/mandos/trunk : revision 24.2.1

55

import logging

56

import logging.handlers

57

import pwd

58

from contextlib import closing

58

import contextlib

59

import struct

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

62

64

63

65

import dbus

64

66

import dbus.service

79

81

SO_BINDTODEVICE = None

80

82

81

83

82

version = "1.0.12"

84

version = "1.0.14"

83

85

84

86

logger = logging.Logger(u'mandos')

85

87

syslogger = (logging.handlers.SysLogHandler

96

98

u' %(message)s'))

97

99

logger.addHandler(console)

98

100

101

multiprocessing_manager = multiprocessing.Manager()

102

99

103

class AvahiError(Exception):

100

104

def __init__(self, value, *args, **kwargs):

101

105

self.value = value

242

246

enabled: bool()

243

247

last_checked_ok: datetime.datetime(); (UTC) or None

244

248

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

249

until this client is disabled

246

250

interval: datetime.timedelta(); How often to start a new checker

247

251

disable_hook: If set, called by disable() as disable_hook(self)

248

252

checker: subprocess.Popen(); a running checker process used

256

260

runtime with vars(self) as dict, so that for

257

261

instance %(name)s can be used in the command.

258

262

current_checker_command: string; current running checker_command

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

259

266

"""

260

267

261

268

@staticmethod

272

279

def interval_milliseconds(self):

273

280

"Return the 'interval' attribute in milliseconds"

274

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

275

285

276

286

def __init__(self, name = None, disable_hook=None, config=None):

277

287

"""Note: the 'checker' key in 'config' sets the

290

300

if u"secret" in config:

291

301

self.secret = config[u"secret"].decode(u"base64")

292

302

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])),

296

"rb")) as secfile:

303

with open(os.path.expanduser(os.path.expandvars

304

(config[u"secfile"])),

305

"rb") as secfile:

297

306

self.secret = secfile.read()

298

307

else:

308

#XXX Need to allow secret on demand!

299

309

raise TypeError(u"No secret or secfile for client %s"

300

310

% self.name)

301

311

self.host = config.get(u"host", u"")

313

323

self.checker_command = config[u"checker"]

314

324

self.current_checker_command = None

315

325

self.last_connect = None

316

326

self.approvals_pending = 0

327

self._approved = None

328

self.approved_by_default = config.get(u"approved_by_default",

329

True)

330

self.approved_delay = string_to_delta(

331

config[u"approved_delay"])

332

self.approved_duration = string_to_delta(

333

config[u"approved_duration"])

334

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

335

336

def send_changedstate(self):

337

self.changedstate.acquire()

338

self.changedstate.notify_all()

339

self.changedstate.release()

340

317

341

def enable(self):

318

342

"""Start this client's checker and timeout hooks"""

319

343

if getattr(self, u"enabled", False):

320

344

# Already enabled

321

345

return

346

self.send_changedstate()

322

347

self.last_enabled = datetime.datetime.utcnow()

323

348

# Schedule a new checker to be started an 'interval' from now,

324

349

# and every interval from then on.

325

350

self.checker_initiator_tag = (gobject.timeout_add

326

351

(self.interval_milliseconds(),

327

352

self.start_checker))

328

# Also start a new checker *right now*.

329

self.start_checker()

330

353

# Schedule a disable() when 'timeout' has passed

331

354

self.disable_initiator_tag = (gobject.timeout_add

332

355

(self.timeout_milliseconds(),

333

356

self.disable))

334

357

self.enabled = True

358

# Also start a new checker *right now*.

359

self.start_checker()

335

360

336

def disable(self):

361

def disable(self, quiet=True):

337

362

"""Disable this client."""

338

363

if not getattr(self, "enabled", False):

339

364

return False

340

logger.info(u"Disabling client %s", self.name)

365

if not quiet:

366

self.send_changedstate()

367

if not quiet:

368

logger.info(u"Disabling client %s", self.name)

341

369

if getattr(self, u"disable_initiator_tag", False):

342

370

gobject.source_remove(self.disable_initiator_tag)

343

371

self.disable_initiator_tag = None

395

423

# client would inevitably timeout, since no checker would get

396

424

# a chance to run to completion. If we instead leave running

397

425

# checkers alone, the checker would have to take more time

398

# than 'timeout' for the client to be declared invalid, which

399

# is as it should be.

426

# than 'timeout' for the client to be disabled, which is as it

427

# should be.

400

428

401

429

# If a checker exists, make sure it is not a zombie

402

430

try:

467

495

logger.debug(u"Stopping checker for %(name)s", vars(self))

468

496

try:

469

497

os.kill(self.checker.pid, signal.SIGTERM)

470

#os.sleep(0.5)

498

#time.sleep(0.5)

471

499

#if self.checker.poll() is None:

472

500

# os.kill(self.checker.pid, signal.SIGKILL)

473

501

except OSError, error:

474

502

if error.errno != errno.ESRCH: # No such process

475

503

raise

476

504

self.checker = None

477

478

def still_valid(self):

479

"""Has the timeout not yet passed for this client?"""

480

if not getattr(self, u"enabled", False):

481

return False

482

now = datetime.datetime.utcnow()

483

if self.last_checked_ok is None:

484

return now < (self.created + self.timeout)

485

else:

486

return now < (self.last_checked_ok + self.timeout)

487

488

505

489

506

def dbus_service_property(dbus_interface, signature=u"v",

490

507

access=u"readwrite", byte_arrays=False):

498

515

dbus.service.method, except there is only "signature", since the

499

516

type from Get() and the type sent to Set() is the same.

500

517

"""

518

# Encoding deeply encoded byte arrays is not supported yet by the

519

# "Set" method, so we fail early here:

520

if byte_arrays and signature != u"ay":

521

raise ValueError(u"Byte arrays not supported for non-'ay'"

522

u" signature %r" % signature)

501

523

def decorator(func):

502

524

func._dbus_is_property = True

503

525

func._dbus_interface = dbus_interface

589

611

if prop._dbus_access == u"read":

590

612

raise DBusPropertyAccessException(property_name)

591

613

if prop._dbus_get_args_options[u"byte_arrays"]:

614

# The byte_arrays option is not supported yet on

615

# signatures other than "ay".

616

if prop._dbus_signature != u"ay":

617

raise ValueError

592

618

value = dbus.ByteArray(''.join(unichr(byte)

593

619

for byte in value))

594

620

prop(value)

705

731

variant_level=1))

706

732

return r

707

733

708

def disable(self, signal = True):

734

def disable(self, quiet = False):

709

735

oldstate = getattr(self, u"enabled", False)

710

r = Client.disable(self)

711

if signal and oldstate != self.enabled:

736

r = Client.disable(self, quiet=quiet)

737

if not quiet and oldstate != self.enabled:

712

738

# Emit D-Bus signal

713

739

self.PropertyChanged(dbus.String(u"enabled"),

714

740

dbus.Boolean(False, variant_level=1))

779

805

self.PropertyChanged(dbus.String(u"checker_running"),

780

806

dbus.Boolean(False, variant_level=1))

781

807

return r

782

783

## D-Bus methods & signals

808

809

def _reset_approved(self):

810

self._approved = None

811

return False

812

813

def approve(self, value=True):

814

self._approved = value

815

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

816

817

def approved_pending(self):

818

return self.approvals_pending > 0

819

820

821

## D-Bus methods, signals & properties

784

822

_interface = u"se.bsnet.fukt.Mandos.Client"

785

823

786

# CheckedOK - method

787

@dbus.service.method(_interface)

788

def CheckedOK(self):

789

return self.checked_ok()

824

## Signals

790

825

791

826

# CheckerCompleted - signal

792

827

@dbus.service.signal(_interface, signature=u"nxs")

810

845

@dbus.service.signal(_interface)

811

846

def GotSecret(self):

812

847

"D-Bus signal"

813

pass

848

if self.approved_pending():

849

self.PropertyChanged(dbus.String(u"checker_running"),

850

dbus.Boolean(False, variant_level=1))

814

851

815

852

# Rejected - signal

816

@dbus.service.signal(_interface)

817

def Rejected(self):

818

"D-Bus signal"

819

pass

853

@dbus.service.signal(_interface, signature=u"s")

854

def Rejected(self, reason):

855

"D-Bus signal"

856

if self.approved_pending():

857

self.PropertyChanged(dbus.String(u"checker_running"),

858

dbus.Boolean(False, variant_level=1))

859

860

# NeedApproval - signal

861

@dbus.service.signal(_interface, signature=u"db")

862

def NeedApproval(self, timeout, default):

863

"D-Bus signal"

864

if not self.approved_pending():

865

self.PropertyChanged(dbus.String(u"approved_pending"),

866

dbus.Boolean(True, variant_level=1))

867

868

## Methods

869

870

# Approve - method

871

@dbus.service.method(_interface, in_signature=u"b")

872

def Approve(self, value):

873

self.approve(value)

874

875

# CheckedOK - method

876

@dbus.service.method(_interface)

877

def CheckedOK(self):

878

return self.checked_ok()

820

879

821

880

# Enable - method

822

881

@dbus.service.method(_interface)

841

900

def StopChecker(self):

842

901

self.stop_checker()

843

902

903

## Properties

904

905

# approved_pending - property

906

@dbus_service_property(_interface, signature=u"b", access=u"read")

907

def approved_pending_dbus_property(self):

908

return dbus.Boolean(self.approved_pending())

909

910

# approved_by_default - property

911

@dbus_service_property(_interface, signature=u"b",

912

access=u"readwrite")

913

def approved_by_default_dbus_property(self):

914

return dbus.Boolean(self.approved_by_default)

915

916

# approved_delay - property

917

@dbus_service_property(_interface, signature=u"t",

918

access=u"readwrite")

919

def approved_delay_dbus_property(self):

920

return dbus.UInt64(self.approved_delay_milliseconds())

921

922

# approved_duration - property

923

@dbus_service_property(_interface, signature=u"t",

924

access=u"readwrite")

925

def approved_duration_dbus_property(self):

926

return dbus.UInt64(self._timedelta_to_milliseconds(

927

self.approved_duration))

928

844

929

# name - property

845

930

@dbus_service_property(_interface, signature=u"s", access=u"read")

846

931

def name_dbus_property(self):

980

1065

del _interface

981

1066

982

1067

1068

class ProxyClient(object):

1069

def __init__(self, child_pipe, fpr, address):

1070

self._pipe = child_pipe

1071

self._pipe.send(('init', fpr, address))

1072

if not self._pipe.recv():

1073

raise KeyError()

1074

1075

def __getattribute__(self, name):

1076

if(name == '_pipe'):

1077

return super(ProxyClient, self).__getattribute__(name)

1078

self._pipe.send(('getattr', name))

1079

data = self._pipe.recv()

1080

if data[0] == 'data':

1081

return data[1]

1082

if data[0] == 'function':

1083

def func(*args, **kwargs):

1084

self._pipe.send(('funcall', name, args, kwargs))

1085

return self._pipe.recv()[1]

1086

return func

1087

1088

def __setattr__(self, name, value):

1089

if(name == '_pipe'):

1090

return super(ProxyClient, self).__setattr__(name, value)

1091

self._pipe.send(('setattr', name, value))

1092

1093

983

1094

class ClientHandler(socketserver.BaseRequestHandler, object):

984

1095

"""A class to handle client connections.

985

1096

987

1098

Note: This will run in its own forked process."""

988

1099

989

1100

def handle(self):

990

logger.info(u"TCP connection from: %s",

991

unicode(self.client_address))

992

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

993

# Open IPC pipe to parent process

994

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1101

with contextlib.closing(self.server.child_pipe) as child_pipe:

1102

logger.info(u"TCP connection from: %s",

1103

unicode(self.client_address))

1104

logger.debug(u"Pipe FD: %d",

1105

self.server.child_pipe.fileno())

1106

995

1107

session = (gnutls.connection

996

1108

.ClientSession(self.request,

997

1109

gnutls.connection

998

1110

.X509Credentials()))

999

1000

line = self.request.makefile().readline()

1001

logger.debug(u"Protocol version: %r", line)

1002

try:

1003

if int(line.strip().split()[0]) > 1:

1004

raise RuntimeError

1005

except (ValueError, IndexError, RuntimeError), error:

1006

logger.error(u"Unknown protocol version: %s", error)

1007

return

1008

1111

1009

1112

# Note: gnutls.connection.X509Credentials is really a

1010

1113

# generic GnuTLS certificate credentials object so long as

1011

1114

# no X.509 keys are added to it. Therefore, we can use it

1012

1115

# here despite using OpenPGP certificates.

1013

1116

1014

1117

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1015

1118

# u"+AES-256-CBC", u"+SHA1",

1016

1119

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1022

1125

(gnutls.library.functions

1023

1126

.gnutls_priority_set_direct(session._c_object,

1024

1127

priority, None))

1025

1128

1129

# Start communication using the Mandos protocol

1130

# Get protocol number

1131

line = self.request.makefile().readline()

1132

logger.debug(u"Protocol version: %r", line)

1133

try:

1134

if int(line.strip().split()[0]) > 1:

1135

raise RuntimeError

1136

except (ValueError, IndexError, RuntimeError), error:

1137

logger.error(u"Unknown protocol version: %s", error)

1138

return

1139

1140

# Start GnuTLS connection

1026

1141

try:

1027

1142

session.handshake()

1028

1143

except gnutls.errors.GNUTLSError, error:

1031

1146

# established. Just abandon the request.

1032

1147

return

1033

1148

logger.debug(u"Handshake succeeded")

1149

1150

approval_required = False

1034

1151

try:

1035

fpr = self.fingerprint(self.peer_certificate(session))

1036

except (TypeError, gnutls.errors.GNUTLSError), error:

1037

logger.warning(u"Bad certificate: %s", error)

1038

session.bye()

1039

return

1040

logger.debug(u"Fingerprint: %s", fpr)

1152

try:

1153

fpr = self.fingerprint(self.peer_certificate

1154

(session))

1155

except (TypeError, gnutls.errors.GNUTLSError), error:

1156

logger.warning(u"Bad certificate: %s", error)

1157

return

1158

logger.debug(u"Fingerprint: %s", fpr)

1159

1160

try:

1161

client = ProxyClient(child_pipe, fpr,

1162

self.client_address)

1163

except KeyError:

1164

return

1165

1166

if client.approved_delay:

1167

delay = client.approved_delay

1168

client.approvals_pending += 1

1169

approval_required = True

1170

1171

while True:

1172

if not client.enabled:

1173

logger.warning(u"Client %s is disabled",

1174

client.name)

1175

if self.server.use_dbus:

1176

# Emit D-Bus signal

1177

client.Rejected("Disabled")

1178

return

1179

1180

if client._approved or not client.approved_delay:

1181

#We are approved or approval is disabled

1182

break

1183

elif client._approved is None:

1184

logger.info(u"Client %s need approval",

1185

client.name)

1186

if self.server.use_dbus:

1187

# Emit D-Bus signal

1188

client.NeedApproval(

1189

client.approved_delay_milliseconds(),

1190

client.approved_by_default)

1191

else:

1192

logger.warning(u"Client %s was not approved",

1193

client.name)

1194

if self.server.use_dbus:

1195

# Emit D-Bus signal

1196

client.Rejected("Disapproved")

1197

return

1198

1199

#wait until timeout or approved

1200

#x = float(client._timedelta_to_milliseconds(delay))

1201

time = datetime.datetime.now()

1202

client.changedstate.acquire()

1203

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1204

client.changedstate.release()

1205

time2 = datetime.datetime.now()

1206

if (time2 - time) >= delay:

1207

if not client.approved_by_default:

1208

logger.warning("Client %s timed out while"

1209

" waiting for approval",

1210

client.name)

1211

if self.server.use_dbus:

1212

# Emit D-Bus signal

1213

client.Rejected("Time out")

1214

return

1215

else:

1216

break

1217

else:

1218

delay -= time2 - time

1219

1220

sent_size = 0

1221

while sent_size < len(client.secret):

1222

# XXX handle session exception

1223

sent = session.send(client.secret[sent_size:])

1224

logger.debug(u"Sent: %d, remaining: %d",

1225

sent, len(client.secret)

1226

- (sent_size + sent))

1227

sent_size += sent

1228

1229

logger.info(u"Sending secret to %s", client.name)

1230

# bump the timeout as if seen

1231

client.checked_ok()

1232

if self.server.use_dbus:

1233

# Emit D-Bus signal

1234

client.GotSecret()

1041

1235

1042

for c in self.server.clients:

1043

if c.fingerprint == fpr:

1044

client = c

1045

break

1046

else:

1047

ipc.write(u"NOTFOUND %s %s\n"

1048

% (fpr, unicode(self.client_address)))

1049

session.bye()

1050

return

1051

# Have to check if client.still_valid(), since it is

1052

# possible that the client timed out while establishing

1053

# the GnuTLS session.

1054

if not client.still_valid():

1055

ipc.write(u"INVALID %s\n" % client.name)

1056

session.bye()

1057

return

1058

ipc.write(u"SENDING %s\n" % client.name)

1059

sent_size = 0

1060

while sent_size < len(client.secret):

1061

sent = session.send(client.secret[sent_size:])

1062

logger.debug(u"Sent: %d, remaining: %d",

1063

sent, len(client.secret)

1064

- (sent_size + sent))

1065

sent_size += sent

1066

session.bye()

1236

finally:

1237

if approval_required:

1238

client.approvals_pending -= 1

1239

session.bye()

1067

1240

1068

1241

@staticmethod

1069

1242

def peer_certificate(session):

1129

1302

return hex_fpr

1130

1303

1131

1304

1132

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1133

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1305

class MultiprocessingMixIn(object):

1306

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1307

def sub_process_main(self, request, address):

1308

try:

1309

self.finish_request(request, address)

1310

except:

1311

self.handle_error(request, address)

1312

self.close_request(request)

1313

1314

def process_request(self, request, address):

1315

"""Start a new process to process the request."""

1316

multiprocessing.Process(target = self.sub_process_main,

1317

args = (request, address)).start()

1318

1319

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1320

""" adds a pipe to the MixIn """

1134

1321

def process_request(self, request, client_address):

1135

1322

"""Overrides and wraps the original process_request().

1136

1323

1137

1324

This function creates a new pipe in self.pipe

1138

1325

"""

1139

self.pipe = os.pipe()

1140

super(ForkingMixInWithPipe,

1326

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1327

1328

super(MultiprocessingMixInWithPipe,

1141

1329

self).process_request(request, client_address)

1142

os.close(self.pipe[1]) # close write end

1143

self.add_pipe(self.pipe[0])

1144

def add_pipe(self, pipe):

1330

self.add_pipe(parent_pipe)

1331

def add_pipe(self, parent_pipe):

1145

1332

"""Dummy function; override as necessary"""

1146

os.close(pipe)

1147

1148

1149

class IPv6_TCPServer(ForkingMixInWithPipe,

1333

pass

1334

1335

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1150

1336

socketserver.TCPServer, object):

1151

1337

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1152

1338

1237

1423

return socketserver.TCPServer.server_activate(self)

1238

1424

def enable(self):

1239

1425

self.enabled = True

1240

def add_pipe(self, pipe):

1426

def add_pipe(self, parent_pipe):

1241

1427

# Call "handle_ipc" for both data and EOF events

1242

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1243

self.handle_ipc)

1244

def handle_ipc(self, source, condition, file_objects={}):

1428

gobject.io_add_watch(parent_pipe.fileno(),

1429

gobject.IO_IN | gobject.IO_HUP,

1430

functools.partial(self.handle_ipc,

1431

parent_pipe = parent_pipe))

1432

1433

def handle_ipc(self, source, condition, parent_pipe=None,

1434

client_object=None):

1245

1435

condition_names = {

1246

1436

gobject.IO_IN: u"IN", # There is data to read.

1247

1437

gobject.IO_OUT: u"OUT", # Data can be written (without

1259

1449

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1260

1450

conditions_string)

1261

1451

1262

# Turn the pipe file descriptor into a Python file object

1263

if source not in file_objects:

1264

file_objects[source] = os.fdopen(source, u"r", 1)

1452

# Read a request from the child

1453

request = parent_pipe.recv()

1454

command = request[0]

1265

1455

1266

# Read a line from the file object

1267

cmdline = file_objects[source].readline()

1268

if not cmdline: # Empty line means end of file

1269

# close the IPC pipe

1270

file_objects[source].close()

1271

del file_objects[source]

1272

1273

# Stop calling this function

1456

if command == 'init':

1457

fpr = request[1]

1458

address = request[2]

1459

1460

for c in self.clients:

1461

if c.fingerprint == fpr:

1462

client = c

1463

break

1464

else:

1465

logger.warning(u"Client not found for fingerprint: %s, ad"

1466

u"dress: %s", fpr, address)

1467

if self.use_dbus:

1468

# Emit D-Bus signal

1469

mandos_dbus_service.ClientNotFound(fpr, address)

1470

parent_pipe.send(False)

1471

return False

1472

1473

gobject.io_add_watch(parent_pipe.fileno(),

1474

gobject.IO_IN | gobject.IO_HUP,

1475

functools.partial(self.handle_ipc,

1476

parent_pipe = parent_pipe,

1477

client_object = client))

1478

parent_pipe.send(True)

1479

# remove the old hook in favor of the new above hook on same fileno

1274

1480

return False

1275

1276

logger.debug(u"IPC command: %r", cmdline)

1277

1278

# Parse and act on command

1279

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1280

1281

if cmd == u"NOTFOUND":

1282

logger.warning(u"Client not found for fingerprint: %s",

1283

args)

1284

if self.use_dbus:

1285

# Emit D-Bus signal

1286

mandos_dbus_service.ClientNotFound(args)

1287

elif cmd == u"INVALID":

1288

for client in self.clients:

1289

if client.name == args:

1290

logger.warning(u"Client %s is invalid", args)

1291

if self.use_dbus:

1292

# Emit D-Bus signal

1293

client.Rejected()

1294

break

1295

else:

1296

logger.error(u"Unknown client %s is invalid", args)

1297

elif cmd == u"SENDING":

1298

for client in self.clients:

1299

if client.name == args:

1300

logger.info(u"Sending secret to %s", client.name)

1301

client.checked_ok()

1302

if self.use_dbus:

1303

# Emit D-Bus signal

1304

client.GotSecret()

1305

break

1306

else:

1307

logger.error(u"Sending secret to unknown client %s",

1308

args)

1309

else:

1310

logger.error(u"Unknown IPC command: %r", cmdline)

1311

1312

# Keep calling this function

1481

if command == 'funcall':

1482

funcname = request[1]

1483

args = request[2]

1484

kwargs = request[3]

1485

1486

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1487

1488

if command == 'getattr':

1489

attrname = request[1]

1490

if callable(client_object.__getattribute__(attrname)):

1491

parent_pipe.send(('function',))

1492

else:

1493

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1494

1495

if command == 'setattr':

1496

attrname = request[1]

1497

value = request[2]

1498

setattr(client_object, attrname, value)

1499

1313

1500

return True

1314

1501

1315

1502

1345

1532

elif suffix == u"w":

1346

1533

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1347

1534

else:

1348

raise ValueError

1349

except (ValueError, IndexError):

1350

raise ValueError

1535

raise ValueError(u"Unknown suffix %r" % suffix)

1536

except (ValueError, IndexError), e:

1537

raise ValueError(e.message)

1351

1538

timevalue += delta

1352

1539

return timevalue

1353

1540

1366

1553

def if_nametoindex(interface):

1367

1554

"Get an interface index the hard way, i.e. using fcntl()"

1368

1555

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1369

with closing(socket.socket()) as s:

1556

with contextlib.closing(socket.socket()) as s:

1370

1557

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1371

1558

struct.pack(str(u"16s16x"),

1372

1559

interface))

1503

1690

u"interval": u"5m",

1504

1691

u"checker": u"fping -q -- %%(host)s",

1505

1692

u"host": u"",

1693

u"approved_delay": u"0s",

1694

u"approved_duration": u"1s",

1506

1695

}

1507

1696

client_config = configparser.SafeConfigParser(client_defaults)

1508

1697

client_config.read(os.path.join(server_settings[u"configdir"],

1566

1755

bus = dbus.SystemBus()

1567

1756

# End of Avahi example code

1568

1757

if use_dbus:

1569

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1758

try:

1759

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1760

bus, do_not_queue=True)

1761

except dbus.exceptions.NameExistsException, e:

1762

logger.error(unicode(e) + u", disabling D-Bus")

1763

use_dbus = False

1764

server_settings[u"use_dbus"] = False

1765

tcp_server.use_dbus = False

1570

1766

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1571

1767

service = AvahiService(name = server_settings[u"servicename"],

1572

1768

servicetype = u"_mandos._tcp",

1578

1774

client_class = Client

1579

1775

if use_dbus:

1580

1776

client_class = functools.partial(ClientDBus, bus = bus)

1777

def client_config_items(config, section):

1778

special_settings = {

1779

"approved_by_default":

1780

lambda: config.getboolean(section,

1781

"approved_by_default"),

1782

}

1783

for name, value in config.items(section):

1784

try:

1785

yield (name, special_settings[name]())

1786

except KeyError:

1787

yield (name, value)

1788

1581

1789

tcp_server.clients.update(set(

1582

1790

client_class(name = section,

1583

config= dict(client_config.items(section)))

1791

config= dict(client_config_items(

1792

client_config, section)))

1584

1793

for section in client_config.sections()))

1585

1794

if not tcp_server.clients:

1586

1795

logger.warning(u"No clients defined")

1598

1807

daemon()

1599

1808

1600

1809

try:

1601

with closing(pidfile):

1810

with pidfile:

1602

1811

pid = os.getpid()

1603

1812

pidfile.write(str(pid) + "\n")

1604

1813

del pidfile

1610

1819

pass

1611

1820

del pidfilename

1612

1821

1613

def cleanup():

1614

"Cleanup function; run on exit"

1615

service.cleanup()

1616

1617

while tcp_server.clients:

1618

client = tcp_server.clients.pop()

1619

client.disable_hook = None

1620

client.disable()

1621

1622

atexit.register(cleanup)

1623

1624

1822

if not debug:

1625

1823

signal.signal(signal.SIGINT, signal.SIG_IGN)

1626

1824

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1633

1831

dbus.service.Object.__init__(self, bus, u"/")

1634

1832

_interface = u"se.bsnet.fukt.Mandos"

1635

1833

1636

@dbus.service.signal(_interface, signature=u"oa{sv}")

1637

def ClientAdded(self, objpath, properties):

1834

@dbus.service.signal(_interface, signature=u"o")

1835

def ClientAdded(self, objpath):

1638

1836

"D-Bus signal"

1639

1837

pass

1640

1838

1641

@dbus.service.signal(_interface, signature=u"s")

1642

def ClientNotFound(self, fingerprint):

1839

@dbus.service.signal(_interface, signature=u"ss")

1840

def ClientNotFound(self, fingerprint, address):

1643

1841

"D-Bus signal"

1644

1842

pass

1645

1843

1671

1869

tcp_server.clients.remove(c)

1672

1870

c.remove_from_connection()

1673

1871

# Don't signal anything except ClientRemoved

1674

c.disable(signal=False)

1872

c.disable(quiet=True)

1675

1873

# Emit D-Bus signal

1676

1874

self.ClientRemoved(object_path, c.name)

1677

1875

return

1678

raise KeyError

1876

raise KeyError(object_path)

1679

1877

1680

1878

del _interface

1681

1879

1682

1880

mandos_dbus_service = MandosDBusService()

1683

1881

1882

def cleanup():

1883

"Cleanup function; run on exit"

1884

service.cleanup()

1885

1886

while tcp_server.clients:

1887

client = tcp_server.clients.pop()

1888

if use_dbus:

1889

client.remove_from_connection()

1890

client.disable_hook = None

1891

# Don't signal anything except ClientRemoved

1892

client.disable(quiet=True)

1893

if use_dbus:

1894

# Emit D-Bus signal

1895

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1896

client.name)

1897

1898

atexit.register(cleanup)

1899

1684

1900

for client in tcp_server.clients:

1685

1901

if use_dbus:

1686

1902

# Emit D-Bus signal

1687

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1688

client.GetAll(u""))

1903

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1689

1904

client.enable()

1690

1905

1691

1906

tcp_server.enable()

1709

1924

service.activate()

1710

1925

except dbus.exceptions.DBusException, error:

1711

1926

logger.critical(u"DBusException: %s", error)

1927

cleanup()

1712

1928

sys.exit(1)

1713

1929

# End of Avahi example code

1714

1930

1721

1937

main_loop.run()

1722

1938

except AvahiError, error:

1723

1939

logger.critical(u"AvahiError: %s", error)

1940

cleanup()

1724

1941

sys.exit(1)

1725

1942

except KeyboardInterrupt:

1726

1943

if debug:

1727

1944

print >> sys.stderr

1728

1945

logger.debug(u"Server received KeyboardInterrupt")

1729

1946

logger.debug(u"Server exiting")

1947

# Must run before the D-Bus bus name gets deregistered

1948

cleanup()

1730

1949

1731

1950

if __name__ == '__main__':

1732

1951

main()