175
125
self.rename_count = 0
176
126
self.max_renames = max_renames
177
self.protocol = protocol
178
self.group = None # our entry group
181
self.entry_group_state_changed_match = None
182
127
def rename(self):
183
128
"""Derived from the Avahi example code"""
184
129
if self.rename_count >= self.max_renames:
185
logger.critical("No suitable Zeroconf service name found"
186
" after %i retries, exiting.",
130
logger.critical(u"No suitable Zeroconf service name found"
131
u" after %i retries, exiting.",
187
132
self.rename_count)
188
raise AvahiServiceError("Too many renames")
189
self.name = unicode(self.server
190
.GetAlternativeServiceName(self.name))
191
logger.info("Changing Zeroconf service name to %r ...",
133
raise AvahiServiceError(u"Too many renames")
134
self.name = server.GetAlternativeServiceName(self.name)
135
logger.info(u"Changing Zeroconf service name to %r ...",
137
syslogger.setFormatter(logging.Formatter
138
('Mandos (%s): %%(levelname)s:'
139
' %%(message)s' % self.name))
196
except dbus.exceptions.DBusException as error:
197
logger.critical("DBusException: %s", error)
200
142
self.rename_count += 1
201
143
def remove(self):
202
144
"""Derived from the Avahi example code"""
203
if self.entry_group_state_changed_match is not None:
204
self.entry_group_state_changed_match.remove()
205
self.entry_group_state_changed_match = None
206
if self.group is not None:
145
if group is not None:
209
148
"""Derived from the Avahi example code"""
211
if self.group is None:
212
self.group = dbus.Interface(
213
self.bus.get_object(avahi.DBUS_NAME,
214
self.server.EntryGroupNew()),
215
avahi.DBUS_INTERFACE_ENTRY_GROUP)
216
self.entry_group_state_changed_match = (
217
self.group.connect_to_signal(
218
'StateChanged', self.entry_group_state_changed))
219
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
220
self.name, self.type)
221
self.group.AddService(
224
dbus.UInt32(0), # flags
225
self.name, self.type,
226
self.domain, self.host,
227
dbus.UInt16(self.port),
228
avahi.string_array_to_txt_array(self.TXT))
230
def entry_group_state_changed(self, state, error):
231
"""Derived from the Avahi example code"""
232
logger.debug("Avahi entry group state change: %i", state)
234
if state == avahi.ENTRY_GROUP_ESTABLISHED:
235
logger.debug("Zeroconf service established.")
236
elif state == avahi.ENTRY_GROUP_COLLISION:
237
logger.info("Zeroconf service name collision.")
239
elif state == avahi.ENTRY_GROUP_FAILURE:
240
logger.critical("Avahi: Error in group state changed %s",
242
raise AvahiGroupError("State changed: %s"
245
"""Derived from the Avahi example code"""
246
if self.group is not None:
249
except (dbus.exceptions.UnknownMethodException,
250
dbus.exceptions.DBusException):
254
def server_state_changed(self, state, error=None):
255
"""Derived from the Avahi example code"""
256
logger.debug("Avahi server state change: %i", state)
257
bad_states = { avahi.SERVER_INVALID:
258
"Zeroconf server invalid",
259
avahi.SERVER_REGISTERING: None,
260
avahi.SERVER_COLLISION:
261
"Zeroconf server name collision",
262
avahi.SERVER_FAILURE:
263
"Zeroconf server failure" }
264
if state in bad_states:
265
if bad_states[state] is not None:
267
logger.error(bad_states[state])
269
logger.error(bad_states[state] + ": %r", error)
271
elif state == avahi.SERVER_RUNNING:
275
logger.debug("Unknown state: %r", state)
277
logger.debug("Unknown state: %r: %r", state, error)
279
"""Derived from the Avahi example code"""
280
if self.server is None:
281
self.server = dbus.Interface(
282
self.bus.get_object(avahi.DBUS_NAME,
283
avahi.DBUS_PATH_SERVER,
284
follow_name_owner_changes=True),
285
avahi.DBUS_INTERFACE_SERVER)
286
self.server.connect_to_signal("StateChanged",
287
self.server_state_changed)
288
self.server_state_changed(self.server.GetState())
290
class AvahiServiceToSyslog(AvahiService):
292
"""Add the new name to the syslog messages"""
293
ret = AvahiService.rename(self)
294
syslogger.setFormatter(logging.Formatter
295
('Mandos (%s) [%%(process)d]:'
296
' %%(levelname)s: %%(message)s'
300
def _timedelta_to_milliseconds(td):
301
"Convert a datetime.timedelta() to milliseconds"
302
return ((td.days * 24 * 60 * 60 * 1000)
303
+ (td.seconds * 1000)
304
+ (td.microseconds // 1000))
306
class Client(object):
151
group = dbus.Interface(bus.get_object
153
server.EntryGroupNew()),
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
155
group.connect_to_signal('StateChanged',
156
entry_group_state_changed)
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
158
service.name, service.type)
160
self.interface, # interface
161
avahi.PROTO_INET6, # protocol
162
dbus.UInt32(0), # flags
163
self.name, self.type,
164
self.domain, self.host,
165
dbus.UInt16(self.port),
166
avahi.string_array_to_txt_array(self.TXT))
169
# From the Avahi example code:
170
group = None # our entry group
171
# End of Avahi example code
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
class Client(dbus.service.Object):
307
180
"""A representation of a client host served by this server.
310
_approved: bool(); 'None' if not yet approved/disapproved
311
approval_delay: datetime.timedelta(); Time to wait for approval
312
approval_duration: datetime.timedelta(); Duration of one approval
182
name: string; from the config file, used in log messages and
184
fingerprint: string (40 or 32 hexadecimal digits); used to
185
uniquely identify the client
186
secret: bytestring; sent verbatim (over TLS) to client
187
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
189
last_enabled: datetime.datetime(); (UTC)
191
last_checked_ok: datetime.datetime(); (UTC) or None
192
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
313
196
checker: subprocess.Popen(); a running checker process used
314
197
to see if the client lives.
315
198
'None' if no process is running.
316
checker_callback_tag: a gobject event source tag, or None
317
checker_command: string; External command which is run to check
318
if client lives. %() expansions are done at
199
checker_initiator_tag: a gobject event source tag, or None
200
disable_initiator_tag: - '' -
201
checker_callback_tag: - '' -
202
checker_command: string; External command which is run to check if
203
client lives. %() expansions are done at
319
204
runtime with vars(self) as dict, so that for
320
205
instance %(name)s can be used in the command.
321
checker_initiator_tag: a gobject event source tag, or None
322
created: datetime.datetime(); (UTC) object creation
323
client_structure: Object describing what attributes a client has
324
and is used for storing the client at exit
325
current_checker_command: string; current running checker_command
326
disable_initiator_tag: a gobject event source tag, or None
328
fingerprint: string (40 or 32 hexadecimal digits); used to
329
uniquely identify the client
330
host: string; available for use by the checker command
331
interval: datetime.timedelta(); How often to start a new checker
332
last_approval_request: datetime.datetime(); (UTC) or None
333
last_checked_ok: datetime.datetime(); (UTC) or None
335
last_checker_status: integer between 0 and 255 reflecting exit
336
status of last checker. -1 reflects crashed
338
last_enabled: datetime.datetime(); (UTC)
339
name: string; from the config file, used in log messages and
341
secret: bytestring; sent verbatim (over TLS) to client
342
timeout: datetime.timedelta(); How long from last_checked_ok
343
until this client is disabled
344
extended_timeout: extra long timeout when password has been sent
345
runtime_expansions: Allowed attributes for runtime expansion.
346
expires: datetime.datetime(); time (UTC) when a client will be
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
350
runtime_expansions = ("approval_delay", "approval_duration",
351
"created", "enabled", "fingerprint",
352
"host", "interval", "last_checked_ok",
353
"last_enabled", "name", "timeout")
355
209
def timeout_milliseconds(self):
356
210
"Return the 'timeout' attribute in milliseconds"
357
return _timedelta_to_milliseconds(self.timeout)
359
def extended_timeout_milliseconds(self):
360
"Return the 'extended_timeout' attribute in milliseconds"
361
return _timedelta_to_milliseconds(self.extended_timeout)
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
363
215
def interval_milliseconds(self):
364
216
"Return the 'interval' attribute in milliseconds"
365
return _timedelta_to_milliseconds(self.interval)
367
def approval_delay_milliseconds(self):
368
return _timedelta_to_milliseconds(self.approval_delay)
370
def __init__(self, name = None, config=None):
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
221
def __init__(self, name = None, disable_hook=None, config=None,
371
223
"""Note: the 'checker' key in 'config' sets the
372
224
'checker_command' attribute and *not* the 'checker'
375
227
if config is None:
377
logger.debug("Creating client %r", self.name)
229
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
378
231
# Uppercase and remove spaces from fingerprint for later
379
232
# comparison purposes with return value from the fingerprint()
381
234
self.fingerprint = (config["fingerprint"].upper()
383
logger.debug(" Fingerprint: %s", self.fingerprint)
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
384
237
if "secret" in config:
385
self.secret = config["secret"].decode("base64")
238
self.secret = config["secret"].decode(u"base64")
386
239
elif "secfile" in config:
387
with open(os.path.expanduser(os.path.expandvars
388
(config["secfile"])),
240
with closing(open(os.path.expanduser
242
(config["secfile"])))) as secfile:
390
243
self.secret = secfile.read()
392
raise TypeError("No secret or secfile for client %s"
245
raise TypeError(u"No secret or secfile for client %s"
394
247
self.host = config.get("host", "")
395
248
self.created = datetime.datetime.utcnow()
397
self.last_approval_request = None
398
self.last_enabled = datetime.datetime.utcnow()
250
self.last_enabled = None
399
251
self.last_checked_ok = None
400
self.last_checker_status = None
401
252
self.timeout = string_to_delta(config["timeout"])
402
self.extended_timeout = string_to_delta(config
403
["extended_timeout"])
404
253
self.interval = string_to_delta(config["interval"])
254
self.disable_hook = disable_hook
405
255
self.checker = None
406
256
self.checker_initiator_tag = None
407
257
self.disable_initiator_tag = None
408
self.expires = datetime.datetime.utcnow() + self.timeout
409
258
self.checker_callback_tag = None
410
259
self.checker_command = config["checker"]
411
self.current_checker_command = None
412
self._approved = None
413
self.approved_by_default = config.get("approved_by_default",
415
self.approvals_pending = 0
416
self.approval_delay = string_to_delta(
417
config["approval_delay"])
418
self.approval_duration = string_to_delta(
419
config["approval_duration"])
420
self.changedstate = (multiprocessing_manager
421
.Condition(multiprocessing_manager
423
self.client_structure = [attr for attr in
424
self.__dict__.iterkeys()
425
if not attr.startswith("_")]
426
self.client_structure.append("client_structure")
428
for name, t in inspect.getmembers(type(self),
432
if not name.startswith("_"):
433
self.client_structure.append(name)
435
# Send notice to process children that client state has changed
436
def send_changedstate(self):
437
with self.changedstate:
438
self.changedstate.notify_all()
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
263
self.use_dbus = use_dbus
265
self.dbus_object_path = (dbus.ObjectPath
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
440
271
def enable(self):
441
272
"""Start this client's checker and timeout hooks"""
442
if getattr(self, "enabled", False):
445
self.send_changedstate()
446
self.expires = datetime.datetime.utcnow() + self.timeout
273
self.last_enabled = datetime.datetime.utcnow()
274
# Schedule a new checker to be started an 'interval' from now,
275
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
279
# Also start a new checker *right now*.
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
447
285
self.enabled = True
448
self.last_enabled = datetime.datetime.utcnow()
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
451
def disable(self, quiet=True):
452
295
"""Disable this client."""
453
296
if not getattr(self, "enabled", False):
456
self.send_changedstate()
458
logger.info("Disabling client %s", self.name)
298
logger.info(u"Disabling client %s", self.name)
459
299
if getattr(self, "disable_initiator_tag", False):
460
300
gobject.source_remove(self.disable_initiator_tag)
461
301
self.disable_initiator_tag = None
463
302
if getattr(self, "checker_initiator_tag", False):
464
303
gobject.source_remove(self.checker_initiator_tag)
465
304
self.checker_initiator_tag = None
466
305
self.stop_checker()
306
if self.disable_hook:
307
self.disable_hook(self)
467
308
self.enabled = False
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
468
313
# Do not run this again if called by a gobject.timeout_add
471
316
def __del__(self):
317
self.disable_hook = None
474
def init_checker(self):
475
# Schedule a new checker to be started an 'interval' from now,
476
# and every interval from then on.
477
self.checker_initiator_tag = (gobject.timeout_add
478
(self.interval_milliseconds(),
480
# Schedule a disable() when 'timeout' has passed
481
self.disable_initiator_tag = (gobject.timeout_add
482
(self.timeout_milliseconds(),
484
# Also start a new checker *right now*.
487
320
def checker_callback(self, pid, condition, command):
488
321
"""The checker has completed, so take appropriate actions."""
489
322
self.checker_callback_tag = None
490
323
self.checker = None
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
491
328
if os.WIFEXITED(condition):
492
self.last_checker_status = os.WEXITSTATUS(condition)
493
if self.last_checker_status == 0:
494
logger.info("Checker for %(name)s succeeded",
329
exitstatus = os.WEXITSTATUS(condition)
331
logger.info(u"Checker for %(name)s succeeded",
496
333
self.checked_ok()
498
logger.info("Checker for %(name)s failed",
335
logger.info(u"Checker for %(name)s failed",
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
501
self.last_checker_status = -1
502
logger.warning("Checker for %(name)s crashed?",
343
logger.warning(u"Checker for %(name)s crashed?",
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
505
def checked_ok(self, timeout=None):
351
def checked_ok(self):
506
352
"""Bump up the timeout for this client.
508
353
This should only be called when the client has been seen,
512
timeout = self.timeout
513
356
self.last_checked_ok = datetime.datetime.utcnow()
514
if self.disable_initiator_tag is not None:
515
gobject.source_remove(self.disable_initiator_tag)
516
if getattr(self, "enabled", False):
517
self.disable_initiator_tag = (gobject.timeout_add
518
(_timedelta_to_milliseconds
519
(timeout), self.disable))
520
self.expires = datetime.datetime.utcnow() + timeout
522
def need_approval(self):
523
self.last_approval_request = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
525
368
def start_checker(self):
526
369
"""Start a new checker subprocess if one is not running.
528
370
If a checker already exists, leave it running and do
530
372
# The reason for not killing a running checker is that if we
604
425
self.checker_callback_tag = None
605
426
if getattr(self, "checker", None) is None:
607
logger.debug("Stopping checker for %(name)s", vars(self))
428
logger.debug(u"Stopping checker for %(name)s", vars(self))
609
430
os.kill(self.checker.pid, signal.SIGTERM)
611
432
#if self.checker.poll() is None:
612
433
# os.kill(self.checker.pid, signal.SIGKILL)
613
except OSError as error:
434
except OSError, error:
614
435
if error.errno != errno.ESRCH: # No such process
616
437
self.checker = None
618
# Encrypts a client secret and stores it in a varible
620
def encrypt_secret(self, key):
621
# Encryption-key need to be of a specific size, so we hash
623
hasheng = hashlib.sha256()
625
encryptionkey = hasheng.digest()
627
# Create validation hash so we know at decryption if it was
629
hasheng = hashlib.sha256()
630
hasheng.update(self.secret)
631
validationhash = hasheng.digest()
634
iv = os.urandom(Crypto.Cipher.AES.block_size)
635
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
636
Crypto.Cipher.AES.MODE_CFB,
638
ciphertext = ciphereng.encrypt(validationhash+self.secret)
639
self.encrypted_secret = (ciphertext, iv)
641
# Decrypt a encrypted client secret
642
def decrypt_secret(self, key):
643
# Decryption-key need to be of a specific size, so we hash inputed key
644
hasheng = hashlib.sha256()
646
encryptionkey = hasheng.digest()
648
# Decrypt encrypted secret
649
ciphertext, iv = self.encrypted_secret
650
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
651
Crypto.Cipher.AES.MODE_CFB,
653
plain = ciphereng.decrypt(ciphertext)
655
# Validate decrypted secret to know if it was succesful
656
hasheng = hashlib.sha256()
657
validationhash = plain[:hasheng.digest_size]
658
secret = plain[hasheng.digest_size:]
659
hasheng.update(secret)
661
# if validation fails, we use key as new secret. Otherwhise,
662
# we use the decrypted secret
663
if hasheng.digest() == validationhash:
667
del self.encrypted_secret
670
def dbus_service_property(dbus_interface, signature="v",
671
access="readwrite", byte_arrays=False):
672
"""Decorators for marking methods of a DBusObjectWithProperties to
673
become properties on the D-Bus.
675
The decorated method will be called with no arguments by "Get"
676
and with one argument by "Set".
678
The parameters, where they are supported, are the same as
679
dbus.service.method, except there is only "signature", since the
680
type from Get() and the type sent to Set() is the same.
682
# Encoding deeply encoded byte arrays is not supported yet by the
683
# "Set" method, so we fail early here:
684
if byte_arrays and signature != "ay":
685
raise ValueError("Byte arrays not supported for non-'ay'"
686
" signature %r" % signature)
688
func._dbus_is_property = True
689
func._dbus_interface = dbus_interface
690
func._dbus_signature = signature
691
func._dbus_access = access
692
func._dbus_name = func.__name__
693
if func._dbus_name.endswith("_dbus_property"):
694
func._dbus_name = func._dbus_name[:-14]
695
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
700
class DBusPropertyException(dbus.exceptions.DBusException):
701
"""A base class for D-Bus property-related exceptions
703
def __unicode__(self):
704
return unicode(str(self))
707
class DBusPropertyAccessException(DBusPropertyException):
708
"""A property's access permissions disallows an operation.
713
class DBusPropertyNotFound(DBusPropertyException):
714
"""An attempt was made to access a non-existing property.
719
class DBusObjectWithProperties(dbus.service.Object):
720
"""A D-Bus object with properties.
722
Classes inheriting from this can use the dbus_service_property
723
decorator to expose methods as D-Bus properties. It exposes the
724
standard Get(), Set(), and GetAll() methods on the D-Bus.
728
def _is_dbus_property(obj):
729
return getattr(obj, "_dbus_is_property", False)
731
def _get_all_dbus_properties(self):
732
"""Returns a generator of (name, attribute) pairs
734
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
735
for cls in self.__class__.__mro__
737
inspect.getmembers(cls, self._is_dbus_property))
739
def _get_dbus_property(self, interface_name, property_name):
740
"""Returns a bound method if one exists which is a D-Bus
741
property with the specified name and interface.
743
for cls in self.__class__.__mro__:
744
for name, value in (inspect.getmembers
745
(cls, self._is_dbus_property)):
746
if (value._dbus_name == property_name
747
and value._dbus_interface == interface_name):
748
return value.__get__(self)
751
raise DBusPropertyNotFound(self.dbus_object_path + ":"
752
+ interface_name + "."
755
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
757
def Get(self, interface_name, property_name):
758
"""Standard D-Bus property Get() method, see D-Bus standard.
760
prop = self._get_dbus_property(interface_name, property_name)
761
if prop._dbus_access == "write":
762
raise DBusPropertyAccessException(property_name)
764
if not hasattr(value, "variant_level"):
766
return type(value)(value, variant_level=value.variant_level+1)
768
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
769
def Set(self, interface_name, property_name, value):
770
"""Standard D-Bus property Set() method, see D-Bus standard.
772
prop = self._get_dbus_property(interface_name, property_name)
773
if prop._dbus_access == "read":
774
raise DBusPropertyAccessException(property_name)
775
if prop._dbus_get_args_options["byte_arrays"]:
776
# The byte_arrays option is not supported yet on
777
# signatures other than "ay".
778
if prop._dbus_signature != "ay":
780
value = dbus.ByteArray(''.join(unichr(byte)
784
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
785
out_signature="a{sv}")
786
def GetAll(self, interface_name):
787
"""Standard D-Bus property GetAll() method, see D-Bus
790
Note: Will not include properties with access="write".
793
for name, prop in self._get_all_dbus_properties():
795
and interface_name != prop._dbus_interface):
796
# Interface non-empty but did not match
798
# Ignore write-only properties
799
if prop._dbus_access == "write":
802
if not hasattr(value, "variant_level"):
803
properties[name] = value
805
properties[name] = type(value)(value, variant_level=
806
value.variant_level+1)
807
return dbus.Dictionary(properties, signature="sv")
809
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
811
path_keyword='object_path',
812
connection_keyword='connection')
813
def Introspect(self, object_path, connection):
814
"""Standard D-Bus method, overloaded to insert property tags.
816
xmlstring = dbus.service.Object.Introspect(self, object_path,
819
document = xml.dom.minidom.parseString(xmlstring)
820
def make_tag(document, name, prop):
821
e = document.createElement("property")
822
e.setAttribute("name", name)
823
e.setAttribute("type", prop._dbus_signature)
824
e.setAttribute("access", prop._dbus_access)
826
for if_tag in document.getElementsByTagName("interface"):
827
for tag in (make_tag(document, name, prop)
829
in self._get_all_dbus_properties()
830
if prop._dbus_interface
831
== if_tag.getAttribute("name")):
832
if_tag.appendChild(tag)
833
# Add the names to the return values for the
834
# "org.freedesktop.DBus.Properties" methods
835
if (if_tag.getAttribute("name")
836
== "org.freedesktop.DBus.Properties"):
837
for cn in if_tag.getElementsByTagName("method"):
838
if cn.getAttribute("name") == "Get":
839
for arg in cn.getElementsByTagName("arg"):
840
if (arg.getAttribute("direction")
842
arg.setAttribute("name", "value")
843
elif cn.getAttribute("name") == "GetAll":
844
for arg in cn.getElementsByTagName("arg"):
845
if (arg.getAttribute("direction")
847
arg.setAttribute("name", "props")
848
xmlstring = document.toxml("utf-8")
850
except (AttributeError, xml.dom.DOMException,
851
xml.parsers.expat.ExpatError) as error:
852
logger.error("Failed to override Introspection method",
857
def datetime_to_dbus (dt, variant_level=0):
858
"""Convert a UTC datetime.datetime() to a D-Bus type."""
860
return dbus.String("", variant_level = variant_level)
861
return dbus.String(dt.isoformat(),
862
variant_level=variant_level)
865
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
867
"""Applied to an empty subclass of a D-Bus object, this metaclass
868
will add additional D-Bus attributes matching a certain pattern.
870
def __new__(mcs, name, bases, attr):
871
# Go through all the base classes which could have D-Bus
872
# methods, signals, or properties in them
873
for base in (b for b in bases
874
if issubclass(b, dbus.service.Object)):
875
# Go though all attributes of the base class
876
for attrname, attribute in inspect.getmembers(base):
877
# Ignore non-D-Bus attributes, and D-Bus attributes
878
# with the wrong interface name
879
if (not hasattr(attribute, "_dbus_interface")
880
or not attribute._dbus_interface
881
.startswith("se.recompile.Mandos")):
883
# Create an alternate D-Bus interface name based on
885
alt_interface = (attribute._dbus_interface
886
.replace("se.recompile.Mandos",
887
"se.bsnet.fukt.Mandos"))
888
# Is this a D-Bus signal?
889
if getattr(attribute, "_dbus_is_signal", False):
890
# Extract the original non-method function by
892
nonmethod_func = (dict(
893
zip(attribute.func_code.co_freevars,
894
attribute.__closure__))["func"]
896
# Create a new, but exactly alike, function
897
# object, and decorate it to be a new D-Bus signal
898
# with the alternate D-Bus interface name
899
new_function = (dbus.service.signal
901
attribute._dbus_signature)
903
nonmethod_func.func_code,
904
nonmethod_func.func_globals,
905
nonmethod_func.func_name,
906
nonmethod_func.func_defaults,
907
nonmethod_func.func_closure)))
908
# Define a creator of a function to call both the
909
# old and new functions, so both the old and new
910
# signals gets sent when the function is called
911
def fixscope(func1, func2):
912
"""This function is a scope container to pass
913
func1 and func2 to the "call_both" function
914
outside of its arguments"""
915
def call_both(*args, **kwargs):
916
"""This function will emit two D-Bus
917
signals by calling func1 and func2"""
918
func1(*args, **kwargs)
919
func2(*args, **kwargs)
921
# Create the "call_both" function and add it to
923
attr[attrname] = fixscope(attribute,
925
# Is this a D-Bus method?
926
elif getattr(attribute, "_dbus_is_method", False):
927
# Create a new, but exactly alike, function
928
# object. Decorate it to be a new D-Bus method
929
# with the alternate D-Bus interface name. Add it
931
attr[attrname] = (dbus.service.method
933
attribute._dbus_in_signature,
934
attribute._dbus_out_signature)
936
(attribute.func_code,
937
attribute.func_globals,
939
attribute.func_defaults,
940
attribute.func_closure)))
941
# Is this a D-Bus property?
942
elif getattr(attribute, "_dbus_is_property", False):
943
# Create a new, but exactly alike, function
944
# object, and decorate it to be a new D-Bus
945
# property with the alternate D-Bus interface
946
# name. Add it to the class.
947
attr[attrname] = (dbus_service_property
949
attribute._dbus_signature,
950
attribute._dbus_access,
952
._dbus_get_args_options
955
(attribute.func_code,
956
attribute.func_globals,
958
attribute.func_defaults,
959
attribute.func_closure)))
960
return type.__new__(mcs, name, bases, attr)
963
class ClientDBus(Client, DBusObjectWithProperties):
964
"""A Client class using D-Bus
967
dbus_object_path: dbus.ObjectPath
968
bus: dbus.SystemBus()
971
runtime_expansions = (Client.runtime_expansions
972
+ ("dbus_object_path",))
974
# dbus.service.Object doesn't use super(), so we can't either.
976
def __init__(self, bus = None, *args, **kwargs):
978
Client.__init__(self, *args, **kwargs)
980
self._approvals_pending = 0
981
# Only now, when this client is initialized, can it show up on
983
client_object_name = unicode(self.name).translate(
986
self.dbus_object_path = (dbus.ObjectPath
987
("/clients/" + client_object_name))
988
DBusObjectWithProperties.__init__(self, self.bus,
989
self.dbus_object_path)
991
def notifychangeproperty(transform_func,
992
dbus_name, type_func=lambda x: x,
994
""" Modify a variable so that it's a property which announces
997
transform_fun: Function that takes a value and a variant_level
998
and transforms it to a D-Bus type.
999
dbus_name: D-Bus name of the variable
1000
type_func: Function that transform the value before sending it
1001
to the D-Bus. Default: no transform
1002
variant_level: D-Bus variant level. Default: 1
1004
attrname = "_{0}".format(dbus_name)
1005
def setter(self, value):
1006
if hasattr(self, "dbus_object_path"):
1007
if (not hasattr(self, attrname) or
1008
type_func(getattr(self, attrname, None))
1009
!= type_func(value)):
1010
dbus_value = transform_func(type_func(value),
1013
self.PropertyChanged(dbus.String(dbus_name),
1015
setattr(self, attrname, value)
1017
return property(lambda self: getattr(self, attrname), setter)
1020
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1021
approvals_pending = notifychangeproperty(dbus.Boolean,
1024
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1025
last_enabled = notifychangeproperty(datetime_to_dbus,
1027
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1028
type_func = lambda checker:
1029
checker is not None)
1030
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1032
last_approval_request = notifychangeproperty(
1033
datetime_to_dbus, "LastApprovalRequest")
1034
approved_by_default = notifychangeproperty(dbus.Boolean,
1035
"ApprovedByDefault")
1036
approval_delay = notifychangeproperty(dbus.UInt16,
1039
_timedelta_to_milliseconds)
1040
approval_duration = notifychangeproperty(
1041
dbus.UInt16, "ApprovalDuration",
1042
type_func = _timedelta_to_milliseconds)
1043
host = notifychangeproperty(dbus.String, "Host")
1044
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1046
_timedelta_to_milliseconds)
1047
extended_timeout = notifychangeproperty(
1048
dbus.UInt16, "ExtendedTimeout",
1049
type_func = _timedelta_to_milliseconds)
1050
interval = notifychangeproperty(dbus.UInt16,
1053
_timedelta_to_milliseconds)
1054
checker_command = notifychangeproperty(dbus.String, "Checker")
1056
del notifychangeproperty
1058
def __del__(self, *args, **kwargs):
1060
self.remove_from_connection()
1063
if hasattr(DBusObjectWithProperties, "__del__"):
1064
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1065
Client.__del__(self, *args, **kwargs)
1067
def checker_callback(self, pid, condition, command,
1069
self.checker_callback_tag = None
1071
if os.WIFEXITED(condition):
1072
exitstatus = os.WEXITSTATUS(condition)
1074
self.CheckerCompleted(dbus.Int16(exitstatus),
1075
dbus.Int64(condition),
1076
dbus.String(command))
1079
self.CheckerCompleted(dbus.Int16(-1),
1080
dbus.Int64(condition),
1081
dbus.String(command))
1083
return Client.checker_callback(self, pid, condition, command,
1086
def start_checker(self, *args, **kwargs):
1087
old_checker = self.checker
1088
if self.checker is not None:
1089
old_checker_pid = self.checker.pid
1091
old_checker_pid = None
1092
r = Client.start_checker(self, *args, **kwargs)
1093
# Only if new checker process was started
1094
if (self.checker is not None
1095
and old_checker_pid != self.checker.pid):
1097
self.CheckerStarted(self.current_checker_command)
1100
def _reset_approved(self):
1101
self._approved = None
1104
def approve(self, value=True):
1105
self.send_changedstate()
1106
self._approved = value
1107
gobject.timeout_add(_timedelta_to_milliseconds
1108
(self.approval_duration),
1109
self._reset_approved)
1112
## D-Bus methods, signals & properties
1113
_interface = "se.recompile.Mandos.Client"
439
self.PropertyChanged(dbus.String(u"checker_running"),
440
dbus.Boolean(False, variant_level=1))
442
def still_valid(self):
443
"""Has the timeout not yet passed for this client?"""
444
if not getattr(self, "enabled", False):
446
now = datetime.datetime.utcnow()
447
if self.last_checked_ok is None:
448
return now < (self.created + self.timeout)
450
return now < (self.last_checked_ok + self.timeout)
452
## D-Bus methods & signals
453
_interface = u"se.bsnet.fukt.Mandos.Client"
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
1117
459
# CheckerCompleted - signal
1118
460
@dbus.service.signal(_interface, signature="nxs")
1194
584
# StopChecker - method
1195
@dbus.service.method(_interface)
1196
def StopChecker(self):
1201
# ApprovalPending - property
1202
@dbus_service_property(_interface, signature="b", access="read")
1203
def ApprovalPending_dbus_property(self):
1204
return dbus.Boolean(bool(self.approvals_pending))
1206
# ApprovedByDefault - property
1207
@dbus_service_property(_interface, signature="b",
1209
def ApprovedByDefault_dbus_property(self, value=None):
1210
if value is None: # get
1211
return dbus.Boolean(self.approved_by_default)
1212
self.approved_by_default = bool(value)
1214
# ApprovalDelay - property
1215
@dbus_service_property(_interface, signature="t",
1217
def ApprovalDelay_dbus_property(self, value=None):
1218
if value is None: # get
1219
return dbus.UInt64(self.approval_delay_milliseconds())
1220
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1222
# ApprovalDuration - property
1223
@dbus_service_property(_interface, signature="t",
1225
def ApprovalDuration_dbus_property(self, value=None):
1226
if value is None: # get
1227
return dbus.UInt64(_timedelta_to_milliseconds(
1228
self.approval_duration))
1229
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1232
@dbus_service_property(_interface, signature="s", access="read")
1233
def Name_dbus_property(self):
1234
return dbus.String(self.name)
1236
# Fingerprint - property
1237
@dbus_service_property(_interface, signature="s", access="read")
1238
def Fingerprint_dbus_property(self):
1239
return dbus.String(self.fingerprint)
1242
@dbus_service_property(_interface, signature="s",
1244
def Host_dbus_property(self, value=None):
1245
if value is None: # get
1246
return dbus.String(self.host)
1249
# Created - property
1250
@dbus_service_property(_interface, signature="s", access="read")
1251
def Created_dbus_property(self):
1252
return dbus.String(datetime_to_dbus(self.created))
1254
# LastEnabled - property
1255
@dbus_service_property(_interface, signature="s", access="read")
1256
def LastEnabled_dbus_property(self):
1257
return datetime_to_dbus(self.last_enabled)
1259
# Enabled - property
1260
@dbus_service_property(_interface, signature="b",
1262
def Enabled_dbus_property(self, value=None):
1263
if value is None: # get
1264
return dbus.Boolean(self.enabled)
1270
# LastCheckedOK - property
1271
@dbus_service_property(_interface, signature="s",
1273
def LastCheckedOK_dbus_property(self, value=None):
1274
if value is not None:
1277
return datetime_to_dbus(self.last_checked_ok)
1279
# Expires - property
1280
@dbus_service_property(_interface, signature="s", access="read")
1281
def Expires_dbus_property(self):
1282
return datetime_to_dbus(self.expires)
1284
# LastApprovalRequest - property
1285
@dbus_service_property(_interface, signature="s", access="read")
1286
def LastApprovalRequest_dbus_property(self):
1287
return datetime_to_dbus(self.last_approval_request)
1289
# Timeout - property
1290
@dbus_service_property(_interface, signature="t",
1292
def Timeout_dbus_property(self, value=None):
1293
if value is None: # get
1294
return dbus.UInt64(self.timeout_milliseconds())
1295
self.timeout = datetime.timedelta(0, 0, 0, value)
1296
if getattr(self, "disable_initiator_tag", None) is None:
1298
# Reschedule timeout
1299
gobject.source_remove(self.disable_initiator_tag)
1300
self.disable_initiator_tag = None
1302
time_to_die = _timedelta_to_milliseconds((self
1307
if time_to_die <= 0:
1308
# The timeout has passed
1311
self.expires = (datetime.datetime.utcnow()
1312
+ datetime.timedelta(milliseconds =
1314
self.disable_initiator_tag = (gobject.timeout_add
1315
(time_to_die, self.disable))
1317
# ExtendedTimeout - property
1318
@dbus_service_property(_interface, signature="t",
1320
def ExtendedTimeout_dbus_property(self, value=None):
1321
if value is None: # get
1322
return dbus.UInt64(self.extended_timeout_milliseconds())
1323
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1325
# Interval - property
1326
@dbus_service_property(_interface, signature="t",
1328
def Interval_dbus_property(self, value=None):
1329
if value is None: # get
1330
return dbus.UInt64(self.interval_milliseconds())
1331
self.interval = datetime.timedelta(0, 0, 0, value)
1332
if getattr(self, "checker_initiator_tag", None) is None:
1334
# Reschedule checker run
1335
gobject.source_remove(self.checker_initiator_tag)
1336
self.checker_initiator_tag = (gobject.timeout_add
1337
(value, self.start_checker))
1338
self.start_checker() # Start one now, too
1340
# Checker - property
1341
@dbus_service_property(_interface, signature="s",
1343
def Checker_dbus_property(self, value=None):
1344
if value is None: # get
1345
return dbus.String(self.checker_command)
1346
self.checker_command = value
1348
# CheckerRunning - property
1349
@dbus_service_property(_interface, signature="b",
1351
def CheckerRunning_dbus_property(self, value=None):
1352
if value is None: # get
1353
return dbus.Boolean(self.checker is not None)
1355
self.start_checker()
1359
# ObjectPath - property
1360
@dbus_service_property(_interface, signature="o", access="read")
1361
def ObjectPath_dbus_property(self):
1362
return self.dbus_object_path # is already a dbus.ObjectPath
1365
@dbus_service_property(_interface, signature="ay",
1366
access="write", byte_arrays=True)
1367
def Secret_dbus_property(self, value):
1368
self.secret = str(value)
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
1373
class ProxyClient(object):
1374
def __init__(self, child_pipe, fpr, address):
1375
self._pipe = child_pipe
1376
self._pipe.send(('init', fpr, address))
1377
if not self._pipe.recv():
1380
def __getattribute__(self, name):
1381
if(name == '_pipe'):
1382
return super(ProxyClient, self).__getattribute__(name)
1383
self._pipe.send(('getattr', name))
1384
data = self._pipe.recv()
1385
if data[0] == 'data':
1387
if data[0] == 'function':
1388
def func(*args, **kwargs):
1389
self._pipe.send(('funcall', name, args, kwargs))
1390
return self._pipe.recv()[1]
1393
def __setattr__(self, name, value):
1394
if(name == '_pipe'):
1395
return super(ProxyClient, self).__setattr__(name, value)
1396
self._pipe.send(('setattr', name, value))
1399
class ClientDBusTransitional(ClientDBus):
1400
__metaclass__ = AlternateDBusNamesMetaclass
1403
class ClientHandler(socketserver.BaseRequestHandler, object):
1404
"""A class to handle client connections.
1406
Instantiated once for each connection to handle it.
591
def peer_certificate(session):
592
"Return the peer's OpenPGP certificate as a bytestring"
593
# If not an OpenPGP certificate...
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
597
# ...do the normal thing
598
return session.peer_certificate
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
606
if list_size.value == 0:
609
return ctypes.string_at(cert.data, cert.size)
612
def fingerprint(openpgp):
613
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
614
# New GnuTLS "datum" with the OpenPGP public key
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
619
ctypes.c_uint(len(openpgp))))
620
# New empty GnuTLS certificate
621
crt = gnutls.library.types.gnutls_openpgp_crt_t()
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
624
# Import the OpenPGP public key into the certificate
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
629
# Verify the self signature in the key
630
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
633
if crtverify.value != 0:
634
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
635
raise gnutls.errors.CertificateSecurityError("Verify failed")
636
# New buffer for the fingerprint
637
buf = ctypes.create_string_buffer(20)
638
buf_len = ctypes.c_size_t()
639
# Get the fingerprint from the certificate into the buffer
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
643
# Deinit the certificate
644
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
645
# Convert the buffer to a Python bytestring
646
fpr = ctypes.string_at(buf, buf_len.value)
647
# Convert the bytestring to hexadecimal notation
648
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
652
class TCP_handler(SocketServer.BaseRequestHandler, object):
653
"""A TCP request handler class.
654
Instantiated by IPv6_TCPServer for each request to handle it.
1407
655
Note: This will run in its own forked process."""
1409
657
def handle(self):
1410
with contextlib.closing(self.server.child_pipe) as child_pipe:
1411
logger.info("TCP connection from: %s",
1412
unicode(self.client_address))
1413
logger.debug("Pipe FD: %d",
1414
self.server.child_pipe.fileno())
1416
session = (gnutls.connection
1417
.ClientSession(self.request,
1419
.X509Credentials()))
1421
# Note: gnutls.connection.X509Credentials is really a
1422
# generic GnuTLS certificate credentials object so long as
1423
# no X.509 keys are added to it. Therefore, we can use it
1424
# here despite using OpenPGP certificates.
1426
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1427
# "+AES-256-CBC", "+SHA1",
1428
# "+COMP-NULL", "+CTYPE-OPENPGP",
1430
# Use a fallback default, since this MUST be set.
1431
priority = self.server.gnutls_priority
1432
if priority is None:
1434
(gnutls.library.functions
1435
.gnutls_priority_set_direct(session._c_object,
1438
# Start communication using the Mandos protocol
1439
# Get protocol number
1440
line = self.request.makefile().readline()
1441
logger.debug("Protocol version: %r", line)
1443
if int(line.strip().split()[0]) > 1:
1445
except (ValueError, IndexError, RuntimeError) as error:
1446
logger.error("Unknown protocol version: %s", error)
1449
# Start GnuTLS connection
1452
except gnutls.errors.GNUTLSError as error:
1453
logger.warning("Handshake failed: %s", error)
1454
# Do not run session.bye() here: the session is not
1455
# established. Just abandon the request.
1457
logger.debug("Handshake succeeded")
1459
approval_required = False
1462
fpr = self.fingerprint(self.peer_certificate
1465
gnutls.errors.GNUTLSError) as error:
1466
logger.warning("Bad certificate: %s", error)
1468
logger.debug("Fingerprint: %s", fpr)
1469
if self.server.use_dbus:
1471
client.NewRequest(str(self.client_address))
1474
client = ProxyClient(child_pipe, fpr,
1475
self.client_address)
1479
if client.approval_delay:
1480
delay = client.approval_delay
1481
client.approvals_pending += 1
1482
approval_required = True
1485
if not client.enabled:
1486
logger.info("Client %s is disabled",
1488
if self.server.use_dbus:
1490
client.Rejected("Disabled")
1493
if client._approved or not client.approval_delay:
1494
#We are approved or approval is disabled
1496
elif client._approved is None:
1497
logger.info("Client %s needs approval",
1499
if self.server.use_dbus:
1501
client.NeedApproval(
1502
client.approval_delay_milliseconds(),
1503
client.approved_by_default)
1505
logger.warning("Client %s was not approved",
1507
if self.server.use_dbus:
1509
client.Rejected("Denied")
1512
#wait until timeout or approved
1513
time = datetime.datetime.now()
1514
client.changedstate.acquire()
1515
(client.changedstate.wait
1516
(float(client._timedelta_to_milliseconds(delay)
1518
client.changedstate.release()
1519
time2 = datetime.datetime.now()
1520
if (time2 - time) >= delay:
1521
if not client.approved_by_default:
1522
logger.warning("Client %s timed out while"
1523
" waiting for approval",
1525
if self.server.use_dbus:
1527
client.Rejected("Approval timed out")
1532
delay -= time2 - time
1535
while sent_size < len(client.secret):
1537
sent = session.send(client.secret[sent_size:])
1538
except gnutls.errors.GNUTLSError as error:
1539
logger.warning("gnutls send failed")
1541
logger.debug("Sent: %d, remaining: %d",
1542
sent, len(client.secret)
1543
- (sent_size + sent))
1546
logger.info("Sending secret to %s", client.name)
1547
# bump the timeout using extended_timeout
1548
client.checked_ok(client.extended_timeout)
1549
if self.server.use_dbus:
1554
if approval_required:
1555
client.approvals_pending -= 1
1558
except gnutls.errors.GNUTLSError as error:
1559
logger.warning("GnuTLS bye failed")
1562
def peer_certificate(session):
1563
"Return the peer's OpenPGP certificate as a bytestring"
1564
# If not an OpenPGP certificate...
1565
if (gnutls.library.functions
1566
.gnutls_certificate_type_get(session._c_object)
1567
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1568
# ...do the normal thing
1569
return session.peer_certificate
1570
list_size = ctypes.c_uint(1)
1571
cert_list = (gnutls.library.functions
1572
.gnutls_certificate_get_peers
1573
(session._c_object, ctypes.byref(list_size)))
1574
if not bool(cert_list) and list_size.value != 0:
1575
raise gnutls.errors.GNUTLSError("error getting peer"
1577
if list_size.value == 0:
1580
return ctypes.string_at(cert.data, cert.size)
1583
def fingerprint(openpgp):
1584
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1585
# New GnuTLS "datum" with the OpenPGP public key
1586
datum = (gnutls.library.types
1587
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1590
ctypes.c_uint(len(openpgp))))
1591
# New empty GnuTLS certificate
1592
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1593
(gnutls.library.functions
1594
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1595
# Import the OpenPGP public key into the certificate
1596
(gnutls.library.functions
1597
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1598
gnutls.library.constants
1599
.GNUTLS_OPENPGP_FMT_RAW))
1600
# Verify the self signature in the key
1601
crtverify = ctypes.c_uint()
1602
(gnutls.library.functions
1603
.gnutls_openpgp_crt_verify_self(crt, 0,
1604
ctypes.byref(crtverify)))
1605
if crtverify.value != 0:
1606
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1607
raise (gnutls.errors.CertificateSecurityError
1609
# New buffer for the fingerprint
1610
buf = ctypes.create_string_buffer(20)
1611
buf_len = ctypes.c_size_t()
1612
# Get the fingerprint from the certificate into the buffer
1613
(gnutls.library.functions
1614
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1615
ctypes.byref(buf_len)))
1616
# Deinit the certificate
1617
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1618
# Convert the buffer to a Python bytestring
1619
fpr = ctypes.string_at(buf, buf_len.value)
1620
# Convert the bytestring to hexadecimal notation
1621
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1625
class MultiprocessingMixIn(object):
1626
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1627
def sub_process_main(self, request, address):
1629
self.finish_request(request, address)
1631
self.handle_error(request, address)
1632
self.close_request(request)
1634
def process_request(self, request, address):
1635
"""Start a new process to process the request."""
1636
proc = multiprocessing.Process(target = self.sub_process_main,
1643
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1644
""" adds a pipe to the MixIn """
1645
def process_request(self, request, client_address):
1646
"""Overrides and wraps the original process_request().
1648
This function creates a new pipe in self.pipe
1650
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1652
proc = MultiprocessingMixIn.process_request(self, request,
1654
self.child_pipe.close()
1655
self.add_pipe(parent_pipe, proc)
1657
def add_pipe(self, parent_pipe, proc):
1658
"""Dummy function; override as necessary"""
1659
raise NotImplementedError
1662
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1663
socketserver.TCPServer, object):
1664
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
658
logger.info(u"TCP connection from: %s",
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
665
line = self.request.makefile().readline()
666
logger.debug(u"Protocol version: %r", line)
668
if int(line.strip().split()[0]) > 1:
670
except (ValueError, IndexError, RuntimeError), error:
671
logger.error(u"Unknown protocol version: %s", error)
674
# Note: gnutls.connection.X509Credentials is really a generic
675
# GnuTLS certificate credentials object so long as no X.509
676
# keys are added to it. Therefore, we can use it here despite
677
# using OpenPGP certificates.
679
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
690
except gnutls.errors.GNUTLSError, error:
691
logger.warning(u"Handshake failed: %s", error)
692
# Do not run session.bye() here: the session is not
693
# established. Just abandon the request.
695
logger.debug(u"Handshake succeeded")
697
fpr = fingerprint(peer_certificate(session))
698
except (TypeError, gnutls.errors.GNUTLSError), error:
699
logger.warning(u"Bad certificate: %s", error)
702
logger.debug(u"Fingerprint: %s", fpr)
704
for c in self.server.clients:
705
if c.fingerprint == fpr:
709
logger.warning(u"Client not found for fingerprint: %s",
713
# Have to check if client.still_valid(), since it is possible
714
# that the client timed out while establishing the GnuTLS
716
if not client.still_valid():
717
logger.warning(u"Client %(name)s is invalid",
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
724
while sent_size < len(client.secret):
725
sent = session.send(client.secret[sent_size:])
726
logger.debug(u"Sent: %d, remaining: %d",
727
sent, len(client.secret)
728
- (sent_size + sent))
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
735
"""IPv6 TCP server. Accepts 'None' as address and/or port.
737
settings: Server settings
738
clients: Set() of Client objects
1667
739
enabled: Boolean; whether this server is activated yet
1668
interface: None or a network interface name (string)
1669
use_ipv6: Boolean; to use IPv6 or not
1671
def __init__(self, server_address, RequestHandlerClass,
1672
interface=None, use_ipv6=True):
1673
self.interface = interface
1675
self.address_family = socket.AF_INET6
1676
socketserver.TCPServer.__init__(self, server_address,
1677
RequestHandlerClass)
741
address_family = socket.AF_INET6
742
def __init__(self, *args, **kwargs):
743
if "settings" in kwargs:
744
self.settings = kwargs["settings"]
745
del kwargs["settings"]
746
if "clients" in kwargs:
747
self.clients = kwargs["clients"]
748
del kwargs["clients"]
750
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1678
751
def server_bind(self):
1679
752
"""This overrides the normal server_bind() function
1680
753
to bind to an interface if one was specified, and also NOT to
1681
754
bind to an address or port if they were not specified."""
1682
if self.interface is not None:
1683
if SO_BINDTODEVICE is None:
1684
logger.error("SO_BINDTODEVICE does not exist;"
1685
" cannot bind to interface %s",
1689
self.socket.setsockopt(socket.SOL_SOCKET,
1693
except socket.error as error:
1694
if error[0] == errno.EPERM:
1695
logger.error("No permission to"
1696
" bind to interface %s",
1698
elif error[0] == errno.ENOPROTOOPT:
1699
logger.error("SO_BINDTODEVICE not available;"
1700
" cannot bind to interface %s",
755
if self.settings["interface"]:
756
# 25 is from /usr/include/asm-i486/socket.h
757
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
759
self.socket.setsockopt(socket.SOL_SOCKET,
761
self.settings["interface"])
762
except socket.error, error:
763
if error[0] == errno.EPERM:
764
logger.error(u"No permission to"
765
u" bind to interface %s",
766
self.settings["interface"])
1704
769
# Only bind(2) the socket if we really need to.
1705
770
if self.server_address[0] or self.server_address[1]:
1706
771
if not self.server_address[0]:
1707
if self.address_family == socket.AF_INET6:
1708
any_address = "::" # in6addr_any
1710
any_address = socket.INADDR_ANY
1711
self.server_address = (any_address,
773
self.server_address = (in6addr_any,
1712
774
self.server_address[1])
1713
775
elif not self.server_address[1]:
1714
776
self.server_address = (self.server_address[0],
1716
# if self.interface:
778
# if self.settings["interface"]:
1717
779
# self.server_address = (self.server_address[0],
1720
782
# if_nametoindex
1722
return socketserver.TCPServer.server_bind(self)
1725
class MandosServer(IPv6_TCPServer):
1729
clients: set of Client objects
1730
gnutls_priority GnuTLS priority string
1731
use_dbus: Boolean; to emit D-Bus signals or not
1733
Assumes a gobject.MainLoop event loop.
1735
def __init__(self, server_address, RequestHandlerClass,
1736
interface=None, use_ipv6=True, clients=None,
1737
gnutls_priority=None, use_dbus=True):
1738
self.enabled = False
1739
self.clients = clients
1740
if self.clients is None:
1742
self.use_dbus = use_dbus
1743
self.gnutls_priority = gnutls_priority
1744
IPv6_TCPServer.__init__(self, server_address,
1745
RequestHandlerClass,
1746
interface = interface,
1747
use_ipv6 = use_ipv6)
785
return super(IPv6_TCPServer, self).server_bind()
1748
786
def server_activate(self):
1749
787
if self.enabled:
1750
return socketserver.TCPServer.server_activate(self)
788
return super(IPv6_TCPServer, self).server_activate()
1752
789
def enable(self):
1753
790
self.enabled = True
1755
def add_pipe(self, parent_pipe, proc):
1756
# Call "handle_ipc" for both data and EOF events
1757
gobject.io_add_watch(parent_pipe.fileno(),
1758
gobject.IO_IN | gobject.IO_HUP,
1759
functools.partial(self.handle_ipc,
1764
def handle_ipc(self, source, condition, parent_pipe=None,
1765
proc = None, client_object=None):
1767
gobject.IO_IN: "IN", # There is data to read.
1768
gobject.IO_OUT: "OUT", # Data can be written (without
1770
gobject.IO_PRI: "PRI", # There is urgent data to read.
1771
gobject.IO_ERR: "ERR", # Error condition.
1772
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1773
# broken, usually for pipes and
1776
conditions_string = ' | '.join(name
1778
condition_names.iteritems()
1779
if cond & condition)
1780
# error, or the other end of multiprocessing.Pipe has closed
1781
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1782
# Wait for other process to exit
1786
# Read a request from the child
1787
request = parent_pipe.recv()
1788
command = request[0]
1790
if command == 'init':
1792
address = request[2]
1794
for c in self.clients.itervalues():
1795
if c.fingerprint == fpr:
1799
logger.info("Client not found for fingerprint: %s, ad"
1800
"dress: %s", fpr, address)
1803
mandos_dbus_service.ClientNotFound(fpr,
1805
parent_pipe.send(False)
1808
gobject.io_add_watch(parent_pipe.fileno(),
1809
gobject.IO_IN | gobject.IO_HUP,
1810
functools.partial(self.handle_ipc,
1816
parent_pipe.send(True)
1817
# remove the old hook in favor of the new above hook on
1820
if command == 'funcall':
1821
funcname = request[1]
1825
parent_pipe.send(('data', getattr(client_object,
1829
if command == 'getattr':
1830
attrname = request[1]
1831
if callable(client_object.__getattribute__(attrname)):
1832
parent_pipe.send(('function',))
1834
parent_pipe.send(('data', client_object
1835
.__getattribute__(attrname)))
1837
if command == 'setattr':
1838
attrname = request[1]
1840
setattr(client_object, attrname, value)
1845
793
def string_to_delta(interval):
2086
1038
(gnutls.library.functions
2087
1039
.gnutls_global_set_log_function(debug_gnutls))
2089
# Redirect stdin so all checkers get /dev/null
2090
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2091
os.dup2(null, sys.stdin.fileno())
2095
# No console logging
2096
logger.removeHandler(console)
2098
# Need to fork before connecting to D-Bus
2100
# Close all input and output, do double fork, etc.
1042
service = AvahiService(name = server_settings["servicename"],
1043
servicetype = "_mandos._tcp", )
1044
if server_settings["interface"]:
1045
service.interface = (if_nametoindex
1046
(server_settings["interface"]))
2103
1048
global main_loop
2104
1051
# From the Avahi example code
2105
1052
DBusGMainLoop(set_as_default=True )
2106
1053
main_loop = gobject.MainLoop()
2107
1054
bus = dbus.SystemBus()
1055
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1056
avahi.DBUS_PATH_SERVER),
1057
avahi.DBUS_INTERFACE_SERVER)
2108
1058
# End of Avahi example code
2111
bus_name = dbus.service.BusName("se.recompile.Mandos",
2112
bus, do_not_queue=True)
2113
old_bus_name = (dbus.service.BusName
2114
("se.bsnet.fukt.Mandos", bus,
2116
except dbus.exceptions.NameExistsException as e:
2117
logger.error(unicode(e) + ", disabling D-Bus")
2119
server_settings["use_dbus"] = False
2120
tcp_server.use_dbus = False
2121
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2122
service = AvahiServiceToSyslog(name =
2123
server_settings["servicename"],
2124
servicetype = "_mandos._tcp",
2125
protocol = protocol, bus = bus)
2126
if server_settings["interface"]:
2127
service.interface = (if_nametoindex
2128
(str(server_settings["interface"])))
2130
global multiprocessing_manager
2131
multiprocessing_manager = multiprocessing.Manager()
2133
client_class = Client
2135
client_class = functools.partial(ClientDBusTransitional,
2138
special_settings = {
2139
# Some settings need to be accessd by special methods;
2140
# booleans need .getboolean(), etc. Here is a list of them:
2141
"approved_by_default":
2143
client_config.getboolean(section, "approved_by_default"),
2145
# Construct a new dict of client settings of this form:
2146
# { client_name: {setting_name: value, ...}, ...}
2147
# with exceptions for any special settings as defined above
2148
client_settings = dict((clientname,
2151
if setting not in special_settings
2152
else special_settings[setting]
2154
for setting, value in
2155
client_config.items(clientname)))
2156
for clientname in client_config.sections())
2158
old_client_settings = {}
2161
# Get client data and settings from last running state.
2162
if server_settings["restore"]:
2164
with open(stored_state_path, "rb") as stored_state:
2165
clients_data, old_client_settings = (pickle.load
2167
os.remove(stored_state_path)
2168
except IOError as e:
2169
logger.warning("Could not load persistant state: {0}"
2171
if e.errno != errno.ENOENT:
2174
for client in clients_data:
2175
client_name = client["name"]
2177
# Decide which value to use after restoring saved state.
2178
# We have three different values: Old config file,
2179
# new config file, and saved state.
2180
# New config value takes precedence if it differs from old
2181
# config value, otherwise use saved state.
2182
for name, value in client_settings[client_name].items():
2184
# For each value in new config, check if it differs
2185
# from the old config value (Except for the "secret"
2187
if (name != "secret" and
2188
value != old_client_settings[client_name][name]):
2189
setattr(client, name, value)
2193
# Clients who has passed its expire date, can still be enabled
2194
# if its last checker was sucessful. Clients who checkers
2195
# failed before we stored it state is asumed to had failed
2196
# checker during downtime.
2197
if client["enabled"] and client["last_checked_ok"]:
2198
if ((datetime.datetime.utcnow()
2199
- client["last_checked_ok"]) > client["interval"]):
2200
if client["last_checker_status"] != 0:
2201
client["enabled"] = False
2203
client["expires"] = (datetime.datetime.utcnow()
2204
+ client["timeout"])
2206
client["changedstate"] = (multiprocessing_manager
2207
.Condition(multiprocessing_manager
2210
new_client = (ClientDBusTransitional.__new__
2211
(ClientDBusTransitional))
2212
tcp_server.clients[client_name] = new_client
2213
new_client.bus = bus
2214
for name, value in client.iteritems():
2215
setattr(new_client, name, value)
2216
client_object_name = unicode(client_name).translate(
2217
{ord("."): ord("_"),
2218
ord("-"): ord("_")})
2219
new_client.dbus_object_path = (dbus.ObjectPath
2221
+ client_object_name))
2222
DBusObjectWithProperties.__init__(new_client,
2227
tcp_server.clients[client_name] = Client.__new__(Client)
2228
for name, value in client.iteritems():
2229
setattr(tcp_server.clients[client_name], name, value)
2231
tcp_server.clients[client_name].decrypt_secret(
2232
client_settings[client_name]["secret"])
2234
# Create/remove clients based on new changes made to config
2235
for clientname in set(old_client_settings) - set(client_settings):
2236
del tcp_server.clients[clientname]
2237
for clientname in set(client_settings) - set(old_client_settings):
2238
tcp_server.clients[clientname] = (client_class(name
2244
if not tcp_server.clients:
2245
logger.warning("No clients defined")
1060
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1062
clients.update(Set(Client(name = section,
1064
= dict(client_config.items(section)),
1065
use_dbus = use_dbus)
1066
for section in client_config.sections()))
1068
logger.warning(u"No clients defined")
1071
# Redirect stdin so all checkers get /dev/null
1072
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1073
os.dup2(null, sys.stdin.fileno())
1077
# No console logging
1078
logger.removeHandler(console)
1079
# Close all input and output, do double fork, etc.
1084
pidfile.write(str(pid) + "\n")
1088
logger.error(u"Could not write to file %r with PID %d",
1091
# "pidfile" was never created
1096
"Cleanup function; run on exit"
1098
# From the Avahi example code
1099
if not group is None:
1102
# End of Avahi example code
1105
client = clients.pop()
1106
client.disable_hook = None
1109
atexit.register(cleanup)
2251
pidfile.write(str(pid) + "\n".encode("utf-8"))
2254
logger.error("Could not write to file %r with PID %d",
2257
# "pidfile" was never created
2261
1112
signal.signal(signal.SIGINT, signal.SIG_IGN)
2263
1113
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2264
1114
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2267
class MandosDBusService(dbus.service.Object):
1117
class MandosServer(dbus.service.Object):
2268
1118
"""A D-Bus proxy object"""
2269
1119
def __init__(self):
2270
1120
dbus.service.Object.__init__(self, bus, "/")
2271
_interface = "se.recompile.Mandos"
2273
@dbus.service.signal(_interface, signature="o")
2274
def ClientAdded(self, objpath):
2278
@dbus.service.signal(_interface, signature="ss")
2279
def ClientNotFound(self, fingerprint, address):
1121
_interface = u"se.bsnet.fukt.Mandos"
1123
@dbus.service.signal(_interface, signature="oa{sv}")
1124
def ClientAdded(self, objpath, properties):