/mandos/trunk : revision 24.1.149

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

81

SO_BINDTODEVICE = None

82

83

84

version = "1.2"

84

version = "1.0.14"

85

86

#logger = logging.getLogger(u'mandos')

87

86

logger = logging.Logger(u'mandos')

88

87

syslogger = (logging.handlers.SysLogHandler

89

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

99

98

u' %(message)s'))

100

99

logger.addHandler(console)

101

100

101

multiprocessing_manager = multiprocessing.Manager()

102

103

class AvahiError(Exception):

103

104

def __init__(self, value, *args, **kwargs):

104

105

self.value = value

157

158

u" after %i retries, exiting.",

158

159

self.rename_count)

159

160

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

self.name = self.server.GetAlternativeServiceName(self.name)

161

162

logger.info(u"Changing Zeroconf service name to %r ...",

162

self.name)

163

unicode(self.name))

163

164

syslogger.setFormatter(logging.Formatter

164

165

(u'Mandos (%s) [%%(process)d]:'

165

166

u' %%(levelname)s: %%(message)s'

166

167

% self.name))

167

168

self.remove()

168

try:

169

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

172

self.cleanup()

173

os._exit(1)

169

self.add()

174

170

self.rename_count += 1

175

171

def remove(self):

176

172

"""Derived from the Avahi example code"""

199

195

self.group.Commit()

200

196

def entry_group_state_changed(self, state, error):

201

197

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

198

logger.debug(u"Avahi state change: %i", state)

203

199

204

200

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

201

logger.debug(u"Zeroconf service established.")

218

214

self.group = None

219

215

def server_state_changed(self, state):

220

216

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

217

if state == avahi.SERVER_COLLISION:

223

218

logger.error(u"Zeroconf server name collision")

224

219

self.remove()

236

231

self.server_state_changed(self.server.GetState())

237

232

238

233

234

# XXX Need to add:

235

# approved_by_default (Config option for each client)

236

# approved_delay (config option for each client)

237

# approved_duration (config option for each client)

239

238

class Client(object):

240

239

"""A representation of a client host served by this server.

241

240

242

241

Attributes:

243

_approved: bool(); 'None' if not yet approved/disapproved

244

approval_delay: datetime.timedelta(); Time to wait for approval

245

approval_duration: datetime.timedelta(); Duration of one approval

242

name: string; from the config file, used in log messages and

243

D-Bus identifiers

244

fingerprint: string (40 or 32 hexadecimal digits); used to

245

uniquely identify the client

246

secret: bytestring; sent verbatim (over TLS) to client

247

host: string; available for use by the checker command

248

created: datetime.datetime(); (UTC) object creation

249

last_enabled: datetime.datetime(); (UTC)

250

enabled: bool()

251

last_checked_ok: datetime.datetime(); (UTC) or None

252

timeout: datetime.timedelta(); How long from last_checked_ok

253

until this client is disabled

254

interval: datetime.timedelta(); How often to start a new checker

255

disable_hook: If set, called by disable() as disable_hook(self)

246

256

checker: subprocess.Popen(); a running checker process used

247

257

to see if the client lives.

248

258

'None' if no process is running.

249

checker_callback_tag: a gobject event source tag, or None

250

checker_command: string; External command which is run to check

251

if client lives. %() expansions are done at

259

checker_initiator_tag: a gobject event source tag, or None

260

disable_initiator_tag: - '' -

261

checker_callback_tag: - '' -

262

checker_command: string; External command which is run to check if

263

client lives. %() expansions are done at

252

264

runtime with vars(self) as dict, so that for

253

265

instance %(name)s can be used in the command.

254

checker_initiator_tag: a gobject event source tag, or None

255

created: datetime.datetime(); (UTC) object creation

256

266

current_checker_command: string; current running checker_command

257

disable_hook: If set, called by disable() as disable_hook(self)

258

disable_initiator_tag: a gobject event source tag, or None

259

enabled: bool()

260

fingerprint: string (40 or 32 hexadecimal digits); used to

261

uniquely identify the client

262

host: string; available for use by the checker command

263

interval: datetime.timedelta(); How often to start a new checker

264

last_approval_request: datetime.datetime(); (UTC) or None

265

last_checked_ok: datetime.datetime(); (UTC) or None

266

last_enabled: datetime.datetime(); (UTC)

267

name: string; from the config file, used in log messages and

268

D-Bus identifiers

269

secret: bytestring; sent verbatim (over TLS) to client

270

timeout: datetime.timedelta(); How long from last_checked_ok

271

until this client is disabled

272

runtime_expansions: Allowed attributes for runtime expansion.

267

approved_delay: datetime.timedelta(); Time to wait for approval

268

_approved: bool(); 'None' if not yet approved/disapproved

269

approved_duration: datetime.timedelta(); Duration of one approval

273

270

"""

274

271

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

272

@staticmethod

281

273

def _timedelta_to_milliseconds(td):

282

274

"Convert a datetime.timedelta() to milliseconds"

292

284

"Return the 'interval' attribute in milliseconds"

293

285

return self._timedelta_to_milliseconds(self.interval)

294

286

295

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

287

def approved_delay_milliseconds(self):

288

return self._timedelta_to_milliseconds(self.approved_delay)

297

289

298

290

def __init__(self, name = None, disable_hook=None, config=None):

299

291

"""Note: the 'checker' key in 'config' sets the

317

309

"rb") as secfile:

318

310

self.secret = secfile.read()

319

311

else:

312

#XXX Need to allow secret on demand!

320

313

raise TypeError(u"No secret or secfile for client %s"

321

314

% self.name)

322

315

self.host = config.get(u"host", u"")

323

316

self.created = datetime.datetime.utcnow()

324

317

self.enabled = False

325

self.last_approval_request = None

326

318

self.last_enabled = None

327

319

self.last_checked_ok = None

328

320

self.timeout = string_to_delta(config[u"timeout"])

337

329

self.last_connect = None

338

330

self._approved = None

339

331

self.approved_by_default = config.get(u"approved_by_default",

340

True)

341

self.approvals_pending = 0

342

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

344

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

332

False)

333

self.approved_delay = string_to_delta(

334

config[u"approved_delay"])

335

self.approved_duration = string_to_delta(

336

config[u"approved_duration"])

346

337

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

347

338

348

339

def send_changedstate(self):

349

340

self.changedstate.acquire()

350

341

self.changedstate.notify_all()

424

415

(self.timeout_milliseconds(),

425

416

self.disable))

426

417

427

def need_approval(self):

428

self.last_approval_request = datetime.datetime.utcnow()

429

430

418

def start_checker(self):

431

419

"""Start a new checker subprocess if one is not running.

432

420

461

449

command = self.checker_command % self.host

462

450

except TypeError:

463

451

# Escape attributes for the shell

464

escaped_attrs = dict(

465

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

467

errors=

468

u'replace')))

469

for attr in

470

self.runtime_expansions)

471

452

escaped_attrs = dict((key,

453

re.escape(unicode(str(val),

454

errors=

455

u'replace')))

456

for key, val in

457

vars(self).iteritems())

472

458

try:

473

459

command = self.checker_command % escaped_attrs

474

460

except TypeError, error:

716

702

dbus_object_path: dbus.ObjectPath

717

703

bus: dbus.SystemBus()

718

704

"""

719

720

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

722

723

705

# dbus.service.Object doesn't use super(), so we can't either.

724

706

725

707

def __init__(self, bus = None, *args, **kwargs):

726

self._approvals_pending = 0

727

708

self.bus = bus

728

709

Client.__init__(self, *args, **kwargs)

729

710

# Only now, when this client is initialized, can it show up on

730

711

# the D-Bus

731

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

734

712

self.dbus_object_path = (dbus.ObjectPath

735

(u"/clients/" + client_object_name))

713

(u"/clients/"

714

+ self.name.replace(u".", u"_")))

736

715

DBusObjectWithProperties.__init__(self, self.bus,

737

716

self.dbus_object_path)

738

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

750

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

717

755

718

@staticmethod

756

719

def _datetime_to_dbus(dt, variant_level=0):

763

726

r = Client.enable(self)

764

727

if oldstate != self.enabled:

765

728

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

729

self.PropertyChanged(dbus.String(u"enabled"),

767

730

dbus.Boolean(True, variant_level=1))

768

731

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

732

dbus.String(u"last_enabled"),

770

733

self._datetime_to_dbus(self.last_enabled,

771

734

variant_level=1))

772

735

return r

776

739

r = Client.disable(self, quiet=quiet)

777

740

if not quiet and oldstate != self.enabled:

778

741

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

742

self.PropertyChanged(dbus.String(u"enabled"),

780

743

dbus.Boolean(False, variant_level=1))

781

744

return r

782

745

794

757

self.checker_callback_tag = None

795

758

self.checker = None

796

759

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

760

self.PropertyChanged(dbus.String(u"checker_running"),

798

761

dbus.Boolean(False, variant_level=1))

799

762

if os.WIFEXITED(condition):

800

763

exitstatus = os.WEXITSTATUS(condition)

815

778

r = Client.checked_ok(self, *args, **kwargs)

816

779

# Emit D-Bus signal

817

780

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

781

dbus.String(u"last_checked_ok"),

819

782

(self._datetime_to_dbus(self.last_checked_ok,

820

783

variant_level=1)))

821

784

return r

822

785

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

832

786

def start_checker(self, *args, **kwargs):

833

787

old_checker = self.checker

834

788

if self.checker is not None:

842

796

# Emit D-Bus signal

843

797

self.CheckerStarted(self.current_checker_command)

844

798

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

799

dbus.String(u"checker_running"),

846

800

dbus.Boolean(True, variant_level=1))

847

801

return r

848

802

851

805

r = Client.stop_checker(self, *args, **kwargs)

852

806

if (old_checker is not None

853

807

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

808

self.PropertyChanged(dbus.String(u"checker_running"),

855

809

dbus.Boolean(False, variant_level=1))

856

810

return r

857

811

860

814

return False

861

815

862

816

def approve(self, value=True):

863

self.send_changedstate()

864

817

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

866

(self.approval_duration),

867

self._reset_approved)

868

818

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

869

819

870

820

## D-Bus methods, signals & properties

871

821

_interface = u"se.bsnet.fukt.Mandos.Client"

893

843

# GotSecret - signal

894

844

@dbus.service.signal(_interface)

895

845

def GotSecret(self):

896

"""D-Bus signal

897

Is sent after a successful transfer of secret from the Mandos

898

server to mandos-client

899

"""

846

"D-Bus signal"

900

847

pass

901

848

902

849

# Rejected - signal

906

853

pass

907

854

908

855

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

856

@dbus.service.signal(_interface, signature=u"db")

910

857

def NeedApproval(self, timeout, default):

911

858

"D-Bus signal"

912

return self.need_approval()

859

pass

913

860

914

861

## Methods

915

862

916

863

# Approve - method

917

864

@dbus.service.method(_interface, in_signature=u"b")

918

865

def Approve(self, value):

919

866

self.approve(value)

920

867

921

868

# CheckedOK - method

922

869

@dbus.service.method(_interface)

923

870

def CheckedOK(self):

948

895

949

896

## Properties

950

897

951

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

953

def ApprovalPending_dbus_property(self):

954

return dbus.Boolean(bool(self.approvals_pending))

955

956

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

959

def ApprovedByDefault_dbus_property(self, value=None):

960

if value is None: # get

961

return dbus.Boolean(self.approved_by_default)

962

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

967

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

970

def ApprovalDelay_dbus_property(self, value=None):

971

if value is None: # get

972

return dbus.UInt64(self.approval_delay_milliseconds())

973

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

978

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

981

def ApprovalDuration_dbus_property(self, value=None):

982

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

984

self.approval_duration))

985

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

990

# Name - property

898

# xxx 3 new properties

899

900

# name - property

991

901

@dbus_service_property(_interface, signature=u"s", access=u"read")

992

def Name_dbus_property(self):

902

def name_dbus_property(self):

993

903

return dbus.String(self.name)

994

904

995

# Fingerprint - property

905

# fingerprint - property

996

906

@dbus_service_property(_interface, signature=u"s", access=u"read")

997

def Fingerprint_dbus_property(self):

907

def fingerprint_dbus_property(self):

998

908

return dbus.String(self.fingerprint)

999

909

1000

# Host - property

910

# host - property

1001

911

@dbus_service_property(_interface, signature=u"s",

1002

912

access=u"readwrite")

1003

def Host_dbus_property(self, value=None):

913

def host_dbus_property(self, value=None):

1004

914

if value is None: # get

1005

915

return dbus.String(self.host)

1006

916

self.host = value

1007

917

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

918

self.PropertyChanged(dbus.String(u"host"),

1009

919

dbus.String(value, variant_level=1))

1010

920

1011

# Created - property

921

# created - property

1012

922

@dbus_service_property(_interface, signature=u"s", access=u"read")

1013

def Created_dbus_property(self):

923

def created_dbus_property(self):

1014

924

return dbus.String(self._datetime_to_dbus(self.created))

1015

925

1016

# LastEnabled - property

926

# last_enabled - property

1017

927

@dbus_service_property(_interface, signature=u"s", access=u"read")

1018

def LastEnabled_dbus_property(self):

928

def last_enabled_dbus_property(self):

1019

929

if self.last_enabled is None:

1020

930

return dbus.String(u"")

1021

931

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1022

932

1023

# Enabled - property

933

# enabled - property

1024

934

@dbus_service_property(_interface, signature=u"b",

1025

935

access=u"readwrite")

1026

def Enabled_dbus_property(self, value=None):

936

def enabled_dbus_property(self, value=None):

1027

937

if value is None: # get

1028

938

return dbus.Boolean(self.enabled)

1029

939

if value:

1031

941

else:

1032

942

self.disable()

1033

943

1034

# LastCheckedOK - property

944

# last_checked_ok - property

1035

945

@dbus_service_property(_interface, signature=u"s",

1036

946

access=u"readwrite")

1037

def LastCheckedOK_dbus_property(self, value=None):

947

def last_checked_ok_dbus_property(self, value=None):

1038

948

if value is not None:

1039

949

self.checked_ok()

1040

950

return

1043

953

return dbus.String(self._datetime_to_dbus(self

1044

954

.last_checked_ok))

1045

955

1046

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1048

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1054

1055

# Timeout - property

956

# timeout - property

1056

957

@dbus_service_property(_interface, signature=u"t",

1057

958

access=u"readwrite")

1058

def Timeout_dbus_property(self, value=None):

959

def timeout_dbus_property(self, value=None):

1059

960

if value is None: # get

1060

961

return dbus.UInt64(self.timeout_milliseconds())

1061

962

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

963

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

964

self.PropertyChanged(dbus.String(u"timeout"),

1064

965

dbus.UInt64(value, variant_level=1))

1065

966

if getattr(self, u"disable_initiator_tag", None) is None:

1066

967

return

1080

981

self.disable_initiator_tag = (gobject.timeout_add

1081

982

(time_to_die, self.disable))

1082

983

1083

# Interval - property

984

# interval - property

1084

985

@dbus_service_property(_interface, signature=u"t",

1085

986

access=u"readwrite")

1086

def Interval_dbus_property(self, value=None):

987

def interval_dbus_property(self, value=None):

1087

988

if value is None: # get

1088

989

return dbus.UInt64(self.interval_milliseconds())

1089

990

self.interval = datetime.timedelta(0, 0, 0, value)

1090

991

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

992

self.PropertyChanged(dbus.String(u"interval"),

1092

993

dbus.UInt64(value, variant_level=1))

1093

994

if getattr(self, u"checker_initiator_tag", None) is None:

1094

995

return

1098

999

(value, self.start_checker))

1099

1000

self.start_checker() # Start one now, too

1100

1001

1101

# Checker - property

1002

# checker - property

1102

1003

@dbus_service_property(_interface, signature=u"s",

1103

1004

access=u"readwrite")

1104

def Checker_dbus_property(self, value=None):

1005

def checker_dbus_property(self, value=None):

1105

1006

if value is None: # get

1106

1007

return dbus.String(self.checker_command)

1107

1008

self.checker_command = value

1108

1009

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1010

self.PropertyChanged(dbus.String(u"checker"),

1110

1011

dbus.String(self.checker_command,

1111

1012

variant_level=1))

1112

1013

1113

# CheckerRunning - property

1014

# checker_running - property

1114

1015

@dbus_service_property(_interface, signature=u"b",

1115

1016

access=u"readwrite")

1116

def CheckerRunning_dbus_property(self, value=None):

1017

def checker_running_dbus_property(self, value=None):

1117

1018

if value is None: # get

1118

1019

return dbus.Boolean(self.checker is not None)

1119

1020

if value:

1121

1022

else:

1122

1023

self.stop_checker()

1123

1024

1124

# ObjectPath - property

1025

# object_path - property

1125

1026

@dbus_service_property(_interface, signature=u"o", access=u"read")

1126

def ObjectPath_dbus_property(self):

1027

def object_path_dbus_property(self):

1127

1028

return self.dbus_object_path # is already a dbus.ObjectPath

1128

1029

1129

# Secret = property

1030

# secret = property

1130

1031

@dbus_service_property(_interface, signature=u"ay",

1131

1032

access=u"write", byte_arrays=True)

1132

def Secret_dbus_property(self, value):

1033

def secret_dbus_property(self, value):

1133

1034

self.secret = str(value)

1134

1035

1135

1036

del _interface

1216

1117

# established. Just abandon the request.

1217

1118

return

1218

1119

logger.debug(u"Handshake succeeded")

1219

1220

approval_required = False

1221

1120

try:

1222

1121

try:

1223

1122

fpr = self.fingerprint(self.peer_certificate

1233

1132

except KeyError:

1234

1133

return

1235

1134

1236

if client.approval_delay:

1237

delay = client.approval_delay

1238

client.approvals_pending += 1

1239

approval_required = True

1240

1135

delay = client.approved_delay

1241

1136

while True:

1242

1137

if not client.enabled:

1243

1138

logger.warning(u"Client %s is disabled",

1246

1141

# Emit D-Bus signal

1247

1142

client.Rejected("Disabled")

1248

1143

return

1249

1250

if client._approved or not client.approval_delay:

1251

#We are approved or approval is disabled

1252

break

1253

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1144

if client._approved is None:

1145

logger.info(u"Client %s need approval",

1255

1146

client.name)

1256

1147

if self.server.use_dbus:

1257

1148

# Emit D-Bus signal

1258

1149

client.NeedApproval(

1259

client.approval_delay_milliseconds(),

1150

client.approved_delay_milliseconds(),

1260

1151

client.approved_by_default)

1152

elif client._approved:

1153

#We have a password and are approved

1154

break

1261

1155

else:

1262

1156

logger.warning(u"Client %s was not approved",

1263

1157

client.name)

1264

1158

if self.server.use_dbus:

1265

# Emit D-Bus signal

1266

client.Rejected("Denied")

1159

# Emit D-Bus signal

1160

client.Rejected("Disapproved")

1267

1161

return

1268

1162

1269

1163

#wait until timeout or approved

1280

1174

client.name)

1281

1175

if self.server.use_dbus:

1282

1176

# Emit D-Bus signal

1283

client.Rejected("Approval timed out")

1177

client.Rejected("Time out")

1284

1178

return

1285

1179

else:

1286

1180

break

1289

1183

1290

1184

sent_size = 0

1291

1185

while sent_size < len(client.secret):

1292

try:

1293

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1295

logger.warning("gnutls send failed")

1296

return

1186

# XXX handle session exception

1187

sent = session.send(client.secret[sent_size:])

1297

1188

logger.debug(u"Sent: %d, remaining: %d",

1298

1189

sent, len(client.secret)

1299

1190

- (sent_size + sent))

1305

1196

if self.server.use_dbus:

1306

1197

# Emit D-Bus signal

1307

1198

client.GotSecret()

1308

1199

1309

1200

finally:

1310

if approval_required:

1311

client.approvals_pending -= 1

1312

try:

1313

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1315

logger.warning("GnuTLS bye failed")

1201

session.bye()

1316

1202

1317

1203

@staticmethod

1318

1204

def peer_certificate(session):

1403

1289

1404

1290

super(MultiprocessingMixInWithPipe,

1405

1291

self).process_request(request, client_address)

1406

self.child_pipe.close()

1407

1292

self.add_pipe(parent_pipe)

1408

1409

1293

def add_pipe(self, parent_pipe):

1410

1294

"""Dummy function; override as necessary"""

1411

1295

pass

1524

1408

for cond, name in

1525

1409

condition_names.iteritems()

1526

1410

if cond & condition)

1527

# error or the other end of multiprocessing.Pipe has closed

1528

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1529

return False

1411

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1412

conditions_string)

1530

1413

1531

1414

# Read a request from the child

1532

1415

request = parent_pipe.recv()

1545

1428

u"dress: %s", fpr, address)

1546

1429

if self.use_dbus:

1547

1430

# Emit D-Bus signal

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1431

mandos_dbus_service.ClientNotFound(fpr, address)

1549

1432

parent_pipe.send(False)

1550

1433

return False

1551

1434

1570

1453

parent_pipe.send(('function',))

1571

1454

else:

1572

1455

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1573

1456

1574

1457

if command == 'setattr':

1575

1458

attrname = request[1]

1576

1459

value = request[2]

1577

1460

setattr(client_object, attrname, value)

1578

1461

1579

1462

return True

1580

1463

1581

1464

1684

1567

parser.add_option("--debug", action=u"store_true",

1685

1568

help=u"Debug mode; run in foreground and log to"

1686

1569

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1689

1570

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

1571

u" priority string (see GnuTLS documentation)")

1691

1572

parser.add_option("--servicename", type=u"string",

1716

1597

u"servicename": u"Mandos",

1717

1598

u"use_dbus": u"True",

1718

1599

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1720

1600

}

1721

1601

1722

1602

# Parse config file for server-global settings

1739

1619

# options, if set.

1740

1620

for option in (u"interface", u"address", u"port", u"debug",

1741

1621

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1622

u"use_dbus", u"use_ipv6"):

1743

1623

value = getattr(options, option)

1744

1624

if value is not None:

1745

1625

server_settings[option] = value

1754

1634

1755

1635

# For convenience

1756

1636

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

1637

use_dbus = server_settings[u"use_dbus"]

1759

1638

use_ipv6 = server_settings[u"use_ipv6"]

1760

1639

1640

if not debug:

1641

syslogger.setLevel(logging.WARNING)

1642

console.setLevel(logging.WARNING)

1643

1761

1644

if server_settings[u"servicename"] != u"Mandos":

1762

1645

syslogger.setFormatter(logging.Formatter

1763

1646

(u'Mandos (%s) [%%(process)d]:'

1769

1652

u"interval": u"5m",

1770

1653

u"checker": u"fping -q -- %%(host)s",

1771

1654

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1655

u"approved_delay": u"5m",

1656

u"approved_duration": u"1s",

1774

1657

}

1775

1658

client_config = configparser.SafeConfigParser(client_defaults)

1776

1659

client_config.read(os.path.join(server_settings[u"configdir"],

1782

1665

tcp_server = MandosServer((server_settings[u"address"],

1783

1666

server_settings[u"port"]),

1784

1667

ClientHandler,

1785

interface=(server_settings[u"interface"]

1786

or None),

1668

interface=server_settings[u"interface"],

1787

1669

use_ipv6=use_ipv6,

1788

1670

gnutls_priority=

1789

1671

server_settings[u"priority"],

1790

1672

use_dbus=use_dbus)

1791

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1793

try:

1794

pidfile = open(pidfilename, u"w")

1795

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1673

pidfilename = u"/var/run/mandos.pid"

1674

try:

1675

pidfile = open(pidfilename, u"w")

1676

except IOError:

1677

logger.error(u"Could not open file %r", pidfilename)

1797

1678

1798

1679

try:

1799

1680

uid = pwd.getpwnam(u"_mandos").pw_uid

1816

1697

if error[0] != errno.EPERM:

1817

1698

raise error

1818

1699

1819

if not debug and not debuglevel:

1820

syslogger.setLevel(logging.WARNING)

1821

console.setLevel(logging.WARNING)

1822

if debuglevel:

1823

level = getattr(logging, debuglevel.upper())

1824

syslogger.setLevel(level)

1825

console.setLevel(level)

1826

1700

# Enable all possible GnuTLS debugging

1827

1701

if debug:

1828

# Enable all possible GnuTLS debugging

1829

1830

1702

# "Use a log level over 10 to enable all debugging options."

1831

1703

# - GnuTLS manual

1832

1704

gnutls.library.functions.gnutls_global_set_log_level(11)

1837

1709

1838

1710

(gnutls.library.functions

1839

1711

.gnutls_global_set_log_function(debug_gnutls))

1840

1841

# Redirect stdin so all checkers get /dev/null

1842

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1843

os.dup2(null, sys.stdin.fileno())

1844

if null > 2:

1845

os.close(null)

1846

else:

1847

# No console logging

1848

logger.removeHandler(console)

1849

1850

1712

1851

1713

global main_loop

1852

1714

# From the Avahi example code

1870

1732

if server_settings["interface"]:

1871

1733

service.interface = (if_nametoindex

1872

1734

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1878

global multiprocessing_manager

1879

multiprocessing_manager = multiprocessing.Manager()

1880

1735

1881

1736

client_class = Client

1882

1737

if use_dbus:

1883

1738

client_class = functools.partial(ClientDBus, bus = bus)

1884

1739

def client_config_items(config, section):

1885

1740

special_settings = {

1886

"approved_by_default":

1741

"approve_by_default":

1887

1742

lambda: config.getboolean(section,

1888

"approved_by_default"),

1743

"approve_by_default"),

1889

1744

}

1890

1745

for name, value in config.items(section):

1891

1746

try:

1892

yield (name, special_settings[name]())

1747

yield special_settings[name]()

1893

1748

except KeyError:

1894

1749

yield (name, value)

1895

1750

1900

1755

for section in client_config.sections()))

1901

1756

if not tcp_server.clients:

1902

1757

logger.warning(u"No clients defined")

1903

1758

1759

if debug:

1760

# Redirect stdin so all checkers get /dev/null

1761

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1762

os.dup2(null, sys.stdin.fileno())

1763

if null > 2:

1764

os.close(null)

1765

else:

1766

# No console logging

1767

logger.removeHandler(console)

1768

# Close all input and output, do double fork, etc.

1769

daemon()

1770

1771

try:

1772

with pidfile:

1773

pid = os.getpid()

1774

pidfile.write(str(pid) + "\n")

1775

del pidfile

1776

except IOError:

1777

logger.error(u"Could not write to file %r with PID %d",

1778

pidfilename, pid)

1779

except NameError:

1780

# "pidfile" was never created

1781

pass

1782

del pidfilename

1783

1904

1784

if not debug:

1905

try:

1906

with pidfile:

1907

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

1909

del pidfile

1910

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

1912

pidfilename, pid)

1913

except NameError:

1914

# "pidfile" was never created

1915

pass

1916

del pidfilename

1917

1918

1785

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

1920

1786

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1921

1787

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1922

1788