To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 410
- compare with another revision
- download diff
- download tarball
- view history from revision 410
- Committer: Teddy Hogeborn
- Date: 2009-11-19 18:31:28 UTC
- Revision ID: teddy@fukt.bsnet.se-20091119183128-ttstewh61xmtnil1
* Makefile (LINK_FORTIFY_LD): Bug fix: removed "-fPIE".
* mandos-keygen: Bug fix: Fix quoting for the "--password" option.
* mandos-keygen: Bug fix: Fix quoting for the "--password" option.
- files added:
- dbus-mandos.conf
- files modified:
- Makefile
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer
36
import SocketServer as socketserver
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser
47
import ConfigParser as configparser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
53
52
import subprocess
54
53
import atexit
55
54
import stat
57
56
import logging.handlers
58
57
import pwd
59
58
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
60
62
61
63
import dbus
62
64
import dbus.service
65
67
from dbus.mainloop.glib import DBusGMainLoop
66
68
import ctypes
67
69
import ctypes.util
70
import xml.dom.minidom
71
import inspect
68
72
69
73
try:
70
74
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
72
76
try:
73
77
from IN import SO_BINDTODEVICE
74
78
except ImportError:
75
# From /usr/include/asm/socket.h
76
SO_BINDTODEVICE = 25
77
78
79
version = "1.0.8"
80
81
logger = logging.Logger('mandos')
79
SO_BINDTODEVICE = None
80
81
82
version = "1.0.14"
83
84
logger = logging.Logger(u'mandos')
82
85
syslogger = (logging.handlers.SysLogHandler
83
86
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
84
87
address = "/dev/log"))
85
88
syslogger.setFormatter(logging.Formatter
86
('Mandos [%(process)d]: %(levelname)s:'
87
' %(message)s'))
89
(u'Mandos [%(process)d]: %(levelname)s:'
90
u' %(message)s'))
88
91
logger.addHandler(syslogger)
89
92
90
93
console = logging.StreamHandler()
91
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
92
' %(levelname)s: %(message)s'))
94
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
95
u' %(levelname)s:'
96
u' %(message)s'))
93
97
logger.addHandler(console)
94
98
95
99
class AvahiError(Exception):
112
116
Attributes:
113
117
interface: integer; avahi.IF_UNSPEC or an interface index.
114
118
Used to optionally bind to the specified interface.
115
name: string; Example: 'Mandos'
116
type: string; Example: '_mandos._tcp'.
119
name: string; Example: u'Mandos'
120
type: string; Example: u'_mandos._tcp'.
117
121
See <http://www.dns-sd.org/ServiceTypes.html>
118
122
port: integer; what port to announce
119
123
TXT: list of strings; TXT record for the service
122
126
max_renames: integer; maximum number of renames
123
127
rename_count: integer; counter so we only rename after collisions
124
128
a sensible number of times
129
group: D-Bus Entry Group
130
server: D-Bus Server
131
bus: dbus.SystemBus()
125
132
"""
126
133
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
127
134
servicetype = None, port = None, TXT = None,
128
domain = "", host = "", max_renames = 32768,
129
protocol = avahi.PROTO_UNSPEC):
135
domain = u"", host = u"", max_renames = 32768,
136
protocol = avahi.PROTO_UNSPEC, bus = None):
130
137
self.interface = interface
131
138
self.name = name
132
139
self.type = servicetype
137
144
self.rename_count = 0
138
145
self.max_renames = max_renames
139
146
self.protocol = protocol
147
self.group = None # our entry group
148
self.server = None
149
self.bus = bus
140
150
def rename(self):
141
151
"""Derived from the Avahi example code"""
142
152
if self.rename_count >= self.max_renames:
144
154
u" after %i retries, exiting.",
145
155
self.rename_count)
146
156
raise AvahiServiceError(u"Too many renames")
147
self.name = server.GetAlternativeServiceName(self.name)
157
self.name = self.server.GetAlternativeServiceName(self.name)
148
158
logger.info(u"Changing Zeroconf service name to %r ...",
149
str(self.name))
159
unicode(self.name))
150
160
syslogger.setFormatter(logging.Formatter
151
('Mandos (%s) [%%(process)d]:'
152
' %%(levelname)s: %%(message)s'
161
(u'Mandos (%s) [%%(process)d]:'
162
u' %%(levelname)s: %%(message)s'
153
163
% self.name))
154
164
self.remove()
155
165
self.add()
156
166
self.rename_count += 1
157
167
def remove(self):
158
168
"""Derived from the Avahi example code"""
159
if group is not None:
160
group.Reset()
169
if self.group is not None:
170
self.group.Reset()
161
171
def add(self):
162
172
"""Derived from the Avahi example code"""
163
global group
164
if group is None:
165
group = dbus.Interface(bus.get_object
166
(avahi.DBUS_NAME,
167
server.EntryGroupNew()),
168
avahi.DBUS_INTERFACE_ENTRY_GROUP)
169
group.connect_to_signal('StateChanged',
170
entry_group_state_changed)
173
if self.group is None:
174
self.group = dbus.Interface(
175
self.bus.get_object(avahi.DBUS_NAME,
176
self.server.EntryGroupNew()),
177
avahi.DBUS_INTERFACE_ENTRY_GROUP)
178
self.group.connect_to_signal('StateChanged',
179
self
180
.entry_group_state_changed)
171
181
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
172
service.name, service.type)
173
group.AddService(
174
self.interface, # interface
175
self.protocol, # protocol
176
dbus.UInt32(0), # flags
177
self.name, self.type,
178
self.domain, self.host,
179
dbus.UInt16(self.port),
180
avahi.string_array_to_txt_array(self.TXT))
181
group.Commit()
182
183
# From the Avahi example code:
184
group = None # our entry group
185
# End of Avahi example code
186
187
188
def _datetime_to_dbus(dt, variant_level=0):
189
"""Convert a UTC datetime.datetime() to a D-Bus type."""
190
return dbus.String(dt.isoformat(), variant_level=variant_level)
182
self.name, self.type)
183
self.group.AddService(
184
self.interface,
185
self.protocol,
186
dbus.UInt32(0), # flags
187
self.name, self.type,
188
self.domain, self.host,
189
dbus.UInt16(self.port),
190
avahi.string_array_to_txt_array(self.TXT))
191
self.group.Commit()
192
def entry_group_state_changed(self, state, error):
193
"""Derived from the Avahi example code"""
194
logger.debug(u"Avahi state change: %i", state)
195
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
197
logger.debug(u"Zeroconf service established.")
198
elif state == avahi.ENTRY_GROUP_COLLISION:
199
logger.warning(u"Zeroconf service name collision.")
200
self.rename()
201
elif state == avahi.ENTRY_GROUP_FAILURE:
202
logger.critical(u"Avahi: Error in group state changed %s",
203
unicode(error))
204
raise AvahiGroupError(u"State changed: %s"
205
% unicode(error))
206
def cleanup(self):
207
"""Derived from the Avahi example code"""
208
if self.group is not None:
209
self.group.Free()
210
self.group = None
211
def server_state_changed(self, state):
212
"""Derived from the Avahi example code"""
213
if state == avahi.SERVER_COLLISION:
214
logger.error(u"Zeroconf server name collision")
215
self.remove()
216
elif state == avahi.SERVER_RUNNING:
217
self.add()
218
def activate(self):
219
"""Derived from the Avahi example code"""
220
if self.server is None:
221
self.server = dbus.Interface(
222
self.bus.get_object(avahi.DBUS_NAME,
223
avahi.DBUS_PATH_SERVER),
224
avahi.DBUS_INTERFACE_SERVER)
225
self.server.connect_to_signal(u"StateChanged",
226
self.server_state_changed)
227
self.server_state_changed(self.server.GetState())
191
228
192
229
193
230
class Client(object):
212
249
to see if the client lives.
213
250
'None' if no process is running.
214
251
checker_initiator_tag: a gobject event source tag, or None
215
disable_initiator_tag: - '' -
252
disable_initiator_tag: - '' -
216
253
checker_callback_tag: - '' -
217
254
checker_command: string; External command which is run to check if
218
255
client lives. %() expansions are done at
220
257
instance %(name)s can be used in the command.
221
258
current_checker_command: string; current running checker_command
222
259
"""
260
261
@staticmethod
262
def _timedelta_to_milliseconds(td):
263
"Convert a datetime.timedelta() to milliseconds"
264
return ((td.days * 24 * 60 * 60 * 1000)
265
+ (td.seconds * 1000)
266
+ (td.microseconds // 1000))
267
223
268
def timeout_milliseconds(self):
224
269
"Return the 'timeout' attribute in milliseconds"
225
return ((self.timeout.days * 24 * 60 * 60 * 1000)
226
+ (self.timeout.seconds * 1000)
227
+ (self.timeout.microseconds // 1000))
270
return self._timedelta_to_milliseconds(self.timeout)
228
271
229
272
def interval_milliseconds(self):
230
273
"Return the 'interval' attribute in milliseconds"
231
return ((self.interval.days * 24 * 60 * 60 * 1000)
232
+ (self.interval.seconds * 1000)
233
+ (self.interval.microseconds // 1000))
274
return self._timedelta_to_milliseconds(self.interval)
234
275
235
276
def __init__(self, name = None, disable_hook=None, config=None):
236
277
"""Note: the 'checker' key in 'config' sets the
243
284
# Uppercase and remove spaces from fingerprint for later
244
285
# comparison purposes with return value from the fingerprint()
245
286
# function
246
self.fingerprint = (config["fingerprint"].upper()
287
self.fingerprint = (config[u"fingerprint"].upper()
247
288
.replace(u" ", u""))
248
289
logger.debug(u" Fingerprint: %s", self.fingerprint)
249
if "secret" in config:
250
self.secret = config["secret"].decode(u"base64")
251
elif "secfile" in config:
290
if u"secret" in config:
291
self.secret = config[u"secret"].decode(u"base64")
292
elif u"secfile" in config:
252
293
with closing(open(os.path.expanduser
253
294
(os.path.expandvars
254
(config["secfile"])))) as secfile:
295
(config[u"secfile"])),
296
"rb")) as secfile:
255
297
self.secret = secfile.read()
256
298
else:
257
299
raise TypeError(u"No secret or secfile for client %s"
258
300
% self.name)
259
self.host = config.get("host", "")
301
self.host = config.get(u"host", u"")
260
302
self.created = datetime.datetime.utcnow()
261
303
self.enabled = False
262
304
self.last_enabled = None
263
305
self.last_checked_ok = None
264
self.timeout = string_to_delta(config["timeout"])
265
self.interval = string_to_delta(config["interval"])
306
self.timeout = string_to_delta(config[u"timeout"])
307
self.interval = string_to_delta(config[u"interval"])
266
308
self.disable_hook = disable_hook
267
309
self.checker = None
268
310
self.checker_initiator_tag = None
269
311
self.disable_initiator_tag = None
270
312
self.checker_callback_tag = None
271
self.checker_command = config["checker"]
313
self.checker_command = config[u"checker"]
272
314
self.current_checker_command = None
273
315
self.last_connect = None
274
316
275
317
def enable(self):
276
318
"""Start this client's checker and timeout hooks"""
319
if getattr(self, u"enabled", False):
320
# Already enabled
321
return
277
322
self.last_enabled = datetime.datetime.utcnow()
278
323
# Schedule a new checker to be started an 'interval' from now,
279
324
# and every interval from then on.
280
325
self.checker_initiator_tag = (gobject.timeout_add
281
326
(self.interval_milliseconds(),
282
327
self.start_checker))
283
# Also start a new checker *right now*.
284
self.start_checker()
285
328
# Schedule a disable() when 'timeout' has passed
286
329
self.disable_initiator_tag = (gobject.timeout_add
287
330
(self.timeout_milliseconds(),
288
331
self.disable))
289
332
self.enabled = True
333
# Also start a new checker *right now*.
334
self.start_checker()
290
335
291
def disable(self):
336
def disable(self, quiet=True):
292
337
"""Disable this client."""
293
338
if not getattr(self, "enabled", False):
294
339
return False
295
logger.info(u"Disabling client %s", self.name)
296
if getattr(self, "disable_initiator_tag", False):
340
if not quiet:
341
logger.info(u"Disabling client %s", self.name)
342
if getattr(self, u"disable_initiator_tag", False):
297
343
gobject.source_remove(self.disable_initiator_tag)
298
344
self.disable_initiator_tag = None
299
if getattr(self, "checker_initiator_tag", False):
345
if getattr(self, u"checker_initiator_tag", False):
300
346
gobject.source_remove(self.checker_initiator_tag)
301
347
self.checker_initiator_tag = None
302
348
self.stop_checker()
354
400
# is as it should be.
355
401
356
402
# If a checker exists, make sure it is not a zombie
357
if self.checker is not None:
403
try:
358
404
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
405
except (AttributeError, OSError), error:
406
if (isinstance(error, OSError)
407
and error.errno != errno.ECHILD):
408
raise error
409
else:
359
410
if pid:
360
logger.warning("Checker was a zombie")
411
logger.warning(u"Checker was a zombie")
361
412
gobject.source_remove(self.checker_callback_tag)
362
413
self.checker_callback(pid, status,
363
414
self.current_checker_command)
368
419
command = self.checker_command % self.host
369
420
except TypeError:
370
421
# Escape attributes for the shell
371
escaped_attrs = dict((key, re.escape(str(val)))
422
escaped_attrs = dict((key,
423
re.escape(unicode(str(val),
424
errors=
425
u'replace')))
372
426
for key, val in
373
427
vars(self).iteritems())
374
428
try:
387
441
# always replaced by /dev/null.)
388
442
self.checker = subprocess.Popen(command,
389
443
close_fds=True,
390
shell=True, cwd="/")
444
shell=True, cwd=u"/")
391
445
self.checker_callback_tag = (gobject.child_watch_add
392
446
(self.checker.pid,
393
447
self.checker_callback,
409
463
if self.checker_callback_tag:
410
464
gobject.source_remove(self.checker_callback_tag)
411
465
self.checker_callback_tag = None
412
if getattr(self, "checker", None) is None:
466
if getattr(self, u"checker", None) is None:
413
467
return
414
468
logger.debug(u"Stopping checker for %(name)s", vars(self))
415
469
try:
416
470
os.kill(self.checker.pid, signal.SIGTERM)
417
#os.sleep(0.5)
471
#time.sleep(0.5)
418
472
#if self.checker.poll() is None:
419
473
# os.kill(self.checker.pid, signal.SIGKILL)
420
474
except OSError, error:
424
478
425
479
def still_valid(self):
426
480
"""Has the timeout not yet passed for this client?"""
427
if not getattr(self, "enabled", False):
481
if not getattr(self, u"enabled", False):
428
482
return False
429
483
now = datetime.datetime.utcnow()
430
484
if self.last_checked_ok is None:
433
487
return now < (self.last_checked_ok + self.timeout)
434
488
435
489
436
class ClientDBus(Client, dbus.service.Object):
490
def dbus_service_property(dbus_interface, signature=u"v",
491
access=u"readwrite", byte_arrays=False):
492
"""Decorators for marking methods of a DBusObjectWithProperties to
493
become properties on the D-Bus.
494
495
The decorated method will be called with no arguments by "Get"
496
and with one argument by "Set".
497
498
The parameters, where they are supported, are the same as
499
dbus.service.method, except there is only "signature", since the
500
type from Get() and the type sent to Set() is the same.
501
"""
502
def decorator(func):
503
func._dbus_is_property = True
504
func._dbus_interface = dbus_interface
505
func._dbus_signature = signature
506
func._dbus_access = access
507
func._dbus_name = func.__name__
508
if func._dbus_name.endswith(u"_dbus_property"):
509
func._dbus_name = func._dbus_name[:-14]
510
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
511
return func
512
return decorator
513
514
515
class DBusPropertyException(dbus.exceptions.DBusException):
516
"""A base class for D-Bus property-related exceptions
517
"""
518
def __unicode__(self):
519
return unicode(str(self))
520
521
522
class DBusPropertyAccessException(DBusPropertyException):
523
"""A property's access permissions disallows an operation.
524
"""
525
pass
526
527
528
class DBusPropertyNotFound(DBusPropertyException):
529
"""An attempt was made to access a non-existing property.
530
"""
531
pass
532
533
534
class DBusObjectWithProperties(dbus.service.Object):
535
"""A D-Bus object with properties.
536
537
Classes inheriting from this can use the dbus_service_property
538
decorator to expose methods as D-Bus properties. It exposes the
539
standard Get(), Set(), and GetAll() methods on the D-Bus.
540
"""
541
542
@staticmethod
543
def _is_dbus_property(obj):
544
return getattr(obj, u"_dbus_is_property", False)
545
546
def _get_all_dbus_properties(self):
547
"""Returns a generator of (name, attribute) pairs
548
"""
549
return ((prop._dbus_name, prop)
550
for name, prop in
551
inspect.getmembers(self, self._is_dbus_property))
552
553
def _get_dbus_property(self, interface_name, property_name):
554
"""Returns a bound method if one exists which is a D-Bus
555
property with the specified name and interface.
556
"""
557
for name in (property_name,
558
property_name + u"_dbus_property"):
559
prop = getattr(self, name, None)
560
if (prop is None
561
or not self._is_dbus_property(prop)
562
or prop._dbus_name != property_name
563
or (interface_name and prop._dbus_interface
564
and interface_name != prop._dbus_interface)):
565
continue
566
return prop
567
# No such property
568
raise DBusPropertyNotFound(self.dbus_object_path + u":"
569
+ interface_name + u"."
570
+ property_name)
571
572
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
573
out_signature=u"v")
574
def Get(self, interface_name, property_name):
575
"""Standard D-Bus property Get() method, see D-Bus standard.
576
"""
577
prop = self._get_dbus_property(interface_name, property_name)
578
if prop._dbus_access == u"write":
579
raise DBusPropertyAccessException(property_name)
580
value = prop()
581
if not hasattr(value, u"variant_level"):
582
return value
583
return type(value)(value, variant_level=value.variant_level+1)
584
585
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
586
def Set(self, interface_name, property_name, value):
587
"""Standard D-Bus property Set() method, see D-Bus standard.
588
"""
589
prop = self._get_dbus_property(interface_name, property_name)
590
if prop._dbus_access == u"read":
591
raise DBusPropertyAccessException(property_name)
592
if prop._dbus_get_args_options[u"byte_arrays"]:
593
value = dbus.ByteArray(''.join(unichr(byte)
594
for byte in value))
595
prop(value)
596
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
598
out_signature=u"a{sv}")
599
def GetAll(self, interface_name):
600
"""Standard D-Bus property GetAll() method, see D-Bus
601
standard.
602
603
Note: Will not include properties with access="write".
604
"""
605
all = {}
606
for name, prop in self._get_all_dbus_properties():
607
if (interface_name
608
and interface_name != prop._dbus_interface):
609
# Interface non-empty but did not match
610
continue
611
# Ignore write-only properties
612
if prop._dbus_access == u"write":
613
continue
614
value = prop()
615
if not hasattr(value, u"variant_level"):
616
all[name] = value
617
continue
618
all[name] = type(value)(value, variant_level=
619
value.variant_level+1)
620
return dbus.Dictionary(all, signature=u"sv")
621
622
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
623
out_signature=u"s",
624
path_keyword='object_path',
625
connection_keyword='connection')
626
def Introspect(self, object_path, connection):
627
"""Standard D-Bus method, overloaded to insert property tags.
628
"""
629
xmlstring = dbus.service.Object.Introspect(self, object_path,
630
connection)
631
try:
632
document = xml.dom.minidom.parseString(xmlstring)
633
def make_tag(document, name, prop):
634
e = document.createElement(u"property")
635
e.setAttribute(u"name", name)
636
e.setAttribute(u"type", prop._dbus_signature)
637
e.setAttribute(u"access", prop._dbus_access)
638
return e
639
for if_tag in document.getElementsByTagName(u"interface"):
640
for tag in (make_tag(document, name, prop)
641
for name, prop
642
in self._get_all_dbus_properties()
643
if prop._dbus_interface
644
== if_tag.getAttribute(u"name")):
645
if_tag.appendChild(tag)
646
# Add the names to the return values for the
647
# "org.freedesktop.DBus.Properties" methods
648
if (if_tag.getAttribute(u"name")
649
== u"org.freedesktop.DBus.Properties"):
650
for cn in if_tag.getElementsByTagName(u"method"):
651
if cn.getAttribute(u"name") == u"Get":
652
for arg in cn.getElementsByTagName(u"arg"):
653
if (arg.getAttribute(u"direction")
654
== u"out"):
655
arg.setAttribute(u"name", u"value")
656
elif cn.getAttribute(u"name") == u"GetAll":
657
for arg in cn.getElementsByTagName(u"arg"):
658
if (arg.getAttribute(u"direction")
659
== u"out"):
660
arg.setAttribute(u"name", u"props")
661
xmlstring = document.toxml(u"utf-8")
662
document.unlink()
663
except (AttributeError, xml.dom.DOMException,
664
xml.parsers.expat.ExpatError), error:
665
logger.error(u"Failed to override Introspection method",
666
error)
667
return xmlstring
668
669
670
class ClientDBus(Client, DBusObjectWithProperties):
437
671
"""A Client class using D-Bus
438
672
439
673
Attributes:
440
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
674
dbus_object_path: dbus.ObjectPath
675
bus: dbus.SystemBus()
441
676
"""
442
677
# dbus.service.Object doesn't use super(), so we can't either.
443
678
444
def __init__(self, *args, **kwargs):
679
def __init__(self, bus = None, *args, **kwargs):
680
self.bus = bus
445
681
Client.__init__(self, *args, **kwargs)
446
682
# Only now, when this client is initialized, can it show up on
447
683
# the D-Bus
448
684
self.dbus_object_path = (dbus.ObjectPath
449
("/clients/"
450
+ self.name.replace(".", "_")))
451
dbus.service.Object.__init__(self, bus,
452
self.dbus_object_path)
685
(u"/clients/"
686
+ self.name.replace(u".", u"_")))
687
DBusObjectWithProperties.__init__(self, self.bus,
688
self.dbus_object_path)
689
690
@staticmethod
691
def _datetime_to_dbus(dt, variant_level=0):
692
"""Convert a UTC datetime.datetime() to a D-Bus type."""
693
return dbus.String(dt.isoformat(),
694
variant_level=variant_level)
695
453
696
def enable(self):
454
oldstate = getattr(self, "enabled", False)
697
oldstate = getattr(self, u"enabled", False)
455
698
r = Client.enable(self)
456
699
if oldstate != self.enabled:
457
700
# Emit D-Bus signals
458
701
self.PropertyChanged(dbus.String(u"enabled"),
459
702
dbus.Boolean(True, variant_level=1))
460
self.PropertyChanged(dbus.String(u"last_enabled"),
461
(_datetime_to_dbus(self.last_enabled,
462
variant_level=1)))
703
self.PropertyChanged(
704
dbus.String(u"last_enabled"),
705
self._datetime_to_dbus(self.last_enabled,
706
variant_level=1))
463
707
return r
464
708
465
def disable(self, signal = True):
466
oldstate = getattr(self, "enabled", False)
467
r = Client.disable(self)
468
if signal and oldstate != self.enabled:
709
def disable(self, quiet = False):
710
oldstate = getattr(self, u"enabled", False)
711
r = Client.disable(self, quiet=quiet)
712
if not quiet and oldstate != self.enabled:
469
713
# Emit D-Bus signal
470
714
self.PropertyChanged(dbus.String(u"enabled"),
471
715
dbus.Boolean(False, variant_level=1))
476
720
self.remove_from_connection()
477
721
except LookupError:
478
722
pass
479
if hasattr(dbus.service.Object, "__del__"):
480
dbus.service.Object.__del__(self, *args, **kwargs)
723
if hasattr(DBusObjectWithProperties, u"__del__"):
724
DBusObjectWithProperties.__del__(self, *args, **kwargs)
481
725
Client.__del__(self, *args, **kwargs)
482
726
483
727
def checker_callback(self, pid, condition, command,
507
751
# Emit D-Bus signal
508
752
self.PropertyChanged(
509
753
dbus.String(u"last_checked_ok"),
510
(_datetime_to_dbus(self.last_checked_ok,
511
variant_level=1)))
754
(self._datetime_to_dbus(self.last_checked_ok,
755
variant_level=1)))
512
756
return r
513
757
514
758
def start_checker(self, *args, **kwargs):
524
768
# Emit D-Bus signal
525
769
self.CheckerStarted(self.current_checker_command)
526
770
self.PropertyChanged(
527
dbus.String("checker_running"),
771
dbus.String(u"checker_running"),
528
772
dbus.Boolean(True, variant_level=1))
529
773
return r
530
774
531
775
def stop_checker(self, *args, **kwargs):
532
old_checker = getattr(self, "checker", None)
776
old_checker = getattr(self, u"checker", None)
533
777
r = Client.stop_checker(self, *args, **kwargs)
534
778
if (old_checker is not None
535
and getattr(self, "checker", None) is None):
779
and getattr(self, u"checker", None) is None):
536
780
self.PropertyChanged(dbus.String(u"checker_running"),
537
781
dbus.Boolean(False, variant_level=1))
538
782
return r
541
785
_interface = u"se.bsnet.fukt.Mandos.Client"
542
786
543
787
# CheckedOK - method
544
CheckedOK = dbus.service.method(_interface)(checked_ok)
545
CheckedOK.__name__ = "CheckedOK"
788
@dbus.service.method(_interface)
789
def CheckedOK(self):
790
return self.checked_ok()
546
791
547
792
# CheckerCompleted - signal
548
@dbus.service.signal(_interface, signature="nxs")
793
@dbus.service.signal(_interface, signature=u"nxs")
549
794
def CheckerCompleted(self, exitcode, waitstatus, command):
550
795
"D-Bus signal"
551
796
pass
552
797
553
798
# CheckerStarted - signal
554
@dbus.service.signal(_interface, signature="s")
799
@dbus.service.signal(_interface, signature=u"s")
555
800
def CheckerStarted(self, command):
556
801
"D-Bus signal"
557
802
pass
558
803
559
# GetAllProperties - method
560
@dbus.service.method(_interface, out_signature="a{sv}")
561
def GetAllProperties(self):
562
"D-Bus method"
563
return dbus.Dictionary({
564
dbus.String("name"):
565
dbus.String(self.name, variant_level=1),
566
dbus.String("fingerprint"):
567
dbus.String(self.fingerprint, variant_level=1),
568
dbus.String("host"):
569
dbus.String(self.host, variant_level=1),
570
dbus.String("created"):
571
_datetime_to_dbus(self.created, variant_level=1),
572
dbus.String("last_enabled"):
573
(_datetime_to_dbus(self.last_enabled,
574
variant_level=1)
575
if self.last_enabled is not None
576
else dbus.Boolean(False, variant_level=1)),
577
dbus.String("enabled"):
578
dbus.Boolean(self.enabled, variant_level=1),
579
dbus.String("last_checked_ok"):
580
(_datetime_to_dbus(self.last_checked_ok,
581
variant_level=1)
582
if self.last_checked_ok is not None
583
else dbus.Boolean (False, variant_level=1)),
584
dbus.String("timeout"):
585
dbus.UInt64(self.timeout_milliseconds(),
586
variant_level=1),
587
dbus.String("interval"):
588
dbus.UInt64(self.interval_milliseconds(),
589
variant_level=1),
590
dbus.String("checker"):
591
dbus.String(self.checker_command,
592
variant_level=1),
593
dbus.String("checker_running"):
594
dbus.Boolean(self.checker is not None,
595
variant_level=1),
596
dbus.String("object_path"):
597
dbus.ObjectPath(self.dbus_object_path,
598
variant_level=1)
599
}, signature="sv")
600
601
# IsStillValid - method
602
@dbus.service.method(_interface, out_signature="b")
603
def IsStillValid(self):
604
return self.still_valid()
605
606
804
# PropertyChanged - signal
607
@dbus.service.signal(_interface, signature="sv")
805
@dbus.service.signal(_interface, signature=u"sv")
608
806
def PropertyChanged(self, property, value):
609
807
"D-Bus signal"
610
808
pass
611
809
612
# ReceivedSecret - signal
810
# GotSecret - signal
613
811
@dbus.service.signal(_interface)
614
def ReceivedSecret(self):
812
def GotSecret(self):
615
813
"D-Bus signal"
616
814
pass
617
815
621
819
"D-Bus signal"
622
820
pass
623
821
624
# SetChecker - method
625
@dbus.service.method(_interface, in_signature="s")
626
def SetChecker(self, checker):
627
"D-Bus setter method"
628
self.checker_command = checker
629
# Emit D-Bus signal
630
self.PropertyChanged(dbus.String(u"checker"),
631
dbus.String(self.checker_command,
632
variant_level=1))
633
634
# SetHost - method
635
@dbus.service.method(_interface, in_signature="s")
636
def SetHost(self, host):
637
"D-Bus setter method"
638
self.host = host
639
# Emit D-Bus signal
640
self.PropertyChanged(dbus.String(u"host"),
641
dbus.String(self.host, variant_level=1))
642
643
# SetInterval - method
644
@dbus.service.method(_interface, in_signature="t")
645
def SetInterval(self, milliseconds):
646
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
647
# Emit D-Bus signal
648
self.PropertyChanged(dbus.String(u"interval"),
649
(dbus.UInt64(self.interval_milliseconds(),
650
variant_level=1)))
651
652
# SetSecret - method
653
@dbus.service.method(_interface, in_signature="ay",
654
byte_arrays=True)
655
def SetSecret(self, secret):
656
"D-Bus setter method"
657
self.secret = str(secret)
658
659
# SetTimeout - method
660
@dbus.service.method(_interface, in_signature="t")
661
def SetTimeout(self, milliseconds):
662
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
663
# Emit D-Bus signal
664
self.PropertyChanged(dbus.String(u"timeout"),
665
(dbus.UInt64(self.timeout_milliseconds(),
666
variant_level=1)))
667
668
822
# Enable - method
669
Enable = dbus.service.method(_interface)(enable)
670
Enable.__name__ = "Enable"
823
@dbus.service.method(_interface)
824
def Enable(self):
825
"D-Bus method"
826
self.enable()
671
827
672
828
# StartChecker - method
673
829
@dbus.service.method(_interface)
682
838
self.disable()
683
839
684
840
# StopChecker - method
685
StopChecker = dbus.service.method(_interface)(stop_checker)
686
StopChecker.__name__ = "StopChecker"
841
@dbus.service.method(_interface)
842
def StopChecker(self):
843
self.stop_checker()
844
845
# name - property
846
@dbus_service_property(_interface, signature=u"s", access=u"read")
847
def name_dbus_property(self):
848
return dbus.String(self.name)
849
850
# fingerprint - property
851
@dbus_service_property(_interface, signature=u"s", access=u"read")
852
def fingerprint_dbus_property(self):
853
return dbus.String(self.fingerprint)
854
855
# host - property
856
@dbus_service_property(_interface, signature=u"s",
857
access=u"readwrite")
858
def host_dbus_property(self, value=None):
859
if value is None: # get
860
return dbus.String(self.host)
861
self.host = value
862
# Emit D-Bus signal
863
self.PropertyChanged(dbus.String(u"host"),
864
dbus.String(value, variant_level=1))
865
866
# created - property
867
@dbus_service_property(_interface, signature=u"s", access=u"read")
868
def created_dbus_property(self):
869
return dbus.String(self._datetime_to_dbus(self.created))
870
871
# last_enabled - property
872
@dbus_service_property(_interface, signature=u"s", access=u"read")
873
def last_enabled_dbus_property(self):
874
if self.last_enabled is None:
875
return dbus.String(u"")
876
return dbus.String(self._datetime_to_dbus(self.last_enabled))
877
878
# enabled - property
879
@dbus_service_property(_interface, signature=u"b",
880
access=u"readwrite")
881
def enabled_dbus_property(self, value=None):
882
if value is None: # get
883
return dbus.Boolean(self.enabled)
884
if value:
885
self.enable()
886
else:
887
self.disable()
888
889
# last_checked_ok - property
890
@dbus_service_property(_interface, signature=u"s",
891
access=u"readwrite")
892
def last_checked_ok_dbus_property(self, value=None):
893
if value is not None:
894
self.checked_ok()
895
return
896
if self.last_checked_ok is None:
897
return dbus.String(u"")
898
return dbus.String(self._datetime_to_dbus(self
899
.last_checked_ok))
900
901
# timeout - property
902
@dbus_service_property(_interface, signature=u"t",
903
access=u"readwrite")
904
def timeout_dbus_property(self, value=None):
905
if value is None: # get
906
return dbus.UInt64(self.timeout_milliseconds())
907
self.timeout = datetime.timedelta(0, 0, 0, value)
908
# Emit D-Bus signal
909
self.PropertyChanged(dbus.String(u"timeout"),
910
dbus.UInt64(value, variant_level=1))
911
if getattr(self, u"disable_initiator_tag", None) is None:
912
return
913
# Reschedule timeout
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = None
916
time_to_die = (self.
917
_timedelta_to_milliseconds((self
918
.last_checked_ok
919
+ self.timeout)
920
- datetime.datetime
921
.utcnow()))
922
if time_to_die <= 0:
923
# The timeout has passed
924
self.disable()
925
else:
926
self.disable_initiator_tag = (gobject.timeout_add
927
(time_to_die, self.disable))
928
929
# interval - property
930
@dbus_service_property(_interface, signature=u"t",
931
access=u"readwrite")
932
def interval_dbus_property(self, value=None):
933
if value is None: # get
934
return dbus.UInt64(self.interval_milliseconds())
935
self.interval = datetime.timedelta(0, 0, 0, value)
936
# Emit D-Bus signal
937
self.PropertyChanged(dbus.String(u"interval"),
938
dbus.UInt64(value, variant_level=1))
939
if getattr(self, u"checker_initiator_tag", None) is None:
940
return
941
# Reschedule checker run
942
gobject.source_remove(self.checker_initiator_tag)
943
self.checker_initiator_tag = (gobject.timeout_add
944
(value, self.start_checker))
945
self.start_checker() # Start one now, too
946
947
# checker - property
948
@dbus_service_property(_interface, signature=u"s",
949
access=u"readwrite")
950
def checker_dbus_property(self, value=None):
951
if value is None: # get
952
return dbus.String(self.checker_command)
953
self.checker_command = value
954
# Emit D-Bus signal
955
self.PropertyChanged(dbus.String(u"checker"),
956
dbus.String(self.checker_command,
957
variant_level=1))
958
959
# checker_running - property
960
@dbus_service_property(_interface, signature=u"b",
961
access=u"readwrite")
962
def checker_running_dbus_property(self, value=None):
963
if value is None: # get
964
return dbus.Boolean(self.checker is not None)
965
if value:
966
self.start_checker()
967
else:
968
self.stop_checker()
969
970
# object_path - property
971
@dbus_service_property(_interface, signature=u"o", access=u"read")
972
def object_path_dbus_property(self):
973
return self.dbus_object_path # is already a dbus.ObjectPath
974
975
# secret = property
976
@dbus_service_property(_interface, signature=u"ay",
977
access=u"write", byte_arrays=True)
978
def secret_dbus_property(self, value):
979
self.secret = str(value)
687
980
688
981
del _interface
689
982
690
983
691
class ClientHandler(SocketServer.BaseRequestHandler, object):
984
class ClientHandler(socketserver.BaseRequestHandler, object):
692
985
"""A class to handle client connections.
693
986
694
987
Instantiated once for each connection to handle it.
699
992
unicode(self.client_address))
700
993
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
701
994
# Open IPC pipe to parent process
702
with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
995
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
703
996
session = (gnutls.connection
704
997
.ClientSession(self.request,
705
998
gnutls.connection
719
1012
# no X.509 keys are added to it. Therefore, we can use it
720
1013
# here despite using OpenPGP certificates.
721
1014
722
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
723
# "+AES-256-CBC", "+SHA1",
724
# "+COMP-NULL", "+CTYPE-OPENPGP",
725
# "+DHE-DSS"))
1015
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1016
# u"+AES-256-CBC", u"+SHA1",
1017
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1018
# u"+DHE-DSS"))
726
1019
# Use a fallback default, since this MUST be set.
727
1020
priority = self.server.gnutls_priority
728
1021
if priority is None:
729
priority = "NORMAL"
1022
priority = u"NORMAL"
730
1023
(gnutls.library.functions
731
1024
.gnutls_priority_set_direct(session._c_object,
732
1025
priority, None))
752
1045
client = c
753
1046
break
754
1047
else:
755
ipc.write("NOTFOUND %s\n" % fpr)
1048
ipc.write(u"NOTFOUND %s %s\n"
1049
% (fpr, unicode(self.client_address)))
756
1050
session.bye()
757
1051
return
758
1052
# Have to check if client.still_valid(), since it is
759
1053
# possible that the client timed out while establishing
760
1054
# the GnuTLS session.
761
1055
if not client.still_valid():
762
ipc.write("INVALID %s\n" % client.name)
1056
ipc.write(u"INVALID %s\n" % client.name)
763
1057
session.bye()
764
1058
return
765
ipc.write("SENDING %s\n" % client.name)
1059
ipc.write(u"SENDING %s\n" % client.name)
766
1060
sent_size = 0
767
1061
while sent_size < len(client.secret):
768
1062
sent = session.send(client.secret[sent_size:])
786
1080
.gnutls_certificate_get_peers
787
1081
(session._c_object, ctypes.byref(list_size)))
788
1082
if not bool(cert_list) and list_size.value != 0:
789
raise gnutls.errors.GNUTLSError("error getting peer"
790
" certificate")
1083
raise gnutls.errors.GNUTLSError(u"error getting peer"
1084
u" certificate")
791
1085
if list_size.value == 0:
792
1086
return None
793
1087
cert = cert_list[0]
819
1113
if crtverify.value != 0:
820
1114
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
821
1115
raise (gnutls.errors.CertificateSecurityError
822
("Verify failed"))
1116
(u"Verify failed"))
823
1117
# New buffer for the fingerprint
824
1118
buf = ctypes.create_string_buffer(20)
825
1119
buf_len = ctypes.c_size_t()
836
1130
return hex_fpr
837
1131
838
1132
839
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
840
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
841
842
Assumes a gobject.MainLoop event loop.
843
"""
1133
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1134
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
844
1135
def process_request(self, request, client_address):
845
1136
"""Overrides and wraps the original process_request().
846
1137
847
This function creates a new pipe in self.pipe
1138
This function creates a new pipe in self.pipe
848
1139
"""
849
1140
self.pipe = os.pipe()
850
1141
super(ForkingMixInWithPipe,
851
1142
self).process_request(request, client_address)
852
1143
os.close(self.pipe[1]) # close write end
853
# Call "handle_ipc" for both data and EOF events
854
gobject.io_add_watch(self.pipe[0],
855
gobject.IO_IN | gobject.IO_HUP,
856
self.handle_ipc)
857
def handle_ipc(source, condition):
1144
self.add_pipe(self.pipe[0])
1145
def add_pipe(self, pipe):
858
1146
"""Dummy function; override as necessary"""
859
os.close(source)
860
return False
1147
os.close(pipe)
861
1148
862
1149
863
1150
class IPv6_TCPServer(ForkingMixInWithPipe,
864
SocketServer.TCPServer, object):
1151
socketserver.TCPServer, object):
865
1152
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
866
1153
867
1154
Attributes:
868
1155
enabled: Boolean; whether this server is activated yet
869
1156
interface: None or a network interface name (string)
870
1157
use_ipv6: Boolean; to use IPv6 or not
871
----
872
clients: Set() of Client objects
873
gnutls_priority GnuTLS priority string
874
use_dbus: Boolean; to emit D-Bus signals or not
875
1158
"""
876
1159
def __init__(self, server_address, RequestHandlerClass,
877
interface=None, use_ipv6=True, clients=None,
878
gnutls_priority=None, use_dbus=True):
879
self.enabled = False
1160
interface=None, use_ipv6=True):
880
1161
self.interface = interface
881
1162
if use_ipv6:
882
1163
self.address_family = socket.AF_INET6
883
self.clients = clients
884
self.use_dbus = use_dbus
885
self.gnutls_priority = gnutls_priority
886
SocketServer.TCPServer.__init__(self, server_address,
1164
socketserver.TCPServer.__init__(self, server_address,
887
1165
RequestHandlerClass)
888
1166
def server_bind(self):
889
1167
"""This overrides the normal server_bind() function
890
1168
to bind to an interface if one was specified, and also NOT to
891
1169
bind to an address or port if they were not specified."""
892
1170
if self.interface is not None:
893
try:
894
self.socket.setsockopt(socket.SOL_SOCKET,
895
SO_BINDTODEVICE,
896
self.interface + '\0')
897
except socket.error, error:
898
if error[0] == errno.EPERM:
899
logger.error(u"No permission to"
900
u" bind to interface %s",
901
self.interface)
902
else:
903
raise
1171
if SO_BINDTODEVICE is None:
1172
logger.error(u"SO_BINDTODEVICE does not exist;"
1173
u" cannot bind to interface %s",
1174
self.interface)
1175
else:
1176
try:
1177
self.socket.setsockopt(socket.SOL_SOCKET,
1178
SO_BINDTODEVICE,
1179
str(self.interface
1180
+ u'\0'))
1181
except socket.error, error:
1182
if error[0] == errno.EPERM:
1183
logger.error(u"No permission to"
1184
u" bind to interface %s",
1185
self.interface)
1186
elif error[0] == errno.ENOPROTOOPT:
1187
logger.error(u"SO_BINDTODEVICE not available;"
1188
u" cannot bind to interface %s",
1189
self.interface)
1190
else:
1191
raise
904
1192
# Only bind(2) the socket if we really need to.
905
1193
if self.server_address[0] or self.server_address[1]:
906
1194
if not self.server_address[0]:
907
1195
if self.address_family == socket.AF_INET6:
908
any_address = "::" # in6addr_any
1196
any_address = u"::" # in6addr_any
909
1197
else:
910
1198
any_address = socket.INADDR_ANY
911
1199
self.server_address = (any_address,
919
1207
# 0, # flowinfo
920
1208
# if_nametoindex
921
1209
# (self.interface))
922
return SocketServer.TCPServer.server_bind(self)
1210
return socketserver.TCPServer.server_bind(self)
1211
1212
1213
class MandosServer(IPv6_TCPServer):
1214
"""Mandos server.
1215
1216
Attributes:
1217
clients: set of Client objects
1218
gnutls_priority GnuTLS priority string
1219
use_dbus: Boolean; to emit D-Bus signals or not
1220
1221
Assumes a gobject.MainLoop event loop.
1222
"""
1223
def __init__(self, server_address, RequestHandlerClass,
1224
interface=None, use_ipv6=True, clients=None,
1225
gnutls_priority=None, use_dbus=True):
1226
self.enabled = False
1227
self.clients = clients
1228
if self.clients is None:
1229
self.clients = set()
1230
self.use_dbus = use_dbus
1231
self.gnutls_priority = gnutls_priority
1232
IPv6_TCPServer.__init__(self, server_address,
1233
RequestHandlerClass,
1234
interface = interface,
1235
use_ipv6 = use_ipv6)
923
1236
def server_activate(self):
924
1237
if self.enabled:
925
return SocketServer.TCPServer.server_activate(self)
1238
return socketserver.TCPServer.server_activate(self)
926
1239
def enable(self):
927
1240
self.enabled = True
1241
def add_pipe(self, pipe):
1242
# Call "handle_ipc" for both data and EOF events
1243
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1244
self.handle_ipc)
928
1245
def handle_ipc(self, source, condition, file_objects={}):
929
1246
condition_names = {
930
gobject.IO_IN: "IN", # There is data to read.
931
gobject.IO_OUT: "OUT", # Data can be written (without
932
# blocking).
933
gobject.IO_PRI: "PRI", # There is urgent data to read.
934
gobject.IO_ERR: "ERR", # Error condition.
935
gobject.IO_HUP: "HUP" # Hung up (the connection has been
936
# broken, usually for pipes and
937
# sockets).
1247
gobject.IO_IN: u"IN", # There is data to read.
1248
gobject.IO_OUT: u"OUT", # Data can be written (without
1249
# blocking).
1250
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1251
gobject.IO_ERR: u"ERR", # Error condition.
1252
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1253
# broken, usually for pipes and
1254
# sockets).
938
1255
}
939
1256
conditions_string = ' | '.join(name
940
1257
for cond, name in
941
1258
condition_names.iteritems()
942
1259
if cond & condition)
943
logger.debug("Handling IPC: FD = %d, condition = %s", source,
1260
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
944
1261
conditions_string)
945
1262
946
1263
# Turn the pipe file descriptor into a Python file object
947
1264
if source not in file_objects:
948
file_objects[source] = os.fdopen(source, "r", 1)
1265
file_objects[source] = os.fdopen(source, u"r", 1)
949
1266
950
1267
# Read a line from the file object
951
1268
cmdline = file_objects[source].readline()
957
1274
# Stop calling this function
958
1275
return False
959
1276
960
logger.debug("IPC command: %r", cmdline)
1277
logger.debug(u"IPC command: %r", cmdline)
961
1278
962
1279
# Parse and act on command
963
cmd, args = cmdline.rstrip("\r\n").split(None, 1)
1280
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
964
1281
965
if cmd == "NOTFOUND":
966
logger.warning(u"Client not found for fingerprint: %s",
967
args)
1282
if cmd == u"NOTFOUND":
1283
fpr, address = args.split(None, 1)
1284
logger.warning(u"Client not found for fingerprint: %s, ad"
1285
u"dress: %s", fpr, address)
968
1286
if self.use_dbus:
969
1287
# Emit D-Bus signal
970
mandos_dbus_service.ClientNotFound(args)
971
elif cmd == "INVALID":
1288
mandos_dbus_service.ClientNotFound(fpr, address)
1289
elif cmd == u"INVALID":
972
1290
for client in self.clients:
973
1291
if client.name == args:
974
1292
logger.warning(u"Client %s is invalid", args)
978
1296
break
979
1297
else:
980
1298
logger.error(u"Unknown client %s is invalid", args)
981
elif cmd == "SENDING":
1299
elif cmd == u"SENDING":
982
1300
for client in self.clients:
983
1301
if client.name == args:
984
1302
logger.info(u"Sending secret to %s", client.name)
985
1303
client.checked_ok()
986
1304
if self.use_dbus:
987
1305
# Emit D-Bus signal
988
client.ReceivedSecret()
1306
client.GotSecret()
989
1307
break
990
1308
else:
991
1309
logger.error(u"Sending secret to unknown client %s",
992
1310
args)
993
1311
else:
994
logger.error("Unknown IPC command: %r", cmdline)
1312
logger.error(u"Unknown IPC command: %r", cmdline)
995
1313
996
1314
# Keep calling this function
997
1315
return True
1000
1318
def string_to_delta(interval):
1001
1319
"""Parse a string and return a datetime.timedelta
1002
1320
1003
>>> string_to_delta('7d')
1321
>>> string_to_delta(u'7d')
1004
1322
datetime.timedelta(7)
1005
>>> string_to_delta('60s')
1323
>>> string_to_delta(u'60s')
1006
1324
datetime.timedelta(0, 60)
1007
>>> string_to_delta('60m')
1325
>>> string_to_delta(u'60m')
1008
1326
datetime.timedelta(0, 3600)
1009
>>> string_to_delta('24h')
1327
>>> string_to_delta(u'24h')
1010
1328
datetime.timedelta(1)
1011
1329
>>> string_to_delta(u'1w')
1012
1330
datetime.timedelta(7)
1013
>>> string_to_delta('5m 30s')
1331
>>> string_to_delta(u'5m 30s')
1014
1332
datetime.timedelta(0, 330)
1015
1333
"""
1016
1334
timevalue = datetime.timedelta(0)
1029
1347
elif suffix == u"w":
1030
1348
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1031
1349
else:
1032
raise ValueError
1033
except (ValueError, IndexError):
1034
raise ValueError
1350
raise ValueError(u"Unknown suffix %r" % suffix)
1351
except (ValueError, IndexError), e:
1352
raise ValueError(e.message)
1035
1353
timevalue += delta
1036
1354
return timevalue
1037
1355
1038
1356
1039
def server_state_changed(state):
1040
"""Derived from the Avahi example code"""
1041
if state == avahi.SERVER_COLLISION:
1042
logger.error(u"Zeroconf server name collision")
1043
service.remove()
1044
elif state == avahi.SERVER_RUNNING:
1045
service.add()
1046
1047
1048
def entry_group_state_changed(state, error):
1049
"""Derived from the Avahi example code"""
1050
logger.debug(u"Avahi state change: %i", state)
1051
1052
if state == avahi.ENTRY_GROUP_ESTABLISHED:
1053
logger.debug(u"Zeroconf service established.")
1054
elif state == avahi.ENTRY_GROUP_COLLISION:
1055
logger.warning(u"Zeroconf service name collision.")
1056
service.rename()
1057
elif state == avahi.ENTRY_GROUP_FAILURE:
1058
logger.critical(u"Avahi: Error in group state changed %s",
1059
unicode(error))
1060
raise AvahiGroupError(u"State changed: %s" % unicode(error))
1061
1062
1357
def if_nametoindex(interface):
1063
"""Call the C function if_nametoindex(), or equivalent"""
1358
"""Call the C function if_nametoindex(), or equivalent
1359
1360
Note: This function cannot accept a unicode string."""
1064
1361
global if_nametoindex
1065
1362
try:
1066
1363
if_nametoindex = (ctypes.cdll.LoadLibrary
1067
(ctypes.util.find_library("c"))
1364
(ctypes.util.find_library(u"c"))
1068
1365
.if_nametoindex)
1069
1366
except (OSError, AttributeError):
1070
if "struct" not in sys.modules:
1071
import struct
1072
if "fcntl" not in sys.modules:
1073
import fcntl
1367
logger.warning(u"Doing if_nametoindex the hard way")
1074
1368
def if_nametoindex(interface):
1075
1369
"Get an interface index the hard way, i.e. using fcntl()"
1076
1370
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1077
1371
with closing(socket.socket()) as s:
1078
1372
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1079
struct.pack("16s16x", interface))
1080
interface_index = struct.unpack("I", ifreq[16:20])[0]
1373
struct.pack(str(u"16s16x"),
1374
interface))
1375
interface_index = struct.unpack(str(u"I"),
1376
ifreq[16:20])[0]
1081
1377
return interface_index
1082
1378
return if_nametoindex(interface)
1083
1379
1090
1386
sys.exit()
1091
1387
os.setsid()
1092
1388
if not nochdir:
1093
os.chdir("/")
1389
os.chdir(u"/")
1094
1390
if os.fork():
1095
1391
sys.exit()
1096
1392
if not noclose:
1098
1394
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1099
1395
if not stat.S_ISCHR(os.fstat(null).st_mode):
1100
1396
raise OSError(errno.ENODEV,
1101
"/dev/null not a character device")
1397
u"%s not a character device"
1398
% os.path.devnull)
1102
1399
os.dup2(null, sys.stdin.fileno())
1103
1400
os.dup2(null, sys.stdout.fileno())
1104
1401
os.dup2(null, sys.stderr.fileno())
1108
1405
1109
1406
def main():
1110
1407
1111
######################################################################
1408
##################################################################
1112
1409
# Parsing of options, both command line and config file
1113
1410
1114
1411
parser = optparse.OptionParser(version = "%%prog %s" % version)
1115
parser.add_option("-i", "--interface", type="string",
1116
metavar="IF", help="Bind to interface IF")
1117
parser.add_option("-a", "--address", type="string",
1118
help="Address to listen for requests on")
1119
parser.add_option("-p", "--port", type="int",
1120
help="Port number to receive requests on")
1121
parser.add_option("--check", action="store_true",
1122
help="Run self-test")
1123
parser.add_option("--debug", action="store_true",
1124
help="Debug mode; run in foreground and log to"
1125
" terminal")
1126
parser.add_option("--priority", type="string", help="GnuTLS"
1127
" priority string (see GnuTLS documentation)")
1128
parser.add_option("--servicename", type="string", metavar="NAME",
1129
help="Zeroconf service name")
1130
parser.add_option("--configdir", type="string",
1131
default="/etc/mandos", metavar="DIR",
1132
help="Directory to search for configuration"
1133
" files")
1134
parser.add_option("--no-dbus", action="store_false",
1135
dest="use_dbus",
1136
help="Do not provide D-Bus system bus"
1137
" interface")
1138
parser.add_option("--no-ipv6", action="store_false",
1139
dest="use_ipv6", help="Do not use IPv6")
1412
parser.add_option("-i", u"--interface", type=u"string",
1413
metavar="IF", help=u"Bind to interface IF")
1414
parser.add_option("-a", u"--address", type=u"string",
1415
help=u"Address to listen for requests on")
1416
parser.add_option("-p", u"--port", type=u"int",
1417
help=u"Port number to receive requests on")
1418
parser.add_option("--check", action=u"store_true",
1419
help=u"Run self-test")
1420
parser.add_option("--debug", action=u"store_true",
1421
help=u"Debug mode; run in foreground and log to"
1422
u" terminal")
1423
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1424
u" priority string (see GnuTLS documentation)")
1425
parser.add_option("--servicename", type=u"string",
1426
metavar=u"NAME", help=u"Zeroconf service name")
1427
parser.add_option("--configdir", type=u"string",
1428
default=u"/etc/mandos", metavar=u"DIR",
1429
help=u"Directory to search for configuration"
1430
u" files")
1431
parser.add_option("--no-dbus", action=u"store_false",
1432
dest=u"use_dbus", help=u"Do not provide D-Bus"
1433
u" system bus interface")
1434
parser.add_option("--no-ipv6", action=u"store_false",
1435
dest=u"use_ipv6", help=u"Do not use IPv6")
1140
1436
options = parser.parse_args()[0]
1141
1437
1142
1438
if options.check:
1145
1441
sys.exit()
1146
1442
1147
1443
# Default values for config file for server-global settings
1148
server_defaults = { "interface": "",
1149
"address": "",
1150
"port": "",
1151
"debug": "False",
1152
"priority":
1153
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1154
"servicename": "Mandos",
1155
"use_dbus": "True",
1156
"use_ipv6": "True",
1444
server_defaults = { u"interface": u"",
1445
u"address": u"",
1446
u"port": u"",
1447
u"debug": u"False",
1448
u"priority":
1449
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1450
u"servicename": u"Mandos",
1451
u"use_dbus": u"True",
1452
u"use_ipv6": u"True",
1157
1453
}
1158
1454
1159
1455
# Parse config file for server-global settings
1160
server_config = ConfigParser.SafeConfigParser(server_defaults)
1456
server_config = configparser.SafeConfigParser(server_defaults)
1161
1457
del server_defaults
1162
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1458
server_config.read(os.path.join(options.configdir,
1459
u"mandos.conf"))
1163
1460
# Convert the SafeConfigParser object to a dict
1164
1461
server_settings = server_config.defaults()
1165
1462
# Use the appropriate methods on the non-string config options
1166
server_settings["debug"] = server_config.getboolean("DEFAULT",
1167
"debug")
1168
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1169
"use_dbus")
1170
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1171
"use_ipv6")
1463
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1464
server_settings[option] = server_config.getboolean(u"DEFAULT",
1465
option)
1172
1466
if server_settings["port"]:
1173
server_settings["port"] = server_config.getint("DEFAULT",
1174
"port")
1467
server_settings["port"] = server_config.getint(u"DEFAULT",
1468
u"port")
1175
1469
del server_config
1176
1470
1177
1471
# Override the settings from the config file with command line
1178
1472
# options, if set.
1179
for option in ("interface", "address", "port", "debug",
1180
"priority", "servicename", "configdir",
1181
"use_dbus", "use_ipv6"):
1473
for option in (u"interface", u"address", u"port", u"debug",
1474
u"priority", u"servicename", u"configdir",
1475
u"use_dbus", u"use_ipv6"):
1182
1476
value = getattr(options, option)
1183
1477
if value is not None:
1184
1478
server_settings[option] = value
1185
1479
del options
1480
# Force all strings to be unicode
1481
for option in server_settings.keys():
1482
if type(server_settings[option]) is str:
1483
server_settings[option] = unicode(server_settings[option])
1186
1484
# Now we have our good server settings in "server_settings"
1187
1485
1188
1486
##################################################################
1189
1487
1190
1488
# For convenience
1191
debug = server_settings["debug"]
1192
use_dbus = server_settings["use_dbus"]
1193
use_ipv6 = server_settings["use_ipv6"]
1489
debug = server_settings[u"debug"]
1490
use_dbus = server_settings[u"use_dbus"]
1491
use_ipv6 = server_settings[u"use_ipv6"]
1194
1492
1195
1493
if not debug:
1196
1494
syslogger.setLevel(logging.WARNING)
1197
1495
console.setLevel(logging.WARNING)
1198
1496
1199
if server_settings["servicename"] != "Mandos":
1497
if server_settings[u"servicename"] != u"Mandos":
1200
1498
syslogger.setFormatter(logging.Formatter
1201
('Mandos (%s) [%%(process)d]:'
1202
' %%(levelname)s: %%(message)s'
1203
% server_settings["servicename"]))
1499
(u'Mandos (%s) [%%(process)d]:'
1500
u' %%(levelname)s: %%(message)s'
1501
% server_settings[u"servicename"]))
1204
1502
1205
1503
# Parse config file with clients
1206
client_defaults = { "timeout": "1h",
1207
"interval": "5m",
1208
"checker": "fping -q -- %%(host)s",
1209
"host": "",
1504
client_defaults = { u"timeout": u"1h",
1505
u"interval": u"5m",
1506
u"checker": u"fping -q -- %%(host)s",
1507
u"host": u"",
1210
1508
}
1211
client_config = ConfigParser.SafeConfigParser(client_defaults)
1212
client_config.read(os.path.join(server_settings["configdir"],
1213
"clients.conf"))
1214
1509
client_config = configparser.SafeConfigParser(client_defaults)
1510
client_config.read(os.path.join(server_settings[u"configdir"],
1511
u"clients.conf"))
1512
1215
1513
global mandos_dbus_service
1216
1514
mandos_dbus_service = None
1217
1515
1218
clients = Set()
1219
tcp_server = IPv6_TCPServer((server_settings["address"],
1220
server_settings["port"]),
1221
ClientHandler,
1222
interface=
1223
server_settings["interface"],
1224
use_ipv6=use_ipv6,
1225
clients=clients,
1226
gnutls_priority=
1227
server_settings["priority"],
1228
use_dbus=use_dbus)
1229
pidfilename = "/var/run/mandos.pid"
1516
tcp_server = MandosServer((server_settings[u"address"],
1517
server_settings[u"port"]),
1518
ClientHandler,
1519
interface=server_settings[u"interface"],
1520
use_ipv6=use_ipv6,
1521
gnutls_priority=
1522
server_settings[u"priority"],
1523
use_dbus=use_dbus)
1524
pidfilename = u"/var/run/mandos.pid"
1230
1525
try:
1231
pidfile = open(pidfilename, "w")
1526
pidfile = open(pidfilename, u"w")
1232
1527
except IOError:
1233
logger.error("Could not open file %r", pidfilename)
1528
logger.error(u"Could not open file %r", pidfilename)
1234
1529
1235
1530
try:
1236
uid = pwd.getpwnam("_mandos").pw_uid
1237
gid = pwd.getpwnam("_mandos").pw_gid
1531
uid = pwd.getpwnam(u"_mandos").pw_uid
1532
gid = pwd.getpwnam(u"_mandos").pw_gid
1238
1533
except KeyError:
1239
1534
try:
1240
uid = pwd.getpwnam("mandos").pw_uid
1241
gid = pwd.getpwnam("mandos").pw_gid
1535
uid = pwd.getpwnam(u"mandos").pw_uid
1536
gid = pwd.getpwnam(u"mandos").pw_gid
1242
1537
except KeyError:
1243
1538
try:
1244
uid = pwd.getpwnam("nobody").pw_uid
1245
gid = pwd.getpwnam("nogroup").pw_gid
1539
uid = pwd.getpwnam(u"nobody").pw_uid
1540
gid = pwd.getpwnam(u"nobody").pw_gid
1246
1541
except KeyError:
1247
1542
uid = 65534
1248
1543
gid = 65534
1261
1556
1262
1557
@gnutls.library.types.gnutls_log_func
1263
1558
def debug_gnutls(level, string):
1264
logger.debug("GnuTLS: %s", string[:-1])
1559
logger.debug(u"GnuTLS: %s", string[:-1])
1265
1560
1266
1561
(gnutls.library.functions
1267
1562
.gnutls_global_set_log_function(debug_gnutls))
1268
1563
1269
global service
1270
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1271
service = AvahiService(name = server_settings["servicename"],
1272
servicetype = "_mandos._tcp",
1273
protocol = protocol)
1274
if server_settings["interface"]:
1275
service.interface = (if_nametoindex
1276
(server_settings["interface"]))
1277
1278
1564
global main_loop
1279
global bus
1280
global server
1281
1565
# From the Avahi example code
1282
1566
DBusGMainLoop(set_as_default=True )
1283
1567
main_loop = gobject.MainLoop()
1284
1568
bus = dbus.SystemBus()
1285
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1286
avahi.DBUS_PATH_SERVER),
1287
avahi.DBUS_INTERFACE_SERVER)
1288
1569
# End of Avahi example code
1289
1570
if use_dbus:
1290
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1571
try:
1572
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1573
bus, do_not_queue=True)
1574
except dbus.exceptions.NameExistsException, e:
1575
logger.error(unicode(e) + u", disabling D-Bus")
1576
use_dbus = False
1577
server_settings[u"use_dbus"] = False
1578
tcp_server.use_dbus = False
1579
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1580
service = AvahiService(name = server_settings[u"servicename"],
1581
servicetype = u"_mandos._tcp",
1582
protocol = protocol, bus = bus)
1583
if server_settings["interface"]:
1584
service.interface = (if_nametoindex
1585
(str(server_settings[u"interface"])))
1291
1586
1292
1587
client_class = Client
1293
1588
if use_dbus:
1294
client_class = ClientDBus
1295
clients.update(Set(
1589
client_class = functools.partial(ClientDBus, bus = bus)
1590
tcp_server.clients.update(set(
1296
1591
client_class(name = section,
1297
1592
config= dict(client_config.items(section)))
1298
1593
for section in client_config.sections()))
1299
if not clients:
1594
if not tcp_server.clients:
1300
1595
logger.warning(u"No clients defined")
1301
1596
1302
1597
if debug:
1324
1619
pass
1325
1620
del pidfilename
1326
1621
1327
def cleanup():
1328
"Cleanup function; run on exit"
1329
global group
1330
# From the Avahi example code
1331
if not group is None:
1332
group.Free()
1333
group = None
1334
# End of Avahi example code
1335
1336
while clients:
1337
client = clients.pop()
1338
client.disable_hook = None
1339
client.disable()
1340
1341
atexit.register(cleanup)
1342
1343
1622
if not debug:
1344
1623
signal.signal(signal.SIGINT, signal.SIG_IGN)
1345
1624
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1349
1628
class MandosDBusService(dbus.service.Object):
1350
1629
"""A D-Bus proxy object"""
1351
1630
def __init__(self):
1352
dbus.service.Object.__init__(self, bus, "/")
1631
dbus.service.Object.__init__(self, bus, u"/")
1353
1632
_interface = u"se.bsnet.fukt.Mandos"
1354
1633
1355
@dbus.service.signal(_interface, signature="oa{sv}")
1634
@dbus.service.signal(_interface, signature=u"oa{sv}")
1356
1635
def ClientAdded(self, objpath, properties):
1357
1636
"D-Bus signal"
1358
1637
pass
1359
1638
1360
@dbus.service.signal(_interface, signature="s")
1361
def ClientNotFound(self, fingerprint):
1639
@dbus.service.signal(_interface, signature=u"ss")
1640
def ClientNotFound(self, fingerprint, address):
1362
1641
"D-Bus signal"
1363
1642
pass
1364
1643
1365
@dbus.service.signal(_interface, signature="os")
1644
@dbus.service.signal(_interface, signature=u"os")
1366
1645
def ClientRemoved(self, objpath, name):
1367
1646
"D-Bus signal"
1368
1647
pass
1369
1648
1370
@dbus.service.method(_interface, out_signature="ao")
1649
@dbus.service.method(_interface, out_signature=u"ao")
1371
1650
def GetAllClients(self):
1372
1651
"D-Bus method"
1373
return dbus.Array(c.dbus_object_path for c in clients)
1652
return dbus.Array(c.dbus_object_path
1653
for c in tcp_server.clients)
1374
1654
1375
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1655
@dbus.service.method(_interface,
1656
out_signature=u"a{oa{sv}}")
1376
1657
def GetAllClientsWithProperties(self):
1377
1658
"D-Bus method"
1378
1659
return dbus.Dictionary(
1379
((c.dbus_object_path, c.GetAllProperties())
1380
for c in clients),
1381
signature="oa{sv}")
1660
((c.dbus_object_path, c.GetAll(u""))
1661
for c in tcp_server.clients),
1662
signature=u"oa{sv}")
1382
1663
1383
@dbus.service.method(_interface, in_signature="o")
1664
@dbus.service.method(_interface, in_signature=u"o")
1384
1665
def RemoveClient(self, object_path):
1385
1666
"D-Bus method"
1386
for c in clients:
1667
for c in tcp_server.clients:
1387
1668
if c.dbus_object_path == object_path:
1388
clients.remove(c)
1669
tcp_server.clients.remove(c)
1389
1670
c.remove_from_connection()
1390
1671
# Don't signal anything except ClientRemoved
1391
c.disable(signal=False)
1672
c.disable(quiet=True)
1392
1673
# Emit D-Bus signal
1393
1674
self.ClientRemoved(object_path, c.name)
1394
1675
return
1395
raise KeyError
1676
raise KeyError(object_path)
1396
1677
1397
1678
del _interface
1398
1679
1399
1680
mandos_dbus_service = MandosDBusService()
1400
1681
1401
for client in clients:
1682
def cleanup():
1683
"Cleanup function; run on exit"
1684
service.cleanup()
1685
1686
while tcp_server.clients:
1687
client = tcp_server.clients.pop()
1688
if use_dbus:
1689
client.remove_from_connection()
1690
client.disable_hook = None
1691
# Don't signal anything except ClientRemoved
1692
client.disable(quiet=True)
1693
if use_dbus:
1694
# Emit D-Bus signal
1695
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1696
client.name)
1697
1698
atexit.register(cleanup)
1699
1700
for client in tcp_server.clients:
1402
1701
if use_dbus:
1403
1702
# Emit D-Bus signal
1404
1703
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1405
client.GetAllProperties())
1704
client.GetAll(u""))
1406
1705
client.enable()
1407
1706
1408
1707
tcp_server.enable()
1422
1721
1423
1722
try:
1424
1723
# From the Avahi example code
1425
server.connect_to_signal("StateChanged", server_state_changed)
1426
1724
try:
1427
server_state_changed(server.GetState())
1725
service.activate()
1428
1726
except dbus.exceptions.DBusException, error:
1429
1727
logger.critical(u"DBusException: %s", error)
1728
cleanup()
1430
1729
sys.exit(1)
1431
1730
# End of Avahi example code
1432
1731
1439
1738
main_loop.run()
1440
1739
except AvahiError, error:
1441
1740
logger.critical(u"AvahiError: %s", error)
1741
cleanup()
1442
1742
sys.exit(1)
1443
1743
except KeyboardInterrupt:
1444
1744
if debug:
1445
1745
print >> sys.stderr
1446
logger.debug("Server received KeyboardInterrupt")
1447
logger.debug("Server exiting")
1746
logger.debug(u"Server received KeyboardInterrupt")
1747
logger.debug(u"Server exiting")
1748
# Must run before the D-Bus bus name gets deregistered
1749
cleanup()
1448
1750
1449
1751
if __name__ == '__main__':
1450
1752
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0