To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.2.18
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.18
- Committer: Teddy Hogeborn
- Date: 2009-02-25 01:31:13 UTC
- mto: (24.1.170 mandos) (237.4.29 release)
- mto: This revision was merged to the branch mainline in revision 324.
- Revision ID: teddy@fukt.bsnet.se-20090225013113-mzw86kzgqrhd9rfm
Tags: version-1.0.8-1
* Makefile (version): Changed to "1.0.8".
* NEWS (Version 1.0.8): New entry.
* debian/changelog (1.0.8-1): - '' -
* NEWS (Version 1.0.8): New entry.
* debian/changelog (1.0.8-1): - '' -
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
import SocketServer as socketserver
36
import SocketServer
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
45
44
import gnutls.library.functions
46
45
import gnutls.library.constants
47
46
import gnutls.library.types
48
import ConfigParser as configparser
47
import ConfigParser
49
48
import sys
50
49
import re
51
50
import os
52
51
import signal
52
from sets import Set
53
53
import subprocess
54
54
import atexit
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
import contextlib
60
import struct
61
import fcntl
62
import functools
63
import cPickle as pickle
64
import multiprocessing
65
import types
66
import hashlib
59
from contextlib import closing
67
60
68
61
import dbus
69
62
import dbus.service
72
65
from dbus.mainloop.glib import DBusGMainLoop
73
66
import ctypes
74
67
import ctypes.util
75
import xml.dom.minidom
76
import inspect
77
import Crypto.Cipher.AES
78
79
try:
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
except AttributeError:
82
try:
83
from IN import SO_BINDTODEVICE
84
except ImportError:
85
SO_BINDTODEVICE = None
86
87
88
version = "1.4.1"
89
stored_state_path = "/var/lib/mandos/clients.pickle"
90
91
logger = logging.getLogger()
68
69
version = "1.0.8"
70
71
logger = logging.Logger('mandos')
92
72
syslogger = (logging.handlers.SysLogHandler
93
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
123
' [%(process)d]:'
124
' %(levelname)s:'
125
' %(message)s'))
126
logger.addHandler(console)
127
logger.setLevel(level)
128
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
78
logger.addHandler(syslogger)
79
80
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
83
logger.addHandler(console)
129
84
130
85
class AvahiError(Exception):
131
86
def __init__(self, value, *args, **kwargs):
143
98
144
99
class AvahiService(object):
145
100
"""An Avahi (Zeroconf) service.
146
147
101
Attributes:
148
102
interface: integer; avahi.IF_UNSPEC or an interface index.
149
103
Used to optionally bind to the specified interface.
157
111
max_renames: integer; maximum number of renames
158
112
rename_count: integer; counter so we only rename after collisions
159
113
a sensible number of times
160
group: D-Bus Entry Group
161
server: D-Bus Server
162
bus: dbus.SystemBus()
163
114
"""
164
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
165
116
servicetype = None, port = None, TXT = None,
166
117
domain = "", host = "", max_renames = 32768,
167
protocol = avahi.PROTO_UNSPEC, bus = None):
118
protocol = avahi.PROTO_UNSPEC):
168
119
self.interface = interface
169
120
self.name = name
170
121
self.type = servicetype
175
126
self.rename_count = 0
176
127
self.max_renames = max_renames
177
128
self.protocol = protocol
178
self.group = None # our entry group
179
self.server = None
180
self.bus = bus
181
self.entry_group_state_changed_match = None
182
129
def rename(self):
183
130
"""Derived from the Avahi example code"""
184
131
if self.rename_count >= self.max_renames:
185
logger.critical("No suitable Zeroconf service name found"
186
" after %i retries, exiting.",
132
logger.critical(u"No suitable Zeroconf service name found"
133
u" after %i retries, exiting.",
187
134
self.rename_count)
188
raise AvahiServiceError("Too many renames")
189
self.name = unicode(self.server
190
.GetAlternativeServiceName(self.name))
191
logger.info("Changing Zeroconf service name to %r ...",
192
self.name)
135
raise AvahiServiceError(u"Too many renames")
136
self.name = server.GetAlternativeServiceName(self.name)
137
logger.info(u"Changing Zeroconf service name to %r ...",
138
str(self.name))
139
syslogger.setFormatter(logging.Formatter
140
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
193
142
self.remove()
194
try:
195
self.add()
196
except dbus.exceptions.DBusException as error:
197
logger.critical("DBusException: %s", error)
198
self.cleanup()
199
os._exit(1)
143
self.add()
200
144
self.rename_count += 1
201
145
def remove(self):
202
146
"""Derived from the Avahi example code"""
203
if self.entry_group_state_changed_match is not None:
204
self.entry_group_state_changed_match.remove()
205
self.entry_group_state_changed_match = None
206
if self.group is not None:
207
self.group.Reset()
147
if group is not None:
148
group.Reset()
208
149
def add(self):
209
150
"""Derived from the Avahi example code"""
210
self.remove()
211
if self.group is None:
212
self.group = dbus.Interface(
213
self.bus.get_object(avahi.DBUS_NAME,
214
self.server.EntryGroupNew()),
215
avahi.DBUS_INTERFACE_ENTRY_GROUP)
216
self.entry_group_state_changed_match = (
217
self.group.connect_to_signal(
218
'StateChanged', self.entry_group_state_changed))
219
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
220
self.name, self.type)
221
self.group.AddService(
222
self.interface,
223
self.protocol,
224
dbus.UInt32(0), # flags
225
self.name, self.type,
226
self.domain, self.host,
227
dbus.UInt16(self.port),
228
avahi.string_array_to_txt_array(self.TXT))
229
self.group.Commit()
230
def entry_group_state_changed(self, state, error):
231
"""Derived from the Avahi example code"""
232
logger.debug("Avahi entry group state change: %i", state)
233
234
if state == avahi.ENTRY_GROUP_ESTABLISHED:
235
logger.debug("Zeroconf service established.")
236
elif state == avahi.ENTRY_GROUP_COLLISION:
237
logger.info("Zeroconf service name collision.")
238
self.rename()
239
elif state == avahi.ENTRY_GROUP_FAILURE:
240
logger.critical("Avahi: Error in group state changed %s",
241
unicode(error))
242
raise AvahiGroupError("State changed: %s"
243
% unicode(error))
244
def cleanup(self):
245
"""Derived from the Avahi example code"""
246
if self.group is not None:
247
try:
248
self.group.Free()
249
except (dbus.exceptions.UnknownMethodException,
250
dbus.exceptions.DBusException):
251
pass
252
self.group = None
253
self.remove()
254
def server_state_changed(self, state, error=None):
255
"""Derived from the Avahi example code"""
256
logger.debug("Avahi server state change: %i", state)
257
bad_states = { avahi.SERVER_INVALID:
258
"Zeroconf server invalid",
259
avahi.SERVER_REGISTERING: None,
260
avahi.SERVER_COLLISION:
261
"Zeroconf server name collision",
262
avahi.SERVER_FAILURE:
263
"Zeroconf server failure" }
264
if state in bad_states:
265
if bad_states[state] is not None:
266
if error is None:
267
logger.error(bad_states[state])
268
else:
269
logger.error(bad_states[state] + ": %r", error)
270
self.cleanup()
271
elif state == avahi.SERVER_RUNNING:
272
self.add()
273
else:
274
if error is None:
275
logger.debug("Unknown state: %r", state)
276
else:
277
logger.debug("Unknown state: %r: %r", state, error)
278
def activate(self):
279
"""Derived from the Avahi example code"""
280
if self.server is None:
281
self.server = dbus.Interface(
282
self.bus.get_object(avahi.DBUS_NAME,
283
avahi.DBUS_PATH_SERVER,
284
follow_name_owner_changes=True),
285
avahi.DBUS_INTERFACE_SERVER)
286
self.server.connect_to_signal("StateChanged",
287
self.server_state_changed)
288
self.server_state_changed(self.server.GetState())
289
290
class AvahiServiceToSyslog(AvahiService):
291
def rename(self):
292
"""Add the new name to the syslog messages"""
293
ret = AvahiService.rename(self)
294
syslogger.setFormatter(logging.Formatter
295
('Mandos (%s) [%%(process)d]:'
296
' %%(levelname)s: %%(message)s'
297
% self.name))
298
return ret
299
300
def _timedelta_to_milliseconds(td):
301
"Convert a datetime.timedelta() to milliseconds"
302
return ((td.days * 24 * 60 * 60 * 1000)
303
+ (td.seconds * 1000)
304
+ (td.microseconds // 1000))
305
306
class Client(object):
151
global group
152
if group is None:
153
group = dbus.Interface(bus.get_object
154
(avahi.DBUS_NAME,
155
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
group.connect_to_signal('StateChanged',
158
entry_group_state_changed)
159
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
service.name, service.type)
161
group.AddService(
162
self.interface, # interface
163
self.protocol, # protocol
164
dbus.UInt32(0), # flags
165
self.name, self.type,
166
self.domain, self.host,
167
dbus.UInt16(self.port),
168
avahi.string_array_to_txt_array(self.TXT))
169
group.Commit()
170
171
# From the Avahi example code:
172
group = None # our entry group
173
# End of Avahi example code
174
175
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
class Client(dbus.service.Object):
307
182
"""A representation of a client host served by this server.
308
309
183
Attributes:
310
_approved: bool(); 'None' if not yet approved/disapproved
311
approval_delay: datetime.timedelta(); Time to wait for approval
312
approval_duration: datetime.timedelta(); Duration of one approval
184
name: string; from the config file, used in log messages and
185
D-Bus identifiers
186
fingerprint: string (40 or 32 hexadecimal digits); used to
187
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
192
enabled: bool()
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
313
198
checker: subprocess.Popen(); a running checker process used
314
199
to see if the client lives.
315
200
'None' if no process is running.
316
checker_callback_tag: a gobject event source tag, or None
317
checker_command: string; External command which is run to check
318
if client lives. %() expansions are done at
201
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
203
checker_callback_tag: - '' -
204
checker_command: string; External command which is run to check if
205
client lives. %() expansions are done at
319
206
runtime with vars(self) as dict, so that for
320
207
instance %(name)s can be used in the command.
321
checker_initiator_tag: a gobject event source tag, or None
322
created: datetime.datetime(); (UTC) object creation
323
client_structure: Object describing what attributes a client has
324
and is used for storing the client at exit
325
208
current_checker_command: string; current running checker_command
326
disable_initiator_tag: a gobject event source tag, or None
327
enabled: bool()
328
fingerprint: string (40 or 32 hexadecimal digits); used to
329
uniquely identify the client
330
host: string; available for use by the checker command
331
interval: datetime.timedelta(); How often to start a new checker
332
last_approval_request: datetime.datetime(); (UTC) or None
333
last_checked_ok: datetime.datetime(); (UTC) or None
334
335
last_checker_status: integer between 0 and 255 reflecting exit
336
status of last checker. -1 reflects crashed
337
checker, or None.
338
last_enabled: datetime.datetime(); (UTC)
339
name: string; from the config file, used in log messages and
340
D-Bus identifiers
341
secret: bytestring; sent verbatim (over TLS) to client
342
timeout: datetime.timedelta(); How long from last_checked_ok
343
until this client is disabled
344
extended_timeout: extra long timeout when password has been sent
345
runtime_expansions: Allowed attributes for runtime expansion.
346
expires: datetime.datetime(); time (UTC) when a client will be
347
disabled, or None
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
348
211
"""
349
350
runtime_expansions = ("approval_delay", "approval_duration",
351
"created", "enabled", "fingerprint",
352
"host", "interval", "last_checked_ok",
353
"last_enabled", "name", "timeout")
354
355
212
def timeout_milliseconds(self):
356
213
"Return the 'timeout' attribute in milliseconds"
357
return _timedelta_to_milliseconds(self.timeout)
358
359
def extended_timeout_milliseconds(self):
360
"Return the 'extended_timeout' attribute in milliseconds"
361
return _timedelta_to_milliseconds(self.extended_timeout)
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
362
217
363
218
def interval_milliseconds(self):
364
219
"Return the 'interval' attribute in milliseconds"
365
return _timedelta_to_milliseconds(self.interval)
366
367
def approval_delay_milliseconds(self):
368
return _timedelta_to_milliseconds(self.approval_delay)
369
370
def __init__(self, name = None, config=None):
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
223
224
def __init__(self, name = None, disable_hook=None, config=None,
225
use_dbus=True):
371
226
"""Note: the 'checker' key in 'config' sets the
372
227
'checker_command' attribute and *not* the 'checker'
373
228
attribute."""
