2
# -*- mode: python; coding: utf-8 -*-
4
# Mandos server - give out binary blobs to connecting clients.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
# GNU General Public License for more details.
27
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
31
# Contact the authors at <mandos@recompile.se>.
34
from __future__ import (division, absolute_import, print_function,
37
import SocketServer as socketserver
3
from __future__ import division
8
from optparse import OptionParser
42
11
import gnutls.crypto
43
12
import gnutls.connection
44
13
import gnutls.errors
45
import gnutls.library.functions
46
import gnutls.library.constants
47
import gnutls.library.types
48
import ConfigParser as configparser
57
import logging.handlers
63
import cPickle as pickle
64
import multiprocessing
72
from dbus.mainloop.glib import DBusGMainLoop
75
import xml.dom.minidom
77
import Crypto.Cipher.AES
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
except AttributeError:
83
from IN import SO_BINDTODEVICE
85
SO_BINDTODEVICE = None
89
stored_state_path = "/var/lib/mandos/clients.pickle"
91
logger = logging.getLogger()
92
syslogger = (logging.handlers.SysLogHandler
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
address = str("/dev/log")))
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
108
interface_index = struct.unpack(str("I"),
110
return interface_index
113
def initlogger(level=logging.WARNING):
114
"""init logger and add loglevel"""
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
119
logger.addHandler(syslogger)
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
126
logger.addHandler(console)
127
logger.setLevel(level)
130
class AvahiError(Exception):
131
def __init__(self, value, *args, **kwargs):
133
super(AvahiError, self).__init__(value, *args, **kwargs)
134
def __unicode__(self):
135
return unicode(repr(self.value))
137
class AvahiServiceError(AvahiError):
140
class AvahiGroupError(AvahiError):
144
class AvahiService(object):
145
"""An Avahi (Zeroconf) service.
148
interface: integer; avahi.IF_UNSPEC or an interface index.
149
Used to optionally bind to the specified interface.
150
name: string; Example: 'Mandos'
151
type: string; Example: '_mandos._tcp'.
152
See <http://www.dns-sd.org/ServiceTypes.html>
153
port: integer; what port to announce
154
TXT: list of strings; TXT record for the service
155
domain: string; Domain to publish on, default to .local if empty.
156
host: string; Host to publish records for, default is localhost
157
max_renames: integer; maximum number of renames
158
rename_count: integer; counter so we only rename after collisions
159
a sensible number of times
160
group: D-Bus Entry Group
162
bus: dbus.SystemBus()
164
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
165
servicetype = None, port = None, TXT = None,
166
domain = "", host = "", max_renames = 32768,
167
protocol = avahi.PROTO_UNSPEC, bus = None):
168
self.interface = interface
170
self.type = servicetype
172
self.TXT = TXT if TXT is not None else []
175
self.rename_count = 0
176
self.max_renames = max_renames
177
self.protocol = protocol
178
self.group = None # our entry group
181
self.entry_group_state_changed_match = None
183
"""Derived from the Avahi example code"""
184
if self.rename_count >= self.max_renames:
185
logger.critical("No suitable Zeroconf service name found"
186
" after %i retries, exiting.",
188
raise AvahiServiceError("Too many renames")
189
self.name = unicode(self.server
190
.GetAlternativeServiceName(self.name))
191
logger.info("Changing Zeroconf service name to %r ...",
196
except dbus.exceptions.DBusException as error:
197
logger.critical("DBusException: %s", error)
200
self.rename_count += 1
202
"""Derived from the Avahi example code"""
203
if self.entry_group_state_changed_match is not None:
204
self.entry_group_state_changed_match.remove()
205
self.entry_group_state_changed_match = None
206
if self.group is not None:
209
"""Derived from the Avahi example code"""
211
if self.group is None:
212
self.group = dbus.Interface(
213
self.bus.get_object(avahi.DBUS_NAME,
214
self.server.EntryGroupNew()),
215
avahi.DBUS_INTERFACE_ENTRY_GROUP)
216
self.entry_group_state_changed_match = (
217
self.group.connect_to_signal(
218
'StateChanged', self.entry_group_state_changed))
219
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
220
self.name, self.type)
221
self.group.AddService(
224
dbus.UInt32(0), # flags
225
self.name, self.type,
226
self.domain, self.host,
227
dbus.UInt16(self.port),
228
avahi.string_array_to_txt_array(self.TXT))
230
def entry_group_state_changed(self, state, error):
231
"""Derived from the Avahi example code"""
232
logger.debug("Avahi entry group state change: %i", state)
234
if state == avahi.ENTRY_GROUP_ESTABLISHED:
235
logger.debug("Zeroconf service established.")
236
elif state == avahi.ENTRY_GROUP_COLLISION:
237
logger.info("Zeroconf service name collision.")
239
elif state == avahi.ENTRY_GROUP_FAILURE:
240
logger.critical("Avahi: Error in group state changed %s",
242
raise AvahiGroupError("State changed: %s"
245
"""Derived from the Avahi example code"""
246
if self.group is not None:
249
except (dbus.exceptions.UnknownMethodException,
250
dbus.exceptions.DBusException):
254
def server_state_changed(self, state, error=None):
255
"""Derived from the Avahi example code"""
256
logger.debug("Avahi server state change: %i", state)
257
bad_states = { avahi.SERVER_INVALID:
258
"Zeroconf server invalid",
259
avahi.SERVER_REGISTERING: None,
260
avahi.SERVER_COLLISION:
261
"Zeroconf server name collision",
262
avahi.SERVER_FAILURE:
263
"Zeroconf server failure" }
264
if state in bad_states:
265
if bad_states[state] is not None:
267
logger.error(bad_states[state])
269
logger.error(bad_states[state] + ": %r", error)
271
elif state == avahi.SERVER_RUNNING:
275
logger.debug("Unknown state: %r", state)
277
logger.debug("Unknown state: %r: %r", state, error)
279
"""Derived from the Avahi example code"""
280
if self.server is None:
281
self.server = dbus.Interface(
282
self.bus.get_object(avahi.DBUS_NAME,
283
avahi.DBUS_PATH_SERVER,
284
follow_name_owner_changes=True),
285
avahi.DBUS_INTERFACE_SERVER)
286
self.server.connect_to_signal("StateChanged",
287
self.server_state_changed)
288
self.server_state_changed(self.server.GetState())
290
class AvahiServiceToSyslog(AvahiService):
292
"""Add the new name to the syslog messages"""
293
ret = AvahiService.rename(self)
294
syslogger.setFormatter(logging.Formatter
295
('Mandos (%s) [%%(process)d]:'
296
' %%(levelname)s: %%(message)s'
300
def _timedelta_to_milliseconds(td):
301
"Convert a datetime.timedelta() to milliseconds"
302
return ((td.days * 24 * 60 * 60 * 1000)
303
+ (td.seconds * 1000)
304
+ (td.microseconds // 1000))
306
22
class Client(object):
307
"""A representation of a client host served by this server.
310
_approved: bool(); 'None' if not yet approved/disapproved
311
approval_delay: datetime.timedelta(); Time to wait for approval
312
approval_duration: datetime.timedelta(); Duration of one approval
313
checker: subprocess.Popen(); a running checker process used
314
to see if the client lives.
315
'None' if no process is running.
316
checker_callback_tag: a gobject event source tag, or None
317
checker_command: string; External command which is run to check
318
if client lives. %() expansions are done at
319
runtime with vars(self) as dict, so that for
320
instance %(name)s can be used in the command.
321
checker_initiator_tag: a gobject event source tag, or None
322
created: datetime.datetime(); (UTC) object creation
323
client_structure: Object describing what attributes a client has
324
and is used for storing the client at exit
325
current_checker_command: string; current running checker_command
326
disable_initiator_tag: a gobject event source tag, or None
328
fingerprint: string (40 or 32 hexadecimal digits); used to
329
uniquely identify the client
330
host: string; available for use by the checker command
331
interval: datetime.timedelta(); How often to start a new checker
332
last_approval_request: datetime.datetime(); (UTC) or None
333
last_checked_ok: datetime.datetime(); (UTC) or None
335
last_checker_status: integer between 0 and 255 reflecting exit
336
status of last checker. -1 reflects crashed
338
last_enabled: datetime.datetime(); (UTC)
339
name: string; from the config file, used in log messages and
341
secret: bytestring; sent verbatim (over TLS) to client
342
timeout: datetime.timedelta(); How long from last_checked_ok
343
until this client is disabled
344
extended_timeout: extra long timeout when password has been sent
345
runtime_expansions: Allowed attributes for runtime expansion.
346
expires: datetime.datetime(); time (UTC) when a client will be
350
runtime_expansions = ("approval_delay", "approval_duration",
351
"created", "enabled", "fingerprint",
352
"host", "interval", "last_checked_ok",
353
"last_enabled", "name", "timeout")
355
def timeout_milliseconds(self):
356
"Return the 'timeout' attribute in milliseconds"
357
return _timedelta_to_milliseconds(self.timeout)
359
def extended_timeout_milliseconds(self):
360
"Return the 'extended_timeout' attribute in milliseconds"
361
return _timedelta_to_milliseconds(self.extended_timeout)
363
def interval_milliseconds(self):
364
"Return the 'interval' attribute in milliseconds"
365
return _timedelta_to_milliseconds(self.interval)
367
def approval_delay_milliseconds(self):
368
return _timedelta_to_milliseconds(self.approval_delay)
370
def __init__(self, name = None, config=None):
371
"""Note: the 'checker' key in 'config' sets the
372
'checker_command' attribute and *not* the 'checker'
23
def __init__(self, name=None, options=None, dn=None,
24
password=None, passfile=None, fqdn=None,
25
timeout=None, interval=-1):
377
logger.debug("Creating client %r", self.name)
378
# Uppercase and remove spaces from fingerprint for later
379
# comparison purposes with return value from the fingerprint()
381
self.fingerprint = (config["fingerprint"].upper()
383
logger.debug(" Fingerprint: %s", self.fingerprint)
384
if "secret" in config:
385
self.secret = config["secret"].decode("base64")
386
elif "secfile" in config:
387
with open(os.path.expanduser(os.path.expandvars
388
(config["secfile"])),
390
self.secret = secfile.read()
392
raise TypeError("No secret or secfile for client %s"
394
self.host = config.get("host", "")
395
self.created = datetime.datetime.utcnow()
397
self.last_approval_request = None
398
self.last_enabled = datetime.datetime.utcnow()
399
self.last_checked_ok = None
400
self.last_checker_status = None
401
self.timeout = string_to_delta(config["timeout"])
402
self.extended_timeout = string_to_delta(config
403
["extended_timeout"])
404
self.interval = string_to_delta(config["interval"])
406
self.checker_initiator_tag = None
407
self.disable_initiator_tag = None
408
self.expires = datetime.datetime.utcnow() + self.timeout
409
self.checker_callback_tag = None
410
self.checker_command = config["checker"]
411
self.current_checker_command = None
412
self._approved = None
413
self.approved_by_default = config.get("approved_by_default",
415
self.approvals_pending = 0
416
self.approval_delay = string_to_delta(
417
config["approval_delay"])
418
self.approval_duration = string_to_delta(
419
config["approval_duration"])
420
self.changedstate = (multiprocessing_manager
421
.Condition(multiprocessing_manager
423
self.client_structure = [attr for attr in
424
self.__dict__.iterkeys()
425
if not attr.startswith("_")]
426
self.client_structure.append("client_structure")
428
for name, t in inspect.getmembers(type(self),
432
if not name.startswith("_"):
433
self.client_structure.append(name)
435
# Send notice to process children that client state has changed
436
def send_changedstate(self):
437
with self.changedstate:
438
self.changedstate.notify_all()
441
"""Start this client's checker and timeout hooks"""
442
if getattr(self, "enabled", False):
445
self.send_changedstate()
446
self.expires = datetime.datetime.utcnow() + self.timeout
448
self.last_enabled = datetime.datetime.utcnow()
451
def disable(self, quiet=True):
452
"""Disable this client."""
453
if not getattr(self, "enabled", False):
456
self.send_changedstate()
458
logger.info("Disabling client %s", self.name)
459
if getattr(self, "disable_initiator_tag", False):
460
gobject.source_remove(self.disable_initiator_tag)
461
self.disable_initiator_tag = None
463
if getattr(self, "checker_initiator_tag", False):
464
gobject.source_remove(self.checker_initiator_tag)
465
self.checker_initiator_tag = None
468
# Do not run this again if called by a gobject.timeout_add
474
def init_checker(self):
475
# Schedule a new checker to be started an 'interval' from now,
476
# and every interval from then on.
477
self.checker_initiator_tag = (gobject.timeout_add
478
(self.interval_milliseconds(),
480
# Schedule a disable() when 'timeout' has passed
481
self.disable_initiator_tag = (gobject.timeout_add
482
(self.timeout_milliseconds(),
484
# Also start a new checker *right now*.
487
def checker_callback(self, pid, condition, command):
488
"""The checker has completed, so take appropriate actions."""
489
self.checker_callback_tag = None
491
if os.WIFEXITED(condition):
492
self.last_checker_status = os.WEXITSTATUS(condition)
493
if self.last_checker_status == 0:
494
logger.info("Checker for %(name)s succeeded",
498
logger.info("Checker for %(name)s failed",
501
self.last_checker_status = -1
502
logger.warning("Checker for %(name)s crashed?",
505
def checked_ok(self, timeout=None):
506
"""Bump up the timeout for this client.
508
This should only be called when the client has been seen,
29
self.password = password
31
self.password = open(passfile).readall()
33
print "No Password or Passfile in client config file"
34
# raise RuntimeError XXX
35
self.password = "gazonk"
36
self.fqdn = fqdn # string
37
self.created = datetime.datetime.now()
38
self.last_seen = None # datetime.datetime()
511
39
if timeout is None:
512
timeout = self.timeout
513
self.last_checked_ok = datetime.datetime.utcnow()
514
if self.disable_initiator_tag is not None:
515
gobject.source_remove(self.disable_initiator_tag)
516
if getattr(self, "enabled", False):
517
self.disable_initiator_tag = (gobject.timeout_add
518
(_timedelta_to_milliseconds
519
(timeout), self.disable))
520
self.expires = datetime.datetime.utcnow() + timeout
522
def need_approval(self):
523
self.last_approval_request = datetime.datetime.utcnow()
40
timeout = options.timeout
41
self.timeout = timeout # datetime.timedelta()
43
interval = options.interval
45
interval = string_to_delta(interval)
46
self.interval = interval # datetime.timedelta()
47
self.next_check = datetime.datetime.now() # datetime.datetime()
48
# Note: next_check may be in the past if checker is not None
49
self.checker = None # or a subprocess.Popen()
50
def check_action(self):
51
"""The checker said something and might have completed.
52
Check if is has, and take appropriate actions."""
53
if self.checker.poll() is None:
54
# False alarm, no result yet
56
#print "Checker for %(name)s said nothing?" % vars(self)
58
now = datetime.datetime.now()
59
if self.checker.returncode == 0:
60
print "Checker for %(name)s succeeded" % vars(self)
63
print "Checker for %(name)s failed" % vars(self)
64
while self.next_check <= now:
65
self.next_check += self.interval
67
handle_request = check_action
525
68
def start_checker(self):
526
"""Start a new checker subprocess if one is not running.
528
If a checker already exists, leave it running and do
530
# The reason for not killing a running checker is that if we
531
# did that, then if a checker (for some reason) started
532
# running slowly and taking more than 'interval' time, the
533
# client would inevitably timeout, since no checker would get
534
# a chance to run to completion. If we instead leave running
535
# checkers alone, the checker would have to take more time
536
# than 'timeout' for the client to be disabled, which is as it
539
# If a checker exists, make sure it is not a zombie
541
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
542
except (AttributeError, OSError) as error:
543
if (isinstance(error, OSError)
544
and error.errno != errno.ECHILD):
548
logger.warning("Checker was a zombie")
549
gobject.source_remove(self.checker_callback_tag)
550
self.checker_callback(pid, status,
551
self.current_checker_command)
552
# Start a new checker if needed
553
if self.checker is None:
555
# In case checker_command has exactly one % operator
556
command = self.checker_command % self.host
558
# Escape attributes for the shell
559
escaped_attrs = dict(
561
re.escape(unicode(str(getattr(self, attr, "")),
565
self.runtime_expansions)
568
command = self.checker_command % escaped_attrs
569
except TypeError as error:
570
logger.error('Could not format string "%s":'
571
' %s', self.checker_command, error)
572
return True # Try again later
573
self.current_checker_command = command
575
logger.info("Starting checker %r for %s",
577
# We don't need to redirect stdout and stderr, since
578
# in normal mode, that is already done by daemon(),
579
# and in debug mode we don't want to. (Stdin is
580
# always replaced by /dev/null.)
581
self.checker = subprocess.Popen(command,
584
self.checker_callback_tag = (gobject.child_watch_add
586
self.checker_callback,
588
# The checker may have completed before the gobject
589
# watch was added. Check for this.
590
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
592
gobject.source_remove(self.checker_callback_tag)
593
self.checker_callback(pid, status, command)
594
except OSError as error:
595
logger.error("Failed to start subprocess: %s",
597
# Re-run this periodically if run by gobject.timeout_add
71
self.checker = subprocess.Popen("sleep 10; fping -q -- %s"
72
% re.escape(self.fqdn),
73
stdout=subprocess.PIPE,
76
except subprocess.OSError, e:
77
print "Failed to start subprocess:", e
600
78
def stop_checker(self):
601
"""Force the checker process, if any, to stop."""
602
if self.checker_callback_tag:
603
gobject.source_remove(self.checker_callback_tag)
604
self.checker_callback_tag = None
605
if getattr(self, "checker", None) is None:
607
logger.debug("Stopping checker for %(name)s", vars(self))
609
os.kill(self.checker.pid, signal.SIGTERM)
611
#if self.checker.poll() is None:
612
# os.kill(self.checker.pid, signal.SIGKILL)
613
except OSError as error:
614
if error.errno != errno.ESRCH: # No such process
618
# Encrypts a client secret and stores it in a varible
620
def encrypt_secret(self, key):
621
# Encryption-key need to be of a specific size, so we hash
623
hasheng = hashlib.sha256()
625
encryptionkey = hasheng.digest()
627
# Create validation hash so we know at decryption if it was
629
hasheng = hashlib.sha256()
630
hasheng.update(self.secret)
631
validationhash = hasheng.digest()
634
iv = os.urandom(Crypto.Cipher.AES.block_size)
635
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
636
Crypto.Cipher.AES.MODE_CFB,
638
ciphertext = ciphereng.encrypt(validationhash+self.secret)
639
self.encrypted_secret = (ciphertext, iv)
641
# Decrypt a encrypted client secret
642
def decrypt_secret(self, key):
643
# Decryption-key need to be of a specific size, so we hash inputed key
644
hasheng = hashlib.sha256()
646
encryptionkey = hasheng.digest()
648
# Decrypt encrypted secret
649
ciphertext, iv = self.encrypted_secret
650
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
651
Crypto.Cipher.AES.MODE_CFB,
653
plain = ciphereng.decrypt(ciphertext)
655
# Validate decrypted secret to know if it was succesful
656
hasheng = hashlib.sha256()
657
validationhash = plain[:hasheng.digest_size]
658
secret = plain[hasheng.digest_size:]
659
hasheng.update(secret)
661
# if validation fails, we use key as new secret. Otherwhise,
662
# we use the decrypted secret
663
if hasheng.digest() == validationhash:
667
del self.encrypted_secret
670
def dbus_service_property(dbus_interface, signature="v",
671
access="readwrite", byte_arrays=False):
672
"""Decorators for marking methods of a DBusObjectWithProperties to
673
become properties on the D-Bus.
675
The decorated method will be called with no arguments by "Get"
676
and with one argument by "Set".
678
The parameters, where they are supported, are the same as
679
dbus.service.method, except there is only "signature", since the
680
type from Get() and the type sent to Set() is the same.
682
# Encoding deeply encoded byte arrays is not supported yet by the
683
# "Set" method, so we fail early here:
684
if byte_arrays and signature != "ay":
685
raise ValueError("Byte arrays not supported for non-'ay'"
686
" signature %r" % signature)
688
func._dbus_is_property = True
689
func._dbus_interface = dbus_interface
690
func._dbus_signature = signature
691
func._dbus_access = access
692
func._dbus_name = func.__name__
693
if func._dbus_name.endswith("_dbus_property"):
694
func._dbus_name = func._dbus_name[:-14]
695
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
700
class DBusPropertyException(dbus.exceptions.DBusException):
701
"""A base class for D-Bus property-related exceptions
703
def __unicode__(self):
704
return unicode(str(self))
707
class DBusPropertyAccessException(DBusPropertyException):
708
"""A property's access permissions disallows an operation.
713
class DBusPropertyNotFound(DBusPropertyException):
714
"""An attempt was made to access a non-existing property.
719
class DBusObjectWithProperties(dbus.service.Object):
720
"""A D-Bus object with properties.
722
Classes inheriting from this can use the dbus_service_property
723
decorator to expose methods as D-Bus properties. It exposes the
724
standard Get(), Set(), and GetAll() methods on the D-Bus.
728
def _is_dbus_property(obj):
729
return getattr(obj, "_dbus_is_property", False)
731
def _get_all_dbus_properties(self):
732
"""Returns a generator of (name, attribute) pairs
734
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
735
for cls in self.__class__.__mro__
737
inspect.getmembers(cls, self._is_dbus_property))
739
def _get_dbus_property(self, interface_name, property_name):
740
"""Returns a bound method if one exists which is a D-Bus
741
property with the specified name and interface.
743
for cls in self.__class__.__mro__:
744
for name, value in (inspect.getmembers
745
(cls, self._is_dbus_property)):
746
if (value._dbus_name == property_name
747
and value._dbus_interface == interface_name):
748
return value.__get__(self)
751
raise DBusPropertyNotFound(self.dbus_object_path + ":"
752
+ interface_name + "."
755
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
757
def Get(self, interface_name, property_name):
758
"""Standard D-Bus property Get() method, see D-Bus standard.
760
prop = self._get_dbus_property(interface_name, property_name)
761
if prop._dbus_access == "write":
762
raise DBusPropertyAccessException(property_name)
764
if not hasattr(value, "variant_level"):
766
return type(value)(value, variant_level=value.variant_level+1)
768
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
769
def Set(self, interface_name, property_name, value):
770
"""Standard D-Bus property Set() method, see D-Bus standard.
772
prop = self._get_dbus_property(interface_name, property_name)
773
if prop._dbus_access == "read":
774
raise DBusPropertyAccessException(property_name)
775
if prop._dbus_get_args_options["byte_arrays"]:
776
# The byte_arrays option is not supported yet on
777
# signatures other than "ay".
778
if prop._dbus_signature != "ay":
780
value = dbus.ByteArray(''.join(unichr(byte)
784
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
785
out_signature="a{sv}")
786
def GetAll(self, interface_name):
787
"""Standard D-Bus property GetAll() method, see D-Bus
790
Note: Will not include properties with access="write".
793
for name, prop in self._get_all_dbus_properties():
795
and interface_name != prop._dbus_interface):
796
# Interface non-empty but did not match
798
# Ignore write-only properties
799
if prop._dbus_access == "write":
802
if not hasattr(value, "variant_level"):
803
properties[name] = value
805
properties[name] = type(value)(value, variant_level=
806
value.variant_level+1)
807
return dbus.Dictionary(properties, signature="sv")
809
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
811
path_keyword='object_path',
812
connection_keyword='connection')
813
def Introspect(self, object_path, connection):
814
"""Standard D-Bus method, overloaded to insert property tags.
816
xmlstring = dbus.service.Object.Introspect(self, object_path,
819
document = xml.dom.minidom.parseString(xmlstring)
820
def make_tag(document, name, prop):
821
e = document.createElement("property")
822
e.setAttribute("name", name)
823
e.setAttribute("type", prop._dbus_signature)
824
e.setAttribute("access", prop._dbus_access)
826
for if_tag in document.getElementsByTagName("interface"):
827
for tag in (make_tag(document, name, prop)
829
in self._get_all_dbus_properties()
830
if prop._dbus_interface
831
== if_tag.getAttribute("name")):
832
if_tag.appendChild(tag)
833
# Add the names to the return values for the
834
# "org.freedesktop.DBus.Properties" methods
835
if (if_tag.getAttribute("name")
836
== "org.freedesktop.DBus.Properties"):
837
for cn in if_tag.getElementsByTagName("method"):
838
if cn.getAttribute("name") == "Get":
839
for arg in cn.getElementsByTagName("arg"):
840
if (arg.getAttribute("direction")
842
arg.setAttribute("name", "value")
843
elif cn.getAttribute("name") == "GetAll":
844
for arg in cn.getElementsByTagName("arg"):
845
if (arg.getAttribute("direction")
847
arg.setAttribute("name", "props")
848
xmlstring = document.toxml("utf-8")
850
except (AttributeError, xml.dom.DOMException,
851
xml.parsers.expat.ExpatError) as error:
852
logger.error("Failed to override Introspection method",
857
def datetime_to_dbus (dt, variant_level=0):
858
"""Convert a UTC datetime.datetime() to a D-Bus type."""
860
return dbus.String("", variant_level = variant_level)
861
return dbus.String(dt.isoformat(),
862
variant_level=variant_level)
865
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
867
"""Applied to an empty subclass of a D-Bus object, this metaclass
868
will add additional D-Bus attributes matching a certain pattern.
870
def __new__(mcs, name, bases, attr):
871
# Go through all the base classes which could have D-Bus
872
# methods, signals, or properties in them
873
for base in (b for b in bases
874
if issubclass(b, dbus.service.Object)):
875
# Go though all attributes of the base class
876
for attrname, attribute in inspect.getmembers(base):
877
# Ignore non-D-Bus attributes, and D-Bus attributes
878
# with the wrong interface name
879
if (not hasattr(attribute, "_dbus_interface")
880
or not attribute._dbus_interface
881
.startswith("se.recompile.Mandos")):
883
# Create an alternate D-Bus interface name based on
885
alt_interface = (attribute._dbus_interface
886
.replace("se.recompile.Mandos",
887
"se.bsnet.fukt.Mandos"))
888
# Is this a D-Bus signal?
889
if getattr(attribute, "_dbus_is_signal", False):
890
# Extract the original non-method function by
892
nonmethod_func = (dict(
893
zip(attribute.func_code.co_freevars,
894
attribute.__closure__))["func"]
896
# Create a new, but exactly alike, function
897
# object, and decorate it to be a new D-Bus signal
898
# with the alternate D-Bus interface name
899
new_function = (dbus.service.signal
901
attribute._dbus_signature)
903
nonmethod_func.func_code,
904
nonmethod_func.func_globals,
905
nonmethod_func.func_name,
906
nonmethod_func.func_defaults,
907
nonmethod_func.func_closure)))
908
# Define a creator of a function to call both the
909
# old and new functions, so both the old and new
910
# signals gets sent when the function is called
911
def fixscope(func1, func2):
912
"""This function is a scope container to pass
913
func1 and func2 to the "call_both" function
914
outside of its arguments"""
915
def call_both(*args, **kwargs):
916
"""This function will emit two D-Bus
917
signals by calling func1 and func2"""
918
func1(*args, **kwargs)
919
func2(*args, **kwargs)
921
# Create the "call_both" function and add it to
923
attr[attrname] = fixscope(attribute,
925
# Is this a D-Bus method?
926
elif getattr(attribute, "_dbus_is_method", False):
927
# Create a new, but exactly alike, function
928
# object. Decorate it to be a new D-Bus method
929
# with the alternate D-Bus interface name. Add it
931
attr[attrname] = (dbus.service.method
933
attribute._dbus_in_signature,
934
attribute._dbus_out_signature)
936
(attribute.func_code,
937
attribute.func_globals,
939
attribute.func_defaults,
940
attribute.func_closure)))
941
# Is this a D-Bus property?
942
elif getattr(attribute, "_dbus_is_property", False):
943
# Create a new, but exactly alike, function
944
# object, and decorate it to be a new D-Bus
945
# property with the alternate D-Bus interface
946
# name. Add it to the class.
947
attr[attrname] = (dbus_service_property
949
attribute._dbus_signature,
950
attribute._dbus_access,
952
._dbus_get_args_options
955
(attribute.func_code,
956
attribute.func_globals,
958
attribute.func_defaults,
959
attribute.func_closure)))
960
return type.__new__(mcs, name, bases, attr)
963
class ClientDBus(Client, DBusObjectWithProperties):
964
"""A Client class using D-Bus
967
dbus_object_path: dbus.ObjectPath
968
bus: dbus.SystemBus()
971
runtime_expansions = (Client.runtime_expansions
972
+ ("dbus_object_path",))
974
# dbus.service.Object doesn't use super(), so we can't either.
976
def __init__(self, bus = None, *args, **kwargs):
978
Client.__init__(self, *args, **kwargs)
980
self._approvals_pending = 0
981
# Only now, when this client is initialized, can it show up on
983
client_object_name = unicode(self.name).translate(
986
self.dbus_object_path = (dbus.ObjectPath
987
("/clients/" + client_object_name))
988
DBusObjectWithProperties.__init__(self, self.bus,
989
self.dbus_object_path)
991
def notifychangeproperty(transform_func,
992
dbus_name, type_func=lambda x: x,
994
""" Modify a variable so that it's a property which announces
997
transform_fun: Function that takes a value and a variant_level
998
and transforms it to a D-Bus type.
999
dbus_name: D-Bus name of the variable
1000
type_func: Function that transform the value before sending it
1001
to the D-Bus. Default: no transform
1002
variant_level: D-Bus variant level. Default: 1
1004
attrname = "_{0}".format(dbus_name)
1005
def setter(self, value):
1006
if hasattr(self, "dbus_object_path"):
1007
if (not hasattr(self, attrname) or
1008
type_func(getattr(self, attrname, None))
1009
!= type_func(value)):
1010
dbus_value = transform_func(type_func(value),
1013
self.PropertyChanged(dbus.String(dbus_name),
1015
setattr(self, attrname, value)
1017
return property(lambda self: getattr(self, attrname), setter)
1020
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1021
approvals_pending = notifychangeproperty(dbus.Boolean,
1024
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1025
last_enabled = notifychangeproperty(datetime_to_dbus,
1027
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1028
type_func = lambda checker:
1029
checker is not None)
1030
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1032
last_approval_request = notifychangeproperty(
1033
datetime_to_dbus, "LastApprovalRequest")
1034
approved_by_default = notifychangeproperty(dbus.Boolean,
1035
"ApprovedByDefault")
1036
approval_delay = notifychangeproperty(dbus.UInt16,
1039
_timedelta_to_milliseconds)
1040
approval_duration = notifychangeproperty(
1041
dbus.UInt16, "ApprovalDuration",
1042
type_func = _timedelta_to_milliseconds)
1043
host = notifychangeproperty(dbus.String, "Host")
1044
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1046
_timedelta_to_milliseconds)
1047
extended_timeout = notifychangeproperty(
1048
dbus.UInt16, "ExtendedTimeout",
1049
type_func = _timedelta_to_milliseconds)
1050
interval = notifychangeproperty(dbus.UInt16,
1053
_timedelta_to_milliseconds)
1054
checker_command = notifychangeproperty(dbus.String, "Checker")
1056
del notifychangeproperty
1058
def __del__(self, *args, **kwargs):
1060
self.remove_from_connection()
1063
if hasattr(DBusObjectWithProperties, "__del__"):
1064
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1065
Client.__del__(self, *args, **kwargs)
1067
def checker_callback(self, pid, condition, command,
1069
self.checker_callback_tag = None
1071
if os.WIFEXITED(condition):
1072
exitstatus = os.WEXITSTATUS(condition)
1074
self.CheckerCompleted(dbus.Int16(exitstatus),
1075
dbus.Int64(condition),
1076
dbus.String(command))
1079
self.CheckerCompleted(dbus.Int16(-1),
1080
dbus.Int64(condition),
1081
dbus.String(command))
1083
return Client.checker_callback(self, pid, condition, command,
1086
def start_checker(self, *args, **kwargs):
1087
old_checker = self.checker
1088
if self.checker is not None:
1089
old_checker_pid = self.checker.pid
1091
old_checker_pid = None
1092
r = Client.start_checker(self, *args, **kwargs)
1093
# Only if new checker process was started
1094
if (self.checker is not None
1095
and old_checker_pid != self.checker.pid):
1097
self.CheckerStarted(self.current_checker_command)
1100
def _reset_approved(self):
1101
self._approved = None
1104
def approve(self, value=True):
1105
self.send_changedstate()
1106
self._approved = value
1107
gobject.timeout_add(_timedelta_to_milliseconds
1108
(self.approval_duration),
1109
self._reset_approved)
1112
## D-Bus methods, signals & properties
1113
_interface = "se.recompile.Mandos.Client"
1117
# CheckerCompleted - signal
1118
@dbus.service.signal(_interface, signature="nxs")
1119
def CheckerCompleted(self, exitcode, waitstatus, command):
1123
# CheckerStarted - signal
1124
@dbus.service.signal(_interface, signature="s")
1125
def CheckerStarted(self, command):
1129
# PropertyChanged - signal
1130
@dbus.service.signal(_interface, signature="sv")
1131
def PropertyChanged(self, property, value):
1135
# GotSecret - signal
1136
@dbus.service.signal(_interface)
1137
def GotSecret(self):
1139
Is sent after a successful transfer of secret from the Mandos
1140
server to mandos-client
1145
@dbus.service.signal(_interface, signature="s")
1146
def Rejected(self, reason):
1150
# NeedApproval - signal
1151
@dbus.service.signal(_interface, signature="tb")
1152
def NeedApproval(self, timeout, default):
1154
return self.need_approval()
1156
# NeRwequest - signal
1157
@dbus.service.signal(_interface, signature="s")
1158
def NewRequest(self, ip):
1160
Is sent after a client request a password.
1167
@dbus.service.method(_interface, in_signature="b")
1168
def Approve(self, value):
1171
# CheckedOK - method
1172
@dbus.service.method(_interface)
1173
def CheckedOK(self):
1177
@dbus.service.method(_interface)
1182
# StartChecker - method
1183
@dbus.service.method(_interface)
1184
def StartChecker(self):
1186
self.start_checker()
1189
@dbus.service.method(_interface)
1194
# StopChecker - method
1195
@dbus.service.method(_interface)
1196
def StopChecker(self):
1201
# ApprovalPending - property
1202
@dbus_service_property(_interface, signature="b", access="read")
1203
def ApprovalPending_dbus_property(self):
1204
return dbus.Boolean(bool(self.approvals_pending))
1206
# ApprovedByDefault - property
1207
@dbus_service_property(_interface, signature="b",
1209
def ApprovedByDefault_dbus_property(self, value=None):
1210
if value is None: # get
1211
return dbus.Boolean(self.approved_by_default)
1212
self.approved_by_default = bool(value)
1214
# ApprovalDelay - property
1215
@dbus_service_property(_interface, signature="t",
1217
def ApprovalDelay_dbus_property(self, value=None):
1218
if value is None: # get
1219
return dbus.UInt64(self.approval_delay_milliseconds())
1220
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1222
# ApprovalDuration - property
1223
@dbus_service_property(_interface, signature="t",
1225
def ApprovalDuration_dbus_property(self, value=None):
1226
if value is None: # get
1227
return dbus.UInt64(_timedelta_to_milliseconds(
1228
self.approval_duration))
1229
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1232
@dbus_service_property(_interface, signature="s", access="read")
1233
def Name_dbus_property(self):
1234
return dbus.String(self.name)
1236
# Fingerprint - property
1237
@dbus_service_property(_interface, signature="s", access="read")
1238
def Fingerprint_dbus_property(self):
1239
return dbus.String(self.fingerprint)
1242
@dbus_service_property(_interface, signature="s",
1244
def Host_dbus_property(self, value=None):
1245
if value is None: # get
1246
return dbus.String(self.host)
1249
# Created - property
1250
@dbus_service_property(_interface, signature="s", access="read")
1251
def Created_dbus_property(self):
1252
return dbus.String(datetime_to_dbus(self.created))
1254
# LastEnabled - property
1255
@dbus_service_property(_interface, signature="s", access="read")
1256
def LastEnabled_dbus_property(self):
1257
return datetime_to_dbus(self.last_enabled)
1259
# Enabled - property
1260
@dbus_service_property(_interface, signature="b",
1262
def Enabled_dbus_property(self, value=None):
1263
if value is None: # get
1264
return dbus.Boolean(self.enabled)
1270
# LastCheckedOK - property
1271
@dbus_service_property(_interface, signature="s",
1273
def LastCheckedOK_dbus_property(self, value=None):
1274
if value is not None:
1277
return datetime_to_dbus(self.last_checked_ok)
1279
# Expires - property
1280
@dbus_service_property(_interface, signature="s", access="read")
1281
def Expires_dbus_property(self):
1282
return datetime_to_dbus(self.expires)
1284
# LastApprovalRequest - property
1285
@dbus_service_property(_interface, signature="s", access="read")
1286
def LastApprovalRequest_dbus_property(self):
1287
return datetime_to_dbus(self.last_approval_request)
1289
# Timeout - property
1290
@dbus_service_property(_interface, signature="t",
1292
def Timeout_dbus_property(self, value=None):
1293
if value is None: # get
1294
return dbus.UInt64(self.timeout_milliseconds())
1295
self.timeout = datetime.timedelta(0, 0, 0, value)
1296
if getattr(self, "disable_initiator_tag", None) is None:
1298
# Reschedule timeout
1299
gobject.source_remove(self.disable_initiator_tag)
1300
self.disable_initiator_tag = None
1302
time_to_die = _timedelta_to_milliseconds((self
1307
if time_to_die <= 0:
1308
# The timeout has passed
1311
self.expires = (datetime.datetime.utcnow()
1312
+ datetime.timedelta(milliseconds =
1314
self.disable_initiator_tag = (gobject.timeout_add
1315
(time_to_die, self.disable))
1317
# ExtendedTimeout - property
1318
@dbus_service_property(_interface, signature="t",
1320
def ExtendedTimeout_dbus_property(self, value=None):
1321
if value is None: # get
1322
return dbus.UInt64(self.extended_timeout_milliseconds())
1323
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1325
# Interval - property
1326
@dbus_service_property(_interface, signature="t",
1328
def Interval_dbus_property(self, value=None):
1329
if value is None: # get
1330
return dbus.UInt64(self.interval_milliseconds())
1331
self.interval = datetime.timedelta(0, 0, 0, value)
1332
if getattr(self, "checker_initiator_tag", None) is None:
1334
# Reschedule checker run
1335
gobject.source_remove(self.checker_initiator_tag)
1336
self.checker_initiator_tag = (gobject.timeout_add
1337
(value, self.start_checker))
1338
self.start_checker() # Start one now, too
1340
# Checker - property
1341
@dbus_service_property(_interface, signature="s",
1343
def Checker_dbus_property(self, value=None):
1344
if value is None: # get
1345
return dbus.String(self.checker_command)
1346
self.checker_command = value
1348
# CheckerRunning - property
1349
@dbus_service_property(_interface, signature="b",
1351
def CheckerRunning_dbus_property(self, value=None):
1352
if value is None: # get
1353
return dbus.Boolean(self.checker is not None)
1355
self.start_checker()
1359
# ObjectPath - property
1360
@dbus_service_property(_interface, signature="o", access="read")
1361
def ObjectPath_dbus_property(self):
1362
return self.dbus_object_path # is already a dbus.ObjectPath
1365
@dbus_service_property(_interface, signature="ay",
1366
access="write", byte_arrays=True)
1367
def Secret_dbus_property(self, value):
1368
self.secret = str(value)
1373
class ProxyClient(object):
1374
def __init__(self, child_pipe, fpr, address):
1375
self._pipe = child_pipe
1376
self._pipe.send(('init', fpr, address))
1377
if not self._pipe.recv():
1380
def __getattribute__(self, name):
1381
if(name == '_pipe'):
1382
return super(ProxyClient, self).__getattribute__(name)
1383
self._pipe.send(('getattr', name))
1384
data = self._pipe.recv()
1385
if data[0] == 'data':
1387
if data[0] == 'function':
1388
def func(*args, **kwargs):
1389
self._pipe.send(('funcall', name, args, kwargs))
1390
return self._pipe.recv()[1]
1393
def __setattr__(self, name, value):
1394
if(name == '_pipe'):
1395
return super(ProxyClient, self).__setattr__(name, value)
1396
self._pipe.send(('setattr', name, value))
1399
class ClientDBusTransitional(ClientDBus):
1400
__metaclass__ = AlternateDBusNamesMetaclass
1403
class ClientHandler(socketserver.BaseRequestHandler, object):
1404
"""A class to handle client connections.
1406
Instantiated once for each connection to handle it.
1407
Note: This will run in its own forked process."""
1410
with contextlib.closing(self.server.child_pipe) as child_pipe:
1411
logger.info("TCP connection from: %s",
1412
unicode(self.client_address))
1413
logger.debug("Pipe FD: %d",
1414
self.server.child_pipe.fileno())
1416
session = (gnutls.connection
1417
.ClientSession(self.request,
1419
.X509Credentials()))
1421
# Note: gnutls.connection.X509Credentials is really a
1422
# generic GnuTLS certificate credentials object so long as
1423
# no X.509 keys are added to it. Therefore, we can use it
1424
# here despite using OpenPGP certificates.
1426
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1427
# "+AES-256-CBC", "+SHA1",
1428
# "+COMP-NULL", "+CTYPE-OPENPGP",
1430
# Use a fallback default, since this MUST be set.
1431
priority = self.server.gnutls_priority
1432
if priority is None:
1434
(gnutls.library.functions
1435
.gnutls_priority_set_direct(session._c_object,
1438
# Start communication using the Mandos protocol
1439
# Get protocol number
1440
line = self.request.makefile().readline()
1441
logger.debug("Protocol version: %r", line)
1443
if int(line.strip().split()[0]) > 1:
1445
except (ValueError, IndexError, RuntimeError) as error:
1446
logger.error("Unknown protocol version: %s", error)
1449
# Start GnuTLS connection
1452
except gnutls.errors.GNUTLSError as error:
1453
logger.warning("Handshake failed: %s", error)
1454
# Do not run session.bye() here: the session is not
1455
# established. Just abandon the request.
1457
logger.debug("Handshake succeeded")
1459
approval_required = False
1462
fpr = self.fingerprint(self.peer_certificate
1465
gnutls.errors.GNUTLSError) as error:
1466
logger.warning("Bad certificate: %s", error)
1468
logger.debug("Fingerprint: %s", fpr)
1469
if self.server.use_dbus:
1471
client.NewRequest(str(self.client_address))
1474
client = ProxyClient(child_pipe, fpr,
1475
self.client_address)
1479
if client.approval_delay:
1480
delay = client.approval_delay
1481
client.approvals_pending += 1
1482
approval_required = True
1485
if not client.enabled:
1486
logger.info("Client %s is disabled",
1488
if self.server.use_dbus:
1490
client.Rejected("Disabled")
1493
if client._approved or not client.approval_delay:
1494
#We are approved or approval is disabled
1496
elif client._approved is None:
1497
logger.info("Client %s needs approval",
1499
if self.server.use_dbus:
1501
client.NeedApproval(
1502
client.approval_delay_milliseconds(),
1503
client.approved_by_default)
1505
logger.warning("Client %s was not approved",
1507
if self.server.use_dbus:
1509
client.Rejected("Denied")
1512
#wait until timeout or approved
1513
time = datetime.datetime.now()
1514
client.changedstate.acquire()
1515
(client.changedstate.wait
1516
(float(client._timedelta_to_milliseconds(delay)
1518
client.changedstate.release()
1519
time2 = datetime.datetime.now()
1520
if (time2 - time) >= delay:
1521
if not client.approved_by_default:
1522
logger.warning("Client %s timed out while"
1523
" waiting for approval",
1525
if self.server.use_dbus:
1527
client.Rejected("Approval timed out")
1532
delay -= time2 - time
1535
while sent_size < len(client.secret):
1537
sent = session.send(client.secret[sent_size:])
1538
except gnutls.errors.GNUTLSError as error:
1539
logger.warning("gnutls send failed")
1541
logger.debug("Sent: %d, remaining: %d",
1542
sent, len(client.secret)
1543
- (sent_size + sent))
1546
logger.info("Sending secret to %s", client.name)
1547
# bump the timeout using extended_timeout
1548
client.checked_ok(client.extended_timeout)
1549
if self.server.use_dbus:
1554
if approval_required:
1555
client.approvals_pending -= 1
1558
except gnutls.errors.GNUTLSError as error:
1559
logger.warning("GnuTLS bye failed")
1562
def peer_certificate(session):
1563
"Return the peer's OpenPGP certificate as a bytestring"
1564
# If not an OpenPGP certificate...
1565
if (gnutls.library.functions
1566
.gnutls_certificate_type_get(session._c_object)
1567
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1568
# ...do the normal thing
1569
return session.peer_certificate
1570
list_size = ctypes.c_uint(1)
1571
cert_list = (gnutls.library.functions
1572
.gnutls_certificate_get_peers
1573
(session._c_object, ctypes.byref(list_size)))
1574
if not bool(cert_list) and list_size.value != 0:
1575
raise gnutls.errors.GNUTLSError("error getting peer"
1577
if list_size.value == 0:
79
if self.checker is None:
81
os.kill(self.checker.pid, signal.SIGTERM)
82
if self.checker.poll() is None:
83
os.kill(self.checker.pid, signal.SIGKILL)
85
__del__ = stop_checker
87
if self.checker is None:
1580
return ctypes.string_at(cert.data, cert.size)
1583
def fingerprint(openpgp):
1584
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1585
# New GnuTLS "datum" with the OpenPGP public key
1586
datum = (gnutls.library.types
1587
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1590
ctypes.c_uint(len(openpgp))))
1591
# New empty GnuTLS certificate
1592
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1593
(gnutls.library.functions
1594
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1595
# Import the OpenPGP public key into the certificate
1596
(gnutls.library.functions
1597
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1598
gnutls.library.constants
1599
.GNUTLS_OPENPGP_FMT_RAW))
1600
# Verify the self signature in the key
1601
crtverify = ctypes.c_uint()
1602
(gnutls.library.functions
1603
.gnutls_openpgp_crt_verify_self(crt, 0,
1604
ctypes.byref(crtverify)))
1605
if crtverify.value != 0:
1606
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1607
raise (gnutls.errors.CertificateSecurityError
1609
# New buffer for the fingerprint
1610
buf = ctypes.create_string_buffer(20)
1611
buf_len = ctypes.c_size_t()
1612
# Get the fingerprint from the certificate into the buffer
1613
(gnutls.library.functions
1614
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1615
ctypes.byref(buf_len)))
1616
# Deinit the certificate
1617
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1618
# Convert the buffer to a Python bytestring
1619
fpr = ctypes.string_at(buf, buf_len.value)
1620
# Convert the bytestring to hexadecimal notation
1621
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1625
class MultiprocessingMixIn(object):
1626
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1627
def sub_process_main(self, request, address):
1629
self.finish_request(request, address)
1631
self.handle_error(request, address)
1632
self.close_request(request)
1634
def process_request(self, request, address):
1635
"""Start a new process to process the request."""
1636
proc = multiprocessing.Process(target = self.sub_process_main,
1643
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1644
""" adds a pipe to the MixIn """
1645
def process_request(self, request, client_address):
1646
"""Overrides and wraps the original process_request().
1648
This function creates a new pipe in self.pipe
1650
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1652
proc = MultiprocessingMixIn.process_request(self, request,
1654
self.child_pipe.close()
1655
self.add_pipe(parent_pipe, proc)
1657
def add_pipe(self, parent_pipe, proc):
1658
"""Dummy function; override as necessary"""
1659
raise NotImplementedError
1662
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1663
socketserver.TCPServer, object):
1664
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1667
enabled: Boolean; whether this server is activated yet
1668
interface: None or a network interface name (string)
1669
use_ipv6: Boolean; to use IPv6 or not
1671
def __init__(self, server_address, RequestHandlerClass,
1672
interface=None, use_ipv6=True):
1673
self.interface = interface
1675
self.address_family = socket.AF_INET6
1676
socketserver.TCPServer.__init__(self, server_address,
1677
RequestHandlerClass)
1678
def server_bind(self):
1679
"""This overrides the normal server_bind() function
1680
to bind to an interface if one was specified, and also NOT to
1681
bind to an address or port if they were not specified."""
1682
if self.interface is not None:
1683
if SO_BINDTODEVICE is None:
1684
logger.error("SO_BINDTODEVICE does not exist;"
1685
" cannot bind to interface %s",
89
return self.checker.stdout.fileno()
91
"""The time when something must be done about this client
92
May be in the past."""
93
if self.last_seen is None:
94
# This client has never been seen
95
next_timeout = self.created + self.timeout
97
next_timeout = self.last_seen + self.timeout
98
if self.checker is None:
99
return min(next_timeout, self.next_check)
102
def still_valid(self, now=None):
103
"""Has this client's timeout not passed?"""
105
now = datetime.datetime.now()
106
if self.last_seen is None:
107
return now < (self.created + self.timeout)
109
return now < (self.last_seen + self.timeout)
110
def it_is_time_to_check(self, now=None):
112
now = datetime.datetime.now()
113
return self.next_check <= now
116
class server_metaclass(type):
117
"Common behavior for the UDP and TCP server classes"
118
def __new__(cls, name, bases, attrs):
119
attrs["address_family"] = socket.AF_INET6
120
attrs["allow_reuse_address"] = True
121
def server_bind(self):
122
if self.options.interface:
123
if not hasattr(socket, "SO_BINDTODEVICE"):
124
# From /usr/include/asm-i486/socket.h
125
socket.SO_BINDTODEVICE = 25
1689
127
self.socket.setsockopt(socket.SOL_SOCKET,
1693
except socket.error as error:
128
socket.SO_BINDTODEVICE,
129
self.options.interface)
130
except socket.error, error:
1694
131
if error[0] == errno.EPERM:
1695
logger.error("No permission to"
1696
" bind to interface %s",
1698
elif error[0] == errno.ENOPROTOOPT:
1699
logger.error("SO_BINDTODEVICE not available;"
1700
" cannot bind to interface %s",
132
print "Warning: No permission to bind to interface", \
133
self.options.interface
1704
# Only bind(2) the socket if we really need to.
1705
if self.server_address[0] or self.server_address[1]:
1706
if not self.server_address[0]:
1707
if self.address_family == socket.AF_INET6:
1708
any_address = "::" # in6addr_any
1710
any_address = socket.INADDR_ANY
1711
self.server_address = (any_address,
1712
self.server_address[1])
1713
elif not self.server_address[1]:
1714
self.server_address = (self.server_address[0],
1716
# if self.interface:
1717
# self.server_address = (self.server_address[0],
1722
return socketserver.TCPServer.server_bind(self)
1725
class MandosServer(IPv6_TCPServer):
1729
clients: set of Client objects
1730
gnutls_priority GnuTLS priority string
1731
use_dbus: Boolean; to emit D-Bus signals or not
1733
Assumes a gobject.MainLoop event loop.
1735
def __init__(self, server_address, RequestHandlerClass,
1736
interface=None, use_ipv6=True, clients=None,
1737
gnutls_priority=None, use_dbus=True):
1738
self.enabled = False
1739
self.clients = clients
1740
if self.clients is None:
1742
self.use_dbus = use_dbus
1743
self.gnutls_priority = gnutls_priority
1744
IPv6_TCPServer.__init__(self, server_address,
1745
RequestHandlerClass,
1746
interface = interface,
1747
use_ipv6 = use_ipv6)
1748
def server_activate(self):
1750
return socketserver.TCPServer.server_activate(self)
1755
def add_pipe(self, parent_pipe, proc):
1756
# Call "handle_ipc" for both data and EOF events
1757
gobject.io_add_watch(parent_pipe.fileno(),
1758
gobject.IO_IN | gobject.IO_HUP,
1759
functools.partial(self.handle_ipc,
1764
def handle_ipc(self, source, condition, parent_pipe=None,
1765
proc = None, client_object=None):
1767
gobject.IO_IN: "IN", # There is data to read.
1768
gobject.IO_OUT: "OUT", # Data can be written (without
1770
gobject.IO_PRI: "PRI", # There is urgent data to read.
1771
gobject.IO_ERR: "ERR", # Error condition.
1772
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1773
# broken, usually for pipes and
1776
conditions_string = ' | '.join(name
1778
condition_names.iteritems()
1779
if cond & condition)
1780
# error, or the other end of multiprocessing.Pipe has closed
1781
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1782
# Wait for other process to exit
1786
# Read a request from the child
1787
request = parent_pipe.recv()
1788
command = request[0]
1790
if command == 'init':
1792
address = request[2]
1794
for c in self.clients.itervalues():
1795
if c.fingerprint == fpr:
1799
logger.info("Client not found for fingerprint: %s, ad"
1800
"dress: %s", fpr, address)
1803
mandos_dbus_service.ClientNotFound(fpr,
1805
parent_pipe.send(False)
1808
gobject.io_add_watch(parent_pipe.fileno(),
1809
gobject.IO_IN | gobject.IO_HUP,
1810
functools.partial(self.handle_ipc,
1816
parent_pipe.send(True)
1817
# remove the old hook in favor of the new above hook on
1820
if command == 'funcall':
1821
funcname = request[1]
1825
parent_pipe.send(('data', getattr(client_object,
1829
if command == 'getattr':
1830
attrname = request[1]
1831
if callable(client_object.__getattribute__(attrname)):
1832
parent_pipe.send(('function',))
1834
parent_pipe.send(('data', client_object
1835
.__getattribute__(attrname)))
1837
if command == 'setattr':
1838
attrname = request[1]
1840
setattr(client_object, attrname, value)
136
return super(type(self), self).server_bind()
137
attrs["server_bind"] = server_bind
138
def init(self, *args, **kwargs):
139
if "options" in kwargs:
140
self.options = kwargs["options"]
141
del kwargs["options"]
142
if "clients" in kwargs:
143
self.clients = kwargs["clients"]
144
del kwargs["clients"]
145
if "credentials" in kwargs:
146
self.credentials = kwargs["credentials"]
147
del kwargs["credentials"]
148
return super(type(self), self).__init__(*args, **kwargs)
149
attrs["__init__"] = init
150
return type.__new__(cls, name, bases, attrs)
153
class udp_handler(SocketServer.DatagramRequestHandler, object):
155
self.wfile.write("Polo")
156
print "UDP request answered"
159
class IPv6_UDPServer(SocketServer.UDPServer, object):
160
__metaclass__ = server_metaclass
161
def verify_request(self, request, client_address):
162
print "UDP request came"
163
return request[0] == "Marco"
166
class tcp_handler(SocketServer.BaseRequestHandler, object):
168
print "TCP request came"
169
print "Request:", self.request
170
print "Client Address:", self.client_address
171
print "Server:", self.server
172
session = gnutls.connection.ServerSession(self.request,
173
self.server.credentials)
175
if session.peer_certificate:
176
print "DN:", session.peer_certificate.subject
178
session.verify_peer()
179
except gnutls.errors.CertificateError, error:
180
print "Verify failed", error
184
session.send([client.password
185
for client in self.server.clients
187
session.peer_certificate.subject)][0])
189
session.send("gazonk")
194
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
195
__metaclass__ = server_metaclass
1845
198
def string_to_delta(interval):
1846
199
"""Parse a string and return a datetime.timedelta
1848
201
>>> string_to_delta('7d')
1849
202
datetime.timedelta(7)
1850
203
>>> string_to_delta('60s')
1853
206
datetime.timedelta(0, 3600)
1854
207
>>> string_to_delta('24h')
1855
208
datetime.timedelta(1)
1856
>>> string_to_delta('1w')
209
>>> string_to_delta(u'1w')
1857
210
datetime.timedelta(7)
1858
>>> string_to_delta('5m 30s')
1859
datetime.timedelta(0, 330)
1861
timevalue = datetime.timedelta(0)
1862
for s in interval.split():
1864
suffix = unicode(s[-1])
1867
delta = datetime.timedelta(value)
1869
delta = datetime.timedelta(0, value)
1871
delta = datetime.timedelta(0, 0, 0, 0, value)
1873
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1875
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1877
raise ValueError("Unknown suffix %r" % suffix)
1878
except (ValueError, IndexError) as e:
1879
raise ValueError(*(e.args))
1884
def daemon(nochdir = False, noclose = False):
1885
"""See daemon(3). Standard BSD Unix function.
1887
This should really exist as os.daemon, but it doesn't (yet)."""
1896
# Close all standard open file descriptors
1897
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1898
if not stat.S_ISCHR(os.fstat(null).st_mode):
1899
raise OSError(errno.ENODEV,
1900
"%s not a character device"
1902
os.dup2(null, sys.stdin.fileno())
1903
os.dup2(null, sys.stdout.fileno())
1904
os.dup2(null, sys.stderr.fileno())
213
suffix=unicode(interval[-1])
214
value=int(interval[:-1])
216
delta = datetime.timedelta(value)
218
delta = datetime.timedelta(0, value)
220
delta = datetime.timedelta(0, 0, 0, 0, value)
222
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
224
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
227
except (ValueError, IndexError):
1911
##################################################################
1912
# Parsing of options, both command line and config file
1914
parser = argparse.ArgumentParser()
1915
parser.add_argument("-v", "--version", action="version",
1916
version = "%%(prog)s %s" % version,
1917
help="show version number and exit")
1918
parser.add_argument("-i", "--interface", metavar="IF",
1919
help="Bind to interface IF")
1920
parser.add_argument("-a", "--address",
1921
help="Address to listen for requests on")
1922
parser.add_argument("-p", "--port", type=int,
1923
help="Port number to receive requests on")
1924
parser.add_argument("--check", action="store_true",
1925
help="Run self-test")
1926
parser.add_argument("--debug", action="store_true",
1927
help="Debug mode; run in foreground and log"
1929
parser.add_argument("--debuglevel", metavar="LEVEL",
1930
help="Debug level for stdout output")
1931
parser.add_argument("--priority", help="GnuTLS"
1932
" priority string (see GnuTLS documentation)")
1933
parser.add_argument("--servicename",
1934
metavar="NAME", help="Zeroconf service name")
1935
parser.add_argument("--configdir",
1936
default="/etc/mandos", metavar="DIR",
1937
help="Directory to search for configuration"
1939
parser.add_argument("--no-dbus", action="store_false",
1940
dest="use_dbus", help="Do not provide D-Bus"
1941
" system bus interface")
1942
parser.add_argument("--no-ipv6", action="store_false",
1943
dest="use_ipv6", help="Do not use IPv6")
1944
parser.add_argument("--no-restore", action="store_false",
1945
dest="restore", help="Do not restore stored"
1946
" state", default=True)
1948
options = parser.parse_args()
233
parser = OptionParser()
234
parser.add_option("-i", "--interface", type="string",
235
default="eth0", metavar="IF",
236
help="Interface to bind to")
237
parser.add_option("--cert", type="string", default="cert.pem",
239
help="Public key certificate to use")
240
parser.add_option("--key", type="string", default="key.pem",
242
help="Private key to use")
243
parser.add_option("--ca", type="string", default="ca.pem",
245
help="Certificate Authority certificate to use")
246
parser.add_option("--crl", type="string", default="crl.pem",
248
help="Certificate Revokation List to use")
249
parser.add_option("-p", "--port", type="int", default=49001,
250
help="Port number to receive requests on")
251
parser.add_option("--dh", type="int", metavar="BITS",
252
help="DH group to use")
253
parser.add_option("-t", "--timeout", type="string", # Parsed later
255
help="Amount of downtime allowed for clients")
256
parser.add_option("--interval", type="string", # Parsed later
258
help="How often to check that a client is up")
259
parser.add_option("--check", action="store_true", default=False,
260
help="Run self-test")
261
(options, args) = parser.parse_args()
1950
263
if options.check:
1952
265
doctest.testmod()
1955
# Default values for config file for server-global settings
1956
server_defaults = { "interface": "",
1961
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1962
"servicename": "Mandos",
1968
# Parse config file for server-global settings
1969
server_config = configparser.SafeConfigParser(server_defaults)
1971
server_config.read(os.path.join(options.configdir,
1973
# Convert the SafeConfigParser object to a dict
1974
server_settings = server_config.defaults()
1975
# Use the appropriate methods on the non-string config options
1976
for option in ("debug", "use_dbus", "use_ipv6"):
1977
server_settings[option] = server_config.getboolean("DEFAULT",
1979
if server_settings["port"]:
1980
server_settings["port"] = server_config.getint("DEFAULT",
1984
# Override the settings from the config file with command line
1986
for option in ("interface", "address", "port", "debug",
1987
"priority", "servicename", "configdir",
1988
"use_dbus", "use_ipv6", "debuglevel", "restore"):
1989
value = getattr(options, option)
1990
if value is not None:
1991
server_settings[option] = value
1993
# Force all strings to be unicode
1994
for option in server_settings.keys():
1995
if type(server_settings[option]) is str:
1996
server_settings[option] = unicode(server_settings[option])
1997
# Now we have our good server settings in "server_settings"
1999
##################################################################
2002
debug = server_settings["debug"]
2003
debuglevel = server_settings["debuglevel"]
2004
use_dbus = server_settings["use_dbus"]
2005
use_ipv6 = server_settings["use_ipv6"]
2008
initlogger(logging.DEBUG)
2013
level = getattr(logging, debuglevel.upper())
2016
if server_settings["servicename"] != "Mandos":
2017
syslogger.setFormatter(logging.Formatter
2018
('Mandos (%s) [%%(process)d]:'
2019
' %%(levelname)s: %%(message)s'
2020
% server_settings["servicename"]))
2022
# Parse config file with clients
2023
client_defaults = { "timeout": "5m",
2024
"extended_timeout": "15m",
2026
"checker": "fping -q -- %%(host)s",
2028
"approval_delay": "0s",
2029
"approval_duration": "1s",
2031
client_config = configparser.SafeConfigParser(client_defaults)
2032
client_config.read(os.path.join(server_settings["configdir"],
2035
global mandos_dbus_service
2036
mandos_dbus_service = None
2038
tcp_server = MandosServer((server_settings["address"],
2039
server_settings["port"]),
2041
interface=(server_settings["interface"]
2045
server_settings["priority"],
2048
pidfilename = "/var/run/mandos.pid"
2050
pidfile = open(pidfilename, "w")
2052
logger.error("Could not open file %r", pidfilename)
2055
uid = pwd.getpwnam("_mandos").pw_uid
2056
gid = pwd.getpwnam("_mandos").pw_gid
2059
uid = pwd.getpwnam("mandos").pw_uid
2060
gid = pwd.getpwnam("mandos").pw_gid
2063
uid = pwd.getpwnam("nobody").pw_uid
2064
gid = pwd.getpwnam("nobody").pw_gid
2071
except OSError as error:
2072
if error[0] != errno.EPERM:
2076
# Enable all possible GnuTLS debugging
2078
# "Use a log level over 10 to enable all debugging options."
2080
gnutls.library.functions.gnutls_global_set_log_level(11)
2082
@gnutls.library.types.gnutls_log_func
2083
def debug_gnutls(level, string):
2084
logger.debug("GnuTLS: %s", string[:-1])
2086
(gnutls.library.functions
2087
.gnutls_global_set_log_function(debug_gnutls))
2089
# Redirect stdin so all checkers get /dev/null
2090
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2091
os.dup2(null, sys.stdin.fileno())
2095
# No console logging
2096
logger.removeHandler(console)
2098
# Need to fork before connecting to D-Bus
2100
# Close all input and output, do double fork, etc.
2104
# From the Avahi example code
2105
DBusGMainLoop(set_as_default=True )
2106
main_loop = gobject.MainLoop()
2107
bus = dbus.SystemBus()
2108
# End of Avahi example code
2111
bus_name = dbus.service.BusName("se.recompile.Mandos",
2112
bus, do_not_queue=True)
2113
old_bus_name = (dbus.service.BusName
2114
("se.bsnet.fukt.Mandos", bus,
2116
except dbus.exceptions.NameExistsException as e:
2117
logger.error(unicode(e) + ", disabling D-Bus")
2119
server_settings["use_dbus"] = False
2120
tcp_server.use_dbus = False
2121
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2122
service = AvahiServiceToSyslog(name =
2123
server_settings["servicename"],
2124
servicetype = "_mandos._tcp",
2125
protocol = protocol, bus = bus)
2126
if server_settings["interface"]:
2127
service.interface = (if_nametoindex
2128
(str(server_settings["interface"])))
2130
global multiprocessing_manager
2131
multiprocessing_manager = multiprocessing.Manager()
2133
client_class = Client
2135
client_class = functools.partial(ClientDBusTransitional,
2138
special_settings = {
2139
# Some settings need to be accessd by special methods;
2140
# booleans need .getboolean(), etc. Here is a list of them:
2141
"approved_by_default":
2143
client_config.getboolean(section, "approved_by_default"),
2145
# Construct a new dict of client settings of this form:
2146
# { client_name: {setting_name: value, ...}, ...}
2147
# with exceptions for any special settings as defined above
2148
client_settings = dict((clientname,
2151
if setting not in special_settings
2152
else special_settings[setting]
2154
for setting, value in
2155
client_config.items(clientname)))
2156
for clientname in client_config.sections())
2158
old_client_settings = {}
2161
# Get client data and settings from last running state.
2162
if server_settings["restore"]:
2164
with open(stored_state_path, "rb") as stored_state:
2165
clients_data, old_client_settings = (pickle.load
2167
os.remove(stored_state_path)
2168
except IOError as e:
2169
logger.warning("Could not load persistant state: {0}"
2171
if e.errno != errno.ENOENT:
2174
for client in clients_data:
2175
client_name = client["name"]
2177
# Decide which value to use after restoring saved state.
2178
# We have three different values: Old config file,
2179
# new config file, and saved state.
2180
# New config value takes precedence if it differs from old
2181
# config value, otherwise use saved state.
2182
for name, value in client_settings[client_name].items():
2184
# For each value in new config, check if it differs
2185
# from the old config value (Except for the "secret"
2187
if (name != "secret" and
2188
value != old_client_settings[client_name][name]):
2189
setattr(client, name, value)
2193
# Clients who has passed its expire date, can still be enabled
2194
# if its last checker was sucessful. Clients who checkers
2195
# failed before we stored it state is asumed to had failed
2196
# checker during downtime.
2197
if client["enabled"] and client["last_checked_ok"]:
2198
if ((datetime.datetime.utcnow()
2199
- client["last_checked_ok"]) > client["interval"]):
2200
if client["last_checker_status"] != 0:
2201
client["enabled"] = False
2203
client["expires"] = (datetime.datetime.utcnow()
2204
+ client["timeout"])
2206
client["changedstate"] = (multiprocessing_manager
2207
.Condition(multiprocessing_manager
2210
new_client = (ClientDBusTransitional.__new__
2211
(ClientDBusTransitional))
2212
tcp_server.clients[client_name] = new_client
2213
new_client.bus = bus
2214
for name, value in client.iteritems():
2215
setattr(new_client, name, value)
2216
client_object_name = unicode(client_name).translate(
2217
{ord("."): ord("_"),
2218
ord("-"): ord("_")})
2219
new_client.dbus_object_path = (dbus.ObjectPath
2221
+ client_object_name))
2222
DBusObjectWithProperties.__init__(new_client,
2227
tcp_server.clients[client_name] = Client.__new__(Client)
2228
for name, value in client.iteritems():
2229
setattr(tcp_server.clients[client_name], name, value)
2231
tcp_server.clients[client_name].decrypt_secret(
2232
client_settings[client_name]["secret"])
2234
# Create/remove clients based on new changes made to config
2235
for clientname in set(old_client_settings) - set(client_settings):
2236
del tcp_server.clients[clientname]
2237
for clientname in set(client_settings) - set(old_client_settings):
2238
tcp_server.clients[clientname] = (client_class(name
2244
if not tcp_server.clients:
2245
logger.warning("No clients defined")
2251
pidfile.write(str(pid) + "\n".encode("utf-8"))
2254
logger.error("Could not write to file %r with PID %d",
2257
# "pidfile" was never created
2261
signal.signal(signal.SIGINT, signal.SIG_IGN)
2263
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2264
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2267
class MandosDBusService(dbus.service.Object):
2268
"""A D-Bus proxy object"""
2270
dbus.service.Object.__init__(self, bus, "/")
2271
_interface = "se.recompile.Mandos"
2273
@dbus.service.signal(_interface, signature="o")
2274
def ClientAdded(self, objpath):
2278
@dbus.service.signal(_interface, signature="ss")
2279
def ClientNotFound(self, fingerprint, address):
2283
@dbus.service.signal(_interface, signature="os")
2284
def ClientRemoved(self, objpath, name):
2288
@dbus.service.method(_interface, out_signature="ao")
2289
def GetAllClients(self):
2291
return dbus.Array(c.dbus_object_path
2293
tcp_server.clients.itervalues())
2295
@dbus.service.method(_interface,
2296
out_signature="a{oa{sv}}")
2297
def GetAllClientsWithProperties(self):
2299
return dbus.Dictionary(
2300
((c.dbus_object_path, c.GetAll(""))
2301
for c in tcp_server.clients.itervalues()),
2304
@dbus.service.method(_interface, in_signature="o")
2305
def RemoveClient(self, object_path):
2307
for c in tcp_server.clients.itervalues():
2308
if c.dbus_object_path == object_path:
2309
del tcp_server.clients[c.name]
2310
c.remove_from_connection()
2311
# Don't signal anything except ClientRemoved
2312
c.disable(quiet=True)
2314
self.ClientRemoved(object_path, c.name)
2316
raise KeyError(object_path)
2320
class MandosDBusServiceTransitional(MandosDBusService):
2321
__metaclass__ = AlternateDBusNamesMetaclass
2322
mandos_dbus_service = MandosDBusServiceTransitional()
2325
"Cleanup function; run on exit"
2328
multiprocessing.active_children()
2329
if not (tcp_server.clients or client_settings):
2332
# Store client before exiting. Secrets are encrypted with key
2333
# based on what config file has. If config file is
2334
# removed/edited, old secret will thus be unrecovable.
2336
for client in tcp_server.clients.itervalues():
2337
client.encrypt_secret(client_settings[client.name]
2342
# A list of attributes that will not be stored when
2344
exclude = set(("bus", "changedstate", "secret"))
2345
for name, typ in inspect.getmembers(dbus.service.Object):
2348
client_dict["encrypted_secret"] = client.encrypted_secret
2349
for attr in client.client_structure:
2350
if attr not in exclude:
2351
client_dict[attr] = getattr(client, attr)
2353
clients.append(client_dict)
2354
del client_settings[client.name]["secret"]
2357
with os.fdopen(os.open(stored_state_path,
2358
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2359
0600), "wb") as stored_state:
2360
pickle.dump((clients, client_settings), stored_state)
2361
except IOError as e:
2362
logger.warning("Could not save persistant state: {0}"
2364
if e.errno != errno.ENOENT:
2367
# Delete all clients, and settings from config
2368
while tcp_server.clients:
2369
name, client = tcp_server.clients.popitem()
2371
client.remove_from_connection()
2372
# Don't signal anything except ClientRemoved
2373
client.disable(quiet=True)
2376
mandos_dbus_service.ClientRemoved(client
2379
client_settings.clear()
2381
atexit.register(cleanup)
2383
for client in tcp_server.clients.itervalues():
2386
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2387
# Need to initiate checking of clients
2389
client.init_checker()
2393
tcp_server.server_activate()
2395
# Find out what port we got
2396
service.port = tcp_server.socket.getsockname()[1]
2398
logger.info("Now listening on address %r, port %d,"
2399
" flowinfo %d, scope_id %d"
2400
% tcp_server.socket.getsockname())
2402
logger.info("Now listening on address %r, port %d"
2403
% tcp_server.socket.getsockname())
2405
#service.interface = tcp_server.socket.getsockname()[3]
2408
# From the Avahi example code
2411
except dbus.exceptions.DBusException as error:
2412
logger.critical("DBusException: %s", error)
2415
# End of Avahi example code
2417
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2418
lambda *args, **kwargs:
2419
(tcp_server.handle_request
2420
(*args[2:], **kwargs) or True))
2422
logger.debug("Starting main loop")
2424
except AvahiError as error:
2425
logger.critical("AvahiError: %s", error)
2428
except KeyboardInterrupt:
2430
print("", file=sys.stderr)
2431
logger.debug("Server received KeyboardInterrupt")
2432
logger.debug("Server exiting")
2433
# Must run before the D-Bus bus name gets deregistered
2437
if __name__ == '__main__':
268
# Parse the time arguments
270
options.timeout = string_to_delta(options.timeout)
272
parser.error("option --timeout: Unparseable time")
275
options.interval = string_to_delta(options.interval)
277
parser.error("option --interval: Unparseable time")
279
cert = gnutls.crypto.X509Certificate(open(options.cert).read())
280
key = gnutls.crypto.X509PrivateKey(open(options.key).read())
281
ca = gnutls.crypto.X509Certificate(open(options.ca).read())
282
crl = gnutls.crypto.X509CRL(open(options.crl).read())
283
cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
287
client_config_object = ConfigParser.SafeConfigParser(defaults)
288
client_config_object.read("mandos-clients.conf")
289
clients = Set(Client(name=section, options=options,
290
**(dict(client_config_object\
292
for section in client_config_object.sections())
295
udp_server = IPv6_UDPServer((in6addr_any, options.port),
299
tcp_server = IPv6_TCPServer((in6addr_any, options.port),
309
next_stop = min(client.next_stop() for client in clients)
310
now = datetime.datetime.now()
312
delay = next_stop - now
313
delay_seconds = (delay.days * 24 * 60 * 60
315
+ delay.microseconds / 1000000)
316
clients_with_checkers = tuple(client for client in
320
input_checks = (udp_server, tcp_server) \
321
+ clients_with_checkers
322
print "Waiting for network",
323
if clients_with_checkers:
324
print "and checkers for:",
325
for client in clients_with_checkers:
328
input, out, err = select.select(input_checks, (), (),
333
for client in clients:
334
if client.it_is_time_to_check(now=now) and \
335
client.checker is None:
336
print "Starting checker for client %(name)s" \
338
client.start_checker()
339
# delete timed-out clients
340
for client in clients.copy():
341
if not client.still_valid(now=now):
343
print "Removing client %(name)s" % vars(client)
344
clients.remove(client)
345
except KeyboardInterrupt:
349
for client in clients:
350
client.stop_checker()
353
if __name__ == "__main__":