To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.2.38
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.38
- Committer: Teddy Hogeborn
- Date: 2009-01-18 00:16:57 UTC
- mto: (24.1.127 mandos) (237.4.2 mandos-pipe-ipc) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 249.
- Revision ID: teddy@fukt.bsnet.se-20090118001657-6mo3ae73ldy5tegf
* debian/mandos-client.postinst: Converted to Bourne shell. Also
minor message change.
* debian/mandos-client.postrm: Minor message change.
* debian/mandos.postinst: Converted to Bourne shell. Also minor
message change.
* debian/mandos.prerm: Minor message change.
minor message change.
* debian/mandos-client.postrm: Minor message change.
* debian/mandos.postinst: Converted to Bourne shell. Also minor
message change.
* debian/mandos.prerm: Minor message change.
- files removed:
- dbus-mandos.conf
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
58
import contextlib
59
import struct
60
import fcntl
61
import functools
62
import cPickle as pickle
59
from contextlib import closing
63
60
64
61
import dbus
65
62
import dbus.service
68
65
from dbus.mainloop.glib import DBusGMainLoop
69
66
import ctypes
70
67
import ctypes.util
71
import xml.dom.minidom
72
import inspect
73
74
try:
75
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
76
except AttributeError:
77
try:
78
from IN import SO_BINDTODEVICE
79
except ImportError:
80
SO_BINDTODEVICE = None
81
82
83
version = "1.0.14"
84
85
logger = logging.Logger(u'mandos')
68
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
86
72
syslogger = (logging.handlers.SysLogHandler
87
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
88
74
address = "/dev/log"))
89
75
syslogger.setFormatter(logging.Formatter
90
(u'Mandos [%(process)d]: %(levelname)s:'
91
u' %(message)s'))
76
('Mandos: %(levelname)s: %(message)s'))
92
77
logger.addHandler(syslogger)
93
78
94
79
console = logging.StreamHandler()
95
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
96
u' %(levelname)s:'
97
u' %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
98
82
logger.addHandler(console)
99
83
100
84
class AvahiError(Exception):
113
97
114
98
class AvahiService(object):
115
99
"""An Avahi (Zeroconf) service.
116
117
100
Attributes:
118
101
interface: integer; avahi.IF_UNSPEC or an interface index.
119
102
Used to optionally bind to the specified interface.
120
name: string; Example: u'Mandos'
121
type: string; Example: u'_mandos._tcp'.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
122
105
See <http://www.dns-sd.org/ServiceTypes.html>
123
106
port: integer; what port to announce
124
107
TXT: list of strings; TXT record for the service
127
110
max_renames: integer; maximum number of renames
128
111
rename_count: integer; counter so we only rename after collisions
129
112
a sensible number of times
130
group: D-Bus Entry Group
131
server: D-Bus Server
132
bus: dbus.SystemBus()
133
113
"""
134
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
135
115
servicetype = None, port = None, TXT = None,
136
domain = u"", host = u"", max_renames = 32768,
137
protocol = avahi.PROTO_UNSPEC, bus = None):
116
domain = "", host = "", max_renames = 32768):
138
117
self.interface = interface
139
118
self.name = name
140
119
self.type = servicetype
144
123
self.host = host
145
124
self.rename_count = 0
146
125
self.max_renames = max_renames
147
self.protocol = protocol
148
self.group = None # our entry group
149
self.server = None
150
self.bus = bus
151
126
def rename(self):
152
127
"""Derived from the Avahi example code"""
153
128
if self.rename_count >= self.max_renames:
155
130
u" after %i retries, exiting.",
156
131
self.rename_count)
157
132
raise AvahiServiceError(u"Too many renames")
158
self.name = self.server.GetAlternativeServiceName(self.name)
133
self.name = server.GetAlternativeServiceName(self.name)
159
134
logger.info(u"Changing Zeroconf service name to %r ...",
160
unicode(self.name))
135
str(self.name))
161
136
syslogger.setFormatter(logging.Formatter
162
(u'Mandos (%s) [%%(process)d]:'
163
u' %%(levelname)s: %%(message)s'
164
% self.name))
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
165
139
self.remove()
166
140
self.add()
167
141
self.rename_count += 1
168
142
def remove(self):
169
143
"""Derived from the Avahi example code"""
170
if self.group is not None:
171
self.group.Reset()
144
if group is not None:
145
group.Reset()
172
146
def add(self):
173
147
"""Derived from the Avahi example code"""
174
if self.group is None:
175
self.group = dbus.Interface(
176
self.bus.get_object(avahi.DBUS_NAME,
177
self.server.EntryGroupNew()),
178
avahi.DBUS_INTERFACE_ENTRY_GROUP)
179
self.group.connect_to_signal('StateChanged',
180
self
181
.entry_group_state_changed)
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
182
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
183
self.name, self.type)
184
self.group.AddService(
185
self.interface,
186
self.protocol,
187
dbus.UInt32(0), # flags
188
self.name, self.type,
189
self.domain, self.host,
190
dbus.UInt16(self.port),
191
avahi.string_array_to_txt_array(self.TXT))
192
self.group.Commit()
193
def entry_group_state_changed(self, state, error):
194
"""Derived from the Avahi example code"""
195
logger.debug(u"Avahi state change: %i", state)
196
197
if state == avahi.ENTRY_GROUP_ESTABLISHED:
198
logger.debug(u"Zeroconf service established.")
199
elif state == avahi.ENTRY_GROUP_COLLISION:
200
logger.warning(u"Zeroconf service name collision.")
201
self.rename()
202
elif state == avahi.ENTRY_GROUP_FAILURE:
203
logger.critical(u"Avahi: Error in group state changed %s",
204
unicode(error))
205
raise AvahiGroupError(u"State changed: %s"
206
% unicode(error))
207
def cleanup(self):
208
"""Derived from the Avahi example code"""
209
if self.group is not None:
210
self.group.Free()
211
self.group = None
212
def server_state_changed(self, state):
213
"""Derived from the Avahi example code"""
214
if state == avahi.SERVER_COLLISION:
215
logger.error(u"Zeroconf server name collision")
216
self.remove()
217
elif state == avahi.SERVER_RUNNING:
218
self.add()
219
def activate(self):
220
"""Derived from the Avahi example code"""
221
if self.server is None:
222
self.server = dbus.Interface(
223
self.bus.get_object(avahi.DBUS_NAME,
224
avahi.DBUS_PATH_SERVER),
225
avahi.DBUS_INTERFACE_SERVER)
226
self.server.connect_to_signal(u"StateChanged",
227
self.server_state_changed)
228
self.server_state_changed(self.server.GetState())
229
230
231
class Client(object):
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
232
179
"""A representation of a client host served by this server.
233
234
180
Attributes:
235
name: string; from the config file, used in log messages and
236
D-Bus identifiers
181
name: string; from the config file, used in log messages
237
182
fingerprint: string (40 or 32 hexadecimal digits); used to
238
183
uniquely identify the client
239
184
secret: bytestring; sent verbatim (over TLS) to client
243
188
enabled: bool()
244
189
last_checked_ok: datetime.datetime(); (UTC) or None
245
190
timeout: datetime.timedelta(); How long from last_checked_ok
246
until this client is disabled
191
until this client is invalid
247
192
interval: datetime.timedelta(); How often to start a new checker
248
193
disable_hook: If set, called by disable() as disable_hook(self)
249
194
checker: subprocess.Popen(); a running checker process used
250
195
to see if the client lives.
251
196
'None' if no process is running.
252
197
checker_initiator_tag: a gobject event source tag, or None
253
disable_initiator_tag: - '' -
198
disable_initiator_tag: - '' -
254
199
checker_callback_tag: - '' -
255
200
checker_command: string; External command which is run to check if
256
201
client lives. %() expansions are done at
257
202
runtime with vars(self) as dict, so that for
258
203
instance %(name)s can be used in the command.
259
current_checker_command: string; current running checker_command
260
changesignal: File descriptor; written to on object change
261
_reset: File descriptor; for flushing changesignal
262
delay: datetime.timedelta(); how long to wait for approval/secret
263
approved: bool(); None if not yet approved/disapproved
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
264
206
"""
265
266
@staticmethod
267
def _timedelta_to_milliseconds(td):
268
"Convert a datetime.timedelta() to milliseconds"
269
return ((td.days * 24 * 60 * 60 * 1000)
270
+ (td.seconds * 1000)
271
+ (td.microseconds // 1000))
272
273
207
def timeout_milliseconds(self):
274
208
"Return the 'timeout' attribute in milliseconds"
275
return self._timedelta_to_milliseconds(self.timeout)
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
276
212
277
213
def interval_milliseconds(self):
278
214
"Return the 'interval' attribute in milliseconds"
279
return self._timedelta_to_milliseconds(self.interval)
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
280
218
281
def __init__(self, name = None, disable_hook=None, config=None):
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
282
221
"""Note: the 'checker' key in 'config' sets the
283
222
'checker_command' attribute and *not* the 'checker'
284
223
attribute."""
286
225
if config is None:
287
226
config = {}
288
227
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
289
235
# Uppercase and remove spaces from fingerprint for later
290
236
# comparison purposes with return value from the fingerprint()
291
237
# function
292
self.fingerprint = (config[u"fingerprint"].upper()
238
self.fingerprint = (config["fingerprint"].upper()
293
239
.replace(u" ", u""))
294
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
295
if u"secret" in config:
296
self._secret = config[u"secret"].decode(u"base64")
297
elif u"secfile" in config:
298
with open(os.path.expanduser(os.path.expandvars
299
(config[u"secfile"])),
300
"rb") as secfile:
301
self._secret = secfile.read()
241
if "secret" in config:
242
self.secret = config["secret"].decode(u"base64")
243
elif "secfile" in config:
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
302
248
else:
303
#XXX Need to allow secret on demand!
304
249
raise TypeError(u"No secret or secfile for client %s"
305
250
% self.name)
306
self.host = config.get(u"host", u"")
251
self.host = config.get("host", "")
307
252
self.created = datetime.datetime.utcnow()
308
253
self.enabled = False
309
254
self.last_enabled = None
310
255
self.last_checked_ok = None
311
self.timeout = string_to_delta(config[u"timeout"])
312
self.interval = string_to_delta(config[u"interval"])
256
self.timeout = string_to_delta(config["timeout"])
257
self.interval = string_to_delta(config["interval"])
313
258
self.disable_hook = disable_hook
314
259
self.checker = None
315
260
self.checker_initiator_tag = None
316
261
self.disable_initiator_tag = None
317
262
self.checker_callback_tag = None
318
self.checker_command = config[u"checker"]
319
self.current_checker_command = None
320
self.last_connect = None
321
self.changesignal, self._reset = os.pipe()
322
self._approved = None #XXX should be based on configfile
323
self.delay = 10; #XXX Should be based on configfile
324
325
def setsecret(self, value):
326
self._secret = value
327
os.write(self.changesignal, "\0")
328
os.read(self._reset, 1)
329
330
secret = property(lambda self: self._secret, setsecret)
331
del setsecret
263
self.checker_command = config["checker"]
332
264
333
def setapproved(self, value):
334
self._approved = value
335
os.write(self.changesignal, "\0")
336
os.read(self._reset, 1)
337
338
approved = property(lambda self: self._approved, setapproved)
339
del setapproved
340
341
265
def enable(self):
342
266
"""Start this client's checker and timeout hooks"""
343
if getattr(self, u"enabled", False):
344
# Already enabled
345
return
346
267
self.last_enabled = datetime.datetime.utcnow()
347
268
# Schedule a new checker to be started an 'interval' from now,
348
269
# and every interval from then on.
349
270
self.checker_initiator_tag = (gobject.timeout_add
350
271
(self.interval_milliseconds(),
351
272
self.start_checker))
273
# Also start a new checker *right now*.
274
self.start_checker()
352
275
# Schedule a disable() when 'timeout' has passed
353
276
self.disable_initiator_tag = (gobject.timeout_add
354
277
(self.timeout_milliseconds(),
355
278
self.disable))
356
279
self.enabled = True
357
# Also start a new checker *right now*.
358
self.start_checker()
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
359
287
360
def disable(self, quiet=True):
288
def disable(self):
361
289
"""Disable this client."""
362
290
if not getattr(self, "enabled", False):
363
291
return False
364
if not quiet:
365
logger.info(u"Disabling client %s", self.name)
366
if getattr(self, u"disable_initiator_tag", False):
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
367
294
gobject.source_remove(self.disable_initiator_tag)
368
295
self.disable_initiator_tag = None
369
if getattr(self, u"checker_initiator_tag", False):
296
if getattr(self, "checker_initiator_tag", False):
370
297
gobject.source_remove(self.checker_initiator_tag)
371
298
self.checker_initiator_tag = None
372
299
self.stop_checker()
373
300
if self.disable_hook:
374
301
self.disable_hook(self)
375
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
376
307
# Do not run this again if called by a gobject.timeout_add
377
308
return False
378
309
384
315
"""The checker has completed, so take appropriate actions."""
385
316
self.checker_callback_tag = None
386
317
self.checker = None
387
if os.WIFEXITED(condition):
388
exitstatus = os.WEXITSTATUS(condition)
389
if exitstatus == 0:
390
logger.info(u"Checker for %(name)s succeeded",
391
vars(self))
392
self.checked_ok()
393
else:
394
logger.info(u"Checker for %(name)s failed",
395
vars(self))
396
else:
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
324
logger.info(u"Checker for %(name)s succeeded",
325
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
332
elif not os.WIFEXITED(condition):
397
333
logger.warning(u"Checker for %(name)s crashed?",
398
334
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
else:
341
logger.info(u"Checker for %(name)s failed",
342
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
399
348
400
def checked_ok(self):
349
def bump_timeout(self):
401
350
"""Bump up the timeout for this client.
402
403
351
This should only be called when the client has been seen,
404
352
alive and well.
405
353
"""
408
356
self.disable_initiator_tag = (gobject.timeout_add
409
357
(self.timeout_milliseconds(),
410
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
411
365
412
366
def start_checker(self):
413
367
"""Start a new checker subprocess if one is not running.
414
415
368
If a checker already exists, leave it running and do
416
369
nothing."""
417
370
# The reason for not killing a running checker is that if we
420
373
# client would inevitably timeout, since no checker would get
421
374
# a chance to run to completion. If we instead leave running
422
375
# checkers alone, the checker would have to take more time
423
# than 'timeout' for the client to be disabled, which is as it
424
# should be.
425
426
# If a checker exists, make sure it is not a zombie
427
try:
428
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
429
except (AttributeError, OSError), error:
430
if (isinstance(error, OSError)
431
and error.errno != errno.ECHILD):
432
raise error
433
else:
434
if pid:
435
logger.warning(u"Checker was a zombie")
436
gobject.source_remove(self.checker_callback_tag)
437
self.checker_callback(pid, status,
438
self.current_checker_command)
439
# Start a new checker if needed
376
# than 'timeout' for the client to be declared invalid, which
377
# is as it should be.
440
378
if self.checker is None:
441
379
try:
442
380
# In case checker_command has exactly one % operator
443
381
command = self.checker_command % self.host
444
382
except TypeError:
445
383
# Escape attributes for the shell
446
escaped_attrs = dict((key,
447
re.escape(unicode(str(val),
448
errors=
449
u'replace')))
384
escaped_attrs = dict((key, re.escape(str(val)))
450
385
for key, val in
451
386
vars(self).iteritems())
452
387
try:
455
390
logger.error(u'Could not format string "%s":'
456
391
u' %s', self.checker_command, error)
457
392
return True # Try again later
458
self.current_checker_command = command
459
393
try:
460
394
logger.info(u"Starting checker %r for %s",
461
395
command, self.name)
465
399
# always replaced by /dev/null.)
466
400
self.checker = subprocess.Popen(command,
467
401
close_fds=True,
468
shell=True, cwd=u"/")
402
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
469
409
self.checker_callback_tag = (gobject.child_watch_add
470
410
(self.checker.pid,
471
411
self.checker_callback,
472
412
data=command))
473
# The checker may have completed before the gobject
474
# watch was added. Check for this.
475
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
476
if pid:
477
gobject.source_remove(self.checker_callback_tag)
478
self.checker_callback(pid, status, command)
479
413
except OSError, error:
480
414
logger.error(u"Failed to start subprocess: %s",
481
415
error)
487
421
if self.checker_callback_tag:
488
422
gobject.source_remove(self.checker_callback_tag)
489
423
self.checker_callback_tag = None
490
if getattr(self, u"checker", None) is None:
424
if getattr(self, "checker", None) is None:
491
425
return
492
426
logger.debug(u"Stopping checker for %(name)s", vars(self))
493
427
try:
494
428
os.kill(self.checker.pid, signal.SIGTERM)
495
#time.sleep(0.5)
429
#os.sleep(0.5)
496
430
#if self.checker.poll() is None:
497
431
# os.kill(self.checker.pid, signal.SIGKILL)
498
432
except OSError, error:
499
433
if error.errno != errno.ESRCH: # No such process
500
434
raise
501
435
self.checker = None
502
503
504
def dbus_service_property(dbus_interface, signature=u"v",
505
access=u"readwrite", byte_arrays=False):
506
"""Decorators for marking methods of a DBusObjectWithProperties to
507
become properties on the D-Bus.
508
509
The decorated method will be called with no arguments by "Get"
510
and with one argument by "Set".
511
512
The parameters, where they are supported, are the same as
513
dbus.service.method, except there is only "signature", since the
514
type from Get() and the type sent to Set() is the same.
515
"""
516
# Encoding deeply encoded byte arrays is not supported yet by the
517
# "Set" method, so we fail early here:
518
if byte_arrays and signature != u"ay":
519
raise ValueError(u"Byte arrays not supported for non-'ay'"
520
u" signature %r" % signature)
521
def decorator(func):
522
func._dbus_is_property = True
523
func._dbus_interface = dbus_interface
524
func._dbus_signature = signature
525
func._dbus_access = access
526
func._dbus_name = func.__name__
527
if func._dbus_name.endswith(u"_dbus_property"):
528
func._dbus_name = func._dbus_name[:-14]
529
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
530
return func
531
return decorator
532
533
534
class DBusPropertyException(dbus.exceptions.DBusException):
535
"""A base class for D-Bus property-related exceptions
536
"""
537
def __unicode__(self):
538
return unicode(str(self))
539
540
541
class DBusPropertyAccessException(DBusPropertyException):
542
"""A property's access permissions disallows an operation.
543
"""
544
pass
545
546
547
class DBusPropertyNotFound(DBusPropertyException):
548
"""An attempt was made to access a non-existing property.
549
"""
550
pass
551
552
553
class DBusObjectWithProperties(dbus.service.Object):
554
"""A D-Bus object with properties.
555
556
Classes inheriting from this can use the dbus_service_property
557
decorator to expose methods as D-Bus properties. It exposes the
558
standard Get(), Set(), and GetAll() methods on the D-Bus.
559
"""
560
561
@staticmethod
562
def _is_dbus_property(obj):
563
return getattr(obj, u"_dbus_is_property", False)
564
565
def _get_all_dbus_properties(self):
566
"""Returns a generator of (name, attribute) pairs
567
"""
568
return ((prop._dbus_name, prop)
569
for name, prop in
570
inspect.getmembers(self, self._is_dbus_property))
571
572
def _get_dbus_property(self, interface_name, property_name):
573
"""Returns a bound method if one exists which is a D-Bus
574
property with the specified name and interface.
575
"""
576
for name in (property_name,
577
property_name + u"_dbus_property"):
578
prop = getattr(self, name, None)
579
if (prop is None
580
or not self._is_dbus_property(prop)
581
or prop._dbus_name != property_name
582
or (interface_name and prop._dbus_interface
583
and interface_name != prop._dbus_interface)):
584
continue
585
return prop
586
# No such property
587
raise DBusPropertyNotFound(self.dbus_object_path + u":"
588
+ interface_name + u"."
589
+ property_name)
590
591
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
592
out_signature=u"v")
593
def Get(self, interface_name, property_name):
594
"""Standard D-Bus property Get() method, see D-Bus standard.
595
"""
596
prop = self._get_dbus_property(interface_name, property_name)
597
if prop._dbus_access == u"write":
598
raise DBusPropertyAccessException(property_name)
599
value = prop()
600
if not hasattr(value, u"variant_level"):
601
return value
602
return type(value)(value, variant_level=value.variant_level+1)
603
604
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
605
def Set(self, interface_name, property_name, value):
606
"""Standard D-Bus property Set() method, see D-Bus standard.
607
"""
608
prop = self._get_dbus_property(interface_name, property_name)
609
if prop._dbus_access == u"read":
610
raise DBusPropertyAccessException(property_name)
611
if prop._dbus_get_args_options[u"byte_arrays"]:
612
# The byte_arrays option is not supported yet on
613
# signatures other than "ay".
614
if prop._dbus_signature != u"ay":
615
raise ValueError
616
value = dbus.ByteArray(''.join(unichr(byte)
617
for byte in value))
618
prop(value)
619
620
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
621
out_signature=u"a{sv}")
622
def GetAll(self, interface_name):
623
"""Standard D-Bus property GetAll() method, see D-Bus
624
standard.
625
626
Note: Will not include properties with access="write".
627
"""
628
all = {}
629
for name, prop in self._get_all_dbus_properties():
630
if (interface_name
631
and interface_name != prop._dbus_interface):
632
# Interface non-empty but did not match
633
continue
634
# Ignore write-only properties
635
if prop._dbus_access == u"write":
636
continue
637
value = prop()
638
if not hasattr(value, u"variant_level"):
639
all[name] = value
640
continue
641
all[name] = type(value)(value, variant_level=
642
value.variant_level+1)
643
return dbus.Dictionary(all, signature=u"sv")
644
645
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
646
out_signature=u"s",
647
path_keyword='object_path',
648
connection_keyword='connection')
649
def Introspect(self, object_path, connection):
650
"""Standard D-Bus method, overloaded to insert property tags.
651
"""
652
xmlstring = dbus.service.Object.Introspect(self, object_path,
653
connection)
654
try:
655
document = xml.dom.minidom.parseString(xmlstring)
656
def make_tag(document, name, prop):
657
e = document.createElement(u"property")
658
e.setAttribute(u"name", name)
659
e.setAttribute(u"type", prop._dbus_signature)
660
e.setAttribute(u"access", prop._dbus_access)
661
return e
662
for if_tag in document.getElementsByTagName(u"interface"):
663
for tag in (make_tag(document, name, prop)
664
for name, prop
665
in self._get_all_dbus_properties()
666
if prop._dbus_interface
667
== if_tag.getAttribute(u"name")):
668
if_tag.appendChild(tag)
669
# Add the names to the return values for the
670
# "org.freedesktop.DBus.Properties" methods
671
if (if_tag.getAttribute(u"name")
672
== u"org.freedesktop.DBus.Properties"):
673
for cn in if_tag.getElementsByTagName(u"method"):
674
if cn.getAttribute(u"name") == u"Get":
675
for arg in cn.getElementsByTagName(u"arg"):
676
if (arg.getAttribute(u"direction")
677
== u"out"):
678
arg.setAttribute(u"name", u"value")
679
elif cn.getAttribute(u"name") == u"GetAll":
680
for arg in cn.getElementsByTagName(u"arg"):
681
if (arg.getAttribute(u"direction")
682
== u"out"):
683
arg.setAttribute(u"name", u"props")
684
xmlstring = document.toxml(u"utf-8")
685
document.unlink()
686
except (AttributeError, xml.dom.DOMException,
687
xml.parsers.expat.ExpatError), error:
688
logger.error(u"Failed to override Introspection method",
689
error)
690
return xmlstring
691
692
693
class ClientDBus(Client, DBusObjectWithProperties):
694
"""A Client class using D-Bus
695
696
Attributes:
697
dbus_object_path: dbus.ObjectPath
698
bus: dbus.SystemBus()
699
"""
700
# dbus.service.Object doesn't use super(), so we can't either.
701
702
def __init__(self, bus = None, *args, **kwargs):
703
self.bus = bus
704
Client.__init__(self, *args, **kwargs)
705
# Only now, when this client is initialized, can it show up on
706
# the D-Bus
707
self.dbus_object_path = (dbus.ObjectPath
708
(u"/clients/"
709
+ self.name.replace(u".", u"_")))
710
DBusObjectWithProperties.__init__(self, self.bus,
711
self.dbus_object_path)
712
713
@staticmethod
714
def _datetime_to_dbus(dt, variant_level=0):
715
"""Convert a UTC datetime.datetime() to a D-Bus type."""
716
return dbus.String(dt.isoformat(),
717
variant_level=variant_level)
718
719
def enable(self):
720
oldstate = getattr(self, u"enabled", False)
721
r = Client.enable(self)
722
if oldstate != self.enabled:
723
# Emit D-Bus signals
724
self.PropertyChanged(dbus.String(u"enabled"),
725
dbus.Boolean(True, variant_level=1))
726
self.PropertyChanged(
727
dbus.String(u"last_enabled"),
728
self._datetime_to_dbus(self.last_enabled,
729
variant_level=1))
730
return r
731
732
def disable(self, quiet = False):
733
oldstate = getattr(self, u"enabled", False)
734
r = Client.disable(self, quiet=quiet)
735
if not quiet and oldstate != self.enabled:
736
# Emit D-Bus signal
737
self.PropertyChanged(dbus.String(u"enabled"),
738
dbus.Boolean(False, variant_level=1))
739
return r
740
741
def __del__(self, *args, **kwargs):
742
try:
743
self.remove_from_connection()
744
except LookupError:
745
pass
746
if hasattr(DBusObjectWithProperties, u"__del__"):
747
DBusObjectWithProperties.__del__(self, *args, **kwargs)
748
Client.__del__(self, *args, **kwargs)
749
750
def checker_callback(self, pid, condition, command,
751
*args, **kwargs):
752
self.checker_callback_tag = None
753
self.checker = None
754
# Emit D-Bus signal
755
self.PropertyChanged(dbus.String(u"checker_running"),
756
dbus.Boolean(False, variant_level=1))
757
if os.WIFEXITED(condition):
758
exitstatus = os.WEXITSTATUS(condition)
759
# Emit D-Bus signal
760
self.CheckerCompleted(dbus.Int16(exitstatus),
761
dbus.Int64(condition),
762
dbus.String(command))
763
else:
764
# Emit D-Bus signal
765
self.CheckerCompleted(dbus.Int16(-1),
766
dbus.Int64(condition),
767
dbus.String(command))
768
769
return Client.checker_callback(self, pid, condition, command,
770
*args, **kwargs)
771
772
def checked_ok(self, *args, **kwargs):
773
r = Client.checked_ok(self, *args, **kwargs)
774
# Emit D-Bus signal
775
self.PropertyChanged(
776
dbus.String(u"last_checked_ok"),
777
(self._datetime_to_dbus(self.last_checked_ok,
778
variant_level=1)))
779
return r
780
781
def start_checker(self, *args, **kwargs):
782
old_checker = self.checker
783
if self.checker is not None:
784
old_checker_pid = self.checker.pid
785
else:
786
old_checker_pid = None
787
r = Client.start_checker(self, *args, **kwargs)
788
# Only if new checker process was started
789
if (self.checker is not None
790
and old_checker_pid != self.checker.pid):
791
# Emit D-Bus signal
792
self.CheckerStarted(self.current_checker_command)
793
self.PropertyChanged(
794
dbus.String(u"checker_running"),
795
dbus.Boolean(True, variant_level=1))
796
return r
797
798
def stop_checker(self, *args, **kwargs):
799
old_checker = getattr(self, u"checker", None)
800
r = Client.stop_checker(self, *args, **kwargs)
801
if (old_checker is not None
802
and getattr(self, u"checker", None) is None):
436
if self.use_dbus:
803
437
self.PropertyChanged(dbus.String(u"checker_running"),
804
438
dbus.Boolean(False, variant_level=1))
805
return r
806
807
## D-Bus methods, signals & properties
808
_interface = u"se.bsnet.fukt.Mandos.Client"
809
810
## Signals
439
440
def still_valid(self):
441
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
445
if self.last_checked_ok is None:
446
return now < (self.created + self.timeout)
447
else:
448
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
811
456
812
457
# CheckerCompleted - signal
813
@dbus.service.signal(_interface, signature=u"nxs")
814
def CheckerCompleted(self, exitcode, waitstatus, command):
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
815
460
"D-Bus signal"
816
461
pass
817
462
818
463
# CheckerStarted - signal
819
@dbus.service.signal(_interface, signature=u"s")
464
@dbus.service.signal(_interface, signature="s")
820
465
def CheckerStarted(self, command):
821
466
"D-Bus signal"
822
467
pass
823
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
824
513
# PropertyChanged - signal
825
@dbus.service.signal(_interface, signature=u"sv")
514
@dbus.service.signal(_interface, signature="sv")
826
515
def PropertyChanged(self, property, value):
827
516
"D-Bus signal"
828
517
pass
829
518
830
# GotSecret - signal
831
@dbus.service.signal(_interface)
832
def GotSecret(self):
833
"D-Bus signal"
834
pass
835
836
# Rejected - signal
837
@dbus.service.signal(_interface)
838
def Rejected(self):
839
"D-Bus signal"
840
pass
841
842
## Methods
843
844
# CheckedOK - method
845
@dbus.service.method(_interface)
846
def CheckedOK(self):
847
return self.checked_ok()
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
848
562
849
563
# Enable - method
850
@dbus.service.method(_interface)
851
def Enable(self):
852
"D-Bus method"
853
self.enable()
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
854
566
855
567
# StartChecker - method
856
568
@dbus.service.method(_interface)
865
577
self.disable()
866
578
867
579
# StopChecker - method
868
@dbus.service.method(_interface)
869
def StopChecker(self):
870
self.stop_checker()
871
872
## Properties
873
874
# name - property
875
@dbus_service_property(_interface, signature=u"s", access=u"read")
876
def name_dbus_property(self):
877
return dbus.String(self.name)
878
879
# fingerprint - property
880
@dbus_service_property(_interface, signature=u"s", access=u"read")
881
def fingerprint_dbus_property(self):
882
return dbus.String(self.fingerprint)
883
884
# host - property
885
@dbus_service_property(_interface, signature=u"s",
886
access=u"readwrite")
887
def host_dbus_property(self, value=None):
888
if value is None: # get
889
return dbus.String(self.host)
890
self.host = value
891
# Emit D-Bus signal
892
self.PropertyChanged(dbus.String(u"host"),
893
dbus.String(value, variant_level=1))
894
895
# created - property
896
@dbus_service_property(_interface, signature=u"s", access=u"read")
897
def created_dbus_property(self):
898
return dbus.String(self._datetime_to_dbus(self.created))
899
900
# last_enabled - property
901
@dbus_service_property(_interface, signature=u"s", access=u"read")
902
def last_enabled_dbus_property(self):
903
if self.last_enabled is None:
904
return dbus.String(u"")
905
return dbus.String(self._datetime_to_dbus(self.last_enabled))
906
907
# enabled - property
908
@dbus_service_property(_interface, signature=u"b",
909
access=u"readwrite")
910
def enabled_dbus_property(self, value=None):
911
if value is None: # get
912
return dbus.Boolean(self.enabled)
913
if value:
914
self.enable()
915
else:
916
self.disable()
917
918
# last_checked_ok - property
919
@dbus_service_property(_interface, signature=u"s",
920
access=u"readwrite")
921
def last_checked_ok_dbus_property(self, value=None):
922
if value is not None:
923
self.checked_ok()
924
return
925
if self.last_checked_ok is None:
926
return dbus.String(u"")
927
return dbus.String(self._datetime_to_dbus(self
928
.last_checked_ok))
929
930
# timeout - property
931
@dbus_service_property(_interface, signature=u"t",
932
access=u"readwrite")
933
def timeout_dbus_property(self, value=None):
934
if value is None: # get
935
return dbus.UInt64(self.timeout_milliseconds())
936
self.timeout = datetime.timedelta(0, 0, 0, value)
937
# Emit D-Bus signal
938
self.PropertyChanged(dbus.String(u"timeout"),
939
dbus.UInt64(value, variant_level=1))
940
if getattr(self, u"disable_initiator_tag", None) is None:
941
return
942
# Reschedule timeout
943
gobject.source_remove(self.disable_initiator_tag)
944
self.disable_initiator_tag = None
945
time_to_die = (self.
946
_timedelta_to_milliseconds((self
947
.last_checked_ok
948
+ self.timeout)
949
- datetime.datetime
950
.utcnow()))
951
if time_to_die <= 0:
952
# The timeout has passed
953
self.disable()
954
else:
955
self.disable_initiator_tag = (gobject.timeout_add
956
(time_to_die, self.disable))
957
958
# interval - property
959
@dbus_service_property(_interface, signature=u"t",
960
access=u"readwrite")
961
def interval_dbus_property(self, value=None):
962
if value is None: # get
963
return dbus.UInt64(self.interval_milliseconds())
964
self.interval = datetime.timedelta(0, 0, 0, value)
965
# Emit D-Bus signal
966
self.PropertyChanged(dbus.String(u"interval"),
967
dbus.UInt64(value, variant_level=1))
968
if getattr(self, u"checker_initiator_tag", None) is None:
969
return
970
# Reschedule checker run
971
gobject.source_remove(self.checker_initiator_tag)
972
self.checker_initiator_tag = (gobject.timeout_add
973
(value, self.start_checker))
974
self.start_checker() # Start one now, too
975
976
# checker - property
977
@dbus_service_property(_interface, signature=u"s",
978
access=u"readwrite")
979
def checker_dbus_property(self, value=None):
980
if value is None: # get
981
return dbus.String(self.checker_command)
982
self.checker_command = value
983
# Emit D-Bus signal
984
self.PropertyChanged(dbus.String(u"checker"),
985
dbus.String(self.checker_command,
986
variant_level=1))
987
988
# checker_running - property
989
@dbus_service_property(_interface, signature=u"b",
990
access=u"readwrite")
991
def checker_running_dbus_property(self, value=None):
992
if value is None: # get
993
return dbus.Boolean(self.checker is not None)
994
if value:
995
self.start_checker()
996
else:
997
self.stop_checker()
998
999
# object_path - property
1000
@dbus_service_property(_interface, signature=u"o", access=u"read")
1001
def object_path_dbus_property(self):
1002
return self.dbus_object_path # is already a dbus.ObjectPath
1003
1004
# secret = property
1005
@dbus_service_property(_interface, signature=u"ay",
1006
access=u"write", byte_arrays=True)
1007
def secret_dbus_property(self, value):
1008
self.secret = str(value)
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
1009
582
1010
583
del _interface
1011
584
1012
585
1013
class ClientHandler(socketserver.BaseRequestHandler, object):
1014
"""A class to handle client connections.
1015
1016
Instantiated once for each connection to handle it.
586
def peer_certificate(session):
587
"Return the peer's OpenPGP certificate as a bytestring"
588
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
592
# ...do the normal thing
593
return session.peer_certificate
594
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
598
if list_size.value == 0:
599
return None
600
cert = cert_list[0]
601
return ctypes.string_at(cert.data, cert.size)
602
603
604
def fingerprint(openpgp):
605
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
612
# New empty GnuTLS certificate
613
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
616
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
621
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
628
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
631
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
635
# Deinit the certificate
636
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
639
# Convert the bytestring to hexadecimal notation
640
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
641
return hex_fpr
642
643
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
645
"""A TCP request handler class.
646
Instantiated by IPv6_TCPServer for each request to handle it.
1017
647
Note: This will run in its own forked process."""
1018
648
1019
649
def handle(self):
1020
650
logger.info(u"TCP connection from: %s",
1021
651
unicode(self.client_address))
1022
logger.debug(u"IPC Pipe FD: %d",
1023
self.server.child_pipe[1].fileno())
1024
# Open IPC pipe to parent process
1025
with contextlib.nested(self.server.child_pipe[1],
1026
self.server.parent_pipe[0]
1027
) as (ipc, ipc_return):
1028
session = (gnutls.connection
1029
.ClientSession(self.request,
1030
gnutls.connection
1031
.X509Credentials()))
1032
1033
line = self.request.makefile().readline()
1034
logger.debug(u"Protocol version: %r", line)
1035
try:
1036
if int(line.strip().split()[0]) > 1:
1037
raise RuntimeError
1038
except (ValueError, IndexError, RuntimeError), error:
1039
logger.error(u"Unknown protocol version: %s", error)
1040
return
1041
1042
# Note: gnutls.connection.X509Credentials is really a
1043
# generic GnuTLS certificate credentials object so long as
1044
# no X.509 keys are added to it. Therefore, we can use it
1045
# here despite using OpenPGP certificates.
1046
1047
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1048
# u"+AES-256-CBC", u"+SHA1",
1049
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1050
# u"+DHE-DSS"))
1051
# Use a fallback default, since this MUST be set.
1052
priority = self.server.gnutls_priority
1053
if priority is None:
1054
priority = u"NORMAL"
1055
(gnutls.library.functions
1056
.gnutls_priority_set_direct(session._c_object,
1057
priority, None))
1058
1059
try:
1060
session.handshake()
1061
except gnutls.errors.GNUTLSError, error:
1062
logger.warning(u"Handshake failed: %s", error)
1063
# Do not run session.bye() here: the session is not
1064
# established. Just abandon the request.
1065
return
1066
logger.debug(u"Handshake succeeded")
1067
try:
1068
try:
1069
fpr = self.fingerprint(self.peer_certificate
1070
(session))
1071
except (TypeError, gnutls.errors.GNUTLSError), error:
1072
logger.warning(u"Bad certificate: %s", error)
1073
return
1074
logger.debug(u"Fingerprint: %s", fpr)
1075
1076
for c in self.server.clients:
1077
if c.fingerprint == fpr:
1078
client = c
1079
break
1080
else:
1081
ipc.write(u"NOTFOUND %s %s\n"
1082
% (fpr, unicode(self.client_address)))
1083
return
1084
1085
class proxyclient(object):
1086
def __getattribute__(self, name):
1087
ipc.write(u"GETATTR %s %s\n" % name, client.fpr)
1088
return pickle.load(ipc_reply)
1089
p = proxyclient(client)
1090
1091
while True:
1092
if not p.client.enabled:
1093
icp.write("DISABLED %s\n" % client.fpr)
1094
return
1095
if p.client.approved == False:
1096
icp.write("Disaproved")
1097
return
1098
1099
if not p.client.secret:
1100
icp.write("No password")
1101
elif not p.client.approved:
1102
icp.write("Need approval"):
1103
else:
1104
#We have a password and are approved
1105
break
1106
i, o, e = select(p.changesignal, (), (), client.delay)
1107
if not i:
1108
icp.write("Timeout passed")
1109
return
1110
1111
ipc.write(u"SENDING %s\n" % client.name)
1112
sent_size = 0
1113
while sent_size < len(client.secret):
1114
sent = session.send(client.secret[sent_size:])
1115
logger.debug(u"Sent: %d, remaining: %d",
1116
sent, len(client.secret)
1117
- (sent_size + sent))
1118
sent_size += sent
1119
finally:
1120
session.bye()
1121
1122
@staticmethod
1123
def peer_certificate(session):
1124
"Return the peer's OpenPGP certificate as a bytestring"
1125
# If not an OpenPGP certificate...
1126
if (gnutls.library.functions
1127
.gnutls_certificate_type_get(session._c_object)
1128
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1129
# ...do the normal thing
1130
return session.peer_certificate
1131
list_size = ctypes.c_uint(1)
1132
cert_list = (gnutls.library.functions
1133
.gnutls_certificate_get_peers
1134
(session._c_object, ctypes.byref(list_size)))
1135
if not bool(cert_list) and list_size.value != 0:
1136
raise gnutls.errors.GNUTLSError(u"error getting peer"
1137
u" certificate")
1138
if list_size.value == 0:
1139
return None
1140
cert = cert_list[0]
1141
return ctypes.string_at(cert.data, cert.size)
1142
1143
@staticmethod
1144
def fingerprint(openpgp):
1145
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1146
# New GnuTLS "datum" with the OpenPGP public key
1147
datum = (gnutls.library.types
1148
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1149
ctypes.POINTER
1150
(ctypes.c_ubyte)),
1151
ctypes.c_uint(len(openpgp))))
1152
# New empty GnuTLS certificate
1153
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1154
(gnutls.library.functions
1155
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1156
# Import the OpenPGP public key into the certificate
1157
(gnutls.library.functions
1158
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1159
gnutls.library.constants
1160
.GNUTLS_OPENPGP_FMT_RAW))
1161
# Verify the self signature in the key
1162
crtverify = ctypes.c_uint()
1163
(gnutls.library.functions
1164
.gnutls_openpgp_crt_verify_self(crt, 0,
1165
ctypes.byref(crtverify)))
1166
if crtverify.value != 0:
1167
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1168
raise (gnutls.errors.CertificateSecurityError
1169
(u"Verify failed"))
1170
# New buffer for the fingerprint
1171
buf = ctypes.create_string_buffer(20)
1172
buf_len = ctypes.c_size_t()
1173
# Get the fingerprint from the certificate into the buffer
1174
(gnutls.library.functions
1175
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1176
ctypes.byref(buf_len)))
1177
# Deinit the certificate
1178
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1179
# Convert the buffer to a Python bytestring
1180
fpr = ctypes.string_at(buf, buf_len.value)
1181
# Convert the bytestring to hexadecimal notation
1182
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1183
return hex_fpr
1184
1185
1186
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1187
"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1188
def process_request(self, request, client_address):
1189
"""Overrides and wraps the original process_request().
1190
1191
This function creates a new pipe in self.pipe
1192
"""
1193
# Child writes to child_pipe
1194
self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1195
# Parent writes to parent_pipe
1196
self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1197
super(ForkingMixInWithPipes,
1198
self).process_request(request, client_address)
1199
# Close unused ends for parent
1200
self.parent_pipe[0].close() # close read end
1201
self.child_pipe[1].close() # close write end
1202
self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1203
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1204
"""Dummy function; override as necessary"""
1205
child_pipe_fd.close()
1206
parent_pipe_fd.close()
1207
1208
1209
class IPv6_TCPServer(ForkingMixInWithPipes,
1210
socketserver.TCPServer, object):
1211
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1212
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
656
657
line = self.request.makefile().readline()
658
logger.debug(u"Protocol version: %r", line)
659
try:
660
if int(line.strip().split()[0]) > 1:
661
raise RuntimeError
662
except (ValueError, IndexError, RuntimeError), error:
663
logger.error(u"Unknown protocol version: %s", error)
664
return
665
666
# Note: gnutls.connection.X509Credentials is really a generic
667
# GnuTLS certificate credentials object so long as no X.509
668
# keys are added to it. Therefore, we can use it here despite
669
# using OpenPGP certificates.
670
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
673
# "+DHE-DSS"))
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
679
680
try:
681
session.handshake()
682
except gnutls.errors.GNUTLSError, error:
683
logger.warning(u"Handshake failed: %s", error)
684
# Do not run session.bye() here: the session is not
685
# established. Just abandon the request.
686
return
687
try:
688
fpr = fingerprint(peer_certificate(session))
689
except (TypeError, gnutls.errors.GNUTLSError), error:
690
logger.warning(u"Bad certificate: %s", error)
691
session.bye()
692
return
693
logger.debug(u"Fingerprint: %s", fpr)
694
for c in self.server.clients:
695
if c.fingerprint == fpr:
696
client = c
697
break
698
else:
699
logger.warning(u"Client not found for fingerprint: %s",
700
fpr)
701
session.bye()
702
return
703
# Have to check if client.still_valid(), since it is possible
704
# that the client timed out while establishing the GnuTLS
705
# session.
706
if not client.still_valid():
707
logger.warning(u"Client %(name)s is invalid",
708
vars(client))
709
session.bye()
710
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
713
sent_size = 0
714
while sent_size < len(client.secret):
715
sent = session.send(client.secret[sent_size:])
716
logger.debug(u"Sent: %d, remaining: %d",
717
sent, len(client.secret)
718
- (sent_size + sent))
719
sent_size += sent
720
session.bye()
721
722
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1213
726
Attributes:
727
settings: Server settings
728
clients: Set() of Client objects
1214
729
enabled: Boolean; whether this server is activated yet
1215
interface: None or a network interface name (string)
1216
use_ipv6: Boolean; to use IPv6 or not
1217
730
"""
1218
def __init__(self, server_address, RequestHandlerClass,
1219
interface=None, use_ipv6=True):
1220
self.interface = interface
1221
if use_ipv6:
1222
self.address_family = socket.AF_INET6
1223
socketserver.TCPServer.__init__(self, server_address,
1224
RequestHandlerClass)
731
address_family = socket.AF_INET6
732
def __init__(self, *args, **kwargs):
733
if "settings" in kwargs:
734
self.settings = kwargs["settings"]
735
del kwargs["settings"]
736
if "clients" in kwargs:
737
self.clients = kwargs["clients"]
738
del kwargs["clients"]
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1225
741
def server_bind(self):
1226
742
"""This overrides the normal server_bind() function
1227
743
to bind to an interface if one was specified, and also NOT to
1228
744
bind to an address or port if they were not specified."""
1229
if self.interface is not None:
1230
if SO_BINDTODEVICE is None:
1231
logger.error(u"SO_BINDTODEVICE does not exist;"
1232
u" cannot bind to interface %s",
1233
self.interface)
1234
else:
1235
try:
1236
self.socket.setsockopt(socket.SOL_SOCKET,
1237
SO_BINDTODEVICE,
1238
str(self.interface
1239
+ u'\0'))
1240
except socket.error, error:
1241
if error[0] == errno.EPERM:
1242
logger.error(u"No permission to"
1243
u" bind to interface %s",
1244
self.interface)
1245
elif error[0] == errno.ENOPROTOOPT:
1246
logger.error(u"SO_BINDTODEVICE not available;"
1247
u" cannot bind to interface %s",
1248
self.interface)
1249
else:
1250
raise
745
if self.settings["interface"]:
746
# 25 is from /usr/include/asm-i486/socket.h
747
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
748
try:
749
self.socket.setsockopt(socket.SOL_SOCKET,
750
SO_BINDTODEVICE,
751
self.settings["interface"])
752
except socket.error, error:
753
if error[0] == errno.EPERM:
754
logger.error(u"No permission to"
755
u" bind to interface %s",
756
self.settings["interface"])
757
else:
758
raise error
1251
759
# Only bind(2) the socket if we really need to.
1252
760
if self.server_address[0] or self.server_address[1]:
1253
761
if not self.server_address[0]:
1254
if self.address_family == socket.AF_INET6:
1255
any_address = u"::" # in6addr_any
1256
else:
1257
any_address = socket.INADDR_ANY
1258
self.server_address = (any_address,
762
in6addr_any = "::"
763
self.server_address = (in6addr_any,
1259
764
self.server_address[1])
1260
765
elif not self.server_address[1]:
1261
766
self.server_address = (self.server_address[0],
1262
767
0)
1263
# if self.interface:
768
# if self.settings["interface"]:
1264
769
# self.server_address = (self.server_address[0],
1265
770
# 0, # port
1266
771
# 0, # flowinfo
1267
772
# if_nametoindex
1268
# (self.interface))
1269
return socketserver.TCPServer.server_bind(self)
1270
1271
1272
class MandosServer(IPv6_TCPServer):
1273
"""Mandos server.
1274
1275
Attributes:
1276
clients: set of Client objects
1277
gnutls_priority GnuTLS priority string
1278
use_dbus: Boolean; to emit D-Bus signals or not
1279
1280
Assumes a gobject.MainLoop event loop.
1281
"""
1282
def __init__(self, server_address, RequestHandlerClass,
1283
interface=None, use_ipv6=True, clients=None,
1284
gnutls_priority=None, use_dbus=True):
1285
self.enabled = False
1286
self.clients = clients
1287
if self.clients is None:
1288
self.clients = set()
1289
self.use_dbus = use_dbus
1290
self.gnutls_priority = gnutls_priority
1291
IPv6_TCPServer.__init__(self, server_address,
1292
RequestHandlerClass,
1293
interface = interface,
1294
use_ipv6 = use_ipv6)
773
# (self.settings
774
# ["interface"]))
775
return super(IPv6_TCPServer, self).server_bind()
1295
776
def server_activate(self):
1296
777
if self.enabled:
1297
return socketserver.TCPServer.server_activate(self)
778
return super(IPv6_TCPServer, self).server_activate()
1298
779
def enable(self):
1299
780
self.enabled = True
1300
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1301
# Call "handle_ipc" for both data and EOF events
1302
gobject.io_add_watch(child_pipe_fd.fileno(),
1303
gobject.IO_IN | gobject.IO_HUP,
1304
functools.partial(self.handle_ipc,
1305
reply = parent_pipe_fd,
1306
sender= child_pipe_fd))
1307
def handle_ipc(self, source, condition, reply=None, sender=None):
1308
condition_names = {
1309
gobject.IO_IN: u"IN", # There is data to read.
1310
gobject.IO_OUT: u"OUT", # Data can be written (without
1311
# blocking).
1312
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1313
gobject.IO_ERR: u"ERR", # Error condition.
1314
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1315
# broken, usually for pipes and
1316
# sockets).
1317
}
1318
conditions_string = ' | '.join(name
1319
for cond, name in
1320
condition_names.iteritems()
1321
if cond & condition)
1322
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1323
conditions_string)
1324
1325
# Read a line from the file object
1326
cmdline = sender.readline()
1327
if not cmdline: # Empty line means end of file
1328
# close the IPC pipes
1329
sender.close()
1330
reply.close()
1331
1332
# Stop calling this function
1333
return False
1334
1335
logger.debug(u"IPC command: %r", cmdline)
1336
1337
# Parse and act on command
1338
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1339
1340
if cmd == u"NOTFOUND":
1341
fpr, address = args.split(None, 1)
1342
logger.warning(u"Client not found for fingerprint: %s, ad"
1343
u"dress: %s", fpr, address)
1344
if self.use_dbus:
1345
# Emit D-Bus signal
1346
mandos_dbus_service.ClientNotFound(fpr, address)
1347
elif cmd == u"DISABLED":
1348
for client in self.clients:
1349
if client.name == args:
1350
logger.warning(u"Client %s is disabled", args)
1351
if self.use_dbus:
1352
# Emit D-Bus signal
1353
client.Rejected()
1354
break
1355
else:
1356
logger.error(u"Unknown client %s is disabled", args)
1357
elif cmd == u"SENDING":
1358
for client in self.clients:
1359
if client.name == args:
1360
logger.info(u"Sending secret to %s", client.name)
1361
client.checked_ok()
1362
if self.use_dbus:
1363
# Emit D-Bus signal
1364
client.GotSecret()
1365
break
1366
else:
1367
logger.error(u"Sending secret to unknown client %s",
1368
args)
1369
elif cmd == u"GETATTR":
1370
attr_name, fpr = args.split(None, 1)
1371
for client in self.clients:
1372
if client.fingerprint == fpr:
1373
attr_value = getattr(client, attr_name, None)
1374
logger.debug("IPC reply: %r", attr_value)
1375
pickle.dump(attr_value, reply)
1376
break
1377
else:
1378
logger.error(u"Client %s on address %s requesting "
1379
u"attribute %s not found", fpr, address,
1380
attr_name)
1381
pickle.dump(None, reply)
1382
else:
1383
logger.error(u"Unknown IPC command: %r", cmdline)
1384
1385
# Keep calling this function
1386
return True
1387
781
1388
782
1389
783
def string_to_delta(interval):
1390
784
"""Parse a string and return a datetime.timedelta
1391
1392
>>> string_to_delta(u'7d')
785
786
>>> string_to_delta('7d')
1393
787
datetime.timedelta(7)
1394
>>> string_to_delta(u'60s')
788
>>> string_to_delta('60s')
1395
789
datetime.timedelta(0, 60)
1396
>>> string_to_delta(u'60m')
790
>>> string_to_delta('60m')
1397
791
datetime.timedelta(0, 3600)
1398
>>> string_to_delta(u'24h')
792
>>> string_to_delta('24h')
1399
793
datetime.timedelta(1)
1400
794
>>> string_to_delta(u'1w')
1401
795
datetime.timedelta(7)
1402
>>> string_to_delta(u'5m 30s')
796
>>> string_to_delta('5m 30s')
1403
797
datetime.timedelta(0, 330)
1404
798
"""
1405
799
timevalue = datetime.timedelta(0)
1418
812
elif suffix == u"w":
1419
813
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1420
814
else:
1421
raise ValueError(u"Unknown suffix %r" % suffix)
1422
except (ValueError, IndexError), e:
1423
raise ValueError(e.message)
815
raise ValueError
816
except (ValueError, IndexError):
817
raise ValueError
1424
818
timevalue += delta
1425
819
return timevalue
1426
820
1427
821
822
def server_state_changed(state):
823
"""Derived from the Avahi example code"""
824
if state == avahi.SERVER_COLLISION:
825
logger.error(u"Zeroconf server name collision")
826
service.remove()
827
elif state == avahi.SERVER_RUNNING:
828
service.add()
829
830
831
def entry_group_state_changed(state, error):
832
"""Derived from the Avahi example code"""
833
logger.debug(u"Avahi state change: %i", state)
834
835
if state == avahi.ENTRY_GROUP_ESTABLISHED:
836
logger.debug(u"Zeroconf service established.")
837
elif state == avahi.ENTRY_GROUP_COLLISION:
838
logger.warning(u"Zeroconf service name collision.")
839
service.rename()
840
elif state == avahi.ENTRY_GROUP_FAILURE:
841
logger.critical(u"Avahi: Error in group state changed %s",
842
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
844
1428
845
def if_nametoindex(interface):
1429
"""Call the C function if_nametoindex(), or equivalent
1430
1431
Note: This function cannot accept a unicode string."""
846
"""Call the C function if_nametoindex(), or equivalent"""
1432
847
global if_nametoindex
1433
848
try:
1434
849
if_nametoindex = (ctypes.cdll.LoadLibrary
1435
(ctypes.util.find_library(u"c"))
850
(ctypes.util.find_library("c"))
1436
851
.if_nametoindex)
1437
852
except (OSError, AttributeError):
1438
logger.warning(u"Doing if_nametoindex the hard way")
853
if "struct" not in sys.modules:
854
import struct
855
if "fcntl" not in sys.modules:
856
import fcntl
1439
857
def if_nametoindex(interface):
1440
858
"Get an interface index the hard way, i.e. using fcntl()"
1441
859
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1442
with contextlib.closing(socket.socket()) as s:
860
with closing(socket.socket()) as s:
1443
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1444
struct.pack(str(u"16s16x"),
1445
interface))
1446
interface_index = struct.unpack(str(u"I"),
1447
ifreq[16:20])[0]
862
struct.pack("16s16x", interface))
863
interface_index = struct.unpack("I", ifreq[16:20])[0]
1448
864
return interface_index
1449
865
return if_nametoindex(interface)
1450
866
1451
867
1452
868
def daemon(nochdir = False, noclose = False):
1453
869
"""See daemon(3). Standard BSD Unix function.
1454
1455
870
This should really exist as os.daemon, but it doesn't (yet)."""
1456
871
if os.fork():
1457
872
sys.exit()
1458
873
os.setsid()
1459
874
if not nochdir:
1460
os.chdir(u"/")
875
os.chdir("/")
1461
876
if os.fork():
1462
877
sys.exit()
1463
878
if not noclose:
1465
880
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1466
881
if not stat.S_ISCHR(os.fstat(null).st_mode):
1467
882
raise OSError(errno.ENODEV,
1468
u"%s not a character device"
1469
% os.path.devnull)
883
"/dev/null not a character device")
1470
884
os.dup2(null, sys.stdin.fileno())
1471
885
os.dup2(null, sys.stdout.fileno())
1472
886
os.dup2(null, sys.stderr.fileno())
1475
889
1476
890
1477
891
def main():
1478
1479
##################################################################
1480
# Parsing of options, both command line and config file
1481
1482
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
1483
parser.add_option("-i", u"--interface", type=u"string",
1484
metavar="IF", help=u"Bind to interface IF")
1485
parser.add_option("-a", u"--address", type=u"string",
1486
help=u"Address to listen for requests on")
1487
parser.add_option("-p", u"--port", type=u"int",
1488
help=u"Port number to receive requests on")
1489
parser.add_option("--check", action=u"store_true",
1490
help=u"Run self-test")
1491
parser.add_option("--debug", action=u"store_true",
1492
help=u"Debug mode; run in foreground and log to"
1493
u" terminal")
1494
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1495
u" priority string (see GnuTLS documentation)")
1496
parser.add_option("--servicename", type=u"string",
1497
metavar=u"NAME", help=u"Zeroconf service name")
1498
parser.add_option("--configdir", type=u"string",
1499
default=u"/etc/mandos", metavar=u"DIR",
1500
help=u"Directory to search for configuration"
1501
u" files")
1502
parser.add_option("--no-dbus", action=u"store_false",
1503
dest=u"use_dbus", help=u"Do not provide D-Bus"
1504
u" system bus interface")
1505
parser.add_option("--no-ipv6", action=u"store_false",
1506
dest=u"use_ipv6", help=u"Do not use IPv6")
893
parser.add_option("-i", "--interface", type="string",
894
metavar="IF", help="Bind to interface IF")
895
parser.add_option("-a", "--address", type="string",
896
help="Address to listen for requests on")
897
parser.add_option("-p", "--port", type="int",
898
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
900
help="Run self-test")
901
parser.add_option("--debug", action="store_true",
902
help="Debug mode; run in foreground and log to"
903
" terminal")
904
parser.add_option("--priority", type="string", help="GnuTLS"
905
" priority string (see GnuTLS documentation)")
906
parser.add_option("--servicename", type="string", metavar="NAME",
907
help="Zeroconf service name")
908
parser.add_option("--configdir", type="string",
909
default="/etc/mandos", metavar="DIR",
910
help="Directory to search for configuration"
911
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
1507
916
options = parser.parse_args()[0]
1508
917
1509
918
if options.check:
1512
921
sys.exit()
1513
922
1514
923
# Default values for config file for server-global settings
1515
server_defaults = { u"interface": u"",
1516
u"address": u"",
1517
u"port": u"",
1518
u"debug": u"False",
1519
u"priority":
1520
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1521
u"servicename": u"Mandos",
1522
u"use_dbus": u"True",
1523
u"use_ipv6": u"True",
924
server_defaults = { "interface": "",
925
"address": "",
926
"port": "",
927
"debug": "False",
928
"priority":
929
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
"servicename": "Mandos",
931
"use_dbus": "True",
1524
932
}
1525
933
1526
934
# Parse config file for server-global settings
1527
server_config = configparser.SafeConfigParser(server_defaults)
935
server_config = ConfigParser.SafeConfigParser(server_defaults)
1528
936
del server_defaults
1529
server_config.read(os.path.join(options.configdir,
1530
u"mandos.conf"))
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1531
938
# Convert the SafeConfigParser object to a dict
1532
939
server_settings = server_config.defaults()
1533
# Use the appropriate methods on the non-string config options
1534
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1535
server_settings[option] = server_config.getboolean(u"DEFAULT",
1536
option)
1537
if server_settings["port"]:
1538
server_settings["port"] = server_config.getint(u"DEFAULT",
1539
u"port")
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
1540
945
del server_config
1541
946
1542
947
# Override the settings from the config file with command line
1543
948
# options, if set.
1544
for option in (u"interface", u"address", u"port", u"debug",
1545
u"priority", u"servicename", u"configdir",
1546
u"use_dbus", u"use_ipv6"):
949
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
951
"use_dbus"):
1547
952
value = getattr(options, option)
1548
953
if value is not None:
1549
954
server_settings[option] = value
1550
955
del options
1551
# Force all strings to be unicode
1552
for option in server_settings.keys():
1553
if type(server_settings[option]) is str:
1554
server_settings[option] = unicode(server_settings[option])
1555
956
# Now we have our good server settings in "server_settings"
1556
957
1557
##################################################################
1558
1559
958
# For convenience
1560
debug = server_settings[u"debug"]
1561
use_dbus = server_settings[u"use_dbus"]
1562
use_ipv6 = server_settings[u"use_ipv6"]
959
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
1563
961
1564
962
if not debug:
1565
963
syslogger.setLevel(logging.WARNING)
1566
964
console.setLevel(logging.WARNING)
1567
965
1568
if server_settings[u"servicename"] != u"Mandos":
966
if server_settings["servicename"] != "Mandos":
1569
967
syslogger.setFormatter(logging.Formatter
1570
(u'Mandos (%s) [%%(process)d]:'
1571
u' %%(levelname)s: %%(message)s'
1572
% server_settings[u"servicename"]))
968
('Mandos (%s): %%(levelname)s:'
969
' %%(message)s'
970
% server_settings["servicename"]))
1573
971
1574
972
# Parse config file with clients
1575
client_defaults = { u"timeout": u"1h",
1576
u"interval": u"5m",
1577
u"checker": u"fping -q -- %%(host)s",
1578
u"host": u"",
973
client_defaults = { "timeout": "1h",
974
"interval": "5m",
975
"checker": "fping -q -- %%(host)s",
976
"host": "",
1579
977
}
1580
client_config = configparser.SafeConfigParser(client_defaults)
1581
client_config.read(os.path.join(server_settings[u"configdir"],
1582
u"clients.conf"))
1583
1584
global mandos_dbus_service
1585
mandos_dbus_service = None
1586
1587
tcp_server = MandosServer((server_settings[u"address"],
1588
server_settings[u"port"]),
1589
ClientHandler,
1590
interface=server_settings[u"interface"],
1591
use_ipv6=use_ipv6,
1592
gnutls_priority=
1593
server_settings[u"priority"],
1594
use_dbus=use_dbus)
1595
pidfilename = u"/var/run/mandos.pid"
1596
try:
1597
pidfile = open(pidfilename, u"w")
1598
except IOError:
1599
logger.error(u"Could not open file %r", pidfilename)
1600
1601
try:
1602
uid = pwd.getpwnam(u"_mandos").pw_uid
1603
gid = pwd.getpwnam(u"_mandos").pw_gid
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
979
client_config.read(os.path.join(server_settings["configdir"],
980
"clients.conf"))
981
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
1604
997
except KeyError:
1605
998
try:
1606
uid = pwd.getpwnam(u"mandos").pw_uid
1607
gid = pwd.getpwnam(u"mandos").pw_gid
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1608
1001
except KeyError:
1609
1002
try:
1610
uid = pwd.getpwnam(u"nobody").pw_uid
1611
gid = pwd.getpwnam(u"nobody").pw_gid
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1612
1005
except KeyError:
1613
1006
uid = 65534
1614
1007
gid = 65534
1615
1008
try:
1009
os.setuid(uid)
1616
1010
os.setgid(gid)
1617
os.setuid(uid)
1618
1011
except OSError, error:
1619
1012
if error[0] != errno.EPERM:
1620
1013
raise error
1621
1014
1622
# Enable all possible GnuTLS debugging
1623
if debug:
1624
# "Use a log level over 10 to enable all debugging options."
1625
# - GnuTLS manual
1626
gnutls.library.functions.gnutls_global_set_log_level(11)
1627
1628
@gnutls.library.types.gnutls_log_func
1629
def debug_gnutls(level, string):
1630
logger.debug(u"GnuTLS: %s", string[:-1])
1631
1632
(gnutls.library.functions
1633
.gnutls_global_set_log_function(debug_gnutls))
1015
global service
1016
service = AvahiService(name = server_settings["servicename"],
1017
servicetype = "_mandos._tcp", )
1018
if server_settings["interface"]:
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
1634
1021
1635
1022
global main_loop
1023
global bus
1024
global server
1636
1025
# From the Avahi example code
1637
1026
DBusGMainLoop(set_as_default=True )
1638
1027
main_loop = gobject.MainLoop()
1639
1028
bus = dbus.SystemBus()
1029
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1030
avahi.DBUS_PATH_SERVER),
1031
avahi.DBUS_INTERFACE_SERVER)
1640
1032
# End of Avahi example code
1641
1033
if use_dbus:
1642
try:
1643
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1644
bus, do_not_queue=True)
1645
except dbus.exceptions.NameExistsException, e:
1646
logger.error(unicode(e) + u", disabling D-Bus")
1647
use_dbus = False
1648
server_settings[u"use_dbus"] = False
1649
tcp_server.use_dbus = False
1650
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1651
service = AvahiService(name = server_settings[u"servicename"],
1652
servicetype = u"_mandos._tcp",
1653
protocol = protocol, bus = bus)
1654
if server_settings["interface"]:
1655
service.interface = (if_nametoindex
1656
(str(server_settings[u"interface"])))
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
1657
1036
1658
client_class = Client
1659
if use_dbus:
1660
client_class = functools.partial(ClientDBus, bus = bus)
1661
tcp_server.clients.update(set(
1662
client_class(name = section,
1663
config= dict(client_config.items(section)))
1664
for section in client_config.sections()))
1665
if not tcp_server.clients:
1037
clients.update(Set(Client(name = section,
1038
config
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
1041
for section in client_config.sections()))
1042
if not clients:
1666
1043
logger.warning(u"No clients defined")
1667
1044
1668
1045
if debug:
1678
1055
daemon()
1679
1056
1680
1057
try:
1681
with pidfile:
1682
pid = os.getpid()
1683
pidfile.write(str(pid) + "\n")
1058
pid = os.getpid()
1059
pidfile.write(str(pid) + "\n")
1060
pidfile.close()
1684
1061
del pidfile
1685
1062
except IOError:
1686
1063
logger.error(u"Could not write to file %r with PID %d",
1690
1067
pass
1691
1068
del pidfilename
1692
1069
1070
def cleanup():
1071
"Cleanup function; run on exit"
1072
global group
1073
# From the Avahi example code
1074
if not group is None:
1075
group.Free()
1076
group = None
1077
# End of Avahi example code
1078
1079
while clients:
1080
client = clients.pop()
1081
client.disable_hook = None
1082
client.disable()
1083
1084
atexit.register(cleanup)
1085
1693
1086
if not debug:
1694
1087
signal.signal(signal.SIGINT, signal.SIG_IGN)
1695
1088
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1696
1089
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1697
1090
1698
1091
if use_dbus:
1699
class MandosDBusService(dbus.service.Object):
1092
class MandosServer(dbus.service.Object):
1700
1093
"""A D-Bus proxy object"""
1701
1094
def __init__(self):
1702
dbus.service.Object.__init__(self, bus, u"/")
1703
_interface = u"se.bsnet.fukt.Mandos"
1704
1705
@dbus.service.signal(_interface, signature=u"o")
1706
def ClientAdded(self, objpath):
1707
"D-Bus signal"
1708
pass
1709
1710
@dbus.service.signal(_interface, signature=u"ss")
1711
def ClientNotFound(self, fingerprint, address):
1712
"D-Bus signal"
1713
pass
1714
1715
@dbus.service.signal(_interface, signature=u"os")
1716
def ClientRemoved(self, objpath, name):
1717
"D-Bus signal"
1718
pass
1719
1720
@dbus.service.method(_interface, out_signature=u"ao")
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1721
1110
def GetAllClients(self):
1722
"D-Bus method"
1723
return dbus.Array(c.dbus_object_path
1724
for c in tcp_server.clients)
1725
1726
@dbus.service.method(_interface,
1727
out_signature=u"a{oa{sv}}")
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1728
1114
def GetAllClientsWithProperties(self):
1729
"D-Bus method"
1730
1115
return dbus.Dictionary(
1731
((c.dbus_object_path, c.GetAll(u""))
1732
for c in tcp_server.clients),
1733
signature=u"oa{sv}")
1734
1735
@dbus.service.method(_interface, in_signature=u"o")
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1736
1121
def RemoveClient(self, object_path):
1737
"D-Bus method"
1738
for c in tcp_server.clients:
1122
for c in clients:
1739
1123
if c.dbus_object_path == object_path:
1740
tcp_server.clients.remove(c)
1741
c.remove_from_connection()
1124
clients.remove(c)
1742
1125
# Don't signal anything except ClientRemoved
1743
c.disable(quiet=True)
1126
c.use_dbus = False
1127
c.disable()
1744
1128
# Emit D-Bus signal
1745
self.ClientRemoved(object_path, c.name)
1129
self.ClientRemoved(object_path)
1746
1130
return
1747
raise KeyError(object_path)
1748
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1749
1136
del _interface
1750
1751
mandos_dbus_service = MandosDBusService()
1752
1753
def cleanup():
1754
"Cleanup function; run on exit"
1755
service.cleanup()
1756
1757
while tcp_server.clients:
1758
client = tcp_server.clients.pop()
1759
if use_dbus:
1760
client.remove_from_connection()
1761
client.disable_hook = None
1762
# Don't signal anything except ClientRemoved
1763
client.disable(quiet=True)
1764
if use_dbus:
1765
# Emit D-Bus signal
1766
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1767
client.name)
1768
1769
atexit.register(cleanup)
1770
1771
for client in tcp_server.clients:
1137
1138
mandos_server = MandosServer()
1139
1140
for client in clients:
1772
1141
if use_dbus:
1773
1142
# Emit D-Bus signal
1774
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1775
1145
client.enable()
1776
1146
1777
1147
tcp_server.enable()
1779
1149
1780
1150
# Find out what port we got
1781
1151
service.port = tcp_server.socket.getsockname()[1]
1782
if use_ipv6:
1783
logger.info(u"Now listening on address %r, port %d,"
1784
" flowinfo %d, scope_id %d"
1785
% tcp_server.socket.getsockname())
1786
else: # IPv4
1787
logger.info(u"Now listening on address %r, port %d"
1788
% tcp_server.socket.getsockname())
1152
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1153
u" scope_id %d" % tcp_server.socket.getsockname())
1789
1154
1790
1155
#service.interface = tcp_server.socket.getsockname()[3]
1791
1156
1792
1157
try:
1793
1158
# From the Avahi example code
1159
server.connect_to_signal("StateChanged", server_state_changed)
1794
1160
try:
1795
service.activate()
1161
server_state_changed(server.GetState())
1796
1162
except dbus.exceptions.DBusException, error:
1797
1163
logger.critical(u"DBusException: %s", error)
1798
cleanup()
1799
1164
sys.exit(1)
1800
1165
# End of Avahi example code
1801
1166
1808
1173
main_loop.run()
1809
1174
except AvahiError, error:
1810
1175
logger.critical(u"AvahiError: %s", error)
1811
cleanup()
1812
1176
sys.exit(1)
1813
1177
except KeyboardInterrupt:
1814
1178
if debug:
1815
print >> sys.stderr
1816
logger.debug(u"Server received KeyboardInterrupt")
1817
logger.debug(u"Server exiting")
1818
# Must run before the D-Bus bus name gets deregistered
1819
cleanup()
1179
print
1820
1180
1821
1181
if __name__ == '__main__':
1822
1182
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0