110
111
return interface_index
113
def initlogger(level=logging.WARNING):
114
def initlogger(debug, level=logging.WARNING):
114
115
"""init logger and add loglevel"""
117
syslogger = (logging.handlers.SysLogHandler
119
logging.handlers.SysLogHandler.LOG_DAEMON,
120
address = str("/dev/log")))
116
121
syslogger.setFormatter(logging.Formatter
117
122
('Mandos [%(process)d]: %(levelname)s:'
119
124
logger.addHandler(syslogger)
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
126
logger.addHandler(console)
127
console = logging.StreamHandler()
128
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
132
logger.addHandler(console)
127
133
logger.setLevel(level)
136
class PGPError(Exception):
137
"""Exception if encryption/decryption fails"""
141
class PGPEngine(object):
142
"""A simple class for OpenPGP symmetric encryption & decryption"""
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
self.gnupgargs = ['--batch',
146
'--home', self.tempdir,
154
def __exit__(self, exc_type, exc_value, traceback):
162
if self.tempdir is not None:
163
# Delete contents of tempdir
164
for root, dirs, files in os.walk(self.tempdir,
166
for filename in files:
167
os.remove(os.path.join(root, filename))
169
os.rmdir(os.path.join(root, dirname))
171
os.rmdir(self.tempdir)
174
def password_encode(self, password):
175
# Passphrase can not be empty and can not contain newlines or
176
# NUL bytes. So we prefix it and hex encode it.
177
encoded = b"mandos" + binascii.hexlify(password)
178
if len(encoded) > 2048:
179
# GnuPG can't handle long passwords, so encode differently
180
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
181
.replace(b"\n", b"\\n")
182
.replace(b"\0", b"\\x00"))
185
def encrypt(self, data, password):
186
passphrase = self.password_encode(password)
187
with tempfile.NamedTemporaryFile(dir=self.tempdir
189
passfile.write(passphrase)
191
proc = subprocess.Popen(['gpg', '--symmetric',
195
stdin = subprocess.PIPE,
196
stdout = subprocess.PIPE,
197
stderr = subprocess.PIPE)
198
ciphertext, err = proc.communicate(input = data)
199
if proc.returncode != 0:
203
def decrypt(self, data, password):
204
passphrase = self.password_encode(password)
205
with tempfile.NamedTemporaryFile(dir = self.tempdir
207
passfile.write(passphrase)
209
proc = subprocess.Popen(['gpg', '--decrypt',
213
stdin = subprocess.PIPE,
214
stdout = subprocess.PIPE,
215
stderr = subprocess.PIPE)
216
decrypted_plaintext, err = proc.communicate(input
218
if proc.returncode != 0:
220
return decrypted_plaintext
130
223
class AvahiError(Exception):
131
224
def __init__(self, value, *args, **kwargs):
132
225
self.value = value
331
435
interval: datetime.timedelta(); How often to start a new checker
332
436
last_approval_request: datetime.datetime(); (UTC) or None
333
437
last_checked_ok: datetime.datetime(); (UTC) or None
335
438
last_checker_status: integer between 0 and 255 reflecting exit
336
439
status of last checker. -1 reflects crashed
338
last_enabled: datetime.datetime(); (UTC)
440
checker, -2 means no checker completed yet.
441
last_enabled: datetime.datetime(); (UTC) or None
339
442
name: string; from the config file, used in log messages and
340
443
D-Bus identifiers
341
444
secret: bytestring; sent verbatim (over TLS) to client
342
445
timeout: datetime.timedelta(); How long from last_checked_ok
343
446
until this client is disabled
344
extended_timeout: extra long timeout when password has been sent
447
extended_timeout: extra long timeout when secret has been sent
345
448
runtime_expansions: Allowed attributes for runtime expansion.
346
449
expires: datetime.datetime(); time (UTC) when a client will be
347
450
disabled, or None
451
server_settings: The server_settings dict from main()
350
454
runtime_expansions = ("approval_delay", "approval_duration",
351
"created", "enabled", "fingerprint",
352
"host", "interval", "last_checked_ok",
455
"created", "enabled", "expires",
456
"fingerprint", "host", "interval",
457
"last_approval_request", "last_checked_ok",
353
458
"last_enabled", "name", "timeout")
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
462
"checker": "fping -q -- %%(host)s",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
355
470
def timeout_milliseconds(self):
356
471
"Return the 'timeout' attribute in milliseconds"
357
return _timedelta_to_milliseconds(self.timeout)
472
return timedelta_to_milliseconds(self.timeout)
359
474
def extended_timeout_milliseconds(self):
360
475
"Return the 'extended_timeout' attribute in milliseconds"
361
return _timedelta_to_milliseconds(self.extended_timeout)
476
return timedelta_to_milliseconds(self.extended_timeout)
363
478
def interval_milliseconds(self):
364
479
"Return the 'interval' attribute in milliseconds"
365
return _timedelta_to_milliseconds(self.interval)
480
return timedelta_to_milliseconds(self.interval)
367
482
def approval_delay_milliseconds(self):
368
return _timedelta_to_milliseconds(self.approval_delay)
370
def __init__(self, name = None, config=None):
371
"""Note: the 'checker' key in 'config' sets the
372
'checker_command' attribute and *not* the 'checker'
483
return timedelta_to_milliseconds(self.approval_delay)
486
def config_parser(config):
487
"""Construct a new dict of client settings of this form:
488
{ client_name: {setting_name: value, ...}, ...}
489
with exceptions for any special settings as defined above.
490
NOTE: Must be a pure function. Must return the same result
491
value given the same arguments.
494
for client_name in config.sections():
495
section = dict(config.items(client_name))
496
client = settings[client_name] = {}
498
client["host"] = section["host"]
499
# Reformat values from string types to Python types
500
client["approved_by_default"] = config.getboolean(
501
client_name, "approved_by_default")
502
client["enabled"] = config.getboolean(client_name,
505
client["fingerprint"] = (section["fingerprint"].upper()
507
if "secret" in section:
508
client["secret"] = section["secret"].decode("base64")
509
elif "secfile" in section:
510
with open(os.path.expanduser(os.path.expandvars
511
(section["secfile"])),
513
client["secret"] = secfile.read()
515
raise TypeError("No secret or secfile for section {0}"
517
client["timeout"] = string_to_delta(section["timeout"])
518
client["extended_timeout"] = string_to_delta(
519
section["extended_timeout"])
520
client["interval"] = string_to_delta(section["interval"])
521
client["approval_delay"] = string_to_delta(
522
section["approval_delay"])
523
client["approval_duration"] = string_to_delta(
524
section["approval_duration"])
525
client["checker_command"] = section["checker"]
526
client["last_approval_request"] = None
527
client["last_checked_ok"] = None
528
client["last_checker_status"] = -2
532
def __init__(self, settings, name = None, server_settings=None):
534
if server_settings is None:
536
self.server_settings = server_settings
537
# adding all client settings
538
for setting, value in settings.iteritems():
539
setattr(self, setting, value)
542
if not hasattr(self, "last_enabled"):
543
self.last_enabled = datetime.datetime.utcnow()
544
if not hasattr(self, "expires"):
545
self.expires = (datetime.datetime.utcnow()
548
self.last_enabled = None
377
551
logger.debug("Creating client %r", self.name)
378
552
# Uppercase and remove spaces from fingerprint for later
379
553
# comparison purposes with return value from the fingerprint()
381
self.fingerprint = (config["fingerprint"].upper()
383
555
logger.debug(" Fingerprint: %s", self.fingerprint)
384
if "secret" in config:
385
self.secret = config["secret"].decode("base64")
386
elif "secfile" in config:
387
with open(os.path.expanduser(os.path.expandvars
388
(config["secfile"])),
390
self.secret = secfile.read()
392
raise TypeError("No secret or secfile for client %s"
394
self.host = config.get("host", "")
395
self.created = datetime.datetime.utcnow()
397
self.last_approval_request = None
398
self.last_enabled = datetime.datetime.utcnow()
399
self.last_checked_ok = None
400
self.last_checker_status = None
401
self.timeout = string_to_delta(config["timeout"])
402
self.extended_timeout = string_to_delta(config
403
["extended_timeout"])
404
self.interval = string_to_delta(config["interval"])
556
self.created = settings.get("created",
557
datetime.datetime.utcnow())
559
# attributes specific for this server instance
405
560
self.checker = None
406
561
self.checker_initiator_tag = None
407
562
self.disable_initiator_tag = None
408
self.expires = datetime.datetime.utcnow() + self.timeout
409
563
self.checker_callback_tag = None
410
self.checker_command = config["checker"]
411
564
self.current_checker_command = None
412
self._approved = None
413
self.approved_by_default = config.get("approved_by_default",
415
566
self.approvals_pending = 0
416
self.approval_delay = string_to_delta(
417
config["approval_delay"])
418
self.approval_duration = string_to_delta(
419
config["approval_duration"])
420
567
self.changedstate = (multiprocessing_manager
421
568
.Condition(multiprocessing_manager
578
724
# in normal mode, that is already done by daemon(),
579
725
# and in debug mode we don't want to. (Stdin is
580
726
# always replaced by /dev/null.)
727
# The exception is when not debugging but nevertheless
728
# running in the foreground; use the previously
731
if (not self.server_settings["debug"]
732
and self.server_settings["foreground"]):
733
popen_args.update({"stdout": wnull,
581
735
self.checker = subprocess.Popen(command,
584
self.checker_callback_tag = (gobject.child_watch_add
586
self.checker_callback,
588
# The checker may have completed before the gobject
589
# watch was added. Check for this.
739
except OSError as error:
740
logger.error("Failed to start subprocess",
743
self.checker_callback_tag = (gobject.child_watch_add
745
self.checker_callback,
747
# The checker may have completed before the gobject
748
# watch was added. Check for this.
590
750
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
592
gobject.source_remove(self.checker_callback_tag)
593
self.checker_callback(pid, status, command)
594
751
except OSError as error:
595
logger.error("Failed to start subprocess: %s",
752
if error.errno == errno.ECHILD:
753
# This should never happen
754
logger.error("Child process vanished",
759
gobject.source_remove(self.checker_callback_tag)
760
self.checker_callback(pid, status, command)
597
761
# Re-run this periodically if run by gobject.timeout_add
607
771
logger.debug("Stopping checker for %(name)s", vars(self))
609
os.kill(self.checker.pid, signal.SIGTERM)
773
self.checker.terminate()
611
775
#if self.checker.poll() is None:
612
# os.kill(self.checker.pid, signal.SIGKILL)
776
# self.checker.kill()
613
777
except OSError as error:
614
778
if error.errno != errno.ESRCH: # No such process
616
780
self.checker = None
618
# Encrypts a client secret and stores it in a varible
620
def encrypt_secret(self, key):
621
# Encryption-key need to be of a specific size, so we hash
623
hasheng = hashlib.sha256()
625
encryptionkey = hasheng.digest()
627
# Create validation hash so we know at decryption if it was
629
hasheng = hashlib.sha256()
630
hasheng.update(self.secret)
631
validationhash = hasheng.digest()
634
iv = os.urandom(Crypto.Cipher.AES.block_size)
635
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
636
Crypto.Cipher.AES.MODE_CFB,
638
ciphertext = ciphereng.encrypt(validationhash+self.secret)
639
self.encrypted_secret = (ciphertext, iv)
641
# Decrypt a encrypted client secret
642
def decrypt_secret(self, key):
643
# Decryption-key need to be of a specific size, so we hash inputed key
644
hasheng = hashlib.sha256()
646
encryptionkey = hasheng.digest()
648
# Decrypt encrypted secret
649
ciphertext, iv = self.encrypted_secret
650
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
651
Crypto.Cipher.AES.MODE_CFB,
653
plain = ciphereng.decrypt(ciphertext)
655
# Validate decrypted secret to know if it was succesful
656
hasheng = hashlib.sha256()
657
validationhash = plain[:hasheng.digest_size]
658
secret = plain[hasheng.digest_size:]
659
hasheng.update(secret)
661
# if validation fails, we use key as new secret. Otherwhise,
662
# we use the decrypted secret
663
if hasheng.digest() == validationhash:
667
del self.encrypted_secret
670
783
def dbus_service_property(dbus_interface, signature="v",
824
988
e.setAttribute("access", prop._dbus_access)
826
990
for if_tag in document.getElementsByTagName("interface"):
827
992
for tag in (make_tag(document, name, prop)
829
in self._get_all_dbus_properties()
994
in self._get_all_dbus_things("property")
830
995
if prop._dbus_interface
831
996
== if_tag.getAttribute("name")):
832
997
if_tag.appendChild(tag)
998
# Add annotation tags
999
for typ in ("method", "signal", "property"):
1000
for tag in if_tag.getElementsByTagName(typ):
1002
for name, prop in (self.
1003
_get_all_dbus_things(typ)):
1004
if (name == tag.getAttribute("name")
1005
and prop._dbus_interface
1006
== if_tag.getAttribute("name")):
1007
annots.update(getattr
1009
"_dbus_annotations",
1011
for name, value in annots.iteritems():
1012
ann_tag = document.createElement(
1014
ann_tag.setAttribute("name", name)
1015
ann_tag.setAttribute("value", value)
1016
tag.appendChild(ann_tag)
1017
# Add interface annotation tags
1018
for annotation, value in dict(
1019
itertools.chain.from_iterable(
1020
annotations().iteritems()
1021
for name, annotations in
1022
self._get_all_dbus_things("interface")
1023
if name == if_tag.getAttribute("name")
1025
ann_tag = document.createElement("annotation")
1026
ann_tag.setAttribute("name", annotation)
1027
ann_tag.setAttribute("value", value)
1028
if_tag.appendChild(ann_tag)
833
1029
# Add the names to the return values for the
834
1030
# "org.freedesktop.DBus.Properties" methods
835
1031
if (if_tag.getAttribute("name")
862
1058
variant_level=variant_level)
865
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
867
"""Applied to an empty subclass of a D-Bus object, this metaclass
868
will add additional D-Bus attributes matching a certain pattern.
1061
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1062
"""A class decorator; applied to a subclass of
1063
dbus.service.Object, it will add alternate D-Bus attributes with
1064
interface names according to the "alt_interface_names" mapping.
1067
@alternate_dbus_interfaces({"org.example.Interface":
1068
"net.example.AlternateInterface"})
1069
class SampleDBusObject(dbus.service.Object):
1070
@dbus.service.method("org.example.Interface")
1071
def SampleDBusMethod():
1074
The above "SampleDBusMethod" on "SampleDBusObject" will be
1075
reachable via two interfaces: "org.example.Interface" and
1076
"net.example.AlternateInterface", the latter of which will have
1077
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1078
"true", unless "deprecate" is passed with a False value.
1080
This works for methods and signals, and also for D-Bus properties
1081
(from DBusObjectWithProperties) and interfaces (from the
1082
dbus_interface_annotations decorator).
870
def __new__(mcs, name, bases, attr):
871
# Go through all the base classes which could have D-Bus
872
# methods, signals, or properties in them
873
for base in (b for b in bases
874
if issubclass(b, dbus.service.Object)):
875
# Go though all attributes of the base class
876
for attrname, attribute in inspect.getmembers(base):
1085
for orig_interface_name, alt_interface_name in (
1086
alt_interface_names.iteritems()):
1088
interface_names = set()
1089
# Go though all attributes of the class
1090
for attrname, attribute in inspect.getmembers(cls):
877
1091
# Ignore non-D-Bus attributes, and D-Bus attributes
878
1092
# with the wrong interface name
879
1093
if (not hasattr(attribute, "_dbus_interface")
880
1094
or not attribute._dbus_interface
881
.startswith("se.recompile.Mandos")):
1095
.startswith(orig_interface_name)):
883
1097
# Create an alternate D-Bus interface name based on
884
1098
# the current name
885
1099
alt_interface = (attribute._dbus_interface
886
.replace("se.recompile.Mandos",
887
"se.bsnet.fukt.Mandos"))
1100
.replace(orig_interface_name,
1101
alt_interface_name))
1102
interface_names.add(alt_interface)
888
1103
# Is this a D-Bus signal?
889
1104
if getattr(attribute, "_dbus_is_signal", False):
890
# Extract the original non-method function by
1105
# Extract the original non-method undecorated
1106
# function by black magic
892
1107
nonmethod_func = (dict(
893
1108
zip(attribute.func_code.co_freevars,
894
1109
attribute.__closure__))["func"]
957
1184
attribute.func_name,
958
1185
attribute.func_defaults,
959
1186
attribute.func_closure)))
960
return type.__new__(mcs, name, bases, attr)
1187
# Copy annotations, if any
1189
attr[attrname]._dbus_annotations = (
1190
dict(attribute._dbus_annotations))
1191
except AttributeError:
1193
# Is this a D-Bus interface?
1194
elif getattr(attribute, "_dbus_is_interface", False):
1195
# Create a new, but exactly alike, function
1196
# object. Decorate it to be a new D-Bus interface
1197
# with the alternate D-Bus interface name. Add it
1199
attr[attrname] = (dbus_interface_annotations
1202
(attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1208
# Deprecate all alternate interfaces
1209
iname="_AlternateDBusNames_interface_annotation{0}"
1210
for interface_name in interface_names:
1211
@dbus_interface_annotations(interface_name)
1213
return { "org.freedesktop.DBus.Deprecated":
1215
# Find an unused name
1216
for aname in (iname.format(i)
1217
for i in itertools.count()):
1218
if aname not in attr:
1222
# Replace the class with a new subclass of it with
1223
# methods, signals, etc. as created above.
1224
cls = type(b"{0}Alternate".format(cls.__name__),
1230
@alternate_dbus_interfaces({"se.recompile.Mandos":
1231
"se.bsnet.fukt.Mandos"})
963
1232
class ClientDBus(Client, DBusObjectWithProperties):
964
1233
"""A Client class using D-Bus
1029
1295
checker is not None)
1030
1296
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1031
1297
"LastCheckedOK")
1298
last_checker_status = notifychangeproperty(dbus.Int16,
1299
"LastCheckerStatus")
1032
1300
last_approval_request = notifychangeproperty(
1033
1301
datetime_to_dbus, "LastApprovalRequest")
1034
1302
approved_by_default = notifychangeproperty(dbus.Boolean,
1035
1303
"ApprovedByDefault")
1036
approval_delay = notifychangeproperty(dbus.UInt16,
1304
approval_delay = notifychangeproperty(dbus.UInt64,
1037
1305
"ApprovalDelay",
1039
_timedelta_to_milliseconds)
1307
timedelta_to_milliseconds)
1040
1308
approval_duration = notifychangeproperty(
1041
dbus.UInt16, "ApprovalDuration",
1042
type_func = _timedelta_to_milliseconds)
1309
dbus.UInt64, "ApprovalDuration",
1310
type_func = timedelta_to_milliseconds)
1043
1311
host = notifychangeproperty(dbus.String, "Host")
1044
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1312
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1046
_timedelta_to_milliseconds)
1314
timedelta_to_milliseconds)
1047
1315
extended_timeout = notifychangeproperty(
1048
dbus.UInt16, "ExtendedTimeout",
1049
type_func = _timedelta_to_milliseconds)
1050
interval = notifychangeproperty(dbus.UInt16,
1316
dbus.UInt64, "ExtendedTimeout",
1317
type_func = timedelta_to_milliseconds)
1318
interval = notifychangeproperty(dbus.UInt64,
1053
_timedelta_to_milliseconds)
1321
timedelta_to_milliseconds)
1054
1322
checker_command = notifychangeproperty(dbus.String, "Checker")
1056
1324
del notifychangeproperty
1669
1929
use_ipv6: Boolean; to use IPv6 or not
1671
1931
def __init__(self, server_address, RequestHandlerClass,
1672
interface=None, use_ipv6=True):
1932
interface=None, use_ipv6=True, socketfd=None):
1933
"""If socketfd is set, use that file descriptor instead of
1934
creating a new one with socket.socket().
1673
1936
self.interface = interface
1675
1938
self.address_family = socket.AF_INET6
1939
if socketfd is not None:
1940
# Save the file descriptor
1941
self.socketfd = socketfd
1942
# Save the original socket.socket() function
1943
self.socket_socket = socket.socket
1944
# To implement --socket, we monkey patch socket.socket.
1946
# (When socketserver.TCPServer is a new-style class, we
1947
# could make self.socket into a property instead of monkey
1948
# patching socket.socket.)
1950
# Create a one-time-only replacement for socket.socket()
1951
@functools.wraps(socket.socket)
1952
def socket_wrapper(*args, **kwargs):
1953
# Restore original function so subsequent calls are
1955
socket.socket = self.socket_socket
1956
del self.socket_socket
1957
# This time only, return a new socket object from the
1958
# saved file descriptor.
1959
return socket.fromfd(self.socketfd, *args, **kwargs)
1960
# Replace socket.socket() function with wrapper
1961
socket.socket = socket_wrapper
1962
# The socketserver.TCPServer.__init__ will call
1963
# socket.socket(), which might be our replacement,
1964
# socket_wrapper(), if socketfd was set.
1676
1965
socketserver.TCPServer.__init__(self, server_address,
1677
1966
RequestHandlerClass)
1678
1968
def server_bind(self):
1679
1969
"""This overrides the normal server_bind() function
1680
1970
to bind to an interface if one was specified, and also NOT to
2123
def rfc3339_duration_to_delta(duration):
2124
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2126
>>> rfc3339_duration_to_delta("P7D")
2127
datetime.timedelta(7)
2128
>>> rfc3339_duration_to_delta("PT60S")
2129
datetime.timedelta(0, 60)
2130
>>> rfc3339_duration_to_delta("PT60M")
2131
datetime.timedelta(0, 3600)
2132
>>> rfc3339_duration_to_delta("PT24H")
2133
datetime.timedelta(1)
2134
>>> rfc3339_duration_to_delta("P1W")
2135
datetime.timedelta(7)
2136
>>> rfc3339_duration_to_delta("PT5M30S")
2137
datetime.timedelta(0, 330)
2138
>>> rfc3339_duration_to_delta("P1DT3M20S")
2139
datetime.timedelta(1, 200)
2142
# Parsing an RFC 3339 duration with regular expressions is not
2143
# possible - there would have to be multiple places for the same
2144
# values, like seconds. The current code, while more esoteric, is
2145
# cleaner without depending on a parsing library. If Python had a
2146
# built-in library for parsing we would use it, but we'd like to
2147
# avoid excessive use of external libraries.
2149
# New type for defining tokens, syntax, and semantics all-in-one
2150
Token = collections.namedtuple("Token",
2151
("regexp", # To match token; if
2152
# "value" is not None,
2153
# must have a "group"
2155
"value", # datetime.timedelta or
2157
"followers")) # Tokens valid after
2159
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2160
# the "duration" ABNF definition in RFC 3339, Appendix A.
2161
token_end = Token(re.compile(r"$"), None, frozenset())
2162
token_second = Token(re.compile(r"(\d+)S"),
2163
datetime.timedelta(seconds=1),
2164
frozenset((token_end,)))
2165
token_minute = Token(re.compile(r"(\d+)M"),
2166
datetime.timedelta(minutes=1),
2167
frozenset((token_second, token_end)))
2168
token_hour = Token(re.compile(r"(\d+)H"),
2169
datetime.timedelta(hours=1),
2170
frozenset((token_minute, token_end)))
2171
token_time = Token(re.compile(r"T"),
2173
frozenset((token_hour, token_minute,
2175
token_day = Token(re.compile(r"(\d+)D"),
2176
datetime.timedelta(days=1),
2177
frozenset((token_time, token_end)))
2178
token_month = Token(re.compile(r"(\d+)M"),
2179
datetime.timedelta(weeks=4),
2180
frozenset((token_day, token_end)))
2181
token_year = Token(re.compile(r"(\d+)Y"),
2182
datetime.timedelta(weeks=52),
2183
frozenset((token_month, token_end)))
2184
token_week = Token(re.compile(r"(\d+)W"),
2185
datetime.timedelta(weeks=1),
2186
frozenset((token_end,)))
2187
token_duration = Token(re.compile(r"P"), None,
2188
frozenset((token_year, token_month,
2189
token_day, token_time,
2191
# Define starting values
2192
value = datetime.timedelta() # Value so far
2194
followers = frozenset(token_duration,) # Following valid tokens
2195
s = duration # String left to parse
2196
# Loop until end token is found
2197
while found_token is not token_end:
2198
# Search for any currently valid tokens
2199
for token in followers:
2200
match = token.regexp.match(s)
2201
if match is not None:
2203
if token.value is not None:
2204
# Value found, parse digits
2205
factor = int(match.group(1), 10)
2206
# Add to value so far
2207
value += factor * token.value
2208
# Strip token from string
2209
s = token.regexp.sub("", s, 1)
2212
# Set valid next tokens
2213
followers = found_token.followers
2216
# No currently valid tokens were found
2217
raise ValueError("Invalid RFC 3339 duration")
1845
2222
def string_to_delta(interval):
1846
2223
"""Parse a string and return a datetime.timedelta
1939
2323
parser.add_argument("--no-dbus", action="store_false",
1940
2324
dest="use_dbus", help="Do not provide D-Bus"
1941
" system bus interface")
2325
" system bus interface", default=None)
1942
2326
parser.add_argument("--no-ipv6", action="store_false",
1943
dest="use_ipv6", help="Do not use IPv6")
2327
dest="use_ipv6", help="Do not use IPv6",
1944
2329
parser.add_argument("--no-restore", action="store_false",
1945
2330
dest="restore", help="Do not restore stored"
1946
" state", default=True)
2331
" state", default=None)
2332
parser.add_argument("--socket", type=int,
2333
help="Specify a file descriptor to a network"
2334
" socket to use instead of creating one")
2335
parser.add_argument("--statedir", metavar="DIR",
2336
help="Directory to save/restore state in")
2337
parser.add_argument("--foreground", action="store_true",
2338
help="Run in foreground", default=None)
1948
2340
options = parser.parse_args()
1950
2342
if options.check:
2344
fail_count, test_count = doctest.testmod()
2345
sys.exit(os.EX_OK if fail_count == 0 else 1)
1955
2347
# Default values for config file for server-global settings
1956
2348
server_defaults = { "interface": "",
1973
2369
# Convert the SafeConfigParser object to a dict
1974
2370
server_settings = server_config.defaults()
1975
2371
# Use the appropriate methods on the non-string config options
1976
for option in ("debug", "use_dbus", "use_ipv6"):
2372
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1977
2373
server_settings[option] = server_config.getboolean("DEFAULT",
1979
2375
if server_settings["port"]:
1980
2376
server_settings["port"] = server_config.getint("DEFAULT",
2378
if server_settings["socket"]:
2379
server_settings["socket"] = server_config.getint("DEFAULT",
2381
# Later, stdin will, and stdout and stderr might, be dup'ed
2382
# over with an opened os.devnull. But we don't want this to
2383
# happen with a supplied network socket.
2384
if 0 <= server_settings["socket"] <= 2:
2385
server_settings["socket"] = os.dup(server_settings
1982
2387
del server_config
1984
2389
# Override the settings from the config file with command line
1985
2390
# options, if set.
1986
2391
for option in ("interface", "address", "port", "debug",
1987
2392
"priority", "servicename", "configdir",
1988
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2393
"use_dbus", "use_ipv6", "debuglevel", "restore",
2394
"statedir", "socket", "foreground"):
1989
2395
value = getattr(options, option)
1990
2396
if value is not None:
1991
2397
server_settings[option] = value
2003
2416
debuglevel = server_settings["debuglevel"]
2004
2417
use_dbus = server_settings["use_dbus"]
2005
2418
use_ipv6 = server_settings["use_ipv6"]
2419
stored_state_path = os.path.join(server_settings["statedir"],
2421
foreground = server_settings["foreground"]
2008
initlogger(logging.DEBUG)
2424
initlogger(debug, logging.DEBUG)
2010
2426
if not debuglevel:
2013
2429
level = getattr(logging, debuglevel.upper())
2430
initlogger(debug, level)
2016
2432
if server_settings["servicename"] != "Mandos":
2017
2433
syslogger.setFormatter(logging.Formatter
2018
('Mandos (%s) [%%(process)d]:'
2019
' %%(levelname)s: %%(message)s'
2020
% server_settings["servicename"]))
2434
('Mandos ({0}) [%(process)d]:'
2435
' %(levelname)s: %(message)s'
2436
.format(server_settings
2022
2439
# Parse config file with clients
2023
client_defaults = { "timeout": "5m",
2024
"extended_timeout": "15m",
2026
"checker": "fping -q -- %%(host)s",
2028
"approval_delay": "0s",
2029
"approval_duration": "1s",
2031
client_config = configparser.SafeConfigParser(client_defaults)
2440
client_config = configparser.SafeConfigParser(Client
2032
2442
client_config.read(os.path.join(server_settings["configdir"],
2033
2443
"clients.conf"))
2166
2567
(stored_state))
2167
2568
os.remove(stored_state_path)
2168
2569
except IOError as e:
2169
logger.warning("Could not load persistant state: {0}"
2171
if e.errno != errno.ENOENT:
2570
if e.errno == errno.ENOENT:
2571
logger.warning("Could not load persistent state: {0}"
2572
.format(os.strerror(e.errno)))
2574
logger.critical("Could not load persistent state:",
2577
except EOFError as e:
2578
logger.warning("Could not load persistent state: "
2579
"EOFError:", exc_info=e)
2174
for client in clients_data:
2175
client_name = client["name"]
2177
# Decide which value to use after restoring saved state.
2178
# We have three different values: Old config file,
2179
# new config file, and saved state.
2180
# New config value takes precedence if it differs from old
2181
# config value, otherwise use saved state.
2182
for name, value in client_settings[client_name].items():
2581
with PGPEngine() as pgp:
2582
for client_name, client in clients_data.iteritems():
2583
# Skip removed clients
2584
if client_name not in client_settings:
2587
# Decide which value to use after restoring saved state.
2588
# We have three different values: Old config file,
2589
# new config file, and saved state.
2590
# New config value takes precedence if it differs from old
2591
# config value, otherwise use saved state.
2592
for name, value in client_settings[client_name].items():
2594
# For each value in new config, check if it
2595
# differs from the old config value (Except for
2596
# the "secret" attribute)
2597
if (name != "secret" and
2598
value != old_client_settings[client_name]
2600
client[name] = value
2604
# Clients who has passed its expire date can still be
2605
# enabled if its last checker was successful. Clients
2606
# whose checker succeeded before we stored its state is
2607
# assumed to have successfully run all checkers during
2609
if client["enabled"]:
2610
if datetime.datetime.utcnow() >= client["expires"]:
2611
if not client["last_checked_ok"]:
2613
"disabling client {0} - Client never "
2614
"performed a successful checker"
2615
.format(client_name))
2616
client["enabled"] = False
2617
elif client["last_checker_status"] != 0:
2619
"disabling client {0} - Client "
2620
"last checker failed with error code {1}"
2621
.format(client_name,
2622
client["last_checker_status"]))
2623
client["enabled"] = False
2625
client["expires"] = (datetime.datetime
2627
+ client["timeout"])
2628
logger.debug("Last checker succeeded,"
2629
" keeping {0} enabled"
2630
.format(client_name))
2184
# For each value in new config, check if it differs
2185
# from the old config value (Except for the "secret"
2187
if (name != "secret" and
2188
value != old_client_settings[client_name][name]):
2189
setattr(client, name, value)
2193
# Clients who has passed its expire date, can still be enabled
2194
# if its last checker was sucessful. Clients who checkers
2195
# failed before we stored it state is asumed to had failed
2196
# checker during downtime.
2197
if client["enabled"] and client["last_checked_ok"]:
2198
if ((datetime.datetime.utcnow()
2199
- client["last_checked_ok"]) > client["interval"]):
2200
if client["last_checker_status"] != 0:
2201
client["enabled"] = False
2203
client["expires"] = (datetime.datetime.utcnow()
2204
+ client["timeout"])
2206
client["changedstate"] = (multiprocessing_manager
2207
.Condition(multiprocessing_manager
2210
new_client = (ClientDBusTransitional.__new__
2211
(ClientDBusTransitional))
2212
tcp_server.clients[client_name] = new_client
2213
new_client.bus = bus
2214
for name, value in client.iteritems():
2215
setattr(new_client, name, value)
2216
client_object_name = unicode(client_name).translate(
2217
{ord("."): ord("_"),
2218
ord("-"): ord("_")})
2219
new_client.dbus_object_path = (dbus.ObjectPath
2221
+ client_object_name))
2222
DBusObjectWithProperties.__init__(new_client,
2227
tcp_server.clients[client_name] = Client.__new__(Client)
2228
for name, value in client.iteritems():
2229
setattr(tcp_server.clients[client_name], name, value)
2231
tcp_server.clients[client_name].decrypt_secret(
2232
client_settings[client_name]["secret"])
2234
# Create/remove clients based on new changes made to config
2235
for clientname in set(old_client_settings) - set(client_settings):
2236
del tcp_server.clients[clientname]
2237
for clientname in set(client_settings) - set(old_client_settings):
2238
tcp_server.clients[clientname] = (client_class(name
2632
client["secret"] = (
2633
pgp.decrypt(client["encrypted_secret"],
2634
client_settings[client_name]
2637
# If decryption fails, we use secret from new settings
2638
logger.debug("Failed to decrypt {0} old secret"
2639
.format(client_name))
2640
client["secret"] = (
2641
client_settings[client_name]["secret"])
2643
# Add/remove clients based on new changes made to config
2644
for client_name in (set(old_client_settings)
2645
- set(client_settings)):
2646
del clients_data[client_name]
2647
for client_name in (set(client_settings)
2648
- set(old_client_settings)):
2649
clients_data[client_name] = client_settings[client_name]
2651
# Create all client objects
2652
for client_name, client in clients_data.iteritems():
2653
tcp_server.clients[client_name] = client_class(
2654
name = client_name, settings = client,
2655
server_settings = server_settings)
2244
2657
if not tcp_server.clients:
2245
2658
logger.warning("No clients defined")
2251
pidfile.write(str(pid) + "\n".encode("utf-8"))
2254
logger.error("Could not write to file %r with PID %d",
2257
# "pidfile" was never created
2661
if pidfile is not None:
2665
pidfile.write(str(pid) + "\n".encode("utf-8"))
2667
logger.error("Could not write to file %r with PID %d",
2259
2670
del pidfilename
2261
signal.signal(signal.SIGINT, signal.SIG_IGN)
2263
2672
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2264
2673
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2267
class MandosDBusService(dbus.service.Object):
2676
@alternate_dbus_interfaces({"se.recompile.Mandos":
2677
"se.bsnet.fukt.Mandos"})
2678
class MandosDBusService(DBusObjectWithProperties):
2268
2679
"""A D-Bus proxy object"""
2269
2680
def __init__(self):
2270
2681
dbus.service.Object.__init__(self, bus, "/")
2271
2682
_interface = "se.recompile.Mandos"
2684
@dbus_interface_annotations(_interface)
2686
return { "org.freedesktop.DBus.Property"
2687
".EmitsChangedSignal":
2273
2690
@dbus.service.signal(_interface, signature="o")
2274
2691
def ClientAdded(self, objpath):
2320
class MandosDBusServiceTransitional(MandosDBusService):
2321
__metaclass__ = AlternateDBusNamesMetaclass
2322
mandos_dbus_service = MandosDBusServiceTransitional()
2737
mandos_dbus_service = MandosDBusService()
2325
2740
"Cleanup function; run on exit"
2326
2741
service.cleanup()
2328
2743
multiprocessing.active_children()
2329
2745
if not (tcp_server.clients or client_settings):
2332
2748
# Store client before exiting. Secrets are encrypted with key
2333
2749
# based on what config file has. If config file is
2334
2750
# removed/edited, old secret will thus be unrecovable.
2336
for client in tcp_server.clients.itervalues():
2337
client.encrypt_secret(client_settings[client.name]
2342
# A list of attributes that will not be stored when
2344
exclude = set(("bus", "changedstate", "secret"))
2345
for name, typ in inspect.getmembers(dbus.service.Object):
2348
client_dict["encrypted_secret"] = client.encrypted_secret
2349
for attr in client.client_structure:
2350
if attr not in exclude:
2351
client_dict[attr] = getattr(client, attr)
2353
clients.append(client_dict)
2354
del client_settings[client.name]["secret"]
2752
with PGPEngine() as pgp:
2753
for client in tcp_server.clients.itervalues():
2754
key = client_settings[client.name]["secret"]
2755
client.encrypted_secret = pgp.encrypt(client.secret,
2759
# A list of attributes that can not be pickled
2761
exclude = set(("bus", "changedstate", "secret",
2762
"checker", "server_settings"))
2763
for name, typ in (inspect.getmembers
2764
(dbus.service.Object)):
2767
client_dict["encrypted_secret"] = (client
2769
for attr in client.client_structure:
2770
if attr not in exclude:
2771
client_dict[attr] = getattr(client, attr)
2773
clients[client.name] = client_dict
2774
del client_settings[client.name]["secret"]
2357
with os.fdopen(os.open(stored_state_path,
2358
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2359
0600), "wb") as stored_state:
2777
with (tempfile.NamedTemporaryFile
2778
(mode='wb', suffix=".pickle", prefix='clients-',
2779
dir=os.path.dirname(stored_state_path),
2780
delete=False)) as stored_state:
2360
2781
pickle.dump((clients, client_settings), stored_state)
2361
except IOError as e:
2362
logger.warning("Could not save persistant state: {0}"
2364
if e.errno != errno.ENOENT:
2782
tempname=stored_state.name
2783
os.rename(tempname, stored_state_path)
2784
except (IOError, OSError) as e:
2790
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2791
logger.warning("Could not save persistent state: {0}"
2792
.format(os.strerror(e.errno)))
2794
logger.warning("Could not save persistent state:",
2367
2798
# Delete all clients, and settings from config