/mandos/trunk : revision 525

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

67

65

import types

68

66

import binascii

69

67

import tempfile

70

import itertools

71

68

72

69

import dbus

73

70

import dbus.service

88

85

except ImportError:

89

86

SO_BINDTODEVICE = None

90

87

91

version = "1.5.3"

88

version = "1.4.1"

92

89

stored_state_file = "clients.pickle"

93

90

94

91

logger = logging.getLogger()

113

110

return interface_index

114

111

115

112

116

def initlogger(debug, level=logging.WARNING):

113

def initlogger(level=logging.WARNING):

117

114

"""init logger and add loglevel"""

118

115

119

116

syslogger.setFormatter(logging.Formatter

121

118

' %(message)s'))

122

119

logger.addHandler(syslogger)

123

120

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

121

console = logging.StreamHandler()

122

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

123

' [%(process)d]:'

124

' %(levelname)s:'

125

' %(message)s'))

126

logger.addHandler(console)

131

127

logger.setLevel(level)

132

128

133

129

145

141

self.gnupg.options.meta_interactive = False

146

142

self.gnupg.options.homedir = self.tempdir

147

143

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

144

'--quiet'])

150

145

151

146

def __enter__(self):

152

147

return self

178

173

179

174

def encrypt(self, data, password):

180

175

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

176

with open(os.devnull) as devnull:

182

177

try:

183

178

proc = self.gnupg.run(['--symmetric'],

184

179

create_fhs=['stdin', 'stdout'],

195

190

196

191

def decrypt(self, data, password):

197

192

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

193

with open(os.devnull) as devnull:

199

194

try:

200

195

proc = self.gnupg.run(['--decrypt'],

201

196

create_fhs=['stdin', 'stdout'],

202

197

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

198

with contextlib.closing(proc.handles['stdin'] ) as f:

204

199

f.write(data)

205

200

with contextlib.closing(proc.handles['stdout']) as f:

206

201

decrypted_plaintext = f.read()

211

206

return decrypted_plaintext

212

207

213

208

209

214

210

class AvahiError(Exception):

215

211

def __init__(self, value, *args, **kwargs):

216

212

self.value = value

245

241

server: D-Bus Server

246

242

bus: dbus.SystemBus()

247

243

"""

248

249

244

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

245

servicetype = None, port = None, TXT = None,

251

246

domain = "", host = "", max_renames = 32768,

264

259

self.server = None

265

260

self.bus = bus

266

261

self.entry_group_state_changed_match = None

267

268

262

def rename(self):

269

263

"""Derived from the Avahi example code"""

270

264

if self.rename_count >= self.max_renames:

280

274

try:

281

275

self.add()

282

276

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

277

logger.critical("DBusException: %s", error)

284

278

self.cleanup()

285

279

os._exit(1)

286

280

self.rename_count += 1

287

288

281

def remove(self):

289

282

"""Derived from the Avahi example code"""

290

283

if self.entry_group_state_changed_match is not None:

292

285

self.entry_group_state_changed_match = None

293

286

if self.group is not None:

294

287

self.group.Reset()

295

296

288

def add(self):

297

289

"""Derived from the Avahi example code"""

298

290

self.remove()

315

307

dbus.UInt16(self.port),

316

308

avahi.string_array_to_txt_array(self.TXT))

317

309

self.group.Commit()

318

319

310

def entry_group_state_changed(self, state, error):

320

311

"""Derived from the Avahi example code"""

321

312

logger.debug("Avahi entry group state change: %i", state)

328

319

elif state == avahi.ENTRY_GROUP_FAILURE:

329

320

logger.critical("Avahi: Error in group state changed %s",

330

321

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

322

raise AvahiGroupError("State changed: %s"

323

% unicode(error))

334

324

def cleanup(self):

335

325

"""Derived from the Avahi example code"""

336

326

if self.group is not None:

341

331

pass

342

332

self.group = None

343

333

self.remove()

344

345

334

def server_state_changed(self, state, error=None):

346

335

"""Derived from the Avahi example code"""

347

336

logger.debug("Avahi server state change: %i", state)

366

355

logger.debug("Unknown state: %r", state)

367

356

else:

368

357

logger.debug("Unknown state: %r: %r", state, error)

369

370

358

def activate(self):

371

359

"""Derived from the Avahi example code"""

372

360

if self.server is None:

384

372

"""Add the new name to the syslog messages"""

385

373

ret = AvahiService.rename(self)

386

374

syslogger.setFormatter(logging.Formatter

387

('Mandos ({0}) [%(process)d]:'

388

' %(levelname)s: %(message)s'

389

.format(self.name)))

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

390

378

return ret

391

379

392

380

def timedelta_to_milliseconds(td):

394

382

return ((td.days * 24 * 60 * 60 * 1000)

395

383

+ (td.seconds * 1000)

396

384

+ (td.microseconds // 1000))

397

385

398

386

class Client(object):

399

387

"""A representation of a client host served by this server.

400

388

425

413

last_checked_ok: datetime.datetime(); (UTC) or None

426

414

last_checker_status: integer between 0 and 255 reflecting exit

427

415

status of last checker. -1 reflects crashed

428

checker, -2 means no checker completed yet.

416

checker, or None.

429

417

last_enabled: datetime.datetime(); (UTC) or None

430

418

name: string; from the config file, used in log messages and

431

419

D-Bus identifiers

432

420

secret: bytestring; sent verbatim (over TLS) to client

433

421

timeout: datetime.timedelta(); How long from last_checked_ok

434

422

until this client is disabled

435

extended_timeout: extra long timeout when secret has been sent

423

extended_timeout: extra long timeout when password has been sent

436

424

runtime_expansions: Allowed attributes for runtime expansion.

437

425

expires: datetime.datetime(); time (UTC) when a client will be

438

426

disabled, or None

467

455

468

456

def approval_delay_milliseconds(self):

469

457

return timedelta_to_milliseconds(self.approval_delay)

470

458

471

459

@staticmethod

472

460

def config_parser(config):

473

"""Construct a new dict of client settings of this form:

461

""" Construct a new dict of client settings of this form:

474

462

{ client_name: {setting_name: value, ...}, ...}

475

with exceptions for any special settings as defined above.

476

NOTE: Must be a pure function. Must return the same result

477

value given the same arguments.

478

"""

463

with exceptions for any special settings as defined above"""

479

464

settings = {}

480

465

for client_name in config.sections():

481

466

section = dict(config.items(client_name))

485

470

# Reformat values from string types to Python types

486

471

client["approved_by_default"] = config.getboolean(

487

472

client_name, "approved_by_default")

488

client["enabled"] = config.getboolean(client_name,

489

"enabled")

473

client["enabled"] = config.getboolean(client_name, "enabled")

490

474

491

475

client["fingerprint"] = (section["fingerprint"].upper()

492

476

.replace(" ", ""))

498

482

"rb") as secfile:

499

483

client["secret"] = secfile.read()

500

484

else:

501

raise TypeError("No secret or secfile for section {0}"

502

.format(section))

485

raise TypeError("No secret or secfile for section %s"

486

% section)

503

487

client["timeout"] = string_to_delta(section["timeout"])

504

488

client["extended_timeout"] = string_to_delta(

505

489

section["extended_timeout"])

511

495

client["checker_command"] = section["checker"]

512

496

client["last_approval_request"] = None

513

497

client["last_checked_ok"] = None

514

client["last_checker_status"] = -2

515

498

client["last_checker_status"] = None

499

if client["enabled"]:

500

client["last_enabled"] = datetime.datetime.utcnow()

501

client["expires"] = (datetime.datetime.utcnow()

502

+ client["timeout"])

503

else:

504

client["last_enabled"] = None

505

client["expires"] = None

506

516

507

return settings

517

508

509

518

510

def __init__(self, settings, name = None):

511

"""Note: the 'checker' key in 'config' sets the

512

'checker_command' attribute and *not* the 'checker'

513

attribute."""

519

514

self.name = name

520

515

# adding all client settings

521

516

for setting, value in settings.iteritems():

522

517

setattr(self, setting, value)

523

518

524

if self.enabled:

525

if not hasattr(self, "last_enabled"):

526

self.last_enabled = datetime.datetime.utcnow()

527

if not hasattr(self, "expires"):

528

self.expires = (datetime.datetime.utcnow()

529

+ self.timeout)

530

else:

531

self.last_enabled = None

532

self.expires = None

533

534

519

logger.debug("Creating client %r", self.name)

535

520

# Uppercase and remove spaces from fingerprint for later

536

521

# comparison purposes with return value from the fingerprint()

537

522

# function

538

523

logger.debug(" Fingerprint: %s", self.fingerprint)

539

self.created = settings.get("created",

540

datetime.datetime.utcnow())

541

524

self.created = settings.get("created", datetime.datetime.utcnow())

525

542

526

# attributes specific for this server instance

543

527

self.checker = None

544

528

self.checker_initiator_tag = None

632

616

logger.warning("Checker for %(name)s crashed?",

633

617

vars(self))

634

618

635

def checked_ok(self):

636

"""Assert that the client has been seen, alive and well."""

637

self.last_checked_ok = datetime.datetime.utcnow()

638

self.last_checker_status = 0

639

self.bump_timeout()

640

641

def bump_timeout(self, timeout=None):

642

"""Bump up the timeout for this client."""

619

def checked_ok(self, timeout=None):

620

"""Bump up the timeout for this client.

621

622

This should only be called when the client has been seen,

623

alive and well.

624

"""

643

625

if timeout is None:

644

626

timeout = self.timeout

627

self.last_checked_ok = datetime.datetime.utcnow()

645

628

if self.disable_initiator_tag is not None:

646

629

gobject.source_remove(self.disable_initiator_tag)

647

630

if getattr(self, "enabled", False):

659

642

If a checker already exists, leave it running and do

660

643

nothing."""

661

644

# The reason for not killing a running checker is that if we

662

# did that, and if a checker (for some reason) started running

663

# slowly and taking more than 'interval' time, then the client

664

# would inevitably timeout, since no checker would get a

665

# chance to run to completion. If we instead leave running

645

# did that, then if a checker (for some reason) started

646

# running slowly and taking more than 'interval' time, the

647

# client would inevitably timeout, since no checker would get

648

# a chance to run to completion. If we instead leave running

666

649

# checkers alone, the checker would have to take more time

667

650

# than 'timeout' for the client to be disabled, which is as it

668

651

# should be.

698

681

try:

699

682

command = self.checker_command % escaped_attrs

700

683

except TypeError as error:

701

logger.error('Could not format string "%s"',

702

self.checker_command, exc_info=error)

684

logger.error('Could not format string "%s":'

685

' %s', self.checker_command, error)

703

686

return True # Try again later

704

687

self.current_checker_command = command

705

688

try:

723

706

gobject.source_remove(self.checker_callback_tag)

724

707

self.checker_callback(pid, status, command)

725

708

except OSError as error:

726

logger.error("Failed to start subprocess",

727

exc_info=error)

709

logger.error("Failed to start subprocess: %s",

710

error)

728

711

# Re-run this periodically if run by gobject.timeout_add

729

712

return True

730

713

737

720

return

738

721

logger.debug("Stopping checker for %(name)s", vars(self))

739

722

try:

740

self.checker.terminate()

723

os.kill(self.checker.pid, signal.SIGTERM)

741

724

#time.sleep(0.5)

742

725

#if self.checker.poll() is None:

743

# self.checker.kill()

726

# os.kill(self.checker.pid, signal.SIGKILL)

744

727

except OSError as error:

745

728

if error.errno != errno.ESRCH: # No such process

746

729

raise

763

746

# "Set" method, so we fail early here:

764

747

if byte_arrays and signature != "ay":

765

748

raise ValueError("Byte arrays not supported for non-'ay'"

766

" signature {0!r}".format(signature))

749

" signature %r" % signature)

767

750

def decorator(func):

768

751

func._dbus_is_property = True

769

752

func._dbus_interface = dbus_interface

777

760

return decorator

778

761

779

762

780

def dbus_interface_annotations(dbus_interface):

781

"""Decorator for marking functions returning interface annotations

782

783

Usage:

784

785

@dbus_interface_annotations("org.example.Interface")

786

def _foo(self): # Function name does not matter

787

return {"org.freedesktop.DBus.Deprecated": "true",

788

"org.freedesktop.DBus.Property.EmitsChangedSignal":

789

"false"}

790

"""

791

def decorator(func):

792

func._dbus_is_interface = True

793

func._dbus_interface = dbus_interface

794

func._dbus_name = dbus_interface

795

return func

796

return decorator

797

798

799

def dbus_annotations(annotations):

800

"""Decorator to annotate D-Bus methods, signals or properties

801

Usage:

802

803

@dbus_service_property("org.example.Interface", signature="b",

804

access="r")

805

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

806

"org.freedesktop.DBus.Property."

807

"EmitsChangedSignal": "false"})

808

def Property_dbus_property(self):

809

return dbus.Boolean(False)

810

"""

811

def decorator(func):

812

func._dbus_annotations = annotations

813

return func

814

return decorator

815

816

817

763

class DBusPropertyException(dbus.exceptions.DBusException):

818

764

"""A base class for D-Bus property-related exceptions

819

765

"""

842

788

"""

843

789

844

790

@staticmethod

845

def _is_dbus_thing(thing):

846

"""Returns a function testing if an attribute is a D-Bus thing

847

848

If called like _is_dbus_thing("method") it returns a function

849

suitable for use as predicate to inspect.getmembers().

850

"""

851

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

852

False)

791

def _is_dbus_property(obj):

792

return getattr(obj, "_dbus_is_property", False)

853

793

854

def _get_all_dbus_things(self, thing):

794

def _get_all_dbus_properties(self):

855

795

"""Returns a generator of (name, attribute) pairs

856

796

"""

857

return ((getattr(athing.__get__(self), "_dbus_name",

858

name),

859

athing.__get__(self))

797

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

860

798

for cls in self.__class__.__mro__

861

for name, athing in

862

inspect.getmembers(cls,

863

self._is_dbus_thing(thing)))

799

for name, prop in

800

inspect.getmembers(cls, self._is_dbus_property))

864

801

865

802

def _get_dbus_property(self, interface_name, property_name):

866

803

"""Returns a bound method if one exists which is a D-Bus

868

805

"""

869

806

for cls in self.__class__.__mro__:

870

807

for name, value in (inspect.getmembers

871

(cls,

872

self._is_dbus_thing("property"))):

808

(cls, self._is_dbus_property)):

873

809

if (value._dbus_name == property_name

874

810

and value._dbus_interface == interface_name):

875

811

return value.__get__(self)

904

840

# signatures other than "ay".

905

841

if prop._dbus_signature != "ay":

906

842

raise ValueError

907

value = dbus.ByteArray(b''.join(chr(byte)

908

for byte in value))

843

value = dbus.ByteArray(''.join(unichr(byte)

844

for byte in value))

909

845

prop(value)

910

846

911

847

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

917

853

Note: Will not include properties with access="write".

918

854

"""

919

855

properties = {}

920

for name, prop in self._get_all_dbus_things("property"):

856

for name, prop in self._get_all_dbus_properties():

921

857

if (interface_name

922

858

and interface_name != prop._dbus_interface):

923

859

# Interface non-empty but did not match

938

874

path_keyword='object_path',

939

875

connection_keyword='connection')

940

876

def Introspect(self, object_path, connection):

941

"""Overloading of standard D-Bus method.

942

943

Inserts property tags and interface annotation tags.

877

"""Standard D-Bus method, overloaded to insert property tags.

944

878

"""

945

879

xmlstring = dbus.service.Object.Introspect(self, object_path,

946

880

connection)

953

887

e.setAttribute("access", prop._dbus_access)

954

888

return e

955

889

for if_tag in document.getElementsByTagName("interface"):

956

# Add property tags

957

890

for tag in (make_tag(document, name, prop)

958

891

for name, prop

959

in self._get_all_dbus_things("property")

892

in self._get_all_dbus_properties()

960

893

if prop._dbus_interface

961

894

== if_tag.getAttribute("name")):

962

895

if_tag.appendChild(tag)

963

# Add annotation tags

964

for typ in ("method", "signal", "property"):

965

for tag in if_tag.getElementsByTagName(typ):

966

annots = dict()

967

for name, prop in (self.

