124
148
self.rename_count = 0
125
149
self.max_renames = max_renames
150
self.protocol = protocol
151
self.group = None # our entry group
154
self.entry_group_state_changed_match = None
126
155
def rename(self):
127
156
"""Derived from the Avahi example code"""
128
157
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
131
160
self.rename_count)
132
161
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
136
165
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
141
176
self.rename_count += 1
142
177
def remove(self):
143
178
"""Derived from the Avahi example code"""
144
if group is not None:
179
if self.entry_group_state_changed_match is not None:
180
self.entry_group_state_changed_match.remove()
181
self.entry_group_state_changed_match = None
182
if self.group is not None:
147
185
"""Derived from the Avahi example code"""
150
group = dbus.Interface(bus.get_object
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
service.name, service.type)
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
178
class Client(dbus.service.Object):
187
if self.group is None:
188
self.group = dbus.Interface(
189
self.bus.get_object(avahi.DBUS_NAME,
190
self.server.EntryGroupNew()),
191
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
self.entry_group_state_changed_match = (
193
self.group.connect_to_signal(
194
'StateChanged', self .entry_group_state_changed))
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
196
self.name, self.type)
197
self.group.AddService(
200
dbus.UInt32(0), # flags
201
self.name, self.type,
202
self.domain, self.host,
203
dbus.UInt16(self.port),
204
avahi.string_array_to_txt_array(self.TXT))
206
def entry_group_state_changed(self, state, error):
207
"""Derived from the Avahi example code"""
208
logger.debug("Avahi entry group state change: %i", state)
210
if state == avahi.ENTRY_GROUP_ESTABLISHED:
211
logger.debug("Zeroconf service established.")
212
elif state == avahi.ENTRY_GROUP_COLLISION:
213
logger.info("Zeroconf service name collision.")
215
elif state == avahi.ENTRY_GROUP_FAILURE:
216
logger.critical("Avahi: Error in group state changed %s",
218
raise AvahiGroupError("State changed: %s"
221
"""Derived from the Avahi example code"""
222
if self.group is not None:
225
except (dbus.exceptions.UnknownMethodException,
226
dbus.exceptions.DBusException) as e:
230
def server_state_changed(self, state, error=None):
231
"""Derived from the Avahi example code"""
232
logger.debug("Avahi server state change: %i", state)
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
240
if state in bad_states:
241
if bad_states[state] is not None:
243
logger.error(bad_states[state])
245
logger.error(bad_states[state] + ": %r", error)
247
elif state == avahi.SERVER_RUNNING:
251
logger.debug("Unknown state: %r", state)
253
logger.debug("Unknown state: %r: %r", state, error)
255
"""Derived from the Avahi example code"""
256
if self.server is None:
257
self.server = dbus.Interface(
258
self.bus.get_object(avahi.DBUS_NAME,
259
avahi.DBUS_PATH_SERVER,
260
follow_name_owner_changes=True),
261
avahi.DBUS_INTERFACE_SERVER)
262
self.server.connect_to_signal("StateChanged",
263
self.server_state_changed)
264
self.server_state_changed(self.server.GetState())
267
class Client(object):
179
268
"""A representation of a client host served by this server.
181
name: string; from the config file, used in log messages
271
_approved: bool(); 'None' if not yet approved/disapproved
272
approval_delay: datetime.timedelta(); Time to wait for approval
273
approval_duration: datetime.timedelta(); Duration of one approval
274
checker: subprocess.Popen(); a running checker process used
275
to see if the client lives.
276
'None' if no process is running.
277
checker_callback_tag: a gobject event source tag, or None
278
checker_command: string; External command which is run to check
279
if client lives. %() expansions are done at
280
runtime with vars(self) as dict, so that for
281
instance %(name)s can be used in the command.
282
checker_initiator_tag: a gobject event source tag, or None
283
created: datetime.datetime(); (UTC) object creation
284
current_checker_command: string; current running checker_command
285
disable_hook: If set, called by disable() as disable_hook(self)
286
disable_initiator_tag: a gobject event source tag, or None
182
288
fingerprint: string (40 or 32 hexadecimal digits); used to
183
289
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
290
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
291
interval: datetime.timedelta(); How often to start a new checker
292
last_approval_request: datetime.datetime(); (UTC) or None
293
last_checked_ok: datetime.datetime(); (UTC) or None
187
294
last_enabled: datetime.datetime(); (UTC)
189
last_checked_ok: datetime.datetime(); (UTC) or None
295
name: string; from the config file, used in log messages and
297
secret: bytestring; sent verbatim (over TLS) to client
190
298
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
197
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
199
checker_callback_tag: - '' -
200
checker_command: string; External command which is run to check if
201
client lives. %() expansions are done at
202
runtime with vars(self) as dict, so that for
203
instance %(name)s can be used in the command.
204
dbus_object_path: dbus.ObjectPath
206
_timeout: Real variable for 'timeout'
207
_interval: Real variable for 'interval'
208
_timeout_milliseconds: Used when calling gobject.timeout_add()
209
_interval_milliseconds: - '' -
299
until this client is disabled
300
extended_timeout: extra long timeout when password has been sent
301
runtime_expansions: Allowed attributes for runtime expansion.
302
expires: datetime.datetime(); time (UTC) when a client will be
211
def _set_timeout(self, timeout):
212
"Setter function for the 'timeout' attribute"
213
self._timeout = timeout
214
self._timeout_milliseconds = ((self.timeout.days
215
* 24 * 60 * 60 * 1000)
216
+ (self.timeout.seconds * 1000)
217
+ (self.timeout.microseconds
220
self.PropertyChanged(dbus.String(u"timeout"),
221
(dbus.UInt64(self._timeout_milliseconds,
223
timeout = property(lambda self: self._timeout, _set_timeout)
226
def _set_interval(self, interval):
227
"Setter function for the 'interval' attribute"
228
self._interval = interval
229
self._interval_milliseconds = ((self.interval.days
230
* 24 * 60 * 60 * 1000)
231
+ (self.interval.seconds
233
+ (self.interval.microseconds
236
self.PropertyChanged(dbus.String(u"interval"),
237
(dbus.UInt64(self._interval_milliseconds,
239
interval = property(lambda self: self._interval, _set_interval)
306
runtime_expansions = ("approval_delay", "approval_duration",
307
"created", "enabled", "fingerprint",
308
"host", "interval", "last_checked_ok",
309
"last_enabled", "name", "timeout")
312
def _timedelta_to_milliseconds(td):
313
"Convert a datetime.timedelta() to milliseconds"
314
return ((td.days * 24 * 60 * 60 * 1000)
315
+ (td.seconds * 1000)
316
+ (td.microseconds // 1000))
318
def timeout_milliseconds(self):
319
"Return the 'timeout' attribute in milliseconds"
320
return self._timedelta_to_milliseconds(self.timeout)
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return self._timedelta_to_milliseconds(self.extended_timeout)
326
def interval_milliseconds(self):
327
"Return the 'interval' attribute in milliseconds"
328
return self._timedelta_to_milliseconds(self.interval)
330
def approval_delay_milliseconds(self):
331
return self._timedelta_to_milliseconds(self.approval_delay)
242
333
def __init__(self, name = None, disable_hook=None, config=None):
243
334
"""Note: the 'checker' key in 'config' sets the
244
335
'checker_command' attribute and *not* the 'checker'
246
self.dbus_object_path = (dbus.ObjectPath
248
+ name.replace(".", "_")))
249
dbus.service.Object.__init__(self, bus,
250
self.dbus_object_path)
251
338
if config is None:
254
logger.debug(u"Creating client %r", self.name)
340
logger.debug("Creating client %r", self.name)
255
341
# Uppercase and remove spaces from fingerprint for later
256
342
# comparison purposes with return value from the fingerprint()
258
344
self.fingerprint = (config["fingerprint"].upper()
260
logger.debug(u" Fingerprint: %s", self.fingerprint)
346
logger.debug(" Fingerprint: %s", self.fingerprint)
261
347
if "secret" in config:
262
self.secret = config["secret"].decode(u"base64")
348
self.secret = config["secret"].decode("base64")
263
349
elif "secfile" in config:
264
with closing(open(os.path.expanduser
266
(config["secfile"])))) as secfile:
350
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
267
353
self.secret = secfile.read()
269
raise TypeError(u"No secret or secfile for client %s"
355
raise TypeError("No secret or secfile for client %s"
271
357
self.host = config.get("host", "")
272
358
self.created = datetime.datetime.utcnow()
273
359
self.enabled = False
360
self.last_approval_request = None
274
361
self.last_enabled = None
275
362
self.last_checked_ok = None
276
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
277
365
self.interval = string_to_delta(config["interval"])
278
366
self.disable_hook = disable_hook
279
367
self.checker = None
280
368
self.checker_initiator_tag = None
281
369
self.disable_initiator_tag = None
282
371
self.checker_callback_tag = None
283
372
self.checker_command = config["checker"]
373
self.current_checker_command = None
374
self.last_connect = None
375
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
378
self.approvals_pending = 0
379
self.approval_delay = string_to_delta(
380
config["approval_delay"])
381
self.approval_duration = string_to_delta(
382
config["approval_duration"])
383
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
385
def send_changedstate(self):
386
self.changedstate.acquire()
387
self.changedstate.notify_all()
388
self.changedstate.release()
285
390
def enable(self):
286
391
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
395
self.send_changedstate()
287
396
self.last_enabled = datetime.datetime.utcnow()
288
397
# Schedule a new checker to be started an 'interval' from now,
289
398
# and every interval from then on.
290
399
self.checker_initiator_tag = (gobject.timeout_add
291
(self._interval_milliseconds,
400
(self.interval_milliseconds(),
292
401
self.start_checker))
293
# Also start a new checker *right now*.
295
402
# Schedule a disable() when 'timeout' has passed
403
self.expires = datetime.datetime.utcnow() + self.timeout
296
404
self.disable_initiator_tag = (gobject.timeout_add
297
(self._timeout_milliseconds,
405
(self.timeout_milliseconds(),
299
407
self.enabled = True
301
self.PropertyChanged(dbus.String(u"enabled"),
302
dbus.Boolean(True, variant_level=1))
303
self.PropertyChanged(dbus.String(u"last_enabled"),
304
(_datetime_to_dbus(self.last_enabled,
408
# Also start a new checker *right now*.
411
def disable(self, quiet=True):
308
412
"""Disable this client."""
309
413
if not getattr(self, "enabled", False):
311
logger.info(u"Disabling client %s", self.name)
416
self.send_changedstate()
418
logger.info("Disabling client %s", self.name)
312
419
if getattr(self, "disable_initiator_tag", False):
313
420
gobject.source_remove(self.disable_initiator_tag)
314
421
self.disable_initiator_tag = None
315
423
if getattr(self, "checker_initiator_tag", False):
316
424
gobject.source_remove(self.checker_initiator_tag)
317
425
self.checker_initiator_tag = None
432
551
self.checker_callback_tag = None
433
552
if getattr(self, "checker", None) is None:
435
logger.debug(u"Stopping checker for %(name)s", vars(self))
554
logger.debug("Stopping checker for %(name)s", vars(self))
437
556
os.kill(self.checker.pid, signal.SIGTERM)
439
558
#if self.checker.poll() is None:
440
559
# os.kill(self.checker.pid, signal.SIGKILL)
441
except OSError, error:
560
except OSError as error:
442
561
if error.errno != errno.ESRCH: # No such process
444
563
self.checker = None
445
self.PropertyChanged(dbus.String(u"checker_running"),
565
def dbus_service_property(dbus_interface, signature="v",
566
access="readwrite", byte_arrays=False):
567
"""Decorators for marking methods of a DBusObjectWithProperties to
568
become properties on the D-Bus.
570
The decorated method will be called with no arguments by "Get"
571
and with one argument by "Set".
573
The parameters, where they are supported, are the same as
574
dbus.service.method, except there is only "signature", since the
575
type from Get() and the type sent to Set() is the same.
577
# Encoding deeply encoded byte arrays is not supported yet by the
578
# "Set" method, so we fail early here:
579
if byte_arrays and signature != "ay":
580
raise ValueError("Byte arrays not supported for non-'ay'"
581
" signature %r" % signature)
583
func._dbus_is_property = True
584
func._dbus_interface = dbus_interface
585
func._dbus_signature = signature
586
func._dbus_access = access
587
func._dbus_name = func.__name__
588
if func._dbus_name.endswith("_dbus_property"):
589
func._dbus_name = func._dbus_name[:-14]
590
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
595
class DBusPropertyException(dbus.exceptions.DBusException):
596
"""A base class for D-Bus property-related exceptions
598
def __unicode__(self):
599
return unicode(str(self))
602
class DBusPropertyAccessException(DBusPropertyException):
603
"""A property's access permissions disallows an operation.
608
class DBusPropertyNotFound(DBusPropertyException):
609
"""An attempt was made to access a non-existing property.
614
class DBusObjectWithProperties(dbus.service.Object):
615
"""A D-Bus object with properties.
617
Classes inheriting from this can use the dbus_service_property
618
decorator to expose methods as D-Bus properties. It exposes the
619
standard Get(), Set(), and GetAll() methods on the D-Bus.
623
def _is_dbus_property(obj):
624
return getattr(obj, "_dbus_is_property", False)
626
def _get_all_dbus_properties(self):
627
"""Returns a generator of (name, attribute) pairs
629
return ((prop._dbus_name, prop)
631
inspect.getmembers(self, self._is_dbus_property))
633
def _get_dbus_property(self, interface_name, property_name):
634
"""Returns a bound method if one exists which is a D-Bus
635
property with the specified name and interface.
637
for name in (property_name,
638
property_name + "_dbus_property"):
639
prop = getattr(self, name, None)
641
or not self._is_dbus_property(prop)
642
or prop._dbus_name != property_name
643
or (interface_name and prop._dbus_interface
644
and interface_name != prop._dbus_interface)):
648
raise DBusPropertyNotFound(self.dbus_object_path + ":"
649
+ interface_name + "."
652
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
654
def Get(self, interface_name, property_name):
655
"""Standard D-Bus property Get() method, see D-Bus standard.
657
prop = self._get_dbus_property(interface_name, property_name)
658
if prop._dbus_access == "write":
659
raise DBusPropertyAccessException(property_name)
661
if not hasattr(value, "variant_level"):
663
return type(value)(value, variant_level=value.variant_level+1)
665
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
666
def Set(self, interface_name, property_name, value):
667
"""Standard D-Bus property Set() method, see D-Bus standard.
669
prop = self._get_dbus_property(interface_name, property_name)
670
if prop._dbus_access == "read":
671
raise DBusPropertyAccessException(property_name)
672
if prop._dbus_get_args_options["byte_arrays"]:
673
# The byte_arrays option is not supported yet on
674
# signatures other than "ay".
675
if prop._dbus_signature != "ay":
677
value = dbus.ByteArray(''.join(unichr(byte)
681
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
682
out_signature="a{sv}")
683
def GetAll(self, interface_name):
684
"""Standard D-Bus property GetAll() method, see D-Bus
687
Note: Will not include properties with access="write".
690
for name, prop in self._get_all_dbus_properties():
692
and interface_name != prop._dbus_interface):
693
# Interface non-empty but did not match
695
# Ignore write-only properties
696
if prop._dbus_access == "write":
699
if not hasattr(value, "variant_level"):
702
all[name] = type(value)(value, variant_level=
703
value.variant_level+1)
704
return dbus.Dictionary(all, signature="sv")
706
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
708
path_keyword='object_path',
709
connection_keyword='connection')
710
def Introspect(self, object_path, connection):
711
"""Standard D-Bus method, overloaded to insert property tags.
713
xmlstring = dbus.service.Object.Introspect(self, object_path,
716
document = xml.dom.minidom.parseString(xmlstring)
717
def make_tag(document, name, prop):
718
e = document.createElement("property")
719
e.setAttribute("name", name)
720
e.setAttribute("type", prop._dbus_signature)
721
e.setAttribute("access", prop._dbus_access)
723
for if_tag in document.getElementsByTagName("interface"):
724
for tag in (make_tag(document, name, prop)
726
in self._get_all_dbus_properties()
727
if prop._dbus_interface
728
== if_tag.getAttribute("name")):
729
if_tag.appendChild(tag)
730
# Add the names to the return values for the
731
# "org.freedesktop.DBus.Properties" methods
732
if (if_tag.getAttribute("name")
733
== "org.freedesktop.DBus.Properties"):
734
for cn in if_tag.getElementsByTagName("method"):
735
if cn.getAttribute("name") == "Get":
736
for arg in cn.getElementsByTagName("arg"):
737
if (arg.getAttribute("direction")
739
arg.setAttribute("name", "value")
740
elif cn.getAttribute("name") == "GetAll":
741
for arg in cn.getElementsByTagName("arg"):
742
if (arg.getAttribute("direction")
744
arg.setAttribute("name", "props")
745
xmlstring = document.toxml("utf-8")
747
except (AttributeError, xml.dom.DOMException,
748
xml.parsers.expat.ExpatError) as error:
749
logger.error("Failed to override Introspection method",
754
class ClientDBus(Client, DBusObjectWithProperties):
755
"""A Client class using D-Bus
758
dbus_object_path: dbus.ObjectPath
759
bus: dbus.SystemBus()
762
runtime_expansions = (Client.runtime_expansions
763
+ ("dbus_object_path",))
765
# dbus.service.Object doesn't use super(), so we can't either.
767
def __init__(self, bus = None, *args, **kwargs):
768
self._approvals_pending = 0
770
Client.__init__(self, *args, **kwargs)
771
# Only now, when this client is initialized, can it show up on
773
client_object_name = unicode(self.name).translate(
776
self.dbus_object_path = (dbus.ObjectPath
777
("/clients/" + client_object_name))
778
DBusObjectWithProperties.__init__(self, self.bus,
779
self.dbus_object_path)
780
def _set_expires(self, value):
781
old_value = getattr(self, "_expires", None)
782
self._expires = value
783
if hasattr(self, "dbus_object_path") and old_value != value:
784
dbus_time = (self._datetime_to_dbus(self._expires,
786
self.PropertyChanged(dbus.String("Expires"),
788
expires = property(lambda self: self._expires, _set_expires)
791
def _get_approvals_pending(self):
792
return self._approvals_pending
793
def _set_approvals_pending(self, value):
794
old_value = self._approvals_pending
795
self._approvals_pending = value
797
if (hasattr(self, "dbus_object_path")
798
and bval is not bool(old_value)):
799
dbus_bool = dbus.Boolean(bval, variant_level=1)
800
self.PropertyChanged(dbus.String("ApprovalPending"),
803
approvals_pending = property(_get_approvals_pending,
804
_set_approvals_pending)
805
del _get_approvals_pending, _set_approvals_pending
808
def _datetime_to_dbus(dt, variant_level=0):
809
"""Convert a UTC datetime.datetime() to a D-Bus type."""
811
return dbus.String("", variant_level = variant_level)
812
return dbus.String(dt.isoformat(),
813
variant_level=variant_level)
816
oldstate = getattr(self, "enabled", False)
817
r = Client.enable(self)
818
if oldstate != self.enabled:
820
self.PropertyChanged(dbus.String("Enabled"),
821
dbus.Boolean(True, variant_level=1))
822
self.PropertyChanged(
823
dbus.String("LastEnabled"),
824
self._datetime_to_dbus(self.last_enabled,
828
def disable(self, quiet = False):
829
oldstate = getattr(self, "enabled", False)
830
r = Client.disable(self, quiet=quiet)
831
if not quiet and oldstate != self.enabled:
833
self.PropertyChanged(dbus.String("Enabled"),
834
dbus.Boolean(False, variant_level=1))
837
def __del__(self, *args, **kwargs):
839
self.remove_from_connection()
842
if hasattr(DBusObjectWithProperties, "__del__"):
843
DBusObjectWithProperties.__del__(self, *args, **kwargs)
844
Client.__del__(self, *args, **kwargs)
846
def checker_callback(self, pid, condition, command,
848
self.checker_callback_tag = None
851
self.PropertyChanged(dbus.String("CheckerRunning"),
446
852
dbus.Boolean(False, variant_level=1))
448
def still_valid(self):
449
"""Has the timeout not yet passed for this client?"""
450
if not getattr(self, "enabled", False):
452
now = datetime.datetime.utcnow()
453
if self.last_checked_ok is None:
454
return now < (self.created + self.timeout)
456
return now < (self.last_checked_ok + self.timeout)
458
## D-Bus methods & signals
459
_interface = u"org.mandos_system.Mandos.Client"
461
# BumpTimeout - method
462
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
463
BumpTimeout.__name__ = "BumpTimeout"
853
if os.WIFEXITED(condition):
854
exitstatus = os.WEXITSTATUS(condition)
856
self.CheckerCompleted(dbus.Int16(exitstatus),
857
dbus.Int64(condition),
858
dbus.String(command))
861
self.CheckerCompleted(dbus.Int16(-1),
862
dbus.Int64(condition),
863
dbus.String(command))
865
return Client.checker_callback(self, pid, condition, command,
868
def checked_ok(self, *args, **kwargs):
869
Client.checked_ok(self, *args, **kwargs)
871
self.PropertyChanged(
872
dbus.String("LastCheckedOK"),
873
(self._datetime_to_dbus(self.last_checked_ok,
876
def need_approval(self, *args, **kwargs):
877
r = Client.need_approval(self, *args, **kwargs)
879
self.PropertyChanged(
880
dbus.String("LastApprovalRequest"),
881
(self._datetime_to_dbus(self.last_approval_request,
885
def start_checker(self, *args, **kwargs):
886
old_checker = self.checker
887
if self.checker is not None:
888
old_checker_pid = self.checker.pid
890
old_checker_pid = None
891
r = Client.start_checker(self, *args, **kwargs)
892
# Only if new checker process was started
893
if (self.checker is not None
894
and old_checker_pid != self.checker.pid):
896
self.CheckerStarted(self.current_checker_command)
897
self.PropertyChanged(
898
dbus.String("CheckerRunning"),
899
dbus.Boolean(True, variant_level=1))
902
def stop_checker(self, *args, **kwargs):
903
old_checker = getattr(self, "checker", None)
904
r = Client.stop_checker(self, *args, **kwargs)
905
if (old_checker is not None
906
and getattr(self, "checker", None) is None):
907
self.PropertyChanged(dbus.String("CheckerRunning"),
908
dbus.Boolean(False, variant_level=1))
911
def _reset_approved(self):
912
self._approved = None
915
def approve(self, value=True):
916
self.send_changedstate()
917
self._approved = value
918
gobject.timeout_add(self._timedelta_to_milliseconds
919
(self.approval_duration),
920
self._reset_approved)
923
## D-Bus methods, signals & properties
924
_interface = "se.bsnet.fukt.Mandos.Client"
465
928
# CheckerCompleted - signal
466
@dbus.service.signal(_interface, signature="bqs")
467
def CheckerCompleted(self, success, condition, command):
929
@dbus.service.signal(_interface, signature="nxs")
930
def CheckerCompleted(self, exitcode, waitstatus, command):
572
997
# StopChecker - method
573
StopChecker = dbus.service.method(_interface)(stop_checker)
574
StopChecker.__name__ = "StopChecker"
998
@dbus.service.method(_interface)
999
def StopChecker(self):
1004
# ApprovalPending - property
1005
@dbus_service_property(_interface, signature="b", access="read")
1006
def ApprovalPending_dbus_property(self):
1007
return dbus.Boolean(bool(self.approvals_pending))
1009
# ApprovedByDefault - property
1010
@dbus_service_property(_interface, signature="b",
1012
def ApprovedByDefault_dbus_property(self, value=None):
1013
if value is None: # get
1014
return dbus.Boolean(self.approved_by_default)
1015
old_value = self.approved_by_default
1016
self.approved_by_default = bool(value)
1018
if old_value != self.approved_by_default:
1019
self.PropertyChanged(dbus.String("ApprovedByDefault"),
1020
dbus.Boolean(value, variant_level=1))
1022
# ApprovalDelay - property
1023
@dbus_service_property(_interface, signature="t",
1025
def ApprovalDelay_dbus_property(self, value=None):
1026
if value is None: # get
1027
return dbus.UInt64(self.approval_delay_milliseconds())
1028
old_value = self.approval_delay
1029
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1031
if old_value != self.approval_delay:
1032
self.PropertyChanged(dbus.String("ApprovalDelay"),
1033
dbus.UInt64(value, variant_level=1))
1035
# ApprovalDuration - property
1036
@dbus_service_property(_interface, signature="t",
1038
def ApprovalDuration_dbus_property(self, value=None):
1039
if value is None: # get
1040
return dbus.UInt64(self._timedelta_to_milliseconds(
1041
self.approval_duration))
1042
old_value = self.approval_duration
1043
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1045
if old_value != self.approval_duration:
1046
self.PropertyChanged(dbus.String("ApprovalDuration"),
1047
dbus.UInt64(value, variant_level=1))
1050
@dbus_service_property(_interface, signature="s", access="read")
1051
def Name_dbus_property(self):
1052
return dbus.String(self.name)
1054
# Fingerprint - property
1055
@dbus_service_property(_interface, signature="s", access="read")
1056
def Fingerprint_dbus_property(self):
1057
return dbus.String(self.fingerprint)
1060
@dbus_service_property(_interface, signature="s",
1062
def Host_dbus_property(self, value=None):
1063
if value is None: # get
1064
return dbus.String(self.host)
1065
old_value = self.host
1068
if old_value != self.host:
1069
self.PropertyChanged(dbus.String("Host"),
1070
dbus.String(value, variant_level=1))
1072
# Created - property
1073
@dbus_service_property(_interface, signature="s", access="read")
1074
def Created_dbus_property(self):
1075
return dbus.String(self._datetime_to_dbus(self.created))
1077
# LastEnabled - property
1078
@dbus_service_property(_interface, signature="s", access="read")
1079
def LastEnabled_dbus_property(self):
1080
return self._datetime_to_dbus(self.last_enabled)
1082
# Enabled - property
1083
@dbus_service_property(_interface, signature="b",
1085
def Enabled_dbus_property(self, value=None):
1086
if value is None: # get
1087
return dbus.Boolean(self.enabled)
1093
# LastCheckedOK - property
1094
@dbus_service_property(_interface, signature="s",
1096
def LastCheckedOK_dbus_property(self, value=None):
1097
if value is not None:
1100
return self._datetime_to_dbus(self.last_checked_ok)
1102
# Expires - property
1103
@dbus_service_property(_interface, signature="s", access="read")
1104
def Expires_dbus_property(self):
1105
return self._datetime_to_dbus(self.expires)
1107
# LastApprovalRequest - property
1108
@dbus_service_property(_interface, signature="s", access="read")
1109
def LastApprovalRequest_dbus_property(self):
1110
return self._datetime_to_dbus(self.last_approval_request)
1112
# Timeout - property
1113
@dbus_service_property(_interface, signature="t",
1115
def Timeout_dbus_property(self, value=None):
1116
if value is None: # get
1117
return dbus.UInt64(self.timeout_milliseconds())
1118
old_value = self.timeout
1119
self.timeout = datetime.timedelta(0, 0, 0, value)
1121
if old_value != self.timeout:
1122
self.PropertyChanged(dbus.String("Timeout"),
1123
dbus.UInt64(value, variant_level=1))
1124
if getattr(self, "disable_initiator_tag", None) is None:
1126
# Reschedule timeout
1127
gobject.source_remove(self.disable_initiator_tag)
1128
self.disable_initiator_tag = None
1130
time_to_die = (self.
1131
_timedelta_to_milliseconds((self
1136
if time_to_die <= 0:
1137
# The timeout has passed
1140
self.expires = (datetime.datetime.utcnow()
1141
+ datetime.timedelta(milliseconds = time_to_die))
1142
self.disable_initiator_tag = (gobject.timeout_add
1143
(time_to_die, self.disable))
1145
# ExtendedTimeout - property
1146
@dbus_service_property(_interface, signature="t",
1148
def ExtendedTimeout_dbus_property(self, value=None):
1149
if value is None: # get
1150
return dbus.UInt64(self.extended_timeout_milliseconds())
1151
old_value = self.extended_timeout
1152
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1154
if old_value != self.extended_timeout:
1155
self.PropertyChanged(dbus.String("ExtendedTimeout"),
1156
dbus.UInt64(value, variant_level=1))
1158
# Interval - property
1159
@dbus_service_property(_interface, signature="t",
1161
def Interval_dbus_property(self, value=None):
1162
if value is None: # get
1163
return dbus.UInt64(self.interval_milliseconds())
1164
old_value = self.interval
1165
self.interval = datetime.timedelta(0, 0, 0, value)
1167
if old_value != self.interval:
1168
self.PropertyChanged(dbus.String("Interval"),
1169
dbus.UInt64(value, variant_level=1))
1170
if getattr(self, "checker_initiator_tag", None) is None:
1172
# Reschedule checker run
1173
gobject.source_remove(self.checker_initiator_tag)
1174
self.checker_initiator_tag = (gobject.timeout_add
1175
(value, self.start_checker))
1176
self.start_checker() # Start one now, too
1178
# Checker - property
1179
@dbus_service_property(_interface, signature="s",
1181
def Checker_dbus_property(self, value=None):
1182
if value is None: # get
1183
return dbus.String(self.checker_command)
1184
old_value = self.checker_command
1185
self.checker_command = value
1187
if old_value != self.checker_command:
1188
self.PropertyChanged(dbus.String("Checker"),
1189
dbus.String(self.checker_command,
1192
# CheckerRunning - property
1193
@dbus_service_property(_interface, signature="b",
1195
def CheckerRunning_dbus_property(self, value=None):
1196
if value is None: # get
1197
return dbus.Boolean(self.checker is not None)
1199
self.start_checker()
1203
# ObjectPath - property
1204
@dbus_service_property(_interface, signature="o", access="read")
1205
def ObjectPath_dbus_property(self):
1206
return self.dbus_object_path # is already a dbus.ObjectPath
1209
@dbus_service_property(_interface, signature="ay",
1210
access="write", byte_arrays=True)
1211
def Secret_dbus_property(self, value):
1212
self.secret = str(value)
579
def peer_certificate(session):
580
"Return the peer's OpenPGP certificate as a bytestring"
581
# If not an OpenPGP certificate...
582
if (gnutls.library.functions
583
.gnutls_certificate_type_get(session._c_object)
584
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
585
# ...do the normal thing
586
return session.peer_certificate
587
list_size = ctypes.c_uint()
588
cert_list = (gnutls.library.functions
589
.gnutls_certificate_get_peers
590
(session._c_object, ctypes.byref(list_size)))
591
if list_size.value == 0:
594
return ctypes.string_at(cert.data, cert.size)
597
def fingerprint(openpgp):
598
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
599
# New GnuTLS "datum" with the OpenPGP public key
600
datum = (gnutls.library.types
601
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
604
ctypes.c_uint(len(openpgp))))
605
# New empty GnuTLS certificate
606
crt = gnutls.library.types.gnutls_openpgp_crt_t()
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
609
# Import the OpenPGP public key into the certificate
610
(gnutls.library.functions
611
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
612
gnutls.library.constants
613
.GNUTLS_OPENPGP_FMT_RAW))
614
# Verify the self signature in the key
615
crtverify = ctypes.c_uint()
616
(gnutls.library.functions
617
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
618
if crtverify.value != 0:
619
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
620
raise gnutls.errors.CertificateSecurityError("Verify failed")
621
# New buffer for the fingerprint
622
buf = ctypes.create_string_buffer(20)
623
buf_len = ctypes.c_size_t()
624
# Get the fingerprint from the certificate into the buffer
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
627
ctypes.byref(buf_len)))
628
# Deinit the certificate
629
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
630
# Convert the buffer to a Python bytestring
631
fpr = ctypes.string_at(buf, buf_len.value)
632
# Convert the bytestring to hexadecimal notation
633
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
637
class TCP_handler(SocketServer.BaseRequestHandler, object):
638
"""A TCP request handler class.
639
Instantiated by IPv6_TCPServer for each request to handle it.
1217
class ProxyClient(object):
1218
def __init__(self, child_pipe, fpr, address):
1219
self._pipe = child_pipe
1220
self._pipe.send(('init', fpr, address))
1221
if not self._pipe.recv():
1224
def __getattribute__(self, name):
1225
if(name == '_pipe'):
1226
return super(ProxyClient, self).__getattribute__(name)
1227
self._pipe.send(('getattr', name))
1228
data = self._pipe.recv()
1229
if data[0] == 'data':
1231
if data[0] == 'function':
1232
def func(*args, **kwargs):
1233
self._pipe.send(('funcall', name, args, kwargs))
1234
return self._pipe.recv()[1]
1237
def __setattr__(self, name, value):
1238
if(name == '_pipe'):
1239
return super(ProxyClient, self).__setattr__(name, value)
1240
self._pipe.send(('setattr', name, value))
1243
class ClientHandler(socketserver.BaseRequestHandler, object):
1244
"""A class to handle client connections.
1246
Instantiated once for each connection to handle it.
640
1247
Note: This will run in its own forked process."""
642
1249
def handle(self):
643
logger.info(u"TCP connection from: %s",
644
unicode(self.client_address))
645
session = (gnutls.connection
646
.ClientSession(self.request,
650
line = self.request.makefile().readline()
651
logger.debug(u"Protocol version: %r", line)
653
if int(line.strip().split()[0]) > 1:
655
except (ValueError, IndexError, RuntimeError), error:
656
logger.error(u"Unknown protocol version: %s", error)
659
# Note: gnutls.connection.X509Credentials is really a generic
660
# GnuTLS certificate credentials object so long as no X.509
661
# keys are added to it. Therefore, we can use it here despite
662
# using OpenPGP certificates.
664
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
665
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
667
# Use a fallback default, since this MUST be set.
668
priority = self.server.settings.get("priority", "NORMAL")
669
(gnutls.library.functions
670
.gnutls_priority_set_direct(session._c_object,
675
except gnutls.errors.GNUTLSError, error:
676
logger.warning(u"Handshake failed: %s", error)
677
# Do not run session.bye() here: the session is not
678
# established. Just abandon the request.
681
fpr = fingerprint(peer_certificate(session))
682
except (TypeError, gnutls.errors.GNUTLSError), error:
683
logger.warning(u"Bad certificate: %s", error)
686
logger.debug(u"Fingerprint: %s", fpr)
687
for c in self.server.clients:
688
if c.fingerprint == fpr:
692
logger.warning(u"Client not found for fingerprint: %s",
696
# Have to check if client.still_valid(), since it is possible
697
# that the client timed out while establishing the GnuTLS
699
if not client.still_valid():
700
logger.warning(u"Client %(name)s is invalid",
704
## This won't work here, since we're in a fork.
705
# client.bump_timeout()
707
while sent_size < len(client.secret):
708
sent = session.send(client.secret[sent_size:])
709
logger.debug(u"Sent: %d, remaining: %d",
710
sent, len(client.secret)
711
- (sent_size + sent))
716
class IPv6_TCPServer(SocketServer.ForkingMixIn,
717
SocketServer.TCPServer, object):
718
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1250
with contextlib.closing(self.server.child_pipe) as child_pipe:
1251
logger.info("TCP connection from: %s",
1252
unicode(self.client_address))
1253
logger.debug("Pipe FD: %d",
1254
self.server.child_pipe.fileno())
1256
session = (gnutls.connection
1257
.ClientSession(self.request,
1259
.X509Credentials()))
1261
# Note: gnutls.connection.X509Credentials is really a
1262
# generic GnuTLS certificate credentials object so long as
1263
# no X.509 keys are added to it. Therefore, we can use it
1264
# here despite using OpenPGP certificates.
1266
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1267
# "+AES-256-CBC", "+SHA1",
1268
# "+COMP-NULL", "+CTYPE-OPENPGP",
1270
# Use a fallback default, since this MUST be set.
1271
priority = self.server.gnutls_priority
1272
if priority is None:
1274
(gnutls.library.functions
1275
.gnutls_priority_set_direct(session._c_object,
1278
# Start communication using the Mandos protocol
1279
# Get protocol number
1280
line = self.request.makefile().readline()
1281
logger.debug("Protocol version: %r", line)
1283
if int(line.strip().split()[0]) > 1:
1285
except (ValueError, IndexError, RuntimeError) as error:
1286
logger.error("Unknown protocol version: %s", error)
1289
# Start GnuTLS connection
1292
except gnutls.errors.GNUTLSError as error:
1293
logger.warning("Handshake failed: %s", error)
1294
# Do not run session.bye() here: the session is not
1295
# established. Just abandon the request.
1297
logger.debug("Handshake succeeded")
1299
approval_required = False
1302
fpr = self.fingerprint(self.peer_certificate
1305
gnutls.errors.GNUTLSError) as error:
1306
logger.warning("Bad certificate: %s", error)
1308
logger.debug("Fingerprint: %s", fpr)
1311
client = ProxyClient(child_pipe, fpr,
1312
self.client_address)
1316
if client.approval_delay:
1317
delay = client.approval_delay
1318
client.approvals_pending += 1
1319
approval_required = True
1322
if not client.enabled:
1323
logger.info("Client %s is disabled",
1325
if self.server.use_dbus:
1327
client.Rejected("Disabled")
1330
if client._approved or not client.approval_delay:
1331
#We are approved or approval is disabled
1333
elif client._approved is None:
1334
logger.info("Client %s needs approval",
1336
if self.server.use_dbus:
1338
client.NeedApproval(
1339
client.approval_delay_milliseconds(),
1340
client.approved_by_default)
1342
logger.warning("Client %s was not approved",
1344
if self.server.use_dbus:
1346
client.Rejected("Denied")
1349
#wait until timeout or approved
1350
#x = float(client._timedelta_to_milliseconds(delay))
1351
time = datetime.datetime.now()
1352
client.changedstate.acquire()
1353
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1354
client.changedstate.release()
1355
time2 = datetime.datetime.now()
1356
if (time2 - time) >= delay:
1357
if not client.approved_by_default:
1358
logger.warning("Client %s timed out while"
1359
" waiting for approval",
1361
if self.server.use_dbus:
1363
client.Rejected("Approval timed out")
1368
delay -= time2 - time
1371
while sent_size < len(client.secret):
1373
sent = session.send(client.secret[sent_size:])
1374
except gnutls.errors.GNUTLSError as error:
1375
logger.warning("gnutls send failed")
1377
logger.debug("Sent: %d, remaining: %d",
1378
sent, len(client.secret)
1379
- (sent_size + sent))
1382
logger.info("Sending secret to %s", client.name)
1383
# bump the timeout as if seen
1384
client.checked_ok(client.extended_timeout)
1385
if self.server.use_dbus:
1390
if approval_required:
1391
client.approvals_pending -= 1
1394
except gnutls.errors.GNUTLSError as error:
1395
logger.warning("GnuTLS bye failed")
1398
def peer_certificate(session):
1399
"Return the peer's OpenPGP certificate as a bytestring"
1400
# If not an OpenPGP certificate...
1401
if (gnutls.library.functions
1402
.gnutls_certificate_type_get(session._c_object)
1403
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1404
# ...do the normal thing
1405
return session.peer_certificate
1406
list_size = ctypes.c_uint(1)
1407
cert_list = (gnutls.library.functions
1408
.gnutls_certificate_get_peers
1409
(session._c_object, ctypes.byref(list_size)))
1410
if not bool(cert_list) and list_size.value != 0:
1411
raise gnutls.errors.GNUTLSError("error getting peer"
1413
if list_size.value == 0:
1416
return ctypes.string_at(cert.data, cert.size)
1419
def fingerprint(openpgp):
1420
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1421
# New GnuTLS "datum" with the OpenPGP public key
1422
datum = (gnutls.library.types
1423
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1426
ctypes.c_uint(len(openpgp))))
1427
# New empty GnuTLS certificate
1428
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1429
(gnutls.library.functions
1430
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1431
# Import the OpenPGP public key into the certificate
1432
(gnutls.library.functions
1433
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1434
gnutls.library.constants
1435
.GNUTLS_OPENPGP_FMT_RAW))
1436
# Verify the self signature in the key
1437
crtverify = ctypes.c_uint()
1438
(gnutls.library.functions
1439
.gnutls_openpgp_crt_verify_self(crt, 0,
1440
ctypes.byref(crtverify)))
1441
if crtverify.value != 0:
1442
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1443
raise (gnutls.errors.CertificateSecurityError
1445
# New buffer for the fingerprint
1446
buf = ctypes.create_string_buffer(20)
1447
buf_len = ctypes.c_size_t()
1448
# Get the fingerprint from the certificate into the buffer
1449
(gnutls.library.functions
1450
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1451
ctypes.byref(buf_len)))
1452
# Deinit the certificate
1453
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1454
# Convert the buffer to a Python bytestring
1455
fpr = ctypes.string_at(buf, buf_len.value)
1456
# Convert the bytestring to hexadecimal notation
1457
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1461
class MultiprocessingMixIn(object):
1462
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1463
def sub_process_main(self, request, address):
1465
self.finish_request(request, address)
1467
self.handle_error(request, address)
1468
self.close_request(request)
1470
def process_request(self, request, address):
1471
"""Start a new process to process the request."""
1472
multiprocessing.Process(target = self.sub_process_main,
1473
args = (request, address)).start()
1475
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1476
""" adds a pipe to the MixIn """
1477
def process_request(self, request, client_address):
1478
"""Overrides and wraps the original process_request().
1480
This function creates a new pipe in self.pipe
1482
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1484
super(MultiprocessingMixInWithPipe,
1485
self).process_request(request, client_address)
1486
self.child_pipe.close()
1487
self.add_pipe(parent_pipe)
1489
def add_pipe(self, parent_pipe):
1490
"""Dummy function; override as necessary"""
1491
raise NotImplementedError
1493
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1494
socketserver.TCPServer, object):
1495
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
720
settings: Server settings
721
clients: Set() of Client objects
722
1498
enabled: Boolean; whether this server is activated yet
1499
interface: None or a network interface name (string)
1500
use_ipv6: Boolean; to use IPv6 or not
724
address_family = socket.AF_INET6
725
def __init__(self, *args, **kwargs):
726
if "settings" in kwargs:
727
self.settings = kwargs["settings"]
728
del kwargs["settings"]
729
if "clients" in kwargs:
730
self.clients = kwargs["clients"]
731
del kwargs["clients"]
733
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1502
def __init__(self, server_address, RequestHandlerClass,
1503
interface=None, use_ipv6=True):
1504
self.interface = interface
1506
self.address_family = socket.AF_INET6
1507
socketserver.TCPServer.__init__(self, server_address,
1508
RequestHandlerClass)
734
1509
def server_bind(self):
735
1510
"""This overrides the normal server_bind() function
736
1511
to bind to an interface if one was specified, and also NOT to
737
1512
bind to an address or port if they were not specified."""
738
if self.settings["interface"]:
739
# 25 is from /usr/include/asm-i486/socket.h
740
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
742
self.socket.setsockopt(socket.SOL_SOCKET,
744
self.settings["interface"])
745
except socket.error, error:
746
if error[0] == errno.EPERM:
747
logger.error(u"No permission to"
748
u" bind to interface %s",
749
self.settings["interface"])
1513
if self.interface is not None:
1514
if SO_BINDTODEVICE is None:
1515
logger.error("SO_BINDTODEVICE does not exist;"
1516
" cannot bind to interface %s",
1520
self.socket.setsockopt(socket.SOL_SOCKET,
1524
except socket.error as error:
1525
if error[0] == errno.EPERM:
1526
logger.error("No permission to"
1527
" bind to interface %s",
1529
elif error[0] == errno.ENOPROTOOPT:
1530
logger.error("SO_BINDTODEVICE not available;"
1531
" cannot bind to interface %s",
752
1535
# Only bind(2) the socket if we really need to.
753
1536
if self.server_address[0] or self.server_address[1]:
754
1537
if not self.server_address[0]:
756
self.server_address = (in6addr_any,
1538
if self.address_family == socket.AF_INET6:
1539
any_address = "::" # in6addr_any
1541
any_address = socket.INADDR_ANY
1542
self.server_address = (any_address,
757
1543
self.server_address[1])
758
1544
elif not self.server_address[1]:
759
1545
self.server_address = (self.server_address[0],
761
# if self.settings["interface"]:
1547
# if self.interface:
762
1548
# self.server_address = (self.server_address[0],
765
1551
# if_nametoindex
768
return super(IPv6_TCPServer, self).server_bind()
1553
return socketserver.TCPServer.server_bind(self)
1556
class MandosServer(IPv6_TCPServer):
1560
clients: set of Client objects
1561
gnutls_priority GnuTLS priority string
1562
use_dbus: Boolean; to emit D-Bus signals or not
1564
Assumes a gobject.MainLoop event loop.
1566
def __init__(self, server_address, RequestHandlerClass,
1567
interface=None, use_ipv6=True, clients=None,
1568
gnutls_priority=None, use_dbus=True):
1569
self.enabled = False
1570
self.clients = clients
1571
if self.clients is None:
1572
self.clients = set()
1573
self.use_dbus = use_dbus
1574
self.gnutls_priority = gnutls_priority
1575
IPv6_TCPServer.__init__(self, server_address,
1576
RequestHandlerClass,
1577
interface = interface,
1578
use_ipv6 = use_ipv6)
769
1579
def server_activate(self):
770
1580
if self.enabled:
771
return super(IPv6_TCPServer, self).server_activate()
1581
return socketserver.TCPServer.server_activate(self)
772
1582
def enable(self):
773
1583
self.enabled = True
1584
def add_pipe(self, parent_pipe):
1585
# Call "handle_ipc" for both data and EOF events
1586
gobject.io_add_watch(parent_pipe.fileno(),
1587
gobject.IO_IN | gobject.IO_HUP,
1588
functools.partial(self.handle_ipc,
1589
parent_pipe = parent_pipe))
1591
def handle_ipc(self, source, condition, parent_pipe=None,
1592
client_object=None):
1594
gobject.IO_IN: "IN", # There is data to read.
1595
gobject.IO_OUT: "OUT", # Data can be written (without
1597
gobject.IO_PRI: "PRI", # There is urgent data to read.
1598
gobject.IO_ERR: "ERR", # Error condition.
1599
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1600
# broken, usually for pipes and
1603
conditions_string = ' | '.join(name
1605
condition_names.iteritems()
1606
if cond & condition)
1607
# error or the other end of multiprocessing.Pipe has closed
1608
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1611
# Read a request from the child
1612
request = parent_pipe.recv()
1613
command = request[0]
1615
if command == 'init':
1617
address = request[2]
1619
for c in self.clients:
1620
if c.fingerprint == fpr:
1624
logger.info("Client not found for fingerprint: %s, ad"
1625
"dress: %s", fpr, address)
1628
mandos_dbus_service.ClientNotFound(fpr, address[0])
1629
parent_pipe.send(False)
1632
gobject.io_add_watch(parent_pipe.fileno(),
1633
gobject.IO_IN | gobject.IO_HUP,
1634
functools.partial(self.handle_ipc,
1635
parent_pipe = parent_pipe,
1636
client_object = client))
1637
parent_pipe.send(True)
1638
# remove the old hook in favor of the new above hook on same fileno
1640
if command == 'funcall':
1641
funcname = request[1]
1645
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1647
if command == 'getattr':
1648
attrname = request[1]
1649
if callable(client_object.__getattribute__(attrname)):
1650
parent_pipe.send(('function',))
1652
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1654
if command == 'setattr':
1655
attrname = request[1]
1657
setattr(client_object, attrname, value)
776
1662
def string_to_delta(interval):
777
1663
"""Parse a string and return a datetime.timedelta
779
1665
>>> string_to_delta('7d')
780
1666
datetime.timedelta(7)
781
1667
>>> string_to_delta('60s')
918
1798
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
919
1799
"servicename": "Mandos",
922
1805
# Parse config file for server-global settings
923
server_config = ConfigParser.SafeConfigParser(server_defaults)
1806
server_config = configparser.SafeConfigParser(server_defaults)
924
1807
del server_defaults
925
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1808
server_config.read(os.path.join(options.configdir,
926
1810
# Convert the SafeConfigParser object to a dict
927
1811
server_settings = server_config.defaults()
928
# Use getboolean on the boolean config option
929
server_settings["debug"] = (server_config.getboolean
930
("DEFAULT", "debug"))
1812
# Use the appropriate methods on the non-string config options
1813
for option in ("debug", "use_dbus", "use_ipv6"):
1814
server_settings[option] = server_config.getboolean("DEFAULT",
1816
if server_settings["port"]:
1817
server_settings["port"] = server_config.getint("DEFAULT",
931
1819
del server_config
933
1821
# Override the settings from the config file with command line
934
1822
# options, if set.
935
1823
for option in ("interface", "address", "port", "debug",
936
"priority", "servicename", "configdir"):
1824
"priority", "servicename", "configdir",
1825
"use_dbus", "use_ipv6", "debuglevel"):
937
1826
value = getattr(options, option)
938
1827
if value is not None:
939
1828
server_settings[option] = value
1830
# Force all strings to be unicode
1831
for option in server_settings.keys():
1832
if type(server_settings[option]) is str:
1833
server_settings[option] = unicode(server_settings[option])
941
1834
# Now we have our good server settings in "server_settings"
1836
##################################################################
943
1839
debug = server_settings["debug"]
946
syslogger.setLevel(logging.WARNING)
947
console.setLevel(logging.WARNING)
1840
debuglevel = server_settings["debuglevel"]
1841
use_dbus = server_settings["use_dbus"]
1842
use_ipv6 = server_settings["use_ipv6"]
949
1844
if server_settings["servicename"] != "Mandos":
950
1845
syslogger.setFormatter(logging.Formatter
951
('Mandos (%s): %%(levelname)s:'
1846
('Mandos (%s) [%%(process)d]:'
1847
' %%(levelname)s: %%(message)s'
953
1848
% server_settings["servicename"]))
955
1850
# Parse config file with clients
956
client_defaults = { "timeout": "1h",
958
"checker": "fping -q -- %(host)s",
1851
client_defaults = { "timeout": "5m",
1852
"extended_timeout": "15m",
1854
"checker": "fping -q -- %%(host)s",
1856
"approval_delay": "0s",
1857
"approval_duration": "1s",
961
client_config = ConfigParser.SafeConfigParser(client_defaults)
1859
client_config = configparser.SafeConfigParser(client_defaults)
962
1860
client_config.read(os.path.join(server_settings["configdir"],
963
1861
"clients.conf"))
966
tcp_server = IPv6_TCPServer((server_settings["address"],
967
server_settings["port"]),
969
settings=server_settings,
971
pidfilename = "/var/run/mandos.pid"
973
pidfile = open(pidfilename, "w")
974
except IOError, error:
975
logger.error("Could not open file %r", pidfilename)
1863
global mandos_dbus_service
1864
mandos_dbus_service = None
1866
tcp_server = MandosServer((server_settings["address"],
1867
server_settings["port"]),
1869
interface=(server_settings["interface"]
1873
server_settings["priority"],
1876
pidfilename = "/var/run/mandos.pid"
1878
pidfile = open(pidfilename, "w")
1880
logger.error("Could not open file %r", pidfilename)
978
1883
uid = pwd.getpwnam("_mandos").pw_uid
1884
gid = pwd.getpwnam("_mandos").pw_gid
979
1885
except KeyError:
981
1887
uid = pwd.getpwnam("mandos").pw_uid
1888
gid = pwd.getpwnam("mandos").pw_gid
982
1889
except KeyError:
984
1891
uid = pwd.getpwnam("nobody").pw_uid
1892
gid = pwd.getpwnam("nobody").pw_gid
985
1893
except KeyError:
988
gid = pwd.getpwnam("_mandos").pw_gid
991
gid = pwd.getpwnam("mandos").pw_gid
994
gid = pwd.getpwnam("nogroup").pw_gid
1000
except OSError, error:
1899
except OSError as error:
1001
1900
if error[0] != errno.EPERM:
1005
service = AvahiService(name = server_settings["servicename"],
1006
servicetype = "_mandos._tcp", )
1007
if server_settings["interface"]:
1008
service.interface = (if_nametoindex
1009
(server_settings["interface"]))
1014
# From the Avahi example code
1015
DBusGMainLoop(set_as_default=True )
1016
main_loop = gobject.MainLoop()
1017
bus = dbus.SystemBus()
1018
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1019
avahi.DBUS_PATH_SERVER),
1020
avahi.DBUS_INTERFACE_SERVER)
1021
# End of Avahi example code
1022
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1024
clients.update(Set(Client(name = section,
1026
= dict(client_config.items(section)))
1027
for section in client_config.sections()))
1029
logger.critical(u"No clients defined")
1903
if not debug and not debuglevel:
1904
syslogger.setLevel(logging.WARNING)
1905
console.setLevel(logging.WARNING)
1907
level = getattr(logging, debuglevel.upper())
1908
syslogger.setLevel(level)
1909
console.setLevel(level)
1912
# Enable all possible GnuTLS debugging
1914
# "Use a log level over 10 to enable all debugging options."
1916
gnutls.library.functions.gnutls_global_set_log_level(11)
1918
@gnutls.library.types.gnutls_log_func
1919
def debug_gnutls(level, string):
1920
logger.debug("GnuTLS: %s", string[:-1])
1922
(gnutls.library.functions
1923
.gnutls_global_set_log_function(debug_gnutls))
1033
1925
# Redirect stdin so all checkers get /dev/null
1034
1926
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1035
1927
os.dup2(null, sys.stdin.fileno())
1039
1931
# No console logging
1040
1932
logger.removeHandler(console)
1934
# Need to fork before connecting to D-Bus
1041
1936
# Close all input and output, do double fork, etc.
1046
pidfile.write(str(pid) + "\n")
1050
logger.error(u"Could not write to file %r with PID %d",
1053
# "pidfile" was never created
1940
# From the Avahi example code
1941
DBusGMainLoop(set_as_default=True )
1942
main_loop = gobject.MainLoop()
1943
bus = dbus.SystemBus()
1944
# End of Avahi example code
1947
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1948
bus, do_not_queue=True)
1949
except dbus.exceptions.NameExistsException as e:
1950
logger.error(unicode(e) + ", disabling D-Bus")
1952
server_settings["use_dbus"] = False
1953
tcp_server.use_dbus = False
1954
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1955
service = AvahiService(name = server_settings["servicename"],
1956
servicetype = "_mandos._tcp",
1957
protocol = protocol, bus = bus)
1958
if server_settings["interface"]:
1959
service.interface = (if_nametoindex
1960
(str(server_settings["interface"])))
1962
global multiprocessing_manager
1963
multiprocessing_manager = multiprocessing.Manager()
1965
client_class = Client
1967
client_class = functools.partial(ClientDBus, bus = bus)
1968
def client_config_items(config, section):
1969
special_settings = {
1970
"approved_by_default":
1971
lambda: config.getboolean(section,
1972
"approved_by_default"),
1974
for name, value in config.items(section):
1976
yield (name, special_settings[name]())
1980
tcp_server.clients.update(set(
1981
client_class(name = section,
1982
config= dict(client_config_items(
1983
client_config, section)))
1984
for section in client_config.sections()))
1985
if not tcp_server.clients:
1986
logger.warning("No clients defined")
1992
pidfile.write(str(pid) + "\n".encode("utf-8"))
1995
logger.error("Could not write to file %r with PID %d",
1998
# "pidfile" was never created
2002
signal.signal(signal.SIGINT, signal.SIG_IGN)
2004
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2005
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2008
class MandosDBusService(dbus.service.Object):
2009
"""A D-Bus proxy object"""
2011
dbus.service.Object.__init__(self, bus, "/")
2012
_interface = "se.bsnet.fukt.Mandos"
2014
@dbus.service.signal(_interface, signature="o")
2015
def ClientAdded(self, objpath):
2019
@dbus.service.signal(_interface, signature="ss")
2020
def ClientNotFound(self, fingerprint, address):
2024
@dbus.service.signal(_interface, signature="os")
2025
def ClientRemoved(self, objpath, name):
2029
@dbus.service.method(_interface, out_signature="ao")
2030
def GetAllClients(self):
2032
return dbus.Array(c.dbus_object_path
2033
for c in tcp_server.clients)
2035
@dbus.service.method(_interface,
2036
out_signature="a{oa{sv}}")
2037
def GetAllClientsWithProperties(self):
2039
return dbus.Dictionary(
2040
((c.dbus_object_path, c.GetAll(""))
2041
for c in tcp_server.clients),
2044
@dbus.service.method(_interface, in_signature="o")
2045
def RemoveClient(self, object_path):
2047
for c in tcp_server.clients:
2048
if c.dbus_object_path == object_path:
2049
tcp_server.clients.remove(c)
2050
c.remove_from_connection()
2051
# Don't signal anything except ClientRemoved
2052
c.disable(quiet=True)
2054
self.ClientRemoved(object_path, c.name)
2056
raise KeyError(object_path)
2060
mandos_dbus_service = MandosDBusService()
1058
2063
"Cleanup function; run on exit"
1060
# From the Avahi example code
1061
if not group is None:
1064
# End of Avahi example code
1067
client = clients.pop()
2066
while tcp_server.clients:
2067
client = tcp_server.clients.pop()
2069
client.remove_from_connection()
1068
2070
client.disable_hook = None
2071
# Don't signal anything except ClientRemoved
2072
client.disable(quiet=True)
2075
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1071
2078
atexit.register(cleanup)
1074
signal.signal(signal.SIGINT, signal.SIG_IGN)
1075
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1078
class MandosServer(dbus.service.Object):
1079
"""A D-Bus proxy object"""
1081
dbus.service.Object.__init__(self, bus,
1083
_interface = u"org.mandos_system.Mandos"
1085
@dbus.service.signal(_interface, signature="oa{sv}")
1086
def ClientAdded(self, objpath, properties):
1090
@dbus.service.signal(_interface, signature="o")
1091
def ClientRemoved(self, objpath):
1095
@dbus.service.method(_interface, out_signature="ao")
1096
def GetAllClients(self):
1097
return dbus.Array(c.dbus_object_path for c in clients)
1099
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1100
def GetAllClientsWithProperties(self):
1101
return dbus.Dictionary(
1102
((c.dbus_object_path, c.GetAllProperties())
1106
@dbus.service.method(_interface, in_signature="o")
1107
def RemoveClient(self, object_path):
1109
if c.dbus_object_path == object_path:
1117
mandos_server = MandosServer()
1119
for client in clients:
1121
mandos_server.ClientAdded(client.dbus_object_path,
1122
client.GetAllProperties())
2080
for client in tcp_server.clients:
2083
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1123
2084
client.enable()
1125
2086
tcp_server.enable()