/mandos/trunk : revision 535.1.7

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

60

61

import fcntl

61

62

import functools

62

63

import cPickle as pickle

63

import select

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

64

68

65

69

import dbus

66

70

import dbus.service

71

75

import ctypes.util

72

76

import xml.dom.minidom

73

77

import inspect

78

import GnuPGInterface

74

79

75

80

try:

76

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

80

85

except ImportError:

81

86

SO_BINDTODEVICE = None

82

87

83

84

version = "1.0.14"

85

86

logger = logging.Logger(u'mandos')

88

version = "1.4.1"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

87

92

syslogger = (logging.handlers.SysLogHandler

88

93

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

89

address = "/dev/log"))

90

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

93

logger.addHandler(syslogger)

94

95

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

logger.addHandler(console)

94

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet'])

146

147

def __enter__(self):

148

return self

149

150

def __exit__ (self, exc_type, exc_value, traceback):

151

self._cleanup()

152

return False

153

154

def __del__(self):

155

self._cleanup()

156

157

def _cleanup(self):

158

if self.tempdir is not None:

159

# Delete contents of tempdir

160

for root, dirs, files in os.walk(self.tempdir,

161

topdown = False):

162

for filename in files:

163

os.remove(os.path.join(root, filename))

164

for dirname in dirs:

165

os.rmdir(os.path.join(root, dirname))

166

# Remove tempdir

167

os.rmdir(self.tempdir)

168

self.tempdir = None

169

170

def password_encode(self, password):

171

# Passphrase can not be empty and can not contain newlines or

172

# NUL bytes. So we prefix it and hex encode it.

173

return b"mandos" + binascii.hexlify(password)

174

175

def encrypt(self, data, password):

176

self.gnupg.passphrase = self.password_encode(password)

177

with open(os.devnull) as devnull:

178

try:

179

proc = self.gnupg.run(['--symmetric'],

180

create_fhs=['stdin', 'stdout'],

181

attach_fhs={'stderr': devnull})

182

with contextlib.closing(proc.handles['stdin']) as f:

183

f.write(data)

184

with contextlib.closing(proc.handles['stdout']) as f:

185

ciphertext = f.read()

186

proc.wait()

187

except IOError as e:

188

raise PGPError(e)

189

self.gnupg.passphrase = None

190

return ciphertext

191

192

def decrypt(self, data, password):

193

self.gnupg.passphrase = self.password_encode(password)

194

with open(os.devnull) as devnull:

195

try:

196

proc = self.gnupg.run(['--decrypt'],

197

create_fhs=['stdin', 'stdout'],

198

attach_fhs={'stderr': devnull})

199

with contextlib.closing(proc.handles['stdin'] ) as f:

200

f.write(data)

201

with contextlib.closing(proc.handles['stdout']) as f:

202

decrypted_plaintext = f.read()

203

proc.wait()

204

except IOError as e:

205

raise PGPError(e)

206

self.gnupg.passphrase = None

207

return decrypted_plaintext

208

209

100

210

101

211

class AvahiError(Exception):

102

212

def __init__(self, value, *args, **kwargs):

118

228

Attributes:

119

229

interface: integer; avahi.IF_UNSPEC or an interface index.

120

230

Used to optionally bind to the specified interface.

121

122

type: string; Example: u'_mandos._tcp'.

231

232

type: string; Example: '_mandos._tcp'.

123

233

See <http://www.dns-sd.org/ServiceTypes.html>

124

234

port: integer; what port to announce

125

235

TXT: list of strings; TXT record for the service

134

244

"""

135

245

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

136

246

servicetype = None, port = None, TXT = None,

137

domain = u"", host = u"", max_renames = 32768,

247

domain = "", host = "", max_renames = 32768,

138

248

protocol = avahi.PROTO_UNSPEC, bus = None):

139

249

self.interface = interface

140

250

self.name = name

149

259

self.group = None # our entry group

150

260

self.server = None

151

261

self.bus = bus

262

self.entry_group_state_changed_match = None

152

263

def rename(self):

153

264

"""Derived from the Avahi example code"""

154

265

if self.rename_count >= self.max_renames:

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

266

logger.critical("No suitable Zeroconf service name found"

267

" after %i retries, exiting.",

157

268

self.rename_count)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

162

syslogger.setFormatter(logging.Formatter

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

165

% self.name))

269

raise AvahiServiceError("Too many renames")

270

self.name = unicode(self.server

271

.GetAlternativeServiceName(self.name))

272

logger.info("Changing Zeroconf service name to %r ...",

273

self.name)

166

274

self.remove()

167

self.add()

275

try:

276

self.add()

277

except dbus.exceptions.DBusException as error:

278

logger.critical("DBusException: %s", error)

279

self.cleanup()

280

os._exit(1)

168

281

self.rename_count += 1

169

282

def remove(self):

170

283

"""Derived from the Avahi example code"""

284

if self.entry_group_state_changed_match is not None:

285

self.entry_group_state_changed_match.remove()

286

self.entry_group_state_changed_match = None

171

287

if self.group is not None:

172

288

self.group.Reset()

173

289

def add(self):

174

290

"""Derived from the Avahi example code"""

291

self.remove()

175

292

if self.group is None:

176

293

self.group = dbus.Interface(

177

294

self.bus.get_object(avahi.DBUS_NAME,

178

295

self.server.EntryGroupNew()),

179

296

avahi.DBUS_INTERFACE_ENTRY_GROUP)

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

297

self.entry_group_state_changed_match = (

298

self.group.connect_to_signal(

299

'StateChanged', self.entry_group_state_changed))

300

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

184

301

self.name, self.type)

185

302

self.group.AddService(

186

303

self.interface,

193

310

self.group.Commit()

194

311

def entry_group_state_changed(self, state, error):

195

312

"""Derived from the Avahi example code"""

196

logger.debug(u"Avahi entry group state change: %i", state)

313

logger.debug("Avahi entry group state change: %i", state)

197

314

198

315

if state == avahi.ENTRY_GROUP_ESTABLISHED:

199

logger.debug(u"Zeroconf service established.")

316

logger.debug("Zeroconf service established.")

200

317

elif state == avahi.ENTRY_GROUP_COLLISION:

201

logger.warning(u"Zeroconf service name collision.")

318

logger.info("Zeroconf service name collision.")

202

319

self.rename()

203

320

elif state == avahi.ENTRY_GROUP_FAILURE:

204

logger.critical(u"Avahi: Error in group state changed %s",

321

logger.critical("Avahi: Error in group state changed %s",

205

322

unicode(error))

206

raise AvahiGroupError(u"State changed: %s"

323

raise AvahiGroupError("State changed: %s"

207

324

% unicode(error))

208

325

def cleanup(self):

209

326

"""Derived from the Avahi example code"""

210

327

if self.group is not None:

211

self.group.Free()

328

try:

329

self.group.Free()

330

except (dbus.exceptions.UnknownMethodException,

331

dbus.exceptions.DBusException):

332

pass

212

333

self.group = None

213

def server_state_changed(self, state):

334

self.remove()

335

def server_state_changed(self, state, error=None):

214

336

"""Derived from the Avahi example code"""

215

logger.debug(u"Avahi server state change: %i", state)

216

if state == avahi.SERVER_COLLISION:

217

logger.error(u"Zeroconf server name collision")

218

self.remove()

337

logger.debug("Avahi server state change: %i", state)

338

bad_states = { avahi.SERVER_INVALID:

339

"Zeroconf server invalid",

340

avahi.SERVER_REGISTERING: None,

341

avahi.SERVER_COLLISION:

342

"Zeroconf server name collision",

343

avahi.SERVER_FAILURE:

344

"Zeroconf server failure" }

345

if state in bad_states:

346

if bad_states[state] is not None:

347

if error is None:

348

logger.error(bad_states[state])

349

else:

350

logger.error(bad_states[state] + ": %r", error)

351

self.cleanup()

219

352

elif state == avahi.SERVER_RUNNING:

220

353

self.add()

354

else:

355

if error is None:

356

logger.debug("Unknown state: %r", state)

357

else:

358

logger.debug("Unknown state: %r: %r", state, error)

221

359

def activate(self):

222

360

"""Derived from the Avahi example code"""

223

361

if self.server is None:

224

362

self.server = dbus.Interface(

225

363

self.bus.get_object(avahi.DBUS_NAME,

226

avahi.DBUS_PATH_SERVER),

364

avahi.DBUS_PATH_SERVER,

365

follow_name_owner_changes=True),

227

366

avahi.DBUS_INTERFACE_SERVER)

228

self.server.connect_to_signal(u"StateChanged",

367

self.server.connect_to_signal("StateChanged",

229

368

self.server_state_changed)

230

369

self.server_state_changed(self.server.GetState())

231

370

371

class AvahiServiceToSyslog(AvahiService):

372

def rename(self):

373

"""Add the new name to the syslog messages"""

374

ret = AvahiService.rename(self)

375

syslogger.setFormatter(logging.Formatter

376

('Mandos (%s) [%%(process)d]:'

377

' %%(levelname)s: %%(message)s'

378

% self.name))

379

return ret

232

380

381

def timedelta_to_milliseconds(td):

382

"Convert a datetime.timedelta() to milliseconds"

383

return ((td.days * 24 * 60 * 60 * 1000)

384

+ (td.seconds * 1000)

385

+ (td.microseconds // 1000))

386

233

387

class Client(object):

234

388

"""A representation of a client host served by this server.

235

389

236

390

Attributes:

237

238

D-Bus identifiers

391

approved: bool(); 'None' if not yet approved/disapproved

392

approval_delay: datetime.timedelta(); Time to wait for approval

393

approval_duration: datetime.timedelta(); Duration of one approval

394

checker: subprocess.Popen(); a running checker process used

395

to see if the client lives.

396

'None' if no process is running.

397

checker_callback_tag: a gobject event source tag, or None

398

checker_command: string; External command which is run to check

399

if client lives. %() expansions are done at

400

runtime with vars(self) as dict, so that for

401

instance %(name)s can be used in the command.

402

checker_initiator_tag: a gobject event source tag, or None

403

created: datetime.datetime(); (UTC) object creation

404

client_structure: Object describing what attributes a client has

405

and is used for storing the client at exit

406

current_checker_command: string; current running checker_command

407

disable_initiator_tag: a gobject event source tag, or None

408

enabled: bool()

239

409

fingerprint: string (40 or 32 hexadecimal digits); used to

240

410

uniquely identify the client

241

secret: bytestring; sent verbatim (over TLS) to client

242

411

host: string; available for use by the checker command

243

created: datetime.datetime(); (UTC) object creation

244

last_enabled: datetime.datetime(); (UTC)

245

enabled: bool()

412

interval: datetime.timedelta(); How often to start a new checker

413

last_approval_request: datetime.datetime(); (UTC) or None

246

414

last_checked_ok: datetime.datetime(); (UTC) or None

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

419

420

D-Bus identifiers

421

secret: bytestring; sent verbatim (over TLS) to client

247

422

timeout: datetime.timedelta(); How long from last_checked_ok

248

423

until this client is disabled

249

interval: datetime.timedelta(); How often to start a new checker

250

disable_hook: If set, called by disable() as disable_hook(self)

251

checker: subprocess.Popen(); a running checker process used

252

to see if the client lives.

253

'None' if no process is running.

254

checker_initiator_tag: a gobject event source tag, or None

255

disable_initiator_tag: - '' -

256

checker_callback_tag: - '' -

257

checker_command: string; External command which is run to check if

258

client lives. %() expansions are done at

259

runtime with vars(self) as dict, so that for

260

instance %(name)s can be used in the command.

261

current_checker_command: string; current running checker_command

424

extended_timeout: extra long timeout when password has been sent

425

runtime_expansions: Allowed attributes for runtime expansion.

426

expires: datetime.datetime(); time (UTC) when a client will be

427

disabled, or None

262

428

"""

263

429

264

@staticmethod

265

def _timedelta_to_milliseconds(td):

266

"Convert a datetime.timedelta() to milliseconds"

267

return ((td.days * 24 * 60 * 60 * 1000)

268

+ (td.seconds * 1000)

269

+ (td.microseconds // 1000))

430

runtime_expansions = ("approval_delay", "approval_duration",

431

"created", "enabled", "fingerprint",

432

"host", "interval", "last_checked_ok",

433

"last_enabled", "name", "timeout")

434

client_defaults = { "timeout": "5m",

435

"extended_timeout": "15m",

436

"interval": "2m",

437

"checker": "fping -q -- %%(host)s",

438

"host": "",

439

"approval_delay": "0s",

440

"approval_duration": "1s",

441

"approved_by_default": "True",

442

"enabled": "True",

443

}

270

444

271

445

def timeout_milliseconds(self):

272

446

"Return the 'timeout' attribute in milliseconds"

273

return self._timedelta_to_milliseconds(self.timeout)

447

return timedelta_to_milliseconds(self.timeout)

448

449

def extended_timeout_milliseconds(self):

450

"Return the 'extended_timeout' attribute in milliseconds"

451

return timedelta_to_milliseconds(self.extended_timeout)

274

452

275

453

def interval_milliseconds(self):

276

454

"Return the 'interval' attribute in milliseconds"

277

return self._timedelta_to_milliseconds(self.interval)

455

return timedelta_to_milliseconds(self.interval)

278

456

279

def __init__(self, name = None, disable_hook=None, config=None):

457

def approval_delay_milliseconds(self):

458

return timedelta_to_milliseconds(self.approval_delay)

459

460

@staticmethod

461

def config_parser(config):

462

""" Construct a new dict of client settings of this form:

463

{ client_name: {setting_name: value, ...}, ...}

464

with exceptions for any special settings as defined above"""

465

settings = {}

466

for client_name in config.sections():

467

section = dict(config.items(client_name))

468

client = settings[client_name] = {}

469

470

client["host"] = section["host"]

471

# Reformat values from string types to Python types

472

client["approved_by_default"] = config.getboolean(

473

client_name, "approved_by_default")

474

client["enabled"] = config.getboolean(client_name, "enabled")

475

476

client["fingerprint"] = (section["fingerprint"].upper()

477

.replace(" ", ""))

478

if "secret" in section:

479

client["secret"] = section["secret"].decode("base64")

480

elif "secfile" in section:

481

with open(os.path.expanduser(os.path.expandvars

482

(section["secfile"])),

483

"rb") as secfile:

484

client["secret"] = secfile.read()

485

else:

486

raise TypeError("No secret or secfile for section %s"

487

% section)

488

client["timeout"] = string_to_delta(section["timeout"])

489

client["extended_timeout"] = string_to_delta(

490

section["extended_timeout"])

491

client["interval"] = string_to_delta(section["interval"])

492

client["approval_delay"] = string_to_delta(

493

section["approval_delay"])

494

client["approval_duration"] = string_to_delta(

495

section["approval_duration"])

496

client["checker_command"] = section["checker"]

497

client["last_approval_request"] = None

498

client["last_checked_ok"] = None

499

client["last_checker_status"] = None

500

if client["enabled"]:

501

client["last_enabled"] = datetime.datetime.utcnow()

502

client["expires"] = (datetime.datetime.utcnow()

503

+ client["timeout"])

504

else:

505

client["last_enabled"] = None

506

client["expires"] = None

507

508

return settings

509

510

511

def __init__(self, settings, name = None):

280

512

"""Note: the 'checker' key in 'config' sets the

281

513

'checker_command' attribute and *not* the 'checker'

282

514

attribute."""

283

515

self.name = name

284

if config is None:

285

config = {}

286

logger.debug(u"Creating client %r", self.name)

516

# adding all client settings

517

for setting, value in settings.iteritems():

518

setattr(self, setting, value)

519

520

logger.debug("Creating client %r", self.name)

287

521

# Uppercase and remove spaces from fingerprint for later

288

522

# comparison purposes with return value from the fingerprint()

289

523

# function

290

self.fingerprint = (config[u"fingerprint"].upper()

291

.replace(u" ", u""))

292

logger.debug(u" Fingerprint: %s", self.fingerprint)

293

if u"secret" in config:

294

self.secret = config[u"secret"].decode(u"base64")

295

elif u"secfile" in config:

296

with open(os.path.expanduser(os.path.expandvars

297

(config[u"secfile"])),

298

"rb") as secfile:

299

self.secret = secfile.read()

300

else:

301

raise TypeError(u"No secret or secfile for client %s"

302

% self.name)

303

self.host = config.get(u"host", u"")

304

self.created = datetime.datetime.utcnow()

305

self.enabled = False

306

self.last_enabled = None

307

self.last_checked_ok = None

308

self.timeout = string_to_delta(config[u"timeout"])

309

self.interval = string_to_delta(config[u"interval"])

310

self.disable_hook = disable_hook

524

logger.debug(" Fingerprint: %s", self.fingerprint)

525

self.created = settings.get("created", datetime.datetime.utcnow())

526

527

# attributes specific for this server instance

311

528

self.checker = None

312

529

self.checker_initiator_tag = None

313

530

self.disable_initiator_tag = None

314

531

self.checker_callback_tag = None

315

self.checker_command = config[u"checker"]

316

532

self.current_checker_command = None

317

self.last_connect = None

533

self.approved = None

534

self.approvals_pending = 0

535

self.changedstate = (multiprocessing_manager

536

.Condition(multiprocessing_manager

537

.Lock()))

538

self.client_structure = [attr for attr in

539

self.__dict__.iterkeys()

540

if not attr.startswith("_")]

541

self.client_structure.append("client_structure")

542

543

for name, t in inspect.getmembers(type(self),

544

lambda obj:

545

isinstance(obj,

546

property)):

547

if not name.startswith("_"):

548

self.client_structure.append(name)

549

550

# Send notice to process children that client state has changed

551

def send_changedstate(self):

552

with self.changedstate:

553

self.changedstate.notify_all()

318

554

319

555

def enable(self):

320

556

"""Start this client's checker and timeout hooks"""

321

if getattr(self, u"enabled", False):

557

if getattr(self, "enabled", False):

322

558

# Already enabled

323

559

return

560

self.send_changedstate()

561

self.expires = datetime.datetime.utcnow() + self.timeout

562

self.enabled = True

324

563

self.last_enabled = datetime.datetime.utcnow()

564

self.init_checker()

565

566

def disable(self, quiet=True):

567

"""Disable this client."""

568

if not getattr(self, "enabled", False):

569

return False

570

if not quiet:

571

self.send_changedstate()

572

if not quiet:

573

logger.info("Disabling client %s", self.name)

574

if getattr(self, "disable_initiator_tag", False):

575

gobject.source_remove(self.disable_initiator_tag)

576

self.disable_initiator_tag = None

577

self.expires = None

578

if getattr(self, "checker_initiator_tag", False):

579

gobject.source_remove(self.checker_initiator_tag)

580

self.checker_initiator_tag = None

581

self.stop_checker()

582

self.enabled = False

583

# Do not run this again if called by a gobject.timeout_add

584

return False

585

586

def __del__(self):

587

self.disable()

588

589

def init_checker(self):

325

590

# Schedule a new checker to be started an 'interval' from now,

326

591

# and every interval from then on.

327

592

self.checker_initiator_tag = (gobject.timeout_add

331

596

self.disable_initiator_tag = (gobject.timeout_add

332

597

(self.timeout_milliseconds(),

333

598

self.disable))

334

self.enabled = True

335

599

# Also start a new checker *right now*.

336

600

self.start_checker()

337

601

338

def disable(self, quiet=True):

339

"""Disable this client."""

340

if not getattr(self, "enabled", False):

341

return False

342

if not quiet:

343

logger.info(u"Disabling client %s", self.name)

344

if getattr(self, u"disable_initiator_tag", False):

345

gobject.source_remove(self.disable_initiator_tag)

346

self.disable_initiator_tag = None

347

if getattr(self, u"checker_initiator_tag", False):

348

gobject.source_remove(self.checker_initiator_tag)

349

self.checker_initiator_tag = None

350

self.stop_checker()

351

if self.disable_hook:

352

self.disable_hook(self)

353

self.enabled = False

354

# Do not run this again if called by a gobject.timeout_add

355

return False

356

357

def __del__(self):

358

self.disable_hook = None

359

self.disable()

360

361

602

def checker_callback(self, pid, condition, command):

362

603

"""The checker has completed, so take appropriate actions."""

363

604

self.checker_callback_tag = None

364

605

self.checker = None

365

606

if os.WIFEXITED(condition):

366

exitstatus = os.WEXITSTATUS(condition)

367

if exitstatus == 0:

368

logger.info(u"Checker for %(name)s succeeded",

607

self.last_checker_status = os.WEXITSTATUS(condition)

608

if self.last_checker_status == 0:

609

logger.info("Checker for %(name)s succeeded",

369

610

vars(self))

370

611

self.checked_ok()

371

612

else:

372

logger.info(u"Checker for %(name)s failed",

613

logger.info("Checker for %(name)s failed",

373

614

vars(self))

374

615

else:

375

logger.warning(u"Checker for %(name)s crashed?",

616

self.last_checker_status = -1

617

logger.warning("Checker for %(name)s crashed?",

376

618

vars(self))

377

619

378

def checked_ok(self):

620

def checked_ok(self, timeout=None):

379

621

"""Bump up the timeout for this client.

380

622

381

623

This should only be called when the client has been seen,

382

624

alive and well.

383

625

"""

626

if timeout is None:

627

timeout = self.timeout

384

628

self.last_checked_ok = datetime.datetime.utcnow()

385

gobject.source_remove(self.disable_initiator_tag)

386

self.disable_initiator_tag = (gobject.timeout_add

387

(self.timeout_milliseconds(),

388

self.disable))

629

if self.disable_initiator_tag is not None:

630

gobject.source_remove(self.disable_initiator_tag)

631

if getattr(self, "enabled", False):

632

self.disable_initiator_tag = (gobject.timeout_add

633

(timedelta_to_milliseconds

634

(timeout), self.disable))

635

self.expires = datetime.datetime.utcnow() + timeout

636

637

def need_approval(self):

638

self.last_approval_request = datetime.datetime.utcnow()

389

639

390

640

def start_checker(self):

391

641

"""Start a new checker subprocess if one is not running.

404

654

# If a checker exists, make sure it is not a zombie

405

655

try:

406

656

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

407

except (AttributeError, OSError), error:

657

except (AttributeError, OSError) as error:

408

658

if (isinstance(error, OSError)

409

659

and error.errno != errno.ECHILD):

410

660

raise error

411

661

else:

412

662

if pid:

413

logger.warning(u"Checker was a zombie")

663

logger.warning("Checker was a zombie")

414

664

gobject.source_remove(self.checker_callback_tag)

415

665

self.checker_callback(pid, status,

416

666

self.current_checker_command)

421

671

command = self.checker_command % self.host

422

672

except TypeError:

423

673

# Escape attributes for the shell

424

escaped_attrs = dict((key,

425

re.escape(unicode(str(val),

426

errors=

427

u'replace')))

428

for key, val in

429

vars(self).iteritems())

674

escaped_attrs = dict(

675

(attr,

676

re.escape(unicode(str(getattr(self, attr, "")),

677

errors=

678

'replace')))

679

for attr in

680

self.runtime_expansions)

681

430

682

try:

431

683

command = self.checker_command % escaped_attrs

432

except TypeError, error:

433

logger.error(u'Could not format string "%s":'

434

u' %s', self.checker_command, error)

684

except TypeError as error:

685

logger.error('Could not format string "%s":'

686

' %s', self.checker_command, error)

435

687

return True # Try again later

436

688

self.current_checker_command = command

437

689

try:

438

logger.info(u"Starting checker %r for %s",

690

logger.info("Starting checker %r for %s",

439

691

command, self.name)

440

692

# We don't need to redirect stdout and stderr, since

441

693

# in normal mode, that is already done by daemon(),

443

695

# always replaced by /dev/null.)

444

696

self.checker = subprocess.Popen(command,

445

697

close_fds=True,

446

shell=True, cwd=u"/")

698

shell=True, cwd="/")

447

699

self.checker_callback_tag = (gobject.child_watch_add

448

700

(self.checker.pid,

449

701

self.checker_callback,

454

706

if pid:

455

707

gobject.source_remove(self.checker_callback_tag)

456

708

self.checker_callback(pid, status, command)

457

except OSError, error:

458

logger.error(u"Failed to start subprocess: %s",

709

except OSError as error:

710

logger.error("Failed to start subprocess: %s",

459

711

error)

460

712

# Re-run this periodically if run by gobject.timeout_add

461

713

return True

465

717

if self.checker_callback_tag:

466

718

gobject.source_remove(self.checker_callback_tag)

467

719

self.checker_callback_tag = None

468

if getattr(self, u"checker", None) is None:

720

if getattr(self, "checker", None) is None:

469

721

return

470

logger.debug(u"Stopping checker for %(name)s", vars(self))

722

logger.debug("Stopping checker for %(name)s", vars(self))

471

723

try:

472

724

os.kill(self.checker.pid, signal.SIGTERM)

473

725

#time.sleep(0.5)

474

726

#if self.checker.poll() is None:

475

727

# os.kill(self.checker.pid, signal.SIGKILL)

476

except OSError, error:

728

except OSError as error:

477

729

if error.errno != errno.ESRCH: # No such process

478

730

raise

479

731

self.checker = None

480

732

481

733

482

def dbus_service_property(dbus_interface, signature=u"v",

483

access=u"readwrite", byte_arrays=False):

734

def dbus_service_property(dbus_interface, signature="v",

735

access="readwrite", byte_arrays=False):

484

736

"""Decorators for marking methods of a DBusObjectWithProperties to

485

737

become properties on the D-Bus.

486

738

493

745

"""

494

746

# Encoding deeply encoded byte arrays is not supported yet by the

495

747

# "Set" method, so we fail early here:

496

if byte_arrays and signature != u"ay":

497

raise ValueError(u"Byte arrays not supported for non-'ay'"

498

u" signature %r" % signature)

748

if byte_arrays and signature != "ay":

749

raise ValueError("Byte arrays not supported for non-'ay'"

750

" signature %r" % signature)

499

751

def decorator(func):

500

752

func._dbus_is_property = True

501

753

func._dbus_interface = dbus_interface

502

754

func._dbus_signature = signature

503

755

func._dbus_access = access

504

756

func._dbus_name = func.__name__

505

if func._dbus_name.endswith(u"_dbus_property"):

757

if func._dbus_name.endswith("_dbus_property"):

506

758

func._dbus_name = func._dbus_name[:-14]

507

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

759

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

508

760

return func

509

761

return decorator

510

762

530

782

531

783

class DBusObjectWithProperties(dbus.service.Object):

532

784

"""A D-Bus object with properties.

533

785

534

786

Classes inheriting from this can use the dbus_service_property

535

787

decorator to expose methods as D-Bus properties. It exposes the

536

788

standard Get(), Set(), and GetAll() methods on the D-Bus.

538

790

539

791

@staticmethod

540

792

def _is_dbus_property(obj):

541

return getattr(obj, u"_dbus_is_property", False)

793

return getattr(obj, "_dbus_is_property", False)

542

794

543

795

def _get_all_dbus_properties(self):

544

796

"""Returns a generator of (name, attribute) pairs

545

797

"""

546

return ((prop._dbus_name, prop)

798

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

799

for cls in self.__class__.__mro__

547

800

for name, prop in

548

inspect.getmembers(self, self._is_dbus_property))

801

inspect.getmembers(cls, self._is_dbus_property))

549

802

550

803

def _get_dbus_property(self, interface_name, property_name):

551

804

"""Returns a bound method if one exists which is a D-Bus

552

805

property with the specified name and interface.

553

806

"""

554

for name in (property_name,

555

property_name + u"_dbus_property"):

556

prop = getattr(self, name, None)

557

if (prop is None

558

or not self._is_dbus_property(prop)

559

or prop._dbus_name != property_name

560

or (interface_name and prop._dbus_interface

561

and interface_name != prop._dbus_interface)):

562

continue

563

return prop

807

for cls in self.__class__.__mro__:

808

for name, value in (inspect.getmembers

809

(cls, self._is_dbus_property)):

810

if (value._dbus_name == property_name

811

and value._dbus_interface == interface_name):

812

return value.__get__(self)

813

564

814

# No such property

565

raise DBusPropertyNotFound(self.dbus_object_path + u":"

566

+ interface_name + u"."

815

raise DBusPropertyNotFound(self.dbus_object_path + ":"

816

+ interface_name + "."

567

817

+ property_name)

568

818

569

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

570

out_signature=u"v")

819

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

820

out_signature="v")

571

821

def Get(self, interface_name, property_name):

572

822

"""Standard D-Bus property Get() method, see D-Bus standard.

573

823

"""

574

824

prop = self._get_dbus_property(interface_name, property_name)

575

if prop._dbus_access == u"write":

825

if prop._dbus_access == "write":

576

826

raise DBusPropertyAccessException(property_name)

577

827

value = prop()

578

if not hasattr(value, u"variant_level"):

828

if not hasattr(value, "variant_level"):

579

829

return value

580

830

return type(value)(value, variant_level=value.variant_level+1)

581

831

582

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

832

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

583

833

def Set(self, interface_name, property_name, value):

584

834

"""Standard D-Bus property Set() method, see D-Bus standard.

585

835

"""

586

836

prop = self._get_dbus_property(interface_name, property_name)

587

if prop._dbus_access == u"read":

837

if prop._dbus_access == "read":

588

838

raise DBusPropertyAccessException(property_name)

589

if prop._dbus_get_args_options[u"byte_arrays"]:

839

if prop._dbus_get_args_options["byte_arrays"]:

590

840

# The byte_arrays option is not supported yet on

591

841

# signatures other than "ay".

592

if prop._dbus_signature != u"ay":

842

if prop._dbus_signature != "ay":

593

843

raise ValueError

594

844

value = dbus.ByteArray(''.join(unichr(byte)

595

845

for byte in value))

596

846

prop(value)

597

847

598

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

599

out_signature=u"a{sv}")

848

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

849

out_signature="a{sv}")

600

850

def GetAll(self, interface_name):

601

851

"""Standard D-Bus property GetAll() method, see D-Bus

602

852

standard.

603

853

604

854

Note: Will not include properties with access="write".

605

855

"""

606

all = {}

856

properties = {}

607

857

for name, prop in self._get_all_dbus_properties():

608

858

if (interface_name

609

859

and interface_name != prop._dbus_interface):

610

860

# Interface non-empty but did not match

611

861

continue

612

862

# Ignore write-only properties

613

if prop._dbus_access == u"write":

863

if prop._dbus_access == "write":

614

864

continue

615

865

value = prop()

616

if not hasattr(value, u"variant_level"):

617

all[name] = value

866

if not hasattr(value, "variant_level"):

867

properties[name] = value

618

868

continue

619

all[name] = type(value)(value, variant_level=

620

value.variant_level+1)

621

return dbus.Dictionary(all, signature=u"sv")

869

properties[name] = type(value)(value, variant_level=

870

value.variant_level+1)

871

return dbus.Dictionary(properties, signature="sv")

622

872

623

873

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

624

out_signature=u"s",

874

out_signature="s",

625

875

path_keyword='object_path',

626

876

connection_keyword='connection')

627

877

def Introspect(self, object_path, connection):

632

882

try:

633

883

document = xml.dom.minidom.parseString(xmlstring)

634

884

def make_tag(document, name, prop):

635

e = document.createElement(u"property")

636

e.setAttribute(u"name", name)

637

e.setAttribute(u"type", prop._dbus_signature)

638

e.setAttribute(u"access", prop._dbus_access)

885

e = document.createElement("property")

886

e.setAttribute("name", name)

887

e.setAttribute("type", prop._dbus_signature)

888

e.setAttribute("access", prop._dbus_access)

639

889

return e

640

for if_tag in document.getElementsByTagName(u"interface"):

890

for if_tag in document.getElementsByTagName("interface"):

641

891

for tag in (make_tag(document, name, prop)

642

892

for name, prop

643

893

in self._get_all_dbus_properties()

644

894

if prop._dbus_interface

645

== if_tag.getAttribute(u"name")):

895

== if_tag.getAttribute("name")):

646

896

if_tag.appendChild(tag)

647

897

# Add the names to the return values for the

648

898

# "org.freedesktop.DBus.Properties" methods

649

if (if_tag.getAttribute(u"name")

650

== u"org.freedesktop.DBus.Properties"):

651

for cn in if_tag.getElementsByTagName(u"method"):

652

if cn.getAttribute(u"name") == u"Get":

653

for arg in cn.getElementsByTagName(u"arg"):

654

if (arg.getAttribute(u"direction")

655

== u"out"):

656

arg.setAttribute(u"name", u"value")

657

elif cn.getAttribute(u"name") == u"GetAll":

658

for arg in cn.getElementsByTagName(u"arg"):

659

if (arg.getAttribute(u"direction")

660

== u"out"):

661

arg.setAttribute(u"name", u"props")

662

xmlstring = document.toxml(u"utf-8")

899

if (if_tag.getAttribute("name")

900

== "org.freedesktop.DBus.Properties"):

901

for cn in if_tag.getElementsByTagName("method"):

902

if cn.getAttribute("name") == "Get":

903

for arg in cn.getElementsByTagName("arg"):

904

if (arg.getAttribute("direction")

905

== "out"):

906

arg.setAttribute("name", "value")

907

elif cn.getAttribute("name") == "GetAll":

908

for arg in cn.getElementsByTagName("arg"):

909

if (arg.getAttribute("direction")

910

== "out"):

911

arg.setAttribute("name", "props")

912

xmlstring = document.toxml("utf-8")

663

913

document.unlink()

664

914

except (AttributeError, xml.dom.DOMException,

665

xml.parsers.expat.ExpatError), error:

666

logger.error(u"Failed to override Introspection method",

915

xml.parsers.expat.ExpatError) as error:

916

logger.error("Failed to override Introspection method",

667

917

error)

668

918

return xmlstring

669

919

670

920

921

def datetime_to_dbus (dt, variant_level=0):

922

"""Convert a UTC datetime.datetime() to a D-Bus type."""

923

if dt is None:

924

return dbus.String("", variant_level = variant_level)

925

return dbus.String(dt.isoformat(),

926

variant_level=variant_level)

927

928

929

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

930

.__metaclass__):

931

"""Applied to an empty subclass of a D-Bus object, this metaclass

932

will add additional D-Bus attributes matching a certain pattern.

933

"""

934

def __new__(mcs, name, bases, attr):

935

# Go through all the base classes which could have D-Bus

936

# methods, signals, or properties in them

937

for base in (b for b in bases

938

if issubclass(b, dbus.service.Object)):

939

# Go though all attributes of the base class

940

for attrname, attribute in inspect.getmembers(base):

941

# Ignore non-D-Bus attributes, and D-Bus attributes

942

# with the wrong interface name

943

if (not hasattr(attribute, "_dbus_interface")

944

or not attribute._dbus_interface

945

.startswith("se.recompile.Mandos")):

946

continue

947

# Create an alternate D-Bus interface name based on

948

# the current name

949

alt_interface = (attribute._dbus_interface

950

.replace("se.recompile.Mandos",

951

"se.bsnet.fukt.Mandos"))

952

# Is this a D-Bus signal?

953

if getattr(attribute, "_dbus_is_signal", False):

954

# Extract the original non-method function by

955

# black magic

956

nonmethod_func = (dict(

957

zip(attribute.func_code.co_freevars,

958

attribute.__closure__))["func"]

959

.cell_contents)

960

# Create a new, but exactly alike, function

961

# object, and decorate it to be a new D-Bus signal

962

# with the alternate D-Bus interface name

963

new_function = (dbus.service.signal

964

(alt_interface,

965

attribute._dbus_signature)

966

(types.FunctionType(

967

nonmethod_func.func_code,

968

nonmethod_func.func_globals,

969

nonmethod_func.func_name,

970

nonmethod_func.func_defaults,

971

nonmethod_func.func_closure)))

972

# Define a creator of a function to call both the

973

# old and new functions, so both the old and new

974

# signals gets sent when the function is called

975

def fixscope(func1, func2):

976

"""This function is a scope container to pass

977

func1 and func2 to the "call_both" function

978

outside of its arguments"""

979

def call_both(*args, **kwargs):

980

"""This function will emit two D-Bus

981

signals by calling func1 and func2"""

982

func1(*args, **kwargs)

983

func2(*args, **kwargs)

984

return call_both

985

# Create the "call_both" function and add it to

986

# the class

987

attr[attrname] = fixscope(attribute,

988

new_function)

989

# Is this a D-Bus method?

990

elif getattr(attribute, "_dbus_is_method", False):

991

# Create a new, but exactly alike, function

992

# object. Decorate it to be a new D-Bus method

993

# with the alternate D-Bus interface name. Add it

994

# to the class.

995

attr[attrname] = (dbus.service.method

996

(alt_interface,

997

attribute._dbus_in_signature,

998

attribute._dbus_out_signature)

999

(types.FunctionType

1000

(attribute.func_code,

1001

attribute.func_globals,

1002

attribute.func_name,

1003

attribute.func_defaults,

1004

attribute.func_closure)))

1005

# Is this a D-Bus property?

1006

elif getattr(attribute, "_dbus_is_property", False):

1007

# Create a new, but exactly alike, function

1008

# object, and decorate it to be a new D-Bus

1009

# property with the alternate D-Bus interface

1010

# name. Add it to the class.

1011

attr[attrname] = (dbus_service_property

1012

(alt_interface,

1013

attribute._dbus_signature,

1014

attribute._dbus_access,

1015

attribute

1016

._dbus_get_args_options

1017

["byte_arrays"])

1018

(types.FunctionType

1019

(attribute.func_code,

1020

attribute.func_globals,

1021

attribute.func_name,

1022

attribute.func_defaults,

1023

attribute.func_closure)))

1024

return type.__new__(mcs, name, bases, attr)

1025

1026

671

1027

class ClientDBus(Client, DBusObjectWithProperties):

672

1028

"""A Client class using D-Bus

673

1029

675

1031

dbus_object_path: dbus.ObjectPath

676

1032

bus: dbus.SystemBus()

677

1033

"""

1034

1035

runtime_expansions = (Client.runtime_expansions

1036

+ ("dbus_object_path",))

1037

678

1038

# dbus.service.Object doesn't use super(), so we can't either.

679

1039

680

1040

def __init__(self, bus = None, *args, **kwargs):

681

1041

self.bus = bus

682

1042

Client.__init__(self, *args, **kwargs)

1043

self._approvals_pending = 0

1044

1045

self._approvals_pending = 0

683

1046

# Only now, when this client is initialized, can it show up on

684

1047

# the D-Bus

1048

client_object_name = unicode(self.name).translate(

1049

{ord("."): ord("_"),

1050

ord("-"): ord("_")})

685

1051

self.dbus_object_path = (dbus.ObjectPath

686

(u"/clients/"

687

+ self.name.replace(u".", u"_")))

1052

("/clients/" + client_object_name))

688

1053

DBusObjectWithProperties.__init__(self, self.bus,

689

1054

self.dbus_object_path)

690

691

@staticmethod

692

def _datetime_to_dbus(dt, variant_level=0):

693

"""Convert a UTC datetime.datetime() to a D-Bus type."""

694

return dbus.String(dt.isoformat(),

695

variant_level=variant_level)

696

697

def enable(self):

698

oldstate = getattr(self, u"enabled", False)

699

r = Client.enable(self)

700

if oldstate != self.enabled:

701

# Emit D-Bus signals

702

self.PropertyChanged(dbus.String(u"enabled"),

703

dbus.Boolean(True, variant_level=1))

704

self.PropertyChanged(

705

dbus.String(u"last_enabled"),

706

self._datetime_to_dbus(self.last_enabled,

707

variant_level=1))

708

return r

709

710

def disable(self, quiet = False):

711

oldstate = getattr(self, u"enabled", False)

712

r = Client.disable(self, quiet=quiet)

713

if not quiet and oldstate != self.enabled:

714

# Emit D-Bus signal

715

self.PropertyChanged(dbus.String(u"enabled"),

716

dbus.Boolean(False, variant_level=1))

717

return r

1055

1056

def notifychangeproperty(transform_func,

1057

dbus_name, type_func=lambda x: x,

1058

variant_level=1):

1059

""" Modify a variable so that it's a property which announces

1060

its changes to DBus.

1061

1062

transform_fun: Function that takes a value and a variant_level

1063

and transforms it to a D-Bus type.

1064

dbus_name: D-Bus name of the variable

1065

type_func: Function that transform the value before sending it

1066

to the D-Bus. Default: no transform

1067

variant_level: D-Bus variant level. Default: 1

1068

"""

1069

attrname = "_{0}".format(dbus_name)

1070

def setter(self, value):

1071

if hasattr(self, "dbus_object_path"):

1072

if (not hasattr(self, attrname) or

1073

type_func(getattr(self, attrname, None))

1074

!= type_func(value)):

1075

dbus_value = transform_func(type_func(value),

1076

variant_level

1077

=variant_level)

1078

self.PropertyChanged(dbus.String(dbus_name),

1079

dbus_value)

1080

setattr(self, attrname, value)

1081

1082

return property(lambda self: getattr(self, attrname), setter)

1083

1084

1085

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1086

approvals_pending = notifychangeproperty(dbus.Boolean,

1087

"ApprovalPending",

1088

type_func = bool)

1089

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1090

last_enabled = notifychangeproperty(datetime_to_dbus,

1091

"LastEnabled")

1092

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1093

type_func = lambda checker:

1094

checker is not None)

1095

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1096

"LastCheckedOK")

1097

last_approval_request = notifychangeproperty(

1098

datetime_to_dbus, "LastApprovalRequest")

1099

approved_by_default = notifychangeproperty(dbus.Boolean,

1100

"ApprovedByDefault")

1101

approval_delay = notifychangeproperty(dbus.UInt64,

1102

"ApprovalDelay",

1103

type_func =

1104

timedelta_to_milliseconds)

1105

approval_duration = notifychangeproperty(

1106

dbus.UInt64, "ApprovalDuration",

1107

type_func = timedelta_to_milliseconds)

1108

host = notifychangeproperty(dbus.String, "Host")

1109

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1110

type_func =

1111

timedelta_to_milliseconds)

1112

extended_timeout = notifychangeproperty(

1113

dbus.UInt64, "ExtendedTimeout",

1114

type_func = timedelta_to_milliseconds)

1115

interval = notifychangeproperty(dbus.UInt64,

1116

"Interval",

1117

type_func =

1118

timedelta_to_milliseconds)

1119

checker_command = notifychangeproperty(dbus.String, "Checker")

1120

1121

del notifychangeproperty

718

1122

719

1123

def __del__(self, *args, **kwargs):

720

1124

try:

721

1125

self.remove_from_connection()

722

1126

except LookupError:

723

1127

pass

724

if hasattr(DBusObjectWithProperties, u"__del__"):

1128

if hasattr(DBusObjectWithProperties, "__del__"):

725

1129

DBusObjectWithProperties.__del__(self, *args, **kwargs)

726

1130

Client.__del__(self, *args, **kwargs)

727

1131

729

1133

*args, **kwargs):

730

1134

self.checker_callback_tag = None

731

1135

self.checker = None

732

# Emit D-Bus signal

733

self.PropertyChanged(dbus.String(u"checker_running"),

734

dbus.Boolean(False, variant_level=1))

735

1136

if os.WIFEXITED(condition):

736

1137

exitstatus = os.WEXITSTATUS(condition)

737

1138

# Emit D-Bus signal

747

1148

return Client.checker_callback(self, pid, condition, command,

748

1149

*args, **kwargs)

749

1150

750

def checked_ok(self, *args, **kwargs):

751

r = Client.checked_ok(self, *args, **kwargs)

752

# Emit D-Bus signal

753

self.PropertyChanged(

754

dbus.String(u"last_checked_ok"),

755

(self._datetime_to_dbus(self.last_checked_ok,

756

variant_level=1)))

757

return r

758

759

1151

def start_checker(self, *args, **kwargs):

760

1152

old_checker = self.checker

761

1153

if self.checker is not None:

768

1160

and old_checker_pid != self.checker.pid):

769

1161

# Emit D-Bus signal

770

1162

self.CheckerStarted(self.current_checker_command)

771

self.PropertyChanged(

772

dbus.String(u"checker_running"),

773

dbus.Boolean(True, variant_level=1))

774

return r

775

776

def stop_checker(self, *args, **kwargs):

777

old_checker = getattr(self, u"checker", None)

778

r = Client.stop_checker(self, *args, **kwargs)

779

if (old_checker is not None

780

and getattr(self, u"checker", None) is None):

781

self.PropertyChanged(dbus.String(u"checker_running"),

782

dbus.Boolean(False, variant_level=1))

783

return r

1163

return r

1164

1165

def _reset_approved(self):

1166

self.approved = None

1167

return False

1168

1169

def approve(self, value=True):

1170

self.send_changedstate()

1171

self.approved = value

1172

gobject.timeout_add(timedelta_to_milliseconds

1173

(self.approval_duration),

1174

self._reset_approved)

1175

784

1176

785

1177

## D-Bus methods, signals & properties

786

_interface = u"se.bsnet.fukt.Mandos.Client"

1178

_interface = "se.recompile.Mandos.Client"

787

1179

788

1180

## Signals

789

1181

790

1182

# CheckerCompleted - signal

791

@dbus.service.signal(_interface, signature=u"nxs")

1183

@dbus.service.signal(_interface, signature="nxs")

792

1184

def CheckerCompleted(self, exitcode, waitstatus, command):

793

1185

"D-Bus signal"

794

1186

pass

795

1187

796

1188

# CheckerStarted - signal

797

@dbus.service.signal(_interface, signature=u"s")

1189

@dbus.service.signal(_interface, signature="s")

798

1190

def CheckerStarted(self, command):

799

1191

"D-Bus signal"

800

1192

pass

801

1193

802

1194

# PropertyChanged - signal

803

@dbus.service.signal(_interface, signature=u"sv")

1195

@dbus.service.signal(_interface, signature="sv")

804

1196

def PropertyChanged(self, property, value):

805

1197

"D-Bus signal"

806

1198

pass

808

1200

# GotSecret - signal

809

1201

@dbus.service.signal(_interface)

810

1202

def GotSecret(self):

811

"D-Bus signal"

1203

"""D-Bus signal

1204

Is sent after a successful transfer of secret from the Mandos

1205

server to mandos-client

1206

"""

812

1207

pass

813

1208

814

1209

# Rejected - signal

815

@dbus.service.signal(_interface)

816

def Rejected(self):

817

"D-Bus signal"

1210

@dbus.service.signal(_interface, signature="s")

1211

def Rejected(self, reason):

1212

"D-Bus signal"

1213

pass

1214

1215

# NeedApproval - signal

1216

@dbus.service.signal(_interface, signature="tb")

1217

def NeedApproval(self, timeout, default):

1218

"D-Bus signal"

1219

return self.need_approval()

1220

1221

# NeRwequest - signal

1222

@dbus.service.signal(_interface, signature="s")

1223

def NewRequest(self, ip):

1224

"""D-Bus signal

1225

Is sent after a client request a password.

1226

"""

818

1227

pass

819

1228

820

1229

## Methods

821

1230

1231

# Approve - method

1232

@dbus.service.method(_interface, in_signature="b")

1233

def Approve(self, value):

1234

self.approve(value)

1235

822

1236

# CheckedOK - method

823

1237

@dbus.service.method(_interface)

824

1238

def CheckedOK(self):

825

return self.checked_ok()

1239

self.checked_ok()

826

1240

827

1241

# Enable - method

828

1242

@dbus.service.method(_interface)

849

1263

850

1264

## Properties

851

1265

852

# name - property

853

@dbus_service_property(_interface, signature=u"s", access=u"read")

854

def name_dbus_property(self):

1266

# ApprovalPending - property

1267

@dbus_service_property(_interface, signature="b", access="read")

1268

def ApprovalPending_dbus_property(self):

1269

return dbus.Boolean(bool(self.approvals_pending))

1270

1271

# ApprovedByDefault - property

1272

@dbus_service_property(_interface, signature="b",

1273

access="readwrite")

1274

def ApprovedByDefault_dbus_property(self, value=None):

1275

if value is None: # get

1276

return dbus.Boolean(self.approved_by_default)

1277

self.approved_by_default = bool(value)

1278

1279

# ApprovalDelay - property

1280

@dbus_service_property(_interface, signature="t",

1281

access="readwrite")

1282

def ApprovalDelay_dbus_property(self, value=None):

1283

if value is None: # get

1284

return dbus.UInt64(self.approval_delay_milliseconds())

1285

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1286

1287

# ApprovalDuration - property

1288

@dbus_service_property(_interface, signature="t",

1289

access="readwrite")

1290

def ApprovalDuration_dbus_property(self, value=None):

1291

if value is None: # get

1292

return dbus.UInt64(timedelta_to_milliseconds(

1293

self.approval_duration))

1294

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1295

1296

# Name - property

1297

@dbus_service_property(_interface, signature="s", access="read")

1298

def Name_dbus_property(self):

855

1299

return dbus.String(self.name)

856

1300

857

# fingerprint - property

858

@dbus_service_property(_interface, signature=u"s", access=u"read")

859

def fingerprint_dbus_property(self):

1301

# Fingerprint - property

1302

@dbus_service_property(_interface, signature="s", access="read")

1303

def Fingerprint_dbus_property(self):

860

1304

return dbus.String(self.fingerprint)

861

1305

862

# host - property

863

@dbus_service_property(_interface, signature=u"s",

864

access=u"readwrite")

865

def host_dbus_property(self, value=None):

1306

# Host - property

1307

@dbus_service_property(_interface, signature="s",

1308

access="readwrite")

1309

def Host_dbus_property(self, value=None):

866

1310

if value is None: # get

867

1311

return dbus.String(self.host)

868

self.host = value

869

# Emit D-Bus signal

870

self.PropertyChanged(dbus.String(u"host"),

871

dbus.String(value, variant_level=1))

872

873

# created - property

874

@dbus_service_property(_interface, signature=u"s", access=u"read")

875

def created_dbus_property(self):

876

return dbus.String(self._datetime_to_dbus(self.created))

877

878

# last_enabled - property

879

@dbus_service_property(_interface, signature=u"s", access=u"read")

880

def last_enabled_dbus_property(self):

881

if self.last_enabled is None:

882

return dbus.String(u"")

883

return dbus.String(self._datetime_to_dbus(self.last_enabled))

884

885

# enabled - property

886

@dbus_service_property(_interface, signature=u"b",

887

access=u"readwrite")

888

def enabled_dbus_property(self, value=None):

1312

self.host = unicode(value)

1313

1314

# Created - property

1315

@dbus_service_property(_interface, signature="s", access="read")

1316

def Created_dbus_property(self):

1317

return datetime_to_dbus(self.created)

1318

1319

# LastEnabled - property

1320

@dbus_service_property(_interface, signature="s", access="read")

1321

def LastEnabled_dbus_property(self):

1322

return datetime_to_dbus(self.last_enabled)

1323

1324

# Enabled - property

1325

@dbus_service_property(_interface, signature="b",

1326

access="readwrite")

1327

def Enabled_dbus_property(self, value=None):

889

1328

if value is None: # get

890

1329

return dbus.Boolean(self.enabled)

891

1330

if value:

893

1332

else:

894

1333

self.disable()

895

1334

896

# last_checked_ok - property

897

@dbus_service_property(_interface, signature=u"s",

898

access=u"readwrite")

899

def last_checked_ok_dbus_property(self, value=None):

1335

# LastCheckedOK - property

1336

@dbus_service_property(_interface, signature="s",

1337

access="readwrite")

1338

def LastCheckedOK_dbus_property(self, value=None):

900

1339

if value is not None:

901

1340

self.checked_ok()

902

1341

return

903

if self.last_checked_ok is None:

904

return dbus.String(u"")

905

return dbus.String(self._datetime_to_dbus(self

906

.last_checked_ok))

907

908

# timeout - property

909

@dbus_service_property(_interface, signature=u"t",

910

access=u"readwrite")

911

def timeout_dbus_property(self, value=None):

1342

return datetime_to_dbus(self.last_checked_ok)

1343

1344

# Expires - property

1345

@dbus_service_property(_interface, signature="s", access="read")

1346

def Expires_dbus_property(self):

1347

return datetime_to_dbus(self.expires)

1348

1349

# LastApprovalRequest - property

1350

@dbus_service_property(_interface, signature="s", access="read")

1351

def LastApprovalRequest_dbus_property(self):

1352

return datetime_to_dbus(self.last_approval_request)

1353

1354

# Timeout - property

1355

@dbus_service_property(_interface, signature="t",

1356

access="readwrite")

1357

def Timeout_dbus_property(self, value=None):

912

1358

if value is None: # get

913

1359

return dbus.UInt64(self.timeout_milliseconds())

914

1360

self.timeout = datetime.timedelta(0, 0, 0, value)

915

# Emit D-Bus signal

916

self.PropertyChanged(dbus.String(u"timeout"),

917

dbus.UInt64(value, variant_level=1))

918

if getattr(self, u"disable_initiator_tag", None) is None:

1361

if getattr(self, "disable_initiator_tag", None) is None:

919

1362

return

920

1363

# Reschedule timeout

921

1364

gobject.source_remove(self.disable_initiator_tag)

922

1365

self.disable_initiator_tag = None

923

time_to_die = (self.

924

_timedelta_to_milliseconds((self

925

.last_checked_ok

926

+ self.timeout)

927

- datetime.datetime

928

.utcnow()))

1366

self.expires = None

1367

time_to_die = timedelta_to_milliseconds((self

1368

.last_checked_ok

1369

+ self.timeout)

1370

- datetime.datetime

1371

.utcnow())

929

1372

if time_to_die <= 0:

930

1373

# The timeout has passed

931

1374

self.disable()

932

1375

else:

1376

self.expires = (datetime.datetime.utcnow()

1377

+ datetime.timedelta(milliseconds =

1378

time_to_die))

933

1379

self.disable_initiator_tag = (gobject.timeout_add

934

1380

(time_to_die, self.disable))

935

1381

936

# interval - property

937

@dbus_service_property(_interface, signature=u"t",

938

access=u"readwrite")

939

def interval_dbus_property(self, value=None):

1382

# ExtendedTimeout - property

1383

@dbus_service_property(_interface, signature="t",

1384

access="readwrite")

1385

def ExtendedTimeout_dbus_property(self, value=None):

1386

if value is None: # get

1387

return dbus.UInt64(self.extended_timeout_milliseconds())

1388

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1389

1390

# Interval - property

1391

@dbus_service_property(_interface, signature="t",

1392

access="readwrite")

1393

def Interval_dbus_property(self, value=None):

940

1394

if value is None: # get

941

1395

return dbus.UInt64(self.interval_milliseconds())

942

1396

self.interval = datetime.timedelta(0, 0, 0, value)

943

# Emit D-Bus signal

944

self.PropertyChanged(dbus.String(u"interval"),

945

dbus.UInt64(value, variant_level=1))

946

if getattr(self, u"checker_initiator_tag", None) is None:

1397

if getattr(self, "checker_initiator_tag", None) is None:

947

1398

return

948

# Reschedule checker run

949

gobject.source_remove(self.checker_initiator_tag)

950

self.checker_initiator_tag = (gobject.timeout_add

951

(value, self.start_checker))

952

self.start_checker() # Start one now, too

953

954

# checker - property

955

@dbus_service_property(_interface, signature=u"s",

956

access=u"readwrite")

957

def checker_dbus_property(self, value=None):

1399

if self.enabled:

1400

# Reschedule checker run

1401

gobject.source_remove(self.checker_initiator_tag)

1402

self.checker_initiator_tag = (gobject.timeout_add

1403

(value, self.start_checker))

1404

self.start_checker() # Start one now, too

1405

1406

# Checker - property

1407

@dbus_service_property(_interface, signature="s",

1408

access="readwrite")

1409

def Checker_dbus_property(self, value=None):

958

1410

if value is None: # get

959

1411

return dbus.String(self.checker_command)

960

self.checker_command = value

961

# Emit D-Bus signal

962

self.PropertyChanged(dbus.String(u"checker"),

963

dbus.String(self.checker_command,

964

variant_level=1))

1412

self.checker_command = unicode(value)

965

1413

966

# checker_running - property

967

@dbus_service_property(_interface, signature=u"b",

968

access=u"readwrite")

969

def checker_running_dbus_property(self, value=None):

1414

# CheckerRunning - property

1415

@dbus_service_property(_interface, signature="b",

1416

access="readwrite")

1417

def CheckerRunning_dbus_property(self, value=None):

970

1418

if value is None: # get

971

1419

return dbus.Boolean(self.checker is not None)

972

1420

if value:

974

1422

else:

975

1423

self.stop_checker()

976

1424

977

# object_path - property

978

@dbus_service_property(_interface, signature=u"o", access=u"read")

979

def object_path_dbus_property(self):

1425

# ObjectPath - property

1426

@dbus_service_property(_interface, signature="o", access="read")

1427

def ObjectPath_dbus_property(self):

980

1428

return self.dbus_object_path # is already a dbus.ObjectPath

981

1429

982

# secret = property

983

@dbus_service_property(_interface, signature=u"ay",

984

access=u"write", byte_arrays=True)

985

def secret_dbus_property(self, value):

1430

# Secret = property

1431

@dbus_service_property(_interface, signature="ay",

1432

access="write", byte_arrays=True)

1433

def Secret_dbus_property(self, value):

986

1434

self.secret = str(value)

987

1435

988

1436

del _interface

989

1437

990

1438

1439

class ProxyClient(object):

1440

def __init__(self, child_pipe, fpr, address):

1441

self._pipe = child_pipe

1442

self._pipe.send(('init', fpr, address))

1443

if not self._pipe.recv():

1444

raise KeyError()

1445

1446

def __getattribute__(self, name):

1447

if name == '_pipe':

1448

return super(ProxyClient, self).__getattribute__(name)

1449

self._pipe.send(('getattr', name))

1450

data = self._pipe.recv()

1451

if data[0] == 'data':

1452

return data[1]

1453

if data[0] == 'function':

1454

def func(*args, **kwargs):

1455

self._pipe.send(('funcall', name, args, kwargs))

1456

return self._pipe.recv()[1]

1457

return func

1458

1459

def __setattr__(self, name, value):

1460

if name == '_pipe':

1461

return super(ProxyClient, self).__setattr__(name, value)

1462

self._pipe.send(('setattr', name, value))

1463

1464

1465

class ClientDBusTransitional(ClientDBus):

1466

__metaclass__ = AlternateDBusNamesMetaclass

1467

1468

991

1469

class ClientHandler(socketserver.BaseRequestHandler, object):

992

1470

"""A class to handle client connections.

993

1471

995

1473

Note: This will run in its own forked process."""

996

1474

997

1475

def handle(self):

998

logger.info(u"TCP connection from: %s",

999

unicode(self.client_address))

1000

logger.debug(u"IPC Pipe FD: %d",

1001

self.server.child_pipe[1].fileno())

1002

# Open IPC pipe to parent process

1003

with contextlib.nested(self.server.child_pipe[1],

1004

self.server.parent_pipe[0]

1005

) as (ipc, ipc_return):

1476

with contextlib.closing(self.server.child_pipe) as child_pipe:

1477

logger.info("TCP connection from: %s",

1478

unicode(self.client_address))

1479

logger.debug("Pipe FD: %d",

1480

self.server.child_pipe.fileno())

1481

1006

1482

session = (gnutls.connection

1007

1483

.ClientSession(self.request,

1008

1484

gnutls.connection

1013

1489

# no X.509 keys are added to it. Therefore, we can use it

1014

1490

# here despite using OpenPGP certificates.

1015

1491

1016

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1017

# u"+AES-256-CBC", u"+SHA1",

1018

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1019

# u"+DHE-DSS"))

1492

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1493

# "+AES-256-CBC", "+SHA1",

1494

# "+COMP-NULL", "+CTYPE-OPENPGP",

1495

# "+DHE-DSS"))

1020

1496

# Use a fallback default, since this MUST be set.

1021

1497

priority = self.server.gnutls_priority

1022

1498

if priority is None:

1023

priority = u"NORMAL"

1499

priority = "NORMAL"

1024

1500

(gnutls.library.functions

1025

1501

.gnutls_priority_set_direct(session._c_object,

1026

1502

priority, None))

1028

1504

# Start communication using the Mandos protocol

1029

1505

# Get protocol number

1030

1506

line = self.request.makefile().readline()

1031

logger.debug(u"Protocol version: %r", line)

1507

logger.debug("Protocol version: %r", line)

1032

1508

try:

1033

1509

if int(line.strip().split()[0]) > 1:

1034

1510

raise RuntimeError

1035

except (ValueError, IndexError, RuntimeError), error:

1036

logger.error(u"Unknown protocol version: %s", error)

1511

except (ValueError, IndexError, RuntimeError) as error:

1512

logger.error("Unknown protocol version: %s", error)

1037

1513

return

1038

1514

1039

1515

# Start GnuTLS connection

1040

1516

try:

1041

1517

session.handshake()

1042

except gnutls.errors.GNUTLSError, error:

1043

logger.warning(u"Handshake failed: %s", error)

1518

except gnutls.errors.GNUTLSError as error:

1519

logger.warning("Handshake failed: %s", error)

1044

1520

# Do not run session.bye() here: the session is not

1045

1521

# established. Just abandon the request.

1046

1522

return

1047

logger.debug(u"Handshake succeeded")

1523

logger.debug("Handshake succeeded")

1524

1525

approval_required = False

1048

1526

try:

1049

1527

try:

1050

1528

fpr = self.fingerprint(self.peer_certificate

1051

1529

(session))

1052

except (TypeError, gnutls.errors.GNUTLSError), error:

1053

logger.warning(u"Bad certificate: %s", error)

1054

return

1055

logger.debug(u"Fingerprint: %s", fpr)

1056

1057

for c in self.server.clients:

1058

if c.fingerprint == fpr:

1059

client = c

1530

except (TypeError,

1531

gnutls.errors.GNUTLSError) as error:

1532

logger.warning("Bad certificate: %s", error)

1533

return

1534

logger.debug("Fingerprint: %s", fpr)

1535

1536

try:

1537

client = ProxyClient(child_pipe, fpr,

1538

self.client_address)

1539

except KeyError:

1540

return

1541

1542

if self.server.use_dbus:

1543

# Emit D-Bus signal

1544

client.NewRequest(str(self.client_address))

1545

1546

if client.approval_delay:

1547

delay = client.approval_delay

1548

client.approvals_pending += 1

1549

approval_required = True

1550

1551

while True:

1552

if not client.enabled:

1553

logger.info("Client %s is disabled",

1554

client.name)

1555

if self.server.use_dbus:

1556

# Emit D-Bus signal

1557

client.Rejected("Disabled")

1558

return

1559

1560

if client.approved or not client.approval_delay:

1561

#We are approved or approval is disabled

1060

1562

break

1061

else:

1062

ipc.write(u"NOTFOUND %s %s\n"

1063

% (fpr, unicode(self.client_address)))

1064

return

1065

1066

class ClientProxy(object):

1067

"""Client proxy object. Not for calling methods."""

1068

def __init__(self, client):

1069

self.client = client

1070

def __getattr__(self, name):

1071

if name.startswith("ipc_"):

1072

def tempfunc():

1073

ipc.write("%s %s\n" % (name[4:].upper(),

1074

self.client.name))

1075

return tempfunc

1076

if not hasattr(self.client, name):

1077

raise AttributeError

1078

ipc.write(u"GETATTR %s %s\n"

1079

% (name, self.client.fingerprint))

1080

return pickle.load(ipc_return)

1081

clientproxy = ClientProxy(client)

1082

# Have to check if client.enabled, since it is

1083

# possible that the client was disabled since the

1084

# GnuTLS session was established.

1085

if not clientproxy.enabled:

1086

clientproxy.ipc_disabled()

1087

return

1088

1089

clientproxy.ipc_sending()

1563

elif client.approved is None:

1564

logger.info("Client %s needs approval",

1565

client.name)

1566

if self.server.use_dbus:

1567

# Emit D-Bus signal

1568

client.NeedApproval(

1569

client.approval_delay_milliseconds(),

1570

client.approved_by_default)

1571

else:

1572

logger.warning("Client %s was not approved",

1573

client.name)

1574

if self.server.use_dbus:

1575

# Emit D-Bus signal

1576

client.Rejected("Denied")

1577

return

1578

1579

#wait until timeout or approved

1580

time = datetime.datetime.now()

1581

client.changedstate.acquire()

1582

(client.changedstate.wait

1583

(float(client.timedelta_to_milliseconds(delay)

1584

/ 1000)))

1585

client.changedstate.release()

1586

time2 = datetime.datetime.now()

1587

if (time2 - time) >= delay:

1588

if not client.approved_by_default:

1589

logger.warning("Client %s timed out while"

1590

" waiting for approval",

1591

client.name)

1592

if self.server.use_dbus:

1593

# Emit D-Bus signal

1594

client.Rejected("Approval timed out")

1595

return

1596

else:

1597

break

1598

else:

1599

delay -= time2 - time

1600

1090

1601

sent_size = 0

1091

1602

while sent_size < len(client.secret):

1092

sent = session.send(client.secret[sent_size:])

1093

logger.debug(u"Sent: %d, remaining: %d",

1603

try:

1604

sent = session.send(client.secret[sent_size:])

1605

except gnutls.errors.GNUTLSError as error:

1606

logger.warning("gnutls send failed")

1607

return

1608

logger.debug("Sent: %d, remaining: %d",

1094

1609

sent, len(client.secret)

1095

1610

- (sent_size + sent))

1096

1611

sent_size += sent

1612

1613

logger.info("Sending secret to %s", client.name)

1614

# bump the timeout using extended_timeout

1615

client.checked_ok(client.extended_timeout)

1616

if self.server.use_dbus:

1617

# Emit D-Bus signal

1618

client.GotSecret()

1619

1097

1620

finally:

1098

session.bye()

1621

if approval_required:

1622

client.approvals_pending -= 1

1623

try:

1624

session.bye()

1625

except gnutls.errors.GNUTLSError as error:

1626

logger.warning("GnuTLS bye failed")

1099

1627

1100

1628

@staticmethod

1101

1629

def peer_certificate(session):

1111

1639

.gnutls_certificate_get_peers

1112

1640

(session._c_object, ctypes.byref(list_size)))

1113

1641

if not bool(cert_list) and list_size.value != 0:

1114

raise gnutls.errors.GNUTLSError(u"error getting peer"

1115

u" certificate")

1642

raise gnutls.errors.GNUTLSError("error getting peer"

1643

" certificate")

1116

1644

if list_size.value == 0:

1117

1645

return None

1118

1646

cert = cert_list[0]

1144

1672

if crtverify.value != 0:

1145

1673

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1146

1674

raise (gnutls.errors.CertificateSecurityError

1147

(u"Verify failed"))

1675

("Verify failed"))

1148

1676

# New buffer for the fingerprint

1149

1677

buf = ctypes.create_string_buffer(20)

1150

1678

buf_len = ctypes.c_size_t()

1157

1685

# Convert the buffer to a Python bytestring

1158

1686

fpr = ctypes.string_at(buf, buf_len.value)

1159

1687

# Convert the bytestring to hexadecimal notation

1160

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1688

hex_fpr = binascii.hexlify(fpr).upper()

1161

1689

return hex_fpr

1162

1690

1163

1691

1164

class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):

1165

"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""

1692

class MultiprocessingMixIn(object):

1693

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1694

def sub_process_main(self, request, address):

1695

try:

1696

self.finish_request(request, address)

1697

except Exception:

1698

self.handle_error(request, address)

1699

self.close_request(request)

1700

1701

def process_request(self, request, address):

1702

"""Start a new process to process the request."""

1703

proc = multiprocessing.Process(target = self.sub_process_main,

1704

args = (request,

1705

address))

1706

proc.start()

1707

return proc

1708

1709

1710

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1711

""" adds a pipe to the MixIn """

1166

1712

def process_request(self, request, client_address):

1167

1713

"""Overrides and wraps the original process_request().

1168

1714

1169

1715

This function creates a new pipe in self.pipe

1170

1716

"""

1171

# Child writes to child_pipe

1172

self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1173

# Parent writes to parent_pipe

1174

self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1175

super(ForkingMixInWithPipes,

1176

self).process_request(request, client_address)

1177

# Close unused ends for parent

1178

self.parent_pipe[0].close() # close read end

1179

self.child_pipe[1].close() # close write end

1180

self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])

1181

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1717

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1718

1719

proc = MultiprocessingMixIn.process_request(self, request,

1720

client_address)

1721

self.child_pipe.close()

1722

self.add_pipe(parent_pipe, proc)

1723

1724

def add_pipe(self, parent_pipe, proc):

1182

1725

"""Dummy function; override as necessary"""

1183

child_pipe_fd.close()

1184

parent_pipe_fd.close()

1185

1186

1187

class IPv6_TCPServer(ForkingMixInWithPipes,

1726

raise NotImplementedError

1727

1728

1729

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1188

1730

socketserver.TCPServer, object):

1189

1731

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1190

1732

1206

1748

bind to an address or port if they were not specified."""

1207

1749

if self.interface is not None:

1208

1750

if SO_BINDTODEVICE is None:

1209

logger.error(u"SO_BINDTODEVICE does not exist;"

1210

u" cannot bind to interface %s",

1751

logger.error("SO_BINDTODEVICE does not exist;"

1752

" cannot bind to interface %s",

1211

1753

self.interface)

1212

1754

else:

1213

1755

try:

1214

1756

self.socket.setsockopt(socket.SOL_SOCKET,

1215

1757

SO_BINDTODEVICE,

1216

1758

str(self.interface

1217

+ u'\0'))

1218

except socket.error, error:

1759

+ '\0'))

1760

except socket.error as error:

1219

1761

if error[0] == errno.EPERM:

1220

logger.error(u"No permission to"

1221

u" bind to interface %s",

1762

logger.error("No permission to"

1763

" bind to interface %s",

1222

1764

self.interface)

1223

1765

elif error[0] == errno.ENOPROTOOPT:

1224

logger.error(u"SO_BINDTODEVICE not available;"

1225

u" cannot bind to interface %s",

1766

logger.error("SO_BINDTODEVICE not available;"

1767

" cannot bind to interface %s",

1226

1768

self.interface)

1227

1769

else:

1228

1770

raise

1230

1772

if self.server_address[0] or self.server_address[1]:

1231

1773

if not self.server_address[0]:

1232

1774

if self.address_family == socket.AF_INET6:

1233

any_address = u"::" # in6addr_any

1775

any_address = "::" # in6addr_any

1234

1776

else:

1235

1777

any_address = socket.INADDR_ANY

1236

1778

self.server_address = (any_address,

1263

1805

self.enabled = False

1264

1806

self.clients = clients

1265

1807

if self.clients is None:

1266

self.clients = set()

1808

self.clients = {}

1267

1809

self.use_dbus = use_dbus

1268

1810

self.gnutls_priority = gnutls_priority

1269

1811

IPv6_TCPServer.__init__(self, server_address,

1273

1815

def server_activate(self):

1274

1816

if self.enabled:

1275

1817

return socketserver.TCPServer.server_activate(self)

1818

1276

1819

def enable(self):

1277

1820

self.enabled = True

1278

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1821

1822

def add_pipe(self, parent_pipe, proc):

1279

1823

# Call "handle_ipc" for both data and EOF events

1280

gobject.io_add_watch(child_pipe_fd.fileno(),

1824

gobject.io_add_watch(parent_pipe.fileno(),

1281

1825

gobject.IO_IN | gobject.IO_HUP,

1282

1826

functools.partial(self.handle_ipc,

1283

reply = parent_pipe_fd,

1284

sender= child_pipe_fd))

1285

def handle_ipc(self, source, condition, reply=None, sender=None):

1827

parent_pipe =

1828

parent_pipe,

1829

proc = proc))

1830

1831

def handle_ipc(self, source, condition, parent_pipe=None,

1832

proc = None, client_object=None):

1286

1833

condition_names = {

1287

gobject.IO_IN: u"IN", # There is data to read.

1288

gobject.IO_OUT: u"OUT", # Data can be written (without

1834

gobject.IO_IN: "IN", # There is data to read.

1835

gobject.IO_OUT: "OUT", # Data can be written (without

1289

1836

# blocking).

1290

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1291

gobject.IO_ERR: u"ERR", # Error condition.

1292

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1837

gobject.IO_PRI: "PRI", # There is urgent data to read.

1838

gobject.IO_ERR: "ERR", # Error condition.

1839

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1293

1840

# broken, usually for pipes and

1294

1841

# sockets).

1295

1842

}

1297

1844

for cond, name in

1298

1845

condition_names.iteritems()

1299

1846

if cond & condition)

1300

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1301

conditions_string)

1302

1303

# Read a line from the file object

1304

cmdline = sender.readline()

1305

if not cmdline: # Empty line means end of file

1306

# close the IPC pipes

1307

sender.close()

1308

reply.close()

1309

1310

# Stop calling this function

1311

return False

1312

1313

logger.debug(u"IPC command: %r", cmdline)

1314

1315

# Parse and act on command

1316

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1317

1318

if cmd == u"NOTFOUND":

1319

fpr, address = args.split(None, 1)

1320

logger.warning(u"Client not found for fingerprint: %s, ad"

1321

u"dress: %s", fpr, address)

1322

if self.use_dbus:

1323

# Emit D-Bus signal

1324

mandos_dbus_service.ClientNotFound(fpr, address)

1325

elif cmd == u"DISABLED":

1326

for client in self.clients:

1327

if client.name == args:

1328

logger.warning(u"Client %s is disabled", args)

1329

if self.use_dbus:

1330

# Emit D-Bus signal

1331

client.Rejected()

1332

break

1333

else:

1334

logger.error(u"Unknown client %s is disabled", args)

1335

elif cmd == u"SENDING":

1336

for client in self.clients:

1337

if client.name == args:

1338

logger.info(u"Sending secret to %s", client.name)

1339

client.checked_ok()

1340

if self.use_dbus:

1341

# Emit D-Bus signal

1342

client.GotSecret()

1343

break

1344

else:

1345

logger.error(u"Sending secret to unknown client %s",

1346

args)

1347

elif cmd == u"GETATTR":

1348

attr_name, fpr = args.split(None, 1)

1349

for client in self.clients:

1350

if client.fingerprint == fpr:

1351

attr_value = getattr(client, attr_name, None)

1352

logger.debug("IPC reply: %r", attr_value)

1353

pickle.dump(attr_value, reply)

1354

break

1355

else:

1356

logger.error(u"Client %s on address %s requesting "

1357

u"attribute %s not found", fpr, address,

1358

attr_name)

1359

pickle.dump(None, reply)

1360

else:

1361

logger.error(u"Unknown IPC command: %r", cmdline)

1362

1363

# Keep calling this function

1847

# error, or the other end of multiprocessing.Pipe has closed

1848

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1849

# Wait for other process to exit

1850

proc.join()

1851

return False

1852

1853

# Read a request from the child

1854

request = parent_pipe.recv()

1855

command = request[0]

1856

1857

if command == 'init':

1858

fpr = request[1]

1859

address = request[2]

1860

1861

for c in self.clients.itervalues():

1862

if c.fingerprint == fpr:

1863

client = c

1864

break

1865

else:

1866

logger.info("Client not found for fingerprint: %s, ad"

1867

"dress: %s", fpr, address)

1868

if self.use_dbus:

1869

# Emit D-Bus signal

1870

mandos_dbus_service.ClientNotFound(fpr,

1871

address[0])

1872

parent_pipe.send(False)

1873

return False

1874

1875

gobject.io_add_watch(parent_pipe.fileno(),

1876

gobject.IO_IN | gobject.IO_HUP,

1877

functools.partial(self.handle_ipc,

1878

parent_pipe =

1879

parent_pipe,

1880

proc = proc,

1881

client_object =

1882

client))

1883

parent_pipe.send(True)

1884

# remove the old hook in favor of the new above hook on

1885

# same fileno

1886

return False

1887

if command == 'funcall':

1888

funcname = request[1]

1889

args = request[2]

1890

kwargs = request[3]

1891

1892

parent_pipe.send(('data', getattr(client_object,

1893

funcname)(*args,

1894

**kwargs)))

1895

1896

if command == 'getattr':

1897

attrname = request[1]

1898

if callable(client_object.__getattribute__(attrname)):

1899

parent_pipe.send(('function',))

1900

else:

1901

parent_pipe.send(('data', client_object

1902

.__getattribute__(attrname)))

1903

1904

if command == 'setattr':

1905

attrname = request[1]

1906

value = request[2]

1907

setattr(client_object, attrname, value)

1908

1364

1909

return True

1365

1910

1366

1911

1367

1912

def string_to_delta(interval):

1368

1913

"""Parse a string and return a datetime.timedelta

1369

1914

1370

>>> string_to_delta(u'7d')

1915

>>> string_to_delta('7d')

1371

1916

datetime.timedelta(7)

1372

>>> string_to_delta(u'60s')

1917

>>> string_to_delta('60s')

1373

1918

datetime.timedelta(0, 60)

1374

>>> string_to_delta(u'60m')

1919

>>> string_to_delta('60m')

1375

1920

datetime.timedelta(0, 3600)

1376

>>> string_to_delta(u'24h')

1921

>>> string_to_delta('24h')

1377

1922

datetime.timedelta(1)

1378

>>> string_to_delta(u'1w')

1923

>>> string_to_delta('1w')

1379

1924

datetime.timedelta(7)

1380

>>> string_to_delta(u'5m 30s')

1925

>>> string_to_delta('5m 30s')

1381

1926

datetime.timedelta(0, 330)

1382

1927

"""

1383

1928

timevalue = datetime.timedelta(0)

1385

1930

try:

1386

1931

suffix = unicode(s[-1])

1387

1932

value = int(s[:-1])

1388

if suffix == u"d":

1933

if suffix == "d":

1389

1934

delta = datetime.timedelta(value)

1390

elif suffix == u"s":

1935

elif suffix == "s":

1391

1936

delta = datetime.timedelta(0, value)

1392

elif suffix == u"m":

1937

elif suffix == "m":

1393

1938

delta = datetime.timedelta(0, 0, 0, 0, value)

1394

elif suffix == u"h":

1939

elif suffix == "h":

1395

1940

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1396

elif suffix == u"w":

1941

elif suffix == "w":

1397

1942

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1398

1943

else:

1399

raise ValueError(u"Unknown suffix %r" % suffix)

1400

except (ValueError, IndexError), e:

1401

raise ValueError(e.message)

1944

raise ValueError("Unknown suffix %r" % suffix)

1945

except (ValueError, IndexError) as e:

1946

raise ValueError(*(e.args))

1402

1947

timevalue += delta

1403

1948

return timevalue

1404

1949

1405

1950

1406

def if_nametoindex(interface):

1407

"""Call the C function if_nametoindex(), or equivalent

1408

1409

Note: This function cannot accept a unicode string."""

1410

global if_nametoindex

1411

try:

1412

if_nametoindex = (ctypes.cdll.LoadLibrary

1413

(ctypes.util.find_library(u"c"))

1414

.if_nametoindex)

1415

except (OSError, AttributeError):

1416

logger.warning(u"Doing if_nametoindex the hard way")

1417

def if_nametoindex(interface):

1418

"Get an interface index the hard way, i.e. using fcntl()"

1419

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1420

with contextlib.closing(socket.socket()) as s:

1421

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1422

struct.pack(str(u"16s16x"),

1423

interface))

1424

interface_index = struct.unpack(str(u"I"),

1425

ifreq[16:20])[0]

1426

return interface_index

1427

return if_nametoindex(interface)

1428

1429

1430

1951

def daemon(nochdir = False, noclose = False):

1431

1952

"""See daemon(3). Standard BSD Unix function.

1432

1953

1435

1956

sys.exit()

1436

1957

os.setsid()

1437

1958

if not nochdir:

1438

os.chdir(u"/")

1959

os.chdir("/")

1439

1960

if os.fork():

1440

1961

sys.exit()

1441

1962

if not noclose:

1443

1964

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1444

1965

if not stat.S_ISCHR(os.fstat(null).st_mode):

1445

1966

raise OSError(errno.ENODEV,

1446

u"%s not a character device"

1967

"%s not a character device"

1447

1968

% os.path.devnull)

1448

1969

os.dup2(null, sys.stdin.fileno())

1449

1970

os.dup2(null, sys.stdout.fileno())

1457

1978

##################################################################

1458

1979

# Parsing of options, both command line and config file

1459

1980

1460

parser = optparse.OptionParser(version = "%%prog %s" % version)

1461

parser.add_option("-i", u"--interface", type=u"string",

1462

metavar="IF", help=u"Bind to interface IF")

1463

parser.add_option("-a", u"--address", type=u"string",

1464

help=u"Address to listen for requests on")

1465

parser.add_option("-p", u"--port", type=u"int",

1466

help=u"Port number to receive requests on")

1467

parser.add_option("--check", action=u"store_true",

1468

help=u"Run self-test")

1469

parser.add_option("--debug", action=u"store_true",

1470

help=u"Debug mode; run in foreground and log to"

1471

u" terminal")

1472

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1473

u" priority string (see GnuTLS documentation)")

1474

parser.add_option("--servicename", type=u"string",

1475

metavar=u"NAME", help=u"Zeroconf service name")

1476

parser.add_option("--configdir", type=u"string",

1477

default=u"/etc/mandos", metavar=u"DIR",

1478

help=u"Directory to search for configuration"

1479

u" files")

1480

parser.add_option("--no-dbus", action=u"store_false",

1481

dest=u"use_dbus", help=u"Do not provide D-Bus"

1482

u" system bus interface")

1483

parser.add_option("--no-ipv6", action=u"store_false",

1484

dest=u"use_ipv6", help=u"Do not use IPv6")

1485

options = parser.parse_args()[0]

1981

parser = argparse.ArgumentParser()

1982

parser.add_argument("-v", "--version", action="version",

1983

version = "%%(prog)s %s" % version,

1984

help="show version number and exit")

1985

parser.add_argument("-i", "--interface", metavar="IF",

1986

help="Bind to interface IF")

1987

parser.add_argument("-a", "--address",

1988

help="Address to listen for requests on")

1989

parser.add_argument("-p", "--port", type=int,

1990

help="Port number to receive requests on")

1991

parser.add_argument("--check", action="store_true",

1992

help="Run self-test")

1993

parser.add_argument("--debug", action="store_true",

1994

help="Debug mode; run in foreground and log"

1995

" to terminal")

1996

parser.add_argument("--debuglevel", metavar="LEVEL",

1997

help="Debug level for stdout output")

1998

parser.add_argument("--priority", help="GnuTLS"

1999

" priority string (see GnuTLS documentation)")

2000

parser.add_argument("--servicename",

2001

metavar="NAME", help="Zeroconf service name")

2002

parser.add_argument("--configdir",

2003

default="/etc/mandos", metavar="DIR",

2004

help="Directory to search for configuration"

2005

" files")

2006

parser.add_argument("--no-dbus", action="store_false",

2007

dest="use_dbus", help="Do not provide D-Bus"

2008

" system bus interface")

2009

parser.add_argument("--no-ipv6", action="store_false",

2010

dest="use_ipv6", help="Do not use IPv6")

2011

parser.add_argument("--no-restore", action="store_false",

2012

dest="restore", help="Do not restore stored"

2013

" state")

2014

parser.add_argument("--statedir", metavar="DIR",

2015

help="Directory to save/restore state in")

2016

2017

options = parser.parse_args()

1486

2018

1487

2019

if options.check:

1488

2020

import doctest

1490

2022

sys.exit()

1491

2023

1492

2024

# Default values for config file for server-global settings

1493

server_defaults = { u"interface": u"",

1494

u"address": u"",

1495

u"port": u"",

1496

u"debug": u"False",

1497

u"priority":

1498

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1499

u"servicename": u"Mandos",

1500

u"use_dbus": u"True",

1501

u"use_ipv6": u"True",

2025

server_defaults = { "interface": "",

2026

"address": "",

2027

"port": "",

2028

"debug": "False",

2029

"priority":

2030

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2031

"servicename": "Mandos",

2032

"use_dbus": "True",

2033

"use_ipv6": "True",

2034

"debuglevel": "",

2035

"restore": "True",

2036

"statedir": "/var/lib/mandos"

1502

2037

}

1503

2038

1504

2039

# Parse config file for server-global settings

1505

2040

server_config = configparser.SafeConfigParser(server_defaults)

1506

2041

del server_defaults

1507

2042

server_config.read(os.path.join(options.configdir,

1508

u"mandos.conf"))

2043

"mandos.conf"))

1509

2044

# Convert the SafeConfigParser object to a dict

1510

2045

server_settings = server_config.defaults()

1511

2046

# Use the appropriate methods on the non-string config options

1512

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1513

server_settings[option] = server_config.getboolean(u"DEFAULT",

2047

for option in ("debug", "use_dbus", "use_ipv6"):

2048

server_settings[option] = server_config.getboolean("DEFAULT",

1514

2049

option)

1515

2050

if server_settings["port"]:

1516

server_settings["port"] = server_config.getint(u"DEFAULT",

1517

u"port")

2051

server_settings["port"] = server_config.getint("DEFAULT",

2052

"port")

1518

2053

del server_config

1519

2054

1520

2055

# Override the settings from the config file with command line

1521

2056

# options, if set.

1522

for option in (u"interface", u"address", u"port", u"debug",

1523

u"priority", u"servicename", u"configdir",

1524

u"use_dbus", u"use_ipv6"):

2057

for option in ("interface", "address", "port", "debug",

2058

"priority", "servicename", "configdir",

2059

"use_dbus", "use_ipv6", "debuglevel", "restore",

2060

"statedir"):

1525

2061

value = getattr(options, option)

1526

2062

if value is not None:

1527

2063

server_settings[option] = value

1535

2071

##################################################################

1536

2072

1537

2073

# For convenience

1538

debug = server_settings[u"debug"]

1539

use_dbus = server_settings[u"use_dbus"]

1540

use_ipv6 = server_settings[u"use_ipv6"]

1541

1542

if not debug:

1543

syslogger.setLevel(logging.WARNING)

1544

console.setLevel(logging.WARNING)

1545

1546

if server_settings[u"servicename"] != u"Mandos":

2074

debug = server_settings["debug"]

2075

debuglevel = server_settings["debuglevel"]

2076

use_dbus = server_settings["use_dbus"]

2077

use_ipv6 = server_settings["use_ipv6"]

2078

stored_state_path = os.path.join(server_settings["statedir"],

2079

stored_state_file)

2080

2081

if debug:

2082

initlogger(debug, logging.DEBUG)

2083

else:

2084

if not debuglevel:

2085

initlogger(debug)

2086

else:

2087

level = getattr(logging, debuglevel.upper())

2088

initlogger(debug, level)

2089

2090

if server_settings["servicename"] != "Mandos":

1547

2091

syslogger.setFormatter(logging.Formatter

1548

(u'Mandos (%s) [%%(process)d]:'

1549

u' %%(levelname)s: %%(message)s'

1550

% server_settings[u"servicename"]))

2092

('Mandos (%s) [%%(process)d]:'

2093

' %%(levelname)s: %%(message)s'

2094

% server_settings["servicename"]))

1551

2095

1552

2096

# Parse config file with clients

1553

client_defaults = { u"timeout": u"1h",

1554

u"interval": u"5m",

1555

u"checker": u"fping -q -- %%(host)s",

1556

u"host": u"",

1557

}

1558

client_config = configparser.SafeConfigParser(client_defaults)

1559

client_config.read(os.path.join(server_settings[u"configdir"],

1560

u"clients.conf"))

2097

client_config = configparser.SafeConfigParser(Client.client_defaults)

2098

client_config.read(os.path.join(server_settings["configdir"],

2099

"clients.conf"))

1561

2100

1562

2101

global mandos_dbus_service

1563

2102

mandos_dbus_service = None

1564

2103

1565

tcp_server = MandosServer((server_settings[u"address"],

1566

server_settings[u"port"]),

2104

tcp_server = MandosServer((server_settings["address"],

2105

server_settings["port"]),

1567

2106

ClientHandler,

1568

interface=(server_settings[u"interface"]

2107

interface=(server_settings["interface"]

1569

2108

or None),

1570

2109

use_ipv6=use_ipv6,

1571

2110

gnutls_priority=

1572

server_settings[u"priority"],

2111

server_settings["priority"],

1573

2112

use_dbus=use_dbus)

1574

pidfilename = u"/var/run/mandos.pid"

1575

try:

1576

pidfile = open(pidfilename, u"w")

1577

except IOError:

1578

logger.error(u"Could not open file %r", pidfilename)

2113

if not debug:

2114

pidfilename = "/var/run/mandos.pid"

2115

try:

2116

pidfile = open(pidfilename, "w")

2117

except IOError:

2118

logger.error("Could not open file %r", pidfilename)

1579

2119

1580

2120

try:

1581

uid = pwd.getpwnam(u"_mandos").pw_uid

1582

gid = pwd.getpwnam(u"_mandos").pw_gid

2121

uid = pwd.getpwnam("_mandos").pw_uid

2122

gid = pwd.getpwnam("_mandos").pw_gid

1583

2123

except KeyError:

1584

2124

try:

1585

uid = pwd.getpwnam(u"mandos").pw_uid

1586

gid = pwd.getpwnam(u"mandos").pw_gid

2125

uid = pwd.getpwnam("mandos").pw_uid

2126

gid = pwd.getpwnam("mandos").pw_gid

1587

2127

except KeyError:

1588

2128

try:

1589

uid = pwd.getpwnam(u"nobody").pw_uid

1590

gid = pwd.getpwnam(u"nobody").pw_gid

2129

uid = pwd.getpwnam("nobody").pw_uid

2130

gid = pwd.getpwnam("nobody").pw_gid

1591

2131

except KeyError:

1592

2132

uid = 65534

1593

2133

gid = 65534

1594

2134

try:

1595

2135

os.setgid(gid)

1596

2136

os.setuid(uid)

1597

except OSError, error:

2137

except OSError as error:

1598

2138

if error[0] != errno.EPERM:

1599

2139

raise error

1600

2140

1601

# Enable all possible GnuTLS debugging

1602

2141

if debug:

2142

# Enable all possible GnuTLS debugging

2143

1603

2144

# "Use a log level over 10 to enable all debugging options."

1604

2145

# - GnuTLS manual

1605

2146

gnutls.library.functions.gnutls_global_set_log_level(11)

1606

2147

1607

2148

@gnutls.library.types.gnutls_log_func

1608

2149

def debug_gnutls(level, string):

1609

logger.debug(u"GnuTLS: %s", string[:-1])

2150

logger.debug("GnuTLS: %s", string[:-1])

1610

2151

1611

2152

(gnutls.library.functions

1612

2153

.gnutls_global_set_log_function(debug_gnutls))

2154

2155

# Redirect stdin so all checkers get /dev/null

2156

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2157

os.dup2(null, sys.stdin.fileno())

2158

if null > 2:

2159

os.close(null)

2160

2161

# Need to fork before connecting to D-Bus

2162

if not debug:

2163

# Close all input and output, do double fork, etc.

2164

daemon()

2165

2166

gobject.threads_init()

1613

2167

1614

2168

global main_loop

1615

2169

# From the Avahi example code

1619

2173

# End of Avahi example code

1620

2174

if use_dbus:

1621

2175

try:

1622

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2176

bus_name = dbus.service.BusName("se.recompile.Mandos",

1623

2177

bus, do_not_queue=True)

1624

except dbus.exceptions.NameExistsException, e:

1625

logger.error(unicode(e) + u", disabling D-Bus")

2178

old_bus_name = (dbus.service.BusName

2179

("se.bsnet.fukt.Mandos", bus,

2180

do_not_queue=True))

2181

except dbus.exceptions.NameExistsException as e:

2182

logger.error(unicode(e) + ", disabling D-Bus")

1626

2183

use_dbus = False

1627

server_settings[u"use_dbus"] = False

2184

server_settings["use_dbus"] = False

1628

2185

tcp_server.use_dbus = False

1629

2186

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1630

service = AvahiService(name = server_settings[u"servicename"],

1631

servicetype = u"_mandos._tcp",

1632

protocol = protocol, bus = bus)

2187

service = AvahiServiceToSyslog(name =

2188

server_settings["servicename"],

2189

servicetype = "_mandos._tcp",

2190

protocol = protocol, bus = bus)

1633

2191

if server_settings["interface"]:

1634

2192

service.interface = (if_nametoindex

1635

(str(server_settings[u"interface"])))

2193

(str(server_settings["interface"])))

2194

2195

global multiprocessing_manager

2196

multiprocessing_manager = multiprocessing.Manager()

1636

2197

1637

2198

client_class = Client

1638

2199

if use_dbus:

1639

client_class = functools.partial(ClientDBus, bus = bus)

1640

tcp_server.clients.update(set(

1641

client_class(name = section,

1642

config= dict(client_config.items(section)))

1643

for section in client_config.sections()))

2200

client_class = functools.partial(ClientDBusTransitional,

2201

bus = bus)

2202

2203

client_settings = Client.config_parser(client_config)

2204

old_client_settings = {}

2205

clients_data = {}

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

except EOFError as e:

2220

logger.warning("Could not load persistent state: "

2221

"EOFError: {0}".format(e))

2222

2223

with PGPEngine() as pgp:

2224

for client_name, client in clients_data.iteritems():

2225

# Decide which value to use after restoring saved state.

2226

# We have three different values: Old config file,

2227

# new config file, and saved state.

2228

# New config value takes precedence if it differs from old

2229

# config value, otherwise use saved state.

2230

for name, value in client_settings[client_name].items():

2231

try:

2232

# For each value in new config, check if it

2233

# differs from the old config value (Except for

2234

# the "secret" attribute)

2235

if (name != "secret" and

2236

value != old_client_settings[client_name]

2237

[name]):

2238

client[name] = value

2239

except KeyError:

2240

pass

2241

2242

# Clients who has passed its expire date can still be

2243

# enabled if its last checker was successful. Clients

2244

# whose checker failed before we stored its state is

2245

# assumed to have failed all checkers during downtime.

2246

if client["enabled"]:

2247

if datetime.datetime.utcnow() >= client["expires"]:

2248

if not client["last_checked_ok"]:

2249

logger.warning(

2250

"disabling client {0} - Client never "

2251

"performed a successfull checker"

2252

.format(client["name"]))

2253

client["enabled"] = False

2254

elif client["last_checker_status"] != 0:

2255

logger.warning(

2256

"disabling client {0} - Client "

2257

"last checker failed with error code {1}"

2258

.format(client["name"],

2259

client["last_checker_status"]))

2260

client["enabled"] = False

2261

else:

2262

client["expires"] = (datetime.datetime

2263

.utcnow()

2264

+ client["timeout"])

2265

2266

try:

2267

client["secret"] = (

2268

pgp.decrypt(client["encrypted_secret"],

2269

client_settings[client_name]

2270

["secret"]))

2271

except PGPError:

2272

# If decryption fails, we use secret from new settings

2273

logger.debug("Failed to decrypt {0} old secret"

2274

.format(client_name))

2275

client["secret"] = (

2276

client_settings[client_name]["secret"])

2277

2278

2279

# Add/remove clients based on new changes made to config

2280

for client_name in set(old_client_settings) - set(client_settings):

2281

del clients_data[client_name]

2282

for client_name in set(client_settings) - set(old_client_settings):

2283

clients_data[client_name] = client_settings[client_name]

2284

2285

# Create clients all clients

2286

for client_name, client in clients_data.iteritems():

2287

tcp_server.clients[client_name] = client_class(

2288

name = client_name, settings = client)

2289

1644

2290

if not tcp_server.clients:

1645

logger.warning(u"No clients defined")

1646

1647

if debug:

1648

# Redirect stdin so all checkers get /dev/null

1649

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1650

os.dup2(null, sys.stdin.fileno())

1651

if null > 2:

1652

os.close(null)

1653

else:

1654

# No console logging

1655

logger.removeHandler(console)

1656

# Close all input and output, do double fork, etc.

1657

daemon()

1658

1659

try:

1660

with pidfile:

1661

pid = os.getpid()

1662

pidfile.write(str(pid) + "\n")

1663

del pidfile

1664

except IOError:

1665

logger.error(u"Could not write to file %r with PID %d",

1666

pidfilename, pid)

1667

except NameError:

1668

# "pidfile" was never created

1669

pass

1670

del pidfilename

1671

2291

logger.warning("No clients defined")

2292

1672

2293

if not debug:

2294

try:

2295

with pidfile:

2296

pid = os.getpid()

2297

pidfile.write(str(pid) + "\n".encode("utf-8"))

2298

del pidfile

2299

except IOError:

2300

logger.error("Could not write to file %r with PID %d",

2301

pidfilename, pid)

2302

except NameError:

2303

# "pidfile" was never created

2304

pass

2305

del pidfilename

1673

2306

signal.signal(signal.SIGINT, signal.SIG_IGN)

2307

1674

2308

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1675

2309

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1676

2310

1678

2312

class MandosDBusService(dbus.service.Object):

1679

2313

"""A D-Bus proxy object"""

1680

2314

def __init__(self):

1681

dbus.service.Object.__init__(self, bus, u"/")

1682

_interface = u"se.bsnet.fukt.Mandos"

2315

dbus.service.Object.__init__(self, bus, "/")

2316

_interface = "se.recompile.Mandos"

1683

2317

1684

@dbus.service.signal(_interface, signature=u"o")

2318

@dbus.service.signal(_interface, signature="o")

1685

2319

def ClientAdded(self, objpath):

1686

2320

"D-Bus signal"

1687

2321

pass

1688

2322

1689

@dbus.service.signal(_interface, signature=u"ss")

2323

@dbus.service.signal(_interface, signature="ss")

1690

2324

def ClientNotFound(self, fingerprint, address):

1691

2325

"D-Bus signal"

1692

2326

pass

1693

2327

1694

@dbus.service.signal(_interface, signature=u"os")

2328

@dbus.service.signal(_interface, signature="os")

1695

2329

def ClientRemoved(self, objpath, name):

1696

2330

"D-Bus signal"

1697

2331

pass

1698

2332

1699

@dbus.service.method(_interface, out_signature=u"ao")

2333

@dbus.service.method(_interface, out_signature="ao")

1700

2334

def GetAllClients(self):

1701

2335

"D-Bus method"

1702

2336

return dbus.Array(c.dbus_object_path

1703

for c in tcp_server.clients)

2337

for c in

2338

tcp_server.clients.itervalues())

1704

2339

1705

2340

@dbus.service.method(_interface,

1706

out_signature=u"a{oa{sv}}")

2341

out_signature="a{oa{sv}}")

1707

2342

def GetAllClientsWithProperties(self):

1708

2343

"D-Bus method"

1709

2344

return dbus.Dictionary(

1710

((c.dbus_object_path, c.GetAll(u""))

1711

for c in tcp_server.clients),

1712

signature=u"oa{sv}")

2345

((c.dbus_object_path, c.GetAll(""))

2346

for c in tcp_server.clients.itervalues()),

2347

signature="oa{sv}")

1713

2348

1714

@dbus.service.method(_interface, in_signature=u"o")

2349

@dbus.service.method(_interface, in_signature="o")

1715

2350

def RemoveClient(self, object_path):

1716

2351

"D-Bus method"

1717

for c in tcp_server.clients:

2352

for c in tcp_server.clients.itervalues():

1718

2353

if c.dbus_object_path == object_path:

1719

tcp_server.clients.remove(c)

2354

del tcp_server.clients[c.name]

1720

2355

c.remove_from_connection()

1721

2356

# Don't signal anything except ClientRemoved

1722

2357

c.disable(quiet=True)

1727

2362

1728

2363

del _interface

1729

2364

1730

mandos_dbus_service = MandosDBusService()

2365

class MandosDBusServiceTransitional(MandosDBusService):

2366

__metaclass__ = AlternateDBusNamesMetaclass

2367

mandos_dbus_service = MandosDBusServiceTransitional()

1731

2368

1732

2369

def cleanup():

1733

2370

"Cleanup function; run on exit"

1734

2371

service.cleanup()

1735

2372

2373

multiprocessing.active_children()

2374

if not (tcp_server.clients or client_settings):

2375

return

2376

2377

# Store client before exiting. Secrets are encrypted with key

2378

# based on what config file has. If config file is

2379

# removed/edited, old secret will thus be unrecovable.

2380

clients = {}

2381

with PGPEngine() as pgp:

2382

for client in tcp_server.clients.itervalues():

2383

key = client_settings[client.name]["secret"]

2384

client.encrypted_secret = pgp.encrypt(client.secret,

2385

key)

2386

client_dict = {}

2387

2388

# A list of attributes that can not be pickled

2389

# + secret.

2390

exclude = set(("bus", "changedstate", "secret",

2391

"checker"))

2392

for name, typ in (inspect.getmembers

2393

(dbus.service.Object)):

2394

exclude.add(name)

2395

2396

client_dict["encrypted_secret"] = (client

2397

.encrypted_secret)

2398

for attr in client.client_structure:

2399

if attr not in exclude:

2400

client_dict[attr] = getattr(client, attr)

2401

2402

clients[client.name] = client_dict

2403

del client_settings[client.name]["secret"]

2404

2405

try:

2406

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2407

prefix="clients-",

2408

dir=os.path.dirname

2409

(stored_state_path))

2410

with os.fdopen(tempfd, "wb") as stored_state:

2411

pickle.dump((clients, client_settings), stored_state)

2412

os.rename(tempname, stored_state_path)

2413

except (IOError, OSError) as e:

2414

logger.warning("Could not save persistent state: {0}"

2415

.format(e))

2416

if not debug:

2417

try:

2418

os.remove(tempname)

2419

except NameError:

2420

pass

2421

if e.errno not in set((errno.ENOENT, errno.EACCES,

2422

errno.EEXIST)):

2423

raise e

2424

2425

# Delete all clients, and settings from config

1736

2426

while tcp_server.clients:

1737

client = tcp_server.clients.pop()

2427

name, client = tcp_server.clients.popitem()

1738

2428

if use_dbus:

1739

2429

client.remove_from_connection()

1740

client.disable_hook = None

1741

2430

# Don't signal anything except ClientRemoved

1742

2431

client.disable(quiet=True)

1743

2432

if use_dbus:

1744

2433

# Emit D-Bus signal

1745

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2434

mandos_dbus_service.ClientRemoved(client

2435

.dbus_object_path,

1746

2436

client.name)

2437

client_settings.clear()

1747

2438

1748

2439

atexit.register(cleanup)

1749

2440

1750

for client in tcp_server.clients:

2441

for client in tcp_server.clients.itervalues():

1751

2442

if use_dbus:

1752

2443

# Emit D-Bus signal

1753

2444

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1754

client.enable()

2445

# Need to initiate checking of clients

2446

if client.enabled:

2447

client.init_checker()

1755

2448

1756

2449

tcp_server.enable()

1757

2450

tcp_server.server_activate()

1759

2452

# Find out what port we got

1760

2453

service.port = tcp_server.socket.getsockname()[1]

1761

2454

if use_ipv6:

1762

logger.info(u"Now listening on address %r, port %d,"

2455

logger.info("Now listening on address %r, port %d,"

1763

2456

" flowinfo %d, scope_id %d"

1764

2457

% tcp_server.socket.getsockname())

1765

2458

else: # IPv4

1766

logger.info(u"Now listening on address %r, port %d"

2459

logger.info("Now listening on address %r, port %d"

1767

2460

% tcp_server.socket.getsockname())

1768

2461

1769

2462

#service.interface = tcp_server.socket.getsockname()[3]

1772

2465

# From the Avahi example code

1773

2466

try:

1774

2467

service.activate()

1775

except dbus.exceptions.DBusException, error:

1776

logger.critical(u"DBusException: %s", error)

2468

except dbus.exceptions.DBusException as error:

2469

logger.critical("DBusException: %s", error)

1777

2470

cleanup()

1778

2471

sys.exit(1)

1779

2472

# End of Avahi example code

1783

2476

(tcp_server.handle_request

1784

2477

(*args[2:], **kwargs) or True))

1785

2478

1786

logger.debug(u"Starting main loop")

2479

logger.debug("Starting main loop")

1787

2480

main_loop.run()

1788

except AvahiError, error:

1789

logger.critical(u"AvahiError: %s", error)

2481

except AvahiError as error:

2482

logger.critical("AvahiError: %s", error)

1790

2483

cleanup()

1791

2484

sys.exit(1)

1792

2485

except KeyboardInterrupt:

1793

2486

if debug:

1794

print >> sys.stderr

1795

logger.debug(u"Server received KeyboardInterrupt")

1796

logger.debug(u"Server exiting")

2487

print("", file=sys.stderr)

2488

logger.debug("Server received KeyboardInterrupt")

2489

logger.debug("Server exiting")

1797

2490

# Must run before the D-Bus bus name gets deregistered

1798

2491

cleanup()

1799

2492