/mandos/trunk : revision 520

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

65

67

66

68

import dbus

67

69

import dbus.service

72

74

import ctypes.util

73

75

import xml.dom.minidom

74

76

import inspect

77

import Crypto.Cipher.AES

75

78

76

79

try:

77

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

85

SO_BINDTODEVICE = None

83

86

84

87

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

89

93

syslogger = (logging.handlers.SysLogHandler

90

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

95

address = str("/dev/log")))

95

99

logger.addHandler(syslogger)

96

100

97

101

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

99

104

' %(levelname)s:'

100

105

' %(message)s'))

101

106

logger.addHandler(console)

102

107

108

103

109

class AvahiError(Exception):

104

110

def __init__(self, value, *args, **kwargs):

105

111

self.value = value

159

165

" after %i retries, exiting.",

160

166

self.rename_count)

161

167

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

163

170

logger.info("Changing Zeroconf service name to %r ...",

164

171

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

172

self.remove()

170

173

try:

171

174

self.add()

191

194

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

195

self.entry_group_state_changed_match = (

193

196

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

197

'StateChanged', self.entry_group_state_changed))

195

198

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

196

199

self.name, self.type)

197

200

self.group.AddService(

263

266

self.server_state_changed)

264

267

self.server_state_changed(self.server.GetState())

265

268

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

266

278

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

267

285

class Client(object):

268

286

"""A representation of a client host served by this server.

269

287

281

299

instance %(name)s can be used in the command.

282

300

checker_initiator_tag: a gobject event source tag, or None

283

301

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

284

304

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

305

disable_initiator_tag: a gobject event source tag, or None

287

306

enabled: bool()

288

307

fingerprint: string (40 or 32 hexadecimal digits); used to

291

310

interval: datetime.timedelta(); How often to start a new checker

292

311

last_approval_request: datetime.datetime(); (UTC) or None

293

312

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

294

316

last_enabled: datetime.datetime(); (UTC)

295

317

name: string; from the config file, used in log messages and

296

318

D-Bus identifiers

308

330

"host", "interval", "last_checked_ok",

309

331

"last_enabled", "name", "timeout")

310

332

311

@staticmethod

312

def _timedelta_to_milliseconds(td):

313

"Convert a datetime.timedelta() to milliseconds"

314

return ((td.days * 24 * 60 * 60 * 1000)

315

+ (td.seconds * 1000)

316

+ (td.microseconds // 1000))

317

318

333

def timeout_milliseconds(self):

319

334

"Return the 'timeout' attribute in milliseconds"

320

return self._timedelta_to_milliseconds(self.timeout)

321

335

return _timedelta_to_milliseconds(self.timeout)

336

322

337

def extended_timeout_milliseconds(self):

323

338

"Return the 'extended_timeout' attribute in milliseconds"

324

return self._timedelta_to_milliseconds(self.extended_timeout)

339

return _timedelta_to_milliseconds(self.extended_timeout)

325

340

326

341

def interval_milliseconds(self):

327

342

"Return the 'interval' attribute in milliseconds"

328

return self._timedelta_to_milliseconds(self.interval)

329

343

return _timedelta_to_milliseconds(self.interval)

344

330

345

def approval_delay_milliseconds(self):

331

return self._timedelta_to_milliseconds(self.approval_delay)

346

return _timedelta_to_milliseconds(self.approval_delay)

332

347

333

def __init__(self, name = None, disable_hook=None, config=None):

348

def __init__(self, name = None, config=None):

334

349

"""Note: the 'checker' key in 'config' sets the

335

350

'checker_command' attribute and *not* the 'checker'

336

351

attribute."""

356

371

% self.name)

357

372

self.host = config.get("host", "")

358

373

self.created = datetime.datetime.utcnow()

359

self.enabled = False

374

self.enabled = True

360

375

self.last_approval_request = None

361

self.last_enabled = None

376

self.last_enabled = datetime.datetime.utcnow()

362

377

self.last_checked_ok = None

378

self.last_checker_status = None

363

379

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

365

382

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

367

383

self.checker = None

368

384

self.checker_initiator_tag = None

369

385

self.disable_initiator_tag = None

370

self.expires = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

371

387

self.checker_callback_tag = None

372

388

self.checker_command = config["checker"]

373

389

self.current_checker_command = None

374

self.last_connect = None

375

390

self._approved = None

376

391

self.approved_by_default = config.get("approved_by_default",

377

392

True)

380

395

config["approval_delay"])

381

396

self.approval_duration = string_to_delta(

382

397

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

384

409

410

# Send notice to process children that client state has changed

385

411

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

412

with self.changedstate:

413

self.changedstate.notify_all()

414

390

415

def enable(self):

391

416

"""Start this client's checker and timeout hooks"""

392

417

if getattr(self, "enabled", False):

393

418

# Already enabled

394

419

return

395

420

self.send_changedstate()

396

self.last_enabled = datetime.datetime.utcnow()

397

# Schedule a new checker to be started an 'interval' from now,

398

# and every interval from then on.

399

self.checker_initiator_tag = (gobject.timeout_add

400

(self.interval_milliseconds(),

401

self.start_checker))

402

# Schedule a disable() when 'timeout' has passed

403

421

self.expires = datetime.datetime.utcnow() + self.timeout

404

self.disable_initiator_tag = (gobject.timeout_add

405

(self.timeout_milliseconds(),

406

self.disable))

407

422

self.enabled = True

408

# Also start a new checker *right now*.

409

self.start_checker()

423

self.last_enabled = datetime.datetime.utcnow()

424

self.init_checker()

410

425

411

426

def disable(self, quiet=True):

412

427

"""Disable this client."""

424

439

gobject.source_remove(self.checker_initiator_tag)

425

440

self.checker_initiator_tag = None

426

441

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

429

442

self.enabled = False

430

443

# Do not run this again if called by a gobject.timeout_add

431

444

return False

432

445

433

446

def __del__(self):

434

self.disable_hook = None

435

447

self.disable()

436

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

437

463

def checker_callback(self, pid, condition, command):

438

464

"""The checker has completed, so take appropriate actions."""

439

465

self.checker_callback_tag = None

440

466

self.checker = None

441

467

if os.WIFEXITED(condition):

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

444

470

logger.info("Checker for %(name)s succeeded",

445

471

vars(self))

446

472

self.checked_ok()

448

474

logger.info("Checker for %(name)s failed",

449

475

vars(self))

450

476

else:

477

self.last_checker_status = -1

451

478

logger.warning("Checker for %(name)s crashed?",

452

479

vars(self))

453

480

460

487

if timeout is None:

461

488

timeout = self.timeout

462

489

self.last_checked_ok = datetime.datetime.utcnow()

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(self._timedelta_to_milliseconds(timeout),

467

self.disable))

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

468

497

469

498

def need_approval(self):

470

499

self.last_approval_request = datetime.datetime.utcnow()

510

539

'replace')))

511

540

for attr in

512

541

self.runtime_expansions)

513

542

514

543

try:

515

544

command = self.checker_command % escaped_attrs

516

545

except TypeError as error:

562

591

raise

563

592

self.checker = None

564

593

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

640

565

641

def dbus_service_property(dbus_interface, signature="v",

566

642

access="readwrite", byte_arrays=False):

567

643

"""Decorators for marking methods of a DBusObjectWithProperties to

613

689

614

690

class DBusObjectWithProperties(dbus.service.Object):

615

691

"""A D-Bus object with properties.

616

692

617

693

Classes inheriting from this can use the dbus_service_property

618

694

decorator to expose methods as D-Bus properties. It exposes the

619

695

standard Get(), Set(), and GetAll() methods on the D-Bus.

626

702

def _get_all_dbus_properties(self):

627

703

"""Returns a generator of (name, attribute) pairs

628

704

"""

629

return ((prop._dbus_name, prop)

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

706

for cls in self.__class__.__mro__

630

707

for name, prop in

631

inspect.getmembers(self, self._is_dbus_property))

708

inspect.getmembers(cls, self._is_dbus_property))

632

709

633

710

def _get_dbus_property(self, interface_name, property_name):

634

711

"""Returns a bound method if one exists which is a D-Bus

635

712

property with the specified name and interface.

636

713

"""

637

for name in (property_name,

638

property_name + "_dbus_property"):

639

prop = getattr(self, name, None)

640

if (prop is None

641

or not self._is_dbus_property(prop)

642

or prop._dbus_name != property_name

643

or (interface_name and prop._dbus_interface

644

and interface_name != prop._dbus_interface)):

645

continue

646

return prop

714

for cls in self.__class__.__mro__:

715

for name, value in (inspect.getmembers

716

(cls, self._is_dbus_property)):

717

if (value._dbus_name == property_name

718

and value._dbus_interface == interface_name):

719

return value.__get__(self)

720

647

721

# No such property

648

722

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

723

+ interface_name + "."

683

757

def GetAll(self, interface_name):

684

758

"""Standard D-Bus property GetAll() method, see D-Bus

685

759

standard.

686

760

687

761

Note: Will not include properties with access="write".

688

762

"""

689

763

all = {}

751

825

return xmlstring

752

826

753

827

828

def datetime_to_dbus (dt, variant_level=0):

829

"""Convert a UTC datetime.datetime() to a D-Bus type."""

830

if dt is None:

831

return dbus.String("", variant_level = variant_level)

832

return dbus.String(dt.isoformat(),

833

variant_level=variant_level)

834

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

839

"""

840

def __new__(mcs, name, bases, attr):

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

847

# Ignore non-D-Bus attributes, and D-Bus attributes

848

# with the wrong interface name

849

if (not hasattr(attribute, "_dbus_interface")

850

or not attribute._dbus_interface

851

.startswith("se.recompile.Mandos")):

852

continue

853

# Create an alternate D-Bus interface name based on

854

# the current name

855

alt_interface = (attribute._dbus_interface

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

858

# Is this a D-Bus signal?

859

if getattr(attribute, "_dbus_is_signal", False):

860

# Extract the original non-method function by

861

# black magic

862

nonmethod_func = (dict(

863

zip(attribute.func_code.co_freevars,

864

attribute.__closure__))["func"]

865

.cell_contents)

866

# Create a new, but exactly alike, function

867

# object, and decorate it to be a new D-Bus signal

868

# with the alternate D-Bus interface name

869

new_function = (dbus.service.signal

870

(alt_interface,

871

attribute._dbus_signature)

872

(types.FunctionType(

873

nonmethod_func.func_code,

874

nonmethod_func.func_globals,

875

nonmethod_func.func_name,

876

nonmethod_func.func_defaults,

877

nonmethod_func.func_closure)))

878

# Define a creator of a function to call both the

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

881

def fixscope(func1, func2):

882

"""This function is a scope container to pass

883

func1 and func2 to the "call_both" function

884

outside of its arguments"""

885

def call_both(*args, **kwargs):

886

"""This function will emit two D-Bus

887

signals by calling func1 and func2"""

888

func1(*args, **kwargs)

889

func2(*args, **kwargs)

