/mandos/trunk : revision 24.1.185

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

65

63

import cPickle as pickle

66

64

import multiprocessing

67

65

import types

68

import binascii

69

import tempfile

70

import itertools

71

66

72

67

import dbus

73

68

import dbus.service

78

73

import ctypes.util

79

74

import xml.dom.minidom

80

75

import inspect

81

import GnuPGInterface

82

76

83

77

try:

84

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

88

82

except ImportError:

89

83

SO_BINDTODEVICE = None

90

84

91

version = "1.5.3"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

85

86

version = "1.3.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

95

90

syslogger = (logging.handlers.SysLogHandler

96

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

92

address = str("/dev/log")))

98

99

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

def if_nametoindex(interface):

105

"Get an interface index the hard way, i.e. using fcntl()"

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

with contextlib.closing(socket.socket()) as s:

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

113

return interface_index

114

115

116

def initlogger(debug, level=logging.WARNING):

117

"""init logger and add loglevel"""

118

119

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

132

133

134

class PGPError(Exception):

135

"""Exception if encryption/decryption fails"""

136

pass

137

138

139

class PGPEngine(object):

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

151

def __enter__(self):

152

return self

153

154

def __exit__ (self, exc_type, exc_value, traceback):

155

self._cleanup()

156

return False

157

158

def __del__(self):

159

self._cleanup()

160

161

def _cleanup(self):

162

if self.tempdir is not None:

163

# Delete contents of tempdir

164

for root, dirs, files in os.walk(self.tempdir,

165

topdown = False):

166

for filename in files:

167

os.remove(os.path.join(root, filename))

168

for dirname in dirs:

169

os.rmdir(os.path.join(root, dirname))

170

# Remove tempdir

171

os.rmdir(self.tempdir)

172

self.tempdir = None

173

174

def password_encode(self, password):

175

# Passphrase can not be empty and can not contain newlines or

176

# NUL bytes. So we prefix it and hex encode it.

177

return b"mandos" + binascii.hexlify(password)

178

179

def encrypt(self, data, password):

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

194

return ciphertext

195

196

def decrypt(self, data, password):

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

211

return decrypted_plaintext

212

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

213

103

214

104

class AvahiError(Exception):

215

105

def __init__(self, value, *args, **kwargs):

245

135

server: D-Bus Server

246

136

bus: dbus.SystemBus()

247

137

"""

248

249

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

139

servicetype = None, port = None, TXT = None,

251

140

domain = "", host = "", max_renames = 32768,

264

153

self.server = None

265

154

self.bus = bus

266

155

self.entry_group_state_changed_match = None

267

268

156

def rename(self):

269

157

"""Derived from the Avahi example code"""

270

158

if self.rename_count >= self.max_renames:

272

160

" after %i retries, exiting.",

273

161

self.rename_count)

274

162

raise AvahiServiceError("Too many renames")

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

277

164

logger.info("Changing Zeroconf service name to %r ...",

278

165

self.name)

166

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

169

% self.name))

279

170

self.remove()

280

171

try:

281

172

self.add()

282

173

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

174

logger.critical("DBusException: %s", error)

284

175

self.cleanup()

285

176

os._exit(1)

286

177

self.rename_count += 1

287

288

178

def remove(self):

289

179

"""Derived from the Avahi example code"""

290

180

if self.entry_group_state_changed_match is not None:

292

182

self.entry_group_state_changed_match = None

293

183

if self.group is not None:

294

184

self.group.Reset()

295

296

185

def add(self):

297

186

"""Derived from the Avahi example code"""

298

187

self.remove()

303

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

304

193

self.entry_group_state_changed_match = (

305

194

self.group.connect_to_signal(

306

'StateChanged', self.entry_group_state_changed))

195

'StateChanged', self .entry_group_state_changed))

307

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

308

197

self.name, self.type)

309

198

self.group.AddService(

315

204

dbus.UInt16(self.port),

316

205

avahi.string_array_to_txt_array(self.TXT))

317

206

self.group.Commit()

318

319

207

def entry_group_state_changed(self, state, error):

320

208

"""Derived from the Avahi example code"""

321

209

logger.debug("Avahi entry group state change: %i", state)

328

216

elif state == avahi.ENTRY_GROUP_FAILURE:

329

217

logger.critical("Avahi: Error in group state changed %s",

330

218

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

219

raise AvahiGroupError("State changed: %s"

220

% unicode(error))

334

221

def cleanup(self):

335

222

"""Derived from the Avahi example code"""

336

223

if self.group is not None:

337

224

try:

338

225

self.group.Free()

339

226

except (dbus.exceptions.UnknownMethodException,

340

dbus.exceptions.DBusException):

227

dbus.exceptions.DBusException) as e:

341

228

pass

342

229

self.group = None

343

230

self.remove()

344

345

231

def server_state_changed(self, state, error=None):

346

232

"""Derived from the Avahi example code"""

347

233

logger.debug("Avahi server state change: %i", state)

366

252

logger.debug("Unknown state: %r", state)

367

253

else:

368

254

logger.debug("Unknown state: %r: %r", state, error)

369

370

255

def activate(self):

371

256

"""Derived from the Avahi example code"""

372

257

if self.server is None:

380

265

self.server_state_changed(self.server.GetState())

381

266

382

267

383

class AvahiServiceToSyslog(AvahiService):

384

def rename(self):

385

"""Add the new name to the syslog messages"""

386

ret = AvahiService.rename(self)

387

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

391

return ret

392

393

394

def timedelta_to_milliseconds(td):

268

def _timedelta_to_milliseconds(td):

395

269

"Convert a datetime.timedelta() to milliseconds"

396

270

return ((td.days * 24 * 60 * 60 * 1000)

397

271

+ (td.seconds * 1000)

398

272

+ (td.microseconds // 1000))

399

400

273

401

274

class Client(object):

402

275

"""A representation of a client host served by this server.

403

276

404

277

Attributes:

405

approved: bool(); 'None' if not yet approved/disapproved

278

_approved: bool(); 'None' if not yet approved/disapproved

406

279

approval_delay: datetime.timedelta(); Time to wait for approval

407

280

approval_duration: datetime.timedelta(); Duration of one approval

408

281

checker: subprocess.Popen(); a running checker process used

415

288

instance %(name)s can be used in the command.

416

289

checker_initiator_tag: a gobject event source tag, or None

417

290

created: datetime.datetime(); (UTC) object creation

418

client_structure: Object describing what attributes a client has

419

and is used for storing the client at exit

420

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

421

293

disable_initiator_tag: a gobject event source tag, or None

422

294

enabled: bool()

423

295

fingerprint: string (40 or 32 hexadecimal digits); used to

426

298

interval: datetime.timedelta(); How often to start a new checker

427

299

last_approval_request: datetime.datetime(); (UTC) or None

428

300

last_checked_ok: datetime.datetime(); (UTC) or None

429

last_checker_status: integer between 0 and 255 reflecting exit

430

status of last checker. -1 reflects crashed

431

checker, -2 means no checker completed yet.

432

last_enabled: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

433

302

name: string; from the config file, used in log messages and

434

303

D-Bus identifiers

435

304

secret: bytestring; sent verbatim (over TLS) to client

436

305

timeout: datetime.timedelta(); How long from last_checked_ok

437

306

until this client is disabled

438

extended_timeout: extra long timeout when secret has been sent

307

extended_timeout: extra long timeout when password has been sent

439

308

runtime_expansions: Allowed attributes for runtime expansion.

440

309

expires: datetime.datetime(); time (UTC) when a client will be

441

310

disabled, or None

442

311

"""

443

312

444

313

runtime_expansions = ("approval_delay", "approval_duration",

445

"created", "enabled", "expires",

446

"fingerprint", "host", "interval",

447

"last_approval_request", "last_checked_ok",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

448

316

"last_enabled", "name", "timeout")

449

client_defaults = { "timeout": "5m",

450

"extended_timeout": "15m",

451

"interval": "2m",

452

"checker": "fping -q -- %%(host)s",

453

"host": "",

454

"approval_delay": "0s",

455

"approval_duration": "1s",

456

"approved_by_default": "True",

457

"enabled": "True",

458

}

459

317

460

318

def timeout_milliseconds(self):

461

319

"Return the 'timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

463

321

464

322

def extended_timeout_milliseconds(self):

465

323

"Return the 'extended_timeout' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.extended_timeout)

324

return _timedelta_to_milliseconds(self.extended_timeout)

467

325

468

326

def interval_milliseconds(self):

469

327

"Return the 'interval' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.interval)

328

return _timedelta_to_milliseconds(self.interval)

471

329

472

330

def approval_delay_milliseconds(self):

473

return timedelta_to_milliseconds(self.approval_delay)

474

475

@staticmethod

476

def config_parser(config):

477

"""Construct a new dict of client settings of this form:

478

{ client_name: {setting_name: value, ...}, ...}

479

with exceptions for any special settings as defined above.

480

NOTE: Must be a pure function. Must return the same result

481

value given the same arguments.

482

"""

483

settings = {}

484

for client_name in config.sections():

485

section = dict(config.items(client_name))

486

client = settings[client_name] = {}

487

488

client["host"] = section["host"]

489

# Reformat values from string types to Python types

490

client["approved_by_default"] = config.getboolean(

491

client_name, "approved_by_default")

492

client["enabled"] = config.getboolean(client_name,

493

"enabled")

494

495

client["fingerprint"] = (section["fingerprint"].upper()

496

.replace(" ", ""))

497

if "secret" in section:

498

client["secret"] = section["secret"].decode("base64")

499

elif "secfile" in section:

500

with open(os.path.expanduser(os.path.expandvars

501

(section["secfile"])),

502

"rb") as secfile:

503

client["secret"] = secfile.read()

504

else:

505

raise TypeError("No secret or secfile for section {0}"

506

.format(section))

507

client["timeout"] = string_to_delta(section["timeout"])

508

client["extended_timeout"] = string_to_delta(

509

section["extended_timeout"])

510

client["interval"] = string_to_delta(section["interval"])

511

client["approval_delay"] = string_to_delta(

512

section["approval_delay"])

513

client["approval_duration"] = string_to_delta(

514

section["approval_duration"])

515

client["checker_command"] = section["checker"]

516

client["last_approval_request"] = None

517

client["last_checked_ok"] = None

518

client["last_checker_status"] = -2

519

520

return settings

521

522

def __init__(self, settings, name = None):

331

return _timedelta_to_milliseconds(self.approval_delay)

332

333

def __init__(self, name = None, disable_hook=None, config=None):

334

"""Note: the 'checker' key in 'config' sets the

335

'checker_command' attribute and *not* the 'checker'

336

attribute."""

523

337

self.name = name

524

# adding all client settings

525

for setting, value in settings.iteritems():

526

setattr(self, setting, value)

527

528

if self.enabled:

529

if not hasattr(self, "last_enabled"):

530

self.last_enabled = datetime.datetime.utcnow()

531

if not hasattr(self, "expires"):

532

self.expires = (datetime.datetime.utcnow()

533

+ self.timeout)

534

else:

535

self.last_enabled = None

536

self.expires = None

537

338

if config is None:

339

config = {}

538

340

logger.debug("Creating client %r", self.name)

539

341

# Uppercase and remove spaces from fingerprint for later

540

342

# comparison purposes with return value from the fingerprint()

541

343

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

542

346

logger.debug(" Fingerprint: %s", self.fingerprint)

543

self.created = settings.get("created",

544

datetime.datetime.utcnow())

545

546

# attributes specific for this server instance

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

353

self.secret = secfile.read()

354

else:

355

raise TypeError("No secret or secfile for client %s"

356

% self.name)

357

self.host = config.get("host", "")

358

self.created = datetime.datetime.utcnow()

359

self.enabled = False

360

self.last_approval_request = None

361

self.last_enabled = None

362

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

547

367

self.checker = None

548

368

self.checker_initiator_tag = None

549

369

self.disable_initiator_tag = None

370

self.expires = None

550

371

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

551

373

self.current_checker_command = None

552

self.approved = None

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

553

378

self.approvals_pending = 0

554

self.changedstate = (multiprocessing_manager

555

.Condition(multiprocessing_manager

556

.Lock()))

557

self.client_structure = [attr for attr in

558

self.__dict__.iterkeys()

559

if not attr.startswith("_")]

560

self.client_structure.append("client_structure")

561

562

for name, t in inspect.getmembers(type(self),

563

lambda obj:

564

isinstance(obj,

565

property)):

566

if not name.startswith("_"):

567

self.client_structure.append(name)

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

568

384

569

# Send notice to process children that client state has changed

570

385

def send_changedstate(self):

571

with self.changedstate:

572

self.changedstate.notify_all()

573

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

574

390

def enable(self):

575

391

"""Start this client's checker and timeout hooks"""

576

392

if getattr(self, "enabled", False):

577

393

# Already enabled

578

394

return

395

self.send_changedstate()

396

# Schedule a new checker to be started an 'interval' from now,

397

# and every interval from then on.

398

self.checker_initiator_tag = (gobject.timeout_add

399

(self.interval_milliseconds(),

400

self.start_checker))

401

# Schedule a disable() when 'timeout' has passed

579

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

self.disable_initiator_tag = (gobject.timeout_add

404

(self.timeout_milliseconds(),

405

self.disable))

580

406

self.enabled = True

581

407

self.last_enabled = datetime.datetime.utcnow()

582

self.init_checker()

583

self.send_changedstate()

408

# Also start a new checker *right now*.

409

self.start_checker()

584

410

585

411

def disable(self, quiet=True):

586

412

"""Disable this client."""

587

413

if not getattr(self, "enabled", False):

588

414

return False

589

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

590

418

logger.info("Disabling client %s", self.name)

591

if getattr(self, "disable_initiator_tag", None) is not None:

419

if getattr(self, "disable_initiator_tag", False):

592

420

gobject.source_remove(self.disable_initiator_tag)

593

421

self.disable_initiator_tag = None

594

422

self.expires = None

595

if getattr(self, "checker_initiator_tag", None) is not None:

423

if getattr(self, "checker_initiator_tag", False):

596

424

gobject.source_remove(self.checker_initiator_tag)

597

425

self.checker_initiator_tag = None

598

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

599

429

self.enabled = False

600

if not quiet:

601

self.send_changedstate()

602

430

# Do not run this again if called by a gobject.timeout_add

603

431

return False

604

432

605

433

def __del__(self):

434

self.disable_hook = None

606

435

self.disable()

607

436

608

def init_checker(self):

609

# Schedule a new checker to be started an 'interval' from now,

610

# and every interval from then on.

611

if self.checker_initiator_tag is not None:

612

gobject.source_remove(self.checker_initiator_tag)

613

self.checker_initiator_tag = (gobject.timeout_add

614

(self.interval_milliseconds(),

615

self.start_checker))

616

# Schedule a disable() when 'timeout' has passed

617

if self.disable_initiator_tag is not None:

618

gobject.source_remove(self.disable_initiator_tag)

619

self.disable_initiator_tag = (gobject.timeout_add

620

(self.timeout_milliseconds(),

621

self.disable))

622

# Also start a new checker *right now*.

623

self.start_checker()

624

625

437

def checker_callback(self, pid, condition, command):

626

438

"""The checker has completed, so take appropriate actions."""

627

439

self.checker_callback_tag = None

628

440

self.checker = None

629

441

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

631

if self.last_checker_status == 0:

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

632

444

logger.info("Checker for %(name)s succeeded",

633

445

vars(self))

634

446

self.checked_ok()

636

448

logger.info("Checker for %(name)s failed",

637

449

vars(self))

638

450

else:

639

self.last_checker_status = -1

640

451

logger.warning("Checker for %(name)s crashed?",

641

452

vars(self))

642

453

643

def checked_ok(self):

644

"""Assert that the client has been seen, alive and well."""

645

self.last_checked_ok = datetime.datetime.utcnow()

646

self.last_checker_status = 0

647

self.bump_timeout()

648

649

def bump_timeout(self, timeout=None):

650

"""Bump up the timeout for this client."""

454

def checked_ok(self, timeout=None):

455

"""Bump up the timeout for this client.

456

457

This should only be called when the client has been seen,

458

alive and well.

459

"""

651

460

if timeout is None:

652

461

timeout = self.timeout

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = None

656

if getattr(self, "enabled", False):

657

self.disable_initiator_tag = (gobject.timeout_add

658

(timedelta_to_milliseconds

659

(timeout), self.disable))

660

self.expires = datetime.datetime.utcnow() + timeout

462

self.last_checked_ok = datetime.datetime.utcnow()

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

467

self.disable))

661

468

662

469

def need_approval(self):

663

470

self.last_approval_request = datetime.datetime.utcnow()

668

475

If a checker already exists, leave it running and do

669

476

nothing."""

670

477

# The reason for not killing a running checker is that if we

671

# did that, and if a checker (for some reason) started running

672

# slowly and taking more than 'interval' time, then the client

673

# would inevitably timeout, since no checker would get a

674

# chance to run to completion. If we instead leave running

478

# did that, then if a checker (for some reason) started

479

# running slowly and taking more than 'interval' time, the

480

# client would inevitably timeout, since no checker would get

481

# a chance to run to completion. If we instead leave running

675

482

# checkers alone, the checker would have to take more time

676

483

# than 'timeout' for the client to be disabled, which is as it

677

484

# should be.

691

498

self.current_checker_command)

692

499

# Start a new checker if needed

693

500

if self.checker is None:

694

# Escape attributes for the shell

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

699

501

try:

700

command = self.checker_command % escaped_attrs

701

except TypeError as error:

702

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

502

# In case checker_command has exactly one % operator

503

command = self.checker_command % self.host

504

except TypeError:

505

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

514

try:

515

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

519

return True # Try again later

705

520

self.current_checker_command = command

706

521

try:

707

522

logger.info("Starting checker %r for %s",

713

528

self.checker = subprocess.Popen(command,

714

529

close_fds=True,

715

530

shell=True, cwd="/")

531

self.checker_callback_tag = (gobject.child_watch_add

532

(self.checker.pid,

533

self.checker_callback,

534

data=command))

535

# The checker may have completed before the gobject

536

# watch was added. Check for this.

537

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

538

if pid:

539

gobject.source_remove(self.checker_callback_tag)

540

self.checker_callback(pid, status, command)

716

541

except OSError as error:

717

logger.error("Failed to start subprocess",

718

exc_info=error)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

542

logger.error("Failed to start subprocess: %s",

543

error)

729

544

# Re-run this periodically if run by gobject.timeout_add

730

545

return True

731

546

738

553

return

739

554

logger.debug("Stopping checker for %(name)s", vars(self))

740

555

try:

741

self.checker.terminate()

556

os.kill(self.checker.pid, signal.SIGTERM)

742

557

#time.sleep(0.5)

743

558

#if self.checker.poll() is None:

744

# self.checker.kill()

559

# os.kill(self.checker.pid, signal.SIGKILL)

745

560

except OSError as error:

746

561

if error.errno != errno.ESRCH: # No such process

747

562

raise

764

579

# "Set" method, so we fail early here:

765

580

if byte_arrays and signature != "ay":

766

581

raise ValueError("Byte arrays not supported for non-'ay'"

767

" signature {0!r}".format(signature))

582

" signature %r" % signature)

768

583

def decorator(func):

769

584

func._dbus_is_property = True

770

585

func._dbus_interface = dbus_interface

778

593

return decorator

779

594

780

595

781

def dbus_interface_annotations(dbus_interface):

782

"""Decorator for marking functions returning interface annotations

783

784

Usage:

785

786

@dbus_interface_annotations("org.example.Interface")

787

def _foo(self): # Function name does not matter

788

return {"org.freedesktop.DBus.Deprecated": "true",

789

"org.freedesktop.DBus.Property.EmitsChangedSignal":

790

"false"}

791

"""

792

def decorator(func):

793

func._dbus_is_interface = True

794

func._dbus_interface = dbus_interface

795

func._dbus_name = dbus_interface

796

return func

797

return decorator

798

799

800

def dbus_annotations(annotations):

801

"""Decorator to annotate D-Bus methods, signals or properties

802

Usage:

803

804

@dbus_service_property("org.example.Interface", signature="b",

805

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

809

def Property_dbus_property(self):

810

return dbus.Boolean(False)

811

"""

812

def decorator(func):

813

func._dbus_annotations = annotations

814

return func

815

return decorator

816

817

818

596

class DBusPropertyException(dbus.exceptions.DBusException):

819

597

"""A base class for D-Bus property-related exceptions

820

598

"""

843

621

"""

844

622

845

623

@staticmethod

846

def _is_dbus_thing(thing):

847

"""Returns a function testing if an attribute is a D-Bus thing

848

849

If called like _is_dbus_thing("method") it returns a function

850

suitable for use as predicate to inspect.getmembers().

851

"""

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

853

False)

624

def _is_dbus_property(obj):

625

return getattr(obj, "_dbus_is_property", False)

854

626

855

def _get_all_dbus_things(self, thing):

627

def _get_all_dbus_properties(self):

856

628

"""Returns a generator of (name, attribute) pairs

857

629

"""

858

return ((getattr(athing.__get__(self), "_dbus_name",

859

name),

860

athing.__get__(self))

861

for cls in self.__class__.__mro__

862

for name, athing in

863

inspect.getmembers(cls,

864

self._is_dbus_thing(thing)))

630

return ((prop._dbus_name, prop)

631

for name, prop in

632

inspect.getmembers(self, self._is_dbus_property))

865

633

634

# def _get_dbus_property(self, interface_name, property_name):

635

# """Returns a bound method if one exists which is a D-Bus

636

# property with the specified name and interface.

637

# """

638

# print("get_property({0!r}, {1!r}".format(interface_name, property_name),file=sys.stderr)

639

# print(dir(self), sys.stderr)

640

# for name in (property_name,

641

# property_name + "_dbus_property"):

642

# prop = getattr(self, name, None)

643

# if (prop is None

644

# or not self._is_dbus_property(prop)

645

# or prop._dbus_name != property_name

646

# or (interface_name and prop._dbus_interface

647

# and interface_name != prop._dbus_interface)):

648

# continue

649

# return prop

650

# # No such property

651

# raise DBusPropertyNotFound(self.dbus_object_path + ":"

652

# + interface_name + "."

653

# + property_name)

654

866

655

def _get_dbus_property(self, interface_name, property_name):

867

656

"""Returns a bound method if one exists which is a D-Bus

868

657

property with the specified name and interface.

869

658

"""

870

for cls in self.__class__.__mro__:

871

for name, value in (inspect.getmembers

872

(cls,

873

self._is_dbus_thing("property"))):

874

if (value._dbus_name == property_name

875

and value._dbus_interface == interface_name):

876

return value.__get__(self)

659

for name, value in inspect.getmembers(self, self._is_dbus_property):

660

if value._dbus_name == property_name and value._dbus_interface == interface_name:

661

return value

877

662

878

663

# No such property

879

664

raise DBusPropertyNotFound(self.dbus_object_path + ":"

880

665

+ interface_name + "."

881

666

+ property_name)

667

882

668

883

669

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

884

670

out_signature="v")

905

691

# signatures other than "ay".

906

692

if prop._dbus_signature != "ay":

907

693

raise ValueError

908

value = dbus.ByteArray(b''.join(chr(byte)

909

for byte in value))

694

value = dbus.ByteArray(''.join(unichr(byte)

695

for byte in value))

910

696

prop(value)

911

697

912

698

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

917

703

918

704

Note: Will not include properties with access="write".

919

705

"""

920

properties = {}

921

for name, prop in self._get_all_dbus_things("property"):

706

all = {}

707

for name, prop in self._get_all_dbus_properties():

922

708

if (interface_name

923

709

and interface_name != prop._dbus_interface):

924

710

# Interface non-empty but did not match

928

714

continue

929

715

value = prop()

930

716

if not hasattr(value, "variant_level"):

931

properties[name] = value

717

all[name] = value

932

718

continue

933

properties[name] = type(value)(value, variant_level=

934

value.variant_level+1)

935

return dbus.Dictionary(properties, signature="sv")

719

all[name] = type(value)(value, variant_level=

720

value.variant_level+1)

721

return dbus.Dictionary(all, signature="sv")

936

722

937

723

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

938

724

out_signature="s",

939

725

path_keyword='object_path',

940

726

connection_keyword='connection')

941

727

def Introspect(self, object_path, connection):

942

"""Overloading of standard D-Bus method.

943

944

Inserts property tags and interface annotation tags.

728

"""Standard D-Bus method, overloaded to insert property tags.

945

729

"""

946

730

xmlstring = dbus.service.Object.Introspect(self, object_path,

947

731

connection)

954

738

e.setAttribute("access", prop._dbus_access)

955

739

return e

956

740

for if_tag in document.getElementsByTagName("interface"):

957

# Add property tags

958

741

for tag in (make_tag(document, name, prop)

959

742

for name, prop

960

in self._get_all_dbus_things("property")

743

in self._get_all_dbus_properties()

961

744

if prop._dbus_interface

962

745

== if_tag.getAttribute("name")):

963

746

if_tag.appendChild(tag)

964

# Add annotation tags

965

for typ in ("method", "signal", "property"):

966

for tag in if_tag.getElementsByTagName(typ):

967

annots = dict()

968

for name, prop in (self.

969

_get_all_dbus_things(typ)):

970

if (name == tag.getAttribute("name")

971

and prop._dbus_interface

972

== if_tag.getAttribute("name")):

973

annots.update(getattr

974

(prop,

975

"_dbus_annotations",

976

{}))

977

for name, value in annots.iteritems():

978

ann_tag = document.createElement(

979

"annotation")

980

ann_tag.setAttribute("name", name)

981

ann_tag.setAttribute("value", value)

982

tag.appendChild(ann_tag)

983

# Add interface annotation tags

984

for annotation, value in dict(

985

itertools.chain.from_iterable(

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

989

if name == if_tag.getAttribute("name")

990

)).iteritems():

991

ann_tag = document.createElement("annotation")

992

ann_tag.setAttribute("name", annotation)

993

ann_tag.setAttribute("value", value)

994

if_tag.appendChild(ann_tag)

995

747

# Add the names to the return values for the

996

748

# "org.freedesktop.DBus.Properties" methods

997

749

if (if_tag.getAttribute("name")

1012

764

except (AttributeError, xml.dom.DOMException,

1013

765

xml.parsers.expat.ExpatError) as error:

1014

766

logger.error("Failed to override Introspection method",

1015

exc_info=error)

767

error)

1016

768

return xmlstring

1017

769

1018

770

1023

775

return dbus.String(dt.isoformat(),

1024

776

variant_level=variant_level)

1025

777

1026

1027

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1028

"""A class decorator; applied to a subclass of

1029

dbus.service.Object, it will add alternate D-Bus attributes with

1030

interface names according to the "alt_interface_names" mapping.

1031

Usage:

1032

1033

@alternate_dbus_names({"org.example.Interface":

1034

"net.example.AlternateInterface"})

1035

class SampleDBusObject(dbus.service.Object):

1036

@dbus.service.method("org.example.Interface")

1037

def SampleDBusMethod():

1038

pass

1039

1040

The above "SampleDBusMethod" on "SampleDBusObject" will be

1041

reachable via two interfaces: "org.example.Interface" and

1042

"net.example.AlternateInterface", the latter of which will have

1043

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1044

"true", unless "deprecate" is passed with a False value.

1045

1046

This works for methods and signals, and also for D-Bus properties

1047

(from DBusObjectWithProperties) and interfaces (from the

1048

dbus_interface_annotations decorator).

1049

"""

1050

def wrapper(cls):

1051

for orig_interface_name, alt_interface_name in (

1052

alt_interface_names.iteritems()):

1053

attr = {}

1054

interface_names = set()

1055

# Go though all attributes of the class

1056

for attrname, attribute in inspect.getmembers(cls):

1057

# Ignore non-D-Bus attributes, and D-Bus attributes

1058

# with the wrong interface name

1059

if (not hasattr(attribute, "_dbus_interface")

1060

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

1062

continue

1063

# Create an alternate D-Bus interface name based on

1064

# the current name

1065

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1068

interface_names.add(alt_interface)

1069

# Is this a D-Bus signal?

1070

if getattr(attribute, "_dbus_is_signal", False):

1071

# Extract the original non-method function by

1072

# black magic

1073

nonmethod_func = (dict(

1074

zip(attribute.func_code.co_freevars,

1075

attribute.__closure__))["func"]

1076

.cell_contents)

1077

# Create a new, but exactly alike, function

1078

# object, and decorate it to be a new D-Bus signal

1079

# with the alternate D-Bus interface name

1080

new_function = (dbus.service.signal

1081

(alt_interface,

1082

attribute._dbus_signature)

1083

(types.FunctionType(

1084

nonmethod_func.func_code,

1085

nonmethod_func.func_globals,

1086

nonmethod_func.func_name,

1087

nonmethod_func.func_defaults,

1088

nonmethod_func.func_closure)))

1089

# Copy annotations, if any

1090

try:

1091

new_function._dbus_annotations = (

1092

dict(attribute._dbus_annotations))

1093

except AttributeError:

1094

pass

1095

# Define a creator of a function to call both the

1096

# original and alternate functions, so both the

1097

# original and alternate signals gets sent when

1098

# the function is called

1099

def fixscope(func1, func2):

1100

"""This function is a scope container to pass

1101

func1 and func2 to the "call_both" function

1102

outside of its arguments"""

1103

def call_both(*args, **kwargs):

1104

"""This function will emit two D-Bus

1105

signals by calling func1 and func2"""

1106

func1(*args, **kwargs)

1107

func2(*args, **kwargs)

1108

return call_both

1109

# Create the "call_both" function and add it to

1110

# the class

1111

attr[attrname] = fixscope(attribute, new_function)

1112

# Is this a D-Bus method?

1113

elif getattr(attribute, "_dbus_is_method", False):

1114

# Create a new, but exactly alike, function

1115

# object. Decorate it to be a new D-Bus method

1116

# with the alternate D-Bus interface name. Add it

1117

# to the class.

1118

attr[attrname] = (dbus.service.method

1119

(alt_interface,

1120

attribute._dbus_in_signature,

1121

attribute._dbus_out_signature)

1122

(types.FunctionType

1123

(attribute.func_code,

1124

attribute.func_globals,

1125

attribute.func_name,

1126

attribute.func_defaults,

1127

attribute.func_closure)))

1128

# Copy annotations, if any

1129

try:

1130

attr[attrname]._dbus_annotations = (

1131

dict(attribute._dbus_annotations))

1132

except AttributeError:

1133

pass

1134

# Is this a D-Bus property?

1135

elif getattr(attribute, "_dbus_is_property", False):

1136

# Create a new, but exactly alike, function

1137

# object, and decorate it to be a new D-Bus

1138

# property with the alternate D-Bus interface

1139

# name. Add it to the class.

1140

attr[attrname] = (dbus_service_property

1141

(alt_interface,

1142

attribute._dbus_signature,

1143

attribute._dbus_access,

1144

attribute

1145

._dbus_get_args_options

1146

["byte_arrays"])

1147

(types.FunctionType

1148

(attribute.func_code,

1149

attribute.func_globals,

1150

attribute.func_name,

1151

attribute.func_defaults,

1152

attribute.func_closure)))

1153

# Copy annotations, if any

1154

try:

1155

attr[attrname]._dbus_annotations = (

1156

dict(attribute._dbus_annotations))

1157

except AttributeError:

1158

pass

1159

# Is this a D-Bus interface?

1160

elif getattr(attribute, "_dbus_is_interface", False):

1161

# Create a new, but exactly alike, function

1162

# object. Decorate it to be a new D-Bus interface

1163

# with the alternate D-Bus interface name. Add it

1164

# to the class.

1165

attr[attrname] = (dbus_interface_annotations

1166

(alt_interface)

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1173

if deprecate:

1174

# Deprecate all alternate interfaces

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1176

for interface_name in interface_names:

1177

@dbus_interface_annotations(interface_name)

1178

def func(self):

1179

return { "org.freedesktop.DBus.Deprecated":

1180

"true" }

1181

# Find an unused name

1182

for aname in (iname.format(i)

1183

for i in itertools.count()):

1184

if aname not in attr:

1185

attr[aname] = func

1186

break

1187

if interface_names:

1188

# Replace the class with a new subclass of it with

1189

# methods, signals, etc. as created above.

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1192

return cls

1193

return wrapper

1194

1195

1196

@alternate_dbus_interfaces({"se.recompile.Mandos":

1197

"se.bsnet.fukt.Mandos"})

778

class transitional_clientdbus(DBusObjectWithProperties.__metaclass__):

779

def __new__(mcs, name, bases, attr):

780

for key, old_dbusobj in attr.items():

781

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

782

if getattr(old_dbusobj, "_dbus_is_signal", False):

783

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

784

old_dbusobj.__closure__))["func"].cell_contents

785

newfunc = types.FunctionType(unwrappedfunc.func_code,

786

unwrappedfunc.func_globals,

787

unwrappedfunc.func_name,

788

unwrappedfunc.func_defaults,

789

unwrappedfunc.func_closure)

790

new_dbusfunc = dbus.service.signal(

791

new_interface, old_dbusobj._dbus_signature)(newfunc)

792

attr["_transitional_{0}_1".format(key)] = new_dbusfunc

793

attr["_transitional_{0}_0".format(key)] = old_dbusobj

794

def fixscope(func1, func2):

795

def newcall(*args, **kwargs):

796

func1(*args, **kwargs)

797

func2(*args, **kwargs)

798

return newcall

799

800

attr[key] = fixscope(

801

old_dbusobj, attr["_transitional_{0}_1".format(key)])

802

803

if getattr(old_dbusobj, "_dbus_is_method", False):

804

new_dbusfunc = (dbus.service.method

805

(new_interface,

806

old_dbusobj._dbus_in_signature,

807

old_dbusobj._dbus_out_signature)

808

(types.FunctionType

809

(old_dbusobj.func_code,

810

old_dbusobj.func_globals,

811

old_dbusobj.func_name,

812

old_dbusobj.func_defaults,

813

old_dbusobj.func_closure)))

814

815

attr["_transitional_{0}".format(key)] = new_dbusfunc

816

if getattr(old_dbusobj, "_dbus_is_property", False):

817

new_dbusfunc = (dbus_service_property

818

(new_interface,

819

old_dbusobj._dbus_signature,

820

old_dbusobj._dbus_access,

821

old_dbusobj._dbus_get_args_options["byte_arrays"])

822

(types.FunctionType

823

(old_dbusobj.func_code,

824

old_dbusobj.func_globals,

825

old_dbusobj.func_name,

826

old_dbusobj.func_defaults,

827

old_dbusobj.func_closure)))

828

829

attr["_transitional_{0}".format(key)] = new_dbusfunc

830

return type.__new__(mcs, name, bases, attr)

831

1198

832

class ClientDBus(Client, DBusObjectWithProperties):

1199

833

"""A Client class using D-Bus

1200

834

1205

839

1206

840

runtime_expansions = (Client.runtime_expansions

1207

841

+ ("dbus_object_path",))

842

843

__metaclass__ = transitional_clientdbus

1208

844

1209

845

# dbus.service.Object doesn't use super(), so we can't either.

1210

846

1211

847

def __init__(self, bus = None, *args, **kwargs):

848

self._approvals_pending = 0

1212

849

self.bus = bus

1213

850

Client.__init__(self, *args, **kwargs)

1214

851

# Only now, when this client is initialized, can it show up on

1220

857

("/clients/" + client_object_name))

1221

858

DBusObjectWithProperties.__init__(self, self.bus,

1222

859

self.dbus_object_path)

1223

860

1224

861

def notifychangeproperty(transform_func,

1225

862

dbus_name, type_func=lambda x: x,

1226

863

variant_level=1):

1227

""" Modify a variable so that it's a property which announces

1228

its changes to DBus.

1229

1230

transform_fun: Function that takes a value and a variant_level

1231

and transforms it to a D-Bus type.

1232

dbus_name: D-Bus name of the variable

864

""" Modify a variable so that its a property that announce its

865

changes to DBus.

866

transform_fun: Function that takes a value and transform it to

867

DBus type.

868

dbus_name: DBus name of the variable

1233

869

type_func: Function that transform the value before sending it

1234

to the D-Bus. Default: no transform

1235

variant_level: D-Bus variant level. Default: 1

870

to DBus

871

variant_level: DBus variant level. default: 1

1236

872

"""

1237

attrname = "_{0}".format(dbus_name)

873

real_value = [None,]

1238

874

def setter(self, value):

875

old_value = real_value[0]

876

real_value[0] = value

1239

877

if hasattr(self, "dbus_object_path"):

1240

if (not hasattr(self, attrname) or

1241

type_func(getattr(self, attrname, None))

1242

!= type_func(value)):

1243

dbus_value = transform_func(type_func(value),

1244

variant_level

1245

=variant_level)

878

if type_func(old_value) != type_func(real_value[0]):

879

dbus_value = transform_func(type_func(real_value[0]),

880

variant_level)

1246

881

self.PropertyChanged(dbus.String(dbus_name),

1247

882

dbus_value)

1248

setattr(self, attrname, value)

1249

883

1250

return property(lambda self: getattr(self, attrname), setter)

884

return property(lambda self: real_value[0], setter)

885

1251

886

1252

887

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1253

888

approvals_pending = notifychangeproperty(dbus.Boolean,

1257

892

last_enabled = notifychangeproperty(datetime_to_dbus,

1258

893

"LastEnabled")

1259

894

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1260

type_func = lambda checker:

1261

checker is not None)

895

type_func = lambda checker: checker is not None)

1262

896

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1263

897

"LastCheckedOK")

1264

last_checker_status = notifychangeproperty(dbus.Int16,

1265

"LastCheckerStatus")

1266

last_approval_request = notifychangeproperty(

1267

datetime_to_dbus, "LastApprovalRequest")

898

last_approval_request = notifychangeproperty(datetime_to_dbus,

899

"LastApprovalRequest")

1268

900

approved_by_default = notifychangeproperty(dbus.Boolean,

1269

901

"ApprovedByDefault")

1270

approval_delay = notifychangeproperty(dbus.UInt64,

1271

"ApprovalDelay",

1272

type_func =

1273

timedelta_to_milliseconds)

1274

approval_duration = notifychangeproperty(

1275

dbus.UInt64, "ApprovalDuration",

1276

type_func = timedelta_to_milliseconds)

902

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

903

type_func = _timedelta_to_milliseconds)

904

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

905

type_func = _timedelta_to_milliseconds)

1277

906

host = notifychangeproperty(dbus.String, "Host")

1278

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1279

type_func =

1280

timedelta_to_milliseconds)

1281

extended_timeout = notifychangeproperty(

1282

dbus.UInt64, "ExtendedTimeout",

1283

type_func = timedelta_to_milliseconds)

1284

interval = notifychangeproperty(dbus.UInt64,

1285

"Interval",

1286

type_func =

1287

timedelta_to_milliseconds)

907

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

908

type_func = _timedelta_to_milliseconds)

909

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

910

type_func = _timedelta_to_milliseconds)

911

interval = notifychangeproperty(dbus.UInt16, "Interval",

912

type_func = _timedelta_to_milliseconds)

1288

913

checker_command = notifychangeproperty(dbus.String, "Checker")

1289

914

1290

915

del notifychangeproperty

1332

957

return r

1333

958

1334

959

def _reset_approved(self):

1335

self.approved = None

960

self._approved = None

1336

961

return False

1337

962

1338

963

def approve(self, value=True):

1339

self.approved = value

1340

gobject.timeout_add(timedelta_to_milliseconds

964

self.send_changedstate()

965

self._approved = value

966

gobject.timeout_add(_timedelta_to_milliseconds

1341

967

(self.approval_duration),

1342

968

self._reset_approved)

1343

self.send_changedstate()

969

1344

970

1345

971

## D-Bus methods, signals & properties

1346

_interface = "se.recompile.Mandos.Client"

1347

1348

## Interfaces

1349

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

1354

972

_interface = "se.bsnet.fukt.Mandos.Client"

973

1355

974

## Signals

1356

975

1357

976

# CheckerCompleted - signal

1456

1075

access="readwrite")

1457

1076

def ApprovalDuration_dbus_property(self, value=None):

1458

1077

if value is None: # get

1459

return dbus.UInt64(timedelta_to_milliseconds(

1078

return dbus.UInt64(_timedelta_to_milliseconds(

1460

1079

self.approval_duration))

1461

1080

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1462

1081

1476

1095

def Host_dbus_property(self, value=None):

1477

1096

if value is None: # get

1478

1097

return dbus.String(self.host)

1479

self.host = unicode(value)

1098

self.host = value

1480

1099

1481

1100

# Created - property

1482

1101

@dbus_service_property(_interface, signature="s", access="read")

1483

1102

def Created_dbus_property(self):

1484

return datetime_to_dbus(self.created)

1103

return dbus.String(datetime_to_dbus(self.created))

1485

1104

1486

1105

# LastEnabled - property

1487

1106

@dbus_service_property(_interface, signature="s", access="read")

1508

1127

return

1509

1128

return datetime_to_dbus(self.last_checked_ok)

1510

1129

1511

# LastCheckerStatus - property

1512

@dbus_service_property(_interface, signature="n",

1513

access="read")

1514

def LastCheckerStatus_dbus_property(self):

1515

return dbus.Int16(self.last_checker_status)

1516

1517

1130

# Expires - property

1518

1131

@dbus_service_property(_interface, signature="s", access="read")

1519

1132

def Expires_dbus_property(self):

1530

1143

def Timeout_dbus_property(self, value=None):

1531

1144

if value is None: # get

1532

1145

return dbus.UInt64(self.timeout_milliseconds())

1533

old_timeout = self.timeout

1534

1146

self.timeout = datetime.timedelta(0, 0, 0, value)

1535

# Reschedule disabling

1536

if self.enabled:

1537

now = datetime.datetime.utcnow()

1538

self.expires += self.timeout - old_timeout

1539

if self.expires <= now:

1540

# The timeout has passed

1541

self.disable()

1542

else:

1543

if (getattr(self, "disable_initiator_tag", None)

1544

is None):

1545

return

1546

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1147

if getattr(self, "disable_initiator_tag", None) is None:

1148

return

1149

# Reschedule timeout

1150

gobject.source_remove(self.disable_initiator_tag)

1151

self.disable_initiator_tag = None

1152

self.expires = None

1153

time_to_die = (self.

1154

_timedelta_to_milliseconds((self

1155

.last_checked_ok

1156

+ self.timeout)

1157

- datetime.datetime

1158

.utcnow()))

1159

if time_to_die <= 0:

1160

# The timeout has passed

1161

self.disable()

1162

else:

1163

self.expires = (datetime.datetime.utcnow()

1164

+ datetime.timedelta(milliseconds = time_to_die))

1165

self.disable_initiator_tag = (gobject.timeout_add

1166

(time_to_die, self.disable))

1551

1167

1552

1168

# ExtendedTimeout - property

1553

1169

@dbus_service_property(_interface, signature="t",

1566

1182

self.interval = datetime.timedelta(0, 0, 0, value)

1567

1183

if getattr(self, "checker_initiator_tag", None) is None:

1568

1184

return

1569

if self.enabled:

1570

# Reschedule checker run

1571

gobject.source_remove(self.checker_initiator_tag)

1572

self.checker_initiator_tag = (gobject.timeout_add

1573

(value, self.start_checker))

1574

self.start_checker() # Start one now, too

1185

# Reschedule checker run

1186

gobject.source_remove(self.checker_initiator_tag)

1187

self.checker_initiator_tag = (gobject.timeout_add

1188

(value, self.start_checker))

1189

self.start_checker() # Start one now, too

1575

1190

1576

1191

# Checker - property

1577

1192

@dbus_service_property(_interface, signature="s",

1579

1194

def Checker_dbus_property(self, value=None):

1580

1195

if value is None: # get

1581

1196

return dbus.String(self.checker_command)

1582

self.checker_command = unicode(value)

1197

self.checker_command = value

1583

1198

1584

1199

# CheckerRunning - property

1585

1200

@dbus_service_property(_interface, signature="b",

1614

1229

raise KeyError()

1615

1230

1616

1231

def __getattribute__(self, name):

1617

if name == '_pipe':

1232

if(name == '_pipe'):

1618

1233

return super(ProxyClient, self).__getattribute__(name)

1619

1234

self._pipe.send(('getattr', name))

1620

1235

data = self._pipe.recv()

1627

1242

return func

1628

1243

1629

1244

def __setattr__(self, name, value):

1630

if name == '_pipe':

1245

if(name == '_pipe'):

1631

1246

return super(ProxyClient, self).__setattr__(name, value)

1632

1247

self._pipe.send(('setattr', name, value))

1633

1248

1716

1331

client.name)

1717

1332

if self.server.use_dbus:

1718

1333

# Emit D-Bus signal

1719

client.Rejected("Disabled")

1334

client.Rejected("Disabled")

1720

1335

return

1721

1336

1722

if client.approved or not client.approval_delay:

1337

if client._approved or not client.approval_delay:

1723

1338

#We are approved or approval is disabled

1724

1339

break

1725

elif client.approved is None:

1340

elif client._approved is None:

1726

1341

logger.info("Client %s needs approval",

1727

1342

client.name)

1728

1343

if self.server.use_dbus:

1739

1354

return

1740

1355

1741

1356

#wait until timeout or approved

1357

#x = float(client._timedelta_to_milliseconds(delay))

1742

1358

time = datetime.datetime.now()

1743

1359

client.changedstate.acquire()

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1360

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1747

1361

client.changedstate.release()

1748

1362

time2 = datetime.datetime.now()

1749

1363

if (time2 - time) >= delay:

1765

1379

try:

1766

1380

sent = session.send(client.secret[sent_size:])

1767

1381

except gnutls.errors.GNUTLSError as error:

1768

logger.warning("gnutls send failed",

1769

exc_info=error)

1382

logger.warning("gnutls send failed")

1770

1383

return

1771

1384

logger.debug("Sent: %d, remaining: %d",

1772

1385

sent, len(client.secret)

1774

1387

sent_size += sent

1775

1388

1776

1389

logger.info("Sending secret to %s", client.name)

1777

# bump the timeout using extended_timeout

1778

client.bump_timeout(client.extended_timeout)

1390

# bump the timeout as if seen

1391

client.checked_ok(client.extended_timeout)

1779

1392

if self.server.use_dbus:

1780

1393

# Emit D-Bus signal

1781

1394

client.GotSecret()

1786

1399

try:

1787

1400

session.bye()

1788

1401

except gnutls.errors.GNUTLSError as error:

1789

logger.warning("GnuTLS bye failed",

1790

exc_info=error)

1402

logger.warning("GnuTLS bye failed")

1791

1403

1792

1404

@staticmethod

1793

1405

def peer_certificate(session):

1849

1461

# Convert the buffer to a Python bytestring

1850

1462

fpr = ctypes.string_at(buf, buf_len.value)

1851

1463

# Convert the bytestring to hexadecimal notation

1852

hex_fpr = binascii.hexlify(fpr).upper()

1464

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1853

1465

return hex_fpr

1854

1466

1855

1467

1858

1470

def sub_process_main(self, request, address):

1859

1471

try:

1860

1472

self.finish_request(request, address)

1861

except Exception:

1473

except:

1862

1474

self.handle_error(request, address)

1863

1475

self.close_request(request)

1864

1476

1865

1477

def process_request(self, request, address):

1866

1478

"""Start a new process to process the request."""

1867

proc = multiprocessing.Process(target = self.sub_process_main,

1868

args = (request, address))

1869

proc.start()

1870

return proc

1479

multiprocessing.Process(target = self.sub_process_main,

1480

args = (request, address)).start()

1871

1481

1872

1482

1873

1483

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1879

1489

"""

1880

1490

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1881

1491

1882

proc = MultiprocessingMixIn.process_request(self, request,

1883

client_address)

1492

super(MultiprocessingMixInWithPipe,

1493

self).process_request(request, client_address)

1884

1494

self.child_pipe.close()

1885

self.add_pipe(parent_pipe, proc)

1495

self.add_pipe(parent_pipe)

1886

1496

1887

def add_pipe(self, parent_pipe, proc):

1497

def add_pipe(self, parent_pipe):

1888

1498

"""Dummy function; override as necessary"""

1889

1499

raise NotImplementedError

1890

1500

1921

1531

str(self.interface

1922

1532

+ '\0'))

1923

1533

except socket.error as error:

1924

if error.errno == errno.EPERM:

1534

if error[0] == errno.EPERM:

1925

1535

logger.error("No permission to"

1926

1536

" bind to interface %s",

1927

1537

self.interface)

1928

elif error.errno == errno.ENOPROTOOPT:

1538

elif error[0] == errno.ENOPROTOOPT:

1929

1539

logger.error("SO_BINDTODEVICE not available;"

1930

1540

" cannot bind to interface %s",

1931

1541

self.interface)

1932

elif error.errno == errno.ENODEV:

1933

logger.error("Interface %s does not"

1934

" exist, cannot bind",

1935

self.interface)

1936

1542

else:

1937

1543

raise

1938

1544

# Only bind(2) the socket if we really need to.

1972

1578

self.enabled = False

1973

1579

self.clients = clients

1974

1580

if self.clients is None:

1975

self.clients = {}

1581

self.clients = set()

1976

1582

self.use_dbus = use_dbus

1977

1583

self.gnutls_priority = gnutls_priority

1978

1584

IPv6_TCPServer.__init__(self, server_address,

1982

1588

def server_activate(self):

1983

1589

if self.enabled:

1984

1590

return socketserver.TCPServer.server_activate(self)

1985

1986

1591

def enable(self):

1987

1592

self.enabled = True

1988

1989

def add_pipe(self, parent_pipe, proc):

1593

def add_pipe(self, parent_pipe):

1990

1594

# Call "handle_ipc" for both data and EOF events

1991

1595

gobject.io_add_watch(parent_pipe.fileno(),

1992

1596

gobject.IO_IN | gobject.IO_HUP,

1993

1597

functools.partial(self.handle_ipc,

1994

parent_pipe =

1995

parent_pipe,

1996

proc = proc))

1997

1598

parent_pipe = parent_pipe))

1599

1998

1600

def handle_ipc(self, source, condition, parent_pipe=None,

1999

proc = None, client_object=None):

2000

# error, or the other end of multiprocessing.Pipe has closed

2001

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2002

# Wait for other process to exit

2003

proc.join()

1601

client_object=None):

1602

condition_names = {

1603

gobject.IO_IN: "IN", # There is data to read.

1604

gobject.IO_OUT: "OUT", # Data can be written (without

1605

# blocking).

1606

gobject.IO_PRI: "PRI", # There is urgent data to read.

1607

gobject.IO_ERR: "ERR", # Error condition.

1608

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1609

# broken, usually for pipes and

1610

# sockets).

1611

}

1612

conditions_string = ' | '.join(name

1613

for cond, name in

1614

condition_names.iteritems()

1615

if cond & condition)

1616

# error or the other end of multiprocessing.Pipe has closed

1617

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2004

1618

return False

2005

1619

2006

1620

# Read a request from the child

2011

1625

fpr = request[1]

2012

1626

address = request[2]

2013

1627

2014

for c in self.clients.itervalues():

1628

for c in self.clients:

2015

1629

if c.fingerprint == fpr:

2016

1630

client = c

2017

1631

break

2020

1634

"dress: %s", fpr, address)

2021

1635

if self.use_dbus:

2022

1636

# Emit D-Bus signal

2023

mandos_dbus_service.ClientNotFound(fpr,

2024

address[0])

1637

mandos_dbus_service.ClientNotFound(fpr, address[0])

2025

1638

parent_pipe.send(False)

2026

1639

return False

2027

1640

2028

1641

gobject.io_add_watch(parent_pipe.fileno(),

2029

1642

gobject.IO_IN | gobject.IO_HUP,

2030

1643

functools.partial(self.handle_ipc,

2031

parent_pipe =

2032

parent_pipe,

2033

proc = proc,

2034

client_object =

2035

client))

1644

parent_pipe = parent_pipe,

1645

client_object = client))

2036

1646

parent_pipe.send(True)

2037

# remove the old hook in favor of the new above hook on

2038

# same fileno

1647

# remove the old hook in favor of the new above hook on same fileno

2039

1648

return False

2040

1649

if command == 'funcall':

2041

1650

funcname = request[1]

2042

1651

args = request[2]

2043

1652

kwargs = request[3]

2044

1653

2045

parent_pipe.send(('data', getattr(client_object,

2046

funcname)(*args,

2047

**kwargs)))

1654

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

2048

1655

2049

1656

if command == 'getattr':

2050

1657

attrname = request[1]

2051

1658

if callable(client_object.__getattribute__(attrname)):

2052

1659

parent_pipe.send(('function',))

2053

1660

else:

2054

parent_pipe.send(('data', client_object

2055

.__getattribute__(attrname)))

1661

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2056

1662

2057

1663

if command == 'setattr':

2058

1664

attrname = request[1]

2094

1700

elif suffix == "w":

2095

1701

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2096

1702

else:

2097

raise ValueError("Unknown suffix {0!r}"

2098

.format(suffix))

1703

raise ValueError("Unknown suffix %r" % suffix)

2099

1704

except (ValueError, IndexError) as e:

2100

1705

raise ValueError(*(e.args))

2101

1706

timevalue += delta

2102

1707

return timevalue

2103

1708

2104

1709

1710

def if_nametoindex(interface):

1711

"""Call the C function if_nametoindex(), or equivalent

1712

1713

Note: This function cannot accept a unicode string."""

1714

global if_nametoindex

1715

try:

1716

if_nametoindex = (ctypes.cdll.LoadLibrary

1717

(ctypes.util.find_library("c"))

1718

.if_nametoindex)

1719

except (OSError, AttributeError):

1720

logger.warning("Doing if_nametoindex the hard way")

1721

def if_nametoindex(interface):

1722

"Get an interface index the hard way, i.e. using fcntl()"

1723

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1724

with contextlib.closing(socket.socket()) as s:

1725

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1726

struct.pack(str("16s16x"),

1727

interface))

1728

interface_index = struct.unpack(str("I"),

1729

ifreq[16:20])[0]

1730

return interface_index

1731

return if_nametoindex(interface)

1732

1733

2105

1734

def daemon(nochdir = False, noclose = False):

2106

1735

"""See daemon(3). Standard BSD Unix function.

2107

1736

2115

1744

sys.exit()

2116

1745

if not noclose:

2117

1746

# Close all standard open file descriptors

2118

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1747

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2119

1748

if not stat.S_ISCHR(os.fstat(null).st_mode):

2120

1749

raise OSError(errno.ENODEV,

2121

"{0} not a character device"

2122

.format(os.devnull))

1750

"%s not a character device"

1751

% os.path.devnull)

2123

1752

os.dup2(null, sys.stdin.fileno())

2124

1753

os.dup2(null, sys.stdout.fileno())

2125

1754

os.dup2(null, sys.stderr.fileno())

2134

1763

2135

1764

parser = argparse.ArgumentParser()

2136

1765

parser.add_argument("-v", "--version", action="version",

2137

version = "%(prog)s {0}".format(version),

1766

version = "%%(prog)s %s" % version,

2138

1767

help="show version number and exit")

2139

1768

parser.add_argument("-i", "--interface", metavar="IF",

2140

1769

help="Bind to interface IF")

2162

1791

" system bus interface")

2163

1792

parser.add_argument("--no-ipv6", action="store_false",

2164

1793

dest="use_ipv6", help="Do not use IPv6")

2165

parser.add_argument("--no-restore", action="store_false",

2166

dest="restore", help="Do not restore stored"

2167

" state")

2168

parser.add_argument("--statedir", metavar="DIR",

2169

help="Directory to save/restore state in")

2170

2171

1794

options = parser.parse_args()

2172

1795

2173

1796

if options.check:

2186

1809

"use_dbus": "True",

2187

1810

"use_ipv6": "True",

2188

1811

"debuglevel": "",

2189

"restore": "True",

2190

"statedir": "/var/lib/mandos"

2191

1812

}

2192

1813

2193

1814

# Parse config file for server-global settings

2210

1831

# options, if set.

2211

1832

for option in ("interface", "address", "port", "debug",

2212

1833

"priority", "servicename", "configdir",

2213

"use_dbus", "use_ipv6", "debuglevel", "restore",

2214

"statedir"):

1834

"use_dbus", "use_ipv6", "debuglevel"):

2215

1835

value = getattr(options, option)

2216

1836

if value is not None:

2217

1837

server_settings[option] = value

2229

1849

debuglevel = server_settings["debuglevel"]

2230

1850

use_dbus = server_settings["use_dbus"]

2231

1851

use_ipv6 = server_settings["use_ipv6"]

2232

stored_state_path = os.path.join(server_settings["statedir"],

2233

stored_state_file)

2234

2235

if debug:

2236

initlogger(debug, logging.DEBUG)

2237

else:

2238

if not debuglevel:

2239

initlogger(debug)

2240

else:

2241

level = getattr(logging, debuglevel.upper())

2242

initlogger(debug, level)

2243

1852

2244

1853

if server_settings["servicename"] != "Mandos":

2245

1854

syslogger.setFormatter(logging.Formatter

2246

('Mandos ({0}) [%(process)d]:'

2247

' %(levelname)s: %(message)s'

2248

.format(server_settings

2249

["servicename"])))

1855

('Mandos (%s) [%%(process)d]:'

1856

' %%(levelname)s: %%(message)s'

1857

% server_settings["servicename"]))

2250

1858

2251

1859

# Parse config file with clients

2252

client_config = configparser.SafeConfigParser(Client

2253

.client_defaults)

1860

client_defaults = { "timeout": "5m",

1861

"extended_timeout": "15m",

1862

"interval": "2m",

1863

"checker": "fping -q -- %%(host)s",

1864

"host": "",

1865

"approval_delay": "0s",

1866

"approval_duration": "1s",

1867

}

1868

client_config = configparser.SafeConfigParser(client_defaults)

2254

1869

client_config.read(os.path.join(server_settings["configdir"],

2255

1870

"clients.conf"))

2256

1871

2270

1885

pidfilename = "/var/run/mandos.pid"

2271

1886

try:

2272

1887

pidfile = open(pidfilename, "w")

2273

except IOError as e:

2274

logger.error("Could not open file %r", pidfilename,

2275

exc_info=e)

1888

except IOError:

1889

logger.error("Could not open file %r", pidfilename)

2276

1890

2277

for name in ("_mandos", "mandos", "nobody"):

1891

try:

1892

uid = pwd.getpwnam("_mandos").pw_uid

1893

gid = pwd.getpwnam("_mandos").pw_gid

1894

except KeyError:

2278

1895

try:

2279

uid = pwd.getpwnam(name).pw_uid

2280

gid = pwd.getpwnam(name).pw_gid

2281

break

1896

uid = pwd.getpwnam("mandos").pw_uid

1897

gid = pwd.getpwnam("mandos").pw_gid

2282

1898

except KeyError:

2283

continue

2284

else:

2285

uid = 65534

2286

gid = 65534

1899

try:

1900

uid = pwd.getpwnam("nobody").pw_uid

1901

gid = pwd.getpwnam("nobody").pw_gid

1902

except KeyError:

1903

uid = 65534

1904

gid = 65534

2287

1905

try:

2288

1906

os.setgid(gid)

2289

1907

os.setuid(uid)

2290

1908

except OSError as error:

2291

if error.errno != errno.EPERM:

1909

if error[0] != errno.EPERM:

2292

1910

raise error

2293

1911

1912

if not debug and not debuglevel:

1913

syslogger.setLevel(logging.WARNING)

1914

console.setLevel(logging.WARNING)

1915

if debuglevel:

1916

level = getattr(logging, debuglevel.upper())

1917

syslogger.setLevel(level)

1918

console.setLevel(level)

1919

2294

1920

if debug:

2295

1921

# Enable all possible GnuTLS debugging

2296

1922

2306

1932

.gnutls_global_set_log_function(debug_gnutls))

2307

1933

2308

1934

# Redirect stdin so all checkers get /dev/null

2309

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1935

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2310

1936

os.dup2(null, sys.stdin.fileno())

2311

1937

if null > 2:

2312

1938

os.close(null)

1939

else:

1940

# No console logging

1941

logger.removeHandler(console)

2313

1942

2314

1943

# Need to fork before connecting to D-Bus

2315

1944

if not debug:

2316

1945

# Close all input and output, do double fork, etc.

2317

1946

daemon()

2318

1947

2319

gobject.threads_init()

2320

2321

1948

global main_loop

2322

1949

# From the Avahi example code

2323

DBusGMainLoop(set_as_default=True)

1950

DBusGMainLoop(set_as_default=True )

2324

1951

main_loop = gobject.MainLoop()

2325

1952

bus = dbus.SystemBus()

2326

1953

# End of Avahi example code

2327

1954

if use_dbus:

2328

1955

try:

2329

bus_name = dbus.service.BusName("se.recompile.Mandos",

2330

bus, do_not_queue=True)

2331

old_bus_name = (dbus.service.BusName

2332

("se.bsnet.fukt.Mandos", bus,

2333

do_not_queue=True))

1956

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1957

bus, do_not_queue=True)

1958

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1959

bus, do_not_queue=True)

2334

1960

except dbus.exceptions.NameExistsException as e:

2335

logger.error("Disabling D-Bus:", exc_info=e)

1961

logger.error(unicode(e) + ", disabling D-Bus")

2336

1962

use_dbus = False

2337

1963

server_settings["use_dbus"] = False

2338

1964

tcp_server.use_dbus = False

2339

1965

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2340

service = AvahiServiceToSyslog(name =

2341

server_settings["servicename"],

2342

servicetype = "_mandos._tcp",

2343

protocol = protocol, bus = bus)

1966

service = AvahiService(name = server_settings["servicename"],

1967

servicetype = "_mandos._tcp",

1968

protocol = protocol, bus = bus)

2344

1969

if server_settings["interface"]:

2345

1970

service.interface = (if_nametoindex

2346

1971

(str(server_settings["interface"])))

2351

1976

client_class = Client

2352

1977

if use_dbus:

2353

1978

client_class = functools.partial(ClientDBus, bus = bus)

2354

2355

client_settings = Client.config_parser(client_config)

2356

old_client_settings = {}

2357

clients_data = {}

2358

2359

# Get client data and settings from last running state.

2360

if server_settings["restore"]:

2361

try:

2362

with open(stored_state_path, "rb") as stored_state:

2363

clients_data, old_client_settings = (pickle.load

2364

(stored_state))

2365

os.remove(stored_state_path)

2366

except IOError as e:

2367

if e.errno == errno.ENOENT:

2368

logger.warning("Could not load persistent state: {0}"

2369

.format(os.strerror(e.errno)))

2370

else:

2371

logger.critical("Could not load persistent state:",

2372

exc_info=e)

2373

raise

2374

except EOFError as e:

2375

logger.warning("Could not load persistent state: "

2376

"EOFError:", exc_info=e)

2377

2378

with PGPEngine() as pgp:

2379

for client_name, client in clients_data.iteritems():

2380

# Decide which value to use after restoring saved state.

2381

# We have three different values: Old config file,

2382

# new config file, and saved state.

2383

# New config value takes precedence if it differs from old

2384

# config value, otherwise use saved state.

2385

for name, value in client_settings[client_name].items():

2386

try:

2387

# For each value in new config, check if it

2388

# differs from the old config value (Except for

2389

# the "secret" attribute)

2390

if (name != "secret" and

2391

value != old_client_settings[client_name]

2392

[name]):

2393

client[name] = value

2394

except KeyError:

2395

pass

2396

2397

# Clients who has passed its expire date can still be

2398

# enabled if its last checker was successful. Clients

2399

# whose checker succeeded before we stored its state is

2400

# assumed to have successfully run all checkers during

2401

# downtime.

2402

if client["enabled"]:

2403

if datetime.datetime.utcnow() >= client["expires"]:

2404

if not client["last_checked_ok"]:

2405

logger.warning(

2406

"disabling client {0} - Client never "

2407

"performed a successful checker"

2408

.format(client_name))

2409

client["enabled"] = False

2410

elif client["last_checker_status"] != 0:

2411

logger.warning(

2412

"disabling client {0} - Client "

2413

"last checker failed with error code {1}"

2414

.format(client_name,

2415

client["last_checker_status"]))

2416

client["enabled"] = False

2417

else:

2418

client["expires"] = (datetime.datetime

2419

.utcnow()

2420

+ client["timeout"])

2421

logger.debug("Last checker succeeded,"

2422

" keeping {0} enabled"

2423

.format(client_name))

1979

def client_config_items(config, section):

1980

special_settings = {

1981

"approved_by_default":

1982

lambda: config.getboolean(section,

1983

"approved_by_default"),

1984

}

1985

for name, value in config.items(section):

2424

1986

try:

2425

client["secret"] = (

2426

pgp.decrypt(client["encrypted_secret"],

2427

client_settings[client_name]

2428

["secret"]))

2429

except PGPError:

2430

# If decryption fails, we use secret from new settings

2431

logger.debug("Failed to decrypt {0} old secret"

2432

.format(client_name))

2433

client["secret"] = (

2434

client_settings[client_name]["secret"])

2435

2436

# Add/remove clients based on new changes made to config

2437

for client_name in (set(old_client_settings)

2438

- set(client_settings)):

2439

del clients_data[client_name]

2440

for client_name in (set(client_settings)

2441

- set(old_client_settings)):

2442

clients_data[client_name] = client_settings[client_name]

2443

2444

# Create all client objects

2445

for client_name, client in clients_data.iteritems():

2446

tcp_server.clients[client_name] = client_class(

2447

name = client_name, settings = client)

2448

1987

yield (name, special_settings[name]())

1988

except KeyError:

1989

yield (name, value)

1990

1991

tcp_server.clients.update(set(

1992

client_class(name = section,

1993

config= dict(client_config_items(

1994

client_config, section)))

1995

for section in client_config.sections()))

2449

1996

if not tcp_server.clients:

2450

1997

logger.warning("No clients defined")

2451

1998

2452

1999

if not debug:

2453

2000

try:

2454

2001

with pidfile:

2462

2009

# "pidfile" was never created

2463

2010

pass

2464

2011

del pidfilename

2012

2013

signal.signal(signal.SIGINT, signal.SIG_IGN)

2465

2014

2466

2015

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2467

2016

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2468

2017

2469

2018

if use_dbus:

2470

@alternate_dbus_interfaces({"se.recompile.Mandos":

2471

"se.bsnet.fukt.Mandos"})

2472

class MandosDBusService(DBusObjectWithProperties):

2019

class MandosDBusService(dbus.service.Object):

2473

2020

"""A D-Bus proxy object"""

2474

2021

def __init__(self):

2475

2022

dbus.service.Object.__init__(self, bus, "/")

2476

_interface = "se.recompile.Mandos"

2477

2478

@dbus_interface_annotations(_interface)

2479

def _foo(self):

2480

return { "org.freedesktop.DBus.Property"

2481

".EmitsChangedSignal":

2482

"false"}

2023

_interface = "se.bsnet.fukt.Mandos"

2483

2024

2484

2025

@dbus.service.signal(_interface, signature="o")

2485

2026

def ClientAdded(self, objpath):

2500

2041

def GetAllClients(self):

2501

2042

"D-Bus method"

2502

2043

return dbus.Array(c.dbus_object_path

2503

for c in

2504

tcp_server.clients.itervalues())

2044

for c in tcp_server.clients)

2505

2045

2506

2046

@dbus.service.method(_interface,

2507

2047

out_signature="a{oa{sv}}")

2509

2049

"D-Bus method"

2510

2050

return dbus.Dictionary(

2511

2051

((c.dbus_object_path, c.GetAll(""))

2512

for c in tcp_server.clients.itervalues()),

2052

for c in tcp_server.clients),

2513

2053

signature="oa{sv}")

2514

2054

2515

2055

@dbus.service.method(_interface, in_signature="o")

2516

2056

def RemoveClient(self, object_path):

2517

2057

"D-Bus method"

2518

for c in tcp_server.clients.itervalues():

2058

for c in tcp_server.clients:

2519

2059

if c.dbus_object_path == object_path:

2520

del tcp_server.clients[c.name]

2060

tcp_server.clients.remove(c)

2521

2061

c.remove_from_connection()

2522

2062

# Don't signal anything except ClientRemoved

2523

2063

c.disable(quiet=True)

2534

2074

"Cleanup function; run on exit"

2535

2075

service.cleanup()

2536

2076

2537

multiprocessing.active_children()

2538

if not (tcp_server.clients or client_settings):

2539

return

2540

2541

# Store client before exiting. Secrets are encrypted with key

2542

# based on what config file has. If config file is

2543

# removed/edited, old secret will thus be unrecovable.

2544

clients = {}

2545

with PGPEngine() as pgp:

2546

for client in tcp_server.clients.itervalues():

2547

key = client_settings[client.name]["secret"]

2548

client.encrypted_secret = pgp.encrypt(client.secret,

2549

key)

2550

client_dict = {}

2551

2552

# A list of attributes that can not be pickled

2553

# + secret.

2554

exclude = set(("bus", "changedstate", "secret",

2555

"checker"))

2556

for name, typ in (inspect.getmembers

2557

(dbus.service.Object)):

2558

exclude.add(name)

2559

2560

client_dict["encrypted_secret"] = (client

2561

.encrypted_secret)

2562

for attr in client.client_structure:

2563

if attr not in exclude:

2564

client_dict[attr] = getattr(client, attr)

2565

2566

clients[client.name] = client_dict

2567

del client_settings[client.name]["secret"]

2568

2569

try:

2570

with (tempfile.NamedTemporaryFile

2571

(mode='wb', suffix=".pickle", prefix='clients-',

2572

dir=os.path.dirname(stored_state_path),

2573

delete=False)) as stored_state:

2574

pickle.dump((clients, client_settings), stored_state)

2575

tempname=stored_state.name

2576

os.rename(tempname, stored_state_path)

2577

except (IOError, OSError) as e:

2578

if not debug:

2579

try:

2580

os.remove(tempname)

2581

except NameError:

2582

pass

2583

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2584

logger.warning("Could not save persistent state: {0}"

2585

.format(os.strerror(e.errno)))

2586

else:

2587

logger.warning("Could not save persistent state:",

2588

exc_info=e)

2589

raise e

2590

2591

# Delete all clients, and settings from config

2592

2077

while tcp_server.clients:

2593

name, client = tcp_server.clients.popitem()

2078

client = tcp_server.clients.pop()

2594

2079

if use_dbus:

2595

2080

client.remove_from_connection()

2081

client.disable_hook = None

2596

2082

# Don't signal anything except ClientRemoved

2597

2083

client.disable(quiet=True)

2598

2084

if use_dbus:

2599

2085

# Emit D-Bus signal

2600

mandos_dbus_service.ClientRemoved(client

2601

.dbus_object_path,

2086

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2602

2087

client.name)

2603

client_settings.clear()

2604

2088

2605

2089

atexit.register(cleanup)

2606

2090

2607

for client in tcp_server.clients.itervalues():

2091

for client in tcp_server.clients:

2608

2092

if use_dbus:

2609

2093

# Emit D-Bus signal

2610

2094

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2611

# Need to initiate checking of clients

2612

if client.enabled:

2613

client.init_checker()

2095

client.enable()

2614

2096

2615

2097

tcp_server.enable()

2616

2098

tcp_server.server_activate()

2619

2101

service.port = tcp_server.socket.getsockname()[1]

2620

2102

if use_ipv6:

2621

2103

logger.info("Now listening on address %r, port %d,"

2622

" flowinfo %d, scope_id %d",

2623

*tcp_server.socket.getsockname())

2104

" flowinfo %d, scope_id %d"

2105

% tcp_server.socket.getsockname())

2624

2106

else: # IPv4

2625

logger.info("Now listening on address %r, port %d",

2626

*tcp_server.socket.getsockname())

2107

logger.info("Now listening on address %r, port %d"

2108

% tcp_server.socket.getsockname())

2627

2109

2628

2110

#service.interface = tcp_server.socket.getsockname()[3]

2629

2111

2632

2114

try:

2633

2115

service.activate()

2634

2116

except dbus.exceptions.DBusException as error:

2635

logger.critical("D-Bus Exception", exc_info=error)

2117

logger.critical("DBusException: %s", error)

2636

2118

cleanup()

2637

2119

sys.exit(1)

2638

2120

# End of Avahi example code

2645

2127

logger.debug("Starting main loop")

2646

2128

main_loop.run()

2647

2129

except AvahiError as error:

2648

logger.critical("Avahi Error", exc_info=error)

2130

logger.critical("AvahiError: %s", error)

2649

2131

cleanup()

2650

2132

sys.exit(1)

2651

2133

except KeyboardInterrupt:

2656

2138

# Must run before the D-Bus bus name gets deregistered

2657

2139

cleanup()

2658

2140

2141

2659

2142

if __name__ == '__main__':

2660

2143

main()