/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2009-04-01 03:37:45 UTC
  • Revision ID: teddy@fukt.bsnet.se-20090401033745-c89k6bij5opdm1rk
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
                               not try to call
                               dbus.service.Object.__del__() if it
                               does not exist.
  (ClientDBus.start_checker): Simplify logic.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
# 
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
# 
32
33
 
33
 
from __future__ import division
 
34
from __future__ import division, with_statement, absolute_import
34
35
 
35
36
import SocketServer
36
37
import socket
37
 
import select
38
 
from optparse import OptionParser
 
38
import optparse
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
 
59
from contextlib import closing
59
60
 
60
61
import dbus
 
62
import dbus.service
61
63
import gobject
62
64
import avahi
63
65
from dbus.mainloop.glib import DBusGMainLoop
64
66
import ctypes
 
67
import ctypes.util
65
68
 
66
 
version = "1.0"
 
69
version = "1.0.8"
67
70
 
68
71
logger = logging.Logger('mandos')
69
 
syslogger = logging.handlers.SysLogHandler\
70
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
 
             address = "/dev/log")
72
 
syslogger.setFormatter(logging.Formatter\
73
 
                        ('Mandos: %(levelname)s: %(message)s'))
 
72
syslogger = (logging.handlers.SysLogHandler
 
73
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
74
              address = "/dev/log"))
 
75
syslogger.setFormatter(logging.Formatter
 
76
                       ('Mandos [%(process)d]: %(levelname)s:'
 
77
                        ' %(message)s'))
74
78
logger.addHandler(syslogger)
75
79
 
76
80
console = logging.StreamHandler()
77
 
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
 
                                       ' %(message)s'))
 
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
82
                                       ' %(levelname)s: %(message)s'))
79
83
logger.addHandler(console)
80
84
 
81
85
class AvahiError(Exception):
82
 
    def __init__(self, value):
 
86
    def __init__(self, value, *args, **kwargs):
83
87
        self.value = value
84
 
    def __str__(self):
85
 
        return repr(self.value)
 
88
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
89
    def __unicode__(self):
 
90
        return unicode(repr(self.value))
86
91
 
87
92
class AvahiServiceError(AvahiError):
88
93
    pass
108
113
                  a sensible number of times
109
114
    """
110
115
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
 
                 type = None, port = None, TXT = None, domain = "",
112
 
                 host = "", max_renames = 32768):
 
116
                 servicetype = None, port = None, TXT = None,
 
117
                 domain = "", host = "", max_renames = 32768,
 
118
                 protocol = avahi.PROTO_UNSPEC):
113
119
        self.interface = interface
114
120
        self.name = name
115
 
        self.type = type
 
121
        self.type = servicetype
116
122
        self.port = port
117
 
        if TXT is None:
118
 
            self.TXT = []
119
 
        else:
120
 
            self.TXT = TXT
 
123
        self.TXT = TXT if TXT is not None else []
121
124
        self.domain = domain
122
125
        self.host = host
123
126
        self.rename_count = 0
124
127
        self.max_renames = max_renames
 
128
        self.protocol = protocol
125
129
    def rename(self):
126
130
        """Derived from the Avahi example code"""
127
131
        if self.rename_count >= self.max_renames:
128
132
            logger.critical(u"No suitable Zeroconf service name found"
129
133
                            u" after %i retries, exiting.",
130
 
                            rename_count)
131
 
            raise AvahiServiceError("Too many renames")
 
134
                            self.rename_count)
 
135
            raise AvahiServiceError(u"Too many renames")
132
136
        self.name = server.GetAlternativeServiceName(self.name)
133
137
        logger.info(u"Changing Zeroconf service name to %r ...",
134
138
                    str(self.name))
135
 
        syslogger.setFormatter(logging.Formatter\
136
 
                               ('Mandos (%s): %%(levelname)s:'
137
 
                               ' %%(message)s' % self.name))
 
139
        syslogger.setFormatter(logging.Formatter
 
140
                               ('Mandos (%s) [%%(process)d]:'
 
141
                                ' %%(levelname)s: %%(message)s'
 
142
                                % self.name))
138
143
        self.remove()
139
144
        self.add()
140
145
        self.rename_count += 1
146
151
        """Derived from the Avahi example code"""
147
152
        global group
148
153
        if group is None:
149
 
            group = dbus.Interface\
150
 
                    (bus.get_object(avahi.DBUS_NAME,
 
154
            group = dbus.Interface(bus.get_object
 
155
                                   (avahi.DBUS_NAME,
151
156
                                    server.EntryGroupNew()),
152
 
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
157
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
158
            group.connect_to_signal('StateChanged',
154
159
                                    entry_group_state_changed)
155
160
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
156
161
                     service.name, service.type)
157
162
        group.AddService(
158
163
                self.interface,         # interface
159
 
                avahi.PROTO_INET6,      # protocol
 
164
                self.protocol,          # protocol
160
165
                dbus.UInt32(0),         # flags
161
166
                self.name, self.type,
162
167
                self.domain, self.host,
169
174
# End of Avahi example code
170
175
 
171
176
 
 
177
def _datetime_to_dbus(dt, variant_level=0):
 
178
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
179
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
180
 
 
181
 
172
182
class Client(object):
173
183
    """A representation of a client host served by this server.
174
184
    Attributes:
175
 
    name:      string; from the config file, used in log messages
 
185
    name:       string; from the config file, used in log messages and
 
186
                        D-Bus identifiers
176
187
    fingerprint: string (40 or 32 hexadecimal digits); used to
177
188
                 uniquely identify the client
178
 
    secret:    bytestring; sent verbatim (over TLS) to client
179
 
    host:      string; available for use by the checker command
180
 
    created:   datetime.datetime(); object creation, not client host
181
 
    last_checked_ok: datetime.datetime() or None if not yet checked OK
182
 
    timeout:   datetime.timedelta(); How long from last_checked_ok
183
 
                                     until this client is invalid
184
 
    interval:  datetime.timedelta(); How often to start a new checker
185
 
    stop_hook: If set, called by stop() as stop_hook(self)
186
 
    checker:   subprocess.Popen(); a running checker process used
187
 
                                   to see if the client lives.
188
 
                                   'None' if no process is running.
 
189
    secret:     bytestring; sent verbatim (over TLS) to client
 
190
    host:       string; available for use by the checker command
 
191
    created:    datetime.datetime(); (UTC) object creation
 
192
    last_enabled: datetime.datetime(); (UTC)
 
193
    enabled:    bool()
 
194
    last_checked_ok: datetime.datetime(); (UTC) or None
 
195
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
196
                                      until this client is invalid
 
197
    interval:   datetime.timedelta(); How often to start a new checker
 
198
    disable_hook:  If set, called by disable() as disable_hook(self)
 
199
    checker:    subprocess.Popen(); a running checker process used
 
200
                                    to see if the client lives.
 
201
                                    'None' if no process is running.
189
202
    checker_initiator_tag: a gobject event source tag, or None
190
 
    stop_initiator_tag:    - '' -
 
203
    disable_initiator_tag:    - '' -
191
204
    checker_callback_tag:  - '' -
192
205
    checker_command: string; External command which is run to check if
193
206
                     client lives.  %() expansions are done at
194
207
                     runtime with vars(self) as dict, so that for
195
208
                     instance %(name)s can be used in the command.
196
 
    Private attibutes:
197
 
    _timeout: Real variable for 'timeout'
198
 
    _interval: Real variable for 'interval'
199
 
    _timeout_milliseconds: Used when calling gobject.timeout_add()
200
 
    _interval_milliseconds: - '' -
 
209
    current_checker_command: string; current running checker_command
201
210
    """
202
 
    def _set_timeout(self, timeout):
203
 
        "Setter function for 'timeout' attribute"
204
 
        self._timeout = timeout
205
 
        self._timeout_milliseconds = ((self.timeout.days
206
 
                                       * 24 * 60 * 60 * 1000)
207
 
                                      + (self.timeout.seconds * 1000)
208
 
                                      + (self.timeout.microseconds
209
 
                                         // 1000))
210
 
    timeout = property(lambda self: self._timeout,
211
 
                       _set_timeout)
212
 
    del _set_timeout
213
 
    def _set_interval(self, interval):
214
 
        "Setter function for 'interval' attribute"
215
 
        self._interval = interval
216
 
        self._interval_milliseconds = ((self.interval.days
217
 
                                        * 24 * 60 * 60 * 1000)
218
 
                                       + (self.interval.seconds
219
 
                                          * 1000)
220
 
                                       + (self.interval.microseconds
221
 
                                          // 1000))
222
 
    interval = property(lambda self: self._interval,
223
 
                        _set_interval)
224
 
    del _set_interval
225
 
    def __init__(self, name = None, stop_hook=None, config={}):
 
211
    def timeout_milliseconds(self):
 
212
        "Return the 'timeout' attribute in milliseconds"
 
213
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
 
214
                + (self.timeout.seconds * 1000)
 
215
                + (self.timeout.microseconds // 1000))
 
216
    
 
217
    def interval_milliseconds(self):
 
218
        "Return the 'interval' attribute in milliseconds"
 
219
        return ((self.interval.days * 24 * 60 * 60 * 1000)
 
220
                + (self.interval.seconds * 1000)
 
221
                + (self.interval.microseconds // 1000))
 
222
    
 
223
    def __init__(self, name = None, disable_hook=None, config=None):
226
224
        """Note: the 'checker' key in 'config' sets the
227
225
        'checker_command' attribute and *not* the 'checker'
228
226
        attribute."""
229
227
        self.name = name
 
228
        if config is None:
 
229
            config = {}
230
230
        logger.debug(u"Creating client %r", self.name)
231
231
        # Uppercase and remove spaces from fingerprint for later
232
232
        # comparison purposes with return value from the fingerprint()
233
233
        # function
234
 
        self.fingerprint = config["fingerprint"].upper()\
235
 
                           .replace(u" ", u"")
 
234
        self.fingerprint = (config["fingerprint"].upper()
 
235
                            .replace(u" ", u""))
236
236
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
237
237
        if "secret" in config:
238
238
            self.secret = config["secret"].decode(u"base64")
239
239
        elif "secfile" in config:
240
 
            sf = open(config["secfile"])
241
 
            self.secret = sf.read()
242
 
            sf.close()
 
240
            with closing(open(os.path.expanduser
 
241
                              (os.path.expandvars
 
242
                               (config["secfile"])))) as secfile:
 
243
                self.secret = secfile.read()
243
244
        else:
244
245
            raise TypeError(u"No secret or secfile for client %s"
245
246
                            % self.name)
246
247
        self.host = config.get("host", "")
247
 
        self.created = datetime.datetime.now()
 
248
        self.created = datetime.datetime.utcnow()
 
249
        self.enabled = False
 
250
        self.last_enabled = None
248
251
        self.last_checked_ok = None
249
252
        self.timeout = string_to_delta(config["timeout"])
250
253
        self.interval = string_to_delta(config["interval"])
251
 
        self.stop_hook = stop_hook
 
254
        self.disable_hook = disable_hook
252
255
        self.checker = None
253
256
        self.checker_initiator_tag = None
254
 
        self.stop_initiator_tag = None
 
257
        self.disable_initiator_tag = None
255
258
        self.checker_callback_tag = None
256
 
        self.check_command = config["checker"]
257
 
    def start(self):
 
259
        self.checker_command = config["checker"]
 
260
        self.current_checker_command = None
 
261
        self.last_connect = None
 
262
    
 
263
    def enable(self):
258
264
        """Start this client's checker and timeout hooks"""
 
265
        self.last_enabled = datetime.datetime.utcnow()
259
266
        # Schedule a new checker to be started an 'interval' from now,
260
267
        # and every interval from then on.
261
 
        self.checker_initiator_tag = gobject.timeout_add\
262
 
                                     (self._interval_milliseconds,
263
 
                                      self.start_checker)
 
268
        self.checker_initiator_tag = (gobject.timeout_add
 
269
                                      (self.interval_milliseconds(),
 
270
                                       self.start_checker))
264
271
        # Also start a new checker *right now*.
265
272
        self.start_checker()
266
 
        # Schedule a stop() when 'timeout' has passed
267
 
        self.stop_initiator_tag = gobject.timeout_add\
268
 
                                  (self._timeout_milliseconds,
269
 
                                   self.stop)
270
 
    def stop(self):
271
 
        """Stop this client.
272
 
        The possibility that a client might be restarted is left open,
273
 
        but not currently used."""
274
 
        # If this client doesn't have a secret, it is already stopped.
275
 
        if hasattr(self, "secret") and self.secret:
276
 
            logger.info(u"Stopping client %s", self.name)
277
 
            self.secret = None
278
 
        else:
 
273
        # Schedule a disable() when 'timeout' has passed
 
274
        self.disable_initiator_tag = (gobject.timeout_add
 
275
                                   (self.timeout_milliseconds(),
 
276
                                    self.disable))
 
277
        self.enabled = True
 
278
    
 
279
    def disable(self):
 
280
        """Disable this client."""
 
281
        if not getattr(self, "enabled", False):
279
282
            return False
280
 
        if getattr(self, "stop_initiator_tag", False):
281
 
            gobject.source_remove(self.stop_initiator_tag)
282
 
            self.stop_initiator_tag = None
 
283
        logger.info(u"Disabling client %s", self.name)
 
284
        if getattr(self, "disable_initiator_tag", False):
 
285
            gobject.source_remove(self.disable_initiator_tag)
 
286
            self.disable_initiator_tag = None
283
287
        if getattr(self, "checker_initiator_tag", False):
284
288
            gobject.source_remove(self.checker_initiator_tag)
285
289
            self.checker_initiator_tag = None
286
290
        self.stop_checker()
287
 
        if self.stop_hook:
288
 
            self.stop_hook(self)
 
291
        if self.disable_hook:
 
292
            self.disable_hook(self)
 
293
        self.enabled = False
289
294
        # Do not run this again if called by a gobject.timeout_add
290
295
        return False
 
296
    
291
297
    def __del__(self):
292
 
        self.stop_hook = None
293
 
        self.stop()
294
 
    def checker_callback(self, pid, condition):
 
298
        self.disable_hook = None
 
299
        self.disable()
 
300
    
 
301
    def checker_callback(self, pid, condition, command):
295
302
        """The checker has completed, so take appropriate actions."""
296
 
        now = datetime.datetime.now()
297
303
        self.checker_callback_tag = None
298
304
        self.checker = None
299
 
        if os.WIFEXITED(condition) \
300
 
               and (os.WEXITSTATUS(condition) == 0):
301
 
            logger.info(u"Checker for %(name)s succeeded",
302
 
                        vars(self))
303
 
            self.last_checked_ok = now
304
 
            gobject.source_remove(self.stop_initiator_tag)
305
 
            self.stop_initiator_tag = gobject.timeout_add\
306
 
                                      (self._timeout_milliseconds,
307
 
                                       self.stop)
308
 
        elif not os.WIFEXITED(condition):
 
305
        if os.WIFEXITED(condition):
 
306
            exitstatus = os.WEXITSTATUS(condition)
 
307
            if exitstatus == 0:
 
308
                logger.info(u"Checker for %(name)s succeeded",
 
309
                            vars(self))
 
310
                self.checked_ok()
 
311
            else:
 
312
                logger.info(u"Checker for %(name)s failed",
 
313
                            vars(self))
 
314
        else:
309
315
            logger.warning(u"Checker for %(name)s crashed?",
310
316
                           vars(self))
311
 
        else:
312
 
            logger.info(u"Checker for %(name)s failed",
313
 
                        vars(self))
 
317
    
 
318
    def checked_ok(self):
 
319
        """Bump up the timeout for this client.
 
320
        This should only be called when the client has been seen,
 
321
        alive and well.
 
322
        """
 
323
        self.last_checked_ok = datetime.datetime.utcnow()
 
324
        gobject.source_remove(self.disable_initiator_tag)
 
325
        self.disable_initiator_tag = (gobject.timeout_add
 
326
                                      (self.timeout_milliseconds(),
 
327
                                       self.disable))
 
328
    
314
329
    def start_checker(self):
315
330
        """Start a new checker subprocess if one is not running.
316
331
        If a checker already exists, leave it running and do
323
338
        # checkers alone, the checker would have to take more time
324
339
        # than 'timeout' for the client to be declared invalid, which
325
340
        # is as it should be.
 
341
        
 
342
        # If a checker exists, make sure it is not a zombie
 
343
        if self.checker is not None:
 
344
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
345
            if pid:
 
346
                logger.warning("Checker was a zombie")
 
347
                gobject.source_remove(self.checker_callback_tag)
 
348
                self.checker_callback(pid, status,
 
349
                                      self.current_checker_command)
 
350
        # Start a new checker if needed
326
351
        if self.checker is None:
327
352
            try:
328
 
                # In case check_command has exactly one % operator
329
 
                command = self.check_command % self.host
 
353
                # In case checker_command has exactly one % operator
 
354
                command = self.checker_command % self.host
330
355
            except TypeError:
331
356
                # Escape attributes for the shell
332
357
                escaped_attrs = dict((key, re.escape(str(val)))
333
358
                                     for key, val in
334
359
                                     vars(self).iteritems())
335
360
                try:
336
 
                    command = self.check_command % escaped_attrs
 
361
                    command = self.checker_command % escaped_attrs
337
362
                except TypeError, error:
338
363
                    logger.error(u'Could not format string "%s":'
339
 
                                 u' %s', self.check_command, error)
 
364
                                 u' %s', self.checker_command, error)
340
365
                    return True # Try again later
 
366
            self.current_checker_command = command
341
367
            try:
342
368
                logger.info(u"Starting checker %r for %s",
343
369
                            command, self.name)
348
374
                self.checker = subprocess.Popen(command,
349
375
                                                close_fds=True,
350
376
                                                shell=True, cwd="/")
351
 
                self.checker_callback_tag = gobject.child_watch_add\
352
 
                                            (self.checker.pid,
353
 
                                             self.checker_callback)
 
377
                self.checker_callback_tag = (gobject.child_watch_add
 
378
                                             (self.checker.pid,
 
379
                                              self.checker_callback,
 
380
                                              data=command))
 
381
                # The checker may have completed before the gobject
 
382
                # watch was added.  Check for this.
 
383
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
384
                if pid:
 
385
                    gobject.source_remove(self.checker_callback_tag)
 
386
                    self.checker_callback(pid, status, command)
354
387
            except OSError, error:
355
388
                logger.error(u"Failed to start subprocess: %s",
356
389
                             error)
357
390
        # Re-run this periodically if run by gobject.timeout_add
358
391
        return True
 
392
    
359
393
    def stop_checker(self):
360
394
        """Force the checker process, if any, to stop."""
361
395
        if self.checker_callback_tag:
373
407
            if error.errno != errno.ESRCH: # No such process
374
408
                raise
375
409
        self.checker = None
 
410
    
376
411
    def still_valid(self):
377
412
        """Has the timeout not yet passed for this client?"""
378
 
        now = datetime.datetime.now()
 
413
        if not getattr(self, "enabled", False):
 
414
            return False
 
415
        now = datetime.datetime.utcnow()
379
416
        if self.last_checked_ok is None:
380
417
            return now < (self.created + self.timeout)
381
418
        else:
382
419
            return now < (self.last_checked_ok + self.timeout)
383
420
 
384
421
 
 
422
class ClientDBus(Client, dbus.service.Object):
 
423
    """A Client class using D-Bus
 
424
    Attributes:
 
425
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
 
426
    """
 
427
    # dbus.service.Object doesn't use super(), so we can't either.
 
428
    
 
429
    def __init__(self, *args, **kwargs):
 
430
        Client.__init__(self, *args, **kwargs)
 
431
        # Only now, when this client is initialized, can it show up on
 
432
        # the D-Bus
 
433
        self.dbus_object_path = (dbus.ObjectPath
 
434
                                 ("/clients/"
 
435
                                  + self.name.replace(".", "_")))
 
436
        dbus.service.Object.__init__(self, bus,
 
437
                                     self.dbus_object_path)
 
438
    def enable(self):
 
439
        oldstate = getattr(self, "enabled", False)
 
440
        r = Client.enable(self)
 
441
        if oldstate != self.enabled:
 
442
            # Emit D-Bus signals
 
443
            self.PropertyChanged(dbus.String(u"enabled"),
 
444
                                 dbus.Boolean(True, variant_level=1))
 
445
            self.PropertyChanged(dbus.String(u"last_enabled"),
 
446
                                 (_datetime_to_dbus(self.last_enabled,
 
447
                                                    variant_level=1)))
 
448
        return r
 
449
    
 
450
    def disable(self, signal = True):
 
451
        oldstate = getattr(self, "enabled", False)
 
452
        r = Client.disable(self)
 
453
        if signal and oldstate != self.enabled:
 
454
            # Emit D-Bus signal
 
455
            self.PropertyChanged(dbus.String(u"enabled"),
 
456
                                 dbus.Boolean(False, variant_level=1))
 
457
        return r
 
458
    
 
459
    def __del__(self, *args, **kwargs):
 
460
        try:
 
461
            self.remove_from_connection()
 
462
        except LookupError:
 
463
            pass
 
464
        if hasattr(dbus.service.Object, "__del__"):
 
465
            dbus.service.Object.__del__(self, *args, **kwargs)
 
466
        Client.__del__(self, *args, **kwargs)
 
467
    
 
468
    def checker_callback(self, pid, condition, command,
 
469
                         *args, **kwargs):
 
470
        self.checker_callback_tag = None
 
471
        self.checker = None
 
472
        # Emit D-Bus signal
 
473
        self.PropertyChanged(dbus.String(u"checker_running"),
 
474
                             dbus.Boolean(False, variant_level=1))
 
475
        if os.WIFEXITED(condition):
 
476
            exitstatus = os.WEXITSTATUS(condition)
 
477
            # Emit D-Bus signal
 
478
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
479
                                  dbus.Int64(condition),
 
480
                                  dbus.String(command))
 
481
        else:
 
482
            # Emit D-Bus signal
 
483
            self.CheckerCompleted(dbus.Int16(-1),
 
484
                                  dbus.Int64(condition),
 
485
                                  dbus.String(command))
 
486
        
 
487
        return Client.checker_callback(self, pid, condition, command,
 
488
                                       *args, **kwargs)
 
489
    
 
490
    def checked_ok(self, *args, **kwargs):
 
491
        r = Client.checked_ok(self, *args, **kwargs)
 
492
        # Emit D-Bus signal
 
493
        self.PropertyChanged(
 
494
            dbus.String(u"last_checked_ok"),
 
495
            (_datetime_to_dbus(self.last_checked_ok,
 
496
                               variant_level=1)))
 
497
        return r
 
498
    
 
499
    def start_checker(self, *args, **kwargs):
 
500
        old_checker = self.checker
 
501
        if self.checker is not None:
 
502
            old_checker_pid = self.checker.pid
 
503
        else:
 
504
            old_checker_pid = None
 
505
        r = Client.start_checker(self, *args, **kwargs)
 
506
        # Only if new checker process was started
 
507
        if (self.checker is not None
 
508
            and old_checker_pid != self.checker.pid):
 
509
            # Emit D-Bus signal
 
510
            self.CheckerStarted(self.current_checker_command)
 
511
            self.PropertyChanged(
 
512
                dbus.String("checker_running"),
 
513
                dbus.Boolean(True, variant_level=1))
 
514
        return r
 
515
    
 
516
    def stop_checker(self, *args, **kwargs):
 
517
        old_checker = getattr(self, "checker", None)
 
518
        r = Client.stop_checker(self, *args, **kwargs)
 
519
        if (old_checker is not None
 
520
            and getattr(self, "checker", None) is None):
 
521
            self.PropertyChanged(dbus.String(u"checker_running"),
 
522
                                 dbus.Boolean(False, variant_level=1))
 
523
        return r
 
524
    
 
525
    ## D-Bus methods & signals
 
526
    _interface = u"se.bsnet.fukt.Mandos.Client"
 
527
    
 
528
    # CheckedOK - method
 
529
    CheckedOK = dbus.service.method(_interface)(checked_ok)
 
530
    CheckedOK.__name__ = "CheckedOK"
 
531
    
 
532
    # CheckerCompleted - signal
 
533
    @dbus.service.signal(_interface, signature="nxs")
 
534
    def CheckerCompleted(self, exitcode, waitstatus, command):
 
535
        "D-Bus signal"
 
536
        pass
 
537
    
 
538
    # CheckerStarted - signal
 
539
    @dbus.service.signal(_interface, signature="s")
 
540
    def CheckerStarted(self, command):
 
541
        "D-Bus signal"
 
542
        pass
 
543
    
 
544
    # GetAllProperties - method
 
545
    @dbus.service.method(_interface, out_signature="a{sv}")
 
546
    def GetAllProperties(self):
 
547
        "D-Bus method"
 
548
        return dbus.Dictionary({
 
549
                dbus.String("name"):
 
550
                    dbus.String(self.name, variant_level=1),
 
551
                dbus.String("fingerprint"):
 
552
                    dbus.String(self.fingerprint, variant_level=1),
 
553
                dbus.String("host"):
 
554
                    dbus.String(self.host, variant_level=1),
 
555
                dbus.String("created"):
 
556
                    _datetime_to_dbus(self.created, variant_level=1),
 
557
                dbus.String("last_enabled"):
 
558
                    (_datetime_to_dbus(self.last_enabled,
 
559
                                       variant_level=1)
 
560
                     if self.last_enabled is not None
 
561
                     else dbus.Boolean(False, variant_level=1)),
 
562
                dbus.String("enabled"):
 
563
                    dbus.Boolean(self.enabled, variant_level=1),
 
564
                dbus.String("last_checked_ok"):
 
565
                    (_datetime_to_dbus(self.last_checked_ok,
 
566
                                       variant_level=1)
 
567
                     if self.last_checked_ok is not None
 
568
                     else dbus.Boolean (False, variant_level=1)),
 
569
                dbus.String("timeout"):
 
570
                    dbus.UInt64(self.timeout_milliseconds(),
 
571
                                variant_level=1),
 
572
                dbus.String("interval"):
 
573
                    dbus.UInt64(self.interval_milliseconds(),
 
574
                                variant_level=1),
 
575
                dbus.String("checker"):
 
576
                    dbus.String(self.checker_command,
 
577
                                variant_level=1),
 
578
                dbus.String("checker_running"):
 
579
                    dbus.Boolean(self.checker is not None,
 
580
                                 variant_level=1),
 
581
                dbus.String("object_path"):
 
582
                    dbus.ObjectPath(self.dbus_object_path,
 
583
                                    variant_level=1)
 
584
                }, signature="sv")
 
585
    
 
586
    # IsStillValid - method
 
587
    @dbus.service.method(_interface, out_signature="b")
 
588
    def IsStillValid(self):
 
589
        return self.still_valid()
 
590
    
 
591
    # PropertyChanged - signal
 
592
    @dbus.service.signal(_interface, signature="sv")
 
593
    def PropertyChanged(self, property, value):
 
594
        "D-Bus signal"
 
595
        pass
 
596
    
 
597
    # ReceivedSecret - signal
 
598
    @dbus.service.signal(_interface)
 
599
    def ReceivedSecret(self):
 
600
        "D-Bus signal"
 
601
        pass
 
602
    
 
603
    # Rejected - signal
 
604
    @dbus.service.signal(_interface)
 
605
    def Rejected(self):
 
606
        "D-Bus signal"
 
607
        pass
 
608
    
 
609
    # SetChecker - method
 
610
    @dbus.service.method(_interface, in_signature="s")
 
611
    def SetChecker(self, checker):
 
612
        "D-Bus setter method"
 
613
        self.checker_command = checker
 
614
        # Emit D-Bus signal
 
615
        self.PropertyChanged(dbus.String(u"checker"),
 
616
                             dbus.String(self.checker_command,
 
617
                                         variant_level=1))
 
618
    
 
619
    # SetHost - method
 
620
    @dbus.service.method(_interface, in_signature="s")
 
621
    def SetHost(self, host):
 
622
        "D-Bus setter method"
 
623
        self.host = host
 
624
        # Emit D-Bus signal
 
625
        self.PropertyChanged(dbus.String(u"host"),
 
626
                             dbus.String(self.host, variant_level=1))
 
627
    
 
628
    # SetInterval - method
 
629
    @dbus.service.method(_interface, in_signature="t")
 
630
    def SetInterval(self, milliseconds):
 
631
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
 
632
        # Emit D-Bus signal
 
633
        self.PropertyChanged(dbus.String(u"interval"),
 
634
                             (dbus.UInt64(self.interval_milliseconds(),
 
635
                                          variant_level=1)))
 
636
    
 
637
    # SetSecret - method
 
638
    @dbus.service.method(_interface, in_signature="ay",
 
639
                         byte_arrays=True)
 
640
    def SetSecret(self, secret):
 
641
        "D-Bus setter method"
 
642
        self.secret = str(secret)
 
643
    
 
644
    # SetTimeout - method
 
645
    @dbus.service.method(_interface, in_signature="t")
 
646
    def SetTimeout(self, milliseconds):
 
647
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
 
648
        # Emit D-Bus signal
 
649
        self.PropertyChanged(dbus.String(u"timeout"),
 
650
                             (dbus.UInt64(self.timeout_milliseconds(),
 
651
                                          variant_level=1)))
 
652
    
 
653
    # Enable - method
 
654
    Enable = dbus.service.method(_interface)(enable)
 
655
    Enable.__name__ = "Enable"
 
656
    
 
657
    # StartChecker - method
 
658
    @dbus.service.method(_interface)
 
659
    def StartChecker(self):
 
660
        "D-Bus method"
 
661
        self.start_checker()
 
662
    
 
663
    # Disable - method
 
664
    @dbus.service.method(_interface)
 
665
    def Disable(self):
 
666
        "D-Bus method"
 
667
        self.disable()
 
668
    
 
669
    # StopChecker - method
 
670
    StopChecker = dbus.service.method(_interface)(stop_checker)
 
671
    StopChecker.__name__ = "StopChecker"
 
672
    
 
673
    del _interface
 
674
 
 
675
 
385
676
def peer_certificate(session):
386
677
    "Return the peer's OpenPGP certificate as a bytestring"
387
678
    # If not an OpenPGP certificate...
388
 
    if gnutls.library.functions.gnutls_certificate_type_get\
389
 
            (session._c_object) \
390
 
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
 
679
    if (gnutls.library.functions
 
680
        .gnutls_certificate_type_get(session._c_object)
 
681
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
391
682
        # ...do the normal thing
392
683
        return session.peer_certificate
393
 
    list_size = ctypes.c_uint()
394
 
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
 
        (session._c_object, ctypes.byref(list_size))
 
684
    list_size = ctypes.c_uint(1)
 
685
    cert_list = (gnutls.library.functions
 
686
                 .gnutls_certificate_get_peers
 
687
                 (session._c_object, ctypes.byref(list_size)))
 
688
    if not bool(cert_list) and list_size.value != 0:
 
689
        raise gnutls.errors.GNUTLSError("error getting peer"
 
690
                                        " certificate")
396
691
    if list_size.value == 0:
397
692
        return None
398
693
    cert = cert_list[0]
402
697
def fingerprint(openpgp):
403
698
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
699
    # New GnuTLS "datum" with the OpenPGP public key
405
 
    datum = gnutls.library.types.gnutls_datum_t\
406
 
        (ctypes.cast(ctypes.c_char_p(openpgp),
407
 
                     ctypes.POINTER(ctypes.c_ubyte)),
408
 
         ctypes.c_uint(len(openpgp)))
 
700
    datum = (gnutls.library.types
 
701
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
702
                                         ctypes.POINTER
 
703
                                         (ctypes.c_ubyte)),
 
704
                             ctypes.c_uint(len(openpgp))))
409
705
    # New empty GnuTLS certificate
410
706
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
 
    gnutls.library.functions.gnutls_openpgp_crt_init\
412
 
        (ctypes.byref(crt))
 
707
    (gnutls.library.functions
 
708
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
413
709
    # Import the OpenPGP public key into the certificate
414
 
    gnutls.library.functions.gnutls_openpgp_crt_import\
415
 
                    (crt, ctypes.byref(datum),
416
 
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
710
    (gnutls.library.functions
 
711
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
712
                                gnutls.library.constants
 
713
                                .GNUTLS_OPENPGP_FMT_RAW))
417
714
    # Verify the self signature in the key
418
 
    crtverify = ctypes.c_uint();
419
 
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
 
        (crt, 0, ctypes.byref(crtverify))
 
715
    crtverify = ctypes.c_uint()
 
716
    (gnutls.library.functions
 
717
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
421
718
    if crtverify.value != 0:
422
719
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
720
        raise gnutls.errors.CertificateSecurityError("Verify failed")
424
721
    # New buffer for the fingerprint
425
 
    buffer = ctypes.create_string_buffer(20)
426
 
    buffer_length = ctypes.c_size_t()
 
722
    buf = ctypes.create_string_buffer(20)
 
723
    buf_len = ctypes.c_size_t()
427
724
    # Get the fingerprint from the certificate into the buffer
428
 
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
 
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
 
725
    (gnutls.library.functions
 
726
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
727
                                         ctypes.byref(buf_len)))
430
728
    # Deinit the certificate
431
729
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
730
    # Convert the buffer to a Python bytestring
433
 
    fpr = ctypes.string_at(buffer, buffer_length.value)
 
731
    fpr = ctypes.string_at(buf, buf_len.value)
434
732
    # Convert the bytestring to hexadecimal notation
435
733
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
436
734
    return hex_fpr
437
735
 
438
736
 
439
 
class tcp_handler(SocketServer.BaseRequestHandler, object):
 
737
class TCP_handler(SocketServer.BaseRequestHandler, object):
440
738
    """A TCP request handler class.
441
739
    Instantiated by IPv6_TCPServer for each request to handle it.
442
740
    Note: This will run in its own forked process."""
443
741
    
444
742
    def handle(self):
445
743
        logger.info(u"TCP connection from: %s",
446
 
                     unicode(self.client_address))
447
 
        session = gnutls.connection.ClientSession\
448
 
                  (self.request, gnutls.connection.X509Credentials())
449
 
        
450
 
        line = self.request.makefile().readline()
451
 
        logger.debug(u"Protocol version: %r", line)
452
 
        try:
453
 
            if int(line.strip().split()[0]) > 1:
454
 
                raise RuntimeError
455
 
        except (ValueError, IndexError, RuntimeError), error:
456
 
            logger.error(u"Unknown protocol version: %s", error)
457
 
            return
458
 
        
459
 
        # Note: gnutls.connection.X509Credentials is really a generic
460
 
        # GnuTLS certificate credentials object so long as no X.509
461
 
        # keys are added to it.  Therefore, we can use it here despite
462
 
        # using OpenPGP certificates.
463
 
        
464
 
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
 
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
 
        #                "+DHE-DSS"))
467
 
        priority = "NORMAL"             # Fallback default, since this
468
 
                                        # MUST be set.
469
 
        if self.server.settings["priority"]:
470
 
            priority = self.server.settings["priority"]
471
 
        gnutls.library.functions.gnutls_priority_set_direct\
472
 
            (session._c_object, priority, None);
473
 
        
474
 
        try:
475
 
            session.handshake()
476
 
        except gnutls.errors.GNUTLSError, error:
477
 
            logger.warning(u"Handshake failed: %s", error)
478
 
            # Do not run session.bye() here: the session is not
479
 
            # established.  Just abandon the request.
480
 
            return
481
 
        try:
482
 
            fpr = fingerprint(peer_certificate(session))
483
 
        except (TypeError, gnutls.errors.GNUTLSError), error:
484
 
            logger.warning(u"Bad certificate: %s", error)
485
 
            session.bye()
486
 
            return
487
 
        logger.debug(u"Fingerprint: %s", fpr)
488
 
        client = None
489
 
        for c in self.server.clients:
490
 
            if c.fingerprint == fpr:
491
 
                client = c
492
 
                break
493
 
        if not client:
494
 
            logger.warning(u"Client not found for fingerprint: %s",
495
 
                           fpr)
496
 
            session.bye()
497
 
            return
498
 
        # Have to check if client.still_valid(), since it is possible
499
 
        # that the client timed out while establishing the GnuTLS
500
 
        # session.
501
 
        if not client.still_valid():
502
 
            logger.warning(u"Client %(name)s is invalid",
503
 
                           vars(client))
504
 
            session.bye()
505
 
            return
506
 
        sent_size = 0
507
 
        while sent_size < len(client.secret):
508
 
            sent = session.send(client.secret[sent_size:])
509
 
            logger.debug(u"Sent: %d, remaining: %d",
510
 
                         sent, len(client.secret)
511
 
                         - (sent_size + sent))
512
 
            sent_size += sent
513
 
        session.bye()
514
 
 
515
 
 
516
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
 
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
 
744
                    unicode(self.client_address))
 
745
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
 
746
        # Open IPC pipe to parent process
 
747
        with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
 
748
            session = (gnutls.connection
 
749
                       .ClientSession(self.request,
 
750
                                      gnutls.connection
 
751
                                      .X509Credentials()))
 
752
            
 
753
            line = self.request.makefile().readline()
 
754
            logger.debug(u"Protocol version: %r", line)
 
755
            try:
 
756
                if int(line.strip().split()[0]) > 1:
 
757
                    raise RuntimeError
 
758
            except (ValueError, IndexError, RuntimeError), error:
 
759
                logger.error(u"Unknown protocol version: %s", error)
 
760
                return
 
761
            
 
762
            # Note: gnutls.connection.X509Credentials is really a
 
763
            # generic GnuTLS certificate credentials object so long as
 
764
            # no X.509 keys are added to it.  Therefore, we can use it
 
765
            # here despite using OpenPGP certificates.
 
766
            
 
767
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
768
            #                     "+AES-256-CBC", "+SHA1",
 
769
            #                     "+COMP-NULL", "+CTYPE-OPENPGP",
 
770
            #                     "+DHE-DSS"))
 
771
            # Use a fallback default, since this MUST be set.
 
772
            priority = self.server.settings.get("priority", "NORMAL")
 
773
            (gnutls.library.functions
 
774
             .gnutls_priority_set_direct(session._c_object,
 
775
                                         priority, None))
 
776
            
 
777
            try:
 
778
                session.handshake()
 
779
            except gnutls.errors.GNUTLSError, error:
 
780
                logger.warning(u"Handshake failed: %s", error)
 
781
                # Do not run session.bye() here: the session is not
 
782
                # established.  Just abandon the request.
 
783
                return
 
784
            logger.debug(u"Handshake succeeded")
 
785
            try:
 
786
                fpr = fingerprint(peer_certificate(session))
 
787
            except (TypeError, gnutls.errors.GNUTLSError), error:
 
788
                logger.warning(u"Bad certificate: %s", error)
 
789
                session.bye()
 
790
                return
 
791
            logger.debug(u"Fingerprint: %s", fpr)
 
792
            
 
793
            for c in self.server.clients:
 
794
                if c.fingerprint == fpr:
 
795
                    client = c
 
796
                    break
 
797
            else:
 
798
                logger.warning(u"Client not found for fingerprint: %s",
 
799
                               fpr)
 
800
                ipc.write("NOTFOUND %s\n" % fpr)
 
801
                session.bye()
 
802
                return
 
803
            # Have to check if client.still_valid(), since it is
 
804
            # possible that the client timed out while establishing
 
805
            # the GnuTLS session.
 
806
            if not client.still_valid():
 
807
                logger.warning(u"Client %(name)s is invalid",
 
808
                               vars(client))
 
809
                ipc.write("INVALID %s\n" % client.name)
 
810
                session.bye()
 
811
                return
 
812
            ipc.write("SENDING %s\n" % client.name)
 
813
            sent_size = 0
 
814
            while sent_size < len(client.secret):
 
815
                sent = session.send(client.secret[sent_size:])
 
816
                logger.debug(u"Sent: %d, remaining: %d",
 
817
                             sent, len(client.secret)
 
818
                             - (sent_size + sent))
 
819
                sent_size += sent
 
820
            session.bye()
 
821
 
 
822
 
 
823
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
 
824
    """Like SocketServer.ForkingMixIn, but also pass a pipe.
 
825
    Assumes a gobject.MainLoop event loop.
 
826
    """
 
827
    def process_request(self, request, client_address):
 
828
        """This overrides and wraps the original process_request().
 
829
        This function creates a new pipe in self.pipe 
 
830
        """
 
831
        self.pipe = os.pipe()
 
832
        super(ForkingMixInWithPipe,
 
833
              self).process_request(request, client_address)
 
834
        os.close(self.pipe[1])  # close write end
 
835
        # Call "handle_ipc" for both data and EOF events
 
836
        gobject.io_add_watch(self.pipe[0],
 
837
                             gobject.IO_IN | gobject.IO_HUP,
 
838
                             self.handle_ipc)
 
839
    def handle_ipc(source, condition):
 
840
        """Dummy function; override as necessary"""
 
841
        os.close(source)
 
842
        return False
 
843
 
 
844
 
 
845
class IPv6_TCPServer(ForkingMixInWithPipe,
 
846
                     SocketServer.TCPServer, object):
 
847
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
518
848
    Attributes:
519
849
        settings:       Server settings
520
850
        clients:        Set() of Client objects
528
858
        if "clients" in kwargs:
529
859
            self.clients = kwargs["clients"]
530
860
            del kwargs["clients"]
 
861
        if "use_ipv6" in kwargs:
 
862
            if not kwargs["use_ipv6"]:
 
863
                self.address_family = socket.AF_INET
 
864
            del kwargs["use_ipv6"]
531
865
        self.enabled = False
532
 
        return super(type(self), self).__init__(*args, **kwargs)
 
866
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
533
867
    def server_bind(self):
534
868
        """This overrides the normal server_bind() function
535
869
        to bind to an interface if one was specified, and also NOT to
547
881
                                 u" bind to interface %s",
548
882
                                 self.settings["interface"])
549
883
                else:
550
 
                    raise error
 
884
                    raise
551
885
        # Only bind(2) the socket if we really need to.
552
886
        if self.server_address[0] or self.server_address[1]:
553
887
            if not self.server_address[0]:
554
 
                in6addr_any = "::"
555
 
                self.server_address = (in6addr_any,
 
888
                if self.address_family == socket.AF_INET6:
 
889
                    any_address = "::" # in6addr_any
 
890
                else:
 
891
                    any_address = socket.INADDR_ANY
 
892
                self.server_address = (any_address,
556
893
                                       self.server_address[1])
557
894
            elif not self.server_address[1]:
558
895
                self.server_address = (self.server_address[0],
564
901
#                                            if_nametoindex
565
902
#                                            (self.settings
566
903
#                                             ["interface"]))
567
 
            return super(type(self), self).server_bind()
 
904
            return super(IPv6_TCPServer, self).server_bind()
568
905
    def server_activate(self):
569
906
        if self.enabled:
570
 
            return super(type(self), self).server_activate()
 
907
            return super(IPv6_TCPServer, self).server_activate()
571
908
    def enable(self):
572
909
        self.enabled = True
 
910
    def handle_ipc(self, source, condition, file_objects={}):
 
911
        condition_names = {
 
912
            gobject.IO_IN: "IN", # There is data to read.
 
913
            gobject.IO_OUT: "OUT", # Data can be written (without
 
914
                                   # blocking).
 
915
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
916
            gobject.IO_ERR: "ERR", # Error condition.
 
917
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
918
                                   # broken, usually for pipes and
 
919
                                   # sockets).
 
920
            }
 
921
        conditions_string = ' | '.join(name
 
922
                                       for cond, name in
 
923
                                       condition_names.iteritems()
 
924
                                       if cond & condition)
 
925
        logger.debug("Handling IPC: FD = %d, condition = %s", source,
 
926
                     conditions_string)
 
927
        
 
928
        # Turn the pipe file descriptor into a Python file object
 
929
        if source not in file_objects:
 
930
            file_objects[source] = os.fdopen(source, "r", 1)
 
931
        
 
932
        # Read a line from the file object
 
933
        cmdline = file_objects[source].readline()
 
934
        if not cmdline:             # Empty line means end of file
 
935
            # close the IPC pipe
 
936
            file_objects[source].close()
 
937
            del file_objects[source]
 
938
            
 
939
            # Stop calling this function
 
940
            return False
 
941
        
 
942
        logger.debug("IPC command: %r\n" % cmdline)
 
943
        
 
944
        # Parse and act on command
 
945
        cmd, args = cmdline.split(None, 1)
 
946
        if cmd == "NOTFOUND":
 
947
            if self.settings["use_dbus"]:
 
948
                # Emit D-Bus signal
 
949
                mandos_dbus_service.ClientNotFound(args)
 
950
        elif cmd == "INVALID":
 
951
            if self.settings["use_dbus"]:
 
952
                for client in self.clients:
 
953
                    if client.name == args:
 
954
                        # Emit D-Bus signal
 
955
                        client.Rejected()
 
956
                        break
 
957
        elif cmd == "SENDING":
 
958
            for client in self.clients:
 
959
                if client.name == args:
 
960
                    client.checked_ok()
 
961
                    if self.settings["use_dbus"]:
 
962
                        # Emit D-Bus signal
 
963
                        client.ReceivedSecret()
 
964
                    break
 
965
        else:
 
966
            logger.error("Unknown IPC command: %r", cmdline)
 
967
        
 
968
        # Keep calling this function
 
969
        return True
573
970
 
574
971
 
575
972
def string_to_delta(interval):
576
973
    """Parse a string and return a datetime.timedelta
577
 
 
 
974
    
578
975
    >>> string_to_delta('7d')
579
976
    datetime.timedelta(7)
580
977
    >>> string_to_delta('60s')
591
988
    timevalue = datetime.timedelta(0)
592
989
    for s in interval.split():
593
990
        try:
594
 
            suffix=unicode(s[-1])
595
 
            value=int(s[:-1])
 
991
            suffix = unicode(s[-1])
 
992
            value = int(s[:-1])
596
993
            if suffix == u"d":
597
994
                delta = datetime.timedelta(value)
598
995
            elif suffix == u"s":
632
1029
    elif state == avahi.ENTRY_GROUP_FAILURE:
633
1030
        logger.critical(u"Avahi: Error in group state changed %s",
634
1031
                        unicode(error))
635
 
        raise AvahiGroupError("State changed: %s", str(error))
 
1032
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
636
1033
 
637
1034
def if_nametoindex(interface):
638
1035
    """Call the C function if_nametoindex(), or equivalent"""
639
1036
    global if_nametoindex
640
1037
    try:
641
 
        if "ctypes.util" not in sys.modules:
642
 
            import ctypes.util
643
 
        if_nametoindex = ctypes.cdll.LoadLibrary\
644
 
            (ctypes.util.find_library("c")).if_nametoindex
 
1038
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1039
                          (ctypes.util.find_library("c"))
 
1040
                          .if_nametoindex)
645
1041
    except (OSError, AttributeError):
646
1042
        if "struct" not in sys.modules:
647
1043
            import struct
650
1046
        def if_nametoindex(interface):
651
1047
            "Get an interface index the hard way, i.e. using fcntl()"
652
1048
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
653
 
            s = socket.socket()
654
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
 
                                struct.pack("16s16x", interface))
656
 
            s.close()
 
1049
            with closing(socket.socket()) as s:
 
1050
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1051
                                    struct.pack("16s16x", interface))
657
1052
            interface_index = struct.unpack("I", ifreq[16:20])[0]
658
1053
            return interface_index
659
1054
    return if_nametoindex(interface)
683
1078
 
684
1079
 
685
1080
def main():
686
 
    global main_loop_started
687
 
    main_loop_started = False
688
 
    
689
 
    parser = OptionParser(version = "%%prog %s" % version)
 
1081
    
 
1082
    ######################################################################
 
1083
    # Parsing of options, both command line and config file
 
1084
    
 
1085
    parser = optparse.OptionParser(version = "%%prog %s" % version)
690
1086
    parser.add_option("-i", "--interface", type="string",
691
1087
                      metavar="IF", help="Bind to interface IF")
692
1088
    parser.add_option("-a", "--address", type="string",
693
1089
                      help="Address to listen for requests on")
694
1090
    parser.add_option("-p", "--port", type="int",
695
1091
                      help="Port number to receive requests on")
696
 
    parser.add_option("--check", action="store_true", default=False,
 
1092
    parser.add_option("--check", action="store_true",
697
1093
                      help="Run self-test")
698
1094
    parser.add_option("--debug", action="store_true",
699
1095
                      help="Debug mode; run in foreground and log to"
706
1102
                      default="/etc/mandos", metavar="DIR",
707
1103
                      help="Directory to search for configuration"
708
1104
                      " files")
709
 
    (options, args) = parser.parse_args()
 
1105
    parser.add_option("--no-dbus", action="store_false",
 
1106
                      dest="use_dbus",
 
1107
                      help="Do not provide D-Bus system bus"
 
1108
                      " interface")
 
1109
    parser.add_option("--no-ipv6", action="store_false",
 
1110
                      dest="use_ipv6", help="Do not use IPv6")
 
1111
    options = parser.parse_args()[0]
710
1112
    
711
1113
    if options.check:
712
1114
        import doctest
721
1123
                        "priority":
722
1124
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
723
1125
                        "servicename": "Mandos",
 
1126
                        "use_dbus": "True",
 
1127
                        "use_ipv6": "True",
724
1128
                        }
725
1129
    
726
1130
    # Parse config file for server-global settings
729
1133
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
730
1134
    # Convert the SafeConfigParser object to a dict
731
1135
    server_settings = server_config.defaults()
732
 
    # Use getboolean on the boolean config option
733
 
    server_settings["debug"] = server_config.getboolean\
734
 
                               ("DEFAULT", "debug")
 
1136
    # Use the appropriate methods on the non-string config options
 
1137
    server_settings["debug"] = server_config.getboolean("DEFAULT",
 
1138
                                                        "debug")
 
1139
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
 
1140
                                                           "use_dbus")
 
1141
    server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
 
1142
                                                           "use_ipv6")
 
1143
    if server_settings["port"]:
 
1144
        server_settings["port"] = server_config.getint("DEFAULT",
 
1145
                                                       "port")
735
1146
    del server_config
736
1147
    
737
1148
    # Override the settings from the config file with command line
738
1149
    # options, if set.
739
1150
    for option in ("interface", "address", "port", "debug",
740
 
                   "priority", "servicename", "configdir"):
 
1151
                   "priority", "servicename", "configdir",
 
1152
                   "use_dbus", "use_ipv6"):
741
1153
        value = getattr(options, option)
742
1154
        if value is not None:
743
1155
            server_settings[option] = value
744
1156
    del options
745
1157
    # Now we have our good server settings in "server_settings"
746
1158
    
 
1159
    ##################################################################
 
1160
    
 
1161
    # For convenience
747
1162
    debug = server_settings["debug"]
 
1163
    use_dbus = server_settings["use_dbus"]
 
1164
    use_ipv6 = server_settings["use_ipv6"]
748
1165
    
749
1166
    if not debug:
750
1167
        syslogger.setLevel(logging.WARNING)
751
1168
        console.setLevel(logging.WARNING)
752
1169
    
753
1170
    if server_settings["servicename"] != "Mandos":
754
 
        syslogger.setFormatter(logging.Formatter\
755
 
                               ('Mandos (%s): %%(levelname)s:'
756
 
                                ' %%(message)s'
 
1171
        syslogger.setFormatter(logging.Formatter
 
1172
                               ('Mandos (%s) [%%(process)d]:'
 
1173
                                ' %%(levelname)s: %%(message)s'
757
1174
                                % server_settings["servicename"]))
758
1175
    
759
1176
    # Parse config file with clients
760
1177
    client_defaults = { "timeout": "1h",
761
1178
                        "interval": "5m",
762
 
                        "checker": "fping -q -- %(host)s",
 
1179
                        "checker": "fping -q -- %%(host)s",
763
1180
                        "host": "",
764
1181
                        }
765
1182
    client_config = ConfigParser.SafeConfigParser(client_defaults)
766
1183
    client_config.read(os.path.join(server_settings["configdir"],
767
1184
                                    "clients.conf"))
 
1185
 
 
1186
    global mandos_dbus_service
 
1187
    mandos_dbus_service = None
768
1188
    
769
1189
    clients = Set()
770
1190
    tcp_server = IPv6_TCPServer((server_settings["address"],
771
1191
                                 server_settings["port"]),
772
 
                                tcp_handler,
 
1192
                                TCP_handler,
773
1193
                                settings=server_settings,
774
 
                                clients=clients)
 
1194
                                clients=clients, use_ipv6=use_ipv6)
775
1195
    pidfilename = "/var/run/mandos.pid"
776
1196
    try:
777
1197
        pidfile = open(pidfilename, "w")
778
 
    except IOError, error:
 
1198
    except IOError:
779
1199
        logger.error("Could not open file %r", pidfilename)
780
1200
    
781
 
    uid = 65534
782
 
    gid = 65534
783
 
    try:
784
 
        uid = pwd.getpwnam("mandos").pw_uid
785
 
    except KeyError:
786
 
        try:
787
 
            uid = pwd.getpwnam("nobody").pw_uid
788
 
        except KeyError:
789
 
            pass
790
 
    try:
791
 
        gid = pwd.getpwnam("mandos").pw_gid
792
 
    except KeyError:
793
 
        try:
794
 
            gid = pwd.getpwnam("nogroup").pw_gid
795
 
        except KeyError:
796
 
            pass
797
 
    try:
 
1201
    try:
 
1202
        uid = pwd.getpwnam("_mandos").pw_uid
 
1203
        gid = pwd.getpwnam("_mandos").pw_gid
 
1204
    except KeyError:
 
1205
        try:
 
1206
            uid = pwd.getpwnam("mandos").pw_uid
 
1207
            gid = pwd.getpwnam("mandos").pw_gid
 
1208
        except KeyError:
 
1209
            try:
 
1210
                uid = pwd.getpwnam("nobody").pw_uid
 
1211
                gid = pwd.getpwnam("nogroup").pw_gid
 
1212
            except KeyError:
 
1213
                uid = 65534
 
1214
                gid = 65534
 
1215
    try:
 
1216
        os.setgid(gid)
798
1217
        os.setuid(uid)
799
 
        os.setgid(gid)
800
1218
    except OSError, error:
801
1219
        if error[0] != errno.EPERM:
802
1220
            raise error
803
1221
    
 
1222
    # Enable all possible GnuTLS debugging
 
1223
    if debug:
 
1224
        # "Use a log level over 10 to enable all debugging options."
 
1225
        # - GnuTLS manual
 
1226
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
1227
        
 
1228
        @gnutls.library.types.gnutls_log_func
 
1229
        def debug_gnutls(level, string):
 
1230
            logger.debug("GnuTLS: %s", string[:-1])
 
1231
        
 
1232
        (gnutls.library.functions
 
1233
         .gnutls_global_set_log_function(debug_gnutls))
 
1234
    
804
1235
    global service
 
1236
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
805
1237
    service = AvahiService(name = server_settings["servicename"],
806
 
                           type = "_mandos._tcp", );
 
1238
                           servicetype = "_mandos._tcp",
 
1239
                           protocol = protocol)
807
1240
    if server_settings["interface"]:
808
 
        service.interface = if_nametoindex\
809
 
                            (server_settings["interface"])
 
1241
        service.interface = (if_nametoindex
 
1242
                             (server_settings["interface"]))
810
1243
    
811
1244
    global main_loop
812
1245
    global bus
819
1252
                                           avahi.DBUS_PATH_SERVER),
820
1253
                            avahi.DBUS_INTERFACE_SERVER)
821
1254
    # End of Avahi example code
822
 
    
823
 
    def remove_from_clients(client):
824
 
        clients.remove(client)
825
 
        if not clients:
826
 
            logger.critical(u"No clients left, exiting")
827
 
            sys.exit()
828
 
    
829
 
    clients.update(Set(Client(name = section,
830
 
                              stop_hook = remove_from_clients,
831
 
                              config
832
 
                              = dict(client_config.items(section)))
833
 
                       for section in client_config.sections()))
 
1255
    if use_dbus:
 
1256
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
 
1257
    
 
1258
    client_class = Client
 
1259
    if use_dbus:
 
1260
        client_class = ClientDBus
 
1261
    clients.update(Set(
 
1262
            client_class(name = section,
 
1263
                         config= dict(client_config.items(section)))
 
1264
            for section in client_config.sections()))
834
1265
    if not clients:
835
 
        logger.critical(u"No clients defined")
836
 
        sys.exit(1)
 
1266
        logger.warning(u"No clients defined")
837
1267
    
838
1268
    if debug:
839
1269
        # Redirect stdin so all checkers get /dev/null
848
1278
        daemon()
849
1279
    
850
1280
    try:
851
 
        pid = os.getpid()
852
 
        pidfile.write(str(pid) + "\n")
853
 
        pidfile.close()
 
1281
        with closing(pidfile):
 
1282
            pid = os.getpid()
 
1283
            pidfile.write(str(pid) + "\n")
854
1284
        del pidfile
855
 
    except IOError, err:
 
1285
    except IOError:
856
1286
        logger.error(u"Could not write to file %r with PID %d",
857
1287
                     pidfilename, pid)
858
1288
    except NameError:
871
1301
        
872
1302
        while clients:
873
1303
            client = clients.pop()
874
 
            client.stop_hook = None
875
 
            client.stop()
 
1304
            client.disable_hook = None
 
1305
            client.disable()
876
1306
    
877
1307
    atexit.register(cleanup)
878
1308
    
881
1311
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
882
1312
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
883
1313
    
 
1314
    if use_dbus:
 
1315
        class MandosDBusService(dbus.service.Object):
 
1316
            """A D-Bus proxy object"""
 
1317
            def __init__(self):
 
1318
                dbus.service.Object.__init__(self, bus, "/")
 
1319
            _interface = u"se.bsnet.fukt.Mandos"
 
1320
            
 
1321
            @dbus.service.signal(_interface, signature="oa{sv}")
 
1322
            def ClientAdded(self, objpath, properties):
 
1323
                "D-Bus signal"
 
1324
                pass
 
1325
            
 
1326
            @dbus.service.signal(_interface, signature="s")
 
1327
            def ClientNotFound(self, fingerprint):
 
1328
                "D-Bus signal"
 
1329
                pass
 
1330
            
 
1331
            @dbus.service.signal(_interface, signature="os")
 
1332
            def ClientRemoved(self, objpath, name):
 
1333
                "D-Bus signal"
 
1334
                pass
 
1335
            
 
1336
            @dbus.service.method(_interface, out_signature="ao")
 
1337
            def GetAllClients(self):
 
1338
                "D-Bus method"
 
1339
                return dbus.Array(c.dbus_object_path for c in clients)
 
1340
            
 
1341
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
 
1342
            def GetAllClientsWithProperties(self):
 
1343
                "D-Bus method"
 
1344
                return dbus.Dictionary(
 
1345
                    ((c.dbus_object_path, c.GetAllProperties())
 
1346
                     for c in clients),
 
1347
                    signature="oa{sv}")
 
1348
            
 
1349
            @dbus.service.method(_interface, in_signature="o")
 
1350
            def RemoveClient(self, object_path):
 
1351
                "D-Bus method"
 
1352
                for c in clients:
 
1353
                    if c.dbus_object_path == object_path:
 
1354
                        clients.remove(c)
 
1355
                        c.remove_from_connection()
 
1356
                        # Don't signal anything except ClientRemoved
 
1357
                        c.disable(signal=False)
 
1358
                        # Emit D-Bus signal
 
1359
                        self.ClientRemoved(object_path, c.name)
 
1360
                        return
 
1361
                raise KeyError
 
1362
            
 
1363
            del _interface
 
1364
        
 
1365
        mandos_dbus_service = MandosDBusService()
 
1366
    
884
1367
    for client in clients:
885
 
        client.start()
 
1368
        if use_dbus:
 
1369
            # Emit D-Bus signal
 
1370
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
 
1371
                                            client.GetAllProperties())
 
1372
        client.enable()
886
1373
    
887
1374
    tcp_server.enable()
888
1375
    tcp_server.server_activate()
889
1376
    
890
1377
    # Find out what port we got
891
1378
    service.port = tcp_server.socket.getsockname()[1]
892
 
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
893
 
                u" scope_id %d" % tcp_server.socket.getsockname())
 
1379
    if use_ipv6:
 
1380
        logger.info(u"Now listening on address %r, port %d,"
 
1381
                    " flowinfo %d, scope_id %d"
 
1382
                    % tcp_server.socket.getsockname())
 
1383
    else:                       # IPv4
 
1384
        logger.info(u"Now listening on address %r, port %d"
 
1385
                    % tcp_server.socket.getsockname())
894
1386
    
895
1387
    #service.interface = tcp_server.socket.getsockname()[3]
896
1388
    
906
1398
        
907
1399
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
908
1400
                             lambda *args, **kwargs:
909
 
                             tcp_server.handle_request\
910
 
                             (*args[2:], **kwargs) or True)
 
1401
                             (tcp_server.handle_request
 
1402
                              (*args[2:], **kwargs) or True))
911
1403
        
912
1404
        logger.debug(u"Starting main loop")
913
 
        main_loop_started = True
914
1405
        main_loop.run()
915
1406
    except AvahiError, error:
916
 
        logger.critical(u"AvahiError: %s" + unicode(error))
 
1407
        logger.critical(u"AvahiError: %s", error)
917
1408
        sys.exit(1)
918
1409
    except KeyboardInterrupt:
919
1410
        if debug:
920
 
            print
 
1411
            print >> sys.stderr
 
1412
        logger.debug("Server received KeyboardInterrupt")
 
1413
    logger.debug("Server exiting")
921
1414
 
922
1415
if __name__ == '__main__':
923
1416
    main()