374
229
self.name = name
375
230
if config is None:
376
231
config = {}
377
logger.debug("Creating client %r", self.name)
232
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
378
234
# Uppercase and remove spaces from fingerprint for later
379
235
# comparison purposes with return value from the fingerprint()
380
236
# function
381
237
self.fingerprint = (config["fingerprint"].upper()
382
.replace(" ", ""))
383
logger.debug(" Fingerprint: %s", self.fingerprint)
238
.replace(u" ", u""))
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
384
240
if "secret" in config:
385
self.secret = config["secret"].decode("base64")
241
self.secret = config["secret"].decode(u"base64")
386
242
elif "secfile" in config:
387
with open(os.path.expanduser(os.path.expandvars
388
(config["secfile"])),
389
"rb") as secfile:
243
with closing(open(os.path.expanduser
244
(os.path.expandvars
245
(config["secfile"])))) as secfile:
390
246
self.secret = secfile.read()
391
247
else:
392
raise TypeError("No secret or secfile for client %s"
248
raise TypeError(u"No secret or secfile for client %s"
393
249
% self.name)
394
250
self.host = config.get("host", "")
395
251
self.created = datetime.datetime.utcnow()
396
self.enabled = True
397
self.last_approval_request = None
398
self.last_enabled = datetime.datetime.utcnow()
252
self.enabled = False
253
self.last_enabled = None
399
254
self.last_checked_ok = None
400
self.last_checker_status = None
401
255
self.timeout = string_to_delta(config["timeout"])
402
self.extended_timeout = string_to_delta(config
403
["extended_timeout"])
404
256
self.interval = string_to_delta(config["interval"])
257
self.disable_hook = disable_hook
405
258
self.checker = None
406
259
self.checker_initiator_tag = None
407
260
self.disable_initiator_tag = None
408
self.expires = datetime.datetime.utcnow() + self.timeout
409
261
self.checker_callback_tag = None
410
262
self.checker_command = config["checker"]
411
263
self.current_checker_command = None
412
self._approved = None
413
self.approved_by_default = config.get("approved_by_default",
414
True)
415
self.approvals_pending = 0
416
self.approval_delay = string_to_delta(
417
config["approval_delay"])
418
self.approval_duration = string_to_delta(
419
config["approval_duration"])
420
self.changedstate = (multiprocessing_manager
421
.Condition(multiprocessing_manager
422
.Lock()))
423
self.client_structure = [attr for attr in
424
self.__dict__.iterkeys()
425
if not attr.startswith("_")]
426
self.client_structure.append("client_structure")
427
428
for name, t in inspect.getmembers(type(self),
429
lambda obj:
430
isinstance(obj,
431
property)):
432
if not name.startswith("_"):
433
self.client_structure.append(name)
434
435
# Send notice to process children that client state has changed
436
def send_changedstate(self):
437
with self.changedstate:
438
self.changedstate.notify_all()
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
266
# the D-Bus
267
self.use_dbus = use_dbus
268
if self.use_dbus:
269
self.dbus_object_path = (dbus.ObjectPath
270
("/clients/"
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
439
274
440
275
def enable(self):
441
276
"""Start this client's checker and timeout hooks"""
442
if getattr(self, "enabled", False):
443
# Already enabled
444
return
445
self.send_changedstate()
446
self.expires = datetime.datetime.utcnow() + self.timeout
277
self.last_enabled = datetime.datetime.utcnow()
278
# Schedule a new checker to be started an 'interval' from now,
279
# and every interval from then on.
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
282
self.start_checker))
283
# Also start a new checker *right now*.
284
self.start_checker()
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
447
289
self.enabled = True
448
self.last_enabled = datetime.datetime.utcnow()
449
self.init_checker()
290
if self.use_dbus:
291
# Emit D-Bus signals
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
296
variant_level=1)))
450
297
451
def disable(self, quiet=True):
298
def disable(self):
452
299
"""Disable this client."""
453
300
if not getattr(self, "enabled", False):
454
301
return False
455
if not quiet:
456
self.send_changedstate()
457
if not quiet:
458
logger.info("Disabling client %s", self.name)
302
logger.info(u"Disabling client %s", self.name)
459
303
if getattr(self, "disable_initiator_tag", False):
460
304
gobject.source_remove(self.disable_initiator_tag)
461
305
self.disable_initiator_tag = None
462
self.expires = None
463
306
if getattr(self, "checker_initiator_tag", False):
464
307
gobject.source_remove(self.checker_initiator_tag)
465
308
self.checker_initiator_tag = None
466
309
self.stop_checker()
310
if self.disable_hook:
311
self.disable_hook(self)
467
312
self.enabled = False
313
if self.use_dbus:
314
# Emit D-Bus signal
315
self.PropertyChanged(dbus.String(u"enabled"),
316
dbus.Boolean(False, variant_level=1))
468
317
# Do not run this again if called by a gobject.timeout_add
469
318
return False
470
319
471
320
def __del__(self):
321
self.disable_hook = None
472
322
self.disable()
473
323
474
def init_checker(self):
475
# Schedule a new checker to be started an 'interval' from now,
476
# and every interval from then on.
477
self.checker_initiator_tag = (gobject.timeout_add
478
(self.interval_milliseconds(),
479
self.start_checker))
480
# Schedule a disable() when 'timeout' has passed
481
self.disable_initiator_tag = (gobject.timeout_add
482
(self.timeout_milliseconds(),
483
self.disable))
484
# Also start a new checker *right now*.
485
self.start_checker()
486
487
324
def checker_callback(self, pid, condition, command):
488
325
"""The checker has completed, so take appropriate actions."""
489
326
self.checker_callback_tag = None
490
327
self.checker = None
328
if self.use_dbus:
329
# Emit D-Bus signal
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
491
332
if os.WIFEXITED(condition):
492
self.last_checker_status = os.WEXITSTATUS(condition)
493
if self.last_checker_status == 0:
494
logger.info("Checker for %(name)s succeeded",
333
exitstatus = os.WEXITSTATUS(condition)
334
if exitstatus == 0:
335
logger.info(u"Checker for %(name)s succeeded",
495
336
vars(self))
496
337
self.checked_ok()
497
338
else:
498
logger.info("Checker for %(name)s failed",
339
logger.info(u"Checker for %(name)s failed",
499
340
vars(self))
341
if self.use_dbus:
342
# Emit D-Bus signal
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
500
346
else:
501
self.last_checker_status = -1
502
logger.warning("Checker for %(name)s crashed?",
347
logger.warning(u"Checker for %(name)s crashed?",
503
348
vars(self))
349
if self.use_dbus:
350
# Emit D-Bus signal
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
504
354
505
def checked_ok(self, timeout=None):
355
def checked_ok(self):
506
356
"""Bump up the timeout for this client.
507
508
357
This should only be called when the client has been seen,
509
358
alive and well.
510
359
"""
511
if timeout is None:
512
timeout = self.timeout
513
360
self.last_checked_ok = datetime.datetime.utcnow()
514
if self.disable_initiator_tag is not None:
515
gobject.source_remove(self.disable_initiator_tag)
516
if getattr(self, "enabled", False):
517
self.disable_initiator_tag = (gobject.timeout_add
518
(_timedelta_to_milliseconds
519
(timeout), self.disable))
520
self.expires = datetime.datetime.utcnow() + timeout
521
522
def need_approval(self):
523
self.last_approval_request = datetime.datetime.utcnow()
361
gobject.source_remove(self.disable_initiator_tag)
362
self.disable_initiator_tag = (gobject.timeout_add
363
(self.timeout_milliseconds(),
364
self.disable))
365
if self.use_dbus:
366
# Emit D-Bus signal
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
370
variant_level=1)))
524
371
525
372
def start_checker(self):
526
373
"""Start a new checker subprocess if one is not running.
527
528
374
If a checker already exists, leave it running and do
529
375
nothing."""
530
376
# The reason for not killing a running checker is that if we
533
379
# client would inevitably timeout, since no checker would get
534
380
# a chance to run to completion. If we instead leave running
535
381
# checkers alone, the checker would have to take more time
536
# than 'timeout' for the client to be disabled, which is as it
537
# should be.
382
# than 'timeout' for the client to be declared invalid, which
383
# is as it should be.
538
384
539
385
# If a checker exists, make sure it is not a zombie
540
try:
386
if self.checker is not None:
541
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
542
except (AttributeError, OSError) as error:
543
if (isinstance(error, OSError)
544
and error.errno != errno.ECHILD):
545
raise error
546
else:
547
388
if pid:
548
389
logger.warning("Checker was a zombie")
549
390
gobject.source_remove(self.checker_callback_tag)
556
397
command = self.checker_command % self.host
557
398
except TypeError:
558
399
# Escape attributes for the shell
559
escaped_attrs = dict(
560
(attr,
561
re.escape(unicode(str(getattr(self, attr, "")),
562
errors=
563
'replace')))
564
for attr in
565
self.runtime_expansions)
566
400
escaped_attrs = dict((key, re.escape(str(val)))
401
for key, val in
402
vars(self).iteritems())
567
403
try:
568
404
command = self.checker_command % escaped_attrs
569
except TypeError as error:
570
logger.error('Could not format string "%s":'
571
' %s', self.checker_command, error)
405
except TypeError, error:
406
logger.error(u'Could not format string "%s":'
407
u' %s', self.checker_command, error)
572
408
return True # Try again later
573
self.current_checker_command = command
409
self.current_checker_command = command
574
410
try:
575
logger.info("Starting checker %r for %s",
411
logger.info(u"Starting checker %r for %s",
576
412
command, self.name)
577
413
# We don't need to redirect stdout and stderr, since
578
414
# in normal mode, that is already done by daemon(),
581
417
self.checker = subprocess.Popen(command,
582
418
close_fds=True,
583
419
shell=True, cwd="/")
420
if self.use_dbus:
421
# Emit D-Bus signal
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
584
426
self.checker_callback_tag = (gobject.child_watch_add
585
427
(self.checker.pid,
586
428
self.checker_callback,
591
433
if pid:
592
434
gobject.source_remove(self.checker_callback_tag)
593
435
self.checker_callback(pid, status, command)
594
except OSError as error:
595
logger.error("Failed to start subprocess: %s",
436
except OSError, error:
437
logger.error(u"Failed to start subprocess: %s",
596
438
error)
597
439
# Re-run this periodically if run by gobject.timeout_add
598
440
return True
604
446
self.checker_callback_tag = None
605
447
if getattr(self, "checker", None) is None:
606
448
return
607
logger.debug("Stopping checker for %(name)s", vars(self))
449
logger.debug(u"Stopping checker for %(name)s", vars(self))
608
450
try:
609
451
os.kill(self.checker.pid, signal.SIGTERM)
610
#time.sleep(0.5)
452
#os.sleep(0.5)
611
453
#if self.checker.poll() is None:
612
454
# os.kill(self.checker.pid, signal.SIGKILL)
613
except OSError as error:
455
except OSError, error:
614
456
if error.errno != errno.ESRCH: # No such process
615
457
raise
616
458
self.checker = None
617
618
# Encrypts a client secret and stores it in a varible
619
# encrypted_secret
620
def encrypt_secret(self, key):
621
# Encryption-key need to be of a specific size, so we hash
622
# inputed key
623
hasheng = hashlib.sha256()
624
hasheng.update(key)
625
encryptionkey = hasheng.digest()
626
627
# Create validation hash so we know at decryption if it was
628
# sucessful
629
hasheng = hashlib.sha256()
630
hasheng.update(self.secret)
631
validationhash = hasheng.digest()
632
633
# Encrypt secret
634
iv = os.urandom(Crypto.Cipher.AES.block_size)
635
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
636
Crypto.Cipher.AES.MODE_CFB,
637
iv)
638
ciphertext = ciphereng.encrypt(validationhash+self.secret)
639
self.encrypted_secret = (ciphertext, iv)
640
641
# Decrypt a encrypted client secret
642
def decrypt_secret(self, key):
643
# Decryption-key need to be of a specific size, so we hash inputed key
644
hasheng = hashlib.sha256()
645
hasheng.update(key)
646
encryptionkey = hasheng.digest()
647
648
# Decrypt encrypted secret
649
ciphertext, iv = self.encrypted_secret
650
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
651
Crypto.Cipher.AES.MODE_CFB,
652
iv)
653
plain = ciphereng.decrypt(ciphertext)
654
655
# Validate decrypted secret to know if it was succesful
656
hasheng = hashlib.sha256()
657
validationhash = plain[:hasheng.digest_size]
658
secret = plain[hasheng.digest_size:]
659
hasheng.update(secret)
660
661
# if validation fails, we use key as new secret. Otherwhise,
662
# we use the decrypted secret
663
if hasheng.digest() == validationhash:
664
self.secret = secret
665
else:
666
self.secret = key
667
del self.encrypted_secret
668
669
670
def dbus_service_property(dbus_interface, signature="v",
671
access="readwrite", byte_arrays=False):
672
"""Decorators for marking methods of a DBusObjectWithProperties to
673
become properties on the D-Bus.
674
675
The decorated method will be called with no arguments by "Get"
676
and with one argument by "Set".
677
678
The parameters, where they are supported, are the same as
679
dbus.service.method, except there is only "signature", since the
680
type from Get() and the type sent to Set() is the same.
681
"""
682
# Encoding deeply encoded byte arrays is not supported yet by the
683
# "Set" method, so we fail early here:
684
if byte_arrays and signature != "ay":
685
raise ValueError("Byte arrays not supported for non-'ay'"
686
" signature %r" % signature)
687
def decorator(func):
688
func._dbus_is_property = True
689
func._dbus_interface = dbus_interface
690
func._dbus_signature = signature
691
func._dbus_access = access
692
func._dbus_name = func.__name__
693
if func._dbus_name.endswith("_dbus_property"):
694
func._dbus_name = func._dbus_name[:-14]
695
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
696
return func
697
return decorator
698
699
700
class DBusPropertyException(dbus.exceptions.DBusException):
701
"""A base class for D-Bus property-related exceptions
702
"""
703
def __unicode__(self):
704
return unicode(str(self))
705
706
707
class DBusPropertyAccessException(DBusPropertyException):
708
"""A property's access permissions disallows an operation.
709
"""
710
pass
711
712
713
class DBusPropertyNotFound(DBusPropertyException):
714
"""An attempt was made to access a non-existing property.
715
"""
716
pass
717
718
719
class DBusObjectWithProperties(dbus.service.Object):
720
"""A D-Bus object with properties.
721
722
Classes inheriting from this can use the dbus_service_property
723
decorator to expose methods as D-Bus properties. It exposes the
724
standard Get(), Set(), and GetAll() methods on the D-Bus.
725
"""
726
727
@staticmethod
728
def _is_dbus_property(obj):
729
return getattr(obj, "_dbus_is_property", False)
730
731
def _get_all_dbus_properties(self):
732
"""Returns a generator of (name, attribute) pairs
733
"""
734
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
735
for cls in self.__class__.__mro__
736
for name, prop in
737
inspect.getmembers(cls, self._is_dbus_property))
738
739
def _get_dbus_property(self, interface_name, property_name):
740
"""Returns a bound method if one exists which is a D-Bus
741
property with the specified name and interface.
742
"""
743
for cls in self.__class__.__mro__:
744
for name, value in (inspect.getmembers
745
(cls, self._is_dbus_property)):
746
if (value._dbus_name == property_name
747
and value._dbus_interface == interface_name):
748
return value.__get__(self)
749
750
# No such property
751
raise DBusPropertyNotFound(self.dbus_object_path + ":"
752
+ interface_name + "."
753
+ property_name)
754
755
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
756
out_signature="v")
757
def Get(self, interface_name, property_name):
758
"""Standard D-Bus property Get() method, see D-Bus standard.
759
"""
760
prop = self._get_dbus_property(interface_name, property_name)
761
if prop._dbus_access == "write":
762
raise DBusPropertyAccessException(property_name)
763
value = prop()
764
if not hasattr(value, "variant_level"):
765
return value
766
return type(value)(value, variant_level=value.variant_level+1)
767
768
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
769
def Set(self, interface_name, property_name, value):
770
"""Standard D-Bus property Set() method, see D-Bus standard.
771
"""
772
prop = self._get_dbus_property(interface_name, property_name)
773
if prop._dbus_access == "read":
774
raise DBusPropertyAccessException(property_name)
775
if prop._dbus_get_args_options["byte_arrays"]:
776
# The byte_arrays option is not supported yet on
777
# signatures other than "ay".
778
if prop._dbus_signature != "ay":
779
raise ValueError
780
value = dbus.ByteArray(''.join(unichr(byte)
781
for byte in value))
782
prop(value)
783
784
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
785
out_signature="a{sv}")
786
def GetAll(self, interface_name):
787
"""Standard D-Bus property GetAll() method, see D-Bus
788
standard.
789
790
Note: Will not include properties with access="write".
791
"""
792
properties = {}
793
for name, prop in self._get_all_dbus_properties():
794
if (interface_name
795
and interface_name != prop._dbus_interface):
796
# Interface non-empty but did not match
797
continue
798
# Ignore write-only properties
799
if prop._dbus_access == "write":
800
continue
801
value = prop()
802
if not hasattr(value, "variant_level"):
803
properties[name] = value
804
continue
805
properties[name] = type(value)(value, variant_level=
806
value.variant_level+1)
807
return dbus.Dictionary(properties, signature="sv")
808
809
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
810
out_signature="s",
811
path_keyword='object_path',
812
connection_keyword='connection')
813
def Introspect(self, object_path, connection):
814
"""Standard D-Bus method, overloaded to insert property tags.
815
"""
816
xmlstring = dbus.service.Object.Introspect(self, object_path,
817
connection)
818
try:
819
document = xml.dom.minidom.parseString(xmlstring)
820
def make_tag(document, name, prop):
821
e = document.createElement("property")
822
e.setAttribute("name", name)
823
e.setAttribute("type", prop._dbus_signature)
824
e.setAttribute("access", prop._dbus_access)
825
return e
826
for if_tag in document.getElementsByTagName("interface"):
827
for tag in (make_tag(document, name, prop)
828
for name, prop
829
in self._get_all_dbus_properties()
830
if prop._dbus_interface
831
== if_tag.getAttribute("name")):
832
if_tag.appendChild(tag)
833
# Add the names to the return values for the
834
# "org.freedesktop.DBus.Properties" methods
835
if (if_tag.getAttribute("name")
836
== "org.freedesktop.DBus.Properties"):
837
for cn in if_tag.getElementsByTagName("method"):
838
if cn.getAttribute("name") == "Get":
839
for arg in cn.getElementsByTagName("arg"):
840
if (arg.getAttribute("direction")
841
== "out"):
842
arg.setAttribute("name", "value")
843
elif cn.getAttribute("name") == "GetAll":
844
for arg in cn.getElementsByTagName("arg"):
845
if (arg.getAttribute("direction")
846
== "out"):
847
arg.setAttribute("name", "props")
848
xmlstring = document.toxml("utf-8")
849
document.unlink()
850
except (AttributeError, xml.dom.DOMException,
851
xml.parsers.expat.ExpatError) as error:
852
logger.error("Failed to override Introspection method",
853
error)
854
return xmlstring
855
856
857
def datetime_to_dbus (dt, variant_level=0):
858
"""Convert a UTC datetime.datetime() to a D-Bus type."""
859
if dt is None:
860
return dbus.String("", variant_level = variant_level)
861
return dbus.String(dt.isoformat(),
862
variant_level=variant_level)
863
864
865
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
866
.__metaclass__):
867
"""Applied to an empty subclass of a D-Bus object, this metaclass
868
will add additional D-Bus attributes matching a certain pattern.
869
"""
870
def __new__(mcs, name, bases, attr):
871
# Go through all the base classes which could have D-Bus
872
# methods, signals, or properties in them
873
for base in (b for b in bases
874
if issubclass(b, dbus.service.Object)):
875
# Go though all attributes of the base class
876
for attrname, attribute in inspect.getmembers(base):
877
# Ignore non-D-Bus attributes, and D-Bus attributes
878
# with the wrong interface name
879
if (not hasattr(attribute, "_dbus_interface")
880
or not attribute._dbus_interface
881
.startswith("se.recompile.Mandos")):
882
continue
883
# Create an alternate D-Bus interface name based on
884
# the current name
885
alt_interface = (attribute._dbus_interface
886
.replace("se.recompile.Mandos",
887
"se.bsnet.fukt.Mandos"))
888
# Is this a D-Bus signal?
889
if getattr(attribute, "_dbus_is_signal", False):
890
# Extract the original non-method function by
891
# black magic
892
nonmethod_func = (dict(
893
zip(attribute.func_code.co_freevars,
894
attribute.__closure__))["func"]
895
.cell_contents)
896
# Create a new, but exactly alike, function
897
# object, and decorate it to be a new D-Bus signal
898
# with the alternate D-Bus interface name
899
new_function = (dbus.service.signal
900
(alt_interface,
901
attribute._dbus_signature)
902
(types.FunctionType(
903
nonmethod_func.func_code,
904
nonmethod_func.func_globals,
905
nonmethod_func.func_name,
906
nonmethod_func.func_defaults,
907
nonmethod_func.func_closure)))
908
# Define a creator of a function to call both the
909
# old and new functions, so both the old and new
910
# signals gets sent when the function is called
911
def fixscope(func1, func2):
912
"""This function is a scope container to pass
913
func1 and func2 to the "call_both" function
914
outside of its arguments"""
915
def call_both(*args, **kwargs):
916
"""This function will emit two D-Bus
917
signals by calling func1 and func2"""
918
func1(*args, **kwargs)
919
func2(*args, **kwargs)
920
return call_both
921
# Create the "call_both" function and add it to
922
# the class
923
attr[attrname] = fixscope(attribute,
924
new_function)
925
# Is this a D-Bus method?
926
elif getattr(attribute, "_dbus_is_method", False):
927
# Create a new, but exactly alike, function
928
# object. Decorate it to be a new D-Bus method
929
# with the alternate D-Bus interface name. Add it
930
# to the class.
931
attr[attrname] = (dbus.service.method
932
(alt_interface,
933
attribute._dbus_in_signature,
934
attribute._dbus_out_signature)
935
(types.FunctionType
936
(attribute.func_code,
937
attribute.func_globals,
938
attribute.func_name,
939
attribute.func_defaults,
940
attribute.func_closure)))
941
# Is this a D-Bus property?
942
elif getattr(attribute, "_dbus_is_property", False):
943
# Create a new, but exactly alike, function
944
# object, and decorate it to be a new D-Bus
945
# property with the alternate D-Bus interface
946
# name. Add it to the class.
947
attr[attrname] = (dbus_service_property
948
(alt_interface,
949
attribute._dbus_signature,
950
attribute._dbus_access,
951
attribute
952
._dbus_get_args_options
953
["byte_arrays"])
954
(types.FunctionType
955
(attribute.func_code,
956
attribute.func_globals,
957
attribute.func_name,
958
attribute.func_defaults,
959
attribute.func_closure)))
960
return type.__new__(mcs, name, bases, attr)
961
962
963
class ClientDBus(Client, DBusObjectWithProperties):
964
"""A Client class using D-Bus
965
966
Attributes:
967
dbus_object_path: dbus.ObjectPath
968
bus: dbus.SystemBus()
969
"""
970
971
runtime_expansions = (Client.runtime_expansions
972
+ ("dbus_object_path",))
973
974
# dbus.service.Object doesn't use super(), so we can't either.
975
976
def __init__(self, bus = None, *args, **kwargs):
977
self.bus = bus
978
Client.__init__(self, *args, **kwargs)
979
980
self._approvals_pending = 0
981
# Only now, when this client is initialized, can it show up on
982
# the D-Bus
983
client_object_name = unicode(self.name).translate(
984
{ord("."): ord("_"),
985
ord("-"): ord("_")})
986
self.dbus_object_path = (dbus.ObjectPath
987
("/clients/" + client_object_name))
988
DBusObjectWithProperties.__init__(self, self.bus,
989
self.dbus_object_path)
990
991
def notifychangeproperty(transform_func,
992
dbus_name, type_func=lambda x: x,
993
variant_level=1):
994
""" Modify a variable so that it's a property which announces
995
its changes to DBus.
996
997
transform_fun: Function that takes a value and a variant_level
998
and transforms it to a D-Bus type.
999
dbus_name: D-Bus name of the variable
1000
type_func: Function that transform the value before sending it
1001
to the D-Bus. Default: no transform
1002
variant_level: D-Bus variant level. Default: 1
1003
"""
1004
attrname = "_{0}".format(dbus_name)
1005
def setter(self, value):
1006
if hasattr(self, "dbus_object_path"):
1007
if (not hasattr(self, attrname) or
1008
type_func(getattr(self, attrname, None))
1009
!= type_func(value)):
1010
dbus_value = transform_func(type_func(value),
1011
variant_level
1012
=variant_level)
1013
self.PropertyChanged(dbus.String(dbus_name),
1014
dbus_value)
1015
setattr(self, attrname, value)
1016
1017
return property(lambda self: getattr(self, attrname), setter)
1018
1019
1020
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1021
approvals_pending = notifychangeproperty(dbus.Boolean,
1022
"ApprovalPending",
1023
type_func = bool)
1024
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1025
last_enabled = notifychangeproperty(datetime_to_dbus,
1026
"LastEnabled")
1027
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1028
type_func = lambda checker:
1029
checker is not None)
1030
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1031
"LastCheckedOK")
1032
last_approval_request = notifychangeproperty(
1033
datetime_to_dbus, "LastApprovalRequest")
1034
approved_by_default = notifychangeproperty(dbus.Boolean,
1035
"ApprovedByDefault")
1036
approval_delay = notifychangeproperty(dbus.UInt16,
1037
"ApprovalDelay",
1038
type_func =
1039
_timedelta_to_milliseconds)
1040
approval_duration = notifychangeproperty(
1041
dbus.UInt16, "ApprovalDuration",
1042
type_func = _timedelta_to_milliseconds)
1043
host = notifychangeproperty(dbus.String, "Host")
1044
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1045
type_func =
1046
_timedelta_to_milliseconds)
1047
extended_timeout = notifychangeproperty(
1048
dbus.UInt16, "ExtendedTimeout",
1049
type_func = _timedelta_to_milliseconds)
1050
interval = notifychangeproperty(dbus.UInt16,
1051
"Interval",
1052
type_func =
1053
_timedelta_to_milliseconds)
1054
checker_command = notifychangeproperty(dbus.String, "Checker")
1055
1056
del notifychangeproperty
1057
1058
def __del__(self, *args, **kwargs):
1059
try:
1060
self.remove_from_connection()
1061
except LookupError:
1062
pass
1063
if hasattr(DBusObjectWithProperties, "__del__"):
1064
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1065
Client.__del__(self, *args, **kwargs)
1066
1067
def checker_callback(self, pid, condition, command,
1068
*args, **kwargs):
1069
self.checker_callback_tag = None
1070
self.checker = None
1071
if os.WIFEXITED(condition):
1072
exitstatus = os.WEXITSTATUS(condition)
1073
# Emit D-Bus signal
1074
self.CheckerCompleted(dbus.Int16(exitstatus),
1075
dbus.Int64(condition),
1076
dbus.String(command))
1077
else:
1078
# Emit D-Bus signal
1079
self.CheckerCompleted(dbus.Int16(-1),
1080
dbus.Int64(condition),
1081
dbus.String(command))
1082
1083
return Client.checker_callback(self, pid, condition, command,
1084
*args, **kwargs)
1085
1086
def start_checker(self, *args, **kwargs):
1087
old_checker = self.checker
1088
if self.checker is not None:
1089
old_checker_pid = self.checker.pid
1090
else:
1091
old_checker_pid = None
1092
r = Client.start_checker(self, *args, **kwargs)
1093
# Only if new checker process was started
1094
if (self.checker is not None
1095
and old_checker_pid != self.checker.pid):
1096
# Emit D-Bus signal
1097
self.CheckerStarted(self.current_checker_command)
1098
return r
1099
1100
def _reset_approved(self):
1101
self._approved = None
1102
return False
1103
1104
def approve(self, value=True):
1105
self.send_changedstate()
1106
self._approved = value
1107
gobject.timeout_add(_timedelta_to_milliseconds
1108
(self.approval_duration),
1109
self._reset_approved)
1110
1111
1112
## D-Bus methods, signals & properties
1113
_interface = "se.recompile.Mandos.Client"
1114
1115
## Signals
459
if self.use_dbus:
460
self.PropertyChanged(dbus.String(u"checker_running"),
461
dbus.Boolean(False, variant_level=1))
462
463
def still_valid(self):
464
"""Has the timeout not yet passed for this client?"""
465
if not getattr(self, "enabled", False):
466
return False
467
now = datetime.datetime.utcnow()
468
if self.last_checked_ok is None:
469
return now < (self.created + self.timeout)
470
else:
471
return now < (self.last_checked_ok + self.timeout)
472
473
## D-Bus methods & signals
474
_interface = u"se.bsnet.fukt.Mandos.Client"
475
476
# CheckedOK - method
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
1116
479
1117
480
# CheckerCompleted - signal
1118
481
@dbus.service.signal(_interface, signature="nxs")
1126
489
"D-Bus signal"
1127
490
pass
1128
491
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
495
"D-Bus method"
496
return dbus.Dictionary({
497
dbus.String("name"):
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
501
dbus.String("host"):
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
507
variant_level=1)
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
514
variant_level=1)
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
519
variant_level=1),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
522
variant_level=1),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
525
variant_level=1),
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
528
variant_level=1),
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
531
variant_level=1)
532
}, signature="sv")
533
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
(still_valid))
537
IsStillValid.__name__ = "IsStillValid"
538
1129
539
# PropertyChanged - signal
1130
540
@dbus.service.signal(_interface, signature="sv")
1131
541
def PropertyChanged(self, property, value):
1132
542
"D-Bus signal"
1133
543
pass
1134
544
1135
# GotSecret - signal
1136
@dbus.service.signal(_interface)
1137
def GotSecret(self):
1138
"""D-Bus signal
1139
Is sent after a successful transfer of secret from the Mandos
1140
server to mandos-client
1141
"""
1142
pass
1143
1144
# Rejected - signal
1145
@dbus.service.signal(_interface, signature="s")
1146
def Rejected(self, reason):
1147
"D-Bus signal"
1148
pass
1149
1150
# NeedApproval - signal
1151
@dbus.service.signal(_interface, signature="tb")
1152
def NeedApproval(self, timeout, default):
1153
"D-Bus signal"
1154
return self.need_approval()
1155
1156
# NeRwequest - signal
1157
@dbus.service.signal(_interface, signature="s")
1158
def NewRequest(self, ip):
1159
"""D-Bus signal
1160
Is sent after a client request a password.
1161
"""
1162
pass
1163
1164
## Methods
1165
1166
# Approve - method
1167
@dbus.service.method(_interface, in_signature="b")
1168
def Approve(self, value):
1169
self.approve(value)
1170
1171
# CheckedOK - method
1172
@dbus.service.method(_interface)
1173
def CheckedOK(self):
1174
self.checked_ok()
545
# SetChecker - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetChecker(self, checker):
548
"D-Bus setter method"
549
self.checker_command = checker
550
# Emit D-Bus signal
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
553
variant_level=1))
554
555
# SetHost - method
556
@dbus.service.method(_interface, in_signature="s")
557
def SetHost(self, host):
558
"D-Bus setter method"
559
self.host = host
560
# Emit D-Bus signal
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
563
564
# SetInterval - method
565
@dbus.service.method(_interface, in_signature="t")
566
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
# Emit D-Bus signal
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
571
variant_level=1)))
572
573
# SetSecret - method
574
@dbus.service.method(_interface, in_signature="ay",
575
byte_arrays=True)
576
def SetSecret(self, secret):
577
"D-Bus setter method"
578
self.secret = str(secret)
579
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
# Emit D-Bus signal
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
587
variant_level=1)))
1175
588
1176
589
# Enable - method
1177
@dbus.service.method(_interface)
1178
def Enable(self):
1179
"D-Bus method"
1180
self.enable()
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
1181
592
1182
593
# StartChecker - method
1183
594
@dbus.service.method(_interface)
1192
603
self.disable()
1193
604
1194
605
# StopChecker - method
1195
@dbus.service.method(_interface)
1196
def StopChecker(self):
1197
self.stop_checker()
1198
1199
## Properties
1200
1201
# ApprovalPending - property
1202
@dbus_service_property(_interface, signature="b", access="read")
1203
def ApprovalPending_dbus_property(self):
1204
return dbus.Boolean(bool(self.approvals_pending))
1205
1206
# ApprovedByDefault - property
1207
@dbus_service_property(_interface, signature="b",
1208
access="readwrite")
1209
def ApprovedByDefault_dbus_property(self, value=None):
1210
if value is None: # get
1211
return dbus.Boolean(self.approved_by_default)
1212
self.approved_by_default = bool(value)
1213
1214
# ApprovalDelay - property
1215
@dbus_service_property(_interface, signature="t",
1216
access="readwrite")
1217
def ApprovalDelay_dbus_property(self, value=None):
1218
if value is None: # get
1219
return dbus.UInt64(self.approval_delay_milliseconds())
1220
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1221
1222
# ApprovalDuration - property
1223
@dbus_service_property(_interface, signature="t",
1224
access="readwrite")
1225
def ApprovalDuration_dbus_property(self, value=None):
1226
if value is None: # get
1227
return dbus.UInt64(_timedelta_to_milliseconds(
1228
self.approval_duration))
1229
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1230
1231
# Name - property
1232
@dbus_service_property(_interface, signature="s", access="read")
1233
def Name_dbus_property(self):
1234
return dbus.String(self.name)
1235
1236
# Fingerprint - property
1237
@dbus_service_property(_interface, signature="s", access="read")
1238
def Fingerprint_dbus_property(self):
1239
return dbus.String(self.fingerprint)
1240
1241
# Host - property
1242
@dbus_service_property(_interface, signature="s",
1243
access="readwrite")
1244
def Host_dbus_property(self, value=None):
1245
if value is None: # get
1246
return dbus.String(self.host)
1247
self.host = value
1248
1249
# Created - property
1250
@dbus_service_property(_interface, signature="s", access="read")
1251
def Created_dbus_property(self):
1252
return dbus.String(datetime_to_dbus(self.created))
1253
1254
# LastEnabled - property
1255
@dbus_service_property(_interface, signature="s", access="read")
1256
def LastEnabled_dbus_property(self):
1257
return datetime_to_dbus(self.last_enabled)
1258
1259
# Enabled - property
1260
@dbus_service_property(_interface, signature="b",
1261
access="readwrite")
1262
def Enabled_dbus_property(self, value=None):
1263
if value is None: # get
1264
return dbus.Boolean(self.enabled)
1265
if value:
1266
self.enable()
1267
else:
1268
self.disable()
1269
1270
# LastCheckedOK - property
1271
@dbus_service_property(_interface, signature="s",
1272
access="readwrite")
1273
def LastCheckedOK_dbus_property(self, value=None):
1274
if value is not None:
1275
self.checked_ok()
1276
return
1277
return datetime_to_dbus(self.last_checked_ok)
1278
1279
# Expires - property
1280
@dbus_service_property(_interface, signature="s", access="read")
1281
def Expires_dbus_property(self):
1282
return datetime_to_dbus(self.expires)
1283
1284
# LastApprovalRequest - property
1285
@dbus_service_property(_interface, signature="s", access="read")
1286
def LastApprovalRequest_dbus_property(self):
1287
return datetime_to_dbus(self.last_approval_request)
1288
1289
# Timeout - property
1290
@dbus_service_property(_interface, signature="t",
1291
access="readwrite")
1292
def Timeout_dbus_property(self, value=None):
1293
if value is None: # get
1294
return dbus.UInt64(self.timeout_milliseconds())
1295
self.timeout = datetime.timedelta(0, 0, 0, value)
1296
if getattr(self, "disable_initiator_tag", None) is None:
1297
return
1298
# Reschedule timeout
1299
gobject.source_remove(self.disable_initiator_tag)
1300
self.disable_initiator_tag = None
1301
self.expires = None
1302
time_to_die = _timedelta_to_milliseconds((self
1303
.last_checked_ok
1304
+ self.timeout)
1305
- datetime.datetime
1306
.utcnow())
1307
if time_to_die <= 0:
1308
# The timeout has passed
1309
self.disable()
1310
else:
1311
self.expires = (datetime.datetime.utcnow()
1312
+ datetime.timedelta(milliseconds =
1313
time_to_die))
1314
self.disable_initiator_tag = (gobject.timeout_add
1315
(time_to_die, self.disable))
1316
1317
# ExtendedTimeout - property
1318
@dbus_service_property(_interface, signature="t",
1319
access="readwrite")
1320
def ExtendedTimeout_dbus_property(self, value=None):
1321
if value is None: # get
1322
return dbus.UInt64(self.extended_timeout_milliseconds())
1323
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1324
1325
# Interval - property
1326
@dbus_service_property(_interface, signature="t",
1327
access="readwrite")
1328
def Interval_dbus_property(self, value=None):
1329
if value is None: # get
1330
return dbus.UInt64(self.interval_milliseconds())
1331
self.interval = datetime.timedelta(0, 0, 0, value)
1332
if getattr(self, "checker_initiator_tag", None) is None:
1333
return
1334
# Reschedule checker run
1335
gobject.source_remove(self.checker_initiator_tag)
1336
self.checker_initiator_tag = (gobject.timeout_add
1337
(value, self.start_checker))
1338
self.start_checker() # Start one now, too
1339
1340
# Checker - property
1341
@dbus_service_property(_interface, signature="s",
1342
access="readwrite")
1343
def Checker_dbus_property(self, value=None):
1344
if value is None: # get
1345
return dbus.String(self.checker_command)
1346
self.checker_command = value
1347
1348
# CheckerRunning - property
1349
@dbus_service_property(_interface, signature="b",
1350
access="readwrite")
1351
def CheckerRunning_dbus_property(self, value=None):
1352
if value is None: # get
1353
return dbus.Boolean(self.checker is not None)
1354
if value:
1355
self.start_checker()
1356
else:
1357
self.stop_checker()
1358
1359
# ObjectPath - property
1360
@dbus_service_property(_interface, signature="o", access="read")
1361
def ObjectPath_dbus_property(self):
1362
return self.dbus_object_path # is already a dbus.ObjectPath
1363
1364
# Secret = property
1365
@dbus_service_property(_interface, signature="ay",
1366
access="write", byte_arrays=True)
1367
def Secret_dbus_property(self, value):
1368
self.secret = str(value)
606
StopChecker = dbus.service.method(_interface)(stop_checker)
607
StopChecker.__name__ = "StopChecker"
1369
608
1370
609
del _interface
1371
610
1372
611
1373
class ProxyClient(object):
1374
def __init__(self, child_pipe, fpr, address):
1375
self._pipe = child_pipe
1376
self._pipe.send(('init', fpr, address))
1377
if not self._pipe.recv():
1378
raise KeyError()
1379
1380
def __getattribute__(self, name):
1381
if(name == '_pipe'):
1382
return super(ProxyClient, self).__getattribute__(name)
1383
self._pipe.send(('getattr', name))
1384
data = self._pipe.recv()
1385
if data[0] == 'data':
1386
return data[1]
1387
if data[0] == 'function':
1388
def func(*args, **kwargs):
1389
self._pipe.send(('funcall', name, args, kwargs))
1390
return self._pipe.recv()[1]
1391
return func
1392
1393
def __setattr__(self, name, value):
1394
if(name == '_pipe'):
1395
return super(ProxyClient, self).__setattr__(name, value)
1396
self._pipe.send(('setattr', name, value))
1397
1398
1399
class ClientDBusTransitional(ClientDBus):
1400
__metaclass__ = AlternateDBusNamesMetaclass
1401
1402
1403
class ClientHandler(socketserver.BaseRequestHandler, object):
1404
"""A class to handle client connections.
1405
1406
Instantiated once for each connection to handle it.
612
def peer_certificate(session):
613
"Return the peer's OpenPGP certificate as a bytestring"
614
# If not an OpenPGP certificate...
615
if (gnutls.library.functions
616
.gnutls_certificate_type_get(session._c_object)
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
# ...do the normal thing
619
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
621
cert_list = (gnutls.library.functions
622
.gnutls_certificate_get_peers
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
626
" certificate")
627
if list_size.value == 0:
628
return None
629
cert = cert_list[0]
630
return ctypes.string_at(cert.data, cert.size)
631
632
633
def fingerprint(openpgp):
634
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
# New GnuTLS "datum" with the OpenPGP public key
636
datum = (gnutls.library.types
637
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
ctypes.POINTER
639
(ctypes.c_ubyte)),
640
ctypes.c_uint(len(openpgp))))
641
# New empty GnuTLS certificate
642
crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
(gnutls.library.functions
644
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
645
# Import the OpenPGP public key into the certificate
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
gnutls.library.constants
649
.GNUTLS_OPENPGP_FMT_RAW))
650
# Verify the self signature in the key
651
crtverify = ctypes.c_uint()
652
(gnutls.library.functions
653
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
654
if crtverify.value != 0:
655
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
raise gnutls.errors.CertificateSecurityError("Verify failed")
657
# New buffer for the fingerprint
658
buf = ctypes.create_string_buffer(20)
659
buf_len = ctypes.c_size_t()
660
# Get the fingerprint from the certificate into the buffer
661
(gnutls.library.functions
662
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
ctypes.byref(buf_len)))
664
# Deinit the certificate
665
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
# Convert the buffer to a Python bytestring
667
fpr = ctypes.string_at(buf, buf_len.value)
668
# Convert the bytestring to hexadecimal notation
669
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
670
return hex_fpr
671
672
673
class TCP_handler(SocketServer.BaseRequestHandler, object):
674
"""A TCP request handler class.
675
Instantiated by IPv6_TCPServer for each request to handle it.
1407
676
Note: This will run in its own forked process."""
1408
677
1409
678
def handle(self):
1410
with contextlib.closing(self.server.child_pipe) as child_pipe:
1411
logger.info("TCP connection from: %s",
1412
unicode(self.client_address))
1413
logger.debug("Pipe FD: %d",
1414
self.server.child_pipe.fileno())
1415
1416
session = (gnutls.connection
1417
.ClientSession(self.request,
1418
gnutls.connection
1419
.X509Credentials()))
1420
1421
# Note: gnutls.connection.X509Credentials is really a
1422
# generic GnuTLS certificate credentials object so long as
1423
# no X.509 keys are added to it. Therefore, we can use it
1424
# here despite using OpenPGP certificates.
1425
1426
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1427
# "+AES-256-CBC", "+SHA1",
1428
# "+COMP-NULL", "+CTYPE-OPENPGP",
1429
# "+DHE-DSS"))
1430
# Use a fallback default, since this MUST be set.
1431
priority = self.server.gnutls_priority
1432
if priority is None:
1433
priority = "NORMAL"
1434
(gnutls.library.functions
1435
.gnutls_priority_set_direct(session._c_object,
1436
priority, None))
1437
1438
# Start communication using the Mandos protocol
1439
# Get protocol number
1440
line = self.request.makefile().readline()
1441
logger.debug("Protocol version: %r", line)
1442
try:
1443
if int(line.strip().split()[0]) > 1:
1444
raise RuntimeError
1445
except (ValueError, IndexError, RuntimeError) as error:
1446
logger.error("Unknown protocol version: %s", error)
1447
return
1448
1449
# Start GnuTLS connection
1450
try:
1451
session.handshake()
1452
except gnutls.errors.GNUTLSError as error:
1453
logger.warning("Handshake failed: %s", error)
1454
# Do not run session.bye() here: the session is not
1455
# established. Just abandon the request.
1456
return
1457
logger.debug("Handshake succeeded")
1458
1459
approval_required = False
1460
try:
1461
try:
1462
fpr = self.fingerprint(self.peer_certificate
1463
(session))
1464
except (TypeError,
1465
gnutls.errors.GNUTLSError) as error:
1466
logger.warning("Bad certificate: %s", error)
1467
return
1468
logger.debug("Fingerprint: %s", fpr)
1469
if self.server.use_dbus:
1470
# Emit D-Bus signal
1471
client.NewRequest(str(self.client_address))
1472
1473
try:
1474
client = ProxyClient(child_pipe, fpr,
1475
self.client_address)
1476
except KeyError:
1477
return
1478
1479
if client.approval_delay:
1480
delay = client.approval_delay
1481
client.approvals_pending += 1
1482
approval_required = True
1483
1484
while True:
1485
if not client.enabled:
1486
logger.info("Client %s is disabled",
1487
client.name)
1488
if self.server.use_dbus:
1489
# Emit D-Bus signal
1490
client.Rejected("Disabled")
1491
return
1492
1493
if client._approved or not client.approval_delay:
1494
#We are approved or approval is disabled
1495
break
1496
elif client._approved is None:
1497
logger.info("Client %s needs approval",
1498
client.name)
1499
if self.server.use_dbus:
1500
# Emit D-Bus signal
1501
client.NeedApproval(
1502
client.approval_delay_milliseconds(),
1503
client.approved_by_default)
1504
else:
1505
logger.warning("Client %s was not approved",
1506
client.name)
1507
if self.server.use_dbus:
1508
# Emit D-Bus signal
1509
client.Rejected("Denied")
1510
return
1511
1512
#wait until timeout or approved
1513
time = datetime.datetime.now()
1514
client.changedstate.acquire()
1515
(client.changedstate.wait
1516
(float(client._timedelta_to_milliseconds(delay)
1517
/ 1000)))
1518
client.changedstate.release()
1519
time2 = datetime.datetime.now()
1520
if (time2 - time) >= delay:
1521
if not client.approved_by_default:
1522
logger.warning("Client %s timed out while"
1523
" waiting for approval",
1524
client.name)
1525
if self.server.use_dbus:
1526
# Emit D-Bus signal
1527
client.Rejected("Approval timed out")
1528
return
1529
else:
1530
break
1531
else:
1532
delay -= time2 - time
1533
1534
sent_size = 0
1535
while sent_size < len(client.secret):
1536
try:
1537
sent = session.send(client.secret[sent_size:])
1538
except gnutls.errors.GNUTLSError as error:
1539
logger.warning("gnutls send failed")
1540
return
1541
logger.debug("Sent: %d, remaining: %d",
1542
sent, len(client.secret)
1543
- (sent_size + sent))
1544
sent_size += sent
1545
1546
logger.info("Sending secret to %s", client.name)
1547
# bump the timeout using extended_timeout
1548
client.checked_ok(client.extended_timeout)
1549
if self.server.use_dbus:
1550
# Emit D-Bus signal
1551
client.GotSecret()
1552
1553
finally:
1554
if approval_required:
1555
client.approvals_pending -= 1
1556
try:
1557
session.bye()
1558
except gnutls.errors.GNUTLSError as error:
1559
logger.warning("GnuTLS bye failed")
1560
1561
@staticmethod
1562
def peer_certificate(session):
1563
"Return the peer's OpenPGP certificate as a bytestring"
1564
# If not an OpenPGP certificate...
1565
if (gnutls.library.functions
1566
.gnutls_certificate_type_get(session._c_object)
1567
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1568
# ...do the normal thing
1569
return session.peer_certificate
1570
list_size = ctypes.c_uint(1)
1571
cert_list = (gnutls.library.functions
1572
.gnutls_certificate_get_peers
1573
(session._c_object, ctypes.byref(list_size)))
1574
if not bool(cert_list) and list_size.value != 0:
1575
raise gnutls.errors.GNUTLSError("error getting peer"
1576
" certificate")
1577
if list_size.value == 0:
1578
return None
1579
cert = cert_list[0]
1580
return ctypes.string_at(cert.data, cert.size)
1581
1582
@staticmethod
1583
def fingerprint(openpgp):
1584
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1585
# New GnuTLS "datum" with the OpenPGP public key
1586
datum = (gnutls.library.types
1587
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1588
ctypes.POINTER
1589
(ctypes.c_ubyte)),
1590
ctypes.c_uint(len(openpgp))))
1591
# New empty GnuTLS certificate
1592
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1593
(gnutls.library.functions
1594
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1595
# Import the OpenPGP public key into the certificate
1596
(gnutls.library.functions
1597
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1598
gnutls.library.constants
1599
.GNUTLS_OPENPGP_FMT_RAW))
1600
# Verify the self signature in the key
1601
crtverify = ctypes.c_uint()
1602
(gnutls.library.functions
1603
.gnutls_openpgp_crt_verify_self(crt, 0,
1604
ctypes.byref(crtverify)))
1605
if crtverify.value != 0:
1606
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1607
raise (gnutls.errors.CertificateSecurityError
1608
("Verify failed"))
1609
# New buffer for the fingerprint
1610
buf = ctypes.create_string_buffer(20)
1611
buf_len = ctypes.c_size_t()
1612
# Get the fingerprint from the certificate into the buffer
1613
(gnutls.library.functions
1614
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1615
ctypes.byref(buf_len)))
1616
# Deinit the certificate
1617
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1618
# Convert the buffer to a Python bytestring
1619
fpr = ctypes.string_at(buf, buf_len.value)
1620
# Convert the bytestring to hexadecimal notation
1621
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1622
return hex_fpr
1623
1624
1625
class MultiprocessingMixIn(object):
1626
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1627
def sub_process_main(self, request, address):
1628
try:
1629
self.finish_request(request, address)
1630
except:
1631
self.handle_error(request, address)
1632
self.close_request(request)
1633
1634
def process_request(self, request, address):
1635
"""Start a new process to process the request."""
1636
proc = multiprocessing.Process(target = self.sub_process_main,
1637
args = (request,
1638
address))
1639
proc.start()
1640
return proc
1641
1642
1643
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1644
""" adds a pipe to the MixIn """
1645
def process_request(self, request, client_address):
1646
"""Overrides and wraps the original process_request().
1647
1648
This function creates a new pipe in self.pipe
1649
"""
1650
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1651
1652
proc = MultiprocessingMixIn.process_request(self, request,
1653
client_address)
1654
self.child_pipe.close()
1655
self.add_pipe(parent_pipe, proc)
1656
1657
def add_pipe(self, parent_pipe, proc):
1658
"""Dummy function; override as necessary"""
1659
raise NotImplementedError
1660
1661
1662
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1663
socketserver.TCPServer, object):
679
logger.info(u"TCP connection from: %s",
680
unicode(self.client_address))
681
session = (gnutls.connection
682
.ClientSession(self.request,
683
gnutls.connection
684
.X509Credentials()))
685
686
line = self.request.makefile().readline()
687
logger.debug(u"Protocol version: %r", line)
688
try:
689
if int(line.strip().split()[0]) > 1:
690
raise RuntimeError
691
except (ValueError, IndexError, RuntimeError), error:
692
logger.error(u"Unknown protocol version: %s", error)
693
return
694
695
# Note: gnutls.connection.X509Credentials is really a generic
696
# GnuTLS certificate credentials object so long as no X.509
697
# keys are added to it. Therefore, we can use it here despite
698
# using OpenPGP certificates.
699
700
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
# "+DHE-DSS"))
703
# Use a fallback default, since this MUST be set.
704
priority = self.server.settings.get("priority", "NORMAL")
705
(gnutls.library.functions
706
.gnutls_priority_set_direct(session._c_object,
707
priority, None))
708
709
try:
710
session.handshake()
711
except gnutls.errors.GNUTLSError, error:
712
logger.warning(u"Handshake failed: %s", error)
713
# Do not run session.bye() here: the session is not
714
# established. Just abandon the request.
715
return
716
logger.debug(u"Handshake succeeded")
717
try:
718
fpr = fingerprint(peer_certificate(session))
719
except (TypeError, gnutls.errors.GNUTLSError), error:
720
logger.warning(u"Bad certificate: %s", error)
721
session.bye()
722
return
723
logger.debug(u"Fingerprint: %s", fpr)
724
725
for c in self.server.clients:
726
if c.fingerprint == fpr:
727
client = c
728
break
729
else:
730
logger.warning(u"Client not found for fingerprint: %s",
731
fpr)
732
session.bye()
733
return
734
# Have to check if client.still_valid(), since it is possible
735
# that the client timed out while establishing the GnuTLS
736
# session.
737
if not client.still_valid():
738
logger.warning(u"Client %(name)s is invalid",
739
vars(client))
740
session.bye()
741
return
742
## This won't work here, since we're in a fork.
743
# client.checked_ok()
744
sent_size = 0
745
while sent_size < len(client.secret):
746
sent = session.send(client.secret[sent_size:])
747
logger.debug(u"Sent: %d, remaining: %d",
748
sent, len(client.secret)
749
- (sent_size + sent))
750
sent_size += sent
751
session.bye()
752
753
754
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
SocketServer.TCPServer, object):
1664
756
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1665
1666
757
Attributes:
758
settings: Server settings
759
clients: Set() of Client objects
1667
760
enabled: Boolean; whether this server is activated yet
1668
interface: None or a network interface name (string)
1669
use_ipv6: Boolean; to use IPv6 or not
1670
761
"""
1671
def __init__(self, server_address, RequestHandlerClass,
1672
interface=None, use_ipv6=True):
1673
self.interface = interface
1674
if use_ipv6:
1675
self.address_family = socket.AF_INET6
1676
socketserver.TCPServer.__init__(self, server_address,
1677
RequestHandlerClass)
762
address_family = socket.AF_INET6
763
def __init__(self, *args, **kwargs):
764
if "settings" in kwargs:
765
self.settings = kwargs["settings"]
766
del kwargs["settings"]
767
if "clients" in kwargs:
768
self.clients = kwargs["clients"]
769
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
774
self.enabled = False
775
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1678
776
def server_bind(self):
1679
777
"""This overrides the normal server_bind() function
1680
778
to bind to an interface if one was specified, and also NOT to
1681
779
bind to an address or port if they were not specified."""
1682
if self.interface is not None:
1683
if SO_BINDTODEVICE is None:
1684
logger.error("SO_BINDTODEVICE does not exist;"
1685
" cannot bind to interface %s",
1686
self.interface)
1687
else:
1688
try:
1689
self.socket.setsockopt(socket.SOL_SOCKET,
1690
SO_BINDTODEVICE,
1691
str(self.interface
1692
+ '\0'))
1693
except socket.error as error:
1694
if error[0] == errno.EPERM:
1695
logger.error("No permission to"
1696
" bind to interface %s",
1697
self.interface)
1698
elif error[0] == errno.ENOPROTOOPT:
1699
logger.error("SO_BINDTODEVICE not available;"
1700
" cannot bind to interface %s",
1701
self.interface)
1702
else:
1703
raise
780
if self.settings["interface"]:
781
# 25 is from /usr/include/asm-i486/socket.h
782
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
783
try:
784
self.socket.setsockopt(socket.SOL_SOCKET,
785
SO_BINDTODEVICE,
786
self.settings["interface"])
787
except socket.error, error:
788
if error[0] == errno.EPERM:
789
logger.error(u"No permission to"
790
u" bind to interface %s",
791
self.settings["interface"])
792
else:
793
raise
1704
794
# Only bind(2) the socket if we really need to.
1705
795
if self.server_address[0] or self.server_address[1]:
1706
796
if not self.server_address[0]:
1713
803
elif not self.server_address[1]:
1714
804
self.server_address = (self.server_address[0],
1715
805
0)
1716
# if self.interface:
806
# if self.settings["interface"]:
1717
807
# self.server_address = (self.server_address[0],
1718
808
# 0, # port
1719
809
# 0, # flowinfo
1720
810
# if_nametoindex
1721
# (self.interface))
1722
return socketserver.TCPServer.server_bind(self)
1723
1724
1725
class MandosServer(IPv6_TCPServer):
1726
"""Mandos server.
1727
1728
Attributes:
1729
clients: set of Client objects
1730
gnutls_priority GnuTLS priority string
1731
use_dbus: Boolean; to emit D-Bus signals or not
1732
1733
Assumes a gobject.MainLoop event loop.
1734
"""
1735
def __init__(self, server_address, RequestHandlerClass,
1736
interface=None, use_ipv6=True, clients=None,
1737
gnutls_priority=None, use_dbus=True):
1738
self.enabled = False
1739
self.clients = clients
1740
if self.clients is None:
1741
self.clients = {}
1742
self.use_dbus = use_dbus
1743
self.gnutls_priority = gnutls_priority
1744
IPv6_TCPServer.__init__(self, server_address,
1745
RequestHandlerClass,
1746
interface = interface,
1747
use_ipv6 = use_ipv6)
811
# (self.settings
812
# ["interface"]))
813
return super(IPv6_TCPServer, self).server_bind()
1748
814
def server_activate(self):
1749
815
if self.enabled:
1750
return socketserver.TCPServer.server_activate(self)
1751
816
return super(IPv6_TCPServer, self).server_activate()
1752
817
def enable(self):
1753
818
self.enabled = True
1754
1755
def add_pipe(self, parent_pipe, proc):
1756
# Call "handle_ipc" for both data and EOF events
1757
gobject.io_add_watch(parent_pipe.fileno(),
1758
gobject.IO_IN | gobject.IO_HUP,
1759
functools.partial(self.handle_ipc,
1760
parent_pipe =
1761
parent_pipe,
1762
proc = proc))
1763
1764
def handle_ipc(self, source, condition, parent_pipe=None,
1765
proc = None, client_object=None):
1766
condition_names = {
1767
gobject.IO_IN: "IN", # There is data to read.
1768
gobject.IO_OUT: "OUT", # Data can be written (without
1769
# blocking).
1770
gobject.IO_PRI: "PRI", # There is urgent data to read.
1771
gobject.IO_ERR: "ERR", # Error condition.
1772
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1773
# broken, usually for pipes and
1774
# sockets).
1775
}
1776
conditions_string = ' | '.join(name
1777
for cond, name in
1778
condition_names.iteritems()
1779
if cond & condition)
1780
# error, or the other end of multiprocessing.Pipe has closed
1781
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1782
# Wait for other process to exit
1783
proc.join()
1784
return False
1785
1786
# Read a request from the child
1787
request = parent_pipe.recv()
1788
command = request[0]
1789
1790
if command == 'init':
1791
fpr = request[1]
1792
address = request[2]
1793
1794
for c in self.clients.itervalues():
1795
if c.fingerprint == fpr:
1796
client = c
1797
break
1798
else:
1799
logger.info("Client not found for fingerprint: %s, ad"
1800
"dress: %s", fpr, address)
1801
if self.use_dbus:
1802
# Emit D-Bus signal
1803
mandos_dbus_service.ClientNotFound(fpr,
1804
address[0])
1805
parent_pipe.send(False)
1806
return False
1807
1808
gobject.io_add_watch(parent_pipe.fileno(),
1809
gobject.IO_IN | gobject.IO_HUP,
1810
functools.partial(self.handle_ipc,
1811
parent_pipe =
1812
parent_pipe,
1813
proc = proc,
1814
client_object =
1815
client))
1816
parent_pipe.send(True)
1817
# remove the old hook in favor of the new above hook on
1818
# same fileno
1819
return False
1820
if command == 'funcall':
1821
funcname = request[1]
1822
args = request[2]
1823
kwargs = request[3]
1824
1825
parent_pipe.send(('data', getattr(client_object,
1826
funcname)(*args,
1827
**kwargs)))
1828
1829
if command == 'getattr':
1830
attrname = request[1]
1831
if callable(client_object.__getattribute__(attrname)):
1832
parent_pipe.send(('function',))
1833
else:
1834
parent_pipe.send(('data', client_object
1835
.__getattribute__(attrname)))
1836
1837
if command == 'setattr':
1838
attrname = request[1]
1839
value = request[2]
1840
setattr(client_object, attrname, value)
1841
1842
return True
1843
819
1844
820
1845
821
def string_to_delta(interval):
1853
829
datetime.timedelta(0, 3600)
1854
830
>>> string_to_delta('24h')
1855
831
datetime.timedelta(1)
1856
>>> string_to_delta('1w')
832
>>> string_to_delta(u'1w')
1857
833
datetime.timedelta(7)
1858
834
>>> string_to_delta('5m 30s')
1859
835
datetime.timedelta(0, 330)
1863
839
try:
1864
840
suffix = unicode(s[-1])
1865
841
value = int(s[:-1])
1866
if suffix == "d":
842
if suffix == u"d":
1867
843
delta = datetime.timedelta(value)
1868
elif suffix == "s":
844
elif suffix == u"s":
1869
845
delta = datetime.timedelta(0, value)
1870
elif suffix == "m":
846
elif suffix == u"m":
1871
847
delta = datetime.timedelta(0, 0, 0, 0, value)
1872
elif suffix == "h":
848
elif suffix == u"h":
1873
849
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1874
elif suffix == "w":
850
elif suffix == u"w":
1875
851
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1876
852
else:
1877
raise ValueError("Unknown suffix %r" % suffix)
1878
except (ValueError, IndexError) as e:
1879
raise ValueError(*(e.args))
853
raise ValueError
854
except (ValueError, IndexError):
855
raise ValueError
1880
856
timevalue += delta
1881
857
return timevalue
1882
858
1883
859
860
def server_state_changed(state):
861
"""Derived from the Avahi example code"""
862
if state == avahi.SERVER_COLLISION:
863
logger.error(u"Zeroconf server name collision")
864
service.remove()
865
elif state == avahi.SERVER_RUNNING:
866
service.add()
867
868
869
def entry_group_state_changed(state, error):
870
"""Derived from the Avahi example code"""
871
logger.debug(u"Avahi state change: %i", state)
872
873
if state == avahi.ENTRY_GROUP_ESTABLISHED:
874
logger.debug(u"Zeroconf service established.")
875
elif state == avahi.ENTRY_GROUP_COLLISION:
876
logger.warning(u"Zeroconf service name collision.")
877
service.rename()
878
elif state == avahi.ENTRY_GROUP_FAILURE:
879
logger.critical(u"Avahi: Error in group state changed %s",
880
unicode(error))
881
raise AvahiGroupError(u"State changed: %s" % unicode(error))
882
883
def if_nametoindex(interface):
884
"""Call the C function if_nametoindex(), or equivalent"""
885
global if_nametoindex
886
try:
887
if_nametoindex = (ctypes.cdll.LoadLibrary
888
(ctypes.util.find_library("c"))
889
.if_nametoindex)
890
except (OSError, AttributeError):
891
if "struct" not in sys.modules:
892
import struct
893
if "fcntl" not in sys.modules:
894
import fcntl
895
def if_nametoindex(interface):
896
"Get an interface index the hard way, i.e. using fcntl()"
897
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
898
with closing(socket.socket()) as s:
899
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
900
struct.pack("16s16x", interface))
901
interface_index = struct.unpack("I", ifreq[16:20])[0]
902
return interface_index
903
return if_nametoindex(interface)
904
905
1884
906
def daemon(nochdir = False, noclose = False):
1885
907
"""See daemon(3). Standard BSD Unix function.
1886
1887
908
This should really exist as os.daemon, but it doesn't (yet)."""
1888
909
if os.fork():
1889
910
sys.exit()
1897
918
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1898
919
if not stat.S_ISCHR(os.fstat(null).st_mode):
1899
920
raise OSError(errno.ENODEV,
1900
"%s not a character device"
1901
% os.path.devnull)
921
"/dev/null not a character device")
1902
922
os.dup2(null, sys.stdin.fileno())
1903
923
os.dup2(null, sys.stdout.fileno())
1904
924
os.dup2(null, sys.stderr.fileno())
1907
927
1908
928
1909
929
def main():
1910
1911
##################################################################
1912
# Parsing of options, both command line and config file
1913
1914
parser = argparse.ArgumentParser()
1915
parser.add_argument("-v", "--version", action="version",
1916
version = "%%(prog)s %s" % version,
1917
help="show version number and exit")
1918
parser.add_argument("-i", "--interface", metavar="IF",
1919
help="Bind to interface IF")
1920
parser.add_argument("-a", "--address",
1921
help="Address to listen for requests on")
1922
parser.add_argument("-p", "--port", type=int,
1923
help="Port number to receive requests on")
1924
parser.add_argument("--check", action="store_true",
1925
help="Run self-test")
1926
parser.add_argument("--debug", action="store_true",
1927
help="Debug mode; run in foreground and log"
1928
" to terminal")
1929
parser.add_argument("--debuglevel", metavar="LEVEL",
1930
help="Debug level for stdout output")
1931
parser.add_argument("--priority", help="GnuTLS"
1932
" priority string (see GnuTLS documentation)")
1933
parser.add_argument("--servicename",
1934
metavar="NAME", help="Zeroconf service name")
1935
parser.add_argument("--configdir",
1936
default="/etc/mandos", metavar="DIR",
1937
help="Directory to search for configuration"
1938
" files")
1939
parser.add_argument("--no-dbus", action="store_false",
1940
dest="use_dbus", help="Do not provide D-Bus"
1941
" system bus interface")
1942
parser.add_argument("--no-ipv6", action="store_false",
1943
dest="use_ipv6", help="Do not use IPv6")
1944
parser.add_argument("--no-restore", action="store_false",
1945
dest="restore", help="Do not restore stored"
1946
" state", default=True)
1947
1948
options = parser.parse_args()
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
931
parser.add_option("-i", "--interface", type="string",
932
metavar="IF", help="Bind to interface IF")
933
parser.add_option("-a", "--address", type="string",
934
help="Address to listen for requests on")
935
parser.add_option("-p", "--port", type="int",
936
help="Port number to receive requests on")
937
parser.add_option("--check", action="store_true",
938
help="Run self-test")
939
parser.add_option("--debug", action="store_true",
940
help="Debug mode; run in foreground and log to"
941
" terminal")
942
parser.add_option("--priority", type="string", help="GnuTLS"
943
" priority string (see GnuTLS documentation)")
944
parser.add_option("--servicename", type="string", metavar="NAME",
945
help="Zeroconf service name")
946
parser.add_option("--configdir", type="string",
947
default="/etc/mandos", metavar="DIR",
948
help="Directory to search for configuration"
949
" files")
950
parser.add_option("--no-dbus", action="store_false",
951
dest="use_dbus",
952
help=optparse.SUPPRESS_HELP) # XXX: Not done yet
953
parser.add_option("--no-ipv6", action="store_false",
954
dest="use_ipv6", help="Do not use IPv6")
955
options = parser.parse_args()[0]
1949
956
1950
957
if options.check:
1951
958
import doctest
1962
969
"servicename": "Mandos",
1963
970
"use_dbus": "True",
1964
971
"use_ipv6": "True",
1965
"debuglevel": "",
1966
972
}
1967
973
1968
974
# Parse config file for server-global settings
1969
server_config = configparser.SafeConfigParser(server_defaults)
975
server_config = ConfigParser.SafeConfigParser(server_defaults)
1970
976
del server_defaults
1971
server_config.read(os.path.join(options.configdir,
1972
"mandos.conf"))
977
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1973
978
# Convert the SafeConfigParser object to a dict
1974
979
server_settings = server_config.defaults()
1975
980
# Use the appropriate methods on the non-string config options
1976
for option in ("debug", "use_dbus", "use_ipv6"):
1977
server_settings[option] = server_config.getboolean("DEFAULT",
1978
option)
981
server_settings["debug"] = server_config.getboolean("DEFAULT",
982
"debug")
983
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
984
"use_dbus")
985
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
986
"use_ipv6")
1979
987
if server_settings["port"]:
1980
988
server_settings["port"] = server_config.getint("DEFAULT",
1981
989
"port")
1985
993
# options, if set.
1986
994
for option in ("interface", "address", "port", "debug",
1987
995
"priority", "servicename", "configdir",
1988
"use_dbus", "use_ipv6", "debuglevel", "restore"):
996
"use_dbus", "use_ipv6"):
1989
997
value = getattr(options, option)
1990
998
if value is not None:
1991
999
server_settings[option] = value
1992
1000
del options
1993
# Force all strings to be unicode
1994
for option in server_settings.keys():
1995
if type(server_settings[option]) is str:
1996
server_settings[option] = unicode(server_settings[option])
1997
1001
# Now we have our good server settings in "server_settings"
1998
1002
1999
##################################################################
2000
2001
1003
# For convenience
2002
1004
debug = server_settings["debug"]
2003
debuglevel = server_settings["debuglevel"]
2004
1005
use_dbus = server_settings["use_dbus"]
1006
use_dbus = False # XXX: Not done yet
2005
1007
use_ipv6 = server_settings["use_ipv6"]
2006
1008
2007
if debug:
2008
initlogger(logging.DEBUG)
2009
else:
2010
if not debuglevel:
2011
initlogger()
2012
else:
2013
level = getattr(logging, debuglevel.upper())
2014
initlogger(level)
1009
if not debug:
1010
syslogger.setLevel(logging.WARNING)
1011
console.setLevel(logging.WARNING)
2015
1012
2016
1013
if server_settings["servicename"] != "Mandos":
2017
1014
syslogger.setFormatter(logging.Formatter
2018
('Mandos (%s) [%%(process)d]:'
2019
' %%(levelname)s: %%(message)s'
1015
('Mandos (%s): %%(levelname)s:'
1016
' %%(message)s'
2020
1017
% server_settings["servicename"]))
2021
1018
2022
1019
# Parse config file with clients
2023
client_defaults = { "timeout": "5m",
2024
"extended_timeout": "15m",
2025
"interval": "2m",
1020
client_defaults = { "timeout": "1h",
1021
"interval": "5m",
2026
1022
"checker": "fping -q -- %%(host)s",
2027
1023
"host": "",
2028
"approval_delay": "0s",
2029
"approval_duration": "1s",
2030
1024
}
2031
client_config = configparser.SafeConfigParser(client_defaults)
1025
client_config = ConfigParser.SafeConfigParser(client_defaults)
2032
1026
client_config.read(os.path.join(server_settings["configdir"],
2033
1027
"clients.conf"))
2034
1028
2035
global mandos_dbus_service
2036
mandos_dbus_service = None
2037
2038
tcp_server = MandosServer((server_settings["address"],
2039
server_settings["port"]),
2040
ClientHandler,
2041
interface=(server_settings["interface"]
2042
or None),
2043
use_ipv6=use_ipv6,
2044
gnutls_priority=
2045
server_settings["priority"],
2046
use_dbus=use_dbus)
2047
if not debug:
2048
pidfilename = "/var/run/mandos.pid"
2049
try:
2050
pidfile = open(pidfilename, "w")
2051
except IOError:
2052
logger.error("Could not open file %r", pidfilename)
1029
clients = Set()
1030
tcp_server = IPv6_TCPServer((server_settings["address"],
1031
server_settings["port"]),
1032
TCP_handler,
1033
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
1035
pidfilename = "/var/run/mandos.pid"
1036
try:
1037
pidfile = open(pidfilename, "w")
1038
except IOError:
1039
logger.error("Could not open file %r", pidfilename)
2053
1040
2054
1041
try:
2055
1042
uid = pwd.getpwnam("_mandos").pw_uid
2061
1048
except KeyError:
2062
1049
try:
2063
1050
uid = pwd.getpwnam("nobody").pw_uid
2064
gid = pwd.getpwnam("nobody").pw_gid
1051
gid = pwd.getpwnam("nogroup").pw_gid
2065
1052
except KeyError:
2066
1053
uid = 65534
2067
1054
gid = 65534
2068
1055
try:
2069
1056
os.setgid(gid)
2070
1057
os.setuid(uid)
2071
except OSError as error:
1058
except OSError, error:
2072
1059
if error[0] != errno.EPERM:
2073
1060
raise error
2074
1061
1062
# Enable all possible GnuTLS debugging
2075
1063
if debug:
2076
# Enable all possible GnuTLS debugging
2077
2078
1064
# "Use a log level over 10 to enable all debugging options."
2079
1065
# - GnuTLS manual
2080
1066
gnutls.library.functions.gnutls_global_set_log_level(11)
2085
1071
2086
1072
(gnutls.library.functions
2087
1073
.gnutls_global_set_log_function(debug_gnutls))
2088
2089
# Redirect stdin so all checkers get /dev/null
2090
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2091
os.dup2(null, sys.stdin.fileno())
2092
if null > 2:
2093
os.close(null)
2094
else:
2095
# No console logging
2096
logger.removeHandler(console)
2097
1074
2098
# Need to fork before connecting to D-Bus
2099
if not debug:
2100
# Close all input and output, do double fork, etc.
2101
daemon()
1075
global service
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
service = AvahiService(name = server_settings["servicename"],
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
1080
if server_settings["interface"]:
1081
service.interface = (if_nametoindex
1082
(server_settings["interface"]))
2102
1083
2103
1084
global main_loop
1085
global bus
1086
global server
2104
1087
# From the Avahi example code
2105
1088
DBusGMainLoop(set_as_default=True )
2106
1089
main_loop = gobject.MainLoop()
2107
1090
bus = dbus.SystemBus()
1091
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1092
avahi.DBUS_PATH_SERVER),
1093
avahi.DBUS_INTERFACE_SERVER)
2108
1094
# End of Avahi example code
2109
1095
if use_dbus:
2110
try:
2111
bus_name = dbus.service.BusName("se.recompile.Mandos",
2112
bus, do_not_queue=True)
2113
old_bus_name = (dbus.service.BusName
2114
("se.bsnet.fukt.Mandos", bus,
2115
do_not_queue=True))
2116
except dbus.exceptions.NameExistsException as e:
2117
logger.error(unicode(e) + ", disabling D-Bus")
2118
use_dbus = False
2119
server_settings["use_dbus"] = False
2120
tcp_server.use_dbus = False
2121
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2122
service = AvahiServiceToSyslog(name =
2123
server_settings["servicename"],
2124
servicetype = "_mandos._tcp",
2125
protocol = protocol, bus = bus)
2126
if server_settings["interface"]:
2127
service.interface = (if_nametoindex
2128
(str(server_settings["interface"])))
2129
2130
global multiprocessing_manager
2131
multiprocessing_manager = multiprocessing.Manager()
2132
2133
client_class = Client
2134
if use_dbus:
2135
client_class = functools.partial(ClientDBusTransitional,
2136
bus = bus)
2137
2138
special_settings = {
2139
# Some settings need to be accessd by special methods;
2140
# booleans need .getboolean(), etc. Here is a list of them:
2141
"approved_by_default":
2142
lambda section:
2143
client_config.getboolean(section, "approved_by_default"),
2144
}
2145
# Construct a new dict of client settings of this form:
2146
# { client_name: {setting_name: value, ...}, ...}
2147
# with exceptions for any special settings as defined above
2148
client_settings = dict((clientname,
2149
dict((setting,
2150
(value
2151
if setting not in special_settings
2152
else special_settings[setting]
2153
(clientname)))
2154
for setting, value in
2155
client_config.items(clientname)))
2156
for clientname in client_config.sections())
2157
2158
old_client_settings = {}
2159
clients_data = []
2160
2161
# Get client data and settings from last running state.
2162
if server_settings["restore"]:
2163
try:
2164
with open(stored_state_path, "rb") as stored_state:
2165
clients_data, old_client_settings = (pickle.load
2166
(stored_state))
2167
os.remove(stored_state_path)
2168
except IOError as e:
2169
logger.warning("Could not load persistant state: {0}"
2170
.format(e))
2171
if e.errno != errno.ENOENT:
2172
raise
2173
2174
for client in clients_data:
2175
client_name = client["name"]
2176
2177
# Decide which value to use after restoring saved state.
2178
# We have three different values: Old config file,
2179
# new config file, and saved state.
2180
# New config value takes precedence if it differs from old
2181
# config value, otherwise use saved state.
2182
for name, value in client_settings[client_name].items():
2183
try:
2184
# For each value in new config, check if it differs
2185
# from the old config value (Except for the "secret"
2186
# attribute)
2187
if (name != "secret" and
2188
value != old_client_settings[client_name][name]):
2189
setattr(client, name, value)
2190
except KeyError:
2191
pass
2192
2193
# Clients who has passed its expire date, can still be enabled
2194
# if its last checker was sucessful. Clients who checkers
2195
# failed before we stored it state is asumed to had failed
2196
# checker during downtime.
2197
if client["enabled"] and client["last_checked_ok"]:
2198
if ((datetime.datetime.utcnow()
2199
- client["last_checked_ok"]) > client["interval"]):
2200
if client["last_checker_status"] != 0:
2201
client["enabled"] = False
2202
else:
2203
client["expires"] = (datetime.datetime.utcnow()
2204
+ client["timeout"])
2205
2206
client["changedstate"] = (multiprocessing_manager
2207
.Condition(multiprocessing_manager
2208
.Lock()))
2209
if use_dbus:
2210
new_client = (ClientDBusTransitional.__new__
2211
(ClientDBusTransitional))
2212
tcp_server.clients[client_name] = new_client
2213
new_client.bus = bus
2214
for name, value in client.iteritems():
2215
setattr(new_client, name, value)
2216
client_object_name = unicode(client_name).translate(
2217
{ord("."): ord("_"),
2218
ord("-"): ord("_")})
2219
new_client.dbus_object_path = (dbus.ObjectPath
2220
("/clients/"
2221
+ client_object_name))
2222
DBusObjectWithProperties.__init__(new_client,
2223
new_client.bus,
2224
new_client
2225
.dbus_object_path)
2226
else:
2227
tcp_server.clients[client_name] = Client.__new__(Client)
2228
for name, value in client.iteritems():
2229
setattr(tcp_server.clients[client_name], name, value)
2230
2231
tcp_server.clients[client_name].decrypt_secret(
2232
client_settings[client_name]["secret"])
2233
2234
# Create/remove clients based on new changes made to config
2235
for clientname in set(old_client_settings) - set(client_settings):
2236
del tcp_server.clients[clientname]
2237
for clientname in set(client_settings) - set(old_client_settings):
2238
tcp_server.clients[clientname] = (client_class(name
2239
= clientname,
2240
config =
2241
client_settings
2242
[clientname]))
2243
2244
if not tcp_server.clients:
2245
logger.warning("No clients defined")
2246
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1097
1098
clients.update(Set(Client(name = section,
1099
config
1100
= dict(client_config.items(section)),
1101
use_dbus = use_dbus)
1102
for section in client_config.sections()))
1103
if not clients:
1104
logger.warning(u"No clients defined")
1105
1106
if debug:
1107
# Redirect stdin so all checkers get /dev/null
1108
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1109
os.dup2(null, sys.stdin.fileno())
1110
if null > 2:
1111
os.close(null)
1112
else:
1113
# No console logging
1114
logger.removeHandler(console)
1115
# Close all input and output, do double fork, etc.
1116
daemon()
1117
1118
try:
1119
pid = os.getpid()
1120
pidfile.write(str(pid) + "\n")
1121
pidfile.close()
1122
del pidfile
1123
except IOError:
1124
logger.error(u"Could not write to file %r with PID %d",
1125
pidfilename, pid)
1126
except NameError:
1127
# "pidfile" was never created
1128
pass
1129
del pidfilename
1130
1131
def cleanup():
1132
"Cleanup function; run on exit"
1133
global group
1134
# From the Avahi example code
1135
if not group is None:
1136
group.Free()
1137
group = None
1138
# End of Avahi example code
1139
1140
while clients:
1141
client = clients.pop()
1142
client.disable_hook = None
1143
client.disable()
1144
1145
atexit.register(cleanup)
1146
2247
1147
if not debug:
2248
try:
2249
with pidfile:
2250
pid = os.getpid()
2251
pidfile.write(str(pid) + "\n".encode("utf-8"))
2252
del pidfile
2253
except IOError:
2254
logger.error("Could not write to file %r with PID %d",
2255
pidfilename, pid)
2256
except NameError:
2257
# "pidfile" was never created
2258
pass
2259
del pidfilename
2260
2261
1148
signal.signal(signal.SIGINT, signal.SIG_IGN)
2262
2263
1149
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2264
1150
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2265
1151
2266
1152
if use_dbus:
2267
class MandosDBusService(dbus.service.Object):
1153
class MandosServer(dbus.service.Object):
2268
1154
"""A D-Bus proxy object"""
2269
1155
def __init__(self):
2270
1156
dbus.service.Object.__init__(self, bus, "/")
2271
_interface = "se.recompile.Mandos"
2272
2273
@dbus.service.signal(_interface, signature="o")
2274
def ClientAdded(self, objpath):
2275
"D-Bus signal"
2276
pass
2277
2278
@dbus.service.signal(_interface, signature="ss")
2279
def ClientNotFound(self, fingerprint, address):
1157
_interface = u"se.bsnet.fukt.Mandos"
1158
1159
@dbus.service.signal(_interface, signature="oa{sv}")
1160
def ClientAdded(self, objpath, properties):
2280
1161
"D-Bus signal"
2281
1162
pass
2282
1163
2288
1169
@dbus.service.method(_interface, out_signature="ao")
2289
1170
def GetAllClients(self):
2290
1171
"D-Bus method"
2291
return dbus.Array(c.dbus_object_path
2292
for c in
2293
tcp_server.clients.itervalues())
1172
return dbus.Array(c.dbus_object_path for c in clients)
2294
1173
2295
@dbus.service.method(_interface,
2296
out_signature="a{oa{sv}}")
1174
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
2297
1175
def GetAllClientsWithProperties(self):
2298
1176
"D-Bus method"
2299
1177
return dbus.Dictionary(
2300
((c.dbus_object_path, c.GetAll(""))
2301
for c in tcp_server.clients.itervalues()),
1178
((c.dbus_object_path, c.GetAllProperties())
1179
for c in clients),
2302
1180
signature="oa{sv}")
2303
1181
2304
1182
@dbus.service.method(_interface, in_signature="o")
2305
1183
def RemoveClient(self, object_path):
2306
1184
"D-Bus method"
2307
for c in tcp_server.clients.itervalues():
1185
for c in clients:
2308
1186
if c.dbus_object_path == object_path:
2309
del tcp_server.clients[c.name]
2310
c.remove_from_connection()
1187
clients.remove(c)
2311
1188
# Don't signal anything except ClientRemoved
2312
c.disable(quiet=True)
1189
c.use_dbus = False
1190
c.disable()
2313
1191
# Emit D-Bus signal
2314
1192
self.ClientRemoved(object_path, c.name)
2315
1193
return
2316
raise KeyError(object_path)
1194
raise KeyError
2317
1195
2318
1196
del _interface
2319
1197
2320
class MandosDBusServiceTransitional(MandosDBusService):
2321
__metaclass__ = AlternateDBusNamesMetaclass
2322
mandos_dbus_service = MandosDBusServiceTransitional()
2323
2324
def cleanup():
2325
"Cleanup function; run on exit"
2326
service.cleanup()
2327
2328
multiprocessing.active_children()
2329
if not (tcp_server.clients or client_settings):
2330
return
2331
2332
# Store client before exiting. Secrets are encrypted with key
2333
# based on what config file has. If config file is
2334
# removed/edited, old secret will thus be unrecovable.
2335
clients = []
2336
for client in tcp_server.clients.itervalues():
2337
client.encrypt_secret(client_settings[client.name]
2338
["secret"])
2339
2340
client_dict = {}
2341
2342
# A list of attributes that will not be stored when
2343
# shutting down.
2344
exclude = set(("bus", "changedstate", "secret"))
2345
for name, typ in inspect.getmembers(dbus.service.Object):
2346
exclude.add(name)
2347
2348
client_dict["encrypted_secret"] = client.encrypted_secret
2349
for attr in client.client_structure:
2350
if attr not in exclude:
2351
client_dict[attr] = getattr(client, attr)
2352
2353
clients.append(client_dict)
2354
del client_settings[client.name]["secret"]
2355
2356
try:
2357
with os.fdopen(os.open(stored_state_path,
2358
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2359
0600), "wb") as stored_state:
2360
pickle.dump((clients, client_settings), stored_state)
2361
except IOError as e:
2362
logger.warning("Could not save persistant state: {0}"
2363
.format(e))
2364
if e.errno != errno.ENOENT:
2365
raise
2366
2367
# Delete all clients, and settings from config
2368
while tcp_server.clients:
2369
name, client = tcp_server.clients.popitem()
2370
if use_dbus:
2371
client.remove_from_connection()
2372
# Don't signal anything except ClientRemoved
2373
client.disable(quiet=True)
2374
if use_dbus:
2375
# Emit D-Bus signal
2376
mandos_dbus_service.ClientRemoved(client
2377
.dbus_object_path,
2378
client.name)
2379
client_settings.clear()
2380
2381
atexit.register(cleanup)
2382
2383
for client in tcp_server.clients.itervalues():
1198
mandos_server = MandosServer()
1199
1200
for client in clients:
2384
1201
if use_dbus:
2385
1202
# Emit D-Bus signal
2386
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2387
# Need to initiate checking of clients
2388
if client.enabled:
2389
client.init_checker()
2390
1203
mandos_server.ClientAdded(client.dbus_object_path,
1204
client.GetAllProperties())
1205
client.enable()
2391
1206
2392
1207
tcp_server.enable()
2393
1208
tcp_server.server_activate()
2395
1210
# Find out what port we got
2396
1211
service.port = tcp_server.socket.getsockname()[1]
2397
1212
if use_ipv6:
2398
logger.info("Now listening on address %r, port %d,"
1213
logger.info(u"Now listening on address %r, port %d,"
2399
1214
" flowinfo %d, scope_id %d"
2400
1215
% tcp_server.socket.getsockname())
2401
1216
else: # IPv4
2402
logger.info("Now listening on address %r, port %d"
1217
logger.info(u"Now listening on address %r, port %d"
2403
1218
% tcp_server.socket.getsockname())
2404
1219
2405
1220
#service.interface = tcp_server.socket.getsockname()[3]
2406
1221
2407
1222
try:
2408
1223
# From the Avahi example code
1224
server.connect_to_signal("StateChanged", server_state_changed)
2409
1225
try:
2410
service.activate()
2411
except dbus.exceptions.DBusException as error:
2412
logger.critical("DBusException: %s", error)
2413
cleanup()
1226
server_state_changed(server.GetState())
1227
except dbus.exceptions.DBusException, error:
1228
logger.critical(u"DBusException: %s", error)
2414
1229
sys.exit(1)
2415
1230
# End of Avahi example code
2416
1231
2419
1234
(tcp_server.handle_request
2420
1235
(*args[2:], **kwargs) or True))
2421
1236
2422
logger.debug("Starting main loop")
1237
logger.debug(u"Starting main loop")
2423
1238
main_loop.run()
2424
except AvahiError as error:
2425
logger.critical("AvahiError: %s", error)
2426
cleanup()
1239
except AvahiError, error:
1240
logger.critical(u"AvahiError: %s", error)
2427
1241
sys.exit(1)
2428
1242
except KeyboardInterrupt:
2429
1243
if debug:
2430
print("", file=sys.stderr)
1244
print >> sys.stderr
2431
1245
logger.debug("Server received KeyboardInterrupt")
2432
1246
logger.debug("Server exiting")
2433
# Must run before the D-Bus bus name gets deregistered
2434
cleanup()
2435
2436
1247
2437
1248
if __name__ == '__main__':
2438
1249
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0