/mandos/trunk : revision 548

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

68

70

69

import dbus

71

70

import dbus.service

86

85

except ImportError:

87

86

SO_BINDTODEVICE = None

88

87

89

version = "1.5.3"

88

version = "1.5.0"

90

89

stored_state_file = "clients.pickle"

91

90

92

91

logger = logging.getLogger()

176

175

177

176

def encrypt(self, data, password):

178

177

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

178

with open(os.devnull) as devnull:

180

179

try:

181

180

proc = self.gnupg.run(['--symmetric'],

182

181

create_fhs=['stdin', 'stdout'],

193

192

194

193

def decrypt(self, data, password):

195

194

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

195

with open(os.devnull) as devnull:

197

196

try:

198

197

proc = self.gnupg.run(['--decrypt'],

199

198

create_fhs=['stdin', 'stdout'],

200

199

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

200

with contextlib.closing(proc.handles['stdin'] ) as f:

202

201

f.write(data)

203

202

with contextlib.closing(proc.handles['stdout']) as f:

204

203

decrypted_plaintext = f.read()

209

208

return decrypted_plaintext

210

209

211

210

211

212

class AvahiError(Exception):

213

def __init__(self, value, *args, **kwargs):

214

self.value = value

243

server: D-Bus Server

244

bus: dbus.SystemBus()

245

"""

246

247

246

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

247

servicetype = None, port = None, TXT = None,

249

248

domain = "", host = "", max_renames = 32768,

262

261

self.server = None

263

262

self.bus = bus

264

263

self.entry_group_state_changed_match = None

265

266

264

def rename(self):

267

265

"""Derived from the Avahi example code"""

268

266

if self.rename_count >= self.max_renames:

278

276

try:

279

277

self.add()

280

278

except dbus.exceptions.DBusException as error:

281

logger.critical("D-Bus Exception", exc_info=error)

279

logger.critical("DBusException: %s", error)

282

280

self.cleanup()

283

281

os._exit(1)

284

282

self.rename_count += 1

285

286

283

def remove(self):

287

284

"""Derived from the Avahi example code"""

288

285

if self.entry_group_state_changed_match is not None:

290

287

self.entry_group_state_changed_match = None

291

288

if self.group is not None:

292

289

self.group.Reset()

293

294

290

def add(self):

295

291

"""Derived from the Avahi example code"""

296

292

self.remove()

313

309

dbus.UInt16(self.port),

314

310

avahi.string_array_to_txt_array(self.TXT))

315

311

self.group.Commit()

316

317

312

def entry_group_state_changed(self, state, error):

318

313

"""Derived from the Avahi example code"""

319

314

logger.debug("Avahi entry group state change: %i", state)

326

321

elif state == avahi.ENTRY_GROUP_FAILURE:

327

322

logger.critical("Avahi: Error in group state changed %s",

328

323

unicode(error))

329

raise AvahiGroupError("State changed: {0!s}"

330

.format(error))

331

324

raise AvahiGroupError("State changed: %s"

325

% unicode(error))

332

326

def cleanup(self):

333

327

"""Derived from the Avahi example code"""

334

328

if self.group is not None:

339

333

pass

340

334

self.group = None

341

335

self.remove()

342

343

336

def server_state_changed(self, state, error=None):

344

337

"""Derived from the Avahi example code"""

345

338

logger.debug("Avahi server state change: %i", state)

364

357

logger.debug("Unknown state: %r", state)

365

358

else:

366

359

logger.debug("Unknown state: %r: %r", state, error)

367

368

360

def activate(self):

369

361

"""Derived from the Avahi example code"""

370

362

if self.server is None:

382

374

"""Add the new name to the syslog messages"""

383

375

ret = AvahiService.rename(self)

384

376

syslogger.setFormatter(logging.Formatter

385

('Mandos ({0}) [%(process)d]:'

386

' %(levelname)s: %(message)s'

387

.format(self.name)))

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

388

380

return ret

389

381

390

382

def timedelta_to_milliseconds(td):

392

384

return ((td.days * 24 * 60 * 60 * 1000)

393

385

+ (td.seconds * 1000)

394

386

+ (td.microseconds // 1000))

395

387

396

388

class Client(object):

397

389

"""A representation of a client host served by this server.

398

390

423

415

last_checked_ok: datetime.datetime(); (UTC) or None

424

416

last_checker_status: integer between 0 and 255 reflecting exit

425

417

status of last checker. -1 reflects crashed

426

checker, -2 means no checker completed yet.

418

checker, or None.

427

419

last_enabled: datetime.datetime(); (UTC) or None

428

420

name: string; from the config file, used in log messages and

429

421

D-Bus identifiers

430

422

secret: bytestring; sent verbatim (over TLS) to client

431

423

timeout: datetime.timedelta(); How long from last_checked_ok

432

424

until this client is disabled

433

extended_timeout: extra long timeout when secret has been sent

425

extended_timeout: extra long timeout when password has been sent

434

426

runtime_expansions: Allowed attributes for runtime expansion.

435

427

expires: datetime.datetime(); time (UTC) when a client will be

436

428

disabled, or None

465

457

466

458

def approval_delay_milliseconds(self):

467

459

return timedelta_to_milliseconds(self.approval_delay)

468

460

469

461

@staticmethod

470

462

def config_parser(config):

471

463

"""Construct a new dict of client settings of this form:

496

488

"rb") as secfile:

497

489

client["secret"] = secfile.read()

498

490

else:

499

raise TypeError("No secret or secfile for section {0}"

500

.format(section))

491

raise TypeError("No secret or secfile for section %s"

492

% section)

501

493

client["timeout"] = string_to_delta(section["timeout"])

502

494

client["extended_timeout"] = string_to_delta(

503

495

section["extended_timeout"])

509

501

client["checker_command"] = section["checker"]

510

502

client["last_approval_request"] = None

511

503

client["last_checked_ok"] = None

512

client["last_checker_status"] = -2

504

client["last_checker_status"] = None

513

505

514

506

return settings

515

507

508

516

509

def __init__(self, settings, name = None):

510

"""Note: the 'checker' key in 'config' sets the

511

'checker_command' attribute and *not* the 'checker'

512

attribute."""

517

513

self.name = name

518

514

# adding all client settings

519

515

for setting, value in settings.iteritems():

528

524

else:

529

525

self.last_enabled = None

530

526

self.expires = None

531

527

532

528

logger.debug("Creating client %r", self.name)

533

529

# Uppercase and remove spaces from fingerprint for later

534

530

# comparison purposes with return value from the fingerprint()

536

532

logger.debug(" Fingerprint: %s", self.fingerprint)

537

533

self.created = settings.get("created",

538

534

datetime.datetime.utcnow())

539

535

540

536

# attributes specific for this server instance

541

537

self.checker = None

542

538

self.checker_initiator_tag = None

630

626

logger.warning("Checker for %(name)s crashed?",

631

627

vars(self))

632

628

633

def checked_ok(self):

634

"""Assert that the client has been seen, alive and well."""

635

self.last_checked_ok = datetime.datetime.utcnow()

636

self.last_checker_status = 0

637

self.bump_timeout()

638

639

def bump_timeout(self, timeout=None):

640

"""Bump up the timeout for this client."""

629

def checked_ok(self, timeout=None):

630

"""Bump up the timeout for this client.

631

632

This should only be called when the client has been seen,

633

alive and well.

634

"""

641

635

if timeout is None:

642

636

timeout = self.timeout

637

self.last_checked_ok = datetime.datetime.utcnow()

643

638

if self.disable_initiator_tag is not None:

644

639

gobject.source_remove(self.disable_initiator_tag)

645

640

if getattr(self, "enabled", False):

696

691

try:

697

692

command = self.checker_command % escaped_attrs

698

693

except TypeError as error:

699

logger.error('Could not format string "%s"',

700

self.checker_command, exc_info=error)

694

logger.error('Could not format string "%s":'

695

' %s', self.checker_command, error)

701

696

return True # Try again later

702

697

self.current_checker_command = command

703

698

try:

721

716

gobject.source_remove(self.checker_callback_tag)

722

717

self.checker_callback(pid, status, command)

723

718

except OSError as error:

724

logger.error("Failed to start subprocess",

725

exc_info=error)

719

logger.error("Failed to start subprocess: %s",

720

error)

726

721

# Re-run this periodically if run by gobject.timeout_add

727

722

return True

728

723

735

730

return

736

731

logger.debug("Stopping checker for %(name)s", vars(self))

737

732

try:

738

self.checker.terminate()

733

os.kill(self.checker.pid, signal.SIGTERM)

739

734

#time.sleep(0.5)

740

735

#if self.checker.poll() is None:

741

# self.checker.kill()

736

# os.kill(self.checker.pid, signal.SIGKILL)

742

737

except OSError as error:

743

738

if error.errno != errno.ESRCH: # No such process

744

739

raise

761

756

# "Set" method, so we fail early here:

762

757

if byte_arrays and signature != "ay":

763

758

raise ValueError("Byte arrays not supported for non-'ay'"

764

" signature {0!r}".format(signature))

759

" signature %r" % signature)

765

760

def decorator(func):

766

761

func._dbus_is_property = True

767

762

func._dbus_interface = dbus_interface

775

770

return decorator

776

771

777

772

778

def dbus_interface_annotations(dbus_interface):

779

"""Decorator for marking functions returning interface annotations

780

781

Usage:

782

783

@dbus_interface_annotations("org.example.Interface")

784

def _foo(self): # Function name does not matter

785

return {"org.freedesktop.DBus.Deprecated": "true",

786

"org.freedesktop.DBus.Property.EmitsChangedSignal":

787

"false"}

788

"""

789

def decorator(func):

790

func._dbus_is_interface = True

791

func._dbus_interface = dbus_interface

792

func._dbus_name = dbus_interface

793

return func

794

return decorator

795

796

797

def dbus_annotations(annotations):

798

"""Decorator to annotate D-Bus methods, signals or properties

799

Usage:

800

801

@dbus_service_property("org.example.Interface", signature="b",

802

access="r")

803

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

804

"org.freedesktop.DBus.Property."

805

"EmitsChangedSignal": "false"})

806

def Property_dbus_property(self):

807

return dbus.Boolean(False)

808

"""

809

def decorator(func):

810

func._dbus_annotations = annotations

811

return func

812

return decorator

813

814

815

773

class DBusPropertyException(dbus.exceptions.DBusException):

816

774

"""A base class for D-Bus property-related exceptions

817

775

"""

840

798

"""

841

799

842

800

@staticmethod

843

def _is_dbus_thing(thing):

844

"""Returns a function testing if an attribute is a D-Bus thing

845

846

If called like _is_dbus_thing("method") it returns a function

847

suitable for use as predicate to inspect.getmembers().

848

"""

849

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

850

False)

801

def _is_dbus_property(obj):

802

return getattr(obj, "_dbus_is_property", False)

851

803

852

def _get_all_dbus_things(self, thing):

804

def _get_all_dbus_properties(self):

853

805

"""Returns a generator of (name, attribute) pairs

854

806

"""

855

return ((getattr(athing.__get__(self), "_dbus_name",

856

name),

857

athing.__get__(self))

807

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

858

808

for cls in self.__class__.__mro__

859

for name, athing in

860

inspect.getmembers(cls,

861

self._is_dbus_thing(thing)))

809

for name, prop in

810

inspect.getmembers(cls, self._is_dbus_property))

862

811

863

812

def _get_dbus_property(self, interface_name, property_name):

864

813

"""Returns a bound method if one exists which is a D-Bus

866

815

"""

867

816

for cls in self.__class__.__mro__:

868

817

for name, value in (inspect.getmembers

869

(cls,

870

self._is_dbus_thing("property"))):

818

(cls, self._is_dbus_property)):

871

819

if (value._dbus_name == property_name

872

820

and value._dbus_interface == interface_name):

873

821

return value.__get__(self)

915

863

Note: Will not include properties with access="write".

916

864

"""

917

865

properties = {}

918

for name, prop in self._get_all_dbus_things("property"):

866

for name, prop in self._get_all_dbus_properties():

919

867

if (interface_name

920

868

and interface_name != prop._dbus_interface):

921

869

# Interface non-empty but did not match

936

884

path_keyword='object_path',

937

885

connection_keyword='connection')

938

886

def Introspect(self, object_path, connection):

939

"""Overloading of standard D-Bus method.

940

941

Inserts property tags and interface annotation tags.

887

"""Standard D-Bus method, overloaded to insert property tags.

942

888

"""

943

889

xmlstring = dbus.service.Object.Introspect(self, object_path,

944

890

connection)

951

897

e.setAttribute("access", prop._dbus_access)

952

898

return e

953

899

for if_tag in document.getElementsByTagName("interface"):

954

# Add property tags

955

900

for tag in (make_tag(document, name, prop)

956

901

for name, prop

957

in self._get_all_dbus_things("property")

902

in self._get_all_dbus_properties()

958

903

if prop._dbus_interface

959

904

== if_tag.getAttribute("name")):

960

905

if_tag.appendChild(tag)

961

# Add annotation tags

962

for typ in ("method", "signal", "property"):

963

for tag in if_tag.getElementsByTagName(typ):

964

annots = dict()

965

for name, prop in (self.

966

_get_all_dbus_things(typ)):

967

if (name == tag.getAttribute("name")

968

and prop._dbus_interface

969

== if_tag.getAttribute("name")):

970

annots.update(getattr

971

(prop,

972

"_dbus_annotations",

973

{}))

974

for name, value in annots.iteritems():

975

ann_tag = document.createElement(

976

"annotation")

977

ann_tag.setAttribute("name", name)

978

ann_tag.setAttribute("value", value)

979

tag.appendChild(ann_tag)

980

# Add interface annotation tags

981

for annotation, value in dict(

982

itertools.chain(

983

*(annotations().iteritems()

984

for name, annotations in

985

self._get_all_dbus_things("interface")

986

if name == if_tag.getAttribute("name")

987

))).iteritems():

988

ann_tag = document.createElement("annotation")

989

ann_tag.setAttribute("name", annotation)

990

ann_tag.setAttribute("value", value)

991

if_tag.appendChild(ann_tag)

992

906

# Add the names to the return values for the

993

907

# "org.freedesktop.DBus.Properties" methods

994

908

if (if_tag.getAttribute("name")

1009

923

except (AttributeError, xml.dom.DOMException,

1010

924

xml.parsers.expat.ExpatError) as error:

1011

925

logger.error("Failed to override Introspection method",

1012

exc_info=error)

926

error)

1013

927

return xmlstring

1014

928

1015

929

1029

943

def __new__(mcs, name, bases, attr):

1030

944

# Go through all the base classes which could have D-Bus

1031

945

# methods, signals, or properties in them

1032

old_interface_names = []

1033

946

for base in (b for b in bases

1034

947

if issubclass(b, dbus.service.Object)):

1035

948

# Go though all attributes of the base class

1045

958

alt_interface = (attribute._dbus_interface

1046

959

.replace("se.recompile.Mandos",

1047

960

"se.bsnet.fukt.Mandos"))

1048

if alt_interface != attribute._dbus_interface:

1049

old_interface_names.append(alt_interface)

1050

961

# Is this a D-Bus signal?

1051

962

if getattr(attribute, "_dbus_is_signal", False):

1052

963

# Extract the original non-method function by

1067

978

nonmethod_func.func_name,

1068

979

nonmethod_func.func_defaults,

1069

980

nonmethod_func.func_closure)))

1070

# Copy annotations, if any

1071

try:

1072

new_function._dbus_annotations = (

1073

dict(attribute._dbus_annotations))

1074

except AttributeError:

1075

pass

1076

981

# Define a creator of a function to call both the

1077

982

# old and new functions, so both the old and new

1078

983

# signals gets sent when the function is called

1106

1011

attribute.func_name,

1107

1012

attribute.func_defaults,

1108

1013

attribute.func_closure)))

1109

# Copy annotations, if any

1110

try:

1111

attr[attrname]._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1113

except AttributeError:

1114

pass

1115

1014

# Is this a D-Bus property?

1116

1015

elif getattr(attribute, "_dbus_is_property", False):

1117

1016

# Create a new, but exactly alike, function

1131

1030

attribute.func_name,

1132

1031

attribute.func_defaults,

1133

1032

attribute.func_closure)))

1134

# Copy annotations, if any

1135

try:

1136

attr[attrname]._dbus_annotations = (

1137

dict(attribute._dbus_annotations))

1138

except AttributeError:

1139

pass

1140

# Is this a D-Bus interface?

1141

elif getattr(attribute, "_dbus_is_interface", False):

1142

# Create a new, but exactly alike, function

1143

# object. Decorate it to be a new D-Bus interface

1144

# with the alternate D-Bus interface name. Add it

1145

# to the class.

1146

attr[attrname] = (dbus_interface_annotations

1147

(alt_interface)

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1154

# Deprecate all old interfaces

1155

iname="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1156

for old_interface_name in old_interface_names:

1157

@dbus_interface_annotations(old_interface_name)

1158

def func(self):

1159

return { "org.freedesktop.DBus.Deprecated": "true" }

1160

# Find an unused name

1161

for aname in (iname.format(i) for i in itertools.count()):

1162

if aname not in attr:

1163

attr[aname] = func

1164

break

1165

1033

return type.__new__(mcs, name, bases, attr)

1166

1034

1167

1035

1181

1049

def __init__(self, bus = None, *args, **kwargs):

1182

1050

self.bus = bus

1183

1051

Client.__init__(self, *args, **kwargs)

1052

self._approvals_pending = 0

1053

1054

self._approvals_pending = 0

1184

1055

# Only now, when this client is initialized, can it show up on

1185

1056

# the D-Bus

1186

1057

client_object_name = unicode(self.name).translate(

1190

1061

("/clients/" + client_object_name))

1191

1062

DBusObjectWithProperties.__init__(self, self.bus,

1192

1063

self.dbus_object_path)

1193

1064

1194

1065

def notifychangeproperty(transform_func,

1195

1066

dbus_name, type_func=lambda x: x,

1196

1067

variant_level=1):

1219

1090

1220

1091

return property(lambda self: getattr(self, attrname), setter)

1221

1092

1093

1222

1094

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1223

1095

approvals_pending = notifychangeproperty(dbus.Boolean,

1224

1096

"ApprovalPending",

1231

1103

checker is not None)

1232

1104

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1233

1105

"LastCheckedOK")

1234

last_checker_status = notifychangeproperty(dbus.Int16,

1235

"LastCheckerStatus")

1236

1106

last_approval_request = notifychangeproperty(

1237

1107

datetime_to_dbus, "LastApprovalRequest")

1238

1108

approved_by_default = notifychangeproperty(dbus.Boolean,

1312

1182

(self.approval_duration),

1313

1183

self._reset_approved)

1314

1184

1185

1315

1186

## D-Bus methods, signals & properties

1316

1187

_interface = "se.recompile.Mandos.Client"

1317

1188

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1325

1189

## Signals

1326

1190

1327

1191

# CheckerCompleted - signal

1363

1227

"D-Bus signal"

1364

1228

return self.need_approval()

1365

1229

1230

# NeRwequest - signal

1231

@dbus.service.signal(_interface, signature="s")

1232

def NewRequest(self, ip):

1233

"""D-Bus signal

1234

Is sent after a client request a password.

1235

"""

1236

pass

1237

1366

1238

## Methods

1367

1239

1368

1240

# Approve - method

1478

1350

return

1479

1351

return datetime_to_dbus(self.last_checked_ok)

1480

1352

1481

# LastCheckerStatus - property

1482

@dbus_service_property(_interface, signature="n",

1483

access="read")

1484

def LastCheckerStatus_dbus_property(self):

1485

return dbus.Int16(self.last_checker_status)

1486

1487

1353

# Expires - property

1488

1354

@dbus_service_property(_interface, signature="s", access="read")

1489

1355

def Expires_dbus_property(self):

1681

1547

except KeyError:

1682

1548

return

1683

1549

1550

if self.server.use_dbus:

1551

# Emit D-Bus signal

1552

client.NewRequest(str(self.client_address))

1553

1684

1554

if client.approval_delay:

1685

1555

delay = client.approval_delay

1686

1556

client.approvals_pending += 1

1741

1611

try:

1742

1612

sent = session.send(client.secret[sent_size:])

1743

1613

except gnutls.errors.GNUTLSError as error:

1744

logger.warning("gnutls send failed",

1745

exc_info=error)

1614

logger.warning("gnutls send failed")

1746

1615

return

1747

1616

logger.debug("Sent: %d, remaining: %d",

1748

1617

sent, len(client.secret)

1751

1620

1752

1621

logger.info("Sending secret to %s", client.name)

1753

1622

# bump the timeout using extended_timeout

1754

client.bump_timeout(client.extended_timeout)

1623

client.checked_ok(client.extended_timeout)

1755

1624

if self.server.use_dbus:

1756

1625

# Emit D-Bus signal

1757

1626

client.GotSecret()

1762

1631

try:

1763

1632

session.bye()

1764

1633

except gnutls.errors.GNUTLSError as error:

1765

logger.warning("GnuTLS bye failed",

1766

exc_info=error)

1634

logger.warning("GnuTLS bye failed")

1767

1635

1768

1636

@staticmethod

1769

1637

def peer_certificate(session):

2081

1949

elif suffix == "w":

2082

1950

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2083

1951

else:

2084

raise ValueError("Unknown suffix {0!r}"

2085

.format(suffix))

1952

raise ValueError("Unknown suffix %r" % suffix)

2086

1953

except (ValueError, IndexError) as e:

2087

1954

raise ValueError(*(e.args))

2088

1955

timevalue += delta

2102

1969

sys.exit()

2103

1970

if not noclose:

2104

1971

# Close all standard open file descriptors

2105

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1972

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2106

1973

if not stat.S_ISCHR(os.fstat(null).st_mode):

2107

1974

raise OSError(errno.ENODEV,

2108

"{0} not a character device"

2109

.format(os.devnull))

1975

"%s not a character device"

1976

% os.path.devnull)

2110

1977

os.dup2(null, sys.stdin.fileno())

2111

1978

os.dup2(null, sys.stdout.fileno())

2112

1979

os.dup2(null, sys.stderr.fileno())

2121

1988

2122

1989

parser = argparse.ArgumentParser()

2123

1990

parser.add_argument("-v", "--version", action="version",

2124

version = "%(prog)s {0}".format(version),

1991

version = "%%(prog)s %s" % version,

2125

1992

help="show version number and exit")

2126

1993

parser.add_argument("-i", "--interface", metavar="IF",

2127

1994

help="Bind to interface IF")

2230

2097

2231

2098

if server_settings["servicename"] != "Mandos":

2232

2099

syslogger.setFormatter(logging.Formatter

2233

('Mandos ({0}) [%(process)d]:'

2234

' %(levelname)s: %(message)s'

2235

.format(server_settings

2236

["servicename"])))

2100

('Mandos (%s) [%%(process)d]:'

2101

' %%(levelname)s: %%(message)s'

2102

% server_settings["servicename"]))

2237

2103

2238

2104

# Parse config file with clients

2239

2105

client_config = configparser.SafeConfigParser(Client

2257

2123

pidfilename = "/var/run/mandos.pid"

2258

2124

try:

2259

2125

pidfile = open(pidfilename, "w")

2260

except IOError as e:

2261

logger.error("Could not open file %r", pidfilename,

2262

exc_info=e)

2126

except IOError:

2127

logger.error("Could not open file %r", pidfilename)

2263

2128

2264

for name in ("_mandos", "mandos", "nobody"):

2129

try:

2130

uid = pwd.getpwnam("_mandos").pw_uid

2131

gid = pwd.getpwnam("_mandos").pw_gid

2132

except KeyError:

2265

2133

try:

2266

uid = pwd.getpwnam(name).pw_uid

2267

gid = pwd.getpwnam(name).pw_gid

2268

break

2134

uid = pwd.getpwnam("mandos").pw_uid

2135

gid = pwd.getpwnam("mandos").pw_gid

2269

2136

except KeyError:

2270

continue

2271

else:

2272

uid = 65534

2273

gid = 65534

2137

try:

2138

uid = pwd.getpwnam("nobody").pw_uid

2139

gid = pwd.getpwnam("nobody").pw_gid

2140

except KeyError:

2141

uid = 65534

2142

gid = 65534

2274

2143

try:

2275

2144

os.setgid(gid)

2276

2145

os.setuid(uid)

2293

2162

.gnutls_global_set_log_function(debug_gnutls))

2294

2163

2295

2164

# Redirect stdin so all checkers get /dev/null

2296

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2165

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2297

2166

os.dup2(null, sys.stdin.fileno())

2298

2167

if null > 2:

2299

2168

os.close(null)

2307

2176

2308

2177

global main_loop

2309

2178

# From the Avahi example code

2310

DBusGMainLoop(set_as_default=True)

2179

DBusGMainLoop(set_as_default=True )

2311

2180

main_loop = gobject.MainLoop()

2312

2181

bus = dbus.SystemBus()

2313

2182

# End of Avahi example code

2319

2188

("se.bsnet.fukt.Mandos", bus,

2320

2189

do_not_queue=True))

2321

2190

except dbus.exceptions.NameExistsException as e:

2322

logger.error("Disabling D-Bus:", exc_info=e)

2191

logger.error(unicode(e) + ", disabling D-Bus")

2323

2192

use_dbus = False

2324

2193

server_settings["use_dbus"] = False

2325

2194

tcp_server.use_dbus = False

2352

2221

(stored_state))

2353

2222

os.remove(stored_state_path)

2354

2223

except IOError as e:

2355

if e.errno == errno.ENOENT:

2356

logger.warning("Could not load persistent state: {0}"

2357

.format(os.strerror(e.errno)))

2358

else:

2359

logger.critical("Could not load persistent state:",

2360

exc_info=e)

2224

logger.warning("Could not load persistent state: {0}"

2225

.format(e))

2226

if e.errno != errno.ENOENT:

2361

2227

raise

2362

2228

except EOFError as e:

2363

2229

logger.warning("Could not load persistent state: "

2364

"EOFError:", exc_info=e)

2230

"EOFError: {0}".format(e))

2365

2231

2366

2232

with PGPEngine() as pgp:

2367

2233

for client_name, client in clients_data.iteritems():

2384

2250

2385

2251

# Clients who has passed its expire date can still be

2386

2252

# enabled if its last checker was successful. Clients

2387

# whose checker succeeded before we stored its state is

2388

# assumed to have successfully run all checkers during

2389

# downtime.

2253

# whose checker failed before we stored its state is

2254

# assumed to have failed all checkers during downtime.

2390

2255

if client["enabled"]:

2391

2256

if datetime.datetime.utcnow() >= client["expires"]:

2392

2257

if not client["last_checked_ok"]:

2393

2258

logger.warning(

2394

2259

"disabling client {0} - Client never "

2395

"performed a successful checker"

2396

.format(client_name))

2260

"performed a successfull checker"

2261

.format(client["name"]))

2397

2262

client["enabled"] = False

2398

2263

elif client["last_checker_status"] != 0:

2399

2264

logger.warning(

2400

2265

"disabling client {0} - Client "

2401

2266

"last checker failed with error code {1}"

2402

.format(client_name,

2267

.format(client["name"],

2403

2268

client["last_checker_status"]))

2404

2269

client["enabled"] = False

2405

2270

else:

2408

2273

+ client["timeout"])

2409

2274

logger.debug("Last checker succeeded,"

2410

2275

" keeping {0} enabled"

2411

.format(client_name))

2276

.format(client["name"]))

2412

2277

try:

2413

2278

client["secret"] = (

2414

2279

pgp.decrypt(client["encrypted_secret"],

2420

2285

.format(client_name))

2421

2286

client["secret"] = (

2422

2287

client_settings[client_name]["secret"])

2288

2423

2289

2424

2290

# Add/remove clients based on new changes made to config

2425

2291

for client_name in (set(old_client_settings)

2428

2294

for client_name in (set(client_settings)

2429

2295

- set(old_client_settings)):

2430

2296

clients_data[client_name] = client_settings[client_name]

2431

2432

# Create all client objects

2297

2298

# Create clients all clients

2433

2299

for client_name, client in clients_data.iteritems():

2434

2300

tcp_server.clients[client_name] = client_class(

2435

2301

name = client_name, settings = client)

2436

2302

2437

2303

if not tcp_server.clients:

2438

2304

logger.warning("No clients defined")

2439

2305

2440

2306

if not debug:

2441

2307

try:

2442

2308

with pidfile:

2456

2322

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2457

2323

2458

2324

if use_dbus:

2459

class MandosDBusService(DBusObjectWithProperties):

2325

class MandosDBusService(dbus.service.Object):

2460

2326

"""A D-Bus proxy object"""

2461

2327

def __init__(self):

2462

2328

dbus.service.Object.__init__(self, bus, "/")

2463

2329

_interface = "se.recompile.Mandos"

2464

2330

2465

@dbus_interface_annotations(_interface)

2466

def _foo(self):

2467

return { "org.freedesktop.DBus.Property"

2468

".EmitsChangedSignal":

2469

"false"}

2470

2471

2331

@dbus.service.signal(_interface, signature="o")

2472

2332

def ClientAdded(self, objpath):

2473

2333

"D-Bus signal"

2564

2424

pickle.dump((clients, client_settings), stored_state)

2565

2425

os.rename(tempname, stored_state_path)

2566

2426

except (IOError, OSError) as e:

2427

logger.warning("Could not save persistent state: {0}"

2428

.format(e))

2567

2429

if not debug:

2568

2430

try:

2569

2431

os.remove(tempname)

2570

2432

except NameError:

2571

2433

pass

2572

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2573

logger.warning("Could not save persistent state: {0}"

2574

.format(os.strerror(e.errno)))

2575

else:

2576

logger.warning("Could not save persistent state:",

2577

exc_info=e)

2434

if e.errno not in set((errno.ENOENT, errno.EACCES,

2435

errno.EEXIST)):

2578

2436

raise e

2579

2437

2580

2438

# Delete all clients, and settings from config

2608

2466

service.port = tcp_server.socket.getsockname()[1]

2609

2467

if use_ipv6:

2610

2468

logger.info("Now listening on address %r, port %d,"

2611

" flowinfo %d, scope_id %d",

2612

*tcp_server.socket.getsockname())

2469

" flowinfo %d, scope_id %d"

2470

% tcp_server.socket.getsockname())

2613

2471

else: # IPv4

2614

logger.info("Now listening on address %r, port %d",

2615

*tcp_server.socket.getsockname())

2472

logger.info("Now listening on address %r, port %d"

2473

% tcp_server.socket.getsockname())

2616

2474

2617

2475

#service.interface = tcp_server.socket.getsockname()[3]

2618

2476

2621

2479

try:

2622

2480

service.activate()

2623

2481

except dbus.exceptions.DBusException as error:

2624

logger.critical("D-Bus Exception", exc_info=error)

2482

logger.critical("DBusException: %s", error)

2625

2483

cleanup()

2626

2484

sys.exit(1)

2627

2485

# End of Avahi example code

2634

2492

logger.debug("Starting main loop")

2635

2493

main_loop.run()

2636

2494

except AvahiError as error:

2637

logger.critical("Avahi Error", exc_info=error)

2495

logger.critical("AvahiError: %s", error)

2638

2496

cleanup()

2639

2497

sys.exit(1)

2640

2498

except KeyboardInterrupt: