To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 420
- compare with another revision
- download diff
- download tarball
- view history from revision 420
- Committer: teddy at bsnet
- Date: 2010-09-09 18:28:57 UTC
- mfrom: (237.3.1 mandos-makefile-warning)
- Revision ID: teddy@fukt.bsnet.se-20100909182857-fuq4l9zetww2fyxw
* Makefile: Merge branch adding warning messages to "run-*" targets.
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
60
60
import fcntl
61
61
import functools
62
62
import cPickle as pickle
63
import multiprocessing
63
import select
64
64
65
65
import dbus
66
66
import dbus.service
83
83
84
84
version = "1.0.14"
85
85
86
#logger = logging.getLogger(u'mandos')
87
86
logger = logging.Logger(u'mandos')
88
87
syslogger = (logging.handlers.SysLogHandler
89
88
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
157
156
u" after %i retries, exiting.",
158
157
self.rename_count)
159
158
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
159
self.name = self.server.GetAlternativeServiceName(self.name)
161
160
logger.info(u"Changing Zeroconf service name to %r ...",
162
self.name)
161
unicode(self.name))
163
162
syslogger.setFormatter(logging.Formatter
164
163
(u'Mandos (%s) [%%(process)d]:'
165
164
u' %%(levelname)s: %%(message)s'
166
165
% self.name))
167
166
self.remove()
168
try:
169
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
172
self.cleanup()
173
os._exit(1)
167
self.add()
174
168
self.rename_count += 1
175
169
def remove(self):
176
170
"""Derived from the Avahi example code"""
240
234
"""A representation of a client host served by this server.
241
235
242
236
Attributes:
243
_approved: bool(); 'None' if not yet approved/disapproved
244
approval_delay: datetime.timedelta(); Time to wait for approval
245
approval_duration: datetime.timedelta(); Duration of one approval
237
name: string; from the config file, used in log messages and
238
D-Bus identifiers
239
fingerprint: string (40 or 32 hexadecimal digits); used to
240
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
244
last_enabled: datetime.datetime(); (UTC)
245
enabled: bool()
246
last_checked_ok: datetime.datetime(); (UTC) or None
247
timeout: datetime.timedelta(); How long from last_checked_ok
248
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
246
251
checker: subprocess.Popen(); a running checker process used
247
252
to see if the client lives.
248
253
'None' if no process is running.
249
checker_callback_tag: a gobject event source tag, or None
250
checker_command: string; External command which is run to check
251
if client lives. %() expansions are done at
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
252
259
runtime with vars(self) as dict, so that for
253
260
instance %(name)s can be used in the command.
254
checker_initiator_tag: a gobject event source tag, or None
255
created: datetime.datetime(); (UTC) object creation
256
261
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: a gobject event source tag, or None
259
enabled: bool()
260
fingerprint: string (40 or 32 hexadecimal digits); used to
261
uniquely identify the client
262
host: string; available for use by the checker command
263
interval: datetime.timedelta(); How often to start a new checker
264
last_approval_request: datetime.datetime(); (UTC) or None
265
last_checked_ok: datetime.datetime(); (UTC) or None
266
last_enabled: datetime.datetime(); (UTC)
267
name: string; from the config file, used in log messages and
268
D-Bus identifiers
269
secret: bytestring; sent verbatim (over TLS) to client
270
timeout: datetime.timedelta(); How long from last_checked_ok
271
until this client is disabled
272
runtime_expansions: Allowed attributes for runtime expansion.
273
262
"""
274
263
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
279
280
264
@staticmethod
281
265
def _timedelta_to_milliseconds(td):
282
266
"Convert a datetime.timedelta() to milliseconds"
291
275
def interval_milliseconds(self):
292
276
"Return the 'interval' attribute in milliseconds"
293
277
return self._timedelta_to_milliseconds(self.interval)
294
295
def approval_delay_milliseconds(self):
296
return self._timedelta_to_milliseconds(self.approval_delay)
297
278
298
279
def __init__(self, name = None, disable_hook=None, config=None):
299
280
"""Note: the 'checker' key in 'config' sets the
322
303
self.host = config.get(u"host", u"")
323
304
self.created = datetime.datetime.utcnow()
324
305
self.enabled = False
325
self.last_approval_request = None
326
306
self.last_enabled = None
327
307
self.last_checked_ok = None
328
308
self.timeout = string_to_delta(config[u"timeout"])
335
315
self.checker_command = config[u"checker"]
336
316
self.current_checker_command = None
337
317
self.last_connect = None
338
self._approved = None
339
self.approved_by_default = config.get(u"approved_by_default",
340
True)
341
self.approvals_pending = 0
342
self.approval_delay = string_to_delta(
343
config[u"approval_delay"])
344
self.approval_duration = string_to_delta(
345
config[u"approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
347
318
348
def send_changedstate(self):
349
self.changedstate.acquire()
350
self.changedstate.notify_all()
351
self.changedstate.release()
352
353
319
def enable(self):
354
320
"""Start this client's checker and timeout hooks"""
355
321
if getattr(self, u"enabled", False):
356
322
# Already enabled
357
323
return
358
self.send_changedstate()
359
324
self.last_enabled = datetime.datetime.utcnow()
360
325
# Schedule a new checker to be started an 'interval' from now,
361
326
# and every interval from then on.
375
340
if not getattr(self, "enabled", False):
376
341
return False
377
342
if not quiet:
378
self.send_changedstate()
379
if not quiet:
380
343
logger.info(u"Disabling client %s", self.name)
381
344
if getattr(self, u"disable_initiator_tag", False):
382
345
gobject.source_remove(self.disable_initiator_tag)
424
387
(self.timeout_milliseconds(),
425
388
self.disable))
426
389
427
def need_approval(self):
428
self.last_approval_request = datetime.datetime.utcnow()
429
430
390
def start_checker(self):
431
391
"""Start a new checker subprocess if one is not running.
432
392
461
421
command = self.checker_command % self.host
462
422
except TypeError:
463
423
# Escape attributes for the shell
464
escaped_attrs = dict(
465
(attr,
466
re.escape(unicode(str(getattr(self, attr, u"")),
467
errors=
468
u'replace')))
469
for attr in
470
self.runtime_expansions)
471
424
escaped_attrs = dict((key,
425
re.escape(unicode(str(val),
426
errors=
427
u'replace')))
428
for key, val in
429
vars(self).iteritems())
472
430
try:
473
431
command = self.checker_command % escaped_attrs
474
432
except TypeError, error:
520
478
raise
521
479
self.checker = None
522
480
481
523
482
def dbus_service_property(dbus_interface, signature=u"v",
524
483
access=u"readwrite", byte_arrays=False):
525
484
"""Decorators for marking methods of a DBusObjectWithProperties to
716
675
dbus_object_path: dbus.ObjectPath
717
676
bus: dbus.SystemBus()
718
677
"""
719
720
runtime_expansions = (Client.runtime_expansions
721
+ (u"dbus_object_path",))
722
723
678
# dbus.service.Object doesn't use super(), so we can't either.
724
679
725
680
def __init__(self, bus = None, *args, **kwargs):
726
self._approvals_pending = 0
727
681
self.bus = bus
728
682
Client.__init__(self, *args, **kwargs)
729
683
# Only now, when this client is initialized, can it show up on
730
684
# the D-Bus
731
client_object_name = unicode(self.name).translate(
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
734
685
self.dbus_object_path = (dbus.ObjectPath
735
(u"/clients/" + client_object_name))
686
(u"/clients/"
687
+ self.name.replace(u".", u"_")))
736
688
DBusObjectWithProperties.__init__(self, self.bus,
737
689
self.dbus_object_path)
738
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
744
bval = bool(value)
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
dbus_bool)
750
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
754
690
755
691
@staticmethod
756
692
def _datetime_to_dbus(dt, variant_level=0):
763
699
r = Client.enable(self)
764
700
if oldstate != self.enabled:
765
701
# Emit D-Bus signals
766
self.PropertyChanged(dbus.String(u"Enabled"),
702
self.PropertyChanged(dbus.String(u"enabled"),
767
703
dbus.Boolean(True, variant_level=1))
768
704
self.PropertyChanged(
769
dbus.String(u"LastEnabled"),
705
dbus.String(u"last_enabled"),
770
706
self._datetime_to_dbus(self.last_enabled,
771
707
variant_level=1))
772
708
return r
776
712
r = Client.disable(self, quiet=quiet)
777
713
if not quiet and oldstate != self.enabled:
778
714
# Emit D-Bus signal
779
self.PropertyChanged(dbus.String(u"Enabled"),
715
self.PropertyChanged(dbus.String(u"enabled"),
780
716
dbus.Boolean(False, variant_level=1))
781
717
return r
782
718
794
730
self.checker_callback_tag = None
795
731
self.checker = None
796
732
# Emit D-Bus signal
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
733
self.PropertyChanged(dbus.String(u"checker_running"),
798
734
dbus.Boolean(False, variant_level=1))
799
735
if os.WIFEXITED(condition):
800
736
exitstatus = os.WEXITSTATUS(condition)
815
751
r = Client.checked_ok(self, *args, **kwargs)
816
752
# Emit D-Bus signal
817
753
self.PropertyChanged(
818
dbus.String(u"LastCheckedOK"),
754
dbus.String(u"last_checked_ok"),
819
755
(self._datetime_to_dbus(self.last_checked_ok,
820
756
variant_level=1)))
821
757
return r
822
758
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
825
# Emit D-Bus signal
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
829
variant_level=1)))
830
return r
831
832
759
def start_checker(self, *args, **kwargs):
833
760
old_checker = self.checker
834
761
if self.checker is not None:
842
769
# Emit D-Bus signal
843
770
self.CheckerStarted(self.current_checker_command)
844
771
self.PropertyChanged(
845
dbus.String(u"CheckerRunning"),
772
dbus.String(u"checker_running"),
846
773
dbus.Boolean(True, variant_level=1))
847
774
return r
848
775
851
778
r = Client.stop_checker(self, *args, **kwargs)
852
779
if (old_checker is not None
853
780
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
781
self.PropertyChanged(dbus.String(u"checker_running"),
855
782
dbus.Boolean(False, variant_level=1))
856
783
return r
857
858
def _reset_approved(self):
859
self._approved = None
860
return False
861
862
def approve(self, value=True):
863
self.send_changedstate()
864
self._approved = value
865
gobject.timeout_add(self._timedelta_to_milliseconds
866
(self.approval_duration),
867
self._reset_approved)
868
869
784
870
785
## D-Bus methods, signals & properties
871
786
_interface = u"se.bsnet.fukt.Mandos.Client"
893
808
# GotSecret - signal
894
809
@dbus.service.signal(_interface)
895
810
def GotSecret(self):
896
"""D-Bus signal
897
Is sent after a successful transfer of secret from the Mandos
898
server to mandos-client
899
"""
811
"D-Bus signal"
900
812
pass
901
813
902
814
# Rejected - signal
903
@dbus.service.signal(_interface, signature=u"s")
904
def Rejected(self, reason):
815
@dbus.service.signal(_interface)
816
def Rejected(self):
905
817
"D-Bus signal"
906
818
pass
907
819
908
# NeedApproval - signal
909
@dbus.service.signal(_interface, signature=u"tb")
910
def NeedApproval(self, timeout, default):
911
"D-Bus signal"
912
return self.need_approval()
913
914
820
## Methods
915
821
916
# Approve - method
917
@dbus.service.method(_interface, in_signature=u"b")
918
def Approve(self, value):
919
self.approve(value)
920
921
822
# CheckedOK - method
922
823
@dbus.service.method(_interface)
923
824
def CheckedOK(self):
948
849
949
850
## Properties
950
851
951
# ApprovalPending - property
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
953
def ApprovalPending_dbus_property(self):
954
return dbus.Boolean(bool(self.approvals_pending))
955
956
# ApprovedByDefault - property
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
959
def ApprovedByDefault_dbus_property(self, value=None):
960
if value is None: # get
961
return dbus.Boolean(self.approved_by_default)
962
self.approved_by_default = bool(value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
966
967
# ApprovalDelay - property
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
970
def ApprovalDelay_dbus_property(self, value=None):
971
if value is None: # get
972
return dbus.UInt64(self.approval_delay_milliseconds())
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
# Emit D-Bus signal
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
977
978
# ApprovalDuration - property
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
981
def ApprovalDuration_dbus_property(self, value=None):
982
if value is None: # get
983
return dbus.UInt64(self._timedelta_to_milliseconds(
984
self.approval_duration))
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
# Emit D-Bus signal
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
989
990
# Name - property
852
# name - property
991
853
@dbus_service_property(_interface, signature=u"s", access=u"read")
992
def Name_dbus_property(self):
854
def name_dbus_property(self):
993
855
return dbus.String(self.name)
994
856
995
# Fingerprint - property
857
# fingerprint - property
996
858
@dbus_service_property(_interface, signature=u"s", access=u"read")
997
def Fingerprint_dbus_property(self):
859
def fingerprint_dbus_property(self):
998
860
return dbus.String(self.fingerprint)
999
861
1000
# Host - property
862
# host - property
1001
863
@dbus_service_property(_interface, signature=u"s",
1002
864
access=u"readwrite")
1003
def Host_dbus_property(self, value=None):
865
def host_dbus_property(self, value=None):
1004
866
if value is None: # get
1005
867
return dbus.String(self.host)
1006
868
self.host = value
1007
869
# Emit D-Bus signal
1008
self.PropertyChanged(dbus.String(u"Host"),
870
self.PropertyChanged(dbus.String(u"host"),
1009
871
dbus.String(value, variant_level=1))
1010
872
1011
# Created - property
873
# created - property
1012
874
@dbus_service_property(_interface, signature=u"s", access=u"read")
1013
def Created_dbus_property(self):
875
def created_dbus_property(self):
1014
876
return dbus.String(self._datetime_to_dbus(self.created))
1015
877
1016
# LastEnabled - property
878
# last_enabled - property
1017
879
@dbus_service_property(_interface, signature=u"s", access=u"read")
1018
def LastEnabled_dbus_property(self):
880
def last_enabled_dbus_property(self):
1019
881
if self.last_enabled is None:
1020
882
return dbus.String(u"")
1021
883
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1022
884
1023
# Enabled - property
885
# enabled - property
1024
886
@dbus_service_property(_interface, signature=u"b",
1025
887
access=u"readwrite")
1026
def Enabled_dbus_property(self, value=None):
888
def enabled_dbus_property(self, value=None):
1027
889
if value is None: # get
1028
890
return dbus.Boolean(self.enabled)
1029
891
if value:
1031
893
else:
1032
894
self.disable()
1033
895
1034
# LastCheckedOK - property
896
# last_checked_ok - property
1035
897
@dbus_service_property(_interface, signature=u"s",
1036
898
access=u"readwrite")
1037
def LastCheckedOK_dbus_property(self, value=None):
899
def last_checked_ok_dbus_property(self, value=None):
1038
900
if value is not None:
1039
901
self.checked_ok()
1040
902
return
1043
905
return dbus.String(self._datetime_to_dbus(self
1044
906
.last_checked_ok))
1045
907
1046
# LastApprovalRequest - property
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1048
def LastApprovalRequest_dbus_property(self):
1049
if self.last_approval_request is None:
1050
return dbus.String(u"")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1054
1055
# Timeout - property
908
# timeout - property
1056
909
@dbus_service_property(_interface, signature=u"t",
1057
910
access=u"readwrite")
1058
def Timeout_dbus_property(self, value=None):
911
def timeout_dbus_property(self, value=None):
1059
912
if value is None: # get
1060
913
return dbus.UInt64(self.timeout_milliseconds())
1061
914
self.timeout = datetime.timedelta(0, 0, 0, value)
1062
915
# Emit D-Bus signal
1063
self.PropertyChanged(dbus.String(u"Timeout"),
916
self.PropertyChanged(dbus.String(u"timeout"),
1064
917
dbus.UInt64(value, variant_level=1))
1065
918
if getattr(self, u"disable_initiator_tag", None) is None:
1066
919
return
1080
933
self.disable_initiator_tag = (gobject.timeout_add
1081
934
(time_to_die, self.disable))
1082
935
1083
# Interval - property
936
# interval - property
1084
937
@dbus_service_property(_interface, signature=u"t",
1085
938
access=u"readwrite")
1086
def Interval_dbus_property(self, value=None):
939
def interval_dbus_property(self, value=None):
1087
940
if value is None: # get
1088
941
return dbus.UInt64(self.interval_milliseconds())
1089
942
self.interval = datetime.timedelta(0, 0, 0, value)
1090
943
# Emit D-Bus signal
1091
self.PropertyChanged(dbus.String(u"Interval"),
944
self.PropertyChanged(dbus.String(u"interval"),
1092
945
dbus.UInt64(value, variant_level=1))
1093
946
if getattr(self, u"checker_initiator_tag", None) is None:
1094
947
return
1098
951
(value, self.start_checker))
1099
952
self.start_checker() # Start one now, too
1100
953
1101
# Checker - property
954
# checker - property
1102
955
@dbus_service_property(_interface, signature=u"s",
1103
956
access=u"readwrite")
1104
def Checker_dbus_property(self, value=None):
957
def checker_dbus_property(self, value=None):
1105
958
if value is None: # get
1106
959
return dbus.String(self.checker_command)
1107
960
self.checker_command = value
1108
961
# Emit D-Bus signal
1109
self.PropertyChanged(dbus.String(u"Checker"),
962
self.PropertyChanged(dbus.String(u"checker"),
1110
963
dbus.String(self.checker_command,
1111
964
variant_level=1))
1112
965
1113
# CheckerRunning - property
966
# checker_running - property
1114
967
@dbus_service_property(_interface, signature=u"b",
1115
968
access=u"readwrite")
1116
def CheckerRunning_dbus_property(self, value=None):
969
def checker_running_dbus_property(self, value=None):
1117
970
if value is None: # get
1118
971
return dbus.Boolean(self.checker is not None)
1119
972
if value:
1121
974
else:
1122
975
self.stop_checker()
1123
976
1124
# ObjectPath - property
977
# object_path - property
1125
978
@dbus_service_property(_interface, signature=u"o", access=u"read")
1126
def ObjectPath_dbus_property(self):
979
def object_path_dbus_property(self):
1127
980
return self.dbus_object_path # is already a dbus.ObjectPath
1128
981
1129
# Secret = property
982
# secret = property
1130
983
@dbus_service_property(_interface, signature=u"ay",
1131
984
access=u"write", byte_arrays=True)
1132
def Secret_dbus_property(self, value):
985
def secret_dbus_property(self, value):
1133
986
self.secret = str(value)
1134
987
1135
988
del _interface
1136
989
1137
990
1138
class ProxyClient(object):
1139
def __init__(self, child_pipe, fpr, address):
1140
self._pipe = child_pipe
1141
self._pipe.send(('init', fpr, address))
1142
if not self._pipe.recv():
1143
raise KeyError()
1144
1145
def __getattribute__(self, name):
1146
if(name == '_pipe'):
1147
return super(ProxyClient, self).__getattribute__(name)
1148
self._pipe.send(('getattr', name))
1149
data = self._pipe.recv()
1150
if data[0] == 'data':
1151
return data[1]
1152
if data[0] == 'function':
1153
def func(*args, **kwargs):
1154
self._pipe.send(('funcall', name, args, kwargs))
1155
return self._pipe.recv()[1]
1156
return func
1157
1158
def __setattr__(self, name, value):
1159
if(name == '_pipe'):
1160
return super(ProxyClient, self).__setattr__(name, value)
1161
self._pipe.send(('setattr', name, value))
1162
1163
1164
991
class ClientHandler(socketserver.BaseRequestHandler, object):
1165
992
"""A class to handle client connections.
1166
993
1168
995
Note: This will run in its own forked process."""
1169
996
1170
997
def handle(self):
1171
with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
logger.info(u"TCP connection from: %s",
1173
unicode(self.client_address))
1174
logger.debug(u"Pipe FD: %d",
1175
self.server.child_pipe.fileno())
1176
998
logger.info(u"TCP connection from: %s",
999
unicode(self.client_address))
1000
logger.debug(u"IPC Pipe FD: %d",
1001
self.server.child_pipe[1].fileno())
1002
# Open IPC pipe to parent process
1003
with contextlib.nested(self.server.child_pipe[1],
1004
self.server.parent_pipe[0]
1005
) as (ipc, ipc_return):
1177
1006
session = (gnutls.connection
1178
1007
.ClientSession(self.request,
1179
1008
gnutls.connection
1180
1009
.X509Credentials()))
1181
1010
1182
1011
# Note: gnutls.connection.X509Credentials is really a
1183
1012
# generic GnuTLS certificate credentials object so long as
1184
1013
# no X.509 keys are added to it. Therefore, we can use it
1185
1014
# here despite using OpenPGP certificates.
1186
1015
1187
1016
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
1017
# u"+AES-256-CBC", u"+SHA1",
1189
1018
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1195
1024
(gnutls.library.functions
1196
1025
.gnutls_priority_set_direct(session._c_object,
1197
1026
priority, None))
1198
1027
1199
1028
# Start communication using the Mandos protocol
1200
1029
# Get protocol number
1201
1030
line = self.request.makefile().readline()
1206
1035
except (ValueError, IndexError, RuntimeError), error:
1207
1036
logger.error(u"Unknown protocol version: %s", error)
1208
1037
return
1209
1038
1210
1039
# Start GnuTLS connection
1211
1040
try:
1212
1041
session.handshake()
1216
1045
# established. Just abandon the request.
1217
1046
return
1218
1047
logger.debug(u"Handshake succeeded")
1219
1220
approval_required = False
1221
1048
try:
1222
1049
try:
1223
1050
fpr = self.fingerprint(self.peer_certificate
1227
1054
return
1228
1055
logger.debug(u"Fingerprint: %s", fpr)
1229
1056
1230
try:
1231
client = ProxyClient(child_pipe, fpr,
1232
self.client_address)
1233
except KeyError:
1234
return
1235
1236
if client.approval_delay:
1237
delay = client.approval_delay
1238
client.approvals_pending += 1
1239
approval_required = True
1240
1241
while True:
1242
if not client.enabled:
1243
logger.warning(u"Client %s is disabled",
1244
client.name)
1245
if self.server.use_dbus:
1246
# Emit D-Bus signal
1247
client.Rejected("Disabled")
1248
return
1249
1250
if client._approved or not client.approval_delay:
1251
#We are approved or approval is disabled
1057
for c in self.server.clients:
1058
if c.fingerprint == fpr:
1059
client = c
1252
1060
break
1253
elif client._approved is None:
1254
logger.info(u"Client %s needs approval",
1255
client.name)
1256
if self.server.use_dbus:
1257
# Emit D-Bus signal
1258
client.NeedApproval(
1259
client.approval_delay_milliseconds(),
1260
client.approved_by_default)
1261
else:
1262
logger.warning(u"Client %s was not approved",
1263
client.name)
1264
if self.server.use_dbus:
1265
# Emit D-Bus signal
1266
client.Rejected("Denied")
1267
return
1268
1269
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
1271
time = datetime.datetime.now()
1272
client.changedstate.acquire()
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1274
client.changedstate.release()
1275
time2 = datetime.datetime.now()
1276
if (time2 - time) >= delay:
1277
if not client.approved_by_default:
1278
logger.warning("Client %s timed out while"
1279
" waiting for approval",
1280
client.name)
1281
if self.server.use_dbus:
1282
# Emit D-Bus signal
1283
client.Rejected("Approval timed out")
1284
return
1285
else:
1286
break
1287
else:
1288
delay -= time2 - time
1289
1061
else:
1062
ipc.write(u"NOTFOUND %s %s\n"
1063
% (fpr, unicode(self.client_address)))
1064
return
1065
1066
class ClientProxy(object):
1067
"""Client proxy object. Not for calling methods."""
1068
def __init__(self, client):
1069
self.client = client
1070
def __getattr__(self, name):
1071
if name.startswith("ipc_"):
1072
def tempfunc():
1073
ipc.write("%s %s\n" % (name[4:].upper(),
1074
self.client.name))
1075
return tempfunc
1076
if not hasattr(self.client, name):
1077
raise AttributeError
1078
ipc.write(u"GETATTR %s %s\n"
1079
% (name, self.client.fingerprint))
1080
return pickle.load(ipc_return)
1081
clientproxy = ClientProxy(client)
1082
# Have to check if client.enabled, since it is
1083
# possible that the client was disabled since the
1084
# GnuTLS session was established.
1085
if not clientproxy.enabled:
1086
clientproxy.ipc_disabled()
1087
return
1088
1089
clientproxy.ipc_sending()
1290
1090
sent_size = 0
1291
1091
while sent_size < len(client.secret):
1292
try:
1293
sent = session.send(client.secret[sent_size:])
1294
except (gnutls.errors.GNUTLSError), error:
1295
logger.warning("gnutls send failed")
1296
return
1092
sent = session.send(client.secret[sent_size:])
1297
1093
logger.debug(u"Sent: %d, remaining: %d",
1298
1094
sent, len(client.secret)
1299
1095
- (sent_size + sent))
1300
1096
sent_size += sent
1301
1302
logger.info(u"Sending secret to %s", client.name)
1303
# bump the timeout as if seen
1304
client.checked_ok()
1305
if self.server.use_dbus:
1306
# Emit D-Bus signal
1307
client.GotSecret()
1308
1309
1097
finally:
1310
if approval_required:
1311
client.approvals_pending -= 1
1312
try:
1313
session.bye()
1314
except (gnutls.errors.GNUTLSError), error:
1315
logger.warning("GnuTLS bye failed")
1098
session.bye()
1316
1099
1317
1100
@staticmethod
1318
1101
def peer_certificate(session):
1378
1161
return hex_fpr
1379
1162
1380
1163
1381
class MultiprocessingMixIn(object):
1382
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1383
def sub_process_main(self, request, address):
1384
try:
1385
self.finish_request(request, address)
1386
except:
1387
self.handle_error(request, address)
1388
self.close_request(request)
1389
1390
def process_request(self, request, address):
1391
"""Start a new process to process the request."""
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
1394
1395
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
""" adds a pipe to the MixIn """
1164
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1165
"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1397
1166
def process_request(self, request, client_address):
1398
1167
"""Overrides and wraps the original process_request().
1399
1168
1400
1169
This function creates a new pipe in self.pipe
1401
1170
"""
1402
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
1404
super(MultiprocessingMixInWithPipe,
1171
# Child writes to child_pipe
1172
self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1173
# Parent writes to parent_pipe
1174
self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1175
super(ForkingMixInWithPipes,
1405
1176
self).process_request(request, client_address)
1406
self.child_pipe.close()
1407
self.add_pipe(parent_pipe)
1408
1409
def add_pipe(self, parent_pipe):
1177
# Close unused ends for parent
1178
self.parent_pipe[0].close() # close read end
1179
self.child_pipe[1].close() # close write end
1180
self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1181
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1410
1182
"""Dummy function; override as necessary"""
1411
pass
1412
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1183
child_pipe_fd.close()
1184
parent_pipe_fd.close()
1185
1186
1187
class IPv6_TCPServer(ForkingMixInWithPipes,
1414
1188
socketserver.TCPServer, object):
1415
1189
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1416
1190
1501
1275
return socketserver.TCPServer.server_activate(self)
1502
1276
def enable(self):
1503
1277
self.enabled = True
1504
def add_pipe(self, parent_pipe):
1278
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1505
1279
# Call "handle_ipc" for both data and EOF events
1506
gobject.io_add_watch(parent_pipe.fileno(),
1280
gobject.io_add_watch(child_pipe_fd.fileno(),
1507
1281
gobject.IO_IN | gobject.IO_HUP,
1508
1282
functools.partial(self.handle_ipc,
1509
parent_pipe = parent_pipe))
1510
1511
def handle_ipc(self, source, condition, parent_pipe=None,
1512
client_object=None):
1283
reply = parent_pipe_fd,
1284
sender= child_pipe_fd))
1285
def handle_ipc(self, source, condition, reply=None, sender=None):
1513
1286
condition_names = {
1514
1287
gobject.IO_IN: u"IN", # There is data to read.
1515
1288
gobject.IO_OUT: u"OUT", # Data can be written (without
1524
1297
for cond, name in
1525
1298
condition_names.iteritems()
1526
1299
if cond & condition)
1527
# error or the other end of multiprocessing.Pipe has closed
1528
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1529
return False
1530
1531
# Read a request from the child
1532
request = parent_pipe.recv()
1533
command = request[0]
1534
1535
if command == 'init':
1536
fpr = request[1]
1537
address = request[2]
1538
1539
for c in self.clients:
1540
if c.fingerprint == fpr:
1541
client = c
1542
break
1543
else:
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1546
if self.use_dbus:
1547
# Emit D-Bus signal
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1549
parent_pipe.send(False)
1550
return False
1551
1552
gobject.io_add_watch(parent_pipe.fileno(),
1553
gobject.IO_IN | gobject.IO_HUP,
1554
functools.partial(self.handle_ipc,
1555
parent_pipe = parent_pipe,
1556
client_object = client))
1557
parent_pipe.send(True)
1558
# remove the old hook in favor of the new above hook on same fileno
1559
return False
1560
if command == 'funcall':
1561
funcname = request[1]
1562
args = request[2]
1563
kwargs = request[3]
1564
1565
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
1567
if command == 'getattr':
1568
attrname = request[1]
1569
if callable(client_object.__getattribute__(attrname)):
1570
parent_pipe.send(('function',))
1571
else:
1572
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1573
1574
if command == 'setattr':
1575
attrname = request[1]
1576
value = request[2]
1577
setattr(client_object, attrname, value)
1578
1300
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1301
conditions_string)
1302
1303
# Read a line from the file object
1304
cmdline = sender.readline()
1305
if not cmdline: # Empty line means end of file
1306
# close the IPC pipes
1307
sender.close()
1308
reply.close()
1309
1310
# Stop calling this function
1311
return False
1312
1313
logger.debug(u"IPC command: %r", cmdline)
1314
1315
# Parse and act on command
1316
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1317
1318
if cmd == u"NOTFOUND":
1319
fpr, address = args.split(None, 1)
1320
logger.warning(u"Client not found for fingerprint: %s, ad"
1321
u"dress: %s", fpr, address)
1322
if self.use_dbus:
1323
# Emit D-Bus signal
1324
mandos_dbus_service.ClientNotFound(fpr, address)
1325
elif cmd == u"DISABLED":
1326
for client in self.clients:
1327
if client.name == args:
1328
logger.warning(u"Client %s is disabled", args)
1329
if self.use_dbus:
1330
# Emit D-Bus signal
1331
client.Rejected()
1332
break
1333
else:
1334
logger.error(u"Unknown client %s is disabled", args)
1335
elif cmd == u"SENDING":
1336
for client in self.clients:
1337
if client.name == args:
1338
logger.info(u"Sending secret to %s", client.name)
1339
client.checked_ok()
1340
if self.use_dbus:
1341
# Emit D-Bus signal
1342
client.GotSecret()
1343
break
1344
else:
1345
logger.error(u"Sending secret to unknown client %s",
1346
args)
1347
elif cmd == u"GETATTR":
1348
attr_name, fpr = args.split(None, 1)
1349
for client in self.clients:
1350
if client.fingerprint == fpr:
1351
attr_value = getattr(client, attr_name, None)
1352
logger.debug("IPC reply: %r", attr_value)
1353
pickle.dump(attr_value, reply)
1354
break
1355
else:
1356
logger.error(u"Client %s on address %s requesting "
1357
u"attribute %s not found", fpr, address,
1358
attr_name)
1359
pickle.dump(None, reply)
1360
else:
1361
logger.error(u"Unknown IPC command: %r", cmdline)
1362
1363
# Keep calling this function
1579
1364
return True
1580
1365
1581
1366
1684
1469
parser.add_option("--debug", action=u"store_true",
1685
1470
help=u"Debug mode; run in foreground and log to"
1686
1471
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1688
help=u"Debug level for stdout output")
1689
1472
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
1473
u" priority string (see GnuTLS documentation)")
1691
1474
parser.add_option("--servicename", type=u"string",
1716
1499
u"servicename": u"Mandos",
1717
1500
u"use_dbus": u"True",
1718
1501
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1720
1502
}
1721
1503
1722
1504
# Parse config file for server-global settings
1739
1521
# options, if set.
1740
1522
for option in (u"interface", u"address", u"port", u"debug",
1741
1523
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1524
u"use_dbus", u"use_ipv6"):
1743
1525
value = getattr(options, option)
1744
1526
if value is not None:
1745
1527
server_settings[option] = value
1754
1536
1755
1537
# For convenience
1756
1538
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
1539
use_dbus = server_settings[u"use_dbus"]
1759
1540
use_ipv6 = server_settings[u"use_ipv6"]
1760
1541
1542
if not debug:
1543
syslogger.setLevel(logging.WARNING)
1544
console.setLevel(logging.WARNING)
1545
1761
1546
if server_settings[u"servicename"] != u"Mandos":
1762
1547
syslogger.setFormatter(logging.Formatter
1763
1548
(u'Mandos (%s) [%%(process)d]:'
1769
1554
u"interval": u"5m",
1770
1555
u"checker": u"fping -q -- %%(host)s",
1771
1556
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1774
1557
}
1775
1558
client_config = configparser.SafeConfigParser(client_defaults)
1776
1559
client_config.read(os.path.join(server_settings[u"configdir"],
1788
1571
gnutls_priority=
1789
1572
server_settings[u"priority"],
1790
1573
use_dbus=use_dbus)
1791
if not debug:
1792
pidfilename = u"/var/run/mandos.pid"
1793
try:
1794
pidfile = open(pidfilename, u"w")
1795
except IOError:
1796
logger.error(u"Could not open file %r", pidfilename)
1574
pidfilename = u"/var/run/mandos.pid"
1575
try:
1576
pidfile = open(pidfilename, u"w")
1577
except IOError:
1578
logger.error(u"Could not open file %r", pidfilename)
1797
1579
1798
1580
try:
1799
1581
uid = pwd.getpwnam(u"_mandos").pw_uid
1816
1598
if error[0] != errno.EPERM:
1817
1599
raise error
1818
1600
1819
if not debug and not debuglevel:
1820
syslogger.setLevel(logging.WARNING)
1821
console.setLevel(logging.WARNING)
1822
if debuglevel:
1823
level = getattr(logging, debuglevel.upper())
1824
syslogger.setLevel(level)
1825
console.setLevel(level)
1826
1601
# Enable all possible GnuTLS debugging
1827
1602
if debug:
1828
# Enable all possible GnuTLS debugging
1829
1830
1603
# "Use a log level over 10 to enable all debugging options."
1831
1604
# - GnuTLS manual
1832
1605
gnutls.library.functions.gnutls_global_set_log_level(11)
1837
1610
1838
1611
(gnutls.library.functions
1839
1612
.gnutls_global_set_log_function(debug_gnutls))
1840
1841
# Redirect stdin so all checkers get /dev/null
1842
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1843
os.dup2(null, sys.stdin.fileno())
1844
if null > 2:
1845
os.close(null)
1846
else:
1847
# No console logging
1848
logger.removeHandler(console)
1849
1850
1613
1851
1614
global main_loop
1852
1615
# From the Avahi example code
1870
1633
if server_settings["interface"]:
1871
1634
service.interface = (if_nametoindex
1872
1635
(str(server_settings[u"interface"])))
1873
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1877
1878
global multiprocessing_manager
1879
multiprocessing_manager = multiprocessing.Manager()
1880
1636
1881
1637
client_class = Client
1882
1638
if use_dbus:
1883
1639
client_class = functools.partial(ClientDBus, bus = bus)
1884
def client_config_items(config, section):
1885
special_settings = {
1886
"approved_by_default":
1887
lambda: config.getboolean(section,
1888
"approved_by_default"),
1889
}
1890
for name, value in config.items(section):
1891
try:
1892
yield (name, special_settings[name]())
1893
except KeyError:
1894
yield (name, value)
1895
1896
1640
tcp_server.clients.update(set(
1897
1641
client_class(name = section,
1898
config= dict(client_config_items(
1899
client_config, section)))
1642
config= dict(client_config.items(section)))
1900
1643
for section in client_config.sections()))
1901
1644
if not tcp_server.clients:
1902
1645
logger.warning(u"No clients defined")
1903
1646
1647
if debug:
1648
# Redirect stdin so all checkers get /dev/null
1649
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1650
os.dup2(null, sys.stdin.fileno())
1651
if null > 2:
1652
os.close(null)
1653
else:
1654
# No console logging
1655
logger.removeHandler(console)
1656
# Close all input and output, do double fork, etc.
1657
daemon()
1658
1659
try:
1660
with pidfile:
1661
pid = os.getpid()
1662
pidfile.write(str(pid) + "\n")
1663
del pidfile
1664
except IOError:
1665
logger.error(u"Could not write to file %r with PID %d",
1666
pidfilename, pid)
1667
except NameError:
1668
# "pidfile" was never created
1669
pass
1670
del pidfilename
1671
1904
1672
if not debug:
1905
try:
1906
with pidfile:
1907
pid = os.getpid()
1908
pidfile.write(str(pid) + "\n")
1909
del pidfile
1910
except IOError:
1911
logger.error(u"Could not write to file %r with PID %d",
1912
pidfilename, pid)
1913
except NameError:
1914
# "pidfile" was never created
1915
pass
1916
del pidfilename
1917
1918
1673
signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
1920
1674
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
1675
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1922
1676
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0