88
101
except ImportError:
89
102
SO_BINDTODEVICE = None
104
if sys.version_info.major == 2:
92
108
stored_state_file = "clients.pickle"
94
110
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
103
116
except (OSError, AttributeError):
104
118
def if_nametoindex(interface):
105
119
"Get an interface index the hard way, i.e. using fcntl()"
106
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
121
with contextlib.closing(socket.socket()) as s:
108
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
125
return interface_index
116
128
def initlogger(debug, level=logging.WARNING):
117
129
"""init logger and add loglevel"""
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
119
135
syslogger.setFormatter(logging.Formatter
120
136
('Mandos [%(process)d]: %(levelname)s:'
174
189
def password_encode(self, password):
175
190
# Passphrase can not be empty and can not contain newlines or
176
191
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
179
200
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
194
216
return ciphertext
196
218
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
211
234
return decrypted_plaintext
214
237
class AvahiError(Exception):
215
238
def __init__(self, value, *args, **kwargs):
216
239
self.value = value
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
240
return super(AvahiError, self).__init__(value, *args,
221
244
class AvahiServiceError(AvahiError):
224
248
class AvahiGroupError(AvahiError):
266
297
self.entry_group_state_changed_match = None
299
def rename(self, remove=True):
269
300
"""Derived from the Avahi example code"""
270
301
if self.rename_count >= self.max_renames:
271
302
logger.critical("No suitable Zeroconf service name found"
272
303
" after %i retries, exiting.",
273
304
self.rename_count)
274
305
raise AvahiServiceError("Too many renames")
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
277
309
logger.info("Changing Zeroconf service name to %r ...",
282
315
except dbus.exceptions.DBusException as error:
283
logger.critical("D-Bus Exception", exc_info=error)
286
self.rename_count += 1
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
321
logger.critical("D-Bus Exception", exc_info=error)
288
325
def remove(self):
289
326
"""Derived from the Avahi example code"""
345
381
def server_state_changed(self, state, error=None):
346
382
"""Derived from the Avahi example code"""
347
383
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
355
390
if state in bad_states:
356
391
if bad_states[state] is not None:
357
392
if error is None:
376
411
follow_name_owner_changes=True),
377
412
avahi.DBUS_INTERFACE_SERVER)
378
413
self.server.connect_to_signal("StateChanged",
379
self.server_state_changed)
414
self.server_state_changed)
380
415
self.server_state_changed(self.server.GetState())
383
418
class AvahiServiceToSyslog(AvahiService):
419
def rename(self, *args, **kwargs):
385
420
"""Add the new name to the syslog messages"""
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
421
ret = AvahiService.rename(self, *args, **kwargs)
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
401
428
class Client(object):
402
429
"""A representation of a client host served by this server.
446
474
"fingerprint", "host", "interval",
447
475
"last_approval_request", "last_checked_ok",
448
476
"last_enabled", "name", "timeout")
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
452
"checker": "fping -q -- %%(host)s",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
460
def timeout_milliseconds(self):
461
"Return the 'timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.timeout)
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
468
def interval_milliseconds(self):
469
"Return the 'interval' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.interval)
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
479
"extended_timeout": "PT15M",
481
"checker": "fping -q -- %%(host)s",
483
"approval_delay": "PT0S",
484
"approval_duration": "PT1S",
485
"approved_by_default": "True",
476
490
def config_parser(config):
551
568
self.current_checker_command = None
552
569
self.approved = None
553
570
self.approvals_pending = 0
554
self.changedstate = (multiprocessing_manager
555
.Condition(multiprocessing_manager
557
self.client_structure = [attr for attr in
558
self.__dict__.iterkeys()
571
self.changedstate = multiprocessing_manager.Condition(
572
multiprocessing_manager.Lock())
573
self.client_structure = [attr
574
for attr in self.__dict__.iterkeys()
559
575
if not attr.startswith("_")]
560
576
self.client_structure.append("client_structure")
562
for name, t in inspect.getmembers(type(self),
578
for name, t in inspect.getmembers(
579
type(self), lambda obj: isinstance(obj, property)):
566
580
if not name.startswith("_"):
567
581
self.client_structure.append(name)
610
624
# and every interval from then on.
611
625
if self.checker_initiator_tag is not None:
612
626
gobject.source_remove(self.checker_initiator_tag)
613
self.checker_initiator_tag = (gobject.timeout_add
614
(self.interval_milliseconds(),
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
616
630
# Schedule a disable() when 'timeout' has passed
617
631
if self.disable_initiator_tag is not None:
618
632
gobject.source_remove(self.disable_initiator_tag)
619
self.disable_initiator_tag = (gobject.timeout_add
620
(self.timeout_milliseconds(),
633
self.disable_initiator_tag = gobject.timeout_add(
634
int(self.timeout.total_seconds() * 1000), self.disable)
622
635
# Also start a new checker *right now*.
623
636
self.start_checker()
692
704
# Start a new checker if needed
693
705
if self.checker is None:
694
706
# Escape attributes for the shell
695
escaped_attrs = dict(
696
(attr, re.escape(unicode(getattr(self, attr))))
698
self.runtime_expansions)
708
attr: re.escape(str(getattr(self, attr)))
709
for attr in self.runtime_expansions }
700
711
command = self.checker_command % escaped_attrs
701
712
except TypeError as error:
702
713
logger.error('Could not format string "%s"',
703
self.checker_command, exc_info=error)
704
return True # Try again later
714
self.checker_command,
716
return True # Try again later
705
717
self.current_checker_command = command
707
logger.info("Starting checker %r for %s",
719
logger.info("Starting checker %r for %s", command,
709
721
# We don't need to redirect stdout and stderr, since
710
722
# in normal mode, that is already done by daemon(),
711
723
# and in debug mode we don't want to. (Stdin is
712
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
713
733
self.checker = subprocess.Popen(command,
716
738
except OSError as error:
717
739
logger.error("Failed to start subprocess",
719
self.checker_callback_tag = (gobject.child_watch_add
721
self.checker_callback,
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
723
744
# The checker may have completed before the gobject
724
745
# watch was added. Check for this.
725
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
727
756
gobject.source_remove(self.checker_callback_tag)
728
757
self.checker_callback(pid, status, command)
801
836
"""Decorator to annotate D-Bus methods, signals or properties
839
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
804
842
@dbus_service_property("org.example.Interface", signature="b",
806
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
"org.freedesktop.DBus.Property."
808
"EmitsChangedSignal": "false"})
809
844
def Property_dbus_property(self):
810
845
return dbus.Boolean(False)
812
848
def decorator(func):
813
849
func._dbus_annotations = annotations
818
855
class DBusPropertyException(dbus.exceptions.DBusException):
819
856
"""A base class for D-Bus property-related exceptions
821
def __unicode__(self):
822
return unicode(str(self))
825
861
class DBusPropertyAccessException(DBusPropertyException):
849
885
If called like _is_dbus_thing("method") it returns a function
850
886
suitable for use as predicate to inspect.getmembers().
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
855
891
def _get_all_dbus_things(self, thing):
856
892
"""Returns a generator of (name, attribute) pairs
858
return ((getattr(athing.__get__(self), "_dbus_name",
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
860
895
athing.__get__(self))
861
896
for cls in self.__class__.__mro__
862
897
for name, athing in
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
866
900
def _get_dbus_property(self, interface_name, property_name):
867
901
"""Returns a bound method if one exists which is a D-Bus
868
902
property with the specified name and interface.
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
873
self._is_dbus_thing("property"))):
904
for cls in self.__class__.__mro__:
905
for name, value in inspect.getmembers(
906
cls, self._is_dbus_thing("property")):
874
907
if (value._dbus_name == property_name
875
908
and value._dbus_interface == interface_name):
876
909
return value.__get__(self)
878
911
# No such property
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
912
raise DBusPropertyNotFound("{}:{}.{}".format(
913
self.dbus_object_path, interface_name, property_name))
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
884
917
out_signature="v")
885
918
def Get(self, interface_name, property_name):
886
919
"""Standard D-Bus property Get() method, see D-Bus standard.
1057
1101
# Ignore non-D-Bus attributes, and D-Bus attributes
1058
1102
# with the wrong interface name
1059
1103
if (not hasattr(attribute, "_dbus_interface")
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1104
or not attribute._dbus_interface.startswith(
1105
orig_interface_name)):
1063
1107
# Create an alternate D-Bus interface name based on
1064
1108
# the current name
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1109
alt_interface = attribute._dbus_interface.replace(
1110
orig_interface_name, alt_interface_name)
1068
1111
interface_names.add(alt_interface)
1069
1112
# Is this a D-Bus signal?
1070
1113
if getattr(attribute, "_dbus_is_signal", False):
1071
# Extract the original non-method function by
1114
# Extract the original non-method undecorated
1115
# function by black magic
1073
1116
nonmethod_func = (dict(
1074
zip(attribute.func_code.co_freevars,
1075
attribute.__closure__))["func"]
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1077
1120
# Create a new, but exactly alike, function
1078
1121
# object, and decorate it to be a new D-Bus signal
1079
1122
# with the alternate D-Bus interface name
1080
new_function = (dbus.service.signal
1082
attribute._dbus_signature)
1123
new_function = (dbus.service.signal(
1124
alt_interface, attribute._dbus_signature)
1083
1125
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1126
nonmethod_func.func_code,
1127
nonmethod_func.func_globals,
1128
nonmethod_func.func_name,
1129
nonmethod_func.func_defaults,
1130
nonmethod_func.func_closure)))
1089
1131
# Copy annotations, if any
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1133
new_function._dbus_annotations = dict(
1134
attribute._dbus_annotations)
1093
1135
except AttributeError:
1095
1137
# Define a creator of a function to call both the
1115
1159
# object. Decorate it to be a new D-Bus method
1116
1160
# with the alternate D-Bus interface name. Add it
1117
1161
# to the class.
1118
attr[attrname] = (dbus.service.method
1120
attribute._dbus_in_signature,
1121
attribute._dbus_out_signature)
1123
(attribute.func_code,
1124
attribute.func_globals,
1125
attribute.func_name,
1126
attribute.func_defaults,
1127
attribute.func_closure)))
1163
dbus.service.method(
1165
attribute._dbus_in_signature,
1166
attribute._dbus_out_signature)
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1128
1172
# Copy annotations, if any
1130
attr[attrname]._dbus_annotations = (
1131
dict(attribute._dbus_annotations))
1174
attr[attrname]._dbus_annotations = dict(
1175
attribute._dbus_annotations)
1132
1176
except AttributeError:
1134
1178
# Is this a D-Bus property?
1137
1181
# object, and decorate it to be a new D-Bus
1138
1182
# property with the alternate D-Bus interface
1139
1183
# name. Add it to the class.
1140
attr[attrname] = (dbus_service_property
1142
attribute._dbus_signature,
1143
attribute._dbus_access,
1145
._dbus_get_args_options
1148
(attribute.func_code,
1149
attribute.func_globals,
1150
attribute.func_name,
1151
attribute.func_defaults,
1152
attribute.func_closure)))
1184
attr[attrname] = (dbus_service_property(
1185
alt_interface, attribute._dbus_signature,
1186
attribute._dbus_access,
1187
attribute._dbus_get_args_options
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1153
1195
# Copy annotations, if any
1155
attr[attrname]._dbus_annotations = (
1156
dict(attribute._dbus_annotations))
1197
attr[attrname]._dbus_annotations = dict(
1198
attribute._dbus_annotations)
1157
1199
except AttributeError:
1159
1201
# Is this a D-Bus interface?
1162
1204
# object. Decorate it to be a new D-Bus interface
1163
1205
# with the alternate D-Bus interface name. Add it
1164
1206
# to the class.
1165
attr[attrname] = (dbus_interface_annotations
1168
(attribute.func_code,
1169
attribute.func_globals,
1170
attribute.func_name,
1171
attribute.func_defaults,
1172
attribute.func_closure)))
1208
dbus_interface_annotations(alt_interface)
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1174
1215
# Deprecate all alternate interfaces
1175
iname="_AlternateDBusNames_interface_annotation{0}"
1216
iname="_AlternateDBusNames_interface_annotation{}"
1176
1217
for interface_name in interface_names:
1177
1219
@dbus_interface_annotations(interface_name)
1178
1220
def func(self):
1179
1221
return { "org.freedesktop.DBus.Deprecated":
1181
1223
# Find an unused name
1182
1224
for aname in (iname.format(i)
1183
1225
for i in itertools.count()):
1213
1258
Client.__init__(self, *args, **kwargs)
1214
1259
# Only now, when this client is initialized, can it show up on
1216
client_object_name = unicode(self.name).translate(
1261
client_object_name = str(self.name).translate(
1217
1262
{ord("."): ord("_"),
1218
1263
ord("-"): ord("_")})
1219
self.dbus_object_path = (dbus.ObjectPath
1220
("/clients/" + client_object_name))
1264
self.dbus_object_path = dbus.ObjectPath(
1265
"/clients/" + client_object_name)
1221
1266
DBusObjectWithProperties.__init__(self, self.bus,
1222
1267
self.dbus_object_path)
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1269
def notifychangeproperty(transform_func, dbus_name,
1270
type_func=lambda x: x,
1272
invalidate_only=False,
1273
_interface=_interface):
1227
1274
""" Modify a variable so that it's a property which announces
1228
1275
its changes to DBus.
1234
1281
to the D-Bus. Default: no transform
1235
1282
variant_level: D-Bus variant level. Default: 1
1237
attrname = "_{0}".format(dbus_name)
1284
attrname = "_{}".format(dbus_name)
1238
1286
def setter(self, value):
1239
1287
if hasattr(self, "dbus_object_path"):
1240
1288
if (not hasattr(self, attrname) or
1241
1289
type_func(getattr(self, attrname, None))
1242
1290
!= type_func(value)):
1243
dbus_value = transform_func(type_func(value),
1246
self.PropertyChanged(dbus.String(dbus_name),
1292
self.PropertiesChanged(
1293
_interface, dbus.Dictionary(),
1294
dbus.Array((dbus_name, )))
1296
dbus_value = transform_func(
1298
variant_level = variant_level)
1299
self.PropertyChanged(dbus.String(dbus_name),
1301
self.PropertiesChanged(
1303
dbus.Dictionary({ dbus.String(dbus_name):
1248
1306
setattr(self, attrname, value)
1250
1308
return property(lambda self: getattr(self, attrname), setter)
1267
1325
datetime_to_dbus, "LastApprovalRequest")
1268
1326
approved_by_default = notifychangeproperty(dbus.Boolean,
1269
1327
"ApprovedByDefault")
1270
approval_delay = notifychangeproperty(dbus.UInt64,
1273
timedelta_to_milliseconds)
1328
approval_delay = notifychangeproperty(
1329
dbus.UInt64, "ApprovalDelay",
1330
type_func = lambda td: td.total_seconds() * 1000)
1274
1331
approval_duration = notifychangeproperty(
1275
1332
dbus.UInt64, "ApprovalDuration",
1276
type_func = timedelta_to_milliseconds)
1333
type_func = lambda td: td.total_seconds() * 1000)
1277
1334
host = notifychangeproperty(dbus.String, "Host")
1278
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
timedelta_to_milliseconds)
1335
timeout = notifychangeproperty(
1336
dbus.UInt64, "Timeout",
1337
type_func = lambda td: td.total_seconds() * 1000)
1281
1338
extended_timeout = notifychangeproperty(
1282
1339
dbus.UInt64, "ExtendedTimeout",
1283
type_func = timedelta_to_milliseconds)
1284
interval = notifychangeproperty(dbus.UInt64,
1287
timedelta_to_milliseconds)
1340
type_func = lambda td: td.total_seconds() * 1000)
1341
interval = notifychangeproperty(
1342
dbus.UInt64, "Interval",
1343
type_func = lambda td: td.total_seconds() * 1000)
1288
1344
checker_command = notifychangeproperty(dbus.String, "Checker")
1345
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1346
invalidate_only=True)
1290
1348
del notifychangeproperty
1444
1493
self.approved_by_default = bool(value)
1446
1495
# ApprovalDelay - property
1447
@dbus_service_property(_interface, signature="t",
1496
@dbus_service_property(_interface,
1448
1498
access="readwrite")
1449
1499
def ApprovalDelay_dbus_property(self, value=None):
1450
1500
if value is None: # get
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1501
return dbus.UInt64(self.approval_delay.total_seconds()
1452
1503
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1454
1505
# ApprovalDuration - property
1455
@dbus_service_property(_interface, signature="t",
1506
@dbus_service_property(_interface,
1456
1508
access="readwrite")
1457
1509
def ApprovalDuration_dbus_property(self, value=None):
1458
1510
if value is None: # get
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1511
return dbus.UInt64(self.approval_duration.total_seconds()
1461
1513
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1463
1515
# Name - property
1546
1601
gobject.source_remove(self.disable_initiator_tag)
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1602
self.disable_initiator_tag = gobject.timeout_add(
1603
int((self.expires - now).total_seconds() * 1000),
1552
1606
# ExtendedTimeout - property
1553
@dbus_service_property(_interface, signature="t",
1607
@dbus_service_property(_interface,
1554
1609
access="readwrite")
1555
1610
def ExtendedTimeout_dbus_property(self, value=None):
1556
1611
if value is None: # get
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
1612
return dbus.UInt64(self.extended_timeout.total_seconds()
1558
1614
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1560
1616
# Interval - property
1561
@dbus_service_property(_interface, signature="t",
1617
@dbus_service_property(_interface,
1562
1619
access="readwrite")
1563
1620
def Interval_dbus_property(self, value=None):
1564
1621
if value is None: # get
1565
return dbus.UInt64(self.interval_milliseconds())
1622
return dbus.UInt64(self.interval.total_seconds() * 1000)
1566
1623
self.interval = datetime.timedelta(0, 0, 0, value)
1567
1624
if getattr(self, "checker_initiator_tag", None) is None:
1569
1626
if self.enabled:
1570
1627
# Reschedule checker run
1571
1628
gobject.source_remove(self.checker_initiator_tag)
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
1629
self.checker_initiator_tag = gobject.timeout_add(
1630
value, self.start_checker)
1631
self.start_checker() # Start one now, too
1576
1633
# Checker - property
1577
@dbus_service_property(_interface, signature="s",
1634
@dbus_service_property(_interface,
1578
1636
access="readwrite")
1579
1637
def Checker_dbus_property(self, value=None):
1580
1638
if value is None: # get
1581
1639
return dbus.String(self.checker_command)
1582
self.checker_command = unicode(value)
1640
self.checker_command = str(value)
1584
1642
# CheckerRunning - property
1585
@dbus_service_property(_interface, signature="b",
1643
@dbus_service_property(_interface,
1586
1645
access="readwrite")
1587
1646
def CheckerRunning_dbus_property(self, value=None):
1588
1647
if value is None: # get
1814
1872
def fingerprint(openpgp):
1815
1873
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1816
1874
# New GnuTLS "datum" with the OpenPGP public key
1817
datum = (gnutls.library.types
1818
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1821
ctypes.c_uint(len(openpgp))))
1875
datum = gnutls.library.types.gnutls_datum_t(
1876
ctypes.cast(ctypes.c_char_p(openpgp),
1877
ctypes.POINTER(ctypes.c_ubyte)),
1878
ctypes.c_uint(len(openpgp)))
1822
1879
# New empty GnuTLS certificate
1823
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1824
(gnutls.library.functions
1825
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1826
1883
# Import the OpenPGP public key into the certificate
1827
(gnutls.library.functions
1828
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1829
gnutls.library.constants
1830
.GNUTLS_OPENPGP_FMT_RAW))
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1831
1887
# Verify the self signature in the key
1832
1888
crtverify = ctypes.c_uint()
1833
(gnutls.library.functions
1834
.gnutls_openpgp_crt_verify_self(crt, 0,
1835
ctypes.byref(crtverify)))
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
1836
1891
if crtverify.value != 0:
1837
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1838
raise (gnutls.errors.CertificateSecurityError
1893
raise gnutls.errors.CertificateSecurityError(
1840
1895
# New buffer for the fingerprint
1841
1896
buf = ctypes.create_string_buffer(20)
1842
1897
buf_len = ctypes.c_size_t()
1843
1898
# Get the fingerprint from the certificate into the buffer
1844
(gnutls.library.functions
1845
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1846
ctypes.byref(buf_len)))
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1847
1901
# Deinit the certificate
1848
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1849
1903
# Convert the buffer to a Python bytestring
1946
2005
self.interface)
1949
self.socket.setsockopt(socket.SOL_SOCKET,
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
1953
2011
except socket.error as error:
1954
2012
if error.errno == errno.EPERM:
1955
logger.error("No permission to"
1956
" bind to interface %s",
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
1958
2015
elif error.errno == errno.ENOPROTOOPT:
1959
2016
logger.error("SO_BINDTODEVICE not available;"
1960
2017
" cannot bind to interface %s",
1961
2018
self.interface)
1962
2019
elif error.errno == errno.ENODEV:
1963
logger.error("Interface %s does not"
1964
" exist, cannot bind",
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
1968
2024
# Only bind(2) the socket if we really need to.
2020
2081
def add_pipe(self, parent_pipe, proc):
2021
2082
# Call "handle_ipc" for both data and EOF events
2022
gobject.io_add_watch(parent_pipe.fileno(),
2023
gobject.IO_IN | gobject.IO_HUP,
2024
functools.partial(self.handle_ipc,
2083
gobject.io_add_watch(
2084
parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2086
functools.partial(self.handle_ipc,
2087
parent_pipe = parent_pipe,
2029
def handle_ipc(self, source, condition, parent_pipe=None,
2030
proc = None, client_object=None):
2090
def handle_ipc(self, source, condition,
2093
client_object=None):
2031
2094
# error, or the other end of multiprocessing.Pipe has closed
2032
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2033
2096
# Wait for other process to exit
2158
def rfc3339_duration_to_delta(duration):
2159
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2161
>>> rfc3339_duration_to_delta("P7D")
2162
datetime.timedelta(7)
2163
>>> rfc3339_duration_to_delta("PT60S")
2164
datetime.timedelta(0, 60)
2165
>>> rfc3339_duration_to_delta("PT60M")
2166
datetime.timedelta(0, 3600)
2167
>>> rfc3339_duration_to_delta("PT24H")
2168
datetime.timedelta(1)
2169
>>> rfc3339_duration_to_delta("P1W")
2170
datetime.timedelta(7)
2171
>>> rfc3339_duration_to_delta("PT5M30S")
2172
datetime.timedelta(0, 330)
2173
>>> rfc3339_duration_to_delta("P1DT3M20S")
2174
datetime.timedelta(1, 200)
2177
# Parsing an RFC 3339 duration with regular expressions is not
2178
# possible - there would have to be multiple places for the same
2179
# values, like seconds. The current code, while more esoteric, is
2180
# cleaner without depending on a parsing library. If Python had a
2181
# built-in library for parsing we would use it, but we'd like to
2182
# avoid excessive use of external libraries.
2184
# New type for defining tokens, syntax, and semantics all-in-one
2185
Token = collections.namedtuple("Token", (
2186
"regexp", # To match token; if "value" is not None, must have
2187
# a "group" containing digits
2188
"value", # datetime.timedelta or None
2189
"followers")) # Tokens valid after this token
2190
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2191
# the "duration" ABNF definition in RFC 3339, Appendix A.
2192
token_end = Token(re.compile(r"$"), None, frozenset())
2193
token_second = Token(re.compile(r"(\d+)S"),
2194
datetime.timedelta(seconds=1),
2195
frozenset((token_end, )))
2196
token_minute = Token(re.compile(r"(\d+)M"),
2197
datetime.timedelta(minutes=1),
2198
frozenset((token_second, token_end)))
2199
token_hour = Token(re.compile(r"(\d+)H"),
2200
datetime.timedelta(hours=1),
2201
frozenset((token_minute, token_end)))
2202
token_time = Token(re.compile(r"T"),
2204
frozenset((token_hour, token_minute,
2206
token_day = Token(re.compile(r"(\d+)D"),
2207
datetime.timedelta(days=1),
2208
frozenset((token_time, token_end)))
2209
token_month = Token(re.compile(r"(\d+)M"),
2210
datetime.timedelta(weeks=4),
2211
frozenset((token_day, token_end)))
2212
token_year = Token(re.compile(r"(\d+)Y"),
2213
datetime.timedelta(weeks=52),
2214
frozenset((token_month, token_end)))
2215
token_week = Token(re.compile(r"(\d+)W"),
2216
datetime.timedelta(weeks=1),
2217
frozenset((token_end, )))
2218
token_duration = Token(re.compile(r"P"), None,
2219
frozenset((token_year, token_month,
2220
token_day, token_time,
2222
# Define starting values
2223
value = datetime.timedelta() # Value so far
2225
followers = frozenset((token_duration, )) # Following valid tokens
2226
s = duration # String left to parse
2227
# Loop until end token is found
2228
while found_token is not token_end:
2229
# Search for any currently valid tokens
2230
for token in followers:
2231
match = token.regexp.match(s)
2232
if match is not None:
2234
if token.value is not None:
2235
# Value found, parse digits
2236
factor = int(match.group(1), 10)
2237
# Add to value so far
2238
value += factor * token.value
2239
# Strip token from string
2240
s = token.regexp.sub("", s, 1)
2243
# Set valid next tokens
2244
followers = found_token.followers
2247
# No currently valid tokens were found
2248
raise ValueError("Invalid RFC 3339 duration: {!r}"
2096
2254
def string_to_delta(interval):
2097
2255
"""Parse a string and return a datetime.timedelta
2191
2354
parser.add_argument("--no-dbus", action="store_false",
2192
2355
dest="use_dbus", help="Do not provide D-Bus"
2193
" system bus interface")
2356
" system bus interface", default=None)
2194
2357
parser.add_argument("--no-ipv6", action="store_false",
2195
dest="use_ipv6", help="Do not use IPv6")
2358
dest="use_ipv6", help="Do not use IPv6",
2196
2360
parser.add_argument("--no-restore", action="store_false",
2197
2361
dest="restore", help="Do not restore stored"
2362
" state", default=None)
2199
2363
parser.add_argument("--socket", type=int,
2200
2364
help="Specify a file descriptor to a network"
2201
2365
" socket to use instead of creating one")
2202
2366
parser.add_argument("--statedir", metavar="DIR",
2203
2367
help="Directory to save/restore state in")
2368
parser.add_argument("--foreground", action="store_true",
2369
help="Run in foreground", default=None)
2370
parser.add_argument("--no-zeroconf", action="store_false",
2371
dest="zeroconf", help="Do not use Zeroconf",
2205
2374
options = parser.parse_args()
2207
2376
if options.check:
2378
fail_count, test_count = doctest.testmod()
2379
sys.exit(os.EX_OK if fail_count == 0 else 1)
2212
2381
# Default values for config file for server-global settings
2213
2382
server_defaults = { "interface": "",
2216
2385
"debug": "False",
2218
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2387
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2388
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2219
2389
"servicename": "Mandos",
2220
2390
"use_dbus": "True",
2221
2391
"use_ipv6": "True",
2222
2392
"debuglevel": "",
2223
2393
"restore": "True",
2225
"statedir": "/var/lib/mandos"
2395
"statedir": "/var/lib/mandos",
2396
"foreground": "False",
2228
2400
# Parse config file for server-global settings
2229
2401
server_config = configparser.SafeConfigParser(server_defaults)
2230
2402
del server_defaults
2231
server_config.read(os.path.join(options.configdir,
2403
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2233
2404
# Convert the SafeConfigParser object to a dict
2234
2405
server_settings = server_config.defaults()
2235
2406
# Use the appropriate methods on the non-string config options
2236
for option in ("debug", "use_dbus", "use_ipv6"):
2407
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2237
2408
server_settings[option] = server_config.getboolean("DEFAULT",
2239
2410
if server_settings["port"]:
2253
2424
# Override the settings from the config file with command line
2254
2425
# options, if set.
2255
2426
for option in ("interface", "address", "port", "debug",
2256
"priority", "servicename", "configdir",
2257
"use_dbus", "use_ipv6", "debuglevel", "restore",
2258
"statedir", "socket"):
2427
"priority", "servicename", "configdir", "use_dbus",
2428
"use_ipv6", "debuglevel", "restore", "statedir",
2429
"socket", "foreground", "zeroconf"):
2259
2430
value = getattr(options, option)
2260
2431
if value is not None:
2261
2432
server_settings[option] = value
2263
2434
# Force all strings to be unicode
2264
2435
for option in server_settings.keys():
2265
if type(server_settings[option]) is str:
2266
server_settings[option] = unicode(server_settings[option])
2436
if isinstance(server_settings[option], bytes):
2437
server_settings[option] = (server_settings[option]
2439
# Force all boolean options to be boolean
2440
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2441
"foreground", "zeroconf"):
2442
server_settings[option] = bool(server_settings[option])
2443
# Debug implies foreground
2444
if server_settings["debug"]:
2445
server_settings["foreground"] = True
2267
2446
# Now we have our good server settings in "server_settings"
2269
2448
##################################################################
2450
if (not server_settings["zeroconf"]
2451
and not (server_settings["port"]
2452
or server_settings["socket"] != "")):
2453
parser.error("Needs port or socket to work without Zeroconf")
2271
2455
# For convenience
2272
2456
debug = server_settings["debug"]
2273
2457
debuglevel = server_settings["debuglevel"]
2301
2486
global mandos_dbus_service
2302
2487
mandos_dbus_service = None
2304
tcp_server = MandosServer((server_settings["address"],
2305
server_settings["port"]),
2307
interface=(server_settings["interface"]
2311
server_settings["priority"],
2313
socketfd=(server_settings["socket"]
2316
pidfilename = "/var/run/mandos.pid"
2490
if server_settings["socket"] != "":
2491
socketfd = server_settings["socket"]
2492
tcp_server = MandosServer(
2493
(server_settings["address"], server_settings["port"]),
2495
interface=(server_settings["interface"] or None),
2497
gnutls_priority=server_settings["priority"],
2501
pidfilename = "/run/mandos.pid"
2502
if not os.path.isdir("/run/."):
2503
pidfilename = "/var/run/mandos.pid"
2318
pidfile = open(pidfilename, "w")
2506
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2319
2507
except IOError as e:
2320
2508
logger.error("Could not open file %r", pidfilename,
2375
2565
bus_name = dbus.service.BusName("se.recompile.Mandos",
2376
bus, do_not_queue=True)
2377
old_bus_name = (dbus.service.BusName
2378
("se.bsnet.fukt.Mandos", bus,
2380
except dbus.exceptions.NameExistsException as e:
2568
old_bus_name = dbus.service.BusName(
2569
"se.bsnet.fukt.Mandos", bus,
2571
except dbus.exceptions.DBusException as e:
2381
2572
logger.error("Disabling D-Bus:", exc_info=e)
2382
2573
use_dbus = False
2383
2574
server_settings["use_dbus"] = False
2384
2575
tcp_server.use_dbus = False
2385
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2386
service = AvahiServiceToSyslog(name =
2387
server_settings["servicename"],
2388
servicetype = "_mandos._tcp",
2389
protocol = protocol, bus = bus)
2390
if server_settings["interface"]:
2391
service.interface = (if_nametoindex
2392
(str(server_settings["interface"])))
2577
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2578
service = AvahiServiceToSyslog(
2579
name = server_settings["servicename"],
2580
servicetype = "_mandos._tcp",
2581
protocol = protocol,
2583
if server_settings["interface"]:
2584
service.interface = if_nametoindex(
2585
server_settings["interface"].encode("utf-8"))
2394
2587
global multiprocessing_manager
2395
2588
multiprocessing_manager = multiprocessing.Manager()
2402
2595
old_client_settings = {}
2403
2596
clients_data = {}
2598
# This is used to redirect stdout and stderr for checker processes
2600
wnull = open(os.devnull, "w") # A writable /dev/null
2601
# Only used if server is running in foreground but not in debug
2603
if debug or not foreground:
2405
2606
# Get client data and settings from last running state.
2406
2607
if server_settings["restore"]:
2408
2609
with open(stored_state_path, "rb") as stored_state:
2409
clients_data, old_client_settings = (pickle.load
2610
clients_data, old_client_settings = pickle.load(
2411
2612
os.remove(stored_state_path)
2412
2613
except IOError as e:
2413
2614
if e.errno == errno.ENOENT:
2414
logger.warning("Could not load persistent state: {0}"
2415
.format(os.strerror(e.errno)))
2615
logger.warning("Could not load persistent state:"
2616
" {}".format(os.strerror(e.errno)))
2417
2618
logger.critical("Could not load persistent state:",
2420
2621
except EOFError as e:
2421
2622
logger.warning("Could not load persistent state: "
2422
"EOFError:", exc_info=e)
2424
2626
with PGPEngine() as pgp:
2425
for client_name, client in clients_data.iteritems():
2627
for client_name, client in clients_data.items():
2628
# Skip removed clients
2629
if client_name not in client_settings:
2426
2632
# Decide which value to use after restoring saved state.
2427
2633
# We have three different values: Old config file,
2428
2634
# new config file, and saved state.
2449
2655
if datetime.datetime.utcnow() >= client["expires"]:
2450
2656
if not client["last_checked_ok"]:
2451
2657
logger.warning(
2452
"disabling client {0} - Client never "
2453
"performed a successful checker"
2454
.format(client_name))
2658
"disabling client {} - Client never "
2659
"performed a successful checker".format(
2455
2661
client["enabled"] = False
2456
2662
elif client["last_checker_status"] != 0:
2457
2663
logger.warning(
2458
"disabling client {0} - Client "
2459
"last checker failed with error code {1}"
2460
.format(client_name,
2461
client["last_checker_status"]))
2664
"disabling client {} - Client last"
2665
" checker failed with error code"
2668
client["last_checker_status"]))
2462
2669
client["enabled"] = False
2464
client["expires"] = (datetime.datetime
2466
+ client["timeout"])
2671
client["expires"] = (
2672
datetime.datetime.utcnow()
2673
+ client["timeout"])
2467
2674
logger.debug("Last checker succeeded,"
2468
" keeping {0} enabled"
2469
.format(client_name))
2675
" keeping {} enabled".format(
2471
client["secret"] = (
2472
pgp.decrypt(client["encrypted_secret"],
2473
client_settings[client_name]
2678
client["secret"] = pgp.decrypt(
2679
client["encrypted_secret"],
2680
client_settings[client_name]["secret"])
2475
2681
except PGPError:
2476
2682
# If decryption fails, we use secret from new settings
2477
logger.debug("Failed to decrypt {0} old secret"
2478
.format(client_name))
2479
client["secret"] = (
2480
client_settings[client_name]["secret"])
2683
logger.debug("Failed to decrypt {} old secret".format(
2685
client["secret"] = (client_settings[client_name]
2482
2688
# Add/remove clients based on new changes made to config
2483
2689
for client_name in (set(old_client_settings)
2488
2694
clients_data[client_name] = client_settings[client_name]
2490
2696
# Create all client objects
2491
for client_name, client in clients_data.iteritems():
2697
for client_name, client in clients_data.items():
2492
2698
tcp_server.clients[client_name] = client_class(
2493
name = client_name, settings = client)
2701
server_settings = server_settings)
2495
2703
if not tcp_server.clients:
2496
2704
logger.warning("No clients defined")
2502
pidfile.write(str(pid) + "\n".encode("utf-8"))
2505
logger.error("Could not write to file %r with PID %d",
2508
# "pidfile" was never created
2707
if pidfile is not None:
2711
print(pid, file=pidfile)
2713
logger.error("Could not write to file %r with PID %d",
2510
2716
del pidfilename
2512
2718
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2513
2719
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2516
@alternate_dbus_interfaces({"se.recompile.Mandos":
2517
"se.bsnet.fukt.Mandos"})
2723
@alternate_dbus_interfaces(
2724
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2518
2725
class MandosDBusService(DBusObjectWithProperties):
2519
2726
"""A D-Bus proxy object"""
2520
2728
def __init__(self):
2521
2729
dbus.service.Object.__init__(self, bus, "/")
2522
2731
_interface = "se.recompile.Mandos"
2524
2733
@dbus_interface_annotations(_interface)
2525
2734
def _foo(self):
2526
return { "org.freedesktop.DBus.Property"
2527
".EmitsChangedSignal":
2736
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2530
2739
@dbus.service.signal(_interface, signature="o")
2531
2740
def ClientAdded(self, objpath):
2613
2823
del client_settings[client.name]["secret"]
2616
with (tempfile.NamedTemporaryFile
2617
(mode='wb', suffix=".pickle", prefix='clients-',
2618
dir=os.path.dirname(stored_state_path),
2619
delete=False)) as stored_state:
2826
with tempfile.NamedTemporaryFile(
2830
dir=os.path.dirname(stored_state_path),
2831
delete=False) as stored_state:
2620
2832
pickle.dump((clients, client_settings), stored_state)
2621
tempname=stored_state.name
2833
tempname = stored_state.name
2622
2834
os.rename(tempname, stored_state_path)
2623
2835
except (IOError, OSError) as e: