To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.2.76
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.76
- Committer: Teddy Hogeborn
- Date: 2009-02-12 23:17:14 UTC
- mto: (237.4.2 mandos-pipe-ipc) (24.1.137 mandos) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 250.
- Revision ID: teddy@fukt.bsnet.se-20090212231714-59wxtc7h3w7ss8v6
* plugins.d/mandos-client.c (browse_callback, main): Do not require
IPv6.
(main): Removed redundant initialization of "mc".
IPv6.
(main): Removed redundant initialization of "mc".
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
56
57
import logging.handlers
57
58
import pwd
58
59
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
62
60
63
61
import dbus
64
62
import dbus.service
67
65
from dbus.mainloop.glib import DBusGMainLoop
68
66
import ctypes
69
67
import ctypes.util
70
import xml.dom.minidom
71
import inspect
72
73
try:
74
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
75
except AttributeError:
76
try:
77
from IN import SO_BINDTODEVICE
78
except ImportError:
79
SO_BINDTODEVICE = None
80
81
82
version = "1.0.14"
83
84
logger = logging.Logger(u'mandos')
68
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
85
72
syslogger = (logging.handlers.SysLogHandler
86
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
87
74
address = "/dev/log"))
88
75
syslogger.setFormatter(logging.Formatter
89
(u'Mandos [%(process)d]: %(levelname)s:'
90
u' %(message)s'))
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
91
78
logger.addHandler(syslogger)
92
79
93
80
console = logging.StreamHandler()
94
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
95
u' %(levelname)s:'
96
u' %(message)s'))
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
97
83
logger.addHandler(console)
98
84
99
85
class AvahiError(Exception):
112
98
113
99
class AvahiService(object):
114
100
"""An Avahi (Zeroconf) service.
115
116
101
Attributes:
117
102
interface: integer; avahi.IF_UNSPEC or an interface index.
118
103
Used to optionally bind to the specified interface.
119
name: string; Example: u'Mandos'
120
type: string; Example: u'_mandos._tcp'.
104
name: string; Example: 'Mandos'
105
type: string; Example: '_mandos._tcp'.
121
106
See <http://www.dns-sd.org/ServiceTypes.html>
122
107
port: integer; what port to announce
123
108
TXT: list of strings; TXT record for the service
126
111
max_renames: integer; maximum number of renames
127
112
rename_count: integer; counter so we only rename after collisions
128
113
a sensible number of times
129
group: D-Bus Entry Group
130
server: D-Bus Server
131
bus: dbus.SystemBus()
132
114
"""
133
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
134
116
servicetype = None, port = None, TXT = None,
135
domain = u"", host = u"", max_renames = 32768,
136
protocol = avahi.PROTO_UNSPEC, bus = None):
117
domain = "", host = "", max_renames = 32768):
137
118
self.interface = interface
138
119
self.name = name
139
120
self.type = servicetype
143
124
self.host = host
144
125
self.rename_count = 0
145
126
self.max_renames = max_renames
146
self.protocol = protocol
147
self.group = None # our entry group
148
self.server = None
149
self.bus = bus
150
127
def rename(self):
151
128
"""Derived from the Avahi example code"""
152
129
if self.rename_count >= self.max_renames:
154
131
u" after %i retries, exiting.",
155
132
self.rename_count)
156
133
raise AvahiServiceError(u"Too many renames")
157
self.name = self.server.GetAlternativeServiceName(self.name)
134
self.name = server.GetAlternativeServiceName(self.name)
158
135
logger.info(u"Changing Zeroconf service name to %r ...",
159
unicode(self.name))
136
str(self.name))
160
137
syslogger.setFormatter(logging.Formatter
161
(u'Mandos (%s) [%%(process)d]:'
162
u' %%(levelname)s: %%(message)s'
163
% self.name))
138
('Mandos (%s): %%(levelname)s:'
139
' %%(message)s' % self.name))
164
140
self.remove()
165
141
self.add()
166
142
self.rename_count += 1
167
143
def remove(self):
168
144
"""Derived from the Avahi example code"""
169
if self.group is not None:
170
self.group.Reset()
145
if group is not None:
146
group.Reset()
171
147
def add(self):
172
148
"""Derived from the Avahi example code"""
173
if self.group is None:
174
self.group = dbus.Interface(
175
self.bus.get_object(avahi.DBUS_NAME,
176
self.server.EntryGroupNew()),
177
avahi.DBUS_INTERFACE_ENTRY_GROUP)
178
self.group.connect_to_signal('StateChanged',
179
self
180
.entry_group_state_changed)
149
global group
150
if group is None:
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
153
server.EntryGroupNew()),
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
155
group.connect_to_signal('StateChanged',
156
entry_group_state_changed)
181
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
182
self.name, self.type)
183
self.group.AddService(
184
self.interface,
185
self.protocol,
186
dbus.UInt32(0), # flags
187
self.name, self.type,
188
self.domain, self.host,
189
dbus.UInt16(self.port),
190
avahi.string_array_to_txt_array(self.TXT))
191
self.group.Commit()
192
def entry_group_state_changed(self, state, error):
193
"""Derived from the Avahi example code"""
194
logger.debug(u"Avahi state change: %i", state)
195
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
197
logger.debug(u"Zeroconf service established.")
198
elif state == avahi.ENTRY_GROUP_COLLISION:
199
logger.warning(u"Zeroconf service name collision.")
200
self.rename()
201
elif state == avahi.ENTRY_GROUP_FAILURE:
202
logger.critical(u"Avahi: Error in group state changed %s",
203
unicode(error))
204
raise AvahiGroupError(u"State changed: %s"
205
% unicode(error))
206
def cleanup(self):
207
"""Derived from the Avahi example code"""
208
if self.group is not None:
209
self.group.Free()
210
self.group = None
211
def server_state_changed(self, state):
212
"""Derived from the Avahi example code"""
213
if state == avahi.SERVER_COLLISION:
214
logger.error(u"Zeroconf server name collision")
215
self.remove()
216
elif state == avahi.SERVER_RUNNING:
217
self.add()
218
def activate(self):
219
"""Derived from the Avahi example code"""
220
if self.server is None:
221
self.server = dbus.Interface(
222
self.bus.get_object(avahi.DBUS_NAME,
223
avahi.DBUS_PATH_SERVER),
224
avahi.DBUS_INTERFACE_SERVER)
225
self.server.connect_to_signal(u"StateChanged",
226
self.server_state_changed)
227
self.server_state_changed(self.server.GetState())
228
229
230
class Client(object):
158
service.name, service.type)
159
group.AddService(
160
self.interface, # interface
161
avahi.PROTO_INET6, # protocol
162
dbus.UInt32(0), # flags
163
self.name, self.type,
164
self.domain, self.host,
165
dbus.UInt16(self.port),
166
avahi.string_array_to_txt_array(self.TXT))
167
group.Commit()
168
169
# From the Avahi example code:
170
group = None # our entry group
171
# End of Avahi example code
172
173
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
231
180
"""A representation of a client host served by this server.
232
233
181
Attributes:
234
182
name: string; from the config file, used in log messages and
235
183
D-Bus identifiers
249
197
to see if the client lives.
250
198
'None' if no process is running.
251
199
checker_initiator_tag: a gobject event source tag, or None
252
disable_initiator_tag: - '' -
200
disable_initiator_tag: - '' -
253
201
checker_callback_tag: - '' -
254
202
checker_command: string; External command which is run to check if
255
203
client lives. %() expansions are done at
256
204
runtime with vars(self) as dict, so that for
257
205
instance %(name)s can be used in the command.
258
current_checker_command: string; current running checker_command
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
259
208
"""
260
261
@staticmethod
262
def _timedelta_to_milliseconds(td):
263
"Convert a datetime.timedelta() to milliseconds"
264
return ((td.days * 24 * 60 * 60 * 1000)
265
+ (td.seconds * 1000)
266
+ (td.microseconds // 1000))
267
268
209
def timeout_milliseconds(self):
269
210
"Return the 'timeout' attribute in milliseconds"
270
return self._timedelta_to_milliseconds(self.timeout)
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
271
214
272
215
def interval_milliseconds(self):
273
216
"Return the 'interval' attribute in milliseconds"
274
return self._timedelta_to_milliseconds(self.interval)
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
275
220
276
def __init__(self, name = None, disable_hook=None, config=None):
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
277
223
"""Note: the 'checker' key in 'config' sets the
278
224
'checker_command' attribute and *not* the 'checker'
279
225
attribute."""
281
227
if config is None:
282
228
config = {}
283
229
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
284
231
# Uppercase and remove spaces from fingerprint for later
285
232
# comparison purposes with return value from the fingerprint()
286
233
# function
287
self.fingerprint = (config[u"fingerprint"].upper()
234
self.fingerprint = (config["fingerprint"].upper()
288
235
.replace(u" ", u""))
289
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
290
if u"secret" in config:
291
self.secret = config[u"secret"].decode(u"base64")
292
elif u"secfile" in config:
237
if "secret" in config:
238
self.secret = config["secret"].decode(u"base64")
239
elif "secfile" in config:
293
240
with closing(open(os.path.expanduser
294
241
(os.path.expandvars
295
(config[u"secfile"])),
296
"rb")) as secfile:
242
(config["secfile"])))) as secfile:
297
243
self.secret = secfile.read()
298
244
else:
299
245
raise TypeError(u"No secret or secfile for client %s"
300
246
% self.name)
301
self.host = config.get(u"host", u"")
247
self.host = config.get("host", "")
302
248
self.created = datetime.datetime.utcnow()
303
249
self.enabled = False
304
250
self.last_enabled = None
305
251
self.last_checked_ok = None
306
self.timeout = string_to_delta(config[u"timeout"])
307
self.interval = string_to_delta(config[u"interval"])
252
self.timeout = string_to_delta(config["timeout"])
253
self.interval = string_to_delta(config["interval"])
308
254
self.disable_hook = disable_hook
309
255
self.checker = None
310
256
self.checker_initiator_tag = None
311
257
self.disable_initiator_tag = None
312
258
self.checker_callback_tag = None
313
self.checker_command = config[u"checker"]
314
self.current_checker_command = None
259
self.checker_command = config["checker"]
315
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
316
270
317
271
def enable(self):
318
272
"""Start this client's checker and timeout hooks"""
319
if getattr(self, u"enabled", False):
320
# Already enabled
321
return
322
273
self.last_enabled = datetime.datetime.utcnow()
323
274
# Schedule a new checker to be started an 'interval' from now,
324
275
# and every interval from then on.
332
283
(self.timeout_milliseconds(),
333
284
self.disable))
334
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
335
293
336
294
def disable(self):
337
295
"""Disable this client."""
338
296
if not getattr(self, "enabled", False):
339
297
return False
340
298
logger.info(u"Disabling client %s", self.name)
341
if getattr(self, u"disable_initiator_tag", False):
299
if getattr(self, "disable_initiator_tag", False):
342
300
gobject.source_remove(self.disable_initiator_tag)
343
301
self.disable_initiator_tag = None
344
if getattr(self, u"checker_initiator_tag", False):
302
if getattr(self, "checker_initiator_tag", False):
345
303
gobject.source_remove(self.checker_initiator_tag)
346
304
self.checker_initiator_tag = None
347
305
self.stop_checker()
348
306
if self.disable_hook:
349
307
self.disable_hook(self)
350
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
351
313
# Do not run this again if called by a gobject.timeout_add
352
314
return False
353
315
359
321
"""The checker has completed, so take appropriate actions."""
360
322
self.checker_callback_tag = None
361
323
self.checker = None
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
362
328
if os.WIFEXITED(condition):
363
329
exitstatus = os.WEXITSTATUS(condition)
364
330
if exitstatus == 0:
368
334
else:
369
335
logger.info(u"Checker for %(name)s failed",
370
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
371
342
else:
372
343
logger.warning(u"Checker for %(name)s crashed?",
373
344
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
374
350
375
351
def checked_ok(self):
376
352
"""Bump up the timeout for this client.
377
378
353
This should only be called when the client has been seen,
379
354
alive and well.
380
355
"""
383
358
self.disable_initiator_tag = (gobject.timeout_add
384
359
(self.timeout_milliseconds(),
385
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
386
367
387
368
def start_checker(self):
388
369
"""Start a new checker subprocess if one is not running.
389
390
370
If a checker already exists, leave it running and do
391
371
nothing."""
392
372
# The reason for not killing a running checker is that if we
397
377
# checkers alone, the checker would have to take more time
398
378
# than 'timeout' for the client to be declared invalid, which
399
379
# is as it should be.
400
401
# If a checker exists, make sure it is not a zombie
402
try:
403
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
404
except (AttributeError, OSError), error:
405
if (isinstance(error, OSError)
406
and error.errno != errno.ECHILD):
407
raise error
408
else:
409
if pid:
410
logger.warning(u"Checker was a zombie")
411
gobject.source_remove(self.checker_callback_tag)
412
self.checker_callback(pid, status,
413
self.current_checker_command)
414
# Start a new checker if needed
415
380
if self.checker is None:
416
381
try:
417
382
# In case checker_command has exactly one % operator
418
383
command = self.checker_command % self.host
419
384
except TypeError:
420
385
# Escape attributes for the shell
421
escaped_attrs = dict((key,
422
re.escape(unicode(str(val),
423
errors=
424
u'replace')))
386
escaped_attrs = dict((key, re.escape(str(val)))
425
387
for key, val in
426
388
vars(self).iteritems())
427
389
try:
430
392
logger.error(u'Could not format string "%s":'
431
393
u' %s', self.checker_command, error)
432
394
return True # Try again later
433
self.current_checker_command = command
434
395
try:
435
396
logger.info(u"Starting checker %r for %s",
436
397
command, self.name)
440
401
# always replaced by /dev/null.)
441
402
self.checker = subprocess.Popen(command,
442
403
close_fds=True,
443
shell=True, cwd=u"/")
404
shell=True, cwd="/")
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
444
411
self.checker_callback_tag = (gobject.child_watch_add
445
412
(self.checker.pid,
446
413
self.checker_callback,
462
429
if self.checker_callback_tag:
463
430
gobject.source_remove(self.checker_callback_tag)
464
431
self.checker_callback_tag = None
465
if getattr(self, u"checker", None) is None:
432
if getattr(self, "checker", None) is None:
466
433
return
467
434
logger.debug(u"Stopping checker for %(name)s", vars(self))
468
435
try:
474
441
if error.errno != errno.ESRCH: # No such process
475
442
raise
476
443
self.checker = None
444
if self.use_dbus:
445
self.PropertyChanged(dbus.String(u"checker_running"),
446
dbus.Boolean(False, variant_level=1))
477
447
478
448
def still_valid(self):
479
449
"""Has the timeout not yet passed for this client?"""
480
if not getattr(self, u"enabled", False):
450
if not getattr(self, "enabled", False):
481
451
return False
482
452
now = datetime.datetime.utcnow()
483
453
if self.last_checked_ok is None:
484
454
return now < (self.created + self.timeout)
485
455
else:
486
456
return now < (self.last_checked_ok + self.timeout)
487
488
489
def dbus_service_property(dbus_interface, signature=u"v",
490
access=u"readwrite", byte_arrays=False):
491
"""Decorators for marking methods of a DBusObjectWithProperties to
492
become properties on the D-Bus.
493
494
The decorated method will be called with no arguments by "Get"
495
and with one argument by "Set".
496
497
The parameters, where they are supported, are the same as
498
dbus.service.method, except there is only "signature", since the
499
type from Get() and the type sent to Set() is the same.
500
"""
501
def decorator(func):
502
func._dbus_is_property = True
503
func._dbus_interface = dbus_interface
504
func._dbus_signature = signature
505
func._dbus_access = access
506
func._dbus_name = func.__name__
507
if func._dbus_name.endswith(u"_dbus_property"):
508
func._dbus_name = func._dbus_name[:-14]
509
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
510
return func
511
return decorator
512
513
514
class DBusPropertyException(dbus.exceptions.DBusException):
515
"""A base class for D-Bus property-related exceptions
516
"""
517
def __unicode__(self):
518
return unicode(str(self))
519
520
521
class DBusPropertyAccessException(DBusPropertyException):
522
"""A property's access permissions disallows an operation.
523
"""
524
pass
525
526
527
class DBusPropertyNotFound(DBusPropertyException):
528
"""An attempt was made to access a non-existing property.
529
"""
530
pass
531
532
533
class DBusObjectWithProperties(dbus.service.Object):
534
"""A D-Bus object with properties.
535
536
Classes inheriting from this can use the dbus_service_property
537
decorator to expose methods as D-Bus properties. It exposes the
538
standard Get(), Set(), and GetAll() methods on the D-Bus.
539
"""
540
541
@staticmethod
542
def _is_dbus_property(obj):
543
return getattr(obj, u"_dbus_is_property", False)
544
545
def _get_all_dbus_properties(self):
546
"""Returns a generator of (name, attribute) pairs
547
"""
548
return ((prop._dbus_name, prop)
549
for name, prop in
550
inspect.getmembers(self, self._is_dbus_property))
551
552
def _get_dbus_property(self, interface_name, property_name):
553
"""Returns a bound method if one exists which is a D-Bus
554
property with the specified name and interface.
555
"""
556
for name in (property_name,
557
property_name + u"_dbus_property"):
558
prop = getattr(self, name, None)
559
if (prop is None
560
or not self._is_dbus_property(prop)
561
or prop._dbus_name != property_name
562
or (interface_name and prop._dbus_interface
563
and interface_name != prop._dbus_interface)):
564
continue
565
return prop
566
# No such property
567
raise DBusPropertyNotFound(self.dbus_object_path + u":"
568
+ interface_name + u"."
569
+ property_name)
570
571
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
572
out_signature=u"v")
573
def Get(self, interface_name, property_name):
574
"""Standard D-Bus property Get() method, see D-Bus standard.
575
"""
576
prop = self._get_dbus_property(interface_name, property_name)
577
if prop._dbus_access == u"write":
578
raise DBusPropertyAccessException(property_name)
579
value = prop()
580
if not hasattr(value, u"variant_level"):
581
return value
582
return type(value)(value, variant_level=value.variant_level+1)
583
584
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
585
def Set(self, interface_name, property_name, value):
586
"""Standard D-Bus property Set() method, see D-Bus standard.
587
"""
588
prop = self._get_dbus_property(interface_name, property_name)
589
if prop._dbus_access == u"read":
590
raise DBusPropertyAccessException(property_name)
591
if prop._dbus_get_args_options[u"byte_arrays"]:
592
value = dbus.ByteArray(''.join(unichr(byte)
593
for byte in value))
594
prop(value)
595
596
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
597
out_signature=u"a{sv}")
598
def GetAll(self, interface_name):
599
"""Standard D-Bus property GetAll() method, see D-Bus
600
standard.
601
602
Note: Will not include properties with access="write".
603
"""
604
all = {}
605
for name, prop in self._get_all_dbus_properties():
606
if (interface_name
607
and interface_name != prop._dbus_interface):
608
# Interface non-empty but did not match
609
continue
610
# Ignore write-only properties
611
if prop._dbus_access == u"write":
612
continue
613
value = prop()
614
if not hasattr(value, u"variant_level"):
615
all[name] = value
616
continue
617
all[name] = type(value)(value, variant_level=
618
value.variant_level+1)
619
return dbus.Dictionary(all, signature=u"sv")
620
621
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
622
out_signature=u"s",
623
path_keyword='object_path',
624
connection_keyword='connection')
625
def Introspect(self, object_path, connection):
626
"""Standard D-Bus method, overloaded to insert property tags.
627
"""
628
xmlstring = dbus.service.Object.Introspect(self, object_path,
629
connection)
630
try:
631
document = xml.dom.minidom.parseString(xmlstring)
632
def make_tag(document, name, prop):
633
e = document.createElement(u"property")
634
e.setAttribute(u"name", name)
635
e.setAttribute(u"type", prop._dbus_signature)
636
e.setAttribute(u"access", prop._dbus_access)
637
return e
638
for if_tag in document.getElementsByTagName(u"interface"):
639
for tag in (make_tag(document, name, prop)
640
for name, prop
641
in self._get_all_dbus_properties()
642
if prop._dbus_interface
643
== if_tag.getAttribute(u"name")):
644
if_tag.appendChild(tag)
645
# Add the names to the return values for the
646
# "org.freedesktop.DBus.Properties" methods
647
if (if_tag.getAttribute(u"name")
648
== u"org.freedesktop.DBus.Properties"):
649
for cn in if_tag.getElementsByTagName(u"method"):
650
if cn.getAttribute(u"name") == u"Get":
651
for arg in cn.getElementsByTagName(u"arg"):
652
if (arg.getAttribute(u"direction")
653
== u"out"):
654
arg.setAttribute(u"name", u"value")
655
elif cn.getAttribute(u"name") == u"GetAll":
656
for arg in cn.getElementsByTagName(u"arg"):
657
if (arg.getAttribute(u"direction")
658
== u"out"):
659
arg.setAttribute(u"name", u"props")
660
xmlstring = document.toxml(u"utf-8")
661
document.unlink()
662
except (AttributeError, xml.dom.DOMException,
663
xml.parsers.expat.ExpatError), error:
664
logger.error(u"Failed to override Introspection method",
665
error)
666
return xmlstring
667
668
669
class ClientDBus(Client, DBusObjectWithProperties):
670
"""A Client class using D-Bus
671
672
Attributes:
673
dbus_object_path: dbus.ObjectPath
674
bus: dbus.SystemBus()
675
"""
676
# dbus.service.Object doesn't use super(), so we can't either.
677
678
def __init__(self, bus = None, *args, **kwargs):
679
self.bus = bus
680
Client.__init__(self, *args, **kwargs)
681
# Only now, when this client is initialized, can it show up on
682
# the D-Bus
683
self.dbus_object_path = (dbus.ObjectPath
684
(u"/clients/"
685
+ self.name.replace(u".", u"_")))
686
DBusObjectWithProperties.__init__(self, self.bus,
687
self.dbus_object_path)
688
689
@staticmethod
690
def _datetime_to_dbus(dt, variant_level=0):
691
"""Convert a UTC datetime.datetime() to a D-Bus type."""
692
return dbus.String(dt.isoformat(),
693
variant_level=variant_level)
694
695
def enable(self):
696
oldstate = getattr(self, u"enabled", False)
697
r = Client.enable(self)
698
if oldstate != self.enabled:
699
# Emit D-Bus signals
700
self.PropertyChanged(dbus.String(u"enabled"),
701
dbus.Boolean(True, variant_level=1))
702
self.PropertyChanged(
703
dbus.String(u"last_enabled"),
704
self._datetime_to_dbus(self.last_enabled,
705
variant_level=1))
706
return r
707
708
def disable(self, signal = True):
709
oldstate = getattr(self, u"enabled", False)
710
r = Client.disable(self)
711
if signal and oldstate != self.enabled:
712
# Emit D-Bus signal
713
self.PropertyChanged(dbus.String(u"enabled"),
714
dbus.Boolean(False, variant_level=1))
715
return r
716
717
def __del__(self, *args, **kwargs):
718
try:
719
self.remove_from_connection()
720
except LookupError:
721
pass
722
if hasattr(DBusObjectWithProperties, u"__del__"):
723
DBusObjectWithProperties.__del__(self, *args, **kwargs)
724
Client.__del__(self, *args, **kwargs)
725
726
def checker_callback(self, pid, condition, command,
727
*args, **kwargs):
728
self.checker_callback_tag = None
729
self.checker = None
730
# Emit D-Bus signal
731
self.PropertyChanged(dbus.String(u"checker_running"),
732
dbus.Boolean(False, variant_level=1))
733
if os.WIFEXITED(condition):
734
exitstatus = os.WEXITSTATUS(condition)
735
# Emit D-Bus signal
736
self.CheckerCompleted(dbus.Int16(exitstatus),
737
dbus.Int64(condition),
738
dbus.String(command))
739
else:
740
# Emit D-Bus signal
741
self.CheckerCompleted(dbus.Int16(-1),
742
dbus.Int64(condition),
743
dbus.String(command))
744
745
return Client.checker_callback(self, pid, condition, command,
746
*args, **kwargs)
747
748
def checked_ok(self, *args, **kwargs):
749
r = Client.checked_ok(self, *args, **kwargs)
750
# Emit D-Bus signal
751
self.PropertyChanged(
752
dbus.String(u"last_checked_ok"),
753
(self._datetime_to_dbus(self.last_checked_ok,
754
variant_level=1)))
755
return r
756
757
def start_checker(self, *args, **kwargs):
758
old_checker = self.checker
759
if self.checker is not None:
760
old_checker_pid = self.checker.pid
761
else:
762
old_checker_pid = None
763
r = Client.start_checker(self, *args, **kwargs)
764
# Only if new checker process was started
765
if (self.checker is not None
766
and old_checker_pid != self.checker.pid):
767
# Emit D-Bus signal
768
self.CheckerStarted(self.current_checker_command)
769
self.PropertyChanged(
770
dbus.String(u"checker_running"),
771
dbus.Boolean(True, variant_level=1))
772
return r
773
774
def stop_checker(self, *args, **kwargs):
775
old_checker = getattr(self, u"checker", None)
776
r = Client.stop_checker(self, *args, **kwargs)
777
if (old_checker is not None
778
and getattr(self, u"checker", None) is None):
779
self.PropertyChanged(dbus.String(u"checker_running"),
780
dbus.Boolean(False, variant_level=1))
781
return r
782
457
783
458
## D-Bus methods & signals
784
459
_interface = u"se.bsnet.fukt.Mandos.Client"
785
460
786
461
# CheckedOK - method
787
@dbus.service.method(_interface)
788
def CheckedOK(self):
789
return self.checked_ok()
462
CheckedOK = dbus.service.method(_interface)(checked_ok)
463
CheckedOK.__name__ = "CheckedOK"
790
464
791
465
# CheckerCompleted - signal
792
@dbus.service.signal(_interface, signature=u"nxs")
466
@dbus.service.signal(_interface, signature="nxs")
793
467
def CheckerCompleted(self, exitcode, waitstatus, command):
794
468
"D-Bus signal"
795
469
pass
796
470
797
471
# CheckerStarted - signal
798
@dbus.service.signal(_interface, signature=u"s")
472
@dbus.service.signal(_interface, signature="s")
799
473
def CheckerStarted(self, command):
800
474
"D-Bus signal"
801
475
pass
802
476
477
# GetAllProperties - method
478
@dbus.service.method(_interface, out_signature="a{sv}")
479
def GetAllProperties(self):
480
"D-Bus method"
481
return dbus.Dictionary({
482
dbus.String("name"):
483
dbus.String(self.name, variant_level=1),
484
dbus.String("fingerprint"):
485
dbus.String(self.fingerprint, variant_level=1),
486
dbus.String("host"):
487
dbus.String(self.host, variant_level=1),
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
492
variant_level=1)
493
if self.last_enabled is not None
494
else dbus.Boolean(False, variant_level=1)),
495
dbus.String("enabled"):
496
dbus.Boolean(self.enabled, variant_level=1),
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
499
variant_level=1)
500
if self.last_checked_ok is not None
501
else dbus.Boolean (False, variant_level=1)),
502
dbus.String("timeout"):
503
dbus.UInt64(self.timeout_milliseconds(),
504
variant_level=1),
505
dbus.String("interval"):
506
dbus.UInt64(self.interval_milliseconds(),
507
variant_level=1),
508
dbus.String("checker"):
509
dbus.String(self.checker_command,
510
variant_level=1),
511
dbus.String("checker_running"):
512
dbus.Boolean(self.checker is not None,
513
variant_level=1),
514
dbus.String("object_path"):
515
dbus.ObjectPath(self.dbus_object_path,
516
variant_level=1)
517
}, signature="sv")
518
519
# IsStillValid - method
520
IsStillValid = (dbus.service.method(_interface, out_signature="b")
521
(still_valid))
522
IsStillValid.__name__ = "IsStillValid"
523
803
524
# PropertyChanged - signal
804
@dbus.service.signal(_interface, signature=u"sv")
525
@dbus.service.signal(_interface, signature="sv")
805
526
def PropertyChanged(self, property, value):
806
527
"D-Bus signal"
807
528
pass
808
529
809
# GotSecret - signal
810
@dbus.service.signal(_interface)
811
def GotSecret(self):
812
"D-Bus signal"
813
pass
814
815
# Rejected - signal
816
@dbus.service.signal(_interface)
817
def Rejected(self):
818
"D-Bus signal"
819
pass
530
# SetChecker - method
531
@dbus.service.method(_interface, in_signature="s")
532
def SetChecker(self, checker):
533
"D-Bus setter method"
534
self.checker_command = checker
535
# Emit D-Bus signal
536
self.PropertyChanged(dbus.String(u"checker"),
537
dbus.String(self.checker_command,
538
variant_level=1))
539
540
# SetHost - method
541
@dbus.service.method(_interface, in_signature="s")
542
def SetHost(self, host):
543
"D-Bus setter method"
544
self.host = host
545
# Emit D-Bus signal
546
self.PropertyChanged(dbus.String(u"host"),
547
dbus.String(self.host, variant_level=1))
548
549
# SetInterval - method
550
@dbus.service.method(_interface, in_signature="t")
551
def SetInterval(self, milliseconds):
552
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
553
# Emit D-Bus signal
554
self.PropertyChanged(dbus.String(u"interval"),
555
(dbus.UInt64(self.interval_milliseconds(),
556
variant_level=1)))
557
558
# SetSecret - method
559
@dbus.service.method(_interface, in_signature="ay",
560
byte_arrays=True)
561
def SetSecret(self, secret):
562
"D-Bus setter method"
563
self.secret = str(secret)
564
565
# SetTimeout - method
566
@dbus.service.method(_interface, in_signature="t")
567
def SetTimeout(self, milliseconds):
568
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
569
# Emit D-Bus signal
570
self.PropertyChanged(dbus.String(u"timeout"),
571
(dbus.UInt64(self.timeout_milliseconds(),
572
variant_level=1)))
820
573
821
574
# Enable - method
822
@dbus.service.method(_interface)
823
def Enable(self):
824
"D-Bus method"
825
self.enable()
575
Enable = dbus.service.method(_interface)(enable)
576
Enable.__name__ = "Enable"
826
577
827
578
# StartChecker - method
828
579
@dbus.service.method(_interface)
837
588
self.disable()
838
589
839
590
# StopChecker - method
840
@dbus.service.method(_interface)
841
def StopChecker(self):
842
self.stop_checker()
843
844
# name - property
845
@dbus_service_property(_interface, signature=u"s", access=u"read")
846
def name_dbus_property(self):
847
return dbus.String(self.name)
848
849
# fingerprint - property
850
@dbus_service_property(_interface, signature=u"s", access=u"read")
851
def fingerprint_dbus_property(self):
852
return dbus.String(self.fingerprint)
853
854
# host - property
855
@dbus_service_property(_interface, signature=u"s",
856
access=u"readwrite")
857
def host_dbus_property(self, value=None):
858
if value is None: # get
859
return dbus.String(self.host)
860
self.host = value
861
# Emit D-Bus signal
862
self.PropertyChanged(dbus.String(u"host"),
863
dbus.String(value, variant_level=1))
864
865
# created - property
866
@dbus_service_property(_interface, signature=u"s", access=u"read")
867
def created_dbus_property(self):
868
return dbus.String(self._datetime_to_dbus(self.created))
869
870
# last_enabled - property
871
@dbus_service_property(_interface, signature=u"s", access=u"read")
872
def last_enabled_dbus_property(self):
873
if self.last_enabled is None:
874
return dbus.String(u"")
875
return dbus.String(self._datetime_to_dbus(self.last_enabled))
876
877
# enabled - property
878
@dbus_service_property(_interface, signature=u"b",
879
access=u"readwrite")
880
def enabled_dbus_property(self, value=None):
881
if value is None: # get
882
return dbus.Boolean(self.enabled)
883
if value:
884
self.enable()
885
else:
886
self.disable()
887
888
# last_checked_ok - property
889
@dbus_service_property(_interface, signature=u"s",
890
access=u"readwrite")
891
def last_checked_ok_dbus_property(self, value=None):
892
if value is not None:
893
self.checked_ok()
894
return
895
if self.last_checked_ok is None:
896
return dbus.String(u"")
897
return dbus.String(self._datetime_to_dbus(self
898
.last_checked_ok))
899
900
# timeout - property
901
@dbus_service_property(_interface, signature=u"t",
902
access=u"readwrite")
903
def timeout_dbus_property(self, value=None):
904
if value is None: # get
905
return dbus.UInt64(self.timeout_milliseconds())
906
self.timeout = datetime.timedelta(0, 0, 0, value)
907
# Emit D-Bus signal
908
self.PropertyChanged(dbus.String(u"timeout"),
909
dbus.UInt64(value, variant_level=1))
910
if getattr(self, u"disable_initiator_tag", None) is None:
911
return
912
# Reschedule timeout
913
gobject.source_remove(self.disable_initiator_tag)
914
self.disable_initiator_tag = None
915
time_to_die = (self.
916
_timedelta_to_milliseconds((self
917
.last_checked_ok
918
+ self.timeout)
919
- datetime.datetime
920
.utcnow()))
921
if time_to_die <= 0:
922
# The timeout has passed
923
self.disable()
924
else:
925
self.disable_initiator_tag = (gobject.timeout_add
926
(time_to_die, self.disable))
927
928
# interval - property
929
@dbus_service_property(_interface, signature=u"t",
930
access=u"readwrite")
931
def interval_dbus_property(self, value=None):
932
if value is None: # get
933
return dbus.UInt64(self.interval_milliseconds())
934
self.interval = datetime.timedelta(0, 0, 0, value)
935
# Emit D-Bus signal
936
self.PropertyChanged(dbus.String(u"interval"),
937
dbus.UInt64(value, variant_level=1))
938
if getattr(self, u"checker_initiator_tag", None) is None:
939
return
940
# Reschedule checker run
941
gobject.source_remove(self.checker_initiator_tag)
942
self.checker_initiator_tag = (gobject.timeout_add
943
(value, self.start_checker))
944
self.start_checker() # Start one now, too
945
946
# checker - property
947
@dbus_service_property(_interface, signature=u"s",
948
access=u"readwrite")
949
def checker_dbus_property(self, value=None):
950
if value is None: # get
951
return dbus.String(self.checker_command)
952
self.checker_command = value
953
# Emit D-Bus signal
954
self.PropertyChanged(dbus.String(u"checker"),
955
dbus.String(self.checker_command,
956
variant_level=1))
957
958
# checker_running - property
959
@dbus_service_property(_interface, signature=u"b",
960
access=u"readwrite")
961
def checker_running_dbus_property(self, value=None):
962
if value is None: # get
963
return dbus.Boolean(self.checker is not None)
964
if value:
965
self.start_checker()
966
else:
967
self.stop_checker()
968
969
# object_path - property
970
@dbus_service_property(_interface, signature=u"o", access=u"read")
971
def object_path_dbus_property(self):
972
return self.dbus_object_path # is already a dbus.ObjectPath
973
974
# secret = property
975
@dbus_service_property(_interface, signature=u"ay",
976
access=u"write", byte_arrays=True)
977
def secret_dbus_property(self, value):
978
self.secret = str(value)
591
StopChecker = dbus.service.method(_interface)(stop_checker)
592
StopChecker.__name__ = "StopChecker"
979
593
980
594
del _interface
981
595
982
596
983
class ClientHandler(socketserver.BaseRequestHandler, object):
984
"""A class to handle client connections.
985
986
Instantiated once for each connection to handle it.
597
def peer_certificate(session):
598
"Return the peer's OpenPGP certificate as a bytestring"
599
# If not an OpenPGP certificate...
600
if (gnutls.library.functions
601
.gnutls_certificate_type_get(session._c_object)
602
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
603
# ...do the normal thing
604
return session.peer_certificate
605
list_size = ctypes.c_uint(1)
606
cert_list = (gnutls.library.functions
607
.gnutls_certificate_get_peers
608
(session._c_object, ctypes.byref(list_size)))
609
if not bool(cert_list) and list_size.value != 0:
610
raise gnutls.errors.GNUTLSError("error getting peer"
611
" certificate")
612
if list_size.value == 0:
613
return None
614
cert = cert_list[0]
615
return ctypes.string_at(cert.data, cert.size)
616
617
618
def fingerprint(openpgp):
619
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
620
# New GnuTLS "datum" with the OpenPGP public key
621
datum = (gnutls.library.types
622
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
623
ctypes.POINTER
624
(ctypes.c_ubyte)),
625
ctypes.c_uint(len(openpgp))))
626
# New empty GnuTLS certificate
627
crt = gnutls.library.types.gnutls_openpgp_crt_t()
628
(gnutls.library.functions
629
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
630
# Import the OpenPGP public key into the certificate
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
633
gnutls.library.constants
634
.GNUTLS_OPENPGP_FMT_RAW))
635
# Verify the self signature in the key
636
crtverify = ctypes.c_uint()
637
(gnutls.library.functions
638
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
639
if crtverify.value != 0:
640
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
641
raise gnutls.errors.CertificateSecurityError("Verify failed")
642
# New buffer for the fingerprint
643
buf = ctypes.create_string_buffer(20)
644
buf_len = ctypes.c_size_t()
645
# Get the fingerprint from the certificate into the buffer
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
648
ctypes.byref(buf_len)))
649
# Deinit the certificate
650
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
651
# Convert the buffer to a Python bytestring
652
fpr = ctypes.string_at(buf, buf_len.value)
653
# Convert the bytestring to hexadecimal notation
654
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
655
return hex_fpr
656
657
658
class TCP_handler(SocketServer.BaseRequestHandler, object):
659
"""A TCP request handler class.
660
Instantiated by IPv6_TCPServer for each request to handle it.
987
661
Note: This will run in its own forked process."""
988
662
989
663
def handle(self):
990
664
logger.info(u"TCP connection from: %s",
991
665
unicode(self.client_address))
992
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
993
# Open IPC pipe to parent process
994
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
995
session = (gnutls.connection
996
.ClientSession(self.request,
997
gnutls.connection
998
.X509Credentials()))
999
1000
line = self.request.makefile().readline()
1001
logger.debug(u"Protocol version: %r", line)
1002
try:
1003
if int(line.strip().split()[0]) > 1:
1004
raise RuntimeError
1005
except (ValueError, IndexError, RuntimeError), error:
1006
logger.error(u"Unknown protocol version: %s", error)
1007
return
1008
1009
# Note: gnutls.connection.X509Credentials is really a
1010
# generic GnuTLS certificate credentials object so long as
1011
# no X.509 keys are added to it. Therefore, we can use it
1012
# here despite using OpenPGP certificates.
1013
1014
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1015
# u"+AES-256-CBC", u"+SHA1",
1016
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1017
# u"+DHE-DSS"))
1018
# Use a fallback default, since this MUST be set.
1019
priority = self.server.gnutls_priority
1020
if priority is None:
1021
priority = u"NORMAL"
1022
(gnutls.library.functions
1023
.gnutls_priority_set_direct(session._c_object,
1024
priority, None))
1025
1026
try:
1027
session.handshake()
1028
except gnutls.errors.GNUTLSError, error:
1029
logger.warning(u"Handshake failed: %s", error)
1030
# Do not run session.bye() here: the session is not
1031
# established. Just abandon the request.
1032
return
1033
logger.debug(u"Handshake succeeded")
1034
try:
1035
fpr = self.fingerprint(self.peer_certificate(session))
1036
except (TypeError, gnutls.errors.GNUTLSError), error:
1037
logger.warning(u"Bad certificate: %s", error)
1038
session.bye()
1039
return
1040
logger.debug(u"Fingerprint: %s", fpr)
1041
1042
for c in self.server.clients:
1043
if c.fingerprint == fpr:
1044
client = c
1045
break
1046
else:
1047
ipc.write(u"NOTFOUND %s %s\n"
1048
% (fpr, unicode(self.client_address)))
1049
session.bye()
1050
return
1051
# Have to check if client.still_valid(), since it is
1052
# possible that the client timed out while establishing
1053
# the GnuTLS session.
1054
if not client.still_valid():
1055
ipc.write(u"INVALID %s\n" % client.name)
1056
session.bye()
1057
return
1058
ipc.write(u"SENDING %s\n" % client.name)
1059
sent_size = 0
1060
while sent_size < len(client.secret):
1061
sent = session.send(client.secret[sent_size:])
1062
logger.debug(u"Sent: %d, remaining: %d",
1063
sent, len(client.secret)
1064
- (sent_size + sent))
1065
sent_size += sent
1066
session.bye()
1067
1068
@staticmethod
1069
def peer_certificate(session):
1070
"Return the peer's OpenPGP certificate as a bytestring"
1071
# If not an OpenPGP certificate...
1072
if (gnutls.library.functions
1073
.gnutls_certificate_type_get(session._c_object)
1074
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1075
# ...do the normal thing
1076
return session.peer_certificate
1077
list_size = ctypes.c_uint(1)
1078
cert_list = (gnutls.library.functions
1079
.gnutls_certificate_get_peers
1080
(session._c_object, ctypes.byref(list_size)))
1081
if not bool(cert_list) and list_size.value != 0:
1082
raise gnutls.errors.GNUTLSError(u"error getting peer"
1083
u" certificate")
1084
if list_size.value == 0:
1085
return None
1086
cert = cert_list[0]
1087
return ctypes.string_at(cert.data, cert.size)
1088
1089
@staticmethod
1090
def fingerprint(openpgp):
1091
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1092
# New GnuTLS "datum" with the OpenPGP public key
1093
datum = (gnutls.library.types
1094
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1095
ctypes.POINTER
1096
(ctypes.c_ubyte)),
1097
ctypes.c_uint(len(openpgp))))
1098
# New empty GnuTLS certificate
1099
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1100
(gnutls.library.functions
1101
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1102
# Import the OpenPGP public key into the certificate
1103
(gnutls.library.functions
1104
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1105
gnutls.library.constants
1106
.GNUTLS_OPENPGP_FMT_RAW))
1107
# Verify the self signature in the key
1108
crtverify = ctypes.c_uint()
1109
(gnutls.library.functions
1110
.gnutls_openpgp_crt_verify_self(crt, 0,
1111
ctypes.byref(crtverify)))
1112
if crtverify.value != 0:
1113
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1114
raise (gnutls.errors.CertificateSecurityError
1115
(u"Verify failed"))
1116
# New buffer for the fingerprint
1117
buf = ctypes.create_string_buffer(20)
1118
buf_len = ctypes.c_size_t()
1119
# Get the fingerprint from the certificate into the buffer
1120
(gnutls.library.functions
1121
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1122
ctypes.byref(buf_len)))
1123
# Deinit the certificate
1124
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1125
# Convert the buffer to a Python bytestring
1126
fpr = ctypes.string_at(buf, buf_len.value)
1127
# Convert the bytestring to hexadecimal notation
1128
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1129
return hex_fpr
1130
1131
1132
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1133
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1134
def process_request(self, request, client_address):
1135
"""Overrides and wraps the original process_request().
1136
1137
This function creates a new pipe in self.pipe
1138
"""
1139
self.pipe = os.pipe()
1140
super(ForkingMixInWithPipe,
1141
self).process_request(request, client_address)
1142
os.close(self.pipe[1]) # close write end
1143
self.add_pipe(self.pipe[0])
1144
def add_pipe(self, pipe):
1145
"""Dummy function; override as necessary"""
1146
os.close(pipe)
1147
1148
1149
class IPv6_TCPServer(ForkingMixInWithPipe,
1150
socketserver.TCPServer, object):
1151
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1152
666
session = (gnutls.connection
667
.ClientSession(self.request,
668
gnutls.connection
669
.X509Credentials()))
670
671
line = self.request.makefile().readline()
672
logger.debug(u"Protocol version: %r", line)
673
try:
674
if int(line.strip().split()[0]) > 1:
675
raise RuntimeError
676
except (ValueError, IndexError, RuntimeError), error:
677
logger.error(u"Unknown protocol version: %s", error)
678
return
679
680
# Note: gnutls.connection.X509Credentials is really a generic
681
# GnuTLS certificate credentials object so long as no X.509
682
# keys are added to it. Therefore, we can use it here despite
683
# using OpenPGP certificates.
684
685
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
686
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
687
# "+DHE-DSS"))
688
# Use a fallback default, since this MUST be set.
689
priority = self.server.settings.get("priority", "NORMAL")
690
(gnutls.library.functions
691
.gnutls_priority_set_direct(session._c_object,
692
priority, None))
693
694
try:
695
session.handshake()
696
except gnutls.errors.GNUTLSError, error:
697
logger.warning(u"Handshake failed: %s", error)
698
# Do not run session.bye() here: the session is not
699
# established. Just abandon the request.
700
return
701
logger.debug(u"Handshake succeeded")
702
try:
703
fpr = fingerprint(peer_certificate(session))
704
except (TypeError, gnutls.errors.GNUTLSError), error:
705
logger.warning(u"Bad certificate: %s", error)
706
session.bye()
707
return
708
logger.debug(u"Fingerprint: %s", fpr)
709
710
for c in self.server.clients:
711
if c.fingerprint == fpr:
712
client = c
713
break
714
else:
715
logger.warning(u"Client not found for fingerprint: %s",
716
fpr)
717
session.bye()
718
return
719
# Have to check if client.still_valid(), since it is possible
720
# that the client timed out while establishing the GnuTLS
721
# session.
722
if not client.still_valid():
723
logger.warning(u"Client %(name)s is invalid",
724
vars(client))
725
session.bye()
726
return
727
## This won't work here, since we're in a fork.
728
# client.checked_ok()
729
sent_size = 0
730
while sent_size < len(client.secret):
731
sent = session.send(client.secret[sent_size:])
732
logger.debug(u"Sent: %d, remaining: %d",
733
sent, len(client.secret)
734
- (sent_size + sent))
735
sent_size += sent
736
session.bye()
737
738
739
class IPv6_TCPServer(SocketServer.ForkingMixIn,
740
SocketServer.TCPServer, object):
741
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1153
742
Attributes:
743
settings: Server settings
744
clients: Set() of Client objects
1154
745
enabled: Boolean; whether this server is activated yet
1155
interface: None or a network interface name (string)
1156
use_ipv6: Boolean; to use IPv6 or not
1157
746
"""
1158
def __init__(self, server_address, RequestHandlerClass,
1159
interface=None, use_ipv6=True):
1160
self.interface = interface
1161
if use_ipv6:
1162
self.address_family = socket.AF_INET6
1163
socketserver.TCPServer.__init__(self, server_address,
1164
RequestHandlerClass)
747
address_family = socket.AF_INET6
748
def __init__(self, *args, **kwargs):
749
if "settings" in kwargs:
750
self.settings = kwargs["settings"]
751
del kwargs["settings"]
752
if "clients" in kwargs:
753
self.clients = kwargs["clients"]
754
del kwargs["clients"]
755
self.enabled = False
756
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1165
757
def server_bind(self):
1166
758
"""This overrides the normal server_bind() function
1167
759
to bind to an interface if one was specified, and also NOT to
1168
760
bind to an address or port if they were not specified."""
1169
if self.interface is not None:
1170
if SO_BINDTODEVICE is None:
1171
logger.error(u"SO_BINDTODEVICE does not exist;"
1172
u" cannot bind to interface %s",
1173
self.interface)
1174
else:
1175
try:
1176
self.socket.setsockopt(socket.SOL_SOCKET,
1177
SO_BINDTODEVICE,
1178
str(self.interface
1179
+ u'\0'))
1180
except socket.error, error:
1181
if error[0] == errno.EPERM:
1182
logger.error(u"No permission to"
1183
u" bind to interface %s",
1184
self.interface)
1185
elif error[0] == errno.ENOPROTOOPT:
1186
logger.error(u"SO_BINDTODEVICE not available;"
1187
u" cannot bind to interface %s",
1188
self.interface)
1189
else:
1190
raise
761
if self.settings["interface"]:
762
# 25 is from /usr/include/asm-i486/socket.h
763
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
764
try:
765
self.socket.setsockopt(socket.SOL_SOCKET,
766
SO_BINDTODEVICE,
767
self.settings["interface"])
768
except socket.error, error:
769
if error[0] == errno.EPERM:
770
logger.error(u"No permission to"
771
u" bind to interface %s",
772
self.settings["interface"])
773
else:
774
raise
1191
775
# Only bind(2) the socket if we really need to.
1192
776
if self.server_address[0] or self.server_address[1]:
1193
777
if not self.server_address[0]:
1194
if self.address_family == socket.AF_INET6:
1195
any_address = u"::" # in6addr_any
1196
else:
1197
any_address = socket.INADDR_ANY
1198
self.server_address = (any_address,
778
in6addr_any = "::"
779
self.server_address = (in6addr_any,
1199
780
self.server_address[1])
1200
781
elif not self.server_address[1]:
1201
782
self.server_address = (self.server_address[0],
1202
783
0)
1203
# if self.interface:
784
# if self.settings["interface"]:
1204
785
# self.server_address = (self.server_address[0],
1205
786
# 0, # port
1206
787
# 0, # flowinfo
1207
788
# if_nametoindex
1208
# (self.interface))
1209
return socketserver.TCPServer.server_bind(self)
1210
1211
1212
class MandosServer(IPv6_TCPServer):
1213
"""Mandos server.
1214
1215
Attributes:
1216
clients: set of Client objects
1217
gnutls_priority GnuTLS priority string
1218
use_dbus: Boolean; to emit D-Bus signals or not
1219
1220
Assumes a gobject.MainLoop event loop.
1221
"""
1222
def __init__(self, server_address, RequestHandlerClass,
1223
interface=None, use_ipv6=True, clients=None,
1224
gnutls_priority=None, use_dbus=True):
1225
self.enabled = False
1226
self.clients = clients
1227
if self.clients is None:
1228
self.clients = set()
1229
self.use_dbus = use_dbus
1230
self.gnutls_priority = gnutls_priority
1231
IPv6_TCPServer.__init__(self, server_address,
1232
RequestHandlerClass,
1233
interface = interface,
1234
use_ipv6 = use_ipv6)
789
# (self.settings
790
# ["interface"]))
791
return super(IPv6_TCPServer, self).server_bind()
1235
792
def server_activate(self):
1236
793
if self.enabled:
1237
return socketserver.TCPServer.server_activate(self)
794
return super(IPv6_TCPServer, self).server_activate()
1238
795
def enable(self):
1239
796
self.enabled = True
1240
def add_pipe(self, pipe):
1241
# Call "handle_ipc" for both data and EOF events
1242
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1243
self.handle_ipc)
1244
def handle_ipc(self, source, condition, file_objects={}):
1245
condition_names = {
1246
gobject.IO_IN: u"IN", # There is data to read.
1247
gobject.IO_OUT: u"OUT", # Data can be written (without
1248
# blocking).
1249
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1250
gobject.IO_ERR: u"ERR", # Error condition.
1251
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1252
# broken, usually for pipes and
1253
# sockets).
1254
}
1255
conditions_string = ' | '.join(name
1256
for cond, name in
1257
condition_names.iteritems()
1258
if cond & condition)
1259
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1260
conditions_string)
1261
1262
# Turn the pipe file descriptor into a Python file object
1263
if source not in file_objects:
1264
file_objects[source] = os.fdopen(source, u"r", 1)
1265
1266
# Read a line from the file object
1267
cmdline = file_objects[source].readline()
1268
if not cmdline: # Empty line means end of file
1269
# close the IPC pipe
1270
file_objects[source].close()
1271
del file_objects[source]
1272
1273
# Stop calling this function
1274
return False
1275
1276
logger.debug(u"IPC command: %r", cmdline)
1277
1278
# Parse and act on command
1279
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1280
1281
if cmd == u"NOTFOUND":
1282
logger.warning(u"Client not found for fingerprint: %s",
1283
args)
1284
if self.use_dbus:
1285
# Emit D-Bus signal
1286
mandos_dbus_service.ClientNotFound(args)
1287
elif cmd == u"INVALID":
1288
for client in self.clients:
1289
if client.name == args:
1290
logger.warning(u"Client %s is invalid", args)
1291
if self.use_dbus:
1292
# Emit D-Bus signal
1293
client.Rejected()
1294
break
1295
else:
1296
logger.error(u"Unknown client %s is invalid", args)
1297
elif cmd == u"SENDING":
1298
for client in self.clients:
1299
if client.name == args:
1300
logger.info(u"Sending secret to %s", client.name)
1301
client.checked_ok()
1302
if self.use_dbus:
1303
# Emit D-Bus signal
1304
client.GotSecret()
1305
break
1306
else:
1307
logger.error(u"Sending secret to unknown client %s",
1308
args)
1309
else:
1310
logger.error(u"Unknown IPC command: %r", cmdline)
1311
1312
# Keep calling this function
1313
return True
1314
797
1315
798
1316
799
def string_to_delta(interval):
1317
800
"""Parse a string and return a datetime.timedelta
1318
801
1319
>>> string_to_delta(u'7d')
802
>>> string_to_delta('7d')
1320
803
datetime.timedelta(7)
1321
>>> string_to_delta(u'60s')
804
>>> string_to_delta('60s')
1322
805
datetime.timedelta(0, 60)
1323
>>> string_to_delta(u'60m')
806
>>> string_to_delta('60m')
1324
807
datetime.timedelta(0, 3600)
1325
>>> string_to_delta(u'24h')
808
>>> string_to_delta('24h')
1326
809
datetime.timedelta(1)
1327
810
>>> string_to_delta(u'1w')
1328
811
datetime.timedelta(7)
1329
>>> string_to_delta(u'5m 30s')
812
>>> string_to_delta('5m 30s')
1330
813
datetime.timedelta(0, 330)
1331
814
"""
1332
815
timevalue = datetime.timedelta(0)
1352
835
return timevalue
1353
836
1354
837
838
def server_state_changed(state):
839
"""Derived from the Avahi example code"""
840
if state == avahi.SERVER_COLLISION:
841
logger.error(u"Zeroconf server name collision")
842
service.remove()
843
elif state == avahi.SERVER_RUNNING:
844
service.add()
845
846
847
def entry_group_state_changed(state, error):
848
"""Derived from the Avahi example code"""
849
logger.debug(u"Avahi state change: %i", state)
850
851
if state == avahi.ENTRY_GROUP_ESTABLISHED:
852
logger.debug(u"Zeroconf service established.")
853
elif state == avahi.ENTRY_GROUP_COLLISION:
854
logger.warning(u"Zeroconf service name collision.")
855
service.rename()
856
elif state == avahi.ENTRY_GROUP_FAILURE:
857
logger.critical(u"Avahi: Error in group state changed %s",
858
unicode(error))
859
raise AvahiGroupError(u"State changed: %s" % unicode(error))
860
1355
861
def if_nametoindex(interface):
1356
"""Call the C function if_nametoindex(), or equivalent
1357
1358
Note: This function cannot accept a unicode string."""
862
"""Call the C function if_nametoindex(), or equivalent"""
1359
863
global if_nametoindex
1360
864
try:
1361
865
if_nametoindex = (ctypes.cdll.LoadLibrary
1362
(ctypes.util.find_library(u"c"))
866
(ctypes.util.find_library("c"))
1363
867
.if_nametoindex)
1364
868
except (OSError, AttributeError):
1365
logger.warning(u"Doing if_nametoindex the hard way")
869
if "struct" not in sys.modules:
870
import struct
871
if "fcntl" not in sys.modules:
872
import fcntl
1366
873
def if_nametoindex(interface):
1367
874
"Get an interface index the hard way, i.e. using fcntl()"
1368
875
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1369
876
with closing(socket.socket()) as s:
1370
877
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1371
struct.pack(str(u"16s16x"),
1372
interface))
1373
interface_index = struct.unpack(str(u"I"),
1374
ifreq[16:20])[0]
878
struct.pack("16s16x", interface))
879
interface_index = struct.unpack("I", ifreq[16:20])[0]
1375
880
return interface_index
1376
881
return if_nametoindex(interface)
1377
882
1378
883
1379
884
def daemon(nochdir = False, noclose = False):
1380
885
"""See daemon(3). Standard BSD Unix function.
1381
1382
886
This should really exist as os.daemon, but it doesn't (yet)."""
1383
887
if os.fork():
1384
888
sys.exit()
1385
889
os.setsid()
1386
890
if not nochdir:
1387
os.chdir(u"/")
891
os.chdir("/")
1388
892
if os.fork():
1389
893
sys.exit()
1390
894
if not noclose:
1392
896
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1393
897
if not stat.S_ISCHR(os.fstat(null).st_mode):
1394
898
raise OSError(errno.ENODEV,
1395
u"%s not a character device"
1396
% os.path.devnull)
899
"/dev/null not a character device")
1397
900
os.dup2(null, sys.stdin.fileno())
1398
901
os.dup2(null, sys.stdout.fileno())
1399
902
os.dup2(null, sys.stderr.fileno())
1402
905
1403
906
1404
907
def main():
1405
1406
##################################################################
1407
# Parsing of options, both command line and config file
1408
1409
908
parser = optparse.OptionParser(version = "%%prog %s" % version)
1410
parser.add_option("-i", u"--interface", type=u"string",
1411
metavar="IF", help=u"Bind to interface IF")
1412
parser.add_option("-a", u"--address", type=u"string",
1413
help=u"Address to listen for requests on")
1414
parser.add_option("-p", u"--port", type=u"int",
1415
help=u"Port number to receive requests on")
1416
parser.add_option("--check", action=u"store_true",
1417
help=u"Run self-test")
1418
parser.add_option("--debug", action=u"store_true",
1419
help=u"Debug mode; run in foreground and log to"
1420
u" terminal")
1421
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1422
u" priority string (see GnuTLS documentation)")
1423
parser.add_option("--servicename", type=u"string",
1424
metavar=u"NAME", help=u"Zeroconf service name")
1425
parser.add_option("--configdir", type=u"string",
1426
default=u"/etc/mandos", metavar=u"DIR",
1427
help=u"Directory to search for configuration"
1428
u" files")
1429
parser.add_option("--no-dbus", action=u"store_false",
1430
dest=u"use_dbus", help=u"Do not provide D-Bus"
1431
u" system bus interface")
1432
parser.add_option("--no-ipv6", action=u"store_false",
1433
dest=u"use_ipv6", help=u"Do not use IPv6")
909
parser.add_option("-i", "--interface", type="string",
910
metavar="IF", help="Bind to interface IF")
911
parser.add_option("-a", "--address", type="string",
912
help="Address to listen for requests on")
913
parser.add_option("-p", "--port", type="int",
914
help="Port number to receive requests on")
915
parser.add_option("--check", action="store_true",
916
help="Run self-test")
917
parser.add_option("--debug", action="store_true",
918
help="Debug mode; run in foreground and log to"
919
" terminal")
920
parser.add_option("--priority", type="string", help="GnuTLS"
921
" priority string (see GnuTLS documentation)")
922
parser.add_option("--servicename", type="string", metavar="NAME",
923
help="Zeroconf service name")
924
parser.add_option("--configdir", type="string",
925
default="/etc/mandos", metavar="DIR",
926
help="Directory to search for configuration"
927
" files")
928
parser.add_option("--no-dbus", action="store_false",
929
dest="use_dbus",
930
help="Do not provide D-Bus system bus"
931
" interface")
1434
932
options = parser.parse_args()[0]
1435
933
1436
934
if options.check:
1439
937
sys.exit()
1440
938
1441
939
# Default values for config file for server-global settings
1442
server_defaults = { u"interface": u"",
1443
u"address": u"",
1444
u"port": u"",
1445
u"debug": u"False",
1446
u"priority":
1447
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1448
u"servicename": u"Mandos",
1449
u"use_dbus": u"True",
1450
u"use_ipv6": u"True",
940
server_defaults = { "interface": "",
941
"address": "",
942
"port": "",
943
"debug": "False",
944
"priority":
945
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
946
"servicename": "Mandos",
947
"use_dbus": "True",
1451
948
}
1452
949
1453
950
# Parse config file for server-global settings
1454
server_config = configparser.SafeConfigParser(server_defaults)
951
server_config = ConfigParser.SafeConfigParser(server_defaults)
1455
952
del server_defaults
1456
server_config.read(os.path.join(options.configdir,
1457
u"mandos.conf"))
953
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1458
954
# Convert the SafeConfigParser object to a dict
1459
955
server_settings = server_config.defaults()
1460
956
# Use the appropriate methods on the non-string config options
1461
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1462
server_settings[option] = server_config.getboolean(u"DEFAULT",
1463
option)
957
server_settings["debug"] = server_config.getboolean("DEFAULT",
958
"debug")
959
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
960
"use_dbus")
1464
961
if server_settings["port"]:
1465
server_settings["port"] = server_config.getint(u"DEFAULT",
1466
u"port")
962
server_settings["port"] = server_config.getint("DEFAULT",
963
"port")
1467
964
del server_config
1468
965
1469
966
# Override the settings from the config file with command line
1470
967
# options, if set.
1471
for option in (u"interface", u"address", u"port", u"debug",
1472
u"priority", u"servicename", u"configdir",
1473
u"use_dbus", u"use_ipv6"):
968
for option in ("interface", "address", "port", "debug",
969
"priority", "servicename", "configdir",
970
"use_dbus"):
1474
971
value = getattr(options, option)
1475
972
if value is not None:
1476
973
server_settings[option] = value
1477
974
del options
1478
# Force all strings to be unicode
1479
for option in server_settings.keys():
1480
if type(server_settings[option]) is str:
1481
server_settings[option] = unicode(server_settings[option])
1482
975
# Now we have our good server settings in "server_settings"
1483
976
1484
##################################################################
1485
1486
977
# For convenience
1487
debug = server_settings[u"debug"]
1488
use_dbus = server_settings[u"use_dbus"]
1489
use_ipv6 = server_settings[u"use_ipv6"]
978
debug = server_settings["debug"]
979
use_dbus = server_settings["use_dbus"]
1490
980
1491
981
if not debug:
1492
982
syslogger.setLevel(logging.WARNING)
1493
983
console.setLevel(logging.WARNING)
1494
984
1495
if server_settings[u"servicename"] != u"Mandos":
985
if server_settings["servicename"] != "Mandos":
1496
986
syslogger.setFormatter(logging.Formatter
1497
(u'Mandos (%s) [%%(process)d]:'
1498
u' %%(levelname)s: %%(message)s'
1499
% server_settings[u"servicename"]))
987
('Mandos (%s): %%(levelname)s:'
988
' %%(message)s'
989
% server_settings["servicename"]))
1500
990
1501
991
# Parse config file with clients
1502
client_defaults = { u"timeout": u"1h",
1503
u"interval": u"5m",
1504
u"checker": u"fping -q -- %%(host)s",
1505
u"host": u"",
992
client_defaults = { "timeout": "1h",
993
"interval": "5m",
994
"checker": "fping -q -- %%(host)s",
995
"host": "",
1506
996
}
1507
client_config = configparser.SafeConfigParser(client_defaults)
1508
client_config.read(os.path.join(server_settings[u"configdir"],
1509
u"clients.conf"))
1510
1511
global mandos_dbus_service
1512
mandos_dbus_service = None
1513
1514
tcp_server = MandosServer((server_settings[u"address"],
1515
server_settings[u"port"]),
1516
ClientHandler,
1517
interface=server_settings[u"interface"],
1518
use_ipv6=use_ipv6,
1519
gnutls_priority=
1520
server_settings[u"priority"],
1521
use_dbus=use_dbus)
1522
pidfilename = u"/var/run/mandos.pid"
997
client_config = ConfigParser.SafeConfigParser(client_defaults)
998
client_config.read(os.path.join(server_settings["configdir"],
999
"clients.conf"))
1000
1001
clients = Set()
1002
tcp_server = IPv6_TCPServer((server_settings["address"],
1003
server_settings["port"]),
1004
TCP_handler,
1005
settings=server_settings,
1006
clients=clients)
1007
pidfilename = "/var/run/mandos.pid"
1523
1008
try:
1524
pidfile = open(pidfilename, u"w")
1009
pidfile = open(pidfilename, "w")
1525
1010
except IOError:
1526
logger.error(u"Could not open file %r", pidfilename)
1011
logger.error("Could not open file %r", pidfilename)
1527
1012
1528
1013
try:
1529
uid = pwd.getpwnam(u"_mandos").pw_uid
1530
gid = pwd.getpwnam(u"_mandos").pw_gid
1014
uid = pwd.getpwnam("_mandos").pw_uid
1015
gid = pwd.getpwnam("_mandos").pw_gid
1531
1016
except KeyError:
1532
1017
try:
1533
uid = pwd.getpwnam(u"mandos").pw_uid
1534
gid = pwd.getpwnam(u"mandos").pw_gid
1018
uid = pwd.getpwnam("mandos").pw_uid
1019
gid = pwd.getpwnam("mandos").pw_gid
1535
1020
except KeyError:
1536
1021
try:
1537
uid = pwd.getpwnam(u"nobody").pw_uid
1538
gid = pwd.getpwnam(u"nobody").pw_gid
1022
uid = pwd.getpwnam("nobody").pw_uid
1023
gid = pwd.getpwnam("nogroup").pw_gid
1539
1024
except KeyError:
1540
1025
uid = 65534
1541
1026
gid = 65534
1554
1039
1555
1040
@gnutls.library.types.gnutls_log_func
1556
1041
def debug_gnutls(level, string):
1557
logger.debug(u"GnuTLS: %s", string[:-1])
1042
logger.debug("GnuTLS: %s", string[:-1])
1558
1043
1559
1044
(gnutls.library.functions
1560
1045
.gnutls_global_set_log_function(debug_gnutls))
1561
1046
1047
global service
1048
service = AvahiService(name = server_settings["servicename"],
1049
servicetype = "_mandos._tcp", )
1050
if server_settings["interface"]:
1051
service.interface = (if_nametoindex
1052
(server_settings["interface"]))
1053
1562
1054
global main_loop
1055
global bus
1056
global server
1563
1057
# From the Avahi example code
1564
1058
DBusGMainLoop(set_as_default=True )
1565
1059
main_loop = gobject.MainLoop()
1566
1060
bus = dbus.SystemBus()
1061
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1062
avahi.DBUS_PATH_SERVER),
1063
avahi.DBUS_INTERFACE_SERVER)
1567
1064
# End of Avahi example code
1568
1065
if use_dbus:
1569
1066
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1570
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1571
service = AvahiService(name = server_settings[u"servicename"],
1572
servicetype = u"_mandos._tcp",
1573
protocol = protocol, bus = bus)
1574
if server_settings["interface"]:
1575
service.interface = (if_nametoindex
1576
(str(server_settings[u"interface"])))
1577
1067
1578
client_class = Client
1579
if use_dbus:
1580
client_class = functools.partial(ClientDBus, bus = bus)
1581
tcp_server.clients.update(set(
1582
client_class(name = section,
1583
config= dict(client_config.items(section)))
1584
for section in client_config.sections()))
1585
if not tcp_server.clients:
1068
clients.update(Set(Client(name = section,
1069
config
1070
= dict(client_config.items(section)),
1071
use_dbus = use_dbus)
1072
for section in client_config.sections()))
1073
if not clients:
1586
1074
logger.warning(u"No clients defined")
1587
1075
1588
1076
if debug:
1598
1086
daemon()
1599
1087
1600
1088
try:
1601
with closing(pidfile):
1602
pid = os.getpid()
1603
pidfile.write(str(pid) + "\n")
1089
pid = os.getpid()
1090
pidfile.write(str(pid) + "\n")
1091
pidfile.close()
1604
1092
del pidfile
1605
1093
except IOError:
1606
1094
logger.error(u"Could not write to file %r with PID %d",
1612
1100
1613
1101
def cleanup():
1614
1102
"Cleanup function; run on exit"
1615
service.cleanup()
1103
global group
1104
# From the Avahi example code
1105
if not group is None:
1106
group.Free()
1107
group = None
1108
# End of Avahi example code
1616
1109
1617
while tcp_server.clients:
1618
client = tcp_server.clients.pop()
1110
while clients:
1111
client = clients.pop()
1619
1112
client.disable_hook = None
1620
1113
client.disable()
1621
1114
1627
1120
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1628
1121
1629
1122
if use_dbus:
1630
class MandosDBusService(dbus.service.Object):
1123
class MandosServer(dbus.service.Object):
1631
1124
"""A D-Bus proxy object"""
1632
1125
def __init__(self):
1633
dbus.service.Object.__init__(self, bus, u"/")
1126
dbus.service.Object.__init__(self, bus, "/")
1634
1127
_interface = u"se.bsnet.fukt.Mandos"
1635
1128
1636
@dbus.service.signal(_interface, signature=u"oa{sv}")
1129
@dbus.service.signal(_interface, signature="oa{sv}")
1637
1130
def ClientAdded(self, objpath, properties):
1638
1131
"D-Bus signal"
1639
1132
pass
1640
1133
1641
@dbus.service.signal(_interface, signature=u"s")
1642
def ClientNotFound(self, fingerprint):
1643
"D-Bus signal"
1644
pass
1645
1646
@dbus.service.signal(_interface, signature=u"os")
1134
@dbus.service.signal(_interface, signature="os")
1647
1135
def ClientRemoved(self, objpath, name):
1648
1136
"D-Bus signal"
1649
1137
pass
1650
1138
1651
@dbus.service.method(_interface, out_signature=u"ao")
1139
@dbus.service.method(_interface, out_signature="ao")
1652
1140
def GetAllClients(self):
1653
1141
"D-Bus method"
1654
return dbus.Array(c.dbus_object_path
1655
for c in tcp_server.clients)
1142
return dbus.Array(c.dbus_object_path for c in clients)
1656
1143
1657
@dbus.service.method(_interface,
1658
out_signature=u"a{oa{sv}}")
1144
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1659
1145
def GetAllClientsWithProperties(self):
1660
1146
"D-Bus method"
1661
1147
return dbus.Dictionary(
1662
((c.dbus_object_path, c.GetAll(u""))
1663
for c in tcp_server.clients),
1664
signature=u"oa{sv}")
1148
((c.dbus_object_path, c.GetAllProperties())
1149
for c in clients),
1150
signature="oa{sv}")
1665
1151
1666
@dbus.service.method(_interface, in_signature=u"o")
1152
@dbus.service.method(_interface, in_signature="o")
1667
1153
def RemoveClient(self, object_path):
1668
1154
"D-Bus method"
1669
for c in tcp_server.clients:
1155
for c in clients:
1670
1156
if c.dbus_object_path == object_path:
1671
tcp_server.clients.remove(c)
1672
c.remove_from_connection()
1157
clients.remove(c)
1673
1158
# Don't signal anything except ClientRemoved
1674
c.disable(signal=False)
1159
c.use_dbus = False
1160
c.disable()
1675
1161
# Emit D-Bus signal
1676
1162
self.ClientRemoved(object_path, c.name)
1677
1163
return
1679
1165
1680
1166
del _interface
1681
1167
1682
mandos_dbus_service = MandosDBusService()
1168
mandos_server = MandosServer()
1683
1169
1684
for client in tcp_server.clients:
1170
for client in clients:
1685
1171
if use_dbus:
1686
1172
# Emit D-Bus signal
1687
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1688
client.GetAll(u""))
1173
mandos_server.ClientAdded(client.dbus_object_path,
1174
client.GetAllProperties())
1689
1175
client.enable()
1690
1176
1691
1177
tcp_server.enable()
1693
1179
1694
1180
# Find out what port we got
1695
1181
service.port = tcp_server.socket.getsockname()[1]
1696
if use_ipv6:
1697
logger.info(u"Now listening on address %r, port %d,"
1698
" flowinfo %d, scope_id %d"
1699
% tcp_server.socket.getsockname())
1700
else: # IPv4
1701
logger.info(u"Now listening on address %r, port %d"
1702
% tcp_server.socket.getsockname())
1182
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1183
u" scope_id %d" % tcp_server.socket.getsockname())
1703
1184
1704
1185
#service.interface = tcp_server.socket.getsockname()[3]
1705
1186
1706
1187
try:
1707
1188
# From the Avahi example code
1189
server.connect_to_signal("StateChanged", server_state_changed)
1708
1190
try:
1709
service.activate()
1191
server_state_changed(server.GetState())
1710
1192
except dbus.exceptions.DBusException, error:
1711
1193
logger.critical(u"DBusException: %s", error)
1712
1194
sys.exit(1)
1725
1207
except KeyboardInterrupt:
1726
1208
if debug:
1727
1209
print >> sys.stderr
1728
logger.debug(u"Server received KeyboardInterrupt")
1729
logger.debug(u"Server exiting")
1210
logger.debug("Server received KeyboardInterrupt")
1211
logger.debug("Server exiting")
1730
1212
1731
1213
if __name__ == '__main__':
1732
1214
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0