/mandos/trunk : revision 24.1.186

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

65

63

import cPickle as pickle

66

64

import multiprocessing

67

65

import types

68

import binascii

69

import tempfile

70

import itertools

71

66

72

67

import dbus

73

68

import dbus.service

78

73

import ctypes.util

79

74

import xml.dom.minidom

80

75

import inspect

81

import GnuPGInterface

82

76

83

77

try:

84

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

88

82

except ImportError:

89

83

SO_BINDTODEVICE = None

90

84

91

version = "1.5.3"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

85

86

version = "1.3.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

95

90

syslogger = (logging.handlers.SysLogHandler

96

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

92

address = str("/dev/log")))

98

99

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

def if_nametoindex(interface):

105

"Get an interface index the hard way, i.e. using fcntl()"

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

with contextlib.closing(socket.socket()) as s:

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

113

return interface_index

114

115

116

def initlogger(debug, level=logging.WARNING):

117

"""init logger and add loglevel"""

118

119

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

132

133

134

class PGPError(Exception):

135

"""Exception if encryption/decryption fails"""

136

pass

137

138

139

class PGPEngine(object):

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

151

def __enter__(self):

152

return self

153

154

def __exit__ (self, exc_type, exc_value, traceback):

155

self._cleanup()

156

return False

157

158

def __del__(self):

159

self._cleanup()

160

161

def _cleanup(self):

162

if self.tempdir is not None:

163

# Delete contents of tempdir

164

for root, dirs, files in os.walk(self.tempdir,

165

topdown = False):

166

for filename in files:

167

os.remove(os.path.join(root, filename))

168

for dirname in dirs:

169

os.rmdir(os.path.join(root, dirname))

170

# Remove tempdir

171

os.rmdir(self.tempdir)

172

self.tempdir = None

173

174

def password_encode(self, password):

175

# Passphrase can not be empty and can not contain newlines or

176

# NUL bytes. So we prefix it and hex encode it.

177

return b"mandos" + binascii.hexlify(password)

178

179

def encrypt(self, data, password):

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

194

return ciphertext

195

196

def decrypt(self, data, password):

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

211

return decrypted_plaintext

212

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

213

103

214

104

class AvahiError(Exception):

215

105

def __init__(self, value, *args, **kwargs):

245

135

server: D-Bus Server

246

136

bus: dbus.SystemBus()

247

137

"""

248

249

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

139

servicetype = None, port = None, TXT = None,

251

140

domain = "", host = "", max_renames = 32768,

264

153

self.server = None

265

154

self.bus = bus

266

155

self.entry_group_state_changed_match = None

267

268

156

def rename(self):

269

157

"""Derived from the Avahi example code"""

270

158

if self.rename_count >= self.max_renames:

272

160

" after %i retries, exiting.",

273

161

self.rename_count)

274

162

raise AvahiServiceError("Too many renames")

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

277

164

logger.info("Changing Zeroconf service name to %r ...",

278

165

self.name)

166

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

169

% self.name))

279

170

self.remove()

280

171

try:

281

172

self.add()

282

173

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

174

logger.critical("DBusException: %s", error)

284

175

self.cleanup()

285

176

os._exit(1)

286

177

self.rename_count += 1

287

288

178

def remove(self):

289

179

"""Derived from the Avahi example code"""

290

180

if self.entry_group_state_changed_match is not None:

292

182

self.entry_group_state_changed_match = None

293

183

if self.group is not None:

294

184

self.group.Reset()

295

296

185

def add(self):

297

186

"""Derived from the Avahi example code"""

298

187

self.remove()

303

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

304

193

self.entry_group_state_changed_match = (

305

194

self.group.connect_to_signal(

306

'StateChanged', self.entry_group_state_changed))

195

'StateChanged', self .entry_group_state_changed))

307

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

308

197

self.name, self.type)

309

198

self.group.AddService(

315

204

dbus.UInt16(self.port),

316

205

avahi.string_array_to_txt_array(self.TXT))

317

206

self.group.Commit()

318

319

207

def entry_group_state_changed(self, state, error):

320

208

"""Derived from the Avahi example code"""

321

209

logger.debug("Avahi entry group state change: %i", state)

328

216

elif state == avahi.ENTRY_GROUP_FAILURE:

329

217

logger.critical("Avahi: Error in group state changed %s",

330

218

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

219

raise AvahiGroupError("State changed: %s"

220

% unicode(error))

334

221

def cleanup(self):

335

222

"""Derived from the Avahi example code"""

336

223

if self.group is not None:

337

224

try:

338

225

self.group.Free()

339

226

except (dbus.exceptions.UnknownMethodException,

340

dbus.exceptions.DBusException):

227

dbus.exceptions.DBusException) as e:

341

228

pass

342

229

self.group = None

343

230

self.remove()

344

345

231

def server_state_changed(self, state, error=None):

346

232

"""Derived from the Avahi example code"""

347

233

logger.debug("Avahi server state change: %i", state)

366

252

logger.debug("Unknown state: %r", state)

367

253

else:

368

254

logger.debug("Unknown state: %r: %r", state, error)

369

370

255

def activate(self):

371

256

"""Derived from the Avahi example code"""

372

257

if self.server is None:

380

265

self.server_state_changed(self.server.GetState())

381

266

382

267

383

class AvahiServiceToSyslog(AvahiService):

384

def rename(self):

385

"""Add the new name to the syslog messages"""

386

ret = AvahiService.rename(self)

387

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

391

return ret

392

393

394

def timedelta_to_milliseconds(td):

268

def _timedelta_to_milliseconds(td):

395

269

"Convert a datetime.timedelta() to milliseconds"

396

270

return ((td.days * 24 * 60 * 60 * 1000)

397

271

+ (td.seconds * 1000)

398

272

+ (td.microseconds // 1000))

399

400

273

401

274

class Client(object):

402

275

"""A representation of a client host served by this server.

403

276

404

277

Attributes:

405

approved: bool(); 'None' if not yet approved/disapproved

278

_approved: bool(); 'None' if not yet approved/disapproved

406

279

approval_delay: datetime.timedelta(); Time to wait for approval

407

280

approval_duration: datetime.timedelta(); Duration of one approval

408

281

checker: subprocess.Popen(); a running checker process used

415

288

instance %(name)s can be used in the command.

416

289

checker_initiator_tag: a gobject event source tag, or None

417

290

created: datetime.datetime(); (UTC) object creation

418

client_structure: Object describing what attributes a client has

419

and is used for storing the client at exit

420

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

421

293

disable_initiator_tag: a gobject event source tag, or None

422

294

enabled: bool()

423

295

fingerprint: string (40 or 32 hexadecimal digits); used to

426

298

interval: datetime.timedelta(); How often to start a new checker

427

299

last_approval_request: datetime.datetime(); (UTC) or None

428

300

last_checked_ok: datetime.datetime(); (UTC) or None

429

last_checker_status: integer between 0 and 255 reflecting exit

430

status of last checker. -1 reflects crashed

431

checker, -2 means no checker completed yet.

432

last_enabled: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

433

302

name: string; from the config file, used in log messages and

434

303

D-Bus identifiers

435

304

secret: bytestring; sent verbatim (over TLS) to client

436

305

timeout: datetime.timedelta(); How long from last_checked_ok

437

306

until this client is disabled

438

extended_timeout: extra long timeout when secret has been sent

307

extended_timeout: extra long timeout when password has been sent

439

308

runtime_expansions: Allowed attributes for runtime expansion.

440

309

expires: datetime.datetime(); time (UTC) when a client will be

441

310

disabled, or None

442

311

"""

443

312

444

313

runtime_expansions = ("approval_delay", "approval_duration",

445

"created", "enabled", "expires",

446

"fingerprint", "host", "interval",

447

"last_approval_request", "last_checked_ok",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

448

316

"last_enabled", "name", "timeout")

449

client_defaults = { "timeout": "5m",

450

"extended_timeout": "15m",

451

"interval": "2m",

452

"checker": "fping -q -- %%(host)s",

453

"host": "",

454

"approval_delay": "0s",

455

"approval_duration": "1s",

456

"approved_by_default": "True",

457

"enabled": "True",

458

}

459

317

460

318

def timeout_milliseconds(self):

461

319

"Return the 'timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

463

321

464

322

def extended_timeout_milliseconds(self):

465

323

"Return the 'extended_timeout' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.extended_timeout)

324

return _timedelta_to_milliseconds(self.extended_timeout)

467

325

468

326

def interval_milliseconds(self):

469

327

"Return the 'interval' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.interval)

328

return _timedelta_to_milliseconds(self.interval)

471

329

472

330

def approval_delay_milliseconds(self):

473

return timedelta_to_milliseconds(self.approval_delay)

474

475

@staticmethod

476

def config_parser(config):

477

"""Construct a new dict of client settings of this form:

478

{ client_name: {setting_name: value, ...}, ...}

479

with exceptions for any special settings as defined above.

480

NOTE: Must be a pure function. Must return the same result

481

value given the same arguments.

482

"""

483

settings = {}

484

for client_name in config.sections():

485

section = dict(config.items(client_name))

486

client = settings[client_name] = {}

487

488

client["host"] = section["host"]

489

# Reformat values from string types to Python types

490

client["approved_by_default"] = config.getboolean(

491

client_name, "approved_by_default")

492

client["enabled"] = config.getboolean(client_name,

493

"enabled")

494

495

client["fingerprint"] = (section["fingerprint"].upper()

496

.replace(" ", ""))

497

if "secret" in section:

498

client["secret"] = section["secret"].decode("base64")

499

elif "secfile" in section:

500

with open(os.path.expanduser(os.path.expandvars

501

(section["secfile"])),

502

"rb") as secfile:

503

client["secret"] = secfile.read()

504

else:

505

raise TypeError("No secret or secfile for section {0}"

506

.format(section))

507

client["timeout"] = string_to_delta(section["timeout"])

508

client["extended_timeout"] = string_to_delta(

509

section["extended_timeout"])

510

client["interval"] = string_to_delta(section["interval"])

511

client["approval_delay"] = string_to_delta(

512

section["approval_delay"])

513

client["approval_duration"] = string_to_delta(

514

section["approval_duration"])

515

client["checker_command"] = section["checker"]

516

client["last_approval_request"] = None

517

client["last_checked_ok"] = None

518

client["last_checker_status"] = -2

519

520

return settings

521

522

def __init__(self, settings, name = None):

331

return _timedelta_to_milliseconds(self.approval_delay)

332

333

def __init__(self, name = None, disable_hook=None, config=None):

334

"""Note: the 'checker' key in 'config' sets the

335

'checker_command' attribute and *not* the 'checker'

336

attribute."""

523

337

self.name = name

524

# adding all client settings

525

for setting, value in settings.iteritems():

526

setattr(self, setting, value)

527

528

if self.enabled:

529

if not hasattr(self, "last_enabled"):

530

self.last_enabled = datetime.datetime.utcnow()

531

if not hasattr(self, "expires"):

532

self.expires = (datetime.datetime.utcnow()

533

+ self.timeout)

534

else:

535

self.last_enabled = None

536

self.expires = None

537

338

if config is None:

339

config = {}

538

340

logger.debug("Creating client %r", self.name)

539

341

# Uppercase and remove spaces from fingerprint for later

540

342

# comparison purposes with return value from the fingerprint()

541

343

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

542

346

logger.debug(" Fingerprint: %s", self.fingerprint)

543

self.created = settings.get("created",

544

datetime.datetime.utcnow())

545

546

# attributes specific for this server instance

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

353

self.secret = secfile.read()

354

else:

355

raise TypeError("No secret or secfile for client %s"

356

% self.name)

357

self.host = config.get("host", "")

358

self.created = datetime.datetime.utcnow()

359

self.enabled = False

360

self.last_approval_request = None

361

self.last_enabled = None

362

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

547

367

self.checker = None

548

368

self.checker_initiator_tag = None

549

369

self.disable_initiator_tag = None

370

self.expires = None

550

371

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

551

373

self.current_checker_command = None

552

self.approved = None

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

553

378

self.approvals_pending = 0

554

self.changedstate = (multiprocessing_manager

555

.Condition(multiprocessing_manager

556

.Lock()))

557

self.client_structure = [attr for attr in

558

self.__dict__.iterkeys()

559

if not attr.startswith("_")]

560

self.client_structure.append("client_structure")

561

562

for name, t in inspect.getmembers(type(self),

563

lambda obj:

564

isinstance(obj,

565

property)):

566

if not name.startswith("_"):

567

self.client_structure.append(name)

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

568

384

569

# Send notice to process children that client state has changed

570

385

def send_changedstate(self):

571

with self.changedstate:

572

self.changedstate.notify_all()

573

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

574

390

def enable(self):

575

391

"""Start this client's checker and timeout hooks"""

576

392

if getattr(self, "enabled", False):

577

393

# Already enabled

578

394

return

395

self.send_changedstate()

396

# Schedule a new checker to be started an 'interval' from now,

397

# and every interval from then on.

398

self.checker_initiator_tag = (gobject.timeout_add

399

(self.interval_milliseconds(),

400

self.start_checker))

401

# Schedule a disable() when 'timeout' has passed

579

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

self.disable_initiator_tag = (gobject.timeout_add

404

(self.timeout_milliseconds(),

405

self.disable))

580

406

self.enabled = True

581

407

self.last_enabled = datetime.datetime.utcnow()

582

self.init_checker()

583

self.send_changedstate()

408

# Also start a new checker *right now*.

409

self.start_checker()

584

410

585

411

def disable(self, quiet=True):

586

412

"""Disable this client."""

587

413

if not getattr(self, "enabled", False):

588

414

return False

589

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

590

418

logger.info("Disabling client %s", self.name)

591

if getattr(self, "disable_initiator_tag", None) is not None:

419

if getattr(self, "disable_initiator_tag", False):

592

420

gobject.source_remove(self.disable_initiator_tag)

593

421

self.disable_initiator_tag = None

594

422

self.expires = None

595

if getattr(self, "checker_initiator_tag", None) is not None:

423

if getattr(self, "checker_initiator_tag", False):

596

424

gobject.source_remove(self.checker_initiator_tag)

597

425

self.checker_initiator_tag = None

598

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

599

429

self.enabled = False

600

if not quiet:

601

self.send_changedstate()

602

430

# Do not run this again if called by a gobject.timeout_add

603

431

return False

604

432

605

433

def __del__(self):

434

self.disable_hook = None

606

435

self.disable()

607

436

608

def init_checker(self):

609

# Schedule a new checker to be started an 'interval' from now,

610

# and every interval from then on.

611

if self.checker_initiator_tag is not None:

612

gobject.source_remove(self.checker_initiator_tag)

613

self.checker_initiator_tag = (gobject.timeout_add

614

(self.interval_milliseconds(),

615

self.start_checker))

616

# Schedule a disable() when 'timeout' has passed

617

if self.disable_initiator_tag is not None:

618

gobject.source_remove(self.disable_initiator_tag)

619

self.disable_initiator_tag = (gobject.timeout_add

620

(self.timeout_milliseconds(),

621

self.disable))

622

# Also start a new checker *right now*.

623

self.start_checker()

624

625

437

def checker_callback(self, pid, condition, command):

626

438

"""The checker has completed, so take appropriate actions."""

627

439

self.checker_callback_tag = None

628

440

self.checker = None

629

441

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

631

if self.last_checker_status == 0:

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

632

444

logger.info("Checker for %(name)s succeeded",

633

445

vars(self))

634

446

self.checked_ok()

636

448

logger.info("Checker for %(name)s failed",

637

449

vars(self))

638

450

else:

639

self.last_checker_status = -1

640

451

logger.warning("Checker for %(name)s crashed?",

641

452

vars(self))

642

453

643

def checked_ok(self):

644

"""Assert that the client has been seen, alive and well."""

645

self.last_checked_ok = datetime.datetime.utcnow()

646

self.last_checker_status = 0

647

self.bump_timeout()

648

649

def bump_timeout(self, timeout=None):

650

"""Bump up the timeout for this client."""

454

def checked_ok(self, timeout=None):

455

"""Bump up the timeout for this client.

456

457

This should only be called when the client has been seen,

458

alive and well.

459

"""

651

460

if timeout is None:

652

461

timeout = self.timeout

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = None

656

if getattr(self, "enabled", False):

657

self.disable_initiator_tag = (gobject.timeout_add

658

(timedelta_to_milliseconds

659

(timeout), self.disable))

660

self.expires = datetime.datetime.utcnow() + timeout

462

self.last_checked_ok = datetime.datetime.utcnow()

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

467

self.disable))

661

468

662

469

def need_approval(self):

663

470

self.last_approval_request = datetime.datetime.utcnow()

668

475

If a checker already exists, leave it running and do

669

476

nothing."""

670

477

# The reason for not killing a running checker is that if we

671

# did that, and if a checker (for some reason) started running

672

# slowly and taking more than 'interval' time, then the client

673

# would inevitably timeout, since no checker would get a

674

# chance to run to completion. If we instead leave running

478

# did that, then if a checker (for some reason) started

479

# running slowly and taking more than 'interval' time, the

480

# client would inevitably timeout, since no checker would get

481

# a chance to run to completion. If we instead leave running

675

482

# checkers alone, the checker would have to take more time

676

483

# than 'timeout' for the client to be disabled, which is as it

677

484

# should be.

691

498

self.current_checker_command)

692

499

# Start a new checker if needed

693

500

if self.checker is None:

694

# Escape attributes for the shell

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

699

501

try:

700

command = self.checker_command % escaped_attrs

701

except TypeError as error:

702

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

502

# In case checker_command has exactly one % operator

503

command = self.checker_command % self.host

504

except TypeError:

505

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

514

try:

515

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

519

return True # Try again later

705

520

self.current_checker_command = command

706

521

try:

707

522

logger.info("Starting checker %r for %s",

713

528

self.checker = subprocess.Popen(command,

714

529

close_fds=True,

715

530

shell=True, cwd="/")

531

self.checker_callback_tag = (gobject.child_watch_add

532

(self.checker.pid,

533

self.checker_callback,

534

data=command))

535

# The checker may have completed before the gobject

536

# watch was added. Check for this.

537

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

538

if pid:

539

gobject.source_remove(self.checker_callback_tag)

540

self.checker_callback(pid, status, command)

716

541

except OSError as error:

717

logger.error("Failed to start subprocess",

718

exc_info=error)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

542

logger.error("Failed to start subprocess: %s",

543

error)

729

544

# Re-run this periodically if run by gobject.timeout_add

730

545

return True

731

546

738

553

return

739

554

logger.debug("Stopping checker for %(name)s", vars(self))

740

555

try:

741

self.checker.terminate()

556

os.kill(self.checker.pid, signal.SIGTERM)

742

557

#time.sleep(0.5)

743

558

#if self.checker.poll() is None:

744

# self.checker.kill()

559

# os.kill(self.checker.pid, signal.SIGKILL)

745

560

except OSError as error:

746

561

if error.errno != errno.ESRCH: # No such process

747

562

raise

764

579

# "Set" method, so we fail early here:

765

580

if byte_arrays and signature != "ay":

766

581

raise ValueError("Byte arrays not supported for non-'ay'"

767

" signature {0!r}".format(signature))

582

" signature %r" % signature)

768

583

def decorator(func):

769

584

func._dbus_is_property = True

770

585

func._dbus_interface = dbus_interface

778

593

return decorator

779

594

780

595

781

def dbus_interface_annotations(dbus_interface):

782

"""Decorator for marking functions returning interface annotations

783

784

Usage:

785

786

@dbus_interface_annotations("org.example.Interface")

787

def _foo(self): # Function name does not matter

788

return {"org.freedesktop.DBus.Deprecated": "true",

789

"org.freedesktop.DBus.Property.EmitsChangedSignal":

790

"false"}

791

"""

792

def decorator(func):

793

func._dbus_is_interface = True

794

func._dbus_interface = dbus_interface

795

func._dbus_name = dbus_interface

796

return func

797

return decorator

798

799

800

def dbus_annotations(annotations):

801

"""Decorator to annotate D-Bus methods, signals or properties

802

Usage:

803

804

@dbus_service_property("org.example.Interface", signature="b",

805

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

809

def Property_dbus_property(self):

810

return dbus.Boolean(False)

811

"""

812

def decorator(func):

813

func._dbus_annotations = annotations

814

return func

815

return decorator

816

817

818

596

class DBusPropertyException(dbus.exceptions.DBusException):

819

597

"""A base class for D-Bus property-related exceptions

820

598

"""

843

621

"""

844

622

845

623

@staticmethod

846

def _is_dbus_thing(thing):

847

"""Returns a function testing if an attribute is a D-Bus thing

848

849

If called like _is_dbus_thing("method") it returns a function

850

suitable for use as predicate to inspect.getmembers().

851

"""

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

853

False)

624

def _is_dbus_property(obj):

625

return getattr(obj, "_dbus_is_property", False)

854

626

855

def _get_all_dbus_things(self, thing):

627

def _get_all_dbus_properties(self):

856

628

"""Returns a generator of (name, attribute) pairs

857

629

"""

858

return ((getattr(athing.__get__(self), "_dbus_name",

859

name),

860

athing.__get__(self))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

861

631

for cls in self.__class__.__mro__

862

for name, athing in

863

inspect.getmembers(cls,

864

self._is_dbus_thing(thing)))

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

865

633

866

634

def _get_dbus_property(self, interface_name, property_name):

867

635

"""Returns a bound method if one exists which is a D-Bus

868

636

property with the specified name and interface.

869

637

"""

870

638

for cls in self.__class__.__mro__:

871

for name, value in (inspect.getmembers

872

(cls,

873

self._is_dbus_thing("property"))):

874

if (value._dbus_name == property_name

875

and value._dbus_interface == interface_name):

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

876

641

return value.__get__(self)

877

642

878

643

# No such property

879

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

880

645

+ interface_name + "."

881

646

+ property_name)

647

882

648

883

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

884

650

out_signature="v")

905

671

# signatures other than "ay".

906

672

if prop._dbus_signature != "ay":

907

673

raise ValueError

908

value = dbus.ByteArray(b''.join(chr(byte)

909

for byte in value))

674

value = dbus.ByteArray(''.join(unichr(byte)

675

for byte in value))

910

676

prop(value)

911

677

912

678

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

917

683

918

684

Note: Will not include properties with access="write".

919

685

"""

920

properties = {}

921

for name, prop in self._get_all_dbus_things("property"):

686

all = {}

687

for name, prop in self._get_all_dbus_properties():

922

688

if (interface_name

923

689

and interface_name != prop._dbus_interface):

924

690

# Interface non-empty but did not match

928

694

continue

929

695

value = prop()

930

696

if not hasattr(value, "variant_level"):

931

properties[name] = value

697

all[name] = value

932

698

continue

933

properties[name] = type(value)(value, variant_level=

934

value.variant_level+1)

935

return dbus.Dictionary(properties, signature="sv")

699

all[name] = type(value)(value, variant_level=

700

value.variant_level+1)

701

return dbus.Dictionary(all, signature="sv")

936

702

937

703

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

938

704

out_signature="s",

939

705

path_keyword='object_path',

940

706

connection_keyword='connection')

941

707

def Introspect(self, object_path, connection):

942

"""Overloading of standard D-Bus method.

943

944

Inserts property tags and interface annotation tags.

708

"""Standard D-Bus method, overloaded to insert property tags.

945

709

"""

946

710

xmlstring = dbus.service.Object.Introspect(self, object_path,

947

711

connection)

954

718

e.setAttribute("access", prop._dbus_access)

955

719

return e

956

720

for if_tag in document.getElementsByTagName("interface"):

957

# Add property tags

958

721

for tag in (make_tag(document, name, prop)

959

722

for name, prop

960

in self._get_all_dbus_things("property")

723

in self._get_all_dbus_properties()

961

724

if prop._dbus_interface

962

725

== if_tag.getAttribute("name")):

963

726

if_tag.appendChild(tag)

964

# Add annotation tags

965

for typ in ("method", "signal", "property"):

966

for tag in if_tag.getElementsByTagName(typ):

967

annots = dict()

968

for name, prop in (self.

969

_get_all_dbus_things(typ)):

970

if (name == tag.getAttribute("name")

971

and prop._dbus_interface

972

== if_tag.getAttribute("name")):

973

annots.update(getattr

974

(prop,

975

"_dbus_annotations",

976

{}))

977

for name, value in annots.iteritems():

978

ann_tag = document.createElement(

979

"annotation")

980

ann_tag.setAttribute("name", name)

981

ann_tag.setAttribute("value", value)

982

tag.appendChild(ann_tag)

983

# Add interface annotation tags

984

for annotation, value in dict(

985

itertools.chain.from_iterable(

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

989

if name == if_tag.getAttribute("name")

990

)).iteritems():

991

ann_tag = document.createElement("annotation")

992

ann_tag.setAttribute("name", annotation)

993

ann_tag.setAttribute("value", value)

994

if_tag.appendChild(ann_tag)

995

727

# Add the names to the return values for the

996

728

# "org.freedesktop.DBus.Properties" methods

997

729

if (if_tag.getAttribute("name")

1012

744

except (AttributeError, xml.dom.DOMException,

1013

745

xml.parsers.expat.ExpatError) as error:

1014

746

logger.error("Failed to override Introspection method",

1015

exc_info=error)

747

error)

1016

748

return xmlstring

1017

749

1018

750

1023

755

return dbus.String(dt.isoformat(),

1024

756

variant_level=variant_level)

1025

757

1026

1027

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1028

"""A class decorator; applied to a subclass of

1029

dbus.service.Object, it will add alternate D-Bus attributes with

1030

interface names according to the "alt_interface_names" mapping.

1031

Usage:

1032

1033

@alternate_dbus_names({"org.example.Interface":

1034

"net.example.AlternateInterface"})

1035

class SampleDBusObject(dbus.service.Object):

1036

@dbus.service.method("org.example.Interface")

1037

def SampleDBusMethod():

1038

pass

1039

1040

The above "SampleDBusMethod" on "SampleDBusObject" will be

1041

reachable via two interfaces: "org.example.Interface" and

1042

"net.example.AlternateInterface", the latter of which will have

1043

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1044

"true", unless "deprecate" is passed with a False value.

1045

1046

This works for methods and signals, and also for D-Bus properties

1047

(from DBusObjectWithProperties) and interfaces (from the

1048

dbus_interface_annotations decorator).

1049

"""

1050

def wrapper(cls):

1051

for orig_interface_name, alt_interface_name in (

1052

alt_interface_names.iteritems()):

1053

attr = {}

1054

interface_names = set()

1055

# Go though all attributes of the class

1056

for attrname, attribute in inspect.getmembers(cls):

1057

# Ignore non-D-Bus attributes, and D-Bus attributes

1058

# with the wrong interface name

1059

if (not hasattr(attribute, "_dbus_interface")

1060

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

1062

continue

1063

# Create an alternate D-Bus interface name based on

1064

# the current name

1065

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1068

interface_names.add(alt_interface)

1069

# Is this a D-Bus signal?

1070

if getattr(attribute, "_dbus_is_signal", False):

1071

# Extract the original non-method function by

1072

# black magic

1073

nonmethod_func = (dict(

1074

zip(attribute.func_code.co_freevars,

1075

attribute.__closure__))["func"]

1076

.cell_contents)

1077

# Create a new, but exactly alike, function

1078

# object, and decorate it to be a new D-Bus signal

1079

# with the alternate D-Bus interface name

1080

new_function = (dbus.service.signal

1081

(alt_interface,

1082

attribute._dbus_signature)

1083

(types.FunctionType(

1084

nonmethod_func.func_code,

1085

nonmethod_func.func_globals,

1086

nonmethod_func.func_name,

1087

nonmethod_func.func_defaults,

1088

nonmethod_func.func_closure)))

1089

# Copy annotations, if any

1090

try:

1091

new_function._dbus_annotations = (

1092

dict(attribute._dbus_annotations))

1093

except AttributeError:

1094

pass

1095

# Define a creator of a function to call both the

1096

# original and alternate functions, so both the

1097

# original and alternate signals gets sent when

1098

# the function is called

1099

def fixscope(func1, func2):

1100

"""This function is a scope container to pass

1101

func1 and func2 to the "call_both" function

1102

outside of its arguments"""

1103

def call_both(*args, **kwargs):

1104

"""This function will emit two D-Bus

1105

signals by calling func1 and func2"""

1106

func1(*args, **kwargs)

1107

func2(*args, **kwargs)

1108

return call_both

1109

# Create the "call_both" function and add it to

1110

# the class

1111

attr[attrname] = fixscope(attribute, new_function)

1112

# Is this a D-Bus method?

1113

elif getattr(attribute, "_dbus_is_method", False):

1114

# Create a new, but exactly alike, function

1115

# object. Decorate it to be a new D-Bus method

1116

# with the alternate D-Bus interface name. Add it

1117

# to the class.

1118

attr[attrname] = (dbus.service.method

1119

(alt_interface,

1120

attribute._dbus_in_signature,

1121

attribute._dbus_out_signature)

1122

(types.FunctionType

1123

(attribute.func_code,

1124

attribute.func_globals,

1125

attribute.func_name,

1126

attribute.func_defaults,

1127

attribute.func_closure)))

1128

# Copy annotations, if any

1129

try:

1130

attr[attrname]._dbus_annotations = (

1131

dict(attribute._dbus_annotations))

1132

except AttributeError:

1133

pass

1134

# Is this a D-Bus property?

1135

elif getattr(attribute, "_dbus_is_property", False):

1136

# Create a new, but exactly alike, function

1137

# object, and decorate it to be a new D-Bus

1138

# property with the alternate D-Bus interface

1139

# name. Add it to the class.

1140

attr[attrname] = (dbus_service_property

1141

(alt_interface,

1142

attribute._dbus_signature,

1143

attribute._dbus_access,

1144

attribute

1145

._dbus_get_args_options

1146

["byte_arrays"])

1147

(types.FunctionType

1148

(attribute.func_code,

1149

attribute.func_globals,

1150

attribute.func_name,

1151

attribute.func_defaults,

1152

attribute.func_closure)))

1153

# Copy annotations, if any

1154

try:

1155

attr[attrname]._dbus_annotations = (

1156

dict(attribute._dbus_annotations))

1157

except AttributeError:

1158

pass

1159

# Is this a D-Bus interface?

1160

elif getattr(attribute, "_dbus_is_interface", False):

1161

# Create a new, but exactly alike, function

1162

# object. Decorate it to be a new D-Bus interface

1163

# with the alternate D-Bus interface name. Add it

1164

# to the class.

1165

attr[attrname] = (dbus_interface_annotations

1166

(alt_interface)

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1173

if deprecate:

1174

# Deprecate all alternate interfaces

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1176

for interface_name in interface_names:

1177

@dbus_interface_annotations(interface_name)

1178

def func(self):

1179

return { "org.freedesktop.DBus.Deprecated":

1180

"true" }

1181

# Find an unused name

1182

for aname in (iname.format(i)

1183

for i in itertools.count()):

1184

if aname not in attr:

1185

attr[aname] = func

1186

break

1187

if interface_names:

1188

# Replace the class with a new subclass of it with

1189

# methods, signals, etc. as created above.

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1192

return cls

1193

return wrapper

1194

1195

1196

@alternate_dbus_interfaces({"se.recompile.Mandos":

1197

"se.bsnet.fukt.Mandos"})

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

759

def __new__(mcs, name, bases, attr):

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

812

return type.__new__(mcs, name, bases, attr)

813

1198

814

class ClientDBus(Client, DBusObjectWithProperties):

1199

815

"""A Client class using D-Bus

1200

816

1209

825

# dbus.service.Object doesn't use super(), so we can't either.

1210

826

1211

827

def __init__(self, bus = None, *args, **kwargs):

828

self._approvals_pending = 0

1212

829

self.bus = bus

1213

830

Client.__init__(self, *args, **kwargs)

1214

831

# Only now, when this client is initialized, can it show up on

1220

837

("/clients/" + client_object_name))

1221

838

DBusObjectWithProperties.__init__(self, self.bus,

1222

839

self.dbus_object_path)

1223

840

1224

841

def notifychangeproperty(transform_func,

1225

842

dbus_name, type_func=lambda x: x,

1226

843

variant_level=1):

1227

""" Modify a variable so that it's a property which announces

1228

its changes to DBus.

1229

1230

transform_fun: Function that takes a value and a variant_level

1231

and transforms it to a D-Bus type.

1232

dbus_name: D-Bus name of the variable

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

1233

849

type_func: Function that transform the value before sending it

1234

to the D-Bus. Default: no transform

1235

variant_level: D-Bus variant level. Default: 1

850

to DBus

851

variant_level: DBus variant level. default: 1

1236

852

"""

1237

attrname = "_{0}".format(dbus_name)

853

real_value = [None,]

1238

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

1239

857

if hasattr(self, "dbus_object_path"):

1240

if (not hasattr(self, attrname) or

1241

type_func(getattr(self, attrname, None))

1242

!= type_func(value)):

1243

dbus_value = transform_func(type_func(value),

1244

variant_level

1245

=variant_level)

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

1246

861

self.PropertyChanged(dbus.String(dbus_name),

1247

862

dbus_value)

1248

setattr(self, attrname, value)

1249

863

1250

return property(lambda self: getattr(self, attrname), setter)

864

return property(lambda self: real_value[0], setter)

865

1251

866

1252

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1253

868

approvals_pending = notifychangeproperty(dbus.Boolean,

1257

872

last_enabled = notifychangeproperty(datetime_to_dbus,

1258

873

"LastEnabled")

1259

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1260

type_func = lambda checker:

1261

checker is not None)

875

type_func = lambda checker: checker is not None)

1262

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1263

877

"LastCheckedOK")

1264

last_checker_status = notifychangeproperty(dbus.Int16,

1265

"LastCheckerStatus")

1266

last_approval_request = notifychangeproperty(

1267

datetime_to_dbus, "LastApprovalRequest")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

1268

880

approved_by_default = notifychangeproperty(dbus.Boolean,

1269

881

"ApprovedByDefault")

1270

approval_delay = notifychangeproperty(dbus.UInt64,

1271

"ApprovalDelay",

1272

type_func =

1273

timedelta_to_milliseconds)

1274

approval_duration = notifychangeproperty(

1275

dbus.UInt64, "ApprovalDuration",

1276

type_func = timedelta_to_milliseconds)

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

1277

886

host = notifychangeproperty(dbus.String, "Host")

1278

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1279

type_func =

1280

timedelta_to_milliseconds)

1281

extended_timeout = notifychangeproperty(

1282

dbus.UInt64, "ExtendedTimeout",

1283

type_func = timedelta_to_milliseconds)

1284

interval = notifychangeproperty(dbus.UInt64,

1285

"Interval",

1286

type_func =

1287

timedelta_to_milliseconds)

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

1288

893

checker_command = notifychangeproperty(dbus.String, "Checker")

1289

894

1290

895

del notifychangeproperty

1332

937

return r

1333

938

1334

939

def _reset_approved(self):

1335

self.approved = None

940

self._approved = None

1336

941

return False

1337

942

1338

943

def approve(self, value=True):

1339

self.approved = value

1340

gobject.timeout_add(timedelta_to_milliseconds

944

self.send_changedstate()

945

self._approved = value

946

gobject.timeout_add(_timedelta_to_milliseconds

1341

947

(self.approval_duration),

1342

948

self._reset_approved)

1343

self.send_changedstate()

949

1344

950

1345

951

## D-Bus methods, signals & properties

1346

_interface = "se.recompile.Mandos.Client"

1347

1348

## Interfaces

1349

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

1354

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

1355

954

## Signals

1356

955

1357

956

# CheckerCompleted - signal

1456

1055

access="readwrite")

1457

1056

def ApprovalDuration_dbus_property(self, value=None):

1458

1057

if value is None: # get

1459

return dbus.UInt64(timedelta_to_milliseconds(

1058

return dbus.UInt64(_timedelta_to_milliseconds(

1460

1059

self.approval_duration))

1461

1060

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1462

1061

1476

1075

def Host_dbus_property(self, value=None):

1477

1076

if value is None: # get

1478

1077

return dbus.String(self.host)

1479

self.host = unicode(value)

1078

self.host = value

1480

1079

1481

1080

# Created - property

1482

1081

@dbus_service_property(_interface, signature="s", access="read")

1483

1082

def Created_dbus_property(self):

1484

return datetime_to_dbus(self.created)

1083

return dbus.String(datetime_to_dbus(self.created))

1485

1084

1486

1085

# LastEnabled - property

1487

1086

@dbus_service_property(_interface, signature="s", access="read")

1508

1107

return

1509

1108

return datetime_to_dbus(self.last_checked_ok)

1510

1109

1511

# LastCheckerStatus - property

1512

@dbus_service_property(_interface, signature="n",

1513

access="read")

1514

def LastCheckerStatus_dbus_property(self):

1515

return dbus.Int16(self.last_checker_status)

1516

1517

1110

# Expires - property

1518

1111

@dbus_service_property(_interface, signature="s", access="read")

1519

1112

def Expires_dbus_property(self):

1530

1123

def Timeout_dbus_property(self, value=None):

1531

1124

if value is None: # get

1532

1125

return dbus.UInt64(self.timeout_milliseconds())

1533

old_timeout = self.timeout

1534

1126

self.timeout = datetime.timedelta(0, 0, 0, value)

1535

# Reschedule disabling

1536

if self.enabled:

1537

now = datetime.datetime.utcnow()

1538

self.expires += self.timeout - old_timeout

1539

if self.expires <= now:

1540

# The timeout has passed

1541

self.disable()

1542

else:

1543

if (getattr(self, "disable_initiator_tag", None)

1544

is None):

1545

return

1546

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1127

if getattr(self, "disable_initiator_tag", None) is None:

1128

return

1129

# Reschedule timeout

1130

gobject.source_remove(self.disable_initiator_tag)

1131

self.disable_initiator_tag = None

1132

self.expires = None

1133

time_to_die = (self.

1134

_timedelta_to_milliseconds((self

1135

.last_checked_ok

1136

+ self.timeout)

1137

- datetime.datetime

1138

.utcnow()))

1139

if time_to_die <= 0:

1140

# The timeout has passed

1141

self.disable()

1142

else:

1143

self.expires = (datetime.datetime.utcnow()

1144

+ datetime.timedelta(milliseconds = time_to_die))

1145

self.disable_initiator_tag = (gobject.timeout_add

1146

(time_to_die, self.disable))

1551

1147

1552

1148

# ExtendedTimeout - property

1553

1149

@dbus_service_property(_interface, signature="t",

1566

1162

self.interval = datetime.timedelta(0, 0, 0, value)

1567

1163

if getattr(self, "checker_initiator_tag", None) is None:

1568

1164

return

1569

if self.enabled:

1570

# Reschedule checker run

1571

gobject.source_remove(self.checker_initiator_tag)

1572

self.checker_initiator_tag = (gobject.timeout_add

1573

(value, self.start_checker))

1574

self.start_checker() # Start one now, too

1165

# Reschedule checker run

1166

gobject.source_remove(self.checker_initiator_tag)

1167

self.checker_initiator_tag = (gobject.timeout_add

1168

(value, self.start_checker))

1169

self.start_checker() # Start one now, too

1575

1170

1576

1171

# Checker - property

1577

1172

@dbus_service_property(_interface, signature="s",

1579

1174

def Checker_dbus_property(self, value=None):

1580

1175

if value is None: # get

1581

1176

return dbus.String(self.checker_command)

1582

self.checker_command = unicode(value)

1177

self.checker_command = value

1583

1178

1584

1179

# CheckerRunning - property

1585

1180

@dbus_service_property(_interface, signature="b",

1614

1209

raise KeyError()

1615

1210

1616

1211

def __getattribute__(self, name):

1617

if name == '_pipe':

1212

if(name == '_pipe'):

1618

1213

return super(ProxyClient, self).__getattribute__(name)

1619

1214

self._pipe.send(('getattr', name))

1620

1215

data = self._pipe.recv()

1627

1222

return func

1628

1223

1629

1224

def __setattr__(self, name, value):

1630

if name == '_pipe':

1225

if(name == '_pipe'):

1631

1226

return super(ProxyClient, self).__setattr__(name, value)

1632

1227

self._pipe.send(('setattr', name, value))

1633

1228

1229

class ClientDBusTransitional(ClientDBus):

1230

__metaclass__ = transitional_dbus_metaclass

1634

1231

1635

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

1636

1233

"""A class to handle client connections.

1716

1313

client.name)

1717

1314

if self.server.use_dbus:

1718

1315

# Emit D-Bus signal

1719

client.Rejected("Disabled")

1316

client.Rejected("Disabled")

1720

1317

return

1721

1318

1722

if client.approved or not client.approval_delay:

1319

if client._approved or not client.approval_delay:

1723

1320

#We are approved or approval is disabled

1724

1321

break

1725

elif client.approved is None:

1322

elif client._approved is None:

1726

1323

logger.info("Client %s needs approval",

1727

1324

client.name)

1728

1325

if self.server.use_dbus:

1739

1336

return

1740

1337

1741

1338

#wait until timeout or approved

1339

#x = float(client._timedelta_to_milliseconds(delay))

1742

1340

time = datetime.datetime.now()

1743

1341

client.changedstate.acquire()

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1342

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1747

1343

client.changedstate.release()

1748

1344

time2 = datetime.datetime.now()

1749

1345

if (time2 - time) >= delay:

1765

1361

try:

1766

1362

sent = session.send(client.secret[sent_size:])

1767

1363

except gnutls.errors.GNUTLSError as error:

1768

logger.warning("gnutls send failed",

1769

exc_info=error)

1364

logger.warning("gnutls send failed")

1770

1365

return

1771

1366

logger.debug("Sent: %d, remaining: %d",

1772

1367

sent, len(client.secret)

1774

1369

sent_size += sent

1775

1370

1776

1371

logger.info("Sending secret to %s", client.name)

1777

# bump the timeout using extended_timeout

1778

client.bump_timeout(client.extended_timeout)

1372

# bump the timeout as if seen

1373

client.checked_ok(client.extended_timeout)

1779

1374

if self.server.use_dbus:

1780

1375

# Emit D-Bus signal

1781

1376

client.GotSecret()

1786

1381

try:

1787

1382

session.bye()

1788

1383

except gnutls.errors.GNUTLSError as error:

1789

logger.warning("GnuTLS bye failed",

1790

exc_info=error)

1384

logger.warning("GnuTLS bye failed")

1791

1385

1792

1386

@staticmethod

1793

1387

def peer_certificate(session):

1849

1443

# Convert the buffer to a Python bytestring

1850

1444

fpr = ctypes.string_at(buf, buf_len.value)

1851

1445

# Convert the bytestring to hexadecimal notation

1852

hex_fpr = binascii.hexlify(fpr).upper()

1446

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1853

1447

return hex_fpr

1854

1448

1855

1449

1858

1452

def sub_process_main(self, request, address):

1859

1453

try:

1860

1454

self.finish_request(request, address)

1861

except Exception:

1455

except:

1862

1456

self.handle_error(request, address)

1863

1457

self.close_request(request)

1864

1458

1865

1459

def process_request(self, request, address):

1866

1460

"""Start a new process to process the request."""

1867

proc = multiprocessing.Process(target = self.sub_process_main,

1868

args = (request, address))

1869

proc.start()

1870

return proc

1461

multiprocessing.Process(target = self.sub_process_main,

1462

args = (request, address)).start()

1871

1463

1872

1464

1873

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1879

1471

"""

1880

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1881

1473

1882

proc = MultiprocessingMixIn.process_request(self, request,

1883

client_address)

1474

super(MultiprocessingMixInWithPipe,

1475

self).process_request(request, client_address)

1884

1476

self.child_pipe.close()

1885

self.add_pipe(parent_pipe, proc)

1477

self.add_pipe(parent_pipe)

1886

1478

1887

def add_pipe(self, parent_pipe, proc):

1479

def add_pipe(self, parent_pipe):

1888

1480

"""Dummy function; override as necessary"""

1889

1481

raise NotImplementedError

1890

1482

1921

1513

str(self.interface

1922

1514

+ '\0'))

1923

1515

except socket.error as error:

1924

if error.errno == errno.EPERM:

1516

if error[0] == errno.EPERM:

1925

1517

logger.error("No permission to"

1926

1518

" bind to interface %s",

1927

1519

self.interface)

1928

elif error.errno == errno.ENOPROTOOPT:

1520

elif error[0] == errno.ENOPROTOOPT:

1929

1521

logger.error("SO_BINDTODEVICE not available;"

1930

1522

" cannot bind to interface %s",

1931

1523

self.interface)

1932

elif error.errno == errno.ENODEV:

1933

logger.error("Interface %s does not"

1934

" exist, cannot bind",

1935

self.interface)

1936

1524

else:

1937

1525

raise

1938

1526

# Only bind(2) the socket if we really need to.

1972

1560

self.enabled = False

1973

1561

self.clients = clients

1974

1562

if self.clients is None:

1975

self.clients = {}

1563

self.clients = set()

1976

1564

self.use_dbus = use_dbus

1977

1565

self.gnutls_priority = gnutls_priority

1978

1566

IPv6_TCPServer.__init__(self, server_address,

1982

1570

def server_activate(self):

1983

1571

if self.enabled:

1984

1572

return socketserver.TCPServer.server_activate(self)

1985

1986

1573

def enable(self):

1987

1574

self.enabled = True

1988

1989

def add_pipe(self, parent_pipe, proc):

1575

def add_pipe(self, parent_pipe):

1990

1576

# Call "handle_ipc" for both data and EOF events

1991

1577

gobject.io_add_watch(parent_pipe.fileno(),

1992

1578

gobject.IO_IN | gobject.IO_HUP,

1993

1579

functools.partial(self.handle_ipc,

1994

parent_pipe =

1995

parent_pipe,

1996

proc = proc))

1997

1580

parent_pipe = parent_pipe))

1581

1998

1582

def handle_ipc(self, source, condition, parent_pipe=None,

1999

proc = None, client_object=None):

2000

# error, or the other end of multiprocessing.Pipe has closed

2001

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2002

# Wait for other process to exit

2003

proc.join()

1583

client_object=None):

1584

condition_names = {

1585

gobject.IO_IN: "IN", # There is data to read.

1586

gobject.IO_OUT: "OUT", # Data can be written (without

1587

# blocking).

1588

gobject.IO_PRI: "PRI", # There is urgent data to read.

1589

gobject.IO_ERR: "ERR", # Error condition.

1590

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1591

# broken, usually for pipes and

1592

# sockets).

1593

}

1594

conditions_string = ' | '.join(name

1595

for cond, name in

1596

condition_names.iteritems()

1597

if cond & condition)

1598

# error or the other end of multiprocessing.Pipe has closed

1599

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2004

1600

return False

2005

1601

2006

1602

# Read a request from the child

2011

1607

fpr = request[1]

2012

1608

address = request[2]

2013

1609

2014

for c in self.clients.itervalues():

1610

for c in self.clients:

2015

1611

if c.fingerprint == fpr:

2016

1612

client = c

2017

1613

break

2020

1616

"dress: %s", fpr, address)

2021

1617

if self.use_dbus:

2022

1618

# Emit D-Bus signal

2023

mandos_dbus_service.ClientNotFound(fpr,

2024

address[0])

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

2025

1620

parent_pipe.send(False)

2026

1621

return False

2027

1622

2028

1623

gobject.io_add_watch(parent_pipe.fileno(),

2029

1624

gobject.IO_IN | gobject.IO_HUP,

2030

1625

functools.partial(self.handle_ipc,

2031

parent_pipe =

2032

parent_pipe,

2033

proc = proc,

2034

client_object =

2035

client))

1626

parent_pipe = parent_pipe,

1627

client_object = client))

2036

1628

parent_pipe.send(True)

2037

# remove the old hook in favor of the new above hook on

2038

# same fileno

1629

# remove the old hook in favor of the new above hook on same fileno

2039

1630

return False

2040

1631

if command == 'funcall':

2041

1632

funcname = request[1]

2042

1633

args = request[2]

2043

1634

kwargs = request[3]

2044

1635

2045

parent_pipe.send(('data', getattr(client_object,

2046

funcname)(*args,

2047

**kwargs)))

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

2048

1637

2049

1638

if command == 'getattr':

2050

1639

attrname = request[1]

2051

1640

if callable(client_object.__getattribute__(attrname)):

2052

1641

parent_pipe.send(('function',))

2053

1642

else:

2054

parent_pipe.send(('data', client_object

2055

.__getattribute__(attrname)))

1643

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2056

1644

2057

1645

if command == 'setattr':

2058

1646

attrname = request[1]

2094

1682

elif suffix == "w":

2095

1683

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2096

1684

else:

2097

raise ValueError("Unknown suffix {0!r}"

2098

.format(suffix))

1685

raise ValueError("Unknown suffix %r" % suffix)

2099

1686

except (ValueError, IndexError) as e:

2100

1687

raise ValueError(*(e.args))

2101

1688

timevalue += delta

2102

1689

return timevalue

2103

1690

2104

1691

1692

def if_nametoindex(interface):

1693

"""Call the C function if_nametoindex(), or equivalent

1694

1695

Note: This function cannot accept a unicode string."""

1696

global if_nametoindex

1697

try:

1698

if_nametoindex = (ctypes.cdll.LoadLibrary

1699

(ctypes.util.find_library("c"))

1700

.if_nametoindex)

1701

except (OSError, AttributeError):

1702

logger.warning("Doing if_nametoindex the hard way")

1703

def if_nametoindex(interface):

1704

"Get an interface index the hard way, i.e. using fcntl()"

1705

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1706

with contextlib.closing(socket.socket()) as s:

1707

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1708

struct.pack(str("16s16x"),

1709

interface))

1710

interface_index = struct.unpack(str("I"),

1711

ifreq[16:20])[0]

1712

return interface_index

1713

return if_nametoindex(interface)

1714

1715

2105

1716

def daemon(nochdir = False, noclose = False):

2106

1717

"""See daemon(3). Standard BSD Unix function.

2107

1718

2115

1726

sys.exit()

2116

1727

if not noclose:

2117

1728

# Close all standard open file descriptors

2118

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1729

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2119

1730

if not stat.S_ISCHR(os.fstat(null).st_mode):

2120

1731

raise OSError(errno.ENODEV,

2121

"{0} not a character device"

2122

.format(os.devnull))

1732

"%s not a character device"

1733

% os.path.devnull)

2123

1734

os.dup2(null, sys.stdin.fileno())

2124

1735

os.dup2(null, sys.stdout.fileno())

2125

1736

os.dup2(null, sys.stderr.fileno())

2134

1745

2135

1746

parser = argparse.ArgumentParser()

2136

1747

parser.add_argument("-v", "--version", action="version",

2137

version = "%(prog)s {0}".format(version),

1748

version = "%%(prog)s %s" % version,

2138

1749

help="show version number and exit")

2139

1750

parser.add_argument("-i", "--interface", metavar="IF",

2140

1751

help="Bind to interface IF")

2162

1773

" system bus interface")

2163

1774

parser.add_argument("--no-ipv6", action="store_false",

2164

1775

dest="use_ipv6", help="Do not use IPv6")

2165

parser.add_argument("--no-restore", action="store_false",

2166

dest="restore", help="Do not restore stored"

2167

" state")

2168

parser.add_argument("--statedir", metavar="DIR",

2169

help="Directory to save/restore state in")

2170

2171

1776

options = parser.parse_args()

2172

1777

2173

1778

if options.check:

2186

1791

"use_dbus": "True",

2187

1792

"use_ipv6": "True",

2188

1793

"debuglevel": "",

2189

"restore": "True",

2190

"statedir": "/var/lib/mandos"

2191

1794

}

2192

1795

2193

1796

# Parse config file for server-global settings

2210

1813

# options, if set.

2211

1814

for option in ("interface", "address", "port", "debug",

2212

1815

"priority", "servicename", "configdir",

2213

"use_dbus", "use_ipv6", "debuglevel", "restore",

2214

"statedir"):

1816

"use_dbus", "use_ipv6", "debuglevel"):

2215

1817

value = getattr(options, option)

2216

1818

if value is not None:

2217

1819

server_settings[option] = value

2229

1831

debuglevel = server_settings["debuglevel"]

2230

1832

use_dbus = server_settings["use_dbus"]

2231

1833

use_ipv6 = server_settings["use_ipv6"]

2232

stored_state_path = os.path.join(server_settings["statedir"],

2233

stored_state_file)

2234

2235

if debug:

2236

initlogger(debug, logging.DEBUG)

2237

else:

2238

if not debuglevel:

2239

initlogger(debug)

2240

else:

2241

level = getattr(logging, debuglevel.upper())

2242

initlogger(debug, level)

2243

1834

2244

1835

if server_settings["servicename"] != "Mandos":

2245

1836

syslogger.setFormatter(logging.Formatter

2246

('Mandos ({0}) [%(process)d]:'

2247

' %(levelname)s: %(message)s'

2248

.format(server_settings

2249

["servicename"])))

1837

('Mandos (%s) [%%(process)d]:'

1838

' %%(levelname)s: %%(message)s'

1839

% server_settings["servicename"]))

2250

1840

2251

1841

# Parse config file with clients

2252

client_config = configparser.SafeConfigParser(Client

2253

.client_defaults)

1842

client_defaults = { "timeout": "5m",

1843

"extended_timeout": "15m",

1844

"interval": "2m",

1845

"checker": "fping -q -- %%(host)s",

1846

"host": "",

1847

"approval_delay": "0s",

1848

"approval_duration": "1s",

1849

}

1850

client_config = configparser.SafeConfigParser(client_defaults)

2254

1851

client_config.read(os.path.join(server_settings["configdir"],

2255

1852

"clients.conf"))

2256

1853

2270

1867

pidfilename = "/var/run/mandos.pid"

2271

1868

try:

2272

1869

pidfile = open(pidfilename, "w")

2273

except IOError as e:

2274

logger.error("Could not open file %r", pidfilename,

2275

exc_info=e)

1870

except IOError:

1871

logger.error("Could not open file %r", pidfilename)

2276

1872

2277

for name in ("_mandos", "mandos", "nobody"):

1873

try:

1874

uid = pwd.getpwnam("_mandos").pw_uid

1875

gid = pwd.getpwnam("_mandos").pw_gid

1876

except KeyError:

2278

1877

try:

2279

uid = pwd.getpwnam(name).pw_uid

2280

gid = pwd.getpwnam(name).pw_gid

2281

break

1878

uid = pwd.getpwnam("mandos").pw_uid

1879

gid = pwd.getpwnam("mandos").pw_gid

2282

1880

except KeyError:

2283

continue

2284

else:

2285

uid = 65534

2286

gid = 65534

1881

try:

1882

uid = pwd.getpwnam("nobody").pw_uid

1883

gid = pwd.getpwnam("nobody").pw_gid

1884

except KeyError:

1885

uid = 65534

1886

gid = 65534

2287

1887

try:

2288

1888

os.setgid(gid)

2289

1889

os.setuid(uid)

2290

1890

except OSError as error:

2291

if error.errno != errno.EPERM:

1891

if error[0] != errno.EPERM:

2292

1892

raise error

2293

1893

1894

if not debug and not debuglevel:

1895

syslogger.setLevel(logging.WARNING)

1896

console.setLevel(logging.WARNING)

1897

if debuglevel:

1898

level = getattr(logging, debuglevel.upper())

1899

syslogger.setLevel(level)

1900

console.setLevel(level)

1901

2294

1902

if debug:

2295

1903

# Enable all possible GnuTLS debugging

2296

1904

2306

1914

.gnutls_global_set_log_function(debug_gnutls))

2307

1915

2308

1916

# Redirect stdin so all checkers get /dev/null

2309

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1917

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2310

1918

os.dup2(null, sys.stdin.fileno())

2311

1919

if null > 2:

2312

1920

os.close(null)

1921

else:

1922

# No console logging

1923

logger.removeHandler(console)

2313

1924

2314

1925

# Need to fork before connecting to D-Bus

2315

1926

if not debug:

2316

1927

# Close all input and output, do double fork, etc.

2317

1928

daemon()

2318

1929

2319

gobject.threads_init()

2320

2321

1930

global main_loop

2322

1931

# From the Avahi example code

2323

DBusGMainLoop(set_as_default=True)

1932

DBusGMainLoop(set_as_default=True )

2324

1933

main_loop = gobject.MainLoop()

2325

1934

bus = dbus.SystemBus()

2326

1935

# End of Avahi example code

2327

1936

if use_dbus:

2328

1937

try:

2329

bus_name = dbus.service.BusName("se.recompile.Mandos",

2330

bus, do_not_queue=True)

2331

old_bus_name = (dbus.service.BusName

2332

("se.bsnet.fukt.Mandos", bus,

2333

do_not_queue=True))

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

2334

1942

except dbus.exceptions.NameExistsException as e:

2335

logger.error("Disabling D-Bus:", exc_info=e)

1943

logger.error(unicode(e) + ", disabling D-Bus")

2336

1944

use_dbus = False

2337

1945

server_settings["use_dbus"] = False

2338

1946

tcp_server.use_dbus = False

2339

1947

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2340

service = AvahiServiceToSyslog(name =

2341

server_settings["servicename"],

2342

servicetype = "_mandos._tcp",

2343

protocol = protocol, bus = bus)

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1950

protocol = protocol, bus = bus)

2344

1951

if server_settings["interface"]:

2345

1952

service.interface = (if_nametoindex

2346

1953

(str(server_settings["interface"])))

2350

1957

2351

1958

client_class = Client

2352

1959

if use_dbus:

2353

client_class = functools.partial(ClientDBus, bus = bus)

2354

2355

client_settings = Client.config_parser(client_config)

2356

old_client_settings = {}

2357

clients_data = {}

2358

2359

# Get client data and settings from last running state.

2360

if server_settings["restore"]:

2361

try:

2362

with open(stored_state_path, "rb") as stored_state:

2363

clients_data, old_client_settings = (pickle.load

2364

(stored_state))

2365

os.remove(stored_state_path)

2366

except IOError as e:

2367

if e.errno == errno.ENOENT:

2368

logger.warning("Could not load persistent state: {0}"

2369

.format(os.strerror(e.errno)))

2370

else:

2371

logger.critical("Could not load persistent state:",

2372

exc_info=e)

2373

raise

2374

except EOFError as e:

2375

logger.warning("Could not load persistent state: "

2376

"EOFError:", exc_info=e)

2377

2378

with PGPEngine() as pgp:

2379

for client_name, client in clients_data.iteritems():

2380

# Decide which value to use after restoring saved state.

2381

# We have three different values: Old config file,

2382

# new config file, and saved state.

2383

# New config value takes precedence if it differs from old

2384

# config value, otherwise use saved state.

2385

for name, value in client_settings[client_name].items():

2386

try:

2387

# For each value in new config, check if it

2388

# differs from the old config value (Except for

2389

# the "secret" attribute)

2390

if (name != "secret" and

2391

value != old_client_settings[client_name]

2392

[name]):

2393

client[name] = value

2394

except KeyError:

2395

pass

2396

2397

# Clients who has passed its expire date can still be

2398

# enabled if its last checker was successful. Clients

2399

# whose checker succeeded before we stored its state is

2400

# assumed to have successfully run all checkers during

2401

# downtime.

2402

if client["enabled"]:

2403

if datetime.datetime.utcnow() >= client["expires"]:

2404

if not client["last_checked_ok"]:

2405

logger.warning(

2406

"disabling client {0} - Client never "

2407

"performed a successful checker"

2408

.format(client_name))

2409

client["enabled"] = False

2410

elif client["last_checker_status"] != 0:

2411

logger.warning(

2412

"disabling client {0} - Client "

2413

"last checker failed with error code {1}"

2414

.format(client_name,

2415

client["last_checker_status"]))

2416

client["enabled"] = False

2417

else:

2418

client["expires"] = (datetime.datetime

2419

.utcnow()

2420

+ client["timeout"])

2421

logger.debug("Last checker succeeded,"

2422

" keeping {0} enabled"

2423

.format(client_name))

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1961

def client_config_items(config, section):

1962

special_settings = {

1963

"approved_by_default":

1964

lambda: config.getboolean(section,

1965

"approved_by_default"),

1966

}

1967

for name, value in config.items(section):

2424

1968

try:

2425

client["secret"] = (

2426

pgp.decrypt(client["encrypted_secret"],

2427

client_settings[client_name]

2428

["secret"]))

2429

except PGPError:

2430

# If decryption fails, we use secret from new settings

2431

logger.debug("Failed to decrypt {0} old secret"

2432

.format(client_name))

2433

client["secret"] = (

2434

client_settings[client_name]["secret"])

2435

2436

# Add/remove clients based on new changes made to config

2437

for client_name in (set(old_client_settings)

2438

- set(client_settings)):

2439

del clients_data[client_name]

2440

for client_name in (set(client_settings)

2441

- set(old_client_settings)):

2442

clients_data[client_name] = client_settings[client_name]

2443

2444

# Create all client objects

2445

for client_name, client in clients_data.iteritems():

2446

tcp_server.clients[client_name] = client_class(

2447

name = client_name, settings = client)

2448

1969

yield (name, special_settings[name]())

1970

except KeyError:

1971

yield (name, value)

1972

1973

tcp_server.clients.update(set(

1974

client_class(name = section,

1975

config= dict(client_config_items(

1976

client_config, section)))

1977

for section in client_config.sections()))

2449

1978

if not tcp_server.clients:

2450

1979

logger.warning("No clients defined")

2451

1980

2452

1981

if not debug:

2453

1982

try:

2454

1983

with pidfile:

2462

1991

# "pidfile" was never created

2463

1992

pass

2464

1993

del pidfilename

1994

1995

signal.signal(signal.SIGINT, signal.SIG_IGN)

2465

1996

2466

1997

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2467

1998

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2468

1999

2469

2000

if use_dbus:

2470

@alternate_dbus_interfaces({"se.recompile.Mandos":

2471

"se.bsnet.fukt.Mandos"})

2472

class MandosDBusService(DBusObjectWithProperties):

2001

class MandosDBusService(dbus.service.Object):

2473

2002

"""A D-Bus proxy object"""

2474

2003

def __init__(self):

2475

2004

dbus.service.Object.__init__(self, bus, "/")

2476

_interface = "se.recompile.Mandos"

2477

2478

@dbus_interface_annotations(_interface)

2479

def _foo(self):

2480

return { "org.freedesktop.DBus.Property"

2481

".EmitsChangedSignal":

2482

"false"}

2005

_interface = "se.bsnet.fukt.Mandos"

2483

2006

2484

2007

@dbus.service.signal(_interface, signature="o")

2485

2008

def ClientAdded(self, objpath):

2500

2023

def GetAllClients(self):

2501

2024

"D-Bus method"

2502

2025

return dbus.Array(c.dbus_object_path

2503

for c in

2504

tcp_server.clients.itervalues())

2026

for c in tcp_server.clients)

2505

2027

2506

2028

@dbus.service.method(_interface,

2507

2029

out_signature="a{oa{sv}}")

2509

2031

"D-Bus method"

2510

2032

return dbus.Dictionary(

2511

2033

((c.dbus_object_path, c.GetAll(""))

2512

for c in tcp_server.clients.itervalues()),

2034

for c in tcp_server.clients),

2513

2035

signature="oa{sv}")

2514

2036

2515

2037

@dbus.service.method(_interface, in_signature="o")

2516

2038

def RemoveClient(self, object_path):

2517

2039

"D-Bus method"

2518

for c in tcp_server.clients.itervalues():

2040

for c in tcp_server.clients:

2519

2041

if c.dbus_object_path == object_path:

2520

del tcp_server.clients[c.name]

2042

tcp_server.clients.remove(c)

2521

2043

c.remove_from_connection()

2522

2044

# Don't signal anything except ClientRemoved

2523

2045

c.disable(quiet=True)

2528

2050

2529

2051

del _interface

2530

2052

2531

mandos_dbus_service = MandosDBusService()

2053

class MandosDBusServiceTransitional(MandosDBusService):

2054

__metaclass__ = transitional_dbus_metaclass

2055

mandos_dbus_service = MandosDBusServiceTransitional()

2532

2056

2533

2057

def cleanup():

2534

2058

"Cleanup function; run on exit"

2535

2059

service.cleanup()

2536

2060

2537

multiprocessing.active_children()

2538

if not (tcp_server.clients or client_settings):

2539

return

2540

2541

# Store client before exiting. Secrets are encrypted with key

2542

# based on what config file has. If config file is

2543

# removed/edited, old secret will thus be unrecovable.

2544

clients = {}

2545

with PGPEngine() as pgp:

2546

for client in tcp_server.clients.itervalues():

2547

key = client_settings[client.name]["secret"]

2548

client.encrypted_secret = pgp.encrypt(client.secret,

2549

key)

2550

client_dict = {}

2551

2552

# A list of attributes that can not be pickled

2553

# + secret.

2554

exclude = set(("bus", "changedstate", "secret",

2555

"checker"))

2556

for name, typ in (inspect.getmembers

2557

(dbus.service.Object)):

2558

exclude.add(name)

2559

2560

client_dict["encrypted_secret"] = (client

2561

.encrypted_secret)

2562

for attr in client.client_structure:

2563

if attr not in exclude:

2564

client_dict[attr] = getattr(client, attr)

2565

2566

clients[client.name] = client_dict

2567

del client_settings[client.name]["secret"]

2568

2569

try:

2570

with (tempfile.NamedTemporaryFile

2571

(mode='wb', suffix=".pickle", prefix='clients-',

2572

dir=os.path.dirname(stored_state_path),

2573

delete=False)) as stored_state:

2574

pickle.dump((clients, client_settings), stored_state)

2575

tempname=stored_state.name

2576

os.rename(tempname, stored_state_path)

2577

except (IOError, OSError) as e:

2578

if not debug:

2579

try:

2580

os.remove(tempname)

2581

except NameError:

2582

pass

2583

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2584

logger.warning("Could not save persistent state: {0}"

2585

.format(os.strerror(e.errno)))

2586

else:

2587

logger.warning("Could not save persistent state:",

2588

exc_info=e)

2589

raise e

2590

2591

# Delete all clients, and settings from config

2592

2061

while tcp_server.clients:

2593

name, client = tcp_server.clients.popitem()

2062

client = tcp_server.clients.pop()

2594

2063

if use_dbus:

2595

2064

client.remove_from_connection()

2065

client.disable_hook = None

2596

2066

# Don't signal anything except ClientRemoved

2597

2067

client.disable(quiet=True)

2598

2068

if use_dbus:

2599

2069

# Emit D-Bus signal

2600

mandos_dbus_service.ClientRemoved(client

2601

.dbus_object_path,

2070

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2602

2071

client.name)

2603

client_settings.clear()

2604

2072

2605

2073

atexit.register(cleanup)

2606

2074

2607

for client in tcp_server.clients.itervalues():

2075

for client in tcp_server.clients:

2608

2076

if use_dbus:

2609

2077

# Emit D-Bus signal

2610

2078

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2611

# Need to initiate checking of clients

2612

if client.enabled:

2613

client.init_checker()

2079

client.enable()

2614

2080

2615

2081

tcp_server.enable()

2616

2082

tcp_server.server_activate()

2619

2085

service.port = tcp_server.socket.getsockname()[1]

2620

2086

if use_ipv6:

2621

2087

logger.info("Now listening on address %r, port %d,"

2622

" flowinfo %d, scope_id %d",

2623

*tcp_server.socket.getsockname())

2088

" flowinfo %d, scope_id %d"

2089

% tcp_server.socket.getsockname())

2624

2090

else: # IPv4

2625

logger.info("Now listening on address %r, port %d",

2626

*tcp_server.socket.getsockname())

2091

logger.info("Now listening on address %r, port %d"

2092

% tcp_server.socket.getsockname())

2627

2093

2628

2094

#service.interface = tcp_server.socket.getsockname()[3]

2629

2095

2632

2098

try:

2633

2099

service.activate()

2634

2100

except dbus.exceptions.DBusException as error:

2635

logger.critical("D-Bus Exception", exc_info=error)

2101

logger.critical("DBusException: %s", error)

2636

2102

cleanup()

2637

2103

sys.exit(1)

2638

2104

# End of Avahi example code

2645

2111

logger.debug("Starting main loop")

2646

2112

main_loop.run()

2647

2113

except AvahiError as error:

2648

logger.critical("Avahi Error", exc_info=error)

2114

logger.critical("AvahiError: %s", error)

2649

2115

cleanup()

2650

2116

sys.exit(1)

2651

2117

except KeyboardInterrupt:

2656

2122

# Must run before the D-Bus bus name gets deregistered

2657

2123

cleanup()

2658

2124

2125

2659

2126

if __name__ == '__main__':

2660

2127

main()