/mandos/trunk : revision 525

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

68

70

69

import dbus

71

70

import dbus.service

86

85

except ImportError:

87

86

SO_BINDTODEVICE = None

88

87

89

version = "1.5.3"

88

version = "1.4.1"

90

89

stored_state_file = "clients.pickle"

91

90

92

91

logger = logging.getLogger()

111

110

return interface_index

112

111

113

112

114

def initlogger(debug, level=logging.WARNING):

113

def initlogger(level=logging.WARNING):

115

114

"""init logger and add loglevel"""

116

115

117

116

syslogger.setFormatter(logging.Formatter

119

118

' %(message)s'))

120

119

logger.addHandler(syslogger)

121

120

122

if debug:

123

console = logging.StreamHandler()

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

125

' [%(process)d]:'

126

' %(levelname)s:'

127

' %(message)s'))

128

logger.addHandler(console)

121

console = logging.StreamHandler()

122

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

123

' [%(process)d]:'

124

' %(levelname)s:'

125

' %(message)s'))

126

logger.addHandler(console)

129

127

logger.setLevel(level)

130

128

131

129

143

141

self.gnupg.options.meta_interactive = False

144

142

self.gnupg.options.homedir = self.tempdir

145

143

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

144

'--quiet'])

148

145

149

146

def __enter__(self):

150

147

return self

176

173

177

174

def encrypt(self, data, password):

178

175

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

176

with open(os.devnull) as devnull:

180

177

try:

181

178

proc = self.gnupg.run(['--symmetric'],

182

179

create_fhs=['stdin', 'stdout'],

193

190

194

191

def decrypt(self, data, password):

195

192

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

193

with open(os.devnull) as devnull:

197

194

try:

198

195

proc = self.gnupg.run(['--decrypt'],

199

196

create_fhs=['stdin', 'stdout'],

200

197

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

198

with contextlib.closing(proc.handles['stdin'] ) as f:

202

199

f.write(data)

203

200

with contextlib.closing(proc.handles['stdout']) as f:

204

201

decrypted_plaintext = f.read()

209

206

return decrypted_plaintext

210

207

211

208

209

212

210

class AvahiError(Exception):

213

211

def __init__(self, value, *args, **kwargs):

214

212

self.value = value

243

241

server: D-Bus Server

244

242

bus: dbus.SystemBus()

245

243

"""

246

247

244

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

245

servicetype = None, port = None, TXT = None,

249

246

domain = "", host = "", max_renames = 32768,

262

259

self.server = None

263

260

self.bus = bus

264

261

self.entry_group_state_changed_match = None

265

266

262

def rename(self):

267

263

"""Derived from the Avahi example code"""

268

264

if self.rename_count >= self.max_renames:

278

274

try:

279

275

self.add()

280

276

except dbus.exceptions.DBusException as error:

281

logger.critical("D-Bus Exception", exc_info=error)

277

logger.critical("DBusException: %s", error)

282

278

self.cleanup()

283

279

os._exit(1)

284

280

self.rename_count += 1

285

286

281

def remove(self):

287

282

"""Derived from the Avahi example code"""

288

283

if self.entry_group_state_changed_match is not None:

290

285

self.entry_group_state_changed_match = None

291

286

if self.group is not None:

292

287

self.group.Reset()

293

294

288

def add(self):

295

289

"""Derived from the Avahi example code"""

296

290

self.remove()

313

307

dbus.UInt16(self.port),

314

308

avahi.string_array_to_txt_array(self.TXT))

315

309

self.group.Commit()

316

317

310

def entry_group_state_changed(self, state, error):

318

311

"""Derived from the Avahi example code"""

319

312

logger.debug("Avahi entry group state change: %i", state)

326

319

elif state == avahi.ENTRY_GROUP_FAILURE:

327

320

logger.critical("Avahi: Error in group state changed %s",

328

321

unicode(error))

329

raise AvahiGroupError("State changed: {0!s}"

330

.format(error))

331

322

raise AvahiGroupError("State changed: %s"

323

% unicode(error))

332

324

def cleanup(self):

333

325

"""Derived from the Avahi example code"""

334

326

if self.group is not None:

339

331

pass

340

332

self.group = None

341

333

self.remove()

342

343

334

def server_state_changed(self, state, error=None):

344

335

"""Derived from the Avahi example code"""

345

336

logger.debug("Avahi server state change: %i", state)

364

355

logger.debug("Unknown state: %r", state)

365

356

else:

366

357

logger.debug("Unknown state: %r: %r", state, error)

367

368

358

def activate(self):

