/mandos/trunk : revision 525

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

68

70

69

import dbus

71

70

import dbus.service

86

85

except ImportError:

87

86

SO_BINDTODEVICE = None

88

87

89

version = "1.5.3"

88

version = "1.4.1"

90

89

stored_state_file = "clients.pickle"

91

90

92

91

logger = logging.getLogger()

111

110

return interface_index

112

111

113

112

114

def initlogger(debug, level=logging.WARNING):

113

def initlogger(level=logging.WARNING):

115

114

"""init logger and add loglevel"""

116

115

117

116

syslogger.setFormatter(logging.Formatter

119

118

' %(message)s'))

120

119

logger.addHandler(syslogger)

121

120

122

if debug:

123

console = logging.StreamHandler()

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

125

' [%(process)d]:'

126

' %(levelname)s:'

127

' %(message)s'))

128

logger.addHandler(console)

121

console = logging.StreamHandler()

122

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

123

' [%(process)d]:'

124

' %(levelname)s:'

125

' %(message)s'))

126

logger.addHandler(console)

129

127

logger.setLevel(level)

130

128

131

129

143

141

self.gnupg.options.meta_interactive = False

144

142

self.gnupg.options.homedir = self.tempdir

145

143

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

144

'--quiet'])

148

145

149

146

def __enter__(self):

150

147

return self

176

173

177

174

def encrypt(self, data, password):

178

175

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

176

with open(os.devnull) as devnull:

180

177

try:

181

178

proc = self.gnupg.run(['--symmetric'],

182

179

create_fhs=['stdin', 'stdout'],

193

190

194

191

def decrypt(self, data, password):

195

192

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

193

with open(os.devnull) as devnull:

197

194

try:

198

195

proc = self.gnupg.run(['--decrypt'],

199

196

create_fhs=['stdin', 'stdout'],

200

197

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

198

with contextlib.closing(proc.handles['stdin'] ) as f:

202

199

f.write(data)

203

200

with contextlib.closing(proc.handles['stdout']) as f:

204

201

decrypted_plaintext = f.read()

209

206

return decrypted_plaintext

210

207

211

208

209

212

210

class AvahiError(Exception):

213

211

def __init__(self, value, *args, **kwargs):

214

212

self.value = value

243

241

server: D-Bus Server

244

242

bus: dbus.SystemBus()

245

243

"""

246

247

244

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

245

servicetype = None, port = None, TXT = None,

249

246

domain = "", host = "", max_renames = 32768,

262

259

self.server = None

263

260

self.bus = bus

264

261

self.entry_group_state_changed_match = None

265

266

262

def rename(self):

267

263

"""Derived from the Avahi example code"""

268

264

if self.rename_count >= self.max_renames:

278

274

try:

279

275

self.add()

280

276

except dbus.exceptions.DBusException as error:

281

logger.critical("D-Bus Exception", exc_info=error)

277

logger.critical("DBusException: %s", error)

282

278

self.cleanup()

283

279

os._exit(1)

284

280

self.rename_count += 1

285

286

281

def remove(self):

287

282

"""Derived from the Avahi example code"""

288

283

if self.entry_group_state_changed_match is not None:

290

285

self.entry_group_state_changed_match = None

291

286

if self.group is not None:

292

287

self.group.Reset()

293

294

288

def add(self):

295

289

"""Derived from the Avahi example code"""

296

290

self.remove()

313

307

dbus.UInt16(self.port),

314

308

avahi.string_array_to_txt_array(self.TXT))

315

309

self.group.Commit()

316

317

310

def entry_group_state_changed(self, state, error):

318

311

"""Derived from the Avahi example code"""

319

312

logger.debug("Avahi entry group state change: %i", state)

326

319

elif state == avahi.ENTRY_GROUP_FAILURE:

327

320

logger.critical("Avahi: Error in group state changed %s",

328

321

unicode(error))

329

raise AvahiGroupError("State changed: {0!s}"

330

.format(error))

331

322

raise AvahiGroupError("State changed: %s"

323

% unicode(error))

332

324

def cleanup(self):

333

325

"""Derived from the Avahi example code"""

334

326

if self.group is not None:

339

331

pass

340

332

self.group = None

341

333

self.remove()

342

343

334

def server_state_changed(self, state, error=None):

344

335

"""Derived from the Avahi example code"""

345

336

logger.debug("Avahi server state change: %i", state)

364

355

logger.debug("Unknown state: %r", state)

365

356

else:

366

357

logger.debug("Unknown state: %r: %r", state, error)

367

368

358

def activate(self):

369

359

"""Derived from the Avahi example code"""

370

360

if self.server is None:

382

372

"""Add the new name to the syslog messages"""

383

373

ret = AvahiService.rename(self)

384

374

syslogger.setFormatter(logging.Formatter

385

('Mandos ({0}) [%(process)d]:'

386

' %(levelname)s: %(message)s'

387

.format(self.name)))

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

388

378

return ret

389

379

390

380

def timedelta_to_milliseconds(td):

392

382

return ((td.days * 24 * 60 * 60 * 1000)

393

383

+ (td.seconds * 1000)

394

384

+ (td.microseconds // 1000))

395

385

396

386

class Client(object):

397

387

"""A representation of a client host served by this server.

398

388

423

413

last_checked_ok: datetime.datetime(); (UTC) or None

424

414

last_checker_status: integer between 0 and 255 reflecting exit

425

415

status of last checker. -1 reflects crashed

426

checker, -2 means no checker completed yet.

416

checker, or None.

427

417

last_enabled: datetime.datetime(); (UTC) or None

428

418

name: string; from the config file, used in log messages and

429

419

D-Bus identifiers

430

420

secret: bytestring; sent verbatim (over TLS) to client

431

421

timeout: datetime.timedelta(); How long from last_checked_ok

432

422

until this client is disabled

433

extended_timeout: extra long timeout when secret has been sent

423

extended_timeout: extra long timeout when password has been sent

434

424

runtime_expansions: Allowed attributes for runtime expansion.

435

425

expires: datetime.datetime(); time (UTC) when a client will be

436

426

disabled, or None

465

455

466

456

def approval_delay_milliseconds(self):

467

457

return timedelta_to_milliseconds(self.approval_delay)

468

458

469

459

@staticmethod

470

460

def config_parser(config):

471

"""Construct a new dict of client settings of this form:

461

""" Construct a new dict of client settings of this form:

472

462

{ client_name: {setting_name: value, ...}, ...}

473

with exceptions for any special settings as defined above.

474

NOTE: Must be a pure function. Must return the same result

475

value given the same arguments.

476

"""

463

with exceptions for any special settings as defined above"""

477

464

settings = {}

478

465

for client_name in config.sections():

479

466

section = dict(config.items(client_name))

483

470

# Reformat values from string types to Python types

484

471

client["approved_by_default"] = config.getboolean(

485

472

client_name, "approved_by_default")

486

client["enabled"] = config.getboolean(client_name,

487

"enabled")

473

client["enabled"] = config.getboolean(client_name, "enabled")

488

474

489

475

client["fingerprint"] = (section["fingerprint"].upper()

490

476

.replace(" ", ""))

496

482

"rb") as secfile:

497

483

client["secret"] = secfile.read()

498

484

else:

499

raise TypeError("No secret or secfile for section {0}"

500

.format(section))

485

raise TypeError("No secret or secfile for section %s"

486

% section)

501

487

client["timeout"] = string_to_delta(section["timeout"])

502

488

client["extended_timeout"] = string_to_delta(

503

489

section["extended_timeout"])

509

495

client["checker_command"] = section["checker"]

510

496

client["last_approval_request"] = None

511

497

client["last_checked_ok"] = None

512

client["last_checker_status"] = -2

513

498

client["last_checker_status"] = None

499

if client["enabled"]:

500

client["last_enabled"] = datetime.datetime.utcnow()

501

client["expires"] = (datetime.datetime.utcnow()

502

+ client["timeout"])

503

else:

504

client["last_enabled"] = None

505

client["expires"] = None

506

514

507

return settings

515

508

509

516

510

def __init__(self, settings, name = None):

511

"""Note: the 'checker' key in 'config' sets the

512

'checker_command' attribute and *not* the 'checker'

513

attribute."""

517

514

self.name = name

518

515

# adding all client settings

519

516

for setting, value in settings.iteritems():

520

517

setattr(self, setting, value)

521

518

522

if self.enabled:

523

if not hasattr(self, "last_enabled"):

524

self.last_enabled = datetime.datetime.utcnow()

525

if not hasattr(self, "expires"):

526

self.expires = (datetime.datetime.utcnow()

527

+ self.timeout)

528

else:

529

self.last_enabled = None

530

self.expires = None

531

532

519

logger.debug("Creating client %r", self.name)

533

520

# Uppercase and remove spaces from fingerprint for later

534

521

# comparison purposes with return value from the fingerprint()

535

522

# function

536

523

logger.debug(" Fingerprint: %s", self.fingerprint)

537

self.created = settings.get("created",

538

datetime.datetime.utcnow())

539

524

self.created = settings.get("created", datetime.datetime.utcnow())

525

540

526

# attributes specific for this server instance

541

527

self.checker = None

542

528

self.checker_initiator_tag = None

630

616

logger.warning("Checker for %(name)s crashed?",

631

617

vars(self))

632

618

633

def checked_ok(self):

634

"""Assert that the client has been seen, alive and well."""

