130
104
max_renames: integer; maximum number of renames
131
105
rename_count: integer; counter so we only rename after collisions
132
106
a sensible number of times
133
group: D-Bus Entry Group
135
bus: dbus.SystemBus()
137
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
140
protocol = avahi.PROTO_UNSPEC, bus = None):
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
141
111
self.interface = interface
143
self.type = servicetype
145
self.TXT = TXT if TXT is not None else []
146
119
self.domain = domain
148
121
self.rename_count = 0
149
122
self.max_renames = max_renames
150
self.protocol = protocol
151
self.group = None # our entry group
154
self.entry_group_state_changed_match = None
155
123
def rename(self):
156
124
"""Derived from the Avahi example code"""
157
125
if self.rename_count >= self.max_renames:
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
161
128
raise AvahiServiceError("Too many renames")
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
165
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
129
self.name = server.GetAlternativeServiceName(self.name)
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
132
('Mandos (%s): %%(levelname)s:'
133
' %%(message)s' % self.name))
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
176
136
self.rename_count += 1
177
137
def remove(self):
178
138
"""Derived from the Avahi example code"""
179
if self.group is not None:
182
except (dbus.exceptions.UnknownMethodException,
183
dbus.exceptions.DBusException) as e:
186
if self.entry_group_state_changed_match is not None:
187
self.entry_group_state_changed_match.remove()
188
self.entry_group_state_changed_match = None
139
if group is not None:
190
142
"""Derived from the Avahi example code"""
192
self.group = dbus.Interface(
193
self.bus.get_object(avahi.DBUS_NAME,
194
self.server.EntryGroupNew(),
195
follow_name_owner_changes=True),
196
avahi.DBUS_INTERFACE_ENTRY_GROUP)
197
self.entry_group_state_changed_match = (
198
self.group.connect_to_signal(
199
'StateChanged', self .entry_group_state_changed))
200
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
201
self.name, self.type)
202
self.group.AddService(
205
dbus.UInt32(0), # flags
206
self.name, self.type,
207
self.domain, self.host,
208
dbus.UInt16(self.port),
209
avahi.string_array_to_txt_array(self.TXT))
211
def entry_group_state_changed(self, state, error):
212
"""Derived from the Avahi example code"""
213
logger.debug("Avahi entry group state change: %i", state)
215
if state == avahi.ENTRY_GROUP_ESTABLISHED:
216
logger.debug("Zeroconf service established.")
217
elif state == avahi.ENTRY_GROUP_COLLISION:
218
logger.info("Zeroconf service name collision.")
220
elif state == avahi.ENTRY_GROUP_FAILURE:
221
logger.critical("Avahi: Error in group state changed %s",
223
raise AvahiGroupError("State changed: %s"
226
"""Derived from the Avahi example code"""
228
def server_state_changed(self, state, error=None):
229
"""Derived from the Avahi example code"""
230
logger.debug("Avahi server state change: %i", state)
231
bad_states = { avahi.SERVER_INVALID:
232
"Zeroconf server invalid",
233
avahi.SERVER_REGISTERING: None,
234
avahi.SERVER_COLLISION:
235
"Zeroconf server name collision",
236
avahi.SERVER_FAILURE:
237
"Zeroconf server failure" }
238
if state in bad_states:
239
if bad_states[state]:
240
logger.error(bad_states[state])
242
elif state == avahi.SERVER_RUNNING:
245
logger.debug("Unknown state: %r", state)
247
"""Derived from the Avahi example code"""
248
if self.server is None:
249
self.server = dbus.Interface(
250
self.bus.get_object(avahi.DBUS_NAME,
251
avahi.DBUS_PATH_SERVER,
252
follow_name_owner_changes=True),
253
avahi.DBUS_INTERFACE_SERVER)
254
self.server.connect_to_signal("StateChanged",
255
self.server_state_changed)
256
self.server_state_changed(self.server.GetState())
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
147
server.EntryGroupNew()),
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
149
group.connect_to_signal('StateChanged',
150
entry_group_state_changed)
151
logger.debug(u"Adding service '%s' of type '%s' ...",
152
service.name, service.type)
154
self.interface, # interface
155
avahi.PROTO_INET6, # protocol
156
dbus.UInt32(0), # flags
157
self.name, self.type,
158
self.domain, self.host,
159
dbus.UInt16(self.port),
160
avahi.string_array_to_txt_array(self.TXT))
163
# From the Avahi example code:
164
group = None # our entry group
165
# End of Avahi example code
259
168
class Client(object):
260
169
"""A representation of a client host served by this server.
263
_approved: bool(); 'None' if not yet approved/disapproved
264
approval_delay: datetime.timedelta(); Time to wait for approval
265
approval_duration: datetime.timedelta(); Duration of one approval
266
checker: subprocess.Popen(); a running checker process used
267
to see if the client lives.
268
'None' if no process is running.
269
checker_callback_tag: a gobject event source tag, or None
270
checker_command: string; External command which is run to check
271
if client lives. %() expansions are done at
171
name: string; from the config file, used in log messages
172
fingerprint: string (40 or 32 hexadecimal digits); used to
173
uniquely identify the client
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
185
checker_initiator_tag: a gobject event source tag, or None
186
stop_initiator_tag: - '' -
187
checker_callback_tag: - '' -
188
checker_command: string; External command which is run to check if
189
client lives. %() expansions are done at
272
190
runtime with vars(self) as dict, so that for
273
191
instance %(name)s can be used in the command.
274
checker_initiator_tag: a gobject event source tag, or None
275
created: datetime.datetime(); (UTC) object creation
276
current_checker_command: string; current running checker_command
277
disable_hook: If set, called by disable() as disable_hook(self)
278
disable_initiator_tag: a gobject event source tag, or None
280
fingerprint: string (40 or 32 hexadecimal digits); used to
281
uniquely identify the client
282
host: string; available for use by the checker command
283
interval: datetime.timedelta(); How often to start a new checker
284
last_approval_request: datetime.datetime(); (UTC) or None
285
last_checked_ok: datetime.datetime(); (UTC) or None
286
last_enabled: datetime.datetime(); (UTC)
287
name: string; from the config file, used in log messages and
289
secret: bytestring; sent verbatim (over TLS) to client
290
timeout: datetime.timedelta(); How long from last_checked_ok
291
until this client is disabled
292
runtime_expansions: Allowed attributes for runtime expansion.
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
295
runtime_expansions = ("approval_delay", "approval_duration",
296
"created", "enabled", "fingerprint",
297
"host", "interval", "last_checked_ok",
298
"last_enabled", "name", "timeout")
301
def _timedelta_to_milliseconds(td):
302
"Convert a datetime.timedelta() to milliseconds"
303
return ((td.days * 24 * 60 * 60 * 1000)
304
+ (td.seconds * 1000)
305
+ (td.microseconds // 1000))
307
def timeout_milliseconds(self):
308
"Return the 'timeout' attribute in milliseconds"
309
return self._timedelta_to_milliseconds(self.timeout)
311
def interval_milliseconds(self):
312
"Return the 'interval' attribute in milliseconds"
313
return self._timedelta_to_milliseconds(self.interval)
315
def approval_delay_milliseconds(self):
316
return self._timedelta_to_milliseconds(self.approval_delay)
318
def __init__(self, name = None, disable_hook=None, config=None):
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
206
timeout = property(lambda self: self._timeout,
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
216
+ (self.interval.microseconds
218
interval = property(lambda self: self._interval,
221
def __init__(self, name = None, stop_hook=None, config={}):
319
222
"""Note: the 'checker' key in 'config' sets the
320
223
'checker_command' attribute and *not* the 'checker'
325
logger.debug("Creating client %r", self.name)
226
logger.debug(u"Creating client %r", self.name)
326
227
# Uppercase and remove spaces from fingerprint for later
327
228
# comparison purposes with return value from the fingerprint()
329
self.fingerprint = (config["fingerprint"].upper()
331
logger.debug(" Fingerprint: %s", self.fingerprint)
230
self.fingerprint = config["fingerprint"].upper()\
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
332
233
if "secret" in config:
333
self.secret = config["secret"].decode("base64")
234
self.secret = config["secret"].decode(u"base64")
334
235
elif "secfile" in config:
335
with open(os.path.expanduser(os.path.expandvars
336
(config["secfile"])),
338
self.secret = secfile.read()
236
sf = open(config["secfile"])
237
self.secret = sf.read()
340
raise TypeError("No secret or secfile for client %s"
240
raise TypeError(u"No secret or secfile for client %s"
342
242
self.host = config.get("host", "")
343
self.created = datetime.datetime.utcnow()
345
self.last_approval_request = None
346
self.last_enabled = None
243
self.created = datetime.datetime.now()
347
244
self.last_checked_ok = None
348
245
self.timeout = string_to_delta(config["timeout"])
349
246
self.interval = string_to_delta(config["interval"])
350
self.disable_hook = disable_hook
247
self.stop_hook = stop_hook
351
248
self.checker = None
352
249
self.checker_initiator_tag = None
353
self.disable_initiator_tag = None
250
self.stop_initiator_tag = None
354
251
self.checker_callback_tag = None
355
self.checker_command = config["checker"]
356
self.current_checker_command = None
357
self.last_connect = None
358
self._approved = None
359
self.approved_by_default = config.get("approved_by_default",
361
self.approvals_pending = 0
362
self.approval_delay = string_to_delta(
363
config["approval_delay"])
364
self.approval_duration = string_to_delta(
365
config["approval_duration"])
366
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
368
def send_changedstate(self):
369
self.changedstate.acquire()
370
self.changedstate.notify_all()
371
self.changedstate.release()
252
self.check_command = config["checker"]
374
254
"""Start this client's checker and timeout hooks"""
375
if getattr(self, "enabled", False):
378
self.send_changedstate()
379
self.last_enabled = datetime.datetime.utcnow()
380
255
# Schedule a new checker to be started an 'interval' from now,
381
256
# and every interval from then on.
382
self.checker_initiator_tag = (gobject.timeout_add
383
(self.interval_milliseconds(),
385
# Schedule a disable() when 'timeout' has passed
386
self.disable_initiator_tag = (gobject.timeout_add
387
(self.timeout_milliseconds(),
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
390
260
# Also start a new checker *right now*.
391
261
self.start_checker()
393
def disable(self, quiet=True):
394
"""Disable this client."""
395
if not getattr(self, "enabled", False):
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
398
self.send_changedstate()
400
logger.info("Disabling client %s", self.name)
401
if getattr(self, "disable_initiator_tag", False):
402
gobject.source_remove(self.disable_initiator_tag)
403
self.disable_initiator_tag = None
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
404
279
if getattr(self, "checker_initiator_tag", False):
405
280
gobject.source_remove(self.checker_initiator_tag)
406
281
self.checker_initiator_tag = None
407
282
self.stop_checker()
408
if self.disable_hook:
409
self.disable_hook(self)
411
285
# Do not run this again if called by a gobject.timeout_add
414
287
def __del__(self):
415
self.disable_hook = None
418
def checker_callback(self, pid, condition, command):
288
self.stop_hook = None
290
def checker_callback(self, pid, condition):
419
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
420
293
self.checker_callback_tag = None
421
294
self.checker = None
422
if os.WIFEXITED(condition):
423
exitstatus = os.WEXITSTATUS(condition)
425
logger.info("Checker for %(name)s succeeded",
429
logger.info("Checker for %(name)s failed",
432
logger.warning("Checker for %(name)s crashed?",
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
304
elif not os.WIFEXITED(condition):
305
logger.warning(u"Checker for %(name)s crashed?",
435
def checked_ok(self):
436
"""Bump up the timeout for this client.
438
This should only be called when the client has been seen,
441
self.last_checked_ok = datetime.datetime.utcnow()
442
gobject.source_remove(self.disable_initiator_tag)
443
self.disable_initiator_tag = (gobject.timeout_add
444
(self.timeout_milliseconds(),
447
def need_approval(self):
448
self.last_approval_request = datetime.datetime.utcnow()
308
logger.info(u"Checker for %(name)s failed",
450
310
def start_checker(self):
451
311
"""Start a new checker subprocess if one is not running.
453
312
If a checker already exists, leave it running and do
455
314
# The reason for not killing a running checker is that if we
529
355
self.checker_callback_tag = None
530
356
if getattr(self, "checker", None) is None:
532
logger.debug("Stopping checker for %(name)s", vars(self))
358
logger.debug(u"Stopping checker for %(name)s", vars(self))
534
360
os.kill(self.checker.pid, signal.SIGTERM)
536
362
#if self.checker.poll() is None:
537
363
# os.kill(self.checker.pid, signal.SIGKILL)
538
except OSError as error:
364
except OSError, error:
539
365
if error.errno != errno.ESRCH: # No such process
541
367
self.checker = None
543
def dbus_service_property(dbus_interface, signature="v",
544
access="readwrite", byte_arrays=False):
545
"""Decorators for marking methods of a DBusObjectWithProperties to
546
become properties on the D-Bus.
548
The decorated method will be called with no arguments by "Get"
549
and with one argument by "Set".
551
The parameters, where they are supported, are the same as
552
dbus.service.method, except there is only "signature", since the
553
type from Get() and the type sent to Set() is the same.
555
# Encoding deeply encoded byte arrays is not supported yet by the
556
# "Set" method, so we fail early here:
557
if byte_arrays and signature != "ay":
558
raise ValueError("Byte arrays not supported for non-'ay'"
559
" signature %r" % signature)
561
func._dbus_is_property = True
562
func._dbus_interface = dbus_interface
563
func._dbus_signature = signature
564
func._dbus_access = access
565
func._dbus_name = func.__name__
566
if func._dbus_name.endswith("_dbus_property"):
567
func._dbus_name = func._dbus_name[:-14]
568
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
573
class DBusPropertyException(dbus.exceptions.DBusException):
574
"""A base class for D-Bus property-related exceptions
576
def __unicode__(self):
577
return unicode(str(self))
580
class DBusPropertyAccessException(DBusPropertyException):
581
"""A property's access permissions disallows an operation.
586
class DBusPropertyNotFound(DBusPropertyException):
587
"""An attempt was made to access a non-existing property.
592
class DBusObjectWithProperties(dbus.service.Object):
593
"""A D-Bus object with properties.
595
Classes inheriting from this can use the dbus_service_property
596
decorator to expose methods as D-Bus properties. It exposes the
597
standard Get(), Set(), and GetAll() methods on the D-Bus.
601
def _is_dbus_property(obj):
602
return getattr(obj, "_dbus_is_property", False)
604
def _get_all_dbus_properties(self):
605
"""Returns a generator of (name, attribute) pairs
607
return ((prop._dbus_name, prop)
609
inspect.getmembers(self, self._is_dbus_property))
611
def _get_dbus_property(self, interface_name, property_name):
612
"""Returns a bound method if one exists which is a D-Bus
613
property with the specified name and interface.
615
for name in (property_name,
616
property_name + "_dbus_property"):
617
prop = getattr(self, name, None)
619
or not self._is_dbus_property(prop)
620
or prop._dbus_name != property_name
621
or (interface_name and prop._dbus_interface
622
and interface_name != prop._dbus_interface)):
626
raise DBusPropertyNotFound(self.dbus_object_path + ":"
627
+ interface_name + "."
630
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
632
def Get(self, interface_name, property_name):
633
"""Standard D-Bus property Get() method, see D-Bus standard.
635
prop = self._get_dbus_property(interface_name, property_name)
636
if prop._dbus_access == "write":
637
raise DBusPropertyAccessException(property_name)
639
if not hasattr(value, "variant_level"):
641
return type(value)(value, variant_level=value.variant_level+1)
643
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
644
def Set(self, interface_name, property_name, value):
645
"""Standard D-Bus property Set() method, see D-Bus standard.
647
prop = self._get_dbus_property(interface_name, property_name)
648
if prop._dbus_access == "read":
649
raise DBusPropertyAccessException(property_name)
650
if prop._dbus_get_args_options["byte_arrays"]:
651
# The byte_arrays option is not supported yet on
652
# signatures other than "ay".
653
if prop._dbus_signature != "ay":
655
value = dbus.ByteArray(''.join(unichr(byte)
659
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
660
out_signature="a{sv}")
661
def GetAll(self, interface_name):
662
"""Standard D-Bus property GetAll() method, see D-Bus
665
Note: Will not include properties with access="write".
668
for name, prop in self._get_all_dbus_properties():
670
and interface_name != prop._dbus_interface):
671
# Interface non-empty but did not match
673
# Ignore write-only properties
674
if prop._dbus_access == "write":
677
if not hasattr(value, "variant_level"):
680
all[name] = type(value)(value, variant_level=
681
value.variant_level+1)
682
return dbus.Dictionary(all, signature="sv")
684
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
686
path_keyword='object_path',
687
connection_keyword='connection')
688
def Introspect(self, object_path, connection):
689
"""Standard D-Bus method, overloaded to insert property tags.
691
xmlstring = dbus.service.Object.Introspect(self, object_path,
694
document = xml.dom.minidom.parseString(xmlstring)
695
def make_tag(document, name, prop):
696
e = document.createElement("property")
697
e.setAttribute("name", name)
698
e.setAttribute("type", prop._dbus_signature)
699
e.setAttribute("access", prop._dbus_access)
701
for if_tag in document.getElementsByTagName("interface"):
702
for tag in (make_tag(document, name, prop)
704
in self._get_all_dbus_properties()
705
if prop._dbus_interface
706
== if_tag.getAttribute("name")):
707
if_tag.appendChild(tag)
708
# Add the names to the return values for the
709
# "org.freedesktop.DBus.Properties" methods
710
if (if_tag.getAttribute("name")
711
== "org.freedesktop.DBus.Properties"):
712
for cn in if_tag.getElementsByTagName("method"):
713
if cn.getAttribute("name") == "Get":
714
for arg in cn.getElementsByTagName("arg"):
715
if (arg.getAttribute("direction")
717
arg.setAttribute("name", "value")
718
elif cn.getAttribute("name") == "GetAll":
719
for arg in cn.getElementsByTagName("arg"):
720
if (arg.getAttribute("direction")
722
arg.setAttribute("name", "props")
723
xmlstring = document.toxml("utf-8")
725
except (AttributeError, xml.dom.DOMException,
726
xml.parsers.expat.ExpatError) as error:
727
logger.error("Failed to override Introspection method",
732
class ClientDBus(Client, DBusObjectWithProperties):
733
"""A Client class using D-Bus
736
dbus_object_path: dbus.ObjectPath
737
bus: dbus.SystemBus()
740
runtime_expansions = (Client.runtime_expansions
741
+ ("dbus_object_path",))
743
# dbus.service.Object doesn't use super(), so we can't either.
745
def __init__(self, bus = None, *args, **kwargs):
746
self._approvals_pending = 0
748
Client.__init__(self, *args, **kwargs)
749
# Only now, when this client is initialized, can it show up on
751
client_object_name = unicode(self.name).translate(
754
self.dbus_object_path = (dbus.ObjectPath
755
("/clients/" + client_object_name))
756
DBusObjectWithProperties.__init__(self, self.bus,
757
self.dbus_object_path)
759
def _get_approvals_pending(self):
760
return self._approvals_pending
761
def _set_approvals_pending(self, value):
762
old_value = self._approvals_pending
763
self._approvals_pending = value
765
if (hasattr(self, "dbus_object_path")
766
and bval is not bool(old_value)):
767
dbus_bool = dbus.Boolean(bval, variant_level=1)
768
self.PropertyChanged(dbus.String("ApprovalPending"),
771
approvals_pending = property(_get_approvals_pending,
772
_set_approvals_pending)
773
del _get_approvals_pending, _set_approvals_pending
776
def _datetime_to_dbus(dt, variant_level=0):
777
"""Convert a UTC datetime.datetime() to a D-Bus type."""
778
return dbus.String(dt.isoformat(),
779
variant_level=variant_level)
782
oldstate = getattr(self, "enabled", False)
783
r = Client.enable(self)
784
if oldstate != self.enabled:
786
self.PropertyChanged(dbus.String("Enabled"),
787
dbus.Boolean(True, variant_level=1))
788
self.PropertyChanged(
789
dbus.String("LastEnabled"),
790
self._datetime_to_dbus(self.last_enabled,
794
def disable(self, quiet = False):
795
oldstate = getattr(self, "enabled", False)
796
r = Client.disable(self, quiet=quiet)
797
if not quiet and oldstate != self.enabled:
799
self.PropertyChanged(dbus.String("Enabled"),
800
dbus.Boolean(False, variant_level=1))
803
def __del__(self, *args, **kwargs):
805
self.remove_from_connection()
808
if hasattr(DBusObjectWithProperties, "__del__"):
809
DBusObjectWithProperties.__del__(self, *args, **kwargs)
810
Client.__del__(self, *args, **kwargs)
812
def checker_callback(self, pid, condition, command,
814
self.checker_callback_tag = None
817
self.PropertyChanged(dbus.String("CheckerRunning"),
818
dbus.Boolean(False, variant_level=1))
819
if os.WIFEXITED(condition):
820
exitstatus = os.WEXITSTATUS(condition)
822
self.CheckerCompleted(dbus.Int16(exitstatus),
823
dbus.Int64(condition),
824
dbus.String(command))
827
self.CheckerCompleted(dbus.Int16(-1),
828
dbus.Int64(condition),
829
dbus.String(command))
831
return Client.checker_callback(self, pid, condition, command,
834
def checked_ok(self, *args, **kwargs):
835
Client.checked_ok(self, *args, **kwargs)
837
self.PropertyChanged(
838
dbus.String("LastCheckedOK"),
839
(self._datetime_to_dbus(self.last_checked_ok,
842
def need_approval(self, *args, **kwargs):
843
r = Client.need_approval(self, *args, **kwargs)
845
self.PropertyChanged(
846
dbus.String("LastApprovalRequest"),
847
(self._datetime_to_dbus(self.last_approval_request,
851
def start_checker(self, *args, **kwargs):
852
old_checker = self.checker
853
if self.checker is not None:
854
old_checker_pid = self.checker.pid
856
old_checker_pid = None
857
r = Client.start_checker(self, *args, **kwargs)
858
# Only if new checker process was started
859
if (self.checker is not None
860
and old_checker_pid != self.checker.pid):
862
self.CheckerStarted(self.current_checker_command)
863
self.PropertyChanged(
864
dbus.String("CheckerRunning"),
865
dbus.Boolean(True, variant_level=1))
868
def stop_checker(self, *args, **kwargs):
869
old_checker = getattr(self, "checker", None)
870
r = Client.stop_checker(self, *args, **kwargs)
871
if (old_checker is not None
872
and getattr(self, "checker", None) is None):
873
self.PropertyChanged(dbus.String("CheckerRunning"),
874
dbus.Boolean(False, variant_level=1))
877
def _reset_approved(self):
878
self._approved = None
881
def approve(self, value=True):
882
self.send_changedstate()
883
self._approved = value
884
gobject.timeout_add(self._timedelta_to_milliseconds
885
(self.approval_duration),
886
self._reset_approved)
889
## D-Bus methods, signals & properties
890
_interface = "se.bsnet.fukt.Mandos.Client"
894
# CheckerCompleted - signal
895
@dbus.service.signal(_interface, signature="nxs")
896
def CheckerCompleted(self, exitcode, waitstatus, command):
900
# CheckerStarted - signal
901
@dbus.service.signal(_interface, signature="s")
902
def CheckerStarted(self, command):
906
# PropertyChanged - signal
907
@dbus.service.signal(_interface, signature="sv")
908
def PropertyChanged(self, property, value):
913
@dbus.service.signal(_interface)
916
Is sent after a successful transfer of secret from the Mandos
917
server to mandos-client
922
@dbus.service.signal(_interface, signature="s")
923
def Rejected(self, reason):
927
# NeedApproval - signal
928
@dbus.service.signal(_interface, signature="tb")
929
def NeedApproval(self, timeout, default):
931
return self.need_approval()
936
@dbus.service.method(_interface, in_signature="b")
937
def Approve(self, value):
941
@dbus.service.method(_interface)
946
@dbus.service.method(_interface)
951
# StartChecker - method
952
@dbus.service.method(_interface)
953
def StartChecker(self):
958
@dbus.service.method(_interface)
963
# StopChecker - method
964
@dbus.service.method(_interface)
965
def StopChecker(self):
970
# ApprovalPending - property
971
@dbus_service_property(_interface, signature="b", access="read")
972
def ApprovalPending_dbus_property(self):
973
return dbus.Boolean(bool(self.approvals_pending))
975
# ApprovedByDefault - property
976
@dbus_service_property(_interface, signature="b",
978
def ApprovedByDefault_dbus_property(self, value=None):
979
if value is None: # get
980
return dbus.Boolean(self.approved_by_default)
981
self.approved_by_default = bool(value)
983
self.PropertyChanged(dbus.String("ApprovedByDefault"),
984
dbus.Boolean(value, variant_level=1))
986
# ApprovalDelay - property
987
@dbus_service_property(_interface, signature="t",
989
def ApprovalDelay_dbus_property(self, value=None):
990
if value is None: # get
991
return dbus.UInt64(self.approval_delay_milliseconds())
992
self.approval_delay = datetime.timedelta(0, 0, 0, value)
994
self.PropertyChanged(dbus.String("ApprovalDelay"),
995
dbus.UInt64(value, variant_level=1))
997
# ApprovalDuration - property
998
@dbus_service_property(_interface, signature="t",
1000
def ApprovalDuration_dbus_property(self, value=None):
1001
if value is None: # get
1002
return dbus.UInt64(self._timedelta_to_milliseconds(
1003
self.approval_duration))
1004
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1006
self.PropertyChanged(dbus.String("ApprovalDuration"),
1007
dbus.UInt64(value, variant_level=1))
1010
@dbus_service_property(_interface, signature="s", access="read")
1011
def Name_dbus_property(self):
1012
return dbus.String(self.name)
1014
# Fingerprint - property
1015
@dbus_service_property(_interface, signature="s", access="read")
1016
def Fingerprint_dbus_property(self):
1017
return dbus.String(self.fingerprint)
1020
@dbus_service_property(_interface, signature="s",
1022
def Host_dbus_property(self, value=None):
1023
if value is None: # get
1024
return dbus.String(self.host)
1027
self.PropertyChanged(dbus.String("Host"),
1028
dbus.String(value, variant_level=1))
1030
# Created - property
1031
@dbus_service_property(_interface, signature="s", access="read")
1032
def Created_dbus_property(self):
1033
return dbus.String(self._datetime_to_dbus(self.created))
1035
# LastEnabled - property
1036
@dbus_service_property(_interface, signature="s", access="read")
1037
def LastEnabled_dbus_property(self):
1038
if self.last_enabled is None:
1039
return dbus.String("")
1040
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1042
# Enabled - property
1043
@dbus_service_property(_interface, signature="b",
1045
def Enabled_dbus_property(self, value=None):
1046
if value is None: # get
1047
return dbus.Boolean(self.enabled)
1053
# LastCheckedOK - property
1054
@dbus_service_property(_interface, signature="s",
1056
def LastCheckedOK_dbus_property(self, value=None):
1057
if value is not None:
368
def still_valid(self):
369
"""Has the timeout not yet passed for this client?"""
370
now = datetime.datetime.now()
1060
371
if self.last_checked_ok is None:
1061
return dbus.String("")
1062
return dbus.String(self._datetime_to_dbus(self
1065
# LastApprovalRequest - property
1066
@dbus_service_property(_interface, signature="s", access="read")
1067
def LastApprovalRequest_dbus_property(self):
1068
if self.last_approval_request is None:
1069
return dbus.String("")
1070
return dbus.String(self.
1071
_datetime_to_dbus(self
1072
.last_approval_request))
1074
# Timeout - property
1075
@dbus_service_property(_interface, signature="t",
1077
def Timeout_dbus_property(self, value=None):
1078
if value is None: # get
1079
return dbus.UInt64(self.timeout_milliseconds())
1080
self.timeout = datetime.timedelta(0, 0, 0, value)
1082
self.PropertyChanged(dbus.String("Timeout"),
1083
dbus.UInt64(value, variant_level=1))
1084
if getattr(self, "disable_initiator_tag", None) is None:
1086
# Reschedule timeout
1087
gobject.source_remove(self.disable_initiator_tag)
1088
self.disable_initiator_tag = None
1089
time_to_die = (self.
1090
_timedelta_to_milliseconds((self
1095
if time_to_die <= 0:
1096
# The timeout has passed
1099
self.disable_initiator_tag = (gobject.timeout_add
1100
(time_to_die, self.disable))
1102
# Interval - property
1103
@dbus_service_property(_interface, signature="t",
1105
def Interval_dbus_property(self, value=None):
1106
if value is None: # get
1107
return dbus.UInt64(self.interval_milliseconds())
1108
self.interval = datetime.timedelta(0, 0, 0, value)
1110
self.PropertyChanged(dbus.String("Interval"),
1111
dbus.UInt64(value, variant_level=1))
1112
if getattr(self, "checker_initiator_tag", None) is None:
1114
# Reschedule checker run
1115
gobject.source_remove(self.checker_initiator_tag)
1116
self.checker_initiator_tag = (gobject.timeout_add
1117
(value, self.start_checker))
1118
self.start_checker() # Start one now, too
1120
# Checker - property
1121
@dbus_service_property(_interface, signature="s",
1123
def Checker_dbus_property(self, value=None):
1124
if value is None: # get
1125
return dbus.String(self.checker_command)
1126
self.checker_command = value
1128
self.PropertyChanged(dbus.String("Checker"),
1129
dbus.String(self.checker_command,
1132
# CheckerRunning - property
1133
@dbus_service_property(_interface, signature="b",
1135
def CheckerRunning_dbus_property(self, value=None):
1136
if value is None: # get
1137
return dbus.Boolean(self.checker is not None)
1139
self.start_checker()
1143
# ObjectPath - property
1144
@dbus_service_property(_interface, signature="o", access="read")
1145
def ObjectPath_dbus_property(self):
1146
return self.dbus_object_path # is already a dbus.ObjectPath
1149
@dbus_service_property(_interface, signature="ay",
1150
access="write", byte_arrays=True)
1151
def Secret_dbus_property(self, value):
1152
self.secret = str(value)
1157
class ProxyClient(object):
1158
def __init__(self, child_pipe, fpr, address):
1159
self._pipe = child_pipe
1160
self._pipe.send(('init', fpr, address))
1161
if not self._pipe.recv():
1164
def __getattribute__(self, name):
1165
if(name == '_pipe'):
1166
return super(ProxyClient, self).__getattribute__(name)
1167
self._pipe.send(('getattr', name))
1168
data = self._pipe.recv()
1169
if data[0] == 'data':
1171
if data[0] == 'function':
1172
def func(*args, **kwargs):
1173
self._pipe.send(('funcall', name, args, kwargs))
1174
return self._pipe.recv()[1]
1177
def __setattr__(self, name, value):
1178
if(name == '_pipe'):
1179
return super(ProxyClient, self).__setattr__(name, value)
1180
self._pipe.send(('setattr', name, value))
1183
class ClientHandler(socketserver.BaseRequestHandler, object):
1184
"""A class to handle client connections.
1186
Instantiated once for each connection to handle it.
372
return now < (self.created + self.timeout)
374
return now < (self.last_checked_ok + self.timeout)
377
def peer_certificate(session):
378
"Return the peer's OpenPGP certificate as a bytestring"
379
# If not an OpenPGP certificate...
380
if gnutls.library.functions.gnutls_certificate_type_get\
381
(session._c_object) \
382
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
383
# ...do the normal thing
384
return session.peer_certificate
385
list_size = ctypes.c_uint()
386
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
387
(session._c_object, ctypes.byref(list_size))
388
if list_size.value == 0:
391
return ctypes.string_at(cert.data, cert.size)
394
def fingerprint(openpgp):
395
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
396
# New GnuTLS "datum" with the OpenPGP public key
397
datum = gnutls.library.types.gnutls_datum_t\
398
(ctypes.cast(ctypes.c_char_p(openpgp),
399
ctypes.POINTER(ctypes.c_ubyte)),
400
ctypes.c_uint(len(openpgp)))
401
# New empty GnuTLS certificate
402
crt = gnutls.library.types.gnutls_openpgp_crt_t()
403
gnutls.library.functions.gnutls_openpgp_crt_init\
405
# Import the OpenPGP public key into the certificate
406
gnutls.library.functions.gnutls_openpgp_crt_import\
407
(crt, ctypes.byref(datum),
408
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
409
# New buffer for the fingerprint
410
buffer = ctypes.create_string_buffer(20)
411
buffer_length = ctypes.c_size_t()
412
# Get the fingerprint from the certificate into the buffer
413
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
414
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
415
# Deinit the certificate
416
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
417
# Convert the buffer to a Python bytestring
418
fpr = ctypes.string_at(buffer, buffer_length.value)
419
# Convert the bytestring to hexadecimal notation
420
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
424
class tcp_handler(SocketServer.BaseRequestHandler, object):
425
"""A TCP request handler class.
426
Instantiated by IPv6_TCPServer for each request to handle it.
1187
427
Note: This will run in its own forked process."""
1189
429
def handle(self):
1190
with contextlib.closing(self.server.child_pipe) as child_pipe:
1191
logger.info("TCP connection from: %s",
1192
unicode(self.client_address))
1193
logger.debug("Pipe FD: %d",
1194
self.server.child_pipe.fileno())
1196
session = (gnutls.connection
1197
.ClientSession(self.request,
1199
.X509Credentials()))
1201
# Note: gnutls.connection.X509Credentials is really a
1202
# generic GnuTLS certificate credentials object so long as
1203
# no X.509 keys are added to it. Therefore, we can use it
1204
# here despite using OpenPGP certificates.
1206
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1207
# "+AES-256-CBC", "+SHA1",
1208
# "+COMP-NULL", "+CTYPE-OPENPGP",
1210
# Use a fallback default, since this MUST be set.
1211
priority = self.server.gnutls_priority
1212
if priority is None:
1214
(gnutls.library.functions
1215
.gnutls_priority_set_direct(session._c_object,
1218
# Start communication using the Mandos protocol
1219
# Get protocol number
1220
line = self.request.makefile().readline()
1221
logger.debug("Protocol version: %r", line)
1223
if int(line.strip().split()[0]) > 1:
1225
except (ValueError, IndexError, RuntimeError) as error:
1226
logger.error("Unknown protocol version: %s", error)
1229
# Start GnuTLS connection
1232
except gnutls.errors.GNUTLSError as error:
1233
logger.warning("Handshake failed: %s", error)
1234
# Do not run session.bye() here: the session is not
1235
# established. Just abandon the request.
1237
logger.debug("Handshake succeeded")
1239
approval_required = False
1242
fpr = self.fingerprint(self.peer_certificate
1245
gnutls.errors.GNUTLSError) as error:
1246
logger.warning("Bad certificate: %s", error)
1248
logger.debug("Fingerprint: %s", fpr)
1251
client = ProxyClient(child_pipe, fpr,
1252
self.client_address)
1256
if client.approval_delay:
1257
delay = client.approval_delay
1258
client.approvals_pending += 1
1259
approval_required = True
1262
if not client.enabled:
1263
logger.warning("Client %s is disabled",
1265
if self.server.use_dbus:
1267
client.Rejected("Disabled")
1270
if client._approved or not client.approval_delay:
1271
#We are approved or approval is disabled
1273
elif client._approved is None:
1274
logger.info("Client %s needs approval",
1276
if self.server.use_dbus:
1278
client.NeedApproval(
1279
client.approval_delay_milliseconds(),
1280
client.approved_by_default)
1282
logger.warning("Client %s was not approved",
1284
if self.server.use_dbus:
1286
client.Rejected("Denied")
1289
#wait until timeout or approved
1290
#x = float(client._timedelta_to_milliseconds(delay))
1291
time = datetime.datetime.now()
1292
client.changedstate.acquire()
1293
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1294
client.changedstate.release()
1295
time2 = datetime.datetime.now()
1296
if (time2 - time) >= delay:
1297
if not client.approved_by_default:
1298
logger.warning("Client %s timed out while"
1299
" waiting for approval",
1301
if self.server.use_dbus:
1303
client.Rejected("Approval timed out")
1308
delay -= time2 - time
1311
while sent_size < len(client.secret):
1313
sent = session.send(client.secret[sent_size:])
1314
except gnutls.errors.GNUTLSError as error:
1315
logger.warning("gnutls send failed")
1317
logger.debug("Sent: %d, remaining: %d",
1318
sent, len(client.secret)
1319
- (sent_size + sent))
1322
logger.info("Sending secret to %s", client.name)
1323
# bump the timeout as if seen
1325
if self.server.use_dbus:
1330
if approval_required:
1331
client.approvals_pending -= 1
1334
except gnutls.errors.GNUTLSError as error:
1335
logger.warning("GnuTLS bye failed")
1338
def peer_certificate(session):
1339
"Return the peer's OpenPGP certificate as a bytestring"
1340
# If not an OpenPGP certificate...
1341
if (gnutls.library.functions
1342
.gnutls_certificate_type_get(session._c_object)
1343
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1344
# ...do the normal thing
1345
return session.peer_certificate
1346
list_size = ctypes.c_uint(1)
1347
cert_list = (gnutls.library.functions
1348
.gnutls_certificate_get_peers
1349
(session._c_object, ctypes.byref(list_size)))
1350
if not bool(cert_list) and list_size.value != 0:
1351
raise gnutls.errors.GNUTLSError("error getting peer"
1353
if list_size.value == 0:
1356
return ctypes.string_at(cert.data, cert.size)
1359
def fingerprint(openpgp):
1360
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1361
# New GnuTLS "datum" with the OpenPGP public key
1362
datum = (gnutls.library.types
1363
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1366
ctypes.c_uint(len(openpgp))))
1367
# New empty GnuTLS certificate
1368
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1369
(gnutls.library.functions
1370
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1371
# Import the OpenPGP public key into the certificate
1372
(gnutls.library.functions
1373
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1374
gnutls.library.constants
1375
.GNUTLS_OPENPGP_FMT_RAW))
1376
# Verify the self signature in the key
1377
crtverify = ctypes.c_uint()
1378
(gnutls.library.functions
1379
.gnutls_openpgp_crt_verify_self(crt, 0,
1380
ctypes.byref(crtverify)))
1381
if crtverify.value != 0:
1382
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1383
raise (gnutls.errors.CertificateSecurityError
1385
# New buffer for the fingerprint
1386
buf = ctypes.create_string_buffer(20)
1387
buf_len = ctypes.c_size_t()
1388
# Get the fingerprint from the certificate into the buffer
1389
(gnutls.library.functions
1390
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1391
ctypes.byref(buf_len)))
1392
# Deinit the certificate
1393
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1394
# Convert the buffer to a Python bytestring
1395
fpr = ctypes.string_at(buf, buf_len.value)
1396
# Convert the bytestring to hexadecimal notation
1397
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1401
class MultiprocessingMixIn(object):
1402
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1403
def sub_process_main(self, request, address):
1405
self.finish_request(request, address)
1407
self.handle_error(request, address)
1408
self.close_request(request)
1410
def process_request(self, request, address):
1411
"""Start a new process to process the request."""
1412
multiprocessing.Process(target = self.sub_process_main,
1413
args = (request, address)).start()
1415
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1416
""" adds a pipe to the MixIn """
1417
def process_request(self, request, client_address):
1418
"""Overrides and wraps the original process_request().
1420
This function creates a new pipe in self.pipe
1422
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1424
super(MultiprocessingMixInWithPipe,
1425
self).process_request(request, client_address)
1426
self.child_pipe.close()
1427
self.add_pipe(parent_pipe)
1429
def add_pipe(self, parent_pipe):
1430
"""Dummy function; override as necessary"""
1431
raise NotImplementedError
1433
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1434
socketserver.TCPServer, object):
1435
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
430
logger.info(u"TCP connection from: %s",
431
unicode(self.client_address))
432
session = gnutls.connection.ClientSession\
433
(self.request, gnutls.connection.X509Credentials())
435
line = self.request.makefile().readline()
436
logger.debug(u"Protocol version: %r", line)
438
if int(line.strip().split()[0]) > 1:
440
except (ValueError, IndexError, RuntimeError), error:
441
logger.error(u"Unknown protocol version: %s", error)
444
# Note: gnutls.connection.X509Credentials is really a generic
445
# GnuTLS certificate credentials object so long as no X.509
446
# keys are added to it. Therefore, we can use it here despite
447
# using OpenPGP certificates.
449
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
450
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
452
priority = "NORMAL" # Fallback default, since this
454
if self.server.settings["priority"]:
455
priority = self.server.settings["priority"]
456
gnutls.library.functions.gnutls_priority_set_direct\
457
(session._c_object, priority, None);
461
except gnutls.errors.GNUTLSError, error:
462
logger.warning(u"Handshake failed: %s", error)
463
# Do not run session.bye() here: the session is not
464
# established. Just abandon the request.
467
fpr = fingerprint(peer_certificate(session))
468
except (TypeError, gnutls.errors.GNUTLSError), error:
469
logger.warning(u"Bad certificate: %s", error)
472
logger.debug(u"Fingerprint: %s", fpr)
474
for c in self.server.clients:
475
if c.fingerprint == fpr:
479
logger.warning(u"Client not found for fingerprint: %s",
483
# Have to check if client.still_valid(), since it is possible
484
# that the client timed out while establishing the GnuTLS
486
if not client.still_valid():
487
logger.warning(u"Client %(name)s is invalid",
492
while sent_size < len(client.secret):
493
sent = session.send(client.secret[sent_size:])
494
logger.debug(u"Sent: %d, remaining: %d",
495
sent, len(client.secret)
496
- (sent_size + sent))
501
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
502
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1438
enabled: Boolean; whether this server is activated yet
1439
interface: None or a network interface name (string)
1440
use_ipv6: Boolean; to use IPv6 or not
504
settings: Server settings
505
clients: Set() of Client objects
1442
def __init__(self, server_address, RequestHandlerClass,
1443
interface=None, use_ipv6=True):
1444
self.interface = interface
1446
self.address_family = socket.AF_INET6
1447
socketserver.TCPServer.__init__(self, server_address,
1448
RequestHandlerClass)
507
address_family = socket.AF_INET6
508
def __init__(self, *args, **kwargs):
509
if "settings" in kwargs:
510
self.settings = kwargs["settings"]
511
del kwargs["settings"]
512
if "clients" in kwargs:
513
self.clients = kwargs["clients"]
514
del kwargs["clients"]
515
return super(type(self), self).__init__(*args, **kwargs)
1449
516
def server_bind(self):
1450
517
"""This overrides the normal server_bind() function
1451
518
to bind to an interface if one was specified, and also NOT to
1452
519
bind to an address or port if they were not specified."""
1453
if self.interface is not None:
1454
if SO_BINDTODEVICE is None:
1455
logger.error("SO_BINDTODEVICE does not exist;"
1456
" cannot bind to interface %s",
1460
self.socket.setsockopt(socket.SOL_SOCKET,
1464
except socket.error as error:
1465
if error[0] == errno.EPERM:
1466
logger.error("No permission to"
1467
" bind to interface %s",
1469
elif error[0] == errno.ENOPROTOOPT:
1470
logger.error("SO_BINDTODEVICE not available;"
1471
" cannot bind to interface %s",
520
if self.settings["interface"]:
521
# 25 is from /usr/include/asm-i486/socket.h
522
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
524
self.socket.setsockopt(socket.SOL_SOCKET,
526
self.settings["interface"])
527
except socket.error, error:
528
if error[0] == errno.EPERM:
529
logger.error(u"No permission to"
530
u" bind to interface %s",
531
self.settings["interface"])
1475
534
# Only bind(2) the socket if we really need to.
1476
535
if self.server_address[0] or self.server_address[1]:
1477
536
if not self.server_address[0]:
1478
if self.address_family == socket.AF_INET6:
1479
any_address = "::" # in6addr_any
1481
any_address = socket.INADDR_ANY
1482
self.server_address = (any_address,
538
self.server_address = (in6addr_any,
1483
539
self.server_address[1])
1484
540
elif not self.server_address[1]:
1485
541
self.server_address = (self.server_address[0],
1487
# if self.interface:
543
# if self.settings["interface"]:
1488
544
# self.server_address = (self.server_address[0],
1491
547
# if_nametoindex
1493
return socketserver.TCPServer.server_bind(self)
1496
class MandosServer(IPv6_TCPServer):
1500
clients: set of Client objects
1501
gnutls_priority GnuTLS priority string
1502
use_dbus: Boolean; to emit D-Bus signals or not
1504
Assumes a gobject.MainLoop event loop.
1506
def __init__(self, server_address, RequestHandlerClass,
1507
interface=None, use_ipv6=True, clients=None,
1508
gnutls_priority=None, use_dbus=True):
1509
self.enabled = False
1510
self.clients = clients
1511
if self.clients is None:
1512
self.clients = set()
1513
self.use_dbus = use_dbus
1514
self.gnutls_priority = gnutls_priority
1515
IPv6_TCPServer.__init__(self, server_address,
1516
RequestHandlerClass,
1517
interface = interface,
1518
use_ipv6 = use_ipv6)
1519
def server_activate(self):
1521
return socketserver.TCPServer.server_activate(self)
1524
def add_pipe(self, parent_pipe):
1525
# Call "handle_ipc" for both data and EOF events
1526
gobject.io_add_watch(parent_pipe.fileno(),
1527
gobject.IO_IN | gobject.IO_HUP,
1528
functools.partial(self.handle_ipc,
1529
parent_pipe = parent_pipe))
1531
def handle_ipc(self, source, condition, parent_pipe=None,
1532
client_object=None):
1534
gobject.IO_IN: "IN", # There is data to read.
1535
gobject.IO_OUT: "OUT", # Data can be written (without
1537
gobject.IO_PRI: "PRI", # There is urgent data to read.
1538
gobject.IO_ERR: "ERR", # Error condition.
1539
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1540
# broken, usually for pipes and
1543
conditions_string = ' | '.join(name
1545
condition_names.iteritems()
1546
if cond & condition)
1547
# error or the other end of multiprocessing.Pipe has closed
1548
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1551
# Read a request from the child
1552
request = parent_pipe.recv()
1553
command = request[0]
1555
if command == 'init':
1557
address = request[2]
1559
for c in self.clients:
1560
if c.fingerprint == fpr:
1564
logger.warning("Client not found for fingerprint: %s, ad"
1565
"dress: %s", fpr, address)
1568
mandos_dbus_service.ClientNotFound(fpr, address[0])
1569
parent_pipe.send(False)
1572
gobject.io_add_watch(parent_pipe.fileno(),
1573
gobject.IO_IN | gobject.IO_HUP,
1574
functools.partial(self.handle_ipc,
1575
parent_pipe = parent_pipe,
1576
client_object = client))
1577
parent_pipe.send(True)
1578
# remove the old hook in favor of the new above hook on same fileno
1580
if command == 'funcall':
1581
funcname = request[1]
1585
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1587
if command == 'getattr':
1588
attrname = request[1]
1589
if callable(client_object.__getattribute__(attrname)):
1590
parent_pipe.send(('function',))
1592
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1594
if command == 'setattr':
1595
attrname = request[1]
1597
setattr(client_object, attrname, value)
550
return super(type(self), self).server_bind()
1602
553
def string_to_delta(interval):
1603
554
"""Parse a string and return a datetime.timedelta
1605
556
>>> string_to_delta('7d')
1606
557
datetime.timedelta(7)
1607
558
>>> string_to_delta('60s')
1738
695
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1739
696
"servicename": "Mandos",
1745
699
# Parse config file for server-global settings
1746
server_config = configparser.SafeConfigParser(server_defaults)
700
server_config = ConfigParser.SafeConfigParser(server_defaults)
1747
701
del server_defaults
1748
server_config.read(os.path.join(options.configdir,
702
server_config.read(os.path.join(options.configdir, "mandos.conf"))
703
server_section = "server"
1750
704
# Convert the SafeConfigParser object to a dict
1751
server_settings = server_config.defaults()
1752
# Use the appropriate methods on the non-string config options
1753
for option in ("debug", "use_dbus", "use_ipv6"):
1754
server_settings[option] = server_config.getboolean("DEFAULT",
1756
if server_settings["port"]:
1757
server_settings["port"] = server_config.getint("DEFAULT",
705
server_settings = dict(server_config.items(server_section))
706
# Use getboolean on the boolean config option
707
server_settings["debug"] = server_config.getboolean\
708
(server_section, "debug")
1759
709
del server_config
1761
711
# Override the settings from the config file with command line
1762
712
# options, if set.
1763
713
for option in ("interface", "address", "port", "debug",
1764
"priority", "servicename", "configdir",
1765
"use_dbus", "use_ipv6", "debuglevel"):
714
"priority", "servicename", "configdir"):
1766
715
value = getattr(options, option)
1767
716
if value is not None:
1768
717
server_settings[option] = value
1770
# Force all strings to be unicode
1771
for option in server_settings.keys():
1772
if type(server_settings[option]) is str:
1773
server_settings[option] = unicode(server_settings[option])
1774
719
# Now we have our good server settings in "server_settings"
1776
##################################################################
1779
721
debug = server_settings["debug"]
1780
debuglevel = server_settings["debuglevel"]
1781
use_dbus = server_settings["use_dbus"]
1782
use_ipv6 = server_settings["use_ipv6"]
724
syslogger.setLevel(logging.WARNING)
725
console.setLevel(logging.WARNING)
1784
727
if server_settings["servicename"] != "Mandos":
1785
syslogger.setFormatter(logging.Formatter
1786
('Mandos (%s) [%%(process)d]:'
1787
' %%(levelname)s: %%(message)s'
728
syslogger.setFormatter(logging.Formatter\
729
('Mandos (%s): %%(levelname)s:'
1788
731
% server_settings["servicename"]))
1790
733
# Parse config file with clients
1791
734
client_defaults = { "timeout": "1h",
1792
735
"interval": "5m",
1793
736
"checker": "fping -q -- %%(host)s",
1795
"approval_delay": "0s",
1796
"approval_duration": "1s",
1798
client_config = configparser.SafeConfigParser(client_defaults)
738
client_config = ConfigParser.SafeConfigParser(client_defaults)
1799
739
client_config.read(os.path.join(server_settings["configdir"],
1800
740
"clients.conf"))
1802
global mandos_dbus_service
1803
mandos_dbus_service = None
1805
tcp_server = MandosServer((server_settings["address"],
1806
server_settings["port"]),
1808
interface=(server_settings["interface"]
1812
server_settings["priority"],
1815
pidfilename = "/var/run/mandos.pid"
1817
pidfile = open(pidfilename, "w")
1819
logger.error("Could not open file %r", pidfilename)
1822
uid = pwd.getpwnam("_mandos").pw_uid
1823
gid = pwd.getpwnam("_mandos").pw_gid
1826
uid = pwd.getpwnam("mandos").pw_uid
1827
gid = pwd.getpwnam("mandos").pw_gid
1830
uid = pwd.getpwnam("nobody").pw_uid
1831
gid = pwd.getpwnam("nobody").pw_gid
1838
except OSError as error:
1839
if error[0] != errno.EPERM:
1842
if not debug and not debuglevel:
1843
syslogger.setLevel(logging.WARNING)
1844
console.setLevel(logging.WARNING)
1846
level = getattr(logging, debuglevel.upper())
1847
syslogger.setLevel(level)
1848
console.setLevel(level)
1851
# Enable all possible GnuTLS debugging
1853
# "Use a log level over 10 to enable all debugging options."
1855
gnutls.library.functions.gnutls_global_set_log_level(11)
1857
@gnutls.library.types.gnutls_log_func
1858
def debug_gnutls(level, string):
1859
logger.debug("GnuTLS: %s", string[:-1])
1861
(gnutls.library.functions
1862
.gnutls_global_set_log_function(debug_gnutls))
1864
# Redirect stdin so all checkers get /dev/null
1865
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1866
os.dup2(null, sys.stdin.fileno())
1870
# No console logging
1871
logger.removeHandler(console)
1873
# Need to fork before connecting to D-Bus
1875
# Close all input and output, do double fork, etc.
743
service = AvahiService(name = server_settings["servicename"],
744
type = "_mandos._tcp", );
745
if server_settings["interface"]:
746
service.interface = if_nametoindex(server_settings["interface"])
1878
748
global main_loop
1879
751
# From the Avahi example code
1880
752
DBusGMainLoop(set_as_default=True )
1881
753
main_loop = gobject.MainLoop()
1882
754
bus = dbus.SystemBus()
755
server = dbus.Interface(
756
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
757
avahi.DBUS_INTERFACE_SERVER )
1883
758
# End of Avahi example code
1886
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1887
bus, do_not_queue=True)
1888
except dbus.exceptions.NameExistsException as e:
1889
logger.error(unicode(e) + ", disabling D-Bus")
1891
server_settings["use_dbus"] = False
1892
tcp_server.use_dbus = False
1893
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1894
service = AvahiService(name = server_settings["servicename"],
1895
servicetype = "_mandos._tcp",
1896
protocol = protocol, bus = bus)
1897
if server_settings["interface"]:
1898
service.interface = (if_nametoindex
1899
(str(server_settings["interface"])))
1901
global multiprocessing_manager
1902
multiprocessing_manager = multiprocessing.Manager()
1904
client_class = Client
1906
client_class = functools.partial(ClientDBus, bus = bus)
1907
def client_config_items(config, section):
1908
special_settings = {
1909
"approved_by_default":
1910
lambda: config.getboolean(section,
1911
"approved_by_default"),
1913
for name, value in config.items(section):
1915
yield (name, special_settings[name]())
1919
tcp_server.clients.update(set(
1920
client_class(name = section,
1921
config= dict(client_config_items(
1922
client_config, section)))
1923
for section in client_config.sections()))
1924
if not tcp_server.clients:
1925
logger.warning("No clients defined")
1931
pidfile.write(str(pid) + "\n".encode("utf-8"))
1934
logger.error("Could not write to file %r with PID %d",
1937
# "pidfile" was never created
761
def remove_from_clients(client):
762
clients.remove(client)
764
logger.critical(u"No clients left, exiting")
767
clients.update(Set(Client(name = section,
768
stop_hook = remove_from_clients,
770
= dict(client_config.items(section)))
771
for section in client_config.sections()))
773
logger.critical(u"No clients defined")
777
logger.removeHandler(console)
780
pidfilename = "/var/run/mandos/mandos.pid"
783
pidfile = open(pidfilename, "w")
784
pidfile.write(str(pid) + "\n")
788
logger.error(u"Could not write %s file with PID %d",
789
pidfilename, os.getpid())
792
"Cleanup function; run on exit"
794
# From the Avahi example code
795
if not group is None:
798
# End of Avahi example code
801
client = clients.pop()
802
client.stop_hook = None
805
atexit.register(cleanup)
1941
808
signal.signal(signal.SIGINT, signal.SIG_IGN)
1943
809
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1944
810
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1947
class MandosDBusService(dbus.service.Object):
1948
"""A D-Bus proxy object"""
1950
dbus.service.Object.__init__(self, bus, "/")
1951
_interface = "se.bsnet.fukt.Mandos"
1953
@dbus.service.signal(_interface, signature="o")
1954
def ClientAdded(self, objpath):
1958
@dbus.service.signal(_interface, signature="ss")
1959
def ClientNotFound(self, fingerprint, address):
1963
@dbus.service.signal(_interface, signature="os")
1964
def ClientRemoved(self, objpath, name):
1968
@dbus.service.method(_interface, out_signature="ao")
1969
def GetAllClients(self):
1971
return dbus.Array(c.dbus_object_path
1972
for c in tcp_server.clients)
1974
@dbus.service.method(_interface,
1975
out_signature="a{oa{sv}}")
1976
def GetAllClientsWithProperties(self):
1978
return dbus.Dictionary(
1979
((c.dbus_object_path, c.GetAll(""))
1980
for c in tcp_server.clients),
1983
@dbus.service.method(_interface, in_signature="o")
1984
def RemoveClient(self, object_path):
1986
for c in tcp_server.clients:
1987
if c.dbus_object_path == object_path:
1988
tcp_server.clients.remove(c)
1989
c.remove_from_connection()
1990
# Don't signal anything except ClientRemoved
1991
c.disable(quiet=True)
1993
self.ClientRemoved(object_path, c.name)
1995
raise KeyError(object_path)
1999
mandos_dbus_service = MandosDBusService()
2002
"Cleanup function; run on exit"
2005
while tcp_server.clients:
2006
client = tcp_server.clients.pop()
2008
client.remove_from_connection()
2009
client.disable_hook = None
2010
# Don't signal anything except ClientRemoved
2011
client.disable(quiet=True)
2014
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2017
atexit.register(cleanup)
2019
for client in tcp_server.clients:
2022
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2026
tcp_server.server_activate()
812
for client in clients:
815
tcp_server = IPv6_TCPServer((server_settings["address"],
816
server_settings["port"]),
818
settings=server_settings,
2028
820
# Find out what port we got
2029
821
service.port = tcp_server.socket.getsockname()[1]
2031
logger.info("Now listening on address %r, port %d,"
2032
" flowinfo %d, scope_id %d"
2033
% tcp_server.socket.getsockname())
2035
logger.info("Now listening on address %r, port %d"
2036
% tcp_server.socket.getsockname())
822
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
823
u" scope_id %d" % tcp_server.socket.getsockname())
2038
825
#service.interface = tcp_server.socket.getsockname()[3]
2041
828
# From the Avahi example code
829
server.connect_to_signal("StateChanged", server_state_changed)
2044
except dbus.exceptions.DBusException as error:
2045
logger.critical("DBusException: %s", error)
831
server_state_changed(server.GetState())
832
except dbus.exceptions.DBusException, error:
833
logger.critical(u"DBusException: %s", error)
2048
835
# End of Avahi example code
2050
837
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2051
838
lambda *args, **kwargs:
2052
(tcp_server.handle_request
2053
(*args[2:], **kwargs) or True))
839
tcp_server.handle_request\
840
(*args[2:], **kwargs) or True)
2055
logger.debug("Starting main loop")
842
logger.debug(u"Starting main loop")
843
main_loop_started = True
2057
except AvahiError as error:
2058
logger.critical("AvahiError: %s", error)
845
except AvahiError, error:
846
logger.critical(u"AvahiError: %s" + unicode(error))
2061
848
except KeyboardInterrupt:
2063
print("", file=sys.stderr)
2064
logger.debug("Server received KeyboardInterrupt")
2065
logger.debug("Server exiting")
2066
# Must run before the D-Bus bus name gets deregistered
2069
852
if __name__ == '__main__':