/mandos/release : revision 282

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

55

56

import logging

56

57

import logging.handlers

57

58

import pwd

58

from contextlib import closing

59

import contextlib

59

60

import struct

60

61

import fcntl

61

62

import functools

63

import cPickle as pickle

64

import multiprocessing

62

65

63

66

import dbus

64

67

import dbus.service

67

70

from dbus.mainloop.glib import DBusGMainLoop

68

71

import ctypes

69

72

import ctypes.util

73

import xml.dom.minidom

74

import inspect

70

75

71

76

try:

72

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

77

82

SO_BINDTODEVICE = None

78

83

79

84

80

version = "1.0.8"

85

version = "1.2.3"

81

86

82

logger = logging.Logger(u'mandos')

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

83

89

syslogger = (logging.handlers.SysLogHandler

84

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

85

address = "/dev/log"))

91

address = str("/dev/log")))

86

92

syslogger.setFormatter(logging.Formatter

87

(u'Mandos [%(process)d]: %(levelname)s:'

88

u' %(message)s'))

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

89

95

logger.addHandler(syslogger)

90

96

91

97

console = logging.StreamHandler()

92

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

93

u' %(levelname)s:'

94

u' %(message)s'))

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

95

101

logger.addHandler(console)

96

102

97

103

class AvahiError(Exception):

114

120

Attributes:

115

121

interface: integer; avahi.IF_UNSPEC or an interface index.

116

122

Used to optionally bind to the specified interface.

117

118

type: string; Example: u'_mandos._tcp'.

123

124

type: string; Example: '_mandos._tcp'.

119

125

See <http://www.dns-sd.org/ServiceTypes.html>

120

126

port: integer; what port to announce

121

127

TXT: list of strings; TXT record for the service

130

136

"""

131

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

132

138

servicetype = None, port = None, TXT = None,

133

domain = u"", host = u"", max_renames = 32768,

139

domain = "", host = "", max_renames = 32768,

134

140

protocol = avahi.PROTO_UNSPEC, bus = None):

135

141

self.interface = interface

136

142

self.name = name

148

154

def rename(self):

149

155

"""Derived from the Avahi example code"""

150

156

if self.rename_count >= self.max_renames:

151

logger.critical(u"No suitable Zeroconf service name found"

152

u" after %i retries, exiting.",

157

logger.critical("No suitable Zeroconf service name found"

158

" after %i retries, exiting.",

153

159

self.rename_count)

154

raise AvahiServiceError(u"Too many renames")

155

self.name = self.server.GetAlternativeServiceName(self.name)

156

logger.info(u"Changing Zeroconf service name to %r ...",

157

unicode(self.name))

160

raise AvahiServiceError("Too many renames")

161

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

162

logger.info("Changing Zeroconf service name to %r ...",

163

self.name)

158

164

syslogger.setFormatter(logging.Formatter

159

(u'Mandos (%s) [%%(process)d]:'

160

u' %%(levelname)s: %%(message)s'

165

('Mandos (%s) [%%(process)d]:'

166

' %%(levelname)s: %%(message)s'

161

167

% self.name))

162

168

self.remove()

163

self.add()

169

try:

170

self.add()

171

except dbus.exceptions.DBusException, error:

172

logger.critical("DBusException: %s", error)

173

self.cleanup()

174

os._exit(1)

164

175

self.rename_count += 1

165

176

def remove(self):

166

177

"""Derived from the Avahi example code"""

174

185

self.server.EntryGroupNew()),

175

186

avahi.DBUS_INTERFACE_ENTRY_GROUP)

176

187

self.group.connect_to_signal('StateChanged',

177

self.entry_group_state_changed)

178

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

188

self

189

.entry_group_state_changed)

190

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

179

191

self.name, self.type)

180

192

self.group.AddService(

181

193

self.interface,

188

200

self.group.Commit()

189

201

def entry_group_state_changed(self, state, error):

190

202

"""Derived from the Avahi example code"""

191

logger.debug(u"Avahi state change: %i", state)

203

logger.debug("Avahi entry group state change: %i", state)

192

204

193

205

if state == avahi.ENTRY_GROUP_ESTABLISHED:

194

logger.debug(u"Zeroconf service established.")

206

logger.debug("Zeroconf service established.")

195

207

elif state == avahi.ENTRY_GROUP_COLLISION:

196

logger.warning(u"Zeroconf service name collision.")

208

logger.info("Zeroconf service name collision.")

197

209

self.rename()

198

210

elif state == avahi.ENTRY_GROUP_FAILURE:

199

logger.critical(u"Avahi: Error in group state changed %s",

211

logger.critical("Avahi: Error in group state changed %s",

200

212

unicode(error))

201

raise AvahiGroupError(u"State changed: %s"

213

raise AvahiGroupError("State changed: %s"

202

214

% unicode(error))

203

215

def cleanup(self):

204

216

"""Derived from the Avahi example code"""

207

219

self.group = None

208

220

def server_state_changed(self, state):

209

221

"""Derived from the Avahi example code"""

222

logger.debug("Avahi server state change: %i", state)

210

223

if state == avahi.SERVER_COLLISION:

211

logger.error(u"Zeroconf server name collision")

224

logger.error("Zeroconf server name collision")

212

225

self.remove()

213

226

elif state == avahi.SERVER_RUNNING:

214

227

self.add()

219

232

self.bus.get_object(avahi.DBUS_NAME,

220

233

avahi.DBUS_PATH_SERVER),

221

234

avahi.DBUS_INTERFACE_SERVER)

222

self.server.connect_to_signal(u"StateChanged",

235

self.server.connect_to_signal("StateChanged",

223

236

self.server_state_changed)

224

237

self.server_state_changed(self.server.GetState())

225

238

228

241

"""A representation of a client host served by this server.

229

242

230

243

Attributes:

231

232

D-Bus identifiers

233

fingerprint: string (40 or 32 hexadecimal digits); used to

234

uniquely identify the client

235

secret: bytestring; sent verbatim (over TLS) to client

236

host: string; available for use by the checker command

237

created: datetime.datetime(); (UTC) object creation

238

last_enabled: datetime.datetime(); (UTC)

239

enabled: bool()

240

last_checked_ok: datetime.datetime(); (UTC) or None

241

timeout: datetime.timedelta(); How long from last_checked_ok

242

until this client is invalid

243

interval: datetime.timedelta(); How often to start a new checker

244

disable_hook: If set, called by disable() as disable_hook(self)

244

_approved: bool(); 'None' if not yet approved/disapproved

245

approval_delay: datetime.timedelta(); Time to wait for approval

246

approval_duration: datetime.timedelta(); Duration of one approval

245

247

checker: subprocess.Popen(); a running checker process used

246

248

to see if the client lives.

247

249

'None' if no process is running.

248

checker_initiator_tag: a gobject event source tag, or None

249

disable_initiator_tag: - '' -

250

checker_callback_tag: - '' -

251

checker_command: string; External command which is run to check if

252

client lives. %() expansions are done at

250

checker_callback_tag: a gobject event source tag, or None

251

checker_command: string; External command which is run to check

252

if client lives. %() expansions are done at

253

runtime with vars(self) as dict, so that for

254

instance %(name)s can be used in the command.

255

checker_initiator_tag: a gobject event source tag, or None

256

created: datetime.datetime(); (UTC) object creation

255

257

current_checker_command: string; current running checker_command

258

disable_hook: If set, called by disable() as disable_hook(self)

259

disable_initiator_tag: a gobject event source tag, or None

260

enabled: bool()

261

fingerprint: string (40 or 32 hexadecimal digits); used to

262

uniquely identify the client

263

host: string; available for use by the checker command

264

interval: datetime.timedelta(); How often to start a new checker

265

last_approval_request: datetime.datetime(); (UTC) or None

266

last_checked_ok: datetime.datetime(); (UTC) or None

267

last_enabled: datetime.datetime(); (UTC)

268

269

D-Bus identifiers

270

secret: bytestring; sent verbatim (over TLS) to client

271

timeout: datetime.timedelta(); How long from last_checked_ok

272

until this client is disabled

273

runtime_expansions: Allowed attributes for runtime expansion.

256

274

"""

257

275

276

runtime_expansions = ("approval_delay", "approval_duration",

277

"created", "enabled", "fingerprint",

278

"host", "interval", "last_checked_ok",

279

"last_enabled", "name", "timeout")

280

258

281

@staticmethod

259

def _datetime_to_milliseconds(dt):

260

"Convert a datetime.datetime() to milliseconds"

261

return ((dt.days * 24 * 60 * 60 * 1000)

262

+ (dt.seconds * 1000)

263

+ (dt.microseconds // 1000))

282

def _timedelta_to_milliseconds(td):

283

"Convert a datetime.timedelta() to milliseconds"

284

return ((td.days * 24 * 60 * 60 * 1000)

285

+ (td.seconds * 1000)

286

+ (td.microseconds // 1000))

264

287

265

288

def timeout_milliseconds(self):

266

289

"Return the 'timeout' attribute in milliseconds"

267

return self._datetime_to_milliseconds(self.timeout)

290

return self._timedelta_to_milliseconds(self.timeout)

268

291

269

292

def interval_milliseconds(self):

270

293

"Return the 'interval' attribute in milliseconds"

271

return self._datetime_to_milliseconds(self.interval)

294

return self._timedelta_to_milliseconds(self.interval)

295

296

def approval_delay_milliseconds(self):

297

return self._timedelta_to_milliseconds(self.approval_delay)

272

298

273

299

def __init__(self, name = None, disable_hook=None, config=None):

274

300

"""Note: the 'checker' key in 'config' sets the

277

303

self.name = name

278

304

if config is None:

279

305

config = {}

280

logger.debug(u"Creating client %r", self.name)

306

logger.debug("Creating client %r", self.name)

281

307

# Uppercase and remove spaces from fingerprint for later

282

308

# comparison purposes with return value from the fingerprint()

283

309

# function

284

self.fingerprint = (config[u"fingerprint"].upper()

285

.replace(u" ", u""))

286

logger.debug(u" Fingerprint: %s", self.fingerprint)

287

if u"secret" in config:

288

self.secret = config[u"secret"].decode(u"base64")

289

elif u"secfile" in config:

290

with closing(open(os.path.expanduser

291

(os.path.expandvars

292

(config[u"secfile"])))) as secfile:

310

self.fingerprint = (config["fingerprint"].upper()

311

.replace(" ", ""))

312

logger.debug(" Fingerprint: %s", self.fingerprint)

313

if "secret" in config:

314

self.secret = config["secret"].decode("base64")

315

elif "secfile" in config:

316

with open(os.path.expanduser(os.path.expandvars

317

(config["secfile"])),

318

"rb") as secfile:

293

319

self.secret = secfile.read()

294

320

else:

295

raise TypeError(u"No secret or secfile for client %s"

321

raise TypeError("No secret or secfile for client %s"

296

322

% self.name)

297

self.host = config.get(u"host", u"")

323

self.host = config.get("host", "")

298

324

self.created = datetime.datetime.utcnow()

299

325

self.enabled = False

326

self.last_approval_request = None

300

327

self.last_enabled = None

301

328

self.last_checked_ok = None

302

self.timeout = string_to_delta(config[u"timeout"])

303

self.interval = string_to_delta(config[u"interval"])

329

self.timeout = string_to_delta(config["timeout"])

330

self.interval = string_to_delta(config["interval"])

304

331

self.disable_hook = disable_hook

305

332

self.checker = None

306

333

self.checker_initiator_tag = None

307

334

self.disable_initiator_tag = None

308

335

self.checker_callback_tag = None

309

self.checker_command = config[u"checker"]

336

self.checker_command = config["checker"]

310

337

self.current_checker_command = None

311

338

self.last_connect = None

339

self._approved = None

340

self.approved_by_default = config.get("approved_by_default",

341

True)

342

self.approvals_pending = 0

343

self.approval_delay = string_to_delta(

344

config["approval_delay"])

345

self.approval_duration = string_to_delta(

346

config["approval_duration"])

347

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

312

348

349

def send_changedstate(self):

350

self.changedstate.acquire()

351

self.changedstate.notify_all()

352

self.changedstate.release()

353

313

354

def enable(self):

314

355

"""Start this client's checker and timeout hooks"""

356

if getattr(self, "enabled", False):

357

# Already enabled

358

return

359

self.send_changedstate()

315

360

self.last_enabled = datetime.datetime.utcnow()

316

361

# Schedule a new checker to be started an 'interval' from now,

317

362

# and every interval from then on.

318

363

self.checker_initiator_tag = (gobject.timeout_add

319

364

(self.interval_milliseconds(),

320

365

self.start_checker))

321

# Also start a new checker *right now*.

322

self.start_checker()

323

366

# Schedule a disable() when 'timeout' has passed

324

367

self.disable_initiator_tag = (gobject.timeout_add

325

368

(self.timeout_milliseconds(),

326

369

self.disable))

327

370

self.enabled = True

371

# Also start a new checker *right now*.

372

self.start_checker()

328

373

329

def disable(self):

374

def disable(self, quiet=True):

330

375

"""Disable this client."""

331

376

if not getattr(self, "enabled", False):

332

377

return False

333

logger.info(u"Disabling client %s", self.name)

334

if getattr(self, u"disable_initiator_tag", False):

378

if not quiet:

379

self.send_changedstate()

380

if not quiet:

381

logger.info("Disabling client %s", self.name)

382

if getattr(self, "disable_initiator_tag", False):

335

383

gobject.source_remove(self.disable_initiator_tag)

336

384

self.disable_initiator_tag = None

337

if getattr(self, u"checker_initiator_tag", False):

385

if getattr(self, "checker_initiator_tag", False):

338

386

gobject.source_remove(self.checker_initiator_tag)

339

387

self.checker_initiator_tag = None

340

388

self.stop_checker()

355

403

if os.WIFEXITED(condition):

356

404

exitstatus = os.WEXITSTATUS(condition)

357

405

if exitstatus == 0:

358

logger.info(u"Checker for %(name)s succeeded",

406

logger.info("Checker for %(name)s succeeded",

359

407

vars(self))

360

408

self.checked_ok()

361

409

else:

362

logger.info(u"Checker for %(name)s failed",

410

logger.info("Checker for %(name)s failed",

363

411

vars(self))

364

412

else:

365

logger.warning(u"Checker for %(name)s crashed?",

413

logger.warning("Checker for %(name)s crashed?",

366

414

vars(self))

367

415

368

416

def checked_ok(self):

377

425

(self.timeout_milliseconds(),

378

426

self.disable))

379

427

428

def need_approval(self):

429

self.last_approval_request = datetime.datetime.utcnow()

430

380

431

def start_checker(self):

381

432

"""Start a new checker subprocess if one is not running.

382

433

388

439

# client would inevitably timeout, since no checker would get

389

440

# a chance to run to completion. If we instead leave running

390

441

# checkers alone, the checker would have to take more time

391

# than 'timeout' for the client to be declared invalid, which

392

# is as it should be.

442

# than 'timeout' for the client to be disabled, which is as it

443

# should be.

393

444

394

445

# If a checker exists, make sure it is not a zombie

395

if self.checker is not None:

446

try:

396

447

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

448

except (AttributeError, OSError), error:

449

if (isinstance(error, OSError)

450

and error.errno != errno.ECHILD):

451

raise error

452

else:

397

453

if pid:

398

logger.warning(u"Checker was a zombie")

454

logger.warning("Checker was a zombie")

399

455

gobject.source_remove(self.checker_callback_tag)

400

456

self.checker_callback(pid, status,

401

457

self.current_checker_command)

406

462

command = self.checker_command % self.host

407

463

except TypeError:

408

464

# Escape attributes for the shell

409

escaped_attrs = dict((key,

410

re.escape(unicode(str(val),

411

errors=

412

u'replace')))

413

for key, val in

414

vars(self).iteritems())

465

escaped_attrs = dict(

466

(attr,

467

re.escape(unicode(str(getattr(self, attr, "")),

468

errors=

469

'replace')))

470

for attr in

471

self.runtime_expansions)

472

415

473

try:

416

474

command = self.checker_command % escaped_attrs

417

475

except TypeError, error:

418

logger.error(u'Could not format string "%s":'

419

u' %s', self.checker_command, error)

476

logger.error('Could not format string "%s":'

477

' %s', self.checker_command, error)

420

478

return True # Try again later

421

479

self.current_checker_command = command

422

480

try:

423

logger.info(u"Starting checker %r for %s",

481

logger.info("Starting checker %r for %s",

424

482

command, self.name)

425

483

# We don't need to redirect stdout and stderr, since

426

484

# in normal mode, that is already done by daemon(),

428

486

# always replaced by /dev/null.)

429

487

self.checker = subprocess.Popen(command,

430

488

close_fds=True,

431

shell=True, cwd=u"/")

489

shell=True, cwd="/")

432

490

self.checker_callback_tag = (gobject.child_watch_add

433

491

(self.checker.pid,

434

492

self.checker_callback,

440

498

gobject.source_remove(self.checker_callback_tag)

441

499

self.checker_callback(pid, status, command)

442

500

except OSError, error:

443

logger.error(u"Failed to start subprocess: %s",

501

logger.error("Failed to start subprocess: %s",

444

502

error)

445

503

# Re-run this periodically if run by gobject.timeout_add

446

504

return True

450

508

if self.checker_callback_tag:

451

509

gobject.source_remove(self.checker_callback_tag)

452

510

self.checker_callback_tag = None

453

if getattr(self, u"checker", None) is None:

511

if getattr(self, "checker", None) is None:

454

512

return

455

logger.debug(u"Stopping checker for %(name)s", vars(self))

513

logger.debug("Stopping checker for %(name)s", vars(self))

456

514

try:

457

515

os.kill(self.checker.pid, signal.SIGTERM)

458

#os.sleep(0.5)

516

#time.sleep(0.5)

459

517

#if self.checker.poll() is None:

460

518

# os.kill(self.checker.pid, signal.SIGKILL)

461

519

except OSError, error:

462

520

if error.errno != errno.ESRCH: # No such process

463

521

raise

464

522

self.checker = None

465

466

def still_valid(self):

467

"""Has the timeout not yet passed for this client?"""

468

if not getattr(self, u"enabled", False):

469

return False

470

now = datetime.datetime.utcnow()

471

if self.last_checked_ok is None:

472

return now < (self.created + self.timeout)

473

else:

474

return now < (self.last_checked_ok + self.timeout)

475

476

477

class ClientDBus(Client, dbus.service.Object):

523

524

def dbus_service_property(dbus_interface, signature="v",

525

access="readwrite", byte_arrays=False):

526

"""Decorators for marking methods of a DBusObjectWithProperties to

527

become properties on the D-Bus.

528

529

The decorated method will be called with no arguments by "Get"

530

and with one argument by "Set".

531

532

The parameters, where they are supported, are the same as

533

dbus.service.method, except there is only "signature", since the

534

type from Get() and the type sent to Set() is the same.

535

"""

536

# Encoding deeply encoded byte arrays is not supported yet by the

537

# "Set" method, so we fail early here:

538

if byte_arrays and signature != "ay":

539

raise ValueError("Byte arrays not supported for non-'ay'"

540

" signature %r" % signature)

541

def decorator(func):

542

func._dbus_is_property = True

543

func._dbus_interface = dbus_interface

544

func._dbus_signature = signature

545

func._dbus_access = access

546

func._dbus_name = func.__name__

547

if func._dbus_name.endswith("_dbus_property"):

548

func._dbus_name = func._dbus_name[:-14]

549

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

550

return func

551

return decorator

552

553

554

class DBusPropertyException(dbus.exceptions.DBusException):

555

"""A base class for D-Bus property-related exceptions

556

"""

557

def __unicode__(self):

558

return unicode(str(self))

559

560

561

class DBusPropertyAccessException(DBusPropertyException):

562

"""A property's access permissions disallows an operation.

563

"""

564

pass

565

566

567

class DBusPropertyNotFound(DBusPropertyException):

568

"""An attempt was made to access a non-existing property.

569

"""

570

pass

571

572

573

class DBusObjectWithProperties(dbus.service.Object):

574

"""A D-Bus object with properties.

575

576

Classes inheriting from this can use the dbus_service_property

577

decorator to expose methods as D-Bus properties. It exposes the

578

standard Get(), Set(), and GetAll() methods on the D-Bus.

579

"""

580

581

@staticmethod

582

def _is_dbus_property(obj):

583

return getattr(obj, "_dbus_is_property", False)

584

585

def _get_all_dbus_properties(self):

586

"""Returns a generator of (name, attribute) pairs

587

"""

588

return ((prop._dbus_name, prop)

589

for name, prop in

590

inspect.getmembers(self, self._is_dbus_property))

591

592

def _get_dbus_property(self, interface_name, property_name):

593

"""Returns a bound method if one exists which is a D-Bus

594

property with the specified name and interface.

595

"""

596

for name in (property_name,

597

property_name + "_dbus_property"):

598

prop = getattr(self, name, None)

599

if (prop is None

600

or not self._is_dbus_property(prop)

601

or prop._dbus_name != property_name

602

or (interface_name and prop._dbus_interface

603

and interface_name != prop._dbus_interface)):

604

continue

605

return prop

606

# No such property

607

raise DBusPropertyNotFound(self.dbus_object_path + ":"

608

+ interface_name + "."

609

+ property_name)

610

611

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

612

out_signature="v")

613

def Get(self, interface_name, property_name):

614

"""Standard D-Bus property Get() method, see D-Bus standard.

615

"""

616

prop = self._get_dbus_property(interface_name, property_name)

617

if prop._dbus_access == "write":

618

raise DBusPropertyAccessException(property_name)

619

value = prop()

620

if not hasattr(value, "variant_level"):

621

return value

622

return type(value)(value, variant_level=value.variant_level+1)

623

624

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

625

def Set(self, interface_name, property_name, value):

626

"""Standard D-Bus property Set() method, see D-Bus standard.

627

"""

628

prop = self._get_dbus_property(interface_name, property_name)

629

if prop._dbus_access == "read":

630

raise DBusPropertyAccessException(property_name)

631

if prop._dbus_get_args_options["byte_arrays"]:

632

# The byte_arrays option is not supported yet on

633

# signatures other than "ay".

634

if prop._dbus_signature != "ay":

635

raise ValueError

636

value = dbus.ByteArray(''.join(unichr(byte)

637

for byte in value))

638

prop(value)

639

640

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

641

out_signature="a{sv}")

642

def GetAll(self, interface_name):

643

"""Standard D-Bus property GetAll() method, see D-Bus

644

standard.

645

646

Note: Will not include properties with access="write".

647

"""

648

all = {}

649

for name, prop in self._get_all_dbus_properties():

650

if (interface_name

651

and interface_name != prop._dbus_interface):

652

# Interface non-empty but did not match

653

continue

654

# Ignore write-only properties

655

if prop._dbus_access == "write":

656

continue

657

value = prop()

658

if not hasattr(value, "variant_level"):

659

all[name] = value

660

continue

661

all[name] = type(value)(value, variant_level=

662

value.variant_level+1)

663

return dbus.Dictionary(all, signature="sv")

664

665

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

666

out_signature="s",

667

path_keyword='object_path',

668

connection_keyword='connection')

669

def Introspect(self, object_path, connection):

670

"""Standard D-Bus method, overloaded to insert property tags.

671

"""

672

xmlstring = dbus.service.Object.Introspect(self, object_path,

673

connection)

674

try:

675

document = xml.dom.minidom.parseString(xmlstring)

676

def make_tag(document, name, prop):

677

e = document.createElement("property")

678

e.setAttribute("name", name)

679

e.setAttribute("type", prop._dbus_signature)

680

e.setAttribute("access", prop._dbus_access)

681

return e

682

for if_tag in document.getElementsByTagName("interface"):

683

for tag in (make_tag(document, name, prop)

684

for name, prop

685

in self._get_all_dbus_properties()

686

if prop._dbus_interface

687

== if_tag.getAttribute("name")):

688

if_tag.appendChild(tag)

689

# Add the names to the return values for the

690

# "org.freedesktop.DBus.Properties" methods

691

if (if_tag.getAttribute("name")

692

== "org.freedesktop.DBus.Properties"):

693

for cn in if_tag.getElementsByTagName("method"):

694

if cn.getAttribute("name") == "Get":

695

for arg in cn.getElementsByTagName("arg"):

696

if (arg.getAttribute("direction")

697

== "out"):

698

arg.setAttribute("name", "value")

699

elif cn.getAttribute("name") == "GetAll":

700

for arg in cn.getElementsByTagName("arg"):

701

if (arg.getAttribute("direction")

702

== "out"):

703

arg.setAttribute("name", "props")

704

xmlstring = document.toxml("utf-8")

705

document.unlink()

706

except (AttributeError, xml.dom.DOMException,

707

xml.parsers.expat.ExpatError), error:

708

logger.error("Failed to override Introspection method",

709

error)

710

return xmlstring

711

712

713

class ClientDBus(Client, DBusObjectWithProperties):

478

714

"""A Client class using D-Bus

479

715

480

716

Attributes:

481

717

dbus_object_path: dbus.ObjectPath

482

718

bus: dbus.SystemBus()

483

719

"""

720

721

runtime_expansions = (Client.runtime_expansions

722

+ ("dbus_object_path",))

723

484

724

# dbus.service.Object doesn't use super(), so we can't either.

485

725

486

726

def __init__(self, bus = None, *args, **kwargs):

727

self._approvals_pending = 0

487

728

self.bus = bus

488

729

Client.__init__(self, *args, **kwargs)

489

730

# Only now, when this client is initialized, can it show up on

490

731

# the D-Bus

732

client_object_name = unicode(self.name).translate(

733

{ord("."): ord("_"),

734

ord("-"): ord("_")})

491

735

self.dbus_object_path = (dbus.ObjectPath

492

(u"/clients/"

493

+ self.name.replace(u".", u"_")))

494

dbus.service.Object.__init__(self, self.bus,

495

self.dbus_object_path)

736

("/clients/" + client_object_name))

737

DBusObjectWithProperties.__init__(self, self.bus,

738

self.dbus_object_path)

739

740

def _get_approvals_pending(self):

741

return self._approvals_pending

742

def _set_approvals_pending(self, value):

743

old_value = self._approvals_pending

744

self._approvals_pending = value

745

bval = bool(value)

746

if (hasattr(self, "dbus_object_path")

747

and bval is not bool(old_value)):

748

dbus_bool = dbus.Boolean(bval, variant_level=1)

749

self.PropertyChanged(dbus.String("ApprovalPending"),

750

dbus_bool)

751

752

approvals_pending = property(_get_approvals_pending,

753

_set_approvals_pending)

754

del _get_approvals_pending, _set_approvals_pending

496

755

497

756

@staticmethod

498

757

def _datetime_to_dbus(dt, variant_level=0):

501

760

variant_level=variant_level)

502

761

503

762

def enable(self):

504

oldstate = getattr(self, u"enabled", False)

763

oldstate = getattr(self, "enabled", False)

505

764

r = Client.enable(self)

506

765

if oldstate != self.enabled:

507

766

# Emit D-Bus signals

508

self.PropertyChanged(dbus.String(u"enabled"),

767

self.PropertyChanged(dbus.String("Enabled"),

509

768

dbus.Boolean(True, variant_level=1))

510

769

self.PropertyChanged(

511

dbus.String(u"last_enabled"),

770

dbus.String("LastEnabled"),

512

771

self._datetime_to_dbus(self.last_enabled,

513

772

variant_level=1))

514

773

return r

515

774

516

def disable(self, signal = True):

517

oldstate = getattr(self, u"enabled", False)

518

r = Client.disable(self)

519

if signal and oldstate != self.enabled:

775

def disable(self, quiet = False):

776

oldstate = getattr(self, "enabled", False)

777

r = Client.disable(self, quiet=quiet)

778

if not quiet and oldstate != self.enabled:

520

779

# Emit D-Bus signal

521

self.PropertyChanged(dbus.String(u"enabled"),

780

self.PropertyChanged(dbus.String("Enabled"),

522

781

dbus.Boolean(False, variant_level=1))

523

782

return r

524

783

527

786

self.remove_from_connection()

528

787

except LookupError:

529

788

pass

530

if hasattr(dbus.service.Object, u"__del__"):

531

dbus.service.Object.__del__(self, *args, **kwargs)

789

if hasattr(DBusObjectWithProperties, "__del__"):

790

DBusObjectWithProperties.__del__(self, *args, **kwargs)

532

791

Client.__del__(self, *args, **kwargs)

533

792

534

793

def checker_callback(self, pid, condition, command,

536

795

self.checker_callback_tag = None

537

796

self.checker = None

538

797

# Emit D-Bus signal

539

self.PropertyChanged(dbus.String(u"checker_running"),

798

self.PropertyChanged(dbus.String("CheckerRunning"),

540

799

dbus.Boolean(False, variant_level=1))

541

800

if os.WIFEXITED(condition):

542

801

exitstatus = os.WEXITSTATUS(condition)

557

816

r = Client.checked_ok(self, *args, **kwargs)

558

817

# Emit D-Bus signal

559

818

self.PropertyChanged(

560

dbus.String(u"last_checked_ok"),

819

dbus.String("LastCheckedOK"),

561

820

(self._datetime_to_dbus(self.last_checked_ok,

562

821

variant_level=1)))

563

822

return r

564

823

824

def need_approval(self, *args, **kwargs):

825

r = Client.need_approval(self, *args, **kwargs)

826

# Emit D-Bus signal

827

self.PropertyChanged(

828

dbus.String("LastApprovalRequest"),

829

(self._datetime_to_dbus(self.last_approval_request,

830

variant_level=1)))

831

return r

832

565

833

def start_checker(self, *args, **kwargs):

566

834

old_checker = self.checker

567

835

if self.checker is not None:

575

843

# Emit D-Bus signal

576

844

self.CheckerStarted(self.current_checker_command)

577

845

self.PropertyChanged(

578

dbus.String(u"checker_running"),

846

dbus.String("CheckerRunning"),

579

847

dbus.Boolean(True, variant_level=1))

580

848

return r

581

849

582

850

def stop_checker(self, *args, **kwargs):

583

old_checker = getattr(self, u"checker", None)

851

old_checker = getattr(self, "checker", None)

584

852

r = Client.stop_checker(self, *args, **kwargs)

585

853

if (old_checker is not None

586

and getattr(self, u"checker", None) is None):

587

self.PropertyChanged(dbus.String(u"checker_running"),

854

and getattr(self, "checker", None) is None):

855

self.PropertyChanged(dbus.String("CheckerRunning"),

588

856

dbus.Boolean(False, variant_level=1))

589

857

return r

590

591

## D-Bus methods & signals

592

_interface = u"se.bsnet.fukt.Mandos.Client"

593

594

# CheckedOK - method

595

@dbus.service.method(_interface)

596

def CheckedOK(self):

597

return self.checked_ok()

858

859

def _reset_approved(self):

860

self._approved = None

861

return False

862

863

def approve(self, value=True):

864

self.send_changedstate()

865

self._approved = value

866

gobject.timeout_add(self._timedelta_to_milliseconds

867

(self.approval_duration),

868

self._reset_approved)

869

870

871

## D-Bus methods, signals & properties

872

_interface = "se.bsnet.fukt.Mandos.Client"

873

874

## Signals

598

875

599

876

# CheckerCompleted - signal

600

@dbus.service.signal(_interface, signature=u"nxs")

877

@dbus.service.signal(_interface, signature="nxs")

601

878

def CheckerCompleted(self, exitcode, waitstatus, command):

602

879

"D-Bus signal"

603

880

pass

604

881

605

882

# CheckerStarted - signal

606

@dbus.service.signal(_interface, signature=u"s")

883

@dbus.service.signal(_interface, signature="s")

607

884

def CheckerStarted(self, command):

608

885

"D-Bus signal"

609

886

pass

610

887

611

# GetAllProperties - method

612

@dbus.service.method(_interface, out_signature=u"a{sv}")

613

def GetAllProperties(self):

614

"D-Bus method"

615

return dbus.Dictionary({

616

dbus.String(u"name"):

617

dbus.String(self.name, variant_level=1),

618

dbus.String(u"fingerprint"):

619

dbus.String(self.fingerprint, variant_level=1),

620

dbus.String(u"host"):

621

dbus.String(self.host, variant_level=1),

622

dbus.String(u"created"):

623

self._datetime_to_dbus(self.created,

624

variant_level=1),

625

dbus.String(u"last_enabled"):

626

(self._datetime_to_dbus(self.last_enabled,

627

variant_level=1)

628

if self.last_enabled is not None

629

else dbus.Boolean(False, variant_level=1)),

630

dbus.String(u"enabled"):

631

dbus.Boolean(self.enabled, variant_level=1),

632

dbus.String(u"last_checked_ok"):

633

(self._datetime_to_dbus(self.last_checked_ok,

634

variant_level=1)

635

if self.last_checked_ok is not None

636

else dbus.Boolean (False, variant_level=1)),

637

dbus.String(u"timeout"):

638

dbus.UInt64(self.timeout_milliseconds(),

639

variant_level=1),

640

dbus.String(u"interval"):

641

dbus.UInt64(self.interval_milliseconds(),

642

variant_level=1),

643

dbus.String(u"checker"):

644

dbus.String(self.checker_command,

645

variant_level=1),

646

dbus.String(u"checker_running"):

647

dbus.Boolean(self.checker is not None,

648

variant_level=1),

649

dbus.String(u"object_path"):

650

dbus.ObjectPath(self.dbus_object_path,

651

variant_level=1)

652

}, signature=u"sv")

653

654

# IsStillValid - method

655

@dbus.service.method(_interface, out_signature=u"b")

656

def IsStillValid(self):

657

return self.still_valid()

658

659

888

# PropertyChanged - signal

660

@dbus.service.signal(_interface, signature=u"sv")

889

@dbus.service.signal(_interface, signature="sv")

661

890

def PropertyChanged(self, property, value):

662

891

"D-Bus signal"

663

892

pass

664

893

665

# ReceivedSecret - signal

894

# GotSecret - signal

666

895

@dbus.service.signal(_interface)

667

def ReceivedSecret(self):

668

"D-Bus signal"

896

def GotSecret(self):

897

"""D-Bus signal

898

Is sent after a successful transfer of secret from the Mandos

899

server to mandos-client

900

"""

669

901

pass

670

902

671

903

# Rejected - signal

672

@dbus.service.signal(_interface)

673

def Rejected(self):

904

@dbus.service.signal(_interface, signature="s")

905

def Rejected(self, reason):

674

906

"D-Bus signal"

675

907

pass

676

908

677

# SetChecker - method

678

@dbus.service.method(_interface, in_signature=u"s")

679

def SetChecker(self, checker):

680

"D-Bus setter method"

681

self.checker_command = checker

682

# Emit D-Bus signal

683

self.PropertyChanged(dbus.String(u"checker"),

684

dbus.String(self.checker_command,

685

variant_level=1))

686

687

# SetHost - method

688

@dbus.service.method(_interface, in_signature=u"s")

689

def SetHost(self, host):

690

"D-Bus setter method"

691

self.host = host

692

# Emit D-Bus signal

693

self.PropertyChanged(dbus.String(u"host"),

694

dbus.String(self.host, variant_level=1))

695

696

# SetInterval - method

697

@dbus.service.method(_interface, in_signature=u"t")

698

def SetInterval(self, milliseconds):

699

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

700

# Emit D-Bus signal

701

self.PropertyChanged(dbus.String(u"interval"),

702

(dbus.UInt64(self.interval_milliseconds(),

703

variant_level=1)))

704

705

# SetSecret - method

706

@dbus.service.method(_interface, in_signature=u"ay",

707

byte_arrays=True)

708

def SetSecret(self, secret):

709

"D-Bus setter method"

710

self.secret = str(secret)

711

712

# SetTimeout - method

713

@dbus.service.method(_interface, in_signature=u"t")

714

def SetTimeout(self, milliseconds):

715

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

716

# Emit D-Bus signal

717

self.PropertyChanged(dbus.String(u"timeout"),

718

(dbus.UInt64(self.timeout_milliseconds(),

719

variant_level=1)))

909

# NeedApproval - signal

910

@dbus.service.signal(_interface, signature="tb")

911

def NeedApproval(self, timeout, default):

912

"D-Bus signal"

913

return self.need_approval()

914

915

## Methods

916

917

# Approve - method

918

@dbus.service.method(_interface, in_signature="b")

919

def Approve(self, value):

920

self.approve(value)

921

922

# CheckedOK - method

923

@dbus.service.method(_interface)

924

def CheckedOK(self):

925

return self.checked_ok()

720

926

721

927

# Enable - method

722

928

@dbus.service.method(_interface)

741

947

def StopChecker(self):

742

948

self.stop_checker()

743

949

950

## Properties

951

952

# ApprovalPending - property

953

@dbus_service_property(_interface, signature="b", access="read")

954

def ApprovalPending_dbus_property(self):

955

return dbus.Boolean(bool(self.approvals_pending))

956

957

# ApprovedByDefault - property

958

@dbus_service_property(_interface, signature="b",

959

access="readwrite")

960

def ApprovedByDefault_dbus_property(self, value=None):

961

if value is None: # get

962

return dbus.Boolean(self.approved_by_default)

963

self.approved_by_default = bool(value)

964

# Emit D-Bus signal

965

self.PropertyChanged(dbus.String("ApprovedByDefault"),

966

dbus.Boolean(value, variant_level=1))

967

968

# ApprovalDelay - property

969

@dbus_service_property(_interface, signature="t",

970

access="readwrite")

971

def ApprovalDelay_dbus_property(self, value=None):

972

if value is None: # get

973

return dbus.UInt64(self.approval_delay_milliseconds())

974

self.approval_delay = datetime.timedelta(0, 0, 0, value)

975

# Emit D-Bus signal

976

self.PropertyChanged(dbus.String("ApprovalDelay"),

977

dbus.UInt64(value, variant_level=1))

978

979

# ApprovalDuration - property

980

@dbus_service_property(_interface, signature="t",

981

access="readwrite")

982

def ApprovalDuration_dbus_property(self, value=None):

983

if value is None: # get

984

return dbus.UInt64(self._timedelta_to_milliseconds(

985

self.approval_duration))

986

self.approval_duration = datetime.timedelta(0, 0, 0, value)

987

# Emit D-Bus signal

988

self.PropertyChanged(dbus.String("ApprovalDuration"),

989

dbus.UInt64(value, variant_level=1))

990

991

# Name - property

992

@dbus_service_property(_interface, signature="s", access="read")

993

def Name_dbus_property(self):

994

return dbus.String(self.name)

995

996

# Fingerprint - property

997

@dbus_service_property(_interface, signature="s", access="read")

998

def Fingerprint_dbus_property(self):

999

return dbus.String(self.fingerprint)

1000

1001

# Host - property

1002

@dbus_service_property(_interface, signature="s",

1003

access="readwrite")

1004

def Host_dbus_property(self, value=None):

1005

if value is None: # get

1006

return dbus.String(self.host)

1007

self.host = value

1008

# Emit D-Bus signal

1009

self.PropertyChanged(dbus.String("Host"),

1010

dbus.String(value, variant_level=1))

1011

1012

# Created - property

1013

@dbus_service_property(_interface, signature="s", access="read")

1014

def Created_dbus_property(self):

1015

return dbus.String(self._datetime_to_dbus(self.created))

1016

1017

# LastEnabled - property

1018

@dbus_service_property(_interface, signature="s", access="read")

1019

def LastEnabled_dbus_property(self):

1020

if self.last_enabled is None:

1021

return dbus.String("")

1022

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1023

1024

# Enabled - property

1025

@dbus_service_property(_interface, signature="b",

1026

access="readwrite")

1027

def Enabled_dbus_property(self, value=None):

1028

if value is None: # get

1029

return dbus.Boolean(self.enabled)

1030

if value:

1031

self.enable()

1032

else:

1033

self.disable()

1034

1035

# LastCheckedOK - property

1036

@dbus_service_property(_interface, signature="s",

1037

access="readwrite")

1038

def LastCheckedOK_dbus_property(self, value=None):

1039

if value is not None:

1040

self.checked_ok()

1041

return

1042

if self.last_checked_ok is None:

1043

return dbus.String("")

1044

return dbus.String(self._datetime_to_dbus(self

1045

.last_checked_ok))

1046

1047

# LastApprovalRequest - property

1048

@dbus_service_property(_interface, signature="s", access="read")

1049

def LastApprovalRequest_dbus_property(self):

1050

if self.last_approval_request is None:

1051

return dbus.String("")

1052

return dbus.String(self.

1053

_datetime_to_dbus(self

1054

.last_approval_request))

1055

1056

# Timeout - property

1057

@dbus_service_property(_interface, signature="t",

1058

access="readwrite")

1059

def Timeout_dbus_property(self, value=None):

1060

if value is None: # get

1061

return dbus.UInt64(self.timeout_milliseconds())

1062

self.timeout = datetime.timedelta(0, 0, 0, value)

1063

# Emit D-Bus signal

1064

self.PropertyChanged(dbus.String("Timeout"),

1065

dbus.UInt64(value, variant_level=1))

1066

if getattr(self, "disable_initiator_tag", None) is None:

1067

return

1068

# Reschedule timeout

1069

gobject.source_remove(self.disable_initiator_tag)

1070

self.disable_initiator_tag = None

1071

time_to_die = (self.

1072

_timedelta_to_milliseconds((self

1073

.last_checked_ok

1074

+ self.timeout)

1075

- datetime.datetime

1076

.utcnow()))

1077

if time_to_die <= 0:

1078

# The timeout has passed

1079

self.disable()

1080

else:

1081

self.disable_initiator_tag = (gobject.timeout_add

1082

(time_to_die, self.disable))

1083

1084

# Interval - property

1085

@dbus_service_property(_interface, signature="t",

1086

access="readwrite")

1087

def Interval_dbus_property(self, value=None):

1088

if value is None: # get

1089

return dbus.UInt64(self.interval_milliseconds())

1090

self.interval = datetime.timedelta(0, 0, 0, value)

1091

# Emit D-Bus signal

1092

self.PropertyChanged(dbus.String("Interval"),

1093

dbus.UInt64(value, variant_level=1))

1094

if getattr(self, "checker_initiator_tag", None) is None:

1095

return

1096

# Reschedule checker run

1097

gobject.source_remove(self.checker_initiator_tag)

1098

self.checker_initiator_tag = (gobject.timeout_add

1099

(value, self.start_checker))

1100

self.start_checker() # Start one now, too

1101

1102

# Checker - property

1103

@dbus_service_property(_interface, signature="s",

1104

access="readwrite")

1105

def Checker_dbus_property(self, value=None):

1106

if value is None: # get

1107

return dbus.String(self.checker_command)

1108

self.checker_command = value

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Checker"),

1111

dbus.String(self.checker_command,

1112

variant_level=1))

1113

1114

# CheckerRunning - property

1115

@dbus_service_property(_interface, signature="b",

1116

access="readwrite")

1117

def CheckerRunning_dbus_property(self, value=None):

1118

if value is None: # get

1119

return dbus.Boolean(self.checker is not None)

1120

if value:

1121

self.start_checker()

1122

else:

1123

self.stop_checker()

1124

1125

# ObjectPath - property

1126

@dbus_service_property(_interface, signature="o", access="read")

1127

def ObjectPath_dbus_property(self):

1128

return self.dbus_object_path # is already a dbus.ObjectPath

1129

1130

# Secret = property

1131

@dbus_service_property(_interface, signature="ay",

1132

access="write", byte_arrays=True)

1133

def Secret_dbus_property(self, value):

1134

self.secret = str(value)

1135

744

1136

del _interface

745

1137

746

1138

1139

class ProxyClient(object):

1140

def __init__(self, child_pipe, fpr, address):

1141

self._pipe = child_pipe

1142

self._pipe.send(('init', fpr, address))

1143

if not self._pipe.recv():

1144

raise KeyError()

1145

1146

def __getattribute__(self, name):

1147

if(name == '_pipe'):

1148

return super(ProxyClient, self).__getattribute__(name)

1149

self._pipe.send(('getattr', name))

1150

data = self._pipe.recv()

1151

if data[0] == 'data':

1152

return data[1]

1153

if data[0] == 'function':

1154

def func(*args, **kwargs):

1155

self._pipe.send(('funcall', name, args, kwargs))

1156

return self._pipe.recv()[1]

1157

return func

1158

1159

def __setattr__(self, name, value):

1160

if(name == '_pipe'):

1161

return super(ProxyClient, self).__setattr__(name, value)

1162

self._pipe.send(('setattr', name, value))

1163

1164

747

1165

class ClientHandler(socketserver.BaseRequestHandler, object):

748

1166

"""A class to handle client connections.

749

1167

751

1169

Note: This will run in its own forked process."""

752

1170

753

1171

def handle(self):

754

logger.info(u"TCP connection from: %s",

755

unicode(self.client_address))

756

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

757

# Open IPC pipe to parent process

758

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1172

with contextlib.closing(self.server.child_pipe) as child_pipe:

1173

logger.info("TCP connection from: %s",

1174

unicode(self.client_address))

1175

logger.debug("Pipe FD: %d",

1176

self.server.child_pipe.fileno())

1177

759

1178

session = (gnutls.connection

760

1179

.ClientSession(self.request,

761

1180

gnutls.connection

762

1181

.X509Credentials()))

763

764

line = self.request.makefile().readline()

765

logger.debug(u"Protocol version: %r", line)

766

try:

767

if int(line.strip().split()[0]) > 1:

768

raise RuntimeError

769

except (ValueError, IndexError, RuntimeError), error:

770

logger.error(u"Unknown protocol version: %s", error)

771

return

772

1182

773

1183

# Note: gnutls.connection.X509Credentials is really a

774

1184

# generic GnuTLS certificate credentials object so long as

775

1185

# no X.509 keys are added to it. Therefore, we can use it

776

1186

# here despite using OpenPGP certificates.

777

778

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

779

# u"+AES-256-CBC", u"+SHA1",

780

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

781

# u"+DHE-DSS"))

1187

1188

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1189

# "+AES-256-CBC", "+SHA1",

1190

# "+COMP-NULL", "+CTYPE-OPENPGP",

1191

# "+DHE-DSS"))

782

1192

# Use a fallback default, since this MUST be set.

783

1193

priority = self.server.gnutls_priority

784

1194

if priority is None:

785

priority = u"NORMAL"

1195

priority = "NORMAL"

786

1196

(gnutls.library.functions

787

1197

.gnutls_priority_set_direct(session._c_object,

788

1198

priority, None))

789

1199

1200

# Start communication using the Mandos protocol

1201

# Get protocol number

1202

line = self.request.makefile().readline()

1203

logger.debug("Protocol version: %r", line)

1204

try:

1205

if int(line.strip().split()[0]) > 1:

1206

raise RuntimeError

1207

except (ValueError, IndexError, RuntimeError), error:

1208

logger.error("Unknown protocol version: %s", error)

1209

return

1210

1211

# Start GnuTLS connection

790

1212

try:

791

1213

session.handshake()

792

1214

except gnutls.errors.GNUTLSError, error:

793

logger.warning(u"Handshake failed: %s", error)

1215

logger.warning("Handshake failed: %s", error)

794

1216

# Do not run session.bye() here: the session is not

795

1217

# established. Just abandon the request.

796

1218

return

797

logger.debug(u"Handshake succeeded")

1219

logger.debug("Handshake succeeded")

1220

1221

approval_required = False

798

1222

try:

799

fpr = self.fingerprint(self.peer_certificate(session))

800

except (TypeError, gnutls.errors.GNUTLSError), error:

801

logger.warning(u"Bad certificate: %s", error)

802

session.bye()

803

return

804

logger.debug(u"Fingerprint: %s", fpr)

1223

try:

1224

fpr = self.fingerprint(self.peer_certificate

1225

(session))

1226

except (TypeError, gnutls.errors.GNUTLSError), error:

1227

logger.warning("Bad certificate: %s", error)

1228

return

1229

logger.debug("Fingerprint: %s", fpr)

1230

1231

try:

1232

client = ProxyClient(child_pipe, fpr,

1233

self.client_address)

1234

except KeyError:

1235

return

1236

1237

if client.approval_delay:

1238

delay = client.approval_delay

1239

client.approvals_pending += 1

1240

approval_required = True

1241

1242

while True:

1243

if not client.enabled:

1244

logger.warning("Client %s is disabled",

1245

client.name)

1246

if self.server.use_dbus:

1247

# Emit D-Bus signal

1248

client.Rejected("Disabled")

1249

return

1250

1251

if client._approved or not client.approval_delay:

1252

#We are approved or approval is disabled

1253

break

1254

elif client._approved is None:

1255

logger.info("Client %s needs approval",

1256

client.name)

1257

if self.server.use_dbus:

1258

# Emit D-Bus signal

1259

client.NeedApproval(

1260

client.approval_delay_milliseconds(),

1261

client.approved_by_default)

1262

else:

1263

logger.warning("Client %s was not approved",

1264

client.name)

1265

if self.server.use_dbus:

1266

# Emit D-Bus signal

1267

client.Rejected("Denied")

1268

return

1269

1270

#wait until timeout or approved

1271

#x = float(client._timedelta_to_milliseconds(delay))

1272

time = datetime.datetime.now()

1273

client.changedstate.acquire()

1274

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1275

client.changedstate.release()

1276

time2 = datetime.datetime.now()

1277

if (time2 - time) >= delay:

1278

if not client.approved_by_default:

1279

logger.warning("Client %s timed out while"

1280

" waiting for approval",

1281

client.name)

1282

if self.server.use_dbus:

1283

# Emit D-Bus signal

1284

client.Rejected("Approval timed out")

1285

return

1286

else:

1287

break

1288

else:

1289

delay -= time2 - time

1290

1291

sent_size = 0

1292

while sent_size < len(client.secret):

1293

try:

1294

sent = session.send(client.secret[sent_size:])

1295

except (gnutls.errors.GNUTLSError), error:

1296

logger.warning("gnutls send failed")

1297

return

1298

logger.debug("Sent: %d, remaining: %d",

1299

sent, len(client.secret)

1300

- (sent_size + sent))

1301

sent_size += sent

1302

1303

logger.info("Sending secret to %s", client.name)

1304

# bump the timeout as if seen

1305

client.checked_ok()

1306

if self.server.use_dbus:

1307

# Emit D-Bus signal

1308

client.GotSecret()

805

1309

806

for c in self.server.clients:

807

if c.fingerprint == fpr:

808

client = c

809

break

810

else:

811

ipc.write(u"NOTFOUND %s\n" % fpr)

812

session.bye()

813

return

814

# Have to check if client.still_valid(), since it is

815

# possible that the client timed out while establishing

816

# the GnuTLS session.

817

if not client.still_valid():

818

ipc.write(u"INVALID %s\n" % client.name)

819

session.bye()

820

return

821

ipc.write(u"SENDING %s\n" % client.name)

822

sent_size = 0

823

while sent_size < len(client.secret):

824

sent = session.send(client.secret[sent_size:])

825

logger.debug(u"Sent: %d, remaining: %d",

826

sent, len(client.secret)

827

- (sent_size + sent))

828

sent_size += sent

829

session.bye()

1310

finally:

1311

if approval_required:

1312

client.approvals_pending -= 1

1313

try:

1314

session.bye()

1315

except (gnutls.errors.GNUTLSError), error:

1316

logger.warning("GnuTLS bye failed")

830

1317

831

1318

@staticmethod

832

1319

def peer_certificate(session):

842

1329

.gnutls_certificate_get_peers

843

1330

(session._c_object, ctypes.byref(list_size)))

844

1331

if not bool(cert_list) and list_size.value != 0:

845

raise gnutls.errors.GNUTLSError(u"error getting peer"

846

u" certificate")

1332

raise gnutls.errors.GNUTLSError("error getting peer"

1333

" certificate")

847

1334

if list_size.value == 0:

848

1335

return None

849

1336

cert = cert_list[0]

875

1362

if crtverify.value != 0:

876

1363

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

877

1364

raise (gnutls.errors.CertificateSecurityError

878

(u"Verify failed"))

1365

("Verify failed"))

879

1366

# New buffer for the fingerprint

880

1367

buf = ctypes.create_string_buffer(20)

881

1368

buf_len = ctypes.c_size_t()

888

1375

# Convert the buffer to a Python bytestring

889

1376

fpr = ctypes.string_at(buf, buf_len.value)

890

1377

# Convert the bytestring to hexadecimal notation

891

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1378

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

892

1379

return hex_fpr

893

1380

894

1381

895

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

896

"""Like socketserver.ForkingMixIn, but also pass a pipe.

897

898

Assumes a gobject.MainLoop event loop.

899

"""

1382

class MultiprocessingMixIn(object):

1383

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1384

def sub_process_main(self, request, address):

1385

try:

1386

self.finish_request(request, address)

1387

except:

1388

self.handle_error(request, address)

1389

self.close_request(request)

1390

1391

def process_request(self, request, address):

1392

"""Start a new process to process the request."""

1393

multiprocessing.Process(target = self.sub_process_main,

1394

args = (request, address)).start()

1395

1396

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1397

""" adds a pipe to the MixIn """

900

1398

def process_request(self, request, client_address):

901

1399

"""Overrides and wraps the original process_request().

902

1400

903

This function creates a new pipe in self.pipe

1401

This function creates a new pipe in self.pipe

904

1402

"""

905

self.pipe = os.pipe()

906

super(ForkingMixInWithPipe,

1403

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1404

1405

super(MultiprocessingMixInWithPipe,

907

1406

self).process_request(request, client_address)

908

os.close(self.pipe[1]) # close write end

909

# Call "handle_ipc" for both data and EOF events

910

gobject.io_add_watch(self.pipe[0],

911

gobject.IO_IN | gobject.IO_HUP,

912

self.handle_ipc)

913

def handle_ipc(self, source, condition):

1407

self.child_pipe.close()

1408

self.add_pipe(parent_pipe)

1409

1410

def add_pipe(self, parent_pipe):

914

1411

"""Dummy function; override as necessary"""

915

os.close(source)

916

return False

917

918

919

class IPv6_TCPServer(ForkingMixInWithPipe,

1412

raise NotImplementedError

1413

1414

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

920

1415

socketserver.TCPServer, object):

921

1416

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

922

1417

924

1419

enabled: Boolean; whether this server is activated yet

925

1420

interface: None or a network interface name (string)

926

1421

use_ipv6: Boolean; to use IPv6 or not

927

----

928

clients: set of Client objects

929

gnutls_priority GnuTLS priority string

930

use_dbus: Boolean; to emit D-Bus signals or not

931

1422

"""

932

1423

def __init__(self, server_address, RequestHandlerClass,

933

1424

interface=None, use_ipv6=True):

942

1433

bind to an address or port if they were not specified."""

943

1434

if self.interface is not None:

944

1435

if SO_BINDTODEVICE is None:

945

logger.error(u"SO_BINDTODEVICE does not exist;"

946

u" cannot bind to interface %s",

1436

logger.error("SO_BINDTODEVICE does not exist;"

1437

" cannot bind to interface %s",

947

1438

self.interface)

948

1439

else:

949

1440

try:

950

1441

self.socket.setsockopt(socket.SOL_SOCKET,

951

1442

SO_BINDTODEVICE,

952

1443

str(self.interface

953

+ u'\0'))

1444

+ '\0'))

954

1445

except socket.error, error:

955

1446

if error[0] == errno.EPERM:

956

logger.error(u"No permission to"

957

u" bind to interface %s",

1447

logger.error("No permission to"

1448

" bind to interface %s",

958

1449

self.interface)

959

1450

elif error[0] == errno.ENOPROTOOPT:

960

logger.error(u"SO_BINDTODEVICE not available;"

961

u" cannot bind to interface %s",

1451

logger.error("SO_BINDTODEVICE not available;"

1452

" cannot bind to interface %s",

962

1453

self.interface)

963

1454

else:

964

1455

raise

966

1457

if self.server_address[0] or self.server_address[1]:

967

1458

if not self.server_address[0]:

968

1459

if self.address_family == socket.AF_INET6:

969

any_address = u"::" # in6addr_any

1460

any_address = "::" # in6addr_any

970

1461

else:

971

1462

any_address = socket.INADDR_ANY

972

1463

self.server_address = (any_address,

990

1481

clients: set of Client objects

991

1482

gnutls_priority GnuTLS priority string

992

1483

use_dbus: Boolean; to emit D-Bus signals or not

1484

1485

Assumes a gobject.MainLoop event loop.

993

1486

"""

994

1487

def __init__(self, server_address, RequestHandlerClass,

995

1488

interface=None, use_ipv6=True, clients=None,

996

1489

gnutls_priority=None, use_dbus=True):

997

1490

self.enabled = False

998

1491

self.clients = clients

1492

if self.clients is None:

1493

self.clients = set()

999

1494

self.use_dbus = use_dbus

1000

1495

self.gnutls_priority = gnutls_priority

1001

1496

IPv6_TCPServer.__init__(self, server_address,

1007

1502

return socketserver.TCPServer.server_activate(self)

1008

1503

def enable(self):

1009

1504

self.enabled = True

1010

def handle_ipc(self, source, condition, file_objects={}):

1505

def add_pipe(self, parent_pipe):

1506

# Call "handle_ipc" for both data and EOF events

1507

gobject.io_add_watch(parent_pipe.fileno(),

1508

gobject.IO_IN | gobject.IO_HUP,

1509

functools.partial(self.handle_ipc,

1510

parent_pipe = parent_pipe))

1511

1512

def handle_ipc(self, source, condition, parent_pipe=None,

1513

client_object=None):

1011

1514

condition_names = {

1012

gobject.IO_IN: u"IN", # There is data to read.

1013

gobject.IO_OUT: u"OUT", # Data can be written (without

1515

gobject.IO_IN: "IN", # There is data to read.

1516

gobject.IO_OUT: "OUT", # Data can be written (without

1014

1517

# blocking).

1015

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1016

gobject.IO_ERR: u"ERR", # Error condition.

1017

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1518

gobject.IO_PRI: "PRI", # There is urgent data to read.

1519

gobject.IO_ERR: "ERR", # Error condition.

1520

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1018

1521

# broken, usually for pipes and

1019

1522

# sockets).

1020

1523

}

1022

1525

for cond, name in

1023

1526

condition_names.iteritems()

1024

1527

if cond & condition)

1025

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1026

conditions_string)

1027

1028

# Turn the pipe file descriptor into a Python file object

1029

if source not in file_objects:

1030

file_objects[source] = os.fdopen(source, u"r", 1)

1031

1032

# Read a line from the file object

1033

cmdline = file_objects[source].readline()

1034

if not cmdline: # Empty line means end of file

1035

# close the IPC pipe

1036

file_objects[source].close()

1037

del file_objects[source]

1038

1039

# Stop calling this function

1040

return False

1041

1042

logger.debug(u"IPC command: %r", cmdline)

1043

1044

# Parse and act on command

1045

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1046

1047

if cmd == u"NOTFOUND":

1048

logger.warning(u"Client not found for fingerprint: %s",

1049

args)

1050

if self.use_dbus:

1051

# Emit D-Bus signal

1052

mandos_dbus_service.ClientNotFound(args)

1053

elif cmd == u"INVALID":

1054

for client in self.clients:

1055

if client.name == args:

1056

logger.warning(u"Client %s is invalid", args)

1057

if self.use_dbus:

1058

# Emit D-Bus signal

1059

client.Rejected()

1060

break

1061

else:

1062

logger.error(u"Unknown client %s is invalid", args)

1063

elif cmd == u"SENDING":

1064

for client in self.clients:

1065

if client.name == args:

1066

logger.info(u"Sending secret to %s", client.name)

1067

client.checked_ok()

1068

if self.use_dbus:

1069

# Emit D-Bus signal

1070

client.ReceivedSecret()

1071

break

1072

else:

1073

logger.error(u"Sending secret to unknown client %s",

1074

args)

1075

else:

1076

logger.error(u"Unknown IPC command: %r", cmdline)

1077

1078

# Keep calling this function

1528

# error or the other end of multiprocessing.Pipe has closed

1529

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1530

return False

1531

1532

# Read a request from the child

1533

request = parent_pipe.recv()

1534

command = request[0]

1535

1536

if command == 'init':

1537

fpr = request[1]

1538

address = request[2]

1539

1540

for c in self.clients:

1541

if c.fingerprint == fpr:

1542

client = c

1543

break

1544

else:

1545

logger.warning("Client not found for fingerprint: %s, ad"

1546

"dress: %s", fpr, address)

1547

if self.use_dbus:

1548

# Emit D-Bus signal

1549

mandos_dbus_service.ClientNotFound(fpr, address[0])

1550

parent_pipe.send(False)

1551

return False

1552

1553

gobject.io_add_watch(parent_pipe.fileno(),

1554

gobject.IO_IN | gobject.IO_HUP,

1555

functools.partial(self.handle_ipc,

1556

parent_pipe = parent_pipe,

1557

client_object = client))

1558

parent_pipe.send(True)

1559

# remove the old hook in favor of the new above hook on same fileno

1560

return False

1561

if command == 'funcall':

1562

funcname = request[1]

1563

args = request[2]

1564

kwargs = request[3]

1565

1566

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1567

1568

if command == 'getattr':

1569

attrname = request[1]

1570

if callable(client_object.__getattribute__(attrname)):

1571

parent_pipe.send(('function',))

1572

else:

1573

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1574

1575

if command == 'setattr':

1576

attrname = request[1]

1577

value = request[2]

1578

setattr(client_object, attrname, value)

1579

1079

1580

return True

1080

1581

1081

1582

1082

1583

def string_to_delta(interval):

1083

1584

"""Parse a string and return a datetime.timedelta

1084

1585

1085

>>> string_to_delta(u'7d')

1586

>>> string_to_delta('7d')

1086

1587

datetime.timedelta(7)

1087

>>> string_to_delta(u'60s')

1588

>>> string_to_delta('60s')

1088

1589

datetime.timedelta(0, 60)

1089

>>> string_to_delta(u'60m')

1590

>>> string_to_delta('60m')

1090

1591

datetime.timedelta(0, 3600)

1091

>>> string_to_delta(u'24h')

1592

>>> string_to_delta('24h')

1092

1593

datetime.timedelta(1)

1093

>>> string_to_delta(u'1w')

1594

>>> string_to_delta('1w')

1094

1595

datetime.timedelta(7)

1095

>>> string_to_delta(u'5m 30s')

1596

>>> string_to_delta('5m 30s')

1096

1597

datetime.timedelta(0, 330)

1097

1598

"""

1098

1599

timevalue = datetime.timedelta(0)

1100

1601

try:

1101

1602

suffix = unicode(s[-1])

1102

1603

value = int(s[:-1])

1103

if suffix == u"d":

1604

if suffix == "d":

1104

1605

delta = datetime.timedelta(value)

1105

elif suffix == u"s":

1606

elif suffix == "s":

1106

1607

delta = datetime.timedelta(0, value)

1107

elif suffix == u"m":

1608

elif suffix == "m":

1108

1609

delta = datetime.timedelta(0, 0, 0, 0, value)

1109

elif suffix == u"h":

1610

elif suffix == "h":

1110

1611

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1111

elif suffix == u"w":

1612

elif suffix == "w":

1112

1613

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1113

1614

else:

1114

raise ValueError

1115

except (ValueError, IndexError):

1116

raise ValueError

1615

raise ValueError("Unknown suffix %r" % suffix)

1616

except (ValueError, IndexError), e:

1617

raise ValueError(*(e.args))

1117

1618

timevalue += delta

1118

1619

return timevalue

1119

1620

1125

1626

global if_nametoindex

1126

1627

try:

1127

1628

if_nametoindex = (ctypes.cdll.LoadLibrary

1128

(ctypes.util.find_library(u"c"))

1629

(ctypes.util.find_library("c"))

1129

1630

.if_nametoindex)

1130

1631

except (OSError, AttributeError):

1131

logger.warning(u"Doing if_nametoindex the hard way")

1632

logger.warning("Doing if_nametoindex the hard way")

1132

1633

def if_nametoindex(interface):

1133

1634

"Get an interface index the hard way, i.e. using fcntl()"

1134

1635

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1135

with closing(socket.socket()) as s:

1636

with contextlib.closing(socket.socket()) as s:

1136

1637

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1137

struct.pack(str(u"16s16x"),

1638

struct.pack(str("16s16x"),

1138

1639

interface))

1139

interface_index = struct.unpack(str(u"I"),

1640

interface_index = struct.unpack(str("I"),

1140

1641

ifreq[16:20])[0]

1141

1642

return interface_index

1142

1643

return if_nametoindex(interface)

1150

1651

sys.exit()

1151

1652

os.setsid()

1152

1653

if not nochdir:

1153

os.chdir(u"/")

1654

os.chdir("/")

1154

1655

if os.fork():

1155

1656

sys.exit()

1156

1657

if not noclose:

1158

1659

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1159

1660

if not stat.S_ISCHR(os.fstat(null).st_mode):

1160

1661

raise OSError(errno.ENODEV,

1161

u"/dev/null not a character device")

1662

"%s not a character device"

1663

% os.path.devnull)

1162

1664

os.dup2(null, sys.stdin.fileno())

1163

1665

os.dup2(null, sys.stdout.fileno())

1164

1666

os.dup2(null, sys.stderr.fileno())

1168

1670

1169

1671

def main():

1170

1672

1171

######################################################################

1673

##################################################################

1172

1674

# Parsing of options, both command line and config file

1173

1675

1174

1676

parser = optparse.OptionParser(version = "%%prog %s" % version)

1175

parser.add_option("-i", u"--interface", type=u"string",

1176

metavar="IF", help=u"Bind to interface IF")

1177

parser.add_option("-a", u"--address", type=u"string",

1178

help=u"Address to listen for requests on")

1179

parser.add_option("-p", u"--port", type=u"int",

1180

help=u"Port number to receive requests on")

1181

parser.add_option("--check", action=u"store_true",

1182

help=u"Run self-test")

1183

parser.add_option("--debug", action=u"store_true",

1184

help=u"Debug mode; run in foreground and log to"

1185

u" terminal")

1186

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1187

u" priority string (see GnuTLS documentation)")

1188

parser.add_option("--servicename", type=u"string",

1189

metavar=u"NAME", help=u"Zeroconf service name")

1190

parser.add_option("--configdir", type=u"string",

1191

default=u"/etc/mandos", metavar=u"DIR",

1192

help=u"Directory to search for configuration"

1193

u" files")

1194

parser.add_option("--no-dbus", action=u"store_false",

1195

dest=u"use_dbus", help=u"Do not provide D-Bus"

1196

u" system bus interface")

1197

parser.add_option("--no-ipv6", action=u"store_false",

1198

dest=u"use_ipv6", help=u"Do not use IPv6")

1677

parser.add_option("-i", "--interface", type="string",

1678

metavar="IF", help="Bind to interface IF")

1679

parser.add_option("-a", "--address", type="string",

1680

help="Address to listen for requests on")

1681

parser.add_option("-p", "--port", type="int",

1682

help="Port number to receive requests on")

1683

parser.add_option("--check", action="store_true",

1684

help="Run self-test")

1685

parser.add_option("--debug", action="store_true",

1686

help="Debug mode; run in foreground and log to"

1687

" terminal")

1688

parser.add_option("--debuglevel", type="string", metavar="LEVEL",

1689

help="Debug level for stdout output")

1690

parser.add_option("--priority", type="string", help="GnuTLS"

1691

" priority string (see GnuTLS documentation)")

1692

parser.add_option("--servicename", type="string",

1693

metavar="NAME", help="Zeroconf service name")

1694

parser.add_option("--configdir", type="string",

1695

default="/etc/mandos", metavar="DIR",

1696

help="Directory to search for configuration"

1697

" files")

1698

parser.add_option("--no-dbus", action="store_false",

1699

dest="use_dbus", help="Do not provide D-Bus"

1700

" system bus interface")

1701

parser.add_option("--no-ipv6", action="store_false",

1702

dest="use_ipv6", help="Do not use IPv6")

1199

1703

options = parser.parse_args()[0]

1200

1704

1201

1705

if options.check:

1204

1708

sys.exit()

1205

1709

1206

1710

# Default values for config file for server-global settings

1207

server_defaults = { u"interface": u"",

1208

u"address": u"",

1209

u"port": u"",

1210

u"debug": u"False",

1211

u"priority":

1212

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1213

u"servicename": u"Mandos",

1214

u"use_dbus": u"True",

1215

u"use_ipv6": u"True",

1711

server_defaults = { "interface": "",

1712

"address": "",

1713

"port": "",

1714

"debug": "False",

1715

"priority":

1716

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1717

"servicename": "Mandos",

1718

"use_dbus": "True",

1719

"use_ipv6": "True",

1720

"debuglevel": "",

1216

1721

}

1217

1722

1218

1723

# Parse config file for server-global settings

1219

1724

server_config = configparser.SafeConfigParser(server_defaults)

1220

1725

del server_defaults

1221

1726

server_config.read(os.path.join(options.configdir,

1222

u"mandos.conf"))

1727

"mandos.conf"))

1223

1728

# Convert the SafeConfigParser object to a dict

1224

1729

server_settings = server_config.defaults()

1225

1730

# Use the appropriate methods on the non-string config options

1226

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1227

server_settings[option] = server_config.getboolean(u"DEFAULT",

1731

for option in ("debug", "use_dbus", "use_ipv6"):

1732

server_settings[option] = server_config.getboolean("DEFAULT",

1228

1733

option)

1229

1734

if server_settings["port"]:

1230

server_settings["port"] = server_config.getint(u"DEFAULT",

1231

u"port")

1735

server_settings["port"] = server_config.getint("DEFAULT",

1736

"port")

1232

1737

del server_config

1233

1738

1234

1739

# Override the settings from the config file with command line

1235

1740

# options, if set.

1236

for option in (u"interface", u"address", u"port", u"debug",

1237

u"priority", u"servicename", u"configdir",

1238

u"use_dbus", u"use_ipv6"):

1741

for option in ("interface", "address", "port", "debug",

1742

"priority", "servicename", "configdir",

1743

"use_dbus", "use_ipv6", "debuglevel"):

1239

1744

value = getattr(options, option)

1240

1745

if value is not None:

1241

1746

server_settings[option] = value

1249

1754

##################################################################

1250

1755

1251

1756

# For convenience

1252

debug = server_settings[u"debug"]

1253

use_dbus = server_settings[u"use_dbus"]

1254

use_ipv6 = server_settings[u"use_ipv6"]

1255

1256

if not debug:

1257

syslogger.setLevel(logging.WARNING)

1258

console.setLevel(logging.WARNING)

1259

1260

if server_settings[u"servicename"] != u"Mandos":

1757

debug = server_settings["debug"]

1758

debuglevel = server_settings["debuglevel"]

1759

use_dbus = server_settings["use_dbus"]

1760

use_ipv6 = server_settings["use_ipv6"]

1761

1762

if server_settings["servicename"] != "Mandos":

1261

1763

syslogger.setFormatter(logging.Formatter

1262

(u'Mandos (%s) [%%(process)d]:'

1263

u' %%(levelname)s: %%(message)s'

1264

% server_settings[u"servicename"]))

1764

('Mandos (%s) [%%(process)d]:'

1765

' %%(levelname)s: %%(message)s'

1766

% server_settings["servicename"]))

1265

1767

1266

1768

# Parse config file with clients

1267

client_defaults = { u"timeout": u"1h",

1268

u"interval": u"5m",

1269

u"checker": u"fping -q -- %%(host)s",

1270

u"host": u"",

1769

client_defaults = { "timeout": "1h",

1770

"interval": "5m",

1771

"checker": "fping -q -- %%(host)s",

1772

"host": "",

1773

"approval_delay": "0s",

1774

"approval_duration": "1s",

1271

1775

}

1272

1776

client_config = configparser.SafeConfigParser(client_defaults)

1273

client_config.read(os.path.join(server_settings[u"configdir"],

1274

u"clients.conf"))

1777

client_config.read(os.path.join(server_settings["configdir"],

1778

"clients.conf"))

1275

1779

1276

1780

global mandos_dbus_service

1277

1781

mandos_dbus_service = None

1278

1782

1279

clients = set()

1280

tcp_server = MandosServer((server_settings[u"address"],

1281

server_settings[u"port"]),

1783

tcp_server = MandosServer((server_settings["address"],

1784

server_settings["port"]),

1282

1785

ClientHandler,

1283

interface=server_settings[u"interface"],

1786

interface=(server_settings["interface"]

1787

or None),

1284

1788

use_ipv6=use_ipv6,

1285

clients=clients,

1286

1789

gnutls_priority=

1287

server_settings[u"priority"],

1790

server_settings["priority"],

1288

1791

use_dbus=use_dbus)

1289

pidfilename = u"/var/run/mandos.pid"

1290

try:

1291

pidfile = open(pidfilename, u"w")

1292

except IOError:

1293

logger.error(u"Could not open file %r", pidfilename)

1792

if not debug:

1793

pidfilename = "/var/run/mandos.pid"

1794

try:

1795

pidfile = open(pidfilename, "w")

1796

except IOError:

1797

logger.error("Could not open file %r", pidfilename)

1294

1798

1295

1799

try:

1296

uid = pwd.getpwnam(u"_mandos").pw_uid

1297

gid = pwd.getpwnam(u"_mandos").pw_gid

1800

uid = pwd.getpwnam("_mandos").pw_uid

1801

gid = pwd.getpwnam("_mandos").pw_gid

1298

1802

except KeyError:

1299

1803

try:

1300

uid = pwd.getpwnam(u"mandos").pw_uid

1301

gid = pwd.getpwnam(u"mandos").pw_gid

1804

uid = pwd.getpwnam("mandos").pw_uid

1805

gid = pwd.getpwnam("mandos").pw_gid

1302

1806

except KeyError:

1303

1807

try:

1304

uid = pwd.getpwnam(u"nobody").pw_uid

1305

gid = pwd.getpwnam(u"nobody").pw_gid

1808

uid = pwd.getpwnam("nobody").pw_uid

1809

gid = pwd.getpwnam("nobody").pw_gid

1306

1810

except KeyError:

1307

1811

uid = 65534

1308

1812

gid = 65534

1313

1817

if error[0] != errno.EPERM:

1314

1818

raise error

1315

1819

1316

# Enable all possible GnuTLS debugging

1820

if not debug and not debuglevel:

1821

syslogger.setLevel(logging.WARNING)

1822

console.setLevel(logging.WARNING)

1823

if debuglevel:

1824

level = getattr(logging, debuglevel.upper())

1825

syslogger.setLevel(level)

1826

console.setLevel(level)

1827

1317

1828

if debug:

1829

# Enable all possible GnuTLS debugging

1830

1318

1831

# "Use a log level over 10 to enable all debugging options."

1319

1832

# - GnuTLS manual

1320

1833

gnutls.library.functions.gnutls_global_set_log_level(11)

1321

1834

1322

1835

@gnutls.library.types.gnutls_log_func

1323

1836

def debug_gnutls(level, string):

1324

logger.debug(u"GnuTLS: %s", string[:-1])

1837

logger.debug("GnuTLS: %s", string[:-1])

1325

1838

1326

1839

(gnutls.library.functions

1327

1840

.gnutls_global_set_log_function(debug_gnutls))

1841

1842

# Redirect stdin so all checkers get /dev/null

1843

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1844

os.dup2(null, sys.stdin.fileno())

1845

if null > 2:

1846

os.close(null)

1847

else:

1848

# No console logging

1849

logger.removeHandler(console)

1850

1851

# Need to fork before connecting to D-Bus

1852

if not debug:

1853

# Close all input and output, do double fork, etc.

1854

daemon()

1328

1855

1329

1856

global main_loop

1330

1857

# From the Avahi example code

1333

1860

bus = dbus.SystemBus()

1334

1861

# End of Avahi example code

1335

1862

if use_dbus:

1336

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1863

try:

1864

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1865

bus, do_not_queue=True)

1866

except dbus.exceptions.NameExistsException, e:

1867

logger.error(unicode(e) + ", disabling D-Bus")

1868

use_dbus = False

1869

server_settings["use_dbus"] = False

1870

tcp_server.use_dbus = False

1337

1871

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1338

service = AvahiService(name = server_settings[u"servicename"],

1339

servicetype = u"_mandos._tcp",

1872

service = AvahiService(name = server_settings["servicename"],

1873

servicetype = "_mandos._tcp",

1340

1874

protocol = protocol, bus = bus)

1341

1875

if server_settings["interface"]:

1342

1876

service.interface = (if_nametoindex

1343

(str(server_settings[u"interface"])))

1877

(str(server_settings["interface"])))

1878

1879

global multiprocessing_manager

1880

multiprocessing_manager = multiprocessing.Manager()

1344

1881

1345

1882

client_class = Client

1346

1883

if use_dbus:

1347

1884

client_class = functools.partial(ClientDBus, bus = bus)

1348

clients.update(set(

1885

def client_config_items(config, section):

1886

special_settings = {

1887

"approved_by_default":

1888

lambda: config.getboolean(section,

1889

"approved_by_default"),

1890

}

1891

for name, value in config.items(section):

1892

try:

1893

yield (name, special_settings[name]())

1894

except KeyError:

1895

yield (name, value)

1896

1897

tcp_server.clients.update(set(

1349

1898

client_class(name = section,

1350

config= dict(client_config.items(section)))

1899

config= dict(client_config_items(

1900

client_config, section)))

1351

1901

for section in client_config.sections()))

1352

if not clients:

1353

logger.warning(u"No clients defined")

1354

1355

if debug:

1356

# Redirect stdin so all checkers get /dev/null

1357

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1358

os.dup2(null, sys.stdin.fileno())

1359

if null > 2:

1360

os.close(null)

1361

else:

1362

# No console logging

1363

logger.removeHandler(console)

1364

# Close all input and output, do double fork, etc.

1365

daemon()

1366

1367

try:

1368

with closing(pidfile):

1369

pid = os.getpid()

1370

pidfile.write(str(pid) + "\n")

1371

del pidfile

1372

except IOError:

1373

logger.error(u"Could not write to file %r with PID %d",

1374

pidfilename, pid)

1375

except NameError:

1376

# "pidfile" was never created

1377

pass

1378

del pidfilename

1379

1380

def cleanup():

1381

"Cleanup function; run on exit"

1382

service.cleanup()

1902

if not tcp_server.clients:

1903

logger.warning("No clients defined")

1383

1904

1384

while clients:

1385

client = clients.pop()

1386

client.disable_hook = None

1387

client.disable()

1388

1389

atexit.register(cleanup)

1390

1391

1905

if not debug:

1906

try:

1907

with pidfile:

1908

pid = os.getpid()

1909

pidfile.write(str(pid) + "\n".encode("utf-8"))

1910

del pidfile

1911

except IOError:

1912

logger.error("Could not write to file %r with PID %d",

1913

pidfilename, pid)

1914

except NameError:

1915

# "pidfile" was never created

1916

pass

1917

del pidfilename

1918

1392

1919

signal.signal(signal.SIGINT, signal.SIG_IGN)

1920

1393

1921

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1394

1922

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1395

1923

1397

1925

class MandosDBusService(dbus.service.Object):

1398

1926

"""A D-Bus proxy object"""

1399

1927

def __init__(self):

1400

dbus.service.Object.__init__(self, bus, u"/")

1401

_interface = u"se.bsnet.fukt.Mandos"

1402

1403

@dbus.service.signal(_interface, signature=u"oa{sv}")

1404

def ClientAdded(self, objpath, properties):

1405

"D-Bus signal"

1406

pass

1407

1408

@dbus.service.signal(_interface, signature=u"s")

1409

def ClientNotFound(self, fingerprint):

1410

"D-Bus signal"

1411

pass

1412

1413

@dbus.service.signal(_interface, signature=u"os")

1928

dbus.service.Object.__init__(self, bus, "/")

1929

_interface = "se.bsnet.fukt.Mandos"

1930

1931

@dbus.service.signal(_interface, signature="o")

1932

def ClientAdded(self, objpath):

1933

"D-Bus signal"

1934

pass

1935

1936

@dbus.service.signal(_interface, signature="ss")

1937

def ClientNotFound(self, fingerprint, address):

1938

"D-Bus signal"

1939

pass

1940

1941

@dbus.service.signal(_interface, signature="os")

1414

1942

def ClientRemoved(self, objpath, name):

1415

1943

"D-Bus signal"

1416

1944

pass

1417

1945

1418

@dbus.service.method(_interface, out_signature=u"ao")

1946

@dbus.service.method(_interface, out_signature="ao")

1419

1947

def GetAllClients(self):

1420

1948

"D-Bus method"

1421

return dbus.Array(c.dbus_object_path for c in clients)

1949

return dbus.Array(c.dbus_object_path

1950

for c in tcp_server.clients)

1422

1951

1423

1952

@dbus.service.method(_interface,

1424

out_signature=u"a{oa{sv}}")

1953

out_signature="a{oa{sv}}")

1425

1954

def GetAllClientsWithProperties(self):

1426

1955

"D-Bus method"

1427

1956

return dbus.Dictionary(

1428

((c.dbus_object_path, c.GetAllProperties())

1429

for c in clients),

1430

signature=u"oa{sv}")

1957

((c.dbus_object_path, c.GetAll(""))

1958

for c in tcp_server.clients),

1959

signature="oa{sv}")

1431

1960

1432

@dbus.service.method(_interface, in_signature=u"o")

1961

@dbus.service.method(_interface, in_signature="o")

1433

1962

def RemoveClient(self, object_path):

1434

1963

"D-Bus method"

1435

for c in clients:

1964

for c in tcp_server.clients:

1436

1965

if c.dbus_object_path == object_path:

1437

clients.remove(c)

1966

tcp_server.clients.remove(c)

1438

1967

c.remove_from_connection()

1439

1968

# Don't signal anything except ClientRemoved

1440

c.disable(signal=False)

1969

c.disable(quiet=True)

1441

1970

# Emit D-Bus signal

1442

1971

self.ClientRemoved(object_path, c.name)

1443

1972

return

1444

raise KeyError

1973

raise KeyError(object_path)

1445

1974

1446

1975

del _interface

1447

1976

1448

1977

mandos_dbus_service = MandosDBusService()

1449

1978

1450

for client in clients:

1979

def cleanup():

1980

"Cleanup function; run on exit"

1981

service.cleanup()

1982

1983

while tcp_server.clients:

1984

client = tcp_server.clients.pop()

1985

if use_dbus:

1986

client.remove_from_connection()

1987

client.disable_hook = None

1988

# Don't signal anything except ClientRemoved

1989

client.disable(quiet=True)

1990

if use_dbus:

1991

# Emit D-Bus signal

1992

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1993

client.name)

1994

1995

atexit.register(cleanup)

1996

1997

for client in tcp_server.clients:

1451

1998

if use_dbus:

1452

1999

# Emit D-Bus signal

1453

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1454

client.GetAllProperties())

2000

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1455

2001

client.enable()

1456

2002

1457

2003

tcp_server.enable()

1460

2006

# Find out what port we got

1461

2007

service.port = tcp_server.socket.getsockname()[1]

1462

2008

if use_ipv6:

1463

logger.info(u"Now listening on address %r, port %d,"

2009

logger.info("Now listening on address %r, port %d,"

1464

2010

" flowinfo %d, scope_id %d"

1465

2011

% tcp_server.socket.getsockname())

1466

2012

else: # IPv4

1467

logger.info(u"Now listening on address %r, port %d"

2013

logger.info("Now listening on address %r, port %d"

1468

2014

% tcp_server.socket.getsockname())

1469

2015

1470

2016

#service.interface = tcp_server.socket.getsockname()[3]

1474

2020

try:

1475

2021

service.activate()

1476

2022

except dbus.exceptions.DBusException, error:

1477

logger.critical(u"DBusException: %s", error)

2023

logger.critical("DBusException: %s", error)

2024

cleanup()

1478

2025

sys.exit(1)

1479

2026

# End of Avahi example code

1480

2027

1483

2030

(tcp_server.handle_request

1484

2031

(*args[2:], **kwargs) or True))

1485

2032

1486

logger.debug(u"Starting main loop")

2033

logger.debug("Starting main loop")

1487

2034

main_loop.run()

1488

2035

except AvahiError, error:

1489

logger.critical(u"AvahiError: %s", error)

2036

logger.critical("AvahiError: %s", error)

2037

cleanup()

1490

2038

sys.exit(1)

1491

2039

except KeyboardInterrupt:

1492

2040

if debug:

1493

print >> sys.stderr

1494

logger.debug(u"Server received KeyboardInterrupt")

1495

logger.debug(u"Server exiting")

2041

print("", file=sys.stderr)

2042

logger.debug("Server received KeyboardInterrupt")

2043

logger.debug("Server exiting")

2044

# Must run before the D-Bus bus name gets deregistered

2045

cleanup()

1496

2046

1497

2047

if __name__ == '__main__':

1498

2048

main()