635

self.last_checked_ok = datetime.datetime.utcnow()

636

self.last_checker_status = 0

637

self.bump_timeout()

638

639

def bump_timeout(self, timeout=None):

640

"""Bump up the timeout for this client."""

619

def checked_ok(self, timeout=None):

620

"""Bump up the timeout for this client.

621

622

This should only be called when the client has been seen,

623

alive and well.

624

"""

641

625

if timeout is None:

642

626

timeout = self.timeout

627

self.last_checked_ok = datetime.datetime.utcnow()

643

628

if self.disable_initiator_tag is not None:

644

629

gobject.source_remove(self.disable_initiator_tag)

645

630

if getattr(self, "enabled", False):

696

681

try:

697

682

command = self.checker_command % escaped_attrs

698

683

except TypeError as error:

699

logger.error('Could not format string "%s"',

700

self.checker_command, exc_info=error)

684

logger.error('Could not format string "%s":'

685

' %s', self.checker_command, error)

701

686

return True # Try again later

702

687

self.current_checker_command = command

703

688

try:

721

706

gobject.source_remove(self.checker_callback_tag)

722

707

self.checker_callback(pid, status, command)

723

708

except OSError as error:

724

logger.error("Failed to start subprocess",

725

exc_info=error)

709

logger.error("Failed to start subprocess: %s",

710

error)

726

711

# Re-run this periodically if run by gobject.timeout_add

727

712

return True

728

713

735

720

return

736

721

logger.debug("Stopping checker for %(name)s", vars(self))

737

722

try:

738

self.checker.terminate()

723

os.kill(self.checker.pid, signal.SIGTERM)

739

724

#time.sleep(0.5)

740

725

#if self.checker.poll() is None:

741

# self.checker.kill()

726

# os.kill(self.checker.pid, signal.SIGKILL)

742

727

except OSError as error:

743

728

if error.errno != errno.ESRCH: # No such process

744

729

raise

761

746

# "Set" method, so we fail early here:

762

747

if byte_arrays and signature != "ay":

763

748

raise ValueError("Byte arrays not supported for non-'ay'"

764

" signature {0!r}".format(signature))

749

" signature %r" % signature)

765

750

def decorator(func):

766

751

func._dbus_is_property = True

767

752

func._dbus_interface = dbus_interface

775

760

return decorator

776

761

777

762

778

def dbus_interface_annotations(dbus_interface):

779

"""Decorator for marking functions returning interface annotations

780

781

Usage:

782

783

@dbus_interface_annotations("org.example.Interface")

784

def _foo(self): # Function name does not matter

785

return {"org.freedesktop.DBus.Deprecated": "true",

786

"org.freedesktop.DBus.Property.EmitsChangedSignal":

787

"false"}

788

"""

789

def decorator(func):

790

func._dbus_is_interface = True

791

func._dbus_interface = dbus_interface

792

func._dbus_name = dbus_interface

793

return func

794

return decorator

795

796

797

def dbus_annotations(annotations):

798

"""Decorator to annotate D-Bus methods, signals or properties

799

Usage:

800

801

@dbus_service_property("org.example.Interface", signature="b",

802

access="r")

803

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

804

"org.freedesktop.DBus.Property."

805

"EmitsChangedSignal": "false"})

806

def Property_dbus_property(self):

807

return dbus.Boolean(False)

808

"""

809

def decorator(func):

810

func._dbus_annotations = annotations

811

return func

812

return decorator

813

814

815

763

class DBusPropertyException(dbus.exceptions.DBusException):

816

764

"""A base class for D-Bus property-related exceptions

817

765

"""

840

788

"""

841

789

842

790

@staticmethod

843

def _is_dbus_thing(thing):

844

"""Returns a function testing if an attribute is a D-Bus thing

845

846

If called like _is_dbus_thing("method") it returns a function

847

suitable for use as predicate to inspect.getmembers().

848

"""

849

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

850

False)

791

def _is_dbus_property(obj):

792

return getattr(obj, "_dbus_is_property", False)

851

793

852

def _get_all_dbus_things(self, thing):

794

def _get_all_dbus_properties(self):

853

795

"""Returns a generator of (name, attribute) pairs

854

796

"""

855

return ((getattr(athing.__get__(self), "_dbus_name",

856

name),

857

athing.__get__(self))

797

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

858

798

for cls in self.__class__.__mro__

859

for name, athing in

860

inspect.getmembers(cls,

861

self._is_dbus_thing(thing)))

799

for name, prop in

800

inspect.getmembers(cls, self._is_dbus_property))

862

801

863

802

def _get_dbus_property(self, interface_name, property_name):

864

803

"""Returns a bound method if one exists which is a D-Bus

866

805

"""

867

806

for cls in self.__class__.__mro__:

868

807

for name, value in (inspect.getmembers

869

(cls,

870

self._is_dbus_thing("property"))):

808

(cls, self._is_dbus_property)):

871

809

if (value._dbus_name == property_name

872

810

and value._dbus_interface == interface_name):

873

811

return value.__get__(self)

902

840

# signatures other than "ay".

903

841

if prop._dbus_signature != "ay":

904

842

raise ValueError

905

value = dbus.ByteArray(b''.join(chr(byte)

906

for byte in value))

843

value = dbus.ByteArray(''.join(unichr(byte)

844

for byte in value))

907

845

prop(value)

908

846

909

847

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

915

853

Note: Will not include properties with access="write".

916

854

"""

917

855

properties = {}

918

for name, prop in self._get_all_dbus_things("property"):

856

for name, prop in self._get_all_dbus_properties():

919

857

if (interface_name

920

858

and interface_name != prop._dbus_interface):

921

859

# Interface non-empty but did not match

936

874

path_keyword='object_path',

937

875

connection_keyword='connection')

938

876

def Introspect(self, object_path, connection):

939

"""Overloading of standard D-Bus method.

940

941

Inserts property tags and interface annotation tags.

877

"""Standard D-Bus method, overloaded to insert property tags.

942

878

"""

943

879

xmlstring = dbus.service.Object.Introspect(self, object_path,

944

880

connection)

951

887

e.setAttribute("access", prop._dbus_access)

952

888

return e

953

889

for if_tag in document.getElementsByTagName("interface"):

954

# Add property tags

955

890

for tag in (make_tag(document, name, prop)

956

891

for name, prop

957

in self._get_all_dbus_things("property")

892

in self._get_all_dbus_properties()

958

893

if prop._dbus_interface

959

894

== if_tag.getAttribute("name")):

960

895

if_tag.appendChild(tag)

961

# Add annotation tags

962

for typ in ("method", "signal", "property"):

963

for tag in if_tag.getElementsByTagName(typ):

964

annots = dict()

965

for name, prop in (self.

966

_get_all_dbus_things(typ)):

967

if (name == tag.getAttribute("name")

968

and prop._dbus_interface

969

== if_tag.getAttribute("name")):

970

annots.update(getattr

971

(prop,

972

"_dbus_annotations",

973

{}))

974

for name, value in annots.iteritems():

975

ann_tag = document.createElement(

976

"annotation")

977

ann_tag.setAttribute("name", name)

978

ann_tag.setAttribute("value", value)

979

tag.appendChild(ann_tag)

980

# Add interface annotation tags

981

for annotation, value in dict(

982

itertools.chain(

983

*(annotations().iteritems()

984

for name, annotations in

985

self._get_all_dbus_things("interface")

986

if name == if_tag.getAttribute("name")

987

))).iteritems():

988

ann_tag = document.createElement("annotation")

989

ann_tag.setAttribute("name", annotation)

990

ann_tag.setAttribute("value", value)

991

if_tag.appendChild(ann_tag)

992

896

# Add the names to the return values for the

993

897

# "org.freedesktop.DBus.Properties" methods

994

898

if (if_tag.getAttribute("name")

1009

913

except (AttributeError, xml.dom.DOMException,

1010

914

xml.parsers.expat.ExpatError) as error:

1011

915

logger.error("Failed to override Introspection method",

1012

exc_info=error)

916

error)

1013

917

return xmlstring

1014

918

1015

919

1029

933

def __new__(mcs, name, bases, attr):

1030

934

# Go through all the base classes which could have D-Bus

1031

935

# methods, signals, or properties in them

1032

old_interface_names = []

1033

936

for base in (b for b in bases

1034

937

if issubclass(b, dbus.service.Object)):

1035

938

# Go though all attributes of the base class

1045

948

alt_interface = (attribute._dbus_interface

1046

949

.replace("se.recompile.Mandos",

1047

950

"se.bsnet.fukt.Mandos"))

1048

if alt_interface != attribute._dbus_interface:

1049

old_interface_names.append(alt_interface)

1050

951

# Is this a D-Bus signal?

1051

952

if getattr(attribute, "_dbus_is_signal", False):

1052

953

# Extract the original non-method function by

1067

968

nonmethod_func.func_name,

1068

969

nonmethod_func.func_defaults,

1069

970

nonmethod_func.func_closure)))

1070

# Copy annotations, if any

1071

try:

1072

new_function._dbus_annotations = (

1073

dict(attribute._dbus_annotations))

1074

except AttributeError:

1075

pass

1076

971

# Define a creator of a function to call both the

1077

972

# old and new functions, so both the old and new

1078

973

# signals gets sent when the function is called

1106

1001

attribute.func_name,

1107

1002

attribute.func_defaults,

1108

1003

attribute.func_closure)))

1109

# Copy annotations, if any

1110

try:

1111

attr[attrname]._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1113

except AttributeError:

1114

pass

1115

1004

# Is this a D-Bus property?

1116

1005

elif getattr(attribute, "_dbus_is_property", False):

1117

1006

# Create a new, but exactly alike, function

1131

1020

attribute.func_name,

1132

1021

attribute.func_defaults,

1133

1022

attribute.func_closure)))

1134

# Copy annotations, if any

1135

try:

1136

attr[attrname]._dbus_annotations = (

1137

dict(attribute._dbus_annotations))

1138

except AttributeError:

1139

pass

1140

# Is this a D-Bus interface?

1141

elif getattr(attribute, "_dbus_is_interface", False):

1142

# Create a new, but exactly alike, function

1143

# object. Decorate it to be a new D-Bus interface

1144

# with the alternate D-Bus interface name. Add it

1145

# to the class.

1146

attr[attrname] = (dbus_interface_annotations

1147

(alt_interface)

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1154

# Deprecate all old interfaces

1155

iname="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1156

for old_interface_name in old_interface_names:

1157

@dbus_interface_annotations(old_interface_name)

1158

def func(self):

1159

return { "org.freedesktop.DBus.Deprecated": "true" }

1160

# Find an unused name

1161

for aname in (iname.format(i) for i in itertools.count()):

1162

if aname not in attr:

1163

attr[aname] = func

1164

break

1165

1023

return type.__new__(mcs, name, bases, attr)

1166

1024

1167

1025

1181

1039

def __init__(self, bus = None, *args, **kwargs):

1182

1040

self.bus = bus

1183

1041

Client.__init__(self, *args, **kwargs)

1042

self._approvals_pending = 0

1043

1044

self._approvals_pending = 0

1184

1045

# Only now, when this client is initialized, can it show up on

1185

1046

# the D-Bus

1186

1047

client_object_name = unicode(self.name).translate(

1190

1051

("/clients/" + client_object_name))

1191

1052

DBusObjectWithProperties.__init__(self, self.bus,

1192

1053

self.dbus_object_path)

1193

1054

1194

1055

def notifychangeproperty(transform_func,

1195

1056

dbus_name, type_func=lambda x: x,

1196

1057

variant_level=1):

1219

1080

1220

1081

return property(lambda self: getattr(self, attrname), setter)

1221

1082

1083

1222

1084

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1223

1085

approvals_pending = notifychangeproperty(dbus.Boolean,

1224

1086

"ApprovalPending",

1231

1093

checker is not None)

1232

1094

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1233

1095

"LastCheckedOK")

1234

last_checker_status = notifychangeproperty(dbus.Int16,

1235

"LastCheckerStatus")

1236

1096

last_approval_request = notifychangeproperty(

1237

1097

datetime_to_dbus, "LastApprovalRequest")

1238

1098

approved_by_default = notifychangeproperty(dbus.Boolean,

1312

1172

(self.approval_duration),

1313

1173

self._reset_approved)

1314

1174

1175

1315

1176

## D-Bus methods, signals & properties

1316

1177

_interface = "se.recompile.Mandos.Client"

1317

1178

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1325

1179

## Signals

1326

1180

1327

1181

# CheckerCompleted - signal

1363

1217

"D-Bus signal"

1364

1218

return self.need_approval()

1365

1219

1220

# NeRwequest - signal

1221

@dbus.service.signal(_interface, signature="s")

1222

def NewRequest(self, ip):

1223

"""D-Bus signal

1224

Is sent after a client request a password.

1225

"""

1226

pass

1227

1366

1228

## Methods

1367

1229

1368

1230

# Approve - method

1478

1340

return

1479

1341

return datetime_to_dbus(self.last_checked_ok)

1480

1342

1481

# LastCheckerStatus - property

1482

@dbus_service_property(_interface, signature="n",

1483

access="read")

1484

def LastCheckerStatus_dbus_property(self):

1485

return dbus.Int16(self.last_checker_status)

1486

1487

1343

# Expires - property

1488

1344

@dbus_service_property(_interface, signature="s", access="read")

1489

1345

def Expires_dbus_property(self):

1501

1357

if value is None: # get

1502

1358

return dbus.UInt64(self.timeout_milliseconds())

1503

1359

self.timeout = datetime.timedelta(0, 0, 0, value)

1360

if getattr(self, "disable_initiator_tag", None) is None:

1361

return

1504

1362

# Reschedule timeout

1505

if self.enabled:

1506

now = datetime.datetime.utcnow()

1507

time_to_die = timedelta_to_milliseconds(

1508

(self.last_checked_ok + self.timeout) - now)

1509

if time_to_die <= 0:

1510

# The timeout has passed

1511

self.disable()

1512

else:

1513

self.expires = (now +

1514

datetime.timedelta(milliseconds =

1515

time_to_die))

