/mandos/trunk : revision 416.1.2

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

61

60

import fcntl

62

61

import functools

63

62

import cPickle as pickle

64

import multiprocessing

63

import select

65

64

66

65

import dbus

67

66

import dbus.service

82

81

SO_BINDTODEVICE = None

83

82

84

83

85

version = "1.3.0"

84

version = "1.0.14"

86

85

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

86

logger = logging.Logger(u'mandos')

89

87

syslogger = (logging.handlers.SysLogHandler

90

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

89

address = "/dev/log"))

92

90

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

95

93

logger.addHandler(syslogger)

96

94

97

95

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

101

99

logger.addHandler(console)

102

100

103

101

class AvahiError(Exception):

120

118

Attributes:

121

119

interface: integer; avahi.IF_UNSPEC or an interface index.

122

120

Used to optionally bind to the specified interface.

123

124

type: string; Example: '_mandos._tcp'.

121

122

type: string; Example: u'_mandos._tcp'.

125

123

See <http://www.dns-sd.org/ServiceTypes.html>

126

124

port: integer; what port to announce

127

125

TXT: list of strings; TXT record for the service

136

134

"""

137

135

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

136

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

137

domain = u"", host = u"", max_renames = 32768,

140

138

protocol = avahi.PROTO_UNSPEC, bus = None):

141

139

self.interface = interface

142

140

self.name = name

151

149

self.group = None # our entry group

152

150

self.server = None

153

151

self.bus = bus

154

self.entry_group_state_changed_match = None

155

152

def rename(self):

156

153

"""Derived from the Avahi example code"""

157

154

if self.rename_count >= self.max_renames:

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

160

157

self.rename_count)

161

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

163

logger.info("Changing Zeroconf service name to %r ...",

164

self.name)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

165

162

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

168

165

% self.name))

169

166

self.remove()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

167

self.add()

176

168

self.rename_count += 1

177

169

def remove(self):

178

170

"""Derived from the Avahi example code"""

179

171

if self.group is not None:

180

try:

181

self.group.Free()

182

except (dbus.exceptions.UnknownMethodException,

183

dbus.exceptions.DBusException) as e:

184

pass

185

self.group = None

186

if self.entry_group_state_changed_match is not None:

187

self.entry_group_state_changed_match.remove()

188

self.entry_group_state_changed_match = None

172

self.group.Reset()

189

173

def add(self):

190

174

"""Derived from the Avahi example code"""

191

self.remove()

192

self.group = dbus.Interface(

193

self.bus.get_object(avahi.DBUS_NAME,

194

self.server.EntryGroupNew(),

195

follow_name_owner_changes=True),

196

avahi.DBUS_INTERFACE_ENTRY_GROUP)

197

self.entry_group_state_changed_match = (

198

self.group.connect_to_signal(

199

'StateChanged', self .entry_group_state_changed))

200

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

175

if self.group is None:

176

self.group = dbus.Interface(

177

self.bus.get_object(avahi.DBUS_NAME,

178

self.server.EntryGroupNew()),

179

avahi.DBUS_INTERFACE_ENTRY_GROUP)

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

201

184

self.name, self.type)

202

185

self.group.AddService(

203

186

self.interface,

210

193

self.group.Commit()

211

194

def entry_group_state_changed(self, state, error):

212

195

"""Derived from the Avahi example code"""

213

logger.debug("Avahi entry group state change: %i", state)

196

logger.debug(u"Avahi state change: %i", state)

214

197

215

198

if state == avahi.ENTRY_GROUP_ESTABLISHED:

216

logger.debug("Zeroconf service established.")

199

logger.debug(u"Zeroconf service established.")

217

200

elif state == avahi.ENTRY_GROUP_COLLISION:

218

logger.info("Zeroconf service name collision.")

201

logger.warning(u"Zeroconf service name collision.")

219

202

self.rename()

220

203

elif state == avahi.ENTRY_GROUP_FAILURE:

221

logger.critical("Avahi: Error in group state changed %s",

204

logger.critical(u"Avahi: Error in group state changed %s",

222

205

unicode(error))

223

raise AvahiGroupError("State changed: %s"

206

raise AvahiGroupError(u"State changed: %s"

224

207

% unicode(error))

225

208

def cleanup(self):

226

209

"""Derived from the Avahi example code"""

227

self.remove()

228

def server_state_changed(self, state, error=None):

210

if self.group is not None:

211

self.group.Free()

212

self.group = None

213

def server_state_changed(self, state):

229

214

"""Derived from the Avahi example code"""

230

logger.debug("Avahi server state change: %i", state)

231

bad_states = { avahi.SERVER_INVALID:

232

"Zeroconf server invalid",

233

avahi.SERVER_REGISTERING: None,

234

avahi.SERVER_COLLISION:

235

"Zeroconf server name collision",

236

avahi.SERVER_FAILURE:

237

"Zeroconf server failure" }

238

if state in bad_states:

239

if bad_states[state]:

240

logger.error(bad_states[state])

215

if state == avahi.SERVER_COLLISION:

216

logger.error(u"Zeroconf server name collision")

241

217

self.remove()

242

218

elif state == avahi.SERVER_RUNNING:

243

219

self.add()

244

else:

245

logger.debug("Unknown state: %r", state)

246

220

def activate(self):

247

221

"""Derived from the Avahi example code"""

248

222

if self.server is None:

249

223

self.server = dbus.Interface(

250

224

self.bus.get_object(avahi.DBUS_NAME,

251

avahi.DBUS_PATH_SERVER,

252

follow_name_owner_changes=True),

225

avahi.DBUS_PATH_SERVER),

253

226

avahi.DBUS_INTERFACE_SERVER)

254

self.server.connect_to_signal("StateChanged",

227

self.server.connect_to_signal(u"StateChanged",

255

228

self.server_state_changed)

256

229

self.server_state_changed(self.server.GetState())

257

230

260

233

"""A representation of a client host served by this server.

261

234

262

235

Attributes:

263

_approved: bool(); 'None' if not yet approved/disapproved

264

approval_delay: datetime.timedelta(); Time to wait for approval

265

approval_duration: datetime.timedelta(); Duration of one approval

236

237

D-Bus identifiers

238

fingerprint: string (40 or 32 hexadecimal digits); used to

239

uniquely identify the client

240

secret: bytestring; sent verbatim (over TLS) to client

241

host: string; available for use by the checker command

242

created: datetime.datetime(); (UTC) object creation

243

last_enabled: datetime.datetime(); (UTC)

244

enabled: bool()

245

last_checked_ok: datetime.datetime(); (UTC) or None

246

timeout: datetime.timedelta(); How long from last_checked_ok

247

until this client is disabled

248

interval: datetime.timedelta(); How often to start a new checker

249

disable_hook: If set, called by disable() as disable_hook(self)

266

250

checker: subprocess.Popen(); a running checker process used

267

251

to see if the client lives.

268

252

'None' if no process is running.

269

checker_callback_tag: a gobject event source tag, or None

270

checker_command: string; External command which is run to check

271

if client lives. %() expansions are done at

253

checker_initiator_tag: a gobject event source tag, or None

254

disable_initiator_tag: - '' -

255

checker_callback_tag: - '' -

256

checker_command: string; External command which is run to check if

257

client lives. %() expansions are done at

272

258

runtime with vars(self) as dict, so that for

273

259

instance %(name)s can be used in the command.

274

checker_initiator_tag: a gobject event source tag, or None

275

created: datetime.datetime(); (UTC) object creation

276

260

current_checker_command: string; current running checker_command

277

disable_hook: If set, called by disable() as disable_hook(self)

278

disable_initiator_tag: a gobject event source tag, or None

279

enabled: bool()

280

fingerprint: string (40 or 32 hexadecimal digits); used to

281

uniquely identify the client

282

host: string; available for use by the checker command

283

interval: datetime.timedelta(); How often to start a new checker

284

last_approval_request: datetime.datetime(); (UTC) or None

285

last_checked_ok: datetime.datetime(); (UTC) or None

286

last_enabled: datetime.datetime(); (UTC)

287

288

D-Bus identifiers

289

secret: bytestring; sent verbatim (over TLS) to client

290

timeout: datetime.timedelta(); How long from last_checked_ok

291

until this client is disabled

292

runtime_expansions: Allowed attributes for runtime expansion.

293

261

"""

294

262

295

runtime_expansions = ("approval_delay", "approval_duration",

296

"created", "enabled", "fingerprint",

297

"host", "interval", "last_checked_ok",

298

"last_enabled", "name", "timeout")

299

300

263

@staticmethod

301

264

def _timedelta_to_milliseconds(td):

302

265

"Convert a datetime.timedelta() to milliseconds"

311

274

def interval_milliseconds(self):

312

275

"Return the 'interval' attribute in milliseconds"

313

276

return self._timedelta_to_milliseconds(self.interval)

314

315

def approval_delay_milliseconds(self):

316

return self._timedelta_to_milliseconds(self.approval_delay)

317

277

318

278

def __init__(self, name = None, disable_hook=None, config=None):

319

279

"""Note: the 'checker' key in 'config' sets the

322

282

self.name = name

323

283

if config is None:

324

284

config = {}

325

logger.debug("Creating client %r", self.name)

285

logger.debug(u"Creating client %r", self.name)

326

286

# Uppercase and remove spaces from fingerprint for later

327

287

# comparison purposes with return value from the fingerprint()

328

288

# function

329

self.fingerprint = (config["fingerprint"].upper()

330

.replace(" ", ""))

331

logger.debug(" Fingerprint: %s", self.fingerprint)

332

if "secret" in config:

333

self.secret = config["secret"].decode("base64")

334

elif "secfile" in config:

289

self.fingerprint = (config[u"fingerprint"].upper()

290

.replace(u" ", u""))

291

logger.debug(u" Fingerprint: %s", self.fingerprint)

292

if u"secret" in config:

293

self.secret = config[u"secret"].decode(u"base64")

294

elif u"secfile" in config:

335

295

with open(os.path.expanduser(os.path.expandvars

336

(config["secfile"])),

296

(config[u"secfile"])),

337

297

"rb") as secfile:

338

298

self.secret = secfile.read()

339

299

else:

340

raise TypeError("No secret or secfile for client %s"

300

raise TypeError(u"No secret or secfile for client %s"

341

301

% self.name)

342

self.host = config.get("host", "")

302

self.host = config.get(u"host", u"")

343

303

self.created = datetime.datetime.utcnow()

344

304

self.enabled = False

345

self.last_approval_request = None

346

305

self.last_enabled = None

347

306

self.last_checked_ok = None

348

self.timeout = string_to_delta(config["timeout"])

349

self.interval = string_to_delta(config["interval"])

307

self.timeout = string_to_delta(config[u"timeout"])

308

self.interval = string_to_delta(config[u"interval"])

350

309

self.disable_hook = disable_hook

351

310

self.checker = None

352

311

self.checker_initiator_tag = None

353

312

self.disable_initiator_tag = None

354

313

self.checker_callback_tag = None

355

self.checker_command = config["checker"]

314

self.checker_command = config[u"checker"]

356

315

self.current_checker_command = None

357

316

self.last_connect = None

358

self._approved = None

359

self.approved_by_default = config.get("approved_by_default",

360

True)

361

self.approvals_pending = 0

362

self.approval_delay = string_to_delta(

363

config["approval_delay"])

364

self.approval_duration = string_to_delta(

365

config["approval_duration"])

366

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

367

317

368

def send_changedstate(self):

369

self.changedstate.acquire()

370

self.changedstate.notify_all()

371

self.changedstate.release()

372

373

318

def enable(self):

374

319

"""Start this client's checker and timeout hooks"""

375

if getattr(self, "enabled", False):

320

if getattr(self, u"enabled", False):

376

321

# Already enabled

377

322

return

378

self.send_changedstate()

379

323

self.last_enabled = datetime.datetime.utcnow()

380

324

# Schedule a new checker to be started an 'interval' from now,

381

325

# and every interval from then on.

395

339

if not getattr(self, "enabled", False):

396

340

return False

397

341

if not quiet:

398

self.send_changedstate()

399

if not quiet:

400

logger.info("Disabling client %s", self.name)

401

if getattr(self, "disable_initiator_tag", False):

342

logger.info(u"Disabling client %s", self.name)

343

if getattr(self, u"disable_initiator_tag", False):

402

344

gobject.source_remove(self.disable_initiator_tag)

403

345

self.disable_initiator_tag = None

404

if getattr(self, "checker_initiator_tag", False):

346

if getattr(self, u"checker_initiator_tag", False):

405

347

gobject.source_remove(self.checker_initiator_tag)

406

348

self.checker_initiator_tag = None

407

349

self.stop_checker()

422

364

if os.WIFEXITED(condition):

423

365

exitstatus = os.WEXITSTATUS(condition)

424

366

if exitstatus == 0:

425

logger.info("Checker for %(name)s succeeded",

367

logger.info(u"Checker for %(name)s succeeded",

426

368

vars(self))

427

369

self.checked_ok()

428

370

else:

429

logger.info("Checker for %(name)s failed",

371

logger.info(u"Checker for %(name)s failed",

430

372

vars(self))

431

373

else:

432

logger.warning("Checker for %(name)s crashed?",

374

logger.warning(u"Checker for %(name)s crashed?",

433

375

vars(self))

434

376

435

377

def checked_ok(self):

444

386

(self.timeout_milliseconds(),

445

387

self.disable))

446

388

447

def need_approval(self):

448

self.last_approval_request = datetime.datetime.utcnow()

449

450

389

def start_checker(self):

451

390

"""Start a new checker subprocess if one is not running.

452

391

464

403

# If a checker exists, make sure it is not a zombie

465

404

try:

466

405

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

467

except (AttributeError, OSError) as error:

406

except (AttributeError, OSError), error:

468

407

if (isinstance(error, OSError)

469

408

and error.errno != errno.ECHILD):

470

409

raise error

471

410

else:

472

411

if pid:

473

logger.warning("Checker was a zombie")

412

logger.warning(u"Checker was a zombie")

474

413

gobject.source_remove(self.checker_callback_tag)

475

414

self.checker_callback(pid, status,

476

415

self.current_checker_command)

481

420

command = self.checker_command % self.host

482

421

except TypeError:

483

422

# Escape attributes for the shell

484

escaped_attrs = dict(

485

(attr,

486

re.escape(unicode(str(getattr(self, attr, "")),

487

errors=

488

'replace')))

489

for attr in

490

self.runtime_expansions)

491

423

escaped_attrs = dict((key,

424

re.escape(unicode(str(val),

425

errors=

426

u'replace')))

427

for key, val in

428

vars(self).iteritems())

492

429

try:

493

430

command = self.checker_command % escaped_attrs

494

except TypeError as error:

495

logger.error('Could not format string "%s":'

496

' %s', self.checker_command, error)

431

except TypeError, error:

432

logger.error(u'Could not format string "%s":'

433

u' %s', self.checker_command, error)

497

434

return True # Try again later

498

435

self.current_checker_command = command

499

436

try:

500

logger.info("Starting checker %r for %s",

437

logger.info(u"Starting checker %r for %s",

501

438

command, self.name)

502

439

# We don't need to redirect stdout and stderr, since

503

440

# in normal mode, that is already done by daemon(),

505

442

# always replaced by /dev/null.)

506

443

self.checker = subprocess.Popen(command,

507

444

close_fds=True,

508

shell=True, cwd="/")

445

shell=True, cwd=u"/")

509

446

self.checker_callback_tag = (gobject.child_watch_add

510

447

(self.checker.pid,

511

448

self.checker_callback,

516

453

if pid:

517

454

gobject.source_remove(self.checker_callback_tag)

518

455

self.checker_callback(pid, status, command)

519

except OSError as error:

520

logger.error("Failed to start subprocess: %s",

456

except OSError, error:

457

logger.error(u"Failed to start subprocess: %s",

521

458

error)

522

459

# Re-run this periodically if run by gobject.timeout_add

523

460

return True

527

464

if self.checker_callback_tag:

528

465

gobject.source_remove(self.checker_callback_tag)

529

466

self.checker_callback_tag = None

530

if getattr(self, "checker", None) is None:

467

if getattr(self, u"checker", None) is None:

531

468

return

532

logger.debug("Stopping checker for %(name)s", vars(self))

469

logger.debug(u"Stopping checker for %(name)s", vars(self))

533

470

try:

534

471

os.kill(self.checker.pid, signal.SIGTERM)

535

472

#time.sleep(0.5)

536

473

#if self.checker.poll() is None:

537

474

# os.kill(self.checker.pid, signal.SIGKILL)

538

except OSError as error:

475

except OSError, error:

539

476

if error.errno != errno.ESRCH: # No such process

540

477

raise

541

478

self.checker = None

542

479

543

def dbus_service_property(dbus_interface, signature="v",

544

access="readwrite", byte_arrays=False):

480

481

def dbus_service_property(dbus_interface, signature=u"v",

482

access=u"readwrite", byte_arrays=False):

545

483

"""Decorators for marking methods of a DBusObjectWithProperties to

546

484

become properties on the D-Bus.

547

485

554

492

"""

555

493

# Encoding deeply encoded byte arrays is not supported yet by the

556

494

# "Set" method, so we fail early here:

557

if byte_arrays and signature != "ay":

558

raise ValueError("Byte arrays not supported for non-'ay'"

559

" signature %r" % signature)

495

if byte_arrays and signature != u"ay":

496

raise ValueError(u"Byte arrays not supported for non-'ay'"

497

u" signature %r" % signature)

560

498

def decorator(func):

561

499

func._dbus_is_property = True

562

500

func._dbus_interface = dbus_interface

563

501

func._dbus_signature = signature

564

502

func._dbus_access = access

565

503

func._dbus_name = func.__name__

566

if func._dbus_name.endswith("_dbus_property"):

504

if func._dbus_name.endswith(u"_dbus_property"):

567

505

func._dbus_name = func._dbus_name[:-14]

568

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

506

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

569

507

return func

570

508

return decorator

571

509

599

537

600

538

@staticmethod

601

539

def _is_dbus_property(obj):

602

return getattr(obj, "_dbus_is_property", False)

540

return getattr(obj, u"_dbus_is_property", False)

603

541

604

542

def _get_all_dbus_properties(self):

605

543

"""Returns a generator of (name, attribute) pairs

613

551

property with the specified name and interface.

614

552

"""

615

553

for name in (property_name,

616

property_name + "_dbus_property"):

554

property_name + u"_dbus_property"):

617

555

prop = getattr(self, name, None)

618

556

if (prop is None

619

557

or not self._is_dbus_property(prop)

623

561

continue

624

562

return prop

625

563

# No such property

626

raise DBusPropertyNotFound(self.dbus_object_path + ":"

627

+ interface_name + "."

564

raise DBusPropertyNotFound(self.dbus_object_path + u":"

565

+ interface_name + u"."

628

566

+ property_name)

629

567

630

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

631

out_signature="v")

568

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

569

out_signature=u"v")

632

570

def Get(self, interface_name, property_name):

633

571

"""Standard D-Bus property Get() method, see D-Bus standard.

634

572

"""

635

573

prop = self._get_dbus_property(interface_name, property_name)

636

if prop._dbus_access == "write":

574

if prop._dbus_access == u"write":

637

575

raise DBusPropertyAccessException(property_name)

638

576

value = prop()

639

if not hasattr(value, "variant_level"):

577

if not hasattr(value, u"variant_level"):

640

578

return value

641

579

return type(value)(value, variant_level=value.variant_level+1)

642

580

643

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

581

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

644

582

def Set(self, interface_name, property_name, value):

645

583

"""Standard D-Bus property Set() method, see D-Bus standard.

646

584

"""

647

585

prop = self._get_dbus_property(interface_name, property_name)

648

if prop._dbus_access == "read":

586

if prop._dbus_access == u"read":

649

587

raise DBusPropertyAccessException(property_name)

650

if prop._dbus_get_args_options["byte_arrays"]:

588

if prop._dbus_get_args_options[u"byte_arrays"]:

651

589

# The byte_arrays option is not supported yet on

652

590

# signatures other than "ay".

653

if prop._dbus_signature != "ay":

591

if prop._dbus_signature != u"ay":

654

592

raise ValueError

655

593

value = dbus.ByteArray(''.join(unichr(byte)

656

594

for byte in value))

657

595

prop(value)

658

596

659

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

660

out_signature="a{sv}")

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

598

out_signature=u"a{sv}")

661

599

def GetAll(self, interface_name):

662

600

"""Standard D-Bus property GetAll() method, see D-Bus

663

601

standard.

671

609

# Interface non-empty but did not match

672

610

continue

673

611

# Ignore write-only properties

674

if prop._dbus_access == "write":

612

if prop._dbus_access == u"write":

675

613

continue

676

614

value = prop()

677

if not hasattr(value, "variant_level"):

615

if not hasattr(value, u"variant_level"):

678

616

all[name] = value

679

617

continue

680

618

all[name] = type(value)(value, variant_level=

681

619

value.variant_level+1)

682

return dbus.Dictionary(all, signature="sv")

620

return dbus.Dictionary(all, signature=u"sv")

683

621

684

622

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

685

out_signature="s",

623

out_signature=u"s",

686

624

path_keyword='object_path',

687

625

connection_keyword='connection')

688

626

def Introspect(self, object_path, connection):

693

631

try:

694

632

document = xml.dom.minidom.parseString(xmlstring)

695

633

def make_tag(document, name, prop):

696

e = document.createElement("property")

697

e.setAttribute("name", name)

698

e.setAttribute("type", prop._dbus_signature)

699

e.setAttribute("access", prop._dbus_access)

634

e = document.createElement(u"property")

635

e.setAttribute(u"name", name)

636

e.setAttribute(u"type", prop._dbus_signature)

637

e.setAttribute(u"access", prop._dbus_access)

700

638

return e

701

for if_tag in document.getElementsByTagName("interface"):

639

for if_tag in document.getElementsByTagName(u"interface"):

702

640

for tag in (make_tag(document, name, prop)

703

641

for name, prop

704

642

in self._get_all_dbus_properties()

705

643

if prop._dbus_interface

706

== if_tag.getAttribute("name")):

644

== if_tag.getAttribute(u"name")):

707

645

if_tag.appendChild(tag)

708

646

# Add the names to the return values for the

709

647

# "org.freedesktop.DBus.Properties" methods

710

if (if_tag.getAttribute("name")

711

== "org.freedesktop.DBus.Properties"):

712

for cn in if_tag.getElementsByTagName("method"):

713

if cn.getAttribute("name") == "Get":

714

for arg in cn.getElementsByTagName("arg"):

715

if (arg.getAttribute("direction")

716

== "out"):

717

arg.setAttribute("name", "value")

718

elif cn.getAttribute("name") == "GetAll":

719

for arg in cn.getElementsByTagName("arg"):

720

if (arg.getAttribute("direction")

721

== "out"):

722

arg.setAttribute("name", "props")

723

xmlstring = document.toxml("utf-8")

648

if (if_tag.getAttribute(u"name")

649

== u"org.freedesktop.DBus.Properties"):

650

for cn in if_tag.getElementsByTagName(u"method"):

651

if cn.getAttribute(u"name") == u"Get":

652

for arg in cn.getElementsByTagName(u"arg"):

653

if (arg.getAttribute(u"direction")

654

== u"out"):

655

arg.setAttribute(u"name", u"value")

656

elif cn.getAttribute(u"name") == u"GetAll":

657

for arg in cn.getElementsByTagName(u"arg"):

658

if (arg.getAttribute(u"direction")

659

== u"out"):

660

arg.setAttribute(u"name", u"props")

661

xmlstring = document.toxml(u"utf-8")

724

662

document.unlink()

725

663

except (AttributeError, xml.dom.DOMException,

726

xml.parsers.expat.ExpatError) as error:

727

logger.error("Failed to override Introspection method",

664

xml.parsers.expat.ExpatError), error:

665

logger.error(u"Failed to override Introspection method",

728

666

error)

729

667

return xmlstring

730

668

736

674

dbus_object_path: dbus.ObjectPath

737

675

bus: dbus.SystemBus()

738

676

"""

739

740

runtime_expansions = (Client.runtime_expansions

741

+ ("dbus_object_path",))

742

743

677

# dbus.service.Object doesn't use super(), so we can't either.

744

678

745

679

def __init__(self, bus = None, *args, **kwargs):

746

self._approvals_pending = 0

747

680

self.bus = bus

748

681

Client.__init__(self, *args, **kwargs)

749

682

# Only now, when this client is initialized, can it show up on

750

683

# the D-Bus

751

client_object_name = unicode(self.name).translate(

752

{ord("."): ord("_"),

753

ord("-"): ord("_")})

754

684

self.dbus_object_path = (dbus.ObjectPath

755

("/clients/" + client_object_name))

685

(u"/clients/"

686

+ self.name.replace(u".", u"_")))

756

687

DBusObjectWithProperties.__init__(self, self.bus,

757

688

self.dbus_object_path)

758

759

def _get_approvals_pending(self):

760

return self._approvals_pending

761

def _set_approvals_pending(self, value):

762

old_value = self._approvals_pending

763

self._approvals_pending = value

764

bval = bool(value)

765

if (hasattr(self, "dbus_object_path")

766

and bval is not bool(old_value)):

767

dbus_bool = dbus.Boolean(bval, variant_level=1)

768

self.PropertyChanged(dbus.String("ApprovalPending"),

769

dbus_bool)

770

771

approvals_pending = property(_get_approvals_pending,

772

_set_approvals_pending)

773

del _get_approvals_pending, _set_approvals_pending

774

689

775

690

@staticmethod

776

691

def _datetime_to_dbus(dt, variant_level=0):

779

694

variant_level=variant_level)

780

695

781

696

def enable(self):

782

oldstate = getattr(self, "enabled", False)

697

oldstate = getattr(self, u"enabled", False)

783

698

r = Client.enable(self)

784

699

if oldstate != self.enabled:

785

700

# Emit D-Bus signals

786

self.PropertyChanged(dbus.String("Enabled"),

701

self.PropertyChanged(dbus.String(u"enabled"),

787

702

dbus.Boolean(True, variant_level=1))

788

703

self.PropertyChanged(

789

dbus.String("LastEnabled"),

704

dbus.String(u"last_enabled"),

790

705

self._datetime_to_dbus(self.last_enabled,

791

706

variant_level=1))

792

707

return r

793

708

794

709

def disable(self, quiet = False):

795

oldstate = getattr(self, "enabled", False)

710

oldstate = getattr(self, u"enabled", False)

796

711

r = Client.disable(self, quiet=quiet)

797

712

if not quiet and oldstate != self.enabled:

798

713

# Emit D-Bus signal

799

self.PropertyChanged(dbus.String("Enabled"),

714

self.PropertyChanged(dbus.String(u"enabled"),

800

715

dbus.Boolean(False, variant_level=1))

801

716

return r

802

717

805

720

self.remove_from_connection()

806

721

except LookupError:

807

722

pass

808

if hasattr(DBusObjectWithProperties, "__del__"):

723

if hasattr(DBusObjectWithProperties, u"__del__"):

809

724

DBusObjectWithProperties.__del__(self, *args, **kwargs)

810

725

Client.__del__(self, *args, **kwargs)

811

726

814

729

self.checker_callback_tag = None

815

730

self.checker = None

816

731

# Emit D-Bus signal

817

self.PropertyChanged(dbus.String("CheckerRunning"),

732

self.PropertyChanged(dbus.String(u"checker_running"),

818

733

dbus.Boolean(False, variant_level=1))

819

734

if os.WIFEXITED(condition):

820

735

exitstatus = os.WEXITSTATUS(condition)

832

747

*args, **kwargs)

833

748

834

749

def checked_ok(self, *args, **kwargs):

835

Client.checked_ok(self, *args, **kwargs)

750

r = Client.checked_ok(self, *args, **kwargs)

836

751

# Emit D-Bus signal

837

752

self.PropertyChanged(

838

dbus.String("LastCheckedOK"),

753

dbus.String(u"last_checked_ok"),

839

754

(self._datetime_to_dbus(self.last_checked_ok,

840

755

variant_level=1)))

841

842

def need_approval(self, *args, **kwargs):

843

r = Client.need_approval(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastApprovalRequest"),

847

(self._datetime_to_dbus(self.last_approval_request,

848

variant_level=1)))

849

756

return r

850

757

851

758

def start_checker(self, *args, **kwargs):

861

768

# Emit D-Bus signal

862

769

self.CheckerStarted(self.current_checker_command)

863

770

self.PropertyChanged(

864

dbus.String("CheckerRunning"),

771

dbus.String(u"checker_running"),

865

772

dbus.Boolean(True, variant_level=1))

866

773

return r

867

774

868

775

def stop_checker(self, *args, **kwargs):

869

old_checker = getattr(self, "checker", None)

776

old_checker = getattr(self, u"checker", None)

870

777

r = Client.stop_checker(self, *args, **kwargs)

871

778

if (old_checker is not None

872

and getattr(self, "checker", None) is None):

873

self.PropertyChanged(dbus.String("CheckerRunning"),

779

and getattr(self, u"checker", None) is None):

780

self.PropertyChanged(dbus.String(u"checker_running"),

874

781

dbus.Boolean(False, variant_level=1))

875

782

return r

876

877

def _reset_approved(self):

878

self._approved = None

879

return False

880

881

def approve(self, value=True):

882

self.send_changedstate()

883

self._approved = value

884

gobject.timeout_add(self._timedelta_to_milliseconds

885

(self.approval_duration),

886

self._reset_approved)

887

888

783

889

784

## D-Bus methods, signals & properties

890

_interface = "se.bsnet.fukt.Mandos.Client"

785

_interface = u"se.bsnet.fukt.Mandos.Client"

891

786

892

787

## Signals

893

788

894

789

# CheckerCompleted - signal

895

@dbus.service.signal(_interface, signature="nxs")

790

@dbus.service.signal(_interface, signature=u"nxs")

896

791

def CheckerCompleted(self, exitcode, waitstatus, command):

897

792

"D-Bus signal"

898

793

pass

899

794

900

795

# CheckerStarted - signal

901

@dbus.service.signal(_interface, signature="s")

796

@dbus.service.signal(_interface, signature=u"s")

902

797

def CheckerStarted(self, command):

903

798

"D-Bus signal"

904

799

pass

905

800

906

801

# PropertyChanged - signal

907

@dbus.service.signal(_interface, signature="sv")

802

@dbus.service.signal(_interface, signature=u"sv")

908

803

def PropertyChanged(self, property, value):

909

804

"D-Bus signal"

910

805

pass

912

807

# GotSecret - signal

913

808

@dbus.service.signal(_interface)

914

809

def GotSecret(self):

915

"""D-Bus signal

916

Is sent after a successful transfer of secret from the Mandos

917

server to mandos-client

918

"""

810

"D-Bus signal"

919

811

pass

920

812

921

813

# Rejected - signal

922

@dbus.service.signal(_interface, signature="s")

923

def Rejected(self, reason):

814

@dbus.service.signal(_interface)

815

def Rejected(self):

924

816

"D-Bus signal"

925

817

pass

926

818

927

# NeedApproval - signal

928

@dbus.service.signal(_interface, signature="tb")

929

def NeedApproval(self, timeout, default):

930

"D-Bus signal"

931

return self.need_approval()

932

933

819

## Methods

934

820

935

# Approve - method

936

@dbus.service.method(_interface, in_signature="b")

937

def Approve(self, value):

938

self.approve(value)

939

940

821

# CheckedOK - method

941

822

@dbus.service.method(_interface)

942

823

def CheckedOK(self):

943

self.checked_ok()

824

return self.checked_ok()

944

825

945

826

# Enable - method

946

827

@dbus.service.method(_interface)

967

848

968

849

## Properties

969

850

970

# ApprovalPending - property

971

@dbus_service_property(_interface, signature="b", access="read")

972

def ApprovalPending_dbus_property(self):

973

return dbus.Boolean(bool(self.approvals_pending))

974

975

# ApprovedByDefault - property

976

@dbus_service_property(_interface, signature="b",

977

access="readwrite")

978

def ApprovedByDefault_dbus_property(self, value=None):

979

if value is None: # get

980

return dbus.Boolean(self.approved_by_default)

981

self.approved_by_default = bool(value)

982

# Emit D-Bus signal

983

self.PropertyChanged(dbus.String("ApprovedByDefault"),

984

dbus.Boolean(value, variant_level=1))

985

986

# ApprovalDelay - property

987

@dbus_service_property(_interface, signature="t",

988

access="readwrite")

989

def ApprovalDelay_dbus_property(self, value=None):

990

if value is None: # get

991

return dbus.UInt64(self.approval_delay_milliseconds())

992

self.approval_delay = datetime.timedelta(0, 0, 0, value)

993

# Emit D-Bus signal

994

self.PropertyChanged(dbus.String("ApprovalDelay"),

995

dbus.UInt64(value, variant_level=1))

996

997

# ApprovalDuration - property

998

@dbus_service_property(_interface, signature="t",

999

access="readwrite")

1000

def ApprovalDuration_dbus_property(self, value=None):

1001

if value is None: # get

1002

return dbus.UInt64(self._timedelta_to_milliseconds(

1003

self.approval_duration))

1004

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1005

# Emit D-Bus signal

1006

self.PropertyChanged(dbus.String("ApprovalDuration"),

1007

dbus.UInt64(value, variant_level=1))

1008

1009

# Name - property

1010

@dbus_service_property(_interface, signature="s", access="read")

1011

def Name_dbus_property(self):

851

# name - property

852

@dbus_service_property(_interface, signature=u"s", access=u"read")

853

def name_dbus_property(self):

1012

854

return dbus.String(self.name)

1013

855

1014

# Fingerprint - property

1015

@dbus_service_property(_interface, signature="s", access="read")

1016

def Fingerprint_dbus_property(self):

856

# fingerprint - property

857

@dbus_service_property(_interface, signature=u"s", access=u"read")

858

def fingerprint_dbus_property(self):

1017

859

return dbus.String(self.fingerprint)

1018

860

1019

# Host - property

1020

@dbus_service_property(_interface, signature="s",

1021

access="readwrite")

1022

def Host_dbus_property(self, value=None):

861

# host - property

862

@dbus_service_property(_interface, signature=u"s",

863

access=u"readwrite")

864

def host_dbus_property(self, value=None):

1023

865

if value is None: # get

1024

866

return dbus.String(self.host)

1025

867

self.host = value

1026

868

# Emit D-Bus signal

1027

self.PropertyChanged(dbus.String("Host"),

869

self.PropertyChanged(dbus.String(u"host"),

1028

870

dbus.String(value, variant_level=1))

1029

871

1030

# Created - property

1031

@dbus_service_property(_interface, signature="s", access="read")

1032

def Created_dbus_property(self):

872

# created - property

873

@dbus_service_property(_interface, signature=u"s", access=u"read")

874

def created_dbus_property(self):

1033

875

return dbus.String(self._datetime_to_dbus(self.created))

1034

876

1035

# LastEnabled - property

1036

@dbus_service_property(_interface, signature="s", access="read")

1037

def LastEnabled_dbus_property(self):

877

# last_enabled - property

878

@dbus_service_property(_interface, signature=u"s", access=u"read")

879

def last_enabled_dbus_property(self):

1038

880

if self.last_enabled is None:

1039

return dbus.String("")

881

return dbus.String(u"")

1040

882

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1041

883

1042

# Enabled - property

1043

@dbus_service_property(_interface, signature="b",

1044

access="readwrite")

1045

def Enabled_dbus_property(self, value=None):

884

# enabled - property

885

@dbus_service_property(_interface, signature=u"b",

886

access=u"readwrite")

887

def enabled_dbus_property(self, value=None):

1046

888

if value is None: # get

1047

889

return dbus.Boolean(self.enabled)

1048

890

if value:

1050

892

else:

1051

893

self.disable()

1052

894

1053

# LastCheckedOK - property

1054

@dbus_service_property(_interface, signature="s",

1055

access="readwrite")

1056

def LastCheckedOK_dbus_property(self, value=None):

895

# last_checked_ok - property

896

@dbus_service_property(_interface, signature=u"s",

897

access=u"readwrite")

898

def last_checked_ok_dbus_property(self, value=None):

1057

899

if value is not None:

1058

900

self.checked_ok()

1059

901

return

1060

902

if self.last_checked_ok is None:

1061

return dbus.String("")

903

return dbus.String(u"")

1062

904

return dbus.String(self._datetime_to_dbus(self

1063

905

.last_checked_ok))

1064

906

1065

# LastApprovalRequest - property

1066

@dbus_service_property(_interface, signature="s", access="read")

1067

def LastApprovalRequest_dbus_property(self):

1068

if self.last_approval_request is None:

1069

return dbus.String("")

1070

return dbus.String(self.

1071

_datetime_to_dbus(self

1072

.last_approval_request))

1073

1074

# Timeout - property

1075

@dbus_service_property(_interface, signature="t",

1076

access="readwrite")

1077

def Timeout_dbus_property(self, value=None):

907

# timeout - property

908

@dbus_service_property(_interface, signature=u"t",

909

access=u"readwrite")

910

def timeout_dbus_property(self, value=None):

1078

911

if value is None: # get

1079

912

return dbus.UInt64(self.timeout_milliseconds())

1080

913

self.timeout = datetime.timedelta(0, 0, 0, value)

1081

914

# Emit D-Bus signal

1082

self.PropertyChanged(dbus.String("Timeout"),

915

self.PropertyChanged(dbus.String(u"timeout"),

1083

916

dbus.UInt64(value, variant_level=1))

1084

if getattr(self, "disable_initiator_tag", None) is None:

917

if getattr(self, u"disable_initiator_tag", None) is None:

1085

918

return

1086

919

# Reschedule timeout

1087

920

gobject.source_remove(self.disable_initiator_tag)

1099

932

self.disable_initiator_tag = (gobject.timeout_add

1100

933

(time_to_die, self.disable))

1101

934

1102

# Interval - property

1103

@dbus_service_property(_interface, signature="t",

1104

access="readwrite")

1105

def Interval_dbus_property(self, value=None):

935

# interval - property

936

@dbus_service_property(_interface, signature=u"t",

937

access=u"readwrite")

938

def interval_dbus_property(self, value=None):

1106

939

if value is None: # get

1107

940

return dbus.UInt64(self.interval_milliseconds())

1108

941

self.interval = datetime.timedelta(0, 0, 0, value)

1109

942

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Interval"),

943

self.PropertyChanged(dbus.String(u"interval"),

1111

944

dbus.UInt64(value, variant_level=1))

1112

if getattr(self, "checker_initiator_tag", None) is None:

945

if getattr(self, u"checker_initiator_tag", None) is None:

1113

946

return

1114

947

# Reschedule checker run

1115

948

gobject.source_remove(self.checker_initiator_tag)

1117

950

(value, self.start_checker))

1118

951

self.start_checker() # Start one now, too

1119

952

1120

# Checker - property

1121

@dbus_service_property(_interface, signature="s",

1122

access="readwrite")

1123

def Checker_dbus_property(self, value=None):

953

# checker - property

954

@dbus_service_property(_interface, signature=u"s",

955

access=u"readwrite")

956

def checker_dbus_property(self, value=None):

1124

957

if value is None: # get

1125

958

return dbus.String(self.checker_command)

1126

959

self.checker_command = value

1127

960

# Emit D-Bus signal

1128

self.PropertyChanged(dbus.String("Checker"),

961

self.PropertyChanged(dbus.String(u"checker"),

1129

962

dbus.String(self.checker_command,

1130

963

variant_level=1))

1131

964

1132

# CheckerRunning - property

1133

@dbus_service_property(_interface, signature="b",

1134

access="readwrite")

1135

def CheckerRunning_dbus_property(self, value=None):

965

# checker_running - property

966

@dbus_service_property(_interface, signature=u"b",

967

access=u"readwrite")

968

def checker_running_dbus_property(self, value=None):

1136

969

if value is None: # get

1137

970

return dbus.Boolean(self.checker is not None)

1138

971

if value:

1140

973

else:

1141

974

self.stop_checker()

1142

975

1143

# ObjectPath - property

1144

@dbus_service_property(_interface, signature="o", access="read")

1145

def ObjectPath_dbus_property(self):

976

# object_path - property

977

@dbus_service_property(_interface, signature=u"o", access=u"read")

978

def object_path_dbus_property(self):

1146

979

return self.dbus_object_path # is already a dbus.ObjectPath

1147

980

1148

# Secret = property

1149

@dbus_service_property(_interface, signature="ay",

1150

access="write", byte_arrays=True)

1151

def Secret_dbus_property(self, value):

981

# secret = property

982

@dbus_service_property(_interface, signature=u"ay",

983

access=u"write", byte_arrays=True)

984

def secret_dbus_property(self, value):

1152

985

self.secret = str(value)

1153

986

1154

987

del _interface

1155

988

1156

989

1157

class ProxyClient(object):

1158

def __init__(self, child_pipe, fpr, address):

1159

self._pipe = child_pipe

1160

self._pipe.send(('init', fpr, address))

1161

if not self._pipe.recv():

1162

raise KeyError()

1163

1164

def __getattribute__(self, name):

1165

if(name == '_pipe'):

1166

return super(ProxyClient, self).__getattribute__(name)

1167

self._pipe.send(('getattr', name))

1168

data = self._pipe.recv()

1169

if data[0] == 'data':

1170

return data[1]

1171

if data[0] == 'function':

1172

def func(*args, **kwargs):

1173

self._pipe.send(('funcall', name, args, kwargs))

1174

return self._pipe.recv()[1]

1175

return func

1176

1177

def __setattr__(self, name, value):

1178

if(name == '_pipe'):

1179

return super(ProxyClient, self).__setattr__(name, value)

1180

self._pipe.send(('setattr', name, value))

1181

1182

1183

990

class ClientHandler(socketserver.BaseRequestHandler, object):

1184

991

"""A class to handle client connections.

1185

992

1187

994

Note: This will run in its own forked process."""

1188

995

1189

996

def handle(self):

1190

with contextlib.closing(self.server.child_pipe) as child_pipe:

1191

logger.info("TCP connection from: %s",

1192

unicode(self.client_address))

1193

logger.debug("Pipe FD: %d",

1194

self.server.child_pipe.fileno())

1195

997

logger.info(u"TCP connection from: %s",

998

unicode(self.client_address))

999

logger.debug(u"IPC Pipe FD: %d",

1000

self.server.child_pipe[1].fileno())

1001

# Open IPC pipe to parent process

1002

with contextlib.nested(self.server.child_pipe[1],

1003

self.server.parent_pipe[0]

1004

) as (ipc, ipc_return):

1196

1005

session = (gnutls.connection

1197

1006

.ClientSession(self.request,

1198

1007

gnutls.connection

1199

1008

.X509Credentials()))

1200

1009

1201

1010

# Note: gnutls.connection.X509Credentials is really a

1202

1011

# generic GnuTLS certificate credentials object so long as

1203

1012

# no X.509 keys are added to it. Therefore, we can use it

1204

1013

# here despite using OpenPGP certificates.

1205

1206

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1207

# "+AES-256-CBC", "+SHA1",

1208

# "+COMP-NULL", "+CTYPE-OPENPGP",

1209

# "+DHE-DSS"))

1014

1015

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1016

# u"+AES-256-CBC", u"+SHA1",

1017

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1018

# u"+DHE-DSS"))

1210

1019

# Use a fallback default, since this MUST be set.

1211

1020

priority = self.server.gnutls_priority

1212

1021

if priority is None:

1213

priority = "NORMAL"

1022

priority = u"NORMAL"

1214

1023

(gnutls.library.functions

1215

1024

.gnutls_priority_set_direct(session._c_object,

1216

1025

priority, None))

1217

1026

1218

1027

# Start communication using the Mandos protocol

1219

1028

# Get protocol number

1220

1029

line = self.request.makefile().readline()

1221

logger.debug("Protocol version: %r", line)

1030

logger.debug(u"Protocol version: %r", line)

1222

1031

try:

1223

1032

if int(line.strip().split()[0]) > 1:

1224

1033

raise RuntimeError

1225

except (ValueError, IndexError, RuntimeError) as error:

1226

logger.error("Unknown protocol version: %s", error)

1034

except (ValueError, IndexError, RuntimeError), error:

1035

logger.error(u"Unknown protocol version: %s", error)

1227

1036

return

1228

1037

1229

1038

# Start GnuTLS connection

1230

1039

try:

1231

1040

session.handshake()

1232

except gnutls.errors.GNUTLSError as error:

1233

logger.warning("Handshake failed: %s", error)

1041

except gnutls.errors.GNUTLSError, error:

1042

logger.warning(u"Handshake failed: %s", error)

1234

1043

# Do not run session.bye() here: the session is not

1235

1044

# established. Just abandon the request.

1236

1045

return

1237

logger.debug("Handshake succeeded")

1238

1239

approval_required = False

1046

logger.debug(u"Handshake succeeded")

1240

1047

try:

1241

1048

try:

1242

1049

fpr = self.fingerprint(self.peer_certificate

1243

1050

(session))

1244

except (TypeError,

1245

gnutls.errors.GNUTLSError) as error:

1246

logger.warning("Bad certificate: %s", error)

1051

except (TypeError, gnutls.errors.GNUTLSError), error:

1052

logger.warning(u"Bad certificate: %s", error)

1247

1053

return

1248

logger.debug("Fingerprint: %s", fpr)

1054

logger.debug(u"Fingerprint: %s", fpr)

1249

1055

1250

try:

1251

client = ProxyClient(child_pipe, fpr,

1252

self.client_address)

1253

except KeyError:

1254

return

1255

1256

if client.approval_delay:

1257

delay = client.approval_delay

1258

client.approvals_pending += 1

1259

approval_required = True

1260

1261

while True:

1262

if not client.enabled:

1263

logger.warning("Client %s is disabled",

1264

client.name)

1265

if self.server.use_dbus:

1266

# Emit D-Bus signal

1267

client.Rejected("Disabled")

1268

return

1269

1270

if client._approved or not client.approval_delay:

1271

#We are approved or approval is disabled

1056

for c in self.server.clients:

1057

if c.fingerprint == fpr:

1058

client = c

1272

1059

break

1273

elif client._approved is None:

1274

logger.info("Client %s needs approval",

1275

client.name)

1276

if self.server.use_dbus:

1277

# Emit D-Bus signal

1278

client.NeedApproval(

1279

client.approval_delay_milliseconds(),

1280

client.approved_by_default)

1281

else:

1282

logger.warning("Client %s was not approved",

1283

client.name)

1284

if self.server.use_dbus:

1285

# Emit D-Bus signal

1286

client.Rejected("Denied")

1287

return

1288

1289

#wait until timeout or approved

1290

#x = float(client._timedelta_to_milliseconds(delay))

1291

time = datetime.datetime.now()

1292

client.changedstate.acquire()

1293

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1294

client.changedstate.release()

1295

time2 = datetime.datetime.now()

1296

if (time2 - time) >= delay:

1297

if not client.approved_by_default:

1298

logger.warning("Client %s timed out while"

1299

" waiting for approval",

1300

client.name)

1301

if self.server.use_dbus:

1302

# Emit D-Bus signal

1303

client.Rejected("Approval timed out")

1304

return

1305

else:

1306

break

1307

else:

1308

delay -= time2 - time

1309

1060

else:

1061

ipc.write(u"NOTFOUND %s %s\n"

1062

% (fpr, unicode(self.client_address)))

1063

return

1064

1065

class ClientProxy(object):

1066

"""Client proxy object. Not for calling methods."""

1067

def __init__(self, client):

1068

self.client = client

1069

def __getattr__(self, name):

1070

if name.startswith("ipc_"):

1071

def tempfunc():

1072

ipc.write("%s %s\n" % (name[4:].upper(),

1073

self.client.name))

1074

return tempfunc

1075

if not hasattr(self.client, name):

1076

raise AttributeError

1077

ipc.write(u"GETATTR %s %s\n"

1078

% (name, self.client.fingerprint))

1079

return pickle.load(ipc_return)

1080

clientproxy = ClientProxy(client)

1081

# Have to check if client.enabled, since it is

1082

# possible that the client was disabled since the

1083

# GnuTLS session was established.

1084

if not clientproxy.enabled:

1085

clientproxy.ipc_disabled()

1086

return

1087

1088

clientproxy.ipc_sending()

1310

1089

sent_size = 0

1311

1090

while sent_size < len(client.secret):

1312

try:

1313

sent = session.send(client.secret[sent_size:])

1314

except gnutls.errors.GNUTLSError as error:

1315

logger.warning("gnutls send failed")

1316

return

1317

logger.debug("Sent: %d, remaining: %d",

1091

sent = session.send(client.secret[sent_size:])

1092

logger.debug(u"Sent: %d, remaining: %d",

1318

1093

sent, len(client.secret)

1319

1094

- (sent_size + sent))

1320

1095

sent_size += sent

1321

1322

logger.info("Sending secret to %s", client.name)

1323

# bump the timeout as if seen

1324

client.checked_ok()

1325

if self.server.use_dbus:

1326

# Emit D-Bus signal

1327

client.GotSecret()

1328

1329

1096

finally:

1330

if approval_required:

1331

client.approvals_pending -= 1

1332

try:

1333

session.bye()

1334

except gnutls.errors.GNUTLSError as error:

1335

logger.warning("GnuTLS bye failed")

1097

session.bye()

1336

1098

1337

1099

@staticmethod

1338

1100

def peer_certificate(session):

1348

1110

.gnutls_certificate_get_peers

1349

1111

(session._c_object, ctypes.byref(list_size)))

1350

1112

if not bool(cert_list) and list_size.value != 0:

1351

raise gnutls.errors.GNUTLSError("error getting peer"

1352

" certificate")

1113

raise gnutls.errors.GNUTLSError(u"error getting peer"

1114

u" certificate")

1353

1115

if list_size.value == 0:

1354

1116

return None

1355

1117

cert = cert_list[0]

1381

1143

if crtverify.value != 0:

1382

1144

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1383

1145

raise (gnutls.errors.CertificateSecurityError

1384

("Verify failed"))

1146

(u"Verify failed"))

1385

1147

# New buffer for the fingerprint

1386

1148

buf = ctypes.create_string_buffer(20)

1387

1149

buf_len = ctypes.c_size_t()

1394

1156

# Convert the buffer to a Python bytestring

1395

1157

fpr = ctypes.string_at(buf, buf_len.value)

1396

1158

# Convert the bytestring to hexadecimal notation

1397

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1159

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1398

1160

return hex_fpr

1399

1161

1400

1162

1401

class MultiprocessingMixIn(object):

1402

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1403

def sub_process_main(self, request, address):

1404

try:

1405

self.finish_request(request, address)

1406

except:

1407

self.handle_error(request, address)

1408

self.close_request(request)

1409

1410

def process_request(self, request, address):

1411

"""Start a new process to process the request."""

1412

multiprocessing.Process(target = self.sub_process_main,

1413

args = (request, address)).start()

1414

1415

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1416

""" adds a pipe to the MixIn """

1163

class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):

1164

"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""

1417

1165

def process_request(self, request, client_address):

1418

1166

"""Overrides and wraps the original process_request().

1419

1167

1420

1168

This function creates a new pipe in self.pipe

1421

1169

"""

1422

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1423

1424

super(MultiprocessingMixInWithPipe,

1170

# Child writes to child_pipe

1171

self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1172

# Parent writes to parent_pipe

1173

self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1174

super(ForkingMixInWithPipes,

1425

1175

self).process_request(request, client_address)

1426

self.child_pipe.close()

1427

self.add_pipe(parent_pipe)

1428

1429

def add_pipe(self, parent_pipe):

1176

# Close unused ends for parent

1177

self.parent_pipe[0].close() # close read end

1178

self.child_pipe[1].close() # close write end

1179

self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])

1180

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1430

1181

"""Dummy function; override as necessary"""

1431

raise NotImplementedError

1432

1433

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1182

child_pipe_fd.close()

1183

parent_pipe_fd.close()

1184

1185

1186

class IPv6_TCPServer(ForkingMixInWithPipes,

1434

1187

socketserver.TCPServer, object):

1435

1188

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1436

1189

1452

1205

bind to an address or port if they were not specified."""

1453

1206

if self.interface is not None:

1454

1207

if SO_BINDTODEVICE is None:

1455

logger.error("SO_BINDTODEVICE does not exist;"

1456

" cannot bind to interface %s",

1208

logger.error(u"SO_BINDTODEVICE does not exist;"

1209

u" cannot bind to interface %s",

1457

1210

self.interface)

1458

1211

else:

1459

1212

try:

1460

1213

self.socket.setsockopt(socket.SOL_SOCKET,

1461

1214

SO_BINDTODEVICE,

1462

1215

str(self.interface

1463

+ '\0'))

1464

except socket.error as error:

1216

+ u'\0'))

1217

except socket.error, error:

1465

1218

if error[0] == errno.EPERM:

1466

logger.error("No permission to"

1467

" bind to interface %s",

1219

logger.error(u"No permission to"

1220

u" bind to interface %s",

1468

1221

self.interface)

1469

1222

elif error[0] == errno.ENOPROTOOPT:

1470

logger.error("SO_BINDTODEVICE not available;"

1471

" cannot bind to interface %s",

1223

logger.error(u"SO_BINDTODEVICE not available;"

1224

u" cannot bind to interface %s",

1472

1225

self.interface)

1473

1226

else:

1474

1227

raise

1476

1229

if self.server_address[0] or self.server_address[1]:

1477

1230

if not self.server_address[0]:

1478

1231

if self.address_family == socket.AF_INET6:

1479

any_address = "::" # in6addr_any

1232

any_address = u"::" # in6addr_any

1480

1233

else:

1481

1234

any_address = socket.INADDR_ANY

1482

1235

self.server_address = (any_address,

1521

1274

return socketserver.TCPServer.server_activate(self)

1522

1275

def enable(self):

1523

1276

self.enabled = True

1524

def add_pipe(self, parent_pipe):

1277

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1525

1278

# Call "handle_ipc" for both data and EOF events

1526

gobject.io_add_watch(parent_pipe.fileno(),

1279

gobject.io_add_watch(child_pipe_fd.fileno(),

1527

1280

gobject.IO_IN | gobject.IO_HUP,

1528

1281

functools.partial(self.handle_ipc,

1529

parent_pipe = parent_pipe))

1530

1531

def handle_ipc(self, source, condition, parent_pipe=None,

1532

client_object=None):

1282

reply = parent_pipe_fd,

1283

sender= child_pipe_fd))

1284

def handle_ipc(self, source, condition, reply=None, sender=None):

1533

1285

condition_names = {

1534

gobject.IO_IN: "IN", # There is data to read.

1535

gobject.IO_OUT: "OUT", # Data can be written (without

1286

gobject.IO_IN: u"IN", # There is data to read.

1287

gobject.IO_OUT: u"OUT", # Data can be written (without

1536

1288

# blocking).

1537

gobject.IO_PRI: "PRI", # There is urgent data to read.

1538

gobject.IO_ERR: "ERR", # Error condition.

1539

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1289

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1290

gobject.IO_ERR: u"ERR", # Error condition.

1291

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1540

1292

# broken, usually for pipes and

1541

1293

# sockets).

1542

1294

}

1544

1296

for cond, name in

1545

1297

condition_names.iteritems()

1546

1298

if cond & condition)

1547

# error or the other end of multiprocessing.Pipe has closed

1548

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1549

return False

1550

1551

# Read a request from the child

1552

request = parent_pipe.recv()

1553

command = request[0]

1554

1555

if command == 'init':

1556

fpr = request[1]

1557

address = request[2]

1558

1559

for c in self.clients:

1560

if c.fingerprint == fpr:

1561

client = c

1562

break

1563

else:

1564

logger.warning("Client not found for fingerprint: %s, ad"

1565

"dress: %s", fpr, address)

1566

if self.use_dbus:

1567

# Emit D-Bus signal

1568

mandos_dbus_service.ClientNotFound(fpr, address[0])

1569

parent_pipe.send(False)

1570

return False

1571

1572

gobject.io_add_watch(parent_pipe.fileno(),

1573

gobject.IO_IN | gobject.IO_HUP,

1574

functools.partial(self.handle_ipc,

1575

parent_pipe = parent_pipe,

1576

client_object = client))

1577

parent_pipe.send(True)

1578

# remove the old hook in favor of the new above hook on same fileno

1579

return False

1580

if command == 'funcall':

1581

funcname = request[1]

1582

args = request[2]

1583

kwargs = request[3]

1584

1585

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1586

1587

if command == 'getattr':

1588

attrname = request[1]

1589

if callable(client_object.__getattribute__(attrname)):

1590

parent_pipe.send(('function',))

1591

else:

1592

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1593

1594

if command == 'setattr':

1595

attrname = request[1]

1596

value = request[2]

1597

setattr(client_object, attrname, value)

1598

1299

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1300

conditions_string)

1301

1302

# Read a line from the file object

1303

cmdline = sender.readline()

1304

if not cmdline: # Empty line means end of file

1305

# close the IPC pipes

1306

sender.close()

1307

reply.close()

1308

1309

# Stop calling this function

1310

return False

1311

1312

logger.debug(u"IPC command: %r", cmdline)

1313

1314

# Parse and act on command

1315

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1316

1317

if cmd == u"NOTFOUND":

1318

fpr, address = args.split(None, 1)

1319

logger.warning(u"Client not found for fingerprint: %s, ad"

1320

u"dress: %s", fpr, address)

1321

if self.use_dbus:

1322

# Emit D-Bus signal

1323

mandos_dbus_service.ClientNotFound(fpr, address)

1324

elif cmd == u"DISABLED":

1325

for client in self.clients:

1326

if client.name == args:

1327

logger.warning(u"Client %s is disabled", args)

1328

if self.use_dbus:

1329

# Emit D-Bus signal

1330

client.Rejected()

1331

break

1332

else:

1333

logger.error(u"Unknown client %s is disabled", args)

1334

elif cmd == u"SENDING":

1335

for client in self.clients:

1336

if client.name == args:

1337

logger.info(u"Sending secret to %s", client.name)

1338

client.checked_ok()

1339

if self.use_dbus:

1340

# Emit D-Bus signal

1341

client.GotSecret()

1342

break

1343

else:

1344

logger.error(u"Sending secret to unknown client %s",

1345

args)

1346

elif cmd == u"GETATTR":

1347

attr_name, fpr = args.split(None, 1)

1348

for client in self.clients:

1349

if client.fingerprint == fpr:

1350

attr_value = getattr(client, attr_name, None)

1351

logger.debug("IPC reply: %r", attr_value)

1352

pickle.dump(attr_value, reply)

1353

break

1354

else:

1355

logger.error(u"Client %s on address %s requesting "

1356

u"attribute %s not found", fpr, address,

1357

attr_name)

1358

pickle.dump(None, reply)

1359

else:

1360

logger.error(u"Unknown IPC command: %r", cmdline)

1361

1362

# Keep calling this function

1599

1363

return True

1600

1364

1601

1365

1602

1366

def string_to_delta(interval):

1603

1367

"""Parse a string and return a datetime.timedelta

1604

1368

1605

>>> string_to_delta('7d')

1369

>>> string_to_delta(u'7d')

1606

1370

datetime.timedelta(7)

1607

>>> string_to_delta('60s')

1371

>>> string_to_delta(u'60s')

1608

1372

datetime.timedelta(0, 60)

1609

>>> string_to_delta('60m')

1373

>>> string_to_delta(u'60m')

1610

1374

datetime.timedelta(0, 3600)

1611

>>> string_to_delta('24h')

1375

>>> string_to_delta(u'24h')

1612

1376

datetime.timedelta(1)

1613

>>> string_to_delta('1w')

1377

>>> string_to_delta(u'1w')

1614

1378

datetime.timedelta(7)

1615

>>> string_to_delta('5m 30s')

1379

>>> string_to_delta(u'5m 30s')

1616

1380

datetime.timedelta(0, 330)

1617

1381

"""

1618

1382

timevalue = datetime.timedelta(0)

1620

1384

try:

1621

1385

suffix = unicode(s[-1])

1622

1386

value = int(s[:-1])

1623

if suffix == "d":

1387

if suffix == u"d":

1624

1388

delta = datetime.timedelta(value)

1625

elif suffix == "s":

1389

elif suffix == u"s":

1626

1390

delta = datetime.timedelta(0, value)

1627

elif suffix == "m":

1391

elif suffix == u"m":

1628

1392

delta = datetime.timedelta(0, 0, 0, 0, value)

1629

elif suffix == "h":

1393

elif suffix == u"h":

1630

1394

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1631

elif suffix == "w":

1395

elif suffix == u"w":

1632

1396

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1633

1397

else:

1634

raise ValueError("Unknown suffix %r" % suffix)

1635

except (ValueError, IndexError) as e:

1636

raise ValueError(*(e.args))

1398

raise ValueError(u"Unknown suffix %r" % suffix)

1399

except (ValueError, IndexError), e:

1400

raise ValueError(e.message)

1637

1401

timevalue += delta

1638

1402

return timevalue

1639

1403

1645

1409

global if_nametoindex

1646

1410

try:

1647

1411

if_nametoindex = (ctypes.cdll.LoadLibrary

1648

(ctypes.util.find_library("c"))

1412

(ctypes.util.find_library(u"c"))

1649

1413

.if_nametoindex)

1650

1414

except (OSError, AttributeError):

1651

logger.warning("Doing if_nametoindex the hard way")

1415

logger.warning(u"Doing if_nametoindex the hard way")

1652

1416

def if_nametoindex(interface):

1653

1417

"Get an interface index the hard way, i.e. using fcntl()"

1654

1418

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1655

1419

with contextlib.closing(socket.socket()) as s:

1656

1420

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1657

struct.pack(str("16s16x"),

1421

struct.pack(str(u"16s16x"),

1658

1422

interface))

1659

interface_index = struct.unpack(str("I"),

1423

interface_index = struct.unpack(str(u"I"),

1660

1424

ifreq[16:20])[0]

1661

1425

return interface_index

1662

1426

return if_nametoindex(interface)

1670

1434

sys.exit()

1671

1435

os.setsid()

1672

1436

if not nochdir:

1673

os.chdir("/")

1437

os.chdir(u"/")

1674

1438

if os.fork():

1675

1439

sys.exit()

1676

1440

if not noclose:

1678

1442

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1679

1443

if not stat.S_ISCHR(os.fstat(null).st_mode):

1680

1444

raise OSError(errno.ENODEV,

1681

"%s not a character device"

1445

u"%s not a character device"

1682

1446

% os.path.devnull)

1683

1447

os.dup2(null, sys.stdin.fileno())

1684

1448

os.dup2(null, sys.stdout.fileno())

1692

1456

##################################################################

1693

1457

# Parsing of options, both command line and config file

1694

1458

1695

parser = argparse.ArgumentParser()

1696

parser.add_argument("-v", "--version", action="version",

1697

version = "%%(prog)s %s" % version,

1698

help="show version number and exit")

1699

parser.add_argument("-i", "--interface", metavar="IF",

1700

help="Bind to interface IF")

1701

parser.add_argument("-a", "--address",

1702

help="Address to listen for requests on")

1703

parser.add_argument("-p", "--port", type=int,

1704

help="Port number to receive requests on")

1705

parser.add_argument("--check", action="store_true",

1706

help="Run self-test")

1707

parser.add_argument("--debug", action="store_true",

1708

help="Debug mode; run in foreground and log"

1709

" to terminal")

1710

parser.add_argument("--debuglevel", metavar="LEVEL",

1711

help="Debug level for stdout output")

1712

parser.add_argument("--priority", help="GnuTLS"

1713

" priority string (see GnuTLS documentation)")

1714

parser.add_argument("--servicename",

1715

metavar="NAME", help="Zeroconf service name")

1716

parser.add_argument("--configdir",

1717

default="/etc/mandos", metavar="DIR",

1718

help="Directory to search for configuration"

1719

" files")

1720

parser.add_argument("--no-dbus", action="store_false",

1721

dest="use_dbus", help="Do not provide D-Bus"

1722

" system bus interface")

1723

parser.add_argument("--no-ipv6", action="store_false",

1724

dest="use_ipv6", help="Do not use IPv6")

1725

options = parser.parse_args()

1459

parser = optparse.OptionParser(version = "%%prog %s" % version)

1460

parser.add_option("-i", u"--interface", type=u"string",

1461

metavar="IF", help=u"Bind to interface IF")

1462

parser.add_option("-a", u"--address", type=u"string",

1463

help=u"Address to listen for requests on")

1464

parser.add_option("-p", u"--port", type=u"int",

1465

help=u"Port number to receive requests on")

1466

parser.add_option("--check", action=u"store_true",

1467

help=u"Run self-test")

1468

parser.add_option("--debug", action=u"store_true",

1469

help=u"Debug mode; run in foreground and log to"

1470

u" terminal")

1471

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1472

u" priority string (see GnuTLS documentation)")

1473

parser.add_option("--servicename", type=u"string",

1474

metavar=u"NAME", help=u"Zeroconf service name")

1475

parser.add_option("--configdir", type=u"string",

1476

default=u"/etc/mandos", metavar=u"DIR",

1477

help=u"Directory to search for configuration"

1478

u" files")

1479

parser.add_option("--no-dbus", action=u"store_false",

1480

dest=u"use_dbus", help=u"Do not provide D-Bus"

1481

u" system bus interface")

1482

parser.add_option("--no-ipv6", action=u"store_false",

1483

dest=u"use_ipv6", help=u"Do not use IPv6")

1484

options = parser.parse_args()[0]

1726

1485

1727

1486

if options.check:

1728

1487

import doctest

1730

1489

sys.exit()

1731

1490

1732

1491

# Default values for config file for server-global settings

1733

server_defaults = { "interface": "",

1734

"address": "",

1735

"port": "",

1736

"debug": "False",

1737

"priority":

1738

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1739

"servicename": "Mandos",

1740

"use_dbus": "True",

1741

"use_ipv6": "True",

1742

"debuglevel": "",

1492

server_defaults = { u"interface": u"",

1493

u"address": u"",

1494

u"port": u"",

1495

u"debug": u"False",

1496

u"priority":

1497

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1498

u"servicename": u"Mandos",

1499

u"use_dbus": u"True",

1500

u"use_ipv6": u"True",

1743

1501

}

1744

1502

1745

1503

# Parse config file for server-global settings

1746

1504

server_config = configparser.SafeConfigParser(server_defaults)

1747

1505

del server_defaults

1748

1506

server_config.read(os.path.join(options.configdir,

1749

"mandos.conf"))

1507

u"mandos.conf"))

1750

1508

# Convert the SafeConfigParser object to a dict

1751

1509

server_settings = server_config.defaults()

1752

1510

# Use the appropriate methods on the non-string config options

1753

for option in ("debug", "use_dbus", "use_ipv6"):

1754

server_settings[option] = server_config.getboolean("DEFAULT",

1511

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1512

server_settings[option] = server_config.getboolean(u"DEFAULT",

1755

1513

option)

1756

1514

if server_settings["port"]:

1757

server_settings["port"] = server_config.getint("DEFAULT",

1758

"port")

1515

server_settings["port"] = server_config.getint(u"DEFAULT",

1516

u"port")

1759

1517

del server_config

1760

1518

1761

1519

# Override the settings from the config file with command line

1762

1520

# options, if set.

1763

for option in ("interface", "address", "port", "debug",

1764

"priority", "servicename", "configdir",

1765

"use_dbus", "use_ipv6", "debuglevel"):

1521

for option in (u"interface", u"address", u"port", u"debug",

1522

u"priority", u"servicename", u"configdir",

1523

u"use_dbus", u"use_ipv6"):

1766

1524

value = getattr(options, option)

1767

1525

if value is not None:

1768

1526

server_settings[option] = value

1776

1534

##################################################################

1777

1535

1778

1536

# For convenience

1779

debug = server_settings["debug"]

1780

debuglevel = server_settings["debuglevel"]

1781

use_dbus = server_settings["use_dbus"]

1782

use_ipv6 = server_settings["use_ipv6"]

1783

1784

if server_settings["servicename"] != "Mandos":

1537

debug = server_settings[u"debug"]

1538

use_dbus = server_settings[u"use_dbus"]

1539

use_ipv6 = server_settings[u"use_ipv6"]

1540

1541

if not debug:

1542

syslogger.setLevel(logging.WARNING)

1543

console.setLevel(logging.WARNING)

1544

1545

if server_settings[u"servicename"] != u"Mandos":

1785

1546

syslogger.setFormatter(logging.Formatter

1786

('Mandos (%s) [%%(process)d]:'

1787

' %%(levelname)s: %%(message)s'

1788

% server_settings["servicename"]))

1547

(u'Mandos (%s) [%%(process)d]:'

1548

u' %%(levelname)s: %%(message)s'

1549

% server_settings[u"servicename"]))

1789

1550

1790

1551

# Parse config file with clients

1791

client_defaults = { "timeout": "1h",

1792

"interval": "5m",

1793

"checker": "fping -q -- %%(host)s",

1794

"host": "",

1795

"approval_delay": "0s",

1796

"approval_duration": "1s",

1552

client_defaults = { u"timeout": u"1h",

1553

u"interval": u"5m",

1554

u"checker": u"fping -q -- %%(host)s",

1555

u"host": u"",

1797

1556

}

1798

1557

client_config = configparser.SafeConfigParser(client_defaults)

1799

client_config.read(os.path.join(server_settings["configdir"],

1800

"clients.conf"))

1558

client_config.read(os.path.join(server_settings[u"configdir"],

1559

u"clients.conf"))

1801

1560

1802

1561

global mandos_dbus_service

1803

1562

mandos_dbus_service = None

1804

1563

1805

tcp_server = MandosServer((server_settings["address"],

1806

server_settings["port"]),

1564

tcp_server = MandosServer((server_settings[u"address"],

1565

server_settings[u"port"]),

1807

1566

ClientHandler,

1808

interface=(server_settings["interface"]

1809

or None),

1567

interface=server_settings[u"interface"],

1810

1568

use_ipv6=use_ipv6,

1811

1569

gnutls_priority=

1812

server_settings["priority"],

1570

server_settings[u"priority"],

1813

1571

use_dbus=use_dbus)

1814

if not debug:

1815

pidfilename = "/var/run/mandos.pid"

1816

try:

1817

pidfile = open(pidfilename, "w")

1818

except IOError:

1819

logger.error("Could not open file %r", pidfilename)

1572

pidfilename = u"/var/run/mandos.pid"

1573

try:

1574

pidfile = open(pidfilename, u"w")

1575

except IOError:

1576

logger.error(u"Could not open file %r", pidfilename)

1820

1577

1821

1578

try:

1822

uid = pwd.getpwnam("_mandos").pw_uid

1823

gid = pwd.getpwnam("_mandos").pw_gid

1579

uid = pwd.getpwnam(u"_mandos").pw_uid

1580

gid = pwd.getpwnam(u"_mandos").pw_gid

1824

1581

except KeyError:

1825

1582

try:

1826

uid = pwd.getpwnam("mandos").pw_uid

1827

gid = pwd.getpwnam("mandos").pw_gid

1583

uid = pwd.getpwnam(u"mandos").pw_uid

1584

gid = pwd.getpwnam(u"mandos").pw_gid

1828

1585

except KeyError:

1829

1586

try:

1830

uid = pwd.getpwnam("nobody").pw_uid

1831

gid = pwd.getpwnam("nobody").pw_gid

1587

uid = pwd.getpwnam(u"nobody").pw_uid

1588

gid = pwd.getpwnam(u"nobody").pw_gid

1832

1589

except KeyError:

1833

1590

uid = 65534

1834

1591

gid = 65534

1835

1592

try:

1836

1593

os.setgid(gid)

1837

1594

os.setuid(uid)

1838

except OSError as error:

1595

except OSError, error:

1839

1596

if error[0] != errno.EPERM:

1840

1597

raise error

1841

1598

1842

if not debug and not debuglevel:

1843

syslogger.setLevel(logging.WARNING)

1844

console.setLevel(logging.WARNING)

1845

if debuglevel:

1846

level = getattr(logging, debuglevel.upper())

1847

syslogger.setLevel(level)

1848

console.setLevel(level)

1849

1599

# Enable all possible GnuTLS debugging

1850

1600

if debug:

1851

# Enable all possible GnuTLS debugging

1852

1853

1601

# "Use a log level over 10 to enable all debugging options."

1854

1602

# - GnuTLS manual

1855

1603

gnutls.library.functions.gnutls_global_set_log_level(11)

1856

1604

1857

1605

@gnutls.library.types.gnutls_log_func

1858

1606

def debug_gnutls(level, string):

1859

logger.debug("GnuTLS: %s", string[:-1])

1607

logger.debug(u"GnuTLS: %s", string[:-1])

1860

1608

1861

1609

(gnutls.library.functions

1862

1610

.gnutls_global_set_log_function(debug_gnutls))

1863

1864

# Redirect stdin so all checkers get /dev/null

1865

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1866

os.dup2(null, sys.stdin.fileno())

1867

if null > 2:

1868

os.close(null)

1869

else:

1870

# No console logging

1871

logger.removeHandler(console)

1872

1873

# Need to fork before connecting to D-Bus

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1611

1878

1612

global main_loop

1879

1613

# From the Avahi example code

1883

1617

# End of Avahi example code

1884

1618

if use_dbus:

1885

1619

try:

1886

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1620

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1887

1621

bus, do_not_queue=True)

1888

except dbus.exceptions.NameExistsException as e:

1889

logger.error(unicode(e) + ", disabling D-Bus")

1622

except dbus.exceptions.NameExistsException, e:

1623

logger.error(unicode(e) + u", disabling D-Bus")

1890

1624

use_dbus = False

1891

server_settings["use_dbus"] = False

1625

server_settings[u"use_dbus"] = False

1892

1626

tcp_server.use_dbus = False

1893

1627

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1894

service = AvahiService(name = server_settings["servicename"],

1895

servicetype = "_mandos._tcp",

1628

service = AvahiService(name = server_settings[u"servicename"],

1629

servicetype = u"_mandos._tcp",

1896

1630

protocol = protocol, bus = bus)

1897

1631

if server_settings["interface"]:

1898

1632

service.interface = (if_nametoindex

1899

(str(server_settings["interface"])))

1900

1901

global multiprocessing_manager

1902

multiprocessing_manager = multiprocessing.Manager()

1633

(str(server_settings[u"interface"])))

1903

1634

1904

1635

client_class = Client

1905

1636

if use_dbus:

1906

1637

client_class = functools.partial(ClientDBus, bus = bus)

1907

def client_config_items(config, section):

1908

special_settings = {

1909

"approved_by_default":

1910

lambda: config.getboolean(section,

1911

"approved_by_default"),

1912

}

1913

for name, value in config.items(section):

1914

try:

1915

yield (name, special_settings[name]())

1916

except KeyError:

1917

yield (name, value)

1918

1919

1638

tcp_server.clients.update(set(

1920

1639

client_class(name = section,

1921

config= dict(client_config_items(

1922

client_config, section)))

1640

config= dict(client_config.items(section)))

1923

1641

for section in client_config.sections()))

1924

1642

if not tcp_server.clients:

1925

logger.warning("No clients defined")

1926

1643

logger.warning(u"No clients defined")

1644

1645

if debug:

1646

# Redirect stdin so all checkers get /dev/null

1647

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1648

os.dup2(null, sys.stdin.fileno())

1649

if null > 2:

1650

os.close(null)

1651

else:

1652

# No console logging

1653

logger.removeHandler(console)

1654

# Close all input and output, do double fork, etc.

1655

daemon()

1656

1657

try:

1658

with pidfile:

1659

pid = os.getpid()

1660

pidfile.write(str(pid) + "\n")

1661

del pidfile

1662

except IOError:

1663

logger.error(u"Could not write to file %r with PID %d",

1664

pidfilename, pid)

1665

except NameError:

1666

# "pidfile" was never created

1667

pass

1668

del pidfilename

1669

1927

1670

if not debug:

1928

try:

1929

with pidfile:

1930

pid = os.getpid()

1931

pidfile.write(str(pid) + "\n".encode("utf-8"))

1932

del pidfile

1933

except IOError:

1934

logger.error("Could not write to file %r with PID %d",

1935

pidfilename, pid)

1936

except NameError:

1937

# "pidfile" was never created

1938

pass

1939

del pidfilename

1940

1941

1671

signal.signal(signal.SIGINT, signal.SIG_IGN)

1942

1943

1672

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1944

1673

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1945

1674

1947

1676

class MandosDBusService(dbus.service.Object):

1948

1677

"""A D-Bus proxy object"""

1949

1678

def __init__(self):

1950

dbus.service.Object.__init__(self, bus, "/")

1951

_interface = "se.bsnet.fukt.Mandos"

1679

dbus.service.Object.__init__(self, bus, u"/")

1680

_interface = u"se.bsnet.fukt.Mandos"

1952

1681

1953

@dbus.service.signal(_interface, signature="o")

1682

@dbus.service.signal(_interface, signature=u"o")

1954

1683

def ClientAdded(self, objpath):

1955

1684

"D-Bus signal"

1956

1685

pass

1957

1686

1958

@dbus.service.signal(_interface, signature="ss")

1687

@dbus.service.signal(_interface, signature=u"ss")

1959

1688

def ClientNotFound(self, fingerprint, address):

1960

1689

"D-Bus signal"

1961

1690

pass

1962

1691

1963

@dbus.service.signal(_interface, signature="os")

1692

@dbus.service.signal(_interface, signature=u"os")

1964

1693

def ClientRemoved(self, objpath, name):

1965

1694

"D-Bus signal"

1966

1695

pass

1967

1696

1968

@dbus.service.method(_interface, out_signature="ao")

1697

@dbus.service.method(_interface, out_signature=u"ao")

1969

1698

def GetAllClients(self):

1970

1699

"D-Bus method"

1971

1700

return dbus.Array(c.dbus_object_path

1972

1701

for c in tcp_server.clients)

1973

1702

1974

1703

@dbus.service.method(_interface,

1975

out_signature="a{oa{sv}}")

1704

out_signature=u"a{oa{sv}}")

1976

1705

def GetAllClientsWithProperties(self):

1977

1706

"D-Bus method"

1978

1707

return dbus.Dictionary(

1979

((c.dbus_object_path, c.GetAll(""))

1708

((c.dbus_object_path, c.GetAll(u""))

1980

1709

for c in tcp_server.clients),

1981

signature="oa{sv}")

1710

signature=u"oa{sv}")

1982

1711

1983

@dbus.service.method(_interface, in_signature="o")

1712

@dbus.service.method(_interface, in_signature=u"o")

1984

1713

def RemoveClient(self, object_path):

1985

1714

"D-Bus method"

1986

1715

for c in tcp_server.clients:

2028

1757

# Find out what port we got

2029

1758

service.port = tcp_server.socket.getsockname()[1]

2030

1759

if use_ipv6:

2031

logger.info("Now listening on address %r, port %d,"

1760

logger.info(u"Now listening on address %r, port %d,"

2032

1761

" flowinfo %d, scope_id %d"

2033

1762

% tcp_server.socket.getsockname())

2034

1763

else: # IPv4

2035

logger.info("Now listening on address %r, port %d"

1764

logger.info(u"Now listening on address %r, port %d"

2036

1765

% tcp_server.socket.getsockname())

2037

1766

2038

1767

#service.interface = tcp_server.socket.getsockname()[3]

2041

1770

# From the Avahi example code

2042

1771

try:

2043

1772

service.activate()

2044

except dbus.exceptions.DBusException as error:

2045

logger.critical("DBusException: %s", error)

1773

except dbus.exceptions.DBusException, error:

1774

logger.critical(u"DBusException: %s", error)

2046

1775

cleanup()

2047

1776

sys.exit(1)

2048

1777

# End of Avahi example code

2052

1781

(tcp_server.handle_request

2053

1782

(*args[2:], **kwargs) or True))

2054

1783

2055

logger.debug("Starting main loop")

1784

logger.debug(u"Starting main loop")

2056

1785

main_loop.run()

2057

except AvahiError as error:

2058

logger.critical("AvahiError: %s", error)

1786

except AvahiError, error:

1787

logger.critical(u"AvahiError: %s", error)

2059

1788

cleanup()

2060

1789

sys.exit(1)

2061

1790

except KeyboardInterrupt:

2062

1791

if debug:

2063

print("", file=sys.stderr)

2064

logger.debug("Server received KeyboardInterrupt")

2065

logger.debug("Server exiting")

1792

print >> sys.stderr

1793

logger.debug(u"Server received KeyboardInterrupt")

1794

logger.debug(u"Server exiting")

2066

1795

# Must run before the D-Bus bus name gets deregistered

2067

1796

cleanup()

2068

1797