To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 410
- compare with another revision
- download diff
- download tarball
- view history from revision 410
- Committer: Teddy Hogeborn
- Date: 2009-11-19 18:31:28 UTC
- Revision ID: teddy@fukt.bsnet.se-20091119183128-ttstewh61xmtnil1
* Makefile (LINK_FORTIFY_LD): Bug fix: removed "-fPIE".
* mandos-keygen: Bug fix: Fix quoting for the "--password" option.
* mandos-keygen: Bug fix: Fix quoting for the "--password" option.
added
removed
mandos
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
58
import contextlib
58
from contextlib import closing
59
59
import struct
60
60
import fcntl
61
61
import functools
62
import cPickle as pickle
63
import multiprocessing
64
62
65
63
import dbus
66
64
import dbus.service
83
81
84
82
version = "1.0.14"
85
83
86
#logger = logging.getLogger(u'mandos')
87
84
logger = logging.Logger(u'mandos')
88
85
syslogger = (logging.handlers.SysLogHandler
89
86
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
157
154
u" after %i retries, exiting.",
158
155
self.rename_count)
159
156
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
157
self.name = self.server.GetAlternativeServiceName(self.name)
161
158
logger.info(u"Changing Zeroconf service name to %r ...",
162
self.name)
159
unicode(self.name))
163
160
syslogger.setFormatter(logging.Formatter
164
161
(u'Mandos (%s) [%%(process)d]:'
165
162
u' %%(levelname)s: %%(message)s'
166
163
% self.name))
167
164
self.remove()
168
try:
169
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
172
self.cleanup()
173
os._exit(1)
165
self.add()
174
166
self.rename_count += 1
175
167
def remove(self):
176
168
"""Derived from the Avahi example code"""
199
191
self.group.Commit()
200
192
def entry_group_state_changed(self, state, error):
201
193
"""Derived from the Avahi example code"""
202
logger.debug(u"Avahi entry group state change: %i", state)
194
logger.debug(u"Avahi state change: %i", state)
203
195
204
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
197
logger.debug(u"Zeroconf service established.")
218
210
self.group = None
219
211
def server_state_changed(self, state):
220
212
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
222
213
if state == avahi.SERVER_COLLISION:
223
214
logger.error(u"Zeroconf server name collision")
224
215
self.remove()
251
242
enabled: bool()
252
243
last_checked_ok: datetime.datetime(); (UTC) or None
253
244
timeout: datetime.timedelta(); How long from last_checked_ok
254
until this client is disabled
245
until this client is invalid
255
246
interval: datetime.timedelta(); How often to start a new checker
256
247
disable_hook: If set, called by disable() as disable_hook(self)
257
248
checker: subprocess.Popen(); a running checker process used
265
256
runtime with vars(self) as dict, so that for
266
257
instance %(name)s can be used in the command.
267
258
current_checker_command: string; current running checker_command
268
approval_delay: datetime.timedelta(); Time to wait for approval
269
_approved: bool(); 'None' if not yet approved/disapproved
270
approval_duration: datetime.timedelta(); Duration of one approval
271
259
"""
272
260
273
261
@staticmethod
284
272
def interval_milliseconds(self):
285
273
"Return the 'interval' attribute in milliseconds"
286
274
return self._timedelta_to_milliseconds(self.interval)
287
288
def approval_delay_milliseconds(self):
289
return self._timedelta_to_milliseconds(self.approval_delay)
290
275
291
276
def __init__(self, name = None, disable_hook=None, config=None):
292
277
"""Note: the 'checker' key in 'config' sets the
305
290
if u"secret" in config:
306
291
self.secret = config[u"secret"].decode(u"base64")
307
292
elif u"secfile" in config:
308
with open(os.path.expanduser(os.path.expandvars
309
(config[u"secfile"])),
310
"rb") as secfile:
293
with closing(open(os.path.expanduser
294
(os.path.expandvars
295
(config[u"secfile"])),
296
"rb")) as secfile:
311
297
self.secret = secfile.read()
312
298
else:
313
299
raise TypeError(u"No secret or secfile for client %s"
327
313
self.checker_command = config[u"checker"]
328
314
self.current_checker_command = None
329
315
self.last_connect = None
330
self._approved = None
331
self.approved_by_default = config.get(u"approved_by_default",
332
True)
333
self.approvals_pending = 0
334
self.approval_delay = string_to_delta(
335
config[u"approval_delay"])
336
self.approval_duration = string_to_delta(
337
config[u"approval_duration"])
338
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
339
316
340
def send_changedstate(self):
341
self.changedstate.acquire()
342
self.changedstate.notify_all()
343
self.changedstate.release()
344
345
317
def enable(self):
346
318
"""Start this client's checker and timeout hooks"""
347
319
if getattr(self, u"enabled", False):
348
320
# Already enabled
349
321
return
350
self.send_changedstate()
351
322
self.last_enabled = datetime.datetime.utcnow()
352
323
# Schedule a new checker to be started an 'interval' from now,
353
324
# and every interval from then on.
367
338
if not getattr(self, "enabled", False):
368
339
return False
369
340
if not quiet:
370
self.send_changedstate()
371
if not quiet:
372
341
logger.info(u"Disabling client %s", self.name)
373
342
if getattr(self, u"disable_initiator_tag", False):
374
343
gobject.source_remove(self.disable_initiator_tag)
427
396
# client would inevitably timeout, since no checker would get
428
397
# a chance to run to completion. If we instead leave running
429
398
# checkers alone, the checker would have to take more time
430
# than 'timeout' for the client to be disabled, which is as it
431
# should be.
399
# than 'timeout' for the client to be declared invalid, which
400
# is as it should be.
432
401
433
402
# If a checker exists, make sure it is not a zombie
434
403
try:
506
475
if error.errno != errno.ESRCH: # No such process
507
476
raise
508
477
self.checker = None
478
479
def still_valid(self):
480
"""Has the timeout not yet passed for this client?"""
481
if not getattr(self, u"enabled", False):
482
return False
483
now = datetime.datetime.utcnow()
484
if self.last_checked_ok is None:
485
return now < (self.created + self.timeout)
486
else:
487
return now < (self.last_checked_ok + self.timeout)
488
509
489
510
490
def dbus_service_property(dbus_interface, signature=u"v",
511
491
access=u"readwrite", byte_arrays=False):
519
499
dbus.service.method, except there is only "signature", since the
520
500
type from Get() and the type sent to Set() is the same.
521
501
"""
522
# Encoding deeply encoded byte arrays is not supported yet by the
523
# "Set" method, so we fail early here:
524
if byte_arrays and signature != u"ay":
525
raise ValueError(u"Byte arrays not supported for non-'ay'"
526
u" signature %r" % signature)
527
502
def decorator(func):
528
503
func._dbus_is_property = True
529
504
func._dbus_interface = dbus_interface
615
590
if prop._dbus_access == u"read":
616
591
raise DBusPropertyAccessException(property_name)
617
592
if prop._dbus_get_args_options[u"byte_arrays"]:
618
# The byte_arrays option is not supported yet on
619
# signatures other than "ay".
620
if prop._dbus_signature != u"ay":
621
raise ValueError
622
593
value = dbus.ByteArray(''.join(unichr(byte)
623
594
for byte in value))
624
595
prop(value)
706
677
# dbus.service.Object doesn't use super(), so we can't either.
707
678
708
679
def __init__(self, bus = None, *args, **kwargs):
709
self._approvals_pending = 0
710
680
self.bus = bus
711
681
Client.__init__(self, *args, **kwargs)
712
682
# Only now, when this client is initialized, can it show up on
716
686
+ self.name.replace(u".", u"_")))
717
687
DBusObjectWithProperties.__init__(self, self.bus,
718
688
self.dbus_object_path)
719
720
def _get_approvals_pending(self):
721
return self._approvals_pending
722
def _set_approvals_pending(self, value):
723
old_value = self._approvals_pending
724
self._approvals_pending = value
725
bval = bool(value)
726
if (hasattr(self, "dbus_object_path")
727
and bval is not bool(old_value)):
728
dbus_bool = dbus.Boolean(bval, variant_level=1)
729
self.PropertyChanged(dbus.String(u"ApprovalPending"),
730
dbus_bool)
731
732
approvals_pending = property(_get_approvals_pending,
733
_set_approvals_pending)
734
del _get_approvals_pending, _set_approvals_pending
735
689
736
690
@staticmethod
737
691
def _datetime_to_dbus(dt, variant_level=0):
744
698
r = Client.enable(self)
745
699
if oldstate != self.enabled:
746
700
# Emit D-Bus signals
747
self.PropertyChanged(dbus.String(u"Enabled"),
701
self.PropertyChanged(dbus.String(u"enabled"),
748
702
dbus.Boolean(True, variant_level=1))
749
703
self.PropertyChanged(
750
dbus.String(u"LastEnabled"),
704
dbus.String(u"last_enabled"),
751
705
self._datetime_to_dbus(self.last_enabled,
752
706
variant_level=1))
753
707
return r
757
711
r = Client.disable(self, quiet=quiet)
758
712
if not quiet and oldstate != self.enabled:
759
713
# Emit D-Bus signal
760
self.PropertyChanged(dbus.String(u"Enabled"),
714
self.PropertyChanged(dbus.String(u"enabled"),
761
715
dbus.Boolean(False, variant_level=1))
762
716
return r
763
717
775
729
self.checker_callback_tag = None
776
730
self.checker = None
777
731
# Emit D-Bus signal
778
self.PropertyChanged(dbus.String(u"CheckerRunning"),
732
self.PropertyChanged(dbus.String(u"checker_running"),
779
733
dbus.Boolean(False, variant_level=1))
780
734
if os.WIFEXITED(condition):
781
735
exitstatus = os.WEXITSTATUS(condition)
796
750
r = Client.checked_ok(self, *args, **kwargs)
797
751
# Emit D-Bus signal
798
752
self.PropertyChanged(
799
dbus.String(u"LastCheckedOK"),
753
dbus.String(u"last_checked_ok"),
800
754
(self._datetime_to_dbus(self.last_checked_ok,
801
755
variant_level=1)))
802
756
return r
814
768
# Emit D-Bus signal
815
769
self.CheckerStarted(self.current_checker_command)
816
770
self.PropertyChanged(
817
dbus.String(u"CheckerRunning"),
771
dbus.String(u"checker_running"),
818
772
dbus.Boolean(True, variant_level=1))
819
773
return r
820
774
823
777
r = Client.stop_checker(self, *args, **kwargs)
824
778
if (old_checker is not None
825
779
and getattr(self, u"checker", None) is None):
826
self.PropertyChanged(dbus.String(u"CheckerRunning"),
780
self.PropertyChanged(dbus.String(u"checker_running"),
827
781
dbus.Boolean(False, variant_level=1))
828
782
return r
829
830
def _reset_approved(self):
831
self._approved = None
832
return False
833
834
def approve(self, value=True):
835
self.send_changedstate()
836
self._approved = value
837
gobject.timeout_add(self._timedelta_to_milliseconds
838
(self.approval_duration),
839
self._reset_approved)
840
841
842
## D-Bus methods, signals & properties
783
784
## D-Bus methods & signals
843
785
_interface = u"se.bsnet.fukt.Mandos.Client"
844
786
845
## Signals
787
# CheckedOK - method
788
@dbus.service.method(_interface)
789
def CheckedOK(self):
790
return self.checked_ok()
846
791
847
792
# CheckerCompleted - signal
848
793
@dbus.service.signal(_interface, signature=u"nxs")
865
810
# GotSecret - signal
866
811
@dbus.service.signal(_interface)
867
812
def GotSecret(self):
868
"""D-Bus signal
869
Is sent after a successful transfer of secret from the Mandos
870
server to mandos-client
871
"""
813
"D-Bus signal"
872
814
pass
873
815
874
816
# Rejected - signal
875
@dbus.service.signal(_interface, signature=u"s")
876
def Rejected(self, reason):
877
"D-Bus signal"
878
pass
879
880
# NeedApproval - signal
881
@dbus.service.signal(_interface, signature=u"tb")
882
def NeedApproval(self, timeout, default):
883
"D-Bus signal"
884
pass
885
886
## Methods
887
888
# Approve - method
889
@dbus.service.method(_interface, in_signature=u"b")
890
def Approve(self, value):
891
self.approve(value)
892
893
# CheckedOK - method
894
@dbus.service.method(_interface)
895
def CheckedOK(self):
896
return self.checked_ok()
817
@dbus.service.signal(_interface)
818
def Rejected(self):
819
"D-Bus signal"
820
pass
897
821
898
822
# Enable - method
899
823
@dbus.service.method(_interface)
918
842
def StopChecker(self):
919
843
self.stop_checker()
920
844
921
## Properties
922
923
# ApprovalPending - property
924
@dbus_service_property(_interface, signature=u"b", access=u"read")
925
def ApprovalPending_dbus_property(self):
926
return dbus.Boolean(bool(self.approvals_pending))
927
928
# ApprovedByDefault - property
929
@dbus_service_property(_interface, signature=u"b",
930
access=u"readwrite")
931
def ApprovedByDefault_dbus_property(self, value=None):
932
if value is None: # get
933
return dbus.Boolean(self.approved_by_default)
934
self.approved_by_default = bool(value)
935
# Emit D-Bus signal
936
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
937
dbus.Boolean(value, variant_level=1))
938
939
# ApprovalDelay - property
940
@dbus_service_property(_interface, signature=u"t",
941
access=u"readwrite")
942
def ApprovalDelay_dbus_property(self, value=None):
943
if value is None: # get
944
return dbus.UInt64(self.approval_delay_milliseconds())
945
self.approval_delay = datetime.timedelta(0, 0, 0, value)
946
# Emit D-Bus signal
947
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
948
dbus.UInt64(value, variant_level=1))
949
950
# ApprovalDuration - property
951
@dbus_service_property(_interface, signature=u"t",
952
access=u"readwrite")
953
def ApprovalDuration_dbus_property(self, value=None):
954
if value is None: # get
955
return dbus.UInt64(self._timedelta_to_milliseconds(
956
self.approval_duration))
957
self.approval_duration = datetime.timedelta(0, 0, 0, value)
958
# Emit D-Bus signal
959
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
960
dbus.UInt64(value, variant_level=1))
961
962
# Name - property
845
# name - property
963
846
@dbus_service_property(_interface, signature=u"s", access=u"read")
964
def Name_dbus_property(self):
847
def name_dbus_property(self):
965
848
return dbus.String(self.name)
966
849
967
# Fingerprint - property
850
# fingerprint - property
968
851
@dbus_service_property(_interface, signature=u"s", access=u"read")
969
def Fingerprint_dbus_property(self):
852
def fingerprint_dbus_property(self):
970
853
return dbus.String(self.fingerprint)
971
854
972
# Host - property
855
# host - property
973
856
@dbus_service_property(_interface, signature=u"s",
974
857
access=u"readwrite")
975
def Host_dbus_property(self, value=None):
858
def host_dbus_property(self, value=None):
976
859
if value is None: # get
977
860
return dbus.String(self.host)
978
861
self.host = value
979
862
# Emit D-Bus signal
980
self.PropertyChanged(dbus.String(u"Host"),
863
self.PropertyChanged(dbus.String(u"host"),
981
864
dbus.String(value, variant_level=1))
982
865
983
# Created - property
866
# created - property
984
867
@dbus_service_property(_interface, signature=u"s", access=u"read")
985
def Created_dbus_property(self):
868
def created_dbus_property(self):
986
869
return dbus.String(self._datetime_to_dbus(self.created))
987
870
988
# LastEnabled - property
871
# last_enabled - property
989
872
@dbus_service_property(_interface, signature=u"s", access=u"read")
990
def LastEnabled_dbus_property(self):
873
def last_enabled_dbus_property(self):
991
874
if self.last_enabled is None:
992
875
return dbus.String(u"")
993
876
return dbus.String(self._datetime_to_dbus(self.last_enabled))
994
877
995
# Enabled - property
878
# enabled - property
996
879
@dbus_service_property(_interface, signature=u"b",
997
880
access=u"readwrite")
998
def Enabled_dbus_property(self, value=None):
881
def enabled_dbus_property(self, value=None):
999
882
if value is None: # get
1000
883
return dbus.Boolean(self.enabled)
1001
884
if value:
1003
886
else:
1004
887
self.disable()
1005
888
1006
# LastCheckedOK - property
889
# last_checked_ok - property
1007
890
@dbus_service_property(_interface, signature=u"s",
1008
891
access=u"readwrite")
1009
def LastCheckedOK_dbus_property(self, value=None):
892
def last_checked_ok_dbus_property(self, value=None):
1010
893
if value is not None:
1011
894
self.checked_ok()
1012
895
return
1015
898
return dbus.String(self._datetime_to_dbus(self
1016
899
.last_checked_ok))
1017
900
1018
# Timeout - property
901
# timeout - property
1019
902
@dbus_service_property(_interface, signature=u"t",
1020
903
access=u"readwrite")
1021
def Timeout_dbus_property(self, value=None):
904
def timeout_dbus_property(self, value=None):
1022
905
if value is None: # get
1023
906
return dbus.UInt64(self.timeout_milliseconds())
1024
907
self.timeout = datetime.timedelta(0, 0, 0, value)
1025
908
# Emit D-Bus signal
1026
self.PropertyChanged(dbus.String(u"Timeout"),
909
self.PropertyChanged(dbus.String(u"timeout"),
1027
910
dbus.UInt64(value, variant_level=1))
1028
911
if getattr(self, u"disable_initiator_tag", None) is None:
1029
912
return
1043
926
self.disable_initiator_tag = (gobject.timeout_add
1044
927
(time_to_die, self.disable))
1045
928
1046
# Interval - property
929
# interval - property
1047
930
@dbus_service_property(_interface, signature=u"t",
1048
931
access=u"readwrite")
1049
def Interval_dbus_property(self, value=None):
932
def interval_dbus_property(self, value=None):
1050
933
if value is None: # get
1051
934
return dbus.UInt64(self.interval_milliseconds())
1052
935
self.interval = datetime.timedelta(0, 0, 0, value)
1053
936
# Emit D-Bus signal
1054
self.PropertyChanged(dbus.String(u"Interval"),
937
self.PropertyChanged(dbus.String(u"interval"),
1055
938
dbus.UInt64(value, variant_level=1))
1056
939
if getattr(self, u"checker_initiator_tag", None) is None:
1057
940
return
1061
944
(value, self.start_checker))
1062
945
self.start_checker() # Start one now, too
1063
946
1064
# Checker - property
947
# checker - property
1065
948
@dbus_service_property(_interface, signature=u"s",
1066
949
access=u"readwrite")
1067
def Checker_dbus_property(self, value=None):
950
def checker_dbus_property(self, value=None):
1068
951
if value is None: # get
1069
952
return dbus.String(self.checker_command)
1070
953
self.checker_command = value
1071
954
# Emit D-Bus signal
1072
self.PropertyChanged(dbus.String(u"Checker"),
955
self.PropertyChanged(dbus.String(u"checker"),
1073
956
dbus.String(self.checker_command,
1074
957
variant_level=1))
1075
958
1076
# CheckerRunning - property
959
# checker_running - property
1077
960
@dbus_service_property(_interface, signature=u"b",
1078
961
access=u"readwrite")
1079
def CheckerRunning_dbus_property(self, value=None):
962
def checker_running_dbus_property(self, value=None):
1080
963
if value is None: # get
1081
964
return dbus.Boolean(self.checker is not None)
1082
965
if value:
1084
967
else:
1085
968
self.stop_checker()
1086
969
1087
# ObjectPath - property
970
# object_path - property
1088
971
@dbus_service_property(_interface, signature=u"o", access=u"read")
1089
def ObjectPath_dbus_property(self):
972
def object_path_dbus_property(self):
1090
973
return self.dbus_object_path # is already a dbus.ObjectPath
1091
974
1092
# Secret = property
975
# secret = property
1093
976
@dbus_service_property(_interface, signature=u"ay",
1094
977
access=u"write", byte_arrays=True)
1095
def Secret_dbus_property(self, value):
978
def secret_dbus_property(self, value):
1096
979
self.secret = str(value)
1097
980
1098
981
del _interface
1099
982
1100
983
1101
class ProxyClient(object):
1102
def __init__(self, child_pipe, fpr, address):
1103
self._pipe = child_pipe
1104
self._pipe.send(('init', fpr, address))
1105
if not self._pipe.recv():
1106
raise KeyError()
1107
1108
def __getattribute__(self, name):
1109
if(name == '_pipe'):
1110
return super(ProxyClient, self).__getattribute__(name)
1111
self._pipe.send(('getattr', name))
1112
data = self._pipe.recv()
1113
if data[0] == 'data':
1114
return data[1]
1115
if data[0] == 'function':
1116
def func(*args, **kwargs):
1117
self._pipe.send(('funcall', name, args, kwargs))
1118
return self._pipe.recv()[1]
1119
return func
1120
1121
def __setattr__(self, name, value):
1122
if(name == '_pipe'):
1123
return super(ProxyClient, self).__setattr__(name, value)
1124
self._pipe.send(('setattr', name, value))
1125
1126
1127
984
class ClientHandler(socketserver.BaseRequestHandler, object):
1128
985
"""A class to handle client connections.
1129
986
1131
988
Note: This will run in its own forked process."""
1132
989
1133
990
def handle(self):
1134
with contextlib.closing(self.server.child_pipe) as child_pipe:
1135
logger.info(u"TCP connection from: %s",
1136
unicode(self.client_address))
1137
logger.debug(u"Pipe FD: %d",
1138
self.server.child_pipe.fileno())
1139
991
logger.info(u"TCP connection from: %s",
992
unicode(self.client_address))
993
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
994
# Open IPC pipe to parent process
995
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1140
996
session = (gnutls.connection
1141
997
.ClientSession(self.request,
1142
998
gnutls.connection
1143
999
.X509Credentials()))
1144
1000
1001
line = self.request.makefile().readline()
1002
logger.debug(u"Protocol version: %r", line)
1003
try:
1004
if int(line.strip().split()[0]) > 1:
1005
raise RuntimeError
1006
except (ValueError, IndexError, RuntimeError), error:
1007
logger.error(u"Unknown protocol version: %s", error)
1008
return
1009
1145
1010
# Note: gnutls.connection.X509Credentials is really a
1146
1011
# generic GnuTLS certificate credentials object so long as
1147
1012
# no X.509 keys are added to it. Therefore, we can use it
1148
1013
# here despite using OpenPGP certificates.
1149
1014
1150
1015
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1151
1016
# u"+AES-256-CBC", u"+SHA1",
1152
1017
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1158
1023
(gnutls.library.functions
1159
1024
.gnutls_priority_set_direct(session._c_object,
1160
1025
priority, None))
1161
1162
# Start communication using the Mandos protocol
1163
# Get protocol number
1164
line = self.request.makefile().readline()
1165
logger.debug(u"Protocol version: %r", line)
1166
try:
1167
if int(line.strip().split()[0]) > 1:
1168
raise RuntimeError
1169
except (ValueError, IndexError, RuntimeError), error:
1170
logger.error(u"Unknown protocol version: %s", error)
1171
return
1172
1173
# Start GnuTLS connection
1026
1174
1027
try:
1175
1028
session.handshake()
1176
1029
except gnutls.errors.GNUTLSError, error:
1179
1032
# established. Just abandon the request.
1180
1033
return
1181
1034
logger.debug(u"Handshake succeeded")
1182
1183
approval_required = False
1184
1035
try:
1185
try:
1186
fpr = self.fingerprint(self.peer_certificate
1187
(session))
1188
except (TypeError, gnutls.errors.GNUTLSError), error:
1189
logger.warning(u"Bad certificate: %s", error)
1190
return
1191
logger.debug(u"Fingerprint: %s", fpr)
1192
1193
try:
1194
client = ProxyClient(child_pipe, fpr,
1195
self.client_address)
1196
except KeyError:
1197
return
1198
1199
if client.approval_delay:
1200
delay = client.approval_delay
1201
client.approvals_pending += 1
1202
approval_required = True
1203
1204
while True:
1205
if not client.enabled:
1206
logger.warning(u"Client %s is disabled",
1207
client.name)
1208
if self.server.use_dbus:
1209
# Emit D-Bus signal
1210
client.Rejected("Disabled")
1211
return
1212
1213
if client._approved or not client.approval_delay:
1214
#We are approved or approval is disabled
1215
break
1216
elif client._approved is None:
1217
logger.info(u"Client %s needs approval",
1218
client.name)
1219
if self.server.use_dbus:
1220
# Emit D-Bus signal
1221
client.NeedApproval(
1222
client.approval_delay_milliseconds(),
1223
client.approved_by_default)
1224
else:
1225
logger.warning(u"Client %s was not approved",
1226
client.name)
1227
if self.server.use_dbus:
1228
# Emit D-Bus signal
1229
client.Rejected("Denied")
1230
return
1231
1232
#wait until timeout or approved
1233
#x = float(client._timedelta_to_milliseconds(delay))
1234
time = datetime.datetime.now()
1235
client.changedstate.acquire()
1236
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1237
client.changedstate.release()
1238
time2 = datetime.datetime.now()
1239
if (time2 - time) >= delay:
1240
if not client.approved_by_default:
1241
logger.warning("Client %s timed out while"
1242
" waiting for approval",
1243
client.name)
1244
if self.server.use_dbus:
1245
# Emit D-Bus signal
1246
client.Rejected("Approval timed out")
1247
return
1248
else:
1249
break
1250
else:
1251
delay -= time2 - time
1252
1253
sent_size = 0
1254
while sent_size < len(client.secret):
1255
try:
1256
sent = session.send(client.secret[sent_size:])
1257
except (gnutls.errors.GNUTLSError), error:
1258
logger.warning("gnutls send failed")
1259
return
1260
logger.debug(u"Sent: %d, remaining: %d",
1261
sent, len(client.secret)
1262
- (sent_size + sent))
1263
sent_size += sent
1264
1265
logger.info(u"Sending secret to %s", client.name)
1266
# bump the timeout as if seen
1267
client.checked_ok()
1268
if self.server.use_dbus:
1269
# Emit D-Bus signal
1270
client.GotSecret()
1036
fpr = self.fingerprint(self.peer_certificate(session))
1037
except (TypeError, gnutls.errors.GNUTLSError), error:
1038
logger.warning(u"Bad certificate: %s", error)
1039
session.bye()
1040
return
1041
logger.debug(u"Fingerprint: %s", fpr)
1271
1042
1272
finally:
1273
if approval_required:
1274
client.approvals_pending -= 1
1275
try:
1276
session.bye()
1277
except (gnutls.errors.GNUTLSError), error:
1278
logger.warning("GnuTLS bye failed")
1043
for c in self.server.clients:
1044
if c.fingerprint == fpr:
1045
client = c
1046
break
1047
else:
1048
ipc.write(u"NOTFOUND %s %s\n"
1049
% (fpr, unicode(self.client_address)))
1050
session.bye()
1051
return
1052
# Have to check if client.still_valid(), since it is
1053
# possible that the client timed out while establishing
1054
# the GnuTLS session.
1055
if not client.still_valid():
1056
ipc.write(u"INVALID %s\n" % client.name)
1057
session.bye()
1058
return
1059
ipc.write(u"SENDING %s\n" % client.name)
1060
sent_size = 0
1061
while sent_size < len(client.secret):
1062
sent = session.send(client.secret[sent_size:])
1063
logger.debug(u"Sent: %d, remaining: %d",
1064
sent, len(client.secret)
1065
- (sent_size + sent))
1066
sent_size += sent
1067
session.bye()
1279
1068
1280
1069
@staticmethod
1281
1070
def peer_certificate(session):
1341
1130
return hex_fpr
1342
1131
1343
1132
1344
class MultiprocessingMixIn(object):
1345
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1346
def sub_process_main(self, request, address):
1347
try:
1348
self.finish_request(request, address)
1349
except:
1350
self.handle_error(request, address)
1351
self.close_request(request)
1352
1353
def process_request(self, request, address):
1354
"""Start a new process to process the request."""
1355
multiprocessing.Process(target = self.sub_process_main,
1356
args = (request, address)).start()
1357
1358
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1359
""" adds a pipe to the MixIn """
1133
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1134
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1360
1135
def process_request(self, request, client_address):
1361
1136
"""Overrides and wraps the original process_request().
1362
1137
1363
1138
This function creates a new pipe in self.pipe
1364
1139
"""
1365
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1366
1367
super(MultiprocessingMixInWithPipe,
1140
self.pipe = os.pipe()
1141
super(ForkingMixInWithPipe,
1368
1142
self).process_request(request, client_address)
1369
self.child_pipe.close()
1370
self.add_pipe(parent_pipe)
1371
1372
def add_pipe(self, parent_pipe):
1143
os.close(self.pipe[1]) # close write end
1144
self.add_pipe(self.pipe[0])
1145
def add_pipe(self, pipe):
1373
1146
"""Dummy function; override as necessary"""
1374
pass
1375
1376
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1147
os.close(pipe)
1148
1149
1150
class IPv6_TCPServer(ForkingMixInWithPipe,
1377
1151
socketserver.TCPServer, object):
1378
1152
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1379
1153
1464
1238
return socketserver.TCPServer.server_activate(self)
1465
1239
def enable(self):
1466
1240
self.enabled = True
1467
def add_pipe(self, parent_pipe):
1241
def add_pipe(self, pipe):
1468
1242
# Call "handle_ipc" for both data and EOF events
1469
gobject.io_add_watch(parent_pipe.fileno(),
1470
gobject.IO_IN | gobject.IO_HUP,
1471
functools.partial(self.handle_ipc,
1472
parent_pipe = parent_pipe))
1473
1474
def handle_ipc(self, source, condition, parent_pipe=None,
1475
client_object=None):
1243
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1244
self.handle_ipc)
1245
def handle_ipc(self, source, condition, file_objects={}):
1476
1246
condition_names = {
1477
1247
gobject.IO_IN: u"IN", # There is data to read.
1478
1248
gobject.IO_OUT: u"OUT", # Data can be written (without
1487
1257
for cond, name in
1488
1258
condition_names.iteritems()
1489
1259
if cond & condition)
1490
# error or the other end of multiprocessing.Pipe has closed
1491
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1492
return False
1493
1494
# Read a request from the child
1495
request = parent_pipe.recv()
1496
command = request[0]
1497
1498
if command == 'init':
1499
fpr = request[1]
1500
address = request[2]
1501
1502
for c in self.clients:
1503
if c.fingerprint == fpr:
1504
client = c
1505
break
1506
else:
1507
logger.warning(u"Client not found for fingerprint: %s, ad"
1508
u"dress: %s", fpr, address)
1509
if self.use_dbus:
1510
# Emit D-Bus signal
1511
mandos_dbus_service.ClientNotFound(fpr, address)
1512
parent_pipe.send(False)
1513
return False
1514
1515
gobject.io_add_watch(parent_pipe.fileno(),
1516
gobject.IO_IN | gobject.IO_HUP,
1517
functools.partial(self.handle_ipc,
1518
parent_pipe = parent_pipe,
1519
client_object = client))
1520
parent_pipe.send(True)
1521
# remove the old hook in favor of the new above hook on same fileno
1522
return False
1523
if command == 'funcall':
1524
funcname = request[1]
1525
args = request[2]
1526
kwargs = request[3]
1527
1528
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1529
1530
if command == 'getattr':
1531
attrname = request[1]
1532
if callable(client_object.__getattribute__(attrname)):
1533
parent_pipe.send(('function',))
1534
else:
1535
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1536
1537
if command == 'setattr':
1538
attrname = request[1]
1539
value = request[2]
1540
setattr(client_object, attrname, value)
1541
1260
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1261
conditions_string)
1262
1263
# Turn the pipe file descriptor into a Python file object
1264
if source not in file_objects:
1265
file_objects[source] = os.fdopen(source, u"r", 1)
1266
1267
# Read a line from the file object
1268
cmdline = file_objects[source].readline()
1269
if not cmdline: # Empty line means end of file
1270
# close the IPC pipe
1271
file_objects[source].close()
1272
del file_objects[source]
1273
1274
# Stop calling this function
1275
return False
1276
1277
logger.debug(u"IPC command: %r", cmdline)
1278
1279
# Parse and act on command
1280
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1281
1282
if cmd == u"NOTFOUND":
1283
fpr, address = args.split(None, 1)
1284
logger.warning(u"Client not found for fingerprint: %s, ad"
1285
u"dress: %s", fpr, address)
1286
if self.use_dbus:
1287
# Emit D-Bus signal
1288
mandos_dbus_service.ClientNotFound(fpr, address)
1289
elif cmd == u"INVALID":
1290
for client in self.clients:
1291
if client.name == args:
1292
logger.warning(u"Client %s is invalid", args)
1293
if self.use_dbus:
1294
# Emit D-Bus signal
1295
client.Rejected()
1296
break
1297
else:
1298
logger.error(u"Unknown client %s is invalid", args)
1299
elif cmd == u"SENDING":
1300
for client in self.clients:
1301
if client.name == args:
1302
logger.info(u"Sending secret to %s", client.name)
1303
client.checked_ok()
1304
if self.use_dbus:
1305
# Emit D-Bus signal
1306
client.GotSecret()
1307
break
1308
else:
1309
logger.error(u"Sending secret to unknown client %s",
1310
args)
1311
else:
1312
logger.error(u"Unknown IPC command: %r", cmdline)
1313
1314
# Keep calling this function
1542
1315
return True
1543
1316
1544
1317
1595
1368
def if_nametoindex(interface):
1596
1369
"Get an interface index the hard way, i.e. using fcntl()"
1597
1370
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1598
with contextlib.closing(socket.socket()) as s:
1371
with closing(socket.socket()) as s:
1599
1372
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1600
1373
struct.pack(str(u"16s16x"),
1601
1374
interface))
1647
1420
parser.add_option("--debug", action=u"store_true",
1648
1421
help=u"Debug mode; run in foreground and log to"
1649
1422
u" terminal")
1650
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1651
help=u"Debug level for stdout output")
1652
1423
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1653
1424
u" priority string (see GnuTLS documentation)")
1654
1425
parser.add_option("--servicename", type=u"string",
1679
1450
u"servicename": u"Mandos",
1680
1451
u"use_dbus": u"True",
1681
1452
u"use_ipv6": u"True",
1682
u"debuglevel": u"",
1683
1453
}
1684
1454
1685
1455
# Parse config file for server-global settings
1702
1472
# options, if set.
1703
1473
for option in (u"interface", u"address", u"port", u"debug",
1704
1474
u"priority", u"servicename", u"configdir",
1705
u"use_dbus", u"use_ipv6", u"debuglevel"):
1475
u"use_dbus", u"use_ipv6"):
1706
1476
value = getattr(options, option)
1707
1477
if value is not None:
1708
1478
server_settings[option] = value
1717
1487
1718
1488
# For convenience
1719
1489
debug = server_settings[u"debug"]
1720
debuglevel = server_settings[u"debuglevel"]
1721
1490
use_dbus = server_settings[u"use_dbus"]
1722
1491
use_ipv6 = server_settings[u"use_ipv6"]
1723
1492
1493
if not debug:
1494
syslogger.setLevel(logging.WARNING)
1495
console.setLevel(logging.WARNING)
1496
1724
1497
if server_settings[u"servicename"] != u"Mandos":
1725
1498
syslogger.setFormatter(logging.Formatter
1726
1499
(u'Mandos (%s) [%%(process)d]:'
1732
1505
u"interval": u"5m",
1733
1506
u"checker": u"fping -q -- %%(host)s",
1734
1507
u"host": u"",
1735
u"approval_delay": u"0s",
1736
u"approval_duration": u"1s",
1737
1508
}
1738
1509
client_config = configparser.SafeConfigParser(client_defaults)
1739
1510
client_config.read(os.path.join(server_settings[u"configdir"],
1745
1516
tcp_server = MandosServer((server_settings[u"address"],
1746
1517
server_settings[u"port"]),
1747
1518
ClientHandler,
1748
interface=(server_settings[u"interface"]
1749
or None),
1519
interface=server_settings[u"interface"],
1750
1520
use_ipv6=use_ipv6,
1751
1521
gnutls_priority=
1752
1522
server_settings[u"priority"],
1778
1548
if error[0] != errno.EPERM:
1779
1549
raise error
1780
1550
1781
if not debug and not debuglevel:
1782
syslogger.setLevel(logging.WARNING)
1783
console.setLevel(logging.WARNING)
1784
if debuglevel:
1785
level = getattr(logging, debuglevel.upper())
1786
syslogger.setLevel(level)
1787
console.setLevel(level)
1788
1551
# Enable all possible GnuTLS debugging
1789
1552
if debug:
1790
# Enable all possible GnuTLS debugging
1791
1792
1553
# "Use a log level over 10 to enable all debugging options."
1793
1554
# - GnuTLS manual
1794
1555
gnutls.library.functions.gnutls_global_set_log_level(11)
1799
1560
1800
1561
(gnutls.library.functions
1801
1562
.gnutls_global_set_log_function(debug_gnutls))
1802
1803
# Redirect stdin so all checkers get /dev/null
1804
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1805
os.dup2(null, sys.stdin.fileno())
1806
if null > 2:
1807
os.close(null)
1808
else:
1809
# No console logging
1810
logger.removeHandler(console)
1811
1812
1563
1813
1564
global main_loop
1814
1565
# From the Avahi example code
1832
1583
if server_settings["interface"]:
1833
1584
service.interface = (if_nametoindex
1834
1585
(str(server_settings[u"interface"])))
1835
1836
if not debug:
1837
# Close all input and output, do double fork, etc.
1838
daemon()
1839
1840
global multiprocessing_manager
1841
multiprocessing_manager = multiprocessing.Manager()
1842
1586
1843
1587
client_class = Client
1844
1588
if use_dbus:
1845
1589
client_class = functools.partial(ClientDBus, bus = bus)
1846
def client_config_items(config, section):
1847
special_settings = {
1848
"approved_by_default":
1849
lambda: config.getboolean(section,
1850
"approved_by_default"),
1851
}
1852
for name, value in config.items(section):
1853
try:
1854
yield (name, special_settings[name]())
1855
except KeyError:
1856
yield (name, value)
1857
1858
1590
tcp_server.clients.update(set(
1859
1591
client_class(name = section,
1860
config= dict(client_config_items(
1861
client_config, section)))
1592
config= dict(client_config.items(section)))
1862
1593
for section in client_config.sections()))
1863
1594
if not tcp_server.clients:
1864
1595
logger.warning(u"No clients defined")
1865
1596
1597
if debug:
1598
# Redirect stdin so all checkers get /dev/null
1599
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1600
os.dup2(null, sys.stdin.fileno())
1601
if null > 2:
1602
os.close(null)
1603
else:
1604
# No console logging
1605
logger.removeHandler(console)
1606
# Close all input and output, do double fork, etc.
1607
daemon()
1608
1866
1609
try:
1867
with pidfile:
1610
with closing(pidfile):
1868
1611
pid = os.getpid()
1869
1612
pidfile.write(str(pid) + "\n")
1870
1613
del pidfile
1888
1631
dbus.service.Object.__init__(self, bus, u"/")
1889
1632
_interface = u"se.bsnet.fukt.Mandos"
1890
1633
1891
@dbus.service.signal(_interface, signature=u"o")
1892
def ClientAdded(self, objpath):
1634
@dbus.service.signal(_interface, signature=u"oa{sv}")
1635
def ClientAdded(self, objpath, properties):
1893
1636
"D-Bus signal"
1894
1637
pass
1895
1638
1957
1700
for client in tcp_server.clients:
1958
1701
if use_dbus:
1959
1702
# Emit D-Bus signal
1960
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1703
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1704
client.GetAll(u""))
1961
1705
client.enable()
1962
1706
1963
1707
tcp_server.enable()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0