/mandos/trunk : revision 493

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

55

56

import logging

56

57

import logging.handlers

57

58

import pwd

58

from contextlib import closing

59

import contextlib

59

60

import struct

60

61

import fcntl

61

62

import functools

63

import cPickle as pickle

64

import multiprocessing

62

65

63

66

import dbus

64

67

import dbus.service

79

82

SO_BINDTODEVICE = None

80

83

81

84

82

version = "1.0.12"

85

version = "1.3.1"

83

86

84

logger = logging.Logger(u'mandos')

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

85

89

syslogger = (logging.handlers.SysLogHandler

86

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

87

address = "/dev/log"))

91

address = str("/dev/log")))

88

92

syslogger.setFormatter(logging.Formatter

89

(u'Mandos [%(process)d]: %(levelname)s:'

90

u' %(message)s'))

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

91

95

logger.addHandler(syslogger)

92

96

93

97

console = logging.StreamHandler()

94

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

95

u' %(levelname)s:'

96

u' %(message)s'))

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

97

101

logger.addHandler(console)

98

102

99

103

class AvahiError(Exception):

116

120

Attributes:

117

121

interface: integer; avahi.IF_UNSPEC or an interface index.

118

122

Used to optionally bind to the specified interface.

119

120

type: string; Example: u'_mandos._tcp'.

123

124

type: string; Example: '_mandos._tcp'.

121

125

See <http://www.dns-sd.org/ServiceTypes.html>

122

126

port: integer; what port to announce

123

127

TXT: list of strings; TXT record for the service

132

136

"""

133

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

134

138

servicetype = None, port = None, TXT = None,

135

domain = u"", host = u"", max_renames = 32768,

139

domain = "", host = "", max_renames = 32768,

136

140

protocol = avahi.PROTO_UNSPEC, bus = None):

137

141

self.interface = interface

138

142

self.name = name

147

151

self.group = None # our entry group

148

152

self.server = None

149

153

self.bus = bus

154

self.entry_group_state_changed_match = None

150

155

def rename(self):

151

156

"""Derived from the Avahi example code"""

152

157

if self.rename_count >= self.max_renames:

153

logger.critical(u"No suitable Zeroconf service name found"

154

u" after %i retries, exiting.",

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

155

160

self.rename_count)

156

raise AvahiServiceError(u"Too many renames")

157

self.name = self.server.GetAlternativeServiceName(self.name)

158

logger.info(u"Changing Zeroconf service name to %r ...",

159

unicode(self.name))

161

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

163

logger.info("Changing Zeroconf service name to %r ...",

164

self.name)

160

165

syslogger.setFormatter(logging.Formatter

161

(u'Mandos (%s) [%%(process)d]:'

162

u' %%(levelname)s: %%(message)s'

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

163

168

% self.name))

164

169

self.remove()

165

self.add()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

166

176

self.rename_count += 1

167

177

def remove(self):

168

178

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

169

182

if self.group is not None:

170

183

self.group.Reset()

171

184

def add(self):

172

185

"""Derived from the Avahi example code"""

186

self.remove()

173

187

if self.group is None:

174

188

self.group = dbus.Interface(

175

189

self.bus.get_object(avahi.DBUS_NAME,

176

190

self.server.EntryGroupNew()),

177

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

178

self.group.connect_to_signal('StateChanged',

179

self

180

.entry_group_state_changed)

181

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

196

self.name, self.type)

183

197

self.group.AddService(

184

198

self.interface,

191

205

self.group.Commit()

192

206

def entry_group_state_changed(self, state, error):

193

207

"""Derived from the Avahi example code"""

194

logger.debug(u"Avahi state change: %i", state)

208

logger.debug("Avahi entry group state change: %i", state)

195

209

196

210

if state == avahi.ENTRY_GROUP_ESTABLISHED:

197

logger.debug(u"Zeroconf service established.")

211

logger.debug("Zeroconf service established.")

198

212

elif state == avahi.ENTRY_GROUP_COLLISION:

199

logger.warning(u"Zeroconf service name collision.")

213

logger.info("Zeroconf service name collision.")

200

214

self.rename()

201

215

elif state == avahi.ENTRY_GROUP_FAILURE:

202

logger.critical(u"Avahi: Error in group state changed %s",

216

logger.critical("Avahi: Error in group state changed %s",

203

217

unicode(error))

204

raise AvahiGroupError(u"State changed: %s"

218

raise AvahiGroupError("State changed: %s"

205

219

% unicode(error))

206

220

def cleanup(self):

207

221

"""Derived from the Avahi example code"""

208

222

if self.group is not None:

209

self.group.Free()

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

210

228

self.group = None

211

def server_state_changed(self, state):

229

self.remove()

230

def server_state_changed(self, state, error=None):

212

231

"""Derived from the Avahi example code"""

213

if state == avahi.SERVER_COLLISION:

214

logger.error(u"Zeroconf server name collision")

215

self.remove()

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

216

247

elif state == avahi.SERVER_RUNNING:

217

248

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

218

254

def activate(self):

219

255

"""Derived from the Avahi example code"""

220

256

if self.server is None:

221

257

self.server = dbus.Interface(

222

258

self.bus.get_object(avahi.DBUS_NAME,

223

avahi.DBUS_PATH_SERVER),

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

224

261

avahi.DBUS_INTERFACE_SERVER)

225

self.server.connect_to_signal(u"StateChanged",

262

self.server.connect_to_signal("StateChanged",

226

263

self.server_state_changed)

227

264

self.server_state_changed(self.server.GetState())

228

265

231

268

"""A representation of a client host served by this server.

232

269

233

270

Attributes:

234

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

271

_approved: bool(); 'None' if not yet approved/disapproved

272

approval_delay: datetime.timedelta(); Time to wait for approval

273

approval_duration: datetime.timedelta(); Duration of one approval

248

274

checker: subprocess.Popen(); a running checker process used

249

275

to see if the client lives.

250

276

'None' if no process is running.

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

277

checker_callback_tag: a gobject event source tag, or None

278

checker_command: string; External command which is run to check

279

if client lives. %() expansions are done at

256

280

runtime with vars(self) as dict, so that for

257

281

instance %(name)s can be used in the command.

282

checker_initiator_tag: a gobject event source tag, or None

283

created: datetime.datetime(); (UTC) object creation

258

284

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

disable_initiator_tag: a gobject event source tag, or None

287

enabled: bool()

288

fingerprint: string (40 or 32 hexadecimal digits); used to

289

uniquely identify the client

290

host: string; available for use by the checker command

291

interval: datetime.timedelta(); How often to start a new checker

292

last_approval_request: datetime.datetime(); (UTC) or None

293

last_checked_ok: datetime.datetime(); (UTC) or None

294

last_enabled: datetime.datetime(); (UTC)

295

296

D-Bus identifiers

297

secret: bytestring; sent verbatim (over TLS) to client

298

timeout: datetime.timedelta(); How long from last_checked_ok

299

until this client is disabled

300

runtime_expansions: Allowed attributes for runtime expansion.

259

301

"""

260

302

303

runtime_expansions = ("approval_delay", "approval_duration",

304

"created", "enabled", "fingerprint",

305

"host", "interval", "last_checked_ok",

306

"last_enabled", "name", "timeout")

307

261

308

@staticmethod

262

309

def _timedelta_to_milliseconds(td):

263

310

"Convert a datetime.timedelta() to milliseconds"

272

319

def interval_milliseconds(self):

273

320

"Return the 'interval' attribute in milliseconds"

274

321

return self._timedelta_to_milliseconds(self.interval)

322

323

def approval_delay_milliseconds(self):

324

return self._timedelta_to_milliseconds(self.approval_delay)

275

325

276

326

def __init__(self, name = None, disable_hook=None, config=None):

277

327

"""Note: the 'checker' key in 'config' sets the

280

330

self.name = name

281

331

if config is None:

282

332

config = {}

283

logger.debug(u"Creating client %r", self.name)

333

logger.debug("Creating client %r", self.name)

284

334

# Uppercase and remove spaces from fingerprint for later

285

335

# comparison purposes with return value from the fingerprint()

286

336

# function

287

self.fingerprint = (config[u"fingerprint"].upper()

288

.replace(u" ", u""))

289

logger.debug(u" Fingerprint: %s", self.fingerprint)

290

if u"secret" in config:

291

self.secret = config[u"secret"].decode(u"base64")

292

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])))) as secfile:

337

self.fingerprint = (config["fingerprint"].upper()

338

.replace(" ", ""))

339

logger.debug(" Fingerprint: %s", self.fingerprint)

340

if "secret" in config:

341

self.secret = config["secret"].decode("base64")

342

elif "secfile" in config:

343

with open(os.path.expanduser(os.path.expandvars

344

(config["secfile"])),

345

"rb") as secfile:

296

346

self.secret = secfile.read()

297

347

else:

298

raise TypeError(u"No secret or secfile for client %s"

348

raise TypeError("No secret or secfile for client %s"

299

349

% self.name)

300

self.host = config.get(u"host", u"")

350

self.host = config.get("host", "")

301

351

self.created = datetime.datetime.utcnow()

302

352

self.enabled = False

353

self.last_approval_request = None

303

354

self.last_enabled = None

304

355

self.last_checked_ok = None

305

self.timeout = string_to_delta(config[u"timeout"])

306

self.interval = string_to_delta(config[u"interval"])

356

self.timeout = string_to_delta(config["timeout"])

357

self.interval = string_to_delta(config["interval"])

307

358

self.disable_hook = disable_hook

308

359

self.checker = None

309

360

self.checker_initiator_tag = None

310

361

self.disable_initiator_tag = None

311

362

self.checker_callback_tag = None

312

self.checker_command = config[u"checker"]

363

self.checker_command = config["checker"]

313

364

self.current_checker_command = None

314

365

self.last_connect = None

366

self._approved = None

367

self.approved_by_default = config.get("approved_by_default",

368

True)

369

self.approvals_pending = 0

370

self.approval_delay = string_to_delta(

371

config["approval_delay"])

372

self.approval_duration = string_to_delta(

373

config["approval_duration"])

374

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

315

375

376

def send_changedstate(self):

377

self.changedstate.acquire()

378

self.changedstate.notify_all()

379

self.changedstate.release()

380

316

381

def enable(self):

317

382

"""Start this client's checker and timeout hooks"""

318

if getattr(self, u"enabled", False):

383

if getattr(self, "enabled", False):

319

384

# Already enabled

320

385

return

386

self.send_changedstate()

321

387

self.last_enabled = datetime.datetime.utcnow()

322

388

# Schedule a new checker to be started an 'interval' from now,

323

389

# and every interval from then on.

324

390

self.checker_initiator_tag = (gobject.timeout_add

325

391

(self.interval_milliseconds(),

326

392

self.start_checker))

327

# Also start a new checker *right now*.

328

self.start_checker()

329

393

# Schedule a disable() when 'timeout' has passed

330

394

self.disable_initiator_tag = (gobject.timeout_add

331

395

(self.timeout_milliseconds(),

332

396

self.disable))

333

397

self.enabled = True

398

# Also start a new checker *right now*.

399

self.start_checker()

334

400

335

def disable(self):

401

def disable(self, quiet=True):

336

402

"""Disable this client."""

337

403

if not getattr(self, "enabled", False):

338

404

return False

339

logger.info(u"Disabling client %s", self.name)

340

if getattr(self, u"disable_initiator_tag", False):

405

if not quiet:

406

self.send_changedstate()

407

if not quiet:

408

logger.info("Disabling client %s", self.name)

409

if getattr(self, "disable_initiator_tag", False):

341

410

gobject.source_remove(self.disable_initiator_tag)

342

411

self.disable_initiator_tag = None

343

if getattr(self, u"checker_initiator_tag", False):

412

if getattr(self, "checker_initiator_tag", False):

344

413

gobject.source_remove(self.checker_initiator_tag)

345

414

self.checker_initiator_tag = None

346

415

self.stop_checker()

361

430

if os.WIFEXITED(condition):

362

431

exitstatus = os.WEXITSTATUS(condition)

363

432

if exitstatus == 0:

364

logger.info(u"Checker for %(name)s succeeded",

433

logger.info("Checker for %(name)s succeeded",

365

434

vars(self))

366

435

self.checked_ok()

367

436

else:

368

logger.info(u"Checker for %(name)s failed",

437

logger.info("Checker for %(name)s failed",

369

438

vars(self))

370

439

else:

371

logger.warning(u"Checker for %(name)s crashed?",

440

logger.warning("Checker for %(name)s crashed?",

372

441

vars(self))

373

442

374

443

def checked_ok(self):

383

452

(self.timeout_milliseconds(),

384

453

self.disable))

385

454

455

def need_approval(self):

456

self.last_approval_request = datetime.datetime.utcnow()

457

386

458

def start_checker(self):

387

459

"""Start a new checker subprocess if one is not running.

388

460

394

466

# client would inevitably timeout, since no checker would get

395

467

# a chance to run to completion. If we instead leave running

396

468

# checkers alone, the checker would have to take more time

397

# than 'timeout' for the client to be declared invalid, which

398

# is as it should be.

469

# than 'timeout' for the client to be disabled, which is as it

470

# should be.

399

471

400

472

# If a checker exists, make sure it is not a zombie

401

473

try:

402

474

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

403

except (AttributeError, OSError), error:

475

except (AttributeError, OSError) as error:

404

476

if (isinstance(error, OSError)

405

477

and error.errno != errno.ECHILD):

406

478

raise error

407

479

else:

408

480

if pid:

409

logger.warning(u"Checker was a zombie")

481

logger.warning("Checker was a zombie")

410

482

gobject.source_remove(self.checker_callback_tag)

411

483

self.checker_callback(pid, status,

412

484

self.current_checker_command)

417

489

command = self.checker_command % self.host

418

490

except TypeError:

419

491

# Escape attributes for the shell

420

escaped_attrs = dict((key,

421

re.escape(unicode(str(val),

422

errors=

423

u'replace')))

424

for key, val in

425

vars(self).iteritems())

492

escaped_attrs = dict(

493

(attr,

494

re.escape(unicode(str(getattr(self, attr, "")),

495

errors=

496

'replace')))

497

for attr in

498

self.runtime_expansions)

499

426

500

try:

427

501

command = self.checker_command % escaped_attrs

428

except TypeError, error:

429

logger.error(u'Could not format string "%s":'

430

u' %s', self.checker_command, error)

502

except TypeError as error:

503

logger.error('Could not format string "%s":'

504

' %s', self.checker_command, error)

431

505

return True # Try again later

432

506

self.current_checker_command = command

433

507

try:

434

logger.info(u"Starting checker %r for %s",

508

logger.info("Starting checker %r for %s",

435

509

command, self.name)

436

510

# We don't need to redirect stdout and stderr, since

437

511

# in normal mode, that is already done by daemon(),

439

513

# always replaced by /dev/null.)

440

514

self.checker = subprocess.Popen(command,

441

515

close_fds=True,

442

shell=True, cwd=u"/")

516

shell=True, cwd="/")

443

517

self.checker_callback_tag = (gobject.child_watch_add

444

518

(self.checker.pid,

445

519

self.checker_callback,

450

524

if pid:

451

525

gobject.source_remove(self.checker_callback_tag)

452

526

self.checker_callback(pid, status, command)

453

except OSError, error:

454

logger.error(u"Failed to start subprocess: %s",

527

except OSError as error:

528

logger.error("Failed to start subprocess: %s",

455

529

error)

456

530

# Re-run this periodically if run by gobject.timeout_add

457

531

return True

461

535

if self.checker_callback_tag:

462

536

gobject.source_remove(self.checker_callback_tag)

463

537

self.checker_callback_tag = None

464

if getattr(self, u"checker", None) is None:

538

if getattr(self, "checker", None) is None:

465

539

return

466

logger.debug(u"Stopping checker for %(name)s", vars(self))

540

logger.debug("Stopping checker for %(name)s", vars(self))

467

541

try:

468

542

os.kill(self.checker.pid, signal.SIGTERM)

469

#os.sleep(0.5)

543

#time.sleep(0.5)

470

544

#if self.checker.poll() is None:

471

545

# os.kill(self.checker.pid, signal.SIGKILL)

472

except OSError, error:

546

except OSError as error:

473

547

if error.errno != errno.ESRCH: # No such process

474

548

raise

475

549

self.checker = None

476

477

def still_valid(self):

478

"""Has the timeout not yet passed for this client?"""

479

if not getattr(self, u"enabled", False):

480

return False

481

now = datetime.datetime.utcnow()

482

if self.last_checked_ok is None:

483

return now < (self.created + self.timeout)

484

else:

485

return now < (self.last_checked_ok + self.timeout)

486

487

488

def dbus_service_property(dbus_interface, signature=u"v",

489

access=u"readwrite", byte_arrays=False):

550

551

def dbus_service_property(dbus_interface, signature="v",

552

access="readwrite", byte_arrays=False):

490

553

"""Decorators for marking methods of a DBusObjectWithProperties to

491

554

become properties on the D-Bus.

492

555

497

560

dbus.service.method, except there is only "signature", since the

498

561

type from Get() and the type sent to Set() is the same.

499

562

"""

563

# Encoding deeply encoded byte arrays is not supported yet by the

564

# "Set" method, so we fail early here:

565

if byte_arrays and signature != "ay":

566

raise ValueError("Byte arrays not supported for non-'ay'"

567

" signature %r" % signature)

500

568

def decorator(func):

501

569

func._dbus_is_property = True

502

570

func._dbus_interface = dbus_interface

503

571

func._dbus_signature = signature

504

572

func._dbus_access = access

505

573

func._dbus_name = func.__name__

506

if func._dbus_name.endswith(u"_dbus_property"):

574

if func._dbus_name.endswith("_dbus_property"):

507

575

func._dbus_name = func._dbus_name[:-14]

508

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

576

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

509

577

return func

510

578

return decorator

511

579

539

607

540

608

@staticmethod

541

609

def _is_dbus_property(obj):

542

return getattr(obj, u"_dbus_is_property", False)

610

return getattr(obj, "_dbus_is_property", False)

543

611

544

612

def _get_all_dbus_properties(self):

545

613

"""Returns a generator of (name, attribute) pairs

553

621

property with the specified name and interface.

554

622

"""

555

623

for name in (property_name,

556

property_name + u"_dbus_property"):

624

property_name + "_dbus_property"):

557

625

prop = getattr(self, name, None)

558

626

if (prop is None

559

627

or not self._is_dbus_property(prop)

563

631

continue

564

632

return prop

565

633

# No such property

566

raise DBusPropertyNotFound(self.dbus_object_path + u":"

567

+ interface_name + u"."

634

raise DBusPropertyNotFound(self.dbus_object_path + ":"

635

+ interface_name + "."

568

636

+ property_name)

569

637

570

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

571

out_signature=u"v")

638

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

639

out_signature="v")

572

640

def Get(self, interface_name, property_name):

573

641

"""Standard D-Bus property Get() method, see D-Bus standard.

574

642

"""

575

643

prop = self._get_dbus_property(interface_name, property_name)

576

if prop._dbus_access == u"write":

644

if prop._dbus_access == "write":

577

645

raise DBusPropertyAccessException(property_name)

578

646

value = prop()

579

if not hasattr(value, u"variant_level"):

647

if not hasattr(value, "variant_level"):

580

648

return value

581

649

return type(value)(value, variant_level=value.variant_level+1)

582

650

583

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

651

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

584

652

def Set(self, interface_name, property_name, value):

585

653

"""Standard D-Bus property Set() method, see D-Bus standard.

586

654

"""

587

655

prop = self._get_dbus_property(interface_name, property_name)

588

if prop._dbus_access == u"read":

656

if prop._dbus_access == "read":

589

657

raise DBusPropertyAccessException(property_name)

590

if prop._dbus_get_args_options[u"byte_arrays"]:

658

if prop._dbus_get_args_options["byte_arrays"]:

659

# The byte_arrays option is not supported yet on

660

# signatures other than "ay".

661

if prop._dbus_signature != "ay":

662

raise ValueError

591

663

value = dbus.ByteArray(''.join(unichr(byte)

592

664

for byte in value))

593

665

prop(value)

594

666

595

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

596

out_signature=u"a{sv}")

667

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

668

out_signature="a{sv}")

597

669

def GetAll(self, interface_name):

598

670

"""Standard D-Bus property GetAll() method, see D-Bus

599

671

standard.