369

359

"""Derived from the Avahi example code"""

370

360

if self.server is None:

382

372

"""Add the new name to the syslog messages"""

383

373

ret = AvahiService.rename(self)

384

374

syslogger.setFormatter(logging.Formatter

385

('Mandos ({0}) [%(process)d]:'

386

' %(levelname)s: %(message)s'

387

.format(self.name)))

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

388

378

return ret

389

379

390

380

def timedelta_to_milliseconds(td):

392

382

return ((td.days * 24 * 60 * 60 * 1000)

393

383

+ (td.seconds * 1000)

394

384

+ (td.microseconds // 1000))

395

385

396

386

class Client(object):

397

387

"""A representation of a client host served by this server.

398

388

423

413

last_checked_ok: datetime.datetime(); (UTC) or None

424

414

last_checker_status: integer between 0 and 255 reflecting exit

425

415

status of last checker. -1 reflects crashed

426

checker, -2 means no checker completed yet.

416

checker, or None.

427

417

last_enabled: datetime.datetime(); (UTC) or None

428

418

name: string; from the config file, used in log messages and

429

419

D-Bus identifiers

430

420

secret: bytestring; sent verbatim (over TLS) to client

431

421

timeout: datetime.timedelta(); How long from last_checked_ok

432

422

until this client is disabled

433

extended_timeout: extra long timeout when secret has been sent

423

extended_timeout: extra long timeout when password has been sent

434

424

runtime_expansions: Allowed attributes for runtime expansion.

435

425

expires: datetime.datetime(); time (UTC) when a client will be

436

426

disabled, or None

465

455

466

456

def approval_delay_milliseconds(self):

467

457

return timedelta_to_milliseconds(self.approval_delay)

468

458

469

459

@staticmethod

470

460

def config_parser(config):

471

"""Construct a new dict of client settings of this form:

461

""" Construct a new dict of client settings of this form:

472

462

{ client_name: {setting_name: value, ...}, ...}

473

with exceptions for any special settings as defined above.

474

NOTE: Must be a pure function. Must return the same result

475

value given the same arguments.

476

"""

463

with exceptions for any special settings as defined above"""

477

464

settings = {}

478

465

for client_name in config.sections():

479

466

section = dict(config.items(client_name))

483

470

# Reformat values from string types to Python types

484

471

client["approved_by_default"] = config.getboolean(

485

472

client_name, "approved_by_default")

486

client["enabled"] = config.getboolean(client_name,

487

"enabled")

473

client["enabled"] = config.getboolean(client_name, "enabled")

488

474

489

475

client["fingerprint"] = (section["fingerprint"].upper()

490

476

.replace(" ", ""))

496

482

"rb") as secfile:

497

483

client["secret"] = secfile.read()

498

484

else:

499

raise TypeError("No secret or secfile for section {0}"

500

.format(section))

485

raise TypeError("No secret or secfile for section %s"

486

% section)

501

487

client["timeout"] = string_to_delta(section["timeout"])

502

488

client["extended_timeout"] = string_to_delta(

503

489

section["extended_timeout"])

509

495

client["checker_command"] = section["checker"]

510

496

client["last_approval_request"] = None

511

497

client["last_checked_ok"] = None

512

client["last_checker_status"] = -2

513

498

client["last_checker_status"] = None

499

if client["enabled"]:

500

client["last_enabled"] = datetime.datetime.utcnow()

501

client["expires"] = (datetime.datetime.utcnow()

502

+ client["timeout"])

503

else:

504

client["last_enabled"] = None

505

client["expires"] = None

506

514

507

return settings

515

508

509

516

510

def __init__(self, settings, name = None):

511

"""Note: the 'checker' key in 'config' sets the

512

'checker_command' attribute and *not* the 'checker'

513

attribute."""

517

514

self.name = name

518

515

# adding all client settings

519

516

for setting, value in settings.iteritems():

520

517

setattr(self, setting, value)

521

518

522

if self.enabled:

523

if not hasattr(self, "last_enabled"):

524

self.last_enabled = datetime.datetime.utcnow()

525

if not hasattr(self, "expires"):

526

self.expires = (datetime.datetime.utcnow()

527

+ self.timeout)

528

else:

529

self.last_enabled = None

530

self.expires = None

531

532

519

logger.debug("Creating client %r", self.name)

533

520

# Uppercase and remove spaces from fingerprint for later

534

521

# comparison purposes with return value from the fingerprint()

535

522

# function

536

523

logger.debug(" Fingerprint: %s", self.fingerprint)

537

self.created = settings.get("created",

538

datetime.datetime.utcnow())

539

524

self.created = settings.get("created", datetime.datetime.utcnow())

525

540

526

# attributes specific for this server instance

541

527

self.checker = None

542

528

self.checker_initiator_tag = None

630

616

logger.warning("Checker for %(name)s crashed?",

631

617

vars(self))

632

618

633

def checked_ok(self):

634

"""Assert that the client has been seen, alive and well."""

635

self.last_checked_ok = datetime.datetime.utcnow()

636

self.last_checker_status = 0

637

self.bump_timeout()

638

639

def bump_timeout(self, timeout=None):

640

"""Bump up the timeout for this client."""

619

def checked_ok(self, timeout=None):

620

"""Bump up the timeout for this client.

621

622

This should only be called when the client has been seen,

623

alive and well.

624

"""

641

625

if timeout is None:

642

626

timeout = self.timeout

627

self.last_checked_ok = datetime.datetime.utcnow()

643

628

if self.disable_initiator_tag is not None:

644

629

gobject.source_remove(self.disable_initiator_tag)

645

630

if getattr(self, "enabled", False):

696

681

try:

697

682

command = self.checker_command % escaped_attrs

698

683

except TypeError as error:

699

logger.error('Could not format string "%s"',

700

self.checker_command, exc_info=error)

684

logger.error('Could not format string "%s":'

685

' %s', self.checker_command, error)

701

686

return True # Try again later

702

687

self.current_checker_command = command

703

688

try:

721

706

gobject.source_remove(self.checker_callback_tag)

722

707

self.checker_callback(pid, status, command)

723

708

except OSError as error:

724

logger.error("Failed to start subprocess",

725

exc_info=error)

709

logger.error("Failed to start subprocess: %s",

710

error)

726

711

# Re-run this periodically if run by gobject.timeout_add

727

712

return True

728

713

735

720

return

736

721

logger.debug("Stopping checker for %(name)s", vars(self))

737

722

try:

738

self.checker.terminate()

723

os.kill(self.checker.pid, signal.SIGTERM)

739

724

#time.sleep(0.5)

740

725

#if self.checker.poll() is None:

741

# self.checker.kill()

726

# os.kill(self.checker.pid, signal.SIGKILL)

742

727

except OSError as error:

743

728

if error.errno != errno.ESRCH: # No such process

744

729

raise

761

746

# "Set" method, so we fail early here:

762

747

if byte_arrays and signature != "ay":

763

748

raise ValueError("Byte arrays not supported for non-'ay'"

764

" signature {0!r}".format(signature))

749

" signature %r" % signature)

765

750

def decorator(func):

766

751

func._dbus_is_property = True

767

752

func._dbus_interface = dbus_interface

775

760

return decorator

776

761

777

762

778

def dbus_interface_annotations(dbus_interface):

779

"""Decorator for marking functions returning interface annotations

780

781

Usage:

782

783

@dbus_interface_annotations("org.example.Interface")

784

def _foo(self): # Function name does not matter

785

return {"org.freedesktop.DBus.Deprecated": "true",

786

"org.freedesktop.DBus.Property.EmitsChangedSignal":

787

"false"}

788

"""

789

def decorator(func):

790

func._dbus_is_interface = True

791

func._dbus_interface = dbus_interface

792

func._dbus_name = dbus_interface

793

return func

794

return decorator

795

796

797

def dbus_annotations(annotations):

798

"""Decorator to annotate D-Bus methods, signals or properties

799

Usage:

800

801

@dbus_service_property("org.example.Interface", signature="b",

802

access="r")

803

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

804

"org.freedesktop.DBus.Property."

805

"EmitsChangedSignal": "false"})

806

def Property_dbus_property(self):

807

return dbus.Boolean(False)

808

"""

809

def decorator(func):

810

func._dbus_annotations = annotations

811

return func

812

return decorator

813

814

815

763

class DBusPropertyException(dbus.exceptions.DBusException):

816

764

"""A base class for D-Bus property-related exceptions

817

765

"""

840

788

"""

841

789

842

790

@staticmethod

843

def _is_dbus_thing(thing):

844

"""Returns a function testing if an attribute is a D-Bus thing

845

846

If called like _is_dbus_thing("method") it returns a function

847

suitable for use as predicate to inspect.getmembers().

848

"""

849

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

850

False)

791

def _is_dbus_property(obj):

792

return getattr(obj, "_dbus_is_property", False)

851

793

852

def _get_all_dbus_things(self, thing):

794

def _get_all_dbus_properties(self):

853

795

"""Returns a generator of (name, attribute) pairs

854

796

"""

855

return ((getattr(athing.__get__(self), "_dbus_name",

856

name),

857

athing.__get__(self))

797

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

858

798

for cls in self.__class__.__mro__

859

for name, athing in

860

inspect.getmembers(cls,

861

self._is_dbus_thing(thing)))

799

for name, prop in

800

inspect.getmembers(cls, self._is_dbus_property))

862

801

863

802

def _get_dbus_property(self, interface_name, property_name):

864

803

"""Returns a bound method if one exists which is a D-Bus

866

805

"""

867

806

for cls in self.__class__.__mro__:

868

807

for name, value in (inspect.getmembers

869

(cls,

870

self._is_dbus_thing("property"))):

808

(cls, self._is_dbus_property)):

871

809

if (value._dbus_name == property_name

872

810

and value._dbus_interface == interface_name):

873

811

return value.__get__(self)

902

840

# signatures other than "ay".

903

841

if prop._dbus_signature != "ay":

904

842

raise ValueError

905

value = dbus.ByteArray(b''.join(chr(byte)

906

for byte in value))

843

value = dbus.ByteArray(''.join(unichr(byte)

844

for byte in value))

907

845

prop(value)

908

846

909

847

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

915

853

Note: Will not include properties with access="write".

916

854

"""

917

855

properties = {}

918

for name, prop in self._get_all_dbus_things("property"):

856

for name, prop in self._get_all_dbus_properties():

919

857

if (interface_name

920

858

and interface_name != prop._dbus_interface):

921

859

# Interface non-empty but did not match

936

874

path_keyword='object_path',

937

875

connection_keyword='connection')

938

876

def Introspect(self, object_path, connection):

939

"""Overloading of standard D-Bus method.

940

941

Inserts property tags and interface annotation tags.

877

"""Standard D-Bus method, overloaded to insert property tags.

942

878

"""

943

879

xmlstring = dbus.service.Object.Introspect(self, object_path,

944

880

connection)

951

887

e.setAttribute("access", prop._dbus_access)

952

888

return e

953

889

for if_tag in document.getElementsByTagName("interface"):

954

# Add property tags

955

890

for tag in (make_tag(document, name, prop)

956

891

for name, prop

957

in self._get_all_dbus_things("property")

892

in self._get_all_dbus_properties()

958

893

if prop._dbus_interface

959

894

== if_tag.getAttribute("name")):

960

895

if_tag.appendChild(tag)

961

# Add annotation tags

962

for typ in ("method", "signal", "property"):

963

for tag in if_tag.getElementsByTagName(typ):

964

annots = dict()

965

for name, prop in (self.

966

_get_all_dbus_things(typ)):

967

if (name == tag.getAttribute("name")

968

and prop._dbus_interface

969

== if_tag.getAttribute("name")):

970

annots.update(getattr

971

(prop,

972

"_dbus_annotations",

973

{}))

974

for name, value in annots.iteritems():

975

ann_tag = document.createElement(

976

"annotation")

977

ann_tag.setAttribute("name", name)

978

ann_tag.setAttribute("value", value)

979

tag.appendChild(ann_tag)

980

# Add interface annotation tags

981

for annotation, value in dict(

982

itertools.chain(

983

*(annotations().iteritems()

984

for name, annotations in

985

self._get_all_dbus_things("interface")

986

if name == if_tag.getAttribute("name")

987

))).iteritems():

988

ann_tag = document.createElement("annotation")

989

ann_tag.setAttribute("name", annotation)

990

ann_tag.setAttribute("value", value)

991

if_tag.appendChild(ann_tag)

992

896

# Add the names to the return values for the

993

897

# "org.freedesktop.DBus.Properties" methods

994

898

if (if_tag.getAttribute("name")

1009

913

except (AttributeError, xml.dom.DOMException,

1010

914

xml.parsers.expat.ExpatError) as error:

1011

915

logger.error("Failed to override Introspection method",

1012

exc_info=error)

916

error)

1013

917

return xmlstring

1014

918

1015

919

1029

933

def __new__(mcs, name, bases, attr):

1030

934

# Go through all the base classes which could have D-Bus

1031

935

# methods, signals, or properties in them

1032

old_interface_names = []

1033

936

for base in (b for b in bases

1034

937

if issubclass(b, dbus.service.Object)):

1035

938

# Go though all attributes of the base class

1045

948

alt_interface = (attribute._dbus_interface

1046

949

.replace("se.recompile.Mandos",

1047

950

"se.bsnet.fukt.Mandos"))

1048

if alt_interface != attribute._dbus_interface:

1049

old_interface_names.append(alt_interface)

1050

951

# Is this a D-Bus signal?

1051

952

if getattr(attribute, "_dbus_is_signal", False):

1052

953

# Extract the original non-method function by

1067

968

nonmethod_func.func_name,

1068

969

nonmethod_func.func_defaults,

1069

970

nonmethod_func.func_closure)))

1070

# Copy annotations, if any

1071

try:

1072

new_function._dbus_annotations = (

1073

dict(attribute._dbus_annotations))

1074

except AttributeError:

1075

pass

1076

971

# Define a creator of a function to call both the

1077

972

# old and new functions, so both the old and new

1078

973

# signals gets sent when the function is called

1106

1001

attribute.func_name,

1107

1002

attribute.func_defaults,

1108

1003

attribute.func_closure)))

1109

# Copy annotations, if any

1110

try:

1111

attr[attrname]._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1113

except AttributeError:

1114

pass

1115

1004

# Is this a D-Bus property?

1116

1005

elif getattr(attribute, "_dbus_is_property", False):

1117

1006

# Create a new, but exactly alike, function

1131

1020

attribute.func_name,

1132

1021

attribute.func_defaults,

1133

1022

attribute.func_closure)))

1134

# Copy annotations, if any

1135

try:

1136

attr[attrname]._dbus_annotations = (

1137

dict(attribute._dbus_annotations))

1138

except AttributeError:

1139

pass

1140

# Is this a D-Bus interface?

1141

elif getattr(attribute, "_dbus_is_interface", False):

1142

# Create a new, but exactly alike, function

1143

# object. Decorate it to be a new D-Bus interface

1144

# with the alternate D-Bus interface name. Add it

1145

# to the class.

1146

attr[attrname] = (dbus_interface_annotations

1147

(alt_interface)

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1154

# Deprecate all old interfaces

1155

iname="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1156

for old_interface_name in old_interface_names:

1157

@dbus_interface_annotations(old_interface_name)

1158

def func(self):

1159

return { "org.freedesktop.DBus.Deprecated": "true" }

1160

# Find an unused name

1161

for aname in (iname.format(i) for i in itertools.count()):

1162

if aname not in attr:

1163

attr[aname] = func

1164

break

1165

1023

return type.__new__(mcs, name, bases, attr)

1166

1024

1167

1025

1181

1039

def __init__(self, bus = None, *args, **kwargs):

1182

1040

self.bus = bus

1183

1041

Client.__init__(self, *args, **kwargs)

1042

self._approvals_pending = 0

1043

1044

self._approvals_pending = 0

1184

1045

# Only now, when this client is initialized, can it show up on

1185

1046

# the D-Bus

1186

1047

client_object_name = unicode(self.name).translate(

1190

1051

("/clients/" + client_object_name))

1191

1052

DBusObjectWithProperties.__init__(self, self.bus,

1192

1053

self.dbus_object_path)

1193

1054

1194

1055

def notifychangeproperty(transform_func,

1195

1056

dbus_name, type_func=lambda x: x,

1196

1057

variant_level=1):

1219

1080

1220

1081

return property(lambda self: getattr(self, attrname), setter)

1221

1082

1083

1222

1084

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1223

1085

approvals_pending = notifychangeproperty(dbus.Boolean,

1224

1086

"ApprovalPending",

1231

1093

checker is not None)

1232

1094

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1233

1095

"LastCheckedOK")

1234

last_checker_status = notifychangeproperty(dbus.Int16,

1235

"LastCheckerStatus")

1236

1096

last_approval_request = notifychangeproperty(

1237

1097

datetime_to_dbus, "LastApprovalRequest")

1238

1098

approved_by_default = notifychangeproperty(dbus.Boolean,

1312

1172

(self.approval_duration),

1313

1173

self._reset_approved)

1314

1174

1175

1315

1176

## D-Bus methods, signals & properties

1316

1177

_interface = "se.recompile.Mandos.Client"

1317

1178

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1325

1179

## Signals

1326

1180

1327

1181

# CheckerCompleted - signal

1363

1217

"D-Bus signal"

1364

1218

return self.need_approval()

1365

1219

1220

# NeRwequest - signal

1221

@dbus.service.signal(_interface, signature="s")

1222

def NewRequest(self, ip):

1223

"""D-Bus signal

1224

Is sent after a client request a password.

1225

"""

1226

pass

1227

1366

1228

## Methods

1367

1229

1368

1230

# Approve - method

1478

1340

return

1479

1341

return datetime_to_dbus(self.last_checked_ok)

1480

1342

1481

# LastCheckerStatus - property

1482

@dbus_service_property(_interface, signature="n",

1483

access="read")

1484

def LastCheckerStatus_dbus_property(self):

1485

return dbus.Int16(self.last_checker_status)

1486

1487

1343

# Expires - property

1488

1344

@dbus_service_property(_interface, signature="s", access="read")

1489

1345

def Expires_dbus_property(self):

1501

1357

if value is None: # get

1502

1358

return dbus.UInt64(self.timeout_milliseconds())

1503

1359

self.timeout = datetime.timedelta(0, 0, 0, value)

1360

if getattr(self, "disable_initiator_tag", None) is None:

1361

return

1504

1362

# Reschedule timeout

1505

if self.enabled:

1506

now = datetime.datetime.utcnow()

1507

time_to_die = timedelta_to_milliseconds(

1508

(self.last_checked_ok + self.timeout) - now)

1509

if time_to_die <= 0:

1510

# The timeout has passed

1511

self.disable()

1512

else:

1513

self.expires = (now +

1514

datetime.timedelta(milliseconds =

1515

time_to_die))

1516

if (getattr(self, "disable_initiator_tag", None)

1517

is None):

1518

return

1519

gobject.source_remove(self.disable_initiator_tag)

1520

self.disable_initiator_tag = (gobject.timeout_add

1521

(time_to_die,

1522

self.disable))

1363

gobject.source_remove(self.disable_initiator_tag)

1364

self.disable_initiator_tag = None

1365

self.expires = None

1366

time_to_die = timedelta_to_milliseconds((self

1367

.last_checked_ok

1368

+ self.timeout)

1369

- datetime.datetime

1370

.utcnow())

1371

if time_to_die <= 0:

1372

# The timeout has passed

1373

self.disable()

1374

else:

1375

self.expires = (datetime.datetime.utcnow()

1376

+ datetime.timedelta(milliseconds =

1377

time_to_die))

1378

self.disable_initiator_tag = (gobject.timeout_add

1379

(time_to_die, self.disable))

1523

1380

1524

1381

# ExtendedTimeout - property

1525

1382

@dbus_service_property(_interface, signature="t",

1681

1538

except KeyError:

1682

1539

return

1683

1540

1541

if self.server.use_dbus:

1542

# Emit D-Bus signal

1543

client.NewRequest(str(self.client_address))

1544

1684

1545

if client.approval_delay:

1685

1546

delay = client.approval_delay

1686

1547

client.approvals_pending += 1

1750

1611

1751

1612

logger.info("Sending secret to %s", client.name)

1752

1613

# bump the timeout using extended_timeout

1753

client.bump_timeout(client.extended_timeout)

1614

client.checked_ok(client.extended_timeout)

1754

1615

if self.server.use_dbus:

1755

1616

# Emit D-Bus signal

1756

1617

client.GotSecret()

2079

1940

elif suffix == "w":

2080

1941

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2081

1942

else:

2082

raise ValueError("Unknown suffix {0!r}"

2083

.format(suffix))

1943

raise ValueError("Unknown suffix %r" % suffix)

2084

1944

except (ValueError, IndexError) as e:

2085

1945

raise ValueError(*(e.args))

2086

1946

timevalue += delta

2100

1960

sys.exit()

2101

1961

if not noclose:

2102

1962

# Close all standard open file descriptors

2103

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1963

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2104

1964

if not stat.S_ISCHR(os.fstat(null).st_mode):

2105

1965

raise OSError(errno.ENODEV,

2106

"{0} not a character device"

2107

.format(os.devnull))

1966

"%s not a character device"

1967

% os.path.devnull)

2108

1968

os.dup2(null, sys.stdin.fileno())

2109

1969

os.dup2(null, sys.stdout.fileno())

2110

1970

os.dup2(null, sys.stderr.fileno())

2119

1979

2120

1980

parser = argparse.ArgumentParser()

2121

1981

parser.add_argument("-v", "--version", action="version",

2122

version = "%(prog)s {0}".format(version),

1982

version = "%%(prog)s %s" % version,

2123

1983

help="show version number and exit")

2124

1984

parser.add_argument("-i", "--interface", metavar="IF",

2125

1985

help="Bind to interface IF")

2218

2078

stored_state_file)

2219

2079

2220

2080

if debug:

2221

initlogger(debug, logging.DEBUG)

2081

initlogger(logging.DEBUG)

2222

2082

else:

2223

2083

if not debuglevel:

2224

initlogger(debug)

2084

initlogger()

2225

2085

else:

2226

2086

level = getattr(logging, debuglevel.upper())

2227

initlogger(debug, level)

2087

initlogger(level)

2228

2088

2229

2089

if server_settings["servicename"] != "Mandos":

2230

2090

syslogger.setFormatter(logging.Formatter

2231

('Mandos ({0}) [%(process)d]:'

2232

' %(levelname)s: %(message)s'

2233

.format(server_settings

2234

["servicename"])))

2091

('Mandos (%s) [%%(process)d]:'

2092

' %%(levelname)s: %%(message)s'

2093

% server_settings["servicename"]))

2235

2094

2236

2095

# Parse config file with clients

2237

client_config = configparser.SafeConfigParser(Client

2238

.client_defaults)

2096

client_config = configparser.SafeConfigParser(Client.client_defaults)

2239

2097

client_config.read(os.path.join(server_settings["configdir"],

2240

2098

"clients.conf"))

2241

2099

2258

2116

except IOError:

2259

2117

logger.error("Could not open file %r", pidfilename)

2260

2118

2261

for name in ("_mandos", "mandos", "nobody"):

2119

try:

2120

uid = pwd.getpwnam("_mandos").pw_uid

2121

gid = pwd.getpwnam("_mandos").pw_gid

2122

except KeyError:

2262

2123

try:

2263

uid = pwd.getpwnam(name).pw_uid

2264

gid = pwd.getpwnam(name).pw_gid

2265

break

2124

uid = pwd.getpwnam("mandos").pw_uid

2125

gid = pwd.getpwnam("mandos").pw_gid

2266

2126

except KeyError:

2267

continue

2268

else:

2269

uid = 65534

2270

gid = 65534

2127

try:

2128

uid = pwd.getpwnam("nobody").pw_uid

2129

gid = pwd.getpwnam("nobody").pw_gid

2130

except KeyError:

2131

uid = 65534

2132

gid = 65534

2271

2133

try:

2272

2134

os.setgid(gid)

2273

2135

os.setuid(uid)

2290

2152

.gnutls_global_set_log_function(debug_gnutls))

2291

2153

2292

2154

# Redirect stdin so all checkers get /dev/null

2293

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2155

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2294

2156

os.dup2(null, sys.stdin.fileno())

2295

2157

if null > 2:

2296

2158

os.close(null)

2159

else:

2160

# No console logging

2161

logger.removeHandler(console)

2297

2162

2298

2163

# Need to fork before connecting to D-Bus

2299

2164

if not debug:

2300

2165

# Close all input and output, do double fork, etc.

2301

2166

daemon()

2302

2167

2303

gobject.threads_init()

2304

2305

2168

global main_loop

2306

2169

# From the Avahi example code

2307

DBusGMainLoop(set_as_default=True)

2170

DBusGMainLoop(set_as_default=True )

2308

2171

main_loop = gobject.MainLoop()

2309

2172

bus = dbus.SystemBus()

2310

2173

# End of Avahi example code

2353

2216

.format(e))

2354

2217

if e.errno != errno.ENOENT:

2355

2218

raise

2356

except EOFError as e:

2357

logger.warning("Could not load persistent state: "

2358

"EOFError: {0}".format(e))

2359

2219

2360

2220

with PGPEngine() as pgp:

2361

2221

for client_name, client in clients_data.iteritems():

2378

2238

2379

2239

# Clients who has passed its expire date can still be

2380

2240

# enabled if its last checker was successful. Clients

2381

# whose checker succeeded before we stored its state is

2382

# assumed to have successfully run all checkers during

2383

# downtime.

2241

# whose checker failed before we stored its state is

2242

# assumed to have failed all checkers during downtime.

2384

2243

if client["enabled"]:

2385

2244

if datetime.datetime.utcnow() >= client["expires"]:

2386

2245

if not client["last_checked_ok"]:

2387

2246

logger.warning(

2388

2247

"disabling client {0} - Client never "

2389

"performed a successful checker"

2390

.format(client_name))

2248

"performed a successfull checker"

2249

.format(client["name"]))

2391

2250

client["enabled"] = False

2392

2251

elif client["last_checker_status"] != 0:

2393

2252

logger.warning(

2394

2253

"disabling client {0} - Client "

2395

2254

"last checker failed with error code {1}"

2396

.format(client_name,

2255

.format(client["name"],

2397

2256

client["last_checker_status"]))

2398

2257

client["enabled"] = False

2399

2258

else:

2400

2259

client["expires"] = (datetime.datetime

2401

2260

.utcnow()

2402

2261

+ client["timeout"])

2403

logger.debug("Last checker succeeded,"

2404

" keeping {0} enabled"

2405

.format(client_name))

2262

2406

2263

try:

2407

2264

client["secret"] = (

2408

2265

pgp.decrypt(client["encrypted_secret"],

2414

2271

.format(client_name))

2415

2272

client["secret"] = (

2416

2273

client_settings[client_name]["secret"])

2274

2417

2275

2418

2276

# Add/remove clients based on new changes made to config

2419

for client_name in (set(old_client_settings)

2420

- set(client_settings)):

2277

for client_name in set(old_client_settings) - set(client_settings):

2421

2278

del clients_data[client_name]

2422

for client_name in (set(client_settings)

2423

- set(old_client_settings)):

2279

for client_name in set(client_settings) - set(old_client_settings):

2424

2280

clients_data[client_name] = client_settings[client_name]

2425

2426

# Create all client objects

2281

2282

# Create clients all clients

2427

2283

for client_name, client in clients_data.iteritems():

2428

2284

tcp_server.clients[client_name] = client_class(

2429

2285

name = client_name, settings = client)

2430

2286

2431

2287

if not tcp_server.clients:

2432

2288

logger.warning("No clients defined")

2433

2289

2434

2290

if not debug:

2435

2291

try:

2436

2292

with pidfile:

2450

2306

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2451

2307

2452

2308

if use_dbus:

2453

class MandosDBusService(DBusObjectWithProperties):

2309

class MandosDBusService(dbus.service.Object):

2454

2310

"""A D-Bus proxy object"""

2455

2311

def __init__(self):

2456

2312

dbus.service.Object.__init__(self, bus, "/")

2457

2313

_interface = "se.recompile.Mandos"

2458

2314

2459

@dbus_interface_annotations(_interface)

2460

def _foo(self):

2461

return { "org.freedesktop.DBus.Property"

2462

".EmitsChangedSignal":

2463

"false"}

2464

2465

2315

@dbus.service.signal(_interface, signature="o")

2466

2316

def ClientAdded(self, objpath):

2467

2317

"D-Bus signal"

2550

2400

del client_settings[client.name]["secret"]

2551

2401

2552

2402

try:

2553

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2554

prefix="clients-",

2555

dir=os.path.dirname

2556

(stored_state_path))

2557

with os.fdopen(tempfd, "wb") as stored_state:

2403

with os.fdopen(os.open(stored_state_path,

2404

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2405

0600), "wb") as stored_state:

2558

2406

pickle.dump((clients, client_settings), stored_state)

2559

os.rename(tempname, stored_state_path)

2560

2407

except (IOError, OSError) as e:

2561

2408

logger.warning("Could not save persistent state: {0}"

2562

2409

.format(e))

2563

if not debug:

2564

try:

2565

os.remove(tempname)

2566

except NameError:

2567

pass

2568

if e.errno not in set((errno.ENOENT, errno.EACCES,

2569

errno.EEXIST)):

2570

raise e

2410

if e.errno not in (errno.ENOENT, errno.EACCES):

2411

raise

2571

2412

2572

2413

# Delete all clients, and settings from config

2573

2414

while tcp_server.clients:

2600

2441

service.port = tcp_server.socket.getsockname()[1]

2601

2442

if use_ipv6:

2602

2443

logger.info("Now listening on address %r, port %d,"

2603

" flowinfo %d, scope_id %d",

2604

*tcp_server.socket.getsockname())

2444

" flowinfo %d, scope_id %d"

2445

% tcp_server.socket.getsockname())

2605

2446

else: # IPv4

2606

logger.info("Now listening on address %r, port %d",

2607

*tcp_server.socket.getsockname())

2447

logger.info("Now listening on address %r, port %d"

2448

% tcp_server.socket.getsockname())

2608

2449

2609

2450

#service.interface = tcp_server.socket.getsockname()[3]

2610

2451

2613

2454

try:

2614

2455

service.activate()

2615

2456

except dbus.exceptions.DBusException as error:

2616

logger.critical("D-Bus Exception", exc_info=error)

2457

logger.critical("DBusException: %s", error)

2617

2458

cleanup()

2618

2459

sys.exit(1)

2619

2460

# End of Avahi example code

2626

2467

logger.debug("Starting main loop")

2627

2468

main_loop.run()

2628

2469

except AvahiError as error:

2629

logger.critical("Avahi Error", exc_info=error)

2470

logger.critical("AvahiError: %s", error)

2630

2471

cleanup()

2631

2472

sys.exit(1)

2632

2473

except KeyboardInterrupt: