/mandos/release : revision 24.1.157

55

import logging

56

import logging.handlers

57

import pwd

58

from contextlib import closing

58

import contextlib

59

import struct

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

62

64

63

65

import dbus

64

66

import dbus.service

67

69

from dbus.mainloop.glib import DBusGMainLoop

68

70

import ctypes

69

71

import ctypes.util

72

import xml.dom.minidom

73

import inspect

70

74

71

75

try:

72

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

77

81

SO_BINDTODEVICE = None

78

82

79

83

80

version = "1.0.8"

84

version = "1.0.14"

81

85

86

#logger = logging.getLogger(u'mandos')

82

87

logger = logging.Logger(u'mandos')

83

88

syslogger = (logging.handlers.SysLogHandler

84

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

152

157

u" after %i retries, exiting.",

153

158

self.rename_count)

154

159

raise AvahiServiceError(u"Too many renames")

155

self.name = self.server.GetAlternativeServiceName(self.name)

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

156

161

logger.info(u"Changing Zeroconf service name to %r ...",

157

unicode(self.name))

162

self.name)

158

163

syslogger.setFormatter(logging.Formatter

159

164

(u'Mandos (%s) [%%(process)d]:'

160

165

u' %%(levelname)s: %%(message)s'

174

179

self.server.EntryGroupNew()),

175

180

avahi.DBUS_INTERFACE_ENTRY_GROUP)

176

181

self.group.connect_to_signal('StateChanged',

177

self.entry_group_state_changed)

182

self

183

.entry_group_state_changed)

178

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

179

185

self.name, self.type)

180

186

self.group.AddService(

188

194

self.group.Commit()

189

195

def entry_group_state_changed(self, state, error):

190

196

"""Derived from the Avahi example code"""

191

logger.debug(u"Avahi state change: %i", state)

197

logger.debug(u"Avahi entry group state change: %i", state)

192

198

193

199

if state == avahi.ENTRY_GROUP_ESTABLISHED:

194

200

logger.debug(u"Zeroconf service established.")

207

213

self.group = None

208

214

def server_state_changed(self, state):

209

215

"""Derived from the Avahi example code"""

216

logger.debug(u"Avahi server state change: %i", state)

210

217

if state == avahi.SERVER_COLLISION:

211

218

logger.error(u"Zeroconf server name collision")

212

219

self.remove()

239

246

enabled: bool()

240

247

last_checked_ok: datetime.datetime(); (UTC) or None

241

248

timeout: datetime.timedelta(); How long from last_checked_ok

242

until this client is invalid

249

until this client is disabled

243

250

interval: datetime.timedelta(); How often to start a new checker

244

251

disable_hook: If set, called by disable() as disable_hook(self)

245

252

checker: subprocess.Popen(); a running checker process used

246

253

to see if the client lives.

247

254

'None' if no process is running.

248

255

checker_initiator_tag: a gobject event source tag, or None

249

disable_initiator_tag: - '' -

256

disable_initiator_tag: - '' -

250

257

checker_callback_tag: - '' -

251

258

checker_command: string; External command which is run to check if

252

259

client lives. %() expansions are done at

253

260

runtime with vars(self) as dict, so that for

254

261

instance %(name)s can be used in the command.

255

262

current_checker_command: string; current running checker_command

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

256

266

"""

257

267

258

268

@staticmethod

259

def _datetime_to_milliseconds(dt):

260

"Convert a datetime.datetime() to milliseconds"

261

return ((dt.days * 24 * 60 * 60 * 1000)

262

+ (dt.seconds * 1000)

263

+ (dt.microseconds // 1000))

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

264

274

265

275

def timeout_milliseconds(self):

266

276

"Return the 'timeout' attribute in milliseconds"

267

return self._datetime_to_milliseconds(self.timeout)

277

return self._timedelta_to_milliseconds(self.timeout)

268

278

269

279

def interval_milliseconds(self):

270

280

"Return the 'interval' attribute in milliseconds"

271

return self._datetime_to_milliseconds(self.interval)

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

272

285

273

286

def __init__(self, name = None, disable_hook=None, config=None):

274

287

"""Note: the 'checker' key in 'config' sets the

287

300

if u"secret" in config:

288

301

self.secret = config[u"secret"].decode(u"base64")

289

302

elif u"secfile" in config:

290

with closing(open(os.path.expanduser

291

(os.path.expandvars

292

(config[u"secfile"])))) as secfile:

303

with open(os.path.expanduser(os.path.expandvars

304

(config[u"secfile"])),

305

"rb") as secfile:

293

306

self.secret = secfile.read()

294

307

else:

295

308

raise TypeError(u"No secret or secfile for client %s"

309

322

self.checker_command = config[u"checker"]

310

323

self.current_checker_command = None

311

324

self.last_connect = None

325

self._approved = None

326

self.approved_by_default = config.get(u"approved_by_default",

327

True)

328

self.approvals_pending = 0

329

self.approved_delay = string_to_delta(

330

config[u"approved_delay"])

331

self.approved_duration = string_to_delta(

332

config[u"approved_duration"])

333

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

312

334

335

def send_changedstate(self):

336

self.changedstate.acquire()

337

self.changedstate.notify_all()

338

self.changedstate.release()

339

313

340

def enable(self):

314

341

"""Start this client's checker and timeout hooks"""

315

342

if getattr(self, u"enabled", False):

316

343

# Already enabled

317

344

return

345

self.send_changedstate()

318

346

self.last_enabled = datetime.datetime.utcnow()

319

347

# Schedule a new checker to be started an 'interval' from now,

320

348

# and every interval from then on.

321

349

self.checker_initiator_tag = (gobject.timeout_add

322

350

(self.interval_milliseconds(),

323

351

self.start_checker))

324

# Also start a new checker *right now*.

325

self.start_checker()

326

352

# Schedule a disable() when 'timeout' has passed

327

353

self.disable_initiator_tag = (gobject.timeout_add

328

354

(self.timeout_milliseconds(),

329

355

self.disable))

330

356

self.enabled = True

357

# Also start a new checker *right now*.

358

self.start_checker()

331

359

332

def disable(self):

360

def disable(self, quiet=True):

333

361

"""Disable this client."""

334

362

if not getattr(self, "enabled", False):

335

363

return False

336

logger.info(u"Disabling client %s", self.name)

364

if not quiet:

365

self.send_changedstate()

366

if not quiet:

367

logger.info(u"Disabling client %s", self.name)

337

368

if getattr(self, u"disable_initiator_tag", False):

338

369

gobject.source_remove(self.disable_initiator_tag)

339

370

self.disable_initiator_tag = None

391

422

# client would inevitably timeout, since no checker would get

392

423

# a chance to run to completion. If we instead leave running

393

424

# checkers alone, the checker would have to take more time

394

# than 'timeout' for the client to be declared invalid, which

395

# is as it should be.

425

# than 'timeout' for the client to be disabled, which is as it

426

# should be.

396

427

397

428

# If a checker exists, make sure it is not a zombie

398

if self.checker is not None:

429

try:

399

430

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

431

except (AttributeError, OSError), error:

432

if (isinstance(error, OSError)

433

and error.errno != errno.ECHILD):

434

raise error

435

else:

400

436

if pid:

401

437

logger.warning(u"Checker was a zombie")

402

438

gobject.source_remove(self.checker_callback_tag)

458

494

logger.debug(u"Stopping checker for %(name)s", vars(self))

459

495

try:

460

496

os.kill(self.checker.pid, signal.SIGTERM)

461

#os.sleep(0.5)

497

#time.sleep(0.5)

462

498

#if self.checker.poll() is None:

463

499

# os.kill(self.checker.pid, signal.SIGKILL)

464

500

except OSError, error:

465

501

if error.errno != errno.ESRCH: # No such process

466

502

raise

467

503

self.checker = None

468

469

def still_valid(self):

470

"""Has the timeout not yet passed for this client?"""

471

if not getattr(self, u"enabled", False):

472

return False

473

now = datetime.datetime.utcnow()

474

if self.last_checked_ok is None:

475

return now < (self.created + self.timeout)

476

else:

477

return now < (self.last_checked_ok + self.timeout)

478

479

480

class ClientDBus(Client, dbus.service.Object):

504

505

def dbus_service_property(dbus_interface, signature=u"v",

506

access=u"readwrite", byte_arrays=False):

507

"""Decorators for marking methods of a DBusObjectWithProperties to

508

become properties on the D-Bus.

509

510

The decorated method will be called with no arguments by "Get"

511

and with one argument by "Set".

512

513

The parameters, where they are supported, are the same as

514

dbus.service.method, except there is only "signature", since the

515

type from Get() and the type sent to Set() is the same.

516

"""

517

# Encoding deeply encoded byte arrays is not supported yet by the

518

# "Set" method, so we fail early here:

519

if byte_arrays and signature != u"ay":

520

raise ValueError(u"Byte arrays not supported for non-'ay'"

521

u" signature %r" % signature)

522

def decorator(func):

523

func._dbus_is_property = True

524

func._dbus_interface = dbus_interface

525

func._dbus_signature = signature

526

func._dbus_access = access

527

func._dbus_name = func.__name__

528

if func._dbus_name.endswith(u"_dbus_property"):

529

func._dbus_name = func._dbus_name[:-14]

530

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

531

return func

532

return decorator

533

534

535

class DBusPropertyException(dbus.exceptions.DBusException):

536

"""A base class for D-Bus property-related exceptions

537

"""

538

def __unicode__(self):

539

return unicode(str(self))

540

541

542

class DBusPropertyAccessException(DBusPropertyException):

543

"""A property's access permissions disallows an operation.

544

"""

545

pass

546

547

548

class DBusPropertyNotFound(DBusPropertyException):

549

"""An attempt was made to access a non-existing property.

550

"""

551

pass

552

553

554

class DBusObjectWithProperties(dbus.service.Object):

555

"""A D-Bus object with properties.

556

557

Classes inheriting from this can use the dbus_service_property

558

decorator to expose methods as D-Bus properties. It exposes the

559

standard Get(), Set(), and GetAll() methods on the D-Bus.

560

"""

561

562

@staticmethod

563

def _is_dbus_property(obj):

564

return getattr(obj, u"_dbus_is_property", False)

565

566

def _get_all_dbus_properties(self):

567

"""Returns a generator of (name, attribute) pairs

568

"""

569

return ((prop._dbus_name, prop)

570

for name, prop in

571

inspect.getmembers(self, self._is_dbus_property))

572

573

def _get_dbus_property(self, interface_name, property_name):

574

"""Returns a bound method if one exists which is a D-Bus

575

property with the specified name and interface.

576

"""

577

for name in (property_name,

578

property_name + u"_dbus_property"):

579

prop = getattr(self, name, None)

580

if (prop is None

581

or not self._is_dbus_property(prop)

582

or prop._dbus_name != property_name

583

or (interface_name and prop._dbus_interface

584

and interface_name != prop._dbus_interface)):

585

continue

586

return prop

587

# No such property

588

raise DBusPropertyNotFound(self.dbus_object_path + u":"

589

+ interface_name + u"."

590

+ property_name)

591

592

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

593

out_signature=u"v")

594

def Get(self, interface_name, property_name):

595

"""Standard D-Bus property Get() method, see D-Bus standard.

596

"""

597

prop = self._get_dbus_property(interface_name, property_name)

598

if prop._dbus_access == u"write":

599

raise DBusPropertyAccessException(property_name)

600

value = prop()

601

if not hasattr(value, u"variant_level"):

602

return value

603

return type(value)(value, variant_level=value.variant_level+1)

604

605

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

606

def Set(self, interface_name, property_name, value):

607

"""Standard D-Bus property Set() method, see D-Bus standard.

608

"""

609

prop = self._get_dbus_property(interface_name, property_name)

610

if prop._dbus_access == u"read":

611

raise DBusPropertyAccessException(property_name)

612

if prop._dbus_get_args_options[u"byte_arrays"]:

613

# The byte_arrays option is not supported yet on

614

# signatures other than "ay".

615

if prop._dbus_signature != u"ay":

616

raise ValueError

617

value = dbus.ByteArray(''.join(unichr(byte)

618

for byte in value))

619

prop(value)

620

621

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

622

out_signature=u"a{sv}")

623

def GetAll(self, interface_name):

624

"""Standard D-Bus property GetAll() method, see D-Bus

625

standard.

626

627

Note: Will not include properties with access="write".

628

"""

629

all = {}

630

for name, prop in self._get_all_dbus_properties():

631

if (interface_name

632

and interface_name != prop._dbus_interface):

633

# Interface non-empty but did not match

634

continue

635

# Ignore write-only properties

636

if prop._dbus_access == u"write":

637

continue

638

value = prop()

639

if not hasattr(value, u"variant_level"):

640

all[name] = value

641

continue

642

all[name] = type(value)(value, variant_level=

643

value.variant_level+1)

644

return dbus.Dictionary(all, signature=u"sv")

645

646

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

647

out_signature=u"s",

648

path_keyword='object_path',

649

connection_keyword='connection')

650

def Introspect(self, object_path, connection):

651

"""Standard D-Bus method, overloaded to insert property tags.

652

"""

653

xmlstring = dbus.service.Object.Introspect(self, object_path,

654

connection)

655

try:

656

document = xml.dom.minidom.parseString(xmlstring)

657

def make_tag(document, name, prop):

658

e = document.createElement(u"property")

659

e.setAttribute(u"name", name)

660

e.setAttribute(u"type", prop._dbus_signature)

661

e.setAttribute(u"access", prop._dbus_access)

662

return e

663

for if_tag in document.getElementsByTagName(u"interface"):

664

for tag in (make_tag(document, name, prop)

665

for name, prop

666

in self._get_all_dbus_properties()

667

if prop._dbus_interface

668

== if_tag.getAttribute(u"name")):

669

if_tag.appendChild(tag)

670

# Add the names to the return values for the

671

# "org.freedesktop.DBus.Properties" methods

672

if (if_tag.getAttribute(u"name")

673

== u"org.freedesktop.DBus.Properties"):

674

for cn in if_tag.getElementsByTagName(u"method"):

675

if cn.getAttribute(u"name") == u"Get":

676

for arg in cn.getElementsByTagName(u"arg"):

677

if (arg.getAttribute(u"direction")

678

== u"out"):

679

arg.setAttribute(u"name", u"value")

680

elif cn.getAttribute(u"name") == u"GetAll":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"props")

685

xmlstring = document.toxml(u"utf-8")

686

document.unlink()

687

except (AttributeError, xml.dom.DOMException,

688

xml.parsers.expat.ExpatError), error:

689

logger.error(u"Failed to override Introspection method",

690

error)

691

return xmlstring

692

693

694

class ClientDBus(Client, DBusObjectWithProperties):

481

695

"""A Client class using D-Bus

482

696

483

697

Attributes:

487

701

# dbus.service.Object doesn't use super(), so we can't either.

488

702

489

703

def __init__(self, bus = None, *args, **kwargs):

704

self._approvals_pending = 0

490

705

self.bus = bus

491

706

Client.__init__(self, *args, **kwargs)

492

707

# Only now, when this client is initialized, can it show up on

494

709

self.dbus_object_path = (dbus.ObjectPath

495

710

(u"/clients/"

496

711

+ self.name.replace(u".", u"_")))

497

dbus.service.Object.__init__(self, self.bus,

498

self.dbus_object_path)

712

DBusObjectWithProperties.__init__(self, self.bus,

713

self.dbus_object_path)

714

715

def _get_approvals_pending(self):

716

return self._approvals_pending

717

def _set_approvals_pending(self, value):

718

old_value = self._approvals_pending

719

self._approvals_pending = value

720

bval = bool(value)

721

if (hasattr(self, "dbus_object_path")

722

and bval is not bool(old_value)):

723

dbus_bool = dbus.Boolean(bval, variant_level=1)

724

self.PropertyChanged(dbus.String(u"approved_pending"),

725

dbus_bool)

726

727

approvals_pending = property(_get_approvals_pending,

728

_set_approvals_pending)

729

del _get_approvals_pending, _set_approvals_pending

499

730

500

731

@staticmethod

501

732

def _datetime_to_dbus(dt, variant_level=0):

516

747

variant_level=1))

517

748

return r

518

749

519

def disable(self, signal = True):

750

def disable(self, quiet = False):

520

751

oldstate = getattr(self, u"enabled", False)

521

r = Client.disable(self)

522

if signal and oldstate != self.enabled:

752

r = Client.disable(self, quiet=quiet)

753

if not quiet and oldstate != self.enabled:

523

754

# Emit D-Bus signal

524

755

self.PropertyChanged(dbus.String(u"enabled"),

525

756

dbus.Boolean(False, variant_level=1))

530

761

self.remove_from_connection()

531

762

except LookupError:

532

763

pass

533

if hasattr(dbus.service.Object, u"__del__"):

534

dbus.service.Object.__del__(self, *args, **kwargs)

764

if hasattr(DBusObjectWithProperties, u"__del__"):

765

DBusObjectWithProperties.__del__(self, *args, **kwargs)

535

766

Client.__del__(self, *args, **kwargs)

536

767

537

768

def checker_callback(self, pid, condition, command,

590

821

self.PropertyChanged(dbus.String(u"checker_running"),

591

822

dbus.Boolean(False, variant_level=1))

592

823

return r

593

594

## D-Bus methods & signals

824

825

def _reset_approved(self):

826

self._approved = None

827

return False

828

829

def approve(self, value=True):

830

self.send_changedstate()

831

self._approved = value

832

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

833

self._reset_approved)

834

835

836

## D-Bus methods, signals & properties

595

837

_interface = u"se.bsnet.fukt.Mandos.Client"

596

838

597

# CheckedOK - method

598

@dbus.service.method(_interface)

599

def CheckedOK(self):

600

return self.checked_ok()

839

## Signals

601

840

602

841

# CheckerCompleted - signal

603

842

@dbus.service.signal(_interface, signature=u"nxs")

611

850

"D-Bus signal"

612

851

pass

613

852

614

# GetAllProperties - method

615

@dbus.service.method(_interface, out_signature=u"a{sv}")

616

def GetAllProperties(self):

617

"D-Bus method"

618

return dbus.Dictionary({

619

dbus.String(u"name"):

620

dbus.String(self.name, variant_level=1),

621

dbus.String(u"fingerprint"):

622

dbus.String(self.fingerprint, variant_level=1),

623

dbus.String(u"host"):

624

dbus.String(self.host, variant_level=1),

625

dbus.String(u"created"):

626

self._datetime_to_dbus(self.created,

627

variant_level=1),

628

dbus.String(u"last_enabled"):

629

(self._datetime_to_dbus(self.last_enabled,

630

variant_level=1)

631

if self.last_enabled is not None

632

else dbus.Boolean(False, variant_level=1)),

633

dbus.String(u"enabled"):

634

dbus.Boolean(self.enabled, variant_level=1),

635

dbus.String(u"last_checked_ok"):

636

(self._datetime_to_dbus(self.last_checked_ok,

637

variant_level=1)

638

if self.last_checked_ok is not None

639

else dbus.Boolean (False, variant_level=1)),

640

dbus.String(u"timeout"):

641

dbus.UInt64(self.timeout_milliseconds(),

642

variant_level=1),

643

dbus.String(u"interval"):

644

dbus.UInt64(self.interval_milliseconds(),

645

variant_level=1),

646

dbus.String(u"checker"):

647

dbus.String(self.checker_command,

648

variant_level=1),

649

dbus.String(u"checker_running"):

650

dbus.Boolean(self.checker is not None,

651

variant_level=1),

652

dbus.String(u"object_path"):

653

dbus.ObjectPath(self.dbus_object_path,

654

variant_level=1)

655

}, signature=u"sv")

656

657

# IsStillValid - method

658

@dbus.service.method(_interface, out_signature=u"b")

659

def IsStillValid(self):

660

return self.still_valid()

661

662

853

# PropertyChanged - signal

663

854

@dbus.service.signal(_interface, signature=u"sv")

664

855

def PropertyChanged(self, property, value):

665

856

"D-Bus signal"

666

857

pass

667

858

668

# ReceivedSecret - signal

859

# GotSecret - signal

669

860

@dbus.service.signal(_interface)

670

def ReceivedSecret(self):

671

"D-Bus signal"

861

def GotSecret(self):

862

"""D-Bus signal

863

Is sent after a successful transfer of secret from the Mandos

864

server to mandos-client

865

"""

672

866

pass

673

867

674

868

# Rejected - signal

675

@dbus.service.signal(_interface)

676

def Rejected(self):

677

"D-Bus signal"

678

pass

679

680

# SetChecker - method

681

@dbus.service.method(_interface, in_signature=u"s")

682

def SetChecker(self, checker):

683

"D-Bus setter method"

684

self.checker_command = checker

685

# Emit D-Bus signal

686

self.PropertyChanged(dbus.String(u"checker"),

687

dbus.String(self.checker_command,

688

variant_level=1))

689

690

# SetHost - method

691

@dbus.service.method(_interface, in_signature=u"s")

692

def SetHost(self, host):

693

"D-Bus setter method"

694

self.host = host

695

# Emit D-Bus signal

696

self.PropertyChanged(dbus.String(u"host"),

697

dbus.String(self.host, variant_level=1))

698

699

# SetInterval - method

700

@dbus.service.method(_interface, in_signature=u"t")

701

def SetInterval(self, milliseconds):

702

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

703

# Emit D-Bus signal

704

self.PropertyChanged(dbus.String(u"interval"),

705

(dbus.UInt64(self.interval_milliseconds(),

706

variant_level=1)))

707

708

# SetSecret - method

709

@dbus.service.method(_interface, in_signature=u"ay",

710

byte_arrays=True)

711

def SetSecret(self, secret):

712

"D-Bus setter method"

713

self.secret = str(secret)

714

715

# SetTimeout - method

716

@dbus.service.method(_interface, in_signature=u"t")

717

def SetTimeout(self, milliseconds):

718

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

719

# Emit D-Bus signal

720

self.PropertyChanged(dbus.String(u"timeout"),

721

(dbus.UInt64(self.timeout_milliseconds(),

722

variant_level=1)))

869

@dbus.service.signal(_interface, signature=u"s")

870

def Rejected(self, reason):

871

"D-Bus signal"

872

pass

873

874

# NeedApproval - signal

875

@dbus.service.signal(_interface, signature=u"db")

876

def NeedApproval(self, timeout, default):

877

"D-Bus signal"

878

pass

879

880

## Methods

881

882

# Approve - method

883

@dbus.service.method(_interface, in_signature=u"b")

884

def Approve(self, value):

885

self.approve(value)

886

887

# CheckedOK - method

888

@dbus.service.method(_interface)

889

def CheckedOK(self):

890

return self.checked_ok()

723

891

724

892

# Enable - method

725

893

@dbus.service.method(_interface)

744

912

def StopChecker(self):

745

913

self.stop_checker()

746

914

915

## Properties

916

917

# approved_pending - property

918

@dbus_service_property(_interface, signature=u"b", access=u"read")

919

def approved_pending_dbus_property(self):

920

return dbus.Boolean(bool(self.approvals_pending))

921

922

# approved_by_default - property

923

@dbus_service_property(_interface, signature=u"b",

924

access=u"readwrite")

925

def approved_by_default_dbus_property(self):

926

return dbus.Boolean(self.approved_by_default)

927

928

# approved_delay - property

929

@dbus_service_property(_interface, signature=u"t",

930

access=u"readwrite")

931

def approved_delay_dbus_property(self):

932

return dbus.UInt64(self.approved_delay_milliseconds())

933

934

# approved_duration - property

935

@dbus_service_property(_interface, signature=u"t",

936

access=u"readwrite")

937

def approved_duration_dbus_property(self):

938

return dbus.UInt64(self._timedelta_to_milliseconds(

939

self.approved_duration))

940

941

# name - property

942

@dbus_service_property(_interface, signature=u"s", access=u"read")

943

def name_dbus_property(self):

944

return dbus.String(self.name)

945

946

# fingerprint - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def fingerprint_dbus_property(self):

949

return dbus.String(self.fingerprint)

950

951

# host - property

952

@dbus_service_property(_interface, signature=u"s",

953

access=u"readwrite")

954

def host_dbus_property(self, value=None):

955

if value is None: # get

956

return dbus.String(self.host)

957

self.host = value

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"host"),

960

dbus.String(value, variant_level=1))

961

962

# created - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

964

def created_dbus_property(self):

965

return dbus.String(self._datetime_to_dbus(self.created))

966

967

# last_enabled - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def last_enabled_dbus_property(self):

970

if self.last_enabled is None:

971

return dbus.String(u"")

972

return dbus.String(self._datetime_to_dbus(self.last_enabled))

973

974

# enabled - property

975

@dbus_service_property(_interface, signature=u"b",

976

access=u"readwrite")

977

def enabled_dbus_property(self, value=None):

978

if value is None: # get

979

return dbus.Boolean(self.enabled)

980

if value:

981

self.enable()

982

else:

983

self.disable()

984

985

# last_checked_ok - property

986

@dbus_service_property(_interface, signature=u"s",

987

access=u"readwrite")

988

def last_checked_ok_dbus_property(self, value=None):

989

if value is not None:

990

self.checked_ok()

991

return

992

if self.last_checked_ok is None:

993

return dbus.String(u"")

994

return dbus.String(self._datetime_to_dbus(self

995

.last_checked_ok))

996

997

# timeout - property

998

@dbus_service_property(_interface, signature=u"t",

999

access=u"readwrite")

1000

def timeout_dbus_property(self, value=None):

1001

if value is None: # get

1002

return dbus.UInt64(self.timeout_milliseconds())

1003

self.timeout = datetime.timedelta(0, 0, 0, value)

1004

# Emit D-Bus signal

1005

self.PropertyChanged(dbus.String(u"timeout"),

1006

dbus.UInt64(value, variant_level=1))

1007

if getattr(self, u"disable_initiator_tag", None) is None:

1008

return

1009

# Reschedule timeout

1010

gobject.source_remove(self.disable_initiator_tag)

1011

self.disable_initiator_tag = None

1012

time_to_die = (self.

1013

_timedelta_to_milliseconds((self

1014

.last_checked_ok

1015

+ self.timeout)

1016

- datetime.datetime

1017

.utcnow()))

1018

if time_to_die <= 0:

1019

# The timeout has passed

1020

self.disable()

1021

else:

1022

self.disable_initiator_tag = (gobject.timeout_add

1023

(time_to_die, self.disable))

1024

1025

# interval - property

1026

@dbus_service_property(_interface, signature=u"t",

1027

access=u"readwrite")

1028

def interval_dbus_property(self, value=None):

1029

if value is None: # get

1030

return dbus.UInt64(self.interval_milliseconds())

1031

self.interval = datetime.timedelta(0, 0, 0, value)

1032

# Emit D-Bus signal

1033

self.PropertyChanged(dbus.String(u"interval"),

1034

dbus.UInt64(value, variant_level=1))

1035

if getattr(self, u"checker_initiator_tag", None) is None:

1036

return

1037

# Reschedule checker run

1038

gobject.source_remove(self.checker_initiator_tag)

1039

self.checker_initiator_tag = (gobject.timeout_add

1040

(value, self.start_checker))

1041

self.start_checker() # Start one now, too

1042

1043

# checker - property

1044

@dbus_service_property(_interface, signature=u"s",

1045

access=u"readwrite")

1046

def checker_dbus_property(self, value=None):

1047

if value is None: # get

1048

return dbus.String(self.checker_command)

1049

self.checker_command = value

1050

# Emit D-Bus signal

1051

self.PropertyChanged(dbus.String(u"checker"),

1052

dbus.String(self.checker_command,

1053

variant_level=1))

1054

1055

# checker_running - property

1056

@dbus_service_property(_interface, signature=u"b",

1057

access=u"readwrite")

1058

def checker_running_dbus_property(self, value=None):

1059

if value is None: # get

1060

return dbus.Boolean(self.checker is not None)

1061

if value:

1062

self.start_checker()

1063

else:

1064

self.stop_checker()

1065

1066

# object_path - property

1067

@dbus_service_property(_interface, signature=u"o", access=u"read")

1068

def object_path_dbus_property(self):

1069

return self.dbus_object_path # is already a dbus.ObjectPath

1070

1071

# secret = property

1072

@dbus_service_property(_interface, signature=u"ay",

1073

access=u"write", byte_arrays=True)

1074

def secret_dbus_property(self, value):

1075

self.secret = str(value)

1076

747

1077

del _interface

748

1078

749

1079

1080

class ProxyClient(object):

1081

def __init__(self, child_pipe, fpr, address):

1082

self._pipe = child_pipe

1083

self._pipe.send(('init', fpr, address))

1084

if not self._pipe.recv():

1085

raise KeyError()

1086

1087

def __getattribute__(self, name):

1088

if(name == '_pipe'):

1089

return super(ProxyClient, self).__getattribute__(name)

1090

self._pipe.send(('getattr', name))

1091

data = self._pipe.recv()

1092

if data[0] == 'data':

1093

return data[1]

1094

if data[0] == 'function':

1095

def func(*args, **kwargs):

1096

self._pipe.send(('funcall', name, args, kwargs))

1097

return self._pipe.recv()[1]

1098

return func

1099

1100

def __setattr__(self, name, value):

1101

if(name == '_pipe'):

1102

return super(ProxyClient, self).__setattr__(name, value)

1103

self._pipe.send(('setattr', name, value))

1104

1105

750

1106

class ClientHandler(socketserver.BaseRequestHandler, object):

751

1107

"""A class to handle client connections.

752

1108

754

1110

Note: This will run in its own forked process."""

755

1111

756

1112

def handle(self):

757

logger.info(u"TCP connection from: %s",

758

unicode(self.client_address))

759

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

760

# Open IPC pipe to parent process

761

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1113

with contextlib.closing(self.server.child_pipe) as child_pipe:

1114

logger.info(u"TCP connection from: %s",

1115

unicode(self.client_address))

1116

logger.debug(u"Pipe FD: %d",

1117

self.server.child_pipe.fileno())

1118

762

1119

session = (gnutls.connection

763

1120

.ClientSession(self.request,

764

1121

gnutls.connection

765

1122

.X509Credentials()))

766

767

line = self.request.makefile().readline()

768

logger.debug(u"Protocol version: %r", line)

769

try:

770

if int(line.strip().split()[0]) > 1:

771

raise RuntimeError

772

except (ValueError, IndexError, RuntimeError), error:

773

logger.error(u"Unknown protocol version: %s", error)

774

return

775

1123

776

1124

# Note: gnutls.connection.X509Credentials is really a

777

1125

# generic GnuTLS certificate credentials object so long as

778

1126

# no X.509 keys are added to it. Therefore, we can use it

779

1127

# here despite using OpenPGP certificates.

780

1128

781

1129

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

782

1130

# u"+AES-256-CBC", u"+SHA1",

783

1131

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

789

1137

(gnutls.library.functions

790

1138

.gnutls_priority_set_direct(session._c_object,

791

1139

priority, None))

792

1140

1141

# Start communication using the Mandos protocol

1142

# Get protocol number

1143

line = self.request.makefile().readline()

1144

logger.debug(u"Protocol version: %r", line)

1145

try:

1146

if int(line.strip().split()[0]) > 1:

1147

raise RuntimeError

1148

except (ValueError, IndexError, RuntimeError), error:

1149

logger.error(u"Unknown protocol version: %s", error)

1150

return

1151

1152

# Start GnuTLS connection

793

1153

try:

794

1154

session.handshake()

795

1155

except gnutls.errors.GNUTLSError, error:

798

1158

# established. Just abandon the request.

799

1159

return

800

1160

logger.debug(u"Handshake succeeded")

1161

1162

approval_required = False

801

1163

try:

802

fpr = self.fingerprint(self.peer_certificate(session))

803

except (TypeError, gnutls.errors.GNUTLSError), error:

804

logger.warning(u"Bad certificate: %s", error)

805

session.bye()

806

return

807

logger.debug(u"Fingerprint: %s", fpr)

1164

try:

1165

fpr = self.fingerprint(self.peer_certificate

1166

(session))

1167

except (TypeError, gnutls.errors.GNUTLSError), error:

1168

logger.warning(u"Bad certificate: %s", error)

1169

return

1170

logger.debug(u"Fingerprint: %s", fpr)

1171

1172

try:

1173

client = ProxyClient(child_pipe, fpr,

1174

self.client_address)

1175

except KeyError:

1176

return

1177

1178

if client.approved_delay:

1179

delay = client.approved_delay

1180

client.approvals_pending += 1

1181

approval_required = True

1182

1183

while True:

1184

if not client.enabled:

1185

logger.warning(u"Client %s is disabled",

1186

client.name)

1187

if self.server.use_dbus:

1188

# Emit D-Bus signal

1189

client.Rejected("Disabled")

1190

return

1191

1192

if client._approved or not client.approved_delay:

1193

#We are approved or approval is disabled

1194

break

1195

elif client._approved is None:

1196

logger.info(u"Client %s need approval",

1197

client.name)

1198

if self.server.use_dbus:

1199

# Emit D-Bus signal

1200

client.NeedApproval(

1201

client.approved_delay_milliseconds(),

1202

client.approved_by_default)

1203

else:

1204

logger.warning(u"Client %s was not approved",

1205

client.name)

1206

if self.server.use_dbus:

1207

# Emit D-Bus signal

1208

client.Rejected("Disapproved")

1209

return

1210

1211

#wait until timeout or approved

1212

#x = float(client._timedelta_to_milliseconds(delay))

1213

time = datetime.datetime.now()

1214

client.changedstate.acquire()

1215

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1216

client.changedstate.release()

1217

time2 = datetime.datetime.now()

1218

if (time2 - time) >= delay:

1219

if not client.approved_by_default:

1220

logger.warning("Client %s timed out while"

1221

" waiting for approval",

1222

client.name)

1223

if self.server.use_dbus:

1224

# Emit D-Bus signal

1225

client.Rejected("Time out")

1226

return

1227

else:

1228

break

1229

else:

1230

delay -= time2 - time

1231

1232

sent_size = 0

1233

while sent_size < len(client.secret):

1234

try:

1235

sent = session.send(client.secret[sent_size:])

1236

except (gnutls.errors.GNUTLSError), error:

1237

logger.warning("gnutls send failed")

1238

return

1239

logger.debug(u"Sent: %d, remaining: %d",

1240

sent, len(client.secret)

1241

- (sent_size + sent))

1242

sent_size += sent

1243

1244

logger.info(u"Sending secret to %s", client.name)

1245

# bump the timeout as if seen

1246

client.checked_ok()

1247

if self.server.use_dbus:

1248

# Emit D-Bus signal

1249

client.GotSecret()

808

1250

809

for c in self.server.clients:

810

if c.fingerprint == fpr:

811

client = c

812

break

813

else:

814

ipc.write(u"NOTFOUND %s\n" % fpr)

815

session.bye()

816

return

817

# Have to check if client.still_valid(), since it is

818

# possible that the client timed out while establishing

819

# the GnuTLS session.

820

if not client.still_valid():

821

ipc.write(u"INVALID %s\n" % client.name)

822

session.bye()

823

return

824

ipc.write(u"SENDING %s\n" % client.name)

825

sent_size = 0

826

while sent_size < len(client.secret):

827

sent = session.send(client.secret[sent_size:])

828

logger.debug(u"Sent: %d, remaining: %d",

829

sent, len(client.secret)

830

- (sent_size + sent))

831

sent_size += sent

832

session.bye()

1251

finally:

1252

if approval_required:

1253

client.approvals_pending -= 1

1254

try:

1255

session.bye()

1256

except (gnutls.errors.GNUTLSError), error:

1257

logger.warning("gnutls bye failed")

833

1258

834

1259

@staticmethod

835

1260

def peer_certificate(session):

895

1320

return hex_fpr

896

1321

897

1322

898

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

899

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1323

class MultiprocessingMixIn(object):

1324

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1325

def sub_process_main(self, request, address):

1326

try:

1327

self.finish_request(request, address)

1328

except:

1329

self.handle_error(request, address)

1330

self.close_request(request)

1331

1332

def process_request(self, request, address):

1333

"""Start a new process to process the request."""

1334

multiprocessing.Process(target = self.sub_process_main,

1335

args = (request, address)).start()

1336

1337

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1338

""" adds a pipe to the MixIn """

900

1339

def process_request(self, request, client_address):

901

1340

"""Overrides and wraps the original process_request().

902

1341

903

This function creates a new pipe in self.pipe

1342

This function creates a new pipe in self.pipe

904

1343

"""

905

self.pipe = os.pipe()

906

super(ForkingMixInWithPipe,

1344

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1345

1346

super(MultiprocessingMixInWithPipe,

907

1347

self).process_request(request, client_address)

908

os.close(self.pipe[1]) # close write end

909

self.add_pipe(self.pipe[0])

910

def add_pipe(self, pipe):

1348

self.child_pipe.close()

1349

self.add_pipe(parent_pipe)

1350

1351

def add_pipe(self, parent_pipe):

911

1352

"""Dummy function; override as necessary"""

912

os.close(pipe)

913

914

915

class IPv6_TCPServer(ForkingMixInWithPipe,

1353

pass

1354

1355

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

916

1356

socketserver.TCPServer, object):

917

1357

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

918

1358

982

1422

clients: set of Client objects

983

1423

gnutls_priority GnuTLS priority string

984

1424

use_dbus: Boolean; to emit D-Bus signals or not

985

clients: set of Client objects

986

gnutls_priority GnuTLS priority string

987

use_dbus: Boolean; to emit D-Bus signals or not

988

1425

989

1426

Assumes a gobject.MainLoop event loop.

990

1427

"""

1006

1443

return socketserver.TCPServer.server_activate(self)

1007

1444

def enable(self):

1008

1445

self.enabled = True

1009

def add_pipe(self, pipe):

1446

def add_pipe(self, parent_pipe):

1010

1447

# Call "handle_ipc" for both data and EOF events

1011

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1012

self.handle_ipc)

1013

def handle_ipc(self, source, condition, file_objects={}):

1448

gobject.io_add_watch(parent_pipe.fileno(),

1449

gobject.IO_IN | gobject.IO_HUP,

1450

functools.partial(self.handle_ipc,

1451

parent_pipe = parent_pipe))

1452

1453

def handle_ipc(self, source, condition, parent_pipe=None,

1454

client_object=None):

1014

1455

condition_names = {

1015

1456

gobject.IO_IN: u"IN", # There is data to read.

1016

1457

gobject.IO_OUT: u"OUT", # Data can be written (without

1027

1468

if cond & condition)

1028

1469

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1029

1470

conditions_string)

1030

1031

# Turn the pipe file descriptor into a Python file object

1032

if source not in file_objects:

1033

file_objects[source] = os.fdopen(source, u"r", 1)

1034

1035

# Read a line from the file object

1036

cmdline = file_objects[source].readline()

1037

if not cmdline: # Empty line means end of file

1038

# close the IPC pipe

1039

file_objects[source].close()

1040

del file_objects[source]

1041

1042

# Stop calling this function

1043

return False

1044

1045

logger.debug(u"IPC command: %r", cmdline)

1046

1047

# Parse and act on command

1048

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1049

1050

if cmd == u"NOTFOUND":

1051

logger.warning(u"Client not found for fingerprint: %s",

1052

args)

1053

if self.use_dbus:

1054

# Emit D-Bus signal

1055

mandos_dbus_service.ClientNotFound(args)

1056

elif cmd == u"INVALID":

1057

for client in self.clients:

1058

if client.name == args:

1059

logger.warning(u"Client %s is invalid", args)

1060

if self.use_dbus:

1061

# Emit D-Bus signal

1062

client.Rejected()

1063

break

1064

else:

1065

logger.error(u"Unknown client %s is invalid", args)

1066

elif cmd == u"SENDING":

1067

for client in self.clients:

1068

if client.name == args:

1069

logger.info(u"Sending secret to %s", client.name)

1070

client.checked_ok()

1071

if self.use_dbus:

1072

# Emit D-Bus signal

1073

client.ReceivedSecret()

1074

break

1075

else:

1076

logger.error(u"Sending secret to unknown client %s",

1077

args)

1078

else:

1079

logger.error(u"Unknown IPC command: %r", cmdline)

1080

1081

# Keep calling this function

1471

1472

# error or the other end of multiprocessing.Pipe has closed

1473

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1474

return False

1475

1476

# Read a request from the child

1477

request = parent_pipe.recv()

1478

logger.debug(u"IPC request: %s", repr(request))

1479

command = request[0]

1480

1481

if command == 'init':

1482

fpr = request[1]

1483

address = request[2]

1484

1485

for c in self.clients:

1486

if c.fingerprint == fpr:

1487

client = c

1488

break

1489

else:

1490

logger.warning(u"Client not found for fingerprint: %s, ad"

1491

u"dress: %s", fpr, address)

1492

if self.use_dbus:

1493

# Emit D-Bus signal

1494

mandos_dbus_service.ClientNotFound(fpr, address)

1495

parent_pipe.send(False)

1496

return False

1497

1498

gobject.io_add_watch(parent_pipe.fileno(),

1499

gobject.IO_IN | gobject.IO_HUP,

1500

functools.partial(self.handle_ipc,

1501

parent_pipe = parent_pipe,

1502

client_object = client))

1503

parent_pipe.send(True)

1504

# remove the old hook in favor of the new above hook on same fileno

1505

return False

1506

if command == 'funcall':

1507

funcname = request[1]

1508

args = request[2]

1509

kwargs = request[3]

1510

1511

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1512

1513

if command == 'getattr':

1514

attrname = request[1]

1515

if callable(client_object.__getattribute__(attrname)):

1516

parent_pipe.send(('function',))

1517

else:

1518

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1519

1520

if command == 'setattr':

1521

attrname = request[1]

1522

value = request[2]

1523

setattr(client_object, attrname, value)

1524

1082

1525

return True

1083

1526

1084

1527

1114

1557

elif suffix == u"w":

1115

1558

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1116

1559

else:

1117

raise ValueError

1118

except (ValueError, IndexError):

1119

raise ValueError

1560

raise ValueError(u"Unknown suffix %r" % suffix)

1561

except (ValueError, IndexError), e:

1562

raise ValueError(e.message)

1120

1563

timevalue += delta

1121

1564

return timevalue

1122

1565

1135

1578

def if_nametoindex(interface):

1136

1579

"Get an interface index the hard way, i.e. using fcntl()"

1137

1580

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1138

with closing(socket.socket()) as s:

1581

with contextlib.closing(socket.socket()) as s:

1139

1582

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1140

1583

struct.pack(str(u"16s16x"),

1141

1584

interface))

1161

1604

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1162

1605

if not stat.S_ISCHR(os.fstat(null).st_mode):

1163

1606

raise OSError(errno.ENODEV,

1164

u"/dev/null not a character device")

1607

u"%s not a character device"

1608

% os.path.devnull)

1165

1609

os.dup2(null, sys.stdin.fileno())

1166

1610

os.dup2(null, sys.stdout.fileno())

1167

1611

os.dup2(null, sys.stderr.fileno())

1171

1615

1172

1616

def main():

1173

1617

1174

######################################################################

1618

##################################################################

1175

1619

# Parsing of options, both command line and config file

1176

1620

1177

1621

parser = optparse.OptionParser(version = "%%prog %s" % version)

1186

1630

parser.add_option("--debug", action=u"store_true",

1187

1631

help=u"Debug mode; run in foreground and log to"

1188

1632

u" terminal")

1633

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1634

help=u"Debug level for stdout output")

1189

1635

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1190

1636

u" priority string (see GnuTLS documentation)")

1191

1637

parser.add_option("--servicename", type=u"string",

1216

1662

u"servicename": u"Mandos",

1217

1663

u"use_dbus": u"True",

1218

1664

u"use_ipv6": u"True",

1665

u"debuglevel": u"",

1219

1666

}

1220

1667

1221

1668

# Parse config file for server-global settings

1238

1685

# options, if set.

1239

1686

for option in (u"interface", u"address", u"port", u"debug",

1240

1687

u"priority", u"servicename", u"configdir",

1241

u"use_dbus", u"use_ipv6"):

1688

u"use_dbus", u"use_ipv6", u"debuglevel"):

1242

1689

value = getattr(options, option)

1243

1690

if value is not None:

1244

1691

server_settings[option] = value

1253

1700

1254

1701

# For convenience

1255

1702

debug = server_settings[u"debug"]

1703

debuglevel = server_settings[u"debuglevel"]

1256

1704

use_dbus = server_settings[u"use_dbus"]

1257

1705

use_ipv6 = server_settings[u"use_ipv6"]

1258

1259

if not debug:

1260

syslogger.setLevel(logging.WARNING)

1261

console.setLevel(logging.WARNING)

1262

1706

1263

1707

if server_settings[u"servicename"] != u"Mandos":

1264

1708

syslogger.setFormatter(logging.Formatter

1265

1709

(u'Mandos (%s) [%%(process)d]:'

1271

1715

u"interval": u"5m",

1272

1716

u"checker": u"fping -q -- %%(host)s",

1273

1717

u"host": u"",

1718

u"approved_delay": u"0s",

1719

u"approved_duration": u"1s",

1274

1720

}

1275

1721

client_config = configparser.SafeConfigParser(client_defaults)

1276

1722

client_config.read(os.path.join(server_settings[u"configdir"],

1315

1761

raise error

1316

1762

1317

1763

# Enable all possible GnuTLS debugging

1764

1765

1766

if not debug and not debuglevel:

1767

syslogger.setLevel(logging.WARNING)

1768

console.setLevel(logging.WARNING)

1769

if debuglevel:

1770

level = getattr(logging, debuglevel.upper())

1771

syslogger.setLevel(level)

1772

console.setLevel(level)

1773

1318

1774

if debug:

1319

1775

# "Use a log level over 10 to enable all debugging options."

1320

1776

# - GnuTLS manual

1326

1782

1327

1783

(gnutls.library.functions

1328

1784

.gnutls_global_set_log_function(debug_gnutls))

1785

1786

# Redirect stdin so all checkers get /dev/null

1787

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1788

os.dup2(null, sys.stdin.fileno())

1789

if null > 2:

1790

os.close(null)

1791

else:

1792

# No console logging

1793

logger.removeHandler(console)

1794

1329

1795

1330

1796

global main_loop

1331

1797

# From the Avahi example code

1334

1800

bus = dbus.SystemBus()

1335

1801

# End of Avahi example code

1336

1802

if use_dbus:

1337

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1803

try:

1804

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1805

bus, do_not_queue=True)

1806

except dbus.exceptions.NameExistsException, e:

1807

logger.error(unicode(e) + u", disabling D-Bus")

1808

use_dbus = False

1809

server_settings[u"use_dbus"] = False

1810

tcp_server.use_dbus = False

1338

1811

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1339

1812

service = AvahiService(name = server_settings[u"servicename"],

1340

1813

servicetype = u"_mandos._tcp",

1342

1815

if server_settings["interface"]:

1343

1816

service.interface = (if_nametoindex

1344

1817

(str(server_settings[u"interface"])))

1818

1819

if not debug:

1820

# Close all input and output, do double fork, etc.

1821

daemon()

1822

1823

global multiprocessing_manager

1824

multiprocessing_manager = multiprocessing.Manager()

1345

1825

1346

1826

client_class = Client

1347

1827

if use_dbus:

1348

1828

client_class = functools.partial(ClientDBus, bus = bus)

1829

def client_config_items(config, section):

1830

special_settings = {

1831

"approved_by_default":

1832

lambda: config.getboolean(section,

1833

"approved_by_default"),

1834

}

1835

for name, value in config.items(section):

1836

try:

1837

yield (name, special_settings[name]())

1838

except KeyError:

1839

yield (name, value)

1840

1349

1841

tcp_server.clients.update(set(

1350

1842

client_class(name = section,

1351

config= dict(client_config.items(section)))

1843

config= dict(client_config_items(

1844

client_config, section)))

1352

1845

for section in client_config.sections()))

1353

1846

if not tcp_server.clients:

1354

1847

logger.warning(u"No clients defined")

1355

1356

if debug:

1357

# Redirect stdin so all checkers get /dev/null

1358

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1359

os.dup2(null, sys.stdin.fileno())

1360

if null > 2:

1361

os.close(null)

1362

else:

1363

# No console logging

1364

logger.removeHandler(console)

1365

# Close all input and output, do double fork, etc.

1366

daemon()

1367

1848

1368

1849

try:

1369

with closing(pidfile):

1850

with pidfile:

1370

1851

pid = os.getpid()

1371

1852

pidfile.write(str(pid) + "\n")

1372

1853

del pidfile

1378

1859

pass

1379

1860

del pidfilename

1380

1861

1381

def cleanup():

1382

"Cleanup function; run on exit"

1383

service.cleanup()

1384

1385

while tcp_server.clients:

1386

client = tcp_server.clients.pop()

1387

client.disable_hook = None

1388

client.disable()

1389

1390

atexit.register(cleanup)

1391

1392

1862

if not debug:

1393

1863

signal.signal(signal.SIGINT, signal.SIG_IGN)

1394

1864

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1401

1871

dbus.service.Object.__init__(self, bus, u"/")

1402

1872

_interface = u"se.bsnet.fukt.Mandos"

1403

1873

1404

@dbus.service.signal(_interface, signature=u"oa{sv}")

1405

def ClientAdded(self, objpath, properties):

1874

@dbus.service.signal(_interface, signature=u"o")

1875

def ClientAdded(self, objpath):

1406

1876

"D-Bus signal"

1407

1877

pass

1408

1878

1409

@dbus.service.signal(_interface, signature=u"s")

1410

def ClientNotFound(self, fingerprint):

1879

@dbus.service.signal(_interface, signature=u"ss")

1880

def ClientNotFound(self, fingerprint, address):

1411

1881

"D-Bus signal"

1412

1882

pass

1413

1883

1427

1897

def GetAllClientsWithProperties(self):

1428

1898

"D-Bus method"

1429

1899

return dbus.Dictionary(

1430

((c.dbus_object_path, c.GetAllProperties())

1900

((c.dbus_object_path, c.GetAll(u""))

1431

1901

for c in tcp_server.clients),

1432

1902

signature=u"oa{sv}")

1433

1903

1439

1909

tcp_server.clients.remove(c)

1440

1910

c.remove_from_connection()

1441

1911

# Don't signal anything except ClientRemoved

1442

c.disable(signal=False)

1912

c.disable(quiet=True)

1443

1913

# Emit D-Bus signal

1444

1914

self.ClientRemoved(object_path, c.name)

1445

1915

return

1446

raise KeyError

1916

raise KeyError(object_path)

1447

1917

1448

1918

del _interface

1449

1919

1450

1920

mandos_dbus_service = MandosDBusService()

1451

1921

1922

def cleanup():

1923

"Cleanup function; run on exit"

1924

service.cleanup()

1925

1926

while tcp_server.clients:

1927

client = tcp_server.clients.pop()

1928

if use_dbus:

1929

client.remove_from_connection()

1930

client.disable_hook = None

1931

# Don't signal anything except ClientRemoved

1932

client.disable(quiet=True)

1933

if use_dbus:

1934

# Emit D-Bus signal

1935

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1936

client.name)

1937

1938

atexit.register(cleanup)

1939

1452

1940

for client in tcp_server.clients:

1453

1941

if use_dbus:

1454

1942

# Emit D-Bus signal

1455

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1456

client.GetAllProperties())

1943

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1457

1944

client.enable()

1458

1945

1459

1946

tcp_server.enable()

1477

1964

service.activate()

1478

1965

except dbus.exceptions.DBusException, error:

1479

1966

logger.critical(u"DBusException: %s", error)

1967

cleanup()

1480

1968

sys.exit(1)

1481

1969

# End of Avahi example code

1482

1970

1489

1977

main_loop.run()

1490

1978

except AvahiError, error:

1491

1979

logger.critical(u"AvahiError: %s", error)

1980

cleanup()

1492

1981

sys.exit(1)

1493

1982

except KeyboardInterrupt:

1494

1983

if debug:

1495

1984

print >> sys.stderr

1496

1985

logger.debug(u"Server received KeyboardInterrupt")

1497

1986

logger.debug(u"Server exiting")

1987

# Must run before the D-Bus bus name gets deregistered

1988

cleanup()

1498

1989

1499

1990

if __name__ == '__main__':

1500

1991

main()