To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 236
- compare with another revision
- download diff
- download tarball
- view history from revision 236
- Committer: Teddy Hogeborn
- Date: 2008-11-01 02:26:00 UTC
- Revision ID: teddy@fukt.bsnet.se-20081101022600-bacs9fxmsliqrah1
* initramfs-tools-hook: Also ignore plugins named "*.dpkg-bak".
* plugin-runner.c: - '' -
* plugin-runner.c: - '' -
- files added:
- debian/mandos-client.config
- files removed:
- dbus-mandos.conf
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
import SocketServer as socketserver
35
import SocketServer
37
36
import socket
38
import optparse
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
44
43
import gnutls.library.functions
45
44
import gnutls.library.constants
46
45
import gnutls.library.types
47
import ConfigParser as configparser
46
import ConfigParser
48
47
import sys
49
48
import re
50
49
import os
51
50
import signal
51
from sets import Set
52
52
import subprocess
53
53
import atexit
54
54
import stat
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
58
import contextlib
59
import struct
60
import fcntl
61
import functools
62
import cPickle as pickle
63
import multiprocessing
64
58
65
59
import dbus
66
import dbus.service
67
60
import gobject
68
61
import avahi
69
62
from dbus.mainloop.glib import DBusGMainLoop
70
63
import ctypes
71
64
import ctypes.util
72
import xml.dom.minidom
73
import inspect
74
75
try:
76
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
77
except AttributeError:
78
try:
79
from IN import SO_BINDTODEVICE
80
except ImportError:
81
SO_BINDTODEVICE = None
82
83
84
version = "1.0.14"
85
86
logger = logging.Logger(u'mandos')
87
syslogger = (logging.handlers.SysLogHandler
88
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
89
address = "/dev/log"))
90
syslogger.setFormatter(logging.Formatter
91
(u'Mandos [%(process)d]: %(levelname)s:'
92
u' %(message)s'))
65
66
version = "1.0.2"
67
68
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
93
74
logger.addHandler(syslogger)
94
75
95
76
console = logging.StreamHandler()
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
u' %(levelname)s:'
98
u' %(message)s'))
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
99
79
logger.addHandler(console)
100
80
101
multiprocessing_manager = multiprocessing.Manager()
102
103
81
class AvahiError(Exception):
104
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
105
83
self.value = value
106
super(AvahiError, self).__init__(value, *args, **kwargs)
107
def __unicode__(self):
108
return unicode(repr(self.value))
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
109
87
110
88
class AvahiServiceError(AvahiError):
111
89
pass
116
94
117
95
class AvahiService(object):
118
96
"""An Avahi (Zeroconf) service.
119
120
97
Attributes:
121
98
interface: integer; avahi.IF_UNSPEC or an interface index.
122
99
Used to optionally bind to the specified interface.
123
name: string; Example: u'Mandos'
124
type: string; Example: u'_mandos._tcp'.
100
name: string; Example: 'Mandos'
101
type: string; Example: '_mandos._tcp'.
125
102
See <http://www.dns-sd.org/ServiceTypes.html>
126
103
port: integer; what port to announce
127
104
TXT: list of strings; TXT record for the service
130
107
max_renames: integer; maximum number of renames
131
108
rename_count: integer; counter so we only rename after collisions
132
109
a sensible number of times
133
group: D-Bus Entry Group
134
server: D-Bus Server
135
bus: dbus.SystemBus()
136
110
"""
137
111
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
servicetype = None, port = None, TXT = None,
139
domain = u"", host = u"", max_renames = 32768,
140
protocol = avahi.PROTO_UNSPEC, bus = None):
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
141
114
self.interface = interface
142
115
self.name = name
143
116
self.type = servicetype
144
117
self.port = port
145
self.TXT = TXT if TXT is not None else []
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
146
122
self.domain = domain
147
123
self.host = host
148
124
self.rename_count = 0
149
125
self.max_renames = max_renames
150
self.protocol = protocol
151
self.group = None # our entry group
152
self.server = None
153
self.bus = bus
154
126
def rename(self):
155
127
"""Derived from the Avahi example code"""
156
128
if self.rename_count >= self.max_renames:
157
129
logger.critical(u"No suitable Zeroconf service name found"
158
130
u" after %i retries, exiting.",
159
131
self.rename_count)
160
raise AvahiServiceError(u"Too many renames")
161
self.name = self.server.GetAlternativeServiceName(self.name)
132
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
162
134
logger.info(u"Changing Zeroconf service name to %r ...",
163
unicode(self.name))
164
syslogger.setFormatter(logging.Formatter
165
(u'Mandos (%s) [%%(process)d]:'
166
u' %%(levelname)s: %%(message)s'
167
% self.name))
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter\
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
168
139
self.remove()
169
140
self.add()
170
141
self.rename_count += 1
171
142
def remove(self):
172
143
"""Derived from the Avahi example code"""
173
if self.group is not None:
174
self.group.Reset()
144
if group is not None:
145
group.Reset()
175
146
def add(self):
176
147
"""Derived from the Avahi example code"""
177
if self.group is None:
178
self.group = dbus.Interface(
179
self.bus.get_object(avahi.DBUS_NAME,
180
self.server.EntryGroupNew()),
181
avahi.DBUS_INTERFACE_ENTRY_GROUP)
182
self.group.connect_to_signal('StateChanged',
183
self
184
.entry_group_state_changed)
148
global group
149
if group is None:
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
185
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
186
self.name, self.type)
187
self.group.AddService(
188
self.interface,
189
self.protocol,
190
dbus.UInt32(0), # flags
191
self.name, self.type,
192
self.domain, self.host,
193
dbus.UInt16(self.port),
194
avahi.string_array_to_txt_array(self.TXT))
195
self.group.Commit()
196
def entry_group_state_changed(self, state, error):
197
"""Derived from the Avahi example code"""
198
logger.debug(u"Avahi state change: %i", state)
199
200
if state == avahi.ENTRY_GROUP_ESTABLISHED:
201
logger.debug(u"Zeroconf service established.")
202
elif state == avahi.ENTRY_GROUP_COLLISION:
203
logger.warning(u"Zeroconf service name collision.")
204
self.rename()
205
elif state == avahi.ENTRY_GROUP_FAILURE:
206
logger.critical(u"Avahi: Error in group state changed %s",
207
unicode(error))
208
raise AvahiGroupError(u"State changed: %s"
209
% unicode(error))
210
def cleanup(self):
211
"""Derived from the Avahi example code"""
212
if self.group is not None:
213
self.group.Free()
214
self.group = None
215
def server_state_changed(self, state):
216
"""Derived from the Avahi example code"""
217
if state == avahi.SERVER_COLLISION:
218
logger.error(u"Zeroconf server name collision")
219
self.remove()
220
elif state == avahi.SERVER_RUNNING:
221
self.add()
222
def activate(self):
223
"""Derived from the Avahi example code"""
224
if self.server is None:
225
self.server = dbus.Interface(
226
self.bus.get_object(avahi.DBUS_NAME,
227
avahi.DBUS_PATH_SERVER),
228
avahi.DBUS_INTERFACE_SERVER)
229
self.server.connect_to_signal(u"StateChanged",
230
self.server_state_changed)
231
self.server_state_changed(self.server.GetState())
232
233
234
# XXX Need to add:
235
# approved_by_default (Config option for each client)
236
# approved_delay (config option for each client)
237
# approved_duration (config option for each client)
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
238
173
class Client(object):
239
174
"""A representation of a client host served by this server.
240
241
175
Attributes:
242
name: string; from the config file, used in log messages and
243
D-Bus identifiers
176
name: string; from the config file, used in log messages
244
177
fingerprint: string (40 or 32 hexadecimal digits); used to
245
178
uniquely identify the client
246
secret: bytestring; sent verbatim (over TLS) to client
247
host: string; available for use by the checker command
248
created: datetime.datetime(); (UTC) object creation
249
last_enabled: datetime.datetime(); (UTC)
250
enabled: bool()
251
last_checked_ok: datetime.datetime(); (UTC) or None
252
timeout: datetime.timedelta(); How long from last_checked_ok
253
until this client is disabled
254
interval: datetime.timedelta(); How often to start a new checker
255
disable_hook: If set, called by disable() as disable_hook(self)
256
checker: subprocess.Popen(); a running checker process used
257
to see if the client lives.
258
'None' if no process is running.
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
259
190
checker_initiator_tag: a gobject event source tag, or None
260
disable_initiator_tag: - '' -
191
stop_initiator_tag: - '' -
261
192
checker_callback_tag: - '' -
262
193
checker_command: string; External command which is run to check if
263
194
client lives. %() expansions are done at
264
195
runtime with vars(self) as dict, so that for
265
196
instance %(name)s can be used in the command.
266
current_checker_command: string; current running checker_command
267
approved_delay: datetime.timedelta(); Time to wait for approval
268
_approved: bool(); 'None' if not yet approved/disapproved
269
approved_duration: datetime.timedelta(); Duration of one approval
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
270
202
"""
271
272
@staticmethod
273
def _timedelta_to_milliseconds(td):
274
"Convert a datetime.timedelta() to milliseconds"
275
return ((td.days * 24 * 60 * 60 * 1000)
276
+ (td.seconds * 1000)
277
+ (td.microseconds // 1000))
278
279
def timeout_milliseconds(self):
280
"Return the 'timeout' attribute in milliseconds"
281
return self._timedelta_to_milliseconds(self.timeout)
282
283
def interval_milliseconds(self):
284
"Return the 'interval' attribute in milliseconds"
285
return self._timedelta_to_milliseconds(self.interval)
286
287
def approved_delay_milliseconds(self):
288
return self._timedelta_to_milliseconds(self.approved_delay)
289
290
def __init__(self, name = None, disable_hook=None, config=None):
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
291
227
"""Note: the 'checker' key in 'config' sets the
292
228
'checker_command' attribute and *not* the 'checker'
293
229
attribute."""
294
self.name = name
295
230
if config is None:
296
231
config = {}
232
self.name = name
297
233
logger.debug(u"Creating client %r", self.name)
298
234
# Uppercase and remove spaces from fingerprint for later
299
235
# comparison purposes with return value from the fingerprint()
300
236
# function
301
self.fingerprint = (config[u"fingerprint"].upper()
302
.replace(u" ", u""))
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
303
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
304
if u"secret" in config:
305
self.secret = config[u"secret"].decode(u"base64")
306
elif u"secfile" in config:
307
with open(os.path.expanduser(os.path.expandvars
308
(config[u"secfile"])),
309
"rb") as secfile:
310
self.secret = secfile.read()
240
if "secret" in config:
241
self.secret = config["secret"].decode(u"base64")
242
elif "secfile" in config:
243
secfile = open(os.path.expanduser(os.path.expandvars
244
(config["secfile"])))
245
self.secret = secfile.read()
246
secfile.close()
311
247
else:
312
#XXX Need to allow secret on demand!
313
248
raise TypeError(u"No secret or secfile for client %s"
314
249
% self.name)
315
self.host = config.get(u"host", u"")
316
self.created = datetime.datetime.utcnow()
317
self.enabled = False
318
self.last_enabled = None
250
self.host = config.get("host", "")
251
self.created = datetime.datetime.now()
319
252
self.last_checked_ok = None
320
self.timeout = string_to_delta(config[u"timeout"])
321
self.interval = string_to_delta(config[u"interval"])
322
self.disable_hook = disable_hook
253
self.timeout = string_to_delta(config["timeout"])
254
self.interval = string_to_delta(config["interval"])
255
self.stop_hook = stop_hook
323
256
self.checker = None
324
257
self.checker_initiator_tag = None
325
self.disable_initiator_tag = None
258
self.stop_initiator_tag = None
326
259
self.checker_callback_tag = None
327
self.checker_command = config[u"checker"]
328
self.current_checker_command = None
329
self.last_connect = None
330
self._approved = None
331
self.approved_by_default = config.get(u"approved_by_default",
332
False)
333
self.approved_delay = string_to_delta(
334
config[u"approved_delay"])
335
self.approved_duration = string_to_delta(
336
config[u"approved_duration"])
337
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
338
339
def send_changedstate(self):
340
self.changedstate.acquire()
341
self.changedstate.notify_all()
342
self.changedstate.release()
343
344
def enable(self):
260
self.check_command = config["checker"]
261
def start(self):
345
262
"""Start this client's checker and timeout hooks"""
346
if getattr(self, u"enabled", False):
347
# Already enabled
348
return
349
self.send_changedstate()
350
self.last_enabled = datetime.datetime.utcnow()
351
263
# Schedule a new checker to be started an 'interval' from now,
352
264
# and every interval from then on.
353
self.checker_initiator_tag = (gobject.timeout_add
354
(self.interval_milliseconds(),
355
self.start_checker))
356
# Schedule a disable() when 'timeout' has passed
357
self.disable_initiator_tag = (gobject.timeout_add
358
(self.timeout_milliseconds(),
359
self.disable))
360
self.enabled = True
265
self.checker_initiator_tag = gobject.timeout_add\
266
(self._interval_milliseconds,
267
self.start_checker)
361
268
# Also start a new checker *right now*.
362
269
self.start_checker()
363
364
def disable(self, quiet=True):
365
"""Disable this client."""
366
if not getattr(self, "enabled", False):
270
# Schedule a stop() when 'timeout' has passed
271
self.stop_initiator_tag = gobject.timeout_add\
272
(self._timeout_milliseconds,
273
self.stop)
274
def stop(self):
275
"""Stop this client.
276
The possibility that a client might be restarted is left open,
277
but not currently used."""
278
# If this client doesn't have a secret, it is already stopped.
279
if hasattr(self, "secret") and self.secret:
280
logger.info(u"Stopping client %s", self.name)
281
self.secret = None
282
else:
367
283
return False
368
if not quiet:
369
self.send_changedstate()
370
if not quiet:
371
logger.info(u"Disabling client %s", self.name)
372
if getattr(self, u"disable_initiator_tag", False):
373
gobject.source_remove(self.disable_initiator_tag)
374
self.disable_initiator_tag = None
375
if getattr(self, u"checker_initiator_tag", False):
284
if getattr(self, "stop_initiator_tag", False):
285
gobject.source_remove(self.stop_initiator_tag)
286
self.stop_initiator_tag = None
287
if getattr(self, "checker_initiator_tag", False):
376
288
gobject.source_remove(self.checker_initiator_tag)
377
289
self.checker_initiator_tag = None
378
290
self.stop_checker()
379
if self.disable_hook:
380
self.disable_hook(self)
381
self.enabled = False
291
if self.stop_hook:
292
self.stop_hook(self)
382
293
# Do not run this again if called by a gobject.timeout_add
383
294
return False
384
385
295
def __del__(self):
386
self.disable_hook = None
387
self.disable()
388
389
def checker_callback(self, pid, condition, command):
296
self.stop_hook = None
297
self.stop()
298
def checker_callback(self, pid, condition):
390
299
"""The checker has completed, so take appropriate actions."""
300
now = datetime.datetime.now()
391
301
self.checker_callback_tag = None
392
302
self.checker = None
393
if os.WIFEXITED(condition):
394
exitstatus = os.WEXITSTATUS(condition)
395
if exitstatus == 0:
396
logger.info(u"Checker for %(name)s succeeded",
397
vars(self))
398
self.checked_ok()
399
else:
400
logger.info(u"Checker for %(name)s failed",
401
vars(self))
402
else:
303
if os.WIFEXITED(condition) \
304
and (os.WEXITSTATUS(condition) == 0):
305
logger.info(u"Checker for %(name)s succeeded",
306
vars(self))
307
self.last_checked_ok = now
308
gobject.source_remove(self.stop_initiator_tag)
309
self.stop_initiator_tag = gobject.timeout_add\
310
(self._timeout_milliseconds,
311
self.stop)
312
elif not os.WIFEXITED(condition):
403
313
logger.warning(u"Checker for %(name)s crashed?",
404
314
vars(self))
405
406
def checked_ok(self):
407
"""Bump up the timeout for this client.
408
409
This should only be called when the client has been seen,
410
alive and well.
411
"""
412
self.last_checked_ok = datetime.datetime.utcnow()
413
gobject.source_remove(self.disable_initiator_tag)
414
self.disable_initiator_tag = (gobject.timeout_add
415
(self.timeout_milliseconds(),
416
self.disable))
417
315
else:
316
logger.info(u"Checker for %(name)s failed",
317
vars(self))
418
318
def start_checker(self):
419
319
"""Start a new checker subprocess if one is not running.
420
421
320
If a checker already exists, leave it running and do
422
321
nothing."""
423
322
# The reason for not killing a running checker is that if we
426
325
# client would inevitably timeout, since no checker would get
427
326
# a chance to run to completion. If we instead leave running
428
327
# checkers alone, the checker would have to take more time
429
# than 'timeout' for the client to be disabled, which is as it
430
# should be.
431
432
# If a checker exists, make sure it is not a zombie
433
try:
434
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
435
except (AttributeError, OSError), error:
436
if (isinstance(error, OSError)
437
and error.errno != errno.ECHILD):
438
raise error
439
else:
440
if pid:
441
logger.warning(u"Checker was a zombie")
442
gobject.source_remove(self.checker_callback_tag)
443
self.checker_callback(pid, status,
444
self.current_checker_command)
445
# Start a new checker if needed
328
# than 'timeout' for the client to be declared invalid, which
329
# is as it should be.
446
330
if self.checker is None:
447
331
try:
448
# In case checker_command has exactly one % operator
449
command = self.checker_command % self.host
332
# In case check_command has exactly one % operator
333
command = self.check_command % self.host
450
334
except TypeError:
451
335
# Escape attributes for the shell
452
escaped_attrs = dict((key,
453
re.escape(unicode(str(val),
454
errors=
455
u'replace')))
336
escaped_attrs = dict((key, re.escape(str(val)))
456
337
for key, val in
457
338
vars(self).iteritems())
458
339
try:
459
command = self.checker_command % escaped_attrs
340
command = self.check_command % escaped_attrs
460
341
except TypeError, error:
461
342
logger.error(u'Could not format string "%s":'
462
u' %s', self.checker_command, error)
343
u' %s', self.check_command, error)
463
344
return True # Try again later
464
self.current_checker_command = command
465
345
try:
466
346
logger.info(u"Starting checker %r for %s",
467
347
command, self.name)
471
351
# always replaced by /dev/null.)
472
352
self.checker = subprocess.Popen(command,
473
353
close_fds=True,
474
shell=True, cwd=u"/")
475
self.checker_callback_tag = (gobject.child_watch_add
476
(self.checker.pid,
477
self.checker_callback,
478
data=command))
479
# The checker may have completed before the gobject
480
# watch was added. Check for this.
481
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
482
if pid:
483
gobject.source_remove(self.checker_callback_tag)
484
self.checker_callback(pid, status, command)
354
shell=True, cwd="/")
355
self.checker_callback_tag = gobject.child_watch_add\
356
(self.checker.pid,
357
self.checker_callback)
485
358
except OSError, error:
486
359
logger.error(u"Failed to start subprocess: %s",
487
360
error)
488
361
# Re-run this periodically if run by gobject.timeout_add
489
362
return True
490
491
363
def stop_checker(self):
492
364
"""Force the checker process, if any, to stop."""
493
365
if self.checker_callback_tag:
494
366
gobject.source_remove(self.checker_callback_tag)
495
367
self.checker_callback_tag = None
496
if getattr(self, u"checker", None) is None:
368
if getattr(self, "checker", None) is None:
497
369
return
498
370
logger.debug(u"Stopping checker for %(name)s", vars(self))
499
371
try:
500
372
os.kill(self.checker.pid, signal.SIGTERM)
501
#time.sleep(0.5)
373
#os.sleep(0.5)
502
374
#if self.checker.poll() is None:
503
375
# os.kill(self.checker.pid, signal.SIGKILL)
504
376
except OSError, error:
505
377
if error.errno != errno.ESRCH: # No such process
506
378
raise
507
379
self.checker = None
508
509
def dbus_service_property(dbus_interface, signature=u"v",
510
access=u"readwrite", byte_arrays=False):
511
"""Decorators for marking methods of a DBusObjectWithProperties to
512
become properties on the D-Bus.
513
514
The decorated method will be called with no arguments by "Get"
515
and with one argument by "Set".
516
517
The parameters, where they are supported, are the same as
518
dbus.service.method, except there is only "signature", since the
519
type from Get() and the type sent to Set() is the same.
520
"""
521
# Encoding deeply encoded byte arrays is not supported yet by the
522
# "Set" method, so we fail early here:
523
if byte_arrays and signature != u"ay":
524
raise ValueError(u"Byte arrays not supported for non-'ay'"
525
u" signature %r" % signature)
526
def decorator(func):
527
func._dbus_is_property = True
528
func._dbus_interface = dbus_interface
529
func._dbus_signature = signature
530
func._dbus_access = access
531
func._dbus_name = func.__name__
532
if func._dbus_name.endswith(u"_dbus_property"):
533
func._dbus_name = func._dbus_name[:-14]
534
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
535
return func
536
return decorator
537
538
539
class DBusPropertyException(dbus.exceptions.DBusException):
540
"""A base class for D-Bus property-related exceptions
541
"""
542
def __unicode__(self):
543
return unicode(str(self))
544
545
546
class DBusPropertyAccessException(DBusPropertyException):
547
"""A property's access permissions disallows an operation.
548
"""
549
pass
550
551
552
class DBusPropertyNotFound(DBusPropertyException):
553
"""An attempt was made to access a non-existing property.
554
"""
555
pass
556
557
558
class DBusObjectWithProperties(dbus.service.Object):
559
"""A D-Bus object with properties.
560
561
Classes inheriting from this can use the dbus_service_property
562
decorator to expose methods as D-Bus properties. It exposes the
563
standard Get(), Set(), and GetAll() methods on the D-Bus.
564
"""
565
566
@staticmethod
567
def _is_dbus_property(obj):
568
return getattr(obj, u"_dbus_is_property", False)
569
570
def _get_all_dbus_properties(self):
571
"""Returns a generator of (name, attribute) pairs
572
"""
573
return ((prop._dbus_name, prop)
574
for name, prop in
575
inspect.getmembers(self, self._is_dbus_property))
576
577
def _get_dbus_property(self, interface_name, property_name):
578
"""Returns a bound method if one exists which is a D-Bus
579
property with the specified name and interface.
580
"""
581
for name in (property_name,
582
property_name + u"_dbus_property"):
583
prop = getattr(self, name, None)
584
if (prop is None
585
or not self._is_dbus_property(prop)
586
or prop._dbus_name != property_name
587
or (interface_name and prop._dbus_interface
588
and interface_name != prop._dbus_interface)):
589
continue
590
return prop
591
# No such property
592
raise DBusPropertyNotFound(self.dbus_object_path + u":"
593
+ interface_name + u"."
594
+ property_name)
595
596
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
597
out_signature=u"v")
598
def Get(self, interface_name, property_name):
599
"""Standard D-Bus property Get() method, see D-Bus standard.
600
"""
601
prop = self._get_dbus_property(interface_name, property_name)
602
if prop._dbus_access == u"write":
603
raise DBusPropertyAccessException(property_name)
604
value = prop()
605
if not hasattr(value, u"variant_level"):
606
return value
607
return type(value)(value, variant_level=value.variant_level+1)
608
609
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
610
def Set(self, interface_name, property_name, value):
611
"""Standard D-Bus property Set() method, see D-Bus standard.
612
"""
613
prop = self._get_dbus_property(interface_name, property_name)
614
if prop._dbus_access == u"read":
615
raise DBusPropertyAccessException(property_name)
616
if prop._dbus_get_args_options[u"byte_arrays"]:
617
# The byte_arrays option is not supported yet on
618
# signatures other than "ay".
619
if prop._dbus_signature != u"ay":
620
raise ValueError
621
value = dbus.ByteArray(''.join(unichr(byte)
622
for byte in value))
623
prop(value)
624
625
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
626
out_signature=u"a{sv}")
627
def GetAll(self, interface_name):
628
"""Standard D-Bus property GetAll() method, see D-Bus
629
standard.
630
631
Note: Will not include properties with access="write".
632
"""
633
all = {}
634
for name, prop in self._get_all_dbus_properties():
635
if (interface_name
636
and interface_name != prop._dbus_interface):
637
# Interface non-empty but did not match
638
continue
639
# Ignore write-only properties
640
if prop._dbus_access == u"write":
641
continue
642
value = prop()
643
if not hasattr(value, u"variant_level"):
644
all[name] = value
645
continue
646
all[name] = type(value)(value, variant_level=
647
value.variant_level+1)
648
return dbus.Dictionary(all, signature=u"sv")
649
650
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
651
out_signature=u"s",
652
path_keyword='object_path',
653
connection_keyword='connection')
654
def Introspect(self, object_path, connection):
655
"""Standard D-Bus method, overloaded to insert property tags.
656
"""
657
xmlstring = dbus.service.Object.Introspect(self, object_path,
658
connection)
659
try:
660
document = xml.dom.minidom.parseString(xmlstring)
661
def make_tag(document, name, prop):
662
e = document.createElement(u"property")
663
e.setAttribute(u"name", name)
664
e.setAttribute(u"type", prop._dbus_signature)
665
e.setAttribute(u"access", prop._dbus_access)
666
return e
667
for if_tag in document.getElementsByTagName(u"interface"):
668
for tag in (make_tag(document, name, prop)
669
for name, prop
670
in self._get_all_dbus_properties()
671
if prop._dbus_interface
672
== if_tag.getAttribute(u"name")):
673
if_tag.appendChild(tag)
674
# Add the names to the return values for the
675
# "org.freedesktop.DBus.Properties" methods
676
if (if_tag.getAttribute(u"name")
677
== u"org.freedesktop.DBus.Properties"):
678
for cn in if_tag.getElementsByTagName(u"method"):
679
if cn.getAttribute(u"name") == u"Get":
680
for arg in cn.getElementsByTagName(u"arg"):
681
if (arg.getAttribute(u"direction")
682
== u"out"):
683
arg.setAttribute(u"name", u"value")
684
elif cn.getAttribute(u"name") == u"GetAll":
685
for arg in cn.getElementsByTagName(u"arg"):
686
if (arg.getAttribute(u"direction")
687
== u"out"):
688
arg.setAttribute(u"name", u"props")
689
xmlstring = document.toxml(u"utf-8")
690
document.unlink()
691
except (AttributeError, xml.dom.DOMException,
692
xml.parsers.expat.ExpatError), error:
693
logger.error(u"Failed to override Introspection method",
694
error)
695
return xmlstring
696
697
698
class ClientDBus(Client, DBusObjectWithProperties):
699
"""A Client class using D-Bus
700
701
Attributes:
702
dbus_object_path: dbus.ObjectPath
703
bus: dbus.SystemBus()
704
"""
705
# dbus.service.Object doesn't use super(), so we can't either.
706
707
def __init__(self, bus = None, *args, **kwargs):
708
self.bus = bus
709
Client.__init__(self, *args, **kwargs)
710
# Only now, when this client is initialized, can it show up on
711
# the D-Bus
712
self.dbus_object_path = (dbus.ObjectPath
713
(u"/clients/"
714
+ self.name.replace(u".", u"_")))
715
DBusObjectWithProperties.__init__(self, self.bus,
716
self.dbus_object_path)
717
718
@staticmethod
719
def _datetime_to_dbus(dt, variant_level=0):
720
"""Convert a UTC datetime.datetime() to a D-Bus type."""
721
return dbus.String(dt.isoformat(),
722
variant_level=variant_level)
723
724
def enable(self):
725
oldstate = getattr(self, u"enabled", False)
726
r = Client.enable(self)
727
if oldstate != self.enabled:
728
# Emit D-Bus signals
729
self.PropertyChanged(dbus.String(u"enabled"),
730
dbus.Boolean(True, variant_level=1))
731
self.PropertyChanged(
732
dbus.String(u"last_enabled"),
733
self._datetime_to_dbus(self.last_enabled,
734
variant_level=1))
735
return r
736
737
def disable(self, quiet = False):
738
oldstate = getattr(self, u"enabled", False)
739
r = Client.disable(self, quiet=quiet)
740
if not quiet and oldstate != self.enabled:
741
# Emit D-Bus signal
742
self.PropertyChanged(dbus.String(u"enabled"),
743
dbus.Boolean(False, variant_level=1))
744
return r
745
746
def __del__(self, *args, **kwargs):
747
try:
748
self.remove_from_connection()
749
except LookupError:
750
pass
751
if hasattr(DBusObjectWithProperties, u"__del__"):
752
DBusObjectWithProperties.__del__(self, *args, **kwargs)
753
Client.__del__(self, *args, **kwargs)
754
755
def checker_callback(self, pid, condition, command,
756
*args, **kwargs):
757
self.checker_callback_tag = None
758
self.checker = None
759
# Emit D-Bus signal
760
self.PropertyChanged(dbus.String(u"checker_running"),
761
dbus.Boolean(False, variant_level=1))
762
if os.WIFEXITED(condition):
763
exitstatus = os.WEXITSTATUS(condition)
764
# Emit D-Bus signal
765
self.CheckerCompleted(dbus.Int16(exitstatus),
766
dbus.Int64(condition),
767
dbus.String(command))
768
else:
769
# Emit D-Bus signal
770
self.CheckerCompleted(dbus.Int16(-1),
771
dbus.Int64(condition),
772
dbus.String(command))
773
774
return Client.checker_callback(self, pid, condition, command,
775
*args, **kwargs)
776
777
def checked_ok(self, *args, **kwargs):
778
r = Client.checked_ok(self, *args, **kwargs)
779
# Emit D-Bus signal
780
self.PropertyChanged(
781
dbus.String(u"last_checked_ok"),
782
(self._datetime_to_dbus(self.last_checked_ok,
783
variant_level=1)))
784
return r
785
786
def start_checker(self, *args, **kwargs):
787
old_checker = self.checker
788
if self.checker is not None:
789
old_checker_pid = self.checker.pid
790
else:
791
old_checker_pid = None
792
r = Client.start_checker(self, *args, **kwargs)
793
# Only if new checker process was started
794
if (self.checker is not None
795
and old_checker_pid != self.checker.pid):
796
# Emit D-Bus signal
797
self.CheckerStarted(self.current_checker_command)
798
self.PropertyChanged(
799
dbus.String(u"checker_running"),
800
dbus.Boolean(True, variant_level=1))
801
return r
802
803
def stop_checker(self, *args, **kwargs):
804
old_checker = getattr(self, u"checker", None)
805
r = Client.stop_checker(self, *args, **kwargs)
806
if (old_checker is not None
807
and getattr(self, u"checker", None) is None):
808
self.PropertyChanged(dbus.String(u"checker_running"),
809
dbus.Boolean(False, variant_level=1))
810
return r
811
812
def _reset_approved(self):
813
self._approved = None
814
return False
815
816
def approve(self, value=True):
817
self._approved = value
818
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))
819
820
## D-Bus methods, signals & properties
821
_interface = u"se.bsnet.fukt.Mandos.Client"
822
823
## Signals
824
825
# CheckerCompleted - signal
826
@dbus.service.signal(_interface, signature=u"nxs")
827
def CheckerCompleted(self, exitcode, waitstatus, command):
828
"D-Bus signal"
829
pass
830
831
# CheckerStarted - signal
832
@dbus.service.signal(_interface, signature=u"s")
833
def CheckerStarted(self, command):
834
"D-Bus signal"
835
pass
836
837
# PropertyChanged - signal
838
@dbus.service.signal(_interface, signature=u"sv")
839
def PropertyChanged(self, property, value):
840
"D-Bus signal"
841
pass
842
843
# GotSecret - signal
844
@dbus.service.signal(_interface)
845
def GotSecret(self):
846
"D-Bus signal"
847
pass
848
849
# Rejected - signal
850
@dbus.service.signal(_interface, signature=u"s")
851
def Rejected(self, reason):
852
"D-Bus signal"
853
pass
854
855
# NeedApproval - signal
856
@dbus.service.signal(_interface, signature=u"db")
857
def NeedApproval(self, timeout, default):
858
"D-Bus signal"
859
pass
860
861
## Methods
862
863
# Approve - method
864
@dbus.service.method(_interface, in_signature=u"b")
865
def Approve(self, value):
866
self.approve(value)
867
868
# CheckedOK - method
869
@dbus.service.method(_interface)
870
def CheckedOK(self):
871
return self.checked_ok()
872
873
# Enable - method
874
@dbus.service.method(_interface)
875
def Enable(self):
876
"D-Bus method"
877
self.enable()
878
879
# StartChecker - method
880
@dbus.service.method(_interface)
881
def StartChecker(self):
882
"D-Bus method"
883
self.start_checker()
884
885
# Disable - method
886
@dbus.service.method(_interface)
887
def Disable(self):
888
"D-Bus method"
889
self.disable()
890
891
# StopChecker - method
892
@dbus.service.method(_interface)
893
def StopChecker(self):
894
self.stop_checker()
895
896
## Properties
897
898
# xxx 3 new properties
899
900
# name - property
901
@dbus_service_property(_interface, signature=u"s", access=u"read")
902
def name_dbus_property(self):
903
return dbus.String(self.name)
904
905
# fingerprint - property
906
@dbus_service_property(_interface, signature=u"s", access=u"read")
907
def fingerprint_dbus_property(self):
908
return dbus.String(self.fingerprint)
909
910
# host - property
911
@dbus_service_property(_interface, signature=u"s",
912
access=u"readwrite")
913
def host_dbus_property(self, value=None):
914
if value is None: # get
915
return dbus.String(self.host)
916
self.host = value
917
# Emit D-Bus signal
918
self.PropertyChanged(dbus.String(u"host"),
919
dbus.String(value, variant_level=1))
920
921
# created - property
922
@dbus_service_property(_interface, signature=u"s", access=u"read")
923
def created_dbus_property(self):
924
return dbus.String(self._datetime_to_dbus(self.created))
925
926
# last_enabled - property
927
@dbus_service_property(_interface, signature=u"s", access=u"read")
928
def last_enabled_dbus_property(self):
929
if self.last_enabled is None:
930
return dbus.String(u"")
931
return dbus.String(self._datetime_to_dbus(self.last_enabled))
932
933
# enabled - property
934
@dbus_service_property(_interface, signature=u"b",
935
access=u"readwrite")
936
def enabled_dbus_property(self, value=None):
937
if value is None: # get
938
return dbus.Boolean(self.enabled)
939
if value:
940
self.enable()
941
else:
942
self.disable()
943
944
# last_checked_ok - property
945
@dbus_service_property(_interface, signature=u"s",
946
access=u"readwrite")
947
def last_checked_ok_dbus_property(self, value=None):
948
if value is not None:
949
self.checked_ok()
950
return
380
def still_valid(self):
381
"""Has the timeout not yet passed for this client?"""
382
now = datetime.datetime.now()
951
383
if self.last_checked_ok is None:
952
return dbus.String(u"")
953
return dbus.String(self._datetime_to_dbus(self
954
.last_checked_ok))
955
956
# timeout - property
957
@dbus_service_property(_interface, signature=u"t",
958
access=u"readwrite")
959
def timeout_dbus_property(self, value=None):
960
if value is None: # get
961
return dbus.UInt64(self.timeout_milliseconds())
962
self.timeout = datetime.timedelta(0, 0, 0, value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String(u"timeout"),
965
dbus.UInt64(value, variant_level=1))
966
if getattr(self, u"disable_initiator_tag", None) is None:
967
return
968
# Reschedule timeout
969
gobject.source_remove(self.disable_initiator_tag)
970
self.disable_initiator_tag = None
971
time_to_die = (self.
972
_timedelta_to_milliseconds((self
973
.last_checked_ok
974
+ self.timeout)
975
- datetime.datetime
976
.utcnow()))
977
if time_to_die <= 0:
978
# The timeout has passed
979
self.disable()
980
else:
981
self.disable_initiator_tag = (gobject.timeout_add
982
(time_to_die, self.disable))
983
984
# interval - property
985
@dbus_service_property(_interface, signature=u"t",
986
access=u"readwrite")
987
def interval_dbus_property(self, value=None):
988
if value is None: # get
989
return dbus.UInt64(self.interval_milliseconds())
990
self.interval = datetime.timedelta(0, 0, 0, value)
991
# Emit D-Bus signal
992
self.PropertyChanged(dbus.String(u"interval"),
993
dbus.UInt64(value, variant_level=1))
994
if getattr(self, u"checker_initiator_tag", None) is None:
995
return
996
# Reschedule checker run
997
gobject.source_remove(self.checker_initiator_tag)
998
self.checker_initiator_tag = (gobject.timeout_add
999
(value, self.start_checker))
1000
self.start_checker() # Start one now, too
1001
1002
# checker - property
1003
@dbus_service_property(_interface, signature=u"s",
1004
access=u"readwrite")
1005
def checker_dbus_property(self, value=None):
1006
if value is None: # get
1007
return dbus.String(self.checker_command)
1008
self.checker_command = value
1009
# Emit D-Bus signal
1010
self.PropertyChanged(dbus.String(u"checker"),
1011
dbus.String(self.checker_command,
1012
variant_level=1))
1013
1014
# checker_running - property
1015
@dbus_service_property(_interface, signature=u"b",
1016
access=u"readwrite")
1017
def checker_running_dbus_property(self, value=None):
1018
if value is None: # get
1019
return dbus.Boolean(self.checker is not None)
1020
if value:
1021
self.start_checker()
1022
else:
1023
self.stop_checker()
1024
1025
# object_path - property
1026
@dbus_service_property(_interface, signature=u"o", access=u"read")
1027
def object_path_dbus_property(self):
1028
return self.dbus_object_path # is already a dbus.ObjectPath
1029
1030
# secret = property
1031
@dbus_service_property(_interface, signature=u"ay",
1032
access=u"write", byte_arrays=True)
1033
def secret_dbus_property(self, value):
1034
self.secret = str(value)
1035
1036
del _interface
1037
1038
1039
class ProxyClient(object):
1040
def __init__(self, child_pipe, fpr, address):
1041
self._pipe = child_pipe
1042
self._pipe.send(('init', fpr, address))
1043
if not self._pipe.recv():
1044
raise KeyError()
1045
1046
def __getattribute__(self, name):
1047
if(name == '_pipe'):
1048
return super(ProxyClient, self).__getattribute__(name)
1049
self._pipe.send(('getattr', name))
1050
data = self._pipe.recv()
1051
if data[0] == 'data':
1052
return data[1]
1053
if data[0] == 'function':
1054
def func(*args, **kwargs):
1055
self._pipe.send(('funcall', name, args, kwargs))
1056
return self._pipe.recv()[1]
1057
return func
1058
1059
def __setattr__(self, name, value):
1060
if(name == '_pipe'):
1061
return super(ProxyClient, self).__setattr__(name, value)
1062
self._pipe.send(('setattr', name, value))
1063
1064
1065
class ClientHandler(socketserver.BaseRequestHandler, object):
1066
"""A class to handle client connections.
1067
1068
Instantiated once for each connection to handle it.
384
return now < (self.created + self.timeout)
385
else:
386
return now < (self.last_checked_ok + self.timeout)
387
388
389
def peer_certificate(session):
390
"Return the peer's OpenPGP certificate as a bytestring"
391
# If not an OpenPGP certificate...
392
if gnutls.library.functions.gnutls_certificate_type_get\
393
(session._c_object) \
394
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
395
# ...do the normal thing
396
return session.peer_certificate
397
list_size = ctypes.c_uint()
398
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
(session._c_object, ctypes.byref(list_size))
400
if list_size.value == 0:
401
return None
402
cert = cert_list[0]
403
return ctypes.string_at(cert.data, cert.size)
404
405
406
def fingerprint(openpgp):
407
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
408
# New GnuTLS "datum" with the OpenPGP public key
409
datum = gnutls.library.types.gnutls_datum_t\
410
(ctypes.cast(ctypes.c_char_p(openpgp),
411
ctypes.POINTER(ctypes.c_ubyte)),
412
ctypes.c_uint(len(openpgp)))
413
# New empty GnuTLS certificate
414
crt = gnutls.library.types.gnutls_openpgp_crt_t()
415
gnutls.library.functions.gnutls_openpgp_crt_init\
416
(ctypes.byref(crt))
417
# Import the OpenPGP public key into the certificate
418
gnutls.library.functions.gnutls_openpgp_crt_import\
419
(crt, ctypes.byref(datum),
420
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
421
# Verify the self signature in the key
422
crtverify = ctypes.c_uint()
423
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
(crt, 0, ctypes.byref(crtverify))
425
if crtverify.value != 0:
426
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
427
raise gnutls.errors.CertificateSecurityError("Verify failed")
428
# New buffer for the fingerprint
429
buf = ctypes.create_string_buffer(20)
430
buf_len = ctypes.c_size_t()
431
# Get the fingerprint from the certificate into the buffer
432
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
434
# Deinit the certificate
435
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
436
# Convert the buffer to a Python bytestring
437
fpr = ctypes.string_at(buf, buf_len.value)
438
# Convert the bytestring to hexadecimal notation
439
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
440
return hex_fpr
441
442
443
class TCP_handler(SocketServer.BaseRequestHandler, object):
444
"""A TCP request handler class.
445
Instantiated by IPv6_TCPServer for each request to handle it.
1069
446
Note: This will run in its own forked process."""
1070
447
1071
448
def handle(self):
1072
with contextlib.closing(self.server.child_pipe) as child_pipe:
1073
logger.info(u"TCP connection from: %s",
1074
unicode(self.client_address))
1075
logger.debug(u"Pipe FD: %d",
1076
self.server.child_pipe.fileno())
1077
1078
session = (gnutls.connection
1079
.ClientSession(self.request,
1080
gnutls.connection
1081
.X509Credentials()))
1082
1083
# Note: gnutls.connection.X509Credentials is really a
1084
# generic GnuTLS certificate credentials object so long as
1085
# no X.509 keys are added to it. Therefore, we can use it
1086
# here despite using OpenPGP certificates.
1087
1088
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1089
# u"+AES-256-CBC", u"+SHA1",
1090
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1091
# u"+DHE-DSS"))
1092
# Use a fallback default, since this MUST be set.
1093
priority = self.server.gnutls_priority
1094
if priority is None:
1095
priority = u"NORMAL"
1096
(gnutls.library.functions
1097
.gnutls_priority_set_direct(session._c_object,
1098
priority, None))
1099
1100
# Start communication using the Mandos protocol
1101
# Get protocol number
1102
line = self.request.makefile().readline()
1103
logger.debug(u"Protocol version: %r", line)
1104
try:
1105
if int(line.strip().split()[0]) > 1:
1106
raise RuntimeError
1107
except (ValueError, IndexError, RuntimeError), error:
1108
logger.error(u"Unknown protocol version: %s", error)
1109
return
1110
1111
# Start GnuTLS connection
1112
try:
1113
session.handshake()
1114
except gnutls.errors.GNUTLSError, error:
1115
logger.warning(u"Handshake failed: %s", error)
1116
# Do not run session.bye() here: the session is not
1117
# established. Just abandon the request.
1118
return
1119
logger.debug(u"Handshake succeeded")
1120
try:
1121
try:
1122
fpr = self.fingerprint(self.peer_certificate
1123
(session))
1124
except (TypeError, gnutls.errors.GNUTLSError), error:
1125
logger.warning(u"Bad certificate: %s", error)
1126
return
1127
logger.debug(u"Fingerprint: %s", fpr)
1128
1129
try:
1130
client = ProxyClient(child_pipe, fpr,
1131
self.client_address)
1132
except KeyError:
1133
return
1134
1135
delay = client.approved_delay
1136
while True:
1137
if not client.enabled:
1138
logger.warning(u"Client %s is disabled",
1139
client.name)
1140
if self.server.use_dbus:
1141
# Emit D-Bus signal
1142
client.Rejected("Disabled")
1143
return
1144
if client._approved is None:
1145
logger.info(u"Client %s need approval",
1146
client.name)
1147
if self.server.use_dbus:
1148
# Emit D-Bus signal
1149
client.NeedApproval(
1150
client.approved_delay_milliseconds(),
1151
client.approved_by_default)
1152
elif client._approved:
1153
#We have a password and are approved
1154
break
1155
else:
1156
logger.warning(u"Client %s was not approved",
1157
client.name)
1158
if self.server.use_dbus:
1159
# Emit D-Bus signal
1160
client.Rejected("Disapproved")
1161
return
1162
1163
#wait until timeout or approved
1164
#x = float(client._timedelta_to_milliseconds(delay))
1165
time = datetime.datetime.now()
1166
client.changedstate.acquire()
1167
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1168
client.changedstate.release()
1169
time2 = datetime.datetime.now()
1170
if (time2 - time) >= delay:
1171
if not client.approved_by_default:
1172
logger.warning("Client %s timed out while"
1173
" waiting for approval",
1174
client.name)
1175
if self.server.use_dbus:
1176
# Emit D-Bus signal
1177
client.Rejected("Time out")
1178
return
1179
else:
1180
break
1181
else:
1182
delay -= time2 - time
1183
1184
sent_size = 0
1185
while sent_size < len(client.secret):
1186
# XXX handle session exception
1187
sent = session.send(client.secret[sent_size:])
1188
logger.debug(u"Sent: %d, remaining: %d",
1189
sent, len(client.secret)
1190
- (sent_size + sent))
1191
sent_size += sent
1192
1193
logger.info(u"Sending secret to %s", client.name)
1194
# bump the timeout as if seen
1195
client.checked_ok()
1196
if self.server.use_dbus:
1197
# Emit D-Bus signal
1198
client.GotSecret()
1199
1200
finally:
1201
session.bye()
1202
1203
@staticmethod
1204
def peer_certificate(session):
1205
"Return the peer's OpenPGP certificate as a bytestring"
1206
# If not an OpenPGP certificate...
1207
if (gnutls.library.functions
1208
.gnutls_certificate_type_get(session._c_object)
1209
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1210
# ...do the normal thing
1211
return session.peer_certificate
1212
list_size = ctypes.c_uint(1)
1213
cert_list = (gnutls.library.functions
1214
.gnutls_certificate_get_peers
1215
(session._c_object, ctypes.byref(list_size)))
1216
if not bool(cert_list) and list_size.value != 0:
1217
raise gnutls.errors.GNUTLSError(u"error getting peer"
1218
u" certificate")
1219
if list_size.value == 0:
1220
return None
1221
cert = cert_list[0]
1222
return ctypes.string_at(cert.data, cert.size)
1223
1224
@staticmethod
1225
def fingerprint(openpgp):
1226
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1227
# New GnuTLS "datum" with the OpenPGP public key
1228
datum = (gnutls.library.types
1229
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1230
ctypes.POINTER
1231
(ctypes.c_ubyte)),
1232
ctypes.c_uint(len(openpgp))))
1233
# New empty GnuTLS certificate
1234
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1235
(gnutls.library.functions
1236
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1237
# Import the OpenPGP public key into the certificate
1238
(gnutls.library.functions
1239
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1240
gnutls.library.constants
1241
.GNUTLS_OPENPGP_FMT_RAW))
1242
# Verify the self signature in the key
1243
crtverify = ctypes.c_uint()
1244
(gnutls.library.functions
1245
.gnutls_openpgp_crt_verify_self(crt, 0,
1246
ctypes.byref(crtverify)))
1247
if crtverify.value != 0:
1248
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1249
raise (gnutls.errors.CertificateSecurityError
1250
(u"Verify failed"))
1251
# New buffer for the fingerprint
1252
buf = ctypes.create_string_buffer(20)
1253
buf_len = ctypes.c_size_t()
1254
# Get the fingerprint from the certificate into the buffer
1255
(gnutls.library.functions
1256
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1257
ctypes.byref(buf_len)))
1258
# Deinit the certificate
1259
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1260
# Convert the buffer to a Python bytestring
1261
fpr = ctypes.string_at(buf, buf_len.value)
1262
# Convert the bytestring to hexadecimal notation
1263
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1264
return hex_fpr
1265
1266
1267
class MultiprocessingMixIn(object):
1268
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1269
def sub_process_main(self, request, address):
1270
try:
1271
self.finish_request(request, address)
1272
except:
1273
self.handle_error(request, address)
1274
self.close_request(request)
1275
1276
def process_request(self, request, address):
1277
"""Start a new process to process the request."""
1278
multiprocessing.Process(target = self.sub_process_main,
1279
args = (request, address)).start()
1280
1281
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1282
""" adds a pipe to the MixIn """
1283
def process_request(self, request, client_address):
1284
"""Overrides and wraps the original process_request().
1285
1286
This function creates a new pipe in self.pipe
1287
"""
1288
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1289
1290
super(MultiprocessingMixInWithPipe,
1291
self).process_request(request, client_address)
1292
self.add_pipe(parent_pipe)
1293
def add_pipe(self, parent_pipe):
1294
"""Dummy function; override as necessary"""
1295
pass
1296
1297
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1298
socketserver.TCPServer, object):
1299
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1300
449
logger.info(u"TCP connection from: %s",
450
unicode(self.client_address))
451
session = gnutls.connection.ClientSession\
452
(self.request, gnutls.connection.X509Credentials())
453
454
line = self.request.makefile().readline()
455
logger.debug(u"Protocol version: %r", line)
456
try:
457
if int(line.strip().split()[0]) > 1:
458
raise RuntimeError
459
except (ValueError, IndexError, RuntimeError), error:
460
logger.error(u"Unknown protocol version: %s", error)
461
return
462
463
# Note: gnutls.connection.X509Credentials is really a generic
464
# GnuTLS certificate credentials object so long as no X.509
465
# keys are added to it. Therefore, we can use it here despite
466
# using OpenPGP certificates.
467
468
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
469
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
470
# "+DHE-DSS"))
471
priority = "NORMAL" # Fallback default, since this
472
# MUST be set.
473
if self.server.settings["priority"]:
474
priority = self.server.settings["priority"]
475
gnutls.library.functions.gnutls_priority_set_direct\
476
(session._c_object, priority, None)
477
478
try:
479
session.handshake()
480
except gnutls.errors.GNUTLSError, error:
481
logger.warning(u"Handshake failed: %s", error)
482
# Do not run session.bye() here: the session is not
483
# established. Just abandon the request.
484
return
485
try:
486
fpr = fingerprint(peer_certificate(session))
487
except (TypeError, gnutls.errors.GNUTLSError), error:
488
logger.warning(u"Bad certificate: %s", error)
489
session.bye()
490
return
491
logger.debug(u"Fingerprint: %s", fpr)
492
client = None
493
for c in self.server.clients:
494
if c.fingerprint == fpr:
495
client = c
496
break
497
if not client:
498
logger.warning(u"Client not found for fingerprint: %s",
499
fpr)
500
session.bye()
501
return
502
# Have to check if client.still_valid(), since it is possible
503
# that the client timed out while establishing the GnuTLS
504
# session.
505
if not client.still_valid():
506
logger.warning(u"Client %(name)s is invalid",
507
vars(client))
508
session.bye()
509
return
510
sent_size = 0
511
while sent_size < len(client.secret):
512
sent = session.send(client.secret[sent_size:])
513
logger.debug(u"Sent: %d, remaining: %d",
514
sent, len(client.secret)
515
- (sent_size + sent))
516
sent_size += sent
517
session.bye()
518
519
520
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
521
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1301
522
Attributes:
523
settings: Server settings
524
clients: Set() of Client objects
1302
525
enabled: Boolean; whether this server is activated yet
1303
interface: None or a network interface name (string)
1304
use_ipv6: Boolean; to use IPv6 or not
1305
526
"""
1306
def __init__(self, server_address, RequestHandlerClass,
1307
interface=None, use_ipv6=True):
1308
self.interface = interface
1309
if use_ipv6:
1310
self.address_family = socket.AF_INET6
1311
socketserver.TCPServer.__init__(self, server_address,
1312
RequestHandlerClass)
527
address_family = socket.AF_INET6
528
def __init__(self, *args, **kwargs):
529
if "settings" in kwargs:
530
self.settings = kwargs["settings"]
531
del kwargs["settings"]
532
if "clients" in kwargs:
533
self.clients = kwargs["clients"]
534
del kwargs["clients"]
535
self.enabled = False
536
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1313
537
def server_bind(self):
1314
538
"""This overrides the normal server_bind() function
1315
539
to bind to an interface if one was specified, and also NOT to
1316
540
bind to an address or port if they were not specified."""
1317
if self.interface is not None:
1318
if SO_BINDTODEVICE is None:
1319
logger.error(u"SO_BINDTODEVICE does not exist;"
1320
u" cannot bind to interface %s",
1321
self.interface)
1322
else:
1323
try:
1324
self.socket.setsockopt(socket.SOL_SOCKET,
1325
SO_BINDTODEVICE,
1326
str(self.interface
1327
+ u'\0'))
1328
except socket.error, error:
1329
if error[0] == errno.EPERM:
1330
logger.error(u"No permission to"
1331
u" bind to interface %s",
1332
self.interface)
1333
elif error[0] == errno.ENOPROTOOPT:
1334
logger.error(u"SO_BINDTODEVICE not available;"
1335
u" cannot bind to interface %s",
1336
self.interface)
1337
else:
1338
raise
541
if self.settings["interface"]:
542
# 25 is from /usr/include/asm-i486/socket.h
543
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
544
try:
545
self.socket.setsockopt(socket.SOL_SOCKET,
546
SO_BINDTODEVICE,
547
self.settings["interface"])
548
except socket.error, error:
549
if error[0] == errno.EPERM:
550
logger.error(u"No permission to"
551
u" bind to interface %s",
552
self.settings["interface"])
553
else:
554
raise error
1339
555
# Only bind(2) the socket if we really need to.
1340
556
if self.server_address[0] or self.server_address[1]:
1341
557
if not self.server_address[0]:
1342
if self.address_family == socket.AF_INET6:
1343
any_address = u"::" # in6addr_any
1344
else:
1345
any_address = socket.INADDR_ANY
1346
self.server_address = (any_address,
558
in6addr_any = "::"
559
self.server_address = (in6addr_any,
1347
560
self.server_address[1])
1348
561
elif not self.server_address[1]:
1349
562
self.server_address = (self.server_address[0],
1350
563
0)
1351
# if self.interface:
564
# if self.settings["interface"]:
1352
565
# self.server_address = (self.server_address[0],
1353
566
# 0, # port
1354
567
# 0, # flowinfo
1355
568
# if_nametoindex
1356
# (self.interface))
1357
return socketserver.TCPServer.server_bind(self)
1358
1359
1360
class MandosServer(IPv6_TCPServer):
1361
"""Mandos server.
1362
1363
Attributes:
1364
clients: set of Client objects
1365
gnutls_priority GnuTLS priority string
1366
use_dbus: Boolean; to emit D-Bus signals or not
1367
1368
Assumes a gobject.MainLoop event loop.
1369
"""
1370
def __init__(self, server_address, RequestHandlerClass,
1371
interface=None, use_ipv6=True, clients=None,
1372
gnutls_priority=None, use_dbus=True):
1373
self.enabled = False
1374
self.clients = clients
1375
if self.clients is None:
1376
self.clients = set()
1377
self.use_dbus = use_dbus
1378
self.gnutls_priority = gnutls_priority
1379
IPv6_TCPServer.__init__(self, server_address,
1380
RequestHandlerClass,
1381
interface = interface,
1382
use_ipv6 = use_ipv6)
569
# (self.settings
570
# ["interface"]))
571
return super(IPv6_TCPServer, self).server_bind()
1383
572
def server_activate(self):
1384
573
if self.enabled:
1385
return socketserver.TCPServer.server_activate(self)
574
return super(IPv6_TCPServer, self).server_activate()
1386
575
def enable(self):
1387
576
self.enabled = True
1388
def add_pipe(self, parent_pipe):
1389
# Call "handle_ipc" for both data and EOF events
1390
gobject.io_add_watch(parent_pipe.fileno(),
1391
gobject.IO_IN | gobject.IO_HUP,
1392
functools.partial(self.handle_ipc,
1393
parent_pipe = parent_pipe))
1394
1395
def handle_ipc(self, source, condition, parent_pipe=None,
1396
client_object=None):
1397
condition_names = {
1398
gobject.IO_IN: u"IN", # There is data to read.
1399
gobject.IO_OUT: u"OUT", # Data can be written (without
1400
# blocking).
1401
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1402
gobject.IO_ERR: u"ERR", # Error condition.
1403
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1404
# broken, usually for pipes and
1405
# sockets).
1406
}
1407
conditions_string = ' | '.join(name
1408
for cond, name in
1409
condition_names.iteritems()
1410
if cond & condition)
1411
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1412
conditions_string)
1413
1414
# Read a request from the child
1415
request = parent_pipe.recv()
1416
command = request[0]
1417
1418
if command == 'init':
1419
fpr = request[1]
1420
address = request[2]
1421
1422
for c in self.clients:
1423
if c.fingerprint == fpr:
1424
client = c
1425
break
1426
else:
1427
logger.warning(u"Client not found for fingerprint: %s, ad"
1428
u"dress: %s", fpr, address)
1429
if self.use_dbus:
1430
# Emit D-Bus signal
1431
mandos_dbus_service.ClientNotFound(fpr, address)
1432
parent_pipe.send(False)
1433
return False
1434
1435
gobject.io_add_watch(parent_pipe.fileno(),
1436
gobject.IO_IN | gobject.IO_HUP,
1437
functools.partial(self.handle_ipc,
1438
parent_pipe = parent_pipe,
1439
client_object = client))
1440
parent_pipe.send(True)
1441
# remove the old hook in favor of the new above hook on same fileno
1442
return False
1443
if command == 'funcall':
1444
funcname = request[1]
1445
args = request[2]
1446
kwargs = request[3]
1447
1448
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1449
1450
if command == 'getattr':
1451
attrname = request[1]
1452
if callable(client_object.__getattribute__(attrname)):
1453
parent_pipe.send(('function',))
1454
else:
1455
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1456
1457
if command == 'setattr':
1458
attrname = request[1]
1459
value = request[2]
1460
setattr(client_object, attrname, value)
1461
1462
return True
1463
577
1464
578
1465
579
def string_to_delta(interval):
1466
580
"""Parse a string and return a datetime.timedelta
1467
1468
>>> string_to_delta(u'7d')
581
582
>>> string_to_delta('7d')
1469
583
datetime.timedelta(7)
1470
>>> string_to_delta(u'60s')
584
>>> string_to_delta('60s')
1471
585
datetime.timedelta(0, 60)
1472
>>> string_to_delta(u'60m')
586
>>> string_to_delta('60m')
1473
587
datetime.timedelta(0, 3600)
1474
>>> string_to_delta(u'24h')
588
>>> string_to_delta('24h')
1475
589
datetime.timedelta(1)
1476
590
>>> string_to_delta(u'1w')
1477
591
datetime.timedelta(7)
1478
>>> string_to_delta(u'5m 30s')
592
>>> string_to_delta('5m 30s')
1479
593
datetime.timedelta(0, 330)
1480
594
"""
1481
595
timevalue = datetime.timedelta(0)
1494
608
elif suffix == u"w":
1495
609
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1496
610
else:
1497
raise ValueError(u"Unknown suffix %r" % suffix)
1498
except (ValueError, IndexError), e:
1499
raise ValueError(e.message)
611
raise ValueError
612
except (ValueError, IndexError):
613
raise ValueError
1500
614
timevalue += delta
1501
615
return timevalue
1502
616
1503
617
618
def server_state_changed(state):
619
"""Derived from the Avahi example code"""
620
if state == avahi.SERVER_COLLISION:
621
logger.error(u"Zeroconf server name collision")
622
service.remove()
623
elif state == avahi.SERVER_RUNNING:
624
service.add()
625
626
627
def entry_group_state_changed(state, error):
628
"""Derived from the Avahi example code"""
629
logger.debug(u"Avahi state change: %i", state)
630
631
if state == avahi.ENTRY_GROUP_ESTABLISHED:
632
logger.debug(u"Zeroconf service established.")
633
elif state == avahi.ENTRY_GROUP_COLLISION:
634
logger.warning(u"Zeroconf service name collision.")
635
service.rename()
636
elif state == avahi.ENTRY_GROUP_FAILURE:
637
logger.critical(u"Avahi: Error in group state changed %s",
638
unicode(error))
639
raise AvahiGroupError("State changed: %s", str(error))
640
1504
641
def if_nametoindex(interface):
1505
"""Call the C function if_nametoindex(), or equivalent
1506
1507
Note: This function cannot accept a unicode string."""
642
"""Call the C function if_nametoindex(), or equivalent"""
1508
643
global if_nametoindex
1509
644
try:
1510
if_nametoindex = (ctypes.cdll.LoadLibrary
1511
(ctypes.util.find_library(u"c"))
1512
.if_nametoindex)
645
if_nametoindex = ctypes.cdll.LoadLibrary\
646
(ctypes.util.find_library("c")).if_nametoindex
1513
647
except (OSError, AttributeError):
1514
logger.warning(u"Doing if_nametoindex the hard way")
648
if "struct" not in sys.modules:
649
import struct
650
if "fcntl" not in sys.modules:
651
import fcntl
1515
652
def if_nametoindex(interface):
1516
653
"Get an interface index the hard way, i.e. using fcntl()"
1517
654
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1518
with contextlib.closing(socket.socket()) as s:
1519
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1520
struct.pack(str(u"16s16x"),
1521
interface))
1522
interface_index = struct.unpack(str(u"I"),
1523
ifreq[16:20])[0]
655
s = socket.socket()
656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
struct.pack("16s16x", interface))
658
s.close()
659
interface_index = struct.unpack("I", ifreq[16:20])[0]
1524
660
return interface_index
1525
661
return if_nametoindex(interface)
1526
662
1527
663
1528
664
def daemon(nochdir = False, noclose = False):
1529
665
"""See daemon(3). Standard BSD Unix function.
1530
1531
666
This should really exist as os.daemon, but it doesn't (yet)."""
1532
667
if os.fork():
1533
668
sys.exit()
1534
669
os.setsid()
1535
670
if not nochdir:
1536
os.chdir(u"/")
671
os.chdir("/")
1537
672
if os.fork():
1538
673
sys.exit()
1539
674
if not noclose:
1541
676
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1542
677
if not stat.S_ISCHR(os.fstat(null).st_mode):
1543
678
raise OSError(errno.ENODEV,
1544
u"%s not a character device"
1545
% os.path.devnull)
679
"/dev/null not a character device")
1546
680
os.dup2(null, sys.stdin.fileno())
1547
681
os.dup2(null, sys.stdout.fileno())
1548
682
os.dup2(null, sys.stderr.fileno())
1551
685
1552
686
1553
687
def main():
1554
1555
##################################################################
1556
# Parsing of options, both command line and config file
1557
1558
parser = optparse.OptionParser(version = "%%prog %s" % version)
1559
parser.add_option("-i", u"--interface", type=u"string",
1560
metavar="IF", help=u"Bind to interface IF")
1561
parser.add_option("-a", u"--address", type=u"string",
1562
help=u"Address to listen for requests on")
1563
parser.add_option("-p", u"--port", type=u"int",
1564
help=u"Port number to receive requests on")
1565
parser.add_option("--check", action=u"store_true",
1566
help=u"Run self-test")
1567
parser.add_option("--debug", action=u"store_true",
1568
help=u"Debug mode; run in foreground and log to"
1569
u" terminal")
1570
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1571
u" priority string (see GnuTLS documentation)")
1572
parser.add_option("--servicename", type=u"string",
1573
metavar=u"NAME", help=u"Zeroconf service name")
1574
parser.add_option("--configdir", type=u"string",
1575
default=u"/etc/mandos", metavar=u"DIR",
1576
help=u"Directory to search for configuration"
1577
u" files")
1578
parser.add_option("--no-dbus", action=u"store_false",
1579
dest=u"use_dbus", help=u"Do not provide D-Bus"
1580
u" system bus interface")
1581
parser.add_option("--no-ipv6", action=u"store_false",
1582
dest=u"use_ipv6", help=u"Do not use IPv6")
688
parser = OptionParser(version = "%%prog %s" % version)
689
parser.add_option("-i", "--interface", type="string",
690
metavar="IF", help="Bind to interface IF")
691
parser.add_option("-a", "--address", type="string",
692
help="Address to listen for requests on")
693
parser.add_option("-p", "--port", type="int",
694
help="Port number to receive requests on")
695
parser.add_option("--check", action="store_true", default=False,
696
help="Run self-test")
697
parser.add_option("--debug", action="store_true",
698
help="Debug mode; run in foreground and log to"
699
" terminal")
700
parser.add_option("--priority", type="string", help="GnuTLS"
701
" priority string (see GnuTLS documentation)")
702
parser.add_option("--servicename", type="string", metavar="NAME",
703
help="Zeroconf service name")
704
parser.add_option("--configdir", type="string",
705
default="/etc/mandos", metavar="DIR",
706
help="Directory to search for configuration"
707
" files")
1583
708
options = parser.parse_args()[0]
1584
709
1585
710
if options.check:
1588
713
sys.exit()
1589
714
1590
715
# Default values for config file for server-global settings
1591
server_defaults = { u"interface": u"",
1592
u"address": u"",
1593
u"port": u"",
1594
u"debug": u"False",
1595
u"priority":
1596
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1597
u"servicename": u"Mandos",
1598
u"use_dbus": u"True",
1599
u"use_ipv6": u"True",
716
server_defaults = { "interface": "",
717
"address": "",
718
"port": "",
719
"debug": "False",
720
"priority":
721
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
722
"servicename": "Mandos",
1600
723
}
1601
724
1602
725
# Parse config file for server-global settings
1603
server_config = configparser.SafeConfigParser(server_defaults)
726
server_config = ConfigParser.SafeConfigParser(server_defaults)
1604
727
del server_defaults
1605
server_config.read(os.path.join(options.configdir,
1606
u"mandos.conf"))
728
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1607
729
# Convert the SafeConfigParser object to a dict
1608
730
server_settings = server_config.defaults()
1609
# Use the appropriate methods on the non-string config options
1610
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1611
server_settings[option] = server_config.getboolean(u"DEFAULT",
1612
option)
1613
if server_settings["port"]:
1614
server_settings["port"] = server_config.getint(u"DEFAULT",
1615
u"port")
731
# Use getboolean on the boolean config option
732
server_settings["debug"] = server_config.getboolean\
733
("DEFAULT", "debug")
1616
734
del server_config
1617
735
1618
736
# Override the settings from the config file with command line
1619
737
# options, if set.
1620
for option in (u"interface", u"address", u"port", u"debug",
1621
u"priority", u"servicename", u"configdir",
1622
u"use_dbus", u"use_ipv6"):
738
for option in ("interface", "address", "port", "debug",
739
"priority", "servicename", "configdir"):
1623
740
value = getattr(options, option)
1624
741
if value is not None:
1625
742
server_settings[option] = value
1626
743
del options
1627
# Force all strings to be unicode
1628
for option in server_settings.keys():
1629
if type(server_settings[option]) is str:
1630
server_settings[option] = unicode(server_settings[option])
1631
744
# Now we have our good server settings in "server_settings"
1632
745
1633
##################################################################
1634
1635
# For convenience
1636
debug = server_settings[u"debug"]
1637
use_dbus = server_settings[u"use_dbus"]
1638
use_ipv6 = server_settings[u"use_ipv6"]
746
debug = server_settings["debug"]
1639
747
1640
748
if not debug:
1641
749
syslogger.setLevel(logging.WARNING)
1642
750
console.setLevel(logging.WARNING)
1643
751
1644
if server_settings[u"servicename"] != u"Mandos":
1645
syslogger.setFormatter(logging.Formatter
1646
(u'Mandos (%s) [%%(process)d]:'
1647
u' %%(levelname)s: %%(message)s'
1648
% server_settings[u"servicename"]))
752
if server_settings["servicename"] != "Mandos":
753
syslogger.setFormatter(logging.Formatter\
754
('Mandos (%s): %%(levelname)s:'
755
' %%(message)s'
756
% server_settings["servicename"]))
1649
757
1650
758
# Parse config file with clients
1651
client_defaults = { u"timeout": u"1h",
1652
u"interval": u"5m",
1653
u"checker": u"fping -q -- %%(host)s",
1654
u"host": u"",
1655
u"approved_delay": u"5m",
1656
u"approved_duration": u"1s",
759
client_defaults = { "timeout": "1h",
760
"interval": "5m",
761
"checker": "fping -q -- %(host)s",
762
"host": "",
1657
763
}
1658
client_config = configparser.SafeConfigParser(client_defaults)
1659
client_config.read(os.path.join(server_settings[u"configdir"],
1660
u"clients.conf"))
1661
1662
global mandos_dbus_service
1663
mandos_dbus_service = None
1664
1665
tcp_server = MandosServer((server_settings[u"address"],
1666
server_settings[u"port"]),
1667
ClientHandler,
1668
interface=server_settings[u"interface"],
1669
use_ipv6=use_ipv6,
1670
gnutls_priority=
1671
server_settings[u"priority"],
1672
use_dbus=use_dbus)
1673
pidfilename = u"/var/run/mandos.pid"
1674
try:
1675
pidfile = open(pidfilename, u"w")
1676
except IOError:
1677
logger.error(u"Could not open file %r", pidfilename)
1678
1679
try:
1680
uid = pwd.getpwnam(u"_mandos").pw_uid
1681
gid = pwd.getpwnam(u"_mandos").pw_gid
1682
except KeyError:
1683
try:
1684
uid = pwd.getpwnam(u"mandos").pw_uid
1685
gid = pwd.getpwnam(u"mandos").pw_gid
1686
except KeyError:
1687
try:
1688
uid = pwd.getpwnam(u"nobody").pw_uid
1689
gid = pwd.getpwnam(u"nobody").pw_gid
1690
except KeyError:
1691
uid = 65534
1692
gid = 65534
1693
try:
764
client_config = ConfigParser.SafeConfigParser(client_defaults)
765
client_config.read(os.path.join(server_settings["configdir"],
766
"clients.conf"))
767
768
clients = Set()
769
tcp_server = IPv6_TCPServer((server_settings["address"],
770
server_settings["port"]),
771
TCP_handler,
772
settings=server_settings,
773
clients=clients)
774
pidfilename = "/var/run/mandos.pid"
775
try:
776
pidfile = open(pidfilename, "w")
777
except IOError, error:
778
logger.error("Could not open file %r", pidfilename)
779
780
uid = 65534
781
gid = 65534
782
try:
783
uid = pwd.getpwnam("mandos").pw_uid
784
except KeyError:
785
try:
786
uid = pwd.getpwnam("nobody").pw_uid
787
except KeyError:
788
pass
789
try:
790
gid = pwd.getpwnam("mandos").pw_gid
791
except KeyError:
792
try:
793
gid = pwd.getpwnam("nogroup").pw_gid
794
except KeyError:
795
pass
796
try:
797
os.setuid(uid)
1694
798
os.setgid(gid)
1695
os.setuid(uid)
1696
799
except OSError, error:
1697
800
if error[0] != errno.EPERM:
1698
801
raise error
1699
802
1700
# Enable all possible GnuTLS debugging
1701
if debug:
1702
# "Use a log level over 10 to enable all debugging options."
1703
# - GnuTLS manual
1704
gnutls.library.functions.gnutls_global_set_log_level(11)
1705
1706
@gnutls.library.types.gnutls_log_func
1707
def debug_gnutls(level, string):
1708
logger.debug(u"GnuTLS: %s", string[:-1])
1709
1710
(gnutls.library.functions
1711
.gnutls_global_set_log_function(debug_gnutls))
803
global service
804
service = AvahiService(name = server_settings["servicename"],
805
servicetype = "_mandos._tcp", )
806
if server_settings["interface"]:
807
service.interface = if_nametoindex\
808
(server_settings["interface"])
1712
809
1713
810
global main_loop
811
global bus
812
global server
1714
813
# From the Avahi example code
1715
814
DBusGMainLoop(set_as_default=True )
1716
815
main_loop = gobject.MainLoop()
1717
816
bus = dbus.SystemBus()
817
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
818
avahi.DBUS_PATH_SERVER),
819
avahi.DBUS_INTERFACE_SERVER)
1718
820
# End of Avahi example code
1719
if use_dbus:
1720
try:
1721
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1722
bus, do_not_queue=True)
1723
except dbus.exceptions.NameExistsException, e:
1724
logger.error(unicode(e) + u", disabling D-Bus")
1725
use_dbus = False
1726
server_settings[u"use_dbus"] = False
1727
tcp_server.use_dbus = False
1728
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1729
service = AvahiService(name = server_settings[u"servicename"],
1730
servicetype = u"_mandos._tcp",
1731
protocol = protocol, bus = bus)
1732
if server_settings["interface"]:
1733
service.interface = (if_nametoindex
1734
(str(server_settings[u"interface"])))
1735
1736
client_class = Client
1737
if use_dbus:
1738
client_class = functools.partial(ClientDBus, bus = bus)
1739
def client_config_items(config, section):
1740
special_settings = {
1741
"approve_by_default":
1742
lambda: config.getboolean(section,
1743
"approve_by_default"),
1744
}
1745
for name, value in config.items(section):
1746
try:
1747
yield special_settings[name]()
1748
except KeyError:
1749
yield (name, value)
1750
1751
tcp_server.clients.update(set(
1752
client_class(name = section,
1753
config= dict(client_config_items(
1754
client_config, section)))
1755
for section in client_config.sections()))
1756
if not tcp_server.clients:
1757
logger.warning(u"No clients defined")
821
822
def remove_from_clients(client):
823
clients.remove(client)
824
if not clients:
825
logger.critical(u"No clients left, exiting")
826
sys.exit()
827
828
clients.update(Set(Client(name = section,
829
stop_hook = remove_from_clients,
830
config
831
= dict(client_config.items(section)))
832
for section in client_config.sections()))
833
if not clients:
834
logger.critical(u"No clients defined")
835
sys.exit(1)
1758
836
1759
837
if debug:
1760
838
# Redirect stdin so all checkers get /dev/null
1769
847
daemon()
1770
848
1771
849
try:
1772
with pidfile:
1773
pid = os.getpid()
1774
pidfile.write(str(pid) + "\n")
850
pid = os.getpid()
851
pidfile.write(str(pid) + "\n")
852
pidfile.close()
1775
853
del pidfile
1776
854
except IOError:
1777
855
logger.error(u"Could not write to file %r with PID %d",
1781
859
pass
1782
860
del pidfilename
1783
861
862
def cleanup():
863
"Cleanup function; run on exit"
864
global group
865
# From the Avahi example code
866
if not group is None:
867
group.Free()
868
group = None
869
# End of Avahi example code
870
871
while clients:
872
client = clients.pop()
873
client.stop_hook = None
874
client.stop()
875
876
atexit.register(cleanup)
877
1784
878
if not debug:
1785
879
signal.signal(signal.SIGINT, signal.SIG_IGN)
1786
880
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1787
881
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1788
882
1789
if use_dbus:
1790
class MandosDBusService(dbus.service.Object):
1791
"""A D-Bus proxy object"""
1792
def __init__(self):
1793
dbus.service.Object.__init__(self, bus, u"/")
1794
_interface = u"se.bsnet.fukt.Mandos"
1795
1796
@dbus.service.signal(_interface, signature=u"o")
1797
def ClientAdded(self, objpath):
1798
"D-Bus signal"
1799
pass
1800
1801
@dbus.service.signal(_interface, signature=u"ss")
1802
def ClientNotFound(self, fingerprint, address):
1803
"D-Bus signal"
1804
pass
1805
1806
@dbus.service.signal(_interface, signature=u"os")
1807
def ClientRemoved(self, objpath, name):
1808
"D-Bus signal"
1809
pass
1810
1811
@dbus.service.method(_interface, out_signature=u"ao")
1812
def GetAllClients(self):
1813
"D-Bus method"
1814
return dbus.Array(c.dbus_object_path
1815
for c in tcp_server.clients)
1816
1817
@dbus.service.method(_interface,
1818
out_signature=u"a{oa{sv}}")
1819
def GetAllClientsWithProperties(self):
1820
"D-Bus method"
1821
return dbus.Dictionary(
1822
((c.dbus_object_path, c.GetAll(u""))
1823
for c in tcp_server.clients),
1824
signature=u"oa{sv}")
1825
1826
@dbus.service.method(_interface, in_signature=u"o")
1827
def RemoveClient(self, object_path):
1828
"D-Bus method"
1829
for c in tcp_server.clients:
1830
if c.dbus_object_path == object_path:
1831
tcp_server.clients.remove(c)
1832
c.remove_from_connection()
1833
# Don't signal anything except ClientRemoved
1834
c.disable(quiet=True)
1835
# Emit D-Bus signal
1836
self.ClientRemoved(object_path, c.name)
1837
return
1838
raise KeyError(object_path)
1839
1840
del _interface
1841
1842
mandos_dbus_service = MandosDBusService()
1843
1844
def cleanup():
1845
"Cleanup function; run on exit"
1846
service.cleanup()
1847
1848
while tcp_server.clients:
1849
client = tcp_server.clients.pop()
1850
if use_dbus:
1851
client.remove_from_connection()
1852
client.disable_hook = None
1853
# Don't signal anything except ClientRemoved
1854
client.disable(quiet=True)
1855
if use_dbus:
1856
# Emit D-Bus signal
1857
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1858
client.name)
1859
1860
atexit.register(cleanup)
1861
1862
for client in tcp_server.clients:
1863
if use_dbus:
1864
# Emit D-Bus signal
1865
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1866
client.enable()
883
for client in clients:
884
client.start()
1867
885
1868
886
tcp_server.enable()
1869
887
tcp_server.server_activate()
1870
888
1871
889
# Find out what port we got
1872
890
service.port = tcp_server.socket.getsockname()[1]
1873
if use_ipv6:
1874
logger.info(u"Now listening on address %r, port %d,"
1875
" flowinfo %d, scope_id %d"
1876
% tcp_server.socket.getsockname())
1877
else: # IPv4
1878
logger.info(u"Now listening on address %r, port %d"
1879
% tcp_server.socket.getsockname())
891
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
892
u" scope_id %d" % tcp_server.socket.getsockname())
1880
893
1881
894
#service.interface = tcp_server.socket.getsockname()[3]
1882
895
1883
896
try:
1884
897
# From the Avahi example code
898
server.connect_to_signal("StateChanged", server_state_changed)
1885
899
try:
1886
service.activate()
900
server_state_changed(server.GetState())
1887
901
except dbus.exceptions.DBusException, error:
1888
902
logger.critical(u"DBusException: %s", error)
1889
cleanup()
1890
903
sys.exit(1)
1891
904
# End of Avahi example code
1892
905
1893
906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1894
907
lambda *args, **kwargs:
1895
(tcp_server.handle_request
1896
(*args[2:], **kwargs) or True))
908
tcp_server.handle_request\
909
(*args[2:], **kwargs) or True)
1897
910
1898
911
logger.debug(u"Starting main loop")
1899
912
main_loop.run()
1900
913
except AvahiError, error:
1901
logger.critical(u"AvahiError: %s", error)
1902
cleanup()
914
logger.critical(u"AvahiError: %s" + unicode(error))
1903
915
sys.exit(1)
1904
916
except KeyboardInterrupt:
1905
917
if debug:
1906
print >> sys.stderr
1907
logger.debug(u"Server received KeyboardInterrupt")
1908
logger.debug(u"Server exiting")
1909
# Must run before the D-Bus bus name gets deregistered
1910
cleanup()
918
print
1911
919
1912
920
if __name__ == '__main__':
1913
921
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0