/mandos/trunk : revision 539

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

68

70

69

import dbus

71

70

import dbus.service

86

85

except ImportError:

87

86

SO_BINDTODEVICE = None

88

87

89

version = "1.5.3"

88

version = "1.4.1"

90

89

stored_state_file = "clients.pickle"

91

90

92

91

logger = logging.getLogger()

143

142

self.gnupg.options.meta_interactive = False

144

143

self.gnupg.options.homedir = self.tempdir

145

144

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

145

'--quiet'])

148

146

149

147

def __enter__(self):

150

148

return self

176

174

177

175

def encrypt(self, data, password):

178

176

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

177

with open(os.devnull) as devnull:

180

178

try:

181

179

proc = self.gnupg.run(['--symmetric'],

182

180

create_fhs=['stdin', 'stdout'],

193

191

194

192

def decrypt(self, data, password):

195

193

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

194

with open(os.devnull) as devnull:

197

195

try:

198

196

proc = self.gnupg.run(['--decrypt'],

199

197

create_fhs=['stdin', 'stdout'],

200

198

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

199

with contextlib.closing(proc.handles['stdin'] ) as f:

202

200

f.write(data)

203

201

with contextlib.closing(proc.handles['stdout']) as f:

204

202

decrypted_plaintext = f.read()

209

207

return decrypted_plaintext

210

208

211

209

210

212

211

class AvahiError(Exception):

213

212

def __init__(self, value, *args, **kwargs):

214

213

self.value = value

243

242

server: D-Bus Server

244

243

bus: dbus.SystemBus()

245

244

"""

246

247

245

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

246

servicetype = None, port = None, TXT = None,

249

247

domain = "", host = "", max_renames = 32768,

262

260

self.server = None

263

261

self.bus = bus

264

262

self.entry_group_state_changed_match = None

265

266

263

def rename(self):

267

264

"""Derived from the Avahi example code"""

268

265

if self.rename_count >= self.max_renames:

278

275

try:

279

276

self.add()

280

277

except dbus.exceptions.DBusException as error:

281

logger.critical("D-Bus Exception", exc_info=error)

278

logger.critical("DBusException: %s", error)

282

279

self.cleanup()

283

280

os._exit(1)

284

281

self.rename_count += 1

285

286

282

def remove(self):

287

283

"""Derived from the Avahi example code"""

288

284

if self.entry_group_state_changed_match is not None:

290

286

self.entry_group_state_changed_match = None

291

287

if self.group is not None:

292

288

self.group.Reset()

293

294

289

def add(self):

295

290

"""Derived from the Avahi example code"""

296

291

self.remove()

313

308

dbus.UInt16(self.port),

314

309

avahi.string_array_to_txt_array(self.TXT))

315

310

self.group.Commit()

316

317

311

def entry_group_state_changed(self, state, error):

318

312

"""Derived from the Avahi example code"""

319

313

logger.debug("Avahi entry group state change: %i", state)

326

320

elif state == avahi.ENTRY_GROUP_FAILURE:

327

321

logger.critical("Avahi: Error in group state changed %s",

328

322

unicode(error))

329

raise AvahiGroupError("State changed: {0!s}"

330

.format(error))

331

323

raise AvahiGroupError("State changed: %s"

324

% unicode(error))

332

325

def cleanup(self):

333

326

"""Derived from the Avahi example code"""

334

327

if self.group is not None:

339

332

pass

340

333

self.group = None

341

334

self.remove()

342

343

335

def server_state_changed(self, state, error=None):

344

336

"""Derived from the Avahi example code"""

345

337

logger.debug("Avahi server state change: %i", state)

364

356

logger.debug("Unknown state: %r", state)

365

357

else:

366

358

logger.debug("Unknown state: %r: %r", state, error)

367

368

359

def activate(self):

369

360

"""Derived from the Avahi example code"""

370

361

if self.server is None:

382

373

"""Add the new name to the syslog messages"""

383

374

ret = AvahiService.rename(self)

384

375

syslogger.setFormatter(logging.Formatter

385

('Mandos ({0}) [%(process)d]:'

386

' %(levelname)s: %(message)s'

387

.format(self.name)))

376

('Mandos (%s) [%%(process)d]:'

377

' %%(levelname)s: %%(message)s'

378

% self.name))

388

379

return ret

389

380

390

381

def timedelta_to_milliseconds(td):

392

383

return ((td.days * 24 * 60 * 60 * 1000)

393

384

+ (td.seconds * 1000)

394

385

+ (td.microseconds // 1000))

395

386

396

387

class Client(object):

397

388

"""A representation of a client host served by this server.

