To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 389
- compare with another revision
- download diff
- download tarball
- view history from revision 389
- Committer: Teddy Hogeborn
- Date: 2009-10-18 08:47:40 UTC
- Revision ID: teddy@fukt.bsnet.se-20091018084740-fa1qgm22lg125r10
* plugins.d/splashy.c: Use exit codes from <sysexits.h>.
- files removed:
- dbus-mandos.conf
- files modified:
- Makefile
added
removed
mandos
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
58
import contextlib
58
from contextlib import closing
59
59
import struct
60
60
import fcntl
61
61
import functools
62
import cPickle as pickle
63
import multiprocessing
64
62
65
63
import dbus
66
64
import dbus.service
81
79
SO_BINDTODEVICE = None
82
80
83
81
84
version = "1.0.14"
82
version = "1.0.12"
85
83
86
#logger = logging.getLogger(u'mandos')
87
84
logger = logging.Logger(u'mandos')
88
85
syslogger = (logging.handlers.SysLogHandler
89
86
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
157
154
u" after %i retries, exiting.",
158
155
self.rename_count)
159
156
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
157
self.name = self.server.GetAlternativeServiceName(self.name)
161
158
logger.info(u"Changing Zeroconf service name to %r ...",
162
self.name)
159
unicode(self.name))
163
160
syslogger.setFormatter(logging.Formatter
164
161
(u'Mandos (%s) [%%(process)d]:'
165
162
u' %%(levelname)s: %%(message)s'
194
191
self.group.Commit()
195
192
def entry_group_state_changed(self, state, error):
196
193
"""Derived from the Avahi example code"""
197
logger.debug(u"Avahi entry group state change: %i", state)
194
logger.debug(u"Avahi state change: %i", state)
198
195
199
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
200
197
logger.debug(u"Zeroconf service established.")
213
210
self.group = None
214
211
def server_state_changed(self, state):
215
212
"""Derived from the Avahi example code"""
216
logger.debug(u"Avahi server state change: %i", state)
217
213
if state == avahi.SERVER_COLLISION:
218
214
logger.error(u"Zeroconf server name collision")
219
215
self.remove()
246
242
enabled: bool()
247
243
last_checked_ok: datetime.datetime(); (UTC) or None
248
244
timeout: datetime.timedelta(); How long from last_checked_ok
249
until this client is disabled
245
until this client is invalid
250
246
interval: datetime.timedelta(); How often to start a new checker
251
247
disable_hook: If set, called by disable() as disable_hook(self)
252
248
checker: subprocess.Popen(); a running checker process used
260
256
runtime with vars(self) as dict, so that for
261
257
instance %(name)s can be used in the command.
262
258
current_checker_command: string; current running checker_command
263
approved_delay: datetime.timedelta(); Time to wait for approval
264
_approved: bool(); 'None' if not yet approved/disapproved
265
approved_duration: datetime.timedelta(); Duration of one approval
266
259
"""
267
260
268
261
@staticmethod
279
272
def interval_milliseconds(self):
280
273
"Return the 'interval' attribute in milliseconds"
281
274
return self._timedelta_to_milliseconds(self.interval)
282
283
def approved_delay_milliseconds(self):
284
return self._timedelta_to_milliseconds(self.approved_delay)
285
275
286
276
def __init__(self, name = None, disable_hook=None, config=None):
287
277
"""Note: the 'checker' key in 'config' sets the
300
290
if u"secret" in config:
301
291
self.secret = config[u"secret"].decode(u"base64")
302
292
elif u"secfile" in config:
303
with open(os.path.expanduser(os.path.expandvars
304
(config[u"secfile"])),
305
"rb") as secfile:
293
with closing(open(os.path.expanduser
294
(os.path.expandvars
295
(config[u"secfile"])),
296
"rb")) as secfile:
306
297
self.secret = secfile.read()
307
298
else:
308
299
raise TypeError(u"No secret or secfile for client %s"
322
313
self.checker_command = config[u"checker"]
323
314
self.current_checker_command = None
324
315
self.last_connect = None
325
self._approved = None
326
self.approved_by_default = config.get(u"approved_by_default",
327
True)
328
self.approvals_pending = 0
329
self.approved_delay = string_to_delta(
330
config[u"approved_delay"])
331
self.approved_duration = string_to_delta(
332
config[u"approved_duration"])
333
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
334
316
335
def send_changedstate(self):
336
self.changedstate.acquire()
337
self.changedstate.notify_all()
338
self.changedstate.release()
339
340
317
def enable(self):
341
318
"""Start this client's checker and timeout hooks"""
342
319
if getattr(self, u"enabled", False):
343
320
# Already enabled
344
321
return
345
self.send_changedstate()
346
322
self.last_enabled = datetime.datetime.utcnow()
347
323
# Schedule a new checker to be started an 'interval' from now,
348
324
# and every interval from then on.
349
325
self.checker_initiator_tag = (gobject.timeout_add
350
326
(self.interval_milliseconds(),
351
327
self.start_checker))
328
# Also start a new checker *right now*.
329
self.start_checker()
352
330
# Schedule a disable() when 'timeout' has passed
353
331
self.disable_initiator_tag = (gobject.timeout_add
354
332
(self.timeout_milliseconds(),
355
333
self.disable))
356
334
self.enabled = True
357
# Also start a new checker *right now*.
358
self.start_checker()
359
335
360
def disable(self, quiet=True):
336
def disable(self):
361
337
"""Disable this client."""
362
338
if not getattr(self, "enabled", False):
363
339
return False
364
if not quiet:
365
self.send_changedstate()
366
if not quiet:
367
logger.info(u"Disabling client %s", self.name)
340
logger.info(u"Disabling client %s", self.name)
368
341
if getattr(self, u"disable_initiator_tag", False):
369
342
gobject.source_remove(self.disable_initiator_tag)
370
343
self.disable_initiator_tag = None
422
395
# client would inevitably timeout, since no checker would get
423
396
# a chance to run to completion. If we instead leave running
424
397
# checkers alone, the checker would have to take more time
425
# than 'timeout' for the client to be disabled, which is as it
426
# should be.
398
# than 'timeout' for the client to be declared invalid, which
399
# is as it should be.
427
400
428
401
# If a checker exists, make sure it is not a zombie
429
402
try:
494
467
logger.debug(u"Stopping checker for %(name)s", vars(self))
495
468
try:
496
469
os.kill(self.checker.pid, signal.SIGTERM)
497
#time.sleep(0.5)
470
#os.sleep(0.5)
498
471
#if self.checker.poll() is None:
499
472
# os.kill(self.checker.pid, signal.SIGKILL)
500
473
except OSError, error:
501
474
if error.errno != errno.ESRCH: # No such process
502
475
raise
503
476
self.checker = None
477
478
def still_valid(self):
479
"""Has the timeout not yet passed for this client?"""
480
if not getattr(self, u"enabled", False):
481
return False
482
now = datetime.datetime.utcnow()
483
if self.last_checked_ok is None:
484
return now < (self.created + self.timeout)
485
else:
486
return now < (self.last_checked_ok + self.timeout)
487
504
488
505
489
def dbus_service_property(dbus_interface, signature=u"v",
506
490
access=u"readwrite", byte_arrays=False):
514
498
dbus.service.method, except there is only "signature", since the
515
499
type from Get() and the type sent to Set() is the same.
516
500
"""
517
# Encoding deeply encoded byte arrays is not supported yet by the
518
# "Set" method, so we fail early here:
519
if byte_arrays and signature != u"ay":
520
raise ValueError(u"Byte arrays not supported for non-'ay'"
521
u" signature %r" % signature)
522
501
def decorator(func):
523
502
func._dbus_is_property = True
524
503
func._dbus_interface = dbus_interface
610
589
if prop._dbus_access == u"read":
611
590
raise DBusPropertyAccessException(property_name)
612
591
if prop._dbus_get_args_options[u"byte_arrays"]:
613
# The byte_arrays option is not supported yet on
614
# signatures other than "ay".
615
if prop._dbus_signature != u"ay":
616
raise ValueError
617
592
value = dbus.ByteArray(''.join(unichr(byte)
618
593
for byte in value))
619
594
prop(value)
701
676
# dbus.service.Object doesn't use super(), so we can't either.
702
677
703
678
def __init__(self, bus = None, *args, **kwargs):
704
self._approvals_pending = 0
705
679
self.bus = bus
706
680
Client.__init__(self, *args, **kwargs)
707
681
# Only now, when this client is initialized, can it show up on
711
685
+ self.name.replace(u".", u"_")))
712
686
DBusObjectWithProperties.__init__(self, self.bus,
713
687
self.dbus_object_path)
714
715
def _get_approvals_pending(self):
716
return self._approvals_pending
717
def _set_approvals_pending(self, value):
718
old_value = self._approvals_pending
719
self._approvals_pending = value
720
bval = bool(value)
721
if (hasattr(self, "dbus_object_path")
722
and bval is not bool(old_value)):
723
dbus_bool = dbus.Boolean(bval, variant_level=1)
724
self.PropertyChanged(dbus.String(u"approved_pending"),
725
dbus_bool)
726
727
approvals_pending = property(_get_approvals_pending,
728
_set_approvals_pending)
729
del _get_approvals_pending, _set_approvals_pending
730
688
731
689
@staticmethod
732
690
def _datetime_to_dbus(dt, variant_level=0):
747
705
variant_level=1))
748
706
return r
749
707
750
def disable(self, quiet = False):
708
def disable(self, signal = True):
751
709
oldstate = getattr(self, u"enabled", False)
752
r = Client.disable(self, quiet=quiet)
753
if not quiet and oldstate != self.enabled:
710
r = Client.disable(self)
711
if signal and oldstate != self.enabled:
754
712
# Emit D-Bus signal
755
713
self.PropertyChanged(dbus.String(u"enabled"),
756
714
dbus.Boolean(False, variant_level=1))
821
779
self.PropertyChanged(dbus.String(u"checker_running"),
822
780
dbus.Boolean(False, variant_level=1))
823
781
return r
824
825
def _reset_approved(self):
826
self._approved = None
827
return False
828
829
def approve(self, value=True):
830
self.send_changedstate()
831
self._approved = value
832
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
833
self._reset_approved)
834
835
836
## D-Bus methods, signals & properties
782
783
## D-Bus methods & signals
837
784
_interface = u"se.bsnet.fukt.Mandos.Client"
838
785
839
## Signals
786
# CheckedOK - method
787
@dbus.service.method(_interface)
788
def CheckedOK(self):
789
return self.checked_ok()
840
790
841
791
# CheckerCompleted - signal
842
792
@dbus.service.signal(_interface, signature=u"nxs")
859
809
# GotSecret - signal
860
810
@dbus.service.signal(_interface)
861
811
def GotSecret(self):
862
"""D-Bus signal
863
Is sent after a successful transfer of secret from the Mandos
864
server to mandos-client
865
"""
812
"D-Bus signal"
866
813
pass
867
814
868
815
# Rejected - signal
869
@dbus.service.signal(_interface, signature=u"s")
870
def Rejected(self, reason):
871
"D-Bus signal"
872
pass
873
874
# NeedApproval - signal
875
@dbus.service.signal(_interface, signature=u"db")
876
def NeedApproval(self, timeout, default):
877
"D-Bus signal"
878
pass
879
880
## Methods
881
882
# Approve - method
883
@dbus.service.method(_interface, in_signature=u"b")
884
def Approve(self, value):
885
self.approve(value)
886
887
# CheckedOK - method
888
@dbus.service.method(_interface)
889
def CheckedOK(self):
890
return self.checked_ok()
816
@dbus.service.signal(_interface)
817
def Rejected(self):
818
"D-Bus signal"
819
pass
891
820
892
821
# Enable - method
893
822
@dbus.service.method(_interface)
912
841
def StopChecker(self):
913
842
self.stop_checker()
914
843
915
## Properties
916
917
# approved_pending - property
918
@dbus_service_property(_interface, signature=u"b", access=u"read")
919
def approved_pending_dbus_property(self):
920
return dbus.Boolean(bool(self.approvals_pending))
921
922
# approved_by_default - property
923
@dbus_service_property(_interface, signature=u"b",
924
access=u"readwrite")
925
def approved_by_default_dbus_property(self):
926
return dbus.Boolean(self.approved_by_default)
927
928
# approved_delay - property
929
@dbus_service_property(_interface, signature=u"t",
930
access=u"readwrite")
931
def approved_delay_dbus_property(self):
932
return dbus.UInt64(self.approved_delay_milliseconds())
933
934
# approved_duration - property
935
@dbus_service_property(_interface, signature=u"t",
936
access=u"readwrite")
937
def approved_duration_dbus_property(self):
938
return dbus.UInt64(self._timedelta_to_milliseconds(
939
self.approved_duration))
940
941
844
# name - property
942
845
@dbus_service_property(_interface, signature=u"s", access=u"read")
943
846
def name_dbus_property(self):
1077
980
del _interface
1078
981
1079
982
1080
class ProxyClient(object):
1081
def __init__(self, child_pipe, fpr, address):
1082
self._pipe = child_pipe
1083
self._pipe.send(('init', fpr, address))
1084
if not self._pipe.recv():
1085
raise KeyError()
1086
1087
def __getattribute__(self, name):
1088
if(name == '_pipe'):
1089
return super(ProxyClient, self).__getattribute__(name)
1090
self._pipe.send(('getattr', name))
1091
data = self._pipe.recv()
1092
if data[0] == 'data':
1093
return data[1]
1094
if data[0] == 'function':
1095
def func(*args, **kwargs):
1096
self._pipe.send(('funcall', name, args, kwargs))
1097
return self._pipe.recv()[1]
1098
return func
1099
1100
def __setattr__(self, name, value):
1101
if(name == '_pipe'):
1102
return super(ProxyClient, self).__setattr__(name, value)
1103
self._pipe.send(('setattr', name, value))
1104
1105
1106
983
class ClientHandler(socketserver.BaseRequestHandler, object):
1107
984
"""A class to handle client connections.
1108
985
1110
987
Note: This will run in its own forked process."""
1111
988
1112
989
def handle(self):
1113
with contextlib.closing(self.server.child_pipe) as child_pipe:
1114
logger.info(u"TCP connection from: %s",
1115
unicode(self.client_address))
1116
logger.debug(u"Pipe FD: %d",
1117
self.server.child_pipe.fileno())
1118
990
logger.info(u"TCP connection from: %s",
991
unicode(self.client_address))
992
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
993
# Open IPC pipe to parent process
994
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1119
995
session = (gnutls.connection
1120
996
.ClientSession(self.request,
1121
997
gnutls.connection
1122
998
.X509Credentials()))
1123
999
1000
line = self.request.makefile().readline()
1001
logger.debug(u"Protocol version: %r", line)
1002
try:
1003
if int(line.strip().split()[0]) > 1:
1004
raise RuntimeError
1005
except (ValueError, IndexError, RuntimeError), error:
1006
logger.error(u"Unknown protocol version: %s", error)
1007
return
1008
1124
1009
# Note: gnutls.connection.X509Credentials is really a
1125
1010
# generic GnuTLS certificate credentials object so long as
1126
1011
# no X.509 keys are added to it. Therefore, we can use it
1127
1012
# here despite using OpenPGP certificates.
1128
1013
1129
1014
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1130
1015
# u"+AES-256-CBC", u"+SHA1",
1131
1016
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1137
1022
(gnutls.library.functions
1138
1023
.gnutls_priority_set_direct(session._c_object,
1139
1024
priority, None))
1140
1141
# Start communication using the Mandos protocol
1142
# Get protocol number
1143
line = self.request.makefile().readline()
1144
logger.debug(u"Protocol version: %r", line)
1145
try:
1146
if int(line.strip().split()[0]) > 1:
1147
raise RuntimeError
1148
except (ValueError, IndexError, RuntimeError), error:
1149
logger.error(u"Unknown protocol version: %s", error)
1150
return
1151
1152
# Start GnuTLS connection
1025
1153
1026
try:
1154
1027
session.handshake()
1155
1028
except gnutls.errors.GNUTLSError, error:
1158
1031
# established. Just abandon the request.
1159
1032
return
1160
1033
logger.debug(u"Handshake succeeded")
1161
1162
approval_required = False
1163
1034
try:
1164
try:
1165
fpr = self.fingerprint(self.peer_certificate
1166
(session))
1167
except (TypeError, gnutls.errors.GNUTLSError), error:
1168
logger.warning(u"Bad certificate: %s", error)
1169
return
1170
logger.debug(u"Fingerprint: %s", fpr)
1171
1172
try:
1173
client = ProxyClient(child_pipe, fpr,
1174
self.client_address)
1175
except KeyError:
1176
return
1177
1178
if client.approved_delay:
1179
delay = client.approved_delay
1180
client.approvals_pending += 1
1181
approval_required = True
1182
1183
while True:
1184
if not client.enabled:
1185
logger.warning(u"Client %s is disabled",
1186
client.name)
1187
if self.server.use_dbus:
1188
# Emit D-Bus signal
1189
client.Rejected("Disabled")
1190
return
1191
1192
if client._approved or not client.approved_delay:
1193
#We are approved or approval is disabled
1194
break
1195
elif client._approved is None:
1196
logger.info(u"Client %s need approval",
1197
client.name)
1198
if self.server.use_dbus:
1199
# Emit D-Bus signal
1200
client.NeedApproval(
1201
client.approved_delay_milliseconds(),
1202
client.approved_by_default)
1203
else:
1204
logger.warning(u"Client %s was not approved",
1205
client.name)
1206
if self.server.use_dbus:
1207
# Emit D-Bus signal
1208
client.Rejected("Disapproved")
1209
return
1210
1211
#wait until timeout or approved
1212
#x = float(client._timedelta_to_milliseconds(delay))
1213
time = datetime.datetime.now()
1214
client.changedstate.acquire()
1215
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1216
client.changedstate.release()
1217
time2 = datetime.datetime.now()
1218
if (time2 - time) >= delay:
1219
if not client.approved_by_default:
1220
logger.warning("Client %s timed out while"
1221
" waiting for approval",
1222
client.name)
1223
if self.server.use_dbus:
1224
# Emit D-Bus signal
1225
client.Rejected("Time out")
1226
return
1227
else:
1228
break
1229
else:
1230
delay -= time2 - time
1231
1232
sent_size = 0
1233
while sent_size < len(client.secret):
1234
try:
1235
sent = session.send(client.secret[sent_size:])
1236
except (gnutls.errors.GNUTLSError), error:
1237
logger.warning("gnutls send failed")
1238
return
1239
logger.debug(u"Sent: %d, remaining: %d",
1240
sent, len(client.secret)
1241
- (sent_size + sent))
1242
sent_size += sent
1243
1244
logger.info(u"Sending secret to %s", client.name)
1245
# bump the timeout as if seen
1246
client.checked_ok()
1247
if self.server.use_dbus:
1248
# Emit D-Bus signal
1249
client.GotSecret()
1035
fpr = self.fingerprint(self.peer_certificate(session))
1036
except (TypeError, gnutls.errors.GNUTLSError), error:
1037
logger.warning(u"Bad certificate: %s", error)
1038
session.bye()
1039
return
1040
logger.debug(u"Fingerprint: %s", fpr)
1250
1041
1251
finally:
1252
if approval_required:
1253
client.approvals_pending -= 1
1254
try:
1255
session.bye()
1256
except (gnutls.errors.GNUTLSError), error:
1257
logger.warning("gnutls bye failed")
1042
for c in self.server.clients:
1043
if c.fingerprint == fpr:
1044
client = c
1045
break
1046
else:
1047
ipc.write(u"NOTFOUND %s %s\n"
1048
% (fpr, unicode(self.client_address)))
1049
session.bye()
1050
return
1051
# Have to check if client.still_valid(), since it is
1052
# possible that the client timed out while establishing
1053
# the GnuTLS session.
1054
if not client.still_valid():
1055
ipc.write(u"INVALID %s\n" % client.name)
1056
session.bye()
1057
return
1058
ipc.write(u"SENDING %s\n" % client.name)
1059
sent_size = 0
1060
while sent_size < len(client.secret):
1061
sent = session.send(client.secret[sent_size:])
1062
logger.debug(u"Sent: %d, remaining: %d",
1063
sent, len(client.secret)
1064
- (sent_size + sent))
1065
sent_size += sent
1066
session.bye()
1258
1067
1259
1068
@staticmethod
1260
1069
def peer_certificate(session):
1320
1129
return hex_fpr
1321
1130
1322
1131
1323
class MultiprocessingMixIn(object):
1324
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1325
def sub_process_main(self, request, address):
1326
try:
1327
self.finish_request(request, address)
1328
except:
1329
self.handle_error(request, address)
1330
self.close_request(request)
1331
1332
def process_request(self, request, address):
1333
"""Start a new process to process the request."""
1334
multiprocessing.Process(target = self.sub_process_main,
1335
args = (request, address)).start()
1336
1337
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1338
""" adds a pipe to the MixIn """
1132
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1133
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1339
1134
def process_request(self, request, client_address):
1340
1135
"""Overrides and wraps the original process_request().
1341
1136
1342
1137
This function creates a new pipe in self.pipe
1343
1138
"""
1344
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1345
1346
super(MultiprocessingMixInWithPipe,
1139
self.pipe = os.pipe()
1140
super(ForkingMixInWithPipe,
1347
1141
self).process_request(request, client_address)
1348
self.child_pipe.close()
1349
self.add_pipe(parent_pipe)
1350
1351
def add_pipe(self, parent_pipe):
1142
os.close(self.pipe[1]) # close write end
1143
self.add_pipe(self.pipe[0])
1144
def add_pipe(self, pipe):
1352
1145
"""Dummy function; override as necessary"""
1353
pass
1354
1355
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1146
os.close(pipe)
1147
1148
1149
class IPv6_TCPServer(ForkingMixInWithPipe,
1356
1150
socketserver.TCPServer, object):
1357
1151
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1358
1152
1443
1237
return socketserver.TCPServer.server_activate(self)
1444
1238
def enable(self):
1445
1239
self.enabled = True
1446
def add_pipe(self, parent_pipe):
1240
def add_pipe(self, pipe):
1447
1241
# Call "handle_ipc" for both data and EOF events
1448
gobject.io_add_watch(parent_pipe.fileno(),
1449
gobject.IO_IN | gobject.IO_HUP,
1450
functools.partial(self.handle_ipc,
1451
parent_pipe = parent_pipe))
1452
1453
def handle_ipc(self, source, condition, parent_pipe=None,
1454
client_object=None):
1242
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1243
self.handle_ipc)
1244
def handle_ipc(self, source, condition, file_objects={}):
1455
1245
condition_names = {
1456
1246
gobject.IO_IN: u"IN", # There is data to read.
1457
1247
gobject.IO_OUT: u"OUT", # Data can be written (without
1468
1258
if cond & condition)
1469
1259
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1470
1260
conditions_string)
1471
1472
# error or the other end of multiprocessing.Pipe has closed
1473
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1474
return False
1475
1476
# Read a request from the child
1477
request = parent_pipe.recv()
1478
logger.debug(u"IPC request: %s", repr(request))
1479
command = request[0]
1480
1481
if command == 'init':
1482
fpr = request[1]
1483
address = request[2]
1484
1485
for c in self.clients:
1486
if c.fingerprint == fpr:
1487
client = c
1488
break
1489
else:
1490
logger.warning(u"Client not found for fingerprint: %s, ad"
1491
u"dress: %s", fpr, address)
1492
if self.use_dbus:
1493
# Emit D-Bus signal
1494
mandos_dbus_service.ClientNotFound(fpr, address)
1495
parent_pipe.send(False)
1496
return False
1497
1498
gobject.io_add_watch(parent_pipe.fileno(),
1499
gobject.IO_IN | gobject.IO_HUP,
1500
functools.partial(self.handle_ipc,
1501
parent_pipe = parent_pipe,
1502
client_object = client))
1503
parent_pipe.send(True)
1504
# remove the old hook in favor of the new above hook on same fileno
1505
return False
1506
if command == 'funcall':
1507
funcname = request[1]
1508
args = request[2]
1509
kwargs = request[3]
1510
1511
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1512
1513
if command == 'getattr':
1514
attrname = request[1]
1515
if callable(client_object.__getattribute__(attrname)):
1516
parent_pipe.send(('function',))
1517
else:
1518
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1519
1520
if command == 'setattr':
1521
attrname = request[1]
1522
value = request[2]
1523
setattr(client_object, attrname, value)
1524
1261
1262
# Turn the pipe file descriptor into a Python file object
1263
if source not in file_objects:
1264
file_objects[source] = os.fdopen(source, u"r", 1)
1265
1266
# Read a line from the file object
1267
cmdline = file_objects[source].readline()
1268
if not cmdline: # Empty line means end of file
1269
# close the IPC pipe
1270
file_objects[source].close()
1271
del file_objects[source]
1272
1273
# Stop calling this function
1274
return False
1275
1276
logger.debug(u"IPC command: %r", cmdline)
1277
1278
# Parse and act on command
1279
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1280
1281
if cmd == u"NOTFOUND":
1282
logger.warning(u"Client not found for fingerprint: %s",
1283
args)
1284
if self.use_dbus:
1285
# Emit D-Bus signal
1286
mandos_dbus_service.ClientNotFound(args)
1287
elif cmd == u"INVALID":
1288
for client in self.clients:
1289
if client.name == args:
1290
logger.warning(u"Client %s is invalid", args)
1291
if self.use_dbus:
1292
# Emit D-Bus signal
1293
client.Rejected()
1294
break
1295
else:
1296
logger.error(u"Unknown client %s is invalid", args)
1297
elif cmd == u"SENDING":
1298
for client in self.clients:
1299
if client.name == args:
1300
logger.info(u"Sending secret to %s", client.name)
1301
client.checked_ok()
1302
if self.use_dbus:
1303
# Emit D-Bus signal
1304
client.GotSecret()
1305
break
1306
else:
1307
logger.error(u"Sending secret to unknown client %s",
1308
args)
1309
else:
1310
logger.error(u"Unknown IPC command: %r", cmdline)
1311
1312
# Keep calling this function
1525
1313
return True
1526
1314
1527
1315
1557
1345
elif suffix == u"w":
1558
1346
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1559
1347
else:
1560
raise ValueError(u"Unknown suffix %r" % suffix)
1561
except (ValueError, IndexError), e:
1562
raise ValueError(e.message)
1348
raise ValueError
1349
except (ValueError, IndexError):
1350
raise ValueError
1563
1351
timevalue += delta
1564
1352
return timevalue
1565
1353
1578
1366
def if_nametoindex(interface):
1579
1367
"Get an interface index the hard way, i.e. using fcntl()"
1580
1368
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1581
with contextlib.closing(socket.socket()) as s:
1369
with closing(socket.socket()) as s:
1582
1370
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1583
1371
struct.pack(str(u"16s16x"),
1584
1372
interface))
1630
1418
parser.add_option("--debug", action=u"store_true",
1631
1419
help=u"Debug mode; run in foreground and log to"
1632
1420
u" terminal")
1633
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1634
help=u"Debug level for stdout output")
1635
1421
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1636
1422
u" priority string (see GnuTLS documentation)")
1637
1423
parser.add_option("--servicename", type=u"string",
1662
1448
u"servicename": u"Mandos",
1663
1449
u"use_dbus": u"True",
1664
1450
u"use_ipv6": u"True",
1665
u"debuglevel": u"",
1666
1451
}
1667
1452
1668
1453
# Parse config file for server-global settings
1685
1470
# options, if set.
1686
1471
for option in (u"interface", u"address", u"port", u"debug",
1687
1472
u"priority", u"servicename", u"configdir",
1688
u"use_dbus", u"use_ipv6", u"debuglevel"):
1473
u"use_dbus", u"use_ipv6"):
1689
1474
value = getattr(options, option)
1690
1475
if value is not None:
1691
1476
server_settings[option] = value
1700
1485
1701
1486
# For convenience
1702
1487
debug = server_settings[u"debug"]
1703
debuglevel = server_settings[u"debuglevel"]
1704
1488
use_dbus = server_settings[u"use_dbus"]
1705
1489
use_ipv6 = server_settings[u"use_ipv6"]
1706
1490
1491
if not debug:
1492
syslogger.setLevel(logging.WARNING)
1493
console.setLevel(logging.WARNING)
1494
1707
1495
if server_settings[u"servicename"] != u"Mandos":
1708
1496
syslogger.setFormatter(logging.Formatter
1709
1497
(u'Mandos (%s) [%%(process)d]:'
1715
1503
u"interval": u"5m",
1716
1504
u"checker": u"fping -q -- %%(host)s",
1717
1505
u"host": u"",
1718
u"approved_delay": u"0s",
1719
u"approved_duration": u"1s",
1720
1506
}
1721
1507
client_config = configparser.SafeConfigParser(client_defaults)
1722
1508
client_config.read(os.path.join(server_settings[u"configdir"],
1761
1547
raise error
1762
1548
1763
1549
# Enable all possible GnuTLS debugging
1764
1765
1766
if not debug and not debuglevel:
1767
syslogger.setLevel(logging.WARNING)
1768
console.setLevel(logging.WARNING)
1769
if debuglevel:
1770
level = getattr(logging, debuglevel.upper())
1771
syslogger.setLevel(level)
1772
console.setLevel(level)
1773
1774
1550
if debug:
1775
1551
# "Use a log level over 10 to enable all debugging options."
1776
1552
# - GnuTLS manual
1782
1558
1783
1559
(gnutls.library.functions
1784
1560
.gnutls_global_set_log_function(debug_gnutls))
1785
1786
# Redirect stdin so all checkers get /dev/null
1787
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1788
os.dup2(null, sys.stdin.fileno())
1789
if null > 2:
1790
os.close(null)
1791
else:
1792
# No console logging
1793
logger.removeHandler(console)
1794
1795
1561
1796
1562
global main_loop
1797
1563
# From the Avahi example code
1800
1566
bus = dbus.SystemBus()
1801
1567
# End of Avahi example code
1802
1568
if use_dbus:
1803
try:
1804
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1805
bus, do_not_queue=True)
1806
except dbus.exceptions.NameExistsException, e:
1807
logger.error(unicode(e) + u", disabling D-Bus")
1808
use_dbus = False
1809
server_settings[u"use_dbus"] = False
1810
tcp_server.use_dbus = False
1569
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1811
1570
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1812
1571
service = AvahiService(name = server_settings[u"servicename"],
1813
1572
servicetype = u"_mandos._tcp",
1815
1574
if server_settings["interface"]:
1816
1575
service.interface = (if_nametoindex
1817
1576
(str(server_settings[u"interface"])))
1818
1819
if not debug:
1820
# Close all input and output, do double fork, etc.
1821
daemon()
1822
1823
global multiprocessing_manager
1824
multiprocessing_manager = multiprocessing.Manager()
1825
1577
1826
1578
client_class = Client
1827
1579
if use_dbus:
1828
1580
client_class = functools.partial(ClientDBus, bus = bus)
1829
def client_config_items(config, section):
1830
special_settings = {
1831
"approved_by_default":
1832
lambda: config.getboolean(section,
1833
"approved_by_default"),
1834
}
1835
for name, value in config.items(section):
1836
try:
1837
yield (name, special_settings[name]())
1838
except KeyError:
1839
yield (name, value)
1840
1841
1581
tcp_server.clients.update(set(
1842
1582
client_class(name = section,
1843
config= dict(client_config_items(
1844
client_config, section)))
1583
config= dict(client_config.items(section)))
1845
1584
for section in client_config.sections()))
1846
1585
if not tcp_server.clients:
1847
1586
logger.warning(u"No clients defined")
1848
1587
1588
if debug:
1589
# Redirect stdin so all checkers get /dev/null
1590
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1591
os.dup2(null, sys.stdin.fileno())
1592
if null > 2:
1593
os.close(null)
1594
else:
1595
# No console logging
1596
logger.removeHandler(console)
1597
# Close all input and output, do double fork, etc.
1598
daemon()
1599
1849
1600
try:
1850
with pidfile:
1601
with closing(pidfile):
1851
1602
pid = os.getpid()
1852
1603
pidfile.write(str(pid) + "\n")
1853
1604
del pidfile
1859
1610
pass
1860
1611
del pidfilename
1861
1612
1613
def cleanup():
1614
"Cleanup function; run on exit"
1615
service.cleanup()
1616
1617
while tcp_server.clients:
1618
client = tcp_server.clients.pop()
1619
client.disable_hook = None
1620
client.disable()
1621
1622
atexit.register(cleanup)
1623
1862
1624
if not debug:
1863
1625
signal.signal(signal.SIGINT, signal.SIG_IGN)
1864
1626
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1871
1633
dbus.service.Object.__init__(self, bus, u"/")
1872
1634
_interface = u"se.bsnet.fukt.Mandos"
1873
1635
1874
@dbus.service.signal(_interface, signature=u"o")
1875
def ClientAdded(self, objpath):
1636
@dbus.service.signal(_interface, signature=u"oa{sv}")
1637
def ClientAdded(self, objpath, properties):
1876
1638
"D-Bus signal"
1877
1639
pass
1878
1640
1879
@dbus.service.signal(_interface, signature=u"ss")
1880
def ClientNotFound(self, fingerprint, address):
1641
@dbus.service.signal(_interface, signature=u"s")
1642
def ClientNotFound(self, fingerprint):
1881
1643
"D-Bus signal"
1882
1644
pass
1883
1645
1909
1671
tcp_server.clients.remove(c)
1910
1672
c.remove_from_connection()
1911
1673
# Don't signal anything except ClientRemoved
1912
c.disable(quiet=True)
1674
c.disable(signal=False)
1913
1675
# Emit D-Bus signal
1914
1676
self.ClientRemoved(object_path, c.name)
1915
1677
return
1916
raise KeyError(object_path)
1678
raise KeyError
1917
1679
1918
1680
del _interface
1919
1681
1920
1682
mandos_dbus_service = MandosDBusService()
1921
1683
1922
def cleanup():
1923
"Cleanup function; run on exit"
1924
service.cleanup()
1925
1926
while tcp_server.clients:
1927
client = tcp_server.clients.pop()
1928
if use_dbus:
1929
client.remove_from_connection()
1930
client.disable_hook = None
1931
# Don't signal anything except ClientRemoved
1932
client.disable(quiet=True)
1933
if use_dbus:
1934
# Emit D-Bus signal
1935
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1936
client.name)
1937
1938
atexit.register(cleanup)
1939
1940
1684
for client in tcp_server.clients:
1941
1685
if use_dbus:
1942
1686
# Emit D-Bus signal
1943
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1687
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1688
client.GetAll(u""))
1944
1689
client.enable()
1945
1690
1946
1691
tcp_server.enable()
1964
1709
service.activate()
1965
1710
except dbus.exceptions.DBusException, error:
1966
1711
logger.critical(u"DBusException: %s", error)
1967
cleanup()
1968
1712
sys.exit(1)
1969
1713
# End of Avahi example code
1970
1714
1977
1721
main_loop.run()
1978
1722
except AvahiError, error:
1979
1723
logger.critical(u"AvahiError: %s", error)
1980
cleanup()
1981
1724
sys.exit(1)
1982
1725
except KeyboardInterrupt:
1983
1726
if debug:
1984
1727
print >> sys.stderr
1985
1728
logger.debug(u"Server received KeyboardInterrupt")
1986
1729
logger.debug(u"Server exiting")
1987
# Must run before the D-Bus bus name gets deregistered
1988
cleanup()
1989
1730
1990
1731
if __name__ == '__main__':
1991
1732
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0