/mandos/trunk : revision 581

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

37

39

import SocketServer as socketserver

38

40

import socket

39

41

import argparse

62

64

import functools

63

65

import cPickle as pickle

64

66

import multiprocessing

67

import types

68

import binascii

69

import tempfile

70

import itertools

65

71

66

72

import dbus

67

73

import dbus.service

72

78

import ctypes.util

73

79

import xml.dom.minidom

74

80

import inspect

81

import GnuPGInterface

75

82

76

83

try:

77

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

81

88

except ImportError:

82

89

SO_BINDTODEVICE = None

83

90

84

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

91

version = "1.5.3"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

89

95

syslogger = (logging.handlers.SysLogHandler

90

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

97

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

98

99

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

def if_nametoindex(interface):

105

"Get an interface index the hard way, i.e. using fcntl()"

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

with contextlib.closing(socket.socket()) as s:

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

113

return interface_index

114

115

116

def initlogger(debug, level=logging.WARNING):

117

"""init logger and add loglevel"""

118

119

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

132

133

134

class PGPError(Exception):

135

"""Exception if encryption/decryption fails"""

136

pass

137

138

139

class PGPEngine(object):

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

151

def __enter__(self):

152

return self

153

154

def __exit__ (self, exc_type, exc_value, traceback):

155

self._cleanup()

156

return False

157

158

def __del__(self):

159

self._cleanup()

160

161

def _cleanup(self):

162

if self.tempdir is not None:

163

# Delete contents of tempdir

164

for root, dirs, files in os.walk(self.tempdir,

165

topdown = False):

166

for filename in files:

167

os.remove(os.path.join(root, filename))

168

for dirname in dirs:

169

os.rmdir(os.path.join(root, dirname))

170

# Remove tempdir

171

os.rmdir(self.tempdir)

172

self.tempdir = None

173

174

def password_encode(self, password):

175

# Passphrase can not be empty and can not contain newlines or

176

# NUL bytes. So we prefix it and hex encode it.

177

return b"mandos" + binascii.hexlify(password)

178

179

def encrypt(self, data, password):

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

194

return ciphertext

195

196

def decrypt(self, data, password):

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

211

return decrypted_plaintext

212

102

213

103

214

class AvahiError(Exception):

104

215

def __init__(self, value, *args, **kwargs):

134

245

server: D-Bus Server

135

246

bus: dbus.SystemBus()

136

247

"""

248

137

249

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

250

servicetype = None, port = None, TXT = None,

139

251

domain = "", host = "", max_renames = 32768,

152

264

self.server = None

153

265

self.bus = bus

154

266

self.entry_group_state_changed_match = None

267

155

268

def rename(self):

156

269

"""Derived from the Avahi example code"""

157

270

if self.rename_count >= self.max_renames:

159

272

" after %i retries, exiting.",

160

273

self.rename_count)

161

274

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

163

277

logger.info("Changing Zeroconf service name to %r ...",

164

278

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

279

self.remove()

170

280

try:

171

281

self.add()

172

282

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

283

logger.critical("D-Bus Exception", exc_info=error)

174

284

self.cleanup()

175

285

os._exit(1)

176

286

self.rename_count += 1

287

177

288

def remove(self):

178

289

"""Derived from the Avahi example code"""

179

290

if self.entry_group_state_changed_match is not None:

181

292

self.entry_group_state_changed_match = None

182

293

if self.group is not None:

183

294

self.group.Reset()

295

184

296

def add(self):

185

297

"""Derived from the Avahi example code"""

186

298

self.remove()

191

303

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

304

self.entry_group_state_changed_match = (

193

305

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

306

'StateChanged', self.entry_group_state_changed))

195

307

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

196

308

self.name, self.type)

197

309

self.group.AddService(

203

315

dbus.UInt16(self.port),

204

316

avahi.string_array_to_txt_array(self.TXT))

205

317

self.group.Commit()

318

206

319

def entry_group_state_changed(self, state, error):

207

320

"""Derived from the Avahi example code"""

208

321

logger.debug("Avahi entry group state change: %i", state)

215

328

elif state == avahi.ENTRY_GROUP_FAILURE:

216

329

logger.critical("Avahi: Error in group state changed %s",

217

330

unicode(error))

218

raise AvahiGroupError("State changed: %s"

219

% unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

220

334

def cleanup(self):

221

335

"""Derived from the Avahi example code"""

222

336

if self.group is not None:

223

337

try:

224

338

self.group.Free()

225

339

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

340

dbus.exceptions.DBusException):

227

341

pass

228

342

self.group = None

229

343

self.remove()

344

230

345

def server_state_changed(self, state, error=None):

231

346

"""Derived from the Avahi example code"""

232

347

logger.debug("Avahi server state change: %i", state)

251

366

logger.debug("Unknown state: %r", state)

252

367

else:

253

368

logger.debug("Unknown state: %r: %r", state, error)

369

254

370

def activate(self):

255

371

"""Derived from the Avahi example code"""

256

372

if self.server is None:

263

379

self.server_state_changed)

264

380

self.server_state_changed(self.server.GetState())

265

381

382

class AvahiServiceToSyslog(AvahiService):

383

def rename(self):

384

"""Add the new name to the syslog messages"""

385

ret = AvahiService.rename(self)

386

syslogger.setFormatter(logging.Formatter

387

('Mandos ({0}) [%(process)d]:'

388

' %(levelname)s: %(message)s'

389

.format(self.name)))

390

return ret

391

392

def timedelta_to_milliseconds(td):

393

"Convert a datetime.timedelta() to milliseconds"

394

return ((td.days * 24 * 60 * 60 * 1000)

395

+ (td.seconds * 1000)

396

+ (td.microseconds // 1000))

266

397

267

398

class Client(object):

268

399

"""A representation of a client host served by this server.

269

400

270

401

Attributes:

271

_approved: bool(); 'None' if not yet approved/disapproved

402

approved: bool(); 'None' if not yet approved/disapproved

272

403

approval_delay: datetime.timedelta(); Time to wait for approval

273

404

approval_duration: datetime.timedelta(); Duration of one approval

274

405

checker: subprocess.Popen(); a running checker process used

281

412

instance %(name)s can be used in the command.

282

413

checker_initiator_tag: a gobject event source tag, or None

283

414

created: datetime.datetime(); (UTC) object creation

415

client_structure: Object describing what attributes a client has

416

and is used for storing the client at exit

284

417

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

418

disable_initiator_tag: a gobject event source tag, or None

287

419

enabled: bool()

288

420

fingerprint: string (40 or 32 hexadecimal digits); used to

291

423

interval: datetime.timedelta(); How often to start a new checker

292

424

last_approval_request: datetime.datetime(); (UTC) or None

293

425

last_checked_ok: datetime.datetime(); (UTC) or None

294

last_enabled: datetime.datetime(); (UTC)

426

last_checker_status: integer between 0 and 255 reflecting exit

427

status of last checker. -1 reflects crashed

428

checker, -2 means no checker completed yet.

429

last_enabled: datetime.datetime(); (UTC) or None

295

430

name: string; from the config file, used in log messages and

296

431

D-Bus identifiers

297

432

secret: bytestring; sent verbatim (over TLS) to client

298

433

timeout: datetime.timedelta(); How long from last_checked_ok

299

434

until this client is disabled

435

extended_timeout: extra long timeout when secret has been sent

300

436

runtime_expansions: Allowed attributes for runtime expansion.

437

expires: datetime.datetime(); time (UTC) when a client will be

438

disabled, or None

301

439

"""

302

440

303

441

runtime_expansions = ("approval_delay", "approval_duration",

304

442

"created", "enabled", "fingerprint",

305

443

"host", "interval", "last_checked_ok",

306

444

"last_enabled", "name", "timeout")

307

308

@staticmethod

309

def _timedelta_to_milliseconds(td):

310

"Convert a datetime.timedelta() to milliseconds"

311

return ((td.days * 24 * 60 * 60 * 1000)

312

+ (td.seconds * 1000)

313

+ (td.microseconds // 1000))

445

client_defaults = { "timeout": "5m",

446

"extended_timeout": "15m",

447

"interval": "2m",

448

"checker": "fping -q -- %%(host)s",

449

"host": "",

450

"approval_delay": "0s",

451

"approval_duration": "1s",

452

"approved_by_default": "True",

453

"enabled": "True",

454

}

314

455

315

456

def timeout_milliseconds(self):

316

457

"Return the 'timeout' attribute in milliseconds"

317

return self._timedelta_to_milliseconds(self.timeout)

458

return timedelta_to_milliseconds(self.timeout)

459

460

def extended_timeout_milliseconds(self):

461

"Return the 'extended_timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.extended_timeout)

318

463

319

464

def interval_milliseconds(self):

320

465

"Return the 'interval' attribute in milliseconds"

321

return self._timedelta_to_milliseconds(self.interval)

322

466

return timedelta_to_milliseconds(self.interval)

467

323

468

def approval_delay_milliseconds(self):

324

return self._timedelta_to_milliseconds(self.approval_delay)

325

326

def __init__(self, name = None, disable_hook=None, config=None):

327

"""Note: the 'checker' key in 'config' sets the

328

'checker_command' attribute and *not* the 'checker'

329

attribute."""

469

return timedelta_to_milliseconds(self.approval_delay)

470

471

@staticmethod

472

def config_parser(config):

473

"""Construct a new dict of client settings of this form:

474

{ client_name: {setting_name: value, ...}, ...}

475

with exceptions for any special settings as defined above.

476

NOTE: Must be a pure function. Must return the same result

477

value given the same arguments.

478

"""

479

settings = {}

480

for client_name in config.sections():

481

section = dict(config.items(client_name))

482

client = settings[client_name] = {}

483

484

client["host"] = section["host"]

485

# Reformat values from string types to Python types

486

client["approved_by_default"] = config.getboolean(

487

client_name, "approved_by_default")

488

client["enabled"] = config.getboolean(client_name,

489

"enabled")

490

491

client["fingerprint"] = (section["fingerprint"].upper()

492

.replace(" ", ""))

493

if "secret" in section:

494

client["secret"] = section["secret"].decode("base64")

495

elif "secfile" in section:

496

with open(os.path.expanduser(os.path.expandvars

497

(section["secfile"])),

498

"rb") as secfile:

499

client["secret"] = secfile.read()

500

else:

501

raise TypeError("No secret or secfile for section {0}"

502

.format(section))

503

client["timeout"] = string_to_delta(section["timeout"])

504

client["extended_timeout"] = string_to_delta(

505

section["extended_timeout"])

506

client["interval"] = string_to_delta(section["interval"])

507

client["approval_delay"] = string_to_delta(

508

section["approval_delay"])

509

client["approval_duration"] = string_to_delta(

510

section["approval_duration"])

511

client["checker_command"] = section["checker"]

512

client["last_approval_request"] = None

513

client["last_checked_ok"] = None

514

client["last_checker_status"] = -2

515

516

return settings

517

518

def __init__(self, settings, name = None):

330

519

self.name = name

331

if config is None:

332

config = {}

520

# adding all client settings

521

for setting, value in settings.iteritems():

522

setattr(self, setting, value)

523

524

if self.enabled:

525

if not hasattr(self, "last_enabled"):

526

self.last_enabled = datetime.datetime.utcnow()

527

if not hasattr(self, "expires"):

528

self.expires = (datetime.datetime.utcnow()

529

+ self.timeout)

530

else:

531

self.last_enabled = None

532

self.expires = None

533

333

534

logger.debug("Creating client %r", self.name)

334

535

# Uppercase and remove spaces from fingerprint for later

335

536

# comparison purposes with return value from the fingerprint()

336

537

# function

337

self.fingerprint = (config["fingerprint"].upper()

338

.replace(" ", ""))

339

538

logger.debug(" Fingerprint: %s", self.fingerprint)

340

if "secret" in config:

341

self.secret = config["secret"].decode("base64")

342

elif "secfile" in config:

343

with open(os.path.expanduser(os.path.expandvars

344

(config["secfile"])),

345

"rb") as secfile:

346

self.secret = secfile.read()

347

else:

348

raise TypeError("No secret or secfile for client %s"

349

% self.name)

350

self.host = config.get("host", "")

351

self.created = datetime.datetime.utcnow()

352

self.enabled = False

353

self.last_approval_request = None

354

self.last_enabled = None

355

self.last_checked_ok = None

356

self.timeout = string_to_delta(config["timeout"])

357

self.interval = string_to_delta(config["interval"])

358

self.disable_hook = disable_hook

539

self.created = settings.get("created",

540

datetime.datetime.utcnow())

541

542

# attributes specific for this server instance

359

543

self.checker = None

360

544

self.checker_initiator_tag = None

361

545

self.disable_initiator_tag = None

362

546

self.checker_callback_tag = None

363

self.checker_command = config["checker"]

364

547

self.current_checker_command = None

365

self.last_connect = None

366

self._approved = None

367

self.approved_by_default = config.get("approved_by_default",

368

True)

548

self.approved = None

369

549

self.approvals_pending = 0

370

self.approval_delay = string_to_delta(

371

config["approval_delay"])

372

self.approval_duration = string_to_delta(

373

config["approval_duration"])

374

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

550

self.changedstate = (multiprocessing_manager

551

.Condition(multiprocessing_manager

552

.Lock()))

553

self.client_structure = [attr for attr in

554

self.__dict__.iterkeys()

555

if not attr.startswith("_")]

556

self.client_structure.append("client_structure")

557

558

for name, t in inspect.getmembers(type(self),

559

lambda obj:

560

isinstance(obj,

561

property)):

562

if not name.startswith("_"):

563

self.client_structure.append(name)

375

564

565

# Send notice to process children that client state has changed

376

566

def send_changedstate(self):

377

self.changedstate.acquire()

378

self.changedstate.notify_all()

379

self.changedstate.release()

380

567

with self.changedstate:

568

self.changedstate.notify_all()

569

381

570

def enable(self):

382

571

"""Start this client's checker and timeout hooks"""

383

572

if getattr(self, "enabled", False):

384

573

# Already enabled

385

574

return

386

self.send_changedstate()

575

self.expires = datetime.datetime.utcnow() + self.timeout

576

self.enabled = True

387

577

self.last_enabled = datetime.datetime.utcnow()

578

self.init_checker()

579

self.send_changedstate()

580

581

def disable(self, quiet=True):

582

"""Disable this client."""

583

if not getattr(self, "enabled", False):

584

return False

585

if not quiet:

586

logger.info("Disabling client %s", self.name)

587

if getattr(self, "disable_initiator_tag", None) is not None:

588

gobject.source_remove(self.disable_initiator_tag)

589

self.disable_initiator_tag = None

590

self.expires = None

591

if getattr(self, "checker_initiator_tag", None) is not None:

592

gobject.source_remove(self.checker_initiator_tag)

593

self.checker_initiator_tag = None

594

self.stop_checker()

595

self.enabled = False

596

if not quiet:

597

self.send_changedstate()

598

# Do not run this again if called by a gobject.timeout_add

599

return False

600

601

def __del__(self):

602

self.disable()

603

604

def init_checker(self):

388

605

# Schedule a new checker to be started an 'interval' from now,

389

606

# and every interval from then on.

607

if self.checker_initiator_tag is not None:

608

gobject.source_remove(self.checker_initiator_tag)

390

609

self.checker_initiator_tag = (gobject.timeout_add

391

610

(self.interval_milliseconds(),

392

611

self.start_checker))

393

612

# Schedule a disable() when 'timeout' has passed

613

if self.disable_initiator_tag is not None:

614

gobject.source_remove(self.disable_initiator_tag)

394

615

self.disable_initiator_tag = (gobject.timeout_add

395

616

(self.timeout_milliseconds(),

396

617

self.disable))

397

self.enabled = True

398

618

# Also start a new checker *right now*.

399

619

self.start_checker()

400

620

401

def disable(self, quiet=True):

402

"""Disable this client."""

403

if not getattr(self, "enabled", False):

404

return False

405

if not quiet:

406

self.send_changedstate()

407

if not quiet:

408

logger.info("Disabling client %s", self.name)

409

if getattr(self, "disable_initiator_tag", False):

410

gobject.source_remove(self.disable_initiator_tag)

411

self.disable_initiator_tag = None

412

if getattr(self, "checker_initiator_tag", False):

413

gobject.source_remove(self.checker_initiator_tag)

414

self.checker_initiator_tag = None

415

self.stop_checker()

416

if self.disable_hook:

417

self.disable_hook(self)

418

self.enabled = False

419

# Do not run this again if called by a gobject.timeout_add

420

return False

421

422

def __del__(self):

423

self.disable_hook = None

424

self.disable()

425

426

621

def checker_callback(self, pid, condition, command):

427

622

"""The checker has completed, so take appropriate actions."""

428

623

self.checker_callback_tag = None

429

624

self.checker = None

430

625

if os.WIFEXITED(condition):

431

exitstatus = os.WEXITSTATUS(condition)

432

if exitstatus == 0:

626

self.last_checker_status = os.WEXITSTATUS(condition)

627

if self.last_checker_status == 0:

433

628

logger.info("Checker for %(name)s succeeded",

434

629

vars(self))

435

630

self.checked_ok()

437

632

logger.info("Checker for %(name)s failed",

438

633

vars(self))

439

634

else:

635

self.last_checker_status = -1

440

636

logger.warning("Checker for %(name)s crashed?",

441

637

vars(self))

442

638

443

639

def checked_ok(self):

444

"""Bump up the timeout for this client.

445

446

This should only be called when the client has been seen,

447

alive and well.

448

"""

640

"""Assert that the client has been seen, alive and well."""

449

641

self.last_checked_ok = datetime.datetime.utcnow()

450

gobject.source_remove(self.disable_initiator_tag)

451

self.disable_initiator_tag = (gobject.timeout_add

452

(self.timeout_milliseconds(),

453

self.disable))

642

self.last_checker_status = 0

643

self.bump_timeout()

644

645

def bump_timeout(self, timeout=None):

646

"""Bump up the timeout for this client."""

647

if timeout is None:

648

timeout = self.timeout

649

if self.disable_initiator_tag is not None:

650

gobject.source_remove(self.disable_initiator_tag)

651

self.disable_initiator_tag = None

652

if getattr(self, "enabled", False):

653

self.disable_initiator_tag = (gobject.timeout_add

654

(timedelta_to_milliseconds

655

(timeout), self.disable))

656

self.expires = datetime.datetime.utcnow() + timeout

454

657

455

658

def need_approval(self):

456

659

self.last_approval_request = datetime.datetime.utcnow()

461

664

If a checker already exists, leave it running and do

462

665

nothing."""

463

666

# The reason for not killing a running checker is that if we

464

# did that, then if a checker (for some reason) started

465

# running slowly and taking more than 'interval' time, the

466

# client would inevitably timeout, since no checker would get

467

# a chance to run to completion. If we instead leave running

667

# did that, and if a checker (for some reason) started running

668

# slowly and taking more than 'interval' time, then the client

669

# would inevitably timeout, since no checker would get a

670

# chance to run to completion. If we instead leave running

468

671

# checkers alone, the checker would have to take more time

469

672

# than 'timeout' for the client to be disabled, which is as it

470

673

# should be.

496

699

'replace')))

497

700

for attr in

498

701

self.runtime_expansions)

499

702

500

703

try:

501

704

command = self.checker_command % escaped_attrs

502

705

except TypeError as error:

503

logger.error('Could not format string "%s":'

504

' %s', self.checker_command, error)

706

logger.error('Could not format string "%s"',

707

self.checker_command, exc_info=error)

505

708

return True # Try again later

506

709

self.current_checker_command = command

507

710

try:

525

728

gobject.source_remove(self.checker_callback_tag)

526

729

self.checker_callback(pid, status, command)

527

730

except OSError as error:

528

logger.error("Failed to start subprocess: %s",

529

error)

731

logger.error("Failed to start subprocess",

732

exc_info=error)

530

733

# Re-run this periodically if run by gobject.timeout_add

531

734

return True

532

735

539

742

return

540

743

logger.debug("Stopping checker for %(name)s", vars(self))

541

744

try:

542

os.kill(self.checker.pid, signal.SIGTERM)

745

self.checker.terminate()

543

746

#time.sleep(0.5)

544

747

#if self.checker.poll() is None:

545

# os.kill(self.checker.pid, signal.SIGKILL)

748

# self.checker.kill()

546

749

except OSError as error:

547

750

if error.errno != errno.ESRCH: # No such process

548

751

raise

549

752

self.checker = None

550

753

754

551

755

def dbus_service_property(dbus_interface, signature="v",

552

756

access="readwrite", byte_arrays=False):

553

757

"""Decorators for marking methods of a DBusObjectWithProperties to

564

768

# "Set" method, so we fail early here:

565

769

if byte_arrays and signature != "ay":

566

770

raise ValueError("Byte arrays not supported for non-'ay'"

567

" signature %r" % signature)

771

" signature {0!r}".format(signature))

568

772

def decorator(func):

569

773

func._dbus_is_property = True

570

774

func._dbus_interface = dbus_interface

578

782

return decorator

579

783

580

784

785

def dbus_interface_annotations(dbus_interface):

786

"""Decorator for marking functions returning interface annotations

787

788

Usage:

789

790

@dbus_interface_annotations("org.example.Interface")

791

def _foo(self): # Function name does not matter

792

return {"org.freedesktop.DBus.Deprecated": "true",

793

"org.freedesktop.DBus.Property.EmitsChangedSignal":

794

"false"}

795

"""

796

def decorator(func):

797

func._dbus_is_interface = True

798

func._dbus_interface = dbus_interface

799

func._dbus_name = dbus_interface

800

return func

801

return decorator

802

803

804

def dbus_annotations(annotations):

805

"""Decorator to annotate D-Bus methods, signals or properties

806

Usage:

807

808

@dbus_service_property("org.example.Interface", signature="b",

809

access="r")

810

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

811

"org.freedesktop.DBus.Property."

812

"EmitsChangedSignal": "false"})

813

def Property_dbus_property(self):

814

return dbus.Boolean(False)

815

"""

816

def decorator(func):

817

func._dbus_annotations = annotations

818

return func

819

return decorator

820

821

581

822

class DBusPropertyException(dbus.exceptions.DBusException):

582

823

"""A base class for D-Bus property-related exceptions

583

824

"""

599

840

600

841

class DBusObjectWithProperties(dbus.service.Object):

601

842

"""A D-Bus object with properties.

602

843

603

844

Classes inheriting from this can use the dbus_service_property

604

845

decorator to expose methods as D-Bus properties. It exposes the

605

846

standard Get(), Set(), and GetAll() methods on the D-Bus.

606

847

"""

607

848

608

849

@staticmethod

609

def _is_dbus_property(obj):

610

return getattr(obj, "_dbus_is_property", False)

850

def _is_dbus_thing(thing):

851

"""Returns a function testing if an attribute is a D-Bus thing

852

853

If called like _is_dbus_thing("method") it returns a function

854

suitable for use as predicate to inspect.getmembers().

855

"""

856

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

857

False)

611

858

612

def _get_all_dbus_properties(self):

859

def _get_all_dbus_things(self, thing):

613

860

"""Returns a generator of (name, attribute) pairs

614

861

"""

615

return ((prop._dbus_name, prop)

616

for name, prop in

617

inspect.getmembers(self, self._is_dbus_property))

862

return ((getattr(athing.__get__(self), "_dbus_name",

863

name),

864

athing.__get__(self))

865

for cls in self.__class__.__mro__

866

for name, athing in

867

inspect.getmembers(cls,

868

self._is_dbus_thing(thing)))

618

869

619

870

def _get_dbus_property(self, interface_name, property_name):

620

871

"""Returns a bound method if one exists which is a D-Bus

621

872

property with the specified name and interface.

622

873

"""

623

for name in (property_name,

624

property_name + "_dbus_property"):

625

prop = getattr(self, name, None)

626

if (prop is None

627

or not self._is_dbus_property(prop)

628

or prop._dbus_name != property_name

629

or (interface_name and prop._dbus_interface

630

and interface_name != prop._dbus_interface)):

631

continue

632

return prop

874

for cls in self.__class__.__mro__:

875

for name, value in (inspect.getmembers

876

(cls,

877

self._is_dbus_thing("property"))):

878

if (value._dbus_name == property_name

879

and value._dbus_interface == interface_name):

880

return value.__get__(self)

881

633

882

# No such property

634

883

raise DBusPropertyNotFound(self.dbus_object_path + ":"

635

884

+ interface_name + "."

660

909

# signatures other than "ay".

661

910

if prop._dbus_signature != "ay":

662

911

raise ValueError

663

value = dbus.ByteArray(''.join(unichr(byte)

664

for byte in value))

912

value = dbus.ByteArray(b''.join(chr(byte)

913

for byte in value))

665

914

prop(value)

666

915

667

916

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

669

918

def GetAll(self, interface_name):

670

919

"""Standard D-Bus property GetAll() method, see D-Bus

671

920

standard.

672

921

673

922

Note: Will not include properties with access="write".

674

923

"""

675

all = {}

676

for name, prop in self._get_all_dbus_properties():

924

properties = {}

925

for name, prop in self._get_all_dbus_things("property"):

677

926

if (interface_name

678

927

and interface_name != prop._dbus_interface):

679

928

# Interface non-empty but did not match

683

932

continue

684

933

value = prop()

685

934

if not hasattr(value, "variant_level"):

686

all[name] = value

935

properties[name] = value

687

936

continue

688

all[name] = type(value)(value, variant_level=

689

value.variant_level+1)

690

return dbus.Dictionary(all, signature="sv")

937

properties[name] = type(value)(value, variant_level=

938

value.variant_level+1)

939

return dbus.Dictionary(properties, signature="sv")

691

940

692

941

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

693

942

out_signature="s",

694

943

path_keyword='object_path',

695

944

connection_keyword='connection')

696

945

def Introspect(self, object_path, connection):

697

"""Standard D-Bus method, overloaded to insert property tags.

946

"""Overloading of standard D-Bus method.

947

948

Inserts property tags and interface annotation tags.

698

949

"""

699

950

xmlstring = dbus.service.Object.Introspect(self, object_path,

700

951

connection)

707

958

e.setAttribute("access", prop._dbus_access)

708

959

return e

709

960

for if_tag in document.getElementsByTagName("interface"):

961

# Add property tags

710

962

for tag in (make_tag(document, name, prop)

711

963

for name, prop

712

in self._get_all_dbus_properties()

964

in self._get_all_dbus_things("property")

713

965

if prop._dbus_interface

714

966

== if_tag.getAttribute("name")):

715

967

if_tag.appendChild(tag)

968

# Add annotation tags

969

for typ in ("method", "signal", "property"):

970

for tag in if_tag.getElementsByTagName(typ):

971

annots = dict()

972

for name, prop in (self.

973

_get_all_dbus_things(typ)):

974

if (name == tag.getAttribute("name")

975

and prop._dbus_interface

976

== if_tag.getAttribute("name")):

977

annots.update(getattr

978

(prop,

979

"_dbus_annotations",

980

{}))

981

for name, value in annots.iteritems():

982

ann_tag = document.createElement(

983

"annotation")

984

ann_tag.setAttribute("name", name)

985

ann_tag.setAttribute("value", value)

986

tag.appendChild(ann_tag)

987

# Add interface annotation tags

988

for annotation, value in dict(

989

itertools.chain.from_iterable(

990

annotations().iteritems()

991

for name, annotations in

992

self._get_all_dbus_things("interface")

993

if name == if_tag.getAttribute("name")

994

)).iteritems():

995

ann_tag = document.createElement("annotation")

996

ann_tag.setAttribute("name", annotation)

997

ann_tag.setAttribute("value", value)

998

if_tag.appendChild(ann_tag)

716

999

# Add the names to the return values for the

717

1000

# "org.freedesktop.DBus.Properties" methods

718

1001

if (if_tag.getAttribute("name")

733

1016

except (AttributeError, xml.dom.DOMException,

734

1017

xml.parsers.expat.ExpatError) as error:

735

1018

logger.error("Failed to override Introspection method",

736

error)

1019

exc_info=error)

737

1020

return xmlstring

738

1021

739

1022

1023

def datetime_to_dbus (dt, variant_level=0):

1024

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1025

if dt is None:

1026

return dbus.String("", variant_level = variant_level)

1027

return dbus.String(dt.isoformat(),

1028

variant_level=variant_level)

1029

1030

1031

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1032

"""A class decorator; applied to a subclass of

1033

dbus.service.Object, it will add alternate D-Bus attributes with

1034

interface names according to the "alt_interface_names" mapping.

1035

Usage:

1036

1037

@alternate_dbus_names({"org.example.Interface":

1038

"net.example.AlternateInterface"})

1039

class SampleDBusObject(dbus.service.Object):

1040

@dbus.service.method("org.example.Interface")

1041

def SampleDBusMethod():

1042

pass

1043

1044

The above "SampleDBusMethod" on "SampleDBusObject" will be

1045

reachable via two interfaces: "org.example.Interface" and

1046

"net.example.AlternateInterface", the latter of which will have

1047

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1048

"true", unless "deprecate" is passed with a False value.

1049

1050

This works for methods and signals, and also for D-Bus properties

1051

(from DBusObjectWithProperties) and interfaces (from the

1052

dbus_interface_annotations decorator).

1053

"""

1054

def wrapper(cls):

1055

for orig_interface_name, alt_interface_name in (

1056

alt_interface_names.iteritems()):

1057

attr = {}

1058

interface_names = set()

1059

# Go though all attributes of the class

1060

for attrname, attribute in inspect.getmembers(cls):

1061

# Ignore non-D-Bus attributes, and D-Bus attributes

1062

# with the wrong interface name

1063

if (not hasattr(attribute, "_dbus_interface")

1064

or not attribute._dbus_interface

1065

.startswith(orig_interface_name)):

1066

continue

1067

# Create an alternate D-Bus interface name based on

1068

# the current name

1069

alt_interface = (attribute._dbus_interface

1070

.replace(orig_interface_name,

1071

alt_interface_name))

1072

interface_names.add(alt_interface)

1073

# Is this a D-Bus signal?

1074

if getattr(attribute, "_dbus_is_signal", False):

1075

# Extract the original non-method function by

1076

# black magic

1077

nonmethod_func = (dict(

1078

zip(attribute.func_code.co_freevars,

1079

attribute.__closure__))["func"]

1080

.cell_contents)

1081

# Create a new, but exactly alike, function

1082

# object, and decorate it to be a new D-Bus signal

1083

# with the alternate D-Bus interface name

1084

new_function = (dbus.service.signal

1085

(alt_interface,

1086

attribute._dbus_signature)

1087

(types.FunctionType(

1088

nonmethod_func.func_code,

1089

nonmethod_func.func_globals,

1090

nonmethod_func.func_name,

1091

nonmethod_func.func_defaults,

1092

nonmethod_func.func_closure)))

1093

# Copy annotations, if any

1094

try:

1095

new_function._dbus_annotations = (

1096

dict(attribute._dbus_annotations))

1097

except AttributeError:

1098

pass

1099

# Define a creator of a function to call both the

1100

# original and alternate functions, so both the

1101

# original and alternate signals gets sent when

1102

# the function is called

1103

def fixscope(func1, func2):

1104

"""This function is a scope container to pass

1105

func1 and func2 to the "call_both" function

1106

outside of its arguments"""

1107

def call_both(*args, **kwargs):

1108

"""This function will emit two D-Bus

1109

signals by calling func1 and func2"""

1110

func1(*args, **kwargs)

1111

func2(*args, **kwargs)

1112

return call_both

1113

# Create the "call_both" function and add it to

1114

# the class

1115

attr[attrname] = fixscope(attribute, new_function)

1116

# Is this a D-Bus method?

1117

elif getattr(attribute, "_dbus_is_method", False):

1118

# Create a new, but exactly alike, function

1119

# object. Decorate it to be a new D-Bus method

1120

# with the alternate D-Bus interface name. Add it

1121

# to the class.

1122

attr[attrname] = (dbus.service.method

1123

(alt_interface,

1124

attribute._dbus_in_signature,

1125

attribute._dbus_out_signature)

1126

(types.FunctionType

1127

(attribute.func_code,

1128

attribute.func_globals,

1129

attribute.func_name,

1130

attribute.func_defaults,

1131

attribute.func_closure)))

1132

# Copy annotations, if any

1133

try:

1134

attr[attrname]._dbus_annotations = (

1135

dict(attribute._dbus_annotations))

1136

except AttributeError:

1137

pass

1138

# Is this a D-Bus property?

1139

elif getattr(attribute, "_dbus_is_property", False):

1140

# Create a new, but exactly alike, function

1141

# object, and decorate it to be a new D-Bus

1142

# property with the alternate D-Bus interface

1143

# name. Add it to the class.

1144

attr[attrname] = (dbus_service_property

1145

(alt_interface,

1146

attribute._dbus_signature,

1147

attribute._dbus_access,

1148

attribute

1149

._dbus_get_args_options

1150

["byte_arrays"])

1151

(types.FunctionType

1152

(attribute.func_code,

1153

attribute.func_globals,

1154

attribute.func_name,

1155

attribute.func_defaults,

1156

attribute.func_closure)))

1157

# Copy annotations, if any

1158

try:

1159

attr[attrname]._dbus_annotations = (

1160

dict(attribute._dbus_annotations))

1161

except AttributeError:

1162

pass

1163

# Is this a D-Bus interface?

1164

elif getattr(attribute, "_dbus_is_interface", False):

1165

# Create a new, but exactly alike, function

1166

# object. Decorate it to be a new D-Bus interface

1167

# with the alternate D-Bus interface name. Add it

1168

# to the class.

1169

attr[attrname] = (dbus_interface_annotations

1170

(alt_interface)

1171

(types.FunctionType

1172

(attribute.func_code,

1173

attribute.func_globals,

1174

attribute.func_name,

1175

attribute.func_defaults,

1176

attribute.func_closure)))

1177

if deprecate:

1178

# Deprecate all alternate interfaces

1179

iname="_AlternateDBusNames_interface_annotation{0}"

1180

for interface_name in interface_names:

1181

@dbus_interface_annotations(interface_name)

1182

def func(self):

1183

return { "org.freedesktop.DBus.Deprecated":

1184

"true" }

1185

# Find an unused name

1186

for aname in (iname.format(i)

1187

for i in itertools.count()):

1188

if aname not in attr:

1189

attr[aname] = func

1190

break

1191

if interface_names:

1192

# Replace the class with a new subclass of it with

1193

# methods, signals, etc. as created above.

1194

cls = type(b"{0}Alternate".format(cls.__name__),

1195

(cls,), attr)

1196

return cls

1197

return wrapper

1198

1199

1200

@alternate_dbus_interfaces({"se.recompile.Mandos":

1201

"se.bsnet.fukt.Mandos"})

740

1202

class ClientDBus(Client, DBusObjectWithProperties):

741

1203

"""A Client class using D-Bus

742

1204

751

1213

# dbus.service.Object doesn't use super(), so we can't either.

752

1214

753

1215

def __init__(self, bus = None, *args, **kwargs):

754

self._approvals_pending = 0

755

1216

self.bus = bus

756

1217

Client.__init__(self, *args, **kwargs)

757

1218

# Only now, when this client is initialized, can it show up on

763

1224

("/clients/" + client_object_name))

764

1225

DBusObjectWithProperties.__init__(self, self.bus,

765

1226

self.dbus_object_path)

766

767

def _get_approvals_pending(self):

768

return self._approvals_pending

769

def _set_approvals_pending(self, value):

770

old_value = self._approvals_pending

771

self._approvals_pending = value

772

bval = bool(value)

773

if (hasattr(self, "dbus_object_path")

774

and bval is not bool(old_value)):

775

dbus_bool = dbus.Boolean(bval, variant_level=1)

776

self.PropertyChanged(dbus.String("ApprovalPending"),

777

dbus_bool)

778

779

approvals_pending = property(_get_approvals_pending,

780

_set_approvals_pending)

781

del _get_approvals_pending, _set_approvals_pending

782

783

@staticmethod

784

def _datetime_to_dbus(dt, variant_level=0):

785

"""Convert a UTC datetime.datetime() to a D-Bus type."""

786

return dbus.String(dt.isoformat(),

787

variant_level=variant_level)

788

789

def enable(self):

790

oldstate = getattr(self, "enabled", False)

791

r = Client.enable(self)

792

if oldstate != self.enabled:

793

# Emit D-Bus signals

794

self.PropertyChanged(dbus.String("Enabled"),

795

dbus.Boolean(True, variant_level=1))

796

self.PropertyChanged(

797

dbus.String("LastEnabled"),

798

self._datetime_to_dbus(self.last_enabled,

799

variant_level=1))

800

return r

801

802

def disable(self, quiet = False):

803

oldstate = getattr(self, "enabled", False)

804

r = Client.disable(self, quiet=quiet)

805

if not quiet and oldstate != self.enabled:

806

# Emit D-Bus signal

807

self.PropertyChanged(dbus.String("Enabled"),

808

dbus.Boolean(False, variant_level=1))

809

return r

1227

1228

def notifychangeproperty(transform_func,

1229

dbus_name, type_func=lambda x: x,

1230

variant_level=1):

1231

""" Modify a variable so that it's a property which announces

1232

its changes to DBus.

1233

1234

transform_fun: Function that takes a value and a variant_level

1235

and transforms it to a D-Bus type.

1236

dbus_name: D-Bus name of the variable

1237

type_func: Function that transform the value before sending it

1238

to the D-Bus. Default: no transform

1239

variant_level: D-Bus variant level. Default: 1

1240

"""

1241

attrname = "_{0}".format(dbus_name)

1242

def setter(self, value):

1243

if hasattr(self, "dbus_object_path"):

1244

if (not hasattr(self, attrname) or

1245

type_func(getattr(self, attrname, None))

1246

!= type_func(value)):

1247

dbus_value = transform_func(type_func(value),

1248

variant_level

1249

=variant_level)

1250

self.PropertyChanged(dbus.String(dbus_name),

1251

dbus_value)

1252

setattr(self, attrname, value)

1253

1254

return property(lambda self: getattr(self, attrname), setter)

1255

1256

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1257

approvals_pending = notifychangeproperty(dbus.Boolean,

1258

"ApprovalPending",

1259

type_func = bool)

1260

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1261

last_enabled = notifychangeproperty(datetime_to_dbus,

1262

"LastEnabled")

1263

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1264

type_func = lambda checker:

1265

checker is not None)

1266

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1267

"LastCheckedOK")

1268

last_checker_status = notifychangeproperty(dbus.Int16,

1269

"LastCheckerStatus")

1270

last_approval_request = notifychangeproperty(

1271

datetime_to_dbus, "LastApprovalRequest")

1272

approved_by_default = notifychangeproperty(dbus.Boolean,

1273

"ApprovedByDefault")

1274

approval_delay = notifychangeproperty(dbus.UInt64,

1275

"ApprovalDelay",

1276

type_func =

1277

timedelta_to_milliseconds)

1278

approval_duration = notifychangeproperty(

1279

dbus.UInt64, "ApprovalDuration",

1280

type_func = timedelta_to_milliseconds)

1281

host = notifychangeproperty(dbus.String, "Host")

1282

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1283

type_func =

1284

timedelta_to_milliseconds)

1285

extended_timeout = notifychangeproperty(

1286

dbus.UInt64, "ExtendedTimeout",

1287

type_func = timedelta_to_milliseconds)

1288

interval = notifychangeproperty(dbus.UInt64,

1289

"Interval",

1290

type_func =

1291

timedelta_to_milliseconds)

1292

checker_command = notifychangeproperty(dbus.String, "Checker")

1293

1294

del notifychangeproperty

810

1295

811

1296

def __del__(self, *args, **kwargs):

812

1297

try:

821

1306

*args, **kwargs):

822

1307

self.checker_callback_tag = None

823

1308

self.checker = None

824

# Emit D-Bus signal

825

self.PropertyChanged(dbus.String("CheckerRunning"),

826

dbus.Boolean(False, variant_level=1))

827

1309

if os.WIFEXITED(condition):

828

1310

exitstatus = os.WEXITSTATUS(condition)

829

1311

# Emit D-Bus signal

839

1321

return Client.checker_callback(self, pid, condition, command,

840

1322

*args, **kwargs)

841

1323

842

def checked_ok(self, *args, **kwargs):

843

Client.checked_ok(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastCheckedOK"),

847

(self._datetime_to_dbus(self.last_checked_ok,

848

variant_level=1)))

849

850

def need_approval(self, *args, **kwargs):

851

r = Client.need_approval(self, *args, **kwargs)

852

# Emit D-Bus signal

853

self.PropertyChanged(

854

dbus.String("LastApprovalRequest"),

855

(self._datetime_to_dbus(self.last_approval_request,

856

variant_level=1)))

857

return r

858

859

1324

def start_checker(self, *args, **kwargs):

860

1325

old_checker = self.checker

861

1326

if self.checker is not None:

868

1333

and old_checker_pid != self.checker.pid):

869

1334

# Emit D-Bus signal

870

1335

self.CheckerStarted(self.current_checker_command)

871

self.PropertyChanged(

872

dbus.String("CheckerRunning"),

873

dbus.Boolean(True, variant_level=1))

874

1336

return r

875

1337

876

def stop_checker(self, *args, **kwargs):

877

old_checker = getattr(self, "checker", None)

878

r = Client.stop_checker(self, *args, **kwargs)

879

if (old_checker is not None

880

and getattr(self, "checker", None) is None):

881

self.PropertyChanged(dbus.String("CheckerRunning"),

882

dbus.Boolean(False, variant_level=1))

883

return r

884

885

1338

def _reset_approved(self):

886

self._approved = None

1339

self.approved = None

887

1340

return False

888

1341

889

1342

def approve(self, value=True):

890

self.send_changedstate()

891

self._approved = value

892

gobject.timeout_add(self._timedelta_to_milliseconds

1343

self.approved = value

1344

gobject.timeout_add(timedelta_to_milliseconds

893

1345

(self.approval_duration),

894

1346

self._reset_approved)

895

1347

self.send_changedstate()

896

1348

897

1349

## D-Bus methods, signals & properties

898

_interface = "se.bsnet.fukt.Mandos.Client"

1350

_interface = "se.recompile.Mandos.Client"

1351

1352

## Interfaces

1353

1354

@dbus_interface_annotations(_interface)

1355

def _foo(self):

1356

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1357

"false"}

899

1358

900

1359

## Signals

901

1360

987

1446

if value is None: # get

988

1447

return dbus.Boolean(self.approved_by_default)

989

1448

self.approved_by_default = bool(value)

990

# Emit D-Bus signal

991

self.PropertyChanged(dbus.String("ApprovedByDefault"),

992

dbus.Boolean(value, variant_level=1))

993

1449

994

1450

# ApprovalDelay - property

995

1451

@dbus_service_property(_interface, signature="t",

998

1454

if value is None: # get

999

1455

return dbus.UInt64(self.approval_delay_milliseconds())

1000

1456

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1001

# Emit D-Bus signal

1002

self.PropertyChanged(dbus.String("ApprovalDelay"),

1003

dbus.UInt64(value, variant_level=1))

1004

1457

1005

1458

# ApprovalDuration - property

1006

1459

@dbus_service_property(_interface, signature="t",

1007

1460

access="readwrite")

1008

1461

def ApprovalDuration_dbus_property(self, value=None):

1009

1462

if value is None: # get

1010

return dbus.UInt64(self._timedelta_to_milliseconds(

1463

return dbus.UInt64(timedelta_to_milliseconds(

1011

1464

self.approval_duration))

1012

1465

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1013

# Emit D-Bus signal

1014

self.PropertyChanged(dbus.String("ApprovalDuration"),

1015

dbus.UInt64(value, variant_level=1))

1016

1466

1017

1467

# Name - property

1018

1468

@dbus_service_property(_interface, signature="s", access="read")

1030

1480

def Host_dbus_property(self, value=None):

1031

1481

if value is None: # get

1032

1482

return dbus.String(self.host)

1033

self.host = value

1034

# Emit D-Bus signal

1035

self.PropertyChanged(dbus.String("Host"),

1036

dbus.String(value, variant_level=1))

1483

self.host = unicode(value)

1037

1484

1038

1485

# Created - property

1039

1486

@dbus_service_property(_interface, signature="s", access="read")

1040

1487

def Created_dbus_property(self):

1041

return dbus.String(self._datetime_to_dbus(self.created))

1488

return datetime_to_dbus(self.created)

1042

1489

1043

1490

# LastEnabled - property

1044

1491

@dbus_service_property(_interface, signature="s", access="read")

1045

1492

def LastEnabled_dbus_property(self):

1046

if self.last_enabled is None:

1047

return dbus.String("")

1048

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1493

return datetime_to_dbus(self.last_enabled)

1049

1494

1050

1495

# Enabled - property

1051

1496

@dbus_service_property(_interface, signature="b",

1065

1510

if value is not None:

1066

1511

self.checked_ok()

1067

1512

return

1068

if self.last_checked_ok is None:

1069

return dbus.String("")

1070

return dbus.String(self._datetime_to_dbus(self

1071

.last_checked_ok))

1513

return datetime_to_dbus(self.last_checked_ok)

1514

1515

# LastCheckerStatus - property

1516

@dbus_service_property(_interface, signature="n",

1517

access="read")

1518

def LastCheckerStatus_dbus_property(self):

1519

return dbus.Int16(self.last_checker_status)

1520

1521

# Expires - property

1522

@dbus_service_property(_interface, signature="s", access="read")

1523

def Expires_dbus_property(self):

1524

return datetime_to_dbus(self.expires)

1072

1525

1073

1526

# LastApprovalRequest - property

1074

1527

@dbus_service_property(_interface, signature="s", access="read")

1075

1528

def LastApprovalRequest_dbus_property(self):

1076

if self.last_approval_request is None:

1077

return dbus.String("")

1078

return dbus.String(self.

1079

_datetime_to_dbus(self

1080

.last_approval_request))

1529

return datetime_to_dbus(self.last_approval_request)

1081

1530

1082

1531

# Timeout - property

1083

1532

@dbus_service_property(_interface, signature="t",

1085

1534

def Timeout_dbus_property(self, value=None):

1086

1535

if value is None: # get

1087

1536

return dbus.UInt64(self.timeout_milliseconds())

1537

old_timeout = self.timeout

1088

1538

self.timeout = datetime.timedelta(0, 0, 0, value)

1089

# Emit D-Bus signal

1090

self.PropertyChanged(dbus.String("Timeout"),

1091

dbus.UInt64(value, variant_level=1))

1092

if getattr(self, "disable_initiator_tag", None) is None:

1093

return

1094

# Reschedule timeout

1095

gobject.source_remove(self.disable_initiator_tag)

1096

self.disable_initiator_tag = None

1097

time_to_die = (self.

1098

_timedelta_to_milliseconds((self

1099

.last_checked_ok

1100

+ self.timeout)

1101

- datetime.datetime

1102

.utcnow()))

1103

if time_to_die <= 0:

1104

# The timeout has passed

1105

self.disable()

1106

else:

1107

self.disable_initiator_tag = (gobject.timeout_add

1108

(time_to_die, self.disable))

1539

# Reschedule disabling

1540

if self.enabled:

1541

now = datetime.datetime.utcnow()

1542

self.expires += self.timeout - old_timeout

1543

if self.expires <= now:

1544

# The timeout has passed

1545

self.disable()

1546

else:

1547

if (getattr(self, "disable_initiator_tag", None)

1548

is None):

1549

return

1550

gobject.source_remove(self.disable_initiator_tag)

1551

self.disable_initiator_tag = (

1552

gobject.timeout_add(

1553

timedelta_to_milliseconds(self.expires - now),

1554

self.disable))

1555

1556

# ExtendedTimeout - property

1557

@dbus_service_property(_interface, signature="t",

1558

access="readwrite")

1559

def ExtendedTimeout_dbus_property(self, value=None):

1560

if value is None: # get

1561

return dbus.UInt64(self.extended_timeout_milliseconds())

1562

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1109

1563

1110

1564

# Interval - property

1111

1565

@dbus_service_property(_interface, signature="t",

1114

1568

if value is None: # get

1115

1569

return dbus.UInt64(self.interval_milliseconds())

1116

1570

self.interval = datetime.timedelta(0, 0, 0, value)

1117

# Emit D-Bus signal

1118

self.PropertyChanged(dbus.String("Interval"),

1119

dbus.UInt64(value, variant_level=1))

1120

1571

if getattr(self, "checker_initiator_tag", None) is None:

1121

1572

return

1122

# Reschedule checker run

1123

gobject.source_remove(self.checker_initiator_tag)

1124

self.checker_initiator_tag = (gobject.timeout_add

1125

(value, self.start_checker))

1126

self.start_checker() # Start one now, too

1127

1573

if self.enabled:

1574

# Reschedule checker run

1575

gobject.source_remove(self.checker_initiator_tag)

1576

self.checker_initiator_tag = (gobject.timeout_add

1577

(value, self.start_checker))

1578

self.start_checker() # Start one now, too

1579

1128

1580

# Checker - property

1129

1581

@dbus_service_property(_interface, signature="s",

1130

1582

access="readwrite")

1131

1583

def Checker_dbus_property(self, value=None):

1132

1584

if value is None: # get

1133

1585

return dbus.String(self.checker_command)

1134

self.checker_command = value

1135

# Emit D-Bus signal

1136

self.PropertyChanged(dbus.String("Checker"),

1137

dbus.String(self.checker_command,

1138

variant_level=1))

1586

self.checker_command = unicode(value)

1139

1587

1140

1588

# CheckerRunning - property

1141

1589

@dbus_service_property(_interface, signature="b",

1168

1616

self._pipe.send(('init', fpr, address))

1169

1617

if not self._pipe.recv():

1170

1618

raise KeyError()

1171

1619

1172

1620

def __getattribute__(self, name):

1173

if(name == '_pipe'):

1621

if name == '_pipe':

1174

1622

return super(ProxyClient, self).__getattribute__(name)

1175

1623

self._pipe.send(('getattr', name))

1176

1624

data = self._pipe.recv()

1181

1629

self._pipe.send(('funcall', name, args, kwargs))

1182

1630

return self._pipe.recv()[1]

1183

1631

return func

1184

1632

1185

1633

def __setattr__(self, name, value):

1186

if(name == '_pipe'):

1634

if name == '_pipe':

1187

1635

return super(ProxyClient, self).__setattr__(name, value)

1188

1636

self._pipe.send(('setattr', name, value))

1189

1637

1200

1648

unicode(self.client_address))

1201

1649

logger.debug("Pipe FD: %d",

1202

1650

self.server.child_pipe.fileno())

1203

1651

1204

1652

session = (gnutls.connection

1205

1653

.ClientSession(self.request,

1206

1654

gnutls.connection

1207

1655

.X509Credentials()))

1208

1656

1209

1657

# Note: gnutls.connection.X509Credentials is really a

1210

1658

# generic GnuTLS certificate credentials object so long as

1211

1659

# no X.509 keys are added to it. Therefore, we can use it

1212

1660

# here despite using OpenPGP certificates.

1213

1661

1214

1662

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1215

1663

# "+AES-256-CBC", "+SHA1",

1216

1664

# "+COMP-NULL", "+CTYPE-OPENPGP",

1222

1670

(gnutls.library.functions

1223

1671

.gnutls_priority_set_direct(session._c_object,

1224

1672

priority, None))

1225

1673

1226

1674

# Start communication using the Mandos protocol

1227

1675

# Get protocol number

1228

1676

line = self.request.makefile().readline()

1233

1681

except (ValueError, IndexError, RuntimeError) as error:

1234

1682

logger.error("Unknown protocol version: %s", error)

1235

1683

return

1236

1684

1237

1685

# Start GnuTLS connection

1238

1686

try:

1239

1687

session.handshake()

1243

1691

# established. Just abandon the request.

1244

1692

return

1245

1693

logger.debug("Handshake succeeded")

1246

1694

1247

1695

approval_required = False

1248

1696

try:

1249

1697

try:

1254

1702

logger.warning("Bad certificate: %s", error)

1255

1703

return

1256

1704

logger.debug("Fingerprint: %s", fpr)

1257

1705

1258

1706

try:

1259

1707

client = ProxyClient(child_pipe, fpr,

1260

1708

self.client_address)

1272

1720

client.name)

1273

1721

if self.server.use_dbus:

1274

1722

# Emit D-Bus signal

1275

client.Rejected("Disabled")

1723

client.Rejected("Disabled")

1276

1724

return

1277

1725

1278

if client._approved or not client.approval_delay:

1726

if client.approved or not client.approval_delay:

1279

1727

#We are approved or approval is disabled

1280

1728

break

1281

elif client._approved is None:

1729

elif client.approved is None:

1282

1730

logger.info("Client %s needs approval",

1283

1731

client.name)

1284

1732

if self.server.use_dbus:

1295

1743

return

1296

1744

1297

1745

#wait until timeout or approved

1298

#x = float(client._timedelta_to_milliseconds(delay))

1299

1746

time = datetime.datetime.now()

1300

1747

client.changedstate.acquire()

1301

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1748

client.changedstate.wait(

1749

float(timedelta_to_milliseconds(delay)

1750

/ 1000))

1302

1751

client.changedstate.release()

1303

1752

time2 = datetime.datetime.now()

1304

1753

if (time2 - time) >= delay:

1320

1769

try:

1321

1770

sent = session.send(client.secret[sent_size:])

1322

1771

except gnutls.errors.GNUTLSError as error:

1323

logger.warning("gnutls send failed")

1772

logger.warning("gnutls send failed",

1773

exc_info=error)

1324

1774

return

1325

1775

logger.debug("Sent: %d, remaining: %d",

1326

1776

sent, len(client.secret)

1327

1777

- (sent_size + sent))

1328

1778

sent_size += sent

1329

1779

1330

1780

logger.info("Sending secret to %s", client.name)

1331

# bump the timeout as if seen

1332

client.checked_ok()

1781

# bump the timeout using extended_timeout

1782

client.bump_timeout(client.extended_timeout)

1333

1783

if self.server.use_dbus:

1334

1784

# Emit D-Bus signal

1335

1785

client.GotSecret()

1340

1790

try:

1341

1791

session.bye()

1342

1792

except gnutls.errors.GNUTLSError as error:

1343

logger.warning("GnuTLS bye failed")

1793

logger.warning("GnuTLS bye failed",

1794

exc_info=error)

1344

1795

1345

1796

@staticmethod

1346

1797

def peer_certificate(session):

1402

1853

# Convert the buffer to a Python bytestring

1403

1854

fpr = ctypes.string_at(buf, buf_len.value)

1404

1855

# Convert the bytestring to hexadecimal notation

1405

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1856

hex_fpr = binascii.hexlify(fpr).upper()

1406

1857

return hex_fpr

1407

1858

1408

1859

1411

1862

def sub_process_main(self, request, address):

1412

1863

try:

1413

1864

self.finish_request(request, address)

1414

except:

1865

except Exception:

1415

1866

self.handle_error(request, address)

1416

1867

self.close_request(request)

1417

1868

1418

1869

def process_request(self, request, address):

1419

1870

"""Start a new process to process the request."""

1420

multiprocessing.Process(target = self.sub_process_main,

1421

args = (request, address)).start()

1871

proc = multiprocessing.Process(target = self.sub_process_main,

1872

args = (request, address))

1873

proc.start()

1874

return proc

1875

1422

1876

1423

1877

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1424

1878

""" adds a pipe to the MixIn """

1428

1882

This function creates a new pipe in self.pipe

1429

1883

"""

1430

1884

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1431

1432

super(MultiprocessingMixInWithPipe,

1433

self).process_request(request, client_address)

1885

1886

proc = MultiprocessingMixIn.process_request(self, request,

1887

client_address)

1434

1888

self.child_pipe.close()

1435

self.add_pipe(parent_pipe)

1436

1437

def add_pipe(self, parent_pipe):

1889

self.add_pipe(parent_pipe, proc)

1890

1891

def add_pipe(self, parent_pipe, proc):

1438

1892

"""Dummy function; override as necessary"""

1439

1893

raise NotImplementedError

1440

1894

1895

1441

1896

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1442

1897

socketserver.TCPServer, object):

1443

1898

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1517

1972

self.enabled = False

1518

1973

self.clients = clients

1519

1974

if self.clients is None:

1520

self.clients = set()

1975

self.clients = {}

1521

1976

self.use_dbus = use_dbus

1522

1977

self.gnutls_priority = gnutls_priority

1523

1978

IPv6_TCPServer.__init__(self, server_address,

1527

1982

def server_activate(self):

1528

1983

if self.enabled:

1529

1984

return socketserver.TCPServer.server_activate(self)

1985

1530

1986

def enable(self):

1531

1987

self.enabled = True

1532

def add_pipe(self, parent_pipe):

1988

1989

def add_pipe(self, parent_pipe, proc):

1533

1990

# Call "handle_ipc" for both data and EOF events

1534

1991

gobject.io_add_watch(parent_pipe.fileno(),

1535

1992

gobject.IO_IN | gobject.IO_HUP,

1536

1993

functools.partial(self.handle_ipc,

1537

parent_pipe = parent_pipe))

1538

1994

parent_pipe =

1995

parent_pipe,

1996

proc = proc))

1997

1539

1998

def handle_ipc(self, source, condition, parent_pipe=None,

1540

client_object=None):

1541

condition_names = {

1542

gobject.IO_IN: "IN", # There is data to read.

1543

gobject.IO_OUT: "OUT", # Data can be written (without

1544

# blocking).

1545

gobject.IO_PRI: "PRI", # There is urgent data to read.

1546

gobject.IO_ERR: "ERR", # Error condition.

1547

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1548

# broken, usually for pipes and

1549

# sockets).

1550

}

1551

conditions_string = ' | '.join(name

1552

for cond, name in

1553

condition_names.iteritems()

1554

if cond & condition)

1555

# error or the other end of multiprocessing.Pipe has closed

1556

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1999

proc = None, client_object=None):

2000

# error, or the other end of multiprocessing.Pipe has closed

2001

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2002

# Wait for other process to exit

2003

proc.join()

1557

2004

return False

1558

2005

1559

2006

# Read a request from the child

1564

2011

fpr = request[1]

1565

2012

address = request[2]

1566

2013

1567

for c in self.clients:

2014

for c in self.clients.itervalues():

1568

2015

if c.fingerprint == fpr:

1569

2016

client = c

1570

2017

break

1573

2020

"dress: %s", fpr, address)

1574

2021

if self.use_dbus:

1575

2022

# Emit D-Bus signal

1576

mandos_dbus_service.ClientNotFound(fpr, address[0])

2023

mandos_dbus_service.ClientNotFound(fpr,

2024

address[0])

1577

2025

parent_pipe.send(False)

1578

2026

return False

1579

2027

1580

2028

gobject.io_add_watch(parent_pipe.fileno(),

1581

2029

gobject.IO_IN | gobject.IO_HUP,

1582

2030

functools.partial(self.handle_ipc,

1583

parent_pipe = parent_pipe,

1584

client_object = client))

2031

parent_pipe =

2032

parent_pipe,

2033

proc = proc,

2034

client_object =

2035

client))

1585

2036

parent_pipe.send(True)

1586

# remove the old hook in favor of the new above hook on same fileno

2037

# remove the old hook in favor of the new above hook on

2038

# same fileno

1587

2039

return False

1588

2040

if command == 'funcall':

1589

2041

funcname = request[1]

1590

2042

args = request[2]

1591

2043

kwargs = request[3]

1592

2044

1593

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1594

2045

parent_pipe.send(('data', getattr(client_object,

2046

funcname)(*args,

2047

**kwargs)))

2048

1595

2049

if command == 'getattr':

1596

2050

attrname = request[1]

1597

2051

if callable(client_object.__getattribute__(attrname)):

1598

2052

parent_pipe.send(('function',))

1599

2053

else:

1600

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2054

parent_pipe.send(('data', client_object

2055

.__getattribute__(attrname)))

1601

2056

1602

2057

if command == 'setattr':

1603

2058

attrname = request[1]

1604

2059

value = request[2]

1605

2060

setattr(client_object, attrname, value)

1606

2061

1607

2062

return True

1608

2063

1609

2064

1639

2094

elif suffix == "w":

1640

2095

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1641

2096

else:

1642

raise ValueError("Unknown suffix %r" % suffix)

2097

raise ValueError("Unknown suffix {0!r}"

2098

.format(suffix))

1643

2099

except (ValueError, IndexError) as e:

1644

2100

raise ValueError(*(e.args))

1645

2101

timevalue += delta

1646

2102

return timevalue

1647

2103

1648

2104

1649

def if_nametoindex(interface):

1650

"""Call the C function if_nametoindex(), or equivalent

1651

1652

Note: This function cannot accept a unicode string."""

1653

global if_nametoindex

1654

try:

1655

if_nametoindex = (ctypes.cdll.LoadLibrary

1656

(ctypes.util.find_library("c"))

1657

.if_nametoindex)

1658

except (OSError, AttributeError):

1659

logger.warning("Doing if_nametoindex the hard way")

1660

def if_nametoindex(interface):

1661

"Get an interface index the hard way, i.e. using fcntl()"

1662

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1663

with contextlib.closing(socket.socket()) as s:

1664

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1665

struct.pack(str("16s16x"),

1666

interface))

1667

interface_index = struct.unpack(str("I"),

1668

ifreq[16:20])[0]

1669

return interface_index

1670

return if_nametoindex(interface)

1671

1672

1673

2105

def daemon(nochdir = False, noclose = False):

1674

2106

"""See daemon(3). Standard BSD Unix function.

1675

2107

1683

2115

sys.exit()

1684

2116

if not noclose:

1685

2117

# Close all standard open file descriptors

1686

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2118

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1687

2119

if not stat.S_ISCHR(os.fstat(null).st_mode):

1688

2120

raise OSError(errno.ENODEV,

1689

"%s not a character device"

1690

% os.path.devnull)

2121

"{0} not a character device"

2122

.format(os.devnull))

1691

2123

os.dup2(null, sys.stdin.fileno())

1692

2124

os.dup2(null, sys.stdout.fileno())

1693

2125

os.dup2(null, sys.stderr.fileno())

1702

2134

1703

2135

parser = argparse.ArgumentParser()

1704

2136

parser.add_argument("-v", "--version", action="version",

1705

version = "%%(prog)s %s" % version,

2137

version = "%(prog)s {0}".format(version),

1706

2138

help="show version number and exit")

1707

2139

parser.add_argument("-i", "--interface", metavar="IF",

1708

2140

help="Bind to interface IF")

1730

2162

" system bus interface")

1731

2163

parser.add_argument("--no-ipv6", action="store_false",

1732

2164

dest="use_ipv6", help="Do not use IPv6")

2165

parser.add_argument("--no-restore", action="store_false",

2166

dest="restore", help="Do not restore stored"

2167

" state")

2168

parser.add_argument("--statedir", metavar="DIR",

2169

help="Directory to save/restore state in")

2170

1733

2171

options = parser.parse_args()

1734

2172

1735

2173

if options.check:

1748

2186

"use_dbus": "True",

1749

2187

"use_ipv6": "True",

1750

2188

"debuglevel": "",

2189

"restore": "True",

2190

"statedir": "/var/lib/mandos"

1751

2191

}

1752

2192

1753

2193

# Parse config file for server-global settings

1770

2210

# options, if set.

1771

2211

for option in ("interface", "address", "port", "debug",

1772

2212

"priority", "servicename", "configdir",

1773

"use_dbus", "use_ipv6", "debuglevel"):

2213

"use_dbus", "use_ipv6", "debuglevel", "restore",

2214

"statedir"):

1774

2215

value = getattr(options, option)

1775

2216

if value is not None:

1776

2217

server_settings[option] = value

1788

2229

debuglevel = server_settings["debuglevel"]

1789

2230

use_dbus = server_settings["use_dbus"]

1790

2231

use_ipv6 = server_settings["use_ipv6"]

1791

2232

stored_state_path = os.path.join(server_settings["statedir"],

2233

stored_state_file)

2234

2235

if debug:

2236

initlogger(debug, logging.DEBUG)

2237

else:

2238

if not debuglevel:

2239

initlogger(debug)

2240

else:

2241

level = getattr(logging, debuglevel.upper())

2242

initlogger(debug, level)

2243

1792

2244

if server_settings["servicename"] != "Mandos":

1793

2245

syslogger.setFormatter(logging.Formatter

1794

('Mandos (%s) [%%(process)d]:'

1795

' %%(levelname)s: %%(message)s'

1796

% server_settings["servicename"]))

2246

('Mandos ({0}) [%(process)d]:'

2247

' %(levelname)s: %(message)s'

2248

.format(server_settings

2249

["servicename"])))

1797

2250

1798

2251

# Parse config file with clients

1799

client_defaults = { "timeout": "1h",

1800

"interval": "5m",

1801

"checker": "fping -q -- %%(host)s",

1802

"host": "",

1803

"approval_delay": "0s",

1804

"approval_duration": "1s",

1805

}

1806

client_config = configparser.SafeConfigParser(client_defaults)

2252

client_config = configparser.SafeConfigParser(Client

2253

.client_defaults)

1807

2254

client_config.read(os.path.join(server_settings["configdir"],

1808

2255

"clients.conf"))

1809

2256

1823

2270

pidfilename = "/var/run/mandos.pid"

1824

2271

try:

1825

2272

pidfile = open(pidfilename, "w")

1826

except IOError:

1827

logger.error("Could not open file %r", pidfilename)

2273

except IOError as e:

2274

logger.error("Could not open file %r", pidfilename,

2275

exc_info=e)

1828

2276

1829

try:

1830

uid = pwd.getpwnam("_mandos").pw_uid

1831

gid = pwd.getpwnam("_mandos").pw_gid

1832

except KeyError:

2277

for name in ("_mandos", "mandos", "nobody"):

1833

2278

try:

1834

uid = pwd.getpwnam("mandos").pw_uid

1835

gid = pwd.getpwnam("mandos").pw_gid

2279

uid = pwd.getpwnam(name).pw_uid

2280

gid = pwd.getpwnam(name).pw_gid

2281

break

1836

2282

except KeyError:

1837

try:

1838

uid = pwd.getpwnam("nobody").pw_uid

1839

gid = pwd.getpwnam("nobody").pw_gid

1840

except KeyError:

1841

uid = 65534

1842

gid = 65534

2283

continue

2284

else:

2285

uid = 65534

2286

gid = 65534

1843

2287

try:

1844

2288

os.setgid(gid)

1845

2289

os.setuid(uid)

1847

2291

if error[0] != errno.EPERM:

1848

2292

raise error

1849

2293

1850

if not debug and not debuglevel:

1851

syslogger.setLevel(logging.WARNING)

1852

console.setLevel(logging.WARNING)

1853

if debuglevel:

1854

level = getattr(logging, debuglevel.upper())

1855

syslogger.setLevel(level)

1856

console.setLevel(level)

1857

1858

2294

if debug:

1859

2295

# Enable all possible GnuTLS debugging

1860

2296

1870

2306

.gnutls_global_set_log_function(debug_gnutls))

1871

2307

1872

2308

# Redirect stdin so all checkers get /dev/null

1873

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2309

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1874

2310

os.dup2(null, sys.stdin.fileno())

1875

2311

if null > 2:

1876

2312

os.close(null)

1877

else:

1878

# No console logging

1879

logger.removeHandler(console)

1880

2313

1881

2314

# Need to fork before connecting to D-Bus

1882

2315

if not debug:

1883

2316

# Close all input and output, do double fork, etc.

1884

2317

daemon()

1885

2318

2319

gobject.threads_init()

2320

1886

2321

global main_loop

1887

2322

# From the Avahi example code

1888

DBusGMainLoop(set_as_default=True )

2323

DBusGMainLoop(set_as_default=True)

1889

2324

main_loop = gobject.MainLoop()

1890

2325

bus = dbus.SystemBus()

1891

2326

# End of Avahi example code

1892

2327

if use_dbus:

1893

2328

try:

1894

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2329

bus_name = dbus.service.BusName("se.recompile.Mandos",

1895

2330

bus, do_not_queue=True)

2331

old_bus_name = (dbus.service.BusName

2332

("se.bsnet.fukt.Mandos", bus,

2333

do_not_queue=True))

1896

2334

except dbus.exceptions.NameExistsException as e:

1897

logger.error(unicode(e) + ", disabling D-Bus")

2335

logger.error("Disabling D-Bus:", exc_info=e)

1898

2336

use_dbus = False

1899

2337

server_settings["use_dbus"] = False

1900

2338

tcp_server.use_dbus = False

1901

2339

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1902

service = AvahiService(name = server_settings["servicename"],

1903

servicetype = "_mandos._tcp",

1904

protocol = protocol, bus = bus)

2340

service = AvahiServiceToSyslog(name =

2341

server_settings["servicename"],

2342

servicetype = "_mandos._tcp",

2343

protocol = protocol, bus = bus)

1905

2344

if server_settings["interface"]:

1906

2345

service.interface = (if_nametoindex

1907

2346

(str(server_settings["interface"])))

1912

2351

client_class = Client

1913

2352

if use_dbus:

1914

2353

client_class = functools.partial(ClientDBus, bus = bus)

1915

def client_config_items(config, section):

1916

special_settings = {

1917

"approved_by_default":

1918

lambda: config.getboolean(section,

1919

"approved_by_default"),

1920

}

1921

for name, value in config.items(section):

2354

2355

client_settings = Client.config_parser(client_config)

2356

old_client_settings = {}

2357

clients_data = {}

2358

2359

# Get client data and settings from last running state.

2360

if server_settings["restore"]:

2361

try:

2362

with open(stored_state_path, "rb") as stored_state:

2363

clients_data, old_client_settings = (pickle.load

2364

(stored_state))

2365

os.remove(stored_state_path)

2366

except IOError as e:

2367

if e.errno == errno.ENOENT:

2368

logger.warning("Could not load persistent state: {0}"

2369

.format(os.strerror(e.errno)))

2370

else:

2371

logger.critical("Could not load persistent state:",

2372

exc_info=e)

2373

raise

2374

except EOFError as e:

2375

logger.warning("Could not load persistent state: "

2376

"EOFError:", exc_info=e)

2377

2378

with PGPEngine() as pgp:

2379

for client_name, client in clients_data.iteritems():

2380

# Decide which value to use after restoring saved state.

2381

# We have three different values: Old config file,

2382

# new config file, and saved state.

2383

# New config value takes precedence if it differs from old

2384

# config value, otherwise use saved state.

2385

for name, value in client_settings[client_name].items():

2386

try:

2387

# For each value in new config, check if it

2388

# differs from the old config value (Except for

2389

# the "secret" attribute)

2390

if (name != "secret" and

2391

value != old_client_settings[client_name]

2392

[name]):

2393

client[name] = value

2394

except KeyError:

2395

pass

2396

2397

# Clients who has passed its expire date can still be

2398

# enabled if its last checker was successful. Clients

2399

# whose checker succeeded before we stored its state is

2400

# assumed to have successfully run all checkers during

2401

# downtime.

2402

if client["enabled"]:

2403

if datetime.datetime.utcnow() >= client["expires"]:

2404

if not client["last_checked_ok"]:

2405

logger.warning(

2406

"disabling client {0} - Client never "

2407

"performed a successful checker"

2408

.format(client_name))

2409

client["enabled"] = False

2410

elif client["last_checker_status"] != 0:

2411

logger.warning(

2412

"disabling client {0} - Client "

2413

"last checker failed with error code {1}"

2414

.format(client_name,

2415

client["last_checker_status"]))

2416

client["enabled"] = False

2417

else:

2418

client["expires"] = (datetime.datetime

2419

.utcnow()

2420

+ client["timeout"])

2421

logger.debug("Last checker succeeded,"

2422

" keeping {0} enabled"

2423

.format(client_name))

1922

2424

try:

1923

yield (name, special_settings[name]())

1924

except KeyError:

1925

yield (name, value)

1926

1927

tcp_server.clients.update(set(

1928

client_class(name = section,

1929

config= dict(client_config_items(

1930

client_config, section)))

1931

for section in client_config.sections()))

2425

client["secret"] = (

2426

pgp.decrypt(client["encrypted_secret"],

2427

client_settings[client_name]

2428

["secret"]))

2429

except PGPError:

2430

# If decryption fails, we use secret from new settings

2431

logger.debug("Failed to decrypt {0} old secret"

2432

.format(client_name))

2433

client["secret"] = (

2434

client_settings[client_name]["secret"])

2435

2436

# Add/remove clients based on new changes made to config

2437

for client_name in (set(old_client_settings)

2438

- set(client_settings)):

2439

del clients_data[client_name]

2440

for client_name in (set(client_settings)

2441

- set(old_client_settings)):

2442

clients_data[client_name] = client_settings[client_name]

2443

2444

# Create all client objects

2445

for client_name, client in clients_data.iteritems():

2446

tcp_server.clients[client_name] = client_class(

2447

name = client_name, settings = client)

2448

1932

2449

if not tcp_server.clients:

1933

2450

logger.warning("No clients defined")

1934

2451

1935

2452

if not debug:

1936

2453

try:

1937

2454

with pidfile:

1945

2462

# "pidfile" was never created

1946

2463

pass

1947

2464

del pidfilename

1948

1949

2465

signal.signal(signal.SIGINT, signal.SIG_IGN)

1950

2466

1951

2467

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1952

2468

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1953

2469

1954

2470

if use_dbus:

1955

class MandosDBusService(dbus.service.Object):

2471

@alternate_dbus_interfaces({"se.recompile.Mandos":

2472

"se.bsnet.fukt.Mandos"})

2473

class MandosDBusService(DBusObjectWithProperties):

1956

2474

"""A D-Bus proxy object"""

1957

2475

def __init__(self):

1958

2476

dbus.service.Object.__init__(self, bus, "/")

1959

_interface = "se.bsnet.fukt.Mandos"

2477

_interface = "se.recompile.Mandos"

2478

2479

@dbus_interface_annotations(_interface)

2480

def _foo(self):

2481

return { "org.freedesktop.DBus.Property"

2482

".EmitsChangedSignal":

2483

"false"}

1960

2484

1961

2485

@dbus.service.signal(_interface, signature="o")

1962

2486

def ClientAdded(self, objpath):

1977

2501

def GetAllClients(self):

1978

2502

"D-Bus method"

1979

2503

return dbus.Array(c.dbus_object_path

1980

for c in tcp_server.clients)

2504

for c in

2505

tcp_server.clients.itervalues())

1981

2506

1982

2507

@dbus.service.method(_interface,

1983

2508

out_signature="a{oa{sv}}")

1985

2510

"D-Bus method"

1986

2511

return dbus.Dictionary(

1987

2512

((c.dbus_object_path, c.GetAll(""))

1988

for c in tcp_server.clients),

2513

for c in tcp_server.clients.itervalues()),

1989

2514

signature="oa{sv}")

1990

2515

1991

2516

@dbus.service.method(_interface, in_signature="o")

1992

2517

def RemoveClient(self, object_path):

1993

2518

"D-Bus method"

1994

for c in tcp_server.clients:

2519

for c in tcp_server.clients.itervalues():

1995

2520

if c.dbus_object_path == object_path:

1996

tcp_server.clients.remove(c)

2521

del tcp_server.clients[c.name]

1997

2522

c.remove_from_connection()

1998

2523

# Don't signal anything except ClientRemoved

1999

2524

c.disable(quiet=True)

2010

2535

"Cleanup function; run on exit"

2011

2536

service.cleanup()

2012

2537

2538

multiprocessing.active_children()

2539

if not (tcp_server.clients or client_settings):

2540

return

2541

2542

# Store client before exiting. Secrets are encrypted with key

2543

# based on what config file has. If config file is

2544

# removed/edited, old secret will thus be unrecovable.

2545

clients = {}

2546

with PGPEngine() as pgp:

2547

for client in tcp_server.clients.itervalues():

2548

key = client_settings[client.name]["secret"]

2549

client.encrypted_secret = pgp.encrypt(client.secret,

2550

key)

2551

client_dict = {}

2552

2553

# A list of attributes that can not be pickled

2554

# + secret.

2555

exclude = set(("bus", "changedstate", "secret",

2556

"checker"))

2557

for name, typ in (inspect.getmembers

2558

(dbus.service.Object)):

2559

exclude.add(name)

2560

2561

client_dict["encrypted_secret"] = (client

2562

.encrypted_secret)

2563

for attr in client.client_structure:

2564

if attr not in exclude:

2565

client_dict[attr] = getattr(client, attr)

2566

2567

clients[client.name] = client_dict

2568

del client_settings[client.name]["secret"]

2569

2570

try:

2571

with (tempfile.NamedTemporaryFile

2572

(mode='wb', suffix=".pickle", prefix='clients-',

2573

dir=os.path.dirname(stored_state_path),

2574

delete=False)) as stored_state:

2575

pickle.dump((clients, client_settings), stored_state)

2576

tempname=stored_state.name

2577

os.rename(tempname, stored_state_path)

2578

except (IOError, OSError) as e:

2579

if not debug:

2580

try:

2581

os.remove(tempname)

2582

except NameError:

2583

pass

2584

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2585

logger.warning("Could not save persistent state: {0}"

2586

.format(os.strerror(e.errno)))

2587

else:

2588

logger.warning("Could not save persistent state:",

2589

exc_info=e)

2590

raise e

2591

2592

# Delete all clients, and settings from config

2013

2593

while tcp_server.clients:

2014

client = tcp_server.clients.pop()

2594

name, client = tcp_server.clients.popitem()

2015

2595

if use_dbus:

2016

2596

client.remove_from_connection()

2017

client.disable_hook = None

2018

2597

# Don't signal anything except ClientRemoved

2019

2598

client.disable(quiet=True)

2020

2599

if use_dbus:

2021

2600

# Emit D-Bus signal

2022

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2601

mandos_dbus_service.ClientRemoved(client

2602

.dbus_object_path,

2023

2603

client.name)

2604

client_settings.clear()

2024

2605

2025

2606

atexit.register(cleanup)

2026

2607

2027

for client in tcp_server.clients:

2608

for client in tcp_server.clients.itervalues():

2028

2609

if use_dbus:

2029

2610

# Emit D-Bus signal

2030

2611

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2031

client.enable()

2612

# Need to initiate checking of clients

2613

if client.enabled:

2614

client.init_checker()

2032

2615

2033

2616

tcp_server.enable()

2034

2617

tcp_server.server_activate()

2037

2620

service.port = tcp_server.socket.getsockname()[1]

2038

2621

if use_ipv6:

2039

2622

logger.info("Now listening on address %r, port %d,"

2040

" flowinfo %d, scope_id %d"

2041

% tcp_server.socket.getsockname())

2623

" flowinfo %d, scope_id %d",

2624

*tcp_server.socket.getsockname())

2042

2625

else: # IPv4

2043

logger.info("Now listening on address %r, port %d"

2044

% tcp_server.socket.getsockname())

2626

logger.info("Now listening on address %r, port %d",

2627

*tcp_server.socket.getsockname())

2045

2628

2046

2629

#service.interface = tcp_server.socket.getsockname()[3]

2047

2630

2050

2633

try:

2051

2634

service.activate()

2052

2635

except dbus.exceptions.DBusException as error:

2053

logger.critical("DBusException: %s", error)

2636

logger.critical("D-Bus Exception", exc_info=error)

2054

2637

cleanup()

2055

2638

sys.exit(1)

2056

2639

# End of Avahi example code

2063

2646

logger.debug("Starting main loop")

2064

2647

main_loop.run()

2065

2648

except AvahiError as error:

2066

logger.critical("AvahiError: %s", error)

2649

logger.critical("Avahi Error", exc_info=error)

2067

2650

cleanup()

2068

2651

sys.exit(1)

2069

2652

except KeyboardInterrupt: