To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.2.26
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.26
- Committer: Teddy Hogeborn
- Date: 2009-05-23 05:22:05 UTC
- mto: (24.1.170 mandos) (237.4.29 release)
- mto: This revision was merged to the branch mainline in revision 419.
- Revision ID: teddy@fukt.bsnet.se-20090523052205-wgmxzffhlc30rodu
Tags: version-1.0.11-1
* Makefile (version): Changed to "1.0.11".
* NEWS (Version 1.0.11): New entry.
* debian/changelog (1.0.11-1): - '' -
* NEWS (Version 1.0.11): New entry.
* debian/changelog (1.0.11-1): - '' -
- files removed:
- dbus-mandos.conf
- files modified:
- Makefile
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
58
import contextlib
59
import struct
60
import fcntl
61
import functools
62
import cPickle as pickle
63
import multiprocessing
59
from contextlib import closing
64
60
65
61
import dbus
66
62
import dbus.service
69
65
from dbus.mainloop.glib import DBusGMainLoop
70
66
import ctypes
71
67
import ctypes.util
72
import xml.dom.minidom
73
import inspect
74
75
try:
76
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
77
except AttributeError:
78
try:
79
from IN import SO_BINDTODEVICE
80
except ImportError:
81
SO_BINDTODEVICE = None
82
83
84
version = "1.0.14"
85
86
logger = logging.Logger(u'mandos')
68
69
version = "1.0.11"
70
71
logger = logging.Logger('mandos')
87
72
syslogger = (logging.handlers.SysLogHandler
88
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
89
74
address = "/dev/log"))
90
75
syslogger.setFormatter(logging.Formatter
91
(u'Mandos [%(process)d]: %(levelname)s:'
92
u' %(message)s'))
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
93
78
logger.addHandler(syslogger)
94
79
95
80
console = logging.StreamHandler()
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
u' %(levelname)s:'
98
u' %(message)s'))
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
99
83
logger.addHandler(console)
100
84
101
85
class AvahiError(Exception):
114
98
115
99
class AvahiService(object):
116
100
"""An Avahi (Zeroconf) service.
117
118
101
Attributes:
119
102
interface: integer; avahi.IF_UNSPEC or an interface index.
120
103
Used to optionally bind to the specified interface.
121
name: string; Example: u'Mandos'
122
type: string; Example: u'_mandos._tcp'.
104
name: string; Example: 'Mandos'
105
type: string; Example: '_mandos._tcp'.
123
106
See <http://www.dns-sd.org/ServiceTypes.html>
124
107
port: integer; what port to announce
125
108
TXT: list of strings; TXT record for the service
128
111
max_renames: integer; maximum number of renames
129
112
rename_count: integer; counter so we only rename after collisions
130
113
a sensible number of times
131
group: D-Bus Entry Group
132
server: D-Bus Server
133
bus: dbus.SystemBus()
134
114
"""
135
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
136
116
servicetype = None, port = None, TXT = None,
137
domain = u"", host = u"", max_renames = 32768,
138
protocol = avahi.PROTO_UNSPEC, bus = None):
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
139
119
self.interface = interface
140
120
self.name = name
141
121
self.type = servicetype
146
126
self.rename_count = 0
147
127
self.max_renames = max_renames
148
128
self.protocol = protocol
149
self.group = None # our entry group
150
self.server = None
151
self.bus = bus
152
129
def rename(self):
153
130
"""Derived from the Avahi example code"""
154
131
if self.rename_count >= self.max_renames:
156
133
u" after %i retries, exiting.",
157
134
self.rename_count)
158
135
raise AvahiServiceError(u"Too many renames")
159
self.name = self.server.GetAlternativeServiceName(self.name)
136
self.name = server.GetAlternativeServiceName(self.name)
160
137
logger.info(u"Changing Zeroconf service name to %r ...",
161
unicode(self.name))
138
str(self.name))
162
139
syslogger.setFormatter(logging.Formatter
163
(u'Mandos (%s) [%%(process)d]:'
164
u' %%(levelname)s: %%(message)s'
165
% self.name))
140
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
166
142
self.remove()
167
143
self.add()
168
144
self.rename_count += 1
169
145
def remove(self):
170
146
"""Derived from the Avahi example code"""
171
if self.group is not None:
172
self.group.Reset()
147
if group is not None:
148
group.Reset()
173
149
def add(self):
174
150
"""Derived from the Avahi example code"""
175
if self.group is None:
176
self.group = dbus.Interface(
177
self.bus.get_object(avahi.DBUS_NAME,
178
self.server.EntryGroupNew()),
179
avahi.DBUS_INTERFACE_ENTRY_GROUP)
180
self.group.connect_to_signal('StateChanged',
181
self
182
.entry_group_state_changed)
151
global group
152
if group is None:
153
group = dbus.Interface(bus.get_object
154
(avahi.DBUS_NAME,
155
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
group.connect_to_signal('StateChanged',
158
entry_group_state_changed)
183
159
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
184
self.name, self.type)
185
self.group.AddService(
186
self.interface,
187
self.protocol,
188
dbus.UInt32(0), # flags
189
self.name, self.type,
190
self.domain, self.host,
191
dbus.UInt16(self.port),
192
avahi.string_array_to_txt_array(self.TXT))
193
self.group.Commit()
194
def entry_group_state_changed(self, state, error):
195
"""Derived from the Avahi example code"""
196
logger.debug(u"Avahi state change: %i", state)
197
198
if state == avahi.ENTRY_GROUP_ESTABLISHED:
199
logger.debug(u"Zeroconf service established.")
200
elif state == avahi.ENTRY_GROUP_COLLISION:
201
logger.warning(u"Zeroconf service name collision.")
202
self.rename()
203
elif state == avahi.ENTRY_GROUP_FAILURE:
204
logger.critical(u"Avahi: Error in group state changed %s",
205
unicode(error))
206
raise AvahiGroupError(u"State changed: %s"
207
% unicode(error))
208
def cleanup(self):
209
"""Derived from the Avahi example code"""
210
if self.group is not None:
211
self.group.Free()
212
self.group = None
213
def server_state_changed(self, state):
214
"""Derived from the Avahi example code"""
215
if state == avahi.SERVER_COLLISION:
216
logger.error(u"Zeroconf server name collision")
217
self.remove()
218
elif state == avahi.SERVER_RUNNING:
219
self.add()
220
def activate(self):
221
"""Derived from the Avahi example code"""
222
if self.server is None:
223
self.server = dbus.Interface(
224
self.bus.get_object(avahi.DBUS_NAME,
225
avahi.DBUS_PATH_SERVER),
226
avahi.DBUS_INTERFACE_SERVER)
227
self.server.connect_to_signal(u"StateChanged",
228
self.server_state_changed)
229
self.server_state_changed(self.server.GetState())
230
231
232
class Client(object):
160
service.name, service.type)
161
group.AddService(
162
self.interface, # interface
163
self.protocol, # protocol
164
dbus.UInt32(0), # flags
165
self.name, self.type,
166
self.domain, self.host,
167
dbus.UInt16(self.port),
168
avahi.string_array_to_txt_array(self.TXT))
169
group.Commit()
170
171
# From the Avahi example code:
172
group = None # our entry group
173
# End of Avahi example code
174
175
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
class Client(dbus.service.Object):
233
182
"""A representation of a client host served by this server.
234
235
183
Attributes:
236
184
name: string; from the config file, used in log messages and
237
185
D-Bus identifiers
244
192
enabled: bool()
245
193
last_checked_ok: datetime.datetime(); (UTC) or None
246
194
timeout: datetime.timedelta(); How long from last_checked_ok
247
until this client is disabled
195
until this client is invalid
248
196
interval: datetime.timedelta(); How often to start a new checker
249
197
disable_hook: If set, called by disable() as disable_hook(self)
250
198
checker: subprocess.Popen(); a running checker process used
251
199
to see if the client lives.
252
200
'None' if no process is running.
253
201
checker_initiator_tag: a gobject event source tag, or None
254
disable_initiator_tag: - '' -
202
disable_initiator_tag: - '' -
255
203
checker_callback_tag: - '' -
256
204
checker_command: string; External command which is run to check if
257
205
client lives. %() expansions are done at
258
206
runtime with vars(self) as dict, so that for
259
207
instance %(name)s can be used in the command.
260
208
current_checker_command: string; current running checker_command
261
approved_delay: datetime.timedelta(); Time to wait for approval
262
_approved: bool(); 'None' if not yet approved/disapproved
263
approved_duration: datetime.timedelta(); Duration of one approval
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
264
211
"""
265
266
@staticmethod
267
def _timedelta_to_milliseconds(td):
268
"Convert a datetime.timedelta() to milliseconds"
269
return ((td.days * 24 * 60 * 60 * 1000)
270
+ (td.seconds * 1000)
271
+ (td.microseconds // 1000))
272
273
212
def timeout_milliseconds(self):
274
213
"Return the 'timeout' attribute in milliseconds"
275
return self._timedelta_to_milliseconds(self.timeout)
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
276
217
277
218
def interval_milliseconds(self):
278
219
"Return the 'interval' attribute in milliseconds"
279
return self._timedelta_to_milliseconds(self.interval)
280
281
def approved_delay_milliseconds(self):
282
return self._timedelta_to_milliseconds(self.approved_delay)
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
283
223
284
def __init__(self, name = None, disable_hook=None, config=None):
224
def __init__(self, name = None, disable_hook=None, config=None,
225
use_dbus=True):
285
226
"""Note: the 'checker' key in 'config' sets the
286
227
'checker_command' attribute and *not* the 'checker'
287
228
attribute."""
289
230
if config is None:
290
231
config = {}
291
232
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
292
234
# Uppercase and remove spaces from fingerprint for later
293
235
# comparison purposes with return value from the fingerprint()
294
236
# function
295
self.fingerprint = (config[u"fingerprint"].upper()
237
self.fingerprint = (config["fingerprint"].upper()
296
238
.replace(u" ", u""))
297
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
298
if u"secret" in config:
299
self.secret = config[u"secret"].decode(u"base64")
300
elif u"secfile" in config:
301
with open(os.path.expanduser(os.path.expandvars
302
(config[u"secfile"])),
303
"rb") as secfile:
240
if "secret" in config:
241
self.secret = config["secret"].decode(u"base64")
242
elif "secfile" in config:
243
with closing(open(os.path.expanduser
244
(os.path.expandvars
245
(config["secfile"])))) as secfile:
304
246
self.secret = secfile.read()
305
247
else:
306
#XXX Need to allow secret on demand!
307
248
raise TypeError(u"No secret or secfile for client %s"
308
249
% self.name)
309
self.host = config.get(u"host", u"")
250
self.host = config.get("host", "")
310
251
self.created = datetime.datetime.utcnow()
311
252
self.enabled = False
312
253
self.last_enabled = None
313
254
self.last_checked_ok = None
314
self.timeout = string_to_delta(config[u"timeout"])
315
self.interval = string_to_delta(config[u"interval"])
255
self.timeout = string_to_delta(config["timeout"])
256
self.interval = string_to_delta(config["interval"])
316
257
self.disable_hook = disable_hook
317
258
self.checker = None
318
259
self.checker_initiator_tag = None
319
260
self.disable_initiator_tag = None
320
261
self.checker_callback_tag = None
321
self.checker_command = config[u"checker"]
262
self.checker_command = config["checker"]
322
263
self.current_checker_command = None
323
264
self.last_connect = None
324
self.approvals_pending = 0
325
self._approved = None
326
self.approved_by_default = config.get(u"approved_by_default",
327
False)
328
self.approved_delay = string_to_delta(
329
config[u"approved_delay"])
330
self.approved_duration = string_to_delta(
331
config[u"approved_duration"])
332
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
333
334
def send_changedstate(self):
335
self.changedstate.acquire()
336
self.changedstate.notify_all()
337
self.changedstate.release()
338
265
# Only now, when this client is initialized, can it show up on
266
# the D-Bus
267
self.use_dbus = use_dbus
268
if self.use_dbus:
269
self.dbus_object_path = (dbus.ObjectPath
270
("/clients/"
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
274
339
275
def enable(self):
340
276
"""Start this client's checker and timeout hooks"""
341
if getattr(self, u"enabled", False):
342
# Already enabled
343
return
344
self.send_changedstate()
345
277
self.last_enabled = datetime.datetime.utcnow()
346
278
# Schedule a new checker to be started an 'interval' from now,
347
279
# and every interval from then on.
348
280
self.checker_initiator_tag = (gobject.timeout_add
349
281
(self.interval_milliseconds(),
350
282
self.start_checker))
283
# Also start a new checker *right now*.
284
self.start_checker()
351
285
# Schedule a disable() when 'timeout' has passed
352
286
self.disable_initiator_tag = (gobject.timeout_add
353
287
(self.timeout_milliseconds(),
354
288
self.disable))
355
289
self.enabled = True
356
# Also start a new checker *right now*.
357
self.start_checker()
290
if self.use_dbus:
291
# Emit D-Bus signals
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
296
variant_level=1)))
358
297
359
def disable(self, quiet=True):
298
def disable(self):
360
299
"""Disable this client."""
361
300
if not getattr(self, "enabled", False):
362
301
return False
363
if not quiet:
364
self.send_changedstate()
365
if not quiet:
366
logger.info(u"Disabling client %s", self.name)
367
if getattr(self, u"disable_initiator_tag", False):
302
logger.info(u"Disabling client %s", self.name)
303
if getattr(self, "disable_initiator_tag", False):
368
304
gobject.source_remove(self.disable_initiator_tag)
369
305
self.disable_initiator_tag = None
370
if getattr(self, u"checker_initiator_tag", False):
306
if getattr(self, "checker_initiator_tag", False):
371
307
gobject.source_remove(self.checker_initiator_tag)
372
308
self.checker_initiator_tag = None
373
309
self.stop_checker()
374
310
if self.disable_hook:
375
311
self.disable_hook(self)
376
312
self.enabled = False
313
if self.use_dbus:
314
# Emit D-Bus signal
315
self.PropertyChanged(dbus.String(u"enabled"),
316
dbus.Boolean(False, variant_level=1))
377
317
# Do not run this again if called by a gobject.timeout_add
378
318
return False
379
319
385
325
"""The checker has completed, so take appropriate actions."""
386
326
self.checker_callback_tag = None
387
327
self.checker = None
328
if self.use_dbus:
329
# Emit D-Bus signal
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
388
332
if os.WIFEXITED(condition):
389
333
exitstatus = os.WEXITSTATUS(condition)
390
334
if exitstatus == 0:
394
338
else:
395
339
logger.info(u"Checker for %(name)s failed",
396
340
vars(self))
341
if self.use_dbus:
342
# Emit D-Bus signal
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
397
346
else:
398
347
logger.warning(u"Checker for %(name)s crashed?",
399
348
vars(self))
349
if self.use_dbus:
350
# Emit D-Bus signal
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
400
354
401
355
def checked_ok(self):
402
356
"""Bump up the timeout for this client.
403
404
357
This should only be called when the client has been seen,
405
358
alive and well.
406
359
"""
409
362
self.disable_initiator_tag = (gobject.timeout_add
410
363
(self.timeout_milliseconds(),
411
364
self.disable))
365
if self.use_dbus:
366
# Emit D-Bus signal
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
370
variant_level=1)))
412
371
413
372
def start_checker(self):
414
373
"""Start a new checker subprocess if one is not running.
415
416
374
If a checker already exists, leave it running and do
417
375
nothing."""
418
376
# The reason for not killing a running checker is that if we
421
379
# client would inevitably timeout, since no checker would get
422
380
# a chance to run to completion. If we instead leave running
423
381
# checkers alone, the checker would have to take more time
424
# than 'timeout' for the client to be disabled, which is as it
425
# should be.
382
# than 'timeout' for the client to be declared invalid, which
383
# is as it should be.
426
384
427
385
# If a checker exists, make sure it is not a zombie
428
try:
386
if self.checker is not None:
429
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
430
except (AttributeError, OSError), error:
431
if (isinstance(error, OSError)
432
and error.errno != errno.ECHILD):
433
raise error
434
else:
435
388
if pid:
436
logger.warning(u"Checker was a zombie")
389
logger.warning("Checker was a zombie")
437
390
gobject.source_remove(self.checker_callback_tag)
438
391
self.checker_callback(pid, status,
439
392
self.current_checker_command)
444
397
command = self.checker_command % self.host
445
398
except TypeError:
446
399
# Escape attributes for the shell
447
escaped_attrs = dict((key,
448
re.escape(unicode(str(val),
449
errors=
450
u'replace')))
400
escaped_attrs = dict((key, re.escape(str(val)))
451
401
for key, val in
452
402
vars(self).iteritems())
453
403
try:
456
406
logger.error(u'Could not format string "%s":'
457
407
u' %s', self.checker_command, error)
458
408
return True # Try again later
459
self.current_checker_command = command
409
self.current_checker_command = command
460
410
try:
461
411
logger.info(u"Starting checker %r for %s",
462
412
command, self.name)
466
416
# always replaced by /dev/null.)
467
417
self.checker = subprocess.Popen(command,
468
418
close_fds=True,
469
shell=True, cwd=u"/")
419
shell=True, cwd="/")
420
if self.use_dbus:
421
# Emit D-Bus signal
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
470
426
self.checker_callback_tag = (gobject.child_watch_add
471
427
(self.checker.pid,
472
428
self.checker_callback,
488
444
if self.checker_callback_tag:
489
445
gobject.source_remove(self.checker_callback_tag)
490
446
self.checker_callback_tag = None
491
if getattr(self, u"checker", None) is None:
447
if getattr(self, "checker", None) is None:
492
448
return
493
449
logger.debug(u"Stopping checker for %(name)s", vars(self))
494
450
try:
495
451
os.kill(self.checker.pid, signal.SIGTERM)
496
#time.sleep(0.5)
452
#os.sleep(0.5)
497
453
#if self.checker.poll() is None:
498
454
# os.kill(self.checker.pid, signal.SIGKILL)
499
455
except OSError, error:
500
456
if error.errno != errno.ESRCH: # No such process
501
457
raise
502
458
self.checker = None
503
504
def dbus_service_property(dbus_interface, signature=u"v",
505
access=u"readwrite", byte_arrays=False):
506
"""Decorators for marking methods of a DBusObjectWithProperties to
507
become properties on the D-Bus.
508
509
The decorated method will be called with no arguments by "Get"
510
and with one argument by "Set".
511
512
The parameters, where they are supported, are the same as
513
dbus.service.method, except there is only "signature", since the
514
type from Get() and the type sent to Set() is the same.
515
"""
516
# Encoding deeply encoded byte arrays is not supported yet by the
517
# "Set" method, so we fail early here:
518
if byte_arrays and signature != u"ay":
519
raise ValueError(u"Byte arrays not supported for non-'ay'"
520
u" signature %r" % signature)
521
def decorator(func):
522
func._dbus_is_property = True
523
func._dbus_interface = dbus_interface
524
func._dbus_signature = signature
525
func._dbus_access = access
526
func._dbus_name = func.__name__
527
if func._dbus_name.endswith(u"_dbus_property"):
528
func._dbus_name = func._dbus_name[:-14]
529
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
530
return func
531
return decorator
532
533
534
class DBusPropertyException(dbus.exceptions.DBusException):
535
"""A base class for D-Bus property-related exceptions
536
"""
537
def __unicode__(self):
538
return unicode(str(self))
539
540
541
class DBusPropertyAccessException(DBusPropertyException):
542
"""A property's access permissions disallows an operation.
543
"""
544
pass
545
546
547
class DBusPropertyNotFound(DBusPropertyException):
548
"""An attempt was made to access a non-existing property.
549
"""
550
pass
551
552
553
class DBusObjectWithProperties(dbus.service.Object):
554
"""A D-Bus object with properties.
555
556
Classes inheriting from this can use the dbus_service_property
557
decorator to expose methods as D-Bus properties. It exposes the
558
standard Get(), Set(), and GetAll() methods on the D-Bus.
559
"""
560
561
@staticmethod
562
def _is_dbus_property(obj):
563
return getattr(obj, u"_dbus_is_property", False)
564
565
def _get_all_dbus_properties(self):
566
"""Returns a generator of (name, attribute) pairs
567
"""
568
return ((prop._dbus_name, prop)
569
for name, prop in
570
inspect.getmembers(self, self._is_dbus_property))
571
572
def _get_dbus_property(self, interface_name, property_name):
573
"""Returns a bound method if one exists which is a D-Bus
574
property with the specified name and interface.
575
"""
576
for name in (property_name,
577
property_name + u"_dbus_property"):
578
prop = getattr(self, name, None)
579
if (prop is None
580
or not self._is_dbus_property(prop)
581
or prop._dbus_name != property_name
582
or (interface_name and prop._dbus_interface
583
and interface_name != prop._dbus_interface)):
584
continue
585
return prop
586
# No such property
587
raise DBusPropertyNotFound(self.dbus_object_path + u":"
588
+ interface_name + u"."
589
+ property_name)
590
591
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
592
out_signature=u"v")
593
def Get(self, interface_name, property_name):
594
"""Standard D-Bus property Get() method, see D-Bus standard.
595
"""
596
prop = self._get_dbus_property(interface_name, property_name)
597
if prop._dbus_access == u"write":
598
raise DBusPropertyAccessException(property_name)
599
value = prop()
600
if not hasattr(value, u"variant_level"):
601
return value
602
return type(value)(value, variant_level=value.variant_level+1)
603
604
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
605
def Set(self, interface_name, property_name, value):
606
"""Standard D-Bus property Set() method, see D-Bus standard.
607
"""
608
prop = self._get_dbus_property(interface_name, property_name)
609
if prop._dbus_access == u"read":
610
raise DBusPropertyAccessException(property_name)
611
if prop._dbus_get_args_options[u"byte_arrays"]:
612
# The byte_arrays option is not supported yet on
613
# signatures other than "ay".
614
if prop._dbus_signature != u"ay":
615
raise ValueError
616
value = dbus.ByteArray(''.join(unichr(byte)
617
for byte in value))
618
prop(value)
619
620
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
621
out_signature=u"a{sv}")
622
def GetAll(self, interface_name):
623
"""Standard D-Bus property GetAll() method, see D-Bus
624
standard.
625
626
Note: Will not include properties with access="write".
627
"""
628
all = {}
629
for name, prop in self._get_all_dbus_properties():
630
if (interface_name
631
and interface_name != prop._dbus_interface):
632
# Interface non-empty but did not match
633
continue
634
# Ignore write-only properties
635
if prop._dbus_access == u"write":
636
continue
637
value = prop()
638
if not hasattr(value, u"variant_level"):
639
all[name] = value
640
continue
641
all[name] = type(value)(value, variant_level=
642
value.variant_level+1)
643
return dbus.Dictionary(all, signature=u"sv")
644
645
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
646
out_signature=u"s",
647
path_keyword='object_path',
648
connection_keyword='connection')
649
def Introspect(self, object_path, connection):
650
"""Standard D-Bus method, overloaded to insert property tags.
651
"""
652
xmlstring = dbus.service.Object.Introspect(self, object_path,
653
connection)
654
try:
655
document = xml.dom.minidom.parseString(xmlstring)
656
def make_tag(document, name, prop):
657
e = document.createElement(u"property")
658
e.setAttribute(u"name", name)
659
e.setAttribute(u"type", prop._dbus_signature)
660
e.setAttribute(u"access", prop._dbus_access)
661
return e
662
for if_tag in document.getElementsByTagName(u"interface"):
663
for tag in (make_tag(document, name, prop)
664
for name, prop
665
in self._get_all_dbus_properties()
666
if prop._dbus_interface
667
== if_tag.getAttribute(u"name")):
668
if_tag.appendChild(tag)
669
# Add the names to the return values for the
670
# "org.freedesktop.DBus.Properties" methods
671
if (if_tag.getAttribute(u"name")
672
== u"org.freedesktop.DBus.Properties"):
673
for cn in if_tag.getElementsByTagName(u"method"):
674
if cn.getAttribute(u"name") == u"Get":
675
for arg in cn.getElementsByTagName(u"arg"):
676
if (arg.getAttribute(u"direction")
677
== u"out"):
678
arg.setAttribute(u"name", u"value")
679
elif cn.getAttribute(u"name") == u"GetAll":
680
for arg in cn.getElementsByTagName(u"arg"):
681
if (arg.getAttribute(u"direction")
682
== u"out"):
683
arg.setAttribute(u"name", u"props")
684
xmlstring = document.toxml(u"utf-8")
685
document.unlink()
686
except (AttributeError, xml.dom.DOMException,
687
xml.parsers.expat.ExpatError), error:
688
logger.error(u"Failed to override Introspection method",
689
error)
690
return xmlstring
691
692
693
class ClientDBus(Client, DBusObjectWithProperties):
694
"""A Client class using D-Bus
695
696
Attributes:
697
dbus_object_path: dbus.ObjectPath
698
bus: dbus.SystemBus()
699
"""
700
# dbus.service.Object doesn't use super(), so we can't either.
701
702
def __init__(self, bus = None, *args, **kwargs):
703
self.bus = bus
704
Client.__init__(self, *args, **kwargs)
705
# Only now, when this client is initialized, can it show up on
706
# the D-Bus
707
self.dbus_object_path = (dbus.ObjectPath
708
(u"/clients/"
709
+ self.name.replace(u".", u"_")))
710
DBusObjectWithProperties.__init__(self, self.bus,
711
self.dbus_object_path)
712
713
@staticmethod
714
def _datetime_to_dbus(dt, variant_level=0):
715
"""Convert a UTC datetime.datetime() to a D-Bus type."""
716
return dbus.String(dt.isoformat(),
717
variant_level=variant_level)
718
719
def enable(self):
720
oldstate = getattr(self, u"enabled", False)
721
r = Client.enable(self)
722
if oldstate != self.enabled:
723
# Emit D-Bus signals
724
self.PropertyChanged(dbus.String(u"enabled"),
725
dbus.Boolean(True, variant_level=1))
726
self.PropertyChanged(
727
dbus.String(u"last_enabled"),
728
self._datetime_to_dbus(self.last_enabled,
729
variant_level=1))
730
return r
731
732
def disable(self, quiet = False):
733
oldstate = getattr(self, u"enabled", False)
734
r = Client.disable(self, quiet=quiet)
735
if not quiet and oldstate != self.enabled:
736
# Emit D-Bus signal
737
self.PropertyChanged(dbus.String(u"enabled"),
738
dbus.Boolean(False, variant_level=1))
739
return r
740
741
def __del__(self, *args, **kwargs):
742
try:
743
self.remove_from_connection()
744
except LookupError:
745
pass
746
if hasattr(DBusObjectWithProperties, u"__del__"):
747
DBusObjectWithProperties.__del__(self, *args, **kwargs)
748
Client.__del__(self, *args, **kwargs)
749
750
def checker_callback(self, pid, condition, command,
751
*args, **kwargs):
752
self.checker_callback_tag = None
753
self.checker = None
754
# Emit D-Bus signal
755
self.PropertyChanged(dbus.String(u"checker_running"),
756
dbus.Boolean(False, variant_level=1))
757
if os.WIFEXITED(condition):
758
exitstatus = os.WEXITSTATUS(condition)
759
# Emit D-Bus signal
760
self.CheckerCompleted(dbus.Int16(exitstatus),
761
dbus.Int64(condition),
762
dbus.String(command))
763
else:
764
# Emit D-Bus signal
765
self.CheckerCompleted(dbus.Int16(-1),
766
dbus.Int64(condition),
767
dbus.String(command))
768
769
return Client.checker_callback(self, pid, condition, command,
770
*args, **kwargs)
771
772
def checked_ok(self, *args, **kwargs):
773
r = Client.checked_ok(self, *args, **kwargs)
774
# Emit D-Bus signal
775
self.PropertyChanged(
776
dbus.String(u"last_checked_ok"),
777
(self._datetime_to_dbus(self.last_checked_ok,
778
variant_level=1)))
779
return r
780
781
def start_checker(self, *args, **kwargs):
782
old_checker = self.checker
783
if self.checker is not None:
784
old_checker_pid = self.checker.pid
785
else:
786
old_checker_pid = None
787
r = Client.start_checker(self, *args, **kwargs)
788
# Only if new checker process was started
789
if (self.checker is not None
790
and old_checker_pid != self.checker.pid):
791
# Emit D-Bus signal
792
self.CheckerStarted(self.current_checker_command)
793
self.PropertyChanged(
794
dbus.String(u"checker_running"),
795
dbus.Boolean(True, variant_level=1))
796
return r
797
798
def stop_checker(self, *args, **kwargs):
799
old_checker = getattr(self, u"checker", None)
800
r = Client.stop_checker(self, *args, **kwargs)
801
if (old_checker is not None
802
and getattr(self, u"checker", None) is None):
459
if self.use_dbus:
803
460
self.PropertyChanged(dbus.String(u"checker_running"),
804
461
dbus.Boolean(False, variant_level=1))
805
return r
806
807
def _reset_approved(self):
808
self._approved = None
809
return False
810
811
def approve(self, value=True):
812
self._approved = value
813
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))
814
815
def approved_pending(self):
816
return self.approvals_pending > 0
817
818
819
## D-Bus methods, signals & properties
462
463
def still_valid(self):
464
"""Has the timeout not yet passed for this client?"""
465
if not getattr(self, "enabled", False):
466
return False
467
now = datetime.datetime.utcnow()
468
if self.last_checked_ok is None:
469
return now < (self.created + self.timeout)
470
else:
471
return now < (self.last_checked_ok + self.timeout)
472
473
## D-Bus methods & signals
820
474
_interface = u"se.bsnet.fukt.Mandos.Client"
821
475
822
## Signals
476
# CheckedOK - method
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
823
479
824
480
# CheckerCompleted - signal
825
@dbus.service.signal(_interface, signature=u"nxs")
481
@dbus.service.signal(_interface, signature="nxs")
826
482
def CheckerCompleted(self, exitcode, waitstatus, command):
827
483
"D-Bus signal"
828
484
pass
829
485
830
486
# CheckerStarted - signal
831
@dbus.service.signal(_interface, signature=u"s")
487
@dbus.service.signal(_interface, signature="s")
832
488
def CheckerStarted(self, command):
833
489
"D-Bus signal"
834
490
pass
835
491
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
495
"D-Bus method"
496
return dbus.Dictionary({
497
dbus.String("name"):
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
501
dbus.String("host"):
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
507
variant_level=1)
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
514
variant_level=1)
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
519
variant_level=1),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
522
variant_level=1),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
525
variant_level=1),
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
528
variant_level=1),
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
531
variant_level=1)
532
}, signature="sv")
533
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
(still_valid))
537
IsStillValid.__name__ = "IsStillValid"
538
836
539
# PropertyChanged - signal
837
@dbus.service.signal(_interface, signature=u"sv")
540
@dbus.service.signal(_interface, signature="sv")
838
541
def PropertyChanged(self, property, value):
839
542
"D-Bus signal"
840
543
pass
841
544
842
# GotSecret - signal
843
# Is sent after succesfull transfer of secret from mandos-server to mandos-client
844
@dbus.service.signal(_interface)
845
def GotSecret(self):
846
"D-Bus signal"
847
pass
848
849
# Rejected - signal
850
@dbus.service.signal(_interface, signature=u"s")
851
def Rejected(self, reason):
852
"D-Bus signal"
853
pass
854
855
# NeedApproval - signal
856
@dbus.service.signal(_interface, signature=u"db")
857
def NeedApproval(self, timeout, default):
858
"D-Bus signal"
859
pass
860
861
## Methods
862
863
# Approve - method
864
@dbus.service.method(_interface, in_signature=u"b")
865
def Approve(self, value):
866
self.approve(value)
867
868
# CheckedOK - method
869
@dbus.service.method(_interface)
870
def CheckedOK(self):
871
return self.checked_ok()
545
# SetChecker - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetChecker(self, checker):
548
"D-Bus setter method"
549
self.checker_command = checker
550
# Emit D-Bus signal
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
553
variant_level=1))
554
555
# SetHost - method
556
@dbus.service.method(_interface, in_signature="s")
557
def SetHost(self, host):
558
"D-Bus setter method"
559
self.host = host
560
# Emit D-Bus signal
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
563
564
# SetInterval - method
565
@dbus.service.method(_interface, in_signature="t")
566
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
# Emit D-Bus signal
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
571
variant_level=1)))
572
573
# SetSecret - method
574
@dbus.service.method(_interface, in_signature="ay",
575
byte_arrays=True)
576
def SetSecret(self, secret):
577
"D-Bus setter method"
578
self.secret = str(secret)
579
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
# Emit D-Bus signal
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
587
variant_level=1)))
872
588
873
589
# Enable - method
874
@dbus.service.method(_interface)
875
def Enable(self):
876
"D-Bus method"
877
self.enable()
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
878
592
879
593
# StartChecker - method
880
594
@dbus.service.method(_interface)
889
603
self.disable()
890
604
891
605
# StopChecker - method
892
@dbus.service.method(_interface)
893
def StopChecker(self):
894
self.stop_checker()
895
896
## Properties
897
898
# approved_pending - property
899
@dbus_service_property(_interface, signature=u"b", access=u"read")
900
def approved_pending_dbus_property(self):
901
return dbus.Boolean(self.approved_pending())
902
903
# approved_by_default - property
904
@dbus_service_property(_interface, signature=u"b",
905
access=u"readwrite")
906
def approved_by_default_dbus_property(self):
907
return dbus.Boolean(self.approved_by_default)
908
909
# approved_delay - property
910
@dbus_service_property(_interface, signature=u"t",
911
access=u"readwrite")
912
def approved_delay_dbus_property(self):
913
return dbus.UInt64(self.approved_delay_milliseconds())
914
915
# approved_duration - property
916
@dbus_service_property(_interface, signature=u"t",
917
access=u"readwrite")
918
def approved_duration_dbus_property(self):
919
return dbus.UInt64(self._timedelta_to_milliseconds(
920
self.approved_duration))
921
922
# name - property
923
@dbus_service_property(_interface, signature=u"s", access=u"read")
924
def name_dbus_property(self):
925
return dbus.String(self.name)
926
927
# fingerprint - property
928
@dbus_service_property(_interface, signature=u"s", access=u"read")
929
def fingerprint_dbus_property(self):
930
return dbus.String(self.fingerprint)
931
932
# host - property
933
@dbus_service_property(_interface, signature=u"s",
934
access=u"readwrite")
935
def host_dbus_property(self, value=None):
936
if value is None: # get
937
return dbus.String(self.host)
938
self.host = value
939
# Emit D-Bus signal
940
self.PropertyChanged(dbus.String(u"host"),
941
dbus.String(value, variant_level=1))
942
943
# created - property
944
@dbus_service_property(_interface, signature=u"s", access=u"read")
945
def created_dbus_property(self):
946
return dbus.String(self._datetime_to_dbus(self.created))
947
948
# last_enabled - property
949
@dbus_service_property(_interface, signature=u"s", access=u"read")
950
def last_enabled_dbus_property(self):
951
if self.last_enabled is None:
952
return dbus.String(u"")
953
return dbus.String(self._datetime_to_dbus(self.last_enabled))
954
955
# enabled - property
956
@dbus_service_property(_interface, signature=u"b",
957
access=u"readwrite")
958
def enabled_dbus_property(self, value=None):
959
if value is None: # get
960
return dbus.Boolean(self.enabled)
961
if value:
962
self.enable()
963
else:
964
self.disable()
965
966
# last_checked_ok - property
967
@dbus_service_property(_interface, signature=u"s",
968
access=u"readwrite")
969
def last_checked_ok_dbus_property(self, value=None):
970
if value is not None:
971
self.checked_ok()
972
return
973
if self.last_checked_ok is None:
974
return dbus.String(u"")
975
return dbus.String(self._datetime_to_dbus(self
976
.last_checked_ok))
977
978
# timeout - property
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
981
def timeout_dbus_property(self, value=None):
982
if value is None: # get
983
return dbus.UInt64(self.timeout_milliseconds())
984
self.timeout = datetime.timedelta(0, 0, 0, value)
985
# Emit D-Bus signal
986
self.PropertyChanged(dbus.String(u"timeout"),
987
dbus.UInt64(value, variant_level=1))
988
if getattr(self, u"disable_initiator_tag", None) is None:
989
return
990
# Reschedule timeout
991
gobject.source_remove(self.disable_initiator_tag)
992
self.disable_initiator_tag = None
993
time_to_die = (self.
994
_timedelta_to_milliseconds((self
995
.last_checked_ok
996
+ self.timeout)
997
- datetime.datetime
998
.utcnow()))
999
if time_to_die <= 0:
1000
# The timeout has passed
1001
self.disable()
1002
else:
1003
self.disable_initiator_tag = (gobject.timeout_add
1004
(time_to_die, self.disable))
1005
1006
# interval - property
1007
@dbus_service_property(_interface, signature=u"t",
1008
access=u"readwrite")
1009
def interval_dbus_property(self, value=None):
1010
if value is None: # get
1011
return dbus.UInt64(self.interval_milliseconds())
1012
self.interval = datetime.timedelta(0, 0, 0, value)
1013
# Emit D-Bus signal
1014
self.PropertyChanged(dbus.String(u"interval"),
1015
dbus.UInt64(value, variant_level=1))
1016
if getattr(self, u"checker_initiator_tag", None) is None:
1017
return
1018
# Reschedule checker run
1019
gobject.source_remove(self.checker_initiator_tag)
1020
self.checker_initiator_tag = (gobject.timeout_add
1021
(value, self.start_checker))
1022
self.start_checker() # Start one now, too
1023
1024
# checker - property
1025
@dbus_service_property(_interface, signature=u"s",
1026
access=u"readwrite")
1027
def checker_dbus_property(self, value=None):
1028
if value is None: # get
1029
return dbus.String(self.checker_command)
1030
self.checker_command = value
1031
# Emit D-Bus signal
1032
self.PropertyChanged(dbus.String(u"checker"),
1033
dbus.String(self.checker_command,
1034
variant_level=1))
1035
1036
# checker_running - property
1037
@dbus_service_property(_interface, signature=u"b",
1038
access=u"readwrite")
1039
def checker_running_dbus_property(self, value=None):
1040
if value is None: # get
1041
return dbus.Boolean(self.checker is not None)
1042
if value:
1043
self.start_checker()
1044
else:
1045
self.stop_checker()
1046
1047
# object_path - property
1048
@dbus_service_property(_interface, signature=u"o", access=u"read")
1049
def object_path_dbus_property(self):
1050
return self.dbus_object_path # is already a dbus.ObjectPath
1051
1052
# secret = property
1053
@dbus_service_property(_interface, signature=u"ay",
1054
access=u"write", byte_arrays=True)
1055
def secret_dbus_property(self, value):
1056
self.secret = str(value)
606
StopChecker = dbus.service.method(_interface)(stop_checker)
607
StopChecker.__name__ = "StopChecker"
1057
608
1058
609
del _interface
1059
610
1060
611
1061
class ProxyClient(object):
1062
def __init__(self, child_pipe, fpr, address):
1063
self._pipe = child_pipe
1064
self._pipe.send(('init', fpr, address))
1065
if not self._pipe.recv():
1066
raise KeyError()
1067
1068
def __getattribute__(self, name):
1069
if(name == '_pipe'):
1070
return super(ProxyClient, self).__getattribute__(name)
1071
self._pipe.send(('getattr', name))
1072
data = self._pipe.recv()
1073
if data[0] == 'data':
1074
return data[1]
1075
if data[0] == 'function':
1076
def func(*args, **kwargs):
1077
self._pipe.send(('funcall', name, args, kwargs))
1078
return self._pipe.recv()[1]
1079
return func
1080
1081
def __setattr__(self, name, value):
1082
if(name == '_pipe'):
1083
return super(ProxyClient, self).__setattr__(name, value)
1084
self._pipe.send(('setattr', name, value))
1085
1086
1087
class ClientHandler(socketserver.BaseRequestHandler, object):
1088
"""A class to handle client connections.
1089
1090
Instantiated once for each connection to handle it.
612
def peer_certificate(session):
613
"Return the peer's OpenPGP certificate as a bytestring"
614
# If not an OpenPGP certificate...
615
if (gnutls.library.functions
616
.gnutls_certificate_type_get(session._c_object)
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
# ...do the normal thing
619
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
621
cert_list = (gnutls.library.functions
622
.gnutls_certificate_get_peers
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
626
" certificate")
627
if list_size.value == 0:
628
return None
629
cert = cert_list[0]
630
return ctypes.string_at(cert.data, cert.size)
631
632
633
def fingerprint(openpgp):
634
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
# New GnuTLS "datum" with the OpenPGP public key
636
datum = (gnutls.library.types
637
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
ctypes.POINTER
639
(ctypes.c_ubyte)),
640
ctypes.c_uint(len(openpgp))))
641
# New empty GnuTLS certificate
642
crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
(gnutls.library.functions
644
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
645
# Import the OpenPGP public key into the certificate
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
gnutls.library.constants
649
.GNUTLS_OPENPGP_FMT_RAW))
650
# Verify the self signature in the key
651
crtverify = ctypes.c_uint()
652
(gnutls.library.functions
653
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
654
if crtverify.value != 0:
655
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
raise gnutls.errors.CertificateSecurityError("Verify failed")
657
# New buffer for the fingerprint
658
buf = ctypes.create_string_buffer(20)
659
buf_len = ctypes.c_size_t()
660
# Get the fingerprint from the certificate into the buffer
661
(gnutls.library.functions
662
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
ctypes.byref(buf_len)))
664
# Deinit the certificate
665
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
# Convert the buffer to a Python bytestring
667
fpr = ctypes.string_at(buf, buf_len.value)
668
# Convert the bytestring to hexadecimal notation
669
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
670
return hex_fpr
671
672
673
class TCP_handler(SocketServer.BaseRequestHandler, object):
674
"""A TCP request handler class.
675
Instantiated by IPv6_TCPServer for each request to handle it.
1091
676
Note: This will run in its own forked process."""
1092
677
1093
678
def handle(self):
1094
with contextlib.closing(self.server.child_pipe) as child_pipe:
1095
logger.info(u"TCP connection from: %s",
1096
unicode(self.client_address))
1097
logger.debug(u"Pipe FD: %d",
1098
self.server.child_pipe.fileno())
1099
1100
session = (gnutls.connection
1101
.ClientSession(self.request,
1102
gnutls.connection
1103
.X509Credentials()))
1104
1105
# Note: gnutls.connection.X509Credentials is really a
1106
# generic GnuTLS certificate credentials object so long as
1107
# no X.509 keys are added to it. Therefore, we can use it
1108
# here despite using OpenPGP certificates.
1109
1110
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1111
# u"+AES-256-CBC", u"+SHA1",
1112
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1113
# u"+DHE-DSS"))
1114
# Use a fallback default, since this MUST be set.
1115
priority = self.server.gnutls_priority
1116
if priority is None:
1117
priority = u"NORMAL"
1118
(gnutls.library.functions
1119
.gnutls_priority_set_direct(session._c_object,
1120
priority, None))
1121
1122
# Start communication using the Mandos protocol
1123
# Get protocol number
1124
line = self.request.makefile().readline()
1125
logger.debug(u"Protocol version: %r", line)
1126
try:
1127
if int(line.strip().split()[0]) > 1:
1128
raise RuntimeError
1129
except (ValueError, IndexError, RuntimeError), error:
1130
logger.error(u"Unknown protocol version: %s", error)
1131
return
1132
1133
# Start GnuTLS connection
1134
try:
1135
session.handshake()
1136
except gnutls.errors.GNUTLSError, error:
1137
logger.warning(u"Handshake failed: %s", error)
1138
# Do not run session.bye() here: the session is not
1139
# established. Just abandon the request.
1140
return
1141
logger.debug(u"Handshake succeeded")
1142
1143
approval_required = False
1144
try:
1145
try:
1146
fpr = self.fingerprint(self.peer_certificate
1147
(session))
1148
except (TypeError, gnutls.errors.GNUTLSError), error:
1149
logger.warning(u"Bad certificate: %s", error)
1150
return
1151
logger.debug(u"Fingerprint: %s", fpr)
1152
1153
try:
1154
client = ProxyClient(child_pipe, fpr,
1155
self.client_address)
1156
except KeyError:
1157
return
1158
1159
if client.approved_delay:
1160
delay = client.approved_delay
1161
client.approvals_pending += 1
1162
approval_required = True
1163
1164
while True:
1165
if not client.enabled:
1166
logger.warning(u"Client %s is disabled",
1167
client.name)
1168
if self.server.use_dbus:
1169
# Emit D-Bus signal
1170
client.Rejected("Disabled")
1171
return
1172
1173
if client._approved or not client.approved_delay:
1174
#We are approved or approval is disabled
1175
break
1176
elif client._approved is None:
1177
logger.info(u"Client %s need approval",
1178
client.name)
1179
if self.server.use_dbus:
1180
# Emit D-Bus signal
1181
client.NeedApproval(
1182
client.approved_delay_milliseconds(),
1183
client.approved_by_default)
1184
else:
1185
logger.warning(u"Client %s was not approved",
1186
client.name)
1187
if self.server.use_dbus:
1188
# Emit D-Bus signal
1189
client.Rejected("Disapproved")
1190
return
1191
1192
#wait until timeout or approved
1193
#x = float(client._timedelta_to_milliseconds(delay))
1194
time = datetime.datetime.now()
1195
client.changedstate.acquire()
1196
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1197
client.changedstate.release()
1198
time2 = datetime.datetime.now()
1199
if (time2 - time) >= delay:
1200
if not client.approved_by_default:
1201
logger.warning("Client %s timed out while"
1202
" waiting for approval",
1203
client.name)
1204
if self.server.use_dbus:
1205
# Emit D-Bus signal
1206
client.Rejected("Time out")
1207
return
1208
else:
1209
break
1210
else:
1211
delay -= time2 - time
1212
1213
sent_size = 0
1214
while sent_size < len(client.secret):
1215
# XXX handle session exception
1216
sent = session.send(client.secret[sent_size:])
1217
logger.debug(u"Sent: %d, remaining: %d",
1218
sent, len(client.secret)
1219
- (sent_size + sent))
1220
sent_size += sent
1221
1222
logger.info(u"Sending secret to %s", client.name)
1223
# bump the timeout as if seen
1224
client.checked_ok()
1225
if self.server.use_dbus:
1226
# Emit D-Bus signal
1227
client.GotSecret()
1228
1229
finally:
1230
if approval_required:
1231
client.approvals_pending -= 1
1232
session.bye()
1233
1234
@staticmethod
1235
def peer_certificate(session):
1236
"Return the peer's OpenPGP certificate as a bytestring"
1237
# If not an OpenPGP certificate...
1238
if (gnutls.library.functions
1239
.gnutls_certificate_type_get(session._c_object)
1240
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1241
# ...do the normal thing
1242
return session.peer_certificate
1243
list_size = ctypes.c_uint(1)
1244
cert_list = (gnutls.library.functions
1245
.gnutls_certificate_get_peers
1246
(session._c_object, ctypes.byref(list_size)))
1247
if not bool(cert_list) and list_size.value != 0:
1248
raise gnutls.errors.GNUTLSError(u"error getting peer"
1249
u" certificate")
1250
if list_size.value == 0:
1251
return None
1252
cert = cert_list[0]
1253
return ctypes.string_at(cert.data, cert.size)
1254
1255
@staticmethod
1256
def fingerprint(openpgp):
1257
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1258
# New GnuTLS "datum" with the OpenPGP public key
1259
datum = (gnutls.library.types
1260
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1261
ctypes.POINTER
1262
(ctypes.c_ubyte)),
1263
ctypes.c_uint(len(openpgp))))
1264
# New empty GnuTLS certificate
1265
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1266
(gnutls.library.functions
1267
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1268
# Import the OpenPGP public key into the certificate
1269
(gnutls.library.functions
1270
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1271
gnutls.library.constants
1272
.GNUTLS_OPENPGP_FMT_RAW))
1273
# Verify the self signature in the key
1274
crtverify = ctypes.c_uint()
1275
(gnutls.library.functions
1276
.gnutls_openpgp_crt_verify_self(crt, 0,
1277
ctypes.byref(crtverify)))
1278
if crtverify.value != 0:
1279
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1280
raise (gnutls.errors.CertificateSecurityError
1281
(u"Verify failed"))
1282
# New buffer for the fingerprint
1283
buf = ctypes.create_string_buffer(20)
1284
buf_len = ctypes.c_size_t()
1285
# Get the fingerprint from the certificate into the buffer
1286
(gnutls.library.functions
1287
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1288
ctypes.byref(buf_len)))
1289
# Deinit the certificate
1290
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1291
# Convert the buffer to a Python bytestring
1292
fpr = ctypes.string_at(buf, buf_len.value)
1293
# Convert the bytestring to hexadecimal notation
1294
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1295
return hex_fpr
1296
1297
1298
class MultiprocessingMixIn(object):
1299
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1300
def sub_process_main(self, request, address):
1301
try:
1302
self.finish_request(request, address)
1303
except:
1304
self.handle_error(request, address)
1305
self.close_request(request)
1306
1307
def process_request(self, request, address):
1308
"""Start a new process to process the request."""
1309
multiprocessing.Process(target = self.sub_process_main,
1310
args = (request, address)).start()
1311
1312
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1313
""" adds a pipe to the MixIn """
1314
def process_request(self, request, client_address):
1315
"""Overrides and wraps the original process_request().
1316
1317
This function creates a new pipe in self.pipe
1318
"""
1319
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1320
1321
super(MultiprocessingMixInWithPipe,
1322
self).process_request(request, client_address)
1323
self.child_pipe.close()
1324
self.add_pipe(parent_pipe)
1325
1326
def add_pipe(self, parent_pipe):
1327
"""Dummy function; override as necessary"""
1328
pass
1329
1330
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1331
socketserver.TCPServer, object):
679
logger.info(u"TCP connection from: %s",
680
unicode(self.client_address))
681
session = (gnutls.connection
682
.ClientSession(self.request,
683
gnutls.connection
684
.X509Credentials()))
685
686
line = self.request.makefile().readline()
687
logger.debug(u"Protocol version: %r", line)
688
try:
689
if int(line.strip().split()[0]) > 1:
690
raise RuntimeError
691
except (ValueError, IndexError, RuntimeError), error:
692
logger.error(u"Unknown protocol version: %s", error)
693
return
694
695
# Note: gnutls.connection.X509Credentials is really a generic
696
# GnuTLS certificate credentials object so long as no X.509
697
# keys are added to it. Therefore, we can use it here despite
698
# using OpenPGP certificates.
699
700
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
# "+DHE-DSS"))
703
# Use a fallback default, since this MUST be set.
704
priority = self.server.settings.get("priority", "NORMAL")
705
(gnutls.library.functions
706
.gnutls_priority_set_direct(session._c_object,
707
priority, None))
708
709
try:
710
session.handshake()
711
except gnutls.errors.GNUTLSError, error:
712
logger.warning(u"Handshake failed: %s", error)
713
# Do not run session.bye() here: the session is not
714
# established. Just abandon the request.
715
return
716
logger.debug(u"Handshake succeeded")
717
try:
718
fpr = fingerprint(peer_certificate(session))
719
except (TypeError, gnutls.errors.GNUTLSError), error:
720
logger.warning(u"Bad certificate: %s", error)
721
session.bye()
722
return
723
logger.debug(u"Fingerprint: %s", fpr)
724
725
for c in self.server.clients:
726
if c.fingerprint == fpr:
727
client = c
728
break
729
else:
730
logger.warning(u"Client not found for fingerprint: %s",
731
fpr)
732
session.bye()
733
return
734
# Have to check if client.still_valid(), since it is possible
735
# that the client timed out while establishing the GnuTLS
736
# session.
737
if not client.still_valid():
738
logger.warning(u"Client %(name)s is invalid",
739
vars(client))
740
session.bye()
741
return
742
## This won't work here, since we're in a fork.
743
# client.checked_ok()
744
sent_size = 0
745
while sent_size < len(client.secret):
746
sent = session.send(client.secret[sent_size:])
747
logger.debug(u"Sent: %d, remaining: %d",
748
sent, len(client.secret)
749
- (sent_size + sent))
750
sent_size += sent
751
session.bye()
752
753
754
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
SocketServer.TCPServer, object):
1332
756
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1333
1334
757
Attributes:
758
settings: Server settings
759
clients: Set() of Client objects
1335
760
enabled: Boolean; whether this server is activated yet
1336
interface: None or a network interface name (string)
1337
use_ipv6: Boolean; to use IPv6 or not
1338
761
"""
1339
def __init__(self, server_address, RequestHandlerClass,
1340
interface=None, use_ipv6=True):
1341
self.interface = interface
1342
if use_ipv6:
1343
self.address_family = socket.AF_INET6
1344
socketserver.TCPServer.__init__(self, server_address,
1345
RequestHandlerClass)
762
address_family = socket.AF_INET6
763
def __init__(self, *args, **kwargs):
764
if "settings" in kwargs:
765
self.settings = kwargs["settings"]
766
del kwargs["settings"]
767
if "clients" in kwargs:
768
self.clients = kwargs["clients"]
769
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
774
self.enabled = False
775
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1346
776
def server_bind(self):
1347
777
"""This overrides the normal server_bind() function
1348
778
to bind to an interface if one was specified, and also NOT to
1349
779
bind to an address or port if they were not specified."""
1350
if self.interface is not None:
1351
if SO_BINDTODEVICE is None:
1352
logger.error(u"SO_BINDTODEVICE does not exist;"
1353
u" cannot bind to interface %s",
1354
self.interface)
1355
else:
1356
try:
1357
self.socket.setsockopt(socket.SOL_SOCKET,
1358
SO_BINDTODEVICE,
1359
str(self.interface
1360
+ u'\0'))
1361
except socket.error, error:
1362
if error[0] == errno.EPERM:
1363
logger.error(u"No permission to"
1364
u" bind to interface %s",
1365
self.interface)
1366
elif error[0] == errno.ENOPROTOOPT:
1367
logger.error(u"SO_BINDTODEVICE not available;"
1368
u" cannot bind to interface %s",
1369
self.interface)
1370
else:
1371
raise
780
if self.settings["interface"]:
781
# 25 is from /usr/include/asm-i486/socket.h
782
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
783
try:
784
self.socket.setsockopt(socket.SOL_SOCKET,
785
SO_BINDTODEVICE,
786
self.settings["interface"])
787
except socket.error, error:
788
if error[0] == errno.EPERM:
789
logger.error(u"No permission to"
790
u" bind to interface %s",
791
self.settings["interface"])
792
else:
793
raise
1372
794
# Only bind(2) the socket if we really need to.
1373
795
if self.server_address[0] or self.server_address[1]:
1374
796
if not self.server_address[0]:
1375
797
if self.address_family == socket.AF_INET6:
1376
any_address = u"::" # in6addr_any
798
any_address = "::" # in6addr_any
1377
799
else:
1378
800
any_address = socket.INADDR_ANY
1379
801
self.server_address = (any_address,
1381
803
elif not self.server_address[1]:
1382
804
self.server_address = (self.server_address[0],
1383
805
0)
1384
# if self.interface:
806
# if self.settings["interface"]:
1385
807
# self.server_address = (self.server_address[0],
1386
808
# 0, # port
1387
809
# 0, # flowinfo
1388
810
# if_nametoindex
1389
# (self.interface))
1390
return socketserver.TCPServer.server_bind(self)
1391
1392
1393
class MandosServer(IPv6_TCPServer):
1394
"""Mandos server.
1395
1396
Attributes:
1397
clients: set of Client objects
1398
gnutls_priority GnuTLS priority string
1399
use_dbus: Boolean; to emit D-Bus signals or not
1400
1401
Assumes a gobject.MainLoop event loop.
1402
"""
1403
def __init__(self, server_address, RequestHandlerClass,
1404
interface=None, use_ipv6=True, clients=None,
1405
gnutls_priority=None, use_dbus=True):
1406
self.enabled = False
1407
self.clients = clients
1408
if self.clients is None:
1409
self.clients = set()
1410
self.use_dbus = use_dbus
1411
self.gnutls_priority = gnutls_priority
1412
IPv6_TCPServer.__init__(self, server_address,
1413
RequestHandlerClass,
1414
interface = interface,
1415
use_ipv6 = use_ipv6)
811
# (self.settings
812
# ["interface"]))
813
return super(IPv6_TCPServer, self).server_bind()
1416
814
def server_activate(self):
1417
815
if self.enabled:
1418
return socketserver.TCPServer.server_activate(self)
816
return super(IPv6_TCPServer, self).server_activate()
1419
817
def enable(self):
1420
818
self.enabled = True
1421
def add_pipe(self, parent_pipe):
1422
# Call "handle_ipc" for both data and EOF events
1423
gobject.io_add_watch(parent_pipe.fileno(),
1424
gobject.IO_IN | gobject.IO_HUP,
1425
functools.partial(self.handle_ipc,
1426
parent_pipe = parent_pipe))
1427
1428
def handle_ipc(self, source, condition, parent_pipe=None,
1429
client_object=None):
1430
condition_names = {
1431
gobject.IO_IN: u"IN", # There is data to read.
1432
gobject.IO_OUT: u"OUT", # Data can be written (without
1433
# blocking).
1434
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1435
gobject.IO_ERR: u"ERR", # Error condition.
1436
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1437
# broken, usually for pipes and
1438
# sockets).
1439
}
1440
conditions_string = ' | '.join(name
1441
for cond, name in
1442
condition_names.iteritems()
1443
if cond & condition)
1444
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1445
conditions_string)
1446
1447
# error or the other end of multiprocessing.Pipe has closed
1448
if condition & gobject.IO_HUP or condition & gobject.IO_ERR:
1449
return False
1450
1451
# Read a request from the child
1452
request = parent_pipe.recv()
1453
logger.debug(u"IPC request: %s", repr(request))
1454
command = request[0]
1455
1456
if command == 'init':
1457
fpr = request[1]
1458
address = request[2]
1459
1460
for c in self.clients:
1461
if c.fingerprint == fpr:
1462
client = c
1463
break
1464
else:
1465
logger.warning(u"Client not found for fingerprint: %s, ad"
1466
u"dress: %s", fpr, address)
1467
if self.use_dbus:
1468
# Emit D-Bus signal
1469
mandos_dbus_service.ClientNotFound(fpr, address)
1470
parent_pipe.send(False)
1471
return False
1472
1473
gobject.io_add_watch(parent_pipe.fileno(),
1474
gobject.IO_IN | gobject.IO_HUP,
1475
functools.partial(self.handle_ipc,
1476
parent_pipe = parent_pipe,
1477
client_object = client))
1478
parent_pipe.send(True)
1479
# remove the old hook in favor of the new above hook on same fileno
1480
return False
1481
if command == 'funcall':
1482
funcname = request[1]
1483
args = request[2]
1484
kwargs = request[3]
1485
1486
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1487
1488
if command == 'getattr':
1489
attrname = request[1]
1490
if callable(client_object.__getattribute__(attrname)):
1491
parent_pipe.send(('function',))
1492
else:
1493
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1494
1495
if command == 'setattr':
1496
attrname = request[1]
1497
value = request[2]
1498
setattr(client_object, attrname, value)
1499
1500
return True
1501
819
1502
820
1503
821
def string_to_delta(interval):
1504
822
"""Parse a string and return a datetime.timedelta
1505
823
1506
>>> string_to_delta(u'7d')
824
>>> string_to_delta('7d')
1507
825
datetime.timedelta(7)
1508
>>> string_to_delta(u'60s')
826
>>> string_to_delta('60s')
1509
827
datetime.timedelta(0, 60)
1510
>>> string_to_delta(u'60m')
828
>>> string_to_delta('60m')
1511
829
datetime.timedelta(0, 3600)
1512
>>> string_to_delta(u'24h')
830
>>> string_to_delta('24h')
1513
831
datetime.timedelta(1)
1514
832
>>> string_to_delta(u'1w')
1515
833
datetime.timedelta(7)
1516
>>> string_to_delta(u'5m 30s')
834
>>> string_to_delta('5m 30s')
1517
835
datetime.timedelta(0, 330)
1518
836
"""
1519
837
timevalue = datetime.timedelta(0)
1532
850
elif suffix == u"w":
1533
851
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1534
852
else:
1535
raise ValueError(u"Unknown suffix %r" % suffix)
1536
except (ValueError, IndexError), e:
1537
raise ValueError(e.message)
853
raise ValueError
854
except (ValueError, IndexError):
855
raise ValueError
1538
856
timevalue += delta
1539
857
return timevalue
1540
858
1541
859
860
def server_state_changed(state):
861
"""Derived from the Avahi example code"""
862
if state == avahi.SERVER_COLLISION:
863
logger.error(u"Zeroconf server name collision")
864
service.remove()
865
elif state == avahi.SERVER_RUNNING:
866
service.add()
867
868
869
def entry_group_state_changed(state, error):
870
"""Derived from the Avahi example code"""
871
logger.debug(u"Avahi state change: %i", state)
872
873
if state == avahi.ENTRY_GROUP_ESTABLISHED:
874
logger.debug(u"Zeroconf service established.")
