/mandos/trunk : revision 520

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

65

67

66

68

import dbus

67

69

import dbus.service

72

74

import ctypes.util

73

75

import xml.dom.minidom

74

76

import inspect

77

import Crypto.Cipher.AES

75

78

76

79

try:

77

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

85

SO_BINDTODEVICE = None

83

86

84

87

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

89

93

syslogger = (logging.handlers.SysLogHandler

90

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

95

address = str("/dev/log")))

95

99

logger.addHandler(syslogger)

96

100

97

101

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

99

104

' %(levelname)s:'

100

105

' %(message)s'))

101

106

logger.addHandler(console)

102

107

108

103

109

class AvahiError(Exception):

104

110

def __init__(self, value, *args, **kwargs):

105

111

self.value = value

159

165

" after %i retries, exiting.",

160

166

self.rename_count)

161

167

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

163

170

logger.info("Changing Zeroconf service name to %r ...",

164

171

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

172

self.remove()

170

173

try:

171

174

self.add()

191

194

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

195

self.entry_group_state_changed_match = (

193

196

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

197

'StateChanged', self.entry_group_state_changed))

195

198

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

196

199

self.name, self.type)

197

200

self.group.AddService(

263

266

self.server_state_changed)

264

267

self.server_state_changed(self.server.GetState())

265

268

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

266

278

267

279

def _timedelta_to_milliseconds(td):

268

280

"Convert a datetime.timedelta() to milliseconds"

287

299

instance %(name)s can be used in the command.

288

300

checker_initiator_tag: a gobject event source tag, or None

289

301

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

290

304

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

292

305

disable_initiator_tag: a gobject event source tag, or None

293

306

enabled: bool()

294

307

fingerprint: string (40 or 32 hexadecimal digits); used to

297

310

interval: datetime.timedelta(); How often to start a new checker

298

311

last_approval_request: datetime.datetime(); (UTC) or None

299

312

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

300

316

last_enabled: datetime.datetime(); (UTC)

301

317

name: string; from the config file, used in log messages and

302

318

D-Bus identifiers

313

329

"created", "enabled", "fingerprint",

314

330

"host", "interval", "last_checked_ok",

315

331

"last_enabled", "name", "timeout")

316

332

317

333

def timeout_milliseconds(self):

318

334

"Return the 'timeout' attribute in milliseconds"

319

335

return _timedelta_to_milliseconds(self.timeout)

320

336

321

337

def extended_timeout_milliseconds(self):

322

338

"Return the 'extended_timeout' attribute in milliseconds"

323

return _timedelta_to_milliseconds(self.extended_timeout)

339

return _timedelta_to_milliseconds(self.extended_timeout)

324

340

325

341

def interval_milliseconds(self):

326

342

"Return the 'interval' attribute in milliseconds"

327

343

return _timedelta_to_milliseconds(self.interval)

328

344

329

345

def approval_delay_milliseconds(self):

330

346

return _timedelta_to_milliseconds(self.approval_delay)

331

347

332

def __init__(self, name = None, disable_hook=None, config=None):

348

def __init__(self, name = None, config=None):

333

349

"""Note: the 'checker' key in 'config' sets the

334

350

'checker_command' attribute and *not* the 'checker'

335

351

attribute."""

355

371

% self.name)

356

372

self.host = config.get("host", "")

357

373

self.created = datetime.datetime.utcnow()

358

self.enabled = False

374

self.enabled = True

359

375

self.last_approval_request = None

360

self.last_enabled = None

376

self.last_enabled = datetime.datetime.utcnow()

361

377

self.last_checked_ok = None

378

self.last_checker_status = None

362

379

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

364

382

self.interval = string_to_delta(config["interval"])

365

self.disable_hook = disable_hook

366

383

self.checker = None

367

384

self.checker_initiator_tag = None

368

385

self.disable_initiator_tag = None

369

self.expires = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

370

387

self.checker_callback_tag = None

371

388

self.checker_command = config["checker"]

372

389

self.current_checker_command = None

373

self.last_connect = None

374

390

self._approved = None

375

391

self.approved_by_default = config.get("approved_by_default",

376

392

True)

379

395

config["approval_delay"])

380

396

self.approval_duration = string_to_delta(

381

397

config["approval_duration"])

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

398

self.changedstate = (multiprocessing_manager

399

.Condition(multiprocessing_manager

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

383

409

410

# Send notice to process children that client state has changed

384

411

def send_changedstate(self):

385

self.changedstate.acquire()

386

self.changedstate.notify_all()

387

self.changedstate.release()

388

412

with self.changedstate:

413

self.changedstate.notify_all()

414

389

415

def enable(self):

390

416

"""Start this client's checker and timeout hooks"""

391

417

if getattr(self, "enabled", False):

392

418

# Already enabled

393

419

return

394

420

self.send_changedstate()

395

# Schedule a new checker to be started an 'interval' from now,

396

# and every interval from then on.

397

self.checker_initiator_tag = (gobject.timeout_add

398

(self.interval_milliseconds(),

399

self.start_checker))

400

# Schedule a disable() when 'timeout' has passed

401

421

self.expires = datetime.datetime.utcnow() + self.timeout

402

self.disable_initiator_tag = (gobject.timeout_add

403

(self.timeout_milliseconds(),

404

self.disable))

405

422

self.enabled = True

406

423

self.last_enabled = datetime.datetime.utcnow()

407

# Also start a new checker *right now*.

408

self.start_checker()

424

self.init_checker()

409

425

410

426

def disable(self, quiet=True):

411

427

"""Disable this client."""

423

439

gobject.source_remove(self.checker_initiator_tag)

424

440

self.checker_initiator_tag = None

425

441

self.stop_checker()

426

if self.disable_hook:

427

self.disable_hook(self)

428

442

self.enabled = False

429

443

# Do not run this again if called by a gobject.timeout_add

430

444

return False

431

445

432

446

def __del__(self):

433

self.disable_hook = None

434

447

self.disable()

435

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

436

463

def checker_callback(self, pid, condition, command):

437

464

"""The checker has completed, so take appropriate actions."""

438

465

self.checker_callback_tag = None

439

466

self.checker = None

440

467

if os.WIFEXITED(condition):

441

exitstatus = os.WEXITSTATUS(condition)

442

if exitstatus == 0:

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

443

470

logger.info("Checker for %(name)s succeeded",

444

471

vars(self))

445

472

self.checked_ok()

447

474

logger.info("Checker for %(name)s failed",

448

475

vars(self))

449

476

else:

477

self.last_checker_status = -1

450

478

logger.warning("Checker for %(name)s crashed?",

451

479

vars(self))

452

480

459

487

if timeout is None:

460

488

timeout = self.timeout

461

489

self.last_checked_ok = datetime.datetime.utcnow()

462

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

464

self.disable_initiator_tag = (gobject.timeout_add

465

(_timedelta_to_milliseconds(timeout),

466

self.disable))

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

467

497

468

498

def need_approval(self):

469

499

self.last_approval_request = datetime.datetime.utcnow()

509

539

'replace')))

510

540

for attr in

511

541

self.runtime_expansions)

512

542

513

543

try:

514

544

command = self.checker_command % escaped_attrs

515

545

except TypeError as error:

561

591

raise

562

592

self.checker = None

563

593

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

640

564

641

def dbus_service_property(dbus_interface, signature="v",

565

642

access="readwrite", byte_arrays=False):

566

643

"""Decorators for marking methods of a DBusObjectWithProperties to

612

689

613

690

class DBusObjectWithProperties(dbus.service.Object):

614

691

"""A D-Bus object with properties.

615

692

616

693

Classes inheriting from this can use the dbus_service_property

617

694

decorator to expose methods as D-Bus properties. It exposes the

618

695

standard Get(), Set(), and GetAll() methods on the D-Bus.

625

702

def _get_all_dbus_properties(self):

626

703

"""Returns a generator of (name, attribute) pairs

627

704

"""

628

return ((prop._dbus_name, prop)

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

706

for cls in self.__class__.__mro__

629

707

for name, prop in

630

inspect.getmembers(self, self._is_dbus_property))

708

inspect.getmembers(cls, self._is_dbus_property))

631

709

632

710

def _get_dbus_property(self, interface_name, property_name):

633

711

"""Returns a bound method if one exists which is a D-Bus

634

712

property with the specified name and interface.

635

713

"""

636

for name in (property_name,

637

property_name + "_dbus_property"):

638

prop = getattr(self, name, None)

639

if (prop is None

640

or not self._is_dbus_property(prop)

641

or prop._dbus_name != property_name

642

or (interface_name and prop._dbus_interface

643

and interface_name != prop._dbus_interface)):

644

continue

645

return prop

714

for cls in self.__class__.__mro__:

715

for name, value in (inspect.getmembers

716

(cls, self._is_dbus_property)):

717

if (value._dbus_name == property_name

718

and value._dbus_interface == interface_name):

719

return value.__get__(self)

720

646

721

# No such property

647

722

raise DBusPropertyNotFound(self.dbus_object_path + ":"

648

723

+ interface_name + "."

682

757

def GetAll(self, interface_name):

683

758

"""Standard D-Bus property GetAll() method, see D-Bus

684

759

standard.

685

760

686

761

Note: Will not include properties with access="write".

687

762

"""

688

763

all = {}

757

832

return dbus.String(dt.isoformat(),

758

833

variant_level=variant_level)

759

834

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

839

"""

840

def __new__(mcs, name, bases, attr):

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

847

# Ignore non-D-Bus attributes, and D-Bus attributes

848

# with the wrong interface name

849

if (not hasattr(attribute, "_dbus_interface")

850

or not attribute._dbus_interface

851

.startswith("se.recompile.Mandos")):

852

continue

853

# Create an alternate D-Bus interface name based on

854

# the current name

855

alt_interface = (attribute._dbus_interface

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

858

# Is this a D-Bus signal?

859

if getattr(attribute, "_dbus_is_signal", False):

860

# Extract the original non-method function by

861

# black magic

862

nonmethod_func = (dict(

863

zip(attribute.func_code.co_freevars,

864

attribute.__closure__))["func"]

865

.cell_contents)

866

# Create a new, but exactly alike, function

867

# object, and decorate it to be a new D-Bus signal

868

# with the alternate D-Bus interface name

869

new_function = (dbus.service.signal

870

(alt_interface,

871

attribute._dbus_signature)

872

(types.FunctionType(

873

nonmethod_func.func_code,

874

nonmethod_func.func_globals,

875

nonmethod_func.func_name,

876

nonmethod_func.func_defaults,

877

nonmethod_func.func_closure)))

878

# Define a creator of a function to call both the

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

881

def fixscope(func1, func2):

882

"""This function is a scope container to pass

883

func1 and func2 to the "call_both" function

884

outside of its arguments"""

885

def call_both(*args, **kwargs):

886

"""This function will emit two D-Bus

887

signals by calling func1 and func2"""

888

func1(*args, **kwargs)

889

func2(*args, **kwargs)

890

return call_both

891

# Create the "call_both" function and add it to

892

# the class

893

attr[attrname] = fixscope(attribute,

894

new_function)

895

# Is this a D-Bus method?

896

elif getattr(attribute, "_dbus_is_method", False):

897

# Create a new, but exactly alike, function

898

# object. Decorate it to be a new D-Bus method

899

# with the alternate D-Bus interface name. Add it

900

# to the class.

901

attr[attrname] = (dbus.service.method

902

(alt_interface,

903

attribute._dbus_in_signature,

904

attribute._dbus_out_signature)

905

(types.FunctionType

906

(attribute.func_code,

907

attribute.func_globals,

908

attribute.func_name,

909

attribute.func_defaults,

910

attribute.func_closure)))

911

# Is this a D-Bus property?

912

elif getattr(attribute, "_dbus_is_property", False):

913

# Create a new, but exactly alike, function

914

# object, and decorate it to be a new D-Bus

915

# property with the alternate D-Bus interface

916

# name. Add it to the class.

917

attr[attrname] = (dbus_service_property

918

(alt_interface,

919

attribute._dbus_signature,

920

attribute._dbus_access,

921

attribute

922

._dbus_get_args_options

923

["byte_arrays"])

924

(types.FunctionType

925

(attribute.func_code,

926

attribute.func_globals,

927

attribute.func_name,

928

attribute.func_defaults,

929

attribute.func_closure)))

930

return type.__new__(mcs, name, bases, attr)

931

760

932

class ClientDBus(Client, DBusObjectWithProperties):

761

933

"""A Client class using D-Bus

762

934

771

943

# dbus.service.Object doesn't use super(), so we can't either.

772

944

773

945

def __init__(self, bus = None, *args, **kwargs):

946

self.bus = bus

947

Client.__init__(self, *args, **kwargs)

948

774

949

self._approvals_pending = 0

775

self.bus = bus

776

Client.__init__(self, *args, **kwargs)

777

950

# Only now, when this client is initialized, can it show up on

778

951

# the D-Bus

779

952

client_object_name = unicode(self.name).translate(

787

960

def notifychangeproperty(transform_func,

788

961

dbus_name, type_func=lambda x: x,

789

962

variant_level=1):

790

""" Modify a variable so that its a property that announce its

791

changes to DBus.

792

transform_fun: Function that takes a value and transform it to

793

DBus type.

794

dbus_name: DBus name of the variable

963

""" Modify a variable so that it's a property which announces

964

its changes to DBus.

965

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

968

dbus_name: D-Bus name of the variable

795

969

type_func: Function that transform the value before sending it

796

to DBus

797

variant_level: DBus variant level. default: 1

970

to the D-Bus. Default: no transform

971

variant_level: D-Bus variant level. Default: 1

798

972

"""

799

real_value = [None,]

973

attrname = "_{0}".format(dbus_name)

800

974

def setter(self, value):

801

old_value = real_value[0]

802

real_value[0] = value

803

975

if hasattr(self, "dbus_object_path"):

804

if type_func(old_value) != type_func(real_value[0]):

805

dbus_value = transform_func(type_func(real_value[0]),

806

variant_level)

976

if (not hasattr(self, attrname) or

977

type_func(getattr(self, attrname, None))

978

!= type_func(value)):

979

dbus_value = transform_func(type_func(value),

980

variant_level

981

=variant_level)

807

982

self.PropertyChanged(dbus.String(dbus_name),

808

983

dbus_value)

809

810

return property(lambda self: real_value[0], setter)

811

812

984

setattr(self, attrname, value)

985

986

return property(lambda self: getattr(self, attrname), setter)

987

988

813

989

expires = notifychangeproperty(datetime_to_dbus, "Expires")

814

990

approvals_pending = notifychangeproperty(dbus.Boolean,

815

991

"ApprovalPending",

818

994

last_enabled = notifychangeproperty(datetime_to_dbus,

819

995

"LastEnabled")

820

996

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

821

type_func = lambda checker: checker is not None)

997

type_func = lambda checker:

998

checker is not None)

822

999

last_checked_ok = notifychangeproperty(datetime_to_dbus,

823

1000

"LastCheckedOK")

824

last_approval_request = notifychangeproperty(datetime_to_dbus,

825

"LastApprovalRequest")

1001

last_approval_request = notifychangeproperty(

1002

datetime_to_dbus, "LastApprovalRequest")

826

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

827

1004

"ApprovedByDefault")

828

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

829

type_func = _timedelta_to_milliseconds)

830

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

831

type_func = _timedelta_to_milliseconds)

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1006

"ApprovalDelay",

1007

type_func =

1008

_timedelta_to_milliseconds)

1009

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

832

1012

host = notifychangeproperty(dbus.String, "Host")

833

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

834

type_func = _timedelta_to_milliseconds)

835

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

836

type_func = _timedelta_to_milliseconds)

837

interval = notifychangeproperty(dbus.UInt16, "Interval",

838

type_func = _timedelta_to_milliseconds)

1014

type_func =

1015

_timedelta_to_milliseconds)

1016

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1020

"Interval",

1021

type_func =

1022

_timedelta_to_milliseconds)

839

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

840

1024

841

1025

del notifychangeproperty

867

1051

868

1052

return Client.checker_callback(self, pid, condition, command,

869

1053

*args, **kwargs)

870

1054

871

1055

def start_checker(self, *args, **kwargs):

872

1056

old_checker = self.checker

873

1057

if self.checker is not None:

895

1079

896

1080

897

1081

## D-Bus methods, signals & properties

898

_interface = "se.bsnet.fukt.Mandos.Client"

1082

_interface = "se.recompile.Mandos.Client"

899

1083

900

1084

## Signals

901

1085

1076

1260

gobject.source_remove(self.disable_initiator_tag)

1077

1261

self.disable_initiator_tag = None

1078

1262

self.expires = None

1079

time_to_die = (self.

1080

_timedelta_to_milliseconds((self

1081

.last_checked_ok

1082

+ self.timeout)

1083

- datetime.datetime

1084

.utcnow()))

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1085

1268

if time_to_die <= 0:

1086

1269

# The timeout has passed

1087

1270

self.disable()

1088

1271

else:

1089

1272

self.expires = (datetime.datetime.utcnow()

1090

+ datetime.timedelta(milliseconds = time_to_die))

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1091

1275

self.disable_initiator_tag = (gobject.timeout_add

1092

1276

(time_to_die, self.disable))

1093

1277

1094

1278

# ExtendedTimeout - property

1095

1279

@dbus_service_property(_interface, signature="t",

1096

1280

access="readwrite")

1098

1282

if value is None: # get

1099

1283

return dbus.UInt64(self.extended_timeout_milliseconds())

1100

1284

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1101

1285

1102

1286

# Interval - property

1103

1287

@dbus_service_property(_interface, signature="t",

1104

1288

access="readwrite")

1113

1297

self.checker_initiator_tag = (gobject.timeout_add

1114

1298

(value, self.start_checker))

1115

1299

self.start_checker() # Start one now, too

1116

1300

1117

1301

# Checker - property

1118

1302

@dbus_service_property(_interface, signature="s",

1119

1303

access="readwrite")

1153

1337

self._pipe.send(('init', fpr, address))

1154

1338

if not self._pipe.recv():

1155

1339

raise KeyError()

1156

1340

1157

1341

def __getattribute__(self, name):

1158

1342

if(name == '_pipe'):

1159

1343

return super(ProxyClient, self).__getattribute__(name)

1166

1350

self._pipe.send(('funcall', name, args, kwargs))

1167

1351

return self._pipe.recv()[1]

1168

1352

return func

1169

1353

1170

1354

def __setattr__(self, name, value):

1171

1355

if(name == '_pipe'):

1172

1356

return super(ProxyClient, self).__setattr__(name, value)

1173

1357

self._pipe.send(('setattr', name, value))

1174

1358

1359

class ClientDBusTransitional(ClientDBus):

1360

__metaclass__ = AlternateDBusNamesMetaclass

1175

1361

1176

1362

class ClientHandler(socketserver.BaseRequestHandler, object):

1177

1363

"""A class to handle client connections.

1185

1371

unicode(self.client_address))

1186

1372

logger.debug("Pipe FD: %d",

1187

1373

self.server.child_pipe.fileno())

1188

1374

1189

1375

session = (gnutls.connection

1190

1376

.ClientSession(self.request,

1191

1377

gnutls.connection

1192

1378

.X509Credentials()))

1193

1379

1194

1380

# Note: gnutls.connection.X509Credentials is really a

1195

1381

# generic GnuTLS certificate credentials object so long as

1196

1382

# no X.509 keys are added to it. Therefore, we can use it

1197

1383

# here despite using OpenPGP certificates.

1198

1384

1199

1385

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1200

1386

# "+AES-256-CBC", "+SHA1",

1201

1387

# "+COMP-NULL", "+CTYPE-OPENPGP",

1207

1393

(gnutls.library.functions

1208

1394

.gnutls_priority_set_direct(session._c_object,

1209

1395

priority, None))

1210

1396

1211

1397

# Start communication using the Mandos protocol

1212

1398

# Get protocol number

1213

1399

line = self.request.makefile().readline()

1218

1404

except (ValueError, IndexError, RuntimeError) as error:

1219

1405

logger.error("Unknown protocol version: %s", error)

1220

1406

return

1221

1407

1222

1408

# Start GnuTLS connection

1223

1409

try:

1224

1410

session.handshake()

1228

1414

# established. Just abandon the request.

1229

1415

return

1230

1416

logger.debug("Handshake succeeded")

1231

1417

1232

1418

approval_required = False

1233

1419

try:

1234

1420

try:

1239

1425

logger.warning("Bad certificate: %s", error)

1240

1426

return

1241

1427

logger.debug("Fingerprint: %s", fpr)

1242

1428

1243

1429

try:

1244

1430

client = ProxyClient(child_pipe, fpr,

1245

1431

self.client_address)

1257

1443

client.name)

1258

1444

if self.server.use_dbus:

1259

1445

# Emit D-Bus signal

1260

client.Rejected("Disabled")

1446

client.Rejected("Disabled")

1261

1447

return

1262

1448

1263

1449

if client._approved or not client.approval_delay:

1280

1466

return

1281

1467

1282

1468

#wait until timeout or approved

1283

#x = float(client._timedelta_to_milliseconds(delay))

1284

1469

time = datetime.datetime.now()

1285

1470

client.changedstate.acquire()

1286

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1471

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1473

/ 1000)))

1287

1474

client.changedstate.release()

1288

1475

time2 = datetime.datetime.now()

1289

1476

if (time2 - time) >= delay:

1311

1498

sent, len(client.secret)

1312

1499

- (sent_size + sent))

1313

1500

sent_size += sent

1314

1501

1315

1502

logger.info("Sending secret to %s", client.name)

1316

# bump the timeout as if seen

1503

# bump the timeout using extended_timeout

1317

1504

client.checked_ok(client.extended_timeout)

1318

1505

if self.server.use_dbus:

1319

1506

# Emit D-Bus signal

1399

1586

except:

1400

1587

self.handle_error(request, address)

1401

1588

self.close_request(request)

1402

1589

1403

1590

def process_request(self, request, address):

1404

1591

"""Start a new process to process the request."""

1405

multiprocessing.Process(target = self.sub_process_main,

1406

args = (request, address)).start()

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1593

args = (request,

1594

address))

1595

proc.start()

1596

return proc

1597

1407

1598

1408

1599

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1409

1600

""" adds a pipe to the MixIn """

1413

1604

This function creates a new pipe in self.pipe

1414

1605

"""

1415

1606

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1416

1417

super(MultiprocessingMixInWithPipe,

1418

self).process_request(request, client_address)

1607

1608

proc = MultiprocessingMixIn.process_request(self, request,

1609

client_address)

1419

1610

self.child_pipe.close()

1420

self.add_pipe(parent_pipe)

1421

1422

def add_pipe(self, parent_pipe):

1611

self.add_pipe(parent_pipe, proc)

1612

1613

def add_pipe(self, parent_pipe, proc):

1423

1614

"""Dummy function; override as necessary"""

1424

1615

raise NotImplementedError

1425

1616

1617

1426

1618

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1427

1619

socketserver.TCPServer, object):

1428

1620

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1502

1694

self.enabled = False

1503

1695

self.clients = clients

1504

1696

if self.clients is None:

1505

self.clients = set()

1697

self.clients = {}

1506

1698

self.use_dbus = use_dbus

1507

1699

self.gnutls_priority = gnutls_priority

1508

1700

IPv6_TCPServer.__init__(self, server_address,

1512

1704

def server_activate(self):

1513

1705

if self.enabled:

1514

1706

return socketserver.TCPServer.server_activate(self)

1707

1515

1708

def enable(self):

1516

1709

self.enabled = True

1517

def add_pipe(self, parent_pipe):

1710

1711

def add_pipe(self, parent_pipe, proc):

1518

1712

# Call "handle_ipc" for both data and EOF events

1519

1713

gobject.io_add_watch(parent_pipe.fileno(),

1520

1714

gobject.IO_IN | gobject.IO_HUP,

1521

1715

functools.partial(self.handle_ipc,

1522

parent_pipe = parent_pipe))

1523

1716

parent_pipe =

1717

parent_pipe,

1718

proc = proc))

1719

1524

1720

def handle_ipc(self, source, condition, parent_pipe=None,

1525

client_object=None):

1721

proc = None, client_object=None):

1526

1722

condition_names = {

1527

1723

gobject.IO_IN: "IN", # There is data to read.

1528

1724

gobject.IO_OUT: "OUT", # Data can be written (without

1537

1733

for cond, name in

1538

1734

condition_names.iteritems()

1539

1735

if cond & condition)

1540

# error or the other end of multiprocessing.Pipe has closed

1736

# error, or the other end of multiprocessing.Pipe has closed

1541

1737

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1738

# Wait for other process to exit

1739

proc.join()

1542

1740

return False

1543

1741

1544

1742

# Read a request from the child

1549

1747

fpr = request[1]

1550

1748

address = request[2]

1551

1749

1552

for c in self.clients:

1750

for c in self.clients.itervalues():

1553

1751

if c.fingerprint == fpr:

1554

1752

client = c

1555

1753

break

1558

1756

"dress: %s", fpr, address)

1559

1757

if self.use_dbus:

1560

1758

# Emit D-Bus signal

1561

mandos_dbus_service.ClientNotFound(fpr, address[0])

1759

mandos_dbus_service.ClientNotFound(fpr,

1760

address[0])

1562

1761

parent_pipe.send(False)

1563

1762

return False

1564

1763

1565

1764

gobject.io_add_watch(parent_pipe.fileno(),

1566

1765

gobject.IO_IN | gobject.IO_HUP,

1567

1766

functools.partial(self.handle_ipc,

1568

parent_pipe = parent_pipe,

1569

client_object = client))

1767

parent_pipe =

1768

parent_pipe,

1769

proc = proc,

1770

client_object =

1771

client))

1570

1772

parent_pipe.send(True)

1571

# remove the old hook in favor of the new above hook on same fileno

1773

# remove the old hook in favor of the new above hook on

1774

# same fileno

1572

1775

return False

1573

1776

if command == 'funcall':

1574

1777

funcname = request[1]

1575

1778

args = request[2]

1576

1779

kwargs = request[3]

1577

1780

1578

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1579

1781

parent_pipe.send(('data', getattr(client_object,

1782

funcname)(*args,

1783

**kwargs)))

1784

1580

1785

if command == 'getattr':

1581

1786

attrname = request[1]

1582

1787

if callable(client_object.__getattribute__(attrname)):

1583

1788

parent_pipe.send(('function',))

1584

1789

else:

1585

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1790

parent_pipe.send(('data', client_object

1791

.__getattribute__(attrname)))

1586

1792

1587

1793

if command == 'setattr':

1588

1794

attrname = request[1]

1589

1795

value = request[2]

1590

1796

setattr(client_object, attrname, value)

1591

1797

1592

1798

return True

1593

1799

1594

1800

1715

1921

" system bus interface")

1716

1922

parser.add_argument("--no-ipv6", action="store_false",

1717

1923

dest="use_ipv6", help="Do not use IPv6")

1924

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

1718

1928

options = parser.parse_args()

1719

1929

1720

1930

if options.check:

1755

1965

# options, if set.

1756

1966

for option in ("interface", "address", "port", "debug",

1757

1967

"priority", "servicename", "configdir",

1758

"use_dbus", "use_ipv6", "debuglevel"):

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1759

1969

value = getattr(options, option)

1760

1970

if value is not None:

1761

1971

server_settings[option] = value

1773

1983

debuglevel = server_settings["debuglevel"]

1774

1984

use_dbus = server_settings["use_dbus"]

1775

1985

use_ipv6 = server_settings["use_ipv6"]

1776

1986

1777

1987

if server_settings["servicename"] != "Mandos":

1778

1988

syslogger.setFormatter(logging.Formatter

1779

1989

('Mandos (%s) [%%(process)d]:'

1834

2044

raise error

1835

2045

1836

2046

if not debug and not debuglevel:

1837

syslogger.setLevel(logging.WARNING)

1838

console.setLevel(logging.WARNING)

2047

logger.setLevel(logging.WARNING)

1839

2048

if debuglevel:

1840

2049

level = getattr(logging, debuglevel.upper())

1841

syslogger.setLevel(level)

1842

console.setLevel(level)

1843

2050

logger.setLevel(level)

2051

1844

2052

if debug:

2053

logger.setLevel(logging.DEBUG)

1845

2054

# Enable all possible GnuTLS debugging

1846

2055

1847

2056

# "Use a log level over 10 to enable all debugging options."

1877

2086

# End of Avahi example code

1878

2087

if use_dbus:

1879

2088

try:

1880

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2089

bus_name = dbus.service.BusName("se.recompile.Mandos",

1881

2090

bus, do_not_queue=True)

2091

old_bus_name = (dbus.service.BusName

2092

("se.bsnet.fukt.Mandos", bus,

2093

do_not_queue=True))

1882

2094

except dbus.exceptions.NameExistsException as e:

1883

2095

logger.error(unicode(e) + ", disabling D-Bus")

1884

2096

use_dbus = False

1885

2097

server_settings["use_dbus"] = False

1886

2098

tcp_server.use_dbus = False

1887

2099

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1888

service = AvahiService(name = server_settings["servicename"],

1889

servicetype = "_mandos._tcp",

1890

protocol = protocol, bus = bus)

2100

service = AvahiServiceToSyslog(name =

2101

server_settings["servicename"],

2102

servicetype = "_mandos._tcp",

2103

protocol = protocol, bus = bus)

1891

2104

if server_settings["interface"]:

1892

2105

service.interface = (if_nametoindex

1893

2106

(str(server_settings["interface"])))

1897

2110

1898

2111

client_class = Client

1899

2112

if use_dbus:

1900

client_class = functools.partial(ClientDBus, bus = bus)

1901

def client_config_items(config, section):

1902

special_settings = {

1903

"approved_by_default":

1904

lambda: config.getboolean(section,

1905

"approved_by_default"),

1906

}

1907

for name, value in config.items(section):

2113

client_class = functools.partial(ClientDBusTransitional,

2114

bus = bus)

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2133

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2137

if server_settings["restore"]:

2138

try:

2139

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2141

os.remove(stored_state_path)

2142

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2145

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

1908

2156

try:

1909

yield (name, special_settings[name]())

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

1910

2162

except KeyError:

1911

yield (name, value)

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

1912

2209

1913

tcp_server.clients.update(set(

1914

client_class(name = section,

1915

config= dict(client_config_items(

1916

client_config, section)))

1917

for section in client_config.sections()))

2210

1918

2211

if not tcp_server.clients:

1919

2212

logger.warning("No clients defined")

1920

2213

1933

2226

del pidfilename

1934

2227

1935

2228

signal.signal(signal.SIGINT, signal.SIG_IGN)

1936

2229

1937

2230

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1938

2231

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1939

2232

1942

2235

"""A D-Bus proxy object"""

1943

2236

def __init__(self):

1944

2237

dbus.service.Object.__init__(self, bus, "/")

1945

_interface = "se.bsnet.fukt.Mandos"

2238

_interface = "se.recompile.Mandos"

1946

2239

1947

2240

@dbus.service.signal(_interface, signature="o")

1948

2241

def ClientAdded(self, objpath):

1963

2256

def GetAllClients(self):

1964

2257

"D-Bus method"

1965

2258

return dbus.Array(c.dbus_object_path

1966

for c in tcp_server.clients)

2259

for c in

2260

tcp_server.clients.itervalues())

1967

2261

1968

2262

@dbus.service.method(_interface,

1969

2263

out_signature="a{oa{sv}}")

1971

2265

"D-Bus method"

1972

2266

return dbus.Dictionary(

1973

2267

((c.dbus_object_path, c.GetAll(""))

1974

for c in tcp_server.clients),

2268

for c in tcp_server.clients.itervalues()),

1975

2269

signature="oa{sv}")

1976

2270

1977

2271

@dbus.service.method(_interface, in_signature="o")

1978

2272

def RemoveClient(self, object_path):

1979

2273

"D-Bus method"

1980

for c in tcp_server.clients:

2274

for c in tcp_server.clients.itervalues():

1981

2275

if c.dbus_object_path == object_path:

1982

tcp_server.clients.remove(c)

2276

del tcp_server.clients[c.name]

1983

2277

c.remove_from_connection()

1984

2278

# Don't signal anything except ClientRemoved

1985

2279

c.disable(quiet=True)

1990

2284

1991

2285

del _interface

1992

2286

1993

mandos_dbus_service = MandosDBusService()

2287

class MandosDBusServiceTransitional(MandosDBusService):

2288

__metaclass__ = AlternateDBusNamesMetaclass

2289

mandos_dbus_service = MandosDBusServiceTransitional()

1994

2290

1995

2291

def cleanup():

1996

2292

"Cleanup function; run on exit"

1997

2293

service.cleanup()

1998

2294

2295

multiprocessing.active_children()

2296

if not (tcp_server.clients or client_settings):

2297

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2321

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2323

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2329

# Delete all clients, and settings from config

1999

2330

while tcp_server.clients:

2000

client = tcp_server.clients.pop()

2331

name, client = tcp_server.clients.popitem()

2001

2332

if use_dbus:

2002

2333

client.remove_from_connection()

2003

client.disable_hook = None

2004

2334

# Don't signal anything except ClientRemoved

2005

2335

client.disable(quiet=True)

2006

2336

if use_dbus:

2007

2337

# Emit D-Bus signal

2008

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2338

mandos_dbus_service.ClientRemoved(client

2339

.dbus_object_path,

2009

2340

client.name)

2341

client_settings.clear()

2010

2342

2011

2343

atexit.register(cleanup)

2012

2344

2013

for client in tcp_server.clients:

2345

for client in tcp_server.clients.itervalues():

2014

2346

if use_dbus:

2015

2347

# Emit D-Bus signal

2016

2348

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2017

client.enable()

2349

# Need to initiate checking of clients

2350

if client.enabled:

2351

client.init_checker()

2352

2018

2353

2019

2354

tcp_server.enable()

2020

2355

tcp_server.server_activate()

2060

2395

# Must run before the D-Bus bus name gets deregistered

2061

2396

cleanup()

2062

2397

2398

2063

2399

if __name__ == '__main__':

2064

2400

main()