/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

Tags: version-1.2-1
* Makefile (version): Changed to "1.2".
* NEWS (Version 1.2): New entry.
* debian/changelog (1.2): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2010 Teddy Hogeborn
 
15
# Copyright © 2008-2010 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
58
 
from contextlib import closing
 
58
import contextlib
59
59
import struct
60
60
import fcntl
61
61
import functools
 
62
import cPickle as pickle
 
63
import multiprocessing
62
64
 
63
65
import dbus
64
66
import dbus.service
79
81
        SO_BINDTODEVICE = None
80
82
 
81
83
 
82
 
version = "1.0.12"
 
84
version = "1.2"
83
85
 
 
86
#logger = logging.getLogger(u'mandos')
84
87
logger = logging.Logger(u'mandos')
85
88
syslogger = (logging.handlers.SysLogHandler
86
89
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
154
157
                            u" after %i retries, exiting.",
155
158
                            self.rename_count)
156
159
            raise AvahiServiceError(u"Too many renames")
157
 
        self.name = self.server.GetAlternativeServiceName(self.name)
 
160
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
158
161
        logger.info(u"Changing Zeroconf service name to %r ...",
159
 
                    unicode(self.name))
 
162
                    self.name)
160
163
        syslogger.setFormatter(logging.Formatter
161
164
                               (u'Mandos (%s) [%%(process)d]:'
162
165
                                u' %%(levelname)s: %%(message)s'
163
166
                                % self.name))
164
167
        self.remove()
165
 
        self.add()
 
168
        try:
 
169
            self.add()
 
170
        except dbus.exceptions.DBusException, error:
 
171
            logger.critical(u"DBusException: %s", error)
 
172
            self.cleanup()
 
173
            os._exit(1)
166
174
        self.rename_count += 1
167
175
    def remove(self):
168
176
        """Derived from the Avahi example code"""
191
199
        self.group.Commit()
192
200
    def entry_group_state_changed(self, state, error):
193
201
        """Derived from the Avahi example code"""
194
 
        logger.debug(u"Avahi state change: %i", state)
 
202
        logger.debug(u"Avahi entry group state change: %i", state)
195
203
        
196
204
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
197
205
            logger.debug(u"Zeroconf service established.")
210
218
            self.group = None
211
219
    def server_state_changed(self, state):
212
220
        """Derived from the Avahi example code"""
 
221
        logger.debug(u"Avahi server state change: %i", state)
213
222
        if state == avahi.SERVER_COLLISION:
214
223
            logger.error(u"Zeroconf server name collision")
215
224
            self.remove()
231
240
    """A representation of a client host served by this server.
232
241
    
233
242
    Attributes:
234
 
    name:       string; from the config file, used in log messages and
235
 
                        D-Bus identifiers
236
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
237
 
                 uniquely identify the client
238
 
    secret:     bytestring; sent verbatim (over TLS) to client
239
 
    host:       string; available for use by the checker command
240
 
    created:    datetime.datetime(); (UTC) object creation
241
 
    last_enabled: datetime.datetime(); (UTC)
242
 
    enabled:    bool()
243
 
    last_checked_ok: datetime.datetime(); (UTC) or None
244
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
245
 
                                      until this client is invalid
246
 
    interval:   datetime.timedelta(); How often to start a new checker
247
 
    disable_hook:  If set, called by disable() as disable_hook(self)
 
243
    _approved:   bool(); 'None' if not yet approved/disapproved
 
244
    approval_delay: datetime.timedelta(); Time to wait for approval
 
245
    approval_duration: datetime.timedelta(); Duration of one approval
248
246
    checker:    subprocess.Popen(); a running checker process used
249
247
                                    to see if the client lives.
250
248
                                    'None' if no process is running.
251
 
    checker_initiator_tag: a gobject event source tag, or None
252
 
    disable_initiator_tag: - '' -
253
 
    checker_callback_tag:  - '' -
254
 
    checker_command: string; External command which is run to check if
255
 
                     client lives.  %() expansions are done at
 
249
    checker_callback_tag: a gobject event source tag, or None
 
250
    checker_command: string; External command which is run to check
 
251
                     if client lives.  %() expansions are done at
256
252
                     runtime with vars(self) as dict, so that for
257
253
                     instance %(name)s can be used in the command.
 
254
    checker_initiator_tag: a gobject event source tag, or None
 
255
    created:    datetime.datetime(); (UTC) object creation
258
256
    current_checker_command: string; current running checker_command
 
257
    disable_hook:  If set, called by disable() as disable_hook(self)
 
258
    disable_initiator_tag: a gobject event source tag, or None
 
259
    enabled:    bool()
 
260
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
261
                 uniquely identify the client
 
262
    host:       string; available for use by the checker command
 
263
    interval:   datetime.timedelta(); How often to start a new checker
 
264
    last_approval_request: datetime.datetime(); (UTC) or None
 
265
    last_checked_ok: datetime.datetime(); (UTC) or None
 
266
    last_enabled: datetime.datetime(); (UTC)
 
267
    name:       string; from the config file, used in log messages and
 
268
                        D-Bus identifiers
 
269
    secret:     bytestring; sent verbatim (over TLS) to client
 
270
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
271
                                      until this client is disabled
 
272
    runtime_expansions: Allowed attributes for runtime expansion.
259
273
    """
260
274
    
 
275
    runtime_expansions = (u"approval_delay", u"approval_duration",
 
276
                          u"created", u"enabled", u"fingerprint",
 
277
                          u"host", u"interval", u"last_checked_ok",
 
278
                          u"last_enabled", u"name", u"timeout")
 
279
    
261
280
    @staticmethod
262
281
    def _timedelta_to_milliseconds(td):
263
282
        "Convert a datetime.timedelta() to milliseconds"
272
291
    def interval_milliseconds(self):
273
292
        "Return the 'interval' attribute in milliseconds"
274
293
        return self._timedelta_to_milliseconds(self.interval)
 
294
 
 
295
    def approval_delay_milliseconds(self):
 
296
        return self._timedelta_to_milliseconds(self.approval_delay)
275
297
    
276
298
    def __init__(self, name = None, disable_hook=None, config=None):
277
299
        """Note: the 'checker' key in 'config' sets the
290
312
        if u"secret" in config:
291
313
            self.secret = config[u"secret"].decode(u"base64")
292
314
        elif u"secfile" in config:
293
 
            with closing(open(os.path.expanduser
294
 
                              (os.path.expandvars
295
 
                               (config[u"secfile"])))) as secfile:
 
315
            with open(os.path.expanduser(os.path.expandvars
 
316
                                         (config[u"secfile"])),
 
317
                      "rb") as secfile:
296
318
                self.secret = secfile.read()
297
319
        else:
298
320
            raise TypeError(u"No secret or secfile for client %s"
300
322
        self.host = config.get(u"host", u"")
301
323
        self.created = datetime.datetime.utcnow()
302
324
        self.enabled = False
 
325
        self.last_approval_request = None
303
326
        self.last_enabled = None
304
327
        self.last_checked_ok = None
305
328
        self.timeout = string_to_delta(config[u"timeout"])
312
335
        self.checker_command = config[u"checker"]
313
336
        self.current_checker_command = None
314
337
        self.last_connect = None
 
338
        self._approved = None
 
339
        self.approved_by_default = config.get(u"approved_by_default",
 
340
                                              True)
 
341
        self.approvals_pending = 0
 
342
        self.approval_delay = string_to_delta(
 
343
            config[u"approval_delay"])
 
344
        self.approval_duration = string_to_delta(
 
345
            config[u"approval_duration"])
 
346
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
315
347
    
 
348
    def send_changedstate(self):
 
349
        self.changedstate.acquire()
 
350
        self.changedstate.notify_all()
 
351
        self.changedstate.release()
 
352
        
316
353
    def enable(self):
317
354
        """Start this client's checker and timeout hooks"""
318
355
        if getattr(self, u"enabled", False):
319
356
            # Already enabled
320
357
            return
 
358
        self.send_changedstate()
321
359
        self.last_enabled = datetime.datetime.utcnow()
322
360
        # Schedule a new checker to be started an 'interval' from now,
323
361
        # and every interval from then on.
324
362
        self.checker_initiator_tag = (gobject.timeout_add
325
363
                                      (self.interval_milliseconds(),
326
364
                                       self.start_checker))
327
 
        # Also start a new checker *right now*.
328
 
        self.start_checker()
329
365
        # Schedule a disable() when 'timeout' has passed
330
366
        self.disable_initiator_tag = (gobject.timeout_add
331
367
                                   (self.timeout_milliseconds(),
332
368
                                    self.disable))
333
369
        self.enabled = True
 
370
        # Also start a new checker *right now*.
 
371
        self.start_checker()
334
372
    
335
 
    def disable(self):
 
373
    def disable(self, quiet=True):
336
374
        """Disable this client."""
337
375
        if not getattr(self, "enabled", False):
338
376
            return False
339
 
        logger.info(u"Disabling client %s", self.name)
 
377
        if not quiet:
 
378
            self.send_changedstate()
 
379
        if not quiet:
 
380
            logger.info(u"Disabling client %s", self.name)
340
381
        if getattr(self, u"disable_initiator_tag", False):
341
382
            gobject.source_remove(self.disable_initiator_tag)
342
383
            self.disable_initiator_tag = None
383
424
                                      (self.timeout_milliseconds(),
384
425
                                       self.disable))
385
426
    
 
427
    def need_approval(self):
 
428
        self.last_approval_request = datetime.datetime.utcnow()
 
429
    
386
430
    def start_checker(self):
387
431
        """Start a new checker subprocess if one is not running.
388
432
        
394
438
        # client would inevitably timeout, since no checker would get
395
439
        # a chance to run to completion.  If we instead leave running
396
440
        # checkers alone, the checker would have to take more time
397
 
        # than 'timeout' for the client to be declared invalid, which
398
 
        # is as it should be.
 
441
        # than 'timeout' for the client to be disabled, which is as it
 
442
        # should be.
399
443
        
400
444
        # If a checker exists, make sure it is not a zombie
401
 
        if self.checker is not None:
 
445
        try:
402
446
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
447
        except (AttributeError, OSError), error:
 
448
            if (isinstance(error, OSError)
 
449
                and error.errno != errno.ECHILD):
 
450
                raise error
 
451
        else:
403
452
            if pid:
404
453
                logger.warning(u"Checker was a zombie")
405
454
                gobject.source_remove(self.checker_callback_tag)
412
461
                command = self.checker_command % self.host
413
462
            except TypeError:
414
463
                # Escape attributes for the shell
415
 
                escaped_attrs = dict((key,
416
 
                                      re.escape(unicode(str(val),
417
 
                                                        errors=
418
 
                                                        u'replace')))
419
 
                                     for key, val in
420
 
                                     vars(self).iteritems())
 
464
                escaped_attrs = dict(
 
465
                    (attr,
 
466
                     re.escape(unicode(str(getattr(self, attr, u"")),
 
467
                                       errors=
 
468
                                       u'replace')))
 
469
                    for attr in
 
470
                    self.runtime_expansions)
 
471
 
421
472
                try:
422
473
                    command = self.checker_command % escaped_attrs
423
474
                except TypeError, error:
461
512
        logger.debug(u"Stopping checker for %(name)s", vars(self))
462
513
        try:
463
514
            os.kill(self.checker.pid, signal.SIGTERM)
464
 
            #os.sleep(0.5)
 
515
            #time.sleep(0.5)
465
516
            #if self.checker.poll() is None:
466
517
            #    os.kill(self.checker.pid, signal.SIGKILL)
467
518
        except OSError, error:
468
519
            if error.errno != errno.ESRCH: # No such process
469
520
                raise
470
521
        self.checker = None
471
 
    
472
 
    def still_valid(self):
473
 
        """Has the timeout not yet passed for this client?"""
474
 
        if not getattr(self, u"enabled", False):
475
 
            return False
476
 
        now = datetime.datetime.utcnow()
477
 
        if self.last_checked_ok is None:
478
 
            return now < (self.created + self.timeout)
479
 
        else:
480
 
            return now < (self.last_checked_ok + self.timeout)
481
 
 
482
522
 
483
523
def dbus_service_property(dbus_interface, signature=u"v",
484
524
                          access=u"readwrite", byte_arrays=False):
492
532
    dbus.service.method, except there is only "signature", since the
493
533
    type from Get() and the type sent to Set() is the same.
494
534
    """
 
535
    # Encoding deeply encoded byte arrays is not supported yet by the
 
536
    # "Set" method, so we fail early here:
 
537
    if byte_arrays and signature != u"ay":
 
538
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
539
                         u" signature %r" % signature)
495
540
    def decorator(func):
496
541
        func._dbus_is_property = True
497
542
        func._dbus_interface = dbus_interface
583
628
        if prop._dbus_access == u"read":
584
629
            raise DBusPropertyAccessException(property_name)
585
630
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
631
            # The byte_arrays option is not supported yet on
 
632
            # signatures other than "ay".
 
633
            if prop._dbus_signature != u"ay":
 
634
                raise ValueError
586
635
            value = dbus.ByteArray(''.join(unichr(byte)
587
636
                                           for byte in value))
588
637
        prop(value)
620
669
        """Standard D-Bus method, overloaded to insert property tags.
621
670
        """
622
671
        xmlstring = dbus.service.Object.Introspect(self, object_path,
623
 
                                           connection)
624
 
        document = xml.dom.minidom.parseString(xmlstring)
625
 
        del xmlstring
626
 
        def make_tag(document, name, prop):
627
 
            e = document.createElement(u"property")
628
 
            e.setAttribute(u"name", name)
629
 
            e.setAttribute(u"type", prop._dbus_signature)
630
 
            e.setAttribute(u"access", prop._dbus_access)
631
 
            return e
632
 
        for if_tag in document.getElementsByTagName(u"interface"):
633
 
            for tag in (make_tag(document, name, prop)
634
 
                        for name, prop
635
 
                        in self._get_all_dbus_properties()
636
 
                        if prop._dbus_interface
637
 
                        == if_tag.getAttribute(u"name")):
638
 
                if_tag.appendChild(tag)
639
 
        xmlstring = document.toxml(u"utf-8")
640
 
        document.unlink()
 
672
                                                   connection)
 
673
        try:
 
674
            document = xml.dom.minidom.parseString(xmlstring)
 
675
            def make_tag(document, name, prop):
 
676
                e = document.createElement(u"property")
 
677
                e.setAttribute(u"name", name)
 
678
                e.setAttribute(u"type", prop._dbus_signature)
 
679
                e.setAttribute(u"access", prop._dbus_access)
 
680
                return e
 
681
            for if_tag in document.getElementsByTagName(u"interface"):
 
682
                for tag in (make_tag(document, name, prop)
 
683
                            for name, prop
 
684
                            in self._get_all_dbus_properties()
 
685
                            if prop._dbus_interface
 
686
                            == if_tag.getAttribute(u"name")):
 
687
                    if_tag.appendChild(tag)
 
688
                # Add the names to the return values for the
 
689
                # "org.freedesktop.DBus.Properties" methods
 
690
                if (if_tag.getAttribute(u"name")
 
691
                    == u"org.freedesktop.DBus.Properties"):
 
692
                    for cn in if_tag.getElementsByTagName(u"method"):
 
693
                        if cn.getAttribute(u"name") == u"Get":
 
694
                            for arg in cn.getElementsByTagName(u"arg"):
 
695
                                if (arg.getAttribute(u"direction")
 
696
                                    == u"out"):
 
697
                                    arg.setAttribute(u"name", u"value")
 
698
                        elif cn.getAttribute(u"name") == u"GetAll":
 
699
                            for arg in cn.getElementsByTagName(u"arg"):
 
700
                                if (arg.getAttribute(u"direction")
 
701
                                    == u"out"):
 
702
                                    arg.setAttribute(u"name", u"props")
 
703
            xmlstring = document.toxml(u"utf-8")
 
704
            document.unlink()
 
705
        except (AttributeError, xml.dom.DOMException,
 
706
                xml.parsers.expat.ExpatError), error:
 
707
            logger.error(u"Failed to override Introspection method",
 
708
                         error)
641
709
        return xmlstring
642
710
 
643
711
 
648
716
    dbus_object_path: dbus.ObjectPath
649
717
    bus: dbus.SystemBus()
650
718
    """
 
719
    
 
720
    runtime_expansions = (Client.runtime_expansions
 
721
                          + (u"dbus_object_path",))
 
722
    
651
723
    # dbus.service.Object doesn't use super(), so we can't either.
652
724
    
653
725
    def __init__(self, bus = None, *args, **kwargs):
 
726
        self._approvals_pending = 0
654
727
        self.bus = bus
655
728
        Client.__init__(self, *args, **kwargs)
656
729
        # Only now, when this client is initialized, can it show up on
657
730
        # the D-Bus
 
731
        client_object_name = unicode(self.name).translate(
 
732
            {ord(u"."): ord(u"_"),
 
733
             ord(u"-"): ord(u"_")})
658
734
        self.dbus_object_path = (dbus.ObjectPath
659
 
                                 (u"/clients/"
660
 
                                  + self.name.replace(u".", u"_")))
 
735
                                 (u"/clients/" + client_object_name))
661
736
        DBusObjectWithProperties.__init__(self, self.bus,
662
737
                                          self.dbus_object_path)
 
738
        
 
739
    def _get_approvals_pending(self):
 
740
        return self._approvals_pending
 
741
    def _set_approvals_pending(self, value):
 
742
        old_value = self._approvals_pending
 
743
        self._approvals_pending = value
 
744
        bval = bool(value)
 
745
        if (hasattr(self, "dbus_object_path")
 
746
            and bval is not bool(old_value)):
 
747
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
748
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
 
749
                                 dbus_bool)
 
750
 
 
751
    approvals_pending = property(_get_approvals_pending,
 
752
                                 _set_approvals_pending)
 
753
    del _get_approvals_pending, _set_approvals_pending
663
754
    
664
755
    @staticmethod
665
756
    def _datetime_to_dbus(dt, variant_level=0):
672
763
        r = Client.enable(self)
673
764
        if oldstate != self.enabled:
674
765
            # Emit D-Bus signals
675
 
            self.PropertyChanged(dbus.String(u"enabled"),
 
766
            self.PropertyChanged(dbus.String(u"Enabled"),
676
767
                                 dbus.Boolean(True, variant_level=1))
677
768
            self.PropertyChanged(
678
 
                dbus.String(u"last_enabled"),
 
769
                dbus.String(u"LastEnabled"),
679
770
                self._datetime_to_dbus(self.last_enabled,
680
771
                                       variant_level=1))
681
772
        return r
682
773
    
683
 
    def disable(self, signal = True):
 
774
    def disable(self, quiet = False):
684
775
        oldstate = getattr(self, u"enabled", False)
685
 
        r = Client.disable(self)
686
 
        if signal and oldstate != self.enabled:
 
776
        r = Client.disable(self, quiet=quiet)
 
777
        if not quiet and oldstate != self.enabled:
687
778
            # Emit D-Bus signal
688
 
            self.PropertyChanged(dbus.String(u"enabled"),
 
779
            self.PropertyChanged(dbus.String(u"Enabled"),
689
780
                                 dbus.Boolean(False, variant_level=1))
690
781
        return r
691
782
    
703
794
        self.checker_callback_tag = None
704
795
        self.checker = None
705
796
        # Emit D-Bus signal
706
 
        self.PropertyChanged(dbus.String(u"checker_running"),
 
797
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
707
798
                             dbus.Boolean(False, variant_level=1))
708
799
        if os.WIFEXITED(condition):
709
800
            exitstatus = os.WEXITSTATUS(condition)
724
815
        r = Client.checked_ok(self, *args, **kwargs)
725
816
        # Emit D-Bus signal
726
817
        self.PropertyChanged(
727
 
            dbus.String(u"last_checked_ok"),
 
818
            dbus.String(u"LastCheckedOK"),
728
819
            (self._datetime_to_dbus(self.last_checked_ok,
729
820
                                    variant_level=1)))
730
821
        return r
731
822
    
 
823
    def need_approval(self, *args, **kwargs):
 
824
        r = Client.need_approval(self, *args, **kwargs)
 
825
        # Emit D-Bus signal
 
826
        self.PropertyChanged(
 
827
            dbus.String(u"LastApprovalRequest"),
 
828
            (self._datetime_to_dbus(self.last_approval_request,
 
829
                                    variant_level=1)))
 
830
        return r
 
831
    
732
832
    def start_checker(self, *args, **kwargs):
733
833
        old_checker = self.checker
734
834
        if self.checker is not None:
742
842
            # Emit D-Bus signal
743
843
            self.CheckerStarted(self.current_checker_command)
744
844
            self.PropertyChanged(
745
 
                dbus.String(u"checker_running"),
 
845
                dbus.String(u"CheckerRunning"),
746
846
                dbus.Boolean(True, variant_level=1))
747
847
        return r
748
848
    
751
851
        r = Client.stop_checker(self, *args, **kwargs)
752
852
        if (old_checker is not None
753
853
            and getattr(self, u"checker", None) is None):
754
 
            self.PropertyChanged(dbus.String(u"checker_running"),
 
854
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
755
855
                                 dbus.Boolean(False, variant_level=1))
756
856
        return r
757
 
    
758
 
    ## D-Bus methods & signals
 
857
 
 
858
    def _reset_approved(self):
 
859
        self._approved = None
 
860
        return False
 
861
    
 
862
    def approve(self, value=True):
 
863
        self.send_changedstate()
 
864
        self._approved = value
 
865
        gobject.timeout_add(self._timedelta_to_milliseconds
 
866
                            (self.approval_duration),
 
867
                            self._reset_approved)
 
868
    
 
869
    
 
870
    ## D-Bus methods, signals & properties
759
871
    _interface = u"se.bsnet.fukt.Mandos.Client"
760
872
    
 
873
    ## Signals
 
874
    
761
875
    # CheckerCompleted - signal
762
876
    @dbus.service.signal(_interface, signature=u"nxs")
763
877
    def CheckerCompleted(self, exitcode, waitstatus, command):
776
890
        "D-Bus signal"
777
891
        pass
778
892
    
779
 
    # ReceivedSecret - signal
 
893
    # GotSecret - signal
780
894
    @dbus.service.signal(_interface)
781
 
    def ReceivedSecret(self):
782
 
        "D-Bus signal"
 
895
    def GotSecret(self):
 
896
        """D-Bus signal
 
897
        Is sent after a successful transfer of secret from the Mandos
 
898
        server to mandos-client
 
899
        """
783
900
        pass
784
901
    
785
902
    # Rejected - signal
786
 
    @dbus.service.signal(_interface)
787
 
    def Rejected(self):
 
903
    @dbus.service.signal(_interface, signature=u"s")
 
904
    def Rejected(self, reason):
788
905
        "D-Bus signal"
789
906
        pass
790
907
    
791
 
    # name - property
 
908
    # NeedApproval - signal
 
909
    @dbus.service.signal(_interface, signature=u"tb")
 
910
    def NeedApproval(self, timeout, default):
 
911
        "D-Bus signal"
 
912
        return self.need_approval()
 
913
    
 
914
    ## Methods
 
915
    
 
916
    # Approve - method
 
917
    @dbus.service.method(_interface, in_signature=u"b")
 
918
    def Approve(self, value):
 
919
        self.approve(value)
 
920
    
 
921
    # CheckedOK - method
 
922
    @dbus.service.method(_interface)
 
923
    def CheckedOK(self):
 
924
        return self.checked_ok()
 
925
    
 
926
    # Enable - method
 
927
    @dbus.service.method(_interface)
 
928
    def Enable(self):
 
929
        "D-Bus method"
 
930
        self.enable()
 
931
    
 
932
    # StartChecker - method
 
933
    @dbus.service.method(_interface)
 
934
    def StartChecker(self):
 
935
        "D-Bus method"
 
936
        self.start_checker()
 
937
    
 
938
    # Disable - method
 
939
    @dbus.service.method(_interface)
 
940
    def Disable(self):
 
941
        "D-Bus method"
 
942
        self.disable()
 
943
    
 
944
    # StopChecker - method
 
945
    @dbus.service.method(_interface)
 
946
    def StopChecker(self):
 
947
        self.stop_checker()
 
948
    
 
949
    ## Properties
 
950
    
 
951
    # ApprovalPending - property
 
952
    @dbus_service_property(_interface, signature=u"b", access=u"read")
 
953
    def ApprovalPending_dbus_property(self):
 
954
        return dbus.Boolean(bool(self.approvals_pending))
 
955
    
 
956
    # ApprovedByDefault - property
 
957
    @dbus_service_property(_interface, signature=u"b",
 
958
                           access=u"readwrite")
 
959
    def ApprovedByDefault_dbus_property(self, value=None):
 
960
        if value is None:       # get
 
961
            return dbus.Boolean(self.approved_by_default)
 
962
        self.approved_by_default = bool(value)
 
963
        # Emit D-Bus signal
 
964
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
 
965
                             dbus.Boolean(value, variant_level=1))
 
966
    
 
967
    # ApprovalDelay - property
 
968
    @dbus_service_property(_interface, signature=u"t",
 
969
                           access=u"readwrite")
 
970
    def ApprovalDelay_dbus_property(self, value=None):
 
971
        if value is None:       # get
 
972
            return dbus.UInt64(self.approval_delay_milliseconds())
 
973
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
974
        # Emit D-Bus signal
 
975
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
 
976
                             dbus.UInt64(value, variant_level=1))
 
977
    
 
978
    # ApprovalDuration - property
 
979
    @dbus_service_property(_interface, signature=u"t",
 
980
                           access=u"readwrite")
 
981
    def ApprovalDuration_dbus_property(self, value=None):
 
982
        if value is None:       # get
 
983
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
984
                    self.approval_duration))
 
985
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
986
        # Emit D-Bus signal
 
987
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
 
988
                             dbus.UInt64(value, variant_level=1))
 
989
    
 
990
    # Name - property
792
991
    @dbus_service_property(_interface, signature=u"s", access=u"read")
793
 
    def name_dbus_property(self):
 
992
    def Name_dbus_property(self):
794
993
        return dbus.String(self.name)
795
994
    
796
 
    # fingerprint - property
 
995
    # Fingerprint - property
797
996
    @dbus_service_property(_interface, signature=u"s", access=u"read")
798
 
    def fingerprint_dbus_property(self):
 
997
    def Fingerprint_dbus_property(self):
799
998
        return dbus.String(self.fingerprint)
800
999
    
801
 
    # host - property
 
1000
    # Host - property
802
1001
    @dbus_service_property(_interface, signature=u"s",
803
1002
                           access=u"readwrite")
804
 
    def host_dbus_property(self, value=None):
 
1003
    def Host_dbus_property(self, value=None):
805
1004
        if value is None:       # get
806
1005
            return dbus.String(self.host)
807
1006
        self.host = value
808
1007
        # Emit D-Bus signal
809
 
        self.PropertyChanged(dbus.String(u"host"),
 
1008
        self.PropertyChanged(dbus.String(u"Host"),
810
1009
                             dbus.String(value, variant_level=1))
811
1010
    
812
 
    # created - property
 
1011
    # Created - property
813
1012
    @dbus_service_property(_interface, signature=u"s", access=u"read")
814
 
    def created_dbus_property(self):
 
1013
    def Created_dbus_property(self):
815
1014
        return dbus.String(self._datetime_to_dbus(self.created))
816
1015
    
817
 
    # last_enabled - property
 
1016
    # LastEnabled - property
818
1017
    @dbus_service_property(_interface, signature=u"s", access=u"read")
819
 
    def last_enabled_dbus_property(self):
 
1018
    def LastEnabled_dbus_property(self):
820
1019
        if self.last_enabled is None:
821
1020
            return dbus.String(u"")
822
1021
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
823
1022
    
824
 
    # enabled - property
 
1023
    # Enabled - property
825
1024
    @dbus_service_property(_interface, signature=u"b",
826
1025
                           access=u"readwrite")
827
 
    def enabled_dbus_property(self, value=None):
 
1026
    def Enabled_dbus_property(self, value=None):
828
1027
        if value is None:       # get
829
1028
            return dbus.Boolean(self.enabled)
830
1029
        if value:
832
1031
        else:
833
1032
            self.disable()
834
1033
    
835
 
    # last_checked_ok - property
836
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
837
 
    def last_checked_ok_dbus_property(self):
 
1034
    # LastCheckedOK - property
 
1035
    @dbus_service_property(_interface, signature=u"s",
 
1036
                           access=u"readwrite")
 
1037
    def LastCheckedOK_dbus_property(self, value=None):
 
1038
        if value is not None:
 
1039
            self.checked_ok()
 
1040
            return
838
1041
        if self.last_checked_ok is None:
839
1042
            return dbus.String(u"")
840
1043
        return dbus.String(self._datetime_to_dbus(self
841
1044
                                                  .last_checked_ok))
842
1045
    
843
 
    # timeout - property
 
1046
    # LastApprovalRequest - property
 
1047
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1048
    def LastApprovalRequest_dbus_property(self):
 
1049
        if self.last_approval_request is None:
 
1050
            return dbus.String(u"")
 
1051
        return dbus.String(self.
 
1052
                           _datetime_to_dbus(self
 
1053
                                             .last_approval_request))
 
1054
    
 
1055
    # Timeout - property
844
1056
    @dbus_service_property(_interface, signature=u"t",
845
1057
                           access=u"readwrite")
846
 
    def timeout_dbus_property(self, value=None):
 
1058
    def Timeout_dbus_property(self, value=None):
847
1059
        if value is None:       # get
848
1060
            return dbus.UInt64(self.timeout_milliseconds())
849
1061
        self.timeout = datetime.timedelta(0, 0, 0, value)
850
1062
        # Emit D-Bus signal
851
 
        self.PropertyChanged(dbus.String(u"timeout"),
 
1063
        self.PropertyChanged(dbus.String(u"Timeout"),
852
1064
                             dbus.UInt64(value, variant_level=1))
853
1065
        if getattr(self, u"disable_initiator_tag", None) is None:
854
1066
            return
868
1080
            self.disable_initiator_tag = (gobject.timeout_add
869
1081
                                          (time_to_die, self.disable))
870
1082
    
871
 
    # interval - property
 
1083
    # Interval - property
872
1084
    @dbus_service_property(_interface, signature=u"t",
873
1085
                           access=u"readwrite")
874
 
    def interval_dbus_property(self, value=None):
 
1086
    def Interval_dbus_property(self, value=None):
875
1087
        if value is None:       # get
876
1088
            return dbus.UInt64(self.interval_milliseconds())
877
1089
        self.interval = datetime.timedelta(0, 0, 0, value)
878
1090
        # Emit D-Bus signal
879
 
        self.PropertyChanged(dbus.String(u"interval"),
 
1091
        self.PropertyChanged(dbus.String(u"Interval"),
880
1092
                             dbus.UInt64(value, variant_level=1))
881
1093
        if getattr(self, u"checker_initiator_tag", None) is None:
882
1094
            return
886
1098
                                      (value, self.start_checker))
887
1099
        self.start_checker()    # Start one now, too
888
1100
 
889
 
    # checker - property
 
1101
    # Checker - property
890
1102
    @dbus_service_property(_interface, signature=u"s",
891
1103
                           access=u"readwrite")
892
 
    def checker_dbus_property(self, value=None):
 
1104
    def Checker_dbus_property(self, value=None):
893
1105
        if value is None:       # get
894
1106
            return dbus.String(self.checker_command)
895
1107
        self.checker_command = value
896
1108
        # Emit D-Bus signal
897
 
        self.PropertyChanged(dbus.String(u"checker"),
 
1109
        self.PropertyChanged(dbus.String(u"Checker"),
898
1110
                             dbus.String(self.checker_command,
899
1111
                                         variant_level=1))
900
1112
    
901
 
    # checker_running - property
 
1113
    # CheckerRunning - property
902
1114
    @dbus_service_property(_interface, signature=u"b",
903
1115
                           access=u"readwrite")
904
 
    def checker_running_dbus_property(self, value=None):
 
1116
    def CheckerRunning_dbus_property(self, value=None):
905
1117
        if value is None:       # get
906
1118
            return dbus.Boolean(self.checker is not None)
907
1119
        if value:
909
1121
        else:
910
1122
            self.stop_checker()
911
1123
    
912
 
    # object_path - property
 
1124
    # ObjectPath - property
913
1125
    @dbus_service_property(_interface, signature=u"o", access=u"read")
914
 
    def object_path_dbus_property(self):
 
1126
    def ObjectPath_dbus_property(self):
915
1127
        return self.dbus_object_path # is already a dbus.ObjectPath
916
1128
    
917
 
    # secret = property xxx
 
1129
    # Secret = property
918
1130
    @dbus_service_property(_interface, signature=u"ay",
919
1131
                           access=u"write", byte_arrays=True)
920
 
    def secret_dbus_property(self, value):
 
1132
    def Secret_dbus_property(self, value):
921
1133
        self.secret = str(value)
922
1134
    
923
1135
    del _interface
924
1136
 
925
1137
 
 
1138
class ProxyClient(object):
 
1139
    def __init__(self, child_pipe, fpr, address):
 
1140
        self._pipe = child_pipe
 
1141
        self._pipe.send(('init', fpr, address))
 
1142
        if not self._pipe.recv():
 
1143
            raise KeyError()
 
1144
 
 
1145
    def __getattribute__(self, name):
 
1146
        if(name == '_pipe'):
 
1147
            return super(ProxyClient, self).__getattribute__(name)
 
1148
        self._pipe.send(('getattr', name))
 
1149
        data = self._pipe.recv()
 
1150
        if data[0] == 'data':
 
1151
            return data[1]
 
1152
        if data[0] == 'function':
 
1153
            def func(*args, **kwargs):
 
1154
                self._pipe.send(('funcall', name, args, kwargs))
 
1155
                return self._pipe.recv()[1]
 
1156
            return func
 
1157
 
 
1158
    def __setattr__(self, name, value):
 
1159
        if(name == '_pipe'):
 
1160
            return super(ProxyClient, self).__setattr__(name, value)
 
1161
        self._pipe.send(('setattr', name, value))
 
1162
 
 
1163
 
926
1164
class ClientHandler(socketserver.BaseRequestHandler, object):
927
1165
    """A class to handle client connections.
928
1166
    
930
1168
    Note: This will run in its own forked process."""
931
1169
    
932
1170
    def handle(self):
933
 
        logger.info(u"TCP connection from: %s",
934
 
                    unicode(self.client_address))
935
 
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
936
 
        # Open IPC pipe to parent process
937
 
        with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
 
1171
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1172
            logger.info(u"TCP connection from: %s",
 
1173
                        unicode(self.client_address))
 
1174
            logger.debug(u"Pipe FD: %d",
 
1175
                         self.server.child_pipe.fileno())
 
1176
 
938
1177
            session = (gnutls.connection
939
1178
                       .ClientSession(self.request,
940
1179
                                      gnutls.connection
941
1180
                                      .X509Credentials()))
942
 
            
943
 
            line = self.request.makefile().readline()
944
 
            logger.debug(u"Protocol version: %r", line)
945
 
            try:
946
 
                if int(line.strip().split()[0]) > 1:
947
 
                    raise RuntimeError
948
 
            except (ValueError, IndexError, RuntimeError), error:
949
 
                logger.error(u"Unknown protocol version: %s", error)
950
 
                return
951
 
            
 
1181
 
952
1182
            # Note: gnutls.connection.X509Credentials is really a
953
1183
            # generic GnuTLS certificate credentials object so long as
954
1184
            # no X.509 keys are added to it.  Therefore, we can use it
955
1185
            # here despite using OpenPGP certificates.
956
 
            
 
1186
 
957
1187
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
958
1188
            #                      u"+AES-256-CBC", u"+SHA1",
959
1189
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
965
1195
            (gnutls.library.functions
966
1196
             .gnutls_priority_set_direct(session._c_object,
967
1197
                                         priority, None))
968
 
            
 
1198
 
 
1199
            # Start communication using the Mandos protocol
 
1200
            # Get protocol number
 
1201
            line = self.request.makefile().readline()
 
1202
            logger.debug(u"Protocol version: %r", line)
 
1203
            try:
 
1204
                if int(line.strip().split()[0]) > 1:
 
1205
                    raise RuntimeError
 
1206
            except (ValueError, IndexError, RuntimeError), error:
 
1207
                logger.error(u"Unknown protocol version: %s", error)
 
1208
                return
 
1209
 
 
1210
            # Start GnuTLS connection
969
1211
            try:
970
1212
                session.handshake()
971
1213
            except gnutls.errors.GNUTLSError, error:
974
1216
                # established.  Just abandon the request.
975
1217
                return
976
1218
            logger.debug(u"Handshake succeeded")
 
1219
 
 
1220
            approval_required = False
977
1221
            try:
978
 
                fpr = self.fingerprint(self.peer_certificate(session))
979
 
            except (TypeError, gnutls.errors.GNUTLSError), error:
980
 
                logger.warning(u"Bad certificate: %s", error)
981
 
                session.bye()
982
 
                return
983
 
            logger.debug(u"Fingerprint: %s", fpr)
 
1222
                try:
 
1223
                    fpr = self.fingerprint(self.peer_certificate
 
1224
                                           (session))
 
1225
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1226
                    logger.warning(u"Bad certificate: %s", error)
 
1227
                    return
 
1228
                logger.debug(u"Fingerprint: %s", fpr)
 
1229
 
 
1230
                try:
 
1231
                    client = ProxyClient(child_pipe, fpr,
 
1232
                                         self.client_address)
 
1233
                except KeyError:
 
1234
                    return
 
1235
                
 
1236
                if client.approval_delay:
 
1237
                    delay = client.approval_delay
 
1238
                    client.approvals_pending += 1
 
1239
                    approval_required = True
 
1240
                
 
1241
                while True:
 
1242
                    if not client.enabled:
 
1243
                        logger.warning(u"Client %s is disabled",
 
1244
                                       client.name)
 
1245
                        if self.server.use_dbus:
 
1246
                            # Emit D-Bus signal
 
1247
                            client.Rejected("Disabled")                    
 
1248
                        return
 
1249
                    
 
1250
                    if client._approved or not client.approval_delay:
 
1251
                        #We are approved or approval is disabled
 
1252
                        break
 
1253
                    elif client._approved is None:
 
1254
                        logger.info(u"Client %s needs approval",
 
1255
                                    client.name)
 
1256
                        if self.server.use_dbus:
 
1257
                            # Emit D-Bus signal
 
1258
                            client.NeedApproval(
 
1259
                                client.approval_delay_milliseconds(),
 
1260
                                client.approved_by_default)
 
1261
                    else:
 
1262
                        logger.warning(u"Client %s was not approved",
 
1263
                                       client.name)
 
1264
                        if self.server.use_dbus:
 
1265
                            # Emit D-Bus signal
 
1266
                            client.Rejected("Denied")
 
1267
                        return
 
1268
                    
 
1269
                    #wait until timeout or approved
 
1270
                    #x = float(client._timedelta_to_milliseconds(delay))
 
1271
                    time = datetime.datetime.now()
 
1272
                    client.changedstate.acquire()
 
1273
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1274
                    client.changedstate.release()
 
1275
                    time2 = datetime.datetime.now()
 
1276
                    if (time2 - time) >= delay:
 
1277
                        if not client.approved_by_default:
 
1278
                            logger.warning("Client %s timed out while"
 
1279
                                           " waiting for approval",
 
1280
                                           client.name)
 
1281
                            if self.server.use_dbus:
 
1282
                                # Emit D-Bus signal
 
1283
                                client.Rejected("Approval timed out")
 
1284
                            return
 
1285
                        else:
 
1286
                            break
 
1287
                    else:
 
1288
                        delay -= time2 - time
 
1289
                
 
1290
                sent_size = 0
 
1291
                while sent_size < len(client.secret):
 
1292
                    try:
 
1293
                        sent = session.send(client.secret[sent_size:])
 
1294
                    except (gnutls.errors.GNUTLSError), error:
 
1295
                        logger.warning("gnutls send failed")
 
1296
                        return
 
1297
                    logger.debug(u"Sent: %d, remaining: %d",
 
1298
                                 sent, len(client.secret)
 
1299
                                 - (sent_size + sent))
 
1300
                    sent_size += sent
 
1301
 
 
1302
                logger.info(u"Sending secret to %s", client.name)
 
1303
                # bump the timeout as if seen
 
1304
                client.checked_ok()
 
1305
                if self.server.use_dbus:
 
1306
                    # Emit D-Bus signal
 
1307
                    client.GotSecret()
984
1308
            
985
 
            for c in self.server.clients:
986
 
                if c.fingerprint == fpr:
987
 
                    client = c
988
 
                    break
989
 
            else:
990
 
                ipc.write(u"NOTFOUND %s %s\n"
991
 
                          % (fpr, unicode(self.client_address)))
992
 
                session.bye()
993
 
                return
994
 
            # Have to check if client.still_valid(), since it is
995
 
            # possible that the client timed out while establishing
996
 
            # the GnuTLS session.
997
 
            if not client.still_valid():
998
 
                ipc.write(u"INVALID %s\n" % client.name)
999
 
                session.bye()
1000
 
                return
1001
 
            ipc.write(u"SENDING %s\n" % client.name)
1002
 
            sent_size = 0
1003
 
            while sent_size < len(client.secret):
1004
 
                sent = session.send(client.secret[sent_size:])
1005
 
                logger.debug(u"Sent: %d, remaining: %d",
1006
 
                             sent, len(client.secret)
1007
 
                             - (sent_size + sent))
1008
 
                sent_size += sent
1009
 
            session.bye()
 
1309
            finally:
 
1310
                if approval_required:
 
1311
                    client.approvals_pending -= 1
 
1312
                try:
 
1313
                    session.bye()
 
1314
                except (gnutls.errors.GNUTLSError), error:
 
1315
                    logger.warning("GnuTLS bye failed")
1010
1316
    
1011
1317
    @staticmethod
1012
1318
    def peer_certificate(session):
1072
1378
        return hex_fpr
1073
1379
 
1074
1380
 
1075
 
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1076
 
    """Like socketserver.ForkingMixIn, but also pass a pipe."""
 
1381
class MultiprocessingMixIn(object):
 
1382
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1383
    def sub_process_main(self, request, address):
 
1384
        try:
 
1385
            self.finish_request(request, address)
 
1386
        except:
 
1387
            self.handle_error(request, address)
 
1388
        self.close_request(request)
 
1389
            
 
1390
    def process_request(self, request, address):
 
1391
        """Start a new process to process the request."""
 
1392
        multiprocessing.Process(target = self.sub_process_main,
 
1393
                                args = (request, address)).start()
 
1394
 
 
1395
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1396
    """ adds a pipe to the MixIn """
1077
1397
    def process_request(self, request, client_address):
1078
1398
        """Overrides and wraps the original process_request().
1079
1399
        
1080
1400
        This function creates a new pipe in self.pipe
1081
1401
        """
1082
 
        self.pipe = os.pipe()
1083
 
        super(ForkingMixInWithPipe,
 
1402
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1403
 
 
1404
        super(MultiprocessingMixInWithPipe,
1084
1405
              self).process_request(request, client_address)
1085
 
        os.close(self.pipe[1])  # close write end
1086
 
        self.add_pipe(self.pipe[0])
1087
 
    def add_pipe(self, pipe):
 
1406
        self.child_pipe.close()
 
1407
        self.add_pipe(parent_pipe)
 
1408
 
 
1409
    def add_pipe(self, parent_pipe):
1088
1410
        """Dummy function; override as necessary"""
1089
 
        os.close(pipe)
1090
 
 
1091
 
 
1092
 
class IPv6_TCPServer(ForkingMixInWithPipe,
 
1411
        pass
 
1412
 
 
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1093
1414
                     socketserver.TCPServer, object):
1094
1415
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1095
1416
    
1180
1501
            return socketserver.TCPServer.server_activate(self)
1181
1502
    def enable(self):
1182
1503
        self.enabled = True
1183
 
    def add_pipe(self, pipe):
 
1504
    def add_pipe(self, parent_pipe):
1184
1505
        # Call "handle_ipc" for both data and EOF events
1185
 
        gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1186
 
                             self.handle_ipc)
1187
 
    def handle_ipc(self, source, condition, file_objects={}):
 
1506
        gobject.io_add_watch(parent_pipe.fileno(),
 
1507
                             gobject.IO_IN | gobject.IO_HUP,
 
1508
                             functools.partial(self.handle_ipc,
 
1509
                                               parent_pipe = parent_pipe))
 
1510
        
 
1511
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1512
                   client_object=None):
1188
1513
        condition_names = {
1189
1514
            gobject.IO_IN: u"IN",   # There is data to read.
1190
1515
            gobject.IO_OUT: u"OUT", # Data can be written (without
1199
1524
                                       for cond, name in
1200
1525
                                       condition_names.iteritems()
1201
1526
                                       if cond & condition)
1202
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1203
 
                     conditions_string)
1204
 
        
1205
 
        # Turn the pipe file descriptor into a Python file object
1206
 
        if source not in file_objects:
1207
 
            file_objects[source] = os.fdopen(source, u"r", 1)
1208
 
        
1209
 
        # Read a line from the file object
1210
 
        cmdline = file_objects[source].readline()
1211
 
        if not cmdline:             # Empty line means end of file
1212
 
            # close the IPC pipe
1213
 
            file_objects[source].close()
1214
 
            del file_objects[source]
1215
 
            
1216
 
            # Stop calling this function
1217
 
            return False
1218
 
        
1219
 
        logger.debug(u"IPC command: %r", cmdline)
1220
 
        
1221
 
        # Parse and act on command
1222
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1223
 
        
1224
 
        if cmd == u"NOTFOUND":
1225
 
            logger.warning(u"Client not found for fingerprint: %s",
1226
 
                           args)
1227
 
            if self.use_dbus:
1228
 
                # Emit D-Bus signal
1229
 
                mandos_dbus_service.ClientNotFound(args)
1230
 
        elif cmd == u"INVALID":
1231
 
            for client in self.clients:
1232
 
                if client.name == args:
1233
 
                    logger.warning(u"Client %s is invalid", args)
1234
 
                    if self.use_dbus:
1235
 
                        # Emit D-Bus signal
1236
 
                        client.Rejected()
1237
 
                    break
1238
 
            else:
1239
 
                logger.error(u"Unknown client %s is invalid", args)
1240
 
        elif cmd == u"SENDING":
1241
 
            for client in self.clients:
1242
 
                if client.name == args:
1243
 
                    logger.info(u"Sending secret to %s", client.name)
1244
 
                    client.checked_ok()
1245
 
                    if self.use_dbus:
1246
 
                        # Emit D-Bus signal
1247
 
                        client.ReceivedSecret()
1248
 
                    break
1249
 
            else:
1250
 
                logger.error(u"Sending secret to unknown client %s",
1251
 
                             args)
1252
 
        else:
1253
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1254
 
        
1255
 
        # Keep calling this function
 
1527
        # error or the other end of multiprocessing.Pipe has closed
 
1528
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1529
            return False
 
1530
        
 
1531
        # Read a request from the child
 
1532
        request = parent_pipe.recv()
 
1533
        command = request[0]
 
1534
        
 
1535
        if command == 'init':
 
1536
            fpr = request[1]
 
1537
            address = request[2]
 
1538
            
 
1539
            for c in self.clients:
 
1540
                if c.fingerprint == fpr:
 
1541
                    client = c
 
1542
                    break
 
1543
            else:
 
1544
                logger.warning(u"Client not found for fingerprint: %s, ad"
 
1545
                               u"dress: %s", fpr, address)
 
1546
                if self.use_dbus:
 
1547
                    # Emit D-Bus signal
 
1548
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1549
                parent_pipe.send(False)
 
1550
                return False
 
1551
            
 
1552
            gobject.io_add_watch(parent_pipe.fileno(),
 
1553
                                 gobject.IO_IN | gobject.IO_HUP,
 
1554
                                 functools.partial(self.handle_ipc,
 
1555
                                                   parent_pipe = parent_pipe,
 
1556
                                                   client_object = client))
 
1557
            parent_pipe.send(True)
 
1558
            # remove the old hook in favor of the new above hook on same fileno
 
1559
            return False
 
1560
        if command == 'funcall':
 
1561
            funcname = request[1]
 
1562
            args = request[2]
 
1563
            kwargs = request[3]
 
1564
            
 
1565
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1566
 
 
1567
        if command == 'getattr':
 
1568
            attrname = request[1]
 
1569
            if callable(client_object.__getattribute__(attrname)):
 
1570
                parent_pipe.send(('function',))
 
1571
            else:
 
1572
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1573
        
 
1574
        if command == 'setattr':
 
1575
            attrname = request[1]
 
1576
            value = request[2]
 
1577
            setattr(client_object, attrname, value)
 
1578
 
1256
1579
        return True
1257
1580
 
1258
1581
 
1288
1611
            elif suffix == u"w":
1289
1612
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1290
1613
            else:
1291
 
                raise ValueError
1292
 
        except (ValueError, IndexError):
1293
 
            raise ValueError
 
1614
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1615
        except (ValueError, IndexError), e:
 
1616
            raise ValueError(e.message)
1294
1617
        timevalue += delta
1295
1618
    return timevalue
1296
1619
 
1309
1632
        def if_nametoindex(interface):
1310
1633
            "Get an interface index the hard way, i.e. using fcntl()"
1311
1634
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1312
 
            with closing(socket.socket()) as s:
 
1635
            with contextlib.closing(socket.socket()) as s:
1313
1636
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1314
1637
                                    struct.pack(str(u"16s16x"),
1315
1638
                                                interface))
1335
1658
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1336
1659
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1337
1660
            raise OSError(errno.ENODEV,
1338
 
                          u"/dev/null not a character device")
 
1661
                          u"%s not a character device"
 
1662
                          % os.path.devnull)
1339
1663
        os.dup2(null, sys.stdin.fileno())
1340
1664
        os.dup2(null, sys.stdout.fileno())
1341
1665
        os.dup2(null, sys.stderr.fileno())
1360
1684
    parser.add_option("--debug", action=u"store_true",
1361
1685
                      help=u"Debug mode; run in foreground and log to"
1362
1686
                      u" terminal")
 
1687
    parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
 
1688
                      help=u"Debug level for stdout output")
1363
1689
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1364
1690
                      u" priority string (see GnuTLS documentation)")
1365
1691
    parser.add_option("--servicename", type=u"string",
1390
1716
                        u"servicename": u"Mandos",
1391
1717
                        u"use_dbus": u"True",
1392
1718
                        u"use_ipv6": u"True",
 
1719
                        u"debuglevel": u"",
1393
1720
                        }
1394
1721
    
1395
1722
    # Parse config file for server-global settings
1412
1739
    # options, if set.
1413
1740
    for option in (u"interface", u"address", u"port", u"debug",
1414
1741
                   u"priority", u"servicename", u"configdir",
1415
 
                   u"use_dbus", u"use_ipv6"):
 
1742
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
1416
1743
        value = getattr(options, option)
1417
1744
        if value is not None:
1418
1745
            server_settings[option] = value
1427
1754
    
1428
1755
    # For convenience
1429
1756
    debug = server_settings[u"debug"]
 
1757
    debuglevel = server_settings[u"debuglevel"]
1430
1758
    use_dbus = server_settings[u"use_dbus"]
1431
1759
    use_ipv6 = server_settings[u"use_ipv6"]
1432
 
    
1433
 
    if not debug:
1434
 
        syslogger.setLevel(logging.WARNING)
1435
 
        console.setLevel(logging.WARNING)
1436
 
    
 
1760
 
1437
1761
    if server_settings[u"servicename"] != u"Mandos":
1438
1762
        syslogger.setFormatter(logging.Formatter
1439
1763
                               (u'Mandos (%s) [%%(process)d]:'
1445
1769
                        u"interval": u"5m",
1446
1770
                        u"checker": u"fping -q -- %%(host)s",
1447
1771
                        u"host": u"",
 
1772
                        u"approval_delay": u"0s",
 
1773
                        u"approval_duration": u"1s",
1448
1774
                        }
1449
1775
    client_config = configparser.SafeConfigParser(client_defaults)
1450
1776
    client_config.read(os.path.join(server_settings[u"configdir"],
1456
1782
    tcp_server = MandosServer((server_settings[u"address"],
1457
1783
                               server_settings[u"port"]),
1458
1784
                              ClientHandler,
1459
 
                              interface=server_settings[u"interface"],
 
1785
                              interface=(server_settings[u"interface"]
 
1786
                                         or None),
1460
1787
                              use_ipv6=use_ipv6,
1461
1788
                              gnutls_priority=
1462
1789
                              server_settings[u"priority"],
1463
1790
                              use_dbus=use_dbus)
1464
 
    pidfilename = u"/var/run/mandos.pid"
1465
 
    try:
1466
 
        pidfile = open(pidfilename, u"w")
1467
 
    except IOError:
1468
 
        logger.error(u"Could not open file %r", pidfilename)
 
1791
    if not debug:
 
1792
        pidfilename = u"/var/run/mandos.pid"
 
1793
        try:
 
1794
            pidfile = open(pidfilename, u"w")
 
1795
        except IOError:
 
1796
            logger.error(u"Could not open file %r", pidfilename)
1469
1797
    
1470
1798
    try:
1471
1799
        uid = pwd.getpwnam(u"_mandos").pw_uid
1488
1816
        if error[0] != errno.EPERM:
1489
1817
            raise error
1490
1818
    
1491
 
    # Enable all possible GnuTLS debugging
 
1819
    if not debug and not debuglevel:
 
1820
        syslogger.setLevel(logging.WARNING)
 
1821
        console.setLevel(logging.WARNING)
 
1822
    if debuglevel:
 
1823
        level = getattr(logging, debuglevel.upper())
 
1824
        syslogger.setLevel(level)
 
1825
        console.setLevel(level)
 
1826
 
1492
1827
    if debug:
 
1828
        # Enable all possible GnuTLS debugging
 
1829
        
1493
1830
        # "Use a log level over 10 to enable all debugging options."
1494
1831
        # - GnuTLS manual
1495
1832
        gnutls.library.functions.gnutls_global_set_log_level(11)
1500
1837
        
1501
1838
        (gnutls.library.functions
1502
1839
         .gnutls_global_set_log_function(debug_gnutls))
 
1840
        
 
1841
        # Redirect stdin so all checkers get /dev/null
 
1842
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1843
        os.dup2(null, sys.stdin.fileno())
 
1844
        if null > 2:
 
1845
            os.close(null)
 
1846
    else:
 
1847
        # No console logging
 
1848
        logger.removeHandler(console)
 
1849
    
1503
1850
    
1504
1851
    global main_loop
1505
1852
    # From the Avahi example code
1508
1855
    bus = dbus.SystemBus()
1509
1856
    # End of Avahi example code
1510
1857
    if use_dbus:
1511
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
 
1858
        try:
 
1859
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
1860
                                            bus, do_not_queue=True)
 
1861
        except dbus.exceptions.NameExistsException, e:
 
1862
            logger.error(unicode(e) + u", disabling D-Bus")
 
1863
            use_dbus = False
 
1864
            server_settings[u"use_dbus"] = False
 
1865
            tcp_server.use_dbus = False
1512
1866
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1513
1867
    service = AvahiService(name = server_settings[u"servicename"],
1514
1868
                           servicetype = u"_mandos._tcp",
1516
1870
    if server_settings["interface"]:
1517
1871
        service.interface = (if_nametoindex
1518
1872
                             (str(server_settings[u"interface"])))
 
1873
 
 
1874
    if not debug:
 
1875
        # Close all input and output, do double fork, etc.
 
1876
        daemon()
 
1877
        
 
1878
    global multiprocessing_manager
 
1879
    multiprocessing_manager = multiprocessing.Manager()
1519
1880
    
1520
1881
    client_class = Client
1521
1882
    if use_dbus:
1522
1883
        client_class = functools.partial(ClientDBus, bus = bus)
 
1884
    def client_config_items(config, section):
 
1885
        special_settings = {
 
1886
            "approved_by_default":
 
1887
                lambda: config.getboolean(section,
 
1888
                                          "approved_by_default"),
 
1889
            }
 
1890
        for name, value in config.items(section):
 
1891
            try:
 
1892
                yield (name, special_settings[name]())
 
1893
            except KeyError:
 
1894
                yield (name, value)
 
1895
    
1523
1896
    tcp_server.clients.update(set(
1524
1897
            client_class(name = section,
1525
 
                         config= dict(client_config.items(section)))
 
1898
                         config= dict(client_config_items(
 
1899
                        client_config, section)))
1526
1900
            for section in client_config.sections()))
1527
1901
    if not tcp_server.clients:
1528
1902
        logger.warning(u"No clients defined")
1529
 
    
1530
 
    if debug:
1531
 
        # Redirect stdin so all checkers get /dev/null
1532
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1533
 
        os.dup2(null, sys.stdin.fileno())
1534
 
        if null > 2:
1535
 
            os.close(null)
1536
 
    else:
1537
 
        # No console logging
1538
 
        logger.removeHandler(console)
1539
 
        # Close all input and output, do double fork, etc.
1540
 
        daemon()
1541
 
    
1542
 
    try:
1543
 
        with closing(pidfile):
1544
 
            pid = os.getpid()
1545
 
            pidfile.write(str(pid) + "\n")
1546
 
        del pidfile
1547
 
    except IOError:
1548
 
        logger.error(u"Could not write to file %r with PID %d",
1549
 
                     pidfilename, pid)
1550
 
    except NameError:
1551
 
        # "pidfile" was never created
1552
 
        pass
1553
 
    del pidfilename
1554
 
    
1555
 
    def cleanup():
1556
 
        "Cleanup function; run on exit"
1557
 
        service.cleanup()
1558
1903
        
1559
 
        while tcp_server.clients:
1560
 
            client = tcp_server.clients.pop()
1561
 
            client.disable_hook = None
1562
 
            client.disable()
1563
 
    
1564
 
    atexit.register(cleanup)
1565
 
    
1566
1904
    if not debug:
 
1905
        try:
 
1906
            with pidfile:
 
1907
                pid = os.getpid()
 
1908
                pidfile.write(str(pid) + "\n")
 
1909
            del pidfile
 
1910
        except IOError:
 
1911
            logger.error(u"Could not write to file %r with PID %d",
 
1912
                         pidfilename, pid)
 
1913
        except NameError:
 
1914
            # "pidfile" was never created
 
1915
            pass
 
1916
        del pidfilename
 
1917
        
1567
1918
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1919
 
1568
1920
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1569
1921
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1570
1922
    
1575
1927
                dbus.service.Object.__init__(self, bus, u"/")
1576
1928
            _interface = u"se.bsnet.fukt.Mandos"
1577
1929
            
1578
 
            @dbus.service.signal(_interface, signature=u"oa{sv}")
1579
 
            def ClientAdded(self, objpath, properties):
 
1930
            @dbus.service.signal(_interface, signature=u"o")
 
1931
            def ClientAdded(self, objpath):
1580
1932
                "D-Bus signal"
1581
1933
                pass
1582
1934
            
1583
 
            @dbus.service.signal(_interface, signature=u"s")
1584
 
            def ClientNotFound(self, fingerprint):
 
1935
            @dbus.service.signal(_interface, signature=u"ss")
 
1936
            def ClientNotFound(self, fingerprint, address):
1585
1937
                "D-Bus signal"
1586
1938
                pass
1587
1939
            
1613
1965
                        tcp_server.clients.remove(c)
1614
1966
                        c.remove_from_connection()
1615
1967
                        # Don't signal anything except ClientRemoved
1616
 
                        c.disable(signal=False)
 
1968
                        c.disable(quiet=True)
1617
1969
                        # Emit D-Bus signal
1618
1970
                        self.ClientRemoved(object_path, c.name)
1619
1971
                        return
1620
 
                raise KeyError
 
1972
                raise KeyError(object_path)
1621
1973
            
1622
1974
            del _interface
1623
1975
        
1624
1976
        mandos_dbus_service = MandosDBusService()
1625
1977
    
 
1978
    def cleanup():
 
1979
        "Cleanup function; run on exit"
 
1980
        service.cleanup()
 
1981
        
 
1982
        while tcp_server.clients:
 
1983
            client = tcp_server.clients.pop()
 
1984
            if use_dbus:
 
1985
                client.remove_from_connection()
 
1986
            client.disable_hook = None
 
1987
            # Don't signal anything except ClientRemoved
 
1988
            client.disable(quiet=True)
 
1989
            if use_dbus:
 
1990
                # Emit D-Bus signal
 
1991
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1992
                                                  client.name)
 
1993
    
 
1994
    atexit.register(cleanup)
 
1995
    
1626
1996
    for client in tcp_server.clients:
1627
1997
        if use_dbus:
1628
1998
            # Emit D-Bus signal
1629
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
1630
 
                                            client.GetAll(u""))
 
1999
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
1631
2000
        client.enable()
1632
2001
    
1633
2002
    tcp_server.enable()
1651
2020
            service.activate()
1652
2021
        except dbus.exceptions.DBusException, error:
1653
2022
            logger.critical(u"DBusException: %s", error)
 
2023
            cleanup()
1654
2024
            sys.exit(1)
1655
2025
        # End of Avahi example code
1656
2026
        
1663
2033
        main_loop.run()
1664
2034
    except AvahiError, error:
1665
2035
        logger.critical(u"AvahiError: %s", error)
 
2036
        cleanup()
1666
2037
        sys.exit(1)
1667
2038
    except KeyboardInterrupt:
1668
2039
        if debug:
1669
2040
            print >> sys.stderr
1670
2041
        logger.debug(u"Server received KeyboardInterrupt")
1671
2042
    logger.debug(u"Server exiting")
 
2043
    # Must run before the D-Bus bus name gets deregistered
 
2044
    cleanup()
1672
2045
 
1673
2046
if __name__ == '__main__':
1674
2047
    main()