1516

if (getattr(self, "disable_initiator_tag", None)

1517

is None):

1518

return

1519

gobject.source_remove(self.disable_initiator_tag)

1520

self.disable_initiator_tag = (gobject.timeout_add

1521

(time_to_die,

1522

self.disable))

1363

gobject.source_remove(self.disable_initiator_tag)

1364

self.disable_initiator_tag = None

1365

self.expires = None

1366

time_to_die = timedelta_to_milliseconds((self

1367

.last_checked_ok

1368

+ self.timeout)

1369

- datetime.datetime

1370

.utcnow())

1371

if time_to_die <= 0:

1372

# The timeout has passed

1373

self.disable()

1374

else:

1375

self.expires = (datetime.datetime.utcnow()

1376

+ datetime.timedelta(milliseconds =

1377

time_to_die))

1378

self.disable_initiator_tag = (gobject.timeout_add

1379

(time_to_die, self.disable))

1523

1380

1524

1381

# ExtendedTimeout - property

1525

1382

@dbus_service_property(_interface, signature="t",

1681

1538

except KeyError:

1682

1539

return

1683

1540

1541

if self.server.use_dbus:

1542

# Emit D-Bus signal

1543

client.NewRequest(str(self.client_address))

1544

1684

1545

if client.approval_delay:

1685

1546

delay = client.approval_delay

1686

1547

client.approvals_pending += 1

1741

1602

try:

1742

1603

sent = session.send(client.secret[sent_size:])

1743

1604

except gnutls.errors.GNUTLSError as error:

1744

logger.warning("gnutls send failed",

1745

exc_info=error)

1605

logger.warning("gnutls send failed")

1746

1606

return

1747

1607

logger.debug("Sent: %d, remaining: %d",

1748

1608

sent, len(client.secret)

1751

1611

1752

1612

logger.info("Sending secret to %s", client.name)

1753

1613

# bump the timeout using extended_timeout

1754

client.bump_timeout(client.extended_timeout)

1614

client.checked_ok(client.extended_timeout)

1755

1615

if self.server.use_dbus:

1756

1616

# Emit D-Bus signal

1757

1617

client.GotSecret()

1762

1622

try:

1763

1623

session.bye()

1764

1624

except gnutls.errors.GNUTLSError as error:

1765

logger.warning("GnuTLS bye failed",

1766

exc_info=error)

1625

logger.warning("GnuTLS bye failed")

1767

1626

1768

1627

@staticmethod

1769

1628

def peer_certificate(session):

2081

1940

elif suffix == "w":

2082

1941

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2083

1942

else:

2084

raise ValueError("Unknown suffix {0!r}"

2085

.format(suffix))

1943

raise ValueError("Unknown suffix %r" % suffix)

2086

1944

except (ValueError, IndexError) as e:

2087

1945

raise ValueError(*(e.args))

2088

1946

timevalue += delta

2102

1960

sys.exit()

2103

1961

if not noclose:

2104

1962

# Close all standard open file descriptors

2105

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1963

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2106

1964

if not stat.S_ISCHR(os.fstat(null).st_mode):

2107

1965

raise OSError(errno.ENODEV,

2108

"{0} not a character device"

2109

.format(os.devnull))

1966

"%s not a character device"

1967

% os.path.devnull)

2110

1968

os.dup2(null, sys.stdin.fileno())

2111

1969

os.dup2(null, sys.stdout.fileno())

2112

1970

os.dup2(null, sys.stderr.fileno())

2121

1979

2122

1980

parser = argparse.ArgumentParser()

2123

1981

parser.add_argument("-v", "--version", action="version",

2124

version = "%(prog)s {0}".format(version),

1982

version = "%%(prog)s %s" % version,

2125

1983

help="show version number and exit")

2126

1984

parser.add_argument("-i", "--interface", metavar="IF",

2127

1985

help="Bind to interface IF")

2220

2078

stored_state_file)

2221

2079

2222

2080

if debug:

2223

initlogger(debug, logging.DEBUG)

2081

initlogger(logging.DEBUG)

2224

2082

else:

2225

2083

if not debuglevel:

2226

initlogger(debug)

2084

initlogger()

2227

2085

else:

2228

2086

level = getattr(logging, debuglevel.upper())

2229

initlogger(debug, level)

2087

initlogger(level)

2230

2088

2231

2089

if server_settings["servicename"] != "Mandos":

2232

2090

syslogger.setFormatter(logging.Formatter

2233

('Mandos ({0}) [%(process)d]:'

2234

' %(levelname)s: %(message)s'

2235

.format(server_settings

2236

["servicename"])))

2091

('Mandos (%s) [%%(process)d]:'

2092

' %%(levelname)s: %%(message)s'

2093

% server_settings["servicename"]))

2237

2094

2238

2095

# Parse config file with clients

2239

client_config = configparser.SafeConfigParser(Client

2240

.client_defaults)

2096

client_config = configparser.SafeConfigParser(Client.client_defaults)

2241

2097

client_config.read(os.path.join(server_settings["configdir"],

2242

2098

"clients.conf"))

2243

2099

2257

2113

pidfilename = "/var/run/mandos.pid"

2258

2114

try:

2259

2115

pidfile = open(pidfilename, "w")

2260

except IOError as e:

2261

logger.error("Could not open file %r", pidfilename,

2262

exc_info=e)

2116

except IOError:

2117

logger.error("Could not open file %r", pidfilename)

2263

2118

2264

for name in ("_mandos", "mandos", "nobody"):

2119

try:

2120

uid = pwd.getpwnam("_mandos").pw_uid

2121

gid = pwd.getpwnam("_mandos").pw_gid

2122

except KeyError:

2265

2123

try:

2266

uid = pwd.getpwnam(name).pw_uid

2267

gid = pwd.getpwnam(name).pw_gid

2268

break

2124

uid = pwd.getpwnam("mandos").pw_uid

2125

gid = pwd.getpwnam("mandos").pw_gid

2269

2126

except KeyError:

2270

continue

2271

else:

2272

uid = 65534

2273

gid = 65534

2127

try:

2128

uid = pwd.getpwnam("nobody").pw_uid

2129

gid = pwd.getpwnam("nobody").pw_gid

2130

except KeyError:

2131

uid = 65534

2132

gid = 65534

2274

2133

try:

2275

2134

os.setgid(gid)

2276

2135

os.setuid(uid)

2293

2152

.gnutls_global_set_log_function(debug_gnutls))

2294

2153

2295

2154

# Redirect stdin so all checkers get /dev/null

2296

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2155

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2297

2156

os.dup2(null, sys.stdin.fileno())

2298

2157

if null > 2:

2299

2158

os.close(null)

2159

else:

2160

# No console logging

2161

logger.removeHandler(console)

2300

2162

2301

2163

# Need to fork before connecting to D-Bus

2302

2164

if not debug:

2303

2165

# Close all input and output, do double fork, etc.

2304

2166

daemon()

2305

2167

2306

gobject.threads_init()

2307

2308

2168

global main_loop

2309

2169

# From the Avahi example code

2310

DBusGMainLoop(set_as_default=True)

2170

DBusGMainLoop(set_as_default=True )

2311

2171

main_loop = gobject.MainLoop()

2312

2172

bus = dbus.SystemBus()

2313

2173

# End of Avahi example code

2319

2179

("se.bsnet.fukt.Mandos", bus,

2320

2180

do_not_queue=True))

2321

2181

except dbus.exceptions.NameExistsException as e:

2322

logger.error("Disabling D-Bus:", exc_info=e)

2182

logger.error(unicode(e) + ", disabling D-Bus")

2323

2183

use_dbus = False

2324

2184

server_settings["use_dbus"] = False

2325

2185

tcp_server.use_dbus = False

2352

2212

(stored_state))

2353

2213

os.remove(stored_state_path)

2354

2214

except IOError as e:

2355

if e.errno == errno.ENOENT:

2356

logger.warning("Could not load persistent state: {0}"

2357

.format(os.strerror(e.errno)))

2358

else:

2359

logger.critical("Could not load persistent state:",

2360

exc_info=e)

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2361

2218

raise

2362

except EOFError as e:

2363

logger.warning("Could not load persistent state: "

2364

"EOFError:", exc_info=e)

2365

2219

2366

2220

with PGPEngine() as pgp:

2367

2221

for client_name, client in clients_data.iteritems():

2384

2238

2385

2239

# Clients who has passed its expire date can still be

2386

2240

# enabled if its last checker was successful. Clients

2387

# whose checker succeeded before we stored its state is

2388

# assumed to have successfully run all checkers during

2389

# downtime.

2241

# whose checker failed before we stored its state is

2242

# assumed to have failed all checkers during downtime.

2390

2243

if client["enabled"]:

2391

2244

if datetime.datetime.utcnow() >= client["expires"]:

2392

2245

if not client["last_checked_ok"]:

2393

2246

logger.warning(

2394

2247

"disabling client {0} - Client never "

2395

"performed a successful checker"

2396

.format(client_name))

2248

"performed a successfull checker"

2249

.format(client["name"]))

2397

2250

client["enabled"] = False

2398

2251

elif client["last_checker_status"] != 0:

2399

2252

logger.warning(

2400

2253

"disabling client {0} - Client "

2401

2254

"last checker failed with error code {1}"

2402

.format(client_name,

2255

.format(client["name"],

2403

2256

client["last_checker_status"]))

2404

2257

client["enabled"] = False

2405

2258

else:

2406

2259

client["expires"] = (datetime.datetime

2407

2260

.utcnow()

2408

2261

+ client["timeout"])

2409

logger.debug("Last checker succeeded,"

2410

" keeping {0} enabled"

2411

.format(client_name))

2262

2412

2263

try:

2413

2264

client["secret"] = (

2414

2265

pgp.decrypt(client["encrypted_secret"],

2420

2271

.format(client_name))

2421

2272

client["secret"] = (

2422

2273

client_settings[client_name]["secret"])

2274

2423

2275

2424

2276

# Add/remove clients based on new changes made to config

2425

for client_name in (set(old_client_settings)

2426

- set(client_settings)):

2277

for client_name in set(old_client_settings) - set(client_settings):

2427

2278

del clients_data[client_name]

2428

for client_name in (set(client_settings)

2429

- set(old_client_settings)):

2279

for client_name in set(client_settings) - set(old_client_settings):

2430

2280

clients_data[client_name] = client_settings[client_name]

2431

2432

# Create all client objects

2281

2282

# Create clients all clients

2433

2283

for client_name, client in clients_data.iteritems():

2434

2284

tcp_server.clients[client_name] = client_class(

2435

2285

name = client_name, settings = client)

2436

2286

2437

2287

if not tcp_server.clients:

2438

2288

logger.warning("No clients defined")

2439

2289

2440

2290

if not debug:

2441

2291

try:

2442

2292

with pidfile:

2456

2306

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2457

2307

2458

2308

if use_dbus:

2459

class MandosDBusService(DBusObjectWithProperties):

2309

class MandosDBusService(dbus.service.Object):

2460

2310

"""A D-Bus proxy object"""

2461

2311

def __init__(self):

2462

2312

dbus.service.Object.__init__(self, bus, "/")

2463

2313

_interface = "se.recompile.Mandos"

2464

2314

2465

@dbus_interface_annotations(_interface)

2466

def _foo(self):

2467

return { "org.freedesktop.DBus.Property"

2468

".EmitsChangedSignal":

2469

"false"}

2470

2471

2315

@dbus.service.signal(_interface, signature="o")

2472

2316

def ClientAdded(self, objpath):

2473

2317

"D-Bus signal"

2556

2400

del client_settings[client.name]["secret"]

2557

2401

2558

2402

try:

2559

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2560

prefix="clients-",

2561

dir=os.path.dirname

2562

(stored_state_path))

2563

with os.fdopen(tempfd, "wb") as stored_state:

2403

with os.fdopen(os.open(stored_state_path,

2404

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2405

0600), "wb") as stored_state:

2564

2406

pickle.dump((clients, client_settings), stored_state)

2565

os.rename(tempname, stored_state_path)

2566

2407

except (IOError, OSError) as e:

2567

if not debug:

2568

try:

2569

os.remove(tempname)

2570

except NameError:

2571

pass

2572

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2573

logger.warning("Could not save persistent state: {0}"

2574

.format(os.strerror(e.errno)))

2575

else:

2576

logger.warning("Could not save persistent state:",

2577

exc_info=e)

2578

raise e

2408

logger.warning("Could not save persistent state: {0}"

2409

.format(e))

2410

if e.errno not in (errno.ENOENT, errno.EACCES):

2411

raise

2579

2412

2580

2413

# Delete all clients, and settings from config

2581

2414

while tcp_server.clients:

2608

2441

service.port = tcp_server.socket.getsockname()[1]

2609

2442

if use_ipv6:

2610

2443

logger.info("Now listening on address %r, port %d,"

2611

" flowinfo %d, scope_id %d",

2612

*tcp_server.socket.getsockname())

2444

" flowinfo %d, scope_id %d"

2445

% tcp_server.socket.getsockname())

2613

2446

else: # IPv4

2614

logger.info("Now listening on address %r, port %d",

2615

*tcp_server.socket.getsockname())

2447

logger.info("Now listening on address %r, port %d"

2448

% tcp_server.socket.getsockname())

2616

2449

2617

2450

#service.interface = tcp_server.socket.getsockname()[3]

2618

2451

2621

2454

try:

2622

2455

service.activate()

2623

2456

except dbus.exceptions.DBusException as error:

2624

logger.critical("D-Bus Exception", exc_info=error)

2457

logger.critical("DBusException: %s", error)

2625

2458

cleanup()

2626

2459

sys.exit(1)

2627

2460

# End of Avahi example code

2634

2467

logger.debug("Starting main loop")

2635

2468

main_loop.run()

2636

2469

except AvahiError as error:

2637

logger.critical("Avahi Error", exc_info=error)

2470

logger.critical("AvahiError: %s", error)

2638

2471

cleanup()

2639

2472

sys.exit(1)

2640

2473

except KeyboardInterrupt: