/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at recompile
  • Date: 2012-02-26 11:47:19 UTC
  • mto: This revision was merged to the branch mainline in revision 561.
  • Revision ID: teddy@recompile.se-20120226114719-m3odq4s34ebt6hg8
Add facilities for D-Bus interface annotations and use them to mark
the old D-Bus interfaces as deprecated.

* mandos (dbus_interface_annotations): New decorator.
  (DBusObjectWithProperties._is_dbus_property): Removed.  All callers
                                                changed.
  (DBusObjectWithProperties._is_dbus_thing): New; generalized version
                                             of "_is_dbus_property".
  (DBusObjectWithProperties._get_all_dbus_properties): Removed.  All
                                                       callers
                                                       changed.
  (DBusObjectWithProperties._get_all_dbus_things): New; generalized
                                                   version of
                                                   "_get_all_dbus_properties".
  (DBusObjectWithProperties.Introspect): Also add interface
                                         annotation tags.
  (AlternateDBusNamesMetaclass.__new__): Also copy interface
                                         annotations.  Add
                                         "deprecated" annotation on
                                         old interface.
  (ClientDBus._foo): New interface annotation to mark non-compliance
                     with the standard property change signal
                     interface.
  (MandosDBusService): Inherit from DBusObjectWithProperties to get
                       interface annotation support.
  (MandosDBusService._foo): New interface annotation to mark
                            non-compliance with the standard property
                            change signal interface.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
 
66
import binascii
 
67
import tempfile
 
68
import itertools
66
69
 
67
70
import dbus
68
71
import dbus.service
73
76
import ctypes.util
74
77
import xml.dom.minidom
75
78
import inspect
 
79
import GnuPGInterface
76
80
 
77
81
try:
78
82
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
82
86
    except ImportError:
83
87
        SO_BINDTODEVICE = None
84
88
 
85
 
 
86
 
version = "1.4.1"
87
 
 
88
 
#logger = logging.getLogger('mandos')
89
 
logger = logging.Logger('mandos')
 
89
version = "1.5.3"
 
90
stored_state_file = "clients.pickle"
 
91
 
 
92
logger = logging.getLogger()
90
93
syslogger = (logging.handlers.SysLogHandler
91
94
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
95
              address = str("/dev/log")))
93
 
syslogger.setFormatter(logging.Formatter
94
 
                       ('Mandos [%(process)d]: %(levelname)s:'
95
 
                        ' %(message)s'))
96
 
logger.addHandler(syslogger)
97
 
 
98
 
console = logging.StreamHandler()
99
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
 
                                       ' %(levelname)s:'
101
 
                                       ' %(message)s'))
102
 
logger.addHandler(console)
 
96
 
 
97
try:
 
98
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
99
                      (ctypes.util.find_library("c"))
 
100
                      .if_nametoindex)
 
101
except (OSError, AttributeError):
 
102
    def if_nametoindex(interface):
 
103
        "Get an interface index the hard way, i.e. using fcntl()"
 
104
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
105
        with contextlib.closing(socket.socket()) as s:
 
106
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
107
                                struct.pack(str("16s16x"),
 
108
                                            interface))
 
109
        interface_index = struct.unpack(str("I"),
 
110
                                        ifreq[16:20])[0]
 
111
        return interface_index
 
112
 
 
113
 
 
114
def initlogger(debug, level=logging.WARNING):
 
115
    """init logger and add loglevel"""
 
116
    
 
117
    syslogger.setFormatter(logging.Formatter
 
118
                           ('Mandos [%(process)d]: %(levelname)s:'
 
119
                            ' %(message)s'))
 
120
    logger.addHandler(syslogger)
 
121
    
 
122
    if debug:
 
123
        console = logging.StreamHandler()
 
124
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
125
                                               ' [%(process)d]:'
 
126
                                               ' %(levelname)s:'
 
127
                                               ' %(message)s'))
 
128
        logger.addHandler(console)
 
129
    logger.setLevel(level)
 
130
 
 
131
 
 
132
class PGPError(Exception):
 
133
    """Exception if encryption/decryption fails"""
 
134
    pass
 
135
 
 
136
 
 
137
class PGPEngine(object):
 
138
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
139
    def __init__(self):
 
140
        self.gnupg = GnuPGInterface.GnuPG()
 
141
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
142
        self.gnupg = GnuPGInterface.GnuPG()
 
143
        self.gnupg.options.meta_interactive = False
 
144
        self.gnupg.options.homedir = self.tempdir
 
145
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
146
                                              '--quiet',
 
147
                                              '--no-use-agent'])
 
148
    
 
149
    def __enter__(self):
 
150
        return self
 
151
    
 
152
    def __exit__ (self, exc_type, exc_value, traceback):
 
153
        self._cleanup()
 
154
        return False
 
155
    
 
156
    def __del__(self):
 
157
        self._cleanup()
 
158
    
 
159
    def _cleanup(self):
 
160
        if self.tempdir is not None:
 
161
            # Delete contents of tempdir
 
162
            for root, dirs, files in os.walk(self.tempdir,
 
163
                                             topdown = False):
 
164
                for filename in files:
 
165
                    os.remove(os.path.join(root, filename))
 
166
                for dirname in dirs:
 
167
                    os.rmdir(os.path.join(root, dirname))
 
168
            # Remove tempdir
 
169
            os.rmdir(self.tempdir)
 
170
            self.tempdir = None
 
171
    
 
172
    def password_encode(self, password):
 
173
        # Passphrase can not be empty and can not contain newlines or
 
174
        # NUL bytes.  So we prefix it and hex encode it.
 
175
        return b"mandos" + binascii.hexlify(password)
 
176
    
 
177
    def encrypt(self, data, password):
 
178
        self.gnupg.passphrase = self.password_encode(password)
 
179
        with open(os.devnull, "w") as devnull:
 
180
            try:
 
181
                proc = self.gnupg.run(['--symmetric'],
 
182
                                      create_fhs=['stdin', 'stdout'],
 
183
                                      attach_fhs={'stderr': devnull})
 
184
                with contextlib.closing(proc.handles['stdin']) as f:
 
185
                    f.write(data)
 
186
                with contextlib.closing(proc.handles['stdout']) as f:
 
187
                    ciphertext = f.read()
 
188
                proc.wait()
 
189
            except IOError as e:
 
190
                raise PGPError(e)
 
191
        self.gnupg.passphrase = None
 
192
        return ciphertext
 
193
    
 
194
    def decrypt(self, data, password):
 
195
        self.gnupg.passphrase = self.password_encode(password)
 
196
        with open(os.devnull, "w") as devnull:
 
197
            try:
 
198
                proc = self.gnupg.run(['--decrypt'],
 
199
                                      create_fhs=['stdin', 'stdout'],
 
200
                                      attach_fhs={'stderr': devnull})
 
201
                with contextlib.closing(proc.handles['stdin']) as f:
 
202
                    f.write(data)
 
203
                with contextlib.closing(proc.handles['stdout']) as f:
 
204
                    decrypted_plaintext = f.read()
 
205
                proc.wait()
 
206
            except IOError as e:
 
207
                raise PGPError(e)
 
208
        self.gnupg.passphrase = None
 
209
        return decrypted_plaintext
 
210
 
 
211
 
103
212
 
104
213
class AvahiError(Exception):
105
214
    def __init__(self, value, *args, **kwargs):
164
273
                            .GetAlternativeServiceName(self.name))
165
274
        logger.info("Changing Zeroconf service name to %r ...",
166
275
                    self.name)
167
 
        syslogger.setFormatter(logging.Formatter
168
 
                               ('Mandos (%s) [%%(process)d]:'
169
 
                                ' %%(levelname)s: %%(message)s'
170
 
                                % self.name))
171
276
        self.remove()
172
277
        try:
173
278
            self.add()
193
298
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
299
        self.entry_group_state_changed_match = (
195
300
            self.group.connect_to_signal(
196
 
                'StateChanged', self .entry_group_state_changed))
 
301
                'StateChanged', self.entry_group_state_changed))
197
302
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
198
303
                     self.name, self.type)
199
304
        self.group.AddService(
225
330
            try:
226
331
                self.group.Free()
227
332
            except (dbus.exceptions.UnknownMethodException,
228
 
                    dbus.exceptions.DBusException) as e:
 
333
                    dbus.exceptions.DBusException):
229
334
                pass
230
335
            self.group = None
231
336
        self.remove()
265
370
                                 self.server_state_changed)
266
371
        self.server_state_changed(self.server.GetState())
267
372
 
 
373
class AvahiServiceToSyslog(AvahiService):
 
374
    def rename(self):
 
375
        """Add the new name to the syslog messages"""
 
376
        ret = AvahiService.rename(self)
 
377
        syslogger.setFormatter(logging.Formatter
 
378
                               ('Mandos (%s) [%%(process)d]:'
 
379
                                ' %%(levelname)s: %%(message)s'
 
380
                                % self.name))
 
381
        return ret
268
382
 
269
 
def _timedelta_to_milliseconds(td):
 
383
def timedelta_to_milliseconds(td):
270
384
    "Convert a datetime.timedelta() to milliseconds"
271
385
    return ((td.days * 24 * 60 * 60 * 1000)
272
386
            + (td.seconds * 1000)
276
390
    """A representation of a client host served by this server.
277
391
    
278
392
    Attributes:
279
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
393
    approved:   bool(); 'None' if not yet approved/disapproved
280
394
    approval_delay: datetime.timedelta(); Time to wait for approval
281
395
    approval_duration: datetime.timedelta(); Duration of one approval
282
396
    checker:    subprocess.Popen(); a running checker process used
289
403
                     instance %(name)s can be used in the command.
290
404
    checker_initiator_tag: a gobject event source tag, or None
291
405
    created:    datetime.datetime(); (UTC) object creation
 
406
    client_structure: Object describing what attributes a client has
 
407
                      and is used for storing the client at exit
292
408
    current_checker_command: string; current running checker_command
293
 
    disable_hook:  If set, called by disable() as disable_hook(self)
294
409
    disable_initiator_tag: a gobject event source tag, or None
295
410
    enabled:    bool()
296
411
    fingerprint: string (40 or 32 hexadecimal digits); used to
299
414
    interval:   datetime.timedelta(); How often to start a new checker
300
415
    last_approval_request: datetime.datetime(); (UTC) or None
301
416
    last_checked_ok: datetime.datetime(); (UTC) or None
302
 
    last_enabled: datetime.datetime(); (UTC)
 
417
    last_checker_status: integer between 0 and 255 reflecting exit
 
418
                         status of last checker. -1 reflects crashed
 
419
                         checker, -2 means no checker completed yet.
 
420
    last_enabled: datetime.datetime(); (UTC) or None
303
421
    name:       string; from the config file, used in log messages and
304
422
                        D-Bus identifiers
305
423
    secret:     bytestring; sent verbatim (over TLS) to client
306
424
    timeout:    datetime.timedelta(); How long from last_checked_ok
307
425
                                      until this client is disabled
308
 
    extended_timeout:   extra long timeout when password has been sent
 
426
    extended_timeout:   extra long timeout when secret has been sent
309
427
    runtime_expansions: Allowed attributes for runtime expansion.
310
428
    expires:    datetime.datetime(); time (UTC) when a client will be
311
429
                disabled, or None
315
433
                          "created", "enabled", "fingerprint",
316
434
                          "host", "interval", "last_checked_ok",
317
435
                          "last_enabled", "name", "timeout")
 
436
    client_defaults = { "timeout": "5m",
 
437
                        "extended_timeout": "15m",
 
438
                        "interval": "2m",
 
439
                        "checker": "fping -q -- %%(host)s",
 
440
                        "host": "",
 
441
                        "approval_delay": "0s",
 
442
                        "approval_duration": "1s",
 
443
                        "approved_by_default": "True",
 
444
                        "enabled": "True",
 
445
                        }
318
446
    
319
447
    def timeout_milliseconds(self):
320
448
        "Return the 'timeout' attribute in milliseconds"
321
 
        return _timedelta_to_milliseconds(self.timeout)
 
449
        return timedelta_to_milliseconds(self.timeout)
322
450
    
323
451
    def extended_timeout_milliseconds(self):
324
452
        "Return the 'extended_timeout' attribute in milliseconds"
325
 
        return _timedelta_to_milliseconds(self.extended_timeout)
 
453
        return timedelta_to_milliseconds(self.extended_timeout)
326
454
    
327
455
    def interval_milliseconds(self):
328
456
        "Return the 'interval' attribute in milliseconds"
329
 
        return _timedelta_to_milliseconds(self.interval)
 
457
        return timedelta_to_milliseconds(self.interval)
330
458
    
331
459
    def approval_delay_milliseconds(self):
332
 
        return _timedelta_to_milliseconds(self.approval_delay)
333
 
    
334
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
460
        return timedelta_to_milliseconds(self.approval_delay)
 
461
 
 
462
    @staticmethod
 
463
    def config_parser(config):
 
464
        """Construct a new dict of client settings of this form:
 
465
        { client_name: {setting_name: value, ...}, ...}
 
466
        with exceptions for any special settings as defined above.
 
467
        NOTE: Must be a pure function. Must return the same result
 
468
        value given the same arguments.
 
469
        """
 
470
        settings = {}
 
471
        for client_name in config.sections():
 
472
            section = dict(config.items(client_name))
 
473
            client = settings[client_name] = {}
 
474
            
 
475
            client["host"] = section["host"]
 
476
            # Reformat values from string types to Python types
 
477
            client["approved_by_default"] = config.getboolean(
 
478
                client_name, "approved_by_default")
 
479
            client["enabled"] = config.getboolean(client_name,
 
480
                                                  "enabled")
 
481
            
 
482
            client["fingerprint"] = (section["fingerprint"].upper()
 
483
                                     .replace(" ", ""))
 
484
            if "secret" in section:
 
485
                client["secret"] = section["secret"].decode("base64")
 
486
            elif "secfile" in section:
 
487
                with open(os.path.expanduser(os.path.expandvars
 
488
                                             (section["secfile"])),
 
489
                          "rb") as secfile:
 
490
                    client["secret"] = secfile.read()
 
491
            else:
 
492
                raise TypeError("No secret or secfile for section %s"
 
493
                                % section)
 
494
            client["timeout"] = string_to_delta(section["timeout"])
 
495
            client["extended_timeout"] = string_to_delta(
 
496
                section["extended_timeout"])
 
497
            client["interval"] = string_to_delta(section["interval"])
 
498
            client["approval_delay"] = string_to_delta(
 
499
                section["approval_delay"])
 
500
            client["approval_duration"] = string_to_delta(
 
501
                section["approval_duration"])
 
502
            client["checker_command"] = section["checker"]
 
503
            client["last_approval_request"] = None
 
504
            client["last_checked_ok"] = None
 
505
            client["last_checker_status"] = -2
 
506
        
 
507
        return settings
 
508
        
 
509
        
 
510
    def __init__(self, settings, name = None):
335
511
        """Note: the 'checker' key in 'config' sets the
336
512
        'checker_command' attribute and *not* the 'checker'
337
513
        attribute."""
338
514
        self.name = name
339
 
        if config is None:
340
 
            config = {}
 
515
        # adding all client settings
 
516
        for setting, value in settings.iteritems():
 
517
            setattr(self, setting, value)
 
518
        
 
519
        if self.enabled:
 
520
            if not hasattr(self, "last_enabled"):
 
521
                self.last_enabled = datetime.datetime.utcnow()
 
522
            if not hasattr(self, "expires"):
 
523
                self.expires = (datetime.datetime.utcnow()
 
524
                                + self.timeout)
 
525
        else:
 
526
            self.last_enabled = None
 
527
            self.expires = None
 
528
       
341
529
        logger.debug("Creating client %r", self.name)
342
530
        # Uppercase and remove spaces from fingerprint for later
343
531
        # comparison purposes with return value from the fingerprint()
344
532
        # function
345
 
        self.fingerprint = (config["fingerprint"].upper()
346
 
                            .replace(" ", ""))
347
533
        logger.debug("  Fingerprint: %s", self.fingerprint)
348
 
        if "secret" in config:
349
 
            self.secret = config["secret"].decode("base64")
350
 
        elif "secfile" in config:
351
 
            with open(os.path.expanduser(os.path.expandvars
352
 
                                         (config["secfile"])),
353
 
                      "rb") as secfile:
354
 
                self.secret = secfile.read()
355
 
        else:
356
 
            raise TypeError("No secret or secfile for client %s"
357
 
                            % self.name)
358
 
        self.host = config.get("host", "")
359
 
        self.created = datetime.datetime.utcnow()
360
 
        self.enabled = False
361
 
        self.last_approval_request = None
362
 
        self.last_enabled = None
363
 
        self.last_checked_ok = None
364
 
        self.timeout = string_to_delta(config["timeout"])
365
 
        self.extended_timeout = string_to_delta(config
366
 
                                                ["extended_timeout"])
367
 
        self.interval = string_to_delta(config["interval"])
368
 
        self.disable_hook = disable_hook
 
534
        self.created = settings.get("created",
 
535
                                    datetime.datetime.utcnow())
 
536
 
 
537
        # attributes specific for this server instance
369
538
        self.checker = None
370
539
        self.checker_initiator_tag = None
371
540
        self.disable_initiator_tag = None
372
 
        self.expires = None
373
541
        self.checker_callback_tag = None
374
 
        self.checker_command = config["checker"]
375
542
        self.current_checker_command = None
376
 
        self.last_connect = None
377
 
        self._approved = None
378
 
        self.approved_by_default = config.get("approved_by_default",
379
 
                                              True)
 
543
        self.approved = None
380
544
        self.approvals_pending = 0
381
 
        self.approval_delay = string_to_delta(
382
 
            config["approval_delay"])
383
 
        self.approval_duration = string_to_delta(
384
 
            config["approval_duration"])
385
545
        self.changedstate = (multiprocessing_manager
386
546
                             .Condition(multiprocessing_manager
387
547
                                        .Lock()))
 
548
        self.client_structure = [attr for attr in
 
549
                                 self.__dict__.iterkeys()
 
550
                                 if not attr.startswith("_")]
 
551
        self.client_structure.append("client_structure")
 
552
        
 
553
        for name, t in inspect.getmembers(type(self),
 
554
                                          lambda obj:
 
555
                                              isinstance(obj,
 
556
                                                         property)):
 
557
            if not name.startswith("_"):
 
558
                self.client_structure.append(name)
388
559
    
 
560
    # Send notice to process children that client state has changed
389
561
    def send_changedstate(self):
390
 
        self.changedstate.acquire()
391
 
        self.changedstate.notify_all()
392
 
        self.changedstate.release()
 
562
        with self.changedstate:
 
563
            self.changedstate.notify_all()
393
564
    
394
565
    def enable(self):
395
566
        """Start this client's checker and timeout hooks"""
397
568
            # Already enabled
398
569
            return
399
570
        self.send_changedstate()
400
 
        # Schedule a new checker to be started an 'interval' from now,
401
 
        # and every interval from then on.
402
 
        self.checker_initiator_tag = (gobject.timeout_add
403
 
                                      (self.interval_milliseconds(),
404
 
                                       self.start_checker))
405
 
        # Schedule a disable() when 'timeout' has passed
406
571
        self.expires = datetime.datetime.utcnow() + self.timeout
407
 
        self.disable_initiator_tag = (gobject.timeout_add
408
 
                                   (self.timeout_milliseconds(),
409
 
                                    self.disable))
410
572
        self.enabled = True
411
573
        self.last_enabled = datetime.datetime.utcnow()
412
 
        # Also start a new checker *right now*.
413
 
        self.start_checker()
 
574
        self.init_checker()
414
575
    
415
576
    def disable(self, quiet=True):
416
577
        """Disable this client."""
428
589
            gobject.source_remove(self.checker_initiator_tag)
429
590
            self.checker_initiator_tag = None
430
591
        self.stop_checker()
431
 
        if self.disable_hook:
432
 
            self.disable_hook(self)
433
592
        self.enabled = False
434
593
        # Do not run this again if called by a gobject.timeout_add
435
594
        return False
436
595
    
437
596
    def __del__(self):
438
 
        self.disable_hook = None
439
597
        self.disable()
440
598
    
 
599
    def init_checker(self):
 
600
        # Schedule a new checker to be started an 'interval' from now,
 
601
        # and every interval from then on.
 
602
        self.checker_initiator_tag = (gobject.timeout_add
 
603
                                      (self.interval_milliseconds(),
 
604
                                       self.start_checker))
 
605
        # Schedule a disable() when 'timeout' has passed
 
606
        self.disable_initiator_tag = (gobject.timeout_add
 
607
                                   (self.timeout_milliseconds(),
 
608
                                    self.disable))
 
609
        # Also start a new checker *right now*.
 
610
        self.start_checker()
 
611
    
441
612
    def checker_callback(self, pid, condition, command):
442
613
        """The checker has completed, so take appropriate actions."""
443
614
        self.checker_callback_tag = None
444
615
        self.checker = None
445
616
        if os.WIFEXITED(condition):
446
 
            exitstatus = os.WEXITSTATUS(condition)
447
 
            if exitstatus == 0:
 
617
            self.last_checker_status = os.WEXITSTATUS(condition)
 
618
            if self.last_checker_status == 0:
448
619
                logger.info("Checker for %(name)s succeeded",
449
620
                            vars(self))
450
621
                self.checked_ok()
452
623
                logger.info("Checker for %(name)s failed",
453
624
                            vars(self))
454
625
        else:
 
626
            self.last_checker_status = -1
455
627
            logger.warning("Checker for %(name)s crashed?",
456
628
                           vars(self))
457
629
    
458
 
    def checked_ok(self, timeout=None):
459
 
        """Bump up the timeout for this client.
460
 
        
461
 
        This should only be called when the client has been seen,
462
 
        alive and well.
463
 
        """
 
630
    def checked_ok(self):
 
631
        """Assert that the client has been seen, alive and well."""
 
632
        self.last_checked_ok = datetime.datetime.utcnow()
 
633
        self.last_checker_status = 0
 
634
        self.bump_timeout()
 
635
    
 
636
    def bump_timeout(self, timeout=None):
 
637
        """Bump up the timeout for this client."""
464
638
        if timeout is None:
465
639
            timeout = self.timeout
466
 
        self.last_checked_ok = datetime.datetime.utcnow()
467
640
        if self.disable_initiator_tag is not None:
468
641
            gobject.source_remove(self.disable_initiator_tag)
469
642
        if getattr(self, "enabled", False):
470
643
            self.disable_initiator_tag = (gobject.timeout_add
471
 
                                          (_timedelta_to_milliseconds
 
644
                                          (timedelta_to_milliseconds
472
645
                                           (timeout), self.disable))
473
646
            self.expires = datetime.datetime.utcnow() + timeout
474
647
    
599
772
    return decorator
600
773
 
601
774
 
 
775
def dbus_interface_annotations(dbus_interface):
 
776
    """Decorator for marking functions returning interface annotations.
 
777
    
 
778
    Usage:
 
779
    
 
780
    @dbus_interface_annotations("org.example.Interface")
 
781
    def _foo(self):  # Function name does not matter
 
782
        return {"org.freedesktop.DBus.Deprecated": "true",
 
783
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
784
                    "false"}
 
785
    """
 
786
    def decorator(func):
 
787
        func._dbus_is_interface = True
 
788
        func._dbus_interface = dbus_interface
 
789
        func._dbus_name = dbus_interface
 
790
        return func
 
791
    return decorator
 
792
 
 
793
 
602
794
class DBusPropertyException(dbus.exceptions.DBusException):
603
795
    """A base class for D-Bus property-related exceptions
604
796
    """
627
819
    """
628
820
    
629
821
    @staticmethod
630
 
    def _is_dbus_property(obj):
631
 
        return getattr(obj, "_dbus_is_property", False)
 
822
    def _is_dbus_thing(thing):
 
823
        """Returns a function testing if an attribute is a D-Bus thing
 
824
        
 
825
        If called like _is_dbus_thing("method") it returns a function
 
826
        suitable for use as predicate to inspect.getmembers().
 
827
        """
 
828
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
829
                                   False)
632
830
    
633
 
    def _get_all_dbus_properties(self):
 
831
    def _get_all_dbus_things(self, thing):
634
832
        """Returns a generator of (name, attribute) pairs
635
833
        """
636
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
834
        return ((athing.__get__(self)._dbus_name,
 
835
                 athing.__get__(self))
637
836
                for cls in self.__class__.__mro__
638
 
                for name, prop in
639
 
                inspect.getmembers(cls, self._is_dbus_property))
 
837
                for name, athing in
 
838
                inspect.getmembers(cls,
 
839
                                   self._is_dbus_thing(thing)))
640
840
    
641
841
    def _get_dbus_property(self, interface_name, property_name):
642
842
        """Returns a bound method if one exists which is a D-Bus
644
844
        """
645
845
        for cls in  self.__class__.__mro__:
646
846
            for name, value in (inspect.getmembers
647
 
                                (cls, self._is_dbus_property)):
 
847
                                (cls,
 
848
                                 self._is_dbus_thing("property"))):
648
849
                if (value._dbus_name == property_name
649
850
                    and value._dbus_interface == interface_name):
650
851
                    return value.__get__(self)
679
880
            # signatures other than "ay".
680
881
            if prop._dbus_signature != "ay":
681
882
                raise ValueError
682
 
            value = dbus.ByteArray(''.join(unichr(byte)
683
 
                                           for byte in value))
 
883
            value = dbus.ByteArray(b''.join(chr(byte)
 
884
                                            for byte in value))
684
885
        prop(value)
685
886
    
686
887
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
691
892
        
692
893
        Note: Will not include properties with access="write".
693
894
        """
694
 
        all = {}
695
 
        for name, prop in self._get_all_dbus_properties():
 
895
        properties = {}
 
896
        for name, prop in self._get_all_dbus_things("property"):
696
897
            if (interface_name
697
898
                and interface_name != prop._dbus_interface):
698
899
                # Interface non-empty but did not match
702
903
                continue
703
904
            value = prop()
704
905
            if not hasattr(value, "variant_level"):
705
 
                all[name] = value
 
906
                properties[name] = value
706
907
                continue
707
 
            all[name] = type(value)(value, variant_level=
708
 
                                    value.variant_level+1)
709
 
        return dbus.Dictionary(all, signature="sv")
 
908
            properties[name] = type(value)(value, variant_level=
 
909
                                           value.variant_level+1)
 
910
        return dbus.Dictionary(properties, signature="sv")
710
911
    
711
912
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
712
913
                         out_signature="s",
713
914
                         path_keyword='object_path',
714
915
                         connection_keyword='connection')
715
916
    def Introspect(self, object_path, connection):
716
 
        """Standard D-Bus method, overloaded to insert property tags.
 
917
        """Overloading of standard D-Bus method.
 
918
        
 
919
        Inserts property tags and interface annotation tags.
717
920
        """
718
921
        xmlstring = dbus.service.Object.Introspect(self, object_path,
719
922
                                                   connection)
726
929
                e.setAttribute("access", prop._dbus_access)
727
930
                return e
728
931
            for if_tag in document.getElementsByTagName("interface"):
 
932
                # Add property tags
729
933
                for tag in (make_tag(document, name, prop)
730
934
                            for name, prop
731
 
                            in self._get_all_dbus_properties()
 
935
                            in self._get_all_dbus_things("property")
732
936
                            if prop._dbus_interface
733
937
                            == if_tag.getAttribute("name")):
734
938
                    if_tag.appendChild(tag)
 
939
                # Add interface annotation tags
 
940
                for annotation, value in dict(
 
941
                    itertools.chain(
 
942
                        *(annotations().iteritems()
 
943
                          for name, annotations in
 
944
                          self._get_all_dbus_things("interface")
 
945
                          if name == if_tag.getAttribute("name")
 
946
                          ))).iteritems():
 
947
                    attr_tag = document.createElement("annotation")
 
948
                    attr_tag.setAttribute("name", annotation)
 
949
                    attr_tag.setAttribute("value", value)
 
950
                    if_tag.appendChild(attr_tag)
735
951
                # Add the names to the return values for the
736
952
                # "org.freedesktop.DBus.Properties" methods
737
953
                if (if_tag.getAttribute("name")
763
979
    return dbus.String(dt.isoformat(),
764
980
                       variant_level=variant_level)
765
981
 
 
982
 
766
983
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
767
984
                                  .__metaclass__):
768
985
    """Applied to an empty subclass of a D-Bus object, this metaclass
771
988
    def __new__(mcs, name, bases, attr):
772
989
        # Go through all the base classes which could have D-Bus
773
990
        # methods, signals, or properties in them
 
991
        old_interface_names = []
774
992
        for base in (b for b in bases
775
993
                     if issubclass(b, dbus.service.Object)):
776
994
            # Go though all attributes of the base class
786
1004
                alt_interface = (attribute._dbus_interface
787
1005
                                 .replace("se.recompile.Mandos",
788
1006
                                          "se.bsnet.fukt.Mandos"))
 
1007
                if alt_interface != attribute._dbus_interface:
 
1008
                    old_interface_names.append(alt_interface)
789
1009
                # Is this a D-Bus signal?
790
1010
                if getattr(attribute, "_dbus_is_signal", False):
791
1011
                    # Extract the original non-method function by
858
1078
                                        attribute.func_name,
859
1079
                                        attribute.func_defaults,
860
1080
                                        attribute.func_closure)))
 
1081
                # Is this a D-Bus interface?
 
1082
                elif getattr(attribute, "_dbus_is_interface", False):
 
1083
                    # Create a new, but exactly alike, function
 
1084
                    # object.  Decorate it to be a new D-Bus interface
 
1085
                    # with the alternate D-Bus interface name.  Add it
 
1086
                    # to the class.
 
1087
                    attr[attrname] = (dbus_interface_annotations
 
1088
                                      (alt_interface)
 
1089
                                      (types.FunctionType
 
1090
                                       (attribute.func_code,
 
1091
                                        attribute.func_globals,
 
1092
                                        attribute.func_name,
 
1093
                                        attribute.func_defaults,
 
1094
                                        attribute.func_closure)))
 
1095
        # Deprecate all old interfaces
 
1096
        basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"
 
1097
        for old_interface_name in old_interface_names:
 
1098
            @dbus_interface_annotations(old_interface_name)
 
1099
            def func(self):
 
1100
                return { "org.freedesktop.DBus.Deprecated": "true" }
 
1101
            # Find an unused name
 
1102
            for aname in (basename.format(i) for i in
 
1103
                          itertools.count()):
 
1104
                if aname not in attr:
 
1105
                    attr[aname] = func
 
1106
                    break
861
1107
        return type.__new__(mcs, name, bases, attr)
862
1108
 
 
1109
 
863
1110
class ClientDBus(Client, DBusObjectWithProperties):
864
1111
    """A Client class using D-Bus
865
1112
    
874
1121
    # dbus.service.Object doesn't use super(), so we can't either.
875
1122
    
876
1123
    def __init__(self, bus = None, *args, **kwargs):
877
 
        self._approvals_pending = 0
878
1124
        self.bus = bus
879
1125
        Client.__init__(self, *args, **kwargs)
880
1126
        # Only now, when this client is initialized, can it show up on
892
1138
                             variant_level=1):
893
1139
        """ Modify a variable so that it's a property which announces
894
1140
        its changes to DBus.
895
 
 
 
1141
        
896
1142
        transform_fun: Function that takes a value and a variant_level
897
1143
                       and transforms it to a D-Bus type.
898
1144
        dbus_name: D-Bus name of the variable
928
1174
                                       checker is not None)
929
1175
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
930
1176
                                           "LastCheckedOK")
 
1177
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1178
                                               "LastCheckerStatus")
931
1179
    last_approval_request = notifychangeproperty(
932
1180
        datetime_to_dbus, "LastApprovalRequest")
933
1181
    approved_by_default = notifychangeproperty(dbus.Boolean,
934
1182
                                               "ApprovedByDefault")
935
 
    approval_delay = notifychangeproperty(dbus.UInt16,
 
1183
    approval_delay = notifychangeproperty(dbus.UInt64,
936
1184
                                          "ApprovalDelay",
937
1185
                                          type_func =
938
 
                                          _timedelta_to_milliseconds)
 
1186
                                          timedelta_to_milliseconds)
939
1187
    approval_duration = notifychangeproperty(
940
 
        dbus.UInt16, "ApprovalDuration",
941
 
        type_func = _timedelta_to_milliseconds)
 
1188
        dbus.UInt64, "ApprovalDuration",
 
1189
        type_func = timedelta_to_milliseconds)
942
1190
    host = notifychangeproperty(dbus.String, "Host")
943
 
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
 
1191
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
944
1192
                                   type_func =
945
 
                                   _timedelta_to_milliseconds)
 
1193
                                   timedelta_to_milliseconds)
946
1194
    extended_timeout = notifychangeproperty(
947
 
        dbus.UInt16, "ExtendedTimeout",
948
 
        type_func = _timedelta_to_milliseconds)
949
 
    interval = notifychangeproperty(dbus.UInt16,
 
1195
        dbus.UInt64, "ExtendedTimeout",
 
1196
        type_func = timedelta_to_milliseconds)
 
1197
    interval = notifychangeproperty(dbus.UInt64,
950
1198
                                    "Interval",
951
1199
                                    type_func =
952
 
                                    _timedelta_to_milliseconds)
 
1200
                                    timedelta_to_milliseconds)
953
1201
    checker_command = notifychangeproperty(dbus.String, "Checker")
954
1202
    
955
1203
    del notifychangeproperty
997
1245
        return r
998
1246
    
999
1247
    def _reset_approved(self):
1000
 
        self._approved = None
 
1248
        self.approved = None
1001
1249
        return False
1002
1250
    
1003
1251
    def approve(self, value=True):
1004
1252
        self.send_changedstate()
1005
 
        self._approved = value
1006
 
        gobject.timeout_add(_timedelta_to_milliseconds
 
1253
        self.approved = value
 
1254
        gobject.timeout_add(timedelta_to_milliseconds
1007
1255
                            (self.approval_duration),
1008
1256
                            self._reset_approved)
1009
1257
    
1011
1259
    ## D-Bus methods, signals & properties
1012
1260
    _interface = "se.recompile.Mandos.Client"
1013
1261
    
 
1262
    ## Interfaces
 
1263
    
 
1264
    @dbus_interface_annotations(_interface)
 
1265
    def _foo(self):
 
1266
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1267
                     "false"}
 
1268
    
1014
1269
    ## Signals
1015
1270
    
1016
1271
    # CheckerCompleted - signal
1115
1370
                           access="readwrite")
1116
1371
    def ApprovalDuration_dbus_property(self, value=None):
1117
1372
        if value is None:       # get
1118
 
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1373
            return dbus.UInt64(timedelta_to_milliseconds(
1119
1374
                    self.approval_duration))
1120
1375
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1121
1376
    
1135
1390
    def Host_dbus_property(self, value=None):
1136
1391
        if value is None:       # get
1137
1392
            return dbus.String(self.host)
1138
 
        self.host = value
 
1393
        self.host = unicode(value)
1139
1394
    
1140
1395
    # Created - property
1141
1396
    @dbus_service_property(_interface, signature="s", access="read")
1142
1397
    def Created_dbus_property(self):
1143
 
        return dbus.String(datetime_to_dbus(self.created))
 
1398
        return datetime_to_dbus(self.created)
1144
1399
    
1145
1400
    # LastEnabled - property
1146
1401
    @dbus_service_property(_interface, signature="s", access="read")
1167
1422
            return
1168
1423
        return datetime_to_dbus(self.last_checked_ok)
1169
1424
    
 
1425
    # LastCheckerStatus - property
 
1426
    @dbus_service_property(_interface, signature="n",
 
1427
                           access="read")
 
1428
    def LastCheckerStatus_dbus_property(self):
 
1429
        return dbus.Int16(self.last_checker_status)
 
1430
    
1170
1431
    # Expires - property
1171
1432
    @dbus_service_property(_interface, signature="s", access="read")
1172
1433
    def Expires_dbus_property(self):
1184
1445
        if value is None:       # get
1185
1446
            return dbus.UInt64(self.timeout_milliseconds())
1186
1447
        self.timeout = datetime.timedelta(0, 0, 0, value)
1187
 
        if getattr(self, "disable_initiator_tag", None) is None:
1188
 
            return
1189
1448
        # Reschedule timeout
1190
 
        gobject.source_remove(self.disable_initiator_tag)
1191
 
        self.disable_initiator_tag = None
1192
 
        self.expires = None
1193
 
        time_to_die = _timedelta_to_milliseconds((self
1194
 
                                                  .last_checked_ok
1195
 
                                                  + self.timeout)
1196
 
                                                 - datetime.datetime
1197
 
                                                 .utcnow())
1198
 
        if time_to_die <= 0:
1199
 
            # The timeout has passed
1200
 
            self.disable()
1201
 
        else:
1202
 
            self.expires = (datetime.datetime.utcnow()
1203
 
                            + datetime.timedelta(milliseconds =
1204
 
                                                 time_to_die))
1205
 
            self.disable_initiator_tag = (gobject.timeout_add
1206
 
                                          (time_to_die, self.disable))
 
1449
        if self.enabled:
 
1450
            now = datetime.datetime.utcnow()
 
1451
            time_to_die = timedelta_to_milliseconds(
 
1452
                (self.last_checked_ok + self.timeout) - now)
 
1453
            if time_to_die <= 0:
 
1454
                # The timeout has passed
 
1455
                self.disable()
 
1456
            else:
 
1457
                self.expires = (now +
 
1458
                                datetime.timedelta(milliseconds =
 
1459
                                                   time_to_die))
 
1460
                if (getattr(self, "disable_initiator_tag", None)
 
1461
                    is None):
 
1462
                    return
 
1463
                gobject.source_remove(self.disable_initiator_tag)
 
1464
                self.disable_initiator_tag = (gobject.timeout_add
 
1465
                                              (time_to_die,
 
1466
                                               self.disable))
1207
1467
    
1208
1468
    # ExtendedTimeout - property
1209
1469
    @dbus_service_property(_interface, signature="t",
1222
1482
        self.interval = datetime.timedelta(0, 0, 0, value)
1223
1483
        if getattr(self, "checker_initiator_tag", None) is None:
1224
1484
            return
1225
 
        # Reschedule checker run
1226
 
        gobject.source_remove(self.checker_initiator_tag)
1227
 
        self.checker_initiator_tag = (gobject.timeout_add
1228
 
                                      (value, self.start_checker))
1229
 
        self.start_checker()    # Start one now, too
 
1485
        if self.enabled:
 
1486
            # Reschedule checker run
 
1487
            gobject.source_remove(self.checker_initiator_tag)
 
1488
            self.checker_initiator_tag = (gobject.timeout_add
 
1489
                                          (value, self.start_checker))
 
1490
            self.start_checker()    # Start one now, too
1230
1491
    
1231
1492
    # Checker - property
1232
1493
    @dbus_service_property(_interface, signature="s",
1234
1495
    def Checker_dbus_property(self, value=None):
1235
1496
        if value is None:       # get
1236
1497
            return dbus.String(self.checker_command)
1237
 
        self.checker_command = value
 
1498
        self.checker_command = unicode(value)
1238
1499
    
1239
1500
    # CheckerRunning - property
1240
1501
    @dbus_service_property(_interface, signature="b",
1269
1530
            raise KeyError()
1270
1531
    
1271
1532
    def __getattribute__(self, name):
1272
 
        if(name == '_pipe'):
 
1533
        if name == '_pipe':
1273
1534
            return super(ProxyClient, self).__getattribute__(name)
1274
1535
        self._pipe.send(('getattr', name))
1275
1536
        data = self._pipe.recv()
1282
1543
            return func
1283
1544
    
1284
1545
    def __setattr__(self, name, value):
1285
 
        if(name == '_pipe'):
 
1546
        if name == '_pipe':
1286
1547
            return super(ProxyClient, self).__setattr__(name, value)
1287
1548
        self._pipe.send(('setattr', name, value))
1288
1549
 
 
1550
 
1289
1551
class ClientDBusTransitional(ClientDBus):
1290
1552
    __metaclass__ = AlternateDBusNamesMetaclass
1291
1553
 
 
1554
 
1292
1555
class ClientHandler(socketserver.BaseRequestHandler, object):
1293
1556
    """A class to handle client connections.
1294
1557
    
1376
1639
                            client.Rejected("Disabled")
1377
1640
                        return
1378
1641
                    
1379
 
                    if client._approved or not client.approval_delay:
 
1642
                    if client.approved or not client.approval_delay:
1380
1643
                        #We are approved or approval is disabled
1381
1644
                        break
1382
 
                    elif client._approved is None:
 
1645
                    elif client.approved is None:
1383
1646
                        logger.info("Client %s needs approval",
1384
1647
                                    client.name)
1385
1648
                        if self.server.use_dbus:
1399
1662
                    time = datetime.datetime.now()
1400
1663
                    client.changedstate.acquire()
1401
1664
                    (client.changedstate.wait
1402
 
                     (float(client._timedelta_to_milliseconds(delay)
 
1665
                     (float(client.timedelta_to_milliseconds(delay)
1403
1666
                            / 1000)))
1404
1667
                    client.changedstate.release()
1405
1668
                    time2 = datetime.datetime.now()
1431
1694
                
1432
1695
                logger.info("Sending secret to %s", client.name)
1433
1696
                # bump the timeout using extended_timeout
1434
 
                client.checked_ok(client.extended_timeout)
 
1697
                client.bump_timeout(client.extended_timeout)
1435
1698
                if self.server.use_dbus:
1436
1699
                    # Emit D-Bus signal
1437
1700
                    client.GotSecret()
1504
1767
        # Convert the buffer to a Python bytestring
1505
1768
        fpr = ctypes.string_at(buf, buf_len.value)
1506
1769
        # Convert the bytestring to hexadecimal notation
1507
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1770
        hex_fpr = binascii.hexlify(fpr).upper()
1508
1771
        return hex_fpr
1509
1772
 
1510
1773
 
1513
1776
    def sub_process_main(self, request, address):
1514
1777
        try:
1515
1778
            self.finish_request(request, address)
1516
 
        except:
 
1779
        except Exception:
1517
1780
            self.handle_error(request, address)
1518
1781
        self.close_request(request)
1519
1782
    
1624
1887
        self.enabled = False
1625
1888
        self.clients = clients
1626
1889
        if self.clients is None:
1627
 
            self.clients = set()
 
1890
            self.clients = {}
1628
1891
        self.use_dbus = use_dbus
1629
1892
        self.gnutls_priority = gnutls_priority
1630
1893
        IPv6_TCPServer.__init__(self, server_address,
1677
1940
            fpr = request[1]
1678
1941
            address = request[2]
1679
1942
            
1680
 
            for c in self.clients:
 
1943
            for c in self.clients.itervalues():
1681
1944
                if c.fingerprint == fpr:
1682
1945
                    client = c
1683
1946
                    break
1767
2030
    return timevalue
1768
2031
 
1769
2032
 
1770
 
def if_nametoindex(interface):
1771
 
    """Call the C function if_nametoindex(), or equivalent
1772
 
    
1773
 
    Note: This function cannot accept a unicode string."""
1774
 
    global if_nametoindex
1775
 
    try:
1776
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1777
 
                          (ctypes.util.find_library("c"))
1778
 
                          .if_nametoindex)
1779
 
    except (OSError, AttributeError):
1780
 
        logger.warning("Doing if_nametoindex the hard way")
1781
 
        def if_nametoindex(interface):
1782
 
            "Get an interface index the hard way, i.e. using fcntl()"
1783
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1784
 
            with contextlib.closing(socket.socket()) as s:
1785
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
 
                                    struct.pack(str("16s16x"),
1787
 
                                                interface))
1788
 
            interface_index = struct.unpack(str("I"),
1789
 
                                            ifreq[16:20])[0]
1790
 
            return interface_index
1791
 
    return if_nametoindex(interface)
1792
 
 
1793
 
 
1794
2033
def daemon(nochdir = False, noclose = False):
1795
2034
    """See daemon(3).  Standard BSD Unix function.
1796
2035
    
1804
2043
        sys.exit()
1805
2044
    if not noclose:
1806
2045
        # Close all standard open file descriptors
1807
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2046
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1808
2047
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1809
2048
            raise OSError(errno.ENODEV,
1810
2049
                          "%s not a character device"
1811
 
                          % os.path.devnull)
 
2050
                          % os.devnull)
1812
2051
        os.dup2(null, sys.stdin.fileno())
1813
2052
        os.dup2(null, sys.stdout.fileno())
1814
2053
        os.dup2(null, sys.stderr.fileno())
1851
2090
                        " system bus interface")
1852
2091
    parser.add_argument("--no-ipv6", action="store_false",
1853
2092
                        dest="use_ipv6", help="Do not use IPv6")
 
2093
    parser.add_argument("--no-restore", action="store_false",
 
2094
                        dest="restore", help="Do not restore stored"
 
2095
                        " state")
 
2096
    parser.add_argument("--statedir", metavar="DIR",
 
2097
                        help="Directory to save/restore state in")
 
2098
    
1854
2099
    options = parser.parse_args()
1855
2100
    
1856
2101
    if options.check:
1869
2114
                        "use_dbus": "True",
1870
2115
                        "use_ipv6": "True",
1871
2116
                        "debuglevel": "",
 
2117
                        "restore": "True",
 
2118
                        "statedir": "/var/lib/mandos"
1872
2119
                        }
1873
2120
    
1874
2121
    # Parse config file for server-global settings
1891
2138
    # options, if set.
1892
2139
    for option in ("interface", "address", "port", "debug",
1893
2140
                   "priority", "servicename", "configdir",
1894
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2141
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2142
                   "statedir"):
1895
2143
        value = getattr(options, option)
1896
2144
        if value is not None:
1897
2145
            server_settings[option] = value
1909
2157
    debuglevel = server_settings["debuglevel"]
1910
2158
    use_dbus = server_settings["use_dbus"]
1911
2159
    use_ipv6 = server_settings["use_ipv6"]
 
2160
    stored_state_path = os.path.join(server_settings["statedir"],
 
2161
                                     stored_state_file)
 
2162
    
 
2163
    if debug:
 
2164
        initlogger(debug, logging.DEBUG)
 
2165
    else:
 
2166
        if not debuglevel:
 
2167
            initlogger(debug)
 
2168
        else:
 
2169
            level = getattr(logging, debuglevel.upper())
 
2170
            initlogger(debug, level)
1912
2171
    
1913
2172
    if server_settings["servicename"] != "Mandos":
1914
2173
        syslogger.setFormatter(logging.Formatter
1917
2176
                                % server_settings["servicename"]))
1918
2177
    
1919
2178
    # Parse config file with clients
1920
 
    client_defaults = { "timeout": "5m",
1921
 
                        "extended_timeout": "15m",
1922
 
                        "interval": "2m",
1923
 
                        "checker": "fping -q -- %%(host)s",
1924
 
                        "host": "",
1925
 
                        "approval_delay": "0s",
1926
 
                        "approval_duration": "1s",
1927
 
                        }
1928
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2179
    client_config = configparser.SafeConfigParser(Client
 
2180
                                                  .client_defaults)
1929
2181
    client_config.read(os.path.join(server_settings["configdir"],
1930
2182
                                    "clients.conf"))
1931
2183
    
1969
2221
        if error[0] != errno.EPERM:
1970
2222
            raise error
1971
2223
    
1972
 
    if not debug and not debuglevel:
1973
 
        syslogger.setLevel(logging.WARNING)
1974
 
        console.setLevel(logging.WARNING)
1975
 
    if debuglevel:
1976
 
        level = getattr(logging, debuglevel.upper())
1977
 
        syslogger.setLevel(level)
1978
 
        console.setLevel(level)
1979
 
    
1980
2224
    if debug:
1981
2225
        # Enable all possible GnuTLS debugging
1982
2226
        
1992
2236
         .gnutls_global_set_log_function(debug_gnutls))
1993
2237
        
1994
2238
        # Redirect stdin so all checkers get /dev/null
1995
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2239
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1996
2240
        os.dup2(null, sys.stdin.fileno())
1997
2241
        if null > 2:
1998
2242
            os.close(null)
1999
 
    else:
2000
 
        # No console logging
2001
 
        logger.removeHandler(console)
2002
2243
    
2003
2244
    # Need to fork before connecting to D-Bus
2004
2245
    if not debug:
2005
2246
        # Close all input and output, do double fork, etc.
2006
2247
        daemon()
2007
2248
    
 
2249
    gobject.threads_init()
 
2250
    
2008
2251
    global main_loop
2009
2252
    # From the Avahi example code
2010
 
    DBusGMainLoop(set_as_default=True )
 
2253
    DBusGMainLoop(set_as_default=True)
2011
2254
    main_loop = gobject.MainLoop()
2012
2255
    bus = dbus.SystemBus()
2013
2256
    # End of Avahi example code
2024
2267
            server_settings["use_dbus"] = False
2025
2268
            tcp_server.use_dbus = False
2026
2269
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2027
 
    service = AvahiService(name = server_settings["servicename"],
2028
 
                           servicetype = "_mandos._tcp",
2029
 
                           protocol = protocol, bus = bus)
 
2270
    service = AvahiServiceToSyslog(name =
 
2271
                                   server_settings["servicename"],
 
2272
                                   servicetype = "_mandos._tcp",
 
2273
                                   protocol = protocol, bus = bus)
2030
2274
    if server_settings["interface"]:
2031
2275
        service.interface = (if_nametoindex
2032
2276
                             (str(server_settings["interface"])))
2038
2282
    if use_dbus:
2039
2283
        client_class = functools.partial(ClientDBusTransitional,
2040
2284
                                         bus = bus)
2041
 
    def client_config_items(config, section):
2042
 
        special_settings = {
2043
 
            "approved_by_default":
2044
 
                lambda: config.getboolean(section,
2045
 
                                          "approved_by_default"),
2046
 
            }
2047
 
        for name, value in config.items(section):
 
2285
    
 
2286
    client_settings = Client.config_parser(client_config)
 
2287
    old_client_settings = {}
 
2288
    clients_data = {}
 
2289
    
 
2290
    # Get client data and settings from last running state.
 
2291
    if server_settings["restore"]:
 
2292
        try:
 
2293
            with open(stored_state_path, "rb") as stored_state:
 
2294
                clients_data, old_client_settings = (pickle.load
 
2295
                                                     (stored_state))
 
2296
            os.remove(stored_state_path)
 
2297
        except IOError as e:
 
2298
            logger.warning("Could not load persistent state: {0}"
 
2299
                           .format(e))
 
2300
            if e.errno != errno.ENOENT:
 
2301
                raise
 
2302
        except EOFError as e:
 
2303
            logger.warning("Could not load persistent state: "
 
2304
                           "EOFError: {0}".format(e))
 
2305
    
 
2306
    with PGPEngine() as pgp:
 
2307
        for client_name, client in clients_data.iteritems():
 
2308
            # Decide which value to use after restoring saved state.
 
2309
            # We have three different values: Old config file,
 
2310
            # new config file, and saved state.
 
2311
            # New config value takes precedence if it differs from old
 
2312
            # config value, otherwise use saved state.
 
2313
            for name, value in client_settings[client_name].items():
 
2314
                try:
 
2315
                    # For each value in new config, check if it
 
2316
                    # differs from the old config value (Except for
 
2317
                    # the "secret" attribute)
 
2318
                    if (name != "secret" and
 
2319
                        value != old_client_settings[client_name]
 
2320
                        [name]):
 
2321
                        client[name] = value
 
2322
                except KeyError:
 
2323
                    pass
 
2324
            
 
2325
            # Clients who has passed its expire date can still be
 
2326
            # enabled if its last checker was successful.  Clients
 
2327
            # whose checker succeeded before we stored its state is
 
2328
            # assumed to have successfully run all checkers during
 
2329
            # downtime.
 
2330
            if client["enabled"]:
 
2331
                if datetime.datetime.utcnow() >= client["expires"]:
 
2332
                    if not client["last_checked_ok"]:
 
2333
                        logger.warning(
 
2334
                            "disabling client {0} - Client never "
 
2335
                            "performed a successful checker"
 
2336
                            .format(client_name))
 
2337
                        client["enabled"] = False
 
2338
                    elif client["last_checker_status"] != 0:
 
2339
                        logger.warning(
 
2340
                            "disabling client {0} - Client "
 
2341
                            "last checker failed with error code {1}"
 
2342
                            .format(client_name,
 
2343
                                    client["last_checker_status"]))
 
2344
                        client["enabled"] = False
 
2345
                    else:
 
2346
                        client["expires"] = (datetime.datetime
 
2347
                                             .utcnow()
 
2348
                                             + client["timeout"])
 
2349
                        logger.debug("Last checker succeeded,"
 
2350
                                     " keeping {0} enabled"
 
2351
                                     .format(client_name))
2048
2352
            try:
2049
 
                yield (name, special_settings[name]())
2050
 
            except KeyError:
2051
 
                yield (name, value)
2052
 
    
2053
 
    tcp_server.clients.update(set(
2054
 
            client_class(name = section,
2055
 
                         config= dict(client_config_items(
2056
 
                        client_config, section)))
2057
 
            for section in client_config.sections()))
 
2353
                client["secret"] = (
 
2354
                    pgp.decrypt(client["encrypted_secret"],
 
2355
                                client_settings[client_name]
 
2356
                                ["secret"]))
 
2357
            except PGPError:
 
2358
                # If decryption fails, we use secret from new settings
 
2359
                logger.debug("Failed to decrypt {0} old secret"
 
2360
                             .format(client_name))
 
2361
                client["secret"] = (
 
2362
                    client_settings[client_name]["secret"])
 
2363
 
 
2364
    
 
2365
    # Add/remove clients based on new changes made to config
 
2366
    for client_name in (set(old_client_settings)
 
2367
                        - set(client_settings)):
 
2368
        del clients_data[client_name]
 
2369
    for client_name in (set(client_settings)
 
2370
                        - set(old_client_settings)):
 
2371
        clients_data[client_name] = client_settings[client_name]
 
2372
 
 
2373
    # Create all client objects
 
2374
    for client_name, client in clients_data.iteritems():
 
2375
        tcp_server.clients[client_name] = client_class(
 
2376
            name = client_name, settings = client)
 
2377
    
2058
2378
    if not tcp_server.clients:
2059
2379
        logger.warning("No clients defined")
2060
2380
        
2071
2391
            # "pidfile" was never created
2072
2392
            pass
2073
2393
        del pidfilename
2074
 
        
2075
2394
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2076
2395
    
2077
2396
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2078
2397
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2079
2398
    
2080
2399
    if use_dbus:
2081
 
        class MandosDBusService(dbus.service.Object):
 
2400
        class MandosDBusService(DBusObjectWithProperties):
2082
2401
            """A D-Bus proxy object"""
2083
2402
            def __init__(self):
2084
2403
                dbus.service.Object.__init__(self, bus, "/")
2085
2404
            _interface = "se.recompile.Mandos"
2086
2405
            
 
2406
            @dbus_interface_annotations(_interface)
 
2407
            def _foo(self):
 
2408
                return { "org.freedesktop.DBus.Property"
 
2409
                         ".EmitsChangedSignal":
 
2410
                             "false"}
 
2411
            
2087
2412
            @dbus.service.signal(_interface, signature="o")
2088
2413
            def ClientAdded(self, objpath):
2089
2414
                "D-Bus signal"
2103
2428
            def GetAllClients(self):
2104
2429
                "D-Bus method"
2105
2430
                return dbus.Array(c.dbus_object_path
2106
 
                                  for c in tcp_server.clients)
 
2431
                                  for c in
 
2432
                                  tcp_server.clients.itervalues())
2107
2433
            
2108
2434
            @dbus.service.method(_interface,
2109
2435
                                 out_signature="a{oa{sv}}")
2111
2437
                "D-Bus method"
2112
2438
                return dbus.Dictionary(
2113
2439
                    ((c.dbus_object_path, c.GetAll(""))
2114
 
                     for c in tcp_server.clients),
 
2440
                     for c in tcp_server.clients.itervalues()),
2115
2441
                    signature="oa{sv}")
2116
2442
            
2117
2443
            @dbus.service.method(_interface, in_signature="o")
2118
2444
            def RemoveClient(self, object_path):
2119
2445
                "D-Bus method"
2120
 
                for c in tcp_server.clients:
 
2446
                for c in tcp_server.clients.itervalues():
2121
2447
                    if c.dbus_object_path == object_path:
2122
 
                        tcp_server.clients.remove(c)
 
2448
                        del tcp_server.clients[c.name]
2123
2449
                        c.remove_from_connection()
2124
2450
                        # Don't signal anything except ClientRemoved
2125
2451
                        c.disable(quiet=True)
2139
2465
        service.cleanup()
2140
2466
        
2141
2467
        multiprocessing.active_children()
 
2468
        if not (tcp_server.clients or client_settings):
 
2469
            return
 
2470
        
 
2471
        # Store client before exiting. Secrets are encrypted with key
 
2472
        # based on what config file has. If config file is
 
2473
        # removed/edited, old secret will thus be unrecovable.
 
2474
        clients = {}
 
2475
        with PGPEngine() as pgp:
 
2476
            for client in tcp_server.clients.itervalues():
 
2477
                key = client_settings[client.name]["secret"]
 
2478
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2479
                                                      key)
 
2480
                client_dict = {}
 
2481
                
 
2482
                # A list of attributes that can not be pickled
 
2483
                # + secret.
 
2484
                exclude = set(("bus", "changedstate", "secret",
 
2485
                               "checker"))
 
2486
                for name, typ in (inspect.getmembers
 
2487
                                  (dbus.service.Object)):
 
2488
                    exclude.add(name)
 
2489
                
 
2490
                client_dict["encrypted_secret"] = (client
 
2491
                                                   .encrypted_secret)
 
2492
                for attr in client.client_structure:
 
2493
                    if attr not in exclude:
 
2494
                        client_dict[attr] = getattr(client, attr)
 
2495
                
 
2496
                clients[client.name] = client_dict
 
2497
                del client_settings[client.name]["secret"]
 
2498
        
 
2499
        try:
 
2500
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2501
                                                prefix="clients-",
 
2502
                                                dir=os.path.dirname
 
2503
                                                (stored_state_path))
 
2504
            with os.fdopen(tempfd, "wb") as stored_state:
 
2505
                pickle.dump((clients, client_settings), stored_state)
 
2506
            os.rename(tempname, stored_state_path)
 
2507
        except (IOError, OSError) as e:
 
2508
            logger.warning("Could not save persistent state: {0}"
 
2509
                           .format(e))
 
2510
            if not debug:
 
2511
                try:
 
2512
                    os.remove(tempname)
 
2513
                except NameError:
 
2514
                    pass
 
2515
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2516
                                   errno.EEXIST)):
 
2517
                raise e
 
2518
        
 
2519
        # Delete all clients, and settings from config
2142
2520
        while tcp_server.clients:
2143
 
            client = tcp_server.clients.pop()
 
2521
            name, client = tcp_server.clients.popitem()
2144
2522
            if use_dbus:
2145
2523
                client.remove_from_connection()
2146
 
            client.disable_hook = None
2147
2524
            # Don't signal anything except ClientRemoved
2148
2525
            client.disable(quiet=True)
2149
2526
            if use_dbus:
2151
2528
                mandos_dbus_service.ClientRemoved(client
2152
2529
                                                  .dbus_object_path,
2153
2530
                                                  client.name)
 
2531
        client_settings.clear()
2154
2532
    
2155
2533
    atexit.register(cleanup)
2156
2534
    
2157
 
    for client in tcp_server.clients:
 
2535
    for client in tcp_server.clients.itervalues():
2158
2536
        if use_dbus:
2159
2537
            # Emit D-Bus signal
2160
2538
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2161
 
        client.enable()
 
2539
        # Need to initiate checking of clients
 
2540
        if client.enabled:
 
2541
            client.init_checker()
2162
2542
    
2163
2543
    tcp_server.enable()
2164
2544
    tcp_server.server_activate()
2204
2584
    # Must run before the D-Bus bus name gets deregistered
2205
2585
    cleanup()
2206
2586
 
2207
 
 
2208
2587
if __name__ == '__main__':
2209
2588
    main()