/mandos/trunk : revision 460

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

55

import logging

56

import logging.handlers

57

import pwd

58

from contextlib import closing

58

import contextlib

59

import struct

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

62

64

63

65

import dbus

64

66

import dbus.service

79

81

SO_BINDTODEVICE = None

80

82

81

83

82

version = "1.0.12"

84

version = "1.2.3"

83

85

86

#logger = logging.getLogger(u'mandos')

84

87

logger = logging.Logger(u'mandos')

85

88

syslogger = (logging.handlers.SysLogHandler

86

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

154

157

u" after %i retries, exiting.",

155

158

self.rename_count)

156

159

raise AvahiServiceError(u"Too many renames")

157

self.name = self.server.GetAlternativeServiceName(self.name)

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

158

161

logger.info(u"Changing Zeroconf service name to %r ...",

159

unicode(self.name))

162

self.name)

160

163

syslogger.setFormatter(logging.Formatter

161

164

(u'Mandos (%s) [%%(process)d]:'

162

165

u' %%(levelname)s: %%(message)s'

163

166

% self.name))

164

167

self.remove()

165

self.add()

168

try:

169

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

172

self.cleanup()

173

os._exit(1)

166

174

self.rename_count += 1

167

175

def remove(self):

168

176

"""Derived from the Avahi example code"""

191

199

self.group.Commit()

192

200

def entry_group_state_changed(self, state, error):

193

201

"""Derived from the Avahi example code"""

194

logger.debug(u"Avahi state change: %i", state)

202

logger.debug(u"Avahi entry group state change: %i", state)

195

203

196

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

197

205

logger.debug(u"Zeroconf service established.")

210

218

self.group = None

211

219

def server_state_changed(self, state):

212

220

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

213

222

if state == avahi.SERVER_COLLISION:

214

223

logger.error(u"Zeroconf server name collision")

215

224

self.remove()

231

240

"""A representation of a client host served by this server.

232

241

233

242

Attributes:

234

name: string; from the config file, used in log messages and

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

243

_approved: bool(); 'None' if not yet approved/disapproved

244

approval_delay: datetime.timedelta(); Time to wait for approval

245

approval_duration: datetime.timedelta(); Duration of one approval

248

246

checker: subprocess.Popen(); a running checker process used

249

247

to see if the client lives.

250

248

'None' if no process is running.

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

249

checker_callback_tag: a gobject event source tag, or None

250

checker_command: string; External command which is run to check

251

if client lives. %() expansions are done at

256

252

runtime with vars(self) as dict, so that for

257

253

instance %(name)s can be used in the command.

254

checker_initiator_tag: a gobject event source tag, or None

255

created: datetime.datetime(); (UTC) object creation

258

256

current_checker_command: string; current running checker_command

257

disable_hook: If set, called by disable() as disable_hook(self)

258

disable_initiator_tag: a gobject event source tag, or None

259

enabled: bool()

260

fingerprint: string (40 or 32 hexadecimal digits); used to

261

uniquely identify the client

262

host: string; available for use by the checker command

263

interval: datetime.timedelta(); How often to start a new checker

264

last_approval_request: datetime.datetime(); (UTC) or None

265

last_checked_ok: datetime.datetime(); (UTC) or None

266

last_enabled: datetime.datetime(); (UTC)

267

name: string; from the config file, used in log messages and

268

D-Bus identifiers

269

secret: bytestring; sent verbatim (over TLS) to client

270

timeout: datetime.timedelta(); How long from last_checked_ok

271

until this client is disabled

272

runtime_expansions: Allowed attributes for runtime expansion.

259

273

"""

260

274

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

261

280

@staticmethod

262

281

def _timedelta_to_milliseconds(td):

263

282

"Convert a datetime.timedelta() to milliseconds"

272

291

def interval_milliseconds(self):

273

292

"Return the 'interval' attribute in milliseconds"

274

293

return self._timedelta_to_milliseconds(self.interval)

294

295

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

275

297

276

298

def __init__(self, name = None, disable_hook=None, config=None):

277

299

"""Note: the 'checker' key in 'config' sets the

290

312

if u"secret" in config:

291

313

self.secret = config[u"secret"].decode(u"base64")

292

314

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])))) as secfile:

315

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

317

"rb") as secfile:

296

318

self.secret = secfile.read()

297

319

else:

298

320

raise TypeError(u"No secret or secfile for client %s"

300

322

self.host = config.get(u"host", u"")

301

323

self.created = datetime.datetime.utcnow()

302

324

self.enabled = False

325

self.last_approval_request = None

303

326

self.last_enabled = None

304

327

self.last_checked_ok = None

305

328

self.timeout = string_to_delta(config[u"timeout"])

312

335

self.checker_command = config[u"checker"]

313

336

self.current_checker_command = None

314

337

self.last_connect = None

338

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

340

True)

341

self.approvals_pending = 0

342

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

344

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

315

347

348

def send_changedstate(self):

349

self.changedstate.acquire()

350

self.changedstate.notify_all()

351

self.changedstate.release()

352

316

353

def enable(self):

317

354

"""Start this client's checker and timeout hooks"""

318

355

if getattr(self, u"enabled", False):

319

356

# Already enabled

320

357

return

358

self.send_changedstate()

321

359

self.last_enabled = datetime.datetime.utcnow()

322

360

# Schedule a new checker to be started an 'interval' from now,

323

361

# and every interval from then on.

324

362

self.checker_initiator_tag = (gobject.timeout_add

325

363

(self.interval_milliseconds(),

326

364

self.start_checker))

327

# Also start a new checker *right now*.

328

self.start_checker()

329

365

# Schedule a disable() when 'timeout' has passed

330

366

self.disable_initiator_tag = (gobject.timeout_add

331

367

(self.timeout_milliseconds(),

332

368

self.disable))

333

369

self.enabled = True

370

# Also start a new checker *right now*.

371

self.start_checker()

334

372

335

def disable(self):

373

def disable(self, quiet=True):

336

374

"""Disable this client."""

337

375

if not getattr(self, "enabled", False):

338

376

return False

339

logger.info(u"Disabling client %s", self.name)

377

if not quiet:

378

self.send_changedstate()

379

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

340

381

if getattr(self, u"disable_initiator_tag", False):

341

382

gobject.source_remove(self.disable_initiator_tag)

342

383

self.disable_initiator_tag = None

383

424

(self.timeout_milliseconds(),

384

425

self.disable))

385

426

427

def need_approval(self):

428

self.last_approval_request = datetime.datetime.utcnow()

429

386

430

def start_checker(self):

387

431

"""Start a new checker subprocess if one is not running.

388

432

394

438

# client would inevitably timeout, since no checker would get

395

439

# a chance to run to completion. If we instead leave running

396

440

# checkers alone, the checker would have to take more time

397

# than 'timeout' for the client to be declared invalid, which

398

# is as it should be.

441

# than 'timeout' for the client to be disabled, which is as it

442

# should be.

399

443

400

444

# If a checker exists, make sure it is not a zombie

401

445

try:

417

461

command = self.checker_command % self.host

418

462

except TypeError:

419

463

# Escape attributes for the shell

420

escaped_attrs = dict((key,

421

re.escape(unicode(str(val),

422

errors=

423

u'replace')))

424

for key, val in

425

vars(self).iteritems())

464

escaped_attrs = dict(

465

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

467

errors=

468

u'replace')))

469

for attr in

470

self.runtime_expansions)

471

426

472

try:

427

473

command = self.checker_command % escaped_attrs

428

474

except TypeError, error:

466

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

467

513

try:

468

514

os.kill(self.checker.pid, signal.SIGTERM)

469

#os.sleep(0.5)

515

#time.sleep(0.5)

470

516

#if self.checker.poll() is None:

471

517

# os.kill(self.checker.pid, signal.SIGKILL)

472

518

except OSError, error:

473

519

if error.errno != errno.ESRCH: # No such process

474

520

raise

475

521

self.checker = None

476

477

def still_valid(self):

478

"""Has the timeout not yet passed for this client?"""

479

if not getattr(self, u"enabled", False):

480

return False

481

now = datetime.datetime.utcnow()

482

if self.last_checked_ok is None:

483

return now < (self.created + self.timeout)

484

else:

485

return now < (self.last_checked_ok + self.timeout)

486

487

522

488

523

def dbus_service_property(dbus_interface, signature=u"v",

489

524

access=u"readwrite", byte_arrays=False):

497

532

dbus.service.method, except there is only "signature", since the

498

533

type from Get() and the type sent to Set() is the same.

499

534

"""

535

# Encoding deeply encoded byte arrays is not supported yet by the

536

# "Set" method, so we fail early here:

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

500

540

def decorator(func):

501

541

func._dbus_is_property = True

502

542

func._dbus_interface = dbus_interface

588

628

if prop._dbus_access == u"read":

589

629

raise DBusPropertyAccessException(property_name)

590

630

if prop._dbus_get_args_options[u"byte_arrays"]:

631

# The byte_arrays option is not supported yet on

632

# signatures other than "ay".

633

if prop._dbus_signature != u"ay":

634

raise ValueError

591

635

value = dbus.ByteArray(''.join(unichr(byte)

592

636

for byte in value))

593

637

prop(value)

625

669

"""Standard D-Bus method, overloaded to insert property tags.

626

670

"""

627

671

xmlstring = dbus.service.Object.Introspect(self, object_path,

628

connection)

629

document = xml.dom.minidom.parseString(xmlstring)

630

del xmlstring

631

def make_tag(document, name, prop):

632

e = document.createElement(u"property")

633

e.setAttribute(u"name", name)

634

e.setAttribute(u"type", prop._dbus_signature)

635

e.setAttribute(u"access", prop._dbus_access)

636

return e

637

for if_tag in document.getElementsByTagName(u"interface"):

638

for tag in (make_tag(document, name, prop)

639

for name, prop

640

in self._get_all_dbus_properties()

641

if prop._dbus_interface

642

== if_tag.getAttribute(u"name")):

643

if_tag.appendChild(tag)

644

xmlstring = document.toxml(u"utf-8")

645

document.unlink()

672

connection)

673

try:

674

document = xml.dom.minidom.parseString(xmlstring)

675

def make_tag(document, name, prop):

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

680

return e

681

for if_tag in document.getElementsByTagName(u"interface"):

682

for tag in (make_tag(document, name, prop)

683

for name, prop

684

in self._get_all_dbus_properties()

685

if prop._dbus_interface

686

== if_tag.getAttribute(u"name")):

687

if_tag.appendChild(tag)

688

# Add the names to the return values for the

689

# "org.freedesktop.DBus.Properties" methods

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

704

document.unlink()

705

except (AttributeError, xml.dom.DOMException,

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

708

error)

646

709

return xmlstring

647

710

648

711

653

716

dbus_object_path: dbus.ObjectPath

654

717

bus: dbus.SystemBus()

655

718

"""

719

720

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

722

656

723

# dbus.service.Object doesn't use super(), so we can't either.

657

724

658

725

def __init__(self, bus = None, *args, **kwargs):

726

self._approvals_pending = 0

659

727

self.bus = bus

660

728

Client.__init__(self, *args, **kwargs)

661

729

# Only now, when this client is initialized, can it show up on

662

730

# the D-Bus

731

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

663

734

self.dbus_object_path = (dbus.ObjectPath

664

(u"/clients/"

665

+ self.name.replace(u".", u"_")))

735

(u"/clients/" + client_object_name))

666

736

DBusObjectWithProperties.__init__(self, self.bus,

667

737

self.dbus_object_path)

738

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

750

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

668

754

669

755

@staticmethod

670

756

def _datetime_to_dbus(dt, variant_level=0):

677

763

r = Client.enable(self)

678

764

if oldstate != self.enabled:

679

765

# Emit D-Bus signals

680

self.PropertyChanged(dbus.String(u"enabled"),

766

self.PropertyChanged(dbus.String(u"Enabled"),

681

767

dbus.Boolean(True, variant_level=1))

682

768

self.PropertyChanged(

683

dbus.String(u"last_enabled"),

769

dbus.String(u"LastEnabled"),

684

770

self._datetime_to_dbus(self.last_enabled,

685

771

variant_level=1))

686

772

return r

687

773

688

def disable(self, signal = True):

774

def disable(self, quiet = False):

689

775

oldstate = getattr(self, u"enabled", False)

690

r = Client.disable(self)

691

if signal and oldstate != self.enabled:

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

692

778

# Emit D-Bus signal

693

self.PropertyChanged(dbus.String(u"enabled"),

779

self.PropertyChanged(dbus.String(u"Enabled"),

694

780

dbus.Boolean(False, variant_level=1))

695

781

return r

696

782

708

794

self.checker_callback_tag = None

709

795

self.checker = None

710

796

# Emit D-Bus signal

711

self.PropertyChanged(dbus.String(u"checker_running"),

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

712

798

dbus.Boolean(False, variant_level=1))

713

799

if os.WIFEXITED(condition):

714

800

exitstatus = os.WEXITSTATUS(condition)

729

815

r = Client.checked_ok(self, *args, **kwargs)

730

816

# Emit D-Bus signal

731

817

self.PropertyChanged(

732

dbus.String(u"last_checked_ok"),

818

dbus.String(u"LastCheckedOK"),

733

819

(self._datetime_to_dbus(self.last_checked_ok,

734

820

variant_level=1)))

735

821

return r

736

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

737

832

def start_checker(self, *args, **kwargs):

738

833

old_checker = self.checker

739

834

if self.checker is not None:

747

842

# Emit D-Bus signal

748

843

self.CheckerStarted(self.current_checker_command)

749

844

self.PropertyChanged(

750

dbus.String(u"checker_running"),

845

dbus.String(u"CheckerRunning"),

751

846

dbus.Boolean(True, variant_level=1))

752

847

return r

753

848

756

851

r = Client.stop_checker(self, *args, **kwargs)

757

852

if (old_checker is not None

758

853

and getattr(self, u"checker", None) is None):

759

self.PropertyChanged(dbus.String(u"checker_running"),

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

760

855

dbus.Boolean(False, variant_level=1))

761

856

return r

762

763

## D-Bus methods & signals

857

858

def _reset_approved(self):

859

self._approved = None

860

return False

861

862

def approve(self, value=True):

863

self.send_changedstate()

864

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

866

(self.approval_duration),

867

self._reset_approved)

868

869

870

## D-Bus methods, signals & properties

764

871

_interface = u"se.bsnet.fukt.Mandos.Client"

765

872

766

# CheckedOK - method

767

@dbus.service.method(_interface)

768

def CheckedOK(self):

769

return self.checked_ok()

873

## Signals

770

874

771

875

# CheckerCompleted - signal

772

876

@dbus.service.signal(_interface, signature=u"nxs")

786

890

"D-Bus signal"

787

891

pass

788

892

789

# ReceivedSecret - signal

893

# GotSecret - signal

790

894

@dbus.service.signal(_interface)

791

def ReceivedSecret(self):

792

"D-Bus signal"

895

def GotSecret(self):

896

"""D-Bus signal

897

Is sent after a successful transfer of secret from the Mandos

898

server to mandos-client

899

"""

793

900

pass

794

901

795

902

# Rejected - signal

796

@dbus.service.signal(_interface)

797

def Rejected(self):

903

@dbus.service.signal(_interface, signature=u"s")

904

def Rejected(self, reason):

798

905

"D-Bus signal"

799

906

pass

800

907

908

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

910

def NeedApproval(self, timeout, default):

911

"D-Bus signal"

912

return self.need_approval()

913

914

## Methods

915

916

# Approve - method

917

@dbus.service.method(_interface, in_signature=u"b")

918

def Approve(self, value):

919

self.approve(value)

920

921

# CheckedOK - method

922

@dbus.service.method(_interface)

923

def CheckedOK(self):

924

return self.checked_ok()

925

801

926

# Enable - method

802

927

@dbus.service.method(_interface)

803

928

def Enable(self):

821

946

def StopChecker(self):

822

947

self.stop_checker()

823

948

824

# name - property

949

## Properties

950

951

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

953

def ApprovalPending_dbus_property(self):

954

return dbus.Boolean(bool(self.approvals_pending))

955

956

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

959

def ApprovedByDefault_dbus_property(self, value=None):

960

if value is None: # get

961

return dbus.Boolean(self.approved_by_default)

962

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

967

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

970

def ApprovalDelay_dbus_property(self, value=None):

971

if value is None: # get

972

return dbus.UInt64(self.approval_delay_milliseconds())

973

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

978

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

981

def ApprovalDuration_dbus_property(self, value=None):

982

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

984

self.approval_duration))

985

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

990

# Name - property

825

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

826

def name_dbus_property(self):

992

def Name_dbus_property(self):

827

993

return dbus.String(self.name)

828

994

829

# fingerprint - property

995

# Fingerprint - property

830

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

831

def fingerprint_dbus_property(self):

997

def Fingerprint_dbus_property(self):

832

998

return dbus.String(self.fingerprint)

833

999

834

# host - property

1000

# Host - property

835

1001

@dbus_service_property(_interface, signature=u"s",

836

1002

access=u"readwrite")

837

def host_dbus_property(self, value=None):

1003

def Host_dbus_property(self, value=None):

838

1004

if value is None: # get

839

1005

return dbus.String(self.host)

840

1006

self.host = value

841

1007

# Emit D-Bus signal

842

self.PropertyChanged(dbus.String(u"host"),

1008

self.PropertyChanged(dbus.String(u"Host"),

843

1009

dbus.String(value, variant_level=1))

844

1010

845

# created - property

1011

# Created - property

846

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

847

def created_dbus_property(self):

1013

def Created_dbus_property(self):

848

1014

return dbus.String(self._datetime_to_dbus(self.created))

849

1015

850

# last_enabled - property

1016

# LastEnabled - property

851

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

852

def last_enabled_dbus_property(self):

1018

def LastEnabled_dbus_property(self):

853

1019

if self.last_enabled is None:

854

1020

return dbus.String(u"")

855

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

856

1022

857

# enabled - property

1023

# Enabled - property

858

1024

@dbus_service_property(_interface, signature=u"b",

859

1025

access=u"readwrite")

860

def enabled_dbus_property(self, value=None):

1026

def Enabled_dbus_property(self, value=None):

861

1027

if value is None: # get

862

1028

return dbus.Boolean(self.enabled)

863

1029

if value:

865

1031

else:

866

1032

self.disable()

867

1033

868

# last_checked_ok - property

1034

# LastCheckedOK - property

869

1035

@dbus_service_property(_interface, signature=u"s",

870

1036

access=u"readwrite")

871

def last_checked_ok_dbus_property(self, value=None):

1037

def LastCheckedOK_dbus_property(self, value=None):

872

1038

if value is not None:

873

1039

self.checked_ok()

874

1040

return

877

1043

return dbus.String(self._datetime_to_dbus(self

878

1044

.last_checked_ok))

879

1045

880

# timeout - property

1046

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1048

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1054

1055

# Timeout - property

881

1056

@dbus_service_property(_interface, signature=u"t",

882

1057

access=u"readwrite")

883

def timeout_dbus_property(self, value=None):

1058

def Timeout_dbus_property(self, value=None):

884

1059

if value is None: # get

885

1060

return dbus.UInt64(self.timeout_milliseconds())

886

1061

self.timeout = datetime.timedelta(0, 0, 0, value)

887

1062

# Emit D-Bus signal

888

self.PropertyChanged(dbus.String(u"timeout"),

1063

self.PropertyChanged(dbus.String(u"Timeout"),

889

1064

dbus.UInt64(value, variant_level=1))

890

1065

if getattr(self, u"disable_initiator_tag", None) is None:

891

1066

return

905

1080

self.disable_initiator_tag = (gobject.timeout_add

906

1081

(time_to_die, self.disable))

907

1082

908

# interval - property

1083

# Interval - property

909

1084

@dbus_service_property(_interface, signature=u"t",

910

1085

access=u"readwrite")

911

def interval_dbus_property(self, value=None):

1086

def Interval_dbus_property(self, value=None):

912

1087

if value is None: # get

913

1088

return dbus.UInt64(self.interval_milliseconds())

914

1089

self.interval = datetime.timedelta(0, 0, 0, value)

915

1090

# Emit D-Bus signal

916

self.PropertyChanged(dbus.String(u"interval"),

1091

self.PropertyChanged(dbus.String(u"Interval"),

917

1092

dbus.UInt64(value, variant_level=1))

918

1093

if getattr(self, u"checker_initiator_tag", None) is None:

919

1094

return

923

1098

(value, self.start_checker))

924

1099

self.start_checker() # Start one now, too

925

1100

926

# checker - property

1101

# Checker - property

927

1102

@dbus_service_property(_interface, signature=u"s",

928

1103

access=u"readwrite")

929

def checker_dbus_property(self, value=None):

1104

def Checker_dbus_property(self, value=None):

930

1105

if value is None: # get

931

1106

return dbus.String(self.checker_command)

932

1107

self.checker_command = value

933

1108

# Emit D-Bus signal

934

self.PropertyChanged(dbus.String(u"checker"),

1109

self.PropertyChanged(dbus.String(u"Checker"),

935

1110

dbus.String(self.checker_command,

936

1111

variant_level=1))

937

1112

938

# checker_running - property

1113

# CheckerRunning - property

939

1114

@dbus_service_property(_interface, signature=u"b",

940

1115

access=u"readwrite")

941

def checker_running_dbus_property(self, value=None):

1116

def CheckerRunning_dbus_property(self, value=None):

942

1117

if value is None: # get

943

1118

return dbus.Boolean(self.checker is not None)

944

1119

if value:

946

1121

else:

947

1122

self.stop_checker()

948

1123

949

# object_path - property

1124

# ObjectPath - property

950

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

951

def object_path_dbus_property(self):

1126

def ObjectPath_dbus_property(self):

952

1127

return self.dbus_object_path # is already a dbus.ObjectPath

953

1128

954

# secret = property

1129

# Secret = property

955

1130

@dbus_service_property(_interface, signature=u"ay",

956

1131

access=u"write", byte_arrays=True)

957

def secret_dbus_property(self, value):

1132

def Secret_dbus_property(self, value):

958

1133

self.secret = str(value)

959

1134

960

1135

del _interface

961

1136

962

1137

1138

class ProxyClient(object):

1139

def __init__(self, child_pipe, fpr, address):

1140

self._pipe = child_pipe

1141

self._pipe.send(('init', fpr, address))

1142

if not self._pipe.recv():

1143

raise KeyError()

1144

1145

def __getattribute__(self, name):

1146

if(name == '_pipe'):

1147

return super(ProxyClient, self).__getattribute__(name)

1148

self._pipe.send(('getattr', name))

1149

data = self._pipe.recv()

1150

if data[0] == 'data':

1151

return data[1]

1152

if data[0] == 'function':

1153

def func(*args, **kwargs):

1154

self._pipe.send(('funcall', name, args, kwargs))

1155

return self._pipe.recv()[1]

1156

return func

1157

1158

def __setattr__(self, name, value):

1159

if(name == '_pipe'):

1160

return super(ProxyClient, self).__setattr__(name, value)

1161

self._pipe.send(('setattr', name, value))

1162

1163

963

1164

class ClientHandler(socketserver.BaseRequestHandler, object):

964

1165

"""A class to handle client connections.

965

1166

967

1168

Note: This will run in its own forked process."""

968

1169

969

1170

def handle(self):

970

logger.info(u"TCP connection from: %s",

971

unicode(self.client_address))

972

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

973

# Open IPC pipe to parent process

974

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1171

with contextlib.closing(self.server.child_pipe) as child_pipe:

1172

logger.info(u"TCP connection from: %s",

1173

unicode(self.client_address))

1174

logger.debug(u"Pipe FD: %d",

1175

self.server.child_pipe.fileno())

1176

975

1177

session = (gnutls.connection

976

1178

.ClientSession(self.request,

977

1179

gnutls.connection

978

1180

.X509Credentials()))

979

980

line = self.request.makefile().readline()

981

logger.debug(u"Protocol version: %r", line)

982

try:

983

if int(line.strip().split()[0]) > 1:

984

raise RuntimeError

985

except (ValueError, IndexError, RuntimeError), error:

986

logger.error(u"Unknown protocol version: %s", error)

987

return

988

1181

989

1182

# Note: gnutls.connection.X509Credentials is really a

990

1183

# generic GnuTLS certificate credentials object so long as

991

1184

# no X.509 keys are added to it. Therefore, we can use it

992

1185

# here despite using OpenPGP certificates.

993

1186

994

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

995

1188

# u"+AES-256-CBC", u"+SHA1",

996

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1002

1195

(gnutls.library.functions

1003

1196

.gnutls_priority_set_direct(session._c_object,

1004

1197

priority, None))

1005

1198

1199

# Start communication using the Mandos protocol

1200

# Get protocol number

1201

line = self.request.makefile().readline()

1202

logger.debug(u"Protocol version: %r", line)

1203

try:

1204

if int(line.strip().split()[0]) > 1:

1205

raise RuntimeError

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1208

return

1209

1210

# Start GnuTLS connection

1006

1211

try:

1007

1212

session.handshake()

1008

1213

except gnutls.errors.GNUTLSError, error:

1011

1216

# established. Just abandon the request.

1012

1217

return

1013

1218

logger.debug(u"Handshake succeeded")

1219

1220

approval_required = False

1014

1221

try:

1015

fpr = self.fingerprint(self.peer_certificate(session))

1016

except (TypeError, gnutls.errors.GNUTLSError), error:

1017

logger.warning(u"Bad certificate: %s", error)

1018

session.bye()

1019

return

1020

logger.debug(u"Fingerprint: %s", fpr)

1222

try:

1223

fpr = self.fingerprint(self.peer_certificate

1224

(session))

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1227

return

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1230

try:

1231

client = ProxyClient(child_pipe, fpr,

1232

self.client_address)

1233

except KeyError:

1234

return

1235

1236

if client.approval_delay:

1237

delay = client.approval_delay

1238

client.approvals_pending += 1

1239

approval_required = True

1240

1241

while True:

1242

if not client.enabled:

1243

logger.warning(u"Client %s is disabled",

1244

client.name)

1245

if self.server.use_dbus:

1246

# Emit D-Bus signal

1247

client.Rejected("Disabled")

1248

return

1249

1250

if client._approved or not client.approval_delay:

1251

#We are approved or approval is disabled

1252

break

1253

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1255

client.name)

1256

if self.server.use_dbus:

1257

# Emit D-Bus signal

1258

client.NeedApproval(

1259

client.approval_delay_milliseconds(),

1260

client.approved_by_default)

1261

else:

1262

logger.warning(u"Client %s was not approved",

1263

client.name)

1264

if self.server.use_dbus:

1265

# Emit D-Bus signal

1266

client.Rejected("Denied")

1267

return

1268

1269

#wait until timeout or approved

1270

#x = float(client._timedelta_to_milliseconds(delay))

1271

time = datetime.datetime.now()

1272

client.changedstate.acquire()

1273

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1274

client.changedstate.release()

1275

time2 = datetime.datetime.now()

1276

if (time2 - time) >= delay:

1277

if not client.approved_by_default:

1278

logger.warning("Client %s timed out while"

1279

" waiting for approval",

1280

client.name)

1281

if self.server.use_dbus:

1282

# Emit D-Bus signal

1283

client.Rejected("Approval timed out")

1284

return

1285

else:

1286

break

1287

else:

1288

delay -= time2 - time

1289

1290

sent_size = 0

1291

while sent_size < len(client.secret):

1292

try:

1293

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1295

logger.warning("gnutls send failed")

1296

return

1297

logger.debug(u"Sent: %d, remaining: %d",

1298

sent, len(client.secret)

1299

- (sent_size + sent))

1300

sent_size += sent

1301

1302

logger.info(u"Sending secret to %s", client.name)

1303

# bump the timeout as if seen

1304

client.checked_ok()

1305

if self.server.use_dbus:

1306

# Emit D-Bus signal

1307

client.GotSecret()

1021

1308

1022

for c in self.server.clients:

1023

if c.fingerprint == fpr:

1024

client = c

1025

break

1026

else:

1027

ipc.write(u"NOTFOUND %s %s\n"

1028

% (fpr, unicode(self.client_address)))

1029

session.bye()

1030

return

1031

# Have to check if client.still_valid(), since it is

1032

# possible that the client timed out while establishing

1033

# the GnuTLS session.

1034

if not client.still_valid():

1035

ipc.write(u"INVALID %s\n" % client.name)

1036

session.bye()

1037

return

1038

ipc.write(u"SENDING %s\n" % client.name)

1039

sent_size = 0

1040

while sent_size < len(client.secret):

1041

sent = session.send(client.secret[sent_size:])

1042

logger.debug(u"Sent: %d, remaining: %d",

1043

sent, len(client.secret)

1044

- (sent_size + sent))

1045

sent_size += sent

1046

session.bye()

1309

finally:

1310

if approval_required:

1311

client.approvals_pending -= 1

1312

try:

1313

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1315

logger.warning("GnuTLS bye failed")

1047

1316

1048

1317

@staticmethod

1049

1318

def peer_certificate(session):

1109

1378

return hex_fpr

1110

1379

1111

1380

1112

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1113

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1381

class MultiprocessingMixIn(object):

1382

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1383

def sub_process_main(self, request, address):

1384

try:

1385

self.finish_request(request, address)

1386

except:

1387

self.handle_error(request, address)

1388

self.close_request(request)

1389

1390

def process_request(self, request, address):

1391

"""Start a new process to process the request."""

1392

multiprocessing.Process(target = self.sub_process_main,

1393

args = (request, address)).start()

1394

1395

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1396

""" adds a pipe to the MixIn """

1114

1397

def process_request(self, request, client_address):

1115

1398

"""Overrides and wraps the original process_request().

1116

1399

1117

1400

This function creates a new pipe in self.pipe

1118

1401

"""

1119

self.pipe = os.pipe()

1120

super(ForkingMixInWithPipe,

1402

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1403

1404

super(MultiprocessingMixInWithPipe,

1121

1405

self).process_request(request, client_address)

1122

os.close(self.pipe[1]) # close write end

1123

self.add_pipe(self.pipe[0])

1124

def add_pipe(self, pipe):

1406

self.child_pipe.close()

1407

self.add_pipe(parent_pipe)

1408

1409

def add_pipe(self, parent_pipe):

1125

1410

"""Dummy function; override as necessary"""

1126

os.close(pipe)

1127

1128

1129

class IPv6_TCPServer(ForkingMixInWithPipe,

1411

pass

1412

1413

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1130

1414

socketserver.TCPServer, object):

1131

1415

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1132

1416

1217

1501

return socketserver.TCPServer.server_activate(self)

1218

1502

def enable(self):

1219

1503

self.enabled = True

1220

def add_pipe(self, pipe):

1504

def add_pipe(self, parent_pipe):

1221

1505

# Call "handle_ipc" for both data and EOF events

1222

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1223

self.handle_ipc)

1224

def handle_ipc(self, source, condition, file_objects={}):

1506

gobject.io_add_watch(parent_pipe.fileno(),

1507

gobject.IO_IN | gobject.IO_HUP,

1508

functools.partial(self.handle_ipc,

1509

parent_pipe = parent_pipe))

1510

1511

def handle_ipc(self, source, condition, parent_pipe=None,

1512

client_object=None):

1225

1513

condition_names = {

1226

1514

gobject.IO_IN: u"IN", # There is data to read.

1227

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

1236

1524

for cond, name in

1237

1525

condition_names.iteritems()

1238

1526

if cond & condition)

1239

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1240

conditions_string)

1241

1242

# Turn the pipe file descriptor into a Python file object

1243

if source not in file_objects:

1244

file_objects[source] = os.fdopen(source, u"r", 1)

1245

1246

# Read a line from the file object

1247

cmdline = file_objects[source].readline()

1248

if not cmdline: # Empty line means end of file

1249

# close the IPC pipe

1250

file_objects[source].close()

1251

del file_objects[source]

1252

1253

# Stop calling this function

1254

return False

1255

1256

logger.debug(u"IPC command: %r", cmdline)

1257

1258

# Parse and act on command

1259

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1260

1261

if cmd == u"NOTFOUND":

1262

logger.warning(u"Client not found for fingerprint: %s",

1263

args)

1264

if self.use_dbus:

1265

# Emit D-Bus signal

1266

mandos_dbus_service.ClientNotFound(args)

1267

elif cmd == u"INVALID":

1268

for client in self.clients:

1269

if client.name == args:

1270

logger.warning(u"Client %s is invalid", args)

1271

if self.use_dbus:

1272

# Emit D-Bus signal

1273

client.Rejected()

1274

break

1275

else:

1276

logger.error(u"Unknown client %s is invalid", args)

1277

elif cmd == u"SENDING":

1278

for client in self.clients:

1279

if client.name == args:

1280

logger.info(u"Sending secret to %s", client.name)

1281

client.checked_ok()

1282

if self.use_dbus:

1283

# Emit D-Bus signal

1284

client.ReceivedSecret()

1285

break

1286

else:

1287

logger.error(u"Sending secret to unknown client %s",

1288

args)

1289

else:

1290

logger.error(u"Unknown IPC command: %r", cmdline)

1291

1292

# Keep calling this function

1527

# error or the other end of multiprocessing.Pipe has closed

1528

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1529

return False

1530

1531

# Read a request from the child

1532

request = parent_pipe.recv()

1533

command = request[0]

1534

1535

if command == 'init':

1536

fpr = request[1]

1537

address = request[2]

1538

1539

for c in self.clients:

1540

if c.fingerprint == fpr:

1541

client = c

1542

break

1543

else:

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1546

if self.use_dbus:

1547

# Emit D-Bus signal

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1549

parent_pipe.send(False)

1550

return False

1551

1552

gobject.io_add_watch(parent_pipe.fileno(),

1553

gobject.IO_IN | gobject.IO_HUP,

1554

functools.partial(self.handle_ipc,

1555

parent_pipe = parent_pipe,

1556

client_object = client))

1557

parent_pipe.send(True)

1558

# remove the old hook in favor of the new above hook on same fileno

1559

return False

1560

if command == 'funcall':

1561

funcname = request[1]

1562

args = request[2]

1563

kwargs = request[3]

1564

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1567

if command == 'getattr':

1568

attrname = request[1]

1569

if callable(client_object.__getattribute__(attrname)):

1570

parent_pipe.send(('function',))

1571

else:

1572

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1573

1574

if command == 'setattr':

1575

attrname = request[1]

1576

value = request[2]

1577

setattr(client_object, attrname, value)

1578

1293

1579

return True

1294

1580

1295

1581

1325

1611

elif suffix == u"w":

1326

1612

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1327

1613

else:

1328

raise ValueError

1329

except (ValueError, IndexError):

1330

raise ValueError

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1331

1617

timevalue += delta

1332

1618

return timevalue

1333

1619

1346

1632

def if_nametoindex(interface):

1347

1633

"Get an interface index the hard way, i.e. using fcntl()"

1348

1634

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1349

with closing(socket.socket()) as s:

1635

with contextlib.closing(socket.socket()) as s:

1350

1636

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1351

1637

struct.pack(str(u"16s16x"),

1352

1638

interface))

1372

1658

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1373

1659

if not stat.S_ISCHR(os.fstat(null).st_mode):

1374

1660

raise OSError(errno.ENODEV,

1375

u"/dev/null not a character device")

1661

u"%s not a character device"

1662

% os.path.devnull)

1376

1663

os.dup2(null, sys.stdin.fileno())

1377

1664

os.dup2(null, sys.stdout.fileno())

1378

1665

os.dup2(null, sys.stderr.fileno())

1397

1684

parser.add_option("--debug", action=u"store_true",

1398

1685

help=u"Debug mode; run in foreground and log to"

1399

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1400

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1401

1690

u" priority string (see GnuTLS documentation)")

1402

1691

parser.add_option("--servicename", type=u"string",

1427

1716

u"servicename": u"Mandos",

1428

1717

u"use_dbus": u"True",

1429

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1430

1720

}

1431

1721

1432

1722

# Parse config file for server-global settings

1449

1739

# options, if set.

1450

1740

for option in (u"interface", u"address", u"port", u"debug",

1451

1741

u"priority", u"servicename", u"configdir",

1452

u"use_dbus", u"use_ipv6"):

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1453

1743

value = getattr(options, option)

1454

1744

if value is not None:

1455

1745

server_settings[option] = value

1464

1754

1465

1755

# For convenience

1466

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1467

1758

use_dbus = server_settings[u"use_dbus"]

1468

1759

use_ipv6 = server_settings[u"use_ipv6"]

1469

1470

if not debug:

1471

syslogger.setLevel(logging.WARNING)

1472

console.setLevel(logging.WARNING)

1473

1760

1474

1761

if server_settings[u"servicename"] != u"Mandos":

1475

1762

syslogger.setFormatter(logging.Formatter

1476

1763

(u'Mandos (%s) [%%(process)d]:'

1482

1769

u"interval": u"5m",

1483

1770

u"checker": u"fping -q -- %%(host)s",

1484

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1485

1774

}

1486

1775

client_config = configparser.SafeConfigParser(client_defaults)

1487

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1493

1782

tcp_server = MandosServer((server_settings[u"address"],

1494

1783

server_settings[u"port"]),

1495

1784

ClientHandler,

1496

interface=server_settings[u"interface"],

1785

interface=(server_settings[u"interface"]

1786

or None),

1497

1787

use_ipv6=use_ipv6,

1498

1788

gnutls_priority=

1499

1789

server_settings[u"priority"],

1500

1790

use_dbus=use_dbus)

1501

pidfilename = u"/var/run/mandos.pid"

1502

try:

1503

pidfile = open(pidfilename, u"w")

1504

except IOError:

1505

logger.error(u"Could not open file %r", pidfilename)

1791

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1793

try:

1794

pidfile = open(pidfilename, u"w")

1795

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1506

1797

1507

1798

try:

1508

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1525

1816

if error[0] != errno.EPERM:

1526

1817

raise error

1527

1818

1528

# Enable all possible GnuTLS debugging

1819

if not debug and not debuglevel:

1820

syslogger.setLevel(logging.WARNING)

1821

console.setLevel(logging.WARNING)

1822

if debuglevel:

1823

level = getattr(logging, debuglevel.upper())

1824

syslogger.setLevel(level)

1825

console.setLevel(level)

1826

1529

1827

if debug:

1828

# Enable all possible GnuTLS debugging

1829

1530

1830

# "Use a log level over 10 to enable all debugging options."

1531

1831

# - GnuTLS manual

1532

1832

gnutls.library.functions.gnutls_global_set_log_level(11)

1537

1837

1538

1838

(gnutls.library.functions

1539

1839

.gnutls_global_set_log_function(debug_gnutls))

1840

1841

# Redirect stdin so all checkers get /dev/null

1842

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1843

os.dup2(null, sys.stdin.fileno())

1844

if null > 2:

1845

os.close(null)

1846

else:

1847

# No console logging

1848

logger.removeHandler(console)

1849

1850

# Need to fork before connecting to D-Bus

1851

if not debug:

1852

# Close all input and output, do double fork, etc.

1853

daemon()

1540

1854

1541

1855

global main_loop

1542

1856

# From the Avahi example code

1545

1859

bus = dbus.SystemBus()

1546

1860

# End of Avahi example code

1547

1861

if use_dbus:

1548

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1862

try:

1863

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1864

bus, do_not_queue=True)

1865

except dbus.exceptions.NameExistsException, e:

1866

logger.error(unicode(e) + u", disabling D-Bus")

1867

use_dbus = False

1868

server_settings[u"use_dbus"] = False

1869

tcp_server.use_dbus = False

1549

1870

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1550

1871

service = AvahiService(name = server_settings[u"servicename"],

1551

1872

servicetype = u"_mandos._tcp",

1554

1875

service.interface = (if_nametoindex

1555

1876

(str(server_settings[u"interface"])))

1556

1877

1878

global multiprocessing_manager

1879

multiprocessing_manager = multiprocessing.Manager()

1880

1557

1881

client_class = Client

1558

1882

if use_dbus:

1559

1883

client_class = functools.partial(ClientDBus, bus = bus)

1884

def client_config_items(config, section):

1885

special_settings = {

1886

"approved_by_default":

1887

lambda: config.getboolean(section,

1888

"approved_by_default"),

1889

}

1890

for name, value in config.items(section):

1891

try:

1892

yield (name, special_settings[name]())

1893

except KeyError:

1894

yield (name, value)

1895

1560

1896

tcp_server.clients.update(set(

1561

1897

client_class(name = section,

1562

config= dict(client_config.items(section)))

1898

config= dict(client_config_items(

1899

client_config, section)))

1563

1900

for section in client_config.sections()))

1564

1901

if not tcp_server.clients:

1565

1902

logger.warning(u"No clients defined")

1566

1567

if debug:

1568

# Redirect stdin so all checkers get /dev/null

1569

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1570

os.dup2(null, sys.stdin.fileno())

1571

if null > 2:

1572

os.close(null)

1573

else:

1574

# No console logging

1575

logger.removeHandler(console)

1576

# Close all input and output, do double fork, etc.

1577

daemon()

1578

1579

try:

1580

with closing(pidfile):

1581

pid = os.getpid()

1582

pidfile.write(str(pid) + "\n")

1583

del pidfile

1584

except IOError:

1585

logger.error(u"Could not write to file %r with PID %d",

1586

pidfilename, pid)

1587

except NameError:

1588

# "pidfile" was never created

1589

pass

1590

del pidfilename

1591

1592

def cleanup():

1593

"Cleanup function; run on exit"

1594

service.cleanup()

1595

1903

1596

while tcp_server.clients:

1597

client = tcp_server.clients.pop()

1598

client.disable_hook = None

1599

client.disable()

1600

1601

atexit.register(cleanup)

1602

1603

1904

if not debug:

1905

try:

1906

with pidfile:

1907

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

1909

del pidfile

1910

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

1912

pidfilename, pid)

1913

except NameError:

1914

# "pidfile" was never created

1915

pass

1916

del pidfilename

1917

1604

1918

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

1605

1920

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1606

1921

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1607

1922

1612

1927

dbus.service.Object.__init__(self, bus, u"/")

1613

1928

_interface = u"se.bsnet.fukt.Mandos"

1614

1929

1615

@dbus.service.signal(_interface, signature=u"oa{sv}")

1616

def ClientAdded(self, objpath, properties):

1930

@dbus.service.signal(_interface, signature=u"o")

1931

def ClientAdded(self, objpath):

1617

1932

"D-Bus signal"

1618

1933

pass

1619

1934

1620

@dbus.service.signal(_interface, signature=u"s")

1621

def ClientNotFound(self, fingerprint):

1935

@dbus.service.signal(_interface, signature=u"ss")

1936

def ClientNotFound(self, fingerprint, address):

1622

1937

"D-Bus signal"

1623

1938

pass

1624

1939

1650

1965

tcp_server.clients.remove(c)

1651

1966

c.remove_from_connection()

1652

1967

# Don't signal anything except ClientRemoved

1653

c.disable(signal=False)

1968

c.disable(quiet=True)

1654

1969

# Emit D-Bus signal

1655

1970

self.ClientRemoved(object_path, c.name)

1656

1971

return

1657

raise KeyError

1972

raise KeyError(object_path)

1658

1973

1659

1974

del _interface

1660

1975

1661

1976

mandos_dbus_service = MandosDBusService()

1662

1977

1978

def cleanup():

1979

"Cleanup function; run on exit"

1980

service.cleanup()

1981

1982

while tcp_server.clients:

1983

client = tcp_server.clients.pop()

1984

if use_dbus:

1985

client.remove_from_connection()

1986

client.disable_hook = None

1987

# Don't signal anything except ClientRemoved

1988

client.disable(quiet=True)

1989

if use_dbus:

1990

# Emit D-Bus signal

1991

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1992

client.name)

1993

1994

atexit.register(cleanup)

1995

1663

1996

for client in tcp_server.clients:

1664

1997

if use_dbus:

1665

1998

# Emit D-Bus signal

1666

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1667

client.GetAll(u""))

1999

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1668

2000

client.enable()

1669

2001

1670

2002

tcp_server.enable()

1688

2020

service.activate()

1689

2021

except dbus.exceptions.DBusException, error:

1690

2022

logger.critical(u"DBusException: %s", error)

2023

cleanup()

1691

2024

sys.exit(1)

1692

2025

# End of Avahi example code

1693

2026

1700

2033

main_loop.run()

1701

2034

except AvahiError, error:

1702

2035

logger.critical(u"AvahiError: %s", error)

2036

cleanup()

1703

2037

sys.exit(1)

1704

2038

except KeyboardInterrupt:

1705

2039

if debug:

1706

2040

print >> sys.stderr

1707

2041

logger.debug(u"Server received KeyboardInterrupt")

1708

2042

logger.debug(u"Server exiting")

2043

# Must run before the D-Bus bus name gets deregistered

2044

cleanup()

1709

2045

1710

2046

if __name__ == '__main__':

1711

2047

main()