/mandos/trunk : revision 24.1.145

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

55

import logging

56

import logging.handlers

57

import pwd

58

import contextlib

58

from contextlib import closing

59

import struct

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

64

62

65

63

import dbus

66

64

import dbus.service

81

79

SO_BINDTODEVICE = None

82

80

83

81

84

version = "1.2"

82

version = "1.0.12"

85

83

86

#logger = logging.getLogger(u'mandos')

87

84

logger = logging.Logger(u'mandos')

88

85

syslogger = (logging.handlers.SysLogHandler

89

86

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

157

154

u" after %i retries, exiting.",

158

155

self.rename_count)

159

156

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

157

self.name = self.server.GetAlternativeServiceName(self.name)

161

158

logger.info(u"Changing Zeroconf service name to %r ...",

162

self.name)

159

unicode(self.name))

163

160

syslogger.setFormatter(logging.Formatter

164

161

(u'Mandos (%s) [%%(process)d]:'

165

162

u' %%(levelname)s: %%(message)s'

166

163

% self.name))

167

164

self.remove()

168

try:

169

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

172

self.cleanup()

173

os._exit(1)

165

self.add()

174

166

self.rename_count += 1

175

167

def remove(self):

176

168

"""Derived from the Avahi example code"""

199

191

self.group.Commit()

200

192

def entry_group_state_changed(self, state, error):

201

193

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

194

logger.debug(u"Avahi state change: %i", state)

203

195

204

196

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

197

logger.debug(u"Zeroconf service established.")

218

210

self.group = None

219

211

def server_state_changed(self, state):

220

212

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

213

if state == avahi.SERVER_COLLISION:

223

214

logger.error(u"Zeroconf server name collision")

224

215

self.remove()

240

231

"""A representation of a client host served by this server.

241

232

242

233

Attributes:

243

_approved: bool(); 'None' if not yet approved/disapproved

244

approval_delay: datetime.timedelta(); Time to wait for approval

245

approval_duration: datetime.timedelta(); Duration of one approval

234

name: string; from the config file, used in log messages and

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

246

248

checker: subprocess.Popen(); a running checker process used

247

249

to see if the client lives.

248

250

'None' if no process is running.

249

checker_callback_tag: a gobject event source tag, or None

250

checker_command: string; External command which is run to check

251

if client lives. %() expansions are done at

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

252

256

runtime with vars(self) as dict, so that for

253

257

instance %(name)s can be used in the command.

254

checker_initiator_tag: a gobject event source tag, or None

255

created: datetime.datetime(); (UTC) object creation

256

258

current_checker_command: string; current running checker_command

257

disable_hook: If set, called by disable() as disable_hook(self)

258

disable_initiator_tag: a gobject event source tag, or None

259

enabled: bool()

260

fingerprint: string (40 or 32 hexadecimal digits); used to

261

uniquely identify the client

262

host: string; available for use by the checker command

263

interval: datetime.timedelta(); How often to start a new checker

264

last_approval_request: datetime.datetime(); (UTC) or None

265

last_checked_ok: datetime.datetime(); (UTC) or None

266

last_enabled: datetime.datetime(); (UTC)

267

name: string; from the config file, used in log messages and

268

D-Bus identifiers

269

secret: bytestring; sent verbatim (over TLS) to client

270

timeout: datetime.timedelta(); How long from last_checked_ok

271

until this client is disabled

272

runtime_expansions: Allowed attributes for runtime expansion.

273

259

"""

274

260

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

261

@staticmethod

281

262

def _timedelta_to_milliseconds(td):

282

263

"Convert a datetime.timedelta() to milliseconds"

291

272

def interval_milliseconds(self):

292

273

"Return the 'interval' attribute in milliseconds"

293

274

return self._timedelta_to_milliseconds(self.interval)

294

295

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

297

275

298

276

def __init__(self, name = None, disable_hook=None, config=None):

299

277

"""Note: the 'checker' key in 'config' sets the

312

290

if u"secret" in config:

313

291

self.secret = config[u"secret"].decode(u"base64")

314

292

elif u"secfile" in config:

315

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

317

"rb") as secfile:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])))) as secfile:

318

296

self.secret = secfile.read()

319

297

else:

320

298

raise TypeError(u"No secret or secfile for client %s"

322

300

self.host = config.get(u"host", u"")

323

301

self.created = datetime.datetime.utcnow()

324

302

self.enabled = False

325

self.last_approval_request = None

326

303

self.last_enabled = None

327

304

self.last_checked_ok = None

328

305

self.timeout = string_to_delta(config[u"timeout"])

335

312

self.checker_command = config[u"checker"]

336

313

self.current_checker_command = None

337

314

self.last_connect = None

338

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

340

True)

341

self.approvals_pending = 0

342

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

344

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

347

315

348

def send_changedstate(self):

349

self.changedstate.acquire()

350

self.changedstate.notify_all()

351

self.changedstate.release()

352

353

316

def enable(self):

354

317

"""Start this client's checker and timeout hooks"""

355

318

if getattr(self, u"enabled", False):

356

319

# Already enabled

357

320

return

358

self.send_changedstate()

359

321

self.last_enabled = datetime.datetime.utcnow()

360

322

# Schedule a new checker to be started an 'interval' from now,

361

323

# and every interval from then on.

362

324

self.checker_initiator_tag = (gobject.timeout_add

363

325

(self.interval_milliseconds(),

364

326

self.start_checker))

327

# Also start a new checker *right now*.

328

self.start_checker()

365

329

# Schedule a disable() when 'timeout' has passed

366

330

self.disable_initiator_tag = (gobject.timeout_add

367

331

(self.timeout_milliseconds(),

368

332

self.disable))

369

333

self.enabled = True

370

# Also start a new checker *right now*.

371

self.start_checker()

372

334

373

def disable(self, quiet=True):

335

def disable(self):

374

336

"""Disable this client."""

375

337

if not getattr(self, "enabled", False):

376

338

return False

377

if not quiet:

378

self.send_changedstate()

379

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

339

logger.info(u"Disabling client %s", self.name)

381

340

if getattr(self, u"disable_initiator_tag", False):

382

341

gobject.source_remove(self.disable_initiator_tag)

383

342

self.disable_initiator_tag = None

424

383

(self.timeout_milliseconds(),

425

384

self.disable))

426

385

427

def need_approval(self):

428

self.last_approval_request = datetime.datetime.utcnow()

429

430

386

def start_checker(self):

431

387

"""Start a new checker subprocess if one is not running.

432

388

438

394

# client would inevitably timeout, since no checker would get

439

395

# a chance to run to completion. If we instead leave running

440

396

# checkers alone, the checker would have to take more time

441

# than 'timeout' for the client to be disabled, which is as it

442

# should be.

397

# than 'timeout' for the client to be declared invalid, which

398

# is as it should be.

443

399

444

400

# If a checker exists, make sure it is not a zombie

445

try:

401

if self.checker is not None:

446

402

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

447

except (AttributeError, OSError), error:

448

if (isinstance(error, OSError)

449

and error.errno != errno.ECHILD):

450

raise error

451

else:

452

403

if pid:

453

404

logger.warning(u"Checker was a zombie")

454

405

gobject.source_remove(self.checker_callback_tag)

461

412

command = self.checker_command % self.host

462

413

except TypeError:

463

414

# Escape attributes for the shell

464

escaped_attrs = dict(

465

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

467

errors=

468

u'replace')))

469

for attr in

470

self.runtime_expansions)

471

415

escaped_attrs = dict((key,

416

re.escape(unicode(str(val),

417

errors=

418

u'replace')))

419

for key, val in

420

vars(self).iteritems())

472

421

try:

473

422

command = self.checker_command % escaped_attrs

474

423

except TypeError, error:

512

461

logger.debug(u"Stopping checker for %(name)s", vars(self))

513

462

try:

514

463

os.kill(self.checker.pid, signal.SIGTERM)

515

#time.sleep(0.5)

464

#os.sleep(0.5)

516

465

#if self.checker.poll() is None:

517

466

# os.kill(self.checker.pid, signal.SIGKILL)

518

467

except OSError, error:

519

468

if error.errno != errno.ESRCH: # No such process

520

469

raise

521

470

self.checker = None

471

472

def still_valid(self):

473

"""Has the timeout not yet passed for this client?"""

474

if not getattr(self, u"enabled", False):

475

return False

476

now = datetime.datetime.utcnow()

477

if self.last_checked_ok is None:

478

return now < (self.created + self.timeout)

479

else:

480

return now < (self.last_checked_ok + self.timeout)

481

522

482

523

483

def dbus_service_property(dbus_interface, signature=u"v",

524

484

access=u"readwrite", byte_arrays=False):

532

492

dbus.service.method, except there is only "signature", since the

533

493

type from Get() and the type sent to Set() is the same.

534

494

"""

535

# Encoding deeply encoded byte arrays is not supported yet by the

536

# "Set" method, so we fail early here:

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

540

495

def decorator(func):

541

496

func._dbus_is_property = True

542

497

func._dbus_interface = dbus_interface

628

583

if prop._dbus_access == u"read":

629

584

raise DBusPropertyAccessException(property_name)

630

585

if prop._dbus_get_args_options[u"byte_arrays"]:

631

# The byte_arrays option is not supported yet on

632

# signatures other than "ay".

633

if prop._dbus_signature != u"ay":

634

raise ValueError

635

586

value = dbus.ByteArray(''.join(unichr(byte)

636

587

for byte in value))

637

588

prop(value)

669

620

"""Standard D-Bus method, overloaded to insert property tags.

670

621

"""

671

622

xmlstring = dbus.service.Object.Introspect(self, object_path,

672

connection)

673

try:

674

document = xml.dom.minidom.parseString(xmlstring)

675

def make_tag(document, name, prop):

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

680

return e

681

for if_tag in document.getElementsByTagName(u"interface"):

682

for tag in (make_tag(document, name, prop)

683

for name, prop

684

in self._get_all_dbus_properties()

685

if prop._dbus_interface

686

== if_tag.getAttribute(u"name")):

687

if_tag.appendChild(tag)

688

# Add the names to the return values for the

689

# "org.freedesktop.DBus.Properties" methods

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

704

document.unlink()

705

except (AttributeError, xml.dom.DOMException,

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

708

error)

623

connection)

624

document = xml.dom.minidom.parseString(xmlstring)

625

del xmlstring

626

def make_tag(document, name, prop):

627

e = document.createElement(u"property")

628

e.setAttribute(u"name", name)

629

e.setAttribute(u"type", prop._dbus_signature)

630

e.setAttribute(u"access", prop._dbus_access)

631

return e

632

for if_tag in document.getElementsByTagName(u"interface"):

633

for tag in (make_tag(document, name, prop)

634

for name, prop

635

in self._get_all_dbus_properties()

636

if prop._dbus_interface

637

== if_tag.getAttribute(u"name")):

638

if_tag.appendChild(tag)

639

xmlstring = document.toxml(u"utf-8")

640

document.unlink()

709

641

return xmlstring

710

642

711

643

716

648

dbus_object_path: dbus.ObjectPath

717

649

bus: dbus.SystemBus()

718

650

"""

719

720

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

722

723

651

# dbus.service.Object doesn't use super(), so we can't either.

724

652

725

653

def __init__(self, bus = None, *args, **kwargs):

726

self._approvals_pending = 0

727

654

self.bus = bus

728

655

Client.__init__(self, *args, **kwargs)

729

656

# Only now, when this client is initialized, can it show up on

730

657

# the D-Bus

731

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

734

658

self.dbus_object_path = (dbus.ObjectPath

735

(u"/clients/" + client_object_name))

659

(u"/clients/"

660

+ self.name.replace(u".", u"_")))

736

661

DBusObjectWithProperties.__init__(self, self.bus,

737

662

self.dbus_object_path)

738

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

750

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

663

755

664

@staticmethod

756

665

def _datetime_to_dbus(dt, variant_level=0):

763

672

r = Client.enable(self)

764

673

if oldstate != self.enabled:

765

674

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

675

self.PropertyChanged(dbus.String(u"enabled"),

767

676

dbus.Boolean(True, variant_level=1))

768

677

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

678

dbus.String(u"last_enabled"),

770

679

self._datetime_to_dbus(self.last_enabled,

771

680

variant_level=1))

772

681

return r

773

682

774

def disable(self, quiet = False):

683

def disable(self, signal = True):

775

684

oldstate = getattr(self, u"enabled", False)

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

685

r = Client.disable(self)

686

if signal and oldstate != self.enabled:

778

687

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

688

self.PropertyChanged(dbus.String(u"enabled"),

780

689

dbus.Boolean(False, variant_level=1))

781

690

return r

782

691

794

703

self.checker_callback_tag = None

795

704

self.checker = None

796

705

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

706

self.PropertyChanged(dbus.String(u"checker_running"),

798

707

dbus.Boolean(False, variant_level=1))

799

708

if os.WIFEXITED(condition):

800

709

exitstatus = os.WEXITSTATUS(condition)

815

724

r = Client.checked_ok(self, *args, **kwargs)

816

725

# Emit D-Bus signal

817

726

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

727

dbus.String(u"last_checked_ok"),

819

728

(self._datetime_to_dbus(self.last_checked_ok,

820

729

variant_level=1)))

821

730

return r

822

731

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

832

732

def start_checker(self, *args, **kwargs):

833

733

old_checker = self.checker

834

734

if self.checker is not None:

842

742

# Emit D-Bus signal

843

743

self.CheckerStarted(self.current_checker_command)

844

744

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

745

dbus.String(u"checker_running"),

846

746

dbus.Boolean(True, variant_level=1))

847

747

return r

848

748

851

751

r = Client.stop_checker(self, *args, **kwargs)

852

752

if (old_checker is not None

853

753

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

754

self.PropertyChanged(dbus.String(u"checker_running"),

855

755

dbus.Boolean(False, variant_level=1))

856

756

return r

857

858

def _reset_approved(self):

859

self._approved = None

860

return False

861

862

def approve(self, value=True):

863

self.send_changedstate()

864

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

866

(self.approval_duration),

867

self._reset_approved)

868

869

870

## D-Bus methods, signals & properties

757

758

## D-Bus methods & signals

871

759

_interface = u"se.bsnet.fukt.Mandos.Client"

872

760

873

## Signals

874

875

761

# CheckerCompleted - signal

876

762

@dbus.service.signal(_interface, signature=u"nxs")

877

763

def CheckerCompleted(self, exitcode, waitstatus, command):

890

776

"D-Bus signal"

891

777

pass

892

778

893

# GotSecret - signal

779

# ReceivedSecret - signal

894

780

@dbus.service.signal(_interface)

895

def GotSecret(self):

896

"""D-Bus signal

897

Is sent after a successful transfer of secret from the Mandos

898

server to mandos-client

899

"""

781

def ReceivedSecret(self):

782

"D-Bus signal"

900

783

pass

901

784

902

785

# Rejected - signal

903

@dbus.service.signal(_interface, signature=u"s")

904

def Rejected(self, reason):

786

@dbus.service.signal(_interface)

787

def Rejected(self):

905

788

"D-Bus signal"

906

789

pass

907

790

908

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

910

def NeedApproval(self, timeout, default):

911

"D-Bus signal"

912

return self.need_approval()

913

914

## Methods

915

916

# Approve - method

917

@dbus.service.method(_interface, in_signature=u"b")

918

def Approve(self, value):

919

self.approve(value)

920

921

# CheckedOK - method

922

@dbus.service.method(_interface)

923

def CheckedOK(self):

924

return self.checked_ok()

925

926

# Enable - method

927

@dbus.service.method(_interface)

928

def Enable(self):

929

"D-Bus method"

930

self.enable()

931

932

# StartChecker - method

933

@dbus.service.method(_interface)

934

def StartChecker(self):

935

"D-Bus method"

936

self.start_checker()

937

938

# Disable - method

939

@dbus.service.method(_interface)

940

def Disable(self):

941

"D-Bus method"

942

self.disable()

943

944

# StopChecker - method

945

@dbus.service.method(_interface)

946

def StopChecker(self):

947

self.stop_checker()

948

949

## Properties

950

951

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

953

def ApprovalPending_dbus_property(self):

954

return dbus.Boolean(bool(self.approvals_pending))

955

956

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

959

def ApprovedByDefault_dbus_property(self, value=None):

960

if value is None: # get

961

return dbus.Boolean(self.approved_by_default)

962

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

967

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

970

def ApprovalDelay_dbus_property(self, value=None):

971

if value is None: # get

972

return dbus.UInt64(self.approval_delay_milliseconds())

973

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

978

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

981

def ApprovalDuration_dbus_property(self, value=None):

982

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

984

self.approval_duration))

985

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

990

# Name - property

791

# name - property

991

792

@dbus_service_property(_interface, signature=u"s", access=u"read")

992

def Name_dbus_property(self):

793

def name_dbus_property(self):

993

794

return dbus.String(self.name)

994

795

995

# Fingerprint - property

796

# fingerprint - property

996

797

@dbus_service_property(_interface, signature=u"s", access=u"read")

997

def Fingerprint_dbus_property(self):

798

def fingerprint_dbus_property(self):

998

799

return dbus.String(self.fingerprint)

999

800

1000

# Host - property

801

# host - property

1001

802

@dbus_service_property(_interface, signature=u"s",

1002

803

access=u"readwrite")

1003

def Host_dbus_property(self, value=None):

804

def host_dbus_property(self, value=None):

1004

805

if value is None: # get

1005

806

return dbus.String(self.host)

1006

807

self.host = value

1007

808

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

809

self.PropertyChanged(dbus.String(u"host"),

1009

810

dbus.String(value, variant_level=1))

1010

811

1011

# Created - property

812

# created - property

1012

813

@dbus_service_property(_interface, signature=u"s", access=u"read")

1013

def Created_dbus_property(self):

814

def created_dbus_property(self):

1014

815

return dbus.String(self._datetime_to_dbus(self.created))

1015

816

1016

# LastEnabled - property

817

# last_enabled - property

1017

818

@dbus_service_property(_interface, signature=u"s", access=u"read")

1018

def LastEnabled_dbus_property(self):

819

def last_enabled_dbus_property(self):

1019

820

if self.last_enabled is None:

1020

821

return dbus.String(u"")

1021

822

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1022

823

1023

# Enabled - property

824

# enabled - property

1024

825

@dbus_service_property(_interface, signature=u"b",

1025

826

access=u"readwrite")

1026

def Enabled_dbus_property(self, value=None):

827

def enabled_dbus_property(self, value=None):

1027

828

if value is None: # get

1028

829

return dbus.Boolean(self.enabled)

1029

830

if value:

1031

832

else:

1032

833

self.disable()

1033

834

1034

# LastCheckedOK - property

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1037

def LastCheckedOK_dbus_property(self, value=None):

1038

if value is not None:

1039

self.checked_ok()

1040

return

835

# last_checked_ok - property

836

@dbus_service_property(_interface, signature=u"s", access=u"read")

837

def last_checked_ok_dbus_property(self):

1041

838

if self.last_checked_ok is None:

1042

839

return dbus.String(u"")

1043

840

return dbus.String(self._datetime_to_dbus(self

1044

841

.last_checked_ok))

1045

842

1046

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1048

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1054

1055

# Timeout - property

843

# timeout - property

1056

844

@dbus_service_property(_interface, signature=u"t",

1057

845

access=u"readwrite")

1058

def Timeout_dbus_property(self, value=None):

846

def timeout_dbus_property(self, value=None):

1059

847

if value is None: # get

1060

848

return dbus.UInt64(self.timeout_milliseconds())

1061

849

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

850

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

851

self.PropertyChanged(dbus.String(u"timeout"),

1064

852

dbus.UInt64(value, variant_level=1))

1065

853

if getattr(self, u"disable_initiator_tag", None) is None:

1066

854

return

1080

868

self.disable_initiator_tag = (gobject.timeout_add

1081

869

(time_to_die, self.disable))

1082

870

1083

# Interval - property

871

# interval - property

1084

872

@dbus_service_property(_interface, signature=u"t",

1085

873

access=u"readwrite")

1086

def Interval_dbus_property(self, value=None):

874

def interval_dbus_property(self, value=None):

1087

875

if value is None: # get

1088

876

return dbus.UInt64(self.interval_milliseconds())

1089

877

self.interval = datetime.timedelta(0, 0, 0, value)

1090

878

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

879

self.PropertyChanged(dbus.String(u"interval"),

1092

880

dbus.UInt64(value, variant_level=1))

1093

881

if getattr(self, u"checker_initiator_tag", None) is None:

1094

882

return

1098

886

(value, self.start_checker))

1099

887

self.start_checker() # Start one now, too

1100

888

1101

# Checker - property

889

# checker - property

1102

890

@dbus_service_property(_interface, signature=u"s",

1103

891

access=u"readwrite")

1104

def Checker_dbus_property(self, value=None):

892

def checker_dbus_property(self, value=None):

1105

893

if value is None: # get

1106

894

return dbus.String(self.checker_command)

1107

895

self.checker_command = value

1108

896

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

897

self.PropertyChanged(dbus.String(u"checker"),

1110

898

dbus.String(self.checker_command,

1111

899

variant_level=1))

1112

900

1113

# CheckerRunning - property

901

# checker_running - property

1114

902

@dbus_service_property(_interface, signature=u"b",

1115

903

access=u"readwrite")

1116

def CheckerRunning_dbus_property(self, value=None):

904

def checker_running_dbus_property(self, value=None):

1117

905

if value is None: # get

1118

906

return dbus.Boolean(self.checker is not None)

1119

907

if value:

1121

909

else:

1122

910

self.stop_checker()

1123

911

1124

# ObjectPath - property

912

# object_path - property

1125

913

@dbus_service_property(_interface, signature=u"o", access=u"read")

1126

def ObjectPath_dbus_property(self):

914

def object_path_dbus_property(self):

1127

915

return self.dbus_object_path # is already a dbus.ObjectPath

1128

916

1129

# Secret = property

917

# secret = property xxx

1130

918

@dbus_service_property(_interface, signature=u"ay",

1131

919

access=u"write", byte_arrays=True)

1132

def Secret_dbus_property(self, value):

920

def secret_dbus_property(self, value):

1133

921

self.secret = str(value)

1134

922

1135

923

del _interface

1136

924

1137

925

1138

class ProxyClient(object):

1139

def __init__(self, child_pipe, fpr, address):

1140

self._pipe = child_pipe

1141

self._pipe.send(('init', fpr, address))

1142

if not self._pipe.recv():

1143

raise KeyError()

1144

1145

def __getattribute__(self, name):

1146

if(name == '_pipe'):

1147

return super(ProxyClient, self).__getattribute__(name)

1148

self._pipe.send(('getattr', name))

1149

data = self._pipe.recv()

1150

if data[0] == 'data':

1151

return data[1]

1152

if data[0] == 'function':

1153

def func(*args, **kwargs):

1154

self._pipe.send(('funcall', name, args, kwargs))

1155

return self._pipe.recv()[1]

1156

return func

1157

1158

def __setattr__(self, name, value):

1159

if(name == '_pipe'):

1160

return super(ProxyClient, self).__setattr__(name, value)

1161

self._pipe.send(('setattr', name, value))

1162

1163

1164

926

class ClientHandler(socketserver.BaseRequestHandler, object):

1165

927

"""A class to handle client connections.

1166

928

1168

930

Note: This will run in its own forked process."""

1169

931

1170

932

def handle(self):

1171

with contextlib.closing(self.server.child_pipe) as child_pipe:

1172

logger.info(u"TCP connection from: %s",

1173

unicode(self.client_address))

1174

logger.debug(u"Pipe FD: %d",

1175

self.server.child_pipe.fileno())

1176

933

logger.info(u"TCP connection from: %s",

934

unicode(self.client_address))

935

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

936

# Open IPC pipe to parent process

937

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1177

938

session = (gnutls.connection

1178

939

.ClientSession(self.request,

1179

940

gnutls.connection

1180

941

.X509Credentials()))

1181

942

943

line = self.request.makefile().readline()

944

logger.debug(u"Protocol version: %r", line)

945

try:

946

if int(line.strip().split()[0]) > 1:

947

raise RuntimeError

948

except (ValueError, IndexError, RuntimeError), error:

949

logger.error(u"Unknown protocol version: %s", error)

950

return

951

1182

952

# Note: gnutls.connection.X509Credentials is really a

1183

953

# generic GnuTLS certificate credentials object so long as

1184

954

# no X.509 keys are added to it. Therefore, we can use it

1185

955

# here despite using OpenPGP certificates.

1186

956

1187

957

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1188

958

# u"+AES-256-CBC", u"+SHA1",

1189

959

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1195

965

(gnutls.library.functions

1196

966

.gnutls_priority_set_direct(session._c_object,

1197

967

priority, None))

1198

1199

# Start communication using the Mandos protocol

1200

# Get protocol number

1201

line = self.request.makefile().readline()

1202

logger.debug(u"Protocol version: %r", line)

1203

try:

1204

if int(line.strip().split()[0]) > 1:

1205

raise RuntimeError

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1208

return

1209

1210

# Start GnuTLS connection

968

1211

969

try:

1212

970

session.handshake()

1213

971

except gnutls.errors.GNUTLSError, error:

1216

974

# established. Just abandon the request.

1217

975

return

1218

976

logger.debug(u"Handshake succeeded")

1219

1220

approval_required = False

1221

977

try:

1222

try:

1223

fpr = self.fingerprint(self.peer_certificate

1224

(session))

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1227

return

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1230

try:

1231

client = ProxyClient(child_pipe, fpr,

1232

self.client_address)

1233

except KeyError:

1234

return

1235

1236

if client.approval_delay:

1237

delay = client.approval_delay

1238

client.approvals_pending += 1

1239

approval_required = True

1240

1241

while True:

1242

if not client.enabled:

1243

logger.warning(u"Client %s is disabled",

1244

client.name)

1245

if self.server.use_dbus:

1246

# Emit D-Bus signal

1247

client.Rejected("Disabled")

1248

return

1249

1250

if client._approved or not client.approval_delay:

1251

#We are approved or approval is disabled

1252

break

1253

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1255

client.name)

1256

if self.server.use_dbus:

1257

# Emit D-Bus signal

1258

client.NeedApproval(

1259

client.approval_delay_milliseconds(),

1260

client.approved_by_default)

1261

else:

1262

logger.warning(u"Client %s was not approved",

1263

client.name)

1264

if self.server.use_dbus:

1265

# Emit D-Bus signal

1266

client.Rejected("Denied")

1267

return

1268

1269

#wait until timeout or approved

1270

#x = float(client._timedelta_to_milliseconds(delay))

1271

time = datetime.datetime.now()

1272

client.changedstate.acquire()

1273

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1274

client.changedstate.release()

1275

time2 = datetime.datetime.now()

1276

if (time2 - time) >= delay:

1277

if not client.approved_by_default:

1278

logger.warning("Client %s timed out while"

1279

" waiting for approval",

1280

client.name)

1281

if self.server.use_dbus:

1282

# Emit D-Bus signal

1283

client.Rejected("Approval timed out")

1284

return

1285

else:

1286

break

1287

else:

1288

delay -= time2 - time

1289

1290

sent_size = 0

1291

while sent_size < len(client.secret):

1292

try:

1293

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1295

logger.warning("gnutls send failed")

1296

return

1297

logger.debug(u"Sent: %d, remaining: %d",

1298

sent, len(client.secret)

1299

- (sent_size + sent))

1300

sent_size += sent

1301

1302

logger.info(u"Sending secret to %s", client.name)

1303

# bump the timeout as if seen

1304

client.checked_ok()

1305

if self.server.use_dbus:

1306

# Emit D-Bus signal

1307

client.GotSecret()

978

fpr = self.fingerprint(self.peer_certificate(session))

979

except (TypeError, gnutls.errors.GNUTLSError), error:

980

logger.warning(u"Bad certificate: %s", error)

981

session.bye()

982

return

983

logger.debug(u"Fingerprint: %s", fpr)

1308

984

1309

finally:

1310

if approval_required:

1311

client.approvals_pending -= 1

1312

try:

1313

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1315

logger.warning("GnuTLS bye failed")

985

for c in self.server.clients:

986

if c.fingerprint == fpr:

987

client = c

988

break

989

else:

990

ipc.write(u"NOTFOUND %s %s\n"

991

% (fpr, unicode(self.client_address)))

992

session.bye()

993

return

994

# Have to check if client.still_valid(), since it is

995

# possible that the client timed out while establishing

996

# the GnuTLS session.

997

if not client.still_valid():

998

ipc.write(u"INVALID %s\n" % client.name)

999

session.bye()

1000

return

1001

ipc.write(u"SENDING %s\n" % client.name)

1002

sent_size = 0

1003

while sent_size < len(client.secret):

1004

sent = session.send(client.secret[sent_size:])

1005

logger.debug(u"Sent: %d, remaining: %d",

1006

sent, len(client.secret)

1007

- (sent_size + sent))

1008

sent_size += sent

1009

session.bye()

1316

1010

1317

1011

@staticmethod

1318

1012

def peer_certificate(session):

1378

1072

return hex_fpr

1379

1073

1380

1074

1381

class MultiprocessingMixIn(object):

1382

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1383

def sub_process_main(self, request, address):

1384

try:

1385

self.finish_request(request, address)

1386

except:

1387

self.handle_error(request, address)

1388

self.close_request(request)

1389

1390

def process_request(self, request, address):

1391

"""Start a new process to process the request."""

1392

multiprocessing.Process(target = self.sub_process_main,

1393

args = (request, address)).start()

1394

1395

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1396

""" adds a pipe to the MixIn """

1075

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1076

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1397

1077

def process_request(self, request, client_address):

1398

1078

"""Overrides and wraps the original process_request().

1399

1079

1400

1080

This function creates a new pipe in self.pipe

1401

1081

"""

1402

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1403

1404

super(MultiprocessingMixInWithPipe,

1082

self.pipe = os.pipe()

1083

super(ForkingMixInWithPipe,

1405

1084

self).process_request(request, client_address)

1406

self.child_pipe.close()

1407

self.add_pipe(parent_pipe)

1408

1409

def add_pipe(self, parent_pipe):

1085

os.close(self.pipe[1]) # close write end

1086

self.add_pipe(self.pipe[0])

1087

def add_pipe(self, pipe):

1410

1088

"""Dummy function; override as necessary"""

1411

pass

1412

1413

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1089

os.close(pipe)

1090

1091

1092

class IPv6_TCPServer(ForkingMixInWithPipe,

1414

1093

socketserver.TCPServer, object):

1415

1094

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1416

1095

1501

1180

return socketserver.TCPServer.server_activate(self)

1502

1181

def enable(self):

1503

1182

self.enabled = True

1504

def add_pipe(self, parent_pipe):

1183

def add_pipe(self, pipe):

1505

1184

# Call "handle_ipc" for both data and EOF events

1506

gobject.io_add_watch(parent_pipe.fileno(),

1507

gobject.IO_IN | gobject.IO_HUP,

1508

functools.partial(self.handle_ipc,

1509

parent_pipe = parent_pipe))

1510

1511

def handle_ipc(self, source, condition, parent_pipe=None,

1512

client_object=None):

1185

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1186

self.handle_ipc)

1187

def handle_ipc(self, source, condition, file_objects={}):

1513

1188

condition_names = {

1514

1189

gobject.IO_IN: u"IN", # There is data to read.

1515

1190

gobject.IO_OUT: u"OUT", # Data can be written (without

1524

1199

for cond, name in

1525

1200

condition_names.iteritems()

1526

1201

if cond & condition)

1527

# error or the other end of multiprocessing.Pipe has closed

1528

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1529

return False

1530

1531

# Read a request from the child

1532

request = parent_pipe.recv()

1533

command = request[0]

1534

1535

if command == 'init':

1536

fpr = request[1]

1537

address = request[2]

1538

1539

for c in self.clients:

1540

if c.fingerprint == fpr:

1541

client = c

1542

break

1543

else:

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1546

if self.use_dbus:

1547

# Emit D-Bus signal

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1549

parent_pipe.send(False)

1550

return False

1551

1552

gobject.io_add_watch(parent_pipe.fileno(),

1553

gobject.IO_IN | gobject.IO_HUP,

1554

functools.partial(self.handle_ipc,

1555

parent_pipe = parent_pipe,

1556

client_object = client))

1557

parent_pipe.send(True)

1558

# remove the old hook in favor of the new above hook on same fileno

1559

return False

1560

if command == 'funcall':

1561

funcname = request[1]

1562

args = request[2]

1563

kwargs = request[3]

1564

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1567

if command == 'getattr':

1568

attrname = request[1]

1569

if callable(client_object.__getattribute__(attrname)):

1570

parent_pipe.send(('function',))

1571

else:

1572

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1573

1574

if command == 'setattr':

1575

attrname = request[1]

1576

value = request[2]

1577

setattr(client_object, attrname, value)

1578

1202

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1203

conditions_string)

1204

1205

# Turn the pipe file descriptor into a Python file object

1206

if source not in file_objects:

1207

file_objects[source] = os.fdopen(source, u"r", 1)

1208

1209

# Read a line from the file object

1210

cmdline = file_objects[source].readline()

1211

if not cmdline: # Empty line means end of file

1212

# close the IPC pipe

1213

file_objects[source].close()

1214

del file_objects[source]

1215

1216

# Stop calling this function

1217

return False

1218

1219

logger.debug(u"IPC command: %r", cmdline)

1220

1221

# Parse and act on command

1222

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1223

1224

if cmd == u"NOTFOUND":

1225

logger.warning(u"Client not found for fingerprint: %s",

1226

args)

1227

if self.use_dbus:

1228

# Emit D-Bus signal

1229

mandos_dbus_service.ClientNotFound(args)

1230

elif cmd == u"INVALID":

1231

for client in self.clients:

1232

if client.name == args:

1233

logger.warning(u"Client %s is invalid", args)

1234

if self.use_dbus:

1235

# Emit D-Bus signal

1236

client.Rejected()

1237

break

1238

else:

1239

logger.error(u"Unknown client %s is invalid", args)

1240

elif cmd == u"SENDING":

1241

for client in self.clients:

1242

if client.name == args:

1243

logger.info(u"Sending secret to %s", client.name)

1244

client.checked_ok()

1245

if self.use_dbus:

1246

# Emit D-Bus signal

1247

client.ReceivedSecret()

1248

break

1249

else:

1250

logger.error(u"Sending secret to unknown client %s",

1251

args)

1252

else:

1253

logger.error(u"Unknown IPC command: %r", cmdline)

1254

1255

# Keep calling this function

1579

1256

return True

1580

1257

1581

1258

1611

1288

elif suffix == u"w":

1612

1289

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1613

1290

else:

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1291

raise ValueError

1292

except (ValueError, IndexError):

1293

raise ValueError

1617

1294

timevalue += delta

1618

1295

return timevalue

1619

1296

1632

1309

def if_nametoindex(interface):

1633

1310

"Get an interface index the hard way, i.e. using fcntl()"

1634

1311

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1635

with contextlib.closing(socket.socket()) as s:

1312

with closing(socket.socket()) as s:

1636

1313

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1637

1314

struct.pack(str(u"16s16x"),

1638

1315

interface))

1658

1335

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1659

1336

if not stat.S_ISCHR(os.fstat(null).st_mode):

1660

1337

raise OSError(errno.ENODEV,

1661

u"%s not a character device"

1662

% os.path.devnull)

1338

u"/dev/null not a character device")

1663

1339

os.dup2(null, sys.stdin.fileno())

1664

1340

os.dup2(null, sys.stdout.fileno())

1665

1341

os.dup2(null, sys.stderr.fileno())

1684

1360

parser.add_option("--debug", action=u"store_true",

1685

1361

help=u"Debug mode; run in foreground and log to"

1686

1362

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1689

1363

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

1364

u" priority string (see GnuTLS documentation)")

1691

1365

parser.add_option("--servicename", type=u"string",

1716

1390

u"servicename": u"Mandos",

1717

1391

u"use_dbus": u"True",

1718

1392

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1720

1393

}

1721

1394

1722

1395

# Parse config file for server-global settings

1739

1412

# options, if set.

1740

1413

for option in (u"interface", u"address", u"port", u"debug",

1741

1414

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1415

u"use_dbus", u"use_ipv6"):

1743

1416

value = getattr(options, option)

1744

1417

if value is not None:

1745

1418

server_settings[option] = value

1754

1427

1755

1428

# For convenience

1756

1429

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

1430

use_dbus = server_settings[u"use_dbus"]

1759

1431

use_ipv6 = server_settings[u"use_ipv6"]

1760

1432

1433

if not debug:

1434

syslogger.setLevel(logging.WARNING)

1435

console.setLevel(logging.WARNING)

1436

1761

1437

if server_settings[u"servicename"] != u"Mandos":

1762

1438

syslogger.setFormatter(logging.Formatter

1763

1439

(u'Mandos (%s) [%%(process)d]:'

1769

1445

u"interval": u"5m",

1770

1446

u"checker": u"fping -q -- %%(host)s",

1771

1447

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1774

1448

}

1775

1449

client_config = configparser.SafeConfigParser(client_defaults)

1776

1450

client_config.read(os.path.join(server_settings[u"configdir"],

1782

1456

tcp_server = MandosServer((server_settings[u"address"],

1783

1457

server_settings[u"port"]),

1784

1458

ClientHandler,

1785

interface=(server_settings[u"interface"]

1786

or None),

1459

interface=server_settings[u"interface"],

1787

1460

use_ipv6=use_ipv6,

1788

1461

gnutls_priority=

1789

1462

server_settings[u"priority"],

1790

1463

use_dbus=use_dbus)

1791

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1793

try:

1794

pidfile = open(pidfilename, u"w")

1795

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1464

pidfilename = u"/var/run/mandos.pid"

1465

try:

1466

pidfile = open(pidfilename, u"w")

1467

except IOError:

1468

logger.error(u"Could not open file %r", pidfilename)

1797

1469

1798

1470

try:

1799

1471

uid = pwd.getpwnam(u"_mandos").pw_uid

1816

1488

if error[0] != errno.EPERM:

1817

1489

raise error

1818

1490

1819

if not debug and not debuglevel:

1820

syslogger.setLevel(logging.WARNING)

1821

console.setLevel(logging.WARNING)

1822

if debuglevel:

1823

level = getattr(logging, debuglevel.upper())

1824

syslogger.setLevel(level)

1825

console.setLevel(level)

1826

1491

# Enable all possible GnuTLS debugging

1827

1492

if debug:

1828

# Enable all possible GnuTLS debugging

1829

1830

1493

# "Use a log level over 10 to enable all debugging options."

1831

1494

# - GnuTLS manual

1832

1495

gnutls.library.functions.gnutls_global_set_log_level(11)

1837

1500

1838

1501

(gnutls.library.functions

1839

1502

.gnutls_global_set_log_function(debug_gnutls))

1840

1841

# Redirect stdin so all checkers get /dev/null

1842

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1843

os.dup2(null, sys.stdin.fileno())

1844

if null > 2:

1845

os.close(null)

1846

else:

1847

# No console logging

1848

logger.removeHandler(console)

1849

1850

1503

1851

1504

global main_loop

1852

1505

# From the Avahi example code

1855

1508

bus = dbus.SystemBus()

1856

1509

# End of Avahi example code

1857

1510

if use_dbus:

1858

try:

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1860

bus, do_not_queue=True)

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

1863

use_dbus = False

1864

server_settings[u"use_dbus"] = False

1865

tcp_server.use_dbus = False

1511

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1866

1512

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1867

1513

service = AvahiService(name = server_settings[u"servicename"],

1868

1514

servicetype = u"_mandos._tcp",

1870

1516

if server_settings["interface"]:

1871

1517

service.interface = (if_nametoindex

1872

1518

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1878

global multiprocessing_manager

1879

multiprocessing_manager = multiprocessing.Manager()

1880

1519

1881

1520

client_class = Client

1882

1521

if use_dbus:

1883

1522

client_class = functools.partial(ClientDBus, bus = bus)

1884

def client_config_items(config, section):

1885

special_settings = {

1886

"approved_by_default":

1887

lambda: config.getboolean(section,

1888

"approved_by_default"),

1889

}

1890

for name, value in config.items(section):

1891

try:

1892

yield (name, special_settings[name]())

1893

except KeyError:

1894

yield (name, value)

1895

1896

1523

tcp_server.clients.update(set(

1897

1524

client_class(name = section,

1898

config= dict(client_config_items(

1899

client_config, section)))

1525

config= dict(client_config.items(section)))

1900

1526

for section in client_config.sections()))

1901

1527

if not tcp_server.clients:

1902

1528

logger.warning(u"No clients defined")

1529

1530

if debug:

1531

# Redirect stdin so all checkers get /dev/null

1532

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1533

os.dup2(null, sys.stdin.fileno())

1534

if null > 2:

1535

os.close(null)

1536

else:

1537

# No console logging

1538

logger.removeHandler(console)

1539

# Close all input and output, do double fork, etc.

1540

daemon()

1541

1542

try:

1543

with closing(pidfile):

1544

pid = os.getpid()

1545

pidfile.write(str(pid) + "\n")

1546

del pidfile

1547

except IOError:

1548

logger.error(u"Could not write to file %r with PID %d",

1549

pidfilename, pid)

1550

except NameError:

1551

# "pidfile" was never created

1552

pass

1553

del pidfilename

1554

1555

def cleanup():

1556

"Cleanup function; run on exit"

1557

service.cleanup()

1903

1558

1559

while tcp_server.clients:

1560

client = tcp_server.clients.pop()

1561

client.disable_hook = None

1562

client.disable()

1563

1564

atexit.register(cleanup)

1565

1904

1566

if not debug:

1905

try:

1906

with pidfile:

1907

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

1909

del pidfile

1910

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

1912

pidfilename, pid)

1913

except NameError:

1914

# "pidfile" was never created

1915

pass

1916

del pidfilename

1917

1918

1567

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

1920

1568

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1921

1569

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1922

1570

1927

1575

dbus.service.Object.__init__(self, bus, u"/")

1928

1576

_interface = u"se.bsnet.fukt.Mandos"

1929

1577

1930

@dbus.service.signal(_interface, signature=u"o")

1931

def ClientAdded(self, objpath):

1578

@dbus.service.signal(_interface, signature=u"oa{sv}")

1579

def ClientAdded(self, objpath, properties):

1932

1580

"D-Bus signal"

1933

1581

pass

1934

1582

1935

@dbus.service.signal(_interface, signature=u"ss")

1936

def ClientNotFound(self, fingerprint, address):

1583

@dbus.service.signal(_interface, signature=u"s")

1584

def ClientNotFound(self, fingerprint):

1937

1585

"D-Bus signal"

1938

1586

pass

1939

1587

1965

1613

tcp_server.clients.remove(c)

1966

1614

c.remove_from_connection()

1967

1615

# Don't signal anything except ClientRemoved

1968

c.disable(quiet=True)

1616

c.disable(signal=False)

1969

1617

# Emit D-Bus signal

1970

1618

self.ClientRemoved(object_path, c.name)

1971

1619

return

1972

raise KeyError(object_path)

1620

raise KeyError

1973

1621

1974

1622

del _interface

1975

1623

1976

1624

mandos_dbus_service = MandosDBusService()

1977

1625

1978

def cleanup():

1979

"Cleanup function; run on exit"

1980

service.cleanup()

1981

1982

while tcp_server.clients:

1983

client = tcp_server.clients.pop()

1984

if use_dbus:

1985

client.remove_from_connection()

1986

client.disable_hook = None

1987

# Don't signal anything except ClientRemoved

1988

client.disable(quiet=True)

1989

if use_dbus:

1990

# Emit D-Bus signal

1991

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1992

client.name)

1993

1994

atexit.register(cleanup)

1995

1996

1626

for client in tcp_server.clients:

1997

1627

if use_dbus:

1998

1628

# Emit D-Bus signal

1999

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1629

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1630

client.GetAll(u""))

2000

1631

client.enable()

2001

1632

2002

1633

tcp_server.enable()

2020

1651

service.activate()

2021

1652

except dbus.exceptions.DBusException, error:

2022

1653

logger.critical(u"DBusException: %s", error)

2023

cleanup()

2024

1654

sys.exit(1)

2025

1655

# End of Avahi example code

2026

1656

2033

1663

main_loop.run()

2034

1664

except AvahiError, error:

2035

1665

logger.critical(u"AvahiError: %s", error)

2036

cleanup()

2037

1666

sys.exit(1)

2038

1667

except KeyboardInterrupt:

2039

1668

if debug:

2040

1669

print >> sys.stderr

2041

1670

logger.debug(u"Server received KeyboardInterrupt")

2042

1671

logger.debug(u"Server exiting")

2043

# Must run before the D-Bus bus name gets deregistered

2044

cleanup()

2045

1672

2046

1673

if __name__ == '__main__':

2047

1674

main()