/mandos/trunk : revision 336

55

import logging

56

import logging.handlers

57

import pwd

58

import contextlib

58

from contextlib import closing

59

import struct

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

64

61

65

62

import dbus

66

63

import dbus.service

69

66

from dbus.mainloop.glib import DBusGMainLoop

70

67

import ctypes

71

68

import ctypes.util

72

import xml.dom.minidom

73

import inspect

74

69

75

70

try:

76

71

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

78

73

try:

79

74

from IN import SO_BINDTODEVICE

80

75

except ImportError:

81

SO_BINDTODEVICE = None

82

83

84

version = "1.0.14"

85

86

#logger = logging.getLogger(u'mandos')

76

# From /usr/include/asm/socket.h

77

SO_BINDTODEVICE = 25

78

79

80

version = "1.0.8"

81

87

82

logger = logging.Logger(u'mandos')

88

83

syslogger = (logging.handlers.SysLogHandler

89

84

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

131

126

a sensible number of times

132

127

group: D-Bus Entry Group

133

128

server: D-Bus Server

134

bus: dbus.SystemBus()

135

129

"""

136

130

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

131

servicetype = None, port = None, TXT = None,

138

132

domain = u"", host = u"", max_renames = 32768,

139

protocol = avahi.PROTO_UNSPEC, bus = None):

133

protocol = avahi.PROTO_UNSPEC):

140

134

self.interface = interface

141

135

self.name = name

142

136

self.type = servicetype

149

143

self.protocol = protocol

150

144

self.group = None # our entry group

151

145

self.server = None

152

self.bus = bus

153

146

def rename(self):

154

147

"""Derived from the Avahi example code"""

155

148

if self.rename_count >= self.max_renames:

157

150

u" after %i retries, exiting.",

158

151

self.rename_count)

159

152

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

153

self.name = self.server.GetAlternativeServiceName(self.name)

161

154

logger.info(u"Changing Zeroconf service name to %r ...",

162

self.name)

155

unicode(self.name))

163

156

syslogger.setFormatter(logging.Formatter

164

157

(u'Mandos (%s) [%%(process)d]:'

165

158

u' %%(levelname)s: %%(message)s'

166

159

% self.name))

167

160

self.remove()

168

try:

169

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

172

self.cleanup()

173

os._exit(1)

161

self.add()

174

162

self.rename_count += 1

175

163

def remove(self):

176

164

"""Derived from the Avahi example code"""

180

168

"""Derived from the Avahi example code"""

181

169

if self.group is None:

182

170

self.group = dbus.Interface(

183

self.bus.get_object(avahi.DBUS_NAME,

184

self.server.EntryGroupNew()),

171

bus.get_object(avahi.DBUS_NAME,

172

self.server.EntryGroupNew()),

185

173

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

174

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

175

self.entry_group_state_changed)

189

176

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

190

177

self.name, self.type)

191

178

self.group.AddService(

199

186

self.group.Commit()

200

187

def entry_group_state_changed(self, state, error):

201

188

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

189

logger.debug(u"Avahi state change: %i", state)

203

190

204

191

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

192

logger.debug(u"Zeroconf service established.")

218

205

self.group = None

219

206

def server_state_changed(self, state):

220

207

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

208

if state == avahi.SERVER_COLLISION:

223

209

logger.error(u"Zeroconf server name collision")

224

210

self.remove()

228

214

"""Derived from the Avahi example code"""

229

215

if self.server is None:

230

216

self.server = dbus.Interface(

231

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

217

bus.get_object(avahi.DBUS_NAME,

218

avahi.DBUS_PATH_SERVER),

233

219

avahi.DBUS_INTERFACE_SERVER)

234

220

self.server.connect_to_signal(u"StateChanged",

235

221

self.server_state_changed)

251

237

enabled: bool()

252

238

last_checked_ok: datetime.datetime(); (UTC) or None

253

239

timeout: datetime.timedelta(); How long from last_checked_ok

254

until this client is disabled

240

until this client is invalid

255

241

interval: datetime.timedelta(); How often to start a new checker

256

242

disable_hook: If set, called by disable() as disable_hook(self)

257

243

checker: subprocess.Popen(); a running checker process used

258

244

to see if the client lives.

259

245

'None' if no process is running.

260

246

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

247

disable_initiator_tag: - '' -

262

248

checker_callback_tag: - '' -

263

249

checker_command: string; External command which is run to check if

264

250

client lives. %() expansions are done at

265

251

runtime with vars(self) as dict, so that for

266

252

instance %(name)s can be used in the command.

267

253

current_checker_command: string; current running checker_command

268

approval_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approval_duration: datetime.timedelta(); Duration of one approval

271

254

"""

272

255

273

256

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

257

def _datetime_to_milliseconds(dt):

258

"Convert a datetime.datetime() to milliseconds"

259

return ((dt.days * 24 * 60 * 60 * 1000)

260

+ (dt.seconds * 1000)

261

+ (dt.microseconds // 1000))

279

262

280

263

def timeout_milliseconds(self):

281

264

"Return the 'timeout' attribute in milliseconds"

282

return self._timedelta_to_milliseconds(self.timeout)

265

return self._datetime_to_milliseconds(self.timeout)

283

266

284

267

def interval_milliseconds(self):

285

268

"Return the 'interval' attribute in milliseconds"

286

return self._timedelta_to_milliseconds(self.interval)

287

288

def approval_delay_milliseconds(self):

289

return self._timedelta_to_milliseconds(self.approval_delay)

269

return self._datetime_to_milliseconds(self.interval)

290

270

291

271

def __init__(self, name = None, disable_hook=None, config=None):

292

272

"""Note: the 'checker' key in 'config' sets the

305

285

if u"secret" in config:

306

286

self.secret = config[u"secret"].decode(u"base64")

307

287

elif u"secfile" in config:

308

with open(os.path.expanduser(os.path.expandvars

309

(config[u"secfile"])),

310

"rb") as secfile:

288

with closing(open(os.path.expanduser

289

(os.path.expandvars

290

(config[u"secfile"])))) as secfile:

311

291

self.secret = secfile.read()

312

292

else:

313

293

raise TypeError(u"No secret or secfile for client %s"

327

307

self.checker_command = config[u"checker"]

328

308

self.current_checker_command = None

329

309

self.last_connect = None

330

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

332

True)

333

self.approvals_pending = 0

334

self.approval_delay = string_to_delta(

335

config[u"approval_delay"])

336

self.approval_duration = string_to_delta(

337

config[u"approval_duration"])

338

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

339

310

340

def send_changedstate(self):

341

self.changedstate.acquire()

342

self.changedstate.notify_all()

343

self.changedstate.release()

344

345

311

def enable(self):

346

312

"""Start this client's checker and timeout hooks"""

347

if getattr(self, u"enabled", False):

348

# Already enabled

349

return

350

self.send_changedstate()

351

313

self.last_enabled = datetime.datetime.utcnow()

352

314

# Schedule a new checker to be started an 'interval' from now,

353

315

# and every interval from then on.

354

316

self.checker_initiator_tag = (gobject.timeout_add

355

317

(self.interval_milliseconds(),

356

318

self.start_checker))

319

# Also start a new checker *right now*.

320

self.start_checker()

357

321

# Schedule a disable() when 'timeout' has passed

358

322

self.disable_initiator_tag = (gobject.timeout_add

359

323

(self.timeout_milliseconds(),

360

324

self.disable))

361

325

self.enabled = True

362

# Also start a new checker *right now*.

363

self.start_checker()

364

326

365

def disable(self, quiet=True):

327

def disable(self):

366

328

"""Disable this client."""

367

329

if not getattr(self, "enabled", False):

368

330

return False

369

if not quiet:

370

self.send_changedstate()

371

if not quiet:

372

logger.info(u"Disabling client %s", self.name)

331

logger.info(u"Disabling client %s", self.name)

373

332

if getattr(self, u"disable_initiator_tag", False):

374

333

gobject.source_remove(self.disable_initiator_tag)

375

334

self.disable_initiator_tag = None

427

386

# client would inevitably timeout, since no checker would get

428

387

# a chance to run to completion. If we instead leave running

429

388

# checkers alone, the checker would have to take more time

430

# than 'timeout' for the client to be disabled, which is as it

431

# should be.

389

# than 'timeout' for the client to be declared invalid, which

390

# is as it should be.

432

391

433

392

# If a checker exists, make sure it is not a zombie

434

try:

393

if self.checker is not None:

435

394

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

436

except (AttributeError, OSError), error:

437

if (isinstance(error, OSError)

438

and error.errno != errno.ECHILD):

439

raise error

440

else:

441

395

if pid:

442

396

logger.warning(u"Checker was a zombie")

443

397

gobject.source_remove(self.checker_callback_tag)

499

453

logger.debug(u"Stopping checker for %(name)s", vars(self))

500

454

try:

501

455

os.kill(self.checker.pid, signal.SIGTERM)

502

#time.sleep(0.5)

456

#os.sleep(0.5)

503

457

#if self.checker.poll() is None:

504

458

# os.kill(self.checker.pid, signal.SIGKILL)

505

459

except OSError, error:

506

460

if error.errno != errno.ESRCH: # No such process

507

461

raise

508

462

self.checker = None

509

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

512

"""Decorators for marking methods of a DBusObjectWithProperties to

513

become properties on the D-Bus.

514

515

The decorated method will be called with no arguments by "Get"

516

and with one argument by "Set".

517

518

The parameters, where they are supported, are the same as

519

dbus.service.method, except there is only "signature", since the

520

type from Get() and the type sent to Set() is the same.

521

"""

522

# Encoding deeply encoded byte arrays is not supported yet by the

523

# "Set" method, so we fail early here:

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

527

def decorator(func):

528

func._dbus_is_property = True

529

func._dbus_interface = dbus_interface

530

func._dbus_signature = signature

531

func._dbus_access = access

532

func._dbus_name = func.__name__

533

if func._dbus_name.endswith(u"_dbus_property"):

534

func._dbus_name = func._dbus_name[:-14]

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

536

return func

537

return decorator

538

539

540

class DBusPropertyException(dbus.exceptions.DBusException):

541

"""A base class for D-Bus property-related exceptions

542

"""

543

def __unicode__(self):

544

return unicode(str(self))

545

546

547

class DBusPropertyAccessException(DBusPropertyException):

548

"""A property's access permissions disallows an operation.

549

"""

550

pass

551

552

553

class DBusPropertyNotFound(DBusPropertyException):

554

"""An attempt was made to access a non-existing property.

555

"""

556

pass

557

558

559

class DBusObjectWithProperties(dbus.service.Object):

560

"""A D-Bus object with properties.

561

562

Classes inheriting from this can use the dbus_service_property

563

decorator to expose methods as D-Bus properties. It exposes the

564

standard Get(), Set(), and GetAll() methods on the D-Bus.

565

"""

566

567

@staticmethod

568

def _is_dbus_property(obj):

569

return getattr(obj, u"_dbus_is_property", False)

570

571

def _get_all_dbus_properties(self):

572

"""Returns a generator of (name, attribute) pairs

573

"""

574

return ((prop._dbus_name, prop)

575

for name, prop in

576

inspect.getmembers(self, self._is_dbus_property))

577

578

def _get_dbus_property(self, interface_name, property_name):

579

"""Returns a bound method if one exists which is a D-Bus

580

property with the specified name and interface.

581

"""

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

592

# No such property

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

595

+ property_name)

596

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

599

def Get(self, interface_name, property_name):

600

"""Standard D-Bus property Get() method, see D-Bus standard.

601

"""

602

prop = self._get_dbus_property(interface_name, property_name)

603

if prop._dbus_access == u"write":

604

raise DBusPropertyAccessException(property_name)

605

value = prop()

606

if not hasattr(value, u"variant_level"):

607

return value

608

return type(value)(value, variant_level=value.variant_level+1)

609

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

611

def Set(self, interface_name, property_name, value):

612

"""Standard D-Bus property Set() method, see D-Bus standard.

613

"""

614

prop = self._get_dbus_property(interface_name, property_name)

615

if prop._dbus_access == u"read":

616

raise DBusPropertyAccessException(property_name)

617

if prop._dbus_get_args_options[u"byte_arrays"]:

618

# The byte_arrays option is not supported yet on

619

# signatures other than "ay".

620

if prop._dbus_signature != u"ay":

621

raise ValueError

622

value = dbus.ByteArray(''.join(unichr(byte)

623

for byte in value))

624

prop(value)

625

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

628

def GetAll(self, interface_name):

629

"""Standard D-Bus property GetAll() method, see D-Bus

630

standard.

631

632

Note: Will not include properties with access="write".

633

"""

634

all = {}

635

for name, prop in self._get_all_dbus_properties():

636

if (interface_name

637

and interface_name != prop._dbus_interface):

638

# Interface non-empty but did not match

639

continue

640

# Ignore write-only properties

641

if prop._dbus_access == u"write":

642

continue

643

value = prop()

644

if not hasattr(value, u"variant_level"):

645

all[name] = value

646

continue

647

all[name] = type(value)(value, variant_level=

648

value.variant_level+1)

649

return dbus.Dictionary(all, signature=u"sv")

650

651

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

652

out_signature=u"s",

653

path_keyword='object_path',

654

connection_keyword='connection')

655

def Introspect(self, object_path, connection):

656

"""Standard D-Bus method, overloaded to insert property tags.

657

"""

658

xmlstring = dbus.service.Object.Introspect(self, object_path,

659

connection)

660

try:

661

document = xml.dom.minidom.parseString(xmlstring)

662

def make_tag(document, name, prop):

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

667

return e

668

for if_tag in document.getElementsByTagName(u"interface"):

669

for tag in (make_tag(document, name, prop)

670

for name, prop

671

in self._get_all_dbus_properties()

672

if prop._dbus_interface

673

== if_tag.getAttribute(u"name")):

674

if_tag.appendChild(tag)

675

# Add the names to the return values for the

676

# "org.freedesktop.DBus.Properties" methods

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

691

document.unlink()

692

except (AttributeError, xml.dom.DOMException,

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

695

error)

696

return xmlstring

697

698

699

class ClientDBus(Client, DBusObjectWithProperties):

463

464

def still_valid(self):

465

"""Has the timeout not yet passed for this client?"""

466

if not getattr(self, u"enabled", False):

467

return False

468

now = datetime.datetime.utcnow()

469

if self.last_checked_ok is None:

470

return now < (self.created + self.timeout)

471

else:

472

return now < (self.last_checked_ok + self.timeout)

473

474

475

class ClientDBus(Client, dbus.service.Object):

700

476

"""A Client class using D-Bus

701

477

702

478

Attributes:

703

dbus_object_path: dbus.ObjectPath

704

bus: dbus.SystemBus()

479

dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus

705

480

"""

706

481

# dbus.service.Object doesn't use super(), so we can't either.

707

482

708

def __init__(self, bus = None, *args, **kwargs):

709

self._approvals_pending = 0

710

self.bus = bus

483

def __init__(self, *args, **kwargs):

711

484

Client.__init__(self, *args, **kwargs)

712

485

# Only now, when this client is initialized, can it show up on

713

486

# the D-Bus

714

487

self.dbus_object_path = (dbus.ObjectPath

715

488

(u"/clients/"

716

489

+ self.name.replace(u".", u"_")))

717

DBusObjectWithProperties.__init__(self, self.bus,

718

self.dbus_object_path)

719

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"ApprovalPending"),

730

dbus_bool)

731

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

490

dbus.service.Object.__init__(self, bus,

491

self.dbus_object_path)

735

492

736

493

@staticmethod

737

494

def _datetime_to_dbus(dt, variant_level=0):

744

501

r = Client.enable(self)

745

502

if oldstate != self.enabled:

746

503

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"Enabled"),

504

self.PropertyChanged(dbus.String(u"enabled"),

748

505

dbus.Boolean(True, variant_level=1))

749

506

self.PropertyChanged(

750

dbus.String(u"LastEnabled"),

507

dbus.String(u"last_enabled"),

751

508

self._datetime_to_dbus(self.last_enabled,

752

509

variant_level=1))

753

510

return r

754

511

755

def disable(self, quiet = False):

512

def disable(self, signal = True):

756

513

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

514

r = Client.disable(self)

515

if signal and oldstate != self.enabled:

759

516

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"Enabled"),

517

self.PropertyChanged(dbus.String(u"enabled"),

761

518

dbus.Boolean(False, variant_level=1))

762

519

return r

763

520

766

523

self.remove_from_connection()

767

524

except LookupError:

768

525

pass

769

if hasattr(DBusObjectWithProperties, u"__del__"):

770

DBusObjectWithProperties.__del__(self, *args, **kwargs)

526

if hasattr(dbus.service.Object, u"__del__"):

527

dbus.service.Object.__del__(self, *args, **kwargs)

771

528

Client.__del__(self, *args, **kwargs)

772

529

773

530

def checker_callback(self, pid, condition, command,

775

532

self.checker_callback_tag = None

776

533

self.checker = None

777

534

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"CheckerRunning"),

535

self.PropertyChanged(dbus.String(u"checker_running"),

779

536

dbus.Boolean(False, variant_level=1))

780

537

if os.WIFEXITED(condition):

781

538

exitstatus = os.WEXITSTATUS(condition)

796

553

r = Client.checked_ok(self, *args, **kwargs)

797

554

# Emit D-Bus signal

798

555

self.PropertyChanged(

799

dbus.String(u"LastCheckedOK"),

556

dbus.String(u"last_checked_ok"),

800

557

(self._datetime_to_dbus(self.last_checked_ok,

801

558

variant_level=1)))

802

559

return r

814

571

# Emit D-Bus signal

815

572

self.CheckerStarted(self.current_checker_command)

816

573

self.PropertyChanged(

817

dbus.String(u"CheckerRunning"),

574

dbus.String(u"checker_running"),

818

575

dbus.Boolean(True, variant_level=1))

819

576

return r

820

577

823

580

r = Client.stop_checker(self, *args, **kwargs)

824

581

if (old_checker is not None

825

582

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"CheckerRunning"),

583

self.PropertyChanged(dbus.String(u"checker_running"),

827

584

dbus.Boolean(False, variant_level=1))

828

585

return r

829

830

def _reset_approved(self):

831

self._approved = None

832

return False

833

834

def approve(self, value=True):

835

self.send_changedstate()

836

self._approved = value

837

gobject.timeout_add(self._timedelta_to_milliseconds

838

(self.approval_duration),

839

self._reset_approved)

840

841

842

## D-Bus methods, signals & properties

586

587

## D-Bus methods & signals

843

588

_interface = u"se.bsnet.fukt.Mandos.Client"

844

589

845

## Signals

590

# CheckedOK - method

591

@dbus.service.method(_interface)

592

def CheckedOK(self):

593

return self.checked_ok()

846

594

847

595

# CheckerCompleted - signal

848

596

@dbus.service.signal(_interface, signature=u"nxs")

856

604

"D-Bus signal"

857

605

pass

858

606

607

# GetAllProperties - method

608

@dbus.service.method(_interface, out_signature=u"a{sv}")

609

def GetAllProperties(self):

610

"D-Bus method"

611

return dbus.Dictionary({

612

dbus.String(u"name"):

613

dbus.String(self.name, variant_level=1),

614

dbus.String(u"fingerprint"):

615

dbus.String(self.fingerprint, variant_level=1),

616

dbus.String(u"host"):

617

dbus.String(self.host, variant_level=1),

618

dbus.String(u"created"):

619

self._datetime_to_dbus(self.created,

620

variant_level=1),

621

dbus.String(u"last_enabled"):

622

(self._datetime_to_dbus(self.last_enabled,

623

variant_level=1)

624

if self.last_enabled is not None

625

else dbus.Boolean(False, variant_level=1)),

626

dbus.String(u"enabled"):

627

dbus.Boolean(self.enabled, variant_level=1),

628

dbus.String(u"last_checked_ok"):

629

(self._datetime_to_dbus(self.last_checked_ok,

630

variant_level=1)

631

if self.last_checked_ok is not None

632

else dbus.Boolean (False, variant_level=1)),

633

dbus.String(u"timeout"):

634

dbus.UInt64(self.timeout_milliseconds(),

635

variant_level=1),

636

dbus.String(u"interval"):

637

dbus.UInt64(self.interval_milliseconds(),

638

variant_level=1),

639

dbus.String(u"checker"):

640

dbus.String(self.checker_command,

641

variant_level=1),

642

dbus.String(u"checker_running"):

643

dbus.Boolean(self.checker is not None,

644

variant_level=1),

645

dbus.String(u"object_path"):

646

dbus.ObjectPath(self.dbus_object_path,

647

variant_level=1)

648

}, signature=u"sv")

649

650

# IsStillValid - method

651

@dbus.service.method(_interface, out_signature=u"b")

652

def IsStillValid(self):

653

return self.still_valid()

654

859

655

# PropertyChanged - signal

860

656

@dbus.service.signal(_interface, signature=u"sv")

861

657

def PropertyChanged(self, property, value):

862

658

"D-Bus signal"

863

659

pass

864

660

865

# GotSecret - signal

661

# ReceivedSecret - signal

866

662

@dbus.service.signal(_interface)

867

def GotSecret(self):

868

"""D-Bus signal

869

Is sent after a successful transfer of secret from the Mandos

870

server to mandos-client

871

"""

663

def ReceivedSecret(self):

664

"D-Bus signal"

872

665

pass

873

666

874

667

# Rejected - signal

875

@dbus.service.signal(_interface, signature=u"s")

876

def Rejected(self, reason):

877

"D-Bus signal"

878

pass

879

880

# NeedApproval - signal

881

@dbus.service.signal(_interface, signature=u"tb")

882

def NeedApproval(self, timeout, default):

883

"D-Bus signal"

884

pass

885

886

## Methods

887

888

# Approve - method

889

@dbus.service.method(_interface, in_signature=u"b")

890

def Approve(self, value):

891

self.approve(value)

892

893

# CheckedOK - method

894

@dbus.service.method(_interface)

895

def CheckedOK(self):

896

return self.checked_ok()

668

@dbus.service.signal(_interface)

669

def Rejected(self):

670

"D-Bus signal"

671

pass

672

673

# SetChecker - method

674

@dbus.service.method(_interface, in_signature=u"s")

675

def SetChecker(self, checker):

676

"D-Bus setter method"

677

self.checker_command = checker

678

# Emit D-Bus signal

679

self.PropertyChanged(dbus.String(u"checker"),

680

dbus.String(self.checker_command,

681

variant_level=1))

682

683

# SetHost - method

684

@dbus.service.method(_interface, in_signature=u"s")

685

def SetHost(self, host):

686

"D-Bus setter method"

687

self.host = host

688

# Emit D-Bus signal

689

self.PropertyChanged(dbus.String(u"host"),

690

dbus.String(self.host, variant_level=1))

691

692

# SetInterval - method

693

@dbus.service.method(_interface, in_signature=u"t")

694

def SetInterval(self, milliseconds):

695

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

696

# Emit D-Bus signal

697

self.PropertyChanged(dbus.String(u"interval"),

698

(dbus.UInt64(self.interval_milliseconds(),

699

variant_level=1)))

700

701

# SetSecret - method

702

@dbus.service.method(_interface, in_signature=u"ay",

703

byte_arrays=True)

704

def SetSecret(self, secret):

705

"D-Bus setter method"

706

self.secret = str(secret)

707

708

# SetTimeout - method

709

@dbus.service.method(_interface, in_signature=u"t")

710

def SetTimeout(self, milliseconds):

711

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

712

# Emit D-Bus signal

713

self.PropertyChanged(dbus.String(u"timeout"),

714

(dbus.UInt64(self.timeout_milliseconds(),

715

variant_level=1)))

897

716

898

717

# Enable - method

899

718

@dbus.service.method(_interface)

918

737

def StopChecker(self):

919

738

self.stop_checker()

920

739

921

## Properties

922

923

# ApprovalPending - property

924

@dbus_service_property(_interface, signature=u"b", access=u"read")

925

def ApprovalPending_dbus_property(self):

926

return dbus.Boolean(bool(self.approvals_pending))

927

928

# ApprovedByDefault - property

929

@dbus_service_property(_interface, signature=u"b",

930

access=u"readwrite")

931

def ApprovedByDefault_dbus_property(self, value=None):

932

if value is None: # get

933

return dbus.Boolean(self.approved_by_default)

934

self.approved_by_default = bool(value)

935

# Emit D-Bus signal

936

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

937

dbus.Boolean(value, variant_level=1))

938

939

# ApprovalDelay - property

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

942

def ApprovalDelay_dbus_property(self, value=None):

943

if value is None: # get

944

return dbus.UInt64(self.approval_delay_milliseconds())

945

self.approval_delay = datetime.timedelta(0, 0, 0, value)

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

948

dbus.UInt64(value, variant_level=1))

949

950

# ApprovalDuration - property

951

@dbus_service_property(_interface, signature=u"t",

952

access=u"readwrite")

953

def ApprovalDuration_dbus_property(self, value=None):

954

if value is None: # get

955

return dbus.UInt64(self._timedelta_to_milliseconds(

956

self.approval_duration))

957

self.approval_duration = datetime.timedelta(0, 0, 0, value)

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

960

dbus.UInt64(value, variant_level=1))

961

962

# Name - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

964

def Name_dbus_property(self):

965

return dbus.String(self.name)

966

967

# Fingerprint - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def Fingerprint_dbus_property(self):

970

return dbus.String(self.fingerprint)

971

972

# Host - property

973

@dbus_service_property(_interface, signature=u"s",

974

access=u"readwrite")

975

def Host_dbus_property(self, value=None):

976

if value is None: # get

977

return dbus.String(self.host)

978

self.host = value

979

# Emit D-Bus signal

980

self.PropertyChanged(dbus.String(u"Host"),

981

dbus.String(value, variant_level=1))

982

983

# Created - property

984

@dbus_service_property(_interface, signature=u"s", access=u"read")

985

def Created_dbus_property(self):

986

return dbus.String(self._datetime_to_dbus(self.created))

987

988

# LastEnabled - property

989

@dbus_service_property(_interface, signature=u"s", access=u"read")

990

def LastEnabled_dbus_property(self):

991

if self.last_enabled is None:

992

return dbus.String(u"")

993

return dbus.String(self._datetime_to_dbus(self.last_enabled))

994

995

# Enabled - property

996

@dbus_service_property(_interface, signature=u"b",

997

access=u"readwrite")

998

def Enabled_dbus_property(self, value=None):

999

if value is None: # get

1000

return dbus.Boolean(self.enabled)

1001

if value:

1002

self.enable()

1003

else:

1004

self.disable()

1005

1006

# LastCheckedOK - property

1007

@dbus_service_property(_interface, signature=u"s",

1008

access=u"readwrite")

1009

def LastCheckedOK_dbus_property(self, value=None):

1010

if value is not None:

1011

self.checked_ok()

1012

return

1013

if self.last_checked_ok is None:

1014

return dbus.String(u"")

1015

return dbus.String(self._datetime_to_dbus(self

1016

.last_checked_ok))

1017

1018

# Timeout - property

1019

@dbus_service_property(_interface, signature=u"t",

1020

access=u"readwrite")

1021

def Timeout_dbus_property(self, value=None):

1022

if value is None: # get

1023

return dbus.UInt64(self.timeout_milliseconds())

1024

self.timeout = datetime.timedelta(0, 0, 0, value)

1025

# Emit D-Bus signal

1026

self.PropertyChanged(dbus.String(u"Timeout"),

1027

dbus.UInt64(value, variant_level=1))

1028

if getattr(self, u"disable_initiator_tag", None) is None:

1029

return

1030

# Reschedule timeout

1031

gobject.source_remove(self.disable_initiator_tag)

1032

self.disable_initiator_tag = None

1033

time_to_die = (self.

1034

_timedelta_to_milliseconds((self

1035

.last_checked_ok

1036

+ self.timeout)

1037

- datetime.datetime

1038

.utcnow()))

1039

if time_to_die <= 0:

1040

# The timeout has passed

1041

self.disable()

1042

else:

1043

self.disable_initiator_tag = (gobject.timeout_add

1044

(time_to_die, self.disable))

1045

1046

# Interval - property

1047

@dbus_service_property(_interface, signature=u"t",

1048

access=u"readwrite")

1049

def Interval_dbus_property(self, value=None):

1050

if value is None: # get

1051

return dbus.UInt64(self.interval_milliseconds())

1052

self.interval = datetime.timedelta(0, 0, 0, value)

1053

# Emit D-Bus signal

1054

self.PropertyChanged(dbus.String(u"Interval"),

1055

dbus.UInt64(value, variant_level=1))

1056

if getattr(self, u"checker_initiator_tag", None) is None:

1057

return

1058

# Reschedule checker run

1059

gobject.source_remove(self.checker_initiator_tag)

1060

self.checker_initiator_tag = (gobject.timeout_add

1061

(value, self.start_checker))

1062

self.start_checker() # Start one now, too

1063

1064

# Checker - property

1065

@dbus_service_property(_interface, signature=u"s",

1066

access=u"readwrite")

1067

def Checker_dbus_property(self, value=None):

1068

if value is None: # get

1069

return dbus.String(self.checker_command)

1070

self.checker_command = value

1071

# Emit D-Bus signal

1072

self.PropertyChanged(dbus.String(u"Checker"),

1073

dbus.String(self.checker_command,

1074

variant_level=1))

1075

1076

# CheckerRunning - property

1077

@dbus_service_property(_interface, signature=u"b",

1078

access=u"readwrite")

1079

def CheckerRunning_dbus_property(self, value=None):

1080

if value is None: # get

1081

return dbus.Boolean(self.checker is not None)

1082

if value:

1083

self.start_checker()

1084

else:

1085

self.stop_checker()

1086

1087

# ObjectPath - property

1088

@dbus_service_property(_interface, signature=u"o", access=u"read")

1089

def ObjectPath_dbus_property(self):

1090

return self.dbus_object_path # is already a dbus.ObjectPath

1091

1092

# Secret = property

1093

@dbus_service_property(_interface, signature=u"ay",

1094

access=u"write", byte_arrays=True)

1095

def Secret_dbus_property(self, value):

1096

self.secret = str(value)

1097

1098

740

del _interface

1099

741

1100

742

1101

class ProxyClient(object):

1102

def __init__(self, child_pipe, fpr, address):

1103

self._pipe = child_pipe

1104

self._pipe.send(('init', fpr, address))

1105

if not self._pipe.recv():

1106

raise KeyError()

1107

1108

def __getattribute__(self, name):

1109

if(name == '_pipe'):

1110

return super(ProxyClient, self).__getattribute__(name)

1111

self._pipe.send(('getattr', name))

1112

data = self._pipe.recv()

1113

if data[0] == 'data':

1114

return data[1]

1115

if data[0] == 'function':

1116

def func(*args, **kwargs):

1117

self._pipe.send(('funcall', name, args, kwargs))

1118

return self._pipe.recv()[1]

1119

return func

1120

1121

def __setattr__(self, name, value):

1122

if(name == '_pipe'):

1123

return super(ProxyClient, self).__setattr__(name, value)

1124

self._pipe.send(('setattr', name, value))

1125

1126

1127

743

class ClientHandler(socketserver.BaseRequestHandler, object):

1128

744

"""A class to handle client connections.

1129

745

1131

747

Note: This will run in its own forked process."""

1132

748

1133

749

def handle(self):

1134

with contextlib.closing(self.server.child_pipe) as child_pipe:

1135

logger.info(u"TCP connection from: %s",

1136

unicode(self.client_address))

1137

logger.debug(u"Pipe FD: %d",

1138

self.server.child_pipe.fileno())

1139

750

logger.info(u"TCP connection from: %s",

751

unicode(self.client_address))

752

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

753

# Open IPC pipe to parent process

754

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1140

755

session = (gnutls.connection

1141

756

.ClientSession(self.request,

1142

757

gnutls.connection

1143

758

.X509Credentials()))

1144

759

760

line = self.request.makefile().readline()

761

logger.debug(u"Protocol version: %r", line)

762

try:

763

if int(line.strip().split()[0]) > 1:

764

raise RuntimeError

765

except (ValueError, IndexError, RuntimeError), error:

766

logger.error(u"Unknown protocol version: %s", error)

767

return

768

1145

769

# Note: gnutls.connection.X509Credentials is really a

1146

770

# generic GnuTLS certificate credentials object so long as

1147

771

# no X.509 keys are added to it. Therefore, we can use it

1148

772

# here despite using OpenPGP certificates.

1149

773

1150

774

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1151

775

# u"+AES-256-CBC", u"+SHA1",

1152

776

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1158

782

(gnutls.library.functions

1159

783

.gnutls_priority_set_direct(session._c_object,

1160

784

priority, None))

1161

1162

# Start communication using the Mandos protocol

1163

# Get protocol number

1164

line = self.request.makefile().readline()

1165

logger.debug(u"Protocol version: %r", line)

1166

try:

1167

if int(line.strip().split()[0]) > 1:

1168

raise RuntimeError

1169

except (ValueError, IndexError, RuntimeError), error:

1170

logger.error(u"Unknown protocol version: %s", error)

1171

return

1172

1173

# Start GnuTLS connection

785

1174

786

try:

1175

787

session.handshake()

1176

788

except gnutls.errors.GNUTLSError, error:

1179

791

# established. Just abandon the request.

1180

792

return

1181

793

logger.debug(u"Handshake succeeded")

1182

1183

approval_required = False

1184

794

try:

1185

try:

1186

fpr = self.fingerprint(self.peer_certificate

1187

(session))

1188

except (TypeError, gnutls.errors.GNUTLSError), error:

1189

logger.warning(u"Bad certificate: %s", error)

1190

return

1191

logger.debug(u"Fingerprint: %s", fpr)

1192

1193

try:

1194

client = ProxyClient(child_pipe, fpr,

1195

self.client_address)

1196

except KeyError:

1197

return

1198

1199

if client.approval_delay:

1200

delay = client.approval_delay

1201

client.approvals_pending += 1

1202

approval_required = True

1203

1204

while True:

1205

if not client.enabled:

1206

logger.warning(u"Client %s is disabled",

1207

client.name)

1208

if self.server.use_dbus:

1209

# Emit D-Bus signal

1210

client.Rejected("Disabled")

1211

return

1212

1213

if client._approved or not client.approval_delay:

1214

#We are approved or approval is disabled

1215

break

1216

elif client._approved is None:

1217

logger.info(u"Client %s needs approval",

1218

client.name)

1219

if self.server.use_dbus:

1220

# Emit D-Bus signal

1221

client.NeedApproval(

1222

client.approval_delay_milliseconds(),

1223

client.approved_by_default)

1224

else:

1225

logger.warning(u"Client %s was not approved",

1226

client.name)

1227

if self.server.use_dbus:

1228

# Emit D-Bus signal

1229

client.Rejected("Denied")

1230

return

1231

1232

#wait until timeout or approved

1233

#x = float(client._timedelta_to_milliseconds(delay))

1234

time = datetime.datetime.now()

1235

client.changedstate.acquire()

1236

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1237

client.changedstate.release()

1238

time2 = datetime.datetime.now()

1239

if (time2 - time) >= delay:

1240

if not client.approved_by_default:

1241

logger.warning("Client %s timed out while"

1242

" waiting for approval",

1243

client.name)

1244

if self.server.use_dbus:

1245

# Emit D-Bus signal

1246

client.Rejected("Approval timed out")

1247

return

1248

else:

1249

break

1250

else:

1251

delay -= time2 - time

1252

1253

sent_size = 0

1254

while sent_size < len(client.secret):

1255

try:

1256

sent = session.send(client.secret[sent_size:])

1257

except (gnutls.errors.GNUTLSError), error:

1258

logger.warning("gnutls send failed")

1259

return

1260

logger.debug(u"Sent: %d, remaining: %d",

1261

sent, len(client.secret)

1262

- (sent_size + sent))

1263

sent_size += sent

1264

1265

logger.info(u"Sending secret to %s", client.name)

1266

# bump the timeout as if seen

1267

client.checked_ok()

1268

if self.server.use_dbus:

1269

# Emit D-Bus signal

1270

client.GotSecret()

795

fpr = self.fingerprint(self.peer_certificate(session))

796

except (TypeError, gnutls.errors.GNUTLSError), error:

797

logger.warning(u"Bad certificate: %s", error)

798

session.bye()

799

return

800

logger.debug(u"Fingerprint: %s", fpr)

1271

801

1272

finally:

1273

if approval_required:

1274

client.approvals_pending -= 1

1275

try:

1276

session.bye()

1277

except (gnutls.errors.GNUTLSError), error:

1278

logger.warning("GnuTLS bye failed")

802

for c in self.server.clients:

803

if c.fingerprint == fpr:

804

client = c

805

break

806

else:

807

ipc.write(u"NOTFOUND %s\n" % fpr)

808

session.bye()

809

return

810

# Have to check if client.still_valid(), since it is

811

# possible that the client timed out while establishing

812

# the GnuTLS session.

813

if not client.still_valid():

814

ipc.write(u"INVALID %s\n" % client.name)

815

session.bye()

816

return

817

ipc.write(u"SENDING %s\n" % client.name)

818

sent_size = 0

819

while sent_size < len(client.secret):

820

sent = session.send(client.secret[sent_size:])

821

logger.debug(u"Sent: %d, remaining: %d",

822

sent, len(client.secret)

823

- (sent_size + sent))

824

sent_size += sent

825

session.bye()

1279

826

1280

827

@staticmethod

1281

828

def peer_certificate(session):

1341

888

return hex_fpr

1342

889

1343

890

1344

class MultiprocessingMixIn(object):

1345

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1346

def sub_process_main(self, request, address):

1347

try:

1348

self.finish_request(request, address)

1349

except:

1350

self.handle_error(request, address)

1351

self.close_request(request)

1352

1353

def process_request(self, request, address):

1354

"""Start a new process to process the request."""

1355

multiprocessing.Process(target = self.sub_process_main,

1356

args = (request, address)).start()

1357

1358

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1359

""" adds a pipe to the MixIn """

891

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

892

"""Like socketserver.ForkingMixIn, but also pass a pipe.

893

894

Assumes a gobject.MainLoop event loop.

895

"""

1360

896

def process_request(self, request, client_address):

1361

897

"""Overrides and wraps the original process_request().

1362

898

1363

This function creates a new pipe in self.pipe

899

This function creates a new pipe in self.pipe

1364

900

"""

1365

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1366

1367

super(MultiprocessingMixInWithPipe,

901

self.pipe = os.pipe()

902

super(ForkingMixInWithPipe,

1368

903

self).process_request(request, client_address)

1369

self.child_pipe.close()

1370

self.add_pipe(parent_pipe)

1371

1372

def add_pipe(self, parent_pipe):

904

os.close(self.pipe[1]) # close write end

905

# Call "handle_ipc" for both data and EOF events

906

gobject.io_add_watch(self.pipe[0],

907

gobject.IO_IN | gobject.IO_HUP,

908

self.handle_ipc)

909

def handle_ipc(source, condition):

1373

910

"""Dummy function; override as necessary"""

1374

pass

1375

1376

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

911

os.close(source)

912

return False

913

914

915

class IPv6_TCPServer(ForkingMixInWithPipe,

1377

916

socketserver.TCPServer, object):

1378

917

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1379

918

1381

920

enabled: Boolean; whether this server is activated yet

1382

921

interface: None or a network interface name (string)

1383

922

use_ipv6: Boolean; to use IPv6 or not

923

----

924

clients: set of Client objects

925

gnutls_priority GnuTLS priority string

926

use_dbus: Boolean; to emit D-Bus signals or not

1384

927

"""

1385

928

def __init__(self, server_address, RequestHandlerClass,

1386

interface=None, use_ipv6=True):

929

interface=None, use_ipv6=True, clients=None,

930

gnutls_priority=None, use_dbus=True):

931

self.enabled = False

1387

932

self.interface = interface

1388

933

if use_ipv6:

1389

934

self.address_family = socket.AF_INET6

935

self.clients = clients

936

self.use_dbus = use_dbus

937

self.gnutls_priority = gnutls_priority

1390

938

socketserver.TCPServer.__init__(self, server_address,

1391

939

RequestHandlerClass)

1392

940

def server_bind(self):

1394

942

to bind to an interface if one was specified, and also NOT to

1395

943

bind to an address or port if they were not specified."""

1396

944

if self.interface is not None:

1397

if SO_BINDTODEVICE is None:

1398

logger.error(u"SO_BINDTODEVICE does not exist;"

1399

u" cannot bind to interface %s",

1400

self.interface)

1401

else:

1402

try:

1403

self.socket.setsockopt(socket.SOL_SOCKET,

1404

SO_BINDTODEVICE,

1405

str(self.interface

1406

+ u'\0'))

1407

except socket.error, error:

1408

if error[0] == errno.EPERM:

1409

logger.error(u"No permission to"

1410

u" bind to interface %s",

1411

self.interface)

1412

elif error[0] == errno.ENOPROTOOPT:

1413

logger.error(u"SO_BINDTODEVICE not available;"

1414

u" cannot bind to interface %s",

1415

self.interface)

1416

else:

1417

raise

945

try:

946

self.socket.setsockopt(socket.SOL_SOCKET,

947

SO_BINDTODEVICE,

948

str(self.interface + u'\0'))

949

except socket.error, error:

950

if error[0] == errno.EPERM:

951

logger.error(u"No permission to"

952

u" bind to interface %s",

953

self.interface)

954

else:

955

raise

1418

956

# Only bind(2) the socket if we really need to.

1419

957

if self.server_address[0] or self.server_address[1]:

1420

958

if not self.server_address[0]:

1434

972

# if_nametoindex

1435

973

# (self.interface))

1436

974

return socketserver.TCPServer.server_bind(self)

1437

1438

1439

class MandosServer(IPv6_TCPServer):

1440

"""Mandos server.

1441

1442

Attributes:

1443

clients: set of Client objects

1444

gnutls_priority GnuTLS priority string

1445

use_dbus: Boolean; to emit D-Bus signals or not

1446

1447

Assumes a gobject.MainLoop event loop.

1448

"""

1449

def __init__(self, server_address, RequestHandlerClass,

1450

interface=None, use_ipv6=True, clients=None,

1451

gnutls_priority=None, use_dbus=True):

1452

self.enabled = False

1453

self.clients = clients

1454

if self.clients is None:

1455

self.clients = set()

1456

self.use_dbus = use_dbus

1457

self.gnutls_priority = gnutls_priority

1458

IPv6_TCPServer.__init__(self, server_address,

1459

RequestHandlerClass,

1460

interface = interface,

1461

use_ipv6 = use_ipv6)

1462

975

def server_activate(self):

1463

976

if self.enabled:

1464

977

return socketserver.TCPServer.server_activate(self)

1465

978

def enable(self):

1466

979

self.enabled = True

1467

def add_pipe(self, parent_pipe):

1468

# Call "handle_ipc" for both data and EOF events

1469

gobject.io_add_watch(parent_pipe.fileno(),

1470

gobject.IO_IN | gobject.IO_HUP,

1471

functools.partial(self.handle_ipc,

1472

parent_pipe = parent_pipe))

1473

1474

def handle_ipc(self, source, condition, parent_pipe=None,

1475

client_object=None):

980

def handle_ipc(self, source, condition, file_objects={}):

1476

981

condition_names = {

1477

982

gobject.IO_IN: u"IN", # There is data to read.

1478

983

gobject.IO_OUT: u"OUT", # Data can be written (without

1487

992

for cond, name in

1488

993

condition_names.iteritems()

1489

994

if cond & condition)

1490

# error or the other end of multiprocessing.Pipe has closed

1491

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1492

return False

1493

1494

# Read a request from the child

1495

request = parent_pipe.recv()

1496

command = request[0]

1497

1498

if command == 'init':

1499

fpr = request[1]

1500

address = request[2]

1501

1502

for c in self.clients:

1503

if c.fingerprint == fpr:

1504

client = c

1505

break

1506

else:

1507

logger.warning(u"Client not found for fingerprint: %s, ad"

1508

u"dress: %s", fpr, address)

1509

if self.use_dbus:

1510

# Emit D-Bus signal

1511

mandos_dbus_service.ClientNotFound(fpr, address)

1512

parent_pipe.send(False)

1513

return False

1514

1515

gobject.io_add_watch(parent_pipe.fileno(),

1516

gobject.IO_IN | gobject.IO_HUP,

1517

functools.partial(self.handle_ipc,

1518

parent_pipe = parent_pipe,

1519

client_object = client))

1520

parent_pipe.send(True)

1521

# remove the old hook in favor of the new above hook on same fileno

1522

return False

1523

if command == 'funcall':

1524

funcname = request[1]

1525

args = request[2]

1526

kwargs = request[3]

1527

1528

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1529

1530

if command == 'getattr':

1531

attrname = request[1]

1532

if callable(client_object.__getattribute__(attrname)):

1533

parent_pipe.send(('function',))

1534

else:

1535

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1536

1537

if command == 'setattr':

1538

attrname = request[1]

1539

value = request[2]

1540

setattr(client_object, attrname, value)

1541

995

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

996

conditions_string)

997

998

# Turn the pipe file descriptor into a Python file object

999

if source not in file_objects:

1000

file_objects[source] = os.fdopen(source, u"r", 1)

1001

1002

# Read a line from the file object

1003

cmdline = file_objects[source].readline()

1004

if not cmdline: # Empty line means end of file

1005

# close the IPC pipe

1006

file_objects[source].close()

1007

del file_objects[source]

1008

1009

# Stop calling this function

1010

return False

1011

1012

logger.debug(u"IPC command: %r", cmdline)

1013

1014

# Parse and act on command

1015

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1016

1017

if cmd == u"NOTFOUND":

1018

logger.warning(u"Client not found for fingerprint: %s",

1019

args)

1020

if self.use_dbus:

1021

# Emit D-Bus signal

1022

mandos_dbus_service.ClientNotFound(args)

1023

elif cmd == u"INVALID":

1024

for client in self.clients:

1025

if client.name == args:

1026

logger.warning(u"Client %s is invalid", args)

1027

if self.use_dbus:

1028

# Emit D-Bus signal

1029

client.Rejected()

1030

break

1031

else:

1032

logger.error(u"Unknown client %s is invalid", args)

1033

elif cmd == u"SENDING":

1034

for client in self.clients:

1035

if client.name == args:

1036

logger.info(u"Sending secret to %s", client.name)

1037

client.checked_ok()

1038

if self.use_dbus:

1039

# Emit D-Bus signal

1040

client.ReceivedSecret()

1041

break

1042

else:

1043

logger.error(u"Sending secret to unknown client %s",

1044

args)

1045

else:

1046

logger.error(u"Unknown IPC command: %r", cmdline)

1047

1048

# Keep calling this function

1542

1049

return True

1543

1050

1544

1051

1574

1081

elif suffix == u"w":

1575

1082

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1576

1083

else:

1577

raise ValueError(u"Unknown suffix %r" % suffix)

1578

except (ValueError, IndexError), e:

1579

raise ValueError(e.message)

1084

raise ValueError

1085

except (ValueError, IndexError):

1086

raise ValueError

1580

1087

timevalue += delta

1581

1088

return timevalue

1582

1089

1595

1102

def if_nametoindex(interface):

1596

1103

"Get an interface index the hard way, i.e. using fcntl()"

1597

1104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1598

with contextlib.closing(socket.socket()) as s:

1105

with closing(socket.socket()) as s:

1599

1106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1600

1107

struct.pack(str(u"16s16x"),

1601

1108

interface))

1621

1128

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1622

1129

if not stat.S_ISCHR(os.fstat(null).st_mode):

1623

1130

raise OSError(errno.ENODEV,

1624

u"%s not a character device"

1625

% os.path.devnull)

1131

u"/dev/null not a character device")

1626

1132

os.dup2(null, sys.stdin.fileno())

1627

1133

os.dup2(null, sys.stdout.fileno())

1628

1134

os.dup2(null, sys.stderr.fileno())

1632

1138

1633

1139

def main():

1634

1140

1635

##################################################################

1141

######################################################################

1636

1142

# Parsing of options, both command line and config file

1637

1143

1638

1144

parser = optparse.OptionParser(version = "%%prog %s" % version)

1647

1153

parser.add_option("--debug", action=u"store_true",

1648

1154

help=u"Debug mode; run in foreground and log to"

1649

1155

u" terminal")

1650

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1651

help=u"Debug level for stdout output")

1652

1156

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1653

1157

u" priority string (see GnuTLS documentation)")

1654

1158

parser.add_option("--servicename", type=u"string",

1679

1183

u"servicename": u"Mandos",

1680

1184

u"use_dbus": u"True",

1681

1185

u"use_ipv6": u"True",

1682

u"debuglevel": u"",

1683

1186

}

1684

1187

1685

1188

# Parse config file for server-global settings

1702

1205

# options, if set.

1703

1206

for option in (u"interface", u"address", u"port", u"debug",

1704

1207

u"priority", u"servicename", u"configdir",

1705

u"use_dbus", u"use_ipv6", u"debuglevel"):

1208

u"use_dbus", u"use_ipv6"):

1706

1209

value = getattr(options, option)

1707

1210

if value is not None:

1708

1211

server_settings[option] = value

1717

1220

1718

1221

# For convenience

1719

1222

debug = server_settings[u"debug"]

1720

debuglevel = server_settings[u"debuglevel"]

1721

1223

use_dbus = server_settings[u"use_dbus"]

1722

1224

use_ipv6 = server_settings[u"use_ipv6"]

1723

1225

1226

if not debug:

1227

syslogger.setLevel(logging.WARNING)

1228

console.setLevel(logging.WARNING)

1229

1724

1230

if server_settings[u"servicename"] != u"Mandos":

1725

1231

syslogger.setFormatter(logging.Formatter

1726

1232

(u'Mandos (%s) [%%(process)d]:'

1732

1238

u"interval": u"5m",

1733

1239

u"checker": u"fping -q -- %%(host)s",

1734

1240

u"host": u"",

1735

u"approval_delay": u"0s",

1736

u"approval_duration": u"1s",

1737

1241

}

1738

1242

client_config = configparser.SafeConfigParser(client_defaults)

1739

1243

client_config.read(os.path.join(server_settings[u"configdir"],

1742

1246

global mandos_dbus_service

1743

1247

mandos_dbus_service = None

1744

1248

1745

tcp_server = MandosServer((server_settings[u"address"],

1746

server_settings[u"port"]),

1747

ClientHandler,

1748

interface=(server_settings[u"interface"]

1749

or None),

1750

use_ipv6=use_ipv6,

1751

gnutls_priority=

1752

server_settings[u"priority"],

1753

use_dbus=use_dbus)

1249

clients = set()

1250

tcp_server = IPv6_TCPServer((server_settings[u"address"],

1251

server_settings[u"port"]),

1252

ClientHandler,

1253

interface=

1254

server_settings[u"interface"],

1255

use_ipv6=use_ipv6,

1256

clients=clients,

1257

gnutls_priority=

1258

server_settings[u"priority"],

1259

use_dbus=use_dbus)

1754

1260

pidfilename = u"/var/run/mandos.pid"

1755

1261

try:

1756

1262

pidfile = open(pidfilename, u"w")

1778

1284

if error[0] != errno.EPERM:

1779

1285

raise error

1780

1286

1781

if not debug and not debuglevel:

1782

syslogger.setLevel(logging.WARNING)

1783

console.setLevel(logging.WARNING)

1784

if debuglevel:

1785

level = getattr(logging, debuglevel.upper())

1786

syslogger.setLevel(level)

1787

console.setLevel(level)

1788

1287

# Enable all possible GnuTLS debugging

1789

1288

if debug:

1790

# Enable all possible GnuTLS debugging

1791

1792

1289

# "Use a log level over 10 to enable all debugging options."

1793

1290

# - GnuTLS manual

1794

1291

gnutls.library.functions.gnutls_global_set_log_level(11)

1799

1296

1800

1297

(gnutls.library.functions

1801

1298

.gnutls_global_set_log_function(debug_gnutls))

1802

1803

# Redirect stdin so all checkers get /dev/null

1804

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1805

os.dup2(null, sys.stdin.fileno())

1806

if null > 2:

1807

os.close(null)

1808

else:

1809

# No console logging

1810

logger.removeHandler(console)

1811

1299

1300

global service

1301

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1302

service = AvahiService(name = server_settings[u"servicename"],

1303

servicetype = u"_mandos._tcp",

1304

protocol = protocol)

1305

if server_settings["interface"]:

1306

service.interface = (if_nametoindex

1307

(str(server_settings[u"interface"])))

1812

1308

1813

1309

global main_loop

1310

global bus

1814

1311

# From the Avahi example code

1815

1312

DBusGMainLoop(set_as_default=True )

1816

1313

main_loop = gobject.MainLoop()

1817

1314

bus = dbus.SystemBus()

1818

1315

# End of Avahi example code

1819

1316

if use_dbus:

1820

try:

1821

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1822

bus, do_not_queue=True)

1823

except dbus.exceptions.NameExistsException, e:

1824

logger.error(unicode(e) + u", disabling D-Bus")

1825

use_dbus = False

1826

server_settings[u"use_dbus"] = False

1827

tcp_server.use_dbus = False

1828

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1829

service = AvahiService(name = server_settings[u"servicename"],

1830

servicetype = u"_mandos._tcp",

1831

protocol = protocol, bus = bus)

1832

if server_settings["interface"]:

1833

service.interface = (if_nametoindex

1834

(str(server_settings[u"interface"])))

1835

1836

if not debug:

1837

# Close all input and output, do double fork, etc.

1838

daemon()

1839

1840

global multiprocessing_manager

1841

multiprocessing_manager = multiprocessing.Manager()

1317

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1842

1318

1843

1319

client_class = Client

1844

1320

if use_dbus:

1845

client_class = functools.partial(ClientDBus, bus = bus)

1846

def client_config_items(config, section):

1847

special_settings = {

1848

"approved_by_default":

1849

lambda: config.getboolean(section,

1850

"approved_by_default"),

1851

}

1852

for name, value in config.items(section):

1853

try:

1854

yield (name, special_settings[name]())

1855

except KeyError:

1856

yield (name, value)

1857

1858

tcp_server.clients.update(set(

1321

client_class = ClientDBus

1322

clients.update(set(

1859

1323

client_class(name = section,

1860

config= dict(client_config_items(

1861

client_config, section)))

1324

config= dict(client_config.items(section)))

1862

1325

for section in client_config.sections()))

1863

if not tcp_server.clients:

1326

if not clients:

1864

1327

logger.warning(u"No clients defined")

1865

1328

1329

if debug:

1330

# Redirect stdin so all checkers get /dev/null

1331

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1332

os.dup2(null, sys.stdin.fileno())

1333

if null > 2:

1334

os.close(null)

1335

else:

1336

# No console logging

1337

logger.removeHandler(console)

1338

# Close all input and output, do double fork, etc.

1339

daemon()

1340

1866

1341

try:

1867

with pidfile:

1342

with closing(pidfile):

1868

1343

pid = os.getpid()

1869

1344

pidfile.write(str(pid) + "\n")

1870

1345

del pidfile

1876

1351

pass

1877

1352

del pidfilename

1878

1353

1354

def cleanup():

1355

"Cleanup function; run on exit"

1356

service.cleanup()

1357

1358

while clients:

1359

client = clients.pop()

1360

client.disable_hook = None

1361

client.disable()

1362

1363

atexit.register(cleanup)

1364

1879

1365

if not debug:

1880

1366

signal.signal(signal.SIGINT, signal.SIG_IGN)

1881

1367

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1888

1374

dbus.service.Object.__init__(self, bus, u"/")

1889

1375

_interface = u"se.bsnet.fukt.Mandos"

1890

1376

1891

@dbus.service.signal(_interface, signature=u"o")

1892

def ClientAdded(self, objpath):

1377

@dbus.service.signal(_interface, signature=u"oa{sv}")

1378

def ClientAdded(self, objpath, properties):

1893

1379

"D-Bus signal"

1894

1380

pass

1895

1381

1896

@dbus.service.signal(_interface, signature=u"ss")

1897

def ClientNotFound(self, fingerprint, address):

1382

@dbus.service.signal(_interface, signature=u"s")

1383

def ClientNotFound(self, fingerprint):

1898

1384

"D-Bus signal"

1899

1385

pass

1900

1386

1906

1392

@dbus.service.method(_interface, out_signature=u"ao")

1907

1393

def GetAllClients(self):

1908

1394

"D-Bus method"

1909

return dbus.Array(c.dbus_object_path

1910

for c in tcp_server.clients)

1395

return dbus.Array(c.dbus_object_path for c in clients)

1911

1396

1912

1397

@dbus.service.method(_interface,

1913

1398

out_signature=u"a{oa{sv}}")

1914

1399

def GetAllClientsWithProperties(self):

1915

1400

"D-Bus method"

1916

1401

return dbus.Dictionary(

1917

((c.dbus_object_path, c.GetAll(u""))

1918

for c in tcp_server.clients),

1402

((c.dbus_object_path, c.GetAllProperties())

1403

for c in clients),

1919

1404

signature=u"oa{sv}")

1920

1405

1921

1406

@dbus.service.method(_interface, in_signature=u"o")

1922

1407

def RemoveClient(self, object_path):

1923

1408

"D-Bus method"

1924

for c in tcp_server.clients:

1409

for c in clients:

1925

1410

if c.dbus_object_path == object_path:

1926

tcp_server.clients.remove(c)

1411

clients.remove(c)

1927

1412

c.remove_from_connection()

1928

1413

# Don't signal anything except ClientRemoved

1929

c.disable(quiet=True)

1414

c.disable(signal=False)

1930

1415

# Emit D-Bus signal

1931

1416

self.ClientRemoved(object_path, c.name)

1932

1417

return

1933

raise KeyError(object_path)

1418

raise KeyError

1934

1419

1935

1420

del _interface

1936

1421

1937

1422

mandos_dbus_service = MandosDBusService()

1938

1423

1939

def cleanup():

1940

"Cleanup function; run on exit"

1941

service.cleanup()

1942

1943

while tcp_server.clients:

1944

client = tcp_server.clients.pop()

1945

if use_dbus:

1946

client.remove_from_connection()

1947

client.disable_hook = None

1948

# Don't signal anything except ClientRemoved

1949

client.disable(quiet=True)

1950

if use_dbus:

1951

# Emit D-Bus signal

1952

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1953

client.name)

1954

1955

atexit.register(cleanup)

1956

1957

for client in tcp_server.clients:

1424

for client in clients:

1958

1425

if use_dbus:

1959

1426

# Emit D-Bus signal

1960

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1427

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1428

client.GetAllProperties())

1961

1429

client.enable()

1962

1430

1963

1431

tcp_server.enable()

1981

1449

service.activate()

1982

1450

except dbus.exceptions.DBusException, error:

1983

1451

logger.critical(u"DBusException: %s", error)

1984

cleanup()

1985

1452

sys.exit(1)

1986

1453

# End of Avahi example code

1987

1454

1994

1461

main_loop.run()

1995

1462

except AvahiError, error:

1996

1463

logger.critical(u"AvahiError: %s", error)

1997

cleanup()

1998

1464

sys.exit(1)

1999

1465

except KeyboardInterrupt:

2000

1466

if debug:

2001

1467

print >> sys.stderr

2002

1468

logger.debug(u"Server received KeyboardInterrupt")

2003

1469

logger.debug(u"Server exiting")

2004

# Must run before the D-Bus bus name gets deregistered

2005

cleanup()

2006

1470

2007

1471

if __name__ == '__main__':

2008

1472

main()