To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 482
- compare with another revision
- download diff
- download tarball
- view history from revision 482
- Committer: Teddy Hogeborn
- Date: 2011-04-02 06:37:18 UTC
- Revision ID: teddy@fukt.bsnet.se-20110402063718-13ldrcuu0t33sdc4
* mandos: Tolerate restarting Avahi servers. Also Changed to new
"except x as y" exception syntax.
(AvahiService.entry_group_state_changed_match): New; contains the
SignalMatch object.
(AvahiService.remove): Really remove the group and the signal
connection, if any.
(AvahiService.add): Always create a new group and signal connection.
(AvahiService.cleanup): Changed to simply call remove().
(AvahiService.server_state_changed): Handle and log more bad states.
(AvahiService.activate): Set "follow_name_owner_changes=True" on the
Avahi Server proxy object.
(ClientDBus.checked_ok): Do not return anything.
(ClientDBus.CheckedOK): Do not return anything, as documented.
* mandos-monitor: Call D-Bus methods asynchronously.
"except x as y" exception syntax.
(AvahiService.entry_group_state_changed_match): New; contains the
SignalMatch object.
(AvahiService.remove): Really remove the group and the signal
connection, if any.
(AvahiService.add): Always create a new group and signal connection.
(AvahiService.cleanup): Changed to simply call remove().
(AvahiService.server_state_changed): Handle and log more bad states.
(AvahiService.activate): Set "follow_name_owner_changes=True" on the
Avahi Server proxy object.
(ClientDBus.checked_ok): Do not return anything.
(ClientDBus.CheckedOK): Do not return anything, as documented.
* mandos-monitor: Call D-Bus methods asynchronously.
- files added:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
35
36
36
37
import SocketServer as socketserver
37
38
import socket
38
import optparse
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
60
61
import fcntl
61
62
import functools
62
63
import cPickle as pickle
63
import select
64
import multiprocessing
64
65
65
66
import dbus
66
67
import dbus.service
81
82
SO_BINDTODEVICE = None
82
83
83
84
84
version = "1.0.14"
85
version = "1.3.0"
85
86
86
logger = logging.Logger(u'mandos')
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
87
89
syslogger = (logging.handlers.SysLogHandler
88
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
89
address = "/dev/log"))
91
address = str("/dev/log")))
90
92
syslogger.setFormatter(logging.Formatter
91
(u'Mandos [%(process)d]: %(levelname)s:'
92
u' %(message)s'))
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
93
95
logger.addHandler(syslogger)
94
96
95
97
console = logging.StreamHandler()
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
u' %(levelname)s:'
98
u' %(message)s'))
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
99
101
logger.addHandler(console)
100
102
101
103
class AvahiError(Exception):
118
120
Attributes:
119
121
interface: integer; avahi.IF_UNSPEC or an interface index.
120
122
Used to optionally bind to the specified interface.
121
name: string; Example: u'Mandos'
122
type: string; Example: u'_mandos._tcp'.
123
name: string; Example: 'Mandos'
124
type: string; Example: '_mandos._tcp'.
123
125
See <http://www.dns-sd.org/ServiceTypes.html>
124
126
port: integer; what port to announce
125
127
TXT: list of strings; TXT record for the service
134
136
"""
135
137
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
136
138
servicetype = None, port = None, TXT = None,
137
domain = u"", host = u"", max_renames = 32768,
139
domain = "", host = "", max_renames = 32768,
138
140
protocol = avahi.PROTO_UNSPEC, bus = None):
139
141
self.interface = interface
140
142
self.name = name
149
151
self.group = None # our entry group
150
152
self.server = None
151
153
self.bus = bus
154
self.entry_group_state_changed_match = None
152
155
def rename(self):
153
156
"""Derived from the Avahi example code"""
154
157
if self.rename_count >= self.max_renames:
155
logger.critical(u"No suitable Zeroconf service name found"
156
u" after %i retries, exiting.",
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
157
160
self.rename_count)
158
raise AvahiServiceError(u"Too many renames")
159
self.name = self.server.GetAlternativeServiceName(self.name)
160
logger.info(u"Changing Zeroconf service name to %r ...",
161
unicode(self.name))
161
raise AvahiServiceError("Too many renames")
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
164
self.name)
162
165
syslogger.setFormatter(logging.Formatter
163
(u'Mandos (%s) [%%(process)d]:'
164
u' %%(levelname)s: %%(message)s'
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
165
168
% self.name))
166
169
self.remove()
167
self.add()
170
try:
171
self.add()
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
174
self.cleanup()
175
os._exit(1)
168
176
self.rename_count += 1
169
177
def remove(self):
170
178
"""Derived from the Avahi example code"""
171
179
if self.group is not None:
172
self.group.Reset()
180
try:
181
self.group.Free()
182
except (dbus.exceptions.UnknownMethodException,
183
dbus.exceptions.DBusException) as e:
184
pass
185
self.group = None
186
if self.entry_group_state_changed_match is not None:
187
self.entry_group_state_changed_match.remove()
188
self.entry_group_state_changed_match = None
173
189
def add(self):
174
190
"""Derived from the Avahi example code"""
175
if self.group is None:
176
self.group = dbus.Interface(
177
self.bus.get_object(avahi.DBUS_NAME,
178
self.server.EntryGroupNew()),
179
avahi.DBUS_INTERFACE_ENTRY_GROUP)
180
self.group.connect_to_signal('StateChanged',
181
self
182
.entry_group_state_changed)
183
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
191
self.remove()
192
self.group = dbus.Interface(
193
self.bus.get_object(avahi.DBUS_NAME,
194
self.server.EntryGroupNew(),
195
follow_name_owner_changes=True),
196
avahi.DBUS_INTERFACE_ENTRY_GROUP)
197
self.entry_group_state_changed_match = (
198
self.group.connect_to_signal(
199
'StateChanged', self .entry_group_state_changed))
200
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
184
201
self.name, self.type)
185
202
self.group.AddService(
186
203
self.interface,
193
210
self.group.Commit()
194
211
def entry_group_state_changed(self, state, error):
195
212
"""Derived from the Avahi example code"""
196
logger.debug(u"Avahi state change: %i", state)
213
logger.debug("Avahi entry group state change: %i", state)
197
214
198
215
if state == avahi.ENTRY_GROUP_ESTABLISHED:
199
logger.debug(u"Zeroconf service established.")
216
logger.debug("Zeroconf service established.")
200
217
elif state == avahi.ENTRY_GROUP_COLLISION:
201
logger.warning(u"Zeroconf service name collision.")
218
logger.info("Zeroconf service name collision.")
202
219
self.rename()
203
220
elif state == avahi.ENTRY_GROUP_FAILURE:
204
logger.critical(u"Avahi: Error in group state changed %s",
221
logger.critical("Avahi: Error in group state changed %s",
205
222
unicode(error))
206
raise AvahiGroupError(u"State changed: %s"
223
raise AvahiGroupError("State changed: %s"
207
224
% unicode(error))
208
225
def cleanup(self):
209
226
"""Derived from the Avahi example code"""
210
if self.group is not None:
211
self.group.Free()
212
self.group = None
213
def server_state_changed(self, state):
227
self.remove()
228
def server_state_changed(self, state, error=None):
214
229
"""Derived from the Avahi example code"""
215
if state == avahi.SERVER_COLLISION:
216
logger.error(u"Zeroconf server name collision")
230
logger.debug("Avahi server state change: %i", state)
231
bad_states = { avahi.SERVER_INVALID:
232
"Zeroconf server invalid",
233
avahi.SERVER_REGISTERING: None,
234
avahi.SERVER_COLLISION:
235
"Zeroconf server name collision",
236
avahi.SERVER_FAILURE:
237
"Zeroconf server failure" }
238
if state in bad_states:
239
if bad_states[state]:
240
logger.error(bad_states[state])
217
241
self.remove()
218
242
elif state == avahi.SERVER_RUNNING:
219
243
self.add()
244
else:
245
logger.debug("Unknown state: %r", state)
220
246
def activate(self):
221
247
"""Derived from the Avahi example code"""
222
248
if self.server is None:
223
249
self.server = dbus.Interface(
224
250
self.bus.get_object(avahi.DBUS_NAME,
225
avahi.DBUS_PATH_SERVER),
251
avahi.DBUS_PATH_SERVER,
252
follow_name_owner_changes=True),
226
253
avahi.DBUS_INTERFACE_SERVER)
227
self.server.connect_to_signal(u"StateChanged",
254
self.server.connect_to_signal("StateChanged",
228
255
self.server_state_changed)
229
256
self.server_state_changed(self.server.GetState())
230
257
233
260
"""A representation of a client host served by this server.
234
261
235
262
Attributes:
236
name: string; from the config file, used in log messages and
237
D-Bus identifiers
263
_approved: bool(); 'None' if not yet approved/disapproved
264
approval_delay: datetime.timedelta(); Time to wait for approval
265
approval_duration: datetime.timedelta(); Duration of one approval
266
checker: subprocess.Popen(); a running checker process used
267
to see if the client lives.
268
'None' if no process is running.
269
checker_callback_tag: a gobject event source tag, or None
270
checker_command: string; External command which is run to check
271
if client lives. %() expansions are done at
272
runtime with vars(self) as dict, so that for
273
instance %(name)s can be used in the command.
274
checker_initiator_tag: a gobject event source tag, or None
275
created: datetime.datetime(); (UTC) object creation
276
current_checker_command: string; current running checker_command
277
disable_hook: If set, called by disable() as disable_hook(self)
278
disable_initiator_tag: a gobject event source tag, or None
279
enabled: bool()
238
280
fingerprint: string (40 or 32 hexadecimal digits); used to
239
281
uniquely identify the client
240
secret: bytestring; sent verbatim (over TLS) to client
241
282
host: string; available for use by the checker command
242
created: datetime.datetime(); (UTC) object creation
283
interval: datetime.timedelta(); How often to start a new checker
284
last_approval_request: datetime.datetime(); (UTC) or None
285
last_checked_ok: datetime.datetime(); (UTC) or None
243
286
last_enabled: datetime.datetime(); (UTC)
244
enabled: bool()
245
last_checked_ok: datetime.datetime(); (UTC) or None
287
name: string; from the config file, used in log messages and
288
D-Bus identifiers
289
secret: bytestring; sent verbatim (over TLS) to client
246
290
timeout: datetime.timedelta(); How long from last_checked_ok
247
291
until this client is disabled
248
interval: datetime.timedelta(); How often to start a new checker
249
disable_hook: If set, called by disable() as disable_hook(self)
250
checker: subprocess.Popen(); a running checker process used
251
to see if the client lives.
252
'None' if no process is running.
253
checker_initiator_tag: a gobject event source tag, or None
254
disable_initiator_tag: - '' -
255
checker_callback_tag: - '' -
256
checker_command: string; External command which is run to check if
257
client lives. %() expansions are done at
258
runtime with vars(self) as dict, so that for
259
instance %(name)s can be used in the command.
260
current_checker_command: string; current running checker_command
292
runtime_expansions: Allowed attributes for runtime expansion.
261
293
"""
262
294
295
runtime_expansions = ("approval_delay", "approval_duration",
296
"created", "enabled", "fingerprint",
297
"host", "interval", "last_checked_ok",
298
"last_enabled", "name", "timeout")
299
263
300
@staticmethod
264
301
def _timedelta_to_milliseconds(td):
265
302
"Convert a datetime.timedelta() to milliseconds"
274
311
def interval_milliseconds(self):
275
312
"Return the 'interval' attribute in milliseconds"
276
313
return self._timedelta_to_milliseconds(self.interval)
314
315
def approval_delay_milliseconds(self):
316
return self._timedelta_to_milliseconds(self.approval_delay)
277
317
278
318
def __init__(self, name = None, disable_hook=None, config=None):
279
319
"""Note: the 'checker' key in 'config' sets the
282
322
self.name = name
283
323
if config is None:
284
324
config = {}
285
logger.debug(u"Creating client %r", self.name)
325
logger.debug("Creating client %r", self.name)
286
326
# Uppercase and remove spaces from fingerprint for later
287
327
# comparison purposes with return value from the fingerprint()
288
328
# function
289
self.fingerprint = (config[u"fingerprint"].upper()
290
.replace(u" ", u""))
291
logger.debug(u" Fingerprint: %s", self.fingerprint)
292
if u"secret" in config:
293
self.secret = config[u"secret"].decode(u"base64")
294
elif u"secfile" in config:
329
self.fingerprint = (config["fingerprint"].upper()
330
.replace(" ", ""))
331
logger.debug(" Fingerprint: %s", self.fingerprint)
332
if "secret" in config:
333
self.secret = config["secret"].decode("base64")
334
elif "secfile" in config:
295
335
with open(os.path.expanduser(os.path.expandvars
296
(config[u"secfile"])),
336
(config["secfile"])),
297
337
"rb") as secfile:
298
338
self.secret = secfile.read()
299
339
else:
300
raise TypeError(u"No secret or secfile for client %s"
340
raise TypeError("No secret or secfile for client %s"
301
341
% self.name)
302
self.host = config.get(u"host", u"")
342
self.host = config.get("host", "")
303
343
self.created = datetime.datetime.utcnow()
304
344
self.enabled = False
345
self.last_approval_request = None
305
346
self.last_enabled = None
306
347
self.last_checked_ok = None
307
self.timeout = string_to_delta(config[u"timeout"])
308
self.interval = string_to_delta(config[u"interval"])
348
self.timeout = string_to_delta(config["timeout"])
349
self.interval = string_to_delta(config["interval"])
309
350
self.disable_hook = disable_hook
310
351
self.checker = None
311
352
self.checker_initiator_tag = None
312
353
self.disable_initiator_tag = None
313
354
self.checker_callback_tag = None
314
self.checker_command = config[u"checker"]
355
self.checker_command = config["checker"]
315
356
self.current_checker_command = None
316
357
self.last_connect = None
358
self._approved = None
359
self.approved_by_default = config.get("approved_by_default",
360
True)
361
self.approvals_pending = 0
362
self.approval_delay = string_to_delta(
363
config["approval_delay"])
364
self.approval_duration = string_to_delta(
365
config["approval_duration"])
366
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
317
367
368
def send_changedstate(self):
369
self.changedstate.acquire()
370
self.changedstate.notify_all()
371
self.changedstate.release()
372
318
373
def enable(self):
319
374
"""Start this client's checker and timeout hooks"""
320
if getattr(self, u"enabled", False):
375
if getattr(self, "enabled", False):
321
376
# Already enabled
322
377
return
378
self.send_changedstate()
323
379
self.last_enabled = datetime.datetime.utcnow()
324
380
# Schedule a new checker to be started an 'interval' from now,
325
381
# and every interval from then on.
339
395
if not getattr(self, "enabled", False):
340
396
return False
341
397
if not quiet:
342
logger.info(u"Disabling client %s", self.name)
343
if getattr(self, u"disable_initiator_tag", False):
398
self.send_changedstate()
399
if not quiet:
400
logger.info("Disabling client %s", self.name)
401
if getattr(self, "disable_initiator_tag", False):
344
402
gobject.source_remove(self.disable_initiator_tag)
345
403
self.disable_initiator_tag = None
346
if getattr(self, u"checker_initiator_tag", False):
404
if getattr(self, "checker_initiator_tag", False):
347
405
gobject.source_remove(self.checker_initiator_tag)
348
406
self.checker_initiator_tag = None
349
407
self.stop_checker()
364
422
if os.WIFEXITED(condition):
365
423
exitstatus = os.WEXITSTATUS(condition)
366
424
if exitstatus == 0:
367
logger.info(u"Checker for %(name)s succeeded",
425
logger.info("Checker for %(name)s succeeded",
368
426
vars(self))
369
427
self.checked_ok()
370
428
else:
371
logger.info(u"Checker for %(name)s failed",
429
logger.info("Checker for %(name)s failed",
372
430
vars(self))
373
431
else:
374
logger.warning(u"Checker for %(name)s crashed?",
432
logger.warning("Checker for %(name)s crashed?",
375
433
vars(self))
376
434
377
435
def checked_ok(self):
386
444
(self.timeout_milliseconds(),
387
445
self.disable))
388
446
447
def need_approval(self):
448
self.last_approval_request = datetime.datetime.utcnow()
449
389
450
def start_checker(self):
390
451
"""Start a new checker subprocess if one is not running.
391
452
403
464
# If a checker exists, make sure it is not a zombie
404
465
try:
405
466
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
406
except (AttributeError, OSError), error:
467
except (AttributeError, OSError) as error:
407
468
if (isinstance(error, OSError)
408
469
and error.errno != errno.ECHILD):
409
470
raise error
410
471
else:
411
472
if pid:
412
logger.warning(u"Checker was a zombie")
473
logger.warning("Checker was a zombie")
413
474
gobject.source_remove(self.checker_callback_tag)
414
475
self.checker_callback(pid, status,
415
476
self.current_checker_command)
420
481
command = self.checker_command % self.host
421
482
except TypeError:
422
483
# Escape attributes for the shell
423
escaped_attrs = dict((key,
424
re.escape(unicode(str(val),
425
errors=
426
u'replace')))
427
for key, val in
428
vars(self).iteritems())
484
escaped_attrs = dict(
485
(attr,
486
re.escape(unicode(str(getattr(self, attr, "")),
487
errors=
488
'replace')))
489
for attr in
490
self.runtime_expansions)
491
429
492
try:
430
493
command = self.checker_command % escaped_attrs
431
except TypeError, error:
432
logger.error(u'Could not format string "%s":'
433
u' %s', self.checker_command, error)
494
except TypeError as error:
495
logger.error('Could not format string "%s":'
496
' %s', self.checker_command, error)
434
497
return True # Try again later
435
498
self.current_checker_command = command
436
499
try:
437
logger.info(u"Starting checker %r for %s",
500
logger.info("Starting checker %r for %s",
438
501
command, self.name)
439
502
# We don't need to redirect stdout and stderr, since
440
503
# in normal mode, that is already done by daemon(),
442
505
# always replaced by /dev/null.)
443
506
self.checker = subprocess.Popen(command,
444
507
close_fds=True,
445
shell=True, cwd=u"/")
508
shell=True, cwd="/")
446
509
self.checker_callback_tag = (gobject.child_watch_add
447
510
(self.checker.pid,
448
511
self.checker_callback,
453
516
if pid:
454
517
gobject.source_remove(self.checker_callback_tag)
455
518
self.checker_callback(pid, status, command)
456
except OSError, error:
457
logger.error(u"Failed to start subprocess: %s",
519
except OSError as error:
520
logger.error("Failed to start subprocess: %s",
458
521
error)
459
522
# Re-run this periodically if run by gobject.timeout_add
460
523
return True
464
527
if self.checker_callback_tag:
465
528
gobject.source_remove(self.checker_callback_tag)
466
529
self.checker_callback_tag = None
467
if getattr(self, u"checker", None) is None:
530
if getattr(self, "checker", None) is None:
468
531
return
469
logger.debug(u"Stopping checker for %(name)s", vars(self))
532
logger.debug("Stopping checker for %(name)s", vars(self))
470
533
try:
471
534
os.kill(self.checker.pid, signal.SIGTERM)
472
535
#time.sleep(0.5)
473
536
#if self.checker.poll() is None:
474
537
# os.kill(self.checker.pid, signal.SIGKILL)
475
except OSError, error:
538
except OSError as error:
476
539
if error.errno != errno.ESRCH: # No such process
477
540
raise
478
541
self.checker = None
479
542
480
481
def dbus_service_property(dbus_interface, signature=u"v",
482
access=u"readwrite", byte_arrays=False):
543
def dbus_service_property(dbus_interface, signature="v",
544
access="readwrite", byte_arrays=False):
483
545
"""Decorators for marking methods of a DBusObjectWithProperties to
484
546
become properties on the D-Bus.
485
547
492
554
"""
493
555
# Encoding deeply encoded byte arrays is not supported yet by the
494
556
# "Set" method, so we fail early here:
495
if byte_arrays and signature != u"ay":
496
raise ValueError(u"Byte arrays not supported for non-'ay'"
497
u" signature %r" % signature)
557
if byte_arrays and signature != "ay":
558
raise ValueError("Byte arrays not supported for non-'ay'"
559
" signature %r" % signature)
498
560
def decorator(func):
499
561
func._dbus_is_property = True
500
562
func._dbus_interface = dbus_interface
501
563
func._dbus_signature = signature
502
564
func._dbus_access = access
503
565
func._dbus_name = func.__name__
504
if func._dbus_name.endswith(u"_dbus_property"):
566
if func._dbus_name.endswith("_dbus_property"):
505
567
func._dbus_name = func._dbus_name[:-14]
506
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
568
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
507
569
return func
508
570
return decorator
509
571
537
599
538
600
@staticmethod
539
601
def _is_dbus_property(obj):
540
return getattr(obj, u"_dbus_is_property", False)
602
return getattr(obj, "_dbus_is_property", False)
541
603
542
604
def _get_all_dbus_properties(self):
543
605
"""Returns a generator of (name, attribute) pairs
551
613
property with the specified name and interface.
552
614
"""
553
615
for name in (property_name,
554
property_name + u"_dbus_property"):
616
property_name + "_dbus_property"):
555
617
prop = getattr(self, name, None)
556
618
if (prop is None
557
619
or not self._is_dbus_property(prop)
561
623
continue
562
624
return prop
563
625
# No such property
564
raise DBusPropertyNotFound(self.dbus_object_path + u":"
565
+ interface_name + u"."
626
raise DBusPropertyNotFound(self.dbus_object_path + ":"
627
+ interface_name + "."
566
628
+ property_name)
567
629
568
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
569
out_signature=u"v")
630
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
631
out_signature="v")
570
632
def Get(self, interface_name, property_name):
571
633
"""Standard D-Bus property Get() method, see D-Bus standard.
572
634
"""
573
635
prop = self._get_dbus_property(interface_name, property_name)
574
if prop._dbus_access == u"write":
636
if prop._dbus_access == "write":
575
637
raise DBusPropertyAccessException(property_name)
576
638
value = prop()
577
if not hasattr(value, u"variant_level"):
639
if not hasattr(value, "variant_level"):
578
640
return value
579
641
return type(value)(value, variant_level=value.variant_level+1)
580
642
581
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
643
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
582
644
def Set(self, interface_name, property_name, value):
583
645
"""Standard D-Bus property Set() method, see D-Bus standard.
584
646
"""
585
647
prop = self._get_dbus_property(interface_name, property_name)
586
if prop._dbus_access == u"read":
648
if prop._dbus_access == "read":
587
649
raise DBusPropertyAccessException(property_name)
588
if prop._dbus_get_args_options[u"byte_arrays"]:
650
if prop._dbus_get_args_options["byte_arrays"]:
589
651
# The byte_arrays option is not supported yet on
590
652
# signatures other than "ay".
591
if prop._dbus_signature != u"ay":
653
if prop._dbus_signature != "ay":
592
654
raise ValueError
593
655
value = dbus.ByteArray(''.join(unichr(byte)
594
656
for byte in value))
595
657
prop(value)
596
658
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
598
out_signature=u"a{sv}")
659
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
660
out_signature="a{sv}")
599
661
def GetAll(self, interface_name):
600
662
"""Standard D-Bus property GetAll() method, see D-Bus
601
663
standard.
609
671
# Interface non-empty but did not match
610
672
continue
611
673
# Ignore write-only properties
612
if prop._dbus_access == u"write":
674
if prop._dbus_access == "write":
613
675
continue
614
676
value = prop()
615
if not hasattr(value, u"variant_level"):
677
if not hasattr(value, "variant_level"):
616
678
all[name] = value
617
679
continue
618
680
all[name] = type(value)(value, variant_level=
619
681
value.variant_level+1)
620
return dbus.Dictionary(all, signature=u"sv")
682
return dbus.Dictionary(all, signature="sv")
621
683
622
684
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
623
out_signature=u"s",
685
out_signature="s",
624
686
path_keyword='object_path',
625
687
connection_keyword='connection')
626
688
def Introspect(self, object_path, connection):
631
693
try:
632
694
document = xml.dom.minidom.parseString(xmlstring)
633
695
def make_tag(document, name, prop):
634
e = document.createElement(u"property")
635
e.setAttribute(u"name", name)
636
e.setAttribute(u"type", prop._dbus_signature)
637
e.setAttribute(u"access", prop._dbus_access)
696
e = document.createElement("property")
697
e.setAttribute("name", name)
698
e.setAttribute("type", prop._dbus_signature)
699
e.setAttribute("access", prop._dbus_access)
638
700
return e
639
for if_tag in document.getElementsByTagName(u"interface"):
701
for if_tag in document.getElementsByTagName("interface"):
640
702
for tag in (make_tag(document, name, prop)
641
703
for name, prop
642
704
in self._get_all_dbus_properties()
643
705
if prop._dbus_interface
644
== if_tag.getAttribute(u"name")):
706
== if_tag.getAttribute("name")):
645
707
if_tag.appendChild(tag)
646
708
# Add the names to the return values for the
647
709
# "org.freedesktop.DBus.Properties" methods
648
if (if_tag.getAttribute(u"name")
649
== u"org.freedesktop.DBus.Properties"):
650
for cn in if_tag.getElementsByTagName(u"method"):
651
if cn.getAttribute(u"name") == u"Get":
652
for arg in cn.getElementsByTagName(u"arg"):
653
if (arg.getAttribute(u"direction")
654
== u"out"):
655
arg.setAttribute(u"name", u"value")
656
elif cn.getAttribute(u"name") == u"GetAll":
657
for arg in cn.getElementsByTagName(u"arg"):
658
if (arg.getAttribute(u"direction")
659
== u"out"):
660
arg.setAttribute(u"name", u"props")
661
xmlstring = document.toxml(u"utf-8")
710
if (if_tag.getAttribute("name")
711
== "org.freedesktop.DBus.Properties"):
712
for cn in if_tag.getElementsByTagName("method"):
713
if cn.getAttribute("name") == "Get":
714
for arg in cn.getElementsByTagName("arg"):
715
if (arg.getAttribute("direction")
716
== "out"):
717
arg.setAttribute("name", "value")
718
elif cn.getAttribute("name") == "GetAll":
719
for arg in cn.getElementsByTagName("arg"):
720
if (arg.getAttribute("direction")
721
== "out"):
722
arg.setAttribute("name", "props")
723
xmlstring = document.toxml("utf-8")
662
724
document.unlink()
663
725
except (AttributeError, xml.dom.DOMException,
664
xml.parsers.expat.ExpatError), error:
665
logger.error(u"Failed to override Introspection method",
726
xml.parsers.expat.ExpatError) as error:
727
logger.error("Failed to override Introspection method",
666
728
error)
667
729
return xmlstring
668
730
674
736
dbus_object_path: dbus.ObjectPath
675
737
bus: dbus.SystemBus()
676
738
"""
739
740
runtime_expansions = (Client.runtime_expansions
741
+ ("dbus_object_path",))
742
677
743
# dbus.service.Object doesn't use super(), so we can't either.
678
744
679
745
def __init__(self, bus = None, *args, **kwargs):
746
self._approvals_pending = 0
680
747
self.bus = bus
681
748
Client.__init__(self, *args, **kwargs)
682
749
# Only now, when this client is initialized, can it show up on
683
750
# the D-Bus
751
client_object_name = unicode(self.name).translate(
752
{ord("."): ord("_"),
753
ord("-"): ord("_")})
684
754
self.dbus_object_path = (dbus.ObjectPath
685
(u"/clients/"
686
+ self.name.replace(u".", u"_")))
755
("/clients/" + client_object_name))
687
756
DBusObjectWithProperties.__init__(self, self.bus,
688
757
self.dbus_object_path)
758
759
def _get_approvals_pending(self):
760
return self._approvals_pending
761
def _set_approvals_pending(self, value):
762
old_value = self._approvals_pending
763
self._approvals_pending = value
764
bval = bool(value)
765
if (hasattr(self, "dbus_object_path")
766
and bval is not bool(old_value)):
767
dbus_bool = dbus.Boolean(bval, variant_level=1)
768
self.PropertyChanged(dbus.String("ApprovalPending"),
769
dbus_bool)
770
771
approvals_pending = property(_get_approvals_pending,
772
_set_approvals_pending)
773
del _get_approvals_pending, _set_approvals_pending
689
774
690
775
@staticmethod
691
776
def _datetime_to_dbus(dt, variant_level=0):
694
779
variant_level=variant_level)
695
780
696
781
def enable(self):
697
oldstate = getattr(self, u"enabled", False)
782
oldstate = getattr(self, "enabled", False)
698
783
r = Client.enable(self)
699
784
if oldstate != self.enabled:
700
785
# Emit D-Bus signals
701
self.PropertyChanged(dbus.String(u"enabled"),
786
self.PropertyChanged(dbus.String("Enabled"),
702
787
dbus.Boolean(True, variant_level=1))
703
788
self.PropertyChanged(
704
dbus.String(u"last_enabled"),
789
dbus.String("LastEnabled"),
705
790
self._datetime_to_dbus(self.last_enabled,
706
791
variant_level=1))
707
792
return r
708
793
709
794
def disable(self, quiet = False):
710
oldstate = getattr(self, u"enabled", False)
795
oldstate = getattr(self, "enabled", False)
711
796
r = Client.disable(self, quiet=quiet)
712
797
if not quiet and oldstate != self.enabled:
713
798
# Emit D-Bus signal
714
self.PropertyChanged(dbus.String(u"enabled"),
799
self.PropertyChanged(dbus.String("Enabled"),
715
800
dbus.Boolean(False, variant_level=1))
716
801
return r
717
802
720
805
self.remove_from_connection()
721
806
except LookupError:
722
807
pass
723
if hasattr(DBusObjectWithProperties, u"__del__"):
808
if hasattr(DBusObjectWithProperties, "__del__"):
724
809
DBusObjectWithProperties.__del__(self, *args, **kwargs)
725
810
Client.__del__(self, *args, **kwargs)
726
811
729
814
self.checker_callback_tag = None
730
815
self.checker = None
731
816
# Emit D-Bus signal
732
self.PropertyChanged(dbus.String(u"checker_running"),
817
self.PropertyChanged(dbus.String("CheckerRunning"),
733
818
dbus.Boolean(False, variant_level=1))
734
819
if os.WIFEXITED(condition):
735
820
exitstatus = os.WEXITSTATUS(condition)
747
832
*args, **kwargs)
748
833
749
834
def checked_ok(self, *args, **kwargs):
750
r = Client.checked_ok(self, *args, **kwargs)
835
Client.checked_ok(self, *args, **kwargs)
751
836
# Emit D-Bus signal
752
837
self.PropertyChanged(
753
dbus.String(u"last_checked_ok"),
838
dbus.String("LastCheckedOK"),
754
839
(self._datetime_to_dbus(self.last_checked_ok,
755
840
variant_level=1)))
841
842
def need_approval(self, *args, **kwargs):
843
r = Client.need_approval(self, *args, **kwargs)
844
# Emit D-Bus signal
845
self.PropertyChanged(
846
dbus.String("LastApprovalRequest"),
847
(self._datetime_to_dbus(self.last_approval_request,
848
variant_level=1)))
756
849
return r
757
850
758
851
def start_checker(self, *args, **kwargs):
768
861
# Emit D-Bus signal
769
862
self.CheckerStarted(self.current_checker_command)
770
863
self.PropertyChanged(
771
dbus.String(u"checker_running"),
864
dbus.String("CheckerRunning"),
772
865
dbus.Boolean(True, variant_level=1))
773
866
return r
774
867
775
868
def stop_checker(self, *args, **kwargs):
776
old_checker = getattr(self, u"checker", None)
869
old_checker = getattr(self, "checker", None)
777
870
r = Client.stop_checker(self, *args, **kwargs)
778
871
if (old_checker is not None
779
and getattr(self, u"checker", None) is None):
780
self.PropertyChanged(dbus.String(u"checker_running"),
872
and getattr(self, "checker", None) is None):
873
self.PropertyChanged(dbus.String("CheckerRunning"),
781
874
dbus.Boolean(False, variant_level=1))
782
875
return r
876
877
def _reset_approved(self):
878
self._approved = None
879
return False
880
881
def approve(self, value=True):
882
self.send_changedstate()
883
self._approved = value
884
gobject.timeout_add(self._timedelta_to_milliseconds
885
(self.approval_duration),
886
self._reset_approved)
887
783
888
784
889
## D-Bus methods, signals & properties
785
_interface = u"se.bsnet.fukt.Mandos.Client"
890
_interface = "se.bsnet.fukt.Mandos.Client"
786
891
787
892
## Signals
788
893
789
894
# CheckerCompleted - signal
790
@dbus.service.signal(_interface, signature=u"nxs")
895
@dbus.service.signal(_interface, signature="nxs")
791
896
def CheckerCompleted(self, exitcode, waitstatus, command):
792
897
"D-Bus signal"
793
898
pass
794
899
795
900
# CheckerStarted - signal
796
@dbus.service.signal(_interface, signature=u"s")
901
@dbus.service.signal(_interface, signature="s")
797
902
def CheckerStarted(self, command):
798
903
"D-Bus signal"
799
904
pass
800
905
801
906
# PropertyChanged - signal
802
@dbus.service.signal(_interface, signature=u"sv")
907
@dbus.service.signal(_interface, signature="sv")
803
908
def PropertyChanged(self, property, value):
804
909
"D-Bus signal"
805
910
pass
807
912
# GotSecret - signal
808
913
@dbus.service.signal(_interface)
809
914
def GotSecret(self):
810
"D-Bus signal"
915
"""D-Bus signal
916
Is sent after a successful transfer of secret from the Mandos
917
server to mandos-client
918
"""
811
919
pass
812
920
813
921
# Rejected - signal
814
@dbus.service.signal(_interface)
815
def Rejected(self):
922
@dbus.service.signal(_interface, signature="s")
923
def Rejected(self, reason):
816
924
"D-Bus signal"
817
925
pass
818
926
927
# NeedApproval - signal
928
@dbus.service.signal(_interface, signature="tb")
929
def NeedApproval(self, timeout, default):
930
"D-Bus signal"
931
return self.need_approval()
932
819
933
## Methods
820
934
935
# Approve - method
936
@dbus.service.method(_interface, in_signature="b")
937
def Approve(self, value):
938
self.approve(value)
939
821
940
# CheckedOK - method
822
941
@dbus.service.method(_interface)
823
942
def CheckedOK(self):
824
return self.checked_ok()
943
self.checked_ok()
825
944
826
945
# Enable - method
827
946
@dbus.service.method(_interface)
848
967
849
968
## Properties
850
969
851
# name - property
852
@dbus_service_property(_interface, signature=u"s", access=u"read")
853
def name_dbus_property(self):
970
# ApprovalPending - property
971
@dbus_service_property(_interface, signature="b", access="read")
972
def ApprovalPending_dbus_property(self):
973
return dbus.Boolean(bool(self.approvals_pending))
974
975
# ApprovedByDefault - property
976
@dbus_service_property(_interface, signature="b",
977
access="readwrite")
978
def ApprovedByDefault_dbus_property(self, value=None):
979
if value is None: # get
980
return dbus.Boolean(self.approved_by_default)
981
self.approved_by_default = bool(value)
982
# Emit D-Bus signal
983
self.PropertyChanged(dbus.String("ApprovedByDefault"),
984
dbus.Boolean(value, variant_level=1))
985
986
# ApprovalDelay - property
987
@dbus_service_property(_interface, signature="t",
988
access="readwrite")
989
def ApprovalDelay_dbus_property(self, value=None):
990
if value is None: # get
991
return dbus.UInt64(self.approval_delay_milliseconds())
992
self.approval_delay = datetime.timedelta(0, 0, 0, value)
993
# Emit D-Bus signal
994
self.PropertyChanged(dbus.String("ApprovalDelay"),
995
dbus.UInt64(value, variant_level=1))
996
997
# ApprovalDuration - property
998
@dbus_service_property(_interface, signature="t",
999
access="readwrite")
1000
def ApprovalDuration_dbus_property(self, value=None):
1001
if value is None: # get
1002
return dbus.UInt64(self._timedelta_to_milliseconds(
1003
self.approval_duration))
1004
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1005
# Emit D-Bus signal
1006
self.PropertyChanged(dbus.String("ApprovalDuration"),
1007
dbus.UInt64(value, variant_level=1))
1008
1009
# Name - property
1010
@dbus_service_property(_interface, signature="s", access="read")
1011
def Name_dbus_property(self):
854
1012
return dbus.String(self.name)
855
1013
856
# fingerprint - property
857
@dbus_service_property(_interface, signature=u"s", access=u"read")
858
def fingerprint_dbus_property(self):
1014
# Fingerprint - property
1015
@dbus_service_property(_interface, signature="s", access="read")
1016
def Fingerprint_dbus_property(self):
859
1017
return dbus.String(self.fingerprint)
860
1018
861
# host - property
862
@dbus_service_property(_interface, signature=u"s",
863
access=u"readwrite")
864
def host_dbus_property(self, value=None):
1019
# Host - property
1020
@dbus_service_property(_interface, signature="s",
1021
access="readwrite")
1022
def Host_dbus_property(self, value=None):
865
1023
if value is None: # get
866
1024
return dbus.String(self.host)
867
1025
self.host = value
868
1026
# Emit D-Bus signal
869
self.PropertyChanged(dbus.String(u"host"),
1027
self.PropertyChanged(dbus.String("Host"),
870
1028
dbus.String(value, variant_level=1))
871
1029
872
# created - property
873
@dbus_service_property(_interface, signature=u"s", access=u"read")
874
def created_dbus_property(self):
1030
# Created - property
1031
@dbus_service_property(_interface, signature="s", access="read")
1032
def Created_dbus_property(self):
875
1033
return dbus.String(self._datetime_to_dbus(self.created))
876
1034
877
# last_enabled - property
878
@dbus_service_property(_interface, signature=u"s", access=u"read")
879
def last_enabled_dbus_property(self):
1035
# LastEnabled - property
1036
@dbus_service_property(_interface, signature="s", access="read")
1037
def LastEnabled_dbus_property(self):
880
1038
if self.last_enabled is None:
881
return dbus.String(u"")
1039
return dbus.String("")
882
1040
return dbus.String(self._datetime_to_dbus(self.last_enabled))
883
1041
884
# enabled - property
885
@dbus_service_property(_interface, signature=u"b",
886
access=u"readwrite")
887
def enabled_dbus_property(self, value=None):
1042
# Enabled - property
1043
@dbus_service_property(_interface, signature="b",
1044
access="readwrite")
1045
def Enabled_dbus_property(self, value=None):
888
1046
if value is None: # get
889
1047
return dbus.Boolean(self.enabled)
890
1048
if value:
892
1050
else:
893
1051
self.disable()
894
1052
895
# last_checked_ok - property
896
@dbus_service_property(_interface, signature=u"s",
897
access=u"readwrite")
898
def last_checked_ok_dbus_property(self, value=None):
1053
# LastCheckedOK - property
1054
@dbus_service_property(_interface, signature="s",
1055
access="readwrite")
1056
def LastCheckedOK_dbus_property(self, value=None):
899
1057
if value is not None:
900
1058
self.checked_ok()
901
1059
return
902
1060
if self.last_checked_ok is None:
903
return dbus.String(u"")
1061
return dbus.String("")
904
1062
return dbus.String(self._datetime_to_dbus(self
905
1063
.last_checked_ok))
906
1064
907
# timeout - property
908
@dbus_service_property(_interface, signature=u"t",
909
access=u"readwrite")
910
def timeout_dbus_property(self, value=None):
1065
# LastApprovalRequest - property
1066
@dbus_service_property(_interface, signature="s", access="read")
1067
def LastApprovalRequest_dbus_property(self):
1068
if self.last_approval_request is None:
1069
return dbus.String("")
1070
return dbus.String(self.
1071
_datetime_to_dbus(self
1072
.last_approval_request))
1073
1074
# Timeout - property
1075
@dbus_service_property(_interface, signature="t",
1076
access="readwrite")
1077
def Timeout_dbus_property(self, value=None):
911
1078
if value is None: # get
912
1079
return dbus.UInt64(self.timeout_milliseconds())
913
1080
self.timeout = datetime.timedelta(0, 0, 0, value)
914
1081
# Emit D-Bus signal
915
self.PropertyChanged(dbus.String(u"timeout"),
1082
self.PropertyChanged(dbus.String("Timeout"),
916
1083
dbus.UInt64(value, variant_level=1))
917
if getattr(self, u"disable_initiator_tag", None) is None:
1084
if getattr(self, "disable_initiator_tag", None) is None:
918
1085
return
919
1086
# Reschedule timeout
920
1087
gobject.source_remove(self.disable_initiator_tag)
932
1099
self.disable_initiator_tag = (gobject.timeout_add
933
1100
(time_to_die, self.disable))
934
1101
935
# interval - property
936
@dbus_service_property(_interface, signature=u"t",
937
access=u"readwrite")
938
def interval_dbus_property(self, value=None):
1102
# Interval - property
1103
@dbus_service_property(_interface, signature="t",
1104
access="readwrite")
1105
def Interval_dbus_property(self, value=None):
939
1106
if value is None: # get
940
1107
return dbus.UInt64(self.interval_milliseconds())
941
1108
self.interval = datetime.timedelta(0, 0, 0, value)
942
1109
# Emit D-Bus signal
943
self.PropertyChanged(dbus.String(u"interval"),
1110
self.PropertyChanged(dbus.String("Interval"),
944
1111
dbus.UInt64(value, variant_level=1))
945
if getattr(self, u"checker_initiator_tag", None) is None:
1112
if getattr(self, "checker_initiator_tag", None) is None:
946
1113
return
947
1114
# Reschedule checker run
948
1115
gobject.source_remove(self.checker_initiator_tag)
950
1117
(value, self.start_checker))
951
1118
self.start_checker() # Start one now, too
952
1119
953
# checker - property
954
@dbus_service_property(_interface, signature=u"s",
955
access=u"readwrite")
956
def checker_dbus_property(self, value=None):
1120
# Checker - property
1121
@dbus_service_property(_interface, signature="s",
1122
access="readwrite")
1123
def Checker_dbus_property(self, value=None):
957
1124
if value is None: # get
958
1125
return dbus.String(self.checker_command)
959
1126
self.checker_command = value
960
1127
# Emit D-Bus signal
961
self.PropertyChanged(dbus.String(u"checker"),
1128
self.PropertyChanged(dbus.String("Checker"),
962
1129
dbus.String(self.checker_command,
963
1130
variant_level=1))
964
1131
965
# checker_running - property
966
@dbus_service_property(_interface, signature=u"b",
967
access=u"readwrite")
968
def checker_running_dbus_property(self, value=None):
1132
# CheckerRunning - property
1133
@dbus_service_property(_interface, signature="b",
1134
access="readwrite")
1135
def CheckerRunning_dbus_property(self, value=None):
969
1136
if value is None: # get
970
1137
return dbus.Boolean(self.checker is not None)
971
1138
if value:
973
1140
else:
974
1141
self.stop_checker()
975
1142
976
# object_path - property
977
@dbus_service_property(_interface, signature=u"o", access=u"read")
978
def object_path_dbus_property(self):
1143
# ObjectPath - property
1144
@dbus_service_property(_interface, signature="o", access="read")
1145
def ObjectPath_dbus_property(self):
979
1146
return self.dbus_object_path # is already a dbus.ObjectPath
980
1147
981
# secret = property
982
@dbus_service_property(_interface, signature=u"ay",
983
access=u"write", byte_arrays=True)
984
def secret_dbus_property(self, value):
1148
# Secret = property
1149
@dbus_service_property(_interface, signature="ay",
1150
access="write", byte_arrays=True)
1151
def Secret_dbus_property(self, value):
985
1152
self.secret = str(value)
986
1153
987
1154
del _interface
988
1155
989
1156
1157
class ProxyClient(object):
1158
def __init__(self, child_pipe, fpr, address):
1159
self._pipe = child_pipe
1160
self._pipe.send(('init', fpr, address))
1161
if not self._pipe.recv():
1162
raise KeyError()
1163
1164
def __getattribute__(self, name):
1165
if(name == '_pipe'):
1166
return super(ProxyClient, self).__getattribute__(name)
1167
self._pipe.send(('getattr', name))
1168
data = self._pipe.recv()
1169
if data[0] == 'data':
1170
return data[1]
1171
if data[0] == 'function':
1172
def func(*args, **kwargs):
1173
self._pipe.send(('funcall', name, args, kwargs))
1174
return self._pipe.recv()[1]
1175
return func
1176
1177
def __setattr__(self, name, value):
1178
if(name == '_pipe'):
1179
return super(ProxyClient, self).__setattr__(name, value)
1180
self._pipe.send(('setattr', name, value))
1181
1182
990
1183
class ClientHandler(socketserver.BaseRequestHandler, object):
991
1184
"""A class to handle client connections.
992
1185
994
1187
Note: This will run in its own forked process."""
995
1188
996
1189
def handle(self):
997
logger.info(u"TCP connection from: %s",
998
unicode(self.client_address))
999
logger.debug(u"IPC Pipe FD: %d",
1000
self.server.child_pipe[1].fileno())
1001
# Open IPC pipe to parent process
1002
with contextlib.nested(self.server.child_pipe[1],
1003
self.server.parent_pipe[0]
1004
) as (ipc, ipc_return):
1190
with contextlib.closing(self.server.child_pipe) as child_pipe:
1191
logger.info("TCP connection from: %s",
1192
unicode(self.client_address))
1193
logger.debug("Pipe FD: %d",
1194
self.server.child_pipe.fileno())
1195
1005
1196
session = (gnutls.connection
1006
1197
.ClientSession(self.request,
1007
1198
gnutls.connection
1008
1199
.X509Credentials()))
1009
1200
1010
1201
# Note: gnutls.connection.X509Credentials is really a
1011
1202
# generic GnuTLS certificate credentials object so long as
1012
1203
# no X.509 keys are added to it. Therefore, we can use it
1013
1204
# here despite using OpenPGP certificates.
1014
1015
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1016
# u"+AES-256-CBC", u"+SHA1",
1017
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1018
# u"+DHE-DSS"))
1205
1206
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1207
# "+AES-256-CBC", "+SHA1",
1208
# "+COMP-NULL", "+CTYPE-OPENPGP",
1209
# "+DHE-DSS"))
1019
1210
# Use a fallback default, since this MUST be set.
1020
1211
priority = self.server.gnutls_priority
1021
1212
if priority is None:
1022
priority = u"NORMAL"
1213
priority = "NORMAL"
1023
1214
(gnutls.library.functions
1024
1215
.gnutls_priority_set_direct(session._c_object,
1025
1216
priority, None))
1026
1217
1027
1218
# Start communication using the Mandos protocol
1028
1219
# Get protocol number
1029
1220
line = self.request.makefile().readline()
1030
logger.debug(u"Protocol version: %r", line)
1221
logger.debug("Protocol version: %r", line)
1031
1222
try:
1032
1223
if int(line.strip().split()[0]) > 1:
1033
1224
raise RuntimeError
1034
except (ValueError, IndexError, RuntimeError), error:
1035
logger.error(u"Unknown protocol version: %s", error)
1225
except (ValueError, IndexError, RuntimeError) as error:
1226
logger.error("Unknown protocol version: %s", error)
1036
1227
return
1037
1228
1038
1229
# Start GnuTLS connection
1039
1230
try:
1040
1231
session.handshake()
1041
except gnutls.errors.GNUTLSError, error:
1042
logger.warning(u"Handshake failed: %s", error)
1232
except gnutls.errors.GNUTLSError as error:
1233
logger.warning("Handshake failed: %s", error)
1043
1234
# Do not run session.bye() here: the session is not
1044
1235
# established. Just abandon the request.
1045
1236
return
1046
logger.debug(u"Handshake succeeded")
1237
logger.debug("Handshake succeeded")
1238
1239
approval_required = False
1047
1240
try:
1048
1241
try:
1049
1242
fpr = self.fingerprint(self.peer_certificate
1050
1243
(session))
1051
except (TypeError, gnutls.errors.GNUTLSError), error:
1052
logger.warning(u"Bad certificate: %s", error)
1244
except (TypeError,
1245
gnutls.errors.GNUTLSError) as error:
1246
logger.warning("Bad certificate: %s", error)
1053
1247
return
1054
logger.debug(u"Fingerprint: %s", fpr)
1248
logger.debug("Fingerprint: %s", fpr)
1055
1249
1056
for c in self.server.clients:
1057
if c.fingerprint == fpr:
1058
client = c
1250
try:
1251
client = ProxyClient(child_pipe, fpr,
1252
self.client_address)
1253
except KeyError:
1254
return
1255
1256
if client.approval_delay:
1257
delay = client.approval_delay
1258
client.approvals_pending += 1
1259
approval_required = True
1260
1261
while True:
1262
if not client.enabled:
1263
logger.warning("Client %s is disabled",
1264
client.name)
1265
if self.server.use_dbus:
1266
# Emit D-Bus signal
1267
client.Rejected("Disabled")
1268
return
1269
1270
if client._approved or not client.approval_delay:
1271
#We are approved or approval is disabled
1059
1272
break
1060
else:
1061
ipc.write(u"NOTFOUND %s %s\n"
1062
% (fpr, unicode(self.client_address)))
1063
return
1064
1065
class ClientProxy(object):
1066
"""Client proxy object. Not for calling methods."""
1067
def __init__(self, client):
1068
self.client = client
1069
def __getattr__(self, name):
1070
if name.startswith("ipc_"):
1071
def tempfunc():
1072
ipc.write("%s %s\n" % (name[4:].upper(),
1073
self.client.name))
1074
return tempfunc
1075
if not hasattr(self.client, name):
1076
raise AttributeError
1077
ipc.write(u"GETATTR %s %s\n"
1078
% (name, self.client.fingerprint))
1079
return pickle.load(ipc_return)
1080
clientproxy = ClientProxy(client)
1081
# Have to check if client.enabled, since it is
1082
# possible that the client was disabled since the
1083
# GnuTLS session was established.
1084
if not clientproxy.enabled:
1085
clientproxy.ipc_disabled()
1086
return
1087
1088
clientproxy.ipc_sending()
1273
elif client._approved is None:
1274
logger.info("Client %s needs approval",
1275
client.name)
1276
if self.server.use_dbus:
1277
# Emit D-Bus signal
1278
client.NeedApproval(
1279
client.approval_delay_milliseconds(),
1280
client.approved_by_default)
1281
else:
1282
logger.warning("Client %s was not approved",
1283
client.name)
1284
if self.server.use_dbus:
1285
# Emit D-Bus signal
1286
client.Rejected("Denied")
1287
return
1288
1289
#wait until timeout or approved
1290
#x = float(client._timedelta_to_milliseconds(delay))
1291
time = datetime.datetime.now()
1292
client.changedstate.acquire()
1293
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1294
client.changedstate.release()
1295
time2 = datetime.datetime.now()
1296
if (time2 - time) >= delay:
1297
if not client.approved_by_default:
1298
logger.warning("Client %s timed out while"
1299
" waiting for approval",
1300
client.name)
1301
if self.server.use_dbus:
1302
# Emit D-Bus signal
1303
client.Rejected("Approval timed out")
1304
return
1305
else:
1306
break
1307
else:
1308
delay -= time2 - time
1309
1089
1310
sent_size = 0
1090
1311
while sent_size < len(client.secret):
1091
sent = session.send(client.secret[sent_size:])
1092
logger.debug(u"Sent: %d, remaining: %d",
1312
try:
1313
sent = session.send(client.secret[sent_size:])
1314
except gnutls.errors.GNUTLSError as error:
1315
logger.warning("gnutls send failed")
1316
return
1317
logger.debug("Sent: %d, remaining: %d",
1093
1318
sent, len(client.secret)
1094
1319
- (sent_size + sent))
1095
1320
sent_size += sent
1321
1322
logger.info("Sending secret to %s", client.name)
1323
# bump the timeout as if seen
1324
client.checked_ok()
1325
if self.server.use_dbus:
1326
# Emit D-Bus signal
1327
client.GotSecret()
1328
1096
1329
finally:
1097
session.bye()
1330
if approval_required:
1331
client.approvals_pending -= 1
1332
try:
1333
session.bye()
1334
except gnutls.errors.GNUTLSError as error:
1335
logger.warning("GnuTLS bye failed")
1098
1336
1099
1337
@staticmethod
1100
1338
def peer_certificate(session):
1110
1348
.gnutls_certificate_get_peers
1111
1349
(session._c_object, ctypes.byref(list_size)))
1112
1350
if not bool(cert_list) and list_size.value != 0:
1113
raise gnutls.errors.GNUTLSError(u"error getting peer"
1114
u" certificate")
1351
raise gnutls.errors.GNUTLSError("error getting peer"
1352
" certificate")
1115
1353
if list_size.value == 0:
1116
1354
return None
1117
1355
cert = cert_list[0]
1143
1381
if crtverify.value != 0:
1144
1382
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1145
1383
raise (gnutls.errors.CertificateSecurityError
1146
(u"Verify failed"))
1384
("Verify failed"))
1147
1385
# New buffer for the fingerprint
1148
1386
buf = ctypes.create_string_buffer(20)
1149
1387
buf_len = ctypes.c_size_t()
1156
1394
# Convert the buffer to a Python bytestring
1157
1395
fpr = ctypes.string_at(buf, buf_len.value)
1158
1396
# Convert the bytestring to hexadecimal notation
1159
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1397
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1160
1398
return hex_fpr
1161
1399
1162
1400
1163
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1164
"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1401
class MultiprocessingMixIn(object):
1402
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1403
def sub_process_main(self, request, address):
1404
try:
1405
self.finish_request(request, address)
1406
except:
1407
self.handle_error(request, address)
1408
self.close_request(request)
1409
1410
def process_request(self, request, address):
1411
"""Start a new process to process the request."""
1412
multiprocessing.Process(target = self.sub_process_main,
1413
args = (request, address)).start()
1414
1415
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1416
""" adds a pipe to the MixIn """
1165
1417
def process_request(self, request, client_address):
1166
1418
"""Overrides and wraps the original process_request().
1167
1419
1168
1420
This function creates a new pipe in self.pipe
1169
1421
"""
1170
# Child writes to child_pipe
1171
self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1172
# Parent writes to parent_pipe
1173
self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1174
super(ForkingMixInWithPipes,
1422
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1423
1424
super(MultiprocessingMixInWithPipe,
1175
1425
self).process_request(request, client_address)
1176
# Close unused ends for parent
1177
self.parent_pipe[0].close() # close read end
1178
self.child_pipe[1].close() # close write end
1179
self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1180
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1426
self.child_pipe.close()
1427
self.add_pipe(parent_pipe)
1428
1429
def add_pipe(self, parent_pipe):
1181
1430
"""Dummy function; override as necessary"""
1182
child_pipe_fd.close()
1183
parent_pipe_fd.close()
1184
1185
1186
class IPv6_TCPServer(ForkingMixInWithPipes,
1431
raise NotImplementedError
1432
1433
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1187
1434
socketserver.TCPServer, object):
1188
1435
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1189
1436
1205
1452
bind to an address or port if they were not specified."""
1206
1453
if self.interface is not None:
1207
1454
if SO_BINDTODEVICE is None:
1208
logger.error(u"SO_BINDTODEVICE does not exist;"
1209
u" cannot bind to interface %s",
1455
logger.error("SO_BINDTODEVICE does not exist;"
1456
" cannot bind to interface %s",
1210
1457
self.interface)
1211
1458
else:
1212
1459
try:
1213
1460
self.socket.setsockopt(socket.SOL_SOCKET,
1214
1461
SO_BINDTODEVICE,
1215
1462
str(self.interface
1216
+ u'\0'))
1217
except socket.error, error:
1463
+ '\0'))
1464
except socket.error as error:
1218
1465
if error[0] == errno.EPERM:
1219
logger.error(u"No permission to"
1220
u" bind to interface %s",
1466
logger.error("No permission to"
1467
" bind to interface %s",
1221
1468
self.interface)
1222
1469
elif error[0] == errno.ENOPROTOOPT:
1223
logger.error(u"SO_BINDTODEVICE not available;"
1224
u" cannot bind to interface %s",
1470
logger.error("SO_BINDTODEVICE not available;"
1471
" cannot bind to interface %s",
1225
1472
self.interface)
1226
1473
else:
1227
1474
raise
1229
1476
if self.server_address[0] or self.server_address[1]:
1230
1477
if not self.server_address[0]:
1231
1478
if self.address_family == socket.AF_INET6:
1232
any_address = u"::" # in6addr_any
1479
any_address = "::" # in6addr_any
1233
1480
else:
1234
1481
any_address = socket.INADDR_ANY
1235
1482
self.server_address = (any_address,
1274
1521
return socketserver.TCPServer.server_activate(self)
1275
1522
def enable(self):
1276
1523
self.enabled = True
1277
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1524
def add_pipe(self, parent_pipe):
1278
1525
# Call "handle_ipc" for both data and EOF events
1279
gobject.io_add_watch(child_pipe_fd.fileno(),
1526
gobject.io_add_watch(parent_pipe.fileno(),
1280
1527
gobject.IO_IN | gobject.IO_HUP,
1281
1528
functools.partial(self.handle_ipc,
1282
reply = parent_pipe_fd,
1283
sender= child_pipe_fd))
1284
def handle_ipc(self, source, condition, reply=None, sender=None):
1529
parent_pipe = parent_pipe))
1530
1531
def handle_ipc(self, source, condition, parent_pipe=None,
1532
client_object=None):
1285
1533
condition_names = {
1286
gobject.IO_IN: u"IN", # There is data to read.
1287
gobject.IO_OUT: u"OUT", # Data can be written (without
1534
gobject.IO_IN: "IN", # There is data to read.
1535
gobject.IO_OUT: "OUT", # Data can be written (without
1288
1536
# blocking).
1289
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1290
gobject.IO_ERR: u"ERR", # Error condition.
1291
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1537
gobject.IO_PRI: "PRI", # There is urgent data to read.
1538
gobject.IO_ERR: "ERR", # Error condition.
1539
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1292
1540
# broken, usually for pipes and
1293
1541
# sockets).
1294
1542
}
1296
1544
for cond, name in
1297
1545
condition_names.iteritems()
1298
1546
if cond & condition)
1299
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1300
conditions_string)
1301
1302
# Read a line from the file object
1303
cmdline = sender.readline()
1304
if not cmdline: # Empty line means end of file
1305
# close the IPC pipes
1306
sender.close()
1307
reply.close()
1308
1309
# Stop calling this function
1310
return False
1311
1312
logger.debug(u"IPC command: %r", cmdline)
1313
1314
# Parse and act on command
1315
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1316
1317
if cmd == u"NOTFOUND":
1318
fpr, address = args.split(None, 1)
1319
logger.warning(u"Client not found for fingerprint: %s, ad"
1320
u"dress: %s", fpr, address)
1321
if self.use_dbus:
1322
# Emit D-Bus signal
1323
mandos_dbus_service.ClientNotFound(fpr, address)
1324
elif cmd == u"DISABLED":
1325
for client in self.clients:
1326
if client.name == args:
1327
logger.warning(u"Client %s is disabled", args)
1328
if self.use_dbus:
1329
# Emit D-Bus signal
1330
client.Rejected()
1331
break
1332
else:
1333
logger.error(u"Unknown client %s is disabled", args)
1334
elif cmd == u"SENDING":
1335
for client in self.clients:
1336
if client.name == args:
1337
logger.info(u"Sending secret to %s", client.name)
1338
client.checked_ok()
1339
if self.use_dbus:
1340
# Emit D-Bus signal
1341
client.GotSecret()
1342
break
1343
else:
1344
logger.error(u"Sending secret to unknown client %s",
1345
args)
1346
elif cmd == u"GETATTR":
1347
attr_name, fpr = args.split(None, 1)
1348
for client in self.clients:
1349
if client.fingerprint == fpr:
1350
attr_value = getattr(client, attr_name, None)
1351
logger.debug("IPC reply: %r", attr_value)
1352
pickle.dump(attr_value, reply)
1353
break
1354
else:
1355
logger.error(u"Client %s on address %s requesting "
1356
u"attribute %s not found", fpr, address,
1357
attr_name)
1358
pickle.dump(None, reply)
1359
else:
1360
logger.error(u"Unknown IPC command: %r", cmdline)
1361
1362
# Keep calling this function
1547
# error or the other end of multiprocessing.Pipe has closed
1548
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1549
return False
1550
1551
# Read a request from the child
1552
request = parent_pipe.recv()
1553
command = request[0]
1554
1555
if command == 'init':
1556
fpr = request[1]
1557
address = request[2]
1558
1559
for c in self.clients:
1560
if c.fingerprint == fpr:
1561
client = c
1562
break
1563
else:
1564
logger.warning("Client not found for fingerprint: %s, ad"
1565
"dress: %s", fpr, address)
1566
if self.use_dbus:
1567
# Emit D-Bus signal
1568
mandos_dbus_service.ClientNotFound(fpr, address[0])
1569
parent_pipe.send(False)
1570
return False
1571
1572
gobject.io_add_watch(parent_pipe.fileno(),
1573
gobject.IO_IN | gobject.IO_HUP,
1574
functools.partial(self.handle_ipc,
1575
parent_pipe = parent_pipe,
1576
client_object = client))
1577
parent_pipe.send(True)
1578
# remove the old hook in favor of the new above hook on same fileno
1579
return False
1580
if command == 'funcall':
1581
funcname = request[1]
1582
args = request[2]
1583
kwargs = request[3]
1584
1585
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1586
1587
if command == 'getattr':
1588
attrname = request[1]
1589
if callable(client_object.__getattribute__(attrname)):
1590
parent_pipe.send(('function',))
1591
else:
1592
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1593
1594
if command == 'setattr':
1595
attrname = request[1]
1596
value = request[2]
1597
setattr(client_object, attrname, value)
1598
1363
1599
return True
1364
1600
1365
1601
1366
1602
def string_to_delta(interval):
1367
1603
"""Parse a string and return a datetime.timedelta
1368
1604
1369
>>> string_to_delta(u'7d')
1605
>>> string_to_delta('7d')
1370
1606
datetime.timedelta(7)
1371
>>> string_to_delta(u'60s')
1607
>>> string_to_delta('60s')
1372
1608
datetime.timedelta(0, 60)
1373
>>> string_to_delta(u'60m')
1609
>>> string_to_delta('60m')
1374
1610
datetime.timedelta(0, 3600)
1375
>>> string_to_delta(u'24h')
1611
>>> string_to_delta('24h')
1376
1612
datetime.timedelta(1)
1377
>>> string_to_delta(u'1w')
1613
>>> string_to_delta('1w')
1378
1614
datetime.timedelta(7)
1379
>>> string_to_delta(u'5m 30s')
1615
>>> string_to_delta('5m 30s')
1380
1616
datetime.timedelta(0, 330)
1381
1617
"""
1382
1618
timevalue = datetime.timedelta(0)
1384
1620
try:
1385
1621
suffix = unicode(s[-1])
1386
1622
value = int(s[:-1])
1387
if suffix == u"d":
1623
if suffix == "d":
1388
1624
delta = datetime.timedelta(value)
1389
elif suffix == u"s":
1625
elif suffix == "s":
1390
1626
delta = datetime.timedelta(0, value)
1391
elif suffix == u"m":
1627
elif suffix == "m":
1392
1628
delta = datetime.timedelta(0, 0, 0, 0, value)
1393
elif suffix == u"h":
1629
elif suffix == "h":
1394
1630
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1395
elif suffix == u"w":
1631
elif suffix == "w":
1396
1632
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1397
1633
else:
1398
raise ValueError(u"Unknown suffix %r" % suffix)
1399
except (ValueError, IndexError), e:
1400
raise ValueError(e.message)
1634
raise ValueError("Unknown suffix %r" % suffix)
1635
except (ValueError, IndexError) as e:
1636
raise ValueError(*(e.args))
1401
1637
timevalue += delta
1402
1638
return timevalue
1403
1639
1409
1645
global if_nametoindex
1410
1646
try:
1411
1647
if_nametoindex = (ctypes.cdll.LoadLibrary
1412
(ctypes.util.find_library(u"c"))
1648
(ctypes.util.find_library("c"))
1413
1649
.if_nametoindex)
1414
1650
except (OSError, AttributeError):
1415
logger.warning(u"Doing if_nametoindex the hard way")
1651
logger.warning("Doing if_nametoindex the hard way")
1416
1652
def if_nametoindex(interface):
1417
1653
"Get an interface index the hard way, i.e. using fcntl()"
1418
1654
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1419
1655
with contextlib.closing(socket.socket()) as s:
1420
1656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1421
struct.pack(str(u"16s16x"),
1657
struct.pack(str("16s16x"),
1422
1658
interface))
1423
interface_index = struct.unpack(str(u"I"),
1659
interface_index = struct.unpack(str("I"),
1424
1660
ifreq[16:20])[0]
1425
1661
return interface_index
1426
1662
return if_nametoindex(interface)
1434
1670
sys.exit()
1435
1671
os.setsid()
1436
1672
if not nochdir:
1437
os.chdir(u"/")
1673
os.chdir("/")
1438
1674
if os.fork():
1439
1675
sys.exit()
1440
1676
if not noclose:
1442
1678
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1443
1679
if not stat.S_ISCHR(os.fstat(null).st_mode):
1444
1680
raise OSError(errno.ENODEV,
1445
u"%s not a character device"
1681
"%s not a character device"
1446
1682
% os.path.devnull)
1447
1683
os.dup2(null, sys.stdin.fileno())
1448
1684
os.dup2(null, sys.stdout.fileno())
1456
1692
##################################################################
1457
1693
# Parsing of options, both command line and config file
1458
1694
1459
parser = optparse.OptionParser(version = "%%prog %s" % version)
1460
parser.add_option("-i", u"--interface", type=u"string",
1461
metavar="IF", help=u"Bind to interface IF")
1462
parser.add_option("-a", u"--address", type=u"string",
1463
help=u"Address to listen for requests on")
1464
parser.add_option("-p", u"--port", type=u"int",
1465
help=u"Port number to receive requests on")
1466
parser.add_option("--check", action=u"store_true",
1467
help=u"Run self-test")
1468
parser.add_option("--debug", action=u"store_true",
1469
help=u"Debug mode; run in foreground and log to"
1470
u" terminal")
1471
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1472
u" priority string (see GnuTLS documentation)")
1473
parser.add_option("--servicename", type=u"string",
1474
metavar=u"NAME", help=u"Zeroconf service name")
1475
parser.add_option("--configdir", type=u"string",
1476
default=u"/etc/mandos", metavar=u"DIR",
1477
help=u"Directory to search for configuration"
1478
u" files")
1479
parser.add_option("--no-dbus", action=u"store_false",
1480
dest=u"use_dbus", help=u"Do not provide D-Bus"
1481
u" system bus interface")
1482
parser.add_option("--no-ipv6", action=u"store_false",
1483
dest=u"use_ipv6", help=u"Do not use IPv6")
1484
options = parser.parse_args()[0]
1695
parser = argparse.ArgumentParser()
1696
parser.add_argument("-v", "--version", action="version",
1697
version = "%%(prog)s %s" % version,
1698
help="show version number and exit")
1699
parser.add_argument("-i", "--interface", metavar="IF",
1700
help="Bind to interface IF")
1701
parser.add_argument("-a", "--address",
1702
help="Address to listen for requests on")
1703
parser.add_argument("-p", "--port", type=int,
1704
help="Port number to receive requests on")
1705
parser.add_argument("--check", action="store_true",
1706
help="Run self-test")
1707
parser.add_argument("--debug", action="store_true",
1708
help="Debug mode; run in foreground and log"
1709
" to terminal")
1710
parser.add_argument("--debuglevel", metavar="LEVEL",
1711
help="Debug level for stdout output")
1712
parser.add_argument("--priority", help="GnuTLS"
1713
" priority string (see GnuTLS documentation)")
1714
parser.add_argument("--servicename",
1715
metavar="NAME", help="Zeroconf service name")
1716
parser.add_argument("--configdir",
1717
default="/etc/mandos", metavar="DIR",
1718
help="Directory to search for configuration"
1719
" files")
1720
parser.add_argument("--no-dbus", action="store_false",
1721
dest="use_dbus", help="Do not provide D-Bus"
1722
" system bus interface")
1723
parser.add_argument("--no-ipv6", action="store_false",
1724
dest="use_ipv6", help="Do not use IPv6")
1725
options = parser.parse_args()
1485
1726
1486
1727
if options.check:
1487
1728
import doctest
1489
1730
sys.exit()
1490
1731
1491
1732
# Default values for config file for server-global settings
1492
server_defaults = { u"interface": u"",
1493
u"address": u"",
1494
u"port": u"",
1495
u"debug": u"False",
1496
u"priority":
1497
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1498
u"servicename": u"Mandos",
1499
u"use_dbus": u"True",
1500
u"use_ipv6": u"True",
1733
server_defaults = { "interface": "",
1734
"address": "",
1735
"port": "",
1736
"debug": "False",
1737
"priority":
1738
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1739
"servicename": "Mandos",
1740
"use_dbus": "True",
1741
"use_ipv6": "True",
1742
"debuglevel": "",
1501
1743
}
1502
1744
1503
1745
# Parse config file for server-global settings
1504
1746
server_config = configparser.SafeConfigParser(server_defaults)
1505
1747
del server_defaults
1506
1748
server_config.read(os.path.join(options.configdir,
1507
u"mandos.conf"))
1749
"mandos.conf"))
1508
1750
# Convert the SafeConfigParser object to a dict
1509
1751
server_settings = server_config.defaults()
1510
1752
# Use the appropriate methods on the non-string config options
1511
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1512
server_settings[option] = server_config.getboolean(u"DEFAULT",
1753
for option in ("debug", "use_dbus", "use_ipv6"):
1754
server_settings[option] = server_config.getboolean("DEFAULT",
1513
1755
option)
1514
1756
if server_settings["port"]:
1515
server_settings["port"] = server_config.getint(u"DEFAULT",
1516
u"port")
1757
server_settings["port"] = server_config.getint("DEFAULT",
1758
"port")
1517
1759
del server_config
1518
1760
1519
1761
# Override the settings from the config file with command line
1520
1762
# options, if set.
1521
for option in (u"interface", u"address", u"port", u"debug",
1522
u"priority", u"servicename", u"configdir",
1523
u"use_dbus", u"use_ipv6"):
1763
for option in ("interface", "address", "port", "debug",
1764
"priority", "servicename", "configdir",
1765
"use_dbus", "use_ipv6", "debuglevel"):
1524
1766
value = getattr(options, option)
1525
1767
if value is not None:
1526
1768
server_settings[option] = value
1534
1776
##################################################################
1535
1777
1536
1778
# For convenience
1537
debug = server_settings[u"debug"]
1538
use_dbus = server_settings[u"use_dbus"]
1539
use_ipv6 = server_settings[u"use_ipv6"]
1540
1541
if not debug:
1542
syslogger.setLevel(logging.WARNING)
1543
console.setLevel(logging.WARNING)
1544
1545
if server_settings[u"servicename"] != u"Mandos":
1779
debug = server_settings["debug"]
1780
debuglevel = server_settings["debuglevel"]
1781
use_dbus = server_settings["use_dbus"]
1782
use_ipv6 = server_settings["use_ipv6"]
1783
1784
if server_settings["servicename"] != "Mandos":
1546
1785
syslogger.setFormatter(logging.Formatter
1547
(u'Mandos (%s) [%%(process)d]:'
1548
u' %%(levelname)s: %%(message)s'
1549
% server_settings[u"servicename"]))
1786
('Mandos (%s) [%%(process)d]:'
1787
' %%(levelname)s: %%(message)s'
1788
% server_settings["servicename"]))
1550
1789
1551
1790
# Parse config file with clients
1552
client_defaults = { u"timeout": u"1h",
1553
u"interval": u"5m",
1554
u"checker": u"fping -q -- %%(host)s",
1555
u"host": u"",
1791
client_defaults = { "timeout": "1h",
1792
"interval": "5m",
1793
"checker": "fping -q -- %%(host)s",
1794
"host": "",
1795
"approval_delay": "0s",
1796
"approval_duration": "1s",
1556
1797
}
1557
1798
client_config = configparser.SafeConfigParser(client_defaults)
1558
client_config.read(os.path.join(server_settings[u"configdir"],
1559
u"clients.conf"))
1799
client_config.read(os.path.join(server_settings["configdir"],
1800
"clients.conf"))
1560
1801
1561
1802
global mandos_dbus_service
1562
1803
mandos_dbus_service = None
1563
1804
1564
tcp_server = MandosServer((server_settings[u"address"],
1565
server_settings[u"port"]),
1805
tcp_server = MandosServer((server_settings["address"],
1806
server_settings["port"]),
1566
1807
ClientHandler,
1567
interface=server_settings[u"interface"],
1808
interface=(server_settings["interface"]
1809
or None),
1568
1810
use_ipv6=use_ipv6,
1569
1811
gnutls_priority=
1570
server_settings[u"priority"],
1812
server_settings["priority"],
1571
1813
use_dbus=use_dbus)
1572
pidfilename = u"/var/run/mandos.pid"
1573
try:
1574
pidfile = open(pidfilename, u"w")
1575
except IOError:
1576
logger.error(u"Could not open file %r", pidfilename)
1814
if not debug:
1815
pidfilename = "/var/run/mandos.pid"
1816
try:
1817
pidfile = open(pidfilename, "w")
1818
except IOError:
1819
logger.error("Could not open file %r", pidfilename)
1577
1820
1578
1821
try:
1579
uid = pwd.getpwnam(u"_mandos").pw_uid
1580
gid = pwd.getpwnam(u"_mandos").pw_gid
1822
uid = pwd.getpwnam("_mandos").pw_uid
1823
gid = pwd.getpwnam("_mandos").pw_gid
1581
1824
except KeyError:
1582
1825
try:
1583
uid = pwd.getpwnam(u"mandos").pw_uid
1584
gid = pwd.getpwnam(u"mandos").pw_gid
1826
uid = pwd.getpwnam("mandos").pw_uid
1827
gid = pwd.getpwnam("mandos").pw_gid
1585
1828
except KeyError:
1586
1829
try:
1587
uid = pwd.getpwnam(u"nobody").pw_uid
1588
gid = pwd.getpwnam(u"nobody").pw_gid
1830
uid = pwd.getpwnam("nobody").pw_uid
1831
gid = pwd.getpwnam("nobody").pw_gid
1589
1832
except KeyError:
1590
1833
uid = 65534
1591
1834
gid = 65534
1592
1835
try:
1593
1836
os.setgid(gid)
1594
1837
os.setuid(uid)
1595
except OSError, error:
1838
except OSError as error:
1596
1839
if error[0] != errno.EPERM:
1597
1840
raise error
1598
1841
1599
# Enable all possible GnuTLS debugging
1842
if not debug and not debuglevel:
1843
syslogger.setLevel(logging.WARNING)
1844
console.setLevel(logging.WARNING)
1845
if debuglevel:
1846
level = getattr(logging, debuglevel.upper())
1847
syslogger.setLevel(level)
1848
console.setLevel(level)
1849
1600
1850
if debug:
1851
# Enable all possible GnuTLS debugging
1852
1601
1853
# "Use a log level over 10 to enable all debugging options."
1602
1854
# - GnuTLS manual
1603
1855
gnutls.library.functions.gnutls_global_set_log_level(11)
1604
1856
1605
1857
@gnutls.library.types.gnutls_log_func
1606
1858
def debug_gnutls(level, string):
1607
logger.debug(u"GnuTLS: %s", string[:-1])
1859
logger.debug("GnuTLS: %s", string[:-1])
1608
1860
1609
1861
(gnutls.library.functions
1610
1862
.gnutls_global_set_log_function(debug_gnutls))
1863
1864
# Redirect stdin so all checkers get /dev/null
1865
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1866
os.dup2(null, sys.stdin.fileno())
1867
if null > 2:
1868
os.close(null)
1869
else:
1870
# No console logging
1871
logger.removeHandler(console)
1872
1873
# Need to fork before connecting to D-Bus
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1611
1877
1612
1878
global main_loop
1613
1879
# From the Avahi example code
1617
1883
# End of Avahi example code
1618
1884
if use_dbus:
1619
1885
try:
1620
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1886
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1621
1887
bus, do_not_queue=True)
1622
except dbus.exceptions.NameExistsException, e:
1623
logger.error(unicode(e) + u", disabling D-Bus")
1888
except dbus.exceptions.NameExistsException as e:
1889
logger.error(unicode(e) + ", disabling D-Bus")
1624
1890
use_dbus = False
1625
server_settings[u"use_dbus"] = False
1891
server_settings["use_dbus"] = False
1626
1892
tcp_server.use_dbus = False
1627
1893
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1628
service = AvahiService(name = server_settings[u"servicename"],
1629
servicetype = u"_mandos._tcp",
1894
service = AvahiService(name = server_settings["servicename"],
1895
servicetype = "_mandos._tcp",
1630
1896
protocol = protocol, bus = bus)
1631
1897
if server_settings["interface"]:
1632
1898
service.interface = (if_nametoindex
1633
(str(server_settings[u"interface"])))
1899
(str(server_settings["interface"])))
1900
1901
global multiprocessing_manager
1902
multiprocessing_manager = multiprocessing.Manager()
1634
1903
1635
1904
client_class = Client
1636
1905
if use_dbus:
1637
1906
client_class = functools.partial(ClientDBus, bus = bus)
1907
def client_config_items(config, section):
1908
special_settings = {
1909
"approved_by_default":
1910
lambda: config.getboolean(section,
1911
"approved_by_default"),
1912
}
1913
for name, value in config.items(section):
1914
try:
1915
yield (name, special_settings[name]())
1916
except KeyError:
1917
yield (name, value)
1918
1638
1919
tcp_server.clients.update(set(
1639
1920
client_class(name = section,
1640
config= dict(client_config.items(section)))
1921
config= dict(client_config_items(
1922
client_config, section)))
1641
1923
for section in client_config.sections()))
1642
1924
if not tcp_server.clients:
1643
logger.warning(u"No clients defined")
1644
1645
if debug:
1646
# Redirect stdin so all checkers get /dev/null
1647
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1648
os.dup2(null, sys.stdin.fileno())
1649
if null > 2:
1650
os.close(null)
1651
else:
1652
# No console logging
1653
logger.removeHandler(console)
1654
# Close all input and output, do double fork, etc.
1655
daemon()
1656
1657
try:
1658
with pidfile:
1659
pid = os.getpid()
1660
pidfile.write(str(pid) + "\n")
1661
del pidfile
1662
except IOError:
1663
logger.error(u"Could not write to file %r with PID %d",
1664
pidfilename, pid)
1665
except NameError:
1666
# "pidfile" was never created
1667
pass
1668
del pidfilename
1669
1925
logger.warning("No clients defined")
1926
1670
1927
if not debug:
1928
try:
1929
with pidfile:
1930
pid = os.getpid()
1931
pidfile.write(str(pid) + "\n".encode("utf-8"))
1932
del pidfile
1933
except IOError:
1934
logger.error("Could not write to file %r with PID %d",
1935
pidfilename, pid)
1936
except NameError:
1937
# "pidfile" was never created
1938
pass
1939
del pidfilename
1940
1671
1941
signal.signal(signal.SIGINT, signal.SIG_IGN)
1942
1672
1943
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1673
1944
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1674
1945
1676
1947
class MandosDBusService(dbus.service.Object):
1677
1948
"""A D-Bus proxy object"""
1678
1949
def __init__(self):
1679
dbus.service.Object.__init__(self, bus, u"/")
1680
_interface = u"se.bsnet.fukt.Mandos"
1950
dbus.service.Object.__init__(self, bus, "/")
1951
_interface = "se.bsnet.fukt.Mandos"
1681
1952
1682
@dbus.service.signal(_interface, signature=u"o")
1953
@dbus.service.signal(_interface, signature="o")
1683
1954
def ClientAdded(self, objpath):
1684
1955
"D-Bus signal"
1685
1956
pass
1686
1957
1687
@dbus.service.signal(_interface, signature=u"ss")
1958
@dbus.service.signal(_interface, signature="ss")
1688
1959
def ClientNotFound(self, fingerprint, address):
1689
1960
"D-Bus signal"
1690
1961
pass
1691
1962
1692
@dbus.service.signal(_interface, signature=u"os")
1963
@dbus.service.signal(_interface, signature="os")
1693
1964
def ClientRemoved(self, objpath, name):
1694
1965
"D-Bus signal"
1695
1966
pass
1696
1967
1697
@dbus.service.method(_interface, out_signature=u"ao")
1968
@dbus.service.method(_interface, out_signature="ao")
1698
1969
def GetAllClients(self):
1699
1970
"D-Bus method"
1700
1971
return dbus.Array(c.dbus_object_path
1701
1972
for c in tcp_server.clients)
1702
1973
1703
1974
@dbus.service.method(_interface,
1704
out_signature=u"a{oa{sv}}")
1975
out_signature="a{oa{sv}}")
1705
1976
def GetAllClientsWithProperties(self):
1706
1977
"D-Bus method"
1707
1978
return dbus.Dictionary(
1708
((c.dbus_object_path, c.GetAll(u""))
1979
((c.dbus_object_path, c.GetAll(""))
1709
1980
for c in tcp_server.clients),
1710
signature=u"oa{sv}")
1981
signature="oa{sv}")
1711
1982
1712
@dbus.service.method(_interface, in_signature=u"o")
1983
@dbus.service.method(_interface, in_signature="o")
1713
1984
def RemoveClient(self, object_path):
1714
1985
"D-Bus method"
1715
1986
for c in tcp_server.clients:
1757
2028
# Find out what port we got
1758
2029
service.port = tcp_server.socket.getsockname()[1]
1759
2030
if use_ipv6:
1760
logger.info(u"Now listening on address %r, port %d,"
2031
logger.info("Now listening on address %r, port %d,"
1761
2032
" flowinfo %d, scope_id %d"
1762
2033
% tcp_server.socket.getsockname())
1763
2034
else: # IPv4
1764
logger.info(u"Now listening on address %r, port %d"
2035
logger.info("Now listening on address %r, port %d"
1765
2036
% tcp_server.socket.getsockname())
1766
2037
1767
2038
#service.interface = tcp_server.socket.getsockname()[3]
1770
2041
# From the Avahi example code
1771
2042
try:
1772
2043
service.activate()
1773
except dbus.exceptions.DBusException, error:
1774
logger.critical(u"DBusException: %s", error)
2044
except dbus.exceptions.DBusException as error:
2045
logger.critical("DBusException: %s", error)
1775
2046
cleanup()
1776
2047
sys.exit(1)
1777
2048
# End of Avahi example code
1781
2052
(tcp_server.handle_request
1782
2053
(*args[2:], **kwargs) or True))
1783
2054
1784
logger.debug(u"Starting main loop")
2055
logger.debug("Starting main loop")
1785
2056
main_loop.run()
1786
except AvahiError, error:
1787
logger.critical(u"AvahiError: %s", error)
2057
except AvahiError as error:
2058
logger.critical("AvahiError: %s", error)
1788
2059
cleanup()
1789
2060
sys.exit(1)
1790
2061
except KeyboardInterrupt:
1791
2062
if debug:
1792
print >> sys.stderr
1793
logger.debug(u"Server received KeyboardInterrupt")
1794
logger.debug(u"Server exiting")
2063
print("", file=sys.stderr)
2064
logger.debug("Server received KeyboardInterrupt")
2065
logger.debug("Server exiting")
1795
2066
# Must run before the D-Bus bus name gets deregistered
1796
2067
cleanup()
1797
2068
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0