968

_get_all_dbus_things(typ)):

969

if (name == tag.getAttribute("name")

970

and prop._dbus_interface

971

== if_tag.getAttribute("name")):

972

annots.update(getattr

973

(prop,

974

"_dbus_annotations",

975

{}))

976

for name, value in annots.iteritems():

977

ann_tag = document.createElement(

978

"annotation")

979

ann_tag.setAttribute("name", name)

980

ann_tag.setAttribute("value", value)

981

tag.appendChild(ann_tag)

982

# Add interface annotation tags

983

for annotation, value in dict(

984

itertools.chain.from_iterable(

985

annotations().iteritems()

986

for name, annotations in

987

self._get_all_dbus_things("interface")

988

if name == if_tag.getAttribute("name")

989

)).iteritems():

990

ann_tag = document.createElement("annotation")

991

ann_tag.setAttribute("name", annotation)

992

ann_tag.setAttribute("value", value)

993

if_tag.appendChild(ann_tag)

994

896

# Add the names to the return values for the

995

897

# "org.freedesktop.DBus.Properties" methods

996

898

if (if_tag.getAttribute("name")

1011

913

except (AttributeError, xml.dom.DOMException,

1012

914

xml.parsers.expat.ExpatError) as error:

1013

915

logger.error("Failed to override Introspection method",

1014

exc_info=error)

916

error)

1015

917

return xmlstring

1016

918

1017

919

1023

925

variant_level=variant_level)

1024

926

1025

927

1026

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1027

"""A class decorator; applied to a subclass of

1028

dbus.service.Object, it will add alternate D-Bus attributes with

1029

interface names according to the "alt_interface_names" mapping.

1030

Usage:

1031

1032

@alternate_dbus_names({"org.example.Interface":

1033

"net.example.AlternateInterface"})

1034

class SampleDBusObject(dbus.service.Object):

1035

@dbus.service.method("org.example.Interface")

1036

def SampleDBusMethod():

1037

pass

1038

1039

The above "SampleDBusMethod" on "SampleDBusObject" will be

1040

reachable via two interfaces: "org.example.Interface" and

1041

"net.example.AlternateInterface", the latter of which will have

1042

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1043

"true", unless "deprecate" is passed with a False value.

1044

1045

This works for methods and signals, and also for D-Bus properties

1046

(from DBusObjectWithProperties) and interfaces (from the

1047

dbus_interface_annotations decorator).

928

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

929

.__metaclass__):

930

"""Applied to an empty subclass of a D-Bus object, this metaclass

931

will add additional D-Bus attributes matching a certain pattern.

1048

932

"""

1049

def wrapper(cls):

1050

for orig_interface_name, alt_interface_name in (

1051

alt_interface_names.iteritems()):

1052

attr = {}

1053

interface_names = set()

1054

# Go though all attributes of the class

1055

for attrname, attribute in inspect.getmembers(cls):

933

def __new__(mcs, name, bases, attr):

934

# Go through all the base classes which could have D-Bus

935

# methods, signals, or properties in them

936

for base in (b for b in bases

937

if issubclass(b, dbus.service.Object)):

938

# Go though all attributes of the base class

939

for attrname, attribute in inspect.getmembers(base):

1056

940

# Ignore non-D-Bus attributes, and D-Bus attributes

1057

941

# with the wrong interface name

1058

942

if (not hasattr(attribute, "_dbus_interface")

1059

943

or not attribute._dbus_interface

1060

.startswith(orig_interface_name)):

944

.startswith("se.recompile.Mandos")):

1061

945

continue

1062

946

# Create an alternate D-Bus interface name based on

1063

947

# the current name

1064

948

alt_interface = (attribute._dbus_interface

1065

.replace(orig_interface_name,

1066

alt_interface_name))

1067

interface_names.add(alt_interface)

949

.replace("se.recompile.Mandos",

950

"se.bsnet.fukt.Mandos"))

1068

951

# Is this a D-Bus signal?

1069

952

if getattr(attribute, "_dbus_is_signal", False):

1070

953

# Extract the original non-method function by

1085

968

nonmethod_func.func_name,

1086

969

nonmethod_func.func_defaults,

1087

970

nonmethod_func.func_closure)))

1088

# Copy annotations, if any

1089

try:

1090

new_function._dbus_annotations = (

1091

dict(attribute._dbus_annotations))

1092

except AttributeError:

1093

pass

1094

971

# Define a creator of a function to call both the

1095

# original and alternate functions, so both the

1096

# original and alternate signals gets sent when

1097

# the function is called

972

# old and new functions, so both the old and new

973

# signals gets sent when the function is called

1098

974

def fixscope(func1, func2):

1099

975

"""This function is a scope container to pass

1100

976

func1 and func2 to the "call_both" function

1107

983

return call_both

1108

984

# Create the "call_both" function and add it to

1109

985

# the class

1110

attr[attrname] = fixscope(attribute, new_function)

986

attr[attrname] = fixscope(attribute,

987

new_function)

1111

988

# Is this a D-Bus method?

1112

989

elif getattr(attribute, "_dbus_is_method", False):

1113

990

# Create a new, but exactly alike, function

1124

1001

attribute.func_name,

1125

1002

attribute.func_defaults,

1126

1003

attribute.func_closure)))

1127

# Copy annotations, if any

1128

try:

1129

attr[attrname]._dbus_annotations = (

1130

dict(attribute._dbus_annotations))

1131

except AttributeError:

1132

pass

1133

1004

# Is this a D-Bus property?

1134

1005

elif getattr(attribute, "_dbus_is_property", False):

1135

1006

# Create a new, but exactly alike, function

1149

1020

attribute.func_name,

1150

1021

attribute.func_defaults,

1151

1022

attribute.func_closure)))

1152

# Copy annotations, if any

1153

try:

1154

attr[attrname]._dbus_annotations = (

1155

dict(attribute._dbus_annotations))

1156

except AttributeError:

1157

pass

1158

# Is this a D-Bus interface?

1159

elif getattr(attribute, "_dbus_is_interface", False):

1160

# Create a new, but exactly alike, function

1161

# object. Decorate it to be a new D-Bus interface

1162

# with the alternate D-Bus interface name. Add it

1163

# to the class.

1164

attr[attrname] = (dbus_interface_annotations

1165

(alt_interface)

1166

(types.FunctionType

1167

(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1172

if deprecate:

1173

# Deprecate all alternate interfaces

1174

iname="_AlternateDBusNames_interface_annotation{0}"

1175

for interface_name in interface_names:

1176

@dbus_interface_annotations(interface_name)

1177

def func(self):

1178

return { "org.freedesktop.DBus.Deprecated":

1179

"true" }

1180

# Find an unused name

1181

for aname in (iname.format(i)

1182

for i in itertools.count()):

1183

if aname not in attr:

1184

attr[aname] = func

1185

break

1186

if interface_names:

1187

# Replace the class with a new subclass of it with

1188

# methods, signals, etc. as created above.

1189

cls = type(b"{0}Alternate".format(cls.__name__),

1190

(cls,), attr)

1191

return cls

1192

return wrapper

1193

1194

1195

@alternate_dbus_interfaces({"se.recompile.Mandos":

1196

"se.bsnet.fukt.Mandos"})

1023

return type.__new__(mcs, name, bases, attr)

1024

1025

1197

1026

class ClientDBus(Client, DBusObjectWithProperties):

1198

1027

"""A Client class using D-Bus

1199

1028

1210

1039

def __init__(self, bus = None, *args, **kwargs):

1211

1040

self.bus = bus

1212

1041

Client.__init__(self, *args, **kwargs)

1042

self._approvals_pending = 0

1043

1044

self._approvals_pending = 0

1213

1045

# Only now, when this client is initialized, can it show up on

1214

1046

# the D-Bus

1215

1047

client_object_name = unicode(self.name).translate(

1219

1051

("/clients/" + client_object_name))

1220

1052

DBusObjectWithProperties.__init__(self, self.bus,

1221

1053

self.dbus_object_path)

1222

1054

1223

1055

def notifychangeproperty(transform_func,

1224

1056

dbus_name, type_func=lambda x: x,

1225

1057

variant_level=1):

1248

1080

1249

1081

return property(lambda self: getattr(self, attrname), setter)

1250

1082

1083

1251

1084

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1252

1085

approvals_pending = notifychangeproperty(dbus.Boolean,

1253

1086

"ApprovalPending",

1260

1093

checker is not None)

1261

1094

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1262

1095

"LastCheckedOK")

1263

last_checker_status = notifychangeproperty(dbus.Int16,

1264

"LastCheckerStatus")

1265

1096

last_approval_request = notifychangeproperty(

1266

1097

datetime_to_dbus, "LastApprovalRequest")

1267

1098

approved_by_default = notifychangeproperty(dbus.Boolean,

1341

1172

(self.approval_duration),

1342

1173

self._reset_approved)

1343

1174

1175

1344

1176

## D-Bus methods, signals & properties

1345

1177

_interface = "se.recompile.Mandos.Client"

1346

1178

1347

## Interfaces

1348

1349

@dbus_interface_annotations(_interface)

1350

def _foo(self):

1351

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1352

"false"}

1353

1354

1179

## Signals

1355

1180

1356

1181

# CheckerCompleted - signal

1392

1217

"D-Bus signal"

1393

1218

return self.need_approval()

1394

1219

1220

# NeRwequest - signal

1221

@dbus.service.signal(_interface, signature="s")

1222

def NewRequest(self, ip):

1223

"""D-Bus signal

1224

Is sent after a client request a password.

1225

"""

1226

pass

1227

1395

1228

## Methods

1396

1229

1397

1230

# Approve - method

1507

1340

return

1508

1341

return datetime_to_dbus(self.last_checked_ok)

1509

1342

1510

# LastCheckerStatus - property

1511

@dbus_service_property(_interface, signature="n",

1512

access="read")

1513

def LastCheckerStatus_dbus_property(self):

1514

return dbus.Int16(self.last_checker_status)

1515

1516

1343

# Expires - property

1517

1344

@dbus_service_property(_interface, signature="s", access="read")

1518

1345

def Expires_dbus_property(self):

1530

1357

if value is None: # get

1531

1358

return dbus.UInt64(self.timeout_milliseconds())

1532

1359

self.timeout = datetime.timedelta(0, 0, 0, value)

1360

if getattr(self, "disable_initiator_tag", None) is None:

1361

return

1533

1362

# Reschedule timeout

1534

if self.enabled:

1535

now = datetime.datetime.utcnow()

1536

time_to_die = timedelta_to_milliseconds(

1537

(self.last_checked_ok + self.timeout) - now)

1538

if time_to_die <= 0:

1539

# The timeout has passed

1540

self.disable()

1541

else:

1542

self.expires = (now +

1543

datetime.timedelta(milliseconds =

1544

time_to_die))

1545

if (getattr(self, "disable_initiator_tag", None)

1546

is None):

1547

return

1548

gobject.source_remove(self.disable_initiator_tag)

1549

self.disable_initiator_tag = (gobject.timeout_add

1550

(time_to_die,

1551

self.disable))

1363

gobject.source_remove(self.disable_initiator_tag)

1364

self.disable_initiator_tag = None

1365

self.expires = None

1366

time_to_die = timedelta_to_milliseconds((self

1367

.last_checked_ok

1368

+ self.timeout)

1369

- datetime.datetime

1370

.utcnow())

1371

if time_to_die <= 0:

1372

# The timeout has passed

1373

self.disable()

1374

else:

1375

self.expires = (datetime.datetime.utcnow()

1376

+ datetime.timedelta(milliseconds =

1377

time_to_die))

1378

self.disable_initiator_tag = (gobject.timeout_add

1379

(time_to_die, self.disable))

1552

1380

1553

1381

# ExtendedTimeout - property

1554

1382

@dbus_service_property(_interface, signature="t",

1633

1461

self._pipe.send(('setattr', name, value))

1634

1462

1635

1463

1464

class ClientDBusTransitional(ClientDBus):

1465

__metaclass__ = AlternateDBusNamesMetaclass

1466

1467

1636

1468

class ClientHandler(socketserver.BaseRequestHandler, object):

1637

1469

"""A class to handle client connections.

1638

1470

1706

1538

except KeyError:

1707

1539

return

1708

1540

1541

if self.server.use_dbus:

1542

# Emit D-Bus signal

1543

client.NewRequest(str(self.client_address))

1544

1709

1545

if client.approval_delay:

1710

1546

delay = client.approval_delay

1711

1547

client.approvals_pending += 1

1766

1602

try:

1767

1603

sent = session.send(client.secret[sent_size:])

1768

1604

except gnutls.errors.GNUTLSError as error:

1769

logger.warning("gnutls send failed",

1770

exc_info=error)

1605

logger.warning("gnutls send failed")

1771

1606

return

1772

1607

logger.debug("Sent: %d, remaining: %d",

1773

1608

sent, len(client.secret)

1776

1611

1777

1612

logger.info("Sending secret to %s", client.name)

1778

1613

# bump the timeout using extended_timeout

1779

client.bump_timeout(client.extended_timeout)

1614

client.checked_ok(client.extended_timeout)

1780

1615

if self.server.use_dbus:

1781

1616

# Emit D-Bus signal

1782

1617

client.GotSecret()

1787

1622

try:

1788

1623

session.bye()

1789

1624

except gnutls.errors.GNUTLSError as error:

1790

logger.warning("GnuTLS bye failed",

1791

exc_info=error)

1625

logger.warning("GnuTLS bye failed")

1792

1626

1793

1627

@staticmethod

1794

1628

def peer_certificate(session):

1866

1700

def process_request(self, request, address):

1867

1701

"""Start a new process to process the request."""

1868

1702

proc = multiprocessing.Process(target = self.sub_process_main,

1869

args = (request, address))

1703

args = (request,

1704

address))

1870

1705

proc.start()

1871

1706

return proc

1872

1707

1994

1829

1995

1830

def handle_ipc(self, source, condition, parent_pipe=None,

1996

1831

proc = None, client_object=None):

1832

condition_names = {

1833

gobject.IO_IN: "IN", # There is data to read.

1834

gobject.IO_OUT: "OUT", # Data can be written (without

1835

# blocking).

1836

gobject.IO_PRI: "PRI", # There is urgent data to read.

1837

gobject.IO_ERR: "ERR", # Error condition.

1838

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1839

# broken, usually for pipes and

1840

# sockets).

1841

}

1842

conditions_string = ' | '.join(name

1843

for cond, name in

1844

condition_names.iteritems()

1845

if cond & condition)

1997

1846

# error, or the other end of multiprocessing.Pipe has closed

1998

if condition & (gobject.IO_ERR | gobject.IO_HUP):

1847

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1999

1848

# Wait for other process to exit

2000

1849

proc.join()

2001

1850

return False

2091

1940

elif suffix == "w":

2092

1941

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2093

1942

else:

2094

raise ValueError("Unknown suffix {0!r}"

2095

.format(suffix))

1943

raise ValueError("Unknown suffix %r" % suffix)

2096

1944

except (ValueError, IndexError) as e:

2097

1945

raise ValueError(*(e.args))

2098

1946

timevalue += delta

2112

1960

sys.exit()

2113

1961

if not noclose:

2114

1962

# Close all standard open file descriptors

2115

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1963

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2116

1964

if not stat.S_ISCHR(os.fstat(null).st_mode):

2117

1965

raise OSError(errno.ENODEV,

2118

"{0} not a character device"

2119

.format(os.devnull))

1966

"%s not a character device"

1967

% os.path.devnull)

2120

1968

os.dup2(null, sys.stdin.fileno())

2121

1969

os.dup2(null, sys.stdout.fileno())

2122

1970

os.dup2(null, sys.stderr.fileno())

2131

1979

2132

1980

parser = argparse.ArgumentParser()

2133

1981

parser.add_argument("-v", "--version", action="version",

2134

version = "%(prog)s {0}".format(version),

1982

version = "%%(prog)s %s" % version,

2135

1983

help="show version number and exit")

2136

1984

parser.add_argument("-i", "--interface", metavar="IF",

2137

1985

help="Bind to interface IF")

2230

2078

stored_state_file)

2231

2079

2232

2080

if debug:

2233

initlogger(debug, logging.DEBUG)

2081

initlogger(logging.DEBUG)

2234

2082

else:

2235

2083

if not debuglevel:

2236

initlogger(debug)

2084

initlogger()

2237

2085

else:

2238

2086

level = getattr(logging, debuglevel.upper())

2239

initlogger(debug, level)

2087

initlogger(level)

2240

2088

2241

2089

if server_settings["servicename"] != "Mandos":

2242

2090

syslogger.setFormatter(logging.Formatter

2243

('Mandos ({0}) [%(process)d]:'

2244

' %(levelname)s: %(message)s'

2245

.format(server_settings

2246

["servicename"])))

2091

('Mandos (%s) [%%(process)d]:'

2092

' %%(levelname)s: %%(message)s'

2093

% server_settings["servicename"]))

2247

2094

2248

2095

# Parse config file with clients

2249

client_config = configparser.SafeConfigParser(Client

2250

.client_defaults)

2096

client_config = configparser.SafeConfigParser(Client.client_defaults)

2251

2097

client_config.read(os.path.join(server_settings["configdir"],

2252

2098

"clients.conf"))

2253

2099

2267

2113

pidfilename = "/var/run/mandos.pid"

2268

2114

try:

2269

2115

pidfile = open(pidfilename, "w")

2270

except IOError as e:

2271

logger.error("Could not open file %r", pidfilename,

2272

exc_info=e)

2116

except IOError:

2117

logger.error("Could not open file %r", pidfilename)

2273

2118

2274

for name in ("_mandos", "mandos", "nobody"):

2119

try:

2120

uid = pwd.getpwnam("_mandos").pw_uid

2121

gid = pwd.getpwnam("_mandos").pw_gid

2122

except KeyError:

2275

2123

try:

2276

uid = pwd.getpwnam(name).pw_uid

2277

gid = pwd.getpwnam(name).pw_gid

2278

break

2124

uid = pwd.getpwnam("mandos").pw_uid

2125

gid = pwd.getpwnam("mandos").pw_gid

2279

2126

except KeyError:

2280

continue

2281

else:

2282

uid = 65534

2283

gid = 65534

2127

try:

2128

uid = pwd.getpwnam("nobody").pw_uid

2129

gid = pwd.getpwnam("nobody").pw_gid

2130

except KeyError:

2131

uid = 65534

2132

gid = 65534

2284

2133

try:

2285

2134

os.setgid(gid)

2286

2135

os.setuid(uid)

2303

2152

.gnutls_global_set_log_function(debug_gnutls))

2304

2153

2305

2154

# Redirect stdin so all checkers get /dev/null

2306

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2155

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2307

2156

os.dup2(null, sys.stdin.fileno())

2308

2157

if null > 2:

2309

2158

os.close(null)

2159

else:

2160

# No console logging

2161

logger.removeHandler(console)

2310

2162

2311

2163

# Need to fork before connecting to D-Bus

2312

2164

if not debug:

2313

2165

# Close all input and output, do double fork, etc.

2314

2166

daemon()

2315

2167

2316

gobject.threads_init()

2317

2318

2168

global main_loop

2319

2169

# From the Avahi example code

2320

DBusGMainLoop(set_as_default=True)

2170

DBusGMainLoop(set_as_default=True )

2321

2171

main_loop = gobject.MainLoop()

2322

2172

bus = dbus.SystemBus()

2323

2173

# End of Avahi example code

2329

2179

("se.bsnet.fukt.Mandos", bus,

2330

2180

do_not_queue=True))

2331

2181

except dbus.exceptions.NameExistsException as e:

2332

logger.error("Disabling D-Bus:", exc_info=e)

2182

logger.error(unicode(e) + ", disabling D-Bus")

2333

2183

use_dbus = False

2334

2184

server_settings["use_dbus"] = False

2335

2185

tcp_server.use_dbus = False

2347

2197

2348

2198

client_class = Client

2349

2199

if use_dbus:

2350

client_class = functools.partial(ClientDBus, bus = bus)

2200

client_class = functools.partial(ClientDBusTransitional,

2201

bus = bus)

2351

2202

2352

2203

client_settings = Client.config_parser(client_config)

2353

2204

old_client_settings = {}

2361

2212

(stored_state))

2362

2213

os.remove(stored_state_path)

2363

2214

except IOError as e:

2364

if e.errno == errno.ENOENT:

2365

logger.warning("Could not load persistent state: {0}"

2366

.format(os.strerror(e.errno)))

2367

else:

2368

logger.critical("Could not load persistent state:",

2369

exc_info=e)

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2370

2218

raise

2371

except EOFError as e:

2372

logger.warning("Could not load persistent state: "

2373

"EOFError:", exc_info=e)

2374

2219

2375

2220

with PGPEngine() as pgp:

2376

2221

for client_name, client in clients_data.iteritems():

2393

2238

2394

2239

# Clients who has passed its expire date can still be

2395

2240

# enabled if its last checker was successful. Clients

2396

# whose checker succeeded before we stored its state is

2397

# assumed to have successfully run all checkers during

2398

# downtime.

2241

# whose checker failed before we stored its state is

2242

# assumed to have failed all checkers during downtime.

2399

2243

if client["enabled"]:

2400

2244

if datetime.datetime.utcnow() >= client["expires"]:

2401

2245

if not client["last_checked_ok"]:

2402

2246

logger.warning(

2403

2247

"disabling client {0} - Client never "

2404

"performed a successful checker"

2405

.format(client_name))

2248

"performed a successfull checker"

2249

.format(client["name"]))

2406

2250

client["enabled"] = False

2407

2251

elif client["last_checker_status"] != 0:

2408

2252

logger.warning(

2409

2253

"disabling client {0} - Client "

2410

2254

"last checker failed with error code {1}"

2411

.format(client_name,

2255

.format(client["name"],

2412

2256

client["last_checker_status"]))

2413

2257

client["enabled"] = False

2414

2258

else:

2415

2259

client["expires"] = (datetime.datetime

2416

2260

.utcnow()

2417

2261

+ client["timeout"])

2418

logger.debug("Last checker succeeded,"

2419

" keeping {0} enabled"

2420

.format(client_name))

2262

2421

2263

try:

2422

2264

client["secret"] = (

2423

2265

pgp.decrypt(client["encrypted_secret"],

2429

2271

.format(client_name))

2430

2272

client["secret"] = (

2431

2273

client_settings[client_name]["secret"])

2274

2432

2275

2433

2276

# Add/remove clients based on new changes made to config

2434

for client_name in (set(old_client_settings)

2435

- set(client_settings)):

2277

for client_name in set(old_client_settings) - set(client_settings):

2436

2278

del clients_data[client_name]

2437

for client_name in (set(client_settings)

2438

- set(old_client_settings)):

2279

for client_name in set(client_settings) - set(old_client_settings):

2439

2280

clients_data[client_name] = client_settings[client_name]

2440

2441

# Create all client objects

2281

2282

# Create clients all clients

2442

2283

for client_name, client in clients_data.iteritems():

2443

2284

tcp_server.clients[client_name] = client_class(

2444

2285

name = client_name, settings = client)

2445

2286

2446

2287

if not tcp_server.clients:

2447

2288

logger.warning("No clients defined")

2448

2289

2449

2290

if not debug:

2450

2291

try:

2451

2292

with pidfile:

2465

2306

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2466

2307

2467

2308

if use_dbus:

2468

@alternate_dbus_interfaces({"se.recompile.Mandos":

2469

"se.bsnet.fukt.Mandos"})

2470

class MandosDBusService(DBusObjectWithProperties):

2309

class MandosDBusService(dbus.service.Object):

2471

2310

"""A D-Bus proxy object"""

2472

2311

def __init__(self):

2473

2312

dbus.service.Object.__init__(self, bus, "/")

2474

2313

_interface = "se.recompile.Mandos"

2475

2314

2476

@dbus_interface_annotations(_interface)

2477

def _foo(self):

2478

return { "org.freedesktop.DBus.Property"

2479

".EmitsChangedSignal":

2480

"false"}

2481

2482

2315

@dbus.service.signal(_interface, signature="o")

2483

2316

def ClientAdded(self, objpath):

2484

2317

"D-Bus signal"

2526

2359

2527

2360

del _interface

2528

2361

2529

mandos_dbus_service = MandosDBusService()

2362

class MandosDBusServiceTransitional(MandosDBusService):

2363

__metaclass__ = AlternateDBusNamesMetaclass

2364

mandos_dbus_service = MandosDBusServiceTransitional()

2530

2365

2531

2366

def cleanup():

2532

2367

"Cleanup function; run on exit"

2565

2400

del client_settings[client.name]["secret"]

2566

2401

2567

2402

try:

2568

with (tempfile.NamedTemporaryFile

2569

(mode='wb', suffix=".pickle", prefix='clients-',

2570

dir=os.path.dirname(stored_state_path),

2571

delete=False)) as stored_state:

2403

with os.fdopen(os.open(stored_state_path,

2404

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2405

0600), "wb") as stored_state:

2572

2406

pickle.dump((clients, client_settings), stored_state)

2573

tempname=stored_state.name

2574

os.rename(tempname, stored_state_path)

2575

2407

except (IOError, OSError) as e:

2576

if not debug:

2577

try:

2578

os.remove(tempname)

2579

except NameError:

2580

pass

2581

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2582

logger.warning("Could not save persistent state: {0}"

2583

.format(os.strerror(e.errno)))

2584

else:

2585

logger.warning("Could not save persistent state:",

2586

exc_info=e)

2587

raise e

2408

logger.warning("Could not save persistent state: {0}"

2409

.format(e))

2410

if e.errno not in (errno.ENOENT, errno.EACCES):

2411

raise

2588

2412

2589

2413

# Delete all clients, and settings from config

2590

2414

while tcp_server.clients:

2617

2441

service.port = tcp_server.socket.getsockname()[1]

2618

2442

if use_ipv6:

2619

2443

logger.info("Now listening on address %r, port %d,"

2620

" flowinfo %d, scope_id %d",

2621

*tcp_server.socket.getsockname())

2444

" flowinfo %d, scope_id %d"

2445

% tcp_server.socket.getsockname())

2622

2446

else: # IPv4

2623

logger.info("Now listening on address %r, port %d",

2624

*tcp_server.socket.getsockname())

2447

logger.info("Now listening on address %r, port %d"

2448

% tcp_server.socket.getsockname())

2625

2449

2626

2450

#service.interface = tcp_server.socket.getsockname()[3]

2627

2451

2630

2454

try:

2631

2455

service.activate()

2632

2456

except dbus.exceptions.DBusException as error:

2633

logger.critical("D-Bus Exception", exc_info=error)

2457

logger.critical("DBusException: %s", error)

2634

2458

cleanup()

2635

2459

sys.exit(1)

2636

2460

# End of Avahi example code

2643

2467

logger.debug("Starting main loop")

2644

2468

main_loop.run()

2645

2469

except AvahiError as error:

2646

logger.critical("Avahi Error", exc_info=error)

2470

logger.critical("AvahiError: %s", error)

2647

2471

cleanup()

2648

2472

sys.exit(1)

2649

2473

except KeyboardInterrupt: