/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

* plugins.d/splashy.c (main): Do not abort if a process vanishes while
                              investigating it.
* plugins.d/usplash.c (main): - '' -  Also removed unnecessary code.

Show diffs side-by-side

added added

removed removed

Lines of Context:
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add", "remove", "server_state_changed",
10
 
# "entry_group_state_changed", "cleanup", and "activate" in the
11
 
# "AvahiService" class, and some lines in "main".
 
9
# methods "add" and "remove" in the "AvahiService" class, the
 
10
# "server_state_changed" and "entry_group_state_changed" functions,
 
11
# and some lines in "main".
12
12
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
 
34
34
from __future__ import division, with_statement, absolute_import
35
35
 
36
 
import SocketServer as socketserver
 
36
import SocketServer
37
37
import socket
38
 
import optparse
 
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
 
import ConfigParser as configparser
 
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
 
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
58
 
import contextlib
59
 
import struct
60
 
import fcntl
61
 
import functools
62
 
import cPickle as pickle
63
 
import multiprocessing
 
59
from contextlib import closing
64
60
 
65
61
import dbus
66
62
import dbus.service
69
65
from dbus.mainloop.glib import DBusGMainLoop
70
66
import ctypes
71
67
import ctypes.util
72
 
import xml.dom.minidom
73
 
import inspect
74
 
 
75
 
try:
76
 
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
77
 
except AttributeError:
78
 
    try:
79
 
        from IN import SO_BINDTODEVICE
80
 
    except ImportError:
81
 
        SO_BINDTODEVICE = None
82
 
 
83
 
 
84
 
version = "1.0.14"
85
 
 
86
 
#logger = logging.getLogger(u'mandos')
87
 
logger = logging.Logger(u'mandos')
 
68
 
 
69
version = "1.0.3"
 
70
 
 
71
logger = logging.Logger('mandos')
88
72
syslogger = (logging.handlers.SysLogHandler
89
73
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
74
              address = "/dev/log"))
91
75
syslogger.setFormatter(logging.Formatter
92
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
93
 
                        u' %(message)s'))
 
76
                       ('Mandos: %(levelname)s: %(message)s'))
94
77
logger.addHandler(syslogger)
95
78
 
96
79
console = logging.StreamHandler()
97
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
 
                                       u' %(levelname)s:'
99
 
                                       u' %(message)s'))
 
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
 
81
                                       ' %(message)s'))
100
82
logger.addHandler(console)
101
83
 
102
84
class AvahiError(Exception):
115
97
 
116
98
class AvahiService(object):
117
99
    """An Avahi (Zeroconf) service.
118
 
    
119
100
    Attributes:
120
101
    interface: integer; avahi.IF_UNSPEC or an interface index.
121
102
               Used to optionally bind to the specified interface.
122
 
    name: string; Example: u'Mandos'
123
 
    type: string; Example: u'_mandos._tcp'.
 
103
    name: string; Example: 'Mandos'
 
104
    type: string; Example: '_mandos._tcp'.
124
105
                  See <http://www.dns-sd.org/ServiceTypes.html>
125
106
    port: integer; what port to announce
126
107
    TXT: list of strings; TXT record for the service
129
110
    max_renames: integer; maximum number of renames
130
111
    rename_count: integer; counter so we only rename after collisions
131
112
                  a sensible number of times
132
 
    group: D-Bus Entry Group
133
 
    server: D-Bus Server
134
 
    bus: dbus.SystemBus()
135
113
    """
136
114
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
115
                 servicetype = None, port = None, TXT = None,
138
 
                 domain = u"", host = u"", max_renames = 32768,
139
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
116
                 domain = "", host = "", max_renames = 32768):
140
117
        self.interface = interface
141
118
        self.name = name
142
119
        self.type = servicetype
146
123
        self.host = host
147
124
        self.rename_count = 0
148
125
        self.max_renames = max_renames
149
 
        self.protocol = protocol
150
 
        self.group = None       # our entry group
151
 
        self.server = None
152
 
        self.bus = bus
153
126
    def rename(self):
154
127
        """Derived from the Avahi example code"""
155
128
        if self.rename_count >= self.max_renames:
157
130
                            u" after %i retries, exiting.",
158
131
                            self.rename_count)
159
132
            raise AvahiServiceError(u"Too many renames")
160
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
133
        self.name = server.GetAlternativeServiceName(self.name)
161
134
        logger.info(u"Changing Zeroconf service name to %r ...",
162
 
                    self.name)
 
135
                    str(self.name))
163
136
        syslogger.setFormatter(logging.Formatter
164
 
                               (u'Mandos (%s) [%%(process)d]:'
165
 
                                u' %%(levelname)s: %%(message)s'
166
 
                                % self.name))
 
137
                               ('Mandos (%s): %%(levelname)s:'
 
138
                                ' %%(message)s' % self.name))
167
139
        self.remove()
168
 
        try:
169
 
            self.add()
170
 
        except dbus.exceptions.DBusException, error:
171
 
            logger.critical(u"DBusException: %s", error)
172
 
            self.cleanup()
173
 
            os._exit(1)
 
140
        self.add()
174
141
        self.rename_count += 1
175
142
    def remove(self):
176
143
        """Derived from the Avahi example code"""
177
 
        if self.group is not None:
178
 
            self.group.Reset()
 
144
        if group is not None:
 
145
            group.Reset()
179
146
    def add(self):
180
147
        """Derived from the Avahi example code"""
181
 
        if self.group is None:
182
 
            self.group = dbus.Interface(
183
 
                self.bus.get_object(avahi.DBUS_NAME,
184
 
                                    self.server.EntryGroupNew()),
185
 
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
 
            self.group.connect_to_signal('StateChanged',
187
 
                                         self
188
 
                                         .entry_group_state_changed)
 
148
        global group
 
149
        if group is None:
 
150
            group = dbus.Interface(bus.get_object
 
151
                                   (avahi.DBUS_NAME,
 
152
                                    server.EntryGroupNew()),
 
153
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
154
            group.connect_to_signal('StateChanged',
 
155
                                    entry_group_state_changed)
189
156
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
190
 
                     self.name, self.type)
191
 
        self.group.AddService(
192
 
            self.interface,
193
 
            self.protocol,
194
 
            dbus.UInt32(0),     # flags
195
 
            self.name, self.type,
196
 
            self.domain, self.host,
197
 
            dbus.UInt16(self.port),
198
 
            avahi.string_array_to_txt_array(self.TXT))
199
 
        self.group.Commit()
200
 
    def entry_group_state_changed(self, state, error):
201
 
        """Derived from the Avahi example code"""
202
 
        logger.debug(u"Avahi entry group state change: %i", state)
203
 
        
204
 
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
 
            logger.debug(u"Zeroconf service established.")
206
 
        elif state == avahi.ENTRY_GROUP_COLLISION:
207
 
            logger.warning(u"Zeroconf service name collision.")
208
 
            self.rename()
209
 
        elif state == avahi.ENTRY_GROUP_FAILURE:
210
 
            logger.critical(u"Avahi: Error in group state changed %s",
211
 
                            unicode(error))
212
 
            raise AvahiGroupError(u"State changed: %s"
213
 
                                  % unicode(error))
214
 
    def cleanup(self):
215
 
        """Derived from the Avahi example code"""
216
 
        if self.group is not None:
217
 
            self.group.Free()
218
 
            self.group = None
219
 
    def server_state_changed(self, state):
220
 
        """Derived from the Avahi example code"""
221
 
        logger.debug(u"Avahi server state change: %i", state)
222
 
        if state == avahi.SERVER_COLLISION:
223
 
            logger.error(u"Zeroconf server name collision")
224
 
            self.remove()
225
 
        elif state == avahi.SERVER_RUNNING:
226
 
            self.add()
227
 
    def activate(self):
228
 
        """Derived from the Avahi example code"""
229
 
        if self.server is None:
230
 
            self.server = dbus.Interface(
231
 
                self.bus.get_object(avahi.DBUS_NAME,
232
 
                                    avahi.DBUS_PATH_SERVER),
233
 
                avahi.DBUS_INTERFACE_SERVER)
234
 
        self.server.connect_to_signal(u"StateChanged",
235
 
                                 self.server_state_changed)
236
 
        self.server_state_changed(self.server.GetState())
237
 
 
238
 
 
239
 
class Client(object):
 
157
                     service.name, service.type)
 
158
        group.AddService(
 
159
                self.interface,         # interface
 
160
                avahi.PROTO_INET6,      # protocol
 
161
                dbus.UInt32(0),         # flags
 
162
                self.name, self.type,
 
163
                self.domain, self.host,
 
164
                dbus.UInt16(self.port),
 
165
                avahi.string_array_to_txt_array(self.TXT))
 
166
        group.Commit()
 
167
 
 
168
# From the Avahi example code:
 
169
group = None                            # our entry group
 
170
# End of Avahi example code
 
171
 
 
172
 
 
173
def _datetime_to_dbus(dt, variant_level=0):
 
174
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
175
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
176
 
 
177
 
 
178
class Client(dbus.service.Object):
240
179
    """A representation of a client host served by this server.
241
 
    
242
180
    Attributes:
243
 
    _approved:   bool(); 'None' if not yet approved/disapproved
244
 
    approval_delay: datetime.timedelta(); Time to wait for approval
245
 
    approval_duration: datetime.timedelta(); Duration of one approval
 
181
    name:       string; from the config file, used in log messages
 
182
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
183
                 uniquely identify the client
 
184
    secret:     bytestring; sent verbatim (over TLS) to client
 
185
    host:       string; available for use by the checker command
 
186
    created:    datetime.datetime(); (UTC) object creation
 
187
    last_enabled: datetime.datetime(); (UTC)
 
188
    enabled:    bool()
 
189
    last_checked_ok: datetime.datetime(); (UTC) or None
 
190
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
191
                                      until this client is invalid
 
192
    interval:   datetime.timedelta(); How often to start a new checker
 
193
    disable_hook:  If set, called by disable() as disable_hook(self)
246
194
    checker:    subprocess.Popen(); a running checker process used
247
195
                                    to see if the client lives.
248
196
                                    'None' if no process is running.
 
197
    checker_initiator_tag: a gobject event source tag, or None
 
198
    disable_initiator_tag:    - '' -
249
199
    checker_callback_tag:  - '' -
250
 
    checker_command: string; External command which is run to check
251
 
                     if client lives.  %() expansions are done at
 
200
    checker_command: string; External command which is run to check if
 
201
                     client lives.  %() expansions are done at
252
202
                     runtime with vars(self) as dict, so that for
253
203
                     instance %(name)s can be used in the command.
254
 
    checker_initiator_tag: a gobject event source tag, or None
255
 
    created:    datetime.datetime(); (UTC) object creation
256
 
    current_checker_command: string; current running checker_command
257
 
    disable_hook:  If set, called by disable() as disable_hook(self)
258
 
    disable_initiator_tag: - '' -
259
 
    enabled:    bool()
260
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
261
 
                 uniquely identify the client
262
 
    host:       string; available for use by the checker command
263
 
    interval:   datetime.timedelta(); How often to start a new checker
264
 
    last_checked_ok: datetime.datetime(); (UTC) or None
265
 
    last_enabled: datetime.datetime(); (UTC)
266
 
    name:       string; from the config file, used in log messages and
267
 
                        D-Bus identifiers
268
 
    secret:     bytestring; sent verbatim (over TLS) to client
269
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
270
 
                                      until this client is disabled
271
 
    runtime_expansions: Allowed attributes for runtime expansion.
 
204
    use_dbus: bool(); Whether to provide D-Bus interface and signals
 
205
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
272
206
    """
273
 
    
274
 
    runtime_expansions = (u"approval_delay", u"approval_duration",
275
 
                          u"created", u"enabled", u"fingerprint",
276
 
                          u"host", u"interval", u"last_checked_ok",
277
 
                          u"last_enabled", u"name", u"timeout")
278
 
    
279
 
    @staticmethod
280
 
    def _timedelta_to_milliseconds(td):
281
 
        "Convert a datetime.timedelta() to milliseconds"
282
 
        return ((td.days * 24 * 60 * 60 * 1000)
283
 
                + (td.seconds * 1000)
284
 
                + (td.microseconds // 1000))
285
 
    
286
207
    def timeout_milliseconds(self):
287
208
        "Return the 'timeout' attribute in milliseconds"
288
 
        return self._timedelta_to_milliseconds(self.timeout)
 
209
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
 
210
                + (self.timeout.seconds * 1000)
 
211
                + (self.timeout.microseconds // 1000))
289
212
    
290
213
    def interval_milliseconds(self):
291
214
        "Return the 'interval' attribute in milliseconds"
292
 
        return self._timedelta_to_milliseconds(self.interval)
293
 
 
294
 
    def approval_delay_milliseconds(self):
295
 
        return self._timedelta_to_milliseconds(self.approval_delay)
 
215
        return ((self.interval.days * 24 * 60 * 60 * 1000)
 
216
                + (self.interval.seconds * 1000)
 
217
                + (self.interval.microseconds // 1000))
296
218
    
297
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
219
    def __init__(self, name = None, disable_hook=None, config=None,
 
220
                 use_dbus=True):
298
221
        """Note: the 'checker' key in 'config' sets the
299
222
        'checker_command' attribute and *not* the 'checker'
300
223
        attribute."""
302
225
        if config is None:
303
226
            config = {}
304
227
        logger.debug(u"Creating client %r", self.name)
 
228
        self.use_dbus = use_dbus
 
229
        if self.use_dbus:
 
230
            self.dbus_object_path = (dbus.ObjectPath
 
231
                                     ("/Mandos/clients/"
 
232
                                      + self.name.replace(".", "_")))
 
233
            dbus.service.Object.__init__(self, bus,
 
234
                                         self.dbus_object_path)
305
235
        # Uppercase and remove spaces from fingerprint for later
306
236
        # comparison purposes with return value from the fingerprint()
307
237
        # function
308
 
        self.fingerprint = (config[u"fingerprint"].upper()
 
238
        self.fingerprint = (config["fingerprint"].upper()
309
239
                            .replace(u" ", u""))
310
240
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
311
 
        if u"secret" in config:
312
 
            self.secret = config[u"secret"].decode(u"base64")
313
 
        elif u"secfile" in config:
314
 
            with open(os.path.expanduser(os.path.expandvars
315
 
                                         (config[u"secfile"])),
316
 
                      "rb") as secfile:
 
241
        if "secret" in config:
 
242
            self.secret = config["secret"].decode(u"base64")
 
243
        elif "secfile" in config:
 
244
            with closing(open(os.path.expanduser
 
245
                              (os.path.expandvars
 
246
                               (config["secfile"])))) as secfile:
317
247
                self.secret = secfile.read()
318
248
        else:
319
249
            raise TypeError(u"No secret or secfile for client %s"
320
250
                            % self.name)
321
 
        self.host = config.get(u"host", u"")
 
251
        self.host = config.get("host", "")
322
252
        self.created = datetime.datetime.utcnow()
323
253
        self.enabled = False
324
254
        self.last_enabled = None
325
255
        self.last_checked_ok = None
326
 
        self.timeout = string_to_delta(config[u"timeout"])
327
 
        self.interval = string_to_delta(config[u"interval"])
 
256
        self.timeout = string_to_delta(config["timeout"])
 
257
        self.interval = string_to_delta(config["interval"])
328
258
        self.disable_hook = disable_hook
329
259
        self.checker = None
330
260
        self.checker_initiator_tag = None
331
261
        self.disable_initiator_tag = None
332
262
        self.checker_callback_tag = None
333
 
        self.checker_command = config[u"checker"]
334
 
        self.current_checker_command = None
335
 
        self.last_connect = None
336
 
        self._approved = None
337
 
        self.approved_by_default = config.get(u"approved_by_default",
338
 
                                              True)
339
 
        self.approvals_pending = 0
340
 
        self.approval_delay = string_to_delta(
341
 
            config[u"approval_delay"])
342
 
        self.approval_duration = string_to_delta(
343
 
            config[u"approval_duration"])
344
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
263
        self.checker_command = config["checker"]
345
264
    
346
 
    def send_changedstate(self):
347
 
        self.changedstate.acquire()
348
 
        self.changedstate.notify_all()
349
 
        self.changedstate.release()
350
 
        
351
265
    def enable(self):
352
266
        """Start this client's checker and timeout hooks"""
353
 
        if getattr(self, u"enabled", False):
354
 
            # Already enabled
355
 
            return
356
 
        self.send_changedstate()
357
267
        self.last_enabled = datetime.datetime.utcnow()
358
268
        # Schedule a new checker to be started an 'interval' from now,
359
269
        # and every interval from then on.
360
270
        self.checker_initiator_tag = (gobject.timeout_add
361
271
                                      (self.interval_milliseconds(),
362
272
                                       self.start_checker))
 
273
        # Also start a new checker *right now*.
 
274
        self.start_checker()
363
275
        # Schedule a disable() when 'timeout' has passed
364
276
        self.disable_initiator_tag = (gobject.timeout_add
365
277
                                   (self.timeout_milliseconds(),
366
278
                                    self.disable))
367
279
        self.enabled = True
368
 
        # Also start a new checker *right now*.
369
 
        self.start_checker()
 
280
        if self.use_dbus:
 
281
            # Emit D-Bus signals
 
282
            self.PropertyChanged(dbus.String(u"enabled"),
 
283
                                 dbus.Boolean(True, variant_level=1))
 
284
            self.PropertyChanged(dbus.String(u"last_enabled"),
 
285
                                 (_datetime_to_dbus(self.last_enabled,
 
286
                                                    variant_level=1)))
370
287
    
371
 
    def disable(self, quiet=True):
 
288
    def disable(self):
372
289
        """Disable this client."""
373
290
        if not getattr(self, "enabled", False):
374
291
            return False
375
 
        if not quiet:
376
 
            self.send_changedstate()
377
 
        if not quiet:
378
 
            logger.info(u"Disabling client %s", self.name)
379
 
        if getattr(self, u"disable_initiator_tag", False):
 
292
        logger.info(u"Disabling client %s", self.name)
 
293
        if getattr(self, "disable_initiator_tag", False):
380
294
            gobject.source_remove(self.disable_initiator_tag)
381
295
            self.disable_initiator_tag = None
382
 
        if getattr(self, u"checker_initiator_tag", False):
 
296
        if getattr(self, "checker_initiator_tag", False):
383
297
            gobject.source_remove(self.checker_initiator_tag)
384
298
            self.checker_initiator_tag = None
385
299
        self.stop_checker()
386
300
        if self.disable_hook:
387
301
            self.disable_hook(self)
388
302
        self.enabled = False
 
303
        if self.use_dbus:
 
304
            # Emit D-Bus signal
 
305
            self.PropertyChanged(dbus.String(u"enabled"),
 
306
                                 dbus.Boolean(False, variant_level=1))
389
307
        # Do not run this again if called by a gobject.timeout_add
390
308
        return False
391
309
    
397
315
        """The checker has completed, so take appropriate actions."""
398
316
        self.checker_callback_tag = None
399
317
        self.checker = None
400
 
        if os.WIFEXITED(condition):
401
 
            exitstatus = os.WEXITSTATUS(condition)
402
 
            if exitstatus == 0:
403
 
                logger.info(u"Checker for %(name)s succeeded",
404
 
                            vars(self))
405
 
                self.checked_ok()
406
 
            else:
407
 
                logger.info(u"Checker for %(name)s failed",
408
 
                            vars(self))
409
 
        else:
 
318
        if self.use_dbus:
 
319
            # Emit D-Bus signal
 
320
            self.PropertyChanged(dbus.String(u"checker_running"),
 
321
                                 dbus.Boolean(False, variant_level=1))
 
322
        if (os.WIFEXITED(condition)
 
323
            and (os.WEXITSTATUS(condition) == 0)):
 
324
            logger.info(u"Checker for %(name)s succeeded",
 
325
                        vars(self))
 
326
            if self.use_dbus:
 
327
                # Emit D-Bus signal
 
328
                self.CheckerCompleted(dbus.Boolean(True),
 
329
                                      dbus.UInt16(condition),
 
330
                                      dbus.String(command))
 
331
            self.bump_timeout()
 
332
        elif not os.WIFEXITED(condition):
410
333
            logger.warning(u"Checker for %(name)s crashed?",
411
334
                           vars(self))
 
335
            if self.use_dbus:
 
336
                # Emit D-Bus signal
 
337
                self.CheckerCompleted(dbus.Boolean(False),
 
338
                                      dbus.UInt16(condition),
 
339
                                      dbus.String(command))
 
340
        else:
 
341
            logger.info(u"Checker for %(name)s failed",
 
342
                        vars(self))
 
343
            if self.use_dbus:
 
344
                # Emit D-Bus signal
 
345
                self.CheckerCompleted(dbus.Boolean(False),
 
346
                                      dbus.UInt16(condition),
 
347
                                      dbus.String(command))
412
348
    
413
 
    def checked_ok(self):
 
349
    def bump_timeout(self):
414
350
        """Bump up the timeout for this client.
415
 
        
416
351
        This should only be called when the client has been seen,
417
352
        alive and well.
418
353
        """
421
356
        self.disable_initiator_tag = (gobject.timeout_add
422
357
                                      (self.timeout_milliseconds(),
423
358
                                       self.disable))
 
359
        if self.use_dbus:
 
360
            # Emit D-Bus signal
 
361
            self.PropertyChanged(
 
362
                dbus.String(u"last_checked_ok"),
 
363
                (_datetime_to_dbus(self.last_checked_ok,
 
364
                                   variant_level=1)))
424
365
    
425
366
    def start_checker(self):
426
367
        """Start a new checker subprocess if one is not running.
427
 
        
428
368
        If a checker already exists, leave it running and do
429
369
        nothing."""
430
370
        # The reason for not killing a running checker is that if we
433
373
        # client would inevitably timeout, since no checker would get
434
374
        # a chance to run to completion.  If we instead leave running
435
375
        # checkers alone, the checker would have to take more time
436
 
        # than 'timeout' for the client to be disabled, which is as it
437
 
        # should be.
438
 
        
439
 
        # If a checker exists, make sure it is not a zombie
440
 
        try:
441
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
 
        except (AttributeError, OSError), error:
443
 
            if (isinstance(error, OSError)
444
 
                and error.errno != errno.ECHILD):
445
 
                raise error
446
 
        else:
447
 
            if pid:
448
 
                logger.warning(u"Checker was a zombie")
449
 
                gobject.source_remove(self.checker_callback_tag)
450
 
                self.checker_callback(pid, status,
451
 
                                      self.current_checker_command)
452
 
        # Start a new checker if needed
 
376
        # than 'timeout' for the client to be declared invalid, which
 
377
        # is as it should be.
453
378
        if self.checker is None:
454
379
            try:
455
380
                # In case checker_command has exactly one % operator
456
381
                command = self.checker_command % self.host
457
382
            except TypeError:
458
383
                # Escape attributes for the shell
459
 
                escaped_attrs = dict(
460
 
                    (attr,
461
 
                     re.escape(unicode(str(getattr(self, attr, u"")),
462
 
                                       errors=
463
 
                                       u'replace')))
464
 
                    for attr in
465
 
                    self.runtime_expansions)
466
 
 
 
384
                escaped_attrs = dict((key, re.escape(str(val)))
 
385
                                     for key, val in
 
386
                                     vars(self).iteritems())
467
387
                try:
468
388
                    command = self.checker_command % escaped_attrs
469
389
                except TypeError, error:
470
390
                    logger.error(u'Could not format string "%s":'
471
391
                                 u' %s', self.checker_command, error)
472
392
                    return True # Try again later
473
 
            self.current_checker_command = command
474
393
            try:
475
394
                logger.info(u"Starting checker %r for %s",
476
395
                            command, self.name)
480
399
                # always replaced by /dev/null.)
481
400
                self.checker = subprocess.Popen(command,
482
401
                                                close_fds=True,
483
 
                                                shell=True, cwd=u"/")
 
402
                                                shell=True, cwd="/")
 
403
                if self.use_dbus:
 
404
                    # Emit D-Bus signal
 
405
                    self.CheckerStarted(command)
 
406
                    self.PropertyChanged(
 
407
                        dbus.String("checker_running"),
 
408
                        dbus.Boolean(True, variant_level=1))
484
409
                self.checker_callback_tag = (gobject.child_watch_add
485
410
                                             (self.checker.pid,
486
411
                                              self.checker_callback,
487
412
                                              data=command))
488
 
                # The checker may have completed before the gobject
489
 
                # watch was added.  Check for this.
490
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
491
 
                if pid:
492
 
                    gobject.source_remove(self.checker_callback_tag)
493
 
                    self.checker_callback(pid, status, command)
494
413
            except OSError, error:
495
414
                logger.error(u"Failed to start subprocess: %s",
496
415
                             error)
502
421
        if self.checker_callback_tag:
503
422
            gobject.source_remove(self.checker_callback_tag)
504
423
            self.checker_callback_tag = None
505
 
        if getattr(self, u"checker", None) is None:
 
424
        if getattr(self, "checker", None) is None:
506
425
            return
507
426
        logger.debug(u"Stopping checker for %(name)s", vars(self))
508
427
        try:
509
428
            os.kill(self.checker.pid, signal.SIGTERM)
510
 
            #time.sleep(0.5)
 
429
            #os.sleep(0.5)
511
430
            #if self.checker.poll() is None:
512
431
            #    os.kill(self.checker.pid, signal.SIGKILL)
513
432
        except OSError, error:
514
433
            if error.errno != errno.ESRCH: # No such process
515
434
                raise
516
435
        self.checker = None
517
 
 
518
 
def dbus_service_property(dbus_interface, signature=u"v",
519
 
                          access=u"readwrite", byte_arrays=False):
520
 
    """Decorators for marking methods of a DBusObjectWithProperties to
521
 
    become properties on the D-Bus.
522
 
    
523
 
    The decorated method will be called with no arguments by "Get"
524
 
    and with one argument by "Set".
525
 
    
526
 
    The parameters, where they are supported, are the same as
527
 
    dbus.service.method, except there is only "signature", since the
528
 
    type from Get() and the type sent to Set() is the same.
529
 
    """
530
 
    # Encoding deeply encoded byte arrays is not supported yet by the
531
 
    # "Set" method, so we fail early here:
532
 
    if byte_arrays and signature != u"ay":
533
 
        raise ValueError(u"Byte arrays not supported for non-'ay'"
534
 
                         u" signature %r" % signature)
535
 
    def decorator(func):
536
 
        func._dbus_is_property = True
537
 
        func._dbus_interface = dbus_interface
538
 
        func._dbus_signature = signature
539
 
        func._dbus_access = access
540
 
        func._dbus_name = func.__name__
541
 
        if func._dbus_name.endswith(u"_dbus_property"):
542
 
            func._dbus_name = func._dbus_name[:-14]
543
 
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
544
 
        return func
545
 
    return decorator
546
 
 
547
 
 
548
 
class DBusPropertyException(dbus.exceptions.DBusException):
549
 
    """A base class for D-Bus property-related exceptions
550
 
    """
551
 
    def __unicode__(self):
552
 
        return unicode(str(self))
553
 
 
554
 
 
555
 
class DBusPropertyAccessException(DBusPropertyException):
556
 
    """A property's access permissions disallows an operation.
557
 
    """
558
 
    pass
559
 
 
560
 
 
561
 
class DBusPropertyNotFound(DBusPropertyException):
562
 
    """An attempt was made to access a non-existing property.
563
 
    """
564
 
    pass
565
 
 
566
 
 
567
 
class DBusObjectWithProperties(dbus.service.Object):
568
 
    """A D-Bus object with properties.
569
 
 
570
 
    Classes inheriting from this can use the dbus_service_property
571
 
    decorator to expose methods as D-Bus properties.  It exposes the
572
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
573
 
    """
574
 
    
575
 
    @staticmethod
576
 
    def _is_dbus_property(obj):
577
 
        return getattr(obj, u"_dbus_is_property", False)
578
 
    
579
 
    def _get_all_dbus_properties(self):
580
 
        """Returns a generator of (name, attribute) pairs
581
 
        """
582
 
        return ((prop._dbus_name, prop)
583
 
                for name, prop in
584
 
                inspect.getmembers(self, self._is_dbus_property))
585
 
    
586
 
    def _get_dbus_property(self, interface_name, property_name):
587
 
        """Returns a bound method if one exists which is a D-Bus
588
 
        property with the specified name and interface.
589
 
        """
590
 
        for name in (property_name,
591
 
                     property_name + u"_dbus_property"):
592
 
            prop = getattr(self, name, None)
593
 
            if (prop is None
594
 
                or not self._is_dbus_property(prop)
595
 
                or prop._dbus_name != property_name
596
 
                or (interface_name and prop._dbus_interface
597
 
                    and interface_name != prop._dbus_interface)):
598
 
                continue
599
 
            return prop
600
 
        # No such property
601
 
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
602
 
                                   + interface_name + u"."
603
 
                                   + property_name)
604
 
    
605
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
606
 
                         out_signature=u"v")
607
 
    def Get(self, interface_name, property_name):
608
 
        """Standard D-Bus property Get() method, see D-Bus standard.
609
 
        """
610
 
        prop = self._get_dbus_property(interface_name, property_name)
611
 
        if prop._dbus_access == u"write":
612
 
            raise DBusPropertyAccessException(property_name)
613
 
        value = prop()
614
 
        if not hasattr(value, u"variant_level"):
615
 
            return value
616
 
        return type(value)(value, variant_level=value.variant_level+1)
617
 
    
618
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
619
 
    def Set(self, interface_name, property_name, value):
620
 
        """Standard D-Bus property Set() method, see D-Bus standard.
621
 
        """
622
 
        prop = self._get_dbus_property(interface_name, property_name)
623
 
        if prop._dbus_access == u"read":
624
 
            raise DBusPropertyAccessException(property_name)
625
 
        if prop._dbus_get_args_options[u"byte_arrays"]:
626
 
            # The byte_arrays option is not supported yet on
627
 
            # signatures other than "ay".
628
 
            if prop._dbus_signature != u"ay":
629
 
                raise ValueError
630
 
            value = dbus.ByteArray(''.join(unichr(byte)
631
 
                                           for byte in value))
632
 
        prop(value)
633
 
    
634
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
635
 
                         out_signature=u"a{sv}")
636
 
    def GetAll(self, interface_name):
637
 
        """Standard D-Bus property GetAll() method, see D-Bus
638
 
        standard.
639
 
 
640
 
        Note: Will not include properties with access="write".
641
 
        """
642
 
        all = {}
643
 
        for name, prop in self._get_all_dbus_properties():
644
 
            if (interface_name
645
 
                and interface_name != prop._dbus_interface):
646
 
                # Interface non-empty but did not match
647
 
                continue
648
 
            # Ignore write-only properties
649
 
            if prop._dbus_access == u"write":
650
 
                continue
651
 
            value = prop()
652
 
            if not hasattr(value, u"variant_level"):
653
 
                all[name] = value
654
 
                continue
655
 
            all[name] = type(value)(value, variant_level=
656
 
                                    value.variant_level+1)
657
 
        return dbus.Dictionary(all, signature=u"sv")
658
 
    
659
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
660
 
                         out_signature=u"s",
661
 
                         path_keyword='object_path',
662
 
                         connection_keyword='connection')
663
 
    def Introspect(self, object_path, connection):
664
 
        """Standard D-Bus method, overloaded to insert property tags.
665
 
        """
666
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
667
 
                                                   connection)
668
 
        try:
669
 
            document = xml.dom.minidom.parseString(xmlstring)
670
 
            def make_tag(document, name, prop):
671
 
                e = document.createElement(u"property")
672
 
                e.setAttribute(u"name", name)
673
 
                e.setAttribute(u"type", prop._dbus_signature)
674
 
                e.setAttribute(u"access", prop._dbus_access)
675
 
                return e
676
 
            for if_tag in document.getElementsByTagName(u"interface"):
677
 
                for tag in (make_tag(document, name, prop)
678
 
                            for name, prop
679
 
                            in self._get_all_dbus_properties()
680
 
                            if prop._dbus_interface
681
 
                            == if_tag.getAttribute(u"name")):
682
 
                    if_tag.appendChild(tag)
683
 
                # Add the names to the return values for the
684
 
                # "org.freedesktop.DBus.Properties" methods
685
 
                if (if_tag.getAttribute(u"name")
686
 
                    == u"org.freedesktop.DBus.Properties"):
687
 
                    for cn in if_tag.getElementsByTagName(u"method"):
688
 
                        if cn.getAttribute(u"name") == u"Get":
689
 
                            for arg in cn.getElementsByTagName(u"arg"):
690
 
                                if (arg.getAttribute(u"direction")
691
 
                                    == u"out"):
692
 
                                    arg.setAttribute(u"name", u"value")
693
 
                        elif cn.getAttribute(u"name") == u"GetAll":
694
 
                            for arg in cn.getElementsByTagName(u"arg"):
695
 
                                if (arg.getAttribute(u"direction")
696
 
                                    == u"out"):
697
 
                                    arg.setAttribute(u"name", u"props")
698
 
            xmlstring = document.toxml(u"utf-8")
699
 
            document.unlink()
700
 
        except (AttributeError, xml.dom.DOMException,
701
 
                xml.parsers.expat.ExpatError), error:
702
 
            logger.error(u"Failed to override Introspection method",
703
 
                         error)
704
 
        return xmlstring
705
 
 
706
 
 
707
 
class ClientDBus(Client, DBusObjectWithProperties):
708
 
    """A Client class using D-Bus
709
 
    
710
 
    Attributes:
711
 
    dbus_object_path: dbus.ObjectPath
712
 
    bus: dbus.SystemBus()
713
 
    """
714
 
    
715
 
    runtime_expansions = (Client.runtime_expansions
716
 
                          + (u"dbus_object_path",))
717
 
    
718
 
    # dbus.service.Object doesn't use super(), so we can't either.
719
 
    
720
 
    def __init__(self, bus = None, *args, **kwargs):
721
 
        self._approvals_pending = 0
722
 
        self.bus = bus
723
 
        Client.__init__(self, *args, **kwargs)
724
 
        # Only now, when this client is initialized, can it show up on
725
 
        # the D-Bus
726
 
        self.dbus_object_path = (dbus.ObjectPath
727
 
                                 (u"/clients/"
728
 
                                  + self.name.replace(u".", u"_")))
729
 
        DBusObjectWithProperties.__init__(self, self.bus,
730
 
                                          self.dbus_object_path)
731
 
        
732
 
    def _get_approvals_pending(self):
733
 
        return self._approvals_pending
734
 
    def _set_approvals_pending(self, value):
735
 
        old_value = self._approvals_pending
736
 
        self._approvals_pending = value
737
 
        bval = bool(value)
738
 
        if (hasattr(self, "dbus_object_path")
739
 
            and bval is not bool(old_value)):
740
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
741
 
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
742
 
                                 dbus_bool)
743
 
 
744
 
    approvals_pending = property(_get_approvals_pending,
745
 
                                 _set_approvals_pending)
746
 
    del _get_approvals_pending, _set_approvals_pending
747
 
    
748
 
    @staticmethod
749
 
    def _datetime_to_dbus(dt, variant_level=0):
750
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
751
 
        return dbus.String(dt.isoformat(),
752
 
                           variant_level=variant_level)
753
 
    
754
 
    def enable(self):
755
 
        oldstate = getattr(self, u"enabled", False)
756
 
        r = Client.enable(self)
757
 
        if oldstate != self.enabled:
758
 
            # Emit D-Bus signals
759
 
            self.PropertyChanged(dbus.String(u"Enabled"),
760
 
                                 dbus.Boolean(True, variant_level=1))
761
 
            self.PropertyChanged(
762
 
                dbus.String(u"LastEnabled"),
763
 
                self._datetime_to_dbus(self.last_enabled,
764
 
                                       variant_level=1))
765
 
        return r
766
 
    
767
 
    def disable(self, quiet = False):
768
 
        oldstate = getattr(self, u"enabled", False)
769
 
        r = Client.disable(self, quiet=quiet)
770
 
        if not quiet and oldstate != self.enabled:
771
 
            # Emit D-Bus signal
772
 
            self.PropertyChanged(dbus.String(u"Enabled"),
773
 
                                 dbus.Boolean(False, variant_level=1))
774
 
        return r
775
 
    
776
 
    def __del__(self, *args, **kwargs):
777
 
        try:
778
 
            self.remove_from_connection()
779
 
        except LookupError:
780
 
            pass
781
 
        if hasattr(DBusObjectWithProperties, u"__del__"):
782
 
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
783
 
        Client.__del__(self, *args, **kwargs)
784
 
    
785
 
    def checker_callback(self, pid, condition, command,
786
 
                         *args, **kwargs):
787
 
        self.checker_callback_tag = None
788
 
        self.checker = None
789
 
        # Emit D-Bus signal
790
 
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
791
 
                             dbus.Boolean(False, variant_level=1))
792
 
        if os.WIFEXITED(condition):
793
 
            exitstatus = os.WEXITSTATUS(condition)
794
 
            # Emit D-Bus signal
795
 
            self.CheckerCompleted(dbus.Int16(exitstatus),
796
 
                                  dbus.Int64(condition),
797
 
                                  dbus.String(command))
798
 
        else:
799
 
            # Emit D-Bus signal
800
 
            self.CheckerCompleted(dbus.Int16(-1),
801
 
                                  dbus.Int64(condition),
802
 
                                  dbus.String(command))
803
 
        
804
 
        return Client.checker_callback(self, pid, condition, command,
805
 
                                       *args, **kwargs)
806
 
    
807
 
    def checked_ok(self, *args, **kwargs):
808
 
        r = Client.checked_ok(self, *args, **kwargs)
809
 
        # Emit D-Bus signal
810
 
        self.PropertyChanged(
811
 
            dbus.String(u"LastCheckedOK"),
812
 
            (self._datetime_to_dbus(self.last_checked_ok,
813
 
                                    variant_level=1)))
814
 
        return r
815
 
    
816
 
    def start_checker(self, *args, **kwargs):
817
 
        old_checker = self.checker
818
 
        if self.checker is not None:
819
 
            old_checker_pid = self.checker.pid
820
 
        else:
821
 
            old_checker_pid = None
822
 
        r = Client.start_checker(self, *args, **kwargs)
823
 
        # Only if new checker process was started
824
 
        if (self.checker is not None
825
 
            and old_checker_pid != self.checker.pid):
826
 
            # Emit D-Bus signal
827
 
            self.CheckerStarted(self.current_checker_command)
828
 
            self.PropertyChanged(
829
 
                dbus.String(u"CheckerRunning"),
830
 
                dbus.Boolean(True, variant_level=1))
831
 
        return r
832
 
    
833
 
    def stop_checker(self, *args, **kwargs):
834
 
        old_checker = getattr(self, u"checker", None)
835
 
        r = Client.stop_checker(self, *args, **kwargs)
836
 
        if (old_checker is not None
837
 
            and getattr(self, u"checker", None) is None):
838
 
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
839
 
                                 dbus.Boolean(False, variant_level=1))
840
 
        return r
841
 
 
842
 
    def _reset_approved(self):
843
 
        self._approved = None
844
 
        return False
845
 
    
846
 
    def approve(self, value=True):
847
 
        self.send_changedstate()
848
 
        self._approved = value
849
 
        gobject.timeout_add(self._timedelta_to_milliseconds
850
 
                            (self.approval_duration),
851
 
                            self._reset_approved)
852
 
    
853
 
    
854
 
    ## D-Bus methods, signals & properties
855
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
856
 
    
857
 
    ## Signals
 
436
        if self.use_dbus:
 
437
            self.PropertyChanged(dbus.String(u"checker_running"),
 
438
                                 dbus.Boolean(False, variant_level=1))
 
439
    
 
440
    def still_valid(self):
 
441
        """Has the timeout not yet passed for this client?"""
 
442
        if not getattr(self, "enabled", False):
 
443
            return False
 
444
        now = datetime.datetime.utcnow()
 
445
        if self.last_checked_ok is None:
 
446
            return now < (self.created + self.timeout)
 
447
        else:
 
448
            return now < (self.last_checked_ok + self.timeout)
 
449
    
 
450
    ## D-Bus methods & signals
 
451
    _interface = u"org.mandos_system.Mandos.Client"
 
452
    
 
453
    # BumpTimeout - method
 
454
    BumpTimeout = dbus.service.method(_interface)(bump_timeout)
 
455
    BumpTimeout.__name__ = "BumpTimeout"
858
456
    
859
457
    # CheckerCompleted - signal
860
 
    @dbus.service.signal(_interface, signature=u"nxs")
861
 
    def CheckerCompleted(self, exitcode, waitstatus, command):
 
458
    @dbus.service.signal(_interface, signature="bqs")
 
459
    def CheckerCompleted(self, success, condition, command):
862
460
        "D-Bus signal"
863
461
        pass
864
462
    
865
463
    # CheckerStarted - signal
866
 
    @dbus.service.signal(_interface, signature=u"s")
 
464
    @dbus.service.signal(_interface, signature="s")
867
465
    def CheckerStarted(self, command):
868
466
        "D-Bus signal"
869
467
        pass
870
468
    
 
469
    # GetAllProperties - method
 
470
    @dbus.service.method(_interface, out_signature="a{sv}")
 
471
    def GetAllProperties(self):
 
472
        "D-Bus method"
 
473
        return dbus.Dictionary({
 
474
                dbus.String("name"):
 
475
                    dbus.String(self.name, variant_level=1),
 
476
                dbus.String("fingerprint"):
 
477
                    dbus.String(self.fingerprint, variant_level=1),
 
478
                dbus.String("host"):
 
479
                    dbus.String(self.host, variant_level=1),
 
480
                dbus.String("created"):
 
481
                    _datetime_to_dbus(self.created, variant_level=1),
 
482
                dbus.String("last_enabled"):
 
483
                    (_datetime_to_dbus(self.last_enabled,
 
484
                                       variant_level=1)
 
485
                     if self.last_enabled is not None
 
486
                     else dbus.Boolean(False, variant_level=1)),
 
487
                dbus.String("enabled"):
 
488
                    dbus.Boolean(self.enabled, variant_level=1),
 
489
                dbus.String("last_checked_ok"):
 
490
                    (_datetime_to_dbus(self.last_checked_ok,
 
491
                                       variant_level=1)
 
492
                     if self.last_checked_ok is not None
 
493
                     else dbus.Boolean (False, variant_level=1)),
 
494
                dbus.String("timeout"):
 
495
                    dbus.UInt64(self.timeout_milliseconds(),
 
496
                                variant_level=1),
 
497
                dbus.String("interval"):
 
498
                    dbus.UInt64(self.interval_milliseconds(),
 
499
                                variant_level=1),
 
500
                dbus.String("checker"):
 
501
                    dbus.String(self.checker_command,
 
502
                                variant_level=1),
 
503
                dbus.String("checker_running"):
 
504
                    dbus.Boolean(self.checker is not None,
 
505
                                 variant_level=1),
 
506
                }, signature="sv")
 
507
    
 
508
    # IsStillValid - method
 
509
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
 
510
                    (still_valid))
 
511
    IsStillValid.__name__ = "IsStillValid"
 
512
    
871
513
    # PropertyChanged - signal
872
 
    @dbus.service.signal(_interface, signature=u"sv")
 
514
    @dbus.service.signal(_interface, signature="sv")
873
515
    def PropertyChanged(self, property, value):
874
516
        "D-Bus signal"
875
517
        pass
876
518
    
877
 
    # GotSecret - signal
878
 
    @dbus.service.signal(_interface)
879
 
    def GotSecret(self):
880
 
        """D-Bus signal
881
 
        Is sent after a successful transfer of secret from the Mandos
882
 
        server to mandos-client
883
 
        """
884
 
        pass
885
 
    
886
 
    # Rejected - signal
887
 
    @dbus.service.signal(_interface, signature=u"s")
888
 
    def Rejected(self, reason):
889
 
        "D-Bus signal"
890
 
        pass
891
 
    
892
 
    # NeedApproval - signal
893
 
    @dbus.service.signal(_interface, signature=u"tb")
894
 
    def NeedApproval(self, timeout, default):
895
 
        "D-Bus signal"
896
 
        pass
897
 
    
898
 
    ## Methods
899
 
 
900
 
    # Approve - method
901
 
    @dbus.service.method(_interface, in_signature=u"b")
902
 
    def Approve(self, value):
903
 
        self.approve(value)
904
 
 
905
 
    # CheckedOK - method
906
 
    @dbus.service.method(_interface)
907
 
    def CheckedOK(self):
908
 
        return self.checked_ok()
 
519
    # SetChecker - method
 
520
    @dbus.service.method(_interface, in_signature="s")
 
521
    def SetChecker(self, checker):
 
522
        "D-Bus setter method"
 
523
        self.checker_command = checker
 
524
        # Emit D-Bus signal
 
525
        self.PropertyChanged(dbus.String(u"checker"),
 
526
                             dbus.String(self.checker_command,
 
527
                                         variant_level=1))
 
528
    
 
529
    # SetHost - method
 
530
    @dbus.service.method(_interface, in_signature="s")
 
531
    def SetHost(self, host):
 
532
        "D-Bus setter method"
 
533
        self.host = host
 
534
        # Emit D-Bus signal
 
535
        self.PropertyChanged(dbus.String(u"host"),
 
536
                             dbus.String(self.host, variant_level=1))
 
537
    
 
538
    # SetInterval - method
 
539
    @dbus.service.method(_interface, in_signature="t")
 
540
    def SetInterval(self, milliseconds):
 
541
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
 
542
        # Emit D-Bus signal
 
543
        self.PropertyChanged(dbus.String(u"interval"),
 
544
                             (dbus.UInt64(self.interval_milliseconds(),
 
545
                                          variant_level=1)))
 
546
    
 
547
    # SetSecret - method
 
548
    @dbus.service.method(_interface, in_signature="ay",
 
549
                         byte_arrays=True)
 
550
    def SetSecret(self, secret):
 
551
        "D-Bus setter method"
 
552
        self.secret = str(secret)
 
553
    
 
554
    # SetTimeout - method
 
555
    @dbus.service.method(_interface, in_signature="t")
 
556
    def SetTimeout(self, milliseconds):
 
557
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
 
558
        # Emit D-Bus signal
 
559
        self.PropertyChanged(dbus.String(u"timeout"),
 
560
                             (dbus.UInt64(self.timeout_milliseconds(),
 
561
                                          variant_level=1)))
909
562
    
910
563
    # Enable - method
911
 
    @dbus.service.method(_interface)
912
 
    def Enable(self):
913
 
        "D-Bus method"
914
 
        self.enable()
 
564
    Enable = dbus.service.method(_interface)(enable)
 
565
    Enable.__name__ = "Enable"
915
566
    
916
567
    # StartChecker - method
917
568
    @dbus.service.method(_interface)
926
577
        self.disable()
927
578
    
928
579
    # StopChecker - method
929
 
    @dbus.service.method(_interface)
930
 
    def StopChecker(self):
931
 
        self.stop_checker()
932
 
    
933
 
    ## Properties
934
 
    
935
 
    # ApprovalPending - property
936
 
    @dbus_service_property(_interface, signature=u"b", access=u"read")
937
 
    def ApprovalPending_dbus_property(self):
938
 
        return dbus.Boolean(bool(self.approvals_pending))
939
 
    
940
 
    # ApprovedByDefault - property
941
 
    @dbus_service_property(_interface, signature=u"b",
942
 
                           access=u"readwrite")
943
 
    def ApprovedByDefault_dbus_property(self, value=None):
944
 
        if value is None:       # get
945
 
            return dbus.Boolean(self.approved_by_default)
946
 
        self.approved_by_default = bool(value)
947
 
        # Emit D-Bus signal
948
 
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
949
 
                             dbus.Boolean(value, variant_level=1))
950
 
    
951
 
    # ApprovalDelay - property
952
 
    @dbus_service_property(_interface, signature=u"t",
953
 
                           access=u"readwrite")
954
 
    def ApprovalDelay_dbus_property(self, value=None):
955
 
        if value is None:       # get
956
 
            return dbus.UInt64(self.approval_delay_milliseconds())
957
 
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
958
 
        # Emit D-Bus signal
959
 
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
960
 
                             dbus.UInt64(value, variant_level=1))
961
 
    
962
 
    # ApprovalDuration - property
963
 
    @dbus_service_property(_interface, signature=u"t",
964
 
                           access=u"readwrite")
965
 
    def ApprovalDuration_dbus_property(self, value=None):
966
 
        if value is None:       # get
967
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
968
 
                    self.approval_duration))
969
 
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
970
 
        # Emit D-Bus signal
971
 
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
972
 
                             dbus.UInt64(value, variant_level=1))
973
 
    
974
 
    # Name - property
975
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
976
 
    def Name_dbus_property(self):
977
 
        return dbus.String(self.name)
978
 
    
979
 
    # Fingerprint - property
980
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
981
 
    def Fingerprint_dbus_property(self):
982
 
        return dbus.String(self.fingerprint)
983
 
    
984
 
    # Host - property
985
 
    @dbus_service_property(_interface, signature=u"s",
986
 
                           access=u"readwrite")
987
 
    def Host_dbus_property(self, value=None):
988
 
        if value is None:       # get
989
 
            return dbus.String(self.host)
990
 
        self.host = value
991
 
        # Emit D-Bus signal
992
 
        self.PropertyChanged(dbus.String(u"Host"),
993
 
                             dbus.String(value, variant_level=1))
994
 
    
995
 
    # Created - property
996
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
997
 
    def Created_dbus_property(self):
998
 
        return dbus.String(self._datetime_to_dbus(self.created))
999
 
    
1000
 
    # LastEnabled - property
1001
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1002
 
    def LastEnabled_dbus_property(self):
1003
 
        if self.last_enabled is None:
1004
 
            return dbus.String(u"")
1005
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1006
 
    
1007
 
    # Enabled - property
1008
 
    @dbus_service_property(_interface, signature=u"b",
1009
 
                           access=u"readwrite")
1010
 
    def Enabled_dbus_property(self, value=None):
1011
 
        if value is None:       # get
1012
 
            return dbus.Boolean(self.enabled)
1013
 
        if value:
1014
 
            self.enable()
1015
 
        else:
1016
 
            self.disable()
1017
 
    
1018
 
    # LastCheckedOK - property
1019
 
    @dbus_service_property(_interface, signature=u"s",
1020
 
                           access=u"readwrite")
1021
 
    def LastCheckedOK_dbus_property(self, value=None):
1022
 
        if value is not None:
1023
 
            self.checked_ok()
1024
 
            return
1025
 
        if self.last_checked_ok is None:
1026
 
            return dbus.String(u"")
1027
 
        return dbus.String(self._datetime_to_dbus(self
1028
 
                                                  .last_checked_ok))
1029
 
    
1030
 
    # Timeout - property
1031
 
    @dbus_service_property(_interface, signature=u"t",
1032
 
                           access=u"readwrite")
1033
 
    def Timeout_dbus_property(self, value=None):
1034
 
        if value is None:       # get
1035
 
            return dbus.UInt64(self.timeout_milliseconds())
1036
 
        self.timeout = datetime.timedelta(0, 0, 0, value)
1037
 
        # Emit D-Bus signal
1038
 
        self.PropertyChanged(dbus.String(u"Timeout"),
1039
 
                             dbus.UInt64(value, variant_level=1))
1040
 
        if getattr(self, u"disable_initiator_tag", None) is None:
1041
 
            return
1042
 
        # Reschedule timeout
1043
 
        gobject.source_remove(self.disable_initiator_tag)
1044
 
        self.disable_initiator_tag = None
1045
 
        time_to_die = (self.
1046
 
                       _timedelta_to_milliseconds((self
1047
 
                                                   .last_checked_ok
1048
 
                                                   + self.timeout)
1049
 
                                                  - datetime.datetime
1050
 
                                                  .utcnow()))
1051
 
        if time_to_die <= 0:
1052
 
            # The timeout has passed
1053
 
            self.disable()
1054
 
        else:
1055
 
            self.disable_initiator_tag = (gobject.timeout_add
1056
 
                                          (time_to_die, self.disable))
1057
 
    
1058
 
    # Interval - property
1059
 
    @dbus_service_property(_interface, signature=u"t",
1060
 
                           access=u"readwrite")
1061
 
    def Interval_dbus_property(self, value=None):
1062
 
        if value is None:       # get
1063
 
            return dbus.UInt64(self.interval_milliseconds())
1064
 
        self.interval = datetime.timedelta(0, 0, 0, value)
1065
 
        # Emit D-Bus signal
1066
 
        self.PropertyChanged(dbus.String(u"Interval"),
1067
 
                             dbus.UInt64(value, variant_level=1))
1068
 
        if getattr(self, u"checker_initiator_tag", None) is None:
1069
 
            return
1070
 
        # Reschedule checker run
1071
 
        gobject.source_remove(self.checker_initiator_tag)
1072
 
        self.checker_initiator_tag = (gobject.timeout_add
1073
 
                                      (value, self.start_checker))
1074
 
        self.start_checker()    # Start one now, too
1075
 
 
1076
 
    # Checker - property
1077
 
    @dbus_service_property(_interface, signature=u"s",
1078
 
                           access=u"readwrite")
1079
 
    def Checker_dbus_property(self, value=None):
1080
 
        if value is None:       # get
1081
 
            return dbus.String(self.checker_command)
1082
 
        self.checker_command = value
1083
 
        # Emit D-Bus signal
1084
 
        self.PropertyChanged(dbus.String(u"Checker"),
1085
 
                             dbus.String(self.checker_command,
1086
 
                                         variant_level=1))
1087
 
    
1088
 
    # CheckerRunning - property
1089
 
    @dbus_service_property(_interface, signature=u"b",
1090
 
                           access=u"readwrite")
1091
 
    def CheckerRunning_dbus_property(self, value=None):
1092
 
        if value is None:       # get
1093
 
            return dbus.Boolean(self.checker is not None)
1094
 
        if value:
1095
 
            self.start_checker()
1096
 
        else:
1097
 
            self.stop_checker()
1098
 
    
1099
 
    # ObjectPath - property
1100
 
    @dbus_service_property(_interface, signature=u"o", access=u"read")
1101
 
    def ObjectPath_dbus_property(self):
1102
 
        return self.dbus_object_path # is already a dbus.ObjectPath
1103
 
    
1104
 
    # Secret = property
1105
 
    @dbus_service_property(_interface, signature=u"ay",
1106
 
                           access=u"write", byte_arrays=True)
1107
 
    def Secret_dbus_property(self, value):
1108
 
        self.secret = str(value)
 
580
    StopChecker = dbus.service.method(_interface)(stop_checker)
 
581
    StopChecker.__name__ = "StopChecker"
1109
582
    
1110
583
    del _interface
1111
584
 
1112
585
 
1113
 
class ProxyClient(object):
1114
 
    def __init__(self, child_pipe, fpr, address):
1115
 
        self._pipe = child_pipe
1116
 
        self._pipe.send(('init', fpr, address))
1117
 
        if not self._pipe.recv():
1118
 
            raise KeyError()
1119
 
 
1120
 
    def __getattribute__(self, name):
1121
 
        if(name == '_pipe'):
1122
 
            return super(ProxyClient, self).__getattribute__(name)
1123
 
        self._pipe.send(('getattr', name))
1124
 
        data = self._pipe.recv()
1125
 
        if data[0] == 'data':
1126
 
            return data[1]
1127
 
        if data[0] == 'function':
1128
 
            def func(*args, **kwargs):
1129
 
                self._pipe.send(('funcall', name, args, kwargs))
1130
 
                return self._pipe.recv()[1]
1131
 
            return func
1132
 
 
1133
 
    def __setattr__(self, name, value):
1134
 
        if(name == '_pipe'):
1135
 
            return super(ProxyClient, self).__setattr__(name, value)
1136
 
        self._pipe.send(('setattr', name, value))
1137
 
 
1138
 
 
1139
 
class ClientHandler(socketserver.BaseRequestHandler, object):
1140
 
    """A class to handle client connections.
1141
 
    
1142
 
    Instantiated once for each connection to handle it.
 
586
def peer_certificate(session):
 
587
    "Return the peer's OpenPGP certificate as a bytestring"
 
588
    # If not an OpenPGP certificate...
 
589
    if (gnutls.library.functions
 
590
        .gnutls_certificate_type_get(session._c_object)
 
591
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
592
        # ...do the normal thing
 
593
        return session.peer_certificate
 
594
    list_size = ctypes.c_uint()
 
595
    cert_list = (gnutls.library.functions
 
596
                 .gnutls_certificate_get_peers
 
597
                 (session._c_object, ctypes.byref(list_size)))
 
598
    if list_size.value == 0:
 
599
        return None
 
600
    cert = cert_list[0]
 
601
    return ctypes.string_at(cert.data, cert.size)
 
602
 
 
603
 
 
604
def fingerprint(openpgp):
 
605
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
 
606
    # New GnuTLS "datum" with the OpenPGP public key
 
607
    datum = (gnutls.library.types
 
608
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
609
                                         ctypes.POINTER
 
610
                                         (ctypes.c_ubyte)),
 
611
                             ctypes.c_uint(len(openpgp))))
 
612
    # New empty GnuTLS certificate
 
613
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
614
    (gnutls.library.functions
 
615
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
616
    # Import the OpenPGP public key into the certificate
 
617
    (gnutls.library.functions
 
618
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
619
                                gnutls.library.constants
 
620
                                .GNUTLS_OPENPGP_FMT_RAW))
 
621
    # Verify the self signature in the key
 
622
    crtverify = ctypes.c_uint()
 
623
    (gnutls.library.functions
 
624
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
 
625
    if crtverify.value != 0:
 
626
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
627
        raise gnutls.errors.CertificateSecurityError("Verify failed")
 
628
    # New buffer for the fingerprint
 
629
    buf = ctypes.create_string_buffer(20)
 
630
    buf_len = ctypes.c_size_t()
 
631
    # Get the fingerprint from the certificate into the buffer
 
632
    (gnutls.library.functions
 
633
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
634
                                         ctypes.byref(buf_len)))
 
635
    # Deinit the certificate
 
636
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
637
    # Convert the buffer to a Python bytestring
 
638
    fpr = ctypes.string_at(buf, buf_len.value)
 
639
    # Convert the bytestring to hexadecimal notation
 
640
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
641
    return hex_fpr
 
642
 
 
643
 
 
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
 
645
    """A TCP request handler class.
 
646
    Instantiated by IPv6_TCPServer for each request to handle it.
1143
647
    Note: This will run in its own forked process."""
1144
648
    
1145
649
    def handle(self):
1146
 
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1147
 
            logger.info(u"TCP connection from: %s",
1148
 
                        unicode(self.client_address))
1149
 
            logger.debug(u"Pipe FD: %d",
1150
 
                         self.server.child_pipe.fileno())
1151
 
 
1152
 
            session = (gnutls.connection
1153
 
                       .ClientSession(self.request,
1154
 
                                      gnutls.connection
1155
 
                                      .X509Credentials()))
1156
 
 
1157
 
            # Note: gnutls.connection.X509Credentials is really a
1158
 
            # generic GnuTLS certificate credentials object so long as
1159
 
            # no X.509 keys are added to it.  Therefore, we can use it
1160
 
            # here despite using OpenPGP certificates.
1161
 
 
1162
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1163
 
            #                      u"+AES-256-CBC", u"+SHA1",
1164
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1165
 
            #                      u"+DHE-DSS"))
1166
 
            # Use a fallback default, since this MUST be set.
1167
 
            priority = self.server.gnutls_priority
1168
 
            if priority is None:
1169
 
                priority = u"NORMAL"
1170
 
            (gnutls.library.functions
1171
 
             .gnutls_priority_set_direct(session._c_object,
1172
 
                                         priority, None))
1173
 
 
1174
 
            # Start communication using the Mandos protocol
1175
 
            # Get protocol number
1176
 
            line = self.request.makefile().readline()
1177
 
            logger.debug(u"Protocol version: %r", line)
1178
 
            try:
1179
 
                if int(line.strip().split()[0]) > 1:
1180
 
                    raise RuntimeError
1181
 
            except (ValueError, IndexError, RuntimeError), error:
1182
 
                logger.error(u"Unknown protocol version: %s", error)
1183
 
                return
1184
 
 
1185
 
            # Start GnuTLS connection
1186
 
            try:
1187
 
                session.handshake()
1188
 
            except gnutls.errors.GNUTLSError, error:
1189
 
                logger.warning(u"Handshake failed: %s", error)
1190
 
                # Do not run session.bye() here: the session is not
1191
 
                # established.  Just abandon the request.
1192
 
                return
1193
 
            logger.debug(u"Handshake succeeded")
1194
 
 
1195
 
            approval_required = False
1196
 
            try:
1197
 
                try:
1198
 
                    fpr = self.fingerprint(self.peer_certificate
1199
 
                                           (session))
1200
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
1201
 
                    logger.warning(u"Bad certificate: %s", error)
1202
 
                    return
1203
 
                logger.debug(u"Fingerprint: %s", fpr)
1204
 
 
1205
 
                try:
1206
 
                    client = ProxyClient(child_pipe, fpr,
1207
 
                                         self.client_address)
1208
 
                except KeyError:
1209
 
                    return
1210
 
                
1211
 
                if client.approval_delay:
1212
 
                    delay = client.approval_delay
1213
 
                    client.approvals_pending += 1
1214
 
                    approval_required = True
1215
 
                
1216
 
                while True:
1217
 
                    if not client.enabled:
1218
 
                        logger.warning(u"Client %s is disabled",
1219
 
                                       client.name)
1220
 
                        if self.server.use_dbus:
1221
 
                            # Emit D-Bus signal
1222
 
                            client.Rejected("Disabled")                    
1223
 
                        return
1224
 
                    
1225
 
                    if client._approved or not client.approval_delay:
1226
 
                        #We are approved or approval is disabled
1227
 
                        break
1228
 
                    elif client._approved is None:
1229
 
                        logger.info(u"Client %s needs approval",
1230
 
                                    client.name)
1231
 
                        if self.server.use_dbus:
1232
 
                            # Emit D-Bus signal
1233
 
                            client.NeedApproval(
1234
 
                                client.approval_delay_milliseconds(),
1235
 
                                client.approved_by_default)
1236
 
                    else:
1237
 
                        logger.warning(u"Client %s was not approved",
1238
 
                                       client.name)
1239
 
                        if self.server.use_dbus:
1240
 
                            # Emit D-Bus signal
1241
 
                            client.Rejected("Denied")
1242
 
                        return
1243
 
                    
1244
 
                    #wait until timeout or approved
1245
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1246
 
                    time = datetime.datetime.now()
1247
 
                    client.changedstate.acquire()
1248
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1249
 
                    client.changedstate.release()
1250
 
                    time2 = datetime.datetime.now()
1251
 
                    if (time2 - time) >= delay:
1252
 
                        if not client.approved_by_default:
1253
 
                            logger.warning("Client %s timed out while"
1254
 
                                           " waiting for approval",
1255
 
                                           client.name)
1256
 
                            if self.server.use_dbus:
1257
 
                                # Emit D-Bus signal
1258
 
                                client.Rejected("Approval timed out")
1259
 
                            return
1260
 
                        else:
1261
 
                            break
1262
 
                    else:
1263
 
                        delay -= time2 - time
1264
 
                
1265
 
                sent_size = 0
1266
 
                while sent_size < len(client.secret):
1267
 
                    try:
1268
 
                        sent = session.send(client.secret[sent_size:])
1269
 
                    except (gnutls.errors.GNUTLSError), error:
1270
 
                        logger.warning("gnutls send failed")
1271
 
                        return
1272
 
                    logger.debug(u"Sent: %d, remaining: %d",
1273
 
                                 sent, len(client.secret)
1274
 
                                 - (sent_size + sent))
1275
 
                    sent_size += sent
1276
 
 
1277
 
                logger.info(u"Sending secret to %s", client.name)
1278
 
                # bump the timeout as if seen
1279
 
                client.checked_ok()
1280
 
                if self.server.use_dbus:
1281
 
                    # Emit D-Bus signal
1282
 
                    client.GotSecret()
1283
 
            
1284
 
            finally:
1285
 
                if approval_required:
1286
 
                    client.approvals_pending -= 1
1287
 
                try:
1288
 
                    session.bye()
1289
 
                except (gnutls.errors.GNUTLSError), error:
1290
 
                    logger.warning("GnuTLS bye failed")
1291
 
    
1292
 
    @staticmethod
1293
 
    def peer_certificate(session):
1294
 
        "Return the peer's OpenPGP certificate as a bytestring"
1295
 
        # If not an OpenPGP certificate...
1296
 
        if (gnutls.library.functions
1297
 
            .gnutls_certificate_type_get(session._c_object)
1298
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1299
 
            # ...do the normal thing
1300
 
            return session.peer_certificate
1301
 
        list_size = ctypes.c_uint(1)
1302
 
        cert_list = (gnutls.library.functions
1303
 
                     .gnutls_certificate_get_peers
1304
 
                     (session._c_object, ctypes.byref(list_size)))
1305
 
        if not bool(cert_list) and list_size.value != 0:
1306
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
1307
 
                                            u" certificate")
1308
 
        if list_size.value == 0:
1309
 
            return None
1310
 
        cert = cert_list[0]
1311
 
        return ctypes.string_at(cert.data, cert.size)
1312
 
    
1313
 
    @staticmethod
1314
 
    def fingerprint(openpgp):
1315
 
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1316
 
        # New GnuTLS "datum" with the OpenPGP public key
1317
 
        datum = (gnutls.library.types
1318
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1319
 
                                             ctypes.POINTER
1320
 
                                             (ctypes.c_ubyte)),
1321
 
                                 ctypes.c_uint(len(openpgp))))
1322
 
        # New empty GnuTLS certificate
1323
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1324
 
        (gnutls.library.functions
1325
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1326
 
        # Import the OpenPGP public key into the certificate
1327
 
        (gnutls.library.functions
1328
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1329
 
                                    gnutls.library.constants
1330
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
1331
 
        # Verify the self signature in the key
1332
 
        crtverify = ctypes.c_uint()
1333
 
        (gnutls.library.functions
1334
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1335
 
                                         ctypes.byref(crtverify)))
1336
 
        if crtverify.value != 0:
1337
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1338
 
            raise (gnutls.errors.CertificateSecurityError
1339
 
                   (u"Verify failed"))
1340
 
        # New buffer for the fingerprint
1341
 
        buf = ctypes.create_string_buffer(20)
1342
 
        buf_len = ctypes.c_size_t()
1343
 
        # Get the fingerprint from the certificate into the buffer
1344
 
        (gnutls.library.functions
1345
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1346
 
                                             ctypes.byref(buf_len)))
1347
 
        # Deinit the certificate
1348
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1349
 
        # Convert the buffer to a Python bytestring
1350
 
        fpr = ctypes.string_at(buf, buf_len.value)
1351
 
        # Convert the bytestring to hexadecimal notation
1352
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1353
 
        return hex_fpr
1354
 
 
1355
 
 
1356
 
class MultiprocessingMixIn(object):
1357
 
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1358
 
    def sub_process_main(self, request, address):
1359
 
        try:
1360
 
            self.finish_request(request, address)
1361
 
        except:
1362
 
            self.handle_error(request, address)
1363
 
        self.close_request(request)
1364
 
            
1365
 
    def process_request(self, request, address):
1366
 
        """Start a new process to process the request."""
1367
 
        multiprocessing.Process(target = self.sub_process_main,
1368
 
                                args = (request, address)).start()
1369
 
 
1370
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1371
 
    """ adds a pipe to the MixIn """
1372
 
    def process_request(self, request, client_address):
1373
 
        """Overrides and wraps the original process_request().
1374
 
        
1375
 
        This function creates a new pipe in self.pipe
1376
 
        """
1377
 
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1378
 
 
1379
 
        super(MultiprocessingMixInWithPipe,
1380
 
              self).process_request(request, client_address)
1381
 
        self.child_pipe.close()
1382
 
        self.add_pipe(parent_pipe)
1383
 
 
1384
 
    def add_pipe(self, parent_pipe):
1385
 
        """Dummy function; override as necessary"""
1386
 
        pass
1387
 
 
1388
 
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1389
 
                     socketserver.TCPServer, object):
1390
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1391
 
    
 
650
        logger.info(u"TCP connection from: %s",
 
651
                    unicode(self.client_address))
 
652
        session = (gnutls.connection
 
653
                   .ClientSession(self.request,
 
654
                                  gnutls.connection
 
655
                                  .X509Credentials()))
 
656
        
 
657
        line = self.request.makefile().readline()
 
658
        logger.debug(u"Protocol version: %r", line)
 
659
        try:
 
660
            if int(line.strip().split()[0]) > 1:
 
661
                raise RuntimeError
 
662
        except (ValueError, IndexError, RuntimeError), error:
 
663
            logger.error(u"Unknown protocol version: %s", error)
 
664
            return
 
665
        
 
666
        # Note: gnutls.connection.X509Credentials is really a generic
 
667
        # GnuTLS certificate credentials object so long as no X.509
 
668
        # keys are added to it.  Therefore, we can use it here despite
 
669
        # using OpenPGP certificates.
 
670
        
 
671
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
 
672
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
 
673
        #                "+DHE-DSS"))
 
674
        # Use a fallback default, since this MUST be set.
 
675
        priority = self.server.settings.get("priority", "NORMAL")
 
676
        (gnutls.library.functions
 
677
         .gnutls_priority_set_direct(session._c_object,
 
678
                                     priority, None))
 
679
        
 
680
        try:
 
681
            session.handshake()
 
682
        except gnutls.errors.GNUTLSError, error:
 
683
            logger.warning(u"Handshake failed: %s", error)
 
684
            # Do not run session.bye() here: the session is not
 
685
            # established.  Just abandon the request.
 
686
            return
 
687
        try:
 
688
            fpr = fingerprint(peer_certificate(session))
 
689
        except (TypeError, gnutls.errors.GNUTLSError), error:
 
690
            logger.warning(u"Bad certificate: %s", error)
 
691
            session.bye()
 
692
            return
 
693
        logger.debug(u"Fingerprint: %s", fpr)
 
694
        for c in self.server.clients:
 
695
            if c.fingerprint == fpr:
 
696
                client = c
 
697
                break
 
698
        else:
 
699
            logger.warning(u"Client not found for fingerprint: %s",
 
700
                           fpr)
 
701
            session.bye()
 
702
            return
 
703
        # Have to check if client.still_valid(), since it is possible
 
704
        # that the client timed out while establishing the GnuTLS
 
705
        # session.
 
706
        if not client.still_valid():
 
707
            logger.warning(u"Client %(name)s is invalid",
 
708
                           vars(client))
 
709
            session.bye()
 
710
            return
 
711
        ## This won't work here, since we're in a fork.
 
712
        # client.bump_timeout()
 
713
        sent_size = 0
 
714
        while sent_size < len(client.secret):
 
715
            sent = session.send(client.secret[sent_size:])
 
716
            logger.debug(u"Sent: %d, remaining: %d",
 
717
                         sent, len(client.secret)
 
718
                         - (sent_size + sent))
 
719
            sent_size += sent
 
720
        session.bye()
 
721
 
 
722
 
 
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
 
724
                     SocketServer.TCPServer, object):
 
725
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
1392
726
    Attributes:
 
727
        settings:       Server settings
 
728
        clients:        Set() of Client objects
1393
729
        enabled:        Boolean; whether this server is activated yet
1394
 
        interface:      None or a network interface name (string)
1395
 
        use_ipv6:       Boolean; to use IPv6 or not
1396
730
    """
1397
 
    def __init__(self, server_address, RequestHandlerClass,
1398
 
                 interface=None, use_ipv6=True):
1399
 
        self.interface = interface
1400
 
        if use_ipv6:
1401
 
            self.address_family = socket.AF_INET6
1402
 
        socketserver.TCPServer.__init__(self, server_address,
1403
 
                                        RequestHandlerClass)
 
731
    address_family = socket.AF_INET6
 
732
    def __init__(self, *args, **kwargs):
 
733
        if "settings" in kwargs:
 
734
            self.settings = kwargs["settings"]
 
735
            del kwargs["settings"]
 
736
        if "clients" in kwargs:
 
737
            self.clients = kwargs["clients"]
 
738
            del kwargs["clients"]
 
739
        self.enabled = False
 
740
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1404
741
    def server_bind(self):
1405
742
        """This overrides the normal server_bind() function
1406
743
        to bind to an interface if one was specified, and also NOT to
1407
744
        bind to an address or port if they were not specified."""
1408
 
        if self.interface is not None:
1409
 
            if SO_BINDTODEVICE is None:
1410
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
1411
 
                             u" cannot bind to interface %s",
1412
 
                             self.interface)
1413
 
            else:
1414
 
                try:
1415
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1416
 
                                           SO_BINDTODEVICE,
1417
 
                                           str(self.interface
1418
 
                                               + u'\0'))
1419
 
                except socket.error, error:
1420
 
                    if error[0] == errno.EPERM:
1421
 
                        logger.error(u"No permission to"
1422
 
                                     u" bind to interface %s",
1423
 
                                     self.interface)
1424
 
                    elif error[0] == errno.ENOPROTOOPT:
1425
 
                        logger.error(u"SO_BINDTODEVICE not available;"
1426
 
                                     u" cannot bind to interface %s",
1427
 
                                     self.interface)
1428
 
                    else:
1429
 
                        raise
 
745
        if self.settings["interface"]:
 
746
            # 25 is from /usr/include/asm-i486/socket.h
 
747
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
 
748
            try:
 
749
                self.socket.setsockopt(socket.SOL_SOCKET,
 
750
                                       SO_BINDTODEVICE,
 
751
                                       self.settings["interface"])
 
752
            except socket.error, error:
 
753
                if error[0] == errno.EPERM:
 
754
                    logger.error(u"No permission to"
 
755
                                 u" bind to interface %s",
 
756
                                 self.settings["interface"])
 
757
                else:
 
758
                    raise error
1430
759
        # Only bind(2) the socket if we really need to.
1431
760
        if self.server_address[0] or self.server_address[1]:
1432
761
            if not self.server_address[0]:
1433
 
                if self.address_family == socket.AF_INET6:
1434
 
                    any_address = u"::" # in6addr_any
1435
 
                else:
1436
 
                    any_address = socket.INADDR_ANY
1437
 
                self.server_address = (any_address,
 
762
                in6addr_any = "::"
 
763
                self.server_address = (in6addr_any,
1438
764
                                       self.server_address[1])
1439
765
            elif not self.server_address[1]:
1440
766
                self.server_address = (self.server_address[0],
1441
767
                                       0)
1442
 
#                 if self.interface:
 
768
#                 if self.settings["interface"]:
1443
769
#                     self.server_address = (self.server_address[0],
1444
770
#                                            0, # port
1445
771
#                                            0, # flowinfo
1446
772
#                                            if_nametoindex
1447
 
#                                            (self.interface))
1448
 
            return socketserver.TCPServer.server_bind(self)
1449
 
 
1450
 
 
1451
 
class MandosServer(IPv6_TCPServer):
1452
 
    """Mandos server.
1453
 
    
1454
 
    Attributes:
1455
 
        clients:        set of Client objects
1456
 
        gnutls_priority GnuTLS priority string
1457
 
        use_dbus:       Boolean; to emit D-Bus signals or not
1458
 
    
1459
 
    Assumes a gobject.MainLoop event loop.
1460
 
    """
1461
 
    def __init__(self, server_address, RequestHandlerClass,
1462
 
                 interface=None, use_ipv6=True, clients=None,
1463
 
                 gnutls_priority=None, use_dbus=True):
1464
 
        self.enabled = False
1465
 
        self.clients = clients
1466
 
        if self.clients is None:
1467
 
            self.clients = set()
1468
 
        self.use_dbus = use_dbus
1469
 
        self.gnutls_priority = gnutls_priority
1470
 
        IPv6_TCPServer.__init__(self, server_address,
1471
 
                                RequestHandlerClass,
1472
 
                                interface = interface,
1473
 
                                use_ipv6 = use_ipv6)
 
773
#                                            (self.settings
 
774
#                                             ["interface"]))
 
775
            return super(IPv6_TCPServer, self).server_bind()
1474
776
    def server_activate(self):
1475
777
        if self.enabled:
1476
 
            return socketserver.TCPServer.server_activate(self)
 
778
            return super(IPv6_TCPServer, self).server_activate()
1477
779
    def enable(self):
1478
780
        self.enabled = True
1479
 
    def add_pipe(self, parent_pipe):
1480
 
        # Call "handle_ipc" for both data and EOF events
1481
 
        gobject.io_add_watch(parent_pipe.fileno(),
1482
 
                             gobject.IO_IN | gobject.IO_HUP,
1483
 
                             functools.partial(self.handle_ipc,
1484
 
                                               parent_pipe = parent_pipe))
1485
 
        
1486
 
    def handle_ipc(self, source, condition, parent_pipe=None,
1487
 
                   client_object=None):
1488
 
        condition_names = {
1489
 
            gobject.IO_IN: u"IN",   # There is data to read.
1490
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
1491
 
                                    # blocking).
1492
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1493
 
            gobject.IO_ERR: u"ERR", # Error condition.
1494
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1495
 
                                    # broken, usually for pipes and
1496
 
                                    # sockets).
1497
 
            }
1498
 
        conditions_string = ' | '.join(name
1499
 
                                       for cond, name in
1500
 
                                       condition_names.iteritems()
1501
 
                                       if cond & condition)
1502
 
        # error or the other end of multiprocessing.Pipe has closed
1503
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1504
 
            return False
1505
 
        
1506
 
        # Read a request from the child
1507
 
        request = parent_pipe.recv()
1508
 
        command = request[0]
1509
 
        
1510
 
        if command == 'init':
1511
 
            fpr = request[1]
1512
 
            address = request[2]
1513
 
            
1514
 
            for c in self.clients:
1515
 
                if c.fingerprint == fpr:
1516
 
                    client = c
1517
 
                    break
1518
 
            else:
1519
 
                logger.warning(u"Client not found for fingerprint: %s, ad"
1520
 
                               u"dress: %s", fpr, address)
1521
 
                if self.use_dbus:
1522
 
                    # Emit D-Bus signal
1523
 
                    mandos_dbus_service.ClientNotFound(fpr, address)
1524
 
                parent_pipe.send(False)
1525
 
                return False
1526
 
            
1527
 
            gobject.io_add_watch(parent_pipe.fileno(),
1528
 
                                 gobject.IO_IN | gobject.IO_HUP,
1529
 
                                 functools.partial(self.handle_ipc,
1530
 
                                                   parent_pipe = parent_pipe,
1531
 
                                                   client_object = client))
1532
 
            parent_pipe.send(True)
1533
 
            # remove the old hook in favor of the new above hook on same fileno
1534
 
            return False
1535
 
        if command == 'funcall':
1536
 
            funcname = request[1]
1537
 
            args = request[2]
1538
 
            kwargs = request[3]
1539
 
            
1540
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1541
 
 
1542
 
        if command == 'getattr':
1543
 
            attrname = request[1]
1544
 
            if callable(client_object.__getattribute__(attrname)):
1545
 
                parent_pipe.send(('function',))
1546
 
            else:
1547
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1548
 
        
1549
 
        if command == 'setattr':
1550
 
            attrname = request[1]
1551
 
            value = request[2]
1552
 
            setattr(client_object, attrname, value)
1553
 
 
1554
 
        return True
1555
781
 
1556
782
 
1557
783
def string_to_delta(interval):
1558
784
    """Parse a string and return a datetime.timedelta
1559
 
    
1560
 
    >>> string_to_delta(u'7d')
 
785
 
 
786
    >>> string_to_delta('7d')
1561
787
    datetime.timedelta(7)
1562
 
    >>> string_to_delta(u'60s')
 
788
    >>> string_to_delta('60s')
1563
789
    datetime.timedelta(0, 60)
1564
 
    >>> string_to_delta(u'60m')
 
790
    >>> string_to_delta('60m')
1565
791
    datetime.timedelta(0, 3600)
1566
 
    >>> string_to_delta(u'24h')
 
792
    >>> string_to_delta('24h')
1567
793
    datetime.timedelta(1)
1568
794
    >>> string_to_delta(u'1w')
1569
795
    datetime.timedelta(7)
1570
 
    >>> string_to_delta(u'5m 30s')
 
796
    >>> string_to_delta('5m 30s')
1571
797
    datetime.timedelta(0, 330)
1572
798
    """
1573
799
    timevalue = datetime.timedelta(0)
1586
812
            elif suffix == u"w":
1587
813
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1588
814
            else:
1589
 
                raise ValueError(u"Unknown suffix %r" % suffix)
1590
 
        except (ValueError, IndexError), e:
1591
 
            raise ValueError(e.message)
 
815
                raise ValueError
 
816
        except (ValueError, IndexError):
 
817
            raise ValueError
1592
818
        timevalue += delta
1593
819
    return timevalue
1594
820
 
1595
821
 
 
822
def server_state_changed(state):
 
823
    """Derived from the Avahi example code"""
 
824
    if state == avahi.SERVER_COLLISION:
 
825
        logger.error(u"Zeroconf server name collision")
 
826
        service.remove()
 
827
    elif state == avahi.SERVER_RUNNING:
 
828
        service.add()
 
829
 
 
830
 
 
831
def entry_group_state_changed(state, error):
 
832
    """Derived from the Avahi example code"""
 
833
    logger.debug(u"Avahi state change: %i", state)
 
834
    
 
835
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
836
        logger.debug(u"Zeroconf service established.")
 
837
    elif state == avahi.ENTRY_GROUP_COLLISION:
 
838
        logger.warning(u"Zeroconf service name collision.")
 
839
        service.rename()
 
840
    elif state == avahi.ENTRY_GROUP_FAILURE:
 
841
        logger.critical(u"Avahi: Error in group state changed %s",
 
842
                        unicode(error))
 
843
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
 
844
 
1596
845
def if_nametoindex(interface):
1597
 
    """Call the C function if_nametoindex(), or equivalent
1598
 
    
1599
 
    Note: This function cannot accept a unicode string."""
 
846
    """Call the C function if_nametoindex(), or equivalent"""
1600
847
    global if_nametoindex
1601
848
    try:
1602
849
        if_nametoindex = (ctypes.cdll.LoadLibrary
1603
 
                          (ctypes.util.find_library(u"c"))
 
850
                          (ctypes.util.find_library("c"))
1604
851
                          .if_nametoindex)
1605
852
    except (OSError, AttributeError):
1606
 
        logger.warning(u"Doing if_nametoindex the hard way")
 
853
        if "struct" not in sys.modules:
 
854
            import struct
 
855
        if "fcntl" not in sys.modules:
 
856
            import fcntl
1607
857
        def if_nametoindex(interface):
1608
858
            "Get an interface index the hard way, i.e. using fcntl()"
1609
859
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1610
 
            with contextlib.closing(socket.socket()) as s:
 
860
            with closing(socket.socket()) as s:
1611
861
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1612
 
                                    struct.pack(str(u"16s16x"),
1613
 
                                                interface))
1614
 
            interface_index = struct.unpack(str(u"I"),
1615
 
                                            ifreq[16:20])[0]
 
862
                                    struct.pack("16s16x", interface))
 
863
            interface_index = struct.unpack("I", ifreq[16:20])[0]
1616
864
            return interface_index
1617
865
    return if_nametoindex(interface)
1618
866
 
1619
867
 
1620
868
def daemon(nochdir = False, noclose = False):
1621
869
    """See daemon(3).  Standard BSD Unix function.
1622
 
    
1623
870
    This should really exist as os.daemon, but it doesn't (yet)."""
1624
871
    if os.fork():
1625
872
        sys.exit()
1626
873
    os.setsid()
1627
874
    if not nochdir:
1628
 
        os.chdir(u"/")
 
875
        os.chdir("/")
1629
876
    if os.fork():
1630
877
        sys.exit()
1631
878
    if not noclose:
1633
880
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1634
881
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1635
882
            raise OSError(errno.ENODEV,
1636
 
                          u"%s not a character device"
1637
 
                          % os.path.devnull)
 
883
                          "/dev/null not a character device")
1638
884
        os.dup2(null, sys.stdin.fileno())
1639
885
        os.dup2(null, sys.stdout.fileno())
1640
886
        os.dup2(null, sys.stderr.fileno())
1643
889
 
1644
890
 
1645
891
def main():
1646
 
    
1647
 
    ##################################################################
1648
 
    # Parsing of options, both command line and config file
1649
 
    
1650
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1651
 
    parser.add_option("-i", u"--interface", type=u"string",
1652
 
                      metavar="IF", help=u"Bind to interface IF")
1653
 
    parser.add_option("-a", u"--address", type=u"string",
1654
 
                      help=u"Address to listen for requests on")
1655
 
    parser.add_option("-p", u"--port", type=u"int",
1656
 
                      help=u"Port number to receive requests on")
1657
 
    parser.add_option("--check", action=u"store_true",
1658
 
                      help=u"Run self-test")
1659
 
    parser.add_option("--debug", action=u"store_true",
1660
 
                      help=u"Debug mode; run in foreground and log to"
1661
 
                      u" terminal")
1662
 
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
1663
 
                      help=u"Debug level for stdout output")
1664
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1665
 
                      u" priority string (see GnuTLS documentation)")
1666
 
    parser.add_option("--servicename", type=u"string",
1667
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1668
 
    parser.add_option("--configdir", type=u"string",
1669
 
                      default=u"/etc/mandos", metavar=u"DIR",
1670
 
                      help=u"Directory to search for configuration"
1671
 
                      u" files")
1672
 
    parser.add_option("--no-dbus", action=u"store_false",
1673
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1674
 
                      u" system bus interface")
1675
 
    parser.add_option("--no-ipv6", action=u"store_false",
1676
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
 
892
    parser = OptionParser(version = "%%prog %s" % version)
 
893
    parser.add_option("-i", "--interface", type="string",
 
894
                      metavar="IF", help="Bind to interface IF")
 
895
    parser.add_option("-a", "--address", type="string",
 
896
                      help="Address to listen for requests on")
 
897
    parser.add_option("-p", "--port", type="int",
 
898
                      help="Port number to receive requests on")
 
899
    parser.add_option("--check", action="store_true",
 
900
                      help="Run self-test")
 
901
    parser.add_option("--debug", action="store_true",
 
902
                      help="Debug mode; run in foreground and log to"
 
903
                      " terminal")
 
904
    parser.add_option("--priority", type="string", help="GnuTLS"
 
905
                      " priority string (see GnuTLS documentation)")
 
906
    parser.add_option("--servicename", type="string", metavar="NAME",
 
907
                      help="Zeroconf service name")
 
908
    parser.add_option("--configdir", type="string",
 
909
                      default="/etc/mandos", metavar="DIR",
 
910
                      help="Directory to search for configuration"
 
911
                      " files")
 
912
    parser.add_option("--no-dbus", action="store_false",
 
913
                      dest="use_dbus",
 
914
                      help="Do not provide D-Bus system bus"
 
915
                      " interface")
1677
916
    options = parser.parse_args()[0]
1678
917
    
1679
918
    if options.check:
1682
921
        sys.exit()
1683
922
    
1684
923
    # Default values for config file for server-global settings
1685
 
    server_defaults = { u"interface": u"",
1686
 
                        u"address": u"",
1687
 
                        u"port": u"",
1688
 
                        u"debug": u"False",
1689
 
                        u"priority":
1690
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1691
 
                        u"servicename": u"Mandos",
1692
 
                        u"use_dbus": u"True",
1693
 
                        u"use_ipv6": u"True",
1694
 
                        u"debuglevel": u"",
 
924
    server_defaults = { "interface": "",
 
925
                        "address": "",
 
926
                        "port": "",
 
927
                        "debug": "False",
 
928
                        "priority":
 
929
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
930
                        "servicename": "Mandos",
 
931
                        "use_dbus": "True",
1695
932
                        }
1696
933
    
1697
934
    # Parse config file for server-global settings
1698
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
935
    server_config = ConfigParser.SafeConfigParser(server_defaults)
1699
936
    del server_defaults
1700
 
    server_config.read(os.path.join(options.configdir,
1701
 
                                    u"mandos.conf"))
 
937
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
1702
938
    # Convert the SafeConfigParser object to a dict
1703
939
    server_settings = server_config.defaults()
1704
 
    # Use the appropriate methods on the non-string config options
1705
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1706
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
1707
 
                                                           option)
1708
 
    if server_settings["port"]:
1709
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1710
 
                                                       u"port")
 
940
    # Use getboolean on the boolean config options
 
941
    server_settings["debug"] = (server_config.getboolean
 
942
                                ("DEFAULT", "debug"))
 
943
    server_settings["use_dbus"] = (server_config.getboolean
 
944
                                   ("DEFAULT", "use_dbus"))
1711
945
    del server_config
1712
946
    
1713
947
    # Override the settings from the config file with command line
1714
948
    # options, if set.
1715
 
    for option in (u"interface", u"address", u"port", u"debug",
1716
 
                   u"priority", u"servicename", u"configdir",
1717
 
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
 
949
    for option in ("interface", "address", "port", "debug",
 
950
                   "priority", "servicename", "configdir",
 
951
                   "use_dbus"):
1718
952
        value = getattr(options, option)
1719
953
        if value is not None:
1720
954
            server_settings[option] = value
1721
955
    del options
1722
 
    # Force all strings to be unicode
1723
 
    for option in server_settings.keys():
1724
 
        if type(server_settings[option]) is str:
1725
 
            server_settings[option] = unicode(server_settings[option])
1726
956
    # Now we have our good server settings in "server_settings"
1727
957
    
1728
 
    ##################################################################
1729
 
    
1730
958
    # For convenience
1731
 
    debug = server_settings[u"debug"]
1732
 
    debuglevel = server_settings[u"debuglevel"]
1733
 
    use_dbus = server_settings[u"use_dbus"]
1734
 
    use_ipv6 = server_settings[u"use_ipv6"]
1735
 
 
1736
 
    if server_settings[u"servicename"] != u"Mandos":
 
959
    debug = server_settings["debug"]
 
960
    use_dbus = server_settings["use_dbus"]
 
961
    
 
962
    if not debug:
 
963
        syslogger.setLevel(logging.WARNING)
 
964
        console.setLevel(logging.WARNING)
 
965
    
 
966
    if server_settings["servicename"] != "Mandos":
1737
967
        syslogger.setFormatter(logging.Formatter
1738
 
                               (u'Mandos (%s) [%%(process)d]:'
1739
 
                                u' %%(levelname)s: %%(message)s'
1740
 
                                % server_settings[u"servicename"]))
 
968
                               ('Mandos (%s): %%(levelname)s:'
 
969
                                ' %%(message)s'
 
970
                                % server_settings["servicename"]))
1741
971
    
1742
972
    # Parse config file with clients
1743
 
    client_defaults = { u"timeout": u"1h",
1744
 
                        u"interval": u"5m",
1745
 
                        u"checker": u"fping -q -- %%(host)s",
1746
 
                        u"host": u"",
1747
 
                        u"approval_delay": u"0s",
1748
 
                        u"approval_duration": u"1s",
 
973
    client_defaults = { "timeout": "1h",
 
974
                        "interval": "5m",
 
975
                        "checker": "fping -q -- %%(host)s",
 
976
                        "host": "",
1749
977
                        }
1750
 
    client_config = configparser.SafeConfigParser(client_defaults)
1751
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1752
 
                                    u"clients.conf"))
1753
 
    
1754
 
    global mandos_dbus_service
1755
 
    mandos_dbus_service = None
1756
 
    
1757
 
    tcp_server = MandosServer((server_settings[u"address"],
1758
 
                               server_settings[u"port"]),
1759
 
                              ClientHandler,
1760
 
                              interface=(server_settings[u"interface"]
1761
 
                                         or None),
1762
 
                              use_ipv6=use_ipv6,
1763
 
                              gnutls_priority=
1764
 
                              server_settings[u"priority"],
1765
 
                              use_dbus=use_dbus)
1766
 
    pidfilename = u"/var/run/mandos.pid"
1767
 
    try:
1768
 
        pidfile = open(pidfilename, u"w")
1769
 
    except IOError:
1770
 
        logger.error(u"Could not open file %r", pidfilename)
1771
 
    
1772
 
    try:
1773
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1774
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
 
978
    client_config = ConfigParser.SafeConfigParser(client_defaults)
 
979
    client_config.read(os.path.join(server_settings["configdir"],
 
980
                                    "clients.conf"))
 
981
    
 
982
    clients = Set()
 
983
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
984
                                 server_settings["port"]),
 
985
                                TCP_handler,
 
986
                                settings=server_settings,
 
987
                                clients=clients)
 
988
    pidfilename = "/var/run/mandos.pid"
 
989
    try:
 
990
        pidfile = open(pidfilename, "w")
 
991
    except IOError, error:
 
992
        logger.error("Could not open file %r", pidfilename)
 
993
    
 
994
    try:
 
995
        uid = pwd.getpwnam("_mandos").pw_uid
 
996
        gid = pwd.getpwnam("_mandos").pw_gid
1775
997
    except KeyError:
1776
998
        try:
1777
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1778
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
999
            uid = pwd.getpwnam("mandos").pw_uid
 
1000
            gid = pwd.getpwnam("mandos").pw_gid
1779
1001
        except KeyError:
1780
1002
            try:
1781
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1782
 
                gid = pwd.getpwnam(u"nobody").pw_gid
 
1003
                uid = pwd.getpwnam("nobody").pw_uid
 
1004
                gid = pwd.getpwnam("nogroup").pw_gid
1783
1005
            except KeyError:
1784
1006
                uid = 65534
1785
1007
                gid = 65534
1786
1008
    try:
 
1009
        os.setuid(uid)
1787
1010
        os.setgid(gid)
1788
 
        os.setuid(uid)
1789
1011
    except OSError, error:
1790
1012
        if error[0] != errno.EPERM:
1791
1013
            raise error
1792
1014
    
1793
 
    if not debug and not debuglevel:
1794
 
        syslogger.setLevel(logging.WARNING)
1795
 
        console.setLevel(logging.WARNING)
1796
 
    if debuglevel:
1797
 
        level = getattr(logging, debuglevel.upper())
1798
 
        syslogger.setLevel(level)
1799
 
        console.setLevel(level)
1800
 
 
1801
 
    if debug:
1802
 
        # Enable all possible GnuTLS debugging
1803
 
        
1804
 
        # "Use a log level over 10 to enable all debugging options."
1805
 
        # - GnuTLS manual
1806
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
1807
 
        
1808
 
        @gnutls.library.types.gnutls_log_func
1809
 
        def debug_gnutls(level, string):
1810
 
            logger.debug(u"GnuTLS: %s", string[:-1])
1811
 
        
1812
 
        (gnutls.library.functions
1813
 
         .gnutls_global_set_log_function(debug_gnutls))
1814
 
        
1815
 
        # Redirect stdin so all checkers get /dev/null
1816
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1817
 
        os.dup2(null, sys.stdin.fileno())
1818
 
        if null > 2:
1819
 
            os.close(null)
1820
 
    else:
1821
 
        # No console logging
1822
 
        logger.removeHandler(console)
1823
 
    
 
1015
    global service
 
1016
    service = AvahiService(name = server_settings["servicename"],
 
1017
                           servicetype = "_mandos._tcp", )
 
1018
    if server_settings["interface"]:
 
1019
        service.interface = (if_nametoindex
 
1020
                             (server_settings["interface"]))
1824
1021
    
1825
1022
    global main_loop
 
1023
    global bus
 
1024
    global server
1826
1025
    # From the Avahi example code
1827
1026
    DBusGMainLoop(set_as_default=True )
1828
1027
    main_loop = gobject.MainLoop()
1829
1028
    bus = dbus.SystemBus()
 
1029
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
 
1030
                                           avahi.DBUS_PATH_SERVER),
 
1031
                            avahi.DBUS_INTERFACE_SERVER)
1830
1032
    # End of Avahi example code
1831
1033
    if use_dbus:
1832
 
        try:
1833
 
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1834
 
                                            bus, do_not_queue=True)
1835
 
        except dbus.exceptions.NameExistsException, e:
1836
 
            logger.error(unicode(e) + u", disabling D-Bus")
1837
 
            use_dbus = False
1838
 
            server_settings[u"use_dbus"] = False
1839
 
            tcp_server.use_dbus = False
1840
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1841
 
    service = AvahiService(name = server_settings[u"servicename"],
1842
 
                           servicetype = u"_mandos._tcp",
1843
 
                           protocol = protocol, bus = bus)
1844
 
    if server_settings["interface"]:
1845
 
        service.interface = (if_nametoindex
1846
 
                             (str(server_settings[u"interface"])))
1847
 
 
1848
 
    if not debug:
 
1034
        bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
 
1035
                                        bus)
 
1036
    
 
1037
    clients.update(Set(Client(name = section,
 
1038
                              config
 
1039
                              = dict(client_config.items(section)),
 
1040
                              use_dbus = use_dbus)
 
1041
                       for section in client_config.sections()))
 
1042
    if not clients:
 
1043
        logger.warning(u"No clients defined")
 
1044
    
 
1045
    if debug:
 
1046
        # Redirect stdin so all checkers get /dev/null
 
1047
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1048
        os.dup2(null, sys.stdin.fileno())
 
1049
        if null > 2:
 
1050
            os.close(null)
 
1051
    else:
 
1052
        # No console logging
 
1053
        logger.removeHandler(console)
1849
1054
        # Close all input and output, do double fork, etc.
1850
1055
        daemon()
1851
 
        
1852
 
    global multiprocessing_manager
1853
 
    multiprocessing_manager = multiprocessing.Manager()
1854
 
    
1855
 
    client_class = Client
1856
 
    if use_dbus:
1857
 
        client_class = functools.partial(ClientDBus, bus = bus)
1858
 
    def client_config_items(config, section):
1859
 
        special_settings = {
1860
 
            "approved_by_default":
1861
 
                lambda: config.getboolean(section,
1862
 
                                          "approved_by_default"),
1863
 
            }
1864
 
        for name, value in config.items(section):
1865
 
            try:
1866
 
                yield (name, special_settings[name]())
1867
 
            except KeyError:
1868
 
                yield (name, value)
1869
 
    
1870
 
    tcp_server.clients.update(set(
1871
 
            client_class(name = section,
1872
 
                         config= dict(client_config_items(
1873
 
                        client_config, section)))
1874
 
            for section in client_config.sections()))
1875
 
    if not tcp_server.clients:
1876
 
        logger.warning(u"No clients defined")
1877
 
        
 
1056
    
1878
1057
    try:
1879
 
        with pidfile:
1880
 
            pid = os.getpid()
1881
 
            pidfile.write(str(pid) + "\n")
 
1058
        pid = os.getpid()
 
1059
        pidfile.write(str(pid) + "\n")
 
1060
        pidfile.close()
1882
1061
        del pidfile
1883
1062
    except IOError:
1884
1063
        logger.error(u"Could not write to file %r with PID %d",
1888
1067
        pass
1889
1068
    del pidfilename
1890
1069
    
 
1070
    def cleanup():
 
1071
        "Cleanup function; run on exit"
 
1072
        global group
 
1073
        # From the Avahi example code
 
1074
        if not group is None:
 
1075
            group.Free()
 
1076
            group = None
 
1077
        # End of Avahi example code
 
1078
        
 
1079
        while clients:
 
1080
            client = clients.pop()
 
1081
            client.disable_hook = None
 
1082
            client.disable()
 
1083
    
 
1084
    atexit.register(cleanup)
 
1085
    
1891
1086
    if not debug:
1892
1087
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1893
1088
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1894
1089
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1895
1090
    
1896
1091
    if use_dbus:
1897
 
        class MandosDBusService(dbus.service.Object):
 
1092
        class MandosServer(dbus.service.Object):
1898
1093
            """A D-Bus proxy object"""
1899
1094
            def __init__(self):
1900
 
                dbus.service.Object.__init__(self, bus, u"/")
1901
 
            _interface = u"se.bsnet.fukt.Mandos"
1902
 
            
1903
 
            @dbus.service.signal(_interface, signature=u"o")
1904
 
            def ClientAdded(self, objpath):
1905
 
                "D-Bus signal"
1906
 
                pass
1907
 
            
1908
 
            @dbus.service.signal(_interface, signature=u"ss")
1909
 
            def ClientNotFound(self, fingerprint, address):
1910
 
                "D-Bus signal"
1911
 
                pass
1912
 
            
1913
 
            @dbus.service.signal(_interface, signature=u"os")
1914
 
            def ClientRemoved(self, objpath, name):
1915
 
                "D-Bus signal"
1916
 
                pass
1917
 
            
1918
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
1095
                dbus.service.Object.__init__(self, bus,
 
1096
                                             "/Mandos")
 
1097
            _interface = u"org.mandos_system.Mandos"
 
1098
 
 
1099
            @dbus.service.signal(_interface, signature="oa{sv}")
 
1100
            def ClientAdded(self, objpath, properties):
 
1101
                "D-Bus signal"
 
1102
                pass
 
1103
 
 
1104
            @dbus.service.signal(_interface, signature="o")
 
1105
            def ClientRemoved(self, objpath):
 
1106
                "D-Bus signal"
 
1107
                pass
 
1108
 
 
1109
            @dbus.service.method(_interface, out_signature="ao")
1919
1110
            def GetAllClients(self):
1920
 
                "D-Bus method"
1921
 
                return dbus.Array(c.dbus_object_path
1922
 
                                  for c in tcp_server.clients)
1923
 
            
1924
 
            @dbus.service.method(_interface,
1925
 
                                 out_signature=u"a{oa{sv}}")
 
1111
                return dbus.Array(c.dbus_object_path for c in clients)
 
1112
 
 
1113
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
1926
1114
            def GetAllClientsWithProperties(self):
1927
 
                "D-Bus method"
1928
1115
                return dbus.Dictionary(
1929
 
                    ((c.dbus_object_path, c.GetAll(u""))
1930
 
                     for c in tcp_server.clients),
1931
 
                    signature=u"oa{sv}")
1932
 
            
1933
 
            @dbus.service.method(_interface, in_signature=u"o")
 
1116
                    ((c.dbus_object_path, c.GetAllProperties())
 
1117
                     for c in clients),
 
1118
                    signature="oa{sv}")
 
1119
 
 
1120
            @dbus.service.method(_interface, in_signature="o")
1934
1121
            def RemoveClient(self, object_path):
1935
 
                "D-Bus method"
1936
 
                for c in tcp_server.clients:
 
1122
                for c in clients:
1937
1123
                    if c.dbus_object_path == object_path:
1938
 
                        tcp_server.clients.remove(c)
1939
 
                        c.remove_from_connection()
 
1124
                        clients.remove(c)
1940
1125
                        # Don't signal anything except ClientRemoved
1941
 
                        c.disable(quiet=True)
 
1126
                        c.use_dbus = False
 
1127
                        c.disable()
1942
1128
                        # Emit D-Bus signal
1943
 
                        self.ClientRemoved(object_path, c.name)
 
1129
                        self.ClientRemoved(object_path)
1944
1130
                        return
1945
 
                raise KeyError(object_path)
1946
 
            
 
1131
                raise KeyError
 
1132
            @dbus.service.method(_interface)
 
1133
            def Quit(self):
 
1134
                main_loop.quit()
 
1135
 
1947
1136
            del _interface
1948
 
        
1949
 
        mandos_dbus_service = MandosDBusService()
1950
 
    
1951
 
    def cleanup():
1952
 
        "Cleanup function; run on exit"
1953
 
        service.cleanup()
1954
 
        
1955
 
        while tcp_server.clients:
1956
 
            client = tcp_server.clients.pop()
1957
 
            if use_dbus:
1958
 
                client.remove_from_connection()
1959
 
            client.disable_hook = None
1960
 
            # Don't signal anything except ClientRemoved
1961
 
            client.disable(quiet=True)
1962
 
            if use_dbus:
1963
 
                # Emit D-Bus signal
1964
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1965
 
                                                  client.name)
1966
 
    
1967
 
    atexit.register(cleanup)
1968
 
    
1969
 
    for client in tcp_server.clients:
 
1137
    
 
1138
        mandos_server = MandosServer()
 
1139
    
 
1140
    for client in clients:
1970
1141
        if use_dbus:
1971
1142
            # Emit D-Bus signal
1972
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
1143
            mandos_server.ClientAdded(client.dbus_object_path,
 
1144
                                      client.GetAllProperties())
1973
1145
        client.enable()
1974
1146
    
1975
1147
    tcp_server.enable()
1977
1149
    
1978
1150
    # Find out what port we got
1979
1151
    service.port = tcp_server.socket.getsockname()[1]
1980
 
    if use_ipv6:
1981
 
        logger.info(u"Now listening on address %r, port %d,"
1982
 
                    " flowinfo %d, scope_id %d"
1983
 
                    % tcp_server.socket.getsockname())
1984
 
    else:                       # IPv4
1985
 
        logger.info(u"Now listening on address %r, port %d"
1986
 
                    % tcp_server.socket.getsockname())
 
1152
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
 
1153
                u" scope_id %d" % tcp_server.socket.getsockname())
1987
1154
    
1988
1155
    #service.interface = tcp_server.socket.getsockname()[3]
1989
1156
    
1990
1157
    try:
1991
1158
        # From the Avahi example code
 
1159
        server.connect_to_signal("StateChanged", server_state_changed)
1992
1160
        try:
1993
 
            service.activate()
 
1161
            server_state_changed(server.GetState())
1994
1162
        except dbus.exceptions.DBusException, error:
1995
1163
            logger.critical(u"DBusException: %s", error)
1996
 
            cleanup()
1997
1164
            sys.exit(1)
1998
1165
        # End of Avahi example code
1999
1166
        
2006
1173
        main_loop.run()
2007
1174
    except AvahiError, error:
2008
1175
        logger.critical(u"AvahiError: %s", error)
2009
 
        cleanup()
2010
1176
        sys.exit(1)
2011
1177
    except KeyboardInterrupt:
2012
1178
        if debug:
2013
 
            print >> sys.stderr
2014
 
        logger.debug(u"Server received KeyboardInterrupt")
2015
 
    logger.debug(u"Server exiting")
2016
 
    # Must run before the D-Bus bus name gets deregistered
2017
 
    cleanup()
 
1179
            print
2018
1180
 
2019
1181
if __name__ == '__main__':
2020
1182
    main()