398

389

423

414

last_checked_ok: datetime.datetime(); (UTC) or None

424

415

last_checker_status: integer between 0 and 255 reflecting exit

425

416

status of last checker. -1 reflects crashed

426

checker, -2 means no checker completed yet.

417

checker, or None.

427

418

last_enabled: datetime.datetime(); (UTC) or None

428

419

name: string; from the config file, used in log messages and

429

420

D-Bus identifiers

430

421

secret: bytestring; sent verbatim (over TLS) to client

431

422

timeout: datetime.timedelta(); How long from last_checked_ok

432

423

until this client is disabled

433

extended_timeout: extra long timeout when secret has been sent

424

extended_timeout: extra long timeout when password has been sent

434

425

runtime_expansions: Allowed attributes for runtime expansion.

435

426

expires: datetime.datetime(); time (UTC) when a client will be

436

427

disabled, or None

465

456

466

457

def approval_delay_milliseconds(self):

467

458

return timedelta_to_milliseconds(self.approval_delay)

468

459

469

460

@staticmethod

470

461

def config_parser(config):

471

"""Construct a new dict of client settings of this form:

462

""" Construct a new dict of client settings of this form:

472

463

{ client_name: {setting_name: value, ...}, ...}

473

with exceptions for any special settings as defined above.

474

NOTE: Must be a pure function. Must return the same result

475

value given the same arguments.

476

"""

464

with exceptions for any special settings as defined above"""

477

465

settings = {}

478

466

for client_name in config.sections():

479

467

section = dict(config.items(client_name))

483

471

# Reformat values from string types to Python types

484

472

client["approved_by_default"] = config.getboolean(

485

473

client_name, "approved_by_default")

486

client["enabled"] = config.getboolean(client_name,

487

"enabled")

474

client["enabled"] = config.getboolean(client_name, "enabled")

488

475

489

476

client["fingerprint"] = (section["fingerprint"].upper()

490

477

.replace(" ", ""))

496

483

"rb") as secfile:

497

484

client["secret"] = secfile.read()

498

485

else:

499

raise TypeError("No secret or secfile for section {0}"

500

.format(section))

486

raise TypeError("No secret or secfile for section %s"

487

% section)

501

488

client["timeout"] = string_to_delta(section["timeout"])

502

489

client["extended_timeout"] = string_to_delta(

503

490

section["extended_timeout"])

509

496

client["checker_command"] = section["checker"]

510

497

client["last_approval_request"] = None

511

498

client["last_checked_ok"] = None

512

client["last_checker_status"] = -2

513

499

client["last_checker_status"] = None

500

if client["enabled"]:

501

client["last_enabled"] = datetime.datetime.utcnow()

502

client["expires"] = (datetime.datetime.utcnow()

503

+ client["timeout"])

504

else:

505

client["last_enabled"] = None

506

client["expires"] = None

507

514

508

return settings

515

509

510

516

511

def __init__(self, settings, name = None):

512

"""Note: the 'checker' key in 'config' sets the

513

'checker_command' attribute and *not* the 'checker'

514

attribute."""

517

515

self.name = name

518

516

# adding all client settings

519

517

for setting, value in settings.iteritems():

520

518

setattr(self, setting, value)

521

519

522

if self.enabled:

523

if not hasattr(self, "last_enabled"):

524

self.last_enabled = datetime.datetime.utcnow()

525

if not hasattr(self, "expires"):

526

self.expires = (datetime.datetime.utcnow()

527

+ self.timeout)

528

else:

529

self.last_enabled = None

530

self.expires = None

531

532

520

logger.debug("Creating client %r", self.name)

533

521

# Uppercase and remove spaces from fingerprint for later

534

522

# comparison purposes with return value from the fingerprint()

535

523

# function

536

524

logger.debug(" Fingerprint: %s", self.fingerprint)

537

self.created = settings.get("created",

538

datetime.datetime.utcnow())

539

525

self.created = settings.get("created", datetime.datetime.utcnow())

526

540

527

# attributes specific for this server instance

541

528

self.checker = None

542

529

self.checker_initiator_tag = None

630

617

logger.warning("Checker for %(name)s crashed?",

631

618

vars(self))

632

619

633

def checked_ok(self):

634

"""Assert that the client has been seen, alive and well."""

635

self.last_checked_ok = datetime.datetime.utcnow()

636

self.last_checker_status = 0

637

self.bump_timeout()

638

639

def bump_timeout(self, timeout=None):

640

"""Bump up the timeout for this client."""

620

def checked_ok(self, timeout=None):

621

"""Bump up the timeout for this client.

622

623

This should only be called when the client has been seen,

624

alive and well.

625

"""

641

626

if timeout is None:

642

627

timeout = self.timeout

628

self.last_checked_ok = datetime.datetime.utcnow()

643

629

if self.disable_initiator_tag is not None:

644

630

gobject.source_remove(self.disable_initiator_tag)

645

631

if getattr(self, "enabled", False):

696

682

try:

697

683

command = self.checker_command % escaped_attrs

698

684

except TypeError as error:

699

logger.error('Could not format string "%s"',

700

self.checker_command, exc_info=error)

685

logger.error('Could not format string "%s":'

686

' %s', self.checker_command, error)

701

687

return True # Try again later

702

688

self.current_checker_command = command

703

689

try:

721

707

gobject.source_remove(self.checker_callback_tag)

722

708

self.checker_callback(pid, status, command)

723

709

except OSError as error:

724

logger.error("Failed to start subprocess",

725

exc_info=error)

710

logger.error("Failed to start subprocess: %s",

711

error)

726

712

# Re-run this periodically if run by gobject.timeout_add

727

713

return True

728

714

735

721

return

736

722

logger.debug("Stopping checker for %(name)s", vars(self))

737

723

try:

738

self.checker.terminate()

724

os.kill(self.checker.pid, signal.SIGTERM)

739

725

#time.sleep(0.5)

740

726

#if self.checker.poll() is None:

741

# self.checker.kill()

727

# os.kill(self.checker.pid, signal.SIGKILL)

742

728

except OSError as error:

743

729

if error.errno != errno.ESRCH: # No such process

744

730

raise

761

747

# "Set" method, so we fail early here:

762

748

if byte_arrays and signature != "ay":

763

749

raise ValueError("Byte arrays not supported for non-'ay'"

764

" signature {0!r}".format(signature))

750

" signature %r" % signature)

765

751

def decorator(func):

766

752

func._dbus_is_property = True

767

753

func._dbus_interface = dbus_interface

775

761

return decorator

776

762

777

763

778

def dbus_interface_annotations(dbus_interface):

779

"""Decorator for marking functions returning interface annotations

780

781

Usage:

782

783

@dbus_interface_annotations("org.example.Interface")

784

def _foo(self): # Function name does not matter

785

return {"org.freedesktop.DBus.Deprecated": "true",

786

"org.freedesktop.DBus.Property.EmitsChangedSignal":

787

"false"}

788

"""

789

def decorator(func):

790

func._dbus_is_interface = True

791

func._dbus_interface = dbus_interface

792

func._dbus_name = dbus_interface

793

return func

794

return decorator

795

796

797

def dbus_annotations(annotations):

798

"""Decorator to annotate D-Bus methods, signals or properties

799

Usage:

800

801

@dbus_service_property("org.example.Interface", signature="b",

802

access="r")

803

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

804

"org.freedesktop.DBus.Property."

805

"EmitsChangedSignal": "false"})

806

def Property_dbus_property(self):

807

return dbus.Boolean(False)

808

"""

809

def decorator(func):

810

func._dbus_annotations = annotations

811

return func

812

return decorator

813

814

815

764

class DBusPropertyException(dbus.exceptions.DBusException):

816

765

"""A base class for D-Bus property-related exceptions

817

766

"""

840

789

"""

841

790

842

791

@staticmethod

843

def _is_dbus_thing(thing):

844

"""Returns a function testing if an attribute is a D-Bus thing

845

846

If called like _is_dbus_thing("method") it returns a function

847

suitable for use as predicate to inspect.getmembers().

848

"""

849

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

850

False)

792

def _is_dbus_property(obj):

793

return getattr(obj, "_dbus_is_property", False)

851

794

852

def _get_all_dbus_things(self, thing):

795

def _get_all_dbus_properties(self):

853

796

"""Returns a generator of (name, attribute) pairs

854

797

"""

855

return ((getattr(athing.__get__(self), "_dbus_name",

856

name),

857

athing.__get__(self))

798

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

858

799

for cls in self.__class__.__mro__

859

for name, athing in

860

inspect.getmembers(cls,

861

self._is_dbus_thing(thing)))

800

for name, prop in

801

inspect.getmembers(cls, self._is_dbus_property))

862

802

863

803

def _get_dbus_property(self, interface_name, property_name):

864

804

"""Returns a bound method if one exists which is a D-Bus

866

806

"""

867

807

for cls in self.__class__.__mro__:

868

808

for name, value in (inspect.getmembers

869

(cls,

870

self._is_dbus_thing("property"))):

809

(cls, self._is_dbus_property)):

871

810

if (value._dbus_name == property_name

872

811

and value._dbus_interface == interface_name):

873

812

return value.__get__(self)

902

841

# signatures other than "ay".

903

842

if prop._dbus_signature != "ay":

904

843

raise ValueError

905

value = dbus.ByteArray(b''.join(chr(byte)

906

for byte in value))

844

value = dbus.ByteArray(''.join(unichr(byte)

845

for byte in value))

907

846

prop(value)

908

847

909

848

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

915

854

Note: Will not include properties with access="write".

916

855

"""

917

856

properties = {}

918

for name, prop in self._get_all_dbus_things("property"):

857

for name, prop in self._get_all_dbus_properties():

919

858

if (interface_name

920

859

and interface_name != prop._dbus_interface):

921

860

# Interface non-empty but did not match

936

875

path_keyword='object_path',

937

876

connection_keyword='connection')

938

877

def Introspect(self, object_path, connection):

939

"""Overloading of standard D-Bus method.

940

941

Inserts property tags and interface annotation tags.

878

"""Standard D-Bus method, overloaded to insert property tags.

942

879

"""

943

880

xmlstring = dbus.service.Object.Introspect(self, object_path,

944

881

connection)

951

888

e.setAttribute("access", prop._dbus_access)

952

889

return e

953

890

for if_tag in document.getElementsByTagName("interface"):

954

# Add property tags

955

891

for tag in (make_tag(document, name, prop)

956

892

for name, prop

957

in self._get_all_dbus_things("property")

893

in self._get_all_dbus_properties()

958

894

if prop._dbus_interface

959

895

== if_tag.getAttribute("name")):

960

896

if_tag.appendChild(tag)

961

# Add annotation tags

962

for typ in ("method", "signal", "property"):

963

for tag in if_tag.getElementsByTagName(typ):

964

annots = dict()

965

for name, prop in (self.

966

_get_all_dbus_things(typ)):

967

if (name == tag.getAttribute("name")

968

and prop._dbus_interface

969

== if_tag.getAttribute("name")):

970

annots.update(getattr

971

(prop,

972

"_dbus_annotations",

973

{}))

974

for name, value in annots.iteritems():

975

ann_tag = document.createElement(

976

"annotation")

977

ann_tag.setAttribute("name", name)

978

ann_tag.setAttribute("value", value)

979

tag.appendChild(ann_tag)

980

# Add interface annotation tags

981

for annotation, value in dict(

982

itertools.chain(

983

*(annotations().iteritems()

984

for name, annotations in

985

self._get_all_dbus_things("interface")

986

if name == if_tag.getAttribute("name")

987

))).iteritems():

988

ann_tag = document.createElement("annotation")

989

ann_tag.setAttribute("name", annotation)

990

ann_tag.setAttribute("value", value)

991

if_tag.appendChild(ann_tag)

992

897

# Add the names to the return values for the

993

898

# "org.freedesktop.DBus.Properties" methods

994

899

if (if_tag.getAttribute("name")

1009

914

except (AttributeError, xml.dom.DOMException,

1010

915

xml.parsers.expat.ExpatError) as error:

1011

916

logger.error("Failed to override Introspection method",

1012

exc_info=error)

917

error)

1013

918

return xmlstring

1014

919

1015

920

1029

934

def __new__(mcs, name, bases, attr):

1030

935

# Go through all the base classes which could have D-Bus

1031

936

# methods, signals, or properties in them

1032

old_interface_names = []

1033

937

for base in (b for b in bases

1034

938

if issubclass(b, dbus.service.Object)):

1035

939

# Go though all attributes of the base class

1045

949

alt_interface = (attribute._dbus_interface

1046

950

.replace("se.recompile.Mandos",

1047

951

"se.bsnet.fukt.Mandos"))

1048

if alt_interface != attribute._dbus_interface:

1049

old_interface_names.append(alt_interface)

1050

952

# Is this a D-Bus signal?

1051

953

if getattr(attribute, "_dbus_is_signal", False):

1052

954

# Extract the original non-method function by

1067

969

nonmethod_func.func_name,

1068

970

nonmethod_func.func_defaults,

1069

971

nonmethod_func.func_closure)))

1070

# Copy annotations, if any

1071

try:

1072

new_function._dbus_annotations = (

1073

dict(attribute._dbus_annotations))

1074

except AttributeError:

1075

pass

1076

972

# Define a creator of a function to call both the

1077

973

# old and new functions, so both the old and new

1078

974

# signals gets sent when the function is called

1106

1002

attribute.func_name,

1107

1003

attribute.func_defaults,

1108

1004

attribute.func_closure)))

1109

# Copy annotations, if any

1110

try:

1111

attr[attrname]._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1113

except AttributeError:

1114

pass

1115

1005

# Is this a D-Bus property?

1116

1006

elif getattr(attribute, "_dbus_is_property", False):

1117

1007

# Create a new, but exactly alike, function

1131

1021

attribute.func_name,

1132

1022

attribute.func_defaults,

1133

1023

attribute.func_closure)))

1134

# Copy annotations, if any

1135

try:

1136

attr[attrname]._dbus_annotations = (

1137

dict(attribute._dbus_annotations))

1138

except AttributeError:

1139

pass

1140

# Is this a D-Bus interface?

1141

elif getattr(attribute, "_dbus_is_interface", False):

1142

# Create a new, but exactly alike, function

1143

# object. Decorate it to be a new D-Bus interface

1144

# with the alternate D-Bus interface name. Add it

1145

# to the class.

1146

attr[attrname] = (dbus_interface_annotations

1147

(alt_interface)

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1154

# Deprecate all old interfaces

1155

iname="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1156

for old_interface_name in old_interface_names:

1157

@dbus_interface_annotations(old_interface_name)

1158

def func(self):

1159

return { "org.freedesktop.DBus.Deprecated": "true" }

1160

# Find an unused name

1161

for aname in (iname.format(i) for i in itertools.count()):

1162

if aname not in attr:

1163

attr[aname] = func

1164

break

1165

1024

return type.__new__(mcs, name, bases, attr)

1166

1025

1167

1026

1181

1040

def __init__(self, bus = None, *args, **kwargs):

1182

1041

self.bus = bus

1183

1042

Client.__init__(self, *args, **kwargs)

1043

self._approvals_pending = 0

1044

1045

self._approvals_pending = 0

1184

1046

# Only now, when this client is initialized, can it show up on

1185

1047

# the D-Bus

1186

1048

client_object_name = unicode(self.name).translate(

1190

1052

("/clients/" + client_object_name))

1191

1053

DBusObjectWithProperties.__init__(self, self.bus,

1192

1054

self.dbus_object_path)

1193

1055

1194

1056

def notifychangeproperty(transform_func,

1195

1057

dbus_name, type_func=lambda x: x,

1196

1058

variant_level=1):

1219

1081

1220

1082

return property(lambda self: getattr(self, attrname), setter)

1221

1083

1084

1222

1085

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1223

1086

approvals_pending = notifychangeproperty(dbus.Boolean,

1224

1087

"ApprovalPending",

1231

1094

checker is not None)

1232

1095

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1233

1096

"LastCheckedOK")

1234

last_checker_status = notifychangeproperty(dbus.Int16,

1235

"LastCheckerStatus")

1236

1097

last_approval_request = notifychangeproperty(

1237

1098

datetime_to_dbus, "LastApprovalRequest")

1238

1099

approved_by_default = notifychangeproperty(dbus.Boolean,

1312

1173

(self.approval_duration),

1313

1174

self._reset_approved)

1314

1175

1176

1315

1177

## D-Bus methods, signals & properties

1316

1178

_interface = "se.recompile.Mandos.Client"

1317

1179

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1325

1180

## Signals

1326

1181

1327

1182

# CheckerCompleted - signal

1363

1218

"D-Bus signal"

1364

1219

return self.need_approval()

1365

1220

1221

# NeRwequest - signal

1222

@dbus.service.signal(_interface, signature="s")

1223

def NewRequest(self, ip):

1224

"""D-Bus signal

1225

Is sent after a client request a password.

1226

"""

1227

pass

1228

1366

1229

## Methods

1367

1230

1368

1231

# Approve - method

1478

1341

return

1479

1342

return datetime_to_dbus(self.last_checked_ok)

1480

1343

1481

# LastCheckerStatus - property

1482

@dbus_service_property(_interface, signature="n",

1483

access="read")

1484

def LastCheckerStatus_dbus_property(self):

1485

return dbus.Int16(self.last_checker_status)

1486

1487

1344

# Expires - property

1488

1345

@dbus_service_property(_interface, signature="s", access="read")

1489

1346

def Expires_dbus_property(self):

1501

1358

if value is None: # get

1502

1359

return dbus.UInt64(self.timeout_milliseconds())

1503

1360

self.timeout = datetime.timedelta(0, 0, 0, value)

1361

if getattr(self, "disable_initiator_tag", None) is None:

1362

return

1504

1363

# Reschedule timeout

1505

if self.enabled:

1506

now = datetime.datetime.utcnow()

1507

time_to_die = timedelta_to_milliseconds(

1508

(self.last_checked_ok + self.timeout) - now)

1509

if time_to_die <= 0:

1510

# The timeout has passed

1511

self.disable()

1512

else:

1513

self.expires = (now +

1514

datetime.timedelta(milliseconds =

1515

time_to_die))

1516

if (getattr(self, "disable_initiator_tag", None)

1517

is None):

1518

return

1519

gobject.source_remove(self.disable_initiator_tag)

1520

self.disable_initiator_tag = (gobject.timeout_add

1521

(time_to_die,

1522

self.disable))

1364

gobject.source_remove(self.disable_initiator_tag)

1365

self.disable_initiator_tag = None

1366

self.expires = None

1367

time_to_die = timedelta_to_milliseconds((self

1368

.last_checked_ok

1369

+ self.timeout)

1370

- datetime.datetime

1371

.utcnow())

1372

if time_to_die <= 0:

1373

# The timeout has passed

1374

self.disable()

1375

else:

1376

self.expires = (datetime.datetime.utcnow()

1377

+ datetime.timedelta(milliseconds =

1378

time_to_die))

1379

self.disable_initiator_tag = (gobject.timeout_add

1380

(time_to_die, self.disable))

1523

1381

1524

1382

# ExtendedTimeout - property

1525

1383

@dbus_service_property(_interface, signature="t",

1681

1539

except KeyError:

1682

1540

return

1683

1541

1542

if self.server.use_dbus:

1543

# Emit D-Bus signal

1544

client.NewRequest(str(self.client_address))

1545

1684

1546

if client.approval_delay:

1685

1547

delay = client.approval_delay

1686

1548

client.approvals_pending += 1

1741

1603

try:

1742

1604

sent = session.send(client.secret[sent_size:])

1743

1605

except gnutls.errors.GNUTLSError as error:

1744

logger.warning("gnutls send failed",

1745

exc_info=error)

1606

logger.warning("gnutls send failed")

1746

1607

return

1747

1608

logger.debug("Sent: %d, remaining: %d",

1748

1609

sent, len(client.secret)

1751

1612

1752

1613

logger.info("Sending secret to %s", client.name)

1753

1614

# bump the timeout using extended_timeout

1754

client.bump_timeout(client.extended_timeout)

1615

client.checked_ok(client.extended_timeout)

1755

1616

if self.server.use_dbus:

1756

1617

# Emit D-Bus signal

1757

1618

client.GotSecret()

1762

1623

try:

1763

1624

session.bye()

1764

1625

except gnutls.errors.GNUTLSError as error:

1765

logger.warning("GnuTLS bye failed",

1766

exc_info=error)

1626

logger.warning("GnuTLS bye failed")

1767

1627

1768

1628

@staticmethod

1769

1629

def peer_certificate(session):

2081

1941

elif suffix == "w":

2082

1942

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2083

1943

else:

2084

raise ValueError("Unknown suffix {0!r}"

2085

.format(suffix))

1944

raise ValueError("Unknown suffix %r" % suffix)

2086

1945

except (ValueError, IndexError) as e:

2087

1946

raise ValueError(*(e.args))

2088

1947

timevalue += delta

2102

1961

sys.exit()

2103

1962

if not noclose:

2104

1963

# Close all standard open file descriptors

2105

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1964

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2106

1965

if not stat.S_ISCHR(os.fstat(null).st_mode):

2107

1966

raise OSError(errno.ENODEV,

2108

"{0} not a character device"

2109

.format(os.devnull))

1967

"%s not a character device"

1968

% os.path.devnull)

2110

1969

os.dup2(null, sys.stdin.fileno())

2111

1970

os.dup2(null, sys.stdout.fileno())

2112

1971

os.dup2(null, sys.stderr.fileno())

2121

1980

2122

1981

parser = argparse.ArgumentParser()

2123

1982

parser.add_argument("-v", "--version", action="version",

2124

version = "%(prog)s {0}".format(version),

1983

version = "%%(prog)s %s" % version,

2125

1984

help="show version number and exit")

2126

1985

parser.add_argument("-i", "--interface", metavar="IF",

2127

1986

help="Bind to interface IF")

2230

2089

2231

2090

if server_settings["servicename"] != "Mandos":

2232

2091

syslogger.setFormatter(logging.Formatter

2233

('Mandos ({0}) [%(process)d]:'

2234

' %(levelname)s: %(message)s'

2235

.format(server_settings

2236

["servicename"])))

2092

('Mandos (%s) [%%(process)d]:'

2093

' %%(levelname)s: %%(message)s'

2094

% server_settings["servicename"]))

2237

2095

2238

2096

# Parse config file with clients

2239

client_config = configparser.SafeConfigParser(Client

2240

.client_defaults)

2097

client_config = configparser.SafeConfigParser(Client.client_defaults)

2241

2098

client_config.read(os.path.join(server_settings["configdir"],

2242

2099

"clients.conf"))

2243

2100

2257

2114

pidfilename = "/var/run/mandos.pid"

2258

2115

try:

2259

2116

pidfile = open(pidfilename, "w")

2260

except IOError as e:

2261

logger.error("Could not open file %r", pidfilename,

2262

exc_info=e)

2117

except IOError:

2118

logger.error("Could not open file %r", pidfilename)

2263

2119

2264

for name in ("_mandos", "mandos", "nobody"):

2120

try:

2121

uid = pwd.getpwnam("_mandos").pw_uid

2122

gid = pwd.getpwnam("_mandos").pw_gid

2123

except KeyError:

2265

2124

try:

2266

uid = pwd.getpwnam(name).pw_uid

2267

gid = pwd.getpwnam(name).pw_gid

2268

break

2125

uid = pwd.getpwnam("mandos").pw_uid

2126

gid = pwd.getpwnam("mandos").pw_gid

2269

2127

except KeyError:

2270

continue

2271

else:

2272

uid = 65534

2273

gid = 65534

2128

try:

2129

uid = pwd.getpwnam("nobody").pw_uid

2130

gid = pwd.getpwnam("nobody").pw_gid

2131

except KeyError:

2132

uid = 65534

2133

gid = 65534

2274

2134

try:

2275

2135

os.setgid(gid)

2276

2136

os.setuid(uid)

2293

2153

.gnutls_global_set_log_function(debug_gnutls))

2294

2154

2295

2155

# Redirect stdin so all checkers get /dev/null

2296

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2156

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2297

2157

os.dup2(null, sys.stdin.fileno())

2298

2158

if null > 2:

2299

2159

os.close(null)

2307

2167

2308

2168

global main_loop

2309

2169

# From the Avahi example code

2310

DBusGMainLoop(set_as_default=True)

2170

DBusGMainLoop(set_as_default=True )

2311

2171

main_loop = gobject.MainLoop()

2312

2172

bus = dbus.SystemBus()

2313

2173

# End of Avahi example code

2319

2179

("se.bsnet.fukt.Mandos", bus,

2320

2180

do_not_queue=True))

2321

2181

except dbus.exceptions.NameExistsException as e:

2322

logger.error("Disabling D-Bus:", exc_info=e)

2182

logger.error(unicode(e) + ", disabling D-Bus")

2323

2183

use_dbus = False

2324

2184

server_settings["use_dbus"] = False

2325

2185

tcp_server.use_dbus = False

2352

2212

(stored_state))

2353

2213

os.remove(stored_state_path)

2354

2214

except IOError as e:

2355

if e.errno == errno.ENOENT:

2356

logger.warning("Could not load persistent state: {0}"

2357

.format(os.strerror(e.errno)))

2358

else:

2359

logger.critical("Could not load persistent state:",

2360

exc_info=e)

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2361

2218

raise

2362

2219

except EOFError as e:

2363

2220

logger.warning("Could not load persistent state: "

2364

"EOFError:", exc_info=e)

2221

"EOFError: {0}".format(e))

2365

2222

2366

2223

with PGPEngine() as pgp:

2367

2224

for client_name, client in clients_data.iteritems():

2384

2241

2385

2242

# Clients who has passed its expire date can still be

2386

2243

# enabled if its last checker was successful. Clients

2387

# whose checker succeeded before we stored its state is

2388

# assumed to have successfully run all checkers during

2389

# downtime.

2244

# whose checker failed before we stored its state is

2245

# assumed to have failed all checkers during downtime.

2390

2246

if client["enabled"]:

2391

2247

if datetime.datetime.utcnow() >= client["expires"]:

2392

2248

if not client["last_checked_ok"]:

2393

2249

logger.warning(

2394

2250

"disabling client {0} - Client never "

2395

"performed a successful checker"

2396

.format(client_name))

2251

"performed a successfull checker"

2252

.format(client["name"]))

2397

2253

client["enabled"] = False

2398

2254

elif client["last_checker_status"] != 0:

2399

2255

logger.warning(

2400

2256

"disabling client {0} - Client "

2401

2257

"last checker failed with error code {1}"

2402

.format(client_name,

2258

.format(client["name"],

2403

2259

client["last_checker_status"]))

2404

2260

client["enabled"] = False

2405

2261

else:

2406

2262

client["expires"] = (datetime.datetime

2407

2263

.utcnow()

2408

2264

+ client["timeout"])

2409

logger.debug("Last checker succeeded,"

2410

" keeping {0} enabled"

2411

.format(client_name))

2265

2412

2266

try:

2413

2267

client["secret"] = (

2414

2268

pgp.decrypt(client["encrypted_secret"],

2420

2274

.format(client_name))

2421

2275

client["secret"] = (

2422

2276

client_settings[client_name]["secret"])

2277

2423

2278

2424

2279

# Add/remove clients based on new changes made to config

2425

for client_name in (set(old_client_settings)

2426

- set(client_settings)):

2280

for client_name in set(old_client_settings) - set(client_settings):

2427

2281

del clients_data[client_name]

2428

for client_name in (set(client_settings)

2429

- set(old_client_settings)):

2282

for client_name in set(client_settings) - set(old_client_settings):

2430

2283

clients_data[client_name] = client_settings[client_name]

2431

2432

# Create all client objects

2284

2285

# Create clients all clients

2433

2286

for client_name, client in clients_data.iteritems():

2434

2287

tcp_server.clients[client_name] = client_class(

2435

2288

name = client_name, settings = client)

2436

2289

2437

2290

if not tcp_server.clients:

2438

2291

logger.warning("No clients defined")

2439

2292

2440

2293

if not debug:

2441

2294

try:

2442

2295

with pidfile:

2456

2309

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2457

2310

2458

2311

if use_dbus:

2459

class MandosDBusService(DBusObjectWithProperties):

2312

class MandosDBusService(dbus.service.Object):

2460

2313

"""A D-Bus proxy object"""

2461

2314

def __init__(self):

2462

2315

dbus.service.Object.__init__(self, bus, "/")

2463

2316

_interface = "se.recompile.Mandos"

2464

2317

2465

@dbus_interface_annotations(_interface)

2466

def _foo(self):

2467

return { "org.freedesktop.DBus.Property"

2468

".EmitsChangedSignal":

2469

"false"}

2470

2471

2318

@dbus.service.signal(_interface, signature="o")

2472

2319

def ClientAdded(self, objpath):

2473

2320

"D-Bus signal"

2564

2411

pickle.dump((clients, client_settings), stored_state)

2565

2412

os.rename(tempname, stored_state_path)

2566

2413

except (IOError, OSError) as e:

2414

logger.warning("Could not save persistent state: {0}"

2415

.format(e))

2567

2416

if not debug:

2568

2417

try:

2569

2418

os.remove(tempname)

2570

2419

except NameError:

2571

2420

pass

2572

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2573

logger.warning("Could not save persistent state: {0}"

2574

.format(os.strerror(e.errno)))

2575

else:

2576

logger.warning("Could not save persistent state:",

2577

exc_info=e)

2421

if e.errno not in set((errno.ENOENT, errno.EACCES,

2422

errno.EEXIST)):

2578

2423

raise e

2579

2424

2580

2425

# Delete all clients, and settings from config

2608

2453

service.port = tcp_server.socket.getsockname()[1]

2609

2454

if use_ipv6:

2610

2455

logger.info("Now listening on address %r, port %d,"

2611

" flowinfo %d, scope_id %d",

2612

*tcp_server.socket.getsockname())

2456

" flowinfo %d, scope_id %d"

2457

% tcp_server.socket.getsockname())

2613

2458

else: # IPv4

2614

logger.info("Now listening on address %r, port %d",

2615

*tcp_server.socket.getsockname())

2459

logger.info("Now listening on address %r, port %d"

2460

% tcp_server.socket.getsockname())

2616

2461

2617

2462

#service.interface = tcp_server.socket.getsockname()[3]

2618

2463

2621

2466

try:

2622

2467

service.activate()

2623

2468

except dbus.exceptions.DBusException as error:

2624

logger.critical("D-Bus Exception", exc_info=error)

2469

logger.critical("DBusException: %s", error)

2625

2470

cleanup()

2626

2471

sys.exit(1)

2627

2472

# End of Avahi example code

2634

2479

logger.debug("Starting main loop")

2635

2480

main_loop.run()

2636

2481

except AvahiError as error:

2637

logger.critical("Avahi Error", exc_info=error)

2482

logger.critical("AvahiError: %s", error)

2638

2483

cleanup()

2639

2484

sys.exit(1)

2640

2485

except KeyboardInterrupt: