/mandos/trunk : revision 563

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

211

209

return decrypted_plaintext

212

210

213

211

212

214

213

class AvahiError(Exception):

215

214

def __init__(self, value, *args, **kwargs):

216

215

self.value = value

245

244

server: D-Bus Server

246

245

bus: dbus.SystemBus()

247

246

"""

248

249

247

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

248

servicetype = None, port = None, TXT = None,

251

249

domain = "", host = "", max_renames = 32768,

264

262

self.server = None

265

263

self.bus = bus

266

264

self.entry_group_state_changed_match = None

267

268

265

def rename(self):

269

266

"""Derived from the Avahi example code"""

270

267

if self.rename_count >= self.max_renames:

280

277

try:

281

278

self.add()

282

279

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

280

logger.critical("DBusException: %s", error)

284

281

self.cleanup()

285

282

os._exit(1)

286

283

self.rename_count += 1

287

288

284

def remove(self):

289

285

"""Derived from the Avahi example code"""

290

286

if self.entry_group_state_changed_match is not None:

292

288

self.entry_group_state_changed_match = None

293

289

if self.group is not None:

294

290

self.group.Reset()

295

296

291

def add(self):

297

292

"""Derived from the Avahi example code"""

298

293

self.remove()

315

310

dbus.UInt16(self.port),

316

311

avahi.string_array_to_txt_array(self.TXT))

317

312

self.group.Commit()

318

319

313

def entry_group_state_changed(self, state, error):

320

314

"""Derived from the Avahi example code"""

321

315

logger.debug("Avahi entry group state change: %i", state)

328

322

elif state == avahi.ENTRY_GROUP_FAILURE:

329

323

logger.critical("Avahi: Error in group state changed %s",

330

324

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

325

raise AvahiGroupError("State changed: %s"

326

% unicode(error))

334

327

def cleanup(self):

335

328

"""Derived from the Avahi example code"""

336

329

if self.group is not None:

341

334

pass

342

335

self.group = None

343

336

self.remove()

344

345

337

def server_state_changed(self, state, error=None):

346

338

"""Derived from the Avahi example code"""

347

339

logger.debug("Avahi server state change: %i", state)

366

358

logger.debug("Unknown state: %r", state)

367

359

else:

368

360

logger.debug("Unknown state: %r: %r", state, error)

369

370

361

def activate(self):

371

362

"""Derived from the Avahi example code"""

372

363

if self.server is None:

379

370

self.server_state_changed)

380

371

self.server_state_changed(self.server.GetState())

381

372

382

383

373

class AvahiServiceToSyslog(AvahiService):

384

374

def rename(self):

385

375

"""Add the new name to the syslog messages"""

386

376

ret = AvahiService.rename(self)

387

377

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

378

('Mandos (%s) [%%(process)d]:'

379

' %%(levelname)s: %%(message)s'

380

% self.name))

391

381

return ret

392

382

393

394

383

def timedelta_to_milliseconds(td):

395

384

"Convert a datetime.timedelta() to milliseconds"

396

385

return ((td.days * 24 * 60 * 60 * 1000)

397

386

+ (td.seconds * 1000)

398

387

+ (td.microseconds // 1000))

399

400

388

401

389

class Client(object):

402

390

"""A representation of a client host served by this server.

403

391

442

430

"""

443

431

444

432

runtime_expansions = ("approval_delay", "approval_duration",

445

"created", "enabled", "expires",

446

"fingerprint", "host", "interval",

447

"last_approval_request", "last_checked_ok",

433

"created", "enabled", "fingerprint",

434

"host", "interval", "last_checked_ok",

448

435

"last_enabled", "name", "timeout")

449

436

client_defaults = { "timeout": "5m",

450

437

"extended_timeout": "15m",

471

458

472

459

def approval_delay_milliseconds(self):

473

460

return timedelta_to_milliseconds(self.approval_delay)

474

461

475

462

@staticmethod

476

463

def config_parser(config):

477

464

"""Construct a new dict of client settings of this form:

502

489

"rb") as secfile:

503

490

client["secret"] = secfile.read()

504

491

else:

505

raise TypeError("No secret or secfile for section {0}"

506

.format(section))

492

raise TypeError("No secret or secfile for section %s"

493

% section)

507

494

client["timeout"] = string_to_delta(section["timeout"])

508

495

client["extended_timeout"] = string_to_delta(

509

496

section["extended_timeout"])

518

505

client["last_checker_status"] = -2

519

506

520

507

return settings

521

508

509

522

510

def __init__(self, settings, name = None):

511

"""Note: the 'checker' key in 'config' sets the

512

'checker_command' attribute and *not* the 'checker'

513

attribute."""

523

514

self.name = name

524

515

# adding all client settings

525

516

for setting, value in settings.iteritems():

534

525

else:

535

526

self.last_enabled = None

536

527

self.expires = None

537

528

538

529

logger.debug("Creating client %r", self.name)

539

530

# Uppercase and remove spaces from fingerprint for later

540

531

# comparison purposes with return value from the fingerprint()

542

533

logger.debug(" Fingerprint: %s", self.fingerprint)

543

534

self.created = settings.get("created",

544

535

datetime.datetime.utcnow())

545

536

546

537

# attributes specific for this server instance

547

538

self.checker = None

548

539

self.checker_initiator_tag = None

576

567

if getattr(self, "enabled", False):

577

568

# Already enabled

578

569

return

570

self.send_changedstate()

579

571

self.expires = datetime.datetime.utcnow() + self.timeout

580

572

self.enabled = True

581

573

self.last_enabled = datetime.datetime.utcnow()

582

574

self.init_checker()

583

self.send_changedstate()

584

575

585

576

def disable(self, quiet=True):

586

577

"""Disable this client."""

587

578

if not getattr(self, "enabled", False):

588

579

return False

589

580

if not quiet:

581

self.send_changedstate()

582

if not quiet:

590

583

logger.info("Disabling client %s", self.name)

591

if getattr(self, "disable_initiator_tag", None) is not None:

584

if getattr(self, "disable_initiator_tag", False):

592

585

gobject.source_remove(self.disable_initiator_tag)

593

586

self.disable_initiator_tag = None

594

587

self.expires = None

595

if getattr(self, "checker_initiator_tag", None) is not None:

588

if getattr(self, "checker_initiator_tag", False):

596

589

gobject.source_remove(self.checker_initiator_tag)

597

590

self.checker_initiator_tag = None

598

591

self.stop_checker()

599

592

self.enabled = False

600

if not quiet:

601

self.send_changedstate()

602

593

# Do not run this again if called by a gobject.timeout_add

603

594

return False

604

595

608

599

def init_checker(self):

609

600

# Schedule a new checker to be started an 'interval' from now,

610

601

# and every interval from then on.

611

if self.checker_initiator_tag is not None:

612

gobject.source_remove(self.checker_initiator_tag)

613

602

self.checker_initiator_tag = (gobject.timeout_add

614

603

(self.interval_milliseconds(),

615

604

self.start_checker))

616

605

# Schedule a disable() when 'timeout' has passed

617

if self.disable_initiator_tag is not None:

618

gobject.source_remove(self.disable_initiator_tag)

619

606

self.disable_initiator_tag = (gobject.timeout_add

620

607

(self.timeout_milliseconds(),

621

608

self.disable))

652

639

timeout = self.timeout

653

640

if self.disable_initiator_tag is not None:

654

641

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = None

656

642

if getattr(self, "enabled", False):

657

643

self.disable_initiator_tag = (gobject.timeout_add

658

644

(timedelta_to_milliseconds

668

654

If a checker already exists, leave it running and do

669

655

nothing."""

670

656

# The reason for not killing a running checker is that if we

671

# did that, and if a checker (for some reason) started running

672

# slowly and taking more than 'interval' time, then the client

673

# would inevitably timeout, since no checker would get a

674

# chance to run to completion. If we instead leave running

657

# did that, then if a checker (for some reason) started

658

# running slowly and taking more than 'interval' time, the

659

# client would inevitably timeout, since no checker would get

660

# a chance to run to completion. If we instead leave running

675

661

# checkers alone, the checker would have to take more time

676

662

# than 'timeout' for the client to be disabled, which is as it

677

663

# should be.

691

677

self.current_checker_command)

692

678

# Start a new checker if needed

693

679

if self.checker is None:

694

# Escape attributes for the shell

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

699

680

try:

700

command = self.checker_command % escaped_attrs

701

except TypeError as error:

702

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

681

# In case checker_command has exactly one % operator

682

command = self.checker_command % self.host

683

except TypeError:

684

# Escape attributes for the shell

685

escaped_attrs = dict(

686

(attr,

687

re.escape(unicode(str(getattr(self, attr, "")),

688

errors=

689

'replace')))

690

for attr in

691

self.runtime_expansions)

692

693

try:

694

command = self.checker_command % escaped_attrs

695

except TypeError as error:

696

logger.error('Could not format string "%s":'

697

' %s', self.checker_command, error)

698

return True # Try again later

705

699

self.current_checker_command = command

706

700

try:

707

701

logger.info("Starting checker %r for %s",

713

707

self.checker = subprocess.Popen(command,

714

708

close_fds=True,

715

709

shell=True, cwd="/")

710

self.checker_callback_tag = (gobject.child_watch_add

711

(self.checker.pid,

712

self.checker_callback,

713

data=command))

714

# The checker may have completed before the gobject

715

# watch was added. Check for this.

716

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

717

if pid:

718

gobject.source_remove(self.checker_callback_tag)

719

self.checker_callback(pid, status, command)

716

720

except OSError as error:

717

logger.error("Failed to start subprocess",

718

exc_info=error)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

721

logger.error("Failed to start subprocess: %s",

722

error)

729

723

# Re-run this periodically if run by gobject.timeout_add

730

724

return True

731

725

738

732

return

739

733

logger.debug("Stopping checker for %(name)s", vars(self))

740

734

try:

741

self.checker.terminate()

735

os.kill(self.checker.pid, signal.SIGTERM)

742

736

#time.sleep(0.5)

743

737

#if self.checker.poll() is None:

744

# self.checker.kill()

738

# os.kill(self.checker.pid, signal.SIGKILL)

745

739

except OSError as error:

746

740

if error.errno != errno.ESRCH: # No such process

747

741

raise

764

758

# "Set" method, so we fail early here:

765

759

if byte_arrays and signature != "ay":

766

760

raise ValueError("Byte arrays not supported for non-'ay'"

767

" signature {0!r}".format(signature))

761

" signature %r" % signature)

768

762

def decorator(func):

769

763

func._dbus_is_property = True

770

764

func._dbus_interface = dbus_interface

779

773

780

774

781

775

def dbus_interface_annotations(dbus_interface):

782

"""Decorator for marking functions returning interface annotations

776

"""Decorator for marking functions returning interface annotations.

783

777

784

778

Usage:

785

779

982

976

tag.appendChild(ann_tag)

983

977

# Add interface annotation tags

984

978

for annotation, value in dict(

985

itertools.chain.from_iterable(

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

989

if name == if_tag.getAttribute("name")

990

)).iteritems():

979

itertools.chain(

980

*(annotations().iteritems()

981

for name, annotations in

982

self._get_all_dbus_things("interface")

983

if name == if_tag.getAttribute("name")

984

))).iteritems():

991

985

ann_tag = document.createElement("annotation")

992

986

ann_tag.setAttribute("name", annotation)

993

987

ann_tag.setAttribute("value", value)

1012

1006

except (AttributeError, xml.dom.DOMException,

1013

1007

xml.parsers.expat.ExpatError) as error:

1014

1008

logger.error("Failed to override Introspection method",

1015

exc_info=error)

1009

error)

1016

1010

return xmlstring

1017

1011

1018

1012

1024

1018

variant_level=variant_level)

1025

1019

1026

1020

1027

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1028

"""A class decorator; applied to a subclass of

1029

dbus.service.Object, it will add alternate D-Bus attributes with

1030

interface names according to the "alt_interface_names" mapping.

1031

Usage:

1032

1033

@alternate_dbus_names({"org.example.Interface":

1034

"net.example.AlternateInterface"})

1035

class SampleDBusObject(dbus.service.Object):

1036

@dbus.service.method("org.example.Interface")

1037

def SampleDBusMethod():

1038

pass

1039

1040

The above "SampleDBusMethod" on "SampleDBusObject" will be

1041

reachable via two interfaces: "org.example.Interface" and

1042

"net.example.AlternateInterface", the latter of which will have

1043

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1044

"true", unless "deprecate" is passed with a False value.

1045

1046

This works for methods and signals, and also for D-Bus properties

1047

(from DBusObjectWithProperties) and interfaces (from the

1048

dbus_interface_annotations decorator).

1021

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

1022

.__metaclass__):

1023

"""Applied to an empty subclass of a D-Bus object, this metaclass

1024

will add additional D-Bus attributes matching a certain pattern.

1049

1025

"""

1050

def wrapper(cls):

1051

for orig_interface_name, alt_interface_name in (

1052

alt_interface_names.iteritems()):

1053

attr = {}

1054

interface_names = set()

1055

# Go though all attributes of the class

1056

for attrname, attribute in inspect.getmembers(cls):

1026

def __new__(mcs, name, bases, attr):

1027

# Go through all the base classes which could have D-Bus

1028

# methods, signals, or properties in them

1029

old_interface_names = []

1030

for base in (b for b in bases

1031

if issubclass(b, dbus.service.Object)):

1032

# Go though all attributes of the base class

1033

for attrname, attribute in inspect.getmembers(base):

1057

1034

# Ignore non-D-Bus attributes, and D-Bus attributes

1058

1035

# with the wrong interface name

1059

1036

if (not hasattr(attribute, "_dbus_interface")

1060

1037

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

1038

.startswith("se.recompile.Mandos")):

1062

1039

continue

1063

1040

# Create an alternate D-Bus interface name based on

1064

1041

# the current name

1065

1042

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1068

interface_names.add(alt_interface)

1043

.replace("se.recompile.Mandos",

1044

"se.bsnet.fukt.Mandos"))

1045

if alt_interface != attribute._dbus_interface:

1046

old_interface_names.append(alt_interface)

1069

1047

# Is this a D-Bus signal?

1070

1048

if getattr(attribute, "_dbus_is_signal", False):

1071

1049

# Extract the original non-method function by

1093

1071

except AttributeError:

1094

1072

pass

1095

1073

# Define a creator of a function to call both the

1096

# original and alternate functions, so both the

1097

# original and alternate signals gets sent when

1098

# the function is called

1074

# old and new functions, so both the old and new

1075

# signals gets sent when the function is called

1099

1076

def fixscope(func1, func2):

1100

1077

"""This function is a scope container to pass

1101

1078

func1 and func2 to the "call_both" function

1108

1085

return call_both

1109

1086

# Create the "call_both" function and add it to

1110

1087

# the class

1111

attr[attrname] = fixscope(attribute, new_function)

1088

attr[attrname] = fixscope(attribute,

1089

new_function)

1112

1090

# Is this a D-Bus method?

1113

1091

elif getattr(attribute, "_dbus_is_method", False):

1114

1092

# Create a new, but exactly alike, function

1170

1148

attribute.func_name,

1171

1149

attribute.func_defaults,

1172

1150

attribute.func_closure)))

1173

if deprecate:

1174

# Deprecate all alternate interfaces

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1176

for interface_name in interface_names:

1177

@dbus_interface_annotations(interface_name)

1178

def func(self):

1179

return { "org.freedesktop.DBus.Deprecated":

1180

"true" }

1181

# Find an unused name

1182

for aname in (iname.format(i)

1183

for i in itertools.count()):

1184

if aname not in attr:

1185

attr[aname] = func

1186

break

1187

if interface_names:

1188

# Replace the class with a new subclass of it with

1189

# methods, signals, etc. as created above.

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1192

return cls

1193

return wrapper

1194

1195

1196

@alternate_dbus_interfaces({"se.recompile.Mandos":

1197

"se.bsnet.fukt.Mandos"})

1151

# Deprecate all old interfaces

1152

basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1153

for old_interface_name in old_interface_names:

1154

@dbus_interface_annotations(old_interface_name)

1155

def func(self):

1156

return { "org.freedesktop.DBus.Deprecated": "true" }

1157

# Find an unused name

1158

for aname in (basename.format(i) for i in

1159

itertools.count()):

1160

if aname not in attr:

1161

attr[aname] = func

1162

break

1163

return type.__new__(mcs, name, bases, attr)

1164

1165

1198

1166

class ClientDBus(Client, DBusObjectWithProperties):

1199

1167

"""A Client class using D-Bus

1200

1168

1220

1188

("/clients/" + client_object_name))

1221

1189

DBusObjectWithProperties.__init__(self, self.bus,

1222

1190

self.dbus_object_path)

1223

1191

1224

1192

def notifychangeproperty(transform_func,

1225

1193

dbus_name, type_func=lambda x: x,

1226

1194

variant_level=1):

1249

1217

1250

1218

return property(lambda self: getattr(self, attrname), setter)

1251

1219

1220

1252

1221

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1253

1222

approvals_pending = notifychangeproperty(dbus.Boolean,

1254

1223

"ApprovalPending",

1336

1305

return False

1337

1306

1338

1307

def approve(self, value=True):

1308

self.send_changedstate()

1339

1309

self.approved = value

1340

1310

gobject.timeout_add(timedelta_to_milliseconds

1341

1311

(self.approval_duration),

1342

1312

self._reset_approved)

1343

self.send_changedstate()

1313

1344

1314

1345

1315

## D-Bus methods, signals & properties

1346

1316

_interface = "se.recompile.Mandos.Client"

1530

1500

def Timeout_dbus_property(self, value=None):

1531

1501

if value is None: # get

1532

1502

return dbus.UInt64(self.timeout_milliseconds())

1533

old_timeout = self.timeout

1534

1503

self.timeout = datetime.timedelta(0, 0, 0, value)

1535

# Reschedule disabling

1504

# Reschedule timeout

1536

1505

if self.enabled:

1537

1506

now = datetime.datetime.utcnow()

1538

self.expires += self.timeout - old_timeout

1539

if self.expires <= now:

1507

time_to_die = timedelta_to_milliseconds(

1508

(self.last_checked_ok + self.timeout) - now)

1509

if time_to_die <= 0:

1540

1510

# The timeout has passed

1541

1511

self.disable()

1542

1512

else:

1513

self.expires = (now +

1514

datetime.timedelta(milliseconds =

1515

time_to_die))

1543

1516

if (getattr(self, "disable_initiator_tag", None)

1544

1517

is None):

1545

1518

return

1546

1519

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1520

self.disable_initiator_tag = (gobject.timeout_add

1521

(time_to_die,

1522

self.disable))

1551

1523

1552

1524

# ExtendedTimeout - property

1553

1525

@dbus_service_property(_interface, signature="t",

1632

1604

self._pipe.send(('setattr', name, value))

1633

1605

1634

1606

1607

class ClientDBusTransitional(ClientDBus):

1608

__metaclass__ = AlternateDBusNamesMetaclass

1609

1610

1635

1611

class ClientHandler(socketserver.BaseRequestHandler, object):

1636

1612

"""A class to handle client connections.

1637

1613

1741

1717

#wait until timeout or approved

1742

1718

time = datetime.datetime.now()

1743

1719

client.changedstate.acquire()

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1720

(client.changedstate.wait

1721

(float(client.timedelta_to_milliseconds(delay)

1722

/ 1000)))

1747

1723

client.changedstate.release()

1748

1724

time2 = datetime.datetime.now()

1749

1725

if (time2 - time) >= delay:

1765

1741

try:

1766

1742

sent = session.send(client.secret[sent_size:])

1767

1743

except gnutls.errors.GNUTLSError as error:

1768

logger.warning("gnutls send failed",

1769

exc_info=error)

1744

logger.warning("gnutls send failed")

1770

1745

return

1771

1746

logger.debug("Sent: %d, remaining: %d",

1772

1747

sent, len(client.secret)

1786

1761

try:

1787

1762

session.bye()

1788

1763

except gnutls.errors.GNUTLSError as error:

1789

logger.warning("GnuTLS bye failed",

1790

exc_info=error)

1764

logger.warning("GnuTLS bye failed")

1791

1765

1792

1766

@staticmethod

1793

1767

def peer_certificate(session):

1865

1839

def process_request(self, request, address):

1866

1840

"""Start a new process to process the request."""

1867

1841

proc = multiprocessing.Process(target = self.sub_process_main,

1868

args = (request, address))

1842

args = (request,

1843

address))

1869

1844

proc.start()

1870

1845

return proc

1871

1846

1921

1896

str(self.interface

1922

1897

+ '\0'))

1923

1898

except socket.error as error:

1924

if error.errno == errno.EPERM:

1899

if error[0] == errno.EPERM:

1925

1900

logger.error("No permission to"

1926

1901

" bind to interface %s",

1927

1902

self.interface)

1928

elif error.errno == errno.ENOPROTOOPT:

1903

elif error[0] == errno.ENOPROTOOPT:

1929

1904

logger.error("SO_BINDTODEVICE not available;"

1930

1905

" cannot bind to interface %s",

1931

1906

self.interface)

1932

elif error.errno == errno.ENODEV:

1933

logger.error("Interface %s does not"

1934

" exist, cannot bind",

1935

self.interface)

1936

1907

else:

1937

1908

raise

1938

1909

# Only bind(2) the socket if we really need to.

1997

1968

1998

1969

def handle_ipc(self, source, condition, parent_pipe=None,

1999

1970

proc = None, client_object=None):

1971

condition_names = {

1972

gobject.IO_IN: "IN", # There is data to read.

1973

gobject.IO_OUT: "OUT", # Data can be written (without

1974

# blocking).

1975

gobject.IO_PRI: "PRI", # There is urgent data to read.

1976

gobject.IO_ERR: "ERR", # Error condition.

1977

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1978

# broken, usually for pipes and

1979

# sockets).

1980

}

1981

conditions_string = ' | '.join(name

1982

for cond, name in

1983

condition_names.iteritems()

1984

if cond & condition)

2000

1985

# error, or the other end of multiprocessing.Pipe has closed

2001

if condition & (gobject.IO_ERR | gobject.IO_HUP):

1986

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2002

1987

# Wait for other process to exit

2003

1988

proc.join()

2004

1989

return False

2094

2079

elif suffix == "w":

2095

2080

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2096

2081

else:

2097

raise ValueError("Unknown suffix {0!r}"

2098

.format(suffix))

2082

raise ValueError("Unknown suffix %r" % suffix)

2099

2083

except (ValueError, IndexError) as e:

2100

2084

raise ValueError(*(e.args))

2101

2085

timevalue += delta

2118

2102

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2119

2103

if not stat.S_ISCHR(os.fstat(null).st_mode):

2120

2104

raise OSError(errno.ENODEV,

2121

"{0} not a character device"

2122

.format(os.devnull))

2105

"%s not a character device"

2106

% os.devnull)

2123

2107

os.dup2(null, sys.stdin.fileno())

2124

2108

os.dup2(null, sys.stdout.fileno())

2125

2109

os.dup2(null, sys.stderr.fileno())

2134

2118

2135

2119

parser = argparse.ArgumentParser()

2136

2120

parser.add_argument("-v", "--version", action="version",

2137

version = "%(prog)s {0}".format(version),

2121

version = "%%(prog)s %s" % version,

2138

2122

help="show version number and exit")

2139

2123

parser.add_argument("-i", "--interface", metavar="IF",

2140

2124

help="Bind to interface IF")

2243

2227

2244

2228

if server_settings["servicename"] != "Mandos":

2245

2229

syslogger.setFormatter(logging.Formatter

2246

('Mandos ({0}) [%(process)d]:'

2247

' %(levelname)s: %(message)s'

2248

.format(server_settings

2249

["servicename"])))

2230

('Mandos (%s) [%%(process)d]:'

2231

' %%(levelname)s: %%(message)s'

2232

% server_settings["servicename"]))

2250

2233

2251

2234

# Parse config file with clients

2252

2235

client_config = configparser.SafeConfigParser(Client

2270

2253

pidfilename = "/var/run/mandos.pid"

2271

2254

try:

2272

2255

pidfile = open(pidfilename, "w")

2273

except IOError as e:

2274

logger.error("Could not open file %r", pidfilename,

2275

exc_info=e)

2256

except IOError:

2257

logger.error("Could not open file %r", pidfilename)

2276

2258

2277

for name in ("_mandos", "mandos", "nobody"):

2259

try:

2260

uid = pwd.getpwnam("_mandos").pw_uid

2261

gid = pwd.getpwnam("_mandos").pw_gid

2262

except KeyError:

2278

2263

try:

2279

uid = pwd.getpwnam(name).pw_uid

2280

gid = pwd.getpwnam(name).pw_gid

2281

break

2264

uid = pwd.getpwnam("mandos").pw_uid

2265

gid = pwd.getpwnam("mandos").pw_gid

2282

2266

except KeyError:

2283

continue

2284

else:

2285

uid = 65534

2286

gid = 65534

2267

try:

2268

uid = pwd.getpwnam("nobody").pw_uid

2269

gid = pwd.getpwnam("nobody").pw_gid

2270

except KeyError:

2271

uid = 65534

2272

gid = 65534

2287

2273

try:

2288

2274

os.setgid(gid)

2289

2275

os.setuid(uid)

2290

2276

except OSError as error:

2291

if error.errno != errno.EPERM:

2277

if error[0] != errno.EPERM:

2292

2278

raise error

2293

2279

2294

2280

if debug:

2332

2318

("se.bsnet.fukt.Mandos", bus,

2333

2319

do_not_queue=True))

2334

2320

except dbus.exceptions.NameExistsException as e:

2335

logger.error("Disabling D-Bus:", exc_info=e)

2321

logger.error(unicode(e) + ", disabling D-Bus")

2336

2322

use_dbus = False

2337

2323

server_settings["use_dbus"] = False

2338

2324

tcp_server.use_dbus = False

2350

2336

2351

2337

client_class = Client

2352

2338

if use_dbus:

2353

client_class = functools.partial(ClientDBus, bus = bus)

2339

client_class = functools.partial(ClientDBusTransitional,

2340

bus = bus)

2354

2341

2355

2342

client_settings = Client.config_parser(client_config)

2356

2343

old_client_settings = {}

2364

2351

(stored_state))

2365

2352

os.remove(stored_state_path)

2366

2353

except IOError as e:

2367

if e.errno == errno.ENOENT:

2368

logger.warning("Could not load persistent state: {0}"

2369

.format(os.strerror(e.errno)))

2370

else:

2371

logger.critical("Could not load persistent state:",

2372

exc_info=e)

2354

logger.warning("Could not load persistent state: {0}"

2355

.format(e))

2356

if e.errno != errno.ENOENT:

2373

2357

raise

2374

2358

except EOFError as e:

2375

2359

logger.warning("Could not load persistent state: "

2376

"EOFError:", exc_info=e)

2360

"EOFError: {0}".format(e))

2377

2361

2378

2362

with PGPEngine() as pgp:

2379

2363

for client_name, client in clients_data.iteritems():

2432

2416

.format(client_name))

2433

2417

client["secret"] = (

2434

2418

client_settings[client_name]["secret"])

2419

2435

2420

2436

2421

# Add/remove clients based on new changes made to config

2437

2422

for client_name in (set(old_client_settings)

2440

2425

for client_name in (set(client_settings)

2441

2426

- set(old_client_settings)):

2442

2427

clients_data[client_name] = client_settings[client_name]

2443

2428

2444

2429

# Create all client objects

2445

2430

for client_name, client in clients_data.iteritems():

2446

2431

tcp_server.clients[client_name] = client_class(

2448

2433

2449

2434

if not tcp_server.clients:

2450

2435

logger.warning("No clients defined")

2451

2436

2452

2437

if not debug:

2453

2438

try:

2454

2439

with pidfile:

2462

2447

# "pidfile" was never created

2463

2448

pass

2464

2449

del pidfilename

2450

signal.signal(signal.SIGINT, signal.SIG_IGN)

2465

2451

2466

2452

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2467

2453

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2468

2454

2469

2455

if use_dbus:

2470

@alternate_dbus_interfaces({"se.recompile.Mandos":

2471

"se.bsnet.fukt.Mandos"})

2472

2456

class MandosDBusService(DBusObjectWithProperties):

2473

2457

"""A D-Bus proxy object"""

2474

2458

def __init__(self):

2528

2512

2529

2513

del _interface

2530

2514

2531

mandos_dbus_service = MandosDBusService()

2515

class MandosDBusServiceTransitional(MandosDBusService):

2516

__metaclass__ = AlternateDBusNamesMetaclass

2517

mandos_dbus_service = MandosDBusServiceTransitional()

2532

2518

2533

2519

def cleanup():

2534

2520

"Cleanup function; run on exit"

2567

2553

del client_settings[client.name]["secret"]

2568

2554

2569

2555

try:

2570

with (tempfile.NamedTemporaryFile

2571

(mode='wb', suffix=".pickle", prefix='clients-',

2572

dir=os.path.dirname(stored_state_path),

2573

delete=False)) as stored_state:

2556

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2557

prefix="clients-",

2558

dir=os.path.dirname

2559

(stored_state_path))

2560

with os.fdopen(tempfd, "wb") as stored_state:

2574

2561

pickle.dump((clients, client_settings), stored_state)

2575

tempname=stored_state.name

2576

2562

os.rename(tempname, stored_state_path)

2577

2563

except (IOError, OSError) as e:

2564

logger.warning("Could not save persistent state: {0}"

2565

.format(e))

2578

2566

if not debug:

2579

2567

try:

2580

2568

os.remove(tempname)

2581

2569

except NameError:

2582

2570

pass

2583

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2584

logger.warning("Could not save persistent state: {0}"

2585

.format(os.strerror(e.errno)))

2586

else:

2587

logger.warning("Could not save persistent state:",

2588

exc_info=e)

2571

if e.errno not in set((errno.ENOENT, errno.EACCES,

2572

errno.EEXIST)):

2589

2573

raise e

2590

2574

2591

2575

# Delete all clients, and settings from config

2619

2603

service.port = tcp_server.socket.getsockname()[1]

2620

2604

if use_ipv6:

2621

2605

logger.info("Now listening on address %r, port %d,"

2622

" flowinfo %d, scope_id %d",

2623

*tcp_server.socket.getsockname())

2606

" flowinfo %d, scope_id %d"

2607

% tcp_server.socket.getsockname())

2624

2608

else: # IPv4

2625

logger.info("Now listening on address %r, port %d",

2626

*tcp_server.socket.getsockname())

2609

logger.info("Now listening on address %r, port %d"

2610

% tcp_server.socket.getsockname())

2627

2611

2628

2612

#service.interface = tcp_server.socket.getsockname()[3]

2629

2613

2632

2616

try:

2633

2617

service.activate()

2634

2618

except dbus.exceptions.DBusException as error:

2635

logger.critical("D-Bus Exception", exc_info=error)

2619

logger.critical("DBusException: %s", error)

2636

2620

cleanup()

2637

2621

sys.exit(1)

2638

2622

# End of Avahi example code

2645

2629

logger.debug("Starting main loop")

2646

2630

main_loop.run()

2647

2631

except AvahiError as error:

2648

logger.critical("Avahi Error", exc_info=error)

2632

logger.critical("AvahiError: %s", error)

2649

2633

cleanup()

2650

2634

sys.exit(1)

2651

2635

except KeyboardInterrupt: