/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

Added configuration files support for mandos-client
Removed plus argument support for mandos-client

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
# 
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
#     GNU General Public License for more details.
26
25
# 
27
26
# You should have received a copy of the GNU General Public License
28
 
# along with this program.  If not, see
29
 
# <http://www.gnu.org/licenses/>.
 
27
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
30
28
# 
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
# 
33
31
 
34
 
from __future__ import division, with_statement, absolute_import
 
32
from __future__ import division
35
33
 
36
34
import SocketServer
37
35
import socket
38
 
import optparse
 
36
import select
 
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
 
import pwd
59
 
from contextlib import closing
60
57
 
61
58
import dbus
62
 
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
 
import ctypes.util
68
63
 
69
 
version = "1.0.8"
 
64
version = "1.0"
70
65
 
71
66
logger = logging.Logger('mandos')
72
 
syslogger = (logging.handlers.SysLogHandler
73
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
 
              address = "/dev/log"))
75
 
syslogger.setFormatter(logging.Formatter
76
 
                       ('Mandos [%(process)d]: %(levelname)s:'
77
 
                        ' %(message)s'))
 
67
syslogger = logging.handlers.SysLogHandler\
 
68
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
69
             address = "/dev/log")
 
70
syslogger.setFormatter(logging.Formatter\
 
71
                        ('Mandos: %(levelname)s: %(message)s'))
78
72
logger.addHandler(syslogger)
79
73
 
80
74
console = logging.StreamHandler()
81
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
 
                                       ' %(levelname)s: %(message)s'))
 
75
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
 
76
                                       ' %(message)s'))
83
77
logger.addHandler(console)
84
78
 
85
79
class AvahiError(Exception):
86
 
    def __init__(self, value, *args, **kwargs):
 
80
    def __init__(self, value):
87
81
        self.value = value
88
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
89
 
    def __unicode__(self):
90
 
        return unicode(repr(self.value))
 
82
    def __str__(self):
 
83
        return repr(self.value)
91
84
 
92
85
class AvahiServiceError(AvahiError):
93
86
    pass
113
106
                  a sensible number of times
114
107
    """
115
108
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
 
                 servicetype = None, port = None, TXT = None,
117
 
                 domain = "", host = "", max_renames = 32768,
118
 
                 protocol = avahi.PROTO_UNSPEC):
 
109
                 type = None, port = None, TXT = None, domain = "",
 
110
                 host = "", max_renames = 32768):
119
111
        self.interface = interface
120
112
        self.name = name
121
 
        self.type = servicetype
 
113
        self.type = type
122
114
        self.port = port
123
 
        self.TXT = TXT if TXT is not None else []
 
115
        if TXT is None:
 
116
            self.TXT = []
 
117
        else:
 
118
            self.TXT = TXT
124
119
        self.domain = domain
125
120
        self.host = host
126
121
        self.rename_count = 0
127
 
        self.max_renames = max_renames
128
 
        self.protocol = protocol
129
122
    def rename(self):
130
123
        """Derived from the Avahi example code"""
131
124
        if self.rename_count >= self.max_renames:
132
 
            logger.critical(u"No suitable Zeroconf service name found"
133
 
                            u" after %i retries, exiting.",
134
 
                            self.rename_count)
135
 
            raise AvahiServiceError(u"Too many renames")
136
 
        self.name = server.GetAlternativeServiceName(self.name)
137
 
        logger.info(u"Changing Zeroconf service name to %r ...",
138
 
                    str(self.name))
139
 
        syslogger.setFormatter(logging.Formatter
140
 
                               ('Mandos (%s) [%%(process)d]:'
141
 
                                ' %%(levelname)s: %%(message)s'
142
 
                                % self.name))
 
125
            logger.critical(u"No suitable service name found after %i"
 
126
                            u" retries, exiting.", rename_count)
 
127
            raise AvahiServiceError("Too many renames")
 
128
        name = server.GetAlternativeServiceName(name)
 
129
        logger.error(u"Changing name to %r ...", name)
 
130
        syslogger.setFormatter(logging.Formatter\
 
131
                               ('Mandos (%s): %%(levelname)s:'
 
132
                               ' %%(message)s' % name))
143
133
        self.remove()
144
134
        self.add()
145
135
        self.rename_count += 1
151
141
        """Derived from the Avahi example code"""
152
142
        global group
153
143
        if group is None:
154
 
            group = dbus.Interface(bus.get_object
155
 
                                   (avahi.DBUS_NAME,
 
144
            group = dbus.Interface\
 
145
                    (bus.get_object(avahi.DBUS_NAME,
156
146
                                    server.EntryGroupNew()),
157
 
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
147
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
158
148
            group.connect_to_signal('StateChanged',
159
149
                                    entry_group_state_changed)
160
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
150
        logger.debug(u"Adding service '%s' of type '%s' ...",
161
151
                     service.name, service.type)
162
152
        group.AddService(
163
153
                self.interface,         # interface
164
 
                self.protocol,          # protocol
 
154
                avahi.PROTO_INET6,      # protocol
165
155
                dbus.UInt32(0),         # flags
166
156
                self.name, self.type,
167
157
                self.domain, self.host,
174
164
# End of Avahi example code
175
165
 
176
166
 
177
 
def _datetime_to_dbus(dt, variant_level=0):
178
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
179
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
180
 
 
181
 
 
182
167
class Client(object):
183
168
    """A representation of a client host served by this server.
184
169
    Attributes:
185
 
    name:       string; from the config file, used in log messages and
186
 
                        D-Bus identifiers
 
170
    name:      string; from the config file, used in log messages
187
171
    fingerprint: string (40 or 32 hexadecimal digits); used to
188
172
                 uniquely identify the client
189
 
    secret:     bytestring; sent verbatim (over TLS) to client
190
 
    host:       string; available for use by the checker command
191
 
    created:    datetime.datetime(); (UTC) object creation
192
 
    last_enabled: datetime.datetime(); (UTC)
193
 
    enabled:    bool()
194
 
    last_checked_ok: datetime.datetime(); (UTC) or None
195
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
196
 
                                      until this client is invalid
197
 
    interval:   datetime.timedelta(); How often to start a new checker
198
 
    disable_hook:  If set, called by disable() as disable_hook(self)
199
 
    checker:    subprocess.Popen(); a running checker process used
200
 
                                    to see if the client lives.
201
 
                                    'None' if no process is running.
 
173
    secret:    bytestring; sent verbatim (over TLS) to client
 
174
    host:      string; available for use by the checker command
 
175
    created:   datetime.datetime(); object creation, not client host
 
176
    last_checked_ok: datetime.datetime() or None if not yet checked OK
 
177
    timeout:   datetime.timedelta(); How long from last_checked_ok
 
178
                                     until this client is invalid
 
179
    interval:  datetime.timedelta(); How often to start a new checker
 
180
    stop_hook: If set, called by stop() as stop_hook(self)
 
181
    checker:   subprocess.Popen(); a running checker process used
 
182
                                   to see if the client lives.
 
183
                                   'None' if no process is running.
202
184
    checker_initiator_tag: a gobject event source tag, or None
203
 
    disable_initiator_tag:    - '' -
 
185
    stop_initiator_tag:    - '' -
204
186
    checker_callback_tag:  - '' -
205
187
    checker_command: string; External command which is run to check if
206
188
                     client lives.  %() expansions are done at
207
189
                     runtime with vars(self) as dict, so that for
208
190
                     instance %(name)s can be used in the command.
209
 
    current_checker_command: string; current running checker_command
 
191
    Private attibutes:
 
192
    _timeout: Real variable for 'timeout'
 
193
    _interval: Real variable for 'interval'
 
194
    _timeout_milliseconds: Used when calling gobject.timeout_add()
 
195
    _interval_milliseconds: - '' -
210
196
    """
211
 
    def timeout_milliseconds(self):
212
 
        "Return the 'timeout' attribute in milliseconds"
213
 
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
214
 
                + (self.timeout.seconds * 1000)
215
 
                + (self.timeout.microseconds // 1000))
216
 
    
217
 
    def interval_milliseconds(self):
218
 
        "Return the 'interval' attribute in milliseconds"
219
 
        return ((self.interval.days * 24 * 60 * 60 * 1000)
220
 
                + (self.interval.seconds * 1000)
221
 
                + (self.interval.microseconds // 1000))
222
 
    
223
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
197
    def _set_timeout(self, timeout):
 
198
        "Setter function for 'timeout' attribute"
 
199
        self._timeout = timeout
 
200
        self._timeout_milliseconds = ((self.timeout.days
 
201
                                       * 24 * 60 * 60 * 1000)
 
202
                                      + (self.timeout.seconds * 1000)
 
203
                                      + (self.timeout.microseconds
 
204
                                         // 1000))
 
205
    timeout = property(lambda self: self._timeout,
 
206
                       _set_timeout)
 
207
    del _set_timeout
 
208
    def _set_interval(self, interval):
 
209
        "Setter function for 'interval' attribute"
 
210
        self._interval = interval
 
211
        self._interval_milliseconds = ((self.interval.days
 
212
                                        * 24 * 60 * 60 * 1000)
 
213
                                       + (self.interval.seconds
 
214
                                          * 1000)
 
215
                                       + (self.interval.microseconds
 
216
                                          // 1000))
 
217
    interval = property(lambda self: self._interval,
 
218
                        _set_interval)
 
219
    del _set_interval
 
220
    def __init__(self, name = None, stop_hook=None, config={}):
224
221
        """Note: the 'checker' key in 'config' sets the
225
222
        'checker_command' attribute and *not* the 'checker'
226
223
        attribute."""
227
224
        self.name = name
228
 
        if config is None:
229
 
            config = {}
230
225
        logger.debug(u"Creating client %r", self.name)
231
226
        # Uppercase and remove spaces from fingerprint for later
232
227
        # comparison purposes with return value from the fingerprint()
233
228
        # function
234
 
        self.fingerprint = (config["fingerprint"].upper()
235
 
                            .replace(u" ", u""))
 
229
        self.fingerprint = config["fingerprint"].upper()\
 
230
                           .replace(u" ", u"")
236
231
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
237
232
        if "secret" in config:
238
233
            self.secret = config["secret"].decode(u"base64")
239
234
        elif "secfile" in config:
240
 
            with closing(open(os.path.expanduser
241
 
                              (os.path.expandvars
242
 
                               (config["secfile"])))) as secfile:
243
 
                self.secret = secfile.read()
 
235
            sf = open(config["secfile"])
 
236
            self.secret = sf.read()
 
237
            sf.close()
244
238
        else:
245
239
            raise TypeError(u"No secret or secfile for client %s"
246
240
                            % self.name)
247
241
        self.host = config.get("host", "")
248
 
        self.created = datetime.datetime.utcnow()
249
 
        self.enabled = False
250
 
        self.last_enabled = None
 
242
        self.created = datetime.datetime.now()
251
243
        self.last_checked_ok = None
252
244
        self.timeout = string_to_delta(config["timeout"])
253
245
        self.interval = string_to_delta(config["interval"])
254
 
        self.disable_hook = disable_hook
 
246
        self.stop_hook = stop_hook
255
247
        self.checker = None
256
248
        self.checker_initiator_tag = None
257
 
        self.disable_initiator_tag = None
 
249
        self.stop_initiator_tag = None
258
250
        self.checker_callback_tag = None
259
 
        self.checker_command = config["checker"]
260
 
        self.current_checker_command = None
261
 
        self.last_connect = None
262
 
    
263
 
    def enable(self):
 
251
        self.check_command = config["checker"]
 
252
    def start(self):
264
253
        """Start this client's checker and timeout hooks"""
265
 
        self.last_enabled = datetime.datetime.utcnow()
266
254
        # Schedule a new checker to be started an 'interval' from now,
267
255
        # and every interval from then on.
268
 
        self.checker_initiator_tag = (gobject.timeout_add
269
 
                                      (self.interval_milliseconds(),
270
 
                                       self.start_checker))
 
256
        self.checker_initiator_tag = gobject.timeout_add\
 
257
                                     (self._interval_milliseconds,
 
258
                                      self.start_checker)
271
259
        # Also start a new checker *right now*.
272
260
        self.start_checker()
273
 
        # Schedule a disable() when 'timeout' has passed
274
 
        self.disable_initiator_tag = (gobject.timeout_add
275
 
                                   (self.timeout_milliseconds(),
276
 
                                    self.disable))
277
 
        self.enabled = True
278
 
    
279
 
    def disable(self):
280
 
        """Disable this client."""
281
 
        if not getattr(self, "enabled", False):
 
261
        # Schedule a stop() when 'timeout' has passed
 
262
        self.stop_initiator_tag = gobject.timeout_add\
 
263
                                  (self._timeout_milliseconds,
 
264
                                   self.stop)
 
265
    def stop(self):
 
266
        """Stop this client.
 
267
        The possibility that a client might be restarted is left open,
 
268
        but not currently used."""
 
269
        # If this client doesn't have a secret, it is already stopped.
 
270
        if hasattr(self, "secret") and self.secret:
 
271
            logger.info(u"Stopping client %s", self.name)
 
272
            self.secret = None
 
273
        else:
282
274
            return False
283
 
        logger.info(u"Disabling client %s", self.name)
284
 
        if getattr(self, "disable_initiator_tag", False):
285
 
            gobject.source_remove(self.disable_initiator_tag)
286
 
            self.disable_initiator_tag = None
 
275
        if getattr(self, "stop_initiator_tag", False):
 
276
            gobject.source_remove(self.stop_initiator_tag)
 
277
            self.stop_initiator_tag = None
287
278
        if getattr(self, "checker_initiator_tag", False):
288
279
            gobject.source_remove(self.checker_initiator_tag)
289
280
            self.checker_initiator_tag = None
290
281
        self.stop_checker()
291
 
        if self.disable_hook:
292
 
            self.disable_hook(self)
293
 
        self.enabled = False
 
282
        if self.stop_hook:
 
283
            self.stop_hook(self)
294
284
        # Do not run this again if called by a gobject.timeout_add
295
285
        return False
296
 
    
297
286
    def __del__(self):
298
 
        self.disable_hook = None
299
 
        self.disable()
300
 
    
301
 
    def checker_callback(self, pid, condition, command):
 
287
        self.stop_hook = None
 
288
        self.stop()
 
289
    def checker_callback(self, pid, condition):
302
290
        """The checker has completed, so take appropriate actions."""
 
291
        now = datetime.datetime.now()
303
292
        self.checker_callback_tag = None
304
293
        self.checker = None
305
 
        if os.WIFEXITED(condition):
306
 
            exitstatus = os.WEXITSTATUS(condition)
307
 
            if exitstatus == 0:
308
 
                logger.info(u"Checker for %(name)s succeeded",
309
 
                            vars(self))
310
 
                self.checked_ok()
311
 
            else:
312
 
                logger.info(u"Checker for %(name)s failed",
313
 
                            vars(self))
314
 
        else:
 
294
        if os.WIFEXITED(condition) \
 
295
               and (os.WEXITSTATUS(condition) == 0):
 
296
            logger.info(u"Checker for %(name)s succeeded",
 
297
                        vars(self))
 
298
            self.last_checked_ok = now
 
299
            gobject.source_remove(self.stop_initiator_tag)
 
300
            self.stop_initiator_tag = gobject.timeout_add\
 
301
                                      (self._timeout_milliseconds,
 
302
                                       self.stop)
 
303
        elif not os.WIFEXITED(condition):
315
304
            logger.warning(u"Checker for %(name)s crashed?",
316
305
                           vars(self))
317
 
    
318
 
    def checked_ok(self):
319
 
        """Bump up the timeout for this client.
320
 
        This should only be called when the client has been seen,
321
 
        alive and well.
322
 
        """
323
 
        self.last_checked_ok = datetime.datetime.utcnow()
324
 
        gobject.source_remove(self.disable_initiator_tag)
325
 
        self.disable_initiator_tag = (gobject.timeout_add
326
 
                                      (self.timeout_milliseconds(),
327
 
                                       self.disable))
328
 
    
 
306
        else:
 
307
            logger.info(u"Checker for %(name)s failed",
 
308
                        vars(self))
329
309
    def start_checker(self):
330
310
        """Start a new checker subprocess if one is not running.
331
311
        If a checker already exists, leave it running and do
338
318
        # checkers alone, the checker would have to take more time
339
319
        # than 'timeout' for the client to be declared invalid, which
340
320
        # is as it should be.
341
 
        
342
 
        # If a checker exists, make sure it is not a zombie
343
 
        if self.checker is not None:
344
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
345
 
            if pid:
346
 
                logger.warning("Checker was a zombie")
347
 
                gobject.source_remove(self.checker_callback_tag)
348
 
                self.checker_callback(pid, status,
349
 
                                      self.current_checker_command)
350
 
        # Start a new checker if needed
351
321
        if self.checker is None:
352
322
            try:
353
 
                # In case checker_command has exactly one % operator
354
 
                command = self.checker_command % self.host
 
323
                # In case check_command has exactly one % operator
 
324
                command = self.check_command % self.host
355
325
            except TypeError:
356
326
                # Escape attributes for the shell
357
327
                escaped_attrs = dict((key, re.escape(str(val)))
358
328
                                     for key, val in
359
329
                                     vars(self).iteritems())
360
330
                try:
361
 
                    command = self.checker_command % escaped_attrs
 
331
                    command = self.check_command % escaped_attrs
362
332
                except TypeError, error:
363
333
                    logger.error(u'Could not format string "%s":'
364
 
                                 u' %s', self.checker_command, error)
 
334
                                 u' %s', self.check_command, error)
365
335
                    return True # Try again later
366
 
            self.current_checker_command = command
367
336
            try:
368
337
                logger.info(u"Starting checker %r for %s",
369
338
                            command, self.name)
370
 
                # We don't need to redirect stdout and stderr, since
371
 
                # in normal mode, that is already done by daemon(),
372
 
                # and in debug mode we don't want to.  (Stdin is
373
 
                # always replaced by /dev/null.)
374
339
                self.checker = subprocess.Popen(command,
375
340
                                                close_fds=True,
376
341
                                                shell=True, cwd="/")
377
 
                self.checker_callback_tag = (gobject.child_watch_add
378
 
                                             (self.checker.pid,
379
 
                                              self.checker_callback,
380
 
                                              data=command))
381
 
                # The checker may have completed before the gobject
382
 
                # watch was added.  Check for this.
383
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
384
 
                if pid:
385
 
                    gobject.source_remove(self.checker_callback_tag)
386
 
                    self.checker_callback(pid, status, command)
387
 
            except OSError, error:
 
342
                self.checker_callback_tag = gobject.child_watch_add\
 
343
                                            (self.checker.pid,
 
344
                                             self.checker_callback)
 
345
            except subprocess.OSError, error:
388
346
                logger.error(u"Failed to start subprocess: %s",
389
347
                             error)
390
348
        # Re-run this periodically if run by gobject.timeout_add
391
349
        return True
392
 
    
393
350
    def stop_checker(self):
394
351
        """Force the checker process, if any, to stop."""
395
352
        if self.checker_callback_tag:
407
364
            if error.errno != errno.ESRCH: # No such process
408
365
                raise
409
366
        self.checker = None
410
 
    
411
367
    def still_valid(self):
412
368
        """Has the timeout not yet passed for this client?"""
413
 
        if not getattr(self, "enabled", False):
414
 
            return False
415
 
        now = datetime.datetime.utcnow()
 
369
        now = datetime.datetime.now()
416
370
        if self.last_checked_ok is None:
417
371
            return now < (self.created + self.timeout)
418
372
        else:
419
373
            return now < (self.last_checked_ok + self.timeout)
420
374
 
421
375
 
422
 
class ClientDBus(Client, dbus.service.Object):
423
 
    """A Client class using D-Bus
424
 
    Attributes:
425
 
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
426
 
    """
427
 
    # dbus.service.Object doesn't use super(), so we can't either.
428
 
    
429
 
    def __init__(self, *args, **kwargs):
430
 
        Client.__init__(self, *args, **kwargs)
431
 
        # Only now, when this client is initialized, can it show up on
432
 
        # the D-Bus
433
 
        self.dbus_object_path = (dbus.ObjectPath
434
 
                                 ("/clients/"
435
 
                                  + self.name.replace(".", "_")))
436
 
        dbus.service.Object.__init__(self, bus,
437
 
                                     self.dbus_object_path)
438
 
    def enable(self):
439
 
        oldstate = getattr(self, "enabled", False)
440
 
        r = Client.enable(self)
441
 
        if oldstate != self.enabled:
442
 
            # Emit D-Bus signals
443
 
            self.PropertyChanged(dbus.String(u"enabled"),
444
 
                                 dbus.Boolean(True, variant_level=1))
445
 
            self.PropertyChanged(dbus.String(u"last_enabled"),
446
 
                                 (_datetime_to_dbus(self.last_enabled,
447
 
                                                    variant_level=1)))
448
 
        return r
449
 
    
450
 
    def disable(self, signal = True):
451
 
        oldstate = getattr(self, "enabled", False)
452
 
        r = Client.disable(self)
453
 
        if signal and oldstate != self.enabled:
454
 
            # Emit D-Bus signal
455
 
            self.PropertyChanged(dbus.String(u"enabled"),
456
 
                                 dbus.Boolean(False, variant_level=1))
457
 
        return r
458
 
    
459
 
    def __del__(self, *args, **kwargs):
460
 
        try:
461
 
            self.remove_from_connection()
462
 
        except LookupError:
463
 
            pass
464
 
        if hasattr(dbus.service.Object, "__del__"):
465
 
            dbus.service.Object.__del__(self, *args, **kwargs)
466
 
        Client.__del__(self, *args, **kwargs)
467
 
    
468
 
    def checker_callback(self, pid, condition, command,
469
 
                         *args, **kwargs):
470
 
        self.checker_callback_tag = None
471
 
        self.checker = None
472
 
        # Emit D-Bus signal
473
 
        self.PropertyChanged(dbus.String(u"checker_running"),
474
 
                             dbus.Boolean(False, variant_level=1))
475
 
        if os.WIFEXITED(condition):
476
 
            exitstatus = os.WEXITSTATUS(condition)
477
 
            # Emit D-Bus signal
478
 
            self.CheckerCompleted(dbus.Int16(exitstatus),
479
 
                                  dbus.Int64(condition),
480
 
                                  dbus.String(command))
481
 
        else:
482
 
            # Emit D-Bus signal
483
 
            self.CheckerCompleted(dbus.Int16(-1),
484
 
                                  dbus.Int64(condition),
485
 
                                  dbus.String(command))
486
 
        
487
 
        return Client.checker_callback(self, pid, condition, command,
488
 
                                       *args, **kwargs)
489
 
    
490
 
    def checked_ok(self, *args, **kwargs):
491
 
        r = Client.checked_ok(self, *args, **kwargs)
492
 
        # Emit D-Bus signal
493
 
        self.PropertyChanged(
494
 
            dbus.String(u"last_checked_ok"),
495
 
            (_datetime_to_dbus(self.last_checked_ok,
496
 
                               variant_level=1)))
497
 
        return r
498
 
    
499
 
    def start_checker(self, *args, **kwargs):
500
 
        old_checker = self.checker
501
 
        if self.checker is not None:
502
 
            old_checker_pid = self.checker.pid
503
 
        else:
504
 
            old_checker_pid = None
505
 
        r = Client.start_checker(self, *args, **kwargs)
506
 
        # Only if new checker process was started
507
 
        if (self.checker is not None
508
 
            and old_checker_pid != self.checker.pid):
509
 
            # Emit D-Bus signal
510
 
            self.CheckerStarted(self.current_checker_command)
511
 
            self.PropertyChanged(
512
 
                dbus.String("checker_running"),
513
 
                dbus.Boolean(True, variant_level=1))
514
 
        return r
515
 
    
516
 
    def stop_checker(self, *args, **kwargs):
517
 
        old_checker = getattr(self, "checker", None)
518
 
        r = Client.stop_checker(self, *args, **kwargs)
519
 
        if (old_checker is not None
520
 
            and getattr(self, "checker", None) is None):
521
 
            self.PropertyChanged(dbus.String(u"checker_running"),
522
 
                                 dbus.Boolean(False, variant_level=1))
523
 
        return r
524
 
    
525
 
    ## D-Bus methods & signals
526
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
527
 
    
528
 
    # CheckedOK - method
529
 
    CheckedOK = dbus.service.method(_interface)(checked_ok)
530
 
    CheckedOK.__name__ = "CheckedOK"
531
 
    
532
 
    # CheckerCompleted - signal
533
 
    @dbus.service.signal(_interface, signature="nxs")
534
 
    def CheckerCompleted(self, exitcode, waitstatus, command):
535
 
        "D-Bus signal"
536
 
        pass
537
 
    
538
 
    # CheckerStarted - signal
539
 
    @dbus.service.signal(_interface, signature="s")
540
 
    def CheckerStarted(self, command):
541
 
        "D-Bus signal"
542
 
        pass
543
 
    
544
 
    # GetAllProperties - method
545
 
    @dbus.service.method(_interface, out_signature="a{sv}")
546
 
    def GetAllProperties(self):
547
 
        "D-Bus method"
548
 
        return dbus.Dictionary({
549
 
                dbus.String("name"):
550
 
                    dbus.String(self.name, variant_level=1),
551
 
                dbus.String("fingerprint"):
552
 
                    dbus.String(self.fingerprint, variant_level=1),
553
 
                dbus.String("host"):
554
 
                    dbus.String(self.host, variant_level=1),
555
 
                dbus.String("created"):
556
 
                    _datetime_to_dbus(self.created, variant_level=1),
557
 
                dbus.String("last_enabled"):
558
 
                    (_datetime_to_dbus(self.last_enabled,
559
 
                                       variant_level=1)
560
 
                     if self.last_enabled is not None
561
 
                     else dbus.Boolean(False, variant_level=1)),
562
 
                dbus.String("enabled"):
563
 
                    dbus.Boolean(self.enabled, variant_level=1),
564
 
                dbus.String("last_checked_ok"):
565
 
                    (_datetime_to_dbus(self.last_checked_ok,
566
 
                                       variant_level=1)
567
 
                     if self.last_checked_ok is not None
568
 
                     else dbus.Boolean (False, variant_level=1)),
569
 
                dbus.String("timeout"):
570
 
                    dbus.UInt64(self.timeout_milliseconds(),
571
 
                                variant_level=1),
572
 
                dbus.String("interval"):
573
 
                    dbus.UInt64(self.interval_milliseconds(),
574
 
                                variant_level=1),
575
 
                dbus.String("checker"):
576
 
                    dbus.String(self.checker_command,
577
 
                                variant_level=1),
578
 
                dbus.String("checker_running"):
579
 
                    dbus.Boolean(self.checker is not None,
580
 
                                 variant_level=1),
581
 
                dbus.String("object_path"):
582
 
                    dbus.ObjectPath(self.dbus_object_path,
583
 
                                    variant_level=1)
584
 
                }, signature="sv")
585
 
    
586
 
    # IsStillValid - method
587
 
    @dbus.service.method(_interface, out_signature="b")
588
 
    def IsStillValid(self):
589
 
        return self.still_valid()
590
 
    
591
 
    # PropertyChanged - signal
592
 
    @dbus.service.signal(_interface, signature="sv")
593
 
    def PropertyChanged(self, property, value):
594
 
        "D-Bus signal"
595
 
        pass
596
 
    
597
 
    # ReceivedSecret - signal
598
 
    @dbus.service.signal(_interface)
599
 
    def ReceivedSecret(self):
600
 
        "D-Bus signal"
601
 
        pass
602
 
    
603
 
    # Rejected - signal
604
 
    @dbus.service.signal(_interface)
605
 
    def Rejected(self):
606
 
        "D-Bus signal"
607
 
        pass
608
 
    
609
 
    # SetChecker - method
610
 
    @dbus.service.method(_interface, in_signature="s")
611
 
    def SetChecker(self, checker):
612
 
        "D-Bus setter method"
613
 
        self.checker_command = checker
614
 
        # Emit D-Bus signal
615
 
        self.PropertyChanged(dbus.String(u"checker"),
616
 
                             dbus.String(self.checker_command,
617
 
                                         variant_level=1))
618
 
    
619
 
    # SetHost - method
620
 
    @dbus.service.method(_interface, in_signature="s")
621
 
    def SetHost(self, host):
622
 
        "D-Bus setter method"
623
 
        self.host = host
624
 
        # Emit D-Bus signal
625
 
        self.PropertyChanged(dbus.String(u"host"),
626
 
                             dbus.String(self.host, variant_level=1))
627
 
    
628
 
    # SetInterval - method
629
 
    @dbus.service.method(_interface, in_signature="t")
630
 
    def SetInterval(self, milliseconds):
631
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
632
 
        # Emit D-Bus signal
633
 
        self.PropertyChanged(dbus.String(u"interval"),
634
 
                             (dbus.UInt64(self.interval_milliseconds(),
635
 
                                          variant_level=1)))
636
 
    
637
 
    # SetSecret - method
638
 
    @dbus.service.method(_interface, in_signature="ay",
639
 
                         byte_arrays=True)
640
 
    def SetSecret(self, secret):
641
 
        "D-Bus setter method"
642
 
        self.secret = str(secret)
643
 
    
644
 
    # SetTimeout - method
645
 
    @dbus.service.method(_interface, in_signature="t")
646
 
    def SetTimeout(self, milliseconds):
647
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
648
 
        # Emit D-Bus signal
649
 
        self.PropertyChanged(dbus.String(u"timeout"),
650
 
                             (dbus.UInt64(self.timeout_milliseconds(),
651
 
                                          variant_level=1)))
652
 
    
653
 
    # Enable - method
654
 
    Enable = dbus.service.method(_interface)(enable)
655
 
    Enable.__name__ = "Enable"
656
 
    
657
 
    # StartChecker - method
658
 
    @dbus.service.method(_interface)
659
 
    def StartChecker(self):
660
 
        "D-Bus method"
661
 
        self.start_checker()
662
 
    
663
 
    # Disable - method
664
 
    @dbus.service.method(_interface)
665
 
    def Disable(self):
666
 
        "D-Bus method"
667
 
        self.disable()
668
 
    
669
 
    # StopChecker - method
670
 
    StopChecker = dbus.service.method(_interface)(stop_checker)
671
 
    StopChecker.__name__ = "StopChecker"
672
 
    
673
 
    del _interface
674
 
 
675
 
 
676
 
class TCP_handler(SocketServer.BaseRequestHandler, object):
 
376
def peer_certificate(session):
 
377
    "Return the peer's OpenPGP certificate as a bytestring"
 
378
    # If not an OpenPGP certificate...
 
379
    if gnutls.library.functions.gnutls_certificate_type_get\
 
380
            (session._c_object) \
 
381
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
 
382
        # ...do the normal thing
 
383
        return session.peer_certificate
 
384
    list_size = ctypes.c_uint()
 
385
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
 
386
        (session._c_object, ctypes.byref(list_size))
 
387
    if list_size.value == 0:
 
388
        return None
 
389
    cert = cert_list[0]
 
390
    return ctypes.string_at(cert.data, cert.size)
 
391
 
 
392
 
 
393
def fingerprint(openpgp):
 
394
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
 
395
    # New GnuTLS "datum" with the OpenPGP public key
 
396
    datum = gnutls.library.types.gnutls_datum_t\
 
397
        (ctypes.cast(ctypes.c_char_p(openpgp),
 
398
                     ctypes.POINTER(ctypes.c_ubyte)),
 
399
         ctypes.c_uint(len(openpgp)))
 
400
    # New empty GnuTLS certificate
 
401
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
402
    gnutls.library.functions.gnutls_openpgp_crt_init\
 
403
        (ctypes.byref(crt))
 
404
    # Import the OpenPGP public key into the certificate
 
405
    gnutls.library.functions.gnutls_openpgp_crt_import\
 
406
                    (crt, ctypes.byref(datum),
 
407
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
408
    # New buffer for the fingerprint
 
409
    buffer = ctypes.create_string_buffer(20)
 
410
    buffer_length = ctypes.c_size_t()
 
411
    # Get the fingerprint from the certificate into the buffer
 
412
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
 
413
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
 
414
    # Deinit the certificate
 
415
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
416
    # Convert the buffer to a Python bytestring
 
417
    fpr = ctypes.string_at(buffer, buffer_length.value)
 
418
    # Convert the bytestring to hexadecimal notation
 
419
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
420
    return hex_fpr
 
421
 
 
422
 
 
423
class tcp_handler(SocketServer.BaseRequestHandler, object):
677
424
    """A TCP request handler class.
678
425
    Instantiated by IPv6_TCPServer for each request to handle it.
679
426
    Note: This will run in its own forked process."""
680
427
    
681
428
    def handle(self):
682
429
        logger.info(u"TCP connection from: %s",
683
 
                    unicode(self.client_address))
684
 
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
685
 
        # Open IPC pipe to parent process
686
 
        with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
687
 
            session = (gnutls.connection
688
 
                       .ClientSession(self.request,
689
 
                                      gnutls.connection
690
 
                                      .X509Credentials()))
691
 
            
692
 
            line = self.request.makefile().readline()
693
 
            logger.debug(u"Protocol version: %r", line)
694
 
            try:
695
 
                if int(line.strip().split()[0]) > 1:
696
 
                    raise RuntimeError
697
 
            except (ValueError, IndexError, RuntimeError), error:
698
 
                logger.error(u"Unknown protocol version: %s", error)
699
 
                return
700
 
            
701
 
            # Note: gnutls.connection.X509Credentials is really a
702
 
            # generic GnuTLS certificate credentials object so long as
703
 
            # no X.509 keys are added to it.  Therefore, we can use it
704
 
            # here despite using OpenPGP certificates.
705
 
            
706
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
707
 
            #                     "+AES-256-CBC", "+SHA1",
708
 
            #                     "+COMP-NULL", "+CTYPE-OPENPGP",
709
 
            #                     "+DHE-DSS"))
710
 
            # Use a fallback default, since this MUST be set.
711
 
            priority = self.server.settings.get("priority", "NORMAL")
712
 
            (gnutls.library.functions
713
 
             .gnutls_priority_set_direct(session._c_object,
714
 
                                         priority, None))
715
 
            
716
 
            try:
717
 
                session.handshake()
718
 
            except gnutls.errors.GNUTLSError, error:
719
 
                logger.warning(u"Handshake failed: %s", error)
720
 
                # Do not run session.bye() here: the session is not
721
 
                # established.  Just abandon the request.
722
 
                return
723
 
            logger.debug(u"Handshake succeeded")
724
 
            try:
725
 
                fpr = self.fingerprint(self.peer_certificate(session))
726
 
            except (TypeError, gnutls.errors.GNUTLSError), error:
727
 
                logger.warning(u"Bad certificate: %s", error)
728
 
                session.bye()
729
 
                return
730
 
            logger.debug(u"Fingerprint: %s", fpr)
731
 
            
732
 
            for c in self.server.clients:
733
 
                if c.fingerprint == fpr:
734
 
                    client = c
735
 
                    break
736
 
            else:
737
 
                ipc.write("NOTFOUND %s\n" % fpr)
738
 
                session.bye()
739
 
                return
740
 
            # Have to check if client.still_valid(), since it is
741
 
            # possible that the client timed out while establishing
742
 
            # the GnuTLS session.
743
 
            if not client.still_valid():
744
 
                ipc.write("INVALID %s\n" % client.name)
745
 
                session.bye()
746
 
                return
747
 
            ipc.write("SENDING %s\n" % client.name)
748
 
            sent_size = 0
749
 
            while sent_size < len(client.secret):
750
 
                sent = session.send(client.secret[sent_size:])
751
 
                logger.debug(u"Sent: %d, remaining: %d",
752
 
                             sent, len(client.secret)
753
 
                             - (sent_size + sent))
754
 
                sent_size += sent
755
 
            session.bye()
756
 
    
757
 
    @staticmethod
758
 
    def peer_certificate(session):
759
 
        "Return the peer's OpenPGP certificate as a bytestring"
760
 
        # If not an OpenPGP certificate...
761
 
        if (gnutls.library.functions
762
 
            .gnutls_certificate_type_get(session._c_object)
763
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
764
 
            # ...do the normal thing
765
 
            return session.peer_certificate
766
 
        list_size = ctypes.c_uint(1)
767
 
        cert_list = (gnutls.library.functions
768
 
                     .gnutls_certificate_get_peers
769
 
                     (session._c_object, ctypes.byref(list_size)))
770
 
        if not bool(cert_list) and list_size.value != 0:
771
 
            raise gnutls.errors.GNUTLSError("error getting peer"
772
 
                                            " certificate")
773
 
        if list_size.value == 0:
774
 
            return None
775
 
        cert = cert_list[0]
776
 
        return ctypes.string_at(cert.data, cert.size)
777
 
    
778
 
    @staticmethod
779
 
    def fingerprint(openpgp):
780
 
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
781
 
        # New GnuTLS "datum" with the OpenPGP public key
782
 
        datum = (gnutls.library.types
783
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
784
 
                                             ctypes.POINTER
785
 
                                             (ctypes.c_ubyte)),
786
 
                                 ctypes.c_uint(len(openpgp))))
787
 
        # New empty GnuTLS certificate
788
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
789
 
        (gnutls.library.functions
790
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
791
 
        # Import the OpenPGP public key into the certificate
792
 
        (gnutls.library.functions
793
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
794
 
                                    gnutls.library.constants
795
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
796
 
        # Verify the self signature in the key
797
 
        crtverify = ctypes.c_uint()
798
 
        (gnutls.library.functions
799
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
800
 
                                         ctypes.byref(crtverify)))
801
 
        if crtverify.value != 0:
802
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
803
 
            raise (gnutls.errors.CertificateSecurityError
804
 
                   ("Verify failed"))
805
 
        # New buffer for the fingerprint
806
 
        buf = ctypes.create_string_buffer(20)
807
 
        buf_len = ctypes.c_size_t()
808
 
        # Get the fingerprint from the certificate into the buffer
809
 
        (gnutls.library.functions
810
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
811
 
                                             ctypes.byref(buf_len)))
812
 
        # Deinit the certificate
813
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
814
 
        # Convert the buffer to a Python bytestring
815
 
        fpr = ctypes.string_at(buf, buf_len.value)
816
 
        # Convert the bytestring to hexadecimal notation
817
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
818
 
        return hex_fpr
819
 
 
820
 
 
821
 
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
822
 
    """Like SocketServer.ForkingMixIn, but also pass a pipe.
823
 
    Assumes a gobject.MainLoop event loop.
824
 
    """
825
 
    def process_request(self, request, client_address):
826
 
        """This overrides and wraps the original process_request().
827
 
        This function creates a new pipe in self.pipe 
828
 
        """
829
 
        self.pipe = os.pipe()
830
 
        super(ForkingMixInWithPipe,
831
 
              self).process_request(request, client_address)
832
 
        os.close(self.pipe[1])  # close write end
833
 
        # Call "handle_ipc" for both data and EOF events
834
 
        gobject.io_add_watch(self.pipe[0],
835
 
                             gobject.IO_IN | gobject.IO_HUP,
836
 
                             self.handle_ipc)
837
 
    def handle_ipc(source, condition):
838
 
        """Dummy function; override as necessary"""
839
 
        os.close(source)
840
 
        return False
841
 
 
842
 
 
843
 
class IPv6_TCPServer(ForkingMixInWithPipe,
844
 
                     SocketServer.TCPServer, object):
845
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
430
                     unicode(self.client_address))
 
431
        session = gnutls.connection.ClientSession\
 
432
                  (self.request, gnutls.connection.X509Credentials())
 
433
        
 
434
        line = self.request.makefile().readline()
 
435
        logger.debug(u"Protocol version: %r", line)
 
436
        try:
 
437
            if int(line.strip().split()[0]) > 1:
 
438
                raise RuntimeError
 
439
        except (ValueError, IndexError, RuntimeError), error:
 
440
            logger.error(u"Unknown protocol version: %s", error)
 
441
            return
 
442
        
 
443
        # Note: gnutls.connection.X509Credentials is really a generic
 
444
        # GnuTLS certificate credentials object so long as no X.509
 
445
        # keys are added to it.  Therefore, we can use it here despite
 
446
        # using OpenPGP certificates.
 
447
        
 
448
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
 
449
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
 
450
        #                "+DHE-DSS"))
 
451
        priority = "NORMAL"             # Fallback default, since this
 
452
                                        # MUST be set.
 
453
        if self.server.settings["priority"]:
 
454
            priority = self.server.settings["priority"]
 
455
        gnutls.library.functions.gnutls_priority_set_direct\
 
456
            (session._c_object, priority, None);
 
457
        
 
458
        try:
 
459
            session.handshake()
 
460
        except gnutls.errors.GNUTLSError, error:
 
461
            logger.warning(u"Handshake failed: %s", error)
 
462
            # Do not run session.bye() here: the session is not
 
463
            # established.  Just abandon the request.
 
464
            return
 
465
        try:
 
466
            fpr = fingerprint(peer_certificate(session))
 
467
        except (TypeError, gnutls.errors.GNUTLSError), error:
 
468
            logger.warning(u"Bad certificate: %s", error)
 
469
            session.bye()
 
470
            return
 
471
        logger.debug(u"Fingerprint: %s", fpr)
 
472
        client = None
 
473
        for c in self.server.clients:
 
474
            if c.fingerprint == fpr:
 
475
                client = c
 
476
                break
 
477
        if not client:
 
478
            logger.warning(u"Client not found for fingerprint: %s",
 
479
                           fpr)
 
480
            session.bye()
 
481
            return
 
482
        # Have to check if client.still_valid(), since it is possible
 
483
        # that the client timed out while establishing the GnuTLS
 
484
        # session.
 
485
        if not client.still_valid():
 
486
            logger.warning(u"Client %(name)s is invalid",
 
487
                           vars(client))
 
488
            session.bye()
 
489
            return
 
490
        sent_size = 0
 
491
        while sent_size < len(client.secret):
 
492
            sent = session.send(client.secret[sent_size:])
 
493
            logger.debug(u"Sent: %d, remaining: %d",
 
494
                         sent, len(client.secret)
 
495
                         - (sent_size + sent))
 
496
            sent_size += sent
 
497
        session.bye()
 
498
 
 
499
 
 
500
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
 
501
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
846
502
    Attributes:
847
503
        settings:       Server settings
848
504
        clients:        Set() of Client objects
849
 
        enabled:        Boolean; whether this server is activated yet
850
505
    """
851
506
    address_family = socket.AF_INET6
852
507
    def __init__(self, *args, **kwargs):
856
511
        if "clients" in kwargs:
857
512
            self.clients = kwargs["clients"]
858
513
            del kwargs["clients"]
859
 
        if "use_ipv6" in kwargs:
860
 
            if not kwargs["use_ipv6"]:
861
 
                self.address_family = socket.AF_INET
862
 
            del kwargs["use_ipv6"]
863
 
        self.enabled = False
864
 
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
 
514
        return super(type(self), self).__init__(*args, **kwargs)
865
515
    def server_bind(self):
866
516
        """This overrides the normal server_bind() function
867
517
        to bind to an interface if one was specified, and also NOT to
879
529
                                 u" bind to interface %s",
880
530
                                 self.settings["interface"])
881
531
                else:
882
 
                    raise
 
532
                    raise error
883
533
        # Only bind(2) the socket if we really need to.
884
534
        if self.server_address[0] or self.server_address[1]:
885
535
            if not self.server_address[0]:
886
 
                if self.address_family == socket.AF_INET6:
887
 
                    any_address = "::" # in6addr_any
888
 
                else:
889
 
                    any_address = socket.INADDR_ANY
890
 
                self.server_address = (any_address,
 
536
                in6addr_any = "::"
 
537
                self.server_address = (in6addr_any,
891
538
                                       self.server_address[1])
892
539
            elif not self.server_address[1]:
893
540
                self.server_address = (self.server_address[0],
899
546
#                                            if_nametoindex
900
547
#                                            (self.settings
901
548
#                                             ["interface"]))
902
 
            return super(IPv6_TCPServer, self).server_bind()
903
 
    def server_activate(self):
904
 
        if self.enabled:
905
 
            return super(IPv6_TCPServer, self).server_activate()
906
 
    def enable(self):
907
 
        self.enabled = True
908
 
    def handle_ipc(self, source, condition, file_objects={}):
909
 
        condition_names = {
910
 
            gobject.IO_IN: "IN", # There is data to read.
911
 
            gobject.IO_OUT: "OUT", # Data can be written (without
912
 
                                   # blocking).
913
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
914
 
            gobject.IO_ERR: "ERR", # Error condition.
915
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
916
 
                                   # broken, usually for pipes and
917
 
                                   # sockets).
918
 
            }
919
 
        conditions_string = ' | '.join(name
920
 
                                       for cond, name in
921
 
                                       condition_names.iteritems()
922
 
                                       if cond & condition)
923
 
        logger.debug("Handling IPC: FD = %d, condition = %s", source,
924
 
                     conditions_string)
925
 
        
926
 
        # Turn the pipe file descriptor into a Python file object
927
 
        if source not in file_objects:
928
 
            file_objects[source] = os.fdopen(source, "r", 1)
929
 
        
930
 
        # Read a line from the file object
931
 
        cmdline = file_objects[source].readline()
932
 
        if not cmdline:             # Empty line means end of file
933
 
            # close the IPC pipe
934
 
            file_objects[source].close()
935
 
            del file_objects[source]
936
 
            
937
 
            # Stop calling this function
938
 
            return False
939
 
        
940
 
        logger.debug("IPC command: %r", cmdline)
941
 
        
942
 
        # Parse and act on command
943
 
        cmd, args = cmdline.rstrip("\r\n").split(None, 1)
944
 
        
945
 
        if cmd == "NOTFOUND":
946
 
            logger.warning(u"Client not found for fingerprint: %s",
947
 
                           args)
948
 
            if self.settings["use_dbus"]:
949
 
                # Emit D-Bus signal
950
 
                mandos_dbus_service.ClientNotFound(args)
951
 
        elif cmd == "INVALID":
952
 
            for client in self.clients:
953
 
                if client.name == args:
954
 
                    logger.warning(u"Client %s is invalid", args)
955
 
                    if self.settings["use_dbus"]:
956
 
                        # Emit D-Bus signal
957
 
                        client.Rejected()
958
 
                    break
959
 
            else:
960
 
                logger.error(u"Unknown client %s is invalid", args)
961
 
        elif cmd == "SENDING":
962
 
            for client in self.clients:
963
 
                if client.name == args:
964
 
                    logger.info(u"Sending secret to %s", client.name)
965
 
                    client.checked_ok()
966
 
                    if self.settings["use_dbus"]:
967
 
                        # Emit D-Bus signal
968
 
                        client.ReceivedSecret()
969
 
                    break
970
 
            else:
971
 
                logger.error(u"Sending secret to unknown client %s",
972
 
                             args)
973
 
        else:
974
 
            logger.error("Unknown IPC command: %r", cmdline)
975
 
        
976
 
        # Keep calling this function
977
 
        return True
 
549
            return super(type(self), self).server_bind()
978
550
 
979
551
 
980
552
def string_to_delta(interval):
981
553
    """Parse a string and return a datetime.timedelta
982
 
    
 
554
 
983
555
    >>> string_to_delta('7d')
984
556
    datetime.timedelta(7)
985
557
    >>> string_to_delta('60s')
990
562
    datetime.timedelta(1)
991
563
    >>> string_to_delta(u'1w')
992
564
    datetime.timedelta(7)
993
 
    >>> string_to_delta('5m 30s')
994
 
    datetime.timedelta(0, 330)
995
565
    """
996
 
    timevalue = datetime.timedelta(0)
997
 
    for s in interval.split():
998
 
        try:
999
 
            suffix = unicode(s[-1])
1000
 
            value = int(s[:-1])
1001
 
            if suffix == u"d":
1002
 
                delta = datetime.timedelta(value)
1003
 
            elif suffix == u"s":
1004
 
                delta = datetime.timedelta(0, value)
1005
 
            elif suffix == u"m":
1006
 
                delta = datetime.timedelta(0, 0, 0, 0, value)
1007
 
            elif suffix == u"h":
1008
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1009
 
            elif suffix == u"w":
1010
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1011
 
            else:
1012
 
                raise ValueError
1013
 
        except (ValueError, IndexError):
 
566
    try:
 
567
        suffix=unicode(interval[-1])
 
568
        value=int(interval[:-1])
 
569
        if suffix == u"d":
 
570
            delta = datetime.timedelta(value)
 
571
        elif suffix == u"s":
 
572
            delta = datetime.timedelta(0, value)
 
573
        elif suffix == u"m":
 
574
            delta = datetime.timedelta(0, 0, 0, 0, value)
 
575
        elif suffix == u"h":
 
576
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
577
        elif suffix == u"w":
 
578
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
579
        else:
1014
580
            raise ValueError
1015
 
        timevalue += delta
1016
 
    return timevalue
 
581
    except (ValueError, IndexError):
 
582
        raise ValueError
 
583
    return delta
1017
584
 
1018
585
 
1019
586
def server_state_changed(state):
1020
587
    """Derived from the Avahi example code"""
1021
588
    if state == avahi.SERVER_COLLISION:
1022
 
        logger.error(u"Zeroconf server name collision")
 
589
        logger.error(u"Server name collision")
1023
590
        service.remove()
1024
591
    elif state == avahi.SERVER_RUNNING:
1025
592
        service.add()
1027
594
 
1028
595
def entry_group_state_changed(state, error):
1029
596
    """Derived from the Avahi example code"""
1030
 
    logger.debug(u"Avahi state change: %i", state)
 
597
    logger.debug(u"state change: %i", state)
1031
598
    
1032
599
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
1033
 
        logger.debug(u"Zeroconf service established.")
 
600
        logger.debug(u"Service established.")
1034
601
    elif state == avahi.ENTRY_GROUP_COLLISION:
1035
 
        logger.warning(u"Zeroconf service name collision.")
 
602
        logger.warning(u"Service name collision.")
1036
603
        service.rename()
1037
604
    elif state == avahi.ENTRY_GROUP_FAILURE:
1038
 
        logger.critical(u"Avahi: Error in group state changed %s",
 
605
        logger.critical(u"Error in group state changed %s",
1039
606
                        unicode(error))
1040
 
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
 
607
        raise AvahiGroupError("State changed: %s", str(error))
1041
608
 
1042
609
def if_nametoindex(interface):
1043
610
    """Call the C function if_nametoindex(), or equivalent"""
1044
611
    global if_nametoindex
1045
612
    try:
1046
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1047
 
                          (ctypes.util.find_library("c"))
1048
 
                          .if_nametoindex)
 
613
        if "ctypes.util" not in sys.modules:
 
614
            import ctypes.util
 
615
        if_nametoindex = ctypes.cdll.LoadLibrary\
 
616
            (ctypes.util.find_library("c")).if_nametoindex
1049
617
    except (OSError, AttributeError):
1050
618
        if "struct" not in sys.modules:
1051
619
            import struct
1054
622
        def if_nametoindex(interface):
1055
623
            "Get an interface index the hard way, i.e. using fcntl()"
1056
624
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1057
 
            with closing(socket.socket()) as s:
1058
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1059
 
                                    struct.pack("16s16x", interface))
 
625
            s = socket.socket()
 
626
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
627
                                struct.pack("16s16x", interface))
 
628
            s.close()
1060
629
            interface_index = struct.unpack("I", ifreq[16:20])[0]
1061
630
            return interface_index
1062
631
    return if_nametoindex(interface)
1086
655
 
1087
656
 
1088
657
def main():
1089
 
    
1090
 
    ######################################################################
1091
 
    # Parsing of options, both command line and config file
1092
 
    
1093
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
 
658
    global main_loop_started
 
659
    main_loop_started = False
 
660
    
 
661
    parser = OptionParser(version = "%%prog %s" % version)
1094
662
    parser.add_option("-i", "--interface", type="string",
1095
663
                      metavar="IF", help="Bind to interface IF")
1096
664
    parser.add_option("-a", "--address", type="string",
1097
665
                      help="Address to listen for requests on")
1098
666
    parser.add_option("-p", "--port", type="int",
1099
667
                      help="Port number to receive requests on")
1100
 
    parser.add_option("--check", action="store_true",
 
668
    parser.add_option("--check", action="store_true", default=False,
1101
669
                      help="Run self-test")
1102
670
    parser.add_option("--debug", action="store_true",
1103
671
                      help="Debug mode; run in foreground and log to"
1110
678
                      default="/etc/mandos", metavar="DIR",
1111
679
                      help="Directory to search for configuration"
1112
680
                      " files")
1113
 
    parser.add_option("--no-dbus", action="store_false",
1114
 
                      dest="use_dbus",
1115
 
                      help="Do not provide D-Bus system bus"
1116
 
                      " interface")
1117
 
    parser.add_option("--no-ipv6", action="store_false",
1118
 
                      dest="use_ipv6", help="Do not use IPv6")
1119
 
    options = parser.parse_args()[0]
 
681
    (options, args) = parser.parse_args()
1120
682
    
1121
683
    if options.check:
1122
684
        import doctest
1131
693
                        "priority":
1132
694
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1133
695
                        "servicename": "Mandos",
1134
 
                        "use_dbus": "True",
1135
 
                        "use_ipv6": "True",
1136
696
                        }
1137
697
    
1138
698
    # Parse config file for server-global settings
1139
699
    server_config = ConfigParser.SafeConfigParser(server_defaults)
1140
700
    del server_defaults
1141
701
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
702
    server_section = "server"
1142
703
    # Convert the SafeConfigParser object to a dict
1143
 
    server_settings = server_config.defaults()
1144
 
    # Use the appropriate methods on the non-string config options
1145
 
    server_settings["debug"] = server_config.getboolean("DEFAULT",
1146
 
                                                        "debug")
1147
 
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1148
 
                                                           "use_dbus")
1149
 
    server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1150
 
                                                           "use_ipv6")
1151
 
    if server_settings["port"]:
1152
 
        server_settings["port"] = server_config.getint("DEFAULT",
1153
 
                                                       "port")
 
704
    server_settings = dict(server_config.items(server_section))
 
705
    # Use getboolean on the boolean config option
 
706
    server_settings["debug"] = server_config.getboolean\
 
707
                               (server_section, "debug")
1154
708
    del server_config
1155
709
    
1156
710
    # Override the settings from the config file with command line
1157
711
    # options, if set.
1158
712
    for option in ("interface", "address", "port", "debug",
1159
 
                   "priority", "servicename", "configdir",
1160
 
                   "use_dbus", "use_ipv6"):
 
713
                   "priority", "servicename", "configdir"):
1161
714
        value = getattr(options, option)
1162
715
        if value is not None:
1163
716
            server_settings[option] = value
1164
717
    del options
1165
718
    # Now we have our good server settings in "server_settings"
1166
719
    
1167
 
    ##################################################################
1168
 
    
1169
 
    # For convenience
1170
720
    debug = server_settings["debug"]
1171
 
    use_dbus = server_settings["use_dbus"]
1172
 
    use_ipv6 = server_settings["use_ipv6"]
1173
721
    
1174
722
    if not debug:
1175
723
        syslogger.setLevel(logging.WARNING)
1176
724
        console.setLevel(logging.WARNING)
1177
725
    
1178
726
    if server_settings["servicename"] != "Mandos":
1179
 
        syslogger.setFormatter(logging.Formatter
1180
 
                               ('Mandos (%s) [%%(process)d]:'
1181
 
                                ' %%(levelname)s: %%(message)s'
 
727
        syslogger.setFormatter(logging.Formatter\
 
728
                               ('Mandos (%s): %%(levelname)s:'
 
729
                                ' %%(message)s'
1182
730
                                % server_settings["servicename"]))
1183
731
    
1184
732
    # Parse config file with clients
1185
733
    client_defaults = { "timeout": "1h",
1186
734
                        "interval": "5m",
1187
735
                        "checker": "fping -q -- %%(host)s",
1188
 
                        "host": "",
1189
736
                        }
1190
737
    client_config = ConfigParser.SafeConfigParser(client_defaults)
1191
738
    client_config.read(os.path.join(server_settings["configdir"],
1192
739
                                    "clients.conf"))
1193
 
 
1194
 
    global mandos_dbus_service
1195
 
    mandos_dbus_service = None
1196
 
    
1197
 
    clients = Set()
1198
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
1199
 
                                 server_settings["port"]),
1200
 
                                TCP_handler,
1201
 
                                settings=server_settings,
1202
 
                                clients=clients, use_ipv6=use_ipv6)
1203
 
    pidfilename = "/var/run/mandos.pid"
1204
 
    try:
1205
 
        pidfile = open(pidfilename, "w")
1206
 
    except IOError:
1207
 
        logger.error("Could not open file %r", pidfilename)
1208
 
    
1209
 
    try:
1210
 
        uid = pwd.getpwnam("_mandos").pw_uid
1211
 
        gid = pwd.getpwnam("_mandos").pw_gid
1212
 
    except KeyError:
1213
 
        try:
1214
 
            uid = pwd.getpwnam("mandos").pw_uid
1215
 
            gid = pwd.getpwnam("mandos").pw_gid
1216
 
        except KeyError:
1217
 
            try:
1218
 
                uid = pwd.getpwnam("nobody").pw_uid
1219
 
                gid = pwd.getpwnam("nogroup").pw_gid
1220
 
            except KeyError:
1221
 
                uid = 65534
1222
 
                gid = 65534
1223
 
    try:
1224
 
        os.setgid(gid)
1225
 
        os.setuid(uid)
1226
 
    except OSError, error:
1227
 
        if error[0] != errno.EPERM:
1228
 
            raise error
1229
 
    
1230
 
    # Enable all possible GnuTLS debugging
1231
 
    if debug:
1232
 
        # "Use a log level over 10 to enable all debugging options."
1233
 
        # - GnuTLS manual
1234
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
1235
 
        
1236
 
        @gnutls.library.types.gnutls_log_func
1237
 
        def debug_gnutls(level, string):
1238
 
            logger.debug("GnuTLS: %s", string[:-1])
1239
 
        
1240
 
        (gnutls.library.functions
1241
 
         .gnutls_global_set_log_function(debug_gnutls))
1242
740
    
1243
741
    global service
1244
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1245
742
    service = AvahiService(name = server_settings["servicename"],
1246
 
                           servicetype = "_mandos._tcp",
1247
 
                           protocol = protocol)
 
743
                           type = "_mandos._tcp", );
1248
744
    if server_settings["interface"]:
1249
 
        service.interface = (if_nametoindex
1250
 
                             (server_settings["interface"]))
 
745
        service.interface = if_nametoindex(server_settings["interface"])
1251
746
    
1252
747
    global main_loop
1253
748
    global bus
1256
751
    DBusGMainLoop(set_as_default=True )
1257
752
    main_loop = gobject.MainLoop()
1258
753
    bus = dbus.SystemBus()
1259
 
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1260
 
                                           avahi.DBUS_PATH_SERVER),
1261
 
                            avahi.DBUS_INTERFACE_SERVER)
 
754
    server = dbus.Interface(
 
755
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
 
756
            avahi.DBUS_INTERFACE_SERVER )
1262
757
    # End of Avahi example code
1263
 
    if use_dbus:
1264
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1265
 
    
1266
 
    client_class = Client
1267
 
    if use_dbus:
1268
 
        client_class = ClientDBus
1269
 
    clients.update(Set(
1270
 
            client_class(name = section,
1271
 
                         config= dict(client_config.items(section)))
1272
 
            for section in client_config.sections()))
 
758
    
 
759
    clients = Set()
 
760
    def remove_from_clients(client):
 
761
        clients.remove(client)
 
762
        if not clients:
 
763
            logger.critical(u"No clients left, exiting")
 
764
            sys.exit()
 
765
    
 
766
    clients.update(Set(Client(name = section,
 
767
                              stop_hook = remove_from_clients,
 
768
                              config
 
769
                              = dict(client_config.items(section)))
 
770
                       for section in client_config.sections()))
1273
771
    if not clients:
1274
 
        logger.warning(u"No clients defined")
 
772
        logger.critical(u"No clients defined")
 
773
        sys.exit(1)
1275
774
    
1276
 
    if debug:
1277
 
        # Redirect stdin so all checkers get /dev/null
1278
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1279
 
        os.dup2(null, sys.stdin.fileno())
1280
 
        if null > 2:
1281
 
            os.close(null)
1282
 
    else:
1283
 
        # No console logging
 
775
    if not debug:
1284
776
        logger.removeHandler(console)
1285
 
        # Close all input and output, do double fork, etc.
1286
777
        daemon()
1287
778
    
 
779
    pidfilename = "/var/run/mandos/mandos.pid"
 
780
    pid = os.getpid()
1288
781
    try:
1289
 
        with closing(pidfile):
1290
 
            pid = os.getpid()
1291
 
            pidfile.write(str(pid) + "\n")
 
782
        pidfile = open(pidfilename, "w")
 
783
        pidfile.write(str(pid) + "\n")
 
784
        pidfile.close()
1292
785
        del pidfile
1293
 
    except IOError:
1294
 
        logger.error(u"Could not write to file %r with PID %d",
1295
 
                     pidfilename, pid)
1296
 
    except NameError:
1297
 
        # "pidfile" was never created
1298
 
        pass
1299
 
    del pidfilename
 
786
    except IOError, err:
 
787
        logger.error(u"Could not write %s file with PID %d",
 
788
                     pidfilename, os.getpid())
1300
789
    
1301
790
    def cleanup():
1302
791
        "Cleanup function; run on exit"
1309
798
        
1310
799
        while clients:
1311
800
            client = clients.pop()
1312
 
            client.disable_hook = None
1313
 
            client.disable()
 
801
            client.stop_hook = None
 
802
            client.stop()
1314
803
    
1315
804
    atexit.register(cleanup)
1316
805
    
1319
808
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1320
809
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1321
810
    
1322
 
    if use_dbus:
1323
 
        class MandosDBusService(dbus.service.Object):
1324
 
            """A D-Bus proxy object"""
1325
 
            def __init__(self):
1326
 
                dbus.service.Object.__init__(self, bus, "/")
1327
 
            _interface = u"se.bsnet.fukt.Mandos"
1328
 
            
1329
 
            @dbus.service.signal(_interface, signature="oa{sv}")
1330
 
            def ClientAdded(self, objpath, properties):
1331
 
                "D-Bus signal"
1332
 
                pass
1333
 
            
1334
 
            @dbus.service.signal(_interface, signature="s")
1335
 
            def ClientNotFound(self, fingerprint):
1336
 
                "D-Bus signal"
1337
 
                pass
1338
 
            
1339
 
            @dbus.service.signal(_interface, signature="os")
1340
 
            def ClientRemoved(self, objpath, name):
1341
 
                "D-Bus signal"
1342
 
                pass
1343
 
            
1344
 
            @dbus.service.method(_interface, out_signature="ao")
1345
 
            def GetAllClients(self):
1346
 
                "D-Bus method"
1347
 
                return dbus.Array(c.dbus_object_path for c in clients)
1348
 
            
1349
 
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
1350
 
            def GetAllClientsWithProperties(self):
1351
 
                "D-Bus method"
1352
 
                return dbus.Dictionary(
1353
 
                    ((c.dbus_object_path, c.GetAllProperties())
1354
 
                     for c in clients),
1355
 
                    signature="oa{sv}")
1356
 
            
1357
 
            @dbus.service.method(_interface, in_signature="o")
1358
 
            def RemoveClient(self, object_path):
1359
 
                "D-Bus method"
1360
 
                for c in clients:
1361
 
                    if c.dbus_object_path == object_path:
1362
 
                        clients.remove(c)
1363
 
                        c.remove_from_connection()
1364
 
                        # Don't signal anything except ClientRemoved
1365
 
                        c.disable(signal=False)
1366
 
                        # Emit D-Bus signal
1367
 
                        self.ClientRemoved(object_path, c.name)
1368
 
                        return
1369
 
                raise KeyError
1370
 
            
1371
 
            del _interface
1372
 
        
1373
 
        mandos_dbus_service = MandosDBusService()
1374
 
    
1375
811
    for client in clients:
1376
 
        if use_dbus:
1377
 
            # Emit D-Bus signal
1378
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
1379
 
                                            client.GetAllProperties())
1380
 
        client.enable()
1381
 
    
1382
 
    tcp_server.enable()
1383
 
    tcp_server.server_activate()
1384
 
    
 
812
        client.start()
 
813
    
 
814
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
815
                                 server_settings["port"]),
 
816
                                tcp_handler,
 
817
                                settings=server_settings,
 
818
                                clients=clients)
1385
819
    # Find out what port we got
1386
820
    service.port = tcp_server.socket.getsockname()[1]
1387
 
    if use_ipv6:
1388
 
        logger.info(u"Now listening on address %r, port %d,"
1389
 
                    " flowinfo %d, scope_id %d"
1390
 
                    % tcp_server.socket.getsockname())
1391
 
    else:                       # IPv4
1392
 
        logger.info(u"Now listening on address %r, port %d"
1393
 
                    % tcp_server.socket.getsockname())
 
821
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
 
822
                u" scope_id %d" % tcp_server.socket.getsockname())
1394
823
    
1395
824
    #service.interface = tcp_server.socket.getsockname()[3]
1396
825
    
1406
835
        
1407
836
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1408
837
                             lambda *args, **kwargs:
1409
 
                             (tcp_server.handle_request
1410
 
                              (*args[2:], **kwargs) or True))
 
838
                             tcp_server.handle_request\
 
839
                             (*args[2:], **kwargs) or True)
1411
840
        
1412
841
        logger.debug(u"Starting main loop")
 
842
        main_loop_started = True
1413
843
        main_loop.run()
1414
844
    except AvahiError, error:
1415
 
        logger.critical(u"AvahiError: %s", error)
 
845
        logger.critical(u"AvahiError: %s" + unicode(error))
1416
846
        sys.exit(1)
1417
847
    except KeyboardInterrupt:
1418
848
        if debug:
1419
 
            print >> sys.stderr
1420
 
        logger.debug("Server received KeyboardInterrupt")
1421
 
    logger.debug("Server exiting")
 
849
            print
1422
850
 
1423
851
if __name__ == '__main__':
1424
852
    main()