607

679

# Interface non-empty but did not match

608

680

continue

609

681

# Ignore write-only properties

610

if prop._dbus_access == u"write":

682

if prop._dbus_access == "write":

611

683

continue

612

684

value = prop()

613

if not hasattr(value, u"variant_level"):

685

if not hasattr(value, "variant_level"):

614

686

all[name] = value

615

687

continue

616

688

all[name] = type(value)(value, variant_level=

617

689

value.variant_level+1)

618

return dbus.Dictionary(all, signature=u"sv")

690

return dbus.Dictionary(all, signature="sv")

619

691

620

692

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

621

out_signature=u"s",

693

out_signature="s",

622

694

path_keyword='object_path',

623

695

connection_keyword='connection')

624

696

def Introspect(self, object_path, connection):

625

697

"""Standard D-Bus method, overloaded to insert property tags.

626

698

"""

627

699

xmlstring = dbus.service.Object.Introspect(self, object_path,

628

connection)

629

document = xml.dom.minidom.parseString(xmlstring)

630

del xmlstring

631

def make_tag(document, name, prop):

632

e = document.createElement(u"property")

633

e.setAttribute(u"name", name)

634

e.setAttribute(u"type", prop._dbus_signature)

635

e.setAttribute(u"access", prop._dbus_access)

636

return e

637

for if_tag in document.getElementsByTagName(u"interface"):

638

for tag in (make_tag(document, name, prop)

639

for name, prop

640

in self._get_all_dbus_properties()

641

if prop._dbus_interface

642

== if_tag.getAttribute(u"name")):

643

if_tag.appendChild(tag)

644

xmlstring = document.toxml(u"utf-8")

645

document.unlink()

700

connection)

701

try:

702

document = xml.dom.minidom.parseString(xmlstring)

703

def make_tag(document, name, prop):

704

e = document.createElement("property")

705

e.setAttribute("name", name)

706

e.setAttribute("type", prop._dbus_signature)

707

e.setAttribute("access", prop._dbus_access)

708

return e

709

for if_tag in document.getElementsByTagName("interface"):

710

for tag in (make_tag(document, name, prop)

711

for name, prop

712

in self._get_all_dbus_properties()

713

if prop._dbus_interface

714

== if_tag.getAttribute("name")):

715

if_tag.appendChild(tag)

716

# Add the names to the return values for the

717

# "org.freedesktop.DBus.Properties" methods

718

if (if_tag.getAttribute("name")

719

== "org.freedesktop.DBus.Properties"):

720

for cn in if_tag.getElementsByTagName("method"):

721

if cn.getAttribute("name") == "Get":

722

for arg in cn.getElementsByTagName("arg"):

723

if (arg.getAttribute("direction")

724

== "out"):

725

arg.setAttribute("name", "value")

726

elif cn.getAttribute("name") == "GetAll":

727

for arg in cn.getElementsByTagName("arg"):

728

if (arg.getAttribute("direction")

729

== "out"):

730

arg.setAttribute("name", "props")

731

xmlstring = document.toxml("utf-8")

732

document.unlink()

733

except (AttributeError, xml.dom.DOMException,

734

xml.parsers.expat.ExpatError) as error:

735

logger.error("Failed to override Introspection method",

736

error)

646

737

return xmlstring

647

738

648

739

653

744

dbus_object_path: dbus.ObjectPath

654

745

bus: dbus.SystemBus()

655

746

"""

747

748

runtime_expansions = (Client.runtime_expansions

749

+ ("dbus_object_path",))

750

656

751

# dbus.service.Object doesn't use super(), so we can't either.

657

752

658

753

def __init__(self, bus = None, *args, **kwargs):

754

self._approvals_pending = 0

659

755

self.bus = bus

660

756

Client.__init__(self, *args, **kwargs)

661

757

# Only now, when this client is initialized, can it show up on

662

758

# the D-Bus

759

client_object_name = unicode(self.name).translate(

760

{ord("."): ord("_"),

761

ord("-"): ord("_")})

663

762

self.dbus_object_path = (dbus.ObjectPath

664

(u"/clients/"

665

+ self.name.replace(u".", u"_")))

763

("/clients/" + client_object_name))

666

764

DBusObjectWithProperties.__init__(self, self.bus,

667

765

self.dbus_object_path)

766

767

def _get_approvals_pending(self):

768

return self._approvals_pending

769

def _set_approvals_pending(self, value):

770

old_value = self._approvals_pending

771

self._approvals_pending = value

772

bval = bool(value)

773

if (hasattr(self, "dbus_object_path")

774

and bval is not bool(old_value)):

775

dbus_bool = dbus.Boolean(bval, variant_level=1)

776

self.PropertyChanged(dbus.String("ApprovalPending"),

777

dbus_bool)

778

779

approvals_pending = property(_get_approvals_pending,

780

_set_approvals_pending)

781

del _get_approvals_pending, _set_approvals_pending

668

782

669

783

@staticmethod

670

784

def _datetime_to_dbus(dt, variant_level=0):

673

787

variant_level=variant_level)

674

788

675

789

def enable(self):

676

oldstate = getattr(self, u"enabled", False)

790

oldstate = getattr(self, "enabled", False)

677

791

r = Client.enable(self)

678

792

if oldstate != self.enabled:

679

793

# Emit D-Bus signals

680

self.PropertyChanged(dbus.String(u"enabled"),

794

self.PropertyChanged(dbus.String("Enabled"),

681

795

dbus.Boolean(True, variant_level=1))

682

796

self.PropertyChanged(

683

dbus.String(u"last_enabled"),

797

dbus.String("LastEnabled"),

684

798

self._datetime_to_dbus(self.last_enabled,

685

799

variant_level=1))

686

800

return r

687

801

688

def disable(self, signal = True):

689

oldstate = getattr(self, u"enabled", False)

690

r = Client.disable(self)

691

if signal and oldstate != self.enabled:

802

def disable(self, quiet = False):

803

oldstate = getattr(self, "enabled", False)

804

r = Client.disable(self, quiet=quiet)

805

if not quiet and oldstate != self.enabled:

692

806

# Emit D-Bus signal

693

self.PropertyChanged(dbus.String(u"enabled"),

807

self.PropertyChanged(dbus.String("Enabled"),

694

808

dbus.Boolean(False, variant_level=1))

695

809

return r

696

810

699

813

self.remove_from_connection()

700

814

except LookupError:

701

815

pass

702

if hasattr(DBusObjectWithProperties, u"__del__"):

816

if hasattr(DBusObjectWithProperties, "__del__"):

703

817

DBusObjectWithProperties.__del__(self, *args, **kwargs)

704

818

Client.__del__(self, *args, **kwargs)

705

819

708

822

self.checker_callback_tag = None

709

823

self.checker = None

710

824

# Emit D-Bus signal

711

self.PropertyChanged(dbus.String(u"checker_running"),

825

self.PropertyChanged(dbus.String("CheckerRunning"),

712

826

dbus.Boolean(False, variant_level=1))

713

827

if os.WIFEXITED(condition):

714

828

exitstatus = os.WEXITSTATUS(condition)

726

840

*args, **kwargs)

727

841

728

842

def checked_ok(self, *args, **kwargs):

729

r = Client.checked_ok(self, *args, **kwargs)

843

Client.checked_ok(self, *args, **kwargs)

730

844

# Emit D-Bus signal

731

845

self.PropertyChanged(

732

dbus.String(u"last_checked_ok"),

846

dbus.String("LastCheckedOK"),

733

847

(self._datetime_to_dbus(self.last_checked_ok,

734

848

variant_level=1)))

849

850

def need_approval(self, *args, **kwargs):

851

r = Client.need_approval(self, *args, **kwargs)

852

# Emit D-Bus signal

853

self.PropertyChanged(

854

dbus.String("LastApprovalRequest"),

855

(self._datetime_to_dbus(self.last_approval_request,

856

variant_level=1)))

735

857

return r

736

858

737

859

def start_checker(self, *args, **kwargs):

747

869

# Emit D-Bus signal

748

870

self.CheckerStarted(self.current_checker_command)

749

871

self.PropertyChanged(

750

dbus.String(u"checker_running"),

872

dbus.String("CheckerRunning"),

751

873

dbus.Boolean(True, variant_level=1))

752

874

return r

753

875

754

876

def stop_checker(self, *args, **kwargs):

755

old_checker = getattr(self, u"checker", None)

877

old_checker = getattr(self, "checker", None)

756

878

r = Client.stop_checker(self, *args, **kwargs)

757

879

if (old_checker is not None

758

and getattr(self, u"checker", None) is None):

759

self.PropertyChanged(dbus.String(u"checker_running"),

880

and getattr(self, "checker", None) is None):

881

self.PropertyChanged(dbus.String("CheckerRunning"),

760

882

dbus.Boolean(False, variant_level=1))

761

883

return r

762

763

## D-Bus methods & signals

764

_interface = u"se.bsnet.fukt.Mandos.Client"

765

766

# CheckedOK - method

767

@dbus.service.method(_interface)

768

def CheckedOK(self):

769

return self.checked_ok()

884

885

def _reset_approved(self):

886

self._approved = None

887

return False

888

889

def approve(self, value=True):

890

self.send_changedstate()

891

self._approved = value

892

gobject.timeout_add(self._timedelta_to_milliseconds

893

(self.approval_duration),

894

self._reset_approved)

895

896

897

## D-Bus methods, signals & properties

898

_interface = "se.bsnet.fukt.Mandos.Client"

899

900

## Signals

770

901

771

902

# CheckerCompleted - signal

772

@dbus.service.signal(_interface, signature=u"nxs")

903

@dbus.service.signal(_interface, signature="nxs")

773

904

def CheckerCompleted(self, exitcode, waitstatus, command):

774

905

"D-Bus signal"

775

906

pass

776

907

777

908

# CheckerStarted - signal

778

@dbus.service.signal(_interface, signature=u"s")

909

@dbus.service.signal(_interface, signature="s")

779

910

def CheckerStarted(self, command):

780

911

"D-Bus signal"

781

912

pass

782

913

783

914

# PropertyChanged - signal

784

@dbus.service.signal(_interface, signature=u"sv")

915

@dbus.service.signal(_interface, signature="sv")

785

916

def PropertyChanged(self, property, value):

786

917

"D-Bus signal"

787

918

pass

788

919

789

# ReceivedSecret - signal

920

# GotSecret - signal

790

921

@dbus.service.signal(_interface)

791

def ReceivedSecret(self):

792

"D-Bus signal"

922

def GotSecret(self):

923

"""D-Bus signal

924

Is sent after a successful transfer of secret from the Mandos

925

server to mandos-client

926

"""

793

927

pass

794

928

795

929

# Rejected - signal

796

@dbus.service.signal(_interface)

797

def Rejected(self):

930

@dbus.service.signal(_interface, signature="s")

931

def Rejected(self, reason):

798

932

"D-Bus signal"

799

933

pass

800

934

935

# NeedApproval - signal

936

@dbus.service.signal(_interface, signature="tb")

937

def NeedApproval(self, timeout, default):

938

"D-Bus signal"

939

return self.need_approval()

940

941

## Methods

942

943

# Approve - method

944

@dbus.service.method(_interface, in_signature="b")

945

def Approve(self, value):

946

self.approve(value)

947

948

# CheckedOK - method

949

@dbus.service.method(_interface)

950

def CheckedOK(self):

951

self.checked_ok()

952

801

953

# Enable - method

802

954

@dbus.service.method(_interface)

803

955

def Enable(self):

821

973

def StopChecker(self):

822

974

self.stop_checker()

823

975

824

# name - property

825

@dbus_service_property(_interface, signature=u"s", access=u"read")

826

def name_dbus_property(self):

976

## Properties

977

978

# ApprovalPending - property

979

@dbus_service_property(_interface, signature="b", access="read")

980

def ApprovalPending_dbus_property(self):

981

return dbus.Boolean(bool(self.approvals_pending))

982

983

# ApprovedByDefault - property

984

@dbus_service_property(_interface, signature="b",

985

access="readwrite")

986

def ApprovedByDefault_dbus_property(self, value=None):

987

if value is None: # get

988

return dbus.Boolean(self.approved_by_default)

989

self.approved_by_default = bool(value)

990

# Emit D-Bus signal

991

self.PropertyChanged(dbus.String("ApprovedByDefault"),

992

dbus.Boolean(value, variant_level=1))

993

994

# ApprovalDelay - property

995

@dbus_service_property(_interface, signature="t",

996

access="readwrite")

997

def ApprovalDelay_dbus_property(self, value=None):

998

if value is None: # get

999

return dbus.UInt64(self.approval_delay_milliseconds())

1000

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1001

# Emit D-Bus signal

1002

self.PropertyChanged(dbus.String("ApprovalDelay"),

1003

dbus.UInt64(value, variant_level=1))

1004

1005

# ApprovalDuration - property

1006

@dbus_service_property(_interface, signature="t",

1007

access="readwrite")

1008

def ApprovalDuration_dbus_property(self, value=None):

1009

if value is None: # get

1010

return dbus.UInt64(self._timedelta_to_milliseconds(

1011

self.approval_duration))

1012

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1013

# Emit D-Bus signal

1014

self.PropertyChanged(dbus.String("ApprovalDuration"),

1015

dbus.UInt64(value, variant_level=1))

1016

1017

# Name - property

1018

@dbus_service_property(_interface, signature="s", access="read")

1019

def Name_dbus_property(self):

827

1020

return dbus.String(self.name)

828

1021

829

# fingerprint - property

830

@dbus_service_property(_interface, signature=u"s", access=u"read")

831

def fingerprint_dbus_property(self):

1022

# Fingerprint - property

1023

@dbus_service_property(_interface, signature="s", access="read")

1024

def Fingerprint_dbus_property(self):

832

1025

return dbus.String(self.fingerprint)

833

1026

834

# host - property

835

@dbus_service_property(_interface, signature=u"s",

836

access=u"readwrite")

837

def host_dbus_property(self, value=None):

1027

# Host - property

1028

@dbus_service_property(_interface, signature="s",

1029

access="readwrite")

1030

def Host_dbus_property(self, value=None):

838

1031

if value is None: # get

839

1032

return dbus.String(self.host)

840

1033

self.host = value

841

1034

# Emit D-Bus signal

842

self.PropertyChanged(dbus.String(u"host"),

1035

self.PropertyChanged(dbus.String("Host"),

843

1036

dbus.String(value, variant_level=1))

844

1037

845

# created - property

846

@dbus_service_property(_interface, signature=u"s", access=u"read")

847

def created_dbus_property(self):

1038

# Created - property

1039

@dbus_service_property(_interface, signature="s", access="read")

1040

def Created_dbus_property(self):

848

1041

return dbus.String(self._datetime_to_dbus(self.created))

849

1042

850

# last_enabled - property

851

@dbus_service_property(_interface, signature=u"s", access=u"read")

852

def last_enabled_dbus_property(self):

1043

# LastEnabled - property

1044

@dbus_service_property(_interface, signature="s", access="read")

1045

def LastEnabled_dbus_property(self):

853

1046

if self.last_enabled is None:

854

return dbus.String(u"")

1047

return dbus.String("")

855

1048

return dbus.String(self._datetime_to_dbus(self.last_enabled))

856

1049

857

# enabled - property

858

@dbus_service_property(_interface, signature=u"b",

859

access=u"readwrite")

860

def enabled_dbus_property(self, value=None):

1050

# Enabled - property

1051

@dbus_service_property(_interface, signature="b",

1052

access="readwrite")

1053

def Enabled_dbus_property(self, value=None):

861

1054

if value is None: # get

862

1055

return dbus.Boolean(self.enabled)

863

1056

if value:

865

1058

else:

866

1059

self.disable()

867

1060

868

# last_checked_ok - property

869

@dbus_service_property(_interface, signature=u"s",

870

access=u"readwrite")

871

def last_checked_ok_dbus_property(self, value=None):

1061

# LastCheckedOK - property

1062

@dbus_service_property(_interface, signature="s",

1063

access="readwrite")

1064

def LastCheckedOK_dbus_property(self, value=None):

872

1065

if value is not None:

873

1066

self.checked_ok()

874

1067

return

875

1068

if self.last_checked_ok is None:

876

return dbus.String(u"")

1069

return dbus.String("")

877

1070

return dbus.String(self._datetime_to_dbus(self

878

1071

.last_checked_ok))

879

1072

880

# timeout - property

881

@dbus_service_property(_interface, signature=u"t",

882

access=u"readwrite")

883

def timeout_dbus_property(self, value=None):

1073

# LastApprovalRequest - property

1074

@dbus_service_property(_interface, signature="s", access="read")

1075

def LastApprovalRequest_dbus_property(self):

1076

if self.last_approval_request is None:

1077

return dbus.String("")

1078

return dbus.String(self.

1079

_datetime_to_dbus(self

1080

.last_approval_request))

1081

1082

# Timeout - property

1083

@dbus_service_property(_interface, signature="t",

1084

access="readwrite")

1085

def Timeout_dbus_property(self, value=None):

884

1086

if value is None: # get

885

1087

return dbus.UInt64(self.timeout_milliseconds())

886

1088

self.timeout = datetime.timedelta(0, 0, 0, value)

887

1089

# Emit D-Bus signal

888

self.PropertyChanged(dbus.String(u"timeout"),

1090

self.PropertyChanged(dbus.String("Timeout"),

889

1091

dbus.UInt64(value, variant_level=1))

890

if getattr(self, u"disable_initiator_tag", None) is None:

1092

if getattr(self, "disable_initiator_tag", None) is None:

891

1093

return

892

1094

# Reschedule timeout

893

1095

gobject.source_remove(self.disable_initiator_tag)

905

1107

self.disable_initiator_tag = (gobject.timeout_add

906

1108

(time_to_die, self.disable))

907

1109

908

# interval - property

909

@dbus_service_property(_interface, signature=u"t",

910

access=u"readwrite")

911

def interval_dbus_property(self, value=None):

1110

# Interval - property

1111

@dbus_service_property(_interface, signature="t",

1112

access="readwrite")

1113

def Interval_dbus_property(self, value=None):

912

1114

if value is None: # get

913

1115

return dbus.UInt64(self.interval_milliseconds())

914

1116

self.interval = datetime.timedelta(0, 0, 0, value)

915

1117

# Emit D-Bus signal

916

self.PropertyChanged(dbus.String(u"interval"),

1118

self.PropertyChanged(dbus.String("Interval"),

917

1119

dbus.UInt64(value, variant_level=1))

918

if getattr(self, u"checker_initiator_tag", None) is None:

1120

if getattr(self, "checker_initiator_tag", None) is None:

919

1121

return

920

1122

# Reschedule checker run

921

1123

gobject.source_remove(self.checker_initiator_tag)

923

1125

(value, self.start_checker))

924

1126

self.start_checker() # Start one now, too

925

1127

926

# checker - property

927

@dbus_service_property(_interface, signature=u"s",

928

access=u"readwrite")

929

def checker_dbus_property(self, value=None):

1128

# Checker - property

1129

@dbus_service_property(_interface, signature="s",

1130

access="readwrite")

1131

def Checker_dbus_property(self, value=None):

930

1132

if value is None: # get

931

1133

return dbus.String(self.checker_command)

932

1134

self.checker_command = value

933

1135

# Emit D-Bus signal

934

self.PropertyChanged(dbus.String(u"checker"),

1136

self.PropertyChanged(dbus.String("Checker"),

935

1137

dbus.String(self.checker_command,

936

1138

variant_level=1))

937

1139

938

# checker_running - property

939

@dbus_service_property(_interface, signature=u"b",

940

access=u"readwrite")

941

def checker_running_dbus_property(self, value=None):

1140

# CheckerRunning - property

1141

@dbus_service_property(_interface, signature="b",

1142

access="readwrite")

1143

def CheckerRunning_dbus_property(self, value=None):

942

1144

if value is None: # get

943

1145

return dbus.Boolean(self.checker is not None)

944

1146

if value:

946

1148

else:

947

1149

self.stop_checker()

948

1150

949

# object_path - property

950

@dbus_service_property(_interface, signature=u"o", access=u"read")

951

def object_path_dbus_property(self):

1151

# ObjectPath - property

1152

@dbus_service_property(_interface, signature="o", access="read")

1153

def ObjectPath_dbus_property(self):

952

1154

return self.dbus_object_path # is already a dbus.ObjectPath

953

1155

954

# secret = property

955

@dbus_service_property(_interface, signature=u"ay",

956

access=u"write", byte_arrays=True)

957

def secret_dbus_property(self, value):

1156

# Secret = property

1157

@dbus_service_property(_interface, signature="ay",

1158

access="write", byte_arrays=True)

1159

def Secret_dbus_property(self, value):

958

1160

self.secret = str(value)

959

1161

960

1162

del _interface

961

1163

962

1164

1165

class ProxyClient(object):

1166

def __init__(self, child_pipe, fpr, address):

1167

self._pipe = child_pipe

1168

self._pipe.send(('init', fpr, address))

1169

if not self._pipe.recv():

1170

raise KeyError()

1171

1172

def __getattribute__(self, name):

1173

if(name == '_pipe'):

1174

return super(ProxyClient, self).__getattribute__(name)

1175

self._pipe.send(('getattr', name))

1176

data = self._pipe.recv()

1177

if data[0] == 'data':

1178

return data[1]

1179

if data[0] == 'function':

1180

def func(*args, **kwargs):

1181

self._pipe.send(('funcall', name, args, kwargs))

1182

return self._pipe.recv()[1]

1183

return func

1184

1185

def __setattr__(self, name, value):

1186

if(name == '_pipe'):

1187

return super(ProxyClient, self).__setattr__(name, value)

1188

self._pipe.send(('setattr', name, value))

1189

1190

963

1191

class ClientHandler(socketserver.BaseRequestHandler, object):

964

1192

"""A class to handle client connections.

965

1193

967

1195

Note: This will run in its own forked process."""

968

1196

969

1197

def handle(self):

970

logger.info(u"TCP connection from: %s",

971

unicode(self.client_address))

972

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

973

# Open IPC pipe to parent process

974

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1198

with contextlib.closing(self.server.child_pipe) as child_pipe:

1199

logger.info("TCP connection from: %s",

1200

unicode(self.client_address))

1201

logger.debug("Pipe FD: %d",

1202

self.server.child_pipe.fileno())

1203

975

1204

session = (gnutls.connection

976

1205

.ClientSession(self.request,

977

1206

gnutls.connection

978

1207

.X509Credentials()))

979

980

line = self.request.makefile().readline()

981

logger.debug(u"Protocol version: %r", line)

982

try:

983

if int(line.strip().split()[0]) > 1:

984

raise RuntimeError

985

except (ValueError, IndexError, RuntimeError), error:

986

logger.error(u"Unknown protocol version: %s", error)

987

return

988

1208

989

1209

# Note: gnutls.connection.X509Credentials is really a

990

1210

# generic GnuTLS certificate credentials object so long as

991

1211

# no X.509 keys are added to it. Therefore, we can use it

992

1212

# here despite using OpenPGP certificates.

993

994

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

995

# u"+AES-256-CBC", u"+SHA1",

996

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

997

# u"+DHE-DSS"))

1213

1214

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1215

# "+AES-256-CBC", "+SHA1",

1216

# "+COMP-NULL", "+CTYPE-OPENPGP",

1217

# "+DHE-DSS"))

998

1218

# Use a fallback default, since this MUST be set.

999

1219

priority = self.server.gnutls_priority

1000

1220

if priority is None:

1001

priority = u"NORMAL"

1221

priority = "NORMAL"

1002

1222

(gnutls.library.functions

1003

1223

.gnutls_priority_set_direct(session._c_object,

1004

1224

priority, None))

1005

1225

1226

# Start communication using the Mandos protocol

1227

# Get protocol number

1228

line = self.request.makefile().readline()

1229

logger.debug("Protocol version: %r", line)

1230

try:

1231

if int(line.strip().split()[0]) > 1:

1232

raise RuntimeError

1233

except (ValueError, IndexError, RuntimeError) as error:

1234

logger.error("Unknown protocol version: %s", error)

1235

return

1236

1237

# Start GnuTLS connection

1006

1238

try:

1007

1239

session.handshake()

1008

except gnutls.errors.GNUTLSError, error:

1009

logger.warning(u"Handshake failed: %s", error)

1240

except gnutls.errors.GNUTLSError as error:

1241

logger.warning("Handshake failed: %s", error)

1010

1242

# Do not run session.bye() here: the session is not

1011

1243

# established. Just abandon the request.

1012

1244

return

1013

logger.debug(u"Handshake succeeded")

1245

logger.debug("Handshake succeeded")

1246

1247

approval_required = False

1014

1248

try:

1015

fpr = self.fingerprint(self.peer_certificate(session))

1016

except (TypeError, gnutls.errors.GNUTLSError), error:

1017

logger.warning(u"Bad certificate: %s", error)

1018

session.bye()

1019

return

1020

logger.debug(u"Fingerprint: %s", fpr)

1249

try:

1250

fpr = self.fingerprint(self.peer_certificate

1251

(session))

1252

except (TypeError,

1253

gnutls.errors.GNUTLSError) as error:

1254

logger.warning("Bad certificate: %s", error)

1255

return

1256

logger.debug("Fingerprint: %s", fpr)

1257

1258

try:

1259

client = ProxyClient(child_pipe, fpr,

1260

self.client_address)

1261

except KeyError:

1262

return

1263

1264

if client.approval_delay:

1265

delay = client.approval_delay

1266

client.approvals_pending += 1

1267

approval_required = True

1268

1269

while True:

1270

if not client.enabled:

1271

logger.info("Client %s is disabled",

1272

client.name)

1273

if self.server.use_dbus:

1274

# Emit D-Bus signal

1275

client.Rejected("Disabled")

1276

return

1277

1278

if client._approved or not client.approval_delay:

1279

#We are approved or approval is disabled

1280

break

1281

elif client._approved is None:

1282

logger.info("Client %s needs approval",

1283

client.name)

1284

if self.server.use_dbus:

1285

# Emit D-Bus signal

1286

client.NeedApproval(

1287

client.approval_delay_milliseconds(),

1288

client.approved_by_default)

1289

else:

1290

logger.warning("Client %s was not approved",

1291

client.name)

1292

if self.server.use_dbus:

1293

# Emit D-Bus signal

1294

client.Rejected("Denied")

1295

return

1296

1297

#wait until timeout or approved

1298

#x = float(client._timedelta_to_milliseconds(delay))

1299

time = datetime.datetime.now()

1300

client.changedstate.acquire()

1301

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1302

client.changedstate.release()

1303

time2 = datetime.datetime.now()

1304

if (time2 - time) >= delay:

1305

if not client.approved_by_default:

1306

logger.warning("Client %s timed out while"

1307

" waiting for approval",

1308

client.name)

1309

if self.server.use_dbus:

1310

# Emit D-Bus signal

1311

client.Rejected("Approval timed out")

1312

return

1313

else:

1314

break

1315

else:

1316

delay -= time2 - time

1317

1318

sent_size = 0

1319

while sent_size < len(client.secret):

1320

try:

1321

sent = session.send(client.secret[sent_size:])

1322

except gnutls.errors.GNUTLSError as error:

1323

logger.warning("gnutls send failed")

1324

return

1325

logger.debug("Sent: %d, remaining: %d",

1326

sent, len(client.secret)

1327

- (sent_size + sent))

1328

sent_size += sent

1329

1330

logger.info("Sending secret to %s", client.name)

1331

# bump the timeout as if seen

1332

client.checked_ok()

1333

if self.server.use_dbus:

1334

# Emit D-Bus signal

1335

client.GotSecret()

1021

1336

1022

for c in self.server.clients:

1023

if c.fingerprint == fpr:

1024

client = c

1025

break

1026

else:

1027

ipc.write(u"NOTFOUND %s %s\n"

1028

% (fpr, unicode(self.client_address)))

1029

session.bye()

1030

return

1031

# Have to check if client.still_valid(), since it is

1032

# possible that the client timed out while establishing

1033

# the GnuTLS session.

1034

if not client.still_valid():

1035

ipc.write(u"INVALID %s\n" % client.name)

1036

session.bye()

1037

return

1038

ipc.write(u"SENDING %s\n" % client.name)

1039

sent_size = 0

1040

while sent_size < len(client.secret):

1041

sent = session.send(client.secret[sent_size:])

1042

logger.debug(u"Sent: %d, remaining: %d",

1043

sent, len(client.secret)

1044

- (sent_size + sent))

1045

sent_size += sent

1046

session.bye()

1337

finally:

1338

if approval_required:

1339

client.approvals_pending -= 1

1340

try:

1341

session.bye()

1342

except gnutls.errors.GNUTLSError as error:

1343

logger.warning("GnuTLS bye failed")

1047

1344

1048

1345

@staticmethod

1049

1346

def peer_certificate(session):

1059

1356

.gnutls_certificate_get_peers

1060

1357

(session._c_object, ctypes.byref(list_size)))

1061

1358

if not bool(cert_list) and list_size.value != 0:

1062

raise gnutls.errors.GNUTLSError(u"error getting peer"

1063

u" certificate")

1359

raise gnutls.errors.GNUTLSError("error getting peer"

1360

" certificate")

1064

1361

if list_size.value == 0:

1065

1362

return None

1066

1363

cert = cert_list[0]

1092

1389

if crtverify.value != 0:

1093

1390

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1094

1391

raise (gnutls.errors.CertificateSecurityError

1095

(u"Verify failed"))

1392

("Verify failed"))

1096

1393

# New buffer for the fingerprint

1097

1394

buf = ctypes.create_string_buffer(20)

1098

1395

buf_len = ctypes.c_size_t()

1105

1402

# Convert the buffer to a Python bytestring

1106

1403

fpr = ctypes.string_at(buf, buf_len.value)

1107

1404

# Convert the bytestring to hexadecimal notation

1108

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1405

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1109

1406

return hex_fpr

1110

1407

1111

1408

1112

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1113

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1409

class MultiprocessingMixIn(object):

1410

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1411

def sub_process_main(self, request, address):

1412

try:

1413

self.finish_request(request, address)

1414

except:

1415

self.handle_error(request, address)

1416

self.close_request(request)

1417

1418

def process_request(self, request, address):

1419

"""Start a new process to process the request."""

1420

multiprocessing.Process(target = self.sub_process_main,

1421

args = (request, address)).start()

1422

1423

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1424

""" adds a pipe to the MixIn """

1114

1425

def process_request(self, request, client_address):

1115

1426

"""Overrides and wraps the original process_request().

1116

1427

1117

1428

This function creates a new pipe in self.pipe

1118

1429

"""

1119

self.pipe = os.pipe()

1120

super(ForkingMixInWithPipe,

1430

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1431

1432

super(MultiprocessingMixInWithPipe,

1121

1433

self).process_request(request, client_address)

1122

os.close(self.pipe[1]) # close write end

1123

self.add_pipe(self.pipe[0])

1124

def add_pipe(self, pipe):

1434

self.child_pipe.close()

1435

self.add_pipe(parent_pipe)

1436

1437

def add_pipe(self, parent_pipe):

1125

1438

"""Dummy function; override as necessary"""

1126

os.close(pipe)

1127

1128

1129

class IPv6_TCPServer(ForkingMixInWithPipe,

1439

raise NotImplementedError

1440

1441

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1130

1442

socketserver.TCPServer, object):

1131

1443

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1132

1444

1148

1460

bind to an address or port if they were not specified."""

1149

1461

if self.interface is not None:

1150

1462

if SO_BINDTODEVICE is None:

1151

logger.error(u"SO_BINDTODEVICE does not exist;"

1152

u" cannot bind to interface %s",

1463

logger.error("SO_BINDTODEVICE does not exist;"

1464

" cannot bind to interface %s",

1153

1465

self.interface)

1154

1466

else:

1155

1467

try:

1156

1468

self.socket.setsockopt(socket.SOL_SOCKET,

1157

1469

SO_BINDTODEVICE,

1158

1470

str(self.interface

1159

+ u'\0'))

1160

except socket.error, error:

1471

+ '\0'))

1472

except socket.error as error:

1161

1473

if error[0] == errno.EPERM:

1162

logger.error(u"No permission to"

1163

u" bind to interface %s",

1474

logger.error("No permission to"

1475

" bind to interface %s",

1164

1476

self.interface)

1165

1477

elif error[0] == errno.ENOPROTOOPT:

1166

logger.error(u"SO_BINDTODEVICE not available;"

1167

u" cannot bind to interface %s",

1478

logger.error("SO_BINDTODEVICE not available;"

1479

" cannot bind to interface %s",

1168

1480

self.interface)

1169

1481

else:

1170

1482

raise

1172

1484

if self.server_address[0] or self.server_address[1]:

1173

1485

if not self.server_address[0]:

1174

1486

if self.address_family == socket.AF_INET6:

1175

any_address = u"::" # in6addr_any

1487

any_address = "::" # in6addr_any

1176

1488

else:

1177

1489

any_address = socket.INADDR_ANY

1178

1490

self.server_address = (any_address,

1217

1529

return socketserver.TCPServer.server_activate(self)

1218

1530

def enable(self):

1219

1531

self.enabled = True

1220

def add_pipe(self, pipe):

1532

def add_pipe(self, parent_pipe):

1221

1533

# Call "handle_ipc" for both data and EOF events

1222

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1223

self.handle_ipc)

1224

def handle_ipc(self, source, condition, file_objects={}):

1534

gobject.io_add_watch(parent_pipe.fileno(),

1535

gobject.IO_IN | gobject.IO_HUP,

1536

functools.partial(self.handle_ipc,

1537

parent_pipe = parent_pipe))

1538

1539

def handle_ipc(self, source, condition, parent_pipe=None,

1540

client_object=None):

1225

1541

condition_names = {

1226

gobject.IO_IN: u"IN", # There is data to read.

1227

gobject.IO_OUT: u"OUT", # Data can be written (without

1542

gobject.IO_IN: "IN", # There is data to read.

1543

gobject.IO_OUT: "OUT", # Data can be written (without

1228

1544

# blocking).

1229

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1230

gobject.IO_ERR: u"ERR", # Error condition.

1231

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1545

gobject.IO_PRI: "PRI", # There is urgent data to read.

1546

gobject.IO_ERR: "ERR", # Error condition.

1547

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1232

1548

# broken, usually for pipes and

1233

1549

# sockets).

1234

1550

}

1236

1552

for cond, name in

1237

1553

condition_names.iteritems()

1238

1554

if cond & condition)

1239

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1240

conditions_string)

1241

1242

# Turn the pipe file descriptor into a Python file object

1243

if source not in file_objects:

1244

file_objects[source] = os.fdopen(source, u"r", 1)

1245

1246

# Read a line from the file object

1247

cmdline = file_objects[source].readline()

1248

if not cmdline: # Empty line means end of file

1249

# close the IPC pipe

1250

file_objects[source].close()

1251

del file_objects[source]

1252

1253

# Stop calling this function

1254

return False

1255

1256

logger.debug(u"IPC command: %r", cmdline)

1257

1258

# Parse and act on command

1259

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1260

1261

if cmd == u"NOTFOUND":

1262

logger.warning(u"Client not found for fingerprint: %s",

1263

args)

1264

if self.use_dbus:

1265

# Emit D-Bus signal

1266

mandos_dbus_service.ClientNotFound(args)

1267

elif cmd == u"INVALID":

1268

for client in self.clients:

1269

if client.name == args:

1270

logger.warning(u"Client %s is invalid", args)

1271

if self.use_dbus:

1272

# Emit D-Bus signal

1273

client.Rejected()

1274

break

1275

else:

1276

logger.error(u"Unknown client %s is invalid", args)

1277

elif cmd == u"SENDING":

1278

for client in self.clients:

1279

if client.name == args:

1280

logger.info(u"Sending secret to %s", client.name)

1281

client.checked_ok()

1282

if self.use_dbus:

1283

# Emit D-Bus signal

1284

client.ReceivedSecret()

1285

break

1286

else:

1287

logger.error(u"Sending secret to unknown client %s",

1288

args)

1289

else:

1290

logger.error(u"Unknown IPC command: %r", cmdline)

1291

1292

# Keep calling this function

1555

# error or the other end of multiprocessing.Pipe has closed

1556

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1557

return False

1558

1559

# Read a request from the child

1560

request = parent_pipe.recv()

1561

command = request[0]

1562

1563

if command == 'init':

1564

fpr = request[1]

1565

address = request[2]

1566

1567

for c in self.clients:

1568

if c.fingerprint == fpr:

1569

client = c

1570

break

1571

else:

1572

logger.info("Client not found for fingerprint: %s, ad"

1573

"dress: %s", fpr, address)

1574

if self.use_dbus:

1575

# Emit D-Bus signal

1576

mandos_dbus_service.ClientNotFound(fpr, address[0])

1577

parent_pipe.send(False)

1578

return False

1579

1580

gobject.io_add_watch(parent_pipe.fileno(),

1581

gobject.IO_IN | gobject.IO_HUP,

1582

functools.partial(self.handle_ipc,

1583

parent_pipe = parent_pipe,

1584

client_object = client))

1585

parent_pipe.send(True)

1586

# remove the old hook in favor of the new above hook on same fileno

1587

return False

1588

if command == 'funcall':

1589

funcname = request[1]

1590

args = request[2]

1591

kwargs = request[3]

1592

1593

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1594

1595

if command == 'getattr':

1596

attrname = request[1]

1597

if callable(client_object.__getattribute__(attrname)):

1598

parent_pipe.send(('function',))

1599

else:

1600

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1601

1602

if command == 'setattr':

1603

attrname = request[1]

1604

value = request[2]

1605

setattr(client_object, attrname, value)

1606

1293

1607

return True

1294

1608

1295

1609

1296

1610

def string_to_delta(interval):

1297

1611

"""Parse a string and return a datetime.timedelta

1298

1612

1299

>>> string_to_delta(u'7d')

1613

>>> string_to_delta('7d')

1300

1614

datetime.timedelta(7)

1301

>>> string_to_delta(u'60s')

1615

>>> string_to_delta('60s')

1302

1616

datetime.timedelta(0, 60)

1303

>>> string_to_delta(u'60m')

1617

>>> string_to_delta('60m')

1304

1618

datetime.timedelta(0, 3600)

1305

>>> string_to_delta(u'24h')

1619

>>> string_to_delta('24h')

1306

1620

datetime.timedelta(1)

1307

>>> string_to_delta(u'1w')

1621

>>> string_to_delta('1w')

1308

1622

datetime.timedelta(7)

1309

>>> string_to_delta(u'5m 30s')

1623

>>> string_to_delta('5m 30s')

1310

1624

datetime.timedelta(0, 330)

1311

1625

"""

1312

1626

timevalue = datetime.timedelta(0)

1314

1628

try:

1315

1629

suffix = unicode(s[-1])

1316

1630

value = int(s[:-1])

1317

if suffix == u"d":

1631

if suffix == "d":

1318

1632

delta = datetime.timedelta(value)

1319

elif suffix == u"s":

1633

elif suffix == "s":

1320

1634

delta = datetime.timedelta(0, value)

1321

elif suffix == u"m":

1635

elif suffix == "m":

1322

1636

delta = datetime.timedelta(0, 0, 0, 0, value)

1323

elif suffix == u"h":

1637

elif suffix == "h":

1324

1638

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1325

elif suffix == u"w":

1639

elif suffix == "w":

1326

1640

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1327

1641

else:

1328

raise ValueError

1329

except (ValueError, IndexError):

1330

raise ValueError

1642

raise ValueError("Unknown suffix %r" % suffix)

1643

except (ValueError, IndexError) as e:

1644

raise ValueError(*(e.args))

1331

1645

timevalue += delta

1332

1646

return timevalue

1333

1647

1339

1653

global if_nametoindex

1340

1654

try:

1341

1655

if_nametoindex = (ctypes.cdll.LoadLibrary

1342

(ctypes.util.find_library(u"c"))

1656

(ctypes.util.find_library("c"))

1343

1657

.if_nametoindex)

1344

1658

except (OSError, AttributeError):

1345

logger.warning(u"Doing if_nametoindex the hard way")

1659

logger.warning("Doing if_nametoindex the hard way")

1346

1660

def if_nametoindex(interface):

1347

1661

"Get an interface index the hard way, i.e. using fcntl()"

1348

1662

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1349

with closing(socket.socket()) as s:

1663

with contextlib.closing(socket.socket()) as s:

1350

1664

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1351

struct.pack(str(u"16s16x"),

1665

struct.pack(str("16s16x"),

1352

1666

interface))

1353

interface_index = struct.unpack(str(u"I"),

1667

interface_index = struct.unpack(str("I"),

1354

1668

ifreq[16:20])[0]

1355

1669

return interface_index

1356

1670

return if_nametoindex(interface)

1364

1678

sys.exit()

1365

1679

os.setsid()

1366

1680

if not nochdir:

1367

os.chdir(u"/")

1681

os.chdir("/")

1368

1682

if os.fork():

1369

1683

sys.exit()

1370

1684

if not noclose:

1372

1686

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1373

1687

if not stat.S_ISCHR(os.fstat(null).st_mode):

1374

1688

raise OSError(errno.ENODEV,

1375

u"/dev/null not a character device")

1689

"%s not a character device"

1690

% os.path.devnull)

1376

1691

os.dup2(null, sys.stdin.fileno())

1377

1692

os.dup2(null, sys.stdout.fileno())

1378

1693

os.dup2(null, sys.stderr.fileno())

1385

1700

##################################################################

1386

1701

# Parsing of options, both command line and config file

1387

1702

1388

parser = optparse.OptionParser(version = "%%prog %s" % version)

1389

parser.add_option("-i", u"--interface", type=u"string",

1390

metavar="IF", help=u"Bind to interface IF")

1391

parser.add_option("-a", u"--address", type=u"string",

1392

help=u"Address to listen for requests on")

1393

parser.add_option("-p", u"--port", type=u"int",

1394

help=u"Port number to receive requests on")

1395

parser.add_option("--check", action=u"store_true",

1396

help=u"Run self-test")

1397

parser.add_option("--debug", action=u"store_true",

1398

help=u"Debug mode; run in foreground and log to"

1399

u" terminal")

1400

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1401

u" priority string (see GnuTLS documentation)")

1402

parser.add_option("--servicename", type=u"string",

1403

metavar=u"NAME", help=u"Zeroconf service name")

1404

parser.add_option("--configdir", type=u"string",

1405

default=u"/etc/mandos", metavar=u"DIR",

1406

help=u"Directory to search for configuration"

1407

u" files")

1408

parser.add_option("--no-dbus", action=u"store_false",

1409

dest=u"use_dbus", help=u"Do not provide D-Bus"

1410

u" system bus interface")

1411

parser.add_option("--no-ipv6", action=u"store_false",

1412

dest=u"use_ipv6", help=u"Do not use IPv6")

1413

options = parser.parse_args()[0]

1703

parser = argparse.ArgumentParser()

1704

parser.add_argument("-v", "--version", action="version",

1705

version = "%%(prog)s %s" % version,

1706

help="show version number and exit")

1707

parser.add_argument("-i", "--interface", metavar="IF",

1708

help="Bind to interface IF")

1709

parser.add_argument("-a", "--address",

1710

help="Address to listen for requests on")

1711

parser.add_argument("-p", "--port", type=int,

1712

help="Port number to receive requests on")

1713

parser.add_argument("--check", action="store_true",

1714

help="Run self-test")

1715

parser.add_argument("--debug", action="store_true",

1716

help="Debug mode; run in foreground and log"

1717

" to terminal")

1718

parser.add_argument("--debuglevel", metavar="LEVEL",

1719

help="Debug level for stdout output")

1720

parser.add_argument("--priority", help="GnuTLS"

1721

" priority string (see GnuTLS documentation)")

1722

parser.add_argument("--servicename",

1723

metavar="NAME", help="Zeroconf service name")

1724

parser.add_argument("--configdir",

1725

default="/etc/mandos", metavar="DIR",

1726

help="Directory to search for configuration"

1727

" files")

1728

parser.add_argument("--no-dbus", action="store_false",

1729

dest="use_dbus", help="Do not provide D-Bus"

1730

" system bus interface")

1731

parser.add_argument("--no-ipv6", action="store_false",

1732

dest="use_ipv6", help="Do not use IPv6")

1733

options = parser.parse_args()

1414

1734

1415

1735

if options.check:

1416

1736

import doctest

1418

1738

sys.exit()

1419

1739

1420

1740

# Default values for config file for server-global settings

1421

server_defaults = { u"interface": u"",

1422

u"address": u"",

1423

u"port": u"",

1424

u"debug": u"False",

1425

u"priority":

1426

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1427

u"servicename": u"Mandos",

1428

u"use_dbus": u"True",

1429

u"use_ipv6": u"True",

1741

server_defaults = { "interface": "",

1742

"address": "",

1743

"port": "",

1744

"debug": "False",

1745

"priority":

1746

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1747

"servicename": "Mandos",

1748

"use_dbus": "True",

1749

"use_ipv6": "True",

1750

"debuglevel": "",

1430

1751

}

1431

1752

1432

1753

# Parse config file for server-global settings

1433

1754

server_config = configparser.SafeConfigParser(server_defaults)

1434

1755

del server_defaults

1435

1756

server_config.read(os.path.join(options.configdir,

1436

u"mandos.conf"))

1757

"mandos.conf"))

1437

1758

# Convert the SafeConfigParser object to a dict

1438

1759

server_settings = server_config.defaults()

1439

1760

# Use the appropriate methods on the non-string config options

1440

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1441

server_settings[option] = server_config.getboolean(u"DEFAULT",

1761

for option in ("debug", "use_dbus", "use_ipv6"):

1762

server_settings[option] = server_config.getboolean("DEFAULT",

1442

1763

option)

1443

1764

if server_settings["port"]:

1444

server_settings["port"] = server_config.getint(u"DEFAULT",

1445

u"port")

1765

server_settings["port"] = server_config.getint("DEFAULT",

1766

"port")

1446

1767

del server_config

1447

1768

1448

1769

# Override the settings from the config file with command line

1449

1770

# options, if set.

1450

for option in (u"interface", u"address", u"port", u"debug",

1451

u"priority", u"servicename", u"configdir",

1452

u"use_dbus", u"use_ipv6"):

1771

for option in ("interface", "address", "port", "debug",

1772

"priority", "servicename", "configdir",

1773

"use_dbus", "use_ipv6", "debuglevel"):

1453

1774

value = getattr(options, option)

1454

1775

if value is not None:

1455

1776

server_settings[option] = value

1463

1784

##################################################################

1464

1785

1465

1786

# For convenience

1466

debug = server_settings[u"debug"]

1467

use_dbus = server_settings[u"use_dbus"]

1468

use_ipv6 = server_settings[u"use_ipv6"]

1469

1470

if not debug:

1471

syslogger.setLevel(logging.WARNING)

1472

console.setLevel(logging.WARNING)

1473

1474

if server_settings[u"servicename"] != u"Mandos":

1787

debug = server_settings["debug"]

1788

debuglevel = server_settings["debuglevel"]

1789

use_dbus = server_settings["use_dbus"]

1790

use_ipv6 = server_settings["use_ipv6"]

1791

1792

if server_settings["servicename"] != "Mandos":

1475

1793

syslogger.setFormatter(logging.Formatter

1476

(u'Mandos (%s) [%%(process)d]:'

1477

u' %%(levelname)s: %%(message)s'

1478

% server_settings[u"servicename"]))

1794

('Mandos (%s) [%%(process)d]:'

1795

' %%(levelname)s: %%(message)s'

1796

% server_settings["servicename"]))

1479

1797

1480

1798

# Parse config file with clients

1481

client_defaults = { u"timeout": u"1h",

1482

u"interval": u"5m",

1483

u"checker": u"fping -q -- %%(host)s",

1484

u"host": u"",

1799

client_defaults = { "timeout": "1h",

1800

"interval": "5m",

1801

"checker": "fping -q -- %%(host)s",

1802

"host": "",

1803

"approval_delay": "0s",

1804

"approval_duration": "1s",

1485

1805

}

1486

1806

client_config = configparser.SafeConfigParser(client_defaults)

1487

client_config.read(os.path.join(server_settings[u"configdir"],

1488

u"clients.conf"))

1807

client_config.read(os.path.join(server_settings["configdir"],

1808

"clients.conf"))

1489

1809

1490

1810

global mandos_dbus_service

1491

1811

mandos_dbus_service = None

1492

1812

1493

tcp_server = MandosServer((server_settings[u"address"],

1494

server_settings[u"port"]),

1813

tcp_server = MandosServer((server_settings["address"],

1814

server_settings["port"]),

1495

1815

ClientHandler,

1496

interface=server_settings[u"interface"],

1816

interface=(server_settings["interface"]

1817

or None),

1497

1818

use_ipv6=use_ipv6,

1498

1819

gnutls_priority=

1499

server_settings[u"priority"],

1820

server_settings["priority"],

1500

1821

use_dbus=use_dbus)

1501

pidfilename = u"/var/run/mandos.pid"

1502

try:

1503

pidfile = open(pidfilename, u"w")

1504

except IOError:

1505

logger.error(u"Could not open file %r", pidfilename)

1822

if not debug:

1823

pidfilename = "/var/run/mandos.pid"

1824

try:

1825

pidfile = open(pidfilename, "w")

1826

except IOError:

1827

logger.error("Could not open file %r", pidfilename)

1506

1828

1507

1829

try:

1508

uid = pwd.getpwnam(u"_mandos").pw_uid

1509

gid = pwd.getpwnam(u"_mandos").pw_gid

1830

uid = pwd.getpwnam("_mandos").pw_uid

1831

gid = pwd.getpwnam("_mandos").pw_gid

1510

1832

except KeyError:

1511

1833

try:

1512

uid = pwd.getpwnam(u"mandos").pw_uid

1513

gid = pwd.getpwnam(u"mandos").pw_gid

1834

uid = pwd.getpwnam("mandos").pw_uid

1835

gid = pwd.getpwnam("mandos").pw_gid

1514

1836

except KeyError:

1515

1837

try:

1516

uid = pwd.getpwnam(u"nobody").pw_uid

1517

gid = pwd.getpwnam(u"nobody").pw_gid

1838

uid = pwd.getpwnam("nobody").pw_uid

1839

gid = pwd.getpwnam("nobody").pw_gid

1518

1840

except KeyError:

1519

1841

uid = 65534

1520

1842

gid = 65534

1521

1843

try:

1522

1844

os.setgid(gid)

1523

1845

os.setuid(uid)

1524

except OSError, error:

1846

except OSError as error:

1525

1847

if error[0] != errno.EPERM:

1526

1848

raise error

1527

1849

1528

# Enable all possible GnuTLS debugging

1850

if not debug and not debuglevel:

1851

syslogger.setLevel(logging.WARNING)

1852

console.setLevel(logging.WARNING)

1853

if debuglevel:

1854

level = getattr(logging, debuglevel.upper())

1855

syslogger.setLevel(level)

1856

console.setLevel(level)

1857

1529

1858

if debug:

1859

# Enable all possible GnuTLS debugging

1860

1530

1861

# "Use a log level over 10 to enable all debugging options."

1531

1862

# - GnuTLS manual

1532

1863

gnutls.library.functions.gnutls_global_set_log_level(11)

1533

1864

1534

1865

@gnutls.library.types.gnutls_log_func

1535

1866

def debug_gnutls(level, string):

1536

logger.debug(u"GnuTLS: %s", string[:-1])

1867

logger.debug("GnuTLS: %s", string[:-1])

1537

1868

1538

1869

(gnutls.library.functions

1539

1870

.gnutls_global_set_log_function(debug_gnutls))

1871

1872

# Redirect stdin so all checkers get /dev/null

1873

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1874

os.dup2(null, sys.stdin.fileno())

1875

if null > 2:

1876

os.close(null)

1877

else:

1878

# No console logging

1879

logger.removeHandler(console)

1880

1881

# Need to fork before connecting to D-Bus

1882

if not debug:

1883

# Close all input and output, do double fork, etc.

1884

daemon()

1540

1885

1541

1886

global main_loop

1542

1887

# From the Avahi example code

1545

1890

bus = dbus.SystemBus()

1546

1891

# End of Avahi example code

1547

1892

if use_dbus:

1548

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1893

try:

1894

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1895

bus, do_not_queue=True)

1896

except dbus.exceptions.NameExistsException as e:

1897

logger.error(unicode(e) + ", disabling D-Bus")

1898

use_dbus = False

1899

server_settings["use_dbus"] = False

1900

tcp_server.use_dbus = False

1549

1901

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1550

service = AvahiService(name = server_settings[u"servicename"],

1551

servicetype = u"_mandos._tcp",

1902

service = AvahiService(name = server_settings["servicename"],

1903

servicetype = "_mandos._tcp",

1552

1904

protocol = protocol, bus = bus)

1553

1905

if server_settings["interface"]:

1554

1906

service.interface = (if_nametoindex

1555

(str(server_settings[u"interface"])))

1907

(str(server_settings["interface"])))

1908

1909

global multiprocessing_manager

1910

multiprocessing_manager = multiprocessing.Manager()

1556

1911

1557

1912

client_class = Client

1558

1913

if use_dbus:

1559

1914

client_class = functools.partial(ClientDBus, bus = bus)

1915

def client_config_items(config, section):

1916

special_settings = {

1917

"approved_by_default":

1918

lambda: config.getboolean(section,

1919

"approved_by_default"),

1920

}

1921

for name, value in config.items(section):

1922

try:

1923

yield (name, special_settings[name]())

1924

except KeyError:

1925

yield (name, value)

1926

1560

1927

tcp_server.clients.update(set(

1561

1928

client_class(name = section,

1562

config= dict(client_config.items(section)))

1929

config= dict(client_config_items(

1930

client_config, section)))

1563

1931

for section in client_config.sections()))

1564

1932

if not tcp_server.clients:

1565

logger.warning(u"No clients defined")

1566

1567

if debug:

1568

# Redirect stdin so all checkers get /dev/null

1569

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1570

os.dup2(null, sys.stdin.fileno())

1571

if null > 2:

1572

os.close(null)

1573

else:

1574

# No console logging

1575

logger.removeHandler(console)

1576

# Close all input and output, do double fork, etc.

1577

daemon()

1578

1579

try:

1580

with closing(pidfile):

1581

pid = os.getpid()

1582

pidfile.write(str(pid) + "\n")

1583

del pidfile

1584

except IOError:

1585

logger.error(u"Could not write to file %r with PID %d",

1586

pidfilename, pid)

1587

except NameError:

1588

# "pidfile" was never created

1589

pass

1590

del pidfilename

1591

1592

def cleanup():

1593

"Cleanup function; run on exit"

1594

service.cleanup()

1933

logger.warning("No clients defined")

1595

1934

1596

while tcp_server.clients:

1597

client = tcp_server.clients.pop()

1598

client.disable_hook = None

1599

client.disable()

1600

1601

atexit.register(cleanup)

1602

1603

1935

if not debug:

1936

try:

1937

with pidfile:

1938

pid = os.getpid()

1939

pidfile.write(str(pid) + "\n".encode("utf-8"))

1940

del pidfile

1941

except IOError:

1942

logger.error("Could not write to file %r with PID %d",

1943

pidfilename, pid)

1944

except NameError:

1945

# "pidfile" was never created

1946

pass

1947

del pidfilename

1948

1604

1949

signal.signal(signal.SIGINT, signal.SIG_IGN)

1950

1605

1951

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1606

1952

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1607

1953

1609

1955

class MandosDBusService(dbus.service.Object):

1610

1956

"""A D-Bus proxy object"""

1611

1957

def __init__(self):

1612

dbus.service.Object.__init__(self, bus, u"/")

1613

_interface = u"se.bsnet.fukt.Mandos"

1614

1615

@dbus.service.signal(_interface, signature=u"oa{sv}")

1616

def ClientAdded(self, objpath, properties):

1617

"D-Bus signal"

1618

pass

1619

1620

@dbus.service.signal(_interface, signature=u"s")

1621

def ClientNotFound(self, fingerprint):

1622

"D-Bus signal"

1623

pass

1624

1625

@dbus.service.signal(_interface, signature=u"os")

1958

dbus.service.Object.__init__(self, bus, "/")

1959

_interface = "se.bsnet.fukt.Mandos"

1960

1961

@dbus.service.signal(_interface, signature="o")

1962

def ClientAdded(self, objpath):

1963

"D-Bus signal"

1964

pass

1965

1966

@dbus.service.signal(_interface, signature="ss")

1967

def ClientNotFound(self, fingerprint, address):

1968

"D-Bus signal"

1969

pass

1970

1971

@dbus.service.signal(_interface, signature="os")

1626

1972

def ClientRemoved(self, objpath, name):

1627

1973

"D-Bus signal"

1628

1974

pass

1629

1975

1630

@dbus.service.method(_interface, out_signature=u"ao")

1976

@dbus.service.method(_interface, out_signature="ao")

1631

1977

def GetAllClients(self):

1632

1978

"D-Bus method"

1633

1979

return dbus.Array(c.dbus_object_path

1634

1980

for c in tcp_server.clients)

1635

1981

1636

1982

@dbus.service.method(_interface,

1637

out_signature=u"a{oa{sv}}")

1983

out_signature="a{oa{sv}}")

1638

1984

def GetAllClientsWithProperties(self):

1639

1985

"D-Bus method"

1640

1986

return dbus.Dictionary(

1641

((c.dbus_object_path, c.GetAll(u""))

1987

((c.dbus_object_path, c.GetAll(""))

1642

1988

for c in tcp_server.clients),

1643

signature=u"oa{sv}")

1989

signature="oa{sv}")

1644

1990

1645

@dbus.service.method(_interface, in_signature=u"o")

1991

@dbus.service.method(_interface, in_signature="o")

1646

1992

def RemoveClient(self, object_path):

1647

1993

"D-Bus method"

1648

1994

for c in tcp_server.clients:

1650

1996

tcp_server.clients.remove(c)

1651

1997

c.remove_from_connection()

1652

1998

# Don't signal anything except ClientRemoved

1653

c.disable(signal=False)

1999

c.disable(quiet=True)

1654

2000

# Emit D-Bus signal

1655

2001

self.ClientRemoved(object_path, c.name)

1656

2002

return

1657

raise KeyError

2003

raise KeyError(object_path)

1658

2004

1659

2005

del _interface

1660

2006

1661

2007

mandos_dbus_service = MandosDBusService()

1662

2008

2009

def cleanup():

2010

"Cleanup function; run on exit"

2011

service.cleanup()

2012

2013

while tcp_server.clients:

2014

client = tcp_server.clients.pop()

2015

if use_dbus:

2016

client.remove_from_connection()

2017

client.disable_hook = None

2018

# Don't signal anything except ClientRemoved

2019

client.disable(quiet=True)

2020

if use_dbus:

2021

# Emit D-Bus signal

2022

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2023

client.name)

2024

2025

atexit.register(cleanup)

2026

1663

2027

for client in tcp_server.clients:

1664

2028

if use_dbus:

1665

2029

# Emit D-Bus signal

1666

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1667

client.GetAll(u""))

2030

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1668

2031

client.enable()

1669

2032

1670

2033

tcp_server.enable()

1673

2036

# Find out what port we got

1674

2037

service.port = tcp_server.socket.getsockname()[1]

1675

2038

if use_ipv6:

1676

logger.info(u"Now listening on address %r, port %d,"

2039

logger.info("Now listening on address %r, port %d,"

1677

2040

" flowinfo %d, scope_id %d"

1678

2041

% tcp_server.socket.getsockname())

1679

2042

else: # IPv4

1680

logger.info(u"Now listening on address %r, port %d"

2043

logger.info("Now listening on address %r, port %d"

1681

2044

% tcp_server.socket.getsockname())

1682

2045

1683

2046

#service.interface = tcp_server.socket.getsockname()[3]

1686

2049

# From the Avahi example code

1687

2050

try:

1688

2051

service.activate()

1689

except dbus.exceptions.DBusException, error:

1690

logger.critical(u"DBusException: %s", error)

2052

except dbus.exceptions.DBusException as error:

2053

logger.critical("DBusException: %s", error)

2054

cleanup()

1691

2055

sys.exit(1)

1692

2056

# End of Avahi example code

1693

2057

1696

2060

(tcp_server.handle_request

1697

2061

(*args[2:], **kwargs) or True))

1698

2062

1699

logger.debug(u"Starting main loop")

2063

logger.debug("Starting main loop")

1700

2064

main_loop.run()

1701

except AvahiError, error:

1702

logger.critical(u"AvahiError: %s", error)

2065

except AvahiError as error:

2066

logger.critical("AvahiError: %s", error)

2067

cleanup()

1703

2068

sys.exit(1)

1704

2069

except KeyboardInterrupt:

1705

2070

if debug:

1706

print >> sys.stderr

1707

logger.debug(u"Server received KeyboardInterrupt")

1708

logger.debug(u"Server exiting")

2071

print("", file=sys.stderr)

2072

logger.debug("Server received KeyboardInterrupt")

2073

logger.debug("Server exiting")

2074

# Must run before the D-Bus bus name gets deregistered

2075

cleanup()

1709

2076

1710

2077

if __name__ == '__main__':

1711

2078

main()