None,

1540

client_object=None):

1721

proc = None, client_object=None):

1541

1722

condition_names = {

1542

1723

gobject.IO_IN: "IN", # There is data to read.

1543

1724

gobject.IO_OUT: "OUT", # Data can be written (without

1552

1733

for cond, name in

1553

1734

condition_names.iteritems()

1554

1735

if cond & condition)

1555

# error or the other end of multiprocessing.Pipe has closed

1736

# error, or the other end of multiprocessing.Pipe has closed

1556

1737

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1738

# Wait for other process to exit

1739

proc.join()

1557

1740

return False

1558

1741

1559

1742

# Read a request from the child

1564

1747

fpr = request[1]

1565

1748

address = request[2]

1566

1749

1567

for c in self.clients:

1750

for c in self.clients.itervalues():

1568

1751

if c.fingerprint == fpr:

1569

1752

client = c

1570

1753

break

1573

1756

"dress: %s", fpr, address)

1574

1757

if self.use_dbus:

1575

1758

# Emit D-Bus signal

1576

mandos_dbus_service.ClientNotFound(fpr, address[0])

1759

mandos_dbus_service.ClientNotFound(fpr,

1760

address[0])

1577

1761

parent_pipe.send(False)

1578

1762

return False

1579

1763

1580

1764

gobject.io_add_watch(parent_pipe.fileno(),

1581

1765

gobject.IO_IN | gobject.IO_HUP,

1582

1766

functools.partial(self.handle_ipc,

1583

parent_pipe = parent_pipe,

1584

client_object = client))

1767

parent_pipe =

1768

parent_pipe,

1769

proc = proc,

1770

client_object =

1771

client))

1585

1772

parent_pipe.send(True)

1586

# remove the old hook in favor of the new above hook on same fileno

1773

# remove the old hook in favor of the new above hook on

1774

# same fileno

1587

1775

return False

1588

1776

if command == 'funcall':

1589

1777

funcname = request[1]

1590

1778

args = request[2]

1591

1779

kwargs = request[3]

1592

1780

1593

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1594

1781

parent_pipe.send(('data', getattr(client_object,

1782

funcname)(*args,

1783

**kwargs)))

1784

1595

1785

if command == 'getattr':

1596

1786

attrname = request[1]

1597

1787

if callable(client_object.__getattribute__(attrname)):

1598

1788

parent_pipe.send(('function',))

1599

1789

else:

1600

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1790

parent_pipe.send(('data', client_object

1791

.__getattribute__(attrname)))

1601

1792

1602

1793

if command == 'setattr':

1603

1794

attrname = request[1]

1604

1795

value = request[2]

1605

1796

setattr(client_object, attrname, value)

1606

1797

1607

1798

return True

1608

1799

1609

1800

1730

1921

" system bus interface")

1731

1922

parser.add_argument("--no-ipv6", action="store_false",

1732

1923

dest="use_ipv6", help="Do not use IPv6")

1924

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

1733

1928

options = parser.parse_args()

1734

1929

1735

1930

if options.check:

1770

1965

# options, if set.

1771

1966

for option in ("interface", "address", "port", "debug",

1772

1967

"priority", "servicename", "configdir",

1773

"use_dbus", "use_ipv6", "debuglevel"):

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1774

1969

value = getattr(options, option)

1775

1970

if value is not None:

1776

1971

server_settings[option] = value

1788

1983

debuglevel = server_settings["debuglevel"]

1789

1984

use_dbus = server_settings["use_dbus"]

1790

1985

use_ipv6 = server_settings["use_ipv6"]

1791

1986

1792

1987

if server_settings["servicename"] != "Mandos":

1793

1988

syslogger.setFormatter(logging.Formatter

1794

1989

('Mandos (%s) [%%(process)d]:'

1796

1991

% server_settings["servicename"]))

1797

1992

1798

1993

# Parse config file with clients

1799

client_defaults = { "timeout": "1h",

1800

"interval": "5m",

1994

client_defaults = { "timeout": "5m",

1995

"extended_timeout": "15m",

1996

"interval": "2m",

1801

1997

"checker": "fping -q -- %%(host)s",

1802

1998

"host": "",

1803

1999

"approval_delay": "0s",

1848

2044

raise error

1849

2045

1850

2046

if not debug and not debuglevel:

1851

syslogger.setLevel(logging.WARNING)

1852

console.setLevel(logging.WARNING)

2047

logger.setLevel(logging.WARNING)

1853

2048

if debuglevel:

1854

2049

level = getattr(logging, debuglevel.upper())

1855

syslogger.setLevel(level)

1856

console.setLevel(level)

1857

2050

logger.setLevel(level)

2051

1858

2052

if debug:

2053

logger.setLevel(logging.DEBUG)

1859

2054

# Enable all possible GnuTLS debugging

1860

2055

1861

2056

# "Use a log level over 10 to enable all debugging options."

1891

2086

# End of Avahi example code

1892

2087

if use_dbus:

1893

2088

try:

1894

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2089

bus_name = dbus.service.BusName("se.recompile.Mandos",

1895

2090

bus, do_not_queue=True)

2091

old_bus_name = (dbus.service.BusName

2092

("se.bsnet.fukt.Mandos", bus,

2093

do_not_queue=True))

1896

2094

except dbus.exceptions.NameExistsException as e:

1897

2095

logger.error(unicode(e) + ", disabling D-Bus")

1898

2096

use_dbus = False

1899

2097

server_settings["use_dbus"] = False

1900

2098

tcp_server.use_dbus = False

1901

2099

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1902

service = AvahiService(name = server_settings["servicename"],

1903

servicetype = "_mandos._tcp",

1904

protocol = protocol, bus = bus)

2100

service = AvahiServiceToSyslog(name =

2101

server_settings["servicename"],

2102

servicetype = "_mandos._tcp",

2103

protocol = protocol, bus = bus)

1905

2104

if server_settings["interface"]:

1906

2105

service.interface = (if_nametoindex

1907

2106

(str(server_settings["interface"])))

1911

2110

1912

2111

client_class = Client

1913

2112

if use_dbus:

1914

client_class = functools.partial(ClientDBus, bus = bus)

1915

def client_config_items(config, section):

1916

special_settings = {

1917

"approved_by_default":

1918

lambda: config.getboolean(section,

1919

"approved_by_default"),

1920

}

1921

for name, value in config.items(section):

2113

client_class = functools.partial(ClientDBusTransitional,

2114

bus = bus)

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2133

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2137

if server_settings["restore"]:

2138

try:

2139

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2141

os.remove(stored_state_path)

2142

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2145

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

1922

2156

try:

1923

yield (name, special_settings[name]())

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

1924

2162

except KeyError:

1925

yield (name, value)

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

1926

2209

1927

tcp_server.clients.update(set(

1928

client_class(name = section,

1929

config= dict(client_config_items(

1930

client_config, section)))

1931

for section in client_config.sections()))

2210

1932

2211

if not tcp_server.clients:

1933

2212

logger.warning("No clients defined")

1934

2213

1947

2226

del pidfilename

1948

2227

1949

2228

signal.signal(signal.SIGINT, signal.SIG_IGN)

1950

2229

1951

2230

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1952

2231

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1953

2232

1956

2235

"""A D-Bus proxy object"""

1957

2236

def __init__(self):

1958

2237

dbus.service.Object.__init__(self, bus, "/")

1959

_interface = "se.bsnet.fukt.Mandos"

2238

_interface = "se.recompile.Mandos"

1960

2239

1961

2240

@dbus.service.signal(_interface, signature="o")

1962

2241

def ClientAdded(self, objpath):

1977

2256

def GetAllClients(self):

1978

2257

"D-Bus method"

1979

2258

return dbus.Array(c.dbus_object_path

1980

for c in tcp_server.clients)

2259

for c in

2260

tcp_server.clients.itervalues())

1981

2261

1982

2262

@dbus.service.method(_interface,

1983

2263

out_signature="a{oa{sv}}")

1985

2265

"D-Bus method"

1986

2266

return dbus.Dictionary(

1987

2267

((c.dbus_object_path, c.GetAll(""))

1988

for c in tcp_server.clients),

2268

for c in tcp_server.clients.itervalues()),

1989

2269

signature="oa{sv}")

1990

2270

1991

2271

@dbus.service.method(_interface, in_signature="o")

1992

2272

def RemoveClient(self, object_path):

1993

2273

"D-Bus method"

1994

for c in tcp_server.clients:

2274

for c in tcp_server.clients.itervalues():

1995

2275

if c.dbus_object_path == object_path:

1996

tcp_server.clients.remove(c)

2276

del tcp_server.clients[c.name]

1997

2277

c.remove_from_connection()

1998

2278

# Don't signal anything except ClientRemoved

1999

2279

c.disable(quiet=True)

2004

2284

2005

2285

del _interface

2006

2286

2007

mandos_dbus_service = MandosDBusService()

2287

class MandosDBusServiceTransitional(MandosDBusService):

2288

__metaclass__ = AlternateDBusNamesMetaclass

2289

mandos_dbus_service = MandosDBusServiceTransitional()

2008

2290

2009

2291

def cleanup():

2010

2292

"Cleanup function; run on exit"

2011

2293

service.cleanup()

2012

2294

2295

multiprocessing.active_children()

2296

if not (tcp_server.clients or client_settings):

2297

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2321

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2323

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2329

# Delete all clients, and settings from config

2013

2330

while tcp_server.clients:

2014

client = tcp_server.clients.pop()

2331

name, client = tcp_server.clients.popitem()

2015

2332

if use_dbus:

2016

2333

client.remove_from_connection()

2017

client.disable_hook = None

2018

2334

# Don't signal anything except ClientRemoved

2019

2335

client.disable(quiet=True)

2020

2336

if use_dbus:

2021

2337

# Emit D-Bus signal

2022

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2338

mandos_dbus_service.ClientRemoved(client

2339

.dbus_object_path,

2023

2340

client.name)

2341

client_settings.clear()

2024

2342

2025

2343

atexit.register(cleanup)

2026

2344

2027

for client in tcp_server.clients:

2345

for client in tcp_server.clients.itervalues():

2028

2346

if use_dbus:

2029

2347

# Emit D-Bus signal

2030

2348

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2031

client.enable()

2349

# Need to initiate checking of clients

2350

if client.enabled:

2351

client.init_checker()

2352

2032

2353

2033

2354

tcp_server.enable()

2034

2355

tcp_server.server_activate()

2074

2395

# Must run before the D-Bus bus name gets deregistered

2075

2396

cleanup()

2076

2397

2398

2077

2399

if __name__ == '__main__':

2078

2400

main()