/mandos/trunk : revision 525

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

68

70

69

import dbus

71

70

import dbus.service

86

85

except ImportError:

87

86

SO_BINDTODEVICE = None

88

87

89

version = "1.5.3"

88

version = "1.4.1"

90

89

stored_state_file = "clients.pickle"

91

90

92

91

logger = logging.getLogger()

111

110

return interface_index

112

111

113

112

114

def initlogger(debug, level=logging.WARNING):

113

def initlogger(level=logging.WARNING):

115

114

"""init logger and add loglevel"""

116

115

117

116

syslogger.setFormatter(logging.Formatter

119

118

' %(message)s'))

120

119

logger.addHandler(syslogger)

121

120

122

if debug:

123

console = logging.StreamHandler()

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

125

' [%(process)d]:'

126

' %(levelname)s:'

127

' %(message)s'))

128

logger.addHandler(console)

121

console = logging.StreamHandler()

122

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

123

' [%(process)d]:'

124

' %(levelname)s:'

125

' %(message)s'))

126

logger.addHandler(console)

129

127

logger.setLevel(level)

130

128

131

129

143

141

self.gnupg.options.meta_interactive = False

144

142

self.gnupg.options.homedir = self.tempdir

145

143

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

144

'--quiet'])

148

145

149

146

def __enter__(self):

150

147

return self

176

173

177

174

def encrypt(self, data, password):

178

175

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

176

with open(os.devnull) as devnull:

180

177

try:

181

178

proc = self.gnupg.run(['--symmetric'],

182

179

create_fhs=['stdin', 'stdout'],

193

190

194

191

def decrypt(self, data, password):

195

192

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

193

with open(os.devnull) as devnull:

197

194

try:

198

195

proc = self.gnupg.run(['--decrypt'],

199

196

create_fhs=['stdin', 'stdout'],

200

197

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

198

with contextlib.closing(proc.handles['stdin'] ) as f:

202

199

f.write(data)

203

200

with contextlib.closing(proc.handles['stdout']) as f:

204

201

decrypted_plaintext = f.read()

209

206

return decrypted_plaintext

210

207

211

208

209

212

210

class AvahiError(Exception):

213

211

def __init__(self, value, *args, **kwargs):

214

212

self.value = value

243

241

server: D-Bus Server

244

242

bus: dbus.SystemBus()

245

243

"""

246

247

244

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

245

servicetype = None, port = None, TXT = None,

249

246

domain = "", host = "", max_renames = 32768,

262

259

self.server = None

263

260

self.bus = bus

264

261

self.entry_group_state_changed_match = None

265

266

262

def rename(self):

267

263

"""Derived from the Avahi example code"""

268

264

if self.rename_count >= self.max_renames:

278

274

try:

279

275

self.add()

280

276

except dbus.exceptions.DBusException as error:

281

logger.critical("D-Bus Exception", exc_info=error)

277

logger.critical("DBusException: %s", error)

282

278

self.cleanup()

283

279

os._exit(1)

284

280

self.rename_count += 1

285

286

281

def remove(self):

287

282

"""Derived from the Avahi example code"""

288

283

if self.entry_group_state_changed_match is not None:

290

285

self.entry_group_state_changed_match = None

291

286

if self.group is not None:

292

287

self.group.Reset()

293

294

288

def add(self):

295

289

"""Derived from the Avahi example code"""

296

290

self.remove()

313

307

dbus.UInt16(self.port),

314

308

avahi.string_array_to_txt_array(self.TXT))

315

309

self.group.Commit()

316

317

310

def entry_group_state_changed(self, state, error):

318

311

"""Derived from the Avahi example code"""

319

312

logger.debug("Avahi entry group state change: %i", state)

326

319

elif state == avahi.ENTRY_GROUP_FAILURE:

327

320

logger.critical("Avahi: Error in group state changed %s",

328

321

unicode(error))

329

raise AvahiGroupError("State changed: {0!s}"

330

.format(error))

331

322

raise AvahiGroupError("State changed: %s"

323

% unicode(error))

332

324

def cleanup(self):

333

325

"""Derived from the Avahi example code"""

334

326

if self.group is not None:

339

331

pass

340

332

self.group = None

341

333

self.remove()

342

343

334

def server_state_changed(self, state, error=None):

344

335

"""Derived from the Avahi example code"""

345

336

logger.debug("Avahi server state change: %i", state)

364

355

logger.debug("Unknown state: %r", state)

365

356

else:

366

357

logger.debug("Unknown state: %r: %r", state, error)

367

368

358

def activate(self):

369

359

"""Derived from the Avahi example code"""

370

360

if self.server is None:

382

372

"""Add the new name to the syslog messages"""

383

373

ret = AvahiService.rename(self)

384

374

syslogger.setFormatter(logging.Formatter

385

('Mandos ({0}) [%(process)d]:'

386

' %(levelname)s: %(message)s'

387

.format(self.name)))

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

388

378

return ret

389

379

390

380

def timedelta_to_milliseconds(td):

392

382

return ((td.days * 24 * 60 * 60 * 1000)

393

383

+ (td.seconds * 1000)

394

384

+ (td.microseconds // 1000))

395

385

396

386

class Client(object):

397

387

"""A representation of a client host served by this server.

398

388

423

413

last_checked_ok: datetime.datetime(); (UTC) or None

424

414

last_checker_status: integer between 0 and 255 reflecting exit

425

415

status of last checker. -1 reflects crashed

426

checker, -2 means no checker completed yet.

416

checker, or None.

427

417

last_enabled: datetime.datetime(); (UTC) or None

428

418

name: string; from the config file, used in log messages and

429

419

D-Bus identifiers

430

420

secret: bytestring; sent verbatim (over TLS) to client

431

421

timeout: datetime.timedelta(); How long from last_checked_ok

432

422

until this client is disabled

433

extended_timeout: extra long timeout when secret has been sent

423

extended_timeout: extra long timeout when password has been sent

434

424

runtime_expansions: Allowed attributes for runtime expansion.

435

425

expires: datetime.datetime(); time (UTC) when a client will be

436

426

disabled, or None

465

455

466

456

def approval_delay_milliseconds(self):

467

457

return timedelta_to_milliseconds(self.approval_delay)

468

458

469

459

@staticmethod

470

460

def config_parser(config):

471

"""Construct a new dict of client settings of this form:

461

""" Construct a new dict of client settings of this form:

472

462

{ client_name: {setting_name: value, ...}, ...}

473

with exceptions for any special settings as defined above.

474

NOTE: Must be a pure function. Must return the same result

475

value given the same arguments.

476

"""

463

with exceptions for any special settings as defined above"""

477

464

settings = {}

478

465

for client_name in config.sections():

479

466

section = dict(config.items(client_name))

483

470

# Reformat values from string types to Python types

484

471

client["approved_by_default"] = config.getboolean(

485

472

client_name, "approved_by_default")

486

client["enabled"] = config.getboolean(client_name,

487

"enabled")

473

client["enabled"] = config.getboolean(client_name, "enabled")

488

474

489

475

client["fingerprint"] = (section["fingerprint"].upper()

490

476

.replace(" ", ""))

496

482

"rb") as secfile:

497

483

client["secret"] = secfile.read()

498

484

else:

499

raise TypeError("No secret or secfile for section {0}"

500

.format(section))

485

raise TypeError("No secret or secfile for section %s"

486

% section)

501

487

client["timeout"] = string_to_delta(section["timeout"])

502

488

client["extended_timeout"] = string_to_delta(

503

489

section["extended_timeout"])

509

495

client["checker_command"] = section["checker"]

510

496

client["last_approval_request"] = None

511

497

client["last_checked_ok"] = None

512

client["last_checker_status"] = -2

513

498

client["last_checker_status"] = None

499

if client["enabled"]:

500

client["last_enabled"] = datetime.datetime.utcnow()

501

client["expires"] = (datetime.datetime.utcnow()

502

+ client["timeout"])

503

else:

504

client["last_enabled"] = None

505

client["expires"] = None

506

514

507

return settings

515

508

509

516

510

def __init__(self, settings, name = None):

511

"""Note: the 'checker' key in 'config' sets the

512

'checker_command' attribute and *not* the 'checker'

513

attribute."""

517

514

self.name = name

518

515

# adding all client settings

519

516

for setting, value in settings.iteritems():

520

517

setattr(self, setting, value)

521

518

522

if self.enabled:

523

if not hasattr(self, "last_enabled"):

524

self.last_enabled = datetime.datetime.utcnow()

525

if not hasattr(self, "expires"):

526

self.expires = (datetime.datetime.utcnow()

527

+ self.timeout)

528

else:

529

self.last_enabled = None

530

self.expires = None

531

532

519

logger.debug("Creating client %r", self.name)

533

520

# Uppercase and remove spaces from fingerprint for later

534

521

# comparison purposes with return value from the fingerprint()

535

522

# function

536

523

logger.debug(" Fingerprint: %s", self.fingerprint)

537

self.created = settings.get("created",

538

datetime.datetime.utcnow())

539

524

self.created = settings.get("created", datetime.datetime.utcnow())

525

540

526

# attributes specific for this server instance

541

527

self.checker = None

542

528

self.checker_initiator_tag = None

630

616

logger.warning("Checker for %(name)s crashed?",

631

617

vars(self))

632

618

633

def checked_ok(self):

634

"""Assert that the client has been seen, alive and well."""

635

self.last_checked_ok = datetime.datetime.utcnow()

636

self.last_checker_status = 0

637

self.bump_timeout()

638

639

def bump_timeout(self, timeout=None):

640

"""Bump up the timeout for this client."""

619

def checked_ok(self, timeout=None):

620

"""Bump up the timeout for this client.

621

622

This should only be called when the client has been seen,

623

alive and well.

624

"""

641

625

if timeout is None:

642

626

timeout = self.timeout

627

self.last_checked_ok = datetime.datetime.utcnow()

643

628

if self.disable_initiator_tag is not None:

644

629

gobject.source_remove(self.disable_initiator_tag)

645

630

if getattr(self, "enabled", False):

696

681

try:

697

682

command = self.checker_command % escaped_attrs

698

683

except TypeError as error:

699

logger.error('Could not format string "%s"',

700

self.checker_command, exc_info=error)

684

logger.error('Could not format string "%s":'

685

' %s', self.checker_command, error)

701

686

return True # Try again later

702

687

self.current_checker_command = command

703

688

try:

721

706

gobject.source_remove(self.checker_callback_tag)

722

707

self.checker_callback(pid, status, command)

723

708

except OSError as error:

724

logger.error("Failed to start subprocess",

725

exc_info=error)

709

logger.error("Failed to start subprocess: %s",

710

error)

726

711

# Re-run this periodically if run by gobject.timeout_add

727

712

return True

728

713

735

720

return

736

721

logger.debug("Stopping checker for %(name)s", vars(self))

737

722

try:

738

self.checker.terminate()

723

os.kill(self.checker.pid, signal.SIGTERM)

739

724

#time.sleep(0.5)

740

725

#if self.checker.poll() is None:

741

# self.checker.kill()

726

# os.kill(self.checker.pid, signal.SIGKILL)

742

727

except OSError as error:

743

728

if error.errno != errno.ESRCH: # No such process

744

729

raise

761

746

# "Set" method, so we fail early here:

762

747

if byte_arrays and signature != "ay":

763

748

raise ValueError("Byte arrays not supported for non-'ay'"

764

" signature {0!r}".format(signature))

749

" signature %r" % signature)

765

750

def decorator(func):

766

751

func._dbus_is_property = True

767

752

func._dbus_interface = dbus_interface

775

760

return decorator

776

761

777

762

778

def dbus_interface_annotations(dbus_interface):

779

"""Decorator for marking functions returning interface annotations

780

781

Usage:

782

783

@dbus_interface_annotations("org.example.Interface")

784

def _foo(self): # Function name does not matter

785

return {"org.freedesktop.DBus.Deprecated": "true",

786

"org.freedesktop.DBus.Property.EmitsChangedSignal":

787

"false"}

788

"""

789

def decorator(func):

790

func._dbus_is_interface = True

791

func._dbus_interface = dbus_interface

792

func._dbus_name = dbus_interface

793

return func

794

return decorator

795

796

797

def dbus_annotations(annotations):

798

"""Decorator to annotate D-Bus methods, signals or properties

799

Usage:

800

801

@dbus_service_property("org.example.Interface", signature="b",

802

access="r")

803

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

804

"org.freedesktop.DBus.Property."

805

"EmitsChangedSignal": "false"})

806

def Property_dbus_property(self):

807

return dbus.Boolean(False)

808

"""

809

def decorator(func):

810

func._dbus_annotations = annotations

811

return func

812

return decorator

813

814

815

763

class DBusPropertyException(dbus.exceptions.DBusException):

816

764

"""A base class for D-Bus property-related exceptions

817

765

"""

840

788

"""

841

789

842

790

@staticmethod

843

def _is_dbus_thing(thing):

844

"""Returns a function testing if an attribute is a D-Bus thing

845

846

If called like _is_dbus_thing("method") it returns a function

847

suitable for use as predicate to inspect.getmembers().

848

"""

849

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

850

False)

791

def _is_dbus_property(obj):

792

return getattr(obj, "_dbus_is_property", False)

851

793

852

def _get_all_dbus_things(self, thing):

794

def _get_all_dbus_properties(self):

853

795

"""Returns a generator of (name, attribute) pairs

854

796

"""

855

return ((getattr(athing.__get__(self), "_dbus_name",

856

name),

857

athing.__get__(self))

797

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

858

798

for cls in self.__class__.__mro__

859

for name, athing in

860

inspect.getmembers(cls,

861

self._is_dbus_thing(thing)))

799

for name, prop in

800

inspect.getmembers(cls, self._is_dbus_property))

862

801

863

802

def _get_dbus_property(self, interface_name, property_name):

864

803

"""Returns a bound method if one exists which is a D-Bus

866

805

"""

867

806

for cls in self.__class__.__mro__:

868

807

for name, value in (inspect.getmembers

869

(cls,

870

self._is_dbus_thing("property"))):

808

(cls, self._is_dbus_property)):

871

809

if (value._dbus_name == property_name

872

810

and value._dbus_interface == interface_name):

873

811

return value.__get__(self)

902

840

# signatures other than "ay".

903

841

if prop._dbus_signature != "ay":

904

842

raise ValueError

905

value = dbus.ByteArray(b''.join(chr(byte)

906

for byte in value))

843

value = dbus.ByteArray(''.join(unichr(byte)

844

for byte in value))

907

845

prop(value)

908

846

909

847

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

915

853

Note: Will not include properties with access="write".

916

854

"""

917

855

properties = {}

918

for name, prop in self._get_all_dbus_things("property"):

856

for name, prop in self._get_all_dbus_properties():

919

857

if (interface_name

920

858

and interface_name != prop._dbus_interface):

921

859

# Interface non-empty but did not match

936

874

path_keyword='object_path',

937

875

connection_keyword='connection')

938

876

def Introspect(self, object_path, connection):

939

"""Overloading of standard D-Bus method.

940

941

Inserts property tags and interface annotation tags.

877

"""Standard D-Bus method, overloaded to insert property tags.

942

878

"""

943

879

xmlstring = dbus.service.Object.Introspect(self, object_path,

944

880

connection)

951

887

e.setAttribute("access", prop._dbus_access)

952

888

return e

953

889

for if_tag in document.getElementsByTagName("interface"):

954

# Add property tags

955

890

for tag in (make_tag(document, name, prop)

956

891

for name, prop

957

in self._get_all_dbus_things("property")

892

in self._get_all_dbus_properties()

958

893

if prop._dbus_interface

959

894

== if_tag.getAttribute("name")):

960

895

if_tag.appendChild(tag)

961

# Add annotation tags

962

for typ in ("method", "signal", "property"):

963

for tag in if_tag.getElementsByTagName(typ):

964

annots = dict()

965

for name, prop in (self.

966

_get_all_dbus_things(typ)):

967

if (name == tag.getAttribute("name")

968

and prop._dbus_interface

969

== if_tag.getAttribute("name")):

970

annots.update(getattr

971

(prop,

972

"_dbus_annotations",

973

{}))

974

for name, value in annots.iteritems():

975

ann_tag = document.createElement(

976

"annotation")

977

ann_tag.setAttribute("name", name)

978

ann_tag.setAttribute("value", value)

979

tag.appendChild(ann_tag)

980

# Add interface annotation tags

981

for annotation, value in dict(

982

itertools.chain(

983

*(annotations().iteritems()

984

for name, annotations in

985

self._get_all_dbus_things("interface")

986

if name == if_tag.getAttribute("name")

987

))).iteritems():

988

ann_tag = document.createElement("annotation")

989

ann_tag.setAttribute("name", annotation)

990

ann_tag.setAttribute("value", value)

991

if_tag.appendChild(ann_tag)

992

896

# Add the names to the return values for the

993

897

# "org.freedesktop.DBus.Properties" methods

994

898

if (if_tag.getAttribute("name")

1009

913

except (AttributeError, xml.dom.DOMException,

1010

914

xml.parsers.expat.ExpatError) as error:

1011

915

logger.error("Failed to override Introspection method",

1012

exc_info=error)

916

error)

1013

917

return xmlstring

1014

918

1015

919

1021

925

variant_level=variant_level)

1022

926

1023

927

1024

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1025

"""A class decorator; applied to a subclass of

1026

dbus.service.Object, it will add alternate D-Bus attributes with

1027

interface names according to the "alt_interface_names" mapping.

1028

Usage:

1029

1030

@alternate_dbus_names({"org.example.Interface":

1031

"net.example.AlternateInterface"})

1032

class SampleDBusObject(dbus.service.Object):

1033

@dbus.service.method("org.example.Interface")

1034

def SampleDBusMethod():

1035

pass

1036

1037

The above "SampleDBusMethod" on "SampleDBusObject" will be

1038

reachable via two interfaces: "org.example.Interface" and

1039

"net.example.AlternateInterface", the latter of which will have

1040

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1041

"true", unless "deprecate" is passed with a False value.

1042

1043

This works for methods and signals, and also for D-Bus properties

1044

(from DBusObjectWithProperties) and interfaces (from the

1045

dbus_interface_annotations decorator).

928

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

929

.__metaclass__):

930

"""Applied to an empty subclass of a D-Bus object, this metaclass

931

will add additional D-Bus attributes matching a certain pattern.

1046

932

"""

1047

def wrapper(cls):

1048

for orig_interface_name, alt_interface_name in (

1049

alt_interface_names.iteritems()):

1050

attr = {}

1051

interface_names = set()

1052

# Go though all attributes of the class

1053

for attrname, attribute in inspect.getmembers(cls):

933

def __new__(mcs, name, bases, attr):

934

# Go through all the base classes which could have D-Bus

935

# methods, signals, or properties in them

936

for base in (b for b in bases

937

if issubclass(b, dbus.service.Object)):

938

# Go though all attributes of the base class

939

for attrname, attribute in inspect.getmembers(base):

1054

940

# Ignore non-D-Bus attributes, and D-Bus attributes

1055

941

# with the wrong interface name

1056

942

if (not hasattr(attribute, "_dbus_interface")

1057

943

or not attribute._dbus_interface

1058

.startswith(orig_interface_name)):

944

.startswith("se.recompile.Mandos")):

1059

945

continue

1060

946

# Create an alternate D-Bus interface name based on

1061

947

# the current name

1062

948

alt_interface = (attribute._dbus_interface

1063

.replace(orig_interface_name,

1064

alt_interface_name))

1065

interface_names.add(alt_interface)

949

.replace("se.recompile.Mandos",

950

"se.bsnet.fukt.Mandos"))

1066

951

# Is this a D-Bus signal?

1067

952

if getattr(attribute, "_dbus_is_signal", False):

1068

953

# Extract the original non-method function by

1083

968

nonmethod_func.func_name,

1084

969

nonmethod_func.func_defaults,

1085

970

nonmethod_func.func_closure)))

1086

# Copy annotations, if any

1087

try:

1088

new_function._dbus_annotations = (

1089

dict(attribute._dbus_annotations))

1090

except AttributeError:

1091

pass

1092

971

# Define a creator of a function to call both the

1093

# original and alternate functions, so both the

1094

# original and alternate signals gets sent when

1095

# the function is called

972

# old and new functions, so both the old and new

973

# signals gets sent when the function is called

1096

974

def fixscope(func1, func2):

1097

975

"""This function is a scope container to pass

1098

976

func1 and func2 to the "call_both" function

1105

983

return call_both

1106

984

# Create the "call_both" function and add it to

1107

985

# the class

1108

attr[attrname] = fixscope(attribute, new_function)

986

attr[attrname] = fixscope(attribute,

987

new_function)

1109

988

# Is this a D-Bus method?

1110

989

elif getattr(attribute, "_dbus_is_method", False):

1111

990

# Create a new, but exactly alike, function

1122

1001

attribute.func_name,

1123

1002

attribute.func_defaults,

1124

1003

attribute.func_closure)))

1125

# Copy annotations, if any

1126

try:

1127

attr[attrname]._dbus_annotations = (

1128

dict(attribute._dbus_annotations))

1129

except AttributeError:

1130

pass

1131

1004

# Is this a D-Bus property?

1132

1005

elif getattr(attribute, "_dbus_is_property", False):

1133

1006

# Create a new, but exactly alike, function

1147

1020

attribute.func_name,

1148

1021

attribute.func_defaults,

1149

1022

attribute.func_closure)))

1150

# Copy annotations, if any

1151

try:

1152

attr[attrname]._dbus_annotations = (

1153

dict(attribute._dbus_annotations))

1154

except AttributeError:

1155

pass

1156

# Is this a D-Bus interface?

1157

elif getattr(attribute, "_dbus_is_interface", False):

1158

# Create a new, but exactly alike, function

1159

# object. Decorate it to be a new D-Bus interface

1160

# with the alternate D-Bus interface name. Add it

1161

# to the class.

1162

attr[attrname] = (dbus_interface_annotations

1163

(alt_interface)

1164

(types.FunctionType

1165

(attribute.func_code,

1166

attribute.func_globals,

1167

attribute.func_name,

1168

attribute.func_defaults,

1169

attribute.func_closure)))

1170

if deprecate:

1171

# Deprecate all alternate interfaces

1172

iname="_AlternateDBusNames_interface_annotation{0}"

1173

for interface_name in interface_names:

1174

@dbus_interface_annotations(interface_name)

1175

def func(self):

1176

return { "org.freedesktop.DBus.Deprecated":

1177

"true" }

1178

# Find an unused name

1179

for aname in (iname.format(i)

1180

for i in itertools.count()):

1181

if aname not in attr:

1182

attr[aname] = func

1183

break

1184

if interface_names:

1185

# Replace the class with a new subclass of it with

1186

# methods, signals, etc. as created above.

1187

cls = type(b"{0}Alternate".format(cls.__name__),

1188

(cls,), attr)

1189

return cls

1190

return wrapper

1191

1192

1193

@alternate_dbus_interfaces({"se.recompile.Mandos":

1194

"se.bsnet.fukt.Mandos"})

1023

return type.__new__(mcs, name, bases, attr)

1024

1025

1195

1026

class ClientDBus(Client, DBusObjectWithProperties):

1196

1027

"""A Client class using D-Bus

1197

1028

1208

1039

def __init__(self, bus = None, *args, **kwargs):

1209

1040

self.bus = bus

1210

1041

Client.__init__(self, *args, **kwargs)

1042

self._approvals_pending = 0

1043

1044

self._approvals_pending = 0

1211

1045

# Only now, when this client is initialized, can it show up on

1212

1046

# the D-Bus

1213

1047

client_object_name = unicode(self.name).translate(

1217

1051

("/clients/" + client_object_name))

1218

1052

DBusObjectWithProperties.__init__(self, self.bus,

1219

1053

self.dbus_object_path)

1220

1054

1221

1055

def notifychangeproperty(transform_func,

1222

1056

dbus_name, type_func=lambda x: x,

1223

1057

variant_level=1):

1246

1080

1247

1081

return property(lambda self: getattr(self, attrname), setter)

1248

1082

1083

1249

1084

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1250

1085

approvals_pending = notifychangeproperty(dbus.Boolean,

1251

1086

"ApprovalPending",

1258

1093

checker is not None)

1259

1094

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1260

1095

"LastCheckedOK")

1261

last_checker_status = notifychangeproperty(dbus.Int16,

1262

"LastCheckerStatus")

1263

1096

last_approval_request = notifychangeproperty(

1264

1097

datetime_to_dbus, "LastApprovalRequest")

1265

1098

approved_by_default = notifychangeproperty(dbus.Boolean,

1339

1172

(self.approval_duration),

1340

1173

self._reset_approved)

1341

1174

1175

1342

1176

## D-Bus methods, signals & properties

1343

1177

_interface = "se.recompile.Mandos.Client"

1344

1178

1345

## Interfaces

1346

1347

@dbus_interface_annotations(_interface)

1348

def _foo(self):

1349

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1350

"false"}

1351

1352

1179

## Signals

1353

1180

1354

1181

# CheckerCompleted - signal

1390

1217

"D-Bus signal"

1391

1218

return self.need_approval()

1392

1219

1220

# NeRwequest - signal

1221

@dbus.service.signal(_interface, signature="s")

1222

def NewRequest(self, ip):

1223

"""D-Bus signal

1224

Is sent after a client request a password.

1225

"""

1226

pass

1227

1393

1228

## Methods

1394

1229

1395

1230

# Approve - method

1505

1340

return

1506

1341

return datetime_to_dbus(self.last_checked_ok)

1507

1342

1508

# LastCheckerStatus - property

1509

@dbus_service_property(_interface, signature="n",

1510

access="read")

1511

def LastCheckerStatus_dbus_property(self):

1512

return dbus.Int16(self.last_checker_status)

1513

1514

1343

# Expires - property

1515

1344

@dbus_service_property(_interface, signature="s", access="read")

1516

1345

def Expires_dbus_property(self):

1528

1357

if value is None: # get

1529

1358

return dbus.UInt64(self.timeout_milliseconds())

1530

1359

self.timeout = datetime.timedelta(0, 0, 0, value)

1360

if getattr(self, "disable_initiator_tag", None) is None:

1361

return

1531

1362

# Reschedule timeout

1532

if self.enabled:

1533

now = datetime.datetime.utcnow()

1534

time_to_die = timedelta_to_milliseconds(

1535

(self.last_checked_ok + self.timeout) - now)

1536

if time_to_die <= 0:

1537

# The timeout has passed

1538

self.disable()

1539

else:

1540

self.expires = (now +

1541

datetime.timedelta(milliseconds =

1542

time_to_die))

1543

if (getattr(self, "disable_initiator_tag", None)

1544

is None):

1545

return

1546

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (gobject.timeout_add

1548

(time_to_die,

1549

self.disable))

1363

gobject.source_remove(self.disable_initiator_tag)

1364

self.disable_initiator_tag = None

1365

self.expires = None

1366

time_to_die = timedelta_to_milliseconds((self

1367

.last_checked_ok

1368

+ self.timeout)

1369

- datetime.datetime

1370

.utcnow())

1371

if time_to_die <= 0:

1372

# The timeout has passed

1373

self.disable()

1374

else:

1375

self.expires = (datetime.datetime.utcnow()

1376

+ datetime.timedelta(milliseconds =

1377

time_to_die))

1378

self.disable_initiator_tag = (gobject.timeout_add

1379

(time_to_die, self.disable))

1550

1380

1551

1381

# ExtendedTimeout - property

1552

1382

@dbus_service_property(_interface, signature="t",

1631

1461

self._pipe.send(('setattr', name, value))

1632

1462

1633

1463

1464

class ClientDBusTransitional(ClientDBus):

1465

__metaclass__ = AlternateDBusNamesMetaclass

1466

1467

1634

1468

class ClientHandler(socketserver.BaseRequestHandler, object):

1635

1469

"""A class to handle client connections.

1636

1470

1704

1538

except KeyError:

1705

1539

return

1706

1540

1541

if self.server.use_dbus:

1542

# Emit D-Bus signal

1543

client.NewRequest(str(self.client_address))

1544

1707

1545

if client.approval_delay:

1708

1546

delay = client.approval_delay

1709

1547

client.approvals_pending += 1

1764

1602

try:

1765

1603

sent = session.send(client.secret[sent_size:])

1766

1604

except gnutls.errors.GNUTLSError as error:

1767

logger.warning("gnutls send failed",

1768

exc_info=error)

1605

logger.warning("gnutls send failed")

1769

1606

return

1770

1607

logger.debug("Sent: %d, remaining: %d",

1771

1608

sent, len(client.secret)

1774

1611

1775

1612

logger.info("Sending secret to %s", client.name)

1776

1613

# bump the timeout using extended_timeout

1777

client.bump_timeout(client.extended_timeout)

1614

client.checked_ok(client.extended_timeout)

1778

1615

if self.server.use_dbus:

1779

1616

# Emit D-Bus signal

1780

1617

client.GotSecret()

1785

1622

try:

1786

1623

session.bye()

1787

1624

except gnutls.errors.GNUTLSError as error:

1788

logger.warning("GnuTLS bye failed",

1789

exc_info=error)

1625

logger.warning("GnuTLS bye failed")

1790

1626

1791

1627

@staticmethod

1792

1628

def peer_certificate(session):

2104

1940

elif suffix == "w":

2105

1941

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2106

1942

else:

2107

raise ValueError("Unknown suffix {0!r}"

2108

.format(suffix))

1943

raise ValueError("Unknown suffix %r" % suffix)

2109

1944

except (ValueError, IndexError) as e:

2110

1945

raise ValueError(*(e.args))

2111

1946

timevalue += delta

2125

1960

sys.exit()

2126

1961

if not noclose:

2127

1962

# Close all standard open file descriptors

2128

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1963

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2129

1964

if not stat.S_ISCHR(os.fstat(null).st_mode):

2130

1965

raise OSError(errno.ENODEV,

2131

"{0} not a character device"

2132

.format(os.devnull))

1966

"%s not a character device"

1967

% os.path.devnull)

2133

1968

os.dup2(null, sys.stdin.fileno())

2134

1969

os.dup2(null, sys.stdout.fileno())

2135

1970

os.dup2(null, sys.stderr.fileno())

2144

1979

2145

1980

parser = argparse.ArgumentParser()

2146

1981

parser.add_argument("-v", "--version", action="version",

2147

version = "%(prog)s {0}".format(version),

1982

version = "%%(prog)s %s" % version,

2148

1983

help="show version number and exit")

2149

1984

parser.add_argument("-i", "--interface", metavar="IF",

2150

1985

help="Bind to interface IF")

2243

2078

stored_state_file)

2244

2079

2245

2080

if debug:

2246

initlogger(debug, logging.DEBUG)

2081

initlogger(logging.DEBUG)

2247

2082

else:

2248

2083

if not debuglevel:

2249

initlogger(debug)

2084

initlogger()

2250

2085

else:

2251

2086

level = getattr(logging, debuglevel.upper())

2252

initlogger(debug, level)

2087

initlogger(level)

2253

2088

2254

2089

if server_settings["servicename"] != "Mandos":

2255

2090

syslogger.setFormatter(logging.Formatter

2256

('Mandos ({0}) [%(process)d]:'

2257

' %(levelname)s: %(message)s'

2258

.format(server_settings

2259

["servicename"])))

2091

('Mandos (%s) [%%(process)d]:'

2092

' %%(levelname)s: %%(message)s'

2093

% server_settings["servicename"]))

2260

2094

2261

2095

# Parse config file with clients

2262

client_config = configparser.SafeConfigParser(Client

2263

.client_defaults)

2096

client_config = configparser.SafeConfigParser(Client.client_defaults)

2264

2097

client_config.read(os.path.join(server_settings["configdir"],

2265

2098

"clients.conf"))

2266

2099

2280

2113

pidfilename = "/var/run/mandos.pid"

2281

2114

try:

2282

2115

pidfile = open(pidfilename, "w")

2283

except IOError as e:

2284

logger.error("Could not open file %r", pidfilename,

2285

exc_info=e)

2116

except IOError:

2117

logger.error("Could not open file %r", pidfilename)

2286

2118

2287

for name in ("_mandos", "mandos", "nobody"):

2119

try:

2120

uid = pwd.getpwnam("_mandos").pw_uid

2121

gid = pwd.getpwnam("_mandos").pw_gid

2122

except KeyError:

2288

2123

try:

2289

uid = pwd.getpwnam(name).pw_uid

2290

gid = pwd.getpwnam(name).pw_gid

2291

break

2124

uid = pwd.getpwnam("mandos").pw_uid

2125

gid = pwd.getpwnam("mandos").pw_gid

2292

2126

except KeyError:

2293

continue

2294

else:

2295

uid = 65534

2296

gid = 65534

2127

try:

2128

uid = pwd.getpwnam("nobody").pw_uid

2129

gid = pwd.getpwnam("nobody").pw_gid

2130

except KeyError:

2131

uid = 65534

2132

gid = 65534

2297

2133

try:

2298

2134

os.setgid(gid)

2299

2135

os.setuid(uid)

2316

2152

.gnutls_global_set_log_function(debug_gnutls))

2317

2153

2318

2154

# Redirect stdin so all checkers get /dev/null

2319

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2155

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2320

2156

os.dup2(null, sys.stdin.fileno())

2321

2157

if null > 2:

2322

2158

os.close(null)

2159

else:

2160

# No console logging

2161

logger.removeHandler(console)

2323

2162

2324

2163

# Need to fork before connecting to D-Bus

2325

2164

if not debug:

2326

2165

# Close all input and output, do double fork, etc.

2327

2166

daemon()

2328

2167

2329

gobject.threads_init()

2330

2331

2168

global main_loop

2332

2169

# From the Avahi example code

2333

DBusGMainLoop(set_as_default=True)

2170

DBusGMainLoop(set_as_default=True )

2334

2171

main_loop = gobject.MainLoop()

2335

2172

bus = dbus.SystemBus()

2336

2173

# End of Avahi example code

2342

2179

("se.bsnet.fukt.Mandos", bus,

2343

2180

do_not_queue=True))

2344

2181

except dbus.exceptions.NameExistsException as e:

2345

logger.error("Disabling D-Bus:", exc_info=e)

2182

logger.error(unicode(e) + ", disabling D-Bus")

2346

2183

use_dbus = False

2347

2184

server_settings["use_dbus"] = False

2348

2185

tcp_server.use_dbus = False

2360

2197

2361

2198

client_class = Client

2362

2199

if use_dbus:

2363

client_class = functools.partial(ClientDBus, bus = bus)

2200

client_class = functools.partial(ClientDBusTransitional,

2201

bus = bus)

2364

2202

2365

2203

client_settings = Client.config_parser(client_config)

2366

2204

old_client_settings = {}

2374

2212

(stored_state))

2375

2213

os.remove(stored_state_path)

2376

2214

except IOError as e:

2377

if e.errno == errno.ENOENT:

2378

logger.warning("Could not load persistent state: {0}"

2379

.format(os.strerror(e.errno)))

2380

else:

2381

logger.critical("Could not load persistent state:",

2382

exc_info=e)

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2383

2218

raise

2384

except EOFError as e:

2385

logger.warning("Could not load persistent state: "

2386

"EOFError:", exc_info=e)

2387

2219

2388

2220

with PGPEngine() as pgp:

2389

2221

for client_name, client in clients_data.iteritems():

2406

2238

2407

2239

# Clients who has passed its expire date can still be

2408

2240

# enabled if its last checker was successful. Clients

2409

# whose checker succeeded before we stored its state is

2410

# assumed to have successfully run all checkers during

2411

# downtime.

2241

# whose checker failed before we stored its state is

2242

# assumed to have failed all checkers during downtime.

2412

2243

if client["enabled"]:

2413

2244

if datetime.datetime.utcnow() >= client["expires"]:

2414

2245

if not client["last_checked_ok"]:

2415

2246

logger.warning(

2416

2247

"disabling client {0} - Client never "

2417

"performed a successful checker"

2418

.format(client_name))

2248

"performed a successfull checker"

2249

.format(client["name"]))

2419

2250

client["enabled"] = False

2420

2251

elif client["last_checker_status"] != 0:

2421

2252

logger.warning(

2422

2253

"disabling client {0} - Client "

2423

2254

"last checker failed with error code {1}"

2424

.format(client_name,

2255

.format(client["name"],

2425

2256

client["last_checker_status"]))

2426

2257

client["enabled"] = False

2427

2258

else:

2428

2259

client["expires"] = (datetime.datetime

2429

2260

.utcnow()

2430

2261

+ client["timeout"])

2431

logger.debug("Last checker succeeded,"

2432

" keeping {0} enabled"

2433

.format(client_name))

2262

2434

2263

try:

2435

2264

client["secret"] = (

2436

2265

pgp.decrypt(client["encrypted_secret"],

2442

2271

.format(client_name))

2443

2272

client["secret"] = (

2444

2273

client_settings[client_name]["secret"])

2274

2445

2275

2446

2276

# Add/remove clients based on new changes made to config

2447

for client_name in (set(old_client_settings)

2448

- set(client_settings)):

2277

for client_name in set(old_client_settings) - set(client_settings):

2449

2278

del clients_data[client_name]

2450

for client_name in (set(client_settings)

2451

- set(old_client_settings)):

2279

for client_name in set(client_settings) - set(old_client_settings):

2452

2280

clients_data[client_name] = client_settings[client_name]

2453

2454

# Create all client objects

2281

2282

# Create clients all clients

2455

2283

for client_name, client in clients_data.iteritems():

2456

2284

tcp_server.clients[client_name] = client_class(

2457

2285

name = client_name, settings = client)

2458

2286

2459

2287

if not tcp_server.clients:

2460

2288

logger.warning("No clients defined")

2461

2289

2462

2290

if not debug:

2463

2291

try:

2464

2292

with pidfile:

2478

2306

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2479

2307

2480

2308

if use_dbus:

2481

@alternate_dbus_interfaces({"se.recompile.Mandos":

2482

"se.bsnet.fukt.Mandos"})

2483

class MandosDBusService(DBusObjectWithProperties):

2309

class MandosDBusService(dbus.service.Object):

2484

2310

"""A D-Bus proxy object"""

2485

2311

def __init__(self):

2486

2312

dbus.service.Object.__init__(self, bus, "/")

2487

2313

_interface = "se.recompile.Mandos"

2488

2314

2489

@dbus_interface_annotations(_interface)

2490

def _foo(self):

2491

return { "org.freedesktop.DBus.Property"

2492

".EmitsChangedSignal":

2493

"false"}

2494

2495

2315

@dbus.service.signal(_interface, signature="o")

2496

2316

def ClientAdded(self, objpath):

2497

2317

"D-Bus signal"

2539

2359

2540

2360

del _interface

2541

2361

2542

mandos_dbus_service = MandosDBusService()

2362

class MandosDBusServiceTransitional(MandosDBusService):

2363

__metaclass__ = AlternateDBusNamesMetaclass

2364

mandos_dbus_service = MandosDBusServiceTransitional()

2543

2365

2544

2366

def cleanup():

2545

2367

"Cleanup function; run on exit"

2578

2400

del client_settings[client.name]["secret"]

2579

2401

2580

2402

try:

2581

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2582

prefix="clients-",

2583

dir=os.path.dirname

2584

(stored_state_path))

2585

with os.fdopen(tempfd, "wb") as stored_state:

2403

with os.fdopen(os.open(stored_state_path,

2404

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2405

0600), "wb") as stored_state:

2586

2406

pickle.dump((clients, client_settings), stored_state)

2587

os.rename(tempname, stored_state_path)

2588

2407

except (IOError, OSError) as e:

2589

if not debug:

2590

try:

2591

os.remove(tempname)

2592

except NameError:

2593

pass

2594

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2595

logger.warning("Could not save persistent state: {0}"

2596

.format(os.strerror(e.errno)))

2597

else:

2598

logger.warning("Could not save persistent state:",

2599

exc_info=e)

2600

raise e

2408

logger.warning("Could not save persistent state: {0}"

2409

.format(e))

2410

if e.errno not in (errno.ENOENT, errno.EACCES):

2411

raise

2601

2412

2602

2413

# Delete all clients, and settings from config

2603

2414

while tcp_server.clients:

2630

2441

service.port = tcp_server.socket.getsockname()[1]

2631

2442

if use_ipv6:

2632

2443

logger.info("Now listening on address %r, port %d,"

2633

" flowinfo %d, scope_id %d",

2634

*tcp_server.socket.getsockname())

2444

" flowinfo %d, scope_id %d"

2445

% tcp_server.socket.getsockname())

2635

2446

else: # IPv4

2636

logger.info("Now listening on address %r, port %d",

2637

*tcp_server.socket.getsockname())

2447

logger.info("Now listening on address %r, port %d"

2448

% tcp_server.socket.getsockname())

2638

2449

2639

2450

#service.interface = tcp_server.socket.getsockname()[3]

2640

2451

2643

2454

try:

2644

2455

service.activate()

2645

2456

except dbus.exceptions.DBusException as error:

2646

logger.critical("D-Bus Exception", exc_info=error)

2457

logger.critical("DBusException: %s", error)

2647

2458

cleanup()

2648

2459

sys.exit(1)

2649

2460

# End of Avahi example code

2656

2467

logger.debug("Starting main loop")

2657

2468

main_loop.run()

2658

2469

except AvahiError as error:

2659

logger.critical("Avahi Error", exc_info=error)

2470

logger.critical("AvahiError: %s", error)

2660

2471

cleanup()

2661

2472

sys.exit(1)

2662

2473

except KeyboardInterrupt: