To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 413
- compare with another revision
- download diff
- download tarball
- view history from revision 413
- Committer: Teddy Hogeborn
- Date: 2009-12-27 03:35:58 UTC
- Revision ID: teddy@fukt.bsnet.se-20091227033558-y57wv1u4cls3i8kq
TODO file changes.
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
60
60
import fcntl
61
61
import functools
62
62
import cPickle as pickle
63
import multiprocessing
64
63
65
64
import dbus
66
65
import dbus.service
81
80
SO_BINDTODEVICE = None
82
81
83
82
84
version = "1.2.3"
83
version = "1.0.14"
85
84
86
#logger = logging.getLogger(u'mandos')
87
85
logger = logging.Logger(u'mandos')
88
86
syslogger = (logging.handlers.SysLogHandler
89
87
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
157
155
u" after %i retries, exiting.",
158
156
self.rename_count)
159
157
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
158
self.name = self.server.GetAlternativeServiceName(self.name)
161
159
logger.info(u"Changing Zeroconf service name to %r ...",
162
self.name)
160
unicode(self.name))
163
161
syslogger.setFormatter(logging.Formatter
164
162
(u'Mandos (%s) [%%(process)d]:'
165
163
u' %%(levelname)s: %%(message)s'
166
164
% self.name))
167
165
self.remove()
168
try:
169
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
172
self.cleanup()
173
os._exit(1)
166
self.add()
174
167
self.rename_count += 1
175
168
def remove(self):
176
169
"""Derived from the Avahi example code"""
199
192
self.group.Commit()
200
193
def entry_group_state_changed(self, state, error):
201
194
"""Derived from the Avahi example code"""
202
logger.debug(u"Avahi entry group state change: %i", state)
195
logger.debug(u"Avahi state change: %i", state)
203
196
204
197
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
198
logger.debug(u"Zeroconf service established.")
218
211
self.group = None
219
212
def server_state_changed(self, state):
220
213
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
222
214
if state == avahi.SERVER_COLLISION:
223
215
logger.error(u"Zeroconf server name collision")
224
216
self.remove()
240
232
"""A representation of a client host served by this server.
241
233
242
234
Attributes:
243
_approved: bool(); 'None' if not yet approved/disapproved
244
approval_delay: datetime.timedelta(); Time to wait for approval
245
approval_duration: datetime.timedelta(); Duration of one approval
235
name: string; from the config file, used in log messages and
236
D-Bus identifiers
237
fingerprint: string (40 or 32 hexadecimal digits); used to
238
uniquely identify the client
239
secret: bytestring; sent verbatim (over TLS) to client
240
host: string; available for use by the checker command
241
created: datetime.datetime(); (UTC) object creation
242
last_enabled: datetime.datetime(); (UTC)
243
enabled: bool()
244
last_checked_ok: datetime.datetime(); (UTC) or None
245
timeout: datetime.timedelta(); How long from last_checked_ok
246
until this client is disabled
247
interval: datetime.timedelta(); How often to start a new checker
248
disable_hook: If set, called by disable() as disable_hook(self)
246
249
checker: subprocess.Popen(); a running checker process used
247
250
to see if the client lives.
248
251
'None' if no process is running.
249
checker_callback_tag: a gobject event source tag, or None
250
checker_command: string; External command which is run to check
251
if client lives. %() expansions are done at
252
checker_initiator_tag: a gobject event source tag, or None
253
disable_initiator_tag: - '' -
254
checker_callback_tag: - '' -
255
checker_command: string; External command which is run to check if
256
client lives. %() expansions are done at
252
257
runtime with vars(self) as dict, so that for
253
258
instance %(name)s can be used in the command.
254
checker_initiator_tag: a gobject event source tag, or None
255
created: datetime.datetime(); (UTC) object creation
256
259
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: a gobject event source tag, or None
259
enabled: bool()
260
fingerprint: string (40 or 32 hexadecimal digits); used to
261
uniquely identify the client
262
host: string; available for use by the checker command
263
interval: datetime.timedelta(); How often to start a new checker
264
last_approval_request: datetime.datetime(); (UTC) or None
265
last_checked_ok: datetime.datetime(); (UTC) or None
266
last_enabled: datetime.datetime(); (UTC)
267
name: string; from the config file, used in log messages and
268
D-Bus identifiers
269
secret: bytestring; sent verbatim (over TLS) to client
270
timeout: datetime.timedelta(); How long from last_checked_ok
271
until this client is disabled
272
runtime_expansions: Allowed attributes for runtime expansion.
273
260
"""
274
261
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
279
280
262
@staticmethod
281
263
def _timedelta_to_milliseconds(td):
282
264
"Convert a datetime.timedelta() to milliseconds"
291
273
def interval_milliseconds(self):
292
274
"Return the 'interval' attribute in milliseconds"
293
275
return self._timedelta_to_milliseconds(self.interval)
294
295
def approval_delay_milliseconds(self):
296
return self._timedelta_to_milliseconds(self.approval_delay)
297
276
298
277
def __init__(self, name = None, disable_hook=None, config=None):
299
278
"""Note: the 'checker' key in 'config' sets the
322
301
self.host = config.get(u"host", u"")
323
302
self.created = datetime.datetime.utcnow()
324
303
self.enabled = False
325
self.last_approval_request = None
326
304
self.last_enabled = None
327
305
self.last_checked_ok = None
328
306
self.timeout = string_to_delta(config[u"timeout"])
335
313
self.checker_command = config[u"checker"]
336
314
self.current_checker_command = None
337
315
self.last_connect = None
338
self._approved = None
339
self.approved_by_default = config.get(u"approved_by_default",
340
True)
341
self.approvals_pending = 0
342
self.approval_delay = string_to_delta(
343
config[u"approval_delay"])
344
self.approval_duration = string_to_delta(
345
config[u"approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
347
316
348
def send_changedstate(self):
349
self.changedstate.acquire()
350
self.changedstate.notify_all()
351
self.changedstate.release()
352
353
317
def enable(self):
354
318
"""Start this client's checker and timeout hooks"""
355
319
if getattr(self, u"enabled", False):
356
320
# Already enabled
357
321
return
358
self.send_changedstate()
359
322
self.last_enabled = datetime.datetime.utcnow()
360
323
# Schedule a new checker to be started an 'interval' from now,
361
324
# and every interval from then on.
375
338
if not getattr(self, "enabled", False):
376
339
return False
377
340
if not quiet:
378
self.send_changedstate()
379
if not quiet:
380
341
logger.info(u"Disabling client %s", self.name)
381
342
if getattr(self, u"disable_initiator_tag", False):
382
343
gobject.source_remove(self.disable_initiator_tag)
424
385
(self.timeout_milliseconds(),
425
386
self.disable))
426
387
427
def need_approval(self):
428
self.last_approval_request = datetime.datetime.utcnow()
429
430
388
def start_checker(self):
431
389
"""Start a new checker subprocess if one is not running.
432
390
461
419
command = self.checker_command % self.host
462
420
except TypeError:
463
421
# Escape attributes for the shell
464
escaped_attrs = dict(
465
(attr,
466
re.escape(unicode(str(getattr(self, attr, u"")),
467
errors=
468
u'replace')))
469
for attr in
470
self.runtime_expansions)
471
422
escaped_attrs = dict((key,
423
re.escape(unicode(str(val),
424
errors=
425
u'replace')))
426
for key, val in
427
vars(self).iteritems())
472
428
try:
473
429
command = self.checker_command % escaped_attrs
474
430
except TypeError, error:
520
476
raise
521
477
self.checker = None
522
478
479
523
480
def dbus_service_property(dbus_interface, signature=u"v",
524
481
access=u"readwrite", byte_arrays=False):
525
482
"""Decorators for marking methods of a DBusObjectWithProperties to
716
673
dbus_object_path: dbus.ObjectPath
717
674
bus: dbus.SystemBus()
718
675
"""
719
720
runtime_expansions = (Client.runtime_expansions
721
+ (u"dbus_object_path",))
722
723
676
# dbus.service.Object doesn't use super(), so we can't either.
724
677
725
678
def __init__(self, bus = None, *args, **kwargs):
726
self._approvals_pending = 0
727
679
self.bus = bus
728
680
Client.__init__(self, *args, **kwargs)
729
681
# Only now, when this client is initialized, can it show up on
730
682
# the D-Bus
731
client_object_name = unicode(self.name).translate(
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
734
683
self.dbus_object_path = (dbus.ObjectPath
735
(u"/clients/" + client_object_name))
684
(u"/clients/"
685
+ self.name.replace(u".", u"_")))
736
686
DBusObjectWithProperties.__init__(self, self.bus,
737
687
self.dbus_object_path)
738
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
744
bval = bool(value)
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
dbus_bool)
750
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
754
688
755
689
@staticmethod
756
690
def _datetime_to_dbus(dt, variant_level=0):
763
697
r = Client.enable(self)
764
698
if oldstate != self.enabled:
765
699
# Emit D-Bus signals
766
self.PropertyChanged(dbus.String(u"Enabled"),
700
self.PropertyChanged(dbus.String(u"enabled"),
767
701
dbus.Boolean(True, variant_level=1))
768
702
self.PropertyChanged(
769
dbus.String(u"LastEnabled"),
703
dbus.String(u"last_enabled"),
770
704
self._datetime_to_dbus(self.last_enabled,
771
705
variant_level=1))
772
706
return r
776
710
r = Client.disable(self, quiet=quiet)
777
711
if not quiet and oldstate != self.enabled:
778
712
# Emit D-Bus signal
779
self.PropertyChanged(dbus.String(u"Enabled"),
713
self.PropertyChanged(dbus.String(u"enabled"),
780
714
dbus.Boolean(False, variant_level=1))
781
715
return r
782
716
794
728
self.checker_callback_tag = None
795
729
self.checker = None
796
730
# Emit D-Bus signal
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
731
self.PropertyChanged(dbus.String(u"checker_running"),
798
732
dbus.Boolean(False, variant_level=1))
799
733
if os.WIFEXITED(condition):
800
734
exitstatus = os.WEXITSTATUS(condition)
815
749
r = Client.checked_ok(self, *args, **kwargs)
816
750
# Emit D-Bus signal
817
751
self.PropertyChanged(
818
dbus.String(u"LastCheckedOK"),
752
dbus.String(u"last_checked_ok"),
819
753
(self._datetime_to_dbus(self.last_checked_ok,
820
754
variant_level=1)))
821
755
return r
822
756
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
825
# Emit D-Bus signal
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
829
variant_level=1)))
830
return r
831
832
757
def start_checker(self, *args, **kwargs):
833
758
old_checker = self.checker
834
759
if self.checker is not None:
842
767
# Emit D-Bus signal
843
768
self.CheckerStarted(self.current_checker_command)
844
769
self.PropertyChanged(
845
dbus.String(u"CheckerRunning"),
770
dbus.String(u"checker_running"),
846
771
dbus.Boolean(True, variant_level=1))
847
772
return r
848
773
851
776
r = Client.stop_checker(self, *args, **kwargs)
852
777
if (old_checker is not None
853
778
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
779
self.PropertyChanged(dbus.String(u"checker_running"),
855
780
dbus.Boolean(False, variant_level=1))
856
781
return r
857
858
def _reset_approved(self):
859
self._approved = None
860
return False
861
862
def approve(self, value=True):
863
self.send_changedstate()
864
self._approved = value
865
gobject.timeout_add(self._timedelta_to_milliseconds
866
(self.approval_duration),
867
self._reset_approved)
868
869
870
## D-Bus methods, signals & properties
782
783
## D-Bus methods & signals
871
784
_interface = u"se.bsnet.fukt.Mandos.Client"
872
785
873
## Signals
786
# CheckedOK - method
787
@dbus.service.method(_interface)
788
def CheckedOK(self):
789
return self.checked_ok()
874
790
875
791
# CheckerCompleted - signal
876
792
@dbus.service.signal(_interface, signature=u"nxs")
893
809
# GotSecret - signal
894
810
@dbus.service.signal(_interface)
895
811
def GotSecret(self):
896
"""D-Bus signal
897
Is sent after a successful transfer of secret from the Mandos
898
server to mandos-client
899
"""
812
"D-Bus signal"
900
813
pass
901
814
902
815
# Rejected - signal
903
@dbus.service.signal(_interface, signature=u"s")
904
def Rejected(self, reason):
816
@dbus.service.signal(_interface)
817
def Rejected(self):
905
818
"D-Bus signal"
906
819
pass
907
820
908
# NeedApproval - signal
909
@dbus.service.signal(_interface, signature=u"tb")
910
def NeedApproval(self, timeout, default):
911
"D-Bus signal"
912
return self.need_approval()
913
914
## Methods
915
916
# Approve - method
917
@dbus.service.method(_interface, in_signature=u"b")
918
def Approve(self, value):
919
self.approve(value)
920
921
# CheckedOK - method
922
@dbus.service.method(_interface)
923
def CheckedOK(self):
924
return self.checked_ok()
925
926
821
# Enable - method
927
822
@dbus.service.method(_interface)
928
823
def Enable(self):
946
841
def StopChecker(self):
947
842
self.stop_checker()
948
843
949
## Properties
950
951
# ApprovalPending - property
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
953
def ApprovalPending_dbus_property(self):
954
return dbus.Boolean(bool(self.approvals_pending))
955
956
# ApprovedByDefault - property
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
959
def ApprovedByDefault_dbus_property(self, value=None):
960
if value is None: # get
961
return dbus.Boolean(self.approved_by_default)
962
self.approved_by_default = bool(value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
966
967
# ApprovalDelay - property
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
970
def ApprovalDelay_dbus_property(self, value=None):
971
if value is None: # get
972
return dbus.UInt64(self.approval_delay_milliseconds())
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
# Emit D-Bus signal
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
977
978
# ApprovalDuration - property
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
981
def ApprovalDuration_dbus_property(self, value=None):
982
if value is None: # get
983
return dbus.UInt64(self._timedelta_to_milliseconds(
984
self.approval_duration))
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
# Emit D-Bus signal
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
989
990
# Name - property
844
# name - property
991
845
@dbus_service_property(_interface, signature=u"s", access=u"read")
992
def Name_dbus_property(self):
846
def name_dbus_property(self):
993
847
return dbus.String(self.name)
994
848
995
# Fingerprint - property
849
# fingerprint - property
996
850
@dbus_service_property(_interface, signature=u"s", access=u"read")
997
def Fingerprint_dbus_property(self):
851
def fingerprint_dbus_property(self):
998
852
return dbus.String(self.fingerprint)
999
853
1000
# Host - property
854
# host - property
1001
855
@dbus_service_property(_interface, signature=u"s",
1002
856
access=u"readwrite")
1003
def Host_dbus_property(self, value=None):
857
def host_dbus_property(self, value=None):
1004
858
if value is None: # get
1005
859
return dbus.String(self.host)
1006
860
self.host = value
1007
861
# Emit D-Bus signal
1008
self.PropertyChanged(dbus.String(u"Host"),
862
self.PropertyChanged(dbus.String(u"host"),
1009
863
dbus.String(value, variant_level=1))
1010
864
1011
# Created - property
865
# created - property
1012
866
@dbus_service_property(_interface, signature=u"s", access=u"read")
1013
def Created_dbus_property(self):
867
def created_dbus_property(self):
1014
868
return dbus.String(self._datetime_to_dbus(self.created))
1015
869
1016
# LastEnabled - property
870
# last_enabled - property
1017
871
@dbus_service_property(_interface, signature=u"s", access=u"read")
1018
def LastEnabled_dbus_property(self):
872
def last_enabled_dbus_property(self):
1019
873
if self.last_enabled is None:
1020
874
return dbus.String(u"")
1021
875
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1022
876
1023
# Enabled - property
877
# enabled - property
1024
878
@dbus_service_property(_interface, signature=u"b",
1025
879
access=u"readwrite")
1026
def Enabled_dbus_property(self, value=None):
880
def enabled_dbus_property(self, value=None):
1027
881
if value is None: # get
1028
882
return dbus.Boolean(self.enabled)
1029
883
if value:
1031
885
else:
1032
886
self.disable()
1033
887
1034
# LastCheckedOK - property
888
# last_checked_ok - property
1035
889
@dbus_service_property(_interface, signature=u"s",
1036
890
access=u"readwrite")
1037
def LastCheckedOK_dbus_property(self, value=None):
891
def last_checked_ok_dbus_property(self, value=None):
1038
892
if value is not None:
1039
893
self.checked_ok()
1040
894
return
1043
897
return dbus.String(self._datetime_to_dbus(self
1044
898
.last_checked_ok))
1045
899
1046
# LastApprovalRequest - property
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1048
def LastApprovalRequest_dbus_property(self):
1049
if self.last_approval_request is None:
1050
return dbus.String(u"")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1054
1055
# Timeout - property
900
# timeout - property
1056
901
@dbus_service_property(_interface, signature=u"t",
1057
902
access=u"readwrite")
1058
def Timeout_dbus_property(self, value=None):
903
def timeout_dbus_property(self, value=None):
1059
904
if value is None: # get
1060
905
return dbus.UInt64(self.timeout_milliseconds())
1061
906
self.timeout = datetime.timedelta(0, 0, 0, value)
1062
907
# Emit D-Bus signal
1063
self.PropertyChanged(dbus.String(u"Timeout"),
908
self.PropertyChanged(dbus.String(u"timeout"),
1064
909
dbus.UInt64(value, variant_level=1))
1065
910
if getattr(self, u"disable_initiator_tag", None) is None:
1066
911
return
1080
925
self.disable_initiator_tag = (gobject.timeout_add
1081
926
(time_to_die, self.disable))
1082
927
1083
# Interval - property
928
# interval - property
1084
929
@dbus_service_property(_interface, signature=u"t",
1085
930
access=u"readwrite")
1086
def Interval_dbus_property(self, value=None):
931
def interval_dbus_property(self, value=None):
1087
932
if value is None: # get
1088
933
return dbus.UInt64(self.interval_milliseconds())
1089
934
self.interval = datetime.timedelta(0, 0, 0, value)
1090
935
# Emit D-Bus signal
1091
self.PropertyChanged(dbus.String(u"Interval"),
936
self.PropertyChanged(dbus.String(u"interval"),
1092
937
dbus.UInt64(value, variant_level=1))
1093
938
if getattr(self, u"checker_initiator_tag", None) is None:
1094
939
return
1098
943
(value, self.start_checker))
1099
944
self.start_checker() # Start one now, too
1100
945
1101
# Checker - property
946
# checker - property
1102
947
@dbus_service_property(_interface, signature=u"s",
1103
948
access=u"readwrite")
1104
def Checker_dbus_property(self, value=None):
949
def checker_dbus_property(self, value=None):
1105
950
if value is None: # get
1106
951
return dbus.String(self.checker_command)
1107
952
self.checker_command = value
1108
953
# Emit D-Bus signal
1109
self.PropertyChanged(dbus.String(u"Checker"),
954
self.PropertyChanged(dbus.String(u"checker"),
1110
955
dbus.String(self.checker_command,
1111
956
variant_level=1))
1112
957
1113
# CheckerRunning - property
958
# checker_running - property
1114
959
@dbus_service_property(_interface, signature=u"b",
1115
960
access=u"readwrite")
1116
def CheckerRunning_dbus_property(self, value=None):
961
def checker_running_dbus_property(self, value=None):
1117
962
if value is None: # get
1118
963
return dbus.Boolean(self.checker is not None)
1119
964
if value:
1121
966
else:
1122
967
self.stop_checker()
1123
968
1124
# ObjectPath - property
969
# object_path - property
1125
970
@dbus_service_property(_interface, signature=u"o", access=u"read")
1126
def ObjectPath_dbus_property(self):
971
def object_path_dbus_property(self):
1127
972
return self.dbus_object_path # is already a dbus.ObjectPath
1128
973
1129
# Secret = property
974
# secret = property
1130
975
@dbus_service_property(_interface, signature=u"ay",
1131
976
access=u"write", byte_arrays=True)
1132
def Secret_dbus_property(self, value):
977
def secret_dbus_property(self, value):
1133
978
self.secret = str(value)
1134
979
1135
980
del _interface
1136
981
1137
982
1138
class ProxyClient(object):
1139
def __init__(self, child_pipe, fpr, address):
1140
self._pipe = child_pipe
1141
self._pipe.send(('init', fpr, address))
1142
if not self._pipe.recv():
1143
raise KeyError()
1144
1145
def __getattribute__(self, name):
1146
if(name == '_pipe'):
1147
return super(ProxyClient, self).__getattribute__(name)
1148
self._pipe.send(('getattr', name))
1149
data = self._pipe.recv()
1150
if data[0] == 'data':
1151
return data[1]
1152
if data[0] == 'function':
1153
def func(*args, **kwargs):
1154
self._pipe.send(('funcall', name, args, kwargs))
1155
return self._pipe.recv()[1]
1156
return func
1157
1158
def __setattr__(self, name, value):
1159
if(name == '_pipe'):
1160
return super(ProxyClient, self).__setattr__(name, value)
1161
self._pipe.send(('setattr', name, value))
1162
1163
1164
983
class ClientHandler(socketserver.BaseRequestHandler, object):
1165
984
"""A class to handle client connections.
1166
985
1168
987
Note: This will run in its own forked process."""
1169
988
1170
989
def handle(self):
1171
with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
logger.info(u"TCP connection from: %s",
1173
unicode(self.client_address))
1174
logger.debug(u"Pipe FD: %d",
1175
self.server.child_pipe.fileno())
1176
990
logger.info(u"TCP connection from: %s",
991
unicode(self.client_address))
992
logger.debug(u"IPC Pipe FD: %d", self.server.child_pipe[1])
993
# Open IPC pipe to parent process
994
with contextlib.nested(os.fdopen(self.server.child_pipe[1],
995
u"w", 1),
996
os.fdopen(self.server.parent_pipe[0],
997
u"r", 0)) as (ipc,
998
ipc_return):
1177
999
session = (gnutls.connection
1178
1000
.ClientSession(self.request,
1179
1001
gnutls.connection
1180
1002
.X509Credentials()))
1181
1003
1004
line = self.request.makefile().readline()
1005
logger.debug(u"Protocol version: %r", line)
1006
try:
1007
if int(line.strip().split()[0]) > 1:
1008
raise RuntimeError
1009
except (ValueError, IndexError, RuntimeError), error:
1010
logger.error(u"Unknown protocol version: %s", error)
1011
return
1012
1182
1013
# Note: gnutls.connection.X509Credentials is really a
1183
1014
# generic GnuTLS certificate credentials object so long as
1184
1015
# no X.509 keys are added to it. Therefore, we can use it
1185
1016
# here despite using OpenPGP certificates.
1186
1017
1187
1018
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
1019
# u"+AES-256-CBC", u"+SHA1",
1189
1020
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1195
1026
(gnutls.library.functions
1196
1027
.gnutls_priority_set_direct(session._c_object,
1197
1028
priority, None))
1198
1199
# Start communication using the Mandos protocol
1200
# Get protocol number
1201
line = self.request.makefile().readline()
1202
logger.debug(u"Protocol version: %r", line)
1203
try:
1204
if int(line.strip().split()[0]) > 1:
1205
raise RuntimeError
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
1208
return
1209
1210
# Start GnuTLS connection
1029
1211
1030
try:
1212
1031
session.handshake()
1213
1032
except gnutls.errors.GNUTLSError, error:
1216
1035
# established. Just abandon the request.
1217
1036
return
1218
1037
logger.debug(u"Handshake succeeded")
1219
1220
approval_required = False
1221
1038
try:
1222
1039
try:
1223
1040
fpr = self.fingerprint(self.peer_certificate
1227
1044
return
1228
1045
logger.debug(u"Fingerprint: %s", fpr)
1229
1046
1230
try:
1231
client = ProxyClient(child_pipe, fpr,
1232
self.client_address)
1233
except KeyError:
1234
return
1235
1236
if client.approval_delay:
1237
delay = client.approval_delay
1238
client.approvals_pending += 1
1239
approval_required = True
1240
1241
while True:
1242
if not client.enabled:
1243
logger.warning(u"Client %s is disabled",
1244
client.name)
1245
if self.server.use_dbus:
1246
# Emit D-Bus signal
1247
client.Rejected("Disabled")
1248
return
1249
1250
if client._approved or not client.approval_delay:
1251
#We are approved or approval is disabled
1047
for c in self.server.clients:
1048
if c.fingerprint == fpr:
1049
client = c
1252
1050
break
1253
elif client._approved is None:
1254
logger.info(u"Client %s needs approval",
1255
client.name)
1256
if self.server.use_dbus:
1257
# Emit D-Bus signal
1258
client.NeedApproval(
1259
client.approval_delay_milliseconds(),
1260
client.approved_by_default)
1261
else:
1262
logger.warning(u"Client %s was not approved",
1263
client.name)
1264
if self.server.use_dbus:
1265
# Emit D-Bus signal
1266
client.Rejected("Denied")
1267
return
1268
1269
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
1271
time = datetime.datetime.now()
1272
client.changedstate.acquire()
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1274
client.changedstate.release()
1275
time2 = datetime.datetime.now()
1276
if (time2 - time) >= delay:
1277
if not client.approved_by_default:
1278
logger.warning("Client %s timed out while"
1279
" waiting for approval",
1280
client.name)
1281
if self.server.use_dbus:
1282
# Emit D-Bus signal
1283
client.Rejected("Approval timed out")
1284
return
1285
else:
1286
break
1287
else:
1288
delay -= time2 - time
1289
1051
else:
1052
ipc.write(u"NOTFOUND %s %s\n"
1053
% (fpr, unicode(self.client_address)))
1054
return
1055
# Have to check if client.enabled, since it is
1056
# possible that the client was disabled since the
1057
# GnuTLS session was established.
1058
ipc.write(u"GETATTR enabled %s\n" % fpr)
1059
enabled = pickle.load(ipc_return)
1060
if not enabled:
1061
ipc.write(u"DISABLED %s\n" % client.name)
1062
return
1063
ipc.write(u"SENDING %s\n" % client.name)
1290
1064
sent_size = 0
1291
1065
while sent_size < len(client.secret):
1292
try:
1293
sent = session.send(client.secret[sent_size:])
1294
except (gnutls.errors.GNUTLSError), error:
1295
logger.warning("gnutls send failed")
1296
return
1066
sent = session.send(client.secret[sent_size:])
1297
1067
logger.debug(u"Sent: %d, remaining: %d",
1298
1068
sent, len(client.secret)
1299
1069
- (sent_size + sent))
1300
1070
sent_size += sent
1301
1302
logger.info(u"Sending secret to %s", client.name)
1303
# bump the timeout as if seen
1304
client.checked_ok()
1305
if self.server.use_dbus:
1306
# Emit D-Bus signal
1307
client.GotSecret()
1308
1309
1071
finally:
1310
if approval_required:
1311
client.approvals_pending -= 1
1312
try:
1313
session.bye()
1314
except (gnutls.errors.GNUTLSError), error:
1315
logger.warning("GnuTLS bye failed")
1072
session.bye()
1316
1073
1317
1074
@staticmethod
1318
1075
def peer_certificate(session):
1378
1135
return hex_fpr
1379
1136
1380
1137
1381
class MultiprocessingMixIn(object):
1382
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1383
def sub_process_main(self, request, address):
1384
try:
1385
self.finish_request(request, address)
1386
except:
1387
self.handle_error(request, address)
1388
self.close_request(request)
1389
1390
def process_request(self, request, address):
1391
"""Start a new process to process the request."""
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
1394
1395
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
""" adds a pipe to the MixIn """
1138
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1139
"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1397
1140
def process_request(self, request, client_address):
1398
1141
"""Overrides and wraps the original process_request().
1399
1142
1400
1143
This function creates a new pipe in self.pipe
1401
1144
"""
1402
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
1404
super(MultiprocessingMixInWithPipe,
1145
self.child_pipe = os.pipe() # Child writes here
1146
self.parent_pipe = os.pipe() # Parent writes here
1147
super(ForkingMixInWithPipes,
1405
1148
self).process_request(request, client_address)
1406
self.child_pipe.close()
1407
self.add_pipe(parent_pipe)
1408
1409
def add_pipe(self, parent_pipe):
1149
# Close unused ends for parent
1150
os.close(self.parent_pipe[0]) # close read end
1151
os.close(self.child_pipe[1]) # close write end
1152
self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1153
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1410
1154
"""Dummy function; override as necessary"""
1411
pass
1412
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1155
os.close(child_pipe_fd)
1156
os.close(parent_pipe_fd)
1157
1158
1159
class IPv6_TCPServer(ForkingMixInWithPipes,
1414
1160
socketserver.TCPServer, object):
1415
1161
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1416
1162
1501
1247
return socketserver.TCPServer.server_activate(self)
1502
1248
def enable(self):
1503
1249
self.enabled = True
1504
def add_pipe(self, parent_pipe):
1250
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1505
1251
# Call "handle_ipc" for both data and EOF events
1506
gobject.io_add_watch(parent_pipe.fileno(),
1252
gobject.io_add_watch(child_pipe_fd,
1507
1253
gobject.IO_IN | gobject.IO_HUP,
1508
1254
functools.partial(self.handle_ipc,
1509
parent_pipe = parent_pipe))
1510
1511
def handle_ipc(self, source, condition, parent_pipe=None,
1512
client_object=None):
1255
reply_fd
1256
=parent_pipe_fd))
1257
def handle_ipc(self, source, condition, reply_fd=None,
1258
file_objects={}):
1513
1259
condition_names = {
1514
1260
gobject.IO_IN: u"IN", # There is data to read.
1515
1261
gobject.IO_OUT: u"OUT", # Data can be written (without
1524
1270
for cond, name in
1525
1271
condition_names.iteritems()
1526
1272
if cond & condition)
1527
# error or the other end of multiprocessing.Pipe has closed
1528
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1529
return False
1530
1531
# Read a request from the child
1532
request = parent_pipe.recv()
1533
command = request[0]
1534
1535
if command == 'init':
1536
fpr = request[1]
1537
address = request[2]
1538
1539
for c in self.clients:
1540
if c.fingerprint == fpr:
1541
client = c
1542
break
1543
else:
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1546
if self.use_dbus:
1547
# Emit D-Bus signal
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1549
parent_pipe.send(False)
1550
return False
1551
1552
gobject.io_add_watch(parent_pipe.fileno(),
1553
gobject.IO_IN | gobject.IO_HUP,
1554
functools.partial(self.handle_ipc,
1555
parent_pipe = parent_pipe,
1556
client_object = client))
1557
parent_pipe.send(True)
1558
# remove the old hook in favor of the new above hook on same fileno
1559
return False
1560
if command == 'funcall':
1561
funcname = request[1]
1562
args = request[2]
1563
kwargs = request[3]
1564
1565
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
1567
if command == 'getattr':
1568
attrname = request[1]
1569
if callable(client_object.__getattribute__(attrname)):
1570
parent_pipe.send(('function',))
1571
else:
1572
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1573
1574
if command == 'setattr':
1575
attrname = request[1]
1576
value = request[2]
1577
setattr(client_object, attrname, value)
1578
1273
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1274
conditions_string)
1275
1276
# Turn the pipe file descriptors into Python file objects
1277
if source not in file_objects:
1278
file_objects[source] = os.fdopen(source, u"r", 1)
1279
if reply_fd not in file_objects:
1280
file_objects[reply_fd] = os.fdopen(reply_fd, u"w", 0)
1281
1282
# Read a line from the file object
1283
cmdline = file_objects[source].readline()
1284
if not cmdline: # Empty line means end of file
1285
# close the IPC pipes
1286
file_objects[source].close()
1287
del file_objects[source]
1288
file_objects[reply_fd].close()
1289
del file_objects[reply_fd]
1290
1291
# Stop calling this function
1292
return False
1293
1294
logger.debug(u"IPC command: %r", cmdline)
1295
1296
# Parse and act on command
1297
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1298
1299
if cmd == u"NOTFOUND":
1300
fpr, address = args.split(None, 1)
1301
logger.warning(u"Client not found for fingerprint: %s, ad"
1302
u"dress: %s", fpr, address)
1303
if self.use_dbus:
1304
# Emit D-Bus signal
1305
mandos_dbus_service.ClientNotFound(fpr, address)
1306
elif cmd == u"DISABLED":
1307
for client in self.clients:
1308
if client.name == args:
1309
logger.warning(u"Client %s is disabled", args)
1310
if self.use_dbus:
1311
# Emit D-Bus signal
1312
client.Rejected()
1313
break
1314
else:
1315
logger.error(u"Unknown client %s is disabled", args)
1316
elif cmd == u"SENDING":
1317
for client in self.clients:
1318
if client.name == args:
1319
logger.info(u"Sending secret to %s", client.name)
1320
client.checked_ok()
1321
if self.use_dbus:
1322
# Emit D-Bus signal
1323
client.GotSecret()
1324
break
1325
else:
1326
logger.error(u"Sending secret to unknown client %s",
1327
args)
1328
elif cmd == u"GETATTR":
1329
attr_name, fpr = args.split(None, 1)
1330
for client in self.clients:
1331
if client.fingerprint == fpr:
1332
attr_value = getattr(client, attr_name, None)
1333
logger.debug("IPC reply: %r", attr_value)
1334
pickle.dump(attr_value, file_objects[reply_fd])
1335
break
1336
else:
1337
logger.error(u"Client %s on address %s requesting "
1338
u"attribute %s not found", fpr, address,
1339
attr_name)
1340
pickle.dump(None, file_objects[reply_fd])
1341
else:
1342
logger.error(u"Unknown IPC command: %r", cmdline)
1343
1344
# Keep calling this function
1579
1345
return True
1580
1346
1581
1347
1684
1450
parser.add_option("--debug", action=u"store_true",
1685
1451
help=u"Debug mode; run in foreground and log to"
1686
1452
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
help=u"Debug level for stdout output")
1689
1453
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
1454
u" priority string (see GnuTLS documentation)")
1691
1455
parser.add_option("--servicename", type=u"string",
1716
1480
u"servicename": u"Mandos",
1717
1481
u"use_dbus": u"True",
1718
1482
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1720
1483
}
1721
1484
1722
1485
# Parse config file for server-global settings
1739
1502
# options, if set.
1740
1503
for option in (u"interface", u"address", u"port", u"debug",
1741
1504
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1505
u"use_dbus", u"use_ipv6"):
1743
1506
value = getattr(options, option)
1744
1507
if value is not None:
1745
1508
server_settings[option] = value
1754
1517
1755
1518
# For convenience
1756
1519
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
1520
use_dbus = server_settings[u"use_dbus"]
1759
1521
use_ipv6 = server_settings[u"use_ipv6"]
1760
1522
1523
if not debug:
1524
syslogger.setLevel(logging.WARNING)
1525
console.setLevel(logging.WARNING)
1526
1761
1527
if server_settings[u"servicename"] != u"Mandos":
1762
1528
syslogger.setFormatter(logging.Formatter
1763
1529
(u'Mandos (%s) [%%(process)d]:'
1769
1535
u"interval": u"5m",
1770
1536
u"checker": u"fping -q -- %%(host)s",
1771
1537
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1774
1538
}
1775
1539
client_config = configparser.SafeConfigParser(client_defaults)
1776
1540
client_config.read(os.path.join(server_settings[u"configdir"],
1782
1546
tcp_server = MandosServer((server_settings[u"address"],
1783
1547
server_settings[u"port"]),
1784
1548
ClientHandler,
1785
interface=(server_settings[u"interface"]
1786
or None),
1549
interface=server_settings[u"interface"],
1787
1550
use_ipv6=use_ipv6,
1788
1551
gnutls_priority=
1789
1552
server_settings[u"priority"],
1790
1553
use_dbus=use_dbus)
1791
if not debug:
1792
pidfilename = u"/var/run/mandos.pid"
1793
try:
1794
pidfile = open(pidfilename, u"w")
1795
except IOError:
1796
logger.error(u"Could not open file %r", pidfilename)
1554
pidfilename = u"/var/run/mandos.pid"
1555
try:
1556
pidfile = open(pidfilename, u"w")
1557
except IOError:
1558
logger.error(u"Could not open file %r", pidfilename)
1797
1559
1798
1560
try:
1799
1561
uid = pwd.getpwnam(u"_mandos").pw_uid
1816
1578
if error[0] != errno.EPERM:
1817
1579
raise error
1818
1580
1819
if not debug and not debuglevel:
1820
syslogger.setLevel(logging.WARNING)
1821
console.setLevel(logging.WARNING)
1822
if debuglevel:
1823
level = getattr(logging, debuglevel.upper())
1824
syslogger.setLevel(level)
1825
console.setLevel(level)
1826
1581
# Enable all possible GnuTLS debugging
1827
1582
if debug:
1828
# Enable all possible GnuTLS debugging
1829
1830
1583
# "Use a log level over 10 to enable all debugging options."
1831
1584
# - GnuTLS manual
1832
1585
gnutls.library.functions.gnutls_global_set_log_level(11)
1837
1590
1838
1591
(gnutls.library.functions
1839
1592
.gnutls_global_set_log_function(debug_gnutls))
1840
1841
# Redirect stdin so all checkers get /dev/null
1842
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1843
os.dup2(null, sys.stdin.fileno())
1844
if null > 2:
1845
os.close(null)
1846
else:
1847
# No console logging
1848
logger.removeHandler(console)
1849
1850
# Need to fork before connecting to D-Bus
1851
if not debug:
1852
# Close all input and output, do double fork, etc.
1853
daemon()
1854
1593
1855
1594
global main_loop
1856
1595
# From the Avahi example code
1875
1614
service.interface = (if_nametoindex
1876
1615
(str(server_settings[u"interface"])))
1877
1616
1878
global multiprocessing_manager
1879
multiprocessing_manager = multiprocessing.Manager()
1880
1881
1617
client_class = Client
1882
1618
if use_dbus:
1883
1619
client_class = functools.partial(ClientDBus, bus = bus)
1884
def client_config_items(config, section):
1885
special_settings = {
1886
"approved_by_default":
1887
lambda: config.getboolean(section,
1888
"approved_by_default"),
1889
}
1890
for name, value in config.items(section):
1891
try:
1892
yield (name, special_settings[name]())
1893
except KeyError:
1894
yield (name, value)
1895
1896
1620
tcp_server.clients.update(set(
1897
1621
client_class(name = section,
1898
config= dict(client_config_items(
1899
client_config, section)))
1622
config= dict(client_config.items(section)))
1900
1623
for section in client_config.sections()))
1901
1624
if not tcp_server.clients:
1902
1625
logger.warning(u"No clients defined")
1903
1626
1627
if debug:
1628
# Redirect stdin so all checkers get /dev/null
1629
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1630
os.dup2(null, sys.stdin.fileno())
1631
if null > 2:
1632
os.close(null)
1633
else:
1634
# No console logging
1635
logger.removeHandler(console)
1636
# Close all input and output, do double fork, etc.
1637
daemon()
1638
1639
try:
1640
with pidfile:
1641
pid = os.getpid()
1642
pidfile.write(str(pid) + "\n")
1643
del pidfile
1644
except IOError:
1645
logger.error(u"Could not write to file %r with PID %d",
1646
pidfilename, pid)
1647
except NameError:
1648
# "pidfile" was never created
1649
pass
1650
del pidfilename
1651
1904
1652
if not debug:
1905
try:
1906
with pidfile:
1907
pid = os.getpid()
1908
pidfile.write(str(pid) + "\n")
1909
del pidfile
1910
except IOError:
1911
logger.error(u"Could not write to file %r with PID %d",
1912
pidfilename, pid)
1913
except NameError:
1914
# "pidfile" was never created
1915
pass
1916
del pidfilename
1917
1918
1653
signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
1920
1654
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
1655
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1922
1656
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0