875
elif state == avahi.ENTRY_GROUP_COLLISION:
876
logger.warning(u"Zeroconf service name collision.")
877
service.rename()
878
elif state == avahi.ENTRY_GROUP_FAILURE:
879
logger.critical(u"Avahi: Error in group state changed %s",
880
unicode(error))
881
raise AvahiGroupError(u"State changed: %s" % unicode(error))
882
1542
883
def if_nametoindex(interface):
1543
"""Call the C function if_nametoindex(), or equivalent
1544
1545
Note: This function cannot accept a unicode string."""
884
"""Call the C function if_nametoindex(), or equivalent"""
1546
885
global if_nametoindex
1547
886
try:
1548
887
if_nametoindex = (ctypes.cdll.LoadLibrary
1549
(ctypes.util.find_library(u"c"))
888
(ctypes.util.find_library("c"))
1550
889
.if_nametoindex)
1551
890
except (OSError, AttributeError):
1552
logger.warning(u"Doing if_nametoindex the hard way")
891
if "struct" not in sys.modules:
892
import struct
893
if "fcntl" not in sys.modules:
894
import fcntl
1553
895
def if_nametoindex(interface):
1554
896
"Get an interface index the hard way, i.e. using fcntl()"
1555
897
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1556
with contextlib.closing(socket.socket()) as s:
898
with closing(socket.socket()) as s:
1557
899
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1558
struct.pack(str(u"16s16x"),
1559
interface))
1560
interface_index = struct.unpack(str(u"I"),
1561
ifreq[16:20])[0]
900
struct.pack("16s16x", interface))
901
interface_index = struct.unpack("I", ifreq[16:20])[0]
1562
902
return interface_index
1563
903
return if_nametoindex(interface)
1564
904
1565
905
1566
906
def daemon(nochdir = False, noclose = False):
1567
907
"""See daemon(3). Standard BSD Unix function.
1568
1569
908
This should really exist as os.daemon, but it doesn't (yet)."""
1570
909
if os.fork():
1571
910
sys.exit()
1572
911
os.setsid()
1573
912
if not nochdir:
1574
os.chdir(u"/")
913
os.chdir("/")
1575
914
if os.fork():
1576
915
sys.exit()
1577
916
if not noclose:
1579
918
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1580
919
if not stat.S_ISCHR(os.fstat(null).st_mode):
1581
920
raise OSError(errno.ENODEV,
1582
u"%s not a character device"
1583
% os.path.devnull)
921
"/dev/null not a character device")
1584
922
os.dup2(null, sys.stdin.fileno())
1585
923
os.dup2(null, sys.stdout.fileno())
1586
924
os.dup2(null, sys.stderr.fileno())
1589
927
1590
928
1591
929
def main():
1592
1593
##################################################################
1594
# Parsing of options, both command line and config file
1595
1596
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
1597
parser.add_option("-i", u"--interface", type=u"string",
1598
metavar="IF", help=u"Bind to interface IF")
1599
parser.add_option("-a", u"--address", type=u"string",
1600
help=u"Address to listen for requests on")
1601
parser.add_option("-p", u"--port", type=u"int",
1602
help=u"Port number to receive requests on")
1603
parser.add_option("--check", action=u"store_true",
1604
help=u"Run self-test")
1605
parser.add_option("--debug", action=u"store_true",
1606
help=u"Debug mode; run in foreground and log to"
1607
u" terminal")
1608
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1609
u" priority string (see GnuTLS documentation)")
1610
parser.add_option("--servicename", type=u"string",
1611
metavar=u"NAME", help=u"Zeroconf service name")
1612
parser.add_option("--configdir", type=u"string",
1613
default=u"/etc/mandos", metavar=u"DIR",
1614
help=u"Directory to search for configuration"
1615
u" files")
1616
parser.add_option("--no-dbus", action=u"store_false",
1617
dest=u"use_dbus", help=u"Do not provide D-Bus"
1618
u" system bus interface")
1619
parser.add_option("--no-ipv6", action=u"store_false",
1620
dest=u"use_ipv6", help=u"Do not use IPv6")
931
parser.add_option("-i", "--interface", type="string",
932
metavar="IF", help="Bind to interface IF")
933
parser.add_option("-a", "--address", type="string",
934
help="Address to listen for requests on")
935
parser.add_option("-p", "--port", type="int",
936
help="Port number to receive requests on")
937
parser.add_option("--check", action="store_true",
938
help="Run self-test")
939
parser.add_option("--debug", action="store_true",
940
help="Debug mode; run in foreground and log to"
941
" terminal")
942
parser.add_option("--priority", type="string", help="GnuTLS"
943
" priority string (see GnuTLS documentation)")
944
parser.add_option("--servicename", type="string", metavar="NAME",
945
help="Zeroconf service name")
946
parser.add_option("--configdir", type="string",
947
default="/etc/mandos", metavar="DIR",
948
help="Directory to search for configuration"
949
" files")
950
parser.add_option("--no-dbus", action="store_false",
951
dest="use_dbus",
952
help=optparse.SUPPRESS_HELP) # XXX: Not done yet
953
parser.add_option("--no-ipv6", action="store_false",
954
dest="use_ipv6", help="Do not use IPv6")
1621
955
options = parser.parse_args()[0]
1622
956
1623
957
if options.check:
1626
960
sys.exit()
1627
961
1628
962
# Default values for config file for server-global settings
1629
server_defaults = { u"interface": u"",
1630
u"address": u"",
1631
u"port": u"",
1632
u"debug": u"False",
1633
u"priority":
1634
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1635
u"servicename": u"Mandos",
1636
u"use_dbus": u"True",
1637
u"use_ipv6": u"True",
963
server_defaults = { "interface": "",
964
"address": "",
965
"port": "",
966
"debug": "False",
967
"priority":
968
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
969
"servicename": "Mandos",
970
"use_dbus": "True",
971
"use_ipv6": "True",
1638
972
}
1639
973
1640
974
# Parse config file for server-global settings
1641
server_config = configparser.SafeConfigParser(server_defaults)
975
server_config = ConfigParser.SafeConfigParser(server_defaults)
1642
976
del server_defaults
1643
server_config.read(os.path.join(options.configdir,
1644
u"mandos.conf"))
977
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1645
978
# Convert the SafeConfigParser object to a dict
1646
979
server_settings = server_config.defaults()
1647
980
# Use the appropriate methods on the non-string config options
1648
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1649
server_settings[option] = server_config.getboolean(u"DEFAULT",
1650
option)
981
server_settings["debug"] = server_config.getboolean("DEFAULT",
982
"debug")
983
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
984
"use_dbus")
985
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
986
"use_ipv6")
1651
987
if server_settings["port"]:
1652
server_settings["port"] = server_config.getint(u"DEFAULT",
1653
u"port")
988
server_settings["port"] = server_config.getint("DEFAULT",
989
"port")
1654
990
del server_config
1655
991
1656
992
# Override the settings from the config file with command line
1657
993
# options, if set.
1658
for option in (u"interface", u"address", u"port", u"debug",
1659
u"priority", u"servicename", u"configdir",
1660
u"use_dbus", u"use_ipv6"):
994
for option in ("interface", "address", "port", "debug",
995
"priority", "servicename", "configdir",
996
"use_dbus", "use_ipv6"):
1661
997
value = getattr(options, option)
1662
998
if value is not None:
1663
999
server_settings[option] = value
1664
1000
del options
1665
# Force all strings to be unicode
1666
for option in server_settings.keys():
1667
if type(server_settings[option]) is str:
1668
server_settings[option] = unicode(server_settings[option])
1669
1001
# Now we have our good server settings in "server_settings"
1670
1002
1671
##################################################################
1672
1673
1003
# For convenience
1674
debug = server_settings[u"debug"]
1675
use_dbus = server_settings[u"use_dbus"]
1676
use_ipv6 = server_settings[u"use_ipv6"]
1004
debug = server_settings["debug"]
1005
use_dbus = server_settings["use_dbus"]
1006
use_dbus = False # XXX: Not done yet
1007
use_ipv6 = server_settings["use_ipv6"]
1677
1008
1678
1009
if not debug:
1679
1010
syslogger.setLevel(logging.WARNING)
1680
1011
console.setLevel(logging.WARNING)
1681
1012
1682
if server_settings[u"servicename"] != u"Mandos":
1013
if server_settings["servicename"] != "Mandos":
1683
1014
syslogger.setFormatter(logging.Formatter
1684
(u'Mandos (%s) [%%(process)d]:'
1685
u' %%(levelname)s: %%(message)s'
1686
% server_settings[u"servicename"]))
1015
('Mandos (%s): %%(levelname)s:'
1016
' %%(message)s'
1017
% server_settings["servicename"]))
1687
1018
1688
1019
# Parse config file with clients
1689
client_defaults = { u"timeout": u"1h",
1690
u"interval": u"5m",
1691
u"checker": u"fping -q -- %%(host)s",
1692
u"host": u"",
1693
u"approved_delay": u"5m",
1694
u"approved_duration": u"1s",
1020
client_defaults = { "timeout": "1h",
1021
"interval": "5m",
1022
"checker": "fping -q -- %%(host)s",
1023
"host": "",
1695
1024
}
1696
client_config = configparser.SafeConfigParser(client_defaults)
1697
client_config.read(os.path.join(server_settings[u"configdir"],
1698
u"clients.conf"))
1699
1700
global mandos_dbus_service
1701
mandos_dbus_service = None
1702
1703
tcp_server = MandosServer((server_settings[u"address"],
1704
server_settings[u"port"]),
1705
ClientHandler,
1706
interface=server_settings[u"interface"],
1707
use_ipv6=use_ipv6,
1708
gnutls_priority=
1709
server_settings[u"priority"],
1710
use_dbus=use_dbus)
1711
pidfilename = u"/var/run/mandos.pid"
1025
client_config = ConfigParser.SafeConfigParser(client_defaults)
1026
client_config.read(os.path.join(server_settings["configdir"],
1027
"clients.conf"))
1028
1029
clients = Set()
1030
tcp_server = IPv6_TCPServer((server_settings["address"],
1031
server_settings["port"]),
1032
TCP_handler,
1033
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
1035
pidfilename = "/var/run/mandos.pid"
1712
1036
try:
1713
pidfile = open(pidfilename, u"w")
1037
pidfile = open(pidfilename, "w")
1714
1038
except IOError:
1715
logger.error(u"Could not open file %r", pidfilename)
1039
logger.error("Could not open file %r", pidfilename)
1716
1040
1717
1041
try:
1718
uid = pwd.getpwnam(u"_mandos").pw_uid
1719
gid = pwd.getpwnam(u"_mandos").pw_gid
1042
uid = pwd.getpwnam("_mandos").pw_uid
1043
gid = pwd.getpwnam("_mandos").pw_gid
1720
1044
except KeyError:
1721
1045
try:
1722
uid = pwd.getpwnam(u"mandos").pw_uid
1723
gid = pwd.getpwnam(u"mandos").pw_gid
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
gid = pwd.getpwnam("mandos").pw_gid
1724
1048
except KeyError:
1725
1049
try:
1726
uid = pwd.getpwnam(u"nobody").pw_uid
1727
gid = pwd.getpwnam(u"nobody").pw_gid
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
gid = pwd.getpwnam("nogroup").pw_gid
1728
1052
except KeyError:
1729
1053
uid = 65534
1730
1054
gid = 65534
1743
1067
1744
1068
@gnutls.library.types.gnutls_log_func
1745
1069
def debug_gnutls(level, string):
1746
logger.debug(u"GnuTLS: %s", string[:-1])
1070
logger.debug("GnuTLS: %s", string[:-1])
1747
1071
1748
1072
(gnutls.library.functions
1749
1073
.gnutls_global_set_log_function(debug_gnutls))
1750
1074
1075
global service
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
service = AvahiService(name = server_settings["servicename"],
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
1080
if server_settings["interface"]:
1081
service.interface = (if_nametoindex
1082
(server_settings["interface"]))
1083
1751
1084
global main_loop
1085
global bus
1086
global server
1752
1087
# From the Avahi example code
1753
1088
DBusGMainLoop(set_as_default=True )
1754
1089
main_loop = gobject.MainLoop()
1755
1090
bus = dbus.SystemBus()
1091
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1092
avahi.DBUS_PATH_SERVER),
1093
avahi.DBUS_INTERFACE_SERVER)
1756
1094
# End of Avahi example code
1757
1095
if use_dbus:
1758
try:
1759
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1760
bus, do_not_queue=True)
1761
except dbus.exceptions.NameExistsException, e:
1762
logger.error(unicode(e) + u", disabling D-Bus")
1763
use_dbus = False
1764
server_settings[u"use_dbus"] = False
1765
tcp_server.use_dbus = False
1766
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1767
service = AvahiService(name = server_settings[u"servicename"],
1768
servicetype = u"_mandos._tcp",
1769
protocol = protocol, bus = bus)
1770
if server_settings["interface"]:
1771
service.interface = (if_nametoindex
1772
(str(server_settings[u"interface"])))
1773
1774
global multiprocessing_manager
1775
multiprocessing_manager = multiprocessing.Manager()
1776
1777
client_class = Client
1778
if use_dbus:
1779
client_class = functools.partial(ClientDBus, bus = bus)
1780
def client_config_items(config, section):
1781
special_settings = {
1782
"approved_by_default":
1783
lambda: config.getboolean(section,
1784
"approved_by_default"),
1785
}
1786
for name, value in config.items(section):
1787
try:
1788
yield (name, special_settings[name]())
1789
except KeyError:
1790
yield (name, value)
1791
1792
tcp_server.clients.update(set(
1793
client_class(name = section,
1794
config= dict(client_config_items(
1795
client_config, section)))
1796
for section in client_config.sections()))
1797
if not tcp_server.clients:
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1097
1098
clients.update(Set(Client(name = section,
1099
config
1100
= dict(client_config.items(section)),
1101
use_dbus = use_dbus)
1102
for section in client_config.sections()))
1103
if not clients:
1798
1104
logger.warning(u"No clients defined")
1799
1105
1800
1106
if debug:
1810
1116
daemon()
1811
1117
1812
1118
try:
1813
with pidfile:
1814
pid = os.getpid()
1815
pidfile.write(str(pid) + "\n")
1119
pid = os.getpid()
1120
pidfile.write(str(pid) + "\n")
1121
pidfile.close()
1816
1122
del pidfile
1817
1123
except IOError:
1818
1124
logger.error(u"Could not write to file %r with PID %d",
1822
1128
pass
1823
1129
del pidfilename
1824
1130
1131
def cleanup():
1132
"Cleanup function; run on exit"
1133
global group
1134
# From the Avahi example code
1135
if not group is None:
1136
group.Free()
1137
group = None
1138
# End of Avahi example code
1139
1140
while clients:
1141
client = clients.pop()
1142
client.disable_hook = None
1143
client.disable()
1144
1145
atexit.register(cleanup)
1146
1825
1147
if not debug:
1826
1148
signal.signal(signal.SIGINT, signal.SIG_IGN)
1827
1149
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1828
1150
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1829
1151
1830
1152
if use_dbus:
1831
class MandosDBusService(dbus.service.Object):
1153
class MandosServer(dbus.service.Object):
1832
1154
"""A D-Bus proxy object"""
1833
1155
def __init__(self):
1834
dbus.service.Object.__init__(self, bus, u"/")
1156
dbus.service.Object.__init__(self, bus, "/")
1835
1157
_interface = u"se.bsnet.fukt.Mandos"
1836
1158
1837
@dbus.service.signal(_interface, signature=u"o")
1838
def ClientAdded(self, objpath):
1839
"D-Bus signal"
1840
pass
1841
1842
@dbus.service.signal(_interface, signature=u"ss")
1843
def ClientNotFound(self, fingerprint, address):
1844
"D-Bus signal"
1845
pass
1846
1847
@dbus.service.signal(_interface, signature=u"os")
1159
@dbus.service.signal(_interface, signature="oa{sv}")
1160
def ClientAdded(self, objpath, properties):
1161
"D-Bus signal"
1162
pass
1163
1164
@dbus.service.signal(_interface, signature="os")
1848
1165
def ClientRemoved(self, objpath, name):
1849
1166
"D-Bus signal"
1850
1167
pass
1851
1168
1852
@dbus.service.method(_interface, out_signature=u"ao")
1169
@dbus.service.method(_interface, out_signature="ao")
1853
1170
def GetAllClients(self):
1854
1171
"D-Bus method"
1855
return dbus.Array(c.dbus_object_path
1856
for c in tcp_server.clients)
1172
return dbus.Array(c.dbus_object_path for c in clients)
1857
1173
1858
@dbus.service.method(_interface,
1859
out_signature=u"a{oa{sv}}")
1174
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1860
1175
def GetAllClientsWithProperties(self):
1861
1176
"D-Bus method"
1862
1177
return dbus.Dictionary(
1863
((c.dbus_object_path, c.GetAll(u""))
1864
for c in tcp_server.clients),
1865
signature=u"oa{sv}")
1178
((c.dbus_object_path, c.GetAllProperties())
1179
for c in clients),
1180
signature="oa{sv}")
1866
1181
1867
@dbus.service.method(_interface, in_signature=u"o")
1182
@dbus.service.method(_interface, in_signature="o")
1868
1183
def RemoveClient(self, object_path):
1869
1184
"D-Bus method"
1870
for c in tcp_server.clients:
1185
for c in clients:
1871
1186
if c.dbus_object_path == object_path:
1872
tcp_server.clients.remove(c)
1873
c.remove_from_connection()
1187
clients.remove(c)
1874
1188
# Don't signal anything except ClientRemoved
1875
c.disable(quiet=True)
1189
c.use_dbus = False
1190
c.disable()
1876
1191
# Emit D-Bus signal
1877
1192
self.ClientRemoved(object_path, c.name)
1878
1193
return
1879
raise KeyError(object_path)
1194
raise KeyError
1880
1195
1881
1196
del _interface
1882
1197
1883
mandos_dbus_service = MandosDBusService()
1884
1885
def cleanup():
1886
"Cleanup function; run on exit"
1887
service.cleanup()
1888
1889
while tcp_server.clients:
1890
client = tcp_server.clients.pop()
1891
if use_dbus:
1892
client.remove_from_connection()
1893
client.disable_hook = None
1894
# Don't signal anything except ClientRemoved
1895
client.disable(quiet=True)
1896
if use_dbus:
1897
# Emit D-Bus signal
1898
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1899
client.name)
1900
1901
atexit.register(cleanup)
1902
1903
for client in tcp_server.clients:
1198
mandos_server = MandosServer()
1199
1200
for client in clients:
1904
1201
if use_dbus:
1905
1202
# Emit D-Bus signal
1906
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1203
mandos_server.ClientAdded(client.dbus_object_path,
1204
client.GetAllProperties())
1907
1205
client.enable()
1908
1206
1909
1207
tcp_server.enable()
1923
1221
1924
1222
try:
1925
1223
# From the Avahi example code
1224
server.connect_to_signal("StateChanged", server_state_changed)
1926
1225
try:
1927
service.activate()
1226
server_state_changed(server.GetState())
1928
1227
except dbus.exceptions.DBusException, error:
1929
1228
logger.critical(u"DBusException: %s", error)
1930
cleanup()
1931
1229
sys.exit(1)
1932
1230
# End of Avahi example code
1933
1231
1940
1238
main_loop.run()
1941
1239
except AvahiError, error:
1942
1240
logger.critical(u"AvahiError: %s", error)
1943
cleanup()
1944
1241
sys.exit(1)
1945
1242
except KeyboardInterrupt:
1946
1243
if debug:
1947
1244
print >> sys.stderr
1948
logger.debug(u"Server received KeyboardInterrupt")
1949
logger.debug(u"Server exiting")
1950
# Must run before the D-Bus bus name gets deregistered
1951
cleanup()
1245
logger.debug("Server received KeyboardInterrupt")
1246
logger.debug("Server exiting")
1952
1247
1953
1248
if __name__ == '__main__':
1954
1249
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0