489
423
if self.checker_callback_tag:
490
424
gobject.source_remove(self.checker_callback_tag)
491
425
self.checker_callback_tag = None
492
if getattr(self, u"checker", None) is None:
426
if getattr(self, "checker", None) is None:
494
428
logger.debug(u"Stopping checker for %(name)s", vars(self))
496
430
os.kill(self.checker.pid, signal.SIGTERM)
498
432
#if self.checker.poll() is None:
499
433
# os.kill(self.checker.pid, signal.SIGKILL)
500
434
except OSError, error:
501
435
if error.errno != errno.ESRCH: # No such process
503
437
self.checker = None
505
def dbus_service_property(dbus_interface, signature=u"v",
506
access=u"readwrite", byte_arrays=False):
507
"""Decorators for marking methods of a DBusObjectWithProperties to
508
become properties on the D-Bus.
510
The decorated method will be called with no arguments by "Get"
511
and with one argument by "Set".
513
The parameters, where they are supported, are the same as
514
dbus.service.method, except there is only "signature", since the
515
type from Get() and the type sent to Set() is the same.
517
# Encoding deeply encoded byte arrays is not supported yet by the
518
# "Set" method, so we fail early here:
519
if byte_arrays and signature != u"ay":
520
raise ValueError(u"Byte arrays not supported for non-'ay'"
521
u" signature %r" % signature)
523
func._dbus_is_property = True
524
func._dbus_interface = dbus_interface
525
func._dbus_signature = signature
526
func._dbus_access = access
527
func._dbus_name = func.__name__
528
if func._dbus_name.endswith(u"_dbus_property"):
529
func._dbus_name = func._dbus_name[:-14]
530
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
535
class DBusPropertyException(dbus.exceptions.DBusException):
536
"""A base class for D-Bus property-related exceptions
538
def __unicode__(self):
539
return unicode(str(self))
542
class DBusPropertyAccessException(DBusPropertyException):
543
"""A property's access permissions disallows an operation.
548
class DBusPropertyNotFound(DBusPropertyException):
549
"""An attempt was made to access a non-existing property.
554
class DBusObjectWithProperties(dbus.service.Object):
555
"""A D-Bus object with properties.
557
Classes inheriting from this can use the dbus_service_property
558
decorator to expose methods as D-Bus properties. It exposes the
559
standard Get(), Set(), and GetAll() methods on the D-Bus.
563
def _is_dbus_property(obj):
564
return getattr(obj, u"_dbus_is_property", False)
566
def _get_all_dbus_properties(self):
567
"""Returns a generator of (name, attribute) pairs
569
return ((prop._dbus_name, prop)
571
inspect.getmembers(self, self._is_dbus_property))
573
def _get_dbus_property(self, interface_name, property_name):
574
"""Returns a bound method if one exists which is a D-Bus
575
property with the specified name and interface.
577
for name in (property_name,
578
property_name + u"_dbus_property"):
579
prop = getattr(self, name, None)
581
or not self._is_dbus_property(prop)
582
or prop._dbus_name != property_name
583
or (interface_name and prop._dbus_interface
584
and interface_name != prop._dbus_interface)):
588
raise DBusPropertyNotFound(self.dbus_object_path + u":"
589
+ interface_name + u"."
592
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
594
def Get(self, interface_name, property_name):
595
"""Standard D-Bus property Get() method, see D-Bus standard.
597
prop = self._get_dbus_property(interface_name, property_name)
598
if prop._dbus_access == u"write":
599
raise DBusPropertyAccessException(property_name)
601
if not hasattr(value, u"variant_level"):
603
return type(value)(value, variant_level=value.variant_level+1)
605
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
606
def Set(self, interface_name, property_name, value):
607
"""Standard D-Bus property Set() method, see D-Bus standard.
609
prop = self._get_dbus_property(interface_name, property_name)
610
if prop._dbus_access == u"read":
611
raise DBusPropertyAccessException(property_name)
612
if prop._dbus_get_args_options[u"byte_arrays"]:
613
# The byte_arrays option is not supported yet on
614
# signatures other than "ay".
615
if prop._dbus_signature != u"ay":
617
value = dbus.ByteArray(''.join(unichr(byte)
621
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
622
out_signature=u"a{sv}")
623
def GetAll(self, interface_name):
624
"""Standard D-Bus property GetAll() method, see D-Bus
627
Note: Will not include properties with access="write".
630
for name, prop in self._get_all_dbus_properties():
632
and interface_name != prop._dbus_interface):
633
# Interface non-empty but did not match
635
# Ignore write-only properties
636
if prop._dbus_access == u"write":
639
if not hasattr(value, u"variant_level"):
642
all[name] = type(value)(value, variant_level=
643
value.variant_level+1)
644
return dbus.Dictionary(all, signature=u"sv")
646
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
648
path_keyword='object_path',
649
connection_keyword='connection')
650
def Introspect(self, object_path, connection):
651
"""Standard D-Bus method, overloaded to insert property tags.
653
xmlstring = dbus.service.Object.Introspect(self, object_path,
656
document = xml.dom.minidom.parseString(xmlstring)
657
def make_tag(document, name, prop):
658
e = document.createElement(u"property")
659
e.setAttribute(u"name", name)
660
e.setAttribute(u"type", prop._dbus_signature)
661
e.setAttribute(u"access", prop._dbus_access)
663
for if_tag in document.getElementsByTagName(u"interface"):
664
for tag in (make_tag(document, name, prop)
666
in self._get_all_dbus_properties()
667
if prop._dbus_interface
668
== if_tag.getAttribute(u"name")):
669
if_tag.appendChild(tag)
670
# Add the names to the return values for the
671
# "org.freedesktop.DBus.Properties" methods
672
if (if_tag.getAttribute(u"name")
673
== u"org.freedesktop.DBus.Properties"):
674
for cn in if_tag.getElementsByTagName(u"method"):
675
if cn.getAttribute(u"name") == u"Get":
676
for arg in cn.getElementsByTagName(u"arg"):
677
if (arg.getAttribute(u"direction")
679
arg.setAttribute(u"name", u"value")
680
elif cn.getAttribute(u"name") == u"GetAll":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
684
arg.setAttribute(u"name", u"props")
685
xmlstring = document.toxml(u"utf-8")
687
except (AttributeError, xml.dom.DOMException,
688
xml.parsers.expat.ExpatError), error:
689
logger.error(u"Failed to override Introspection method",
694
class ClientDBus(Client, DBusObjectWithProperties):
695
"""A Client class using D-Bus
698
dbus_object_path: dbus.ObjectPath
699
bus: dbus.SystemBus()
701
# dbus.service.Object doesn't use super(), so we can't either.
703
def __init__(self, bus = None, *args, **kwargs):
704
self._approvals_pending = 0
706
Client.__init__(self, *args, **kwargs)
707
# Only now, when this client is initialized, can it show up on
709
self.dbus_object_path = (dbus.ObjectPath
711
+ self.name.replace(u".", u"_")))
712
DBusObjectWithProperties.__init__(self, self.bus,
713
self.dbus_object_path)
715
#Could possible return a bool(self._approvals_pending),
716
#but this could mess up approvals_pending += 1 XXX
717
def _get_approvals_pending(self):
718
return self._approvals_pending
719
def _set_approvals_pending(self, value):
720
old_value = self._approvals_pending
721
self._approvals_pending = value
723
if (hasattr(self, "dbus_object_path")
724
and bval is not bool(old_value)):
725
dbus_bool = dbus.Boolean(bval, variant_level=1)
726
self.PropertyChanged(dbus.String(u"approved_pending"),
729
approvals_pending = property(_get_approvals_pending,
730
_set_approvals_pending)
731
del _get_approvals_pending, _set_approvals_pending
734
def _datetime_to_dbus(dt, variant_level=0):
735
"""Convert a UTC datetime.datetime() to a D-Bus type."""
736
return dbus.String(dt.isoformat(),
737
variant_level=variant_level)
740
oldstate = getattr(self, u"enabled", False)
741
r = Client.enable(self)
742
if oldstate != self.enabled:
744
self.PropertyChanged(dbus.String(u"enabled"),
745
dbus.Boolean(True, variant_level=1))
746
self.PropertyChanged(
747
dbus.String(u"last_enabled"),
748
self._datetime_to_dbus(self.last_enabled,
752
def disable(self, quiet = False):
753
oldstate = getattr(self, u"enabled", False)
754
r = Client.disable(self, quiet=quiet)
755
if not quiet and oldstate != self.enabled:
757
self.PropertyChanged(dbus.String(u"enabled"),
758
dbus.Boolean(False, variant_level=1))
761
def __del__(self, *args, **kwargs):
763
self.remove_from_connection()
766
if hasattr(DBusObjectWithProperties, u"__del__"):
767
DBusObjectWithProperties.__del__(self, *args, **kwargs)
768
Client.__del__(self, *args, **kwargs)
770
def checker_callback(self, pid, condition, command,
772
self.checker_callback_tag = None
775
self.PropertyChanged(dbus.String(u"checker_running"),
776
dbus.Boolean(False, variant_level=1))
777
if os.WIFEXITED(condition):
778
exitstatus = os.WEXITSTATUS(condition)
780
self.CheckerCompleted(dbus.Int16(exitstatus),
781
dbus.Int64(condition),
782
dbus.String(command))
785
self.CheckerCompleted(dbus.Int16(-1),
786
dbus.Int64(condition),
787
dbus.String(command))
789
return Client.checker_callback(self, pid, condition, command,
792
def checked_ok(self, *args, **kwargs):
793
r = Client.checked_ok(self, *args, **kwargs)
795
self.PropertyChanged(
796
dbus.String(u"last_checked_ok"),
797
(self._datetime_to_dbus(self.last_checked_ok,
801
def start_checker(self, *args, **kwargs):
802
old_checker = self.checker
803
if self.checker is not None:
804
old_checker_pid = self.checker.pid
806
old_checker_pid = None
807
r = Client.start_checker(self, *args, **kwargs)
808
# Only if new checker process was started
809
if (self.checker is not None
810
and old_checker_pid != self.checker.pid):
812
self.CheckerStarted(self.current_checker_command)
813
self.PropertyChanged(
814
dbus.String(u"checker_running"),
815
dbus.Boolean(True, variant_level=1))
818
def stop_checker(self, *args, **kwargs):
819
old_checker = getattr(self, u"checker", None)
820
r = Client.stop_checker(self, *args, **kwargs)
821
if (old_checker is not None
822
and getattr(self, u"checker", None) is None):
823
439
self.PropertyChanged(dbus.String(u"checker_running"),
824
440
dbus.Boolean(False, variant_level=1))
827
def _reset_approved(self):
828
self._approved = None
831
def approve(self, value=True):
832
self.send_changedstate()
833
self._approved = value
834
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
835
self._reset_approved)
838
## D-Bus methods, signals & properties
442
def still_valid(self):
443
"""Has the timeout not yet passed for this client?"""
444
if not getattr(self, "enabled", False):
446
now = datetime.datetime.utcnow()
447
if self.last_checked_ok is None:
448
return now < (self.created + self.timeout)
450
return now < (self.last_checked_ok + self.timeout)
452
## D-Bus methods & signals
839
453
_interface = u"se.bsnet.fukt.Mandos.Client"
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
843
459
# CheckerCompleted - signal
844
@dbus.service.signal(_interface, signature=u"nxs")
460
@dbus.service.signal(_interface, signature="nxs")
845
461
def CheckerCompleted(self, exitcode, waitstatus, command):
849
465
# CheckerStarted - signal
850
@dbus.service.signal(_interface, signature=u"s")
466
@dbus.service.signal(_interface, signature="s")
851
467
def CheckerStarted(self, command):
471
# GetAllProperties - method
472
@dbus.service.method(_interface, out_signature="a{sv}")
473
def GetAllProperties(self):
475
return dbus.Dictionary({
477
dbus.String(self.name, variant_level=1),
478
dbus.String("fingerprint"):
479
dbus.String(self.fingerprint, variant_level=1),
481
dbus.String(self.host, variant_level=1),
482
dbus.String("created"):
483
_datetime_to_dbus(self.created, variant_level=1),
484
dbus.String("last_enabled"):
485
(_datetime_to_dbus(self.last_enabled,
487
if self.last_enabled is not None
488
else dbus.Boolean(False, variant_level=1)),
489
dbus.String("enabled"):
490
dbus.Boolean(self.enabled, variant_level=1),
491
dbus.String("last_checked_ok"):
492
(_datetime_to_dbus(self.last_checked_ok,
494
if self.last_checked_ok is not None
495
else dbus.Boolean (False, variant_level=1)),
496
dbus.String("timeout"):
497
dbus.UInt64(self.timeout_milliseconds(),
499
dbus.String("interval"):
500
dbus.UInt64(self.interval_milliseconds(),
502
dbus.String("checker"):
503
dbus.String(self.checker_command,
505
dbus.String("checker_running"):
506
dbus.Boolean(self.checker is not None,
508
dbus.String("object_path"):
509
dbus.ObjectPath(self.dbus_object_path,
513
# IsStillValid - method
514
IsStillValid = (dbus.service.method(_interface, out_signature="b")
516
IsStillValid.__name__ = "IsStillValid"
855
518
# PropertyChanged - signal
856
@dbus.service.signal(_interface, signature=u"sv")
519
@dbus.service.signal(_interface, signature="sv")
857
520
def PropertyChanged(self, property, value):
862
# XXXTEDDY Is sent after succesfull transfer of secret from mandos-server to mandos-client
863
@dbus.service.signal(_interface)
869
@dbus.service.signal(_interface, signature=u"s")
870
def Rejected(self, reason):
874
# NeedApproval - signal
875
@dbus.service.signal(_interface, signature=u"db")
876
def NeedApproval(self, timeout, default):
883
@dbus.service.method(_interface, in_signature=u"b")
884
def Approve(self, value):
888
@dbus.service.method(_interface)
890
return self.checked_ok()
524
# SetChecker - method
525
@dbus.service.method(_interface, in_signature="s")
526
def SetChecker(self, checker):
527
"D-Bus setter method"
528
self.checker_command = checker
530
self.PropertyChanged(dbus.String(u"checker"),
531
dbus.String(self.checker_command,
535
@dbus.service.method(_interface, in_signature="s")
536
def SetHost(self, host):
537
"D-Bus setter method"
540
self.PropertyChanged(dbus.String(u"host"),
541
dbus.String(self.host, variant_level=1))
543
# SetInterval - method
544
@dbus.service.method(_interface, in_signature="t")
545
def SetInterval(self, milliseconds):
546
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
548
self.PropertyChanged(dbus.String(u"interval"),
549
(dbus.UInt64(self.interval_milliseconds(),
553
@dbus.service.method(_interface, in_signature="ay",
555
def SetSecret(self, secret):
556
"D-Bus setter method"
557
self.secret = str(secret)
559
# SetTimeout - method
560
@dbus.service.method(_interface, in_signature="t")
561
def SetTimeout(self, milliseconds):
562
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
564
self.PropertyChanged(dbus.String(u"timeout"),
565
(dbus.UInt64(self.timeout_milliseconds(),
892
568
# Enable - method
893
@dbus.service.method(_interface)
569
Enable = dbus.service.method(_interface)(enable)
570
Enable.__name__ = "Enable"
898
572
# StartChecker - method
899
573
@dbus.service.method(_interface)
910
584
# StopChecker - method
911
@dbus.service.method(_interface)
912
def StopChecker(self):
917
# approved_pending - property
918
@dbus_service_property(_interface, signature=u"b", access=u"read")
919
def approved_pending_dbus_property(self):
920
return dbus.Boolean(bool(self.approvals_pending))
922
# approved_by_default - property
923
@dbus_service_property(_interface, signature=u"b",
925
def approved_by_default_dbus_property(self):
926
return dbus.Boolean(self.approved_by_default)
928
# approved_delay - property
929
@dbus_service_property(_interface, signature=u"t",
931
def approved_delay_dbus_property(self):
932
return dbus.UInt64(self.approved_delay_milliseconds())
934
# approved_duration - property
935
@dbus_service_property(_interface, signature=u"t",
937
def approved_duration_dbus_property(self):
938
return dbus.UInt64(self._timedelta_to_milliseconds(
939
self.approved_duration))
942
@dbus_service_property(_interface, signature=u"s", access=u"read")
943
def name_dbus_property(self):
944
return dbus.String(self.name)
946
# fingerprint - property
947
@dbus_service_property(_interface, signature=u"s", access=u"read")
948
def fingerprint_dbus_property(self):
949
return dbus.String(self.fingerprint)
952
@dbus_service_property(_interface, signature=u"s",
954
def host_dbus_property(self, value=None):
955
if value is None: # get
956
return dbus.String(self.host)
959
self.PropertyChanged(dbus.String(u"host"),
960
dbus.String(value, variant_level=1))
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
964
def created_dbus_property(self):
965
return dbus.String(self._datetime_to_dbus(self.created))
967
# last_enabled - property
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
969
def last_enabled_dbus_property(self):
970
if self.last_enabled is None:
971
return dbus.String(u"")
972
return dbus.String(self._datetime_to_dbus(self.last_enabled))
975
@dbus_service_property(_interface, signature=u"b",
977
def enabled_dbus_property(self, value=None):
978
if value is None: # get
979
return dbus.Boolean(self.enabled)
985
# last_checked_ok - property
986
@dbus_service_property(_interface, signature=u"s",
988
def last_checked_ok_dbus_property(self, value=None):
989
if value is not None:
992
if self.last_checked_ok is None:
993
return dbus.String(u"")
994
return dbus.String(self._datetime_to_dbus(self
998
@dbus_service_property(_interface, signature=u"t",
1000
def timeout_dbus_property(self, value=None):
1001
if value is None: # get
1002
return dbus.UInt64(self.timeout_milliseconds())
1003
self.timeout = datetime.timedelta(0, 0, 0, value)
1005
self.PropertyChanged(dbus.String(u"timeout"),
1006
dbus.UInt64(value, variant_level=1))
1007
if getattr(self, u"disable_initiator_tag", None) is None:
1009
# Reschedule timeout
1010
gobject.source_remove(self.disable_initiator_tag)
1011
self.disable_initiator_tag = None
1012
time_to_die = (self.
1013
_timedelta_to_milliseconds((self
1018
if time_to_die <= 0:
1019
# The timeout has passed
1022
self.disable_initiator_tag = (gobject.timeout_add
1023
(time_to_die, self.disable))
1025
# interval - property
1026
@dbus_service_property(_interface, signature=u"t",
1027
access=u"readwrite")
1028
def interval_dbus_property(self, value=None):
1029
if value is None: # get
1030
return dbus.UInt64(self.interval_milliseconds())
1031
self.interval = datetime.timedelta(0, 0, 0, value)
1033
self.PropertyChanged(dbus.String(u"interval"),
1034
dbus.UInt64(value, variant_level=1))
1035
if getattr(self, u"checker_initiator_tag", None) is None:
1037
# Reschedule checker run
1038
gobject.source_remove(self.checker_initiator_tag)
1039
self.checker_initiator_tag = (gobject.timeout_add
1040
(value, self.start_checker))
1041
self.start_checker() # Start one now, too
1043
# checker - property
1044
@dbus_service_property(_interface, signature=u"s",
1045
access=u"readwrite")
1046
def checker_dbus_property(self, value=None):
1047
if value is None: # get
1048
return dbus.String(self.checker_command)
1049
self.checker_command = value
1051
self.PropertyChanged(dbus.String(u"checker"),
1052
dbus.String(self.checker_command,
1055
# checker_running - property
1056
@dbus_service_property(_interface, signature=u"b",
1057
access=u"readwrite")
1058
def checker_running_dbus_property(self, value=None):
1059
if value is None: # get
1060
return dbus.Boolean(self.checker is not None)
1062
self.start_checker()
1066
# object_path - property
1067
@dbus_service_property(_interface, signature=u"o", access=u"read")
1068
def object_path_dbus_property(self):
1069
return self.dbus_object_path # is already a dbus.ObjectPath
1072
@dbus_service_property(_interface, signature=u"ay",
1073
access=u"write", byte_arrays=True)
1074
def secret_dbus_property(self, value):
1075
self.secret = str(value)
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
1080
class ProxyClient(object):
1081
def __init__(self, child_pipe, fpr, address):
1082
self._pipe = child_pipe
1083
self._pipe.send(('init', fpr, address))
1084
if not self._pipe.recv():
1087
def __getattribute__(self, name):
1088
if(name == '_pipe'):
1089
return super(ProxyClient, self).__getattribute__(name)
1090
self._pipe.send(('getattr', name))
1091
data = self._pipe.recv()
1092
if data[0] == 'data':
1094
if data[0] == 'function':
1095
def func(*args, **kwargs):
1096
self._pipe.send(('funcall', name, args, kwargs))
1097
return self._pipe.recv()[1]
1100
def __setattr__(self, name, value):
1101
if(name == '_pipe'):
1102
return super(ProxyClient, self).__setattr__(name, value)
1103
self._pipe.send(('setattr', name, value))
1106
class ClientHandler(socketserver.BaseRequestHandler, object):
1107
"""A class to handle client connections.
1109
Instantiated once for each connection to handle it.
591
def peer_certificate(session):
592
"Return the peer's OpenPGP certificate as a bytestring"
593
# If not an OpenPGP certificate...
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
597
# ...do the normal thing
598
return session.peer_certificate
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
606
if list_size.value == 0:
609
return ctypes.string_at(cert.data, cert.size)
612
def fingerprint(openpgp):
613
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
614
# New GnuTLS "datum" with the OpenPGP public key
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
619
ctypes.c_uint(len(openpgp))))
620
# New empty GnuTLS certificate
621
crt = gnutls.library.types.gnutls_openpgp_crt_t()
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
624
# Import the OpenPGP public key into the certificate
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
629
# Verify the self signature in the key
630
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
633
if crtverify.value != 0:
634
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
635
raise gnutls.errors.CertificateSecurityError("Verify failed")
636
# New buffer for the fingerprint
637
buf = ctypes.create_string_buffer(20)
638
buf_len = ctypes.c_size_t()
639
# Get the fingerprint from the certificate into the buffer
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
643
# Deinit the certificate
644
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
645
# Convert the buffer to a Python bytestring
646
fpr = ctypes.string_at(buf, buf_len.value)
647
# Convert the bytestring to hexadecimal notation
648
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
652
class TCP_handler(SocketServer.BaseRequestHandler, object):
653
"""A TCP request handler class.
654
Instantiated by IPv6_TCPServer for each request to handle it.
1110
655
Note: This will run in its own forked process."""
1112
657
def handle(self):
1113
with contextlib.closing(self.server.child_pipe) as child_pipe:
1114
logger.info(u"TCP connection from: %s",
1115
unicode(self.client_address))
1116
logger.debug(u"Pipe FD: %d",
1117
self.server.child_pipe.fileno())
1119
session = (gnutls.connection
1120
.ClientSession(self.request,
1122
.X509Credentials()))
1124
# Note: gnutls.connection.X509Credentials is really a
1125
# generic GnuTLS certificate credentials object so long as
1126
# no X.509 keys are added to it. Therefore, we can use it
1127
# here despite using OpenPGP certificates.
1129
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1130
# u"+AES-256-CBC", u"+SHA1",
1131
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1133
# Use a fallback default, since this MUST be set.
1134
priority = self.server.gnutls_priority
1135
if priority is None:
1136
priority = u"NORMAL"
1137
(gnutls.library.functions
1138
.gnutls_priority_set_direct(session._c_object,
1141
# Start communication using the Mandos protocol
1142
# Get protocol number
1143
line = self.request.makefile().readline()
1144
logger.debug(u"Protocol version: %r", line)
1146
if int(line.strip().split()[0]) > 1:
1148
except (ValueError, IndexError, RuntimeError), error:
1149
logger.error(u"Unknown protocol version: %s", error)
1152
# Start GnuTLS connection
1155
except gnutls.errors.GNUTLSError, error:
1156
logger.warning(u"Handshake failed: %s", error)
1157
# Do not run session.bye() here: the session is not
1158
# established. Just abandon the request.
1160
logger.debug(u"Handshake succeeded")
1162
approval_required = False
1165
fpr = self.fingerprint(self.peer_certificate
1167
except (TypeError, gnutls.errors.GNUTLSError), error:
1168
logger.warning(u"Bad certificate: %s", error)
1170
logger.debug(u"Fingerprint: %s", fpr)
1173
client = ProxyClient(child_pipe, fpr,
1174
self.client_address)
1178
if client.approved_delay:
1179
delay = client.approved_delay
1180
client.approvals_pending += 1
1181
approval_required = True
1184
if not client.enabled:
1185
logger.warning(u"Client %s is disabled",
1187
if self.server.use_dbus:
1189
client.Rejected("Disabled")
1192
if client._approved or not client.approved_delay:
1193
#We are approved or approval is disabled
1195
elif client._approved is None:
1196
logger.info(u"Client %s need approval",
1198
if self.server.use_dbus:
1200
client.NeedApproval(
1201
client.approved_delay_milliseconds(),
1202
client.approved_by_default)
1204
logger.warning(u"Client %s was not approved",
1206
if self.server.use_dbus:
1208
client.Rejected("Disapproved")
1211
#wait until timeout or approved
1212
#x = float(client._timedelta_to_milliseconds(delay))
1213
time = datetime.datetime.now()
1214
client.changedstate.acquire()
1215
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1216
client.changedstate.release()
1217
time2 = datetime.datetime.now()
1218
if (time2 - time) >= delay:
1219
if not client.approved_by_default:
1220
logger.warning("Client %s timed out while"
1221
" waiting for approval",
1223
if self.server.use_dbus:
1225
client.Rejected("Time out")
1230
delay -= time2 - time
1233
while sent_size < len(client.secret):
1234
# XXX handle session exception
1235
sent = session.send(client.secret[sent_size:])
1236
logger.debug(u"Sent: %d, remaining: %d",
1237
sent, len(client.secret)
1238
- (sent_size + sent))
1241
logger.info(u"Sending secret to %s", client.name)
1242
# bump the timeout as if seen
1244
if self.server.use_dbus:
1249
if approval_required:
1250
client.approvals_pending -= 1
1254
def peer_certificate(session):
1255
"Return the peer's OpenPGP certificate as a bytestring"
1256
# If not an OpenPGP certificate...
1257
if (gnutls.library.functions
1258
.gnutls_certificate_type_get(session._c_object)
1259
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1260
# ...do the normal thing
1261
return session.peer_certificate
1262
list_size = ctypes.c_uint(1)
1263
cert_list = (gnutls.library.functions
1264
.gnutls_certificate_get_peers
1265
(session._c_object, ctypes.byref(list_size)))
1266
if not bool(cert_list) and list_size.value != 0:
1267
raise gnutls.errors.GNUTLSError(u"error getting peer"
1269
if list_size.value == 0:
1272
return ctypes.string_at(cert.data, cert.size)
1275
def fingerprint(openpgp):
1276
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1277
# New GnuTLS "datum" with the OpenPGP public key
1278
datum = (gnutls.library.types
1279
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1282
ctypes.c_uint(len(openpgp))))
1283
# New empty GnuTLS certificate
1284
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1285
(gnutls.library.functions
1286
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1287
# Import the OpenPGP public key into the certificate
1288
(gnutls.library.functions
1289
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1290
gnutls.library.constants
1291
.GNUTLS_OPENPGP_FMT_RAW))
1292
# Verify the self signature in the key
1293
crtverify = ctypes.c_uint()
1294
(gnutls.library.functions
1295
.gnutls_openpgp_crt_verify_self(crt, 0,
1296
ctypes.byref(crtverify)))
1297
if crtverify.value != 0:
1298
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1299
raise (gnutls.errors.CertificateSecurityError
1301
# New buffer for the fingerprint
1302
buf = ctypes.create_string_buffer(20)
1303
buf_len = ctypes.c_size_t()
1304
# Get the fingerprint from the certificate into the buffer
1305
(gnutls.library.functions
1306
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1307
ctypes.byref(buf_len)))
1308
# Deinit the certificate
1309
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1310
# Convert the buffer to a Python bytestring
1311
fpr = ctypes.string_at(buf, buf_len.value)
1312
# Convert the bytestring to hexadecimal notation
1313
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1317
class MultiprocessingMixIn(object):
1318
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1319
def sub_process_main(self, request, address):
1321
self.finish_request(request, address)
1323
self.handle_error(request, address)
1324
self.close_request(request)
1326
def process_request(self, request, address):
1327
"""Start a new process to process the request."""
1328
multiprocessing.Process(target = self.sub_process_main,
1329
args = (request, address)).start()
1331
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1332
""" adds a pipe to the MixIn """
1333
def process_request(self, request, client_address):
1334
"""Overrides and wraps the original process_request().
1336
This function creates a new pipe in self.pipe
1338
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1340
super(MultiprocessingMixInWithPipe,
1341
self).process_request(request, client_address)
1342
self.child_pipe.close()
1343
self.add_pipe(parent_pipe)
1345
def add_pipe(self, parent_pipe):
1346
"""Dummy function; override as necessary"""
1349
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1350
socketserver.TCPServer, object):
1351
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
658
logger.info(u"TCP connection from: %s",
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
665
line = self.request.makefile().readline()
666
logger.debug(u"Protocol version: %r", line)
668
if int(line.strip().split()[0]) > 1:
670
except (ValueError, IndexError, RuntimeError), error:
671
logger.error(u"Unknown protocol version: %s", error)
674
# Note: gnutls.connection.X509Credentials is really a generic
675
# GnuTLS certificate credentials object so long as no X.509
676
# keys are added to it. Therefore, we can use it here despite
677
# using OpenPGP certificates.
679
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
690
except gnutls.errors.GNUTLSError, error:
691
logger.warning(u"Handshake failed: %s", error)
692
# Do not run session.bye() here: the session is not
693
# established. Just abandon the request.
695
logger.debug(u"Handshake succeeded")
697
fpr = fingerprint(peer_certificate(session))
698
except (TypeError, gnutls.errors.GNUTLSError), error:
699
logger.warning(u"Bad certificate: %s", error)
702
logger.debug(u"Fingerprint: %s", fpr)
704
for c in self.server.clients:
705
if c.fingerprint == fpr:
709
logger.warning(u"Client not found for fingerprint: %s",
713
# Have to check if client.still_valid(), since it is possible
714
# that the client timed out while establishing the GnuTLS
716
if not client.still_valid():
717
logger.warning(u"Client %(name)s is invalid",
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
724
while sent_size < len(client.secret):
725
sent = session.send(client.secret[sent_size:])
726
logger.debug(u"Sent: %d, remaining: %d",
727
sent, len(client.secret)
728
- (sent_size + sent))
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
735
"""IPv6 TCP server. Accepts 'None' as address and/or port.
737
settings: Server settings
738
clients: Set() of Client objects
1354
739
enabled: Boolean; whether this server is activated yet
1355
interface: None or a network interface name (string)
1356
use_ipv6: Boolean; to use IPv6 or not
1358
def __init__(self, server_address, RequestHandlerClass,
1359
interface=None, use_ipv6=True):
1360
self.interface = interface
1362
self.address_family = socket.AF_INET6
1363
socketserver.TCPServer.__init__(self, server_address,
1364
RequestHandlerClass)
741
address_family = socket.AF_INET6
742
def __init__(self, *args, **kwargs):
743
if "settings" in kwargs:
744
self.settings = kwargs["settings"]
745
del kwargs["settings"]
746
if "clients" in kwargs:
747
self.clients = kwargs["clients"]
748
del kwargs["clients"]
750
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1365
751
def server_bind(self):
1366
752
"""This overrides the normal server_bind() function
1367
753
to bind to an interface if one was specified, and also NOT to
1368
754
bind to an address or port if they were not specified."""
1369
if self.interface is not None:
1370
if SO_BINDTODEVICE is None:
1371
logger.error(u"SO_BINDTODEVICE does not exist;"
1372
u" cannot bind to interface %s",
1376
self.socket.setsockopt(socket.SOL_SOCKET,
1380
except socket.error, error:
1381
if error[0] == errno.EPERM:
1382
logger.error(u"No permission to"
1383
u" bind to interface %s",
1385
elif error[0] == errno.ENOPROTOOPT:
1386
logger.error(u"SO_BINDTODEVICE not available;"
1387
u" cannot bind to interface %s",
755
if self.settings["interface"]:
756
# 25 is from /usr/include/asm-i486/socket.h
757
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
759
self.socket.setsockopt(socket.SOL_SOCKET,
761
self.settings["interface"])
762
except socket.error, error:
763
if error[0] == errno.EPERM:
764
logger.error(u"No permission to"
765
u" bind to interface %s",
766
self.settings["interface"])
1391
769
# Only bind(2) the socket if we really need to.
1392
770
if self.server_address[0] or self.server_address[1]:
1393
771
if not self.server_address[0]:
1394
if self.address_family == socket.AF_INET6:
1395
any_address = u"::" # in6addr_any
1397
any_address = socket.INADDR_ANY
1398
self.server_address = (any_address,
773
self.server_address = (in6addr_any,
1399
774
self.server_address[1])
1400
775
elif not self.server_address[1]:
1401
776
self.server_address = (self.server_address[0],
1403
# if self.interface:
778
# if self.settings["interface"]:
1404
779
# self.server_address = (self.server_address[0],
1407
782
# if_nametoindex
1409
return socketserver.TCPServer.server_bind(self)
1412
class MandosServer(IPv6_TCPServer):
1416
clients: set of Client objects
1417
gnutls_priority GnuTLS priority string
1418
use_dbus: Boolean; to emit D-Bus signals or not
1420
Assumes a gobject.MainLoop event loop.
1422
def __init__(self, server_address, RequestHandlerClass,
1423
interface=None, use_ipv6=True, clients=None,
1424
gnutls_priority=None, use_dbus=True):
1425
self.enabled = False
1426
self.clients = clients
1427
if self.clients is None:
1428
self.clients = set()
1429
self.use_dbus = use_dbus
1430
self.gnutls_priority = gnutls_priority
1431
IPv6_TCPServer.__init__(self, server_address,
1432
RequestHandlerClass,
1433
interface = interface,
1434
use_ipv6 = use_ipv6)
785
return super(IPv6_TCPServer, self).server_bind()
1435
786
def server_activate(self):
1436
787
if self.enabled:
1437
return socketserver.TCPServer.server_activate(self)
788
return super(IPv6_TCPServer, self).server_activate()
1438
789
def enable(self):
1439
790
self.enabled = True
1440
def add_pipe(self, parent_pipe):
1441
# Call "handle_ipc" for both data and EOF events
1442
gobject.io_add_watch(parent_pipe.fileno(),
1443
gobject.IO_IN | gobject.IO_HUP,
1444
functools.partial(self.handle_ipc,
1445
parent_pipe = parent_pipe))
1447
def handle_ipc(self, source, condition, parent_pipe=None,
1448
client_object=None):
1450
gobject.IO_IN: u"IN", # There is data to read.
1451
gobject.IO_OUT: u"OUT", # Data can be written (without
1453
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1454
gobject.IO_ERR: u"ERR", # Error condition.
1455
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1456
# broken, usually for pipes and
1459
conditions_string = ' | '.join(name
1461
condition_names.iteritems()
1462
if cond & condition)
1463
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1466
# XXXTEDDY error or the other end of multiprocessing.Pipe has closed
1467
if condition & gobject.IO_HUP or condition & gobject.IO_ERR:
1470
# Read a request from the child
1471
request = parent_pipe.recv()
1472
logger.debug(u"IPC request: %s", repr(request))
1473
command = request[0]
1475
if command == 'init':
1477
address = request[2]
1479
for c in self.clients:
1480
if c.fingerprint == fpr:
1484
logger.warning(u"Client not found for fingerprint: %s, ad"
1485
u"dress: %s", fpr, address)
1488
mandos_dbus_service.ClientNotFound(fpr, address)
1489
parent_pipe.send(False)
1492
gobject.io_add_watch(parent_pipe.fileno(),
1493
gobject.IO_IN | gobject.IO_HUP,
1494
functools.partial(self.handle_ipc,
1495
parent_pipe = parent_pipe,
1496
client_object = client))
1497
parent_pipe.send(True)
1498
# remove the old hook in favor of the new above hook on same fileno
1500
if command == 'funcall':
1501
funcname = request[1]
1505
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1507
if command == 'getattr':
1508
attrname = request[1]
1509
if callable(client_object.__getattribute__(attrname)):
1510
parent_pipe.send(('function',))
1512
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1514
if command == 'setattr':
1515
attrname = request[1]
1517
setattr(client_object, attrname, value)
1522
793
def string_to_delta(interval):
1523
794
"""Parse a string and return a datetime.timedelta
1525
>>> string_to_delta(u'7d')
796
>>> string_to_delta('7d')
1526
797
datetime.timedelta(7)
1527
>>> string_to_delta(u'60s')
798
>>> string_to_delta('60s')
1528
799
datetime.timedelta(0, 60)
1529
>>> string_to_delta(u'60m')
800
>>> string_to_delta('60m')
1530
801
datetime.timedelta(0, 3600)
1531
>>> string_to_delta(u'24h')
802
>>> string_to_delta('24h')
1532
803
datetime.timedelta(1)
1533
804
>>> string_to_delta(u'1w')
1534
805
datetime.timedelta(7)
1535
>>> string_to_delta(u'5m 30s')
806
>>> string_to_delta('5m 30s')
1536
807
datetime.timedelta(0, 330)
1538
809
timevalue = datetime.timedelta(0)
1647
933
# Default values for config file for server-global settings
1648
server_defaults = { u"interface": u"",
1653
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1654
u"servicename": u"Mandos",
1655
u"use_dbus": u"True",
1656
u"use_ipv6": u"True",
934
server_defaults = { "interface": "",
939
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
940
"servicename": "Mandos",
1659
944
# Parse config file for server-global settings
1660
server_config = configparser.SafeConfigParser(server_defaults)
945
server_config = ConfigParser.SafeConfigParser(server_defaults)
1661
946
del server_defaults
1662
server_config.read(os.path.join(options.configdir,
947
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1664
948
# Convert the SafeConfigParser object to a dict
1665
949
server_settings = server_config.defaults()
1666
950
# Use the appropriate methods on the non-string config options
1667
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1668
server_settings[option] = server_config.getboolean(u"DEFAULT",
951
server_settings["debug"] = server_config.getboolean("DEFAULT",
953
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1670
955
if server_settings["port"]:
1671
server_settings["port"] = server_config.getint(u"DEFAULT",
956
server_settings["port"] = server_config.getint("DEFAULT",
1673
958
del server_config
1675
960
# Override the settings from the config file with command line
1676
961
# options, if set.
1677
for option in (u"interface", u"address", u"port", u"debug",
1678
u"priority", u"servicename", u"configdir",
1679
u"use_dbus", u"use_ipv6"):
962
for option in ("interface", "address", "port", "debug",
963
"priority", "servicename", "configdir",
1680
965
value = getattr(options, option)
1681
966
if value is not None:
1682
967
server_settings[option] = value
1684
# Force all strings to be unicode
1685
for option in server_settings.keys():
1686
if type(server_settings[option]) is str:
1687
server_settings[option] = unicode(server_settings[option])
1688
969
# Now we have our good server settings in "server_settings"
1690
##################################################################
1692
971
# For convenience
1693
debug = server_settings[u"debug"]
1694
use_dbus = server_settings[u"use_dbus"]
1695
use_ipv6 = server_settings[u"use_ipv6"]
972
debug = server_settings["debug"]
973
use_dbus = server_settings["use_dbus"]
1698
976
syslogger.setLevel(logging.WARNING)
1699
977
console.setLevel(logging.WARNING)
1701
if server_settings[u"servicename"] != u"Mandos":
979
if server_settings["servicename"] != "Mandos":
1702
980
syslogger.setFormatter(logging.Formatter
1703
(u'Mandos (%s) [%%(process)d]:'
1704
u' %%(levelname)s: %%(message)s'
1705
% server_settings[u"servicename"]))
981
('Mandos (%s): %%(levelname)s:'
983
% server_settings["servicename"]))
1707
985
# Parse config file with clients
1708
client_defaults = { u"timeout": u"1h",
1710
u"checker": u"fping -q -- %%(host)s",
1712
u"approved_delay": u"0s",
1713
u"approved_duration": u"1s",
986
client_defaults = { "timeout": "1h",
988
"checker": "fping -q -- %%(host)s",
1715
client_config = configparser.SafeConfigParser(client_defaults)
1716
client_config.read(os.path.join(server_settings[u"configdir"],
1719
global mandos_dbus_service
1720
mandos_dbus_service = None
1722
tcp_server = MandosServer((server_settings[u"address"],
1723
server_settings[u"port"]),
1725
interface=server_settings[u"interface"],
1728
server_settings[u"priority"],
1730
pidfilename = u"/var/run/mandos.pid"
991
client_config = ConfigParser.SafeConfigParser(client_defaults)
992
client_config.read(os.path.join(server_settings["configdir"],
996
tcp_server = IPv6_TCPServer((server_settings["address"],
997
server_settings["port"]),
999
settings=server_settings,
1001
pidfilename = "/var/run/mandos.pid"
1732
pidfile = open(pidfilename, u"w")
1003
pidfile = open(pidfilename, "w")
1733
1004
except IOError:
1734
logger.error(u"Could not open file %r", pidfilename)
1005
logger.error("Could not open file %r", pidfilename)
1737
uid = pwd.getpwnam(u"_mandos").pw_uid
1738
gid = pwd.getpwnam(u"_mandos").pw_gid
1008
uid = pwd.getpwnam("_mandos").pw_uid
1009
gid = pwd.getpwnam("_mandos").pw_gid
1739
1010
except KeyError:
1741
uid = pwd.getpwnam(u"mandos").pw_uid
1742
gid = pwd.getpwnam(u"mandos").pw_gid
1012
uid = pwd.getpwnam("mandos").pw_uid
1013
gid = pwd.getpwnam("mandos").pw_gid
1743
1014
except KeyError:
1745
uid = pwd.getpwnam(u"nobody").pw_uid
1746
gid = pwd.getpwnam(u"nobody").pw_gid
1016
uid = pwd.getpwnam("nobody").pw_uid
1017
gid = pwd.getpwnam("nogroup").pw_gid
1747
1018
except KeyError: