To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 410
- compare with another revision
- download diff
- download tarball
- view history from revision 410
- Committer: Teddy Hogeborn
- Date: 2009-11-19 18:31:28 UTC
- Revision ID: teddy@fukt.bsnet.se-20091119183128-ttstewh61xmtnil1
* Makefile (LINK_FORTIFY_LD): Bug fix: removed "-fPIE".
* mandos-keygen: Bug fix: Fix quoting for the "--password" option.
* mandos-keygen: Bug fix: Fix quoting for the "--password" option.
added
removed
mandos
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
58
import contextlib
58
from contextlib import closing
59
59
import struct
60
60
import fcntl
61
61
import functools
62
import cPickle as pickle
63
import multiprocessing
64
62
65
63
import dbus
66
64
import dbus.service
83
81
84
82
version = "1.0.14"
85
83
86
#logger = logging.getLogger(u'mandos')
87
84
logger = logging.Logger(u'mandos')
88
85
syslogger = (logging.handlers.SysLogHandler
89
86
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
157
154
u" after %i retries, exiting.",
158
155
self.rename_count)
159
156
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
157
self.name = self.server.GetAlternativeServiceName(self.name)
161
158
logger.info(u"Changing Zeroconf service name to %r ...",
162
self.name)
159
unicode(self.name))
163
160
syslogger.setFormatter(logging.Formatter
164
161
(u'Mandos (%s) [%%(process)d]:'
165
162
u' %%(levelname)s: %%(message)s'
245
242
enabled: bool()
246
243
last_checked_ok: datetime.datetime(); (UTC) or None
247
244
timeout: datetime.timedelta(); How long from last_checked_ok
248
until this client is disabled
245
until this client is invalid
249
246
interval: datetime.timedelta(); How often to start a new checker
250
247
disable_hook: If set, called by disable() as disable_hook(self)
251
248
checker: subprocess.Popen(); a running checker process used
259
256
runtime with vars(self) as dict, so that for
260
257
instance %(name)s can be used in the command.
261
258
current_checker_command: string; current running checker_command
262
approved_delay: datetime.timedelta(); Time to wait for approval
263
_approved: bool(); 'None' if not yet approved/disapproved
264
approved_duration: datetime.timedelta(); Duration of one approval
265
259
"""
266
260
267
261
@staticmethod
278
272
def interval_milliseconds(self):
279
273
"Return the 'interval' attribute in milliseconds"
280
274
return self._timedelta_to_milliseconds(self.interval)
281
282
def approved_delay_milliseconds(self):
283
return self._timedelta_to_milliseconds(self.approved_delay)
284
275
285
276
def __init__(self, name = None, disable_hook=None, config=None):
286
277
"""Note: the 'checker' key in 'config' sets the
299
290
if u"secret" in config:
300
291
self.secret = config[u"secret"].decode(u"base64")
301
292
elif u"secfile" in config:
302
with open(os.path.expanduser(os.path.expandvars
303
(config[u"secfile"])),
304
"rb") as secfile:
293
with closing(open(os.path.expanduser
294
(os.path.expandvars
295
(config[u"secfile"])),
296
"rb")) as secfile:
305
297
self.secret = secfile.read()
306
298
else:
307
299
raise TypeError(u"No secret or secfile for client %s"
321
313
self.checker_command = config[u"checker"]
322
314
self.current_checker_command = None
323
315
self.last_connect = None
324
self._approved = None
325
self.approved_by_default = config.get(u"approved_by_default",
326
True)
327
self.approvals_pending = 0
328
self.approved_delay = string_to_delta(
329
config[u"approved_delay"])
330
self.approved_duration = string_to_delta(
331
config[u"approved_duration"])
332
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
333
316
334
def send_changedstate(self):
335
self.changedstate.acquire()
336
self.changedstate.notify_all()
337
self.changedstate.release()
338
339
317
def enable(self):
340
318
"""Start this client's checker and timeout hooks"""
341
319
if getattr(self, u"enabled", False):
342
320
# Already enabled
343
321
return
344
self.send_changedstate()
345
322
self.last_enabled = datetime.datetime.utcnow()
346
323
# Schedule a new checker to be started an 'interval' from now,
347
324
# and every interval from then on.
361
338
if not getattr(self, "enabled", False):
362
339
return False
363
340
if not quiet:
364
self.send_changedstate()
365
if not quiet:
366
341
logger.info(u"Disabling client %s", self.name)
367
342
if getattr(self, u"disable_initiator_tag", False):
368
343
gobject.source_remove(self.disable_initiator_tag)
421
396
# client would inevitably timeout, since no checker would get
422
397
# a chance to run to completion. If we instead leave running
423
398
# checkers alone, the checker would have to take more time
424
# than 'timeout' for the client to be disabled, which is as it
425
# should be.
399
# than 'timeout' for the client to be declared invalid, which
400
# is as it should be.
426
401
427
402
# If a checker exists, make sure it is not a zombie
428
403
try:
500
475
if error.errno != errno.ESRCH: # No such process
501
476
raise
502
477
self.checker = None
478
479
def still_valid(self):
480
"""Has the timeout not yet passed for this client?"""
481
if not getattr(self, u"enabled", False):
482
return False
483
now = datetime.datetime.utcnow()
484
if self.last_checked_ok is None:
485
return now < (self.created + self.timeout)
486
else:
487
return now < (self.last_checked_ok + self.timeout)
488
503
489
504
490
def dbus_service_property(dbus_interface, signature=u"v",
505
491
access=u"readwrite", byte_arrays=False):
513
499
dbus.service.method, except there is only "signature", since the
514
500
type from Get() and the type sent to Set() is the same.
515
501
"""
516
# Encoding deeply encoded byte arrays is not supported yet by the
517
# "Set" method, so we fail early here:
518
if byte_arrays and signature != u"ay":
519
raise ValueError(u"Byte arrays not supported for non-'ay'"
520
u" signature %r" % signature)
521
502
def decorator(func):
522
503
func._dbus_is_property = True
523
504
func._dbus_interface = dbus_interface
609
590
if prop._dbus_access == u"read":
610
591
raise DBusPropertyAccessException(property_name)
611
592
if prop._dbus_get_args_options[u"byte_arrays"]:
612
# The byte_arrays option is not supported yet on
613
# signatures other than "ay".
614
if prop._dbus_signature != u"ay":
615
raise ValueError
616
593
value = dbus.ByteArray(''.join(unichr(byte)
617
594
for byte in value))
618
595
prop(value)
700
677
# dbus.service.Object doesn't use super(), so we can't either.
701
678
702
679
def __init__(self, bus = None, *args, **kwargs):
703
self._approvals_pending = 0
704
680
self.bus = bus
705
681
Client.__init__(self, *args, **kwargs)
706
682
# Only now, when this client is initialized, can it show up on
710
686
+ self.name.replace(u".", u"_")))
711
687
DBusObjectWithProperties.__init__(self, self.bus,
712
688
self.dbus_object_path)
713
714
def _get_approvals_pending(self):
715
return self._approvals_pending
716
def _set_approvals_pending(self, value):
717
old_value = self._approvals_pending
718
self._approvals_pending = value
719
bval = bool(value)
720
if (hasattr(self, "dbus_object_path")
721
and bval is not bool(old_value)):
722
dbus_bool = dbus.Boolean(bval, variant_level=1)
723
self.PropertyChanged(dbus.String(u"approved_pending"),
724
dbus_bool)
725
726
approvals_pending = property(_get_approvals_pending,
727
_set_approvals_pending)
728
del _get_approvals_pending, _set_approvals_pending
729
689
730
690
@staticmethod
731
691
def _datetime_to_dbus(dt, variant_level=0):
820
780
self.PropertyChanged(dbus.String(u"checker_running"),
821
781
dbus.Boolean(False, variant_level=1))
822
782
return r
823
824
def _reset_approved(self):
825
self._approved = None
826
return False
827
828
def approve(self, value=True):
829
self.send_changedstate()
830
self._approved = value
831
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
832
self._reset_approved)
833
834
835
## D-Bus methods, signals & properties
783
784
## D-Bus methods & signals
836
785
_interface = u"se.bsnet.fukt.Mandos.Client"
837
786
838
## Signals
787
# CheckedOK - method
788
@dbus.service.method(_interface)
789
def CheckedOK(self):
790
return self.checked_ok()
839
791
840
792
# CheckerCompleted - signal
841
793
@dbus.service.signal(_interface, signature=u"nxs")
858
810
# GotSecret - signal
859
811
@dbus.service.signal(_interface)
860
812
def GotSecret(self):
861
"""D-Bus signal
862
Is sent after a successful transfer of secret from the Mandos
863
server to mandos-client
864
"""
813
"D-Bus signal"
865
814
pass
866
815
867
816
# Rejected - signal
868
@dbus.service.signal(_interface, signature=u"s")
869
def Rejected(self, reason):
870
"D-Bus signal"
871
pass
872
873
# NeedApproval - signal
874
@dbus.service.signal(_interface, signature=u"db")
875
def NeedApproval(self, timeout, default):
876
"D-Bus signal"
877
pass
878
879
## Methods
880
881
# Approve - method
882
@dbus.service.method(_interface, in_signature=u"b")
883
def Approve(self, value):
884
self.approve(value)
885
886
# CheckedOK - method
887
@dbus.service.method(_interface)
888
def CheckedOK(self):
889
return self.checked_ok()
817
@dbus.service.signal(_interface)
818
def Rejected(self):
819
"D-Bus signal"
820
pass
890
821
891
822
# Enable - method
892
823
@dbus.service.method(_interface)
911
842
def StopChecker(self):
912
843
self.stop_checker()
913
844
914
## Properties
915
916
# approved_pending - property
917
@dbus_service_property(_interface, signature=u"b", access=u"read")
918
def approved_pending_dbus_property(self):
919
return dbus.Boolean(bool(self.approvals_pending))
920
921
# approved_by_default - property
922
@dbus_service_property(_interface, signature=u"b",
923
access=u"readwrite")
924
def approved_by_default_dbus_property(self):
925
return dbus.Boolean(self.approved_by_default)
926
927
# approved_delay - property
928
@dbus_service_property(_interface, signature=u"t",
929
access=u"readwrite")
930
def approved_delay_dbus_property(self):
931
return dbus.UInt64(self.approved_delay_milliseconds())
932
933
# approved_duration - property
934
@dbus_service_property(_interface, signature=u"t",
935
access=u"readwrite")
936
def approved_duration_dbus_property(self):
937
return dbus.UInt64(self._timedelta_to_milliseconds(
938
self.approved_duration))
939
940
845
# name - property
941
846
@dbus_service_property(_interface, signature=u"s", access=u"read")
942
847
def name_dbus_property(self):
1076
981
del _interface
1077
982
1078
983
1079
class ProxyClient(object):
1080
def __init__(self, child_pipe, fpr, address):
1081
self._pipe = child_pipe
1082
self._pipe.send(('init', fpr, address))
1083
if not self._pipe.recv():
1084
raise KeyError()
1085
1086
def __getattribute__(self, name):
1087
if(name == '_pipe'):
1088
return super(ProxyClient, self).__getattribute__(name)
1089
self._pipe.send(('getattr', name))
1090
data = self._pipe.recv()
1091
if data[0] == 'data':
1092
return data[1]
1093
if data[0] == 'function':
1094
def func(*args, **kwargs):
1095
self._pipe.send(('funcall', name, args, kwargs))
1096
return self._pipe.recv()[1]
1097
return func
1098
1099
def __setattr__(self, name, value):
1100
if(name == '_pipe'):
1101
return super(ProxyClient, self).__setattr__(name, value)
1102
self._pipe.send(('setattr', name, value))
1103
1104
1105
984
class ClientHandler(socketserver.BaseRequestHandler, object):
1106
985
"""A class to handle client connections.
1107
986
1109
988
Note: This will run in its own forked process."""
1110
989
1111
990
def handle(self):
1112
with contextlib.closing(self.server.child_pipe) as child_pipe:
1113
logger.info(u"TCP connection from: %s",
1114
unicode(self.client_address))
1115
logger.debug(u"Pipe FD: %d",
1116
self.server.child_pipe.fileno())
1117
991
logger.info(u"TCP connection from: %s",
992
unicode(self.client_address))
993
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
994
# Open IPC pipe to parent process
995
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1118
996
session = (gnutls.connection
1119
997
.ClientSession(self.request,
1120
998
gnutls.connection
1121
999
.X509Credentials()))
1122
1000
1001
line = self.request.makefile().readline()
1002
logger.debug(u"Protocol version: %r", line)
1003
try:
1004
if int(line.strip().split()[0]) > 1:
1005
raise RuntimeError
1006
except (ValueError, IndexError, RuntimeError), error:
1007
logger.error(u"Unknown protocol version: %s", error)
1008
return
1009
1123
1010
# Note: gnutls.connection.X509Credentials is really a
1124
1011
# generic GnuTLS certificate credentials object so long as
1125
1012
# no X.509 keys are added to it. Therefore, we can use it
1126
1013
# here despite using OpenPGP certificates.
1127
1014
1128
1015
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1129
1016
# u"+AES-256-CBC", u"+SHA1",
1130
1017
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1136
1023
(gnutls.library.functions
1137
1024
.gnutls_priority_set_direct(session._c_object,
1138
1025
priority, None))
1139
1140
# Start communication using the Mandos protocol
1141
# Get protocol number
1142
line = self.request.makefile().readline()
1143
logger.debug(u"Protocol version: %r", line)
1144
try:
1145
if int(line.strip().split()[0]) > 1:
1146
raise RuntimeError
1147
except (ValueError, IndexError, RuntimeError), error:
1148
logger.error(u"Unknown protocol version: %s", error)
1149
return
1150
1151
# Start GnuTLS connection
1026
1152
1027
try:
1153
1028
session.handshake()
1154
1029
except gnutls.errors.GNUTLSError, error:
1157
1032
# established. Just abandon the request.
1158
1033
return
1159
1034
logger.debug(u"Handshake succeeded")
1160
1161
approval_required = False
1162
1035
try:
1163
try:
1164
fpr = self.fingerprint(self.peer_certificate
1165
(session))
1166
except (TypeError, gnutls.errors.GNUTLSError), error:
1167
logger.warning(u"Bad certificate: %s", error)
1168
return
1169
logger.debug(u"Fingerprint: %s", fpr)
1170
1171
try:
1172
client = ProxyClient(child_pipe, fpr,
1173
self.client_address)
1174
except KeyError:
1175
return
1176
1177
if client.approved_delay:
1178
delay = client.approved_delay
1179
client.approvals_pending += 1
1180
approval_required = True
1181
1182
while True:
1183
if not client.enabled:
1184
logger.warning(u"Client %s is disabled",
1185
client.name)
1186
if self.server.use_dbus:
1187
# Emit D-Bus signal
1188
client.Rejected("Disabled")
1189
return
1190
1191
if client._approved or not client.approved_delay:
1192
#We are approved or approval is disabled
1193
break
1194
elif client._approved is None:
1195
logger.info(u"Client %s need approval",
1196
client.name)
1197
if self.server.use_dbus:
1198
# Emit D-Bus signal
1199
client.NeedApproval(
1200
client.approved_delay_milliseconds(),
1201
client.approved_by_default)
1202
else:
1203
logger.warning(u"Client %s was not approved",
1204
client.name)
1205
if self.server.use_dbus:
1206
# Emit D-Bus signal
1207
client.Rejected("Disapproved")
1208
return
1209
1210
#wait until timeout or approved
1211
#x = float(client._timedelta_to_milliseconds(delay))
1212
time = datetime.datetime.now()
1213
client.changedstate.acquire()
1214
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1215
client.changedstate.release()
1216
time2 = datetime.datetime.now()
1217
if (time2 - time) >= delay:
1218
if not client.approved_by_default:
1219
logger.warning("Client %s timed out while"
1220
" waiting for approval",
1221
client.name)
1222
if self.server.use_dbus:
1223
# Emit D-Bus signal
1224
client.Rejected("Time out")
1225
return
1226
else:
1227
break
1228
else:
1229
delay -= time2 - time
1230
1231
sent_size = 0
1232
while sent_size < len(client.secret):
1233
try:
1234
sent = session.send(client.secret[sent_size:])
1235
except (gnutls.errors.GNUTLSError), error:
1236
logger.warning("gnutls send failed")
1237
return
1238
logger.debug(u"Sent: %d, remaining: %d",
1239
sent, len(client.secret)
1240
- (sent_size + sent))
1241
sent_size += sent
1242
1243
logger.info(u"Sending secret to %s", client.name)
1244
# bump the timeout as if seen
1245
client.checked_ok()
1246
if self.server.use_dbus:
1247
# Emit D-Bus signal
1248
client.GotSecret()
1036
fpr = self.fingerprint(self.peer_certificate(session))
1037
except (TypeError, gnutls.errors.GNUTLSError), error:
1038
logger.warning(u"Bad certificate: %s", error)
1039
session.bye()
1040
return
1041
logger.debug(u"Fingerprint: %s", fpr)
1249
1042
1250
finally:
1251
if approval_required:
1252
client.approvals_pending -= 1
1253
try:
1254
session.bye()
1255
except (gnutls.errors.GNUTLSError), error:
1256
logger.warning("gnutls bye failed")
1043
for c in self.server.clients:
1044
if c.fingerprint == fpr:
1045
client = c
1046
break
1047
else:
1048
ipc.write(u"NOTFOUND %s %s\n"
1049
% (fpr, unicode(self.client_address)))
1050
session.bye()
1051
return
1052
# Have to check if client.still_valid(), since it is
1053
# possible that the client timed out while establishing
1054
# the GnuTLS session.
1055
if not client.still_valid():
1056
ipc.write(u"INVALID %s\n" % client.name)
1057
session.bye()
1058
return
1059
ipc.write(u"SENDING %s\n" % client.name)
1060
sent_size = 0
1061
while sent_size < len(client.secret):
1062
sent = session.send(client.secret[sent_size:])
1063
logger.debug(u"Sent: %d, remaining: %d",
1064
sent, len(client.secret)
1065
- (sent_size + sent))
1066
sent_size += sent
1067
session.bye()
1257
1068
1258
1069
@staticmethod
1259
1070
def peer_certificate(session):
1319
1130
return hex_fpr
1320
1131
1321
1132
1322
class MultiprocessingMixIn(object):
1323
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1324
def sub_process_main(self, request, address):
1325
try:
1326
self.finish_request(request, address)
1327
except:
1328
self.handle_error(request, address)
1329
self.close_request(request)
1330
1331
def process_request(self, request, address):
1332
"""Start a new process to process the request."""
1333
multiprocessing.Process(target = self.sub_process_main,
1334
args = (request, address)).start()
1335
1336
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1337
""" adds a pipe to the MixIn """
1133
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1134
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1338
1135
def process_request(self, request, client_address):
1339
1136
"""Overrides and wraps the original process_request().
1340
1137
1341
1138
This function creates a new pipe in self.pipe
1342
1139
"""
1343
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1344
1345
super(MultiprocessingMixInWithPipe,
1140
self.pipe = os.pipe()
1141
super(ForkingMixInWithPipe,
1346
1142
self).process_request(request, client_address)
1347
self.child_pipe.close()
1348
self.add_pipe(parent_pipe)
1349
1350
def add_pipe(self, parent_pipe):
1143
os.close(self.pipe[1]) # close write end
1144
self.add_pipe(self.pipe[0])
1145
def add_pipe(self, pipe):
1351
1146
"""Dummy function; override as necessary"""
1352
pass
1353
1354
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1147
os.close(pipe)
1148
1149
1150
class IPv6_TCPServer(ForkingMixInWithPipe,
1355
1151
socketserver.TCPServer, object):
1356
1152
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1357
1153
1442
1238
return socketserver.TCPServer.server_activate(self)
1443
1239
def enable(self):
1444
1240
self.enabled = True
1445
def add_pipe(self, parent_pipe):
1241
def add_pipe(self, pipe):
1446
1242
# Call "handle_ipc" for both data and EOF events
1447
gobject.io_add_watch(parent_pipe.fileno(),
1448
gobject.IO_IN | gobject.IO_HUP,
1449
functools.partial(self.handle_ipc,
1450
parent_pipe = parent_pipe))
1451
1452
def handle_ipc(self, source, condition, parent_pipe=None,
1453
client_object=None):
1243
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1244
self.handle_ipc)
1245
def handle_ipc(self, source, condition, file_objects={}):
1454
1246
condition_names = {
1455
1247
gobject.IO_IN: u"IN", # There is data to read.
1456
1248
gobject.IO_OUT: u"OUT", # Data can be written (without
1467
1259
if cond & condition)
1468
1260
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1469
1261
conditions_string)
1470
1471
# error or the other end of multiprocessing.Pipe has closed
1472
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1473
return False
1474
1475
# Read a request from the child
1476
request = parent_pipe.recv()
1477
logger.debug(u"IPC request: %s", repr(request))
1478
command = request[0]
1479
1480
if command == 'init':
1481
fpr = request[1]
1482
address = request[2]
1483
1484
for c in self.clients:
1485
if c.fingerprint == fpr:
1486
client = c
1487
break
1488
else:
1489
logger.warning(u"Client not found for fingerprint: %s, ad"
1490
u"dress: %s", fpr, address)
1491
if self.use_dbus:
1492
# Emit D-Bus signal
1493
mandos_dbus_service.ClientNotFound(fpr, address)
1494
parent_pipe.send(False)
1495
return False
1496
1497
gobject.io_add_watch(parent_pipe.fileno(),
1498
gobject.IO_IN | gobject.IO_HUP,
1499
functools.partial(self.handle_ipc,
1500
parent_pipe = parent_pipe,
1501
client_object = client))
1502
parent_pipe.send(True)
1503
# remove the old hook in favor of the new above hook on same fileno
1504
return False
1505
if command == 'funcall':
1506
funcname = request[1]
1507
args = request[2]
1508
kwargs = request[3]
1509
1510
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1511
1512
if command == 'getattr':
1513
attrname = request[1]
1514
if callable(client_object.__getattribute__(attrname)):
1515
parent_pipe.send(('function',))
1516
else:
1517
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1518
1519
if command == 'setattr':
1520
attrname = request[1]
1521
value = request[2]
1522
setattr(client_object, attrname, value)
1523
1262
1263
# Turn the pipe file descriptor into a Python file object
1264
if source not in file_objects:
1265
file_objects[source] = os.fdopen(source, u"r", 1)
1266
1267
# Read a line from the file object
1268
cmdline = file_objects[source].readline()
1269
if not cmdline: # Empty line means end of file
1270
# close the IPC pipe
1271
file_objects[source].close()
1272
del file_objects[source]
1273
1274
# Stop calling this function
1275
return False
1276
1277
logger.debug(u"IPC command: %r", cmdline)
1278
1279
# Parse and act on command
1280
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1281
1282
if cmd == u"NOTFOUND":
1283
fpr, address = args.split(None, 1)
1284
logger.warning(u"Client not found for fingerprint: %s, ad"
1285
u"dress: %s", fpr, address)
1286
if self.use_dbus:
1287
# Emit D-Bus signal
1288
mandos_dbus_service.ClientNotFound(fpr, address)
1289
elif cmd == u"INVALID":
1290
for client in self.clients:
1291
if client.name == args:
1292
logger.warning(u"Client %s is invalid", args)
1293
if self.use_dbus:
1294
# Emit D-Bus signal
1295
client.Rejected()
1296
break
1297
else:
1298
logger.error(u"Unknown client %s is invalid", args)
1299
elif cmd == u"SENDING":
1300
for client in self.clients:
1301
if client.name == args:
1302
logger.info(u"Sending secret to %s", client.name)
1303
client.checked_ok()
1304
if self.use_dbus:
1305
# Emit D-Bus signal
1306
client.GotSecret()
1307
break
1308
else:
1309
logger.error(u"Sending secret to unknown client %s",
1310
args)
1311
else:
1312
logger.error(u"Unknown IPC command: %r", cmdline)
1313
1314
# Keep calling this function
1524
1315
return True
1525
1316
1526
1317
1577
1368
def if_nametoindex(interface):
1578
1369
"Get an interface index the hard way, i.e. using fcntl()"
1579
1370
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1580
with contextlib.closing(socket.socket()) as s:
1371
with closing(socket.socket()) as s:
1581
1372
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1582
1373
struct.pack(str(u"16s16x"),
1583
1374
interface))
1629
1420
parser.add_option("--debug", action=u"store_true",
1630
1421
help=u"Debug mode; run in foreground and log to"
1631
1422
u" terminal")
1632
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1633
help=u"Debug level for stdout output")
1634
1423
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1635
1424
u" priority string (see GnuTLS documentation)")
1636
1425
parser.add_option("--servicename", type=u"string",
1661
1450
u"servicename": u"Mandos",
1662
1451
u"use_dbus": u"True",
1663
1452
u"use_ipv6": u"True",
1664
u"debuglevel": u"",
1665
1453
}
1666
1454
1667
1455
# Parse config file for server-global settings
1684
1472
# options, if set.
1685
1473
for option in (u"interface", u"address", u"port", u"debug",
1686
1474
u"priority", u"servicename", u"configdir",
1687
u"use_dbus", u"use_ipv6", u"debuglevel"):
1475
u"use_dbus", u"use_ipv6"):
1688
1476
value = getattr(options, option)
1689
1477
if value is not None:
1690
1478
server_settings[option] = value
1699
1487
1700
1488
# For convenience
1701
1489
debug = server_settings[u"debug"]
1702
debuglevel = server_settings[u"debuglevel"]
1703
1490
use_dbus = server_settings[u"use_dbus"]
1704
1491
use_ipv6 = server_settings[u"use_ipv6"]
1705
1492
1493
if not debug:
1494
syslogger.setLevel(logging.WARNING)
1495
console.setLevel(logging.WARNING)
1496
1706
1497
if server_settings[u"servicename"] != u"Mandos":
1707
1498
syslogger.setFormatter(logging.Formatter
1708
1499
(u'Mandos (%s) [%%(process)d]:'
1714
1505
u"interval": u"5m",
1715
1506
u"checker": u"fping -q -- %%(host)s",
1716
1507
u"host": u"",
1717
u"approved_delay": u"0s",
1718
u"approved_duration": u"1s",
1719
1508
}
1720
1509
client_config = configparser.SafeConfigParser(client_defaults)
1721
1510
client_config.read(os.path.join(server_settings[u"configdir"],
1760
1549
raise error
1761
1550
1762
1551
# Enable all possible GnuTLS debugging
1763
1764
1765
if not debug and not debuglevel:
1766
syslogger.setLevel(logging.WARNING)
1767
console.setLevel(logging.WARNING)
1768
if debuglevel:
1769
level = getattr(logging, debuglevel.upper())
1770
syslogger.setLevel(level)
1771
console.setLevel(level)
1772
1773
1552
if debug:
1774
1553
# "Use a log level over 10 to enable all debugging options."
1775
1554
# - GnuTLS manual
1781
1560
1782
1561
(gnutls.library.functions
1783
1562
.gnutls_global_set_log_function(debug_gnutls))
1784
1785
# Redirect stdin so all checkers get /dev/null
1786
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1787
os.dup2(null, sys.stdin.fileno())
1788
if null > 2:
1789
os.close(null)
1790
else:
1791
# No console logging
1792
logger.removeHandler(console)
1793
1794
1563
1795
1564
global main_loop
1796
1565
# From the Avahi example code
1814
1583
if server_settings["interface"]:
1815
1584
service.interface = (if_nametoindex
1816
1585
(str(server_settings[u"interface"])))
1817
1818
if not debug:
1819
# Close all input and output, do double fork, etc.
1820
daemon()
1821
1822
global multiprocessing_manager
1823
multiprocessing_manager = multiprocessing.Manager()
1824
1586
1825
1587
client_class = Client
1826
1588
if use_dbus:
1827
1589
client_class = functools.partial(ClientDBus, bus = bus)
1828
def client_config_items(config, section):
1829
special_settings = {
1830
"approved_by_default":
1831
lambda: config.getboolean(section,
1832
"approved_by_default"),
1833
}
1834
for name, value in config.items(section):
1835
try:
1836
yield (name, special_settings[name]())
1837
except KeyError:
1838
yield (name, value)
1839
1840
1590
tcp_server.clients.update(set(
1841
1591
client_class(name = section,
1842
config= dict(client_config_items(
1843
client_config, section)))
1592
config= dict(client_config.items(section)))
1844
1593
for section in client_config.sections()))
1845
1594
if not tcp_server.clients:
1846
1595
logger.warning(u"No clients defined")
1847
1596
1597
if debug:
1598
# Redirect stdin so all checkers get /dev/null
1599
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1600
os.dup2(null, sys.stdin.fileno())
1601
if null > 2:
1602
os.close(null)
1603
else:
1604
# No console logging
1605
logger.removeHandler(console)
1606
# Close all input and output, do double fork, etc.
1607
daemon()
1608
1848
1609
try:
1849
with pidfile:
1610
with closing(pidfile):
1850
1611
pid = os.getpid()
1851
1612
pidfile.write(str(pid) + "\n")
1852
1613
del pidfile
1870
1631
dbus.service.Object.__init__(self, bus, u"/")
1871
1632
_interface = u"se.bsnet.fukt.Mandos"
1872
1633
1873
@dbus.service.signal(_interface, signature=u"o")
1874
def ClientAdded(self, objpath):
1634
@dbus.service.signal(_interface, signature=u"oa{sv}")
1635
def ClientAdded(self, objpath, properties):
1875
1636
"D-Bus signal"
1876
1637
pass
1877
1638
1939
1700
for client in tcp_server.clients:
1940
1701
if use_dbus:
1941
1702
# Emit D-Bus signal
1942
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1703
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1704
client.GetAll(u""))
1943
1705
client.enable()
1944
1706
1945
1707
tcp_server.enable()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0