890

return call_both

891

# Create the "call_both" function and add it to

892

# the class

893

attr[attrname] = fixscope(attribute,

894

new_function)

895

# Is this a D-Bus method?

896

elif getattr(attribute, "_dbus_is_method", False):

897

# Create a new, but exactly alike, function

898

# object. Decorate it to be a new D-Bus method

899

# with the alternate D-Bus interface name. Add it

900

# to the class.

901

attr[attrname] = (dbus.service.method

902

(alt_interface,

903

attribute._dbus_in_signature,

904

attribute._dbus_out_signature)

905

(types.FunctionType

906

(attribute.func_code,

907

attribute.func_globals,

908

attribute.func_name,

909

attribute.func_defaults,

910

attribute.func_closure)))

911

# Is this a D-Bus property?

912

elif getattr(attribute, "_dbus_is_property", False):

913

# Create a new, but exactly alike, function

914

# object, and decorate it to be a new D-Bus

915

# property with the alternate D-Bus interface

916

# name. Add it to the class.

917

attr[attrname] = (dbus_service_property

918

(alt_interface,

919

attribute._dbus_signature,

920

attribute._dbus_access,

921

attribute

922

._dbus_get_args_options

923

["byte_arrays"])

924

(types.FunctionType

925

(attribute.func_code,

926

attribute.func_globals,

927

attribute.func_name,

928

attribute.func_defaults,

929

attribute.func_closure)))

930

return type.__new__(mcs, name, bases, attr)

931

754

932

class ClientDBus(Client, DBusObjectWithProperties):

755

933

"""A Client class using D-Bus

756

934

765

943

# dbus.service.Object doesn't use super(), so we can't either.

766

944

767

945

def __init__(self, bus = None, *args, **kwargs):

946

self.bus = bus

947

Client.__init__(self, *args, **kwargs)

948

768

949

self._approvals_pending = 0

769

self.bus = bus

770

Client.__init__(self, *args, **kwargs)

771

950

# Only now, when this client is initialized, can it show up on

772

951

# the D-Bus

773

952

client_object_name = unicode(self.name).translate(

777

956

("/clients/" + client_object_name))

778

957

DBusObjectWithProperties.__init__(self, self.bus,

779

958

self.dbus_object_path)

780

def _set_expires(self, value):

781

old_value = getattr(self, "_expires", None)

782

self._expires = value

783

if hasattr(self, "dbus_object_path") and old_value != value:

784

dbus_time = (self._datetime_to_dbus(self._expires,

785

variant_level=1))

786

self.PropertyChanged(dbus.String("Expires"),

787

dbus_time)

788

expires = property(lambda self: self._expires, _set_expires)

789

del _set_expires

790

959

791

def _get_approvals_pending(self):

792

return self._approvals_pending

793

def _set_approvals_pending(self, value):

794

old_value = self._approvals_pending

795

self._approvals_pending = value

796

bval = bool(value)

797

if (hasattr(self, "dbus_object_path")

798

and bval is not bool(old_value)):

799

dbus_bool = dbus.Boolean(bval, variant_level=1)

800

self.PropertyChanged(dbus.String("ApprovalPending"),

801

dbus_bool)

960

def notifychangeproperty(transform_func,

961

dbus_name, type_func=lambda x: x,

962

variant_level=1):

963

""" Modify a variable so that it's a property which announces

964

its changes to DBus.

802

965

803

approvals_pending = property(_get_approvals_pending,

804

_set_approvals_pending)

805

del _get_approvals_pending, _set_approvals_pending

806

807

@staticmethod

808

def _datetime_to_dbus(dt, variant_level=0):

809

"""Convert a UTC datetime.datetime() to a D-Bus type."""

810

if dt is None:

811

return dbus.String("", variant_level = variant_level)

812

return dbus.String(dt.isoformat(),

813

variant_level=variant_level)

814

815

def enable(self):

816

oldstate = getattr(self, "enabled", False)

817

r = Client.enable(self)

818

if oldstate != self.enabled:

819

# Emit D-Bus signals

820

self.PropertyChanged(dbus.String("Enabled"),

821

dbus.Boolean(True, variant_level=1))

822

self.PropertyChanged(

823

dbus.String("LastEnabled"),

824

self._datetime_to_dbus(self.last_enabled,

825

variant_level=1))

826

return r

827

828

def disable(self, quiet = False):

829

oldstate = getattr(self, "enabled", False)

830

r = Client.disable(self, quiet=quiet)

831

if not quiet and oldstate != self.enabled:

832

# Emit D-Bus signal

833

self.PropertyChanged(dbus.String("Enabled"),

834

dbus.Boolean(False, variant_level=1))

835

return r

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

968

dbus_name: D-Bus name of the variable

969

type_func: Function that transform the value before sending it

970

to the D-Bus. Default: no transform

971

variant_level: D-Bus variant level. Default: 1

972

"""

973

attrname = "_{0}".format(dbus_name)

974

def setter(self, value):

975

if hasattr(self, "dbus_object_path"):

976

if (not hasattr(self, attrname) or

977

type_func(getattr(self, attrname, None))

978

!= type_func(value)):

979

dbus_value = transform_func(type_func(value),

980

variant_level

981

=variant_level)

982

self.PropertyChanged(dbus.String(dbus_name),

983

dbus_value)

984

setattr(self, attrname, value)

985

986

return property(lambda self: getattr(self, attrname), setter)

987

988

989

expires = notifychangeproperty(datetime_to_dbus, "Expires")

990

approvals_pending = notifychangeproperty(dbus.Boolean,

991

"ApprovalPending",

992

type_func = bool)

993

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

994

last_enabled = notifychangeproperty(datetime_to_dbus,

995

"LastEnabled")

996

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

997

type_func = lambda checker:

998

checker is not None)

999

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1000

"LastCheckedOK")

1001

last_approval_request = notifychangeproperty(

1002

datetime_to_dbus, "LastApprovalRequest")

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

1004

"ApprovedByDefault")

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1006

"ApprovalDelay",

1007

type_func =

1008

_timedelta_to_milliseconds)

1009

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

1012

host = notifychangeproperty(dbus.String, "Host")

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1014

type_func =

1015

_timedelta_to_milliseconds)

1016

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1020

"Interval",

1021

type_func =

1022

_timedelta_to_milliseconds)

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

1024

1025

del notifychangeproperty

836

1026

837

1027

def __del__(self, *args, **kwargs):

838

1028

try:

847

1037

*args, **kwargs):

848

1038

self.checker_callback_tag = None

849

1039

self.checker = None

850

# Emit D-Bus signal

851

self.PropertyChanged(dbus.String("CheckerRunning"),

852

dbus.Boolean(False, variant_level=1))

853

1040

if os.WIFEXITED(condition):

854

1041

exitstatus = os.WEXITSTATUS(condition)

855

1042

# Emit D-Bus signal

865

1052

return Client.checker_callback(self, pid, condition, command,

866

1053

*args, **kwargs)

867

1054

868

def checked_ok(self, *args, **kwargs):

869

Client.checked_ok(self, *args, **kwargs)

870

# Emit D-Bus signal

871

self.PropertyChanged(

872

dbus.String("LastCheckedOK"),

873

(self._datetime_to_dbus(self.last_checked_ok,

874

variant_level=1)))

875

876

def need_approval(self, *args, **kwargs):

877

r = Client.need_approval(self, *args, **kwargs)

878

# Emit D-Bus signal

879

self.PropertyChanged(

880

dbus.String("LastApprovalRequest"),

881

(self._datetime_to_dbus(self.last_approval_request,

882

variant_level=1)))

883

return r

884

885

1055

def start_checker(self, *args, **kwargs):

886

1056

old_checker = self.checker

887

1057

if self.checker is not None:

894

1064

and old_checker_pid != self.checker.pid):

895

1065

# Emit D-Bus signal

896

1066

self.CheckerStarted(self.current_checker_command)

897

self.PropertyChanged(

898

dbus.String("CheckerRunning"),

899

dbus.Boolean(True, variant_level=1))

900

1067

return r

901

1068

902

def stop_checker(self, *args, **kwargs):

903

old_checker = getattr(self, "checker", None)

904

r = Client.stop_checker(self, *args, **kwargs)

905

if (old_checker is not None

906

and getattr(self, "checker", None) is None):

907

self.PropertyChanged(dbus.String("CheckerRunning"),

908

dbus.Boolean(False, variant_level=1))

909

return r

910

911

1069

def _reset_approved(self):

912

1070

self._approved = None

913

1071

return False

915

1073

def approve(self, value=True):

916

1074

self.send_changedstate()

917

1075

self._approved = value

918

gobject.timeout_add(self._timedelta_to_milliseconds

1076

gobject.timeout_add(_timedelta_to_milliseconds

919

1077

(self.approval_duration),

920

1078

self._reset_approved)

921

1079

922

1080

923

1081

## D-Bus methods, signals & properties

924

_interface = "se.bsnet.fukt.Mandos.Client"

1082

_interface = "se.recompile.Mandos.Client"

925

1083

926

1084

## Signals

927

1085

1012

1170

def ApprovedByDefault_dbus_property(self, value=None):

1013

1171

if value is None: # get

1014

1172

return dbus.Boolean(self.approved_by_default)

1015

old_value = self.approved_by_default

1016

1173

self.approved_by_default = bool(value)

1017

# Emit D-Bus signal

1018

if old_value != self.approved_by_default:

1019

self.PropertyChanged(dbus.String("ApprovedByDefault"),

1020

dbus.Boolean(value, variant_level=1))

1021

1174

1022

1175

# ApprovalDelay - property

1023

1176

@dbus_service_property(_interface, signature="t",

1025

1178

def ApprovalDelay_dbus_property(self, value=None):

1026

1179

if value is None: # get

1027

1180

return dbus.UInt64(self.approval_delay_milliseconds())

1028

old_value = self.approval_delay

1029

1181

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1030

# Emit D-Bus signal

1031

if old_value != self.approval_delay:

1032

self.PropertyChanged(dbus.String("ApprovalDelay"),

1033

dbus.UInt64(value, variant_level=1))

1034

1182

1035

1183

# ApprovalDuration - property

1036

1184

@dbus_service_property(_interface, signature="t",

1037

1185

access="readwrite")

1038

1186

def ApprovalDuration_dbus_property(self, value=None):

1039

1187

if value is None: # get

1040

return dbus.UInt64(self._timedelta_to_milliseconds(

1188

return dbus.UInt64(_timedelta_to_milliseconds(

1041

1189

self.approval_duration))

1042

old_value = self.approval_duration

1043

1190

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1044

# Emit D-Bus signal

1045

if old_value != self.approval_duration:

1046

self.PropertyChanged(dbus.String("ApprovalDuration"),

1047

dbus.UInt64(value, variant_level=1))

1048

1191

1049

1192

# Name - property

1050

1193

@dbus_service_property(_interface, signature="s", access="read")

1062

1205

def Host_dbus_property(self, value=None):

1063

1206

if value is None: # get

1064

1207

return dbus.String(self.host)

1065

old_value = self.host

1066

1208

self.host = value

1067

# Emit D-Bus signal

1068

if old_value != self.host:

1069

self.PropertyChanged(dbus.String("Host"),

1070

dbus.String(value, variant_level=1))

1071

1209

1072

1210

# Created - property

1073

1211

@dbus_service_property(_interface, signature="s", access="read")

1074

1212

def Created_dbus_property(self):

1075

return dbus.String(self._datetime_to_dbus(self.created))

1213

return dbus.String(datetime_to_dbus(self.created))

1076

1214

1077

1215

# LastEnabled - property

1078

1216

@dbus_service_property(_interface, signature="s", access="read")

1079

1217

def LastEnabled_dbus_property(self):

1080

return self._datetime_to_dbus(self.last_enabled)

1218

return datetime_to_dbus(self.last_enabled)

1081

1219

1082

1220

# Enabled - property

1083

1221

@dbus_service_property(_interface, signature="b",

1097

1235

if value is not None:

1098

1236

self.checked_ok()

1099

1237

return

1100

return self._datetime_to_dbus(self.last_checked_ok)

1238

return datetime_to_dbus(self.last_checked_ok)

1101

1239

1102

1240

# Expires - property

1103

1241

@dbus_service_property(_interface, signature="s", access="read")

1104

1242

def Expires_dbus_property(self):

1105

return self._datetime_to_dbus(self.expires)

1243

return datetime_to_dbus(self.expires)

1106

1244

1107

1245

# LastApprovalRequest - property

1108

1246

@dbus_service_property(_interface, signature="s", access="read")

1109

1247

def LastApprovalRequest_dbus_property(self):

1110

return self._datetime_to_dbus(self.last_approval_request)

1248

return datetime_to_dbus(self.last_approval_request)

1111

1249

1112

1250

# Timeout - property

1113

1251

@dbus_service_property(_interface, signature="t",

1115

1253

def Timeout_dbus_property(self, value=None):

1116

1254

if value is None: # get

1117

1255

return dbus.UInt64(self.timeout_milliseconds())

1118

old_value = self.timeout

1119

1256

self.timeout = datetime.timedelta(0, 0, 0, value)

1120

# Emit D-Bus signal

1121

if old_value != self.timeout:

1122

self.PropertyChanged(dbus.String("Timeout"),

1123

dbus.UInt64(value, variant_level=1))

1124

1257

if getattr(self, "disable_initiator_tag", None) is None:

1125

1258

return

1126

1259

# Reschedule timeout

1127

1260

gobject.source_remove(self.disable_initiator_tag)

1128

1261

self.disable_initiator_tag = None

1129

1262

self.expires = None

1130

time_to_die = (self.

1131

_timedelta_to_milliseconds((self

1132

.last_checked_ok

1133

+ self.timeout)

1134

- datetime.datetime

1135

.utcnow()))

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1136

1268

if time_to_die <= 0:

1137

1269

# The timeout has passed

1138

1270

self.disable()

1139

1271

else:

1140

1272

self.expires = (datetime.datetime.utcnow()

1141

+ datetime.timedelta(milliseconds = time_to_die))

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1142

1275

self.disable_initiator_tag = (gobject.timeout_add

1143

1276

(time_to_die, self.disable))

1144

1277

1145

1278

# ExtendedTimeout - property

1146

1279

@dbus_service_property(_interface, signature="t",

1147

1280

access="readwrite")

1148

1281

def ExtendedTimeout_dbus_property(self, value=None):

1149

1282

if value is None: # get

1150

1283

return dbus.UInt64(self.extended_timeout_milliseconds())

1151

old_value = self.extended_timeout

1152

1284

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1153

# Emit D-Bus signal

1154

if old_value != self.extended_timeout:

1155

self.PropertyChanged(dbus.String("ExtendedTimeout"),

1156

dbus.UInt64(value, variant_level=1))

1157

1285

1158

1286

# Interval - property

1159

1287

@dbus_service_property(_interface, signature="t",

1160

1288

access="readwrite")

1161

1289

def Interval_dbus_property(self, value=None):

1162

1290

if value is None: # get

1163

1291

return dbus.UInt64(self.interval_milliseconds())

1164

old_value = self.interval

1165

1292

self.interval = datetime.timedelta(0, 0, 0, value)

1166

# Emit D-Bus signal

1167

if old_value != self.interval:

1168

self.PropertyChanged(dbus.String("Interval"),

1169

dbus.UInt64(value, variant_level=1))

1170

1293

if getattr(self, "checker_initiator_tag", None) is None:

1171

1294

return

1172

1295

# Reschedule checker run

1174

1297

self.checker_initiator_tag = (gobject.timeout_add

1175

1298

(value, self.start_checker))

1176

1299

self.start_checker() # Start one now, too

1177

1300

1178

1301

# Checker - property

1179

1302

@dbus_service_property(_interface, signature="s",

1180

1303

access="readwrite")

1181

1304

def Checker_dbus_property(self, value=None):

1182

1305

if value is None: # get

1183

1306

return dbus.String(self.checker_command)

1184

old_value = self.checker_command

1185

1307

self.checker_command = value

1186

# Emit D-Bus signal

1187

if old_value != self.checker_command:

1188

self.PropertyChanged(dbus.String("Checker"),

1189

dbus.String(self.checker_command,

1190

variant_level=1))

1191

1308

1192

1309

# CheckerRunning - property

1193

1310

@dbus_service_property(_interface, signature="b",

1220

1337

self._pipe.send(('init', fpr, address))

1221

1338

if not self._pipe.recv():

1222

1339

raise KeyError()

1223

1340

1224

1341

def __getattribute__(self, name):

1225

1342

if(name == '_pipe'):

1226

1343

return super(ProxyClient, self).__getattribute__(name)

1233

1350

self._pipe.send(('funcall', name, args, kwargs))

1234

1351

return self._pipe.recv()[1]

1235

1352

return func

1236

1353

1237

1354

def __setattr__(self, name, value):

1238

1355

if(name == '_pipe'):

1239

1356

return super(ProxyClient, self).__setattr__(name, value)

1240

1357

self._pipe.send(('setattr', name, value))

1241

1358

1359

class ClientDBusTransitional(ClientDBus):

1360

__metaclass__ = AlternateDBusNamesMetaclass

1242

1361

1243

1362

class ClientHandler(socketserver.BaseRequestHandler, object):

1244

1363

"""A class to handle client connections.

1252

1371

unicode(self.client_address))

1253

1372

logger.debug("Pipe FD: %d",

1254

1373

self.server.child_pipe.fileno())

1255

1374

1256

1375

session = (gnutls.connection

1257

1376

.ClientSession(self.request,

1258

1377

gnutls.connection

1259

1378

.X509Credentials()))

1260

1379

1261

1380

# Note: gnutls.connection.X509Credentials is really a

1262

1381

# generic GnuTLS certificate credentials object so long as

1263

1382

# no X.509 keys are added to it. Therefore, we can use it

1264

1383

# here despite using OpenPGP certificates.

1265

1384

1266

1385

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1267

1386

# "+AES-256-CBC", "+SHA1",

1268

1387

# "+COMP-NULL", "+CTYPE-OPENPGP",

1274

1393

(gnutls.library.functions

1275

1394

.gnutls_priority_set_direct(session._c_object,

1276

1395

priority, None))

1277

1396

1278

1397

# Start communication using the Mandos protocol

1279

1398

# Get protocol number

1280

1399

line = self.request.makefile().readline()

1285

1404

except (ValueError, IndexError, RuntimeError) as error:

1286

1405

logger.error("Unknown protocol version: %s", error)

1287

1406

return

1288

1407

1289

1408

# Start GnuTLS connection

1290

1409

try:

1291

1410

session.handshake()

1295

1414

# established. Just abandon the request.

1296

1415

return

1297

1416

logger.debug("Handshake succeeded")

1298

1417

1299

1418

approval_required = False

1300

1419

try:

1301

1420

try:

1306

1425

logger.warning("Bad certificate: %s", error)

1307

1426

return

1308

1427

logger.debug("Fingerprint: %s", fpr)

1309

1428

1310

1429

try:

1311

1430

client = ProxyClient(child_pipe, fpr,

1312

1431

self.client_address)

1324

1443

client.name)

1325

1444

if self.server.use_dbus:

1326

1445

# Emit D-Bus signal

1327

client.Rejected("Disabled")

1446

client.Rejected("Disabled")

1328

1447

return

1329

1448

1330

1449

if client._approved or not client.approval_delay:

1347

1466

return

1348

1467

1349

1468

#wait until timeout or approved

1350

#x = float(client._timedelta_to_milliseconds(delay))

1351

1469

time = datetime.datetime.now()

1352

1470

client.changedstate.acquire()

1353

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1471

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1473

/ 1000)))

1354

1474

client.changedstate.release()

1355

1475

time2 = datetime.datetime.now()

1356

1476

if (time2 - time) >= delay:

1378

1498

sent, len(client.secret)

1379

1499

- (sent_size + sent))

1380

1500

sent_size += sent

1381

1501

1382

1502

logger.info("Sending secret to %s", client.name)

1383

# bump the timeout as if seen

1503

# bump the timeout using extended_timeout

1384

1504

client.checked_ok(client.extended_timeout)

1385

1505

if self.server.use_dbus:

1386

1506

# Emit D-Bus signal

1466

1586

except:

1467

1587

self.handle_error(request, address)

1468

1588

self.close_request(request)

1469

1589

1470

1590

def process_request(self, request, address):

1471

1591

"""Start a new process to process the request."""

1472

multiprocessing.Process(target = self.sub_process_main,

1473

args = (request, address)).start()

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1593

args = (request,

1594

address))

1595

proc.start()

1596

return proc

1597

1474

1598

1475

1599

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1476

1600

""" adds a pipe to the MixIn """

1480

1604

This function creates a new pipe in self.pipe

1481

1605

"""

1482

1606

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1483

1484

super(MultiprocessingMixInWithPipe,

1485

self).process_request(request, client_address)

1607

1608

proc = MultiprocessingMixIn.process_request(self, request,

1609

client_address)

1486

1610

self.child_pipe.close()

1487

self.add_pipe(parent_pipe)

1488

1489

def add_pipe(self, parent_pipe):

1611

self.add_pipe(parent_pipe, proc)

1612

1613

def add_pipe(self, parent_pipe, proc):

1490

1614

"""Dummy function; override as necessary"""

1491

1615

raise NotImplementedError

1492

1616

1617

1493

1618

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1494

1619

socketserver.TCPServer, object):

1495

1620

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1569

1694

self.enabled = False

1570

1695

self.clients = clients

1571

1696

if self.clients is None:

1572

self.clients = set()

1697

self.clients = {}

1573

1698

self.use_dbus = use_dbus

1574

1699

self.gnutls_priority = gnutls_priority

1575

1700

IPv6_TCPServer.__init__(self, server_address,

1579

1704

def server_activate(self):

1580

1705

if self.enabled:

1581

1706

return socketserver.TCPServer.server_activate(self)

1707

1582

1708

def enable(self):

1583

1709

self.enabled = True

1584

def add_pipe(self, parent_pipe):

1710

1711

def add_pipe(self, parent_pipe, proc):

1585

1712

# Call "handle_ipc" for both data and EOF events

1586

1713

gobject.io_add_watch(parent_pipe.fileno(),

1587

1714

gobject.IO_IN | gobject.IO_HUP,

1588

1715

functools.partial(self.handle_ipc,

1589

parent_pipe = parent_pipe))

1590

1716

parent_pipe =

1717

parent_pipe,

1718

proc = proc))

1719

1591

1720

def handle_ipc(self, source, condition, parent_pipe=None,

1592

client_object=None):

1721

proc = None, client_object=None):

1593

1722

condition_names = {

1594

1723

gobject.IO_IN: "IN", # There is data to read.

1595

1724

gobject.IO_OUT: "OUT", # Data can be written (without

1604

1733

for cond, name in

1605

1734

condition_names.iteritems()

1606

1735

if cond & condition)

1607

# error or the other end of multiprocessing.Pipe has closed

1736

# error, or the other end of multiprocessing.Pipe has closed

1608

1737

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1738

# Wait for other process to exit

1739

proc.join()

1609

1740

return False

1610

1741

1611

1742

# Read a request from the child

1616

1747

fpr = request[1]

1617

1748

address = request[2]

1618

1749

1619

for c in self.clients:

1750

for c in self.clients.itervalues():

1620

1751

if c.fingerprint == fpr:

1621

1752

client = c

1622

1753

break

1625

1756

"dress: %s", fpr, address)

1626

1757

if self.use_dbus:

1627

1758

# Emit D-Bus signal

1628

mandos_dbus_service.ClientNotFound(fpr, address[0])

1759

mandos_dbus_service.ClientNotFound(fpr,

1760

address[0])

1629

1761

parent_pipe.send(False)

1630

1762

return False

1631

1763

1632

1764

gobject.io_add_watch(parent_pipe.fileno(),

1633

1765

gobject.IO_IN | gobject.IO_HUP,

1634

1766

functools.partial(self.handle_ipc,

1635

parent_pipe = parent_pipe,

1636

client_object = client))

1767

parent_pipe =

1768

parent_pipe,

1769

proc = proc,

1770

client_object =

1771

client))

1637

1772

parent_pipe.send(True)

1638

# remove the old hook in favor of the new above hook on same fileno

1773

# remove the old hook in favor of the new above hook on

1774

# same fileno

1639

1775

return False

1640

1776

if command == 'funcall':

1641

1777

funcname = request[1]

1642

1778

args = request[2]

1643

1779

kwargs = request[3]

1644

1780

1645

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1646

1781

parent_pipe.send(('data', getattr(client_object,

1782

funcname)(*args,

1783

**kwargs)))

1784

1647

1785

if command == 'getattr':

1648

1786

attrname = request[1]

1649

1787

if callable(client_object.__getattribute__(attrname)):

1650

1788

parent_pipe.send(('function',))

1651

1789

else:

1652

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1790

parent_pipe.send(('data', client_object

1791

.__getattribute__(attrname)))

1653

1792

1654

1793

if command == 'setattr':

1655

1794

attrname = request[1]

1656

1795

value = request[2]

1657

1796

setattr(client_object, attrname, value)

1658

1797

1659

1798

return True

1660

1799

1661

1800

1782

1921

" system bus interface")

1783

1922

parser.add_argument("--no-ipv6", action="store_false",

1784

1923

dest="use_ipv6", help="Do not use IPv6")

1924

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

1785

1928

options = parser.parse_args()

1786

1929

1787

1930

if options.check:

1822

1965

# options, if set.

1823

1966

for option in ("interface", "address", "port", "debug",

1824

1967

"priority", "servicename", "configdir",

1825

"use_dbus", "use_ipv6", "debuglevel"):

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1826

1969

value = getattr(options, option)

1827

1970

if value is not None:

1828

1971

server_settings[option] = value

1840

1983

debuglevel = server_settings["debuglevel"]

1841

1984

use_dbus = server_settings["use_dbus"]

1842

1985

use_ipv6 = server_settings["use_ipv6"]

1843

1986

1844

1987

if server_settings["servicename"] != "Mandos":

1845

1988

syslogger.setFormatter(logging.Formatter

1846

1989

('Mandos (%s) [%%(process)d]:'

1901

2044

raise error

1902

2045

1903

2046

if not debug and not debuglevel:

1904

syslogger.setLevel(logging.WARNING)

1905

console.setLevel(logging.WARNING)

2047

logger.setLevel(logging.WARNING)

1906

2048

if debuglevel:

1907

2049

level = getattr(logging, debuglevel.upper())

1908

syslogger.setLevel(level)

1909

console.setLevel(level)

1910

2050

logger.setLevel(level)

2051

1911

2052

if debug:

2053

logger.setLevel(logging.DEBUG)

1912

2054

# Enable all possible GnuTLS debugging

1913

2055

1914

2056

# "Use a log level over 10 to enable all debugging options."

1944

2086

# End of Avahi example code

1945

2087

if use_dbus:

1946

2088

try:

1947

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2089

bus_name = dbus.service.BusName("se.recompile.Mandos",

1948

2090

bus, do_not_queue=True)

2091

old_bus_name = (dbus.service.BusName

2092

("se.bsnet.fukt.Mandos", bus,

2093

do_not_queue=True))

1949

2094

except dbus.exceptions.NameExistsException as e:

1950

2095

logger.error(unicode(e) + ", disabling D-Bus")

1951

2096

use_dbus = False

1952

2097

server_settings["use_dbus"] = False

1953

2098

tcp_server.use_dbus = False

1954

2099

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1955

service = AvahiService(name = server_settings["servicename"],

1956

servicetype = "_mandos._tcp",

1957

protocol = protocol, bus = bus)

2100

service = AvahiServiceToSyslog(name =

2101

server_settings["servicename"],

2102

servicetype = "_mandos._tcp",

2103

protocol = protocol, bus = bus)

1958

2104

if server_settings["interface"]:

1959

2105

service.interface = (if_nametoindex

1960

2106

(str(server_settings["interface"])))

1964

2110

1965

2111

client_class = Client

1966

2112

if use_dbus:

1967

client_class = functools.partial(ClientDBus, bus = bus)

1968

def client_config_items(config, section):

1969

special_settings = {

1970

"approved_by_default":

1971

lambda: config.getboolean(section,

1972

"approved_by_default"),

1973

}

1974

for name, value in config.items(section):

2113

client_class = functools.partial(ClientDBusTransitional,

2114

bus = bus)

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2133

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2137

if server_settings["restore"]:

2138

try:

2139

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2141

os.remove(stored_state_path)

2142

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2145

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

1975

2156

try:

1976

yield (name, special_settings[name]())

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

1977

2162

except KeyError:

1978

yield (name, value)

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

1979

2209

1980

tcp_server.clients.update(set(

1981

client_class(name = section,

1982

config= dict(client_config_items(

1983

client_config, section)))

1984

for section in client_config.sections()))

2210

1985

2211

if not tcp_server.clients:

1986

2212

logger.warning("No clients defined")

1987

2213

2000

2226

del pidfilename

2001

2227

2002

2228

signal.signal(signal.SIGINT, signal.SIG_IGN)

2003

2229

2004

2230

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2005

2231

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2006

2232

2009

2235

"""A D-Bus proxy object"""

2010

2236

def __init__(self):

2011

2237

dbus.service.Object.__init__(self, bus, "/")

2012

_interface = "se.bsnet.fukt.Mandos"

2238

_interface = "se.recompile.Mandos"

2013

2239

2014

2240

@dbus.service.signal(_interface, signature="o")

2015

2241

def ClientAdded(self, objpath):

2030

2256

def GetAllClients(self):

2031

2257

"D-Bus method"

2032

2258

return dbus.Array(c.dbus_object_path

2033

for c in tcp_server.clients)

2259

for c in

2260

tcp_server.clients.itervalues())

2034

2261

2035

2262

@dbus.service.method(_interface,

2036

2263

out_signature="a{oa{sv}}")

2038

2265

"D-Bus method"

2039

2266

return dbus.Dictionary(

2040

2267

((c.dbus_object_path, c.GetAll(""))

2041

for c in tcp_server.clients),

2268

for c in tcp_server.clients.itervalues()),

2042

2269

signature="oa{sv}")

2043

2270

2044

2271

@dbus.service.method(_interface, in_signature="o")

2045

2272

def RemoveClient(self, object_path):

2046

2273

"D-Bus method"

2047

for c in tcp_server.clients:

2274

for c in tcp_server.clients.itervalues():

2048

2275

if c.dbus_object_path == object_path:

2049

tcp_server.clients.remove(c)

2276

del tcp_server.clients[c.name]

2050

2277

c.remove_from_connection()

2051

2278

# Don't signal anything except ClientRemoved

2052

2279

c.disable(quiet=True)

2057

2284

2058

2285

del _interface

2059

2286

2060

mandos_dbus_service = MandosDBusService()

2287

class MandosDBusServiceTransitional(MandosDBusService):

2288

__metaclass__ = AlternateDBusNamesMetaclass

2289

mandos_dbus_service = MandosDBusServiceTransitional()

2061

2290

2062

2291

def cleanup():

2063

2292

"Cleanup function; run on exit"

2064

2293

service.cleanup()

2065

2294

2295

multiprocessing.active_children()

2296

if not (tcp_server.clients or client_settings):

2297

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2321

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2323

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2329

# Delete all clients, and settings from config

2066

2330

while tcp_server.clients:

2067

client = tcp_server.clients.pop()

2331

name, client = tcp_server.clients.popitem()

2068

2332

if use_dbus:

2069

2333

client.remove_from_connection()

2070

client.disable_hook = None

2071

2334

# Don't signal anything except ClientRemoved

2072

2335

client.disable(quiet=True)

2073

2336

if use_dbus:

2074

2337

# Emit D-Bus signal

2075

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2338

mandos_dbus_service.ClientRemoved(client

2339

.dbus_object_path,

2076

2340

client.name)

2341

client_settings.clear()

2077

2342

2078

2343

atexit.register(cleanup)

2079

2344

2080

for client in tcp_server.clients:

2345

for client in tcp_server.clients.itervalues():

2081

2346

if use_dbus:

2082

2347

# Emit D-Bus signal

2083

2348

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2084

client.enable()

2349

# Need to initiate checking of clients

2350

if client.enabled:

2351

client.init_checker()

2352

2085

2353

2086

2354

tcp_server.enable()

2087

2355

tcp_server.server_activate()

2127

2395

# Must run before the D-Bus bus name gets deregistered

2128

2396

cleanup()

2129

2397

2398

2130

2399

if __name__ == '__main__':

2131

2400

main()